theokit 0.59.0 → 0.61.0

package/dist/{internal-api-4FBFRQ4G.js → internal-api-QKWTQ2Q7.js}

@@ -16,10 +16,10 @@ import {
   handleCspReport,
   handleCsrfReadiness,
   mountAgent
-} from "./chunk-IF7CZXPW.js";
+} from "./chunk-KVZQJ3ZM.js";
 import {
   resolveProvider
-} from "./chunk-35QIWOHT.js";
+} from "./chunk-WFIAYPBH.js";
 import {
   dispatchControllerRequest,
   incomingMessageToHandlerRequest,
@@ -27,7 +27,7 @@ import {
 } from "./chunk-L4TB6FXQ.js";
 import {
   generateNonce
-} from "./chunk-RPET332G.js";
+} from "./chunk-VV2VU3LJ.js";
 import {
   TRACE_HEADER,
   extractTraceId
@@ -87,4 +87,4 @@ export {
   scanWebSocketRoutes,
   sendError
 };
-//# sourceMappingURL=internal-api-4FBFRQ4G.js.map
+//# sourceMappingURL=internal-api-QKWTQ2Q7.js.map

package/dist/{internal-api-W5RURFU7.js → internal-api-VRUDDBEG.js}

@@ -1,17 +1,17 @@
 import {
   dispatchControllerRequest
-} from "./chunk-WOANPZBT.js";
+} from "./chunk-Q3UE7WIM.js";
 import {
   mountAgent
-} from "./chunk-M357ILK5.js";
+} from "./chunk-H2X5T45M.js";
 import {
   CSP_REPORT_PATH,
   CsrfReadinessStore,
   applySecurityHeaders,
   handleCspReport,
   handleCsrfReadiness
-} from "./chunk-BPYMC7SU.js";
-import "./chunk-IRQGAC4L.js";
+} from "./chunk-EYRWD2AB.js";
+import "./chunk-5GZROLDV.js";
 import {
   BATCH_PATH,
   createCorsHandler,
@@ -20,11 +20,11 @@ import {
   handleBatchRequest,
   incomingMessageToHandlerRequest,
   sendError
-} from "./chunk-JW5UFKQ3.js";
+} from "./chunk-5AGNZXHJ.js";
 import "./chunk-P6OS7652.js";
 import "./chunk-ZDUO4IYN.js";
 import "./chunk-D4VP2QPR.js";
-import "./chunk-YN4W7LCX.js";
+import "./chunk-ENRT6DAU.js";
 import "./chunk-47FFT43U.js";
 import {
   findSuggestion
@@ -64,7 +64,7 @@ import "./chunk-ACKBVBUI.js";
 import "./chunk-IZ3TIL6K.js";
 import {
   resolveProvider
-} from "./chunk-CF2DNN5R.js";
+} from "./chunk-45XETXSG.js";
 import "./chunk-YSJOZEI6.js";
 import {
   generateNonce
@@ -107,4 +107,4 @@ export {
   scanWebSocketRoutes,
   sendError
 };
-//# sourceMappingURL=internal-api-W5RURFU7.js.map
+//# sourceMappingURL=internal-api-VRUDDBEG.js.map

package/dist/{load-config-BKUAMGO5.js → load-config-VMKOV44Y.js}

@@ -3,14 +3,14 @@ import "tsx/esm";
 import {
   deepMerge,
   loadConfig
-} from "./chunk-HA35FS7U.js";
+} from "./chunk-FFS7IRZF.js";
 import "./chunk-3QPVEJ7D.js";
 import "./chunk-U5PWXS3J.js";
-import "./chunk-4OTIXAUY.js";
+import "./chunk-TMQ52AZR.js";
 import "./chunk-ZNZISJDZ.js";
 import "./chunk-OSBGZYXZ.js";
 export {
   deepMerge,
   loadConfig
 };
-//# sourceMappingURL=load-config-BKUAMGO5.js.map
+//# sourceMappingURL=load-config-VMKOV44Y.js.map

package/dist/{mcp-I5HCW4QF.js → mcp-WMZSXQQG.js}

@@ -2,12 +2,12 @@
 import "tsx/esm";
 import {
   createAgentSsrLoader
-} from "./chunk-MWPC7EOR.js";
+} from "./chunk-YXEKPMDK.js";
 import {
   extractAppResources,
   handleMcpJsonRpc
 } from "./chunk-2CVV6CNN.js";
-import "./chunk-35QIWOHT.js";
+import "./chunk-WFIAYPBH.js";
 import {
   scanAgents
 } from "./chunk-5NNFO7R7.js";
@@ -46,7 +46,7 @@ async function serveMcpStdio(mod, name, appResources, streams) {
 // src/cli/commands/mcp.ts
 async function mcpCommand(name, deps = {}) {
   const projectRoot = deps.projectRoot ?? process.cwd();
-  const agentsDir = deps.agentsDir ?? (await (await import("./load-config-BKUAMGO5.js")).loadConfig(projectRoot)).agentsDir;
+  const agentsDir = deps.agentsDir ?? (await (await import("./load-config-VMKOV44Y.js")).loadConfig(projectRoot)).agentsDir;
   const agent = scanAgents(projectRoot, agentsDir).find((a) => a.name === name);
   if (!agent) {
     const names = scanAgents(projectRoot, agentsDir).map((a) => a.name).join(", ");
@@ -75,4 +75,4 @@ async function mcpCommand(name, deps = {}) {
 export {
   mcpCommand
 };
-//# sourceMappingURL=mcp-I5HCW4QF.js.map
+//# sourceMappingURL=mcp-WMZSXQQG.js.map

