theokit 0.60.0 → 0.61.0

package/dist/{chunk-XES7ZE2K.js → chunk-L2NSHQOY.js}

@@ -25,7 +25,7 @@ import {
   parseAgentRequestBody,
   readAgentPolicy,
   subjectFromContext
-} from "./chunk-GZ5YHD5H.js";
+} from "./chunk-KVZQJ3ZM.js";
 import {
   getApprovalRegistry
 } from "./chunk-WFIAYPBH.js";
@@ -867,4 +867,4 @@ export {
   applyNonceToInlineScripts,
   setupSsrDevMiddleware
 };
-//# sourceMappingURL=chunk-XES7ZE2K.js.map
+//# sourceMappingURL=chunk-L2NSHQOY.js.map

package/dist/{chunk-KZ3PXNPT.js → chunk-MIPHNT4J.js}

@@ -9,6 +9,7 @@ import "reflect-metadata";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { basename, dirname, join, relative, resolve } from "path";
 import { pathToFileURL } from "url";
+import { PUBLIC_ROUTE_METADATA } from "@theokit/http";
 import {
   CONTROLLER_PREFIX,
   ROUTE_METHODS,
@@ -84,7 +85,6 @@ function assertControllerPathsReachable(loaded) {
     throw new UnreachableControllerPathError(cls.name || "a controller", prefix, sourceFile);
   }
 }
-var PUBLIC_ROUTE_METADATA = "theokit:public";
 var UndeclaredControllerAccessError = class extends Error {
   constructor(controller, method, verb, file) {
     super(
@@ -102,7 +102,7 @@ var UndeclaredControllerAccessError = class extends Error {
         ``,
         `  Or state that it is open on purpose \u2014 a health check, an OAuth callback:`,
         ``,
-        `      @SetMetadata('${PUBLIC_ROUTE_METADATA}', true)`,
+        `      @Public()               // from '@theokit/http'`,
         ``,
         `  Both are declarations. What is refused is neither.`
       ].join("\n")
@@ -186,4 +186,4 @@ export {
   emitControllerArtifacts,
   describeControllerArtifacts
 };
-//# sourceMappingURL=chunk-KZ3PXNPT.js.map
+//# sourceMappingURL=chunk-MIPHNT4J.js.map

