theokit 0.48.14 → 0.50.1

package/dist/route-config-Cm_ZMA1C.d.ts

@@ -0,0 +1,72 @@
+import { z } from 'zod';
+import { R as RoutePolicy } from './route-policy-BxOycCDq.js';
+
+/**
+ * core/contracts/route-config.ts
+ *
+ * Canonical home for `RouteConfig<TQuery, TBody, TParams, TCtx, TResponse>` —
+ * the contract shape consumed by `defineRoute()` (server) and
+ * `defineCachedRoute()` (cache).
+ *
+ * Moved here in T2.2 of architecture-cleanup so `cache → core/contracts`
+ * is the legal edge (replacing the prior `cache → server` violation).
+ *
+ * GAP-4 (plan v1.1): the 5-arity generic shape `<TQuery, TBody, TParams, TCtx, TResponse>`
+ * MUST be preserved byte-by-byte. Type tests assert this in
+ * `tests/unit/route-config-generic-arity.test.ts`.
+ */
+
+interface RouteConfig<TQuery extends z.ZodType = z.ZodUndefined, TBody extends z.ZodType = z.ZodUndefined, TParams extends z.ZodType = z.ZodUndefined, TCtx = unknown, TResponse = unknown> {
+    query?: TQuery;
+    body?: TBody;
+    params?: TParams;
+    status?: number;
+    /**
+     * Optional Zod schema for the handler's plain-object return value. When
+     * present, BOTH runtimes (Node `executeRoute` + Web `executeWebRequest`)
+     * validate the handler's plain-object return against it BEFORE serializing.
+     *
+     * A mismatch is a SERVER fault (the handler violated its own declared
+     * contract) → 500 `INTERNAL_SERVER_ERROR`, distinct from the 400 used for
+     * input (`query`/`body`/`params`) validation failures.
+     *
+     * `Response`-instance returns (and `undefined`/`null` → 204) are NOT
+     * validated. This is a plain optional field — runtime validation only; the
+     * handler return type is NOT statically inferred from `response` (YAGNI).
+     */
+    response?: z.ZodType;
+    /**
+     * Opt out of CSRF enforcement for this route. Use for endpoints that
+     * legitimately receive third-party POSTs (Stripe webhooks, GitHub
+     * webhooks, OAuth callbacks). Defaults to enforced per `config.security.csrf`.
+     *
+     * Setting `csrf: false` only disables the per-route check — it does NOT
+     * disable the global mode setting for other routes.
+     */
+    csrf?: false;
+    /**
+     * Who may perform this operation (ADR 0001).
+     *
+     * Evaluated by the Node executor, the Web executor AND `callProcedure`, from
+     * one implementation — which is what makes "the same route gives the same
+     * access decision on every transport" a property of the code. Before this
+     * existed, a route's access rules applied over HTTP and applied nowhere
+     * in-process, and in-process is the path the desktop and terminal targets are
+     * built on.
+     *
+     * `'public'` is a declaration and not a default. Absence currently means "not
+     * declared" and is NOT reinterpreted as denial at runtime: flipping that would
+     * break every existing route in every consumer at once. The ADR routes it
+     * through a build-time gate and a migration instead.
+     */
+    policy?: RoutePolicy<z.infer<TQuery>, z.infer<TBody>, z.infer<TParams>>;
+    handler: (ctx: {
+        query: z.infer<TQuery>;
+        body: z.infer<TBody>;
+        params: z.infer<TParams>;
+        request: Request;
+        ctx: TCtx;
+    }) => TResponse | Promise<TResponse>;
+}
+
+export type { RouteConfig as R };

package/dist/route-policy-BxOycCDq.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Who is asking. Supplied by the caller through the run-context, never read from
+ * a transport.
+ *
+ * A cookie is one way to establish this and a terminal has no cookies, so the
+ * contract takes the resolved subject rather than the mechanism that resolved it
+ * (ADR 0001 section Decision, point 4).
+ */
+interface RouteSubject {
+    id: string;
+    [claim: string]: unknown;
+}
+/** The answer a policy gives. A denial carries its reason so the caller can say it. */
+type AccessDecision = {
+    allowed: true;
+} | {
+    allowed: false;
+    reason: string;
+};
+/** What a policy is handed. Deliberately transport-free: no headers, no cookies, no response. */
+interface RoutePolicyInput<TQuery = unknown, TBody = unknown, TParams = unknown> {
+    subject: RouteSubject | null;
+    query: TQuery;
+    body: TBody;
+    params: TParams;
+}
+/**
+ * A route's access policy.
+ *
+ * `'public'` is a declaration, not a default. The point of writing it is that
+ * openness becomes greppable — today a route that enforces nothing looks exactly
+ * like a route nobody thought about (ADR 0001 section Consequences, Risks).
+ */
+type RoutePolicy<TQuery = unknown, TBody = unknown, TParams = unknown> = 'public' | ((input: RoutePolicyInput<TQuery, TBody, TParams>) => boolean | AccessDecision | Promise<boolean | AccessDecision>);
+/** Narrow a run-context to the subject it carries, if it carries one. */
+declare function subjectFromContext(context: unknown): RouteSubject | null;
+/**
+ * Evaluate a route policy. THE single implementation - the HTTP executors and
+ * the in-process caller all reach this function, which is what makes "the same
+ * route gives the same access decision on every transport" a property of the code
+ * rather than a claim in a document.
+ *
+ * The shape mirrors `validateRouteInput`, which is already described in-source as
+ * "the SINGLE shared pipeline ... One pipeline, no drift". Access control had no
+ * such pipeline; that absence is what ADR 0001 exists to close.
+ *
+ * An undeclared policy returns `allowed` and is NOT the same thing as `'public'`.
+ * Absence is refused where an application DECLARES its routes — the file-system
+ * scanner fails the build naming the file (`MissingRoutePolicyError`) — and not
+ * here, where the argument may be a `RouteConfig` a caller built in memory and
+ * never scanned. Reinterpreting absence as denial at this point would break
+ * every direct caller of the executors at once, which the ADR routes through the
+ * build gate and a migration instead.
+ */
+declare function evaluateRoutePolicy(policy: RoutePolicy | undefined, input: RoutePolicyInput): Promise<AccessDecision>;
+/**
+ * The authorization primitive the framework did not have.
+ *
+ * `requireAuth` answers "is anyone there". Every action then answered "may THIS
+ * subject touch THIS record" on its own, which is one implementation per action
+ * and one place per action to get it wrong. This is that answer, once.
+ */
+declare function requireOwner(subject: RouteSubject | null, ownerId: string | null | undefined): AccessDecision;
+
+export { type AccessDecision as A, type RoutePolicy as R, type RouteSubject as a, type RoutePolicyInput as b, evaluateRoutePolicy as e, requireOwner as r, subjectFromContext as s };