package/dist/{netlify-C2IRCZKI.js → netlify-BJQGPMGY.js}

@@ -7,13 +7,13 @@ import {
   deployedTraceFragment,
   describeDeployedSecurityHeaders,
   renderSecurityHeadersConfigLiteral
-} from "./chunk-E43VJ3E5.js";
+} from "./chunk-VPX3MS5D.js";
 import {
   nodeAdapter
 } from "./chunk-KI4DOTN4.js";
 import {
   buildSecurityHeaders
-} from "./chunk-RPET332G.js";
+} from "./chunk-VV2VU3LJ.js";
 import {
   assertServicesUnsupported,
   readManifest
@@ -242,4 +242,4 @@ export {
   netlifyAdapter,
   renderNetlifyFunction
 };
-//# sourceMappingURL=netlify-C2IRCZKI.js.map
+//# sourceMappingURL=netlify-BJQGPMGY.js.map

package/dist/{openapi-WDX3XX2J.js → openapi-SKKXWFX4.js}

@@ -12,10 +12,10 @@ import "./chunk-NO6HA4FG.js";
 import "./chunk-Z7CJHDLS.js";
 import {
   loadConfig
-} from "./chunk-HA35FS7U.js";
+} from "./chunk-FFS7IRZF.js";
 import "./chunk-3QPVEJ7D.js";
 import "./chunk-U5PWXS3J.js";
-import "./chunk-4OTIXAUY.js";
+import "./chunk-TMQ52AZR.js";
 import "./chunk-ZNZISJDZ.js";
 import "./chunk-OSBGZYXZ.js";
 
@@ -84,4 +84,4 @@ function emitOpenApiInMemory(manifest, config) {
 export {
   openapiCommand
 };
-//# sourceMappingURL=openapi-WDX3XX2J.js.map
+//# sourceMappingURL=openapi-SKKXWFX4.js.map

package/dist/{preview-PWGO5LUE.js → preview-GUEKVBGL.js}

@@ -4,8 +4,8 @@ import "tsx/esm";
 // src/cli/commands/preview.ts
 async function defaultSteps() {
   const [{ buildCommand }, { startCommand }] = await Promise.all([
-    import("./build-H2UDKBV7.js"),
-    import("./start-KEWSYVVU.js")
+    import("./build-22OMF3NG.js"),
+    import("./start-AKMBT3DW.js")
   ]);
   return {
     build: (opts) => buildCommand(opts),
@@ -20,4 +20,4 @@ async function previewCommand(options = {}, steps) {
 export {
   previewCommand
 };
-//# sourceMappingURL=preview-PWGO5LUE.js.map
+//# sourceMappingURL=preview-GUEKVBGL.js.map

package/dist/{provider-resolver-VS61zqsw.d.ts → provider-resolver-1aWi_WSz.d.ts}

@@ -60,6 +60,23 @@ interface ProviderDescriptor {
      * contradicts the real one is a debugging trap rather than a harmless inaccuracy.
      */
     baseUrlEnv?: string;
+    /**
+     * True when this provider is a GATEWAY — it serves other providers' catalogs under their own
+     * model ids, reachable by prefixing its name (`openrouter/openai/gpt-4o-mini`).
+     *
+     * It changes nothing about resolution. It exists so the refusal below can name a model id that
+     * would work instead of only the variable that is missing (#554): a scaffold shipping
+     * `openai/gpt-4o-mini` and an `.env.example` asking for `OPENROUTER_API_KEY` produced an error
+     * naming `OPENAI_API_KEY` — the one key the reader was never told to get — while the key they had
+     * serves that exact id through the gateway.
+     *
+     * Deliberately NOT a licence to substitute. Every caller here takes `.apiKey` and discards
+     * `.baseUrl`; the SDK picks the endpoint from the model id (measured: `openai/gpt-4o-mini` →
+     * `api.openai.com`, `openrouter/openai/gpt-4o-mini` → `openrouter.ai`). Handing an OpenRouter key
+     * to a request bound for OpenAI is #326 exactly, so the caller changes the id and the routing
+     * follows — the framework does not change it for them.
+     */
+    gateway?: boolean;
     /** Resolution priority (lower = higher priority). FIRST match wins. */
     priority: number;
 }

package/dist/{registry-3LUHO4IB.js → registry-APCN3PSJ.js}

@@ -4,13 +4,13 @@ import "tsx/esm";
 // src/adapters/registry.ts
 var adapterRegistry = {
   node: async () => (await import("./node-OSVPYQ3D.js")).nodeAdapter,
-  vercel: async () => (await import("./vercel-BMCQKCWE.js")).vercelAdapter,
-  cloudflare: async () => (await import("./cloudflare-SIG42OIW.js")).cloudflareAdapter,
+  vercel: async () => (await import("./vercel-BEDGUVXX.js")).vercelAdapter,
+  cloudflare: async () => (await import("./cloudflare-F5DNYH4B.js")).cloudflareAdapter,
   static: async () => (await import("./static-SVDWIOXJ.js")).staticAdapter,
-  bun: async () => (await import("./bun-POLTY2HK.js")).bunAdapter,
-  "deno-deploy": async () => (await import("./deno-deploy-LQAYOOPW.js")).denoDeployAdapter,
-  netlify: async () => (await import("./netlify-C2IRCZKI.js")).netlifyAdapter,
-  "aws-lambda": async () => (await import("./aws-lambda-VKMYUMP2.js")).awsLambdaAdapter,
+  bun: async () => (await import("./bun-MAAG4MKW.js")).bunAdapter,
+  "deno-deploy": async () => (await import("./deno-deploy-47E7GIME.js")).denoDeployAdapter,
+  netlify: async () => (await import("./netlify-BJQGPMGY.js")).netlifyAdapter,
+  "aws-lambda": async () => (await import("./aws-lambda-2R77AV5F.js")).awsLambdaAdapter,
   "theo-cloud": async () => (await import("./theo-cloud-3ET4G5T6.js")).theoCloudAdapter
 };
 async function resolveAdapter(target) {
@@ -20,4 +20,4 @@ async function resolveAdapter(target) {
 export {
   resolveAdapter
 };
-//# sourceMappingURL=registry-3LUHO4IB.js.map
+//# sourceMappingURL=registry-APCN3PSJ.js.map

package/dist/{route-config-Cm_ZMA1C.d.ts → route-config-B7FaTSby.d.ts}

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { R as RoutePolicy } from './route-policy-BxOycCDq.js';
+import { R as RoutePolicy } from './route-policy-BHXQDzBF.js';
 
