theokit 0.48.13 → 0.50.0

package/dist/server/index.d.ts

@@ -1,15 +1,17 @@
-import { RouteConfig } from './define/index.js';
+import { R as RouteConfig } from '../route-config-Cm_ZMA1C.js';
 export { ActionAccept, ActionBuilder, ActionConfig, ChannelHandler, MiddlewareBuilder, MiddlewareHandler, PluginBuilder, RouteBuilder, ToolBuilder, WebChannelHandler, WebSocketBuilder, action, defineChannel, defineWebChannel, middleware, plugin, route, tool, uiMessageStreamResponse, websocket } from './define/index.js';
 export { W as WebSocketHandler, a as WebSocketHandlerWeb, b as WebSocketLike } from '../define-websocket-DzPn1sR6.js';
 export { C as CustomTool, D as DefineAgentToolSpec, T as ToolContextMessage, a as ToolHandlerContext, b as ToolTransform, c as applyTransform } from '../define-agent-tool-cRuSpidb.js';
+export { A as AccessDecision, R as RoutePolicy, b as RoutePolicyInput, a as RouteSubject, e as evaluateRoutePolicy, r as requireOwner, s as subjectFromContext } from '../route-policy-BxOycCDq.js';
 export { H as HEALTH_PATH, a as HealthRouteConfig, b as READY_PATH, c as ReadyRouteConfig, d as ReservedResponse, R as ReservedRoutes, e as defineHealthRoute, f as defineReadyRoute, s as serveReservedRoute } from '../health-route-C0hk64_U.js';
-export { B as BATCH_PATH, a as BatchExecuteFn, b as BatchPathConflictError, c as BatchPayload, d as BatchRequestItem, e as BatchResponse, f as BatchResultItem, C as CookieOptions, g as CorsConfig, h as CorsHandler, i as CorsOrigin, j as CorsWebHandler, k as CustomErrorPages, E as ExecuteActionOptions, l as ExecuteRouteContext, H as HandleBatchOptions, M as MAX_ERROR_HTML_BYTES, m as MiddlewareResult, N as NotFoundError, S as STRIPPED_HEADERS, n as SendErrorInput, o as SendErrorOptions, T as TRACE_HEADER, p as TRACE_PARENT_HEADER, q as TheoError, r as TheoTransformer, _ as _resetMiddlewareCacheForTests, s as appendCookieToHeaders, t as appendDeleteCookieToHeaders, u as createCorsHandler, v as createCorsWebHandler, w as deleteCookie, x as envelopeCodeToStatus, y as executeAction, z as executeRoute, A as extractTraceId, D as extractTraceIdFromRequest, F as fromUnknown, G as getCookie, I as getCookieFromRequest, J as handleBatchRequest, K as handleRequestError, L as handleWebRequestError, O as jsonTransformer, P as loadCustomErrorPages, Q as matchesOrigin, R as parseCookieHeader, U as parseTraceparent, V as resolveTransformer, W as runMiddlewareAndContext, X as sendError, Y as sendJson, Z as serializeCookie, $ as serveStaticFile, a0 as serverErrorToEnvelope, a1 as setCookie, a2 as superjsonTransformer } from '../index-BEtEv6ZH.js';
-export { ActionNode, ActionScanError, LoadedManifest, ManifestAction, ManifestAgent, ManifestRoute, ManifestWebSocket, TheoManifest, WebSocketRouteNode, generateManifest, loadManifest, scanMiddlewares, scanServerActions, scanServerActionsEnriched, scanServerRoutes, scanWebSocketRoutes, writeManifest } from './scan/index.js';
-export { L as LoadModule, S as ServerRouteNode, c as compilePattern, a as createProductionLoader, b as createViteLoader, m as matchRoute } from '../match-CfbEFRG4.js';
-import { T as TheoErrorEnvelope, a as TheoErrorCode, V as ValidationFieldsExt } from '../error-envelope-DG47lt8E.js';
-export { AcpToolConfig, AppResource, AppResourceInput, ChannelMessage, ChannelWebhookConfig, CodeModeApi, CodeModeConfig, CodeModePermission, CodeModePermissionDeniedError, McpResourceContents, McpResourceDescriptor, NodeAcpTransport, ProviderDescriptor, ResolvedProvider, Sandbox, StdioStreams, VendorAgentClient, VendorAgentToolConfig, WorkflowLike, WorkflowToolConfig, buildResourceDescriptors, createACPTool, createCodeMode, createVendorAgentTool, createWorkflowTool, defineAppResource, extractAppResources, handleChannelWebhook, handleMcpStdioLine, isChannelPath, listProviders, parseChannelPath, readAppResource, registerProvider, resetProviderRegistry, resolveProvider, serveMcpStdio, tryResolveProvider } from './agent/index.js';
+export { A as ActionError, a as ActionErrorCode, b as ActionInputError, c as ActionManifestEntry, d as ActionResult, B as BATCH_PATH, e as BatchExecuteFn, f as BatchPathConflictError, g as BatchPayload, h as BatchRequestItem, i as BatchResponse, j as BatchResultItem, k as BodyParserOptions, C as CookieOptions, l as CorsConfig, m as CorsHandler, n as CorsOrigin, o as CorsWebHandler, p as CustomErrorPages, E as ExecuteActionOptions, q as ExecuteRouteContext, F as FileTooLargeError, H as HandleBatchOptions, M as MAX_ERROR_HTML_BYTES, r as MiddlewareResult, N as NotFoundError, O as OpenApiDocsOptions, P as ParsedBody, s as ProcedureInput, t as ProcedureInputError, u as ProcedureOutputError, R as RawRouteInput, v as RouteInputChannel, w as RouteInputSchemas, x as RouteInputValidation, S as STRIPPED_HEADERS, y as SendErrorInput, z as SendErrorOptions, D as SerializedActionResult, T as TRACE_HEADER, G as TRACE_PARENT_HEADER, I as TheoError, J as TheoTransformer, U as UniversalZodIssue, K as UploadedFile, W as W3CTraceContext, _ as _resetMiddlewareCacheForTests, L as appendCookieToHeaders, Q as appendDeleteCookieToHeaders, V as callProcedure, X as createCorsHandler, Y as createCorsWebHandler, Z as createOpenApiHandler, $ as createServerContext, a0 as deleteCookie, a1 as envelopeCodeToStatus, a2 as executeAction, a3 as executeRoute, a4 as executeWebRequest, a5 as extractTraceId, a6 as extractTraceIdFromRequest, a7 as extractUniversalIssues, a8 as extractW3CTraceContext, a9 as fromUnknown, aa as getCookie, ab as getCookieFromRequest, ac as handleBatchRequest, ad as handleRequestError, ae as handleWebRequestError, af as isActionError, ag as isInputError, ah as jsonTransformer, ai as loadCustomErrorPages, aj as matchesOrigin, ak as parseCookieHeader, al as parseRequestBody, am as parseTraceparent, an as parseTraceparentContext, ao as resolveTransformer, ap as runMiddlewareAndContext, aq as sendError, ar as sendJson, as as serializeCookie, at as serveStaticFile, au as serverErrorToEnvelope, av as setCookie, aw as superjsonTransformer, ax as validateRouteInput } from '../index-CzxtQcnp.js';
