theokit 0.60.0 → 0.62.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (92) hide show
  1. package/dist/{actions-virtual-module-UE5H42GP.js → actions-virtual-module-LXENSB3L.js} +3 -3
  2. package/dist/{actions-virtual-module-DNOALUTX.js → actions-virtual-module-PBYOQTLB.js} +6 -6
  3. package/dist/adapters/agent-mount.d.ts +11 -3
  4. package/dist/adapters/agent-mount.js +3 -3
  5. package/dist/{agent-VWPSEDXD.js → agent-YNHEKPD6.js} +3 -3
  6. package/dist/{app-typed-client-MKTSLES3.js → app-typed-client-VZN2ISQX.js} +6 -6
  7. package/dist/{app-typed-client-4KLNKET6.js → app-typed-client-Z5AKRLSU.js} +3 -3
  8. package/dist/{build-RG54DH3F.js → build-TFH2T26B.js} +4 -4
  9. package/dist/{bun-MAAG4MKW.js → bun-DJ6QEFIP.js} +2 -2
  10. package/dist/{chunk-KQ27YDLG.js → chunk-4BQIJ4HE.js} +3 -3
  11. package/dist/{chunk-IZTOGKLS.js → chunk-4LQKAWZJ.js} +3 -3
  12. package/dist/{chunk-JW5UFKQ3.js → chunk-5AGNZXHJ.js} +2 -2
  13. package/dist/{chunk-XES7ZE2K.js → chunk-BAXPERIV.js} +3 -3
  14. package/dist/{chunk-DMODPX7P.js → chunk-CY5WKIM5.js} +17 -5
  15. package/dist/{chunk-DMODPX7P.js.map → chunk-CY5WKIM5.js.map} +1 -1
  16. package/dist/{chunk-YN4W7LCX.js → chunk-ENRT6DAU.js} +6 -1
  17. package/dist/chunk-ENRT6DAU.js.map +1 -0
  18. package/dist/{chunk-45XETXSG.js → chunk-JI365DWM.js} +32 -2
  19. package/dist/chunk-JI365DWM.js.map +1 -0
  20. package/dist/{chunk-KZ3PXNPT.js → chunk-MIPHNT4J.js} +3 -3
  21. package/dist/chunk-MIPHNT4J.js.map +1 -0
  22. package/dist/{chunk-M2WC5MF7.js → chunk-O55RLSGG.js} +2 -2
  23. package/dist/chunk-O55RLSGG.js.map +1 -0
  24. package/dist/{chunk-ETKLM6UN.js → chunk-PGYYVOM3.js} +11 -11
  25. package/dist/chunk-PGYYVOM3.js.map +1 -0
  26. package/dist/{chunk-WOANPZBT.js → chunk-Q3UE7WIM.js} +2 -2
  27. package/dist/{chunk-K3DUUEQ5.js → chunk-UK2WVX5G.js} +13 -13
  28. package/dist/chunk-UK2WVX5G.js.map +1 -0
  29. package/dist/{chunk-GZ5YHD5H.js → chunk-UZFOWYAQ.js} +21 -4
  30. package/dist/chunk-UZFOWYAQ.js.map +1 -0
  31. package/dist/{chunk-WFIAYPBH.js → chunk-YVHQ35RT.js} +32 -2
  32. package/dist/chunk-YVHQ35RT.js.map +1 -0
  33. package/dist/cli/index.js +6 -6
  34. package/dist/{cloudflare-F5DNYH4B.js → cloudflare-UYKOO6EP.js} +2 -2
  35. package/dist/{deno-deploy-47E7GIME.js → deno-deploy-W2JWCYPT.js} +2 -2
  36. package/dist/{dev-5ETOFKOP.js → dev-FUQFN7PQ.js} +5 -5
  37. package/dist/{index-ADEV6pen.d.ts → index-BXGSBlxf.d.ts} +1 -1
  38. package/dist/index.js +6 -6
  39. package/dist/{internal-api-3YDGG5FF.js → internal-api-D4LIZ3S6.js} +6 -6
  40. package/dist/{internal-api-UM77XDXN.js → internal-api-HXKRFUXR.js} +3 -3
  41. package/dist/{mcp-B42ISIJG.js → mcp-7MSZDEKX.js} +3 -3
  42. package/dist/{preview-XP77EPTL.js → preview-CCL7SKCG.js} +3 -3
  43. package/dist/{provider-resolver-1aWi_WSz.d.ts → provider-resolver-Cc9C3-Rb.d.ts} +8 -0
  44. package/dist/{registry-APCN3PSJ.js → registry-PAJOMMVV.js} +4 -4
  45. package/dist/{route-config-Cm_ZMA1C.d.ts → route-config-B7FaTSby.d.ts} +1 -1
  46. package/dist/{route-policy-BxOycCDq.d.ts → route-policy-BHXQDzBF.d.ts} +20 -1
  47. package/dist/server/agent/index.d.ts +1 -1
  48. package/dist/server/agent/index.js +1 -1
  49. package/dist/server/define/index.d.ts +5 -4
  50. package/dist/server/define/index.js +1 -1
  51. package/dist/server/http/index.d.ts +3 -3
  52. package/dist/server/http/index.js +3 -3
  53. package/dist/server/index.d.ts +5 -5
  54. package/dist/server/index.js +4 -4
  55. package/dist/{server-boundary-X52AMCKI.js → server-boundary-6PGQB5XT.js} +3 -3
