theokit 0.71.0 → 0.72.1

package/dist/{dev-CD4YU5FN.js → dev-JDJWMRLH.js}

@@ -5,22 +5,22 @@ import {
 } from "./chunk-GEQJAFSV.js";
 import {
   initCacheEngineFromConfig
-} from "./chunk-NZDGV4YJ.js";
+} from "./chunk-YCF3N4JS.js";
 import {
   preflightNodeAndBindings
 } from "./chunk-KTMQUYED.js";
 import {
   theoPluginAsync
-} from "./chunk-V6VARIR3.js";
-import "./chunk-PGDBSK2L.js";
+} from "./chunk-4EQEJ4PH.js";
+import "./chunk-L6UHMWXU.js";
 import "./chunk-BDH5GKFZ.js";
 import "./chunk-3PWQQWT6.js";
 import "./chunk-FDOOBTXJ.js";
-import "./chunk-5XXXJ6DT.js";
+import "./chunk-E2RC367T.js";
 import "./chunk-BINRCILF.js";
 import "./chunk-QD5X56I3.js";
 import "./chunk-WSMLSIS5.js";
-import "./chunk-MS4A7N77.js";
+import "./chunk-PEL3MJLM.js";
 import "./chunk-C27VRUVN.js";
 import "./chunk-7UZZHCRN.js";
 import "./chunk-47MM2JUK.js";
@@ -30,16 +30,16 @@ import "./chunk-NO6HA4FG.js";
 import "./chunk-Z7CJHDLS.js";
 import {
   loadConfig
-} from "./chunk-FFS7IRZF.js";
+} from "./chunk-SZWGXHY3.js";
 import {
   loadEnv
 } from "./chunk-3QPVEJ7D.js";
 import "./chunk-U5PWXS3J.js";
-import "./chunk-TMQ52AZR.js";
+import "./chunk-X2LFNDJQ.js";
 import {
   orchestrateDev
 } from "./chunk-ZNZISJDZ.js";
-import "./chunk-OSBGZYXZ.js";
+import "./chunk-D2R5SJEL.js";
 import "./chunk-5ODOE6EF.js";
 import "./chunk-VQIUTCK2.js";
 
@@ -128,4 +128,4 @@ export {
   devCommand,
   startDevServer
 };
-//# sourceMappingURL=dev-CD4YU5FN.js.map
+//# sourceMappingURL=dev-JDJWMRLH.js.map

package/dist/{index-inRdhi59.d.ts → index-CmkWlIDO.d.ts}

@@ -578,6 +578,8 @@ declare function _resetMiddlewareCacheForTests(): void;
 declare class MiddlewareNextUnavailableError extends Error {
     constructor();
 }
+/** Test seam: the latch is per-process, and a suite needs to assert the FIRST warning repeatedly. */
+declare function _resetUninvocableWarningsForTests(): void;
 declare function runMiddlewareAndContext(req: IncomingMessage, res: ServerResponse, loadModule: LoadModule, serverDir: string): Promise<MiddlewareResult>;
 /**
  * Run ONLY the application's `server/context.ts` factory and return what it produced.
@@ -986,4 +988,4 @@ interface OpenApiDocsOptions {
  */
 declare function createOpenApiHandler(opts?: OpenApiDocsOptions): (request: Request) => Response | null;
 
-export { extractTraceId as $, appendCookieToHeaders as A, BATCH_PATH as B, type CookieOptions as C, appendDeleteCookieToHeaders as D, type ExecuteActionOptions as E, FileTooLargeError as F, callProcedure as G, type HandleBatchOptions as H, createCorsHandler as I, createCorsWebHandler as J, createOpenApiHandler as K, createServerContext as L, MAX_ERROR_HTML_BYTES as M, NotFoundError as N, type OpenApiDocsOptions as O, type ParsedBody as P, deleteCookie as Q, type RawRouteInput as R, STRIPPED_HEADERS as S, TRACE_HEADER as T, type UploadedFile as U, envelopeCodeToStatus as V, type W3CTraceContext as W, executeAction as X, executeRoute as Y, executeWebRequest as Z, _resetMiddlewareCacheForTests as _, type BatchExecuteFn as a, extractTraceIdFromRequest as a0, extractW3CTraceContext as a1, fromUnknown as a2, getCookie as a3, getCookieFromRequest as a4, handleBatchRequest as a5, handleRequestError as a6, handleWebRequestError as a7, injectModulePreloads as a8, jsonTransformer as a9, loadCustomErrorPages as aa, matchesOrigin as ab, parseCookieHeader as ac, parseRequestBody as ad, parseTraceparent as ae, parseTraceparentContext as af, resolveTransformer as ag, resolveUserModule as ah, runMiddlewareAndContext as ai, sendError as aj, sendJson as ak, serializeCookie as al, serveStaticFile as am, serverErrorToEnvelope as an, setCookie as ao, superjsonTransformer as ap, validateRouteInput as aq, BatchPathConflictError as b, type BatchPayload as c, type BatchRequestItem as d, type BatchResponse as e, type BatchResultItem as f, type BodyParserOptions as g, type CorsConfig as h, type CorsHandler as i, type CorsOrigin as j, type CorsWebHandler as k, type CustomErrorPages as l, type ExecuteRouteContext as m, MiddlewareNextUnavailableError as n, type MiddlewareResult as o, type ProcedureInput as p, ProcedureInputError as q, ProcedureOutputError as r, type RouteInputChannel as s, type RouteInputSchemas as t, type RouteInputValidation as u, type SendErrorInput as v, type SendErrorOptions as w, TRACE_PARENT_HEADER as x, TheoError as y, type TheoTransformer as z };
+export { executeWebRequest as $, _resetUninvocableWarningsForTests as A, BATCH_PATH as B, type CookieOptions as C, appendCookieToHeaders as D, type ExecuteActionOptions as E, FileTooLargeError as F, appendDeleteCookieToHeaders as G, type HandleBatchOptions as H, callProcedure as I, createCorsHandler as J, createCorsWebHandler as K, createOpenApiHandler as L, MAX_ERROR_HTML_BYTES as M, NotFoundError as N, type OpenApiDocsOptions as O, type ParsedBody as P, createServerContext as Q, type RawRouteInput as R, STRIPPED_HEADERS as S, TRACE_HEADER as T, type UploadedFile as U, deleteCookie as V, type W3CTraceContext as W, envelopeCodeToStatus as X, executeAction as Y, executeRoute as Z, _resetMiddlewareCacheForTests as _, type BatchExecuteFn as a, extractTraceId as a0, extractTraceIdFromRequest as a1, extractW3CTraceContext as a2, fromUnknown as a3, getCookie as a4, getCookieFromRequest as a5, handleBatchRequest as a6, handleRequestError as a7, handleWebRequestError as a8, injectModulePreloads as a9, jsonTransformer as aa, loadCustomErrorPages as ab, matchesOrigin as ac, parseCookieHeader as ad, parseRequestBody as ae, parseTraceparent as af, parseTraceparentContext as ag, resolveTransformer as ah, resolveUserModule as ai, runMiddlewareAndContext as aj, sendError as ak, sendJson as al, serializeCookie as am, serveStaticFile as an, serverErrorToEnvelope as ao, setCookie as ap, superjsonTransformer as aq, validateRouteInput as ar, BatchPathConflictError as b, type BatchPayload as c, type BatchRequestItem as d, type BatchResponse as e, type BatchResultItem as f, type BodyParserOptions as g, type CorsConfig as h, type CorsHandler as i, type CorsOrigin as j, type CorsWebHandler as k, type CustomErrorPages as l, type ExecuteRouteContext as m, MiddlewareNextUnavailableError as n, type MiddlewareResult as o, type ProcedureInput as p, ProcedureInputError as q, ProcedureOutputError as r, type RouteInputChannel as s, type RouteInputSchemas as t, type RouteInputValidation as u, type SendErrorInput as v, type SendErrorOptions as w, TRACE_PARENT_HEADER as x, TheoError as y, type TheoTransformer as z };

package/dist/index.d.ts

@@ -2,9 +2,9 @@ import { z } from 'zod';
 import { T as TheoErrorEnvelope } from './error-envelope-DG47lt8E.js';
 export { theoPlugin } from './vite-plugin/index.js';
 import 'vite';
-import './rate-limit-BdNDZ3vt.js';
+import './rate-limit-fULgvzCz.js';
 import 'node:http';
-import './rate-limit-store-BEJnhWdw.js';
+import './rate-limit-store-n1wD4Yk4.js';
 import './csrf-readiness-store-CjIoub3U.js';
 import './schema-BdakLtuC.js';
 
