theokit 0.48.13 → 0.50.0

package/dist/{start-KR2JJR7K.js → start-UZDMOT7I.js}

@@ -2,76 +2,169 @@
 import "tsx/esm";
 import {
   CONTROLLER_MANIFEST_FILE
-} from "./chunk-47CINLWF.js";
+} from "./chunk-44J2ANQC.js";
 import {
   parseCookieHeader
 } from "./chunk-V7MTRM6Q.js";
+import {
+  initCacheEngineFromConfig
+} from "./chunk-Q5L5EGWZ.js";
 import {
   preflightNodeAndBindings
 } from "./chunk-KTMQUYED.js";
 import {
   applyNonceToInlineScripts,
+  createAgentSubjectResolver,
   extractHeadTags,
   handleAgentApproval,
   injectIntoHead,
   isApprovalPath,
+  matchAgentAuxRoute,
+  parseApprovalAgentName,
+  resolvePluginSpecifiers,
   resolveTransformer,
-  serveAgentAuxRoute,
-  writeWebResponseToServerResponse
-} from "./chunk-GRI4XHBJ.js";
+  serveMatchedAuxRoute,
+  serveThroughPluginLifecycle
+} from "./chunk-JWRCZIA4.js";
 import "./chunk-2CVV6CNN.js";
 import {
   findRootDiv
 } from "./chunk-3PWQQWT6.js";
-import {
-  loadConfig
-} from "./chunk-S433N3CT.js";
-import {
-  loadEnv
-} from "./chunk-HBU2GIMZ.js";
-import "./chunk-GVW5EKEU.js";
-import "./chunk-7VPQHEAJ.js";
 import {
   InMemoryStore,
-  buildSecurityHeaders,
+  createCorsHandler,
   createPluginRunnerFromConfig,
   createProductionLoader,
   executeAction,
   executeRoute,
   findSuggestion,
-  generateNonce,
-  mountAgent
-} from "./chunk-BIVCP6X5.js";
+  mountAgent,
+  readAgentPolicy,
+  writeWebResponseToServerResponse
+} from "./chunk-C62IZEJI.js";
 import {
   getApprovalRegistry,
   resolveProvider
-} from "./chunk-6GGWS7J3.js";
+} from "./chunk-5YPXXSYY.js";
 import {
+  createWebRequestSource,
   dispatchControllerRequest,
-  incomingMessageToWebRequest,
+  sendError
+} from "./chunk-HWBRS4DZ.js";
+import {
+  buildSecurityHeaders,
+  generateNonce
+} from "./chunk-RPET332G.js";
+import {
+  TRACE_HEADER,
+  createObservabilityPluginFromConfig,
+  extractTraceId,
+  generateNewTraceContext
+} from "./chunk-7PM6K5EV.js";
+import {
   logRequest,
-  sendError,
   warnOnce
-} from "./chunk-T5C46IIU.js";
+} from "./chunk-2AMLGJJA.js";
 import {
   loadManifest
-} from "./chunk-ZB7D62OA.js";
+} from "./chunk-KUZVRJ7M.js";
 import {
   scanAgents
-} from "./chunk-LNVMHQ2Z.js";
+} from "./chunk-EVZKNA2W.js";
 import {
   matchRoute,
   scanServerActions,
   scanServerRoutes,
   scanWebSocketRoutes
-} from "./chunk-BMHS4WAN.js";
-import "./chunk-A7JBF5FO.js";
+} from "./chunk-XS7EX55U.js";
+import "./chunk-FD4ZDTQ6.js";
+import {
+  loadConfig
+} from "./chunk-QTHVHNJJ.js";
+import {
+  loadEnv
+} from "./chunk-3QPVEJ7D.js";
+import "./chunk-U5PWXS3J.js";
+import "./chunk-FH3SQR6P.js";
+import "./chunk-ZNZISJDZ.js";
+import "./chunk-VI7ZANB3.js";
 import "./chunk-VQIUTCK2.js";
 
 // src/cli/commands/start/index.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
 import { createServer } from "http";
-import { join as join2, resolve as resolve3 } from "path";
+import { join as join2, resolve as resolve4 } from "path";
+
+// src/server/cron/cron-runtime-node.ts
+import { CronExpressionParser } from "cron-parser";
+function createCronScheduler(definitions) {
+  const states = definitions.map((def) => ({
+    def,
+    inFlight: false,
+    timer: null,
+    abortController: null
+  }));
+  let started = false;
+  const fireAndReschedule = (state, scheduledAt) => {
+    state.timer = null;
+    if (state.inFlight && state.def.concurrency === "forbid") {
+      console.warn(
+        `[theokit:cron] "${state.def.name}" skipped tick at ${scheduledAt.toISOString()} \u2014 previous handler still running (concurrency: forbid).`
+      );
+      scheduleNext(state);
+      return;
+    }
+    state.inFlight = true;
+    state.abortController = new AbortController();
+    const traceCtx = generateNewTraceContext();
+    const ctx = {
+      traceId: traceCtx.trace_id,
+      scheduledAt,
+      signal: state.abortController.signal
+    };
