theokit 0.67.0 → 0.69.0

package/dist/chunk-FFGP2LGQ.js

@@ -0,0 +1,465 @@
+#!/usr/bin/env node
+import "tsx/esm";
+import {
+  buildSecurityHeaders
+} from "./chunk-WSMLSIS5.js";
+
+// src/adapters/deployed-agents.ts
+var EMPTY = { imports: [], declarations: [], branch: [], hostBypass: "" };
+var AUX_DEPS_PARITY = [
+  `        ...CSRF_CONFIG,`,
+  `        resolveApiKey: (model, plugins) => resolveProvider(model, { plugins }).apiKey,`
+];
+var AGENT_PREFIX = "/api/agents/";
+var WELL_KNOWN_PREFIX = "/.well-known/";
+function scannedFromLoaderCache(agentsDirLiteral2) {
+  return {
+    kind: "scan",
+    projectRoot: "cwd",
+    agentsDirLiteral: agentsDirLiteral2,
+    loadModule: "loaderCache",
+    serverDir: "serverDir",
+    ensureLoader: "if (!loaderCache) loaderCache = createProductionLoader()"
+  };
+}
+var JSON_NOT_FOUND_RESPONSE = `new Response(JSON.stringify({ error: { code: 'NOT_FOUND' } }), { status: 404, headers: { 'content-type': 'application/json' } })`;
+function deployedAgentsFragment(source, host = {}) {
+  if (source === void 0) return EMPTY;
+  if (source.kind === "baked" && source.agents.length === 0) return EMPTY;
+  const pathname = host.pathname ?? "url.pathname";
+  const notFound = host.notFound ?? "notFoundResponse()";
+  const prefix = host.importPrefix ?? "";
+  const resolution = source.kind === "baked" ? bakedResolution(source.agents, source.contextModule, host.pluginRunnerExpr) : scannedResolution({ ...source, pluginRunnerExpr: host.pluginRunnerExpr });
+  return {
+    hostBypass: ` && !__theoIsAgentCardPath(${pathname})`,
+    imports: [
+      // `theokit/adapters/agent-mount`, not `theokit/server`: `mount-agent` is deliberately not on
+      // the app-facing surface (ADR 0041), and a generated entry is not an app. See that module.
+      // B-185 — the identity entry differs by host: a filesystem host LOCATES its own
+      // `context.ts`, a Worker is handed the baked factory (ADR 0014). `createWebShim` is not here
+      // because all three entries already import it at module level.
+      `import { mountAgent, resolveProvider, matchAgentAuxRoute, serveMatchedAuxRoute${resolution.identityImport}${source.kind === "scan" ? ", scanAgents" : ""} } from '${prefix}theokit/adapters/agent-mount'`,
+      ...resolution.imports
+    ],
+    declarations: [
+      ...resolution.declarations,
+      // SI-020 — the host's `/api/` guard decides between the API surface and static assets, and it
+      // runs BEFORE this branch. Widening the branch guard alone left the `.well-known` arm as dead
+      // code on all three targets: present in the source, unreachable in the emitted program. The
+      // host consults this predicate, so the card path escapes the asset branch and NOTHING else
+      // under `/.well-known/` does — a blanket prefix bypass would route `/.well-known/security.txt`
+      // away from assets, trading an unreachable card for a broken namespace.
+      //
+      // Same shape as `agent-card-handler.ts`'s own WELL_KNOWN. That is a COPY, not a shared
+      // definition, and saying otherwise was the claim an inventory judge falsified: changing the
+      // handler to serve `/agent.json` left every card test green, because this guard and that
+      // matcher are checked separately and never against each other. The drift that matters here —
+      // this guard narrowing while the matcher still serves the path — is caught by
+      // `a-deployed-worker-reaches-the-agent-card.test.ts`, which drives a real request. The other
+      // direction is not, and is the honest limit of this line.
+      String.raw`const __theoIsAgentCardPath = (p) => /^\/\.well-known\/[^/]+\/agent-card\.json$/.test(p)`,
+      // B-185 — one factory, two call sites: the aux branch on a hit, and the run handler below.
+      // Declared rather than inlined twice so the mechanism ADR 0014 decides has a single home.
+      // `async` because the entry's plugin runner is a promise: `createPluginRunnerFromConfig` is
+      // async, so the runtime-config fragment declares `const THEO_PLUGIN_RUNNER = createPluginRunnerFromConfig(...)`
+      // WITHOUT awaiting it, and every consumer awaits at the point of use. `await` is a reserved
+      // word everywhere in an ES module, so a non-async factory carrying that binding does not
+      // merely misbehave -- the entry does not parse, and `tests/unit/adapter-entry-parses.test.ts`
+      // is where that is caught. It went red at HEAD before this line existed, on a first version
+      // of this fix whose own test asserted `toContain('await THEO_PLUGIN_RUNNER')`: the presence
+      // of the token that breaks the parse. That test file's header says why, in its own words --
+      // `toContain` does not care whether the string is a program.
+      //
+      // Laziness is unaffected. The shim was always built eagerly inside this factory; what ADR-1
+      // refuses is paying for a url nobody answers, and neither call site is reached by one.
+      `async function __theoResolveSubject(request) {`,
+      ...resolution.identity,
+      `  return resolveSubject`,
+      `}`
+    ],
+    branch: [
+      `    // #367 \u2014 the agent convention owns this prefix. It is answered BEFORE the file-route`,
+      `    // table because an agent matches no file route: falling through is how a deployed`,
+      `    // \`/api/agents/<name>\` used to 404 on every target.`,
+      `    if (`,
+      `      ${pathname}.startsWith(${JSON.stringify(AGENT_PREFIX)}) ||`,
+      `      ${pathname}.startsWith(${JSON.stringify(WELL_KNOWN_PREFIX)})`,
+      `    ) {`,
+      ...resolution.auxPrelude,
+      `      // B-185 \u2014 the aux dispatcher is asked FIRST, and declining costs nothing: the matcher`,
+      `      // reads the url and the scanned nodes, never a module (ADR-1). A miss falls through to`,
+      `      // the run handler exactly as before, so this branch owns the sub-paths and nothing more.`,
+      `      const auxRoute = await matchAgentAuxRoute(request.method, ${pathname}, auxDeps)`,
+      `      if (auxRoute !== null) {`,
+      `        // B-185 \u2014 identity is resolved only now. Building it costs a web shim and, where the`,
+      `        // app declares one, a call into its own \`createContext\`; a url this dispatcher`,
+      `        // merely declined must pay for neither (resolve-agent-subject.ts:93-96).`,
+      `        const auxResponse = await serveMatchedAuxRoute(auxRoute, request, {`,
+      `          ...auxDeps,`,
+      `          resolveSubject: await __theoResolveSubject(request),`,
+      `        })`,
+      host.wrapSecurityHeaders === true ? `        return withSecurityHeaders(auxResponse, SECURITY_HEADERS)` : `        return auxResponse`,
+      `      }`,
+      `      // B-185 \u2014 only the agent prefix has a run handler behind it. A \`.well-known\` url the`,
+      `      // dispatcher declined must NOT slice a prefix it does not carry: the name would be`,
+      `      // garbage and mountAgent would answer 500 for what is a routing miss.`,
+      `      if (!${pathname}.startsWith(${JSON.stringify(AGENT_PREFIX)})) return ${notFound}`,
+      `      const agentName = ${pathname}.slice(${String(AGENT_PREFIX.length)}).split('/')[0]`,
+      ...resolution.lookup,
+      `      // A name nobody scanned is a 404, exactly like any other unknown path. Handing`,
+      `      // \`undefined\` to mountAgent would surface as a 500 for what is a routing miss.`,
+      `      if (mod === undefined) return ${notFound}`,
+      `      const agentResponse = await mountAgent(mod, request, (model, plugins) => resolveProvider(model, { plugins }).apiKey, {`,
+      `        agentName,`,
+      `        // B-185 \u2014 mount-agent.ts:121 has accepted this since #365 and 0 of 23 adapters passed`,
+      `        // one, so agent-access.ts:146 judged every deployed policy against \`subject: null\`.`,
+      `        // A run is not a decline: it is about to do real work, so the shim this builds is not`,
+      `        // the cost ADR-1 refuses.`,
+      `        resolveSubject: await __theoResolveSubject(request),`,
+      `        ...CSRF_CONFIG,`,
+      `      })`,
+      host.wrapSecurityHeaders === true ? `      return withSecurityHeaders(agentResponse, SECURITY_HEADERS)` : `      return agentResponse`,
+      `    }`
+    ]
+  };
+}
+function bakedResolution(agents, contextModule, pluginRunnerExpr) {
+  const varOf = (index) => `__theoAgent${String(index)}`;
+  return {
+    imports: [
+      ...agents.map((agent, index) => `import * as ${varOf(index)} from '../../${agent.filePath}'`),
+      // B-185 — the app's context module, baked exactly like the agents above it (ADR 0014).
+      ...contextModule === void 0 ? [] : [
+        // SI-022 — DYNAMIC, not a top-level static import. B-185 added this import; before it
+        // a Worker did not load the app's `server/context.ts` at all. A module-scope throw
+        // there — the commonest shape being a required-env-var check — then went from costing
+        // nothing to taking the ENTIRE target down: the import fails, the module never
+        // evaluates, and every route dies rather than only the one that wanted an identity.
+        //
+        // That is strictly worse than what `resolve-agent-subject.ts:69-72` promises. It says
+        // a throwing `createContext` reaches the branch's own error handler and becomes a 500,
+        // which is a failure scoped to the request that needed identity. A throw at IMPORT
+        // time reaches no handler at all.
+        //
+        // A relative `import()` is statically analysable, so wrangler bundles the module
+        // exactly as it bundled the static form — the reason ADR 0014 bakes it is unaffected.
+        // What changes is WHEN it evaluates, and therefore what a failure costs. It is only
+        // a real improvement if the import stays inside the thunk; see the factory below.
+        `const __theoContext = () => import('../../${contextModule}')`
+      ]
+    ],
+    declarations: [
+      `// #367 \u2014 the app's agents, keyed by NAME because that is what the URL carries, what the`,
+      `// access policy is judged under, and what the run's spans are labelled with (#406).`,
+      `const agents = {`,
+      ...agents.map((agent, index) => `  ${JSON.stringify(agent.name)}: ${varOf(index)},`),
+      `}`,
+      `// B-185 \u2014 the node list the aux dispatcher matches a url against. There is deliberately NO`,
+      `// second table keyed by file path: \`test_the_table_is_keyed_by_agent_name_not_by_file_path\``,
+      `// forbids one, and the reason it gives is the right one \u2014 a path key makes a lookup depend on`,
+      `// the server's directory layout. The loader below reaches the module THROUGH this list, so the`,
+      `// layout appears once, here, and the module table above stays keyed by the name the URL, the`,
+      `// access policy and the run's spans all carry (#406).`,
+      `const agentNodes = [`,
+      ...agents.map(
+        (agent) => `  { filePath: ${JSON.stringify(agent.filePath)}, agentPath: ${JSON.stringify(agent.agentPath)}, name: ${JSON.stringify(agent.name)} },`
+      ),
+      `]`
+    ],
+    lookup: [
+      `      const mod = Object.prototype.hasOwnProperty.call(agents, agentName)`,
+      `        ? agents[agentName]`,
+      `        : undefined`
+    ],
+    identityImport: contextModule === void 0 ? "" : ", createSubjectResolverFromFactory",
+    identity: contextModule === void 0 ? [
+      `  // B-185 \u2014 this app declares no \`server/context.ts\`, so there is no factory to`,
+      `  // bake and an anonymous caller is the honest answer. A policy that admits`,
+      `  // nobody is the correct outcome, not an error.`,
+      `        const resolveSubject = undefined`
+    ] : [
+      `  // B-185 \u2014 a Worker has no filesystem to find \`context.ts\` on, so the module is baked`,
+      `  // and its factory handed straight to the resolver (ADR 0014).`,
+      `  //`,
+      `  // This function has TWO callers and is lazy on purpose. Both build a shim, and that is`,
+      `  // correct at both: the aux branch calls it only AFTER a match, and the run handler is`,
+      `  // about to do real work. What neither pays for is the app's own \`createContext\` on a`,
+      `  // url nobody answers \u2014 the resolver is a thunk, and \`agent-access.ts:146\` returns early`,
+      `  // for an absent or public policy without ever invoking it.`,
+      `        const { req: __theoReq, res: __theoRes } = createWebShim(request)`,
+      `  const resolveSubject = createSubjectResolverFromFactory(`,
+      // The import happens HERE, inside the factory, and `createSubjectResolverFromFactory`
+      // calls the factory inside the thunk it returns (`resolve-agent-subject.ts:127-133`).