package/dist/chunk-MIPHNT4J.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/commands/build/emit-controllers.ts"],"sourcesContent":["import 'reflect-metadata'\n\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'\nimport { basename, dirname, join, relative, resolve } from 'node:path'\nimport { pathToFileURL } from 'node:url'\n\nimport { PUBLIC_ROUTE_METADATA } from '@theokit/http'\nimport {\n  CONTROLLER_PREFIX,\n  ROUTE_METHODS,\n  USE_GUARDS,\n  getMeta,\n  isControllerClass,\n  transformControllerSource,\n} from '@theokit/http'\n\nimport { findControllerFiles } from '../../../server/http/controller-dispatch.js'\n\n/**\n * theokit#123 — compile `server/controllers/**` into `dist` so production can serve them.\n *\n * ## Why production needed anything at all\n *\n * #122 made decorator controllers first-class in `theokit dev`, where a Vite `enforce:'pre'` swc\n * transform compiles them on the fly — parameter decorators (`@Body`/`@Param`/`@Query`) emit\n * metadata esbuild cannot produce. `theokit start` has no Vite and no transform, so an uncompiled\n * `.controller.ts` simply cannot load, and controller routes 404'd in production while working in\n * dev. That split is the whole issue.\n *\n * ## Why compile at BUILD time rather than load with swc at runtime\n *\n * `loadControllerWithSwc` would work in production and was the smaller diff. It is refused on\n * purpose: `@swc/core` is a peer dependency and a native binary, so that path makes every deployed\n * app carry a compiler it only needs once, and turns a missing optional peer into a runtime 404\n * instead of a build failure. Compilation belongs where the rest of the build already is — and it\n * is what the issue's root-cause note asks for.\n *\n * ## Why NOT in `generateManifest`\n *\n * ADR-5 keeps controllers out of the manifest, and that is preserved here: the manifest is the\n * deploy-adapter contract, and adding a parallel route source to it would ripple through every\n * adapter. This emits a SEPARATE artifact (`dist/controllers.json` + `dist/controllers/*.mjs`) that\n * only the Node start path reads. An adapter that knows nothing about controllers keeps working\n * exactly as before.\n */\n\n/** The build artifact `theokit start` reads to find compiled controllers. */\ninterface ControllerBuildManifest {\n  version: 1\n  /** Emitted module paths, relative to `distDir`, in scan order. */\n  modules: string[]\n}\n\nexport const CONTROLLER_MANIFEST_FILE = 'controllers.json'\nconst CONTROLLER_OUT_DIR = 'controllers'\n\n/**\n * Compile every controller under `<serverDir>/controllers` into `<distDir>/controllers`.\n *\n * No controllers ⇒ **no artifact at all** (not an empty one). `theokit start` treats a missing\n * manifest as \"this app has no controllers\" and skips the whole branch, so a routes-only app pays\n * nothing and its `dist` is byte-identical to before — the ADR-5 posture, kept.\n */\n/**\n * Point a compiled controller's RELATIVE imports back at the app's own source tree.\n *\n * theokit#516 — controllers are compiled into `<distDir>/controllers` because parameter decorators\n * need metadata only swc emits. File routes are never compiled: in production `importUserModule`\n * loads them straight from the source, which is why THEIR relative imports resolve. A controller's\n * did not — `../auth/index.js` resolved from `dist`, where the app does not exist — so a controller\n * that imported anything of the app's worked under `theokit dev` and failed the build.\n *\n * Rewriting to an ABSOLUTE path into the source tree is the smallest fix that keeps one definition\n * of every module. The alternatives each cost more than they buy: copying the app's modules beside\n * the controller duplicates them, and bundling inlines them, so in both a module with state exists\n * twice and the two copies drift.\n *\n * The extension is mapped back to what is on disk. TypeScript source writes `./x.js` for `./x.ts`\n * (NodeNext), and the emitted module has to name the file that exists, since it is loaded by the\n * same `importUserModule` path a file route takes — `.ts` included.\n *\n * BARE specifiers are left exactly as written. `@theokit/http`, `zod` and every other package\n * resolve through `node_modules` from any directory, so rewriting them would replace something that\n * works with a path that pins a version.\n */\nfunction rewriteLocalImports(code: string, sourceFile: string): string {\n  const fromDir = dirname(sourceFile)\n  return code.replace(\n    /(\\bfrom\\s*|\\bimport\\s*\\(\\s*)(['\"])(\\.[^'\"]*)\\2/g,\n    (whole, lead: string, quote: string, spec: string) => {\n      const resolved = resolve(fromDir, spec)\n      const onDisk = existingSourcePath(resolved)\n      if (onDisk === undefined) return whole\n      return `${lead}${quote}${pathToFileURL(onDisk).href}${quote}`\n    },\n  )\n}\n\n/**\n * The file a compiled specifier names, as it exists on disk — or `undefined` when nothing does.\n *\n * `./x.js` may be `x.ts`, `x.tsx`, a literal `x.js`, or a directory holding `index.*`. Returning\n * `undefined` for the rest is deliberate: a specifier this cannot resolve is left UNCHANGED, so the\n * runtime reports the missing module by the name the author wrote. Substituting a guess would move\n * the error somewhere the author never typed.\n */\nfunction existingSourcePath(resolved: string): string | undefined {\n  const withoutExt = resolved.replace(/\\.(js|mjs|cjs)$/, '')\n  const candidates = [\n    ...(resolved === withoutExt ? [] : [`${withoutExt}.ts`, `${withoutExt}.tsx`, resolved]),\n    ...(resolved === withoutExt ? [`${resolved}.ts`, `${resolved}.tsx`, `${resolved}.js`] : []),\n    join(withoutExt, 'index.ts'),\n    join(withoutExt, 'index.tsx'),\n    join(withoutExt, 'index.js'),\n  ]\n  return candidates.find((c) => existsSync(c))\n}\n\n/**\n * The URL prefix both runtimes gate the controller fall-through on.\n *\n * `start/handlers.ts` and `vite-plugin/api-middleware.ts` each return early unless the request URL\n * starts with `/api/`, so a controller declaring anything else describes a path that branch never\n * visits. Written here as a constant rather than a literal in the check, because the day that gate\n * moves this is the line that has to move with it.\n */\nconst SERVED_PREFIX = 'api'\n\n/**\n * A controller compiled successfully and mounted at a path the runtime never routes to.\n *\n * Its own class so a caller can tell it from a compile failure: the source is fine, the decorators\n * are fine, and the app would start — the route simply answers 404 forever. That is the failure\n * this module's docblock already refuses for compile errors, reached by a different road.\n *\n * Measured against `theokit@0.56.0`: `@Controller('probe')` built clean, emitted a module, wrote\n * the manifest, and `/api/probe` returned 404. `/probe` returned **200** — the SPA fallback serving\n * `index.html`, so the status code agreed with success while the body was a web page. A defect that\n * survives a status-code check is exactly the kind a build gate has to catch instead.\n */\nexport class UnreachableControllerPathError extends Error {\n  override readonly name = 'UnreachableControllerPathError'\n  constructor(\n    readonly controller: string,\n    readonly declaredPath: string,\n    readonly file: string,\n  ) {\n    super(\n      [\n        `${controller} declares \\`@Controller('${declaredPath}')\\`, which this runtime never routes to.`,\n        ``,\n        `  ${file}`,\n        ``,\n        `  Controller routes are served from a fall-through that runs only for URLs under`,\n        `  \\`/${SERVED_PREFIX}/\\` — a file-route miss is what reaches it. A path outside that`,\n        `  prefix compiles, emits, and then answers 404 for the life of the app.`,\n        ``,\n        `  Write it as:`,\n        ``,\n        `      @Controller('${SERVED_PREFIX}/${declaredPath.replace(/^\\/+/, '')}')`,\n        ``,\n        `  Refused at build rather than left to 404, for the reason this module already refuses a`,\n        `  compile error: shipping a route nothing can reach, with nothing pointing back at why.`,\n      ].join('\\n'),\n    )\n  }\n}\n\n/**\n * Is `prefix` reachable from the served path?\n *\n * `'api'`, `'/api'`, `'api/x'` and `'/api/x'` are the same URL written four ways, so all four pass:\n * the gate is about reachability, not spelling. A prefix that merely STARTS with the letters —\n * `'apiary'` — is not, which is why the check is segment-wise rather than a `startsWith`.\n */\nfunction isReachable(prefix: string): boolean {\n  const segments = prefix.split('/').filter((s) => s.length > 0)\n  return segments[0] === SERVED_PREFIX\n}\n\n/**\n * Refuse any emitted controller whose declared path the runtime cannot route to.\n *\n * Reads the prefix off the COMPILED module rather than the source: the decorator metadata is what\n * the runtime will actually match on, and a regex over source text would disagree with it the first\n * time someone writes the prefix as anything other than a literal.\n */\nfunction assertControllerPathsReachable(\n  loaded: readonly { cls: ControllerClass; sourceFile: string }[],\n): void {\n  for (const { cls, sourceFile } of loaded) {\n    const meta = getMeta<{ prefix?: string }>(CONTROLLER_PREFIX, cls)\n    const prefix = meta?.prefix ?? ''\n    if (isReachable(prefix)) continue\n    throw new UnreachableControllerPathError(cls.name || 'a controller', prefix, sourceFile)\n  }\n}\n\n/**\n * The metadata key an explicitly-open controller route sets — IMPORTED, no longer redeclared.\n *\n * The counterpart of `'public'` on the file path, and it exists for the same routes: a health check\n * a load balancer calls with no session, an OAuth callback the provider redirects to.\n *\n * This was a local `const` under a docblock arguing that exporting it \"would publish a new surface\n * for a string that appears once per open route\". #574 measured the cost of that reasoning in the\n * first real adopter — 8 controllers, 6 hand-written copies of `'theokit:public'` — and\n * `@theokit/http` now exports both the key and `@Public()`. Keeping a second copy here would leave\n * the gate and the decorator agreeing by coincidence rather than by construction.\n *\n * It is an opt-out, never a default. A route that is open says so in the file, where review sees\n * it; a route nobody thought about is the one that ships open, which is the whole reason ADR 0001\n * made absence stop meaning open on the file path.\n */\n\n/**\n * A controller route that declares no access decision at all.\n *\n * Distinct from a guard REFUSING a request — that is the system working. This is a route where\n * nobody wrote down whether it should be reachable, which on the file path is a build failure and\n * on the decorator path was, until now, silence.\n *\n * Measured against theokit@0.56.0: a `@Controller` with no guard answered 200 to a request with no\n * session, while the file route it would replace answered 403, on the same server in the same\n * second. The mechanism was never missing — `@UseGuards` works and returns `403 FORBIDDEN`. Only\n * the refusal of absence was.