theokit 0.59.0 → 0.61.0

package/dist/{actions-virtual-module-L6SCJLDI.js → actions-virtual-module-345YHSEB.js}

@@ -1,12 +1,12 @@
-import "./chunk-WOANPZBT.js";
-import "./chunk-M357ILK5.js";
-import "./chunk-BPYMC7SU.js";
-import "./chunk-IRQGAC4L.js";
-import "./chunk-JW5UFKQ3.js";
+import "./chunk-Q3UE7WIM.js";
+import "./chunk-H2X5T45M.js";
+import "./chunk-EYRWD2AB.js";
+import "./chunk-5GZROLDV.js";
+import "./chunk-5AGNZXHJ.js";
 import "./chunk-P6OS7652.js";
 import "./chunk-ZDUO4IYN.js";
 import "./chunk-D4VP2QPR.js";
-import "./chunk-YN4W7LCX.js";
+import "./chunk-ENRT6DAU.js";
 import "./chunk-47FFT43U.js";
 import "./chunk-NTDN54XO.js";
 import "./chunk-PVNMLZ5G.js";
@@ -24,7 +24,7 @@ import "./chunk-DV34VG3N.js";
 import "./chunk-V6Y2SMRG.js";
 import "./chunk-ACKBVBUI.js";
 import "./chunk-IZ3TIL6K.js";
-import "./chunk-CF2DNN5R.js";
+import "./chunk-45XETXSG.js";
 import "./chunk-YSJOZEI6.js";
 import "./chunk-Z4PJMZLM.js";
 import "./chunk-UMNXCU3K.js";
@@ -234,4 +234,4 @@ export const actions = manifest
 export {
   actionsVirtualModule
 };
-//# sourceMappingURL=actions-virtual-module-L6SCJLDI.js.map
+//# sourceMappingURL=actions-virtual-module-345YHSEB.js.map

package/dist/{actions-virtual-module-YQBEDNHN.js → actions-virtual-module-XI5IGBF4.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import "tsx/esm";
-import "./chunk-IF7CZXPW.js";
-import "./chunk-35QIWOHT.js";
+import "./chunk-KVZQJ3ZM.js";
+import "./chunk-WFIAYPBH.js";
 import "./chunk-L4TB6FXQ.js";
-import "./chunk-RPET332G.js";
+import "./chunk-VV2VU3LJ.js";
 import "./chunk-5VLP3GQ2.js";
 import "./chunk-C27VRUVN.js";
 import "./chunk-7UZZHCRN.js";
@@ -218,4 +218,4 @@ export const actions = manifest
 export {
   actionsVirtualModule
 };
-//# sourceMappingURL=actions-virtual-module-YQBEDNHN.js.map
+//# sourceMappingURL=actions-virtual-module-XI5IGBF4.js.map

package/dist/adapters/agent-mount.d.ts

@@ -1,6 +1,6 @@
-import { a as RouteSubject, R as RoutePolicy } from '../route-policy-BxOycCDq.js';
+import { a as RouteSubject, R as RoutePolicy } from '../route-policy-BHXQDzBF.js';
 import { C as CsrfMode } from '../csrf-Dgot9qSM.js';
-export { r as resolveProvider } from '../provider-resolver-VS61zqsw.js';
+export { r as resolveProvider } from '../provider-resolver-1aWi_WSz.js';
 export { s as scanAgents } from '../agent-scan-BZa-pagG.js';
 import 'node:http';
 import '../audit-log-BQWM5YLG.js';

package/dist/adapters/agent-mount.js

@@ -1,8 +1,8 @@
 import {
   mountAgent
-} from "../chunk-M357ILK5.js";
+} from "../chunk-H2X5T45M.js";
 import "../chunk-P6OS7652.js";
-import "../chunk-YN4W7LCX.js";
+import "../chunk-ENRT6DAU.js";
 import "../chunk-PVNMLZ5G.js";
 import "../chunk-ZDCCILMP.js";
 import "../chunk-CHTAWXC2.js";
@@ -12,7 +12,7 @@ import {
 } from "../chunk-KDP2HURW.js";
 import {
   resolveProvider
-} from "../chunk-CF2DNN5R.js";
+} from "../chunk-45XETXSG.js";
 import "../chunk-UMNXCU3K.js";
 import "../chunk-SOYOYGWY.js";
 import "../chunk-ZWN3AODA.js";

package/dist/adapters/security-headers.d.ts

@@ -1,6 +1,6 @@
 export { g as generateNonce } from '../nonce-BXt7Qu_C.js';
-import { S as SecurityHeadersConfig } from '../security-headers-Ccj7ncNx.js';
-export { b as buildSecurityHeaders } from '../security-headers-Ccj7ncNx.js';
+import { S as SecurityHeadersConfig } from '../security-headers-C2cByfJn.js';
+export { b as buildSecurityHeaders } from '../security-headers-C2cByfJn.js';
 
 /**
  * The security headers a deployed target puts on its responses.

