theokit 0.57.1 → 0.58.1

package/dist/{chunk-CMCEGW3B.js → chunk-WOANPZBT.js}

@@ -10,8 +10,24 @@ import {
 // src/server/http/controller-dispatch.ts
 import { readdirSync } from "node:fs";
 import { join } from "node:path";
-import { createDecoratorHandler, isControllerClass } from "@theokit/http";
+import {
+  CONTROLLER_PREFIX,
+  createDecoratorHandler,
+  getMeta,
+  isControllerClass,
+  Reflector
+} from "@theokit/http";
 var CSRF_PROTECTED_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+var CSRF_EXEMPT_METADATA = "theokit:csrf-exempt";
+function segments(value) {
+  return value.split("/").filter(Boolean);
+}
+function pathOwnedByPrefix(pathname, prefix) {
+  const want = segments(prefix);
+  const got = segments(pathname);
+  if (want.length === 0 || got.length < want.length) return false;
+  return want.every((segment, i) => got[i] === segment);
+}
 function findControllerFiles(dir) {
   const found = [];
   const walk = (current) => {
@@ -52,9 +68,15 @@ async function createControllerDispatcher(opts) {
   const classes = await scanControllers(opts.controllersDir, opts.loadModule);
   if (classes.length === 0) return null;
   const handle = createDecoratorHandler({ controllers: classes, serveAgent: opts.serveAgent });
+  const reflector = new Reflector();
+  const exemptPrefixes = classes.filter((cls) => reflector.getByKey(CSRF_EXEMPT_METADATA, cls) === true).map((cls) => {
+    const meta = getMeta(CONTROLLER_PREFIX, cls);
+    return meta?.prefix ?? "";
+  }).filter((prefix) => prefix !== "");
   return {
     dispatch: (request) => handle(request),
-    matches: (method, pathname) => handle.matches(method, pathname)
+    matches: (method, pathname) => handle.matches(method, pathname),
+    isCsrfExempt: (pathname) => exemptPrefixes.some((p) => pathOwnedByPrefix(pathname, p))
   };
 }
 async function writeControllerResponse(res, response) {
@@ -79,7 +101,7 @@ async function dispatchControllerRequest(args) {
   const method = (req.method ?? "GET").toUpperCase();
   const webRequest = incomingMessageToWebRequest(req);
   const pathname = new URL(webRequest.url).pathname;
-  if (CSRF_PROTECTED_METHODS.has(method) && dispatcher.matches(method, pathname)) {
+  if (CSRF_PROTECTED_METHODS.has(method) && dispatcher.matches(method, pathname) && !dispatcher.isCsrfExempt(pathname)) {
     const decision = enforceCsrf(
       req,
       csrfMode,
@@ -108,4 +130,4 @@ export {
   scanControllerModules,
   dispatchControllerRequest
 };
-//# sourceMappingURL=chunk-CMCEGW3B.js.map
+//# sourceMappingURL=chunk-WOANPZBT.js.map

