theokit 0.59.0 → 0.60.0

package/dist/{actions-virtual-module-L6SCJLDI.js → actions-virtual-module-DNOALUTX.js}

@@ -1,7 +1,7 @@
 import "./chunk-WOANPZBT.js";
-import "./chunk-M357ILK5.js";
-import "./chunk-BPYMC7SU.js";
-import "./chunk-IRQGAC4L.js";
+import "./chunk-DMODPX7P.js";
+import "./chunk-EYRWD2AB.js";
+import "./chunk-5GZROLDV.js";
 import "./chunk-JW5UFKQ3.js";
 import "./chunk-P6OS7652.js";
 import "./chunk-ZDUO4IYN.js";
@@ -24,7 +24,7 @@ import "./chunk-DV34VG3N.js";
 import "./chunk-V6Y2SMRG.js";
 import "./chunk-ACKBVBUI.js";
 import "./chunk-IZ3TIL6K.js";
-import "./chunk-CF2DNN5R.js";
+import "./chunk-45XETXSG.js";
 import "./chunk-YSJOZEI6.js";
 import "./chunk-Z4PJMZLM.js";
 import "./chunk-UMNXCU3K.js";
@@ -234,4 +234,4 @@ export const actions = manifest
 export {
   actionsVirtualModule
 };
-//# sourceMappingURL=actions-virtual-module-L6SCJLDI.js.map
+//# sourceMappingURL=actions-virtual-module-DNOALUTX.js.map

package/dist/{actions-virtual-module-YQBEDNHN.js → actions-virtual-module-UE5H42GP.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import "tsx/esm";
-import "./chunk-IF7CZXPW.js";
-import "./chunk-35QIWOHT.js";
+import "./chunk-GZ5YHD5H.js";
+import "./chunk-WFIAYPBH.js";
 import "./chunk-L4TB6FXQ.js";
-import "./chunk-RPET332G.js";
+import "./chunk-VV2VU3LJ.js";
 import "./chunk-5VLP3GQ2.js";
 import "./chunk-C27VRUVN.js";
 import "./chunk-7UZZHCRN.js";
@@ -218,4 +218,4 @@ export const actions = manifest
 export {
   actionsVirtualModule
 };
-//# sourceMappingURL=actions-virtual-module-YQBEDNHN.js.map
+//# sourceMappingURL=actions-virtual-module-UE5H42GP.js.map

package/dist/adapters/agent-mount.d.ts

@@ -1,6 +1,6 @@
 import { a as RouteSubject, R as RoutePolicy } from '../route-policy-BxOycCDq.js';
 import { C as CsrfMode } from '../csrf-Dgot9qSM.js';
-export { r as resolveProvider } from '../provider-resolver-VS61zqsw.js';
+export { r as resolveProvider } from '../provider-resolver-1aWi_WSz.js';
 export { s as scanAgents } from '../agent-scan-BZa-pagG.js';
 import 'node:http';
 import '../audit-log-BQWM5YLG.js';

package/dist/adapters/agent-mount.js

@@ -1,6 +1,6 @@
 import {
   mountAgent
-} from "../chunk-M357ILK5.js";
+} from "../chunk-DMODPX7P.js";
 import "../chunk-P6OS7652.js";
 import "../chunk-YN4W7LCX.js";
 import "../chunk-PVNMLZ5G.js";
@@ -12,7 +12,7 @@ import {
 } from "../chunk-KDP2HURW.js";
 import {
   resolveProvider
-} from "../chunk-CF2DNN5R.js";
+} from "../chunk-45XETXSG.js";
 import "../chunk-UMNXCU3K.js";
 import "../chunk-SOYOYGWY.js";
 import "../chunk-ZWN3AODA.js";

package/dist/adapters/security-headers.d.ts

@@ -1,6 +1,6 @@
 export { g as generateNonce } from '../nonce-BXt7Qu_C.js';
-import { S as SecurityHeadersConfig } from '../security-headers-Ccj7ncNx.js';
-export { b as buildSecurityHeaders } from '../security-headers-Ccj7ncNx.js';
+import { S as SecurityHeadersConfig } from '../security-headers-C2cByfJn.js';
+export { b as buildSecurityHeaders } from '../security-headers-C2cByfJn.js';
 
 /**
  * The security headers a deployed target puts on its responses.

