theokit 0.66.1 → 0.68.0

package/dist/{actions-virtual-module-RMEAW2NX.js → actions-virtual-module-3OPYLD76.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import "tsx/esm";
-import "./chunk-O3EBLVMP.js";
+import "./chunk-G2NWAVGG.js";
 import "./chunk-UETVDZBE.js";
 import "./chunk-QD5X56I3.js";
-import "./chunk-VV2VU3LJ.js";
-import "./chunk-5VLP3GQ2.js";
+import "./chunk-WSMLSIS5.js";
+import "./chunk-MS4A7N77.js";
 import "./chunk-C27VRUVN.js";
 import "./chunk-7UZZHCRN.js";
 import "./chunk-BCFA6LHL.js";
@@ -218,4 +218,4 @@ export const actions = manifest
 export {
   actionsVirtualModule
 };
-//# sourceMappingURL=actions-virtual-module-RMEAW2NX.js.map
+//# sourceMappingURL=actions-virtual-module-3OPYLD76.js.map

package/dist/{actions-virtual-module-LVWXLDCT.js → actions-virtual-module-SE44BKR4.js}

@@ -1,11 +1,11 @@
-import "./chunk-WAYUHS54.js";
+import "./chunk-GDF2XQOO.js";
 import "./chunk-GAJOZJWD.js";
-import "./chunk-EYRWD2AB.js";
-import "./chunk-5GZROLDV.js";
-import "./chunk-5AGNZXHJ.js";
+import "./chunk-WSOAN4KN.js";
+import "./chunk-ENSFCKP6.js";
+import "./chunk-Q7T3UQ4L.js";
 import "./chunk-P6OS7652.js";
 import "./chunk-ZDUO4IYN.js";
-import "./chunk-D4VP2QPR.js";
+import "./chunk-7L7LQ2GU.js";
 import "./chunk-ENRT6DAU.js";
 import "./chunk-47FFT43U.js";
 import "./chunk-NTDN54XO.js";
@@ -234,4 +234,4 @@ export const actions = manifest
 export {
   actionsVirtualModule
 };
-//# sourceMappingURL=actions-virtual-module-LVWXLDCT.js.map
+//# sourceMappingURL=actions-virtual-module-SE44BKR4.js.map

package/dist/adapters/security-headers.d.ts

@@ -1,6 +1,6 @@
 export { g as generateNonce } from '../nonce-BXt7Qu_C.js';
-import { S as SecurityHeadersConfig } from '../security-headers-C2cByfJn.js';
-export { b as buildSecurityHeaders } from '../security-headers-C2cByfJn.js';
+import { S as SecurityHeadersConfig } from '../security-headers-vris2MQq.js';
+export { b as buildSecurityHeaders } from '../security-headers-vris2MQq.js';
 
 /**
  * The security headers a deployed target puts on its responses.

package/dist/adapters/security-headers.js

@@ -1,6 +1,6 @@
 import {
   buildSecurityHeaders
-} from "../chunk-5GZROLDV.js";
+} from "../chunk-ENSFCKP6.js";
 import {
   generateNonce
 } from "../chunk-Z4PJMZLM.js";

package/dist/{agent-OCQA4WXF.js → agent-UBDDP2L5.js}

@@ -3,7 +3,7 @@ import "tsx/esm";
 import {
   agentCommand,
   createAgentSsrLoader
-} from "./chunk-N6XDYNWK.js";
+} from "./chunk-FYYKMPST.js";
 import "./chunk-UETVDZBE.js";
 import "./chunk-5NNFO7R7.js";
 import "./chunk-Z7CJHDLS.js";
@@ -12,4 +12,4 @@ export {
   agentCommand,
   createAgentSsrLoader
 };
-//# sourceMappingURL=agent-OCQA4WXF.js.map
+//# sourceMappingURL=agent-UBDDP2L5.js.map

package/dist/{app-typed-client-J7NWKMS7.js → app-typed-client-BE3PV3JY.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import "tsx/esm";
-import "./chunk-O3EBLVMP.js";
+import "./chunk-G2NWAVGG.js";
 import "./chunk-UETVDZBE.js";
 import {
   scanControllerModules
 } from "./chunk-QD5X56I3.js";
-import "./chunk-VV2VU3LJ.js";
-import "./chunk-5VLP3GQ2.js";
+import "./chunk-WSMLSIS5.js";
+import "./chunk-MS4A7N77.js";
 import "./chunk-C27VRUVN.js";
 import "./chunk-7UZZHCRN.js";
 import {
@@ -411,4 +411,4 @@ export {
   generateClientDts,
   shouldReemitForFile
 };
-//# sourceMappingURL=app-typed-client-J7NWKMS7.js.map
+//# sourceMappingURL=app-typed-client-BE3PV3JY.js.map

package/dist/{app-typed-client-Z4MF5HCB.js → app-typed-client-RAFEBA7S.js}

@@ -1,13 +1,13 @@
 import {
   scanControllerModules
-} from "./chunk-WAYUHS54.js";
+} from "./chunk-GDF2XQOO.js";
 import "./chunk-GAJOZJWD.js";
-import "./chunk-EYRWD2AB.js";
-import "./chunk-5GZROLDV.js";
-import "./chunk-5AGNZXHJ.js";
+import "./chunk-WSOAN4KN.js";
+import "./chunk-ENSFCKP6.js";
+import "./chunk-Q7T3UQ4L.js";
 import "./chunk-P6OS7652.js";
 import "./chunk-ZDUO4IYN.js";
-import "./chunk-D4VP2QPR.js";
+import "./chunk-7L7LQ2GU.js";
 import "./chunk-ENRT6DAU.js";
 import "./chunk-47FFT43U.js";
 import "./chunk-NTDN54XO.js";
@@ -427,4 +427,4 @@ export {
   generateClientDts,
   shouldReemitForFile
 };
-//# sourceMappingURL=app-typed-client-Z4MF5HCB.js.map
+//# sourceMappingURL=app-typed-client-RAFEBA7S.js.map