+export { ACTION_SCHEMAS_DIR, ActionNode, ActionScanError, LoadedManifest, ManifestAction, ManifestAgent, ManifestRoute, ManifestWebSocket, TheoManifest, WebSocketRouteNode, _resetRouteScanCacheForTests, compareRouteSpecificity, generateManifest, loadManifest, scanMiddlewares, scanServerActions, scanServerActionsEnriched, scanServerRoutes, scanWebSocketRoutes, writeManifest } from './scan/index.js';
+export { L as LoadModule, S as ServerRouteNode, c as compilePattern, a as createProductionLoader, b as createViteLoader, m as matchRoute } from '../match-DmGgxjIU.js';
+export { AcpToolConfig, AppResource, AppResourceInput, ChannelMessage, ChannelWebhookConfig, CodeModeApi, CodeModeConfig, CodeModePermission, CodeModePermissionDeniedError, McpResourceContents, McpResourceDescriptor, NodeAcpTransport, Sandbox, StdioStreams, VendorAgentClient, VendorAgentToolConfig, WorkflowLike, WorkflowToolConfig, buildResourceDescriptors, createACPTool, createCodeMode, createVendorAgentTool, createWorkflowTool, defineAppResource, extractAppResources, handleChannelWebhook, handleMcpStdioLine, isChannelPath, parseChannelPath, readAppResource, serveMcpStdio } from './agent/index.js';
 export { InProcessApprovalRequest, InProcessApprovalRequiredError, InProcessAwaitApproval, StreamAgentTurnDeps, StreamAgentTurnInProcessInput, streamAgentTurnInProcess } from '@theokit/agents';
-export { AuthRequiredError, BackupCode, BackupCodeOptions, OidcMetadata, PkceChallenge, SessionConfig, SessionManager, SessionManagerWeb, SessionMeta, ThrottleOptions, ThrottleState, TotpAlgorithm, TotpOptions, TotpUriOptions, VerifyTotpOptions, _resetKeyCacheForTests, assertProductionSecret, checkThrottle, clearOidcCache, createSessionManager, createSessionManagerWeb, decrypt, discoverOidcProvider, encrypt, generateBackupCodes, generateNonce, generateOAuthState, generatePkceChallenge, generateTotp, generateTotpSecret, pkceChallengeFromVerifier, recordAttempt, requireAuth, rotateIfNeeded, rotateIfNeededWeb, totpUri, verifyBackupCode, verifyOAuthState, verifyTotp } from './auth/index.js';
+export { P as ProviderDescriptor, R as ResolvedProvider, l as listProviders, a as registerProvider, b as resetProviderRegistry, r as resolveProvider, t as tryResolveProvider } from '../provider-resolver-Dx6QuWrw.js';
+export { AuthRequiredError, BackupCode, BackupCodeOptions, OidcMetadata, PkceChallenge, SessionConfig, SessionManager, SessionManagerWeb, SessionMeta, ThrottleOptions, ThrottleState, TotpAlgorithm, TotpOptions, TotpUriOptions, VerifyTotpOptions, _resetKeyCacheForTests, assertProductionSecret, checkThrottle, clearOidcCache, createSessionManager, createSessionManagerWeb, decrypt, discoverOidcProvider, encrypt, generateBackupCodes, generateOAuthState, generatePkceChallenge, generateTotp, generateTotpSecret, pkceChallengeFromVerifier, recordAttempt, requireAuth, rotateIfNeeded, rotateIfNeededWeb, totpUri, verifyBackupCode, verifyOAuthState, verifyTotp } from './auth/index.js';
+export { g as generateNonce } from '../nonce-BXt7Qu_C.js';
 export { InMemoryUsageStorage, ToolHookEvent, ToolUsageRecord, TrackAgentRunInput, TrackAgentRunOptions, TrackAgentToolsHooks, TrackAgentToolsOptions, UsageQuery, UsageRecord, UsageResult, UsageStorageAdapter, trackAgentRun, trackAgentTools } from './cost/index.js';
 export { InMemoryUsageStorage as NeutralUsageStorage } from '@theokit/agents/usage';
 export { CRON_MANIFEST_SCHEMA_VERSION, CronConcurrencyPolicy, CronContext, CronDefinition, CronManifest, CronManifestEntry, CronNode, CronOptions, CronScheduler, DuplicateCronNameError, ExistingConfigUnparseableError, buildCronManifest, convertToAwsCron, createCronScheduler, defineCron, scanCronDirs, scanCrons, translateCronToAws, translateCronToCloudflare, translateCronToDeno, translateCronToVercel, validateCronSchedule, writeCronManifest } from './cron/index.js';
@@ -17,211 +19,32 @@ export { DuplicateContextKeyError, DuplicateJobNameError, EnqueueOptions, InMemo
 export { J as JobBackend, a as JobEnqueueInput, b as JobLease, N as NonRetryableError } from '../job-backend-CgC8Xf33.js';
 export { ConsoleObservabilityAdapter, LogLevel, LoggerFn, NoopObservabilityAdapter, NoopSpan, ObservabilityAdapter, RequestLog, SpanAttributes, SpanHandle, SpanImpl, StructuredLog, TheoCloudObservabilityAdapter, TheoLogger, _resetWarnOnceForTests, createLogger, createObservabilityPlugin, defineObservabilityAdapter, findSuggestion, levenshtein, logRequest, resolveAdapter, serializeSpansToOtlp, warnOnce } from './observability/index.js';
 export { a as AuditEvent, A as AuditLogger, J as JsonStdoutSink, c as createNoOpLogger, s as safeAudit } from '../audit-log-BQWM5YLG.js';
-export { D as DuplicateDecorationError, a as DuplicatePluginError, P as PluginRunner } from '../plugin-runner-BFEcgtmJ.js';
