theokit 0.71.0 → 0.72.1

package/dist/{chunk-IGCOTLQI.js.map → chunk-C5CAL3DX.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/adapters/deployed-agents.ts","../src/adapters/deployed-cors.ts","../src/adapters/deployed-csrf.ts","../src/adapters/security-headers.ts","../src/adapters/deployed-rate-limit.ts","../src/adapters/deployed-runtime-config.ts","../src/adapters/deployed-trace.ts"],"sourcesContent":["/**\n * Serving an agent from a generated deploy entry (usetheokit/theokit#367).\n *\n * ## The gap this closes\n *\n * `grep -rc \"agent\" packages/theo/src/adapters/*.ts` used to return nothing across 14 files. The\n * notion did not exist in this layer at all: every generated entry routes `/api/` exclusively\n * through `scanServerRoutes` + `executeRoute`, and an agent is a DIFFERENT scan served by a\n * DIFFERENT function — `scanAgents` + `mountAgent`. So `/api/agents/chat` matched no file route and\n * fell into `notFoundResponse()` on every target.\n *\n * For a framework whose stated reason to exist is \"the agent is a file, delivered by the same\n * pipeline that serves the page\", that is the gap which contradicts the sentence: the agent was\n * delivered by no pipeline at all outside a machine running `theokit start`.\n *\n * ## Why baking, and why `../../`\n *\n * A Worker has no filesystem to scan and no path to `import()`, which is the same reason routes are\n * baked (#369). The agent modules are resolved on the build machine and emitted as static imports,\n * relative to the entry's directory — every target that can do this writes two levels below the\n * project root, so the arithmetic is the one `renderBakedRoutes` already does.\n *\n * ## Which targets can do it\n *\n * Only the ones whose output is BUNDLED from the project: `cloudflare` (wrangler), `bun` and\n * `deno-deploy` resolve the emitted import against the app's own source tree. `vercel`, `netlify`\n * and `aws-lambda` receive a standalone function directory that never sees the app's modules, so\n * an agent cannot travel there by this road at all. Same split as plugins (#425), same cause.\n *\n * ## The table is keyed by NAME\n *\n * The URL carries the name, the access policy is judged under the name, and the run's spans are\n * labelled with it (#406). Keying by file path would make the lookup depend on the server's\n * directory layout — which changes per deploy, and which is exactly the value #406 removed from\n * telemetry for the same reason.\n */\n\n/** One agent, as `scanAgents` reports it. Structural, so the adapters need no `server/` import. */\nexport interface DeployedAgent {\n  /** Path relative to the project root — the specifier the static import uses. */\n  readonly filePath: string\n  /** The URL the agent answers on. */\n  readonly agentPath: string\n  /** The agent's NAME — what the URL carries, the policy is judged under, and spans are labelled. */\n  readonly name: string\n}\n\nexport interface DeployedAgentsFragment {\n  /** Top-level imports of the agent modules. */\n  readonly imports: string[]\n  /** Module-scope declarations — the name→module table. */\n  readonly declarations: string[]\n  /** The request-handler branch, to be emitted before the file-route table is consulted. */\n  readonly branch: string[]\n  /**\n   * SI-020 — the condition a host ANDs into its non-API early-return guard, so an agent card path\n   * is not handed to static assets before this fragment's branch is reached.\n   *\n   * Empty string when the fragment emits nothing, so a host that interpolates it unconditionally\n   * never references a name that was not declared.\n   */\n  readonly hostBypass: string\n}\n\nconst EMPTY: DeployedAgentsFragment = { imports: [], declarations: [], branch: [], hostBypass: '' }\n\n/**\n * How the host entry names the things this branch has to use.\n *\n * The fragment is generated code injected into three entries that do NOT agree on their own\n * vocabulary — Bun reads `pathname`, Cloudflare reads `url.pathname`; Deno calls `notFound()`,\n * Cloudflare calls `notFoundResponse()`; Cloudflare wraps each branch in the security baseline\n * while Bun and Deno wrap once at the caller; Deno resolves npm packages with an `npm:` prefix.\n *\n * Naming those differences is what keeps this ONE fragment. The alternative — three near-identical\n * branches, one per adapter — is the copy that `serveThroughPluginLifecycle` was extracted to undo\n * after it had drifted five ways (#405).\n */\n/**\n * How the target REACHES its agent modules — and the two answers are genuinely different, not a\n * copy waiting to be merged.\n *\n * A Worker has no filesystem: its agents must be resolved on the build machine and emitted as\n * static imports, which is what `renderBakedRoutes` already does for routes there. Bun and Deno DO\n * have a filesystem and already scan their routes at request time; making them bake would couple an\n * agent's existence to a rebuild for no gain. The split mirrors the one routes already have on\n * exactly these targets, which is the argument for keeping it.\n */\nexport type DeployedAgentsSource =\n  | {\n      readonly kind: 'baked'\n      /** Scanned on the build machine, emitted as static imports. */\n      readonly agents: readonly DeployedAgent[]\n      /**\n       * B-185 — the app's `server/context.ts`, as a specifier relative to the emitted entry, or\n       * `undefined` when the app has none. A Worker has no filesystem on which to find it, so it is\n       * baked like the agent modules beside it (ADR 0014). `undefined` is the ordinary case for an\n       * app that declares no context, and emitting an import of a file that is not there would\n       * fail the BUILD rather than the request — which is why `planDeployedPlugins` takes the same\n       * road for plugins.\n       */\n      readonly contextModule?: string\n    }\n  | {\n      readonly kind: 'scan'\n      /** Expression yielding the project root at runtime. */\n      readonly projectRoot: string\n      /** Expression yielding the module loader the entry already builds. */\n      readonly loadModule: string\n      /**\n       * A statement that guarantees `loadModule` is usable, for a host that builds its loader\n       * lazily. Deno's `loaderCache` is created on the route path, which runs AFTER this branch —\n       * so without this the agent branch would call `null`.\n       */\n      readonly ensureLoader?: string\n      /** The configured agents directory as a quoted literal. Absent ⇒ `scanAgents` defaults to `agents`. */\n      readonly agentsDirLiteral?: string\n      /**\n       * B-185 — an expression yielding the app's `server/` directory, which this host already\n       * declares (`bun.ts:95`, `deno-deploy.ts:69`) and already hands to `executeRoute`. A host\n       * with a filesystem locates its own `context.ts`, so it needs no baking (ADR 0014, and the\n       * split `deployed-agents.ts` already argues for routes two docblocks above).\n       */\n      readonly serverDir?: string\n    }\n\nexport interface DeployedAgentsHost {\n  /** Expression yielding the request path inside the handler. Default `url.pathname`. */\n  readonly pathname?: string\n  /** Call producing the 404 response. Default `notFoundResponse()`. */\n  readonly notFound?: string\n  /** Whether THIS branch applies the security baseline, or the caller already does. */\n  readonly wrapSecurityHeaders?: boolean\n  /** Prefix for bare package specifiers. Deno needs `npm:`; the others need nothing. */\n  readonly importPrefix?: string\n  /**\n   * Expression yielding the entry's plugin runner, or `undefined` when the app declared no plugins\n   * and the build emitted no module to bind.\n   *\n   * `deployedRuntimeConfigFragment` already declares `const THEO_PLUGIN_RUNNER` at module scope and\n   * spreads `pluginRunner: await THEO_PLUGIN_RUNNER` into `executeRoute`; an adapter passes that\n   * same expression here rather than building a second runner, because a runner rebuilt per request\n   * re-runs every plugin's `register` -- which is where a plugin allocates the state its hooks read.\n   */\n  readonly pluginRunnerExpr?: string\n}\n\n/**\n * The two `AuxRouteDeps` fields a deployed entry must supply to match what dev already does.\n *\n * Both dev callers pass them — `vite-plugin/agent-middleware.ts:161,164` and\n * `cli/commands/start/handlers.ts:226,229` — and a first draft of this fragment passed neither,\n * on a quotation from `serve-aux-routes.ts:83-85` that names three routes (\"card, approvals,\n * stream\") while the dispatcher serves six. Two reviewers measured the same two consequences:\n *\n * - `csrfMode` unset defaults to `'strict'` (`serve-aux-routes.ts:379`), so an app declaring\n *   `security: { csrf: 'off' }` got `off` on `POST /api/agents/<name>` and `strict` on its `/mcp`\n *   sibling one line away — verbatim the divergence `deployed-csrf.ts`'s own header exists to\n *   record, re-created on a route this slice had just made reachable.\n * - `resolveApiKey` unset makes the thread follow-up answer a permanent 501 on every deploy\n *   target (`serve-aux-routes.ts:359-365`), naming a framework-internal parameter to the caller.\n *\n * Both values are already in scope: `CSRF_CONFIG` is spread into `mountAgent` in the same emitted\n * function, and `resolveProvider` is already on its import line.\n */\nconst AUX_DEPS_PARITY = [\n  `        ...CSRF_CONFIG,`,\n  `        resolveApiKey: (model, plugins) => resolveProvider(model, { plugins }).apiKey,`,\n] as const\n\n/** The prefix the agent convention owns. Matches `handlers.ts`'s own `tryServeAgent`. */\nconst AGENT_PREFIX = '/api/agents/'\n\n/**\n * The second shape the aux dispatcher owns. `matchGetAuxRoute` serves M15's\n * `GET /.well-known/<name>/agent-card.json`, and a guard admitting only {@link AGENT_PREFIX} left\n * five of the dispatcher's six families reachable on a deploy target and excluded the sixth — by\n * the guard, not by a decision, and silently.\n *\n * A prefix rather than the matcher's own `isAgentCardPath`: the guard exists to keep a url nobody\n * answers from paying for anything, and importing the matcher's predicate into every emitted entry\n * would buy a narrower pre-filter at the cost of a module the branch already declines without.\n */\nconst WELL_KNOWN_PREFIX = '/.well-known/'\n\n/**\n * What a deployed entry needs in order to serve the app's agents.\n *\n * @param agents - the agents scanned on the build machine. Empty emits nothing at all.\n */\n/**\n * The scan source every filesystem host with a lazily-created loader shares.\n *\n * Four adapters — `netlify`, `vercel`, `aws-lambda`, `deno-deploy` — emit an entry that resolves\n * `serverDir` itself, caches its loader in `loaderCache`, and creates that cache on first use.\n * They therefore hand this fragment the SAME six fields, and writing them out four times is the\n * copy `serveThroughPluginLifecycle` was extracted to undo after it had drifted five ways (#405).\n *\n * B-235 is what made it four: wiring three more targets duplicated the block three more times, and\n * the duplication gate on new code is what said so — 4.2% against a 3% ceiling. The gate was right\n * and the fix is the one it implies, not a threshold.\n *\n * `bun` is deliberately NOT a caller. It names its loader `loadModule` and creates it eagerly, so\n * it has no `ensureLoader` — a parameter to cover that difference would make this function a\n * switch over its callers, which is the shape that drifts.\n */\nexport function scannedFromLoaderCache(agentsDirLiteral?: string): DeployedAgentsSource {\n  return {\n    kind: 'scan',\n    projectRoot: 'cwd',\n    agentsDirLiteral,\n    loadModule: 'loaderCache',\n    serverDir: 'serverDir',\n    ensureLoader: 'if (!loaderCache) loaderCache = createProductionLoader()',\n  }\n}\n\n/**\n * The JSON 404 `vercel` and `aws-lambda` answer a routing miss with.\n *\n * An expression rather than a call, because the fragment interpolates `notFound` into a `return`\n * and neither host declares a helper for it.\n */\nexport const JSON_NOT_FOUND_RESPONSE = `new Response(JSON.stringify({ error: { code: 'NOT_FOUND' } }), { status: 404, headers: { 'content-type': 'application/json' } })`\n\nexport function deployedAgentsFragment(\n  source: DeployedAgentsSource | undefined,\n  host: DeployedAgentsHost = {},\n): DeployedAgentsFragment {\n  if (source === undefined) return EMPTY\n  if (source.kind === 'baked' && source.agents.length === 0) return EMPTY\n\n  const pathname = host.pathname ?? 'url.pathname'\n  const notFound = host.notFound ?? 'notFoundResponse()'\n  const prefix = host.importPrefix ?? ''\n\n  const resolution =\n    source.kind === 'baked'\n      ? bakedResolution(source.agents, source.contextModule, host.pluginRunnerExpr)\n      : scannedResolution({ ...source, pluginRunnerExpr: host.pluginRunnerExpr })\n\n  return {\n    hostBypass: ` && !__theoIsAgentCardPath(${pathname})`,\n    imports: [\n      // `theokit/adapters/agent-mount`, not `theokit/server`: `mount-agent` is deliberately not on\n      // the app-facing surface (ADR 0041), and a generated entry is not an app. See that module.\n      // B-185 — the identity entry differs by host: a filesystem host LOCATES its own\n      // `context.ts`, a Worker is handed the baked factory (ADR 0014). `createWebShim` is not here\n      // because all three entries already import it at module level.\n      `import { mountAgent, resolveProvider, matchAgentAuxRoute, serveMatchedAuxRoute${resolution.identityImport}${source.kind === 'scan' ? ', scanAgents' : ''} } from '${prefix}theokit/adapters/agent-mount'`,\n      ...resolution.imports,\n    ],\n    declarations: [\n      ...resolution.declarations,\n      // SI-020 — the host's `/api/` guard decides between the API surface and static assets, and it\n      // runs BEFORE this branch. Widening the branch guard alone left the `.well-known` arm as dead\n      // code on all three targets: present in the source, unreachable in the emitted program. The\n      // host consults this predicate, so the card path escapes the asset branch and NOTHING else\n      // under `/.well-known/` does — a blanket prefix bypass would route `/.well-known/security.txt`\n      // away from assets, trading an unreachable card for a broken namespace.\n      //\n      // Same shape as `agent-card-handler.ts`'s own WELL_KNOWN. That is a COPY, not a shared\n      // definition, and saying otherwise was the claim an inventory judge falsified: changing the\n      // handler to serve `/agent.json` left every card test green, because this guard and that\n      // matcher are checked separately and never against each other. The drift that matters here —\n      // this guard narrowing while the matcher still serves the path — is caught by\n      // `a-deployed-worker-reaches-the-agent-card.test.ts`, which drives a real request. The other\n      // direction is not, and is the honest limit of this line.\n      String.raw`const __theoIsAgentCardPath = (p) => /^\\/\\.well-known\\/[^/]+\\/agent-card\\.json$/.test(p)`,\n      // B-185 — one factory, two call sites: the aux branch on a hit, and the run handler below.\n      // Declared rather than inlined twice so the mechanism ADR 0014 decides has a single home.\n      // `async` because the entry's plugin runner is a promise: `createPluginRunnerFromConfig` is\n      // async, so the runtime-config fragment declares `const THEO_PLUGIN_RUNNER = createPluginRunnerFromConfig(...)`\n      // WITHOUT awaiting it, and every consumer awaits at the point of use. `await` is a reserved\n      // word everywhere in an ES module, so a non-async factory carrying that binding does not\n      // merely misbehave -- the entry does not parse, and `tests/unit/adapter-entry-parses.test.ts`\n      // is where that is caught. It went red at HEAD before this line existed, on a first version\n      // of this fix whose own test asserted `toContain('await THEO_PLUGIN_RUNNER')`: the presence\n      // of the token that breaks the parse. That test file's header says why, in its own words --\n      // `toContain` does not care whether the string is a program.\n      //\n      // Laziness is unaffected. The shim was always built eagerly inside this factory; what ADR-1\n      // refuses is paying for a url nobody answers, and neither call site is reached by one.\n      `async function __theoResolveSubject(request) {`,\n      ...resolution.identity,\n      `  return resolveSubject`,\n      `}`,\n    ],\n    branch: [\n      `    // #367 — the agent convention owns this prefix. It is answered BEFORE the file-route`,\n      `    // table because an agent matches no file route: falling through is how a deployed`,\n      `    // \\`/api/agents/<name>\\` used to 404 on every target.`,\n      `    if (`,\n      `      ${pathname}.startsWith(${JSON.stringify(AGENT_PREFIX)}) ||`,\n      `      ${pathname}.startsWith(${JSON.stringify(WELL_KNOWN_PREFIX)})`,\n      `    ) {`,\n      ...resolution.auxPrelude,\n      `      // B-185 — the aux dispatcher is asked FIRST, and declining costs nothing: the matcher`,\n      `      // reads the url and the scanned nodes, never a module (ADR-1). A miss falls through to`,\n      `      // the run handler exactly as before, so this branch owns the sub-paths and nothing more.`,\n      `      const auxRoute = await matchAgentAuxRoute(request.method, ${pathname}, auxDeps)`,\n      `      if (auxRoute !== null) {`,\n      `        // B-185 — identity is resolved only now. Building it costs a web shim and, where the`,\n      `        // app declares one, a call into its own \\`createContext\\`; a url this dispatcher`,\n      `        // merely declined must pay for neither (resolve-agent-subject.ts:93-96).`,\n      `        const auxResponse = await serveMatchedAuxRoute(auxRoute, request, {`,\n      `          ...auxDeps,`,\n      `          resolveSubject: await __theoResolveSubject(request),`,\n      `        })`,\n      host.wrapSecurityHeaders === true\n        ? `        return withSecurityHeaders(auxResponse, SECURITY_HEADERS)`\n        : `        return auxResponse`,\n      `      }`,\n      `      // B-185 — only the agent prefix has a run handler behind it. A \\`.well-known\\` url the`,\n      `      // dispatcher declined must NOT slice a prefix it does not carry: the name would be`,\n      `      // garbage and mountAgent would answer 500 for what is a routing miss.`,\n      `      if (!${pathname}.startsWith(${JSON.stringify(AGENT_PREFIX)})) return ${notFound}`,\n      `      const agentName = ${pathname}.slice(${String(AGENT_PREFIX.length)}).split('/')[0]`,\n      ...resolution.lookup,\n      `      // A name nobody scanned is a 404, exactly like any other unknown path. Handing`,\n      `      // \\`undefined\\` to mountAgent would surface as a 500 for what is a routing miss.`,\n      `      if (mod === undefined) return ${notFound}`,\n      `      const agentResponse = await mountAgent(mod, request, (model, plugins) => resolveProvider(model, { plugins }).apiKey, {`,\n      `        agentName,`,\n      `        // B-185 — mount-agent.ts:121 has accepted this since #365 and 0 of 23 adapters passed`,\n      `        // one, so agent-access.ts:146 judged every deployed policy against \\`subject: null\\`.`,\n      `        // A run is not a decline: it is about to do real work, so the shim this builds is not`,\n      `        // the cost ADR-1 refuses.`,\n      `        resolveSubject: await __theoResolveSubject(request),`,\n      `        ...CSRF_CONFIG,`,\n      `      })`,\n      host.wrapSecurityHeaders === true\n        ? `      return withSecurityHeaders(agentResponse, SECURITY_HEADERS)`\n        : `      return agentResponse`,\n      `    }`,\n    ],\n  }\n}\n\ninterface AgentResolution {\n  imports: string[]\n  declarations: string[]\n  /** Lines that must leave `mod` bound to the agent's module, or `undefined`. */\n  lookup: string[]\n  /**\n   * B-185 — lines that must leave `auxDeps` bound to an `AuxRouteDeps`, plus the expression for\n   * its `agents`. They run BEFORE {@link AgentResolution.lookup} so a declined aux route performs\n   * no module load, which is what ADR-1 buys and what a later ordering would spend.\n   */\n  auxPrelude: string[]\n  /**\n   * B-185 — lines that must leave `resolveSubject` bound to a resolver, or to `undefined`. Emitted\n   * only where a match has already happened, because building one costs a web shim and\n   * `resolve-agent-subject.ts:93-96` states that a declined url must never run the application's\n   * `createContext`.\n   */\n  identity: string[]\n  /**\n   * B-185 — what {@link AgentResolution.identity} imports, appended to the `agent-mount` line, or\n   * `''` where identity is not resolved at all.\n   *\n   * It lives HERE, beside the lines that CALL it, because a first draft decided it in a separate\n   * `identityEntryFor` that switched the same discriminated union a second time. The two could not\n   * disagree then — the conditions were identical — which is what made it latent rather than live.\n   * A later drift would emit an entry that CALLS a symbol it never imported, and nothing catches\n   * that: the stub-coverage guard derives its requirement FROM the imports, so a missing import\n   * shrinks the requirement instead of failing, and `node --check` is syntax rather than\n   * resolution. It would surface as a `ReferenceError` inside a deployed Worker.\n   */\n  identityImport: string\n}\n\n/** No filesystem: every agent module is a static import decided on the build machine. */\nfunction bakedResolution(\n  agents: readonly DeployedAgent[],\n  contextModule: string | undefined,\n  pluginRunnerExpr: string | undefined,\n): AgentResolution {\n  const varOf = (index: number): string => `__theoAgent${String(index)}`\n  return {\n    imports: [\n      ...agents.map((agent, index) => `import * as ${varOf(index)} from '../../${agent.filePath}'`),\n      // B-185 — the app's context module, baked exactly like the agents above it (ADR 0014).\n      ...(contextModule === undefined\n        ? []\n        : [\n            // SI-022 — DYNAMIC, not a top-level static import. B-185 added this import; before it\n            // a Worker did not load the app's `server/context.ts` at all. A module-scope throw\n            // there — the commonest shape being a required-env-var check — then went from costing\n            // nothing to taking the ENTIRE target down: the import fails, the module never\n            // evaluates, and every route dies rather than only the one that wanted an identity.\n            //\n            // That is strictly worse than what `resolve-agent-subject.ts:69-72` promises. It says\n            // a throwing `createContext` reaches the branch's own error handler and becomes a 500,\n            // which is a failure scoped to the request that needed identity. A throw at IMPORT\n            // time reaches no handler at all.\n            //\n            // A relative `import()` is statically analysable, so wrangler bundles the module\n            // exactly as it bundled the static form — the reason ADR 0014 bakes it is unaffected.\n            // What changes is WHEN it evaluates, and therefore what a failure costs. It is only\n            // a real improvement if the import stays inside the thunk; see the factory below.\n            `const __theoContext = () => import('../../${contextModule}')`,\n          ]),\n    ],\n    declarations: [\n      `// #367 — the app's agents, keyed by NAME because that is what the URL carries, what the`,\n      `// access policy is judged under, and what the run's spans are labelled with (#406).`,\n      `const agents = {`,\n      ...agents.map((agent, index) => `  ${JSON.stringify(agent.name)}: ${varOf(index)},`),\n      `}`,\n      `// B-185 — the node list the aux dispatcher matches a url against. There is deliberately NO`,\n      `// second table keyed by file path: \\`test_the_table_is_keyed_by_agent_name_not_by_file_path\\``,\n      `// forbids one, and the reason it gives is the right one — a path key makes a lookup depend on`,\n      `// the server's directory layout. The loader below reaches the module THROUGH this list, so the`,\n      `// layout appears once, here, and the module table above stays keyed by the name the URL, the`,\n      `// access policy and the run's spans all carry (#406).`,\n      `const agentNodes = [`,\n      ...agents.map(\n        (agent) =>\n          `  { filePath: ${JSON.stringify(agent.filePath)}, agentPath: ${JSON.stringify(agent.agentPath)}, name: ${JSON.stringify(agent.name)} },`,\n      ),\n      `]`,\n    ],\n    lookup: [\n      `      const mod = Object.prototype.hasOwnProperty.call(agents, agentName)`,\n      `        ? agents[agentName]`,\n      `        : undefined`,\n    ],\n    identityImport: contextModule === undefined ? '' : ', createSubjectResolverFromFactory',\n    identity:\n      contextModule === undefined\n        ? [\n            `  // B-185 — this app declares no \\`server/context.ts\\`, so there is no factory to`,\n            `  // bake and an anonymous caller is the honest answer. A policy that admits`,\n            `  // nobody is the correct outcome, not an error.`,\n            `        const resolveSubject = undefined`,\n          ]\n        : [\n            `  // B-185 — a Worker has no filesystem to find \\`context.ts\\` on, so the module is baked`,\n            `  // and its factory handed straight to the resolver (ADR 0014).`,\n            `  //`,\n            `  // This function has TWO callers and is lazy on purpose. Both build a shim, and that is`,\n            `  // correct at both: the aux branch calls it only AFTER a match, and the run handler is`,\n            `  // about to do real work. What neither pays for is the app's own \\`createContext\\` on a`,\n            `  // url nobody answers — the resolver is a thunk, and \\`agent-access.ts:146\\` returns early`,\n            `  // for an absent or public policy without ever invoking it.`,\n            `        const { req: __theoReq, res: __theoRes } = createWebShim(request)`,\n            `  const resolveSubject = createSubjectResolverFromFactory(`,\n            // The import happens HERE, inside the factory, and `createSubjectResolverFromFactory`\n            // calls the factory inside the thunk it returns (`resolve-agent-subject.ts:127-133`).