theokit 0.68.0 → 0.70.0

package/dist/chunk-V5SSTT3C.js

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+import "tsx/esm";
+
+// src/adapters/deployed-plugins-module.ts
+var UnbakeablePluginError = class extends Error {
+  constructor(index, name, target) {
+    super(
+      `plugins[${index}] ("${name}") cannot be carried to the ${target} target: it is a constructed plugin, and a closure has no literal a generated entry could hold. Declare it by module specifier instead \u2014 plugins: ['./src/plugins/${name}.ts'] \u2014 so the build can emit a static import for it. Both forms work locally; only the specifier survives a deploy.`
+    );
+    this.name = "UnbakeablePluginError";
+  }
+};
+var MODULE_FILENAME = "theo.plugins.mjs";
+function planDeployedPlugins(plugins, target) {
+  if (plugins === void 0 || plugins.length === 0) return void 0;
+  const specifiers = plugins.map((entry, index) => {
+    if (typeof entry === "string") return entry;
+    throw new UnbakeablePluginError(index, nameOf(entry), target);
+  });
+  const vars = specifiers.map((_, i) => `__theoPlugin${String(i)}`);
+  return {
+    moduleSpecifier: `./${MODULE_FILENAME}`,
+    specifiers,
+    source: [
+      `// Generated by Theo \u2014 the plugins the deployed entry registers (usetheokit/theokit#425).`,
+      `//`,
+      `// Static imports, resolved on the build machine. A constructed plugin has no literal, which`,
+      `// is why the config declares these by module specifier and why this file can exist at all.`,
+      ...specifiers.map((s, i) => `import ${vars[i]} from '${entrySpecifier(s)}'`),
+      ``,
+      `// Order is DECLARED order, because plugin order is hook order.`,
+      `export default { plugins: [${vars.join(", ")}] }`,
+      ``
+    ].join("\n")
+  };
+}
+function entrySpecifier(specifier) {
+  if (!specifier.startsWith(".")) return specifier;
+  return `../../${specifier.replace(/^\.\/+/, "")}`;
+}
+function nameOf(entry) {
+  if (entry != null && typeof entry === "object") {
+    const named = entry.name;
+    if (typeof named === "string" && named.length > 0) return named;
+  }
+  return "unnamed";
+}
+
+export {
+  planDeployedPlugins
+};
+//# sourceMappingURL=chunk-V5SSTT3C.js.map

package/dist/chunk-V5SSTT3C.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapters/deployed-plugins-module.ts"],"sourcesContent":["/**\n * The plugins module a build writes beside a deployed entry (usetheokit/theokit#425).\n *\n * ## What it is for\n *\n * `config.plugins` used to reach no deployed target at all, so `onRequest`, `preHandler`,\n * `onResponse` and `onError` were dead on every Web-standards deployment while firing locally. The\n * reason was never the hook loop — `executeRoute` has always run it — but that a constructed\n * plugin closes over state, and there is no literal for a closure.\n *\n * A plugin declared as a module SPECIFIER can be carried, because the build can emit a static\n * import for it. That is the road `renderBakedRoutes` already takes for route modules (#369):\n * resolve on the build machine, emit a static specifier, let the target's bundler see through it.\n *\n * ## Why the specifier is `../../`\n *\n * Every target that can carry plugins writes its entry two levels below the project root —\n * `.theokit/cloudflare/`, `.theokit/bun/`, `.theokit/deno/` — and a declared specifier is relative\n * to that root. The same arithmetic `renderBakedRoutes` does for routes, for the same reason.\n *\n * ## Which targets can carry them at all\n *\n * Only the ones whose output is BUNDLED from the project: Cloudflare (wrangler), Bun and Deno all\n * resolve the emitted import against the app's own source tree. Vercel, Netlify and AWS Lambda\n * receive a standalone function directory and never see the app's modules, so for them a named\n * refusal — which `findUnappliedConfig` already prints — remains the honest answer, and this module\n * is not called.\n */\n\n/**\n * A plugin the build was asked to carry and cannot.\n *\n * Its own type because the alternative is the defect this whole issue is: hooks that do not fire\n * and nothing that says so. A target that CAN carry a named module but was handed a closure has\n * something actionable to say, so it says it at build time rather than at the first request\n * (`rules/three-target-parity.md` § 3 — refuse by name).\n */\nexport class UnbakeablePluginError extends Error {\n  constructor(index: number, name: string, target: string) {\n    super(\n      `plugins[${index}] (\"${name}\") cannot be carried to the ${target} target: it is a constructed ` +\n        `plugin, and a closure has no literal a generated entry could hold. Declare it by module ` +\n        `specifier instead — plugins: ['./src/plugins/${name}.ts'] — so the build can emit a ` +\n        `static import for it. Both forms work locally; only the specifier survives a deploy.`,\n    )\n    this.name = 'UnbakeablePluginError'\n  }\n}\n\nexport interface DeployedPluginsPlan {\n  /** The module source to write beside the entry. */\n  readonly source: string\n  /** What the entry imports it as — a sibling, because both are written to the same directory. */\n  readonly moduleSpecifier: string\n  /** The declared specifiers, in order, for the build to report. */\n  readonly specifiers: readonly string[]\n}\n\nconst MODULE_FILENAME = 'theo.plugins.mjs'\n\n/**\n * Plan the plugins module for a target that can carry one.\n *\n * @param plugins - the raw `config.plugins` array.\n * @param target - the deploy target, named in the refusal so the message says where it applies.\n * @returns `undefined` when the app declares no plugins, so an app carrying none emits nothing.\n * @throws UnbakeablePluginError when an entry is a constructed plugin rather than a specifier.\n */\nexport function planDeployedPlugins(\n  plugins: readonly unknown[] | undefined,\n  target: string,\n): DeployedPluginsPlan | undefined {\n  if (plugins === undefined || plugins.length === 0) return undefined\n\n  const specifiers = plugins.map((entry, index) => {\n    if (typeof entry === 'string') return entry\n    throw new UnbakeablePluginError(index, nameOf(entry), target)\n  })\n\n  const vars = specifiers.map((_, i) => `__theoPlugin${String(i)}`)\n\n  return {\n    moduleSpecifier: `./${MODULE_FILENAME}`,\n    specifiers,\n    source: [\n      `// Generated by Theo — the plugins the deployed entry registers (usetheokit/theokit#425).`,\n      `//`,\n      `// Static imports, resolved on the build machine. A constructed plugin has no literal, which`,\n      `// is why the config declares these by module specifier and why this file can exist at all.`,\n      ...specifiers.map((s, i) => `import ${vars[i]} from '${entrySpecifier(s)}'`),\n      ``,\n      `// Order is DECLARED order, because plugin order is hook order.`,\n      `export default { plugins: [${vars.join(', ')}] }`,\n      ``,\n    ].join('\\n'),\n  }\n}\n\n/**\n * How the emitted module names a declared specifier.\n *\n * A RELATIVE specifier is relative to the project root, and the module sits two levels below it, so\n * it is re-based — the arithmetic `renderBakedRoutes` does for routes. A BARE specifier is a package\n * and must be left alone: `../../my-plugin-pkg` is a path that does not exist, where\n * `my-plugin-pkg` is a dependency the target's bundler resolves from `node_modules` like any other.\n */\nfunction entrySpecifier(specifier: string): string {\n  if (!specifier.startsWith('.')) return specifier\n  return `../../${specifier.replace(/^\\.\\/+/, '')}`\n}\n\n/** The plugin's own name when it has one, so the refusal names the thing the author wrote. */\nfunction nameOf(entry: unknown): string {\n  if (entry != null && typeof entry === 'object') {\n    const named = (entry as { name?: unknown }).name\n    if (typeof named === 'string' && named.length > 0) return named\n  }\n  return 'unnamed'\n}\n"],"mappings":";;;;AAqCO,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAC/C,YAAY,OAAe,MAAc,QAAgB;AACvD;AAAA,MACE,WAAW,KAAK,OAAO,IAAI,+BAA+B,MAAM,0KAEd,IAAI;AAAA,IAExD;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAWA,IAAM,kBAAkB;AAUjB,SAAS,oBACd,SACA,QACiC;AACjC,MAAI,YAAY,UAAa,QAAQ,WAAW,EAAG,QAAO;AAE1D,QAAM,aAAa,QAAQ,IAAI,CAAC,OAAO,UAAU;AAC/C,QAAI,OAAO,UAAU,SAAU,QAAO;AACtC,UAAM,IAAI,sBAAsB,OAAO,OAAO,KAAK,GAAG,MAAM;AAAA,EAC9D,CAAC;AAED,QAAM,OAAO,WAAW,IAAI,CAAC,GAAG,MAAM,eAAe,OAAO,CAAC,CAAC,EAAE;AAEhE,SAAO;AAAA,IACL,iBAAiB,KAAK,eAAe;AAAA,IACrC;AAAA,IACA,QAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAG,WAAW,IAAI,CAAC,GAAG,MAAM,UAAU,KAAK,CAAC,CAAC,UAAU,eAAe,CAAC,CAAC,GAAG;AAAA,MAC3E;AAAA,MACA;AAAA,MACA,8BAA8B,KAAK,KAAK,IAAI,CAAC;AAAA,MAC7C;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,EACb;AACF;AAUA,SAAS,eAAe,WAA2B;AACjD,MAAI,CAAC,UAAU,WAAW,GAAG,EAAG,QAAO;AACvC,SAAO,SAAS,UAAU,QAAQ,UAAU,EAAE,CAAC;AACjD;AAGA,SAAS,OAAO,OAAwB;AACtC,MAAI,SAAS,QAAQ,OAAO,UAAU,UAAU;AAC9C,UAAM,QAAS,MAA6B;AAC5C,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAAA,EAC5D;AACA,SAAO;AACT;","names":[]}

package/dist/chunk-XG6SQUEP.js

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+import "tsx/esm";
+import {
+  deployedCorsFragment,
+  deployedCsrfFragment,
+  securityHeadersDeclarations
+} from "./chunk-FFGP2LGQ.js";
+
+// src/adapters/deployed-preamble.ts
+function deployedEntryPreamble(runtimeConfig, agentsFragment, opts, host) {
+  return [
+    ...securityHeadersDeclarations(opts.securityHeaders),
+    ``,
+    ...runtimeConfig.imports,
+    ...agentsFragment.imports,
+    ...runtimeConfig.declarations,
+    ...agentsFragment.declarations,
+    ...deployedCsrfFragment(opts),
+    ``,
+    ...deployedCorsFragment(opts.cors, host)
+  ];
+}
+
+export {
+  deployedEntryPreamble
+};
+//# sourceMappingURL=chunk-XG6SQUEP.js.map

package/dist/chunk-XG6SQUEP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapters/deployed-preamble.ts"],"sourcesContent":["import type { SecurityHeadersConfig } from '../core/contracts/security-headers.js'\n\nimport type { DeployedAgentsFragment } from './deployed-agents.js'\nimport { deployedCorsFragment, type DeployedCorsOptions } from './deployed-cors.js'\nimport { deployedCsrfFragment, type DeployedCsrfOptions } from './deployed-csrf.js'\nimport { securityHeadersDeclarations } from './security-headers.js'\n\n/**\n * The module-level preamble five deploy entries emit, in the order they emit it.\n *\n * `bun`, `deno-deploy`, `vercel`, `netlify` and `aws-lambda` wrote these nine lines identically —\n * blank lines included — with one string different between them: the host name the CORS fragment\n * is told. Verified by matching the exact text, not by reading: the template below was searched\n * for in all six adapters and found in five.\n *\n * ## Why this was extracted, and what the alternative was\n *\n * SonarCloud's duplication gate is a REQUIRED check on `develop`, and it failed a promotion PR at\n * 4.2% on new code against a 3% ceiling. Three smaller extractions — the scan source, the security\n * declarations, the entry-options type — took it to 3.9% and stopped helping, because each one\n * ADDS an identical call site and an identical import to every caller. Measured on that PR: of 226\n * added lines under `src/`, 26 repeated, and every one of them was an import or a call.\n *\n * That is the metric describing the shape of extraction rather than a defect, and it is why the\n * answer had to be one bigger seam rather than a fourth small one. This collapses nine repeated\n * lines into one call in five files.\n *\n * Raising the threshold was never on the list: `rules/autonomy-envelope.md` floor 3 forbids moving\n * a bound to pass it, and a duplication gate whose ceiling rises stops reporting duplication.\n *\n * ## Why `cloudflare` is not a caller\n *\n * Its order is genuinely different — security declarations, then CSRF, then the runtime and agents\n * declarations, then CORS — and its CSRF fragment takes a second argument (`'a Worker'`) that no\n * other host passes. Forcing it through here would need a flag per difference, which turns this\n * function into a switch over its callers: the shape that drifts, and the one\n * `serveThroughPluginLifecycle` was extracted to undo after five copies had (#405).\n *\n * A Worker being the odd one is not an accident. It has no filesystem, so it bakes what the others\n * scan, and that changes what has to be declared before what.\n */\nexport function deployedEntryPreamble(\n  runtimeConfig: { imports: string[]; declarations: string[] },\n  agentsFragment: DeployedAgentsFragment,\n  opts: { securityHeaders?: SecurityHeadersConfig } & DeployedCsrfOptions & DeployedCorsOptions,\n  host: string,\n): string[] {\n  return [\n    ...securityHeadersDeclarations(opts.securityHeaders),\n    ``,\n    ...runtimeConfig.imports,\n    ...agentsFragment.imports,\n    ...runtimeConfig.declarations,\n    ...agentsFragment.declarations,\n    ...deployedCsrfFragment(opts),\n    ``,\n    ...deployedCorsFragment(opts.cors, host),\n  ]\n}\n"],"mappings":";;;;;;;;;AAyCO,SAAS,sBACd,eACA,gBACA,MACA,MACU;AACV,SAAO;AAAA,IACL,GAAG,4BAA4B,KAAK,eAAe;AAAA,IACnD;AAAA,IACA,GAAG,cAAc;AAAA,IACjB,GAAG,eAAe;AAAA,IAClB,GAAG,cAAc;AAAA,IACjB,GAAG,eAAe;AAAA,IAClB,GAAG,qBAAqB,IAAI;AAAA,IAC5B;AAAA,IACA,GAAG,qBAAqB,KAAK,MAAM,IAAI;AAAA,EACzC;AACF;","names":[]}

package/dist/{chunk-QGNSZ2ZK.js → chunk-YWWMYEAC.js}

@@ -4,11 +4,11 @@ import {
 } from "./chunk-O2KGDLA7.js";
 import {
   validateRouteInput
-} from "./chunk-Q7T3UQ4L.js";
+} from "./chunk-4D4YVXHR.js";
 import {
   evaluateRoutePolicy,
   subjectFromContext
-} from "./chunk-ENRT6DAU.js";
+} from "./chunk-IDWN2OSG.js";
 
 // src/core/contracts/module-preloads.ts
 function escapeAttribute(value) {
@@ -296,4 +296,4 @@ export {
   callProcedure,
   createOpenApiHandler
 };
-//# sourceMappingURL=chunk-QGNSZ2ZK.js.map
+//# sourceMappingURL=chunk-YWWMYEAC.js.map

package/dist/cli/index.js

@@ -15,12 +15,12 @@ function cliVersion() {
 // src/cli/index.ts
 var cli = cac("theokit");
 cli.command("dev", "Start development server").option("--port <port>", "Port number").action(async (options) => {
-  const { devCommand } = await import("../dev-E3USPAWQ.js");
+  const { devCommand } = await import("../dev-KKO3JIN7.js");
   await devCommand({ port: options.port ? Number(options.port) : void 0 });
 });
 cli.command("build", "Build for production").option("--target <target>", "Deploy target (node, vercel, cloudflare)").action(async (options) => {
   try {
-    const { buildCommand } = await import("../build-U4HVYY6F.js");
+    const { buildCommand } = await import("../build-NIHGHPYS.js");
     await buildCommand({ target: options.target });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -32,7 +32,7 @@ cli.command("build", "Build for production").option("--target <target>", "Deploy
 });
 cli.command("start", "Start production server").option("--port <port>", "Port number").action(async (options) => {
   try {
-    const { startCommand } = await import("../start-6WEPXA3X.js");
+    const { startCommand } = await import("../start-OD4DG4C6.js");
     await startCommand({ port: options.port ? Number(options.port) : void 0 });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -44,7 +44,7 @@ cli.command("start", "Start production server").option("--port <port>", "Port nu
 });
 cli.command("preview", "Build for production, then serve it \u2014 one step (B-030)").option("--port <port>", "Port number").option("--target <target>", "Deploy target (node, vercel, cloudflare)").action(async (options) => {
   try {
-    const { previewCommand } = await import("../preview-GPMF43QX.js");
+    const { previewCommand } = await import("../preview-EOL3LMK7.js");
     await previewCommand({
       port: options.port ? Number(options.port) : void 0,
       target: options.target
@@ -77,7 +77,7 @@ cli.command(
   "Run an agent in the terminal (stream + tool calls + approval)"
 ).action(async (name, message) => {
   try {
-    const { agentCommand } = await import("../agent-UBDDP2L5.js");
+    const { agentCommand } = await import("../agent-7DQ3TKJY.js");
     const { sawError } = await agentCommand(name, message);
     if (sawError) process.exit(1);
   } catch (err) {
@@ -108,7 +108,7 @@ cli.command("agent sessions gc", "Collect old transcripts for this project (dry
 });
 cli.command("mcp <agent>", "Serve an agent as an MCP server over stdio (for desktop MCP clients)").action(async (agent) => {
   try {
-    const { mcpCommand } = await import("../mcp-7UOQM4FW.js");
+    const { mcpCommand } = await import("../mcp-I6MCW6KX.js");
     await mcpCommand(agent);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -173,7 +173,7 @@ cli.command(
   "Generate <distDir>/openapi.json from route schemas (opt-in via config.openapi)"
 ).option("--dry-run", "Print the document to stdout without writing to disk (EC-3)").action(async (options) => {
   try {
-    const { openapiCommand } = await import("../openapi-SKKXWFX4.js");
+    const { openapiCommand } = await import("../openapi-24PTE7P6.js");
     await openapiCommand({ dryRun: Boolean(options.dryRun) });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);

package/dist/client/index.d.ts

@@ -343,6 +343,26 @@ interface MetadataProps {
     /** Custom meta tags rendered as children */
     children?: React.ReactNode;
 }
+/**
+ * Why `canonical` is NOT refused the way `ogImage` is — B-243, decided 2026-09-21.
+ *
+ * The two look like the same shape and are not. `href` on a `<link>` is a URL-typed attribute: the
+ * HTML parser resolves it against the document's own base, so `canonical="/contacts"` on
+ * `https://mycrm.com/x` IS `https://mycrm.com/contacts` — correct, not broken. `content` on a
+ * `<meta>` is a plain string with no base to resolve against, which is why the Open Graph protocol
+ * requires an absolute URL and why a relative one there produces a tag that is present,
+ * well-formed and wrong.
+ *
+ * So refusing a relative `canonical` would refuse a value that works. The asymmetry is the
+ * decision, and it is written here because the code shows only its result: a reader seeing
+ * `refuseRelativeOgImage` three lines above a `canonical` that passes through unchecked has no way
+ * to tell a decision from an oversight, and the honest answer to that question costs one comment
+ * against a re-investigation.
+ *
+ * What this does NOT claim: that an absolute `canonical` is never better. It usually is, for the
+ * same reason an absolute `og:image` is — it survives being copied into a context with a different
+ * base. That is advice, and this framework does not refuse values on advice.
+ */
 declare function Metadata(props: Readonly<MetadataProps>): react.JSX.Element;
 
