theokit 0.72.1 → 0.74.0

package/dist/{cloudflare-4M4XVNUH.js → cloudflare-AMH4TJNL.js}

@@ -3,9 +3,16 @@ import "tsx/esm";
 import {
   parseAssetsMap
 } from "./chunk-46FM5AFZ.js";
+import {
+  readDocumentShell
+} from "./chunk-IJQQNHL7.js";
 import {
   planDeployedPlugins
-} from "./chunk-V5SSTT3C.js";
+} from "./chunk-C43AHOHI.js";
+import {
+  renderBakedRoutes,
+  routeRuntimeLines
+} from "./chunk-72RSCKMW.js";
 import {
   deployedAgentsFragment,
   deployedCorsFragment,
@@ -17,13 +24,11 @@ import {
   rateLimitCheckFragment,
   securityHeadersDeclarations,
   serverDirLiteral
-} from "./chunk-C5CAL3DX.js";
+} from "./chunk-EQJF2EH5.js";
 import {
   nodeAdapter
-} from "./chunk-G7U7FQVC.js";
-import {
-  findRootDiv
-} from "./chunk-3PWQQWT6.js";
+} from "./chunk-UFBBFP75.js";
+import "./chunk-3PWQQWT6.js";
 import "./chunk-WSMLSIS5.js";
 import {
   assertServicesUnsupported,
@@ -31,72 +36,8 @@ import {
 } from "./chunk-ZNZISJDZ.js";
 
 // src/adapters/cloudflare.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { mkdirSync, readFileSync, writeFileSync } from "fs";
 import { resolve } from "path";
-function readDocumentShell(cwd, streaming) {
-  if (!streaming) return {};
-  const indexPath = resolve(cwd, ".theokit/client/index.html");
-  if (!existsSync(indexPath)) {
-    throw new Error(
-      `[adapter-cloudflare] ssrStreaming is on but ${indexPath} does not exist, so the worker would serve a document with no <head> and no client entry. Run the client build first, or set ssrStreaming: false in theo.config.ts.`
-    );
-  }
-  const indexHtml = readFileSync(indexPath, "utf-8");
-  const rootDiv = findRootDiv(indexHtml);
-  if (rootDiv === void 0) {
-    throw new Error(
-      `[adapter-cloudflare] ${indexPath} has no <div id="root">, so the streamed document has nowhere to put the app. Add one, or set ssrStreaming: false in theo.config.ts.`
-    );
-  }
-  return {
-    htmlHead: indexHtml.slice(0, rootDiv.insertAt),
-    htmlTail: indexHtml.slice(rootDiv.insertAt)
-  };
-}
-function renderBakedRoutes(routes) {
-  const routeVar = (index) => `__theoRoute${String(index)}`;
-  return {
-    routeImports: routes.map(
-      (route, index) => `import * as ${routeVar(index)} from '../../${route.filePath}'`
-    ),
-    routeModuleEntries: routes.map(
-      (route, index) => `  ${JSON.stringify(route.filePath)}: ${routeVar(index)},`
-    ),
-    routeTableEntries: routes.map(
-      (route) => `  { filePath: ${JSON.stringify(route.filePath)}, routePath: ${JSON.stringify(route.routePath)}, methods: ${JSON.stringify([...route.methods ?? []])}, ...compilePattern(${JSON.stringify(route.routePath)}) },`
-    )
-  };
-}
-function routeRuntimeLines(moduleEntries, tableEntries) {
-  return [
-    `// #369 \u2014 the routes are baked at build time. The Worker used to reach for`,
-    `// \`scanServerRoutes\` on the server directory \u2014 a readdirSync, in a runtime with no`,
-    `// filesystem. The pattern is recompiled here from the same routePath the scanner`,
-    `// used, so one function decides precedence on every target.`,
-    `const ROUTE_MODULES = {`,
-    ...moduleEntries,
-    `}`,
-    ``,
-    `const routes = [`,
-    ...tableEntries,
-    `]`,
-    ``,
-    `// The executor asks for a module by the path the table names. Anything else was`,
-    `// never bundled, and saying so beats returning undefined and failing later on a`,
-    `// property access far from the cause.`,
-    `async function loadModule(path) {`,
-    `  const mod = ROUTE_MODULES[path]`,
-    `  if (mod === undefined) {`,
-    // No backticks in this message: it is emitted INTO a template literal, and a stray one closes
-    // it. That is how #344 shipped a SyntaxError, and the emitted-entry parse gate caught this one
-    // before it left the branch.
-    "  throw new Error(`Route module '${path}' was not bundled into this Worker. A Worker has no filesystem, so every route is imported at build time. Re-run: theokit build --target cloudflare`)",
-    `  }`,
-    `  return mod`,
-    `}`,
-    ``
-  ];
-}
 function readAssetsMapForBake(path) {
   try {
     return parseAssetsMap(readFileSync(path, "utf8"));
@@ -113,6 +54,30 @@ function renderPreloadSupport(assetsMap) {
 }
 function renderNonApiBranch(opts, preloadsApply) {
   return opts.ssrStreaming ? [
+    `      // B-263 \u2014 a worker that owns \`/\` also receives \`/robots.txt\` and \`/logo.png\`, because`,
+    `      // \`run_worker_first\` in wrangler.toml is what stops the asset handler answering the`,
+    `      // document before this code runs. Rendering SSR for those would answer a text file with HTML.`,
+    `      //`,
+    `      // B-331 \u2014 the extension is a PRE-FILTER, no longer the decision. It used to decide: a dot in`,
+    `      // the last segment meant "static file", so \`/users/john.doe\`, \`/v1.2/docs\` and`,
+    `      // \`/reports/2026.q3\` were handed to a handler that does not have them, and with`,
+    `      // \`not_found_handling = "none"\` that is a 404 for a page the app renders.`,
+    `      //`,
+    `      // Now a miss falls through to SSR, so a wrong guess costs one local lookup instead of the`,
+    `      // response. Keeping the pre-filter is what keeps that lookup OFF every ordinary page`,
+    `      // request: \`/dashboard\` never touches the binding.`,
+    `      //`,
+    `      // Still uncovered, and stated rather than implied: a static file with NO extension, such as`,
+    `      // a \`public/CNAME\`. The pre-filter never asks for it, so it renders as a document. That`,
+    `      // is the pre-existing behaviour and the rarer direction of the two.`,
+    `      const lastSegment = url.pathname.slice(url.pathname.lastIndexOf('/') + 1)`,
+    `      if (lastSegment.includes('.')) {`,
+    `        const staticAssets = env?.ASSETS`,
+    `        if (staticAssets === undefined) return notFoundResponse()`,
+    `        const hit = await staticAssets.fetch(request)`,
+    `        if (hit.status !== 404) return withSecurityHeaders(hit, SECURITY_HEADERS)`,
+    `      }`,
+    ``,
     `      // T2.3 \u2014 streaming SSR for non-API routes`,
     `      // The same primitive \`theokit start\` uses, not a second one:`,
     `      // 16 bytes of Web Crypto entropy, base64.`,
@@ -138,7 +103,7 @@ function renderNonApiBranch(opts, preloadsApply) {
   ].join("\n");
 }
 function renderCloudflareWorkerEntry(opts = {}) {
-  const streamingImport = opts.ssrStreaming ? `import { renderStreamingWeb } from '/@theo/entry-server'` : `// (ssrStreaming off: renderStreamingWeb not imported)`;
+  const streamingImport = opts.ssrStreaming ? `import { renderStreamingWeb } from '../server/entry-server.js'` : `// (ssrStreaming off: renderStreamingWeb not imported)`;
   const preloadsApply = preloadsApplyTo(opts);
   const preloadSupport = preloadsApply ? renderPreloadSupport(opts.assetsMap) : "";
   const nonApiBranch = renderNonApiBranch(opts, preloadsApply);
@@ -171,8 +136,22 @@ function renderCloudflareWorkerEntry(opts = {}) {
     `//     so Wrangler bundles theokit and its transitive deps`,
     `//   - Deploy: wrangler deploy`,
     ``,
-    !preloadsApply ? `import { matchRoute, executeRoute, compilePattern, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler } from 'theokit/server'` : `import { matchRoute, executeRoute, compilePattern, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler } from 'theokit/server'
-import { injectModulePreloads } from 'theokit/server/http'`,
+    // NEVER the `theokit/server` umbrella. It is deprecated (the package prints so on import) and it
+    // is what made the first real `wrangler deploy` fail: bisected 2026-09-26 with a worker whose
+    // only line was `import { matchRoute } from 'theokit/server'`, and that alone pulled
+    // `@swc/core`'s `.node` native addon into the bundle. workerd cannot load a `.node` at any
+    // bundler setting, so it is not a flag away from working (B-263).