\n */\nexport class UndeclaredControllerAccessError extends Error {\n  override readonly name = 'UndeclaredControllerAccessError'\n  constructor(\n    readonly controller: string,\n    readonly method: string,\n    readonly verb: string,\n    readonly file: string,\n  ) {\n    super(\n      [\n        `${controller}.${method}() serves ${verb} and declares no access decision.`,\n        ``,\n        `  ${file}`,\n        ``,\n        `  A file route with no \\`.policy\\` fails this build for the same reason (ADR 0001): a route`,\n        `  nobody thought about is the one that ships open. The decorator path now says the same.`,\n        ``,\n        `  Require a session:`,\n        ``,\n        `      @UseGuards(AuthGuard)   // on the method, or on the @Controller to cover all of them`,\n        ``,\n        `  Or state that it is open on purpose — a health check, an OAuth callback:`,\n        ``,\n        `      @Public()               // from '@theokit/http'`,\n        ``,\n        `  Both are declarations. What is refused is neither.`,\n      ].join('\\n'),\n    )\n  }\n}\n\n/**\n * Refuse any controller route whose access decision nobody wrote down.\n *\n * A guard on the CLASS covers every method under it, which is the shape most controllers want and\n * mirrors how `@UseGuards` already behaves at runtime — the gate must agree with the dispatcher or\n * it would refuse code that works.\n *\n * Read off the compiled module for the reason the prefix check is: decorator metadata is what the\n * runtime matches on. The per-method key lives on the CLASS with the property name, not on the\n * prototype and not on the descriptor — measured, after both of those returned `undefined`.\n */\nfunction assertControllerAccessDeclared(\n  loaded: readonly { cls: ControllerClass; sourceFile: string }[],\n): void {\n  for (const { cls, sourceFile } of loaded) {\n    // Class level covers every method under it — for BOTH forms. A guard on the class already\n    // behaves that way at runtime, and a controller whose routes are all open (a health group, an\n    // OAuth callback group) must be declarable once for the same reason. Checking one at class\n    // level and not the other would refuse code that is correct.\n    if (getMeta<unknown[]>(USE_GUARDS, cls) !== undefined) continue\n    if (Reflect.getMetadata(PUBLIC_ROUTE_METADATA, cls) === true) continue\n\n    const routes = getMeta<{ verb: string; propertyKey: string }[]>(ROUTE_METHODS, cls) ?? []\n    for (const { verb, propertyKey } of routes) {\n      if (getMeta<unknown[]>(USE_GUARDS, cls, propertyKey) !== undefined) continue\n      // `Reflect` directly, not `getMeta`: `@SetMetadata` writes through `Reflect.defineMetadata`\n      // with the key as given, and `getMeta` is typed for the symbol keys this package defines.\n      if (Reflect.getMetadata(PUBLIC_ROUTE_METADATA, cls, propertyKey) === true) continue\n      throw new UndeclaredControllerAccessError(\n        cls.name || 'a controller',\n        propertyKey,\n        verb,\n        sourceFile,\n      )\n    }\n  }\n}\n\n/**\n * Load every emitted controller class once, for both checks below.\n *\n * One pass rather than one per check: the alternative loads each module twice and doubles the\n * surface on which a stale import could fool a gate.\n *\n * The `?t=` is a cache-bust. `emitControllerArtifacts` runs once per build process today, so it\n * changes nothing now — it is here because these are SECURITY gates, and the failure mode if a\n * watch mode is ever added is one that reads metadata from a version of the file that no longer\n * exists and passes it. `parsimony-ladder.md` is explicit that security is not what the ladder\n * trims, and the cost is a query parameter.\n */\nasync function loadEmittedControllers(\n  emitted: readonly { modulePath: string; sourceFile: string }[],\n): Promise<{ cls: ControllerClass; sourceFile: string }[]> {\n  const out: { cls: ControllerClass; sourceFile: string }[] = []\n  for (const { modulePath, sourceFile } of emitted) {\n    const url = `${pathToFileURL(modulePath).href}?t=${Date.now()}`\n    const mod: Record<string, unknown> = await import(url)\n    for (const exported of Object.values(mod)) {\n      if (typeof exported !== 'function' || !isControllerClass(exported)) continue\n      out.push({ cls: exported as ControllerClass, sourceFile })\n    }\n  }\n  return out\n}\n\n/** A class carrying `@Controller` metadata — narrowed once so both checks read the same shape. */\ntype ControllerClass = (new (...args: never[]) => unknown) & { name: string }\n\nexport async function emitControllerArtifacts(opts: {\n  serverDir: string\n  distDir: string\n}): Promise<ControllerBuildManifest | null> {\n  const controllersDir = resolve(opts.serverDir, CONTROLLER_OUT_DIR)\n  const files = findControllerFiles(controllersDir)\n  if (files.length === 0) return null\n\n  const outDir = resolve(opts.distDir, CONTROLLER_OUT_DIR)\n  mkdirSync(outDir, { recursive: true })\n\n  const modules: string[] = []\n  const emitted: { modulePath: string; sourceFile: string }[] = []\n  for (const file of files) {\n    // Errors are NOT caught. A controller that fails to compile must fail the BUILD — swallowing it\n    // here would ship an app whose routes 404 at runtime with nothing pointing back at the cause,\n    // which is the exact failure mode this issue reports (error-handling.md § 2).\n    const compiled = await transformControllerSource(readFileSync(file, 'utf-8'), file)\n    const code = rewriteLocalImports(compiled, file)\n\n    // Mirror the source tree under `dist/controllers` so two files with the same basename in\n    // different folders cannot overwrite each other.\n    const rel = relative(controllersDir, file).replace(/\\.controller\\.ts$/, '.controller.mjs')\n    const outPath = join(outDir, rel)\n    mkdirSync(dirname(outPath), { recursive: true })\n    writeFileSync(outPath, code)\n    modules.push(`${CONTROLLER_OUT_DIR}/${rel.split('\\\\').join('/')}`)\n    emitted.push({ modulePath: outPath, sourceFile: file })\n  }\n\n  // AFTER writing, because reading the prefix means loading the compiled module — and a module that\n  // failed to compile has already thrown above. Before the manifest, so a refused build leaves no\n  // artifact claiming a route that does not answer.\n  const loaded = await loadEmittedControllers(emitted)\n  assertControllerPathsReachable(loaded)\n  assertControllerAccessDeclared(loaded)\n\n  const manifest: ControllerBuildManifest = { version: 1, modules }\n  writeFileSync(\n    resolve(opts.distDir, CONTROLLER_MANIFEST_FILE),\n    JSON.stringify(manifest, null, 2) + '\\n',\n  )\n  return manifest\n}\n\n/** Human-facing summary for the build log (mirrors the cron/job emitters). */\nexport function describeControllerArtifacts(manifest: ControllerBuildManifest | null): string {\n  if (manifest === null) return 'controllers: none'\n  const names = manifest.modules.map((m) => basename(m, '.mjs')).join(', ')\n  return `controllers: ${manifest.modules.length} compiled (${names})`\n}\n"],"mappings":";;;;;;;AAAA,OAAO;AAEP,SAAS,YAAY,WAAW,cAAc,qBAAqB;AACnE,SAAS,UAAU,SAAS,MAAM,UAAU,eAAe;AAC3D,SAAS,qBAAqB;AAE9B,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAuCA,IAAM,2BAA2B;AACxC,IAAM,qBAAqB;AA+B3B,SAAS,oBAAoB,MAAc,YAA4B;AACrE,QAAM,UAAU,QAAQ,UAAU;AAClC,SAAO,KAAK;AAAA,IACV;AAAA,IACA,CAAC,OAAO,MAAc,OAAe,SAAiB;AACpD,YAAM,WAAW,QAAQ,SAAS,IAAI;AACtC,YAAM,SAAS,mBAAmB,QAAQ;AAC1C,UAAI,WAAW,OAAW,QAAO;AACjC,aAAO,GAAG,IAAI,GAAG,KAAK,GAAG,cAAc,MAAM,EAAE,IAAI,GAAG,KAAK;AAAA,IAC7D;AAAA,EACF;AACF;AAUA,SAAS,mBAAmB,UAAsC;AAChE,QAAM,aAAa,SAAS,QAAQ,mBAAmB,EAAE;AACzD,QAAM,aAAa;AAAA,IACjB,GAAI,aAAa,aAAa,CAAC,IAAI,CAAC,GAAG,UAAU,OAAO,GAAG,UAAU,QAAQ,QAAQ;AAAA,IACrF,GAAI,aAAa,aAAa,CAAC,GAAG,QAAQ,OAAO,GAAG,QAAQ,QAAQ,GAAG,QAAQ,KAAK,IAAI,CAAC;AAAA,IACzF,KAAK,YAAY,UAAU;AAAA,IAC3B,KAAK,YAAY,WAAW;AAAA,IAC5B,KAAK,YAAY,UAAU;AAAA,EAC7B;AACA,SAAO,WAAW,KAAK,CAAC,MAAM,WAAW,CAAC,CAAC;AAC7C;AAUA,IAAM,gBAAgB;AAcf,IAAM,iCAAN,cAA6C,MAAM;AAAA,EAExD,YACW,YACA,cACA,MACT;AACA;AAAA,MACE;AAAA,QACE,GAAG,UAAU,4BAA4B,YAAY;AAAA,QACrD;AAAA,QACA,KAAK,IAAI;AAAA,QACT;AAAA,QACA;AAAA,QACA,QAAQ,aAAa;AAAA,QACrB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,sBAAsB,aAAa,IAAI,aAAa,QAAQ,QAAQ,EAAE,CAAC;AAAA,QACvE;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI;AAAA,IACb;AArBS;AACA;AACA;AAAA,EAoBX;AAAA,EAtBW;AAAA,EACA;AAAA,EACA;AAAA,EAJO,OAAO;AAyB3B;AASA,SAAS,YAAY,QAAyB;AAC5C,QAAM,WAAW,OAAO,MAAM,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AAC7D,SAAO,SAAS,CAAC,MAAM;AACzB;AASA,SAAS,+BACP,QACM;AACN,aAAW,EAAE,KAAK,WAAW,KAAK,QAAQ;AACxC,UAAM,OAAO,QAA6B,mBAAmB,GAAG;AAChE,UAAM,SAAS,MAAM,UAAU;AAC/B,QAAI,YAAY,MAAM,EAAG;AACzB,UAAM,IAAI,+BAA+B,IAAI,QAAQ,gBAAgB,QAAQ,UAAU;AAAA,EACzF;AACF;AA+BO,IAAM,kCAAN,cAA8C,MAAM;AAAA,EAEzD,YACW,YACA,QACA,MACA,MACT;AACA;AAAA,MACE;AAAA,QACE,GAAG,UAAU,IAAI,MAAM,aAAa,IAAI;AAAA,QACxC;AAAA,QACA,KAAK,IAAI;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI;AAAA,IACb;AAxBS;AACA;AACA;AACA;AAAA,EAsBX;AAAA,EAzBW;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EALO,OAAO;AA4B3B;AAaA,SAAS,+BACP,QACM;AACN,aAAW,EAAE,KAAK,WAAW,KAAK,QAAQ;AAKxC,QAAI,QAAmB,YAAY,GAAG,MAAM,OAAW;AACvD,QAAI,QAAQ,YAAY,uBAAuB,GAAG,MAAM,KAAM;AAE9D,UAAM,SAAS,QAAiD,eAAe,GAAG,KAAK,CAAC;AACxF,eAAW,EAAE,MAAM,YAAY,KAAK,QAAQ;AAC1C,UAAI,QAAmB,YAAY,KAAK,WAAW,MAAM,OAAW;AAGpE,UAAI,QAAQ,YAAY,uBAAuB,KAAK,WAAW,MAAM,KAAM;AAC3E,YAAM,IAAI;AAAA,QACR,IAAI,QAAQ;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAcA,eAAe,uBACb,SACyD;AACzD,QAAM,MAAsD,CAAC;AAC7D,aAAW,EAAE,YAAY,WAAW,KAAK,SAAS;AAChD,UAAM,MAAM,GAAG,cAAc,UAAU,EAAE,IAAI,MAAM,KAAK,IAAI,CAAC;AAC7D,UAAM,MAA+B,MAAM,OAAO;AAClD,eAAW,YAAY,OAAO,OAAO,GAAG,GAAG;AACzC,UAAI,OAAO,aAAa,cAAc,CAAC,kBAAkB,QAAQ,EAAG;AACpE,UAAI,KAAK,EAAE,KAAK,UAA6B,WAAW,CAAC;AAAA,IAC3D;AAAA,EACF;AACA,SAAO;AACT;AAKA,eAAsB,wBAAwB,MAGF;AAC1C,QAAM,iBAAiB,QAAQ,KAAK,WAAW,kBAAkB;AACjE,QAAM,QAAQ,oBAAoB,cAAc;AAChD,MAAI,MAAM,WAAW,EAAG,QAAO;AAE/B,QAAM,SAAS,QAAQ,KAAK,SAAS,kBAAkB;AACvD,YAAU,QAAQ,EAAE,WAAW,KAAK,CAAC;AAErC,QAAM,UAAoB,CAAC;AAC3B,QAAM,UAAwD,CAAC;AAC/D,aAAW,QAAQ,OAAO;AAIxB,UAAM,WAAW,MAAM,0BAA0B,aAAa,MAAM,OAAO,GAAG,IAAI;AAClF,UAAM,OAAO,oBAAoB,UAAU,IAAI;AAI/C,UAAM,MAAM,SAAS,gBAAgB,IAAI,EAAE,QAAQ,qBAAqB,iBAAiB;AACzF,UAAM,UAAU,KAAK,QAAQ,GAAG;AAChC,cAAU,QAAQ,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AAC/C,kBAAc,SAAS,IAAI;AAC3B,YAAQ,KAAK,GAAG,kBAAkB,IAAI,IAAI,MAAM,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE;AACjE,YAAQ,KAAK,EAAE,YAAY,SAAS,YAAY,KAAK,CAAC;AAAA,EACxD;AAKA,QAAM,SAAS,MAAM,uBAAuB,OAAO;AACnD,iCAA+B,MAAM;AACrC,iCAA+B,MAAM;AAErC,QAAM,WAAoC,EAAE,SAAS,GAAG,QAAQ;AAChE;AAAA,IACE,QAAQ,KAAK,SAAS,wBAAwB;AAAA,IAC9C,KAAK,UAAU,UAAU,MAAM,CAAC,IAAI;AAAA,EACtC;AACA,SAAO;AACT;AAGO,SAAS,4BAA4B,UAAkD;AAC5F,MAAI,aAAa,KAAM,QAAO;AAC9B,QAAM,QAAQ,SAAS,QAAQ,IAAI,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,KAAK,IAAI;AACxE,SAAO,gBAAgB,SAAS,QAAQ,MAAM,cAAc,KAAK;AACnE;","names":[]}

