theokit 0.67.0 → 0.69.0

package/dist/{chunk-YNK7DW5V.js → chunk-QVXMAHZC.js}

@@ -7,32 +7,29 @@ import {
 } from "./chunk-SSYDEKWF.js";
 import {
   dispatchControllerRequest
-} from "./chunk-WAYUHS54.js";
+} from "./chunk-425FJKKO.js";
+import {
+  createAgentSubjectResolver,
+  isAgentCardPath,
+  matchAgentAuxRoute,
+  serveMatchedAuxRoute
+} from "./chunk-BDPD5HEO.js";
 import {
-  RUN_ID_HEADER,
-  SSE_BASE_HEADERS,
-  SSE_DONE_FRAME,
   admitAgentRequest,
   agentAccessDenied,
   cacheSchema,
   closePauseSpan,
   createObservabilityPluginFromConfig,
-  encodeSse,
-  formatSseFrame,
   getApprovalRegistry,
-  getRunEventCache,
   loggingSchema,
-  makeThreadStartRun,
-  mintRunId,
   mountAgent,
   observabilitySchema,
-  parseAgentRequestBody,
   rateLimitSchema,
   readAgentPolicy,
   securitySchema,
   storageSchema,
   uploadSchema
-} from "./chunk-GAJOZJWD.js";
+} from "./chunk-MOGTMGGA.js";
 import {
   broadcastToDevtools
 } from "./chunk-OIGJOYX6.js";
@@ -52,21 +49,19 @@ import {
 import {
   BATCH_PATH,
   createCorsHandler,
-  createServerContext,
-  createWebRequestSource,
   executeAction,
   executeRoute,
-  handleBatchRequest,
+  handleBatchRequest
+} from "./chunk-SRJBH5E5.js";
+import {
+  createWebRequestSource,
   incomingMessageToHandlerRequest,
   sendError,
   writeWebResponseToServerResponse
-} from "./chunk-5AGNZXHJ.js";
+} from "./chunk-3T5XLDOH.js";
 import {
   validateCsrfRequest
 } from "./chunk-P6OS7652.js";
-import {
-  subjectFromContext
-} from "./chunk-ENRT6DAU.js";
 import {
   findSuggestion
 } from "./chunk-NTDN54XO.js";
@@ -93,11 +88,6 @@ import {
 import {
   scanAgents
 } from "./chunk-KDP2HURW.js";
-import {
-  extractAppResources,
-  handleMcpJsonRpc,
-  isMcpPath
-} from "./chunk-TQEE36VD.js";
 import {
   resolveProvider
 } from "./chunk-ICXXHV4V.js";
@@ -110,7 +100,7 @@ import {
 
 // src/vite-plugin/index.ts
 import { existsSync as existsSync8 } from "node:fs";
-import { resolve as resolve10, dirname as dirname4 } from "node:path";
+import { resolve as resolve9, dirname as dirname4 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // src/vite-plugin/config-hook.ts
@@ -154,6 +144,18 @@ function runConfigHook(ctx) {
       }
     },
     resolve: {
+      // B-228 — one module instance per package, or two React contexts reach the client and the
+      // one `RouterProvider` filled is not the one `useLocation()` reads. The alias list below is
+      // what creates the condition: its catch-all maps any unlisted `theokit/*` subpath to
+      // WORKSPACE SOURCE, whose own bare `react-router` import then resolves against the
+      // workspace's node_modules while the app's entry resolves against its own. Measured
+      // 2026-09-20: 7.18.2 and 7.18.4 both reached one bundle, and React Router's ErrorBoundary
+      // replaced the whole tree with "Unexpected Application Error!".
+      //
+      // React and react-dom carry the same hazard by the same route — two React instances would
+      // produce this class of defect with a different symptom — so all four are named rather than
+      // the one that was caught.