+export { D as DuplicateDecorationError, a as DuplicatePluginError, P as PluginRunner } from '../plugin-runner-BVMOSxvb.js';
 export { InvalidPluginShapeError, createPluginRunnerFromConfig } from './plugins/index.js';
 export { R as RateLimitConfig, a as RateLimitResult, c as createRateLimiter, b as createRateLimiterWeb } from '../rate-limit-BdNDZ3vt.js';
 export { I as InMemoryStore, a as RateLimitState, R as RateLimitStore } from '../rate-limit-store-BEJnhWdw.js';
 export { DeriveKeyRequestContext, KeyByMode, RouteRateLimitConfig, createRouteRateLimiter, createRouteRateLimiterWeb, deriveKey, deriveKeyFromRequest, matchRoutePattern } from './rate-limit/index.js';
 export { ChannelManager } from './realtime/index.js';
-export { CSP_REPORT_PATH, CSRF_READINESS_PATH, CSRF_READINESS_RESET_PATH, CspMode, CspReportHandlerOptions, CspViolation, DEFAULT_CSP, DEFAULT_PERMISSIONS_POLICY, SecurityEnv, SecurityHeadersConfig, SecurityHeadersOptions, applySecurityHeaders, buildSecurityHeaders, handleCspReport, handleCspReportRequest, handleCsrfReadiness, handleCsrfReadinessRequest, normalizeLegacy, normalizeNew } from './security/index.js';
-export { C as CSRF_WARN_CODE, a as CSRF_WARN_DOCS_URL, b as CsrfLogger, c as CsrfMode, d as CsrfWarnPayload, D as DisallowedConfig, e as enforceCsrf, m as matchDisallowed, v as validateCsrf, f as validateCsrfRequest } from '../csrf-BBrEZSBW.js';
+export { CSP_REPORT_PATH, CSRF_READINESS_PATH, CSRF_READINESS_RESET_PATH, CspReportHandlerOptions, CspViolation, CsrfDecision, CsrfMultiHeaderOptions, applySecurityHeaders, evaluateCsrfMultiHeaderRequest, handleCspReport, handleCspReportRequest, handleCsrfReadiness, handleCsrfReadinessRequest, isCsrfOriginAllowed, matchWildcardDomain, normalizeLegacy, normalizeNew } from './security/index.js';
+export { a as CSRF_WARN_CODE, b as CSRF_WARN_DOCS_URL, c as CsrfLogger, C as CsrfMode, d as CsrfWarnPayload, D as DisallowedConfig, e as enforceCsrf, m as matchDisallowed, v as validateCsrf, f as validateCsrfRequest } from '../csrf-Dgot9qSM.js';
 export { a as CsrfReadinessRouteSummary, C as CsrfReadinessStore, b as CsrfReadinessSummary, c as CsrfWarnRecord } from '../csrf-readiness-store-CjIoub3U.js';
 export { P as PostgresFactory, R as RedisFactory, S as StorageManager, g as getStorageManager } from '../storage-manager-C6hmsaer.js';
 export { Db0Database, UnstorageInstance, useDatabase, useUnstorage } from './storage/index.js';
 export { G as GenericFactory, a as PoolLike, P as PostgresDatabaseConfig, c as RedisLike, R as RedisServerConfig, S as ServerConfig, d as StorageAdapter, b as StorageConfig, T as TlsConfig } from '../storage-types-DsDTCPbp.js';
-export { BodyTooLargeError, DEFAULT_MAX_BODY_BYTES, RawBodyResult, ReadRawBodyOptions, defineWebhook, dispatchWebhook, readRawBody, timingSafeEqual } from './webhook/index.js';
+export { BodyTooLargeError, DEFAULT_MAX_BODY_BYTES, DiscordWebhookOptions, GitHubWebhookOptions, RawBodyResult, ReadRawBodyOptions, SlackWebhookOptions, StripeWebhookOptions, TelegramWebhookOptions, defineWebhook, discord, dispatchWebhook, github, readRawBody, slack, stripe, telegram, timingSafeEqual } from './webhook/index.js';
 export { D as DefineWebhookOptions, V as VerifyFn, a as VerifyResult, W as WebhookContext, b as WebhookDefinition } from '../webhook-types-DGIjjcaI.js';
 import { z } from 'zod';
-import { IncomingMessage } from 'node:http';
-import { W as WebOnRequestHook, b as WebPreHandlerHook, c as WebOnResponseHook, d as WebOnErrorHook } from '../plugin-types-D69-lJZ9.js';
-export { e as HookName, H as HookResult, O as OnErrorHook, f as OnRequestHook, g as OnResponseHook, P as PluginContext, h as PluginErrorContext, i as PreHandlerHook, R as RunHookOptions, a as TheoApp, T as TheoPlugin } from '../plugin-types-D69-lJZ9.js';
+export { b as HookName, H as HookResult, O as OnErrorHook, c as OnRequestHook, d as OnResponseHook, P as PluginContext, e as PluginErrorContext, f as PreHandlerHook, R as RunHookOptions, a as TheoApp, T as TheoPlugin } from '../plugin-types-BUVfUQ0V.js';
 export { ComposeInstructionsOptions, ComposedInstructions, ConfigLayer, ContextPressure, ContextPressureThresholdError, ContextPressureThresholds, CustomCommand, CustomCommandsResult, DEFAULT_CONTEXT_PRESSURE_THRESHOLDS, InstructionBlock, InstructionSource, InstructionTree, InstructionTreeBudget, LayerOutOfOrderError, LayeredConfig, LayeredConfigInput, LayeredConfigResult, LoadCustomCommandsInput, LoadInstructionTreeInput, ParsedFrontmatter, PrecedenceReport, ProvenancePerKey, TrustRecord, TrustStore, TrustStorePermissionsError, composeInstructions, contextPressure, effectiveContextWindow, frontmatterValue, loadCustomCommands, loadInstructionTree, splitFrontmatter } from '@theokit/agents/config';
 export { a as ServiceDefinition, S as ServicesConfig, b as ServicesConfigInput, c as ServicesConfigOutput } from '../schema-BdakLtuC.js';
+export { C as CspMode, D as DEFAULT_CSP, a as DEFAULT_PERMISSIONS_POLICY, c as SecurityEnv, S as SecurityHeadersConfig, d as SecurityHeadersOptions, b as buildSecurityHeaders } from '../security-headers-Ccj7ncNx.js';
 import '@theokit/presenter/wire';
+import 'node:http';
+import '../error-envelope-DG47lt8E.js';
+import '../agent-scan-BZa-pagG.js';
 import 'vite';
 import '@theokit/sdk';
 
-/**
- * Action protocol — cross-boundary contract for `defineAction` + `useAction`.