+    //
+    // The narrow subpaths were probed the same way and are clean — `wrangler deploy --dry-run`
+    // exit 0, zero swc, zero errors for both. Which symbol lives where was read from the modules
+    // rather than grepped, since these indexes use `export *`:
+    //
+    //   theokit/server/scan   matchRoute, compilePattern
+    //   theokit/server/http   executeRoute, extractTraceIdFromRequest, TRACE_HEADER,
+    //                         createCorsWebHandler, injectModulePreloads
+    !preloadsApply ? `import { matchRoute, compilePattern } from 'theokit/server/scan'
+import { executeRoute, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler } from 'theokit/server/http'` : `import { matchRoute, compilePattern } from 'theokit/server/scan'
+import { executeRoute, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler, injectModulePreloads } from 'theokit/server/http'`,
     `import { createWebShim } from 'theokit/adapters/web-shim'`,
     opts.ssrStreaming ? `import { buildSecurityHeaders, generateNonce, withSecurityHeaders } from 'theokit/adapters/security-headers'` : `import { buildSecurityHeaders, withSecurityHeaders } from 'theokit/adapters/security-headers'`,
     `// T3.4 \u2014 WS bridge for Cloudflare Workers`,
@@ -182,7 +161,7 @@ import { injectModulePreloads } from 'theokit/server/http'`,
     // when it LOADED. `resolveClientIpFromRequest` is the forwarded-header fallback, behind
     // `trustProxy`; the primary source is `cf-connecting-ip`, which the Workers runtime writes.
     ...opts.rateLimit === void 0 ? [] : [
-      `import { createRateLimiterWeb } from 'theokit/server'`,
+      `import { createRateLimiterWeb } from 'theokit/server/rate-limit'`,
       `import { resolveClientIpFromRequest } from 'theokit/server/rate-limit'`
     ],
     streamingImport,
@@ -195,7 +174,7 @@ import { injectModulePreloads } from 'theokit/server/http'`,
     `// call process.cwd() and resolving paths at runtime returned '/server'.`,
     `const serverDir = ${serverDirLiteral(opts)}`,
     ``,
-    ...routeRuntimeLines(routeModuleEntries, routeTableEntries),
+    ...routeRuntimeLines(routeModuleEntries, routeTableEntries, "cloudflare"),
     `// #410 \u2014 the security baseline \`theokit start\` puts on every response, carried`,
     `// here as a literal because a Worker has no theo.config.ts to read. Same`,
     `// function, same input, so the deployed page and the local one cannot`,
@@ -303,7 +282,7 @@ function cloudflareHandleRequestFragment(nonApiBranch, runtimeSpread, agentBranc
     `}`
   ];
 }
-function renderWranglerToml() {
+function renderWranglerToml(opts) {
   return [
     `# Generated by Theo \u2014 Cloudflare Workers`,
     `name = "theo-app"`,
@@ -320,15 +299,49 @@ function renderWranglerToml() {
     `[assets]`,
     `directory = ".theokit/client"`,
     `binding = "ASSETS"`,
-    `# A client-routed app asks for /dashboard, which is no file. Without this the asset`,
-    `# handler 404s a deep link and the SPA never boots.`,
-    `not_found_handling = "single-page-application"`,
+    `# B-263 \u2014 WITHOUT this key Cloudflare's asset handler answers before the worker for any path`,
+    `# that matches a file, and \`.theokit/client/index.html\` matches \`/\`. Measured on the first real`,
+    `# deploy: \`GET /\` returned 200 with an empty \`<div id="root">\` and NONE of the six security`,
+    `# headers, while \`/api/health\` \u2014 a path no file matches \u2014 was answered by the worker and carried`,
+    `# them. The document was coming off the CDN and the code that renders it never ran.`,
+    `#`,
+    `# The negation keeps the 300-odd hashed build outputs on the CDN path: \`true\` would satisfy the`,
+    `# precedence and pay a JS invocation per stylesheet and chunk.`,
+    `run_worker_first = ["/*", "!/assets/*"]`,
+    ...opts?.ssrStreaming === true ? [
+      `# The worker renders every extension-less path itself, so an asset MISS is a genuine 404.`,
+      `# \`single-page-application\` here would answer \`/nope.png\` with 200 and an HTML body.`,
+      `not_found_handling = "none"`
+    ] : [
+      `# A client-routed app asks for /dashboard, which is no file, and with streaming off the`,
+      `# worker forwards it to ASSETS rather than rendering it. Without this the asset handler`,
+      `# 404s a deep link and the SPA never boots.`,
+      `not_found_handling = "single-page-application"`
+    ],
+    ``,
+    `# B-332 \u2014 the [define] "import.meta.url" compensation lived here until 2026-09-28.`,
+    `#`,
+    `# Cloudflare executes the top-level module during validation, so a dependency that resolves a`,
+    `# path at load time refused the whole upload (code 10021). The cause was @theokit/sdk, in`,
+    `# internal/providers/catalog-loader.ts, fixed upstream and published in 5.9.2 \u2014 measured on the`,
+    `# published tarball: 0 of 254 executable files resolve a path at module scope.`,
+    `#`,
+    `# The floor this framework declares is now ^5.9.2, so the versions that needed the compensation`,
+    `# cannot be installed. A declared dependency is the honest form of that requirement;`,
+    `# substituting a literal for import.meta.url was the form that also covered the NEXT dependency`,
+    `# with the same vice, in silence.`,
     ``,
     `# Environment variables are set via wrangler secret or dashboard`,
     `# Example: wrangler secret put DATABASE_URL`
   ].join("\n");
 }
 var cloudflareAdapter = {
+  // #367 / #369 and `docs/adr/0020`. Wrangler runs esbuild at deploy time, so bundling here
+  // twice would be work with no observable effect — validated live 2026-09-26
+  // (`records/acceptance/evidence/b263-cloudflare-deploy.txt`). There is still no source tree in
+  // a Worker, which is why it bakes.
+  readsSourceAtRunTime: false,
+  specifiersResolvedBy: "the-platform",
   name: "cloudflare",
   streamsResponses: true,
   // #409 / #410 — the generated entry calls `executeRoute` with routes, loader
@@ -369,6 +382,10 @@ var cloudflareAdapter = {
       resolve(outputDir, "worker.mjs"),
       renderCloudflareWorkerEntry({
         ssrStreaming: config.ssrStreaming,
+        // B-315 — LATENT here, not broken: the routes are baked (#369) so the worker never scans,
+        // and a live deploy on 2026-09-26 served every route correctly with the wrong literal. It
+        // is still handed to `executeRoute`, so it is one refactor away from mattering.
+        serverDir: config.serverDir,
         ...shell,
         securityHeaders: config.security?.headers,
         csrf: config.security?.csrf,
@@ -390,7 +407,12 @@ var cloudflareAdapter = {
         wsRoutes: scanned.wsRoutes
       })
     );
-    writeFileSync(resolve(cwd, "wrangler.toml"), renderWranglerToml());
+    writeFileSync(
+      resolve(cwd, "wrangler.toml"),
+      // B-263 — the toml decides whether the worker or the CDN answers the document, and the two
+      // modes need different `not_found_handling`. Passing the flag is what keeps them apart.