+    void Promise.resolve().then(() => state.def.handler(ctx)).catch((err) => {
+      console.error(
+        `[theokit:cron] "${state.def.name}" handler error:`,
+        err instanceof Error ? err.message : err
+      );
+    }).finally(() => {
+      state.inFlight = false;
+    });
+    scheduleNext(state);
+  };
+  const scheduleNext = (state) => {
+    if (!started) return;
+    const interval = CronExpressionParser.parse(state.def.schedule, {
+      tz: "UTC",
+      currentDate: /* @__PURE__ */ new Date()
+    });
+    const next = interval.next().toDate();
+    const delayMs = Math.max(0, next.getTime() - Date.now());
+    state.timer = setTimeout(() => {
+      fireAndReschedule(state, next);
+    }, delayMs);
+  };
+  return {
+    start() {
+      if (started) return;
+      started = true;
+      for (const state of states) {
+        scheduleNext(state);
+      }
+    },
+    stop() {
+      started = false;
+      for (const state of states) {
+        if (state.timer) {
+          clearTimeout(state.timer);
+          state.timer = null;
+        }
+        state.abortController?.abort();
+        state.abortController = null;
+      }
+    }
+  };
+}
 
 // src/server/define/health-route.ts
 var HEALTH_PATH = "/__theo/health";
@@ -330,7 +423,7 @@ async function configureStorageManagerFromConfig(storageConfig) {
   if (storageConfig === void 0 || storageConfig === null) return;
   try {
     const { getStorageManager } = await import("./storage-manager-3O5PDO6O.js");
-    const { storageSchema } = await import("./schema-ZO3OSWVG.js");
+    const { storageSchema } = await import("./schema-SOAD43RQ.js");
     const parsed = storageSchema.parse(storageConfig);
     getStorageManager().configure(parsed);
   } catch (err) {
@@ -350,6 +443,32 @@ function resolveSsrEntry(distDir) {
   return null;
 }
 
+// src/cli/commands/start/cron-bootstrap.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve2 } from "path";
+async function loadCronDefinitions(manifestPath, projectRoot, loadModule) {
+  if (!existsSync2(manifestPath)) return [];
+  const manifest = JSON.parse(readFileSync2(manifestPath, "utf-8"));
+  const definitions = [];
+  for (const entry of manifest.crons) {
+    const filePath = resolve2(projectRoot, entry.filePath);
+    const mod = await loadModule(filePath);
+    const exported = mod.default;
+    if (!isCronDefinition(exported)) {
+      throw new Error(
+        `Cron "${entry.name}" declared in "${entry.filePath}" is missing a valid default export. Expected \`export default defineCron(name, { schedule, handler })\`. Re-run \`theokit build\` if the file changed since the last build.`
+      );
+    }
+    definitions.push(exported);
+  }
+  return definitions;
+}
+function isCronDefinition(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const candidate = value;
+  return typeof candidate.name === "string" && typeof candidate.schedule === "string" && typeof candidate.handler === "function";
+}
+
 // src/cli/commands/start/graceful-shutdown.ts
 function installGracefulShutdown(server) {
   let shuttingDown = false;
@@ -382,6 +501,16 @@ function installGracefulShutdown(server) {
           message: msg
         });
       }
+      try {
+        const { getObservabilityAdapter } = await import("./observability-bootstrap-MZMSOE66.js");
+        await getObservabilityAdapter()?.shutdown();
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        warnOnce("shutdown.observability_error", {
+          event: "shutdown.observability_error",
+          message: msg
+        });
+      }
       console.log(`  [theokit] shutdown complete`);
       server.close(() => {
         process.exit(0);
@@ -404,12 +533,12 @@ function installGracefulShutdown(server) {
 }
 
 // src/cli/commands/start/manifest-loader.ts
-import { existsSync as existsSync2 } from "fs";
+import { existsSync as existsSync3 } from "fs";
