theokit 0.68.0 → 0.69.0

package/README.md

@@ -38,6 +38,27 @@ Node `>= 22.12.0`. Peers: `react`, `react-dom`, `react-router`, `zod`, and — w
 | `server/ws/chat.ts` | `ws://…/ws/chat` |
 | `server/middleware/01-cors.ts` | request middleware, in filename order |
 
+### `next` is supported on one of the two paths
+
+A middleware receives `(request, context, next)`. What `next` does depends on which runner is
+executing it, and the two differ today:
+
+| path | `next` |
+|---|---|
+| `executeWebRequest` — the Web runner | runs the rest of the chain **and the route**, so code after `await next()` observes the route's response |
+| `server/middleware/*.ts` — the file-scan runner | **refuses.** It runs BEFORE routing, so there is no downstream to await |
+
+The file-scan path throws `MiddlewareNextUnavailableError`, naming the alternative. It used to
+accept the call and continue silently, which meant the code after `await next()` never ran and
+nothing said so.
+
+**This is a real limitation, not a bug being hidden.** Closing it means either folding the
+file-scan path so the chain wraps the route, or retiring this contract for a single one; both are
+large and the choice is open — `docs/adr/0003` § *AMENDED 2026-09-21* records what each costs.
+
+Write a `server/middleware/*.ts` middleware that returns a `Response` to answer the request, or
+returns nothing to continue. Use the Web path when you need code to run after the route.
+
 ## Authoring surfaces
 
 Every surface is a fluent builder whose `.build()` is a compile error while a required link is

package/dist/{actions-virtual-module-SE44BKR4.js → actions-virtual-module-DH3N34I6.js}

@@ -1,12 +1,12 @@
-import "./chunk-GDF2XQOO.js";
-import "./chunk-GAJOZJWD.js";
+import "./chunk-425FJKKO.js";
+import "./chunk-MOGTMGGA.js";
 import "./chunk-WSOAN4KN.js";
 import "./chunk-ENSFCKP6.js";
-import "./chunk-Q7T3UQ4L.js";
+import "./chunk-SRJBH5E5.js";
+import "./chunk-3T5XLDOH.js";
 import "./chunk-P6OS7652.js";
 import "./chunk-ZDUO4IYN.js";
-import "./chunk-7L7LQ2GU.js";
-import "./chunk-ENRT6DAU.js";
+import "./chunk-IDWN2OSG.js";
 import "./chunk-47FFT43U.js";
 import "./chunk-NTDN54XO.js";
 import "./chunk-PVNMLZ5G.js";
@@ -234,4 +234,4 @@ export const actions = manifest
 export {
   actionsVirtualModule
 };
-//# sourceMappingURL=actions-virtual-module-SE44BKR4.js.map
+//# sourceMappingURL=actions-virtual-module-DH3N34I6.js.map

package/dist/{actions-virtual-module-3OPYLD76.js → actions-virtual-module-OMIFGXK6.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import "tsx/esm";
-import "./chunk-G2NWAVGG.js";
-import "./chunk-UETVDZBE.js";
+import "./chunk-SJ4AW54X.js";
+import "./chunk-BINRCILF.js";
 import "./chunk-QD5X56I3.js";
 import "./chunk-WSMLSIS5.js";
 import "./chunk-MS4A7N77.js";
@@ -218,4 +218,4 @@ export const actions = manifest
 export {
   actionsVirtualModule
 };
-//# sourceMappingURL=actions-virtual-module-3OPYLD76.js.map
+//# sourceMappingURL=actions-virtual-module-OMIFGXK6.js.map

package/dist/adapters/agent-mount.d.ts

@@ -1,9 +1,14 @@
 import { a as RouteSubject, R as RoutePolicy } from '../route-policy-BHXQDzBF.js';
 import { C as CsrfMode } from '../csrf-Dgot9qSM.js';
 export { r as resolveProvider } from '../provider-resolver-Cc9C3-Rb.js';
+import { A as AgentNode } from '../agent-scan-BZa-pagG.js';
 export { s as scanAgents } from '../agent-scan-BZa-pagG.js';
-import 'node:http';
+import { IncomingMessage, ServerResponse } from 'node:http';
+import { P as PluginRunner } from '../plugin-runner-BVMOSxvb.js';
+import { L as LoadModule } from '../module-loader-DCip7NoL.js';
 import '../audit-log-BQWM5YLG.js';
+import '../plugin-types-BUVfUQ0V.js';
+import 'vite';
 
 /**
  * ADR 0001, applied to the agent surface (usetheokit/theokit#365).
@@ -132,4 +137,187 @@ interface MountAgentOptions {
  */
 declare function mountAgent(mod: unknown, request: Request, apiKey: string | ApiKeyResolver, { source, csrfMode, projectRoot, agentName, policy, resolveSubject, }?: MountAgentOptions): Promise<Response>;
 