+      renderWranglerToml({ ssrStreaming: config.ssrStreaming })
+    );
     console.log("\n  \u2713 Cloudflare output \u2192 .theokit/cloudflare/ + wrangler.toml");
     console.log(
       `${describeDeployedSecurityHeaders({
@@ -414,4 +436,4 @@ export {
   renderCloudflareWorkerEntry,
   renderWranglerToml
 };
-//# sourceMappingURL=cloudflare-4M4XVNUH.js.map
+//# sourceMappingURL=cloudflare-AMH4TJNL.js.map

package/dist/cloudflare-AMH4TJNL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapters/cloudflare.ts"],"sourcesContent":["import { mkdirSync, readFileSync, writeFileSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nimport type { TheoConfig } from '../config/schema.js'\nimport { parseAssetsMap } from '../core/contracts/module-preloads.js'\nimport type { SecurityHeadersConfig } from '../core/contracts/security-headers.js'\nimport { assertServicesUnsupported, readManifest } from '../services/index.js'\n\nimport { deployedAgentsFragment, type DeployedAgent } from './deployed-agents.js'\nimport { renderBakedRoutes, routeRuntimeLines } from './deployed-baked-routes.js'\nimport { deployedCorsFragment, type DeployedCorsOptions } from './deployed-cors.js'\nimport { deployedCsrfFragment, type DeployedCsrfOptions } from './deployed-csrf.js'\nimport { readDocumentShell } from './deployed-document-shell.js'\nimport { planDeployedPlugins } from './deployed-plugins-module.js'\nimport {\n  deployedRateLimitFragment,\n  rateLimitCheckFragment,\n  type DeployedRateLimitOptions,\n} from './deployed-rate-limit.js'\nimport {\n  deployedRuntimeConfigFragment,\n  serverDirLiteral,\n  type DeployedRuntimeConfigOptions,\n  type DeployedServerDirOptions,\n} from './deployed-runtime-config.js'\nimport { deployedTraceFragment } from './deployed-trace.js'\nimport { nodeAdapter } from './node.js'\nimport { describeDeployedSecurityHeaders, securityHeadersDeclarations } from './security-headers.js'\nimport type { AdapterBuildContext, DeployAdapter } from './types.js'\n\n/**\n * T2.1 — Cloudflare adapter rewritten to consume `theokit/adapters/web-shim`\n * instead of emitting an inline plain-object Request/Response shim. Reduces\n * template from ~50 lines to ~25 and centralizes maintenance.\n */\n\n/**\n * The built `index.html` split into the part before `<div id=\"root\">` and the\n * part after it.\n *\n * Refuses by name when streaming is on and the template is missing, rather than\n * emitting a worker that serves a headless document. A build that cannot produce\n * a correct artifact should say so at build time; the alternative is a deploy\n * that looks successful and serves pages with no stylesheet.\n */\n// `readDocumentShell` moved to `./deployed-document-shell.js` (B-317): the Vercel target needs the\n// same shell, and an adapter importing another adapter is the coupling `deployed-baked-routes.ts`\n// was extracted to avoid.\n\n// Re-exported because this module's tests import it from here, and the move is not their subject.\nexport { readDocumentShell }\n\n/**\n * Read the map `theokit build` emitted, for baking into the worker (B-035).\n *\n * Returns `undefined` — never throws — for an absent or malformed file. A deploy that failed\n * because an optimisation was missing would turn a lost round trip into a broken build, and the\n * worker is correct without it.\n */\nexport function readAssetsMapForBake(path: string): Record<string, string[]> | undefined {\n  try {\n    // eslint-disable-next-line security/detect-non-literal-fs-filename -- `path` is built by the one caller from a fixed `.theokit/client` layout; this returns `undefined` for anything it cannot read\n    return parseAssetsMap(readFileSync(path, 'utf8'))\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * The baked route-to-chunks map, as worker source (B-035).\n *\n * A literal and not a read, for the same reason the document shell is: a Worker has no filesystem\n * at request time. Emitted only when the build produced a map; otherwise the worker carries\n * nothing about preloads and behaves exactly as before.\n *\n * **It emits the DATA and no longer the code.** An earlier revision emitted a hand-written copy of\n * `injectModulePreloads`, justified by a claim that the worker could not import it. That claim was\n * false — `theokit/server` re-exports from `core/contracts/` and the generated worker already\n * imports that subpath — and the copy drifted within a day: a fix for proxy-form request targets\n * landed in the original and not in the duplicate. The worker now imports the real function, which\n * is the shape `adapters/security-headers.ts` established one directory over for exactly this\n * build-half/runtime-half pair.\n */\n/**\n * Whether this worker can preload at all (B-035).\n *\n * ONE predicate, read by the bake, the import and the call. Two conditions for one decision is\n * how the import came to be emitted for a worker that had no map to give it — found at review, in\n * the same change where a copy and its original had already drifted apart.\n *\n * Streaming is required because the other branch serves the document from `env.ASSETS` as a\n * static file and can inject nothing into it.\n */\nfunction preloadsApplyTo(opts: {\n  ssrStreaming?: boolean\n  assetsMap?: Record<string, string[]>\n}): boolean {\n  return opts.ssrStreaming === true && opts.assetsMap !== undefined\n}\n\nfunction renderPreloadSupport(assetsMap: Record<string, string[]> | undefined): string {\n  if (assetsMap === undefined) return ''\n  return `const __THEO_ASSETS_MAP = ${JSON.stringify(assetsMap)}`\n}\n\n/**\n * The branch that answers a non-API request: streamed SSR, or the static asset the Worker\n * platform serves. Extracted at review — it is the one decision in this emitter with two whole\n * shapes behind it, and keeping it inline pushed the caller past its line budget.\n */\nfunction renderNonApiBranch(\n  opts: NonNullable<Parameters<typeof renderCloudflareWorkerEntry>[0]>,\n  preloadsApply: boolean,\n): string {\n  return opts.ssrStreaming\n    ? [\n        `      // B-263 — a worker that owns \\`/\\` also receives \\`/robots.txt\\` and \\`/logo.png\\`, because`,\n        `      // \\`run_worker_first\\` in wrangler.toml is what stops the asset handler answering the`,\n        `      // document before this code runs. Rendering SSR for those would answer a text file with HTML.`,\n        `      //`,\n        `      // B-331 — the extension is a PRE-FILTER, no longer the decision. It used to decide: a dot in`,\n        `      // the last segment meant \"static file\", so \\`/users/john.doe\\`, \\`/v1.2/docs\\` and`,\n        `      // \\`/reports/2026.q3\\` were handed to a handler that does not have them, and with`,\n        `      // \\`not_found_handling = \"none\"\\` that is a 404 for a page the app renders.`,\n        `      //`,\n        `      // Now a miss falls through to SSR, so a wrong guess costs one local lookup instead of the`,\n        `      // response. Keeping the pre-filter is what keeps that lookup OFF every ordinary page`,\n        `      // request: \\`/dashboard\\` never touches the binding.`,\n        `      //`,\n        `      // Still uncovered, and stated rather than implied: a static file with NO extension, such as`,\n        `      // a \\`public/CNAME\\`. The pre-filter never asks for it, so it renders as a document. That`,\n        `      // is the pre-existing behaviour and the rarer direction of the two.`,\n        `      const lastSegment = url.pathname.slice(url.pathname.lastIndexOf('/') + 1)`,\n        `      if (lastSegment.includes('.')) {`,\n        `        const staticAssets = env?.ASSETS`,\n        `        if (staticAssets === undefined) return notFoundResponse()`,\n        `        const hit = await staticAssets.fetch(request)`,\n        `        if (hit.status !== 404) return withSecurityHeaders(hit, SECURITY_HEADERS)`,\n        `      }`,\n        ``,\n        `      // T2.3 — streaming SSR for non-API routes`,\n        `      // The same primitive \\`theokit start\\` uses, not a second one:`,\n        `      // 16 bytes of Web Crypto entropy, base64.