theokit 0.71.0 → 0.72.1

package/dist/{chunk-FWEXQ2BR.js → chunk-XLSJWKSP.js}

@@ -7,13 +7,13 @@ import {
 } from "./chunk-SSYDEKWF.js";
 import {
   dispatchControllerRequest
-} from "./chunk-JMN4COMK.js";
+} from "./chunk-D7STTNQN.js";
 import {
   createAgentSubjectResolver,
   isAgentCardPath,
   matchAgentAuxRoute,
   serveMatchedAuxRoute
-} from "./chunk-3NAKOWTX.js";
+} from "./chunk-6U67SO5U.js";
 import {
   admitAgentRequest,
   agentAccessDenied,
@@ -29,7 +29,7 @@ import {
   securitySchema,
   storageSchema,
   uploadSchema
-} from "./chunk-SX7ZAHNE.js";
+} from "./chunk-WBB3MEEN.js";
 import {
   broadcastToDevtools
 } from "./chunk-OIGJOYX6.js";
@@ -52,13 +52,13 @@ import {
   executeAction,
   executeRoute,
   handleBatchRequest
-} from "./chunk-KOG5K26V.js";
+} from "./chunk-2Z7TANA4.js";
 import {
   createWebRequestSource,
   incomingMessageToHandlerRequest,
   sendError,
   writeWebResponseToServerResponse
-} from "./chunk-4D4YVXHR.js";
+} from "./chunk-SYIQV4UH.js";
 import {
   validateCsrfRequest
 } from "./chunk-P6OS7652.js";
@@ -75,7 +75,7 @@ import {
 } from "./chunk-VSLTKX5L.js";
 import {
   createRateLimiter
-} from "./chunk-TNI4MARH.js";
+} from "./chunk-SFGGRC35.js";
 import {
   createViteLoader
 } from "./chunk-4ERYQBL6.js";
@@ -3024,19 +3024,19 @@ async function theoPluginAsync(rootOrOptions) {
   }
   const { assetsMapPlugin } = await import("./assets-map-CV2YZ3MY.js");
   const assetsMap = assetsMapPlugin({ appDir: resolve9(projectRoot, options.appDir ?? "app") });
-  const { appTypedClientPlugin } = await import("./app-typed-client-LIIPHLO6.js");
+  const { appTypedClientPlugin } = await import("./app-typed-client-ILLQYTXP.js");
   const appClientPlugin = appTypedClientPlugin({
     cwd: projectRoot,
     serverDir: serverDirAbs,
     distDir: resolve9(projectRoot, ".theokit")
   });
-  const { actionsVirtualModule } = await import("./actions-virtual-module-5LRBP6YK.js");
+  const { actionsVirtualModule } = await import("./actions-virtual-module-OHENNMQG.js");
   const actionsPlugin = actionsVirtualModule({
     serverDir: serverDirAbs,
     distDir: resolve9(projectRoot, ".theokit")
   });
   const { agentsTypedClientPlugin } = await import("./agents-typed-client-PVUZU65B.js");
-  const { generateManifest } = await import("./internal-api-TMLSNYMP.js");
+  const { generateManifest } = await import("./internal-api-6XNLCNI5.js");
   const agentsClientPlugin = agentsTypedClientPlugin({
     projectRoot,
     agentsDir: agentsDirName,
@@ -3053,7 +3053,7 @@ async function theoPluginAsync(rootOrOptions) {
   const controllerTransformPlugin = controllerSwcTransformPlugin({
     serverDir: serverDirAbs
   });
-  const { serverOnlyImportBoundary } = await import("./server-boundary-NZPP33G6.js");
+  const { serverOnlyImportBoundary } = await import("./server-boundary-E5GFVPLB.js");
   const serverBoundaryPlugin = serverOnlyImportBoundary({
     projectRoot,
     serverDir: serverDirAbs
@@ -3237,4 +3237,4 @@ export {
   theoPluginAsync,
   theoPlugin
 };
-//# sourceMappingURL=chunk-FWEXQ2BR.js.map
+//# sourceMappingURL=chunk-XLSJWKSP.js.map

package/dist/{chunk-NZDGV4YJ.js → chunk-YCF3N4JS.js}

@@ -6,7 +6,7 @@ async function initCacheEngineFromConfig(cacheConfig) {
   if (cacheConfig === void 0 || cacheConfig === null) return;
   const { initCacheEngine, isCacheEngineInitialized } = await import("./engine-singleton-X4R7AZBJ.js");
   if (isCacheEngineInitialized()) return;
-  const { cacheSchema } = await import("./schemas-QCMSKQDK.js");
+  const { cacheSchema } = await import("./schemas-2R2J64ZH.js");
   const parsed = cacheSchema.parse(cacheConfig);
   if (!parsed.enabled) return;
   initCacheEngine({
@@ -23,4 +23,4 @@ async function initCacheEngineFromConfig(cacheConfig) {
 export {
   initCacheEngineFromConfig
 };
-//# sourceMappingURL=chunk-NZDGV4YJ.js.map
+//# sourceMappingURL=chunk-YCF3N4JS.js.map

package/dist/cli/index.js

@@ -15,12 +15,12 @@ function cliVersion() {
 // src/cli/index.ts
 var cli = cac("theokit");
 cli.command("dev", "Start development server").option("--port <port>", "Port number").action(async (options) => {
-  const { devCommand } = await import("../dev-CD4YU5FN.js");
+  const { devCommand } = await import("../dev-JDJWMRLH.js");
   await devCommand({ port: options.port ? Number(options.port) : void 0 });
 });
 cli.command("build", "Build for production").option("--target <target>", "Deploy target (node, vercel, cloudflare)").action(async (options) => {
   try {
-    const { buildCommand } = await import("../build-KCIH3HI6.js");
+    const { buildCommand } = await import("../build-23QF5FNQ.js");
     await buildCommand({ target: options.target });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -32,7 +32,7 @@ cli.command("build", "Build for production").option("--target <target>", "Deploy
 });
 cli.command("start", "Start production server").option("--port <port>", "Port number").action(async (options) => {
   try {
-    const { startCommand } = await import("../start-TYXS5I4M.js");
+    const { startCommand } = await import("../start-4JTYXQQJ.js");
     await startCommand({ port: options.port ? Number(options.port) : void 0 });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -44,7 +44,7 @@ cli.command("start", "Start production server").option("--port <port>", "Port nu
 });
 cli.command("preview", "Build for production, then serve it \u2014 one step (B-030)").option("--port <port>", "Port number").option("--target <target>", "Deploy target (node, vercel, cloudflare)").action(async (options) => {
   try {
-    const { previewCommand } = await import("../preview-YDJSRJ2K.js");
+    const { previewCommand } = await import("../preview-BARW75PN.js");
     await previewCommand({
       port: options.port ? Number(options.port) : void 0,
       target: options.target
@@ -77,7 +77,7 @@ cli.command(
   "Run an agent in the terminal (stream + tool calls + approval)"
 ).action(async (name, message) => {
   try {
-    const { agentCommand } = await import("../agent-4FXJXZFD.js");
+    const { agentCommand } = await import("../agent-VJTZ4DQ7.js");
     const { sawError } = await agentCommand(name, message);
     if (sawError) process.exit(1);
   } catch (err) {
@@ -108,7 +108,7 @@ cli.command("agent sessions gc", "Collect old transcripts for this project (dry
 });
 cli.command("mcp <agent>", "Serve an agent as an MCP server over stdio (for desktop MCP clients)").action(async (agent) => {
   try {
-    const { mcpCommand } = await import("../mcp-HS26ZCU4.js");
+    const { mcpCommand } = await import("../mcp-WJNCTM7M.js");
     await mcpCommand(agent);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -120,7 +120,7 @@ cli.command("mcp <agent>", "Serve an agent as an MCP server over stdio (for desk
 });
 cli.command("routes", "List all routes, actions, and WebSocket endpoints").action(async () => {
   try {
-    const { routesCommand } = await import("../routes-ECCDRHXZ.js");
+    const { routesCommand } = await import("../routes-FDF4SLOB.js");
     await routesCommand();
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -161,7 +161,7 @@ cli.command("add <package>", "Install a known TheoKit adapter or plugin (whiteli
   await addCommand(pkg);
 });
 cli.command("info", "Print environment info (runtime, config, routes)").action(async () => {
-  const { infoCommand } = await import("../info-2H7I55YN.js");
+  const { infoCommand } = await import("../info-SUX7QVA3.js");
   await infoCommand();
 });
 cli.command("doctor", "Report the RESOLVED state of this installation (never prints a secret)").action(async () => {
@@ -173,7 +173,7 @@ cli.command(
   "Generate <distDir>/openapi.json from route schemas (opt-in via config.openapi)"
 ).option("--dry-run", "Print the document to stdout without writing to disk (EC-3)").action(async (options) => {
   try {
-    const { openapiCommand } = await import("../openapi-N4CXRUNT.js");
+    const { openapiCommand } = await import("../openapi-Q53YOBIU.js");
     await openapiCommand({ dryRun: Boolean(options.dryRun) });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);

package/dist/{cloudflare-XO43ZIQF.js → cloudflare-4M4XVNUH.js}

@@ -17,10 +17,10 @@ import {
   rateLimitCheckFragment,
   securityHeadersDeclarations,
   serverDirLiteral
-} from "./chunk-IGCOTLQI.js";
+} from "./chunk-C5CAL3DX.js";
 import {
   nodeAdapter
-} from "./chunk-KI4DOTN4.js";
+} from "./chunk-G7U7FQVC.js";
 import {
   findRootDiv
 } from "./chunk-3PWQQWT6.js";
@@ -343,6 +343,8 @@ var cloudflareAdapter = {
   // that can mint one (`adapters/security-headers.ts`).
   servesAgents: true,
   appliesConfig: ["securityHeaders", "csrf", "disallowed", "cors", "serialization", "plugins"],
+  // B-257 — per-invocation: an in-process counter does not survive, so a declared limit needs a durable store.
+  enforcesRateLimit: "with-a-store",
   async build(config, cwd, ctx) {
     assertServicesUnsupported("cloudflare", readManifest(cwd));
     await nodeAdapter.build(config, cwd, ctx);
@@ -412,4 +414,4 @@ export {
   renderCloudflareWorkerEntry,
   renderWranglerToml
 };
-//# sourceMappingURL=cloudflare-XO43ZIQF.js.map
+//# sourceMappingURL=cloudflare-4M4XVNUH.js.map

