theokit 0.52.1 → 0.54.0

package/dist/{dev-emit-G2E2U3NP.js → dev-emit-W27J3DLU.js}

@@ -1,6 +1,6 @@
 import {
   generateManifest
-} from "./chunk-VHB2FSPM.js";
+} from "./chunk-I2UN46ZX.js";
 import "./chunk-DV34VG3N.js";
 import "./chunk-IRASEXOG.js";
 import "./chunk-5K4TDLRG.js";
@@ -339,4 +339,4 @@ export {
   _resetInFlightForTests,
   reEmitOpenApi
 };
-//# sourceMappingURL=dev-emit-G2E2U3NP.js.map
+//# sourceMappingURL=dev-emit-W27J3DLU.js.map

package/dist/{index-C8YN9dpF.d.ts → index-ADEV6pen.d.ts}

@@ -3,7 +3,7 @@ import { IncomingMessage, ServerResponse } from 'node:http';
 import { P as PluginContext, W as WebOnRequestHook, g as WebPreHandlerHook, h as WebOnResponseHook, i as WebOnErrorHook } from './plugin-types-BUVfUQ0V.js';
 import { P as PluginRunner } from './plugin-runner-BVMOSxvb.js';
 import { J as JobBackend } from './job-backend-CgC8Xf33.js';
-import { L as LoadModule, S as ServerRouteNode } from './match-DmGgxjIU.js';
+import { L as LoadModule, S as ServerRouteNode } from './match-Dw4CNXJH.js';
 import { C as CsrfMode, D as DisallowedConfig } from './csrf-Dgot9qSM.js';
 import { z } from 'zod';
 import { R as RouteConfig } from './route-config-Cm_ZMA1C.js';

package/dist/index.d.ts

@@ -46,7 +46,7 @@ declare const theoConfigSchema: z.ZodObject<{
         }, z.core.$strip>>;
     }, z.core.$strip>>;
     port: z.ZodDefault<z.ZodNumber>;
-    host: z.ZodDefault<z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>;
+    host: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>;
     open: z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>>;
     strictPort: z.ZodDefault<z.ZodBoolean>;
     forwardConsole: z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
@@ -144,6 +144,7 @@ declare const theoConfigSchema: z.ZodObject<{
             credentials: z.ZodDefault<z.ZodBoolean>;
             maxAge: z.ZodDefault<z.ZodNumber>;
         }, z.core.$strip>>;
+        allowUnauthenticatedWrites: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
     serialization: z.ZodDefault<z.ZodEnum<{
         json: "json";

package/dist/index.js

@@ -8,15 +8,15 @@ import {
   scanRoutes,
   theoConfigSchema,
   theoPlugin
-} from "./chunk-I4ELCXNV.js";
+} from "./chunk-S6RWUH3J.js";
 import "./chunk-VQPHPQ5L.js";
 import "./chunk-SSYDEKWF.js";
-import "./chunk-VGE6AKEJ.js";
+import "./chunk-DAE7BJ7H.js";
 import "./chunk-OIGJOYX6.js";
-import "./chunk-JUDNKBDQ.js";
+import "./chunk-WX6NHGKS.js";
 import "./chunk-4X6H2BXP.js";
 import "./chunk-OGLS76RN.js";
-import "./chunk-5BOKW3GX.js";
+import "./chunk-FVFYACYK.js";
 import "./chunk-ZDUO4IYN.js";
 import "./chunk-47FFT43U.js";
 import "./chunk-NTDN54XO.js";
@@ -26,7 +26,7 @@ import "./chunk-CHTAWXC2.js";
 import "./chunk-VSLTKX5L.js";
 import "./chunk-TNI4MARH.js";
 import "./chunk-OQCRCXCP.js";
-import "./chunk-VHB2FSPM.js";
+import "./chunk-I2UN46ZX.js";
 import "./chunk-DV34VG3N.js";
 import "./chunk-IRASEXOG.js";
 import "./chunk-BX6EUYHU.js";

package/dist/{info-Y55RWS42.js → info-6WJ3JRNE.js}

@@ -5,12 +5,12 @@ import {
 } from "./chunk-47MM2JUK.js";
 import {
   loadConfig
-} from "./chunk-QTHVHNJJ.js";
+} from "./chunk-HA35FS7U.js";
 import "./chunk-3QPVEJ7D.js";
 import "./chunk-U5PWXS3J.js";
-import "./chunk-FH3SQR6P.js";
+import "./chunk-4OTIXAUY.js";
 import "./chunk-ZNZISJDZ.js";
-import "./chunk-VI7ZANB3.js";
+import "./chunk-OSBGZYXZ.js";
 