`,\n        `      const nonce = generateNonce()`,\n        `      return withSecurityHeaders(`,\n        `        await renderStreamingWeb(request, {`,\n        !preloadsApply\n          ? `          htmlHead: ${JSON.stringify(opts.htmlHead ?? '')},`\n          : `          htmlHead: injectModulePreloads(${JSON.stringify(opts.htmlHead ?? '')}, __THEO_ASSETS_MAP, new URL(request.url).pathname),`,\n        `          htmlTail: ${JSON.stringify(opts.htmlTail ?? '')},`,\n        `          nonce,`,\n        `        }),`,\n        `        buildSecurityHeaders(SECURITY_HEADERS_CONFIG, { production: true }, { nonce }),`,\n        `      )`,\n      ].join('\\n')\n    : [\n        `      // #412 — the document, served by the worker so it carries the same baseline every`,\n        `      // API response carries. It used to return 404 here while wrangler.toml declared a`,\n        `      // \\`[site]\\` bucket nothing read, so the page was missing rather than unprotected.`,\n        `      const assets = env?.ASSETS`,\n        `      // A wrangler.toml that predates this binding has no ASSETS. Reading .fetch off`,\n        `      // undefined would turn every page request into a 500; 404 is what this target`,\n        `      // answered before, which is the honest fallback rather than a new failure.`,\n        `      if (assets === undefined) return notFoundResponse()`,\n        `      return withSecurityHeaders(await assets.fetch(request), SECURITY_HEADERS)`,\n      ].join('\\n')\n}\n\nexport function renderCloudflareWorkerEntry(\n  opts: {\n    ssrStreaming?: boolean\n    htmlHead?: string\n    htmlTail?: string\n    /**\n     * B-035 — the route-to-chunks map, baked as a literal for the same reason the shell above\n     * is: a Worker has no filesystem at request time. Absent when the build produced no map,\n     * and then nothing about preloads is emitted at all.\n     */\n    assetsMap?: Record<string, string[]>\n    securityHeaders?: SecurityHeadersConfig\n    /**\n     * The server routes, scanned on the BUILD machine (#369).\n     *\n     * A Worker has no filesystem, so the worker used to call `scanServerRoutes` — a `readdirSync` —\n     * against a directory that does not exist there, and load each module through `import()` of a\n     * file path. Both are baked here instead, which is the road this adapter already takes for the\n     * document shell one function away.\n     *\n     * `filePath` is relative to the project root and is used for two things: the key the executor\n     * looks a module up by, and the specifier the static import uses. Paths are emitted relative to\n     * `.theokit/cloudflare/`, where the worker is written.\n     */\n    routes?: readonly { filePath: string; routePath: string; methods?: readonly string[] }[]\n    /**\n     * The two concerns #410 could not bake (#425), composed from one place so the six targets\n     * cannot drift into six spellings. `serialization` is a literal like the security values above;\n     * `plugins` is an import, because a closure has no literal.\n     */\n    runtimeConfigModule?: DeployedRuntimeConfigOptions['runtimeConfigModule']\n    serialization?: DeployedRuntimeConfigOptions['serialization']\n    /**\n     * The app's agents, scanned on the build machine (#367).\n     *\n     * A different scan from `routes` and served by a different function — which is why a worker\n     * that only consulted the route table answered every `/api/agents/<name>` with a 404.\n     */\n    agents?: readonly DeployedAgent[]\n    /** B-185 — the app's `server/context.ts`, project-relative, or absent when it declares none. */\n    contextModule?: string\n    /** WebSocket route files, scanned on the build machine. Only their presence is used (#369). */\n    wsRoutes?: readonly string[]\n  } & DeployedServerDirOptions &\n    DeployedCsrfOptions &\n    DeployedCorsOptions &\n    DeployedRateLimitOptions = {},\n): string {\n  // `/@theo/entry-server` is a VITE virtual id (`vite-plugin/index.ts`), and `adapters/node.ts`\n  // resolves it by passing it as the vite build's `input`. This file is not bundled by vite: wrangler\n  // hands it to esbuild, which has no such module and fails the build before a request is ever sent —\n  // measured 2026-09-26 on the first real `wrangler deploy` this repository attempted (B-263).\n  //\n  // The same build writes the real thing next door. The worker lands at\n  // `.theokit/cloudflare/worker.mjs` and the renderer at `.theokit/server/entry-server.js`, so one\n  // directory up is the spelling esbuild can follow.\n  const streamingImport = opts.ssrStreaming\n    ? `import { renderStreamingWeb } from '../server/entry-server.js'`\n    : `// (ssrStreaming off: renderStreamingWeb not imported)`\n  // #343 — the document shell is inlined as a build-time literal because a Worker\n  // has no filesystem to read `index.html` from at request time. Without it,\n  // `renderStreamingWeb` falls back to its empty-string defaults and the response\n  // is React output with no `<html>`, no `<head>`, no stylesheet and no client\n  // entry — hydration data for a page that cannot hydrate. The streaming\n  // assembly was fixed in the generated entry and this, its only caller, was\n  // left passing nothing.\n  //\n  // `JSON.stringify` and not a template literal: the shell contains quotes,\n  // angle brackets and a `</script>`, and embedding it naively produces a worker\n  // that fails to parse at deploy time rather than here.\n  //\n  // #410 — this is also the ONE deploy path that renders HTML at request time,\n  // so the one that can mint a per-request CSP nonce: `renderStreamingWeb`\n  // threads `options.nonce` into `renderToReadableStream` and into the hydration\n  // script (`router/entry-server.ts`). Every other response below carries the\n  // nonce-less baseline, which is what `buildSecurityHeaders` already does for a\n  // prerendered route (EC-4).\n  // Only the streaming branch renders HTML at request time; the other serves the document from\n  // `env.ASSETS` as a static file and can inject nothing. Baking the map for it would ship the whole\n  // route table as dead weight — found at review, where the emitter was measured declaring it with\n  // zero call sites.\n  const preloadsApply = preloadsApplyTo(opts)\n  const preloadSupport = preloadsApply ? renderPreloadSupport(opts.assetsMap) : ''\n\n  const nonApiBranch = renderNonApiBranch(opts, preloadsApply)\n\n  // CR-006: Workers lack `process.cwd()` and the `node:*` import surface\n  // is brittle even under `nodejs_compat`. We use the Web Crypto\n  // `crypto.randomUUID()` instead of `node:crypto.randomUUID`, and embed\n  // the server directory as a build-time literal instead of resolving via\n  // `node:path` at runtime.\n  const { routeImports, routeModuleEntries, routeTableEntries } = renderBakedRoutes(\n    opts.routes ?? [],\n  )\n  const runtimeConfig = deployedRuntimeConfigFragment(opts)\n  const agentsFragment = deployedAgentsFragment(\n    opts.agents === undefined\n      ? undefined\n      : // B-185 — a Worker has no filesystem, so its identity module is baked exactly like its\n        // agents and its routes (ADR 0014). `contextModule` is `undefined` for an app that\n        // declares none, and the generator then emits no import for it.\n        { kind: 'baked', agents: opts.agents, contextModule: opts.contextModule },\n    {\n      wrapSecurityHeaders: true,\n      // B-185 — bound only when the runtime-config fragment declared the const, which is\n      // exactly when a plugins module was emitted. Referencing it otherwise would emit an\n      // identifier the entry never declares.\n      pluginRunnerExpr:\n        opts.runtimeConfigModule === undefined ? undefined : 'await THEO_PLUGIN_RUNNER',\n    },\n  )\n\n  return [\n    `// Generated by Theo — Cloudflare Workers Adapter`,\n    `//`,\n    `// REQUIREMENTS (EC-3):`,\n    `//   - wrangler.toml MUST include compatibility_flags = [\"nodejs_compat\"]`,\n    `//     (still required for transitive theokit/server deps, e.g. busboy)`,\n    `//   - package.json MUST list \"theokit\" in dependencies (not devDependencies)`,\n    `//     so Wrangler bundles theokit and its transitive deps`,\n    `//   - Deploy: wrangler deploy`,\n    ``,\n    // NEVER the `theokit/server` umbrella. It is deprecated (the package prints so on import) and it\n    // is what made the first real `wrangler deploy` fail: bisected 2026-09-26 with a worker whose\n    // only line was `import { matchRoute } from 'theokit/server'`, and that alone pulled\n    // `@swc/core`'s `.node` native addon into the bundle. workerd cannot load a `.node` at any\n    // bundler setting, so it is not a flag away from working (B-263).