package/dist/{cloudflare-XO43ZIQF.js.map → cloudflare-4M4XVNUH.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/adapters/cloudflare.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Cloudflare deploy adapter. All write paths are under `cwd/.theokit/cloudflare/`\n * and `cwd/wrangler.toml`. Build-time tool — no HTTP input.\n */\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nimport type { TheoConfig } from '../config/schema.js'\nimport { findRootDiv } from '../core/contracts/find-root-div.js'\nimport { parseAssetsMap } from '../core/contracts/module-preloads.js'\nimport type { SecurityHeadersConfig } from '../core/contracts/security-headers.js'\nimport { assertServicesUnsupported, readManifest } from '../services/index.js'\n\nimport { deployedAgentsFragment, type DeployedAgent } from './deployed-agents.js'\nimport { deployedCorsFragment, type DeployedCorsOptions } from './deployed-cors.js'\nimport { deployedCsrfFragment, type DeployedCsrfOptions } from './deployed-csrf.js'\nimport { planDeployedPlugins } from './deployed-plugins-module.js'\nimport {\n  deployedRateLimitFragment,\n  rateLimitCheckFragment,\n  type DeployedRateLimitOptions,\n} from './deployed-rate-limit.js'\nimport {\n  deployedRuntimeConfigFragment,\n  serverDirLiteral,\n  type DeployedRuntimeConfigOptions,\n  type DeployedServerDirOptions,\n} from './deployed-runtime-config.js'\nimport { deployedTraceFragment } from './deployed-trace.js'\nimport { nodeAdapter } from './node.js'\nimport { describeDeployedSecurityHeaders, securityHeadersDeclarations } from './security-headers.js'\nimport type { AdapterBuildContext, DeployAdapter } from './types.js'\n\n/**\n * T2.1 — Cloudflare adapter rewritten to consume `theokit/adapters/web-shim`\n * instead of emitting an inline plain-object Request/Response shim. Reduces\n * template from ~50 lines to ~25 and centralizes maintenance.\n */\n\n/**\n * The built `index.html` split into the part before `<div id=\"root\">` and the\n * part after it.\n *\n * Refuses by name when streaming is on and the template is missing, rather than\n * emitting a worker that serves a headless document. A build that cannot produce\n * a correct artifact should say so at build time; the alternative is a deploy\n * that looks successful and serves pages with no stylesheet.\n */\n/**\n * @internal Exported for tests only. Nothing re-exports this module, so this does not reach the\n * published surface — `findRootDiv`, exported for the same reason, appears 0 times in `dist/`.\n */\nexport function readDocumentShell(\n  cwd: string,\n  streaming: boolean,\n): { htmlHead?: string; htmlTail?: string } {\n  if (!streaming) return {}\n\n  const indexPath = resolve(cwd, '.theokit/client/index.html')\n  if (!existsSync(indexPath)) {\n    throw new Error(\n      `[adapter-cloudflare] ssrStreaming is on but ${indexPath} does not exist, so the worker ` +\n        `would serve a document with no <head> and no client entry. Run the client build first, ` +\n        `or set ssrStreaming: false in theo.config.ts.`,\n    )\n  }\n\n  const indexHtml = readFileSync(indexPath, 'utf-8')\n  const rootDiv = findRootDiv(indexHtml)\n  if (rootDiv === undefined) {\n    throw new Error(\n      `[adapter-cloudflare] ${indexPath} has no <div id=\"root\">, so the streamed document has ` +\n        `nowhere to put the app. Add one, or set ssrStreaming: false in theo.config.ts.`,\n    )\n  }\n\n  return {\n    htmlHead: indexHtml.slice(0, rootDiv.insertAt),\n    htmlTail: indexHtml.slice(rootDiv.insertAt),\n  }\n}\n\n/**\n * The routes, turned into source: static imports, a module map and a literal table (#369).\n *\n * Extracted so the worker renderer stays inside its length budget, and because this is the whole of\n * what changed about how a Worker finds a route — it reads as one idea rather than as three loops\n * inside a hundred lines of template.\n *\n * `../../` because the worker is written to `.theokit/cloudflare/worker.mjs` and `filePath` is\n * relative to the project root. The imports are static so Wrangler's bundler follows them:\n * `wrangler.toml` uploads `.theokit/client` and has never uploaded `server/`, so a module not\n * bundled INTO the worker is not on the platform at all.\n */\nfunction renderBakedRoutes(\n  routes: readonly { filePath: string; routePath: string; methods?: readonly string[] }[],\n): { routeImports: string[]; routeModuleEntries: string[]; routeTableEntries: string[] } {\n  const routeVar = (index: number): string => `__theoRoute${String(index)}`\n  return {\n    routeImports: routes.map(\n      (route, index) => `import * as ${routeVar(index)} from '../../${route.filePath}'`,\n    ),\n    routeModuleEntries: routes.map(\n      (route, index) => `  ${JSON.stringify(route.filePath)}: ${routeVar(index)},`,\n    ),\n    routeTableEntries: routes.map(\n      (route) =>\n        `  { filePath: ${JSON.stringify(route.filePath)}, routePath: ${JSON.stringify(route.routePath)}, ` +\n        `methods: ${JSON.stringify([...(route.methods ?? [])])}, ` +\n        `...compilePattern(${JSON.stringify(route.routePath)}) },`,\n    ),\n  }\n}\n\n/**\n * The route-resolution runtime the Worker gets instead of a directory scan (#369).\n *\n * A module map, the literal table, and a loader that refuses anything the build did not bake.\n * Emitted as its own block because it replaces one idea — \"find the routes\" — wholesale.\n */\nfunction routeRuntimeLines(moduleEntries: string[], tableEntries: string[]): string[] {\n  return [\n    `// #369 — the routes are baked at build time. The Worker used to reach for`,\n    `// \\`scanServerRoutes\\` on the server directory — a readdirSync, in a runtime with no`,\n    `// filesystem. The pattern is recompiled here from the same routePath the scanner`,\n    `// used, so one function decides precedence on every target.`,\n    `const ROUTE_MODULES = {`,\n    ...moduleEntries,\n    `}`,\n    ``,\n    `const routes = [`,\n    ...tableEntries,\n    `]`,\n    ``,\n    `// The executor asks for a module by the path the table names. Anything else was`,\n    `// never bundled, and saying so beats returning undefined and failing later on a`,\n    `// property access far from the cause.`,\n    `async function loadModule(path) {`,\n    `  const mod = ROUTE_MODULES[path]`,\n    `  if (mod === undefined) {`,\n    // No backticks in this message: it is emitted INTO a template literal, and a stray one closes\n    // it. That is how #344 shipped a SyntaxError, and the emitted-entry parse gate caught this one\n    // before it left the branch.\n    \"  throw new Error(`Route module '\" +\n      '${path}' +\n      \"' was not bundled into this Worker. \" +\n      'A Worker has no filesystem, so every route is imported at build time. ' +\n      'Re-run: theokit build --target cloudflare`)',\n    `  }`,\n    `  return mod`,\n    `}`,\n    ``,\n  ]\n}\n\n/**\n * Read the map `theokit build` emitted, for baking into the worker (B-035).\n *\n * Returns `undefined` — never throws — for an absent or malformed file. A deploy that failed\n * because an optimisation was missing would turn a lost round trip into a broken build, and the\n * worker is correct without it.\n */\nexport function readAssetsMapForBake(path: string): Record<string, string[]> | undefined {\n  try {\n    return parseAssetsMap(readFileSync(path, 'utf8'))\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * The baked route-to-chunks map, as worker source (B-035).\n *\n * A literal and not a read, for the same reason the document shell is: a Worker has no filesystem\n * at request time. Emitted only when the build produced a map; otherwise the worker carries\n * nothing about preloads and behaves exactly as before.\n *\n * **It emits the DATA and no longer the code.** An earlier revision emitted a hand-written copy of\n * `injectModulePreloads`, justified by a claim that the worker could not import it. That claim was\n * false — `theokit/server` re-exports from `core/contracts/` and the generated worker already\n * imports that subpath — and the copy drifted within a day: a fix for proxy-form request targets\n * landed in the original and not in the duplicate. The worker now imports the real function, which\n * is the shape `adapters/security-headers.ts` established one directory over for exactly this\n * build-half/runtime-half pair.\n */\n/**\n * Whether this worker can preload at all (B-035).\n *\n * ONE predicate, read by the bake, the import and the call. Two conditions for one decision is\n * how the import came to be emitted for a worker that had no map to give it — found at review, in\n * the same change where a copy and its original had already drifted apart.\n *\n * Streaming is required because the other branch serves the document from `env.ASSETS` as a\n * static file and can inject nothing into it.\n */\nfunction preloadsApplyTo(opts: {\n  ssrStreaming?: boolean\n  assetsMap?: Record<string, string[]>\n}): boolean {\n  return opts.ssrStreaming === true && opts.assetsMap !== undefined\n}\n\nfunction renderPreloadSupport(assetsMap: Record<string, string[]> | undefined): string {\n  if (assetsMap === undefined) return ''\n  return `const __THEO_ASSETS_MAP = ${JSON.stringify(assetsMap)}`\n}\n\n/**\n * The branch that answers a non-API request: streamed SSR, or the static asset the Worker\n * platform serves. Extracted at review — it is the one decision in this emitter with two whole\n * shapes behind it, and keeping it inline pushed the caller past its line budget.\n */\nfunction renderNonApiBranch(\n  opts: NonNullable<Parameters<typeof renderCloudflareWorkerEntry>[0]>,\n  preloadsApply: boolean,\n): string {\n  return opts.ssrStreaming\n    ? [\n        `      // T2.3 — streaming SSR for non-API routes`,\n        `      // The same primitive \\`theokit start\\` uses, not a second one:`,\n        `      // 16 bytes of Web Crypto entropy, base64.`,\n        `      const nonce = generateNonce()`,\n        `      return withSecurityHeaders(`,\n        `        await renderStreamingWeb(request, {`,\n        !preloadsApply\n          ? `          htmlHead: ${JSON.stringify(opts.htmlHead ?? '')},`\n          : `          htmlHead: injectModulePreloads(${JSON.stringify(opts.htmlHead ?? '')}, __THEO_ASSETS_MAP, new URL(request.url).pathname),`,\n        `          htmlTail: ${JSON.stringify(opts.htmlTail ?? '')},`,\n        `          nonce,`,\n        `        }),`,\n        `        buildSecurityHeaders(SECURITY_HEADERS_CONFIG, { production: true }, { nonce }),`,\n        `      )`,\n      ].join('\\n')\n    : [\n        `      // #412 — the document, served by the worker so it carries the same baseline every`,\n        `      // API response carries. It used to return 404 here while wrangler.toml declared a`,\n        `      // \\`[site]\\` bucket nothing read, so the page was missing rather than unprotected.`,\n        `      const assets = env?.ASSETS`,\n        `      // A wrangler.toml that predates this binding has no ASSETS. Reading .fetch off`,\n        `      // undefined would turn every page request into a 500; 404 is what this target`,\n        `      // answered before, which is the honest fallback rather than a new failure.`,\n        `      if (assets === undefined) return notFoundResponse()`,\n        `      return withSecurityHeaders(await assets.fetch(request), SECURITY_HEADERS)`,\n      ].join('\\n')\n}\n\nexport function renderCloudflareWorkerEntry(\n  opts: {\n    ssrStreaming?: boolean\n    htmlHead?: string\n    htmlTail?: string\n    /**\n     * B-035 — the route-to-chunks map, baked as a literal for the same reason the shell above\n     * is: a Worker has no filesystem at request time. Absent when the build produced no map,\n     * and then nothing about preloads is emitted at all.\n     */\n    assetsMap?: Record<string, string[]>\n    securityHeaders?: SecurityHeadersConfig\n    /**\n     * The server routes, scanned on the BUILD machine (#369).\n     *\n     * A Worker has no filesystem, so the worker used to call `scanServerRoutes` — a `readdirSync` —\n     * against a directory that does not exist there, and load each module through `import()` of a\n     * file path. Both are baked here instead, which is the road this adapter already takes for the\n     * document shell one function away.\n     *\n     * `filePath` is relative to the project root and is used for two things: the key the executor\n     * looks a module up by, and the specifier the static import uses. Paths are emitted relative to\n     * `.theokit/cloudflare/`, where the worker is written.\n     */\n    routes?: readonly { filePath: string; routePath: string; methods?: readonly string[] }[]\n    /**\n     * The two concerns #410 could not bake (#425), composed from one place so the six targets\n     * cannot drift into six spellings. `serialization` is a literal like the security values above;\n     * `plugins` is an import, because a closure has no literal.\n     */\n    runtimeConfigModule?: DeployedRuntimeConfigOptions['runtimeConfigModule']\n    serialization?: DeployedRuntimeConfigOptions['serialization']\n    /**\n     * The app's agents, scanned on the build machine (#367).\n     *\n     * A different scan from `routes` and served by a different function — which is why a worker\n     * that only consulted the route table answered every `/api/agents/<name>` with a 404.\n     */\n    agents?: readonly DeployedAgent[]\n    /** B-185 — the app's `server/context.ts`, project-relative, or absent when it declares none. */\n    contextModule?: string\n    /** WebSocket route files, scanned on the build machine. Only their presence is used (#369). */\n    wsRoutes?: readonly string[]\n  } & DeployedServerDirOptions &\n    DeployedCsrfOptions &\n    DeployedCorsOptions &\n    DeployedRateLimitOptions = {},\n): string {\n  const streamingImport = opts.ssrStreaming\n    ? `import { renderStreamingWeb } from '/@theo/entry-server'`\n    : `// (ssrStreaming off: renderStreamingWeb not imported)`\n  // #343 — the document shell is inlined as a build-time literal because a Worker\n  // has no filesystem to read `index.html` from at request time. Without it,\n  // `renderStreamingWeb` falls back to its empty-string defaults and the response\n  // is React output with no `<html>`, no `<head>`, no stylesheet and no client\n  // entry — hydration data for a page that cannot hydrate. The streaming\n  // assembly was fixed in the generated entry and this, its only caller, was\n  // left passing nothing.\n  //\n  // `JSON.stringify` and not a template literal: the shell contains quotes,\n  // angle brackets and a `</script>`, and embedding it naively produces a worker\n  // that fails to parse at deploy time rather than here.\n  //\n  // #410 — this is also the ONE deploy path that renders HTML at request time,\n  // so the one that can mint a per-request CSP nonce: `renderStreamingWeb`\n  // threads `options.nonce` into `renderToReadableStream` and into the hydration\n  // script (`router/entry-server.ts`). Every other response below carries the\n  // nonce-less baseline, which is what `buildSecurityHeaders` already does for a\n  // prerendered route (EC-4).\n  // Only the streaming branch renders HTML at request time; the other serves the document from\n  // `env.ASSETS` as a static file and can inject nothing. Baking the map for it would ship the whole\n  // route table as dead weight — found at review, where the emitter was measured declaring it with\n  // zero call sites.\n  const preloadsApply = preloadsApplyTo(opts)\n  const preloadSupport = preloadsApply ? renderPreloadSupport(opts.assetsMap) : ''\n\n  const nonApiBranch = renderNonApiBranch(opts, preloadsApply)\n\n  // CR-006: Workers lack `process.cwd()` and the `node:*` import surface\n  // is brittle even under `nodejs_compat`. We use the Web Crypto\n  // `crypto.randomUUID()` instead of `node:crypto.randomUUID`, and embed\n  // the server directory as a build-time literal instead of resolving via\n  // `node:path` at runtime.\n  const { routeImports, routeModuleEntries, routeTableEntries } = renderBakedRoutes(\n    opts.routes ?? [],\n  )\n  const runtimeConfig = deployedRuntimeConfigFragment(opts)\n  const agentsFragment = deployedAgentsFragment(\n    opts.agents === undefined\n      ? undefined\n      : // B-185 — a Worker has no filesystem, so its identity module is baked exactly like its\n        // agents and its routes (ADR 0014). `contextModule` is `undefined` for an app that\n        // declares none, and the generator then emits no import for it.\n        { kind: 'baked', agents: opts.agents, contextModule: opts.contextModule },\n    {\n      wrapSecurityHeaders: true,\n      // B-185 — bound only when the runtime-config fragment declared the const, which is\n      // exactly when a plugins module was emitted. Referencing it otherwise would emit an\n      // identifier the entry never declares.\n      pluginRunnerExpr:\n        opts.runtimeConfigModule === undefined ? undefined : 'await THEO_PLUGIN_RUNNER',\n    },\n  )\n\n  return [\n    `// Generated by Theo — Cloudflare Workers Adapter`,\n    `//`,\n    `// REQUIREMENTS (EC-3):`,\n    `//   - wrangler.toml MUST include compatibility_flags = [\"nodejs_compat\"]`,\n    `//     (still required for transitive theokit/server deps, e.g. busboy)`,\n    `//   - package.json MUST list \"theokit\" in dependencies (not devDependencies)`,\n    `//     so Wrangler bundles theokit and its transitive deps`,\n    `//   - Deploy: wrangler deploy`,\n    ``,\n    !preloadsApply\n      ? `import { matchRoute, executeRoute, compilePattern, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler } from 'theokit/server'`\n      : `import { matchRoute, executeRoute, compilePattern, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler } from 'theokit/server'\\nimport { injectModulePreloads } from 'theokit/server/http'`,\n    `import { createWebShim } from 'theokit/adapters/web-shim'`,\n    opts.ssrStreaming\n      ? `import { buildSecurityHeaders, generateNonce, withSecurityHeaders } from 'theokit/adapters/security-headers'`\n      : `import { buildSecurityHeaders, withSecurityHeaders } from 'theokit/adapters/security-headers'`,\n    `// T3.4 — WS bridge for Cloudflare Workers`,\n    `import { createCloudflareWsBridge } from 'theokit/adapters/ws-shim'`,\n    // B-027 — only when a limit is declared. `createRateLimiterWeb` is used at module scope by the\n    // fragment below and was imported by no target but bun, so an entry that declared a limit threw\n    // when it LOADED. `resolveClientIpFromRequest` is the forwarded-header fallback, behind\n    // `trustProxy`; the primary source is `cf-connecting-ip`, which the Workers runtime writes.\n    ...