package/dist/router/element-scroll-restoration.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Restore the scroll offset of elements the application marked as scrollers (#421).
+ *
+ * Mounted beside react-router's `<ScrollRestoration>`, not instead of it: that one owns the
+ * DOCUMENT, correctly and with its own timing, and this one owns the elements it cannot see. An app
+ * whose document scrolls keeps exactly the behaviour it had.
+ *
+ * ## What an application does
+ *
+ * ```tsx
+ * <main data-theo-scroll="main" className="overflow-y-auto">…</main>
+ * ```
+ *
+ * The attribute's VALUE is the id, so two scrollers on one page stay distinguishable.
+ *
+ * ## Why every decision is elsewhere
+ *
+ * This component queries, sequences, and nothing else — `scroll-restoration.ts` decides which key
+ * an offset lands under, when it is read back, and what happens to an element that is gone on
+ * return. That split is because this repository sets up no DOM test environment, so the part that
+ * cannot be covered by a test is deliberately the part with no branches in it.
+ *
+ * `useLayoutEffect` and not `useEffect`: the offset must be applied before the browser paints, or
+ * the user sees the top of the list and then a jump.
+ */
+declare function ElementScrollRestoration(): null;
+
+export { ElementScrollRestoration };

package/dist/router/element-scroll-restoration.js

@@ -0,0 +1,96 @@
+import "../chunk-XTHN6JBX.js";
+
+// src/router/element-scroll-restoration.tsx
+import { useLayoutEffect, useRef } from "react";
+import { useLocation } from "react-router";
+
+// src/router/scroll-restoration.ts
+var SCROLL_CONTAINER_ATTRIBUTE = "data-theo-scroll";
+function storageKey(locationKey) {
+  return `theokit:scroll:${locationKey}`;
+}
+function createScrollRestorer(store) {
+  return {
+    save(locationKey, targets) {
+      const offsets = {};
+      for (const target of targets) offsets[target.id] = target.scrollTop;
+      try {
+        store.set(storageKey(locationKey), JSON.stringify(offsets));
+      } catch {
+      }
+    },
+    restore(locationKey, targets) {
+      const offsets = readOffsets(store, locationKey);
+      if (offsets === void 0) return;
+      for (const target of targets) {
+        const offset = offsets[target.id];
+        if (typeof offset === "number") target.scrollTop = offset;
+      }
+    }
+  };
+}
+function readOffsets(store, locationKey) {
+  const raw = store.get(storageKey(locationKey));
+  if (raw === null) return void 0;
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed !== null && typeof parsed === "object" ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+
+// src/router/element-scroll-restoration.tsx
+function ElementScrollRestoration() {
+  const location = useLocation();
+  const previousKey = useRef(void 0);
+  useLayoutEffect(() => {
+    const restorer = createScrollRestorer(sessionScrollStore());
+    const leaving = previousKey.current;
+    if (leaving !== void 0) restorer.save(leaving, scrollTargets());
+    previousKey.current = location.key;
+    restorer.restore(location.key, scrollTargets());
+    const onHide = () => {
+      createScrollRestorer(sessionScrollStore()).save(location.key, scrollTargets());
+    };
+    window.addEventListener("pagehide", onHide);
+    return () => {
+      window.removeEventListener("pagehide", onHide);
+    };
+  }, [location.key]);
+  return null;
+}
+function scrollTargets() {
+  return [...document.querySelectorAll(`[${SCROLL_CONTAINER_ATTRIBUTE}]`)].flatMap((element) => {
+    const id = element.getAttribute(SCROLL_CONTAINER_ATTRIBUTE);
+    if (id === null || id === "") return [];
+    return [
+      {
+        id,
+        get scrollTop() {
+          return element.scrollTop;
+        },
+        set scrollTop(value) {
+          element.scrollTop = value;
+        }
+      }
+    ];
+  });
+}
+function sessionScrollStore() {
+  try {
+    const storage = window.sessionStorage;
+    return {
+      get: (key) => storage.getItem(key),
+      set: (key, value) => {
+        storage.setItem(key, value);
+      }
+    };
+  } catch {
+    return { get: () => null, set: () => void 0 };
+  }
+}
+export {
+  ElementScrollRestoration
+};
+//# sourceMappingURL=element-scroll-restoration.js.map

