theokit 0.72.0 → 0.73.0

package/dist/{actions-virtual-module-WP47EKD7.js → actions-virtual-module-OHENNMQG.js}

@@ -1,9 +1,9 @@
-import "./chunk-JMN4COMK.js";
+import "./chunk-D7STTNQN.js";
 import "./chunk-WBB3MEEN.js";
 import "./chunk-WSOAN4KN.js";
 import "./chunk-ENSFCKP6.js";
-import "./chunk-KOG5K26V.js";
-import "./chunk-4D4YVXHR.js";
+import "./chunk-2Z7TANA4.js";
+import "./chunk-SYIQV4UH.js";
 import "./chunk-P6OS7652.js";
 import "./chunk-ZDUO4IYN.js";
 import "./chunk-IDWN2OSG.js";
@@ -234,4 +234,4 @@ export const actions = manifest
 export {
   actionsVirtualModule
 };
-//# sourceMappingURL=actions-virtual-module-WP47EKD7.js.map
+//# sourceMappingURL=actions-virtual-module-OHENNMQG.js.map

package/dist/{actions-virtual-module-6LND2WHL.js → actions-virtual-module-QCDKQ6QD.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import "tsx/esm";
-import "./chunk-EZHDAVAF.js";
+import "./chunk-EDBQM6RB.js";
 import "./chunk-BINRCILF.js";
-import "./chunk-QD5X56I3.js";
+import "./chunk-FNJVSFEC.js";
 import "./chunk-WSMLSIS5.js";
-import "./chunk-PEL3MJLM.js";
+import "./chunk-MX63AWEK.js";
 import "./chunk-C27VRUVN.js";
 import "./chunk-7UZZHCRN.js";
 import "./chunk-RCFD5W5V.js";
@@ -218,4 +218,4 @@ export const actions = manifest
 export {
   actionsVirtualModule
 };
-//# sourceMappingURL=actions-virtual-module-6LND2WHL.js.map
+//# sourceMappingURL=actions-virtual-module-QCDKQ6QD.js.map

package/dist/adapters/agent-mount.js

@@ -3,11 +3,11 @@ import {
   createSubjectResolverFromFactory,
   matchAgentAuxRoute,
   serveMatchedAuxRoute
-} from "../chunk-IVGQMV3S.js";
+} from "../chunk-6U67SO5U.js";
 import {
   mountAgent
 } from "../chunk-WBB3MEEN.js";
-import "../chunk-4D4YVXHR.js";
+import "../chunk-SYIQV4UH.js";
 import "../chunk-P6OS7652.js";
 import "../chunk-IDWN2OSG.js";
 import "../chunk-PVNMLZ5G.js";

