theokit 0.48.14 → 0.50.0

package/dist/{routes-NJR4ISCT.js → routes-BPLU3ISV.js}

@@ -3,18 +3,20 @@ import "tsx/esm";
 import {
   validateProjectStructure
 } from "./chunk-GEQJAFSV.js";
-import {
-  loadConfig
-} from "./chunk-AATSV4UV.js";
-import "./chunk-HBU2GIMZ.js";
-import "./chunk-CMYSHZFT.js";
-import "./chunk-WSXNGF7X.js";
 import {
   scanServerActions,
   scanServerRoutes,
   scanWebSocketRoutes
-} from "./chunk-BMHS4WAN.js";
-import "./chunk-A7JBF5FO.js";
+} from "./chunk-XS7EX55U.js";
+import "./chunk-FD4ZDTQ6.js";
+import {
+  loadConfig
+} from "./chunk-QTHVHNJJ.js";
+import "./chunk-3QPVEJ7D.js";
+import "./chunk-U5PWXS3J.js";
+import "./chunk-FH3SQR6P.js";
+import "./chunk-ZNZISJDZ.js";
+import "./chunk-VI7ZANB3.js";
 
 // src/cli/commands/routes.ts
 import { resolve, relative } from "path";
@@ -62,4 +64,4 @@ async function routesCommand() {
 export {
   routesCommand
 };
-//# sourceMappingURL=routes-NJR4ISCT.js.map
+//# sourceMappingURL=routes-BPLU3ISV.js.map