package/dist/router/element-scroll-restoration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/router/element-scroll-restoration.tsx","../../src/router/scroll-restoration.ts"],"mappings":";;;AAAA,SAAS,iBAAiB,cAAc;AACxC,SAAS,mBAAmB;;;ACiDrB,IAAM,6BAA6B;AAG1C,SAAS,WAAW,aAA6B;AAC/C,SAAO,kBAAkB,WAAW;AACtC;AASO,SAAS,qBAAqB,OAAoC;AACvE,SAAO;AAAA,IACL,KAAK,aAAa,SAAS;AACzB,YAAM,UAAkC,CAAC;AACzC,iBAAW,UAAU,QAAS,SAAQ,OAAO,EAAE,IAAI,OAAO;AAC1D,UAAI;AACF,cAAM,IAAI,WAAW,WAAW,GAAG,KAAK,UAAU,OAAO,CAAC;AAAA,MAC5D,QAAQ;AAAA,MAGR;AAAA,IACF;AAAA,IAEA,QAAQ,aAAa,SAAS;AAC5B,YAAM,UAAU,YAAY,OAAO,WAAW;AAC9C,UAAI,YAAY,OAAW;AAC3B,iBAAW,UAAU,SAAS;AAC5B,cAAM,SAAS,QAAQ,OAAO,EAAE;AAGhC,YAAI,OAAO,WAAW,SAAU,QAAO,YAAY;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,YAAY,OAAoB,aAA0D;AACjG,QAAM,MAAM,MAAM,IAAI,WAAW,WAAW,CAAC;AAC7C,MAAI,QAAQ,KAAM,QAAO;AACzB,MAAI;AACF,UAAM,SAAkB,KAAK,MAAM,GAAG;AAGtC,WAAO,WAAW,QAAQ,OAAO,WAAW,WACvC,SACD;AAAA,EACN,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ADpEO,SAAS,2BAAiC;AAC/C,QAAM,WAAW,YAAY;AAC7B,QAAM,cAAc,OAA2B,MAAS;AAExD,kBAAgB,MAAM;AACpB,UAAM,WAAW,qBAAqB,mBAAmB,CAAC;AAC1D,UAAM,UAAU,YAAY;AAC5B,QAAI,YAAY,OAAW,UAAS,KAAK,SAAS,cAAc,CAAC;AACjE,gBAAY,UAAU,SAAS;AAC/B,aAAS,QAAQ,SAAS,KAAK,cAAc,CAAC;AAI9C,UAAM,SAAS,MAAY;AACzB,2BAAqB,mBAAmB,CAAC,EAAE,KAAK,SAAS,KAAK,cAAc,CAAC;AAAA,IAC/E;AACA,WAAO,iBAAiB,YAAY,MAAM;AAC1C,WAAO,MAAM;AACX,aAAO,oBAAoB,YAAY,MAAM;AAAA,IAC/C;AAAA,EACF,GAAG,CAAC,SAAS,GAAG,CAAC;AAEjB,SAAO;AACT;AAWA,SAAS,gBAAgC;AACvC,SAAO,CAAC,GAAG,SAAS,iBAAiB,IAAI,0BAA0B,GAAG,CAAC,EAAE,QAAQ,CAAC,YAAY;AAC5F,UAAM,KAAK,QAAQ,aAAa,0BAA0B;AAC1D,QAAI,OAAO,QAAQ,OAAO,GAAI,QAAO,CAAC;AACtC,WAAO;AAAA,MACL;AAAA,QACE;AAAA,QACA,IAAI,YAAoB;AACtB,iBAAO,QAAQ;AAAA,QACjB;AAAA,QACA,IAAI,UAAU,OAAe;AAC3B,kBAAQ,YAAY;AAAA,QACtB;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAQA,SAAS,qBAAkC;AACzC,MAAI;AACF,UAAM,UAAU,OAAO;AACvB,WAAO;AAAA,MACL,KAAK,CAAC,QAAQ,QAAQ,QAAQ,GAAG;AAAA,MACjC,KAAK,CAAC,KAAK,UAAU;AACnB,gBAAQ,QAAQ,KAAK,KAAK;AAAA,MAC5B;AAAA,IACF;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,KAAK,MAAM,MAAM,KAAK,MAAM,OAAU;AAAA,EACjD;AACF;","names":[]}

package/dist/{routes-NJR4ISCT.js → routes-BPLU3ISV.js}

@@ -3,18 +3,20 @@ import "tsx/esm";
 import {
   validateProjectStructure
 } from "./chunk-GEQJAFSV.js";
-import {
-  loadConfig
-} from "./chunk-AATSV4UV.js";
-import "./chunk-HBU2GIMZ.js";
-import "./chunk-CMYSHZFT.js";
-import "./chunk-WSXNGF7X.js";
 import {
   scanServerActions,
   scanServerRoutes,
   scanWebSocketRoutes
-} from "./chunk-BMHS4WAN.js";
-import "./chunk-A7JBF5FO.js";
+} from "./chunk-XS7EX55U.js";
+import "./chunk-FD4ZDTQ6.js";
+import {
+  loadConfig
+} from "./chunk-QTHVHNJJ.js";
+import "./chunk-3QPVEJ7D.js";
+import "./chunk-U5PWXS3J.js";
+import "./chunk-FH3SQR6P.js";
+import "./chunk-ZNZISJDZ.js";
+import "./chunk-VI7ZANB3.js";
 