-export { mountAgent };
+/** Dependencies the aux dispatcher needs from its caller (dev or prod). */
+interface AuxRouteDeps {
+    /** Discovered agents (from `scanAgents`). */
+    agents: readonly AgentNode[];
+    /** Load an agent module from its file path (dev: vite loader; prod: dynamic import). */
+    loadModule: (filePath: string) => Promise<unknown>;
+    /** Absolute base URL (`http(s)://host`) for the agent-card endpoint URLs. */
+    baseUrl: string;
+    /**
+     * M34 (#97) — CSRF enforcement mode for the MCP route. `POST /api/agents/<name>/mcp` drives the
+     * agent (spends LLM tokens), so a cross-origin POST MUST be rejected in `'strict'` — parity with
+     * the agent-run route (`mount-agent.ts:83-91`). Defaults to `'strict'` (safe-by-default); a caller
+     * that already gated upstream may pass `'off'`.
+     */
+    csrfMode?: CsrfMode;
+    /**
+     * M39 — lazily resolve the provider apiKey. Required only for the thread
+     * follow-up route (which drives the agent); resolved on demand so non-agent
+     * aux routes (card, approvals, stream) never need a provider key.
+     *
+     * theokit#328 — it receives the model the agent declares, so the credential matches the provider
+     * the agent asked for. It was called with no argument, before the module was even compiled, so
+     * an agent declaring `anthropic/…` was handed whichever key env priority found first.
+     */
+    resolveApiKey?: ApiKeyResolver;
+    /**
+     * Who is asking (usetheokit/theokit#365). Invoked ONLY from {@link serveMatchedAuxRoute}, and only
+     * when the matched path's agent declares a policy — so the application's `createContext` never
+     * runs for a url this dispatcher merely declines. {@link matchAgentAuxRoute} is not given it, for
+     * the same reason it is not given the request body: deciding must cost nothing.
+     */
+    resolveSubject?: AgentSubjectResolver;
+}
+/**
+ * One aux route, already decided. Carries what the match resolved so the serve half re-derives
+ * nothing: the agent node it looked up, and for MCP the module it had to open in order to answer
+ * the opt-in question at all.
+ */
+type AgentAuxRoute = {
+    readonly kind: 'card';
+    readonly agent: AgentNode;
+} | {
+    readonly kind: 'approvals';
+    readonly agent: AgentNode;
+} | {
+    readonly kind: 'run-stream';
+    readonly agent: AgentNode;
+    readonly runId: string;
+} | {
+    readonly kind: 'thread-stream';
+    readonly agent: AgentNode;
+    readonly sessionId: string;
+} | {
+    readonly kind: 'thread-message';
+    readonly agent: AgentNode;
+    readonly sessionId: string;
+} | {
+    readonly kind: 'mcp';
+    readonly agent: AgentNode;
+    readonly mod: unknown;
+};
+/**
+ * Does this dispatcher own `urlPath`? Returns the matched route, or `null` to fall through (not an
+ * aux path, wrong method, unknown agent, or an agent that did not opt into MCP).
+ *
+ * theokit#400 — this function is where the "convert only on a path you are about to answer" rule
+ * now lives, and it is enforced by the signature rather than by discipline: it is handed a method
+ * and a url and has no request to convert. Converting in order to decide is what drained the Node
+ * body stream on every path this dispatcher declined, so an ordinary `POST /api/…` file route then
+ * waited forever for an `'end'` that had already fired — no status, no timeout, no response.
+ *
+ * The one branch that does real work here is MCP, which must open the module to read its
+ * `export const mcp` opt-in. That is deliberate: a match that could still fall through would hand
+ * the caller a request it had already started a lifecycle for, and the span opened for it would
+ * either double-count or never close.
+ */
+declare function matchAgentAuxRoute(method: string, urlPath: string, deps: AuxRouteDeps): Promise<AgentAuxRoute | null>;
+/**
+ * Answer a route {@link matchAgentAuxRoute} already claimed. Always returns a `Response` — every
+ * fall-through was decided upstream, which is what lets a caller open a request span before this
+ * runs and be sure something will close it.
+ */
+declare function serveMatchedAuxRoute(route: AgentAuxRoute, request: Request, deps: AuxRouteDeps): Promise<Response>;
+
+/**
+ * Who is asking, on the Node dispatch path that serves the agent endpoints
+ * (usetheokit/theokit#365).
+ *
+ * `executeRoute` answers this with `subjectFromContext(ctx)`, where `ctx` is the run context built
+ * from the application's `server/context.ts` plus plugin decorations. The agent branches build no
+ * such context — which is why `mountAgent`'s `subject` option had nowhere to come from and every
+ * caller left it out. This builds the same context from the same two sources, so the agent surface
+ * reads identity from the seam the routes already read it from rather than from a second one.
+ *
+ * ## Why it returns a resolver instead of a subject
+ *
+ * `tryServeAgentAux` runs for EVERY url, including the ones it does not own. Resolving eagerly
+ * there would execute the application's `createContext` twice on every route request — once in the
+ * aux branch that falls through, once in the route executor. So callers get a memoized thunk and
+ * invoke it only on a path they are about to answer, which is the same discipline theokit#400
+ * imposed on `source.toRequest()` for the same dispatcher.
+ *
+ * ## What `createContext` can read here, and what it cannot (usetheokit/theokit#415)
+ *
+ * **Headers and cookies: yes. The request body: no.**
+ *
+ * This used to state the opposite as a MUST — "invoke it before converting the request to a Web
+ * `Request`" — and no caller could honour it. The laziness argued for directly above is what makes
+ * it unsatisfiable: the invocation necessarily happens INSIDE the handler, and the handler is
+ * entered after `serveThroughPluginLifecycle` has already called `source.toRequest()` at the top of
+ * its bracket. `incomingMessageToWebRequest` attaches the Node readable as the request body
+ * (`body: webStream, duplex: 'half'`), so by the time an application's `createContext` receives
+ * that `IncomingMessage`, the stream is consumed.
+ *
+ * The contract was written for an EAGER resolver and kept when the resolver became lazy. Both
+ * decisions were right on their own; the sentence joining them was not, and it pointed callers at
+ * something impossible while implying a capability that does not exist.
+ *
+ * Practically this costs little — identity is overwhelmingly a header or a cookie, and both survive
+ * the conversion untouched. What it costs an application that resolves identity from the BODY is an
+ * empty read or a wait for an `'end'` that already fired, which is why saying so plainly matters
+ * more than the frequency suggests.
+ *
+ * Restoring body access would mean resolving eagerly — running the application's `createContext`
+ * twice on every route request, which is exactly what the laziness exists to prevent — or buffering
+ * every agent request body to replay it, which is a cost paid by every caller for a case almost
+ * none has.
+ */
+
+/** What {@link createAgentSubjectResolver} needs in order to build the run context. */
+interface AgentSubjectSources {
+    req: IncomingMessage;
+    res: ServerResponse;
+    loadModule: LoadModule;
+    /** The app's `server/` directory. Absent ⇒ there is no `context.ts` to consult. */
+    serverDir: string | undefined;
+    pluginRunner: PluginRunner | undefined;
+}
+/**
+ * Build a memoized resolver for the caller's identity.
+ *
+ * Decorations are applied ON TOP of the factory's result, matching `executeRoute`: a plugin
+ * decoration wins only where `context.ts` did not set the same key.
+ *
+ * A `createContext` that throws is not swallowed — an application whose identity resolution is
+ * broken must not be treated as an anonymous caller, because that reads as a clean refusal and
+ * hides the fault. The throw reaches the branch's own error handler and becomes a 500.
+ */
+declare function createAgentSubjectResolver(sources: AgentSubjectSources): () => Promise<RouteSubject | null>;
+/**
+ * The app's `createContext`, as a host that is not Node sees it.
+ *
+ * Deliberately NOT `middleware-runner`'s `ContextFactory`, which types its argument as
+ * `IncomingMessage`/`ServerResponse`. Those are exactly right for the dev path and wrong here: on
+ * every deploy target the pair is what `createWebShim` synthesises over a Web `Request`. Widening
+ * to `unknown` says what is actually true at this boundary rather than casting a lie past the
+ * type system — the app's own `createContext` is typed by the app, and a generated fragment is the
+ * one caller that cannot promise it Node objects.
+ */
+type HostContextFactory = (args: {
+    request: unknown;
+    response: unknown;
+}) => unknown;
+/**
+ * The half that CALLS an already-resolved context factory (B-185, ADR 0014).
+ *
+ * {@link createAgentSubjectResolver} does two things: it LOCATES `context.ts` on a filesystem —
+ * `existsSync` plus `loadModule`, inside `createServerContext` — and then CALLS what it found. A
+ * deploy target with no filesystem can do the second and not the first, so the generator bakes the
+ * module as a static import (the way routes, agents and plugins already are) and hands the factory
+ * here directly.
+ *
+ * Measured before this existed: passing `serverDir: undefined` to the resolver above takes its
+ * `produced = {}` branch, never touches `req`/`res`/`loadModule`, and returns
+ * `subjectFromContext({})` — which is null for every caller. Satisfying its types would have
+ * satisfied nothing.
+ *
+ * `request`/`response` are whatever the host has. On every deploy target that is the
+ * `ShimRequest`/`ShimResponse` pair `createWebShim` synthesises over a Web `Request`, which is the
+ * same contract routes on those targets have crossed since they were baked.
+ */
+declare function createSubjectResolverFromFactory(createContext: HostContextFactory | undefined, request: unknown, response: unknown, pluginRunner?: PluginRunner): () => Promise<RouteSubject | null>;
+
+export { createAgentSubjectResolver, createSubjectResolverFromFactory, matchAgentAuxRoute, mountAgent, serveMatchedAuxRoute };