 import { join } from "path";
 import { dirname } from "path";
 function loadRoutesAndActions(distDir, serverDir, agentsDir = "agents") {
   const manifestPath = join(distDir, "manifest.json");
-  if (existsSync2(manifestPath)) {
+  if (existsSync3(manifestPath)) {
     const manifest = loadManifest(distDir, serverDir);
     return {
       routes: manifest.routes,
@@ -432,16 +561,13 @@ function loadRoutesAndActions(distDir, serverDir, agentsDir = "agents") {
   };
 }
 
-// src/cli/commands/start/request-handler.ts
-import { randomUUID } from "crypto";
-
 // src/cli/commands/start/handlers.ts
 import { extname as extname2 } from "path";
 import { pathToFileURL } from "url";
 
 // src/server/http/static.ts
-import { existsSync as existsSync3, readFileSync as readFileSync2, statSync } from "fs";
-import { resolve as resolve2, extname } from "path";
+import { closeSync, fstatSync, openSync, readFileSync as readFileSync3, realpathSync } from "fs";
+import { resolve as resolve3, extname, sep } from "path";
 var MIME_TYPES = {
   ".html": "text/html",
   ".js": "application/javascript",
@@ -462,24 +588,41 @@ var MIME_TYPES = {
 };
 function serveStaticFile(req, res, clientDir) {
   const urlPath = (req.url ?? "/").split("?")[0];
-  const filePath = resolve2(clientDir, "." + urlPath);
-  if (!filePath.startsWith(clientDir)) {
+  const filePath = resolve3(clientDir, "." + urlPath);
+  if (filePath !== clientDir && !filePath.startsWith(clientDir + sep)) {
     res.writeHead(403);
     res.end("Forbidden");
     return true;
   }
-  if (!existsSync3(filePath)) return false;
-  const stat = statSync(filePath);
-  if (!stat.isFile()) return false;
-  const ext = extname(filePath);
-  const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
-  const content = readFileSync2(filePath);
-  res.writeHead(200, {
-    "Content-Type": contentType,
-    "Content-Length": content.length
-  });
-  res.end(content);
-  return true;
+  let realPath;
+  let realRoot;
+  try {
+    realPath = realpathSync(filePath);
+    realRoot = realpathSync(clientDir);
+  } catch {
+    return false;
+  }
+  if (realPath !== realRoot && !realPath.startsWith(realRoot + sep)) return false;
+  let fd;
+  try {
+    fd = openSync(realPath, "r");
+  } catch {
+    return false;
+  }
+  try {
+    if (!fstatSync(fd).isFile()) return false;
+    const ext = extname(filePath);
+    const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
+    const content = readFileSync3(fd);
+    res.writeHead(200, {
+      "Content-Type": contentType,
+      "Content-Length": content.length
+    });
+    res.end(content);
+    return true;
+  } finally {
+    closeSync(fd);
+  }
 }
 
 // src/cli/commands/start/handlers.ts
@@ -487,6 +630,15 @@ async function loadCompiledController(absPath) {
   return await import(pathToFileURL(absPath).href);
 }
 var X_REQUEST_ID = "x-request-id";
+function agentSubjectResolver(c) {
+  return createAgentSubjectResolver({
+    req: c.req,
+    res: c.res,
+    loadModule: c.loadModule,
+    serverDir: c.serverDir,
+    pluginRunner: c.pluginRunner
+  });
+}
 async function applyRateLimit(c, method) {
   if (!c.rateLimiter) return false;
   const check = await c.rateLimiter(c.req);
@@ -568,22 +720,41 @@ async function tryServeAction(c) {
 }
 async function tryServeAgentAux(c) {
   const urlPath = c.url.split("?")[0];
-  const baseUrl = `http://${c.req.headers.host ?? "localhost"}`;
-  const request = incomingMessageToWebRequest(c.req);
-  const response = await serveAgentAuxRoute(request, urlPath, {
+  const deps = {
     agents: c.cachedAgents,
     loadModule: c.loadModule,
-    baseUrl,
+    baseUrl: `http://${c.req.headers.host ?? "localhost"}`,
     // M34 (#97) — the MCP aux route drives the agent (spends tokens); enforce CSRF like the run route.
     csrfMode: c.csrfMode,
     // M39 — the thread follow-up route drives the agent; resolve the key on demand.