+      dedupe: ["react-router", "react-router/dom", "react", "react-dom"],
       alias: [
         // Order still matters — first match wins — but the entries below are
         // EXACT (#377). A Vite alias whose `find` is a string matches by prefix,
@@ -773,7 +775,7 @@ async function resolvePluginConfig(projectRoot) {
 }
 
 // src/vite-plugin/configure-server-hook.ts
-import { resolve as resolve8, basename } from "node:path";
+import { resolve as resolve7, basename } from "node:path";
 
 // src/devtools/server-side/route-manifest.ts
 function buildPath(parents, segment) {
@@ -1013,52 +1015,6 @@ function createActionMiddleware(vite, serverDir, options) {
 // src/vite-plugin/agent-middleware.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 
-// src/server/agent/agent-card-handler.ts
-import { buildAgentCard, compileLoadedAgentModule } from "@theokit/agents";
-var WELL_KNOWN = /^\/\.well-known\/([^/]+)\/agent-card\.json$/;
-function isAgentCardPath(urlPath) {
-  const match = WELL_KNOWN.exec(urlPath);
-  return match ? decodeURIComponent(match[1]) : null;
-}
-function toManifestEntry(name, route, mod) {
-  const compiled = compileLoadedAgentModule(mod, `agent card for "${name}"`);
-  return {
-    name,
-    route,
-    stream: compiled.stream,
-    mainLoop: { method: "", strategy: "" },
-    guards: [],
-    interceptors: [],
-    tools: compiled.tools.map((t) => ({
-      name: t.name,
-      description: t.description,
-      approval: false,
-      trace: false,
-      audit: false
-    })),
-    subAgents: []
-  };
-}
-function handleAgentCard(mod, name, route, baseUrl) {
-  try {
-    const card = buildAgentCard(toManifestEntry(name, route, mod), { baseUrl });
-    return new Response(JSON.stringify(card), {
-      status: 200,
-      headers: { "content-type": "application/json; charset=utf-8" }
-    });
-  } catch (err) {
-    return new Response(
-      JSON.stringify({
-        error: {
-          code: "AGENT_CARD_FAILED",
-          message: err instanceof Error ? err.message : "card build failed"
-        }
-      }),
-      { status: 500, headers: { "content-type": "application/json; charset=utf-8" } }
-    );
-  }
-}
-
 // src/server/agent/approve-agent.ts
 var APPROVE_SEGMENT = "/approve/";
 var APPROVE_PATH = /^\/api\/agents\/([^/]+)\/approve\/([^/]+)$/;
@@ -1148,445 +1104,6 @@ async function handleAgentApproval(request, urlPath, registry, csrfMode = "stric
   });
 }
 
-// src/server/agent/handle-agent-run-reconnect.ts
-var RUN_STREAM_PATH = /^\/api\/agents\/([^/]+)\/runs\/([^/]+)\/stream$/;
-function isAgentRunStreamPath(urlPath) {
-  const m = RUN_STREAM_PATH.exec(urlPath);
-  return m ? { name: decodeURIComponent(m[1]), runId: decodeURIComponent(m[2]) } : null;
-}
-function parseLastEventId(raw) {
-  if (raw === null) return -1;
-  const n = Number.parseInt(raw, 10);
-  return Number.isInteger(n) && n >= 0 ? n : -1;
-}
-function handleAgentRunReconnect(runId, request, cache) {
-  if (!cache.has(runId)) {
-    return new Response(
-      JSON.stringify({ error: { code: "RUN_NOT_FOUND", message: `Unknown run '${runId}'.` } }),
-      {
-        status: 404,
-        headers: { "content-type": "application/json" }
-      }
-    );
-  }
-  const afterSeq = parseLastEventId(request.headers.get("last-event-id"));
-  const stream = new ReadableStream({
-    start(controller) {
-      let closed = false;
-      const safeEnqueue = (text) => {
-        if (closed) return;
-        try {
-          controller.enqueue(encodeSse(text));
-        } catch {
-        }
-      };
-      const close = () => {
-        if (closed) return;
-        safeEnqueue(SSE_DONE_FRAME);
-        closed = true;
-        try {
-          controller.close();
-        } catch {
-        }
-      };
-      const res = cache.attach(
-        runId,
-        afterSeq,
-        (frame) => {
-          safeEnqueue(formatSseFrame(frame.seq, frame.data));
-        },
-        () => {
-          close();
-        }
-      );
-      if (!res.known) {
-        close();
-        return;
-      }
-      for (const frame of res.replay) {
-        safeEnqueue(formatSseFrame(frame.seq, frame.data));
-      }
-      if (res.ended) {