package/dist/adapters/agent-mount.js

@@ -1,8 +1,15 @@
+import {
+  createAgentSubjectResolver,
+  createSubjectResolverFromFactory,
+  matchAgentAuxRoute,
+  serveMatchedAuxRoute
+} from "../chunk-BDPD5HEO.js";
 import {
   mountAgent
-} from "../chunk-GAJOZJWD.js";
+} from "../chunk-MOGTMGGA.js";
+import "../chunk-3T5XLDOH.js";
 import "../chunk-P6OS7652.js";
-import "../chunk-ENRT6DAU.js";
+import "../chunk-IDWN2OSG.js";
 import "../chunk-PVNMLZ5G.js";
 import "../chunk-ZDCCILMP.js";
 import "../chunk-CHTAWXC2.js";
@@ -10,6 +17,10 @@ import "../chunk-AVQU5CQF.js";
 import {
   scanAgents
 } from "../chunk-KDP2HURW.js";
+import "../chunk-V6Y2SMRG.js";
+import "../chunk-ACKBVBUI.js";
+import "../chunk-IZ3TIL6K.js";
+import "../chunk-TQEE36VD.js";
 import {
   resolveProvider
 } from "../chunk-ICXXHV4V.js";
@@ -18,8 +29,12 @@ import "../chunk-SOYOYGWY.js";
 import "../chunk-ZWN3AODA.js";
 import "../chunk-XTHN6JBX.js";
 export {
+  createAgentSubjectResolver,
+  createSubjectResolverFromFactory,
+  matchAgentAuxRoute,
   mountAgent,
   resolveProvider,
-  scanAgents
+  scanAgents,
+  serveMatchedAuxRoute
 };
 //# sourceMappingURL=agent-mount.js.map

package/dist/adapters/security-headers.d.ts

@@ -57,6 +57,22 @@ export { b as buildSecurityHeaders } from '../security-headers-vris2MQq.js';
  * (`cli/commands/start/index.ts`). An app with no security block gets the same
  * baseline deployed as it gets locally.
  */
+/**
+ * The two declarations every deploy entry emits to carry the security baseline.
+ *
+ * Four adapters wrote these same two lines — `netlify`, `vercel`, `aws-lambda`, `deno-deploy` —
+ * each under a comment naming its own host's static-asset boundary. The COMMENT differs and is
+ * meant to; the declarations do not.
+ *
+ * Extracted after SonarCloud's duplication gate failed a PR at 4.0% against a 3% ceiling and named
+ * this as the largest repeated block among the changed files. The gate was measuring something
+ * real: a literal renderer and a builder call, copied four times, is four places to update when
+ * either changes.
+ *
+ * Returns the lines rather than a joined string, because every caller splices them into an array
+ * of emitted lines.
+ */
+declare function securityHeadersDeclarations(config: SecurityHeadersConfig | undefined): string[];
 declare function renderSecurityHeadersConfigLiteral(headers: SecurityHeadersConfig | undefined): string;
 /**
  * Put the headers on a response, without overruling the handler.
@@ -129,4 +145,4 @@ interface DeployedSecurityHeaderLimits {
  */
 declare function describeDeployedSecurityHeaders(limits: DeployedSecurityHeaderLimits): string;
 
-export { type DeployedSecurityHeaderLimits, describeDeployedSecurityHeaders, renderSecurityHeadersConfigLiteral, withSecurityHeaders };
+export { type DeployedSecurityHeaderLimits, describeDeployedSecurityHeaders, renderSecurityHeadersConfigLiteral, securityHeadersDeclarations, withSecurityHeaders };

package/dist/adapters/security-headers.js

@@ -7,6 +7,12 @@ import {
 import "../chunk-XTHN6JBX.js";
 
 // src/adapters/security-headers.ts
+function securityHeadersDeclarations(config) {
+  return [
+    `const SECURITY_HEADERS_CONFIG = ${renderSecurityHeadersConfigLiteral(config)}`,
+    `const SECURITY_HEADERS = buildSecurityHeaders(SECURITY_HEADERS_CONFIG, { production: true })`
+  ];
+}
 function renderSecurityHeadersConfigLiteral(headers) {
   return JSON.stringify(headers ?? {});
 }
@@ -59,6 +65,7 @@ export {
   describeDeployedSecurityHeaders,
   generateNonce,
   renderSecurityHeadersConfigLiteral,
+  securityHeadersDeclarations,
   withSecurityHeaders
 };
 //# sourceMappingURL=security-headers.js.map