package/dist/{routes-NJR4ISCT.js.map → routes-BPLU3ISV.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli/commands/routes.ts"],"sourcesContent":["import { resolve, relative } from 'node:path'\n\nimport { loadConfig } from '../../config/load-config.js'\nimport { validateProjectStructure } from '../../config/validate-structure.js'\nimport { scanServerActions } from '../../server/scan/action-scan.js'\nimport { scanServerRoutes } from '../../server/scan/scan.js'\nimport { scanWebSocketRoutes } from '../../server/scan/ws-scan.js'\n\nexport async function routesCommand(): Promise<void> {\n  const cwd = process.cwd()\n  const config = await loadConfig(cwd)\n  // #95 — honor config.appDir so a custom frontend dir (e.g. apps/web) passes the structure gate.\n  validateProjectStructure(cwd, config.appDir)\n\n  const serverDir = resolve(cwd, config.serverDir)\n\n  const apiRoutes = scanServerRoutes(serverDir)\n  const actions = scanServerActions(serverDir)\n  const wsRoutes = scanWebSocketRoutes(serverDir)\n\n  const totalCount = apiRoutes.length + actions.length + wsRoutes.length\n\n  if (totalCount === 0) {\n    console.log('\\n  No routes found.\\n')\n    return\n  }\n\n  // API Routes\n  if (apiRoutes.length > 0) {\n    console.log('\\n  API Routes')\n    console.log('  ' + '─'.repeat(60))\n    for (const route of apiRoutes) {\n      const rel = relative(cwd, route.filePath)\n      console.log(`  GET/POST  ${route.routePath.padEnd(30)} ${rel}`)\n    }\n  }\n\n  // Actions\n  if (actions.length > 0) {\n    console.log('\\n  Actions')\n    console.log('  ' + '─'.repeat(60))\n    for (const action of actions) {\n      const rel = relative(cwd, action.filePath)\n      console.log(`  POST      /api/__actions/${action.actionPath.padEnd(18)} ${rel}`)\n    }\n  }\n\n  // WebSocket\n  if (wsRoutes.length > 0) {\n    console.log('\\n  WebSocket')\n    console.log('  ' + '─'.repeat(60))\n    for (const route of wsRoutes) {\n      const rel = relative(cwd, route.filePath)\n      console.log(`  WS        ${route.wsPath.padEnd(30)} ${rel}`)\n    }\n  }\n\n  console.log(`\\n  Total: ${totalCount} endpoints\\n`)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS,gBAAgB;AAQlC,eAAsB,gBAA+B;AACnD,QAAM,MAAM,QAAQ,IAAI;AACxB,QAAM,SAAS,MAAM,WAAW,GAAG;AAEnC,2BAAyB,KAAK,OAAO,MAAM;AAE3C,QAAM,YAAY,QAAQ,KAAK,OAAO,SAAS;AAE/C,QAAM,YAAY,iBAAiB,SAAS;AAC5C,QAAM,UAAU,kBAAkB,SAAS;AAC3C,QAAM,WAAW,oBAAoB,SAAS;AAE9C,QAAM,aAAa,UAAU,SAAS,QAAQ,SAAS,SAAS;AAEhE,MAAI,eAAe,GAAG;AACpB,YAAQ,IAAI,wBAAwB;AACpC;AAAA,EACF;AAGA,MAAI,UAAU,SAAS,GAAG;AACxB,YAAQ,IAAI,gBAAgB;AAC5B,YAAQ,IAAI,OAAO,SAAI,OAAO,EAAE,CAAC;AACjC,eAAW,SAAS,WAAW;AAC7B,YAAM,MAAM,SAAS,KAAK,MAAM,QAAQ;AACxC,cAAQ,IAAI,eAAe,MAAM,UAAU,OAAO,EAAE,CAAC,IAAI,GAAG,EAAE;AAAA,IAChE;AAAA,EACF;AAGA,MAAI,QAAQ,SAAS,GAAG;AACtB,YAAQ,IAAI,aAAa;AACzB,YAAQ,IAAI,OAAO,SAAI,OAAO,EAAE,CAAC;AACjC,eAAW,UAAU,SAAS;AAC5B,YAAM,MAAM,SAAS,KAAK,OAAO,QAAQ;AACzC,cAAQ,IAAI,8BAA8B,OAAO,WAAW,OAAO,EAAE,CAAC,IAAI,GAAG,EAAE;AAAA,IACjF;AAAA,EACF;AAGA,MAAI,SAAS,SAAS,GAAG;AACvB,YAAQ,IAAI,eAAe;AAC3B,YAAQ,IAAI,OAAO,SAAI,OAAO,EAAE,CAAC;AACjC,eAAW,SAAS,UAAU;AAC5B,YAAM,MAAM,SAAS,KAAK,MAAM,QAAQ;AACxC,cAAQ,IAAI,eAAe,MAAM,OAAO,OAAO,EAAE,CAAC,IAAI,GAAG,EAAE;AAAA,IAC7D;AAAA,EACF;AAEA,UAAQ,IAAI;AAAA,WAAc,UAAU;AAAA,CAAc;AACpD;","names":[]}
+{"version":3,"sources":["../src/cli/commands/routes.ts"],"sourcesContent":["import { resolve, relative } from 'node:path'\n\nimport { loadConfig } from '../../config/load-config.js'\nimport { validateProjectStructure } from '../../config/validate-structure.js'\nimport { scanServerActions } from '../../server/scan/action-scan.js'\nimport { scanServerRoutes } from '../../server/scan/scan.js'\nimport { scanWebSocketRoutes } from '../../server/scan/ws-scan.js'\n\nexport async function routesCommand(): Promise<void> {\n  const cwd = process.cwd()\n  const config = await loadConfig(cwd)\n  // #95 — honor config.appDir so a custom frontend dir (e.g. apps/web) passes the structure gate.\n  validateProjectStructure(cwd, config.appDir)\n\n  const serverDir = resolve(cwd, config.serverDir)\n\n  const apiRoutes = scanServerRoutes(serverDir)\n  const actions = scanServerActions(serverDir)\n  const wsRoutes = scanWebSocketRoutes(serverDir)\n\n  const totalCount = apiRoutes.length + actions.length + wsRoutes.length\n\n  if (totalCount === 0) {\n    console.log('\\n  No routes found.\\n')\n    return\n  }\n\n  // API Routes\n  if (apiRoutes.length > 0) {\n    console.log('\\n  API Routes')\n    console.log('  ' + '─'.repeat(60))\n    for (const route of apiRoutes) {\n      const rel = relative(cwd, route.filePath)\n      console.log(`  GET/POST  ${route.routePath.padEnd(30)} ${rel}`)\n    }\n  }\n\n  // Actions\n  if (actions.length > 0) {\n    console.log('\\n  Actions')\n    console.log('  ' + '─'.repeat(60))\n    for (const action of actions) {\n      const rel = relative(cwd, action.filePath)\n      console.log(`  POST      /api/__actions/${action.actionPath.padEnd(18)} ${rel}`)\n    }\n  }\n\n  // WebSocket\n  if (wsRoutes.length > 0) {\n    console.log('\\n  WebSocket')\n    console.log('  ' + '─'.repeat(60))\n    for (const route of wsRoutes) {\n      const rel = relative(cwd, route.filePath)\n      console.log(`  WS        ${route.wsPath.padEnd(30)} ${rel}`)\n    }\n  }\n\n  console.log(`\\n  Total: ${totalCount} endpoints\\n`)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS,gBAAgB;AAQlC,eAAsB,gBAA+B;AACnD,QAAM,MAAM,QAAQ,IAAI;AACxB,QAAM,SAAS,MAAM,WAAW,GAAG;AAEnC,2BAAyB,KAAK,OAAO,MAAM;AAE3C,QAAM,YAAY,QAAQ,KAAK,OAAO,SAAS;AAE/C,QAAM,YAAY,iBAAiB,SAAS;AAC5C,QAAM,UAAU,kBAAkB,SAAS;AAC3C,QAAM,WAAW,oBAAoB,SAAS;AAE9C,QAAM,aAAa,UAAU,SAAS,QAAQ,SAAS,SAAS;AAEhE,MAAI,eAAe,GAAG;AACpB,YAAQ,IAAI,wBAAwB;AACpC;AAAA,EACF;AAGA,MAAI,UAAU,SAAS,GAAG;AACxB,YAAQ,IAAI,gBAAgB;AAC5B,YAAQ,IAAI,OAAO,SAAI,OAAO,EAAE,CAAC;AACjC,eAAW,SAAS,WAAW;AAC7B,YAAM,MAAM,SAAS,KAAK,MAAM,QAAQ;AACxC,cAAQ,IAAI,eAAe,MAAM,UAAU,OAAO,EAAE,CAAC,IAAI,GAAG,EAAE;AAAA,IAChE;AAAA,EACF;AAGA,MAAI,QAAQ,SAAS,GAAG;AACtB,YAAQ,IAAI,aAAa;AACzB,YAAQ,IAAI,OAAO,SAAI,OAAO,EAAE,CAAC;AACjC,eAAW,UAAU,SAAS;AAC5B,YAAM,MAAM,SAAS,KAAK,OAAO,QAAQ;AACzC,cAAQ,IAAI,8BAA8B,OAAO,WAAW,OAAO,EAAE,CAAC,IAAI,GAAG,EAAE;AAAA,IACjF;AAAA,EACF;AAGA,MAAI,SAAS,SAAS,GAAG;AACvB,YAAQ,IAAI,eAAe;AAC3B,YAAQ,IAAI,OAAO,SAAI,OAAO,EAAE,CAAC;AACjC,eAAW,SAAS,UAAU;AAC5B,YAAM,MAAM,SAAS,KAAK,MAAM,QAAQ;AACxC,cAAQ,IAAI,eAAe,MAAM,OAAO,OAAO,EAAE,CAAC,IAAI,GAAG,EAAE;AAAA,IAC7D;AAAA,EACF;AAEA,UAAQ,IAAI;AAAA,WAAc,UAAU;AAAA,CAAc;AACpD;","names":[]}