+      // A first version of this fix awaited the import as an ARGUMENT, which evaluated it
+      // eagerly inside `__theoResolveSubject` — both call sites await that before
+      // `agent-access.ts:145` returns early for an absent or `'public'` policy. The blast
+      // radius was then every agent request rather than the one that wanted an identity,
+      // and the laziness invariant the lines above assert was broken. Found by the
+      // inventory judge while the change was still in the working tree.
+      `    async (__theoArgs) => (await __theoContext()).createContext(__theoArgs),`,
+      `    __theoReq,`,
+      `    __theoRes,`,
+      `    ${pluginRunnerExpr ?? "undefined"},`,
+      `  )`
+    ],
+    auxPrelude: [
+      `      // B-185 \u2014 the aux dispatcher needs nodes carrying \`filePath\` and a loader keyed by it.`,
+      `      // The loader resolves the path to a NAME through the node list, then reads the same`,
+      `      // name-keyed table the url lookup uses: one map, one layout mention, no filesystem`,
+      `      // (ADR-2). A linear find over a handful of agents is not worth a second table that`,
+      `      // \`test_the_table_is_keyed_by_agent_name_not_by_file_path\` exists to forbid.`,
+      `      const auxDeps = {`,
+      `        agents: agentNodes,`,
+      `        loadModule: async (filePath) => {`,
+      `          const node = agentNodes.find((a) => a.filePath === filePath)`,
+      `          return node === undefined ? undefined : agents[node.name]`,
+      `        },`,
+      `        baseUrl: url.origin,`,
+      ...AUX_DEPS_PARITY,
+      `      }`
+    ]
+  };
+}
+function scannedResolution(source) {
+  const agentsDirArg = source.agentsDirLiteral === void 0 ? "" : `, ${source.agentsDirLiteral}`;
+  return {
+    imports: [],
+    declarations: [
+      `// #367 \u2014 scanned on first use and cached, the same shape this entry already gives routes.`,
+      `// Baking would tie an agent's existence to a rebuild on a target that has a filesystem.`,
+      `let agentsCache = null`
+    ],
+    lookup: [
+      `      const agentNode = agentsCache.find((a) => a.name === agentName)`,
+      `      const mod = agentNode === undefined ? undefined : await ${source.loadModule}(agentNode.filePath)`
+    ],
+    identityImport: source.serverDir === void 0 ? "" : ", createAgentSubjectResolver",
+    identity: source.serverDir === void 0 ? [`        const resolveSubject = undefined`] : [
+      `  // B-185 \u2014 this host HAS a filesystem, so it locates its own \`context.ts\` and the`,
+      `  // existing resolver works unchanged; nothing is baked (ADR 0014). Lazy for the reason`,
+      `  // the baked branch gives: both callers build a shim, and neither runs the app's own`,
+      `  // \`createContext\` for a url nobody answers.`,
+      `        const { req: __theoReq, res: __theoRes } = createWebShim(request)`,
+      `  const resolveSubject = createAgentSubjectResolver({`,
+      `    req: __theoReq,`,
+      `    res: __theoRes,`,
+      `    loadModule: ${source.loadModule},`,
+      `    serverDir: ${source.serverDir},`,
+      `    pluginRunner: ${source.pluginRunnerExpr ?? "undefined"},`,
+      `        })`
+    ],
+    auxPrelude: [
+      ...source.ensureLoader === void 0 ? [] : [`      ${source.ensureLoader}`],
+      `      // B-185 \u2014 hoisted above the lookup so a declined aux route loads no module. The scan`,
+      `      // LISTS agent files; it imports none, so moving it here costs a declined request`,
+      `      // nothing it was not already paying.`,
+      `      if (!agentsCache) agentsCache = scanAgents(${source.projectRoot}${agentsDirArg})`,
+      `      const auxDeps = {`,
+      `        agents: agentsCache,`,
+      `        loadModule: ${source.loadModule},`,
+      `        baseUrl: url.origin,`,
+      ...AUX_DEPS_PARITY,
+      `      }`
+    ]
+  };
+}
+
+// src/adapters/deployed-cors.ts
+var UnserializableCorsOriginError = class extends Error {
+  constructor(target) {
+    super(
+      `security.cors.origins is a function, and the \`${target}\` target cannot carry it: a deployed function has no theo.config.ts to read, and a callback cannot be written into the emitted entry. Replace it with the origin, a RegExp, or an array of either \u2014 all of which travel \u2014 or build for \`node\` and run \`theokit start\`, which evaluates the callback at runtime.`
+    );
+    this.name = "UnserializableCorsOriginError";
+  }
+};
+function renderOrigin(origin, target) {
+  if (typeof origin === "function") throw new UnserializableCorsOriginError(target);
+  if (origin instanceof RegExp) return String(origin);
+  if (Array.isArray(origin)) return `[${origin.map((o) => renderOrigin(o, target)).join(", ")}]`;
+  return JSON.stringify(origin);
+}
+function renderDeployedCorsLiteral(cors, target) {
+  if (cors === void 0) return "undefined";
+  const parts = [`origins: ${renderOrigin(cors.origins, target)}`];
+  if (cors.methods !== void 0) parts.push(`methods: ${JSON.stringify(cors.methods)}`);
+  if (cors.allowedHeaders !== void 0)
+    parts.push(`allowedHeaders: ${JSON.stringify(cors.allowedHeaders)}`);
+  if (cors.exposedHeaders !== void 0)
+    parts.push(`exposedHeaders: ${JSON.stringify(cors.exposedHeaders)}`);
+  parts.push(
+    `credentials: ${JSON.stringify(cors.credentials)}`,
+    `maxAge: ${JSON.stringify(cors.maxAge)}`
+  );
+  return `{ ${parts.join(", ")} }`;
+}
+function deployedCorsFragment(cors, target) {
+  return [
+    `// #409 \u2014 the CORS the app declared, carried as a literal because a deployed function has no`,
+    `// theo.config.ts to read. \`null\` when the app declared none: no headers, not permissive ones.`,
+    `const CORS_CONFIG = ${renderDeployedCorsLiteral(cors, target)}`,
+    `const CORS_HANDLER = CORS_CONFIG === undefined ? null : createCorsWebHandler(CORS_CONFIG)`,
+    ``,
+    `/** Answer a preflight before routing \u2014 an OPTIONS the router handles never gets a CORS answer. */`,
+    `function corsPreflight(request) {`,
+    `  return CORS_HANDLER === null ? null : CORS_HANDLER.handlePreflightRequest(request)`,
+    `}`,
+    ``,
+    `/** Put the headers on whatever the app answered, including its 404s \u2014 a browser reads a 404`,
+    ` *  without them as a CORS failure rather than as the 404 it is. */`,
+    `function withCors(request, response) {`,
+    `  if (CORS_HANDLER !== null) CORS_HANDLER.applyCorsHeaders(request, response.headers)`,
+    `  return response`,
+    `}`
+  ];
+}
+
+// src/adapters/deployed-csrf.ts
+function renderRoutePattern(pattern) {
+  return pattern instanceof RegExp ? String(pattern) : JSON.stringify(pattern);
+}
+function renderDeployedCsrfLiteral(security) {
+  if (security === void 0) return "{}";
+  const parts = [];
+  if (security.csrf !== void 0) parts.push(`csrfMode: ${JSON.stringify(security.csrf)}`);
+  const { disallowed } = security;
+  if (disallowed !== void 0) {
+    const routes = disallowed.routes.map(renderRoutePattern).join(", ");
+    parts.push(
+      `disallowed: { routes: [${routes}], behavior: ${JSON.stringify(disallowed.behavior)} }`
+    );
+  }
+  return parts.length === 0 ? "{}" : `{ ${parts.join(", ")} }`;
+}
+function deployedCsrfFragment(opts, home = "a deployed function") {
+  return [
+    `// #410 \u2014 the CSRF mode and per-route escalation the app declared. Carried as a`,
+    `// literal for the same reason as the headers above: ${home} has no theo.config.ts`,
+    `// to read. Absent keys stay absent so executeRoute's own default ('strict') applies,`,
+    `// rather than this file becoming a second place it can drift.`,
+    `const CSRF_CONFIG = ${renderDeployedCsrfLiteral(opts)}`
+  ];
+}
+
+// src/adapters/security-headers.ts
+function securityHeadersDeclarations(config) {
+  return [
+    `const SECURITY_HEADERS_CONFIG = ${renderSecurityHeadersConfigLiteral(config)}`,
+    `const SECURITY_HEADERS = buildSecurityHeaders(SECURITY_HEADERS_CONFIG, { production: true })`
+  ];
+}
+function renderSecurityHeadersConfigLiteral(headers) {
+  return JSON.stringify(headers ?? {});
+}
+function describeDeployedSecurityHeaders(limits) {
+  const headers = buildSecurityHeaders(limits.securityHeaders ?? {}, { production: true });
+  const names = Object.keys(headers);
+  if (names.length === 0) {
+    return `  ! \`${limits.target}\` sends no security headers: the configuration switched every one of them off.`;
+  }
+  const lines = [
+    `  \u2713 security headers on every response \`${limits.target}\` returns: ${names.join(", ")}.`
+  ];
+  const sendsCsp = names.some((name) => name.startsWith("Content-Security-Policy"));
+  if (sendsCsp && !limits.mintsNonce) {
+    lines.push(
+      `    - The CSP carries no nonce: this target serves HTML written at build time,`,
+      `      so there is no per-request value to put on a script tag. An inline`,
+      `      <script> is refused by \`script-src 'self'\` here, while the same page`,
+      `      under \`theokit start\` gets a nonce and runs it. Move inline scripts to`,
+      `      \`<script src="...">\`, or set \`security.headers.cspMode: 'report-only'\``,
+      `      while you migrate.`
+    );
+  }
+  if (limits.documentHeaders === "platform-configured") {
+    lines.push(
+      `    - The HTML document is served by the platform's static host, and reaches`,
+      `      the browser with these headers through config this build emits. That`,
+      `      path is not verified by a deploy from here \u2014 the values come from the`,
+      `      same function the handler uses, but no response has been read back.`
+    );
+  }
+  if (limits.documentHeaders === "platform-unmanaged") {
+    lines.push(
+      `    - The HTML document does NOT pass through this handler \u2014 the platform's`,
+      `      static host serves it \u2014 so these headers reach \`/api/*\` responses and`,
+      `      not the page. This build emits no artifact that could configure it, so`,
+      `      set the document's headers on the platform (usetheokit/theokit#412).`
+    );
+  }
+  return lines.join("\n");
+}
+
+// src/adapters/deployed-runtime-config.ts
+function serverDirLiteral(opts) {
+  return JSON.stringify(opts.serverDir ?? "server");
+}
+function agentsDirLiteral(opts) {
+  return JSON.stringify(opts.agentsDir ?? "agents");
+}
+var EMPTY2 = {
+  imports: [],
+  declarations: [],
+  executeRouteSpread: ""
+};
+function deployedRuntimeConfigFragment(options) {
+  const pluginsModule = options?.runtimeConfigModule;
+  const serialization = options?.serialization === "superjson" ? "superjson" : void 0;
+  if (pluginsModule === void 0 && serialization === void 0) return EMPTY2;
+  const imports = [];
+  const declarations = [];
+  const spread = [];
+  if (pluginsModule !== void 0) {
+    imports.push(
+      `import { createPluginRunnerFromConfig } from 'theokit/server'`,
+      `// #425 \u2014 the app's own plugins, resolved on the build machine and written beside this entry.`,
+      `// A closure has no literal, so this is an import rather than a baked value.`,
+      `import theoRuntimeConfig from '${pluginsModule}'`
+    );
+    declarations.push(
+      `// Built ONCE, at module load. A runner rebuilt per request would re-run every plugin's`,
+      `// \`register\`, which is where a plugin allocates the state its hooks then read.`,
+      `const THEO_PLUGIN_RUNNER = createPluginRunnerFromConfig(theoRuntimeConfig.plugins)`
+    );
+    spread.push(`pluginRunner: await THEO_PLUGIN_RUNNER`);
+  }
+  if (serialization !== void 0) {
+    imports.push(`import { resolveTransformer } from 'theokit/server'`);
+    declarations.push(
+      `// #425 \u2014 a literal, because \`config.serialization\` is a SELECTOR and not a transformer.`,
+      `// Same string, same function \`theokit start\` calls, so the deployed response and the local`,
+      `// one cannot disagree about what the app asked for \u2014 including the \`x-theo-transformer\``,
+      `// header, whose absence is what made this a data bug rather than a formatting one.`,