-        close();
-        return;
-      }
-      request.signal.addEventListener("abort", () => {
-        res.unsubscribe();
-        close();
-      });
-    }
-  });
-  return new Response(stream, { headers: { ...SSE_BASE_HEADERS, [RUN_ID_HEADER]: runId } });
-}
-
-// src/server/agent/thread-dispatcher.ts
-function postThreadFollowUp(deps, sessionId, message) {
-  if (deps.registry.getActive(sessionId) !== null) {
-    deps.registry.queue(sessionId, { message });
-    return { queued: true };
-  }
-  return { runId: startAndPump(deps, sessionId, message) };
-}
-function startAndPump(deps, sessionId, message) {
-  const runId = mintRunId();
-  deps.cache.begin(runId);
-  deps.registry.startRun(sessionId, runId);
-  pumpIntoCache(deps, sessionId, runId, deps.startRun(sessionId, message));
-  return runId;
-}
-function pumpIntoCache(deps, sessionId, runId, chunks) {
-  void (async () => {
-    try {
-      for await (const chunk of chunks) {
-        deps.cache.append(runId, JSON.stringify(chunk));
-      }
-    } catch {
-    } finally {
-      deps.cache.end(runId);
-      const next = deps.registry.endRun(sessionId, runId);
-      if (next !== void 0) startAndPump(deps, sessionId, next.message);
-    }
-  })();
-}
-
-// src/server/agent/thread-run-registry.ts
-function createInProcessThreadRunRegistry() {
-  const threads = /* @__PURE__ */ new Map();
-  const ensure = (sessionId) => {
-    let s = threads.get(sessionId);
-    if (s === void 0) {
-      s = { activeRunId: null, queue: [], waiters: /* @__PURE__ */ new Set() };
-      threads.set(sessionId, s);
-    }
-    return s;
-  };
-  return {
-    getActive(sessionId) {
-      return threads.get(sessionId)?.activeRunId ?? null;
-    },
-    startRun(sessionId, runId) {
-      const s = ensure(sessionId);
-      s.activeRunId = runId;
-      const waiters = [...s.waiters];
-      s.waiters.clear();
-      for (const cb of waiters) cb(runId);
-    },
-    endRun(sessionId, runId) {
-      const s = threads.get(sessionId);
-      if (s?.activeRunId !== runId) return void 0;
-      s.activeRunId = null;
-      return s.queue.shift();
-    },
-    queue(sessionId, followUp) {
-      ensure(sessionId).queue.push(followUp);
-    },
-    onNextRun(sessionId, cb) {
-      const s = ensure(sessionId);
-      s.waiters.add(cb);
-      return () => {
-        s.waiters.delete(cb);
-      };
-    }
-  };
-}
-var serverRegistry;
-function getThreadRunRegistry() {
-  serverRegistry ??= createInProcessThreadRunRegistry();
-  return serverRegistry;
-}
-
-// src/server/agent/handle-thread-routes.ts
-var THREAD_MESSAGE_PATH = /^\/api\/agents\/([^/]+)\/threads\/([^/]+)\/message$/;
-var THREAD_STREAM_PATH = /^\/api\/agents\/([^/]+)\/threads\/([^/]+)\/stream$/;
-var DEFAULT_IDLE_WAIT_MS = 3e4;
-function matchThread(re, urlPath) {
-  const m = re.exec(urlPath);
-  return m ? { name: decodeURIComponent(m[1]), sessionId: decodeURIComponent(m[2]) } : null;
-}
-var isThreadMessagePath = (urlPath) => matchThread(THREAD_MESSAGE_PATH, urlPath);
-var isThreadStreamPath = (urlPath) => matchThread(THREAD_STREAM_PATH, urlPath);
-function jsonError2(status, code, message) {
-  return new Response(JSON.stringify({ error: { code, message } }), {
-    status,
-    headers: { "content-type": "application/json; charset=utf-8" }
-  });
-}
-async function handleThreadMessage(args) {
-  const { mod, apiKey, sessionId, request, source, agentName, csrfMode = "strict" } = args;
-  if (csrfMode === "strict") {
-    const csrf = validateCsrfRequest(request);
-    if (!csrf.valid) return jsonError2(403, "CSRF_FAILED", `CSRF check failed: ${csrf.reason}`);
-  }
-  let body = null;
-  try {
-    body = await request.json();
-  } catch {
-  }
-  const input = parseAgentRequestBody(body);
-  if (input === null) {
-    return jsonError2(400, "BAD_REQUEST", "Request must contain a non-empty message.");
-  }
-  const result = postThreadFollowUp(
-    {
-      registry: getThreadRunRegistry(),
-      cache: getRunEventCache(),
-      // usetheokit/theokit#381 — the request goes with it, so the run's spans join the trace of
-      // the caller that queued it instead of opening one of their own.