package/dist/{scan-7MJC6PYU.js → scan-YJEE4KQK.js}

@@ -2,8 +2,8 @@
 import "tsx/esm";
 import {
   scanRoutes
-} from "./chunk-IEES3CHD.js";
+} from "./chunk-47MM2JUK.js";
 export {
   scanRoutes
 };
-//# sourceMappingURL=scan-7MJC6PYU.js.map
+//# sourceMappingURL=scan-YJEE4KQK.js.map

package/dist/{schema-DNIT7JQX.js → schema-SOAD43RQ.js}

@@ -1,13 +1,15 @@
 #!/usr/bin/env node
 import "tsx/esm";
+import {
+  theoConfigSchema
+} from "./chunk-FH3SQR6P.js";
+import "./chunk-ZNZISJDZ.js";
 import {
   cacheSchema,
   corsSchema,
   securityHeadersSchema,
-  storageSchema,
-  theoConfigSchema
-} from "./chunk-CMYSHZFT.js";
-import "./chunk-WSXNGF7X.js";
+  storageSchema
+} from "./chunk-VI7ZANB3.js";
 export {
   cacheSchema,
   corsSchema,
@@ -15,4 +17,4 @@ export {
   storageSchema,
   theoConfigSchema
 };
-//# sourceMappingURL=schema-DNIT7JQX.js.map
+//# sourceMappingURL=schema-SOAD43RQ.js.map

package/dist/schemas-4AXHQMV3.js

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+import "tsx/esm";
+import {
+  cacheSchema,
+  corsSchema,
+  loggingSchema,
+  observabilitySchema,
+  rateLimitSchema,
+  securityHeadersSchema,
+  securitySchema,
+  storageSchema,
+  uploadSchema
+} from "./chunk-VI7ZANB3.js";
+export {
+  cacheSchema,
+  corsSchema,
+  loggingSchema,
+  observabilitySchema,
+  rateLimitSchema,
+  securityHeadersSchema,
+  securitySchema,
+  storageSchema,
+  uploadSchema
+};
+//# sourceMappingURL=schemas-4AXHQMV3.js.map

package/dist/schemas-4AXHQMV3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/security-headers-Ccj7ncNx.d.ts

@@ -0,0 +1,129 @@
+/**
+ * The security-header baseline, as a pure function of configuration.
+ *
+ * It lives in `core/contracts/` because **every** target needs it and none of it
+ * is transport-specific: `buildSecurityHeaders` takes a config object and
+ * returns `Record<string, string>`. `theokit start` writes that map onto a Node
+ * `ServerResponse` (`server/security/security-headers.ts`); the six Web deploy
+ * adapters write it onto a `Response` (`adapters/security-headers.ts`). Putting
+ * it under `server/` made the second group import across a boundary the
+ * dependency graph forbids — `adapters → server` is not a declared edge in
+ * ADR-0001 v3 — and the fix is not to widen the rule but to notice that this
+ * code was never server code.
+ *
+ * `core/contracts/<file>.ts` is the declared exception to the deep-import rule,
+ * so both callers reach it directly and there is still exactly ONE definition of
+ * what a configured header set means.
+ *
+ * Phase 6 — Default Security Headers (D4 / EC-2).
+ *
+ * Per-response security baseline. The framework applies these BEFORE the
+ * route handler runs so a handler can still override via `res.setHeader`.
+ *
+ * EC-2 backward-compatibility: CSP ships in `report-only` mode by default
+ * for 0.2.0. Existing apps with inline scripts or third-party CDN scripts
+ * keep working but consumers see violation reports via their CSP report
+ * collector (or browser DevTools). 0.3.0 will flip the default to
+ * `enforce` after a release of visibility.
+ */
+/**
+ * Default Content-Security-Policy. Conservative-but-not-paralyzing:
+ *
+ *   - default-src 'self'              — every fetch falls back to same-origin
+ *   - script-src 'self'               — T6.1 (0.3.0): `'unsafe-inline'`
+ *                                         dropped. The SSR pipeline issues a
+ *                                         per-request nonce that REPLACES
+ *                                         this directive at runtime
+ *                                         (`'nonce-<token>'`). For static /
+ *                                         non-SSR contexts where no nonce is
+ *                                         available, the policy is strict-
+ *                                         no-inline — user inline scripts
+ *                                         must be migrated to external
+ *                                         `<script src="...">` or threaded
+ *                                         through `ctx.nonce`.
+ *   - style-src 'self' 'unsafe-inline' — Tailwind + TheoUI use style attrs
+ *                                         in animation directives
+ *   - img-src 'self' data: blob:      — supports inline data URIs, blobs
+ *                                         from canvas exports
+ *   - font-src 'self' data:           — Geist fonts inline-base64
+ *   - connect-src 'self' ws: wss:     — WebSocket dev HMR + agent streams
+ *   - frame-ancestors 'none'          — clickjacking defense
+ */
+/**
+ * T5.1 — default CSP includes the built-in report endpoint so violations
+ * are visible without extra config. Apps that ship a custom `csp` string
+ * override the report-uri.
+ */
+declare const DEFAULT_CSP: string;
+/**
+ * T1.1 — Default Permissions-Policy header (default-deny stance).
+ *
+ * Disables sensitive Web APIs that the vast majority of apps don't use.
+ * Apps that DO need any of these opt in by overriding `permissionsPolicy`
+ * in `config.security.headers`.
+ *
+ * The seven features listed are the most-abused for: tracking
+ * (geolocation, accelerometer, gyroscope), spyware (camera, microphone),
+ * fraud (payment), and hardware exfiltration (usb).
+ *
+ * Aligns with Mozilla baseline + OWASP Secure Headers + Lighthouse PWA.
+ */
+declare const DEFAULT_PERMISSIONS_POLICY = "geolocation=(), camera=(), microphone=(), payment=(), usb=(), accelerometer=(), gyroscope=()";
+type CspMode = 'enforce' | 'report-only' | 'off';
+interface SecurityHeadersConfig {
+    /**
+     * Custom CSP policy string. When set, replaces the default verbatim.
+     * Pass `false` to disable CSP entirely (alias for `cspMode: 'off'`).
+     */
+    csp?: string | false;
+    /**
+     * Enforcement mode for CSP. Default `report-only` for 0.2.0 (EC-2).
+     * 0.3.0 will default to `enforce`.
+     */
+    cspMode?: CspMode;
+    /**
+     * Strict-Transport-Security value. Defaults to
+     * `max-age=31536000; includeSubDomains` in production. Pass `false` to
+     * suppress (e.g. internal LANs without TLS).
+     */
+    hsts?: string | false;
+    /** X-Frame-Options. Default DENY. */
+    frameOptions?: 'DENY' | 'SAMEORIGIN';
+    /** X-Content-Type-Options. Default `nosniff`. */
+    contentTypeOptions?: 'nosniff';
+    /** Referrer-Policy. Default `strict-origin-when-cross-origin`. */
+    referrerPolicy?: string;
+    /**
+     * T1.1 — Permissions-Policy directive string. When set, replaces the
+     * default verbatim (no merge — see ADR-EC-12). Pass `false` to disable
+     * the header entirely. Schema-level refinement rejects any string
+     * containing CR/LF (EC-3 — CWE-113 HTTP Response Splitting mitigation).
+     */
+    permissionsPolicy?: string | false;
+}
+interface SecurityEnv {
+    production: boolean;
+}
+/**
+ * T4.1 — Per-request options passed by the SSR pipeline.
+ *
+ * - `nonce`: when set, the framework substitutes the `'unsafe-inline'`
+ *   token in `script-src` with `'nonce-<nonce>'`. EC-3 forces
+ *   `Cache-Control: private, no-store` so a CDN cannot cache the HTML
+ *   (carrying one nonce) and re-serve it with a freshly-generated CSP
+ *   header (carrying a different nonce).
+ * - `prerender`: when true, the nonce is IGNORED. Prerendered HTML is
+ *   generated at build time with no nonce in the script tags; mixing a
+ *   runtime nonce in the header would block every script. EC-4.
+ */
+interface SecurityHeadersOptions {
+    nonce?: string;
+    prerender?: boolean;
+}
+/**
+ * Build the security headers map for a given config + env. Pure function —
+ * returned object can be inspected, logged, or applied to a response.
+ */
+declare function buildSecurityHeaders(config: SecurityHeadersConfig, env: SecurityEnv, options?: SecurityHeadersOptions): Record<string, string>;
+
+export { type CspMode as C, DEFAULT_CSP as D, type SecurityHeadersConfig as S, DEFAULT_PERMISSIONS_POLICY as a, buildSecurityHeaders as b, type SecurityEnv as c, type SecurityHeadersOptions as d };

