theokit 0.48.13 → 0.50.0

package/dist/app-typed-client-DQM3Y6YY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/vite-plugin/app-typed-client.ts","../src/vite-plugin/controller-client-emit.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Codegen-time fs ops: all paths derive from `opts.serverDir` / `opts.distDir`\n * (vite plugin opts — trusted, set by the framework's CLI). The plugin only\n * runs at dev/build time, never serves user HTTP input. No path traversal\n * surface here.\n */\n/**\n * Phase 2 + Phase 4 of G1 (g1-client-codegen-plan.md):\n *\n * 1. `generateClientDts(manifest, dtsOutPath)` — pure function emitting the\n *    `.theokit/client.d.ts` shape (declared module `@theo/client`).\n * 2. `appTypedClientPlugin(opts)` — Vite plugin wrapper that calls (1),\n *    writes the file atomically, and rewrites on route file changes.\n *\n * Implementation notes:\n *  - Pure (1) is unit-testable without Vite or a filesystem (see G1-P2 tests).\n *  - EC-2: kebab-case segments → camelCase; unsafe chars → bracket-access.\n *  - EC-3: collision between HTTP method name and sub-segment name → method\n *    wins; a sub-segment gets a `_` suffix + a warning comment.\n *  - EC-6: the write is `writeFileSync(tmp) + renameSync(tmp, final)` (POSIX atomic).\n *  - EC-8: imports normalize `\\\\` → `/`.\n */\n\nimport { mkdirSync, readFileSync, renameSync, writeFileSync, existsSync } from 'node:fs'\nimport { dirname, isAbsolute, posix, relative, resolve } from 'node:path'\n\nimport type { Plugin, ViteDevServer } from 'vite'\n\nimport { HTTP_METHODS, type HttpMethod } from '../core/contracts/http-methods.js'\nimport { generateManifest, type ManifestRoute, type TheoManifest } from '../server/internal-api.js'\n\nimport { collectControllerRouteData, type ControllerRouteData } from './controller-client-emit.js'\n\nconst FILE_HEADER = `// AUTO-GENERATED by theokit — do not edit.\n// Source: theokit/packages/theo/src/vite-plugin/app-typed-client.ts (G1 plan).\n// To refresh: \\`pnpm dev\\` or \\`pnpm build\\` regenerates this file on every route change.\n\n/* eslint-disable */\n`\n\ninterface ControllerLeaf {\n  /** Import alias of the controller class (`_c0`). */\n  classAlias: string\n  /** Controller method name backing the route (`findById`). */\n  methodName: string\n  /**\n   * theokit#124 — module specifier + exported name of the `@Body` schema, when it has one, so the\n   * emitted signature can say `z.infer<typeof import('...').zCreate>` instead of `unknown`.\n   */\n  bodySchema?: { importPath: string; exportName: string }\n  /** theokit#124 — same for `@Query`. */\n  querySchema?: { importPath: string; exportName: string }\n}\n\ninterface TreeNode {\n  /** sub-namespaces — keyed by segment name (already normalized). */\n  children: Map<string, TreeNode>\n  /** File-based routes: HTTP method → import alias (`InferResponse<typeof alias>`). */\n  methods: Map<HttpMethod, string>\n  /** Decorator controllers: HTTP method → class alias + method (`Awaited<ReturnType<...>>`). */\n  controllerMethods: Map<HttpMethod, ControllerLeaf>\n  /** Whether any descendant declares dynamic params (for params type construction). */\n  paramNamesAccumulated: string[]\n}\n\nfunction makeNode(): TreeNode {\n  return {\n    children: new Map(),\n    methods: new Map(),\n    controllerMethods: new Map(),\n    paramNamesAccumulated: [],\n  }\n}\n\n/**\n * Normalize a path segment to a valid TS identifier when possible.\n * EC-2: kebab-case → camelCase; pure dynamic (`:name`) → identifier `name`;\n * starts with digit or unsafe char → emit as bracket-access key.\n */\nfunction normalizeSegment(raw: string): { identifier: string; bracket: boolean } {\n  // Dynamic segment: leading `:` (e.g. `:id` or `:...slug`).\n  let s = raw\n  if (s.startsWith(':...')) s = s.slice(4)\n  else if (s.startsWith(':')) s = s.slice(1)\n\n  // kebab → camel\n  const camel = s.replace(/-([a-z0-9])/gi, (_, c: string) => c.toUpperCase())\n\n  // Valid TS identifier (cannot start with digit, must be [a-zA-Z_$][a-zA-Z0-9_$]*)\n  if (/^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(camel)) {\n    return { identifier: camel, bracket: false }\n  }\n  // Fallback: bracket-access (keep raw form intact for JSON-string key)\n  return { identifier: s, bracket: true }\n}\n\nfunction importPathFor(dtsOutPath: string, routeFileAbs: string): string {\n  let rel = relative(dirname(dtsOutPath), routeFileAbs)\n  // EC-8: normalize Windows path separators.\n  rel = rel.replace(/\\\\/g, '/')\n  // Strip extension (`.ts` / `.tsx`); TS module resolution likes extensionless.\n  rel = rel.replace(/\\.[jt]sx?$/, '')\n  if (!rel.startsWith('.') && !rel.startsWith('/')) {\n    rel = './' + rel\n  }\n  return rel\n}\n\n/**\n * Convert a route path (e.g. `/api/users/:id/posts`) into the tree segments\n * we want under the `client` root. Strips the `/api/` prefix and splits.\n */\nfunction routePathSegments(routePath: string): string[] {\n  let p = routePath\n  if (p.startsWith('/api/')) p = p.slice(5)\n  else if (p.startsWith('/api')) p = p.slice(4)\n  if (p.startsWith('/')) p = p.slice(1)\n  if (p === '') return []\n  return p.split('/').filter(Boolean)\n}\n\nfunction paramNamesFromRoute(routePath: string): string[] {\n  const out: string[] = []\n  const re = /:(?:\\.\\.\\.)?([^/]+)/g\n  let m: RegExpExecArray | null\n  while ((m = re.exec(routePath)) !== null) {\n    out.push(m[1])\n  }\n  return out\n}\n\ninterface BuildContext {\n  root: TreeNode\n  /** Sequential index per route file for aliasing imports. */\n  aliasCounter: { value: number }\n  /** Lines emitted at the top of the declared module (one per route file). */\n  importLines: string[]\n  /** Diagnostic warnings rendered as block comments inside the declared module. */\n  warnings: string[]\n  dtsOutPath: string\n  serverDir: string\n}\n\nfunction buildOneRoute(route: ManifestRoute, ctx: BuildContext): void {\n  if (!route.methods || route.methods.length === 0) return\n  // Build alias prefix once per route file (`_r0`, `_r1`, ...).\n  const idx = ctx.aliasCounter.value++\n  // Resolve absolute path for the route file (manifest stores it relative to serverDir).\n  const absRouteFile = isAbsolute(route.filePath)\n    ? route.filePath\n    : resolve(ctx.serverDir, route.filePath)\n  const importPath = importPathFor(ctx.dtsOutPath, absRouteFile)\n  const aliases = route.methods\n    .filter((m): m is HttpMethod => (HTTP_METHODS as readonly string[]).includes(m))\n    .map((method) => ({ method, alias: `_r${idx}_${method}` }))\n  if (aliases.length === 0) return\n  const importClause = aliases.map((a) => `${a.method} as ${a.alias}`).join(', ')\n  ctx.importLines.push(`  import type { ${importClause} } from '${importPath}'`)\n\n  // Walk segments + register methods at the leaf node.\n  const segments = routePathSegments(route.routePath)\n  let node = ctx.root\n  for (const seg of segments) {\n    const norm = normalizeSegment(seg)\n    let child = node.children.get(norm.identifier)\n    if (child === undefined) {\n      child = makeNode()\n      node.children.set(norm.identifier, child)\n    }\n    node = child\n  }\n  // Accumulated param names for typed params (e.g. `{ id: string }`).\n  node.paramNamesAccumulated = paramNamesFromRoute(route.routePath)\n\n  // Register each HTTP method (collision detection runs in a post-pass).\n  for (const { method, alias } of aliases) {\n    if (node.methods.has(method)) {\n      ctx.warnings.push(\n        `// WARNING: duplicate ${method} export at /${segments.join('/')} (route file declared twice). Keeping last definition.`,\n      )\n    }\n    node.methods.set(method, alias)\n  }\n}\n\n/**\n * #122 (T2.1) — register one decorator-controller route into the tree. The class\n * import alias is shared across the class's methods (resolved by the caller). A\n * file-based route at the same node+verb WINS (file routes are the default); the\n * controller entry is skipped with a warning to keep the emitted `.d.ts` valid.\n */\nfunction buildOneController(cr: ControllerRouteData, classAlias: string, ctx: BuildContext): void {\n  const verb = cr.verb.toUpperCase()\n  if (!(HTTP_METHODS as readonly string[]).includes(verb)) return\n  const method = verb as HttpMethod\n\n  const segments = routePathSegments(cr.fullPath)\n  let node = ctx.root\n  for (const seg of segments) {\n    const norm = normalizeSegment(seg)\n    let child = node.children.get(norm.identifier)\n    if (child === undefined) {\n      child = makeNode()\n      node.children.set(norm.identifier, child)\n    }\n    node = child\n  }\n  node.paramNamesAccumulated = paramNamesFromRoute(cr.fullPath)\n\n  if (node.methods.has(method)) {\n    ctx.warnings.push(\n      `WARNING (#122): controller ${cr.className}.