-    resolveApiKey: () => resolveProvider().apiKey
-  });
-  if (response === null) return false;
+    // theokit#328 — the thread route drives an agent, so its key follows the model too.
+    resolveApiKey: (model) => resolveProvider(model).apiKey,
+    // usetheokit/theokit#365 — who is asking. Memoized and LAZY: built here, invoked only inside
+    // `serveMatchedAuxRoute` and only when the matched agent declares a policy, so the application's
+    // `createContext` never runs for a url this branch declines.
+    resolveSubject: agentSubjectResolver(c)
+  };
+  const method = (c.req.method ?? "GET").toUpperCase();
+  const route = await matchAgentAuxRoute(method, urlPath, deps);
+  if (route === null) return false;
   c.res.setHeader(X_REQUEST_ID, c.requestId);
-  await writeWebResponseToServerResponse(response, c.res);
+  await serveThroughPluginLifecycle(
+    {
+      source: createWebRequestSource(c.req),
+      res: c.res,
+      requestId: c.requestId,
+      pluginRunner: c.pluginRunner,
+      failureMessage: "Agent aux handler failed"
+    },
+    async (request) => {
+      await writeWebResponseToServerResponse(
+        await serveMatchedAuxRoute(route, request, deps),
+        c.res
+      );
+    }
+  );
   logRequest({
-    method: (c.req.method ?? "GET").toUpperCase(),
+    method,
     url: c.url,
     status: c.res.statusCode,
     duration: Date.now() - c.startTime,
@@ -616,25 +787,27 @@ async function tryServeAgent(c) {
       });
       return true;
     }
-    try {
-      const request = incomingMessageToWebRequest(c.req);
-      const response = await handleAgentApproval(
-        request,
-        urlPath,
-        getApprovalRegistry(),
-        c.csrfMode
-      );
-      await writeWebResponseToServerResponse(response, c.res);
-    } catch (err) {
-      sendError(
-        c.res,
-        "INTERNAL",
-        err instanceof Error ? err.message : "Approve handler failed",
-        500,
-        void 0,
-        c.requestId
-      );
-    }
+    await serveThroughPluginLifecycle(
+      {
+        source: createWebRequestSource(c.req),
+        res: c.res,
+        requestId: c.requestId,
+        pluginRunner: c.pluginRunner,
+        failureMessage: "Approve handler failed"
+      },
+      async (request) => {
+        const approveAgent = c.cachedAgents.find((a) => a.name === parseApprovalAgentName(urlPath));
+        const policy = approveAgent === void 0 ? void 0 : readAgentPolicy(await c.loadModule(approveAgent.filePath), approveAgent.filePath);
+        const response = await handleAgentApproval(
+          request,
+          urlPath,
+          getApprovalRegistry(),
+          c.csrfMode,
+          { policy, resolveSubject: agentSubjectResolver(c) }
+        );
+        await writeWebResponseToServerResponse(response, c.res);
+      }
+    );
     logRequest({
       method: method2,
       url: c.url,
@@ -667,26 +840,35 @@ async function tryServeAgent(c) {
     });
     return true;
   }
-  try {
-    const mod = await c.loadModule(agent.filePath);
-    const apiKey = resolveProvider().apiKey;
-    const request = incomingMessageToWebRequest(c.req);
-    const response = await mountAgent(mod, request, apiKey, {
-      source: agent.filePath,
-      csrfMode: c.csrfMode,
-      projectRoot: c.projectRoot
-    });
-    await writeWebResponseToServerResponse(response, c.res);
-  } catch (err) {
-    sendError(
-      c.res,
-      "INTERNAL",
-      err instanceof Error ? err.message : "Agent handler failed",
-      500,
-      void 0,
-      c.requestId
-    );
-  }
+  await serveAgentTurn(c, agent, method);
+  return true;
+}
+async function serveAgentTurn(c, agent, method) {
+  const resolveSubject = agentSubjectResolver(c);
+  await serveThroughPluginLifecycle(
+    {
+      source: createWebRequestSource(c.req),
+      res: c.res,
+      requestId: c.requestId,
+      pluginRunner: c.pluginRunner,
+      failureMessage: "Agent handler failed"
+    },
+    async (request) => {
+      const mod = await c.loadModule(agent.filePath);
+      const apiKey = (model) => resolveProvider(model).apiKey;
+      const response = await mountAgent(mod, request, apiKey, {
+        source: agent.filePath,
+        csrfMode: c.csrfMode,
+        projectRoot: c.projectRoot,
+        // usetheokit/theokit#365 — the policy is read off `mod` inside `mountAgent`; what this
+        // caller owes is the identity to judge it against. usetheokit/theokit#406 — and it is the
+        // same value the run's spans are labelled with, so `source` above never reaches telemetry.