package/dist/adapters/security-headers.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/adapters/security-headers.ts"],"mappings":";;;;;;;;;AA8EO,SAAS,mCACd,SACQ;AACR,SAAO,KAAK,UAAU,WAAW,CAAC,CAAC;AACrC;AAyBO,SAAS,oBAAoB,UAAoB,SAA2C;AACjG,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,CAAC,SAAS,QAAQ,IAAI,GAAG,EAAG,UAAS,QAAQ,IAAI,KAAK,KAAK;AAAA,EACjE;AACA,SAAO;AACT;AAgDO,SAAS,gCAAgC,QAA8C;AAC5F,QAAM,UAAU,qBAAqB,OAAO,mBAAmB,CAAC,GAAG,EAAE,YAAY,KAAK,CAAC;AACvF,QAAM,QAAQ,OAAO,KAAK,OAAO;AACjC,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO,SAAS,OAAO,MAAM;AAAA,EAC/B;AAEA,QAAM,QAAQ;AAAA,IACZ,iDAA4C,OAAO,MAAM,eAAe,MAAM,KAAK,IAAI,CAAC;AAAA,EAC1F;AACA,QAAM,WAAW,MAAM,KAAK,CAAC,SAAS,KAAK,WAAW,yBAAyB,CAAC;AAChF,MAAI,YAAY,CAAC,OAAO,YAAY;AAClC,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,oBAAoB,uBAAuB;AACpD,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,oBAAoB,sBAAsB;AACnD,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;","names":[]}
+{"version":3,"sources":["../../src/adapters/security-headers.ts"],"mappings":";;;;;;;;;AA6FO,SAAS,4BAA4B,QAAqD;AAC/F,SAAO;AAAA,IACL,mCAAmC,mCAAmC,MAAM,CAAC;AAAA,IAC7E;AAAA,EACF;AACF;AAEO,SAAS,mCACd,SACQ;AACR,SAAO,KAAK,UAAU,WAAW,CAAC,CAAC;AACrC;AAyBO,SAAS,oBAAoB,UAAoB,SAA2C;AACjG,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,CAAC,SAAS,QAAQ,IAAI,GAAG,EAAG,UAAS,QAAQ,IAAI,KAAK,KAAK;AAAA,EACjE;AACA,SAAO;AACT;AAgDO,SAAS,gCAAgC,QAA8C;AAC5F,QAAM,UAAU,qBAAqB,OAAO,mBAAmB,CAAC,GAAG,EAAE,YAAY,KAAK,CAAC;AACvF,QAAM,QAAQ,OAAO,KAAK,OAAO;AACjC,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO,SAAS,OAAO,MAAM;AAAA,EAC/B;AAEA,QAAM,QAAQ;AAAA,IACZ,iDAA4C,OAAO,MAAM,eAAe,MAAM,KAAK,IAAI,CAAC;AAAA,EAC1F;AACA,QAAM,WAAW,MAAM,KAAK,CAAC,SAAS,KAAK,WAAW,yBAAyB,CAAC;AAChF,MAAI,YAAY,CAAC,OAAO,YAAY;AAClC,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,oBAAoB,uBAAuB;AACpD,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,oBAAoB,sBAAsB;AACnD,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;","names":[]}

package/dist/{agent-UBDDP2L5.js → agent-7RPGAKTY.js}

@@ -3,8 +3,8 @@ import "tsx/esm";
 import {
   agentCommand,
   createAgentSsrLoader
-} from "./chunk-FYYKMPST.js";
-import "./chunk-UETVDZBE.js";
+} from "./chunk-TJPENLGQ.js";
+import "./chunk-BINRCILF.js";
 import "./chunk-5NNFO7R7.js";
 import "./chunk-Z7CJHDLS.js";
 import "./chunk-3QPVEJ7D.js";
@@ -12,4 +12,4 @@ export {
   agentCommand,
   createAgentSsrLoader
 };
-//# sourceMappingURL=agent-UBDDP2L5.js.map
+//# sourceMappingURL=agent-7RPGAKTY.js.map

package/dist/{app-typed-client-RAFEBA7S.js → app-typed-client-C4LRUSIS.js}

@@ -1,14 +1,14 @@
 import {
   scanControllerModules
-} from "./chunk-GDF2XQOO.js";
-import "./chunk-GAJOZJWD.js";
+} from "./chunk-425FJKKO.js";
+import "./chunk-MOGTMGGA.js";
 import "./chunk-WSOAN4KN.js";
 import "./chunk-ENSFCKP6.js";
-import "./chunk-Q7T3UQ4L.js";
+import "./chunk-SRJBH5E5.js";
+import "./chunk-3T5XLDOH.js";
 import "./chunk-P6OS7652.js";
 import "./chunk-ZDUO4IYN.js";
-import "./chunk-7L7LQ2GU.js";
-import "./chunk-ENRT6DAU.js";
+import "./chunk-IDWN2OSG.js";
 import "./chunk-47FFT43U.js";
 import "./chunk-NTDN54XO.js";
 import "./chunk-PVNMLZ5G.js";
@@ -427,4 +427,4 @@ export {
   generateClientDts,
   shouldReemitForFile
 };
-//# sourceMappingURL=app-typed-client-RAFEBA7S.js.map
+//# sourceMappingURL=app-typed-client-C4LRUSIS.js.map

package/dist/{app-typed-client-BE3PV3JY.js → app-typed-client-R6OUJZEE.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import "tsx/esm";
-import "./chunk-G2NWAVGG.js";
-import "./chunk-UETVDZBE.js";
+import "./chunk-SJ4AW54X.js";
+import "./chunk-BINRCILF.js";
 import {
   scanControllerModules
 } from "./chunk-QD5X56I3.js";
@@ -411,4 +411,4 @@ export {
   generateClientDts,
   shouldReemitForFile
 };
-//# sourceMappingURL=app-typed-client-BE3PV3JY.js.map
+//# sourceMappingURL=app-typed-client-R6OUJZEE.js.map