@@ -69,7 +69,17 @@ declare const theoConfigSchema: z.ZodObject<{
     rateLimit: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
         windowMs: z.ZodNumber;
         max: z.ZodNumber;
+        store: z.ZodOptional<z.ZodObject<{
+            module: z.ZodString;
+            factory: z.ZodString;
+            options: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+        }, z.core.$strip>>;
     }, z.core.$strip>, z.ZodObject<{
+        store: z.ZodOptional<z.ZodObject<{
+            module: z.ZodString;
+            factory: z.ZodString;
+            options: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+        }, z.core.$strip>>;
         default: z.ZodOptional<z.ZodObject<{
             windowMs: z.ZodNumber;
             max: z.ZodNumber;

package/dist/index.js

@@ -8,19 +8,19 @@ import {
   scanRoutes,
   theoConfigSchema,
   theoPlugin
-} from "./chunk-FWEXQ2BR.js";
+} from "./chunk-XLSJWKSP.js";
 import "./chunk-7NRFZBAL.js";
 import "./chunk-SSYDEKWF.js";
-import "./chunk-JMN4COMK.js";
-import "./chunk-3NAKOWTX.js";
-import "./chunk-SX7ZAHNE.js";
+import "./chunk-D7STTNQN.js";
+import "./chunk-6U67SO5U.js";
+import "./chunk-WBB3MEEN.js";
 import "./chunk-OIGJOYX6.js";
 import "./chunk-U3SPBLJF.js";
 import "./chunk-WSOAN4KN.js";
 import "./chunk-ENSFCKP6.js";
 import "./chunk-OGLS76RN.js";
-import "./chunk-KOG5K26V.js";
-import "./chunk-4D4YVXHR.js";
+import "./chunk-2Z7TANA4.js";
+import "./chunk-SYIQV4UH.js";
 import "./chunk-P6OS7652.js";
 import "./chunk-ZDUO4IYN.js";
 import "./chunk-IDWN2OSG.js";
@@ -31,7 +31,7 @@ import "./chunk-ZDCCILMP.js";
 import "./chunk-CHTAWXC2.js";
 import "./chunk-AVQU5CQF.js";
 import "./chunk-VSLTKX5L.js";
-import "./chunk-TNI4MARH.js";
+import "./chunk-SFGGRC35.js";
 import "./chunk-4ERYQBL6.js";
 import "./chunk-4CIHLTSI.js";
 import "./chunk-FHQP23Z5.js";

package/dist/{info-2H7I55YN.js → info-SUX7QVA3.js}

@@ -5,12 +5,12 @@ import {
 } from "./chunk-47MM2JUK.js";
 import {
   loadConfig
-} from "./chunk-FFS7IRZF.js";
+} from "./chunk-SZWGXHY3.js";
 import "./chunk-3QPVEJ7D.js";
 import "./chunk-U5PWXS3J.js";
-import "./chunk-TMQ52AZR.js";
+import "./chunk-X2LFNDJQ.js";
 import "./chunk-ZNZISJDZ.js";
-import "./chunk-OSBGZYXZ.js";
+import "./chunk-D2R5SJEL.js";
 
 // src/cli/commands/info.ts
 import { existsSync, readFileSync } from "fs";
@@ -103,4 +103,4 @@ export {
   buildInfo,
   infoCommand
 };
-//# sourceMappingURL=info-2H7I55YN.js.map
+//# sourceMappingURL=info-SUX7QVA3.js.map

package/dist/{internal-api-TMLSNYMP.js → internal-api-6XNLCNI5.js}

@@ -1,9 +1,9 @@
 import {
   dispatchControllerRequest
-} from "./chunk-JMN4COMK.js";
+} from "./chunk-D7STTNQN.js";
 import {
   mountAgent
-} from "./chunk-SX7ZAHNE.js";
+} from "./chunk-WBB3MEEN.js";
 import {
   CSP_REPORT_PATH,
   CsrfReadinessStore,
@@ -18,11 +18,11 @@ import {
   executeAction,
   executeRoute,
   handleBatchRequest
-} from "./chunk-KOG5K26V.js";
+} from "./chunk-2Z7TANA4.js";
 import {
   incomingMessageToHandlerRequest,
   sendError
-} from "./chunk-4D4YVXHR.js";
+} from "./chunk-SYIQV4UH.js";
 import "./chunk-P6OS7652.js";
 import "./chunk-ZDUO4IYN.js";
 import "./chunk-IDWN2OSG.js";
@@ -43,7 +43,7 @@ import {
 } from "./chunk-VSLTKX5L.js";
 import {
   createRateLimiter
-} from "./chunk-TNI4MARH.js";
+} from "./chunk-SFGGRC35.js";
 import {
   createViteLoader
 } from "./chunk-4ERYQBL6.js";
@@ -108,4 +108,4 @@ export {
   scanWebSocketRoutes,
   sendError
 };
-//# sourceMappingURL=internal-api-TMLSNYMP.js.map
+//# sourceMappingURL=internal-api-6XNLCNI5.js.map

package/dist/{internal-api-WAKX6AZW.js → internal-api-VDYOXOT7.js}

@@ -16,7 +16,7 @@ import {
   handleCspReport,
   handleCsrfReadiness,
   mountAgent
-} from "./chunk-5XXXJ6DT.js";
+} from "./chunk-E2RC367T.js";
 import {
   resolveProvider
 } from "./chunk-BINRCILF.js";
@@ -31,7 +31,7 @@ import {
 import {
   TRACE_HEADER,
   extractTraceId
-} from "./chunk-MS4A7N77.js";
+} from "./chunk-PEL3MJLM.js";
 import {
   logRequest
 } from "./chunk-C27VRUVN.js";
@@ -52,7 +52,7 @@ import {
 } from "./chunk-NO6HA4FG.js";
 import "./chunk-Z7CJHDLS.js";
 import "./chunk-U5PWXS3J.js";
-import "./chunk-OSBGZYXZ.js";
+import "./chunk-D2R5SJEL.js";
 import "./chunk-VQIUTCK2.js";
 export {
   ACTION_SCHEMAS_DIR,
@@ -87,4 +87,4 @@ export {
   scanWebSocketRoutes,
   sendError
 };
-//# sourceMappingURL=internal-api-WAKX6AZW.js.map
+//# sourceMappingURL=internal-api-VDYOXOT7.js.map

package/dist/{load-config-VMKOV44Y.js → load-config-52H3EKAA.js}

@@ -3,14 +3,14 @@ import "tsx/esm";
 import {
   deepMerge,
   loadConfig
-} from "./chunk-FFS7IRZF.js";
+} from "./chunk-SZWGXHY3.js";
 import "./chunk-3QPVEJ7D.js";
 import "./chunk-U5PWXS3J.js";
-import "./chunk-TMQ52AZR.js";
+import "./chunk-X2LFNDJQ.js";
 import "./chunk-ZNZISJDZ.js";
-import "./chunk-OSBGZYXZ.js";
+import "./chunk-D2R5SJEL.js";
 export {
   deepMerge,
   loadConfig
 };
-//# sourceMappingURL=load-config-VMKOV44Y.js.map
+//# sourceMappingURL=load-config-52H3EKAA.js.map

package/dist/{mcp-HS26ZCU4.js → mcp-WJNCTM7M.js}

@@ -2,7 +2,7 @@
 import "tsx/esm";
 import {
   createAgentSsrLoader
-} from "./chunk-DSPEN7ZJ.js";
+} from "./chunk-DKX7LF5Q.js";
 import {
   extractAppResources,
   handleMcpJsonRpc
@@ -46,7 +46,7 @@ async function serveMcpStdio(mod, name, appResources, streams) {
 // src/cli/commands/mcp.ts
 async function mcpCommand(name, deps = {}) {
   const projectRoot = deps.projectRoot ?? process.cwd();
-  const agentsDir = deps.agentsDir ?? (await (await import("./load-config-VMKOV44Y.js")).loadConfig(projectRoot)).agentsDir;
+  const agentsDir = deps.agentsDir ?? (await (await import("./load-config-52H3EKAA.js")).loadConfig(projectRoot)).agentsDir;
   const agent = scanAgents(projectRoot, agentsDir).find((a) => a.name === name);
   if (!agent) {
     const names = scanAgents(projectRoot, agentsDir).map((a) => a.name).join(", ");
@@ -75,4 +75,4 @@ async function mcpCommand(name, deps = {}) {
 export {
   mcpCommand
 };
-//# sourceMappingURL=mcp-HS26ZCU4.js.map
+//# sourceMappingURL=mcp-WJNCTM7M.js.map

package/dist/{netlify-LEYEQZK6.js → netlify-3HEWV375.js}

@@ -2,7 +2,7 @@
 import "tsx/esm";
 import {
   deployedEntryPreamble
-} from "./chunk-6AGXDYVE.js";
+} from "./chunk-IB5VIXLR.js";
 import {
   JSON_NOT_FOUND_RESPONSE,
   agentsDirLiteral,
@@ -13,10 +13,10 @@ import {
   describeDeployedSecurityHeaders,
   rateLimitCheckFragment,
   scannedFromLoaderCache
-} from "./chunk-IGCOTLQI.js";
+} from "./chunk-C5CAL3DX.js";
 import {
   nodeAdapter
-} from "./chunk-KI4DOTN4.js";
+} from "./chunk-G7U7FQVC.js";
 import {
   buildSecurityHeaders
 } from "./chunk-WSMLSIS5.js";
@@ -256,6 +256,8 @@ var netlifyAdapter = {
   // The document is served by Netlify's static host and does not pass through
   // it (usetheokit/theokit#412).
   appliesConfig: ["securityHeaders", "csrf", "disallowed", "cors", "serialization"],
+  // B-257 — per-invocation: an in-process counter does not survive, so a declared limit needs a durable store.
+  enforcesRateLimit: "with-a-store",
   build(config, cwd, ctx) {
     return buildNetlify(config, cwd, {}, ctx);
   }
@@ -267,4 +269,4 @@ export {
   netlifyAdapter,
   renderNetlifyFunction
 };
-//# sourceMappingURL=netlify-LEYEQZK6.js.map
+//# sourceMappingURL=netlify-3HEWV375.js.map