- *
- * Per plan g3-server-actions-and-useaction v1.2 § Phase 0 / T0.1, ADRs D1 (encoding)
- * + D6 (full dot-notation path) + D7 (PII mask) — types and runtime referenced
- * by server (`server/http/action-execute.ts`, `server/define/define-action.ts`)
- * and client (`@theokit/react/useAction`, `vite-plugin/actions-virtual-module`).
- *
- * Lives in `core/contracts/` per architecture.md v3.1 exception — cross-module
- * deep imports ALLOWED for this file. Core depends on NOTHING intra-monorepo;
- * `extractUniversalIssues` is implemented INLINE (NOT imported from `@theokit/sdk`)
- * to honor dep-cruiser `core-depends-on-nothing` invariant (EC-1 absorbed).
- *
- * Field-key convention (D6 + EC-13): dot-notation full path. Nested objects use
- * `'user.address.zip'`; array indices use `'items.0.name'` (NOT bracket
- * `'items[0].name'`). Root-level errors (path = []) use empty string `''`
- * (EC-7). Consumers needing bracket notation can write a small `dotToBracket`
- * helper in userland.
- */
-
-/**
- * HTTP-status mapping per IANA HTTP Status Code Registry (subset relevant to
- * action surface). VALIDATION_ERROR → 422 is preferred over Astro's BAD_REQUEST/400
- * (more semantic for input-shape mismatch). PAYLOAD_TOO_LARGE → 413 covers EC-3
- * (response-side size limit; request-side reuses standard 413).
- */
-type ActionErrorCode = 'VALIDATION_ERROR' | 'BAD_REQUEST' | 'UNAUTHORIZED' | 'FORBIDDEN' | 'NOT_FOUND' | 'METHOD_NOT_ALLOWED' | 'CONFLICT' | 'CONTENT_TOO_LARGE' | 'PAYLOAD_TOO_LARGE' | 'UNSUPPORTED_MEDIA_TYPE' | 'TOO_MANY_REQUESTS' | 'INTERNAL_SERVER_ERROR';
-/**
- * Universal zod issue shape covering BOTH v3 (`z.ZodIssue`) and v4 (`$ZodIssue`).
- * Duck-typed minimum surface: `{path, message}`. Implemented per EC-1 absorbed —
- * consumers chain may ship either zod major; constructor accepts `unknown` and
- * normalizes via `extractUniversalIssues`.
- */
-interface UniversalZodIssue {
-    readonly path: readonly (string | number)[];
-    readonly message: string;
-    readonly code?: string;
-}
-/**
- * `ActionError` — general server-side action failure. Discriminator `type` is
- * literal `'TheoActionError'`; used by `ActionError.fromJson` to distinguish
- * from `ActionInputError`.
- */
-declare class ActionError extends Error {
-    readonly type: 'TheoActionError' | 'TheoActionInputError';
-    readonly code: ActionErrorCode;
-    readonly status: number;
-    constructor(params: {
-        code: ActionErrorCode;
-        message?: string;
-        stack?: string;
-    });
-    /**
-     * G5 T2.4 — canonical envelope view of the action error. Maps the G3
-     * ActionErrorCode to a canonical TheoErrorCode (VALIDATION_ERROR ↔
-     * UNPROCESSABLE_ENTITY, CONTENT_TOO_LARGE ↔ PAYLOAD_TOO_LARGE) so consumer
-     * UI / SDK code can switch on the unified envelope.
-     *
-     * Subclasses override to populate `ext` (see `ActionInputError.envelope`).
-     */
-    get envelope(): TheoErrorEnvelope;
-    /**
-     * Translate G3 ActionErrorCode → canonical TheoErrorCode (blueprint
-     * Recommendations § "G3 ActionError becomes inaugural envelope user").
-     */
-    static toTheoErrorCode(code: ActionErrorCode): TheoErrorCode;
-    static codeToStatus(code: ActionErrorCode): number;
-    static statusToCode(status: number): ActionErrorCode;
-    /**
-     * Parse a serialized error JSON back into the typed class hierarchy.
-     * Distinguishes `TheoActionInputError` (with `issues` array) from
-     * `TheoActionError` via the `type` discriminator. Falls back to
-     * `INTERNAL_SERVER_ERROR` for malformed bodies (non-object, missing
-     * `type`, unknown `code`).