package/dist/{chunk-WOANPZBT.js → chunk-Q3UE7WIM.js}

@@ -2,7 +2,7 @@ import {
   dispatchCsrfWarn,
   incomingMessageToWebRequest,
   sendError
-} from "./chunk-JW5UFKQ3.js";
+} from "./chunk-5AGNZXHJ.js";
 import {
   enforceCsrf
 } from "./chunk-P6OS7652.js";
@@ -130,4 +130,4 @@ export {
   scanControllerModules,
   dispatchControllerRequest
 };
-//# sourceMappingURL=chunk-WOANPZBT.js.map
+//# sourceMappingURL=chunk-Q3UE7WIM.js.map

package/dist/{chunk-IZTOGKLS.js → chunk-YXEKPMDK.js}

@@ -178,7 +178,7 @@ async function agentCommand(name, message, deps = {}) {
 async function createAgentSsrLoader(projectRoot) {
   const { createServer } = await import("vite");
   const react = (await import("@vitejs/plugin-react")).default;
-  const { theoPluginAsync } = await import("./vite-plugin-BG5K3L46.js");
+  const { theoPluginAsync } = await import("./vite-plugin-37OQ5RDR.js");
   const { loadConfig } = await import("./load-config-VMKOV44Y.js");
   const config = await loadConfig(projectRoot);
   const theoPlugins = await theoPluginAsync({
@@ -212,4 +212,4 @@ export {
   agentCommand,
   createAgentSsrLoader
 };
-//# sourceMappingURL=chunk-IZTOGKLS.js.map
+//# sourceMappingURL=chunk-YXEKPMDK.js.map

package/dist/{chunk-K3DUUEQ5.js → chunk-ZXJAI4J7.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-SSYDEKWF.js";
 import {
   dispatchControllerRequest
-} from "./chunk-WOANPZBT.js";
+} from "./chunk-Q3UE7WIM.js";
 import {
   RUN_ID_HEADER,
   SSE_BASE_HEADERS,
@@ -32,7 +32,7 @@ import {
   securitySchema,
   storageSchema,
   uploadSchema
-} from "./chunk-DMODPX7P.js";
+} from "./chunk-H2X5T45M.js";
 import {
   broadcastToDevtools
 } from "./chunk-OIGJOYX6.js";
@@ -60,13 +60,13 @@ import {
   incomingMessageToHandlerRequest,
   sendError,
   writeWebResponseToServerResponse
-} from "./chunk-JW5UFKQ3.js";
+} from "./chunk-5AGNZXHJ.js";
 import {
   validateCsrfRequest
 } from "./chunk-P6OS7652.js";
 import {
   subjectFromContext
-} from "./chunk-YN4W7LCX.js";
+} from "./chunk-ENRT6DAU.js";
 import {
   findSuggestion
 } from "./chunk-NTDN54XO.js";
@@ -3507,19 +3507,19 @@ async function theoPluginAsync(rootOrOptions) {
       })
     );
   }
-  const { appTypedClientPlugin } = await import("./app-typed-client-MKTSLES3.js");
+  const { appTypedClientPlugin } = await import("./app-typed-client-B7QIRDSP.js");
   const appClientPlugin = appTypedClientPlugin({
     cwd: projectRoot,
     serverDir: serverDirAbs,
     distDir: resolve10(projectRoot, ".theokit")
   });
-  const { actionsVirtualModule } = await import("./actions-virtual-module-DNOALUTX.js");
+  const { actionsVirtualModule } = await import("./actions-virtual-module-345YHSEB.js");
   const actionsPlugin = actionsVirtualModule({
     serverDir: serverDirAbs,
     distDir: resolve10(projectRoot, ".theokit")
   });
   const { agentsTypedClientPlugin } = await import("./agents-typed-client-PVUZU65B.js");
-  const { generateManifest } = await import("./internal-api-3YDGG5FF.js");
+  const { generateManifest } = await import("./internal-api-VRUDDBEG.js");
   const agentsClientPlugin = agentsTypedClientPlugin({
     projectRoot,
     agentsDir: agentsDirName,
@@ -3536,7 +3536,7 @@ async function theoPluginAsync(rootOrOptions) {
   const controllerTransformPlugin = controllerSwcTransformPlugin({
     serverDir: serverDirAbs
   });
-  const { serverOnlyImportBoundary } = await import("./server-boundary-JG53VI6L.js");
+  const { serverOnlyImportBoundary } = await import("./server-boundary-OEBKNBEP.js");
   const serverBoundaryPlugin = serverOnlyImportBoundary({
     projectRoot,
     serverDir: serverDirAbs
@@ -3719,4 +3719,4 @@ export {
   theoPluginAsync,
   theoPlugin
 };
-//# sourceMappingURL=chunk-K3DUUEQ5.js.map
+//# sourceMappingURL=chunk-ZXJAI4J7.js.map