package/dist/assets-map-BMQASQHW.js

@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+import "tsx/esm";
+
+// src/vite-plugin/assets-map.ts
+var PAGE_FILE = /[/\\]page\.(tsx|ts|jsx|js)$/;
+function routePathForPageFile(appDir, moduleId) {
+  const normalised = moduleId.replace(/\\/g, "/");
+  const root = appDir.replace(/\\/g, "/").replace(/\/$/, "");
+  if (!normalised.startsWith(`${root}/`)) return void 0;
+  if (!PAGE_FILE.test(normalised)) return void 0;
+  const relative = normalised.slice(root.length).replace(PAGE_FILE, "");
+  return relative === "" ? "/" : relative;
+}
+function staticClosure(bundle, start) {
+  const seen = /* @__PURE__ */ new Set();
+  const queue = [start];
+  while (queue.length > 0) {
+    const name = queue.pop();
+    if (name === void 0 || seen.has(name)) continue;
+    seen.add(name);
+    for (const next of bundle[name]?.imports ?? []) queue.push(next);
+  }
+  return seen;
+}
+function buildAssetsMap(bundle, appDir) {
+  const chunks = Object.entries(bundle).filter(
+    (entry) => entry[1]?.type === "chunk"
+  );
+  const alreadyLoaded = /* @__PURE__ */ new Set();
+  for (const [name, chunk] of chunks) {
+    if (chunk.isEntry === true) {
+      for (const reachable of staticClosure(bundle, name)) alreadyLoaded.add(reachable);
+    }
+  }
+  const map = {};
+  for (const [name, chunk] of chunks) {
+    const moduleId = chunk.facadeModuleId;
+    if (moduleId === void 0 || moduleId === null) continue;
+    const route = routePathForPageFile(appDir, moduleId);
+    if (route === void 0) continue;
+    map[route] = [...staticClosure(bundle, name)].filter((f) => !alreadyLoaded.has(f)).sort((a, b) => a.localeCompare(b));
+  }
+  return map;
+}
+function assetsMapPlugin(opts) {
+  let isSsrPass = false;
+  return {
+    name: "theokit:assets-map",
+    apply: "build",
+    configResolved(config) {
+      isSsrPass = Boolean(config.build.ssr);
+    },
+    generateBundle(_options, bundle) {
+      if (isSsrPass) return;
+      const map = buildAssetsMap(bundle, opts.appDir);
+      this.emitFile({
+        type: "asset",
+        fileName: "assets-map.json",
+        source: `${JSON.stringify(map, null, 2)}
+`
+      });
+    }
+  };
+}
+export {
+  assetsMapPlugin,
+  buildAssetsMap,
+  routePathForPageFile
+};
+//# sourceMappingURL=assets-map-BMQASQHW.js.map

