theokit 0.55.0 → 0.56.0

package/dist/{actions-virtual-module-TZFLCIIR.js → actions-virtual-module-3V7VG2YL.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import "tsx/esm";
-import "./chunk-DADMEW4G.js";
-import "./chunk-5YPXXSYY.js";
+import "./chunk-22ZZSUKD.js";
+import "./chunk-35QIWOHT.js";
 import "./chunk-MWWFXYW3.js";
 import "./chunk-RPET332G.js";
 import "./chunk-5VLP3GQ2.js";
@@ -218,4 +218,4 @@ export const actions = manifest
 export {
   actionsVirtualModule
 };
-//# sourceMappingURL=actions-virtual-module-TZFLCIIR.js.map
+//# sourceMappingURL=actions-virtual-module-3V7VG2YL.js.map

package/dist/{actions-virtual-module-PREAJNIS.js → actions-virtual-module-KJBCM7PP.js}

@@ -1,41 +1,41 @@
-import "./chunk-3DRALT3J.js";
-import "./chunk-WX6NHGKS.js";
-import "./chunk-ITSNTHWN.js";
+import "./chunk-XYVZJCZU.js";
+import "./chunk-M357ILK5.js";
+import "./chunk-BPYMC7SU.js";
+import "./chunk-IRQGAC4L.js";
+import "./chunk-JW5UFKQ3.js";
+import "./chunk-P6OS7652.js";
 import "./chunk-ZDUO4IYN.js";
+import "./chunk-D4VP2QPR.js";
+import "./chunk-YN4W7LCX.js";
 import "./chunk-47FFT43U.js";
 import "./chunk-NTDN54XO.js";
-import "./chunk-2OEN3YTE.js";
-import "./chunk-BND4YZTQ.js";
+import "./chunk-PVNMLZ5G.js";
+import "./chunk-ZDCCILMP.js";
 import "./chunk-CHTAWXC2.js";
+import "./chunk-AVQU5CQF.js";
 import "./chunk-VSLTKX5L.js";
 import "./chunk-TNI4MARH.js";
-import "./chunk-OQCRCXCP.js";
+import "./chunk-4ERYQBL6.js";
 import {
   scanServerActionsEnriched
-} from "./chunk-I2UN46ZX.js";
+} from "./chunk-XJOU425Y.js";
+import "./chunk-KDP2HURW.js";
 import "./chunk-DV34VG3N.js";
-import "./chunk-IRASEXOG.js";
-import "./chunk-BX6EUYHU.js";
-import "./chunk-BPYMC7SU.js";
-import "./chunk-IRQGAC4L.js";
-import "./chunk-P6OS7652.js";
-import "./chunk-AVQU5CQF.js";
+import "./chunk-V6Y2SMRG.js";
 import "./chunk-ACKBVBUI.js";
 import "./chunk-IZ3TIL6K.js";
-import "./chunk-3PBAN2YE.js";
+import "./chunk-CF2DNN5R.js";
 import "./chunk-YSJOZEI6.js";
 import "./chunk-Z4PJMZLM.js";
 import "./chunk-UMNXCU3K.js";
-import "./chunk-52PDWL5S.js";
-import "./chunk-5K4TDLRG.js";
+import "./chunk-5KRMDP46.js";
+import "./chunk-SOYOYGWY.js";
 import "./chunk-ZWN3AODA.js";
-import "./chunk-D4VP2QPR.js";
-import "./chunk-YN4W7LCX.js";
 import "./chunk-XTHN6JBX.js";
 
 // src/vite-plugin/actions-virtual-module.ts
-import { existsSync, mkdirSync, renameSync, watch as fsWatch, writeFileSync } from "fs";
-import { dirname, join, posix, resolve } from "path";
+import { existsSync, mkdirSync, renameSync, watch as fsWatch, writeFileSync } from "node:fs";
+import { dirname, join, posix, resolve } from "node:path";
 var VIRTUAL_ID = "@theo/actions";
 var RESOLVED_ID = `\0${VIRTUAL_ID}`;
 function actionsVirtualModule(opts) {
@@ -234,4 +234,4 @@ export const actions = manifest
 export {
   actionsVirtualModule
 };
-//# sourceMappingURL=actions-virtual-module-PREAJNIS.js.map
+//# sourceMappingURL=actions-virtual-module-KJBCM7PP.js.map

package/dist/adapters/agent-mount.d.ts

@@ -1,6 +1,6 @@
 import { a as RouteSubject, R as RoutePolicy } from '../route-policy-BxOycCDq.js';
 import { C as CsrfMode } from '../csrf-Dgot9qSM.js';
-export { r as resolveProvider } from '../provider-resolver-Dx6QuWrw.js';
+export { r as resolveProvider } from '../provider-resolver-VS61zqsw.js';
 export { s as scanAgents } from '../agent-scan-BZa-pagG.js';
 import 'node:http';
 import '../audit-log-BQWM5YLG.js';

package/dist/adapters/agent-mount.js

@@ -1,21 +1,21 @@
 import {
   mountAgent
-} from "../chunk-WX6NHGKS.js";
-import "../chunk-2OEN3YTE.js";
-import "../chunk-BND4YZTQ.js";
+} from "../chunk-M357ILK5.js";
+import "../chunk-P6OS7652.js";
+import "../chunk-YN4W7LCX.js";
+import "../chunk-PVNMLZ5G.js";
+import "../chunk-ZDCCILMP.js";
 import "../chunk-CHTAWXC2.js";
+import "../chunk-AVQU5CQF.js";
 import {
   scanAgents
-} from "../chunk-IRASEXOG.js";
-import "../chunk-P6OS7652.js";
-import "../chunk-AVQU5CQF.js";
+} from "../chunk-KDP2HURW.js";
 import {
   resolveProvider
-} from "../chunk-3PBAN2YE.js";
+} from "../chunk-CF2DNN5R.js";
 import "../chunk-UMNXCU3K.js";
-import "../chunk-5K4TDLRG.js";
+import "../chunk-SOYOYGWY.js";
 import "../chunk-ZWN3AODA.js";
-import "../chunk-YN4W7LCX.js";
 import "../chunk-XTHN6JBX.js";
 export {
   mountAgent,

package/dist/{agent-2AELELAC.js → agent-NLG77PFN.js}

@@ -3,8 +3,8 @@ import "tsx/esm";
 import {
   agentCommand,
   createAgentSsrLoader
-} from "./chunk-2PSKQWGM.js";
-import "./chunk-5YPXXSYY.js";
+} from "./chunk-TUO2FE3S.js";
+import "./chunk-35QIWOHT.js";
 import "./chunk-5NNFO7R7.js";
 import "./chunk-Z7CJHDLS.js";
 import "./chunk-3QPVEJ7D.js";
@@ -12,4 +12,4 @@ export {
   agentCommand,
   createAgentSsrLoader
 };
-//# sourceMappingURL=agent-2AELELAC.js.map
+//# sourceMappingURL=agent-NLG77PFN.js.map

package/dist/{agents-typed-client-INR2E7B3.js → agents-typed-client-PVUZU65B.js}

@@ -1,8 +1,8 @@
 import "./chunk-XTHN6JBX.js";
 