${cr.methodName} (${method} /${segments.join('/')}) collides with a file-based route at the same path; file route wins.`,\n    )\n    return\n  }\n  if (cr.schemaNotExported === true) {\n    // theokit#124 — a note, not a warning: the author did nothing wrong, and the emitted file is\n    // valid. It exists so a reader who sees one typed method beside an untyped one knows the reason\n    // is reachability, and knows the one-word fix.\n    const note = `NOTE (#124): ${cr.className}.${cr.methodName} validates with a schema that is not exported, so its request type falls back to \\`unknown\\`. To get the type, export the schema (\\`export const zX = z.object({...})\\`).`\n    if (!ctx.warnings.includes(note)) ctx.warnings.push(note)\n  }\n  node.controllerMethods.set(method, {\n    classAlias,\n    methodName: cr.methodName,\n    // theokit#124 — an EXPORTED schema is referenceable from the emitted `.d.ts`; an inline one is\n    // not, and falls through to the documented `unknown`.\n    ...(cr.bodySchemaExport !== undefined\n      ? {\n          bodySchema: {\n            importPath: importPathFor(ctx.dtsOutPath, cr.filePath),\n            exportName: cr.bodySchemaExport,\n          },\n        }\n      : {}),\n    ...(cr.querySchemaExport !== undefined\n      ? {\n          querySchema: {\n            importPath: importPathFor(ctx.dtsOutPath, cr.filePath),\n            exportName: cr.querySchemaExport,\n          },\n        }\n      : {}),\n  })\n}\n\n/**\n * EC-3: walk the tree post-build and resolve any node where a method's\n * lowercase name clashes with a child segment. HTTP method wins (more common);\n * the offending child gets a `_` suffix + a warning entry.\n */\nfunction resolveCollisions(node: TreeNode, pathPrefix: string, warnings: string[]): void {\n  const methodLowerNames = new Set<string>()\n  for (const method of node.methods.keys()) {\n    methodLowerNames.add(method.toLowerCase())\n  }\n  for (const method of node.controllerMethods.keys()) {\n    methodLowerNames.add(method.toLowerCase())\n  }\n  const renames: { from: string; to: string }[] = []\n  for (const childName of node.children.keys()) {\n    if (methodLowerNames.has(childName)) {\n      renames.push({ from: childName, to: `${childName}_` })\n    }\n  }\n  for (const { from, to } of renames) {\n    const old = node.children.get(from)\n    if (old !== undefined) {\n      node.children.delete(from)\n      node.children.set(to, old)\n      warnings.push(\n        `WARNING (EC-3): path collision — method '${from}' clashed with sub-namespace at ${pathPrefix}/${from}; sub-namespace renamed to '${to}'.`,\n      )\n    }\n  }\n  // Recurse into all children (including the renamed ones).\n  for (const [name, child] of node.children) {\n    resolveCollisions(child, `${pathPrefix}/${name}`, warnings)\n  }\n}\n\nfunction renderTreeNode(node: TreeNode, indent: string, _isRoot: boolean): string {\n  // _isRoot is reserved for callers; current rendering is uniform across roots\n  // and children (both open with `{`). Kept in the signature for future overrides.\n  const lines: string[] = ['{']\n  // Methods first\n  for (const [method, alias] of node.methods) {\n    const lower = method.toLowerCase()\n    // Routes with path params (`:id`, `:name`) emit a `{ params: {...} }` object\n    // intersected with TheoFetchOptions. Without the outer `{...}` wrap the\n    // generated signature `(opts: params: {...} & ...)` is invalid TS syntax\n    // (parser reads `params:` as a parameter label, then `{...}` as type — invalid).\n    const paramsList = node.paramNamesAccumulated.map((p) => `${p}: string`).join('; ')\n    const paramsField =\n      node.paramNamesAccumulated.length > 0 ? `{ params: { ${paramsList} } } & ` : ''\n    const optionalMark = node.paramNamesAccumulated.length === 0 ? '?' : ''\n    lines.push(\n      `${indent}  ${lower}: (opts${optionalMark}: ${paramsField}import('theokit/client').TheoFetchOptions<typeof ${alias}>) => Promise<import('theokit/client').InferResponse<typeof ${alias}>>`,\n    )\n  }\n  // #122 (T2.1) — decorator-controller methods. Response inferred via\n  // `Awaited<ReturnType<...>>`; params typed from the route pattern.\n  //\n  // theokit#124 — the request side too, when the `@Body`/`@Query` schema is EXPORTED. The ADR-2\n  // checkpoint was right that the type cannot come from the class (parameter decorators erase to\n  // runtime metadata, so `Parameters<...>[N]` is positional-only), and right that the runtime schema\n  // carries no source identifier. What it missed is that the codegen LOADS the module, so the schema\n  // object can be matched back to an export by reference identity — see `exportedNameOf`. An inline\n  // schema has no name to reference and keeps the documented `unknown`.\n  for (const [method, leaf] of node.controllerMethods) {\n    const lower = method.toLowerCase()\n    const paramsList = node.paramNamesAccumulated.map((p) => `${p}: string`).join('; ')\n    const paramsField =\n      node.paramNamesAccumulated.length > 0 ? `{ params: { ${paramsList} } } & ` : ''\n    const optionalMark = node.paramNamesAccumulated.length === 0 ? '?' : ''\n    const bodyType =\n      leaf.bodySchema === undefined\n        ? 'body?: unknown'\n        : `body: import('zod').infer<typeof import('${leaf.bodySchema.importPath}').${leaf.bodySchema.exportName}>`\n    const queryType =\n      leaf.querySchema === undefined\n        ? 'query?: Record<string, string>'\n        : `query: import('zod').infer<typeof import('${leaf.querySchema.importPath}').${leaf.querySchema.exportName}>`\n    lines.push(\n      `${indent}  ${lower}: (opts${optionalMark}: ${paramsField}{ ${bodyType}; ${queryType} }) => Promise<Awaited<ReturnType<InstanceType<typeof ${leaf.classAlias}>['${leaf.methodName}']>>>`,\n    )\n  }\n  // Children\n  for (const [name, child] of node.children) {\n    // Backslash first, then the quote: escaping the quote while leaving the escape character\n    // untouched means `back\\` emits as `'back\\'`, whose trailing backslash escapes the closing\n    // quote and swallows the rest of the line. A backslash is a legal POSIX filename character, so\n    // it reaches here from `server/routes/`.\n    const propKey = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(name)\n      ? name\n      : `'${name.replace(/\\\\/g, '\\\\\\\\').replace(/'/g, \"\\\\'\")}'`\n    lines.push(`${indent}  ${propKey}: ${renderTreeNode(child, indent + '  ', false)}`)\n  }\n  lines.push(`${indent}}`)\n  return lines.join('\\n')\n}\n\ninterface GenerateClientDtsOptions {\n  manifest: TheoManifest\n  /** Absolute path to the .d.ts that will be emitted. Used to compute import paths. */\n  dtsOutPath: string\n  /** Absolute serverDir; manifest's filePath entries are relative to this. */\n  serverDir: string\n  /**\n   * #122 (T2.1) — decorator-controller routes (from `collectControllerRouteData`),\n   * merged into the same `client.<ns>.<method>()` tree as file routes. Absent/empty\n   * → zero controller output (ADR-5 routes-only byte-identity).\n   */\n  controllerRoutes?: ControllerRouteData[]\n}\n\nexport function generateClientDts({\n  manifest,\n  dtsOutPath,\n  serverDir,\n  controllerRoutes,\n}: GenerateClientDtsOptions): string {\n  const ctx: BuildContext = {\n    root: makeNode(),\n    aliasCounter: { value: 0 },\n    importLines: [],\n    warnings: [],\n    dtsOutPath,\n    serverDir,\n  }\n  for (const route of manifest.routes) {\n    buildOneRoute(route, ctx)\n  }\n  // #122 (T2.1) — merge decorator controllers into the same tree. One import\n  // alias per class (shared across its methods), keyed by source file.\n  if (controllerRoutes?.length) {\n    const classAliases = new Map<string, string>()\n    for (const cr of controllerRoutes) {\n      let alias = classAliases.get(cr.filePath)\n      if (alias === undefined) {\n        alias = `_c${classAliases.size}`\n        classAliases.set(cr.filePath, alias)\n        const importPath = importPathFor(dtsOutPath, cr.filePath)\n        ctx.importLines.push(`  import type { ${cr.className} as ${alias} } from '${importPath}'`)\n      }\n      buildOneController(cr, alias, ctx)\n    }\n  }\n  // EC-3: resolve collisions in a post-build pass (collisions materialize\n  // when two routes are both processed, not during a single route's build).