  56. package/dist/{server-boundary-JG53VI6L.js → server-boundary-QHWMBDKT.js} +6 -6
  57. package/dist/{start-3FYIYTM7.js → start-K4O5J7JA.js} +7 -7
  58. package/dist/{start-3FYIYTM7.js.map → start-K4O5J7JA.js.map} +1 -1
  59. package/dist/vite-plugin/index.js +6 -6
  60. package/dist/{vite-plugin-BG5K3L46.js → vite-plugin-675YOCHV.js} +5 -5
  61. package/package.json +2 -2
  62. package/dist/chunk-45XETXSG.js.map +0 -1
  63. package/dist/chunk-ETKLM6UN.js.map +0 -1
  64. package/dist/chunk-GZ5YHD5H.js.map +0 -1
  65. package/dist/chunk-K3DUUEQ5.js.map +0 -1
  66. package/dist/chunk-KZ3PXNPT.js.map +0 -1
  67. package/dist/chunk-M2WC5MF7.js.map +0 -1
  68. package/dist/chunk-WFIAYPBH.js.map +0 -1
  69. package/dist/chunk-YN4W7LCX.js.map +0 -1
  70. /package/dist/{actions-virtual-module-UE5H42GP.js.map → actions-virtual-module-LXENSB3L.js.map} +0 -0
  71. /package/dist/{actions-virtual-module-DNOALUTX.js.map → actions-virtual-module-PBYOQTLB.js.map} +0 -0
  72. /package/dist/{agent-VWPSEDXD.js.map → agent-YNHEKPD6.js.map} +0 -0
  73. /package/dist/{app-typed-client-MKTSLES3.js.map → app-typed-client-VZN2ISQX.js.map} +0 -0
  74. /package/dist/{app-typed-client-4KLNKET6.js.map → app-typed-client-Z5AKRLSU.js.map} +0 -0
  75. /package/dist/{build-RG54DH3F.js.map → build-TFH2T26B.js.map} +0 -0
  76. /package/dist/{bun-MAAG4MKW.js.map → bun-DJ6QEFIP.js.map} +0 -0
  77. /package/dist/{chunk-KQ27YDLG.js.map → chunk-4BQIJ4HE.js.map} +0 -0
  78. /package/dist/{chunk-IZTOGKLS.js.map → chunk-4LQKAWZJ.js.map} +0 -0
  79. /package/dist/{chunk-JW5UFKQ3.js.map → chunk-5AGNZXHJ.js.map} +0 -0
  80. /package/dist/{chunk-XES7ZE2K.js.map → chunk-BAXPERIV.js.map} +0 -0
  81. /package/dist/{chunk-WOANPZBT.js.map → chunk-Q3UE7WIM.js.map} +0 -0
  82. /package/dist/{cloudflare-F5DNYH4B.js.map → cloudflare-UYKOO6EP.js.map} +0 -0
  83. /package/dist/{deno-deploy-47E7GIME.js.map → deno-deploy-W2JWCYPT.js.map} +0 -0
  84. /package/dist/{dev-5ETOFKOP.js.map → dev-FUQFN7PQ.js.map} +0 -0
  85. /package/dist/{internal-api-3YDGG5FF.js.map → internal-api-D4LIZ3S6.js.map} +0 -0
  86. /package/dist/{internal-api-UM77XDXN.js.map → internal-api-HXKRFUXR.js.map} +0 -0
  87. /package/dist/{mcp-B42ISIJG.js.map → mcp-7MSZDEKX.js.map} +0 -0
  88. /package/dist/{preview-XP77EPTL.js.map → preview-CCL7SKCG.js.map} +0 -0
  89. /package/dist/{registry-APCN3PSJ.js.map → registry-PAJOMMVV.js.map} +0 -0
  90. /package/dist/{server-boundary-X52AMCKI.js.map → server-boundary-6PGQB5XT.js.map} +0 -0
  91. /package/dist/{server-boundary-JG53VI6L.js.map → server-boundary-QHWMBDKT.js.map} +0 -0
  92. /package/dist/{vite-plugin-BG5K3L46.js.map → vite-plugin-675YOCHV.js.map} +0 -0
@@ -0,0 +1 @@
1
+ {"version":3,"sources":["../src/adapters/deployed-agents.ts","../src/adapters/deployed-plugins-module.ts"],"sourcesContent":["/**\n * Serving an agent from a generated deploy entry (usetheokit/theokit#367).\n *\n * ## The gap this closes\n *\n * `grep -rc \"agent\" packages/theo/src/adapters/*.ts` used to return nothing across 14 files. The\n * notion did not exist in this layer at all: every generated entry routes `/api/` exclusively\n * through `scanServerRoutes` + `executeRoute`, and an agent is a DIFFERENT scan served by a\n * DIFFERENT function — `scanAgents` + `mountAgent`. So `/api/agents/chat` matched no file route and\n * fell into `notFoundResponse()` on every target.\n *\n * For a framework whose stated reason to exist is \"the agent is a file, delivered by the same\n * pipeline that serves the page\", that is the gap which contradicts the sentence: the agent was\n * delivered by no pipeline at all outside a machine running `theokit start`.