 // src/vite-plugin/agents-typed-client.ts
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
-import { dirname, posix } from "path";
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, posix } from "node:path";
 var FILE_HEADER = `// AUTO-GENERATED by theokit \u2014 do not edit.
 // Source: theokit/packages/theo/src/vite-plugin/agents-typed-client.ts (M2).
 // To refresh: \`pnpm dev\` or \`pnpm build\` regenerates this on every agents/ change.
@@ -181,4 +181,4 @@ export {
   generateAgentsRuntimeModule,
   handleIdentifier
 };
-//# sourceMappingURL=agents-typed-client-INR2E7B3.js.map
+//# sourceMappingURL=agents-typed-client-PVUZU65B.js.map

package/dist/{app-typed-client-KSFGMOQ6.js → app-typed-client-XSXAORG6.js}

@@ -1,45 +1,45 @@
 import {
   scanControllerModules
-} from "./chunk-3DRALT3J.js";
-import "./chunk-WX6NHGKS.js";
-import "./chunk-ITSNTHWN.js";
+} from "./chunk-XYVZJCZU.js";
+import "./chunk-M357ILK5.js";
+import "./chunk-BPYMC7SU.js";
+import "./chunk-IRQGAC4L.js";
+import "./chunk-JW5UFKQ3.js";
+import "./chunk-P6OS7652.js";
 import "./chunk-ZDUO4IYN.js";
+import "./chunk-D4VP2QPR.js";
+import "./chunk-YN4W7LCX.js";
 import "./chunk-47FFT43U.js";
 import "./chunk-NTDN54XO.js";
-import "./chunk-2OEN3YTE.js";
-import "./chunk-BND4YZTQ.js";
+import "./chunk-PVNMLZ5G.js";
+import "./chunk-ZDCCILMP.js";
 import "./chunk-CHTAWXC2.js";
+import "./chunk-AVQU5CQF.js";
 import "./chunk-VSLTKX5L.js";
 import "./chunk-TNI4MARH.js";
-import "./chunk-OQCRCXCP.js";
+import "./chunk-4ERYQBL6.js";
 import {
   generateManifest
-} from "./chunk-I2UN46ZX.js";
+} from "./chunk-XJOU425Y.js";
+import "./chunk-KDP2HURW.js";
 import {
   HTTP_METHODS
 } from "./chunk-DV34VG3N.js";
-import "./chunk-IRASEXOG.js";
-import "./chunk-BX6EUYHU.js";
-import "./chunk-BPYMC7SU.js";
-import "./chunk-IRQGAC4L.js";
-import "./chunk-P6OS7652.js";
-import "./chunk-AVQU5CQF.js";
+import "./chunk-V6Y2SMRG.js";
 import "./chunk-ACKBVBUI.js";
 import "./chunk-IZ3TIL6K.js";
-import "./chunk-3PBAN2YE.js";
+import "./chunk-CF2DNN5R.js";
 import "./chunk-YSJOZEI6.js";
 import "./chunk-Z4PJMZLM.js";
 import "./chunk-UMNXCU3K.js";
-import "./chunk-52PDWL5S.js";
-import "./chunk-5K4TDLRG.js";
+import "./chunk-5KRMDP46.js";
+import "./chunk-SOYOYGWY.js";
 import "./chunk-ZWN3AODA.js";
-import "./chunk-D4VP2QPR.js";
-import "./chunk-YN4W7LCX.js";
 import "./chunk-XTHN6JBX.js";
 
 // src/vite-plugin/app-typed-client.ts
-import { mkdirSync, readFileSync, renameSync, writeFileSync, existsSync } from "fs";
-import { dirname, isAbsolute, posix, relative, resolve } from "path";
+import { mkdirSync, readFileSync, renameSync, writeFileSync, existsSync } from "node:fs";
+import { dirname, isAbsolute, posix, relative, resolve } from "node:path";
 
 // src/vite-plugin/controller-client-emit.ts
 import { loadControllerWithSwc, walkControllerMetadata } from "@theokit/http";
@@ -427,4 +427,4 @@ export {
   generateClientDts,
   shouldReemitForFile
 };
-//# sourceMappingURL=app-typed-client-KSFGMOQ6.js.map
+//# sourceMappingURL=app-typed-client-XSXAORG6.js.map

package/dist/{app-typed-client-NEKRXPAQ.js → app-typed-client-ZO3VKJ3O.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import "tsx/esm";
-import "./chunk-DADMEW4G.js";
-import "./chunk-5YPXXSYY.js";
+import "./chunk-22ZZSUKD.js";
+import "./chunk-35QIWOHT.js";
 import {
   scanControllerModules
 } from "./chunk-MWWFXYW3.js";
@@ -411,4 +411,4 @@ export {
   generateClientDts,
   shouldReemitForFile
 };
-//# sourceMappingURL=app-typed-client-NEKRXPAQ.js.map
+//# sourceMappingURL=app-typed-client-ZO3VKJ3O.js.map

package/dist/boot/index.js

@@ -1,3 +1,6 @@
+import {
+  serveReservedRoute
+} from "../chunk-GAPBPRPP.js";
 import {
   envelopeCodeToStatus
 } from "../chunk-ACKBVBUI.js";
@@ -5,9 +8,6 @@ import {
   NotFoundError,
   serverErrorToEnvelope
 } from "../chunk-IZ3TIL6K.js";
-import {
-  serveReservedRoute
-} from "../chunk-GAPBPRPP.js";
 import "../chunk-XTHN6JBX.js";
 