package/dist/server/agent/index.d.ts

@@ -4,110 +4,7 @@ import { AcpTransport } from '@theokit/agents';
 export { InProcessApprovalRequest, InProcessApprovalRequiredError, InProcessAwaitApproval, StreamAgentTurnDeps, StreamAgentTurnInProcessInput, streamAgentTurnInProcess } from '@theokit/agents';
 import { CustomTool as CustomTool$1 } from '@theokit/sdk';
 import { V as VerifyFn } from '../../webhook-types-DGIjjcaI.js';
-
-/**
- * Provider Resolver — Strategy + Registry pattern (FAANG-grade).
- *
- * Inspiration: Dapr Conversation Registry (`dapr/pkg/components/conversation/registry.go`)
- * + Encore Manager provider array (`encore/runtimes/go/pubsub/manager_internal.go`).
- *
- * Principle: provider routing is the FRAMEWORK's responsibility, not the consumer's — but the
- * consumer still gets to SAY which provider it wants, and it says so in the model id.
- *
- * `provider/model` is the convention every agent in this ecosystem already writes
- * (`anthropic/claude-sonnet-4-6`, `openrouter/anthropic/claude-haiku-4.5`), and it is the one the
- * SDK routes on. Until theokit#326 this resolver ignored it entirely and picked by env-var
- * priority, so an agent that declared `anthropic/...` was handed an OpenRouter key whenever one
- * happened to be present — and every turn failed with `auth_failed (HTTP 401)` against a provider
- * nobody asked for. The declared provider now wins; priority is the fallback for a bare model id.
- *
- * Wire protocol: OpenAI Chat Completions (universal — implemented by every
- * os providers: OpenRouter, Groq, Mistral, Together, Anthropic via proxy, etc).
- *
- * Resolution by priority (FIRST match wins):
- *   1. OPENROUTER_API_KEY → baseUrl=openrouter.ai (multi-model gateway)
- *   2. OPENAI_API_KEY     → baseUrl=api.openai.com
- *   3. ANTHROPIC_API_KEY  → direct Anthropic (Messages API, not OpenAI-compat)
- *
- * Escape hatch: an explicit `options.apiKey` OVERRIDES auto-resolution
- * (the consumer can force a specific provider if it wants to).
- */
-/**
- * Provider configuration descriptor — Registry entry shape.
- *
- * @public
- */
-interface ProviderDescriptor {
-    /** Stable name used internally — not exposed on the wire. */
-    name: string;
-    /** Environment variable that holds the API key for this provider. */
-    envKey: string;
-    /** Base URL for the provider's OpenAI-compatible (or native) API. */
-    baseUrl: string;
-    /** Resolution priority (lower = higher priority). FIRST match wins. */
-    priority: number;
-}
-/**
- * Resolved provider configuration — output of `resolveProvider()`.
- *
- * @public
- */
-interface ResolvedProvider {
-    name: string;
-    apiKey: string;
-    baseUrl: string;
-}
-/** Where the announcement goes, and what it may contain. @public */
-interface ResolveOptions {
-    /** Receives one line per provider, at most once. NEVER receives the key. */
-    announce?: (line: string) => void;
-}
-/**
- * Register a new provider (Registry pattern — runtime extension point).
- * Useful for self-hosted endpoints or custom providers without touching theokit src.
- *
- * @example
- * registerProvider({
- *   name: 'self-hosted',
- *   envKey: 'SELF_HOSTED_API_KEY',
- *   baseUrl: 'https://llm.internal.acme.com/v1',
- *   priority: 0, // highest priority
- * })
- *
- * @public
- */
-declare function registerProvider(descriptor: ProviderDescriptor): void;
-/**
- * Reset registry to DEFAULT_REGISTRY (test-only / dev escape hatch).
- *
- * @public
- */
-declare function resetProviderRegistry(): void;
-/**
- * Get current registry snapshot (read-only — inspection).
- *
- * @public
- */
-declare function listProviders(): readonly ProviderDescriptor[];
-/**
- * Resolve the provider for a model.
- *
- * When `modelId` declares a registered provider (`anthropic/…`), THAT provider's key is
- * required — no substitution. Otherwise the registry is walked by priority, first match wins.
- *
- * @returns ResolvedProvider with apiKey + baseUrl + name
- * @throws Error if NO provider env var is set (actionable message)
- *
- * @public
- */
-declare function resolveProvider(modelId?: string, options?: ResolveOptions): ResolvedProvider;
-/**
- * Try to resolve — does NOT throw. Returns null if no provider available.
- * Useful for graceful degradation (e.g., mock mode).
- *
- * @public
- */
-declare function tryResolveProvider(modelId?: string): ResolvedProvider | null;
+export { P as ProviderDescriptor, R as ResolvedProvider, l as listProviders, a as registerProvider, b as resetProviderRegistry, r as resolveProvider, t as tryResolveProvider } from '../../provider-resolver-Dx6QuWrw.js';
 