\n *\n * ## Why baking, and why `../../`\n *\n * A Worker has no filesystem to scan and no path to `import()`, which is the same reason routes are\n * baked (#369). The agent modules are resolved on the build machine and emitted as static imports,\n * relative to the entry's directory — every target that can do this writes two levels below the\n * project root, so the arithmetic is the one `renderBakedRoutes` already does.\n *\n * ## Which targets can do it\n *\n * Only the ones whose output is BUNDLED from the project: `cloudflare` (wrangler), `bun` and\n * `deno-deploy` resolve the emitted import against the app's own source tree. `vercel`, `netlify`\n * and `aws-lambda` receive a standalone function directory that never sees the app's modules, so\n * an agent cannot travel there by this road at all. Same split as plugins (#425), same cause.\n *\n * ## The table is keyed by NAME\n *\n * The URL carries the name, the access policy is judged under the name, and the run's spans are\n * labelled with it (#406). Keying by file path would make the lookup depend on the server's\n * directory layout — which changes per deploy, and which is exactly the value #406 removed from\n * telemetry for the same reason.\n */\n\n/** One agent, as `scanAgents` reports it. Structural, so the adapters need no `server/` import. */\nexport interface DeployedAgent {\n /** Path relative to the project root — the specifier the static import uses. */\n readonly filePath: string\n /** The URL the agent answers on. */\n readonly agentPath: string\n /** The agent's NAME — what the URL carries, the policy is judged under, and spans are labelled. */\n readonly name: string\n}\n\nexport interface DeployedAgentsFragment {\n /** Top-level imports of the agent modules. */\n readonly imports: string[]\n /** Module-scope declarations — the name→module table. */\n readonly declarations: string[]\n /** The request-handler branch, to be emitted before the file-route table is consulted. */\n readonly branch: string[]\n}\n\nconst EMPTY: DeployedAgentsFragment = { imports: [], declarations: [], branch: [] }\n\n/**\n * How the host entry names the things this branch has to use.\n *\n * The fragment is generated code injected into three entries that do NOT agree on their own\n * vocabulary — Bun reads `pathname`, Cloudflare reads `url.pathname`; Deno calls `notFound()`,\n * Cloudflare calls `notFoundResponse()`; Cloudflare wraps each branch in the security baseline\n * while Bun and Deno wrap once at the caller; Deno resolves npm packages with an `npm:` prefix.\n *\n * Naming those differences is what keeps this ONE fragment. The alternative — three near-identical\n * branches, one per adapter — is the copy that `serveThroughPluginLifecycle` was extracted to undo\n * after it had drifted five ways (#405).\n */\n/**\n * How the target REACHES its agent modules — and the two answers are genuinely different, not a\n * copy waiting to be merged.\n *\n * A Worker has no filesystem: its agents must be resolved on the build machine and emitted as\n * static imports, which is what `renderBakedRoutes` already does for routes there. Bun and Deno DO\n * have a filesystem and already scan their routes at request time; making them bake would couple an\n * agent's existence to a rebuild for no gain. The split mirrors the one routes already have on\n * exactly these targets, which is the argument for keeping it.