 // src/server/boot.ts

package/dist/{build-ESSQS5F5.js → build-4GQLIFTD.js}

@@ -554,7 +554,7 @@ async function buildCommand(options) {
 `);
 }
 async function runAdapterBuild(target, config, cwd) {
-  const { theoPluginAsync } = await import("./vite-plugin-5O3D472R.js");
+  const { theoPluginAsync } = await import("./vite-plugin-UET2BUFW.js");
   const { default: react } = await import("@vitejs/plugin-react");
   const ctx = {
     // `react()` may return Plugin or Plugin[] depending on version; spread the
@@ -603,7 +603,7 @@ async function runAdapterBuild(target, config, cwd) {
       };
     }
   };
-  const { resolveAdapter } = await import("./registry-KBZDCFVQ.js");
+  const { resolveAdapter } = await import("./registry-3LUHO4IB.js");
   const adapter = await resolveAdapter(target);
   const { warnUnappliedConfig, assertRateLimitEnforceable } = await import("./config-support-O4REYSK5.js");
   assertRateLimitEnforceable(config, adapter, target);
@@ -676,4 +676,4 @@ function relativize3(absPath, root) {
 export {
   buildCommand
 };
-//# sourceMappingURL=build-ESSQS5F5.js.map
+//# sourceMappingURL=build-4GQLIFTD.js.map

package/dist/{bun-L7PP6ID5.js → bun-POLTY2HK.js}

@@ -24,6 +24,107 @@ import {
 // src/adapters/bun.ts
 import { mkdirSync, writeFileSync } from "fs";
 import { resolve } from "path";
+
+// src/adapters/deployed-rate-limit.ts
+var UnserialisableRateLimitError = class extends Error {
+  constructor(target, reason, ways) {
+    super(
+      [
+        `Refusing to build for \`${target}\`: theo.config.ts declares a rate limit this target cannot carry.`,
+        ``,
+        `  ${reason}`,
+        ``,
+        `  Ways forward:`,
+        ...ways.map((w) => `    \u2022 ${w}`),
+        ``,
+        `  This refuses rather than dropping the key, because a rate limit that silently does not`,
+        `  apply looks exactly like one that does (usetheokit/theokit#461, #508).`
+      ].join("\n")
+    );
+    this.target = target;
+    this.reason = reason;
+  }
+  target;
+  reason;
+  name = "UnserialisableRateLimitError";
+};
+function bakeableRateLimit(rateLimit, target) {
+  if (rateLimit === void 0) return void 0;
+  const cfg = rateLimit;
+  if (typeof cfg.keyBy === "function") {
+    throw new UnserialisableRateLimitError(
+      target,
+      "`security.rateLimit.keyBy` is a function, and a deployed entry has no literal for a closure.",
+      [
+        "use `keyBy: 'ip'` (the default), which this target resolves from the connection",
+        "build for `node` and run `theokit start`, which can call the function"
+      ]
+    );
+  }
+  if (cfg.keyBy === "session" || cfg.keyBy === "user") {
+    throw new UnserialisableRateLimitError(
+      target,
+      `\`security.rateLimit.keyBy: '${cfg.keyBy}'\` needs a resolved session, and the limit runs before routing.`,
+      [
+        "use `keyBy: 'ip'`, which is resolvable at that point",
+        "build for `node` and run `theokit start`"
+      ]
+    );
+  }
+  if (cfg.routes !== void 0) {
+    throw new UnserialisableRateLimitError(
+      target,
+      "`security.rateLimit.routes` needs the matched route, which is decided after the limit runs here.",
+      [
+        "declare a single global limit (`windowMs` + `max`)",
+        "build for `node` and run `theokit start`, which applies per-route limits"
+      ]
+    );
+  }
+  const windowMs = cfg.windowMs;
+  const max = cfg.max;
+  if (typeof windowMs !== "number" || typeof max !== "number") return void 0;
+  return { windowMs, max };
+}
+function deployedRateLimitFragment(rateLimit, target, addressExpression) {
+  const baked = bakeableRateLimit(rateLimit, target);
+  if (baked === void 0) return [];
+  return [
+    `// #508 \u2014 the limit the app declared, carried as a literal because a deployed entry has no`,
+    `// theo.config.ts to read. The counter lives in this process, which outlives a request here.`,
+    `const RATE_LIMIT = createRateLimiterWeb({ windowMs: ${baked.windowMs}, max: ${baked.max} })`,
+    ``,
+    `/**`,
+    ` * The caller's address, from the connection rather than from a header.`,
+    ` *`,
+    ` * A header a client can set is a key a client can choose, which makes the bucket theirs to`,
+    ` * split. An unresolved address falls back to one shared bucket \u2014 rare here, since that only`,
+    ` * happens for a connection already gone, and the same fallback \`theokit start\` uses.`,
+    ` */`,
+    `function callerAddress(request, server) {`,
+    `  return ${addressExpression} ?? 'unknown'`,
+    `}`,
+    ``,
+    `/** The 429 a limited caller gets, carrying the limiter's own headers. */`,
+    `function rateLimited(result) {`,
+    `  return new Response(JSON.stringify({ error: { code: 'RATE_LIMITED', message: 'Too many requests' } }), {`,
+    `    status: 429,`,
+    `    headers: { 'Content-Type': 'application/json', ...result.headers },`,
+    `  })`,
+    `}`
+  ];
+}
+function rateLimitCheckFragment(rateLimit, indent) {
+  if (rateLimit === void 0) return [];
+  return [
+    `${indent}const limit = RATE_LIMIT(callerAddress(request, server))`,
+    `${indent}if (limit.limited) {`,
+    `${indent}  return withCors(request, withSecurityHeaders(rateLimited(limit), SECURITY_HEADERS))`,
+    `${indent}}`
+  ];
+}
+
+// src/adapters/bun.ts
 function renderBunEntry(port, opts = {}) {
   const streamingComment = opts.ssrStreaming ? `// T2.3 \u2014 ssrStreaming on; renderStreamingWeb may be consumed by app code` : `// (ssrStreaming off)`;
   const runtimeConfig = deployedRuntimeConfigFragment(opts);
@@ -58,7 +159,7 @@ function renderBunEntry(port, opts = {}) {
     ``,
     `import { resolve, join } from 'node:path'`,
     `import { existsSync } from 'node:fs'`,
-    `import { scanServerRoutes, matchRoute, executeRoute, createProductionLoader, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler } from 'theokit/server'`,
+    `import { scanServerRoutes, matchRoute, executeRoute, createProductionLoader, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler${opts.rateLimit === void 0 ? "" : ", createRateLimiterWeb"} } from 'theokit/server'`,
     `import { createWebShim } from 'theokit/adapters/web-shim'`,
     `import { buildSecurityHeaders, withSecurityHeaders } from 'theokit/adapters/security-headers'`,
     `// T3.2 \u2014 WS bridge for Bun runtime`,
@@ -87,6 +188,8 @@ function renderBunEntry(port, opts = {}) {
     ``,
     ...deployedCorsFragment(opts.cors, "bun"),
     ``,
+    ...deployedRateLimitFragment(opts.rateLimit, "bun", "server.requestIP(request)?.address"),
+    ``,
     `const routes = existsSync(serverDir) ? scanServerRoutes(serverDir) : []`,
     `const wsRoutes = existsSync(serverDir) ? scanWebSocketRoutes(serverDir) : []`,
     `const loadModule = createProductionLoader()`,
@@ -117,6 +220,7 @@ function renderBunEntry(port, opts = {}) {
     `    // handles is an OPTIONS the browser never gets a CORS answer to.`,
     `    const preflight = corsPreflight(request)`,
     `    if (preflight !== null) return withSecurityHeaders(preflight, SECURITY_HEADERS)`,
+    ...rateLimitCheckFragment(opts.rateLimit, "    "),
     `    return withCors(request, withSecurityHeaders(await handleRequest(request), SECURITY_HEADERS))`,
     `  },`,
     `})`,
@@ -218,7 +322,18 @@ var bunAdapter = {
   // literal and puts the built baseline on every response, the served document
   // included.
   servesAgents: true,
-  appliesConfig: ["securityHeaders", "csrf", "disallowed", "cors", "serialization", "plugins"],
+  appliesConfig: [
+    "securityHeaders",
+    "csrf",
+    "disallowed",
+    "cors",
+    "serialization",
+    "plugins",
+    // #508 — bun is the first Web target to ENFORCE a declared limit rather than refuse the
+    // build: `Bun.serve` is long-lived, so the in-process counter survives, and its handler
+    // already receives `server`, whose `requestIP` gives the peer address without a header.
+    "rateLimit"
+  ],
   build(config, cwd, ctx) {
     return buildBun(config, cwd, {}, ctx);
   }
@@ -228,4 +343,4 @@ export {
   bunAdapter,
   renderBunEntry
 };
-//# sourceMappingURL=bun-L7PP6ID5.js.map
+//# sourceMappingURL=bun-POLTY2HK.js.map