-      startRun: makeThreadStartRun(mod, apiKey, source, agentName, request)
-    },
-    sessionId,
-    input.message
-  );
-  const headers = { "content-type": "application/json; charset=utf-8" };
-  if ("runId" in result) headers[RUN_ID_HEADER] = result.runId;
-  return new Response(JSON.stringify(result), { status: 202, headers });
-}
-function handleThreadStream(sessionId, request, registry = getThreadRunRegistry(), cache = getRunEventCache(), idleWaitMs = DEFAULT_IDLE_WAIT_MS) {
-  const active = registry.getActive(sessionId);
-  if (active !== null && cache.has(active)) {
-    return handleAgentRunReconnect(active, request, cache);
-  }
-  return waitThenAttachStream(sessionId, request, registry, cache, idleWaitMs);
-}
-function waitThenAttachStream(sessionId, request, registry, cache, idleWaitMs) {
-  const stream = new ReadableStream({
-    start(controller) {
-      let closed = false;
-      const send = (text) => {
-        if (closed) return;
-        try {
-          controller.enqueue(encodeSse(text));
-        } catch {
-        }
-      };
-      let detachAttach;
-      const close = () => {
-        if (closed) return;
-        send(SSE_DONE_FRAME);
-        closed = true;
-        try {
-          controller.close();
-        } catch {
-        }
-      };
-      const offNext = registry.onNextRun(sessionId, (runId) => {
-        const res = cache.attach(
-          runId,
-          -1,
-          (frame) => {
-            send(formatSseFrame(frame.seq, frame.data));
-          },
-          () => {
-            close();
-          }
-        );
-        if (!res.known) {
-          close();
-          return;
-        }
-        for (const frame of res.replay) send(formatSseFrame(frame.seq, frame.data));
-        if (res.ended) {
-          close();
-          return;
-        }
-        detachAttach = res.unsubscribe;
-      });
-      const teardownWaiter = () => {
-        offNext();
-        detachAttach?.();
-      };
-      const timer = setTimeout(() => {
-        teardownWaiter();
-        close();
-      }, idleWaitMs);
-      timer.unref();
-      request.signal.addEventListener("abort", () => {
-        teardownWaiter();
-        clearTimeout(timer);
-        close();
-      });
-    }
-  });
-  return new Response(stream, { headers: { ...SSE_BASE_HEADERS } });
-}
-
-// src/server/agent/list-approvals-handler.ts
-var LIST_PATH = /^\/api\/agents\/([^/]+)\/approvals$/;
-function isListApprovalsPath(urlPath) {
-  const match = LIST_PATH.exec(urlPath);
-  return match ? decodeURIComponent(match[1]) : null;
-}
-function handleListApprovals(registry, subject) {
-  const visible = registry.list().filter((approval) => {
-    const owner = registry.ownerOf(approval.approvalId);
-    return owner === void 0 || owner === subject;
-  });
-  return new Response(JSON.stringify({ approvals: visible }), {
-    status: 200,
-    headers: { "content-type": "application/json; charset=utf-8" }
-  });
-}
-
-// src/server/agent/serve-aux-routes.ts
-function jsonError3(status, code, message) {
-  return new Response(JSON.stringify({ error: { code, message } }), {
-    status,
-    headers: { "content-type": "application/json; charset=utf-8" }
-  });
-}
-function routeFor(deps, name, build) {
-  if (name === null) return null;
-  const agent = deps.agents.find((a) => a.name === name);
-  return agent === void 0 ? null : build(agent);
-}
-function matchGetAuxRoute(verb, urlPath, deps) {
-  if (verb !== "GET") return null;
-  const card = routeFor(
-    deps,
-    isAgentCardPath(urlPath),