package/dist/assets-map-BMQASQHW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/vite-plugin/assets-map.ts"],"sourcesContent":["/**\n * Emits `assets-map.json` — the route-to-chunks relation a document needs in order to preload\n * what the current route will import, instead of discovering it one round trip later.\n *\n * Chunk names exist only AFTER bundling, which is why this is a `generateBundle` hook and not a\n * post-build script reading `.vite/manifest.json`: Rollup hands the bundle in as an argument, and\n * the pre-bundle manifests must keep emitting before Vite so a failing build still leaves\n * diagnostics (B-035 ADR-1).\n *\n * `apply: 'build'` is not decoration. The plugin set this joins is shared by `theokit build`,\n * `theo dev` and `theo agent`; removing the plugin from the two serve chains is stronger than\n * relying on the hook never being reached there. The repository already uses the mirror of this in\n * `services-typed-client.ts` (`apply: 'serve'`, \"dev-only; never runs in build\").\n *\n * The SSR pass is skipped by reading the RESOLVED `build.ssr`, never a factory option: the adapter\n * calls the plugin factory twice (`adapters/node.ts:57` client, `:71` ssr) and passes `ssr: true`\n * to BOTH when the project enables SSR, so the option in the signature cannot tell the passes\n * apart. Emitting on the server pass would produce a second, unread `assets-map.json` under\n * `.theokit/server/` — harmless, because `this.emitFile` can only write inside its own build's\n * `outDir`, and deliberately avoided anyway so no future reader picks the wrong one.\n */\nimport type { Plugin } from 'vite'\n\n/** A route path mapped to the chunk file names it needs beyond what the entry already loads. */\nexport type AssetsMap = Record<string, string[]>\n\n/** Rollup's `generateBundle` bundle value, narrowed to the fields this hook reads. */\n/**\n * Exported so a fixture can be typed as one. A test that builds a chunk shape by hand and cannot\n * name the type is a test the compiler checks against `Record<string, unknown>` — which is what\n * silently erased every `fileName` a fixture passed until the root `tsc` reported it.\n */\nexport interface BundleChunk {\n  type: string\n  isEntry?: boolean\n  fileName: string\n  facadeModuleId?: string | null\n  imports?: string[]\n  /**\n   * Declared and deliberately NOT walked. A dynamic import is by definition what the browser fetches\n   * later; preloading it would defeat the split that made it dynamic.\n   *\n   * Naming it here is what makes the test asserting that meaningful. The field was absent from this\n   * type while a fixture passed it, so the case named \"does not follow dynamic imports\" passed\n   * because the walker ignores unknown keys — proving the behaviour by accident rather than by\n   * design. The root `tsc` reported it once the fixture helper stopped erasing its overrides.\n   */\n  dynamicImports?: string[]\n}\n\n/**\n * A bundle as this hook reads it. The value is `| undefined` ON PURPOSE: an `imports` entry may\n * name something the bundle does not contain (an external), and a lookup that cannot miss would\n * make the optional chain in `staticClosure` look redundant to a type-based lint while removing\n * it would crash at runtime. The type is widened to match reality rather than the guard narrowed\n * to match the type.\n */\ntype BundleLike = Record<string, BundleChunk | undefined>\n\nconst PAGE_FILE = /[/\\\\]page\\.(tsx|ts|jsx|js)$/\n\n/**\n * Derive the route path a page file serves. `<appDir>/about/page.tsx` -> `/about`;\n * `<appDir>/page.tsx` -> `/`. Returns undefined when the file is not a page under `appDir`.\n */\nexport function routePathForPageFile(appDir: string, moduleId: string): string | undefined {\n  const normalised = moduleId.replace(/\\\\/g, '/')\n  const root = appDir.replace(/\\\\/g, '/').replace(/\\/$/, '')\n  if (!normalised.startsWith(`${root}/`)) return undefined\n  if (!PAGE_FILE.test(normalised)) return undefined\n  const relative = normalised.slice(root.length).replace(PAGE_FILE, '')\n  return relative === '' ? '/' : relative\n}\n\n/**\n * Every chunk reachable from `start` through STATIC imports, `start` included. Dynamic imports are\n * deliberately excluded: they are what the browser fetches later, by definition, and preloading\n * them would defeat the split that produced them.\n */\nfunction staticClosure(bundle: BundleLike, start: string): Set<string> {\n  const seen = new Set<string>()\n  const queue = [start]\n  while (queue.length > 0) {\n    const name = queue.pop()\n    if (name === undefined || seen.has(name)) continue\n    seen.add(name)\n    for (const next of bundle[name]?.imports ?? []) queue.push(next)\n  }\n  return seen\n}\n\n/**\n * Compute the map from a Rollup bundle. Exported for unit testing without running a build —\n * the hook below is a thin wrapper so this function carries the behaviour.\n */\nexport function buildAssetsMap(bundle: BundleLike, appDir: string): AssetsMap {\n  const chunks = Object.entries(bundle).filter(\n    (entry): entry is [string, BundleChunk] => entry[1]?.type === 'chunk',\n  )\n\n  // What the document already loads. A route needing only these needs no preload at all, which is\n  // the case an over-eager implementation gets wrong and the empty array records honestly.\n  const alreadyLoaded = new Set<string>()\n  for (const [name, chunk] of chunks) {\n    if (chunk.isEntry === true) {\n      for (const reachable of staticClosure(bundle, name)) alreadyLoaded.add(reachable)\n    }\n  }\n\n  const map: AssetsMap = {}\n  for (const [name, chunk] of chunks) {\n    const moduleId = chunk.facadeModuleId\n    if (moduleId === undefined || moduleId === null) continue\n    const route = routePathForPageFile(appDir, moduleId)\n    if (route === undefined) continue\n    map[route] = [...staticClosure(bundle, name)]\n      .filter((f) => !alreadyLoaded.has(f))\n      .sort((a, b) => a.localeCompare(b))\n  }\n  return map\n}\n\n/** The plugin. See the module docblock for why `apply` and the SSR skip are what they are. */\nexport function assetsMapPlugin(opts: { appDir: string }): Plugin {\n  let isSsrPass = false\n  return {\n    name: 'theokit:assets-map',\n    apply: 'build',\n    configResolved(config) {\n      // The RESOLVED flag, per build pass — not the factory option, which is `true` in both.\n      isSsrPass = Boolean(config.build.ssr)\n    },\n    generateBundle(_options, bundle) {\n      if (isSsrPass) return\n      const map = buildAssetsMap(bundle, opts.appDir)\n      this.emitFile({\n        type: 'asset',\n        fileName: 'assets-map.json',\n        source: `${JSON.stringify(map, null, 2)}\\n`,\n      })\n    },\n  }\n}\n"],"mappings":";;;;AA2DA,IAAM,YAAY;AAMX,SAAS,qBAAqB,QAAgB,UAAsC;AACzF,QAAM,aAAa,SAAS,QAAQ,OAAO,GAAG;AAC9C,QAAM,OAAO,OAAO,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AACzD,MAAI,CAAC,WAAW,WAAW,GAAG,IAAI,GAAG,EAAG,QAAO;AAC/C,MAAI,CAAC,UAAU,KAAK,UAAU,EAAG,QAAO;AACxC,QAAM,WAAW,WAAW,MAAM,KAAK,MAAM,EAAE,QAAQ,WAAW,EAAE;AACpE,SAAO,aAAa,KAAK,MAAM;AACjC;AAOA,SAAS,cAAc,QAAoB,OAA4B;AACrE,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,QAAQ,CAAC,KAAK;AACpB,SAAO,MAAM,SAAS,GAAG;AACvB,UAAM,OAAO,MAAM,IAAI;AACvB,QAAI,SAAS,UAAa,KAAK,IAAI,IAAI,EAAG;AAC1C,SAAK,IAAI,IAAI;AACb,eAAW,QAAQ,OAAO,IAAI,GAAG,WAAW,CAAC,EAAG,OAAM,KAAK,IAAI;AAAA,EACjE;AACA,SAAO;AACT;AAMO,SAAS,eAAe,QAAoB,QAA2B;AAC5E,QAAM,SAAS,OAAO,QAAQ,MAAM,EAAE;AAAA,IACpC,CAAC,UAA0C,MAAM,CAAC,GAAG,SAAS;AAAA,EAChE;AAIA,QAAM,gBAAgB,oBAAI,IAAY;AACtC,aAAW,CAAC,MAAM,KAAK,KAAK,QAAQ;AAClC,QAAI,MAAM,YAAY,MAAM;AAC1B,iBAAW,aAAa,cAAc,QAAQ,IAAI,EAAG,eAAc,IAAI,SAAS;AAAA,IAClF;AAAA,EACF;AAEA,QAAM,MAAiB,CAAC;AACxB,aAAW,CAAC,MAAM,KAAK,KAAK,QAAQ;AAClC,UAAM,WAAW,MAAM;AACvB,QAAI,aAAa,UAAa,aAAa,KAAM;AACjD,UAAM,QAAQ,qBAAqB,QAAQ,QAAQ;AACnD,QAAI,UAAU,OAAW;AACzB,QAAI,KAAK,IAAI,CAAC,GAAG,cAAc,QAAQ,IAAI,CAAC,EACzC,OAAO,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC,EACnC,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;AAAA,EACtC;AACA,SAAO;AACT;AAGO,SAAS,gBAAgB,MAAkC;AAChE,MAAI,YAAY;AAChB,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,IACP,eAAe,QAAQ;AAErB,kBAAY,QAAQ,OAAO,MAAM,GAAG;AAAA,IACtC;AAAA,IACA,eAAe,UAAU,QAAQ;AAC/B,UAAI,UAAW;AACf,YAAM,MAAM,eAAe,QAAQ,KAAK,MAAM;AAC9C,WAAK,SAAS;AAAA,QACZ,MAAM;AAAA,QACN,UAAU;AAAA,QACV,QAAQ,GAAG,KAAK,UAAU,KAAK,MAAM,CAAC,CAAC;AAAA;AAAA,MACzC,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":[]}