+      `const THEO_TRANSFORMER = resolveTransformer('${serialization}')`
+    );
+    spread.push(`transformer: THEO_TRANSFORMER`);
+  }
+  return { imports, declarations, executeRouteSpread: `${spread.join(", ")},` };
+}
+
+// src/adapters/deployed-trace.ts
+function deployedTraceFragment(requestVar, indent) {
+  return [
+    `${indent}// #410 \u2014 honour the caller's trace id instead of minting a new one, and echo it.`,
+    `${indent}// \`extractTraceIdFromRequest\` validates the caller-controlled \`x-request-id\``,
+    `${indent}// before trusting it, and falls back to a fresh UUID when neither header is present.`,
+    `${indent}const requestId = extractTraceIdFromRequest(${requestVar})`,
+    `${indent}res.setHeader('x-request-id', requestId)`,
+    `${indent}res.setHeader(TRACE_HEADER, requestId)`
+  ];
+}
+
+export {
+  scannedFromLoaderCache,
+  JSON_NOT_FOUND_RESPONSE,
+  deployedAgentsFragment,
+  deployedCorsFragment,
+  deployedCsrfFragment,
+  securityHeadersDeclarations,
+  describeDeployedSecurityHeaders,
+  serverDirLiteral,
+  agentsDirLiteral,
+  deployedRuntimeConfigFragment,
+  deployedTraceFragment
+};
+//# sourceMappingURL=chunk-FFGP2LGQ.js.map

package/dist/chunk-FFGP2LGQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapters/deployed-agents.ts","../src/adapters/deployed-cors.ts","../src/adapters/deployed-csrf.ts","../src/adapters/security-headers.ts","../src/adapters/deployed-runtime-config.ts","../src/adapters/deployed-trace.ts"],"sourcesContent":["/**\n * Serving an agent from a generated deploy entry (usetheokit/theokit#367).\n *\n * ## The gap this closes\n *\n * `grep -rc \"agent\" packages/theo/src/adapters/*.ts` used to return nothing across 14 files. The\n * notion did not exist in this layer at all: every generated entry routes `/api/` exclusively\n * through `scanServerRoutes` + `executeRoute`, and an agent is a DIFFERENT scan served by a\n * DIFFERENT function — `scanAgents` + `mountAgent`. So `/api/agents/chat` matched no file route and\n * fell into `notFoundResponse()` on every target.\n *\n * For a framework whose stated reason to exist is \"the agent is a file, delivered by the same\n * pipeline that serves the page\", that is the gap which contradicts the sentence: the agent was\n * delivered by no pipeline at all outside a machine running `theokit start`.\n *\n * ## Why baking, and why `../../`\n *\n * A Worker has no filesystem to scan and no path to `import()`, which is the same reason routes are\n * baked (#369). The agent modules are resolved on the build machine and emitted as static imports,\n * relative to the entry's directory — every target that can do this writes two levels below the\n * project root, so the arithmetic is the one `renderBakedRoutes` already does.\n *\n * ## Which targets can do it\n *\n * Only the ones whose output is BUNDLED from the project: `cloudflare` (wrangler), `bun` and\n * `deno-deploy` resolve the emitted import against the app's own source tree. `vercel`, `netlify`\n * and `aws-lambda` receive a standalone function directory that never sees the app's modules, so\n * an agent cannot travel there by this road at all. Same split as plugins (#425), same cause.\n *\n * ## The table is keyed by NAME\n *\n * The URL carries the name, the access policy is judged under the name, and the run's spans are\n * labelled with it (#406). Keying by file path would make the lookup depend on the server's\n * directory layout — which changes per deploy, and which is exactly the value #406 removed from\n * telemetry for the same reason.\n */\n\n/** One agent, as `scanAgents` reports it. Structural, so the adapters need no `server/` import. */\nexport interface DeployedAgent {\n  /** Path relative to the project root — the specifier the static import uses. */\n  readonly filePath: string\n  /** The URL the agent answers on. */\n  readonly agentPath: string\n  /** The agent's NAME — what the URL carries, the policy is judged under, and spans are labelled. */\n  readonly name: string\n}\n\nexport interface DeployedAgentsFragment {\n  /** Top-level imports of the agent modules. */\n  readonly imports: string[]\n  /** Module-scope declarations — the name→module table. */\n  readonly declarations: string[]\n  /** The request-handler branch, to be emitted before the file-route table is consulted. */\n  readonly branch: string[]\n  /**\n   * SI-020 — the condition a host ANDs into its non-API early-return guard, so an agent card path\n   * is not handed to static assets before this fragment's branch is reached.\n   *\n   * Empty string when the fragment emits nothing, so a host that interpolates it unconditionally\n   * never references a name that was not declared.\n   */\n  readonly hostBypass: string\n}\n\nconst EMPTY: DeployedAgentsFragment = { imports: [], declarations: [], branch: [], hostBypass: '' }\n\n/**\n * How the host entry names the things this branch has to use.\n *\n * The fragment is generated code injected into three entries that do NOT agree on their own\n * vocabulary — Bun reads `pathname`, Cloudflare reads `url.pathname`; Deno calls `notFound()`,\n * Cloudflare calls `notFoundResponse()`; Cloudflare wraps each branch in the security baseline\n * while Bun and Deno wrap once at the caller; Deno resolves npm packages with an `npm:` prefix.\n *\n * Naming those differences is what keeps this ONE fragment. The alternative — three near-identical\n * branches, one per adapter — is the copy that `serveThroughPluginLifecycle` was extracted to undo\n * after it had drifted five ways (#405).\n */\n/**\n * How the target REACHES its agent modules — and the two answers are genuinely different, not a\n * copy waiting to be merged.\n *\n * A Worker has no filesystem: its agents must be resolved on the build machine and emitted as\n * static imports, which is what `renderBakedRoutes` already does for routes there. Bun and Deno DO\n * have a filesystem and already scan their routes at request time; making them bake would couple an\n * agent's existence to a rebuild for no gain. The split mirrors the one routes already have on\n * exactly these targets, which is the argument for keeping it.\n */\nexport type DeployedAgentsSource =\n  | {\n      readonly kind: 'baked'\n      /** Scanned on the build machine, emitted as static imports. */\n      readonly agents: readonly DeployedAgent[]\n      /**\n       * B-185 — the app's `server/context.ts`, as a specifier relative to the emitted entry, or\n       * `undefined` when the app has none. A Worker has no filesystem on which to find it, so it is\n       * baked like the agent modules beside it (ADR 0014). `undefined` is the ordinary case for an\n       * app that declares no context, and emitting an import of a file that is not there would\n       * fail the BUILD rather than the request — which is why `planDeployedPlugins` takes the same\n       * road for plugins.\n       */\n      readonly contextModule?: string\n    }\n  | {\n      readonly kind: 'scan'\n      /** Expression yielding the project root at runtime. */\n      readonly projectRoot: string\n      /** Expression yielding the module loader the entry already builds. */\n      readonly loadModule: string\n      /**\n       * A statement that guarantees `loadModule` is usable, for a host that builds its loader\n       * lazily. Deno's `loaderCache` is created on the route path, which runs AFTER this branch —\n       * so without this the agent branch would call `null`.\n       */\n      readonly ensureLoader?: string\n      /** The configured agents directory as a quoted literal. Absent ⇒ `scanAgents` defaults to `agents`. */\n      readonly agentsDirLiteral?: string\n      /**\n       * B-185 — an expression yielding the app's `server/` directory, which this host already\n       * declares (`bun.ts:95`, `deno-deploy.ts:69`) and already hands to `executeRoute`. A host\n       * with a filesystem locates its own `context.ts`, so it needs no baking (ADR 0014, and the\n       * split `deployed-agents.ts` already argues for routes two docblocks above).\n       */\n      readonly serverDir?: string\n    }\n\nexport interface DeployedAgentsHost {\n  /** Expression yielding the request path inside the handler. Default `url.pathname`. */\n  readonly pathname?: string\n  /** Call producing the 404 response. Default `notFoundResponse()`. */\n  readonly notFound?: string\n  /** Whether THIS branch applies the security baseline, or the caller already does. */\n  readonly wrapSecurityHeaders?: boolean\n  /** Prefix for bare package specifiers. Deno needs `npm:`; the others need nothing. */\n  readonly importPrefix?: string\n  /**\n   * Expression yielding the entry's plugin runner, or `undefined` when the app declared no plugins\n   * and the build emitted no module to bind.\n   *\n   * `deployedRuntimeConfigFragment` already declares `const THEO_PLUGIN_RUNNER` at module scope and\n   * spreads `pluginRunner: await THEO_PLUGIN_RUNNER` into `executeRoute`; an adapter passes that\n   * same expression here rather than building a second runner, because a runner rebuilt per request\n   * re-runs every plugin's `register` -- which is where a plugin allocates the state its hooks read.\n   */\n  readonly pluginRunnerExpr?: string\n}\n\n/**\n * The two `AuxRouteDeps` fields a deployed entry must supply to match what dev already does.\n *\n * Both dev callers pass them — `vite-plugin/agent-middleware.ts:161,164` and\n * `cli/commands/start/handlers.ts:226,229` — and a first draft of this fragment passed neither,\n * on a quotation from `serve-aux-routes.ts:83-85` that names three routes (\"card, approvals,\n * stream\") while the dispatcher serves six. Two reviewers measured the same two consequences:\n *\n * - `csrfMode` unset defaults to `'strict'` (`serve-aux-routes.ts:379`), so an app declaring\n *   `security: { csrf: 'off' }` got `off` on `POST /api/agents/<name>` and `strict` on its `/mcp`\n *   sibling one line away — verbatim the divergence `deployed-csrf.ts`'s own header exists to\n *   record, re-created on a route this slice had just made reachable.\n * - `resolveApiKey` unset makes the thread follow-up answer a permanent 501 on every deploy\n *   target (`serve-aux-routes.ts:359-365`), naming a framework-internal parameter to the caller.\n *\n * Both values are already in scope: `CSRF_CONFIG` is spread into `mountAgent` in the same emitted\n * function, and `resolveProvider` is already on its import line.\n */\nconst AUX_DEPS_PARITY = [\n  `        ...CSRF_CONFIG,`,\n  `        resolveApiKey: (model, plugins) => resolveProvider(model, { plugins }).apiKey,`,\n] as const\n\n/** The prefix the agent convention owns. Matches `handlers.ts`'s own `tryServeAgent`. */\nconst AGENT_PREFIX = '/api/agents/'\n\n/**\n * The second shape the aux dispatcher owns. `matchGetAuxRoute` serves M15's\n * `GET /.well-known/<name>/agent-card.json`, and a guard admitting only {@link AGENT_PREFIX} left\n * five of the dispatcher's six families reachable on a deploy target and excluded the sixth — by\n * the guard, not by a decision, and silently.\n *\n * A prefix rather than the matcher's own `isAgentCardPath`: the guard exists to keep a url nobody\n * answers from paying for anything, and importing the matcher's predicate into every emitted entry\n * would buy a narrower pre-filter at the cost of a module the branch already declines without.\n */\nconst WELL_KNOWN_PREFIX = '/.well-known/'\n\n/**\n * What a deployed entry needs in order to serve the app's agents.\n *\n * @param agents - the agents scanned on the build machine. Empty emits nothing at all.\n */\n/**\n * The scan source every filesystem host with a lazily-created loader shares.\n *\n * Four adapters — `netlify`, `vercel`, `aws-lambda`, `deno-deploy` — emit an entry that resolves\n * `serverDir` itself, caches its loader in `loaderCache`, and creates that cache on first use.\n * They therefore hand this fragment the SAME six fields, and writing them out four times is the\n * copy `serveThroughPluginLifecycle` was extracted to undo after it had drifted five ways (#405).