-     */
-    static fromJson(body: unknown): ActionError;
-}
-/**
- * `ActionInputError` — validation failure with field-level mapping.
- *
- * `fields` is auto-derived from `issues`: for each issue, key = full
- * dot-notation path (`'user.address.zip'`; root-level `path:[]` → `''`;
- * array indices as numeric segments → `'items.0.name'`). Multiple messages
- * for the same key accumulate; duplicate (path, message) tuples are deduped.
- */
-declare class ActionInputError extends ActionError {
-    readonly type: "TheoActionInputError";
-    readonly issues: readonly UniversalZodIssue[];
-    readonly fields: Record<string, string[]>;
-    constructor(rawIssues: unknown);
-    /**
-     * G5 T2.4 — envelope view with ValidationFieldsExt populated from .fields.
-     * UI consumers can `switch (env.code)` on `UNPROCESSABLE_ENTITY` and read
-     * `(env.ext as ValidationFieldsExt).fields` for field-level rendering.
-     */
-    get envelope(): TheoErrorEnvelope<ValidationFieldsExt>;
-}
-/**
- * Normalize zod v3 (`z.ZodIssue`) and v4 (`$ZodIssue`) raw issues to
- * `UniversalZodIssue[]` (EC-1 absorbed). Duck-typed on `{path, message}` —
- * does NOT import zod types (`core/contracts/` depends on no intra-monorepo
- * + zod is consumer-controlled across the boundary).
- *
- * Silently skips entries missing required fields or shape mismatches; returns
- * empty array on non-array input.
- */
-declare function extractUniversalIssues(raw: unknown): UniversalZodIssue[];
-/**
- * Type guard for `ActionError` (and its subclass `ActionInputError`). True
- * iff the value is an instance of `ActionError`. Use `isInputError` to
- * narrow specifically to validation failures.
- */
-declare function isActionError(value: unknown): value is ActionError;
-/**
- * Type guard narrowing to `ActionInputError`. Requires `instanceof` check
- * (not duck-typing on `type`) to prevent attacker-controlled JSON from
- * being mistaken for a real error instance.
- */
-declare function isInputError(value: unknown): value is ActionInputError;
-/**
- * `ActionResult<TData, TError>` — discriminated union returned by client-side
- * action invocation. Either `{data, error: undefined}` (success) or
- * `{data: undefined, error}` (failure). Mirrors Astro `SafeResult` shape.
- */
-type ActionResult<TData = unknown, TError extends ActionError = ActionError> = {
-    data: TData;
-    error: undefined;
-} | {
-    data: undefined;
-    error: TError;
-};
-/**
- * `SerializedActionResult` — wire-shape emitted by `serializeActionResult`
- * in `server/http/serialize-action-result.ts` (T1.3). Discriminator `type`
- * distinguishes data (devalue-encoded), error (JSON), and empty (204) cases.
- */
-type SerializedActionResult = {
-    type: 'data';
-    status: number;
-    contentType: 'application/json+devalue';
-    body: string;
-} | {
-    type: 'error';
-    status: number;
-    contentType: 'application/json';
-    body: string;
-} | {
-    type: 'empty';
-    status: 204;
-};
-/**
- * `ActionManifestEntry` — per-action metadata emitted by `action-scan.ts`
- * (T1.4) into `.theokit/actions-manifest.json`. Consumed by virtual module
- * `@theo/actions` (T3.1) and G4 devtools "Actions" tab (T5.1).
- */
-interface ActionManifestEntry {
-    readonly name: string;
-    readonly filePath: string;
-    readonly urlPath: string;
-    readonly accept: 'form' | 'json';
-    readonly hasInput: boolean;
-}
-
-interface OpenApiDocsOptions {
-    /** Path to serve Scalar UI (default: '/api/docs'). */
-    docsPath?: string;
-    /** Path to serve the JSON spec (default: '/api/docs/openapi.json'). */
-    openapiJsonPath?: string;
-    /** Path to the spec file on disk (default: '.theokit/openapi.json'). */
-    specFilePath?: string;
-    /** Page title (default: 'API Reference'). */
-    pageTitle?: string;
-    /** Scalar CDN URL (default: jsdelivr). Must be HTTPS. */
-    cdnUrl?: string;
-}
-/**
- * Creates a request handler that serves OpenAPI docs.
- * Returns `null` for non-matching requests (passthrough).
- */
-declare function createOpenApiHandler(opts?: OpenApiDocsOptions): (request: Request) => Response | null;
-
 /**
  * A cached value persisted by a CacheStorageAdapter.
  *
@@ -296,13 +119,30 @@ interface CacheStoreAdmin {
 type CacheStorageAdapter = CacheStore & Partial<CacheStoreAdmin>;
 
 type CacheStatus = 'hit' | 'stale' | 'miss';
+/**
+ * Process-wide fallbacks for the options a cache wrapper takes per call site.
+ *
+ * The engine reads none of them: `getOrCompute` and `tryReadCached` always
+ * receive explicit values. They are carried here because the engine is the one
+ * object every wrapper (`defineCachedRoute`) already holds, and a wrapper with
+ * no declared value has nowhere else to look. Per-call-site options always win.
+ *
+ * Shaped to accept `NormalizedCacheConfig['defaults']` whole (#352): every field
+ * the config schema declares is honoured, none is dropped on the way in.
+ */
+interface CacheDefaults {
+    /** seconds; fallback for a wrapper that declares no `maxAge`. */
+    maxAge?: number;
+    /** seconds; fallback stale-while-revalidate window. */
+    swr?: number;
+    /** whether responses with status >= 400 may be cached. */
+    cacheErrors?: boolean;
+    /** version stamp applied to entries written without an explicit one. */
+    cacheVersion?: string;
+}
 interface CacheEngineOptions {
     storage: CacheStorageAdapter;
-    defaults?: {
-        maxAge?: number;
-        swr?: number;
-        cacheVersion?: string;
-    };
+    defaults?: CacheDefaults;
     onError?: (err: unknown, ctx: {
         phase: 'get' | 'set' | 'revalidate';
         key: string;
@@ -353,6 +193,11 @@ interface CacheEngine {
     revalidatePath(path: string, type?: 'layout' | 'page'): Promise<number>;
     /** Storage adapter passthrough (read-only access for diagnostics). */
     readonly storage: CacheStorageAdapter;
+    /**
+     * Process-wide defaults the wrappers fall back to. Normalized to `{}` when the
+     * factory received none, so a caller never has to guard the access.