\n    //\n    // The narrow subpaths were probed the same way and are clean — `wrangler deploy --dry-run`\n    // exit 0, zero swc, zero errors for both. Which symbol lives where was read from the modules\n    // rather than grepped, since these indexes use `export *`:\n    //\n    //   theokit/server/scan   matchRoute, compilePattern\n    //   theokit/server/http   executeRoute, extractTraceIdFromRequest, TRACE_HEADER,\n    //                         createCorsWebHandler, injectModulePreloads\n    !preloadsApply\n      ? `import { matchRoute, compilePattern } from 'theokit/server/scan'\\nimport { executeRoute, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler } from 'theokit/server/http'`\n      : `import { matchRoute, compilePattern } from 'theokit/server/scan'\\nimport { executeRoute, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler, injectModulePreloads } from 'theokit/server/http'`,\n    `import { createWebShim } from 'theokit/adapters/web-shim'`,\n    opts.ssrStreaming\n      ? `import { buildSecurityHeaders, generateNonce, withSecurityHeaders } from 'theokit/adapters/security-headers'`\n      : `import { buildSecurityHeaders, withSecurityHeaders } from 'theokit/adapters/security-headers'`,\n    `// T3.4 — WS bridge for Cloudflare Workers`,\n    `import { createCloudflareWsBridge } from 'theokit/adapters/ws-shim'`,\n    // B-027 — only when a limit is declared. `createRateLimiterWeb` is used at module scope by the\n    // fragment below and was imported by no target but bun, so an entry that declared a limit threw\n    // when it LOADED. `resolveClientIpFromRequest` is the forwarded-header fallback, behind\n    // `trustProxy`; the primary source is `cf-connecting-ip`, which the Workers runtime writes.\n    ...(opts.rateLimit === undefined\n      ? []\n      : [\n          `import { createRateLimiterWeb } from 'theokit/server/rate-limit'`,\n          `import { resolveClientIpFromRequest } from 'theokit/server/rate-limit'`,\n        ]),\n    streamingImport,\n    ``,\n    ...runtimeConfig.imports,\n    ...agentsFragment.imports,\n    ...routeImports,\n    ``,\n    `// CR-006: server directory is a build-time literal — Workers cannot`,\n    `// call process.cwd() and resolving paths at runtime returned '/server'.`,\n    `const serverDir = ${serverDirLiteral(opts)}`,\n    ``,\n    ...routeRuntimeLines(routeModuleEntries, routeTableEntries, 'cloudflare'),\n    `// #410 — the security baseline \\`theokit start\\` puts on every response, carried`,\n    `// here as a literal because a Worker has no theo.config.ts to read. Same`,\n    `// function, same input, so the deployed page and the local one cannot`,\n    `// disagree about what the configuration means.`,\n    preloadSupport,\n    ...securityHeadersDeclarations(opts.securityHeaders),\n    ``,\n    ...deployedCsrfFragment(opts, 'a Worker'),\n    ``,\n    ...runtimeConfig.declarations,\n    ...agentsFragment.declarations,\n    ...deployedCorsFragment(opts.cors, 'cloudflare'),\n    `// #369 — whether this project declares a WebSocket route, decided at build time. It used`,\n    `// to answer it with \\`scanWebSocketRoutes\\`, which is the same readdirSync.`,\n    `const HAS_WS_ROUTES = ${String((opts.wsRoutes ?? []).length > 0)}`,\n    ``,\n    `function notFoundResponse() {`,\n    `  return withSecurityHeaders(`,\n    `    new Response(`,\n    `      JSON.stringify({ error: { code: 'NOT_FOUND', message: 'Route not found' } }),`,\n    `      { status: 404, headers: { 'Content-Type': 'application/json' } },`,\n    `    ),`,\n    `    SECURITY_HEADERS,`,\n    `  )`,\n    `}`,\n    ``,\n    ...cloudflareHandleRequestFragment(\n      nonApiBranch,\n      runtimeConfig.executeRouteSpread,\n      agentsFragment.branch,\n      agentsFragment.hostBypass,\n      opts.rateLimit,\n    ),\n  ].join('\\n')\n}\n\n/**\n * The Worker's request handler, as generated source.\n *\n * Extracted for the reason `vercel.ts` extracts its own fragments: the emitter is one array\n * literal, so every line the entry gains counts against `max-lines-per-function`, and #410 added\n * the CSRF literal to an emitter already sitting exactly at the ceiling.\n *\n * @param nonApiBranch - what a non-`/api/` request gets, which differs with `ssrStreaming`\n */\nfunction cloudflareHandleRequestFragment(\n  nonApiBranch: string,\n  runtimeSpread: string,\n  agentBranch: readonly string[],\n  /** SI-020 — the condition that keeps an agent card path out of the static-asset branch. */\n  hostBypass: string,\n  /** B-027 — the declared limit, or `undefined`. Passed rather than read: this fragment is a\n   * separate function from `renderCloudflareWorkerEntry`, where `opts` is bound. */\n  rateLimit: DeployedRateLimitOptions['rateLimit'],\n): string[] {\n  return [\n    `async function handleRequest(request, url, env) {`,\n    `    if (!url.pathname.startsWith('/api/')${hostBypass}) {`,\n    nonApiBranch,\n    `    }`,\n    ``,\n    ...agentBranch,\n    ``,\n    `    const match = matchRoute(url.pathname, routes)`,\n    `    if (!match) return notFoundResponse()`,\n    ``,\n    `    const { req, res, toResponse } = createWebShim(request, { trustedProxy: 'platform' })`,\n    ...deployedTraceFragment('request', '    '),\n    `    const method = request.method.toUpperCase()`,\n    `    // #382 — the run is NOT awaited before the Response is taken. toResponse()`,\n    `    // settles as soon as status + headers are known and carries a live body, so`,\n    `    // the Worker starts flushing while the handler is still writing. Awaiting`,\n    `    // executeRoute() first would re-buffer the whole response here even though`,\n    `    // the shim streams; awaiting toResponse() does not — it settles at the head.`,\n    `    return withSecurityHeaders(await toResponse(executeRoute({`,\n    `      route: match.route, method, params: match.params,`,\n    `      req, res, loadModule, serverDir, requestId, ...CSRF_CONFIG, ${runtimeSpread}`,\n    `    })), SECURITY_HEADERS)`,\n    `}`,\n    ``,\n    ...deployedRateLimitFragment(\n      rateLimit,\n      'cloudflare',\n      // `cf-connecting-ip` is the RUNTIME's answer and a caller cannot forge it through the edge.\n      // A Worker reached directly has none, and then only a declared `trustProxy` produces an\n      // address — otherwise `undefined`, which is the named 503 rather than everyone's bucket.\n      `request.headers.get('cf-connecting-ip') ?? resolveClientIpFromRequest(request, TRUST_PROXY)`,\n      // `request` alone: the handler binds `(request, env, ctx)` and the header is on the request.\n      'request',\n    ),\n    ``,\n    `export default {`,\n    `  async fetch(request, env, ctx) {`,\n    `    const url = new URL(request.url)`,\n    ``,\n    `    // #409 — the preflight is answered BEFORE anything routes: an OPTIONS the router handles`,\n    `    // is an OPTIONS the browser never gets a CORS answer to. The WebSocket upgrade above is`,\n    `    // deliberately upstream of it — a 101 is not a CORS-governed response.`,\n    `    const preflight = corsPreflight(request)`,\n    `    if (preflight !== null) return withSecurityHeaders(preflight, SECURITY_HEADERS)`,\n    ...rateLimitCheckFragment(rateLimit, '    ', 'request'),\n    ``,\n    `    // LCR0103 — the upgrade branch sits BELOW the limiter, and the order is the point.`,\n    `    // It used to sit above, under the comment \"a 101 carries no document and no script,`,\n    `    // so the security baseline does not apply to it\". That is true of the security`,\n    `    // HEADERS — a document concern — and false of the limiter, which is a resource`,\n    `    // concern: a long-lived socket is the most expensive thing this entry hands out, so`,\n    `    // the upgrade is the path that most needs a budget, not the one that may skip it.`,\n    `    // T3.4 — Detect WebSocket upgrade and delegate to the CF bridge.`,\n    `    // A 101 carries no document and no script, so the security baseline does`,\n    `    // not apply to it.