theokit 0.63.0 → 0.64.0

package/dist/vercel-BEDGUVXX.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/adapters/vercel.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Vercel deploy adapter. All paths derived from `cwd` and a fixed\n * `.theokit/vercel/` output layout. Build-time tool — no HTTP input.\n */\nimport { existsSync, mkdirSync, writeFileSync, cpSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nimport type { TheoConfig } from '../config/schema.js'\nimport type { SecurityHeadersConfig } from '../core/contracts/security-headers.js'\nimport { assertServicesUnsupported, readManifest } from '../services/index.js'\n\nimport { deployedCorsFragment, type DeployedCorsOptions } from './deployed-cors.js'\nimport { deployedCsrfFragment, type DeployedCsrfOptions } from './deployed-csrf.js'\nimport {\n  deployedRuntimeConfigFragment,\n  type DeployedRuntimeConfigOptions,\n} from './deployed-runtime-config.js'\nimport { deployedTraceFragment } from './deployed-trace.js'\nimport { nodeAdapter } from './node.js'\nimport {\n  buildSecurityHeaders,\n  describeDeployedSecurityHeaders,\n  renderSecurityHeadersConfigLiteral,\n} from './security-headers.js'\nimport type { AdapterBuildContext, DeployAdapter } from './types.js'\n\n/**\n * T2.2 — Vercel adapter rewritten to consume `theokit/adapters/web-shim`\n * instead of emitting an inline plain-object Request/Response shim and\n * lazy-importing internal `theo-server/` paths.\n */\n\n// Generated-code fragments — extracted so the parent emitter stays under the\n// max-lines-per-function ceiling.\n/** The exported function Vercel invokes: one security-header call, then the drain. */\nfunction vercelHandlerFragment(): string[] {\n  return [\n    `export default async function handler(nodeReq, nodeRes) {`,\n    `  // #409 — CORS reads only the method and the \\`origin\\` / \\`access-control-request-method\\``,\n    `  // headers, so this carries exactly those and no body. It is deliberately NOT the routing`,\n    `  // Request: that one drains the request stream, and only after a route matched — building it`,\n    `  // here would drain the body of every static path too.`,\n    `  const corsHeaders = new Headers()`,\n    `  for (const [k, v] of Object.entries(nodeReq.headers ?? {})) {`,\n    `    if (typeof v === 'string') corsHeaders.set(k, v)`,\n    `  }`,\n    `  const corsRequest = new Request(`,\n    `    new URL(nodeReq.url ?? '/', 'http://' + (nodeReq.headers?.host ?? 'localhost')),`,\n    `    { method: (nodeReq.method ?? 'GET').toUpperCase(), headers: corsHeaders },`,\n    `  )`,\n    ``,\n    `  // The preflight is answered BEFORE anything routes: an OPTIONS the router handles is an`,\n    `  // OPTIONS the browser never gets a CORS answer to.`,\n    `  const preflight = corsPreflight(corsRequest)`,\n    `  const webResponse = preflight !== null`,\n    `    ? withSecurityHeaders(preflight, SECURITY_HEADERS)`,\n    `    : withCors(corsRequest, withSecurityHeaders(await routeRequest(nodeReq), SECURITY_HEADERS))`,\n    ``,\n    `  // \\`outHeaders\\`, not \\`headers\\`: this used to live in the same scope as the`,\n    `  // request-side \\`const headers\\` below, which made the whole module a`,\n    `  // SyntaxError — every Vercel build between #382 and #411 emitted a function`,\n    `  // that could not be loaded.`,\n    `  const outHeaders = {}`,\n    `  webResponse.headers.forEach((v, k) => { outHeaders[k] = v })`,\n    `  nodeRes.writeHead(webResponse.status, outHeaders)`,\n    `  if (typeof nodeRes.flushHeaders === 'function') nodeRes.flushHeaders()`,\n    ``,\n    `  // #382 — this used to materialize the entire body as a string and hand`,\n    `  // it to a single end(), which re-buffered the whole response inside the`,\n    `  // function even after the shim was fixed. Drain chunk by chunk instead,`,\n    `  // honouring Node backpressure so a slow client cannot grow the queue.