\n            // A first version of this fix awaited the import as an ARGUMENT, which evaluated it\n            // eagerly inside `__theoResolveSubject` — both call sites await that before\n            // `agent-access.ts:145` returns early for an absent or `'public'` policy. The blast\n            // radius was then every agent request rather than the one that wanted an identity,\n            // and the laziness invariant the lines above assert was broken. Found by the\n            // inventory judge while the change was still in the working tree.\n            `    async (__theoArgs) => (await __theoContext()).createContext(__theoArgs),`,\n            `    __theoReq,`,\n            `    __theoRes,`,\n            `    ${pluginRunnerExpr ?? 'undefined'},`,\n            `  )`,\n          ],\n    auxPrelude: [\n      `      // B-185 — the aux dispatcher needs nodes carrying \\`filePath\\` and a loader keyed by it.`,\n      `      // The loader resolves the path to a NAME through the node list, then reads the same`,\n      `      // name-keyed table the url lookup uses: one map, one layout mention, no filesystem`,\n      `      // (ADR-2). A linear find over a handful of agents is not worth a second table that`,\n      `      // \\`test_the_table_is_keyed_by_agent_name_not_by_file_path\\` exists to forbid.`,\n      `      const auxDeps = {`,\n      `        agents: agentNodes,`,\n      `        loadModule: async (filePath) => {`,\n      `          const node = agentNodes.find((a) => a.filePath === filePath)`,\n      `          return node === undefined ? undefined : agents[node.name]`,\n      `        },`,\n      `        baseUrl: url.origin,`,\n      ...AUX_DEPS_PARITY,\n      `      }`,\n    ],\n  }\n}\n\n/** A filesystem: scan once and load on demand, exactly as this entry already treats its routes. */\nfunction scannedResolution(source: {\n  projectRoot: string\n  loadModule: string\n  ensureLoader?: string\n  agentsDirLiteral?: string\n  serverDir?: string\n  pluginRunnerExpr?: string\n}): AgentResolution {\n  // The configured directory as a second argument, or nothing. `scanAgents` defaults the name to\n  // `agents`, which is right for a project that never set one and wrong for every project that did.\n  const agentsDirArg = source.agentsDirLiteral === undefined ? '' : `, ${source.agentsDirLiteral}`\n\n  return {\n    imports: [],\n    declarations: [\n      `// #367 — scanned on first use and cached, the same shape this entry already gives routes.`,\n      `// Baking would tie an agent's existence to a rebuild on a target that has a filesystem.`,\n      `let agentsCache = null`,\n    ],\n    lookup: [\n      `      const agentNode = agentsCache.find((a) => a.name === agentName)`,\n      `      const mod = agentNode === undefined ? undefined : await ${source.loadModule}(agentNode.filePath)`,\n    ],\n    identityImport: source.serverDir === undefined ? '' : ', createAgentSubjectResolver',\n    identity:\n      source.serverDir === undefined\n        ? [`        const resolveSubject = undefined`]\n        : [\n            `  // B-185 — this host HAS a filesystem, so it locates its own \\`context.ts\\` and the`,\n            `  // existing resolver works unchanged; nothing is baked (ADR 0014). Lazy for the reason`,\n            `  // the baked branch gives: both callers build a shim, and neither runs the app's own`,\n            `  // \\`createContext\\` for a url nobody answers.`,\n            `        const { req: __theoReq, res: __theoRes } = createWebShim(request)`,\n            `  const resolveSubject = createAgentSubjectResolver({`,\n            `    req: __theoReq,`,\n            `    res: __theoRes,`,\n            `    loadModule: ${source.loadModule},`,\n            `    serverDir: ${source.serverDir},`,\n            `    pluginRunner: ${source.pluginRunnerExpr ?? 'undefined'},`,\n            `        })`,\n          ],\n    auxPrelude: [\n      ...(source.ensureLoader === undefined ? [] : [`      ${source.ensureLoader}`]),\n      `      // B-185 — hoisted above the lookup so a declined aux route loads no module. The scan`,\n      `      // LISTS agent files; it imports none, so moving it here costs a declined request`,\n      `      // nothing it was not already paying.`,\n      `      if (!agentsCache) agentsCache = scanAgents(${source.projectRoot}${agentsDirArg})`,\n      `      const auxDeps = {`,\n      `        agents: agentsCache,`,\n      `        loadModule: ${source.loadModule},`,\n      `        baseUrl: url.origin,`,\n      ...AUX_DEPS_PARITY,\n      `      }`,\n    ],\n  }\n}\n","/**\n * The CORS configuration a deployed entry carries, baked at build time.\n *\n * ## The defect this closes\n *\n * `security.cors` reached exactly one consumer: Vite's `configureServer` hook. So an app that\n * worked cross-origin under `theokit dev` stopped working the moment anything else served it —\n * `theokit start` (fixed separately) and all six Web deploy targets (usetheokit/theokit#409). Same\n * config, same code, no error and no warning; the failure surfaces in a browser as a blocked fetch\n * on the deployed URL, three layers from the key that had quietly stopped being read.\n *\n * The pure half was written twice and called once: `createCorsWebHandler` — the Web mirror — had no\n * caller anywhere in the repository. Nothing here reimplements it.\n *\n * ## A callback origin is REFUSED, not silently dropped\n *\n * `corsSchema.origins` accepts `z.function(...)` alongside the string / RegExp / array shapes. A\n * deployed function has no `theo.config.ts` to read, and there is no literal for a closure — so a\n * build that baked only the serialisable shapes would produce an app whose CORS silently allowed\n * nothing, which is the exact class of failure this issue reports.\n *\n * `rules/three-target-parity.md` § 3 is explicit about the alternative: \"a target that cannot serve\n * a capability refuses by name. Silent degradation is the failure mode this rule exists to\n * prevent.\" So the build throws, naming the target, the key and the two ways forward.\n */\nimport type { TheoConfig } from '../config/schema.js'\n\ntype CorsConfig = NonNullable<NonNullable<TheoConfig['security']>['cors']>\n\n/**\n * The CORS slice of an adapter's build options.\n *\n * Narrow and named once, matching how `securityHeaders` and `DeployedCsrfOptions` already reach the\n * emitters: each renderer receives what it uses, and six signatures name one type instead of six\n * inline shapes that can drift.\n */\nexport interface DeployedCorsOptions {\n  cors?: CorsConfig\n}\n\n/**\n * Thrown at BUILD time when the declared CORS cannot be carried to a deployed target.\n *\n * A build error is the point: the alternative is a deploy that looks configured and refuses every\n * cross-origin request, discovered by a browser rather than by the build.\n */\nexport class UnserializableCorsOriginError extends Error {\n  constructor(target: string) {\n    super(\n      `security.cors.origins is a function, and the \\`${target}\\` target cannot carry it: a deployed ` +\n        `function has no theo.config.ts to read, and a callback cannot be written into the emitted ` +\n        `entry. Replace it with the origin, a RegExp, or an array of either — all of which travel — ` +\n        `or build for \\`node\\` and run \\`theokit start\\`, which evaluates the callback at runtime.`,\n    )\n    this.name = 'UnserializableCorsOriginError'\n  }\n}\n\n/** Source text for one origin matcher: a RegExp as a literal, anything else as JSON. */\nfunction renderOrigin(origin: unknown, target: string): string {\n  if (typeof origin === 'function') throw new UnserializableCorsOriginError(target)\n  if (origin instanceof RegExp) return String(origin)\n  if (Array.isArray(origin)) return `[${origin.map((o) => renderOrigin(o, target)).join(', ')}]`\n  return JSON.stringify(origin)\n}\n\n/**\n * Source text for the CORS config, or `undefined` when the app declared none.\n *\n * RegExp entries are emitted as regex literals for the reason `deployed-csrf.ts` gives at length:\n * `JSON.stringify` renders a RegExp as `{}`, and `matchesOrigin` checks `instanceof RegExp`, so a\n * JSON-rendered origin would sit in the emitted file looking configured and matching nothing.\n *\n * @throws UnserializableCorsOriginError when `origins` is a callback\n */\nexport function renderDeployedCorsLiteral(cors: CorsConfig | undefined, target: string): string {\n  if (cors === undefined) return 'undefined'\n\n  const parts = [`origins: ${renderOrigin(cors.origins, target)}`]\n  if (cors.methods !== undefined) parts.push(`methods: ${JSON.stringify(cors.methods)}`)\n  if (cors.allowedHeaders !== undefined)\n    parts.push(`allowedHeaders: ${JSON.stringify(cors.allowedHeaders)}`)\n  if (cors.exposedHeaders !== undefined)\n    parts.push(`exposedHeaders: ${JSON.stringify(cors.exposedHeaders)}`)\n  // Both carry schema defaults, so they are always present and always emitted — unlike the\n  // optional fields above, whose absence is a real answer the handler already has one for.\n  parts.push(\n    `credentials: ${JSON.stringify(cors.credentials)}`,\n    `maxAge: ${JSON.stringify(cors.maxAge)}`,\n  )\n\n  return `{ ${parts.join(', ')} }`\n}\n\n/**\n * The lines that declare the CORS handler in a generated entry.\n *\n * `null` when nothing was declared, which is what \"no cors block\" meant before and still means: no\n * headers, not permissive ones.\n */\nexport function deployedCorsFragment(cors: CorsConfig | undefined, target: string): string[] {\n  return [\n    `// #409 — the CORS the app declared, carried as a literal because a deployed function has no`,\n    `// theo.config.ts to read. \\`null\\` when the app declared none: no headers, not permissive ones.`,\n    `const CORS_CONFIG = ${renderDeployedCorsLiteral(cors, target)}`,\n    `const CORS_HANDLER = CORS_CONFIG === undefined ? null : createCorsWebHandler(CORS_CONFIG)`,\n    ``,\n    `/** Answer a preflight before routing — an OPTIONS the router handles never gets a CORS answer. */`,\n    `function corsPreflight(request) {`,\n    `  return CORS_HANDLER === null ? null : CORS_HANDLER.handlePreflightRequest(request)`,\n    `}`,\n    ``,\n    `/** Put the headers on whatever the app answered, including its 404s — a browser reads a 404`,\n    ` *  without them as a CORS failure rather than as the 404 it is. */`,\n    `function withCors(request, response) {`,\n    `  if (CORS_HANDLER !== null) CORS_HANDLER.applyCorsHeaders(request, response.headers)`,\n    `  return response`,\n    `}`,\n  ]\n}\n","/**\n * The CSRF configuration a deployed entry carries, baked at build time.\n *\n * ## The defect this closes\n *\n * The six Web-standards adapter entries built `executeRoute`'s context from an eight-field\n * literal, and neither `csrfMode` nor `disallowed` was among the eight (usetheokit/theokit#410).\n * `executeRoute` defaults an absent mode to `'strict'`, so an app declaring\n * `security: { csrf: 'off' }` — or `'warn'` — got `'strict'` on every deploy target: a `POST` that\n * works under `theokit dev` and `theokit start` answers `403 CSRF_INVALID` on Vercel, naming a\n * mechanism the operator had switched off. The config still validated and the build still\n * succeeded; the behaviour simply changed.\n *\n * The deployed function has no `theo.config.ts` to read, which is why the value is carried as a\n * literal — the same shape `security.headers` already uses (`renderSecurityHeadersConfigLiteral`).\n *\n * ## Why this is not `JSON.stringify`\n *\n * `disallowed.routes` accepts RegExp entries (`config/schemas/security.ts`), and `JSON.stringify`\n * renders a RegExp as `{}`. That is not a formatting problem: `matchDisallowed` checks\n * `p instanceof RegExp`, so a `{}` matches nothing while reading, in the emitted file, as a rule\n * that is present and configured. Reaching for JSON here would reproduce this issue's own defect —\n * configuration that survives validation and quietly stops applying — one layer further down.\n */\nimport type { TheoConfig } from '../config/schema.js'\n\ntype SecurityConfig = NonNullable<TheoConfig['security']>\n\n/**\n * The two slices of `security` that reach `executeRoute`'s context.\n *\n * Narrow rather than the whole block, matching how `securityHeaders` is already passed: each\n * renderer receives what it uses and nothing else, so a headers change cannot reach the CSRF\n * literal and vice versa.\n */\nexport interface DeployedCsrfOptions {\n  csrf?: SecurityConfig['csrf']\n  disallowed?: SecurityConfig['disallowed']\n}\n\n/**\n * Source text for one route pattern.\n *\n * A RegExp is emitted as a regex literal so it arrives as a RegExp; a string goes through\n * `JSON.stringify`, which is the correct escaper for a JS string literal (quotes, backslashes,\n * control characters, line separators).\n */\nfunction renderRoutePattern(pattern: string | RegExp): string {\n  return pattern instanceof RegExp ? String(pattern) : JSON.stringify(pattern)\n}\n\n/**\n * Source text for the CSRF slice of `executeRoute`'s context.\n *\n * Absent values are OMITTED rather than defaulted. `executeRoute` already defaults an absent\n * `csrfMode` to `'strict'`, and writing `'strict'` here would put that default in a second place\n * where the two can disagree — which is the class of drift the whole issue is about.\n *\n * @param security - the declared csrf slices, or `undefined` when the app declared no security block\n */\nexport function renderDeployedCsrfLiteral(security: DeployedCsrfOptions | undefined): string {\n  if (security === undefined) return '{}'\n\n  const parts: string[] = []\n  if (security.csrf !== undefined) parts.push(`csrfMode: ${JSON.stringify(security.csrf)}`)\n\n  const { disallowed } = security\n  if (disallowed !== undefined) {\n    const routes = disallowed.routes.map(renderRoutePattern).join(', ')\n    parts.push(\n      `disallowed: { routes: [${routes}], behavior: ${JSON.stringify(disallowed.behavior)} }`,\n    )\n  }\n\n  // `{}` and not `{ }` when nothing was declared: the emitted file is read by people, and the\n  // two-space version reads as though something was meant to be there.\n  return parts.length === 0 ? '{}' : `{ ${parts.join(', ')} }`\n}\n\n/**\n * The lines that declare `CSRF_CONFIG` in a generated entry.\n *\n * One function rather than the same six lines pasted into each of the six adapters: that\n * duplication is how the eight-field context literal came to be wrong in six places at once, and\n * repeating the fix in the same shape would leave the next field with the same six places to be\n * forgotten in. It also keeps the two largest emitters under the `max-lines-per-function` ceiling,\n * which `vercel.ts` already extracts fragments to respect.\n *\n * @param opts - the declared csrf slices, passed straight through from the adapter's build options\n * @param home - what the target has instead of a config file, for the comment's second sentence\n */\nexport function deployedCsrfFragment(\n  opts: DeployedCsrfOptions,\n  home = 'a deployed function',\n): string[] {\n  return [\n    `// #410 — the CSRF mode and per-route escalation the app declared. Carried as a`,\n    `// literal for the same reason as the headers above: ${home} has no theo.config.ts`,\n    `// to read. Absent keys stay absent so executeRoute's own default ('strict') applies,`,\n    `// rather than this file becoming a second place it can drift.`,\n    `const CSRF_CONFIG = ${renderDeployedCsrfLiteral(opts)}`,\n  ]\n}\n","/**\n * The security headers a deployed target puts on its responses.\n *\n * `theokit start` applies the configured baseline to every response it writes\n * (`cli/commands/start/request-handler.ts`). None of the six Web-standards\n * deploy adapters applied any, so the same page carried a CSP,\n * `X-Frame-Options`, HSTS and `nosniff` under `theokit start` and none of them\n * once deployed (usetheokit/theokit#410, GHSA-87qq-fgcr-384x).\n *\n * This module is the seam that closes that half of the gap. It has two halves\n * and they live together on purpose: the code that writes the literal into a\n * generated entry and the code that reads it at request time have to agree on\n * one shape, and a shape stated in two files drifts.\n *\n * - **Build time** — {@link renderSecurityHeadersConfigLiteral} turns\n *   `security.headers` into a JSON literal the adapter inlines. A deployed\n *   runtime has no `theo.config.ts` to read, so the configuration travels as\n *   data.\n * - **Request time** — the generated entry calls {@link buildSecurityHeaders}\n *   on that literal and hands every response to {@link withSecurityHeaders}.\n *   The same function `theokit start` calls, on the same input, so the two\n *   cannot disagree about what the configuration means.\n *\n * ## The per-request nonce, and where it stops\n *\n * `buildSecurityHeaders` accepts a per-request `nonce` and substitutes it into\n * `script-src`. A nonce cannot survive a build-time literal — it is minted per\n * response — so a target reaches one only if it renders the HTML at request\n * time and can put the same value on the script tags it emits.\n *\n * Exactly one deploy path does: **Cloudflare with `ssrStreaming: true`**, whose\n * worker calls `renderStreamingWeb(request, { nonce })`, and that renderer\n * threads the value into `renderToReadableStream` and into the hydration script\n * (`router/entry-server.ts`). That branch mints a nonce per request and builds\n * its CSP from it. Everything else serves HTML written at build time, or no\n * HTML at all, and carries a **nonce-less CSP** — the same answer\n * `buildSecurityHeaders` already gives a prerendered route (EC-4), for the same\n * reason: a nonce in the header with no nonce on the tag blocks every inline\n * script.\n *\n * That asymmetry is real and is not smoothed over. It is stated in the emitted\n * entry, printed by the build through\n * {@link describeDeployedSecurityHeaders}, and written down in\n * `docs/surfaces/build-adapters.md`.\n */\nimport { generateNonce } from '../core/contracts/nonce.js'\nimport type { SecurityHeadersConfig } from '../core/contracts/security-headers.js'\nimport { buildSecurityHeaders } from '../core/contracts/security-headers.js'\n\n/**\n * Re-exported so a generated entry has ONE import for the whole concern.\n *\n * Reaching it through `theokit/server/security` would work and would also drag\n * that barrel's CSRF surface into a Worker bundle, for a function that is forty\n * lines of string concatenation. It is defined in `core/contracts/`, which is\n * the module every target may import from — `adapters → server` is not an edge\n * in the DAG, and the header policy was never server code.\n */\nexport { buildSecurityHeaders }\n\n/**\n * Re-exported for the same reason, and so the streamed Cloudflare worker mints\n * its nonce with the identical primitive `theokit start` uses\n * (`cli/commands/start/request-handler.ts`) rather than a second, hand-rolled\n * one. It is already runtime-portable: Web Crypto first, with a named error\n * when the runtime has none.\n */\nexport { generateNonce }\n\n/**\n * The `security.headers` block, as a literal a generated entry can carry.\n *\n * `{}` when the app declares none — which is not the same as \"no headers\".\n * `buildSecurityHeaders({})` returns the full default baseline, and `{}` is\n * exactly what `theokit start` passes when `security.headers` is absent\n * (`cli/commands/start/index.ts`). An app with no security block gets the same\n * baseline deployed as it gets locally.\n */\n/**\n * The two declarations every deploy entry emits to carry the security baseline.\n *\n * Four adapters wrote these same two lines — `netlify`, `vercel`, `aws-lambda`, `deno-deploy` —\n * each under a comment naming its own host's static-asset boundary. The COMMENT differs and is\n * meant to; the declarations do not.\n *\n * Extracted after SonarCloud's duplication gate failed a PR at 4.0% against a 3% ceiling and named\n * this as the largest repeated block among the changed files. The gate was measuring something\n * real: a literal renderer and a builder call, copied four times, is four places to update when\n * either changes.\n *\n * Returns the lines rather than a joined string, because every caller splices them into an array\n * of emitted lines.\n */\nexport function securityHeadersDeclarations(config: SecurityHeadersConfig | undefined): string[] {\n  return [\n    `const SECURITY_HEADERS_CONFIG = ${renderSecurityHeadersConfigLiteral(config)}`,\n    `const SECURITY_HEADERS = buildSecurityHeaders(SECURITY_HEADERS_CONFIG, { production: true })`,\n  ]\n}\n\nexport function renderSecurityHeadersConfigLiteral(\n  headers: SecurityHeadersConfig | undefined,\n): string {\n  return JSON.stringify(headers ?? {})\n}\n\n/**\n * Put the headers on a response, without overruling the handler.\n *\n * `theokit start` sets the baseline BEFORE the route handler runs, so a handler\n * can override it with `res.setHeader` (last write wins, Node convention). On a\n * Web target the response arrives already built, so the equivalent of \"the\n * handler wins\" is to skip a header the response already carries: a route that\n * set its own `Content-Security-Policy` keeps it.\n *\n * Mutates and returns the same `Response` rather than constructing a\n * replacement, because these responses are handed to the runtime while their\n * body is still being written (#382) and re-wrapping the stream is exactly the\n * second buffering point that change removed.\n *\n * Mutation is safe for every response these entries produce: the Fetch spec\n * gives a locally constructed `Response` the `response` header guard, which\n * permits `set` for every name used here. The `immutable` guard belongs to\n * responses that came back from `fetch()`, and none of the six emitted handlers\n * returns one — each builds its response from `createWebShim`, from a `new\n * Response(...)`, or from the SSR renderer. The WebSocket upgrade, which is the\n * one response an adapter gets from its runtime rather than building, is\n * deliberately not routed through here.\n */\nexport function withSecurityHeaders(response: Response, headers: Record<string, string>): Response {\n  for (const [key, value] of Object.entries(headers)) {\n    if (!response.headers.has(key)) response.headers.set(key, value)\n  }\n  return response\n}\n\nexport interface DeployedSecurityHeaderLimits {\n  target: string\n  /** The app's `security.headers` block, or undefined when it declares none. */\n  securityHeaders: SecurityHeadersConfig | undefined\n  /**\n   * Does the emitted handler render HTML at request time and mint a CSP nonce\n   * for it? True only for Cloudflare with `ssrStreaming: true`.\n   */\n  mintsNonce: boolean\n  /**\n   * Is the HTML document served by a platform static host rather than by the\n   * handler this build emits? True wherever the emitted handler answers\n   * `/api/*` and returns 404 for everything else.\n   */\n  /**\n   * Who puts the security headers on the HTML DOCUMENT — a different question from who serves it,\n   * and the two used to be collapsed into one boolean (usetheokit/theokit#412).\n   *\n   * - `handler` — this target's own handler returns the document, so it carries the same baseline\n   *   every API response carries. No caveat.\n   * - `platform-configured` — the platform's static host serves the document, AND this build emits\n   *   the configuration that puts the headers on it (`.vercel/output/config.json`, `netlify.toml`).\n   *   Still worth stating, because nothing here has seen a deployed response.\n   * - `platform-unmanaged` — the platform serves it and this build owns no artifact that could\n   *   configure it. This is the real remaining gap, and it stays named.\n   *\n   * The two-value version reported `platform-configured` targets with the same message as\n   * `platform-unmanaged` ones, telling an operator to go and do work the build had already done —\n   * and a stale limitation reads exactly like a current one.\n   */\n  documentHeaders: 'handler' | 'platform-configured' | 'platform-unmanaged'\n}\n\n/**\n * What the build tells the operator, once, per target.\n *\n * Silent degradation is the failure mode `rules/three-target-parity.md` exists\n * to prevent. Two things degrade quietly here and both are named rather than\n * discovered in production: a CSP that refuses inline scripts on a deploy while\n * allowing them locally, and an HTML document that never passes through the\n * handler these headers are attached to.\n *\n * The header names are read from the map the entry will actually carry, not\n * from a list written next to it. A configuration that switches HSTS or the CSP\n * off would otherwise be announced as sending them.\n */\nexport function describeDeployedSecurityHeaders(limits: DeployedSecurityHeaderLimits): string {\n  const headers = buildSecurityHeaders(limits.securityHeaders ?? {}, { production: true })\n  const names = Object.keys(headers)\n  if (names.length === 0) {\n    return `  ! \\`${limits.target}\\` sends no security headers: the configuration switched every one of them off.`\n  }\n\n  const lines = [\n    `  ✓ security headers on every response \\`${limits.target}\\` returns: ${names.join(', ')}.`,\n  ]\n  const sendsCsp = names.some((name) => name.startsWith('Content-Security-Policy'))\n  if (sendsCsp && !limits.mintsNonce) {\n    lines.push(\n      `    - The CSP carries no nonce: this target serves HTML written at build time,`,\n      `      so there is no per-request value to put on a script tag. An inline`,\n      `      <script> is refused by \\`script-src 'self'\\` here, while the same page`,\n      `      under \\`theokit start\\` gets a nonce and runs it. Move inline scripts to`,\n      `      \\`<script src=\"...\">\\`, or set \\`security.headers.cspMode: 'report-only'\\``,\n      `      while you migrate.`,\n    )\n  }\n  if (limits.documentHeaders === 'platform-configured') {\n    lines.push(\n      `    - The HTML document is served by the platform's static host, and reaches`,\n      `      the browser with these headers through config this build emits. That`,\n      `      path is not verified by a deploy from here — the values come from the`,\n      `      same function the handler uses, but no response has been read back.