package/dist/adapters/security-headers.js

@@ -1,6 +1,6 @@
 import {
   buildSecurityHeaders
-} from "../chunk-IRQGAC4L.js";
+} from "../chunk-5GZROLDV.js";
 import {
   generateNonce
 } from "../chunk-Z4PJMZLM.js";

package/dist/{agent-X7RDENTI.js → agent-L45EZWPV.js}

@@ -3,8 +3,8 @@ import "tsx/esm";
 import {
   agentCommand,
   createAgentSsrLoader
-} from "./chunk-MWPC7EOR.js";
-import "./chunk-35QIWOHT.js";
+} from "./chunk-YXEKPMDK.js";
+import "./chunk-WFIAYPBH.js";
 import "./chunk-5NNFO7R7.js";
 import "./chunk-Z7CJHDLS.js";
 import "./chunk-3QPVEJ7D.js";
@@ -12,4 +12,4 @@ export {
   agentCommand,
   createAgentSsrLoader
 };
-//# sourceMappingURL=agent-X7RDENTI.js.map
+//# sourceMappingURL=agent-L45EZWPV.js.map

package/dist/{app-typed-client-F3YLMV4N.js → app-typed-client-B7QIRDSP.js}

@@ -1,14 +1,14 @@
 import {
   scanControllerModules
-} from "./chunk-WOANPZBT.js";
-import "./chunk-M357ILK5.js";
-import "./chunk-BPYMC7SU.js";
-import "./chunk-IRQGAC4L.js";
-import "./chunk-JW5UFKQ3.js";
+} from "./chunk-Q3UE7WIM.js";
+import "./chunk-H2X5T45M.js";
+import "./chunk-EYRWD2AB.js";
+import "./chunk-5GZROLDV.js";
+import "./chunk-5AGNZXHJ.js";
 import "./chunk-P6OS7652.js";
 import "./chunk-ZDUO4IYN.js";
 import "./chunk-D4VP2QPR.js";
-import "./chunk-YN4W7LCX.js";
+import "./chunk-ENRT6DAU.js";
 import "./chunk-47FFT43U.js";
 import "./chunk-NTDN54XO.js";
 import "./chunk-PVNMLZ5G.js";
@@ -28,7 +28,7 @@ import {
 import "./chunk-V6Y2SMRG.js";
 import "./chunk-ACKBVBUI.js";
 import "./chunk-IZ3TIL6K.js";
-import "./chunk-CF2DNN5R.js";
+import "./chunk-45XETXSG.js";
 import "./chunk-YSJOZEI6.js";
 import "./chunk-Z4PJMZLM.js";
 import "./chunk-UMNXCU3K.js";
@@ -427,4 +427,4 @@ export {
   generateClientDts,
   shouldReemitForFile
 };
-//# sourceMappingURL=app-typed-client-F3YLMV4N.js.map
+//# sourceMappingURL=app-typed-client-B7QIRDSP.js.map

package/dist/{app-typed-client-BE4LZPK2.js → app-typed-client-GVP4V4X3.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import "tsx/esm";
-import "./chunk-IF7CZXPW.js";
-import "./chunk-35QIWOHT.js";
+import "./chunk-KVZQJ3ZM.js";
+import "./chunk-WFIAYPBH.js";
 import {
   scanControllerModules
 } from "./chunk-L4TB6FXQ.js";
-import "./chunk-RPET332G.js";
+import "./chunk-VV2VU3LJ.js";
 import "./chunk-5VLP3GQ2.js";
 import "./chunk-C27VRUVN.js";
 import "./chunk-7UZZHCRN.js";
@@ -411,4 +411,4 @@ export {
   generateClientDts,
   shouldReemitForFile
 };
-//# sourceMappingURL=app-typed-client-BE4LZPK2.js.map
+//# sourceMappingURL=app-typed-client-GVP4V4X3.js.map

package/dist/{aws-lambda-VKMYUMP2.js → aws-lambda-2R77AV5F.js}

@@ -7,11 +7,11 @@ import {
   deployedTraceFragment,
   describeDeployedSecurityHeaders,
   renderSecurityHeadersConfigLiteral
-} from "./chunk-E43VJ3E5.js";
+} from "./chunk-VPX3MS5D.js";
 import {
   nodeAdapter
 } from "./chunk-KI4DOTN4.js";
-import "./chunk-RPET332G.js";
+import "./chunk-VV2VU3LJ.js";
 import {
   assertServicesUnsupported,
   readManifest
@@ -258,4 +258,4 @@ export {
   renderAwsLambdaEntry,
   responseToLambdaResultV2
 };
-//# sourceMappingURL=aws-lambda-VKMYUMP2.js.map
+//# sourceMappingURL=aws-lambda-2R77AV5F.js.map