package/dist/chunk-WOANPZBT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/http/controller-dispatch.ts"],"mappings":";;;;;;;;;;AAIA,SAAS,mBAAgC;AAEzC,SAAS,YAAY;AAErB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AA2BP,IAAM,yBAAyB,oBAAI,IAAI,CAAC,QAAQ,OAAO,SAAS,QAAQ,CAAC;AAkBzE,IAAM,uBAAuB;AAU7B,SAAS,SAAS,OAAyB;AACzC,SAAO,MAAM,MAAM,GAAG,EAAE,OAAO,OAAO;AACxC;AAEA,SAAS,kBAAkB,UAAkB,QAAyB;AACpE,QAAM,OAAO,SAAS,MAAM;AAC5B,QAAM,MAAM,SAAS,QAAQ;AAC7B,MAAI,KAAK,WAAW,KAAK,IAAI,SAAS,KAAK,OAAQ,QAAO;AAC1D,SAAO,KAAK,MAAM,CAAC,SAAS,MAAM,IAAI,CAAC,MAAM,OAAO;AACtD;AAQO,SAAS,oBAAoB,KAAuB;AACzD,QAAM,QAAkB,CAAC;AACzB,QAAM,OAAO,CAAC,YAA0B;AACtC,QAAI;AACJ,QAAI;AACF,gBAAU,YAAY,SAAS,EAAE,eAAe,KAAK,CAAC;AAAA,IACxD,QAAQ;AACN;AAAA,IACF;AACA,eAAW,SAAS,SAAS;AAC3B,YAAM,OAAO,KAAK,SAAS,MAAM,IAAI;AACrC,UAAI,MAAM,YAAY,EAAG,MAAK,IAAI;AAAA,eAKzB,MAAM,KAAK,SAAS,gBAAgB,KAAK,MAAM,KAAK,SAAS,iBAAiB;AACrF,cAAM,KAAK,IAAI;AAAA,IACnB;AAAA,EACF;AACA,OAAK,GAAG;AACR,SAAO;AACT;AAyBA,eAAsB,sBACpB,gBACA,YAC6B;AAC7B,QAAM,QAAQ,oBAAoB,cAAc;AAChD,QAAM,UAA8B,CAAC;AACrC,aAAW,YAAY,OAAO;AAC5B,UAAM,MAAM,MAAM,WAAW,QAAQ;AACrC,eAAW,YAAY,OAAO,OAAO,GAAG,GAAG;AACzC,UAAI,OAAO,aAAa,cAAc,kBAAkB,QAAQ,GAAG;AACjE,gBAAQ,KAAK,EAAE,UAAU,KAAK,UAA6B,SAAS,IAAI,CAAC;AAAA,MAC3E;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAGA,eAAe,gBACb,gBACA,YAC4B;AAC5B,QAAM,UAAU,MAAM,sBAAsB,gBAAgB,UAAU;AACtE,SAAO,QAAQ,IAAI,CAAC,MAAM,EAAE,GAAG;AACjC;AAUA,eAAsB,2BAA2B,MAKR;AACvC,QAAM,UAAU,MAAM,gBAAgB,KAAK,gBAAgB,KAAK,UAAU;AAC1E,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,QAAM,SAAS,uBAAuB,EAAE,aAAa,SAAS,YAAY,KAAK,WAAW,CAAC;AAC3F,QAAM,YAAY,IAAI,UAAU;AAIhC,QAAM,iBAAiB,QAIpB,OAAO,CAAC,QAAQ,UAAU,SAAkB,sBAAsB,GAAG,MAAM,IAAI,EAC/E,IAAI,CAAC,QAAQ;AACZ,UAAM,OAAO,QAA6B,mBAAmB,GAAG;AAChE,WAAO,MAAM,UAAU;AAAA,EACzB,CAAC,EACA,OAAO,CAAC,WAAW,WAAW,EAAE;AAEnC,SAAO;AAAA,IACL,UAAU,CAAC,YAAY,OAAO,OAAO;AAAA,IACrC,SAAS,CAAC,QAAQ,aAAa,OAAO,QAAQ,QAAQ,QAAQ;AAAA,IAC9D,cAAc,CAAC,aAAa,eAAe,KAAK,CAAC,MAAM,kBAAkB,UAAU,CAAC,CAAC;AAAA,EACvF;AACF;AAmBA,eAAe,wBAAwB,KAAqB,UAAmC;AAC7F,QAAM,aAAqC,CAAC;AAC5C,aAAW,CAAC,GAAG,CAAC,KAAK,SAAS,SAAS;AACrC,QAAI,EAAE,YAAY,MAAM,aAAc,YAAW,CAAC,IAAI;AAAA,EACxD;AACA,QAAM,aAAa,SAAS,QAAQ,aAAa;AACjD,MAAI,WAAW,SAAS,EAAG,KAAI,UAAU,cAAc,UAAU;AACjE,MAAI,UAAU,SAAS,QAAQ,UAAU;AAGzC,QAAM,OAAO,SAAS,OAAO,OAAO,KAAK,MAAM,SAAS,YAAY,CAAC,IAAI;AACzE,MAAI,IAAI,SAAS,UAAa,KAAK,SAAS,IAAI,OAAO,MAAS;AAClE;AAWA,eAAsB,0BAA0B,MAU3B;AACnB,QAAM,EAAE,KAAK,KAAK,UAAU,YAAY,UAAU,IAAI;AACtD,QAAM,aAAa,MAAM,2BAA2B;AAAA,IAClD,gBAAgB,KAAK;AAAA,IACrB,YAAY,KAAK;AAAA,IACjB,YAAY,KAAK;AAAA,EACnB,CAAC;AACD,MAAI,CAAC,WAAY,QAAO;AAExB,QAAM,UAAU,IAAI,UAAU,OAAO,YAAY;AACjD,QAAM,aAAa,4BAA4B,GAAG;AAClD,QAAM,WAAW,IAAI,IAAI,WAAW,GAAG,EAAE;AAMzC,MACE,uBAAuB,IAAI,MAAM,KACjC,WAAW,QAAQ,QAAQ,QAAQ,KACnC,CAAC,WAAW,aAAa,QAAQ,GACjC;AACA,UAAM,WAAW;AAAA,MACf;AAAA,MACA;AAAA,MACA,EAAE,MAAM,kBAAkB,MAAM,IAAI,IAAI;AAAA,MACxC;AAAA,IACF;AACA,QAAI,CAAC,SAAS,OAAO;AACnB;AAAA,QACE;AAAA,QACA;AAAA,QACA,SAAS,UAAU;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,WAAW,SAAS,UAAU;AACrD,MAAI,aAAa,KAAM,QAAO;AAC9B,QAAM,wBAAwB,KAAK,QAAQ;AAC3C,SAAO;AACT;","names":[]}