package/dist/adapters/security-headers.js

@@ -1,6 +1,6 @@
 import {
   buildSecurityHeaders
-} from "../chunk-IRQGAC4L.js";
+} from "../chunk-5GZROLDV.js";
 import {
   generateNonce
 } from "../chunk-Z4PJMZLM.js";

package/dist/{agent-X7RDENTI.js → agent-VWPSEDXD.js}

@@ -3,8 +3,8 @@ import "tsx/esm";
 import {
   agentCommand,
   createAgentSsrLoader
-} from "./chunk-MWPC7EOR.js";
-import "./chunk-35QIWOHT.js";
+} from "./chunk-IZTOGKLS.js";
+import "./chunk-WFIAYPBH.js";
 import "./chunk-5NNFO7R7.js";
 import "./chunk-Z7CJHDLS.js";
 import "./chunk-3QPVEJ7D.js";
@@ -12,4 +12,4 @@ export {
   agentCommand,
   createAgentSsrLoader
 };
-//# sourceMappingURL=agent-X7RDENTI.js.map
+//# sourceMappingURL=agent-VWPSEDXD.js.map

package/dist/{app-typed-client-BE4LZPK2.js → app-typed-client-4KLNKET6.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import "tsx/esm";
-import "./chunk-IF7CZXPW.js";
-import "./chunk-35QIWOHT.js";
+import "./chunk-GZ5YHD5H.js";
+import "./chunk-WFIAYPBH.js";
 import {
   scanControllerModules
 } from "./chunk-L4TB6FXQ.js";
-import "./chunk-RPET332G.js";
+import "./chunk-VV2VU3LJ.js";
 import "./chunk-5VLP3GQ2.js";
 import "./chunk-C27VRUVN.js";
 import "./chunk-7UZZHCRN.js";
@@ -411,4 +411,4 @@ export {
   generateClientDts,
   shouldReemitForFile
 };
-//# sourceMappingURL=app-typed-client-BE4LZPK2.js.map
+//# sourceMappingURL=app-typed-client-4KLNKET6.js.map

package/dist/{app-typed-client-F3YLMV4N.js → app-typed-client-MKTSLES3.js}

@@ -1,9 +1,9 @@
 import {
   scanControllerModules
 } from "./chunk-WOANPZBT.js";
-import "./chunk-M357ILK5.js";
-import "./chunk-BPYMC7SU.js";
-import "./chunk-IRQGAC4L.js";
+import "./chunk-DMODPX7P.js";
+import "./chunk-EYRWD2AB.js";
+import "./chunk-5GZROLDV.js";
 import "./chunk-JW5UFKQ3.js";
 import "./chunk-P6OS7652.js";
 import "./chunk-ZDUO4IYN.js";
@@ -28,7 +28,7 @@ import {
 import "./chunk-V6Y2SMRG.js";
 import "./chunk-ACKBVBUI.js";
 import "./chunk-IZ3TIL6K.js";
-import "./chunk-CF2DNN5R.js";
+import "./chunk-45XETXSG.js";
 import "./chunk-YSJOZEI6.js";
 import "./chunk-Z4PJMZLM.js";
 import "./chunk-UMNXCU3K.js";
@@ -427,4 +427,4 @@ export {
   generateClientDts,
   shouldReemitForFile
 };
-//# sourceMappingURL=app-typed-client-F3YLMV4N.js.map
+//# sourceMappingURL=app-typed-client-MKTSLES3.js.map

package/dist/{aws-lambda-VKMYUMP2.js → aws-lambda-2R77AV5F.js}

@@ -7,11 +7,11 @@ import {
   deployedTraceFragment,
   describeDeployedSecurityHeaders,
   renderSecurityHeadersConfigLiteral
-} from "./chunk-E43VJ3E5.js";
+} from "./chunk-VPX3MS5D.js";
 import {
   nodeAdapter
 } from "./chunk-KI4DOTN4.js";
-import "./chunk-RPET332G.js";
+import "./chunk-VV2VU3LJ.js";
 import {
   assertServicesUnsupported,
   readManifest
@@ -258,4 +258,4 @@ export {
   renderAwsLambdaEntry,
   responseToLambdaResultV2
 };
-//# sourceMappingURL=aws-lambda-VKMYUMP2.js.map
+//# sourceMappingURL=aws-lambda-2R77AV5F.js.map

package/dist/{build-H2UDKBV7.js → build-RG54DH3F.js}

@@ -34,14 +34,14 @@ import {
 } from "./chunk-Z7CJHDLS.js";
 import {
   loadConfig
-} from "./chunk-HA35FS7U.js";
+} from "./chunk-FFS7IRZF.js";
 import {
   loadEnv
 } from "./chunk-3QPVEJ7D.js";
 import {
   importUserModule
 } from "./chunk-U5PWXS3J.js";
-import "./chunk-4OTIXAUY.js";
+import "./chunk-TMQ52AZR.js";
 import {
   buildManifest,
   writeManifest
@@ -554,7 +554,7 @@ async function buildCommand(options) {
 `);
 }
 async function runAdapterBuild(target, config, cwd) {
-  const { theoPluginAsync } = await import("./vite-plugin-TU3HQA43.js");
+  const { theoPluginAsync } = await import("./vite-plugin-BG5K3L46.js");
   const { default: react } = await import("@vitejs/plugin-react");
   const ctx = {
     // `react()` may return Plugin or Plugin[] depending on version; spread the
@@ -603,7 +603,7 @@ async function runAdapterBuild(target, config, cwd) {
       };
     }
   };
-  const { resolveAdapter } = await import("./registry-3LUHO4IB.js");
+  const { resolveAdapter } = await import("./registry-APCN3PSJ.js");
   const adapter = await resolveAdapter(target);
   const { warnUnappliedConfig, assertRateLimitEnforceable } = await import("./config-support-O4REYSK5.js");
   assertRateLimitEnforceable(config, adapter, target);
@@ -676,4 +676,4 @@ function relativize3(absPath, root) {
 export {
   buildCommand
 };
-//# sourceMappingURL=build-H2UDKBV7.js.map
+//# sourceMappingURL=build-RG54DH3F.js.map