package/dist/adapters/security-headers.d.ts

@@ -32,15 +32,29 @@ export { b as buildSecurityHeaders } from '../security-headers-vris2MQq.js';
  * response — so a target reaches one only if it renders the HTML at request
  * time and can put the same value on the script tags it emits.
  *
- * Exactly one deploy path does: **Cloudflare with `ssrStreaming: true`**, whose
- * worker calls `renderStreamingWeb(request, { nonce })`, and that renderer
- * threads the value into `renderToReadableStream` and into the hydration script
- * (`router/entry-server.ts`). That branch mints a nonce per request and builds
- * its CSP from it. Everything else serves HTML written at build time, or no
- * HTML at all, and carries a **nonce-less CSP** — the same answer
- * `buildSecurityHeaders` already gives a prerendered route (EC-4), for the same
- * reason: a nonce in the header with no nonce on the tag blocks every inline
- * script.
+ * Two paths do, and this docblock named one of them until 2026-09-24:
+ *
+ *   - **Cloudflare with `ssrStreaming: true`** — the worker calls
+ *     `renderStreamingWeb(request, { nonce })`, and that renderer threads the
+ *     value into `renderToReadableStream` and into the hydration script
+ *     (`router/entry-server.ts`).
+ *   - **node** — `theokit start` mints one per request
+ *     (`cli/commands/start/request-handler.ts:272`) and stamps it onto the
+ *     inline scripts in the head. The `node` deploy adapter serves through that
+ *     same handler, which is what its own comment says
+ *     (`adapters/node.ts:24`).
+ *
+ * The six Web-standards targets that DO declare a limit here — aws-lambda, bun,
+ * deno-deploy, netlify, vercel, and Cloudflare without `ssrStreaming` — serve
+ * HTML written at build time, or no HTML at all, and carry a **nonce-less
+ * CSP**: the same answer `buildSecurityHeaders` already gives a prerendered
+ * route (EC-4), for the same reason — a nonce in the header with no nonce on
+ * the tag blocks every inline script.
+ *
+ * `node` declares no `mintsNonce` at all, because it never calls
+ * {@link describeDeployedSecurityHeaders}. That is a gap in what its build
+ * PRINTS, not a wrong declaration, and closing it is its own change rather than
+ * a line in the item that corrected this paragraph.
  *
  * That asymmetry is real and is not smoothed over. It is stated in the emitted
  * entry, printed by the build through
@@ -104,7 +118,9 @@ interface DeployedSecurityHeaderLimits {
     securityHeaders: SecurityHeadersConfig | undefined;
     /**
      * Does the emitted handler render HTML at request time and mint a CSP nonce
-     * for it? True only for Cloudflare with `ssrStreaming: true`.
+     * for it? Among the targets that CALL this function, true only for Cloudflare
+     * with `ssrStreaming: true`. `node` also mints one and is not among them —
+     * see the note in this module's header docblock.
      */
     mintsNonce: boolean;
     /**
@@ -133,7 +149,7 @@ interface DeployedSecurityHeaderLimits {
 /**
  * What the build tells the operator, once, per target.
  *
- * Silent degradation is the failure mode `rules/three-target-parity.md` exists
+ * Silent degradation is the failure mode `docs/program/three-target-parity.md` exists
  * to prevent. Two things degrade quietly here and both are named rather than
  * discovered in production: a CSP that refuses inline scripts on a deploy while
  * allowing them locally, and an HTML document that never passes through the

package/dist/adapters/security-headers.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/adapters/security-headers.ts"],"mappings":";;;;;;;;;AA6FO,SAAS,4BAA4B,QAAqD;AAC/F,SAAO;AAAA,IACL,mCAAmC,mCAAmC,MAAM,CAAC;AAAA,IAC7E;AAAA,EACF;AACF;AAEO,SAAS,mCACd,SACQ;AACR,SAAO,KAAK,UAAU,WAAW,CAAC,CAAC;AACrC;AAyBO,SAAS,oBAAoB,UAAoB,SAA2C;AACjG,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,CAAC,SAAS,QAAQ,IAAI,GAAG,EAAG,UAAS,QAAQ,IAAI,KAAK,KAAK;AAAA,EACjE;AACA,SAAO;AACT;AAgDO,SAAS,gCAAgC,QAA8C;AAC5F,QAAM,UAAU,qBAAqB,OAAO,mBAAmB,CAAC,GAAG,EAAE,YAAY,KAAK,CAAC;AACvF,QAAM,QAAQ,OAAO,KAAK,OAAO;AACjC,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO,SAAS,OAAO,MAAM;AAAA,EAC/B;AAEA,QAAM,QAAQ;AAAA,IACZ,iDAA4C,OAAO,MAAM,eAAe,MAAM,KAAK,IAAI,CAAC;AAAA,EAC1F;AACA,QAAM,WAAW,MAAM,KAAK,CAAC,SAAS,KAAK,WAAW,yBAAyB,CAAC;AAChF,MAAI,YAAY,CAAC,OAAO,YAAY;AAClC,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,oBAAoB,uBAAuB;AACpD,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,oBAAoB,sBAAsB;AACnD,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;","names":[]}
+{"version":3,"sources":["../../src/adapters/security-headers.ts"],"mappings":";;;;;;;;;AA2GO,SAAS,4BAA4B,QAAqD;AAC/F,SAAO;AAAA,IACL,mCAAmC,mCAAmC,MAAM,CAAC;AAAA,IAC7E;AAAA,EACF;AACF;AAEO,SAAS,mCACd,SACQ;AACR,SAAO,KAAK,UAAU,WAAW,CAAC,CAAC;AACrC;AAyBO,SAAS,oBAAoB,UAAoB,SAA2C;AACjG,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,CAAC,SAAS,QAAQ,IAAI,GAAG,EAAG,UAAS,QAAQ,IAAI,KAAK,KAAK;AAAA,EACjE;AACA,SAAO;AACT;AAkDO,SAAS,gCAAgC,QAA8C;AAC5F,QAAM,UAAU,qBAAqB,OAAO,mBAAmB,CAAC,GAAG,EAAE,YAAY,KAAK,CAAC;AACvF,QAAM,QAAQ,OAAO,KAAK,OAAO;AACjC,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO,SAAS,OAAO,MAAM;AAAA,EAC/B;AAEA,QAAM,QAAQ;AAAA,IACZ,iDAA4C,OAAO,MAAM,eAAe,MAAM,KAAK,IAAI,CAAC;AAAA,EAC1F;AACA,QAAM,WAAW,MAAM,KAAK,CAAC,SAAS,KAAK,WAAW,yBAAyB,CAAC;AAChF,MAAI,YAAY,CAAC,OAAO,YAAY;AAClC,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,oBAAoB,uBAAuB;AACpD,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,oBAAoB,sBAAsB;AACnD,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;","names":[]}