package/dist/bun-POLTY2HK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapters/bun.ts","../src/adapters/deployed-rate-limit.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Bun deploy adapter. Writes to `cwd/.theokit/bun/`. Build-time.\n */\nimport { mkdirSync, writeFileSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nimport type { TheoConfig } from '../config/schema.js'\nimport type { SecurityHeadersConfig } from '../core/contracts/security-headers.js'\nimport { assertServicesUnsupported, readManifest } from '../services/index.js'\n\nimport { deployedAgentsFragment } from './deployed-agents.js'\nimport { deployedCorsFragment, type DeployedCorsOptions } from './deployed-cors.js'\nimport { deployedCsrfFragment, type DeployedCsrfOptions } from './deployed-csrf.js'\nimport { planDeployedPlugins } from './deployed-plugins-module.js'\nimport {\n  deployedRateLimitFragment,\n  rateLimitCheckFragment,\n  type DeployedRateLimitOptions,\n} from './deployed-rate-limit.js'\nimport {\n  deployedRuntimeConfigFragment,\n  type DeployedRuntimeConfigOptions,\n} from './deployed-runtime-config.js'\nimport { deployedTraceFragment } from './deployed-trace.js'\nimport { nodeAdapter } from './node.js'\nimport {\n  describeDeployedSecurityHeaders,\n  renderSecurityHeadersConfigLiteral,\n} from './security-headers.js'\nimport type { AdapterBuildContext, DeployAdapter } from './types.js'\n\nexport interface BunBuildDeps {\n  runNodeBuild?: (config: TheoConfig, cwd: string, ctx?: AdapterBuildContext) => Promise<void>\n  writeEntry?: (path: string, content: string) => void\n  ensureDir?: (path: string) => void\n}\n\nexport function renderBunEntry(\n  port: number,\n  opts: {\n    ssrStreaming?: boolean\n    securityHeaders?: SecurityHeadersConfig\n  } & DeployedCsrfOptions &\n    DeployedRuntimeConfigOptions &\n    DeployedCorsOptions &\n    DeployedRateLimitOptions = {},\n): string {\n  const streamingComment = opts.ssrStreaming\n    ? `// T2.3 — ssrStreaming on; renderStreamingWeb may be consumed by app code`\n    : `// (ssrStreaming off)`\n  const runtimeConfig = deployedRuntimeConfigFragment(opts)\n  const agentsFragment = deployedAgentsFragment(\n    { kind: 'scan', projectRoot: 'cwd', loadModule: 'loadModule' },\n    { pathname: 'pathname' },\n  )\n  return [\n    `// Generated by Theo — Bun Adapter`,\n    `// Run: bun run .theokit/bun/server.mjs`,\n    `// Requires Bun >= 1.1`,\n    streamingComment,\n    ``,\n    `// EC-1: dev-mode guard`,\n    `if (process.env.NODE_ENV !== 'production') {`,\n    `  console.error('TheoBunAdapter is production-only. Use \\\\'theokit dev\\\\' (Node) for development.')`,\n    `  process.exit(1)`,\n    `}`,\n    ``,\n    `// Version check: Bun >= 1.1`,\n    `if (typeof Bun === 'undefined') {`,\n    `  console.error('TheoBunAdapter must run inside Bun. Got Node.js or unknown runtime.')`,\n    `  process.exit(1)`,\n    `}`,\n    `{`,\n    `  const [maj, min] = (Bun.version ?? '0.0').split('.').map(Number)`,\n    `  if (maj < 1 || (maj === 1 && min < 1)) {`,\n    `    console.error('TheoBunAdapter requires Bun >= 1.1; got ' + Bun.version)`,\n    `    process.exit(1)`,\n    `  }`,\n    `}`,\n    ``,\n    `import { resolve, join } from 'node:path'`,\n    `import { existsSync } from 'node:fs'`,\n    `import { scanServerRoutes, matchRoute, executeRoute, createProductionLoader, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler${opts.rateLimit === undefined ? '' : ', createRateLimiterWeb'} } from 'theokit/server'`,\n    `import { createWebShim } from 'theokit/adapters/web-shim'`,\n    `import { buildSecurityHeaders, withSecurityHeaders } from 'theokit/adapters/security-headers'`,\n    `// T3.2 — WS bridge for Bun runtime`,\n    `import { createBunWsBridge } from 'theokit/adapters/ws-shim'`,\n    `import { scanWebSocketRoutes } from 'theokit/server'`,\n    ``,\n    `const cwd = process.cwd()`,\n    `const clientDir = resolve(cwd, '.theokit/client')`,\n    `const serverDir = resolve(cwd, 'server')`,\n    `const port = process.env.PORT ? Number(process.env.PORT) : ${port}`,\n    ``,\n    `// #410 — the security baseline \\`theokit start\\` puts on every response,`,\n    `// carried here as a literal because the deployed process has no`,\n    `// theo.config.ts to read. Bun is the one Web target whose own handler serves`,\n    `// the HTML document (static file + SPA fallback below), so the document gets`,\n    `// these headers too -- with a nonce-less CSP, because that HTML was written`,\n    `// at build time and carries no nonce on its script tags (EC-4).`,\n    `const SECURITY_HEADERS_CONFIG = ${renderSecurityHeadersConfigLiteral(opts.securityHeaders)}`,\n    `const SECURITY_HEADERS = buildSecurityHeaders(SECURITY_HEADERS_CONFIG, { production: true })`,\n    ``,\n    ...runtimeConfig.imports,\n    ...agentsFragment.imports,\n    ...runtimeConfig.declarations,\n    ...agentsFragment.declarations,\n    ...deployedCsrfFragment(opts),\n    ``,\n    ...deployedCorsFragment(opts.cors, 'bun'),\n    ``,\n    ...deployedRateLimitFragment(opts.rateLimit, 'bun', 'server.requestIP(request)?.address'),\n    ``,\n    `const routes = existsSync(serverDir) ? scanServerRoutes(serverDir) : []`,\n    `const wsRoutes = existsSync(serverDir) ? scanWebSocketRoutes(serverDir) : []`,\n    `const loadModule = createProductionLoader()`,\n    ``,\n    `// Bun WebSocket config — single handler dispatches to first ws route,`,\n    `// or a default no-op when none declared. Per-route routing happens above`,\n    `// (the upgrade decision is made in fetch handler before Bun.serve hands off).`,\n    `const wsBridge = wsRoutes.length > 0`,\n    `  ? createBunWsBridge({`,\n    `      onOpen: () => {},`,\n    `      onMessage: (ws, data) => { ws.send(data) },`,\n    `      onClose: () => {},`,\n    `    })`,\n    `  : { open: () => {}, message: () => {}, close: () => {} }`,\n    ``,\n    `function notFoundResponse() {`,\n    `  return new Response(JSON.stringify({ error: { code: 'NOT_FOUND', message: 'Route not found' } }), {`,\n    `    status: 404,`,\n    `    headers: { 'Content-Type': 'application/json' },`,\n    `  })`,\n    `}`,\n    ``,\n    `Bun.serve({`,\n    `  port,`,\n    `  websocket: wsBridge,`,\n    `  async fetch(request, server) {`,\n    `    // #409 — the preflight is answered BEFORE anything routes: an OPTIONS the router`,\n    `    // handles is an OPTIONS the browser never gets a CORS answer to.