package/dist/{bun-POLTY2HK.js → bun-MAAG4MKW.js}

@@ -11,11 +11,11 @@ import {
   deployedTraceFragment,
   describeDeployedSecurityHeaders,
   renderSecurityHeadersConfigLiteral
-} from "./chunk-E43VJ3E5.js";
+} from "./chunk-VPX3MS5D.js";
 import {
   nodeAdapter
 } from "./chunk-KI4DOTN4.js";
-import "./chunk-RPET332G.js";
+import "./chunk-VV2VU3LJ.js";
 import {
   assertServicesUnsupported,
   readManifest
@@ -343,4 +343,4 @@ export {
   bunAdapter,
   renderBunEntry
 };
-//# sourceMappingURL=bun-POLTY2HK.js.map
+//# sourceMappingURL=bun-MAAG4MKW.js.map

package/dist/{chunk-CF2DNN5R.js → chunk-45XETXSG.js}

@@ -16,6 +16,7 @@ var DEFAULT_REGISTRY = [
     name: "openrouter",
     envKey: "OPENROUTER_API_KEY",
     baseUrl: "https://openrouter.ai/api/v1",
+    gateway: true,
     priority: 1
   },
   {
@@ -84,6 +85,13 @@ function declaredPrefixOf(modelId) {
   if (slash <= 0) return void 0;
   return modelId.slice(0, slash);
 }
+function gatewayHint(declared, modelId, registered) {
+  const gateway = registered.find(
+    (p) => p.gateway === true && p.name !== declared.name && p.envKey !== void 0 && (process.env[p.envKey] ?? "").length > 0
+  );
+  if (gateway?.envKey === void 0) return `, or change the model's provider prefix`;
+  return `, or use "${gateway.name}/${modelId}" to route it through ${gateway.name} (${gateway.envKey} is set, and ${gateway.name} serves this model id)`;
+}
 function takesCredential(desc) {
   return desc.envKey !== void 0;
 }
@@ -102,7 +110,7 @@ function resolveProvider(modelId, options) {
       return { name: declared.name, apiKey, baseUrl: baseUrlOf(declared) };
     }
     throw new Error(
-      `Model "${modelId}" declares provider "${declared.name}", but ${declared.envKey} is not set. Set ${declared.envKey}, or change the model's provider prefix.`
+      `Model "${modelId}" declares provider "${declared.name}", but ${declared.envKey} is not set. Set ${declared.envKey}${gatewayHint(declared, modelId, sorted)}.`
     );
   }
   const unregisteredPrefix = declared === void 0 ? declaredPrefixOf(modelId) : void 0;
@@ -144,4 +152,4 @@ export {
   resolveProvider,
   tryResolveProvider
 };
-//# sourceMappingURL=chunk-CF2DNN5R.js.map
+//# sourceMappingURL=chunk-45XETXSG.js.map