package/dist/{agent-KUP3XA2S.js → agent-OWJ5A7W5.js}

@@ -3,7 +3,7 @@ import "tsx/esm";
 import {
   agentCommand,
   createAgentSsrLoader
-} from "./chunk-LJNMSKFL.js";
+} from "./chunk-HDAILYVM.js";
 import "./chunk-BINRCILF.js";
 import "./chunk-R7G2B2WH.js";
 import "./chunk-Z7CJHDLS.js";
@@ -12,4 +12,4 @@ export {
   agentCommand,
   createAgentSsrLoader
 };
-//# sourceMappingURL=agent-KUP3XA2S.js.map
+//# sourceMappingURL=agent-OWJ5A7W5.js.map

package/dist/{app-typed-client-IMRSVARP.js → app-typed-client-2PTK2SJH.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import "tsx/esm";
-import "./chunk-EZHDAVAF.js";
+import "./chunk-EDBQM6RB.js";
 import "./chunk-BINRCILF.js";
 import {
   scanControllerModules
-} from "./chunk-QD5X56I3.js";
+} from "./chunk-FNJVSFEC.js";
 import "./chunk-WSMLSIS5.js";
-import "./chunk-PEL3MJLM.js";
+import "./chunk-MX63AWEK.js";
 import "./chunk-C27VRUVN.js";
 import "./chunk-7UZZHCRN.js";
 import {
@@ -411,4 +411,4 @@ export {
   generateClientDts,
   shouldReemitForFile
 };
-//# sourceMappingURL=app-typed-client-IMRSVARP.js.map
+//# sourceMappingURL=app-typed-client-2PTK2SJH.js.map

package/dist/{app-typed-client-6VIHSYJH.js → app-typed-client-ILLQYTXP.js}

@@ -1,11 +1,11 @@
 import {
   scanControllerModules
-} from "./chunk-JMN4COMK.js";
+} from "./chunk-D7STTNQN.js";
 import "./chunk-WBB3MEEN.js";
 import "./chunk-WSOAN4KN.js";
 import "./chunk-ENSFCKP6.js";
-import "./chunk-KOG5K26V.js";
-import "./chunk-4D4YVXHR.js";
+import "./chunk-2Z7TANA4.js";
+import "./chunk-SYIQV4UH.js";
 import "./chunk-P6OS7652.js";
 import "./chunk-ZDUO4IYN.js";
 import "./chunk-IDWN2OSG.js";
@@ -427,4 +427,4 @@ export {
   generateClientDts,
   shouldReemitForFile
 };
-//# sourceMappingURL=app-typed-client-6VIHSYJH.js.map
+//# sourceMappingURL=app-typed-client-ILLQYTXP.js.map