 // src/cli/commands/info.ts
 import { existsSync, readFileSync } from "fs";
@@ -103,4 +103,4 @@ export {
   buildInfo,
   infoCommand
 };
-//# sourceMappingURL=info-Y55RWS42.js.map
+//# sourceMappingURL=info-6WJ3JRNE.js.map

package/dist/{internal-api-EL25ADPR.js → internal-api-TA37BXH7.js}

@@ -16,7 +16,7 @@ import {
   handleCspReport,
   handleCsrfReadiness,
   mountAgent
-} from "./chunk-E53UIFH6.js";
+} from "./chunk-IHAQUUT2.js";
 import {
   resolveProvider
 } from "./chunk-5YPXXSYY.js";
@@ -31,17 +31,17 @@ import {
 import {
   TRACE_HEADER,
   extractTraceId
-} from "./chunk-GSIOWE5B.js";
+} from "./chunk-5VLP3GQ2.js";
 import {
   logRequest
 } from "./chunk-C27VRUVN.js";
 import "./chunk-7UZZHCRN.js";
 import {
   generateManifest
-} from "./chunk-XLLW46MB.js";
+} from "./chunk-2HWWJTOH.js";
 import {
   scanAgents
-} from "./chunk-6AM7HIRM.js";
+} from "./chunk-5NNFO7R7.js";
 import {
   ACTION_SCHEMAS_DIR,
   matchRoute,
@@ -49,10 +49,10 @@ import {
   scanServerActionsEnriched,
   scanServerRoutes,
   scanWebSocketRoutes
-} from "./chunk-YYOBMOO4.js";
+} from "./chunk-NO6HA4FG.js";
 import "./chunk-Z7CJHDLS.js";
 import "./chunk-U5PWXS3J.js";
-import "./chunk-VI7ZANB3.js";
+import "./chunk-OSBGZYXZ.js";
 import "./chunk-VQIUTCK2.js";
 export {
   ACTION_SCHEMAS_DIR,
@@ -87,4 +87,4 @@ export {
   scanWebSocketRoutes,
   sendError
 };
-//# sourceMappingURL=internal-api-EL25ADPR.js.map
+//# sourceMappingURL=internal-api-TA37BXH7.js.map

package/dist/{internal-api-S6BGJCZP.js → internal-api-VUDJUWYE.js}

@@ -1,9 +1,9 @@
 import {
   dispatchControllerRequest
-} from "./chunk-VGE6AKEJ.js";
+} from "./chunk-DAE7BJ7H.js";
 import {
   mountAgent
-} from "./chunk-JUDNKBDQ.js";
+} from "./chunk-WX6NHGKS.js";
 import {
   BATCH_PATH,
   createCorsHandler,
@@ -12,7 +12,7 @@ import {
   handleBatchRequest,
   incomingMessageToHandlerRequest,
   sendError
-} from "./chunk-5BOKW3GX.js";
+} from "./chunk-FVFYACYK.js";
 import "./chunk-ZDUO4IYN.js";
 import "./chunk-47FFT43U.js";
 import {
@@ -42,7 +42,7 @@ import {
   scanServerActionsEnriched,
   scanServerRoutes,
   scanWebSocketRoutes
-} from "./chunk-VHB2FSPM.js";
+} from "./chunk-I2UN46ZX.js";
 import "./chunk-DV34VG3N.js";
 import {
   scanAgents
@@ -107,4 +107,4 @@ export {
   scanWebSocketRoutes,
   sendError
 };
-//# sourceMappingURL=internal-api-S6BGJCZP.js.map
+//# sourceMappingURL=internal-api-VUDJUWYE.js.map

package/dist/{load-config-4ATXQUN3.js → load-config-BKUAMGO5.js}

@@ -3,14 +3,14 @@ import "tsx/esm";
 import {
   deepMerge,
   loadConfig
-} from "./chunk-QTHVHNJJ.js";
+} from "./chunk-HA35FS7U.js";
 import "./chunk-3QPVEJ7D.js";
 import "./chunk-U5PWXS3J.js";
-import "./chunk-FH3SQR6P.js";
+import "./chunk-4OTIXAUY.js";
 import "./chunk-ZNZISJDZ.js";
-import "./chunk-VI7ZANB3.js";
+import "./chunk-OSBGZYXZ.js";
 export {
   deepMerge,
   loadConfig
 };
-//# sourceMappingURL=load-config-4ATXQUN3.js.map
+//# sourceMappingURL=load-config-BKUAMGO5.js.map

package/dist/{match-DmGgxjIU.d.ts → match-Dw4CNXJH.d.ts}

@@ -31,6 +31,14 @@ interface ServerRouteNode {
      * compatibility with manifests generated before G1. Empty array means the
      * file has no HTTP exports (util-only); undefined means "not detected". */
     methods?: string[];
+    /**
+     * The subset of `methods` whose policy is the literal `'public'` (ADR 0001).
+     *
+     * `undefined` means "not detected" — a manifest built before the field existed — and is NOT the
+     * same as `[]`, which means "detected, and nothing is public". `public-exposure-gate.ts` depends
+     * on that distinction: reading absence as safety is the failure it exists to prevent.
+     */
+    publicMethods?: string[];
 }
 declare function compilePattern(routePath: string): {
     pattern: RegExp;

package/dist/{mcp-7BXBN7PD.js → mcp-2RQCKWQR.js}

@@ -2,7 +2,7 @@
 import "tsx/esm";
 import {
   createAgentSsrLoader
-} from "./chunk-PFAVZL4F.js";
+} from "./chunk-SIGUGCBS.js";
 import {
   extractAppResources,
   handleMcpJsonRpc
@@ -10,7 +10,7 @@ import {
 import "./chunk-5YPXXSYY.js";
 import {
   scanAgents
-} from "./chunk-6AM7HIRM.js";
+} from "./chunk-5NNFO7R7.js";
 import "./chunk-Z7CJHDLS.js";
 import "./chunk-3QPVEJ7D.js";
 