package/dist/cli/index.js

@@ -15,12 +15,12 @@ function cliVersion() {
 // src/cli/index.ts
 var cli = cac("theokit");
 cli.command("dev", "Start development server").option("--port <port>", "Port number").action(async (options) => {
-  const { devCommand } = await import("../dev-5ETOFKOP.js");
+  const { devCommand } = await import("../dev-BDODXUEA.js");
   await devCommand({ port: options.port ? Number(options.port) : void 0 });
 });
 cli.command("build", "Build for production").option("--target <target>", "Deploy target (node, vercel, cloudflare)").action(async (options) => {
   try {
-    const { buildCommand } = await import("../build-RG54DH3F.js");
+    const { buildCommand } = await import("../build-22OMF3NG.js");
     await buildCommand({ target: options.target });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -32,7 +32,7 @@ cli.command("build", "Build for production").option("--target <target>", "Deploy
 });
 cli.command("start", "Start production server").option("--port <port>", "Port number").action(async (options) => {
   try {
-    const { startCommand } = await import("../start-3FYIYTM7.js");
+    const { startCommand } = await import("../start-AKMBT3DW.js");
     await startCommand({ port: options.port ? Number(options.port) : void 0 });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -44,7 +44,7 @@ cli.command("start", "Start production server").option("--port <port>", "Port nu
 });
 cli.command("preview", "Build for production, then serve it \u2014 one step (B-030)").option("--port <port>", "Port number").option("--target <target>", "Deploy target (node, vercel, cloudflare)").action(async (options) => {
   try {
-    const { previewCommand } = await import("../preview-XP77EPTL.js");
+    const { previewCommand } = await import("../preview-GUEKVBGL.js");
     await previewCommand({
       port: options.port ? Number(options.port) : void 0,
       target: options.target
@@ -77,7 +77,7 @@ cli.command(
   "Run an agent in the terminal (stream + tool calls + approval)"
 ).action(async (name, message) => {
   try {
-    const { agentCommand } = await import("../agent-VWPSEDXD.js");
+    const { agentCommand } = await import("../agent-L45EZWPV.js");
     const { sawError } = await agentCommand(name, message);
     if (sawError) process.exit(1);
   } catch (err) {
@@ -108,7 +108,7 @@ cli.command("agent sessions gc", "Collect old transcripts for this project (dry
 });
 cli.command("mcp <agent>", "Serve an agent as an MCP server over stdio (for desktop MCP clients)").action(async (agent) => {
   try {
-    const { mcpCommand } = await import("../mcp-B42ISIJG.js");
+    const { mcpCommand } = await import("../mcp-WMZSXQQG.js");
     await mcpCommand(agent);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);

package/dist/{dev-5ETOFKOP.js → dev-BDODXUEA.js}

@@ -11,13 +11,13 @@ import {
 } from "./chunk-KTMQUYED.js";
 import {
   theoPluginAsync
-} from "./chunk-ETKLM6UN.js";
-import "./chunk-XES7ZE2K.js";
+} from "./chunk-6R6UR64X.js";
+import "./chunk-L2NSHQOY.js";
 import "./chunk-2CVV6CNN.js";
 import "./chunk-3PWQQWT6.js";
 import "./chunk-FDOOBTXJ.js";
 import "./chunk-47MM2JUK.js";
-import "./chunk-GZ5YHD5H.js";
+import "./chunk-KVZQJ3ZM.js";
 import "./chunk-WFIAYPBH.js";
 import "./chunk-L4TB6FXQ.js";
 import "./chunk-VV2VU3LJ.js";
@@ -128,4 +128,4 @@ export {
   devCommand,
   startDevServer
 };
-//# sourceMappingURL=dev-5ETOFKOP.js.map
+//# sourceMappingURL=dev-BDODXUEA.js.map

package/dist/{index-ADEV6pen.d.ts → index-BXGSBlxf.d.ts}

@@ -6,7 +6,7 @@ import { J as JobBackend } from './job-backend-CgC8Xf33.js';
 import { L as LoadModule, S as ServerRouteNode } from './match-Dw4CNXJH.js';
 import { C as CsrfMode, D as DisallowedConfig } from './csrf-Dgot9qSM.js';
 import { z } from 'zod';
-import { R as RouteConfig } from './route-config-Cm_ZMA1C.js';
+import { R as RouteConfig } from './route-config-B7FaTSby.js';
 import './action-protocol-tGm3NKRg.js';
 
 interface ExecuteActionOptions {

package/dist/index.js

@@ -8,21 +8,21 @@ import {
   scanRoutes,
   theoConfigSchema,
   theoPlugin
-} from "./chunk-K3DUUEQ5.js";
+} from "./chunk-ZXJAI4J7.js";
 import "./chunk-7NRFZBAL.js";
 import "./chunk-SSYDEKWF.js";
-import "./chunk-WOANPZBT.js";
-import "./chunk-DMODPX7P.js";
+import "./chunk-Q3UE7WIM.js";
+import "./chunk-H2X5T45M.js";
 import "./chunk-OIGJOYX6.js";
 import "./chunk-U3SPBLJF.js";
 import "./chunk-EYRWD2AB.js";
 import "./chunk-5GZROLDV.js";
 import "./chunk-OGLS76RN.js";
-import "./chunk-JW5UFKQ3.js";
+import "./chunk-5AGNZXHJ.js";
 import "./chunk-P6OS7652.js";
 import "./chunk-ZDUO4IYN.js";
 import "./chunk-D4VP2QPR.js";
-import "./chunk-YN4W7LCX.js";
+import "./chunk-ENRT6DAU.js";
 import "./chunk-47FFT43U.js";
 import "./chunk-NTDN54XO.js";
 import "./chunk-PVNMLZ5G.js";

package/dist/{internal-api-UM77XDXN.js → internal-api-QKWTQ2Q7.js}

@@ -16,7 +16,7 @@ import {
   handleCspReport,
   handleCsrfReadiness,
   mountAgent
-} from "./chunk-GZ5YHD5H.js";
+} from "./chunk-KVZQJ3ZM.js";
 import {
   resolveProvider
 } from "./chunk-WFIAYPBH.js";
@@ -87,4 +87,4 @@ export {
   scanWebSocketRoutes,
   sendError
 };
-//# sourceMappingURL=internal-api-UM77XDXN.js.map
+//# sourceMappingURL=internal-api-QKWTQ2Q7.js.map

package/dist/{internal-api-3YDGG5FF.js → internal-api-VRUDDBEG.js}

@@ -1,9 +1,9 @@
 import {
   dispatchControllerRequest
-} from "./chunk-WOANPZBT.js";
+} from "./chunk-Q3UE7WIM.js";
 import {
   mountAgent
-} from "./chunk-DMODPX7P.js";
+} from "./chunk-H2X5T45M.js";
 import {
   CSP_REPORT_PATH,
   CsrfReadinessStore,
@@ -20,11 +20,11 @@ import {
   handleBatchRequest,
   incomingMessageToHandlerRequest,
   sendError
-} from "./chunk-JW5UFKQ3.js";
+} from "./chunk-5AGNZXHJ.js";
 import "./chunk-P6OS7652.js";
 import "./chunk-ZDUO4IYN.js";
 import "./chunk-D4VP2QPR.js";
-import "./chunk-YN4W7LCX.js";
+import "./chunk-ENRT6DAU.js";
 import "./chunk-47FFT43U.js";
 import {
   findSuggestion
@@ -107,4 +107,4 @@ export {
   scanWebSocketRoutes,
   sendError
 };
-//# sourceMappingURL=internal-api-3YDGG5FF.js.map
+//# sourceMappingURL=internal-api-VRUDDBEG.js.map

package/dist/{mcp-B42ISIJG.js → mcp-WMZSXQQG.js}

@@ -2,7 +2,7 @@
 import "tsx/esm";
 import {
   createAgentSsrLoader
-} from "./chunk-IZTOGKLS.js";
+} from "./chunk-YXEKPMDK.js";
 import {
   extractAppResources,
   handleMcpJsonRpc
@@ -75,4 +75,4 @@ async function mcpCommand(name, deps = {}) {
 export {
   mcpCommand
 };
-//# sourceMappingURL=mcp-B42ISIJG.js.map
+//# sourceMappingURL=mcp-WMZSXQQG.js.map

package/dist/{preview-XP77EPTL.js → preview-GUEKVBGL.js}

@@ -4,8 +4,8 @@ import "tsx/esm";
 // src/cli/commands/preview.ts
 async function defaultSteps() {
   const [{ buildCommand }, { startCommand }] = await Promise.all([
-    import("./build-RG54DH3F.js"),
-    import("./start-3FYIYTM7.js")
+    import("./build-22OMF3NG.js"),
+    import("./start-AKMBT3DW.js")
   ]);
   return {
     build: (opts) => buildCommand(opts),
@@ -20,4 +20,4 @@ async function previewCommand(options = {}, steps) {
 export {
   previewCommand
 };
-//# sourceMappingURL=preview-XP77EPTL.js.map
+//# sourceMappingURL=preview-GUEKVBGL.js.map

package/dist/{route-config-Cm_ZMA1C.d.ts → route-config-B7FaTSby.d.ts}

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { R as RoutePolicy } from './route-policy-BxOycCDq.js';
+import { R as RoutePolicy } from './route-policy-BHXQDzBF.js';
 