package/dist/assets-map-CV2YZ3MY.js

@@ -0,0 +1,69 @@
+import "./chunk-XTHN6JBX.js";
+
+// src/vite-plugin/assets-map.ts
+var PAGE_FILE = /[/\\]page\.(tsx|ts|jsx|js)$/;
+function routePathForPageFile(appDir, moduleId) {
+  const normalised = moduleId.replace(/\\/g, "/");
+  const root = appDir.replace(/\\/g, "/").replace(/\/$/, "");
+  if (!normalised.startsWith(`${root}/`)) return void 0;
+  if (!PAGE_FILE.test(normalised)) return void 0;
+  const relative = normalised.slice(root.length).replace(PAGE_FILE, "");
+  return relative === "" ? "/" : relative;
+}
+function staticClosure(bundle, start) {
+  const seen = /* @__PURE__ */ new Set();
+  const queue = [start];
+  while (queue.length > 0) {
+    const name = queue.pop();
+    if (name === void 0 || seen.has(name)) continue;
+    seen.add(name);
+    for (const next of bundle[name]?.imports ?? []) queue.push(next);
+  }
+  return seen;
+}
+function buildAssetsMap(bundle, appDir) {
+  const chunks = Object.entries(bundle).filter(
+    (entry) => entry[1]?.type === "chunk"
+  );
+  const alreadyLoaded = /* @__PURE__ */ new Set();
+  for (const [name, chunk] of chunks) {
+    if (chunk.isEntry === true) {
+      for (const reachable of staticClosure(bundle, name)) alreadyLoaded.add(reachable);
+    }
+  }
+  const map = {};
+  for (const [name, chunk] of chunks) {
+    const moduleId = chunk.facadeModuleId;
+    if (moduleId === void 0 || moduleId === null) continue;
+    const route = routePathForPageFile(appDir, moduleId);
+    if (route === void 0) continue;
+    map[route] = [...staticClosure(bundle, name)].filter((f) => !alreadyLoaded.has(f)).sort((a, b) => a.localeCompare(b));
+  }
+  return map;
+}
+function assetsMapPlugin(opts) {
+  let isSsrPass = false;
+  return {
+    name: "theokit:assets-map",
+    apply: "build",
+    configResolved(config) {
+      isSsrPass = Boolean(config.build.ssr);
+    },
+    generateBundle(_options, bundle) {
+      if (isSsrPass) return;
+      const map = buildAssetsMap(bundle, opts.appDir);
+      this.emitFile({
+        type: "asset",
+        fileName: "assets-map.json",
+        source: `${JSON.stringify(map, null, 2)}
+`
+      });
+    }
+  };
+}
+export {
+  assetsMapPlugin,
+  buildAssetsMap,
+  routePathForPageFile
+};
+//# sourceMappingURL=assets-map-CV2YZ3MY.js.map

package/dist/assets-map-CV2YZ3MY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/vite-plugin/assets-map.ts"],"mappings":";;;AA2DA,IAAM,YAAY;AAMX,SAAS,qBAAqB,QAAgB,UAAsC;AACzF,QAAM,aAAa,SAAS,QAAQ,OAAO,GAAG;AAC9C,QAAM,OAAO,OAAO,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AACzD,MAAI,CAAC,WAAW,WAAW,GAAG,IAAI,GAAG,EAAG,QAAO;AAC/C,MAAI,CAAC,UAAU,KAAK,UAAU,EAAG,QAAO;AACxC,QAAM,WAAW,WAAW,MAAM,KAAK,MAAM,EAAE,QAAQ,WAAW,EAAE;AACpE,SAAO,aAAa,KAAK,MAAM;AACjC;AAOA,SAAS,cAAc,QAAoB,OAA4B;AACrE,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,QAAQ,CAAC,KAAK;AACpB,SAAO,MAAM,SAAS,GAAG;AACvB,UAAM,OAAO,MAAM,IAAI;AACvB,QAAI,SAAS,UAAa,KAAK,IAAI,IAAI,EAAG;AAC1C,SAAK,IAAI,IAAI;AACb,eAAW,QAAQ,OAAO,IAAI,GAAG,WAAW,CAAC,EAAG,OAAM,KAAK,IAAI;AAAA,EACjE;AACA,SAAO;AACT;AAMO,SAAS,eAAe,QAAoB,QAA2B;AAC5E,QAAM,SAAS,OAAO,QAAQ,MAAM,EAAE;AAAA,IACpC,CAAC,UAA0C,MAAM,CAAC,GAAG,SAAS;AAAA,EAChE;AAIA,QAAM,gBAAgB,oBAAI,IAAY;AACtC,aAAW,CAAC,MAAM,KAAK,KAAK,QAAQ;AAClC,QAAI,MAAM,YAAY,MAAM;AAC1B,iBAAW,aAAa,cAAc,QAAQ,IAAI,EAAG,eAAc,IAAI,SAAS;AAAA,IAClF;AAAA,EACF;AAEA,QAAM,MAAiB,CAAC;AACxB,aAAW,CAAC,MAAM,KAAK,KAAK,QAAQ;AAClC,UAAM,WAAW,MAAM;AACvB,QAAI,aAAa,UAAa,aAAa,KAAM;AACjD,UAAM,QAAQ,qBAAqB,QAAQ,QAAQ;AACnD,QAAI,UAAU,OAAW;AACzB,QAAI,KAAK,IAAI,CAAC,GAAG,cAAc,QAAQ,IAAI,CAAC,EACzC,OAAO,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC,EACnC,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;AAAA,EACtC;AACA,SAAO;AACT;AAGO,SAAS,gBAAgB,MAAkC;AAChE,MAAI,YAAY;AAChB,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,IACP,eAAe,QAAQ;AAErB,kBAAY,QAAQ,OAAO,MAAM,GAAG;AAAA,IACtC;AAAA,IACA,eAAe,UAAU,QAAQ;AAC/B,UAAI,UAAW;AACf,YAAM,MAAM,eAAe,QAAQ,KAAK,MAAM;AAC9C,WAAK,SAAS;AAAA,QACZ,MAAM;AAAA,QACN,UAAU;AAAA,QACV,QAAQ,GAAG,KAAK,UAAU,KAAK,MAAM,CAAC,CAAC;AAAA;AAAA,MACzC,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":[]}