@@ -46,7 +46,7 @@ async function serveMcpStdio(mod, name, appResources, streams) {
 // src/cli/commands/mcp.ts
 async function mcpCommand(name, deps = {}) {
   const projectRoot = deps.projectRoot ?? process.cwd();
-  const agentsDir = deps.agentsDir ?? (await (await import("./load-config-4ATXQUN3.js")).loadConfig(projectRoot)).agentsDir;
+  const agentsDir = deps.agentsDir ?? (await (await import("./load-config-BKUAMGO5.js")).loadConfig(projectRoot)).agentsDir;
   const agent = scanAgents(projectRoot, agentsDir).find((a) => a.name === name);
   if (!agent) {
     const names = scanAgents(projectRoot, agentsDir).map((a) => a.name).join(", ");
@@ -75,4 +75,4 @@ async function mcpCommand(name, deps = {}) {
 export {
   mcpCommand
 };
-//# sourceMappingURL=mcp-7BXBN7PD.js.map
+//# sourceMappingURL=mcp-2RQCKWQR.js.map

package/dist/{observability-bootstrap-M2WSDIDV.js → observability-bootstrap-H4NSILXD.js}

@@ -4,13 +4,13 @@ import {
   _resetObservabilityAdapter,
   createObservabilityPluginFromConfig,
   getObservabilityAdapter
-} from "./chunk-GSIOWE5B.js";
+} from "./chunk-5VLP3GQ2.js";
 import "./chunk-C27VRUVN.js";
 import "./chunk-7UZZHCRN.js";
-import "./chunk-VI7ZANB3.js";
+import "./chunk-OSBGZYXZ.js";
 export {
   _resetObservabilityAdapter,
   createObservabilityPluginFromConfig,
   getObservabilityAdapter
 };
-//# sourceMappingURL=observability-bootstrap-M2WSDIDV.js.map
+//# sourceMappingURL=observability-bootstrap-H4NSILXD.js.map

package/dist/{openapi-2IBBOS3Q.js → openapi-PKDDJ7M2.js}

@@ -6,18 +6,18 @@ import {
 } from "./chunk-47VNWTL4.js";
 import {
   generateManifest
-} from "./chunk-XLLW46MB.js";
-import "./chunk-6AM7HIRM.js";
-import "./chunk-YYOBMOO4.js";
+} from "./chunk-2HWWJTOH.js";
+import "./chunk-5NNFO7R7.js";
+import "./chunk-NO6HA4FG.js";
 import "./chunk-Z7CJHDLS.js";
 import {
   loadConfig
-} from "./chunk-QTHVHNJJ.js";
+} from "./chunk-HA35FS7U.js";
 import "./chunk-3QPVEJ7D.js";
 import "./chunk-U5PWXS3J.js";
-import "./chunk-FH3SQR6P.js";
+import "./chunk-4OTIXAUY.js";
 import "./chunk-ZNZISJDZ.js";
-import "./chunk-VI7ZANB3.js";
+import "./chunk-OSBGZYXZ.js";
 
 // src/cli/commands/openapi.ts
 import { mkdtempSync, rmSync } from "fs";
@@ -84,4 +84,4 @@ function emitOpenApiInMemory(manifest, config) {
 export {
   openapiCommand
 };
-//# sourceMappingURL=openapi-2IBBOS3Q.js.map
+//# sourceMappingURL=openapi-PKDDJ7M2.js.map

package/dist/{preview-4ZTFJG2D.js → preview-J57QZNTO.js}

@@ -4,8 +4,8 @@ import "tsx/esm";
 // src/cli/commands/preview.ts
 async function defaultSteps() {
   const [{ buildCommand }, { startCommand }] = await Promise.all([
-    import("./build-3AYYQZGQ.js"),
-    import("./start-WILEDDW2.js")
+    import("./build-JH53TZJI.js"),
+    import("./start-3F4LVHWS.js")
   ]);
   return {
     build: (opts) => buildCommand(opts),
@@ -20,4 +20,4 @@ async function previewCommand(options = {}, steps) {
 export {
   previewCommand
 };
-//# sourceMappingURL=preview-4ZTFJG2D.js.map
+//# sourceMappingURL=preview-J57QZNTO.js.map