 /**
  * core/contracts/route-config.ts

package/dist/{route-policy-BxOycCDq.d.ts → route-policy-BHXQDzBF.d.ts}

@@ -32,7 +32,26 @@ interface RoutePolicyInput<TQuery = unknown, TBody = unknown, TParams = unknown>
  * like a route nobody thought about (ADR 0001 section Consequences, Risks).
  */
 type RoutePolicy<TQuery = unknown, TBody = unknown, TParams = unknown> = 'public' | ((input: RoutePolicyInput<TQuery, TBody, TParams>) => boolean | AccessDecision | Promise<boolean | AccessDecision>);
-/** Narrow a run-context to the subject it carries, if it carries one. */
+/**
+ * Narrow a RUN-CONTEXT to the subject it carries, if it carries one.
+ *
+ * The argument is the object `server/context.ts` builds — the one with `subject` on it. It is NOT a
+ * controller guard's `ExecutionContext`, and telling a caller so is the whole reason for the throw
+ * below (usetheokit/theokit#574).
+ *
+ * An `ExecutionContext` carries `getRequest`, `getUrl`, `getClass` and `getMethodName` and nothing
+ * else, so this function used to answer `null` for it — indistinguishable from "an anonymous
+ * caller". A guard written as `subjectFromContext(context) !== null` therefore denied EVERYONE, and
+ * passed the only test aimed at it, because that test asserted an unauthenticated request is
+ * refused. A guard that always denies is indistinguishable from a working one until somebody tries
+ * to get in.
+ *
+ * That is a silent, fail-CLOSED defect, which is the worst combination: nothing errors, nothing
+ * logs, and the failure looks like the feature. `error-handling.md` § 2 is unambiguous here — fail
+ * fast, fail loud, and never return a magic value for a caller mistake.
+ *
+ * @throws TypeError when handed an `ExecutionContext` instead of a run-context.
+ */
 declare function subjectFromContext(context: unknown): RouteSubject | null;
 /**
  * Evaluate a route policy. THE single implementation - the HTTP executors and

package/dist/server/define/index.d.ts

@@ -1,12 +1,13 @@
-import { R as RouteConfig } from '../../route-config-Cm_ZMA1C.js';
+import { R as RouteConfig } from '../../route-config-B7FaTSby.js';
 import { z } from 'zod';
 import { W as WebSocketHandler, b as WebSocketLike } from '../../define-websocket-DzPn1sR6.js';
 export { a as WebSocketHandlerWeb } from '../../define-websocket-DzPn1sR6.js';
 import { b as ToolTransform, C as CustomTool } from '../../define-agent-tool-aYYLpMeo.js';
 export { D as DefineAgentToolSpec, T as ToolContextMessage, a as ToolHandlerContext, c as applyTransform } from '../../define-agent-tool-aYYLpMeo.js';
-import { R as RoutePolicy } from '../../route-policy-BxOycCDq.js';
-export { A as AccessDecision, b as RoutePolicyInput, a as RouteSubject, e as evaluateRoutePolicy, r as requireOwner, s as subjectFromContext } from '../../route-policy-BxOycCDq.js';
+import { R as RoutePolicy } from '../../route-policy-BHXQDzBF.js';
+export { A as AccessDecision, b as RoutePolicyInput, a as RouteSubject, e as evaluateRoutePolicy, r as requireOwner, s as subjectFromContext } from '../../route-policy-BHXQDzBF.js';
 import { c as OnRequestHook, f as PreHandlerHook, d as OnResponseHook, O as OnErrorHook, T as TheoPlugin } from '../../plugin-types-BUVfUQ0V.js';
+export { b as HookName, P as PluginContext, e as PluginErrorContext } from '../../plugin-types-BUVfUQ0V.js';
 import { WireChunk } from '@theokit/presenter/wire';
 import { IncomingMessage } from 'node:http';
 export { H as HEALTH_PATH, a as HealthRouteConfig, b as READY_PATH, c as ReadyRouteConfig, d as ReservedResponse, R as ReservedRoutes, e as defineHealthRoute, f as defineReadyRoute, s as serveReservedRoute } from '../../health-route-C0hk64_U.js';
@@ -402,4 +403,4 @@ interface WebChannelHandler<TMessage = unknown> {
  */
 declare function defineWebChannel<TMessage = unknown>(handler: WebChannelHandler<TMessage>): WebChannelHandler<TMessage>;
 
-export { type ActionAccept, type ActionBuilder, type ActionConfig, type ChannelHandler, CustomTool, type MiddlewareBuilder, type MiddlewareHandler, type PluginBuilder, type RouteBuilder, RouteConfig, RoutePolicy, type ToolBuilder, ToolTransform, type WebChannelHandler, type WebSocketBuilder, WebSocketHandler, WebSocketLike, action, defineChannel, defineWebChannel, middleware, plugin, route, tool, uiMessageStreamResponse, websocket };
+export { type ActionAccept, type ActionBuilder, type ActionConfig, type ChannelHandler, CustomTool, type MiddlewareBuilder, type MiddlewareHandler, OnErrorHook, OnRequestHook, OnResponseHook, type PluginBuilder, PreHandlerHook, type RouteBuilder, RouteConfig, RoutePolicy, TheoPlugin, type ToolBuilder, ToolTransform, type WebChannelHandler, type WebSocketBuilder, WebSocketHandler, WebSocketLike, action, defineChannel, defineWebChannel, middleware, plugin, route, tool, uiMessageStreamResponse, websocket };

package/dist/server/define/index.js

@@ -14,7 +14,7 @@ import {
   evaluateRoutePolicy,
   requireOwner,
   subjectFromContext
-} from "../../chunk-YN4W7LCX.js";
+} from "../../chunk-ENRT6DAU.js";
 import {
   HEALTH_PATH,
   READY_PATH,