package/dist/{aws-lambda-AN6CEBXO.js → aws-lambda-R76PWR27.js}

@@ -8,11 +8,11 @@ import {
   describeDeployedSecurityHeaders,
   renderSecurityHeadersConfigLiteral,
   serverDirLiteral
-} from "./chunk-PALZUV6E.js";
+} from "./chunk-6B3CMPE4.js";
 import {
   nodeAdapter
 } from "./chunk-KI4DOTN4.js";
-import "./chunk-VV2VU3LJ.js";
+import "./chunk-WSMLSIS5.js";
 import {
   assertServicesUnsupported,
   readManifest
@@ -259,4 +259,4 @@ export {
   renderAwsLambdaEntry,
   responseToLambdaResultV2
 };
-//# sourceMappingURL=aws-lambda-AN6CEBXO.js.map
+//# sourceMappingURL=aws-lambda-R76PWR27.js.map

package/dist/boot/index.d.ts

@@ -1,12 +1,11 @@
-import { R as ReservedRoutes } from '../health-route-C0hk64_U.js';
+import { R as ReservedRoutes } from '../health-route-CYI7z5g3.js';
 
 /**
  * M7-3 — `theokit/boot`: programmatic boot surface for the convention server.
  *
- * The programmatic surface is a Web `fetch` handler (the universal "fetch
- * handler is the entry point" contract — see the hono reference in
- * knowledge-base/discoveries/blueprints/m7-http-dual-surface-blueprint.md
- * "Coverage Corner 4"). It composes M7-1 (typed 404 envelope) + M7-2 (reserved
+ * The programmatic surface is a Web `fetch` handler — the universal "a fetch
+ * handler is the entry point" contract. It composes M7-1 (typed 404 envelope)
+ * + M7-2 (reserved
  * health/ready routes) and binds NO socket, so embedders + integration tests
  * can fire requests in-process via `app.fetch(new Request(...))`.
  *

package/dist/boot/index.js

@@ -1,6 +1,6 @@
 import {
   serveReservedRoute
-} from "../chunk-GAPBPRPP.js";
+} from "../chunk-TRCJHFAX.js";
 import {
   envelopeCodeToStatus
 } from "../chunk-ACKBVBUI.js";

package/dist/boot/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/boot.ts"],"mappings":";;;;;;;;;;;;;AA0CO,SAAS,6BACd,UAAyC,CAAC,GACnB;AACvB,SAAO;AAAA,IACL,MAAM,MAAM,SAAqC;AAC/C,YAAM,WAAW,IAAI,IAAI,QAAQ,GAAG,EAAE;AACtC,YAAM,WAAW,MAAM,mBAAmB,UAAU,QAAQ,kBAAkB,CAAC,CAAC;AAChF,UAAI,aAAa,MAAM;AACrB,eAAO,SAAS,KAAK,SAAS,MAAM,EAAE,QAAQ,SAAS,OAAO,CAAC;AAAA,MACjE;AAIA,YAAM,WAAW,sBAAsB,IAAI,cAAc,WAAW,CAAC;AACrE,aAAO,SAAS,KAAK,UAAU,EAAE,QAAQ,qBAAqB,SAAS,IAAI,EAAE,CAAC;AAAA,IAChF;AAAA;AAAA;AAAA,IAGA,QAAuB;AACrB,aAAO,QAAQ,QAAQ;AAAA,IACzB;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/server/boot.ts"],"mappings":";;;;;;;;;;;;;AAyCO,SAAS,6BACd,UAAyC,CAAC,GACnB;AACvB,SAAO;AAAA,IACL,MAAM,MAAM,SAAqC;AAC/C,YAAM,WAAW,IAAI,IAAI,QAAQ,GAAG,EAAE;AACtC,YAAM,WAAW,MAAM,mBAAmB,UAAU,QAAQ,kBAAkB,CAAC,CAAC;AAChF,UAAI,aAAa,MAAM;AACrB,eAAO,SAAS,KAAK,SAAS,MAAM,EAAE,QAAQ,SAAS,OAAO,CAAC;AAAA,MACjE;AAIA,YAAM,WAAW,sBAAsB,IAAI,cAAc,WAAW,CAAC;AACrE,aAAO,SAAS,KAAK,UAAU,EAAE,QAAQ,qBAAqB,SAAS,IAAI,EAAE,CAAC;AAAA,IAChF;AAAA;AAAA;AAAA,IAGA,QAAuB;AACrB,aAAO,QAAQ,QAAQ;AAAA,IACzB;AAAA,EACF;AACF;","names":[]}