\n  resolveCollisions(ctx.root, '', ctx.warnings)\n\n  const importsBlock = ctx.importLines.length > 0 ? ctx.importLines.join('\\n') + '\\n\\n' : '\\n'\n  const warningsBlock =\n    ctx.warnings.length > 0 ? '  // ' + ctx.warnings.join('\\n  // ') + '\\n\\n' : ''\n\n  // Empty manifest (no routes with methods) → emit a stub interface so consumers\n  // still get `client.X` autocomplete-friendly errors instead of \"Module not found\".\n  const treeBody =\n    ctx.root.children.size === 0 &&\n    ctx.root.methods.size === 0 &&\n    ctx.root.controllerMethods.size === 0\n      ? '{\\n    // No routes detected — add `server/routes/*.ts` to populate this client.\\n  }'\n      : renderTreeNode(ctx.root, '  ', /* isRoot */ true)\n\n  return `${FILE_HEADER}\ndeclare module '@theo/client' {\n${importsBlock}${warningsBlock}  export interface AppClient ${treeBody}\n  export const client: AppClient\n}\n`\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Phase 4 — Vite plugin\n// ─────────────────────────────────────────────────────────────────────────────\n\ninterface AppTypedClientPluginOptions {\n  /** Project root (cwd). */\n  cwd: string\n  /** Absolute path to the user's `server/` dir. */\n  serverDir: string\n  /** Absolute path to the `.theokit/` output dir (where `client.d.ts` lands). */\n  distDir: string\n  /**\n   * Additional routes to merge into the typed client alongside file-system routes.\n   * Each entry follows ManifestRoute shape (filePath, routePath, methods, paramNames).\n   *\n   * Used by `@theokit/http` `httpDecoratorsPlugin` to inject\n   * decorator-defined routes — zero coupling between theokit core and the\n   * decorator package (the walk happens in http-decorators; only data arrives here).\n   */\n  extraRoutes?: ManifestRoute[]\n}\n\nconst VIRTUAL_APP_CLIENT_ID = '@theo/client'\nconst RESOLVED_APP_CLIENT_ID = '\\0@theo/client'\n\n/**\n * Should a watcher file event under `routes/` or `controllers/` trigger a client\n * re-emit? Ignores the `.__decorated__.mjs` temp files that `loadControllerWithSwc`\n * writes+unlinks during controller codegen — reacting to them would create a\n * perpetual emit→temp-write→watcher→emit loop (#122 T2.1).\n */\nexport function shouldReemitForFile(\n  file: string,\n  routesGlob: string,\n  controllersGlob: string,\n): boolean {\n  const normalized = file.replace(/\\\\/g, '/')\n  if (normalized.includes('.__decorated__.')) return false\n  return normalized.startsWith(routesGlob) || normalized.startsWith(controllersGlob)\n}\n\n/** Atomic write via tmp + rename (EC-6). Skips when content is unchanged. */\nfunction writeFileIfChanged(filePath: string, content: string): { changed: boolean } {\n  if (existsSync(filePath)) {\n    try {\n      const current = readFileSync(filePath, 'utf-8')\n      if (current === content) return { changed: false }\n    } catch {\n      // fall through to write\n    }\n  }\n  mkdirSync(dirname(filePath), { recursive: true })\n  const tmp = `${filePath}.${process.pid}.tmp`\n  writeFileSync(tmp, content)\n  renameSync(tmp, filePath)\n  return { changed: true }\n}\n\nasync function emitClientDts(\n  opts: AppTypedClientPluginOptions,\n): Promise<{ changed: boolean; path: string }> {\n  if (!existsSync(opts.serverDir)) {\n    // No server dir — emit empty stub to avoid \"module not found\".\n    const stubPath = posix.join(opts.distDir.replace(/\\\\/g, '/'), 'client.d.ts')\n    return {\n      changed: writeFileIfChanged(\n        stubPath,\n        generateClientDts({\n          manifest: {\n            version: 1,\n            generatedAt: new Date().toISOString(),\n            routes: [],\n            actions: [],\n            websockets: [],\n          },\n          dtsOutPath: stubPath,\n          serverDir: opts.serverDir,\n        }),\n      ).changed,\n      path: stubPath,\n    }\n  }\n  const manifest = generateManifest(opts.serverDir)\n\n  // Decorator-client-bridge: merge extra routes (from @theokit/http\n  // or any other source) into the manifest so generateClientDts() produces a\n  // SINGLE typed client covering both file-system routes AND injected routes.\n  if (opts.extraRoutes?.length) {\n    manifest.routes.push(...opts.extraRoutes)\n  }\n\n  // #122 (T2.1) — merge decorator controllers under `<serverDir>/controllers/`\n  // into the same typed client. Zero output when the dir is absent/empty (ADR-5).\n  const controllersDir = resolve(opts.serverDir, 'controllers')\n  const controllerRoutes = existsSync(controllersDir)\n    ? await collectControllerRouteData({ controllersDir })\n    : []\n\n  const dtsOutPath = posix.join(opts.distDir.replace(/\\\\/g, '/'), 'client.d.ts')\n  const content = generateClientDts({\n    manifest,\n    dtsOutPath,\n    serverDir: opts.serverDir,\n    controllerRoutes,\n  })\n  const { changed } = writeFileIfChanged(dtsOutPath, content)\n  return { changed, path: dtsOutPath }\n}\n\nexport function appTypedClientPlugin(opts: AppTypedClientPluginOptions): Plugin {\n  let debounceTimer: NodeJS.Timeout | undefined\n  let viteServer: ViteDevServer | undefined\n\n  function scheduleEmit(): void {\n    if (debounceTimer) clearTimeout(debounceTimer)\n    debounceTimer = setTimeout(() => {\n      void (async () => {\n        try {\n          await emitClientDts(opts)\n          // Invalidate the virtual module so re-imports pick up potential new shape.\n          if (viteServer) {\n            const mod = viteServer.moduleGraph.getModuleById(RESOLVED_APP_CLIENT_ID)\n            if (mod) viteServer.moduleGraph.invalidateModule(mod)\n          }\n        } catch (err) {\n          // Surface but don't crash dev server.\n          console.error('[theokit:app-typed-client] codegen error:', err)\n        }\n      })()\n    }, 100)\n  }\n\n  return {\n    name: 'theokit:app-typed-client',\n    enforce: 'post',\n    async configResolved() {\n      try {\n        await emitClientDts(opts)\n      } catch (err) {\n        console.error('[theokit:app-typed-client] initial codegen error:', err)\n      }\n    },\n    async buildEnd() {\n      try {\n        await emitClientDts(opts)\n      } catch (err) {\n        console.error('[theokit:app-typed-client] buildEnd codegen error:', err)\n      }\n    },\n    configureServer(server) {\n      viteServer = server\n      const routesGlob = posix.join(opts.serverDir.replace(/\\\\/g, '/'), 'routes')\n      const controllersGlob = posix.join(opts.serverDir.replace(/\\\\/g, '/'), 'controllers')\n      const onFile = (file: string): void => {\n        if (shouldReemitForFile(file, routesGlob, controllersGlob)) scheduleEmit()\n      }\n      server.watcher.on('add', onFile)\n      server.watcher.on('change', onFile)\n      server.watcher.on('unlink', onFile)\n    },\n    resolveId(id) {\n      if (id === VIRTUAL_APP_CLIENT_ID) return RESOLVED_APP_CLIENT_ID\n      return null\n    },\n    load(id) {\n      if (id === RESOLVED_APP_CLIENT_ID) {\n        return [\n          `import { createAppClient } from 'theokit/client'`,\n          `export const client = createAppClient()`,\n          `export default client`,\n          ``,\n        ].join('\\n')\n      }\n      return null\n    },\n  }\n}\n\nexport { VIRTUAL_APP_CLIENT_ID, RESOLVED_APP_CLIENT_ID, emitClientDts }\n","/**\n * #122 (T2.1) — typed-client codegen for decorator controllers.\n *\n * Collects the routing metadata of every `@Controller` under `controllersDir`\n * so the app-typed-client codegen can emit `client.<ns>.<method>()` entries.\n * Codegen loads controllers via `loadControllerWithSwc` (swc-compile + import,\n * no Vite dev server needed) — distinct from the dev SERVING path, which loads\n * through Vite's `ssrLoadModule`.\n *\n * ADR-2 checkpoint (LOCKED — see the plan's Unresolved Questions): only the\n * RESPONSE type is inferred, via `Awaited<ReturnType<InstanceType<typeof C>['m']>>`.\n * Request `@Body` types are NOT inferred from the class — parameter decorators are\n * erased runtime metadata, invisible to the type system, so `Parameters<...>[N]` is\n * positional-only and cannot tell body from param from query. Body falls back to\n * `unknown` (runtime `@Body` Zod validation from Phase 1 still applies). Full body\n * inference is tracked in the follow-up issue.\n */\nimport { loadControllerWithSwc, walkControllerMetadata } from '@theokit/http'\n\nimport {\n  scanControllerModules,\n  type ControllerModuleLoader,\n} from '../server/http/controller-dispatch.js'\n\n/** One controller route, flattened for the client codegen. */\nexport interface ControllerRouteData {\n  /** Absolute path to the `*.controller.ts` source (for the `import type` line). */\n  filePath: string\n  /** The exported class name (e.g. `TasksController`). */\n  className: string\n  /** Full route path, e.g. `/api/v2/tasks/:id`. */\n  fullPath: string\n  /** HTTP verb (`GET`, `POST`, …). */\n  verb: string\n  /** The controller method name backing this route (e.g. `findById`). */\n  methodName: string\n  /**\n   * theokit#124 — the EXPORTED name of the `@Body(schema)` Zod schema, when it has one.