package/dist/{aws-lambda-7AZNJGWU.js → aws-lambda-OP2L5RKZ.js}

@@ -2,7 +2,7 @@
 import "tsx/esm";
 import {
   deployedEntryPreamble
-} from "./chunk-IB5VIXLR.js";
+} from "./chunk-R36YNWBU.js";
 import {
   JSON_NOT_FOUND_RESPONSE,
   agentsDirLiteral,
@@ -14,7 +14,7 @@ import {
   rateLimitCheckFragment,
   scannedFromLoaderCache,
   serverDirLiteral
-} from "./chunk-C5CAL3DX.js";
+} from "./chunk-SEGD3JUC.js";
 import {
   nodeAdapter
 } from "./chunk-G7U7FQVC.js";
@@ -302,4 +302,4 @@ export {
   renderAwsLambdaEntry,
   responseToLambdaResultV2
 };
-//# sourceMappingURL=aws-lambda-7AZNJGWU.js.map
+//# sourceMappingURL=aws-lambda-OP2L5RKZ.js.map

package/dist/{build-4J24BAEC.js → build-CVP2XU5M.js}

@@ -3,14 +3,14 @@ import "tsx/esm";
 import {
   describeControllerArtifacts,
   emitControllerArtifacts
-} from "./chunk-RE2WE7CD.js";
+} from "./chunk-LOOOB46A.js";
 import {
   validateProjectStructure
 } from "./chunk-GEQJAFSV.js";
 import {
   preflightNodeAndBindings
 } from "./chunk-KTMQUYED.js";
-import "./chunk-QD5X56I3.js";
+import "./chunk-FNJVSFEC.js";
 import "./chunk-C27VRUVN.js";
 import "./chunk-7UZZHCRN.js";
 import {
@@ -554,7 +554,7 @@ async function buildCommand(options) {
 `);
 }
 async function runAdapterBuild(target, config, cwd) {
-  const { theoPluginAsync } = await import("./vite-plugin-WFA7NPYK.js");
+  const { theoPluginAsync } = await import("./vite-plugin-54XIRMKT.js");
   const { default: react } = await import("@vitejs/plugin-react");
   const ctx = {
     // `react()` may return Plugin or Plugin[] depending on version; spread the
@@ -608,7 +608,7 @@ async function runAdapterBuild(target, config, cwd) {
       };
     }
   };
-  const { resolveAdapter } = await import("./registry-SDBODRU6.js");
+  const { resolveAdapter } = await import("./registry-L6JG75LY.js");
   const adapter = await resolveAdapter(target);
   const { warnUnappliedConfig, assertRateLimitEnforceable } = await import("./config-support-SB5NDQZB.js");
   assertRateLimitEnforceable(config, adapter, target);
@@ -681,4 +681,4 @@ function relativize3(absPath, root) {
 export {
   buildCommand
 };
-//# sourceMappingURL=build-4J24BAEC.js.map
+//# sourceMappingURL=build-CVP2XU5M.js.map

package/dist/{bun-NKVHOFSJ.js → bun-CZXHPK2W.js}

@@ -2,10 +2,10 @@
 import "tsx/esm";
 import {
   planDeployedPlugins
-} from "./chunk-V5SSTT3C.js";
+} from "./chunk-C43AHOHI.js";
 import {
   deployedEntryPreamble
-} from "./chunk-IB5VIXLR.js";
+} from "./chunk-R36YNWBU.js";
 import {
   agentsDirLiteral,
   deployedAgentsFragment,
@@ -15,7 +15,7 @@ import {
   describeDeployedSecurityHeaders,
   rateLimitCheckFragment,
   serverDirLiteral
-} from "./chunk-C5CAL3DX.js";
+} from "./chunk-SEGD3JUC.js";
 import {
   nodeAdapter
 } from "./chunk-G7U7FQVC.js";
@@ -259,4 +259,4 @@ export {
   bunAdapter,
   renderBunEntry
 };
-//# sourceMappingURL=bun-NKVHOFSJ.js.map
+//# sourceMappingURL=bun-CZXHPK2W.js.map