\n */\nexport type DeployedAgentsSource =\n | {\n readonly kind: 'baked'\n /** Scanned on the build machine, emitted as static imports. */\n readonly agents: readonly DeployedAgent[]\n }\n | {\n readonly kind: 'scan'\n /** Expression yielding the project root at runtime. */\n readonly projectRoot: string\n /** Expression yielding the module loader the entry already builds. */\n readonly loadModule: string\n /**\n * A statement that guarantees `loadModule` is usable, for a host that builds its loader\n * lazily. Deno's `loaderCache` is created on the route path, which runs AFTER this branch —\n * so without this the agent branch would call `null`.\n */\n readonly ensureLoader?: string\n }\n\nexport interface DeployedAgentsHost {\n /** Expression yielding the request path inside the handler. Default `url.pathname`. */\n readonly pathname?: string\n /** Call producing the 404 response. Default `notFoundResponse()`. */\n readonly notFound?: string\n /** Whether THIS branch applies the security baseline, or the caller already does. */\n readonly wrapSecurityHeaders?: boolean\n /** Prefix for bare package specifiers. Deno needs `npm:`; the others need nothing. */\n readonly importPrefix?: string\n}\n\n/** The prefix the agent convention owns. Matches `handlers.ts`'s own `tryServeAgent`. */\nconst AGENT_PREFIX = '/api/agents/'\n\n/**\n * What a deployed entry needs in order to serve the app's agents.\n *\n * @param agents - the agents scanned on the build machine. Empty emits nothing at all.\n */\nexport function deployedAgentsFragment(\n source: DeployedAgentsSource | undefined,\n host: DeployedAgentsHost = {},\n): DeployedAgentsFragment {\n if (source === undefined) return EMPTY\n if (source.kind === 'baked' && source.agents.length === 0) return EMPTY\n\n const pathname = host.pathname ?? 'url.pathname'\n const notFound = host.notFound ?? 'notFoundResponse()'\n const prefix = host.importPrefix ?? ''\n\n const resolution =\n source.kind === 'baked' ? bakedResolution(source.agents) : scannedResolution(source)\n\n return {\n imports: [\n // `theokit/adapters/agent-mount`, not `theokit/server`: `mount-agent` is deliberately not on\n // the app-facing surface (ADR 0041), and a generated entry is not an app. See that module.\n `import { mountAgent, resolveProvider${source.kind === 'scan' ? ', scanAgents' : ''} } from '${prefix}theokit/adapters/agent-mount'`,\n ...resolution.imports,\n ],\n declarations: resolution.declarations,\n branch: [\n ` // #367 — the agent convention owns this prefix. It is answered BEFORE the file-route`,\n ` // table because an agent matches no file route: falling through is how a deployed`,\n ` // \\`/api/agents/<name>\\` used to 404 on every target.`,\n ` if (${pathname}.startsWith(${JSON.stringify(AGENT_PREFIX)})) {`,\n ` const agentName = ${pathname}.slice(${String(AGENT_PREFIX.length)}).split('/')[0]`,\n ...resolution.lookup,\n ` // A name nobody scanned is a 404, exactly like any other unknown path. Handing`,\n ` // \\`undefined\\` to mountAgent would surface as a 500 for what is a routing miss.