`,\n    `    if (request.headers.get('upgrade')?.toLowerCase() === 'websocket') {`,\n    `      if (!HAS_WS_ROUTES) return notFoundResponse()`,\n    `      const cfWs = createCloudflareWsBridge({`,\n    `        onOpen: () => {},`,\n    `        onMessage: (ws, data) => { ws.send(data) },`,\n    `        onClose: () => {},`,\n    `      })`,\n    `      return cfWs.handle(request)`,\n    `    }`,\n    ``,\n    `    return withCors(request, await handleRequest(request, url, env))`,\n    `  },`,\n    `}`,\n  ]\n}\n\nexport function renderWranglerToml(opts?: { ssrStreaming?: boolean }): string {\n  return [\n    `# Generated by Theo — Cloudflare Workers`,\n    `name = \"theo-app\"`,\n    `main = \".theokit/cloudflare/worker.mjs\"`,\n    `compatibility_date = \"2025-09-01\"`,\n    `compatibility_flags = [\"nodejs_compat\"]`,\n    ``,\n    `# #412 — \\`[assets]\\` with a BINDING, not the legacy \\`[site]\\` bucket.`,\n    `#`,\n    `# \\`[site]\\` uploads to KV and is read through \\`kv-asset-handler\\` and a`,\n    `# \\`__STATIC_CONTENT\\` binding — neither of which this worker has ever had. So the`,\n    `# bucket was declared, uploaded, and consumed by nothing: with ssrStreaming off, a`,\n    `# deploy answered 404 for its own page. This binding is what the worker calls.`,\n    `[assets]`,\n    `directory = \".theokit/client\"`,\n    `binding = \"ASSETS\"`,\n    `# B-263 — WITHOUT this key Cloudflare's asset handler answers before the worker for any path`,\n    `# that matches a file, and \\`.theokit/client/index.html\\` matches \\`/\\`. Measured on the first real`,\n    `# deploy: \\`GET /\\` returned 200 with an empty \\`<div id=\"root\">\\` and NONE of the six security`,\n    `# headers, while \\`/api/health\\` — a path no file matches — was answered by the worker and carried`,\n    `# them. The document was coming off the CDN and the code that renders it never ran.`,\n    `#`,\n    `# The negation keeps the 300-odd hashed build outputs on the CDN path: \\`true\\` would satisfy the`,\n    `# precedence and pay a JS invocation per stylesheet and chunk.`,\n    `run_worker_first = [\"/*\", \"!/assets/*\"]`,\n    ...(opts?.ssrStreaming === true\n      ? [\n          `# The worker renders every extension-less path itself, so an asset MISS is a genuine 404.`,\n          `# \\`single-page-application\\` here would answer \\`/nope.png\\` with 200 and an HTML body.`,\n          `not_found_handling = \"none\"`,\n        ]\n      : [\n          `# A client-routed app asks for /dashboard, which is no file, and with streaming off the`,\n          `# worker forwards it to ASSETS rather than rendering it. Without this the asset handler`,\n          `# 404s a deep link and the SPA never boots.`,\n          `not_found_handling = \"single-page-application\"`,\n        ]),\n    ``,\n    `# B-332 — the [define] \"import.meta.url\" compensation lived here until 2026-09-28.`,\n    `#`,\n    `# Cloudflare executes the top-level module during validation, so a dependency that resolves a`,\n    `# path at load time refused the whole upload (code 10021). The cause was @theokit/sdk, in`,\n    `# internal/providers/catalog-loader.ts, fixed upstream and published in 5.9.2 — measured on the`,\n    `# published tarball: 0 of 254 executable files resolve a path at module scope.`,\n    `#`,\n    `# The floor this framework declares is now ^5.9.2, so the versions that needed the compensation`,\n    `# cannot be installed. A declared dependency is the honest form of that requirement;`,\n    `# substituting a literal for import.meta.url was the form that also covered the NEXT dependency`,\n    `# with the same vice, in silence.`,\n    ``,\n    `# Environment variables are set via wrangler secret or dashboard`,\n    `# Example: wrangler secret put DATABASE_URL`,\n  ].join('\\n')\n}\n\nexport const cloudflareAdapter: DeployAdapter = {\n  // #367 / #369 and `docs/adr/0020`. Wrangler runs esbuild at deploy time, so bundling here\n  // twice would be work with no observable effect — validated live 2026-09-26\n  // (`records/acceptance/evidence/b263-cloudflare-deploy.txt`). There is still no source tree in\n  // a Worker, which is why it bakes.\n  readsSourceAtRunTime: false,\n  specifiersResolvedBy: 'the-platform',\n  name: 'cloudflare',\n  streamsResponses: true,\n  // #409 / #410 — the generated entry calls `executeRoute` with routes, loader\n  // and serverDir only. CSRF, route policy, file middleware and Zod validation\n  // still run because they live inside `executeRoute`; none of the remaining\n  // configurable concerns reach it. Declared explicitly rather than omitted so\n  // the gap is a statement in the source and not an absence.\n  //\n  // `securityHeaders` IS applied: the worker carries `security.headers` as a\n  // literal and puts the built baseline on every response it returns, including\n  // the streamed SSR document — with a per-request nonce, the only deploy path\n  // that can mint one (`adapters/security-headers.ts`).\n  servesAgents: true,\n  appliesConfig: ['securityHeaders', 'csrf', 'disallowed', 'cors', 'serialization', 'plugins'],\n  // B-257 — per-invocation: an in-process counter does not survive, so a declared limit needs a durable store.\n  enforcesRateLimit: 'with-a-store',\n\n  async build(config: TheoConfig, cwd: string, ctx?: AdapterBuildContext): Promise<void> {\n    // Wave 2 (T2.2) — reject polyglot services on this adapter.\n    assertServicesUnsupported('cloudflare', readManifest(cwd))\n\n    // 1. Run the standard Node build first (ctx forwarded so nodeAdapter has makeVitePlugins)\n    await nodeAdapter.build(config, cwd, ctx)\n\n    const outputDir = resolve(cwd, '.theokit/cloudflare')\n    // eslint-disable-next-line security/detect-non-literal-fs-filename -- build-time output directory, derived from the project root\n    mkdirSync(outputDir, { recursive: true })\n\n    // 2. Emit Worker entry (now uses the shared web-shim)\n    //\n    // The document shell is read HERE, after the Node build produced\n    // `.theokit/client/index.html`, and inlined into the worker: a Worker has no\n    // filesystem at request time. Split on the root div with the same helper the\n    // Node server uses (`ssr-setup.ts`), so the two paths cannot disagree about\n    // where the shell ends (#343).\n    const shell = readDocumentShell(cwd, config.ssrStreaming)\n    // B-035 — the route-to-chunks map, read HERE on the build machine for the same reason the\n    // shell above is: a Worker has no filesystem at request time. `nodeAdapter.build` ran\n    // first, so the map the Node build emitted is on disk by now. Absent map -> nothing about\n    // preloads is emitted, and the worker behaves exactly as it did before.\n    const assetsMap = readAssetsMapForBake(resolve(cwd, '.theokit', 'client', 'assets-map.json'))\n\n    // #369 — the routes are resolved HERE, on the build machine, for the same reason the document\n    // shell above is read here: a Worker has no filesystem at request time, and the worker used to\n    // run the scan itself against a directory that does not exist there.\n    //\n    // The scanner is INJECTED rather than imported: importing it would add an `adapters → server`\n    // edge, which is the layering inversion ADR-0001 v3 removed for `vite-plugin` and which\n    // `adapters-may-only-depend-on-core-router-services` refuses. An absent scanner emits a worker\n    // with no routes rather than falling back to a runtime scan — the fallback IS the defect.\n    const scanned = ctx?.scanRoutes?.(config.serverDir) ?? {\n      routes: [],\n      wsRoutes: [],\n      agents: [],\n      // B-185 — no provider means no scan, and an app whose context nobody looked for is\n      // indistinguishable here from one that has none. Both resolve an anonymous caller, which is\n      // the honest answer rather than an invented subject.\n      contextModule: undefined,\n    }\n\n    const pluginsPlan = planDeployedPlugins(config.plugins, 'cloudflare')\n    if (pluginsPlan !== undefined) {\n      // Beside the worker, so the emitted import is a sibling. Wrangler bundles from here, which is\n      // what lets the static import reach the app's own module at all (#425).