package/dist/chunk-45XETXSG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/_internal/process-singleton.ts","../src/server/agent/provider-resolver.ts"],"mappings":";AAgCA,IAAM,YAAY;AASX,SAAS,iBAAmC,KAAa,SAAqB;AACnF,QAAM,OAAO,uBAAO,IAAI,YAAY,GAAG;AACvC,QAAM,OAAO;AAEb,QAAM,WAAW,KAAK,IAAI;AAC1B,MAAI,aAAa,OAAW,QAAO;AAEnC,QAAM,UAAU,QAAQ;AACxB,OAAK,IAAI,IAAI;AACb,SAAO;AACT;;;ACuDA,IAAM,mBAAyC;AAAA,EAC7C;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAME,MAAM;AAAA,IACN,SAAS;AAAA,IACT,YAAY;AAAA,IACZ,UAAU;AAAA,EACZ;AACF;AAYA,SAAS,aAAmC;AAC1C,SAAO,iBAAiB,qBAAqB,MAAM,CAAC,GAAG,gBAAgB,CAAC;AAC1E;AAUA,IAAM,YAAY,oBAAI,IAAY;AA2B3B,SAAS,iBAAiB,YAAsC;AAErE,QAAM,WAAW,WAAW;AAC5B,QAAM,MAAM,SAAS,UAAU,CAAC,MAAM,EAAE,SAAS,WAAW,IAAI;AAChE,MAAI,OAAO,EAAG,UAAS,GAAG,IAAI;AAAA,MACzB,UAAS,KAAK,UAAU;AAC/B;AAOO,SAAS,wBAA8B;AAC5C,QAAM,WAAW,WAAW;AAC5B,WAAS,SAAS;AAClB,WAAS,KAAK,GAAG,gBAAgB;AACnC;AAOO,SAAS,gBAA+C;AAC7D,SAAO,CAAC,GAAG,WAAW,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,EAAE,QAAQ;AACjE;AASA,SAAS,SACP,MACA,KACA,SACM;AACN,MAAI,UAAU,IAAI,KAAK,IAAI,EAAG;AAC9B,YAAU,IAAI,KAAK,IAAI;AACvB,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,OAAO,sBAAsB,KAAK,IAAI,KAAK,GAAG,YAAY,MAAM,YAAY,UAAU,IAAI,CAAC;AACjG,MAAI,SAAS,SAAU,SAAQ,SAAS,IAAI;AAAA,MAIvC,SAAQ,KAAK,IAAI;AACxB;AAQA,SAAS,UAAU,MAAkC;AACnD,MAAI,KAAK,eAAe,OAAW,QAAO,KAAK;AAC/C,QAAM,WAAW,QAAQ,IAAI,KAAK,UAAU;AAC5C,SAAO,aAAa,UAAa,SAAS,SAAS,IAAI,WAAW,KAAK;AACzE;AAaA,SAAS,WACP,SACA,YACgC;AAChC,QAAM,SAAS,iBAAiB,OAAO;AACvC,MAAI,WAAW,OAAW,QAAO;AACjC,SAAO,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,MAAM;AACjD;AASA,SAAS,iBAAiB,SAAiD;AACzE,MAAI,YAAY,OAAW,QAAO;AAClC,QAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,MAAI,SAAS,EAAG,QAAO;AACvB,SAAO,QAAQ,MAAM,GAAG,KAAK;AAC/B;AAaA,SAAS,YACP,UACA,SACA,YACQ;AACR,QAAM,UAAU,WAAW;AAAA,IACzB,CAAC,MACC,EAAE,YAAY,QACd,EAAE,SAAS,SAAS,QACpB,EAAE,WAAW,WACZ,QAAQ,IAAI,EAAE,MAAM,KAAK,IAAI,SAAS;AAAA,EAC3C;AACA,MAAI,SAAS,WAAW,OAAW,QAAO;AAC1C,SACE,aAAa,QAAQ,IAAI,IAAI,OAAO,yBAAyB,QAAQ,IAAI,KACrE,QAAQ,MAAM,gBAAgB,QAAQ,IAAI;AAElD;AAKA,SAAS,gBAAgB,MAAwD;AAC/E,SAAO,KAAK,WAAW;AACzB;AA+BA,IAAM,kBAAkB;AAEjB,SAAS,gBAAgB,SAAkB,SAA4C;AAC5F,QAAM,SAAS,CAAC,GAAG,WAAW,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,EAAE,QAAQ;AAEvE,QAAM,WAAW,YAAY,SAAY,SAAY,WAAW,SAAS,MAAM;AAC/E,MAAI,aAAa,UAAa,YAAY,QAAW;AACnD,QAAI,SAAS,WAAW,QAAW;AACjC,eAAS,UAAU,yBAAyB,OAAO;AACnD,aAAO,EAAE,MAAM,SAAS,MAAM,QAAQ,iBAAiB,SAAS,UAAU,QAAQ,EAAE;AAAA,IACtF;AACA,UAAM,SAAS,QAAQ,IAAI,SAAS,MAAM;AAC1C,QAAI,UAAU,OAAO,SAAS,GAAG;AAC/B,eAAS,UAAU,yBAAyB,OAAO;AACnD,aAAO,EAAE,MAAM,SAAS,MAAM,QAAQ,SAAS,UAAU,QAAQ,EAAE;AAAA,IACrE;AAOA,UAAM,IAAI;AAAA,MACR,UAAU,OAAO,wBAAwB,SAAS,IAAI,UAAU,SAAS,MAAM,oBACtE,SAAS,MAAM,GAAG,YAAY,UAAU,SAAS,MAAM,CAAC;AAAA,IACnE;AAAA,EACF;AAcA,QAAM,qBAAqB,aAAa,SAAY,iBAAiB,OAAO,IAAI;AAChF,MAAI,uBAAuB,QAAW;AACpC,UAAM,IAAI;AAAA,MACR,UAAU,OAAO,OAAO,CAAC,wBAAwB,kBAAkB,qDACxC,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC,gDACf,kBAAkB;AAAA,IACpE;AAAA,EACF;AAIA,QAAM,eAAe,OAAO,OAAO,eAAe;AAElD,aAAW,QAAQ,cAAc;AAC/B,UAAM,SAAS,QAAQ,IAAI,KAAK,MAAM;AACtC,QAAI,UAAU,OAAO,SAAS,GAAG;AAC/B,eAAS,MAAM,mBAAmB,OAAO;AACzC,aAAO;AAAA,QACL,MAAM,KAAK;AAAA,QACX;AAAA,QACA,SAAS,UAAU,IAAI;AAAA,MACzB;AAAA,IACF;AAAA,EACF;AAQA,QAAM,UAAU,aAAa,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,MAAM;AAC7D,QAAM,IAAI;AAAA,IACR,6DAA6D,OAAO;AAAA,EAEtE;AACF;AAQO,SAAS,mBAAmB,SAA2C;AAC5E,MAAI;AACF,WAAO,gBAAgB,OAAO;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/{chunk-IRQGAC4L.js → chunk-5GZROLDV.js}