`,\n ` if (mod === undefined) return ${notFound}`,\n ` const agentResponse = await mountAgent(mod, request, (model, plugins) => resolveProvider(model, { plugins }).apiKey, {`,\n ` agentName,`,\n ` ...CSRF_CONFIG,`,\n ` })`,\n host.wrapSecurityHeaders === true\n ? ` return withSecurityHeaders(agentResponse, SECURITY_HEADERS)`\n : ` return agentResponse`,\n ` }`,\n ],\n }\n}\n\ninterface AgentResolution {\n imports: string[]\n declarations: string[]\n /** Lines that must leave `mod` bound to the agent's module, or `undefined`. */\n lookup: string[]\n}\n\n/** No filesystem: every agent module is a static import decided on the build machine. */\nfunction bakedResolution(agents: readonly DeployedAgent[]): AgentResolution {\n const varOf = (index: number): string => `__theoAgent${String(index)}`\n return {\n imports: agents.map(\n (agent, index) => `import * as ${varOf(index)} from '../../${agent.filePath}'`,\n ),\n declarations: [\n `// #367 — the app's agents, keyed by NAME because that is what the URL carries, what the`,\n `// access policy is judged under, and what the run's spans are labelled with (#406).`,\n `const agents = {`,\n ...agents.map((agent, index) => ` ${JSON.stringify(agent.name)}: ${varOf(index)},`),\n `}`,\n ],\n lookup: [\n ` const mod = Object.prototype.hasOwnProperty.call(agents, agentName)`,\n ` ? agents[agentName]`,\n ` : undefined`,\n ],\n }\n}\n\n/** A filesystem: scan once and load on demand, exactly as this entry already treats its routes. */\nfunction scannedResolution(source: {\n projectRoot: string\n loadModule: string\n ensureLoader?: string\n}): AgentResolution {\n return {\n imports: [],\n declarations: [\n `// #367 — scanned on first use and cached, the same shape this entry already gives routes.`,\n `// Baking would tie an agent's existence to a rebuild on a target that has a filesystem.`,\n `let agentsCache = null`,\n ],\n lookup: [\n ...(source.ensureLoader === undefined ? [] : [` ${source.ensureLoader}`]),\n ` if (!agentsCache) agentsCache = scanAgents(${source.projectRoot})`,\n ` const agentNode = agentsCache.find((a) => a.name === agentName)`,\n ` const mod = agentNode === undefined ? undefined : await ${source.loadModule}(agentNode.filePath)`,\n ],\n }\n}\n","/**\n * The plugins module a build writes beside a deployed entry (usetheokit/theokit#425).\n *\n * ## What it is for\n *\n * `config.plugins` used to reach no deployed target at all, so `onRequest`, `preHandler`,\n * `onResponse` and `onError` were dead on every Web-standards deployment while firing locally. The\n * reason was never the hook loop — `executeRoute` has always run it — but that a constructed\n * plugin closes over state, and there is no literal for a closure.\n *\n * A plugin declared as a module SPECIFIER can be carried, because the build can emit a static\n * import for it. That is the road `renderBakedRoutes` already takes for route modules (#369):\n * resolve on the build machine, emit a static specifier, let the target's bundler see through it.\n *\n * ## Why the specifier is `../../`\n *\n * Every target that can carry plugins writes its entry two levels below the project root —\n * `.theokit/cloudflare/`, `.theokit/bun/`, `.theokit/deno/` — and a declared specifier is relative\n * to that root. The same arithmetic `renderBakedRoutes` does for routes, for the same reason.\n *\n * ## Which targets can carry them at all\n *\n * Only the ones whose output is BUNDLED from the project: Cloudflare (wrangler), Bun and Deno all\n * resolve the emitted import against the app's own source tree. Vercel, Netlify and AWS Lambda\n * receive a standalone function directory and never see the app's modules, so for them a named\n * refusal — which `findUnappliedConfig` already prints — remains the honest answer, and this module\n * is not called.\n */\n\n/**\n * A plugin the build was asked to carry and cannot.\n *\n * Its own type because the alternative is the defect this whole issue is: hooks that do not fire\n * and nothing that says so. A target that CAN carry a named module but was handed a closure has\n * something actionable to say, so it says it at build time rather than at the first request\n * (`rules/three-target-parity.md` § 3 — refuse by name).