theokit 0.48.14 → 0.50.1

package/dist/app-typed-client-XGDZKH73.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/vite-plugin/app-typed-client.ts","../src/vite-plugin/controller-client-emit.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,SAAS,WAAW,cAAc,YAAY,eAAe,kBAAkB;AAC/E,SAAS,SAAS,YAAY,OAAO,UAAU,eAAe;;;ACP9D,SAAS,uBAAuB,8BAA8B;AAmD9D,SAAS,eACP,QACA,eACoB;AACpB,MAAI,WAAW,UAAa,WAAW,KAAM,QAAO;AACpD,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,aAAa,GAAG;AAGzD,QAAI,UAAU,OAAQ,QAAO;AAAA,EAC/B;AACA,SAAO;AACT;AAOA,eAAsB,2BAA2B,MAGd;AACjC,QAAM,SAAS,KAAK,cAAc;AAClC,QAAM,UAAU,MAAM,sBAAsB,KAAK,gBAAgB,MAAM;AACvE,QAAM,MAA6B,CAAC;AACpC,aAAW,EAAE,UAAU,KAAK,QAAQ,KAAK,SAAS;AAChD,UAAM,YAAa,IAAyB;AAC5C,eAAW,QAAQ,uBAAuB,GAAG,GAAG;AAC9C,YAAM,mBAAmB,eAAe,KAAK,YAAY,OAAO;AAUhE,YAAM,aAAa,KAAK,aAAa;AAAA,QACnC,CAAC,MAAM,EAAE,WAAW,WAAW,EAAE,WAAW;AAAA,MAC9C;AACA,YAAM,oBAAoB,eAAe,YAAY,QAAQ,OAAO;AACpE,UAAI,KAAK;AAAA,QACP;AAAA,QACA;AAAA,QACA,UAAU,KAAK;AAAA,QACf,MAAM,KAAK;AAAA,QACX,YAAY,OAAO,KAAK,WAAW;AAAA,QACnC,GAAI,qBAAqB,SAAY,EAAE,iBAAiB,IAAI,CAAC;AAAA,QAC7D,GAAI,sBAAsB,SAAY,EAAE,kBAAkB,IAAI,CAAC;AAAA,QAC/D,GAAK,KAAK,eAAe,UAAa,qBAAqB,UAC1D,YAAY,WAAW,UAAa,sBAAsB,SACvD,EAAE,mBAAmB,KAAK,IAC1B,CAAC;AAAA,MACP,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;;;AD7FA,IAAM,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAgCpB,SAAS,WAAqB;AAC5B,SAAO;AAAA,IACL,UAAU,oBAAI,IAAI;AAAA,IAClB,SAAS,oBAAI,IAAI;AAAA,IACjB,mBAAmB,oBAAI,IAAI;AAAA,IAC3B,uBAAuB,CAAC;AAAA,EAC1B;AACF;AAOA,SAAS,iBAAiB,KAAuD;AAE/E,MAAI,IAAI;AACR,MAAI,EAAE,WAAW,MAAM,EAAG,KAAI,EAAE,MAAM,CAAC;AAAA,WAC9B,EAAE,WAAW,GAAG,EAAG,KAAI,EAAE,MAAM,CAAC;AAGzC,QAAM,QAAQ,EAAE,QAAQ,iBAAiB,CAAC,GAAG,MAAc,EAAE,YAAY,CAAC;AAG1E,MAAI,6BAA6B,KAAK,KAAK,GAAG;AAC5C,WAAO,EAAE,YAAY,OAAO,SAAS,MAAM;AAAA,EAC7C;AAEA,SAAO,EAAE,YAAY,GAAG,SAAS,KAAK;AACxC;AAEA,SAAS,cAAc,YAAoB,cAA8B;AACvE,MAAI,MAAM,SAAS,QAAQ,UAAU,GAAG,YAAY;AAEpD,QAAM,IAAI,QAAQ,OAAO,GAAG;AAE5B,QAAM,IAAI,QAAQ,cAAc,EAAE;AAClC,MAAI,CAAC,IAAI,WAAW,GAAG,KAAK,CAAC,IAAI,WAAW,GAAG,GAAG;AAChD,UAAM,OAAO;AAAA,EACf;AACA,SAAO;AACT;AAMA,SAAS,kBAAkB,WAA6B;AACtD,MAAI,IAAI;AACR,MAAI,EAAE,WAAW,OAAO,EAAG,KAAI,EAAE,MAAM,CAAC;AAAA,WAC/B,EAAE,WAAW,MAAM,EAAG,KAAI,EAAE,MAAM,CAAC;AAC5C,MAAI,EAAE,WAAW,GAAG,EAAG,KAAI,EAAE,MAAM,CAAC;AACpC,MAAI,MAAM,GAAI,QAAO,CAAC;AACtB,SAAO,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AACpC;AAEA,SAAS,oBAAoB,WAA6B;AACxD,QAAM,MAAgB,CAAC;AACvB,QAAM,KAAK;AACX,MAAI;AACJ,UAAQ,IAAI,GAAG,KAAK,SAAS,OAAO,MAAM;AACxC,QAAI,KAAK,EAAE,CAAC,CAAC;AAAA,EACf;AACA,SAAO;AACT;AAcA,SAAS,cAAc,OAAsB,KAAyB;AACpE,MAAI,CAAC,MAAM,WAAW,MAAM,QAAQ,WAAW,EAAG;AAElD,QAAM,MAAM,IAAI,aAAa;AAE7B,QAAM,eAAe,WAAW,MAAM,QAAQ,IAC1C,MAAM,WACN,QAAQ,IAAI,WAAW,MAAM,QAAQ;AACzC,QAAM,aAAa,cAAc,IAAI,YAAY,YAAY;AAC7D,QAAM,UAAU,MAAM,QACnB,OAAO,CAAC,MAAwB,aAAmC,SAAS,CAAC,CAAC,EAC9E,IAAI,CAAC,YAAY,EAAE,QAAQ,OAAO,KAAK,GAAG,IAAI,MAAM,GAAG,EAAE;AAC5D,MAAI,QAAQ,WAAW,EAAG;AAC1B,QAAM,eAAe,QAAQ,IAAI,CAAC,MAAM,GAAG,EAAE,MAAM,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,IAAI;AAC9E,MAAI,YAAY,KAAK,mBAAmB,YAAY,YAAY,UAAU,GAAG;AAG7E,QAAM,WAAW,kBAAkB,MAAM,SAAS;AAClD,MAAI,OAAO,IAAI;AACf,aAAW,OAAO,UAAU;AAC1B,UAAM,OAAO,iBAAiB,GAAG;AACjC,QAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,UAAU;AAC7C,QAAI,UAAU,QAAW;AACvB,cAAQ,SAAS;AACjB,WAAK,SAAS,IAAI,KAAK,YAAY,KAAK;AAAA,IAC1C;AACA,WAAO;AAAA,EACT;AAEA,OAAK,wBAAwB,oBAAoB,MAAM,SAAS;AAGhE,aAAW,EAAE,QAAQ,MAAM,KAAK,SAAS;AACvC,QAAI,KAAK,QAAQ,IAAI,MAAM,GAAG;AAC5B,UAAI,SAAS;AAAA,QACX,yBAAyB,MAAM,eAAe,SAAS,KAAK,GAAG,CAAC;AAAA,MAClE;AAAA,IACF;AACA,SAAK,QAAQ,IAAI,QAAQ,KAAK;AAAA,EAChC;AACF;AAQA,SAAS,mBAAmB,IAAyB,YAAoB,KAAyB;AAChG,QAAM,OAAO,GAAG,KAAK,YAAY;AACjC,MAAI,CAAE,aAAmC,SAAS,IAAI,EAAG;AACzD,QAAM,SAAS;AAEf,QAAM,WAAW,kBAAkB,GAAG,QAAQ;AAC9C,MAAI,OAAO,IAAI;AACf,aAAW,OAAO,UAAU;AAC1B,UAAM,OAAO,iBAAiB,GAAG;AACjC,QAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,UAAU;AAC7C,QAAI,UAAU,QAAW;AACvB,cAAQ,SAAS;AACjB,WAAK,SAAS,IAAI,KAAK,YAAY,KAAK;AAAA,IAC1C;AACA,WAAO;AAAA,EACT;AACA,OAAK,wBAAwB,oBAAoB,GAAG,QAAQ;AAE5D,MAAI,KAAK,QAAQ,IAAI,MAAM,GAAG;AAC5B,QAAI,SAAS;AAAA,MACX,8BAA8B,GAAG,SAAS,IAAI,GAAG,UAAU,KAAK,MAAM,KAAK,SAAS,KAAK,GAAG,CAAC;AAAA,IAC/F;AACA;AAAA,EACF;AACA,MAAI,GAAG,sBAAsB,MAAM;AAIjC,UAAM,OAAO,gBAAgB,GAAG,SAAS,IAAI,GAAG,UAAU;AAC1D,QAAI,CAAC,IAAI,SAAS,SAAS,IAAI,EAAG,KAAI,SAAS,KAAK,IAAI;AAAA,EAC1D;AACA,OAAK,kBAAkB,IAAI,QAAQ;AAAA,IACjC;AAAA,IACA,YAAY,GAAG;AAAA;AAAA;AAAA,IAGf,GAAI,GAAG,qBAAqB,SACxB;AAAA,MACE,YAAY;AAAA,QACV,YAAY,cAAc,IAAI,YAAY,GAAG,QAAQ;AAAA,QACrD,YAAY,GAAG;AAAA,MACjB;AAAA,IACF,IACA,CAAC;AAAA,IACL,GAAI,GAAG,sBAAsB,SACzB;AAAA,MACE,aAAa;AAAA,QACX,YAAY,cAAc,IAAI,YAAY,GAAG,QAAQ;AAAA,QACrD,YAAY,GAAG;AAAA,MACjB;AAAA,IACF,IACA,CAAC;AAAA,EACP,CAAC;AACH;AAOA,SAAS,kBAAkB,MAAgB,YAAoB,UAA0B;AACvF,QAAM,mBAAmB,oBAAI,IAAY;AACzC,aAAW,UAAU,KAAK,QAAQ,KAAK,GAAG;AACxC,qBAAiB,IAAI,OAAO,YAAY,CAAC;AAAA,EAC3C;AACA,aAAW,UAAU,KAAK,kBAAkB,KAAK,GAAG;AAClD,qBAAiB,IAAI,OAAO,YAAY,CAAC;AAAA,EAC3C;AACA,QAAM,UAA0C,CAAC;AACjD,aAAW,aAAa,KAAK,SAAS,KAAK,GAAG;AAC5C,QAAI,iBAAiB,IAAI,SAAS,GAAG;AACnC,cAAQ,KAAK,EAAE,MAAM,WAAW,IAAI,GAAG,SAAS,IAAI,CAAC;AAAA,IACvD;AAAA,EACF;AACA,aAAW,EAAE,MAAM,GAAG,KAAK,SAAS;AAClC,UAAM,MAAM,KAAK,SAAS,IAAI,IAAI;AAClC,QAAI,QAAQ,QAAW;AACrB,WAAK,SAAS,OAAO,IAAI;AACzB,WAAK,SAAS,IAAI,IAAI,GAAG;AACzB,eAAS;AAAA,QACP,iDAA4C,IAAI,mCAAmC,UAAU,IAAI,IAAI,+BAA+B,EAAE;AAAA,MACxI;AAAA,IACF;AAAA,EACF;AAEA,aAAW,CAAC,MAAM,KAAK,KAAK,KAAK,UAAU;AACzC,sBAAkB,OAAO,GAAG,UAAU,IAAI,IAAI,IAAI,QAAQ;AAAA,EAC5D;AACF;AAEA,SAAS,eAAe,MAAgB,QAAgB,SAA0B;AAGhF,QAAM,QAAkB,CAAC,GAAG;AAE5B,aAAW,CAAC,QAAQ,KAAK,KAAK,KAAK,SAAS;AAC1C,UAAM,QAAQ,OAAO,YAAY;AAKjC,UAAM,aAAa,KAAK,sBAAsB,IAAI,CAAC,MAAM,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI;AAClF,UAAM,cACJ,KAAK,sBAAsB,SAAS,IAAI,eAAe,UAAU,YAAY;AAC/E,UAAM,eAAe,KAAK,sBAAsB,WAAW,IAAI,MAAM;AACrE,UAAM;AAAA,MACJ,GAAG,MAAM,KAAK,KAAK,UAAU,YAAY,KAAK,WAAW,oDAAoD,KAAK,+DAA+D,KAAK;AAAA,IACxL;AAAA,EACF;AAUA,aAAW,CAAC,QAAQ,IAAI,KAAK,KAAK,mBAAmB;AACnD,UAAM,QAAQ,OAAO,YAAY;AACjC,UAAM,aAAa,KAAK,sBAAsB,IAAI,CAAC,MAAM,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI;AAClF,UAAM,cACJ,KAAK,sBAAsB,SAAS,IAAI,eAAe,UAAU,YAAY;AAC/E,UAAM,eAAe,KAAK,sBAAsB,WAAW,IAAI,MAAM;AACrE,UAAM,WACJ,KAAK,eAAe,SAChB,mBACA,4CAA4C,KAAK,WAAW,UAAU,MAAM,KAAK,WAAW,UAAU;AAC5G,UAAM,YACJ,KAAK,gBAAgB,SACjB,mCACA,6CAA6C,KAAK,YAAY,UAAU,MAAM,KAAK,YAAY,UAAU;AAC/G,UAAM;AAAA,MACJ,GAAG,MAAM,KAAK,KAAK,UAAU,YAAY,KAAK,WAAW,KAAK,QAAQ,KAAK,SAAS,yDAAyD,KAAK,UAAU,MAAM,KAAK,UAAU;AAAA,IACnL;AAAA,EACF;AAEA,aAAW,CAAC,MAAM,KAAK,KAAK,KAAK,UAAU;AAKzC,UAAM,UAAU,6BAA6B,KAAK,IAAI,IAClD,OACA,IAAI,KAAK,QAAQ,OAAO,MAAM,EAAE,QAAQ,MAAM,KAAK,CAAC;AACxD,UAAM,KAAK,GAAG,MAAM,KAAK,OAAO,KAAK,eAAe,OAAO,SAAS,MAAM,KAAK,CAAC,EAAE;AAAA,EACpF;AACA,QAAM,KAAK,GAAG,MAAM,GAAG;AACvB,SAAO,MAAM,KAAK,IAAI;AACxB;AAgBO,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAqC;AACnC,QAAM,MAAoB;AAAA,IACxB,MAAM,SAAS;AAAA,IACf,cAAc,EAAE,OAAO,EAAE;AAAA,IACzB,aAAa,CAAC;AAAA,IACd,UAAU,CAAC;AAAA,IACX;AAAA,IACA;AAAA,EACF;AACA,aAAW,SAAS,SAAS,QAAQ;AACnC,kBAAc,OAAO,GAAG;AAAA,EAC1B;AAGA,MAAI,kBAAkB,QAAQ;