\n *\n * B-235 is what made it four: wiring three more targets duplicated the block three more times, and\n * the duplication gate on new code is what said so — 4.2% against a 3% ceiling. The gate was right\n * and the fix is the one it implies, not a threshold.\n *\n * `bun` is deliberately NOT a caller. It names its loader `loadModule` and creates it eagerly, so\n * it has no `ensureLoader` — a parameter to cover that difference would make this function a\n * switch over its callers, which is the shape that drifts.\n */\nexport function scannedFromLoaderCache(agentsDirLiteral?: string): DeployedAgentsSource {\n  return {\n    kind: 'scan',\n    projectRoot: 'cwd',\n    agentsDirLiteral,\n    loadModule: 'loaderCache',\n    serverDir: 'serverDir',\n    ensureLoader: 'if (!loaderCache) loaderCache = createProductionLoader()',\n  }\n}\n\n/**\n * The JSON 404 `vercel` and `aws-lambda` answer a routing miss with.\n *\n * An expression rather than a call, because the fragment interpolates `notFound` into a `return`\n * and neither host declares a helper for it.\n */\nexport const JSON_NOT_FOUND_RESPONSE = `new Response(JSON.stringify({ error: { code: 'NOT_FOUND' } }), { status: 404, headers: { 'content-type': 'application/json' } })`\n\nexport function deployedAgentsFragment(\n  source: DeployedAgentsSource | undefined,\n  host: DeployedAgentsHost = {},\n): DeployedAgentsFragment {\n  if (source === undefined) return EMPTY\n  if (source.kind === 'baked' && source.agents.length === 0) return EMPTY\n\n  const pathname = host.pathname ?? 'url.pathname'\n  const notFound = host.notFound ?? 'notFoundResponse()'\n  const prefix = host.importPrefix ?? ''\n\n  const resolution =\n    source.kind === 'baked'\n      ? bakedResolution(source.agents, source.contextModule, host.pluginRunnerExpr)\n      : scannedResolution({ ...source, pluginRunnerExpr: host.pluginRunnerExpr })\n\n  return {\n    hostBypass: ` && !__theoIsAgentCardPath(${pathname})`,\n    imports: [\n      // `theokit/adapters/agent-mount`, not `theokit/server`: `mount-agent` is deliberately not on\n      // the app-facing surface (ADR 0041), and a generated entry is not an app. See that module.\n      // B-185 — the identity entry differs by host: a filesystem host LOCATES its own\n      // `context.ts`, a Worker is handed the baked factory (ADR 0014). `createWebShim` is not here\n      // because all three entries already import it at module level.\n      `import { mountAgent, resolveProvider, matchAgentAuxRoute, serveMatchedAuxRoute${resolution.identityImport}${source.kind === 'scan' ? ', scanAgents' : ''} } from '${prefix}theokit/adapters/agent-mount'`,\n      ...resolution.imports,\n    ],\n    declarations: [\n      ...resolution.declarations,\n      // SI-020 — the host's `/api/` guard decides between the API surface and static assets, and it\n      // runs BEFORE this branch. Widening the branch guard alone left the `.well-known` arm as dead\n      // code on all three targets: present in the source, unreachable in the emitted program. The\n      // host consults this predicate, so the card path escapes the asset branch and NOTHING else\n      // under `/.well-known/` does — a blanket prefix bypass would route `/.well-known/security.txt`\n      // away from assets, trading an unreachable card for a broken namespace.\n      //\n      // Same shape as `agent-card-handler.ts`'s own WELL_KNOWN. That is a COPY, not a shared\n      // definition, and saying otherwise was the claim an inventory judge falsified: changing the\n      // handler to serve `/agent.json` left every card test green, because this guard and that\n      // matcher are checked separately and never against each other. The drift that matters here —\n      // this guard narrowing while the matcher still serves the path — is caught by\n      // `a-deployed-worker-reaches-the-agent-card.test.ts`, which drives a real request. The other\n      // direction is not, and is the honest limit of this line.\n      String.raw`const __theoIsAgentCardPath = (p) => /^\\/\\.well-known\\/[^/]+\\/agent-card\\.json$/.test(p)`,\n      // B-185 — one factory, two call sites: the aux branch on a hit, and the run handler below.\n      // Declared rather than inlined twice so the mechanism ADR 0014 decides has a single home.\n      // `async` because the entry's plugin runner is a promise: `createPluginRunnerFromConfig` is\n      // async, so the runtime-config fragment declares `const THEO_PLUGIN_RUNNER = createPluginRunnerFromConfig(...)`\n      // WITHOUT awaiting it, and every consumer awaits at the point of use. `await` is a reserved\n      // word everywhere in an ES module, so a non-async factory carrying that binding does not\n      // merely misbehave -- the entry does not parse, and `tests/unit/adapter-entry-parses.test.ts`\n      // is where that is caught. It went red at HEAD before this line existed, on a first version\n      // of this fix whose own test asserted `toContain('await THEO_PLUGIN_RUNNER')`: the presence\n      // of the token that breaks the parse. That test file's header says why, in its own words --\n      // `toContain` does not care whether the string is a program.\n      //\n      // Laziness is unaffected. The shim was always built eagerly inside this factory; what ADR-1\n      // refuses is paying for a url nobody answers, and neither call site is reached by one.\n      `async function __theoResolveSubject(request) {`,\n      ...resolution.identity,\n      `  return resolveSubject`,\n      `}`,\n    ],\n    branch: [\n      `    // #367 — the agent convention owns this prefix. It is answered BEFORE the file-route`,\n      `    // table because an agent matches no file route: falling through is how a deployed`,\n      `    // \\`/api/agents/<name>\\` used to 404 on every target.`,\n      `    if (`,\n      `      ${pathname}.startsWith(${JSON.stringify(AGENT_PREFIX)}) ||`,\n      `      ${pathname}.startsWith(${JSON.stringify(WELL_KNOWN_PREFIX)})`,\n      `    ) {`,\n      ...resolution.auxPrelude,\n      `      // B-185 — the aux dispatcher is asked FIRST, and declining costs nothing: the matcher`,\n      `      // reads the url and the scanned nodes, never a module (ADR-1). A miss falls through to`,\n      `      // the run handler exactly as before, so this branch owns the sub-paths and nothing more.`,\n      `      const auxRoute = await matchAgentAuxRoute(request.method, ${pathname}, auxDeps)`,\n      `      if (auxRoute !== null) {`,\n      `        // B-185 — identity is resolved only now. Building it costs a web shim and, where the`,\n      `        // app declares one, a call into its own \\`createContext\\`; a url this dispatcher`,\n      `        // merely declined must pay for neither (resolve-agent-subject.ts:93-96).`,\n      `        const auxResponse = await serveMatchedAuxRoute(auxRoute, request, {`,\n      `          ...auxDeps,`,\n      `          resolveSubject: await __theoResolveSubject(request),`,\n      `        })`,\n      host.wrapSecurityHeaders === true\n        ? `        return withSecurityHeaders(auxResponse, SECURITY_HEADERS)`\n        : `        return auxResponse`,\n      `      }`,\n      `      // B-185 — only the agent prefix has a run handler behind it. A \\`.well-known\\` url the`,\n      `      // dispatcher declined must NOT slice a prefix it does not carry: the name would be`,\n      `      // garbage and mountAgent would answer 500 for what is a routing miss.`,\n      `      if (!${pathname}.startsWith(${JSON.stringify(AGENT_PREFIX)})) return ${notFound}`,\n      `      const agentName = ${pathname}.slice(${String(AGENT_PREFIX.length)}).split('/')[0]`,\n      ...resolution.lookup,\n      `      // A name nobody scanned is a 404, exactly like any other unknown path. Handing`,\n      `      // \\`undefined\\` to mountAgent would surface as a 500 for what is a routing miss.`,\n      `      if (mod === undefined) return ${notFound}`,\n      `      const agentResponse = await mountAgent(mod, request, (model, plugins) => resolveProvider(model, { plugins }).apiKey, {`,\n      `        agentName,`,\n      `        // B-185 — mount-agent.ts:121 has accepted this since #365 and 0 of 23 adapters passed`,\n      `        // one, so agent-access.ts:146 judged every deployed policy against \\`subject: null\\`.`,\n      `        // A run is not a decline: it is about to do real work, so the shim this builds is not`,\n      `        // the cost ADR-1 refuses.`,\n      `        resolveSubject: await __theoResolveSubject(request),`,\n      `        ...CSRF_CONFIG,`,\n      `      })`,\n      host.wrapSecurityHeaders === true\n        ? `      return withSecurityHeaders(agentResponse, SECURITY_HEADERS)`\n        : `      return agentResponse`,\n      `    }`,\n    ],\n  }\n}\n\ninterface AgentResolution {\n  imports: string[]\n  declarations: string[]\n  /** Lines that must leave `mod` bound to the agent's module, or `undefined`. */\n  lookup: string[]\n  /**\n   * B-185 — lines that must leave `auxDeps` bound to an `AuxRouteDeps`, plus the expression for\n   * its `agents`. They run BEFORE {@link AgentResolution.lookup} so a declined aux route performs\n   * no module load, which is what ADR-1 buys and what a later ordering would spend.\n   */\n  auxPrelude: string[]\n  /**\n   * B-185 — lines that must leave `resolveSubject` bound to a resolver, or to `undefined`. Emitted\n   * only where a match has already happened, because building one costs a web shim and\n   * `resolve-agent-subject.ts:93-96` states that a declined url must never run the application's\n   * `createContext`.\n   */\n  identity: string[]\n  /**\n   * B-185 — what {@link AgentResolution.identity} imports, appended to the `agent-mount` line, or\n   * `''` where identity is not resolved at all.\n   *\n   * It lives HERE, beside the lines that CALL it, because a first draft decided it in a separate\n   * `identityEntryFor` that switched the same discriminated union a second time. The two could not\n   * disagree then — the conditions were identical — which is what made it latent rather than live.\n   * A later drift would emit an entry that CALLS a symbol it never imported, and nothing catches\n   * that: the stub-coverage guard derives its requirement FROM the imports, so a missing import\n   * shrinks the requirement instead of failing, and `node --check` is syntax rather than\n   * resolution. It would surface as a `ReferenceError` inside a deployed Worker.\n   */\n  identityImport: string\n}\n\n/** No filesystem: every agent module is a static import decided on the build machine. */\nfunction bakedResolution(\n  agents: readonly DeployedAgent[],\n  contextModule: string | undefined,\n  pluginRunnerExpr: string | undefined,\n): AgentResolution {\n  const varOf = (index: number): string => `__theoAgent${String(index)}`\n  return {\n    imports: [\n      ...agents.map((agent, index) => `import * as ${varOf(index)} from '../../${agent.filePath}'`),\n      // B-185 — the app's context module, baked exactly like the agents above it (ADR 0014).\n      ...(contextModule === undefined\n        ? []\n        : [\n            // SI-022 — DYNAMIC, not a top-level static import. B-185 added this import; before it\n            // a Worker did not load the app's `server/context.ts` at all. A module-scope throw\n            // there — the commonest shape being a required-env-var check — then went from costing\n            // nothing to taking the ENTIRE target down: the import fails, the module never\n            // evaluates, and every route dies rather than only the one that wanted an identity.\n            //\n            // That is strictly worse than what `resolve-agent-subject.ts:69-72` promises. It says\n            // a throwing `createContext` reaches the branch's own error handler and becomes a 500,\n            // which is a failure scoped to the request that needed identity. A throw at IMPORT\n            // time reaches no handler at all.\n            //\n            // A relative `import()` is statically analysable, so wrangler bundles the module\n            // exactly as it bundled the static form — the reason ADR 0014 bakes it is unaffected.