\n   *\n   * Absent when the schema is declared inline or otherwise not exported: there is then no\n   * identifier the emitted `.d.ts` could reference, and the body stays `unknown`.\n   */\n  bodySchemaExport?: string\n  /** theokit#124 — same for `@Query(schema)`. */\n  querySchemaExport?: string\n  /**\n   * theokit#124 — a `@Body`/`@Query` schema EXISTS on this route but is not exported, so no name\n   * could be referenced and the type degraded to `unknown`.\n   *\n   * Distinct from \"there is no schema at all\": that route was never going to be typed and needs no\n   * explanation, while this one looks arbitrarily untyped next to a typed neighbour. The codegen\n   * turns this into a note in the emitted file so the difference is legible.\n   */\n  schemaNotExported?: boolean\n}\n\n/**\n * Recover the EXPORTED name of a runtime schema object — theokit#124.\n *\n * `WalkResult.bodySchema` is a `z.ZodType` instance with no source identifier, which is why #122's\n * ADR-2 checkpoint concluded the request type was unrecoverable. It is recoverable, just not from\n * the metadata: the codegen already imports the module, so this object IS the one the module\n * exported, and reference identity gives back its name. No parsing, no heuristics — either some\n * export is the same object or none is.\n *\n * Returns `undefined` for an inline schema, which is a real limit rather than a bug: an unexported\n * value has no name a `.d.ts` can import.\n */\nfunction exportedNameOf(\n  schema: unknown,\n  moduleExports: Readonly<Record<string, unknown>>,\n): string | undefined {\n  if (schema === undefined || schema === null) return undefined\n  for (const [name, value] of Object.entries(moduleExports)) {\n    // Reference identity, never structural comparison: two distinct schemas can be deeply equal,\n    // and emitting the wrong name would type the client against the wrong contract silently.\n    if (value === schema) return name\n  }\n  return undefined\n}\n\n/**\n * Scan `controllersDir` and flatten every controller's routes into\n * {@link ControllerRouteData}. Returns `[]` when the directory has no controllers\n * (so the codegen contributes zero bytes — ADR-5 routes-only byte-identity).\n */\nexport async function collectControllerRouteData(opts: {\n  controllersDir: string\n  loadModule?: ControllerModuleLoader\n}): Promise<ControllerRouteData[]> {\n  const loader = opts.loadModule ?? loadControllerWithSwc\n  const modules = await scanControllerModules(opts.controllersDir, loader)\n  const out: ControllerRouteData[] = []\n  for (const { filePath, cls, exports } of modules) {\n    const className = (cls as { name: string }).name\n    for (const walk of walkControllerMetadata(cls)) {\n      const bodySchemaExport = exportedNameOf(walk.bodySchema, exports)\n      // `walk.querySchema` is DECLARED on `WalkResult` and never populated — `walkControllerMetadata`\n      // resolves a body schema and has no query counterpart, so the field always reads `undefined`\n      // (grep: the only occurrence in `@theokit/http` is its own declaration). Reading the entry\n      // directly is therefore not a shortcut around an API; it is the only place the schema exists.\n      //\n      // Deliberately NOT fixed by populating `querySchema` here: that field feeds runtime validation\n      // for `@Body`, so filling the query one would start VALIDATING query strings that are not\n      // validated today. This issue is about editor types; silently turning on runtime rejection\n      // under it would be a behaviour change nobody asked for. Filed separately.\n      const queryEntry = walk.paramEntries.find(\n        (e) => e.source === 'query' && e.schema !== undefined,\n      )\n      const querySchemaExport = exportedNameOf(queryEntry?.schema, exports)\n      out.push({\n        filePath,\n        className,\n        fullPath: walk.fullPath,\n        verb: walk.verb,\n        methodName: String(walk.propertyKey),\n        ...(bodySchemaExport !== undefined ? { bodySchemaExport } : {}),\n        ...(querySchemaExport !== undefined ? { querySchemaExport } : {}),\n        ...((walk.bodySchema !== undefined && bodySchemaExport === undefined) ||\n        (queryEntry?.schema !== undefined && querySchemaExport === undefined)\n          ? { schemaNotExported: true }\n          : {}),\n      })\n    }\n  }\n  return out\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAuBA,SAAS,WAAW,cAAc,YAAY,eAAe,kBAAkB;AAC/E,SAAS,SAAS,YAAY,OAAO,UAAU,eAAe;;;ACP9D,SAAS,uBAAuB,8BAA8B;AAmD9D,SAAS,eACP,QACA,eACoB;AACpB,MAAI,WAAW,UAAa,WAAW,KAAM,QAAO;AACpD,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,aAAa,GAAG;AAGzD,QAAI,UAAU,OAAQ,QAAO;AAAA,EAC/B;AACA,SAAO;AACT;AAOA,eAAsB,2BAA2B,MAGd;AACjC,QAAM,SAAS,KAAK,cAAc;AAClC,QAAM,UAAU,MAAM,sBAAsB,KAAK,gBAAgB,MAAM;AACvE,QAAM,MAA6B,CAAC;AACpC,aAAW,EAAE,UAAU,KAAK,QAAQ,KAAK,SAAS;AAChD,UAAM,YAAa,IAAyB;AAC5C,eAAW,QAAQ,uBAAuB,GAAG,GAAG;AAC9C,YAAM,mBAAmB,eAAe,KAAK,YAAY,OAAO;AAUhE,YAAM,aAAa,KAAK,aAAa;AAAA,QACnC,CAAC,MAAM,EAAE,WAAW,WAAW,EAAE,WAAW;AAAA,MAC9C;AACA,YAAM,oBAAoB,eAAe,YAAY,QAAQ,OAAO;AACpE,UAAI,KAAK;AAAA,QACP;AAAA,QACA;AAAA,QACA,UAAU,KAAK;AAAA,QACf,MAAM,KAAK;AAAA,QACX,YAAY,OAAO,KAAK,WAAW;AAAA,QACnC,GAAI,qBAAqB,SAAY,EAAE,iBAAiB,IAAI,CAAC;AAAA,QAC7D,GAAI,sBAAsB,SAAY,EAAE,kBAAkB,IAAI,CAAC;AAAA,QAC/D,GAAK,KAAK,eAAe,UAAa,qBAAqB,UAC1D,YAAY,WAAW,UAAa,sBAAsB,SACvD,EAAE,mBAAmB,KAAK,IAC1B,CAAC;AAAA,MACP,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;;;AD7FA,IAAM,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAgCpB,SAAS,WAAqB;AAC5B,SAAO;AAAA,IACL,UAAU,oBAAI,IAAI;AAAA,IAClB,SAAS,oBAAI,IAAI;AAAA,IACjB,mBAAmB,oBAAI,IAAI;AAAA,IAC3B,uBAAuB,CAAC;AAAA,EAC1B;AACF;AAOA,SAAS,iBAAiB,KAAuD;AAE/E,MAAI,IAAI;AACR,MAAI,EAAE,WAAW,MAAM,EAAG,KAAI,EAAE,MAAM,CAAC;AAAA,WAC9B,EAAE,WAAW,GAAG,EAAG,KAAI,EAAE,MAAM,CAAC;AAGzC,QAAM,QAAQ,EAAE,QAAQ,iBAAiB,CAAC,GAAG,MAAc,EAAE,YAAY,CAAC;AAG1E,MAAI,6BAA6B,KAAK,KAAK,GAAG;AAC5C,WAAO,EAAE,YAAY,OAAO,SAAS,MAAM;AAAA,EAC7C;AAEA,SAAO,EAAE,YAAY,GAAG,SAAS,KAAK;AACxC;AAEA,SAAS,cAAc,YAAoB,cAA8B;AACvE,MAAI,MAAM,SAAS,QAAQ,UAAU,GAAG,YAAY;AAEpD,QAAM,IAAI,QAAQ,OAAO,GAAG;AAE5B,QAAM,IAAI,QAAQ,cAAc,EAAE;AAClC,MAAI,CAAC,IAAI,WAAW,GAAG,KAAK,CAAC,IAAI,WAAW,GAAG,GAAG;AAChD,UAAM,OAAO;AAAA,EACf;AACA,SAAO;AACT;AAMA,SAAS,kBAAkB,WAA6B;AACtD,MAAI,IAAI;AACR,MAAI,EAAE,WAAW,OAAO,EAAG,KAAI,EAAE,MAAM,CAAC;AAAA,WAC/B,EAAE,WAAW,MAAM,EAAG,KAAI,EAAE,MAAM,CAAC;AAC5C,MAAI,EAAE,WAAW,GAAG,EAAG,KAAI,EAAE,MAAM,CAAC;AACpC,MAAI,MAAM,GAAI,QAAO,CAAC;AACtB,SAAO,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AACpC;AAEA,SAAS,oBAAoB,WAA6B;AACxD,QAAM,MAAgB,CAAC;AACvB,QAAM,KAAK;AACX,MAAI;AACJ,UAAQ,IAAI,GAAG,KAAK,SAAS,OAAO,MAAM;AACxC,QAAI,KAAK,EAAE,CAAC,CAAC;AAAA,EACf;AACA,SAAO;AACT;AAcA,SAAS,cAAc,OAAsB,KAAyB;AACpE,MAAI,CAAC,MAAM,WAAW,MAAM,QAAQ,WAAW,EAAG;AAElD,QAAM,MAAM,IAAI,aAAa;AAE7B,QAAM,eAAe,WAAW,MAAM,QAAQ,IAC1C,MAAM,WACN,QAAQ,IAAI,WAAW,MAAM,QAAQ;AACzC,QAAM,aAAa,cAAc,IAAI,YAAY,YAAY;AAC7D,QAAM,UAAU,MAAM,QACnB,OAAO,CAAC,MAAwB,aAAmC,SAAS,CAAC,CAAC,EAC9E,IAAI,CAAC,YAAY,EAAE,QAAQ,OAAO,KAAK,GAAG,IAAI,MAAM,GAAG,EAAE;AAC5D,MAAI,QAAQ,WAAW,EAAG;AAC1B,QAAM,eAAe,QAAQ,IAAI,CAAC,MAAM,GAAG,EAAE,MAAM,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,IAAI;AAC9E,MAAI,YAAY,KAAK,mBAAmB,YAAY,YAAY,UAAU,GAAG;AAG7E,QAAM,WAAW,kBAAkB,MAAM,SAAS;AAClD,MAAI,OAAO,IAAI;AACf,aAAW,OAAO,UAAU;AAC1B,UAAM,OAAO,iBAAiB,GAAG;AACjC,QAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,UAAU;AAC7C,QAAI,UAAU,QAAW;AACvB,cAAQ,SAAS;AACjB,WAAK,SAAS,IAAI,KAAK,YAAY,KAAK;AAAA,IAC1C;AACA,WAAO;AAAA,EACT;AAEA,OAAK,wBAAwB,oBAAoB,MAAM,SAAS;AAGhE,aAAW,EAAE,QAAQ,MAAM,KAAK,SAAS;AACvC,QAAI,KAAK,QAAQ,IAAI,MAAM,GAAG;AAC5B,UAAI,SAAS;AAAA,QACX,yBAAyB,MAAM,eAAe,SAAS,KAAK,GAAG,CAAC;AAAA,MAClE;AAAA,IACF;AACA,SAAK,QAAQ,IAAI,QAAQ,KAAK;AAAA,EAChC;AACF;AAQA,SAAS,mBAAmB,IAAyB,YAAoB,KAAyB;AAChG,QAAM,OAAO,GAAG,KAAK,YAAY;AACjC,MAAI,CAAE,aAAmC,SAAS,IAAI,EAAG;AACzD,QAAM,SAAS;AAEf,QAAM,WAAW,kBAAkB,GAAG,QAAQ;AAC9C,MAAI,OAAO,IAAI;AACf,aAAW,OAAO,UAAU;AAC1B,UAAM,OAAO,iBAAiB,GAAG;AACjC,QAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,UAAU;AAC7C,QAAI,UAAU,QAAW;AACvB,cAAQ,SAAS;AACjB,WAAK,SAAS,IAAI,KAAK,YAAY,KAAK;AAAA,IAC1C;AACA,WAAO;AAAA,EACT;AACA,OAAK,wBAAwB,oBAAoB,GAAG,QAAQ;AAE5D,MAAI,KAAK,QAAQ,IAAI,MAAM,GAAG;AAC5B,QAAI,SAAS;AAAA,MACX,8BAA8B,GAAG,SAAS,IAAI,GAAG,UAAU,KAAK,MAAM,KAAK,SAAS,KAAK,GAAG,CAAC;AAAA,IAC/F;AACA;AAAA,EACF;AACA,MAAI,GAAG,sBAAsB,MAAM;AAIjC,UAAM,OAAO,gBAAgB,GAAG,SAAS,IAAI,GAAG,UAAU;AAC1D,QAAI,CAAC,IAAI,SAAS,SAAS,IAAI,EAAG,KAAI,SAAS,KAAK,IAAI;AAAA,EAC1D;AACA,OAAK,kBAAkB,IAAI,QAAQ;AAAA,IACjC;AAAA,IACA,YAAY,GAAG;AAAA;AAAA;AAAA,IAGf,GAAI,GAAG,qBAAqB,SACxB;AAAA,MACE,YAAY;AAAA,QACV,YAAY,cAAc,IAAI,YAAY,GAAG,QAAQ;AAAA,QACrD,YAAY,GAAG;AAAA,MACjB;AAAA,IACF,IACA,CAAC;AAAA,IACL,GAAI,GAAG,sBAAsB,SACzB;AAAA,MACE,aAAa;AAAA,QACX,YAAY,cAAc,IAAI,YAAY,GAAG,QAAQ;AAAA,QACrD,YAAY,GAAG;AAAA,MACjB;AAAA,IACF,IACA,CAAC;AAAA,EACP,CAAC;AACH;AAOA,SAAS,kBAAkB,MAAgB,YAAoB,UAA0B;AACvF,QAAM,mBAAmB,oBAAI,IAAY;AACzC,aAAW,UAAU,KAAK,QAAQ,KAAK,GAAG;AACxC,qBAAiB,IAAI,OAAO,YAAY,CAAC;AAAA,EAC3C;AACA,aAAW,UAAU,KAAK,kBAAkB,KAAK,GAAG;AAClD,qBAAiB,IAAI,OAAO,YAAY,CAAC;AAAA,EAC3C;AACA,QAAM,UAA0C,CAAC;AACjD,aAAW,aAAa,KAAK,SAAS,KAAK,GAAG;AAC5C,QAAI,iBAAiB,IAAI,SAAS,GAAG;AACnC,cAAQ,KAAK,EAAE,MAAM,WAAW,IAAI,GAAG,SAAS,IAAI,CAAC;AAAA,IACvD;AAAA,EACF;AACA,aAAW,EAAE,MAAM,GAAG,KAAK,SAAS;AAClC,UAAM,MAAM,KAAK,SAAS,IAAI,IAAI;AAClC,QAAI,QAAQ,QAAW;AACrB,WAAK,SAAS,OAAO,IAAI;AACzB,WAAK,SAAS,IAAI,IAAI,GAAG;AACzB,eAAS;AAAA,QACP,iDAA4C,IAAI,mCAAmC,UAAU,IAAI,IAAI,+BAA+B,EAAE;AAAA,MACxI;AAAA,IACF;AAAA,EACF;AAEA,aAAW,CAAC,MAAM,KAAK,KAAK,KAAK,UAAU;AACzC,sBAAkB,OAAO,GAAG,UAAU,IAAI,IAAI,IAAI,QAAQ;AAAA,EAC5D;AACF;AAEA,SAAS,eAAe,MAAgB,QAAgB,SAA0B;AAGhF,QAAM,QAAkB,CAAC,GAAG;AAE5B,aAAW,CAAC,QAAQ,KAAK,KAAK,KAAK,SAAS;AAC1C,UAAM,QAAQ,OAAO,YAAY;AAKjC,UAAM,aAAa,KAAK,sBAAsB,IAAI,CAAC,MAAM,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI;AAClF,UAAM,cACJ,KAAK,sBAAsB,SAAS,IAAI,eAAe,UAAU,YAAY;AAC/E,UAAM,eAAe,KAAK,sBAAsB,WAAW,IAAI,MAAM;AACrE,UAAM;AAAA,MACJ,GAAG,MAAM,KAAK,KAAK,UAAU,YAAY,KAAK,WAAW,oDAAoD,KAAK,+DAA+D,KAAK;AAAA,IACxL;AAAA,EACF;AAUA,aAAW,CAAC,QAAQ,IAAI,KAAK,KAAK,mBAAmB;AACnD,UAAM,QAAQ,OAAO,YAAY;AACjC,UAAM,aAAa,KAAK,sBAAsB,IAAI,CAAC,MAAM,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI;AAClF,UAAM,cACJ,KAAK,sBAAsB,SAAS,IAAI,eAAe,UAAU,YAAY;AAC/E,UAAM,eAAe,KAAK,sBAAsB,WAAW,IAAI,MAAM;AACrE,UAAM,WACJ,KAAK,eAAe,SAChB,mBACA,4CAA4C,KAAK,WAAW,UAAU,MAAM,KAAK,WAAW,UAAU;AAC5G,UAAM,YACJ,KAAK,gBAAgB,SACjB,mCACA,6CAA6C,KAAK,YAAY,UAAU,MAAM,KAAK,YAAY,UAAU;AAC/G,UAAM;AAAA,MACJ,GAAG,MAAM,KAAK,KAAK,UAAU,YAAY,KAAK,WAAW,KAAK,QAAQ,KAAK,SAAS,yDAAyD,KAAK,UAAU,MAAM,KAAK,UAAU;AAAA,IACnL;AAAA,EACF;AAEA,aAAW,CAAC,MAAM,KAAK,KAAK,KAAK,UAAU;AAKzC,UAAM,UAAU,6BAA6B,KAAK,IAAI,IAClD,OACA,IAAI,KAAK,QAAQ,OAAO,MAAM,EAAE,QAAQ,MAAM,KAAK,CAAC;AACxD,UAAM,KAAK,GAAG,MAAM,KAAK,OAAO,KAAK,eAAe,OAAO,SAAS,MAAM,KAAK,CAAC,EAAE;AAAA,EACpF;AACA,QAAM,KAAK,GAAG,MAAM,GAAG;AACvB,SAAO,MAAM,KAAK,IAAI;AACxB;AAgBO,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAqC;AACnC,QAAM,MAAoB;AAAA,IACxB,MAAM,SAAS;AAAA,IACf,cAAc,EAAE,OAAO,EAAE;AAAA,IACzB,aAAa,CAAC;AAAA,IACd,UAAU,CAAC;AAAA,IACX;AAAA,IACA;AAAA,EACF;AACA,aAAW,SAAS,SAAS,QAAQ;AACnC,kBAAc,OAAO,GAAG;AAAA,EAC1B;AAGA,MAAI,kBAAkB,QAAQ;AAC5B,UAAM,eAAe,oBAAI,IAAoB;AAC7C,eAAW,MAAM,kBAAkB;AACjC,UAAI,QAAQ,aAAa,IAAI,GAAG,QAAQ;AACxC,UAAI,UAAU,QAAW;AACvB,gBAAQ,KAAK,aAAa,IAAI;AAC9B,qBAAa,IAAI,GAAG,UAAU,KAAK;AACnC,cAAM,aAAa,cAAc,YAAY,GAAG,QAAQ;AACxD,YAAI,YAAY,KAAK,mBAAmB,GAAG,SAAS,OAAO,KAAK,YAAY,UAAU,GAAG;AAAA,MAC3F;AACA,yBAAmB,IAAI,OAAO,GAAG;AAAA,IACnC;AAAA,EACF;AAGA,oBAAkB,IAAI,MAAM,IAAI,IAAI,QAAQ;AAE5C,QAAM,eAAe,IAAI,YAAY,SAAS,IAAI,IAAI,YAAY,KAAK,IAAI,IAAI,SAAS;AACxF,QAAM,gBACJ,IAAI,SAAS,SAAS,IAAI,UAAU,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS;AAI9E,QAAM,WACJ,IAAI,KAAK,SAAS,SAAS,KAC3B,IAAI,KAAK,QAAQ,SAAS,KAC1B,IAAI,KAAK,kBAAkB,SAAS,IAChC,+FACA;AAAA,IAAe,IAAI;AAAA,IAAM;AAAA;AAAA,IAAmB;AAAA,EAAI;AAEtD,SAAO,GAAG,WAAW;AAAA;AAAA,EAErB,YAAY,GAAG,aAAa,gCAAgC,QAAQ;AAAA;AAAA;AAAA;AAItE;AAwBA,IAAM,wBAAwB;AAC9B,IAAM,yBAAyB;AAQxB,SAAS,oBACd,MACA,YACA,iBACS;AACT,QAAM,aAAa,KAAK,QAAQ,OAAO,GAAG;AAC1C,MAAI,WAAW,SAAS,iBAAiB,EAAG,QAAO;AACnD,SAAO,WAAW,WAAW,UAAU,KAAK,WAAW,WAAW,eAAe;AACnF;AAGA,SAAS,mBAAmB,UAAkB,SAAuC;AACnF,MAAI,WAAW,QAAQ,GAAG;AACxB,QAAI;AACF,YAAM,UAAU,aAAa,UAAU,OAAO;AAC9C,UAAI,YAAY,QAAS,QAAO,EAAE,SAAS,MAAM;AAAA,IACnD,QAAQ;AAAA,IAER;AAAA,EACF;AACA,YAAU,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAChD,QAAM,MAAM,GAAG,QAAQ,IAAI,QAAQ,GAAG;AACtC,gBAAc,KAAK,OAAO;AAC1B,aAAW,KAAK,QAAQ;AACxB,SAAO,EAAE,SAAS,KAAK;AACzB;AAEA,eAAe,cACb,MAC6C;AAC7C,MAAI,CAAC,WAAW,KAAK,SAAS,GAAG;AAE/B,UAAM,WAAW,MAAM,KAAK,KAAK,QAAQ,QAAQ,OAAO,GAAG,GAAG,aAAa;AAC3E,WAAO;AAAA,MACL,SAAS;AAAA,QACP;AAAA,QACA,kBAAkB;AAAA,UAChB,UAAU;AAAA,YACR,SAAS;AAAA,YACT,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,YACpC,QAAQ,CAAC;AAAA,YACT,SAAS,CAAC;AAAA,YACV,YAAY,CAAC;AAAA,UACf;AAAA,UACA,YAAY;AAAA,UACZ,WAAW,KAAK;AAAA,QAClB,CAAC;AAAA,MACH,EAAE;AAAA,MACF,MAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,WAAW,iBAAiB,KAAK,SAAS;AAKhD,MAAI,KAAK,aAAa,QAAQ;AAC5B,aAAS,OAAO,KAAK,GAAG,KAAK,WAAW;AAAA,EAC1C;AAIA,QAAM,iBAAiB,QAAQ,KAAK,WAAW,aAAa;AAC5D,QAAM,mBAAmB,WAAW,cAAc,IAC9C,MAAM,2BAA2B,EAAE,eAAe,CAAC,IACnD,CAAC;AAEL,QAAM,aAAa,MAAM,KAAK,KAAK,QAAQ,QAAQ,OAAO,GAAG,GAAG,aAAa;AAC7E,QAAM,UAAU,kBAAkB;AAAA,IAChC;AAAA,IACA;AAAA,IACA,WAAW,KAAK;AAAA,IAChB;AAAA,EACF,CAAC;AACD,QAAM,EAAE,QAAQ,IAAI,mBAAmB,YAAY,OAAO;AAC1D,SAAO,EAAE,SAAS,MAAM,WAAW;AACrC;AAEO,SAAS,qBAAqB,MAA2C;AAC9E,MAAI;AACJ,MAAI;AAEJ,WAAS,eAAqB;AAC5B,QAAI,cAAe,cAAa,aAAa;AAC7C,oBAAgB,WAAW,MAAM;AAC/B,YAAM,YAAY;AAChB,YAAI;AACF,gBAAM,cAAc,IAAI;AAExB,cAAI,YAAY;AACd,kBAAM,MAAM,WAAW,YAAY,cAAc,sBAAsB;AACvE,gBAAI,IAAK,YAAW,YAAY,iBAAiB,GAAG;AAAA,UACtD;AAAA,QACF,SAAS,KAAK;AAEZ,kBAAQ,MAAM,6CAA6C,GAAG;AAAA,QAChE;AAAA,MACF,GAAG;AAAA,IACL,GAAG,GAAG;AAAA,EACR;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,iBAAiB;AACrB,UAAI;AACF,cAAM,cAAc,IAAI;AAAA,MAC1B,SAAS,KAAK;AACZ,gBAAQ,MAAM,qDAAqD,GAAG;AAAA,MACxE;AAAA,IACF;AAAA,IACA,MAAM,WAAW;AACf,UAAI;AACF,cAAM,cAAc,IAAI;AAAA,MAC1B,SAAS,KAAK;AACZ,gBAAQ,MAAM,sDAAsD,GAAG;AAAA,MACzE;AAAA,IACF;AAAA,IACA,gBAAgB,QAAQ;AACtB,mBAAa;AACb,YAAM,aAAa,MAAM,KAAK,KAAK,UAAU,QAAQ,OAAO,GAAG,GAAG,QAAQ;AAC1E,YAAM,kBAAkB,MAAM,KAAK,KAAK,UAAU,QAAQ,OAAO,GAAG,GAAG,aAAa;AACpF,YAAM,SAAS,CAAC,SAAuB;AACrC,YAAI,oBAAoB,MAAM,YAAY,eAAe,EAAG,cAAa;AAAA,MAC3E;AACA,aAAO,QAAQ,GAAG,OAAO,MAAM;AAC/B,aAAO,QAAQ,GAAG,UAAU,MAAM;AAClC,aAAO,QAAQ,GAAG,UAAU,MAAM;AAAA,IACpC;AAAA,IACA,UAAU,IAAI;AACZ,UAAI,OAAO,sBAAuB,QAAO;AACzC,aAAO;AAAA,IACT;AAAA,IACA,KAAK,IAAI;AACP,UAAI,OAAO,wBAAwB;AACjC,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF,EAAE,KAAK,IAAI;AAAA,MACb;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;","names":[]}

package/dist/aws-lambda-VKMYUMP2.js

@@ -0,0 +1,261 @@
+#!/usr/bin/env node
+import "tsx/esm";
+import {
+  deployedCorsFragment,
+  deployedCsrfFragment,
+  deployedRuntimeConfigFragment,
+  deployedTraceFragment,
+  describeDeployedSecurityHeaders,
+  renderSecurityHeadersConfigLiteral
+} from "./chunk-E43VJ3E5.js";
+import {
+  nodeAdapter
+} from "./chunk-KI4DOTN4.js";
+import "./chunk-RPET332G.js";
+import {
+  assertServicesUnsupported,
+  readManifest
+} from "./chunk-ZNZISJDZ.js";
+
+// src/adapters/aws-lambda.ts
+import { mkdirSync, writeFileSync } from "fs";
+import { resolve } from "path";
+var BINARY_CONTENT_TYPES = [
+  "application/octet-stream",
+  "application/pdf",
+  "application/zip",
+  "image/",
+  "audio/",
+  "video/"
+];
+function isBinaryContentType(contentType) {
+  if (!contentType) return false;
+  const ct = contentType.toLowerCase();
+  return BINARY_CONTENT_TYPES.some((prefix) => ct.startsWith(prefix));
+}
+function eventV2ToRequestShape(event) {
+  const headers = {};
+  for (const [k, v] of Object.entries(event.headers ?? {})) {
+    if (v !== void 0) headers[k] = v;
+  }
+  let body = event.body;
+  if (body !== void 0 && event.isBase64Encoded) {
+    body = Buffer.from(body, "base64").toString("utf-8");
+  }
+  return {
+    method: event.requestContext.http.method,
+    path: event.requestContext.http.path,
+    headers,
+    body
+  };
+}
+function responseToLambdaResultV2(statusCode, headers, body) {
+  const isBinary = isBinaryContentType(headers["content-type"]);
+  return {
+    statusCode,
+    headers,
+    body: isBinary ? Buffer.from(body, "binary").toString("base64") : body,
+    isBase64Encoded: isBinary
+  };
+}
+function awsLambdaHandlerFragment(runtimeSpread) {
+  return [
+    `// #382 \u2014 this target is DELISTED for response streaming, by construction.`,
+    `// The Lambda v2 result object below carries \`body\` as a string, so the`,
+    `// response cannot exist until the run has finished, no matter how the`,
+    `// framework's shim writes it. Streaming here would require`,
+    `// \`awslambda.streamifyResponse\` plus a Function URL in RESPONSE_STREAM`,
+    `// invoke mode \u2014 neither of which this adapter emits, and which would break`,
+    `// every API Gateway deployment of it. Rather than degrade in silence, a`,
+    `// response that is unambiguously a stream is named in the logs below.`,