`,\n    `  if (webResponse.body === null) {`,\n    `    nodeRes.end()`,\n    `    return`,\n    `  }`,\n    `  const reader = webResponse.body.getReader()`,\n    `  try {`,\n    `    for (;;) {`,\n    `      const { done, value } = await reader.read()`,\n    `      if (done) break`,\n    `      if (nodeRes.write(value) === false) {`,\n    `        await new Promise((resolveDrain) => {`,\n    `          const finish = () => {`,\n    `            nodeRes.off('drain', finish)`,\n    `            nodeRes.off('close', finish)`,\n    `            nodeRes.off('error', finish)`,\n    `            resolveDrain()`,\n    `          }`,\n    `          nodeRes.once('drain', finish)`,\n    `          nodeRes.once('close', finish)`,\n    `          nodeRes.once('error', finish)`,\n    `        })`,\n    `      }`,\n    `    }`,\n    `    nodeRes.end()`,\n    `  } catch (streamErr) {`,\n    `    // The handler failed after the head went out. Destroying the socket is`,\n    `    // the only signal left that the body is incomplete — ending normally`,\n    `    // would report a truncated response as a complete one (ADR-0002).`,\n    `    nodeRes.destroy(streamErr)`,\n    `  } finally {`,\n    `    reader.releaseLock()`,\n    `  }`,\n    `}`,\n    ``,\n  ]\n}\n\n// Generated-code fragments — extracted so the parent emitter stays under the\n// max-lines-per-function ceiling.\n/** Everything that decides WHAT the response is, as a Web Response for every outcome. */\nfunction vercelRouteRequestFragment(runtimeSpread: string): string[] {\n  return [\n    `async function routeRequest(nodeReq) {`,\n    `  const url = new URL(nodeReq.url ?? '/', 'http://' + (nodeReq.headers?.host ?? 'localhost'))`,\n    ``,\n    `  if (!url.pathname.startsWith('/api/')) {`,\n    `    return new Response('Not Found', {`,\n    `      status: 404,`,\n    `      headers: { 'content-type': 'text/plain; charset=utf-8' },`,\n    `    })`,\n    `  }`,\n    ``,\n    `  if (!routesCache) routesCache = scanServerRoutes(serverDir)`,\n    `  if (!loaderCache) loaderCache = createProductionLoader()`,\n    ``,\n    `  const match = matchRoute(url.pathname, routesCache)`,\n    `  if (!match) {`,\n    `    return new Response(JSON.stringify({ error: { code: 'NOT_FOUND' } }), {`,\n    `      status: 404,`,\n    `      headers: { 'content-type': 'application/json' },`,\n    `    })`,\n    `  }`,\n    ``,\n    `  // Convert Node-style req to Web Request for the shim`,\n    `  const headers = new Headers()`,\n    `  for (const [k, v] of Object.entries(nodeReq.headers ?? {})) {`,\n    `    if (typeof v === 'string') headers.set(k, v)`,\n    `  }`,\n    `  let body`,\n    `  const method = (nodeReq.method ?? 'GET').toUpperCase()`,\n    `  if (method !== 'GET' && method !== 'HEAD') {`,\n    `    const chunks = []`,\n    `    await new Promise((resolveProm, rejectProm) => {`,\n    `      nodeReq.on('data', (c) => chunks.push(c))`,\n    `      nodeReq.on('end', () => resolveProm())`,\n    `      nodeReq.on('error', rejectProm)`,\n    `    })`,\n    `    body = Buffer.concat(chunks)`,\n    `  }`,\n    `  const webRequest = new Request(url.toString(), { method, headers, body })`,\n    ``,\n    `  const { req, res, toResponse } = createWebShim(webRequest)`,\n    ...deployedTraceFragment('webRequest', '  '),\n    `  // #382 — executeRoute() is NOT awaited before the Response is taken:`,\n    `  // toResponse() settles at the headers and carries a live body.