package/dist/{build-H2UDKBV7.js → build-22OMF3NG.js}

@@ -3,7 +3,7 @@ import "tsx/esm";
 import {
   describeControllerArtifacts,
   emitControllerArtifacts
-} from "./chunk-KZ3PXNPT.js";
+} from "./chunk-MIPHNT4J.js";
 import {
   validateProjectStructure
 } from "./chunk-GEQJAFSV.js";
@@ -34,14 +34,14 @@ import {
 } from "./chunk-Z7CJHDLS.js";
 import {
   loadConfig
-} from "./chunk-HA35FS7U.js";
+} from "./chunk-FFS7IRZF.js";
 import {
   loadEnv
 } from "./chunk-3QPVEJ7D.js";
 import {
   importUserModule
 } from "./chunk-U5PWXS3J.js";
-import "./chunk-4OTIXAUY.js";
+import "./chunk-TMQ52AZR.js";
 import {
   buildManifest,
   writeManifest
@@ -554,7 +554,7 @@ async function buildCommand(options) {
 `);
 }
 async function runAdapterBuild(target, config, cwd) {
-  const { theoPluginAsync } = await import("./vite-plugin-TU3HQA43.js");
+  const { theoPluginAsync } = await import("./vite-plugin-37OQ5RDR.js");
   const { default: react } = await import("@vitejs/plugin-react");
   const ctx = {
     // `react()` may return Plugin or Plugin[] depending on version; spread the
@@ -603,7 +603,7 @@ async function runAdapterBuild(target, config, cwd) {
       };
     }
   };
-  const { resolveAdapter } = await import("./registry-3LUHO4IB.js");
+  const { resolveAdapter } = await import("./registry-APCN3PSJ.js");
   const adapter = await resolveAdapter(target);
   const { warnUnappliedConfig, assertRateLimitEnforceable } = await import("./config-support-O4REYSK5.js");
   assertRateLimitEnforceable(config, adapter, target);
@@ -676,4 +676,4 @@ function relativize3(absPath, root) {
 export {
   buildCommand
 };
-//# sourceMappingURL=build-H2UDKBV7.js.map
+//# sourceMappingURL=build-22OMF3NG.js.map

package/dist/{bun-POLTY2HK.js → bun-MAAG4MKW.js}

@@ -11,11 +11,11 @@ import {
   deployedTraceFragment,
   describeDeployedSecurityHeaders,
   renderSecurityHeadersConfigLiteral
-} from "./chunk-E43VJ3E5.js";
+} from "./chunk-VPX3MS5D.js";
 import {
   nodeAdapter
 } from "./chunk-KI4DOTN4.js";
-import "./chunk-RPET332G.js";
+import "./chunk-VV2VU3LJ.js";
 import {
   assertServicesUnsupported,
   readManifest
@@ -343,4 +343,4 @@ export {
   bunAdapter,
   renderBunEntry
 };
-//# sourceMappingURL=bun-POLTY2HK.js.map
+//# sourceMappingURL=bun-MAAG4MKW.js.map

package/dist/{chunk-CF2DNN5R.js → chunk-45XETXSG.js}

@@ -16,6 +16,7 @@ var DEFAULT_REGISTRY = [
     name: "openrouter",
     envKey: "OPENROUTER_API_KEY",
     baseUrl: "https://openrouter.ai/api/v1",
+    gateway: true,
     priority: 1
   },
   {
@@ -84,6 +85,13 @@ function declaredPrefixOf(modelId) {
   if (slash <= 0) return void 0;
   return modelId.slice(0, slash);
 }
+function gatewayHint(declared, modelId, registered) {
+  const gateway = registered.find(
+    (p) => p.gateway === true && p.name !== declared.name && p.envKey !== void 0 && (process.env[p.envKey] ?? "").length > 0
+  );
+  if (gateway?.envKey === void 0) return `, or change the model's provider prefix`;
+  return `, or use "${gateway.name}/${modelId}" to route it through ${gateway.name} (${gateway.envKey} is set, and ${gateway.name} serves this model id)`;
+}
 function takesCredential(desc) {
   return desc.envKey !== void 0;
 }
@@ -102,7 +110,7 @@ function resolveProvider(modelId, options) {
       return { name: declared.name, apiKey, baseUrl: baseUrlOf(declared) };
     }
     throw new Error(
-      `Model "${modelId}" declares provider "${declared.name}", but ${declared.envKey} is not set. Set ${declared.envKey}, or change the model's provider prefix.`
+      `Model "${modelId}" declares provider "${declared.name}", but ${declared.envKey} is not set. Set ${declared.envKey}${gatewayHint(declared, modelId, sorted)}.`
     );
   }
   const unregisteredPrefix = declared === void 0 ? declaredPrefixOf(modelId) : void 0;
@@ -144,4 +152,4 @@ export {
   resolveProvider,
   tryResolveProvider
 };
-//# sourceMappingURL=chunk-CF2DNN5R.js.map
+//# sourceMappingURL=chunk-45XETXSG.js.map