`,\n    )\n  }\n  if (limits.documentHeaders === 'platform-unmanaged') {\n    lines.push(\n      `    - The HTML document does NOT pass through this handler — the platform's`,\n      `      static host serves it — so these headers reach \\`/api/*\\` responses and`,\n      `      not the page. This build emits no artifact that could configure it, so`,\n      `      set the document's headers on the platform (usetheokit/theokit#412).`,\n    )\n  }\n  return lines.join('\\n')\n}\n","/**\n * The rate limit a deployed entry carries, baked at build time.\n *\n * ## What #508 asked for, and what this answers\n *\n * `theokit build` refuses the six Web-standards targets when `theo.config.ts` declares a\n * `rateLimit` (`UnenforceableRateLimitError`). That refusal is honest and it is not enforcement.\n * The issue names three things standing between the refusal and a working limit: per-runtime\n * caller-address resolution, a refusal that survives where the address cannot be resolved, and\n * storage that outlives one invocation.\n *\n * For `bun` all three already have answers, which is why it is the target that moves first:\n *\n * - **Address** — `Bun.serve`'s handler is `fetch(request, server)`, and `server.requestIP(request)`\n *   returns the peer address without depending on a proxy header a client could set.\n * - **Storage** — `Bun.serve` is a long-lived process. `createRateLimiterWeb`'s default\n *   `InMemoryStore` therefore behaves exactly as it does under `theokit start`, which is the\n *   deployment `node` already ships.\n * - **Refusal** — see below: every shape whose key cannot be resolved in a deployed entry throws\n *   at BUILD time rather than degrading.\n *\n * ## Why the other five are not here\n *\n * Cloudflare, AWS Lambda, Netlify and Vercel are per-invocation runtimes: an in-process counter\n * does not survive between requests, so a limiter built on one forgets. A limit that forgets is a\n * limit that does not limit — the same class of failure as the shared bucket, reached by a\n * different road. Deno Deploy evicts isolates for the same reason. Those need an external counter,\n * which is a storage design and not a wiring change, so they keep refusing by name.\n *\n * Being explicit about that boundary is the point. The failure this whole area exists to prevent is\n * a config that reads as protection while protecting nothing.\n */\nimport type { TheoConfig } from '../config/schema.js'\n\ntype RateLimitConfig = NonNullable<TheoConfig['rateLimit']>\n\n/** The rate-limit slice of an adapter's build options, named once like `DeployedCorsOptions`. */\nexport interface DeployedRateLimitOptions {\n  rateLimit?: RateLimitConfig\n}\n\n/**\n * Thrown at BUILD time when a declared rate limit cannot be carried into a deployed entry.\n *\n * Distinct from {@link UnenforceableRateLimitError}, and the distinction is not cosmetic: that one\n * means *this target enforces no limit at all*, this one means *this target enforces limits, and\n * cannot carry THIS one*. An operator reading the first looks for another target; an operator\n * reading the second changes the key.\n */\nexport class UnserialisableRateLimitError extends Error {\n  override readonly name = 'UnserialisableRateLimitError'\n  constructor(\n    readonly target: string,\n    readonly reason: string,\n    ways: readonly string[],\n  ) {\n    super(\n      [\n        `Refusing to build for \\`${target}\\`: theo.config.ts declares a rate limit this target cannot carry.`,\n        ``,\n        `  ${reason}`,\n        ``,\n        `  Ways forward:`,\n        ...ways.map((w) => `    • ${w}`),\n        ``,\n        `  This refuses rather than dropping the key, because a rate limit that silently does not`,\n        `  apply looks exactly like one that does (usetheokit/theokit#461, #508).`,\n      ].join('\\n'),\n    )\n  }\n}\n\n/** The base shape every accepted config narrows to: a window, a ceiling, and an IP key. */\ninterface BakeableRateLimit {\n  windowMs: number\n  max: number\n  /**\n   * How many proxies sit in front of the app, for the forwarded-header path. Dropped before the\n   * entry until B-027: the schema declares it (`config/schemas/rate-limit.ts:36`) and the generated\n   * code could not honour it, so a deployment behind a proxy keyed every visitor on the proxy.\n   */\n  trustProxy: boolean | number\n}\n\n/**\n * Narrow a declared rate limit to what a deployed entry can actually enforce, or refuse by name.\n *\n * Accepts the base `{ windowMs, max }` and the explicit `keyBy: 'ip'`, which is what the address\n * resolution below can key. Everything else throws:\n *\n * - a **function** `keyBy` has no literal — the same wall `deployed-cors.ts` hits on a callback\n *   origin, and refused for the same reason;\n * - `keyBy: 'session' | 'user'` needs a session the deployed entry does not resolve at the point\n *   the limit runs, which is before routing;\n * - `routes` needs the matched route, decided after this check. Refusing it is honest today and is\n *   the natural next slice.\n */\nfunction bakeableRateLimit(\n  rateLimit: RateLimitConfig | undefined,\n  target: string,\n): BakeableRateLimit | undefined {\n  if (rateLimit === undefined) return undefined\n  const cfg = rateLimit as Record<string, unknown>\n\n  if (typeof cfg.keyBy === 'function') {\n    throw new UnserialisableRateLimitError(\n      target,\n      '`security.rateLimit.keyBy` is a function, and a deployed entry has no literal for a closure.',\n      [\n        \"use `keyBy: 'ip'` (the default), which this target resolves from the connection\",\n        'build for `node` and run `theokit start`, which can call the function',\n      ],\n    )\n  }\n  if (cfg.keyBy === 'session' || cfg.keyBy === 'user') {\n    throw new UnserialisableRateLimitError(\n      target,\n      `\\`security.rateLimit.keyBy: '${cfg.keyBy}'\\` needs a resolved session, and the limit runs before routing.`,\n      [\n        \"use `keyBy: 'ip'`, which is resolvable at that point\",\n        'build for `node` and run `theokit start`',\n      ],\n    )\n  }\n  if (cfg.routes !== undefined) {\n    throw new UnserialisableRateLimitError(\n      target,\n      '`security.rateLimit.routes` needs the matched route, which is decided after the limit runs here.',\n      [\n        'declare a single global limit (`windowMs` + `max`)',\n        'build for `node` and run `theokit start`, which applies per-route limits',\n      ],\n    )\n  }\n\n  const windowMs = cfg.windowMs\n  const max = cfg.max\n  if (typeof windowMs !== 'number' || typeof max !== 'number') return undefined\n  // `?? false` and not `|| false`: `trustProxy: 0` is a number and falsy, and it means the same to\n  // the resolver as `false` — but emitting `false` where the operator wrote `0` makes the generated\n  // entry disagree with the config a reader compares it against.\n  const trustProxy = cfg.trustProxy\n  return {\n    windowMs,\n    max,\n    trustProxy:\n      typeof trustProxy === 'boolean' || typeof trustProxy === 'number' ? trustProxy : false,\n  }\n}\n\n/**\n * The generated declarations and helper for a target that keys on the connection's peer address.\n *\n * `addressExpression` is the per-runtime half the issue calls out — the one thing that genuinely\n * differs between targets. Bun passes `server`; a future Deno slice would pass its\n * `ServeHandlerInfo`. Everything else here is shared.\n *\n * Returns `[]` when nothing was declared, so an app without a limit emits no limiter at all rather\n * than an inert one.\n */\nexport function deployedRateLimitFragment(\n  rateLimit: RateLimitConfig | undefined,\n  target: string,\n  addressExpression: string,\n  /**\n   * The parameter list `callerAddress` is DECLARED with, because the runtime source differs per\n   * target and only `bun` binds these two names (`bun.ts:158`). `cloudflare.ts:452` binds\n   * `(request, env, ctx)`, `vercel.ts:39` `(nodeReq, nodeRes)`, `netlify.ts:84` `(request, context)`,\n   * `deno-deploy.ts:90` `(request)` and `aws-lambda.ts:152` `(event)`. An expression naming\n   * `context`, `info`, `event` or `nodeReq` inside a function declared `(request, server)` is an\n   * unbound identifier, and the entry throws on the first limited request.\n   */\n  params = 'request, server',\n): string[] {\n  const baked = bakeableRateLimit(rateLimit, target)\n  if (baked === undefined) return []\n  return [\n    `// #508 — the limit the app declared, carried as a literal because a deployed entry has no`,\n    `// theo.config.ts to read.`,\n    `//`,\n    `// WHERE THIS COUNTER LIVES, and it is not the same answer per target. On a long-lived server`,\n    `// (\\`bun\\`) the process outlives a request and the count holds. On a per-invocation or`,\n    `// per-isolate runtime — Cloudflare, AWS Lambda, Netlify, Vercel, Deno Deploy — it does not:`,\n    `// the limit is PER INSTANCE, and a caller spread across instances gets that many budgets.`,\n    `// The address is resolved correctly either way; the counting is what B-257 is about, and`,\n    `// \\`theokit build\\` refuses a declared limit on those five until it is.`,\n    `const RATE_LIMIT = createRateLimiterWeb({ windowMs: ${baked.windowMs}, max: ${baked.max} })`,\n    ``,\n    `// How many proxies the deployment declared in front of it. \\`client-ip.ts\\` reads a forwarded`,\n    `// header only when this says one wrote it: the header is whatever the client typed, so`,\n    `// trusting it unasked lets anyone rotate a forged value past the limiter with one \\`curl -H\\`.`,\n    `const TRUST_PROXY = ${JSON.stringify(baked.trustProxy)}`,\n    ``,\n    `/**`,\n    ` * The caller's address, from the connection rather than from a header.`,\n    ` *`,\n    ` * A header a client can set is a key a client can choose, which makes the bucket theirs to`,\n    ` * split. An address this runtime cannot resolve returns \\`undefined\\`, and the caller answers`,\n    ` * 503 rather than keying on a constant: one shared bucket is a budget the first caller each`,\n    ` * window exhausts for everyone, which is worse than no limiting at all.`,\n    ` */`,\n    `const addr = (v) => (typeof v === 'string' && v.trim() !== '' ? v.trim() : undefined)`,\n    `function callerAddress(${params}) {`,\n    `  return addr(${addressExpression})`,\n    `}`,\n    ``,\n    `/** The 503 a caller this runtime cannot name gets, instead of everyone's shared bucket. */`,\n    `function unnamedCaller() {`,\n    `  return new Response(`,\n    `    JSON.stringify({ error: { code: 'CALLER_UNRESOLVED', message: ${JSON.stringify(\n      `${target} could not resolve the caller's address, and a rate limit keyed on a constant is a denial of service`,\n    )} } }),`,\n    `    { status: 503, headers: { 'Content-Type': 'application/json' } },`,\n    `  )`,\n    `}`,\n    ``,\n    `/** The 429 a limited caller gets, carrying the limiter's own headers. */`,\n    `function rateLimited(result) {`,\n    `  return new Response(JSON.stringify({ error: { code: 'RATE_LIMITED', message: 'Too many requests' } }), {`,\n    `    status: 429,`,\n    `    headers: { 'Content-Type': 'application/json', ...result.headers },`,\n    `  })`,\n    `}`,\n  ]\n}\n\n/**\n * The check itself, as generated source, placed inside the runtime's request handler.\n *\n * Extracted for the reason `bun.ts` extracts its other fragments: the emitter is one array literal,\n * so every line the entry gains counts against `max-lines-per-function`, and this one pushed it\n * past the ceiling.\n *\n * Runs AFTER the CORS preflight and BEFORE routing: a limited caller should not reach a handler,\n * and a browser still needs its CORS answer to read the 429 as a 429 rather than as a network\n * failure.\n */\nexport function rateLimitCheckFragment(\n  rateLimit: RateLimitConfig | undefined,\n  indent: string,\n  /** The arguments `callerAddress` is CALLED with — see `deployedRateLimitFragment`'s `params`. */\n  args = 'request, server',\n  /** How this target answers a caller over its budget. Only `bun` can use the default. */\n  refuse = 'return withCors(request, withSecurityHeaders(rateLimited(limit), SECURITY_HEADERS))',\n  /** How it answers a caller it could not name. Same shape, different body. */\n  refuseUnnamed = 'return withCors(request, withSecurityHeaders(unnamedCaller(), SECURITY_HEADERS))',\n): string[] {\n  if (rateLimit === undefined) return []\n  return [\n    `${indent}const caller = callerAddress(${args})`,\n    `${indent}if (caller === undefined) {`,\n    `${indent}  ${refuseUnnamed}`,\n    `${indent}}`,\n    `${indent}const limit = RATE_LIMIT(caller)`,\n    `${indent}if (limit.limited) {`,\n    `${indent}  ${refuse}`,\n    `${indent}}`,\n  ]\n}\n","/**\n * The configuration a deployed entry could not apply (usetheokit/theokit#425).\n *\n * ## Why this is not another literal renderer\n *\n * `deployed-csrf.ts` and `deployed-cors.ts` bake their values into the emitted source, which works\n * because `csrf` is an enum and `disallowed` is a `{ routes, behavior }` object — plain data, and a\n * deployed function has no `theo.config.ts` to read.\n *\n * The two concerns left over from #410 turn out to be different from each other, and the difference\n * is the whole design:\n *\n * - **`serialization` is plain data too.** The config field is `z.enum(['json', 'superjson'])`\n *   (`config/schema.ts:147`) — a selector, not a transformer. `resolveTransformer` turns it into the\n *   functions, and it already ships from `theokit/server`. So this half is a literal like the rest,\n *   and the deployed entry resolves it exactly the way `theokit start` does\n *   (`cli/commands/start/index.ts:108`), from the same string, through the same function.\n * - **`plugins` genuinely carries functions.** A plugin is constructed in `theo.config.ts` and there\n *   is no literal for a closure, so this half needs the entry to import a module instead.\n *\n * ## Static import, not `import()` in the request path\n *\n * The tempting shortcut is `await import('../../theo.config.js')` inside the handler. It trades a\n * silent failure for a louder one on targets with no filesystem, and it moves configuration\n * resolution into every request on the targets that do have one.\n *\n * What this emits instead is a TOP-LEVEL import of a module the build already resolved and wrote\n * beside the entry — the same shape `renderBakedRoutes` uses for route modules (#369): decide on\n * the build machine, emit a static specifier. It is evaluated once at module load, the target's\n * bundler can see through it, and a plugin that needs an API the target lacks fails the build\n * rather than the first request.\n *\n * ## Why each half is optional\n *\n * An app that declares neither concern must produce the entry it produced before this existed.\n * Importing a module the build did not emit fails at load, and spreading an empty object costs an\n * allocation per request for nothing. So an empty request renders to nothing at all, and the\n * caller's `executeRoute` literal is unchanged.\n *\n * The halves are independent on purpose: an app that only picks `superjson` must not be made to\n * carry a plugins module, and an app with plugins and default JSON must not gain a transformer\n * lookup. Coupling them would have made the common case pay for the rare one.\n */\n\n/**\n * The option every Web-standards adapter grows to carry non-serialisable configuration.\n *\n * Composed into each adapter's option type the way `DeployedCsrfOptions` already is, so the six\n * targets cannot drift into six spellings of the same field.\n */\n/**\n * The project's `serverDir`, carried into every generated entrypoint (#RFC server-layout).\n *\n * Separate from the other option groups because it is not a runtime feature toggle: it is the\n * project's own layout, and an adapter that hardcodes `'server'` agrees with the default by\n * COINCIDENCE. The moment a project sets the option — the entire point of it existing — the\n * generated entrypoint resolves a directory that is not there, and only after deploy: the build\n * succeeds, the bundle is written, and routes 404 in production with nothing naming the cause.\n */\nexport interface DeployedServerDirOptions {\n  /** Project-relative server directory. Absent ⇒ the schema default, `server`. */\n  serverDir?: string\n}\n\n/**\n * The server directory as a quoted TypeScript literal, ready to interpolate into generated source.\n *\n * `JSON.stringify` rather than wrapping in quotes by hand: the value reaches this from user config,\n * so a directory containing a quote or a backslash would otherwise emit a syntax error into\n * somebody else's build — a worse failure than the one this fixes.\n */\nexport function serverDirLiteral(opts: DeployedServerDirOptions): string {\n  return JSON.stringify(opts.serverDir ?? 'server')\n}\n\n/**\n * The agents directory, same shape and same reason as `serverDir` above.\n *\n * `scanAgents(projectRoot, agentsDirName = 'agents')` takes the name as its SECOND parameter\n * (`server/scan/agent-scan.ts:56`). Nine call sites pass the configured value; the generated\n * deploy entry was the only one that did not, so the default won and a project whose agents live\n * under the documented `core/agents` (`config/schema.ts:66`) served none of them — 404 per agent,\n * after deploy, with nothing naming the cause. Measured 2026-09-21 by executing `buildBun`\n * against a config carrying both directories and reading what it emitted.\n */\nexport interface DeployedAgentsDirOptions {\n  /** Project-relative agents directory. Absent ⇒ the schema default, `agents`. */\n  agentsDir?: string\n}\n\nexport function agentsDirLiteral(opts: DeployedAgentsDirOptions): string {\n  return JSON.stringify(opts.agentsDir ?? 'agents')\n}\n\nexport interface DeployedRuntimeConfigOptions {\n  /**\n   * Specifier of the plugins module the build wrote beside the entry, or `undefined` when the app\n   * declares no plugins and the build wrote none.\n   */\n  runtimeConfigModule?: string\n  /**\n   * The app's `serialization` selector, carried as a literal.\n   *\n   * `'json'` and `undefined` both mean the default, and neither emits anything: `executeRoute`\n   * already falls back to `JSON.stringify`, and the `x-theo-transformer` header is deliberately\n   * absent for the default so a client is told only when there is something to be told.\n   */\n  serialization?: 'json' | 'superjson'\n}\n\n/** The three places an entry has to grow to carry non-serialisable configuration. */\nexport interface DeployedRuntimeConfigFragment {\n  /** Top-level imports. Empty when the build emitted no config module. */\n  readonly imports: string[]\n  /** Module-scope declarations — evaluated once, at load. Empty when there is nothing to carry. */\n  readonly declarations: string[]\n  /**\n   * Spread into the entry's `executeRoute({ … })` literal, inside an async function.\n   *\n   * Empty string when there is nothing to carry, so the call site keeps the exact shape it had.\n   */\n  readonly executeRouteSpread: string\n}\n\nconst EMPTY: DeployedRuntimeConfigFragment = {\n  imports: [],\n  declarations: [],\n  executeRouteSpread: '',\n}\n\n/**\n * What a deployed entry needs in order to apply `config.plugins` and `config.serialization`.\n *\n * @param moduleSpecifier - specifier of the runtime-config module the build emitted beside the\n *   entry, or `undefined` when the app declared neither concern and the build emitted none.\n */\nexport function deployedRuntimeConfigFragment(\n  options: DeployedRuntimeConfigOptions | undefined,\n): DeployedRuntimeConfigFragment {\n  const pluginsModule = options?.runtimeConfigModule\n  // 'json' is the default and emits nothing — see `serialization` above.\n  const serialization = options?.serialization === 'superjson' ? 'superjson' : undefined\n  if (pluginsModule === undefined && serialization === undefined) return EMPTY\n\n  const imports: string[] = []\n  const declarations: string[] = []\n  const spread: string[] = []\n\n  if (pluginsModule !== undefined) {\n    imports.push(\n      `import { createPluginRunnerFromConfig } from 'theokit/server'`,\n      `// #425 — the app's own plugins, resolved on the build machine and written beside this entry.`,\n      `// A closure has no literal, so this is an import rather than a baked value.`,\n      `import theoRuntimeConfig from '${pluginsModule}'`,\n    )\n    declarations.push(\n      `// Built ONCE, at module load. A runner rebuilt per request would re-run every plugin's`,\n      `// \\`register\\`, which is where a plugin allocates the state its hooks then read.`,\n      `const THEO_PLUGIN_RUNNER = createPluginRunnerFromConfig(theoRuntimeConfig.plugins)`,\n    )\n    // Awaited, not passed along: `createPluginRunnerFromConfig` is async because `register` is, and\n    // a pending promise handed to `executeRoute` is a truthy object with none of the runner's\n    // methods — every hook would silently not fire, which is this issue's own defect one layer in.\n    spread.push(`pluginRunner: await THEO_PLUGIN_RUNNER`)\n  }\n\n  if (serialization !== undefined) {\n    imports.push(`import { resolveTransformer } from 'theokit/server'`)\n    declarations.push(\n      `// #425 — a literal, because \\`config.serialization\\` is a SELECTOR and not a transformer.`,\n      `// Same string, same function \\`theokit start\\` calls, so the deployed response and the local`,\n      `// one cannot disagree about what the app asked for — including the \\`x-theo-transformer\\``,\n      `// header, whose absence is what made this a data bug rather than a formatting one.`,\n      `const THEO_TRANSFORMER = resolveTransformer('${serialization}')`,\n    )\n    spread.push(`transformer: THEO_TRANSFORMER`)\n  }\n\n  return { imports, declarations, executeRouteSpread: `${spread.join(', ')},` }\n}\n","/**\n * The request id a deployed entry uses, and the header it echoes back.\n *\n * ## The defect this closes\n *\n * Every generated entry minted a fresh `randomUUID()` per request and set no correlation header\n * at all on a success path (usetheokit/theokit#410). Both Node paths do the opposite: they resolve\n * an incoming `traceparent` / `x-request-id` through `extractTraceId` and echo the result under\n * both `x-request-id` and `x-trace-id` (`cli/commands/start/request-handler.ts`,\n * `vite-plugin/api-middleware.ts`).\n *\n * The consequence is that a trace crossing into a deployed function starts over. The caller's id\n * is discarded, and the response carries nothing to correlate against — so a request that fails in\n * production cannot be tied to the client that made it, which is the one situation the id exists\n * for.\n *\n * ## Why `setHeader` before the handler, rather than wrapping the response\n *\n * It is what the Node path does, and the shim reproduces Node's semantics exactly: `writeHead`\n * MERGES into the header map rather than replacing it (`web-shim.ts`), so a header set here\n * survives the handler's own `writeHead` and a handler that sets its own id still wins. Wrapping\n * the finished `Response` instead would have to mutate a response whose body is already streaming\n * (#382), and would miss the branches that return before the shim is built.\n */\n\n/**\n * Lines that resolve the request id and echo it, as generated source.\n *\n * @param requestVar - the name the entry gave the Web `Request` in scope\n * @param indent - leading whitespace, so the emitted file stays readable\n */\nexport function deployedTraceFragment(requestVar: string, indent: string): string[] {\n  return [\n    `${indent}// #410 — honour the caller's trace id instead of minting a new one, and echo it.`,\n    `${indent}// \\`extractTraceIdFromRequest\\` validates the caller-controlled \\`x-request-id\\``,\n    `${indent}// before trusting it, and falls back to a fresh UUID when neither header is present.