 /**

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/client/theo-fetch.ts","../../src/client/batch.ts","../../src/client/batch-transport.ts","../../src/client/app-client.ts","../../src/client/index.ts","../../src/client/use-action.ts","../../src/client/action-client.ts","../../src/client/link.tsx","../../src/client/metadata.tsx","../../src/client/image.tsx","../../src/client/mcp-app-host.ts"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA,OAAO,eAAe;;;AC2Cf,SAAS,cAAc,SAAkC;AAC9D,QAAM,MAAM,QAAQ,OAAO;AAC3B,MAAI,QAAuB,CAAC;AAC5B,MAAI,iBAAiB;AAErB,WAAS,QAAc;AACrB,qBAAiB;AACjB,UAAM,UAAU;AAChB,YAAQ,CAAC;AACT,QAAI,QAAQ,WAAW,EAAG;AAG1B,UAAM,SAA0B,CAAC;AACjC,aAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK,KAAK;AAC5C,aAAO,KAAK,QAAQ,MAAM,GAAG,IAAI,GAAG,CAAC;AAAA,IACvC;AAEA,eAAW,SAAS,QAAQ;AAC1B,YAAM,UAA0B,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG;AACtD,cACG,UAAU,OAAO,EACjB,KAAK,CAAC,YAAY;AACjB,iBAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AAKrC,gBAAM,SAAS,QAAQ,SAAS,IAAI,QAAQ,CAAC,IAAI;AACjD,cAAI,WAAW,QAAW;AACxB,kBAAM,CAAC,EAAE,OAAO,IAAI,MAAM,gDAAgD,CAAC,EAAE,CAAC;AAC9E;AAAA,UACF;AACA,cAAI,WAAW,QAAQ;AACrB,kBAAM,MAAM,IAAI,MAAM,OAAO,MAAM,OAAO;AACzC,YAAC,IAA0B,OAAO,OAAO,MAAM;AAChD,kBAAM,CAAC,EAAE,OAAO,GAAG;AAAA,UACrB,OAAO;AACL,kBAAM,CAAC,EAAE,QAAQ,OAAO,IAAI;AAAA,UAC9B;AAAA,QACF;AAAA,MACF,CAAC,EACA,MAAM,CAAC,QAAiB;AACvB,mBAAW,QAAQ,MAAO,MAAK,OAAO,GAAG;AAAA,MAC3C,CAAC;AAAA,IACL;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS,KAAqC;AAC5C,aAAO,IAAI,QAAiB,CAAC,SAAS,WAAW;AAC/C,cAAM,KAAK,EAAE,KAAK,SAAS,OAAO,CAAC;AACnC,YAAI,CAAC,gBAAgB;AACnB,2BAAiB;AACjB,yBAAe,KAAK;AAAA,QACtB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;ACtFA,IAAM,iBAAiB;AAShB,SAAS,qBAAqB,UAAuC,CAAC,GAAmB;AAC9F,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,WAAW,QAAQ,YAAY;AACrC,SAAO,OAAO,aAAuD;AACnE,UAAM,WAAW,MAAM,UAAU,UAAU;AAAA,MACzC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC;AAAA,IACnC,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,MAAM,4BAA4B,SAAS,MAAM,EAAE;AAAA,IAC/D;AACA,UAAM,UAAW,MAAM,SAAS,KAAK;AACrC,QAAI,CAAC,MAAM,QAAQ,QAAQ,OAAO,GAAG;AACnC,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AAEA,WAAO,QAAQ,QAAQ,IAAI,CAAC,MAAM,UAAU;AAC1C,UAAI,WAAW,MAAM;AACnB,eAAO,EAAE,OAAO,OAAQ,KAAuD,MAAM;AAAA,MACvF;AACA,aAAO,EAAE,OAAO,MAAO,KAA2B,KAAK;AAAA,IACzD,CAAC;AAAA,EACH;AACF;AAIA,IAAI;AAWG,SAAS,mBAAwC;AACtD,QAAM,IAAI;AACV,MAAI,CAAC,EAAE,kBAAmB,QAAO;AACjC,oBAAkB,cAAc,EAAE,WAAW,qBAAqB,EAAE,CAAC;AACrE,SAAO;AACT;;;AFtDA,IAAI,iBAAiB;AAiBd,SAAS,yBACd,KACA,uBACA,uBACS;AAGT,MAAI,QAAQ,IAAI;AACd,WAAO;AAAA,EACT;AAEA,QAAM,kBAAkB,yBAAyB;AACjD,MAAI,oBAAoB,yBAAyB,CAAC,gBAAgB;AAChE,qBAAiB;AACjB,YAAQ;AAAA,MACN,0CAA0C,eAAe,YAAY,qBAAqB;AAAA,IAC5F;AAAA,EACF;AAEA,MAAI,oBAAoB,eAAe,0BAA0B,aAAa;AAC5E,UAAM,UAAU,KAAK,MAAM,GAAG;AAC9B,WAAO,UAAU,YAAY,OAAO;AAAA,EACtC;AAGA,SAAO,KAAK,MAAM,GAAG;AACvB;AAsFA,SAAS,gBAAgB,QAAgB,MAAkC;AACzE,MAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;AACrC,WAAO,EAAE,MAAM,yBAAyB,SAAS,QAAQ,OAAO,MAAM,CAAC,GAAG;AAAA,EAC5E;AACA,QAAM,MAAM;AAEZ,MAAI,OAAO,IAAI,SAAS,YAAY,OAAO,IAAI,YAAY,UAAU;AACnE,WAAO;AAAA,MACL,MAAM,IAAI;AAAA,MACV,SAAS,IAAI;AAAA,MACb,OAAO,IAAI;AAAA,MACX,MAAM,IAAI;AAAA,MACV,KAAK,IAAI;AAAA,IACX;AAAA,EACF;AAEA,MAAI,IAAI,SAAS,OAAO,IAAI,UAAU,UAAU;AAC9C,UAAM,SAAS,IAAI;AACnB,WAAO;AAAA,MACL,MACE,OAAO,OAAO,SAAS,WAAY,OAAO,OAAyB;AAAA,MACrE,SAAS,OAAO,OAAO,YAAY,WAAW,OAAO,UAAU,QAAQ,OAAO,MAAM,CAAC;AAAA,IACvF;AAAA,EACF;AACA,SAAO,EAAE,MAAM,yBAAyB,SAAS,QAAQ,OAAO,MAAM,CAAC,GAAG;AAC5E;AAOA,SAAS,SAAS,KAAqC,KAAiC;AACtF,QAAM,IAAI,MAAM,GAAG;AACnB,SAAO,OAAO,MAAM,WAAW,IAAI;AACrC;AAMA,SAAS,oBACP,QACA,MACwD;AACxD,MAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;AACrC,WAAO,EAAE,SAAS,QAAQ,OAAO,MAAM,CAAC,GAAG;AAAA,EAC7C;AACA,QAAM,MAAM;AACZ,QAAM,SACJ,IAAI,SAAS,OAAO,IAAI,UAAU,WAAY,IAAI,QAAoC;AACxF,QAAM,SAAS,MAAM,QAAQ,QAAQ,MAAM,IAAI,OAAO,SAAS;AAC/D,SAAO;AAAA,IACL,SAAS,SAAS,KAAK,SAAS,KAAK,SAAS,QAAQ,SAAS,KAAK,QAAQ,OAAO,MAAM,CAAC;AAAA,IAC1F,MAAM,SAAS,KAAK,MAAM,KAAK,SAAS,QAAQ,MAAM;AAAA,IACtD;AAAA,EACF;AACF;AAEO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMS;AAAA,EAET,YAAY,QAAgB,MAAgB;AAC1C,UAAM,SAAS,oBAAoB,QAAQ,IAAI;AAC/C,UAAM,OAAO,OAAO;AACpB,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO,OAAO;AACnB,SAAK,SAAS,OAAO;AACrB,SAAK,WAAW,gBAAgB,QAAQ,IAAI;AAAA,EAC9C;AACF;AAOA,SAAS,oBAAoB,OAAwB;AACnD,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,OAAO,KAAK;AAAA,IACrB;AACE,aAAO,KAAK,UAAU,KAAK;AAAA,EAC/B;AACF;AAqBA,SAAS,uBAA+B;AACtC,QAAM,IAAI;AACV,QAAM,UAAU,OAAO,YAAY,cAAc,QAAQ,IAAI,cAAc;AAC3E,SAAO,EAAE,UAAU,UAAU,EAAE,mBAAmB,WAAW;AAC/D;AAEA,SAAS,cAAc,MAAc,OAAiD;AACpF,QAAM,WAAW,IAAI,IAAI,MAAM,qBAAqB,CAAC;AACrD,MAAI,CAAC,MAAO,QAAO;AACnB,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC1C,QAAI,MAAM,QAAW;AACnB,eAAS,aAAa,IAAI,GAAG,oBAAoB,CAAC,CAAC;AAAA,IACrD;AAAA,EACF;AACA,SAAO;AACT;AAQA,SAAS,iBAAiB,OAAwD;AAChF,QAAM,MAA8B,CAAC;AACrC,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,iBAAiB,SAAS;AAC5B,UAAM,QAAQ,CAAC,OAAO,QAAQ;AAC5B,UAAI,GAAG,IAAI;AAAA,IACb,CAAC;AACD,WAAO;AAAA,EACT;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,CAAC,KAAK,KAAK,KAAK,MAAO,KAAI,GAAG,IAAI;AAC7C,WAAO;AAAA,EACT;AACA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,QAAI,GAAG,IAAI;AAAA,EACb;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,MAA6C;AACrE,QAAM,OAAoB,CAAC;AAC3B,MAAI,KAAK,WAAW,OAAW,MAAK,SAAS,KAAK;AAClD,MAAI,KAAK,WAAW,OAAW,MAAK,SAAS,KAAK;AAElD,QAAM,UAAU,iBAAiB,KAAK,OAAO;AAC7C,OAAK,UAAU;AAEf,MAAI,KAAK,SAAS,QAAW;AAC3B,SAAK,OAAO,KAAK,UAAU,KAAK,IAAI;AACpC,YAAQ,cAAc,IAAI;AAAA,EAC5B;AAKA,QAAM,UAAU,KAAK,UAAU,OAAO,YAAY;AAClD,MAAI,WAAW,SAAS,WAAW,UAAU,WAAW,WAAW;AACjE,YAAQ,eAAe,IAAI;AAAA,EAC7B;AACA,SAAO;AACT;AAEA,eAAe,WACb,KACA,SACkE;AAClE,QAAM,UAAU,iBAAiB;AACjC,MAAI,CAAC,QAAS,QAAO,EAAE,SAAS,MAAM;AACtC,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,SAAS;AAAA,MACpC,MAAM;AAAA,MACN,QAAQ,QAAQ,UAAU;AAAA,MAC1B,OAAO,QAAQ;AAAA,MACf,MAAM,QAAQ;AAAA,IAChB,CAAC;AACD,WAAO,EAAE,SAAS,MAAM,OAAO;AAAA,EACjC,QAAQ;AAEN,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AACF;AAEA,eAAsB,UACpB,KACA,SAC2B;AAC3B,QAAM,WAAY,WAAW,CAAC;AAG9B,QAAM,eAAe,MAAM,WAAW,KAAK,QAAQ;AACnD,MAAI,aAAa,SAAS;AACxB,WAAO,aAAa;AAAA,EACtB;AAEA,QAAM,WAAW,cAAc,KAAK,SAAS,KAAK;AAClD,QAAM,OAAO,iBAAiB,QAAQ;AACtC,QAAM,WAAW,MAAM,MAAM,SAAS,SAAS,GAAG,IAAI;AAEtD,MAAI,CAAC,SAAS,IAAI;AAChB,QAAI;AACJ,QAAI;AACF,kBAAY,MAAM,SAAS,KAAK;AAAA,IAClC,QAAQ;AAAA,IAER;AACA,UAAM,IAAI,eAAe,SAAS,QAAQ,SAAS;AAAA,EACrD;AAGA,MAAI,SAAS,WAAW,KAAK;AAC3B,WAAO;AAAA,EACT;AAGA,QAAM,gBAAgB,SAAS,QAAQ,IAAI,gBAAgB;AAC3D,MAAI,kBAAkB,KAAK;AACzB,WAAO;AAAA,EACT;AAGA,QAAM,wBAAwB,SAAS,QAAQ,IAAI,oBAAoB;AACvE,QAAM,wBAAwB,6BAA6B;AAC3D,QAAM,OAAO,MAAM,SAAS,KAAK;AACjC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AASA,SAAS,+BAAuC;AAC9C,QAAM,IAAI;AACV,SAAO,EAAE,wBAAwB;AACnC;;;AG5XA,IAAM,mBAAmB,IAAI,IAAI,qBAAqB;AAOtD,IAAM,qBAAqB,oBAAI,IAAI;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAcD,SAAS,aAAa,MAAc,QAAkD;AACpF,MAAI,CAAC,QAAQ;AACX,QAAI,wBAAwB,KAAK,IAAI,GAAG;AACtC,YAAM,IAAI,eAAe,GAAG;AAAA,QAC1B,OAAO;AAAA,UACL,MAAM;AAAA,UACN,SAAS,SAAS,IAAI;AAAA,QACxB;AAAA,MACF,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AACA,SAAO,KAAK,QAAQ,+BAA+B,CAAC,QAAQ,QAAgB;AAC1E,UAAM,QAAQ,OAAO,GAAG;AAGxB,QAAI,UAAU,IAAI;AAChB,YAAM,IAAI,eAAe,GAAG;AAAA,QAC1B,OAAO;AAAA,UACL,MAAM;AAAA,UACN,SAAS,UAAU,GAAG,2BAA2B,IAAI;AAAA,QACvD;AAAA,MACF,CAAC;AAAA,IACH;AACA,WAAO,mBAAmB,OAAO,KAAK,CAAC;AAAA,EACzC,CAAC;AACH;AAQA,SAAS,UAAU,KAA4B;AAC7C,QAAM,UAAoC;AAAA,IACxC,IAAI,SAAS,KAAK;AAChB,UAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,UAAI,mBAAmB,IAAI,GAAG,EAAG,QAAO;AACxC,UAAI,iBAAiB,IAAI,GAAG,GAAG;AAC7B,eAAO,OAAO,SAAuB;AACnC,cAAI,IAAI,SAAS,WAAW,GAAG;AAC7B,kBAAM,IAAI,eAAe,GAAG;AAAA,cAC1B,OAAO;AAAA,gBACL,MAAM;AAAA,gBACN,SAAS,UAAU,GAAG,4DAA4D,GAAG;AAAA,cACvF;AAAA,YACF,CAAC;AAAA,UACH;AACA,cAAI,YAAY,GAAG,IAAI,OAAO,IAAI,IAAI,SAAS,KAAK,GAAG,CAAC;AACxD,cAAI,MAAM,QAAQ;AAGhB,kBAAM,sBAAsB,IAAI,SAAS;AAAA,cAAI,CAAC,QAC5C,OAAO,UAAU,eAAe,KAAK,KAAK,QAAQ,GAAG,IAAI,IAAI,GAAG,KAAK;AAAA,YACvE;AACA,wBAAY,aAAa,GAAG,IAAI,OAAO,IAAI,oBAAoB,KAAK,GAAG,CAAC,IAAI,KAAK,MAAM;AAAA,UACzF;AACA,gBAAM,EAAE,QAAQ,UAAU,GAAG,KAAK,IAAI,QAAQ,CAAC;AAC/C,gBAAM,OAAO;AAAA,YACX,QAAQ,IAAI,YAAY;AAAA,YACxB,GAAG;AAAA,UACL;AACA,iBAAO,IAAI,UAAU,WAAW,IAAI;AAAA,QACtC;AAAA,MACF;AAEA,aAAO,UAAU,EAAE,GAAG,KAAK,UAAU,CAAC,GAAG,IAAI,UAAU,GAAG,EAAE,CAAC;AAAA,IAC/D;AAAA,IACA,QAAQ;AACN,aAAO,QAAQ;AAAA,QACb,IAAI,eAAe,GAAG;AAAA,UACpB,OAAO;AAAA,YACL,MAAM;AAAA,YACN,SACE;AAAA,UACJ;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACA,SAAO,IAAI,MAAM,MAAM,QAAW,OAAO;AAC3C;AAYO,SAAS,gBACd,kBACA,iBACY;AACZ,MAAI,UAAU;AACd,MAAI,YAAuB;AAC3B,MAAI,OAAO,qBAAqB,UAAU;AACxC,cAAU,oBAAoB;AAAA,EAChC,WAAW,oBAAoB,OAAO,qBAAqB,UAAU;AACnE,QAAI,iBAAiB,QAAS,WAAU,iBAAiB;AACzD,QAAI,iBAAiB,UAAW,aAAY,iBAAiB;AAAA,EAC/D;AAEA,MAAI,gBAAiB,aAAY;AAEjC,MAAI,QAAQ,SAAS,KAAK,QAAQ,SAAS,GAAG,EAAG,WAAU,QAAQ,MAAM,GAAG,EAAE;AAC9E,SAAO,UAAU,EAAE,UAAU,CAAC,GAAG,SAAS,UAAU,CAAC;AACvD;;;AC3IA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;AChCP,SAAS,WAAW,SAAS,QAAQ,4BAA4B;;;ACoDjE,IAAM,OAAoB,OAAO,OAAO;AAAA,EACtC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,OAAO;AAAA,EACP,WAAW;AACb,CAAC;AASD,SAAS,cAAc,KAA2B;AAChD,MAAI,cAAc,GAAG,EAAG,QAAO;AAE/B,MAAI,eAAe,OAAO;AACxB,WAAO,IAAI,YAAY;AAAA,MACrB,MAAM;AAAA,MACN,SAAS,IAAI;AAAA,MACb,OAAO,IAAI;AAAA,IACb,CAAC;AAAA,EACH;AAEA,MAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM;AAC3C,WAAO,IAAI,YAAY,EAAE,MAAM,yBAAyB,SAAS,OAAO,GAAG,EAAE,CAAC;AAAA,EAChF;AAEA,QAAM,MAAM;AACZ,MAAI,IAAI,SAAS,0BAA0B,IAAI,SAAS,mBAAmB;AACzE,QAAI,IAAI,SAAS,0BAA0B,MAAM,QAAQ,IAAI,MAAM,GAAG;AACpE,aAAO,YAAY,SAAS,GAAG;AAAA,IACjC;AACA,QAAI,IAAI,SAAS,mBAAmB;AAClC,aAAO,YAAY,SAAS,GAAG;AAAA,IACjC;AAAA,EACF;AAmBA,QAAM,UAAU,iBAAiB,IAAI,MAAM;AAC3C,MAAI,YAAY,OAAW,QAAO,IAAI,iBAAiB,OAAO;AAM9D,QAAM,UAAU,OAAO,IAAI,YAAY,WAAW,IAAI,UAAU;AAChE,SAAO,IAAI,YAAY,EAAE,MAAM,yBAAyB,QAAQ,CAAC;AACnE;AAeA,SAAS,iBAAiB,KAAiE;AACzF,MAAI,OAAO,QAAQ,YAAY,QAAQ,QAAQ,MAAM,QAAQ,GAAG,EAAG,QAAO;AAE1E,QAAM,SAAgD,CAAC;AACvD,aAAW,CAAC,KAAK,QAAQ,KAAK,OAAO,QAAQ,GAA8B,GAAG;AAC5E,QAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO;AACrC,UAAM,OAAO,QAAQ,KAAK,CAAC,IAAI,IAAI,MAAM,GAAG;AAC5C,eAAW,WAAW,UAAU;AAC9B,UAAI,OAAO,YAAY,SAAU,QAAO;AACxC,aAAO,KAAK,EAAE,MAAM,QAAQ,CAAC;AAAA,IAC/B;AAAA,EACF;AACA,SAAO,OAAO,SAAS,IAAI,SAAS;AACtC;AAGA,SAAS,WAAW,KAAqC;AACvD,SAAO,OAAO,QAAQ,YAAY,QAAQ,QAAQ,UAAU,OAAO,WAAW;AAChF;AAMO,IAAM,eAAN,MAAsD;AAAA,EAClD;AAAA,EACA,aAAa,oBAAI,IAAgB;AAAA,EAC1C,SAAqC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOrC,UAAU;AAAA,EAEV,YAAY,QAAuC;AACjD,SAAK,UAAU;AAAA,EACjB;AAAA;AAAA,EAGA,YAAY,CAAC,aAAuC;AAClD,SAAK,WAAW,IAAI,QAAQ;AAC5B,WAAO,MAAM;AACX,WAAK,WAAW,OAAO,QAAQ;AAAA,IACjC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,cAAc,MAAkC,KAAK;AAAA;AAAA,EAGrD,