+        agentName: agent.name,
+        resolveSubject
+      });
+      await writeWebResponseToServerResponse(response, c.res);
+    }
+  );
   logRequest({
     method,
     url: c.url,
@@ -694,7 +876,6 @@ async function tryServeAgent(c) {
     duration: Date.now() - c.startTime,
     requestId: c.requestId
   });
-  return true;
 }
 async function tryServeApiRoute(c) {
   if (!c.url.startsWith("/api/")) return false;
@@ -860,7 +1041,16 @@ async function handleSsrStreaming(ctx, req, res, url, nonce) {
   try {
     const result = await ctx.ssrRenderStreaming(url, res, {
       signal: controller.signal,
-      nonce
+      nonce,
+      // #343 — the streamed response carried neither of these, so `ssrStreaming: true`
+      // served a bare React tree: no `<head>`, no client entry, no hydration data.
+      //
+      // `applyNonceToInlineScripts` and not `withHoistedHead`: hoisting reads the
+      // RENDERED body for head elements, and nothing is rendered yet when the head
+      // has to flush. Metadata hoisting under streaming is the same defect on a
+      // different surface, and it is M9's, not this one's.
+      htmlHead: applyNonceToInlineScripts(ctx.htmlHead, nonce),
+      htmlTail: ctx.htmlTail
     });
     if (isRedirectResult(result)) sendRedirect(res, result);
     return true;
@@ -902,8 +1092,12 @@ function createRequestHandler(ctx) {
   return (req, res) => {
     void (async () => {
       const url = req.url ?? "/";
-      const requestId = randomUUID();
+      const requestId = extractTraceId(req);
       const start = Date.now();
+      res.setHeader("x-request-id", requestId);
+      res.setHeader(TRACE_HEADER, requestId);
+      if (ctx.corsHandler?.handlePreflight(req, res) === true) return;
+      ctx.corsHandler?.applyHeaders(req, res);
       const nonce = generateNonce();
       const securityHeaders = buildSecurityHeaders(
         ctx.securityHeadersConfig,
@@ -933,6 +1127,24 @@ function createRequestHandler(ctx) {
   };
 }
 
+// src/cli/commands/start/resolve-listen-host.ts
+function resolveListenTarget(host, env = process.env.HOST) {
+  if (host === true) return { host: "0.0.0.0", source: "config" };
+  if (typeof host === "string" && host !== "") return { host, source: "config" };
+  if (host !== false && env !== void 0 && env !== "") return { host: env, source: "env" };
+  return { host: "localhost", source: "default" };
+}
+function describeListenTarget(target, port) {
+  const url = target.host === "0.0.0.0" || target.host === "::" ? "localhost" : target.host;
+  const bound = target.host === "0.0.0.0" || target.host === "::" ? `bound to ${target.host} (every interface)` : `bound to ${target.host} only`;
+  return `  \u2192 http://${url}:${String(port)}  [${bound}${provenance(target.source)}]`;
+}
+function provenance(source) {
+  if (source === "env") return " from HOST";
+  if (source === "config") return "";
+  return " \u2014 set `host: true` in theo.config.ts or HOST=0.0.0.0 to reach it from outside this machine";
+}
+
 // src/cli/commands/start/websocket-handler.ts
 async function attachWebSocketHandler(server, wsRoutes, loadModule) {
   if (wsRoutes.length === 0) return;
@@ -988,22 +1200,28 @@ async function startCommand(options) {
   assertSdkCompatible();
   await configureAgentRegistryFromConfig(config.agents?.registry);
   await configureStorageManagerFromConfig(config.storage);
-  const distDir = resolve3(cwd, ".theokit");
-  const clientDir = resolve3(distDir, "client");
-  const controllersDistDir = existsSync4(resolve3(distDir, CONTROLLER_MANIFEST_FILE)) ? resolve3(distDir, "controllers") : void 0;