`,\n    `    const preflight = corsPreflight(request)`,\n    `    if (preflight !== null) return withSecurityHeaders(preflight, SECURITY_HEADERS)`,\n    ...rateLimitCheckFragment(opts.rateLimit, '    '),\n    `    return withCors(request, withSecurityHeaders(await handleRequest(request), SECURITY_HEADERS))`,\n    `  },`,\n    `})`,\n    ``,\n    ...bunHandleRequestFragment(runtimeConfig.executeRouteSpread, agentsFragment.branch),\n  ].join('\\n')\n}\n\n/**\n * The request handler, as generated source.\n *\n * Extracted for the reason `vercel.ts` extracts its own fragments: the emitter is one array\n * literal, so every line the entry gains counts against `max-lines-per-function`, and #410 added\n * the CSRF literal to an emitter that was already sitting exactly at the ceiling.\n */\nfunction bunHandleRequestFragment(runtimeSpread: string, agentBranch: readonly string[]): string[] {\n  return [\n    `async function handleRequest(request) {`,\n    `    const url = new URL(request.url)`,\n    `    const pathname = url.pathname`,\n    ``,\n    `    // 1) Static assets`,\n    `    const staticPath = pathname === '/' ? '/index.html' : pathname`,\n    `    const fullStatic = join(clientDir, staticPath)`,\n    `    if (existsSync(fullStatic)) {`,\n    `      const file = Bun.file(fullStatic)`,\n    `      if (await file.exists()) return new Response(file)`,\n    `    }`,\n    ``,\n    `    // 2) API routes through the full executeRoute pipeline via the shim`,\n    `    if (pathname.startsWith('/api/')) {`,\n    ...agentBranch,\n    ``,\n    `      const match = matchRoute(pathname, routes)`,\n    `      if (!match) return notFoundResponse()`,\n    `      const { req, res, toResponse } = createWebShim(request)`,\n    ...deployedTraceFragment('request', '      '),\n    `      const method = request.method.toUpperCase()`,\n    `      // #382 — not awaited: toResponse() settles at the headers and carries`,\n    `      // a live body, so Bun.serve streams while the handler writes.`,\n    `      return toResponse(executeRoute({ route: match.route, method, params: match.params, req, res, loadModule, serverDir, requestId, ...CSRF_CONFIG, ${runtimeSpread} }))`,\n    `    }`,\n    ``,\n    `    // 3) SPA fallback`,\n    `    const indexPath = join(clientDir, 'index.html')`,\n    `    if (existsSync(indexPath)) return new Response(Bun.file(indexPath))`,\n    ``,\n    `    return notFoundResponse()`,\n    `}`,\n    ``,\n    `console.log('Theo (Bun) listening on http://localhost:' + port)`,\n  ]\n}\n\nexport async function buildBun(\n  config: TheoConfig,\n  cwd: string,\n  deps: BunBuildDeps = {},\n  ctx?: AdapterBuildContext,\n): Promise<void> {\n  // Wave 2 (T2.2) — reject polyglot services on this adapter.\n  assertServicesUnsupported('bun', readManifest(cwd))\n\n  const runNodeBuild = deps.runNodeBuild ?? nodeAdapter.build.bind(nodeAdapter)\n  await runNodeBuild(config, cwd, ctx)\n\n  const outputDir = resolve(cwd, '.theokit/bun')\n  const ensureDir = deps.ensureDir ?? ((p: string) => mkdirSync(p, { recursive: true }))\n  ensureDir(outputDir)\n\n  const pluginsPlan = planDeployedPlugins(config.plugins, 'bun')\n  const entry = renderBunEntry(config.port, {\n    ssrStreaming: config.ssrStreaming,\n    securityHeaders: config.security?.headers,\n    csrf: config.security?.csrf,\n    disallowed: config.security?.disallowed,\n    cors: config.security?.cors,\n    // #425 — a selector, not a transformer, so it rides as a literal like the values above.\n    serialization: config.serialization,\n    // #425 — the ONE concern that is not a literal. A closure cannot be baked, so a plugin\n    // declared by module specifier is imported by the emitted module instead; a constructed one\n    // is refused by name at build time rather than dropped in silence.\n    runtimeConfigModule: pluginsPlan?.moduleSpecifier,\n  })\n  const write =\n    deps.writeEntry ??\n    ((p, c) => {\n      writeFileSync(p, c)\n    })\n  if (pluginsPlan !== undefined) {\n    // Beside the entry, so the emitted import is a sibling. Written through the same seam as\n    // the entry so a test that captures one captures both (#425).\n    write(resolve(outputDir, 'theo.plugins.mjs'), pluginsPlan.source)\n  }\n  write(resolve(outputDir, 'server.mjs'), entry)\n\n  // eslint-disable-next-line no-console -- CLI build progress\n  console.log('\\n  ✓ Bun output → .theokit/bun/server.mjs')\n  // eslint-disable-next-line no-console -- CLI build progress\n  console.log(\n    `${describeDeployedSecurityHeaders({\n      target: 'bun',\n      securityHeaders: config.security?.headers,\n      // No deploy target other than the streamed Cloudflare worker renders HTML\n      // at request time, so none of the rest can mint a nonce.\n      mintsNonce: false,\n      // Bun serves `.theokit/client` itself, so the document DOES pass through\n      // the handler these headers are attached to.\n      documentHeaders: 'handler',\n    })}\\n`,\n  )\n}\n\nexport const bunAdapter: DeployAdapter = {\n  name: 'bun',\n  streamsResponses: true,\n  // #409 / #410 — the generated entry calls `executeRoute` with routes, loader\n  // and serverDir only. CSRF, route policy, file middleware and Zod validation\n  // still run because they live inside `executeRoute`; none of the remaining\n  // configurable concerns reach it. Declared explicitly rather than omitted so\n  // the gap is a statement in the source and not an absence.\n  //\n  // `securityHeaders` IS applied: the entry carries `security.headers` as a\n  // literal and puts the built baseline on every response, the served document\n  // included.\n  servesAgents: true,\n  appliesConfig: [\n    'securityHeaders',\n    'csrf',\n    'disallowed',\n    'cors',\n    'serialization',\n    'plugins',\n    // #508 — bun is the first Web target to ENFORCE a declared limit rather than refuse the\n    // build: `Bun.serve` is long-lived, so the in-process counter survives, and its handler\n    // already receives `server`, whose `requestIP` gives the peer address without a header.