cAAc,OAAO,UAAkC;AACrD,UAAM,SAAS,EAAE,KAAK;AACtB,SAAK,MAAM,EAAE,QAAQ,WAAW,MAAM,QAAW,OAAO,QAAW,WAAW,MAAM,CAAC;AAErF,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,KAAK,QAAQ,KAAK;AAAA,IAChC,SAAS,QAAQ;AACf,YAAM,QAAQ,cAAc,MAAM;AAClC,UAAI,WAAW,KAAK,SAAS;AAC3B,aAAK,MAAM,EAAE,QAAQ,SAAS,MAAM,QAAW,OAAO,WAAW,MAAM,CAAC;AAAA,MAC1E;AACA,YAAM;AAAA,IACR;AAEA,QAAI,WAAW,GAAG,KAAK,IAAI,UAAU,QAAW;AAC9C,YAAM,QAAQ,cAAc,IAAI,KAAK;AACrC,UAAI,WAAW,KAAK,SAAS;AAC3B,aAAK,MAAM,EAAE,QAAQ,SAAS,MAAM,QAAW,OAAO,WAAW,MAAM,CAAC;AAAA,MAC1E;AACA,YAAM;AAAA,IACR;AAEA,UAAM,OAAQ,WAAW,GAAG,IAAI,IAAI,OAAO;AAC3C,QAAI,WAAW,KAAK,SAAS;AAC3B,WAAK,MAAM,EAAE,QAAQ,WAAW,MAAM,OAAO,QAAW,WAAW,MAAM,CAAC;AAAA,IAC5E;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,SAAS,CAAC,UAAwB;AAChC,SAAK,KAAK,YAAY,KAAK,EAAE,MAAM,MAAM,MAAS;AAAA,EACpD;AAAA;AAAA,EAGA,QAAQ,MAAY;AAClB,SAAK;AACL,SAAK,MAAM,IAAkC;AAAA,EAC/C;AAAA,EAEA,MAAM,MAAwC;AAC5C,SAAK,SAAS,OAAO,OAAO,IAAI;AAChC,eAAW,YAAY,KAAK,WAAY,UAAS;AAAA,EACnD;AACF;;;ADxLO,SAAS,UACd,QACgC;AAKhC,QAAM,YAAY,OAAO,MAAM;AAC/B,YAAU,MAAM;AACd,cAAU,UAAU;AAAA,EACtB,GAAG,CAAC,MAAM,CAAC;AAEX,QAAM,SAAS;AAAA,IACb,MAAM,IAAI,aAA4B,CAAC,UAAU,UAAU,QAAQ,KAAK,CAAC;AAAA,IACzE,CAAC;AAAA,EACH;AAEA,QAAM,QAAQ,qBAAqB,OAAO,WAAW,OAAO,aAAa,OAAO,WAAW;AAE3F,SAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,OAAO,MAAM;AAAA,IACb,QAAQ,MAAM,WAAW;AAAA,IACzB,WAAW,MAAM,WAAW;AAAA,IAC5B,SAAS,MAAM,WAAW;AAAA,IAC1B,WAAW,MAAM,WAAW;AAAA,IAC5B,WAAW,MAAM;AAAA,IACjB,QAAQ,OAAO;AAAA,IACf,aAAa,OAAO;AAAA,IACpB,OAAO,OAAO;AAAA,EAChB;AACF;;;AD9BA,SAAS,gBAAgB;AASzB,SAAS,aAAa,qBAAqB;AAM3C,SAAS,qBAAqB;AAE9B,SAAS,0BAA0B;AASnC,SAAS,wBAAwB;AAMjC,SAAS,mBAAmB;AAI5B,SAAS,mCAAmC;;;AG7E5C,SAAS,UAAAA,SAAQ,aAAa,aAAAC,kBAAiB;AAC/C,SAAS,QAAQ,kBAAqD;AAuFlE;AA7EJ,IAAM,aAAa,oBAAI,IAAY;AAEnC,SAAS,eAAe,MAAoB;AAE1C,MAAI,OAAO,aAAa,YAAa;AACrC,MAAI,WAAW,IAAI,IAAI,EAAG;AAC1B,aAAW,IAAI,IAAI;AAEnB,QAAM,OAAO,SAAS,cAAc,MAAM;AAC1C,OAAK,MAAM;AACX,OAAK,OAAO;AACZ,WAAS,KAAK,YAAY,IAAI;AAChC;AAEA,SAAS,UAAU,IAA6B;AAC9C,MAAI,OAAO,OAAO,SAAU,QAAO;AACnC,SAAO,GAAG,YAAY;AACxB;AAcO,SAAS,KAAK;AAAA,EACnB,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL,GAAwB;AACtB,QAAM,MAAMD,QAA0B,IAAI;AAE1C,QAAM,eAAe;AAAA,IACnB,CAAC,UAAqF;AACpF,UAAI,aAAa,UAAU;AACzB,uBAAe,UAAU,EAAE,CAAC;AAAA,MAC9B;AAEA,UAAI,MAAM,SAAS,gBAAgB,cAAc;AAC/C,qBAAa,KAA4C;AAAA,MAC3D;AACA,UAAI,MAAM,SAAS,WAAW,SAAS;AACrC,gBAAQ,KAA4C;AAAA,MACtD;AAAA,IACF;AAAA,IACA,CAAC,UAAU,IAAI,cAAc,OAAO;AAAA,EACtC;AAGA,EAAAC,WAAU,MAAM;AACd,QAAI,aAAa,cAAc,CAAC,IAAI,QAAS;AAC7C,QAAI,OAAO,yBAAyB,YAAa;AAEjD,UAAM,WAAW,IAAI;AAAA,MACnB,CAAC,CAAC,KAAK,MAAM;AACX,YAAI,MAAM,gBAAgB;AACxB,yBAAe,UAAU,EAAE,CAAC;AAC5B,mBAAS,WAAW;AAAA,QACtB;AAAA,MACF;AAAA,MACA,EAAE,YAAY,QAAQ;AAAA;AAAA,IACxB;AACA,aAAS,QAAQ,IAAI,OAAO;AAC5B,WAAO,MAAM;AACX,eAAS,WAAW;AAAA,IACtB;AAAA,EACF,GAAG,CAAC,UAAU,EAAE,CAAC;AAEjB,SACE,oBAAC,cAAW,KAAU,IAAQ,cAAc,cAAc,SAAS,cAAe,GAAG,MAAM;AAE/F;;;ACLI,mBACkB,OAAAC,MADlB;AAjDJ,SAAS,cAAc,OAAwB;AAC7C,SAAO,MAAM,WAAW,IAAI,KAAK,wBAAwB,KAAK,KAAK;AACrE;AAgBA,SAAS,sBAAsB,SAAmC;AAChE,MAAI,YAAY,UAAa,cAAc,OAAO,EAAG;AAQrD,QAAM,MAAM,OAAO,YAAY,cAAc,SAAY,QAAQ,IAAI;AACrE,MAAI,QAAQ,UAAa,QAAQ,aAAc;AAE/C,QAAM,IAAI;AAAA,IACR,sBAAsB,OAAO;AAAA;AAAA,yCAGe,QAAQ,QAAQ,QAAQ,EAAE,CAAC;AAAA;AAAA;AAAA,EAIzE;AACF;AAGO,SAAS,SAAS,OAAgC;AACvD,wBAAsB,MAAM,OAAO;AAEnC,QAAM,UAAU,MAAM,WAAW,MAAM;AACvC,QAAM,SAAS,MAAM,iBAAiB,MAAM;AAE5C,SACE,iCACG;AAAA,UAAM,SAAS,gBAAAA,KAAC,WAAO,gBAAM,OAAM;AAAA,IACnC,MAAM,eAAe,gBAAAA,KAAC,UAAK,MAAK,eAAc,SAAS,MAAM,aAAa;AAAA,IAC1E,MAAM,aAAa,gBAAAA,KAAC,UAAK,KAAI,aAAY,MAAM,MAAM,WAAW;AAAA,IAChE,WAAW,gBAAAA,KAAC,UAAK,UAAS,YAAW,SAAS,SAAS;AAAA,IACvD,UAAU,gBAAAA,KAAC,UAAK,UAAS,kBAAiB,SAAS,QAAQ;AAAA,IAC3D,MAAM,WAAW,gBAAAA,KAAC,UAAK,UAAS,YAAW,SAAS,MAAM,SAAS;AAAA,IACnE,MAAM,UAAU,gBAAAA,KAAC,UAAK,UAAS,WAAU,SAAS,MAAM,QAAQ;AAAA,IAChE,MAAM,SAAS,gBAAAA,KAAC,UAAK,UAAS,UAAS,SAAS,MAAM,OAAO;AAAA,IAC7D,MAAM,eAAe,gBAAAA,KAAC,UAAK,MAAK,gBAAe,SAAS,MAAM,aAAa;AAAA,IAC3E,MAAM;AAAA,KACT;AAEJ;;;ACII,gBAAAC,YAAA;AA5DJ,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACrC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AA+BO,SAAS,MAAM,EAAE,UAAU,SAAS,UAAU,GAAG,MAAM,GAAyB;AAKrF,QAAM,QAAQ;AAEd,MAAI,MAAM,UAAU,UAAa,MAAM,WAAW,QAAW;AAC3D,UAAM,IAAI;AAAA,MACR,eAAe,MAAM,GAAG;AAAA,IAG1B;AAAA,EACF;AAEA,MAAI,MAAM,WAAW,UAAa,MAAM,UAAU,QAAW;AAC3D,UAAM,IAAI;AAAA,MACR,eAAe,MAAM,GAAG;AAAA,IAG1B;AAAA,EACF;AAEA,SACE,gBAAAA;AAAA,IAAC;AAAA;AAAA,MACC,SAAS,YAAY,WAAW,UAAU;AAAA,MAC1C,UAAU,YAAY;AAAA,MACrB,GAAG;AAAA;AAAA,EACN;AAEJ;;;ACzFO,SAAS,0BACd,MACA,MACkC;AAClC,SAAO,OAAO,SAAiC;AAC7C,QAAI,OAAO,SAAS,YAAY,SAAS,KAAM;AAC/C,UAAM,MAAM;AACZ,QACE,IAAI,SAAS,oBACb,OAAO,IAAI,OAAO,YAClB,OAAO,IAAI,SAAS,UACpB;AACA,YAAM,SAAS,MAAM,KAAK,iBAAiB,IAAI,MAAM,IAAI,IAAI;AAC7D,WAAK,EAAE,MAAM,yBAAyB,IAAI,IAAI,IAAI,OAAO,CAAC;AAC1D;AAAA,IACF;AACA,QAAI,IAAI,SAAS,iBAAiB,OAAQ,IAA2B,SAAS,UAAU;AACtF,WAAK,gBAAiB,IAAyB,IAAI;AAAA,IACrD;AAAA,EACF;AACF;AAUO,IAAM,kBAAkB;AAMxB,SAAS,YACd,WACA,UACA,MACc;AACd,QAAM,SAAS,UAAU,cAAc,cAAc,QAAQ;AAE7D,SAAO,aAAa,WAAW,eAAe;AAC9C,SAAO,SAAS,SAAS;AACzB,YAAU,YAAY,MAAM;AAE5B,QAAM,OAAO,CAAC,YAA2B;AAMvC,WAAO,eAAe,YAAY,SAAS,GAAG;AAAA,EAChD;AACA,QAAM,SAAS,0BAA0B,MAAM,IAAI;AAEnD,QAAM,YAAY,CAAC,UAA8B;AAE/C,QAAI,MAAM,WAAW,OAAO,cAAe;AAC3C,SAAK,OAAO,MAAM,IAAI;AAAA,EACxB;AACA,QAAM,OAAO,UAAU,cAAc;AACrC,QAAM,iBAAiB,WAAW,SAAS;AAE3C,SAAO;AAAA,IACL;AAAA,IACA,SAAS,MAAM;AACb,YAAM,oBAAoB,WAAW,SAAS;AAC9C,aAAO,OAAO;AAAA,IAChB;AAAA,EACF;AACF;","names":["useRef","useEffect","jsx","jsx"]}
+{"version":3,"sources":["../../src/client/theo-fetch.ts","../../src/client/batch.ts","../../src/client/batch-transport.ts","../../src/client/app-client.ts","../../src/client/index.ts","../../src/client/use-action.ts","../../src/client/action-client.ts","../../src/client/link.tsx","../../src/client/metadata.tsx","../../src/client/image.tsx","../../src/client/mcp-app-host.ts"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA,OAAO,eAAe;;;AC2Cf,SAAS,cAAc,SAAkC;AAC9D,QAAM,MAAM,QAAQ,OAAO;AAC3B,MAAI,QAAuB,CAAC;AAC5B,MAAI,iBAAiB;AAErB,WAAS,QAAc;AACrB,qBAAiB;AACjB,UAAM,UAAU;AAChB,YAAQ,CAAC;AACT,QAAI,QAAQ,WAAW,EAAG;AAG1B,UAAM,SAA0B,CAAC;AACjC,aAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK,KAAK;AAC5C,aAAO,KAAK,QAAQ,MAAM,GAAG,IAAI,GAAG,CAAC;AAAA,IACvC;AAEA,eAAW,SAAS,QAAQ;AAC1B,YAAM,UAA0B,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG;AACtD,cACG,UAAU,OAAO,EACjB,KAAK,CAAC,YAAY;AACjB,iBAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AAKrC,gBAAM,SAAS,QAAQ,SAAS,IAAI,QAAQ,CAAC,IAAI;AACjD,cAAI,WAAW,QAAW;AACxB,kBAAM,CAAC,EAAE,OAAO,IAAI,MAAM,gDAAgD,CAAC,EAAE,CAAC;AAC9E;AAAA,UACF;AACA,cAAI,WAAW,QAAQ;AACrB,kBAAM,MAAM,IAAI,MAAM,OAAO,MAAM,OAAO;AACzC,YAAC,IAA0B,OAAO,OAAO,MAAM;AAChD,kBAAM,CAAC,EAAE,OAAO,GAAG;AAAA,UACrB,OAAO;AACL,kBAAM,CAAC,EAAE,QAAQ,OAAO,IAAI;AAAA,UAC9B;AAAA,QACF;AAAA,MACF,CAAC,EACA,MAAM,CAAC,QAAiB;AACvB,mBAAW,QAAQ,MAAO,MAAK,OAAO,GAAG;AAAA,MAC3C,CAAC;AAAA,IACL;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS,KAAqC;AAC5C,aAAO,IAAI,QAAiB,CAAC,SAAS,WAAW;AAC/C,cAAM,KAAK,EAAE,KAAK,SAAS,OAAO,CAAC;AACnC,YAAI,CAAC,gBAAgB;AACnB,2BAAiB;AACjB,yBAAe,KAAK;AAAA,QACtB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;ACtFA,IAAM,iBAAiB;AAShB,SAAS,qBAAqB,UAAuC,CAAC,GAAmB;AAC9F,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,WAAW,QAAQ,YAAY;AACrC,SAAO,OAAO,aAAuD;AACnE,UAAM,WAAW,MAAM,UAAU,UAAU;AAAA,MACzC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC;AAAA,IACnC,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,MAAM,4BAA4B,SAAS,MAAM,EAAE;AAAA,IAC/D;AACA,UAAM,UAAW,MAAM,SAAS,KAAK;AACrC,QAAI,CAAC,MAAM,QAAQ,QAAQ,OAAO,GAAG;AACnC,YAAM,IAAI,MAAM,sCAAsC;AAAA,IACxD;AAEA,WAAO,QAAQ,QAAQ,IAAI,CAAC,MAAM,UAAU;AAC1C,UAAI,WAAW,MAAM;AACnB,eAAO,EAAE,OAAO,OAAQ,KAAuD,MAAM;AAAA,MACvF;AACA,aAAO,EAAE,OAAO,MAAO,KAA2B,KAAK;AAAA,IACzD,CAAC;AAAA,EACH;AACF;AAIA,IAAI;AAWG,SAAS,mBAAwC;AACtD,QAAM,IAAI;AACV,MAAI,CAAC,EAAE,kBAAmB,QAAO;AACjC,oBAAkB,cAAc,EAAE,WAAW,qBAAqB,EAAE,CAAC;AACrE,SAAO;AACT;;;AFtDA,IAAI,iBAAiB;AAiBd,SAAS,yBACd,KACA,uBACA,uBACS;AAGT,MAAI,QAAQ,IAAI;AACd,WAAO;AAAA,EACT;AAEA,QAAM,kBAAkB,yBAAyB;AACjD,MAAI,oBAAoB,yBAAyB,CAAC,gBAAgB;AAChE,qBAAiB;AACjB,YAAQ;AAAA,MACN,0CAA0C,eAAe,YAAY,qBAAqB;AAAA,IAC5F;AAAA,EACF;AAEA,MAAI,oBAAoB,eAAe,0BAA0B,aAAa;AAC5E,UAAM,UAAU,KAAK,MAAM,GAAG;AAC9B,WAAO,UAAU,YAAY,OAAO;AAAA,EACtC;AAGA,SAAO,KAAK,MAAM,GAAG;AACvB;AAsFA,SAAS,gBAAgB,QAAgB,MAAkC;AACzE,MAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;AACrC,WAAO,EAAE,MAAM,yBAAyB,SAAS,QAAQ,OAAO,MAAM,CAAC,GAAG;AAAA,EAC5E;AACA,QAAM,MAAM;AAEZ,MAAI,OAAO,IAAI,SAAS,YAAY,OAAO,IAAI,YAAY,UAAU;AACnE,WAAO;AAAA,MACL,MAAM,IAAI;AAAA,MACV,SAAS,IAAI;AAAA,MACb,OAAO,IAAI;AAAA,MACX,MAAM,IAAI;AAAA,MACV,KAAK,IAAI;AAAA,IACX;AAAA,EACF;AAEA,MAAI,IAAI,SAAS,OAAO,IAAI,UAAU,UAAU;AAC9C,UAAM,SAAS,IAAI;AACnB,WAAO;AAAA,MACL,MACE,OAAO,OAAO,SAAS,WAAY,OAAO,OAAyB;AAAA,MACrE,SAAS,OAAO,OAAO,YAAY,WAAW,OAAO,UAAU,QAAQ,OAAO,MAAM,CAAC;AAAA,IACvF;AAAA,EACF;AACA,SAAO,EAAE,MAAM,yBAAyB,SAAS,QAAQ,OAAO,MAAM,CAAC,GAAG;AAC5E;AAOA,SAAS,SAAS,KAAqC,KAAiC;AACtF,QAAM,IAAI,MAAM,GAAG;AACnB,SAAO,OAAO,MAAM,WAAW,IAAI;AACrC;AAMA,SAAS,oBACP,QACA,MACwD;AACxD,MAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;AACrC,WAAO,EAAE,SAAS,QAAQ,OAAO,MAAM,CAAC,GAAG;AAAA,EAC7C;AACA,QAAM,MAAM;AACZ,QAAM,SACJ,IAAI,SAAS,OAAO,IAAI,UAAU,WAAY,IAAI,QAAoC;AACxF,QAAM,SAAS,MAAM,QAAQ,QAAQ,MAAM,IAAI,OAAO,SAAS;AAC/D,SAAO;AAAA,IACL,SAAS,SAAS,KAAK,SAAS,KAAK,SAAS,QAAQ,SAAS,KAAK,QAAQ,OAAO,MAAM,CAAC;AAAA,IAC1F,MAAM,SAAS,KAAK,MAAM,KAAK,SAAS,QAAQ,MAAM;AAAA,IACtD;AAAA,EACF;AACF;AAEO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMS;AAAA,EAET,YAAY,QAAgB,MAAgB;AAC1C,UAAM,SAAS,oBAAoB,QAAQ,IAAI;AAC/C,UAAM,OAAO,OAAO;AACpB,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO,OAAO;AACnB,SAAK,SAAS,OAAO;AACrB,SAAK,WAAW,gBAAgB,QAAQ,IAAI;AAAA,EAC9C;AACF;AAOA,SAAS,oBAAoB,OAAwB;AACnD,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,OAAO,KAAK;AAAA,IACrB;AACE,aAAO,KAAK,UAAU,KAAK;AAAA,EAC/B;AACF;AAqBA,SAAS,uBAA+B;AACtC,QAAM,IAAI;AACV,QAAM,UAAU,OAAO,YAAY,cAAc,QAAQ,IAAI,cAAc;AAC3E,SAAO,EAAE,UAAU,UAAU,EAAE,mBAAmB,WAAW;AAC/D;AAEA,SAAS,cAAc,MAAc,OAAiD;AACpF,QAAM,WAAW,IAAI,IAAI,MAAM,qBAAqB,CAAC;AACrD,MAAI,CAAC,MAAO,QAAO;AACnB,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC1C,QAAI,MAAM,QAAW;AACnB,eAAS,aAAa,IAAI,GAAG,oBAAoB,CAAC,CAAC;AAAA,IACrD;AAAA,EACF;AACA,SAAO;AACT;AAQA,SAAS,iBAAiB,OAAwD;AAChF,QAAM,MAA8B,CAAC;AACrC,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,iBAAiB,SAAS;AAC5B,UAAM,QAAQ,CAAC,OAAO,QAAQ;AAC5B,UAAI,GAAG,IAAI;AAAA,IACb,CAAC;AACD,WAAO;AAAA,EACT;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,CAAC,KAAK,KAAK,KAAK,MAAO,KAAI,GAAG,IAAI;AAC7C,WAAO;AAAA,EACT;AACA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,QAAI,GAAG,IAAI;AAAA,EACb;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,MAA6C;AACrE,QAAM,OAAoB,CAAC;AAC3B,MAAI,KAAK,WAAW,OAAW,MAAK,SAAS,KAAK;AAClD,MAAI,KAAK,WAAW,OAAW,MAAK,SAAS,KAAK;AAElD,QAAM,UAAU,iBAAiB,KAAK,OAAO;AAC7C,OAAK,UAAU;AAEf,MAAI,KAAK,SAAS,QAAW;AAC3B,SAAK,OAAO,KAAK,UAAU,KAAK,IAAI;AACpC,YAAQ,cAAc,IAAI;AAAA,EAC5B;AAKA,QAAM,UAAU,KAAK,UAAU,OAAO,YAAY;AAClD,MAAI,WAAW,SAAS,WAAW,UAAU,WAAW,WAAW;AACjE,YAAQ,eAAe,IAAI;AAAA,EAC7B;AACA,SAAO;AACT;AAEA,eAAe,WACb,KACA,SACkE;AAClE,QAAM,UAAU,iBAAiB;AACjC,MAAI,CAAC,QAAS,QAAO,EAAE,SAAS,MAAM;AACtC,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,SAAS;AAAA,MACpC,MAAM;AAAA,MACN,QAAQ,QAAQ,UAAU;AAAA,MAC1B,OAAO,QAAQ;AAAA,MACf,MAAM,QAAQ;AAAA,IAChB,CAAC;AACD,WAAO,EAAE,SAAS,MAAM,OAAO;AAAA,EACjC,QAAQ;AAEN,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AACF;AAEA,eAAsB,UACpB,KACA,SAC2B;AAC3B,QAAM,WAAY,WAAW,CAAC;AAG9B,QAAM,eAAe,MAAM,WAAW,KAAK,QAAQ;AACnD,MAAI,aAAa,SAAS;AACxB,WAAO,aAAa;AAAA,EACtB;AAEA,QAAM,WAAW,cAAc,KAAK,SAAS,KAAK;AAClD,QAAM,OAAO,iBAAiB,QAAQ;AACtC,QAAM,WAAW,MAAM,MAAM,SAAS,SAAS,GAAG,IAAI;AAEtD,MAAI,CAAC,SAAS,IAAI;AAChB,QAAI;AACJ,QAAI;AACF,kBAAY,MAAM,SAAS,KAAK;AAAA,IAClC,QAAQ;AAAA,IAER;AACA,UAAM,IAAI,eAAe,SAAS,QAAQ,SAAS;AAAA,EACrD;AAGA,MAAI,SAAS,WAAW,KAAK;AAC3B,WAAO;AAAA,EACT;AAGA,QAAM,gBAAgB,SAAS,QAAQ,IAAI,gBAAgB;AAC3D,MAAI,kBAAkB,KAAK;AACzB,WAAO;AAAA,EACT;AAGA,QAAM,wBAAwB,SAAS,QAAQ,IAAI,oBAAoB;AACvE,QAAM,wBAAwB,6BAA6B;AAC3D,QAAM,OAAO,MAAM,SAAS,KAAK;AACjC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AASA,SAAS,+BAAuC;AAC9C,QAAM,IAAI;AACV,SAAO,EAAE,wBAAwB;AACnC;;;AG5XA,IAAM,mBAAmB,IAAI,IAAI,qBAAqB;AAOtD,IAAM,qBAAqB,oBAAI,IAAI;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAcD,SAAS,aAAa,MAAc,QAAkD;AACpF,MAAI,CAAC,QAAQ;AACX,QAAI,wBAAwB,KAAK,IAAI,GAAG;AACtC,YAAM,IAAI,eAAe,GAAG;AAAA,QAC1B,OAAO;AAAA,UACL,MAAM;AAAA,UACN,SAAS,SAAS,IAAI;AAAA,QACxB;AAAA,MACF,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AACA,SAAO,KAAK,QAAQ,+BAA+B,CAAC,QAAQ,QAAgB;AAC1E,UAAM,QAAQ,OAAO,GAAG;AAGxB,QAAI,UAAU,IAAI;AAChB,YAAM,IAAI,eAAe,GAAG;AAAA,QAC1B,OAAO;AAAA,UACL,MAAM;AAAA,UACN,SAAS,UAAU,GAAG,2BAA2B,IAAI;AAAA,QACvD;AAAA,MACF,CAAC;AAAA,IACH;AACA,WAAO,mBAAmB,OAAO,KAAK,CAAC;AAAA,EACzC,CAAC;AACH;AAQA,SAAS,UAAU,KAA4B;AAC7C,QAAM,UAAoC;AAAA,IACxC,IAAI,SAAS,KAAK;AAChB,UAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,UAAI,mBAAmB,IAAI,GAAG,EAAG,QAAO;AACxC,UAAI,iBAAiB,IAAI,GAAG,GAAG;AAC7B,eAAO,OAAO,SAAuB;AACnC,cAAI,IAAI,SAAS,WAAW,GAAG;AAC7B,kBAAM,IAAI,eAAe,GAAG;AAAA,cAC1B,OAAO;AAAA,gBACL,MAAM;AAAA,gBACN,SAAS,UAAU,GAAG,4DAA4D,GAAG;AAAA,cACvF;AAAA,YACF,CAAC;AAAA,UACH;AACA,cAAI,YAAY,GAAG,IAAI,OAAO,IAAI,IAAI,SAAS,KAAK,GAAG,CAAC;AACxD,cAAI,MAAM,QAAQ;AAGhB,kBAAM,sBAAsB,IAAI,SAAS;AAAA,cAAI,CAAC,QAC5C,OAAO,UAAU,eAAe,KAAK,KAAK,QAAQ,GAAG,IAAI,IAAI,GAAG,KAAK;AAAA,YACvE;AACA,wBAAY,aAAa,GAAG,IAAI,OAAO,IAAI,oBAAoB,KAAK,GAAG,CAAC,IAAI,KAAK,MAAM;AAAA,UACzF;AACA,gBAAM,EAAE,QAAQ,UAAU,GAAG,KAAK,IAAI,QAAQ,CAAC;AAC/C,gBAAM,OAAO;AAAA,YACX,QAAQ,IAAI,YAAY;AAAA,YACxB,GAAG;AAAA,UACL;AACA,iBAAO,IAAI,UAAU,WAAW,IAAI;AAAA,QACtC;AAAA,MACF;AAEA,aAAO,UAAU,EAAE,GAAG,KAAK,UAAU,CAAC,GAAG,IAAI,UAAU,GAAG,EAAE,CAAC;AAAA,IAC/D;AAAA,IACA,QAAQ;AACN,aAAO,QAAQ;AAAA,QACb,IAAI,eAAe,GAAG;AAAA,UACpB,OAAO;AAAA,YACL,MAAM;AAAA,YACN,SACE;AAAA,UACJ;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACA,SAAO,IAAI,MAAM,MAAM,QAAW,OAAO;AAC3C;AAYO,SAAS,gBACd,kBACA,iBACY;AACZ,MAAI,UAAU;AACd,MAAI,YAAuB;AAC3B,MAAI,OAAO,qBAAqB,UAAU;AACxC,cAAU,oBAAoB;AAAA,EAChC,WAAW,oBAAoB,OAAO,qBAAqB,UAAU;AACnE,QAAI,iBAAiB,QAAS,WAAU,iBAAiB;AACzD,QAAI,iBAAiB,UAAW,aAAY,iBAAiB;AAAA,EAC/D;AAEA,MAAI,gBAAiB,aAAY;AAEjC,MAAI,QAAQ,SAAS,KAAK,QAAQ,SAAS,GAAG,EAAG,WAAU,QAAQ,MAAM,GAAG,EAAE;AAC9E,SAAO,UAAU,EAAE,UAAU,CAAC,GAAG,SAAS,UAAU,CAAC;AACvD;;;AC3IA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;AChCP,SAAS,WAAW,SAAS,QAAQ,4BAA4B;;;ACoDjE,IAAM,OAAoB,OAAO,OAAO;AAAA,EACtC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,OAAO;AAAA,EACP,WAAW;AACb,CAAC;AASD,SAAS,cAAc,KAA2B;AAChD,MAAI,cAAc,GAAG,EAAG,QAAO;AAE/B,MAAI,eAAe,OAAO;AACxB,WAAO,IAAI,YAAY;AAAA,MACrB,MAAM;AAAA,MACN,SAAS,IAAI;AAAA,MACb,OAAO,IAAI;AAAA,IACb,CAAC;AAAA,EACH;AAEA,MAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM;AAC3C,WAAO,IAAI,YAAY,EAAE,MAAM,yBAAyB,SAAS,OAAO,GAAG,EAAE,CAAC;AAAA,EAChF;AAEA,QAAM,MAAM;AACZ,MAAI,IAAI,SAAS,0BAA0B,IAAI,SAAS,mBAAmB;AACzE,QAAI,IAAI,SAAS,0BAA0B,MAAM,QAAQ,IAAI,MAAM,GAAG;AACpE,aAAO,YAAY,SAAS,GAAG;AAAA,IACjC;AACA,QAAI,IAAI,SAAS,mBAAmB;AAClC,aAAO,YAAY,SAAS,GAAG;AAAA,IACjC;AAAA,EACF;AAmBA,QAAM,UAAU,iBAAiB,IAAI,MAAM;AAC3C,MAAI,YAAY,OAAW,QAAO,IAAI,iBAAiB,OAAO;AAM9D,QAAM,UAAU,OAAO,IAAI,YAAY,WAAW,IAAI,UAAU;AAChE,SAAO,IAAI,YAAY,EAAE,MAAM,yBAAyB,QAAQ,CAAC;AACnE;AAeA,SAAS,iBAAiB,KAAiE;AACzF,MAAI,OAAO,QAAQ,YAAY,QAAQ,QAAQ,MAAM,QAAQ,GAAG,EAAG,QAAO;AAE1E,QAAM,SAAgD,CAAC;AACvD,aAAW,CAAC,KAAK,QAAQ,KAAK,OAAO,QAAQ,GAA8B,GAAG;AAC5E,QAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO;AACrC,UAAM,OAAO,QAAQ,KAAK,CAAC,IAAI,IAAI,MAAM,GAAG;AAC5C,eAAW,WAAW,UAAU;AAC9B,UAAI,OAAO,YAAY,SAAU,QAAO;AACxC,aAAO,KAAK,EAAE,MAAM,QAAQ,CAAC;AAAA,IAC/B;AAAA,EACF;AACA,SAAO,OAAO,SAAS,IAAI,SAAS;AACtC;AAGA,SAAS,WAAW,KAAqC;AACvD,SAAO,OAAO,QAAQ,YAAY,QAAQ,QAAQ,UAAU,OAAO,WAAW;AAChF;AAMO,IAAM,eAAN,MAAsD;AAAA,EAClD;AAAA,EACA,aAAa,oBAAI,IAAgB;AAAA,EAC1C,SAAqC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOrC,UAAU;AAAA,EAEV,YAAY,QAAuC;AACjD,SAAK,UAAU;AAAA,EACjB;AAAA;AAAA,EAGA,YAAY,CAAC,aAAuC;AAClD,SAAK,WAAW,IAAI,QAAQ;AAC5B,WAAO,MAAM;AACX,WAAK,WAAW,OAAO,QAAQ;AAAA,IACjC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,cAAc,MAAkC,KAAK;AAAA;AAAA,EAGrD,cAAc,OAAO,UAAkC;AACrD,UAAM,SAAS,EAAE,KAAK;AACtB,SAAK,MAAM,EAAE,QAAQ,WAAW,MAAM,QAAW,OAAO,QAAW,WAAW,MAAM,CAAC;AAErF,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,KAAK,QAAQ,KAAK;AAAA,IAChC,SAAS,QAAQ;AACf,YAAM,QAAQ,cAAc,MAAM;AAClC,UAAI,WAAW,KAAK,SAAS;AAC3B,aAAK,MAAM,EAAE,QAAQ,SAAS,MAAM,QAAW,OAAO,WAAW,MAAM,CAAC;AAAA,MAC1E;AACA,YAAM;AAAA,IACR;AAEA,QAAI,WAAW,GAAG,KAAK,IAAI,UAAU,QAAW;AAC9C,YAAM,QAAQ,cAAc,IAAI,KAAK;AACrC,UAAI,WAAW,KAAK,SAAS;AAC3B,aAAK,MAAM,EAAE,QAAQ,SAAS,MAAM,QAAW,OAAO,WAAW,MAAM,CAAC;AAAA,MAC1E;AACA,YAAM;AAAA,IACR;AAEA,UAAM,OAAQ,WAAW,GAAG,IAAI,IAAI,OAAO;AAC3C,QAAI,WAAW,KAAK,SAAS;AAC3B,WAAK,MAAM,EAAE,QAAQ,WAAW,MAAM,OAAO,QAAW,WAAW,MAAM,CAAC;AAAA,IAC5E;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,SAAS,CAAC,UAAwB;AAChC,SAAK,KAAK,YAAY,KAAK,EAAE,MAAM,MAAM,MAAS;AAAA,EACpD;AAAA;AAAA,EAGA,QAAQ,MAAY;AAClB,SAAK;AACL,SAAK,MAAM,IAAkC;AAAA,EAC/C;AAAA,EAEA,MAAM,MAAwC;AAC5C,SAAK,SAAS,OAAO,OAAO,IAAI;AAChC,eAAW,YAAY,KAAK,WAAY,UAAS;AAAA,EACnD;AACF;;;ADxLO,SAAS,UACd,QACgC;AAKhC,QAAM,YAAY,OAAO,MAAM;AAC/B,YAAU,MAAM;AACd,cAAU,UAAU;AAAA,EACtB,GAAG,CAAC,MAAM,CAAC;AAEX,QAAM,SAAS;AAAA,IACb,MAAM,IAAI,aAA4B,CAAC,UAAU,UAAU,QAAQ,KAAK,CAAC;AAAA,IACzE,CAAC;AAAA,EACH;AAEA,QAAM,QAAQ,qBAAqB,OAAO,WAAW,OAAO,aAAa,OAAO,WAAW;AAE3F,SAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,OAAO,MAAM;AAAA,IACb,QAAQ,MAAM,WAAW;AAAA,IACzB,WAAW,MAAM,WAAW;AAAA,IAC5B,SAAS,MAAM,WAAW;AAAA,IAC1B,WAAW,MAAM,WAAW;AAAA,IAC5B,WAAW,MAAM;AAAA,IACjB,QAAQ,OAAO;AAAA,IACf,aAAa,OAAO;AAAA,IACpB,OAAO,OAAO;AAAA,EAChB;AACF;;;AD9BA,SAAS,gBAAgB;AASzB,SAAS,aAAa,qBAAqB;AAM3C,SAAS,qBAAqB;AAE9B,SAAS,0BAA0B;AASnC,SAAS,wBAAwB;AAMjC,SAAS,mBAAmB;AAI5B,SAAS,mCAAmC;;;AG7E5C,SAAS,UAAAA,SAAQ,aAAa,aAAAC,kBAAiB;AAC/C,SAAS,QAAQ,kBAAqD;AAuFlE;AA7EJ,IAAM,aAAa,oBAAI,IAAY;AAEnC,SAAS,eAAe,MAAoB;AAE1C,MAAI,OAAO,aAAa,YAAa;AACrC,MAAI,WAAW,IAAI,IAAI,EAAG;AAC1B,aAAW,IAAI,IAAI;AAEnB,QAAM,OAAO,SAAS,cAAc,MAAM;AAC1C,OAAK,MAAM;AACX,OAAK,OAAO;AACZ,WAAS,KAAK,YAAY,IAAI;AAChC;AAEA,SAAS,UAAU,IAA6B;AAC9C,MAAI,OAAO,OAAO,SAAU,QAAO;AACnC,SAAO,GAAG,YAAY;AACxB;AAcO,SAAS,KAAK;AAAA,EACnB,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL,GAAwB;AACtB,QAAM,MAAMD,QAA0B,IAAI;AAE1C,QAAM,eAAe;AAAA,IACnB,CAAC,UAAqF;AACpF,UAAI,aAAa,UAAU;AACzB,uBAAe,UAAU,EAAE,CAAC;AAAA,MAC9B;AAEA,UAAI,MAAM,SAAS,gBAAgB,cAAc;AAC/C,qBAAa,KAA4C;AAAA,MAC3D;AACA,UAAI,MAAM,SAAS,WAAW,SAAS;AACrC,gBAAQ,KAA4C;AAAA,MACtD;AAAA,IACF;AAAA,IACA,CAAC,UAAU,IAAI,cAAc,OAAO;AAAA,EACtC;AAGA,EAAAC,WAAU,MAAM;AACd,QAAI,aAAa,cAAc,CAAC,IAAI,QAAS;AAC7C,QAAI,OAAO,yBAAyB,YAAa;AAEjD,UAAM,WAAW,IAAI;AAAA,MACnB,CAAC,CAAC,KAAK,MAAM;AACX,YAAI,MAAM,gBAAgB;AACxB,yBAAe,UAAU,EAAE,CAAC;AAC5B,mBAAS,WAAW;AAAA,QACtB;AAAA,MACF;AAAA,MACA,EAAE,YAAY,QAAQ;AAAA;AAAA,IACxB;AACA,aAAS,QAAQ,IAAI,OAAO;AAC5B,WAAO,MAAM;AACX,eAAS,WAAW;AAAA,IACtB;AAAA,EACF,GAAG,CAAC,UAAU,EAAE,CAAC;AAEjB,SACE,oBAAC,cAAW,KAAU,IAAQ,cAAc,cAAc,SAAS,cAAe,GAAG,MAAM;AAE/F;;;ACeI,mBACkB,OAAAC,MADlB;AArEJ,SAAS,cAAc,OAAwB;AAC7C,SAAO,MAAM,WAAW,IAAI,KAAK,wBAAwB,KAAK,KAAK;AACrE;AAgBA,SAAS,sBAAsB,SAAmC;AAChE,MAAI,YAAY,UAAa,cAAc,OAAO,EAAG;AAQrD,QAAM,MAAM,OAAO,YAAY,cAAc,SAAY,QAAQ,IAAI;AACrE,MAAI,QAAQ,UAAa,QAAQ,aAAc;AAE/C,QAAM,IAAI;AAAA,IACR,sBAAsB,OAAO;AAAA;AAAA,yCAGe,QAAQ,QAAQ,QAAQ,EAAE,CAAC;AAAA;AAAA;AAAA,EAIzE;AACF;AAuBO,SAAS,SAAS,OAAgC;AACvD,wBAAsB,MAAM,OAAO;AAEnC,QAAM,UAAU,MAAM,WAAW,MAAM;AACvC,QAAM,SAAS,MAAM,iBAAiB,MAAM;AAE5C,SACE,iCACG;AAAA,UAAM,SAAS,gBAAAA,KAAC,WAAO,gBAAM,OAAM;AAAA,IACnC,MAAM,eAAe,gBAAAA,KAAC,UAAK,MAAK,eAAc,SAAS,MAAM,aAAa;AAAA,IAC1E,MAAM,aAAa,gBAAAA,KAAC,UAAK,KAAI,aAAY,MAAM,MAAM,WAAW;AAAA,IAChE,WAAW,gBAAAA,KAAC,UAAK,UAAS,YAAW,SAAS,SAAS;AAAA,IACvD,UAAU,gBAAAA,KAAC,UAAK,UAAS,kBAAiB,SAAS,QAAQ;AAAA,IAC3D,MAAM,WAAW,gBAAAA,KAAC,UAAK,UAAS,YAAW,SAAS,MAAM,SAAS;AAAA,IACnE,MAAM,UAAU,gBAAAA,KAAC,UAAK,UAAS,WAAU,SAAS,MAAM,QAAQ;AAAA,IAChE,MAAM,SAAS,gBAAAA,KAAC,UAAK,UAAS,UAAS,SAAS,MAAM,OAAO;AAAA,IAC7D,MAAM,eAAe,gBAAAA,KAAC,UAAK,MAAK,gBAAe,SAAS,MAAM,aAAa;AAAA,IAC3E,MAAM;AAAA,KACT;AAEJ;;;AChBI,gBAAAC,YAAA;AA5DJ,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACrC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AA+BO,SAAS,MAAM,EAAE,UAAU,SAAS,UAAU,GAAG,MAAM,GAAyB;AAKrF,QAAM,QAAQ;AAEd,MAAI,MAAM,UAAU,UAAa,MAAM,WAAW,QAAW;AAC3D,UAAM,IAAI;AAAA,MACR,eAAe,MAAM,GAAG;AAAA,IAG1B;AAAA,EACF;AAEA,MAAI,MAAM,WAAW,UAAa,MAAM,UAAU,QAAW;AAC3D,UAAM,IAAI;AAAA,MACR,eAAe,MAAM,GAAG;AAAA,IAG1B;AAAA,EACF;AAEA,SACE,gBAAAA;AAAA,IAAC;AAAA;AAAA,MACC,SAAS,YAAY,WAAW,UAAU;AAAA,MAC1C,UAAU,YAAY;AAAA,MACrB,GAAG;AAAA;AAAA,EACN;AAEJ;;;ACzFO,SAAS,0BACd,MACA,MACkC;AAClC,SAAO,OAAO,SAAiC;AAC7C,QAAI,OAAO,SAAS,YAAY,SAAS,KAAM;AAC/C,UAAM,MAAM;AACZ,QACE,IAAI,SAAS,oBACb,OAAO,IAAI,OAAO,YAClB,OAAO,IAAI,SAAS,UACpB;AACA,YAAM,SAAS,MAAM,KAAK,iBAAiB,IAAI,MAAM,IAAI,IAAI;AAC7D,WAAK,EAAE,MAAM,yBAAyB,IAAI,IAAI,IAAI,OAAO,CAAC;AAC1D;AAAA,IACF;AACA,QAAI,IAAI,SAAS,iBAAiB,OAAQ,IAA2B,SAAS,UAAU;AACtF,WAAK,gBAAiB,IAAyB,IAAI;AAAA,IACrD;AAAA,EACF;AACF;AAUO,IAAM,kBAAkB;AAMxB,SAAS,YACd,WACA,UACA,MACc;AACd,QAAM,SAAS,UAAU,cAAc,cAAc,QAAQ;AAE7D,SAAO,aAAa,WAAW,eAAe;AAC9C,SAAO,SAAS,SAAS;AACzB,YAAU,YAAY,MAAM;AAE5B,QAAM,OAAO,CAAC,YAA2B;AAMvC,WAAO,eAAe,YAAY,SAAS,GAAG;AAAA,EAChD;AACA,QAAM,SAAS,0BAA0B,MAAM,IAAI;AAEnD,QAAM,YAAY,CAAC,UAA8B;AAE/C,QAAI,MAAM,WAAW,OAAO,cAAe;AAC3C,SAAK,OAAO,MAAM,IAAI;AAAA,EACxB;AACA,QAAM,OAAO,UAAU,cAAc;AACrC,QAAM,iBAAiB,WAAW,SAAS;AAE3C,SAAO;AAAA,IACL;AAAA,IACA,SAAS,MAAM;AACb,YAAM,oBAAoB,WAAW,SAAS;AAC9C,aAAO,OAAO;AAAA,IAChB;AAAA,EACF;AACF;","names":["useRef","useEffect","jsx","jsx"]}