`,\n    `${indent}const requestId = extractTraceIdFromRequest(${requestVar})`,\n    `${indent}res.setHeader('x-request-id', requestId)`,\n    `${indent}res.setHeader(TRACE_HEADER, requestId)`,\n  ]\n}\n"],"mappings":";;;;;;;AAgEA,IAAM,QAAgC,EAAE,SAAS,CAAC,GAAG,cAAc,CAAC,GAAG,QAAQ,CAAC,GAAG,YAAY,GAAG;AAqGlG,IAAM,kBAAkB;AAAA,EACtB;AAAA,EACA;AACF;AAGA,IAAM,eAAe;AAYrB,IAAM,oBAAoB;AAuBnB,SAAS,uBAAuBA,mBAAiD;AACtF,SAAO;AAAA,IACL,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAAA;AAAA,IACA,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,cAAc;AAAA,EAChB;AACF;AAQO,IAAM,0BAA0B;AAEhC,SAAS,uBACd,QACA,OAA2B,CAAC,GACJ;AACxB,MAAI,WAAW,OAAW,QAAO;AACjC,MAAI,OAAO,SAAS,WAAW,OAAO,OAAO,WAAW,EAAG,QAAO;AAElE,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,SAAS,KAAK,gBAAgB;AAEpC,QAAM,aACJ,OAAO,SAAS,UACZ,gBAAgB,OAAO,QAAQ,OAAO,eAAe,KAAK,gBAAgB,IAC1E,kBAAkB,EAAE,GAAG,QAAQ,kBAAkB,KAAK,iBAAiB,CAAC;AAE9E,SAAO;AAAA,IACL,YAAY,8BAA8B,QAAQ;AAAA,IAClD,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMP,iFAAiF,WAAW,cAAc,GAAG,OAAO,SAAS,SAAS,iBAAiB,EAAE,YAAY,MAAM;AAAA,MAC3K,GAAG,WAAW;AAAA,IAChB;AAAA,IACA,cAAc;AAAA,MACZ,GAAG,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAed,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAeP;AAAA,MACA,GAAG,WAAW;AAAA,MACd;AAAA,MACA;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS,QAAQ,eAAe,KAAK,UAAU,YAAY,CAAC;AAAA,MAC5D,SAAS,QAAQ,eAAe,KAAK,UAAU,iBAAiB,CAAC;AAAA,MACjE;AAAA,MACA,GAAG,WAAW;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,mEAAmE,QAAQ;AAAA,MAC3E;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK,wBAAwB,OACzB,sEACA;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc,QAAQ,eAAe,KAAK,UAAU,YAAY,CAAC,aAAa,QAAQ;AAAA,MACtF,2BAA2B,QAAQ,UAAU,OAAO,aAAa,MAAM,CAAC;AAAA,MACxE,GAAG,WAAW;AAAA,MACd;AAAA,MACA;AAAA,MACA,uCAAuC,QAAQ;AAAA,MAC/C;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK,wBAAwB,OACzB,sEACA;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACF;AAoCA,SAAS,gBACP,QACA,eACA,kBACiB;AACjB,QAAM,QAAQ,CAAC,UAA0B,cAAc,OAAO,KAAK,CAAC;AACpE,SAAO;AAAA,IACL,SAAS;AAAA,MACP,GAAG,OAAO,IAAI,CAAC,OAAO,UAAU,eAAe,MAAM,KAAK,CAAC,gBAAgB,MAAM,QAAQ,GAAG;AAAA;AAAA,MAE5F,GAAI,kBAAkB,SAClB,CAAC,IACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAgBE,6CAA6C,aAAa;AAAA,MAC5D;AAAA,IACN;AAAA,IACA,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAG,OAAO,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,UAAU,MAAM,IAAI,CAAC,KAAK,MAAM,KAAK,CAAC,GAAG;AAAA,MACnF;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAG,OAAO;AAAA,QACR,CAAC,UACC,iBAAiB,KAAK,UAAU,MAAM,QAAQ,CAAC,gBAAgB,KAAK,UAAU,MAAM,SAAS,CAAC,WAAW,KAAK,UAAU,MAAM,IAAI,CAAC;AAAA,MACvI;AAAA,MACA;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,gBAAgB,kBAAkB,SAAY,KAAK;AAAA,IACnD,UACE,kBAAkB,SACd;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MASA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,oBAAoB,WAAW;AAAA,MACtC;AAAA,IACF;AAAA,IACN,YAAY;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAG;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;AAGA,SAAS,kBAAkB,QAOP;AAGlB,QAAM,eAAe,OAAO,qBAAqB,SAAY,KAAK,KAAK,OAAO,gBAAgB;AAE9F,SAAO;AAAA,IACL,SAAS,CAAC;AAAA,IACV,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN;AAAA,MACA,iEAAiE,OAAO,UAAU;AAAA,IACpF;AAAA,IACA,gBAAgB,OAAO,cAAc,SAAY,KAAK;AAAA,IACtD,UACE,OAAO,cAAc,SACjB,CAAC,0CAA0C,IAC3C;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,mBAAmB,OAAO,UAAU;AAAA,MACpC,kBAAkB,OAAO,SAAS;AAAA,MAClC,qBAAqB,OAAO,oBAAoB,WAAW;AAAA,MAC3D;AAAA,IACF;AAAA,IACN,YAAY;AAAA,MACV,GAAI,OAAO,iBAAiB,SAAY,CAAC,IAAI,CAAC,SAAS,OAAO,YAAY,EAAE;AAAA,MAC5E;AAAA,MACA;AAAA,MACA;AAAA,MACA,oDAAoD,OAAO,WAAW,GAAG,YAAY;AAAA,MACrF;AAAA,MACA;AAAA,MACA,uBAAuB,OAAO,UAAU;AAAA,MACxC;AAAA,MACA,GAAG;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;;;AC3eO,IAAM,gCAAN,cAA4C,MAAM;AAAA,EACvD,YAAY,QAAgB;AAC1B;AAAA,MACE,kDAAkD,MAAM;AAAA,IAI1D;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAGA,SAAS,aAAa,QAAiB,QAAwB;AAC7D,MAAI,OAAO,WAAW,WAAY,OAAM,IAAI,8BAA8B,MAAM;AAChF,MAAI,kBAAkB,OAAQ,QAAO,OAAO,MAAM;AAClD,MAAI,MAAM,QAAQ,MAAM,EAAG,QAAO,IAAI,OAAO,IAAI,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC;AAC3F,SAAO,KAAK,UAAU,MAAM;AAC9B;AAWO,SAAS,0BAA0B,MAA8B,QAAwB;AAC9F,MAAI,SAAS,OAAW,QAAO;AAE/B,QAAM,QAAQ,CAAC,YAAY,aAAa,KAAK,SAAS,MAAM,CAAC,EAAE;AAC/D,MAAI,KAAK,YAAY,OAAW,OAAM,KAAK,YAAY,KAAK,UAAU,KAAK,OAAO,CAAC,EAAE;AACrF,MAAI,KAAK,mBAAmB;AAC1B,UAAM,KAAK,mBAAmB,KAAK,UAAU,KAAK,cAAc,CAAC,EAAE;AACrE,MAAI,KAAK,mBAAmB;AAC1B,UAAM,KAAK,mBAAmB,KAAK,UAAU,KAAK,cAAc,CAAC,EAAE;AAGrE,QAAM;AAAA,IACJ,gBAAgB,KAAK,UAAU,KAAK,WAAW,CAAC;AAAA,IAChD,WAAW,KAAK,UAAU,KAAK,MAAM,CAAC;AAAA,EACxC;AAEA,SAAO,KAAK,MAAM,KAAK,IAAI,CAAC;AAC9B;AAQO,SAAS,qBAAqB,MAA8B,QAA0B;AAC3F,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,uBAAuB,0BAA0B,MAAM,MAAM,CAAC;AAAA,IAC9D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;ACxEA,SAAS,mBAAmB,SAAkC;AAC5D,SAAO,mBAAmB,SAAS,OAAO,OAAO,IAAI,KAAK,UAAU,OAAO;AAC7E;AAWO,SAAS,0BAA0B,UAAmD;AAC3F,MAAI,aAAa,OAAW,QAAO;AAEnC,QAAM,QAAkB,CAAC;AACzB,MAAI,SAAS,SAAS,OAAW,OAAM,KAAK,aAAa,KAAK,UAAU,SAAS,IAAI,CAAC,EAAE;AAExF,QAAM,EAAE,WAAW,IAAI;AACvB,MAAI,eAAe,QAAW;AAC5B,UAAM,SAAS,WAAW,OAAO,IAAI,kBAAkB,EAAE,KAAK,IAAI;AAClE,UAAM;AAAA,MACJ,0BAA0B,MAAM,gBAAgB,KAAK,UAAU,WAAW,QAAQ,CAAC;AAAA,IACrF;AAAA,EACF;AAIA,SAAO,MAAM,WAAW,IAAI,OAAO,KAAK,MAAM,KAAK,IAAI,CAAC;AAC1D;AAcO,SAAS,qBACd,MACA,OAAO,uBACG;AACV,SAAO;AAAA,IACL;AAAA,IACA,wDAAwD,IAAI;AAAA,IAC5D;AAAA,IACA;AAAA,IACA,uBAAuB,0BAA0B,IAAI,CAAC;AAAA,EACxD;AACF;;;ACTO,SAAS,4BAA4B,QAAqD;AAC/F,SAAO;AAAA,IACL,mCAAmC,mCAAmC,MAAM,CAAC;AAAA,IAC7E;AAAA,EACF;AACF;AAEO,SAAS,mCACd,SACQ;AACR,SAAO,KAAK,UAAU,WAAW,CAAC,CAAC;AACrC;AA8EO,SAAS,gCAAgC,QAA8C;AAC5F,QAAM,UAAU,qBAAqB,OAAO,mBAAmB,CAAC,GAAG,EAAE,YAAY,KAAK,CAAC;AACvF,QAAM,QAAQ,OAAO,KAAK,OAAO;AACjC,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO,SAAS,OAAO,MAAM;AAAA,EAC/B;AAEA,QAAM,QAAQ;AAAA,IACZ,iDAA4C,OAAO,MAAM,eAAe,MAAM,KAAK,IAAI,CAAC;AAAA,EAC1F;AACA,QAAM,WAAW,MAAM,KAAK,CAAC,SAAS,KAAK,WAAW,yBAAyB,CAAC;AAChF,MAAI,YAAY,CAAC,OAAO,YAAY;AAClC,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,oBAAoB,uBAAuB;AACpD,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,oBAAoB,sBAAsB;AACnD,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;;;AC3KO,IAAM,+BAAN,cAA2C,MAAM;AAAA,EAEtD,YACW,QACA,QACT,MACA;AACA;AAAA,MACE;AAAA,QACE,2BAA2B,MAAM;AAAA,QACjC;AAAA,QACA,KAAK,MAAM;AAAA,QACX;AAAA,QACA;AAAA,QACA,GAAG,KAAK,IAAI,CAAC,MAAM,cAAS,CAAC,EAAE;AAAA,QAC/B;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI;AAAA,IACb;AAhBS;AACA;AAAA,EAgBX;AAAA,EAjBW;AAAA,EACA;AAAA,EAHO,OAAO;AAoB3B;AA2BA,SAAS,kBACP,WACA,QAC+B;AAC/B,MAAI,cAAc,OAAW,QAAO;AACpC,QAAM,MAAM;AAEZ,MAAI,OAAO,IAAI,UAAU,YAAY;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,UAAU,aAAa,IAAI,UAAU,QAAQ;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,MACA,gCAAgC,IAAI,KAAK;AAAA,MACzC;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,QAAW;AAC5B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAW,IAAI;AACrB,QAAM,MAAM,IAAI;AAChB,MAAI,OAAO,aAAa,YAAY,OAAO,QAAQ,SAAU,QAAO;AAIpE,QAAM,aAAa,IAAI;AACvB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,YACE,OAAO,eAAe,aAAa,OAAO,eAAe,WAAW,aAAa;AAAA,EACrF;AACF;AAYO,SAAS,0BACd,WACA,QACA,mBASA,SAAS,mBACC;AACV,QAAM,QAAQ,kBAAkB,WAAW,MAAM;AACjD,MAAI,UAAU,OAAW,QAAO,CAAC;AACjC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,uDAAuD,MAAM,QAAQ,UAAU,MAAM,GAAG;AAAA,IACxF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,uBAAuB,KAAK,UAAU,MAAM,UAAU,CAAC;AAAA,IACvD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,0BAA0B,MAAM;AAAA,IAChC,iBAAiB,iBAAiB;AAAA,IAClC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,qEAAqE,KAAK;AAAA,MACxE,GAAG,MAAM;AAAA,IACX,CAAC;AAAA,IACD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAaO,SAAS,uBACd,WACA,QAEA,OAAO,mBAEP,SAAS,uFAET,gBAAgB,oFACN;AACV,MAAI,cAAc,OAAW,QAAO,CAAC;AACrC,SAAO;AAAA,IACL,GAAG,MAAM,gCAAgC,IAAI;AAAA,IAC7C,GAAG,MAAM;AAAA,IACT,GAAG,MAAM,KAAK,aAAa;AAAA,IAC3B,GAAG,MAAM;AAAA,IACT,GAAG,MAAM;AAAA,IACT,GAAG,MAAM;AAAA,IACT,GAAG,MAAM,KAAK,MAAM;AAAA,IACpB,GAAG,MAAM;AAAA,EACX;AACF;;;AC3LO,SAAS,iBAAiB,MAAwC;AACvE,SAAO,KAAK,UAAU,KAAK,aAAa,QAAQ;AAClD;AAiBO,SAAS,iBAAiB,MAAwC;AACvE,SAAO,KAAK,UAAU,KAAK,aAAa,QAAQ;AAClD;AAgCA,IAAMC,SAAuC;AAAA,EAC3C,SAAS,CAAC;AAAA,EACV,cAAc,CAAC;AAAA,EACf,oBAAoB;AACtB;AAQO,SAAS,8BACd,SAC+B;AAC/B,QAAM,gBAAgB,SAAS;AAE/B,QAAM,gBAAgB,SAAS,kBAAkB,cAAc,cAAc;AAC7E,MAAI,kBAAkB,UAAa,kBAAkB,OAAW,QAAOA;AAEvE,QAAM,UAAoB,CAAC;AAC3B,QAAM,eAAyB,CAAC;AAChC,QAAM,SAAmB,CAAC;AAE1B,MAAI,kBAAkB,QAAW;AAC/B,YAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA,kCAAkC,aAAa;AAAA,IACjD;AACA,iBAAa;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAIA,WAAO,KAAK,wCAAwC;AAAA,EACtD;AAEA,MAAI,kBAAkB,QAAW;AAC/B,YAAQ,KAAK,qDAAqD;AAClE,iBAAa;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,gDAAgD,aAAa;AAAA,IAC/D;AACA,WAAO,KAAK,+BAA+B;AAAA,EAC7C;AAEA,SAAO,EAAE,SAAS,cAAc,oBAAoB,GAAG,OAAO,KAAK,IAAI,CAAC,IAAI;AAC9E;;;ACpJO,SAAS,sBAAsB,YAAoB,QAA0B;AAClF,SAAO;AAAA,IACL,GAAG,MAAM;AAAA,IACT,GAAG,MAAM;AAAA,IACT,GAAG,MAAM;AAAA,IACT,GAAG,MAAM,+CAA+C,UAAU;AAAA,IAClE,GAAG,MAAM;AAAA,IACT,GAAG,MAAM;AAAA,EACX;AACF;","names":["agentsDirLiteral","EMPTY"]}
+{"version":3,"sources":["../src/adapters/deployed-agents.ts","../src/adapters/deployed-cors.ts","../src/adapters/deployed-csrf.ts","../src/adapters/security-headers.ts","../src/adapters/deployed-rate-limit.ts","../src/adapters/deployed-runtime-config.ts","../src/adapters/deployed-trace.ts"],"sourcesContent":["/**\n * Serving an agent from a generated deploy entry (usetheokit/theokit#367).\n *\n * ## The gap this closes\n *\n * `grep -rc \"agent\" packages/theo/src/adapters/*.ts` used to return nothing across 14 files. The\n * notion did not exist in this layer at all: every generated entry routes `/api/` exclusively\n * through `scanServerRoutes` + `executeRoute`, and an agent is a DIFFERENT scan served by a\n * DIFFERENT function — `scanAgents` + `mountAgent`. So `/api/agents/chat` matched no file route and\n * fell into `notFoundResponse()` on every target.\n *\n * For a framework whose stated reason to exist is \"the agent is a file, delivered by the same\n * pipeline that serves the page\", that is the gap which contradicts the sentence: the agent was\n * delivered by no pipeline at all outside a machine running `theokit start`.\n *\n * ## Why baking, and why `../../`\n *\n * A Worker has no filesystem to scan and no path to `import()`, which is the same reason routes are\n * baked (#369). The agent modules are resolved on the build machine and emitted as static imports,\n * relative to the entry's directory — every target that can do this writes two levels below the\n * project root, so the arithmetic is the one `renderBakedRoutes` already does.\n *\n * ## Which targets can do it\n *\n * Only the ones whose output is BUNDLED from the project: `cloudflare` (wrangler), `bun` and\n * `deno-deploy` resolve the emitted import against the app's own source tree. `vercel`, `netlify`\n * and `aws-lambda` receive a standalone function directory that never sees the app's modules, so\n * an agent cannot travel there by this road at all. Same split as plugins (#425), same cause.\n *\n * ## The table is keyed by NAME\n *\n * The URL carries the name, the access policy is judged under the name, and the run's spans are\n * labelled with it (#406). Keying by file path would make the lookup depend on the server's\n * directory layout — which changes per deploy, and which is exactly the value #406 removed from\n * telemetry for the same reason.\n */\n\n/** One agent, as `scanAgents` reports it. Structural, so the adapters need no `server/` import. */\nexport interface DeployedAgent {\n  /** Path relative to the project root — the specifier the static import uses. */\n  readonly filePath: string\n  /** The URL the agent answers on. */\n  readonly agentPath: string\n  /** The agent's NAME — what the URL carries, the policy is judged under, and spans are labelled. */\n  readonly name: string\n}\n\nexport interface DeployedAgentsFragment {\n  /** Top-level imports of the agent modules. */\n  readonly imports: string[]\n  /** Module-scope declarations — the name→module table. */\n  readonly declarations: string[]\n  /** The request-handler branch, to be emitted before the file-route table is consulted. */\n  readonly branch: string[]\n  /**\n   * SI-020 — the condition a host ANDs into its non-API early-return guard, so an agent card path\n   * is not handed to static assets before this fragment's branch is reached.\n   *\n   * Empty string when the fragment emits nothing, so a host that interpolates it unconditionally\n   * never references a name that was not declared.\n   */\n  readonly hostBypass: string\n}\n\nconst EMPTY: DeployedAgentsFragment = { imports: [], declarations: [], branch: [], hostBypass: '' }\n\n/**\n * How the host entry names the things this branch has to use.\n *\n * The fragment is generated code injected into three entries that do NOT agree on their own\n * vocabulary — Bun reads `pathname`, Cloudflare reads `url.pathname`; Deno calls `notFound()`,\n * Cloudflare calls `notFoundResponse()`; Cloudflare wraps each branch in the security baseline\n * while Bun and Deno wrap once at the caller; Deno resolves npm packages with an `npm:` prefix.\n *\n * Naming those differences is what keeps this ONE fragment. The alternative — three near-identical\n * branches, one per adapter — is the copy that `serveThroughPluginLifecycle` was extracted to undo\n * after it had drifted five ways (#405).\n */\n/**\n * How the target REACHES its agent modules — and the two answers are genuinely different, not a\n * copy waiting to be merged.\n *\n * A Worker has no filesystem: its agents must be resolved on the build machine and emitted as\n * static imports, which is what `renderBakedRoutes` already does for routes there. Bun and Deno DO\n * have a filesystem and already scan their routes at request time; making them bake would couple an\n * agent's existence to a rebuild for no gain. The split mirrors the one routes already have on\n * exactly these targets, which is the argument for keeping it.\n */\nexport type DeployedAgentsSource =\n  | {\n      readonly kind: 'baked'\n      /** Scanned on the build machine, emitted as static imports. */\n      readonly agents: readonly DeployedAgent[]\n      /**\n       * B-185 — the app's `server/context.ts`, as a specifier relative to the emitted entry, or\n       * `undefined` when the app has none. A Worker has no filesystem on which to find it, so it is\n       * baked like the agent modules beside it (ADR 0014). `undefined` is the ordinary case for an\n       * app that declares no context, and emitting an import of a file that is not there would\n       * fail the BUILD rather than the request — which is why `planDeployedPlugins` takes the same\n       * road for plugins.\n       */\n      readonly contextModule?: string\n    }\n  | {\n      readonly kind: 'scan'\n      /** Expression yielding the project root at runtime. */\n      readonly projectRoot: string\n      /** Expression yielding the module loader the entry already builds. */\n      readonly loadModule: string\n      /**\n       * A statement that guarantees `loadModule` is usable, for a host that builds its loader\n       * lazily. Deno's `loaderCache` is created on the route path, which runs AFTER this branch —\n       * so without this the agent branch would call `null`.\n       */\n      readonly ensureLoader?: string\n      /** The configured agents directory as a quoted literal. Absent ⇒ `scanAgents` defaults to `agents`. */\n      readonly agentsDirLiteral?: string\n      /**\n       * B-185 — an expression yielding the app's `server/` directory, which this host already\n       * declares (`bun.ts:95`, `deno-deploy.ts:69`) and already hands to `executeRoute`. A host\n       * with a filesystem locates its own `context.ts`, so it needs no baking (ADR 0014, and the\n       * split `deployed-agents.ts` already argues for routes two docblocks above).\n       */\n      readonly serverDir?: string\n    }\n\nexport interface DeployedAgentsHost {\n  /** Expression yielding the request path inside the handler. Default `url.pathname`. */\n  readonly pathname?: string\n  /** Call producing the 404 response. Default `notFoundResponse()`. */\n  readonly notFound?: string\n  /** Whether THIS branch applies the security baseline, or the caller already does. */\n  readonly wrapSecurityHeaders?: boolean\n  /** Prefix for bare package specifiers. Deno needs `npm:`; the others need nothing. */\n  readonly importPrefix?: string\n  /**\n   * Expression yielding the entry's plugin runner, or `undefined` when the app declared no plugins\n   * and the build emitted no module to bind.\n   *\n   * `deployedRuntimeConfigFragment` already declares `const THEO_PLUGIN_RUNNER` at module scope and\n   * spreads `pluginRunner: await THEO_PLUGIN_RUNNER` into `executeRoute`; an adapter passes that\n   * same expression here rather than building a second runner, because a runner rebuilt per request\n   * re-runs every plugin's `register` -- which is where a plugin allocates the state its hooks read.\n   */\n  readonly pluginRunnerExpr?: string\n}\n\n/**\n * The two `AuxRouteDeps` fields a deployed entry must supply to match what dev already does.\n *\n * Both dev callers pass them — `vite-plugin/agent-middleware.ts:161,164` and\n * `cli/commands/start/handlers.ts:226,229` — and a first draft of this fragment passed neither,\n * on a quotation from `serve-aux-routes.ts:83-85` that names three routes (\"card, approvals,\n * stream\") while the dispatcher serves six. Two reviewers measured the same two consequences:\n *\n * - `csrfMode` unset defaults to `'strict'` (`serve-aux-routes.ts:379`), so an app declaring\n *   `security: { csrf: 'off' }` got `off` on `POST /api/agents/<name>` and `strict` on its `/mcp`\n *   sibling one line away — verbatim the divergence `deployed-csrf.ts`'s own header exists to\n *   record, re-created on a route this slice had just made reachable.\n * - `resolveApiKey` unset makes the thread follow-up answer a permanent 501 on every deploy\n *   target (`serve-aux-routes.ts:359-365`), naming a framework-internal parameter to the caller.\n *\n * Both values are already in scope: `CSRF_CONFIG` is spread into `mountAgent` in the same emitted\n * function, and `resolveProvider` is already on its import line.\n */\nconst AUX_DEPS_PARITY = [\n  `        ...CSRF_CONFIG,`,\n  `        resolveApiKey: (model, plugins) => resolveProvider(model, { plugins }).apiKey,`,\n] as const\n\n/** The prefix the agent convention owns. Matches `handlers.ts`'s own `tryServeAgent`. */\nconst AGENT_PREFIX = '/api/agents/'\n\n/**\n * The second shape the aux dispatcher owns. `matchGetAuxRoute` serves M15's\n * `GET /.well-known/<name>/agent-card.json`, and a guard admitting only {@link AGENT_PREFIX} left\n * five of the dispatcher's six families reachable on a deploy target and excluded the sixth — by\n * the guard, not by a decision, and silently.\n *\n * A prefix rather than the matcher's own `isAgentCardPath`: the guard exists to keep a url nobody\n * answers from paying for anything, and importing the matcher's predicate into every emitted entry\n * would buy a narrower pre-filter at the cost of a module the branch already declines without.\n */\nconst WELL_KNOWN_PREFIX = '/.well-known/'\n\n/**\n * What a deployed entry needs in order to serve the app's agents.\n *\n * @param agents - the agents scanned on the build machine. Empty emits nothing at all.\n */\n/**\n * The scan source every filesystem host with a lazily-created loader shares.\n *\n * Four adapters — `netlify`, `vercel`, `aws-lambda`, `deno-deploy` — emit an entry that resolves\n * `serverDir` itself, caches its loader in `loaderCache`, and creates that cache on first use.\n * They therefore hand this fragment the SAME six fields, and writing them out four times is the\n * copy `serveThroughPluginLifecycle` was extracted to undo after it had drifted five ways (#405).\n *\n * B-235 is what made it four: wiring three more targets duplicated the block three more times, and\n * the duplication gate on new code is what said so — 4.2% against a 3% ceiling. The gate was right\n * and the fix is the one it implies, not a threshold.\n *\n * `bun` is deliberately NOT a caller. It names its loader `loadModule` and creates it eagerly, so\n * it has no `ensureLoader` — a parameter to cover that difference would make this function a\n * switch over its callers, which is the shape that drifts.\n */\nexport function scannedFromLoaderCache(agentsDirLiteral?: string): DeployedAgentsSource {\n  return {\n    kind: 'scan',\n    projectRoot: 'cwd',\n    agentsDirLiteral,\n    loadModule: 'loaderCache',\n    serverDir: 'serverDir',\n    ensureLoader: 'if (!loaderCache) loaderCache = createProductionLoader()',\n  }\n}\n\n/**\n * The JSON 404 `vercel` and `aws-lambda` answer a routing miss with.\n *\n * An expression rather than a call, because the fragment interpolates `notFound` into a `return`\n * and neither host declares a helper for it.\n */\nexport const JSON_NOT_FOUND_RESPONSE = `new Response(JSON.stringify({ error: { code: 'NOT_FOUND' } }), { status: 404, headers: { 'content-type': 'application/json' } })`\n\nexport function deployedAgentsFragment(\n  source: DeployedAgentsSource | undefined,\n  host: DeployedAgentsHost = {},\n): DeployedAgentsFragment {\n  if (source === undefined) return EMPTY\n  if (source.kind === 'baked' && source.agents.length === 0) return EMPTY\n\n  const pathname = host.pathname ?? 'url.pathname'\n  const notFound = host.notFound ?? 'notFoundResponse()'\n  const prefix = host.importPrefix ?? ''\n\n  const resolution =\n    source.kind === 'baked'\n      ? bakedResolution(source.agents, source.contextModule, host.pluginRunnerExpr)\n      : scannedResolution({ ...source, pluginRunnerExpr: host.pluginRunnerExpr })\n\n  return {\n    hostBypass: ` && !__theoIsAgentCardPath(${pathname})`,\n    imports: [\n      // `theokit/adapters/agent-mount`, not `theokit/server`: `mount-agent` is deliberately not on\n      // the app-facing surface (ADR 0041), and a generated entry is not an app. See that module.\n      // B-185 — the identity entry differs by host: a filesystem host LOCATES its own\n      // `context.ts`, a Worker is handed the baked factory (ADR 0014). `createWebShim` is not here\n      // because all three entries already import it at module level.\n      `import { mountAgent, resolveProvider, matchAgentAuxRoute, serveMatchedAuxRoute${resolution.identityImport}${source.kind === 'scan' ? ', scanAgents' : ''} } from '${prefix}theokit/adapters/agent-mount'`,\n      ...resolution.imports,\n    ],\n    declarations: [\n      ...resolution.declarations,\n      // SI-020 — the host's `/api/` guard decides between the API surface and static assets, and it\n      // runs BEFORE this branch. Widening the branch guard alone left the `.well-known` arm as dead\n      // code on all three targets: present in the source, unreachable in the emitted program. The\n      // host consults this predicate, so the card path escapes the asset branch and NOTHING else\n      // under `/.well-known/` does — a blanket prefix bypass would route `/.well-known/security.txt`\n      // away from assets, trading an unreachable card for a broken namespace.\n      //\n      // Same shape as `agent-card-handler.ts`'s own WELL_KNOWN. That is a COPY, not a shared\n      // definition, and saying otherwise was the claim an inventory judge falsified: changing the\n      // handler to serve `/agent.json` left every card test green, because this guard and that\n      // matcher are checked separately and never against each other. The drift that matters here —\n      // this guard narrowing while the matcher still serves the path — is caught by\n      // `a-deployed-worker-reaches-the-agent-card.test.ts`, which drives a real request. The other\n      // direction is not, and is the honest limit of this line.\n      String.raw`const __theoIsAgentCardPath = (p) => /^\\/\\.well-known\\/[^/]+\\/agent-card\\.json$/.test(p)`,\n      // B-185 — one factory, two call sites: the aux branch on a hit, and the run handler below.\n      // Declared rather than inlined twice so the mechanism ADR 0014 decides has a single home.\n      // `async` because the entry's plugin runner is a promise: `createPluginRunnerFromConfig` is\n      // async, so the runtime-config fragment declares `const THEO_PLUGIN_RUNNER = createPluginRunnerFromConfig(...)`\n      // WITHOUT awaiting it, and every consumer awaits at the point of use. `await` is a reserved\n      // word everywhere in an ES module, so a non-async factory carrying that binding does not\n      // merely misbehave -- the entry does not parse, and `tests/unit/adapter-entry-parses.test.ts`\n      // is where that is caught. It went red at HEAD before this line existed, on a first version\n      // of this fix whose own test asserted `toContain('await THEO_PLUGIN_RUNNER')`: the presence\n      // of the token that breaks the parse. That test file's header says why, in its own words --\n      // `toContain` does not care whether the string is a program.\n      //\n      // Laziness is unaffected. The shim was always built eagerly inside this factory; what ADR-1\n      // refuses is paying for a url nobody answers, and neither call site is reached by one.\n      `async function __theoResolveSubject(request) {`,\n      ...resolution.identity,\n      `  return resolveSubject`,\n      `}`,\n    ],\n    branch: [\n      `    // #367 — the agent convention owns this prefix. It is answered BEFORE the file-route`,\n      `    // table because an agent matches no file route: falling through is how a deployed`,\n      `    // \\`/api/agents/<name>\\` used to 404 on every target.`,\n      `    if (`,\n      `      ${pathname}.startsWith(${JSON.stringify(AGENT_PREFIX)}) ||`,\n      `      ${pathname}.startsWith(${JSON.stringify(WELL_KNOWN_PREFIX)})`,\n      `    ) {`,\n      ...resolution.auxPrelude,\n      `      // B-185 — the aux dispatcher is asked FIRST, and declining costs nothing: the matcher`,\n      `      // reads the url and the scanned nodes, never a module (ADR-1). A miss falls through to`,\n      `      // the run handler exactly as before, so this branch owns the sub-paths and nothing more.`,\n      `      const auxRoute = await matchAgentAuxRoute(request.method, ${pathname}, auxDeps)`,\n      `      if (auxRoute !== null) {`,\n      `        // B-185 — identity is resolved only now. Building it costs a web shim and, where the`,\n      `        // app declares one, a call into its own \\`createContext\\`; a url this dispatcher`,\n      `        // merely declined must pay for neither (resolve-agent-subject.ts:93-96).`,\n      `        const auxResponse = await serveMatchedAuxRoute(auxRoute, request, {`,\n      `          ...auxDeps,`,\n      `          resolveSubject: await __theoResolveSubject(request),`,\n      `        })`,\n      host.wrapSecurityHeaders === true\n        ? `        return withSecurityHeaders(auxResponse, SECURITY_HEADERS)`\n        : `        return auxResponse`,\n      `      }`,\n      `      // B-185 — only the agent prefix has a run handler behind it. A \\`.well-known\\` url the`,\n      `      // dispatcher declined must NOT slice a prefix it does not carry: the name would be`,\n      `      // garbage and mountAgent would answer 500 for what is a routing miss.`,\n      `      if (!${pathname}.startsWith(${JSON.stringify(AGENT_PREFIX)})) return ${notFound}`,\n      `      const agentName = ${pathname}.slice(${String(AGENT_PREFIX.length)}).split('/')[0]`,\n      ...resolution.lookup,\n      `      // A name nobody scanned is a 404, exactly like any other unknown path. Handing`,\n      `      // \\`undefined\\` to mountAgent would surface as a 500 for what is a routing miss.`,\n      `      if (mod === undefined) return ${notFound}`,\n      `      const agentResponse = await mountAgent(mod, request, (model, plugins) => resolveProvider(model, { plugins }).apiKey, {`,\n      `        agentName,`,\n      `        // B-185 — mount-agent.ts:121 has accepted this since #365 and 0 of 23 adapters passed`,\n      `        // one, so agent-access.ts:146 judged every deployed policy against \\`subject: null\\`.`,\n      `        // A run is not a decline: it is about to do real work, so the shim this builds is not`,\n      `        // the cost ADR-1 refuses.`,\n      `        resolveSubject: await __theoResolveSubject(request),`,\n      `        ...CSRF_CONFIG,`,\n      `      })`,\n      host.wrapSecurityHeaders === true\n        ? `      return withSecurityHeaders(agentResponse, SECURITY_HEADERS)`\n        : `      return agentResponse`,\n      `    }`,\n    ],\n  }\n}\n\ninterface AgentResolution {\n  imports: string[]\n  declarations: string[]\n  /** Lines that must leave `mod` bound to the agent's module, or `undefined`. */\n  lookup: string[]\n  /**\n   * B-185 — lines that must leave `auxDeps` bound to an `AuxRouteDeps`, plus the expression for\n   * its `agents`. They run BEFORE {@link AgentResolution.lookup} so a declined aux route performs\n   * no module load, which is what ADR-1 buys and what a later ordering would spend.