package/dist/{routes-PP5PHHLR.js → routes-A2YLFEYC.js}

@@ -7,16 +7,16 @@ import {
   scanServerActions,
   scanServerRoutes,
   scanWebSocketRoutes
-} from "./chunk-YYOBMOO4.js";
+} from "./chunk-NO6HA4FG.js";
 import "./chunk-Z7CJHDLS.js";
 import {
   loadConfig
-} from "./chunk-QTHVHNJJ.js";
+} from "./chunk-HA35FS7U.js";
 import "./chunk-3QPVEJ7D.js";
 import "./chunk-U5PWXS3J.js";
-import "./chunk-FH3SQR6P.js";
+import "./chunk-4OTIXAUY.js";
 import "./chunk-ZNZISJDZ.js";
-import "./chunk-VI7ZANB3.js";
+import "./chunk-OSBGZYXZ.js";
 
 // src/cli/commands/routes.ts
 import { resolve, relative } from "path";
@@ -64,4 +64,4 @@ async function routesCommand() {
 export {
   routesCommand
 };
-//# sourceMappingURL=routes-PP5PHHLR.js.map
+//# sourceMappingURL=routes-A2YLFEYC.js.map

package/dist/{schema-SOAD43RQ.js → schema-WKTNTGX6.js}

@@ -2,14 +2,14 @@
 import "tsx/esm";
 import {
   theoConfigSchema
-} from "./chunk-FH3SQR6P.js";
+} from "./chunk-4OTIXAUY.js";
 import "./chunk-ZNZISJDZ.js";
 import {
   cacheSchema,
   corsSchema,
   securityHeadersSchema,
   storageSchema
-} from "./chunk-VI7ZANB3.js";
+} from "./chunk-OSBGZYXZ.js";
 export {
   cacheSchema,
   corsSchema,
@@ -17,4 +17,4 @@ export {
   storageSchema,
   theoConfigSchema
 };
-//# sourceMappingURL=schema-SOAD43RQ.js.map
+//# sourceMappingURL=schema-WKTNTGX6.js.map

package/dist/{schemas-4AXHQMV3.js → schemas-QCMSKQDK.js}

@@ -10,7 +10,7 @@ import {
   securitySchema,
   storageSchema,
   uploadSchema
-} from "./chunk-VI7ZANB3.js";
+} from "./chunk-OSBGZYXZ.js";
 export {
   cacheSchema,
   corsSchema,
@@ -22,4 +22,4 @@ export {
   storageSchema,
   uploadSchema
 };
-//# sourceMappingURL=schemas-4AXHQMV3.js.map
+//# sourceMappingURL=schemas-QCMSKQDK.js.map

package/dist/server/agent/index.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { C as CustomTool } from '../../define-agent-tool-cRuSpidb.js';
+import { C as CustomTool } from '../../define-agent-tool-CizaYZwU.js';
 import { AcpTransport } from '@theokit/agents';
 export { InProcessApprovalRequest, InProcessApprovalRequiredError, InProcessAwaitApproval, StreamAgentTurnDeps, StreamAgentTurnInProcessInput, streamAgentTurnInProcess } from '@theokit/agents';
 import { CustomTool as CustomTool$1 } from '@theokit/sdk';

package/dist/server/agent/index.js

@@ -12,7 +12,7 @@ import {
   parseChannelPath,
   serveMcpStdio,
   streamAgentTurnInProcess
-} from "../../chunk-7ZOQN7UH.js";
+} from "../../chunk-ZQO37YQJ.js";
 import {
   buildResourceDescriptors,
   defineAppResource,
@@ -26,7 +26,7 @@ import {
   resolveProvider,
   tryResolveProvider
 } from "../../chunk-3PBAN2YE.js";
-import "../../chunk-SAFGDIPQ.js";
+import "../../chunk-BZF76LFM.js";
 import "../../chunk-XTHN6JBX.js";
 export {
   CodeModePermissionDeniedError,

package/dist/server/define/index.d.ts

@@ -2,8 +2,8 @@ import { R as RouteConfig } from '../../route-config-Cm_ZMA1C.js';
 import { z } from 'zod';
 import { W as WebSocketHandler, b as WebSocketLike } from '../../define-websocket-DzPn1sR6.js';
 export { a as WebSocketHandlerWeb } from '../../define-websocket-DzPn1sR6.js';
-import { b as ToolTransform, C as CustomTool } from '../../define-agent-tool-cRuSpidb.js';
-export { D as DefineAgentToolSpec, T as ToolContextMessage, a as ToolHandlerContext, c as applyTransform } from '../../define-agent-tool-cRuSpidb.js';
+import { b as ToolTransform, C as CustomTool } from '../../define-agent-tool-CizaYZwU.js';
+export { D as DefineAgentToolSpec, T as ToolContextMessage, a as ToolHandlerContext, c as applyTransform } from '../../define-agent-tool-CizaYZwU.js';
 import { R as RoutePolicy } from '../../route-policy-BxOycCDq.js';
 export { A as AccessDecision, b as RoutePolicyInput, a as RouteSubject, e as evaluateRoutePolicy, r as requireOwner, s as subjectFromContext } from '../../route-policy-BxOycCDq.js';
 import { c as OnRequestHook, f as PreHandlerHook, d as OnResponseHook, O as OnErrorHook, T as TheoPlugin } from '../../plugin-types-BUVfUQ0V.js';