package/dist/{aws-lambda-R76PWR27.js → aws-lambda-OCJM5YGB.js}

@@ -1,14 +1,18 @@
 #!/usr/bin/env node
 import "tsx/esm";
 import {
-  deployedCorsFragment,
-  deployedCsrfFragment,
+  deployedEntryPreamble
+} from "./chunk-XG6SQUEP.js";
+import {
+  JSON_NOT_FOUND_RESPONSE,
+  agentsDirLiteral,
+  deployedAgentsFragment,
   deployedRuntimeConfigFragment,
   deployedTraceFragment,
   describeDeployedSecurityHeaders,
-  renderSecurityHeadersConfigLiteral,
+  scannedFromLoaderCache,
   serverDirLiteral
-} from "./chunk-6B3CMPE4.js";
+} from "./chunk-FFGP2LGQ.js";
 import {
   nodeAdapter
 } from "./chunk-KI4DOTN4.js";
@@ -59,7 +63,7 @@ function responseToLambdaResultV2(statusCode, headers, body) {
     isBase64Encoded: isBinary
   };
 }
-function awsLambdaHandlerFragment(runtimeSpread) {
+function awsLambdaHandlerFragment(runtimeSpread, agentsBranch, agentsHostBypass) {
   return [
     `// #382 \u2014 this target is DELISTED for response streaming, by construction.`,
     `// The Lambda v2 result object below carries \`body\` as a string, so the`,
@@ -119,7 +123,7 @@ function awsLambdaHandlerFragment(runtimeSpread) {
     `}`,
     ``,
     `async function routeRequest(event, path) {`,
-    `  if (!path.startsWith('/api/')) {`,
+    `  if (!path.startsWith('/api/')${agentsHostBypass}) {`,
     `    return new Response(`,
     `      'Static assets must be served from CloudFront or a separate static host.',`,
     `      { status: 404, headers: { 'content-type': 'text/plain' } },`,
@@ -129,15 +133,18 @@ function awsLambdaHandlerFragment(runtimeSpread) {
     `  if (!routesCache) routesCache = scanServerRoutes(serverDir)`,
     `  if (!loaderCache) loaderCache = createProductionLoader()`,
     ``,
+    // B-235 — hoisted above the agents branch, which names `request` like every other host's.
+    // It was declared below `matchRoute`, and an agent path never reaches a route match. Building
+    // it here costs nothing new: the outer handler already built one for the CORS matcher, and
+    // `eventV2ToRequest` reads a body the event already carries, so there is no stream to drain
+    // twice.
+    `  const request = eventV2ToRequest(event)`,
+    ``,
+    ...agentsBranch,
+    ``,
     `  const match = matchRoute(path, routesCache)`,
-    `  if (!match) {`,
-    `    return new Response(JSON.stringify({ error: { code: 'NOT_FOUND' } }), {`,
-    `      status: 404,`,
-    `      headers: { 'content-type': 'application/json' },`,
-    `    })`,
-    `  }`,
+    `  if (!match) return ${JSON_NOT_FOUND_RESPONSE}`,
     ``,
-    `  const request = eventV2ToRequest(event)`,
     `  const { req, res, toResponse } = createWebShim(request)`,
     ...deployedTraceFragment("request", "  "),
     `  const method = request.method.toUpperCase()`,
@@ -147,6 +154,10 @@ function awsLambdaHandlerFragment(runtimeSpread) {
 }
 function renderAwsLambdaEntry(opts = {}) {
   const runtimeConfig = deployedRuntimeConfigFragment(opts);
+  const agentsFragment = deployedAgentsFragment(scannedFromLoaderCache(agentsDirLiteral(opts)), {
+    pathname: "path",
+    notFound: JSON_NOT_FOUND_RESPONSE
+  });
   return [
     `// Generated by Theo \u2014 AWS Lambda Adapter`,
     `// Use with API Gateway HTTP API v2 (default).`,
@@ -166,14 +177,7 @@ function renderAwsLambdaEntry(opts = {}) {
     `// theo.config.ts to read. Non-API paths 404 here and the document is served`,
     `// from CloudFront or another static host, so this covers the API and not the`,
     `// page (usetheokit/theokit#412).`,
-    `const SECURITY_HEADERS_CONFIG = ${renderSecurityHeadersConfigLiteral(opts.securityHeaders)}`,
-    `const SECURITY_HEADERS = buildSecurityHeaders(SECURITY_HEADERS_CONFIG, { production: true })`,
-    ``,
-    ...runtimeConfig.imports,
-    ...runtimeConfig.declarations,
-    ...deployedCsrfFragment(opts),
-    ``,
-    ...deployedCorsFragment(opts.cors, "aws-lambda"),
+    ...deployedEntryPreamble(runtimeConfig, agentsFragment, opts, "aws-lambda"),
     ``,
     `function eventV2ToRequest(event) {`,
     `  const method = event.requestContext?.http?.method ?? 'GET'`,
@@ -196,7 +200,11 @@ function renderAwsLambdaEntry(opts = {}) {
     `  })`,
     `}`,
     ``,
-    ...awsLambdaHandlerFragment(runtimeConfig.executeRouteSpread)
+    ...awsLambdaHandlerFragment(
+      runtimeConfig.executeRouteSpread,
+      agentsFragment.branch,
+      agentsFragment.hostBypass
+    )
   ].join("\n");
 }
 async function buildAwsLambda(config, cwd, deps = {}, ctx) {
@@ -213,6 +221,10 @@ async function buildAwsLambda(config, cwd, deps = {}, ctx) {
   ensureDir(outputDir);
   const entry = renderAwsLambdaEntry({
     securityHeaders: config.security?.headers,
+    // B-235 — pillar (a): the option existed and no build passed it, so a project with a
+    // configured agents directory got the default `agents` on this target. Same defect
+    // B-185 fixed for bun and deno, one target over.
+    agentsDir: config.agentsDir,
     csrf: config.security?.csrf,
     disallowed: config.security?.disallowed,
     cors: config.security?.cors,
@@ -259,4 +271,4 @@ export {
   renderAwsLambdaEntry,
   responseToLambdaResultV2
 };
-//# sourceMappingURL=aws-lambda-R76PWR27.js.map
+//# sourceMappingURL=aws-lambda-OCJM5YGB.js.map