\n            // What changes is WHEN it evaluates, and therefore what a failure costs. It is only\n            // a real improvement if the import stays inside the thunk; see the factory below.\n            `const __theoContext = () => import('../../${contextModule}')`,\n          ]),\n    ],\n    declarations: [\n      `// #367 — the app's agents, keyed by NAME because that is what the URL carries, what the`,\n      `// access policy is judged under, and what the run's spans are labelled with (#406).`,\n      `const agents = {`,\n      ...agents.map((agent, index) => `  ${JSON.stringify(agent.name)}: ${varOf(index)},`),\n      `}`,\n      `// B-185 — the node list the aux dispatcher matches a url against. There is deliberately NO`,\n      `// second table keyed by file path: \\`test_the_table_is_keyed_by_agent_name_not_by_file_path\\``,\n      `// forbids one, and the reason it gives is the right one — a path key makes a lookup depend on`,\n      `// the server's directory layout. The loader below reaches the module THROUGH this list, so the`,\n      `// layout appears once, here, and the module table above stays keyed by the name the URL, the`,\n      `// access policy and the run's spans all carry (#406).`,\n      `const agentNodes = [`,\n      ...agents.map(\n        (agent) =>\n          `  { filePath: ${JSON.stringify(agent.filePath)}, agentPath: ${JSON.stringify(agent.agentPath)}, name: ${JSON.stringify(agent.name)} },`,\n      ),\n      `]`,\n    ],\n    lookup: [\n      `      const mod = Object.prototype.hasOwnProperty.call(agents, agentName)`,\n      `        ? agents[agentName]`,\n      `        : undefined`,\n    ],\n    identityImport: contextModule === undefined ? '' : ', createSubjectResolverFromFactory',\n    identity:\n      contextModule === undefined\n        ? [\n            `  // B-185 — this app declares no \\`server/context.ts\\`, so there is no factory to`,\n            `  // bake and an anonymous caller is the honest answer. A policy that admits`,\n            `  // nobody is the correct outcome, not an error.`,\n            `        const resolveSubject = undefined`,\n          ]\n        : [\n            `  // B-185 — a Worker has no filesystem to find \\`context.ts\\` on, so the module is baked`,\n            `  // and its factory handed straight to the resolver (ADR 0014).`,\n            `  //`,\n            `  // This function has TWO callers and is lazy on purpose. Both build a shim, and that is`,\n            `  // correct at both: the aux branch calls it only AFTER a match, and the run handler is`,\n            `  // about to do real work. What neither pays for is the app's own \\`createContext\\` on a`,\n            `  // url nobody answers — the resolver is a thunk, and \\`agent-access.ts:146\\` returns early`,\n            `  // for an absent or public policy without ever invoking it.`,\n            `        const { req: __theoReq, res: __theoRes } = createWebShim(request)`,\n            `  const resolveSubject = createSubjectResolverFromFactory(`,\n            // The import happens HERE, inside the factory, and `createSubjectResolverFromFactory`\n            // calls the factory inside the thunk it returns (`resolve-agent-subject.ts:127-133`).\n            // A first version of this fix awaited the import as an ARGUMENT, which evaluated it\n            // eagerly inside `__theoResolveSubject` — both call sites await that before\n            // `agent-access.ts:145` returns early for an absent or `'public'` policy. The blast\n            // radius was then every agent request rather than the one that wanted an identity,\n            // and the laziness invariant the lines above assert was broken. Found by the\n            // inventory judge while the change was still in the working tree.\n            `    async (__theoArgs) => (await __theoContext()).createContext(__theoArgs),`,\n            `    __theoReq,`,\n            `    __theoRes,`,\n            `    ${pluginRunnerExpr ?? 'undefined'},`,\n            `  )`,\n          ],\n    auxPrelude: [\n      `      // B-185 — the aux dispatcher needs nodes carrying \\`filePath\\` and a loader keyed by it.`,\n      `      // The loader resolves the path to a NAME through the node list, then reads the same`,\n      `      // name-keyed table the url lookup uses: one map, one layout mention, no filesystem`,\n      `      // (ADR-2). A linear find over a handful of agents is not worth a second table that`,\n      `      // \\`test_the_table_is_keyed_by_agent_name_not_by_file_path\\` exists to forbid.`,\n      `      const auxDeps = {`,\n      `        agents: agentNodes,`,\n      `        loadModule: async (filePath) => {`,\n      `          const node = agentNodes.find((a) => a.filePath === filePath)`,\n      `          return node === undefined ? undefined : agents[node.name]`,\n      `        },`,\n      `        baseUrl: url.origin,`,\n      ...AUX_DEPS_PARITY,\n      `      }`,\n    ],\n  }\n}\n\n/** A filesystem: scan once and load on demand, exactly as this entry already treats its routes. */\nfunction scannedResolution(source: {\n  projectRoot: string\n  loadModule: string\n  ensureLoader?: string\n  agentsDirLiteral?: string\n  serverDir?: string\n  pluginRunnerExpr?: string\n}): AgentResolution {\n  // The configured directory as a second argument, or nothing. `scanAgents` defaults the name to\n  // `agents`, which is right for a project that never set one and wrong for every project that did.\n  const agentsDirArg = source.agentsDirLiteral === undefined ? '' : `, ${source.agentsDirLiteral}`\n\n  return {\n    imports: [],\n    declarations: [\n      `// #367 — scanned on first use and cached, the same shape this entry already gives routes.`,\n      `// Baking would tie an agent's existence to a rebuild on a target that has a filesystem.`,\n      `let agentsCache = null`,\n    ],\n    lookup: [\n      `      const agentNode = agentsCache.find((a) => a.name === agentName)`,\n      `      const mod = agentNode === undefined ? undefined : await ${source.loadModule}(agentNode.filePath)`,\n    ],\n    identityImport: source.serverDir === undefined ? '' : ', createAgentSubjectResolver',\n    identity:\n      source.serverDir === undefined\n        ? [`        const resolveSubject = undefined`]\n        : [\n            `  // B-185 — this host HAS a filesystem, so it locates its own \\`context.ts\\` and the`,\n            `  // existing resolver works unchanged; nothing is baked (ADR 0014). Lazy for the reason`,\n            `  // the baked branch gives: both callers build a shim, and neither runs the app's own`,\n            `  // \\`createContext\\` for a url nobody answers.`,\n            `        const { req: __theoReq, res: __theoRes } = createWebShim(request)`,\n            `  const resolveSubject = createAgentSubjectResolver({`,\n            `    req: __theoReq,`,\n            `    res: __theoRes,`,\n            `    loadModule: ${source.loadModule},`,\n            `    serverDir: ${source.serverDir},`,\n            `    pluginRunner: ${source.pluginRunnerExpr ?? 'undefined'},`,\n            `        })`,\n          ],\n    auxPrelude: [\n      ...(source.ensureLoader === undefined ? [] : [`      ${source.ensureLoader}`]),\n      `      // B-185 — hoisted above the lookup so a declined aux route loads no module. The scan`,\n      `      // LISTS agent files; it imports none, so moving it here costs a declined request`,\n      `      // nothing it was not already paying.`,\n      `      if (!agentsCache) agentsCache = scanAgents(${source.projectRoot}${agentsDirArg})`,\n      `      const auxDeps = {`,\n      `        agents: agentsCache,`,\n      `        loadModule: ${source.loadModule},`,\n      `        baseUrl: url.origin,`,\n      ...AUX_DEPS_PARITY,\n      `      }`,\n    ],\n  }\n}\n","/**\n * The CORS configuration a deployed entry carries, baked at build time.\n *\n * ## The defect this closes\n *\n * `security.cors` reached exactly one consumer: Vite's `configureServer` hook. So an app that\n * worked cross-origin under `theokit dev` stopped working the moment anything else served it —\n * `theokit start` (fixed separately) and all six Web deploy targets (usetheokit/theokit#409). Same\n * config, same code, no error and no warning; the failure surfaces in a browser as a blocked fetch\n * on the deployed URL, three layers from the key that had quietly stopped being read.\n *\n * The pure half was written twice and called once: `createCorsWebHandler` — the Web mirror — had no\n * caller anywhere in the repository. Nothing here reimplements it.\n *\n * ## A callback origin is REFUSED, not silently dropped\n *\n * `corsSchema.origins` accepts `z.function(...)` alongside the string / RegExp / array shapes. A\n * deployed function has no `theo.config.ts` to read, and there is no literal for a closure — so a\n * build that baked only the serialisable shapes would produce an app whose CORS silently allowed\n * nothing, which is the exact class of failure this issue reports.\n *\n * `rules/three-target-parity.md` § 3 is explicit about the alternative: \"a target that cannot serve\n * a capability refuses by name. Silent degradation is the failure mode this rule exists to\n * prevent.\" So the build throws, naming the target, the key and the two ways forward.\n */\nimport type { TheoConfig } from '../config/schema.js'\n\ntype CorsConfig = NonNullable<NonNullable<TheoConfig['security']>['cors']>\n\n/**\n * The CORS slice of an adapter's build options.\n *\n * Narrow and named once, matching how `securityHeaders` and `DeployedCsrfOptions` already reach the\n * emitters: each renderer receives what it uses, and six signatures name one type instead of six\n * inline shapes that can drift.\n */\nexport interface DeployedCorsOptions {\n  cors?: CorsConfig\n}\n\n/**\n * Thrown at BUILD time when the declared CORS cannot be carried to a deployed target.\n *\n * A build error is the point: the alternative is a deploy that looks configured and refuses every\n * cross-origin request, discovered by a browser rather than by the build.\n */\nexport class UnserializableCorsOriginError extends Error {\n  constructor(target: string) {\n    super(\n      `security.cors.origins is a function, and the \\`${target}\\` target cannot carry it: a deployed ` +\n        `function has no theo.config.ts to read, and a callback cannot be written into the emitted ` +\n        `entry. Replace it with the origin, a RegExp, or an array of either — all of which travel — ` +\n        `or build for \\`node\\` and run \\`theokit start\\`, which evaluates the callback at runtime.`,\n    )\n    this.name = 'UnserializableCorsOriginError'\n  }\n}\n\n/** Source text for one origin matcher: a RegExp as a literal, anything else as JSON. */\nfunction renderOrigin(origin: unknown, target: string): string {\n  if (typeof origin === 'function') throw new UnserializableCorsOriginError(target)\n  if (origin instanceof RegExp) return String(origin)\n  if (Array.isArray(origin)) return `[${origin.map((o) => renderOrigin(o, target)).join(', ')}]`\n  return JSON.stringify(origin)\n}\n\n/**\n * Source text for the CORS config, or `undefined` when the app declared none.\n *\n * RegExp entries are emitted as regex literals for the reason `deployed-csrf.ts` gives at length:\n * `JSON.stringify` renders a RegExp as `{}`, and `matchesOrigin` checks `instanceof RegExp`, so a\n * JSON-rendered origin would sit in the emitted file looking configured and matching nothing.\n *\n * @throws UnserializableCorsOriginError when `origins` is a callback\n */\nexport function renderDeployedCorsLiteral(cors: CorsConfig | undefined, target: string): string {\n  if (cors === undefined) return 'undefined'\n\n  const parts = [`origins: ${renderOrigin(cors.origins, target)}`]\n  if (cors.methods !== undefined) parts.push(`methods: ${JSON.stringify(cors.methods)}`)\n  if (cors.allowedHeaders !== undefined)\n    parts.push(`allowedHeaders: ${JSON.stringify(cors.allowedHeaders)}`)\n  if (cors.exposedHeaders !