package/dist/{netlify-LEYEQZK6.js.map → netlify-3HEWV375.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/adapters/netlify.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Netlify deploy adapter. All paths derived from `cwd` and a fixed\n * `.theokit/netlify/` output layout. Build-time tool — no HTTP input.\n */\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nimport type { TheoConfig } from '../config/schema.js'\nimport type { SecurityHeadersConfig } from '../core/contracts/security-headers.js'\nimport { assertServicesUnsupported, readManifest } from '../services/index.js'\n\nimport {\n  deployedAgentsFragment,\n  JSON_NOT_FOUND_RESPONSE,\n  scannedFromLoaderCache,\n} from './deployed-agents.js'\nimport { type DeployedCorsOptions } from './deployed-cors.js'\nimport { type DeployedCsrfOptions } from './deployed-csrf.js'\nimport { deployedEntryPreamble } from './deployed-preamble.js'\nimport { deployedRateLimitFragment, rateLimitCheckFragment } from './deployed-rate-limit.js'\nimport type { DeployedRateLimitOptions } from './deployed-rate-limit.js'\nimport {\n  agentsDirLiteral,\n  type DeployedAgentsDirOptions,\n  deployedRuntimeConfigFragment,\n  type DeployedRuntimeConfigOptions,\n} from './deployed-runtime-config.js'\nimport { deployedTraceFragment } from './deployed-trace.js'\nimport { nodeAdapter } from './node.js'\nimport { buildSecurityHeaders, describeDeployedSecurityHeaders } from './security-headers.js'\nimport type { AdapterBuildContext, DeployAdapter } from './types.js'\n\nexport class NetlifyConflictError extends Error {\n  constructor(path: string, currentTo: string) {\n    super(\n      `netlify.toml has a conflicting redirect: \"${path}\" → \"${currentTo}\". ` +\n        `Remove it manually or edit it to point to \"/.netlify/functions/theo\" ` +\n        `before running the Netlify adapter again.`,\n    )\n    this.name = 'NetlifyConflictError'\n  }\n}\n\nexport interface NetlifyBuildDeps {\n  runNodeBuild?: (config: TheoConfig, cwd: string, ctx?: AdapterBuildContext) => Promise<void>\n  writeFile?: (path: string, content: string) => void\n  ensureDir?: (path: string) => void\n  readTomlIfExists?: () => string | null\n}\n\nexport function renderNetlifyFunction(\n  opts: { securityHeaders?: SecurityHeadersConfig } & DeployedAgentsDirOptions &\n    DeployedCsrfOptions &\n    DeployedRuntimeConfigOptions &\n    DeployedCorsOptions &\n    DeployedRateLimitOptions = {},\n): string {\n  const runtimeConfig = deployedRuntimeConfigFragment(opts)\n  // B-235. Netlify's handler is `(request, context)` and already RECEIVES a Web `Request`, which\n  // is the shape this branch needs — the item filed against it counted `new Request` occurrences\n  // and concluded the opposite, measuring how the entry OBTAINS a request rather than whether it\n  // has one. Deno is the model: same `loaderCache`, same filesystem `serverDir`, same guard.\n  const agentsFragment = deployedAgentsFragment(scannedFromLoaderCache(agentsDirLiteral(opts)), {\n    // Netlify answers its own 404 inline rather than through a helper, so the fragment is given\n    // the expression instead of a call it would have to declare.\n    notFound: `new Response('Not Found', { status: 404 })`,\n  })\n  return [\n    `// Generated by Theo — Netlify Functions adapter`,\n    `import { resolve } from 'node:path'`,\n    `import { scanServerRoutes, matchRoute, executeRoute, createProductionLoader, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler } from 'theokit/server'`,\n    `import { createWebShim } from 'theokit/adapters/web-shim'`,\n    `import { buildSecurityHeaders, withSecurityHeaders } from 'theokit/adapters/security-headers'`,\n    ``,\n    `const cwd = process.cwd()`,\n    `const serverDir = resolve(cwd, 'server')`,\n    `let routesCache = null`,\n    `let loaderCache = null`,\n    ``,\n    `// #410 — the security baseline \\`theokit start\\` puts on every response,`,\n    `// carried here as a literal because the deployed function has no`,\n    `// theo.config.ts to read. The netlify.toml redirect routes only /api/* here,`,\n    `// so this covers the API and not the document Netlify's static host serves`,\n    `// (usetheokit/theokit#412).`,\n    ...deployedEntryPreamble(runtimeConfig, agentsFragment, opts, 'netlify'),\n    ``,\n    // B-027 — emitted only when a limit is declared.\n    ...(opts.rateLimit === undefined\n      ? []\n      : [\n          `import { createRateLimiterWeb } from 'theokit/server'`,\n          `import { resolveClientIpFromRequest } from 'theokit/server/rate-limit'`,\n          ``,\n        ]),\n    ...deployedRateLimitFragment(\n      opts.rateLimit,\n      'netlify',\n      // `context.ip` is the platform's own answer, read from the handler context Netlify passes.\n      // The forwarded fallback covers a function shape that carries no context, and returns\n      // `undefined` unless a `trustProxy` was declared — which is the named 503, not a shared key.\n      `context?.ip ?? resolveClientIpFromRequest(request, TRUST_PROXY)`,\n      // Both names are bound in the OUTER handler, which is where the check runs. Threading\n      // `context` into `handleRequest` — which the plan called for — buys nothing: the limiter\n      // never runs in there.\n      'request, context',\n    ),\n    ``,\n    `export default async (request, context) => {`,\n    `  // #409 — the preflight is answered BEFORE anything routes: an OPTIONS the router`,\n    `  // handles is an OPTIONS the browser never gets a CORS answer to.`,\n    `  const preflight = corsPreflight(request)`,\n    `  if (preflight !== null) return withSecurityHeaders(preflight, SECURITY_HEADERS)`,\n    ...rateLimitCheckFragment(opts.rateLimit, '  ', 'request, context'),\n    `  return withCors(request, withSecurityHeaders(await handleRequest(request), SECURITY_HEADERS))`,\n    `}`,\n    ``,\n    `async function handleRequest(request) {`,\n    `  const url = new URL(request.url)`,\n    `  if (!url.pathname.startsWith('/api/')${agentsFragment.hostBypass}) {`,\n    `    return new Response('Not Found', { status: 404 })`,\n    `  }`,\n    ``,\n    `  if (!routesCache) routesCache = scanServerRoutes(serverDir)`,\n    `  if (!loaderCache) loaderCache = createProductionLoader()`,\n    ``,\n    ...agentsFragment.branch,\n    ``,\n    `  const match = matchRoute(url.pathname, routesCache)`,\n    `  if (!match) return ${JSON_NOT_FOUND_RESPONSE}`,\n    ``,\n    `  const { req, res, toResponse } = createWebShim(request)`,\n    ...deployedTraceFragment('request', '  '),\n    `  const method = request.method.toUpperCase()`,\n    `  // #382 — the run is not awaited: toResponse() settles at the headers and`,\n    `  // carries a live body, so Netlify streams while the handler writes.`,\n    `  return toResponse(executeRoute({ route: match.route, method, params: match.params, req, res, loadModule: loaderCache, serverDir, requestId, ...CSRF_CONFIG, ${runtimeConfig.executeRouteSpread} }))`,\n    `}`,\n  ].join('\\n')\n}\n\nconst THEO_REDIRECT_FROM = '/api/*'\nconst THEO_REDIRECT_TO = '/.netlify/functions/theo'\n\n/**\n * TOML merge (EC-2) — non-destructive.\n *\n * We avoid adding a TOML parser dependency by working at the line level. The\n * supported subset is sufficient for the Netlify use case:\n *   - detect existing `[[redirects]]` blocks\n *   - find a block whose `from = \"...\"` matches our target\n *   - error if such a block points elsewhere\n *   - otherwise append our block\n *\n * Unknown sections (e.g. `[build]`, `[[headers]]`, `[context.production.environment]`)\n * are preserved as-is.\n */\ninterface NetlifyRedirectBlock {\n  startLine: number\n  endLine: number\n  from?: string\n  to?: string\n}\n\nfunction parseRedirectBlocks(lines: readonly string[]): NetlifyRedirectBlock[] {\n  const blocks: NetlifyRedirectBlock[] = []\n  let current: NetlifyRedirectBlock | null = null\n\n  for (let i = 0; i < lines.length; i++) {\n    const trimmed = lines[i].trim()\n    if (trimmed === '[[redirects]]') {\n      if (current) {\n        current.endLine = i - 1\n        blocks.push(current)\n      }\n      current = { startLine: i, endLine: i }\n      continue\n    }\n    if (current && /^\\[(\\[|[^[])/.test(trimmed)) {\n      // Entering another section — close current.