 // src/cli/commands/routes.ts
 import { resolve, relative } from "path";
@@ -62,4 +64,4 @@ async function routesCommand() {
 export {
   routesCommand
 };
-//# sourceMappingURL=routes-NJR4ISCT.js.map
+//# sourceMappingURL=routes-BPLU3ISV.js.map

package/dist/{routes-NJR4ISCT.js.map → routes-BPLU3ISV.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli/commands/routes.ts"],"sourcesContent":["import { resolve, relative } from 'node:path'\n\nimport { loadConfig } from '../../config/load-config.js'\nimport { validateProjectStructure } from '../../config/validate-structure.js'\nimport { scanServerActions } from '../../server/scan/action-scan.js'\nimport { scanServerRoutes } from '../../server/scan/scan.js'\nimport { scanWebSocketRoutes } from '../../server/scan/ws-scan.js'\n\nexport async function routesCommand(): Promise<void> {\n  const cwd = process.cwd()\n  const config = await loadConfig(cwd)\n  // #95 — honor config.appDir so a custom frontend dir (e.g. apps/web) passes the structure gate.\n  validateProjectStructure(cwd, config.appDir)\n\n  const serverDir = resolve(cwd, config.serverDir)\n\n  const apiRoutes = scanServerRoutes(serverDir)\n  const actions = scanServerActions(serverDir)\n  const wsRoutes = scanWebSocketRoutes(serverDir)\n\n  const totalCount = apiRoutes.length + actions.length + wsRoutes.length\n\n  if (totalCount === 0) {\n    console.log('\\n  No routes found.\\n')\n    return\n  }\n\n  // API Routes\n  if (apiRoutes.length > 0) {\n    console.log('\\n  API Routes')\n    console.log('  ' + '─'.repeat(60))\n    for (const route of apiRoutes) {\n      const rel = relative(cwd, route.filePath)\n      console.log(`  GET/POST  ${route.routePath.padEnd(30)} ${rel}`)\n    }\n  }\n\n  // Actions\n  if (actions.length > 0) {\n    console.log('\\n  Actions')\n    console.log('  ' + '─'.repeat(60))\n    for (const action of actions) {\n      const rel = relative(cwd, action.filePath)\n      console.log(`  POST      /api/__actions/${action.actionPath.padEnd(18)} ${rel}`)\n    }\n  }\n\n  // WebSocket\n  if (wsRoutes.length > 0) {\n    console.log('\\n  WebSocket')\n    console.log('  ' + '─'.repeat(60))\n    for (const route of wsRoutes) {\n      const rel = relative(cwd, route.filePath)\n      console.log(`  WS        ${route.wsPath.padEnd(30)} ${rel}`)\n    }\n  }\n\n  console.log(`\\n  Total: ${totalCount} endpoints\\n`)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS,gBAAgB;AAQlC,eAAsB,gBAA+B;AACnD,QAAM,MAAM,QAAQ,IAAI;AACxB,QAAM,SAAS,MAAM,WAAW,GAAG;AAEnC,2BAAyB,KAAK,OAAO,MAAM;AAE3C,QAAM,YAAY,QAAQ,KAAK,OAAO,SAAS;AAE/C,QAAM,YAAY,iBAAiB,SAAS;AAC5C,QAAM,UAAU,kBAAkB,SAAS;AAC3C,QAAM,WAAW,oBAAoB,SAAS;AAE9C,QAAM,aAAa,UAAU,SAAS,QAAQ,SAAS,SAAS;AAEhE,MAAI,eAAe,GAAG;AACpB,YAAQ,IAAI,wBAAwB;AACpC;AAAA,EACF;AAGA,MAAI,UAAU,SAAS,GAAG;AACxB,YAAQ,IAAI,gBAAgB;AAC5B,YAAQ,IAAI,OAAO,SAAI,OAAO,EAAE,CAAC;AACjC,eAAW,SAAS,WAAW;AAC7B,YAAM,MAAM,SAAS,KAAK,MAAM,QAAQ;AACxC,cAAQ,IAAI,eAAe,MAAM,UAAU,OAAO,EAAE,CAAC,IAAI,GAAG,EAAE;AAAA,IAChE;AAAA,EACF;AAGA,MAAI,QAAQ,SAAS,GAAG;AACtB,YAAQ,IAAI,aAAa;AACzB,YAAQ,IAAI,OAAO,SAAI,OAAO,EAAE,CAAC;AACjC,eAAW,UAAU,SAAS;AAC5B,YAAM,MAAM,SAAS,KAAK,OAAO,QAAQ;AACzC,cAAQ,IAAI,8BAA8B,OAAO,WAAW,OAAO,EAAE,CAAC,IAAI,GAAG,EAAE;AAAA,IACjF;AAAA,EACF;AAGA,MAAI,SAAS,SAAS,GAAG;AACvB,YAAQ,IAAI,eAAe;AAC3B,YAAQ,IAAI,OAAO,SAAI,OAAO,EAAE,CAAC;AACjC,eAAW,SAAS,UAAU;AAC5B,YAAM,MAAM,SAAS,KAAK,MAAM,QAAQ;AACxC,cAAQ,IAAI,eAAe,MAAM,OAAO,OAAO,EAAE,CAAC,IAAI,GAAG,EAAE;AAAA,IAC7D;AAAA,EACF;AAEA,UAAQ,IAAI;AAAA,WAAc,UAAU;AAAA,CAAc;AACpD;","names":[]}