-    (agent) => ({ kind: "card", agent })
-  );
-  if (card !== null) return card;
-  const approvals = routeFor(
-    deps,
-    isListApprovalsPath(urlPath),
-    (agent) => ({ kind: "approvals", agent })
-  );
-  if (approvals !== null) return approvals;
-  const run = isAgentRunStreamPath(urlPath);
-  if (run !== null) {
-    return routeFor(
-      deps,
-      run.name,
-      (agent) => ({ kind: "run-stream", agent, runId: run.runId })
-    );
-  }
-  const stream = isThreadStreamPath(urlPath);
-  if (stream === null) return null;
-  return routeFor(
-    deps,
-    stream.name,
-    (agent) => ({ kind: "thread-stream", agent, sessionId: stream.sessionId })
-  );
-}
-async function matchPostAuxRoute(verb, urlPath, deps) {
-  if (verb !== "POST") return null;
-  const msg = isThreadMessagePath(urlPath);
-  if (msg !== null) {
-    return routeFor(
-      deps,
-      msg.name,
-      (agent2) => ({ kind: "thread-message", agent: agent2, sessionId: msg.sessionId })
-    );
-  }
-  const agent = routeFor(deps, isMcpPath(urlPath), (found) => found);
-  if (agent === null) return null;
-  const mod = await deps.loadModule(agent.filePath);
-  return isMcpExposed(mod) ? { kind: "mcp", agent, mod } : null;
-}
-async function matchAgentAuxRoute(method, urlPath, deps) {
-  const verb = method.toUpperCase();
-  return matchGetAuxRoute(verb, urlPath, deps) ?? await matchPostAuxRoute(verb, urlPath, deps);
-}
-async function admitAux(deps, agent, params, body) {
-  const mod = await deps.loadModule(agent.filePath);
-  const resolve11 = deps.resolveSubject;
-  const admitted = { subject: null };
-  const recording = resolve11 === void 0 ? void 0 : async () => {
-    admitted.subject = await resolve11();
-    return admitted.subject;
-  };
-  const decision = await admitAgentRequest(
-    readAgentPolicy(mod, agent.filePath),
-    recording,
-    params,
-    body
-  );
-  const refusal = decision.allowed ? null : agentAccessDenied(decision, params);
-  return { refusal, subject: admitted.subject?.id };
-}
-async function serveMatchedAuxRoute(route, request, deps) {
-  if (route.kind === "card") {
-    const mod = await deps.loadModule(route.agent.filePath);
-    return handleAgentCard(mod, route.agent.name, route.agent.agentPath, deps.baseUrl);
-  }
-  if (route.kind === "approvals") {
-    const admission = await admitAux(deps, route.agent, {
-      agent: route.agent.name,
-      endpoint: "approvals"
-    });
-    if (admission.refusal !== null) return admission.refusal;
-    return handleListApprovals(getApprovalRegistry(), admission.subject);
-  }
-  if (route.kind === "run-stream") {
-    return handleAgentRunReconnect(route.runId, request, getRunEventCache());
-  }
-  if (route.kind === "mcp") return serveMcpRoute(route, request, deps);
-  return serveThreadRoute(route, request, deps);
-}
-async function serveThreadRoute(route, request, deps) {
-  const { agent, sessionId } = route;
-  if (route.kind === "thread-stream") {
-    const { refusal: refusal2 } = await admitAux(deps, agent, {
-      agent: agent.name,
-      endpoint: "thread-stream",
-      sessionId
-    });
-    return refusal2 ?? handleThreadStream(sessionId, request);
-  }
-  const { refusal } = await admitAux(deps, agent, {
-    agent: agent.name,
-    endpoint: "thread-message",
-    sessionId
-  });
-  if (refusal !== null) return refusal;
-  if (deps.resolveApiKey === void 0) {
-    return jsonError3(
-      501,
-      "NOT_CONFIGURED",
-      "Thread follow-up requires a provider API key (resolveApiKey was not provided to serveMatchedAuxRoute)."