package/dist/server/define/index.js

@@ -8,7 +8,7 @@ import {
   tool,
   uiMessageStreamResponse,
   websocket
-} from "../../chunk-DHAD2O3S.js";
+} from "../../chunk-KHBSMLYU.js";
 import "../../chunk-D4VP2QPR.js";
 import {
   evaluateRoutePolicy,
@@ -24,7 +24,7 @@ import {
 } from "../../chunk-GAPBPRPP.js";
 import {
   applyTransform
-} from "../../chunk-SAFGDIPQ.js";
+} from "../../chunk-BZF76LFM.js";
 import "../../chunk-XTHN6JBX.js";
 export {
   HEALTH_PATH,

package/dist/server/http/index.d.ts

@@ -1,11 +1,11 @@
-export { B as BATCH_PATH, a as BatchExecuteFn, b as BatchPathConflictError, c as BatchPayload, d as BatchRequestItem, e as BatchResponse, f as BatchResultItem, C as CookieOptions, h as CorsConfig, i as CorsHandler, j as CorsOrigin, k as CorsWebHandler, l as CustomErrorPages, E as ExecuteActionOptions, m as ExecuteRouteContext, F as FileTooLargeError, H as HandleBatchOptions, M as MAX_ERROR_HTML_BYTES, n as MiddlewareResult, N as NotFoundError, p as ProcedureInputError, q as ProcedureOutputError, S as STRIPPED_HEADERS, u as SendErrorInput, v as SendErrorOptions, T as TRACE_HEADER, w as TRACE_PARENT_HEADER, x as TheoError, W as W3CTraceContext, _ as _resetMiddlewareCacheForTests, z as appendCookieToHeaders, A as appendDeleteCookieToHeaders, D as callProcedure, G as createCorsHandler, I as createCorsWebHandler, J as createOpenApiHandler, K as createServerContext, L as deleteCookie, Q as envelopeCodeToStatus, V as executeAction, X as executeRoute, Y as executeWebRequest, Z as extractTraceId, $ as extractTraceIdFromRequest, a0 as extractW3CTraceContext, a1 as fromUnknown, a2 as getCookie, a3 as getCookieFromRequest, a4 as handleBatchRequest, a5 as handleRequestError, a6 as handleWebRequestError, a7 as jsonTransformer, a8 as loadCustomErrorPages, a9 as matchesOrigin, aa as parseCookieHeader, ab as parseRequestBody, ac as parseTraceparent, ad as parseTraceparentContext, ae as resolveTransformer, af as runMiddlewareAndContext, ag as sendError, ah as sendJson, ai as serializeCookie, aj as serveStaticFile, ak as serverErrorToEnvelope, al as setCookie, am as superjsonTransformer, an as validateRouteInput } from '../../index-C8YN9dpF.js';
+export { B as BATCH_PATH, a as BatchExecuteFn, b as BatchPathConflictError, c as BatchPayload, d as BatchRequestItem, e as BatchResponse, f as BatchResultItem, C as CookieOptions, h as CorsConfig, i as CorsHandler, j as CorsOrigin, k as CorsWebHandler, l as CustomErrorPages, E as ExecuteActionOptions, m as ExecuteRouteContext, F as FileTooLargeError, H as HandleBatchOptions, M as MAX_ERROR_HTML_BYTES, n as MiddlewareResult, N as NotFoundError, p as ProcedureInputError, q as ProcedureOutputError, S as STRIPPED_HEADERS, u as SendErrorInput, v as SendErrorOptions, T as TRACE_HEADER, w as TRACE_PARENT_HEADER, x as TheoError, W as W3CTraceContext, _ as _resetMiddlewareCacheForTests, z as appendCookieToHeaders, A as appendDeleteCookieToHeaders, D as callProcedure, G as createCorsHandler, I as createCorsWebHandler, J as createOpenApiHandler, K as createServerContext, L as deleteCookie, Q as envelopeCodeToStatus, V as executeAction, X as executeRoute, Y as executeWebRequest, Z as extractTraceId, $ as extractTraceIdFromRequest, a0 as extractW3CTraceContext, a1 as fromUnknown, a2 as getCookie, a3 as getCookieFromRequest, a4 as handleBatchRequest, a5 as handleRequestError, a6 as handleWebRequestError, a7 as jsonTransformer, a8 as loadCustomErrorPages, a9 as matchesOrigin, aa as parseCookieHeader, ab as parseRequestBody, ac as parseTraceparent, ad as parseTraceparentContext, ae as resolveTransformer, af as runMiddlewareAndContext, ag as sendError, ah as sendJson, ai as serializeCookie, aj as serveStaticFile, ak as serverErrorToEnvelope, al as setCookie, am as superjsonTransformer, an as validateRouteInput } from '../../index-ADEV6pen.js';
 export { A as ActionError, b as ActionInputError, f as extractUniversalIssues, i as isActionError, d as isInputError } from '../../action-protocol-tGm3NKRg.js';
 import '../../error-envelope-DG47lt8E.js';
 import 'node:http';
 import '../../plugin-types-BUVfUQ0V.js';
 import '../../plugin-runner-BVMOSxvb.js';
 import '../../job-backend-CgC8Xf33.js';
-import '../../match-DmGgxjIU.js';
+import '../../match-Dw4CNXJH.js';
 import 'vite';
 import '../../csrf-Dgot9qSM.js';
 import '../../audit-log-BQWM5YLG.js';