\n    'rateLimit',\n  ],\n  build(config, cwd, ctx) {\n    return buildBun(config, cwd, {}, ctx)\n  },\n}\n","/**\n * The rate limit a deployed entry carries, baked at build time.\n *\n * ## What #508 asked for, and what this answers\n *\n * `theokit build` refuses the six Web-standards targets when `theo.config.ts` declares a\n * `rateLimit` (`UnenforceableRateLimitError`). That refusal is honest and it is not enforcement.\n * The issue names three things standing between the refusal and a working limit: per-runtime\n * caller-address resolution, a refusal that survives where the address cannot be resolved, and\n * storage that outlives one invocation.\n *\n * For `bun` all three already have answers, which is why it is the target that moves first:\n *\n * - **Address** — `Bun.serve`'s handler is `fetch(request, server)`, and `server.requestIP(request)`\n *   returns the peer address without depending on a proxy header a client could set.\n * - **Storage** — `Bun.serve` is a long-lived process. `createRateLimiterWeb`'s default\n *   `InMemoryStore` therefore behaves exactly as it does under `theokit start`, which is the\n *   deployment `node` already ships.\n * - **Refusal** — see below: every shape whose key cannot be resolved in a deployed entry throws\n *   at BUILD time rather than degrading.\n *\n * ## Why the other five are not here\n *\n * Cloudflare, AWS Lambda, Netlify and Vercel are per-invocation runtimes: an in-process counter\n * does not survive between requests, so a limiter built on one forgets. A limit that forgets is a\n * limit that does not limit — the same class of failure as the shared bucket, reached by a\n * different road. Deno Deploy evicts isolates for the same reason. Those need an external counter,\n * which is a storage design and not a wiring change, so they keep refusing by name.\n *\n * Being explicit about that boundary is the point. The failure this whole area exists to prevent is\n * a config that reads as protection while protecting nothing.\n */\nimport type { TheoConfig } from '../config/schema.js'\n\ntype RateLimitConfig = NonNullable<TheoConfig['rateLimit']>\n\n/** The rate-limit slice of an adapter's build options, named once like `DeployedCorsOptions`. */\nexport interface DeployedRateLimitOptions {\n  rateLimit?: RateLimitConfig\n}\n\n/**\n * Thrown at BUILD time when a declared rate limit cannot be carried into a deployed entry.\n *\n * Distinct from {@link UnenforceableRateLimitError}, and the distinction is not cosmetic: that one\n * means *this target enforces no limit at all*, this one means *this target enforces limits, and\n * cannot carry THIS one*. An operator reading the first looks for another target; an operator\n * reading the second changes the key.\n */\nexport class UnserialisableRateLimitError extends Error {\n  override readonly name = 'UnserialisableRateLimitError'\n  constructor(\n    readonly target: string,\n    readonly reason: string,\n    ways: readonly string[],\n  ) {\n    super(\n      [\n        `Refusing to build for \\`${target}\\`: theo.config.ts declares a rate limit this target cannot carry.`,\n        ``,\n        `  ${reason}`,\n        ``,\n        `  Ways forward:`,\n        ...ways.map((w) => `    • ${w}`),\n        ``,\n        `  This refuses rather than dropping the key, because a rate limit that silently does not`,\n        `  apply looks exactly like one that does (usetheokit/theokit#461, #508).`,\n      ].join('\\n'),\n    )\n  }\n}\n\n/** The base shape every accepted config narrows to: a window, a ceiling, and an IP key. */\ninterface BakeableRateLimit {\n  windowMs: number\n  max: number\n}\n\n/**\n * Narrow a declared rate limit to what a deployed entry can actually enforce, or refuse by name.\n *\n * Accepts the base `{ windowMs, max }` and the explicit `keyBy: 'ip'`, which is what the address\n * resolution below can key. Everything else throws:\n *\n * - a **function** `keyBy` has no literal — the same wall `deployed-cors.ts` hits on a callback\n *   origin, and refused for the same reason;\n * - `keyBy: 'session' | 'user'` needs a session the deployed entry does not resolve at the point\n *   the limit runs, which is before routing;\n * - `routes` needs the matched route, decided after this check. Refusing it is honest today and is\n *   the natural next slice.\n */\nfunction bakeableRateLimit(\n  rateLimit: RateLimitConfig | undefined,\n  target: string,\n): BakeableRateLimit | undefined {\n  if (rateLimit === undefined) return undefined\n  const cfg = rateLimit as Record<string, unknown>\n\n  if (typeof cfg.keyBy === 'function') {\n    throw new UnserialisableRateLimitError(\n      target,\n      '`security.rateLimit.keyBy` is a function, and a deployed entry has no literal for a closure.',\n      [\n        \"use `keyBy: 'ip'` (the default), which this target resolves from the connection\",\n        'build for `node` and run `theokit start`, which can call the function',\n      ],\n    )\n  }\n  if (cfg.keyBy === 'session' || cfg.keyBy === 'user') {\n    throw new UnserialisableRateLimitError(\n      target,\n      `\\`security.rateLimit.keyBy: '${cfg.keyBy}'\\` needs a resolved session, and the limit runs before routing.`,\n      [\n        \"use `keyBy: 'ip'`, which is resolvable at that point\",\n        'build for `node` and run `theokit start`',\n      ],\n    )\n  }\n  if (cfg.routes !== undefined) {\n    throw new UnserialisableRateLimitError(\n      target,\n      '`security.rateLimit.routes` needs the matched route, which is decided after the limit runs here.',\n      [\n        'declare a single global limit (`windowMs` + `max`)',\n        'build for `node` and run `theokit start`, which applies per-route limits',\n      ],\n    )\n  }\n\n  const windowMs = cfg.windowMs\n  const max = cfg.max\n  if (typeof windowMs !== 'number' || typeof max !== 'number') return undefined\n  return { windowMs, max }\n}\n\n/**\n * The generated declarations and helper for a target that keys on the connection's peer address.\n *\n * `addressExpression` is the per-runtime half the issue calls out — the one thing that genuinely\n * differs between targets. Bun passes `server`; a future Deno slice would pass its\n * `ServeHandlerInfo`. Everything else here is shared.\n *\n * Returns `[]` when nothing was declared, so an app without a limit emits no limiter at all rather\n * than an inert one.