\n */\nexport class UnbakeablePluginError extends Error {\n constructor(index: number, name: string, target: string) {\n super(\n `plugins[${index}] (\"${name}\") cannot be carried to the ${target} target: it is a constructed ` +\n `plugin, and a closure has no literal a generated entry could hold. Declare it by module ` +\n `specifier instead — plugins: ['./src/plugins/${name}.ts'] — so the build can emit a ` +\n `static import for it. Both forms work locally; only the specifier survives a deploy.`,\n )\n this.name = 'UnbakeablePluginError'\n }\n}\n\nexport interface DeployedPluginsPlan {\n /** The module source to write beside the entry. */\n readonly source: string\n /** What the entry imports it as — a sibling, because both are written to the same directory. */\n readonly moduleSpecifier: string\n /** The declared specifiers, in order, for the build to report. */\n readonly specifiers: readonly string[]\n}\n\nconst MODULE_FILENAME = 'theo.plugins.mjs'\n\n/**\n * Plan the plugins module for a target that can carry one.\n *\n * @param plugins - the raw `config.plugins` array.\n * @param target - the deploy target, named in the refusal so the message says where it applies.\n * @returns `undefined` when the app declares no plugins, so an app carrying none emits nothing.\n * @throws UnbakeablePluginError when an entry is a constructed plugin rather than a specifier.\n */\nexport function planDeployedPlugins(\n plugins: readonly unknown[] | undefined,\n target: string,\n): DeployedPluginsPlan | undefined {\n if (plugins === undefined || plugins.length === 0) return undefined\n\n const specifiers = plugins.map((entry, index) => {\n if (typeof entry === 'string') return entry\n throw new UnbakeablePluginError(index, nameOf(entry), target)\n })\n\n const vars = specifiers.map((_, i) => `__theoPlugin${String(i)}`)\n\n return {\n moduleSpecifier: `./${MODULE_FILENAME}`,\n specifiers,\n source: [\n `// Generated by Theo — the plugins the deployed entry registers (usetheokit/theokit#425).`,\n `//`,\n `// Static imports, resolved on the build machine. A constructed plugin has no literal, which`,\n `// is why the config declares these by module specifier and why this file can exist at all.`,\n ...specifiers.map((s, i) => `import ${vars[i]} from '${entrySpecifier(s)}'`),\n ``,\n `// Order is DECLARED order, because plugin order is hook order.`,\n `export default { plugins: [${vars.join(', ')}] }`,\n ``,\n ].join('\\n'),\n }\n}\n\n/**\n * How the emitted module names a declared specifier.\n *\n * A RELATIVE specifier is relative to the project root, and the module sits two levels below it, so\n * it is re-based — the arithmetic `renderBakedRoutes` does for routes. A BARE specifier is a package\n * and must be left alone: `../../my-plugin-pkg` is a path that does not exist, where\n * `my-plugin-pkg` is a dependency the target's bundler resolves from `node_modules` like any other.\n */\nfunction entrySpecifier(specifier: string): string {\n if (!specifier.startsWith('.')) return specifier\n return `../../${specifier.replace(/^\\.