`,\n    `  return toResponse(executeRoute({`,\n    `    route: match.route, method, params: match.params,`,\n    `    req, res, loadModule: loaderCache, serverDir, requestId, ...CSRF_CONFIG, ${runtimeSpread}`,\n    `  }))`,\n    `}`,\n  ]\n}\n\nexport function renderVercelFunctionEntry(\n  opts: { securityHeaders?: SecurityHeadersConfig } & DeployedCsrfOptions &\n    DeployedRuntimeConfigOptions &\n    DeployedCorsOptions = {},\n): string {\n  const runtimeConfig = deployedRuntimeConfigFragment(opts)\n  return [\n    `// Generated by Theo — Vercel Functions adapter`,\n    `// Environment variables are resolved at RUNTIME, not build time.`,\n    ``,\n    `import { resolve } from 'node:path'`,\n    `import { scanServerRoutes, matchRoute, executeRoute, createProductionLoader, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler } from 'theokit/server'`,\n    `import { createWebShim } from 'theokit/adapters/web-shim'`,\n    `import { buildSecurityHeaders, withSecurityHeaders } from 'theokit/adapters/security-headers'`,\n    ``,\n    `// Cold-start cache`,\n    `let routesCache = null`,\n    `let loaderCache = null`,\n    `const serverDir = resolve(process.cwd(), 'server')`,\n    ``,\n    `// #410 — the security baseline \\`theokit start\\` puts on every response,`,\n    `// carried here as a literal because the deployed function has no`,\n    `// theo.config.ts to read. config.json routes only /api/* here, so this`,\n    `// covers the API and not the document Vercel's static host serves`,\n    `// (usetheokit/theokit#412).`,\n    `const SECURITY_HEADERS_CONFIG = ${renderSecurityHeadersConfigLiteral(opts.securityHeaders)}`,\n    `const SECURITY_HEADERS = buildSecurityHeaders(SECURITY_HEADERS_CONFIG, { production: true })`,\n    ``,\n    ...runtimeConfig.imports,\n    ...runtimeConfig.declarations,\n    ...deployedCsrfFragment(opts),\n    ``,\n    ...deployedCorsFragment(opts.cors, 'vercel'),\n    ``,\n    `// Vercel Functions invoke this default export with a (req, res) pair`,\n    `// (Node IncomingMessage-style). \\`routeRequest\\` produces a Web Response for`,\n    `// every outcome — including the two 404s — so the security baseline is`,\n    `// applied at ONE place and no branch can be added that skips it.`,\n    ...vercelHandlerFragment(),\n    ``,\n    ...vercelRouteRequestFragment(runtimeConfig.executeRouteSpread),\n  ].join('\\n')\n}\n\nexport interface VercelRoutingRule {\n  src?: string\n  dest?: string\n  handle?: string\n  /** Build Output API v3 — response headers this rule adds. */\n  headers?: Record<string, string>\n  /**\n   * Keep routing after this rule matches.\n   *\n   * Load-bearing for the header rule: without it a matching rule TERMINATES routing in Build\n   * Output v3, so every request would receive the headers and no content.\n   */\n  continue?: boolean\n}\n\n/**\n * The routing table, plus the security baseline for the responses this build does NOT serve.\n *\n * The emitted function applies the baseline to every response IT returns — and it never returns the\n * HTML document: `{ handle: 'filesystem' }` hands the page to Vercel's static host, so the JSON was\n * protected and the page it renders in was not (usetheokit/theokit#412).\n *\n * The values come from `buildSecurityHeaders`, the same function the handler calls, rather than\n * being written out here. Two lists of headers that must agree are two lists that eventually do\n * not.