package/dist/{chunk-KOG5K26V.js → chunk-2Z7TANA4.js}

@@ -6,7 +6,7 @@ import {
   runZodValidation,
   sendError,
   sendJson
-} from "./chunk-4D4YVXHR.js";
+} from "./chunk-SYIQV4UH.js";
 import {
   enforceCsrf
 } from "./chunk-P6OS7652.js";
@@ -1039,4 +1039,4 @@ export {
   createCorsHandler,
   createCorsWebHandler
 };
-//# sourceMappingURL=chunk-KOG5K26V.js.map
+//# sourceMappingURL=chunk-2Z7TANA4.js.map

package/dist/{chunk-IVGQMV3S.js → chunk-6U67SO5U.js}

@@ -16,7 +16,7 @@ import {
 } from "./chunk-WBB3MEEN.js";
 import {
   createServerContext
-} from "./chunk-4D4YVXHR.js";
+} from "./chunk-SYIQV4UH.js";
 import {
   validateCsrfRequest
 } from "./chunk-P6OS7652.js";
@@ -570,4 +570,4 @@ export {
   createAgentSubjectResolver,
   createSubjectResolverFromFactory
 };
-//# sourceMappingURL=chunk-IVGQMV3S.js.map
+//# sourceMappingURL=chunk-6U67SO5U.js.map

package/dist/{chunk-V5SSTT3C.js → chunk-C43AHOHI.js}

@@ -49,4 +49,4 @@ function nameOf(entry) {
 export {
   planDeployedPlugins
 };
-//# sourceMappingURL=chunk-V5SSTT3C.js.map
+//# sourceMappingURL=chunk-C43AHOHI.js.map