+    `async function responseToV2Result(response, routePath) {`,
+    `  const headers = {}`,
+    `  response.headers.forEach((v, k) => { headers[k] = v })`,
+    `  const ct = headers['content-type'] ?? ''`,
+    `  if (ct.includes('text/event-stream')) {`,
+    `    console.warn(`,
+    `      '[theo][aws-lambda] ' + routePath + ' returned a streaming response (' + ct + '), ' +`,
+    `      'but the aws-lambda target buffers it whole and delivers it when the run ends. ' +`,
+    `      'This target is delisted for streaming (theokit#382). Deploy streaming routes to ' +`,
+    `      'cloudflare, vercel, netlify, bun, deno-deploy or node.'`,
+    `    )`,
+    `  }`,
+    `  const isBinary = /^application\\/(octet-stream|pdf|zip)|^(image|audio|video)\\//.test(ct)`,
+    `  if (isBinary) {`,
+    `    const buf = Buffer.from(await response.arrayBuffer())`,
+    `    return {`,
+    `      statusCode: response.status,`,
+    `      headers,`,
+    `      body: buf.toString('base64'),`,
+    `      isBase64Encoded: true,`,
+    `    }`,
+    `  }`,
+    `  return {`,
+    `    statusCode: response.status,`,
+    `    headers,`,
+    `    body: await response.text(),`,
+    `    isBase64Encoded: false,`,
+    `  }`,
+    `}`,
+    ``,
+    `// Every outcome \u2014 including both 404s \u2014 is produced as a Web Response by`,
+    `// routeRequest, so the security baseline is applied at ONE place and the`,
+    `// v2 result object is built from headers that already carry it.`,
+    `export const handler = async (event) => {`,
+    `  const path = event.requestContext?.http?.path ?? '/'`,
+    `  // #409 \u2014 the same event, read as a Web Request so the CORS matcher can see the method and`,
+    `  // the \`origin\` header. \`eventV2ToRequest\` reads a body already present in the event, so`,
+    `  // unlike the Node targets there is no stream to drain twice.`,
+    `  const corsRequest = eventV2ToRequest(event)`,
+    ``,
+    `  // The preflight is answered BEFORE anything routes: an OPTIONS the router handles is an`,
+    `  // OPTIONS the browser never gets a CORS answer to.`,
+    `  const preflight = corsPreflight(corsRequest)`,
+    `  const response = preflight !== null`,
+    `    ? withSecurityHeaders(preflight, SECURITY_HEADERS)`,
+    `    : withCors(corsRequest, withSecurityHeaders(await routeRequest(event, path), SECURITY_HEADERS))`,
+    `  return responseToV2Result(response, path)`,
+    `}`,
+    ``,
+    `async function routeRequest(event, path) {`,
+    `  if (!path.startsWith('/api/')) {`,
+    `    return new Response(`,
+    `      'Static assets must be served from CloudFront or a separate static host.',`,
+    `      { status: 404, headers: { 'content-type': 'text/plain' } },`,
+    `    )`,
+    `  }`,
+    ``,
+    `  if (!routesCache) routesCache = scanServerRoutes(serverDir)`,
+    `  if (!loaderCache) loaderCache = createProductionLoader()`,
+    ``,
+    `  const match = matchRoute(path, routesCache)`,
+    `  if (!match) {`,
+    `    return new Response(JSON.stringify({ error: { code: 'NOT_FOUND' } }), {`,
+    `      status: 404,`,
+    `      headers: { 'content-type': 'application/json' },`,
+    `    })`,
+    `  }`,
+    ``,
+    `  const request = eventV2ToRequest(event)`,
+    `  const { req, res, toResponse } = createWebShim(request)`,
+    ...deployedTraceFragment("request", "  "),
+    `  const method = request.method.toUpperCase()`,
+    `  return toResponse(executeRoute({ route: match.route, method, params: match.params, req, res, loadModule: loaderCache, serverDir, requestId, ...CSRF_CONFIG, ${runtimeSpread} }))`,
+    `}`
+  ];
+}
+function renderAwsLambdaEntry(opts = {}) {
+  const runtimeConfig = deployedRuntimeConfigFragment(opts);
+  return [
+    `// Generated by Theo \u2014 AWS Lambda Adapter`,
+    `// Use with API Gateway HTTP API v2 (default).`,
+    ``,
+    `import { resolve } from 'node:path'`,
+    `import { scanServerRoutes, matchRoute, executeRoute, createProductionLoader, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler } from 'theokit/server'`,
+    `import { createWebShim } from 'theokit/adapters/web-shim'`,
+    `import { buildSecurityHeaders, withSecurityHeaders } from 'theokit/adapters/security-headers'`,
+    ``,
+    `const cwd = process.cwd()`,
+    `const serverDir = resolve(cwd, 'server')`,
+    `let routesCache = null`,
+    `let loaderCache = null`,
+    ``,
+    `// #410 \u2014 the security baseline \`theokit start\` puts on every response,`,
+    `// carried here as a literal because the deployed function has no`,
+    `// theo.config.ts to read. Non-API paths 404 here and the document is served`,
+    `// from CloudFront or another static host, so this covers the API and not the`,
+    `// page (usetheokit/theokit#412).`,
+    `const SECURITY_HEADERS_CONFIG = ${renderSecurityHeadersConfigLiteral(opts.securityHeaders)}`,
+    `const SECURITY_HEADERS = buildSecurityHeaders(SECURITY_HEADERS_CONFIG, { production: true })`,
+    ``,
+    ...runtimeConfig.imports,
+    ...runtimeConfig.declarations,
+    ...deployedCsrfFragment(opts),
+    ``,
+    ...deployedCorsFragment(opts.cors, "aws-lambda"),
+    ``,
+    `function eventV2ToRequest(event) {`,
+    `  const method = event.requestContext?.http?.method ?? 'GET'`,
+    `  const path = event.requestContext?.http?.path ?? '/'`,
+    `  const host = event.headers?.host ?? 'lambda'`,
+    `  const qs = event.rawQueryString ? '?' + event.rawQueryString : ''`,
+    `  const url = 'https://' + host + path + qs`,
+    `  const headers = new Headers()`,
+    `  for (const [k, v] of Object.entries(event.headers ?? {})) {`,
+    `    if (v !== undefined) headers.set(k, String(v))`,
+    `  }`,
+    `  let body = event.body`,
+    `  if (body && event.isBase64Encoded) {`,
+    `    body = Buffer.from(body, 'base64')`,
+    `  }`,
+    `  return new Request(url, {`,
+    `    method,`,
+    `    headers,`,
+    `    body: method === 'GET' || method === 'HEAD' ? undefined : body,`,
+    `  })`,
+    `}`,
+    ``,
+    ...awsLambdaHandlerFragment(runtimeConfig.executeRouteSpread)
+  ].join("\n");
+}
+async function buildAwsLambda(config, cwd, deps = {}, ctx) {
+  assertServicesUnsupported("aws-lambda", readManifest(cwd));
+  if (config.ssrStreaming) {
+    throw new Error(
+      "[adapter-aws-lambda] ssrStreaming is on, but the aws-lambda target does not stream responses: the Lambda v2 result object carries the body as a string, so nothing can leave the function before the run ends. Response streaming would need awslambda.streamifyResponse plus a Function URL in RESPONSE_STREAM invoke mode, which this adapter does not emit. Build a streaming target instead (cloudflare, vercel, netlify, bun, deno-deploy, node), or set ssrStreaming: false in theo.config.ts."
+    );
+  }
+  const runNodeBuild = deps.runNodeBuild ?? nodeAdapter.build.bind(nodeAdapter);
+  await runNodeBuild(config, cwd, ctx);
+  const outputDir = resolve(cwd, ".theokit/aws");
+  const ensureDir = deps.ensureDir ?? ((p) => mkdirSync(p, { recursive: true }));
+  ensureDir(outputDir);
+  const entry = renderAwsLambdaEntry({
+    securityHeaders: config.security?.headers,
+    csrf: config.security?.csrf,
+    disallowed: config.security?.disallowed,
+    cors: config.security?.cors,
+    // #425 — a selector, not a transformer, so it rides as a literal like the values above.
+    serialization: config.serialization
+  });
+  const write = deps.writeEntry ?? ((p, c) => {
+    writeFileSync(p, c);
+  });
+  write(resolve(outputDir, "handler.mjs"), entry);
+  console.log("\n  \u2713 AWS Lambda output \u2192 .theokit/aws/handler.mjs");
+  console.log(
+    `${describeDeployedSecurityHeaders({
+      target: "aws-lambda",
+      securityHeaders: config.security?.headers,
+      mintsNonce: false,
+      documentHeaders: "platform-unmanaged"
+    })}
+`
+  );
+}
+var awsLambdaAdapter = {
+  name: "aws-lambda",
+  // #382 — delisted for streaming, deliberately. See DeployAdapter.
+  streamsResponses: false,
+  // #409 / #410 — the generated entry calls `executeRoute` with routes, loader
+  // and serverDir only. CSRF, route policy, file middleware and Zod validation
+  // still run because they live inside `executeRoute`; none of the remaining
+  // configurable concerns reach it. Declared explicitly rather than omitted so
+  // the gap is a statement in the source and not an absence.
+  //
+  // `securityHeaders` IS applied -- to every response this function returns.
+  // The document comes from CloudFront or another static host and does not pass
+  // through it (usetheokit/theokit#412).