package/dist/{chunk-Q6HS3NFG.js → chunk-YGL3H3UW.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-SSYDEKWF.js";
 import {
   dispatchControllerRequest
-} from "./chunk-CMCEGW3B.js";
+} from "./chunk-WOANPZBT.js";
 import {
   RUN_ID_HEADER,
   SSE_BASE_HEADERS,
@@ -89,7 +89,7 @@ import {
   scanServerActions,
   scanServerRoutes,
   scanWebSocketRoutes
-} from "./chunk-XJOU425Y.js";
+} from "./chunk-GP6OJBXP.js";
 import {
   scanAgents
 } from "./chunk-KDP2HURW.js";
@@ -2333,7 +2333,7 @@ async function runConfigureServer(server, ctx) {
   server.watcher.on("unlink", handleRouteChange);
   if (ctx.resolvedOpenApi !== void 0) {
     const openApiCfg = ctx.resolvedOpenApi;
-    const { reEmitOpenApi } = await import("./dev-emit-FIQASO3D.js");
+    const { reEmitOpenApi } = await import("./dev-emit-7RT624PM.js");
     const openApiServerDir = ctx.serverDir;
     const openApiDistDir = resolve8(ctx.projectRoot, ctx.resolvedDistDir);
     const isRouteFileForOpenApi = (file) => file.startsWith(openApiServerDir) && /\.(ts|tsx|js|mjs)$/.test(file);
@@ -3484,19 +3484,19 @@ async function theoPluginAsync(rootOrOptions) {
       })
     );
   }
-  const { appTypedClientPlugin } = await import("./app-typed-client-W74QO5LH.js");
+  const { appTypedClientPlugin } = await import("./app-typed-client-F3YLMV4N.js");
   const appClientPlugin = appTypedClientPlugin({
     cwd: projectRoot,
     serverDir: serverDirAbs,
     distDir: resolve10(projectRoot, ".theokit")
   });
-  const { actionsVirtualModule } = await import("./actions-virtual-module-GMRXCAVN.js");
+  const { actionsVirtualModule } = await import("./actions-virtual-module-L6SCJLDI.js");
   const actionsPlugin = actionsVirtualModule({
     serverDir: serverDirAbs,
     distDir: resolve10(projectRoot, ".theokit")
   });
   const { agentsTypedClientPlugin } = await import("./agents-typed-client-PVUZU65B.js");
-  const { generateManifest } = await import("./internal-api-EVJSGGO3.js");
+  const { generateManifest } = await import("./internal-api-W5RURFU7.js");
   const agentsClientPlugin = agentsTypedClientPlugin({
     projectRoot,
     agentsDir: agentsDirName,
@@ -3513,7 +3513,7 @@ async function theoPluginAsync(rootOrOptions) {
   const controllerTransformPlugin = controllerSwcTransformPlugin({
     serverDir: serverDirAbs
   });
-  const { serverOnlyImportBoundary } = await import("./server-boundary-QRVK3OIJ.js");
+  const { serverOnlyImportBoundary } = await import("./server-boundary-WVWEJNUJ.js");
   const serverBoundaryPlugin = serverOnlyImportBoundary({
     projectRoot,
     serverDir: serverDirAbs
@@ -3696,4 +3696,4 @@ export {
   theoPluginAsync,
   theoPlugin
 };
-//# sourceMappingURL=chunk-Q6HS3NFG.js.map
+//# sourceMappingURL=chunk-YGL3H3UW.js.map