AAC5B,UAAM,eAAe,oBAAI,IAAoB;AAC7C,eAAW,MAAM,kBAAkB;AACjC,UAAI,QAAQ,aAAa,IAAI,GAAG,QAAQ;AACxC,UAAI,UAAU,QAAW;AACvB,gBAAQ,KAAK,aAAa,IAAI;AAC9B,qBAAa,IAAI,GAAG,UAAU,KAAK;AACnC,cAAM,aAAa,cAAc,YAAY,GAAG,QAAQ;AACxD,YAAI,YAAY,KAAK,mBAAmB,GAAG,SAAS,OAAO,KAAK,YAAY,UAAU,GAAG;AAAA,MAC3F;AACA,yBAAmB,IAAI,OAAO,GAAG;AAAA,IACnC;AAAA,EACF;AAGA,oBAAkB,IAAI,MAAM,IAAI,IAAI,QAAQ;AAE5C,QAAM,eAAe,IAAI,YAAY,SAAS,IAAI,IAAI,YAAY,KAAK,IAAI,IAAI,SAAS;AACxF,QAAM,gBACJ,IAAI,SAAS,SAAS,IAAI,UAAU,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS;AAI9E,QAAM,WACJ,IAAI,KAAK,SAAS,SAAS,KAC3B,IAAI,KAAK,QAAQ,SAAS,KAC1B,IAAI,KAAK,kBAAkB,SAAS,IAChC,+FACA;AAAA,IAAe,IAAI;AAAA,IAAM;AAAA;AAAA,IAAmB;AAAA,EAAI;AAEtD,SAAO,GAAG,WAAW;AAAA;AAAA,EAErB,YAAY,GAAG,aAAa,gCAAgC,QAAQ;AAAA;AAAA;AAAA;AAItE;AAwBA,IAAM,wBAAwB;AAC9B,IAAM,yBAAyB;AAQxB,SAAS,oBACd,MACA,YACA,iBACS;AACT,QAAM,aAAa,KAAK,QAAQ,OAAO,GAAG;AAC1C,MAAI,WAAW,SAAS,iBAAiB,EAAG,QAAO;AACnD,SAAO,WAAW,WAAW,UAAU,KAAK,WAAW,WAAW,eAAe;AACnF;AAGA,SAAS,mBAAmB,UAAkB,SAAuC;AACnF,MAAI,WAAW,QAAQ,GAAG;AACxB,QAAI;AACF,YAAM,UAAU,aAAa,UAAU,OAAO;AAC9C,UAAI,YAAY,QAAS,QAAO,EAAE,SAAS,MAAM;AAAA,IACnD,QAAQ;AAAA,IAER;AAAA,EACF;AACA,YAAU,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAChD,QAAM,MAAM,GAAG,QAAQ,IAAI,QAAQ,GAAG;AACtC,gBAAc,KAAK,OAAO;AAC1B,aAAW,KAAK,QAAQ;AACxB,SAAO,EAAE,SAAS,KAAK;AACzB;AAEA,eAAe,cACb,MAC6C;AAC7C,MAAI,CAAC,WAAW,KAAK,SAAS,GAAG;AAE/B,UAAM,WAAW,MAAM,KAAK,KAAK,QAAQ,QAAQ,OAAO,GAAG,GAAG,aAAa;AAC3E,WAAO;AAAA,MACL,SAAS;AAAA,QACP;AAAA,QACA,kBAAkB;AAAA,UAChB,UAAU;AAAA,YACR,SAAS;AAAA,YACT,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,YACpC,QAAQ,CAAC;AAAA,YACT,SAAS,CAAC;AAAA,YACV,YAAY,CAAC;AAAA,UACf;AAAA,UACA,YAAY;AAAA,UACZ,WAAW,KAAK;AAAA,QAClB,CAAC;AAAA,MACH,EAAE;AAAA,MACF,MAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,WAAW,iBAAiB,KAAK,SAAS;AAKhD,MAAI,KAAK,aAAa,QAAQ;AAC5B,aAAS,OAAO,KAAK,GAAG,KAAK,WAAW;AAAA,EAC1C;AAIA,QAAM,iBAAiB,QAAQ,KAAK,WAAW,aAAa;AAC5D,QAAM,mBAAmB,WAAW,cAAc,IAC9C,MAAM,2BAA2B,EAAE,eAAe,CAAC,IACnD,CAAC;AAEL,QAAM,aAAa,MAAM,KAAK,KAAK,QAAQ,QAAQ,OAAO,GAAG,GAAG,aAAa;AAC7E,QAAM,UAAU,kBAAkB;AAAA,IAChC;AAAA,IACA;AAAA,IACA,WAAW,KAAK;AAAA,IAChB;AAAA,EACF,CAAC;AACD,QAAM,EAAE,QAAQ,IAAI,mBAAmB,YAAY,OAAO;AAC1D,SAAO,EAAE,SAAS,MAAM,WAAW;AACrC;AAEO,SAAS,qBAAqB,MAA2C;AAC9E,MAAI;AACJ,MAAI;AAEJ,WAAS,eAAqB;AAC5B,QAAI,cAAe,cAAa,aAAa;AAC7C,oBAAgB,WAAW,MAAM;AAC/B,YAAM,YAAY;AAChB,YAAI;AACF,gBAAM,cAAc,IAAI;AAExB,cAAI,YAAY;AACd,kBAAM,MAAM,WAAW,YAAY,cAAc,sBAAsB;AACvE,gBAAI,IAAK,YAAW,YAAY,iBAAiB,GAAG;AAAA,UACtD;AAAA,QACF,SAAS,KAAK;AAEZ,kBAAQ,MAAM,6CAA6C,GAAG;AAAA,QAChE;AAAA,MACF,GAAG;AAAA,IACL,GAAG,GAAG;AAAA,EACR;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM,iBAAiB;AACrB,UAAI;AACF,cAAM,cAAc,IAAI;AAAA,MAC1B,SAAS,KAAK;AACZ,gBAAQ,MAAM,qDAAqD,GAAG;AAAA,MACxE;AAAA,IACF;AAAA,IACA,MAAM,WAAW;AACf,UAAI;AACF,cAAM,cAAc,IAAI;AAAA,MAC1B,SAAS,KAAK;AACZ,gBAAQ,MAAM,sDAAsD,GAAG;AAAA,MACzE;AAAA,IACF;AAAA,IACA,gBAAgB,QAAQ;AACtB,mBAAa;AACb,YAAM,aAAa,MAAM,KAAK,KAAK,UAAU,QAAQ,OAAO,GAAG,GAAG,QAAQ;AAC1E,YAAM,kBAAkB,MAAM,KAAK,KAAK,UAAU,QAAQ,OAAO,GAAG,GAAG,aAAa;AACpF,YAAM,SAAS,CAAC,SAAuB;AACrC,YAAI,oBAAoB,MAAM,YAAY,eAAe,EAAG,cAAa;AAAA,MAC3E;AACA,aAAO,QAAQ,GAAG,OAAO,MAAM;AAC/B,aAAO,QAAQ,GAAG,UAAU,MAAM;AAClC,aAAO,QAAQ,GAAG,UAAU,MAAM;AAAA,IACpC;AAAA,IACA,UAAU,IAAI;AACZ,UAAI,OAAO,sBAAuB,QAAO;AACzC,aAAO;AAAA,IACT;AAAA,IACA,KAAK,IAAI;AACP,UAAI,OAAO,wBAAwB;AACjC,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF,EAAE,KAAK,IAAI;AAAA,MACb;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;","names":[]}