\n      current.endLine = i - 1\n      blocks.push(current)\n      current = null\n    }\n    if (current) {\n      const fromMatch = /^from\\s*=\\s*\"([^\"]+)\"/.exec(trimmed)\n      if (fromMatch) current.from = fromMatch[1]\n      const toMatch = /^to\\s*=\\s*\"([^\"]+)\"/.exec(trimmed)\n      if (toMatch) current.to = toMatch[1]\n      current.endLine = i\n    }\n  }\n  if (current) blocks.push(current)\n  return blocks\n}\n\nconst THEO_REDIRECT_TARGET = [\n  '[[redirects]]',\n  '  from = \"/api/*\"',\n  '  to = \"/.netlify/functions/theo\"',\n  '  status = 200',\n  '  force = true',\n].join('\\n')\n\n/**\n * Marks the block this build owns, so it can be REGENERATED rather than merely not duplicated.\n *\n * Idempotence alone would be the wrong contract here: the block carries configuration, so a\n * `security.headers` change has to reach the file. Leaving an existing block in place — which is\n * what the redirect above correctly does, because its content is fixed — would silently pin the\n * baseline to whatever the first build emitted.\n */\nconst THEO_HEADERS_MARKER = '# Generated by Theo — security baseline (usetheokit/theokit#412)'\n\n/**\n * The `[[headers]]` block telling Netlify's static host the baseline.\n *\n * The emitted function applies these to every response IT returns, and it never returns the HTML\n * document: the `[[redirects]]` block routes only `/api/*`, so the page comes from Netlify's static\n * host and carried none of them. The values come from `buildSecurityHeaders` — the same function\n * the handler calls — rather than being written out here, because two lists of headers that must\n * agree are two lists that eventually do not.\n */\nfunction renderHeadersBlock(securityHeaders: SecurityHeadersConfig | undefined): string {\n  const values = buildSecurityHeaders(securityHeaders ?? {}, { production: true })\n  return [\n    THEO_HEADERS_MARKER,\n    '[[headers]]',\n    '  for = \"/*\"',\n    '  [headers.values]',\n    ...Object.entries(values).map(([k, v]) => `    ${k} = ${JSON.stringify(v)}`),\n  ].join('\\n')\n}\n\n/**\n * Drop a previously generated block, so the next one replaces it.\n *\n * Bounded by the marker and the next top-level section at column 0 (or EOF) — the shape TOML gives\n * a block. A user's own `[[headers]]` is untouched because it does not carry the marker: their\n * file, their rules, and Netlify applies both.\n */\nfunction withoutGeneratedHeaders(source: string): string {\n  const lines = source.split(/\\r?\\n/)\n  const start = lines.indexOf(THEO_HEADERS_MARKER)\n  if (start < 0) return source\n\n  const opensSection = (line: string | undefined): boolean => (line ?? '').startsWith('[')\n\n  let end = start + 1\n  while (end < lines.length && !opensSection(lines[end])) end += 1\n  // The marker line itself opens the block, so `end` now sits on the NEXT section — but the block's\n  // own `[[headers]]` is the first `[` after the marker, so step past it before scanning again.\n  end += 1\n  while (end < lines.length && !opensSection(lines[end])) end += 1\n\n  return [...lines.slice(0, start), ...lines.slice(end)].join('\\n').replace(/\\n{3,}/gu, '\\n\\n')\n}\n\nexport function mergeNetlifyToml(\n  existing: string | null,\n  securityHeaders?: SecurityHeadersConfig,\n): string {\n  const headersBlock = renderHeadersBlock(securityHeaders)\n\n  if (existing === null || existing.trim().length === 0) {\n    return `${THEO_REDIRECT_TARGET}\\n\\n${headersBlock}\\n`\n  }\n\n  existing = withoutGeneratedHeaders(existing)\n\n  const blocks = parseRedirectBlocks(existing.split(/\\r?\\n/))\n\n  // Detect conflict: every `/api/*` block must point at our function.\n  for (const b of blocks) {\n    if (b.from !== THEO_REDIRECT_FROM) continue\n    if (b.to === THEO_REDIRECT_TO) {\n      // The redirect is already there. The headers block is regenerated regardless, because it\n      // carries configuration and the redirect does not.\n      const sep = existing.endsWith('\\n') ? '' : '\\n'\n      return `${existing}${sep}\\n${headersBlock}\\n`\n    }\n    throw new NetlifyConflictError(b.from, b.to ?? '(unknown)')\n  }\n\n  // No conflict — append target block.\n  const sep = existing.endsWith('\\n') ? '' : '\\n'\n  return `${existing}${sep}\\n${THEO_REDIRECT_TARGET}\\n\\n${headersBlock}\\n`\n}\n\nexport async function buildNetlify(\n  config: TheoConfig,\n  cwd: string,\n  deps: NetlifyBuildDeps = {},\n  ctx?: AdapterBuildContext,\n): Promise<void> {\n  // Wave 2 (T2.2) — reject polyglot services on this adapter.\n  assertServicesUnsupported('netlify', readManifest(cwd))\n\n  const runNodeBuild = deps.runNodeBuild ?? nodeAdapter.build.bind(nodeAdapter)\n  await runNodeBuild(config, cwd, ctx)\n\n  const ensureDir = deps.ensureDir ?? ((p: string) => mkdirSync(p, { recursive: true }))\n  const writeFile =\n    deps.writeFile ??\n    ((p, c) => {\n      writeFileSync(p, c)\n    })\n  const readTomlIfExists =\n    deps.readTomlIfExists ??\n    (() => {\n      const p = resolve(cwd, 'netlify.toml')\n      return existsSync(p) ? readFileSync(p, 'utf-8') : null\n    })\n\n  const fnDir = resolve(cwd, '.netlify/functions')\n  ensureDir(fnDir)\n  writeFile(\n    resolve(fnDir, 'theo.mjs'),\n    renderNetlifyFunction({\n      securityHeaders: config.security?.headers,\n      // B-235 — pillar (a): the option existed and no build passed it, so a project with a\n      // configured agents directory got the default `agents` on this target. Same defect\n      // B-185 fixed for bun and deno, one target over.\n      agentsDir: config.agentsDir,\n      csrf: config.security?.csrf,\n      disallowed: config.security?.disallowed,\n      cors: config.security?.cors,\n      // #425 — a selector, not a transformer, so it rides as a literal like the values above.\n      serialization: config.serialization,\n    }),\n  )\n\n  const existingToml = readTomlIfExists()\n  const merged = mergeNetlifyToml(existingToml, config.security?.headers)\n  writeFile(resolve(cwd, 'netlify.toml'), merged)\n\n  // eslint-disable-next-line no-console -- CLI build progress\n  console.log('\\n  ✓ Netlify output → .netlify/functions/theo.mjs + netlify.toml')\n  // eslint-disable-next-line no-console -- CLI build progress\n  console.log(\n    `${describeDeployedSecurityHeaders({\n      target: 'netlify',\n      securityHeaders: config.security?.headers,\n      mintsNonce: false,\n      documentHeaders: 'platform-configured',\n    })}\\n`,\n  )\n}\n\nexport const netlifyAdapter: DeployAdapter = {\n  name: 'netlify',\n  streamsResponses: true,\n  // #409 / #410 — the generated entry calls `executeRoute` with routes, loader\n  // and serverDir only. CSRF, route policy, file middleware and Zod validation\n  // still run because they live inside `executeRoute`; none of the remaining\n  // configurable concerns reach it. Declared explicitly rather than omitted so\n  // the gap is a statement in the source and not an absence.\n  //\n  // `securityHeaders` IS applied -- to every response this function returns.\n  // The document is served by Netlify's static host and does not pass through\n  // it (usetheokit/theokit#412).