package/dist/cli/index.js

@@ -15,12 +15,12 @@ function cliVersion() {
 // src/cli/index.ts
 var cli = cac("theokit");
 cli.command("dev", "Start development server").option("--port <port>", "Port number").action(async (options) => {
-  const { devCommand } = await import("../dev-WDKROZBS.js");
+  const { devCommand } = await import("../dev-SJE2GSAC.js");
   await devCommand({ port: options.port ? Number(options.port) : void 0 });
 });
 cli.command("build", "Build for production").option("--target <target>", "Deploy target (node, vercel, cloudflare)").action(async (options) => {
   try {
-    const { buildCommand } = await import("../build-FHE72YXR.js");
+    const { buildCommand } = await import("../build-H2UDKBV7.js");
     await buildCommand({ target: options.target });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -32,7 +32,7 @@ cli.command("build", "Build for production").option("--target <target>", "Deploy
 });
 cli.command("start", "Start production server").option("--port <port>", "Port number").action(async (options) => {
   try {
-    const { startCommand } = await import("../start-UAMJ5TSC.js");
+    const { startCommand } = await import("../start-KEWSYVVU.js");
     await startCommand({ port: options.port ? Number(options.port) : void 0 });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -44,7 +44,7 @@ cli.command("start", "Start production server").option("--port <port>", "Port nu
 });
 cli.command("preview", "Build for production, then serve it \u2014 one step (B-030)").option("--port <port>", "Port number").option("--target <target>", "Deploy target (node, vercel, cloudflare)").action(async (options) => {
   try {
-    const { previewCommand } = await import("../preview-VFIFKVP4.js");
+    const { previewCommand } = await import("../preview-PWGO5LUE.js");
     await previewCommand({
       port: options.port ? Number(options.port) : void 0,
       target: options.target
@@ -77,7 +77,7 @@ cli.command(
   "Run an agent in the terminal (stream + tool calls + approval)"
 ).action(async (name, message) => {
   try {
-    const { agentCommand } = await import("../agent-LS7I3ZQB.js");
+    const { agentCommand } = await import("../agent-X7RDENTI.js");
     const { sawError } = await agentCommand(name, message);
     if (sawError) process.exit(1);
   } catch (err) {
@@ -108,7 +108,7 @@ cli.command("agent sessions gc", "Collect old transcripts for this project (dry
 });
 cli.command("mcp <agent>", "Serve an agent as an MCP server over stdio (for desktop MCP clients)").action(async (agent) => {
   try {
-    const { mcpCommand } = await import("../mcp-PBUCHHAS.js");
+    const { mcpCommand } = await import("../mcp-I5HCW4QF.js");
     await mcpCommand(agent);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -173,7 +173,7 @@ cli.command(
   "Generate <distDir>/openapi.json from route schemas (opt-in via config.openapi)"
 ).option("--dry-run", "Print the document to stdout without writing to disk (EC-3)").action(async (options) => {
   try {
-    const { openapiCommand } = await import("../openapi-PKDDJ7M2.js");
+    const { openapiCommand } = await import("../openapi-WDX3XX2J.js");
     await openapiCommand({ dryRun: Boolean(options.dryRun) });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);