-  const serverDir = resolve3(cwd, config.serverDir);
+  await initCacheEngineFromConfig(config.cache);
+  const distDir = resolve4(cwd, ".theokit");
+  const clientDir = resolve4(distDir, "client");
+  const controllersDistDir = existsSync4(resolve4(distDir, CONTROLLER_MANIFEST_FILE)) ? resolve4(distDir, "controllers") : void 0;
+  const serverDir = resolve4(cwd, config.serverDir);
   if (!existsSync4(clientDir)) {
     throw new Error("No build found. Run `theo build` first.");
   }
-  const indexHtml = readFileSync3(join2(clientDir, "index.html"), "utf-8");
+  const indexHtml = readFileSync4(join2(clientDir, "index.html"), "utf-8");
   const loadModule = createProductionLoader();
-  const port = options.port ?? config.port;
-  const pluginRunner = await createPluginRunnerFromConfig(config.plugins);
+  const envPort = Number.parseInt(process.env.PORT ?? "", 10);
+  const port = options.port ?? (Number.isInteger(envPort) ? envPort : void 0) ?? config.port;
+  const observabilityPlugin = createObservabilityPluginFromConfig(config.observability, process.env);
+  const declaredPlugins = await resolvePluginSpecifiers(config.plugins ?? [], cwd);
+  const pluginRunner = await createPluginRunnerFromConfig(
+    observabilityPlugin === void 0 ? declaredPlugins : [observabilityPlugin, ...declaredPlugins]
+  );
   const transformer = resolveTransformer(config.serialization);
   const custom404Path = join2(clientDir, "404.html");
   const custom500Path = join2(clientDir, "500.html");
-  const custom404Html = existsSync4(custom404Path) ? readFileSync3(custom404Path, "utf-8") : null;
-  const custom500Html = existsSync4(custom500Path) ? readFileSync3(custom500Path, "utf-8") : null;
+  const custom404Html = existsSync4(custom404Path) ? readFileSync4(custom404Path, "utf-8") : null;
+  const custom500Html = existsSync4(custom500Path) ? readFileSync4(custom500Path, "utf-8") : null;
   const {
     routes: cachedRoutes,
     actions: cachedActions,
@@ -1041,6 +1259,10 @@ async function startCommand(options) {
         rateLimiter
       }),
       securityHeadersConfig: config.security?.headers ?? {},
+      // #409 — built once at startup, like the security headers beside it. Declaring `cors` and
+      // being served by this command used to mean no CORS at all, which reads in a browser as a
+      // blocked fetch and in the config as a setting that is present and validated.
+      corsHandler: config.security?.cors ? createCorsHandler(config.security.cors) : null,
       ssrRender: ssr.render,
       ssrRenderStreaming: ssr.renderStreaming,
       ssrStreamingEnabled: ssr.streamingEnabled,
@@ -1055,11 +1277,20 @@ async function startCommand(options) {
     })
   );
   await attachWebSocketHandler(server, cachedWsRoutes, loadModule);
-  server.listen(port, () => {
+  const cronDefinitions = await loadCronDefinitions(resolve4(distDir, "crons.json"), cwd, loadModule);
+  if (cronDefinitions.length > 0) {
+    createCronScheduler(cronDefinitions).start();
+  }
+  const listenTarget = resolveListenTarget(config.host);
+  server.listen(port, listenTarget.host, () => {
     console.log(`
   Theo production server`);
-    console.log(`  \u2192 http://localhost:${String(port)}
+    console.log(`${describeListenTarget(listenTarget, port)}
+`);
+    if (cronDefinitions.length > 0) {
+      console.log(`  Crons: ${String(cronDefinitions.length)} scheduled in-process
 `);
+    }
   });
   installGracefulShutdown(server);
 }
@@ -1067,4 +1298,4 @@ export {
   resolveSsrEntry,
   startCommand
 };
-//# sourceMappingURL=start-KR2JJR7K.js.map
+//# sourceMappingURL=start-UZDMOT7I.js.map