+  appliesConfig: ["securityHeaders", "csrf", "disallowed", "cors", "serialization"],
+  build(config, cwd, ctx) {
+    return buildAwsLambda(config, cwd, {}, ctx);
+  }
+};
+export {
+  awsLambdaAdapter,
+  buildAwsLambda,
+  eventV2ToRequestShape,
+  renderAwsLambdaEntry,
+  responseToLambdaResultV2
+};
+//# sourceMappingURL=aws-lambda-VKMYUMP2.js.map

package/dist/aws-lambda-VKMYUMP2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapters/aws-lambda.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * AWS Lambda adapter. Writes to `cwd/.theokit/lambda/`. Build-time tool.\n */\nimport { mkdirSync, writeFileSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nimport type { TheoConfig } from '../config/schema.js'\nimport type { SecurityHeadersConfig } from '../core/contracts/security-headers.js'\nimport { assertServicesUnsupported, readManifest } from '../services/index.js'\n\nimport { deployedCorsFragment, type DeployedCorsOptions } from './deployed-cors.js'\nimport { deployedCsrfFragment, type DeployedCsrfOptions } from './deployed-csrf.js'\nimport {\n  deployedRuntimeConfigFragment,\n  type DeployedRuntimeConfigOptions,\n} from './deployed-runtime-config.js'\nimport { deployedTraceFragment } from './deployed-trace.js'\nimport { nodeAdapter } from './node.js'\nimport {\n  describeDeployedSecurityHeaders,\n  renderSecurityHeadersConfigLiteral,\n} from './security-headers.js'\nimport type { AdapterBuildContext, DeployAdapter } from './types.js'\n\nexport interface AwsLambdaBuildDeps {\n  runNodeBuild?: (config: TheoConfig, cwd: string, ctx?: AdapterBuildContext) => Promise<void>\n  writeEntry?: (path: string, content: string) => void\n  ensureDir?: (path: string) => void\n}\n\nexport interface RequestShape {\n  method: string\n  path: string\n  headers: Record<string, string>\n  body?: string\n}\n\nexport interface LambdaResultV2 {\n  statusCode: number\n  headers: Record<string, string>\n  body: string\n  isBase64Encoded: boolean\n}\n\nconst BINARY_CONTENT_TYPES = [\n  'application/octet-stream',\n  'application/pdf',\n  'application/zip',\n  'image/',\n  'audio/',\n  'video/',\n]\n\nfunction isBinaryContentType(contentType: string | undefined): boolean {\n  if (!contentType) return false\n  const ct = contentType.toLowerCase()\n  return BINARY_CONTENT_TYPES.some((prefix) => ct.startsWith(prefix))\n}\n\ninterface APIGatewayProxyEventV2 {\n  version: string\n  requestContext: {\n    http: { method: string; path: string }\n  }\n  headers?: Record<string, string | undefined>\n  body?: string\n  isBase64Encoded?: boolean\n}\n\nexport function eventV2ToRequestShape(event: APIGatewayProxyEventV2): RequestShape {\n  const headers: Record<string, string> = {}\n  for (const [k, v] of Object.entries(event.headers ?? {})) {\n    if (v !== undefined) headers[k] = v\n  }\n  let body: string | undefined = event.body\n  if (body !== undefined && event.isBase64Encoded) {\n    body = Buffer.from(body, 'base64').toString('utf-8')\n  }\n  return {\n    method: event.requestContext.http.method,\n    path: event.requestContext.http.path,\n    headers,\n    body,\n  }\n}\n\nexport function responseToLambdaResultV2(\n  statusCode: number,\n  headers: Record<string, string>,\n  body: string,\n): LambdaResultV2 {\n  const isBinary = isBinaryContentType(headers['content-type'])\n  return {\n    statusCode,\n    headers,\n    body: isBinary ? Buffer.from(body, 'binary').toString('base64') : body,\n    isBase64Encoded: isBinary,\n  }\n}\n\n// Generated-code fragments — extracted so the parent emitter stays under the\n// max-lines-per-function ceiling.\n/** The v2 result conversion, the handler, and the routing that feeds them. */\nfunction awsLambdaHandlerFragment(runtimeSpread: string): string[] {\n  return [\n    `// #382 — this target is DELISTED for response streaming, by construction.`,\n    `// The Lambda v2 result object below carries \\`body\\` as a string, so the`,\n    `// response cannot exist until the run has finished, no matter how the`,\n    `// framework's shim writes it. Streaming here would require`,\n    `// \\`awslambda.streamifyResponse\\` plus a Function URL in RESPONSE_STREAM`,\n    `// invoke mode — neither of which this adapter emits, and which would break`,\n    `// every API Gateway deployment of it. Rather than degrade in silence, a`,\n    `// response that is unambiguously a stream is named in the logs below.`,\n    `async function responseToV2Result(response, routePath) {`,\n    `  const headers = {}`,\n    `  response.headers.forEach((v, k) => { headers[k] = v })`,\n    `  const ct = headers['content-type'] ?? ''`,\n    `  if (ct.includes('text/event-stream')) {`,\n    `    console.warn(`,\n    `      '[theo][aws-lambda] ' + routePath + ' returned a streaming response (' + ct + '), ' +`,\n    `      'but the aws-lambda target buffers it whole and delivers it when the run ends. ' +`,\n    `      'This target is delisted for streaming (theokit#382). Deploy streaming routes to ' +`,\n    `      'cloudflare, vercel, netlify, bun, deno-deploy or node.'`,\n    `    )`,\n    `  }`,\n    `  const isBinary = /^application\\\\/(octet-stream|pdf|zip)|^(image|audio|video)\\\\//.test(ct)`,\n    `  if (isBinary) {`,\n    `    const buf = Buffer.from(await response.arrayBuffer())`,\n    `    return {`,\n    `      statusCode: response.status,`,\n    `      headers,`,\n    `      body: buf.toString('base64'),`,\n    `      isBase64Encoded: true,`,\n    `    }`,\n    `  }`,\n    `  return {`,\n    `    statusCode: response.status,`,\n    `    headers,`,\n    `    body: await response.text(),`,\n    `    isBase64Encoded: false,`,\n    `  }`,\n    `}`,\n    ``,\n    `// Every outcome — including both 404s — is produced as a Web Response by`,\n    `// routeRequest, so the security baseline is applied at ONE place and the`,\n    `// v2 result object is built from headers that already carry it.`,\n    `export const handler = async (event) => {`,\n    `  const path = event.requestContext?.http?.path ?? '/'`,\n    `  // #409 — the same event, read as a Web Request so the CORS matcher can see the method and`,\n    `  // the \\`origin\\` header. \\`eventV2ToRequest\\` reads a body already present in the event, so`,\n    `  // unlike the Node targets there is no stream to drain twice.`,\n    `  const corsRequest = eventV2ToRequest(event)`,\n    ``,\n    `  // The preflight is answered BEFORE anything routes: an OPTIONS the router handles is an`,\n    `  // OPTIONS the browser never gets a CORS answer to.`,\n    `  const preflight = corsPreflight(corsRequest)`,\n    `  const response = preflight !== null`,\n    `    ? withSecurityHeaders(preflight, SECURITY_HEADERS)`,\n    `    : withCors(corsRequest, withSecurityHeaders(await routeRequest(event, path), SECURITY_HEADERS))`,\n    `  return responseToV2Result(response, path)`,\n    `}`,\n    ``,\n    `async function routeRequest(event, path) {`,\n    `  if (!path.startsWith('/api/')) {`,\n    `    return new Response(`,\n    `      'Static assets must be served from CloudFront or a separate static host.',`,\n    `      { status: 404, headers: { 'content-type': 'text/plain' } },`,\n    `    )`,\n    `  }`,\n    ``,\n    `  if (!routesCache) routesCache = scanServerRoutes(serverDir)`,\n    `  if (!loaderCache) loaderCache = createProductionLoader()`,\n    ``,\n    `  const match = matchRoute(path, routesCache)`,\n    `  if (!match) {`,\n    `    return new Response(JSON.stringify({ error: { code: 'NOT_FOUND' } }), {`,\n    `      status: 404,`,\n    `      headers: { 'content-type': 'application/json' },`,\n    `    })`,\n    `  }`,\n    ``,\n    `  const request = eventV2ToRequest(event)`,\n    `  const { req, res, toResponse } = createWebShim(request)`,\n    ...deployedTraceFragment('request', '  '),\n    `  const method = request.method.toUpperCase()`,\n    `  return toResponse(executeRoute({ route: match.route, method, params: match.params, req, res, loadModule: loaderCache, serverDir, requestId, ...CSRF_CONFIG, ${runtimeSpread} }))`,\n    `}`,\n  ]\n}\n\nexport function renderAwsLambdaEntry(\n  opts: { securityHeaders?: SecurityHeadersConfig } & DeployedCsrfOptions &\n    DeployedRuntimeConfigOptions &\n    DeployedCorsOptions = {},\n): string {\n  const runtimeConfig = deployedRuntimeConfigFragment(opts)\n  return [\n    `// Generated by Theo — AWS Lambda Adapter`,\n    `// Use with API Gateway HTTP API v2 (default).`,\n    ``,\n    `import { resolve } from 'node:path'`,\n    `import { scanServerRoutes, matchRoute, executeRoute, createProductionLoader, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler } from 'theokit/server'`,\n    `import { createWebShim } from 'theokit/adapters/web-shim'`,\n    `import { buildSecurityHeaders, withSecurityHeaders } from 'theokit/adapters/security-headers'`,\n    ``,\n    `const cwd = process.cwd()`,\n    `const serverDir = resolve(cwd, 'server')`,\n    `let routesCache = null`,\n    `let loaderCache = null`,\n    ``,\n    `// #410 — the security baseline \\`theokit start\\` puts on every response,`,\n    `// carried here as a literal because the deployed function has no`,\n    `// theo.config.ts to read. Non-API paths 404 here and the document is served`,\n    `// from CloudFront or another static host, so this covers the API and not the`,\n    `// page (usetheokit/theokit#412).`,\n    `const SECURITY_HEADERS_CONFIG = ${renderSecurityHeadersConfigLiteral(opts.securityHeaders)}`,\n    `const SECURITY_HEADERS = buildSecurityHeaders(SECURITY_HEADERS_CONFIG, { production: true })`,\n    ``,\n    ...runtimeConfig.imports,\n    ...runtimeConfig.declarations,\n    ...deployedCsrfFragment(opts),\n    ``,\n    ...deployedCorsFragment(opts.cors, 'aws-lambda'),\n    ``,\n    `function eventV2ToRequest(event) {`,\n    `  const method = event.requestContext?.http?.method ?? 'GET'`,\n    `  const path = event.requestContext?.http?.path ?? '/'`,\n    `  const host = event.headers?.host ?? 'lambda'`,\n    `  const qs = event.rawQueryString ? '?' + event.rawQueryString : ''`,\n    `  const url = 'https://' + host + path + qs`,\n    `  const headers = new Headers()`,\n    `  for (const [k, v] of Object.entries(event.headers ?? {})) {`,\n    `    if (v !== undefined) headers.set(k, String(v))`,\n    `  }`,\n    `  let body = event.body`,\n    `  if (body && event.isBase64Encoded) {`,\n    `    body = Buffer.from(body, 'base64')`,\n    `  }`,\n    `  return new Request(url, {`,\n    `    method,`,\n    `    headers,`,\n    `    body: method === 'GET' || method === 'HEAD' ? undefined : body,`,\n    `  })`,\n    `}`,\n    ``,\n    ...awsLambdaHandlerFragment(runtimeConfig.executeRouteSpread),\n  ].join('\\n')\n}\n\nexport async function buildAwsLambda(\n  config: TheoConfig,\n  cwd: string,\n  deps: AwsLambdaBuildDeps = {},\n  ctx?: AdapterBuildContext,\n): Promise<void> {\n  // Wave 2 (T2.2) — reject polyglot services on this adapter.