== undefined)\n    parts.push(`exposedHeaders: ${JSON.stringify(cors.exposedHeaders)}`)\n  // Both carry schema defaults, so they are always present and always emitted — unlike the\n  // optional fields above, whose absence is a real answer the handler already has one for.\n  parts.push(\n    `credentials: ${JSON.stringify(cors.credentials)}`,\n    `maxAge: ${JSON.stringify(cors.maxAge)}`,\n  )\n\n  return `{ ${parts.join(', ')} }`\n}\n\n/**\n * The lines that declare the CORS handler in a generated entry.\n *\n * `null` when nothing was declared, which is what \"no cors block\" meant before and still means: no\n * headers, not permissive ones.\n */\nexport function deployedCorsFragment(cors: CorsConfig | undefined, target: string): string[] {\n  return [\n    `// #409 — the CORS the app declared, carried as a literal because a deployed function has no`,\n    `// theo.config.ts to read. \\`null\\` when the app declared none: no headers, not permissive ones.`,\n    `const CORS_CONFIG = ${renderDeployedCorsLiteral(cors, target)}`,\n    `const CORS_HANDLER = CORS_CONFIG === undefined ? null : createCorsWebHandler(CORS_CONFIG)`,\n    ``,\n    `/** Answer a preflight before routing — an OPTIONS the router handles never gets a CORS answer. */`,\n    `function corsPreflight(request) {`,\n    `  return CORS_HANDLER === null ? null : CORS_HANDLER.handlePreflightRequest(request)`,\n    `}`,\n    ``,\n    `/** Put the headers on whatever the app answered, including its 404s — a browser reads a 404`,\n    ` *  without them as a CORS failure rather than as the 404 it is. */`,\n    `function withCors(request, response) {`,\n    `  if (CORS_HANDLER !== null) CORS_HANDLER.applyCorsHeaders(request, response.headers)`,\n    `  return response`,\n    `}`,\n  ]\n}\n","/**\n * The CSRF configuration a deployed entry carries, baked at build time.\n *\n * ## The defect this closes\n *\n * The six Web-standards adapter entries built `executeRoute`'s context from an eight-field\n * literal, and neither `csrfMode` nor `disallowed` was among the eight (usetheokit/theokit#410).\n * `executeRoute` defaults an absent mode to `'strict'`, so an app declaring\n * `security: { csrf: 'off' }` — or `'warn'` — got `'strict'` on every deploy target: a `POST` that\n * works under `theokit dev` and `theokit start` answers `403 CSRF_INVALID` on Vercel, naming a\n * mechanism the operator had switched off. The config still validated and the build still\n * succeeded; the behaviour simply changed.\n *\n * The deployed function has no `theo.config.ts` to read, which is why the value is carried as a\n * literal — the same shape `security.headers` already uses (`renderSecurityHeadersConfigLiteral`).\n *\n * ## Why this is not `JSON.stringify`\n *\n * `disallowed.routes` accepts RegExp entries (`config/schemas/security.ts`), and `JSON.stringify`\n * renders a RegExp as `{}`. That is not a formatting problem: `matchDisallowed` checks\n * `p instanceof RegExp`, so a `{}` matches nothing while reading, in the emitted file, as a rule\n * that is present and configured. Reaching for JSON here would reproduce this issue's own defect —\n * configuration that survives validation and quietly stops applying — one layer further down.\n */\nimport type { TheoConfig } from '../config/schema.js'\n\ntype SecurityConfig = NonNullable<TheoConfig['security']>\n\n/**\n * The two slices of `security` that reach `executeRoute`'s context.\n *\n * Narrow rather than the whole block, matching how `securityHeaders` is already passed: each\n * renderer receives what it uses and nothing else, so a headers change cannot reach the CSRF\n * literal and vice versa.\n */\nexport interface DeployedCsrfOptions {\n  csrf?: SecurityConfig['csrf']\n  disallowed?: SecurityConfig['disallowed']\n}\n\n/**\n * Source text for one route pattern.\n *\n * A RegExp is emitted as a regex literal so it arrives as a RegExp; a string goes through\n * `JSON.stringify`, which is the correct escaper for a JS string literal (quotes, backslashes,\n * control characters, line separators).\n */\nfunction renderRoutePattern(pattern: string | RegExp): string {\n  return pattern instanceof RegExp ? String(pattern) : JSON.stringify(pattern)\n}\n\n/**\n * Source text for the CSRF slice of `executeRoute`'s context.\n *\n * Absent values are OMITTED rather than defaulted. `executeRoute` already defaults an absent\n * `csrfMode` to `'strict'`, and writing `'strict'` here would put that default in a second place\n * where the two can disagree — which is the class of drift the whole issue is about.\n *\n * @param security - the declared csrf slices, or `undefined` when the app declared no security block\n */\nexport function renderDeployedCsrfLiteral(security: DeployedCsrfOptions | undefined): string {\n  if (security === undefined) return '{}'\n\n  const parts: string[] = []\n  if (security.csrf !== undefined) parts.push(`csrfMode: ${JSON.stringify(security.csrf)}`)\n\n  const { disallowed } = security\n  if (disallowed !== undefined) {\n    const routes = disallowed.routes.map(renderRoutePattern).join(', ')\n    parts.push(\n      `disallowed: { routes: [${routes}], behavior: ${JSON.stringify(disallowed.behavior)} }`,\n    )\n  }\n\n  // `{}` and not `{ }` when nothing was declared: the emitted file is read by people, and the\n  // two-space version reads as though something was meant to be there.\n  return parts.length === 0 ? '{}' : `{ ${parts.join(', ')} }`\n}\n\n/**\n * The lines that declare `CSRF_CONFIG` in a generated entry.\n *\n * One function rather than the same six lines pasted into each of the six adapters: that\n * duplication is how the eight-field context literal came to be wrong in six places at once, and\n * repeating the fix in the same shape would leave the next field with the same six places to be\n * forgotten in. It also keeps the two largest emitters under the `max-lines-per-function` ceiling,\n * which `vercel.ts` already extracts fragments to respect.\n *\n * @param opts - the declared csrf slices, passed straight through from the adapter's build options\n * @param home - what the target has instead of a config file, for the comment's second sentence\n */\nexport function deployedCsrfFragment(\n  opts: DeployedCsrfOptions,\n  home = 'a deployed function',\n): string[] {\n  return [\n    `// #410 — the CSRF mode and per-route escalation the app declared. Carried as a`,\n    `// literal for the same reason as the headers above: ${home} has no theo.config.ts`,\n    `// to read. Absent keys stay absent so executeRoute's own default ('strict') applies,`,\n    `// rather than this file becoming a second place it can drift.`,\n    `const CSRF_CONFIG = ${renderDeployedCsrfLiteral(opts)}`,\n  ]\n}\n","/**\n * The security headers a deployed target puts on its responses.\n *\n * `theokit start` applies the configured baseline to every response it writes\n * (`cli/commands/start/request-handler.ts`). None of the six Web-standards\n * deploy adapters applied any, so the same page carried a CSP,\n * `X-Frame-Options`, HSTS and `nosniff` under `theokit start` and none of them\n * once deployed (usetheokit/theokit#410, GHSA-87qq-fgcr-384x).\n *\n * This module is the seam that closes that half of the gap. It has two halves\n * and they live together on purpose: the code that writes the literal into a\n * generated entry and the code that reads it at request time have to agree on\n * one shape, and a shape stated in two files drifts.\n *\n * - **Build time** — {@link renderSecurityHeadersConfigLiteral} turns\n *   `security.headers` into a JSON literal the adapter inlines. A deployed\n *   runtime has no `theo.config.ts` to read, so the configuration travels as\n *   data.\n * - **Request time** — the generated entry calls {@link buildSecurityHeaders}\n *   on that literal and hands every response to {@link withSecurityHeaders}.\n *   The same function `theokit start` calls, on the same input, so the two\n *   cannot disagree about what the configuration means.\n *\n * ## The per-request nonce, and where it stops\n *\n * `buildSecurityHeaders` accepts a per-request `nonce` and substitutes it into\n * `script-src`. A nonce cannot survive a build-time literal — it is minted per\n * response — so a target reaches one only if it renders the HTML at request\n * time and can put the same value on the script tags it emits.\n *\n * Exactly one deploy path does: **Cloudflare with `ssrStreaming: true`**, whose\n * worker calls `renderStreamingWeb(request, { nonce })`, and that renderer\n * threads the value into `renderToReadableStream` and into the hydration script\n * (`router/entry-server.ts`). That branch mints a nonce per request and builds\n * its CSP from it. Everything else serves HTML written at build time, or no\n * HTML at all, and carries a **nonce-less CSP** — the same answer\n * `buildSecurityHeaders` already gives a prerendered route (EC-4), for the same\n * reason: a nonce in the header with no nonce on the tag blocks every inline\n * script.\n *\n * That asymmetry is real and is not smoothed over. It is stated in the emitted\n * entry, printed by the build through\n * {@link describeDeployedSecurityHeaders}, and written down in\n * `docs/surfaces/build-adapters.md`.\n */\nimport { generateNonce } from '../core/contracts/nonce.js'\nimport type { SecurityHeadersConfig } from '../core/contracts/security-headers.js'\nimport { buildSecurityHeaders } from '../core/contracts/security-headers.js'\n\n/**\n * Re-exported so a generated entry has ONE import for the whole concern.\n *\n * Reaching it through `theokit/server/security` would work and would also drag\n * that barrel's CSRF surface into a Worker bundle, for a function that is forty\n * lines of string concatenation. It is defined in `core/contracts/`, which is\n * the module every target may import from — `adapters → server` is not an edge\n * in the DAG, and the header policy was never server code.\n */\nexport { buildSecurityHeaders }\n\n/**\n * Re-exported for the same reason, and so the streamed Cloudflare worker mints\n * its nonce with the identical primitive `theokit start` uses\n * (`cli/commands/start/request-handler.ts`) rather than a second, hand-rolled\n * one. It is already runtime-portable: Web Crypto first, with a named error\n * when the runtime has none.\n */\nexport { generateNonce }\n\n/**\n * The `security.headers` block, as a literal a generated entry can carry.\n *\n * `{}` when the app declares none — which is not the same as \"no headers\".\n * `buildSecurityHeaders({})` returns the full default baseline, and `{}` is\n * exactly what `theokit start` passes when `security.headers` is absent\n * (`cli/commands/start/index.ts`). An app with no security block gets the same\n * baseline deployed as it gets locally.\n */\n/**\n * The two declarations every deploy entry emits to carry the security baseline.\n *\n * Four adapters wrote these same two lines — `netlify`, `vercel`, `aws-lambda`, `deno-deploy` —\n * each under a comment naming its own host's static-asset boundary. The COMMENT differs and is\n * meant to; the declarations do not.\n *\n * Extracted after SonarCloud's duplication gate failed a PR at 4.0% against a 3% ceiling and named\n * this as the largest repeated block among the changed files. The gate was measuring something\n * real: a literal renderer and a builder call, copied four times, is four places to update when\n * either changes.\n *\n * Returns the lines rather than a joined string, because every caller splices them into an array\n * of emitted lines.\n */\nexport function securityHeadersDeclarations(config: SecurityHeadersConfig | undefined): string[] {\n  return [\n    `const SECURITY_HEADERS_CONFIG = ${renderSecurityHeadersConfigLiteral(config)}`,\n    `const SECURITY_HEADERS = buildSecurityHeaders(SECURITY_HEADERS_CONFIG, { production: true })`,\n  ]\n}\n\nexport function renderSecurityHeadersConfigLiteral(\n  headers: SecurityHeadersConfig | undefined,\n): string {\n  return JSON.stringify(headers ?? {})\n}\n\n/**\n * Put the headers on a response, without overruling the handler.