 /**
  * core/contracts/route-config.ts

package/dist/{route-policy-BxOycCDq.d.ts → route-policy-BHXQDzBF.d.ts}

@@ -32,7 +32,26 @@ interface RoutePolicyInput<TQuery = unknown, TBody = unknown, TParams = unknown>
  * like a route nobody thought about (ADR 0001 section Consequences, Risks).
  */
 type RoutePolicy<TQuery = unknown, TBody = unknown, TParams = unknown> = 'public' | ((input: RoutePolicyInput<TQuery, TBody, TParams>) => boolean | AccessDecision | Promise<boolean | AccessDecision>);
-/** Narrow a run-context to the subject it carries, if it carries one. */
+/**
+ * Narrow a RUN-CONTEXT to the subject it carries, if it carries one.
+ *
+ * The argument is the object `server/context.ts` builds — the one with `subject` on it. It is NOT a
+ * controller guard's `ExecutionContext`, and telling a caller so is the whole reason for the throw
+ * below (usetheokit/theokit#574).
+ *
+ * An `ExecutionContext` carries `getRequest`, `getUrl`, `getClass` and `getMethodName` and nothing
+ * else, so this function used to answer `null` for it — indistinguishable from "an anonymous
+ * caller". A guard written as `subjectFromContext(context) !== null` therefore denied EVERYONE, and
+ * passed the only test aimed at it, because that test asserted an unauthenticated request is
+ * refused. A guard that always denies is indistinguishable from a working one until somebody tries
+ * to get in.
+ *
+ * That is a silent, fail-CLOSED defect, which is the worst combination: nothing errors, nothing
+ * logs, and the failure looks like the feature. `error-handling.md` § 2 is unambiguous here — fail
+ * fast, fail loud, and never return a magic value for a caller mistake.
+ *
+ * @throws TypeError when handed an `ExecutionContext` instead of a run-context.
+ */
 declare function subjectFromContext(context: unknown): RouteSubject | null;
 /**
  * Evaluate a route policy. THE single implementation - the HTTP executors and

package/dist/{routes-A2YLFEYC.js → routes-ECCDRHXZ.js}

@@ -11,10 +11,10 @@ import {
 import "./chunk-Z7CJHDLS.js";
 import {
   loadConfig
-} from "./chunk-HA35FS7U.js";
+} from "./chunk-FFS7IRZF.js";
 import "./chunk-3QPVEJ7D.js";
 import "./chunk-U5PWXS3J.js";
-import "./chunk-4OTIXAUY.js";
+import "./chunk-TMQ52AZR.js";
 import "./chunk-ZNZISJDZ.js";
 import "./chunk-OSBGZYXZ.js";
 
@@ -64,4 +64,4 @@ async function routesCommand() {
 export {
   routesCommand
 };
-//# sourceMappingURL=routes-A2YLFEYC.js.map
+//# sourceMappingURL=routes-ECCDRHXZ.js.map

package/dist/{schema-WKTNTGX6.js → schema-ND7GHPQK.js}

@@ -2,7 +2,7 @@
 import "tsx/esm";
 import {
   theoConfigSchema
-} from "./chunk-4OTIXAUY.js";
+} from "./chunk-TMQ52AZR.js";
 import "./chunk-ZNZISJDZ.js";
 import {
   cacheSchema,
@@ -17,4 +17,4 @@ export {
   storageSchema,
   theoConfigSchema
 };
-//# sourceMappingURL=schema-WKTNTGX6.js.map
+//# sourceMappingURL=schema-ND7GHPQK.js.map

package/dist/{security-headers-Ccj7ncNx.d.ts → security-headers-C2cByfJn.d.ts}

@@ -45,6 +45,11 @@
  *                                         in animation directives
  *   - img-src 'self' data: blob:      — supports inline data URIs, blobs
  *                                         from canvas exports
+ *   - media-src 'self' data: blob:    — same reasoning for audio/video the app
+ *                                         generated itself. Absent until #553:
+ *                                         `<audio>` fell back to default-src
+ *                                         and a blob: from plugin-voice's TTS
+ *                                         was blocked in the browser
  *   - font-src 'self' data:           — Geist fonts inline-base64
  *   - connect-src 'self' ws: wss:     — WebSocket dev HMR + agent streams
  *   - frame-ancestors 'none'          — clickjacking defense

package/dist/server/agent/index.d.ts

@@ -3,8 +3,8 @@ import { C as CustomTool } from '../../define-agent-tool-aYYLpMeo.js';
 import { AcpTransport } from '@theokit/agents';
 export { InProcessApprovalRequest, InProcessApprovalRequiredError, InProcessAwaitApproval, StreamAgentTurnDeps, StreamAgentTurnInProcessInput, streamAgentTurnInProcess } from '@theokit/agents';
 import { CustomTool as CustomTool$1 } from '@theokit/sdk';
-import { V as VerifyFn } from '../../webhook-types-DGIjjcaI.js';
-export { P as ProviderDescriptor, R as ResolvedProvider, l as listProviders, a as registerProvider, b as resetProviderRegistry, r as resolveProvider, t as tryResolveProvider } from '../../provider-resolver-VS61zqsw.js';
+import { V as VerifyFn, S as SubscribeFn } from '../../whatsapp-D_Fnl1LX.js';
+export { P as ProviderDescriptor, R as ResolvedProvider, l as listProviders, a as registerProvider, b as resetProviderRegistry, r as resolveProvider, t as tryResolveProvider } from '../../provider-resolver-1aWi_WSz.js';
 