package/dist/chunk-C43AHOHI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapters/deployed-plugins-module.ts"],"sourcesContent":["/**\n * The plugins module a build writes beside a deployed entry (usetheokit/theokit#425).\n *\n * ## What it is for\n *\n * `config.plugins` used to reach no deployed target at all, so `onRequest`, `preHandler`,\n * `onResponse` and `onError` were dead on every Web-standards deployment while firing locally. The\n * reason was never the hook loop — `executeRoute` has always run it — but that a constructed\n * plugin closes over state, and there is no literal for a closure.\n *\n * A plugin declared as a module SPECIFIER can be carried, because the build can emit a static\n * import for it. That is the road `renderBakedRoutes` already takes for route modules (#369):\n * resolve on the build machine, emit a static specifier, let the target's bundler see through it.\n *\n * ## Why the specifier is `../../`\n *\n * Every target that can carry plugins writes its entry two levels below the project root —\n * `.theokit/cloudflare/`, `.theokit/bun/`, `.theokit/deno/` — and a declared specifier is relative\n * to that root. The same arithmetic `renderBakedRoutes` does for routes, for the same reason.\n *\n * ## Which targets can carry them at all\n *\n * Only the ones whose output is BUNDLED from the project: Cloudflare (wrangler), Bun and Deno all\n * resolve the emitted import against the app's own source tree. Vercel, Netlify and AWS Lambda\n * receive a standalone function directory and never see the app's modules, so for them a named\n * refusal — which `findUnappliedConfig` already prints — remains the honest answer, and this module\n * is not called.\n */\n\n/**\n * A plugin the build was asked to carry and cannot.\n *\n * Its own type because the alternative is the defect this whole issue is: hooks that do not fire\n * and nothing that says so. A target that CAN carry a named module but was handed a closure has\n * something actionable to say, so it says it at build time rather than at the first request\n * (`docs/program/three-target-parity.md` § 3 — refuse by name).\n */\nexport class UnbakeablePluginError extends Error {\n  constructor(index: number, name: string, target: string) {\n    super(\n      `plugins[${index}] (\"${name}\") cannot be carried to the ${target} target: it is a constructed ` +\n        `plugin, and a closure has no literal a generated entry could hold. Declare it by module ` +\n        `specifier instead — plugins: ['./src/plugins/${name}.ts'] — so the build can emit a ` +\n        `static import for it. Both forms work locally; only the specifier survives a deploy.`,\n    )\n    this.name = 'UnbakeablePluginError'\n  }\n}\n\nexport interface DeployedPluginsPlan {\n  /** The module source to write beside the entry. */\n  readonly source: string\n  /** What the entry imports it as — a sibling, because both are written to the same directory. */\n  readonly moduleSpecifier: string\n  /** The declared specifiers, in order, for the build to report. */\n  readonly specifiers: readonly string[]\n}\n\nconst MODULE_FILENAME = 'theo.plugins.mjs'\n\n/**\n * Plan the plugins module for a target that can carry one.\n *\n * @param plugins - the raw `config.plugins` array.\n * @param target - the deploy target, named in the refusal so the message says where it applies.\n * @returns `undefined` when the app declares no plugins, so an app carrying none emits nothing.\n * @throws UnbakeablePluginError when an entry is a constructed plugin rather than a specifier.