 /**
  * M26 (ADR-0041) — `createWorkflowTool`: wrap an SDK `Workflow` as a `CustomTool`.
@@ -424,4 +321,4 @@ interface StdioStreams {
  */
 declare function serveMcpStdio(mod: unknown, name: string, appResources: readonly AppResource[], streams: StdioStreams): Promise<void>;
 
-export { type AcpToolConfig, type AppResource, type AppResourceInput, type ChannelMessage, type ChannelWebhookConfig, type CodeModeApi, type CodeModeConfig, type CodeModePermission, CodeModePermissionDeniedError, type McpResourceContents, type McpResourceDescriptor, NodeAcpTransport, type ProviderDescriptor, type ResolvedProvider, type Sandbox, type StdioStreams, type VendorAgentClient, type VendorAgentToolConfig, type WorkflowLike, type WorkflowToolConfig, buildResourceDescriptors, createACPTool, createCodeMode, createVendorAgentTool, createWorkflowTool, defineAppResource, extractAppResources, handleChannelWebhook, handleMcpStdioLine, isChannelPath, listProviders, parseChannelPath, readAppResource, registerProvider, resetProviderRegistry, resolveProvider, serveMcpStdio, tryResolveProvider };
+export { type AcpToolConfig, type AppResource, type AppResourceInput, type ChannelMessage, type ChannelWebhookConfig, type CodeModeApi, type CodeModeConfig, type CodeModePermission, CodeModePermissionDeniedError, type McpResourceContents, type McpResourceDescriptor, NodeAcpTransport, type Sandbox, type StdioStreams, type VendorAgentClient, type VendorAgentToolConfig, type WorkflowLike, type WorkflowToolConfig, buildResourceDescriptors, createACPTool, createCodeMode, createVendorAgentTool, createWorkflowTool, defineAppResource, extractAppResources, handleChannelWebhook, handleMcpStdioLine, isChannelPath, parseChannelPath, readAppResource, serveMcpStdio };

package/dist/server/agent/index.js

@@ -25,7 +25,7 @@ import {
   resetProviderRegistry,
   resolveProvider,
   tryResolveProvider
-} from "../../chunk-AXKUA57G.js";
+} from "../../chunk-3PBAN2YE.js";
 import "../../chunk-SAFGDIPQ.js";
 import "../../chunk-XTHN6JBX.js";
 export {

package/dist/server/auth/index.d.ts

@@ -1,26 +1,7 @@
 import { IncomingMessage, ServerResponse } from 'node:http';
+export { g as generateNonce } from '../../nonce-BXt7Qu_C.js';
 import { R as RateLimitStore } from '../../rate-limit-store-BEJnhWdw.js';
 
-/**
- * T4.1 — Per-request CSP nonce generation.
- *
- * Returns a 22–24 character base64-encoded string carrying 16 bytes of
- * cryptographic entropy. Used by the SSR pipeline to nonce the inline
- * hydration data script so the default CSP can drop `'unsafe-inline'`
- * from `script-src` in 0.3.0.
- *
- * Runtime portability: prefers Web Crypto (`globalThis.crypto`) because
- * it is available on every target runtime (Node 19+, Bun, Deno, Vercel
- * Edge, Cloudflare Workers). Falls back to `node:crypto` for older Node
- * builds where `globalThis.crypto` is absent.
- *
- * NOT a security primitive in the cryptographic sense — the nonce is a
- * one-shot, single-request value that defeats trivial XSS injection by
- * making the attacker guess a 128-bit string per request. It is NOT
- * suitable for signing or session tokens.
- */
-declare function generateNonce(): string;
-
 declare class AuthRequiredError extends Error {
     code: "AUTH_REQUIRED";
     status: number;
@@ -416,4 +397,4 @@ declare function clearOidcCache(): void;
  */
 declare function discoverOidcProvider(issuer: string | URL): Promise<OidcMetadata>;
 