(opts.rateLimit === undefined\n      ? []\n      : [\n          `import { createRateLimiterWeb } from 'theokit/server'`,\n          `import { resolveClientIpFromRequest } from 'theokit/server/rate-limit'`,\n        ]),\n    streamingImport,\n    ``,\n    ...runtimeConfig.imports,\n    ...agentsFragment.imports,\n    ...routeImports,\n    ``,\n    `// CR-006: server directory is a build-time literal — Workers cannot`,\n    `// call process.cwd() and resolving paths at runtime returned '/server'.`,\n    `const serverDir = ${serverDirLiteral(opts)}`,\n    ``,\n    ...routeRuntimeLines(routeModuleEntries, routeTableEntries),\n    `// #410 — the security baseline \\`theokit start\\` puts on every response, carried`,\n    `// here as a literal because a Worker has no theo.config.ts to read. Same`,\n    `// function, same input, so the deployed page and the local one cannot`,\n    `// disagree about what the configuration means.`,\n    preloadSupport,\n    ...securityHeadersDeclarations(opts.securityHeaders),\n    ``,\n    ...deployedCsrfFragment(opts, 'a Worker'),\n    ``,\n    ...runtimeConfig.declarations,\n    ...agentsFragment.declarations,\n    ...deployedCorsFragment(opts.cors, 'cloudflare'),\n    `// #369 — whether this project declares a WebSocket route, decided at build time. It used`,\n    `// to answer it with \\`scanWebSocketRoutes\\`, which is the same readdirSync.`,\n    `const HAS_WS_ROUTES = ${String((opts.wsRoutes ?? []).length > 0)}`,\n    ``,\n    `function notFoundResponse() {`,\n    `  return withSecurityHeaders(`,\n    `    new Response(`,\n    `      JSON.stringify({ error: { code: 'NOT_FOUND', message: 'Route not found' } }),`,\n    `      { status: 404, headers: { 'Content-Type': 'application/json' } },`,\n    `    ),`,\n    `    SECURITY_HEADERS,`,\n    `  )`,\n    `}`,\n    ``,\n    ...cloudflareHandleRequestFragment(\n      nonApiBranch,\n      runtimeConfig.executeRouteSpread,\n      agentsFragment.branch,\n      agentsFragment.hostBypass,\n      opts.rateLimit,\n    ),\n  ].join('\\n')\n}\n\n/**\n * The Worker's request handler, as generated source.\n *\n * Extracted for the reason `vercel.ts` extracts its own fragments: the emitter is one array\n * literal, so every line the entry gains counts against `max-lines-per-function`, and #410 added\n * the CSRF literal to an emitter already sitting exactly at the ceiling.\n *\n * @param nonApiBranch - what a non-`/api/` request gets, which differs with `ssrStreaming`\n */\nfunction cloudflareHandleRequestFragment(\n  nonApiBranch: string,\n  runtimeSpread: string,\n  agentBranch: readonly string[],\n  /** SI-020 — the condition that keeps an agent card path out of the static-asset branch. */\n  hostBypass: string,\n  /** B-027 — the declared limit, or `undefined`. Passed rather than read: this fragment is a\n   * separate function from `renderCloudflareWorkerEntry`, where `opts` is bound. */\n  rateLimit: DeployedRateLimitOptions['rateLimit'],\n): string[] {\n  return [\n    `async function handleRequest(request, url, env) {`,\n    `    if (!url.pathname.startsWith('/api/')${hostBypass}) {`,\n    nonApiBranch,\n    `    }`,\n    ``,\n    ...agentBranch,\n    ``,\n    `    const match = matchRoute(url.pathname, routes)`,\n    `    if (!match) return notFoundResponse()`,\n    ``,\n    `    const { req, res, toResponse } = createWebShim(request, { trustedProxy: 'platform' })`,\n    ...deployedTraceFragment('request', '    '),\n    `    const method = request.method.toUpperCase()`,\n    `    // #382 — the run is NOT awaited before the Response is taken. toResponse()`,\n    `    // settles as soon as status + headers are known and carries a live body, so`,\n    `    // the Worker starts flushing while the handler is still writing. Awaiting`,\n    `    // executeRoute() first would re-buffer the whole response here even though`,\n    `    // the shim streams; awaiting toResponse() does not — it settles at the head.`,\n    `    return withSecurityHeaders(await toResponse(executeRoute({`,\n    `      route: match.route, method, params: match.params,`,\n    `      req, res, loadModule, serverDir, requestId, ...CSRF_CONFIG, ${runtimeSpread}`,\n    `    })), SECURITY_HEADERS)`,\n    `}`,\n    ``,\n    ...deployedRateLimitFragment(\n      rateLimit,\n      'cloudflare',\n      // `cf-connecting-ip` is the RUNTIME's answer and a caller cannot forge it through the edge.\n      // A Worker reached directly has none, and then only a declared `trustProxy` produces an\n      // address — otherwise `undefined`, which is the named 503 rather than everyone's bucket.\n      `request.headers.get('cf-connecting-ip') ?? resolveClientIpFromRequest(request, TRUST_PROXY)`,\n      // `request` alone: the handler binds `(request, env, ctx)` and the header is on the request.\n      'request',\n    ),\n    ``,\n    `export default {`,\n    `  async fetch(request, env, ctx) {`,\n    `    const url = new URL(request.url)`,\n    ``,\n    `    // #409 — the preflight is answered BEFORE anything routes: an OPTIONS the router handles`,\n    `    // is an OPTIONS the browser never gets a CORS answer to. The WebSocket upgrade above is`,\n    `    // deliberately upstream of it — a 101 is not a CORS-governed response.`,\n    `    const preflight = corsPreflight(request)`,\n    `    if (preflight !== null) return withSecurityHeaders(preflight, SECURITY_HEADERS)`,\n    ...rateLimitCheckFragment(rateLimit, '    ', 'request'),\n    ``,\n    `    // LCR0103 — the upgrade branch sits BELOW the limiter, and the order is the point.`,\n    `    // It used to sit above, under the comment \"a 101 carries no document and no script,`,\n    `    // so the security baseline does not apply to it\". That is true of the security`,\n    `    // HEADERS — a document concern — and false of the limiter, which is a resource`,\n    `    // concern: a long-lived socket is the most expensive thing this entry hands out, so`,\n    `    // the upgrade is the path that most needs a budget, not the one that may skip it.`,\n    `    // T3.4 — Detect WebSocket upgrade and delegate to the CF bridge.`,\n    `    // A 101 carries no document and no script, so the security baseline does`,\n    `    // not apply to it.`,\n    `    if (request.headers.get('upgrade')?.toLowerCase() === 'websocket') {`,\n    `      if (!HAS_WS_ROUTES) return notFoundResponse()`,\n    `      const cfWs = createCloudflareWsBridge({`,\n    `        onOpen: () => {},`,\n    `        onMessage: (ws, data) => { ws.send(data) },`,\n    `        onClose: () => {},`,\n    `      })`,\n    `      return cfWs.handle(request)`,\n    `    }`,\n    ``,\n    `    return withCors(request, await handleRequest(request, url, env))`,\n    `  },`,\n    `}`,\n  ]\n}\n\nexport function renderWranglerToml(): string {\n  return [\n    `# Generated by Theo — Cloudflare Workers`,\n    `name = \"theo-app\"`,\n    `main = \".theokit/cloudflare/worker.mjs\"`,\n    `compatibility_date = \"2025-09-01\"`,\n    `compatibility_flags = [\"nodejs_compat\"]`,\n    ``,\n    `# #412 — \\`[assets]\\` with a BINDING, not the legacy \\`[site]\\` bucket.`,\n    `#`,\n    `# \\`[site]\\` uploads to KV and is read through \\`kv-asset-handler\\` and a`,\n    `# \\`__STATIC_CONTENT\\` binding — neither of which this worker has ever had. So the`,\n    `# bucket was declared, uploaded, and consumed by nothing: with ssrStreaming off, a`,\n    `# deploy answered 404 for its own page. This binding is what the worker calls.`,\n    `[assets]`,\n    `directory = \".theokit/client\"`,\n    `binding = \"ASSETS\"`,\n    `# A client-routed app asks for /dashboard, which is no file. Without this the asset`,\n    `# handler 404s a deep link and the SPA never boots.`,\n    `not_found_handling = \"single-page-application\"`,\n    ``,\n    `# Environment variables are set via wrangler secret or dashboard`,\n    `# Example: wrangler secret put DATABASE_URL`,\n  ].join('\\n')\n}\n\nexport const cloudflareAdapter: DeployAdapter = {\n  name: 'cloudflare',\n  streamsResponses: true,\n  // #409 / #410 — the generated entry calls `executeRoute` with routes, loader\n  // and serverDir only. CSRF, route policy, file middleware and Zod validation\n  // still run because they live inside `executeRoute`; none of the remaining\n  // configurable concerns reach it. Declared explicitly rather than omitted so\n  // the gap is a statement in the source and not an absence.\n  //\n  // `securityHeaders` IS applied: the worker carries `security.headers` as a\n  // literal and puts the built baseline on every response it returns, including\n  // the streamed SSR document — with a per-request nonce, the only deploy path\n  // that can mint one (`adapters/security-headers.ts`).\n  servesAgents: true,\n  appliesConfig: ['securityHeaders', 'csrf', 'disallowed', 'cors', 'serialization', 'plugins'],\n\n  async build(config: TheoConfig, cwd: string, ctx?: AdapterBuildContext): Promise<void> {\n    // Wave 2 (T2.2) — reject polyglot services on this adapter.\n    assertServicesUnsupported('cloudflare', readManifest(cwd))\n\n    // 1. Run the standard Node build first (ctx forwarded so nodeAdapter has makeVitePlugins)\n    await nodeAdapter.build(config, cwd, ctx)\n\n    const outputDir = resolve(cwd, '.theokit/cloudflare')\n    mkdirSync(outputDir, { recursive: true })\n\n    // 2. Emit Worker entry (now uses the shared web-shim)\n    //\n    // The document shell is read HERE, after the Node build produced\n    // `.theokit/client/index.html`, and inlined into the worker: a Worker has no\n    // filesystem at request time. Split on the root div with the same helper the\n    // Node server uses (`ssr-setup.ts`), so the two paths cannot disagree about\n    // where the shell ends (#343).\n    const shell = readDocumentShell(cwd, config.ssrStreaming)\n    // B-035 — the route-to-chunks map, read HERE on the build machine for the same reason the\n    // shell above is: a Worker has no filesystem at request time. `nodeAdapter.build` ran\n    // first, so the map the Node build emitted is on disk by now. Absent map -> nothing about\n    // preloads is emitted, and the worker behaves exactly as it did before.\n    const assetsMap = readAssetsMapForBake(resolve(cwd, '.theokit', 'client', 'assets-map.json'))\n\n    // #369 — the routes are resolved HERE, on the build machine, for the same reason the document\n    // shell above is read here: a Worker has no filesystem at request time, and the worker used to\n    // run the scan itself against a directory that does not exist there.\n    //\n    // The scanner is INJECTED rather than imported: importing it would add an `adapters → server`\n    // edge, which is the layering inversion ADR-0001 v3 removed for `vite-plugin` and which\n    // `adapters-may-only-depend-on-core-router-services` refuses. An absent scanner emits a worker\n    // with no routes rather than falling back to a runtime scan — the fallback IS the defect.\n    const scanned = ctx?.scanRoutes?.(config.serverDir) ?? {\n      routes: [],\n      wsRoutes: [],\n      agents: [],\n      // B-185 — no provider means no scan, and an app whose context nobody looked for is\n      // indistinguishable here from one that has none. Both resolve an anonymous caller, which is\n      // the honest answer rather than an invented subject.\n      contextModule: undefined,\n    }\n\n    const pluginsPlan = planDeployedPlugins(config.plugins, 'cloudflare')\n    if (pluginsPlan !== undefined) {\n      // Beside the worker, so the emitted import is a sibling. Wrangler bundles from here, which is\n      // what lets the static import reach the app's own module at all (#425).\n      writeFileSync(resolve(outputDir, 'theo.plugins.mjs'), pluginsPlan.source)\n    }\n\n    writeFileSync(\n      resolve(outputDir, 'worker.mjs'),\n      renderCloudflareWorkerEntry({\n        ssrStreaming: config.ssrStreaming,\n        ...shell,\n        securityHeaders: config.security?.headers,\n        csrf: config.security?.csrf,\n        disallowed: config.security?.disallowed,\n        cors: config.security?.cors,\n        assetsMap,\n        // #425 — a selector, not a transformer, so it rides as a literal like the values above.\n        serialization: config.serialization,\n        // #425 — the ONE concern that is not a literal. A closure cannot be baked, so a plugin\n        // declared by module specifier is imported by the emitted module instead; a constructed one\n        // is refused by name at build time rather than dropped in silence.\n        runtimeConfigModule: pluginsPlan?.moduleSpecifier,\n        routes: scanned.routes,\n        // #367 — a Worker has no filesystem, so its agents are decided here like its routes.\n        agents: scanned.agents,\n        // B-185 — rides beside the agents because it is decided by the same provider, for the same\n        // reason: `build.ts` holds `serverDir` and a Worker cannot look for the module itself.\n        contextModule: scanned.contextModule,\n        wsRoutes: scanned.wsRoutes,\n      }),\n    )\n\n    // 3. Emit wrangler.toml (with nodejs_compat enforced)\n    writeFileSync(resolve(cwd, 'wrangler.toml'), renderWranglerToml())\n\n    // eslint-disable-next-line no-console -- CLI build progress\n    console.log('\\n  ✓ Cloudflare output → .theokit/cloudflare/ + wrangler.toml')\n    // eslint-disable-next-line no-console -- CLI build progress\n    console.log(\n      `${describeDeployedSecurityHeaders({\n        target: 'cloudflare',\n        securityHeaders: config.security?.headers,\n        // Only the streaming worker renders HTML per request, so only it can put\n        // the same nonce on the header and on the script tag it emits.\n        mintsNonce: config.ssrStreaming,\n        // #412 — either way the worker returns the document now: streamed by\n        // `renderStreamingWeb`, or from the ASSETS binding it finally calls.\n        documentHeaders: 'handler',\n      })}\\n`,\n    )\n  },\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIA,SAAS,YAAY,WAAW,cAAc,qBAAqB;AACnE,SAAS,eAAe;AA+CjB,SAAS,kBACd,KACA,WAC0C;AAC1C,MAAI,CAAC,UAAW,QAAO,CAAC;AAExB,QAAM,YAAY,QAAQ,KAAK,4BAA4B;AAC3D,MAAI,CAAC,WAAW,SAAS,GAAG;AAC1B,UAAM,IAAI;AAAA,MACR,+CAA+C,SAAS;AAAA,IAG1D;AAAA,EACF;AAEA,QAAM,YAAY,aAAa,WAAW,OAAO;AACjD,QAAM,UAAU,YAAY,SAAS;AACrC,MAAI,YAAY,QAAW;AACzB,UAAM,IAAI;AAAA,MACR,wBAAwB,SAAS;AAAA,IAEnC;AAAA,EACF;AAEA,SAAO;AAAA,IACL,UAAU,UAAU,MAAM,GAAG,QAAQ,QAAQ;AAAA,IAC7C,UAAU,UAAU,MAAM,QAAQ,QAAQ;AAAA,EAC5C;AACF;AAcA,SAAS,kBACP,QACuF;AACvF,QAAM,WAAW,CAAC,UAA0B,cAAc,OAAO,KAAK,CAAC;AACvE,SAAO;AAAA,IACL,cAAc,OAAO;AAAA,MACnB,CAAC,OAAO,UAAU,eAAe,SAAS,KAAK,CAAC,gBAAgB,MAAM,QAAQ;AAAA,IAChF;AAAA,IACA,oBAAoB,OAAO;AAAA,MACzB,CAAC,OAAO,UAAU,KAAK,KAAK,UAAU,MAAM,QAAQ,CAAC,KAAK,SAAS,KAAK,CAAC;AAAA,IAC3E;AAAA,IACA,mBAAmB,OAAO;AAAA,MACxB,CAAC,UACC,iBAAiB,KAAK,UAAU,MAAM,QAAQ,CAAC,gBAAgB,KAAK,UAAU,MAAM,SAAS,CAAC,cAClF,KAAK,UAAU,CAAC,GAAI,MAAM,WAAW,CAAC,CAAE,CAAC,CAAC,uBACjC,KAAK,UAAU,MAAM,SAAS,CAAC;AAAA,IACxD;AAAA,EACF;AACF;AAQA,SAAS,kBAAkB,eAAyB,cAAkC;AACpF,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAAA;AAAA;AAAA,IAIA;AAAA,IAKA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AASO,SAAS,qBAAqB,MAAoD;AACvF,MAAI;AACF,WAAO,eAAe,aAAa,MAAM,MAAM,CAAC;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AA2BA,SAAS,gBAAgB,MAGb;AACV,SAAO,KAAK,iBAAiB,QAAQ,KAAK,cAAc;AAC1D;AAEA,SAAS,qBAAqB,WAAyD;AACrF,MAAI,cAAc,OAAW,QAAO;AACpC,SAAO,6BAA6B,KAAK,UAAU,SAAS,CAAC;AAC/D;AAOA,SAAS,mBACP,MACA,eACQ;AACR,SAAO,KAAK,eACR;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,CAAC,gBACG,uBAAuB,KAAK,UAAU,KAAK,YAAY,EAAE,CAAC,MAC1D,4CAA4C,KAAK,UAAU,KAAK,YAAY,EAAE,CAAC;AAAA,IACnF,uBAAuB,KAAK,UAAU,KAAK,YAAY,EAAE,CAAC;AAAA,IAC1D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI,IACX;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACjB;AAEO,SAAS,4BACd,OA6C6B,CAAC,GACtB;AACR,QAAM,kBAAkB,KAAK,eACzB,6DACA;AAuBJ,QAAM,gBAAgB,gBAAgB,IAAI;AAC1C,QAAM,iBAAiB,gBAAgB,qBAAqB,KAAK,SAAS,IAAI;AAE9E,QAAM,eAAe,mBAAmB,MAAM,aAAa;AAO3D,QAAM,EAAE,cAAc,oBAAoB,kBAAkB,IAAI;AAAA,IAC9D,KAAK,UAAU,CAAC;AAAA,EAClB;AACA,QAAM,gBAAgB,8BAA8B,IAAI;AACxD,QAAM,iBAAiB;AAAA,IACrB,KAAK,WAAW,SACZ;AAAA;AAAA;AAAA;AAAA,MAIA,EAAE,MAAM,SAAS,QAAQ,KAAK,QAAQ,eAAe,KAAK,cAAc;AAAA;AAAA,IAC5E;AAAA,MACE,qBAAqB;AAAA;AAAA;AAAA;AAAA,MAIrB,kBACE,KAAK,wBAAwB,SAAY,SAAY;AAAA,IACzD;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,CAAC,gBACG,6IACA;AAAA;AAAA,IACJ;AAAA,IACA,KAAK,eACD,iHACA;AAAA,IACJ;AAAA,IACA;AAAA;AAAA;AAAA;AAAA;AAAA,IAKA,GAAI,KAAK,cAAc,SACnB,CAAC,IACD;AAAA,MACE;AAAA,MACA;AAAA,IACF;AAAA,IACJ;AAAA,IACA;AAAA,IACA,GAAG,cAAc;AAAA,IACjB,GAAG,eAAe;AAAA,IAClB,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA,qBAAqB,iBAAiB,IAAI,CAAC;AAAA,IAC3C;AAAA,IACA,GAAG,kBAAkB,oBAAoB,iBAAiB;AAAA,IAC1D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,4BAA4B,KAAK,eAAe;AAAA,IACnD;AAAA,IACA,GAAG,qBAAqB,MAAM,UAAU;AAAA,IACxC;AAAA,IACA,GAAG,cAAc;AAAA,IACjB,GAAG,eAAe;AAAA,IAClB,GAAG,qBAAqB,KAAK,MAAM,YAAY;AAAA,IAC/C;AAAA,IACA;AAAA,IACA,yBAAyB,QAAQ,KAAK,YAAY,CAAC,GAAG,SAAS,CAAC,CAAC;AAAA,IACjE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,MACD;AAAA,MACA,cAAc;AAAA,MACd,eAAe;AAAA,MACf,eAAe;AAAA,MACf,KAAK;AAAA,IACP;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAWA,SAAS,gCACP,cACA,eACA,aAEA,YAGA,WACU;AACV,SAAO;AAAA,IACL;AAAA,IACA,4CAA4C,UAAU;AAAA,IACtD;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,sBAAsB,WAAW,MAAM;AAAA,IAC1C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,qEAAqE,aAAa;AAAA,IAClF;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,MACD;AAAA,MACA;AAAA;AAAA;AAAA;AAAA,MAIA;AAAA;AAAA,MAEA;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,uBAAuB,WAAW,QAAQ,SAAS;AAAA,IACtD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,qBAA6B;AAC3C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEO,IAAM,oBAAmC;AAAA,EAC9C,MAAM;AAAA,EACN,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWlB,cAAc;AAAA,EACd,eAAe,CAAC,mBAAmB,QAAQ,cAAc,QAAQ,iBAAiB,SAAS;AAAA,EAE3F,MAAM,MAAM,QAAoB,KAAa,KAA0C;AAErF,8BAA0B,cAAc,aAAa,GAAG,CAAC;AAGzD,UAAM,YAAY,MAAM,QAAQ,KAAK,GAAG;AAExC,UAAM,YAAY,QAAQ,KAAK,qBAAqB;AACpD,cAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AASxC,UAAM,QAAQ,kBAAkB,KAAK,OAAO,YAAY;AAKxD,UAAM,YAAY,qBAAqB,QAAQ,KAAK,YAAY,UAAU,iBAAiB,CAAC;AAU5F,UAAM,UAAU,KAAK,aAAa,OAAO,SAAS,KAAK;AAAA,MACrD,QAAQ,CAAC;AAAA,MACT,UAAU,CAAC;AAAA,MACX,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA,MAIT,eAAe;AAAA,IACjB;AAEA,UAAM,cAAc,oBAAoB,OAAO,SAAS,YAAY;AACpE,QAAI,gBAAgB,QAAW;AAG7B,oBAAc,QAAQ,WAAW,kBAAkB,GAAG,YAAY,MAAM;AAAA,IAC1E;AAEA;AAAA,MACE,QAAQ,WAAW,YAAY;AAAA,MAC/B,4BAA4B;AAAA,QAC1B,cAAc,OAAO;AAAA,QACrB,GAAG;AAAA,QACH,iBAAiB,OAAO,UAAU;AAAA,QAClC,MAAM,OAAO,UAAU;AAAA,QACvB,YAAY,OAAO,UAAU;AAAA,QAC7B,MAAM,OAAO,UAAU;AAAA,QACvB;AAAA;AAAA,QAEA,eAAe,OAAO;AAAA;AAAA;AAAA;AAAA,QAItB,qBAAqB,aAAa;AAAA,QAClC,QAAQ,QAAQ;AAAA;AAAA,QAEhB,QAAQ,QAAQ;AAAA;AAAA;AAAA,QAGhB,eAAe,QAAQ;AAAA,QACvB,UAAU,QAAQ;AAAA,MACpB,CAAC;AAAA,IACH;AAGA,kBAAc,QAAQ,KAAK,eAAe,GAAG,mBAAmB,CAAC;AAGjE,YAAQ,IAAI,0EAAgE;AAE5E,YAAQ;AAAA,MACN,GAAG,gCAAgC;AAAA,QACjC,QAAQ;AAAA,QACR,iBAAiB,OAAO,UAAU;AAAA;AAAA;AAAA,QAGlC,YAAY,OAAO;AAAA;AAAA;AAAA,QAGnB,iBAAiB;AAAA,MACnB,CAAC,CAAC;AAAA;AAAA,IACJ;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/adapters/cloudflare.