\n */\nexport function planDeployedPlugins(\n  plugins: readonly unknown[] | undefined,\n  target: string,\n): DeployedPluginsPlan | undefined {\n  if (plugins === undefined || plugins.length === 0) return undefined\n\n  const specifiers = plugins.map((entry, index) => {\n    if (typeof entry === 'string') return entry\n    throw new UnbakeablePluginError(index, nameOf(entry), target)\n  })\n\n  const vars = specifiers.map((_, i) => `__theoPlugin${String(i)}`)\n\n  return {\n    moduleSpecifier: `./${MODULE_FILENAME}`,\n    specifiers,\n    source: [\n      `// Generated by Theo — the plugins the deployed entry registers (usetheokit/theokit#425).`,\n      `//`,\n      `// Static imports, resolved on the build machine. A constructed plugin has no literal, which`,\n      `// is why the config declares these by module specifier and why this file can exist at all.`,\n      ...specifiers.map((s, i) => `import ${vars[i]} from '${entrySpecifier(s)}'`),\n      ``,\n      `// Order is DECLARED order, because plugin order is hook order.`,\n      `export default { plugins: [${vars.join(', ')}] }`,\n      ``,\n    ].join('\\n'),\n  }\n}\n\n/**\n * How the emitted module names a declared specifier.\n *\n * A RELATIVE specifier is relative to the project root, and the module sits two levels below it, so\n * it is re-based — the arithmetic `renderBakedRoutes` does for routes. A BARE specifier is a package\n * and must be left alone: `../../my-plugin-pkg` is a path that does not exist, where\n * `my-plugin-pkg` is a dependency the target's bundler resolves from `node_modules` like any other.\n */\nfunction entrySpecifier(specifier: string): string {\n  if (!specifier.startsWith('.')) return specifier\n  return `../../${specifier.replace(/^\\.\\/+/, '')}`\n}\n\n/** The plugin's own name when it has one, so the refusal names the thing the author wrote. */\nfunction nameOf(entry: unknown): string {\n  if (entry != null && typeof entry === 'object') {\n    const named = (entry as { name?: unknown }).name\n    if (typeof named === 'string' && named.length > 0) return named\n  }\n  return 'unnamed'\n}\n"],"mappings":";;;;AAqCO,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAC/C,YAAY,OAAe,MAAc,QAAgB;AACvD;AAAA,MACE,WAAW,KAAK,OAAO,IAAI,+BAA+B,MAAM,0KAEd,IAAI;AAAA,IAExD;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAWA,IAAM,kBAAkB;AAUjB,SAAS,oBACd,SACA,QACiC;AACjC,MAAI,YAAY,UAAa,QAAQ,WAAW,EAAG,QAAO;AAE1D,QAAM,aAAa,QAAQ,IAAI,CAAC,OAAO,UAAU;AAC/C,QAAI,OAAO,UAAU,SAAU,QAAO;AACtC,UAAM,IAAI,sBAAsB,OAAO,OAAO,KAAK,GAAG,MAAM;AAAA,EAC9D,CAAC;AAED,QAAM,OAAO,WAAW,IAAI,CAAC,GAAG,MAAM,eAAe,OAAO,CAAC,CAAC,EAAE;AAEhE,SAAO;AAAA,IACL,iBAAiB,KAAK,eAAe;AAAA,IACrC;AAAA,IACA,QAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAG,WAAW,IAAI,CAAC,GAAG,MAAM,UAAU,KAAK,CAAC,CAAC,UAAU,eAAe,CAAC,CAAC,GAAG;AAAA,MAC3E;AAAA,MACA;AAAA,MACA,8BAA8B,KAAK,KAAK,IAAI,CAAC;AAAA,MAC7C;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,EACb;AACF;AAUA,SAAS,eAAe,WAA2B;AACjD,MAAI,CAAC,UAAU,WAAW,GAAG,EAAG,QAAO;AACvC,SAAO,SAAS,UAAU,QAAQ,UAAU,EAAE,CAAC;AACjD;AAGA,SAAS,OAAO,OAAwB;AACtC,MAAI,SAAS,QAAQ,OAAO,UAAU,UAAU;AAC9C,UAAM,QAAS,MAA6B;AAC5C,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAAA,EAC5D;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-YWWMYEAC.js → chunk-CLSYYO5F.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-O2KGDLA7.js";
 import {
   validateRouteInput
-} from "./chunk-4D4YVXHR.js";
+} from "./chunk-SYIQV4UH.js";
 import {
   evaluateRoutePolicy,
   subjectFromContext
@@ -296,4 +296,4 @@ export {
   callProcedure,
   createOpenApiHandler
 };
-//# sourceMappingURL=chunk-YWWMYEAC.js.map
+//# sourceMappingURL=chunk-CLSYYO5F.js.map