-export { AuthRequiredError, type BackupCode, type BackupCodeOptions, type OidcMetadata, type PkceChallenge, type SessionConfig, type SessionManager, type SessionManagerWeb, type SessionMeta, type ThrottleOptions, type ThrottleState, type TotpAlgorithm, type TotpOptions, type TotpUriOptions, type VerifyTotpOptions, _resetKeyCacheForTests, assertProductionSecret, checkThrottle, clearOidcCache, createSessionManager, createSessionManagerWeb, decrypt, discoverOidcProvider, encrypt, generateBackupCodes, generateNonce, generateOAuthState, generatePkceChallenge, generateTotp, generateTotpSecret, pkceChallengeFromVerifier, recordAttempt, requireAuth, rotateIfNeeded, rotateIfNeededWeb, totpUri, verifyBackupCode, verifyOAuthState, verifyTotp };
+export { AuthRequiredError, type BackupCode, type BackupCodeOptions, type OidcMetadata, type PkceChallenge, type SessionConfig, type SessionManager, type SessionManagerWeb, type SessionMeta, type ThrottleOptions, type ThrottleState, type TotpAlgorithm, type TotpOptions, type TotpUriOptions, type VerifyTotpOptions, _resetKeyCacheForTests, assertProductionSecret, checkThrottle, clearOidcCache, createSessionManager, createSessionManagerWeb, decrypt, discoverOidcProvider, encrypt, generateBackupCodes, generateOAuthState, generatePkceChallenge, generateTotp, generateTotpSecret, pkceChallengeFromVerifier, recordAttempt, requireAuth, rotateIfNeeded, rotateIfNeededWeb, totpUri, verifyBackupCode, verifyOAuthState, verifyTotp };

package/dist/server/auth/index.js

@@ -23,11 +23,12 @@ import {
   verifyBackupCode,
   verifyOAuthState,
   verifyTotp
-} from "../../chunk-646CA6RV.js";
+} from "../../chunk-RQW5YMH7.js";
 import "../../chunk-4FWBKX6G.js";
+import "../../chunk-YSJOZEI6.js";
 import {
   generateNonce
-} from "../../chunk-JA2ZAT5Q.js";
+} from "../../chunk-Z4PJMZLM.js";
 import "../../chunk-XTHN6JBX.js";
 export {
   AuthRequiredError,

package/dist/server/cron/index.js

@@ -14,11 +14,12 @@ import {
   translateCronToVercel,
   validateCronSchedule,
   writeCronManifest
-} from "../../chunk-LXAESF4Y.js";
+} from "../../chunk-HK4AZBKX.js";
 import "../../chunk-VZTYCAO6.js";
-import "../../chunk-RWNSW4FM.js";
+import "../../chunk-UMNXCU3K.js";
 import "../../chunk-52PDWL5S.js";
-import "../../chunk-U267AOWS.js";
+import "../../chunk-5K4TDLRG.js";
+import "../../chunk-ZWN3AODA.js";
 import "../../chunk-XTHN6JBX.js";
 export {
   CRON_MANIFEST_SCHEMA_VERSION,

package/dist/server/define/index.d.ts

@@ -1,65 +1,16 @@
+import { R as RouteConfig } from '../../route-config-Cm_ZMA1C.js';
 import { z } from 'zod';
 import { W as WebSocketHandler, b as WebSocketLike } from '../../define-websocket-DzPn1sR6.js';
 export { a as WebSocketHandlerWeb } from '../../define-websocket-DzPn1sR6.js';
 import { b as ToolTransform, C as CustomTool } from '../../define-agent-tool-cRuSpidb.js';
 export { D as DefineAgentToolSpec, T as ToolContextMessage, a as ToolHandlerContext, c as applyTransform } from '../../define-agent-tool-cRuSpidb.js';
-import { f as OnRequestHook, i as PreHandlerHook, g as OnResponseHook, O as OnErrorHook, T as TheoPlugin } from '../../plugin-types-4VN1GMqV.js';
+import { R as RoutePolicy } from '../../route-policy-BxOycCDq.js';
+export { A as AccessDecision, b as RoutePolicyInput, a as RouteSubject, e as evaluateRoutePolicy, r as requireOwner, s as subjectFromContext } from '../../route-policy-BxOycCDq.js';
+import { c as OnRequestHook, f as PreHandlerHook, d as OnResponseHook, O as OnErrorHook, T as TheoPlugin } from '../../plugin-types-BUVfUQ0V.js';
 import { WireChunk } from '@theokit/presenter/wire';
 import { IncomingMessage } from 'node:http';
 export { H as HEALTH_PATH, a as HealthRouteConfig, b as READY_PATH, c as ReadyRouteConfig, d as ReservedResponse, R as ReservedRoutes, e as defineHealthRoute, f as defineReadyRoute, s as serveReservedRoute } from '../../health-route-C0hk64_U.js';
 