package/dist/server/http/index.js

@@ -6,7 +6,7 @@ import {
   createOpenApiHandler,
   loadCustomErrorPages,
   serveStaticFile
-} from "../../chunk-YZCD3DWE.js";
+} from "../../chunk-AI7GBBRB.js";
 import {
   jsonTransformer,
   resolveTransformer,
@@ -31,7 +31,7 @@ import {
   sendError,
   sendJson,
   validateRouteInput
-} from "../../chunk-5BOKW3GX.js";
+} from "../../chunk-FVFYACYK.js";
 import {
   ActionError,
   ActionInputError,

package/dist/server/index.d.ts

@@ -1,13 +1,13 @@
 import { R as RouteConfig } from '../route-config-Cm_ZMA1C.js';
 export { ActionAccept, ActionBuilder, ActionConfig, ChannelHandler, MiddlewareBuilder, MiddlewareHandler, PluginBuilder, RouteBuilder, ToolBuilder, WebChannelHandler, WebSocketBuilder, action, defineChannel, defineWebChannel, middleware, plugin, route, tool, uiMessageStreamResponse, websocket } from './define/index.js';
 export { W as WebSocketHandler, a as WebSocketHandlerWeb, b as WebSocketLike } from '../define-websocket-DzPn1sR6.js';
-export { C as CustomTool, D as DefineAgentToolSpec, T as ToolContextMessage, a as ToolHandlerContext, b as ToolTransform, c as applyTransform } from '../define-agent-tool-cRuSpidb.js';
+export { C as CustomTool, D as DefineAgentToolSpec, T as ToolContextMessage, a as ToolHandlerContext, b as ToolTransform, c as applyTransform } from '../define-agent-tool-CizaYZwU.js';
 export { A as AccessDecision, R as RoutePolicy, b as RoutePolicyInput, a as RouteSubject, e as evaluateRoutePolicy, r as requireOwner, s as subjectFromContext } from '../route-policy-BxOycCDq.js';
 export { H as HEALTH_PATH, a as HealthRouteConfig, b as READY_PATH, c as ReadyRouteConfig, d as ReservedResponse, R as ReservedRoutes, e as defineHealthRoute, f as defineReadyRoute, s as serveReservedRoute } from '../health-route-C0hk64_U.js';
-export { B as BATCH_PATH, a as BatchExecuteFn, b as BatchPathConflictError, c as BatchPayload, d as BatchRequestItem, e as BatchResponse, f as BatchResultItem, g as BodyParserOptions, C as CookieOptions, h as CorsConfig, i as CorsHandler, j as CorsOrigin, k as CorsWebHandler, l as CustomErrorPages, E as ExecuteActionOptions, m as ExecuteRouteContext, F as FileTooLargeError, H as HandleBatchOptions, M as MAX_ERROR_HTML_BYTES, n as MiddlewareResult, N as NotFoundError, O as OpenApiDocsOptions, P as ParsedBody, o as ProcedureInput, p as ProcedureInputError, q as ProcedureOutputError, R as RawRouteInput, r as RouteInputChannel, s as RouteInputSchemas, t as RouteInputValidation, S as STRIPPED_HEADERS, u as SendErrorInput, v as SendErrorOptions, T as TRACE_HEADER, w as TRACE_PARENT_HEADER, x as TheoError, y as TheoTransformer, U as UploadedFile, W as W3CTraceContext, _ as _resetMiddlewareCacheForTests, z as appendCookieToHeaders, A as appendDeleteCookieToHeaders, D as callProcedure, G as createCorsHandler, I as createCorsWebHandler, J as createOpenApiHandler, K as createServerContext, L as deleteCookie, Q as envelopeCodeToStatus, V as executeAction, X as executeRoute, Y as executeWebRequest, Z as extractTraceId, $ as extractTraceIdFromRequest, a0 as extractW3CTraceContext, a1 as fromUnknown, a2 as getCookie, a3 as getCookieFromRequest, a4 as handleBatchRequest, a5 as handleRequestError, a6 as handleWebRequestError, a7 as jsonTransformer, a8 as loadCustomErrorPages, a9 as matchesOrigin, aa as parseCookieHeader, ab as parseRequestBody, ac as parseTraceparent, ad as parseTraceparentContext, ae as resolveTransformer, af as runMiddlewareAndContext, ag as sendError, ah as sendJson, ai as serializeCookie, aj as serveStaticFile, ak as serverErrorToEnvelope, al as setCookie, am as superjsonTransformer, an as validateRouteInput } from '../index-C8YN9dpF.js';