package/dist/{cloudflare-5HU56XIH.js → cloudflare-GK4VD3EU.js}

@@ -4,18 +4,18 @@ import {
   parseAssetsMap
 } from "./chunk-46FM5AFZ.js";
 import {
-  deployedAgentsFragment,
   planDeployedPlugins
-} from "./chunk-O55RLSGG.js";
+} from "./chunk-V5SSTT3C.js";
 import {
+  deployedAgentsFragment,
   deployedCorsFragment,
   deployedCsrfFragment,
   deployedRuntimeConfigFragment,
   deployedTraceFragment,
   describeDeployedSecurityHeaders,
-  renderSecurityHeadersConfigLiteral,
+  securityHeadersDeclarations,
   serverDirLiteral
-} from "./chunk-6B3CMPE4.js";
+} from "./chunk-FFGP2LGQ.js";
 import {
   nodeAdapter
 } from "./chunk-KI4DOTN4.js";
@@ -145,8 +145,19 @@ function renderCloudflareWorkerEntry(opts = {}) {
   );
   const runtimeConfig = deployedRuntimeConfigFragment(opts);
   const agentsFragment = deployedAgentsFragment(
-    opts.agents === void 0 ? void 0 : { kind: "baked", agents: opts.agents },
-    { wrapSecurityHeaders: true }
+    opts.agents === void 0 ? void 0 : (
+      // B-185 — a Worker has no filesystem, so its identity module is baked exactly like its
+      // agents and its routes (ADR 0014). `contextModule` is `undefined` for an app that
+      // declares none, and the generator then emits no import for it.
+      { kind: "baked", agents: opts.agents, contextModule: opts.contextModule }
+    ),
+    {
+      wrapSecurityHeaders: true,
+      // B-185 — bound only when the runtime-config fragment declared the const, which is
+      // exactly when a plugins module was emitted. Referencing it otherwise would emit an
+      // identifier the entry never declares.
+      pluginRunnerExpr: opts.runtimeConfigModule === void 0 ? void 0 : "await THEO_PLUGIN_RUNNER"
+    }
   );
   return [
     `// Generated by Theo \u2014 Cloudflare Workers Adapter`,
@@ -180,8 +191,7 @@ import { injectModulePreloads } from 'theokit/server/http'`,
     `// function, same input, so the deployed page and the local one cannot`,
     `// disagree about what the configuration means.`,
     preloadSupport,
-    `const SECURITY_HEADERS_CONFIG = ${renderSecurityHeadersConfigLiteral(opts.securityHeaders)}`,
-    `const SECURITY_HEADERS = buildSecurityHeaders(SECURITY_HEADERS_CONFIG, { production: true })`,
+    ...securityHeadersDeclarations(opts.securityHeaders),
     ``,
     ...deployedCsrfFragment(opts, "a Worker"),
     ``,
@@ -205,14 +215,15 @@ import { injectModulePreloads } from 'theokit/server/http'`,
     ...cloudflareHandleRequestFragment(
       nonApiBranch,
       runtimeConfig.executeRouteSpread,
-      agentsFragment.branch
+      agentsFragment.branch,
+      agentsFragment.hostBypass
     )
   ].join("\n");
 }
-function cloudflareHandleRequestFragment(nonApiBranch, runtimeSpread, agentBranch) {
+function cloudflareHandleRequestFragment(nonApiBranch, runtimeSpread, agentBranch, hostBypass) {
   return [
     `async function handleRequest(request, url, env) {`,
-    `    if (!url.pathname.startsWith('/api/')) {`,
+    `    if (!url.pathname.startsWith('/api/')${hostBypass}) {`,
     nonApiBranch,
     `    }`,
     ``,
@@ -310,7 +321,15 @@ var cloudflareAdapter = {
     mkdirSync(outputDir, { recursive: true });
     const shell = readDocumentShell(cwd, config.ssrStreaming);
     const assetsMap = readAssetsMapForBake(resolve(cwd, ".theokit", "client", "assets-map.json"));
-    const scanned = ctx?.scanRoutes?.(config.serverDir) ?? { routes: [], wsRoutes: [], agents: [] };
+    const scanned = ctx?.scanRoutes?.(config.serverDir) ?? {
+      routes: [],
+      wsRoutes: [],
+      agents: [],
+      // B-185 — no provider means no scan, and an app whose context nobody looked for is
+      // indistinguishable here from one that has none. Both resolve an anonymous caller, which is
+      // the honest answer rather than an invented subject.
+      contextModule: void 0
+    };
     const pluginsPlan = planDeployedPlugins(config.plugins, "cloudflare");
     if (pluginsPlan !== void 0) {
       writeFileSync(resolve(outputDir, "theo.plugins.mjs"), pluginsPlan.source);
@@ -334,6 +353,9 @@ var cloudflareAdapter = {
         routes: scanned.routes,
         // #367 — a Worker has no filesystem, so its agents are decided here like its routes.
         agents: scanned.agents,
+        // B-185 — rides beside the agents because it is decided by the same provider, for the same
+        // reason: `build.ts` holds `serverDir` and a Worker cannot look for the module itself.
+        contextModule: scanned.contextModule,
         wsRoutes: scanned.wsRoutes
       })
     );
@@ -357,7 +379,8 @@ var cloudflareAdapter = {
 export {
   cloudflareAdapter,
   readAssetsMapForBake,
+  readDocumentShell,
   renderCloudflareWorkerEntry,
   renderWranglerToml
 };
-//# sourceMappingURL=cloudflare-5HU56XIH.js.map
+//# sourceMappingURL=cloudflare-GK4VD3EU.js.map