\n *\n * Order matters twice: the header rule sits FIRST, because a rule after `handle: 'filesystem'`\n * never runs for a static file, and it carries `continue: true`, because a matching rule otherwise\n * ends routing and the request would get headers with no body.\n *\n * What this does NOT prove: that a deployed page carries them. That needs a deployment, and this\n * repository deploys to no Vercel project from CI. The emitted configuration is verifiable; the\n * platform honouring it is not, and the difference is stated rather than glossed.\n */\nexport function renderVercelConfigJson(securityHeaders?: SecurityHeadersConfig): {\n  version: number\n  routes: VercelRoutingRule[]\n} {\n  return {\n    version: 3,\n    routes: [\n      {\n        src: '/(.*)',\n        headers: buildSecurityHeaders(securityHeaders ?? {}, { production: true }),\n        continue: true,\n      },\n      { src: '/api/(.*)', dest: '/api' },\n      { handle: 'filesystem' },\n      { src: '/(.*)', dest: '/index.html' },\n    ],\n  }\n}\n\nexport function renderVercelVcConfigJson(): {\n  runtime: string\n  handler: string\n  launcherType: string\n  shouldAddHelpers: boolean\n  supportsResponseStreaming: boolean\n} {\n  return {\n    runtime: 'nodejs22.x',\n    handler: 'index.mjs',\n    launcherType: 'Nodejs',\n    shouldAddHelpers: true,\n    // #382 — Build Output API v3 opt-in. Without it the platform buffers the\n    // function's response no matter how the handler writes it, so the emitted\n    // chunk-by-chunk drain above would never reach the client. We cannot\n    // verify the platform side from here; see the streaming note in\n    // `adapters/web-shim.ts` and the adapter's `streamsResponses` flag.\n    supportsResponseStreaming: true,\n  }\n}\n\nexport const vercelAdapter: DeployAdapter = {\n  name: 'vercel',\n  streamsResponses: true,\n  // #409 / #410 — the generated entry calls `executeRoute` with routes, loader\n  // and serverDir only. CSRF, route policy, file middleware and Zod validation\n  // still run because they live inside `executeRoute`; none of the remaining\n  // configurable concerns reach it. Declared explicitly rather than omitted so\n  // the gap is a statement in the source and not an absence.\n  //\n  // `securityHeaders` IS applied -- to every response this function returns.\n  // The document is served from `.vercel/output/static` and does not pass\n  // through it (usetheokit/theokit#412).\n  appliesConfig: ['securityHeaders', 'csrf', 'disallowed', 'cors', 'serialization'],\n\n  async build(config: TheoConfig, cwd: string, ctx?: AdapterBuildContext): Promise<void> {\n    // Wave 2 (T2.2) — reject polyglot services on this adapter.\n    // Per 2026-05-27 owner decision, polyglot is wired via `node` (local\n    // docker-compose harness) + `theo-cloud` (Wave 3). Vercel adapter\n    // wire-up is deferred to a fresh ADR with demand evidence.\n    assertServicesUnsupported('vercel', readManifest(cwd))\n\n    // 1. Run the standard Node build first (ctx forwarded so nodeAdapter has makeVitePlugins)\n    await nodeAdapter.build(config, cwd, ctx)\n\n    const clientDir = resolve(cwd, '.theokit/client')\n    const outputDir = resolve(cwd, '.vercel/output')\n\n    // 2. Create .vercel/output structure\n    mkdirSync(resolve(outputDir, 'static'), { recursive: true })\n    mkdirSync(resolve(outputDir, 'functions/api.func'), { recursive: true })\n\n    // 3. Copy static assets\n    if (existsSync(clientDir)) {\n      cpSync(clientDir, resolve(outputDir, 'static'), { recursive: true })\n    }\n\n    // 4. Emit serverless function entry (now uses shared web-shim)\n    writeFileSync(\n      resolve(outputDir, 'functions/api.func/index.mjs'),\n      renderVercelFunctionEntry({\n        securityHeaders: config.security?.headers,\n        csrf: config.security?.csrf,\n        disallowed: config.security?.disallowed,\n        cors: config.security?.cors,\n        // #425 — a selector, not a transformer, so it rides as a literal like the values above.