package/dist/aws-lambda-VKMYUMP2.js

@@ -0,0 +1,261 @@
+#!/usr/bin/env node
+import "tsx/esm";
+import {
+  deployedCorsFragment,
+  deployedCsrfFragment,
+  deployedRuntimeConfigFragment,
+  deployedTraceFragment,
+  describeDeployedSecurityHeaders,
+  renderSecurityHeadersConfigLiteral
+} from "./chunk-E43VJ3E5.js";
+import {
+  nodeAdapter
+} from "./chunk-KI4DOTN4.js";
+import "./chunk-RPET332G.js";
+import {
+  assertServicesUnsupported,
+  readManifest
+} from "./chunk-ZNZISJDZ.js";
+
+// src/adapters/aws-lambda.ts
+import { mkdirSync, writeFileSync } from "fs";
+import { resolve } from "path";
+var BINARY_CONTENT_TYPES = [
+  "application/octet-stream",
+  "application/pdf",
+  "application/zip",
+  "image/",
+  "audio/",
+  "video/"
+];
+function isBinaryContentType(contentType) {
+  if (!contentType) return false;
+  const ct = contentType.toLowerCase();
+  return BINARY_CONTENT_TYPES.some((prefix) => ct.startsWith(prefix));
+}
+function eventV2ToRequestShape(event) {
+  const headers = {};
+  for (const [k, v] of Object.entries(event.headers ?? {})) {
+    if (v !== void 0) headers[k] = v;
+  }
+  let body = event.body;
+  if (body !== void 0 && event.isBase64Encoded) {
+    body = Buffer.from(body, "base64").toString("utf-8");
+  }
+  return {
+    method: event.requestContext.http.method,
+    path: event.requestContext.http.path,
+    headers,
+    body
+  };
+}
+function responseToLambdaResultV2(statusCode, headers, body) {
+  const isBinary = isBinaryContentType(headers["content-type"]);
+  return {
+    statusCode,
+    headers,
+    body: isBinary ? Buffer.from(body, "binary").toString("base64") : body,
+    isBase64Encoded: isBinary
+  };
+}
+function awsLambdaHandlerFragment(runtimeSpread) {
+  return [
+    `// #382 \u2014 this target is DELISTED for response streaming, by construction.`,
+    `// The Lambda v2 result object below carries \`body\` as a string, so the`,
+    `// response cannot exist until the run has finished, no matter how the`,
+    `// framework's shim writes it. Streaming here would require`,
+    `// \`awslambda.streamifyResponse\` plus a Function URL in RESPONSE_STREAM`,
+    `// invoke mode \u2014 neither of which this adapter emits, and which would break`,
+    `// every API Gateway deployment of it. Rather than degrade in silence, a`,
+    `// response that is unambiguously a stream is named in the logs below.`,
+    `async function responseToV2Result(response, routePath) {`,
+    `  const headers = {}`,
+    `  response.headers.forEach((v, k) => { headers[k] = v })`,
+    `  const ct = headers['content-type'] ?? ''`,
+    `  if (ct.includes('text/event-stream')) {`,
+    `    console.warn(`,
+    `      '[theo][aws-lambda] ' + routePath + ' returned a streaming response (' + ct + '), ' +`,
+    `      'but the aws-lambda target buffers it whole and delivers it when the run ends. ' +`,
+    `      'This target is delisted for streaming (theokit#382). Deploy streaming routes to ' +`,
+    `      'cloudflare, vercel, netlify, bun, deno-deploy or node.'`,
+    `    )`,
+    `  }`,
+    `  const isBinary = /^application\\/(octet-stream|pdf|zip)|^(image|audio|video)\\//.test(ct)`,
+    `  if (isBinary) {`,
+    `    const buf = Buffer.from(await response.arrayBuffer())`,
+    `    return {`,
+    `      statusCode: response.status,`,
+    `      headers,`,
+    `      body: buf.toString('base64'),`,
+    `      isBase64Encoded: true,`,
+    `    }`,
+    `  }`,
+    `  return {`,
+    `    statusCode: response.status,`,
+    `    headers,`,
+    `    body: await response.text(),`,
+    `    isBase64Encoded: false,`,
+    `  }`,
+    `}`,
+    ``,
+    `// Every outcome \u2014 including both 404s \u2014 is produced as a Web Response by`,
+    `// routeRequest, so the security baseline is applied at ONE place and the`,
+    `// v2 result object is built from headers that already carry it.`,
+    `export const handler = async (event) => {`,
+    `  const path = event.requestContext?.http?.path ?? '/'`,
+    `  // #409 \u2014 the same event, read as a Web Request so the CORS matcher can see the method and`,
+    `  // the \`origin\` header. \`eventV2ToRequest\` reads a body already present in the event, so`,
+    `  // unlike the Node targets there is no stream to drain twice.`,
+    `  const corsRequest = eventV2ToRequest(event)`,
+    ``,
+    `  // The preflight is answered BEFORE anything routes: an OPTIONS the router handles is an`,
+    `  // OPTIONS the browser never gets a CORS answer to.`,
+    `  const preflight = corsPreflight(corsRequest)`,
+    `  const response = preflight !== null`,
+    `    ? withSecurityHeaders(preflight, SECURITY_HEADERS)`,
+    `    : withCors(corsRequest, withSecurityHeaders(await routeRequest(event, path), SECURITY_HEADERS))`,
+    `  return responseToV2Result(response, path)`,
+    `}`,
+    ``,
+    `async function routeRequest(event, path) {`,
+    `  if (!path.startsWith('/api/')) {`,
+    `    return new Response(`,
+    `      'Static assets must be served from CloudFront or a separate static host.',`,
+    `      { status: 404, headers: { 'content-type': 'text/plain' } },`,
+    `    )`,
+    `  }`,
+    ``,
+    `  if (!routesCache) routesCache = scanServerRoutes(serverDir)`,
+    `  if (!loaderCache) loaderCache = createProductionLoader()`,
+    ``,
+    `  const match = matchRoute(path, routesCache)`,
+    `  if (!match) {`,
+    `    return new Response(JSON.stringify({ error: { code: 'NOT_FOUND' } }), {`,
+    `      status: 404,`,
+    `      headers: { 'content-type': 'application/json' },`,
+    `    })`,
+    `  }`,
+    ``,
+    `  const request = eventV2ToRequest(event)`,
+    `  const { req, res, toResponse } = createWebShim(request)`,
+    ...deployedTraceFragment("request", "  "),
+    `  const method = request.method.toUpperCase()`,
+    `  return toResponse(executeRoute({ route: match.route, method, params: match.params, req, res, loadModule: loaderCache, serverDir, requestId, ...CSRF_CONFIG, ${runtimeSpread} }))`,
+    `}`
+  ];
+}
+function renderAwsLambdaEntry(opts = {}) {
+  const runtimeConfig = deployedRuntimeConfigFragment(opts);
+  return [
+    `// Generated by Theo \u2014 AWS Lambda Adapter`,
+    `// Use with API Gateway HTTP API v2 (default).`,
+    ``,
+    `import { resolve } from 'node:path'`,
+    `import { scanServerRoutes, matchRoute, executeRoute, createProductionLoader, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler } from 'theokit/server'`,
+    `import { createWebShim } from 'theokit/adapters/web-shim'`,
+    `import { buildSecurityHeaders, withSecurityHeaders } from 'theokit/adapters/security-headers'`,
+    ``,
+    `const cwd = process.cwd()`,
+    `const serverDir = resolve(cwd, 'server')`,
+    `let routesCache = null`,
+    `let loaderCache = null`,
+    ``,
+    `// #410 \u2014 the security baseline \`theokit start\` puts on every response,`,
+    `// carried here as a literal because the deployed function has no`,
+    `// theo.config.ts to read. Non-API paths 404 here and the document is served`,
+    `// from CloudFront or another static host, so this covers the API and not the`,
+    `// page (usetheokit/theokit#412).`,
+    `const SECURITY_HEADERS_CONFIG = ${renderSecurityHeadersConfigLiteral(opts.securityHeaders)}`,
+    `const SECURITY_HEADERS = buildSecurityHeaders(SECURITY_HEADERS_CONFIG, { production: true })`,
+    ``,
+    ...runtimeConfig.imports,
+    ...runtimeConfig.declarations,
+    ...deployedCsrfFragment(opts),
+    ``,
+    ...deployedCorsFragment(opts.cors, "aws-lambda"),
+    ``,
+    `function eventV2ToRequest(event) {`,
+    `  const method = event.requestContext?.http?.method ?? 'GET'`,
+    `  const path = event.requestContext?.http?.path ?? '/'`,
+    `  const host = event.headers?.host ?? 'lambda'`,
+    `  const qs = event.rawQueryString ? '?' + event.rawQueryString : ''`,
+    `  const url = 'https://' + host + path + qs`,
+    `  const headers = new Headers()`,
+    `  for (const [k, v] of Object.entries(event.headers ?? {})) {`,
+    `    if (v !== undefined) headers.set(k, String(v))`,
+    `  }`,
+    `  let body = event.body`,
+    `  if (body && event.isBase64Encoded) {`,
+    `    body = Buffer.from(body, 'base64')`,
+    `  }`,
+    `  return new Request(url, {`,
+    `    method,`,
+    `    headers,`,
+    `    body: method === 'GET' || method === 'HEAD' ? undefined : body,`,
+    `  })`,
+    `}`,
+    ``,
+    ...awsLambdaHandlerFragment(runtimeConfig.executeRouteSpread)
+  ].join("\n");
+}
+async function buildAwsLambda(config, cwd, deps = {}, ctx) {
+  assertServicesUnsupported("aws-lambda", readManifest(cwd));
+  if (config.ssrStreaming) {
+    throw new Error(
+      "[adapter-aws-lambda] ssrStreaming is on, but the aws-lambda target does not stream responses: the Lambda v2 result object carries the body as a string, so nothing can leave the function before the run ends. Response streaming would need awslambda.streamifyResponse plus a Function URL in RESPONSE_STREAM invoke mode, which this adapter does not emit. Build a streaming target instead (cloudflare, vercel, netlify, bun, deno-deploy, node), or set ssrStreaming: false in theo.config.ts."
+    );
+  }
+  const runNodeBuild = deps.runNodeBuild ?? nodeAdapter.build.bind(nodeAdapter);
+  await runNodeBuild(config, cwd, ctx);
+  const outputDir = resolve(cwd, ".theokit/aws");
+  const ensureDir = deps.ensureDir ?? ((p) => mkdirSync(p, { recursive: true }));
+  ensureDir(outputDir);
+  const entry = renderAwsLambdaEntry({
+    securityHeaders: config.security?.headers,
+    csrf: config.security?.csrf,
+    disallowed: config.security?.disallowed,
+    cors: config.security?.cors,
+    // #425 — a selector, not a transformer, so it rides as a literal like the values above.
+    serialization: config.serialization
+  });
+  const write = deps.writeEntry ?? ((p, c) => {
+    writeFileSync(p, c);
+  });
+  write(resolve(outputDir, "handler.mjs"), entry);
+  console.log("\n  \u2713 AWS Lambda output \u2192 .theokit/aws/handler.mjs");
+  console.log(
+    `${describeDeployedSecurityHeaders({
+      target: "aws-lambda",
+      securityHeaders: config.security?.headers,
+      mintsNonce: false,
+      documentHeaders: "platform-unmanaged"
+    })}
+`
+  );
+}
+var awsLambdaAdapter = {
+  name: "aws-lambda",
+  // #382 — delisted for streaming, deliberately. See DeployAdapter.
+  streamsResponses: false,
+  // #409 / #410 — the generated entry calls `executeRoute` with routes, loader
+  // and serverDir only. CSRF, route policy, file middleware and Zod validation
+  // still run because they live inside `executeRoute`; none of the remaining
+  // configurable concerns reach it. Declared explicitly rather than omitted so
+  // the gap is a statement in the source and not an absence.
+  //
+  // `securityHeaders` IS applied -- to every response this function returns.
+  // The document comes from CloudFront or another static host and does not pass
+  // through it (usetheokit/theokit#412).
+  appliesConfig: ["securityHeaders", "csrf", "disallowed", "cors", "serialization"],
+  build(config, cwd, ctx) {
+    return buildAwsLambda(config, cwd, {}, ctx);
+  }
+};
+export {
+  awsLambdaAdapter,
+  buildAwsLambda,
+  eventV2ToRequestShape,
+  renderAwsLambdaEntry,
+  responseToLambdaResultV2
+};
+//# sourceMappingURL=aws-lambda-VKMYUMP2.js.map