package/dist/cloudflare-GK4VD3EU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapters/cloudflare.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Cloudflare deploy adapter. All write paths are under `cwd/.theokit/cloudflare/`\n * and `cwd/wrangler.toml`. Build-time tool — no HTTP input.\n */\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nimport type { TheoConfig } from '../config/schema.js'\nimport { findRootDiv } from '../core/contracts/find-root-div.js'\nimport { parseAssetsMap } from '../core/contracts/module-preloads.js'\nimport type { SecurityHeadersConfig } from '../core/contracts/security-headers.js'\nimport { assertServicesUnsupported, readManifest } from '../services/index.js'\n\nimport { deployedAgentsFragment, type DeployedAgent } from './deployed-agents.js'\nimport { deployedCorsFragment, type DeployedCorsOptions } from './deployed-cors.js'\nimport { deployedCsrfFragment, type DeployedCsrfOptions } from './deployed-csrf.js'\nimport { planDeployedPlugins } from './deployed-plugins-module.js'\nimport {\n  deployedRuntimeConfigFragment,\n  serverDirLiteral,\n  type DeployedRuntimeConfigOptions,\n  type DeployedServerDirOptions,\n} from './deployed-runtime-config.js'\nimport { deployedTraceFragment } from './deployed-trace.js'\nimport { nodeAdapter } from './node.js'\nimport { describeDeployedSecurityHeaders, securityHeadersDeclarations } from './security-headers.js'\nimport type { AdapterBuildContext, DeployAdapter } from './types.js'\n\n/**\n * T2.1 — Cloudflare adapter rewritten to consume `theokit/adapters/web-shim`\n * instead of emitting an inline plain-object Request/Response shim. Reduces\n * template from ~50 lines to ~25 and centralizes maintenance.\n */\n\n/**\n * The built `index.html` split into the part before `<div id=\"root\">` and the\n * part after it.\n *\n * Refuses by name when streaming is on and the template is missing, rather than\n * emitting a worker that serves a headless document. A build that cannot produce\n * a correct artifact should say so at build time; the alternative is a deploy\n * that looks successful and serves pages with no stylesheet.\n */\n/**\n * @internal Exported for tests only. Nothing re-exports this module, so this does not reach the\n * published surface — `findRootDiv`, exported for the same reason, appears 0 times in `dist/`.\n */\nexport function readDocumentShell(\n  cwd: string,\n  streaming: boolean,\n): { htmlHead?: string; htmlTail?: string } {\n  if (!streaming) return {}\n\n  const indexPath = resolve(cwd, '.theokit/client/index.html')\n  if (!existsSync(indexPath)) {\n    throw new Error(\n      `[adapter-cloudflare] ssrStreaming is on but ${indexPath} does not exist, so the worker ` +\n        `would serve a document with no <head> and no client entry. Run the client build first, ` +\n        `or set ssrStreaming: false in theo.config.ts.`,\n    )\n  }\n\n  const indexHtml = readFileSync(indexPath, 'utf-8')\n  const rootDiv = findRootDiv(indexHtml)\n  if (rootDiv === undefined) {\n    throw new Error(\n      `[adapter-cloudflare] ${indexPath} has no <div id=\"root\">, so the streamed document has ` +\n        `nowhere to put the app. Add one, or set ssrStreaming: false in theo.config.ts.`,\n    )\n  }\n\n  return {\n    htmlHead: indexHtml.slice(0, rootDiv.insertAt),\n    htmlTail: indexHtml.slice(rootDiv.insertAt),\n  }\n}\n\n/**\n * The routes, turned into source: static imports, a module map and a literal table (#369).\n *\n * Extracted so the worker renderer stays inside its length budget, and because this is the whole of\n * what changed about how a Worker finds a route — it reads as one idea rather than as three loops\n * inside a hundred lines of template.\n *\n * `../../` because the worker is written to `.theokit/cloudflare/worker.mjs` and `filePath` is\n * relative to the project root. The imports are static so Wrangler's bundler follows them:\n * `wrangler.toml` uploads `.theokit/client` and has never uploaded `server/`, so a module not\n * bundled INTO the worker is not on the platform at all.\n */\nfunction renderBakedRoutes(\n  routes: readonly { filePath: string; routePath: string; methods?: readonly string[] }[],\n): { routeImports: string[]; routeModuleEntries: string[]; routeTableEntries: string[] } {\n  const routeVar = (index: number): string => `__theoRoute${String(index)}`\n  return {\n    routeImports: routes.map(\n      (route, index) => `import * as ${routeVar(index)} from '../../${route.filePath}'`,\n    ),\n    routeModuleEntries: routes.map(\n      (route, index) => `  ${JSON.stringify(route.filePath)}: ${routeVar(index)},`,\n    ),\n    routeTableEntries: routes.map(\n      (route) =>\n        `  { filePath: ${JSON.stringify(route.filePath)}, routePath: ${JSON.stringify(route.routePath)}, ` +\n        `methods: ${JSON.stringify([...(route.methods ?? [])])}, ` +\n        `...compilePattern(${JSON.stringify(route.routePath)}) },`,\n    ),\n  }\n}\n\n/**\n * The route-resolution runtime the Worker gets instead of a directory scan (#369).\n *\n * A module map, the literal table, and a loader that refuses anything the build did not bake.\n * Emitted as its own block because it replaces one idea — \"find the routes\" — wholesale.\n */\nfunction routeRuntimeLines(moduleEntries: string[], tableEntries: string[]): string[] {\n  return [\n    `// #369 — the routes are baked at build time. The Worker used to reach for`,\n    `// \\`scanServerRoutes\\` on the server directory — a readdirSync, in a runtime with no`,\n    `// filesystem. The pattern is recompiled here from the same routePath the scanner`,\n    `// used, so one function decides precedence on every target.`,\n    `const ROUTE_MODULES = {`,\n    ...moduleEntries,\n    `}`,\n    ``,\n    `const routes = [`,\n    ...tableEntries,\n    `]`,\n    ``,\n    `// The executor asks for a module by the path the table names. Anything else was`,\n    `// never bundled, and saying so beats returning undefined and failing later on a`,\n    `// property access far from the cause.`,\n    `async function loadModule(path) {`,\n    `  const mod = ROUTE_MODULES[path]`,\n    `  if (mod === undefined) {`,\n    // No backticks in this message: it is emitted INTO a template literal, and a stray one closes\n    // it. That is how #344 shipped a SyntaxError, and the emitted-entry parse gate caught this one\n    // before it left the branch.\n    \"  throw new Error(`Route module '\" +\n      '${path}' +\n      \"' was not bundled into this Worker. \" +\n      'A Worker has no filesystem, so every route is imported at build time. ' +\n      'Re-run: theokit build --target cloudflare`)',\n    `  }`,\n    `  return mod`,\n    `}`,\n    ``,\n  ]\n}\n\n/**\n * Read the map `theokit build` emitted, for baking into the worker (B-035).\n *\n * Returns `undefined` — never throws — for an absent or malformed file. A deploy that failed\n * because an optimisation was missing would turn a lost round trip into a broken build, and the\n * worker is correct without it.\n */\nexport function readAssetsMapForBake(path: string): Record<string, string[]> | undefined {\n  try {\n    return parseAssetsMap(readFileSync(path, 'utf8'))\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * The baked route-to-chunks map, as worker source (B-035).\n *\n * A literal and not a read, for the same reason the document shell is: a Worker has no filesystem\n * at request time. Emitted only when the build produced a map; otherwise the worker carries\n * nothing about preloads and behaves exactly as before.\n *\n * **It emits the DATA and no longer the code.** An earlier revision emitted a hand-written copy of\n * `injectModulePreloads`, justified by a claim that the worker could not import it. That claim was\n * false — `theokit/server` re-exports from `core/contracts/` and the generated worker already\n * imports that subpath — and the copy drifted within a day: a fix for proxy-form request targets\n * landed in the original and not in the duplicate. The worker now imports the real function, which\n * is the shape `adapters/security-headers.ts` established one directory over for exactly this\n * build-half/runtime-half pair.\n */\n/**\n * Whether this worker can preload at all (B-035).\n *\n * ONE predicate, read by the bake, the import and the call. Two conditions for one decision is\n * how the import came to be emitted for a worker that had no map to give it — found at review, in\n * the same change where a copy and its original had already drifted apart.\n *\n * Streaming is required because the other branch serves the document from `env.ASSETS` as a\n * static file and can inject nothing into it.\n */\nfunction preloadsApplyTo(opts: {\n  ssrStreaming?: boolean\n  assetsMap?: Record<string, string[]>\n}): boolean {\n  return opts.ssrStreaming === true && opts.assetsMap !== undefined\n}\n\nfunction renderPreloadSupport(assetsMap: Record<string, string[]> | undefined): string {\n  if (assetsMap === undefined) return ''\n  return `const __THEO_ASSETS_MAP = ${JSON.stringify(assetsMap)}`\n}\n\n/**\n * The branch that answers a non-API request: streamed SSR, or the static asset the Worker\n * platform serves. Extracted at review — it is the one decision in this emitter with two whole\n * shapes behind it, and keeping it inline pushed the caller past its line budget.\n */\nfunction renderNonApiBranch(\n  opts: NonNullable<Parameters<typeof renderCloudflareWorkerEntry>[0]>,\n  preloadsApply: boolean,\n): string {\n  return opts.ssrStreaming\n    ? [\n        `      // T2.3 — streaming SSR for non-API routes`,\n        `      // The same primitive \\`theokit start\\` uses, not a second one:`,\n        `      // 16 bytes of Web Crypto entropy, base64.`,\n        `      const nonce = generateNonce()`,\n        `      return withSecurityHeaders(`,\n        `        await renderStreamingWeb(request, {`,\n        !preloadsApply\n          ? `          htmlHead: ${JSON.stringify(opts.htmlHead ?? '')},`\n          : `          htmlHead: injectModulePreloads(${JSON.stringify(opts.htmlHead ?? '')}, __THEO_ASSETS_MAP, new URL(request.url).pathname),`,\n        `          htmlTail: ${JSON.stringify(opts.htmlTail ?? '')},`,\n        `          nonce,`,\n        `        }),`,\n        `        buildSecurityHeaders(SECURITY_HEADERS_CONFIG, { production: true }, { nonce }),`,\n        `      )`,\n      ].join('\\n')\n    : [\n        `      // #412 — the document, served by the worker so it carries the same baseline every`,\n        `      // API response carries. It used to return 404 here while wrangler.toml declared a`,\n        `      // \\`[site]\\` bucket nothing read, so the page was missing rather than unprotected.`,\n        `      const assets = env?.ASSETS`,\n        `      // A wrangler.toml that predates this binding has no ASSETS. Reading .fetch off`,\n        `      // undefined would turn every page request into a 500; 404 is what this target`,\n        `      // answered before, which is the honest fallback rather than a new failure.`,\n        `      if (assets === undefined) return notFoundResponse()`,\n        `      return withSecurityHeaders(await assets.fetch(request), SECURITY_HEADERS)`,\n      ].join('\\n')\n}\n\nexport function renderCloudflareWorkerEntry(\n  opts: {\n    ssrStreaming?: boolean\n    htmlHead?: string\n    htmlTail?: string\n    /**\n     * B-035 — the route-to-chunks map, baked as a literal for the same reason the shell above\n     * is: a Worker has no filesystem at request time. Absent when the build produced no map,\n     * and then nothing about preloads is emitted at all.\n     */\n    assetsMap?: Record<string, string[]>\n    securityHeaders?: SecurityHeadersConfig\n    /**\n     * The server routes, scanned on the BUILD machine (#369).\n     *\n     * A Worker has no filesystem, so the worker used to call `scanServerRoutes` — a `readdirSync` —\n     * against a directory that does not exist there, and load each module through `import()` of a\n     * file path. Both are baked here instead, which is the road this adapter already takes for the\n     * document shell one function away.\n     *\n     * `filePath` is relative to the project root and is used for two things: the key the executor\n     * looks a module up by, and the specifier the static import uses. Paths are emitted relative to\n     * `.theokit/cloudflare/`, where the worker is written.\n     */\n    routes?: readonly { filePath: string; routePath: string; methods?: readonly string[] }[]\n    /**\n     * The two concerns #410 could not bake (#425), composed from one place so the six targets\n     * cannot drift into six spellings. `serialization` is a literal like the security values above;\n     * `plugins` is an import, because a closure has no literal.\n     */\n    runtimeConfigModule?: DeployedRuntimeConfigOptions['runtimeConfigModule']\n    serialization?: DeployedRuntimeConfigOptions['serialization']\n    /**\n     * The app's agents, scanned on the build machine (#367).\n     *\n     * A different scan from `routes` and served by a different function — which is why a worker\n     * that only consulted the route table answered every `/api/agents/<name>` with a 404.\n     */\n    agents?: readonly DeployedAgent[]\n    /** B-185 — the app's `server/context.ts`, project-relative, or absent when it declares none. */\n    contextModule?: string\n    /** WebSocket route files, scanned on the build machine. Only their presence is used (#369). */\n    wsRoutes?: readonly string[]\n  } & DeployedServerDirOptions &\n    DeployedCsrfOptions &\n    DeployedCorsOptions = {},\n): string {\n  const streamingImport = opts.ssrStreaming\n    ? `import { renderStreamingWeb } from '/@theo/entry-server'`\n    : `// (ssrStreaming off: renderStreamingWeb not imported)`\n  // #343 — the document shell is inlined as a build-time literal because a Worker\n  // has no filesystem to read `index.html` from at request time. Without it,\n  // `renderStreamingWeb` falls back to its empty-string defaults and the response\n  // is React output with no `<html>`, no `<head>`, no stylesheet and no client\n  // entry — hydration data for a page that cannot hydrate. The streaming\n  // assembly was fixed in the generated entry and this, its only caller, was\n  // left passing nothing.\n  //\n  // `JSON.stringify` and not a template literal: the shell contains quotes,\n  // angle brackets and a `</script>`, and embedding it naively produces a worker\n  // that fails to parse at deploy time rather than here.\n  //\n  // #410 — this is also the ONE deploy path that renders HTML at request time,\n  // so the one that can mint a per-request CSP nonce: `renderStreamingWeb`\n  // threads `options.nonce` into `renderToReadableStream` and into the hydration\n  // script (`router/entry-server.ts`). Every other response below carries the\n  // nonce-less baseline, which is what `buildSecurityHeaders` already does for a\n  // prerendered route (EC-4).\n  // Only the streaming branch renders HTML at request time; the other serves the document from\n  // `env.ASSETS` as a static file and can inject nothing. Baking the map for it would ship the whole\n  // route table as dead weight — found at review, where the emitter was measured declaring it with\n  // zero call sites.\n  const preloadsApply = preloadsApplyTo(opts)\n  const preloadSupport = preloadsApply ? renderPreloadSupport(opts.assetsMap) : ''\n\n  const nonApiBranch = renderNonApiBranch(opts, preloadsApply)\n\n  // CR-006: Workers lack `process.cwd()` and the `node:*` import surface\n  // is brittle even under `nodejs_compat`. We use the Web Crypto\n  // `crypto.randomUUID()` instead of `node:crypto.randomUUID`, and embed\n  // the server directory as a build-time literal instead of resolving via\n  // `node:path` at runtime.\n  const { routeImports, routeModuleEntries, routeTableEntries } = renderBakedRoutes(\n    opts.routes ?? [],\n  )\n  const runtimeConfig = deployedRuntimeConfigFragment(opts)\n  const agentsFragment = deployedAgentsFragment(\n    opts.agents === undefined\n      ? undefined\n      : // B-185 — a Worker has no filesystem, so its identity module is baked exactly like its\n        // agents and its routes (ADR 0014). `contextModule` is `undefined` for an app that\n        // declares none, and the generator then emits no import for it.\n        { kind: 'baked', agents: opts.agents, contextModule: opts.contextModule },\n    {\n      wrapSecurityHeaders: true,\n      // B-185 — bound only when the runtime-config fragment declared the const, which is\n      // exactly when a plugins module was emitted. Referencing it otherwise would emit an\n      // identifier the entry never declares.\n      pluginRunnerExpr:\n        opts.runtimeConfigModule === undefined ? undefined : 'await THEO_PLUGIN_RUNNER',\n    },\n  )\n\n  return [\n    `// Generated by Theo — Cloudflare Workers Adapter`,\n    `//`,\n    `// REQUIREMENTS (EC-3):`,\n    `//   - wrangler.toml MUST include compatibility_flags = [\"nodejs_compat\"]`,\n    `//     (still required for transitive theokit/server deps, e.g. busboy)`,\n    `//   - package.json MUST list \"theokit\" in dependencies (not devDependencies)`,\n    `//     so Wrangler bundles theokit and its transitive deps`,\n    `//   - Deploy: wrangler deploy`,\n    ``,\n    !preloadsApply\n      ? `import { matchRoute, executeRoute, compilePattern, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler } from 'theokit/server'`\n      : `import { matchRoute, executeRoute, compilePattern, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler } from 'theokit/server'\\nimport { injectModulePreloads } from 'theokit/server/http'`,\n    `import { createWebShim } from 'theokit/adapters/web-shim'`,\n    opts.ssrStreaming\n      ? `import { buildSecurityHeaders, generateNonce, withSecurityHeaders } from 'theokit/adapters/security-headers'`\n      : `import { buildSecurityHeaders, withSecurityHeaders } from 'theokit/adapters/security-headers'`,\n    `// T3.4 — WS bridge for Cloudflare Workers`,\n    `import { createCloudflareWsBridge } from 'theokit/adapters/ws-shim'`,\n    streamingImport,\n    ``,\n    ...runtimeConfig.imports,\n    ...agentsFragment.imports,\n    ...routeImports,\n    ``,\n    `// CR-006: server directory is a build-time literal — Workers cannot`,\n    `// call process.cwd() and resolving paths at runtime returned '/server'.