package/dist/{dev-WDKROZBS.js → dev-SJE2GSAC.js}

@@ -11,20 +11,20 @@ import {
 } from "./chunk-KTMQUYED.js";
 import {
   theoPluginAsync
-} from "./chunk-KEDRCI2L.js";
-import "./chunk-OKDCBENR.js";
+} from "./chunk-6YRZWT5X.js";
+import "./chunk-VJRPOUKM.js";
 import "./chunk-2CVV6CNN.js";
 import "./chunk-3PWQQWT6.js";
 import "./chunk-FDOOBTXJ.js";
 import "./chunk-47MM2JUK.js";
-import "./chunk-G5JYB2LO.js";
+import "./chunk-IF7CZXPW.js";
 import "./chunk-35QIWOHT.js";
-import "./chunk-CTRVTBGY.js";
+import "./chunk-L4TB6FXQ.js";
 import "./chunk-RPET332G.js";
 import "./chunk-5VLP3GQ2.js";
 import "./chunk-C27VRUVN.js";
 import "./chunk-7UZZHCRN.js";
-import "./chunk-2HWWJTOH.js";
+import "./chunk-BCFA6LHL.js";
 import "./chunk-5NNFO7R7.js";
 import "./chunk-NO6HA4FG.js";
 import "./chunk-Z7CJHDLS.js";
@@ -123,4 +123,4 @@ export {
   devCommand,
   startDevServer
 };
-//# sourceMappingURL=dev-WDKROZBS.js.map
+//# sourceMappingURL=dev-SJE2GSAC.js.map

package/dist/{dev-emit-FIQASO3D.js → dev-emit-7RT624PM.js}

@@ -1,6 +1,6 @@
 import {
   generateManifest
-} from "./chunk-XJOU425Y.js";
+} from "./chunk-GP6OJBXP.js";
 import "./chunk-KDP2HURW.js";
 import "./chunk-DV34VG3N.js";
 import "./chunk-SOYOYGWY.js";
@@ -339,4 +339,4 @@ export {
   _resetInFlightForTests,
   reEmitOpenApi
 };
-//# sourceMappingURL=dev-emit-FIQASO3D.js.map
+//# sourceMappingURL=dev-emit-7RT624PM.js.map

package/dist/{dev-emit-QGSMUZLU.js → dev-emit-ZLB2J5ME.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-47VNWTL4.js";
 import {
   generateManifest
-} from "./chunk-2HWWJTOH.js";
+} from "./chunk-BCFA6LHL.js";
 import "./chunk-5NNFO7R7.js";
 import "./chunk-NO6HA4FG.js";
 import "./chunk-Z7CJHDLS.js";
@@ -41,4 +41,4 @@ export {
   _resetInFlightForTests,
   reEmitOpenApi
 };
-//# sourceMappingURL=dev-emit-QGSMUZLU.js.map
+//# sourceMappingURL=dev-emit-ZLB2J5ME.js.map

package/dist/index.js

@@ -8,10 +8,10 @@ import {
   scanRoutes,
   theoConfigSchema,
   theoPlugin
-} from "./chunk-Q6HS3NFG.js";
+} from "./chunk-YGL3H3UW.js";
 import "./chunk-7NRFZBAL.js";
 import "./chunk-SSYDEKWF.js";
-import "./chunk-CMCEGW3B.js";
+import "./chunk-WOANPZBT.js";
 import "./chunk-M357ILK5.js";
 import "./chunk-OIGJOYX6.js";
 import "./chunk-U3SPBLJF.js";
@@ -32,7 +32,7 @@ import "./chunk-AVQU5CQF.js";
 import "./chunk-VSLTKX5L.js";
 import "./chunk-TNI4MARH.js";
 import "./chunk-4ERYQBL6.js";
-import "./chunk-XJOU425Y.js";
+import "./chunk-GP6OJBXP.js";
 import "./chunk-KDP2HURW.js";
 import "./chunk-DV34VG3N.js";
 import "./chunk-V6Y2SMRG.js";

package/dist/{internal-api-732K3H75.js → internal-api-4FBFRQ4G.js}

@@ -16,7 +16,7 @@ import {
   handleCspReport,
   handleCsrfReadiness,
   mountAgent
-} from "./chunk-G5JYB2LO.js";
+} from "./chunk-IF7CZXPW.js";
 import {
   resolveProvider
 } from "./chunk-35QIWOHT.js";
@@ -24,7 +24,7 @@ import {
   dispatchControllerRequest,
   incomingMessageToHandlerRequest,
   sendError
-} from "./chunk-CTRVTBGY.js";
+} from "./chunk-L4TB6FXQ.js";
 import {
   generateNonce
 } from "./chunk-RPET332G.js";
@@ -38,7 +38,7 @@ import {
 import "./chunk-7UZZHCRN.js";
 import {
   generateManifest
-} from "./chunk-2HWWJTOH.js";
+} from "./chunk-BCFA6LHL.js";
 import {
   scanAgents
 } from "./chunk-5NNFO7R7.js";
@@ -87,4 +87,4 @@ export {
   scanWebSocketRoutes,
   sendError
 };
-//# sourceMappingURL=internal-api-732K3H75.js.map
+//# sourceMappingURL=internal-api-4FBFRQ4G.js.map