\n  appliesConfig: ['securityHeaders', 'csrf', 'disallowed', 'cors', 'serialization'],\n  build(config, cwd, ctx) {\n    return buildNetlify(config, cwd, {}, ctx)\n  },\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIA,SAAS,YAAY,WAAW,cAAc,qBAAqB;AACnE,SAAS,eAAe;AA2BjB,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAC9C,YAAY,MAAc,WAAmB;AAC3C;AAAA,MACE,6CAA6C,IAAI,aAAQ,SAAS;AAAA,IAGpE;AACA,SAAK,OAAO;AAAA,EACd;AACF;AASO,SAAS,sBACd,OAI6B,CAAC,GACtB;AACR,QAAM,gBAAgB,8BAA8B,IAAI;AAKxD,QAAM,iBAAiB,uBAAuB,uBAAuB,iBAAiB,IAAI,CAAC,GAAG;AAAA;AAAA;AAAA,IAG5F,UAAU;AAAA,EACZ,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,sBAAsB,eAAe,gBAAgB,MAAM,SAAS;AAAA,IACvE;AAAA;AAAA,IAEA,GAAI,KAAK,cAAc,SACnB,CAAC,IACD;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACJ,GAAG;AAAA,MACD,KAAK;AAAA,MACL;AAAA;AAAA;AAAA;AAAA,MAIA;AAAA;AAAA;AAAA;AAAA,MAIA;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,uBAAuB,KAAK,WAAW,MAAM,kBAAkB;AAAA,IAClE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,0CAA0C,eAAe,UAAU;AAAA,IACnE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,eAAe;AAAA,IAClB;AAAA,IACA;AAAA,IACA,wBAAwB,uBAAuB;AAAA,IAC/C;AAAA,IACA;AAAA,IACA,GAAG,sBAAsB,WAAW,IAAI;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA,iKAAiK,cAAc,kBAAkB;AAAA,IACjM;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,IAAM,qBAAqB;AAC3B,IAAM,mBAAmB;AAsBzB,SAAS,oBAAoB,OAAkD;AAC7E,QAAM,SAAiC,CAAC;AACxC,MAAI,UAAuC;AAE3C,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,UAAM,UAAU,MAAM,CAAC,EAAE,KAAK;AAC9B,QAAI,YAAY,iBAAiB;AAC/B,UAAI,SAAS;AACX,gBAAQ,UAAU,IAAI;AACtB,eAAO,KAAK,OAAO;AAAA,MACrB;AACA,gBAAU,EAAE,WAAW,GAAG,SAAS,EAAE;AACrC;AAAA,IACF;AACA,QAAI,WAAW,eAAe,KAAK,OAAO,GAAG;AAE3C,cAAQ,UAAU,IAAI;AACtB,aAAO,KAAK,OAAO;AACnB,gBAAU;AAAA,IACZ;AACA,QAAI,SAAS;AACX,YAAM,YAAY,wBAAwB,KAAK,OAAO;AACtD,UAAI,UAAW,SAAQ,OAAO,UAAU,CAAC;AACzC,YAAM,UAAU,sBAAsB,KAAK,OAAO;AAClD,UAAI,QAAS,SAAQ,KAAK,QAAQ,CAAC;AACnC,cAAQ,UAAU;AAAA,IACpB;AAAA,EACF;AACA,MAAI,QAAS,QAAO,KAAK,OAAO;AAChC,SAAO;AACT;AAEA,IAAM,uBAAuB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,EAAE,KAAK,IAAI;AAUX,IAAM,sBAAsB;AAW5B,SAAS,mBAAmB,iBAA4D;AACtF,QAAM,SAAS,qBAAqB,mBAAmB,CAAC,GAAG,EAAE,YAAY,KAAK,CAAC;AAC/E,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,OAAO,QAAQ,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,EAAE;AAAA,EAC7E,EAAE,KAAK,IAAI;AACb;AASA,SAAS,wBAAwB,QAAwB;AACvD,QAAM,QAAQ,OAAO,MAAM,OAAO;AAClC,QAAM,QAAQ,MAAM,QAAQ,mBAAmB;AAC/C,MAAI,QAAQ,EAAG,QAAO;AAEtB,QAAM,eAAe,CAAC,UAAuC,QAAQ,IAAI,WAAW,GAAG;AAEvF,MAAI,MAAM,QAAQ;AAClB,SAAO,MAAM,MAAM,UAAU,CAAC,aAAa,MAAM,GAAG,CAAC,EAAG,QAAO;AAG/D,SAAO;AACP,SAAO,MAAM,MAAM,UAAU,CAAC,aAAa,MAAM,GAAG,CAAC,EAAG,QAAO;AAE/D,SAAO,CAAC,GAAG,MAAM,MAAM,GAAG,KAAK,GAAG,GAAG,MAAM,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,EAAE,QAAQ,YAAY,MAAM;AAC9F;AAEO,SAAS,iBACd,UACA,iBACQ;AACR,QAAM,eAAe,mBAAmB,eAAe;AAEvD,MAAI,aAAa,QAAQ,SAAS,KAAK,EAAE,WAAW,GAAG;AACrD,WAAO,GAAG,oBAAoB;AAAA;AAAA,EAAO,YAAY;AAAA;AAAA,EACnD;AAEA,aAAW,wBAAwB,QAAQ;AAE3C,QAAM,SAAS,oBAAoB,SAAS,MAAM,OAAO,CAAC;AAG1D,aAAW,KAAK,QAAQ;AACtB,QAAI,EAAE,SAAS,mBAAoB;AACnC,QAAI,EAAE,OAAO,kBAAkB;AAG7B,YAAMA,OAAM,SAAS,SAAS,IAAI,IAAI,KAAK;AAC3C,aAAO,GAAG,QAAQ,GAAGA,IAAG;AAAA,EAAK,YAAY;AAAA;AAAA,IAC3C;AACA,UAAM,IAAI,qBAAqB,EAAE,MAAM,EAAE,MAAM,WAAW;AAAA,EAC5D;AAGA,QAAM,MAAM,SAAS,SAAS,IAAI,IAAI,KAAK;AAC3C,SAAO,GAAG,QAAQ,GAAG,GAAG;AAAA,EAAK,oBAAoB;AAAA;AAAA,EAAO,YAAY;AAAA;AACtE;AAEA,eAAsB,aACpB,QACA,KACA,OAAyB,CAAC,GAC1B,KACe;AAEf,4BAA0B,WAAW,aAAa,GAAG,CAAC;AAEtD,QAAM,eAAe,KAAK,gBAAgB,YAAY,MAAM,KAAK,WAAW;AAC5E,QAAM,aAAa,QAAQ,KAAK,GAAG;AAEnC,QAAM,YAAY,KAAK,cAAc,CAAC,MAAc,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AACpF,QAAM,YACJ,KAAK,cACJ,CAAC,GAAG,MAAM;AACT,kBAAc,GAAG,CAAC;AAAA,EACpB;AACF,QAAM,mBACJ,KAAK,qBACJ,MAAM;AACL,UAAM,IAAI,QAAQ,KAAK,cAAc;AACrC,WAAO,WAAW,CAAC,IAAI,aAAa,GAAG,OAAO,IAAI;AAAA,EACpD;AAEF,QAAM,QAAQ,QAAQ,KAAK,oBAAoB;AAC/C,YAAU,KAAK;AACf;AAAA,IACE,QAAQ,OAAO,UAAU;AAAA,IACzB,sBAAsB;AAAA,MACpB,iBAAiB,OAAO,UAAU;AAAA;AAAA;AAAA;AAAA,MAIlC,WAAW,OAAO;AAAA,MAClB,MAAM,OAAO,UAAU;AAAA,MACvB,YAAY,OAAO,UAAU;AAAA,MAC7B,MAAM,OAAO,UAAU;AAAA;AAAA,MAEvB,eAAe,OAAO;AAAA,IACxB,CAAC;AAAA,EACH;AAEA,QAAM,eAAe,iBAAiB;AACtC,QAAM,SAAS,iBAAiB,cAAc,OAAO,UAAU,OAAO;AACtE,YAAU,QAAQ,KAAK,cAAc,GAAG,MAAM;AAG9C,UAAQ,IAAI,6EAAmE;AAE/E,UAAQ;AAAA,IACN,GAAG,gCAAgC;AAAA,MACjC,QAAQ;AAAA,MACR,iBAAiB,OAAO,UAAU;AAAA,MAClC,YAAY;AAAA,MACZ,iBAAiB;AAAA,IACnB,CAAC,CAAC;AAAA;AAAA,EACJ;AACF;AAEO,IAAM,iBAAgC;AAAA,EAC3C,MAAM;AAAA,EACN,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUlB,eAAe,CAAC,mBAAmB,QAAQ,cAAc,QAAQ,eAAe;AAAA,EAChF,MAAM,QAAQ,KAAK,KAAK;AACtB,WAAO,aAAa,QAAQ,KAAK,CAAC,GAAG,GAAG;AAAA,EAC1C;AACF;","names":["sep"]}
+{"version":3,"sources":["../src/adapters/netlify.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Netlify deploy adapter. All paths derived from `cwd` and a fixed\n * `.theokit/netlify/` output layout. Build-time tool — no HTTP input.\n */\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nimport type { TheoConfig } from '../config/schema.js'\nimport type { SecurityHeadersConfig } from '../core/contracts/security-headers.js'\nimport { assertServicesUnsupported, readManifest } from '../services/index.js'\n\nimport {\n  deployedAgentsFragment,\n  JSON_NOT_FOUND_RESPONSE,\n  scannedFromLoaderCache,\n} from './deployed-agents.js'\nimport { type DeployedCorsOptions } from './deployed-cors.js'\nimport { type DeployedCsrfOptions } from './deployed-csrf.js'\nimport { deployedEntryPreamble } from './deployed-preamble.js'\nimport { deployedRateLimitFragment, rateLimitCheckFragment } from './deployed-rate-limit.js'\nimport type { DeployedRateLimitOptions } from './deployed-rate-limit.js'\nimport {\n  agentsDirLiteral,\n  type DeployedAgentsDirOptions,\n  deployedRuntimeConfigFragment,\n  type DeployedRuntimeConfigOptions,\n} from './deployed-runtime-config.js'\nimport { deployedTraceFragment } from './deployed-trace.js'\nimport { nodeAdapter } from './node.js'\nimport { buildSecurityHeaders, describeDeployedSecurityHeaders } from './security-headers.js'\nimport type { AdapterBuildContext, DeployAdapter } from './types.js'\n\nexport class NetlifyConflictError extends Error {\n  constructor(path: string, currentTo: string) {\n    super(\n      `netlify.toml has a conflicting redirect: \"${path}\" → \"${currentTo}\". ` +\n        `Remove it manually or edit it to point to \"/.netlify/functions/theo\" ` +\n        `before running the Netlify adapter again.`,\n    )\n    this.name = 'NetlifyConflictError'\n  }\n}\n\nexport interface NetlifyBuildDeps {\n  runNodeBuild?: (config: TheoConfig, cwd: string, ctx?: AdapterBuildContext) => Promise<void>\n  writeFile?: (path: string, content: string) => void\n  ensureDir?: (path: string) => void\n  readTomlIfExists?: () => string | null\n}\n\nexport function renderNetlifyFunction(\n  opts: { securityHeaders?: SecurityHeadersConfig } & DeployedAgentsDirOptions &\n    DeployedCsrfOptions &\n    DeployedRuntimeConfigOptions &\n    DeployedCorsOptions &\n    DeployedRateLimitOptions = {},\n): string {\n  const runtimeConfig = deployedRuntimeConfigFragment(opts)\n  // B-235. Netlify's handler is `(request, context)` and already RECEIVES a Web `Request`, which\n  // is the shape this branch needs — the item filed against it counted `new Request` occurrences\n  // and concluded the opposite, measuring how the entry OBTAINS a request rather than whether it\n  // has one. Deno is the model: same `loaderCache`, same filesystem `serverDir`, same guard.\n  const agentsFragment = deployedAgentsFragment(scannedFromLoaderCache(agentsDirLiteral(opts)), {\n    // Netlify answers its own 404 inline rather than through a helper, so the fragment is given\n    // the expression instead of a call it would have to declare.\n    notFound: `new Response('Not Found', { status: 404 })`,\n  })\n  return [\n    `// Generated by Theo — Netlify Functions adapter`,\n    `import { resolve } from 'node:path'`,\n    `import { scanServerRoutes, matchRoute, executeRoute, createProductionLoader, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler } from 'theokit/server'`,\n    `import { createWebShim } from 'theokit/adapters/web-shim'`,\n    `import { buildSecurityHeaders, withSecurityHeaders } from 'theokit/adapters/security-headers'`,\n    ``,\n    `const cwd = process.cwd()`,\n    `const serverDir = resolve(cwd, 'server')`,\n    `let routesCache = null`,\n    `let loaderCache = null`,\n    ``,\n    `// #410 — the security baseline \\`theokit start\\` puts on every response,`,\n    `// carried here as a literal because the deployed function has no`,\n    `// theo.config.ts to read. The netlify.toml redirect routes only /api/* here,`,\n    `// so this covers the API and not the document Netlify's static host serves`,\n    `// (usetheokit/theokit#412).