`,\n    `const serverDir = ${serverDirLiteral(opts)}`,\n    ``,\n    ...routeRuntimeLines(routeModuleEntries, routeTableEntries),\n    `// #410 — the security baseline \\`theokit start\\` puts on every response, carried`,\n    `// here as a literal because a Worker has no theo.config.ts to read. Same`,\n    `// function, same input, so the deployed page and the local one cannot`,\n    `// disagree about what the configuration means.`,\n    preloadSupport,\n    ...securityHeadersDeclarations(opts.securityHeaders),\n    ``,\n    ...deployedCsrfFragment(opts, 'a Worker'),\n    ``,\n    ...runtimeConfig.declarations,\n    ...agentsFragment.declarations,\n    ...deployedCorsFragment(opts.cors, 'cloudflare'),\n    `// #369 — whether this project declares a WebSocket route, decided at build time. It used`,\n    `// to answer it with \\`scanWebSocketRoutes\\`, which is the same readdirSync.`,\n    `const HAS_WS_ROUTES = ${String((opts.wsRoutes ?? []).length > 0)}`,\n    ``,\n    `function notFoundResponse() {`,\n    `  return withSecurityHeaders(`,\n    `    new Response(`,\n    `      JSON.stringify({ error: { code: 'NOT_FOUND', message: 'Route not found' } }),`,\n    `      { status: 404, headers: { 'Content-Type': 'application/json' } },`,\n    `    ),`,\n    `    SECURITY_HEADERS,`,\n    `  )`,\n    `}`,\n    ``,\n    ...cloudflareHandleRequestFragment(\n      nonApiBranch,\n      runtimeConfig.executeRouteSpread,\n      agentsFragment.branch,\n      agentsFragment.hostBypass,\n    ),\n  ].join('\\n')\n}\n\n/**\n * The Worker's request handler, as generated source.\n *\n * Extracted for the reason `vercel.ts` extracts its own fragments: the emitter is one array\n * literal, so every line the entry gains counts against `max-lines-per-function`, and #410 added\n * the CSRF literal to an emitter already sitting exactly at the ceiling.\n *\n * @param nonApiBranch - what a non-`/api/` request gets, which differs with `ssrStreaming`\n */\nfunction cloudflareHandleRequestFragment(\n  nonApiBranch: string,\n  runtimeSpread: string,\n  agentBranch: readonly string[],\n  /** SI-020 — the condition that keeps an agent card path out of the static-asset branch. */\n  hostBypass: string,\n): string[] {\n  return [\n    `async function handleRequest(request, url, env) {`,\n    `    if (!url.pathname.startsWith('/api/')${hostBypass}) {`,\n    nonApiBranch,\n    `    }`,\n    ``,\n    ...agentBranch,\n    ``,\n    `    const match = matchRoute(url.pathname, routes)`,\n    `    if (!match) return notFoundResponse()`,\n    ``,\n    `    const { req, res, toResponse } = createWebShim(request, { trustedProxy: 'platform' })`,\n    ...deployedTraceFragment('request', '    '),\n    `    const method = request.method.toUpperCase()`,\n    `    // #382 — the run is NOT awaited before the Response is taken. toResponse()`,\n    `    // settles as soon as status + headers are known and carries a live body, so`,\n    `    // the Worker starts flushing while the handler is still writing. Awaiting`,\n    `    // executeRoute() first would re-buffer the whole response here even though`,\n    `    // the shim streams; awaiting toResponse() does not — it settles at the head.`,\n    `    return withSecurityHeaders(await toResponse(executeRoute({`,\n    `      route: match.route, method, params: match.params,`,\n    `      req, res, loadModule, serverDir, requestId, ...CSRF_CONFIG, ${runtimeSpread}`,\n    `    })), SECURITY_HEADERS)`,\n    `}`,\n    ``,\n    `export default {`,\n    `  async fetch(request, env, ctx) {`,\n    `    const url = new URL(request.url)`,\n    ``,\n    `    // T3.4 — Detect WebSocket upgrade and delegate to the CF bridge.`,\n    `    // A 101 carries no document and no script, so the security baseline does`,\n    `    // not apply to it.`,\n    `    if (request.headers.get('upgrade')?.toLowerCase() === 'websocket') {`,\n    `      if (!HAS_WS_ROUTES) return notFoundResponse()`,\n    `      const cfWs = createCloudflareWsBridge({`,\n    `        onOpen: () => {},`,\n    `        onMessage: (ws, data) => { ws.send(data) },`,\n    `        onClose: () => {},`,\n    `      })`,\n    `      return cfWs.handle(request)`,\n    `    }`,\n    ``,\n    `    // #409 — the preflight is answered BEFORE anything routes: an OPTIONS the router handles`,\n    `    // is an OPTIONS the browser never gets a CORS answer to. The WebSocket upgrade above is`,\n    `    // deliberately upstream of it — a 101 is not a CORS-governed response.`,\n    `    const preflight = corsPreflight(request)`,\n    `    if (preflight !== null) return withSecurityHeaders(preflight, SECURITY_HEADERS)`,\n    ``,\n    `    return withCors(request, await handleRequest(request, url, env))`,\n    `  },`,\n    `}`,\n  ]\n}\n\nexport function renderWranglerToml(): string {\n  return [\n    `# Generated by Theo — Cloudflare Workers`,\n    `name = \"theo-app\"`,\n    `main = \".theokit/cloudflare/worker.mjs\"`,\n    `compatibility_date = \"2025-09-01\"`,\n    `compatibility_flags = [\"nodejs_compat\"]`,\n    ``,\n    `# #412 — \\`[assets]\\` with a BINDING, not the legacy \\`[site]\\` bucket.`,\n    `#`,\n    `# \\`[site]\\` uploads to KV and is read through \\`kv-asset-handler\\` and a`,\n    `# \\`__STATIC_CONTENT\\` binding — neither of which this worker has ever had. So the`,\n    `# bucket was declared, uploaded, and consumed by nothing: with ssrStreaming off, a`,\n    `# deploy answered 404 for its own page. This binding is what the worker calls.`,\n    `[assets]`,\n    `directory = \".theokit/client\"`,\n    `binding = \"ASSETS\"`,\n    `# A client-routed app asks for /dashboard, which is no file. Without this the asset`,\n    `# handler 404s a deep link and the SPA never boots.`,\n    `not_found_handling = \"single-page-application\"`,\n    ``,\n    `# Environment variables are set via wrangler secret or dashboard`,\n    `# Example: wrangler secret put DATABASE_URL`,\n  ].join('\\n')\n}\n\nexport const cloudflareAdapter: DeployAdapter = {\n  name: 'cloudflare',\n  streamsResponses: true,\n  // #409 / #410 — the generated entry calls `executeRoute` with routes, loader\n  // and serverDir only. CSRF, route policy, file middleware and Zod validation\n  // still run because they live inside `executeRoute`; none of the remaining\n  // configurable concerns reach it. Declared explicitly rather than omitted so\n  // the gap is a statement in the source and not an absence.\n  //\n  // `securityHeaders` IS applied: the worker carries `security.headers` as a\n  // literal and puts the built baseline on every response it returns, including\n  // the streamed SSR document — with a per-request nonce, the only deploy path\n  // that can mint one (`adapters/security-headers.ts`).\n  servesAgents: true,\n  appliesConfig: ['securityHeaders', 'csrf', 'disallowed', 'cors', 'serialization', 'plugins'],\n\n  async build(config: TheoConfig, cwd: string, ctx?: AdapterBuildContext): Promise<void> {\n    // Wave 2 (T2.2) — reject polyglot services on this adapter.\n    assertServicesUnsupported('cloudflare', readManifest(cwd))\n\n    // 1. Run the standard Node build first (ctx forwarded so nodeAdapter has makeVitePlugins)\n    await nodeAdapter.build(config, cwd, ctx)\n\n    const outputDir = resolve(cwd, '.theokit/cloudflare')\n    mkdirSync(outputDir, { recursive: true })\n\n    // 2. Emit Worker entry (now uses the shared web-shim)\n    //\n    // The document shell is read HERE, after the Node build produced\n    // `.theokit/client/index.html`, and inlined into the worker: a Worker has no\n    // filesystem at request time. Split on the root div with the same helper the\n    // Node server uses (`ssr-setup.ts`), so the two paths cannot disagree about\n    // where the shell ends (#343).\n    const shell = readDocumentShell(cwd, config.ssrStreaming)\n    // B-035 — the route-to-chunks map, read HERE on the build machine for the same reason the\n    // shell above is: a Worker has no filesystem at request time. `nodeAdapter.build` ran\n    // first, so the map the Node build emitted is on disk by now. Absent map -> nothing about\n    // preloads is emitted, and the worker behaves exactly as it did before.\n    const assetsMap = readAssetsMapForBake(resolve(cwd, '.theokit', 'client', 'assets-map.json'))\n\n    // #369 — the routes are resolved HERE, on the build machine, for the same reason the document\n    // shell above is read here: a Worker has no filesystem at request time, and the worker used to\n    // run the scan itself against a directory that does not exist there.\n    //\n    // The scanner is INJECTED rather than imported: importing it would add an `adapters → server`\n    // edge, which is the layering inversion ADR-0001 v3 removed for `vite-plugin` and which\n    // `adapters-may-only-depend-on-core-router-services` refuses. An absent scanner emits a worker\n    // with no routes rather than falling back to a runtime scan — the fallback IS the defect.\n    const scanned = ctx?.scanRoutes?.(config.serverDir) ?? {\n      routes: [],\n      wsRoutes: [],\n      agents: [],\n      // B-185 — no provider means no scan, and an app whose context nobody looked for is\n      // indistinguishable here from one that has none. Both resolve an anonymous caller, which is\n      // the honest answer rather than an invented subject.\n      contextModule: undefined,\n    }\n\n    const pluginsPlan = planDeployedPlugins(config.plugins, 'cloudflare')\n    if (pluginsPlan !== undefined) {\n      // Beside the worker, so the emitted import is a sibling. Wrangler bundles from here, which is\n      // what lets the static import reach the app's own module at all (#425).\n      writeFileSync(resolve(outputDir, 'theo.plugins.mjs'), pluginsPlan.source)\n    }\n\n    writeFileSync(\n      resolve(outputDir, 'worker.mjs'),\n      renderCloudflareWorkerEntry({\n        ssrStreaming: config.ssrStreaming,\n        ...shell,\n        securityHeaders: config.security?.headers,\n        csrf: config.security?.csrf,\n        disallowed: config.security?.disallowed,\n        cors: config.security?.cors,\n        assetsMap,\n        // #425 — a selector, not a transformer, so it rides as a literal like the values above.\n        serialization: config.serialization,\n        // #425 — the ONE concern that is not a literal. A closure cannot be baked, so a plugin\n        // declared by module specifier is imported by the emitted module instead; a constructed one\n        // is refused by name at build time rather than dropped in silence.\n        runtimeConfigModule: pluginsPlan?.moduleSpecifier,\n        routes: scanned.routes,\n        // #367 — a Worker has no filesystem, so its agents are decided here like its routes.\n        agents: scanned.agents,\n        // B-185 — rides beside the agents because it is decided by the same provider, for the same\n        // reason: `build.ts` holds `serverDir` and a Worker cannot look for the module itself.\n        contextModule: scanned.contextModule,\n        wsRoutes: scanned.wsRoutes,\n      }),\n    )\n\n    // 3. Emit wrangler.toml (with nodejs_compat enforced)\n    writeFileSync(resolve(cwd, 'wrangler.toml'), renderWranglerToml())\n\n    // eslint-disable-next-line no-console -- CLI build progress\n    console.log('\\n  ✓ Cloudflare output → .theokit/cloudflare/ + wrangler.toml')\n    // eslint-disable-next-line no-console -- CLI build progress\n    console.log(\n      `${describeDeployedSecurityHeaders({\n        target: 'cloudflare',\n        securityHeaders: config.security?.headers,\n        // Only the streaming worker renders HTML per request, so only it can put\n        // the same nonce on the header and on the script tag it emits.\n        mintsNonce: config.ssrStreaming,\n        // #412 — either way the worker returns the document now: streamed by\n        // `renderStreamingWeb`, or from the ASSETS binding it finally calls.\n        documentHeaders: 'handler',\n      })}\\n`,\n    )\n  },\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIA,SAAS,YAAY,WAAW,cAAc,qBAAqB;AACnE,SAAS,eAAe;AA0CjB,SAAS,kBACd,KACA,WAC0C;AAC1C,MAAI,CAAC,UAAW,QAAO,CAAC;AAExB,QAAM,YAAY,QAAQ,KAAK,4BAA4B;AAC3D,MAAI,CAAC,WAAW,SAAS,GAAG;AAC1B,UAAM,IAAI;AAAA,MACR,+CAA+C,SAAS;AAAA,IAG1D;AAAA,EACF;AAEA,QAAM,YAAY,aAAa,WAAW,OAAO;AACjD,QAAM,UAAU,YAAY,SAAS;AACrC,MAAI,YAAY,QAAW;AACzB,UAAM,IAAI;AAAA,MACR,wBAAwB,SAAS;AAAA,IAEnC;AAAA,EACF;AAEA,SAAO;AAAA,IACL,UAAU,UAAU,MAAM,GAAG,QAAQ,QAAQ;AAAA,IAC7C,UAAU,UAAU,MAAM,QAAQ,QAAQ;AAAA,EAC5C;AACF;AAcA,SAAS,kBACP,QACuF;AACvF,QAAM,WAAW,CAAC,UAA0B,cAAc,OAAO,KAAK,CAAC;AACvE,SAAO;AAAA,IACL,cAAc,OAAO;AAAA,MACnB,CAAC,OAAO,UAAU,eAAe,SAAS,KAAK,CAAC,gBAAgB,MAAM,QAAQ;AAAA,IAChF;AAAA,IACA,oBAAoB,OAAO;AAAA,MACzB,CAAC,OAAO,UAAU,KAAK,KAAK,UAAU,MAAM,QAAQ,CAAC,KAAK,SAAS,KAAK,CAAC;AAAA,IAC3E;AAAA,IACA,mBAAmB,OAAO;AAAA,MACxB,CAAC,UACC,iBAAiB,KAAK,UAAU,MAAM,QAAQ,CAAC,gBAAgB,KAAK,UAAU,MAAM,SAAS,CAAC,cAClF,KAAK,UAAU,CAAC,GAAI,MAAM,WAAW,CAAC,CAAE,CAAC,CAAC,uBACjC,KAAK,UAAU,MAAM,SAAS,CAAC;AAAA,IACxD;AAAA,EACF;AACF;AAQA,SAAS,kBAAkB,eAAyB,cAAkC;AACpF,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAAA;AAAA;AAAA,IAIA;AAAA,IAKA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AASO,SAAS,qBAAqB,MAAoD;AACvF,MAAI;AACF,WAAO,eAAe,aAAa,MAAM,MAAM,CAAC;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AA2BA,SAAS,gBAAgB,MAGb;AACV,SAAO,KAAK,iBAAiB,QAAQ,KAAK,cAAc;AAC1D;AAEA,SAAS,qBAAqB,WAAyD;AACrF,MAAI,cAAc,OAAW,QAAO;AACpC,SAAO,6BAA6B,KAAK,UAAU,SAAS,CAAC;AAC/D;AAOA,SAAS,mBACP,MACA,eACQ;AACR,SAAO,KAAK,eACR;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,CAAC,gBACG,uBAAuB,KAAK,UAAU,KAAK,YAAY,EAAE,CAAC,MAC1D,4CAA4C,KAAK,UAAU,KAAK,YAAY,EAAE,CAAC;AAAA,IACnF,uBAAuB,KAAK,UAAU,KAAK,YAAY,EAAE,CAAC;AAAA,IAC1D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI,IACX;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACjB;AAEO,SAAS,4BACd,OA4CwB,CAAC,GACjB;AACR,QAAM,kBAAkB,KAAK,eACzB,6DACA;AAuBJ,QAAM,gBAAgB,gBAAgB,IAAI;AAC1C,QAAM,iBAAiB,gBAAgB,qBAAqB,KAAK,SAAS,IAAI;AAE9E,QAAM,eAAe,mBAAmB,MAAM,aAAa;AAO3D,QAAM,EAAE,cAAc,oBAAoB,kBAAkB,IAAI;AAAA,IAC9D,KAAK,UAAU,CAAC;AAAA,EAClB;AACA,QAAM,gBAAgB,8BAA8B,IAAI;AACxD,QAAM,iBAAiB;AAAA,IACrB,KAAK,WAAW,SACZ;AAAA;AAAA;AAAA;AAAA,MAIA,EAAE,MAAM,SAAS,QAAQ,KAAK,QAAQ,eAAe,KAAK,cAAc;AAAA;AAAA,IAC5E;AAAA,MACE,qBAAqB;AAAA;AAAA;AAAA;AAAA,MAIrB,kBACE,KAAK,wBAAwB,SAAY,SAAY;AAAA,IACzD;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,CAAC,gBACG,6IACA;AAAA;AAAA,IACJ;AAAA,IACA,KAAK,eACD,iHACA;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,cAAc;AAAA,IACjB,GAAG,eAAe;AAAA,IAClB,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA,qBAAqB,iBAAiB,IAAI,CAAC;AAAA,IAC3C;AAAA,IACA,GAAG,kBAAkB,oBAAoB,iBAAiB;AAAA,IAC1D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,4BAA4B,KAAK,eAAe;AAAA,IACnD;AAAA,IACA,GAAG,qBAAqB,MAAM,UAAU;AAAA,IACxC;AAAA,IACA,GAAG,cAAc;AAAA,IACjB,GAAG,eAAe;AAAA,IAClB,GAAG,qBAAqB,KAAK,MAAM,YAAY;AAAA,IAC/C;AAAA,IACA;AAAA,IACA,yBAAyB,QAAQ,KAAK,YAAY,CAAC,GAAG,SAAS,CAAC,CAAC;AAAA,IACjE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,MACD;AAAA,MACA,cAAc;AAAA,MACd,eAAe;AAAA,MACf,eAAe;AAAA,IACjB;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAWA,SAAS,gCACP,cACA,eACA,aAEA,YACU;AACV,SAAO;AAAA,IACL;AAAA,IACA,4CAA4C,UAAU;AAAA,IACtD;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,sBAAsB,WAAW,MAAM;AAAA,IAC1C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,qEAAqE,aAAa;AAAA,IAClF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,qBAA6B;AAC3C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEO,IAAM,oBAAmC;AAAA,EAC9C,MAAM;AAAA,EACN,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWlB,cAAc;AAAA,EACd,eAAe,CAAC,mBAAmB,QAAQ,cAAc,QAAQ,iBAAiB,SAAS;AAAA,EAE3F,MAAM,MAAM,QAAoB,KAAa,KAA0C;AAErF,8BAA0B,cAAc,aAAa,GAAG,CAAC;AAGzD,UAAM,YAAY,MAAM,QAAQ,KAAK,GAAG;AAExC,UAAM,YAAY,QAAQ,KAAK,qBAAqB;AACpD,cAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AASxC,UAAM,QAAQ,kBAAkB,KAAK,OAAO,YAAY;AAKxD,UAAM,YAAY,qBAAqB,QAAQ,KAAK,YAAY,UAAU,iBAAiB,CAAC;AAU5F,UAAM,UAAU,KAAK,aAAa,OAAO,SAAS,KAAK;AAAA,MACrD,QAAQ,CAAC;AAAA,MACT,UAAU,CAAC;AAAA,MACX,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA,MAIT,eAAe;AAAA,IACjB;AAEA,UAAM,cAAc,oBAAoB,OAAO,SAAS,YAAY;AACpE,QAAI,gBAAgB,QAAW;AAG7B,oBAAc,QAAQ,WAAW,kBAAkB,GAAG,YAAY,MAAM;AAAA,IAC1E;AAEA;AAAA,MACE,QAAQ,WAAW,YAAY;AAAA,MAC/B,4BAA4B;AAAA,QAC1B,cAAc,OAAO;AAAA,QACrB,GAAG;AAAA,QACH,iBAAiB,OAAO,UAAU;AAAA,QAClC,MAAM,OAAO,UAAU;AAAA,QACvB,YAAY,OAAO,UAAU;AAAA,QAC7B,MAAM,OAAO,UAAU;AAAA,QACvB;AAAA;AAAA,QAEA,eAAe,OAAO;AAAA;AAAA;AAAA;AAAA,QAItB,qBAAqB,aAAa;AAAA,QAClC,QAAQ,QAAQ;AAAA;AAAA,QAEhB,QAAQ,QAAQ;AAAA;AAAA;AAAA,QAGhB,eAAe,QAAQ;AAAA,QACvB,UAAU,QAAQ;AAAA,MACpB,CAAC;AAAA,IACH;AAGA,kBAAc,QAAQ,KAAK,eAAe,GAAG,mBAAmB,CAAC;AAGjE,YAAQ,IAAI,0EAAgE;AAE5E,YAAQ;AAAA,MACN,GAAG,gCAAgC;AAAA,QACjC,QAAQ;AAAA,QACR,iBAAiB,OAAO,UAAU;AAAA;AAAA;AAAA,QAGlC,YAAY,OAAO;AAAA;AAAA;AAAA,QAGnB,iBAAiB;AAAA,MACnB,CAAC,CAAC;AAAA;AAAA,IACJ;AAAA,EACF;AACF;","names":[]}