package/dist/aws-lambda-OCJM5YGB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapters/aws-lambda.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * AWS Lambda adapter. Writes to `cwd/.theokit/lambda/`. Build-time tool.\n */\nimport { mkdirSync, writeFileSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nimport type { TheoConfig } from '../config/schema.js'\nimport { assertServicesUnsupported, readManifest } from '../services/index.js'\n\nimport {\n  deployedAgentsFragment,\n  scannedFromLoaderCache,\n  JSON_NOT_FOUND_RESPONSE,\n} from './deployed-agents.js'\nimport { deployedEntryPreamble } from './deployed-preamble.js'\nimport {\n  agentsDirLiteral,\n  deployedRuntimeConfigFragment,\n  serverDirLiteral,\n} from './deployed-runtime-config.js'\nimport { deployedTraceFragment } from './deployed-trace.js'\nimport { nodeAdapter } from './node.js'\nimport { describeDeployedSecurityHeaders } from './security-headers.js'\nimport type { AdapterBuildContext, DeployAdapter, DeployedEntryOptions } from './types.js'\n\nexport interface AwsLambdaBuildDeps {\n  runNodeBuild?: (config: TheoConfig, cwd: string, ctx?: AdapterBuildContext) => Promise<void>\n  writeEntry?: (path: string, content: string) => void\n  ensureDir?: (path: string) => void\n}\n\nexport interface RequestShape {\n  method: string\n  path: string\n  headers: Record<string, string>\n  body?: string\n}\n\nexport interface LambdaResultV2 {\n  statusCode: number\n  headers: Record<string, string>\n  body: string\n  isBase64Encoded: boolean\n}\n\nconst BINARY_CONTENT_TYPES = [\n  'application/octet-stream',\n  'application/pdf',\n  'application/zip',\n  'image/',\n  'audio/',\n  'video/',\n]\n\nfunction isBinaryContentType(contentType: string | undefined): boolean {\n  if (!contentType) return false\n  const ct = contentType.toLowerCase()\n  return BINARY_CONTENT_TYPES.some((prefix) => ct.startsWith(prefix))\n}\n\ninterface APIGatewayProxyEventV2 {\n  version: string\n  requestContext: {\n    http: { method: string; path: string }\n  }\n  headers?: Record<string, string | undefined>\n  body?: string\n  isBase64Encoded?: boolean\n}\n\nexport function eventV2ToRequestShape(event: APIGatewayProxyEventV2): RequestShape {\n  const headers: Record<string, string> = {}\n  for (const [k, v] of Object.entries(event.headers ?? {})) {\n    if (v !== undefined) headers[k] = v\n  }\n  let body: string | undefined = event.body\n  if (body !== undefined && event.isBase64Encoded) {\n    body = Buffer.from(body, 'base64').toString('utf-8')\n  }\n  return {\n    method: event.requestContext.http.method,\n    path: event.requestContext.http.path,\n    headers,\n    body,\n  }\n}\n\nexport function responseToLambdaResultV2(\n  statusCode: number,\n  headers: Record<string, string>,\n  body: string,\n): LambdaResultV2 {\n  const isBinary = isBinaryContentType(headers['content-type'])\n  return {\n    statusCode,\n    headers,\n    body: isBinary ? Buffer.from(body, 'binary').toString('base64') : body,\n    isBase64Encoded: isBinary,\n  }\n}\n\n// Generated-code fragments — extracted so the parent emitter stays under the\n// max-lines-per-function ceiling.\n/** The v2 result conversion, the handler, and the routing that feeds them. */\nfunction awsLambdaHandlerFragment(\n  runtimeSpread: string,\n  agentsBranch: readonly string[],\n  agentsHostBypass: string,\n): string[] {\n  return [\n    `// #382 — this target is DELISTED for response streaming, by construction.`,\n    `// The Lambda v2 result object below carries \\`body\\` as a string, so the`,\n    `// response cannot exist until the run has finished, no matter how the`,\n    `// framework's shim writes it. Streaming here would require`,\n    `// \\`awslambda.streamifyResponse\\` plus a Function URL in RESPONSE_STREAM`,\n    `// invoke mode — neither of which this adapter emits, and which would break`,\n    `// every API Gateway deployment of it. Rather than degrade in silence, a`,\n    `// response that is unambiguously a stream is named in the logs below.`,\n    `async function responseToV2Result(response, routePath) {`,\n    `  const headers = {}`,\n    `  response.headers.forEach((v, k) => { headers[k] = v })`,\n    `  const ct = headers['content-type'] ?? ''`,\n    `  if (ct.includes('text/event-stream')) {`,\n    `    console.warn(`,\n    `      '[theo][aws-lambda] ' + routePath + ' returned a streaming response (' + ct + '), ' +`,\n    `      'but the aws-lambda target buffers it whole and delivers it when the run ends. ' +`,\n    `      'This target is delisted for streaming (theokit#382). Deploy streaming routes to ' +`,\n    `      'cloudflare, vercel, netlify, bun, deno-deploy or node.'`,\n    `    )`,\n    `  }`,\n    `  const isBinary = /^application\\\\/(octet-stream|pdf|zip)|^(image|audio|video)\\\\//.test(ct)`,\n    `  if (isBinary) {`,\n    `    const buf = Buffer.from(await response.arrayBuffer())`,\n    `    return {`,\n    `      statusCode: response.status,`,\n    `      headers,`,\n    `      body: buf.toString('base64'),`,\n    `      isBase64Encoded: true,`,\n    `    }`,\n    `  }`,\n    `  return {`,\n    `    statusCode: response.status,`,\n    `    headers,`,\n    `    body: await response.text(),`,\n    `    isBase64Encoded: false,`,\n    `  }`,\n    `}`,\n    ``,\n    `// Every outcome — including both 404s — is produced as a Web Response by`,\n    `// routeRequest, so the security baseline is applied at ONE place and the`,\n    `// v2 result object is built from headers that already carry it.`,\n    `export const handler = async (event) => {`,\n    `  const path = event.requestContext?.http?.path ?? '/'`,\n    `  // #409 — the same event, read as a Web Request so the CORS matcher can see the method and`,\n    `  // the \\`origin\\` header. \\`eventV2ToRequest\\` reads a body already present in the event, so`,\n    `  // unlike the Node targets there is no stream to drain twice.`,\n    `  const corsRequest = eventV2ToRequest(event)`,\n    ``,\n    `  // The preflight is answered BEFORE anything routes: an OPTIONS the router handles is an`,\n    `  // OPTIONS the browser never gets a CORS answer to.`,\n    `  const preflight = corsPreflight(corsRequest)`,\n    `  const response = preflight !== null`,\n    `    ? withSecurityHeaders(preflight, SECURITY_HEADERS)`,\n    `    : withCors(corsRequest, withSecurityHeaders(await routeRequest(event, path), SECURITY_HEADERS))`,\n    `  return responseToV2Result(response, path)`,\n    `}`,\n    ``,\n    `async function routeRequest(event, path) {`,\n    `  if (!path.startsWith('/api/')${agentsHostBypass}) {`,\n    `    return new Response(`,\n    `      'Static assets must be served from CloudFront or a separate static host.',`,\n    `      { status: 404, headers: { 'content-type': 'text/plain' } },`,\n    `    )`,\n    `  }`,\n    ``,\n    `  if (!routesCache) routesCache = scanServerRoutes(serverDir)`,\n    `  if (!loaderCache) loaderCache = createProductionLoader()`,\n    ``,\n    // B-235 — hoisted above the agents branch, which names `request` like every other host's.\n    // It was declared below `matchRoute`, and an agent path never reaches a route match. Building\n    // it here costs nothing new: the outer handler already built one for the CORS matcher, and\n    // `eventV2ToRequest` reads a body the event already carries, so there is no stream to drain\n    // twice.\n    `  const request = eventV2ToRequest(event)`,\n    ``,\n    ...agentsBranch,\n    ``,\n    `  const match = matchRoute(path, routesCache)`,\n    `  if (!match) return ${JSON_NOT_FOUND_RESPONSE}`,\n    ``,\n    `  const { req, res, toResponse } = createWebShim(request)`,\n    ...deployedTraceFragment('request', '  '),\n    `  const method = request.method.toUpperCase()`,\n    `  return toResponse(executeRoute({ route: match.route, method, params: match.params, req, res, loadModule: loaderCache, serverDir, requestId, ...CSRF_CONFIG, ${runtimeSpread} }))`,\n    `}`,\n  ]\n}\n\nexport function renderAwsLambdaEntry(opts: DeployedEntryOptions = {}): string {\n  const runtimeConfig = deployedRuntimeConfigFragment(opts)\n  // B-235. The entry already builds a Web `Request` — `eventV2ToRequest(event)`, for the CORS\n  // matcher — so the shape this branch needs was here all along. `path` rather than `url.pathname`\n  // because that is the name this host reads the route from.\n  const agentsFragment = deployedAgentsFragment(scannedFromLoaderCache(agentsDirLiteral(opts)), {\n    pathname: 'path',\n    notFound: JSON_NOT_FOUND_RESPONSE,\n  })\n  return [\n    `// Generated by Theo — AWS Lambda Adapter`,\n    `// Use with API Gateway HTTP API v2 (default).