 /**
  * M26 (ADR-0041) — `createWorkflowTool`: wrap an SDK `Workflow` as a `CustomTool`.
@@ -218,6 +218,19 @@ interface ChannelMessage {
 interface ChannelWebhookConfig {
     /** Per-platform signature validators (e.g. `{ slack: slack({...}), telegram: telegram({...}) }`). */
     validators: Record<string, VerifyFn>;
+    /**
+     * Per-platform responders for the GET a platform sends to VERIFY the endpoint before it will
+     * subscribe it (e.g. `{ whatsapp: whatsappSubscribe({ verifyToken }) }`).
+     *
+     * Separate from `validators` because it answers a different question at a different moment: a
+     * validator authenticates a delivery, this authenticates a subscription request, and a platform
+     * may need one, both, or neither. Per-platform rather than a bare `verifyToken` on this config,
+     * because the query parameters are Meta's — shared with Instagram and Messenger, not universal —
+     * and putting them here would bake one platform's shape into the seam (#556).
+     *
+     * A platform with no entry answers 405 on a GET: the route exists and does not do that.
+     */
+    subscribe?: Record<string, SubscribeFn>;
     /** Handoff seam — wire the SDK gateway / agent here. Invoked only after signature validation. */
     onMessage: (message: ChannelMessage) => void | Promise<void>;
 }
@@ -226,6 +239,8 @@ interface ChannelWebhookConfig {
  *   404 UNKNOWN_PLATFORM — no validator configured for `<platform>`
  *   400 BAD_REQUEST      — path is not a channel webhook, or the body is not JSON
  *   401 INVALID_SIGNATURE — the platform signature check failed (negative case)
+ *   405 SUBSCRIBE_UNSUPPORTED — a GET on a platform that declared no `subscribe` responder
+ *   200 `<challenge>`    — subscribe handshake accepted (text/plain, per Meta's requirement)
  *   200 { ok: true }     — validated + handed to `onMessage`
  */
 declare function handleChannelWebhook(request: Request, urlPath: string, config: ChannelWebhookConfig): Promise<Response>;

package/dist/server/agent/index.js

@@ -12,7 +12,7 @@ import {
   parseChannelPath,
   serveMcpStdio,
   streamAgentTurnInProcess
-} from "../../chunk-IJER2SYS.js";
+} from "../../chunk-OH32SN46.js";
 import "../../chunk-DVUJLMTF.js";
 import {
   buildResourceDescriptors,
@@ -26,7 +26,7 @@ import {
   resetProviderRegistry,
   resolveProvider,
   tryResolveProvider
-} from "../../chunk-CF2DNN5R.js";
+} from "../../chunk-45XETXSG.js";
 import "../../chunk-XTHN6JBX.js";
 export {
   CodeModePermissionDeniedError,

package/dist/server/define/index.d.ts

@@ -1,12 +1,13 @@
-import { R as RouteConfig } from '../../route-config-Cm_ZMA1C.js';
+import { R as RouteConfig } from '../../route-config-B7FaTSby.js';
 import { z } from 'zod';
 import { W as WebSocketHandler, b as WebSocketLike } from '../../define-websocket-DzPn1sR6.js';
 export { a as WebSocketHandlerWeb } from '../../define-websocket-DzPn1sR6.js';
 import { b as ToolTransform, C as CustomTool } from '../../define-agent-tool-aYYLpMeo.js';
 export { D as DefineAgentToolSpec, T as ToolContextMessage, a as ToolHandlerContext, c as applyTransform } from '../../define-agent-tool-aYYLpMeo.js';
-import { R as RoutePolicy } from '../../route-policy-BxOycCDq.js';
-export { A as AccessDecision, b as RoutePolicyInput, a as RouteSubject, e as evaluateRoutePolicy, r as requireOwner, s as subjectFromContext } from '../../route-policy-BxOycCDq.js';
+import { R as RoutePolicy } from '../../route-policy-BHXQDzBF.js';
+export { A as AccessDecision, b as RoutePolicyInput, a as RouteSubject, e as evaluateRoutePolicy, r as requireOwner, s as subjectFromContext } from '../../route-policy-BHXQDzBF.js';
 import { c as OnRequestHook, f as PreHandlerHook, d as OnResponseHook, O as OnErrorHook, T as TheoPlugin } from '../../plugin-types-BUVfUQ0V.js';
+export { b as HookName, P as PluginContext, e as PluginErrorContext } from '../../plugin-types-BUVfUQ0V.js';
 import { WireChunk } from '@theokit/presenter/wire';
 import { IncomingMessage } from 'node:http';
 export { H as HEALTH_PATH, a as HealthRouteConfig, b as READY_PATH, c as ReadyRouteConfig, d as ReservedResponse, R as ReservedRoutes, e as defineHealthRoute, f as defineReadyRoute, s as serveReservedRoute } from '../../health-route-C0hk64_U.js';
@@ -402,4 +403,4 @@ interface WebChannelHandler<TMessage = unknown> {
  */
 declare function defineWebChannel<TMessage = unknown>(handler: WebChannelHandler<TMessage>): WebChannelHandler<TMessage>;
 