\n */\nexport function deployedRateLimitFragment(\n  rateLimit: RateLimitConfig | undefined,\n  target: string,\n  addressExpression: string,\n): string[] {\n  const baked = bakeableRateLimit(rateLimit, target)\n  if (baked === undefined) return []\n  return [\n    `// #508 — the limit the app declared, carried as a literal because a deployed entry has no`,\n    `// theo.config.ts to read. The counter lives in this process, which outlives a request here.`,\n    `const RATE_LIMIT = createRateLimiterWeb({ windowMs: ${baked.windowMs}, max: ${baked.max} })`,\n    ``,\n    `/**`,\n    ` * The caller's address, from the connection rather than from a header.`,\n    ` *`,\n    ` * A header a client can set is a key a client can choose, which makes the bucket theirs to`,\n    ` * split. An unresolved address falls back to one shared bucket — rare here, since that only`,\n    ` * happens for a connection already gone, and the same fallback \\`theokit start\\` uses.`,\n    ` */`,\n    `function callerAddress(request, server) {`,\n    `  return ${addressExpression} ?? 'unknown'`,\n    `}`,\n    ``,\n    `/** The 429 a limited caller gets, carrying the limiter's own headers. */`,\n    `function rateLimited(result) {`,\n    `  return new Response(JSON.stringify({ error: { code: 'RATE_LIMITED', message: 'Too many requests' } }), {`,\n    `    status: 429,`,\n    `    headers: { 'Content-Type': 'application/json', ...result.headers },`,\n    `  })`,\n    `}`,\n  ]\n}\n\n/**\n * The check itself, as generated source, placed inside the runtime's request handler.\n *\n * Extracted for the reason `bun.ts` extracts its other fragments: the emitter is one array literal,\n * so every line the entry gains counts against `max-lines-per-function`, and this one pushed it\n * past the ceiling.\n *\n * Runs AFTER the CORS preflight and BEFORE routing: a limited caller should not reach a handler,\n * and a browser still needs its CORS answer to read the 429 as a 429 rather than as a network\n * failure.\n */\nexport function rateLimitCheckFragment(\n  rateLimit: RateLimitConfig | undefined,\n  indent: string,\n): string[] {\n  if (rateLimit === undefined) return []\n  return [\n    `${indent}const limit = RATE_LIMIT(callerAddress(request, server))`,\n    `${indent}if (limit.limited) {`,\n    `${indent}  return withCors(request, withSecurityHeaders(rateLimited(limit), SECURITY_HEADERS))`,\n    `${indent}}`,\n  ]\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAGA,SAAS,WAAW,qBAAqB;AACzC,SAAS,eAAe;;;AC6CjB,IAAM,+BAAN,cAA2C,MAAM;AAAA,EAEtD,YACW,QACA,QACT,MACA;AACA;AAAA,MACE;AAAA,QACE,2BAA2B,MAAM;AAAA,QACjC;AAAA,QACA,KAAK,MAAM;AAAA,QACX;AAAA,QACA;AAAA,QACA,GAAG,KAAK,IAAI,CAAC,MAAM,cAAS,CAAC,EAAE;AAAA,QAC/B;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI;AAAA,IACb;AAhBS;AACA;AAAA,EAgBX;AAAA,EAjBW;AAAA,EACA;AAAA,EAHO,OAAO;AAoB3B;AAqBA,SAAS,kBACP,WACA,QAC+B;AAC/B,MAAI,cAAc,OAAW,QAAO;AACpC,QAAM,MAAM;AAEZ,MAAI,OAAO,IAAI,UAAU,YAAY;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,UAAU,aAAa,IAAI,UAAU,QAAQ;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,MACA,gCAAgC,IAAI,KAAK;AAAA,MACzC;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,QAAW;AAC5B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAW,IAAI;AACrB,QAAM,MAAM,IAAI;AAChB,MAAI,OAAO,aAAa,YAAY,OAAO,QAAQ,SAAU,QAAO;AACpE,SAAO,EAAE,UAAU,IAAI;AACzB;AAYO,SAAS,0BACd,WACA,QACA,mBACU;AACV,QAAM,QAAQ,kBAAkB,WAAW,MAAM;AACjD,MAAI,UAAU,OAAW,QAAO,CAAC;AACjC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,uDAAuD,MAAM,QAAQ,UAAU,MAAM,GAAG;AAAA,IACxF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,iBAAiB;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAaO,SAAS,uBACd,WACA,QACU;AACV,MAAI,cAAc,OAAW,QAAO,CAAC;AACrC,SAAO;AAAA,IACL,GAAG,MAAM;AAAA,IACT,GAAG,MAAM;AAAA,IACT,GAAG,MAAM;AAAA,IACT,GAAG,MAAM;AAAA,EACX;AACF;;;ADnKO,SAAS,eACd,MACA,OAM6B,CAAC,GACtB;AACR,QAAM,mBAAmB,KAAK,eAC1B,mFACA;AACJ,QAAM,gBAAgB,8BAA8B,IAAI;AACxD,QAAM,iBAAiB;AAAA,IACrB,EAAE,MAAM,QAAQ,aAAa,OAAO,YAAY,aAAa;AAAA,IAC7D,EAAE,UAAU,WAAW;AAAA,EACzB;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,6IAA6I,KAAK,cAAc,SAAY,KAAK,wBAAwB;AAAA,IACzM;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,8DAA8D,IAAI;AAAA,IAClE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,mCAAmC,mCAAmC,KAAK,eAAe,CAAC;AAAA,IAC3F;AAAA,IACA;AAAA,IACA,GAAG,cAAc;AAAA,IACjB,GAAG,eAAe;AAAA,IAClB,GAAG,cAAc;AAAA,IACjB,GAAG,eAAe;AAAA,IAClB,GAAG,qBAAqB,IAAI;AAAA,IAC5B;AAAA,IACA,GAAG,qBAAqB,KAAK,MAAM,KAAK;AAAA,IACxC;AAAA,IACA,GAAG,0BAA0B,KAAK,WAAW,OAAO,oCAAoC;AAAA,IACxF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,uBAAuB,KAAK,WAAW,MAAM;AAAA,IAChD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,yBAAyB,cAAc,oBAAoB,eAAe,MAAM;AAAA,EACrF,EAAE,KAAK,IAAI;AACb;AASA,SAAS,yBAAyB,eAAuB,aAA0C;AACjG,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,sBAAsB,WAAW,QAAQ;AAAA,IAC5C;AAAA,IACA;AAAA,IACA;AAAA,IACA,wJAAwJ,aAAa;AAAA,IACrK;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,SACpB,QACA,KACA,OAAqB,CAAC,GACtB,KACe;AAEf,4BAA0B,OAAO,aAAa,GAAG,CAAC;AAElD,QAAM,eAAe,KAAK,gBAAgB,YAAY,MAAM,KAAK,WAAW;AAC5E,QAAM,aAAa,QAAQ,KAAK,GAAG;AAEnC,QAAM,YAAY,QAAQ,KAAK,cAAc;AAC7C,QAAM,YAAY,KAAK,cAAc,CAAC,MAAc,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AACpF,YAAU,SAAS;AAEnB,QAAM,cAAc,oBAAoB,OAAO,SAAS,KAAK;AAC7D,QAAM,QAAQ,eAAe,OAAO,MAAM;AAAA,IACxC,cAAc,OAAO;AAAA,IACrB,iBAAiB,OAAO,UAAU;AAAA,IAClC,MAAM,OAAO,UAAU;AAAA,IACvB,YAAY,OAAO,UAAU;AAAA,IAC7B,MAAM,OAAO,UAAU;AAAA;AAAA,IAEvB,eAAe,OAAO;AAAA;AAAA;AAAA;AAAA,IAItB,qBAAqB,aAAa;AAAA,EACpC,CAAC;AACD,QAAM,QACJ,KAAK,eACJ,CAAC,GAAG,MAAM;AACT,kBAAc,GAAG,CAAC;AAAA,EACpB;AACF,MAAI,gBAAgB,QAAW;AAG7B,UAAM,QAAQ,WAAW,kBAAkB,GAAG,YAAY,MAAM;AAAA,EAClE;AACA,QAAM,QAAQ,WAAW,YAAY,GAAG,KAAK;AAG7C,UAAQ,IAAI,sDAA4C;AAExD,UAAQ;AAAA,IACN,GAAG,gCAAgC;AAAA,MACjC,QAAQ;AAAA,MACR,iBAAiB,OAAO,UAAU;AAAA;AAAA;AAAA,MAGlC,YAAY;AAAA;AAAA;AAAA,MAGZ,iBAAiB;AAAA,IACnB,CAAC,CAAC;AAAA;AAAA,EACJ;AACF;AAEO,IAAM,aAA4B;AAAA,EACvC,MAAM;AAAA,EACN,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUlB,cAAc;AAAA,EACd,eAAe;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAAA;AAAA;AAAA,IAIA;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,KAAK,KAAK;AACtB,WAAO,SAAS,QAAQ,KAAK,CAAC,GAAG,GAAG;AAAA,EACtC;AACF;","names":[]}