package/dist/chunk-45XETXSG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/_internal/process-singleton.ts","../src/server/agent/provider-resolver.ts"],"mappings":";AAgCA,IAAM,YAAY;AASX,SAAS,iBAAmC,KAAa,SAAqB;AACnF,QAAM,OAAO,uBAAO,IAAI,YAAY,GAAG;AACvC,QAAM,OAAO;AAEb,QAAM,WAAW,KAAK,IAAI;AAC1B,MAAI,aAAa,OAAW,QAAO;AAEnC,QAAM,UAAU,QAAQ;AACxB,OAAK,IAAI,IAAI;AACb,SAAO;AACT;;;ACuDA,IAAM,mBAAyC;AAAA,EAC7C;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAME,MAAM;AAAA,IACN,SAAS;AAAA,IACT,YAAY;AAAA,IACZ,UAAU;AAAA,EACZ;AACF;AAYA,SAAS,aAAmC;AAC1C,SAAO,iBAAiB,qBAAqB,MAAM,CAAC,GAAG,gBAAgB,CAAC;AAC1E;AAUA,IAAM,YAAY,oBAAI,IAAY;AA2B3B,SAAS,iBAAiB,YAAsC;AAErE,QAAM,WAAW,WAAW;AAC5B,QAAM,MAAM,SAAS,UAAU,CAAC,MAAM,EAAE,SAAS,WAAW,IAAI;AAChE,MAAI,OAAO,EAAG,UAAS,GAAG,IAAI;AAAA,MACzB,UAAS,KAAK,UAAU;AAC/B;AAOO,SAAS,wBAA8B;AAC5C,QAAM,WAAW,WAAW;AAC5B,WAAS,SAAS;AAClB,WAAS,KAAK,GAAG,gBAAgB;AACnC;AAOO,SAAS,gBAA+C;AAC7D,SAAO,CAAC,GAAG,WAAW,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,EAAE,QAAQ;AACjE;AASA,SAAS,SACP,MACA,KACA,SACM;AACN,MAAI,UAAU,IAAI,KAAK,IAAI,EAAG;AAC9B,YAAU,IAAI,KAAK,IAAI;AACvB,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,OAAO,sBAAsB,KAAK,IAAI,KAAK,GAAG,YAAY,MAAM,YAAY,UAAU,IAAI,CAAC;AACjG,MAAI,SAAS,SAAU,SAAQ,SAAS,IAAI;AAAA,MAIvC,SAAQ,KAAK,IAAI;AACxB;AAQA,SAAS,UAAU,MAAkC;AACnD,MAAI,KAAK,eAAe,OAAW,QAAO,KAAK;AAC/C,QAAM,WAAW,QAAQ,IAAI,KAAK,UAAU;AAC5C,SAAO,aAAa,UAAa,SAAS,SAAS,IAAI,WAAW,KAAK;AACzE;AAaA,SAAS,WACP,SACA,YACgC;AAChC,QAAM,SAAS,iBAAiB,OAAO;AACvC,MAAI,WAAW,OAAW,QAAO;AACjC,SAAO,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,MAAM;AACjD;AASA,SAAS,iBAAiB,SAAiD;AACzE,MAAI,YAAY,OAAW,QAAO;AAClC,QAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,MAAI,SAAS,EAAG,QAAO;AACvB,SAAO,QAAQ,MAAM,GAAG,KAAK;AAC/B;AAaA,SAAS,YACP,UACA,SACA,YACQ;AACR,QAAM,UAAU,WAAW;AAAA,IACzB,CAAC,MACC,EAAE,YAAY,QACd,EAAE,SAAS,SAAS,QACpB,EAAE,WAAW,WACZ,QAAQ,IAAI,EAAE,MAAM,KAAK,IAAI,SAAS;AAAA,EAC3C;AACA,MAAI,SAAS,WAAW,OAAW,QAAO;AAC1C,SACE,aAAa,QAAQ,IAAI,IAAI,OAAO,yBAAyB,QAAQ,IAAI,KACrE,QAAQ,MAAM,gBAAgB,QAAQ,IAAI;AAElD;AAKA,SAAS,gBAAgB,MAAwD;AAC/E,SAAO,KAAK,WAAW;AACzB;AA+BA,IAAM,kBAAkB;AAEjB,SAAS,gBAAgB,SAAkB,SAA4C;AAC5F,QAAM,SAAS,CAAC,GAAG,WAAW,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,EAAE,QAAQ;AAEvE,QAAM,WAAW,YAAY,SAAY,SAAY,WAAW,SAAS,MAAM;AAC/E,MAAI,aAAa,UAAa,YAAY,QAAW;AACnD,QAAI,SAAS,WAAW,QAAW;AACjC,eAAS,UAAU,yBAAyB,OAAO;AACnD,aAAO,EAAE,MAAM,SAAS,MAAM,QAAQ,iBAAiB,SAAS,UAAU,QAAQ,EAAE;AAAA,IACtF;AACA,UAAM,SAAS,QAAQ,IAAI,SAAS,MAAM;AAC1C,QAAI,UAAU,OAAO,SAAS,GAAG;AAC/B,eAAS,UAAU,yBAAyB,OAAO;AACnD,aAAO,EAAE,MAAM,SAAS,MAAM,QAAQ,SAAS,UAAU,QAAQ,EAAE;AAAA,IACrE;AAOA,UAAM,IAAI;AAAA,MACR,UAAU,OAAO,wBAAwB,SAAS,IAAI,UAAU,SAAS,MAAM,oBACtE,SAAS,MAAM,GAAG,YAAY,UAAU,SAAS,MAAM,CAAC;AAAA,IACnE;AAAA,EACF;AAcA,QAAM,qBAAqB,aAAa,SAAY,iBAAiB,OAAO,IAAI;AAChF,MAAI,uBAAuB,QAAW;AACpC,UAAM,IAAI;AAAA,MACR,UAAU,OAAO,OAAO,CAAC,wBAAwB,kBAAkB,qDACxC,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC,gDACf,kBAAkB;AAAA,IACpE;AAAA,EACF;AAIA,QAAM,eAAe,OAAO,OAAO,eAAe;AAElD,aAAW,QAAQ,cAAc;AAC/B,UAAM,SAAS,QAAQ,IAAI,KAAK,MAAM;AACtC,QAAI,UAAU,OAAO,SAAS,GAAG;AAC/B,eAAS,MAAM,mBAAmB,OAAO;AACzC,aAAO;AAAA,QACL,MAAM,KAAK;AAAA,QACX;AAAA,QACA,SAAS,UAAU,IAAI;AAAA,MACzB;AAAA,IACF;AAAA,EACF;AAQA,QAAM,UAAU,aAAa,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,MAAM;AAC7D,QAAM,IAAI;AAAA,IACR,6DAA6D,OAAO;AAAA,EAEtE;AACF;AAQO,SAAS,mBAAmB,SAA2C;AAC5E,MAAI;AACF,WAAO,gBAAgB,OAAO;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/{chunk-KQ27YDLG.js → chunk-4BQIJ4HE.js}