\n   */\n  auxPrelude: string[]\n  /**\n   * B-185 — lines that must leave `resolveSubject` bound to a resolver, or to `undefined`. Emitted\n   * only where a match has already happened, because building one costs a web shim and\n   * `resolve-agent-subject.ts:93-96` states that a declined url must never run the application's\n   * `createContext`.\n   */\n  identity: string[]\n  /**\n   * B-185 — what {@link AgentResolution.identity} imports, appended to the `agent-mount` line, or\n   * `''` where identity is not resolved at all.\n   *\n   * It lives HERE, beside the lines that CALL it, because a first draft decided it in a separate\n   * `identityEntryFor` that switched the same discriminated union a second time. The two could not\n   * disagree then — the conditions were identical — which is what made it latent rather than live.\n   * A later drift would emit an entry that CALLS a symbol it never imported, and nothing catches\n   * that: the stub-coverage guard derives its requirement FROM the imports, so a missing import\n   * shrinks the requirement instead of failing, and `node --check` is syntax rather than\n   * resolution. It would surface as a `ReferenceError` inside a deployed Worker.\n   */\n  identityImport: string\n}\n\n/** No filesystem: every agent module is a static import decided on the build machine. */\nfunction bakedResolution(\n  agents: readonly DeployedAgent[],\n  contextModule: string | undefined,\n  pluginRunnerExpr: string | undefined,\n): AgentResolution {\n  const varOf = (index: number): string => `__theoAgent${String(index)}`\n  return {\n    imports: [\n      ...agents.map((agent, index) => `import * as ${varOf(index)} from '../../${agent.filePath}'`),\n      // B-185 — the app's context module, baked exactly like the agents above it (ADR 0014).\n      ...(contextModule === undefined\n        ? []\n        : [\n            // SI-022 — DYNAMIC, not a top-level static import. B-185 added this import; before it\n            // a Worker did not load the app's `server/context.ts` at all. A module-scope throw\n            // there — the commonest shape being a required-env-var check — then went from costing\n            // nothing to taking the ENTIRE target down: the import fails, the module never\n            // evaluates, and every route dies rather than only the one that wanted an identity.\n            //\n            // That is strictly worse than what `resolve-agent-subject.ts:69-72` promises. It says\n            // a throwing `createContext` reaches the branch's own error handler and becomes a 500,\n            // which is a failure scoped to the request that needed identity. A throw at IMPORT\n            // time reaches no handler at all.\n            //\n            // A relative `import()` is statically analysable, so wrangler bundles the module\n            // exactly as it bundled the static form — the reason ADR 0014 bakes it is unaffected.\n            // What changes is WHEN it evaluates, and therefore what a failure costs. It is only\n            // a real improvement if the import stays inside the thunk; see the factory below.\n            `const __theoContext = () => import('../../${contextModule}')`,\n          ]),\n    ],\n    declarations: [\n      `// #367 — the app's agents, keyed by NAME because that is what the URL carries, what the`,\n      `// access policy is judged under, and what the run's spans are labelled with (#406).`,\n      `const agents = {`,\n      ...agents.map((agent, index) => `  ${JSON.stringify(agent.name)}: ${varOf(index)},`),\n      `}`,\n      `// B-185 — the node list the aux dispatcher matches a url against. There is deliberately NO`,\n      `// second table keyed by file path: \\`test_the_table_is_keyed_by_agent_name_not_by_file_path\\``,\n      `// forbids one, and the reason it gives is the right one — a path key makes a lookup depend on`,\n      `// the server's directory layout. The loader below reaches the module THROUGH this list, so the`,\n      `// layout appears once, here, and the module table above stays keyed by the name the URL, the`,\n      `// access policy and the run's spans all carry (#406).`,\n      `const agentNodes = [`,\n      ...agents.map(\n        (agent) =>\n          `  { filePath: ${JSON.stringify(agent.filePath)}, agentPath: ${JSON.stringify(agent.agentPath)}, name: ${JSON.stringify(agent.name)} },`,\n      ),\n      `]`,\n    ],\n    lookup: [\n      `      const mod = Object.prototype.hasOwnProperty.call(agents, agentName)`,\n      `        ? agents[agentName]`,\n      `        : undefined`,\n    ],\n    identityImport: contextModule === undefined ? '' : ', createSubjectResolverFromFactory',\n    identity:\n      contextModule === undefined\n        ? [\n            `  // B-185 — this app declares no \\`server/context.ts\\`, so there is no factory to`,\n            `  // bake and an anonymous caller is the honest answer. A policy that admits`,\n            `  // nobody is the correct outcome, not an error.`,\n            `        const resolveSubject = undefined`,\n          ]\n        : [\n            `  // B-185 — a Worker has no filesystem to find \\`context.ts\\` on, so the module is baked`,\n            `  // and its factory handed straight to the resolver (ADR 0014).`,\n            `  //`,\n            `  // This function has TWO callers and is lazy on purpose. Both build a shim, and that is`,\n            `  // correct at both: the aux branch calls it only AFTER a match, and the run handler is`,\n            `  // about to do real work. What neither pays for is the app's own \\`createContext\\` on a`,\n            `  // url nobody answers — the resolver is a thunk, and \\`agent-access.ts:146\\` returns early`,\n            `  // for an absent or public policy without ever invoking it.`,\n            `        const { req: __theoReq, res: __theoRes } = createWebShim(request)`,\n            `  const resolveSubject = createSubjectResolverFromFactory(`,\n            // The import happens HERE, inside the factory, and `createSubjectResolverFromFactory`\n            // calls the factory inside the thunk it returns (`resolve-agent-subject.ts:127-133`).\n            // A first version of this fix awaited the import as an ARGUMENT, which evaluated it\n            // eagerly inside `__theoResolveSubject` — both call sites await that before\n            // `agent-access.ts:145` returns early for an absent or `'public'` policy. The blast\n            // radius was then every agent request rather than the one that wanted an identity,\n            // and the laziness invariant the lines above assert was broken. Found by the\n            // inventory judge while the change was still in the working tree.\n            `    async (__theoArgs) => (await __theoContext()).createContext(__theoArgs),`,\n            `    __theoReq,`,\n            `    __theoRes,`,\n            `    ${pluginRunnerExpr ?? 'undefined'},`,\n            `  )`,\n          ],\n    auxPrelude: [\n      `      // B-185 — the aux dispatcher needs nodes carrying \\`filePath\\` and a loader keyed by it.`,\n      `      // The loader resolves the path to a NAME through the node list, then reads the same`,\n      `      // name-keyed table the url lookup uses: one map, one layout mention, no filesystem`,\n      `      // (ADR-2). A linear find over a handful of agents is not worth a second table that`,\n      `      // \\`test_the_table_is_keyed_by_agent_name_not_by_file_path\\` exists to forbid.`,\n      `      const auxDeps = {`,\n      `        agents: agentNodes,`,\n      `        loadModule: async (filePath) => {`,\n      `          const node = agentNodes.find((a) => a.filePath === filePath)`,\n      `          return node === undefined ? undefined : agents[node.name]`,\n      `        },`,\n      `        baseUrl: url.origin,`,\n      ...AUX_DEPS_PARITY,\n      `      }`,\n    ],\n  }\n}\n\n/** A filesystem: scan once and load on demand, exactly as this entry already treats its routes. */\nfunction scannedResolution(source: {\n  projectRoot: string\n  loadModule: string\n  ensureLoader?: string\n  agentsDirLiteral?: string\n  serverDir?: string\n  pluginRunnerExpr?: string\n}): AgentResolution {\n  // The configured directory as a second argument, or nothing. `scanAgents` defaults the name to\n  // `agents`, which is right for a project that never set one and wrong for every project that did.\n  const agentsDirArg = source.agentsDirLiteral === undefined ? '' : `, ${source.agentsDirLiteral}`\n\n  return {\n    imports: [],\n    declarations: [\n      `// #367 — scanned on first use and cached, the same shape this entry already gives routes.`,\n      `// Baking would tie an agent's existence to a rebuild on a target that has a filesystem.`,\n      `let agentsCache = null`,\n    ],\n    lookup: [\n      `      const agentNode = agentsCache.find((a) => a.name === agentName)`,\n      `      const mod = agentNode === undefined ? undefined : await ${source.loadModule}(agentNode.filePath)`,\n    ],\n    identityImport: source.serverDir === undefined ? '' : ', createAgentSubjectResolver',\n    identity:\n      source.serverDir === undefined\n        ? [`        const resolveSubject = undefined`]\n        : [\n            `  // B-185 — this host HAS a filesystem, so it locates its own \\`context.ts\\` and the`,\n            `  // existing resolver works unchanged; nothing is baked (ADR 0014). Lazy for the reason`,\n            `  // the baked branch gives: both callers build a shim, and neither runs the app's own`,\n            `  // \\`createContext\\` for a url nobody answers.`,\n            `        const { req: __theoReq, res: __theoRes } = createWebShim(request)`,\n            `  const resolveSubject = createAgentSubjectResolver({`,\n            `    req: __theoReq,`,\n            `    res: __theoRes,`,\n            `    loadModule: ${source.loadModule},`,\n            `    serverDir: ${source.serverDir},`,\n            `    pluginRunner: ${source.pluginRunnerExpr ?? 'undefined'},`,\n            `        })`,\n          ],\n    auxPrelude: [\n      ...(source.ensureLoader === undefined ? [] : [`      ${source.ensureLoader}`]),\n      `      // B-185 — hoisted above the lookup so a declined aux route loads no module. The scan`,\n      `      // LISTS agent files; it imports none, so moving it here costs a declined request`,\n      `      // nothing it was not already paying.`,\n      `      if (!agentsCache) agentsCache = scanAgents(${source.projectRoot}${agentsDirArg})`,\n      `      const auxDeps = {`,\n      `        agents: agentsCache,`,\n      `        loadModule: ${source.loadModule},`,\n      `        baseUrl: url.origin,`,\n      ...AUX_DEPS_PARITY,\n      `      }`,\n    ],\n  }\n}\n","/**\n * The CORS configuration a deployed entry carries, baked at build time.\n *\n * ## The defect this closes\n *\n * `security.cors` reached exactly one consumer: Vite's `configureServer` hook. So an app that\n * worked cross-origin under `theokit dev` stopped working the moment anything else served it —\n * `theokit start` (fixed separately) and all six Web deploy targets (usetheokit/theokit#409). Same\n * config, same code, no error and no warning; the failure surfaces in a browser as a blocked fetch\n * on the deployed URL, three layers from the key that had quietly stopped being read.\n *\n * The pure half was written twice and called once: `createCorsWebHandler` — the Web mirror — had no\n * caller anywhere in the repository. Nothing here reimplements it.\n *\n * ## A callback origin is REFUSED, not silently dropped\n *\n * `corsSchema.origins` accepts `z.function(...)` alongside the string / RegExp / array shapes. A\n * deployed function has no `theo.config.ts` to read, and there is no literal for a closure — so a\n * build that baked only the serialisable shapes would produce an app whose CORS silently allowed\n * nothing, which is the exact class of failure this issue reports.\n *\n * `rules/three-target-parity.md` § 3 is explicit about the alternative: \"a target that cannot serve\n * a capability refuses by name. Silent degradation is the failure mode this rule exists to\n * prevent.\" So the build throws, naming the target, the key and the two ways forward.\n */\nimport type { TheoConfig } from '../config/schema.js'\n\ntype CorsConfig = NonNullable<NonNullable<TheoConfig['security']>['cors']>\n\n/**\n * The CORS slice of an adapter's build options.\n *\n * Narrow and named once, matching how `securityHeaders` and `DeployedCsrfOptions` already reach the\n * emitters: each renderer receives what it uses, and six signatures name one type instead of six\n * inline shapes that can drift.\n */\nexport interface DeployedCorsOptions {\n  cors?: CorsConfig\n}\n\n/**\n * Thrown at BUILD time when the declared CORS cannot be carried to a deployed target.\n *\n * A build error is the point: the alternative is a deploy that looks configured and refuses every\n * cross-origin request, discovered by a browser rather than by the build.\n */\nexport class UnserializableCorsOriginError extends Error {\n  constructor(target: string) {\n    super(\n      `security.cors.origins is a function, and the \\`${target}\\` target cannot carry it: a deployed ` +\n        `function has no theo.config.ts to read, and a callback cannot be written into the emitted ` +\n        `entry. Replace it with the origin, a RegExp, or an array of either — all of which travel — ` +\n        `or build for \\`node\\` and run \\`theokit start\\`, which evaluates the callback at runtime.`,\n    )\n    this.name = 'UnserializableCorsOriginError'\n  }\n}\n\n/** Source text for one origin matcher: a RegExp as a literal, anything else as JSON. */\nfunction renderOrigin(origin: unknown, target: string): string {\n  if (typeof origin === 'function') throw new UnserializableCorsOriginError(target)\n  if (origin instanceof RegExp) return String(origin)\n  if (Array.isArray(origin)) return `[${origin.map((o) => renderOrigin(o, target)).join(', ')}]`\n  return JSON.stringify(origin)\n}\n\n/**\n * Source text for the CORS config, or `undefined` when the app declared none.\n *\n * RegExp entries are emitted as regex literals for the reason `deployed-csrf.ts` gives at length:\n * `JSON.stringify` renders a RegExp as `{}`, and `matchesOrigin` checks `instanceof RegExp`, so a\n * JSON-rendered origin would sit in the emitted file looking configured and matching nothing.\n *\n * @throws UnserializableCorsOriginError when `origins` is a callback\n */\nexport function renderDeployedCorsLiteral(cors: CorsConfig | undefined, target: string): string {\n  if (cors === undefined) return 'undefined'\n\n  const parts = [`origins: ${renderOrigin(cors.origins, target)}`]\n  if (cors.methods !== undefined) parts.push(`methods: ${JSON.stringify(cors.methods)}`)\n  if (cors.allowedHeaders !== undefined)\n    parts.push(`allowedHeaders: ${JSON.stringify(cors.allowedHeaders)}`)\n  if (cors.exposedHeaders !== undefined)\n    parts.push(`exposedHeaders: ${JSON.stringify(cors.exposedHeaders)}`)\n  // Both carry schema defaults, so they are always present and always emitted — unlike the\n  // optional fields above, whose absence is a real answer the handler already has one for.\n  parts.push(\n    `credentials: ${JSON.stringify(cors.credentials)}`,\n    `maxAge: ${JSON.stringify(cors.maxAge)}`,\n  )\n\n  return `{ ${parts.join(', ')} }`\n}\n\n/**\n * The lines that declare the CORS handler in a generated entry.\n *\n * `null` when nothing was declared, which is what \"no cors block\" meant before and still means: no\n * headers, not permissive ones.\n */\nexport function deployedCorsFragment(cors: CorsConfig | undefined, target: string): string[] {\n  return [\n    `// #409 — the CORS the app declared, carried as a literal because a deployed function has no`,\n    `// theo.config.ts to read. \\`null\\` when the app declared none: no headers, not permissive ones.`,\n    `const CORS_CONFIG = ${renderDeployedCorsLiteral(cors, target)}`,\n    `const CORS_HANDLER = CORS_CONFIG === undefined ? null : createCorsWebHandler(CORS_CONFIG)`,\n    ``,\n    `/** Answer a preflight before routing — an OPTIONS the router handles never gets a CORS answer. */`,\n    `function corsPreflight(request) {`,\n    `  return CORS_HANDLER === null ? null : CORS_HANDLER.handlePreflightRequest(request)`,\n    `}`,\n    ``,\n    `/** Put the headers on whatever the app answered, including its 404s — a browser reads a 404`,\n    ` *  without them as a CORS failure rather than as the 404 it is. */`,\n    `function withCors(request, response) {`,\n    `  if (CORS_HANDLER !== null) CORS_HANDLER.applyCorsHeaders(request, response.headers)`,\n    `  return response`,\n    `}`,\n  ]\n}\n","/**\n * The CSRF configuration a deployed entry carries, baked at build time.\n *\n * ## The defect this closes\n *\n * The six Web-standards adapter entries built `executeRoute`'s context from an eight-field\n * literal, and neither `csrfMode` nor `disallowed` was among the eight (usetheokit/theokit#410).\n * `executeRoute` defaults an absent mode to `'strict'`, so an app declaring\n * `security: { csrf: 'off' }` — or `'warn'` — got `'strict'` on every deploy target: a `POST` that\n * works under `theokit dev` and `theokit start` answers `403 CSRF_INVALID` on Vercel, naming a\n * mechanism the operator had switched off. The config still validated and the build still\n * succeeded; the behaviour simply changed.\n *\n * The deployed function has no `theo.config.ts` to read, which is why the value is carried as a\n * literal — the same shape `security.headers` already uses (`renderSecurityHeadersConfigLiteral`).\n *\n * ## Why this is not `JSON.stringify`\n *\n * `disallowed.routes` accepts RegExp entries (`config/schemas/security.ts`), and `JSON.stringify`\n * renders a RegExp as `{}`. That is not a formatting problem: `matchDisallowed` checks\n * `p instanceof RegExp`, so a `{}` matches nothing while reading, in the emitted file, as a rule\n * that is present and configured. Reaching for JSON here would reproduce this issue's own defect —\n * configuration that survives validation and quietly stops applying — one layer further down.\n */\nimport type { TheoConfig } from '../config/schema.js'\n\ntype SecurityConfig = NonNullable<TheoConfig['security']>\n\n/**\n * The two slices of `security` that reach `executeRoute`'s context.\n *\n * Narrow rather than the whole block, matching how `securityHeaders` is already passed: each\n * renderer receives what it uses and nothing else, so a headers change cannot reach the CSRF\n * literal and vice versa.\n */\nexport interface DeployedCsrfOptions {\n  csrf?: SecurityConfig['csrf']\n  disallowed?: SecurityConfig['disallowed']\n}\n\n/**\n * Source text for one route pattern.\n *\n * A RegExp is emitted as a regex literal so it arrives as a RegExp; a string goes through\n * `JSON.stringify`, which is the correct escaper for a JS string literal (quotes, backslashes,\n * control characters, line separators).\n */\nfunction renderRoutePattern(pattern: string | RegExp): string {\n  return pattern instanceof RegExp ? String(pattern) : JSON.stringify(pattern)\n}\n\n/**\n * Source text for the CSRF slice of `executeRoute`'s context.\n *\n * Absent values are OMITTED rather than defaulted. `executeRoute` already defaults an absent\n * `csrfMode` to `'strict'`, and writing `'strict'` here would put that default in a second place\n * where the two can disagree — which is the class of drift the whole issue is about.\n *\n * @param security - the declared csrf slices, or `undefined` when the app declared no security block\n */\nexport function renderDeployedCsrfLiteral(security: DeployedCsrfOptions | undefined): string {\n  if (security === undefined) return '{}'\n\n  const parts: string[] = []\n  if (security.csrf !== undefined) parts.push(`csrfMode: ${JSON.stringify(security.csrf)}`)\n\n  const { disallowed } = security\n  if (disallowed !== undefined) {\n    const routes = disallowed.routes.map(renderRoutePattern).join(', ')\n    parts.push(\n      `disallowed: { routes: [${routes}], behavior: ${JSON.stringify(disallowed.behavior)} }`,\n    )\n  }\n\n  // `{}` and not `{ }` when nothing was declared: the emitted file is read by people, and the\n  // two-space version reads as though something was meant to be there.\n  return parts.length === 0 ? '{}' : `{ ${parts.join(', ')} }`\n}\n\n/**\n * The lines that declare `CSRF_CONFIG` in a generated entry.\n *\n * One function rather than the same six lines pasted into each of the six adapters: that\n * duplication is how the eight-field context literal came to be wrong in six places at once, and\n * repeating the fix in the same shape would leave the next field with the same six places to be\n * forgotten in. It also keeps the two largest emitters under the `max-lines-per-function` ceiling,\n * which `vercel.ts` already extracts fragments to respect.\n *\n * @param opts - the declared csrf slices, passed straight through from the adapter's build options\n * @param home - what the target has instead of a config file, for the comment's second sentence\n */\nexport function deployedCsrfFragment(\n  opts: DeployedCsrfOptions,\n  home = 'a deployed function',\n): string[] {\n  return [\n    `// #410 — the CSRF mode and per-route escalation the app declared. Carried as a`,\n    `// literal for the same reason as the headers above: ${home} has no theo.config.ts`,\n    `// to read. Absent keys stay absent so executeRoute's own default ('strict') applies,`,\n    `// rather than this file becoming a second place it can drift.`,\n    `const CSRF_CONFIG = ${renderDeployedCsrfLiteral(opts)}`,\n  ]\n}\n","/**\n * The security headers a deployed target puts on its responses.\n *\n * `theokit start` applies the configured baseline to every response it writes\n * (`cli/commands/start/request-handler.ts`). None of the six Web-standards\n * deploy adapters applied any, so the same page carried a CSP,\n * `X-Frame-Options`, HSTS and `nosniff` under `theokit start` and none of them\n * once deployed (usetheokit/theokit#410, GHSA-87qq-fgcr-384x).\n *\n * This module is the seam that closes that half of the gap. It has two halves\n * and they live together on purpose: the code that writes the literal into a\n * generated entry and the code that reads it at request time have to agree on\n * one shape, and a shape stated in two files drifts.\n *\n * - **Build time** — {@link renderSecurityHeadersConfigLiteral} turns\n *   `security.headers` into a JSON literal the adapter inlines. A deployed\n *   runtime has no `theo.config.ts` to read, so the configuration travels as\n *   data.\n * - **Request time** — the generated entry calls {@link buildSecurityHeaders}\n *   on that literal and hands every response to {@link withSecurityHeaders}.\n *   The same function `theokit start` calls, on the same input, so the two\n *   cannot disagree about what the configuration means.\n *\n * ## The per-request nonce, and where it stops\n *\n * `buildSecurityHeaders` accepts a per-request `nonce` and substitutes it into\n * `script-src`. A nonce cannot survive a build-time literal — it is minted per\n * response — so a target reaches one only if it renders the HTML at request\n * time and can put the same value on the script tags it emits.\n *\n * Exactly one deploy path does: **Cloudflare with `ssrStreaming: true`**, whose\n * worker calls `renderStreamingWeb(request, { nonce })`, and that renderer\n * threads the value into `renderToReadableStream` and into the hydration script\n * (`router/entry-server.ts`). That branch mints a nonce per request and builds\n * its CSP from it. Everything else serves HTML written at build time, or no\n * HTML at all, and carries a **nonce-less CSP** — the same answer\n * `buildSecurityHeaders` already gives a prerendered route (EC-4), for the same\n * reason: a nonce in the header with no nonce on the tag blocks every inline\n * script.\n *\n * That asymmetry is real and is not smoothed over. It is stated in the emitted\n * entry, printed by the build through\n * {@link describeDeployedSecurityHeaders}, and written down in\n * `docs/surfaces/build-adapters.md`.\n */\nimport { generateNonce } from '../core/contracts/nonce.js'\nimport type { SecurityHeadersConfig } from '../core/contracts/security-headers.js'\nimport { buildSecurityHeaders } from '../core/contracts/security-headers.js'\n\n/**\n * Re-exported so a generated entry has ONE import for the whole concern.\n *\n * Reaching it through `theokit/server/security` would work and would also drag\n * that barrel's CSRF surface into a Worker bundle, for a function that is forty\n * lines of string concatenation. It is defined in `core/contracts/`, which is\n * the module every target may import from — `adapters → server` is not an edge\n * in the DAG, and the header policy was never server code.\n */\nexport { buildSecurityHeaders }\n\n/**\n * Re-exported for the same reason, and so the streamed Cloudflare worker mints\n * its nonce with the identical primitive `theokit start` uses\n * (`cli/commands/start/request-handler.ts`) rather than a second, hand-rolled\n * one. It is already runtime-portable: Web Crypto first, with a named error\n * when the runtime has none.\n */\nexport { generateNonce }\n\n/**\n * The `security.headers` block, as a literal a generated entry can carry.\n *\n * `{}` when the app declares none — which is not the same as \"no headers\".\n * `buildSecurityHeaders({})` returns the full default baseline, and `{}` is\n * exactly what `theokit start` passes when `security.headers` is absent\n * (`cli/commands/start/index.ts`). An app with no security block gets the same\n * baseline deployed as it gets locally.\n */\n/**\n * The two declarations every deploy entry emits to carry the security baseline.\n *\n * Four adapters wrote these same two lines — `netlify`, `vercel`, `aws-lambda`, `deno-deploy` —\n * each under a comment naming its own host's static-asset boundary. The COMMENT differs and is\n * meant to; the declarations do not.\n *\n * Extracted after SonarCloud's duplication gate failed a PR at 4.0% against a 3% ceiling and named\n * this as the largest repeated block among the changed files. The gate was measuring something\n * real: a literal renderer and a builder call, copied four times, is four places to update when\n * either changes.