\n      // eslint-disable-next-line security/detect-non-literal-fs-filename -- build-time write under the project's own `.theokit/cloudflare`\n      writeFileSync(resolve(outputDir, 'theo.plugins.mjs'), pluginsPlan.source)\n    }\n\n    // eslint-disable-next-line security/detect-non-literal-fs-filename -- build-time write under the project's own `.theokit/cloudflare`\n    writeFileSync(\n      resolve(outputDir, 'worker.mjs'),\n      renderCloudflareWorkerEntry({\n        ssrStreaming: config.ssrStreaming,\n        // B-315 — LATENT here, not broken: the routes are baked (#369) so the worker never scans,\n        // and a live deploy on 2026-09-26 served every route correctly with the wrong literal. It\n        // is still handed to `executeRoute`, so it is one refactor away from mattering.\n        serverDir: config.serverDir,\n        ...shell,\n        securityHeaders: config.security?.headers,\n        csrf: config.security?.csrf,\n        disallowed: config.security?.disallowed,\n        cors: config.security?.cors,\n        assetsMap,\n        // #425 — a selector, not a transformer, so it rides as a literal like the values above.\n        serialization: config.serialization,\n        // #425 — the ONE concern that is not a literal. A closure cannot be baked, so a plugin\n        // declared by module specifier is imported by the emitted module instead; a constructed one\n        // is refused by name at build time rather than dropped in silence.\n        runtimeConfigModule: pluginsPlan?.moduleSpecifier,\n        routes: scanned.routes,\n        // #367 — a Worker has no filesystem, so its agents are decided here like its routes.\n        agents: scanned.agents,\n        // B-185 — rides beside the agents because it is decided by the same provider, for the same\n        // reason: `build.ts` holds `serverDir` and a Worker cannot look for the module itself.\n        contextModule: scanned.contextModule,\n        wsRoutes: scanned.wsRoutes,\n      }),\n    )\n\n    // 3. Emit wrangler.toml (with nodejs_compat enforced)\n    // eslint-disable-next-line security/detect-non-literal-fs-filename -- build-time write under the project's own `.theokit/cloudflare`\n    writeFileSync(\n      resolve(cwd, 'wrangler.toml'),\n      // B-263 — the toml decides whether the worker or the CDN answers the document, and the two\n      // modes need different `not_found_handling`. Passing the flag is what keeps them apart.\n      renderWranglerToml({ ssrStreaming: config.ssrStreaming }),\n    )\n\n    // eslint-disable-next-line no-console -- CLI build progress\n    console.log('\\n  ✓ Cloudflare output → .theokit/cloudflare/ + wrangler.toml')\n    // eslint-disable-next-line no-console -- CLI build progress\n    console.log(\n      `${describeDeployedSecurityHeaders({\n        target: 'cloudflare',\n        securityHeaders: config.security?.headers,\n        // Only the streaming worker renders HTML per request, so only it can put\n        // the same nonce on the header and on the script tag it emits.\n        mintsNonce: config.ssrStreaming,\n        // #412 — either way the worker returns the document now: streamed by\n        // `renderStreamingWeb`, or from the ASSETS binding it finally calls.\n        documentHeaders: 'handler',\n      })}\\n`,\n    )\n  },\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,WAAW,cAAc,qBAAqB;AACvD,SAAS,eAAe;AA0DjB,SAAS,qBAAqB,MAAoD;AACvF,MAAI;AAEF,WAAO,eAAe,aAAa,MAAM,MAAM,CAAC;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AA2BA,SAAS,gBAAgB,MAGb;AACV,SAAO,KAAK,iBAAiB,QAAQ,KAAK,cAAc;AAC1D;AAEA,SAAS,qBAAqB,WAAyD;AACrF,MAAI,cAAc,OAAW,QAAO;AACpC,SAAO,6BAA6B,KAAK,UAAU,SAAS,CAAC;AAC/D;AAOA,SAAS,mBACP,MACA,eACQ;AACR,SAAO,KAAK,eACR;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,CAAC,gBACG,uBAAuB,KAAK,UAAU,KAAK,YAAY,EAAE,CAAC,MAC1D,4CAA4C,KAAK,UAAU,KAAK,YAAY,EAAE,CAAC;AAAA,IACnF,uBAAuB,KAAK,UAAU,KAAK,YAAY,EAAE,CAAC;AAAA,IAC1D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI,IACX;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACjB;AAEO,SAAS,4BACd,OA6C6B,CAAC,GACtB;AASR,QAAM,kBAAkB,KAAK,eACzB,mEACA;AAuBJ,QAAM,gBAAgB,gBAAgB,IAAI;AAC1C,QAAM,iBAAiB,gBAAgB,qBAAqB,KAAK,SAAS,IAAI;AAE9E,QAAM,eAAe,mBAAmB,MAAM,aAAa;AAO3D,QAAM,EAAE,cAAc,oBAAoB,kBAAkB,IAAI;AAAA,IAC9D,KAAK,UAAU,CAAC;AAAA,EAClB;AACA,QAAM,gBAAgB,8BAA8B,IAAI;AACxD,QAAM,iBAAiB;AAAA,IACrB,KAAK,WAAW,SACZ;AAAA;AAAA;AAAA;AAAA,MAIA,EAAE,MAAM,SAAS,QAAQ,KAAK,QAAQ,eAAe,KAAK,cAAc;AAAA;AAAA,IAC5E;AAAA,MACE,qBAAqB;AAAA;AAAA;AAAA;AAAA,MAIrB,kBACE,KAAK,wBAAwB,SAAY,SAAY;AAAA,IACzD;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAcA,CAAC,gBACG;AAAA,qHACA;AAAA;AAAA,IACJ;AAAA,IACA,KAAK,eACD,iHACA;AAAA,IACJ;AAAA,IACA;AAAA;AAAA;AAAA;AAAA;AAAA,IAKA,GAAI,KAAK,cAAc,SACnB,CAAC,IACD;AAAA,MACE;AAAA,MACA;AAAA,IACF;AAAA,IACJ;AAAA,IACA;AAAA,IACA,GAAG,cAAc;AAAA,IACjB,GAAG,eAAe;AAAA,IAClB,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA,qBAAqB,iBAAiB,IAAI,CAAC;AAAA,IAC3C;AAAA,IACA,GAAG,kBAAkB,oBAAoB,mBAAmB,YAAY;AAAA,IACxE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,4BAA4B,KAAK,eAAe;AAAA,IACnD;AAAA,IACA,GAAG,qBAAqB,MAAM,UAAU;AAAA,IACxC;AAAA,IACA,GAAG,cAAc;AAAA,IACjB,GAAG,eAAe;AAAA,IAClB,GAAG,qBAAqB,KAAK,MAAM,YAAY;AAAA,IAC/C;AAAA,IACA;AAAA,IACA,yBAAyB,QAAQ,KAAK,YAAY,CAAC,GAAG,SAAS,CAAC,CAAC;AAAA,IACjE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,MACD;AAAA,MACA,cAAc;AAAA,MACd,eAAe;AAAA,MACf,eAAe;AAAA,MACf,KAAK;AAAA,IACP;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAWA,SAAS,gCACP,cACA,eACA,aAEA,YAGA,WACU;AACV,SAAO;AAAA,IACL;AAAA,IACA,4CAA4C,UAAU;AAAA,IACtD;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,sBAAsB,WAAW,MAAM;AAAA,IAC1C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,qEAAqE,aAAa;AAAA,IAClF;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,MACD;AAAA,MACA;AAAA;AAAA;AAAA;AAAA,MAIA;AAAA;AAAA,MAEA;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,uBAAuB,WAAW,QAAQ,SAAS;AAAA,IACtD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,mBAAmB,MAA2C;AAC5E,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,MAAM,iBAAiB,OACvB;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEO,IAAM,oBAAmC;AAAA;AAAA;AAAA;AAAA;AAAA,EAK9C,sBAAsB;AAAA,EACtB,sBAAsB;AAAA,EACtB,MAAM;AAAA,EACN,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWlB,cAAc;AAAA,EACd,eAAe,CAAC,mBAAmB,QAAQ,cAAc,QAAQ,iBAAiB,SAAS;AAAA;AAAA,EAE3F,mBAAmB;AAAA,EAEnB,MAAM,MAAM,QAAoB,KAAa,KAA0C;AAErF,8BAA0B,cAAc,aAAa,GAAG,CAAC;AAGzD,UAAM,YAAY,MAAM,QAAQ,KAAK,GAAG;AAExC,UAAM,YAAY,QAAQ,KAAK,qBAAqB;AAEpD,cAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AASxC,UAAM,QAAQ,kBAAkB,KAAK,OAAO,YAAY;AAKxD,UAAM,YAAY,qBAAqB,QAAQ,KAAK,YAAY,UAAU,iBAAiB,CAAC;AAU5F,UAAM,UAAU,KAAK,aAAa,OAAO,SAAS,KAAK;AAAA,MACrD,QAAQ,CAAC;AAAA,MACT,UAAU,CAAC;AAAA,MACX,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA,MAIT,eAAe;AAAA,IACjB;AAEA,UAAM,cAAc,oBAAoB,OAAO,SAAS,YAAY;AACpE,QAAI,gBAAgB,QAAW;AAI7B,oBAAc,QAAQ,WAAW,kBAAkB,GAAG,YAAY,MAAM;AAAA,IAC1E;AAGA;AAAA,MACE,QAAQ,WAAW,YAAY;AAAA,MAC/B,4BAA4B;AAAA,QAC1B,cAAc,OAAO;AAAA;AAAA;AAAA;AAAA,QAIrB,WAAW,OAAO;AAAA,QAClB,GAAG;AAAA,QACH,iBAAiB,OAAO,UAAU;AAAA,QAClC,MAAM,OAAO,UAAU;AAAA,QACvB,YAAY,OAAO,UAAU;AAAA,QAC7B,MAAM,OAAO,UAAU;AAAA,QACvB;AAAA;AAAA,QAEA,eAAe,OAAO;AAAA;AAAA;AAAA;AAAA,QAItB,qBAAqB,aAAa;AAAA,QAClC,QAAQ,QAAQ;AAAA;AAAA,QAEhB,QAAQ,QAAQ;AAAA;AAAA;AAAA,QAGhB,eAAe,QAAQ;AAAA,QACvB,UAAU,QAAQ;AAAA,MACpB,CAAC;AAAA,IACH;AAIA;AAAA,MACE,QAAQ,KAAK,eAAe;AAAA;AAAA;AAAA,MAG5B,mBAAmB,EAAE,cAAc,OAAO,aAAa,CAAC;AAAA,IAC1D;AAGA,YAAQ,IAAI,0EAAgE;AAE5E,YAAQ;AAAA,MACN,GAAG,gCAAgC;AAAA,QACjC,QAAQ;AAAA,QACR,iBAAiB,OAAO,UAAU;AAAA;AAAA;AAAA,QAGlC,YAAY,OAAO;AAAA;AAAA;AAAA,QAGnB,iBAAiB;AAAA,MACnB,CAAC,CAAC;AAAA;AAAA,IACJ;AAAA,EACF;AACF;","names":[]}

package/dist/{config-support-SB5NDQZB.js → config-support-MOZYHRWG.js}

@@ -2,7 +2,7 @@
 import "tsx/esm";
 import {
   nodeAdapter
-} from "./chunk-G7U7FQVC.js";
+} from "./chunk-UFBBFP75.js";
 import "./chunk-ZNZISJDZ.js";
 
 // src/adapters/config-support.ts
@@ -117,6 +117,16 @@ var UnenforceableRateLimitError = class extends Error {
   target;
   name = "UnenforceableRateLimitError";
 };
+function assertStreamingSupported(config, adapter, target, streamingTargets) {
+  if (!config.ssrStreaming) return;
+  if (adapter.streamsResponses === true) return;
+  const detail = adapter.streamingUnsupportedDetail === void 0 ? "" : ` ${adapter.streamingUnsupportedDetail}`;
+  const alternatives = streamingTargets === void 0 || streamingTargets.length === 0 ? "" : ` Build a streaming target instead (${streamingTargets.join(", ")}), or set`;
+  const orSet = alternatives === "" ? " Set" : alternatives;
+  throw new Error(