\n        serialization: config.serialization,\n      }),\n    )\n\n    // 5. Emit .vc-config.json\n    writeFileSync(\n      resolve(outputDir, 'functions/api.func/.vc-config.json'),\n      JSON.stringify(renderVercelVcConfigJson(), null, 2),\n    )\n\n    // 6. Emit config.json (routing)\n    writeFileSync(\n      resolve(outputDir, 'config.json'),\n      JSON.stringify(renderVercelConfigJson(config.security?.headers), null, 2),\n    )\n\n    // eslint-disable-next-line no-console -- CLI build progress\n    console.log('\\n  ✓ Vercel output → .vercel/output/')\n    // eslint-disable-next-line no-console -- CLI build progress\n    console.log(\n      `${describeDeployedSecurityHeaders({\n        target: 'vercel',\n        securityHeaders: config.security?.headers,\n        mintsNonce: false,\n        documentHeaders: 'platform-configured',\n      })}\\n`,\n    )\n  },\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAIA,SAAS,YAAY,WAAW,eAAe,cAAc;AAC7D,SAAS,eAAe;AA8BxB,SAAS,wBAAkC;AACzC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAKA,SAAS,2BAA2B,eAAiC;AACnE,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,sBAAsB,cAAc,IAAI;AAAA,IAC3C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,gFAAgF,aAAa;AAAA,IAC7F;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,0BACd,OAEwB,CAAC,GACjB;AACR,QAAM,gBAAgB,8BAA8B,IAAI;AACxD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,mCAAmC,mCAAmC,KAAK,eAAe,CAAC;AAAA,IAC3F;AAAA,IACA;AAAA,IACA,GAAG,cAAc;AAAA,IACjB,GAAG,cAAc;AAAA,IACjB,GAAG,qBAAqB,IAAI;AAAA,IAC5B;AAAA,IACA,GAAG,qBAAqB,KAAK,MAAM,QAAQ;AAAA,IAC3C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,sBAAsB;AAAA,IACzB;AAAA,IACA,GAAG,2BAA2B,cAAc,kBAAkB;AAAA,EAChE,EAAE,KAAK,IAAI;AACb;AAoCO,SAAS,uBAAuB,iBAGrC;AACA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,QAAQ;AAAA,MACN;AAAA,QACE,KAAK;AAAA,QACL,SAAS,qBAAqB,mBAAmB,CAAC,GAAG,EAAE,YAAY,KAAK,CAAC;AAAA,QACzE,UAAU;AAAA,MACZ;AAAA,MACA,EAAE,KAAK,aAAa,MAAM,OAAO;AAAA,MACjC,EAAE,QAAQ,aAAa;AAAA,MACvB,EAAE,KAAK,SAAS,MAAM,cAAc;AAAA,IACtC;AAAA,EACF;AACF;AAEO,SAAS,2BAMd;AACA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,SAAS;AAAA,IACT,cAAc;AAAA,IACd,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMlB,2BAA2B;AAAA,EAC7B;AACF;AAEO,IAAM,gBAA+B;AAAA,EAC1C,MAAM;AAAA,EACN,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUlB,eAAe,CAAC,mBAAmB,QAAQ,cAAc,QAAQ,eAAe;AAAA,EAEhF,MAAM,MAAM,QAAoB,KAAa,KAA0C;AAKrF,8BAA0B,UAAU,aAAa,GAAG,CAAC;AAGrD,UAAM,YAAY,MAAM,QAAQ,KAAK,GAAG;AAExC,UAAM,YAAY,QAAQ,KAAK,iBAAiB;AAChD,UAAM,YAAY,QAAQ,KAAK,gBAAgB;AAG/C,cAAU,QAAQ,WAAW,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAC3D,cAAU,QAAQ,WAAW,oBAAoB,GAAG,EAAE,WAAW,KAAK,CAAC;AAGvE,QAAI,WAAW,SAAS,GAAG;AACzB,aAAO,WAAW,QAAQ,WAAW,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAAA,IACrE;AAGA;AAAA,MACE,QAAQ,WAAW,8BAA8B;AAAA,MACjD,0BAA0B;AAAA,QACxB,iBAAiB,OAAO,UAAU;AAAA,QAClC,MAAM,OAAO,UAAU;AAAA,QACvB,YAAY,OAAO,UAAU;AAAA,QAC7B,MAAM,OAAO,UAAU;AAAA;AAAA,QAEvB,eAAe,OAAO;AAAA,MACxB,CAAC;AAAA,IACH;AAGA;AAAA,MACE,QAAQ,WAAW,oCAAoC;AAAA,MACvD,KAAK,UAAU,yBAAyB,GAAG,MAAM,CAAC;AAAA,IACpD;AAGA;AAAA,MACE,QAAQ,WAAW,aAAa;AAAA,MAChC,KAAK,UAAU,uBAAuB,OAAO,UAAU,OAAO,GAAG,MAAM,CAAC;AAAA,IAC1E;AAGA,YAAQ,IAAI,iDAAuC;AAEnD,YAAQ;AAAA,MACN,GAAG,gCAAgC;AAAA,QACjC,QAAQ;AAAA,QACR,iBAAiB,OAAO,UAAU;AAAA,QAClC,YAAY;AAAA,QACZ,iBAAiB;AAAA,MACnB,CAAC,CAAC;AAAA;AAAA,IACJ;AAAA,EACF;AACF;","names":[]}