@@ -1,5 +1,5 @@
 // src/core/contracts/security-headers.ts
-var DEFAULT_CSP = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' ws: wss:; frame-ancestors 'none'; report-uri /__theo/csp-report";
+var DEFAULT_CSP = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; media-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' ws: wss:; frame-ancestors 'none'; report-uri /__theo/csp-report";
 var DEFAULT_PERMISSIONS_POLICY = "geolocation=(), camera=(), microphone=(), payment=(), usb=(), accelerometer=(), gyroscope=()";
 var DEFAULT_HSTS = "max-age=31536000; includeSubDomains";
 function applyNonceToCsp(policy, nonce) {
@@ -49,4 +49,4 @@ export {
   DEFAULT_PERMISSIONS_POLICY,
   buildSecurityHeaders
 };
-//# sourceMappingURL=chunk-IRQGAC4L.js.map
+//# sourceMappingURL=chunk-5GZROLDV.js.map

package/dist/{chunk-IRQGAC4L.js.map → chunk-5GZROLDV.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/core/contracts/security-headers.ts"],"mappings":";AAyDO,IAAM,cACX;AAsBK,IAAM,6BACX;AAyDF,IAAM,eAAe;AAOrB,SAAS,gBAAgB,QAAgB,OAAuB;AAC9D,SAAO,OACJ,MAAM,GAAG,EACT,IAAI,CAAC,cAAc;AAClB,UAAM,UAAU,UAAU,KAAK;AAC/B,QAAI,CAAC,QAAQ,WAAW,YAAY,EAAG,QAAO;AAC9C,QAAI,QAAQ,SAAS,iBAAiB,GAAG;AACvC,aAAO,UAAU,QAAQ,mBAAmB,UAAU,KAAK,GAAG;AAAA,IAChE;AACA,WAAO,GAAG,SAAS,WAAW,KAAK;AAAA,EACrC,CAAC,EACA,KAAK,GAAG;AACb;AAWA,SAAS,SACP,KACA,QACA,gBACM;AACN,MAAI,OAAO,QAAQ,SAAS,OAAO,YAAY,MAAO;AACtD,MAAI,SAAS,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM;AAC3D,MAAI,gBAAgB;AAClB,aAAS,gBAAgB,QAAQ,cAAc;AAAA,EACjD;AAEA,QAAM,OAAgB,OAAO,WAAW;AACxC,MAAI,SAAS,WAAW;AACtB,QAAI,yBAAyB,IAAI;AAAA,EACnC,OAAO;AACL,QAAI,qCAAqC,IAAI;AAAA,EAC/C;AACF;AAMO,SAAS,qBACd,QACA,KACA,UAAkC,CAAC,GACX;AACxB,QAAM,MAA8B,CAAC;AAIrC,QAAM,iBAAiB,QAAQ,YAAY,SAAY,QAAQ;AAE/D,WAAS,KAAK,QAAQ,cAAc;AAGpC,MAAI,iBAAiB,IAAI,OAAO,gBAAgB;AAGhD,MAAI,wBAAwB,IAAI,OAAO,sBAAsB;AAG7D,MAAI,iBAAiB,IAAI,OAAO,kBAAkB;AAIlD,MAAI,OAAO,sBAAsB,OAAO;AACtC,QAAI,oBAAoB,IACtB,OAAO,OAAO,sBAAsB,WAChC,OAAO,oBACP;AAAA,EACR;AAGA,MAAI,IAAI,cAAc,OAAO,SAAS,OAAO;AAC3C,QAAI,2BAA2B,IAAI,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;AAAA,EACrF;AAQA,MAAI,gBAAgB;AAClB,QAAI,eAAe,IAAI;AAAA,EACzB;AAEA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/core/contracts/security-headers.ts"],"mappings":";AA8DO,IAAM,cACX;AAuBK,IAAM,6BACX;AAyDF,IAAM,eAAe;AAOrB,SAAS,gBAAgB,QAAgB,OAAuB;AAC9D,SAAO,OACJ,MAAM,GAAG,EACT,IAAI,CAAC,cAAc;AAClB,UAAM,UAAU,UAAU,KAAK;AAC/B,QAAI,CAAC,QAAQ,WAAW,YAAY,EAAG,QAAO;AAC9C,QAAI,QAAQ,SAAS,iBAAiB,GAAG;AACvC,aAAO,UAAU,QAAQ,mBAAmB,UAAU,KAAK,GAAG;AAAA,IAChE;AACA,WAAO,GAAG,SAAS,WAAW,KAAK;AAAA,EACrC,CAAC,EACA,KAAK,GAAG;AACb;AAWA,SAAS,SACP,KACA,QACA,gBACM;AACN,MAAI,OAAO,QAAQ,SAAS,OAAO,YAAY,MAAO;AACtD,MAAI,SAAS,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM;AAC3D,MAAI,gBAAgB;AAClB,aAAS,gBAAgB,QAAQ,cAAc;AAAA,EACjD;AAEA,QAAM,OAAgB,OAAO,WAAW;AACxC,MAAI,SAAS,WAAW;AACtB,QAAI,yBAAyB,IAAI;AAAA,EACnC,OAAO;AACL,QAAI,qCAAqC,IAAI;AAAA,EAC/C;AACF;AAMO,SAAS,qBACd,QACA,KACA,UAAkC,CAAC,GACX;AACxB,QAAM,MAA8B,CAAC;AAIrC,QAAM,iBAAiB,QAAQ,YAAY,SAAY,QAAQ;AAE/D,WAAS,KAAK,QAAQ,cAAc;AAGpC,MAAI,iBAAiB,IAAI,OAAO,gBAAgB;AAGhD,MAAI,wBAAwB,IAAI,OAAO,sBAAsB;AAG7D,MAAI,iBAAiB,IAAI,OAAO,kBAAkB;AAIlD,MAAI,OAAO,sBAAsB,OAAO;AACtC,QAAI,oBAAoB,IACtB,OAAO,OAAO,sBAAsB,WAChC,OAAO,oBACP;AAAA,EACR;AAGA,MAAI,IAAI,cAAc,OAAO,SAAS,OAAO;AAC3C,QAAI,2BAA2B,IAAI,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;AAAA,EACrF;AAQA,MAAI,gBAAgB;AAClB,QAAI,eAAe,IAAI;AAAA,EACzB;AAEA,SAAO;AACT;","names":[]}