package/dist/{internal-api-EVJSGGO3.js → internal-api-W5RURFU7.js}

@@ -1,6 +1,6 @@
 import {
   dispatchControllerRequest
-} from "./chunk-CMCEGW3B.js";
+} from "./chunk-WOANPZBT.js";
 import {
   mountAgent
 } from "./chunk-M357ILK5.js";
@@ -54,7 +54,7 @@ import {
   scanServerActionsEnriched,
   scanServerRoutes,
   scanWebSocketRoutes
-} from "./chunk-XJOU425Y.js";
+} from "./chunk-GP6OJBXP.js";
 import {
   scanAgents
 } from "./chunk-KDP2HURW.js";
@@ -107,4 +107,4 @@ export {
   scanWebSocketRoutes,
   sendError
 };
-//# sourceMappingURL=internal-api-EVJSGGO3.js.map
+//# sourceMappingURL=internal-api-W5RURFU7.js.map

package/dist/{mcp-PBUCHHAS.js → mcp-I5HCW4QF.js}

@@ -2,7 +2,7 @@
 import "tsx/esm";
 import {
   createAgentSsrLoader
-} from "./chunk-NC2OPE22.js";
+} from "./chunk-MWPC7EOR.js";
 import {
   extractAppResources,
   handleMcpJsonRpc
@@ -75,4 +75,4 @@ async function mcpCommand(name, deps = {}) {
 export {
   mcpCommand
 };
-//# sourceMappingURL=mcp-PBUCHHAS.js.map
+//# sourceMappingURL=mcp-I5HCW4QF.js.map

package/dist/{openapi-PKDDJ7M2.js → openapi-WDX3XX2J.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-47VNWTL4.js";
 import {
   generateManifest
-} from "./chunk-2HWWJTOH.js";
+} from "./chunk-BCFA6LHL.js";
 import "./chunk-5NNFO7R7.js";
 import "./chunk-NO6HA4FG.js";
 import "./chunk-Z7CJHDLS.js";
@@ -84,4 +84,4 @@ function emitOpenApiInMemory(manifest, config) {
 export {
   openapiCommand
 };
-//# sourceMappingURL=openapi-PKDDJ7M2.js.map
+//# sourceMappingURL=openapi-WDX3XX2J.js.map

package/dist/{preview-VFIFKVP4.js → preview-PWGO5LUE.js}

@@ -4,8 +4,8 @@ import "tsx/esm";
 // src/cli/commands/preview.ts
 async function defaultSteps() {
   const [{ buildCommand }, { startCommand }] = await Promise.all([
-    import("./build-FHE72YXR.js"),
-    import("./start-UAMJ5TSC.js")
+    import("./build-H2UDKBV7.js"),
+    import("./start-KEWSYVVU.js")
   ]);
   return {
     build: (opts) => buildCommand(opts),
@@ -20,4 +20,4 @@ async function previewCommand(options = {}, steps) {
 export {
   previewCommand
 };
-//# sourceMappingURL=preview-VFIFKVP4.js.map
+//# sourceMappingURL=preview-PWGO5LUE.js.map

package/dist/server/index.js

@@ -208,7 +208,7 @@ import {
   scanServerRoutes,
   scanWebSocketRoutes,
   writeManifest
-} from "../chunk-XJOU425Y.js";
+} from "../chunk-GP6OJBXP.js";
 import "../chunk-KDP2HURW.js";
 import "../chunk-DV34VG3N.js";
 import {

package/dist/server/scan/index.d.ts

@@ -139,6 +139,17 @@ interface ManifestAgent {
 interface TheoManifest {
     version: 1;
     generatedAt: string;
+    /**
+     * FILE routes — what `scanServerRoutes` finds under `<serverDir>/routes`. Controllers are NOT
+     * here, and that is deliberate: they ship as a separate `controllers.json` so a deploy adapter
+     * that knows nothing about them keeps working unchanged (see `emit-controllers.ts`).
+     *
+     * Which makes `routes: []` ambiguous, and the ambiguity is worth stating rather than leaving for
+     * each reader to rediscover. It means "no file routes" — never "this app serves nothing". Measured
+     * on a nine-controller app: sixteen routes served, `routes: []` written (theokit#543). Anything
+     * answering "what does this app serve?" must read `controllers.json` too; `public-exposure-gate`
+     * is the one that had to learn this the expensive way.
+     */
     routes: ManifestRoute[];
     actions: ManifestAction[];
     websockets: ManifestWebSocket[];