-export { type ActionAccept, type ActionBuilder, type ActionConfig, type ChannelHandler, CustomTool, type MiddlewareBuilder, type MiddlewareHandler, type PluginBuilder, type RouteBuilder, RouteConfig, RoutePolicy, type ToolBuilder, ToolTransform, type WebChannelHandler, type WebSocketBuilder, WebSocketHandler, WebSocketLike, action, defineChannel, defineWebChannel, middleware, plugin, route, tool, uiMessageStreamResponse, websocket };
+export { type ActionAccept, type ActionBuilder, type ActionConfig, type ChannelHandler, CustomTool, type MiddlewareBuilder, type MiddlewareHandler, OnErrorHook, OnRequestHook, OnResponseHook, type PluginBuilder, PreHandlerHook, type RouteBuilder, RouteConfig, RoutePolicy, TheoPlugin, type ToolBuilder, ToolTransform, type WebChannelHandler, type WebSocketBuilder, WebSocketHandler, WebSocketLike, action, defineChannel, defineWebChannel, middleware, plugin, route, tool, uiMessageStreamResponse, websocket };

package/dist/server/define/index.js

@@ -14,7 +14,7 @@ import {
   evaluateRoutePolicy,
   requireOwner,
   subjectFromContext
-} from "../../chunk-YN4W7LCX.js";
+} from "../../chunk-ENRT6DAU.js";
 import {
   HEALTH_PATH,
   READY_PATH,

package/dist/server/http/index.d.ts

@@ -1,4 +1,4 @@
-export { B as BATCH_PATH, a as BatchExecuteFn, b as BatchPathConflictError, c as BatchPayload, d as BatchRequestItem, e as BatchResponse, f as BatchResultItem, C as CookieOptions, h as CorsConfig, i as CorsHandler, j as CorsOrigin, k as CorsWebHandler, l as CustomErrorPages, E as ExecuteActionOptions, m as ExecuteRouteContext, F as FileTooLargeError, H as HandleBatchOptions, M as MAX_ERROR_HTML_BYTES, n as MiddlewareResult, N as NotFoundError, p as ProcedureInputError, q as ProcedureOutputError, S as STRIPPED_HEADERS, u as SendErrorInput, v as SendErrorOptions, T as TRACE_HEADER, w as TRACE_PARENT_HEADER, x as TheoError, W as W3CTraceContext, _ as _resetMiddlewareCacheForTests, z as appendCookieToHeaders, A as appendDeleteCookieToHeaders, D as callProcedure, G as createCorsHandler, I as createCorsWebHandler, J as createOpenApiHandler, K as createServerContext, L as deleteCookie, Q as envelopeCodeToStatus, V as executeAction, X as executeRoute, Y as executeWebRequest, Z as extractTraceId, $ as extractTraceIdFromRequest, a0 as extractW3CTraceContext, a1 as fromUnknown, a2 as getCookie, a3 as getCookieFromRequest, a4 as handleBatchRequest, a5 as handleRequestError, a6 as handleWebRequestError, a7 as jsonTransformer, a8 as loadCustomErrorPages, a9 as matchesOrigin, aa as parseCookieHeader, ab as parseRequestBody, ac as parseTraceparent, ad as parseTraceparentContext, ae as resolveTransformer, af as runMiddlewareAndContext, ag as sendError, ah as sendJson, ai as serializeCookie, aj as serveStaticFile, ak as serverErrorToEnvelope, al as setCookie, am as superjsonTransformer, an as validateRouteInput } from '../../index-ADEV6pen.js';
+export { B as BATCH_PATH, a as BatchExecuteFn, b as BatchPathConflictError, c as BatchPayload, d as BatchRequestItem, e as BatchResponse, f as BatchResultItem, C as CookieOptions, h as CorsConfig, i as CorsHandler, j as CorsOrigin, k as CorsWebHandler, l as CustomErrorPages, E as ExecuteActionOptions, m as ExecuteRouteContext, F as FileTooLargeError, H as HandleBatchOptions, M as MAX_ERROR_HTML_BYTES, n as MiddlewareResult, N as NotFoundError, p as ProcedureInputError, q as ProcedureOutputError, S as STRIPPED_HEADERS, u as SendErrorInput, v as SendErrorOptions, T as TRACE_HEADER, w as TRACE_PARENT_HEADER, x as TheoError, W as W3CTraceContext, _ as _resetMiddlewareCacheForTests, z as appendCookieToHeaders, A as appendDeleteCookieToHeaders, D as callProcedure, G as createCorsHandler, I as createCorsWebHandler, J as createOpenApiHandler, K as createServerContext, L as deleteCookie, Q as envelopeCodeToStatus, V as executeAction, X as executeRoute, Y as executeWebRequest, Z as extractTraceId, $ as extractTraceIdFromRequest, a0 as extractW3CTraceContext, a1 as fromUnknown, a2 as getCookie, a3 as getCookieFromRequest, a4 as handleBatchRequest, a5 as handleRequestError, a6 as handleWebRequestError, a7 as jsonTransformer, a8 as loadCustomErrorPages, a9 as matchesOrigin, aa as parseCookieHeader, ab as parseRequestBody, ac as parseTraceparent, ad as parseTraceparentContext, ae as resolveTransformer, af as runMiddlewareAndContext, ag as sendError, ah as sendJson, ai as serializeCookie, aj as serveStaticFile, ak as serverErrorToEnvelope, al as setCookie, am as superjsonTransformer, an as validateRouteInput } from '../../index-BXGSBlxf.js';
 export { A as ActionError, b as ActionInputError, f as extractUniversalIssues, i as isActionError, d as isInputError } from '../../action-protocol-tGm3NKRg.js';
 import '../../error-envelope-DG47lt8E.js';
 import 'node:http';
@@ -10,5 +10,5 @@ import 'vite';
 import '../../csrf-Dgot9qSM.js';
 import '../../audit-log-BQWM5YLG.js';
 import 'zod';
-import '../../route-config-Cm_ZMA1C.js';
-import '../../route-policy-BxOycCDq.js';
+import '../../route-config-B7FaTSby.js';
+import '../../route-policy-BHXQDzBF.js';