package/dist/{build-JQSCQ3SQ.js → build-U4HVYY6F.js}

@@ -10,13 +10,13 @@ import {
 import {
   preflightNodeAndBindings
 } from "./chunk-KTMQUYED.js";
+import "./chunk-QD5X56I3.js";
+import "./chunk-C27VRUVN.js";
+import "./chunk-7UZZHCRN.js";
 import {
   emitOpenApi,
   loadRoutesForOpenApi
 } from "./chunk-47VNWTL4.js";
-import "./chunk-QD5X56I3.js";
-import "./chunk-C27VRUVN.js";
-import "./chunk-7UZZHCRN.js";
 import {
   generateManifest,
   writeManifest as writeManifest2
@@ -554,7 +554,7 @@ async function buildCommand(options) {
 `);
 }
 async function runAdapterBuild(target, config, cwd) {
-  const { theoPluginAsync } = await import("./vite-plugin-AVFHID5Z.js");
+  const { theoPluginAsync } = await import("./vite-plugin-WBF5NXGW.js");
   const { default: react } = await import("@vitejs/plugin-react");
   const ctx = {
     // `react()` may return Plugin or Plugin[] depending on version; spread the
@@ -603,7 +603,7 @@ async function runAdapterBuild(target, config, cwd) {
       };
     }
   };
-  const { resolveAdapter } = await import("./registry-RZHBBLIF.js");
+  const { resolveAdapter } = await import("./registry-UOWTDUFL.js");
   const adapter = await resolveAdapter(target);
   const { warnUnappliedConfig, assertRateLimitEnforceable } = await import("./config-support-O4REYSK5.js");
   assertRateLimitEnforceable(config, adapter, target);
@@ -676,4 +676,4 @@ function relativize3(absPath, root) {
 export {
   buildCommand
 };
-//# sourceMappingURL=build-JQSCQ3SQ.js.map
+//# sourceMappingURL=build-U4HVYY6F.js.map

package/dist/{bun-3FFL7CS4.js → bun-NPBIAWSU.js}

@@ -12,11 +12,11 @@ import {
   describeDeployedSecurityHeaders,
   renderSecurityHeadersConfigLiteral,
   serverDirLiteral
-} from "./chunk-PALZUV6E.js";
+} from "./chunk-6B3CMPE4.js";
 import {
   nodeAdapter
 } from "./chunk-KI4DOTN4.js";
-import "./chunk-VV2VU3LJ.js";
+import "./chunk-WSMLSIS5.js";
 import {
   assertServicesUnsupported,
   readManifest
@@ -344,4 +344,4 @@ export {
   bunAdapter,
   renderBunEntry
 };
-//# sourceMappingURL=bun-3FFL7CS4.js.map
+//# sourceMappingURL=bun-NPBIAWSU.js.map

package/dist/chunk-46FM5AFZ.js

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+import "tsx/esm";
+
+// src/core/contracts/module-preloads.ts
+function escapeAttribute(value) {
+  return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;");
+}
+function routePathFromTarget(target) {
+  if (target.startsWith("/")) return target.split(/[?#]/)[0];
+  try {
+    return new URL(target).pathname;
+  } catch {
+    return void 0;
+  }
+}
+function injectModulePreloads(head, assetsMap, url) {
+  if (assetsMap === void 0) return head;
+  const path = routePathFromTarget(url);
+  if (path === void 0) return head;
+  const route = path.length > 1 ? path.replace(/\/$/, "") : path;
+  const chunks = assetsMap[route] ?? assetsMap[path];
+  if (chunks === void 0 || chunks.length === 0) return head;
+  const links = chunks.map((chunk) => `<link rel="modulepreload" href="/${escapeAttribute(chunk)}">`).join("");
+  const closing = /<\/head\s*>/i;
+  return closing.test(head) ? head.replace(closing, (tag) => links + tag) : head + links;
+}
+function parseAssetsMap(text) {
+  try {
+    const parsed = JSON.parse(text);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+    const entries = Object.entries(parsed).filter(
+      (entry) => Array.isArray(entry[1]) && entry[1].every((value) => typeof value === "string")
+    );
+    return entries.length > 0 ? Object.fromEntries(entries) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+
+export {
+  injectModulePreloads,
+  parseAssetsMap
+};
+//# sourceMappingURL=chunk-46FM5AFZ.js.map