package/dist/aws-lambda-VKMYUMP2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapters/aws-lambda.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * AWS Lambda adapter. Writes to `cwd/.theokit/lambda/`. Build-time tool.\n */\nimport { mkdirSync, writeFileSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nimport type { TheoConfig } from '../config/schema.js'\nimport type { SecurityHeadersConfig } from '../core/contracts/security-headers.js'\nimport { assertServicesUnsupported, readManifest } from '../services/index.js'\n\nimport { deployedCorsFragment, type DeployedCorsOptions } from './deployed-cors.js'\nimport { deployedCsrfFragment, type DeployedCsrfOptions } from './deployed-csrf.js'\nimport {\n  deployedRuntimeConfigFragment,\n  type DeployedRuntimeConfigOptions,\n} from './deployed-runtime-config.js'\nimport { deployedTraceFragment } from './deployed-trace.js'\nimport { nodeAdapter } from './node.js'\nimport {\n  describeDeployedSecurityHeaders,\n  renderSecurityHeadersConfigLiteral,\n} from './security-headers.js'\nimport type { AdapterBuildContext, DeployAdapter } from './types.js'\n\nexport interface AwsLambdaBuildDeps {\n  runNodeBuild?: (config: TheoConfig, cwd: string, ctx?: AdapterBuildContext) => Promise<void>\n  writeEntry?: (path: string, content: string) => void\n  ensureDir?: (path: string) => void\n}\n\nexport interface RequestShape {\n  method: string\n  path: string\n  headers: Record<string, string>\n  body?: string\n}\n\nexport interface LambdaResultV2 {\n  statusCode: number\n  headers: Record<string, string>\n  body: string\n  isBase64Encoded: boolean\n}\n\nconst BINARY_CONTENT_TYPES = [\n  'application/octet-stream',\n  'application/pdf',\n  'application/zip',\n  'image/',\n  'audio/',\n  'video/',\n]\n\nfunction isBinaryContentType(contentType: string | undefined): boolean {\n  if (!contentType) return false\n  const ct = contentType.toLowerCase()\n  return BINARY_CONTENT_TYPES.some((prefix) => ct.startsWith(prefix))\n}\n\ninterface APIGatewayProxyEventV2 {\n  version: string\n  requestContext: {\n    http: { method: string; path: string }\n  }\n  headers?: Record<string, string | undefined>\n  body?: string\n  isBase64Encoded?: boolean\n}\n\nexport function eventV2ToRequestShape(event: APIGatewayProxyEventV2): RequestShape {\n  const headers: Record<string, string> = {}\n  for (const [k, v] of Object.entries(event.headers ?? {})) {\n    if (v !== undefined) headers[k] = v\n  }\n  let body: string | undefined = event.body\n  if (body !== undefined && event.isBase64Encoded) {\n    body = Buffer.from(body, 'base64').toString('utf-8')\n  }\n  return {\n    method: event.requestContext.http.method,\n    path: event.requestContext.http.path,\n    headers,\n    body,\n  }\n}\n\nexport function responseToLambdaResultV2(\n  statusCode: number,\n  headers: Record<string, string>,\n  body: string,\n): LambdaResultV2 {\n  const isBinary = isBinaryContentType(headers['content-type'])\n  return {\n    statusCode,\n    headers,\n    body: isBinary ? Buffer.from(body, 'binary').toString('base64') : body,\n    isBase64Encoded: isBinary,\n  }\n}\n\n// Generated-code fragments — extracted so the parent emitter stays under the\n// max-lines-per-function ceiling.\n/** The v2 result conversion, the handler, and the routing that feeds them. */\nfunction awsLambdaHandlerFragment(runtimeSpread: string): string[] {\n  return [\n    `// #382 — this target is DELISTED for response streaming, by construction.`,\n    `// The Lambda v2 result object below carries \\`body\\` as a string, so the`,\n    `// response cannot exist until the run has finished, no matter how the`,\n    `// framework's shim writes it. Streaming here would require`,\n    `// \\`awslambda.streamifyResponse\\` plus a Function URL in RESPONSE_STREAM`,\n    `// invoke mode — neither of which this adapter emits, and which would break`,\n    `// every API Gateway deployment of it. Rather than degrade in silence, a`,\n    `// response that is unambiguously a stream is named in the logs below.`,\n    `async function responseToV2Result(response, routePath) {`,\n    `  const headers = {}`,\n    `  response.headers.forEach((v, k) => { headers[k] = v })`,\n    `  const ct = headers['content-type'] ?? ''`,\n    `  if (ct.includes('text/event-stream')) {`,\n    `    console.warn(`,\n    `      '[theo][aws-lambda] ' + routePath + ' returned a streaming response (' + ct + '), ' +`,\n    `      'but the aws-lambda target buffers it whole and delivers it when the run ends. ' +`,\n    `      'This target is delisted for streaming (theokit#382). Deploy streaming routes to ' +`,\n    `      'cloudflare, vercel, netlify, bun, deno-deploy or node.'`,\n    `    )`,\n    `  }`,\n    `  const isBinary = /^application\\\\/(octet-stream|pdf|zip)|^(image|audio|video)\\\\//.test(ct)`,\n    `  if (isBinary) {`,\n    `    const buf = Buffer.from(await response.arrayBuffer())`,\n    `    return {`,\n    `      statusCode: response.status,`,\n    `      headers,`,\n    `      body: buf.toString('base64'),`,\n    `      isBase64Encoded: true,`,\n    `    }`,\n    `  }`,\n    `  return {`,\n    `    statusCode: response.status,`,\n    `    headers,`,\n    `    body: await response.text(),`,\n    `    isBase64Encoded: false,`,\n    `  }`,\n    `}`,\n    ``,\n    `// Every outcome — including both 404s — is produced as a Web Response by`,\n    `// routeRequest, so the security baseline is applied at ONE place and the`,\n    `// v2 result object is built from headers that already carry it.`,\n    `export const handler = async (event) => {`,\n    `  const path = event.requestContext?.http?.path ?? '/'`,\n    `  // #409 — the same event, read as a Web Request so the CORS matcher can see the method and`,\n    `  // the \\`origin\\` header. \\`eventV2ToRequest\\` reads a body already present in the event, so`,\n    `  // unlike the Node targets there is no stream to drain twice.`,\n    `  const corsRequest = eventV2ToRequest(event)`,\n    ``,\n    `  // The preflight is answered BEFORE anything routes: an OPTIONS the router handles is an`,\n    `  // OPTIONS the browser never gets a CORS answer to.`,\n    `  const preflight = corsPreflight(corsRequest)`,\n    `  const response = preflight !== null`,\n    `    ? withSecurityHeaders(preflight, SECURITY_HEADERS)`,\n    `    : withCors(corsRequest, withSecurityHeaders(await routeRequest(event, path), SECURITY_HEADERS))`,\n    `  return responseToV2Result(response, path)`,\n    `}`,\n    ``,\n    `async function routeRequest(event, path) {`,\n    `  if (!path.startsWith('/api/')) {`,\n    `    return new Response(`,\n    `      'Static assets must be served from CloudFront or a separate static host.',`,\n    `      { status: 404, headers: { 'content-type': 'text/plain' } },`,\n    `    )`,\n    `  }`,\n    ``,\n    `  if (!routesCache) routesCache = scanServerRoutes(serverDir)`,\n    `  if (!loaderCache) loaderCache = createProductionLoader()`,\n    ``,\n    `  const match = matchRoute(path, routesCache)`,\n    `  if (!match) {`,\n    `    return new Response(JSON.stringify({ error: { code: 'NOT_FOUND' } }), {`,\n    `      status: 404,`,\n    `      headers: { 'content-type': 'application/json' },`,\n    `    })`,\n    `  }`,\n    ``,\n    `  const request = eventV2ToRequest(event)`,\n    `  const { req, res, toResponse } = createWebShim(request)`,\n    ...deployedTraceFragment('request', '  '),\n    `  const method = request.method.toUpperCase()`,\n    `  return toResponse(executeRoute({ route: match.route, method, params: match.params, req, res, loadModule: loaderCache, serverDir, requestId, ...CSRF_CONFIG, ${runtimeSpread} }))`,\n    `}`,\n  ]\n}\n\nexport function renderAwsLambdaEntry(\n  opts: { securityHeaders?: SecurityHeadersConfig } & DeployedCsrfOptions &\n    DeployedRuntimeConfigOptions &\n    DeployedCorsOptions = {},\n): string {\n  const runtimeConfig = deployedRuntimeConfigFragment(opts)\n  return [\n    `// Generated by Theo — AWS Lambda Adapter`,\n    `// Use with API Gateway HTTP API v2 (default).