`,\n    ``,\n    `import { resolve } from 'node:path'`,\n    `import { scanServerRoutes, matchRoute, executeRoute, createProductionLoader, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler } from 'theokit/server'`,\n    `import { createWebShim } from 'theokit/adapters/web-shim'`,\n    `import { buildSecurityHeaders, withSecurityHeaders } from 'theokit/adapters/security-headers'`,\n    ``,\n    `const cwd = process.cwd()`,\n    `const serverDir = resolve(cwd, ${serverDirLiteral(opts)})`,\n    `let routesCache = null`,\n    `let loaderCache = null`,\n    ``,\n    `// #410 — the security baseline \\`theokit start\\` puts on every response,`,\n    `// carried here as a literal because the deployed function has no`,\n    `// theo.config.ts to read. Non-API paths 404 here and the document is served`,\n    `// from CloudFront or another static host, so this covers the API and not the`,\n    `// page (usetheokit/theokit#412).`,\n    ...deployedEntryPreamble(runtimeConfig, agentsFragment, opts, 'aws-lambda'),\n    ``,\n    `function eventV2ToRequest(event) {`,\n    `  const method = event.requestContext?.http?.method ?? 'GET'`,\n    `  const path = event.requestContext?.http?.path ?? '/'`,\n    `  const host = event.headers?.host ?? 'lambda'`,\n    `  const qs = event.rawQueryString ? '?' + event.rawQueryString : ''`,\n    `  const url = 'https://' + host + path + qs`,\n    `  const headers = new Headers()`,\n    `  for (const [k, v] of Object.entries(event.headers ?? {})) {`,\n    `    if (v !== undefined) headers.set(k, String(v))`,\n    `  }`,\n    `  let body = event.body`,\n    `  if (body && event.isBase64Encoded) {`,\n    `    body = Buffer.from(body, 'base64')`,\n    `  }`,\n    `  return new Request(url, {`,\n    `    method,`,\n    `    headers,`,\n    `    body: method === 'GET' || method === 'HEAD' ? undefined : body,`,\n    `  })`,\n    `}`,\n    ``,\n    ...awsLambdaHandlerFragment(\n      runtimeConfig.executeRouteSpread,\n      agentsFragment.branch,\n      agentsFragment.hostBypass,\n    ),\n  ].join('\\n')\n}\n\nexport async function buildAwsLambda(\n  config: TheoConfig,\n  cwd: string,\n  deps: AwsLambdaBuildDeps = {},\n  ctx?: AdapterBuildContext,\n): Promise<void> {\n  // Wave 2 (T2.2) — reject polyglot services on this adapter.\n  assertServicesUnsupported('aws-lambda', readManifest(cwd))\n\n  // #382 — refuse by name rather than build something that cannot do what was\n  // asked. `ssrStreaming` is the config's declaration that responses stream,\n  // and this target is delisted for that (see `awsLambdaAdapter.streamsResponses`).\n  if (config.ssrStreaming) {\n    throw new Error(\n      '[adapter-aws-lambda] ssrStreaming is on, but the aws-lambda target does not stream ' +\n        'responses: the Lambda v2 result object carries the body as a string, so nothing can ' +\n        'leave the function before the run ends. Response streaming would need ' +\n        'awslambda.streamifyResponse plus a Function URL in RESPONSE_STREAM invoke mode, which ' +\n        'this adapter does not emit. Build a streaming target instead (cloudflare, vercel, ' +\n        'netlify, bun, deno-deploy, node), or set ssrStreaming: false in theo.config.ts.',\n    )\n  }\n\n  const runNodeBuild = deps.runNodeBuild ?? nodeAdapter.build.bind(nodeAdapter)\n  await runNodeBuild(config, cwd, ctx)\n\n  const outputDir = resolve(cwd, '.theokit/aws')\n  const ensureDir = deps.ensureDir ?? ((p: string) => mkdirSync(p, { recursive: true }))\n  ensureDir(outputDir)\n\n  const entry = renderAwsLambdaEntry({\n    securityHeaders: config.security?.headers,\n    // B-235 — pillar (a): the option existed and no build passed it, so a project with a\n    // configured agents directory got the default `agents` on this target. Same defect\n    // B-185 fixed for bun and deno, one target over.\n    agentsDir: config.agentsDir,\n    csrf: config.security?.csrf,\n    disallowed: config.security?.disallowed,\n    cors: config.security?.cors,\n    // #425 — a selector, not a transformer, so it rides as a literal like the values above.\n    serialization: config.serialization,\n  })\n  const write =\n    deps.writeEntry ??\n    ((p, c) => {\n      writeFileSync(p, c)\n    })\n  write(resolve(outputDir, 'handler.mjs'), entry)\n\n  // eslint-disable-next-line no-console -- CLI build progress\n  console.log('\\n  ✓ AWS Lambda output → .theokit/aws/handler.mjs')\n  // eslint-disable-next-line no-console -- CLI build progress\n  console.log(\n    `${describeDeployedSecurityHeaders({\n      target: 'aws-lambda',\n      securityHeaders: config.security?.headers,\n      mintsNonce: false,\n      documentHeaders: 'platform-unmanaged',\n    })}\\n`,\n  )\n}\n\nexport const awsLambdaAdapter: DeployAdapter = {\n  name: 'aws-lambda',\n  // #382 — delisted for streaming, deliberately. See DeployAdapter.\n  streamsResponses: false,\n  // #409 / #410 — the generated entry calls `executeRoute` with routes, loader\n  // and serverDir only. CSRF, route policy, file middleware and Zod validation\n  // still run because they live inside `executeRoute`; none of the remaining\n  // configurable concerns reach it. Declared explicitly rather than omitted so\n  // the gap is a statement in the source and not an absence.\n  //\n  // `securityHeaders` IS applied -- to every response this function returns.\n  // The document comes from CloudFront or another static host and does not pass\n  // through it (usetheokit/theokit#412).\n  appliesConfig: ['securityHeaders', 'csrf', 'disallowed', 'cors', 'serialization'],\n  build(config, cwd, ctx) {\n    return buildAwsLambda(config, cwd, {}, ctx)\n  },\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAGA,SAAS,WAAW,qBAAqB;AACzC,SAAS,eAAe;AAyCxB,IAAM,uBAAuB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,oBAAoB,aAA0C;AACrE,MAAI,CAAC,YAAa,QAAO;AACzB,QAAM,KAAK,YAAY,YAAY;AACnC,SAAO,qBAAqB,KAAK,CAAC,WAAW,GAAG,WAAW,MAAM,CAAC;AACpE;AAYO,SAAS,sBAAsB,OAA6C;AACjF,QAAM,UAAkC,CAAC;AACzC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,WAAW,CAAC,CAAC,GAAG;AACxD,QAAI,MAAM,OAAW,SAAQ,CAAC,IAAI;AAAA,EACpC;AACA,MAAI,OAA2B,MAAM;AACrC,MAAI,SAAS,UAAa,MAAM,iBAAiB;AAC/C,WAAO,OAAO,KAAK,MAAM,QAAQ,EAAE,SAAS,OAAO;AAAA,EACrD;AACA,SAAO;AAAA,IACL,QAAQ,MAAM,eAAe,KAAK;AAAA,IAClC,MAAM,MAAM,eAAe,KAAK;AAAA,IAChC;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,yBACd,YACA,SACA,MACgB;AAChB,QAAM,WAAW,oBAAoB,QAAQ,cAAc,CAAC;AAC5D,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,MAAM,WAAW,OAAO,KAAK,MAAM,QAAQ,EAAE,SAAS,QAAQ,IAAI;AAAA,IAClE,iBAAiB;AAAA,EACnB;AACF;AAKA,SAAS,yBACP,eACA,cACA,kBACU;AACV,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kCAAkC,gBAAgB;AAAA,IAClD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA,wBAAwB,uBAAuB;AAAA,IAC/C;AAAA,IACA;AAAA,IACA,GAAG,sBAAsB,WAAW,IAAI;AAAA,IACxC;AAAA,IACA,iKAAiK,aAAa;AAAA,IAC9K;AAAA,EACF;AACF;AAEO,SAAS,qBAAqB,OAA6B,CAAC,GAAW;AAC5E,QAAM,gBAAgB,8BAA8B,IAAI;AAIxD,QAAM,iBAAiB,uBAAuB,uBAAuB,iBAAiB,IAAI,CAAC,GAAG;AAAA,IAC5F,UAAU;AAAA,IACV,UAAU;AAAA,EACZ,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kCAAkC,iBAAiB,IAAI,CAAC;AAAA,IACxD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,sBAAsB,eAAe,gBAAgB,MAAM,YAAY;AAAA,IAC1E;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,MACD,cAAc;AAAA,MACd,eAAe;AAAA,MACf,eAAe;AAAA,IACjB;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,eAAsB,eACpB,QACA,KACA,OAA2B,CAAC,GAC5B,KACe;AAEf,4BAA0B,cAAc,aAAa,GAAG,CAAC;AAKzD,MAAI,OAAO,cAAc;AACvB,UAAM,IAAI;AAAA,MACR;AAAA,IAMF;AAAA,EACF;AAEA,QAAM,eAAe,KAAK,gBAAgB,YAAY,MAAM,KAAK,WAAW;AAC5E,QAAM,aAAa,QAAQ,KAAK,GAAG;AAEnC,QAAM,YAAY,QAAQ,KAAK,cAAc;AAC7C,QAAM,YAAY,KAAK,cAAc,CAAC,MAAc,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AACpF,YAAU,SAAS;AAEnB,QAAM,QAAQ,qBAAqB;AAAA,IACjC,iBAAiB,OAAO,UAAU;AAAA;AAAA;AAAA;AAAA,IAIlC,WAAW,OAAO;AAAA,IAClB,MAAM,OAAO,UAAU;AAAA,IACvB,YAAY,OAAO,UAAU;AAAA,IAC7B,MAAM,OAAO,UAAU;AAAA;AAAA,IAEvB,eAAe,OAAO;AAAA,EACxB,CAAC;AACD,QAAM,QACJ,KAAK,eACJ,CAAC,GAAG,MAAM;AACT,kBAAc,GAAG,CAAC;AAAA,EACpB;AACF,QAAM,QAAQ,WAAW,aAAa,GAAG,KAAK;AAG9C,UAAQ,IAAI,8DAAoD;AAEhE,UAAQ;AAAA,IACN,GAAG,gCAAgC;AAAA,MACjC,QAAQ;AAAA,MACR,iBAAiB,OAAO,UAAU;AAAA,MAClC,YAAY;AAAA,MACZ,iBAAiB;AAAA,IACnB,CAAC,CAAC;AAAA;AAAA,EACJ;AACF;AAEO,IAAM,mBAAkC;AAAA,EAC7C,MAAM;AAAA;AAAA,EAEN,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUlB,eAAe,CAAC,mBAAmB,QAAQ,cAAc,QAAQ,eAAe;AAAA,EAChF,MAAM,QAAQ,KAAK,KAAK;AACtB,WAAO,eAAe,QAAQ,KAAK,CAAC,GAAG,GAAG;AAAA,EAC5C;AACF;","names":[]}