package/dist/chunk-46FM5AFZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/contracts/module-preloads.ts"],"sourcesContent":["/**\n * Render `<link rel=\"modulepreload\">` for the chunks a route needs beyond the entry (B-035).\n *\n * **The single source of truth, for the Node server AND the Cloudflare worker.**\n *\n * An earlier revision of this file asserted that the worker had to carry a COPY because\n * `theokit`'s package exports declare no subpath reaching `core/`. **That was false, and it was\n * stated three times** — here, in `adapters/cloudflare.ts`, and in a commit message. `server/\n * index.ts` already re-exports from `core/contracts/` *\"for consumer ergonomics\"* in its own\n * words, `adapters/security-headers.ts` imports `generateNonce` and `buildSecurityHeaders` from\n * here, and the generated worker imports BOTH of those subpaths. Adding a named export to an\n * existing barrel touches no `package.json`, so the constraint never existed.\n *\n * The copy is gone. `theokit/server` re-exports `injectModulePreloads` and the worker imports it,\n * which is the shape `adapters/security-headers.ts` established one directory over — and whose\n * docblock states the reason better than this one could: *\"a shape stated in two files drifts\"*.\n * It drifted the same day: the proxy fix below landed in this file and not in the copy.\n */\n\n/** A route path mapped to the chunk file names it needs beyond the entry. */\nexport type AssetsMap = Record<string, string[] | undefined>\n\n/** Attribute-safe: a chunk name must not be able to close the attribute it sits in. */\nfunction escapeAttribute(value: string): string {\n  return value.replace(/&/g, '&amp;').replace(/\"/g, '&quot;').replace(/</g, '&lt;')\n}\n\n/**\n * Inject one `<link rel=\"modulepreload\">` per chunk the route needs, before `</head>`.\n *\n * In the HEAD, not the body: a preload the browser meets after parsing the entry teaches it\n * nothing it was not about to learn a moment later, which is the defect rather than a preference.\n *\n * Returns `head` unchanged for an absent map, an unmapped route, or an empty chunk list. None of\n * those is an error: a build predating the map, or a route the scan did not see, must serve\n * without preloads rather than fail the request.\n */\n/**\n * The route path a request target names, whichever form the target takes.\n *\n * **Found at review, B-035.** The two call sites do not agree on the shape they pass:\n * `cli/commands/start/request-handler.ts` passes `req.url` RAW, and the Cloudflare worker passes\n * `new URL(request.url).pathname`. RFC 9112 §3.2.2 requires an origin server to accept the\n * absolute form, and a proxy sends it — so `GET http://example.com/about` reached this function as\n * a whole URL, matched no key, and the feature silently did nothing on Node behind a proxy while\n * the worker worked. Normalising HERE rather than at each call site is what makes the two agree by\n * construction instead of by two people remembering.\n *\n * Returns `undefined` for a target this cannot read. That is deliberate: inventing a route from an\n * unparseable target would preload another route's chunks, which is worse than preloading none.\n */\nfunction routePathFromTarget(target: string): string | undefined {\n  if (target.startsWith('/')) return target.split(/[?#]/)[0]\n  // Absolute form. `URL` is the platform's own parser and is present in Node and in a Worker —\n  // parsimony rung 3, and it is the same parser the worker's call site already uses.\n  try {\n    return new URL(target).pathname\n  } catch {\n    return undefined\n  }\n}\n\nexport function injectModulePreloads(\n  head: string,\n  assetsMap: AssetsMap | undefined,\n  url: string,\n): string {\n  if (assetsMap === undefined) return head\n  const path = routePathFromTarget(url)\n  if (path === undefined) return head\n  const route = path.length > 1 ? path.replace(/\\/$/, '') : path\n  const chunks = assetsMap[route] ?? assetsMap[path]\n  if (chunks === undefined || chunks.length === 0) return head\n  const links = chunks\n    .map((chunk) => `<link rel=\"modulepreload\" href=\"/${escapeAttribute(chunk)}\">`)\n    .join('')\n  const closing = /<\\/head\\s*>/i\n  return closing.test(head) ? head.replace(closing, (tag) => links + tag) : head + links\n}\n\n/**\n * Decide whether a document is a usable assets map, and return it if so.\n *\n * **Found at review, B-035.** This body existed TWICE, byte-identical modulo the function name —\n * `cli/commands/start/ssr-setup.ts` for the Node server and `adapters/cloudflare.ts` for the bake.\n * Nothing forced the copy: `.dependency-cruiser.cjs` permits `adapters/` -> `core/`, and\n * `cloudflare.ts` already imports from here. What was duplicated is the ACCEPTANCE RULE for a file\n * format, so tightening one side — rejecting `../` in a chunk name, say, which is the obvious next\n * hardening for a value that becomes an `href` — would have left the other accepting it, surfacing\n * as \"Cloudflare accepts a map Node rejects\" in a deploy.\n *\n * The I/O stays with each caller; only the shape decision lives here.\n *\n * Returns `undefined` for anything unusable, and never throws. A server that refused to boot, or a\n * deploy that failed, because an optimisation was missing would turn a lost round trip into an\n * outage.\n */\nexport function parseAssetsMap(text: string): Record<string, string[]> | undefined {\n  try {\n    const parsed: unknown = JSON.parse(text)\n    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) return undefined\n    const entries = Object.entries(parsed).filter(\n      (entry): entry is [string, string[]] =>\n        Array.isArray(entry[1]) && entry[1].every((value) => typeof value === 'string'),\n    )\n    return entries.length > 0 ? Object.fromEntries(entries) : undefined\n  } catch {\n    return undefined\n  }\n}\n"],"mappings":";;;;AAuBA,SAAS,gBAAgB,OAAuB;AAC9C,SAAO,MAAM,QAAQ,MAAM,OAAO,EAAE,QAAQ,MAAM,QAAQ,EAAE,QAAQ,MAAM,MAAM;AAClF;AA0BA,SAAS,oBAAoB,QAAoC;AAC/D,MAAI,OAAO,WAAW,GAAG,EAAG,QAAO,OAAO,MAAM,MAAM,EAAE,CAAC;AAGzD,MAAI;AACF,WAAO,IAAI,IAAI,MAAM,EAAE;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,qBACd,MACA,WACA,KACQ;AACR,MAAI,cAAc,OAAW,QAAO;AACpC,QAAM,OAAO,oBAAoB,GAAG;AACpC,MAAI,SAAS,OAAW,QAAO;AAC/B,QAAM,QAAQ,KAAK,SAAS,IAAI,KAAK,QAAQ,OAAO,EAAE,IAAI;AAC1D,QAAM,SAAS,UAAU,KAAK,KAAK,UAAU,IAAI;AACjD,MAAI,WAAW,UAAa,OAAO,WAAW,EAAG,QAAO;AACxD,QAAM,QAAQ,OACX,IAAI,CAAC,UAAU,oCAAoC,gBAAgB,KAAK,CAAC,IAAI,EAC7E,KAAK,EAAE;AACV,QAAM,UAAU;AAChB,SAAO,QAAQ,KAAK,IAAI,IAAI,KAAK,QAAQ,SAAS,CAAC,QAAQ,QAAQ,GAAG,IAAI,OAAO;AACnF;AAmBO,SAAS,eAAe,MAAoD;AACjF,MAAI;AACF,UAAM,SAAkB,KAAK,MAAM,IAAI;AACvC,QAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,EAAG,QAAO;AACnF,UAAM,UAAU,OAAO,QAAQ,MAAM,EAAE;AAAA,MACrC,CAAC,UACC,MAAM,QAAQ,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,UAAU,OAAO,UAAU,QAAQ;AAAA,IAClF;AACA,WAAO,QAAQ,SAAS,IAAI,OAAO,YAAY,OAAO,IAAI;AAAA,EAC5D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/{chunk-PALZUV6E.js → chunk-6B3CMPE4.js}