package/dist/{chunk-M357ILK5.js → chunk-DMODPX7P.js}

@@ -15,7 +15,7 @@ import {
 } from "./chunk-ZDCCILMP.js";
 import {
   processSingleton
-} from "./chunk-CF2DNN5R.js";
+} from "./chunk-45XETXSG.js";
 import {
   newSpanId,
   newTraceId
@@ -805,4 +805,4 @@ export {
   parseAgentRequestBody,
   mountAgent
 };
-//# sourceMappingURL=chunk-M357ILK5.js.map
+//# sourceMappingURL=chunk-DMODPX7P.js.map

package/dist/{chunk-6YRZWT5X.js → chunk-ETKLM6UN.js}

@@ -12,7 +12,7 @@ import {
   serveMatchedAuxRoute,
   serveThroughPluginLifecycle,
   setupSsrDevMiddleware
-} from "./chunk-VJRPOUKM.js";
+} from "./chunk-XES7ZE2K.js";
 import {
   resolveTheoRootDir
 } from "./chunk-FDOOBTXJ.js";
@@ -38,11 +38,11 @@ import {
   mountAgent,
   readAgentPolicy,
   writeWebResponseToServerResponse
-} from "./chunk-IF7CZXPW.js";
+} from "./chunk-GZ5YHD5H.js";
 import {
   getApprovalRegistry,
   resolveProvider
-} from "./chunk-35QIWOHT.js";
+} from "./chunk-WFIAYPBH.js";
 import {
   createWebRequestSource,
   dispatchControllerRequest,
@@ -68,7 +68,7 @@ import {
 } from "./chunk-NO6HA4FG.js";
 import {
   loadConfig
-} from "./chunk-HA35FS7U.js";
+} from "./chunk-FFS7IRZF.js";
 import {
   buildServicesProxyConfig
 } from "./chunk-ZNZISJDZ.js";
@@ -2179,19 +2179,19 @@ async function theoPluginAsync(rootOrOptions) {
       })
     );
   }
-  const { appTypedClientPlugin } = await import("./app-typed-client-BE4LZPK2.js");
+  const { appTypedClientPlugin } = await import("./app-typed-client-4KLNKET6.js");
   const appClientPlugin = appTypedClientPlugin({
     cwd: projectRoot,
     serverDir: serverDirAbs,
     distDir: resolve5(projectRoot, ".theokit")
   });
-  const { actionsVirtualModule } = await import("./actions-virtual-module-YQBEDNHN.js");
+  const { actionsVirtualModule } = await import("./actions-virtual-module-UE5H42GP.js");
   const actionsPlugin = actionsVirtualModule({
     serverDir: serverDirAbs,
     distDir: resolve5(projectRoot, ".theokit")
   });
   const { agentsTypedClientPlugin } = await import("./agents-typed-client-D4OA2TXB.js");
-  const { generateManifest } = await import("./internal-api-4FBFRQ4G.js");
+  const { generateManifest } = await import("./internal-api-UM77XDXN.js");
   const agentsClientPlugin = agentsTypedClientPlugin({
     projectRoot,
     agentsDir: agentsDirName,
@@ -2208,7 +2208,7 @@ async function theoPluginAsync(rootOrOptions) {
   const controllerTransformPlugin = controllerSwcTransformPlugin({
     serverDir: serverDirAbs
   });
-  const { serverOnlyImportBoundary } = await import("./server-boundary-CJIXOPCF.js");
+  const { serverOnlyImportBoundary } = await import("./server-boundary-X52AMCKI.js");
   const serverBoundaryPlugin = serverOnlyImportBoundary({
     projectRoot,
     serverDir: serverDirAbs
@@ -2383,4 +2383,4 @@ export {
   theoPluginAsync,
   theoPlugin
 };
-//# sourceMappingURL=chunk-6YRZWT5X.js.map
+//# sourceMappingURL=chunk-ETKLM6UN.js.map