package/dist/{define-middleware-D2n71Svm.d.ts → define-middleware-BOHpPOBs.d.ts}

@@ -105,6 +105,6 @@ interface RouteConfig<TQuery extends z.ZodType = z.ZodUndefined, TBody extends z
  * downstream, which the short-circuit shape cannot express.
  */
 type MiddlewareNext = () => Promise<Response | undefined>;
-type MiddlewareHandler = (request: Request, context: Record<string, unknown>, next?: MiddlewareNext) => Response | undefined | void | Promise<Response | undefined | void>;
+type MiddlewareHandler = (request: Request, context: Record<string, unknown>, next: MiddlewareNext) => Response | undefined | void | Promise<Response | undefined | void>;
 
 export type { MiddlewareHandler as M, RouteConfig as R, MiddlewareNext as a };

package/dist/{deno-deploy-BXOQ45LD.js → deno-deploy-WMNXRVGL.js}

@@ -1,17 +1,20 @@
 #!/usr/bin/env node
 import "tsx/esm";
 import {
-  deployedAgentsFragment,
   planDeployedPlugins
-} from "./chunk-O55RLSGG.js";
+} from "./chunk-V5SSTT3C.js";
+import {
+  deployedEntryPreamble
+} from "./chunk-XG6SQUEP.js";
 import {
-  deployedCorsFragment,
-  deployedCsrfFragment,
+  agentsDirLiteral,
+  deployedAgentsFragment,
   deployedRuntimeConfigFragment,
   deployedTraceFragment,
   describeDeployedSecurityHeaders,
-  renderSecurityHeadersConfigLiteral
-} from "./chunk-6B3CMPE4.js";
+  scannedFromLoaderCache,
+  serverDirLiteral
+} from "./chunk-FFGP2LGQ.js";
 import {
   nodeAdapter
 } from "./chunk-KI4DOTN4.js";
@@ -24,17 +27,25 @@ import {
 // src/adapters/deno-deploy.ts
 import { mkdirSync, writeFileSync } from "fs";
 import { resolve } from "path";
+var FRAMEWORK_IMPORTS = [
+  `// Use npm: specifier so Deno resolves theokit from the user's package.json`,
+  `// equivalent (works in both local 'deno run' and Deno Deploy).`,
+  `import { scanServerRoutes, matchRoute, executeRoute, createProductionLoader, scanWebSocketRoutes, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler } from 'npm:theokit/server'`,
+  `import { createWebShim } from 'npm:theokit/adapters/web-shim'`,
+  `import { buildSecurityHeaders, withSecurityHeaders } from 'npm:theokit/adapters/security-headers'`,
+  `// T3.3 \u2014 WS bridge for Deno runtime`,
+  `import { createDenoWsBridge } from 'npm:theokit/adapters/ws-shim'`
+];
 function renderDenoEntry(port, opts = {}) {
   const runtimeConfig = deployedRuntimeConfigFragment(opts);
-  const agentsFragment = deployedAgentsFragment(
-    {
-      kind: "scan",
-      projectRoot: "cwd",
-      loadModule: "loaderCache",
-      ensureLoader: "if (!loaderCache) loaderCache = createProductionLoader()"
-    },
-    { notFound: "notFound()", importPrefix: "npm:" }
-  );
+  const agentsFragment = deployedAgentsFragment(scannedFromLoaderCache(agentsDirLiteral(opts)), {
+    notFound: "notFound()",
+    importPrefix: "npm:",
+    // B-185 — bound only when the runtime-config fragment declared the const, which is
+    // exactly when a plugins module was emitted. Referencing it otherwise would emit an
+    // identifier the entry never declares.
+    pluginRunnerExpr: opts.runtimeConfigModule === void 0 ? void 0 : "await THEO_PLUGIN_RUNNER"
+  });
   return [
     `// Generated by Theo \u2014 Deno Deploy Adapter`,
     `// Deploy: deployctl deploy --project=<name> .theokit/deno/server.ts`,
@@ -45,17 +56,11 @@ function renderDenoEntry(port, opts = {}) {
     `  throw new Error('TheoDenoDeployAdapter must run inside Deno.')`,
     `}`,
     ``,
-    `// Use npm: specifier so Deno resolves theokit from the user's package.json`,
-    `// equivalent (works in both local 'deno run' and Deno Deploy).`,
-    `import { scanServerRoutes, matchRoute, executeRoute, createProductionLoader, scanWebSocketRoutes, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler } from 'npm:theokit/server'`,
-    `import { createWebShim } from 'npm:theokit/adapters/web-shim'`,
-    `import { buildSecurityHeaders, withSecurityHeaders } from 'npm:theokit/adapters/security-headers'`,
-    `// T3.3 \u2014 WS bridge for Deno runtime`,
-    `import { createDenoWsBridge } from 'npm:theokit/adapters/ws-shim'`,
+    ...FRAMEWORK_IMPORTS,
     ``,
     `const port = Number(Deno.env.get('PORT') ?? '${port}')`,
     `const cwd = Deno.cwd()`,
-    `const serverDir = cwd + '/server'`,
+    `const serverDir = cwd + '/' + ${serverDirLiteral(opts)}`,
     `let routesCache = null`,
     `let wsRoutesCache = null`,
     `let loaderCache = null`,
@@ -65,16 +70,7 @@ function renderDenoEntry(port, opts = {}) {
     `// theo.config.ts to read. Non-API paths 404 here and are served by Deno`,
     `// Deploy's static asset handler, so this covers the API and not the`,
     `// document (usetheokit/theokit#412).`,
-    `const SECURITY_HEADERS_CONFIG = ${renderSecurityHeadersConfigLiteral(opts.securityHeaders)}`,
-    `const SECURITY_HEADERS = buildSecurityHeaders(SECURITY_HEADERS_CONFIG, { production: true })`,
-    ``,
-    ...runtimeConfig.imports,
-    ...agentsFragment.imports,
-    ...runtimeConfig.declarations,
-    ...agentsFragment.declarations,
-    ...deployedCsrfFragment(opts),
-    ``,
-    ...deployedCorsFragment(opts.cors, "deno-deploy"),
+    ...deployedEntryPreamble(runtimeConfig, agentsFragment, opts, "deno-deploy"),
     ``,
     `function notFound() {`,
     `  return new Response(JSON.stringify({ error: { code: 'NOT_FOUND' } }), {`,
@@ -108,7 +104,7 @@ function renderDenoEntry(port, opts = {}) {
     `async function handleRequest(request) {`,
     `  const url = new URL(request.url)`,
     ``,
-    `  if (!url.pathname.startsWith('/api/')) {`,
+    `  if (!url.pathname.startsWith('/api/')${agentsFragment.hostBypass}) {`,
     `    // Static + SPA fallback are served by Deno Deploy's static asset handler.`,
     `    return notFound()`,
     `  }`,
@@ -150,7 +146,12 @@ async function buildDeno(config, cwd, deps = {}, ctx) {
     // #425 — the ONE concern that is not a literal. A closure cannot be baked, so a plugin
     // declared by module specifier is imported by the emitted module instead; a constructed one
     // is refused by name at build time rather than dropped in silence.
-    runtimeConfigModule: pluginsPlan?.moduleSpecifier
+    runtimeConfigModule: pluginsPlan?.moduleSpecifier,
+    // #95 — the configured directories, which `build.ts:210` already threads into the Vite
+    // plugins. Without these two lines the literals above fall to their defaults and a project
+    // with a custom dir deploys an entry that resolves a directory it does not have.
+    serverDir: config.serverDir,
+    agentsDir: config.agentsDir
   });
   const write = deps.writeEntry ?? ((p, c) => {
     writeFileSync(p, c);
@@ -193,4 +194,4 @@ export {
   denoDeployAdapter,
   renderDenoEntry
 };
-//# sourceMappingURL=deno-deploy-BXOQ45LD.js.map
+//# sourceMappingURL=deno-deploy-WMNXRVGL.js.map