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Cloudflare deploy adapter. All write paths are under `cwd/.theokit/cloudflare/`\n * and `cwd/wrangler.toml`. Build-time tool — no HTTP input.\n */\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nimport type { TheoConfig } from '../config/schema.js'\nimport { findRootDiv } from '../core/contracts/find-root-div.js'\nimport { parseAssetsMap } from '../core/contracts/module-preloads.js'\nimport type { SecurityHeadersConfig } from '../core/contracts/security-headers.js'\nimport { assertServicesUnsupported, readManifest } from '../services/index.js'\n\nimport { deployedAgentsFragment, type DeployedAgent } from './deployed-agents.js'\nimport { deployedCorsFragment, type DeployedCorsOptions } from './deployed-cors.js'\nimport { deployedCsrfFragment, type DeployedCsrfOptions } from './deployed-csrf.js'\nimport { planDeployedPlugins } from './deployed-plugins-module.js'\nimport {\n  deployedRateLimitFragment,\n  rateLimitCheckFragment,\n  type DeployedRateLimitOptions,\n} from './deployed-rate-limit.js'\nimport {\n  deployedRuntimeConfigFragment,\n  serverDirLiteral,\n  type DeployedRuntimeConfigOptions,\n  type DeployedServerDirOptions,\n} from './deployed-runtime-config.js'\nimport { deployedTraceFragment } from './deployed-trace.js'\nimport { nodeAdapter } from './node.js'\nimport { describeDeployedSecurityHeaders, securityHeadersDeclarations } from './security-headers.js'\nimport type { AdapterBuildContext, DeployAdapter } from './types.js'\n\n/**\n * T2.1 — Cloudflare adapter rewritten to consume `theokit/adapters/web-shim`\n * instead of emitting an inline plain-object Request/Response shim. Reduces\n * template from ~50 lines to ~25 and centralizes maintenance.\n */\n\n/**\n * The built `index.html` split into the part before `<div id=\"root\">` and the\n * part after it.\n *\n * Refuses by name when streaming is on and the template is missing, rather than\n * emitting a worker that serves a headless document. A build that cannot produce\n * a correct artifact should say so at build time; the alternative is a deploy\n * that looks successful and serves pages with no stylesheet.\n */\n/**\n * @internal Exported for tests only. Nothing re-exports this module, so this does not reach the\n * published surface — `findRootDiv`, exported for the same reason, appears 0 times in `dist/`.\n */\nexport function readDocumentShell(\n  cwd: string,\n  streaming: boolean,\n): { htmlHead?: string; htmlTail?: string } {\n  if (!streaming) return {}\n\n  const indexPath = resolve(cwd, '.theokit/client/index.html')\n  if (!existsSync(indexPath)) {\n    throw new Error(\n      `[adapter-cloudflare] ssrStreaming is on but ${indexPath} does not exist, so the worker ` +\n        `would serve a document with no <head> and no client entry. Run the client build first, ` +\n        `or set ssrStreaming: false in theo.config.ts.`,\n    )\n  }\n\n  const indexHtml = readFileSync(indexPath, 'utf-8')\n  const rootDiv = findRootDiv(indexHtml)\n  if (rootDiv === undefined) {\n    throw new Error(\n      `[adapter-cloudflare] ${indexPath} has no <div id=\"root\">, so the streamed document has ` +\n        `nowhere to put the app. Add one, or set ssrStreaming: false in theo.config.ts.`,\n    )\n  }\n\n  return {\n    htmlHead: indexHtml.slice(0, rootDiv.insertAt),\n    htmlTail: indexHtml.slice(rootDiv.insertAt),\n  }\n}\n\n/**\n * The routes, turned into source: static imports, a module map and a literal table (#369).\n *\n * Extracted so the worker renderer stays inside its length budget, and because this is the whole of\n * what changed about how a Worker finds a route — it reads as one idea rather than as three loops\n * inside a hundred lines of template.\n *\n * `../../` because the worker is written to `.theokit/cloudflare/worker.mjs` and `filePath` is\n * relative to the project root. The imports are static so Wrangler's bundler follows them:\n * `wrangler.toml` uploads `.theokit/client` and has never uploaded `server/`, so a module not\n * bundled INTO the worker is not on the platform at all.\n */\nfunction renderBakedRoutes(\n  routes: readonly { filePath: string; routePath: string; methods?: readonly string[] }[],\n): { routeImports: string[]; routeModuleEntries: string[]; routeTableEntries: string[] } {\n  const routeVar = (index: number): string => `__theoRoute${String(index)}`\n  return {\n    routeImports: routes.map(\n      (route, index) => `import * as ${routeVar(index)} from '../../${route.filePath}'`,\n    ),\n    routeModuleEntries: routes.map(\n      (route, index) => `  ${JSON.stringify(route.filePath)}: ${routeVar(index)},`,\n    ),\n    routeTableEntries: routes.map(\n      (route) =>\n        `  { filePath: ${JSON.stringify(route.filePath)}, routePath: ${JSON.stringify(route.routePath)}, ` +\n        `methods: ${JSON.stringify([...(route.methods ?? [])])}, ` +\n        `...compilePattern(${JSON.stringify(route.routePath)}) },`,\n    ),\n  }\n}\n\n/**\n * The route-resolution runtime the Worker gets instead of a directory scan (#369).\n *\n * A module map, the literal table, and a loader that refuses anything the build did not bake.\n * Emitted as its own block because it replaces one idea — \"find the routes\" — wholesale.\n */\nfunction routeRuntimeLines(moduleEntries: string[], tableEntries: string[]): string[] {\n  return [\n    `// #369 — the routes are baked at build time. The Worker used to reach for`,\n    `// \\`scanServerRoutes\\` on the server directory — a readdirSync, in a runtime with no`,\n    `// filesystem. The pattern is recompiled here from the same routePath the scanner`,\n    `// used, so one function decides precedence on every target.`,\n    `const ROUTE_MODULES = {`,\n    ...moduleEntries,\n    `}`,\n    ``,\n    `const routes = [`,\n    ...tableEntries,\n    `]`,\n    ``,\n    `// The executor asks for a module by the path the table names. Anything else was`,\n    `// never bundled, and saying so beats returning undefined and failing later on a`,\n    `// property access far from the cause.`,\n    `async function loadModule(path) {`,\n    `  const mod = ROUTE_MODULES[path]`,\n    `  if (mod === undefined) {`,\n    // No backticks in this message: it is emitted INTO a template literal, and a stray one closes\n    // it. That is how #344 shipped a SyntaxError, and the emitted-entry parse gate caught this one\n    // before it left the branch.\n    \"  throw new Error(`Route module '\" +\n      '${path}' +\n      \"' was not bundled into this Worker. \" +\n      'A Worker has no filesystem, so every route is imported at build time. ' +\n      'Re-run: theokit build --target cloudflare`)',\n    `  }`,\n    `  return mod`,\n    `}`,\n    ``,\n  ]\n}\n\n/**\n * Read the map `theokit build` emitted, for baking into the worker (B-035).\n *\n * Returns `undefined` — never throws — for an absent or malformed file. A deploy that failed\n * because an optimisation was missing would turn a lost round trip into a broken build, and the\n * worker is correct without it.\n */\nexport function readAssetsMapForBake(path: string): Record<string, string[]> | undefined {\n  try {\n    return parseAssetsMap(readFileSync(path, 'utf8'))\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * The baked route-to-chunks map, as worker source (B-035).\n *\n * A literal and not a read, for the same reason the document shell is: a Worker has no filesystem\n * at request time. Emitted only when the build produced a map; otherwise the worker carries\n * nothing about preloads and behaves exactly as before.\n *\n * **It emits the DATA and no longer the code.** An earlier revision emitted a hand-written copy of\n * `injectModulePreloads`, justified by a claim that the worker could not import it. That claim was\n * false — `theokit/server` re-exports from `core/contracts/` and the generated worker already\n * imports that subpath — and the copy drifted within a day: a fix for proxy-form request targets\n * landed in the original and not in the duplicate. The worker now imports the real function, which\n * is the shape `adapters/security-headers.ts` established one directory over for exactly this\n * build-half/runtime-half pair.\n */\n/**\n * Whether this worker can preload at all (B-035).\n *\n * ONE predicate, read by the bake, the import and the call. Two conditions for one decision is\n * how the import came to be emitted for a worker that had no map to give it — found at review, in\n * the same change where a copy and its original had already drifted apart.\n *\n * Streaming is required because the other branch serves the document from `env.ASSETS` as a\n * static file and can inject nothing into it.\n */\nfunction preloadsApplyTo(opts: {\n  ssrStreaming?: boolean\n  assetsMap?: Record<string, string[]>\n}): boolean {\n  return opts.ssrStreaming === true && opts.assetsMap !== undefined\n}\n\nfunction renderPreloadSupport(assetsMap: Record<string, string[]> | undefined): string {\n  if (assetsMap === undefined) return ''\n  return `const __THEO_ASSETS_MAP = ${JSON.stringify(assetsMap)}`\n}\n\n/**\n * The branch that answers a non-API request: streamed SSR, or the static asset the Worker\n * platform serves. Extracted at review — it is the one decision in this emitter with two whole\n * shapes behind it, and keeping it inline pushed the caller past its line budget.\n */\nfunction renderNonApiBranch(\n  opts: NonNullable<Parameters<typeof renderCloudflareWorkerEntry>[0]>,\n  preloadsApply: boolean,\n): string {\n  return opts.ssrStreaming\n    ? [\n        `      // T2.3 — streaming SSR for non-API routes`,\n        `      // The same primitive \\`theokit start\\` uses, not a second one:`,\n        `      // 16 bytes of Web Crypto entropy, base64.`,\n        `      const nonce = generateNonce()`,\n        `      return withSecurityHeaders(`,\n        `        await renderStreamingWeb(request, {`,\n        !preloadsApply\n          ? `          htmlHead: ${JSON.stringify(opts.htmlHead ?? '')},`\n          : `          htmlHead: injectModulePreloads(${JSON.stringify(opts.htmlHead ?? '')}, __THEO_ASSETS_MAP, new URL(request.url).pathname),`,\n        `          htmlTail: ${JSON.stringify(opts.htmlTail ?? '')},`,\n        `          nonce,`,\n        `        }),`,\n        `        buildSecurityHeaders(SECURITY_HEADERS_CONFIG, { production: true }, { nonce }),`,\n        `      )`,\n      ].join('\\n')\n    : [\n        `      // #412 — the document, served by the worker so it carries the same baseline every`,\n        `      // API response carries. It used to return 404 here while wrangler.toml declared a`,\n        `      // \\`[site]\\` bucket nothing read, so the page was missing rather than unprotected.`,\n        `      const assets = env?.ASSETS`,\n        `      // A wrangler.toml that predates this binding has no ASSETS. Reading .fetch off`,\n        `      // undefined would turn every page request into a 500; 404 is what this target`,\n        `      // answered before, which is the honest fallback rather than a new failure.`,\n        `      if (assets === undefined) return notFoundResponse()`,\n        `      return withSecurityHeaders(await assets.fetch(request), SECURITY_HEADERS)`,\n      ].join('\\n')\n}\n\nexport function renderCloudflareWorkerEntry(\n  opts: {\n    ssrStreaming?: boolean\n    htmlHead?: string\n    htmlTail?: string\n    /**\n     * B-035 — the route-to-chunks map, baked as a literal for the same reason the shell above\n     * is: a Worker has no filesystem at request time. Absent when the build produced no map,\n     * and then nothing about preloads is emitted at all.\n     */\n    assetsMap?: Record<string, string[]>\n    securityHeaders?: SecurityHeadersConfig\n    /**\n     * The server routes, scanned on the BUILD machine (#369).\n     *\n     * A Worker has no filesystem, so the worker used to call `scanServerRoutes` — a `readdirSync` —\n     * against a directory that does not exist there, and load each module through `import()` of a\n     * file path. Both are baked here instead, which is the road this adapter already takes for the\n     * document shell one function away.\n     *\n     * `filePath` is relative to the project root and is used for two things: the key the executor\n     * looks a module up by, and the specifier the static import uses. Paths are emitted relative to\n     * `.theokit/cloudflare/`, where the worker is written.\n     */\n    routes?: readonly { filePath: string; routePath: string; methods?: readonly string[] }[]\n    /**\n     * The two concerns #410 could not bake (#425), composed from one place so the six targets\n     * cannot drift into six spellings. `serialization` is a literal like the security values above;\n     * `plugins` is an import, because a closure has no literal.\n     */\n    runtimeConfigModule?: DeployedRuntimeConfigOptions['runtimeConfigModule']\n    serialization?: DeployedRuntimeConfigOptions['serialization']\n    /**\n     * The app's agents, scanned on the build machine (#367).\n     *\n     * A different scan from `routes` and served by a different function — which is why a worker\n     * that only consulted the route table answered every `/api/agents/<name>` with a 404.\n     */\n    agents?: readonly DeployedAgent[]\n    /** B-185 — the app's `server/context.ts`, project-relative, or absent when it declares none. */\n    contextModule?: string\n    /** WebSocket route files, scanned on the build machine. Only their presence is used (#369). */\n    wsRoutes?: readonly string[]\n  } & DeployedServerDirOptions &\n    DeployedCsrfOptions &\n    DeployedCorsOptions &\n    DeployedRateLimitOptions = {},\n): string {\n  const streamingImport = opts.ssrStreaming\n    ? `import { renderStreamingWeb } from '/@theo/entry-server'`\n    : `// (ssrStreaming off: renderStreamingWeb not imported)`\n  // #343 — the document shell is inlined as a build-time literal because a Worker\n  // has no filesystem to read `index.html` from at request time. Without it,\n  // `renderStreamingWeb` falls back to its empty-string defaults and the response\n  // is React output with no `<html>`, no `<head>`, no stylesheet and no client\n  // entry — hydration data for a page that cannot hydrate. The streaming\n  // assembly was fixed in the generated entry and this, its only caller, was\n  // left passing nothing.\n  //\n  // `JSON.stringify` and not a template literal: the shell contains quotes,\n  // angle brackets and a `</script>`, and embedding it naively produces a worker\n  // that fails to parse at deploy time rather than here.\n  //\n  // #410 — this is also the ONE deploy path that renders HTML at request time,\n  // so the one that can mint a per-request CSP nonce: `renderStreamingWeb`\n  // threads `options.nonce` into `renderToReadableStream` and into the hydration\n  // script (`router/entry-server.ts`). Every other response below carries the\n  // nonce-less baseline, which is what `buildSecurityHeaders` already does for a\n  // prerendered route (EC-4).\n  // Only the streaming branch renders HTML at request time; the other serves the document from\n  // `env.ASSETS` as a static file and can inject nothing. Baking the map for it would ship the whole\n  // route table as dead weight — found at review, where the emitter was measured declaring it with\n  // zero call sites.\n  const preloadsApply = preloadsApplyTo(opts)\n  const preloadSupport = preloadsApply ? renderPreloadSupport(opts.assetsMap) : ''\n\n  const nonApiBranch = renderNonApiBranch(opts, preloadsApply)\n\n  // CR-006: Workers lack `process.cwd()` and the `node:*` import surface\n  // is brittle even under `nodejs_compat`. We use the Web Crypto\n  // `crypto.randomUUID()` instead of `node:crypto.randomUUID`, and embed\n  // the server directory as a build-time literal instead of resolving via\n  // `node:path` at runtime.\n  const { routeImports, routeModuleEntries, routeTableEntries } = renderBakedRoutes(\n    opts.routes ?? [],\n  )\n  const runtimeConfig = deployedRuntimeConfigFragment(opts)\n  const agentsFragment = deployedAgentsFragment(\n    opts.agents === undefined\n      ? undefined\n      : // B-185 — a Worker has no filesystem, so its identity module is baked exactly like its\n        // agents and its routes (ADR 0014). `contextModule` is `undefined` for an app that\n        // declares none, and the generator then emits no import for it.\n        { kind: 'baked', agents: opts.agents, contextModule: opts.contextModule },\n    {\n      wrapSecurityHeaders: true,\n      // B-185 — bound only when the runtime-config fragment declared the const, which is\n      // exactly when a plugins module was emitted. Referencing it otherwise would emit an\n      // identifier the entry never declares.\n      pluginRunnerExpr:\n        opts.runtimeConfigModule === undefined ? undefined : 'await THEO_PLUGIN_RUNNER',\n    },\n  )\n\n  return [\n    `// Generated by Theo — Cloudflare Workers Adapter`,\n    `//`,\n    `// REQUIREMENTS (EC-3):`,\n    `//   - wrangler.toml MUST include compatibility_flags = [\"nodejs_compat\"]`,\n    `//     (still required for transitive theokit/server deps, e.g. busboy)`,\n    `//   - package.json MUST list \"theokit\" in dependencies (not devDependencies)`,\n    `//     so Wrangler bundles theokit and its transitive deps`,\n    `//   - Deploy: wrangler deploy`,\n    ``,\n    !preloadsApply\n      ? `import { matchRoute, executeRoute, compilePattern, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler } from 'theokit/server'`\n      : `import { matchRoute, executeRoute, compilePattern, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler } from 'theokit/server'\\nimport { injectModulePreloads } from 'theokit/server/http'`,\n    `import { createWebShim } from 'theokit/adapters/web-shim'`,\n    opts.ssrStreaming\n      ? `import { buildSecurityHeaders, generateNonce, withSecurityHeaders } from 'theokit/adapters/security-headers'`\n      : `import { buildSecurityHeaders, withSecurityHeaders } from 'theokit/adapters/security-headers'`,\n    `// T3.4 — WS bridge for Cloudflare Workers`,\n    `import { createCloudflareWsBridge } from 'theokit/adapters/ws-shim'`,\n    // B-027 — only when a limit is declared. `createRateLimiterWeb` is used at module scope by the\n    // fragment below and was imported by no target but bun, so an entry that declared a limit threw\n    // when it LOADED. `resolveClientIpFromRequest` is the forwarded-header fallback, behind\n    // `trustProxy`; the primary source is `cf-connecting-ip`, which the Workers runtime writes.\n    ...(opts.rateLimit === undefined\n      ? []\n      : [\n          `import { createRateLimiterWeb } from 'theokit/server'`,\n          `import { resolveClientIpFromRequest } from 'theokit/server/rate-limit'`,\n        ]),\n    streamingImport,\n    ``,\n    ...runtimeConfig.imports,\n    ...agentsFragment.imports,\n    ...routeImports,\n    ``,\n    `// CR-006: server directory is a build-time literal — Workers cannot`,\n    `// call process.cwd() and resolving paths at runtime returned '/server'.