\n *\n * Returns the lines rather than a joined string, because every caller splices them into an array\n * of emitted lines.\n */\nexport function securityHeadersDeclarations(config: SecurityHeadersConfig | undefined): string[] {\n  return [\n    `const SECURITY_HEADERS_CONFIG = ${renderSecurityHeadersConfigLiteral(config)}`,\n    `const SECURITY_HEADERS = buildSecurityHeaders(SECURITY_HEADERS_CONFIG, { production: true })`,\n  ]\n}\n\nexport function renderSecurityHeadersConfigLiteral(\n  headers: SecurityHeadersConfig | undefined,\n): string {\n  return JSON.stringify(headers ?? {})\n}\n\n/**\n * Put the headers on a response, without overruling the handler.\n *\n * `theokit start` sets the baseline BEFORE the route handler runs, so a handler\n * can override it with `res.setHeader` (last write wins, Node convention). On a\n * Web target the response arrives already built, so the equivalent of \"the\n * handler wins\" is to skip a header the response already carries: a route that\n * set its own `Content-Security-Policy` keeps it.\n *\n * Mutates and returns the same `Response` rather than constructing a\n * replacement, because these responses are handed to the runtime while their\n * body is still being written (#382) and re-wrapping the stream is exactly the\n * second buffering point that change removed.\n *\n * Mutation is safe for every response these entries produce: the Fetch spec\n * gives a locally constructed `Response` the `response` header guard, which\n * permits `set` for every name used here. The `immutable` guard belongs to\n * responses that came back from `fetch()`, and none of the six emitted handlers\n * returns one — each builds its response from `createWebShim`, from a `new\n * Response(...)`, or from the SSR renderer. The WebSocket upgrade, which is the\n * one response an adapter gets from its runtime rather than building, is\n * deliberately not routed through here.\n */\nexport function withSecurityHeaders(response: Response, headers: Record<string, string>): Response {\n  for (const [key, value] of Object.entries(headers)) {\n    if (!response.headers.has(key)) response.headers.set(key, value)\n  }\n  return response\n}\n\nexport interface DeployedSecurityHeaderLimits {\n  target: string\n  /** The app's `security.headers` block, or undefined when it declares none. */\n  securityHeaders: SecurityHeadersConfig | undefined\n  /**\n   * Does the emitted handler render HTML at request time and mint a CSP nonce\n   * for it? True only for Cloudflare with `ssrStreaming: true`.\n   */\n  mintsNonce: boolean\n  /**\n   * Is the HTML document served by a platform static host rather than by the\n   * handler this build emits? True wherever the emitted handler answers\n   * `/api/*` and returns 404 for everything else.\n   */\n  /**\n   * Who puts the security headers on the HTML DOCUMENT — a different question from who serves it,\n   * and the two used to be collapsed into one boolean (usetheokit/theokit#412).\n   *\n   * - `handler` — this target's own handler returns the document, so it carries the same baseline\n   *   every API response carries. No caveat.\n   * - `platform-configured` — the platform's static host serves the document, AND this build emits\n   *   the configuration that puts the headers on it (`.vercel/output/config.json`, `netlify.toml`).\n   *   Still worth stating, because nothing here has seen a deployed response.\n   * - `platform-unmanaged` — the platform serves it and this build owns no artifact that could\n   *   configure it. This is the real remaining gap, and it stays named.\n   *\n   * The two-value version reported `platform-configured` targets with the same message as\n   * `platform-unmanaged` ones, telling an operator to go and do work the build had already done —\n   * and a stale limitation reads exactly like a current one.\n   */\n  documentHeaders: 'handler' | 'platform-configured' | 'platform-unmanaged'\n}\n\n/**\n * What the build tells the operator, once, per target.\n *\n * Silent degradation is the failure mode `rules/three-target-parity.md` exists\n * to prevent. Two things degrade quietly here and both are named rather than\n * discovered in production: a CSP that refuses inline scripts on a deploy while\n * allowing them locally, and an HTML document that never passes through the\n * handler these headers are attached to.\n *\n * The header names are read from the map the entry will actually carry, not\n * from a list written next to it. A configuration that switches HSTS or the CSP\n * off would otherwise be announced as sending them.\n */\nexport function describeDeployedSecurityHeaders(limits: DeployedSecurityHeaderLimits): string {\n  const headers = buildSecurityHeaders(limits.securityHeaders ?? {}, { production: true })\n  const names = Object.keys(headers)\n  if (names.length === 0) {\n    return `  ! \\`${limits.target}\\` sends no security headers: the configuration switched every one of them off.`\n  }\n\n  const lines = [\n    `  ✓ security headers on every response \\`${limits.target}\\` returns: ${names.join(', ')}.`,\n  ]\n  const sendsCsp = names.some((name) => name.startsWith('Content-Security-Policy'))\n  if (sendsCsp && !limits.mintsNonce) {\n    lines.push(\n      `    - The CSP carries no nonce: this target serves HTML written at build time,`,\n      `      so there is no per-request value to put on a script tag. An inline`,\n      `      <script> is refused by \\`script-src 'self'\\` here, while the same page`,\n      `      under \\`theokit start\\` gets a nonce and runs it. Move inline scripts to`,\n      `      \\`<script src=\"...\">\\`, or set \\`security.headers.cspMode: 'report-only'\\``,\n      `      while you migrate.`,\n    )\n  }\n  if (limits.documentHeaders === 'platform-configured') {\n    lines.push(\n      `    - The HTML document is served by the platform's static host, and reaches`,\n      `      the browser with these headers through config this build emits. That`,\n      `      path is not verified by a deploy from here — the values come from the`,\n      `      same function the handler uses, but no response has been read back.`,\n    )\n  }\n  if (limits.documentHeaders === 'platform-unmanaged') {\n    lines.push(\n      `    - The HTML document does NOT pass through this handler — the platform's`,\n      `      static host serves it — so these headers reach \\`/api/*\\` responses and`,\n      `      not the page. This build emits no artifact that could configure it, so`,\n      `      set the document's headers on the platform (usetheokit/theokit#412).`,\n    )\n  }\n  return lines.join('\\n')\n}\n","/**\n * The rate limit a deployed entry carries, baked at build time.\n *\n * ## What #508 asked for, and what this answers\n *\n * `theokit build` refuses the six Web-standards targets when `theo.config.ts` declares a\n * `rateLimit` (`UnenforceableRateLimitError`). That refusal is honest and it is not enforcement.\n * The issue names three things standing between the refusal and a working limit: per-runtime\n * caller-address resolution, a refusal that survives where the address cannot be resolved, and\n * storage that outlives one invocation.\n *\n * For `bun` all three already have answers, which is why it is the target that moves first:\n *\n * - **Address** — `Bun.serve`'s handler is `fetch(request, server)`, and `server.requestIP(request)`\n *   returns the peer address without depending on a proxy header a client could set.\n * - **Storage** — `Bun.serve` is a long-lived process. `createRateLimiterWeb`'s default\n *   `InMemoryStore` therefore behaves exactly as it does under `theokit start`, which is the\n *   deployment `node` already ships.\n * - **Refusal** — see below: every shape whose key cannot be resolved in a deployed entry throws\n *   at BUILD time rather than degrading.\n *\n * ## Why the other five are not here\n *\n * Cloudflare, AWS Lambda, Netlify and Vercel are per-invocation runtimes: an in-process counter\n * does not survive between requests, so a limiter built on one forgets. A limit that forgets is a\n * limit that does not limit — the same class of failure as the shared bucket, reached by a\n * different road. Deno Deploy evicts isolates for the same reason. Those need an external counter,\n * which is a storage design and not a wiring change, so they keep refusing by name.\n *\n * Being explicit about that boundary is the point. The failure this whole area exists to prevent is\n * a config that reads as protection while protecting nothing.\n */\nimport type { TheoConfig } from '../config/schema.js'\n\ntype RateLimitConfig = NonNullable<TheoConfig['rateLimit']>\n\n/** The rate-limit slice of an adapter's build options, named once like `DeployedCorsOptions`. */\nexport interface DeployedRateLimitOptions {\n  rateLimit?: RateLimitConfig\n}\n\n/**\n * Thrown at BUILD time when a declared rate limit cannot be carried into a deployed entry.\n *\n * Distinct from {@link UnenforceableRateLimitError}, and the distinction is not cosmetic: that one\n * means *this target enforces no limit at all*, this one means *this target enforces limits, and\n * cannot carry THIS one*. An operator reading the first looks for another target; an operator\n * reading the second changes the key.\n */\nexport class UnserialisableRateLimitError extends Error {\n  override readonly name = 'UnserialisableRateLimitError'\n  constructor(\n    readonly target: string,\n    readonly reason: string,\n    ways: readonly string[],\n  ) {\n    super(\n      [\n        `Refusing to build for \\`${target}\\`: theo.config.ts declares a rate limit this target cannot carry.`,\n        ``,\n        `  ${reason}`,\n        ``,\n        `  Ways forward:`,\n        ...ways.map((w) => `    • ${w}`),\n        ``,\n        `  This refuses rather than dropping the key, because a rate limit that silently does not`,\n        `  apply looks exactly like one that does (usetheokit/theokit#461, #508).`,\n      ].join('\\n'),\n    )\n  }\n}\n\n/** The base shape every accepted config narrows to: a window, a ceiling, and an IP key. */\ninterface BakeableRateLimit {\n  windowMs: number\n  max: number\n  /**\n   * How many proxies sit in front of the app, for the forwarded-header path. Dropped before the\n   * entry until B-027: the schema declares it (`config/schemas/rate-limit.ts:36`) and the generated\n   * code could not honour it, so a deployment behind a proxy keyed every visitor on the proxy.\n   */\n  trustProxy: boolean | number\n  /**\n   * B-257 — the durable counter the entry constructs, or `undefined` for the in-process default.\n   *\n   * A reference rather than an instance: this is baked into a generated file, so it must survive\n   * being written as source. `factory` is the one field that cannot be escaped — see\n   * `bakeableStore` below.\n   */\n  store?: BakeableStore\n}\n\n/** A durable store named by `theo.config.ts`, in the form a generated entry can construct. */\ninterface BakeableStore {\n  /** The specifier the entry imports from. Written through `JSON.stringify`. */\n  module: string\n  /** The exported name it constructs. VALIDATED, never escaped — it becomes a bare identifier. */\n  factory: string\n  /** Constructor options. Written through `JSON.stringify`. */\n  options?: Record<string, string | number | boolean>\n}\n\n/**\n * A JavaScript identifier, and nothing else.\n *\n * `factory` becomes a bare identifier in `import { <factory> } from …`, where `JSON.stringify` would\n * emit `import { \"x\" }` and not parse. So it cannot be escaped — only validated. Without this, a\n * `theo.config.ts` carrying `factory: \"x } from 'evil'; //\"` writes arbitrary code into every\n * generated entry, and that file usually arrives with the clone.\n */\nconst IDENTIFIER = /^[A-Za-z_$][\\w$]*$/\n\n/**\n * The words that are well-formed identifiers and cannot be BOUND.\n *\n * `IDENTIFIER` answers \"could this be a name?\"; the emitter needs \"can this be THIS name?\", and the\n * two differ on exactly this set. `factory` lands as a bare binding in\n * `import { <factory> } from '<module>'`, where `import { default }` is a SyntaxError — so a config\n * naming one produces a generated entry that does not parse, and the deploy fails pointing at the\n * emitted file rather than at the line that caused it.\n *\n * `default` is the one a real config reaches by accident, because `export default createStore` is\n * the ordinary shape of the module being named. The rest are here because the cost of the list is\n * one comparison and the cost of an omission is a deploy that fails somewhere else.\n *\n * Reserved words only. `defaultStore` is a legal binding, and a substring match would refuse it —\n * an over-correction that breaks working configs to protect against a shape they do not have.\n */\nconst NOT_BINDABLE = new Set([\n  'await',\n  'break',\n  'case',\n  'catch',\n  'class',\n  'const',\n  'continue',\n  'debugger',\n  'default',\n  'delete',\n  'do',\n  'else',\n  'enum',\n  'export',\n  'extends',\n  'false',\n  'finally',\n  'for',\n  'function',\n  'if',\n  'import',\n  'in',\n  'instanceof',\n  'new',\n  'null',\n  'return',\n  'super',\n  'switch',\n  'this',\n  'throw',\n  'true',\n  'try',\n  'typeof',\n  'var',\n  'void',\n  'while',\n  'with',\n  'yield',\n])\n\n/**\n * Refuse a `store` a generated entry could not construct — or could construct into a hole.\n *\n * Extracted from `bakeableRateLimit` because it is its own responsibility and because inlining it\n * took that function to a cyclomatic complexity of 18 against a ceiling of 15. The three refusals\n * are one question asked of three fields, which is the shape SRP asks for.\n *\n * The third is the one that cannot be solved by escaping. `module` and `options` are written through\n * `JSON.stringify`, as `trustProxy` already is at the emit site. `factory` lands as a BARE\n * IDENTIFIER in `import { <factory> } from …`, where a quoted string does not parse — so it is\n * validated, and a config that fails the check is refused by name rather than interpolated raw.\n */\nfunction assertBakeableStore(store: unknown, target: string): void {\n  if (store === undefined) return\n\n  if (!isStoreShaped(store)) {\n    throw new UnserialisableRateLimitError(\n      target,\n      '`security.rateLimit.store` must be an object naming a module and a factory.',\n      [\n        \"declare `store: { module: '@upstash/redis', factory: 'Redis' }`\",\n        'omit `store` and let the build refuse this target, which is honest about not limiting',\n      ],\n    )\n  }\n\n  const { module: mod, factory } = store as Record<string, unknown>\n\n  if (typeof mod !== 'string' || mod.length === 0) {\n    throw new UnserialisableRateLimitError(\n      target,\n      '`security.rateLimit.store.module` must be the specifier the entry imports from.',\n      [\"declare `module: '@upstash/redis'`\", 'omit `store`'],\n    )\n  }\n\n  if (typeof factory !== 'string' || !IDENTIFIER.test(factory) || NOT_BINDABLE.has(factory)) {\n    throw new UnserialisableRateLimitError(\n      target,\n      '`security.rateLimit.store.factory` must be a plain identifier — it is written into the ' +\n        'generated entry as `import { <factory> }`, where a quoted string would not parse, so it ' +\n        'is validated rather than escaped. Anything else would put arbitrary source in every ' +\n        'deployment this config builds.',\n      [\n        \"name the export directly: `factory: 'Redis'`\",\n        'omit `store` and let the build refuse this target',\n      ],\n    )\n  }\n\n  // `options` is typed `Record<string, string | number | boolean>` and the type is erased before\n  // this runs, so the declaration protects nobody: the value arrives from a config file. Three\n  // measured escapes, and the third is why this is a refusal rather than a comment —\n  // `JSON.stringify` throws a raw TypeError naming JSON on a BigInt and on a cycle, and on a\n  // FUNCTION it throws nothing and omits the key. The option was then simply absent from the\n  // emitted entry, with no diagnostic: a store configured and not configured, which is the same\n  // silence this whole feature exists to remove.\n  const { options } = store as Record<string, unknown>\n  if (options !== undefined) {\n    if (typeof options !== 'object' || options === null || Array.isArray(options)) {\n      throw new UnserialisableRateLimitError(\n        target,\n        '`security.rateLimit.store.options` must be an object of scalar values.',\n        [\n          \"declare `options: { url: 'redis://…', retries: 3 }`\",\n          'omit `options` and configure the store inside the factory',\n        ],\n      )\n    }\n\n    const offending = Object.entries(options as Record<string, unknown>).find(\n      ([, v]) => typeof v !== 'string' && typeof v !== 'number' && typeof v !== 'boolean',\n    )\n    if (offending !== undefined) {\n      throw new UnserialisableRateLimitError(\n        target,\n        `\\`security.rateLimit.store.options.${offending[0]}\\` must be a string, number or boolean.`,\n        [\n          'declare scalars only — strings, numbers and booleans',\n          'move anything else into the factory itself, which the generated entry calls at runtime',\n        ],\n      )\n    }\n  }\n}\n\n/**\n * The ONE predicate both sides read — the call emitter here and `assertBakeableStore`'s first\n * refusal. They were two, differing on arrays: this one accepted `store: []` while the refusal\n * rejected it, so the declaration threw while the call side would still have emitted `await`. The\n * build refused first, so no bad entry reached disk — and the pair exists to agree BY CONSTRUCTION\n * rather than because one check happens to run earlier.\n */\nfunction isStoreShaped(store: unknown): boolean {\n  return typeof store === 'object' && store !== null && !Array.isArray(store)\n}\n\n/**\n * Narrow a declared rate limit to what a deployed entry can actually enforce, or refuse by name.\n *\n * Accepts the base `{ windowMs, max }` and the explicit `keyBy: 'ip'`, which is what the address\n * resolution below can key. Everything else throws:\n *\n * - a **function** `keyBy` has no literal — the same wall `deployed-cors.ts` hits on a callback\n *   origin, and refused for the same reason;\n * - `keyBy: 'session' | 'user'` needs a session the deployed entry does not resolve at the point\n *   the limit runs, which is before routing;\n * - `routes` needs the matched route, decided after this check. Refusing it is honest today and is\n *   the natural next slice.\n */\nfunction bakeableRateLimit(\n  rateLimit: RateLimitConfig | undefined,\n  target: string,\n): BakeableRateLimit | undefined {\n  if (rateLimit === undefined) return undefined\n  const cfg = rateLimit as Record<string, unknown>\n\n  if (typeof cfg.keyBy === 'function') {\n    throw new UnserialisableRateLimitError(\n      target,\n      '`security.rateLimit.keyBy` is a function, and a deployed entry has no literal for a closure.',\n      [\n        \"use `keyBy: 'ip'` (the default), which this target resolves from the connection\",\n        'build for `node` and run `theokit start`, which can call the function',\n      ],\n    )\n  }\n  if (cfg.keyBy === 'session' || cfg.keyBy === 'user') {\n    throw new UnserialisableRateLimitError(\n      target,\n      `\\`security.rateLimit.keyBy: '${cfg.keyBy}'\\` needs a resolved session, and the limit runs before routing.`,\n      [\n        \"use `keyBy: 'ip'`, which is resolvable at that point\",\n        'build for `node` and run `theokit start`',\n      ],\n    )\n  }\n  assertBakeableStore(cfg.store, target)\n\n  if (cfg.routes !== undefined) {\n    throw new UnserialisableRateLimitError(\n      target,\n      '`security.rateLimit.routes` needs the matched route, which is decided after the limit runs here.',\n      [\n        'declare a single global limit (`windowMs` + `max`)',\n        'build for `node` and run `theokit start`, which applies per-route limits',\n      ],\n    )\n  }\n\n  const windowMs = cfg.windowMs\n  const max = cfg.max\n  if (typeof windowMs !== 'number' || typeof max !== 'number') return undefined\n  // `?? false` and not `|| false`: `trustProxy: 0` is a number and falsy, and it means the same to\n  // the resolver as `false` — but emitting `false` where the operator wrote `0` makes the generated\n  // entry disagree with the config a reader compares it against.\n  const trustProxy = cfg.trustProxy\n  return {\n    windowMs,\n    max,\n    trustProxy:\n      typeof trustProxy === 'boolean' || typeof trustProxy === 'number' ? trustProxy : false,\n    // Validated above — `module` and `options` are escaped at emit time, `factory` was checked\n    // against IDENTIFIER because it cannot be.\n    store: cfg.store as BakeableStore | undefined,\n  }\n}\n\n/**\n * The generated declarations and helper for a target that keys on the connection's peer address.\n *\n * `addressExpression` is the per-runtime half the issue calls out — the one thing that genuinely\n * differs between targets. Bun passes `server`; a future Deno slice would pass its\n * `ServeHandlerInfo`. Everything else here is shared.\n *\n * Returns `[]` when nothing was declared, so an app without a limit emits no limiter at all rather\n * than an inert one.\n */\nexport function deployedRateLimitFragment(\n  rateLimit: RateLimitConfig | undefined,\n  target: string,\n  addressExpression: string,\n  /**\n   * The parameter list `callerAddress` is DECLARED with, because the runtime source differs per\n   * target and only `bun` binds these two names (`bun.ts:158`). `cloudflare.ts:452` binds\n   * `(request, env, ctx)`, `vercel.ts:39` `(nodeReq, nodeRes)`, `netlify.ts:84` `(request, context)`,\n   * `deno-deploy.ts:90` `(request)` and `aws-lambda.ts:152` `(event)`. An expression naming\n   * `context`, `info`, `event` or `nodeReq` inside a function declared `(request, server)` is an\n   * unbound identifier, and the entry throws on the first limited request.\n   */\n  params = 'request, server',\n  /**\n   * The specifier prefix this target needs — `'npm:'` on Deno Deploy, empty everywhere else.\n   *\n   * B-257: this function now emits its OWN import for the durable limiter, rather than relying on\n   * each adapter to remember one. The previous shape had THREE sides to keep in step — the\n   * declaration here, the call in `rateLimitCheckFragment`, and a per-adapter import line — and the\n   * third was not joined: six adapters imported `createRateLimiterWeb` and none imported\n   * `createDurableRateLimiterWeb`, so a store-carrying entry referenced a free variable and would\n   * have thrown `ReferenceError` while evaluating its module body. Not at the first limited request:\n   * at LOAD, taking down every route including those declaring no limit.\n   *\n   * `cloudflare.ts:370-373` documents that exact defect from B-027, one symbol earlier. Owning the\n   * import here is what stops a fourth recurrence.\n   */\n  importPrefix = '',\n): string[] {\n  const baked = bakeableRateLimit(rateLimit, target)\n  if (baked === undefined) return []\n  return [\n    `// #508 — the limit the app declared, carried as a literal because a deployed entry has no`,\n    `// theo.config.ts to read.`,\n    `//`,\n    `// WHERE THIS COUNTER LIVES, and it is not the same answer per target. On a long-lived server`,\n    `// (\\`bun\\`) the process outlives a request and the count holds. On a per-invocation or`,\n    `// per-isolate runtime — Cloudflare, AWS Lambda, Netlify, Vercel, Deno Deploy — it does not:`,\n    `// the limit is PER INSTANCE, and a caller spread across instances gets that many budgets.`,\n    `// The address is resolved correctly either way; the counting is what B-257 is about, and`,\n    `// \\`theokit build\\` refuses a declared limit on those five until it is.`,\n    // B-262 — ONE builder, one signature, always async. The emitter used to branch here:\n    // `createRateLimiterWeb` returns a value and `createDurableRateLimiterWeb` returns a Promise, so\n    // the CALL SITE had to know which it got and emit `await` or not. A call site whose shape changes\n    // with the config is what produced B-257's missing `await`, and `buildRateLimiter` removes the\n    // decision rather than documenting it.\n    `import { buildRateLimiter } from '${importPrefix}theokit/server/rate-limit'`,\n    ...(baked.store === undefined\n      ? [\n          `const RATE_LIMIT = buildRateLimiter({ windowMs: ${baked.windowMs}, max: ${baked.max} }, undefined)`,\n        ]\n      : [\n          // B-257 — a durable counter, named by the app. `module` and the options are JSON literals;\n          // `factory` was validated against IDENTIFIER at bake time because it lands here as a bare\n          // identifier and no escape can make that safe.\n          //\n          // The limiter's own import is emitted HERE rather than by each adapter. See `importPrefix`.\n          `import { ${baked.store.factory} } from ${JSON.stringify(baked.store.module)}`,\n          `const RATE_LIMIT_STORE = new ${baked.store.factory}(${JSON.stringify(baked.store.options ?? {})})`,\n          `const RATE_LIMIT = buildRateLimiter(`,\n          `  { windowMs: ${baked.windowMs}, max: ${baked.max} },`,\n          `  RATE_LIMIT_STORE,`,\n          `)`,\n        ]),\n    ``,\n    `// How many proxies the deployment declared in front of it. \\`client-ip.ts\\` reads a forwarded`,\n    `// header only when this says one wrote it: the header is whatever the client typed, so`,\n    `// trusting it unasked lets anyone rotate a forged value past the limiter with one \\`curl -H\\`.`,\n    `const TRUST_PROXY = ${JSON.stringify(baked.trustProxy)}`,\n    ``,\n    `/**`,\n    ` * The caller's address, from the connection rather than from a header.`,\n    ` *`,\n    ` * A header a client can set is a key a client can choose, which makes the bucket theirs to`,\n    ` * split. An address this runtime cannot resolve returns \\`undefined\\`, and the caller answers`,\n    ` * 503 rather than keying on a constant: one shared bucket is a budget the first caller each`,\n    ` * window exhausts for everyone, which is worse than no limiting at all.`,\n    ` */`,\n    `const addr = (v) => (typeof v === 'string' && v.trim() !