`,\n    ``,\n    `import { resolve } from 'node:path'`,\n    `import { scanServerRoutes, matchRoute, executeRoute, createProductionLoader, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler } from 'theokit/server'`,\n    `import { createWebShim } from 'theokit/adapters/web-shim'`,\n    `import { buildSecurityHeaders, withSecurityHeaders } from 'theokit/adapters/security-headers'`,\n    ``,\n    `const cwd = process.cwd()`,\n    `const serverDir = resolve(cwd, 'server')`,\n    `let routesCache = null`,\n    `let loaderCache = null`,\n    ``,\n    `// #410 — the security baseline \\`theokit start\\` puts on every response,`,\n    `// carried here as a literal because the deployed function has no`,\n    `// theo.config.ts to read. Non-API paths 404 here and the document is served`,\n    `// from CloudFront or another static host, so this covers the API and not the`,\n    `// page (usetheokit/theokit#412).`,\n    `const SECURITY_HEADERS_CONFIG = ${renderSecurityHeadersConfigLiteral(opts.securityHeaders)}`,\n    `const SECURITY_HEADERS = buildSecurityHeaders(SECURITY_HEADERS_CONFIG, { production: true })`,\n    ``,\n    ...runtimeConfig.imports,\n    ...runtimeConfig.declarations,\n    ...deployedCsrfFragment(opts),\n    ``,\n    ...deployedCorsFragment(opts.cors, 'aws-lambda'),\n    ``,\n    `function eventV2ToRequest(event) {`,\n    `  const method = event.requestContext?.http?.method ?? 'GET'`,\n    `  const path = event.requestContext?.http?.path ?? '/'`,\n    `  const host = event.headers?.host ?? 'lambda'`,\n    `  const qs = event.rawQueryString ? '?' + event.rawQueryString : ''`,\n    `  const url = 'https://' + host + path + qs`,\n    `  const headers = new Headers()`,\n    `  for (const [k, v] of Object.entries(event.headers ?? {})) {`,\n    `    if (v !== undefined) headers.set(k, String(v))`,\n    `  }`,\n    `  let body = event.body`,\n    `  if (body && event.isBase64Encoded) {`,\n    `    body = Buffer.from(body, 'base64')`,\n    `  }`,\n    `  return new Request(url, {`,\n    `    method,`,\n    `    headers,`,\n    `    body: method === 'GET' || method === 'HEAD' ? undefined : body,`,\n    `  })`,\n    `}`,\n    ``,\n    ...awsLambdaHandlerFragment(runtimeConfig.executeRouteSpread),\n  ].join('\\n')\n}\n\nexport async function buildAwsLambda(\n  config: TheoConfig,\n  cwd: string,\n  deps: AwsLambdaBuildDeps = {},\n  ctx?: AdapterBuildContext,\n): Promise<void> {\n  // Wave 2 (T2.2) — reject polyglot services on this adapter.\n  assertServicesUnsupported('aws-lambda', readManifest(cwd))\n\n  // #382 — refuse by name rather than build something that cannot do what was\n  // asked. `ssrStreaming` is the config's declaration that responses stream,\n  // and this target is delisted for that (see `awsLambdaAdapter.streamsResponses`).\n  if (config.ssrStreaming) {\n    throw new Error(\n      '[adapter-aws-lambda] ssrStreaming is on, but the aws-lambda target does not stream ' +\n        'responses: the Lambda v2 result object carries the body as a string, so nothing can ' +\n        'leave the function before the run ends. Response streaming would need ' +\n        'awslambda.streamifyResponse plus a Function URL in RESPONSE_STREAM invoke mode, which ' +\n        'this adapter does not emit. Build a streaming target instead (cloudflare, vercel, ' +\n        'netlify, bun, deno-deploy, node), or set ssrStreaming: false in theo.config.ts.',\n    )\n  }\n\n  const runNodeBuild = deps.runNodeBuild ?? nodeAdapter.build.bind(nodeAdapter)\n  await runNodeBuild(config, cwd, ctx)\n\n  const outputDir = resolve(cwd, '.theokit/aws')\n  const ensureDir = deps.ensureDir ?? ((p: string) => mkdirSync(p, { recursive: true }))\n  ensureDir(outputDir)\n\n  const entry = renderAwsLambdaEntry({\n    securityHeaders: config.security?.headers,\n    csrf: config.security?.csrf,\n    disallowed: config.security?.disallowed,\n    cors: config.security?.cors,\n    // #425 — a selector, not a transformer, so it rides as a literal like the values above.\n    serialization: config.serialization,\n  })\n  const write =\n    deps.writeEntry ??\n    ((p, c) => {\n      writeFileSync(p, c)\n    })\n  write(resolve(outputDir, 'handler.mjs'), entry)\n\n  // eslint-disable-next-line no-console -- CLI build progress\n  console.log('\\n  ✓ AWS Lambda output → .theokit/aws/handler.mjs')\n  // eslint-disable-next-line no-console -- CLI build progress\n  console.log(\n    `${describeDeployedSecurityHeaders({\n      target: 'aws-lambda',\n      securityHeaders: config.security?.headers,\n      mintsNonce: false,\n      documentHeaders: 'platform-unmanaged',\n    })}\\n`,\n  )\n}\n\nexport const awsLambdaAdapter: DeployAdapter = {\n  name: 'aws-lambda',\n  // #382 — delisted for streaming, deliberately. See DeployAdapter.\n  streamsResponses: false,\n  // #409 / #410 — the generated entry calls `executeRoute` with routes, loader\n  // and serverDir only. CSRF, route policy, file middleware and Zod validation\n  // still run because they live inside `executeRoute`; none of the remaining\n  // configurable concerns reach it. Declared explicitly rather than omitted so\n  // the gap is a statement in the source and not an absence.\n  //\n  // `securityHeaders` IS applied -- to every response this function returns.\n  // The document comes from CloudFront or another static host and does not pass\n  // through it (usetheokit/theokit#412).\n  appliesConfig: ['securityHeaders', 'csrf', 'disallowed', 'cors', 'serialization'],\n  build(config, cwd, ctx) {\n    return buildAwsLambda(config, cwd, {}, ctx)\n  },\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAGA,SAAS,WAAW,qBAAqB;AACzC,SAAS,eAAe;AAwCxB,IAAM,uBAAuB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,oBAAoB,aAA0C;AACrE,MAAI,CAAC,YAAa,QAAO;AACzB,QAAM,KAAK,YAAY,YAAY;AACnC,SAAO,qBAAqB,KAAK,CAAC,WAAW,GAAG,WAAW,MAAM,CAAC;AACpE;AAYO,SAAS,sBAAsB,OAA6C;AACjF,QAAM,UAAkC,CAAC;AACzC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,WAAW,CAAC,CAAC,GAAG;AACxD,QAAI,MAAM,OAAW,SAAQ,CAAC,IAAI;AAAA,EACpC;AACA,MAAI,OAA2B,MAAM;AACrC,MAAI,SAAS,UAAa,MAAM,iBAAiB;AAC/C,WAAO,OAAO,KAAK,MAAM,QAAQ,EAAE,SAAS,OAAO;AAAA,EACrD;AACA,SAAO;AAAA,IACL,QAAQ,MAAM,eAAe,KAAK;AAAA,IAClC,MAAM,MAAM,eAAe,KAAK;AAAA,IAChC;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,yBACd,YACA,SACA,MACgB;AAChB,QAAM,WAAW,oBAAoB,QAAQ,cAAc,CAAC;AAC5D,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,MAAM,WAAW,OAAO,KAAK,MAAM,QAAQ,EAAE,SAAS,QAAQ,IAAI;AAAA,IAClE,iBAAiB;AAAA,EACnB;AACF;AAKA,SAAS,yBAAyB,eAAiC;AACjE,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,sBAAsB,WAAW,IAAI;AAAA,IACxC;AAAA,IACA,iKAAiK,aAAa;AAAA,IAC9K;AAAA,EACF;AACF;AAEO,SAAS,qBACd,OAEwB,CAAC,GACjB;AACR,QAAM,gBAAgB,8BAA8B,IAAI;AACxD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,mCAAmC,mCAAmC,KAAK,eAAe,CAAC;AAAA,IAC3F;AAAA,IACA;AAAA,IACA,GAAG,cAAc;AAAA,IACjB,GAAG,cAAc;AAAA,IACjB,GAAG,qBAAqB,IAAI;AAAA,IAC5B;AAAA,IACA,GAAG,qBAAqB,KAAK,MAAM,YAAY;AAAA,IAC/C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,yBAAyB,cAAc,kBAAkB;AAAA,EAC9D,EAAE,KAAK,IAAI;AACb;AAEA,eAAsB,eACpB,QACA,KACA,OAA2B,CAAC,GAC5B,KACe;AAEf,4BAA0B,cAAc,aAAa,GAAG,CAAC;AAKzD,MAAI,OAAO,cAAc;AACvB,UAAM,IAAI;AAAA,MACR;AAAA,IAMF;AAAA,EACF;AAEA,QAAM,eAAe,KAAK,gBAAgB,YAAY,MAAM,KAAK,WAAW;AAC5E,QAAM,aAAa,QAAQ,KAAK,GAAG;AAEnC,QAAM,YAAY,QAAQ,KAAK,cAAc;AAC7C,QAAM,YAAY,KAAK,cAAc,CAAC,MAAc,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AACpF,YAAU,SAAS;AAEnB,QAAM,QAAQ,qBAAqB;AAAA,IACjC,iBAAiB,OAAO,UAAU;AAAA,IAClC,MAAM,OAAO,UAAU;AAAA,IACvB,YAAY,OAAO,UAAU;AAAA,IAC7B,MAAM,OAAO,UAAU;AAAA;AAAA,IAEvB,eAAe,OAAO;AAAA,EACxB,CAAC;AACD,QAAM,QACJ,KAAK,eACJ,CAAC,GAAG,MAAM;AACT,kBAAc,GAAG,CAAC;AAAA,EACpB;AACF,QAAM,QAAQ,WAAW,aAAa,GAAG,KAAK;AAG9C,UAAQ,IAAI,8DAAoD;AAEhE,UAAQ;AAAA,IACN,GAAG,gCAAgC;AAAA,MACjC,QAAQ;AAAA,MACR,iBAAiB,OAAO,UAAU;AAAA,MAClC,YAAY;AAAA,MACZ,iBAAiB;AAAA,IACnB,CAAC,CAAC;AAAA;AAAA,EACJ;AACF;AAEO,IAAM,mBAAkC;AAAA,EAC7C,MAAM;AAAA;AAAA,EAEN,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUlB,eAAe,CAAC,mBAAmB,QAAQ,cAAc,QAAQ,eAAe;AAAA,EAChF,MAAM,QAAQ,KAAK,KAAK;AACtB,WAAO,eAAe,QAAQ,KAAK,CAAC,GAAG,GAAG;AAAA,EAC5C;AACF;","names":[]}