+{"version":3,"sources":["../src/cli/commands/routes.ts"],"sourcesContent":["import { resolve, relative } from 'node:path'\n\nimport { loadConfig } from '../../config/load-config.js'\nimport { validateProjectStructure } from '../../config/validate-structure.js'\nimport { scanServerActions } from '../../server/scan/action-scan.js'\nimport { scanServerRoutes } from '../../server/scan/scan.js'\nimport { scanWebSocketRoutes } from '../../server/scan/ws-scan.js'\n\nexport async function routesCommand(): Promise<void> {\n  const cwd = process.cwd()\n  const config = await loadConfig(cwd)\n  // #95 — honor config.appDir so a custom frontend dir (e.g. apps/web) passes the structure gate.\n  validateProjectStructure(cwd, config.appDir)\n\n  const serverDir = resolve(cwd, config.serverDir)\n\n  const apiRoutes = scanServerRoutes(serverDir)\n  const actions = scanServerActions(serverDir)\n  const wsRoutes = scanWebSocketRoutes(serverDir)\n\n  const totalCount = apiRoutes.length + actions.length + wsRoutes.length\n\n  if (totalCount === 0) {\n    console.log('\\n  No routes found.\\n')\n    return\n  }\n\n  // API Routes\n  if (apiRoutes.length > 0) {\n    console.log('\\n  API Routes')\n    console.log('  ' + '─'.repeat(60))\n    for (const route of apiRoutes) {\n      const rel = relative(cwd, route.filePath)\n      console.log(`  GET/POST  ${route.routePath.padEnd(30)} ${rel}`)\n    }\n  }\n\n  // Actions\n  if (actions.length > 0) {\n    console.log('\\n  Actions')\n    console.log('  ' + '─'.repeat(60))\n    for (const action of actions) {\n      const rel = relative(cwd, action.filePath)\n      console.log(`  POST      /api/__actions/${action.actionPath.padEnd(18)} ${rel}`)\n    }\n  }\n\n  // WebSocket\n  if (wsRoutes.length > 0) {\n    console.log('\\n  WebSocket')\n    console.log('  ' + '─'.repeat(60))\n    for (const route of wsRoutes) {\n      const rel = relative(cwd, route.filePath)\n      console.log(`  WS        ${route.wsPath.padEnd(30)} ${rel}`)\n    }\n  }\n\n  console.log(`\\n  Total: ${totalCount} endpoints\\n`)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS,gBAAgB;AAQlC,eAAsB,gBAA+B;AACnD,QAAM,MAAM,QAAQ,IAAI;AACxB,QAAM,SAAS,MAAM,WAAW,GAAG;AAEnC,2BAAyB,KAAK,OAAO,MAAM;AAE3C,QAAM,YAAY,QAAQ,KAAK,OAAO,SAAS;AAE/C,QAAM,YAAY,iBAAiB,SAAS;AAC5C,QAAM,UAAU,kBAAkB,SAAS;AAC3C,QAAM,WAAW,oBAAoB,SAAS;AAE9C,QAAM,aAAa,UAAU,SAAS,QAAQ,SAAS,SAAS;AAEhE,MAAI,eAAe,GAAG;AACpB,YAAQ,IAAI,wBAAwB;AACpC;AAAA,EACF;AAGA,MAAI,UAAU,SAAS,GAAG;AACxB,YAAQ,IAAI,gBAAgB;AAC5B,YAAQ,IAAI,OAAO,SAAI,OAAO,EAAE,CAAC;AACjC,eAAW,SAAS,WAAW;AAC7B,YAAM,MAAM,SAAS,KAAK,MAAM,QAAQ;AACxC,cAAQ,IAAI,eAAe,MAAM,UAAU,OAAO,EAAE,CAAC,IAAI,GAAG,EAAE;AAAA,IAChE;AAAA,EACF;AAGA,MAAI,QAAQ,SAAS,GAAG;AACtB,YAAQ,IAAI,aAAa;AACzB,YAAQ,IAAI,OAAO,SAAI,OAAO,EAAE,CAAC;AACjC,eAAW,UAAU,SAAS;AAC5B,YAAM,MAAM,SAAS,KAAK,OAAO,QAAQ;AACzC,cAAQ,IAAI,8BAA8B,OAAO,WAAW,OAAO,EAAE,CAAC,IAAI,GAAG,EAAE;AAAA,IACjF;AAAA,EACF;AAGA,MAAI,SAAS,SAAS,GAAG;AACvB,YAAQ,IAAI,eAAe;AAC3B,YAAQ,IAAI,OAAO,SAAI,OAAO,EAAE,CAAC;AACjC,eAAW,SAAS,UAAU;AAC5B,YAAM,MAAM,SAAS,KAAK,MAAM,QAAQ;AACxC,cAAQ,IAAI,eAAe,MAAM,OAAO,OAAO,EAAE,CAAC,IAAI,GAAG,EAAE;AAAA,IAC7D;AAAA,EACF;AAEA,UAAQ,IAAI;AAAA,WAAc,UAAU;AAAA,CAAc;AACpD;","names":[]}