== '' ? v.trim() : undefined)`,\n    `function callerAddress(${params}) {`,\n    `  return addr(${addressExpression})`,\n    `}`,\n    ``,\n    `/** The 503 a caller this runtime cannot name gets, instead of everyone's shared bucket. */`,\n    `function unnamedCaller() {`,\n    `  return new Response(`,\n    `    JSON.stringify({ error: { code: 'CALLER_UNRESOLVED', message: ${JSON.stringify(\n      `${target} could not resolve the caller's address, and a rate limit keyed on a constant is a denial of service`,\n    )} } }),`,\n    `    { status: 503, headers: { 'Content-Type': 'application/json' } },`,\n    `  )`,\n    `}`,\n    ``,\n    `/** The 429 a limited caller gets, carrying the limiter's own headers. */`,\n    `function rateLimited(result) {`,\n    `  return new Response(JSON.stringify({ error: { code: 'RATE_LIMITED', message: 'Too many requests' } }), {`,\n    `    status: 429,`,\n    `    headers: { 'Content-Type': 'application/json', ...result.headers },`,\n    `  })`,\n    `}`,\n  ]\n}\n\n/**\n * The check itself, as generated source, placed inside the runtime's request handler.\n *\n * Extracted for the reason `bun.ts` extracts its other fragments: the emitter is one array literal,\n * so every line the entry gains counts against `max-lines-per-function`, and this one pushed it\n * past the ceiling.\n *\n * Runs AFTER the CORS preflight and BEFORE routing: a limited caller should not reach a handler,\n * and a browser still needs its CORS answer to read the 429 as a 429 rather than as a network\n * failure.\n */\nexport function rateLimitCheckFragment(\n  rateLimit: RateLimitConfig | undefined,\n  indent: string,\n  /** The arguments `callerAddress` is CALLED with — see `deployedRateLimitFragment`'s `params`. */\n  args = 'request, server',\n  /** How this target answers a caller over its budget. Only `bun` can use the default. */\n  refuse = 'return withCors(request, withSecurityHeaders(rateLimited(limit), SECURITY_HEADERS))',\n  /** How it answers a caller it could not name. Same shape, different body. */\n  refuseUnnamed = 'return withCors(request, withSecurityHeaders(unnamedCaller(), SECURITY_HEADERS))',\n): string[] {\n  if (rateLimit === undefined) return []\n  return [\n    `${indent}const caller = callerAddress(${args})`,\n    `${indent}if (caller === undefined) {`,\n    `${indent}  ${refuseUnnamed}`,\n    `${indent}}`,\n    // B-257 — the call side of the pair. `deployedRateLimitFragment` emits the DECLARATION; this\n    // emits the CALL, and the two branch on the same fact or the entry names a symbol it never\n    // declared. A durable limiter returns a promise; the sync facade does not.\n    // B-262 — `await` unconditionally. `buildRateLimiter` is always async, so this line no longer\n    // asks what the config declared. The conditional it replaces is where B-257's defect lived:\n    // a Promise read for `limited` is always `undefined`, always falsy, and every request passes.\n    `${indent}const limit = await RATE_LIMIT(caller)`,\n    `${indent}if (limit.limited) {`,\n    `${indent}  ${refuse}`,\n    `${indent}}`,\n  ]\n}\n","/**\n * The configuration a deployed entry could not apply (usetheokit/theokit#425).\n *\n * ## Why this is not another literal renderer\n *\n * `deployed-csrf.ts` and `deployed-cors.ts` bake their values into the emitted source, which works\n * because `csrf` is an enum and `disallowed` is a `{ routes, behavior }` object — plain data, and a\n * deployed function has no `theo.config.ts` to read.\n *\n * The two concerns left over from #410 turn out to be different from each other, and the difference\n * is the whole design:\n *\n * - **`serialization` is plain data too.** The config field is `z.enum(['json', 'superjson'])`\n *   (`config/schema.ts:147`) — a selector, not a transformer. `resolveTransformer` turns it into the\n *   functions, and it already ships from `theokit/server`. So this half is a literal like the rest,\n *   and the deployed entry resolves it exactly the way `theokit start` does\n *   (`cli/commands/start/index.ts:108`), from the same string, through the same function.\n * - **`plugins` genuinely carries functions.** A plugin is constructed in `theo.config.ts` and there\n *   is no literal for a closure, so this half needs the entry to import a module instead.\n *\n * ## Static import, not `import()` in the request path\n *\n * The tempting shortcut is `await import('../../theo.config.js')` inside the handler. It trades a\n * silent failure for a louder one on targets with no filesystem, and it moves configuration\n * resolution into every request on the targets that do have one.\n *\n * What this emits instead is a TOP-LEVEL import of a module the build already resolved and wrote\n * beside the entry — the same shape `renderBakedRoutes` uses for route modules (#369): decide on\n * the build machine, emit a static specifier. It is evaluated once at module load, the target's\n * bundler can see through it, and a plugin that needs an API the target lacks fails the build\n * rather than the first request.\n *\n * ## Why each half is optional\n *\n * An app that declares neither concern must produce the entry it produced before this existed.\n * Importing a module the build did not emit fails at load, and spreading an empty object costs an\n * allocation per request for nothing. So an empty request renders to nothing at all, and the\n * caller's `executeRoute` literal is unchanged.\n *\n * The halves are independent on purpose: an app that only picks `superjson` must not be made to\n * carry a plugins module, and an app with plugins and default JSON must not gain a transformer\n * lookup. Coupling them would have made the common case pay for the rare one.\n */\n\n/**\n * The option every Web-standards adapter grows to carry non-serialisable configuration.\n *\n * Composed into each adapter's option type the way `DeployedCsrfOptions` already is, so the six\n * targets cannot drift into six spellings of the same field.\n */\n/**\n * The project's `serverDir`, carried into every generated entrypoint (#RFC server-layout).\n *\n * Separate from the other option groups because it is not a runtime feature toggle: it is the\n * project's own layout, and an adapter that hardcodes `'server'` agrees with the default by\n * COINCIDENCE. The moment a project sets the option — the entire point of it existing — the\n * generated entrypoint resolves a directory that is not there, and only after deploy: the build\n * succeeds, the bundle is written, and routes 404 in production with nothing naming the cause.\n */\nexport interface DeployedServerDirOptions {\n  /** Project-relative server directory. Absent ⇒ the schema default, `server`. */\n  serverDir?: string\n}\n\n/**\n * The server directory as a quoted TypeScript literal, ready to interpolate into generated source.\n *\n * `JSON.stringify` rather than wrapping in quotes by hand: the value reaches this from user config,\n * so a directory containing a quote or a backslash would otherwise emit a syntax error into\n * somebody else's build — a worse failure than the one this fixes.\n */\nexport function serverDirLiteral(opts: DeployedServerDirOptions): string {\n  return JSON.stringify(opts.serverDir ?? 'server')\n}\n\n/**\n * The agents directory, same shape and same reason as `serverDir` above.\n *\n * `scanAgents(projectRoot, agentsDirName = 'agents')` takes the name as its SECOND parameter\n * (`server/scan/agent-scan.ts:56`). Nine call sites pass the configured value; the generated\n * deploy entry was the only one that did not, so the default won and a project whose agents live\n * under the documented `core/agents` (`config/schema.ts:66`) served none of them — 404 per agent,\n * after deploy, with nothing naming the cause. Measured 2026-09-21 by executing `buildBun`\n * against a config carrying both directories and reading what it emitted.\n */\nexport interface DeployedAgentsDirOptions {\n  /** Project-relative agents directory. Absent ⇒ the schema default, `agents`. */\n  agentsDir?: string\n}\n\nexport function agentsDirLiteral(opts: DeployedAgentsDirOptions): string {\n  return JSON.stringify(opts.agentsDir ?? 'agents')\n}\n\nexport interface DeployedRuntimeConfigOptions {\n  /**\n   * Specifier of the plugins module the build wrote beside the entry, or `undefined` when the app\n   * declares no plugins and the build wrote none.\n   */\n  runtimeConfigModule?: string\n  /**\n   * The app's `serialization` selector, carried as a literal.\n   *\n   * `'json'` and `undefined` both mean the default, and neither emits anything: `executeRoute`\n   * already falls back to `JSON.stringify`, and the `x-theo-transformer` header is deliberately\n   * absent for the default so a client is told only when there is something to be told.\n   */\n  serialization?: 'json' | 'superjson'\n}\n\n/** The three places an entry has to grow to carry non-serialisable configuration. */\nexport interface DeployedRuntimeConfigFragment {\n  /** Top-level imports. Empty when the build emitted no config module. */\n  readonly imports: string[]\n  /** Module-scope declarations — evaluated once, at load. Empty when there is nothing to carry. */\n  readonly declarations: string[]\n  /**\n   * Spread into the entry's `executeRoute({ … })` literal, inside an async function.\n   *\n   * Empty string when there is nothing to carry, so the call site keeps the exact shape it had.\n   */\n  readonly executeRouteSpread: string\n}\n\nconst EMPTY: DeployedRuntimeConfigFragment = {\n  imports: [],\n  declarations: [],\n  executeRouteSpread: '',\n}\n\n/**\n * What a deployed entry needs in order to apply `config.plugins` and `config.serialization`.\n *\n * @param moduleSpecifier - specifier of the runtime-config module the build emitted beside the\n *   entry, or `undefined` when the app declared neither concern and the build emitted none.\n */\nexport function deployedRuntimeConfigFragment(\n  options: DeployedRuntimeConfigOptions | undefined,\n): DeployedRuntimeConfigFragment {\n  const pluginsModule = options?.runtimeConfigModule\n  // 'json' is the default and emits nothing — see `serialization` above.\n  const serialization = options?.serialization === 'superjson' ? 'superjson' : undefined\n  if (pluginsModule === undefined && serialization === undefined) return EMPTY\n\n  const imports: string[] = []\n  const declarations: string[] = []\n  const spread: string[] = []\n\n  if (pluginsModule !== undefined) {\n    imports.push(\n      `import { createPluginRunnerFromConfig } from 'theokit/server'`,\n      `// #425 — the app's own plugins, resolved on the build machine and written beside this entry.`,\n      `// A closure has no literal, so this is an import rather than a baked value.`,\n      `import theoRuntimeConfig from '${pluginsModule}'`,\n    )\n    declarations.push(\n      `// Built ONCE, at module load. A runner rebuilt per request would re-run every plugin's`,\n      `// \\`register\\`, which is where a plugin allocates the state its hooks then read.`,\n      `const THEO_PLUGIN_RUNNER = createPluginRunnerFromConfig(theoRuntimeConfig.plugins)`,\n    )\n    // Awaited, not passed along: `createPluginRunnerFromConfig` is async because `register` is, and\n    // a pending promise handed to `executeRoute` is a truthy object with none of the runner's\n    // methods — every hook would silently not fire, which is this issue's own defect one layer in.\n    spread.push(`pluginRunner: await THEO_PLUGIN_RUNNER`)\n  }\n\n  if (serialization !== undefined) {\n    imports.push(`import { resolveTransformer } from 'theokit/server'`)\n    declarations.push(\n      `// #425 — a literal, because \\`config.serialization\\` is a SELECTOR and not a transformer.`,\n      `// Same string, same function \\`theokit start\\` calls, so the deployed response and the local`,\n      `// one cannot disagree about what the app asked for — including the \\`x-theo-transformer\\``,\n      `// header, whose absence is what made this a data bug rather than a formatting one.`,\n      `const THEO_TRANSFORMER = resolveTransformer('${serialization}')`,\n    )\n    spread.push(`transformer: THEO_TRANSFORMER`)\n  }\n\n  return { imports, declarations, executeRouteSpread: `${spread.join(', ')},` }\n}\n","/**\n * The request id a deployed entry uses, and the header it echoes back.\n *\n * ## The defect this closes\n *\n * Every generated entry minted a fresh `randomUUID()` per request and set no correlation header\n * at all on a success path (usetheokit/theokit#410). Both Node paths do the opposite: they resolve\n * an incoming `traceparent` / `x-request-id` through `extractTraceId` and echo the result under\n * both `x-request-id` and `x-trace-id` (`cli/commands/start/request-handler.ts`,\n * `vite-plugin/api-middleware.ts`).\n *\n * The consequence is that a trace crossing into a deployed function starts over. The caller's id\n * is discarded, and the response carries nothing to correlate against — so a request that fails in\n * production cannot be tied to the client that made it, which is the one situation the id exists\n * for.\n *\n * ## Why `setHeader` before the handler, rather than wrapping the response\n *\n * It is what the Node path does, and the shim reproduces Node's semantics exactly: `writeHead`\n * MERGES into the header map rather than replacing it (`web-shim.ts`), so a header set here\n * survives the handler's own `writeHead` and a handler that sets its own id still wins. Wrapping\n * the finished `Response` instead would have to mutate a response whose body is already streaming\n * (#382), and would miss the branches that return before the shim is built.\n */\n\n/**\n * Lines that resolve the request id and echo it, as generated source.\n *\n * @param requestVar - the name the entry gave the Web `Request` in scope\n * @param indent - leading whitespace, so the emitted file stays readable\n */\nexport function deployedTraceFragment(requestVar: string, indent: string): string[] {\n  return [\n    `${indent}// #410 — honour the caller's trace id instead of minting a new one, and echo it.`,\n    `${indent}// \\`extractTraceIdFromRequest\\` validates the caller-controlled \\`x-request-id\\``,\n    `${indent}// before trusting it, and falls back to a fresh UUID when neither header is present.`,\n    `${indent}const requestId = extractTraceIdFromRequest(${requestVar})`,\n    `${indent}res.setHeader('x-request-id', requestId)`,\n    `${indent}res.setHeader(TRACE_HEADER, requestId)`,\n  ]\n}\n"],"mappings":";;;;;;;AAgEA,IAAM,QAAgC,EAAE,SAAS,CAAC,GAAG,cAAc,CAAC,GAAG,QAAQ,CAAC,GAAG,YAAY,GAAG;AAqGlG,IAAM,kBAAkB;AAAA,EACtB;AAAA,EACA;AACF;AAGA,IAAM,eAAe;AAYrB,IAAM,oBAAoB;AAuBnB,SAAS,uBAAuBA,mBAAiD;AACtF,SAAO;AAAA,IACL,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAAA;AAAA,IACA,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,cAAc;AAAA,EAChB;AACF;AAQO,IAAM,0BAA0B;AAEhC,SAAS,uBACd,QACA,OAA2B,CAAC,GACJ;AACxB,MAAI,WAAW,OAAW,QAAO;AACjC,MAAI,OAAO,SAAS,WAAW,OAAO,OAAO,WAAW,EAAG,QAAO;AAElE,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,SAAS,KAAK,gBAAgB;AAEpC,QAAM,aACJ,OAAO,SAAS,UACZ,gBAAgB,OAAO,QAAQ,OAAO,eAAe,KAAK,gBAAgB,IAC1E,kBAAkB,EAAE,GAAG,QAAQ,kBAAkB,KAAK,iBAAiB,CAAC;AAE9E,SAAO;AAAA,IACL,YAAY,8BAA8B,QAAQ;AAAA,IAClD,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMP,iFAAiF,WAAW,cAAc,GAAG,OAAO,SAAS,SAAS,iBAAiB,EAAE,YAAY,MAAM;AAAA,MAC3K,GAAG,WAAW;AAAA,IAChB;AAAA,IACA,cAAc;AAAA,MACZ,GAAG,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAed,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAeP;AAAA,MACA,GAAG,WAAW;AAAA,MACd;AAAA,MACA;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS,QAAQ,eAAe,KAAK,UAAU,YAAY,CAAC;AAAA,MAC5D,SAAS,QAAQ,eAAe,KAAK,UAAU,iBAAiB,CAAC;AAAA,MACjE;AAAA,MACA,GAAG,WAAW;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,mEAAmE,QAAQ;AAAA,MAC3E;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK,wBAAwB,OACzB,sEACA;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc,QAAQ,eAAe,KAAK,UAAU,YAAY,CAAC,aAAa,QAAQ;AAAA,MACtF,2BAA2B,QAAQ,UAAU,OAAO,aAAa,MAAM,CAAC;AAAA,MACxE,GAAG,WAAW;AAAA,MACd;AAAA,MACA;AAAA,MACA,uCAAuC,QAAQ;AAAA,MAC/C;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK,wBAAwB,OACzB,sEACA;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACF;AAoCA,SAAS,gBACP,QACA,eACA,kBACiB;AACjB,QAAM,QAAQ,CAAC,UAA0B,cAAc,OAAO,KAAK,CAAC;AACpE,SAAO;AAAA,IACL,SAAS;AAAA,MACP,GAAG,OAAO,IAAI,CAAC,OAAO,UAAU,eAAe,MAAM,KAAK,CAAC,gBAAgB,MAAM,QAAQ,GAAG;AAAA;AAAA,MAE5F,GAAI,kBAAkB,SAClB,CAAC,IACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAgBE,6CAA6C,aAAa;AAAA,MAC5D;AAAA,IACN;AAAA,IACA,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAG,OAAO,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,UAAU,MAAM,IAAI,CAAC,KAAK,MAAM,KAAK,CAAC,GAAG;AAAA,MACnF;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAG,OAAO;AAAA,QACR,CAAC,UACC,iBAAiB,KAAK,UAAU,MAAM,QAAQ,CAAC,gBAAgB,KAAK,UAAU,MAAM,SAAS,CAAC,WAAW,KAAK,UAAU,MAAM,IAAI,CAAC;AAAA,MACvI;AAAA,MACA;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,gBAAgB,kBAAkB,SAAY,KAAK;AAAA,IACnD,UACE,kBAAkB,SACd;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MASA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,oBAAoB,WAAW;AAAA,MACtC;AAAA,IACF;AAAA,IACN,YAAY;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAG;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;AAGA,SAAS,kBAAkB,QAOP;AAGlB,QAAM,eAAe,OAAO,qBAAqB,SAAY,KAAK,KAAK,OAAO,gBAAgB;AAE9F,SAAO;AAAA,IACL,SAAS,CAAC;AAAA,IACV,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN;AAAA,MACA,iEAAiE,OAAO,UAAU;AAAA,IACpF;AAAA,IACA,gBAAgB,OAAO,cAAc,SAAY,KAAK;AAAA,IACtD,UACE,OAAO,cAAc,SACjB,CAAC,0CAA0C,IAC3C;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,mBAAmB,OAAO,UAAU;AAAA,MACpC,kBAAkB,OAAO,SAAS;AAAA,MAClC,qBAAqB,OAAO,oBAAoB,WAAW;AAAA,MAC3D;AAAA,IACF;AAAA,IACN,YAAY;AAAA,MACV,GAAI,OAAO,iBAAiB,SAAY,CAAC,IAAI,CAAC,SAAS,OAAO,YAAY,EAAE;AAAA,MAC5E;AAAA,MACA;AAAA,MACA;AAAA,MACA,oDAAoD,OAAO,WAAW,GAAG,YAAY;AAAA,MACrF;AAAA,MACA;AAAA,MACA,uBAAuB,OAAO,UAAU;AAAA,MACxC;AAAA,MACA,GAAG;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;;;AC3eO,IAAM,gCAAN,cAA4C,MAAM;AAAA,EACvD,YAAY,QAAgB;AAC1B;AAAA,MACE,kDAAkD,MAAM;AAAA,IAI1D;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAGA,SAAS,aAAa,QAAiB,QAAwB;AAC7D,MAAI,OAAO,WAAW,WAAY,OAAM,IAAI,8BAA8B,MAAM;AAChF,MAAI,kBAAkB,OAAQ,QAAO,OAAO,MAAM;AAClD,MAAI,MAAM,QAAQ,MAAM,EAAG,QAAO,IAAI,OAAO,IAAI,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC;AAC3F,SAAO,KAAK,UAAU,MAAM;AAC9B;AAWO,SAAS,0BAA0B,MAA8B,QAAwB;AAC9F,MAAI,SAAS,OAAW,QAAO;AAE/B,QAAM,QAAQ,CAAC,YAAY,aAAa,KAAK,SAAS,MAAM,CAAC,EAAE;AAC/D,MAAI,KAAK,YAAY,OAAW,OAAM,KAAK,YAAY,KAAK,UAAU,KAAK,OAAO,CAAC,EAAE;AACrF,MAAI,KAAK,mBAAmB;AAC1B,UAAM,KAAK,mBAAmB,KAAK,UAAU,KAAK,cAAc,CAAC,EAAE;AACrE,MAAI,KAAK,mBAAmB;AAC1B,UAAM,KAAK,mBAAmB,KAAK,UAAU,KAAK,cAAc,CAAC,EAAE;AAGrE,QAAM;AAAA,IACJ,gBAAgB,KAAK,UAAU,KAAK,WAAW,CAAC;AAAA,IAChD,WAAW,KAAK,UAAU,KAAK,MAAM,CAAC;AAAA,EACxC;AAEA,SAAO,KAAK,MAAM,KAAK,IAAI,CAAC;AAC9B;AAQO,SAAS,qBAAqB,MAA8B,QAA0B;AAC3F,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,uBAAuB,0BAA0B,MAAM,MAAM,CAAC;AAAA,IAC9D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;ACxEA,SAAS,mBAAmB,SAAkC;AAC5D,SAAO,mBAAmB,SAAS,OAAO,OAAO,IAAI,KAAK,UAAU,OAAO;AAC7E;AAWO,SAAS,0BAA0B,UAAmD;AAC3F,MAAI,aAAa,OAAW,QAAO;AAEnC,QAAM,QAAkB,CAAC;AACzB,MAAI,SAAS,SAAS,OAAW,OAAM,KAAK,aAAa,KAAK,UAAU,SAAS,IAAI,CAAC,EAAE;AAExF,QAAM,EAAE,WAAW,IAAI;AACvB,MAAI,eAAe,QAAW;AAC5B,UAAM,SAAS,WAAW,OAAO,IAAI,kBAAkB,EAAE,KAAK,IAAI;AAClE,UAAM;AAAA,MACJ,0BAA0B,MAAM,gBAAgB,KAAK,UAAU,WAAW,QAAQ,CAAC;AAAA,IACrF;AAAA,EACF;AAIA,SAAO,MAAM,WAAW,IAAI,OAAO,KAAK,MAAM,KAAK,IAAI,CAAC;AAC1D;AAcO,SAAS,qBACd,MACA,OAAO,uBACG;AACV,SAAO;AAAA,IACL;AAAA,IACA,wDAAwD,IAAI;AAAA,IAC5D;AAAA,IACA;AAAA,IACA,uBAAuB,0BAA0B,IAAI,CAAC;AAAA,EACxD;AACF;;;ACTO,SAAS,4BAA4B,QAAqD;AAC/F,SAAO;AAAA,IACL,mCAAmC,mCAAmC,MAAM,CAAC;AAAA,IAC7E;AAAA,EACF;AACF;AAEO,SAAS,mCACd,SACQ;AACR,SAAO,KAAK,UAAU,WAAW,CAAC,CAAC;AACrC;AA8EO,SAAS,gCAAgC,QAA8C;AAC5F,QAAM,UAAU,qBAAqB,OAAO,mBAAmB,CAAC,GAAG,EAAE,YAAY,KAAK,CAAC;AACvF,QAAM,QAAQ,OAAO,KAAK,OAAO;AACjC,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO,SAAS,OAAO,MAAM;AAAA,EAC/B;AAEA,QAAM,QAAQ;AAAA,IACZ,iDAA4C,OAAO,MAAM,eAAe,MAAM,KAAK,IAAI,CAAC;AAAA,EAC1F;AACA,QAAM,WAAW,MAAM,KAAK,CAAC,SAAS,KAAK,WAAW,yBAAyB,CAAC;AAChF,MAAI,YAAY,CAAC,OAAO,YAAY;AAClC,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,oBAAoB,uBAAuB;AACpD,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,oBAAoB,sBAAsB;AACnD,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;;;AC3KO,IAAM,+BAAN,cAA2C,MAAM;AAAA,EAEtD,YACW,QACA,QACT,MACA;AACA;AAAA,MACE;AAAA,QACE,2BAA2B,MAAM;AAAA,QACjC;AAAA,QACA,KAAK,MAAM;AAAA,QACX;AAAA,QACA;AAAA,QACA,GAAG,KAAK,IAAI,CAAC,MAAM,cAAS,CAAC,EAAE;AAAA,QAC/B;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI;AAAA,IACb;AAhBS;AACA;AAAA,EAgBX;AAAA,EAjBW;AAAA,EACA;AAAA,EAHO,OAAO;AAoB3B;AAwCA,IAAM,aAAa;AAkBnB,IAAM,eAAe,oBAAI,IAAI;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAcD,SAAS,oBAAoB,OAAgB,QAAsB;AACjE,MAAI,UAAU,OAAW;AAEzB,MAAI,CAAC,cAAc,KAAK,GAAG;AACzB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,EAAE,QAAQ,KAAK,QAAQ,IAAI;AAEjC,MAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,GAAG;AAC/C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,CAAC,sCAAsC,cAAc;AAAA,IACvD;AAAA,EACF;AAEA,MAAI,OAAO,YAAY,YAAY,CAAC,WAAW,KAAK,OAAO,KAAK,aAAa,IAAI,OAAO,GAAG;AACzF,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MAIA;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AASA,QAAM,EAAE,QAAQ,IAAI;AACpB,MAAI,YAAY,QAAW;AACzB,QAAI,OAAO,YAAY,YAAY,YAAY,QAAQ,MAAM,QAAQ,OAAO,GAAG;AAC7E,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,YAAY,OAAO,QAAQ,OAAkC,EAAE;AAAA,MACnE,CAAC,CAAC,EAAE,CAAC,MAAM,OAAO,MAAM,YAAY,OAAO,MAAM,YAAY,OAAO,MAAM;AAAA,IAC5E;AACA,QAAI,cAAc,QAAW;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,QACA,sCAAsC,UAAU,CAAC,CAAC;AAAA,QAClD;AAAA,UACE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AASA,SAAS,cAAc,OAAyB;AAC9C,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAeA,SAAS,kBACP,WACA,QAC+B;AAC/B,MAAI,cAAc,OAAW,QAAO;AACpC,QAAM,MAAM;AAEZ,MAAI,OAAO,IAAI,UAAU,YAAY;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,UAAU,aAAa,IAAI,UAAU,QAAQ;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,MACA,gCAAgC,IAAI,KAAK;AAAA,MACzC;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,sBAAoB,IAAI,OAAO,MAAM;AAErC,MAAI,IAAI,WAAW,QAAW;AAC5B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAW,IAAI;AACrB,QAAM,MAAM,IAAI;AAChB,MAAI,OAAO,aAAa,YAAY,OAAO,QAAQ,SAAU,QAAO;AAIpE,QAAM,aAAa,IAAI;AACvB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,YACE,OAAO,eAAe,aAAa,OAAO,eAAe,WAAW,aAAa;AAAA;AAAA;AAAA,IAGnF,OAAO,IAAI;AAAA,EACb;AACF;AAYO,SAAS,0BACd,WACA,QACA,mBASA,SAAS,mBAeT,eAAe,IACL;AACV,QAAM,QAAQ,kBAAkB,WAAW,MAAM;AACjD,MAAI,UAAU,OAAW,QAAO,CAAC;AACjC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,qCAAqC,YAAY;AAAA,IACjD,GAAI,MAAM,UAAU,SAChB;AAAA,MACE,mDAAmD,MAAM,QAAQ,UAAU,MAAM,GAAG;AAAA,IACtF,IACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAME,YAAY,MAAM,MAAM,OAAO,WAAW,KAAK,UAAU,MAAM,MAAM,MAAM,CAAC;AAAA,MAC5E,gCAAgC,MAAM,MAAM,OAAO,IAAI,KAAK,UAAU,MAAM,MAAM,WAAW,CAAC,CAAC,CAAC;AAAA,MAChG;AAAA,MACA,iBAAiB,MAAM,QAAQ,UAAU,MAAM,GAAG;AAAA,MAClD;AAAA,MACA;AAAA,IACF;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,uBAAuB,KAAK,UAAU,MAAM,UAAU,CAAC;AAAA,IACvD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,0BAA0B,MAAM;AAAA,IAChC,iBAAiB,iBAAiB;AAAA,IAClC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,qEAAqE,KAAK;AAAA,MACxE,GAAG,MAAM;AAAA,IACX,CAAC;AAAA,IACD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAaO,SAAS,uBACd,WACA,QAEA,OAAO,mBAEP,SAAS,uFAET,gBAAgB,oFACN;AACV,MAAI,cAAc,OAAW,QAAO,CAAC;AACrC,SAAO;AAAA,IACL,GAAG,MAAM,gCAAgC,IAAI;AAAA,IAC7C,GAAG,MAAM;AAAA,IACT,GAAG,MAAM,KAAK,aAAa;AAAA,IAC3B,GAAG,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOT,GAAG,MAAM;AAAA,IACT,GAAG,MAAM;AAAA,IACT,GAAG,MAAM,KAAK,MAAM;AAAA,IACpB,GAAG,MAAM;AAAA,EACX;AACF;;;ACjaO,SAAS,iBAAiB,MAAwC;AACvE,SAAO,KAAK,UAAU,KAAK,aAAa,QAAQ;AAClD;AAiBO,SAAS,iBAAiB,MAAwC;AACvE,SAAO,KAAK,UAAU,KAAK,aAAa,QAAQ;AAClD;AAgCA,IAAMC,SAAuC;AAAA,EAC3C,SAAS,CAAC;AAAA,EACV,cAAc,CAAC;AAAA,EACf,oBAAoB;AACtB;AAQO,SAAS,8BACd,SAC+B;AAC/B,QAAM,gBAAgB,SAAS;AAE/B,QAAM,gBAAgB,SAAS,kBAAkB,cAAc,cAAc;AAC7E,MAAI,kBAAkB,UAAa,kBAAkB,OAAW,QAAOA;AAEvE,QAAM,UAAoB,CAAC;AAC3B,QAAM,eAAyB,CAAC;AAChC,QAAM,SAAmB,CAAC;AAE1B,MAAI,kBAAkB,QAAW;AAC/B,YAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA,kCAAkC,aAAa;AAAA,IACjD;AACA,iBAAa;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAIA,WAAO,KAAK,wCAAwC;AAAA,EACtD;AAEA,MAAI,kBAAkB,QAAW;AAC/B,YAAQ,KAAK,qDAAqD;AAClE,iBAAa;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,gDAAgD,aAAa;AAAA,IAC/D;AACA,WAAO,KAAK,+BAA+B;AAAA,EAC7C;AAEA,SAAO,EAAE,SAAS,cAAc,oBAAoB,GAAG,OAAO,KAAK,IAAI,CAAC,IAAI;AAC9E;;;ACpJO,SAAS,sBAAsB,YAAoB,QAA0B;AAClF,SAAO;AAAA,IACL,GAAG,MAAM;AAAA,IACT,GAAG,MAAM;AAAA,IACT,GAAG,MAAM;AAAA,IACT,GAAG,MAAM,+CAA+C,UAAU;AAAA,IAClE,GAAG,MAAM;AAAA,IACT,GAAG,MAAM;AAAA,EACX;AACF;","names":["agentsDirLiteral","EMPTY"]}

package/dist/{chunk-YWWMYEAC.js → chunk-CLSYYO5F.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-O2KGDLA7.js";
 import {
   validateRouteInput
-} from "./chunk-4D4YVXHR.js";
+} from "./chunk-SYIQV4UH.js";
 import {
   evaluateRoutePolicy,
   subjectFromContext
@@ -296,4 +296,4 @@ export {
   callProcedure,
   createOpenApiHandler
 };
-//# sourceMappingURL=chunk-YWWMYEAC.js.map
+//# sourceMappingURL=chunk-CLSYYO5F.js.map

package/dist/{chunk-OSBGZYXZ.js → chunk-D2R5SJEL.js}

@@ -7,9 +7,23 @@ var baseRateLimitSchema = z.object({
   windowMs: z.number().min(1),
   max: z.number().int().min(1)
 });
+var rateLimitStoreSchema = z.object({
+  /** The specifier the generated entry imports from, e.g. `@upstash/redis`. */
+  module: z.string().min(1),
+  /** The exported name it constructs. Must be a plain identifier — see the build-time refusal. */
+  factory: z.string().min(1),
+  /** Constructor options, written into the entry as a JSON literal. */
+  options: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional()
+});
 var rateLimitSchema = z.union([
-  baseRateLimitSchema,
+  // B-257 — `store` is declared on BOTH branches. `z.object` STRIPS unknown keys, so a config
+  // carrying a store matched the base branch, lost it silently, and the build then refused the
+  // target with the pre-B-257 message while the operator had done exactly what the feature asks.
+  // Measured before the fix: `theoConfigSchema.parse` returned `{windowMs, max}` from a config
+  // whose store block was present.