-/**
- * core/contracts/route-config.ts
- *
- * Canonical home for `RouteConfig<TQuery, TBody, TParams, TCtx, TResponse>` —
- * the contract shape consumed by `defineRoute()` (server) and
- * `defineCachedRoute()` (cache).
- *
- * Moved here in T2.2 of architecture-cleanup so `cache → core/contracts`
- * is the legal edge (replacing the prior `cache → server` violation).
- *
- * GAP-4 (plan v1.1): the 5-arity generic shape `<TQuery, TBody, TParams, TCtx, TResponse>`
- * MUST be preserved byte-by-byte. Type tests assert this in
- * `tests/unit/route-config-generic-arity.test.ts`.
- */
-
-interface RouteConfig<TQuery extends z.ZodType = z.ZodUndefined, TBody extends z.ZodType = z.ZodUndefined, TParams extends z.ZodType = z.ZodUndefined, TCtx = unknown, TResponse = unknown> {
-    query?: TQuery;
-    body?: TBody;
-    params?: TParams;
-    status?: number;
-    /**
-     * Optional Zod schema for the handler's plain-object return value. When
-     * present, BOTH runtimes (Node `executeRoute` + Web `executeWebRequest`)
-     * validate the handler's plain-object return against it BEFORE serializing.
-     *
-     * A mismatch is a SERVER fault (the handler violated its own declared
-     * contract) → 500 `INTERNAL_SERVER_ERROR`, distinct from the 400 used for
-     * input (`query`/`body`/`params`) validation failures.
-     *
-     * `Response`-instance returns (and `undefined`/`null` → 204) are NOT
-     * validated. This is a plain optional field — runtime validation only; the
-     * handler return type is NOT statically inferred from `response` (YAGNI).
-     */
-    response?: z.ZodType;
-    /**
-     * Opt out of CSRF enforcement for this route. Use for endpoints that
-     * legitimately receive third-party POSTs (Stripe webhooks, GitHub
-     * webhooks, OAuth callbacks). Defaults to enforced per `config.security.csrf`.
-     *
-     * Setting `csrf: false` only disables the per-route check — it does NOT
-     * disable the global mode setting for other routes.
-     */
-    csrf?: false;
-    handler: (ctx: {
-        query: z.infer<TQuery>;
-        body: z.infer<TBody>;
-        params: z.infer<TParams>;
-        request: Request;
-        ctx: TCtx;
-    }) => TResponse | Promise<TResponse>;
-}
-
 /**
  * Action wire-protocol accept mode per plan g3-server-actions-and-useaction
  * v1.2 ADR D1. Default behavior (when omitted) is `'json'`. `'form'` opts the
@@ -95,7 +46,31 @@ interface ActionConfig<TInput extends z.ZodType, TCtx = unknown> {
     }) => unknown;
 }
 
-type MiddlewareHandler = (request: Request, next: (request: Request) => Promise<Response>) => Response | Promise<Response>;
+/**
+ * A middleware, as the framework's own builder produces it (usetheokit/theokit#345).
+ *
+ * `(request, context)`: read the request as a Web `Request`, decorate `context` for the route that
+ * follows, and RETURN a `Response` to answer the request yourself. Returning nothing continues to
+ * the next middleware, and then to the route.
+ *
+ * ## Why not `(request, next) => Response`
+ *
+ * That was this type's first shape, and it described a continuation pipeline nothing in this
+ * repository implements: the file-scan runner runs BEFORE routing, so it has no downstream
+ * `Response` to hand back from `next(request)`. The consequence was measured rather than
+ * theorised — `MiddlewareHandler` had **zero runtime consumers**, while `README.md` documented the
+ * builder that produces it as the way to write middleware. A published builder whose output nothing
+ * can call is worse than a missing one, because it reads as supported.
+ *
+ * This shape is the one that fits the model AND already runs: `executeWebRequest` has invoked
+ * `(request, context) => Response | void` since T3.2 (`http/web-middleware-runner.ts`). Adopting it
+ * here converges two of the three middleware contracts instead of adding a fourth.
+ *
+ * The Express-style `(req, res, next)` export keeps working in `server/middleware/*.ts`. It is
+ * Node-bound — which is why it cannot be the framework's contract — but evicting it would break
+ * every app that has one.
+ */
+type MiddlewareHandler = (request: Request, context: Record<string, unknown>) => Response | undefined | void | Promise<Response | undefined | void>;
 
 /**
  * M31 Phase 3 — `route()`, the fluent builder that replaces `defineRoute({...})`.
@@ -133,6 +108,16 @@ interface RouteBuilder<TQuery extends z.ZodType = z.ZodUndefined, TBody extends
     status(code: number): RouteBuilder<TQuery, TBody, TParams, TCtx, TResponse, THandlerSet>;
     /** Opt out of CSRF enforcement for this route (webhooks / OAuth callbacks). */
     csrf(disabled: false): RouteBuilder<TQuery, TBody, TParams, TCtx, TResponse, THandlerSet>;
+    /**
+     * Declare who may call this route (ADR 0001). Required — the scanner refuses a
+     * route file whose HTTP export declares no policy, and `'public'` is a
+     * declaration rather than a default.
+     *
+     * The policy is evaluated by the Node executor, the Web executor and
+     * `callProcedure` from one implementation, so a browser, a desktop shell and a
+     * terminal all get the same answer.
+     */
+    policy(policy: RoutePolicy<z.infer<TQuery>, z.infer<TBody>, z.infer<TParams>>): RouteBuilder<TQuery, TBody, TParams, TCtx, TResponse, THandlerSet>;
     /**
      * Set the handler. Its `ctx` infers `query/body/params` from the schemas set above. Required
      * before `.build()`.
@@ -151,8 +136,9 @@ interface RouteBuilder<TQuery extends z.ZodType = z.ZodUndefined, TBody extends
     build(...guard: THandlerSet extends true ? [] : [error: MissingHandlerError]): RouteConfig<TQuery, TBody, TParams, TCtx, TResponse>;
 }
 /**
- * Start a fluent route definition. Chain `.query/.body/.params/.response/.status/.csrf` (all
- * optional), then `.handler()` (required) and `.build()` for the `RouteConfig`.
+ * Start a fluent route definition. Chain `.query/.body/.params/.response/.status/.csrf`, declare
+ * `.policy()` (which the route scanner requires), then `.handler()` and `.build()` for the
+ * `RouteConfig`.
  */
 declare function route(): RouteBuilder;
 
@@ -416,4 +402,4 @@ interface WebChannelHandler<TMessage = unknown> {
  */
 declare function defineWebChannel<TMessage = unknown>(handler: WebChannelHandler<TMessage>): WebChannelHandler<TMessage>;
 