\\/+/, '')}`\n}\n\n/** The plugin's own name when it has one, so the refusal names the thing the author wrote. */\nfunction nameOf(entry: unknown): string {\n if (entry != null && typeof entry === 'object') {\n const named = (entry as { name?: unknown }).name\n if (typeof named === 'string' && named.length > 0) return named\n }\n return 'unnamed'\n}\n"],"mappings":";;;;AAwDA,IAAM,QAAgC,EAAE,SAAS,CAAC,GAAG,cAAc,CAAC,GAAG,QAAQ,CAAC,EAAE;AAwDlF,IAAM,eAAe;AAOd,SAAS,uBACd,QACA,OAA2B,CAAC,GACJ;AACxB,MAAI,WAAW,OAAW,QAAO;AACjC,MAAI,OAAO,SAAS,WAAW,OAAO,OAAO,WAAW,EAAG,QAAO;AAElE,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,SAAS,KAAK,gBAAgB;AAEpC,QAAM,aACJ,OAAO,SAAS,UAAU,gBAAgB,OAAO,MAAM,IAAI,kBAAkB,MAAM;AAErF,SAAO;AAAA,IACL,SAAS;AAAA;AAAA;AAAA,MAGP,uCAAuC,OAAO,SAAS,SAAS,iBAAiB,EAAE,YAAY,MAAM;AAAA,MACrG,GAAG,WAAW;AAAA,IAChB;AAAA,IACA,cAAc,WAAW;AAAA,IACzB,QAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,QAAQ,eAAe,KAAK,UAAU,YAAY,CAAC;AAAA,MAC9D,2BAA2B,QAAQ,UAAU,OAAO,aAAa,MAAM,CAAC;AAAA,MACxE,GAAG,WAAW;AAAA,MACd;AAAA,MACA;AAAA,MACA,uCAAuC,QAAQ;AAAA,MAC/C;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK,wBAAwB,OACzB,sEACA;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACF;AAUA,SAAS,gBAAgB,QAAmD;AAC1E,QAAM,QAAQ,CAAC,UAA0B,cAAc,OAAO,KAAK,CAAC;AACpE,SAAO;AAAA,IACL,SAAS,OAAO;AAAA,MACd,CAAC,OAAO,UAAU,eAAe,MAAM,KAAK,CAAC,gBAAgB,MAAM,QAAQ;AAAA,IAC7E;AAAA,IACA,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAG,OAAO,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,UAAU,MAAM,IAAI,CAAC,KAAK,MAAM,KAAK,CAAC,GAAG;AAAA,MACnF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAGA,SAAS,kBAAkB,QAIP;AAClB,SAAO;AAAA,IACL,SAAS,CAAC;AAAA,IACV,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,GAAI,OAAO,iBAAiB,SAAY,CAAC,IAAI,CAAC,SAAS,OAAO,YAAY,EAAE;AAAA,MAC5E,oDAAoD,OAAO,WAAW;AAAA,MACtE;AAAA,MACA,iEAAiE,OAAO,UAAU;AAAA,IACpF;AAAA,EACF;AACF;;;AC/KO,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAC/C,YAAY,OAAe,MAAc,QAAgB;AACvD;AAAA,MACE,WAAW,KAAK,OAAO,IAAI,+BAA+B,MAAM,0KAEd,IAAI;AAAA,IAExD;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAWA,IAAM,kBAAkB;AAUjB,SAAS,oBACd,SACA,QACiC;AACjC,MAAI,YAAY,UAAa,QAAQ,WAAW,EAAG,QAAO;AAE1D,QAAM,aAAa,QAAQ,IAAI,CAAC,OAAO,UAAU;AAC/C,QAAI,OAAO,UAAU,SAAU,QAAO;AACtC,UAAM,IAAI,sBAAsB,OAAO,OAAO,KAAK,GAAG,MAAM;AAAA,EAC9D,CAAC;AAED,QAAM,OAAO,WAAW,IAAI,CAAC,GAAG,MAAM,eAAe,OAAO,CAAC,CAAC,EAAE;AAEhE,SAAO;AAAA,IACL,iBAAiB,KAAK,eAAe;AAAA,IACrC;AAAA,IACA,QAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAG,WAAW,IAAI,CAAC,GAAG,MAAM,UAAU,KAAK,CAAC,CAAC,UAAU,eAAe,CAAC,CAAC,GAAG;AAAA,MAC3E;AAAA,MACA;AAAA,MACA,8BAA8B,KAAK,KAAK,IAAI,CAAC;AAAA,MAC7C;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,EACb;AACF;AAUA,SAAS,eAAe,WAA2B;AACjD,MAAI,CAAC,UAAU,WAAW,GAAG,EAAG,QAAO;AACvC,SAAO,SAAS,UAAU,QAAQ,UAAU,EAAE,CAAC;AACjD;AAGA,SAAS,OAAO,OAAwB;AACtC,MAAI,SAAS,QAAQ,OAAO,UAAU,UAAU;AAC9C,UAAM,QAAS,MAA6B;AAC5C,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAAA,EAC5D;AACA,SAAO;AACT;","names":[]}
@@ -12,7 +12,7 @@ import {
12
12
  serveMatchedAuxRoute,
13
13
  serveThroughPluginLifecycle,
14
14
  setupSsrDevMiddleware
15
- } from "./chunk-XES7ZE2K.js";
15
+ } from "./chunk-BAXPERIV.js";
16
16
  import {
17
17
  resolveTheoRootDir
18
18
  } from "./chunk-FDOOBTXJ.js";
@@ -38,11 +38,11 @@ import {
38
38
  mountAgent,
39
39
  readAgentPolicy,
40
40
  writeWebResponseToServerResponse
41
- } from "./chunk-GZ5YHD5H.js";
41
+ } from "./chunk-UZFOWYAQ.js";
42
42
  import {
43
43
  getApprovalRegistry,
44
44
  resolveProvider
45
- } from "./chunk-WFIAYPBH.js";
45
+ } from "./chunk-YVHQ35RT.js";
46
46
  import {
47
47
  createWebRequestSource,
48
48
  dispatchControllerRequest,
@@ -508,7 +508,7 @@ async function serveAux(req, res, next, urlPath, deps) {
508
508
  csrfMode: deps.csrfMode,
509
509
  // M39 — the thread follow-up route drives the agent; resolve the key on demand.