package/dist/{build-U4HVYY6F.js → build-CGFKWZ73.js}

@@ -50,7 +50,7 @@ import "./chunk-OSBGZYXZ.js";
 
 // src/cli/commands/build.ts
 import { existsSync as existsSync4 } from "fs";
-import { dirname as dirname2, relative, resolve, sep as sep2 } from "path";
+import { dirname as dirname2, join, relative, resolve, sep as sep2 } from "path";
 
 // src/adapters/types.ts
 var VALID_TARGETS = [
@@ -554,7 +554,7 @@ async function buildCommand(options) {
 `);
 }
 async function runAdapterBuild(target, config, cwd) {
-  const { theoPluginAsync } = await import("./vite-plugin-WBF5NXGW.js");
+  const { theoPluginAsync } = await import("./vite-plugin-Z7AJG3M2.js");
   const { default: react } = await import("@vitejs/plugin-react");
   const ctx = {
     // `react()` may return Plugin or Plugin[] depending on version; spread the
@@ -599,11 +599,16 @@ async function runAdapterBuild(target, config, cwd) {
           filePath: toProjectRelative(agent.filePath),
           agentPath: agent.agentPath,
           name: agent.name
-        }))
+        })),
+        // B-185 — the identity module, decided here for the same reason the agents are: this
+        // provider is handed `serverDir`, and a Worker has no filesystem to look for it on. An app
+        // with no `server/context.ts` yields `undefined`, and the generator then emits no import —
+        // importing a file that is not there would fail the BUILD rather than one request.
+        contextModule: existsSync4(join(abs, "context.ts")) ? toProjectRelative(join(abs, "context.ts")) : void 0
       };
     }
   };
-  const { resolveAdapter } = await import("./registry-UOWTDUFL.js");
+  const { resolveAdapter } = await import("./registry-DDBXDHJ2.js");
   const adapter = await resolveAdapter(target);
   const { warnUnappliedConfig, assertRateLimitEnforceable } = await import("./config-support-O4REYSK5.js");
   assertRateLimitEnforceable(config, adapter, target);
@@ -676,4 +681,4 @@ function relativize3(absPath, root) {
 export {
   buildCommand
 };
-//# sourceMappingURL=build-U4HVYY6F.js.map
+//# sourceMappingURL=build-CGFKWZ73.js.map