package/dist/{chunk-BPYMC7SU.js → chunk-EYRWD2AB.js}

@@ -1,6 +1,6 @@
 import {
   buildSecurityHeaders
-} from "./chunk-IRQGAC4L.js";
+} from "./chunk-5GZROLDV.js";
 import {
   safeAudit
 } from "./chunk-AVQU5CQF.js";
@@ -359,4 +359,4 @@ export {
   CsrfReadinessStore,
   applySecurityHeaders
 };
-//# sourceMappingURL=chunk-BPYMC7SU.js.map
+//# sourceMappingURL=chunk-EYRWD2AB.js.map

package/dist/{chunk-HA35FS7U.js → chunk-FFS7IRZF.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-U5PWXS3J.js";
 import {
   theoConfigSchema
-} from "./chunk-4OTIXAUY.js";
+} from "./chunk-TMQ52AZR.js";
 
 // src/config/load-config.ts
 import { existsSync } from "fs";
@@ -110,4 +110,4 @@ export {
   deepMerge,
   loadConfig
 };
-//# sourceMappingURL=chunk-HA35FS7U.js.map
+//# sourceMappingURL=chunk-FFS7IRZF.js.map

package/dist/{chunk-IF7CZXPW.js → chunk-GZ5YHD5H.js}

@@ -2,7 +2,7 @@
 import "tsx/esm";
 import {
   getApprovalRegistry
-} from "./chunk-35QIWOHT.js";
+} from "./chunk-WFIAYPBH.js";
 import {
   createWebRequestSource,
   dispatchCsrfWarn,
@@ -15,7 +15,7 @@ import {
 } from "./chunk-L4TB6FXQ.js";
 import {
   buildSecurityHeaders
-} from "./chunk-RPET332G.js";
+} from "./chunk-VV2VU3LJ.js";
 import {
   getObservabilityAdapter,
   newSpanId,
@@ -2616,4 +2616,4 @@ export {
   CsrfReadinessStore,
   applySecurityHeaders
 };
-//# sourceMappingURL=chunk-IF7CZXPW.js.map
+//# sourceMappingURL=chunk-GZ5YHD5H.js.map

package/dist/{chunk-MWPC7EOR.js → chunk-IZTOGKLS.js}

@@ -3,7 +3,7 @@ import "tsx/esm";
 import {
   getApprovalRegistry,
   resolveProvider
-} from "./chunk-35QIWOHT.js";
+} from "./chunk-WFIAYPBH.js";
 import {
   scanAgents
 } from "./chunk-5NNFO7R7.js";
@@ -145,7 +145,7 @@ async function agentCommand(name, message, deps = {}) {
     );
   }
   const projectRoot = deps.projectRoot ?? process.cwd();
-  const agentsDir = deps.agentsDir ?? (await (await import("./load-config-BKUAMGO5.js")).loadConfig(projectRoot)).agentsDir;
+  const agentsDir = deps.agentsDir ?? (await (await import("./load-config-VMKOV44Y.js")).loadConfig(projectRoot)).agentsDir;
   const agents = scanAgents(projectRoot, agentsDir);
   const agent = agents.find((a) => a.name === name);
   if (!agent) {
@@ -178,8 +178,8 @@ async function agentCommand(name, message, deps = {}) {
 async function createAgentSsrLoader(projectRoot) {
   const { createServer } = await import("vite");
   const react = (await import("@vitejs/plugin-react")).default;
-  const { theoPluginAsync } = await import("./vite-plugin-TU3HQA43.js");
-  const { loadConfig } = await import("./load-config-BKUAMGO5.js");
+  const { theoPluginAsync } = await import("./vite-plugin-BG5K3L46.js");
+  const { loadConfig } = await import("./load-config-VMKOV44Y.js");
   const config = await loadConfig(projectRoot);
   const theoPlugins = await theoPluginAsync({
     root: projectRoot,
@@ -212,4 +212,4 @@ export {
   agentCommand,
   createAgentSsrLoader
 };
-//# sourceMappingURL=chunk-MWPC7EOR.js.map
+//# sourceMappingURL=chunk-IZTOGKLS.js.map