`,\n    ...deployedEntryPreamble(runtimeConfig, agentsFragment, opts, 'netlify'),\n    ``,\n    // B-027 — emitted only when a limit is declared.\n    ...(opts.rateLimit === undefined\n      ? []\n      : [\n          `import { createRateLimiterWeb } from 'theokit/server'`,\n          `import { resolveClientIpFromRequest } from 'theokit/server/rate-limit'`,\n          ``,\n        ]),\n    ...deployedRateLimitFragment(\n      opts.rateLimit,\n      'netlify',\n      // `context.ip` is the platform's own answer, read from the handler context Netlify passes.\n      // The forwarded fallback covers a function shape that carries no context, and returns\n      // `undefined` unless a `trustProxy` was declared — which is the named 503, not a shared key.\n      `context?.ip ?? resolveClientIpFromRequest(request, TRUST_PROXY)`,\n      // Both names are bound in the OUTER handler, which is where the check runs. Threading\n      // `context` into `handleRequest` — which the plan called for — buys nothing: the limiter\n      // never runs in there.\n      'request, context',\n    ),\n    ``,\n    `export default async (request, context) => {`,\n    `  // #409 — the preflight is answered BEFORE anything routes: an OPTIONS the router`,\n    `  // handles is an OPTIONS the browser never gets a CORS answer to.`,\n    `  const preflight = corsPreflight(request)`,\n    `  if (preflight !== null) return withSecurityHeaders(preflight, SECURITY_HEADERS)`,\n    ...rateLimitCheckFragment(opts.rateLimit, '  ', 'request, context'),\n    `  return withCors(request, withSecurityHeaders(await handleRequest(request), SECURITY_HEADERS))`,\n    `}`,\n    ``,\n    `async function handleRequest(request) {`,\n    `  const url = new URL(request.url)`,\n    `  if (!url.pathname.startsWith('/api/')${agentsFragment.hostBypass}) {`,\n    `    return new Response('Not Found', { status: 404 })`,\n    `  }`,\n    ``,\n    `  if (!routesCache) routesCache = scanServerRoutes(serverDir)`,\n    `  if (!loaderCache) loaderCache = createProductionLoader()`,\n    ``,\n    ...agentsFragment.branch,\n    ``,\n    `  const match = matchRoute(url.pathname, routesCache)`,\n    `  if (!match) return ${JSON_NOT_FOUND_RESPONSE}`,\n    ``,\n    `  const { req, res, toResponse } = createWebShim(request)`,\n    ...deployedTraceFragment('request', '  '),\n    `  const method = request.method.toUpperCase()`,\n    `  // #382 — the run is not awaited: toResponse() settles at the headers and`,\n    `  // carries a live body, so Netlify streams while the handler writes.`,\n    `  return toResponse(executeRoute({ route: match.route, method, params: match.params, req, res, loadModule: loaderCache, serverDir, requestId, ...CSRF_CONFIG, ${runtimeConfig.executeRouteSpread} }))`,\n    `}`,\n  ].join('\\n')\n}\n\nconst THEO_REDIRECT_FROM = '/api/*'\nconst THEO_REDIRECT_TO = '/.netlify/functions/theo'\n\n/**\n * TOML merge (EC-2) — non-destructive.\n *\n * We avoid adding a TOML parser dependency by working at the line level. The\n * supported subset is sufficient for the Netlify use case:\n *   - detect existing `[[redirects]]` blocks\n *   - find a block whose `from = \"...\"` matches our target\n *   - error if such a block points elsewhere\n *   - otherwise append our block\n *\n * Unknown sections (e.g. `[build]`, `[[headers]]`, `[context.production.environment]`)\n * are preserved as-is.\n */\ninterface NetlifyRedirectBlock {\n  startLine: number\n  endLine: number\n  from?: string\n  to?: string\n}\n\nfunction parseRedirectBlocks(lines: readonly string[]): NetlifyRedirectBlock[] {\n  const blocks: NetlifyRedirectBlock[] = []\n  let current: NetlifyRedirectBlock | null = null\n\n  for (let i = 0; i < lines.length; i++) {\n    const trimmed = lines[i].trim()\n    if (trimmed === '[[redirects]]') {\n      if (current) {\n        current.endLine = i - 1\n        blocks.push(current)\n      }\n      current = { startLine: i, endLine: i }\n      continue\n    }\n    if (current && /^\\[(\\[|[^[])/.test(trimmed)) {\n      // Entering another section — close current.\n      current.endLine = i - 1\n      blocks.push(current)\n      current = null\n    }\n    if (current) {\n      const fromMatch = /^from\\s*=\\s*\"([^\"]+)\"/.exec(trimmed)\n      if (fromMatch) current.from = fromMatch[1]\n      const toMatch = /^to\\s*=\\s*\"([^\"]+)\"/.exec(trimmed)\n      if (toMatch) current.to = toMatch[1]\n      current.endLine = i\n    }\n  }\n  if (current) blocks.push(current)\n  return blocks\n}\n\nconst THEO_REDIRECT_TARGET = [\n  '[[redirects]]',\n  '  from = \"/api/*\"',\n  '  to = \"/.netlify/functions/theo\"',\n  '  status = 200',\n  '  force = true',\n].join('\\n')\n\n/**\n * Marks the block this build owns, so it can be REGENERATED rather than merely not duplicated.\n *\n * Idempotence alone would be the wrong contract here: the block carries configuration, so a\n * `security.headers` change has to reach the file. Leaving an existing block in place — which is\n * what the redirect above correctly does, because its content is fixed — would silently pin the\n * baseline to whatever the first build emitted.\n */\nconst THEO_HEADERS_MARKER = '# Generated by Theo — security baseline (usetheokit/theokit#412)'\n\n/**\n * The `[[headers]]` block telling Netlify's static host the baseline.\n *\n * The emitted function applies these to every response IT returns, and it never returns the HTML\n * document: the `[[redirects]]` block routes only `/api/*`, so the page comes from Netlify's static\n * host and carried none of them. The values come from `buildSecurityHeaders` — the same function\n * the handler calls — rather than being written out here, because two lists of headers that must\n * agree are two lists that eventually do not.\n */\nfunction renderHeadersBlock(securityHeaders: SecurityHeadersConfig | undefined): string {\n  const values = buildSecurityHeaders(securityHeaders ?? {}, { production: true })\n  return [\n    THEO_HEADERS_MARKER,\n    '[[headers]]',\n    '  for = \"/*\"',\n    '  [headers.values]',\n    ...Object.entries(values).map(([k, v]) => `    ${k} = ${JSON.stringify(v)}`),\n  ].join('\\n')\n}\n\n/**\n * Drop a previously generated block, so the next one replaces it.\n *\n * Bounded by the marker and the next top-level section at column 0 (or EOF) — the shape TOML gives\n * a block. A user's own `[[headers]]` is untouched because it does not carry the marker: their\n * file, their rules, and Netlify applies both.\n */\nfunction withoutGeneratedHeaders(source: string): string {\n  const lines = source.split(/\\r?\\n/)\n  const start = lines.indexOf(THEO_HEADERS_MARKER)\n  if (start < 0) return source\n\n  const opensSection = (line: string | undefined): boolean => (line ?? '').startsWith('[')\n\n  let end = start + 1\n  while (end < lines.length && !opensSection(lines[end])) end += 1\n  // The marker line itself opens the block, so `end` now sits on the NEXT section — but the block's\n  // own `[[headers]]` is the first `[` after the marker, so step past it before scanning again.\n  end += 1\n  while (end < lines.length && !opensSection(lines[end])) end += 1\n\n  return [...lines.slice(0, start), ...lines.slice(end)].join('\\n').replace(/\\n{3,}/gu, '\\n\\n')\n}\n\nexport function mergeNetlifyToml(\n  existing: string | null,\n  securityHeaders?: SecurityHeadersConfig,\n): string {\n  const headersBlock = renderHeadersBlock(securityHeaders)\n\n  if (existing === null || existing.trim().length === 0) {\n    return `${THEO_REDIRECT_TARGET}\\n\\n${headersBlock}\\n`\n  }\n\n  existing = withoutGeneratedHeaders(existing)\n\n  const blocks = parseRedirectBlocks(existing.split(/\\r?\\n/))\n\n  // Detect conflict: every `/api/*` block must point at our function.\n  for (const b of blocks) {\n    if (b.from !== THEO_REDIRECT_FROM) continue\n    if (b.to === THEO_REDIRECT_TO) {\n      // The redirect is already there. The headers block is regenerated regardless, because it\n      // carries configuration and the redirect does not.