`,\n    `const serverDir = ${serverDirLiteral(opts)}`,\n    ``,\n    ...routeRuntimeLines(routeModuleEntries, routeTableEntries),\n    `// #410 — the security baseline \\`theokit start\\` puts on every response, carried`,\n    `// here as a literal because a Worker has no theo.config.ts to read. Same`,\n    `// function, same input, so the deployed page and the local one cannot`,\n    `// disagree about what the configuration means.`,\n    preloadSupport,\n    ...securityHeadersDeclarations(opts.securityHeaders),\n    ``,\n    ...deployedCsrfFragment(opts, 'a Worker'),\n    ``,\n    ...runtimeConfig.declarations,\n    ...agentsFragment.declarations,\n    ...deployedCorsFragment(opts.cors, 'cloudflare'),\n    `// #369 — whether this project declares a WebSocket route, decided at build time. It used`,\n    `// to answer it with \\`scanWebSocketRoutes\\`, which is the same readdirSync.`,\n    `const HAS_WS_ROUTES = ${String((opts.wsRoutes ?? []).length > 0)}`,\n    ``,\n    `function notFoundResponse() {`,\n    `  return withSecurityHeaders(`,\n    `    new Response(`,\n    `      JSON.stringify({ error: { code: 'NOT_FOUND', message: 'Route not found' } }),`,\n    `      { status: 404, headers: { 'Content-Type': 'application/json' } },`,\n    `    ),`,\n    `    SECURITY_HEADERS,`,\n    `  )`,\n    `}`,\n    ``,\n    ...cloudflareHandleRequestFragment(\n      nonApiBranch,\n      runtimeConfig.executeRouteSpread,\n      agentsFragment.branch,\n      agentsFragment.hostBypass,\n      opts.rateLimit,\n    ),\n  ].join('\\n')\n}\n\n/**\n * The Worker's request handler, as generated source.\n *\n * Extracted for the reason `vercel.ts` extracts its own fragments: the emitter is one array\n * literal, so every line the entry gains counts against `max-lines-per-function`, and #410 added\n * the CSRF literal to an emitter already sitting exactly at the ceiling.\n *\n * @param nonApiBranch - what a non-`/api/` request gets, which differs with `ssrStreaming`\n */\nfunction cloudflareHandleRequestFragment(\n  nonApiBranch: string,\n  runtimeSpread: string,\n  agentBranch: readonly string[],\n  /** SI-020 — the condition that keeps an agent card path out of the static-asset branch. */\n  hostBypass: string,\n  /** B-027 — the declared limit, or `undefined`. Passed rather than read: this fragment is a\n   * separate function from `renderCloudflareWorkerEntry`, where `opts` is bound. */\n  rateLimit: DeployedRateLimitOptions['rateLimit'],\n): string[] {\n  return [\n    `async function handleRequest(request, url, env) {`,\n    `    if (!url.pathname.startsWith('/api/')${hostBypass}) {`,\n    nonApiBranch,\n    `    }`,\n    ``,\n    ...agentBranch,\n    ``,\n    `    const match = matchRoute(url.pathname, routes)`,\n    `    if (!match) return notFoundResponse()`,\n    ``,\n    `    const { req, res, toResponse } = createWebShim(request, { trustedProxy: 'platform' })`,\n    ...deployedTraceFragment('request', '    '),\n    `    const method = request.method.toUpperCase()`,\n    `    // #382 — the run is NOT awaited before the Response is taken. toResponse()`,\n    `    // settles as soon as status + headers are known and carries a live body, so`,\n    `    // the Worker starts flushing while the handler is still writing. Awaiting`,\n    `    // executeRoute() first would re-buffer the whole response here even though`,\n    `    // the shim streams; awaiting toResponse() does not — it settles at the head.`,\n    `    return withSecurityHeaders(await toResponse(executeRoute({`,\n    `      route: match.route, method, params: match.params,`,\n    `      req, res, loadModule, serverDir, requestId, ...CSRF_CONFIG, ${runtimeSpread}`,\n    `    })), SECURITY_HEADERS)`,\n    `}`,\n    ``,\n    ...deployedRateLimitFragment(\n      rateLimit,\n      'cloudflare',\n      // `cf-connecting-ip` is the RUNTIME's answer and a caller cannot forge it through the edge.\n      // A Worker reached directly has none, and then only a declared `trustProxy` produces an\n      // address — otherwise `undefined`, which is the named 503 rather than everyone's bucket.\n      `request.headers.get('cf-connecting-ip') ?? resolveClientIpFromRequest(request, TRUST_PROXY)`,\n      // `request` alone: the handler binds `(request, env, ctx)` and the header is on the request.\n      'request',\n    ),\n    ``,\n    `export default {`,\n    `  async fetch(request, env, ctx) {`,\n    `    const url = new URL(request.url)`,\n    ``,\n    `    // #409 — the preflight is answered BEFORE anything routes: an OPTIONS the router handles`,\n    `    // is an OPTIONS the browser never gets a CORS answer to. The WebSocket upgrade above is`,\n    `    // deliberately upstream of it — a 101 is not a CORS-governed response.`,\n    `    const preflight = corsPreflight(request)`,\n    `    if (preflight !== null) return withSecurityHeaders(preflight, SECURITY_HEADERS)`,\n    ...rateLimitCheckFragment(rateLimit, '    ', 'request'),\n    ``,\n    `    // LCR0103 — the upgrade branch sits BELOW the limiter, and the order is the point.`,\n    `    // It used to sit above, under the comment \"a 101 carries no document and no script,`,\n    `    // so the security baseline does not apply to it\". That is true of the security`,\n    `    // HEADERS — a document concern — and false of the limiter, which is a resource`,\n    `    // concern: a long-lived socket is the most expensive thing this entry hands out, so`,\n    `    // the upgrade is the path that most needs a budget, not the one that may skip it.`,\n    `    // T3.4 — Detect WebSocket upgrade and delegate to the CF bridge.`,\n    `    // A 101 carries no document and no script, so the security baseline does`,\n    `    // not apply to it.`,\n    `    if (request.headers.get('upgrade')?.toLowerCase() === 'websocket') {`,\n    `      if (!HAS_WS_ROUTES) return notFoundResponse()`,\n    `      const cfWs = createCloudflareWsBridge({`,\n    `        onOpen: () => {},`,\n    `        onMessage: (ws, data) => { ws.send(data) },`,\n    `        onClose: () => {},`,\n    `      })`,\n    `      return cfWs.handle(request)`,\n    `    }`,\n    ``,\n    `    return withCors(request, await handleRequest(request, url, env))`,\n    `  },`,\n    `}`,\n  ]\n}\n\nexport function renderWranglerToml(): string {\n  return [\n    `# Generated by Theo — Cloudflare Workers`,\n    `name = \"theo-app\"`,\n    `main = \".theokit/cloudflare/worker.mjs\"`,\n    `compatibility_date = \"2025-09-01\"`,\n    `compatibility_flags = [\"nodejs_compat\"]`,\n    ``,\n    `# #412 — \\`[assets]\\` with a BINDING, not the legacy \\`[site]\\` bucket.`,\n    `#`,\n    `# \\`[site]\\` uploads to KV and is read through \\`kv-asset-handler\\` and a`,\n    `# \\`__STATIC_CONTENT\\` binding — neither of which this worker has ever had. So the`,\n    `# bucket was declared, uploaded, and consumed by nothing: with ssrStreaming off, a`,\n    `# deploy answered 404 for its own page. This binding is what the worker calls.`,\n    `[assets]`,\n    `directory = \".theokit/client\"`,\n    `binding = \"ASSETS\"`,\n    `# A client-routed app asks for /dashboard, which is no file. Without this the asset`,\n    `# handler 404s a deep link and the SPA never boots.`,\n    `not_found_handling = \"single-page-application\"`,\n    ``,\n    `# Environment variables are set via wrangler secret or dashboard`,\n    `# Example: wrangler secret put DATABASE_URL`,\n  ].join('\\n')\n}\n\nexport const cloudflareAdapter: DeployAdapter = {\n  name: 'cloudflare',\n  streamsResponses: true,\n  // #409 / #410 — the generated entry calls `executeRoute` with routes, loader\n  // and serverDir only. CSRF, route policy, file middleware and Zod validation\n  // still run because they live inside `executeRoute`; none of the remaining\n  // configurable concerns reach it. Declared explicitly rather than omitted so\n  // the gap is a statement in the source and not an absence.\n  //\n  // `securityHeaders` IS applied: the worker carries `security.headers` as a\n  // literal and puts the built baseline on every response it returns, including\n  // the streamed SSR document — with a per-request nonce, the only deploy path\n  // that can mint one (`adapters/security-headers.ts`).\n  servesAgents: true,\n  appliesConfig: ['securityHeaders', 'csrf', 'disallowed', 'cors', 'serialization', 'plugins'],\n  // B-257 — per-invocation: an in-process counter does not survive, so a declared limit needs a durable store.\n  enforcesRateLimit: 'with-a-store',\n\n  async build(config: TheoConfig, cwd: string, ctx?: AdapterBuildContext): Promise<void> {\n    // Wave 2 (T2.2) — reject polyglot services on this adapter.\n    assertServicesUnsupported('cloudflare', readManifest(cwd))\n\n    // 1. Run the standard Node build first (ctx forwarded so nodeAdapter has makeVitePlugins)\n    await nodeAdapter.build(config, cwd, ctx)\n\n    const outputDir = resolve(cwd, '.theokit/cloudflare')\n    mkdirSync(outputDir, { recursive: true })\n\n    // 2. Emit Worker entry (now uses the shared web-shim)\n    //\n    // The document shell is read HERE, after the Node build produced\n    // `.theokit/client/index.html`, and inlined into the worker: a Worker has no\n    // filesystem at request time. Split on the root div with the same helper the\n    // Node server uses (`ssr-setup.ts`), so the two paths cannot disagree about\n    // where the shell ends (#343).\n    const shell = readDocumentShell(cwd, config.ssrStreaming)\n    // B-035 — the route-to-chunks map, read HERE on the build machine for the same reason the\n    // shell above is: a Worker has no filesystem at request time. `nodeAdapter.build` ran\n    // first, so the map the Node build emitted is on disk by now. Absent map -> nothing about\n    // preloads is emitted, and the worker behaves exactly as it did before.\n    const assetsMap = readAssetsMapForBake(resolve(cwd, '.theokit', 'client', 'assets-map.json'))\n\n    // #369 — the routes are resolved HERE, on the build machine, for the same reason the document\n    // shell above is read here: a Worker has no filesystem at request time, and the worker used to\n    // run the scan itself against a directory that does not exist there.\n    //\n    // The scanner is INJECTED rather than imported: importing it would add an `adapters → server`\n    // edge, which is the layering inversion ADR-0001 v3 removed for `vite-plugin` and which\n    // `adapters-may-only-depend-on-core-router-services` refuses. An absent scanner emits a worker\n    // with no routes rather than falling back to a runtime scan — the fallback IS the defect.\n    const scanned = ctx?.scanRoutes?.(config.serverDir) ?? {\n      routes: [],\n      wsRoutes: [],\n      agents: [],\n      // B-185 — no provider means no scan, and an app whose context nobody looked for is\n      // indistinguishable here from one that has none. Both resolve an anonymous caller, which is\n      // the honest answer rather than an invented subject.\n      contextModule: undefined,\n    }\n\n    const pluginsPlan = planDeployedPlugins(config.plugins, 'cloudflare')\n    if (pluginsPlan !== undefined) {\n      // Beside the worker, so the emitted import is a sibling. Wrangler bundles from here, which is\n      // what lets the static import reach the app's own module at all (#425).\n      writeFileSync(resolve(outputDir, 'theo.plugins.mjs'), pluginsPlan.source)\n    }\n\n    writeFileSync(\n      resolve(outputDir, 'worker.mjs'),\n      renderCloudflareWorkerEntry({\n        ssrStreaming: config.ssrStreaming,\n        ...shell,\n        securityHeaders: config.security?.headers,\n        csrf: config.security?.csrf,\n        disallowed: config.security?.disallowed,\n        cors: config.security?.cors,\n        assetsMap,\n        // #425 — a selector, not a transformer, so it rides as a literal like the values above.\n        serialization: config.serialization,\n        // #425 — the ONE concern that is not a literal. A closure cannot be baked, so a plugin\n        // declared by module specifier is imported by the emitted module instead; a constructed one\n        // is refused by name at build time rather than dropped in silence.\n        runtimeConfigModule: pluginsPlan?.moduleSpecifier,\n        routes: scanned.routes,\n        // #367 — a Worker has no filesystem, so its agents are decided here like its routes.\n        agents: scanned.agents,\n        // B-185 — rides beside the agents because it is decided by the same provider, for the same\n        // reason: `build.ts` holds `serverDir` and a Worker cannot look for the module itself.\n        contextModule: scanned.contextModule,\n        wsRoutes: scanned.wsRoutes,\n      }),\n    )\n\n    // 3. Emit wrangler.toml (with nodejs_compat enforced)\n    writeFileSync(resolve(cwd, 'wrangler.toml'), renderWranglerToml())\n\n    // eslint-disable-next-line no-console -- CLI build progress\n    console.log('\\n  ✓ Cloudflare output → .theokit/cloudflare/ + wrangler.toml')\n    // eslint-disable-next-line no-console -- CLI build progress\n    console.log(\n      `${describeDeployedSecurityHeaders({\n        target: 'cloudflare',\n        securityHeaders: config.security?.headers,\n        // Only the streaming worker renders HTML per request, so only it can put\n        // the same nonce on the header and on the script tag it emits.\n        mintsNonce: config.ssrStreaming,\n        // #412 — either way the worker returns the document now: streamed by\n        // `renderStreamingWeb`, or from the ASSETS binding it finally calls.\n        documentHeaders: 'handler',\n      })}\\n`,\n    )\n  },\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIA,SAAS,YAAY,WAAW,cAAc,qBAAqB;AACnE,SAAS,eAAe;AA+CjB,SAAS,kBACd,KACA,WAC0C;AAC1C,MAAI,CAAC,UAAW,QAAO,CAAC;AAExB,QAAM,YAAY,QAAQ,KAAK,4BAA4B;AAC3D,MAAI,CAAC,WAAW,SAAS,GAAG;AAC1B,UAAM,IAAI;AAAA,MACR,+CAA+C,SAAS;AAAA,IAG1D;AAAA,EACF;AAEA,QAAM,YAAY,aAAa,WAAW,OAAO;AACjD,QAAM,UAAU,YAAY,SAAS;AACrC,MAAI,YAAY,QAAW;AACzB,UAAM,IAAI;AAAA,MACR,wBAAwB,SAAS;AAAA,IAEnC;AAAA,EACF;AAEA,SAAO;AAAA,IACL,UAAU,UAAU,MAAM,GAAG,QAAQ,QAAQ;AAAA,IAC7C,UAAU,UAAU,MAAM,QAAQ,QAAQ;AAAA,EAC5C;AACF;AAcA,SAAS,kBACP,QACuF;AACvF,QAAM,WAAW,CAAC,UAA0B,cAAc,OAAO,KAAK,CAAC;AACvE,SAAO;AAAA,IACL,cAAc,OAAO;AAAA,MACnB,CAAC,OAAO,UAAU,eAAe,SAAS,KAAK,CAAC,gBAAgB,MAAM,QAAQ;AAAA,IAChF;AAAA,IACA,oBAAoB,OAAO;AAAA,MACzB,CAAC,OAAO,UAAU,KAAK,KAAK,UAAU,MAAM,QAAQ,CAAC,KAAK,SAAS,KAAK,CAAC;AAAA,IAC3E;AAAA,IACA,mBAAmB,OAAO;AAAA,MACxB,CAAC,UACC,iBAAiB,KAAK,UAAU,MAAM,QAAQ,CAAC,gBAAgB,KAAK,UAAU,MAAM,SAAS,CAAC,cAClF,KAAK,UAAU,CAAC,GAAI,MAAM,WAAW,CAAC,CAAE,CAAC,CAAC,uBACjC,KAAK,UAAU,MAAM,SAAS,CAAC;AAAA,IACxD;AAAA,EACF;AACF;AAQA,SAAS,kBAAkB,eAAyB,cAAkC;AACpF,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAAA;AAAA;AAAA,IAIA;AAAA,IAKA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AASO,SAAS,qBAAqB,MAAoD;AACvF,MAAI;AACF,WAAO,eAAe,aAAa,MAAM,MAAM,CAAC;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AA2BA,SAAS,gBAAgB,MAGb;AACV,SAAO,KAAK,iBAAiB,QAAQ,KAAK,cAAc;AAC1D;AAEA,SAAS,qBAAqB,WAAyD;AACrF,MAAI,cAAc,OAAW,QAAO;AACpC,SAAO,6BAA6B,KAAK,UAAU,SAAS,CAAC;AAC/D;AAOA,SAAS,mBACP,MACA,eACQ;AACR,SAAO,KAAK,eACR;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,CAAC,gBACG,uBAAuB,KAAK,UAAU,KAAK,YAAY,EAAE,CAAC,MAC1D,4CAA4C,KAAK,UAAU,KAAK,YAAY,EAAE,CAAC;AAAA,IACnF,uBAAuB,KAAK,UAAU,KAAK,YAAY,EAAE,CAAC;AAAA,IAC1D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI,IACX;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACjB;AAEO,SAAS,4BACd,OA6C6B,CAAC,GACtB;AACR,QAAM,kBAAkB,KAAK,eACzB,6DACA;AAuBJ,QAAM,gBAAgB,gBAAgB,IAAI;AAC1C,QAAM,iBAAiB,gBAAgB,qBAAqB,KAAK,SAAS,IAAI;AAE9E,QAAM,eAAe,mBAAmB,MAAM,aAAa;AAO3D,QAAM,EAAE,cAAc,oBAAoB,kBAAkB,IAAI;AAAA,IAC9D,KAAK,UAAU,CAAC;AAAA,EAClB;AACA,QAAM,gBAAgB,8BAA8B,IAAI;AACxD,QAAM,iBAAiB;AAAA,IACrB,KAAK,WAAW,SACZ;AAAA;AAAA;AAAA;AAAA,MAIA,EAAE,MAAM,SAAS,QAAQ,KAAK,QAAQ,eAAe,KAAK,cAAc;AAAA;AAAA,IAC5E;AAAA,MACE,qBAAqB;AAAA;AAAA;AAAA;AAAA,MAIrB,kBACE,KAAK,wBAAwB,SAAY,SAAY;AAAA,IACzD;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,CAAC,gBACG,6IACA;AAAA;AAAA,IACJ;AAAA,IACA,KAAK,eACD,iHACA;AAAA,IACJ;AAAA,IACA;AAAA;AAAA;AAAA;AAAA;AAAA,IAKA,GAAI,KAAK,cAAc,SACnB,CAAC,IACD;AAAA,MACE;AAAA,MACA;AAAA,IACF;AAAA,IACJ;AAAA,IACA;AAAA,IACA,GAAG,cAAc;AAAA,IACjB,GAAG,eAAe;AAAA,IAClB,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA,qBAAqB,iBAAiB,IAAI,CAAC;AAAA,IAC3C;AAAA,IACA,GAAG,kBAAkB,oBAAoB,iBAAiB;AAAA,IAC1D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,4BAA4B,KAAK,eAAe;AAAA,IACnD;AAAA,IACA,GAAG,qBAAqB,MAAM,UAAU;AAAA,IACxC;AAAA,IACA,GAAG,cAAc;AAAA,IACjB,GAAG,eAAe;AAAA,IAClB,GAAG,qBAAqB,KAAK,MAAM,YAAY;AAAA,IAC/C;AAAA,IACA;AAAA,IACA,yBAAyB,QAAQ,KAAK,YAAY,CAAC,GAAG,SAAS,CAAC,CAAC;AAAA,IACjE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,MACD;AAAA,MACA,cAAc;AAAA,MACd,eAAe;AAAA,MACf,eAAe;AAAA,MACf,KAAK;AAAA,IACP;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAWA,SAAS,gCACP,cACA,eACA,aAEA,YAGA,WACU;AACV,SAAO;AAAA,IACL;AAAA,IACA,4CAA4C,UAAU;AAAA,IACtD;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,sBAAsB,WAAW,MAAM;AAAA,IAC1C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,qEAAqE,aAAa;AAAA,IAClF;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,MACD;AAAA,MACA;AAAA;AAAA;AAAA;AAAA,MAIA;AAAA;AAAA,MAEA;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,uBAAuB,WAAW,QAAQ,SAAS;AAAA,IACtD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,qBAA6B;AAC3C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEO,IAAM,oBAAmC;AAAA,EAC9C,MAAM;AAAA,EACN,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWlB,cAAc;AAAA,EACd,eAAe,CAAC,mBAAmB,QAAQ,cAAc,QAAQ,iBAAiB,SAAS;AAAA;AAAA,EAE3F,mBAAmB;AAAA,EAEnB,MAAM,MAAM,QAAoB,KAAa,KAA0C;AAErF,8BAA0B,cAAc,aAAa,GAAG,CAAC;AAGzD,UAAM,YAAY,MAAM,QAAQ,KAAK,GAAG;AAExC,UAAM,YAAY,QAAQ,KAAK,qBAAqB;AACpD,cAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AASxC,UAAM,QAAQ,kBAAkB,KAAK,OAAO,YAAY;AAKxD,UAAM,YAAY,qBAAqB,QAAQ,KAAK,YAAY,UAAU,iBAAiB,CAAC;AAU5F,UAAM,UAAU,KAAK,aAAa,OAAO,SAAS,KAAK;AAAA,MACrD,QAAQ,CAAC;AAAA,MACT,UAAU,CAAC;AAAA,MACX,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA,MAIT,eAAe;AAAA,IACjB;AAEA,UAAM,cAAc,oBAAoB,OAAO,SAAS,YAAY;AACpE,QAAI,gBAAgB,QAAW;AAG7B,oBAAc,QAAQ,WAAW,kBAAkB,GAAG,YAAY,MAAM;AAAA,IAC1E;AAEA;AAAA,MACE,QAAQ,WAAW,YAAY;AAAA,MAC/B,4BAA4B;AAAA,QAC1B,cAAc,OAAO;AAAA,QACrB,GAAG;AAAA,QACH,iBAAiB,OAAO,UAAU;AAAA,QAClC,MAAM,OAAO,UAAU;AAAA,QACvB,YAAY,OAAO,UAAU;AAAA,QAC7B,MAAM,OAAO,UAAU;AAAA,QACvB;AAAA;AAAA,QAEA,eAAe,OAAO;AAAA;AAAA;AAAA;AAAA,QAItB,qBAAqB,aAAa;AAAA,QAClC,QAAQ,QAAQ;AAAA;AAAA,QAEhB,QAAQ,QAAQ;AAAA;AAAA;AAAA,QAGhB,eAAe,QAAQ;AAAA,QACvB,UAAU,QAAQ;AAAA,MACpB,CAAC;AAAA,IACH;AAGA,kBAAc,QAAQ,KAAK,eAAe,GAAG,mBAAmB,CAAC;AAGjE,YAAQ,IAAI,0EAAgE;AAE5E,YAAQ;AAAA,MACN,GAAG,gCAAgC;AAAA,QACjC,QAAQ;AAAA,QACR,iBAAiB,OAAO,UAAU;AAAA;AAAA;AAAA,QAGlC,YAAY,OAAO;AAAA;AAAA;AAAA,QAGnB,iBAAiB;AAAA,MACnB,CAAC,CAAC;AAAA;AAAA,IACJ;AAAA,EACF;AACF;","names":[]}