@@ -1,10 +1,10 @@
 import {
   validateRouteInput
-} from "./chunk-JW5UFKQ3.js";
+} from "./chunk-5AGNZXHJ.js";
 import {
   evaluateRoutePolicy,
   subjectFromContext
-} from "./chunk-YN4W7LCX.js";
+} from "./chunk-ENRT6DAU.js";
 
 // src/server/http/error-pages.ts
 import { closeSync, fstatSync, openSync, readFileSync } from "node:fs";
@@ -270,4 +270,4 @@ export {
   callProcedure,
   createOpenApiHandler
 };
-//# sourceMappingURL=chunk-KQ27YDLG.js.map
+//# sourceMappingURL=chunk-4BQIJ4HE.js.map

package/dist/{chunk-JW5UFKQ3.js → chunk-5AGNZXHJ.js}

@@ -12,7 +12,7 @@ import {
 import {
   evaluateRoutePolicy,
   subjectFromContext
-} from "./chunk-YN4W7LCX.js";
+} from "./chunk-ENRT6DAU.js";
 import {
   DuplicateContextKeyError,
   createOutbox,
@@ -1702,4 +1702,4 @@ export {
   createCorsHandler,
   createCorsWebHandler
 };
-//# sourceMappingURL=chunk-JW5UFKQ3.js.map
+//# sourceMappingURL=chunk-5AGNZXHJ.js.map

package/dist/{chunk-IRQGAC4L.js → chunk-5GZROLDV.js}

@@ -1,5 +1,5 @@
 // src/core/contracts/security-headers.ts
-var DEFAULT_CSP = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' ws: wss:; frame-ancestors 'none'; report-uri /__theo/csp-report";
+var DEFAULT_CSP = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; media-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' ws: wss:; frame-ancestors 'none'; report-uri /__theo/csp-report";
 var DEFAULT_PERMISSIONS_POLICY = "geolocation=(), camera=(), microphone=(), payment=(), usb=(), accelerometer=(), gyroscope=()";
 var DEFAULT_HSTS = "max-age=31536000; includeSubDomains";
 function applyNonceToCsp(policy, nonce) {
@@ -49,4 +49,4 @@ export {
   DEFAULT_PERMISSIONS_POLICY,
   buildSecurityHeaders
 };
-//# sourceMappingURL=chunk-IRQGAC4L.js.map
+//# sourceMappingURL=chunk-5GZROLDV.js.map