package/dist/server/scan/index.js

@@ -17,7 +17,7 @@ import {
   scanServerRoutes,
   scanWebSocketRoutes,
   writeManifest
-} from "../../chunk-XJOU425Y.js";
+} from "../../chunk-GP6OJBXP.js";
 import "../../chunk-KDP2HURW.js";
 import "../../chunk-DV34VG3N.js";
 import {

package/dist/{server-boundary-B6U4DRRH.js → server-boundary-CJIXOPCF.js}

@@ -3,14 +3,14 @@ import "tsx/esm";
 import {
   resolveTheoRootDir
 } from "./chunk-FDOOBTXJ.js";
-import "./chunk-G5JYB2LO.js";
+import "./chunk-IF7CZXPW.js";
 import "./chunk-35QIWOHT.js";
-import "./chunk-CTRVTBGY.js";
+import "./chunk-L4TB6FXQ.js";
 import "./chunk-RPET332G.js";
 import "./chunk-5VLP3GQ2.js";
 import "./chunk-C27VRUVN.js";
 import "./chunk-7UZZHCRN.js";
-import "./chunk-2HWWJTOH.js";
+import "./chunk-BCFA6LHL.js";
 import "./chunk-5NNFO7R7.js";
 import {
   ACTION_SCHEMAS_DIR
@@ -131,4 +131,4 @@ export {
   ServerOnlyImportError,
   serverOnlyImportBoundary
 };
-//# sourceMappingURL=server-boundary-B6U4DRRH.js.map
+//# sourceMappingURL=server-boundary-CJIXOPCF.js.map

package/dist/{server-boundary-QRVK3OIJ.js → server-boundary-WVWEJNUJ.js}

@@ -1,7 +1,7 @@
 import {
   resolveTheoRootDir
 } from "./chunk-7NRFZBAL.js";
-import "./chunk-CMCEGW3B.js";
+import "./chunk-WOANPZBT.js";
 import "./chunk-M357ILK5.js";
 import "./chunk-BPYMC7SU.js";
 import "./chunk-IRQGAC4L.js";
@@ -21,7 +21,7 @@ import "./chunk-TNI4MARH.js";
 import "./chunk-4ERYQBL6.js";
 import {
   ACTION_SCHEMAS_DIR
-} from "./chunk-XJOU425Y.js";
+} from "./chunk-GP6OJBXP.js";
 import "./chunk-KDP2HURW.js";
 import "./chunk-DV34VG3N.js";
 import "./chunk-V6Y2SMRG.js";
@@ -147,4 +147,4 @@ export {
   ServerOnlyImportError,
   serverOnlyImportBoundary
 };
-//# sourceMappingURL=server-boundary-QRVK3OIJ.js.map
+//# sourceMappingURL=server-boundary-WVWEJNUJ.js.map