package/dist/{body-parser-web-4Z2QTPDU.js → body-parser-web-ON5CUTEL.js}

@@ -1,3 +1,6 @@
+import {
+  appendField
+} from "./chunk-CHTAWXC2.js";
 import "./chunk-XTHN6JBX.js";
 
 // src/server/body-parser-web.ts
@@ -41,7 +44,7 @@ async function parseImpl(request, options) {
     let fileCount = 0;
     for (const [key, value] of form.entries()) {
       if (typeof value === "string") {
-        fields[key] = value;
+        appendField(fields, key, value);
       } else {
         if (++fileCount > maxFiles) {
           throw new Error(`Too many files: max ${maxFiles}`);
@@ -67,4 +70,4 @@ export {
   RequestBodyTooLargeError,
   parseWebRequestBody
 };
-//# sourceMappingURL=body-parser-web-4Z2QTPDU.js.map
+//# sourceMappingURL=body-parser-web-ON5CUTEL.js.map

package/dist/body-parser-web-ON5CUTEL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/body-parser-web.ts"],"mappings":";;;;;;AA2BA,IAAM,wBAAwB,KAAK,OAAO;AAC1C,IAAM,oBAAoB;AAC1B,IAAM,gBAAgB;AAEf,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAClD,YAAY,UAAkB,KAAa;AACzC,UAAM,mDAAmD,QAAQ,gBAAgB,GAAG,EAAE;AACtF,SAAK,OAAO;AAAA,EACd;AACF;AAGA,IAAM,aAAa,oBAAI,QAAyC;AAEzD,SAAS,oBACd,SACA,UAAgC,CAAC,GACT;AACxB,QAAM,SAAS,WAAW,IAAI,OAAO;AACrC,MAAI,OAAQ,QAAO;AACnB,QAAM,UAAU,UAAU,SAAS,OAAO;AAC1C,aAAW,IAAI,SAAS,OAAO;AAC/B,SAAO;AACT;AAEA,eAAe,UAAU,SAAkB,SAAuD;AAChG,QAAM,cAAc,QAAQ,eAAe;AAC3C,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,WAAW,cAAc,WAAW;AAG1C,QAAM,KAAK,OAAO,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,GAAG;AAC9D,MAAI,KAAK,UAAU;AACjB,UAAM,IAAI,yBAAyB,IAAI,QAAQ;AAAA,EACjD;AAEA,QAAM,QAAuB,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,EAAE;AACrD,MAAI,CAAC,QAAQ,KAAM,QAAO;AAE1B,QAAM,MAAM,QAAQ,QAAQ,IAAI,cAAc,KAAK,IAAI,YAAY;AACnE,MAAI,GAAG,SAAS,kBAAkB,GAAG;AACnC,UAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,QAAI,CAAC,KAAM,QAAO;AAClB,WAAO,EAAE,GAAG,OAAO,MAAM,KAAK,MAAM,IAAI,EAAE;AAAA,EAC5C;AAEA,MAAI,GAAG,SAAS,qBAAqB,GAAG;AACtC,UAAM,OAAO,MAAM,QAAQ,SAAS;AACpC,UAAM,SAA4C,CAAC;AACnD,UAAM,QAAgC,CAAC;AACvC,QAAI,YAAY;AAChB,eAAW,CAAC,KAAK,KAAK,KAAK,KAAK,QAAQ,GAAG;AACzC,UAAI,OAAO,UAAU,UAAU;AAC7B,oBAAY,QAAQ,KAAK,KAAK;AAAA,MAChC,OAAO;AACL,YAAI,EAAE,YAAY,UAAU;AAC1B,gBAAM,IAAI,MAAM,uBAAuB,QAAQ,EAAE;AAAA,QACnD;AACA,YAAI,MAAM,OAAO,aAAa;AAC5B,gBAAM,IAAI,MAAM,QAAQ,MAAM,IAAI,wBAAwB,WAAW,EAAE;AAAA,QACzE;AACA,cAAM,MAAM,IAAI,WAAW,MAAM,MAAM,YAAY,CAAC;AACpD,cAAM,KAAK;AAAA,UACT,WAAW;AAAA,UACX,UAAU,MAAM;AAAA,UAChB,aAAa,MAAM;AAAA,UACnB,MAAM,MAAM;AAAA,UACZ,QAAQ;AAAA,QACV,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO,EAAE,QAAQ,MAAM;AAAA,EACzB;AAEA,SAAO;AACT;","names":[]}

package/dist/{body-parser-web-TIOTXPDW.js → body-parser-web-RV2SSAI3.js}

@@ -1,5 +1,8 @@
 #!/usr/bin/env node
 import "tsx/esm";
+import {
+  appendField
+} from "./chunk-7UZZHCRN.js";
 
 // src/server/body-parser-web.ts
 var DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024;
@@ -42,7 +45,7 @@ async function parseImpl(request, options) {
     let fileCount = 0;
     for (const [key, value] of form.entries()) {
       if (typeof value === "string") {
-        fields[key] = value;
+        appendField(fields, key, value);
       } else {
         if (++fileCount > maxFiles) {
           throw new Error(`Too many files: max ${maxFiles}`);
@@ -68,4 +71,4 @@ export {
   RequestBodyTooLargeError,
   parseWebRequestBody
 };
-//# sourceMappingURL=body-parser-web-TIOTXPDW.js.map
+//# sourceMappingURL=body-parser-web-RV2SSAI3.js.map

package/dist/body-parser-web-RV2SSAI3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/body-parser-web.ts"],"sourcesContent":["/**\n * T5.1 — Web Standards body parser for non-Node runtimes (Bun, Deno, edge).\n *\n * Uses `request.formData()` for multipart and `request.json()`/`text()` for\n * JSON/text. EC-4: Content-Length pre-check prevents OOM. EC-12: per-Request\n * cache via WeakMap so multiple parse calls on the same Request are idempotent.\n */\n\nimport { appendField } from './multipart-fields.js'\n\ninterface ParsedWebBody {\n  json?: unknown\n  fields: Record<string, string | string[]>\n  files: {\n    fieldName: string\n    filename: string\n    contentType: string\n    size: number\n    buffer: Uint8Array\n  }[]\n}\n\ninterface WebBodyParserOptions {\n  maxFileSize?: number\n  maxFiles?: number\n}\n\nconst DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024 // 10MB\nconst DEFAULT_MAX_FILES = 10\nconst SAFETY_MARGIN = 1_048_576 // 1MB encoding overhead\n\nexport class RequestBodyTooLargeError extends Error {\n  constructor(declared: number, max: number) {\n    super(`Request body too large: declared Content-Length ${declared} exceeds max ${max}`)\n    this.name = 'RequestBodyTooLargeError'\n  }\n}\n\n// EC-12 cache — idempotent parse per Request\nconst parseCache = new WeakMap<Request, Promise<ParsedWebBody>>()\n\nexport function parseWebRequestBody(\n  request: Request,\n  options: WebBodyParserOptions = {},\n): Promise<ParsedWebBody> {\n  const cached = parseCache.get(request)\n  if (cached) return cached\n  const promise = parseImpl(request, options)\n  parseCache.set(request, promise)\n  return promise\n}\n\nasync function parseImpl(request: Request, options: WebBodyParserOptions): Promise<ParsedWebBody> {\n  const maxFileSize = options.maxFileSize ?? DEFAULT_MAX_FILE_SIZE\n  const maxFiles = options.maxFiles ?? DEFAULT_MAX_FILES\n  const maxTotal = maxFileSize * maxFiles + SAFETY_MARGIN\n\n  // EC-4 — Content-Length pre-check before materializing body\n  const cl = Number(request.headers.get('content-length') ?? '0')\n  if (cl > maxTotal) {\n    throw new RequestBodyTooLargeError(cl, maxTotal)\n  }\n\n  const empty: ParsedWebBody = { fields: {}, files: [] }\n  if (!request.body) return empty\n\n  const ct = (request.headers.get('content-type') ?? '').toLowerCase()\n  if (ct.includes('application/json')) {\n    const text = await request.text()\n    if (!text) return empty\n    return { ...empty, json: JSON.parse(text) }\n  }\n\n  if (ct.includes('multipart/form-data')) {\n    const form = await request.formData()\n    const fields: Record<string, string | string[]> = {}\n    const files: ParsedWebBody['files'] = []\n    let fileCount = 0\n    for (const [key, value] of form.entries()) {\n      if (typeof value === 'string') {\n        appendField(fields, key, value)\n      } else {\n        if (++fileCount > maxFiles) {\n          throw new Error(`Too many files: max ${maxFiles}`)\n        }\n        if (value.size > maxFileSize) {\n          throw new Error(`File ${value.name} exceeds maxFileSize ${maxFileSize}`)\n        }\n        const buf = new Uint8Array(await value.arrayBuffer())\n        files.push({\n          fieldName: key,\n          filename: value.name,\n          contentType: value.type,\n          size: value.size,\n          buffer: buf,\n        })\n      }\n    }\n    return { fields, files }\n  }\n\n  return empty\n}\n"],"mappings":";;;;;;;AA2BA,IAAM,wBAAwB,KAAK,OAAO;AAC1C,IAAM,oBAAoB;AAC1B,IAAM,gBAAgB;AAEf,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAClD,YAAY,UAAkB,KAAa;AACzC,UAAM,mDAAmD,QAAQ,gBAAgB,GAAG,EAAE;AACtF,SAAK,OAAO;AAAA,EACd;AACF;AAGA,IAAM,aAAa,oBAAI,QAAyC;AAEzD,SAAS,oBACd,SACA,UAAgC,CAAC,GACT;AACxB,QAAM,SAAS,WAAW,IAAI,OAAO;AACrC,MAAI,OAAQ,QAAO;AACnB,QAAM,UAAU,UAAU,SAAS,OAAO;AAC1C,aAAW,IAAI,SAAS,OAAO;AAC/B,SAAO;AACT;AAEA,eAAe,UAAU,SAAkB,SAAuD;AAChG,QAAM,cAAc,QAAQ,eAAe;AAC3C,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,WAAW,cAAc,WAAW;AAG1C,QAAM,KAAK,OAAO,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,GAAG;AAC9D,MAAI,KAAK,UAAU;AACjB,UAAM,IAAI,yBAAyB,IAAI,QAAQ;AAAA,EACjD;AAEA,QAAM,QAAuB,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,EAAE;AACrD,MAAI,CAAC,QAAQ,KAAM,QAAO;AAE1B,QAAM,MAAM,QAAQ,QAAQ,IAAI,cAAc,KAAK,IAAI,YAAY;AACnE,MAAI,GAAG,SAAS,kBAAkB,GAAG;AACnC,UAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,QAAI,CAAC,KAAM,QAAO;AAClB,WAAO,EAAE,GAAG,OAAO,MAAM,KAAK,MAAM,IAAI,EAAE;AAAA,EAC5C;AAEA,MAAI,GAAG,SAAS,qBAAqB,GAAG;AACtC,UAAM,OAAO,MAAM,QAAQ,SAAS;AACpC,UAAM,SAA4C,CAAC;AACnD,UAAM,QAAgC,CAAC;AACvC,QAAI,YAAY;AAChB,eAAW,CAAC,KAAK,KAAK,KAAK,KAAK,QAAQ,GAAG;AACzC,UAAI,OAAO,UAAU,UAAU;AAC7B,oBAAY,QAAQ,KAAK,KAAK;AAAA,MAChC,OAAO;AACL,YAAI,EAAE,YAAY,UAAU;AAC1B,gBAAM,IAAI,MAAM,uBAAuB,QAAQ,EAAE;AAAA,QACnD;AACA,YAAI,MAAM,OAAO,aAAa;AAC5B,gBAAM,IAAI,MAAM,QAAQ,MAAM,IAAI,wBAAwB,WAAW,EAAE;AAAA,QACzE;AACA,cAAM,MAAM,IAAI,WAAW,MAAM,MAAM,YAAY,CAAC;AACpD,cAAM,KAAK;AAAA,UACT,WAAW;AAAA,UACX,UAAU,MAAM;AAAA,UAChB,aAAa,MAAM;AAAA,UACnB,MAAM,MAAM;AAAA,UACZ,QAAQ;AAAA,QACV,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO,EAAE,QAAQ,MAAM;AAAA,EACzB;AAEA,SAAO;AACT;","names":[]}