package/dist/{chunk-IRQGAC4L.js.map → chunk-5GZROLDV.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/core/contracts/security-headers.ts"],"mappings":";AAyDO,IAAM,cACX;AAsBK,IAAM,6BACX;AAyDF,IAAM,eAAe;AAOrB,SAAS,gBAAgB,QAAgB,OAAuB;AAC9D,SAAO,OACJ,MAAM,GAAG,EACT,IAAI,CAAC,cAAc;AAClB,UAAM,UAAU,UAAU,KAAK;AAC/B,QAAI,CAAC,QAAQ,WAAW,YAAY,EAAG,QAAO;AAC9C,QAAI,QAAQ,SAAS,iBAAiB,GAAG;AACvC,aAAO,UAAU,QAAQ,mBAAmB,UAAU,KAAK,GAAG;AAAA,IAChE;AACA,WAAO,GAAG,SAAS,WAAW,KAAK;AAAA,EACrC,CAAC,EACA,KAAK,GAAG;AACb;AAWA,SAAS,SACP,KACA,QACA,gBACM;AACN,MAAI,OAAO,QAAQ,SAAS,OAAO,YAAY,MAAO;AACtD,MAAI,SAAS,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM;AAC3D,MAAI,gBAAgB;AAClB,aAAS,gBAAgB,QAAQ,cAAc;AAAA,EACjD;AAEA,QAAM,OAAgB,OAAO,WAAW;AACxC,MAAI,SAAS,WAAW;AACtB,QAAI,yBAAyB,IAAI;AAAA,EACnC,OAAO;AACL,QAAI,qCAAqC,IAAI;AAAA,EAC/C;AACF;AAMO,SAAS,qBACd,QACA,KACA,UAAkC,CAAC,GACX;AACxB,QAAM,MAA8B,CAAC;AAIrC,QAAM,iBAAiB,QAAQ,YAAY,SAAY,QAAQ;AAE/D,WAAS,KAAK,QAAQ,cAAc;AAGpC,MAAI,iBAAiB,IAAI,OAAO,gBAAgB;AAGhD,MAAI,wBAAwB,IAAI,OAAO,sBAAsB;AAG7D,MAAI,iBAAiB,IAAI,OAAO,kBAAkB;AAIlD,MAAI,OAAO,sBAAsB,OAAO;AACtC,QAAI,oBAAoB,IACtB,OAAO,OAAO,sBAAsB,WAChC,OAAO,oBACP;AAAA,EACR;AAGA,MAAI,IAAI,cAAc,OAAO,SAAS,OAAO;AAC3C,QAAI,2BAA2B,IAAI,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;AAAA,EACrF;AAQA,MAAI,gBAAgB;AAClB,QAAI,eAAe,IAAI;AAAA,EACzB;AAEA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/core/contracts/security-headers.ts"],"mappings":";AA8DO,IAAM,cACX;AAuBK,IAAM,6BACX;AAyDF,IAAM,eAAe;AAOrB,SAAS,gBAAgB,QAAgB,OAAuB;AAC9D,SAAO,OACJ,MAAM,GAAG,EACT,IAAI,CAAC,cAAc;AAClB,UAAM,UAAU,UAAU,KAAK;AAC/B,QAAI,CAAC,QAAQ,WAAW,YAAY,EAAG,QAAO;AAC9C,QAAI,QAAQ,SAAS,iBAAiB,GAAG;AACvC,aAAO,UAAU,QAAQ,mBAAmB,UAAU,KAAK,GAAG;AAAA,IAChE;AACA,WAAO,GAAG,SAAS,WAAW,KAAK;AAAA,EACrC,CAAC,EACA,KAAK,GAAG;AACb;AAWA,SAAS,SACP,KACA,QACA,gBACM;AACN,MAAI,OAAO,QAAQ,SAAS,OAAO,YAAY,MAAO;AACtD,MAAI,SAAS,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM;AAC3D,MAAI,gBAAgB;AAClB,aAAS,gBAAgB,QAAQ,cAAc;AAAA,EACjD;AAEA,QAAM,OAAgB,OAAO,WAAW;AACxC,MAAI,SAAS,WAAW;AACtB,QAAI,yBAAyB,IAAI;AAAA,EACnC,OAAO;AACL,QAAI,qCAAqC,IAAI;AAAA,EAC/C;AACF;AAMO,SAAS,qBACd,QACA,KACA,UAAkC,CAAC,GACX;AACxB,QAAM,MAA8B,CAAC;AAIrC,QAAM,iBAAiB,QAAQ,YAAY,SAAY,QAAQ;AAE/D,WAAS,KAAK,QAAQ,cAAc;AAGpC,MAAI,iBAAiB,IAAI,OAAO,gBAAgB;AAGhD,MAAI,wBAAwB,IAAI,OAAO,sBAAsB;AAG7D,MAAI,iBAAiB,IAAI,OAAO,kBAAkB;AAIlD,MAAI,OAAO,sBAAsB,OAAO;AACtC,QAAI,oBAAoB,IACtB,OAAO,OAAO,sBAAsB,WAChC,OAAO,oBACP;AAAA,EACR;AAGA,MAAI,IAAI,cAAc,OAAO,SAAS,OAAO;AAC3C,QAAI,2BAA2B,IAAI,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;AAAA,EACrF;AAQA,MAAI,gBAAgB;AAClB,QAAI,eAAe,IAAI;AAAA,EACzB;AAEA,SAAO;AACT;","names":[]}

package/dist/{chunk-6YRZWT5X.js → chunk-6R6UR64X.js}

@@ -12,7 +12,7 @@ import {
   serveMatchedAuxRoute,
   serveThroughPluginLifecycle,
   setupSsrDevMiddleware
-} from "./chunk-VJRPOUKM.js";
+} from "./chunk-L2NSHQOY.js";
 import {
   resolveTheoRootDir
 } from "./chunk-FDOOBTXJ.js";
@@ -38,11 +38,11 @@ import {
   mountAgent,
   readAgentPolicy,
   writeWebResponseToServerResponse
-} from "./chunk-IF7CZXPW.js";
+} from "./chunk-KVZQJ3ZM.js";
 import {
   getApprovalRegistry,
   resolveProvider
-} from "./chunk-35QIWOHT.js";
+} from "./chunk-WFIAYPBH.js";
 import {
   createWebRequestSource,
   dispatchControllerRequest,
@@ -68,7 +68,7 @@ import {
 } from "./chunk-NO6HA4FG.js";
 import {
   loadConfig
-} from "./chunk-HA35FS7U.js";
+} from "./chunk-FFS7IRZF.js";
 import {
   buildServicesProxyConfig
 } from "./chunk-ZNZISJDZ.js";
@@ -2179,19 +2179,19 @@ async function theoPluginAsync(rootOrOptions) {
       })
     );
   }
-  const { appTypedClientPlugin } = await import("./app-typed-client-BE4LZPK2.js");
+  const { appTypedClientPlugin } = await import("./app-typed-client-GVP4V4X3.js");
   const appClientPlugin = appTypedClientPlugin({
     cwd: projectRoot,
     serverDir: serverDirAbs,
     distDir: resolve5(projectRoot, ".theokit")
   });
-  const { actionsVirtualModule } = await import("./actions-virtual-module-YQBEDNHN.js");
+  const { actionsVirtualModule } = await import("./actions-virtual-module-XI5IGBF4.js");
   const actionsPlugin = actionsVirtualModule({
     serverDir: serverDirAbs,
     distDir: resolve5(projectRoot, ".theokit")
   });
   const { agentsTypedClientPlugin } = await import("./agents-typed-client-D4OA2TXB.js");
-  const { generateManifest } = await import("./internal-api-4FBFRQ4G.js");
+  const { generateManifest } = await import("./internal-api-QKWTQ2Q7.js");
   const agentsClientPlugin = agentsTypedClientPlugin({
     projectRoot,
     agentsDir: agentsDirName,
@@ -2208,7 +2208,7 @@ async function theoPluginAsync(rootOrOptions) {
   const controllerTransformPlugin = controllerSwcTransformPlugin({
     serverDir: serverDirAbs
   });
-  const { serverOnlyImportBoundary } = await import("./server-boundary-CJIXOPCF.js");
+  const { serverOnlyImportBoundary } = await import("./server-boundary-7BRS2CWI.js");
   const serverBoundaryPlugin = serverOnlyImportBoundary({
     projectRoot,
     serverDir: serverDirAbs
@@ -2383,4 +2383,4 @@ export {
   theoPluginAsync,
   theoPlugin
 };
-//# sourceMappingURL=chunk-6YRZWT5X.js.map
+//# sourceMappingURL=chunk-6R6UR64X.js.map