package/dist/{chunk-BZ6DFSKG.js → chunk-D3M7LPHY.js}

@@ -7,13 +7,13 @@ import {
 } from "./chunk-SSYDEKWF.js";
 import {
   dispatchControllerRequest
-} from "./chunk-JMN4COMK.js";
+} from "./chunk-D7STTNQN.js";
 import {
   createAgentSubjectResolver,
   isAgentCardPath,
   matchAgentAuxRoute,
   serveMatchedAuxRoute
-} from "./chunk-IVGQMV3S.js";
+} from "./chunk-6U67SO5U.js";
 import {
   admitAgentRequest,
   agentAccessDenied,
@@ -52,13 +52,13 @@ import {
   executeAction,
   executeRoute,
   handleBatchRequest
-} from "./chunk-KOG5K26V.js";
+} from "./chunk-2Z7TANA4.js";
 import {
   createWebRequestSource,
   incomingMessageToHandlerRequest,
   sendError,
   writeWebResponseToServerResponse
-} from "./chunk-4D4YVXHR.js";
+} from "./chunk-SYIQV4UH.js";
 import {
   validateCsrfRequest
 } from "./chunk-P6OS7652.js";
@@ -2297,15 +2297,19 @@ function buildAppTreeJs(options) {
   const theme = options.theoUi?.theme ?? "violet-forge";
   if (options.theoUi) {
     return [
-      `React.createElement(TheoUIProvider, { theme: { defaultTheme: '${theme}' } },`,
-      `      React.createElement(Suspense, { fallback: null },`,
-      `        React.createElement(StaticRouterProvider, { router, context, hydrate: false })`,
+      `React.createElement(NonceProvider, { nonce: options.nonce },`,
+      `      React.createElement(TheoUIProvider, { theme: { defaultTheme: '${theme}' } },`,
+      `        React.createElement(Suspense, { fallback: null },`,
+      `          React.createElement(StaticRouterProvider, { router, context, hydrate: false })`,
+      `        )`,
       `      )`,
       `    )`
     ].join("\n");
   }
-  return `React.createElement(Suspense, { fallback: null },
-      React.createElement(StaticRouterProvider, { router, context, hydrate: false })
+  return `React.createElement(NonceProvider, { nonce: options.nonce },
+      React.createElement(Suspense, { fallback: null },
+        React.createElement(StaticRouterProvider, { router, context, hydrate: false })
+      )
     )`;
 }
 function hydrationDataExtractSnippet() {
@@ -2327,6 +2331,7 @@ function generateSingleShotEntry(options) {
     `import { createStaticHandler, createStaticRouter, StaticRouterProvider, matchRoutes } from 'react-router'`,
     `import { PassThrough } from 'node:stream'`,
     `import { routes, __theoPreloadMap, __theoPreloadPathsFor } from '/@theo/route-manifest'`,
+    `import { NonceProvider } from 'theokit/client'`,
     theoUiImport,
     `export async function render(url, options = {}) {`,
     // Resolve the matched pages BEFORE rendering.
@@ -2616,6 +2621,7 @@ function generateStreamingEntry(options) {
     `import { renderToPipeableStream, renderToReadableStream } from 'react-dom/server'`,
     `import { createStaticHandler, createStaticRouter, StaticRouterProvider, matchRoutes } from 'react-router'`,
     `import { routes, __theoPreloadMap, __theoPreloadPathsFor } from '/@theo/route-manifest'`,
+    `import { NonceProvider } from 'theokit/client'`,
     theoUiImport,
     ``,
     ...streamingDocumentHelpers(),
@@ -3024,19 +3030,19 @@ async function theoPluginAsync(rootOrOptions) {
   }
   const { assetsMapPlugin } = await import("./assets-map-CV2YZ3MY.js");
   const assetsMap = assetsMapPlugin({ appDir: resolve9(projectRoot, options.appDir ?? "app") });
-  const { appTypedClientPlugin } = await import("./app-typed-client-6VIHSYJH.js");
+  const { appTypedClientPlugin } = await import("./app-typed-client-ILLQYTXP.js");
   const appClientPlugin = appTypedClientPlugin({
     cwd: projectRoot,
     serverDir: serverDirAbs,
     distDir: resolve9(projectRoot, ".theokit")
   });
-  const { actionsVirtualModule } = await import("./actions-virtual-module-WP47EKD7.js");
+  const { actionsVirtualModule } = await import("./actions-virtual-module-OHENNMQG.js");
   const actionsPlugin = actionsVirtualModule({
     serverDir: serverDirAbs,
     distDir: resolve9(projectRoot, ".theokit")
   });
   const { agentsTypedClientPlugin } = await import("./agents-typed-client-PVUZU65B.js");
-  const { generateManifest } = await import("./internal-api-3IZVNNGB.js");
+  const { generateManifest } = await import("./internal-api-6XNLCNI5.js");
   const agentsClientPlugin = agentsTypedClientPlugin({
     projectRoot,
     agentsDir: agentsDirName,
@@ -3053,7 +3059,7 @@ async function theoPluginAsync(rootOrOptions) {
   const controllerTransformPlugin = controllerSwcTransformPlugin({
     serverDir: serverDirAbs
   });
-  const { serverOnlyImportBoundary } = await import("./server-boundary-WUKORSW2.js");
+  const { serverOnlyImportBoundary } = await import("./server-boundary-E5GFVPLB.js");
   const serverBoundaryPlugin = serverOnlyImportBoundary({
     projectRoot,
     serverDir: serverDirAbs
@@ -3237,4 +3243,4 @@ export {
   theoPluginAsync,
   theoPlugin
 };
-//# sourceMappingURL=chunk-BZ6DFSKG.js.map
+//# sourceMappingURL=chunk-D3M7LPHY.js.map