+     */
+    readonly defaults: CacheDefaults;
 }
 /**
  * Build a cache engine wrapping a storage adapter.
@@ -448,7 +293,7 @@ interface CachedRouteConfig<TQuery extends z.ZodType = z.ZodUndefined, TBody ext
  * 2. Derive key (path + sortedQuery + varies, prefix by method)
  * 3. Cache lookup → HIT/STALE return cached Response
  * 4. Miss → run handler, check cacheability (Set-Cookie / status / size / SSE / streaming)
- * 5. Cacheable → write entry + return Response with X-Theo-Cache: MISS (dev)
+ * 5. Cacheable → write entry + return Response with X-Theo-Cache: MISS
  * 6. Not cacheable → return original Response unchanged
  *
  * Concurrent dedupe is INTENTIONALLY NOT used for routes — Response objects
@@ -654,33 +499,6 @@ declare const THEO_T_PREFIX = "_THEO_T_";
 declare const DEFAULT_MAX_AGE = 1;
 declare const DEFAULT_SWR_MULTIPLIER = 60;
 
-interface UploadedFile {
-    fieldname: string;
-    filename: string;
-    encoding: string;
-    mimeType: string;
-    buffer: Buffer;
-    size: number;
-}
-interface ParsedBody {
-    fields: Record<string, string>;
-    files: UploadedFile[];
-    json?: unknown;
-}
-interface BodyParserOptions {
-    maxFileSize?: number;
-    maxFiles?: number;
-    maxFieldSize?: number;
-}
-declare class FileTooLargeError extends Error {
-    readonly truncatedFilenames: string[];
-    readonly maxFileSize: number;
-    readonly code = "FILE_TOO_LARGE";
-    readonly status = 413;
-    constructor(message: string, truncatedFilenames: string[], maxFileSize: number);
-}
-declare function parseRequestBody(req: IncomingMessage, options?: BodyParserOptions): Promise<ParsedBody>;
-
 interface SerializedResponse {
     json: unknown;
     meta?: unknown;
@@ -694,216 +512,6 @@ declare function serializeResponse(data: unknown): SerializedResponse;
  */
 declare function deserializeResponse(serialized: SerializedResponse): unknown;
 
-/**
- * T3.2 — Web-Standards middleware runner for the `executeWebRequest` path.
- *
- * The Node request path (`http/execute.ts`) runs middleware via
- * `runMiddlewareAndContext`, which is coupled to Node `req`/`res`. Per G8
- * (Web Standards over Node APIs) the Web path needs a `Request`-shaped runner;
- * this is it. Extracted to a sibling so `web-handler.ts` stays under its LoC
- * budget (G6).
- *
- * Ordering invariant (EC-3): the caller runs the CSRF gate BEFORE invoking this
- * runner, mirroring the Node path (CSRF stage precedes user middleware).
- *
- * NOTE (D4 / EC-12): this is its own middleware contract — `(request, context)`.
- * Full semantic parity with the Node `defineMiddleware` contract is part of the
- * deferred Node→Web pipeline convergence, not this slice.
- */
-/** A Web-path middleware: mutate `context`, or return a `Response` to short-circuit. */
-type WebMiddleware = (request: Request, context: Record<string, unknown>) => Promise<Response | undefined> | Response | undefined | void;
-
-/**
- * The route module exported by a `server/routes/*.ts` file (after T2.6 G6
- * router lockdown). Method-named exports map to `defineRoute` results.
- */
-type WebRouteModule = Partial<Record<'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE', unknown>>;
-/**
- * Optional behavior knobs for `executeWebRequest`. Each knob defaults to
- * the safe "no-op" stance so existing Phase A consumers (T1.2 fixture
- * tests) keep working unchanged.
- *
- * **`csrfMode`** (T5a.2 Phase B slice 1/6) — when set to `'strict'`, the
- * Web-Standards request gate runs `validateCsrfRequest` BEFORE method
- * dispatch on state-changing methods (POST/PUT/PATCH/DELETE) and emits a
- * `403 FORBIDDEN` envelope when the check fails. Default: `'off'` (no
- * CSRF enforcement) to preserve Phase A backward compat. Production
- * consumers SHOULD pass `csrfMode: 'strict'`.
- *
- * Per the T5a.2 plan v1.0 § Phase B header-only leaves: csrf.ts is the
- * first leaf to be migrated (slice 1/6); 5 more sibling leaves remain
- * (csrf-multi-header, csrf-readiness-endpoint, csp-report, cors, cookies).
- */
-interface ExecuteWebRequestOptions {
-    csrfMode?: 'off' | 'strict';
-    /**
-     * T3.1 — route params resolved upstream by `matchRoute` (e.g. `{ id: '42' }`
-     * for `/users/:id`). Threaded to the handler's `params` input and validated
-     * against `config.params` (Zod) when declared. Defaults to `{}` — callers
-     * that don't supply params keep the prior behavior (additive, backward-compat).
-     */
-    params?: Record<string, string>;
-    /**
-     * T3.2 — Web-Standards middleware chain. Runs in order AFTER the CSRF gate
-     * (EC-3) and BEFORE the handler. A middleware returning a `Response`
-     * short-circuits (handler not reached); mutating `context` passes data to
-     * the handler. Omitted → zero overhead (handler runs directly).
-     */
-    middleware?: readonly WebMiddleware[];
-    /**
-     * T5a.2 Phase E — body parser strategy.
-     *
-     * - `'inline'` (default): handle `application/json` + `text/*` only.