package/dist/{chunk-YN4W7LCX.js → chunk-ENRT6DAU.js}

@@ -1,6 +1,11 @@
 // src/core/contracts/route-policy.ts
 function subjectFromContext(context) {
   if (context === null || typeof context !== "object") return null;
+  if (typeof context.getRequest === "function" && !("subject" in context)) {
+    throw new TypeError(
+      "subjectFromContext was given a controller ExecutionContext, which carries no subject \u2014 it would answer null for every caller and a guard built on that denies everyone. Read the subject from the request instead (e.g. your session manager over `context.getRequest()`), or use `@Public()` when the route is genuinely open."
+    );
+  }
   const candidate = context.subject;
   if (candidate === null || candidate === void 0 || typeof candidate !== "object") return null;
   const id = candidate.id;
@@ -28,4 +33,4 @@ export {
   evaluateRoutePolicy,
   requireOwner
 };
-//# sourceMappingURL=chunk-YN4W7LCX.js.map
+//# sourceMappingURL=chunk-ENRT6DAU.js.map

package/dist/chunk-ENRT6DAU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/contracts/route-policy.ts"],"mappings":";AAyDO,SAAS,mBAAmB,SAAuC;AACxE,MAAI,YAAY,QAAQ,OAAO,YAAY,SAAU,QAAO;AAI5D,MACE,OAAQ,QAAqC,eAAe,cAC5D,EAAE,aAAa,UACf;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IAIF;AAAA,EACF;AACA,QAAM,YAAa,QAAkC;AACrD,MAAI,cAAc,QAAQ,cAAc,UAAa,OAAO,cAAc,SAAU,QAAO;AAC3F,QAAM,KAAM,UAA+B;AAC3C,SAAO,OAAO,OAAO,YAAY,GAAG,SAAS,IAAK,YAA6B;AACjF;AAoBA,eAAsB,oBACpB,QACA,OACyB;AACzB,MAAI,WAAW,OAAW,QAAO,EAAE,SAAS,KAAK;AACjD,MAAI,WAAW,SAAU,QAAO,EAAE,SAAS,KAAK;AAEhD,QAAM,UAAU,MAAM,OAAO,KAAK;AAClC,MAAI,OAAO,YAAY,WAAW;AAChC,WAAO,UAAU,EAAE,SAAS,KAAK,IAAI,EAAE,SAAS,OAAO,QAAQ,gCAAgC;AAAA,EACjG;AACA,SAAO;AACT;AASO,SAAS,aACd,SACA,SACgB;AAChB,MAAI,YAAY,KAAM,QAAO,EAAE,SAAS,OAAO,QAAQ,oBAAoB;AAC3E,MAAI,OAAO,YAAY,YAAY,QAAQ,WAAW,GAAG;AAIvD,WAAO,EAAE,SAAS,OAAO,QAAQ,iCAAiC;AAAA,EACpE;AACA,SAAO,QAAQ,OAAO,UAClB,EAAE,SAAS,KAAK,IAChB,EAAE,SAAS,OAAO,QAAQ,qCAAqC;AACrE;","names":[]}

package/dist/{chunk-BPYMC7SU.js → chunk-EYRWD2AB.js}

@@ -1,6 +1,6 @@
 import {
   buildSecurityHeaders
-} from "./chunk-IRQGAC4L.js";
+} from "./chunk-5GZROLDV.js";
 import {
   safeAudit
 } from "./chunk-AVQU5CQF.js";
@@ -359,4 +359,4 @@ export {
   CsrfReadinessStore,
   applySecurityHeaders
 };
-//# sourceMappingURL=chunk-BPYMC7SU.js.map
+//# sourceMappingURL=chunk-EYRWD2AB.js.map

package/dist/{chunk-HA35FS7U.js → chunk-FFS7IRZF.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-U5PWXS3J.js";
 import {
   theoConfigSchema
-} from "./chunk-4OTIXAUY.js";
+} from "./chunk-TMQ52AZR.js";
 