package/dist/server/http/index.js

@@ -6,7 +6,7 @@ import {
   createOpenApiHandler,
   loadCustomErrorPages,
   serveStaticFile
-} from "../../chunk-KQ27YDLG.js";
+} from "../../chunk-4BQIJ4HE.js";
 import {
   jsonTransformer,
   resolveTransformer,
@@ -31,7 +31,7 @@ import {
   sendError,
   sendJson,
   validateRouteInput
-} from "../../chunk-JW5UFKQ3.js";
+} from "../../chunk-5AGNZXHJ.js";
 import "../../chunk-P6OS7652.js";
 import {
   ActionError,
@@ -41,7 +41,7 @@ import {
   isInputError
 } from "../../chunk-ZDUO4IYN.js";
 import "../../chunk-D4VP2QPR.js";
-import "../../chunk-YN4W7LCX.js";
+import "../../chunk-ENRT6DAU.js";
 import "../../chunk-47FFT43U.js";
 import {
   FileTooLargeError,

package/dist/server/index.d.ts

@@ -1,16 +1,17 @@
-import { R as RouteConfig } from '../route-config-Cm_ZMA1C.js';
+import { R as RouteConfig } from '../route-config-B7FaTSby.js';
 export { ActionAccept, ActionBuilder, ActionConfig, ChannelHandler, MiddlewareBuilder, MiddlewareHandler, PluginBuilder, RouteBuilder, ToolBuilder, WebChannelHandler, WebSocketBuilder, action, defineChannel, defineWebChannel, middleware, plugin, route, tool, uiMessageStreamResponse, websocket } from './define/index.js';
 export { W as WebSocketHandler, a as WebSocketHandlerWeb, b as WebSocketLike } from '../define-websocket-DzPn1sR6.js';
 export { C as CustomTool, D as DefineAgentToolSpec, T as ToolContextMessage, a as ToolHandlerContext, b as ToolTransform, c as applyTransform } from '../define-agent-tool-aYYLpMeo.js';
-export { A as AccessDecision, R as RoutePolicy, b as RoutePolicyInput, a as RouteSubject, e as evaluateRoutePolicy, r as requireOwner, s as subjectFromContext } from '../route-policy-BxOycCDq.js';
+export { A as AccessDecision, R as RoutePolicy, b as RoutePolicyInput, a as RouteSubject, e as evaluateRoutePolicy, r as requireOwner, s as subjectFromContext } from '../route-policy-BHXQDzBF.js';
+export { b as HookName, H as HookResult, O as OnErrorHook, c as OnRequestHook, d as OnResponseHook, P as PluginContext, e as PluginErrorContext, f as PreHandlerHook, R as RunHookOptions, a as TheoApp, T as TheoPlugin } from '../plugin-types-BUVfUQ0V.js';
 export { H as HEALTH_PATH, a as HealthRouteConfig, b as READY_PATH, c as ReadyRouteConfig, d as ReservedResponse, R as ReservedRoutes, e as defineHealthRoute, f as defineReadyRoute, s as serveReservedRoute } from '../health-route-C0hk64_U.js';
-export { B as BATCH_PATH, a as BatchExecuteFn, b as BatchPathConflictError, c as BatchPayload, d as BatchRequestItem, e as BatchResponse, f as BatchResultItem, g as BodyParserOptions, C as CookieOptions, h as CorsConfig, i as CorsHandler, j as CorsOrigin, k as CorsWebHandler, l as CustomErrorPages, E as ExecuteActionOptions, m as ExecuteRouteContext, F as FileTooLargeError, H as HandleBatchOptions, M as MAX_ERROR_HTML_BYTES, n as MiddlewareResult, N as NotFoundError, O as OpenApiDocsOptions, P as ParsedBody, o as ProcedureInput, p as ProcedureInputError, q as ProcedureOutputError, R as RawRouteInput, r as RouteInputChannel, s as RouteInputSchemas, t as RouteInputValidation, S as STRIPPED_HEADERS, u as SendErrorInput, v as SendErrorOptions, T as TRACE_HEADER, w as TRACE_PARENT_HEADER, x as TheoError, y as TheoTransformer, U as UploadedFile, W as W3CTraceContext, _ as _resetMiddlewareCacheForTests, z as appendCookieToHeaders, A as appendDeleteCookieToHeaders, D as callProcedure, G as createCorsHandler, I as createCorsWebHandler, J as createOpenApiHandler, K as createServerContext, L as deleteCookie, Q as envelopeCodeToStatus, V as executeAction, X as executeRoute, Y as executeWebRequest, Z as extractTraceId, $ as extractTraceIdFromRequest, a0 as extractW3CTraceContext, a1 as fromUnknown, a2 as getCookie, a3 as getCookieFromRequest, a4 as handleBatchRequest, a5 as handleRequestError, a6 as handleWebRequestError, a7 as jsonTransformer, a8 as loadCustomErrorPages, a9 as matchesOrigin, aa as parseCookieHeader, ab as parseRequestBody, ac as parseTraceparent, ad as parseTraceparentContext, ae as resolveTransformer, af as runMiddlewareAndContext, ag as sendError, ah as sendJson, ai as serializeCookie, aj as serveStaticFile, ak as serverErrorToEnvelope, al as setCookie, am as superjsonTransformer, an as validateRouteInput } from '../index-ADEV6pen.js';
+export { B as BATCH_PATH, a as BatchExecuteFn, b as BatchPathConflictError, c as BatchPayload, d as BatchRequestItem, e as BatchResponse, f as BatchResultItem, g as BodyParserOptions, C as CookieOptions, h as CorsConfig, i as CorsHandler, j as CorsOrigin, k as CorsWebHandler, l as CustomErrorPages, E as ExecuteActionOptions, m as ExecuteRouteContext, F as FileTooLargeError, H as HandleBatchOptions, M as MAX_ERROR_HTML_BYTES, n as MiddlewareResult, N as NotFoundError, O as OpenApiDocsOptions, P as ParsedBody, o as ProcedureInput, p as ProcedureInputError, q as ProcedureOutputError, R as RawRouteInput, r as RouteInputChannel, s as RouteInputSchemas, t as RouteInputValidation, S as STRIPPED_HEADERS, u as SendErrorInput, v as SendErrorOptions, T as TRACE_HEADER, w as TRACE_PARENT_HEADER, x as TheoError, y as TheoTransformer, U as UploadedFile, W as W3CTraceContext, _ as _resetMiddlewareCacheForTests, z as appendCookieToHeaders, A as appendDeleteCookieToHeaders, D as callProcedure, G as createCorsHandler, I as createCorsWebHandler, J as createOpenApiHandler, K as createServerContext, L as deleteCookie, Q as envelopeCodeToStatus, V as executeAction, X as executeRoute, Y as executeWebRequest, Z as extractTraceId, $ as extractTraceIdFromRequest, a0 as extractW3CTraceContext, a1 as fromUnknown, a2 as getCookie, a3 as getCookieFromRequest, a4 as handleBatchRequest, a5 as handleRequestError, a6 as handleWebRequestError, a7 as jsonTransformer, a8 as loadCustomErrorPages, a9 as matchesOrigin, aa as parseCookieHeader, ab as parseRequestBody, ac as parseTraceparent, ad as parseTraceparentContext, ae as resolveTransformer, af as runMiddlewareAndContext, ag as sendError, ah as sendJson, ai as serializeCookie, aj as serveStaticFile, ak as serverErrorToEnvelope, al as setCookie, am as superjsonTransformer, an as validateRouteInput } from '../index-BXGSBlxf.js';