package/dist/{config-support-O4REYSK5.js → config-support-SB5NDQZB.js}

@@ -2,7 +2,7 @@
 import "tsx/esm";
 import {
   nodeAdapter
-} from "./chunk-KI4DOTN4.js";
+} from "./chunk-G7U7FQVC.js";
 import "./chunk-ZNZISJDZ.js";
 
 // src/adapters/config-support.ts
@@ -118,12 +118,18 @@ var UnenforceableRateLimitError = class extends Error {
   name = "UnenforceableRateLimitError";
 };
 function assertRateLimitEnforceable(config, adapter, target) {
-  const applied = adapter.appliesConfig ?? [];
-  if (applied === "runtime-not-emitted-here") return;
   if (!isDeclared(config, "rateLimit")) return;
-  if (applied.includes("rateLimit")) return;
+  const enforces = adapter.enforcesRateLimit ?? "never";
+  if (enforces === "not-ours-to-judge") return;
+  if (enforces === "always") return;
+  if (enforces === "never") throw new UnenforceableRateLimitError(target);
+  if (declaresRateLimitStore(config)) return;
   throw new UnenforceableRateLimitError(target);
 }
+function declaresRateLimitStore(config) {
+  const limit = config.rateLimit;
+  return typeof limit?.store === "object" && limit.store !== null;
+}
 export {
   CONFIG_CONCERNS,
   UnenforceableRateLimitError,
@@ -132,4 +138,4 @@ export {
   findUnappliedConfig,
   warnUnappliedConfig
 };
-//# sourceMappingURL=config-support-O4REYSK5.js.map
+//# sourceMappingURL=config-support-SB5NDQZB.js.map