+export { B as BATCH_PATH, a as BatchExecuteFn, b as BatchPathConflictError, c as BatchPayload, d as BatchRequestItem, e as BatchResponse, f as BatchResultItem, g as BodyParserOptions, C as CookieOptions, h as CorsConfig, i as CorsHandler, j as CorsOrigin, k as CorsWebHandler, l as CustomErrorPages, E as ExecuteActionOptions, m as ExecuteRouteContext, F as FileTooLargeError, H as HandleBatchOptions, M as MAX_ERROR_HTML_BYTES, n as MiddlewareResult, N as NotFoundError, O as OpenApiDocsOptions, P as ParsedBody, o as ProcedureInput, p as ProcedureInputError, q as ProcedureOutputError, R as RawRouteInput, r as RouteInputChannel, s as RouteInputSchemas, t as RouteInputValidation, S as STRIPPED_HEADERS, u as SendErrorInput, v as SendErrorOptions, T as TRACE_HEADER, w as TRACE_PARENT_HEADER, x as TheoError, y as TheoTransformer, U as UploadedFile, W as W3CTraceContext, _ as _resetMiddlewareCacheForTests, z as appendCookieToHeaders, A as appendDeleteCookieToHeaders, D as callProcedure, G as createCorsHandler, I as createCorsWebHandler, J as createOpenApiHandler, K as createServerContext, L as deleteCookie, Q as envelopeCodeToStatus, V as executeAction, X as executeRoute, Y as executeWebRequest, Z as extractTraceId, $ as extractTraceIdFromRequest, a0 as extractW3CTraceContext, a1 as fromUnknown, a2 as getCookie, a3 as getCookieFromRequest, a4 as handleBatchRequest, a5 as handleRequestError, a6 as handleWebRequestError, a7 as jsonTransformer, a8 as loadCustomErrorPages, a9 as matchesOrigin, aa as parseCookieHeader, ab as parseRequestBody, ac as parseTraceparent, ad as parseTraceparentContext, ae as resolveTransformer, af as runMiddlewareAndContext, ag as sendError, ah as sendJson, ai as serializeCookie, aj as serveStaticFile, ak as serverErrorToEnvelope, al as setCookie, am as superjsonTransformer, an as validateRouteInput } from '../index-ADEV6pen.js';
 export { A as ActionError, a as ActionErrorCode, b as ActionInputError, e as ActionManifestEntry, c as ActionResult, S as SerializedActionResult, U as UniversalZodIssue, f as extractUniversalIssues, i as isActionError, d as isInputError } from '../action-protocol-tGm3NKRg.js';
 export { ACTION_SCHEMAS_DIR, ActionNode, ActionScanError, LoadedManifest, ManifestAction, ManifestAgent, ManifestRoute, ManifestWebSocket, TheoManifest, WebSocketRouteNode, _resetRouteScanCacheForTests, compareRouteSpecificity, generateManifest, loadManifest, scanMiddlewares, scanServerActions, scanServerActionsEnriched, scanServerRoutes, scanWebSocketRoutes, writeManifest } from './scan/index.js';
-export { L as LoadModule, S as ServerRouteNode, c as compilePattern, a as createProductionLoader, b as createViteLoader, m as matchRoute } from '../match-DmGgxjIU.js';
+export { L as LoadModule, S as ServerRouteNode, c as compilePattern, a as createProductionLoader, b as createViteLoader, m as matchRoute } from '../match-Dw4CNXJH.js';
 export { AcpToolConfig, AppResource, AppResourceInput, ChannelMessage, ChannelWebhookConfig, CodeModeApi, CodeModeConfig, CodeModePermission, CodeModePermissionDeniedError, McpResourceContents, McpResourceDescriptor, NodeAcpTransport, Sandbox, StdioStreams, VendorAgentClient, VendorAgentToolConfig, WorkflowLike, WorkflowToolConfig, buildResourceDescriptors, createACPTool, createCodeMode, createVendorAgentTool, createWorkflowTool, defineAppResource, extractAppResources, handleChannelWebhook, handleMcpStdioLine, isChannelPath, parseChannelPath, readAppResource, serveMcpStdio } from './agent/index.js';
 export { InProcessApprovalRequest, InProcessApprovalRequiredError, InProcessAwaitApproval, StreamAgentTurnDeps, StreamAgentTurnInProcessInput, streamAgentTurnInProcess } from '@theokit/agents';
 export { P as ProviderDescriptor, R as ResolvedProvider, l as listProviders, a as registerProvider, b as resetProviderRegistry, r as resolveProvider, t as tryResolveProvider } from '../provider-resolver-Dx6QuWrw.js';