 export { A as ActionError, a as ActionErrorCode, b as ActionInputError, e as ActionManifestEntry, c as ActionResult, S as SerializedActionResult, U as UniversalZodIssue, f as extractUniversalIssues, i as isActionError, d as isInputError } from '../action-protocol-tGm3NKRg.js';
 export { ACTION_SCHEMAS_DIR, ActionNode, ActionScanError, LoadedManifest, ManifestAction, ManifestAgent, ManifestRoute, ManifestWebSocket, TheoManifest, WebSocketRouteNode, _resetRouteScanCacheForTests, compareRouteSpecificity, generateManifest, loadManifest, scanMiddlewares, scanServerActions, scanServerActionsEnriched, scanServerRoutes, scanWebSocketRoutes, writeManifest } from './scan/index.js';
 export { L as LoadModule, S as ServerRouteNode, c as compilePattern, a as createProductionLoader, b as createViteLoader, m as matchRoute } from '../match-Dw4CNXJH.js';
 export { AcpToolConfig, AppResource, AppResourceInput, ChannelMessage, ChannelWebhookConfig, CodeModeApi, CodeModeConfig, CodeModePermission, CodeModePermissionDeniedError, McpResourceContents, McpResourceDescriptor, NodeAcpTransport, Sandbox, StdioStreams, VendorAgentClient, VendorAgentToolConfig, WorkflowLike, WorkflowToolConfig, buildResourceDescriptors, createACPTool, createCodeMode, createVendorAgentTool, createWorkflowTool, defineAppResource, extractAppResources, handleChannelWebhook, handleMcpStdioLine, isChannelPath, parseChannelPath, readAppResource, serveMcpStdio } from './agent/index.js';
 export { InProcessApprovalRequest, InProcessApprovalRequiredError, InProcessAwaitApproval, StreamAgentTurnDeps, StreamAgentTurnInProcessInput, streamAgentTurnInProcess } from '@theokit/agents';
-export { P as ProviderDescriptor, R as ResolvedProvider, l as listProviders, a as registerProvider, b as resetProviderRegistry, r as resolveProvider, t as tryResolveProvider } from '../provider-resolver-VS61zqsw.js';
+export { P as ProviderDescriptor, R as ResolvedProvider, l as listProviders, a as registerProvider, b as resetProviderRegistry, r as resolveProvider, t as tryResolveProvider } from '../provider-resolver-1aWi_WSz.js';
 export { AuthRequiredError, BackupCode, BackupCodeOptions, OidcMetadata, PkceChallenge, SessionConfig, SessionManager, SessionManagerWeb, SessionMeta, ThrottleOptions, ThrottleState, TotpAlgorithm, TotpOptions, TotpUriOptions, VerifyTotpOptions, _resetKeyCacheForTests, assertProductionSecret, checkThrottle, clearOidcCache, createSessionManager, createSessionManagerWeb, decrypt, discoverOidcProvider, encrypt, generateBackupCodes, generateOAuthState, generatePkceChallenge, generateTotp, generateTotpSecret, pkceChallengeFromVerifier, recordAttempt, requireAuth, rotateIfNeeded, rotateIfNeededWeb, totpUri, verifyBackupCode, verifyOAuthState, verifyTotp } from './auth/index.js';
 export { g as generateNonce } from '../nonce-BXt7Qu_C.js';
 export { InMemoryUsageStorage, ToolHookEvent, TrackAgentRunInput, TrackAgentRunOptions, TrackAgentToolsHooks, TrackAgentToolsOptions, trackAgentRun, trackAgentTools } from './cost/index.js';
@@ -34,12 +35,11 @@ export { P as PostgresFactory, R as RedisFactory, S as StorageManager, g as getS
 export { Db0Database, UnstorageInstance, useDatabase, useUnstorage } from './storage/index.js';
 export { G as GenericFactory, b as PoolLike, P as PostgresDatabaseConfig, d as RedisLike, R as RedisServerConfig, a as ServerConfig, S as StorageAdapter, c as StorageConfig, T as TlsConfig } from '../storage-types-CFGPFIdB.js';
 export { BodyTooLargeError, DEFAULT_MAX_BODY_BYTES, DiscordWebhookOptions, GitHubWebhookOptions, RawBodyResult, ReadRawBodyOptions, SlackWebhookOptions, StripeWebhookOptions, TelegramWebhookOptions, defineWebhook, discord, dispatchWebhook, github, readRawBody, slack, stripe, telegram, timingSafeEqual } from './webhook/index.js';
-export { D as DefineWebhookOptions, V as VerifyFn, a as VerifyResult, W as WebhookContext, b as WebhookDefinition } from '../webhook-types-DGIjjcaI.js';
+export { D as DefineWebhookOptions, S as SubscribeFn, a as SubscribeResult, V as VerifyFn, b as VerifyResult, W as WebhookContext, c as WebhookDefinition, d as WhatsAppSubscribeOptions, e as WhatsAppWebhookOptions, w as whatsapp, f as whatsappSubscribe } from '../whatsapp-D_Fnl1LX.js';
 import { z } from 'zod';
-export { b as HookName, H as HookResult, O as OnErrorHook, c as OnRequestHook, d as OnResponseHook, P as PluginContext, e as PluginErrorContext, f as PreHandlerHook, R as RunHookOptions, a as TheoApp, T as TheoPlugin } from '../plugin-types-BUVfUQ0V.js';
 export { ComposeInstructionsOptions, ComposedInstructions, ConfigLayer, ContextPressure, ContextPressureThresholdError, ContextPressureThresholds, CustomCommand, CustomCommandsResult, DEFAULT_CONTEXT_PRESSURE_THRESHOLDS, InstructionBlock, InstructionSource, InstructionTree, InstructionTreeBudget, LayerOutOfOrderError, LayeredConfig, LayeredConfigInput, LayeredConfigResult, LoadCustomCommandsInput, LoadInstructionTreeInput, ParsedFrontmatter, PrecedenceReport, ProvenancePerKey, TrustRecord, TrustStore, TrustStorePermissionsError, composeInstructions, contextPressure, effectiveContextWindow, frontmatterValue, loadCustomCommands, loadInstructionTree, splitFrontmatter } from '@theokit/agents/config';
 export { a as ServiceDefinition, S as ServicesConfig, b as ServicesConfigInput, c as ServicesConfigOutput } from '../schema-BdakLtuC.js';
-export { C as CspMode, D as DEFAULT_CSP, a as DEFAULT_PERMISSIONS_POLICY, c as SecurityEnv, S as SecurityHeadersConfig, d as SecurityHeadersOptions, b as buildSecurityHeaders } from '../security-headers-Ccj7ncNx.js';
+export { C as CspMode, D as DEFAULT_CSP, a as DEFAULT_PERMISSIONS_POLICY, c as SecurityEnv, S as SecurityHeadersConfig, d as SecurityHeadersOptions, b as buildSecurityHeaders } from '../security-headers-C2cByfJn.js';
 import '@theokit/presenter/wire';
 import 'node:http';
 import '../error-envelope-DG47lt8E.js';