package/dist/{config-support-O4REYSK5.js.map → config-support-SB5NDQZB.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/adapters/config-support.ts"],"sourcesContent":["/**\n * Which configuration a deploy target's emitted handler actually applies.\n *\n * `theo.config.ts` validates `rateLimit`, `security.cors`, `security.csrf`,\n * `security.disallowed` and `serialization` for every target. Applying them is\n * the handler's job, and the six Web-standards adapters build `executeRoute`'s\n * context from a subset of its fields, so the rest fall back to hard-coded\n * defaults on a deployed app (usetheokit/theokit#410). `security.cors` was read\n * only by the dev server until #409 wired it into `theokit start`; the six Web\n * targets still drop it.\n *\n * This module does not fix that. It makes it **audible at build time**: a\n * config key that is parsed and then dropped is named, with the target that\n * drops it and the next action. Silence was the defect — an operator who\n * declares a rate limit and gets none has no reason to look.\n *\n * It warns rather than refuses, deliberately. Refusing would break every\n * deployment that declares `rateLimit` today, and the real fix — wiring a\n * limiter that needs a per-runtime client address — is not a build away\n * (`docs/program/journeys/j07-rate-limit.md` § Correction measured what it\n * costs). Forcing an operator to delete valid configuration in order to ship\n * would trade a silent gap for a loud one that also loses information.\n */\nimport type { TheoConfig } from '../config/schema.js'\n\nimport { nodeAdapter } from './node.js'\nimport type { ConfigConcern, DeployAdapter } from './types.js'\n\n/**\n * The closed set. A concern belongs here when it is (a) declarable in\n * `theo.config.ts` and (b) applied by a request handler rather than at build\n * time — a build-time key cannot be silently dropped by a runtime.\n */\nexport const CONFIG_CONCERNS = [\n  'rateLimit',\n  'cors',\n  'csrf',\n  'disallowed',\n  'serialization',\n  'plugins',\n  'securityHeaders',\n] as const satisfies readonly ConfigConcern[]\n\n/**\n * Does any production target apply this concern?\n *\n * DERIVED from what the `node` adapter declares, rather than listed. This was a hand-maintained\n * `APPLIED_BY_NO_TARGET` set holding `cors`, kept in step with `nodeAdapter.appliesConfig` by a\n * test — and #409, which taught `theokit start` to apply `cors`, emptied it. An empty hardcoded\n * set is not merely redundant: it makes the branch below provably unreachable, which the linter\n * says out loud (`sonarjs/no-empty-collection`).\n *\n * Deriving keeps the branch honest AND reachable: the moment a concern is added that `node` does\n * not apply, the advice stops claiming a target exists for it, with nothing to remember.\n */\nfunction appliedByNoTarget(concern: ConfigConcern): boolean {\n  const applied = nodeAdapter.appliesConfig\n  if (applied === undefined || applied === 'runtime-not-emitted-here') return true\n  return !applied.includes(concern)\n}\n\n/** Where each concern lives in the config, for a message the operator can grep. */\nconst CONFIG_KEY: Record<ConfigConcern, string> = {\n  rateLimit: 'rateLimit',\n  cors: 'security.cors',\n  csrf: 'security.csrf',\n  disallowed: 'security.disallowed',\n  serialization: 'serialization',\n  plugins: 'plugins',\n  securityHeaders: 'security.headers',\n}\n\nfunction isDeclared(config: TheoConfig, concern: ConfigConcern): boolean {\n  const security = config.security\n  switch (concern) {\n    case 'rateLimit':\n      return config.rateLimit !== undefined\n    case 'cors':\n      return security?.cors !== undefined\n    case 'csrf':\n      // `csrf` carries `.default('strict')` (config/schemas/security.ts:100) and\n      // the deployed fallback is also `'strict'` (server/http/execute.ts:144).\n      // A config that says `'strict'` therefore gets what it asked for, by\n      // coincidence rather than by wiring -- reporting it dropped would be noise\n      // over an identical outcome. Only a weaker setting is silently ignored.\n      return security?.csrf !== undefined && security.csrf !== 'strict'\n    case 'disallowed':\n      return security?.disallowed !== undefined && security.disallowed.routes.length > 0\n    case 'securityHeaders':\n      return security?.headers !== undefined\n    case 'serialization':\n      // Same shape: `.default('json')` (config/schema.ts:147), and a target with\n      // no transformer serializes as JSON. `'json'` is honoured by coincidence;\n      // `'superjson'` is the case where the deployed app quietly disagrees with\n      // the file.\n      return config.serialization !== 'json'\n    case 'plugins':\n      return config.plugins !== undefined && config.plugins.length > 0\n  }\n}\n\n/**\n * The concerns this config declares and this adapter does not apply.\n *\n * An adapter that emits no request handler of its own answers\n * `'runtime-not-emitted-here'` and is never reported against: it is not that\n * the configuration is dropped, it is that this build cannot know. Saying\n * nothing is the honest output, and it is a different fact from saying no.\n */\nexport function findUnappliedConfig(\n  config: TheoConfig,\n  adapter: Pick<DeployAdapter, 'appliesConfig'>,\n): ConfigConcern[] {\n  const applied = adapter.appliesConfig ?? []\n  if (applied === 'runtime-not-emitted-here') return []\n  return CONFIG_CONCERNS.filter(\n    (concern) => isDeclared(config, concern) && !applied.includes(concern),\n  )\n}\n\n/**\n * The build-time message. Empty string when nothing was dropped, so the caller\n * neither branches nor prints a header over an empty list.\n */\nexport function describeUnappliedConfig(target: string, dropped: readonly ConfigConcern[]): string {\n  if (dropped.length === 0) return ''\n  const one = dropped.length === 1\n  const list = dropped.map((concern) => `      - ${CONFIG_KEY[concern]}`).join('\\n')\n  const elsewhere = dropped.filter((concern) => !appliedByNoTarget(concern))\n  const nowhere = dropped.filter(appliedByNoTarget)\n\n  // The advice has to change with the target, or it degenerates. Building for\n  // `node` with only `security.cors` dropped once produced \"deploy to `node`,\n  // which applies all of the above except security.cors\" -- an instruction to\n  // do what you are already doing, about the one key it then excepts.\n  const actions: string[] = []\n  if (elsewhere.length > 0 && target !== 'node') {\n    actions.push(\n      `    - ${elsewhere.map((c) => CONFIG_KEY[c]).join(', ')}: build for \\`node\\` and run \\`theokit start\\`,`,\n      `      which applies ${elsewhere.length === 1 ? 'it' : 'them'}; or remove ${elsewhere.length === 1 ? 'it' : 'them'} so the file states what runs.`,\n    )\n  } else if (elsewhere.length > 0) {\n    actions.push(\n      `    - ${elsewhere.map((c) => CONFIG_KEY[c]).join(', ')}: remove ${elsewhere.length === 1 ? 'it' : 'them'} so the file states what runs.`,\n    )\n  }\n  if (nowhere.length > 0) {\n    actions.push(\n      `    - ${nowhere.map((c) => CONFIG_KEY[c]).join(', ')}: no production target applies ${nowhere.length === 1 ? 'this' : 'these'} today`,\n      `      (usetheokit/theokit#409) -- terminate it in front of the app, or remove it.`,\n    )\n  }\n\n  return [\n    `  ! ${String(dropped.length)} configuration ${one ? 'key is' : 'keys are'} validated and NOT applied on \\`${target}\\`:`,\n    list,\n    `    The handler this target emits never reads ${one ? 'it' : 'them'}, so the deployed app`,\n    `    behaves as if ${one ? 'the key were' : 'the keys were'} absent.`,\n    `    What to do:`,\n    ...actions,\n    `    Tracked: usetheokit/theokit#410 (deploy targets), usetheokit/theokit#409 (cors).`,\n  ].join('\\n')\n}\n\n/**\n * Emit the warning, if there is one. The sink is injected so the behaviour is\n * exercisable without driving a whole build: the alternative was a caller that\n * only a full `theokit build` could reach, which in practice means a caller\n * nothing tests.\n */\nexport function warnUnappliedConfig(\n  config: TheoConfig,\n  adapter: Pick<DeployAdapter, 'appliesConfig'>,\n  target: string,\n  log: (message: string) => void,\n): void {\n  const dropped = findUnappliedConfig(config, adapter)\n  if (dropped.length === 0) return\n  log(`\\n${describeUnappliedConfig(target, dropped)}\\n`)\n}\n\n/**\n * A declared rate limit the chosen target cannot enforce.\n *\n * Its own class so a caller can distinguish it from a configuration typo — this is not the build\n * failing to understand the file, it is the build understanding it and refusing the combination.\n */\nexport class UnenforceableRateLimitError extends Error {\n  override readonly name = 'UnenforceableRateLimitError'\n  constructor(readonly target: string) {\n    super(\n      [\n        `Refusing to build for \\`${target}\\`: theo.config.ts declares a rate limit and this target does not enforce one.`,\n        ``,\n        `  The config reads as protection the deploy will not have. Nothing at runtime reports the`,\n        `  absence, so the first sign is abuse — which is why this refuses rather than warns.`,\n        ``,\n        `  Two honest ways forward:`,\n        `    • build for \\`node\\` and run \\`theokit start\\`, which applies the limit; or`,\n        `    • remove \\`rateLimit\\` from theo.config.ts, so the file states what actually runs.`,\n        ``,\n        `  There is deliberately no flag to keep the key and skip the check: a config that stays`,\n        `  while doing nothing is the state this refusal exists to end (usetheokit/theokit#461).`,\n      ].join('\\n'),\n    )\n  }\n}\n\n/**\n * Refuse a build whose target drops a DECLARED rate limit.\n *\n * Only `rateLimit`, and the narrowness is the design. A dropped `cors` or `serialization` degrades\n * where someone can see it, and `describeUnappliedConfig`'s warning is proportionate for those.\n * `rateLimit` is the one whose absence looks exactly like success, which is the same reasoning\n * `MissingRoutePolicyError` applies to an undeclared route policy: refuse where silence would be\n * read as safety.\n *\n * `'runtime-not-emitted-here'` is not judged. That adapter's runtime is someone else's and this\n * build cannot answer for it; refusing there would be asserting something unmeasured.\n */\nexport function assertRateLimitEnforceable(\n  config: TheoConfig,\n  adapter: Pick<DeployAdapter, 'appliesConfig'>,\n  target: string,\n): void {\n  const applied = adapter.appliesConfig ?? []\n  if (applied === 'runtime-not-emitted-here') return\n  if (!isDeclared(config, 'rateLimit')) return\n  if (applied.includes('rateLimit')) return\n  throw new UnenforceableRateLimitError(target)\n}\n"],"mappings":";;;;;;;;AAiCO,IAAM,kBAAkB;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAcA,SAAS,kBAAkB,SAAiC;AAC1D,QAAM,UAAU,YAAY;AAC5B,MAAI,YAAY,UAAa,YAAY,2BAA4B,QAAO;AAC5E,SAAO,CAAC,QAAQ,SAAS,OAAO;AAClC;AAGA,IAAM,aAA4C;AAAA,EAChD,WAAW;AAAA,EACX,MAAM;AAAA,EACN,MAAM;AAAA,EACN,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,SAAS;AAAA,EACT,iBAAiB;AACnB;AAEA,SAAS,WAAW,QAAoB,SAAiC;AACvE,QAAM,WAAW,OAAO;AACxB,UAAQ,SAAS;AAAA,IACf,KAAK;AACH,aAAO,OAAO,cAAc;AAAA,IAC9B,KAAK;AACH,aAAO,UAAU,SAAS;AAAA,IAC5B,KAAK;AAMH,aAAO,UAAU,SAAS,UAAa,SAAS,SAAS;AAAA,IAC3D,KAAK;AACH,aAAO,UAAU,eAAe,UAAa,SAAS,WAAW,OAAO,SAAS;AAAA,IACnF,KAAK;AACH,aAAO,UAAU,YAAY;AAAA,IAC/B,KAAK;AAKH,aAAO,OAAO,kBAAkB;AAAA,IAClC,KAAK;AACH,aAAO,OAAO,YAAY,UAAa,OAAO,QAAQ,SAAS;AAAA,EACnE;AACF;AAUO,SAAS,oBACd,QACA,SACiB;AACjB,QAAM,UAAU,QAAQ,iBAAiB,CAAC;AAC1C,MAAI,YAAY,2BAA4B,QAAO,CAAC;AACpD,SAAO,gBAAgB;AAAA,IACrB,CAAC,YAAY,WAAW,QAAQ,OAAO,KAAK,CAAC,QAAQ,SAAS,OAAO;AAAA,EACvE;AACF;AAMO,SAAS,wBAAwB,QAAgB,SAA2C;AACjG,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,QAAM,MAAM,QAAQ,WAAW;AAC/B,QAAM,OAAO,QAAQ,IAAI,CAAC,YAAY,WAAW,WAAW,OAAO,CAAC,EAAE,EAAE,KAAK,IAAI;AACjF,QAAM,YAAY,QAAQ,OAAO,CAAC,YAAY,CAAC,kBAAkB,OAAO,CAAC;AACzE,QAAM,UAAU,QAAQ,OAAO,iBAAiB;AAMhD,QAAM,UAAoB,CAAC;AAC3B,MAAI,UAAU,SAAS,KAAK,WAAW,QAAQ;AAC7C,YAAQ;AAAA,MACN,SAAS,UAAU,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA,MACvD,uBAAuB,UAAU,WAAW,IAAI,OAAO,MAAM,eAAe,UAAU,WAAW,IAAI,OAAO,MAAM;AAAA,IACpH;AAAA,EACF,WAAW,UAAU,SAAS,GAAG;AAC/B,YAAQ;AAAA,MACN,SAAS,UAAU,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,YAAY,UAAU,WAAW,IAAI,OAAO,MAAM;AAAA,IAC3G;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,GAAG;AACtB,YAAQ;AAAA,MACN,SAAS,QAAQ,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,kCAAkC,QAAQ,WAAW,IAAI,SAAS,OAAO;AAAA,MAC9H;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,OAAO,OAAO,QAAQ,MAAM,CAAC,kBAAkB,MAAM,WAAW,UAAU,mCAAmC,MAAM;AAAA,IACnH;AAAA,IACA,iDAAiD,MAAM,OAAO,MAAM;AAAA,IACpE,qBAAqB,MAAM,iBAAiB,eAAe;AAAA,IAC3D;AAAA,IACA,GAAG;AAAA,IACH;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAQO,SAAS,oBACd,QACA,SACA,QACA,KACM;AACN,QAAM,UAAU,oBAAoB,QAAQ,OAAO;AACnD,MAAI,QAAQ,WAAW,EAAG;AAC1B,MAAI;AAAA,EAAK,wBAAwB,QAAQ,OAAO,CAAC;AAAA,CAAI;AACvD;AAQO,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAErD,YAAqB,QAAgB;AACnC;AAAA,MACE;AAAA,QACE,2BAA2B,MAAM;AAAA,QACjC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI;AAAA,IACb;AAfmB;AAAA,EAgBrB;AAAA,EAhBqB;AAAA,EADH,OAAO;AAkB3B;AAcO,SAAS,2BACd,QACA,SACA,QACM;AACN,QAAM,UAAU,QAAQ,iBAAiB,CAAC;AAC1C,MAAI,YAAY,2BAA4B;AAC5C,MAAI,CAAC,WAAW,QAAQ,WAAW,EAAG;AACtC,MAAI,QAAQ,SAAS,WAAW,EAAG;AACnC,QAAM,IAAI,4BAA4B,MAAM;AAC9C;","names":[]}
+{"version":3,"sources":["../src/adapters/config-support.ts"],"sourcesContent":["/**\n * Which configuration a deploy target's emitted handler actually applies.\n *\n * `theo.config.ts` validates `rateLimit`, `security.cors`, `security.csrf`,\n * `security.disallowed` and `serialization` for every target. Applying them is\n * the handler's job, and the six Web-standards adapters build `executeRoute`'s\n * context from a subset of its fields, so the rest fall back to hard-coded\n * defaults on a deployed app (usetheokit/theokit#410). `security.cors` was read\n * only by the dev server until #409 wired it into `theokit start`; the six Web\n * targets still drop it.\n *\n * This module does not fix that. It makes it **audible at build time**: a\n * config key that is parsed and then dropped is named, with the target that\n * drops it and the next action. Silence was the defect — an operator who\n * declares a rate limit and gets none has no reason to look.\n *\n * It warns rather than refuses, deliberately. Refusing would break every\n * deployment that declares `rateLimit` today, and the real fix — wiring a\n * limiter that needs a per-runtime client address — is not a build away\n * (`docs/program/journeys/j07-rate-limit.md` § Correction measured what it\n * costs). Forcing an operator to delete valid configuration in order to ship\n * would trade a silent gap for a loud one that also loses information.\n */\nimport type { TheoConfig } from '../config/schema.js'\n\nimport { nodeAdapter } from './node.js'\nimport type { ConfigConcern, DeployAdapter } from './types.js'\n\n/**\n * The closed set. A concern belongs here when it is (a) declarable in\n * `theo.config.ts` and (b) applied by a request handler rather than at build\n * time — a build-time key cannot be silently dropped by a runtime.\n */\nexport const CONFIG_CONCERNS = [\n  'rateLimit',\n  'cors',\n  'csrf',\n  'disallowed',\n  'serialization',\n  'plugins',\n  'securityHeaders',\n] as const satisfies readonly ConfigConcern[]\n\n/**\n * Does any production target apply this concern?\n *\n * DERIVED from what the `node` adapter declares, rather than listed. This was a hand-maintained\n * `APPLIED_BY_NO_TARGET` set holding `cors`, kept in step with `nodeAdapter.appliesConfig` by a\n * test — and #409, which taught `theokit start` to apply `cors`, emptied it. An empty hardcoded\n * set is not merely redundant: it makes the branch below provably unreachable, which the linter\n * says out loud (`sonarjs/no-empty-collection`).\n *\n * Deriving keeps the branch honest AND reachable: the moment a concern is added that `node` does\n * not apply, the advice stops claiming a target exists for it, with nothing to remember.\n */\nfunction appliedByNoTarget(concern: ConfigConcern): boolean {\n  const applied = nodeAdapter.appliesConfig\n  if (applied === undefined || applied === 'runtime-not-emitted-here') return true\n  return !applied.includes(concern)\n}\n\n/** Where each concern lives in the config, for a message the operator can grep. */\nconst CONFIG_KEY: Record<ConfigConcern, string> = {\n  rateLimit: 'rateLimit',\n  cors: 'security.cors',\n  csrf: 'security.csrf',\n  disallowed: 'security.disallowed',\n  serialization: 'serialization',\n  plugins: 'plugins',\n  securityHeaders: 'security.headers',\n}\n\nfunction isDeclared(config: TheoConfig, concern: ConfigConcern): boolean {\n  const security = config.security\n  switch (concern) {\n    case 'rateLimit':\n      return config.rateLimit !== undefined\n    case 'cors':\n      return security?.cors !== undefined\n    case 'csrf':\n      // `csrf` carries `.default('strict')` (config/schemas/security.ts:100) and\n      // the deployed fallback is also `'strict'` (server/http/execute.ts:144).\n      // A config that says `'strict'` therefore gets what it asked for, by\n      // coincidence rather than by wiring -- reporting it dropped would be noise\n      // over an identical outcome. Only a weaker setting is silently ignored.\n      return security?.csrf !== undefined && security.csrf !== 'strict'\n    case 'disallowed':\n      return security?.disallowed !== undefined && security.disallowed.routes.length > 0\n    case 'securityHeaders':\n      return security?.headers !== undefined\n    case 'serialization':\n      // Same shape: `.default('json')` (config/schema.ts:147), and a target with\n      // no transformer serializes as JSON. `'json'` is honoured by coincidence;\n      // `'superjson'` is the case where the deployed app quietly disagrees with\n      // the file.\n      return config.serialization !== 'json'\n    case 'plugins':\n      return config.plugins !== undefined && config.plugins.length > 0\n  }\n}\n\n/**\n * The concerns this config declares and this adapter does not apply.\n *\n * An adapter that emits no request handler of its own answers\n * `'runtime-not-emitted-here'` and is never reported against: it is not that\n * the configuration is dropped, it is that this build cannot know. Saying\n * nothing is the honest output, and it is a different fact from saying no.\n */\nexport function findUnappliedConfig(\n  config: TheoConfig,\n  adapter: Pick<DeployAdapter, 'appliesConfig'>,\n): ConfigConcern[] {\n  const applied = adapter.appliesConfig ?? []\n  if (applied === 'runtime-not-emitted-here') return []\n  return CONFIG_CONCERNS.filter(\n    (concern) => isDeclared(config, concern) && !applied.includes(concern),\n  )\n}\n\n/**\n * The build-time message. Empty string when nothing was dropped, so the caller\n * neither branches nor prints a header over an empty list.\n */\nexport function describeUnappliedConfig(target: string, dropped: readonly ConfigConcern[]): string {\n  if (dropped.length === 0) return ''\n  const one = dropped.length === 1\n  const list = dropped.map((concern) => `      - ${CONFIG_KEY[concern]}`).join('\\n')\n  const elsewhere = dropped.filter((concern) => !appliedByNoTarget(concern))\n  const nowhere = dropped.filter(appliedByNoTarget)\n\n  // The advice has to change with the target, or it degenerates. Building for\n  // `node` with only `security.cors` dropped once produced \"deploy to `node`,\n  // which applies all of the above except security.cors\" -- an instruction to\n  // do what you are already doing, about the one key it then excepts.\n  const actions: string[] = []\n  if (elsewhere.length > 0 && target !== 'node') {\n    actions.push(\n      `    - ${elsewhere.map((c) => CONFIG_KEY[c]).join(', ')}: build for \\`node\\` and run \\`theokit start\\`,`,\n      `      which applies ${elsewhere.length === 1 ? 'it' : 'them'}; or remove ${elsewhere.length === 1 ? 'it' : 'them'} so the file states what runs.`,\n    )\n  } else if (elsewhere.length > 0) {\n    actions.push(\n      `    - ${elsewhere.map((c) => CONFIG_KEY[c]).join(', ')}: remove ${elsewhere.length === 1 ? 'it' : 'them'} so the file states what runs.`,\n    )\n  }\n  if (nowhere.length > 0) {\n    actions.push(\n      `    - ${nowhere.map((c) => CONFIG_KEY[c]).join(', ')}: no production target applies ${nowhere.length === 1 ? 'this' : 'these'} today`,\n      `      (usetheokit/theokit#409) -- terminate it in front of the app, or remove it.`,\n    )\n  }\n\n  return [\n    `  ! ${String(dropped.length)} configuration ${one ? 'key is' : 'keys are'} validated and NOT applied on \\`${target}\\`:`,\n    list,\n    `    The handler this target emits never reads ${one ? 'it' : 'them'}, so the deployed app`,\n    `    behaves as if ${one ? 'the key were' : 'the keys were'} absent.`,\n    `    What to do:`,\n    ...actions,\n    `    Tracked: usetheokit/theokit#410 (deploy targets), usetheokit/theokit#409 (cors).`,\n  ].join('\\n')\n}\n\n/**\n * Emit the warning, if there is one. The sink is injected so the behaviour is\n * exercisable without driving a whole build: the alternative was a caller that\n * only a full `theokit build` could reach, which in practice means a caller\n * nothing tests.\n */\nexport function warnUnappliedConfig(\n  config: TheoConfig,\n  adapter: Pick<DeployAdapter, 'appliesConfig'>,\n  target: string,\n  log: (message: string) => void,\n): void {\n  const dropped = findUnappliedConfig(config, adapter)\n  if (dropped.length === 0) return\n  log(`\\n${describeUnappliedConfig(target, dropped)}\\n`)\n}\n\n/**\n * A declared rate limit the chosen target cannot enforce.\n *\n * Its own class so a caller can distinguish it from a configuration typo — this is not the build\n * failing to understand the file, it is the build understanding it and refusing the combination.\n */\nexport class UnenforceableRateLimitError extends Error {\n  override readonly name = 'UnenforceableRateLimitError'\n  constructor(readonly target: string) {\n    super(\n      [\n        `Refusing to build for \\`${target}\\`: theo.config.ts declares a rate limit and this target does not enforce one.`,\n        ``,\n        `  The config reads as protection the deploy will not have. Nothing at runtime reports the`,\n        `  absence, so the first sign is abuse — which is why this refuses rather than warns.`,\n        ``,\n        `  Two honest ways forward:`,\n        `    • build for \\`node\\` and run \\`theokit start\\`, which applies the limit; or`,\n        `    • remove \\`rateLimit\\` from theo.config.ts, so the file states what actually runs.`,\n        ``,\n        `  There is deliberately no flag to keep the key and skip the check: a config that stays`,\n        `  while doing nothing is the state this refusal exists to end (usetheokit/theokit#461).`,\n      ].join('\\n'),\n    )\n  }\n}\n\n/**\n * Refuse a build whose target drops a DECLARED rate limit.\n *\n * Only `rateLimit`, and the narrowness is the design. A dropped `cors` or `serialization` degrades\n * where someone can see it, and `describeUnappliedConfig`'s warning is proportionate for those.\n * `rateLimit` is the one whose absence looks exactly like success, which is the same reasoning\n * `MissingRoutePolicyError` applies to an undeclared route policy: refuse where silence would be\n * read as safety.\n *\n * `'runtime-not-emitted-here'` is not judged. That adapter's runtime is someone else's and this\n * build cannot answer for it; refusing there would be asserting something unmeasured.\n */\nexport function assertRateLimitEnforceable(\n  config: TheoConfig,\n  adapter: Pick<DeployAdapter, 'enforcesRateLimit'>,\n  target: string,\n): void {\n  if (!isDeclared(config, 'rateLimit')) return\n\n  // B-257 — this reads `enforcesRateLimit`, NOT `appliesConfig`. They were one list until now, and\n  // `applied.includes('rateLimit')` returned before the throw, so adding that entry to silence the\n  // WARNING also switched off this REFUSAL — on a runtime where the limit still cannot hold.\n  //\n  // **An omitted field REFUSES.** The first cut defaulted to `'not-ours-to-judge'`, which inverted\n  // the rule it replaced: `appliesConfig ?? []` did not include `'rateLimit'`, so an adapter that\n  // declared nothing was refused; `?? 'not-ours-to-judge'` let it through. Measured on\n  // `static.ts`, which declares neither field and is registered at `registry.ts:28` — it went from\n  // refusing a declared limit to proceeding with a console warning. `:213-215` refuses exactly that\n  // outcome in its own words, and this member is on the EXPORTED `DeployAdapter`, so every\n  // third-party adapter inherited the inversion too.\n  //\n  // Abstaining is a CLAIM about somebody else's runtime, and a claim has to be made rather than\n  // inferred from silence.\n  const enforces = adapter.enforcesRateLimit ?? 'never'\n\n  // An adapter emitting no request handler is not judged. Its runtime is someone else's and this\n  // build cannot answer for it; refusing would assert something unmeasured. An ABSTAIN, and the\n  // reason it is not spelled `'never'`.\n  if (enforces === 'not-ours-to-judge') return\n\n  if (enforces === 'always') return\n\n  // `'never'`, and the default for an adapter that declared nothing. Refusing here is what the\n  // pre-B-257 rule did; reaching the store check below would let an undeclared adapter enforce by\n  // accident whenever a config happened to name one.\n  if (enforces === 'never') throw new UnenforceableRateLimitError(target)\n\n  // `'with-a-store'`: a per-invocation runtime enforces only when the config names a durable\n  // counter. Without one the in-process count dies with the invocation, and a limit that forgets is\n  // a limit that does not limit — the same class of failure as a shared bucket, by another road.\n  if (declaresRateLimitStore(config)) return\n\n  throw new UnenforceableRateLimitError(target)\n}\n\n/** Does the declared `rateLimit` name a store the emitted entry could construct? */\nfunction declaresRateLimitStore(config: TheoConfig): boolean {\n  const limit = (config as { rateLimit?: { store?: unknown } }).rateLimit\n  return typeof limit?.store === 'object' && limit.store !== null\n}\n"],"mappings":";;;;;;;;AAiCO,IAAM,kBAAkB;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAcA,SAAS,kBAAkB,SAAiC;AAC1D,QAAM,UAAU,YAAY;AAC5B,MAAI,YAAY,UAAa,YAAY,2BAA4B,QAAO;AAC5E,SAAO,CAAC,QAAQ,SAAS,OAAO;AAClC;AAGA,IAAM,aAA4C;AAAA,EAChD,WAAW;AAAA,EACX,MAAM;AAAA,EACN,MAAM;AAAA,EACN,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,SAAS;AAAA,EACT,iBAAiB;AACnB;AAEA,SAAS,WAAW,QAAoB,SAAiC;AACvE,QAAM,WAAW,OAAO;AACxB,UAAQ,SAAS;AAAA,IACf,KAAK;AACH,aAAO,OAAO,cAAc;AAAA,IAC9B,KAAK;AACH,aAAO,UAAU,SAAS;AAAA,IAC5B,KAAK;AAMH,aAAO,UAAU,SAAS,UAAa,SAAS,SAAS;AAAA,IAC3D,KAAK;AACH,aAAO,UAAU,eAAe,UAAa,SAAS,WAAW,OAAO,SAAS;AAAA,IACnF,KAAK;AACH,aAAO,UAAU,YAAY;AAAA,IAC/B,KAAK;AAKH,aAAO,OAAO,kBAAkB;AAAA,IAClC,KAAK;AACH,aAAO,OAAO,YAAY,UAAa,OAAO,QAAQ,SAAS;AAAA,EACnE;AACF;AAUO,SAAS,oBACd,QACA,SACiB;AACjB,QAAM,UAAU,QAAQ,iBAAiB,CAAC;AAC1C,MAAI,YAAY,2BAA4B,QAAO,CAAC;AACpD,SAAO,gBAAgB;AAAA,IACrB,CAAC,YAAY,WAAW,QAAQ,OAAO,KAAK,CAAC,QAAQ,SAAS,OAAO;AAAA,EACvE;AACF;AAMO,SAAS,wBAAwB,QAAgB,SAA2C;AACjG,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,QAAM,MAAM,QAAQ,WAAW;AAC/B,QAAM,OAAO,QAAQ,IAAI,CAAC,YAAY,WAAW,WAAW,OAAO,CAAC,EAAE,EAAE,KAAK,IAAI;AACjF,QAAM,YAAY,QAAQ,OAAO,CAAC,YAAY,CAAC,kBAAkB,OAAO,CAAC;AACzE,QAAM,UAAU,QAAQ,OAAO,iBAAiB;AAMhD,QAAM,UAAoB,CAAC;AAC3B,MAAI,UAAU,SAAS,KAAK,WAAW,QAAQ;AAC7C,YAAQ;AAAA,MACN,SAAS,UAAU,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA,MACvD,uBAAuB,UAAU,WAAW,IAAI,OAAO,MAAM,eAAe,UAAU,WAAW,IAAI,OAAO,MAAM;AAAA,IACpH;AAAA,EACF,WAAW,UAAU,SAAS,GAAG;AAC/B,YAAQ;AAAA,MACN,SAAS,UAAU,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,YAAY,UAAU,WAAW,IAAI,OAAO,MAAM;AAAA,IAC3G;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,GAAG;AACtB,YAAQ;AAAA,MACN,SAAS,QAAQ,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,kCAAkC,QAAQ,WAAW,IAAI,SAAS,OAAO;AAAA,MAC9H;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,OAAO,OAAO,QAAQ,MAAM,CAAC,kBAAkB,MAAM,WAAW,UAAU,mCAAmC,MAAM;AAAA,IACnH;AAAA,IACA,iDAAiD,MAAM,OAAO,MAAM;AAAA,IACpE,qBAAqB,MAAM,iBAAiB,eAAe;AAAA,IAC3D;AAAA,IACA,GAAG;AAAA,IACH;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAQO,SAAS,oBACd,QACA,SACA,QACA,KACM;AACN,QAAM,UAAU,oBAAoB,QAAQ,OAAO;AACnD,MAAI,QAAQ,WAAW,EAAG;AAC1B,MAAI;AAAA,EAAK,wBAAwB,QAAQ,OAAO,CAAC;AAAA,CAAI;AACvD;AAQO,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAErD,YAAqB,QAAgB;AACnC;AAAA,MACE;AAAA,QACE,2BAA2B,MAAM;AAAA,QACjC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI;AAAA,IACb;AAfmB;AAAA,EAgBrB;AAAA,EAhBqB;AAAA,EADH,OAAO;AAkB3B;AAcO,SAAS,2BACd,QACA,SACA,QACM;AACN,MAAI,CAAC,WAAW,QAAQ,WAAW,EAAG;AAgBtC,QAAM,WAAW,QAAQ,qBAAqB;AAK9C,MAAI,aAAa,oBAAqB;AAEtC,MAAI,aAAa,SAAU;AAK3B,MAAI,aAAa,QAAS,OAAM,IAAI,4BAA4B,MAAM;AAKtE,MAAI,uBAAuB,MAAM,EAAG;AAEpC,QAAM,IAAI,4BAA4B,MAAM;AAC9C;AAGA,SAAS,uBAAuB,QAA6B;AAC3D,QAAM,QAAS,OAA+C;AAC9D,SAAO,OAAO,OAAO,UAAU,YAAY,MAAM,UAAU;AAC7D;","names":[]}

package/dist/{deno-deploy-EUQDK2RC.js → deno-deploy-IVACZ62D.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-V5SSTT3C.js";
 import {
   deployedEntryPreamble
-} from "./chunk-6AGXDYVE.js";
+} from "./chunk-IB5VIXLR.js";
 import {
   agentsDirLiteral,
   deployedAgentsFragment,
@@ -16,10 +16,10 @@ import {
   rateLimitCheckFragment,
   scannedFromLoaderCache,
   serverDirLiteral
-} from "./chunk-IGCOTLQI.js";
+} from "./chunk-C5CAL3DX.js";
 import {
   nodeAdapter
-} from "./chunk-KI4DOTN4.js";
+} from "./chunk-G7U7FQVC.js";
 import "./chunk-WSMLSIS5.js";
 import {
   assertServicesUnsupported,
@@ -95,7 +95,11 @@ function renderDenoEntry(port, opts = {}) {
       // `info.remoteAddr` is the runtime's own answer. A `UnixAddr` has no `hostname`, so the
       // optional chain is what keeps the read from throwing there rather than a guess.
       `info?.remoteAddr?.hostname ?? resolveClientIpFromRequest(request, TRUST_PROXY)`,
-      "request, info"
+      "request, info",
+      // B-257 — `npm:`, like every other specifier this target emits. A bare one does not resolve
+      // on Deno Deploy, and the durable limiter's import is emitted by the fragment rather than
+      // here, so the prefix has to travel with it.
+      "npm:"
     ),
     ``,
     // The serve handler's SECOND parameter is bound here for the first time: `Deno.serve` has
@@ -213,6 +217,8 @@ var denoDeployAdapter = {
   // through it (usetheokit/theokit#412).
   servesAgents: true,
   appliesConfig: ["securityHeaders", "csrf", "disallowed", "cors", "serialization", "plugins"],
+  // B-257 — per-invocation: an in-process counter does not survive, so a declared limit needs a durable store.
+  enforcesRateLimit: "with-a-store",
   build(config, cwd, ctx) {
     return buildDeno(config, cwd, {}, ctx);
   }
@@ -222,4 +228,4 @@ export {
   denoDeployAdapter,
   renderDenoEntry
 };
-//# sourceMappingURL=deno-deploy-EUQDK2RC.js.map
+//# sourceMappingURL=deno-deploy-IVACZ62D.js.map