-     *   Returns the parsed value (object for JSON, string for text). Other
-     *   content-types (e.g., multipart) return `undefined`.
-     * - `'full'`: delegate to `parseWebRequestBody` for multipart support
-     *   + per-file size caps + max-files cap (Web Standards `request.formData()`
-     *   under the hood). Returns a `ParsedWebBody` object:
-     *   `{ json?, fields, files }`. Multipart consumers MUST opt into this
-     *   mode; JSON-only routes pay zero cost staying on `'inline'`.
-     */
-    bodyParser?: 'inline' | 'full';
-    /**
-     * T5a.2 Phase G slice 1/N — plugin lifecycle hooks.
-     *
-     * Adapters (Node, CF Workers, Bun, Deno) wire `WebPluginContext`-shaped
-     * hooks at the executeWebRequest lifecycle. Lifecycle order mirrors the
-     * Fastify / Hono convention:
-     *
-     *   1. CSRF check (when opts.csrfMode === 'strict')
-     *   2. onRequest — earliest, before body parsing. Plugins can short-circuit
-     *      by setting `ctx.response` (handler skipped; subsequent hooks see
-     *      the short-circuit response).
-     *   3. body parse (inline OR full per opts.bodyParser)
-     *   4. preHandler — after body parsed, before handler runs. Same
-     *      short-circuit semantic.
-     *   5. handler invocation
-     *   6. onResponse — after handler returns OR after a hook short-circuit.
-     *      `ctx.response` is populated.
-     *   7. onError — fires if any of (handler, onRequest, preHandler) throws.
-     *      `ctx.response` is the envelope-shaped error response built via
-     *      serverErrorToEnvelope.
-     *
-     * `responseHeaders` is shared across hooks; the final Response merges
-     * them with the handler's Response headers (handler headers win on
-     * conflict; hook headers add new ones). Decorations made via
-     * `ctx.ctx[key] = value` persist across hooks (request-scoped state).
-     *
-     * `hooks: undefined` (default) → no plugin lifecycle, Phase A behavior
-     * preserved. Production consumers wire via the WebPluginRunner facade
-     * (a future Phase G slice).
-     */
-    hooks?: {
-        onRequest?: readonly WebOnRequestHook[];
-        preHandler?: readonly WebPreHandlerHook[];
-        onResponse?: readonly WebOnResponseHook[];
-        onError?: readonly WebOnErrorHook[];
-    };
-    /**
-     * Stable request identifier propagated into hook contexts. Adapters
-     * resolve via traceparent / x-request-id / generated UUID (see
-     * `extractTraceIdFromRequest` from Phase C slice 1/2). Default:
-     * `globalThis.crypto.randomUUID()`.
-     */
-    requestId?: string;
-}
-declare function executeWebRequest(request: Request, routeModule: WebRouteModule, opts?: ExecuteWebRequestOptions): Promise<Response>;
-
-/**
- * M33 — the SINGLE route-input validation pipeline, shared by the HTTP path (`web-handler.ts`
- * `runHandler`) and the in-process caller (`in-process-caller.ts` `callProcedure`).
- *
- * Both surfaces validate the same three channels (`query`/`body`/`params`) against the same
- * `RouteConfig` Zod schemas. Extracting the logic here means there is ONE validation pipeline
- * (no duplication, no drift) — each caller only differs in how it MAPS a failure: the HTTP path
- * emits a 400 Response, the in-process path throws a typed error.
- */
-
-/** The three request-input channels a route may declare a Zod schema for. */
-type RouteInputChannel = 'query' | 'body' | 'params';
-/**
- * The minimal structural shape the validator needs: the three optional channel schemas. Both
- * `RouteConfig` (the 5-arity generic contract) and `WebRouteHandlerConfig` (the Web runtime shape)
- * satisfy this — the validator depends only on the schemas, not the full route generic.
- */
-interface RouteInputSchemas {
-    query?: z.ZodType;
-    body?: z.ZodType;
-    params?: z.ZodType;
-}
-/** Raw (pre-validation) channel values. A channel absent from the config passes through unchanged. */
-interface RawRouteInput {
-    query?: unknown;
-    body?: unknown;
-    params?: unknown;
-}
-/** Discriminated result — each caller maps `ok:false` to its own surface (Response vs throw). */
-type RouteInputValidation = {
-    ok: true;
-    query: unknown;
-    body: unknown;
-    params: unknown;
-} | {
-    ok: false;
-    channel: RouteInputChannel;
-    error: z.ZodError;
-};
-/**
- * Validate the three input channels against the route's declared Zod schemas. A channel with no
- * declared schema passes its raw value through. First failing channel short-circuits (query → body
- * → params order, matching `runHandler`).
- */
-declare function validateRouteInput(config: RouteInputSchemas, raw: RawRouteInput): RouteInputValidation;
-
-/**
- * M33 Phase 1 — `callProcedure`, the in-process typed caller.
- *
- * The load-bearing seam for non-HTTP surfaces (TUI / Tauri / MCP-tools): invoke a route's shared
- * logic with STRUCTURED input, WITHOUT going through the HTTP transport (no URL/body parsing, no
- * middleware chain, no Response). It reuses the SAME Zod validation pipeline as the HTTP path
- * (`validateRouteInput`) so there is no drift, and reuses the SAME `config.response` server-fault
- * check. Failures throw typed errors (there is no HTTP status off-web).
- *
- * Prior art: tRPC `callProcedure` / `createCallerFactory`
- *
- * Design (ADR-0044 / blueprint §5.4): the AUTHOR passes structured input `{query?, body?, params?}`
- * — never synthesizes a Request. A minimal in-process `Request` is provided to the handler ONLY so
- * handlers that read `request.headers`/`request.url` still work (opencode's proven pattern); the
- * input itself is NOT parsed from it.
- */
-
-/** Structured input for an in-process procedure call — one object per declared channel. */
-type ProcedureInput = RawRouteInput;
-/**
- * Thrown when structured input fails the route's Zod validation. The in-process analog of the HTTP
- * 400 — carries the failing channel + the Zod issues (typed error, not a magic value; Rule 8).