-    );
-  }
-  const mod = await deps.loadModule(agent.filePath);
-  return handleThreadMessage({
-    mod,
-    // Passed unresolved: `makeThreadStartRun` calls it once the module is compiled and the
-    // model is known (theokit#328).
-    apiKey: deps.resolveApiKey,
-    sessionId,
-    request,
-    source: `agent "${agent.name}"`,
-    // usetheokit/theokit#406 — the label above reads well in an `AgentDefinitionError` and is not
-    // a name; the spans get the name, so the same agent is one series whichever route started it.
-    agentName: agent.name,
-    csrfMode: deps.csrfMode ?? "strict"
-  });
-}
-async function serveMcpRoute(route, request, deps) {
-  const { agent, mod } = route;
-  const mcpParams = { agent: agent.name, endpoint: "mcp" };
-  const mcpDecision = await admitAgentRequest(
-    readAgentPolicy(mod, agent.filePath),
-    deps.resolveSubject,
-    mcpParams
-  );
-  if (!mcpDecision.allowed) return agentAccessDenied(mcpDecision, mcpParams);
-  const csrfMode = deps.csrfMode ?? "strict";
-  if (csrfMode === "strict") {
-    const csrf = validateCsrfRequest(request);
-    if (!csrf.valid) return jsonError3(403, "CSRF_FAILED", `CSRF check failed: ${csrf.reason}`);
-  }
-  let body = null;
-  try {
-    body = await request.json();
-  } catch {
-  }
-  return handleMcpJsonRpc(mod, agent.name, body, extractAppResources(mod));
-}
-function isMcpExposed(mod) {
-  return mod?.mcp === true;
-}
-
 // src/server/http/plugin-lifecycle.ts
 function messageOf2(err, fallback) {
   return err instanceof Error ? err.message : fallback;
@@ -1615,22 +1132,6 @@ async function serveThroughPluginLifecycle(target, serve) {
   if (pluginRunner) await pluginRunner.runOnResponse(pluginCtx);
 }
 
-// src/server/http/resolve-agent-subject.ts
-function createAgentSubjectResolver(sources) {
-  let pending;
-  return () => {
-    pending ??= resolve5(sources);
-    return pending;
-  };
-}
-async function resolve5(sources) {
-  const { req, res, loadModule, serverDir, pluginRunner } = sources;
-  const produced = serverDir === void 0 ? {} : await createServerContext(req, res, loadModule, serverDir);
-  const ctx = produced ?? {};
-  pluginRunner?.applyDecorations(ctx);
-  return subjectFromContext(ctx);
-}
-
 // src/vite-plugin/agent-middleware.ts
 var PREFIX2 = "/api/agents/";
 async function serveApprove(req, res, urlPath, deps, log) {
@@ -1855,7 +1356,7 @@ async function serveAgentTurn(t) {
 }
 
 // src/vite-plugin/api-middleware.ts
-import { resolve as resolve6 } from "node:path";
+import { resolve as resolve5 } from "node:path";
 function shouldBypassApiMiddleware(url, prefixes) {
   if (!url.startsWith("/api/")) return true;
   if (prefixes.length === 0) return false;
@@ -1903,10 +1404,10 @@ async function handleBatchIfMatch(req, res, ctx) {
 async function handleBatchInline(req, res, batching, requestId) {
   try {
     const chunks = [];
-    await new Promise((resolve11, reject) => {
+    await new Promise((resolve10, reject) => {
       req.on("data", (c) => chunks.push(c));
       req.on("end", () => {
-        resolve11();
+        resolve10();
       });
       req.on("error", reject);
     });
@@ -1962,7 +1463,7 @@ async function runPluginsBeforeRouteMatch(pluginRunner, reqCtx) {
 }
 async function tryControllerFallthrough(ctx) {
   const handled = await dispatchControllerRequest({
-    controllersDir: resolve6(ctx.serverDir, "controllers"),
+    controllersDir: resolve5(ctx.serverDir, "controllers"),
     loadModule: ctx.loadModule,
     req: ctx.req,
     res: ctx.res,
@@ -2108,7 +1609,7 @@ function createApiMiddleware(vite, serverDir, rateLimitConfigOrOptions) {
 