510
510
  // theokit#328 — the thread route drives an agent, so its key follows the model too.
511
- resolveApiKey: (model) => resolveProvider(model).apiKey,
511
+ resolveApiKey: (model, plugins) => resolveProvider(model, { plugins }).apiKey,
512
512
  // usetheokit/theokit#365 — parity with `theokit start`; lazy for the same reason.
513
513
  resolveSubject: createAgentSubjectResolver({
514
514
  req,
@@ -645,7 +645,7 @@ async function serveAgentTurn(t) {
645
645
  },
646
646
  async (request) => {
647
647
  const mod = await loadModule(agent.filePath);
648
- const apiKey = (model) => resolveProvider(model).apiKey;
648
+ const apiKey = (model, plugins) => resolveProvider(model, { plugins }).apiKey;
649
649
  const response = await mountAgent(mod, request, apiKey, {
650
650
  source: agent.filePath,
651
651
  csrfMode,
@@ -786,7 +786,7 @@ async function tryControllerFallthrough(ctx) {
786
786
  // mechanisms and no rule for which wins. What is NOT solved by that: an `@Expose`d agent shares
787
787
  // the conversation store with the convention endpoints, so a guard that admits a caller admits
788
788
  // them to whatever `sessionId` the body names — see the advisory.
789
- serveAgent: (agent, request) => mountAgent(agent, request, (model) => resolveProvider(model).apiKey, {
789
+ serveAgent: (agent, request) => mountAgent(agent, request, (model, plugins) => resolveProvider(model, { plugins }).apiKey, {
790
790
  source: "expose",
791
791
  csrfMode: "off"
792
792
  })
@@ -2179,19 +2179,19 @@ async function theoPluginAsync(rootOrOptions) {
2179
2179
  })
2180
2180
  );
2181
2181
  }
2182
- const { appTypedClientPlugin } = await import("./app-typed-client-4KLNKET6.js");
2182
+ const { appTypedClientPlugin } = await import("./app-typed-client-Z5AKRLSU.js");
2183
2183
  const appClientPlugin = appTypedClientPlugin({
2184
2184
  cwd: projectRoot,
2185
2185
  serverDir: serverDirAbs,
2186
2186
  distDir: resolve5(projectRoot, ".theokit")
2187
2187
  });
2188
- const { actionsVirtualModule } = await import("./actions-virtual-module-UE5H42GP.js");
2188
+ const { actionsVirtualModule } = await import("./actions-virtual-module-LXENSB3L.js");
2189
2189
  const actionsPlugin = actionsVirtualModule({
2190
2190
  serverDir: serverDirAbs,
2191
2191
  distDir: resolve5(projectRoot, ".theokit")
2192
2192
  });
2193
2193
  const { agentsTypedClientPlugin } = await import("./agents-typed-client-D4OA2TXB.js");
2194
- const { generateManifest } = await import("./internal-api-UM77XDXN.js");
2194
+ const { generateManifest } = await import("./internal-api-HXKRFUXR.js");
2195
2195
  const agentsClientPlugin = agentsTypedClientPlugin({
2196
2196
  projectRoot,
2197
2197
  agentsDir: agentsDirName,
@@ -2208,7 +2208,7 @@ async function theoPluginAsync(rootOrOptions) {
2208
2208
  const controllerTransformPlugin = controllerSwcTransformPlugin({
2209
2209
  serverDir: serverDirAbs
2210
2210
  });
2211
- const { serverOnlyImportBoundary } = await import("./server-boundary-X52AMCKI.js");
2211
+ const { serverOnlyImportBoundary } = await import("./server-boundary-6PGQB5XT.js");
2212
2212
  const serverBoundaryPlugin = serverOnlyImportBoundary({
2213
2213
  projectRoot,
2214
2214
  serverDir: serverDirAbs
@@ -2383,4 +2383,4 @@ export {
2383
2383
  theoPluginAsync,
2384
2384
  theoPlugin
2385
2385
  };
2386
- //# sourceMappingURL=chunk-ETKLM6UN.js.map
2386
+ //# sourceMappingURL=chunk-PGYYVOM3.js.map