-export { type ActionAccept, type ActionBuilder, type ActionConfig, type ChannelHandler, CustomTool, type MiddlewareBuilder, type MiddlewareHandler, type PluginBuilder, type RouteBuilder, type RouteConfig, type ToolBuilder, ToolTransform, type WebChannelHandler, type WebSocketBuilder, WebSocketHandler, WebSocketLike, action, defineChannel, defineWebChannel, middleware, plugin, route, tool, uiMessageStreamResponse, websocket };
+export { type ActionAccept, type ActionBuilder, type ActionConfig, type ChannelHandler, CustomTool, type MiddlewareBuilder, type MiddlewareHandler, type PluginBuilder, type RouteBuilder, RouteConfig, RoutePolicy, type ToolBuilder, ToolTransform, type WebChannelHandler, type WebSocketBuilder, WebSocketHandler, WebSocketLike, action, defineChannel, defineWebChannel, middleware, plugin, route, tool, uiMessageStreamResponse, websocket };

package/dist/server/define/index.js

@@ -8,7 +8,13 @@ import {
   tool,
   uiMessageStreamResponse,
   websocket
-} from "../../chunk-YXG2SGQ3.js";
+} from "../../chunk-DHAD2O3S.js";
+import "../../chunk-D4VP2QPR.js";
+import {
+  evaluateRoutePolicy,
+  requireOwner,
+  subjectFromContext
+} from "../../chunk-YN4W7LCX.js";
 import {
   HEALTH_PATH,
   READY_PATH,
@@ -29,10 +35,13 @@ export {
   defineHealthRoute,
   defineReadyRoute,
   defineWebChannel,
+  evaluateRoutePolicy,
   middleware,
   plugin,
+  requireOwner,
   route,
   serveReservedRoute,
+  subjectFromContext,
   tool,
   uiMessageStreamResponse,
   websocket

package/dist/server/http/index.d.ts

@@ -1,11 +1,13 @@
-export { B as BATCH_PATH, a as BatchExecuteFn, b as BatchPathConflictError, c as BatchPayload, d as BatchRequestItem, e as BatchResponse, f as BatchResultItem, C as CookieOptions, g as CorsConfig, h as CorsHandler, i as CorsOrigin, j as CorsWebHandler, k as CustomErrorPages, E as ExecuteActionOptions, l as ExecuteRouteContext, H as HandleBatchOptions, M as MAX_ERROR_HTML_BYTES, m as MiddlewareResult, N as NotFoundError, S as STRIPPED_HEADERS, n as SendErrorInput, o as SendErrorOptions, T as TRACE_HEADER, p as TRACE_PARENT_HEADER, q as TheoError, _ as _resetMiddlewareCacheForTests, s as appendCookieToHeaders, t as appendDeleteCookieToHeaders, u as createCorsHandler, v as createCorsWebHandler, w as deleteCookie, x as envelopeCodeToStatus, y as executeAction, z as executeRoute, A as extractTraceId, D as extractTraceIdFromRequest, F as fromUnknown, G as getCookie, I as getCookieFromRequest, J as handleBatchRequest, K as handleRequestError, L as handleWebRequestError, P as loadCustomErrorPages, Q as matchesOrigin, R as parseCookieHeader, U as parseTraceparent, W as runMiddlewareAndContext, X as sendError, Y as sendJson, Z as serializeCookie, $ as serveStaticFile, a0 as serverErrorToEnvelope, a1 as setCookie } from '../../index-D_PxPXgQ.js';
+export { A as ActionError, b as ActionInputError, B as BATCH_PATH, e as BatchExecuteFn, f as BatchPathConflictError, g as BatchPayload, h as BatchRequestItem, i as BatchResponse, j as BatchResultItem, C as CookieOptions, l as CorsConfig, m as CorsHandler, n as CorsOrigin, o as CorsWebHandler, p as CustomErrorPages, E as ExecuteActionOptions, q as ExecuteRouteContext, F as FileTooLargeError, H as HandleBatchOptions, M as MAX_ERROR_HTML_BYTES, r as MiddlewareResult, N as NotFoundError, t as ProcedureInputError, u as ProcedureOutputError, S as STRIPPED_HEADERS, y as SendErrorInput, z as SendErrorOptions, T as TRACE_HEADER, G as TRACE_PARENT_HEADER, I as TheoError, W as W3CTraceContext, _ as _resetMiddlewareCacheForTests, L as appendCookieToHeaders, Q as appendDeleteCookieToHeaders, V as callProcedure, X as createCorsHandler, Y as createCorsWebHandler, Z as createOpenApiHandler, $ as createServerContext, a0 as deleteCookie, a1 as envelopeCodeToStatus, a2 as executeAction, a3 as executeRoute, a4 as executeWebRequest, a5 as extractTraceId, a6 as extractTraceIdFromRequest, a7 as extractUniversalIssues, a8 as extractW3CTraceContext, a9 as fromUnknown, aa as getCookie, ab as getCookieFromRequest, ac as handleBatchRequest, ad as handleRequestError, ae as handleWebRequestError, af as isActionError, ag as isInputError, ah as jsonTransformer, ai as loadCustomErrorPages, aj as matchesOrigin, ak as parseCookieHeader, al as parseRequestBody, am as parseTraceparent, an as parseTraceparentContext, ao as resolveTransformer, ap as runMiddlewareAndContext, aq as sendError, ar as sendJson, as as serializeCookie, at as serveStaticFile, au as serverErrorToEnvelope, av as setCookie, aw as superjsonTransformer, ax as validateRouteInput } from '../../index-CzxtQcnp.js';
 import '../../error-envelope-DG47lt8E.js';
 import 'node:http';
-import '../../plugin-types-4VN1GMqV.js';
-import '../../plugin-runner-DHVr1cC5.js';
+import '../../plugin-types-BUVfUQ0V.js';
+import '../../plugin-runner-BVMOSxvb.js';
 import '../../job-backend-CgC8Xf33.js';
-import '../../match-CfbEFRG4.js';
+import '../../match-DmGgxjIU.js';
 import 'vite';
-import '../../csrf-BBrEZSBW.js';
+import '../../csrf-Dgot9qSM.js';
 import '../../audit-log-BQWM5YLG.js';
 import 'zod';
+import '../../route-config-Cm_ZMA1C.js';
+import '../../route-policy-BxOycCDq.js';