\n      const sep = existing.endsWith('\\n') ? '' : '\\n'\n      return `${existing}${sep}\\n${headersBlock}\\n`\n    }\n    throw new NetlifyConflictError(b.from, b.to ?? '(unknown)')\n  }\n\n  // No conflict — append target block.\n  const sep = existing.endsWith('\\n') ? '' : '\\n'\n  return `${existing}${sep}\\n${THEO_REDIRECT_TARGET}\\n\\n${headersBlock}\\n`\n}\n\nexport async function buildNetlify(\n  config: TheoConfig,\n  cwd: string,\n  deps: NetlifyBuildDeps = {},\n  ctx?: AdapterBuildContext,\n): Promise<void> {\n  // Wave 2 (T2.2) — reject polyglot services on this adapter.\n  assertServicesUnsupported('netlify', readManifest(cwd))\n\n  const runNodeBuild = deps.runNodeBuild ?? nodeAdapter.build.bind(nodeAdapter)\n  await runNodeBuild(config, cwd, ctx)\n\n  const ensureDir = deps.ensureDir ?? ((p: string) => mkdirSync(p, { recursive: true }))\n  const writeFile =\n    deps.writeFile ??\n    ((p, c) => {\n      writeFileSync(p, c)\n    })\n  const readTomlIfExists =\n    deps.readTomlIfExists ??\n    (() => {\n      const p = resolve(cwd, 'netlify.toml')\n      return existsSync(p) ? readFileSync(p, 'utf-8') : null\n    })\n\n  const fnDir = resolve(cwd, '.netlify/functions')\n  ensureDir(fnDir)\n  writeFile(\n    resolve(fnDir, 'theo.mjs'),\n    renderNetlifyFunction({\n      securityHeaders: config.security?.headers,\n      // B-235 — pillar (a): the option existed and no build passed it, so a project with a\n      // configured agents directory got the default `agents` on this target. Same defect\n      // B-185 fixed for bun and deno, one target over.\n      agentsDir: config.agentsDir,\n      csrf: config.security?.csrf,\n      disallowed: config.security?.disallowed,\n      cors: config.security?.cors,\n      // #425 — a selector, not a transformer, so it rides as a literal like the values above.\n      serialization: config.serialization,\n    }),\n  )\n\n  const existingToml = readTomlIfExists()\n  const merged = mergeNetlifyToml(existingToml, config.security?.headers)\n  writeFile(resolve(cwd, 'netlify.toml'), merged)\n\n  // eslint-disable-next-line no-console -- CLI build progress\n  console.log('\\n  ✓ Netlify output → .netlify/functions/theo.mjs + netlify.toml')\n  // eslint-disable-next-line no-console -- CLI build progress\n  console.log(\n    `${describeDeployedSecurityHeaders({\n      target: 'netlify',\n      securityHeaders: config.security?.headers,\n      mintsNonce: false,\n      documentHeaders: 'platform-configured',\n    })}\\n`,\n  )\n}\n\nexport const netlifyAdapter: DeployAdapter = {\n  name: 'netlify',\n  streamsResponses: true,\n  // #409 / #410 — the generated entry calls `executeRoute` with routes, loader\n  // and serverDir only. CSRF, route policy, file middleware and Zod validation\n  // still run because they live inside `executeRoute`; none of the remaining\n  // configurable concerns reach it. Declared explicitly rather than omitted so\n  // the gap is a statement in the source and not an absence.\n  //\n  // `securityHeaders` IS applied -- to every response this function returns.\n  // The document is served by Netlify's static host and does not pass through\n  // it (usetheokit/theokit#412).\n  appliesConfig: ['securityHeaders', 'csrf', 'disallowed', 'cors', 'serialization'],\n  // B-257 — per-invocation: an in-process counter does not survive, so a declared limit needs a durable store.\n  enforcesRateLimit: 'with-a-store',\n  build(config, cwd, ctx) {\n    return buildNetlify(config, cwd, {}, ctx)\n  },\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIA,SAAS,YAAY,WAAW,cAAc,qBAAqB;AACnE,SAAS,eAAe;AA2BjB,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAC9C,YAAY,MAAc,WAAmB;AAC3C;AAAA,MACE,6CAA6C,IAAI,aAAQ,SAAS;AAAA,IAGpE;AACA,SAAK,OAAO;AAAA,EACd;AACF;AASO,SAAS,sBACd,OAI6B,CAAC,GACtB;AACR,QAAM,gBAAgB,8BAA8B,IAAI;AAKxD,QAAM,iBAAiB,uBAAuB,uBAAuB,iBAAiB,IAAI,CAAC,GAAG;AAAA;AAAA;AAAA,IAG5F,UAAU;AAAA,EACZ,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,sBAAsB,eAAe,gBAAgB,MAAM,SAAS;AAAA,IACvE;AAAA;AAAA,IAEA,GAAI,KAAK,cAAc,SACnB,CAAC,IACD;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACJ,GAAG;AAAA,MACD,KAAK;AAAA,MACL;AAAA;AAAA;AAAA;AAAA,MAIA;AAAA;AAAA;AAAA;AAAA,MAIA;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,uBAAuB,KAAK,WAAW,MAAM,kBAAkB;AAAA,IAClE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,0CAA0C,eAAe,UAAU;AAAA,IACnE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,eAAe;AAAA,IAClB;AAAA,IACA;AAAA,IACA,wBAAwB,uBAAuB;AAAA,IAC/C;AAAA,IACA;AAAA,IACA,GAAG,sBAAsB,WAAW,IAAI;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA,iKAAiK,cAAc,kBAAkB;AAAA,IACjM;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,IAAM,qBAAqB;AAC3B,IAAM,mBAAmB;AAsBzB,SAAS,oBAAoB,OAAkD;AAC7E,QAAM,SAAiC,CAAC;AACxC,MAAI,UAAuC;AAE3C,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,UAAM,UAAU,MAAM,CAAC,EAAE,KAAK;AAC9B,QAAI,YAAY,iBAAiB;AAC/B,UAAI,SAAS;AACX,gBAAQ,UAAU,IAAI;AACtB,eAAO,KAAK,OAAO;AAAA,MACrB;AACA,gBAAU,EAAE,WAAW,GAAG,SAAS,EAAE;AACrC;AAAA,IACF;AACA,QAAI,WAAW,eAAe,KAAK,OAAO,GAAG;AAE3C,cAAQ,UAAU,IAAI;AACtB,aAAO,KAAK,OAAO;AACnB,gBAAU;AAAA,IACZ;AACA,QAAI,SAAS;AACX,YAAM,YAAY,wBAAwB,KAAK,OAAO;AACtD,UAAI,UAAW,SAAQ,OAAO,UAAU,CAAC;AACzC,YAAM,UAAU,sBAAsB,KAAK,OAAO;AAClD,UAAI,QAAS,SAAQ,KAAK,QAAQ,CAAC;AACnC,cAAQ,UAAU;AAAA,IACpB;AAAA,EACF;AACA,MAAI,QAAS,QAAO,KAAK,OAAO;AAChC,SAAO;AACT;AAEA,IAAM,uBAAuB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,EAAE,KAAK,IAAI;AAUX,IAAM,sBAAsB;AAW5B,SAAS,mBAAmB,iBAA4D;AACtF,QAAM,SAAS,qBAAqB,mBAAmB,CAAC,GAAG,EAAE,YAAY,KAAK,CAAC;AAC/E,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,OAAO,QAAQ,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,EAAE;AAAA,EAC7E,EAAE,KAAK,IAAI;AACb;AASA,SAAS,wBAAwB,QAAwB;AACvD,QAAM,QAAQ,OAAO,MAAM,OAAO;AAClC,QAAM,QAAQ,MAAM,QAAQ,mBAAmB;AAC/C,MAAI,QAAQ,EAAG,QAAO;AAEtB,QAAM,eAAe,CAAC,UAAuC,QAAQ,IAAI,WAAW,GAAG;AAEvF,MAAI,MAAM,QAAQ;AAClB,SAAO,MAAM,MAAM,UAAU,CAAC,aAAa,MAAM,GAAG,CAAC,EAAG,QAAO;AAG/D,SAAO;AACP,SAAO,MAAM,MAAM,UAAU,CAAC,aAAa,MAAM,GAAG,CAAC,EAAG,QAAO;AAE/D,SAAO,CAAC,GAAG,MAAM,MAAM,GAAG,KAAK,GAAG,GAAG,MAAM,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,EAAE,QAAQ,YAAY,MAAM;AAC9F;AAEO,SAAS,iBACd,UACA,iBACQ;AACR,QAAM,eAAe,mBAAmB,eAAe;AAEvD,MAAI,aAAa,QAAQ,SAAS,KAAK,EAAE,WAAW,GAAG;AACrD,WAAO,GAAG,oBAAoB;AAAA;AAAA,EAAO,YAAY;AAAA;AAAA,EACnD;AAEA,aAAW,wBAAwB,QAAQ;AAE3C,QAAM,SAAS,oBAAoB,SAAS,MAAM,OAAO,CAAC;AAG1D,aAAW,KAAK,QAAQ;AACtB,QAAI,EAAE,SAAS,mBAAoB;AACnC,QAAI,EAAE,OAAO,kBAAkB;AAG7B,YAAMA,OAAM,SAAS,SAAS,IAAI,IAAI,KAAK;AAC3C,aAAO,GAAG,QAAQ,GAAGA,IAAG;AAAA,EAAK,YAAY;AAAA;AAAA,IAC3C;AACA,UAAM,IAAI,qBAAqB,EAAE,MAAM,EAAE,MAAM,WAAW;AAAA,EAC5D;AAGA,QAAM,MAAM,SAAS,SAAS,IAAI,IAAI,KAAK;AAC3C,SAAO,GAAG,QAAQ,GAAG,GAAG;AAAA,EAAK,oBAAoB;AAAA;AAAA,EAAO,YAAY;AAAA;AACtE;AAEA,eAAsB,aACpB,QACA,KACA,OAAyB,CAAC,GAC1B,KACe;AAEf,4BAA0B,WAAW,aAAa,GAAG,CAAC;AAEtD,QAAM,eAAe,KAAK,gBAAgB,YAAY,MAAM,KAAK,WAAW;AAC5E,QAAM,aAAa,QAAQ,KAAK,GAAG;AAEnC,QAAM,YAAY,KAAK,cAAc,CAAC,MAAc,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AACpF,QAAM,YACJ,KAAK,cACJ,CAAC,GAAG,MAAM;AACT,kBAAc,GAAG,CAAC;AAAA,EACpB;AACF,QAAM,mBACJ,KAAK,qBACJ,MAAM;AACL,UAAM,IAAI,QAAQ,KAAK,cAAc;AACrC,WAAO,WAAW,CAAC,IAAI,aAAa,GAAG,OAAO,IAAI;AAAA,EACpD;AAEF,QAAM,QAAQ,QAAQ,KAAK,oBAAoB;AAC/C,YAAU,KAAK;AACf;AAAA,IACE,QAAQ,OAAO,UAAU;AAAA,IACzB,sBAAsB;AAAA,MACpB,iBAAiB,OAAO,UAAU;AAAA;AAAA;AAAA;AAAA,MAIlC,WAAW,OAAO;AAAA,MAClB,MAAM,OAAO,UAAU;AAAA,MACvB,YAAY,OAAO,UAAU;AAAA,MAC7B,MAAM,OAAO,UAAU;AAAA;AAAA,MAEvB,eAAe,OAAO;AAAA,IACxB,CAAC;AAAA,EACH;AAEA,QAAM,eAAe,iBAAiB;AACtC,QAAM,SAAS,iBAAiB,cAAc,OAAO,UAAU,OAAO;AACtE,YAAU,QAAQ,KAAK,cAAc,GAAG,MAAM;AAG9C,UAAQ,IAAI,6EAAmE;AAE/E,UAAQ;AAAA,IACN,GAAG,gCAAgC;AAAA,MACjC,QAAQ;AAAA,MACR,iBAAiB,OAAO,UAAU;AAAA,MAClC,YAAY;AAAA,MACZ,iBAAiB;AAAA,IACnB,CAAC,CAAC;AAAA;AAAA,EACJ;AACF;AAEO,IAAM,iBAAgC;AAAA,EAC3C,MAAM;AAAA,EACN,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUlB,eAAe,CAAC,mBAAmB,QAAQ,cAAc,QAAQ,eAAe;AAAA;AAAA,EAEhF,mBAAmB;AAAA,EACnB,MAAM,QAAQ,KAAK,KAAK;AACtB,WAAO,aAAa,QAAQ,KAAK,CAAC,GAAG,GAAG;AAAA,EAC1C;AACF;","names":["sep"]}