package/dist/server/http/index.d.ts

@@ -1,4 +1,4 @@
-export { B as BATCH_PATH, a as BatchExecuteFn, b as BatchPathConflictError, c as BatchPayload, d as BatchRequestItem, e as BatchResponse, f as BatchResultItem, C as CookieOptions, h as CorsConfig, i as CorsHandler, j as CorsOrigin, k as CorsWebHandler, l as CustomErrorPages, E as ExecuteActionOptions, m as ExecuteRouteContext, F as FileTooLargeError, H as HandleBatchOptions, M as MAX_ERROR_HTML_BYTES, n as MiddlewareResult, N as NotFoundError, p as ProcedureInputError, q as ProcedureOutputError, S as STRIPPED_HEADERS, u as SendErrorInput, v as SendErrorOptions, T as TRACE_HEADER, w as TRACE_PARENT_HEADER, x as TheoError, W as W3CTraceContext, _ as _resetMiddlewareCacheForTests, z as appendCookieToHeaders, A as appendDeleteCookieToHeaders, D as callProcedure, G as createCorsHandler, I as createCorsWebHandler, J as createOpenApiHandler, K as createServerContext, L as deleteCookie, Q as envelopeCodeToStatus, V as executeAction, X as executeRoute, Y as executeWebRequest, Z as extractTraceId, $ as extractTraceIdFromRequest, a0 as extractW3CTraceContext, a1 as fromUnknown, a2 as getCookie, a3 as getCookieFromRequest, a4 as handleBatchRequest, a5 as handleRequestError, a6 as handleWebRequestError, a7 as jsonTransformer, a8 as loadCustomErrorPages, a9 as matchesOrigin, aa as parseCookieHeader, ab as parseRequestBody, ac as parseTraceparent, ad as parseTraceparentContext, ae as resolveTransformer, af as runMiddlewareAndContext, ag as sendError, ah as sendJson, ai as serializeCookie, aj as serveStaticFile, ak as serverErrorToEnvelope, al as setCookie, am as superjsonTransformer, an as validateRouteInput } from '../../index-ADEV6pen.js';
+export { B as BATCH_PATH, a as BatchExecuteFn, b as BatchPathConflictError, c as BatchPayload, d as BatchRequestItem, e as BatchResponse, f as BatchResultItem, C as CookieOptions, h as CorsConfig, i as CorsHandler, j as CorsOrigin, k as CorsWebHandler, l as CustomErrorPages, E as ExecuteActionOptions, m as ExecuteRouteContext, F as FileTooLargeError, H as HandleBatchOptions, M as MAX_ERROR_HTML_BYTES, n as MiddlewareResult, N as NotFoundError, p as ProcedureInputError, q as ProcedureOutputError, S as STRIPPED_HEADERS, u as SendErrorInput, v as SendErrorOptions, T as TRACE_HEADER, w as TRACE_PARENT_HEADER, x as TheoError, W as W3CTraceContext, _ as _resetMiddlewareCacheForTests, z as appendCookieToHeaders, A as appendDeleteCookieToHeaders, D as callProcedure, G as createCorsHandler, I as createCorsWebHandler, J as createOpenApiHandler, K as createServerContext, L as deleteCookie, Q as envelopeCodeToStatus, V as executeAction, X as executeRoute, Y as executeWebRequest, Z as extractTraceId, $ as extractTraceIdFromRequest, a0 as extractW3CTraceContext, a1 as fromUnknown, a2 as getCookie, a3 as getCookieFromRequest, a4 as handleBatchRequest, a5 as handleRequestError, a6 as handleWebRequestError, a7 as jsonTransformer, a8 as loadCustomErrorPages, a9 as matchesOrigin, aa as parseCookieHeader, ab as parseRequestBody, ac as parseTraceparent, ad as parseTraceparentContext, ae as resolveTransformer, af as runMiddlewareAndContext, ag as sendError, ah as sendJson, ai as serializeCookie, aj as serveStaticFile, ak as serverErrorToEnvelope, al as setCookie, am as superjsonTransformer, an as validateRouteInput } from '../../index-BXGSBlxf.js';
 export { A as ActionError, b as ActionInputError, f as extractUniversalIssues, i as isActionError, d as isInputError } from '../../action-protocol-tGm3NKRg.js';
 import '../../error-envelope-DG47lt8E.js';
 import 'node:http';
@@ -10,5 +10,5 @@ import 'vite';
 import '../../csrf-Dgot9qSM.js';
 import '../../audit-log-BQWM5YLG.js';
 import 'zod';
-import '../../route-config-Cm_ZMA1C.js';
-import '../../route-policy-BxOycCDq.js';
+import '../../route-config-B7FaTSby.js';
+import '../../route-policy-BHXQDzBF.js';

package/dist/server/http/index.js

@@ -6,7 +6,7 @@ import {
   createOpenApiHandler,
   loadCustomErrorPages,
   serveStaticFile
-} from "../../chunk-KQ27YDLG.js";
+} from "../../chunk-4BQIJ4HE.js";
 import {
   jsonTransformer,
   resolveTransformer,
@@ -31,7 +31,7 @@ import {
   sendError,
   sendJson,
   validateRouteInput
-} from "../../chunk-JW5UFKQ3.js";
+} from "../../chunk-5AGNZXHJ.js";
 import "../../chunk-P6OS7652.js";
 import {
   ActionError,
@@ -41,7 +41,7 @@ import {
   isInputError
 } from "../../chunk-ZDUO4IYN.js";
 import "../../chunk-D4VP2QPR.js";
-import "../../chunk-YN4W7LCX.js";
+import "../../chunk-ENRT6DAU.js";
 import "../../chunk-47FFT43U.js";
 import {
   FileTooLargeError,