package/dist/{build-F2Q5QTSC.js → build-VZODSYIQ.js}

@@ -3,43 +3,54 @@ import "tsx/esm";
 import {
   describeControllerArtifacts,
   emitControllerArtifacts
-} from "./chunk-47CINLWF.js";
-import {
-  preflightNodeAndBindings
-} from "./chunk-KTMQUYED.js";
+} from "./chunk-EDWEYQRG.js";
 import {
   validateProjectStructure
 } from "./chunk-GEQJAFSV.js";
+import {
+  preflightNodeAndBindings
+} from "./chunk-KTMQUYED.js";
 import {
   emitOpenApi,
   loadRoutesForOpenApi
 } from "./chunk-47VNWTL4.js";
+import "./chunk-FMTRNQQ7.js";
+import "./chunk-RARK7JBR.js";
+import "./chunk-7UZZHCRN.js";
+import {
+  generateManifest,
+  writeManifest as writeManifest2
+} from "./chunk-KUZVRJ7M.js";
+import {
+  scanAgents
+} from "./chunk-EVZKNA2W.js";
+import {
+  scanServerRoutes,
+  scanWebSocketRoutes
+} from "./chunk-XS7EX55U.js";
+import {
+  compareByCodeUnit,
+  walkSourceFiles
+} from "./chunk-FD4ZDTQ6.js";
 import {
-  importUserModule,
   loadConfig
-} from "./chunk-AATSV4UV.js";
+} from "./chunk-QTHVHNJJ.js";
 import {
   loadEnv
-} from "./chunk-HBU2GIMZ.js";
-import "./chunk-CMYSHZFT.js";
+} from "./chunk-3QPVEJ7D.js";
+import {
+  importUserModule
+} from "./chunk-U5PWXS3J.js";
+import "./chunk-FH3SQR6P.js";
 import {
   buildManifest,
   writeManifest
-} from "./chunk-WSXNGF7X.js";
-import "./chunk-T5C46IIU.js";
-import {
-  generateManifest,
-  writeManifest as writeManifest2
-} from "./chunk-ZB7D62OA.js";
-import "./chunk-LNVMHQ2Z.js";
-import "./chunk-BMHS4WAN.js";
-import {
-  walkSourceFiles
-} from "./chunk-A7JBF5FO.js";
+} from "./chunk-ZNZISJDZ.js";
+import "./chunk-VI7ZANB3.js";
 
 // src/cli/commands/build.ts
 import { existsSync as existsSync4 } from "fs";
-import { resolve } from "path";
+import { dirname as dirname2, relative, resolve, sep as sep2 } from "path";
 
 // src/adapters/types.ts
 var VALID_TARGETS = [
@@ -306,7 +317,7 @@ async function scanCronDirs(dirs) {
       throw new DuplicateCronNameError(name, paths);
     }
   }
-  return nodes.sort((a, b) => a.name.localeCompare(b.name));
+  return nodes.sort((a, b) => compareByCodeUnit(a.name, b.name));
 }
 
 // src/server/jobs/job-manifest.ts
@@ -402,7 +413,7 @@ async function scanJobs(jobsDir) {
       throw new DuplicateJobNameError(name, paths);
     }
   }
-  return nodes.sort((a, b) => a.name.localeCompare(b.name));
+  return nodes.sort((a, b) => compareByCodeUnit(a.name, b.name));
 }
 
 // src/cli/cleanup/cleanup.ts
@@ -543,7 +554,7 @@ async function buildCommand(options) {
 `);
 }
 async function runAdapterBuild(target, config, cwd) {
-  const { theoPluginAsync } = await import("./vite-plugin-RJFKLF2U.js");
+  const { theoPluginAsync } = await import("./vite-plugin-USXUIV3H.js");
   const { default: react } = await import("@vitejs/plugin-react");
   const ctx = {
     // `react()` may return Plugin or Plugin[] depending on version; spread the
@@ -559,10 +570,45 @@ async function runAdapterBuild(target, config, cwd) {
         serverDir: config.serverDir,
         agentsDir: config.agentsDir
       })
-    ].flat()
+    ].flat(),
+    // #369 — the same inversion, for the same reason. A Worker has no filesystem, so the Cloudflare
+    // entry bakes its routes at build time; importing the scanner from `adapters/` would add the
+    // `adapters → server` edge that `adapters-may-only-depend-on-core-router-services` refuses. The
+    // CLI already imports both sides, so it composes the scan and hands over the result.
+    //
+    // Paths are made relative to the project root here, where `cwd` is known: that string is both
+    // the emitted import specifier and the key the executor looks a module up by, and the scanners
+    // return absolute paths.
+    scanRoutes: (serverDir) => {
+      const abs = resolve(cwd, serverDir);
+      const toProjectRelative = (p) => relative(cwd, p).split(sep2).join("/");
+      return {
+        routes: scanServerRoutes(abs).map((route) => ({
+          filePath: toProjectRelative(route.filePath),
+          routePath: route.routePath,
+          methods: route.methods ?? []
+        })),
+        wsRoutes: scanWebSocketRoutes(abs).map(
+          (ws) => toProjectRelative(typeof ws === "string" ? ws : ws.filePath)
+        ),
+        // #367 — agents are a DIFFERENT scan served by a DIFFERENT function, which is why no
+        // adapter had ever heard of them: the entries route `/api/` through `scanServerRoutes` +
+        // `executeRoute` alone, so `/api/agents/<name>` matched nothing and 404'd on every target.
+        // Scanned here, beside the routes, because the same inversion argument applies verbatim.
+        agents: scanAgents(dirname2(abs), config.agentsDir).map((agent) => ({
+          filePath: toProjectRelative(agent.filePath),
+          agentPath: agent.agentPath,
+          name: agent.name
+        }))
+      };
+    }
   };
-  const { resolveAdapter } = await import("./registry-S7OMF3OS.js");
+  const { resolveAdapter } = await import("./registry-KBZDCFVQ.js");
   const adapter = await resolveAdapter(target);
+  const { warnUnappliedConfig } = await import("./config-support-WQHQIJTA.js");
+  warnUnappliedConfig(config, adapter, target, (message) => {
+    console.log(message);
+  });
   await adapter.build(config, cwd, ctx);
 }
 async function emitCronArtifacts(opts) {
@@ -629,4 +675,4 @@ function relativize3(absPath, root) {
 export {
   buildCommand
 };
-//# sourceMappingURL=build-F2Q5QTSC.js.map
+//# sourceMappingURL=build-VZODSYIQ.js.map