package/dist/server/index.js

@@ -25,7 +25,7 @@ import {
   createOpenApiHandler,
   loadCustomErrorPages,
   serveStaticFile
-} from "../chunk-YZCD3DWE.js";
+} from "../chunk-AI7GBBRB.js";
 import {
   DuplicateJobNameError,
   InMemoryJobBackend,
@@ -86,7 +86,7 @@ import {
   sendError,
   sendJson,
   validateRouteInput
-} from "../chunk-5BOKW3GX.js";
+} from "../chunk-FVFYACYK.js";
 import {
   ActionError,
   ActionInputError,
@@ -160,7 +160,7 @@ import {
   scanServerRoutes,
   scanWebSocketRoutes,
   writeManifest
-} from "../chunk-VHB2FSPM.js";
+} from "../chunk-I2UN46ZX.js";
 import "../chunk-DV34VG3N.js";
 import "../chunk-IRASEXOG.js";
 import {
@@ -220,7 +220,7 @@ import {
   parseChannelPath,
   serveMcpStdio,
   streamAgentTurnInProcess
-} from "../chunk-7ZOQN7UH.js";
+} from "../chunk-ZQO37YQJ.js";
 import {
   buildResourceDescriptors,
   defineAppResource,
@@ -312,7 +312,7 @@ import {
   tool,
   uiMessageStreamResponse,
   websocket
-} from "../chunk-DHAD2O3S.js";
+} from "../chunk-KHBSMLYU.js";
 import "../chunk-D4VP2QPR.js";
 import {
   evaluateRoutePolicy,
@@ -328,7 +328,7 @@ import {
 } from "../chunk-GAPBPRPP.js";
 import {
   applyTransform
-} from "../chunk-SAFGDIPQ.js";
+} from "../chunk-BZF76LFM.js";
 import "../chunk-XTHN6JBX.js";
 
 // src/cache/constants.ts

package/dist/server/scan/index.d.ts

@@ -1,5 +1,5 @@
-import { S as ServerRouteNode } from '../../match-DmGgxjIU.js';
-export { L as LoadModule, c as compilePattern, a as createProductionLoader, b as createViteLoader, m as matchRoute } from '../../match-DmGgxjIU.js';
+import { S as ServerRouteNode } from '../../match-Dw4CNXJH.js';
+export { L as LoadModule, c as compilePattern, a as createProductionLoader, b as createViteLoader, m as matchRoute } from '../../match-Dw4CNXJH.js';
 import { A as AgentNode } from '../../agent-scan-BZa-pagG.js';
 import 'vite';
 
@@ -114,6 +114,12 @@ interface ManifestRoute {
     /** HTTP methods (uppercase) the route file exports. Optional — manifests
      * generated before G1 omit this; loaders treat absence as "unknown". */
     methods?: string[];
+    /**
+     * The subset of `methods` declaring `policy('public')`. Optional for the same reason `methods`
+     * is: a manifest written before the field existed has none, and `public-exposure-gate.ts` reads
+     * that absence as "not measured" rather than as "nothing is public".
+     */
+    publicMethods?: string[];
 }
 interface ManifestAction {
     filePath: string;

package/dist/server/scan/index.js

@@ -17,7 +17,7 @@ import {
   scanServerRoutes,
   scanWebSocketRoutes,
   writeManifest
-} from "../../chunk-VHB2FSPM.js";
+} from "../../chunk-I2UN46ZX.js";
 import "../../chunk-DV34VG3N.js";
 import "../../chunk-IRASEXOG.js";
 import {

package/dist/{server-boundary-XRXVVUMO.js → server-boundary-4UIGB3G5.js}

@@ -1,9 +1,9 @@
 import {
   resolveTheoRootDir
 } from "./chunk-VQPHPQ5L.js";
-import "./chunk-VGE6AKEJ.js";
-import "./chunk-JUDNKBDQ.js";
-import "./chunk-5BOKW3GX.js";
+import "./chunk-DAE7BJ7H.js";
+import "./chunk-WX6NHGKS.js";
+import "./chunk-FVFYACYK.js";
 import "./chunk-ZDUO4IYN.js";
 import "./chunk-47FFT43U.js";
 import "./chunk-NTDN54XO.js";
@@ -15,7 +15,7 @@ import "./chunk-TNI4MARH.js";
 import "./chunk-OQCRCXCP.js";
 import {
   ACTION_SCHEMAS_DIR
-} from "./chunk-VHB2FSPM.js";
+} from "./chunk-I2UN46ZX.js";
 import "./chunk-DV34VG3N.js";
 import "./chunk-IRASEXOG.js";
 import "./chunk-BX6EUYHU.js";
@@ -147,4 +147,4 @@ export {
   ServerOnlyImportError,
   serverOnlyImportBoundary
 };
-//# sourceMappingURL=server-boundary-XRXVVUMO.js.map
+//# sourceMappingURL=server-boundary-4UIGB3G5.js.map