 // src/vite-plugin/ssr-dev-middleware.ts
 import { readFileSync as readFileSync2 } from "node:fs";
-import { resolve as resolve7 } from "node:path";
+import { resolve as resolve6 } from "node:path";
 
 // src/core/contracts/find-root-div.ts
 function maskHtmlComments(html) {
@@ -2199,7 +1700,7 @@ function setupSsrDevMiddleware(server, opts) {
         return;
       }
       try {
-        const indexPath = resolve7(opts.projectRoot, "index.html");
+        const indexPath = resolve6(opts.projectRoot, "index.html");
         let template = readFileSync2(indexPath, "utf-8");
         const nonce = generateNonce();
         template = await server.transformIndexHtml(url, template);
@@ -2342,7 +1843,7 @@ async function runConfigureServer(server, ctx) {
       csrfReadinessStore
     })
   );
-  const configPath = resolve8(ctx.projectRoot, "theo.config.ts");
+  const configPath = resolve7(ctx.projectRoot, "theo.config.ts");
   server.watcher.on("change", (file) => {
     if (file === configPath) {
       console.warn(
@@ -2372,7 +1873,7 @@ async function runConfigureServer(server, ctx) {
     const openApiCfg = ctx.resolvedOpenApi;
     const { reEmitOpenApi } = await import("./dev-emit-7RT624PM.js");
     const openApiServerDir = ctx.serverDir;
-    const openApiDistDir = resolve8(ctx.projectRoot, ctx.resolvedDistDir);
+    const openApiDistDir = resolve7(ctx.projectRoot, ctx.resolvedDistDir);
     const isRouteFileForOpenApi = (file) => file.startsWith(openApiServerDir) && /\.(ts|tsx|js|mjs)$/.test(file);
     void reEmitOpenApi(openApiServerDir, openApiDistDir, openApiCfg);
     server.watcher.on("change", (file) => {
@@ -2679,7 +2180,7 @@ async function integrateUseTheoUI(cwd, opts) {
 
 // src/vite-plugin/transform-html-hook.ts
 import { existsSync as existsSync7 } from "node:fs";
-import { resolve as resolve9 } from "node:path";
+import { resolve as resolve8 } from "node:path";
 
 // src/vite-plugin/inject-devtools.ts
 var DEVTOOLS_VIRTUAL_ID = "/@theo/devtools/entry.js";
@@ -2779,7 +2280,7 @@ function runTransformIndexHtml(html, ctx) {
   next = devtools.html;
   const styles = injectStylesheets(next, {
     isDev: ctx.isDevMode.value,
-    hasPackage: (name) => existsSync7(resolve9(ctx.projectRoot, "node_modules", ...name.split("/")))
+    hasPackage: (name) => existsSync7(resolve8(ctx.projectRoot, "node_modules", ...name.split("/")))
   });
   next = styles.html;
   return next;
@@ -3490,7 +2991,7 @@ function findConsumerConfig(projectRoot, basename2) {
   let dir = projectRoot;
   for (let level = 0; level < 3; level++) {
     for (const ext of extensions) {
-      const candidate = resolve10(dir, `${basename2}${ext}`);
+      const candidate = resolve9(dir, `${basename2}${ext}`);
       if (existsSync8(candidate)) return candidate;
     }
     const parent = dirname4(dir);
@@ -3502,7 +3003,7 @@ function findConsumerConfig(projectRoot, basename2) {
 async function theoPluginAsync(rootOrOptions) {
   const options = typeof rootOrOptions === "string" ? { root: rootOrOptions } : rootOrOptions ?? {};
   const projectRoot = options.root ?? process.cwd();
-  const serverDirAbs = resolve10(projectRoot, options.serverDir ?? "server");
+  const serverDirAbs = resolve9(projectRoot, options.serverDir ?? "server");
   const agentsDirName = options.agentsDir ?? "agents";
   const consumerTailwindConfig = findConsumerConfig(projectRoot, "tailwind.config");
   const consumerPostcssConfig = findConsumerConfig(projectRoot, "postcss.config");
@@ -3521,23 +3022,25 @@ async function theoPluginAsync(rootOrOptions) {
       })
     );
   }