- */
-declare class ProcedureInputError extends Error {
-    readonly channel: RouteInputChannel;
-    readonly issues: z.core.$ZodIssue[];
-    constructor(channel: RouteInputChannel, error: z.ZodError);
-}
-/**
- * Thrown when the handler's plain-object return drifts from `config.response` — a SERVER fault
- * (the handler violated its own declared contract), mirroring the HTTP path's 500 as a throw.
- */
-declare class ProcedureOutputError extends Error {
-    readonly issues: z.core.$ZodIssue[];
-    constructor(error: z.ZodError);
-}
-/**
- * Invoke a route/procedure's handler in-process with structured, Zod-validated input.
- *
- * @param config  the `RouteConfig` (what `route().build()` produces).
- * @param input   structured `{query?, body?, params?}` — validated by the route's schemas.
- * @param ctx     the typed run-context the handler receives (built by the CALLER — a TUI/Tauri/MCP
- *                surface supplies its own ctx factory; there is no HTTP middleware chain here).
- * @returns       the handler's result (validated against `config.response` when declared).
- * @throws ProcedureInputError  on invalid structured input (the off-web analog of a 400).
- * @throws ProcedureOutputError on a handler output that drifts from `config.response` (server fault).
- */
-declare function callProcedure(config: RouteConfig<z.ZodType, z.ZodType, z.ZodType>, input?: ProcedureInput, ctx?: unknown): Promise<unknown>;
-
 /**
  * M33 Phase 1 — the ctx reconciliation contract (ADR-0044 D4 / blueprint §5.2, §8.5).
  *
@@ -1009,4 +617,4 @@ interface LoadEnvResult {
 declare function _resetEnvCache(): void;
 declare function loadEnv(options?: LoadEnvOptions): LoadEnvResult;
 
-export { ActionError, type ActionErrorCode, ActionInputError, type ActionManifestEntry, type ActionResult, type BodyParserOptions, DEFAULT_MAX_AGE as CACHE_DEFAULT_MAX_AGE, DEFAULT_MAX_ENTRY_SIZE as CACHE_DEFAULT_MAX_ENTRY_SIZE, DEFAULT_SWR_MULTIPLIER as CACHE_DEFAULT_SWR_MULTIPLIER, CACHE_TAG_MAX_ITEMS, CACHE_TAG_MAX_LENGTH, CTX_WRITERS, type CacheControlInput, type CacheEngine, type CacheEngineOptions, type CacheEntry, type CacheStatus, type CacheStorageAdapter, type CacheStore, type CacheStoreAdmin, type ValidationResult as CacheValidationResult, type CachedFunction, type CachedRouteConfig, type CompiledRouteRule, type ContextValue, DEFAULT_EXCLUDED_QUERY_PARAMS, type DefineCachedFunctionOptions, FileTooLargeError, type GetOrComputeOptions, InMemoryCacheAdapter, type InMemoryCacheAdapterOptions, type JobsAugmentedCtx, type KeyDerivationOptions, type LoadEnvOptions, type LoadEnvResult, type NormalizedCacheConfig, type OpenApiDocsOptions, type ParsedBody, type ProcedureInput, ProcedureInputError, ProcedureOutputError, type QueueClientLike, type RawRouteInput, type RevalidateResult, type RouteCacheOptions, RouteConfig, type RouteInputChannel, type RouteInputSchemas, type RouteInputValidation, type RouteRule, type RouteRules, type SerializedActionResult, type SerializedResponse, THEO_T_PREFIX, type UniversalZodIssue, type UploadedFile, _resetCacheEngine, _resetEnvCache, callProcedure, compileRouteRules, createCacheEngine, createOpenApiHandler, defineCachedFunction, defineCachedRoute, deriveKey as deriveCacheKey, deserializeResponse, executeWebRequest, extractUniversalIssues, getCacheControlHeader, getCacheEngine, initCacheEngine, isActionError, isInputError, loadEnv, parseRequestBody, resolveRouteRule, revalidatePath, revalidateTag, serializeResponse, updateTag, validateExpire as validateCacheExpire, validateMaxAge as validateCacheMaxAge, validateTags as validateCacheTags, validateRouteInput };
+export { DEFAULT_MAX_AGE as CACHE_DEFAULT_MAX_AGE, DEFAULT_MAX_ENTRY_SIZE as CACHE_DEFAULT_MAX_ENTRY_SIZE, DEFAULT_SWR_MULTIPLIER as CACHE_DEFAULT_SWR_MULTIPLIER, CACHE_TAG_MAX_ITEMS, CACHE_TAG_MAX_LENGTH, CTX_WRITERS, type CacheControlInput, type CacheEngine, type CacheEngineOptions, type CacheEntry, type CacheStatus, type CacheStorageAdapter, type CacheStore, type CacheStoreAdmin, type ValidationResult as CacheValidationResult, type CachedFunction, type CachedRouteConfig, type CompiledRouteRule, type ContextValue, DEFAULT_EXCLUDED_QUERY_PARAMS, type DefineCachedFunctionOptions, type GetOrComputeOptions, InMemoryCacheAdapter, type InMemoryCacheAdapterOptions, type JobsAugmentedCtx, type KeyDerivationOptions, type LoadEnvOptions, type LoadEnvResult, type NormalizedCacheConfig, type QueueClientLike, type RevalidateResult, type RouteCacheOptions, RouteConfig, type RouteRule, type RouteRules, type SerializedResponse, THEO_T_PREFIX, _resetCacheEngine, _resetEnvCache, compileRouteRules, createCacheEngine, defineCachedFunction, defineCachedRoute, deriveKey as deriveCacheKey, deserializeResponse, getCacheControlHeader, getCacheEngine, initCacheEngine, loadEnv, resolveRouteRule, revalidatePath, revalidateTag, serializeResponse, updateTag, validateExpire as validateCacheExpire, validateMaxAge as validateCacheMaxAge, validateTags as validateCacheTags };