+  baseRateLimitSchema.extend({ store: rateLimitStoreSchema.optional() }),
   z.object({
+    store: rateLimitStoreSchema.optional(),
     default: baseRateLimitSchema.optional(),
     routes: z.record(z.string(), baseRateLimitSchema).optional(),
     keyBy: z.union([
@@ -208,4 +222,4 @@ export {
   securitySchema,
   storageSchema
 };
-//# sourceMappingURL=chunk-OSBGZYXZ.js.map
+//# sourceMappingURL=chunk-D2R5SJEL.js.map

package/dist/chunk-D2R5SJEL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config/schemas/rate-limit.ts","../src/config/schemas/upload.ts","../src/config/schemas/logging.ts","../src/config/schemas/cache.ts","../src/config/schemas/observability.ts","../src/config/schemas/security.ts","../src/config/schemas/header-safe.ts","../src/config/schemas/storage.ts"],"sourcesContent":["import { z } from 'zod'\n\n/**\n * Base bucket config — legacy shape preserved for backwards compatibility.\n */\nconst baseRateLimitSchema = z.object({\n  windowMs: z.number().min(1),\n  max: z.number().int().min(1),\n})\n\n/**\n * B-257 — the durable counter a deployment brings, in the form a generated entry can construct.\n *\n * A reference, never an instance: the entry is generated SOURCE, so whatever is named here has to\n * survive being written into a file. `factory` is the field that cannot be escaped — it lands as a\n * bare identifier in `import { <factory> }` — and `adapters/deployed-rate-limit.ts` validates it\n * there rather than here, because the refusal must name the TARGET being built.\n *\n * The framework ships no store. `server/rate-limit/rate-limit-store.ts:5-7` names Redis and\n * Cloudflare KV as what a deployment opts into, and `docs/adr/0017` states why the framework picks\n * none for anybody.\n */\nconst rateLimitStoreSchema = z.object({\n  /** The specifier the generated entry imports from, e.g. `@upstash/redis`. */\n  module: z.string().min(1),\n  /** The exported name it constructs. Must be a plain identifier — see the build-time refusal. */\n  factory: z.string().min(1),\n  /** Constructor options, written into the entry as a JSON literal. */\n  options: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional(),\n})\n\n/**\n * T2.2 — Per-route + per-user rate limit. The new shape adds `routes`\n * (path map), `keyBy`, and `cookieName`. The legacy flat shape is still\n * accepted via the union — see `createRouteRateLimiter` for normalization.\n */\nexport const rateLimitSchema = z.union([\n  // B-257 — `store` is declared on BOTH branches. `z.object` STRIPS unknown keys, so a config\n  // carrying a store matched the base branch, lost it silently, and the build then refused the\n  // target with the pre-B-257 message while the operator had done exactly what the feature asks.\n  // Measured before the fix: `theoConfigSchema.parse` returned `{windowMs, max}` from a config\n  // whose store block was present.\n  baseRateLimitSchema.extend({ store: rateLimitStoreSchema.optional() }),\n  z.object({\n    store: rateLimitStoreSchema.optional(),\n    default: baseRateLimitSchema.optional(),\n    routes: z.record(z.string(), baseRateLimitSchema).optional(),\n    keyBy: z\n      .union([\n        z.enum(['ip', 'session', 'user']),\n        z.function({ input: z.tuple([z.unknown()]), output: z.string() }),\n      ])\n      .optional(),\n    cookieName: z.string().min(1).optional(),\n    /**\n     * How many reverse proxies sit in front of the app, for `keyBy: 'ip'`. `false` (default)\n     * trusts none; `true` means one; a number names a longer chain.\n     *\n     * Required for correct limiting behind Caddy/nginx/a load balancer — without it every visitor\n     * keys on the proxy address and shares a single bucket. Off by default because\n     * `x-forwarded-for` is client-writable.\n     */\n    trustProxy: z.union([z.boolean(), z.number().int().min(0)]).optional(),\n  }),\n])\n","import { z } from 'zod'\n\nexport const uploadSchema = z.object({\n  maxFileSize: z\n    .number()\n    .min(1)\n    .default(10 * 1024 * 1024), // 10MB\n  maxFiles: z.number().int().min(1).default(10),\n  maxFieldSize: z\n    .number()\n    .min(1)\n    .default(1 * 1024 * 1024), // 1MB\n})\n","import { z } from 'zod'\n\nexport const loggingSchema = z.object({\n  level: z.enum(['debug', 'info', 'warn', 'error', 'silent']).default('info'),\n})\n","import { z } from 'zod'\n\n// `.finite()` was removed from the 4 numeric schemas below (agent-builder#319): in zod 4 it is a\n// no-op — `z.number()` already rejects `Infinity`, `-Infinity` and `NaN` by default. Measured before\n// removing, against the installed zod 4.4.3, and not assumed from the deprecation message: all five\n// cases (`Infinity`, `-Infinity`, `NaN`, `1.5`, `0`) give the SAME verdict with and without it.\n\n/**\n * Cache subsystem config (caching-and-revalidation-plan).\n * Default `cache: undefined` keeps the framework backward-compatible\n * (no engine initialized → no cache primitives available).\n *\n * Setting `cache: {}` opts in with all defaults.\n */\nconst routeRuleSchema = z.object({\n  maxAge: z.number().nonnegative().optional(),\n  swr: z.number().nonnegative().optional(),\n  tags: z.array(z.string()).optional(),\n})\n\nexport const cacheSchema = z.object({\n  enabled: z.boolean().default(true),\n  /** 'memory' uses InMemoryCacheAdapter; otherwise pass a custom adapter instance. */\n  storage: z.union([z.literal('memory'), z.custom<unknown>()]).default('memory'),\n  maxEntries: z.number().int().positive().default(1000),\n  defaults: z\n    .object({\n      maxAge: z.number().nonnegative().default(1),\n      swr: z.number().nonnegative().optional(),\n      cacheErrors: z.boolean().default(false),\n    })\n    .default({ maxAge: 1, cacheErrors: false }),\n  keyDerivation: z\n    .object({\n      excludeQuery: z.array(z.string()).optional(),\n      sortQuery: z.boolean().default(true),\n      lowercaseHost: z.boolean().default(true),\n    })\n    .default({ sortQuery: true, lowercaseHost: true }),\n  routeRules: z.record(z.string(), routeRuleSchema).optional(),\n})\n","import { z } from 'zod'\n\n/**\n * Observability subsystem config.\n *\n * `adapter-registry.ts` has documented `theo.config.ts > observability.provider`\n * as the first source in its resolution chain since it was written, and the key\n * did not exist in the schema — so the chain's highest-priority entry was\n * unreachable and every consumer fell through to the environment\n * (usetheokit/theokit#353).\n *\n * Default `observability: undefined` keeps telemetry off, which is what an\n * application that never asked for it should get.\n */\nexport const observabilitySchema = z.object({\n  /** Set `false` to opt out even when the environment would enable an exporter. */\n  enabled: z.boolean().default(true),\n  /**\n   * An `ObservabilityAdapter` instance. Validated structurally rather than by\n   * shape, for the same reason `storage` and `plugins` are: the config layer\n   * cannot import the adapter contract without inverting the module graph, and\n   * the adapter is a live object rather than data.\n   */\n  provider: z.custom<unknown>().optional(),\n})\n","import { z } from 'zod'\n\nimport { headerSafeString } from './header-safe.js'\n\n/**\n * Phase 5 — CSRF warn-first (EC-1).\n *\n * 0.2.0 default: `warn`. Existing apps keep working but get structured\n * warnings about every state-mutating request that does not carry the\n * `X-Theo-Action: 1` header. 0.3.0 will flip the default to `strict`.\n *\n * Set explicitly to `strict` to opt into the future default early,\n * or `off` to disable CSRF entirely (only valid when you have another\n * defense — bearer auth, no session cookies, etc).\n */\n\n/**\n * Phase 6 — Default security headers (D4 / EC-2).\n *\n * 0.2.0 defaults:\n *   - CSP in `report-only` mode (EC-2: don't break existing apps)\n *   - X-Frame-Options: DENY · X-Content-Type-Options: nosniff\n *   - Referrer-Policy: strict-origin-when-cross-origin\n *   - HSTS in production only (no TLS on localhost)\n *\n * Users override individual headers, swap CSP to `enforce`, or disable\n * CSP entirely (`csp: false` / `cspMode: 'off'`).\n */\nexport const securityHeadersSchema = z.object({\n  csp: z.union([headerSafeString, z.literal(false)]).optional(),\n  // T6.1 — default flipped from 'report-only' to 'enforce' for 0.3.0.\n  // Users who want the old behaviour set `cspMode: 'report-only'`\n  // explicitly.\n  cspMode: z.enum(['enforce', 'report-only', 'off']).default('enforce'),\n  hsts: z.union([headerSafeString, z.literal(false)]).optional(),\n  frameOptions: z.enum(['DENY', 'SAMEORIGIN']).default('DENY'),\n  contentTypeOptions: z.literal('nosniff').default('nosniff'),\n  referrerPolicy: headerSafeString.default('strict-origin-when-cross-origin'),\n  /**\n   * T1.1 — Permissions-Policy directive string. EC-3-refined: rejects CR/LF.\n   * Pass `false` to suppress the header.\n   */\n  permissionsPolicy: z.union([headerSafeString, z.literal(false)]).optional(),\n})\n\n/**\n * T5.1 — Disallowed-routes escalation pattern (Rails-inspired).\n *\n * `routes` accepts string (exact match — trailing slash matters) or\n * RegExp entries. Matched routes that would otherwise emit `csrf.warn`\n * dispatch through `disallowedBehavior` instead:\n *   - `'warn'`  : no-op vs the default warn-mode behavior\n *   - `'raise'` : escalate to 403, even when global `csrf` mode is 'warn'\n *\n * Use to roll out strict mode per-route (e.g., flip /api/auth/* first)\n * without committing the entire surface to strict at once.\n */\nconst disallowedConfigSchema = z.object({\n  routes: z.array(z.union([z.string(), z.instanceof(RegExp)])),\n  behavior: z.enum(['warn', 'raise']).default('raise'),\n})\n\n/**\n * T1.2 — CORS configuration.\n *\n * `origins` accepts a single value (`'*'`, string, RegExp, callback) OR an\n * array of (string | RegExp). The spec-violating `origins: '*'` +\n * `credentials: true` combination is rejected at parse time (browsers\n * ignore wildcards when credentials are sent).\n *\n * EC-3 — `allowedHeaders` and `exposedHeaders` entries go through the\n * header-safe refinement (CR/LF rejected — CWE-113 mitigation).\n */\nexport const corsSchema = z\n  .object({\n    origins: z.union([\n      z.literal('*'),\n      headerSafeString,\n      z.instanceof(RegExp),\n      z.array(z.union([headerSafeString, z.instanceof(RegExp)])),\n      z.function({ input: z.tuple([z.string()]), output: z.boolean() }),\n    ]),\n    methods: z\n      .array(z.enum(['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS', 'HEAD']))\n      .optional(),\n    allowedHeaders: z.array(headerSafeString).optional(),\n    exposedHeaders: z.array(headerSafeString).optional(),\n    credentials: z.boolean().default(false),\n    maxAge: z.number().int().min(0).max(86400).default(600),\n  })\n  .refine((c) => !(c.origins === '*' && c.credentials), {\n    message: 'CORS spec forbids origins:\"*\" with credentials:true — browsers ignore the wildcard',\n  })\n\nexport const securitySchema = z.object({\n  // T6.1 — default flipped from 'warn' to 'strict' for 0.3.0. Apps that\n  // grep their warn-mode logs from 0.2.x already know which endpoints\n  // break; opt back into 'warn' globally OR use disallowedRoutes for\n  // surgical migration.\n  csrf: z.enum(['off', 'warn', 'strict']).default('strict'),\n  headers: securityHeadersSchema.optional(),\n  /** T5.1 — per-route escalation (Rails disallowed_warnings pattern). */\n  disallowed: disallowedConfigSchema.optional(),\n  /** T1.2 — Cross-Origin Resource Sharing. Single global config; runs first in pipeline. */\n  cors: corsSchema.optional(),\n  /**\n   * Permit binding a public network interface while write routes still declare `policy('public')`.\n   *\n   * Absent means `false`, and that is the point: `theo start` refuses that combination rather\n   * than serving it, because an unauthenticated POST reachable from a network is an open endpoint\n   * whether or not anyone meant it to be. See `cli/commands/start/public-exposure-gate.ts` for what\n   * is refused and — equally important — what is not.\n   *\n   * Setting it to `true` is a decision, not a switch: the routes stay open, the startup log goes on\n   * naming every one of them, and this line in `theo.config.ts` is what an auditor finds when they\n   * ask who agreed to it.\n   *\n   * `.optional()` rather than `.default(false)`: a Zod default lands in the OUTPUT type, so every\n   * caller constructing a `SecurityConfig` literal would have to name a field they do not care\n   * about. The reader supplies the fallback (`?? false`), which keeps absent and false identical\n   * where it matters and keeps the type unchanged for everyone else.\n   */\n  allowUnauthenticatedWrites: z.boolean().optional(),\n})\n","import { z } from 'zod'\n\n/**\n * EC-3 — CWE-113 HTTP Response Splitting mitigation.\n *\n * Every string that becomes a header value must reject CR/LF. Apps that\n * derive header values from untrusted input (feature flags, tenant config,\n * URL params) would otherwise let attackers inject Set-Cookie / Location\n * headers via `\\r\\n`. Apply this refinement to every header-bound string\n * field: permissionsPolicy, csp, hsts, referrerPolicy, CORS allow/expose.\n */\nexport const headerSafeString = z\n  .string()\n  .refine((s) => !/[\\r\\n]/.test(s), { message: 'Header value must not contain CR/LF' })\n","import { z } from 'zod'\n\n/**\n * StorageManager schemas (T1.1 / ADR-0007 D4).\n *\n * `theo.config.ts > storage` declares Postgres servers (credentials), the\n * databases on each server (TheoCloud / managed PG / self-host), and Redis\n * servers. The runtime `StorageManager` consumes this block; adapters\n * (PostgresJobBackend, PostgresConversationStorage, etc.) request pools by\n * database name and never see raw credentials at the call site.\n *\n * EC-1 (DOCUMENT in concept doc T4.1): Zod default strip-unknown mode\n * silently drops typo keys (`databasees` instead of `databases`). The\n * concept doc warns users to use exact names; runtime errors are still\n * actionable (`Database \"X\" not configured`).\n *\n * EC-2 (DEFERRED to use-time): `databases.X.server` references a key in\n * `servers`. Cross-field validation is intentionally NOT enforced at parse\n * time — `StorageManager.usePostgres()` throws an actionable error on the\n * first call with the dangling reference, matching Rails / Nitro behavior.\n */\nconst tlsConfigSchema = z.object({\n  rejectUnauthorized: z.boolean().optional(),\n  caCert: z.string().optional(),\n  clientCert: z.string().optional(),\n  clientKey: z.string().optional(),\n})\n\nconst serverConfigSchema = z.object({\n  host: z.string().min(1),\n  port: z.number().int().positive().max(65535).optional(),\n  user: z.string().min(1),\n  /** Password may be the empty string (some providers permit it). */\n  password: z.string(),\n  tls: tlsConfigSchema.optional(),\n})\n\nconst postgresPoolConfigSchema = z.object({\n  min: z.number().int().nonnegative().optional(),\n  max: z.number().int().positive().optional(),\n  connectionTimeoutMillis: z.number().int().positive().optional(),\n  idleTimeoutMillis: z.number().int().nonnegative().optional(),\n})\n\nconst postgresDatabaseConfigSchema = z.object({\n  /** References a key in `storage.servers`. Resolved at `usePostgres()` call time. */\n  server: z.string().min(1),\n  database: z.string().min(1),\n  pool: postgresPoolConfigSchema.optional(),\n})\n\nconst redisServerConfigSchema = serverConfigSchema.extend({\n  db: z.number().int().nonnegative().optional(),\n  maxRetriesPerRequest: z.number().int().nonnegative().optional(),\n})\n\nexport const storageSchema = z.object({\n  servers: z.record(z.string(), serverConfigSchema).optional(),\n  databases: z.record(z.string(), postgresDatabaseConfigSchema).optional(),\n  redis: z.record(z.string(), redisServerConfigSchema).optional(),\n})\n\nexport type StorageConfig = z.infer<typeof storageSchema>\n"],"mappings":";;;;AAAA,SAAS,SAAS;AAKlB,IAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAC7B,CAAC;AAcD,IAAM,uBAAuB,EAAE,OAAO;AAAA;AAAA,EAEpC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAExB,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEzB,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS;AACzF,CAAC;AAOM,IAAM,kBAAkB,EAAE,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMrC,oBAAoB,OAAO,EAAE,OAAO,qBAAqB,SAAS,EAAE,CAAC;AAAA,EACrE,EAAE,OAAO;AAAA,IACP,OAAO,qBAAqB,SAAS;AAAA,IACrC,SAAS,oBAAoB,SAAS;AAAA,IACtC,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,mBAAmB,EAAE,SAAS;AAAA,IAC3D,OAAO,EACJ,MAAM;AAAA,MACL,EAAE,KAAK,CAAC,MAAM,WAAW,MAAM,CAAC;AAAA,MAChC,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC;AAAA,IAClE,CAAC,EACA,SAAS;AAAA,IACZ,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASvC,YAAY,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS;AAAA,EACvE,CAAC;AACH,CAAC;;;AChED,SAAS,KAAAA,UAAS;AAEX,IAAM,eAAeA,GAAE,OAAO;AAAA,EACnC,aAAaA,GACV,OAAO,EACP,IAAI,CAAC,EACL,QAAQ,KAAK,OAAO,IAAI;AAAA;AAAA,EAC3B,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE;AAAA,EAC5C,cAAcA,GACX,OAAO,EACP,IAAI,CAAC,EACL,QAAQ,IAAI,OAAO,IAAI;AAAA;AAC5B,CAAC;;;ACZD,SAAS,KAAAC,UAAS;AAEX,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,OAAOA,GAAE,KAAK,CAAC,SAAS,QAAQ,QAAQ,SAAS,QAAQ,CAAC,EAAE,QAAQ,MAAM;AAC5E,CAAC;;;ACJD,SAAS,KAAAC,UAAS;AAclB,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EAC/B,QAAQA,GAAE,OAAO,EAAE,YAAY,EAAE,SAAS;AAAA,EAC1C,KAAKA,GAAE,OAAO,EAAE,YAAY,EAAE,SAAS;AAAA,EACvC,MAAMA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AACrC,CAAC;AAEM,IAAM,cAAcA,GAAE,OAAO;AAAA,EAClC,SAASA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,EAEjC,SAASA,GAAE,MAAM,CAACA,GAAE,QAAQ,QAAQ,GAAGA,GAAE,OAAgB,CAAC,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAC7E,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAI;AAAA,EACpD,UAAUA,GACP,OAAO;AAAA,IACN,QAAQA,GAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,IAC1C,KAAKA,GAAE,OAAO,EAAE,YAAY,EAAE,SAAS;AAAA,IACvC,aAAaA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACxC,CAAC,EACA,QAAQ,EAAE,QAAQ,GAAG,aAAa,MAAM,CAAC;AAAA,EAC5C,eAAeA,GACZ,OAAO;AAAA,IACN,cAAcA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA,IAC3C,WAAWA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,IACnC,eAAeA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,EACzC,CAAC,EACA,QAAQ,EAAE,WAAW,MAAM,eAAe,KAAK,CAAC;AAAA,EACnD,YAAYA,GAAE,OAAOA,GAAE,OAAO,GAAG,eAAe,EAAE,SAAS;AAC7D,CAAC;;;ACxCD,SAAS,KAAAC,UAAS;AAcX,IAAM,sBAAsBA,GAAE,OAAO;AAAA;AAAA,EAE1C,SAASA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOjC,UAAUA,GAAE,OAAgB,EAAE,SAAS;AACzC,CAAC;;;ACxBD,SAAS,KAAAC,UAAS;;;ACAlB,SAAS,KAAAC,UAAS;AAWX,IAAM,mBAAmBA,GAC7B,OAAO,EACP,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,CAAC,GAAG,EAAE,SAAS,sCAAsC,CAAC;;;ADe/E,IAAM,wBAAwBC,GAAE,OAAO;AAAA,EAC5C,KAAKA,GAAE,MAAM,CAAC,kBAAkBA,GAAE,QAAQ,KAAK,CAAC,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI5D,SAASA,GAAE,KAAK,CAAC,WAAW,eAAe,KAAK,CAAC,EAAE,QAAQ,SAAS;AAAA,EACpE,MAAMA,GAAE,MAAM,CAAC,kBAAkBA,GAAE,QAAQ,KAAK,CAAC,CAAC,EAAE,SAAS;AAAA,EAC7D,cAAcA,GAAE,KAAK,CAAC,QAAQ,YAAY,CAAC,EAAE,QAAQ,MAAM;AAAA,EAC3D,oBAAoBA,GAAE,QAAQ,SAAS,EAAE,QAAQ,SAAS;AAAA,EAC1D,gBAAgB,iBAAiB,QAAQ,iCAAiC;AAAA;AAAA;AAAA;AAAA;AAAA,EAK1E,mBAAmBA,GAAE,MAAM,CAAC,kBAAkBA,GAAE,QAAQ,KAAK,CAAC,CAAC,EAAE,SAAS;AAC5E,CAAC;AAcD,IAAM,yBAAyBA,GAAE,OAAO;AAAA,EACtC,QAAQA,GAAE,MAAMA,GAAE,MAAM,CAACA,GAAE,OAAO,GAAGA,GAAE,WAAW,MAAM,CAAC,CAAC,CAAC;AAAA,EAC3D,UAAUA,GAAE,KAAK,CAAC,QAAQ,OAAO,CAAC,EAAE,QAAQ,OAAO;AACrD,CAAC;AAaM,IAAM,aAAaA,GACvB,OAAO;AAAA,EACN,SAASA,GAAE,MAAM;AAAA,IACfA,GAAE,QAAQ,GAAG;AAAA,IACb;AAAA,IACAA,GAAE,WAAW,MAAM;AAAA,IACnBA,GAAE,MAAMA,GAAE,MAAM,CAAC,kBAAkBA,GAAE,WAAW,MAAM,CAAC,CAAC,CAAC;AAAA,IACzDA,GAAE,SAAS,EAAE,OAAOA,GAAE,MAAM,CAACA,GAAE,OAAO,CAAC,CAAC,GAAG,QAAQA,GAAE,QAAQ,EAAE,CAAC;AAAA,EAClE,CAAC;AAAA,EACD,SAASA,GACN,MAAMA,GAAE,KAAK,CAAC,OAAO,QAAQ,OAAO,SAAS,UAAU,WAAW,MAAM,CAAC,CAAC,EAC1E,SAAS;AAAA,EACZ,gBAAgBA,GAAE,MAAM,gBAAgB,EAAE,SAAS;AAAA,EACnD,gBAAgBA,GAAE,MAAM,gBAAgB,EAAE,SAAS;AAAA,EACnD,aAAaA,GAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACtC,QAAQA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,QAAQ,GAAG;AACxD,CAAC,EACA,OAAO,CAAC,MAAM,EAAE,EAAE,YAAY,OAAO,EAAE,cAAc;AAAA,EACpD,SAAS;AACX,CAAC;AAEI,IAAM,iBAAiBA,GAAE,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,EAKrC,MAAMA,GAAE,KAAK,CAAC,OAAO,QAAQ,QAAQ,CAAC,EAAE,QAAQ,QAAQ;AAAA,EACxD,SAAS,sBAAsB,SAAS;AAAA;AAAA,EAExC,YAAY,uBAAuB,SAAS;AAAA;AAAA,EAE5C,MAAM,WAAW,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkB1B,4BAA4BA,GAAE,QAAQ,EAAE,SAAS;AACnD,CAAC;;;AE3HD,SAAS,KAAAC,UAAS;AAqBlB,IAAM,kBAAkBA,GAAE,OAAO;AAAA,EAC/B,oBAAoBA,GAAE,QAAQ,EAAE,SAAS;AAAA,EACzC,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,YAAYA,GAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAWA,GAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,IAAM,qBAAqBA,GAAE,OAAO;AAAA,EAClC,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,MAAMA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,KAAK,EAAE,SAAS;AAAA,EACtD,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAEtB,UAAUA,GAAE,OAAO;AAAA,EACnB,KAAK,gBAAgB,SAAS;AAChC,CAAC;AAED,IAAM,2BAA2BA,GAAE,OAAO;AAAA,EACxC,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC7C,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,yBAAyBA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9D,mBAAmBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAC7D,CAAC;AAED,IAAM,+BAA+BA,GAAE,OAAO;AAAA;AAAA,EAE5C,QAAQA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,MAAM,yBAAyB,SAAS;AAC1C,CAAC;AAED,IAAM,0BAA0B,mBAAmB,OAAO;AAAA,EACxD,IAAIA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC5C,sBAAsBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAChE,CAAC;AAEM,IAAM,gBAAgBA,GAAE,OAAO;AAAA,EACpC,SAASA,GAAE,OAAOA,GAAE,OAAO,GAAG,kBAAkB,EAAE,SAAS;AAAA,EAC3D,WAAWA,GAAE,OAAOA,GAAE,OAAO,GAAG,4BAA4B,EAAE,SAAS;AAAA,EACvE,OAAOA,GAAE,OAAOA,GAAE,OAAO,GAAG,uBAAuB,EAAE,SAAS;AAChE,CAAC;","names":["z","z","z","z","z","z","z","z"]}

package/dist/{chunk-JMN4COMK.js → chunk-D7STTNQN.js}

@@ -1,10 +1,10 @@
 import {
   dispatchCsrfWarn
-} from "./chunk-KOG5K26V.js";
+} from "./chunk-2Z7TANA4.js";
 import {
   incomingMessageToWebRequest,
   sendError
-} from "./chunk-4D4YVXHR.js";
+} from "./chunk-SYIQV4UH.js";
 import {
   enforceCsrf
 } from "./chunk-P6OS7652.js";
@@ -172,4 +172,4 @@ export {
   scanControllerModules,
   dispatchControllerRequest
 };
-//# sourceMappingURL=chunk-JMN4COMK.js.map
+//# sourceMappingURL=chunk-D7STTNQN.js.map

package/dist/{chunk-DSPEN7ZJ.js → chunk-DKX7LF5Q.js}

@@ -145,7 +145,7 @@ async function agentCommand(name, message, deps = {}) {
     );
   }
   const projectRoot = deps.projectRoot ?? process.cwd();
-  const agentsDir = deps.agentsDir ?? (await (await import("./load-config-VMKOV44Y.js")).loadConfig(projectRoot)).agentsDir;
+  const agentsDir = deps.agentsDir ?? (await (await import("./load-config-52H3EKAA.js")).loadConfig(projectRoot)).agentsDir;
   const agents = scanAgents(projectRoot, agentsDir);
   const agent = agents.find((a) => a.name === name);
   if (!agent) {
@@ -178,8 +178,8 @@ async function agentCommand(name, message, deps = {}) {
 async function createAgentSsrLoader(projectRoot) {
   const { createServer } = await import("vite");
   const react = (await import("@vitejs/plugin-react")).default;
-  const { theoPluginAsync } = await import("./vite-plugin-DDILUFYY.js");
-  const { loadConfig } = await import("./load-config-VMKOV44Y.js");
+  const { theoPluginAsync } = await import("./vite-plugin-3ON45MQE.js");
+  const { loadConfig } = await import("./load-config-52H3EKAA.js");
   const config = await loadConfig(projectRoot);
   const theoPlugins = await theoPluginAsync({
     root: projectRoot,
@@ -212,4 +212,4 @@ export {
   agentCommand,
   createAgentSsrLoader
 };
-//# sourceMappingURL=chunk-DSPEN7ZJ.js.map
+//# sourceMappingURL=chunk-DKX7LF5Q.js.map