package/dist/{scan-7MJC6PYU.js → scan-YJEE4KQK.js}

@@ -2,8 +2,8 @@
 import "tsx/esm";
 import {
   scanRoutes
-} from "./chunk-IEES3CHD.js";
+} from "./chunk-47MM2JUK.js";
 export {
   scanRoutes
 };
-//# sourceMappingURL=scan-7MJC6PYU.js.map
+//# sourceMappingURL=scan-YJEE4KQK.js.map

package/dist/{schema-DNIT7JQX.js → schema-SOAD43RQ.js}

@@ -1,13 +1,15 @@
 #!/usr/bin/env node
 import "tsx/esm";
+import {
+  theoConfigSchema
+} from "./chunk-FH3SQR6P.js";
+import "./chunk-ZNZISJDZ.js";
 import {
   cacheSchema,
   corsSchema,
   securityHeadersSchema,
-  storageSchema,
-  theoConfigSchema
-} from "./chunk-CMYSHZFT.js";
-import "./chunk-WSXNGF7X.js";
+  storageSchema
+} from "./chunk-VI7ZANB3.js";
 export {
   cacheSchema,
   corsSchema,
@@ -15,4 +17,4 @@ export {
   storageSchema,
   theoConfigSchema
 };
-//# sourceMappingURL=schema-DNIT7JQX.js.map
+//# sourceMappingURL=schema-SOAD43RQ.js.map

package/dist/schemas-4AXHQMV3.js

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+import "tsx/esm";
+import {
+  cacheSchema,
+  corsSchema,
+  loggingSchema,
+  observabilitySchema,
+  rateLimitSchema,
+  securityHeadersSchema,
+  securitySchema,
+  storageSchema,
+  uploadSchema
+} from "./chunk-VI7ZANB3.js";
+export {
+  cacheSchema,
+  corsSchema,
+  loggingSchema,
+  observabilitySchema,
+  rateLimitSchema,
+  securityHeadersSchema,
+  securitySchema,
+  storageSchema,
+  uploadSchema
+};
+//# sourceMappingURL=schemas-4AXHQMV3.js.map

package/dist/schemas-4AXHQMV3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/security-headers-Ccj7ncNx.d.ts