package/dist/{chunk-DADMEW4G.js → chunk-22ZZSUKD.js}

@@ -2,7 +2,7 @@
 import "tsx/esm";
 import {
   getApprovalRegistry
-} from "./chunk-5YPXXSYY.js";
+} from "./chunk-35QIWOHT.js";
 import {
   createWebRequestSource,
   dispatchCsrfWarn,
@@ -2616,4 +2616,4 @@ export {
   CsrfReadinessStore,
   applySecurityHeaders
 };
-//# sourceMappingURL=chunk-DADMEW4G.js.map
+//# sourceMappingURL=chunk-22ZZSUKD.js.map

package/dist/{chunk-5YPXXSYY.js → chunk-35QIWOHT.js}

@@ -76,13 +76,14 @@ function declaredPrefixOf(modelId) {
 function takesCredential(desc) {
   return desc.envKey !== void 0;
 }
+var KEYLESS_API_KEY = "local";
 function resolveProvider(modelId, options) {
   const sorted = [...registryOf()].sort((a, b) => a.priority - b.priority);
   const declared = modelId === void 0 ? void 0 : providerOf(modelId, sorted);
   if (declared !== void 0 && modelId !== void 0) {
     if (declared.envKey === void 0) {
       announce(declared, "declared by the model", options);
-      return { name: declared.name, apiKey: "", baseUrl: baseUrlOf(declared) };
+      return { name: declared.name, apiKey: KEYLESS_API_KEY, baseUrl: baseUrlOf(declared) };
     }
     const apiKey = process.env[declared.envKey];
     if (apiKey && apiKey.length > 0) {
@@ -93,6 +94,12 @@ function resolveProvider(modelId, options) {
       `Model "${modelId}" declares provider "${declared.name}", but ${declared.envKey} is not set. Set ${declared.envKey}, or change the model's provider prefix.`
     );
   }
+  const unregisteredPrefix = declared === void 0 ? declaredPrefixOf(modelId) : void 0;
+  if (unregisteredPrefix !== void 0) {
+    throw new Error(
+      `Model "${String(modelId)}" declares provider "${unregisteredPrefix}", which is not registered. Registered providers: ${sorted.map((p) => p.name).join(", ")}. Register it with registerProvider({ name: '${unregisteredPrefix}', \u2026 }), or use a registered prefix.`
+    );
+  }
   const credentialed = sorted.filter(takesCredential);
   for (const desc of credentialed) {
     const apiKey = process.env[desc.envKey];
@@ -105,12 +112,6 @@ function resolveProvider(modelId, options) {
       };
     }
   }
-  const prefix = declaredPrefixOf(modelId);
-  if (prefix !== void 0) {
-    throw new Error(
-      `Model "${modelId}" declares provider "${prefix}", which is not registered. Registered providers: ${sorted.map((p) => p.name).join(", ")}. Register it with registerProvider({ name: '${prefix}', \u2026 }), or use a registered prefix.`
-    );
-  }
   const envKeys = credentialed.map((p) => p.envKey).join(" OR ");
   throw new Error(
     `No LLM provider API key found in environment. Set one of: ${envKeys}. Get a free OpenRouter key at https://openrouter.ai/keys (recommended \u2014 one key, many models).`
@@ -178,4 +179,4 @@ export {
   getApprovalRegistry,
   resolveProvider
 };
-//# sourceMappingURL=chunk-5YPXXSYY.js.map
+//# sourceMappingURL=chunk-35QIWOHT.js.map