package/dist/{chunk-YGL3H3UW.js → chunk-K3DUUEQ5.js}

@@ -32,7 +32,7 @@ import {
   securitySchema,
   storageSchema,
   uploadSchema
-} from "./chunk-M357ILK5.js";
+} from "./chunk-DMODPX7P.js";
 import {
   broadcastToDevtools
 } from "./chunk-OIGJOYX6.js";
@@ -45,7 +45,7 @@ import {
   applySecurityHeaders,
   handleCspReport,
   handleCsrfReadiness
-} from "./chunk-BPYMC7SU.js";
+} from "./chunk-EYRWD2AB.js";
 import {
   resolveTransformer
 } from "./chunk-OGLS76RN.js";
@@ -100,7 +100,7 @@ import {
 } from "./chunk-YOIVCCZT.js";
 import {
   resolveProvider
-} from "./chunk-CF2DNN5R.js";
+} from "./chunk-45XETXSG.js";
 import {
   generateNonce
 } from "./chunk-Z4PJMZLM.js";
@@ -309,6 +309,29 @@ var theoConfigSchema = z.object({
    * is still distinguishable from "somebody said localhost".
    */
   host: z.union([z.string(), z.boolean()]).optional(),
+  /**
+   * Hostnames `theokit dev` will answer for, beyond the loopback names Vite permits out of the
+   * box — Vite's `server.allowedHosts` (#555).
+   *
+   * This is NOT {@link host}. That one is the bind ADDRESS; this one is the `Host` header check
+   * that runs after the connection is accepted, so binding `0.0.0.0` does not make a tunnelled
+   * request pass. Developing against any webhook platform needs a public URL, which means a
+   * tunnel or a reverse proxy, which means a `Host` the check refuses by default — and a
+   * scaffolded app has no `vite.config.ts` in which to allow it.
+   *
+   * Vite's own matching rules apply, not globs: a leading dot allows a domain and its
+   * subdomains (`.trycloudflare.com`), and anything else is compared literally.
+   *
+   * `true` disables the check. It is here because a tunnel that mints a fresh random hostname
+   * per run cannot be listed, and the alternative — editing config between runs — is what makes
+   * people reach for the production server instead. It also removes the protection against
+   * DNS-rebinding that the check exists to provide, so prefer the list whenever the hostname is
+   * knowable. `theokit start` is unaffected either way: this is dev-server-only.
+   *
+   * Deliberately NOT defaulted — an empty array is a decision that blocks every host including
+   * the loopback names, so "nobody said" has to stay distinguishable from "somebody said none".
+   */
+  allowedHosts: z.union([z.array(z.string()), z.literal(true)]).optional(),
   /** Automatically open browser on `theokit dev`. */
   open: z.union([z.boolean(), z.string()]).default(false),
   /** Exit if port is already in use instead of trying next available. */
@@ -3484,19 +3507,19 @@ async function theoPluginAsync(rootOrOptions) {
       })
     );
   }
-  const { appTypedClientPlugin } = await import("./app-typed-client-F3YLMV4N.js");
+  const { appTypedClientPlugin } = await import("./app-typed-client-MKTSLES3.js");
   const appClientPlugin = appTypedClientPlugin({
     cwd: projectRoot,
     serverDir: serverDirAbs,
     distDir: resolve10(projectRoot, ".theokit")
   });
-  const { actionsVirtualModule } = await import("./actions-virtual-module-L6SCJLDI.js");
+  const { actionsVirtualModule } = await import("./actions-virtual-module-DNOALUTX.js");
   const actionsPlugin = actionsVirtualModule({
     serverDir: serverDirAbs,
     distDir: resolve10(projectRoot, ".theokit")
   });
   const { agentsTypedClientPlugin } = await import("./agents-typed-client-PVUZU65B.js");
-  const { generateManifest } = await import("./internal-api-W5RURFU7.js");
+  const { generateManifest } = await import("./internal-api-3YDGG5FF.js");
   const agentsClientPlugin = agentsTypedClientPlugin({
     projectRoot,
     agentsDir: agentsDirName,
@@ -3513,7 +3536,7 @@ async function theoPluginAsync(rootOrOptions) {
   const controllerTransformPlugin = controllerSwcTransformPlugin({
     serverDir: serverDirAbs
   });
-  const { serverOnlyImportBoundary } = await import("./server-boundary-WVWEJNUJ.js");
+  const { serverOnlyImportBoundary } = await import("./server-boundary-JG53VI6L.js");
   const serverBoundaryPlugin = serverOnlyImportBoundary({
     projectRoot,
     serverDir: serverDirAbs
@@ -3696,4 +3719,4 @@ export {
   theoPluginAsync,
   theoPlugin
 };
-//# sourceMappingURL=chunk-YGL3H3UW.js.map
+//# sourceMappingURL=chunk-K3DUUEQ5.js.map