-  const { appTypedClientPlugin } = await import("./app-typed-client-2ZEGNFJP.js");
+  const { assetsMapPlugin } = await import("./assets-map-CV2YZ3MY.js");
+  const assetsMap = assetsMapPlugin({ appDir: resolve9(projectRoot, options.appDir ?? "app") });
+  const { appTypedClientPlugin } = await import("./app-typed-client-C4LRUSIS.js");
   const appClientPlugin = appTypedClientPlugin({
     cwd: projectRoot,
     serverDir: serverDirAbs,
-    distDir: resolve10(projectRoot, ".theokit")
+    distDir: resolve9(projectRoot, ".theokit")
   });
-  const { actionsVirtualModule } = await import("./actions-virtual-module-YIWQTI6Q.js");
+  const { actionsVirtualModule } = await import("./actions-virtual-module-DH3N34I6.js");
   const actionsPlugin = actionsVirtualModule({
     serverDir: serverDirAbs,
-    distDir: resolve10(projectRoot, ".theokit")
+    distDir: resolve9(projectRoot, ".theokit")
   });
   const { agentsTypedClientPlugin } = await import("./agents-typed-client-PVUZU65B.js");
-  const { generateManifest } = await import("./internal-api-OK7FS2ZF.js");
+  const { generateManifest } = await import("./internal-api-XRIBUACB.js");
   const agentsClientPlugin = agentsTypedClientPlugin({
     projectRoot,
     agentsDir: agentsDirName,
-    distDir: resolve10(projectRoot, ".theokit"),
+    distDir: resolve9(projectRoot, ".theokit"),
     // Agents live at <projectRoot>/<agentsDir>; generateManifest scans them via the server dir's
     // parent (projectRoot for the canonical layout) + the agents dir name (#95 follow-up).
     scanManifest: () => generateManifest(serverDirAbs, projectRoot, agentsDirName)
@@ -3550,7 +3053,7 @@ async function theoPluginAsync(rootOrOptions) {
   const controllerTransformPlugin = controllerSwcTransformPlugin({
     serverDir: serverDirAbs
   });
-  const { serverOnlyImportBoundary } = await import("./server-boundary-CNYNVFT5.js");
+  const { serverOnlyImportBoundary } = await import("./server-boundary-YN5HAICY.js");
   const serverBoundaryPlugin = serverOnlyImportBoundary({
     projectRoot,
     serverDir: serverDirAbs
@@ -3566,15 +3069,16 @@ async function theoPluginAsync(rootOrOptions) {
     appClientPlugin,
     actionsPlugin,
     agentsClientPlugin,
-    routesHmrPlugin
+    routesHmrPlugin,
+    assetsMap
   ];
 }
 function buildOptimizeDepsInclude(projectRoot, viteOptimizeDeps) {
   const include = [];
-  if (existsSync8(resolve10(projectRoot, "node_modules", "@theokit", "ui"))) {
+  if (existsSync8(resolve9(projectRoot, "node_modules", "@theokit", "ui"))) {
     include.push("@theokit/ui");
   }
-  if (existsSync8(resolve10(projectRoot, "node_modules", "lucide-react"))) {
+  if (existsSync8(resolve9(projectRoot, "node_modules", "lucide-react"))) {
     include.push("lucide-react");
   }
   include.push("devalue");
@@ -3600,8 +3104,8 @@ var VIRTUAL_MODULE_IDS = {
 function theoPlugin(rootOrOptions) {
   const options = typeof rootOrOptions === "string" ? { root: rootOrOptions } : rootOrOptions ?? {};
   const projectRoot = options.root ?? process.cwd();
-  const appDir = resolve10(projectRoot, options.appDir ?? "app");
-  const serverDir = resolve10(projectRoot, options.serverDir ?? "server");
+  const appDir = resolve9(projectRoot, options.appDir ?? "app");
+  const serverDir = resolve9(projectRoot, options.serverDir ?? "server");
   const agentsDir = options.agentsDir ?? "agents";
   const ssrEnabled = options.ssr ?? false;
   const currentDir = dirname4(fileURLToPath(import.meta.url));
@@ -3733,4 +3237,4 @@ export {
   theoPluginAsync,
   theoPlugin
 };
-//# sourceMappingURL=chunk-YNK7DW5V.js.map
+//# sourceMappingURL=chunk-QVXMAHZC.js.map