@@ -0,0 +1,129 @@
+/**
+ * The security-header baseline, as a pure function of configuration.
+ *
+ * It lives in `core/contracts/` because **every** target needs it and none of it
+ * is transport-specific: `buildSecurityHeaders` takes a config object and
+ * returns `Record<string, string>`. `theokit start` writes that map onto a Node
+ * `ServerResponse` (`server/security/security-headers.ts`); the six Web deploy
+ * adapters write it onto a `Response` (`adapters/security-headers.ts`). Putting
+ * it under `server/` made the second group import across a boundary the
+ * dependency graph forbids — `adapters → server` is not a declared edge in
+ * ADR-0001 v3 — and the fix is not to widen the rule but to notice that this
+ * code was never server code.
+ *
+ * `core/contracts/<file>.ts` is the declared exception to the deep-import rule,
+ * so both callers reach it directly and there is still exactly ONE definition of
+ * what a configured header set means.
+ *
+ * Phase 6 — Default Security Headers (D4 / EC-2).
+ *
+ * Per-response security baseline. The framework applies these BEFORE the
+ * route handler runs so a handler can still override via `res.setHeader`.
+ *
+ * EC-2 backward-compatibility: CSP ships in `report-only` mode by default
+ * for 0.2.0. Existing apps with inline scripts or third-party CDN scripts
+ * keep working but consumers see violation reports via their CSP report
+ * collector (or browser DevTools). 0.3.0 will flip the default to
+ * `enforce` after a release of visibility.
+ */
+/**
+ * Default Content-Security-Policy. Conservative-but-not-paralyzing:
+ *
+ *   - default-src 'self'              — every fetch falls back to same-origin
+ *   - script-src 'self'               — T6.1 (0.3.0): `'unsafe-inline'`
+ *                                         dropped. The SSR pipeline issues a
+ *                                         per-request nonce that REPLACES
+ *                                         this directive at runtime
+ *                                         (`'nonce-<token>'`). For static /
+ *                                         non-SSR contexts where no nonce is
+ *                                         available, the policy is strict-
+ *                                         no-inline — user inline scripts
+ *                                         must be migrated to external
+ *                                         `<script src="...">` or threaded
+ *                                         through `ctx.nonce`.
+ *   - style-src 'self' 'unsafe-inline' — Tailwind + TheoUI use style attrs
+ *                                         in animation directives
+ *   - img-src 'self' data: blob:      — supports inline data URIs, blobs
+ *                                         from canvas exports
+ *   - font-src 'self' data:           — Geist fonts inline-base64
+ *   - connect-src 'self' ws: wss:     — WebSocket dev HMR + agent streams
+ *   - frame-ancestors 'none'          — clickjacking defense
+ */
+/**
+ * T5.1 — default CSP includes the built-in report endpoint so violations
+ * are visible without extra config. Apps that ship a custom `csp` string
+ * override the report-uri.
+ */
+declare const DEFAULT_CSP: string;
+/**
+ * T1.1 — Default Permissions-Policy header (default-deny stance).
+ *
+ * Disables sensitive Web APIs that the vast majority of apps don't use.
+ * Apps that DO need any of these opt in by overriding `permissionsPolicy`
+ * in `config.security.headers`.
+ *
+ * The seven features listed are the most-abused for: tracking
+ * (geolocation, accelerometer, gyroscope), spyware (camera, microphone),
+ * fraud (payment), and hardware exfiltration (usb).
+ *
+ * Aligns with Mozilla baseline + OWASP Secure Headers + Lighthouse PWA.
+ */
+declare const DEFAULT_PERMISSIONS_POLICY = "geolocation=(), camera=(), microphone=(), payment=(), usb=(), accelerometer=(), gyroscope=()";
+type CspMode = 'enforce' | 'report-only' | 'off';
+interface SecurityHeadersConfig {
+    /**
+     * Custom CSP policy string. When set, replaces the default verbatim.
+     * Pass `false` to disable CSP entirely (alias for `cspMode: 'off'`).
+     */
+    csp?: string | false;
+    /**
+     * Enforcement mode for CSP. Default `report-only` for 0.2.0 (EC-2).
+     * 0.3.0 will default to `enforce`.
+     */
+    cspMode?: CspMode;
+    /**
+     * Strict-Transport-Security value. Defaults to
+     * `max-age=31536000; includeSubDomains` in production. Pass `false` to
+     * suppress (e.g. internal LANs without TLS).
+     */
+    hsts?: string | false;
+    /** X-Frame-Options. Default DENY. */
+    frameOptions?: 'DENY' | 'SAMEORIGIN';
+    /** X-Content-Type-Options. Default `nosniff`. */
+    contentTypeOptions?: 'nosniff';
+    /** Referrer-Policy. Default `strict-origin-when-cross-origin`. */
+    referrerPolicy?: string;
+    /**
+     * T1.1 — Permissions-Policy directive string. When set, replaces the
+     * default verbatim (no merge — see ADR-EC-12). Pass `false` to disable
+     * the header entirely. Schema-level refinement rejects any string
+     * containing CR/LF (EC-3 — CWE-113 HTTP Response Splitting mitigation).
+     */
+    permissionsPolicy?: string | false;
+}
+interface SecurityEnv {
+    production: boolean;
+}
+/**
+ * T4.1 — Per-request options passed by the SSR pipeline.
+ *
+ * - `nonce`: when set, the framework substitutes the `'unsafe-inline'`
+ *   token in `script-src` with `'nonce-<nonce>'`. EC-3 forces
+ *   `Cache-Control: private, no-store` so a CDN cannot cache the HTML
+ *   (carrying one nonce) and re-serve it with a freshly-generated CSP
+ *   header (carrying a different nonce).
+ * - `prerender`: when true, the nonce is IGNORED. Prerendered HTML is
+ *   generated at build time with no nonce in the script tags; mixing a
+ *   runtime nonce in the header would block every script. EC-4.
+ */
+interface SecurityHeadersOptions {
+    nonce?: string;
+    prerender?: boolean;
+}
+/**
+ * Build the security headers map for a given config + env. Pure function —
+ * returned object can be inspected, logged, or applied to a response.
+ */
+declare function buildSecurityHeaders(config: SecurityHeadersConfig, env: SecurityEnv, options?: SecurityHeadersOptions): Record<string, string>;
+
+export { type CspMode as C, DEFAULT_CSP as D, type SecurityHeadersConfig as S, DEFAULT_PERMISSIONS_POLICY as a, buildSecurityHeaders as b, type SecurityEnv as c, type SecurityHeadersOptions as d };