package/dist/server/index.d.ts

@@ -1,10 +1,11 @@
-import { R as RouteConfig } from '../route-config-Cm_ZMA1C.js';
+import { R as RouteConfig } from '../route-config-B7FaTSby.js';
 export { ActionAccept, ActionBuilder, ActionConfig, ChannelHandler, MiddlewareBuilder, MiddlewareHandler, PluginBuilder, RouteBuilder, ToolBuilder, WebChannelHandler, WebSocketBuilder, action, defineChannel, defineWebChannel, middleware, plugin, route, tool, uiMessageStreamResponse, websocket } from './define/index.js';
 export { W as WebSocketHandler, a as WebSocketHandlerWeb, b as WebSocketLike } from '../define-websocket-DzPn1sR6.js';
 export { C as CustomTool, D as DefineAgentToolSpec, T as ToolContextMessage, a as ToolHandlerContext, b as ToolTransform, c as applyTransform } from '../define-agent-tool-aYYLpMeo.js';
-export { A as AccessDecision, R as RoutePolicy, b as RoutePolicyInput, a as RouteSubject, e as evaluateRoutePolicy, r as requireOwner, s as subjectFromContext } from '../route-policy-BxOycCDq.js';
+export { A as AccessDecision, R as RoutePolicy, b as RoutePolicyInput, a as RouteSubject, e as evaluateRoutePolicy, r as requireOwner, s as subjectFromContext } from '../route-policy-BHXQDzBF.js';
+export { b as HookName, H as HookResult, O as OnErrorHook, c as OnRequestHook, d as OnResponseHook, P as PluginContext, e as PluginErrorContext, f as PreHandlerHook, R as RunHookOptions, a as TheoApp, T as TheoPlugin } from '../plugin-types-BUVfUQ0V.js';
 export { H as HEALTH_PATH, a as HealthRouteConfig, b as READY_PATH, c as ReadyRouteConfig, d as ReservedResponse, R as ReservedRoutes, e as defineHealthRoute, f as defineReadyRoute, s as serveReservedRoute } from '../health-route-C0hk64_U.js';
-export { B as BATCH_PATH, a as BatchExecuteFn, b as BatchPathConflictError, c as BatchPayload, d as BatchRequestItem, e as BatchResponse, f as BatchResultItem, g as BodyParserOptions, C as CookieOptions, h as CorsConfig, i as CorsHandler, j as CorsOrigin, k as CorsWebHandler, l as CustomErrorPages, E as ExecuteActionOptions, m as ExecuteRouteContext, F as FileTooLargeError, H as HandleBatchOptions, M as MAX_ERROR_HTML_BYTES, n as MiddlewareResult, N as NotFoundError, O as OpenApiDocsOptions, P as ParsedBody, o as ProcedureInput, p as ProcedureInputError, q as ProcedureOutputError, R as RawRouteInput, r as RouteInputChannel, s as RouteInputSchemas, t as RouteInputValidation, S as STRIPPED_HEADERS, u as SendErrorInput, v as SendErrorOptions, T as TRACE_HEADER, w as TRACE_PARENT_HEADER, x as TheoError, y as TheoTransformer, U as UploadedFile, W as W3CTraceContext, _ as _resetMiddlewareCacheForTests, z as appendCookieToHeaders, A as appendDeleteCookieToHeaders, D as callProcedure, G as createCorsHandler, I as createCorsWebHandler, J as createOpenApiHandler, K as createServerContext, L as deleteCookie, Q as envelopeCodeToStatus, V as executeAction, X as executeRoute, Y as executeWebRequest, Z as extractTraceId, $ as extractTraceIdFromRequest, a0 as extractW3CTraceContext, a1 as fromUnknown, a2 as getCookie, a3 as getCookieFromRequest, a4 as handleBatchRequest, a5 as handleRequestError, a6 as handleWebRequestError, a7 as jsonTransformer, a8 as loadCustomErrorPages, a9 as matchesOrigin, aa as parseCookieHeader, ab as parseRequestBody, ac as parseTraceparent, ad as parseTraceparentContext, ae as resolveTransformer, af as runMiddlewareAndContext, ag as sendError, ah as sendJson, ai as serializeCookie, aj as serveStaticFile, ak as serverErrorToEnvelope, al as setCookie, am as superjsonTransformer, an as validateRouteInput } from '../index-ADEV6pen.js';
+export { B as BATCH_PATH, a as BatchExecuteFn, b as BatchPathConflictError, c as BatchPayload, d as BatchRequestItem, e as BatchResponse, f as BatchResultItem, g as BodyParserOptions, C as CookieOptions, h as CorsConfig, i as CorsHandler, j as CorsOrigin, k as CorsWebHandler, l as CustomErrorPages, E as ExecuteActionOptions, m as ExecuteRouteContext, F as FileTooLargeError, H as HandleBatchOptions, M as MAX_ERROR_HTML_BYTES, n as MiddlewareResult, N as NotFoundError, O as OpenApiDocsOptions, P as ParsedBody, o as ProcedureInput, p as ProcedureInputError, q as ProcedureOutputError, R as RawRouteInput, r as RouteInputChannel, s as RouteInputSchemas, t as RouteInputValidation, S as STRIPPED_HEADERS, u as SendErrorInput, v as SendErrorOptions, T as TRACE_HEADER, w as TRACE_PARENT_HEADER, x as TheoError, y as TheoTransformer, U as UploadedFile, W as W3CTraceContext, _ as _resetMiddlewareCacheForTests, z as appendCookieToHeaders, A as appendDeleteCookieToHeaders, D as callProcedure, G as createCorsHandler, I as createCorsWebHandler, J as createOpenApiHandler, K as createServerContext, L as deleteCookie, Q as envelopeCodeToStatus, V as executeAction, X as executeRoute, Y as executeWebRequest, Z as extractTraceId, $ as extractTraceIdFromRequest, a0 as extractW3CTraceContext, a1 as fromUnknown, a2 as getCookie, a3 as getCookieFromRequest, a4 as handleBatchRequest, a5 as handleRequestError, a6 as handleWebRequestError, a7 as jsonTransformer, a8 as loadCustomErrorPages, a9 as matchesOrigin, aa as parseCookieHeader, ab as parseRequestBody, ac as parseTraceparent, ad as parseTraceparentContext, ae as resolveTransformer, af as runMiddlewareAndContext, ag as sendError, ah as sendJson, ai as serializeCookie, aj as serveStaticFile, ak as serverErrorToEnvelope, al as setCookie, am as superjsonTransformer, an as validateRouteInput } from '../index-BXGSBlxf.js';
 export { A as ActionError, a as ActionErrorCode, b as ActionInputError, e as ActionManifestEntry, c as ActionResult, S as SerializedActionResult, U as UniversalZodIssue, f as extractUniversalIssues, i as isActionError, d as isInputError } from '../action-protocol-tGm3NKRg.js';
 export { ACTION_SCHEMAS_DIR, ActionNode, ActionScanError, LoadedManifest, ManifestAction, ManifestAgent, ManifestRoute, ManifestWebSocket, TheoManifest, WebSocketRouteNode, _resetRouteScanCacheForTests, compareRouteSpecificity, generateManifest, loadManifest, scanMiddlewares, scanServerActions, scanServerActionsEnriched, scanServerRoutes, scanWebSocketRoutes, writeManifest } from './scan/index.js';
 export { L as LoadModule, S as ServerRouteNode, c as compilePattern, a as createProductionLoader, b as createViteLoader, m as matchRoute } from '../match-Dw4CNXJH.js';
@@ -36,7 +37,6 @@ export { G as GenericFactory, b as PoolLike, P as PostgresDatabaseConfig, d as R
 export { BodyTooLargeError, DEFAULT_MAX_BODY_BYTES, DiscordWebhookOptions, GitHubWebhookOptions, RawBodyResult, ReadRawBodyOptions, SlackWebhookOptions, StripeWebhookOptions, TelegramWebhookOptions, defineWebhook, discord, dispatchWebhook, github, readRawBody, slack, stripe, telegram, timingSafeEqual } from './webhook/index.js';
 export { D as DefineWebhookOptions, S as SubscribeFn, a as SubscribeResult, V as VerifyFn, b as VerifyResult, W as WebhookContext, c as WebhookDefinition, d as WhatsAppSubscribeOptions, e as WhatsAppWebhookOptions, w as whatsapp, f as whatsappSubscribe } from '../whatsapp-D_Fnl1LX.js';
 import { z } from 'zod';
-export { b as HookName, H as HookResult, O as OnErrorHook, c as OnRequestHook, d as OnResponseHook, P as PluginContext, e as PluginErrorContext, f as PreHandlerHook, R as RunHookOptions, a as TheoApp, T as TheoPlugin } from '../plugin-types-BUVfUQ0V.js';
 export { ComposeInstructionsOptions, ComposedInstructions, ConfigLayer, ContextPressure, ContextPressureThresholdError, ContextPressureThresholds, CustomCommand, CustomCommandsResult, DEFAULT_CONTEXT_PRESSURE_THRESHOLDS, InstructionBlock, InstructionSource, InstructionTree, InstructionTreeBudget, LayerOutOfOrderError, LayeredConfig, LayeredConfigInput, LayeredConfigResult, LoadCustomCommandsInput, LoadInstructionTreeInput, ParsedFrontmatter, PrecedenceReport, ProvenancePerKey, TrustRecord, TrustStore, TrustStorePermissionsError, composeInstructions, contextPressure, effectiveContextWindow, frontmatterValue, loadCustomCommands, loadInstructionTree, splitFrontmatter } from '@theokit/agents/config';
 export { a as ServiceDefinition, S as ServicesConfig, b as ServicesConfigInput, c as ServicesConfigOutput } from '../schema-BdakLtuC.js';
 export { C as CspMode, D as DEFAULT_CSP, a as DEFAULT_PERMISSIONS_POLICY, c as SecurityEnv, S as SecurityHeadersConfig, d as SecurityHeadersOptions, b as buildSecurityHeaders } from '../security-headers-C2cByfJn.js';

package/dist/server/index.js

@@ -43,7 +43,7 @@ import {
   createOpenApiHandler,
   loadCustomErrorPages,
   serveStaticFile
-} from "../chunk-KQ27YDLG.js";
+} from "../chunk-4BQIJ4HE.js";
 import {
   DuplicateJobNameError,
   InMemoryJobBackend,
@@ -117,7 +117,7 @@ import {
   sendError,
   sendJson,
   validateRouteInput
-} from "../chunk-JW5UFKQ3.js";
+} from "../chunk-5AGNZXHJ.js";
 import {
   CSRF_WARN_CODE,
   CSRF_WARN_DOCS_URL,
@@ -138,7 +138,7 @@ import {
   evaluateRoutePolicy,
   requireOwner,
   subjectFromContext
-} from "../chunk-YN4W7LCX.js";
+} from "../chunk-ENRT6DAU.js";
 import {
   DuplicateContextKeyError,
   createOutbox,

package/dist/{server-boundary-X52AMCKI.js → server-boundary-7BRS2CWI.js}

@@ -3,7 +3,7 @@ import "tsx/esm";
 import {
   resolveTheoRootDir
 } from "./chunk-FDOOBTXJ.js";
-import "./chunk-GZ5YHD5H.js";
+import "./chunk-KVZQJ3ZM.js";
 import "./chunk-WFIAYPBH.js";
 import "./chunk-L4TB6FXQ.js";
 import "./chunk-VV2VU3LJ.js";
@@ -131,4 +131,4 @@ export {
   ServerOnlyImportError,
   serverOnlyImportBoundary
 };
-//# sourceMappingURL=server-boundary-X52AMCKI.js.map
+//# sourceMappingURL=server-boundary-7BRS2CWI.js.map

package/dist/{server-boundary-JG53VI6L.js → server-boundary-OEBKNBEP.js}

@@ -1,15 +1,15 @@
 import {
   resolveTheoRootDir
 } from "./chunk-7NRFZBAL.js";
-import "./chunk-WOANPZBT.js";
-import "./chunk-DMODPX7P.js";
+import "./chunk-Q3UE7WIM.js";
+import "./chunk-H2X5T45M.js";
 import "./chunk-EYRWD2AB.js";
 import "./chunk-5GZROLDV.js";
-import "./chunk-JW5UFKQ3.js";
+import "./chunk-5AGNZXHJ.js";
 import "./chunk-P6OS7652.js";
 import "./chunk-ZDUO4IYN.js";
 import "./chunk-D4VP2QPR.js";
-import "./chunk-YN4W7LCX.js";
+import "./chunk-ENRT6DAU.js";
 import "./chunk-47FFT43U.js";
 import "./chunk-NTDN54XO.js";
 import "./chunk-PVNMLZ5G.js";
@@ -147,4 +147,4 @@ export {
   ServerOnlyImportError,
   serverOnlyImportBoundary
 };
-//# sourceMappingURL=server-boundary-JG53VI6L.js.map
+//# sourceMappingURL=server-boundary-OEBKNBEP.js.map