package/dist/{node-OSVPYQ3D.js → node-QUGTW6XV.js}

@@ -2,9 +2,9 @@
 import "tsx/esm";
 import {
   nodeAdapter
-} from "./chunk-KI4DOTN4.js";
+} from "./chunk-G7U7FQVC.js";
 import "./chunk-ZNZISJDZ.js";
 export {
   nodeAdapter
 };
-//# sourceMappingURL=node-OSVPYQ3D.js.map
+//# sourceMappingURL=node-QUGTW6XV.js.map

package/dist/{observability-bootstrap-YQKMEYW7.js → observability-bootstrap-FP6LMMJE.js}

@@ -4,13 +4,13 @@ import {
   _resetObservabilityAdapter,
   createObservabilityPluginFromConfig,
   getObservabilityAdapter
-} from "./chunk-MS4A7N77.js";
+} from "./chunk-PEL3MJLM.js";
 import "./chunk-C27VRUVN.js";
 import "./chunk-7UZZHCRN.js";
-import "./chunk-OSBGZYXZ.js";
+import "./chunk-D2R5SJEL.js";
 export {
   _resetObservabilityAdapter,
   createObservabilityPluginFromConfig,
   getObservabilityAdapter
 };
-//# sourceMappingURL=observability-bootstrap-YQKMEYW7.js.map
+//# sourceMappingURL=observability-bootstrap-FP6LMMJE.js.map

package/dist/{openapi-N4CXRUNT.js → openapi-Q53YOBIU.js}

@@ -12,12 +12,12 @@ import "./chunk-NO6HA4FG.js";
 import "./chunk-Z7CJHDLS.js";
 import {
   loadConfig
-} from "./chunk-FFS7IRZF.js";
+} from "./chunk-SZWGXHY3.js";
 import "./chunk-3QPVEJ7D.js";
 import "./chunk-U5PWXS3J.js";
-import "./chunk-TMQ52AZR.js";
+import "./chunk-X2LFNDJQ.js";
 import "./chunk-ZNZISJDZ.js";
-import "./chunk-OSBGZYXZ.js";
+import "./chunk-D2R5SJEL.js";
 
 // src/cli/commands/openapi.ts
 import { mkdtempSync, rmSync } from "fs";
@@ -84,4 +84,4 @@ function emitOpenApiInMemory(manifest, config) {
 export {
   openapiCommand
 };
-//# sourceMappingURL=openapi-N4CXRUNT.js.map
+//# sourceMappingURL=openapi-Q53YOBIU.js.map

package/dist/{preview-YDJSRJ2K.js → preview-BARW75PN.js}

@@ -4,8 +4,8 @@ import "tsx/esm";
 // src/cli/commands/preview.ts
 async function defaultSteps() {
   const [{ buildCommand }, { startCommand }] = await Promise.all([
-    import("./build-KCIH3HI6.js"),
-    import("./start-TYXS5I4M.js")
+    import("./build-23QF5FNQ.js"),
+    import("./start-4JTYXQQJ.js")
   ]);
   return {
     build: (opts) => buildCommand(opts),
@@ -20,4 +20,4 @@ async function previewCommand(options = {}, steps) {
 export {
   previewCommand
 };
-//# sourceMappingURL=preview-YDJSRJ2K.js.map
+//# sourceMappingURL=preview-BARW75PN.js.map

package/dist/{rate-limit-BdNDZ3vt.d.ts → rate-limit-fULgvzCz.d.ts}

@@ -1,5 +1,5 @@
 import { IncomingMessage } from 'node:http';
-import { R as RateLimitStore } from './rate-limit-store-BEJnhWdw.js';
+import { R as RateLimitStore, B as BakedStoreDeclaration } from './rate-limit-store-n1wD4Yk4.js';
 
 /**
  * Rate limit configuration — basic single-bucket shape. Per ADR D2, the
@@ -9,6 +9,16 @@ import { R as RateLimitStore } from './rate-limit-store-BEJnhWdw.js';
 interface RateLimitConfig {
     windowMs: number;
     max: number;
+    /**
+     * B-257 — the durable store a DEPLOYED entry constructs. Declared here because the config schema
+     * accepts it and this type is what the parsed config narrows to.
+     *
+     * The synchronous facades below IGNORE it: they cannot await, which is the whole reason
+     * `createDurableRateLimiterWeb` exists beside them (ADR 0018). A deployed entry reads this field
+     * at BUILD time, through `adapters/deployed-rate-limit.ts`, and constructs the store in the
+     * generated source — it is never read at request time by this module.
+     */
+    store?: RateLimitStore | BakedStoreDeclaration;
 }
 interface RateLimitResult {
     limited: boolean;

package/dist/{rate-limit-store-BEJnhWdw.d.ts → rate-limit-store-n1wD4Yk4.d.ts}

@@ -21,7 +21,54 @@ interface RateLimitState {
     count: number;
     /** Absolute timestamp (ms since epoch) when this window expires. */
     resetAt: number;
+    /**
+     * B-261 — how many requests the window BEFORE this one admitted, when the store can say.
+     *
+     * Optional, and the optionality IS the compatibility line: a third-party store returning only
+     * `{ count, resetAt }` keeps working with the behaviour it already had rather than breaking. A store
+     * that supplies this gets a sliding window instead of a fixed one.
+     *
+     * Why it is needed: with `resetAt` pinned at the first request of a window, filling the window late
+     * and the next one early spends two budgets inside one window's worth of time. Measured before the
+     * fix — `windowMs: 400, max: 5` admitted 10 in ~405ms, a factor of exactly 2.
+     */
+    previousCount?: number;
+}
+/**
+ * A durable store named at BUILD time, for an adapter to construct in a generated entry.
+ *
+ * B-257 — NOT a `RateLimitStore`. It has no methods, nothing calls it, and it exists only as text
+ * an adapter bakes into a generated entry: `config/schemas/rate-limit.ts` accepts it,
+ * `adapters/deployed-rate-limit.ts` emits it, and `createDurableRateLimiterWeb` receives the store
+ * the generated code constructed from it.
+ *
+ * It lives beside `RateLimitStore` because the two share a config key and a reader meeting one
+ * must be able to see the other. Declared once: the same shape was written inline in two modules
+ * before this, and two copies of one type diverge on the first change to either.
+ */
+interface BakedStoreDeclaration {
+    module: string;
+    factory: string;
+    options?: Record<string, string | number | boolean>;
 }
+/**
+ * The count a sliding window charges: the current window, plus whatever of the previous one is still
+ * inside `windowMs`.
+ *
+ * B-261 — it lives HERE and not in either limiter, because review found the first version living in
+ * `rate-limit-durable.ts` only: the durable path stopped bursting and the sync path still admitted 10
+ * against a nominal 5. Two limiters over one store disagreeing about what `max` means is the exact
+ * divergence B-260 had closed on the header contract, one item earlier, on a different axis.
+ *
+ * The weight is how much of the previous window has NOT yet slid out — nearly 1 just after a boundary,
+ * decaying to 0 by the end of the window. Clamped to 0..1, because a clock that moved would otherwise
+ * produce a negative weight (which CREDITS the caller) or one above 1 (which charges it for traffic
+ * that never happened).
+ *
+ * A store that cannot report `previousCount` yields the current count alone — today's behaviour and
+ * today's burst, so nothing breaks for a store nobody updated.
+ */
+declare function slidingCount(state: RateLimitState, windowMs: number): number;
 interface RateLimitStore {
     /**
      * Atomic increment-and-get. If the key is missing OR the previous
@@ -69,4 +116,4 @@ declare class InMemoryStore implements RateLimitStore {
     reset(key: string): Promise<void>;
 }
 
-export { InMemoryStore as I, type RateLimitStore as R, type RateLimitState as a };
+export { type BakedStoreDeclaration as B, InMemoryStore as I, type RateLimitStore as R, type RateLimitState as a, slidingCount as s };

package/dist/registry-SDBODRU6.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+import "tsx/esm";
+
+// src/adapters/registry.ts
+var adapterRegistry = {
+  node: async () => (await import("./node-QUGTW6XV.js")).nodeAdapter,
+  vercel: async () => (await import("./vercel-5PMYEEKF.js")).vercelAdapter,
+  cloudflare: async () => (await import("./cloudflare-4M4XVNUH.js")).cloudflareAdapter,
+  static: async () => (await import("./static-NQPLPAB6.js")).staticAdapter,
+  bun: async () => (await import("./bun-NKVHOFSJ.js")).bunAdapter,
+  "deno-deploy": async () => (await import("./deno-deploy-IVACZ62D.js")).denoDeployAdapter,
+  netlify: async () => (await import("./netlify-3HEWV375.js")).netlifyAdapter,
+  "aws-lambda": async () => (await import("./aws-lambda-7AZNJGWU.js")).awsLambdaAdapter,
+  "theo-cloud": async () => (await import("./theo-cloud-HMFNZ3FS.js")).theoCloudAdapter
+};
+async function resolveAdapter(target) {
+  const factory = adapterRegistry[target];
+  return factory();
+}
+export {
+  resolveAdapter
+};
+//# sourceMappingURL=registry-SDBODRU6.js.map

package/dist/{routes-ECCDRHXZ.js → routes-FDF4SLOB.js}

@@ -11,12 +11,12 @@ import {
 import "./chunk-Z7CJHDLS.js";
 import {
   loadConfig
-} from "./chunk-FFS7IRZF.js";
+} from "./chunk-SZWGXHY3.js";
 import "./chunk-3QPVEJ7D.js";
 import "./chunk-U5PWXS3J.js";
-import "./chunk-TMQ52AZR.js";
+import "./chunk-X2LFNDJQ.js";
 import "./chunk-ZNZISJDZ.js";
-import "./chunk-OSBGZYXZ.js";
+import "./chunk-D2R5SJEL.js";
 
 // src/cli/commands/routes.ts
 import { resolve, relative } from "path";
@@ -64,4 +64,4 @@ async function routesCommand() {
 export {
   routesCommand
 };
-//# sourceMappingURL=routes-ECCDRHXZ.js.map
+//# sourceMappingURL=routes-FDF4SLOB.js.map