@@ -2,7 +2,7 @@
 import "tsx/esm";
 import {
   buildSecurityHeaders
-} from "./chunk-VV2VU3LJ.js";
+} from "./chunk-WSMLSIS5.js";
 
 // src/adapters/deployed-cors.ts
 var UnserializableCorsOriginError = class extends Error {
@@ -189,4 +189,4 @@ export {
   renderSecurityHeadersConfigLiteral,
   describeDeployedSecurityHeaders
 };
-//# sourceMappingURL=chunk-PALZUV6E.js.map
+//# sourceMappingURL=chunk-6B3CMPE4.js.map

package/dist/{chunk-D4VP2QPR.js → chunk-7L7LQ2GU.js}

@@ -13,4 +13,4 @@ export {
   WEB_SHAPED_MIDDLEWARE,
   defineMiddleware
 };
-//# sourceMappingURL=chunk-D4VP2QPR.js.map
+//# sourceMappingURL=chunk-7L7LQ2GU.js.map

package/dist/{chunk-D4VP2QPR.js.map → chunk-7L7LQ2GU.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/server/define/define-middleware.ts"],"mappings":";AA2CO,IAAM,wBAAwB,uBAAO,IAAI,+BAA+B;AAUxE,SAAS,iBAAiB,SAA+C;AAC9E,SAAO,eAAe,SAAS,uBAAuB;AAAA,IACpD,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,cAAc;AAAA,EAChB,CAAC;AACD,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/server/define/define-middleware.ts"],"mappings":";AAkEO,IAAM,wBAAwB,uBAAO,IAAI,+BAA+B;AAUxE,SAAS,iBAAiB,SAA+C;AAC9E,SAAO,eAAe,SAAS,uBAAuB;AAAA,IACpD,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,cAAc;AAAA,EAChB,CAAC;AACD,SAAO;AACT;","names":[]}

package/dist/{chunk-MOTGIGWC.js → chunk-7THO4PRL.js}

@@ -25,7 +25,7 @@ import {
   parseAgentRequestBody,
   readAgentPolicy,
   subjectFromContext
-} from "./chunk-O3EBLVMP.js";
+} from "./chunk-G2NWAVGG.js";
 import {
   getApprovalRegistry
 } from "./chunk-UETVDZBE.js";
@@ -35,7 +35,7 @@ import {
 } from "./chunk-QD5X56I3.js";
 import {
   generateNonce
-} from "./chunk-VV2VU3LJ.js";
+} from "./chunk-WSMLSIS5.js";
 
 // src/config/resolve-plugin-specifiers.ts
 import { isAbsolute, resolve } from "path";
@@ -648,8 +648,12 @@ function isListApprovalsPath(urlPath) {
   const match = LIST_PATH.exec(urlPath);
   return match ? decodeURIComponent(match[1]) : null;
 }
-function handleListApprovals(registry) {
-  return new Response(JSON.stringify({ approvals: registry.list() }), {
+function handleListApprovals(registry, subject) {
+  const visible = registry.list().filter((approval) => {
+    const owner = registry.ownerOf(approval.approvalId);
+    return owner === void 0 || owner === subject;
+  });
+  return new Response(JSON.stringify({ approvals: visible }), {
     status: 200,
     headers: { "content-type": "application/json; charset=utf-8" }
   });
@@ -718,13 +722,20 @@ async function matchAgentAuxRoute(method, urlPath, deps) {
 }
 async function admitAux(deps, agent, params, body) {
   const mod = await deps.loadModule(agent.filePath);
+  const resolve4 = deps.resolveSubject;
+  const admitted = { subject: null };
+  const recording = resolve4 === void 0 ? void 0 : async () => {
+    admitted.subject = await resolve4();
+    return admitted.subject;
+  };
   const decision = await admitAgentRequest(
     readAgentPolicy(mod, agent.filePath),
-    deps.resolveSubject,
+    recording,
     params,
     body
   );
-  return decision.allowed ? null : agentAccessDenied(decision, params);
+  const refusal = decision.allowed ? null : agentAccessDenied(decision, params);
+  return { refusal, subject: admitted.subject?.id };
 }
 async function serveMatchedAuxRoute(route, request, deps) {
   if (route.kind === "card") {
@@ -732,11 +743,12 @@ async function serveMatchedAuxRoute(route, request, deps) {
     return handleAgentCard(mod, route.agent.name, route.agent.agentPath, deps.baseUrl);
   }
   if (route.kind === "approvals") {
-    const refusal = await admitAux(deps, route.agent, {
+    const admission = await admitAux(deps, route.agent, {
       agent: route.agent.name,
       endpoint: "approvals"
     });
-    return refusal ?? handleListApprovals(getApprovalRegistry());
+    if (admission.refusal !== null) return admission.refusal;
+    return handleListApprovals(getApprovalRegistry(), admission.subject);
   }
   if (route.kind === "run-stream") {
     return handleAgentRunReconnect(route.runId, request, getRunEventCache());
@@ -747,14 +759,14 @@ async function serveMatchedAuxRoute(route, request, deps) {
 async function serveThreadRoute(route, request, deps) {
   const { agent, sessionId } = route;
   if (route.kind === "thread-stream") {
-    const refusal2 = await admitAux(deps, agent, {
+    const { refusal: refusal2 } = await admitAux(deps, agent, {
       agent: agent.name,
       endpoint: "thread-stream",
       sessionId
     });
     return refusal2 ?? handleThreadStream(sessionId, request);
   }
-  const refusal = await admitAux(deps, agent, {
+  const { refusal } = await admitAux(deps, agent, {
     agent: agent.name,
     endpoint: "thread-message",
     sessionId
@@ -867,4 +879,4 @@ export {
   applyNonceToInlineScripts,
   setupSsrDevMiddleware
 };
-//# sourceMappingURL=chunk-MOTGIGWC.js.map
+//# sourceMappingURL=chunk-7THO4PRL.js.map