\n *\n * `theokit start` sets the baseline BEFORE the route handler runs, so a handler\n * can override it with `res.setHeader` (last write wins, Node convention). On a\n * Web target the response arrives already built, so the equivalent of \"the\n * handler wins\" is to skip a header the response already carries: a route that\n * set its own `Content-Security-Policy` keeps it.\n *\n * Mutates and returns the same `Response` rather than constructing a\n * replacement, because these responses are handed to the runtime while their\n * body is still being written (#382) and re-wrapping the stream is exactly the\n * second buffering point that change removed.\n *\n * Mutation is safe for every response these entries produce: the Fetch spec\n * gives a locally constructed `Response` the `response` header guard, which\n * permits `set` for every name used here. The `immutable` guard belongs to\n * responses that came back from `fetch()`, and none of the six emitted handlers\n * returns one — each builds its response from `createWebShim`, from a `new\n * Response(...)`, or from the SSR renderer. The WebSocket upgrade, which is the\n * one response an adapter gets from its runtime rather than building, is\n * deliberately not routed through here.\n */\nexport function withSecurityHeaders(response: Response, headers: Record<string, string>): Response {\n  for (const [key, value] of Object.entries(headers)) {\n    if (!response.headers.has(key)) response.headers.set(key, value)\n  }\n  return response\n}\n\nexport interface DeployedSecurityHeaderLimits {\n  target: string\n  /** The app's `security.headers` block, or undefined when it declares none. */\n  securityHeaders: SecurityHeadersConfig | undefined\n  /**\n   * Does the emitted handler render HTML at request time and mint a CSP nonce\n   * for it? True only for Cloudflare with `ssrStreaming: true`.\n   */\n  mintsNonce: boolean\n  /**\n   * Is the HTML document served by a platform static host rather than by the\n   * handler this build emits? True wherever the emitted handler answers\n   * `/api/*` and returns 404 for everything else.\n   */\n  /**\n   * Who puts the security headers on the HTML DOCUMENT — a different question from who serves it,\n   * and the two used to be collapsed into one boolean (usetheokit/theokit#412).\n   *\n   * - `handler` — this target's own handler returns the document, so it carries the same baseline\n   *   every API response carries. No caveat.\n   * - `platform-configured` — the platform's static host serves the document, AND this build emits\n   *   the configuration that puts the headers on it (`.vercel/output/config.json`, `netlify.toml`).\n   *   Still worth stating, because nothing here has seen a deployed response.\n   * - `platform-unmanaged` — the platform serves it and this build owns no artifact that could\n   *   configure it. This is the real remaining gap, and it stays named.\n   *\n   * The two-value version reported `platform-configured` targets with the same message as\n   * `platform-unmanaged` ones, telling an operator to go and do work the build had already done —\n   * and a stale limitation reads exactly like a current one.\n   */\n  documentHeaders: 'handler' | 'platform-configured' | 'platform-unmanaged'\n}\n\n/**\n * What the build tells the operator, once, per target.\n *\n * Silent degradation is the failure mode `rules/three-target-parity.md` exists\n * to prevent. Two things degrade quietly here and both are named rather than\n * discovered in production: a CSP that refuses inline scripts on a deploy while\n * allowing them locally, and an HTML document that never passes through the\n * handler these headers are attached to.\n *\n * The header names are read from the map the entry will actually carry, not\n * from a list written next to it. A configuration that switches HSTS or the CSP\n * off would otherwise be announced as sending them.\n */\nexport function describeDeployedSecurityHeaders(limits: DeployedSecurityHeaderLimits): string {\n  const headers = buildSecurityHeaders(limits.securityHeaders ?? {}, { production: true })\n  const names = Object.keys(headers)\n  if (names.length === 0) {\n    return `  ! \\`${limits.target}\\` sends no security headers: the configuration switched every one of them off.`\n  }\n\n  const lines = [\n    `  ✓ security headers on every response \\`${limits.target}\\` returns: ${names.join(', ')}.`,\n  ]\n  const sendsCsp = names.some((name) => name.startsWith('Content-Security-Policy'))\n  if (sendsCsp && !limits.mintsNonce) {\n    lines.push(\n      `    - The CSP carries no nonce: this target serves HTML written at build time,`,\n      `      so there is no per-request value to put on a script tag. An inline`,\n      `      <script> is refused by \\`script-src 'self'\\` here, while the same page`,\n      `      under \\`theokit start\\` gets a nonce and runs it. Move inline scripts to`,\n      `      \\`<script src=\"...\">\\`, or set \\`security.headers.cspMode: 'report-only'\\``,\n      `      while you migrate.`,\n    )\n  }\n  if (limits.documentHeaders === 'platform-configured') {\n    lines.push(\n      `    - The HTML document is served by the platform's static host, and reaches`,\n      `      the browser with these headers through config this build emits. That`,\n      `      path is not verified by a deploy from here — the values come from the`,\n      `      same function the handler uses, but no response has been read back.`,\n    )\n  }\n  if (limits.documentHeaders === 'platform-unmanaged') {\n    lines.push(\n      `    - The HTML document does NOT pass through this handler — the platform's`,\n      `      static host serves it — so these headers reach \\`/api/*\\` responses and`,\n      `      not the page. This build emits no artifact that could configure it, so`,\n      `      set the document's headers on the platform (usetheokit/theokit#412).`,\n    )\n  }\n  return lines.join('\\n')\n}\n","/**\n * The configuration a deployed entry could not apply (usetheokit/theokit#425).\n *\n * ## Why this is not another literal renderer\n *\n * `deployed-csrf.ts` and `deployed-cors.ts` bake their values into the emitted source, which works\n * because `csrf` is an enum and `disallowed` is a `{ routes, behavior }` object — plain data, and a\n * deployed function has no `theo.config.ts` to read.\n *\n * The two concerns left over from #410 turn out to be different from each other, and the difference\n * is the whole design:\n *\n * - **`serialization` is plain data too.** The config field is `z.enum(['json', 'superjson'])`\n *   (`config/schema.ts:147`) — a selector, not a transformer. `resolveTransformer` turns it into the\n *   functions, and it already ships from `theokit/server`. So this half is a literal like the rest,\n *   and the deployed entry resolves it exactly the way `theokit start` does\n *   (`cli/commands/start/index.ts:108`), from the same string, through the same function.\n * - **`plugins` genuinely carries functions.** A plugin is constructed in `theo.config.ts` and there\n *   is no literal for a closure, so this half needs the entry to import a module instead.\n *\n * ## Static import, not `import()` in the request path\n *\n * The tempting shortcut is `await import('../../theo.config.js')` inside the handler. It trades a\n * silent failure for a louder one on targets with no filesystem, and it moves configuration\n * resolution into every request on the targets that do have one.\n *\n * What this emits instead is a TOP-LEVEL import of a module the build already resolved and wrote\n * beside the entry — the same shape `renderBakedRoutes` uses for route modules (#369): decide on\n * the build machine, emit a static specifier. It is evaluated once at module load, the target's\n * bundler can see through it, and a plugin that needs an API the target lacks fails the build\n * rather than the first request.\n *\n * ## Why each half is optional\n *\n * An app that declares neither concern must produce the entry it produced before this existed.\n * Importing a module the build did not emit fails at load, and spreading an empty object costs an\n * allocation per request for nothing. So an empty request renders to nothing at all, and the\n * caller's `executeRoute` literal is unchanged.\n *\n * The halves are independent on purpose: an app that only picks `superjson` must not be made to\n * carry a plugins module, and an app with plugins and default JSON must not gain a transformer\n * lookup. Coupling them would have made the common case pay for the rare one.\n */\n\n/**\n * The option every Web-standards adapter grows to carry non-serialisable configuration.\n *\n * Composed into each adapter's option type the way `DeployedCsrfOptions` already is, so the six\n * targets cannot drift into six spellings of the same field.\n */\n/**\n * The project's `serverDir`, carried into every generated entrypoint (#RFC server-layout).\n *\n * Separate from the other option groups because it is not a runtime feature toggle: it is the\n * project's own layout, and an adapter that hardcodes `'server'` agrees with the default by\n * COINCIDENCE. The moment a project sets the option — the entire point of it existing — the\n * generated entrypoint resolves a directory that is not there, and only after deploy: the build\n * succeeds, the bundle is written, and routes 404 in production with nothing naming the cause.\n */\nexport interface DeployedServerDirOptions {\n  /** Project-relative server directory. Absent ⇒ the schema default, `server`. */\n  serverDir?: string\n}\n\n/**\n * The server directory as a quoted TypeScript literal, ready to interpolate into generated source.\n *\n * `JSON.stringify` rather than wrapping in quotes by hand: the value reaches this from user config,\n * so a directory containing a quote or a backslash would otherwise emit a syntax error into\n * somebody else's build — a worse failure than the one this fixes.\n */\nexport function serverDirLiteral(opts: DeployedServerDirOptions): string {\n  return JSON.stringify(opts.serverDir ?? 'server')\n}\n\n/**\n * The agents directory, same shape and same reason as `serverDir` above.\n *\n * `scanAgents(projectRoot, agentsDirName = 'agents')` takes the name as its SECOND parameter\n * (`server/scan/agent-scan.ts:56`). Nine call sites pass the configured value; the generated\n * deploy entry was the only one that did not, so the default won and a project whose agents live\n * under the documented `core/agents` (`config/schema.ts:66`) served none of them — 404 per agent,\n * after deploy, with nothing naming the cause. Measured 2026-09-21 by executing `buildBun`\n * against a config carrying both directories and reading what it emitted.\n */\nexport interface DeployedAgentsDirOptions {\n  /** Project-relative agents directory. Absent ⇒ the schema default, `agents`. */\n  agentsDir?: string\n}\n\nexport function agentsDirLiteral(opts: DeployedAgentsDirOptions): string {\n  return JSON.stringify(opts.agentsDir ?? 'agents')\n}\n\nexport interface DeployedRuntimeConfigOptions {\n  /**\n   * Specifier of the plugins module the build wrote beside the entry, or `undefined` when the app\n   * declares no plugins and the build wrote none.\n   */\n  runtimeConfigModule?: string\n  /**\n   * The app's `serialization` selector, carried as a literal.\n   *\n   * `'json'` and `undefined` both mean the default, and neither emits anything: `executeRoute`\n   * already falls back to `JSON.stringify`, and the `x-theo-transformer` header is deliberately\n   * absent for the default so a client is told only when there is something to be told.\n   */\n  serialization?: 'json' | 'superjson'\n}\n\n/** The three places an entry has to grow to carry non-serialisable configuration. */\nexport interface DeployedRuntimeConfigFragment {\n  /** Top-level imports. Empty when the build emitted no config module. */\n  readonly imports: string[]\n  /** Module-scope declarations — evaluated once, at load. Empty when there is nothing to carry. */\n  readonly declarations: string[]\n  /**\n   * Spread into the entry's `executeRoute({ … })` literal, inside an async function.\n   *\n   * Empty string when there is nothing to carry, so the call site keeps the exact shape it had.