 // src/config/load-config.ts
 import { existsSync } from "fs";
@@ -110,4 +110,4 @@ export {
   deepMerge,
   loadConfig
 };
-//# sourceMappingURL=chunk-HA35FS7U.js.map
+//# sourceMappingURL=chunk-FFS7IRZF.js.map

package/dist/{chunk-M357ILK5.js → chunk-H2X5T45M.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-P6OS7652.js";
 import {
   evaluateRoutePolicy
-} from "./chunk-YN4W7LCX.js";
+} from "./chunk-ENRT6DAU.js";
 import {
   createObservabilityPlugin,
   requestTrace,
@@ -15,7 +15,7 @@ import {
 } from "./chunk-ZDCCILMP.js";
 import {
   processSingleton
-} from "./chunk-CF2DNN5R.js";
+} from "./chunk-45XETXSG.js";
 import {
   newSpanId,
   newTraceId
@@ -805,4 +805,4 @@ export {
   parseAgentRequestBody,
   mountAgent
 };
-//# sourceMappingURL=chunk-M357ILK5.js.map
+//# sourceMappingURL=chunk-H2X5T45M.js.map

package/dist/{chunk-GO7UWJ47.js → chunk-KPZ2JSAU.js}

@@ -233,7 +233,8 @@ function stripe(opts) {
   };
 }
 
-// src/server/webhook/providers/github.ts
+// src/server/webhook/providers/hub-signature-256.ts
+var HEADER = "x-hub-signature-256";
 var PREFIX = "sha256=";
 function fromHex2(hex) {
   if (hex.length % 2 !== 0) return null;
@@ -245,43 +246,39 @@ function fromHex2(hex) {
   }
   return bytes;
 }
-function github(opts) {
-  const secrets = Array.isArray(opts.secret) ? opts.secret : [opts.secret];
+function verifyHubSignature256(secrets) {
   return async (req) => {
-    const header = req.headers.get("x-hub-signature-256");
-    if (!header) {
-      return { ok: false, reason: "missing x-hub-signature-256 header" };
-    }
+    const header = req.headers.get(HEADER);
+    if (!header) return { ok: false, reason: `missing ${HEADER} header` };
     if (!header.startsWith(PREFIX)) {
-      return { ok: false, reason: "malformed x-hub-signature-256 header (missing sha256= prefix)" };
+      return { ok: false, reason: `malformed ${HEADER} header (missing ${PREFIX} prefix)` };
     }
-    const sigHex = header.slice(PREFIX.length);
-    const sigBytes = fromHex2(sigHex);
-    if (!sigBytes) {
-      return { ok: false, reason: "malformed signature hex" };
-    }
-    const rawBody = await req.text();
-    const enc2 = new TextEncoder();
-    const bodyBytes = enc2.encode(rawBody);
+    const signature = fromHex2(header.slice(PREFIX.length));
+    if (!signature) return { ok: false, reason: "malformed signature hex" };
+    const encoder = new TextEncoder();
+    const body = encoder.encode(await req.text());
+    let matched = false;
     for (const secret of secrets) {
       const key = await globalThis.crypto.subtle.importKey(
         "raw",
-        enc2.encode(secret),
+        encoder.encode(secret),
         { name: "HMAC", hash: "SHA-256" },
         false,
         ["sign"]
       );
-      const sigBuf = await globalThis.crypto.subtle.sign("HMAC", key, bodyBytes);
-      const expectedBytes = new Uint8Array(sigBuf);
-      if (sigBytes.length !== expectedBytes.length) continue;
-      if (timingSafeEqual(sigBytes, expectedBytes)) {
-        return { ok: true };
-      }
+      const expected = new Uint8Array(await globalThis.crypto.subtle.sign("HMAC", key, body));
+      if (signature.length !== expected.length) continue;
+      if (timingSafeEqual(signature, expected)) matched = true;
     }
-    return { ok: false, reason: "signature mismatch" };
+    return matched ? { ok: true } : { ok: false, reason: "signature mismatch" };
   };
 }
 
+// src/server/webhook/providers/github.ts
+function github(opts) {
+  return verifyHubSignature256(Array.isArray(opts.secret) ? opts.secret : [opts.secret]);
+}
+
 // src/server/webhook/providers/slack.ts
 var PREFIX2 = "v0=";
 function fromHex3(hex) {
@@ -405,6 +402,34 @@ function discord(opts) {
   };
 }
 
+// src/server/webhook/providers/whatsapp.ts
+function whatsapp(opts) {
+  return verifyHubSignature256(
+    Array.isArray(opts.appSecret) ? opts.appSecret : [opts.appSecret]
+  );
+}
+function whatsappSubscribe(opts) {
+  const encoder = new TextEncoder();
+  const expected = encoder.encode(opts.verifyToken);
+  return (req) => {
+    const params = new URL(req.url).searchParams;
+    if (params.get("hub.mode") !== "subscribe") {
+      return { ok: false, reason: `hub.mode must be 'subscribe'` };
+    }
+    const presented = params.get("hub.verify_token");
+    if (presented === null) return { ok: false, reason: "missing hub.verify_token" };
+    const got = encoder.encode(presented);
+    if (got.length !== expected.length || !timingSafeEqual(got, expected)) {
+      return { ok: false, reason: "hub.verify_token mismatch" };
+    }
+    const challenge = params.get("hub.challenge");
+    if (challenge === null || challenge.length === 0) {
+      return { ok: false, reason: "missing hub.challenge" };
+    }
+    return { ok: true, challenge };
+  };
+}
+
 export {
   timingSafeEqual,
   DEFAULT_MAX_BODY_BYTES,
@@ -416,6 +441,8 @@ export {
   github,
   slack,
   telegram,
-  discord
+  discord,
+  whatsapp,
+  whatsappSubscribe
 };
-//# sourceMappingURL=chunk-GO7UWJ47.js.map
+//# sourceMappingURL=chunk-KPZ2JSAU.js.map