package/dist/{start-UAMJ5TSC.js → start-KEWSYVVU.js}

@@ -2,7 +2,7 @@
 import "tsx/esm";
 import {
   CONTROLLER_MANIFEST_FILE
-} from "./chunk-CLBJTDI6.js";
+} from "./chunk-KZ3PXNPT.js";
 import {
   parseCookieHeader
 } from "./chunk-V7MTRM6Q.js";
@@ -25,7 +25,7 @@ import {
   resolveTransformer,
   serveMatchedAuxRoute,
   serveThroughPluginLifecycle
-} from "./chunk-OKDCBENR.js";
+} from "./chunk-VJRPOUKM.js";
 import "./chunk-2CVV6CNN.js";
 import {
   findRootDiv
@@ -41,7 +41,7 @@ import {
   mountAgent,
   readAgentPolicy,
   writeWebResponseToServerResponse
-} from "./chunk-G5JYB2LO.js";
+} from "./chunk-IF7CZXPW.js";
 import {
   getApprovalRegistry,
   resolveProvider
@@ -50,7 +50,7 @@ import {
   createWebRequestSource,
   dispatchControllerRequest,
   sendError
-} from "./chunk-CTRVTBGY.js";
+} from "./chunk-L4TB6FXQ.js";
 import {
   buildSecurityHeaders,
   generateNonce
@@ -68,7 +68,7 @@ import {
 import "./chunk-7UZZHCRN.js";
 import {
   loadManifest
-} from "./chunk-2HWWJTOH.js";
+} from "./chunk-BCFA6LHL.js";
 import {
   scanAgents
 } from "./chunk-5NNFO7R7.js";
@@ -577,10 +577,28 @@ function unauthenticatedWrites(routes) {
   }
   return found;
 }
-function cannotAnswer(routes) {
-  const anyDetected = routes.some((r) => r.publicMethods !== void 0);
-  if (anyDetected) return false;
-  return routes.some((r) => (r.methods ?? []).some((m) => MUTATING_METHODS.has(m)));
+function whyCannotAnswer(routes, hasControllers) {
+  if (routes.length === 0) {
+    return hasControllers === false ? null : "empty-table";
+  }
+  if (routes.some((r) => r.publicMethods !== void 0)) return null;
+  return routes.some((r) => (r.methods ?? []).some((m) => MUTATING_METHODS.has(m))) ? "stale-manifest" : null;
+}
+function unverifiedMessage(reason, host) {
+  const head = `Binding ${host} without checking whether its write routes are authenticated.`;
+  return reason === "stale-manifest" ? [
+    head,
+    "  This manifest predates the check and records no policy kinds. Run `theo build` to",
+    "  regenerate it; until then the server starts, and this warning is the whole of what",
+    "  is known about the exposure."
+  ].join("\n") : [
+    head,
+    "  The manifest describes no routes, so there is nothing here to judge. If this app serves",
+    "  through controllers, that is expected and rebuilding will not change it \u2014 the route scan",
+    "  reads `server/routes/` only (usetheokit/theokit#543). Whatever your controllers mark",
+    "  `theokit:public` on a POST/PUT/PATCH/DELETE is reachable from this address, and this",
+    "  warning is the whole of what is known about it."
+  ].join("\n");
 }
 function refusalMessage(exposures, host) {
   const list = exposures.map((e) => `    ${e.method} ${e.routePath}`).join("\n");
@@ -602,16 +620,9 @@ function refusalMessage(exposures, host) {
 }
 function assessPublicExposure(input) {
   if (!isPubliclyBound(input.target.host)) return { kind: "not-exposed" };
-  if (cannotAnswer(input.routes)) {
-    return {
-      kind: "unverified",
-      message: [
-        `Binding ${input.target.host} without checking whether its write routes are authenticated.`,
-        "  This manifest predates the check and records no policy kinds. Run `theo build` to",
-        "  regenerate it; until then the server starts, and this warning is the whole of what",
-        "  is known about the exposure."
-      ].join("\n")
-    };
+  const blind = whyCannotAnswer(input.routes, input.hasControllers);
+  if (blind !== null) {
+    return { kind: "unverified", message: unverifiedMessage(blind, input.target.host) };
   }
   const exposures = unauthenticatedWrites(input.routes);
   if (exposures.length === 0) return { kind: "allowed" };
@@ -1343,7 +1354,11 @@ async function startCommand(options) {
   const exposure = assessPublicExposure({
     routes: cachedRoutes,
     target: listenTarget,
-    allowUnauthenticatedWrites: config.security?.allowUnauthenticatedWrites ?? false
+    allowUnauthenticatedWrites: config.security?.allowUnauthenticatedWrites ?? false,
+    // `cachedRoutes` comes from the file-route scan and never describes controllers. Without this
+    // the gate reads an empty table as "nothing is exposed" and binds a public interface in silence,
+    // while a controller marked `theokit:public` on a POST sits on it (theokit#543).
+    hasControllers: controllersDistDir !== void 0
   });
   if (exposure.kind === "refused") {
     console.error(`
@@ -1381,4 +1396,4 @@ export {
   resolveSsrEntry,
   startCommand
 };
-//# sourceMappingURL=start-UAMJ5TSC.js.map
+//# sourceMappingURL=start-KEWSYVVU.js.map