\n   */\n  readonly executeRouteSpread: string\n}\n\nconst EMPTY: DeployedRuntimeConfigFragment = {\n  imports: [],\n  declarations: [],\n  executeRouteSpread: '',\n}\n\n/**\n * What a deployed entry needs in order to apply `config.plugins` and `config.serialization`.\n *\n * @param moduleSpecifier - specifier of the runtime-config module the build emitted beside the\n *   entry, or `undefined` when the app declared neither concern and the build emitted none.\n */\nexport function deployedRuntimeConfigFragment(\n  options: DeployedRuntimeConfigOptions | undefined,\n): DeployedRuntimeConfigFragment {\n  const pluginsModule = options?.runtimeConfigModule\n  // 'json' is the default and emits nothing — see `serialization` above.\n  const serialization = options?.serialization === 'superjson' ? 'superjson' : undefined\n  if (pluginsModule === undefined && serialization === undefined) return EMPTY\n\n  const imports: string[] = []\n  const declarations: string[] = []\n  const spread: string[] = []\n\n  if (pluginsModule !== undefined) {\n    imports.push(\n      `import { createPluginRunnerFromConfig } from 'theokit/server'`,\n      `// #425 — the app's own plugins, resolved on the build machine and written beside this entry.`,\n      `// A closure has no literal, so this is an import rather than a baked value.`,\n      `import theoRuntimeConfig from '${pluginsModule}'`,\n    )\n    declarations.push(\n      `// Built ONCE, at module load. A runner rebuilt per request would re-run every plugin's`,\n      `// \\`register\\`, which is where a plugin allocates the state its hooks then read.`,\n      `const THEO_PLUGIN_RUNNER = createPluginRunnerFromConfig(theoRuntimeConfig.plugins)`,\n    )\n    // Awaited, not passed along: `createPluginRunnerFromConfig` is async because `register` is, and\n    // a pending promise handed to `executeRoute` is a truthy object with none of the runner's\n    // methods — every hook would silently not fire, which is this issue's own defect one layer in.\n    spread.push(`pluginRunner: await THEO_PLUGIN_RUNNER`)\n  }\n\n  if (serialization !== undefined) {\n    imports.push(`import { resolveTransformer } from 'theokit/server'`)\n    declarations.push(\n      `// #425 — a literal, because \\`config.serialization\\` is a SELECTOR and not a transformer.`,\n      `// Same string, same function \\`theokit start\\` calls, so the deployed response and the local`,\n      `// one cannot disagree about what the app asked for — including the \\`x-theo-transformer\\``,\n      `// header, whose absence is what made this a data bug rather than a formatting one.`,\n      `const THEO_TRANSFORMER = resolveTransformer('${serialization}')`,\n    )\n    spread.push(`transformer: THEO_TRANSFORMER`)\n  }\n\n  return { imports, declarations, executeRouteSpread: `${spread.join(', ')},` }\n}\n","/**\n * The request id a deployed entry uses, and the header it echoes back.\n *\n * ## The defect this closes\n *\n * Every generated entry minted a fresh `randomUUID()` per request and set no correlation header\n * at all on a success path (usetheokit/theokit#410). Both Node paths do the opposite: they resolve\n * an incoming `traceparent` / `x-request-id` through `extractTraceId` and echo the result under\n * both `x-request-id` and `x-trace-id` (`cli/commands/start/request-handler.ts`,\n * `vite-plugin/api-middleware.ts`).\n *\n * The consequence is that a trace crossing into a deployed function starts over. The caller's id\n * is discarded, and the response carries nothing to correlate against — so a request that fails in\n * production cannot be tied to the client that made it, which is the one situation the id exists\n * for.\n *\n * ## Why `setHeader` before the handler, rather than wrapping the response\n *\n * It is what the Node path does, and the shim reproduces Node's semantics exactly: `writeHead`\n * MERGES into the header map rather than replacing it (`web-shim.ts`), so a header set here\n * survives the handler's own `writeHead` and a handler that sets its own id still wins. Wrapping\n * the finished `Response` instead would have to mutate a response whose body is already streaming\n * (#382), and would miss the branches that return before the shim is built.\n */\n\n/**\n * Lines that resolve the request id and echo it, as generated source.\n *\n * @param requestVar - the name the entry gave the Web `Request` in scope\n * @param indent - leading whitespace, so the emitted file stays readable\n */\nexport function deployedTraceFragment(requestVar: string, indent: string): string[] {\n  return [\n    `${indent}// #410 — honour the caller's trace id instead of minting a new one, and echo it.`,\n    `${indent}// \\`extractTraceIdFromRequest\\` validates the caller-controlled \\`x-request-id\\``,\n    `${indent}// before trusting it, and falls back to a fresh UUID when neither header is present.`,\n    `${indent}const requestId = extractTraceIdFromRequest(${requestVar})`,\n    `${indent}res.setHeader('x-request-id', requestId)`,\n    `${indent}res.setHeader(TRACE_HEADER, requestId)`,\n  ]\n}\n"],"mappings":";;;;;;;AAgEA,IAAM,QAAgC,EAAE,SAAS,CAAC,GAAG,cAAc,CAAC,GAAG,QAAQ,CAAC,GAAG,YAAY,GAAG;AAqGlG,IAAM,kBAAkB;AAAA,EACtB;AAAA,EACA;AACF;AAGA,IAAM,eAAe;AAYrB,IAAM,oBAAoB;AAuBnB,SAAS,uBAAuBA,mBAAiD;AACtF,SAAO;AAAA,IACL,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAAA;AAAA,IACA,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,cAAc;AAAA,EAChB;AACF;AAQO,IAAM,0BAA0B;AAEhC,SAAS,uBACd,QACA,OAA2B,CAAC,GACJ;AACxB,MAAI,WAAW,OAAW,QAAO;AACjC,MAAI,OAAO,SAAS,WAAW,OAAO,OAAO,WAAW,EAAG,QAAO;AAElE,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,SAAS,KAAK,gBAAgB;AAEpC,QAAM,aACJ,OAAO,SAAS,UACZ,gBAAgB,OAAO,QAAQ,OAAO,eAAe,KAAK,gBAAgB,IAC1E,kBAAkB,EAAE,GAAG,QAAQ,kBAAkB,KAAK,iBAAiB,CAAC;AAE9E,SAAO;AAAA,IACL,YAAY,8BAA8B,QAAQ;AAAA,IAClD,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMP,iFAAiF,WAAW,cAAc,GAAG,OAAO,SAAS,SAAS,iBAAiB,EAAE,YAAY,MAAM;AAAA,MAC3K,GAAG,WAAW;AAAA,IAChB;AAAA,IACA,cAAc;AAAA,MACZ,GAAG,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAed,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAeP;AAAA,MACA,GAAG,WAAW;AAAA,MACd;AAAA,MACA;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS,QAAQ,eAAe,KAAK,UAAU,YAAY,CAAC;AAAA,MAC5D,SAAS,QAAQ,eAAe,KAAK,UAAU,iBAAiB,CAAC;AAAA,MACjE;AAAA,MACA,GAAG,WAAW;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,mEAAmE,QAAQ;AAAA,MAC3E;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK,wBAAwB,OACzB,sEACA;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc,QAAQ,eAAe,KAAK,UAAU,YAAY,CAAC,aAAa,QAAQ;AAAA,MACtF,2BAA2B,QAAQ,UAAU,OAAO,aAAa,MAAM,CAAC;AAAA,MACxE,GAAG,WAAW;AAAA,MACd;AAAA,MACA;AAAA,MACA,uCAAuC,QAAQ;AAAA,MAC/C;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK,wBAAwB,OACzB,sEACA;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACF;AAoCA,SAAS,gBACP,QACA,eACA,kBACiB;AACjB,QAAM,QAAQ,CAAC,UAA0B,cAAc,OAAO,KAAK,CAAC;AACpE,SAAO;AAAA,IACL,SAAS;AAAA,MACP,GAAG,OAAO,IAAI,CAAC,OAAO,UAAU,eAAe,MAAM,KAAK,CAAC,gBAAgB,MAAM,QAAQ,GAAG;AAAA;AAAA,MAE5F,GAAI,kBAAkB,SAClB,CAAC,IACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAgBE,6CAA6C,aAAa;AAAA,MAC5D;AAAA,IACN;AAAA,IACA,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAG,OAAO,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,UAAU,MAAM,IAAI,CAAC,KAAK,MAAM,KAAK,CAAC,GAAG;AAAA,MACnF;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAG,OAAO;AAAA,QACR,CAAC,UACC,iBAAiB,KAAK,UAAU,MAAM,QAAQ,CAAC,gBAAgB,KAAK,UAAU,MAAM,SAAS,CAAC,WAAW,KAAK,UAAU,MAAM,IAAI,CAAC;AAAA,MACvI;AAAA,MACA;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,gBAAgB,kBAAkB,SAAY,KAAK;AAAA,IACnD,UACE,kBAAkB,SACd;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MASA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,oBAAoB,WAAW;AAAA,MACtC;AAAA,IACF;AAAA,IACN,YAAY;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAG;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;AAGA,SAAS,kBAAkB,QAOP;AAGlB,QAAM,eAAe,OAAO,qBAAqB,SAAY,KAAK,KAAK,OAAO,gBAAgB;AAE9F,SAAO;AAAA,IACL,SAAS,CAAC;AAAA,IACV,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN;AAAA,MACA,iEAAiE,OAAO,UAAU;AAAA,IACpF;AAAA,IACA,gBAAgB,OAAO,cAAc,SAAY,KAAK;AAAA,IACtD,UACE,OAAO,cAAc,SACjB,CAAC,0CAA0C,IAC3C;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,mBAAmB,OAAO,UAAU;AAAA,MACpC,kBAAkB,OAAO,SAAS;AAAA,MAClC,qBAAqB,OAAO,oBAAoB,WAAW;AAAA,MAC3D;AAAA,IACF;AAAA,IACN,YAAY;AAAA,MACV,GAAI,OAAO,iBAAiB,SAAY,CAAC,IAAI,CAAC,SAAS,OAAO,YAAY,EAAE;AAAA,MAC5E;AAAA,MACA;AAAA,MACA;AAAA,MACA,oDAAoD,OAAO,WAAW,GAAG,YAAY;AAAA,MACrF;AAAA,MACA;AAAA,MACA,uBAAuB,OAAO,UAAU;AAAA,MACxC;AAAA,MACA,GAAG;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;;;AC3eO,IAAM,gCAAN,cAA4C,MAAM;AAAA,EACvD,YAAY,QAAgB;AAC1B;AAAA,MACE,kDAAkD,MAAM;AAAA,IAI1D;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAGA,SAAS,aAAa,QAAiB,QAAwB;AAC7D,MAAI,OAAO,WAAW,WAAY,OAAM,IAAI,8BAA8B,MAAM;AAChF,MAAI,kBAAkB,OAAQ,QAAO,OAAO,MAAM;AAClD,MAAI,MAAM,QAAQ,MAAM,EAAG,QAAO,IAAI,OAAO,IAAI,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC;AAC3F,SAAO,KAAK,UAAU,MAAM;AAC9B;AAWO,SAAS,0BAA0B,MAA8B,QAAwB;AAC9F,MAAI,SAAS,OAAW,QAAO;AAE/B,QAAM,QAAQ,CAAC,YAAY,aAAa,KAAK,SAAS,MAAM,CAAC,EAAE;AAC/D,MAAI,KAAK,YAAY,OAAW,OAAM,KAAK,YAAY,KAAK,UAAU,KAAK,OAAO,CAAC,EAAE;AACrF,MAAI,KAAK,mBAAmB;AAC1B,UAAM,KAAK,mBAAmB,KAAK,UAAU,KAAK,cAAc,CAAC,EAAE;AACrE,MAAI,KAAK,mBAAmB;AAC1B,UAAM,KAAK,mBAAmB,KAAK,UAAU,KAAK,cAAc,CAAC,EAAE;AAGrE,QAAM;AAAA,IACJ,gBAAgB,KAAK,UAAU,KAAK,WAAW,CAAC;AAAA,IAChD,WAAW,KAAK,UAAU,KAAK,MAAM,CAAC;AAAA,EACxC;AAEA,SAAO,KAAK,MAAM,KAAK,IAAI,CAAC;AAC9B;AAQO,SAAS,qBAAqB,MAA8B,QAA0B;AAC3F,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,uBAAuB,0BAA0B,MAAM,MAAM,CAAC;AAAA,IAC9D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;ACxEA,SAAS,mBAAmB,SAAkC;AAC5D,SAAO,mBAAmB,SAAS,OAAO,OAAO,IAAI,KAAK,UAAU,OAAO;AAC7E;AAWO,SAAS,0BAA0B,UAAmD;AAC3F,MAAI,aAAa,OAAW,QAAO;AAEnC,QAAM,QAAkB,CAAC;AACzB,MAAI,SAAS,SAAS,OAAW,OAAM,KAAK,aAAa,KAAK,UAAU,SAAS,IAAI,CAAC,EAAE;AAExF,QAAM,EAAE,WAAW,IAAI;AACvB,MAAI,eAAe,QAAW;AAC5B,UAAM,SAAS,WAAW,OAAO,IAAI,kBAAkB,EAAE,KAAK,IAAI;AAClE,UAAM;AAAA,MACJ,0BAA0B,MAAM,gBAAgB,KAAK,UAAU,WAAW,QAAQ,CAAC;AAAA,IACrF;AAAA,EACF;AAIA,SAAO,MAAM,WAAW,IAAI,OAAO,KAAK,MAAM,KAAK,IAAI,CAAC;AAC1D;AAcO,SAAS,qBACd,MACA,OAAO,uBACG;AACV,SAAO;AAAA,IACL;AAAA,IACA,wDAAwD,IAAI;AAAA,IAC5D;AAAA,IACA;AAAA,IACA,uBAAuB,0BAA0B,IAAI,CAAC;AAAA,EACxD;AACF;;;ACTO,SAAS,4BAA4B,QAAqD;AAC/F,SAAO;AAAA,IACL,mCAAmC,mCAAmC,MAAM,CAAC;AAAA,IAC7E;AAAA,EACF;AACF;AAEO,SAAS,mCACd,SACQ;AACR,SAAO,KAAK,UAAU,WAAW,CAAC,CAAC;AACrC;AA8EO,SAAS,gCAAgC,QAA8C;AAC5F,QAAM,UAAU,qBAAqB,OAAO,mBAAmB,CAAC,GAAG,EAAE,YAAY,KAAK,CAAC;AACvF,QAAM,QAAQ,OAAO,KAAK,OAAO;AACjC,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO,SAAS,OAAO,MAAM;AAAA,EAC/B;AAEA,QAAM,QAAQ;AAAA,IACZ,iDAA4C,OAAO,MAAM,eAAe,MAAM,KAAK,IAAI,CAAC;AAAA,EAC1F;AACA,QAAM,WAAW,MAAM,KAAK,CAAC,SAAS,KAAK,WAAW,yBAAyB,CAAC;AAChF,MAAI,YAAY,CAAC,OAAO,YAAY;AAClC,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,oBAAoB,uBAAuB;AACpD,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,oBAAoB,sBAAsB;AACnD,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;;;ACrJO,SAAS,iBAAiB,MAAwC;AACvE,SAAO,KAAK,UAAU,KAAK,aAAa,QAAQ;AAClD;AAiBO,SAAS,iBAAiB,MAAwC;AACvE,SAAO,KAAK,UAAU,KAAK,aAAa,QAAQ;AAClD;AAgCA,IAAMC,SAAuC;AAAA,EAC3C,SAAS,CAAC;AAAA,EACV,cAAc,CAAC;AAAA,EACf,oBAAoB;AACtB;AAQO,SAAS,8BACd,SAC+B;AAC/B,QAAM,gBAAgB,SAAS;AAE/B,QAAM,gBAAgB,SAAS,kBAAkB,cAAc,cAAc;AAC7E,MAAI,kBAAkB,UAAa,kBAAkB,OAAW,QAAOA;AAEvE,QAAM,UAAoB,CAAC;AAC3B,QAAM,eAAyB,CAAC;AAChC,QAAM,SAAmB,CAAC;AAE1B,MAAI,kBAAkB,QAAW;AAC/B,YAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA,kCAAkC,aAAa;AAAA,IACjD;AACA,iBAAa;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAIA,WAAO,KAAK,wCAAwC;AAAA,EACtD;AAEA,MAAI,kBAAkB,QAAW;AAC/B,YAAQ,KAAK,qDAAqD;AAClE,iBAAa;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,gDAAgD,aAAa;AAAA,IAC/D;AACA,WAAO,KAAK,+BAA+B;AAAA,EAC7C;AAEA,SAAO,EAAE,SAAS,cAAc,oBAAoB,GAAG,OAAO,KAAK,IAAI,CAAC,IAAI;AAC9E;;;ACpJO,SAAS,sBAAsB,YAAoB,QAA0B;AAClF,SAAO;AAAA,IACL,GAAG,MAAM;AAAA,IACT,GAAG,MAAM;AAAA,IACT,GAAG,MAAM;AAAA,IACT,GAAG,MAAM,+CAA+C,UAAU;AAAA,IAClE,GAAG,MAAM;AAAA,IACT,GAAG,MAAM;AAAA,EACX;AACF;","names":["agentsDirLiteral","EMPTY"]}