package/dist/deno-deploy-IVACZ62D.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapters/deno-deploy.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Deno Deploy adapter. Writes to `cwd/.theokit/deno-deploy/`. Build-time.\n */\nimport { mkdirSync, writeFileSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nimport type { TheoConfig } from '../config/schema.js'\nimport { assertServicesUnsupported, readManifest } from '../services/index.js'\n\nimport { deployedAgentsFragment, scannedFromLoaderCache } from './deployed-agents.js'\nimport { planDeployedPlugins } from './deployed-plugins-module.js'\nimport { deployedEntryPreamble } from './deployed-preamble.js'\nimport { deployedRateLimitFragment, rateLimitCheckFragment } from './deployed-rate-limit.js'\nimport {\n  agentsDirLiteral,\n  deployedRuntimeConfigFragment,\n  serverDirLiteral,\n} from './deployed-runtime-config.js'\nimport { deployedTraceFragment } from './deployed-trace.js'\nimport { nodeAdapter } from './node.js'\nimport { describeDeployedSecurityHeaders } from './security-headers.js'\nimport type { AdapterBuildContext, DeployAdapter, DeployedEntryOptions } from './types.js'\n\nexport interface DenoBuildDeps {\n  runNodeBuild?: (config: TheoConfig, cwd: string, ctx?: AdapterBuildContext) => Promise<void>\n  writeEntry?: (path: string, content: string) => void\n  ensureDir?: (path: string) => void\n}\n\n/**\n * The framework imports this entry opens with, as `npm:` specifiers.\n *\n * Extracted from `renderDenoEntry` when adding the configured-directory literal pushed it past the\n * per-function line budget. A cohesive block — every line is one import of the same package family\n * — so lifting it keeps the budget a signal about the renderer rather than about its preamble.\n */\nconst FRAMEWORK_IMPORTS: readonly string[] = [\n  `// Use npm: specifier so Deno resolves theokit from the user's package.json`,\n  `// equivalent (works in both local 'deno run' and Deno Deploy).`,\n  `import { scanServerRoutes, matchRoute, executeRoute, createProductionLoader, scanWebSocketRoutes, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler } from 'npm:theokit/server'`,\n  `import { createWebShim } from 'npm:theokit/adapters/web-shim'`,\n  `import { buildSecurityHeaders, withSecurityHeaders } from 'npm:theokit/adapters/security-headers'`,\n  `// T3.3 — WS bridge for Deno runtime`,\n  `import { createDenoWsBridge } from 'npm:theokit/adapters/ws-shim'`,\n]\n\n/** The target's name, in the five places that spell it. Adding a sixth tripped the duplicate-literal gate. */\n/* The name in the places a gate does NOT read. `assertServicesUnsupported` keeps the literal:\n * `services-other-adapters-reject.test.ts:30` requires each adapter to name ITSELF there, so a\n * copy-paste carrying another adapter's name cannot hide behind a constant. */\nconst TARGET = 'deno-deploy'\n\nexport function renderDenoEntry(port: number, opts: DeployedEntryOptions = {}): string {\n  const runtimeConfig = deployedRuntimeConfigFragment(opts)\n  const agentsFragment = deployedAgentsFragment(scannedFromLoaderCache(agentsDirLiteral(opts)), {\n    notFound: 'notFound()',\n    importPrefix: 'npm:',\n    // B-185 — bound only when the runtime-config fragment declared the const, which is\n    // exactly when a plugins module was emitted. Referencing it otherwise would emit an\n    // identifier the entry never declares.\n    pluginRunnerExpr:\n      opts.runtimeConfigModule === undefined ? undefined : 'await THEO_PLUGIN_RUNNER',\n  })\n  return [\n    `// Generated by Theo — Deno Deploy Adapter`,\n    `// Deploy: deployctl deploy --project=<name> .theokit/deno/server.ts`,\n    `// Requires Deno >= 1.40 (Deno.serve + npm: specifier support)`,\n    ``,\n    `// Runtime guard`,\n    `if (typeof Deno === 'undefined') {`,\n    `  throw new Error('TheoDenoDeployAdapter must run inside Deno.')`,\n    `}`,\n    ``,\n    ...FRAMEWORK_IMPORTS,\n    ``,\n    `const port = Number(Deno.env.get('PORT') ?? '${port}')`,\n    `const cwd = Deno.cwd()`,\n    `const serverDir = cwd + '/' + ${serverDirLiteral(opts)}`,\n    `let routesCache = null`,\n    `let wsRoutesCache = null`,\n    `let loaderCache = null`,\n    ``,\n    `// #410 — the security baseline \\`theokit start\\` puts on every response,`,\n    `// carried here as a literal because the deployed isolate has no`,\n    `// theo.config.ts to read. Non-API paths 404 here and are served by Deno`,\n    `// Deploy's static asset handler, so this covers the API and not the`,\n    `// document (usetheokit/theokit#412).`,\n    ...deployedEntryPreamble(runtimeConfig, agentsFragment, opts, TARGET),\n    ``,\n    `function notFound() {`,\n    `  return new Response(JSON.stringify({ error: { code: 'NOT_FOUND' } }), {`,\n    `    status: 404,`,\n    `    headers: { 'Content-Type': 'application/json' },`,\n    `  })`,\n    `}`,\n    ``,\n    // B-027 — `npm:`, like every other specifier this target emits (`:37-43`). A bare one does\n    // not resolve on Deno Deploy, and the harness asserts the prefix is here before rewriting it.\n    ...(opts.rateLimit === undefined\n      ? []\n      : [\n          `import { createRateLimiterWeb } from 'npm:theokit/server'`,\n          `import { resolveClientIpFromRequest } from 'npm:theokit/server/rate-limit'`,\n          ``,\n        ]),\n    ...deployedRateLimitFragment(\n      opts.rateLimit,\n      TARGET,\n      // `info.remoteAddr` is the runtime's own answer. A `UnixAddr` has no `hostname`, so the\n      // optional chain is what keeps the read from throwing there rather than a guess.\n      `info?.remoteAddr?.hostname ?? resolveClientIpFromRequest(request, TRUST_PROXY)`,\n      'request, info',\n      // B-257 — `npm:`, like every other specifier this target emits. A bare one does not resolve\n      // on Deno Deploy, and the durable limiter's import is emitted by the fragment rather than\n      // here, so the prefix has to travel with it.\n      'npm:',\n    ),\n    ``,\n    // The serve handler's SECOND parameter is bound here for the first time: `Deno.serve` has\n    // always passed it and the emitted entry discarded it.\n    `Deno.serve({ port }, async (request, info) => {`,\n    `  // #409 — the preflight is answered BEFORE anything routes: an OPTIONS the router`,\n    `  // handles is an OPTIONS the browser never gets a CORS answer to.`,\n    `  const preflight = corsPreflight(request)`,\n    `  if (preflight !== null) return withSecurityHeaders(preflight, SECURITY_HEADERS)`,\n    ...rateLimitCheckFragment(opts.rateLimit, '  ', 'request, info'),\n    ``,\n    `  // LCR0103 — the upgrade branch sits BELOW the limiter, and the order is the point.`,\n    `  // It used to sit above, under the comment \"a 101 carries no document and no script,`,\n    `  // so the security baseline does not apply to it\". That is true of the security`,\n    `  // HEADERS — a document concern — and false of the limiter, which is a resource`,\n    `  // concern: a long-lived socket is the most expensive thing this entry hands out, so`,\n    `  // the upgrade is the path that most needs a budget, not the one that may skip it.`,\n    `  // T3.3 — Detect WebSocket upgrade and delegate to the Deno bridge.`,\n    `  // A 101 carries no document and no script, so the security baseline does`,\n    `  // not apply to it.`,\n    `  if (request.headers.get('upgrade')?.toLowerCase() === 'websocket') {`,\n    `    if (!wsRoutesCache) wsRoutesCache = scanWebSocketRoutes(serverDir)`,\n    `    if (wsRoutesCache.length === 0) return notFound()`,\n    `    const denoWs = createDenoWsBridge({`,\n    `      onOpen: () => {},`,\n    `      onMessage: (ws, data) => { ws.send(data) },`,\n    `      onClose: () => {},`,\n    `    }, Deno)`,\n    `    return denoWs.handle(request)`,\n    `  }`,\n    `  return withCors(request, withSecurityHeaders(await handleRequest(request), SECURITY_HEADERS))`,\n    `})`,\n    ``,\n    `async function handleRequest(request) {`,\n    `  const url = new URL(request.url)`,\n    ``,\n    `  if (!url.pathname.startsWith('/api/')${agentsFragment.hostBypass}) {`,\n    `    // Static + SPA fallback are served by Deno Deploy's static asset handler.`,\n    `    return notFound()`,\n    `  }`,\n    ``,\n    `  if (!routesCache) routesCache = scanServerRoutes(serverDir)`,\n    `  if (!loaderCache) loaderCache = createProductionLoader()`,\n    ``,\n    ...agentsFragment.branch,\n    ``,\n    `  const match = matchRoute(url.pathname, routesCache)`,\n    `  if (!match) return notFound()`,\n    ``,\n    `  const { req, res, toResponse } = createWebShim(request)`,\n    ...deployedTraceFragment('request', '  '),\n    `  const method = request.method.toUpperCase()`,\n    `  // #382 — not awaited: toResponse() settles at the headers and carries a`,\n    `  // live body, so Deno.serve streams while the handler writes.`,\n    `  return toResponse(executeRoute({ route: match.route, method, params: match.params, req, res, loadModule: loaderCache, serverDir, requestId, ...CSRF_CONFIG, ${runtimeConfig.executeRouteSpread} }))`,\n    `}`,\n    ``,\n    `console.log('Theo (Deno Deploy) listening on :' + port)`,\n  ].join('\\n')\n}\n\nexport async function buildDeno(\n  config: TheoConfig,\n  cwd: string,\n  deps: DenoBuildDeps = {},\n  ctx?: AdapterBuildContext,\n): Promise<void> {\n  // Wave 2 (T2.2) — reject polyglot services on this adapter.\n  assertServicesUnsupported('deno-deploy', readManifest(cwd))\n\n  const runNodeBuild = deps.runNodeBuild ?? nodeAdapter.build.bind(nodeAdapter)\n  await runNodeBuild(config, cwd, ctx)\n\n  const outputDir = resolve(cwd, '.theokit/deno')\n  const ensureDir = deps.ensureDir ?? ((p: string) => mkdirSync(p, { recursive: true }))\n  ensureDir(outputDir)\n\n  const pluginsPlan = planDeployedPlugins(config.plugins, denoDeployAdapter.name)\n  const entry = renderDenoEntry(config.port, {\n    securityHeaders: config.security?.headers,\n    csrf: config.security?.csrf,\n    disallowed: config.security?.disallowed,\n    cors: config.security?.cors,\n    // #425 — a selector, not a transformer, so it rides as a literal like the values above.\n    serialization: config.serialization,\n    // #425 — the ONE concern that is not a literal. A closure cannot be baked, so a plugin\n    // declared by module specifier is imported by the emitted module instead; a constructed one\n    // is refused by name at build time rather than dropped in silence.\n    runtimeConfigModule: pluginsPlan?.moduleSpecifier,\n    // #95 — the configured directories, which `build.ts:210` already threads into the Vite\n    // plugins. Without these two lines the literals above fall to their defaults and a project\n    // with a custom dir deploys an entry that resolves a directory it does not have.\n    serverDir: config.serverDir,\n    agentsDir: config.agentsDir,\n  })\n  const write =\n    deps.writeEntry ??\n    ((p, c) => {\n      writeFileSync(p, c)\n    })\n  if (pluginsPlan !== undefined) {\n    // Beside the entry, so the emitted import is a sibling. Written through the same seam as\n    // the entry so a test that captures one captures both (#425).\n    write(resolve(outputDir, 'theo.plugins.mjs'), pluginsPlan.source)\n  }\n  write(resolve(outputDir, 'server.ts'), entry)\n\n  // eslint-disable-next-line no-console -- CLI build progress\n  console.log('\\n  ✓ Deno Deploy output → .theokit/deno/server.ts')\n  // eslint-disable-next-line no-console -- CLI build progress\n  console.log(\n    `${describeDeployedSecurityHeaders({\n      target: TARGET,\n      securityHeaders: config.security?.headers,\n      mintsNonce: false,\n      documentHeaders: 'platform-unmanaged',\n    })}\\n`,\n  )\n}\n\nexport const denoDeployAdapter: DeployAdapter = {\n  name: 'deno-deploy',\n  streamsResponses: true,\n  // #409 / #410 — the generated entry calls `executeRoute` with routes, loader\n  // and serverDir only. CSRF, route policy, file middleware and Zod validation\n  // still run because they live inside `executeRoute`; none of the remaining\n  // configurable concerns reach it. Declared explicitly rather than omitted so\n  // the gap is a statement in the source and not an absence.\n  //\n  // `securityHeaders` IS applied -- to every response this isolate returns. The\n  // document comes from Deno Deploy's static asset handler and does not pass\n  // through it (usetheokit/theokit#412).\n  servesAgents: true,\n  appliesConfig: ['securityHeaders', 'csrf', 'disallowed', 'cors', 'serialization', 'plugins'],\n  // B-257 — per-invocation: an in-process counter does not survive, so a declared limit needs a durable store.\n  enforcesRateLimit: 'with-a-store',\n  build(config, cwd, ctx) {\n    return buildDeno(config, cwd, {}, ctx)\n  },\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGA,SAAS,WAAW,qBAAqB;AACzC,SAAS,eAAe;AAgCxB,IAAM,oBAAuC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAMA,IAAM,SAAS;AAER,SAAS,gBAAgB,MAAc,OAA6B,CAAC,GAAW;AACrF,QAAM,gBAAgB,8BAA8B,IAAI;AACxD,QAAM,iBAAiB,uBAAuB,uBAAuB,iBAAiB,IAAI,CAAC,GAAG;AAAA,IAC5F,UAAU;AAAA,IACV,cAAc;AAAA;AAAA;AAAA;AAAA,IAId,kBACE,KAAK,wBAAwB,SAAY,SAAY;AAAA,EACzD,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH;AAAA,IACA,gDAAgD,IAAI;AAAA,IACpD;AAAA,IACA,iCAAiC,iBAAiB,IAAI,CAAC;AAAA,IACvD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,sBAAsB,eAAe,gBAAgB,MAAM,MAAM;AAAA,IACpE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAAA;AAAA,IAGA,GAAI,KAAK,cAAc,SACnB,CAAC,IACD;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACJ,GAAG;AAAA,MACD,KAAK;AAAA,MACL;AAAA;AAAA;AAAA,MAGA;AAAA,MACA;AAAA;AAAA;AAAA;AAAA,MAIA;AAAA,IACF;AAAA,IACA;AAAA;AAAA;AAAA,IAGA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,uBAAuB,KAAK,WAAW,MAAM,eAAe;AAAA,IAC/D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,0CAA0C,eAAe,UAAU;AAAA,IACnE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,eAAe;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,sBAAsB,WAAW,IAAI;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA,iKAAiK,cAAc,kBAAkB;AAAA,IACjM;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,eAAsB,UACpB,QACA,KACA,OAAsB,CAAC,GACvB,KACe;AAEf,4BAA0B,eAAe,aAAa,GAAG,CAAC;AAE1D,QAAM,eAAe,KAAK,gBAAgB,YAAY,MAAM,KAAK,WAAW;AAC5E,QAAM,aAAa,QAAQ,KAAK,GAAG;AAEnC,QAAM,YAAY,QAAQ,KAAK,eAAe;AAC9C,QAAM,YAAY,KAAK,cAAc,CAAC,MAAc,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AACpF,YAAU,SAAS;AAEnB,QAAM,cAAc,oBAAoB,OAAO,SAAS,kBAAkB,IAAI;AAC9E,QAAM,QAAQ,gBAAgB,OAAO,MAAM;AAAA,IACzC,iBAAiB,OAAO,UAAU;AAAA,IAClC,MAAM,OAAO,UAAU;AAAA,IACvB,YAAY,OAAO,UAAU;AAAA,IAC7B,MAAM,OAAO,UAAU;AAAA;AAAA,IAEvB,eAAe,OAAO;AAAA;AAAA;AAAA;AAAA,IAItB,qBAAqB,aAAa;AAAA;AAAA;AAAA;AAAA,IAIlC,WAAW,OAAO;AAAA,IAClB,WAAW,OAAO;AAAA,EACpB,CAAC;AACD,QAAM,QACJ,KAAK,eACJ,CAAC,GAAG,MAAM;AACT,kBAAc,GAAG,CAAC;AAAA,EACpB;AACF,MAAI,gBAAgB,QAAW;AAG7B,UAAM,QAAQ,WAAW,kBAAkB,GAAG,YAAY,MAAM;AAAA,EAClE;AACA,QAAM,QAAQ,WAAW,WAAW,GAAG,KAAK;AAG5C,UAAQ,IAAI,8DAAoD;AAEhE,UAAQ;AAAA,IACN,GAAG,gCAAgC;AAAA,MACjC,QAAQ;AAAA,MACR,iBAAiB,OAAO,UAAU;AAAA,MAClC,YAAY;AAAA,MACZ,iBAAiB;AAAA,IACnB,CAAC,CAAC;AAAA;AAAA,EACJ;AACF;AAEO,IAAM,oBAAmC;AAAA,EAC9C,MAAM;AAAA,EACN,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUlB,cAAc;AAAA,EACd,eAAe,CAAC,mBAAmB,QAAQ,cAAc,QAAQ,iBAAiB,SAAS;AAAA;AAAA,EAE3F,mBAAmB;AAAA,EACnB,MAAM,QAAQ,KAAK,KAAK;AACtB,WAAO,UAAU,QAAQ,KAAK,CAAC,GAAG,GAAG;AAAA,EACvC;AACF;","names":[]}