package/dist/server/agent/index.d.ts

@@ -4,110 +4,7 @@ import { AcpTransport } from '@theokit/agents';
 export { InProcessApprovalRequest, InProcessApprovalRequiredError, InProcessAwaitApproval, StreamAgentTurnDeps, StreamAgentTurnInProcessInput, streamAgentTurnInProcess } from '@theokit/agents';
 import { CustomTool as CustomTool$1 } from '@theokit/sdk';
 import { V as VerifyFn } from '../../webhook-types-DGIjjcaI.js';
-
-/**
- * Provider Resolver — Strategy + Registry pattern (FAANG-grade).
- *
- * Inspiration: Dapr Conversation Registry (`dapr/pkg/components/conversation/registry.go`)
- * + Encore Manager provider array (`encore/runtimes/go/pubsub/manager_internal.go`).
- *
- * Principle: provider routing is the FRAMEWORK's responsibility, not the consumer's — but the
- * consumer still gets to SAY which provider it wants, and it says so in the model id.
- *
- * `provider/model` is the convention every agent in this ecosystem already writes
- * (`anthropic/claude-sonnet-4-6`, `openrouter/anthropic/claude-haiku-4.5`), and it is the one the
- * SDK routes on. Until theokit#326 this resolver ignored it entirely and picked by env-var
- * priority, so an agent that declared `anthropic/...` was handed an OpenRouter key whenever one
- * happened to be present — and every turn failed with `auth_failed (HTTP 401)` against a provider
- * nobody asked for. The declared provider now wins; priority is the fallback for a bare model id.
- *
- * Wire protocol: OpenAI Chat Completions (universal — implemented by every
- * os providers: OpenRouter, Groq, Mistral, Together, Anthropic via proxy, etc).
- *
- * Resolution by priority (FIRST match wins):
- *   1. OPENROUTER_API_KEY → baseUrl=openrouter.ai (multi-model gateway)
- *   2. OPENAI_API_KEY     → baseUrl=api.openai.com
- *   3. ANTHROPIC_API_KEY  → direct Anthropic (Messages API, not OpenAI-compat)
- *
- * Escape hatch: an explicit `options.apiKey` OVERRIDES auto-resolution
- * (the consumer can force a specific provider if it wants to).
- */
-/**
- * Provider configuration descriptor — Registry entry shape.
- *
- * @public
- */
-interface ProviderDescriptor {
-    /** Stable name used internally — not exposed on the wire. */
-    name: string;
-    /** Environment variable that holds the API key for this provider. */
-    envKey: string;
-    /** Base URL for the provider's OpenAI-compatible (or native) API. */
-    baseUrl: string;
-    /** Resolution priority (lower = higher priority). FIRST match wins. */
-    priority: number;
-}
-/**
- * Resolved provider configuration — output of `resolveProvider()`.
- *
- * @public
- */
-interface ResolvedProvider {
-    name: string;
-    apiKey: string;
-    baseUrl: string;
-}
-/** Where the announcement goes, and what it may contain. @public */
-interface ResolveOptions {
-    /** Receives one line per provider, at most once. NEVER receives the key. */
-    announce?: (line: string) => void;
-}
-/**
- * Register a new provider (Registry pattern — runtime extension point).
- * Useful for self-hosted endpoints or custom providers without touching theokit src.
- *
- * @example
- * registerProvider({
- *   name: 'self-hosted',
- *   envKey: 'SELF_HOSTED_API_KEY',
- *   baseUrl: 'https://llm.internal.acme.com/v1',
- *   priority: 0, // highest priority
- * })
- *
- * @public
- */
-declare function registerProvider(descriptor: ProviderDescriptor): void;
-/**
- * Reset registry to DEFAULT_REGISTRY (test-only / dev escape hatch).
- *
- * @public
- */
-declare function resetProviderRegistry(): void;
-/**
- * Get current registry snapshot (read-only — inspection).
- *
- * @public
- */
-declare function listProviders(): readonly ProviderDescriptor[];
-/**
- * Resolve the provider for a model.
- *
- * When `modelId` declares a registered provider (`anthropic/…`), THAT provider's key is
- * required — no substitution. Otherwise the registry is walked by priority, first match wins.
- *
- * @returns ResolvedProvider with apiKey + baseUrl + name
- * @throws Error if NO provider env var is set (actionable message)
- *
- * @public
- */
-declare function resolveProvider(modelId?: string, options?: ResolveOptions): ResolvedProvider;
-/**
- * Try to resolve — does NOT throw. Returns null if no provider available.
- * Useful for graceful degradation (e.g., mock mode).
- *
- * @public
- */
-declare function tryResolveProvider(modelId?: string): ResolvedProvider | null;
+export { P as ProviderDescriptor, R as ResolvedProvider, l as listProviders, a as registerProvider, b as resetProviderRegistry, r as resolveProvider, t as tryResolveProvider } from '../../provider-resolver-Dx6QuWrw.js';
 
 /**
  * M26 (ADR-0041) — `createWorkflowTool`: wrap an SDK `Workflow` as a `CustomTool`.
@@ -424,4 +321,4 @@ interface StdioStreams {
  */
 declare function serveMcpStdio(mod: unknown, name: string, appResources: readonly AppResource[], streams: StdioStreams): Promise<void>;
 
-export { type AcpToolConfig, type AppResource, type AppResourceInput, type ChannelMessage, type ChannelWebhookConfig, type CodeModeApi, type CodeModeConfig, type CodeModePermission, CodeModePermissionDeniedError, type McpResourceContents, type McpResourceDescriptor, NodeAcpTransport, type ProviderDescriptor, type ResolvedProvider, type Sandbox, type StdioStreams, type VendorAgentClient, type VendorAgentToolConfig, type WorkflowLike, type WorkflowToolConfig, buildResourceDescriptors, createACPTool, createCodeMode, createVendorAgentTool, createWorkflowTool, defineAppResource, extractAppResources, handleChannelWebhook, handleMcpStdioLine, isChannelPath, listProviders, parseChannelPath, readAppResource, registerProvider, resetProviderRegistry, resolveProvider, serveMcpStdio, tryResolveProvider };
+export { type AcpToolConfig, type AppResource, type AppResourceInput, type ChannelMessage, type ChannelWebhookConfig, type CodeModeApi, type CodeModeConfig, type CodeModePermission, CodeModePermissionDeniedError, type McpResourceContents, type McpResourceDescriptor, NodeAcpTransport, type Sandbox, type StdioStreams, type VendorAgentClient, type VendorAgentToolConfig, type WorkflowLike, type WorkflowToolConfig, buildResourceDescriptors, createACPTool, createCodeMode, createVendorAgentTool, createWorkflowTool, defineAppResource, extractAppResources, handleChannelWebhook, handleMcpStdioLine, isChannelPath, parseChannelPath, readAppResource, serveMcpStdio };

package/dist/server/agent/index.js

@@ -25,7 +25,7 @@ import {
   resetProviderRegistry,
   resolveProvider,
   tryResolveProvider
-} from "../../chunk-AXKUA57G.js";
+} from "../../chunk-3PBAN2YE.js";
 import "../../chunk-SAFGDIPQ.js";
 import "../../chunk-XTHN6JBX.js";
 export {