\n  assertServicesUnsupported('aws-lambda', readManifest(cwd))\n\n  // #382 — refuse by name rather than build something that cannot do what was\n  // asked. `ssrStreaming` is the config's declaration that responses stream,\n  // and this target is delisted for that (see `awsLambdaAdapter.streamsResponses`).\n  if (config.ssrStreaming) {\n    throw new Error(\n      '[adapter-aws-lambda] ssrStreaming is on, but the aws-lambda target does not stream ' +\n        'responses: the Lambda v2 result object carries the body as a string, so nothing can ' +\n        'leave the function before the run ends. Response streaming would need ' +\n        'awslambda.streamifyResponse plus a Function URL in RESPONSE_STREAM invoke mode, which ' +\n        'this adapter does not emit. Build a streaming target instead (cloudflare, vercel, ' +\n        'netlify, bun, deno-deploy, node), or set ssrStreaming: false in theo.config.ts.',\n    )\n  }\n\n  const runNodeBuild = deps.runNodeBuild ?? nodeAdapter.build.bind(nodeAdapter)\n  await runNodeBuild(config, cwd, ctx)\n\n  const outputDir = resolve(cwd, '.theokit/aws')\n  const ensureDir = deps.ensureDir ?? ((p: string) => mkdirSync(p, { recursive: true }))\n  ensureDir(outputDir)\n\n  const entry = renderAwsLambdaEntry({\n    securityHeaders: config.security?.headers,\n    csrf: config.security?.csrf,\n    disallowed: config.security?.disallowed,\n    cors: config.security?.cors,\n    // #425 — a selector, not a transformer, so it rides as a literal like the values above.\n    serialization: config.serialization,\n  })\n  const write =\n    deps.writeEntry ??\n    ((p, c) => {\n      writeFileSync(p, c)\n    })\n  write(resolve(outputDir, 'handler.mjs'), entry)\n\n  // eslint-disable-next-line no-console -- CLI build progress\n  console.log('\\n  ✓ AWS Lambda output → .theokit/aws/handler.mjs')\n  // eslint-disable-next-line no-console -- CLI build progress\n  console.log(\n    `${describeDeployedSecurityHeaders({\n      target: 'aws-lambda',\n      securityHeaders: config.security?.headers,\n      mintsNonce: false,\n      documentHeaders: 'platform-unmanaged',\n    })}\\n`,\n  )\n}\n\nexport const awsLambdaAdapter: DeployAdapter = {\n  name: 'aws-lambda',\n  // #382 — delisted for streaming, deliberately. See DeployAdapter.\n  streamsResponses: false,\n  // #409 / #410 — the generated entry calls `executeRoute` with routes, loader\n  // and serverDir only. CSRF, route policy, file middleware and Zod validation\n  // still run because they live inside `executeRoute`; none of the remaining\n  // configurable concerns reach it. Declared explicitly rather than omitted so\n  // the gap is a statement in the source and not an absence.\n  //\n  // `securityHeaders` IS applied -- to every response this function returns.\n  // The document comes from CloudFront or another static host and does not pass\n  // through it (usetheokit/theokit#412).\n  appliesConfig: ['securityHeaders', 'csrf', 'disallowed', 'cors', 'serialization'],\n  build(config, cwd, ctx) {\n    return buildAwsLambda(config, cwd, {}, ctx)\n  },\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAGA,SAAS,WAAW,qBAAqB;AACzC,SAAS,eAAe;AAwCxB,IAAM,uBAAuB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,oBAAoB,aAA0C;AACrE,MAAI,CAAC,YAAa,QAAO;AACzB,QAAM,KAAK,YAAY,YAAY;AACnC,SAAO,qBAAqB,KAAK,CAAC,WAAW,GAAG,WAAW,MAAM,CAAC;AACpE;AAYO,SAAS,sBAAsB,OAA6C;AACjF,QAAM,UAAkC,CAAC;AACzC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,WAAW,CAAC,CAAC,GAAG;AACxD,QAAI,MAAM,OAAW,SAAQ,CAAC,IAAI;AAAA,EACpC;AACA,MAAI,OAA2B,MAAM;AACrC,MAAI,SAAS,UAAa,MAAM,iBAAiB;AAC/C,WAAO,OAAO,KAAK,MAAM,QAAQ,EAAE,SAAS,OAAO;AAAA,EACrD;AACA,SAAO;AAAA,IACL,QAAQ,MAAM,eAAe,KAAK;AAAA,IAClC,MAAM,MAAM,eAAe,KAAK;AAAA,IAChC;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,yBACd,YACA,SACA,MACgB;AAChB,QAAM,WAAW,oBAAoB,QAAQ,cAAc,CAAC;AAC5D,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,MAAM,WAAW,OAAO,KAAK,MAAM,QAAQ,EAAE,SAAS,QAAQ,IAAI;AAAA,IAClE,iBAAiB;AAAA,EACnB;AACF;AAKA,SAAS,yBAAyB,eAAiC;AACjE,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,sBAAsB,WAAW,IAAI;AAAA,IACxC;AAAA,IACA,iKAAiK,aAAa;AAAA,IAC9K;AAAA,EACF;AACF;AAEO,SAAS,qBACd,OAEwB,CAAC,GACjB;AACR,QAAM,gBAAgB,8BAA8B,IAAI;AACxD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,mCAAmC,mCAAmC,KAAK,eAAe,CAAC;AAAA,IAC3F;AAAA,IACA;AAAA,IACA,GAAG,cAAc;AAAA,IACjB,GAAG,cAAc;AAAA,IACjB,GAAG,qBAAqB,IAAI;AAAA,IAC5B;AAAA,IACA,GAAG,qBAAqB,KAAK,MAAM,YAAY;AAAA,IAC/C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,yBAAyB,cAAc,kBAAkB;AAAA,EAC9D,EAAE,KAAK,IAAI;AACb;AAEA,eAAsB,eACpB,QACA,KACA,OAA2B,CAAC,GAC5B,KACe;AAEf,4BAA0B,cAAc,aAAa,GAAG,CAAC;AAKzD,MAAI,OAAO,cAAc;AACvB,UAAM,IAAI;AAAA,MACR;AAAA,IAMF;AAAA,EACF;AAEA,QAAM,eAAe,KAAK,gBAAgB,YAAY,MAAM,KAAK,WAAW;AAC5E,QAAM,aAAa,QAAQ,KAAK,GAAG;AAEnC,QAAM,YAAY,QAAQ,KAAK,cAAc;AAC7C,QAAM,YAAY,KAAK,cAAc,CAAC,MAAc,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AACpF,YAAU,SAAS;AAEnB,QAAM,QAAQ,qBAAqB;AAAA,IACjC,iBAAiB,OAAO,UAAU;AAAA,IAClC,MAAM,OAAO,UAAU;AAAA,IACvB,YAAY,OAAO,UAAU;AAAA,IAC7B,MAAM,OAAO,UAAU;AAAA;AAAA,IAEvB,eAAe,OAAO;AAAA,EACxB,CAAC;AACD,QAAM,QACJ,KAAK,eACJ,CAAC,GAAG,MAAM;AACT,kBAAc,GAAG,CAAC;AAAA,EACpB;AACF,QAAM,QAAQ,WAAW,aAAa,GAAG,KAAK;AAG9C,UAAQ,IAAI,8DAAoD;AAEhE,UAAQ;AAAA,IACN,GAAG,gCAAgC;AAAA,MACjC,QAAQ;AAAA,MACR,iBAAiB,OAAO,UAAU;AAAA,MAClC,YAAY;AAAA,MACZ,iBAAiB;AAAA,IACnB,CAAC,CAAC;AAAA;AAAA,EACJ;AACF;AAEO,IAAM,mBAAkC;AAAA,EAC7C,MAAM;AAAA;AAAA,EAEN,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUlB,eAAe,CAAC,mBAAmB,QAAQ,cAAc,QAAQ,eAAe;AAAA,EAChF,MAAM,QAAQ,KAAK,KAAK;AACtB,WAAO,eAAe,QAAQ,KAAK,CAAC,GAAG,GAAG;AAAA,EAC5C;AACF;","names":[]}

package/dist/{build-WU6AKKIB.js → build-FLX6VF7Q.js}

@@ -3,43 +3,53 @@ import "tsx/esm";
 import {
   describeControllerArtifacts,
   emitControllerArtifacts
-} from "./chunk-47CINLWF.js";
-import {
-  preflightNodeAndBindings
-} from "./chunk-KTMQUYED.js";
+} from "./chunk-44J2ANQC.js";
 import {
   validateProjectStructure
 } from "./chunk-GEQJAFSV.js";
+import {
+  preflightNodeAndBindings
+} from "./chunk-KTMQUYED.js";
 import {
   emitOpenApi,
   loadRoutesForOpenApi
 } from "./chunk-47VNWTL4.js";
+import "./chunk-HWBRS4DZ.js";
+import "./chunk-2AMLGJJA.js";
+import {
+  generateManifest,
+  writeManifest as writeManifest2
+} from "./chunk-KUZVRJ7M.js";
+import {
+  scanAgents
+} from "./chunk-EVZKNA2W.js";
+import {
+  scanServerRoutes,
+  scanWebSocketRoutes
+} from "./chunk-XS7EX55U.js";
+import {
+  compareByCodeUnit,
+  walkSourceFiles
+} from "./chunk-FD4ZDTQ6.js";
 import {
-  importUserModule,
   loadConfig
-} from "./chunk-S433N3CT.js";
+} from "./chunk-QTHVHNJJ.js";
 import {
   loadEnv
-} from "./chunk-HBU2GIMZ.js";
-import "./chunk-GVW5EKEU.js";
+} from "./chunk-3QPVEJ7D.js";
+import {
+  importUserModule
+} from "./chunk-U5PWXS3J.js";
+import "./chunk-FH3SQR6P.js";
 import {
   buildManifest,
   writeManifest
-} from "./chunk-7VPQHEAJ.js";
-import "./chunk-T5C46IIU.js";
-import {
-  generateManifest,
-  writeManifest as writeManifest2
-} from "./chunk-ZB7D62OA.js";
-import "./chunk-LNVMHQ2Z.js";
-import "./chunk-BMHS4WAN.js";
-import {
-  walkSourceFiles
-} from "./chunk-A7JBF5FO.js";
+} from "./chunk-ZNZISJDZ.js";
+import "./chunk-VI7ZANB3.js";
 
 // src/cli/commands/build.ts
 import { existsSync as existsSync4 } from "fs";
-import { resolve } from "path";
+import { dirname as dirname2, relative, resolve, sep as sep2 } from "path";
 
 // src/adapters/types.ts
 var VALID_TARGETS = [
@@ -306,7 +316,7 @@ async function scanCronDirs(dirs) {
       throw new DuplicateCronNameError(name, paths);
     }
   }
-  return nodes.sort((a, b) => a.name.localeCompare(b.name));
+  return nodes.sort((a, b) => compareByCodeUnit(a.name, b.name));
 }
 
 // src/server/jobs/job-manifest.ts
@@ -402,7 +412,7 @@ async function scanJobs(jobsDir) {
       throw new DuplicateJobNameError(name, paths);
     }
   }
-  return nodes.sort((a, b) => a.name.localeCompare(b.name));
+  return nodes.sort((a, b) => compareByCodeUnit(a.name, b.name));
 }
 
 // src/cli/cleanup/cleanup.ts
@@ -543,7 +553,7 @@ async function buildCommand(options) {
 `);
 }
 async function runAdapterBuild(target, config, cwd) {
-  const { theoPluginAsync } = await import("./vite-plugin-VPJFD4HK.js");
+  const { theoPluginAsync } = await import("./vite-plugin-VKCT2LF2.js");
   const { default: react } = await import("@vitejs/plugin-react");
   const ctx = {
     // `react()` may return Plugin or Plugin[] depending on version; spread the
@@ -559,10 +569,45 @@ async function runAdapterBuild(target, config, cwd) {
         serverDir: config.serverDir,
         agentsDir: config.agentsDir
       })
-    ].flat()
+    ].flat(),
+    // #369 — the same inversion, for the same reason. A Worker has no filesystem, so the Cloudflare
+    // entry bakes its routes at build time; importing the scanner from `adapters/` would add the
+    // `adapters → server` edge that `adapters-may-only-depend-on-core-router-services` refuses. The
+    // CLI already imports both sides, so it composes the scan and hands over the result.
+    //
+    // Paths are made relative to the project root here, where `cwd` is known: that string is both
+    // the emitted import specifier and the key the executor looks a module up by, and the scanners
+    // return absolute paths.
+    scanRoutes: (serverDir) => {
+      const abs = resolve(cwd, serverDir);
+      const toProjectRelative = (p) => relative(cwd, p).split(sep2).join("/");
+      return {
+        routes: scanServerRoutes(abs).map((route) => ({
+          filePath: toProjectRelative(route.filePath),
+          routePath: route.routePath,
+          methods: route.methods ?? []
+        })),
+        wsRoutes: scanWebSocketRoutes(abs).map(
+          (ws) => toProjectRelative(typeof ws === "string" ? ws : ws.filePath)
+        ),
+        // #367 — agents are a DIFFERENT scan served by a DIFFERENT function, which is why no
+        // adapter had ever heard of them: the entries route `/api/` through `scanServerRoutes` +
+        // `executeRoute` alone, so `/api/agents/<name>` matched nothing and 404'd on every target.
+        // Scanned here, beside the routes, because the same inversion argument applies verbatim.
+        agents: scanAgents(dirname2(abs), config.agentsDir).map((agent) => ({
+          filePath: toProjectRelative(agent.filePath),
+          agentPath: agent.agentPath,
+          name: agent.name
+        }))
+      };
+    }
   };
-  const { resolveAdapter } = await import("./registry-GKR3EWRW.js");
+  const { resolveAdapter } = await import("./registry-KBZDCFVQ.js");
   const adapter = await resolveAdapter(target);
+  const { warnUnappliedConfig } = await import("./config-support-WQHQIJTA.js");
+  warnUnappliedConfig(config, adapter, target, (message) => {
+    console.log(message);
+  });
   await adapter.build(config, cwd, ctx);
 }
 async function emitCronArtifacts(opts) {
@@ -629,4 +674,4 @@ function relativize3(absPath, root) {
 export {
   buildCommand
 };
-//# sourceMappingURL=build-WU6AKKIB.js.map
+//# sourceMappingURL=build-FLX6VF7Q.js.map