package/dist/server/index.js

@@ -20,8 +20,10 @@ import {
   slack,
   stripe,
   telegram,
-  timingSafeEqual
-} from "../chunk-GO7UWJ47.js";
+  timingSafeEqual,
+  whatsapp,
+  whatsappSubscribe
+} from "../chunk-KPZ2JSAU.js";
 import {
   action,
   defineChannel,
@@ -41,7 +43,7 @@ import {
   createOpenApiHandler,
   loadCustomErrorPages,
   serveStaticFile
-} from "../chunk-KQ27YDLG.js";
+} from "../chunk-4BQIJ4HE.js";
 import {
   DuplicateJobNameError,
   InMemoryJobBackend,
@@ -85,12 +87,12 @@ import {
   handleCsrfReadinessRequest,
   normalizeLegacy,
   normalizeNew
-} from "../chunk-BPYMC7SU.js";
+} from "../chunk-EYRWD2AB.js";
 import {
   DEFAULT_CSP,
   DEFAULT_PERMISSIONS_POLICY,
   buildSecurityHeaders
-} from "../chunk-IRQGAC4L.js";
+} from "../chunk-5GZROLDV.js";
 import {
   jsonTransformer,
   resolveTransformer,
@@ -115,7 +117,7 @@ import {
   sendError,
   sendJson,
   validateRouteInput
-} from "../chunk-JW5UFKQ3.js";
+} from "../chunk-5AGNZXHJ.js";
 import {
   CSRF_WARN_CODE,
   CSRF_WARN_DOCS_URL,
@@ -136,7 +138,7 @@ import {
   evaluateRoutePolicy,
   requireOwner,
   subjectFromContext
-} from "../chunk-YN4W7LCX.js";
+} from "../chunk-ENRT6DAU.js";
 import {
   DuplicateContextKeyError,
   createOutbox,
@@ -244,7 +246,7 @@ import {
   parseChannelPath,
   serveMcpStdio,
   streamAgentTurnInProcess
-} from "../chunk-IJER2SYS.js";
+} from "../chunk-OH32SN46.js";
 import {
   applyTransform
 } from "../chunk-DVUJLMTF.js";
@@ -260,7 +262,7 @@ import {
   resetProviderRegistry,
   resolveProvider,
   tryResolveProvider
-} from "../chunk-CF2DNN5R.js";
+} from "../chunk-45XETXSG.js";
 import {
   AuthRequiredError,
   _resetKeyCacheForTests,
@@ -1392,6 +1394,8 @@ export {
   verifyTotp,
   warnOnce,
   websocket,
+  whatsapp,
+  whatsappSubscribe,
   writeCronManifest,
   writeJobManifest,
   writeManifest