+    `[adapter-${target}] ssrStreaming is on, but the ${target} target does not stream responses.${detail}${orSet} ssrStreaming: false in theo.config.ts.`
+  );
+}
 function assertRateLimitEnforceable(config, adapter, target) {
   if (!isDeclared(config, "rateLimit")) return;
   const enforces = adapter.enforcesRateLimit ?? "never";
@@ -134,8 +144,9 @@ export {
   CONFIG_CONCERNS,
   UnenforceableRateLimitError,
   assertRateLimitEnforceable,
+  assertStreamingSupported,
   describeUnappliedConfig,
   findUnappliedConfig,
   warnUnappliedConfig
 };
-//# sourceMappingURL=config-support-SB5NDQZB.js.map
+//# sourceMappingURL=config-support-MOZYHRWG.js.map

package/dist/{config-support-SB5NDQZB.js.map → config-support-MOZYHRWG.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/adapters/config-support.ts"],"sourcesContent":["/**\n * Which configuration a deploy target's emitted handler actually applies.\n *\n * `theo.config.ts` validates `rateLimit`, `security.cors`, `security.csrf`,\n * `security.disallowed` and `serialization` for every target. Applying them is\n * the handler's job, and the six Web-standards adapters build `executeRoute`'s\n * context from a subset of its fields, so the rest fall back to hard-coded\n * defaults on a deployed app (usetheokit/theokit#410). `security.cors` was read\n * only by the dev server until #409 wired it into `theokit start`; the six Web\n * targets still drop it.\n *\n * This module does not fix that. It makes it **audible at build time**: a\n * config key that is parsed and then dropped is named, with the target that\n * drops it and the next action. Silence was the defect — an operator who\n * declares a rate limit and gets none has no reason to look.\n *\n * It warns rather than refuses, deliberately. Refusing would break every\n * deployment that declares `rateLimit` today, and the real fix — wiring a\n * limiter that needs a per-runtime client address — is not a build away\n * (`docs/program/journeys/j07-rate-limit.md` § Correction measured what it\n * costs). Forcing an operator to delete valid configuration in order to ship\n * would trade a silent gap for a loud one that also loses information.\n */\nimport type { TheoConfig } from '../config/schema.js'\n\nimport { nodeAdapter } from './node.js'\nimport type { ConfigConcern, DeployAdapter } from './types.js'\n\n/**\n * The closed set. A concern belongs here when it is (a) declarable in\n * `theo.config.ts` and (b) applied by a request handler rather than at build\n * time — a build-time key cannot be silently dropped by a runtime.\n */\nexport const CONFIG_CONCERNS = [\n  'rateLimit',\n  'cors',\n  'csrf',\n  'disallowed',\n  'serialization',\n  'plugins',\n  'securityHeaders',\n] as const satisfies readonly ConfigConcern[]\n\n/**\n * Does any production target apply this concern?\n *\n * DERIVED from what the `node` adapter declares, rather than listed. This was a hand-maintained\n * `APPLIED_BY_NO_TARGET` set holding `cors`, kept in step with `nodeAdapter.appliesConfig` by a\n * test — and #409, which taught `theokit start` to apply `cors`, emptied it. An empty hardcoded\n * set is not merely redundant: it makes the branch below provably unreachable, which the linter\n * says out loud (`sonarjs/no-empty-collection`).\n *\n * Deriving keeps the branch honest AND reachable: the moment a concern is added that `node` does\n * not apply, the advice stops claiming a target exists for it, with nothing to remember.\n */\nfunction appliedByNoTarget(concern: ConfigConcern): boolean {\n  const applied = nodeAdapter.appliesConfig\n  if (applied === undefined || applied === 'runtime-not-emitted-here') return true\n  return !applied.includes(concern)\n}\n\n/** Where each concern lives in the config, for a message the operator can grep. */\nconst CONFIG_KEY: Record<ConfigConcern, string> = {\n  rateLimit: 'rateLimit',\n  cors: 'security.cors',\n  csrf: 'security.csrf',\n  disallowed: 'security.disallowed',\n  serialization: 'serialization',\n  plugins: 'plugins',\n  securityHeaders: 'security.headers',\n}\n\nfunction isDeclared(config: TheoConfig, concern: ConfigConcern): boolean {\n  const security = config.security\n  switch (concern) {\n    case 'rateLimit':\n      return config.rateLimit !== undefined\n    case 'cors':\n      return security?.cors !== undefined\n    case 'csrf':\n      // `csrf` carries `.default('strict')` (config/schemas/security.ts:100) and\n      // the deployed fallback is also `'strict'` (server/http/execute.ts:144).\n      // A config that says `'strict'` therefore gets what it asked for, by\n      // coincidence rather than by wiring -- reporting it dropped would be noise\n      // over an identical outcome. Only a weaker setting is silently ignored.\n      return security?.csrf !== undefined && security.csrf !== 'strict'\n    case 'disallowed':\n      return security?.disallowed !== undefined && security.disallowed.routes.length > 0\n    case 'securityHeaders':\n      return security?.headers !== undefined\n    case 'serialization':\n      // Same shape: `.default('json')` (config/schema.ts:147), and a target with\n      // no transformer serializes as JSON. `'json'` is honoured by coincidence;\n      // `'superjson'` is the case where the deployed app quietly disagrees with\n      // the file.\n      return config.serialization !== 'json'\n    case 'plugins':\n      return config.plugins !== undefined && config.plugins.length > 0\n  }\n}\n\n/**\n * The concerns this config declares and this adapter does not apply.\n *\n * An adapter that emits no request handler of its own answers\n * `'runtime-not-emitted-here'` and is never reported against: it is not that\n * the configuration is dropped, it is that this build cannot know. Saying\n * nothing is the honest output, and it is a different fact from saying no.\n */\nexport function findUnappliedConfig(\n  config: TheoConfig,\n  adapter: Pick<DeployAdapter, 'appliesConfig'>,\n): ConfigConcern[] {\n  const applied = adapter.appliesConfig ?? []\n  if (applied === 'runtime-not-emitted-here') return []\n  return CONFIG_CONCERNS.filter(\n    (concern) => isDeclared(config, concern) && !applied.includes(concern),\n  )\n}\n\n/**\n * The build-time message. Empty string when nothing was dropped, so the caller\n * neither branches nor prints a header over an empty list.\n */\nexport function describeUnappliedConfig(target: string, dropped: readonly ConfigConcern[]): string {\n  if (dropped.length === 0) return ''\n  const one = dropped.length === 1\n  const list = dropped.map((concern) => `      - ${CONFIG_KEY[concern]}`).join('\\n')\n  const elsewhere = dropped.filter((concern) => !appliedByNoTarget(concern))\n  const nowhere = dropped.filter(appliedByNoTarget)\n\n  // The advice has to change with the target, or it degenerates. Building for\n  // `node` with only `security.cors` dropped once produced \"deploy to `node`,\n  // which applies all of the above except security.cors\" -- an instruction to\n  // do what you are already doing, about the one key it then excepts.\n  const actions: string[] = []\n  if (elsewhere.length > 0 && target !== 'node') {\n    actions.push(\n      `    - ${elsewhere.map((c) => CONFIG_KEY[c]).join(', ')}: build for \\`node\\` and run \\`theokit start\\`,`,\n      `      which applies ${elsewhere.length === 1 ? 'it' : 'them'}; or remove ${elsewhere.length === 1 ? 'it' : 'them'} so the file states what runs.`,\n    )\n  } else if (elsewhere.length > 0) {\n    actions.push(\n      `    - ${elsewhere.map((c) => CONFIG_KEY[c]).join(', ')}: remove ${elsewhere.length === 1 ? 'it' : 'them'} so the file states what runs.`,\n    )\n  }\n  if (nowhere.length > 0) {\n    actions.push(\n      `    - ${nowhere.map((c) => CONFIG_KEY[c]).join(', ')}: no production target applies ${nowhere.length === 1 ? 'this' : 'these'} today`,\n      `      (usetheokit/theokit#409) -- terminate it in front of the app, or remove it.`,\n    )\n  }\n\n  return [\n    `  ! ${String(dropped.length)} configuration ${one ? 'key is' : 'keys are'} validated and NOT applied on \\`${target}\\`:`,\n    list,\n    `    The handler this target emits never reads ${one ? 'it' : 'them'}, so the deployed app`,\n    `    behaves as if ${one ? 'the key were' : 'the keys were'} absent.`,\n    `    What to do:`,\n    ...actions,\n    `    Tracked: usetheokit/theokit#410 (deploy targets), usetheokit/theokit#409 (cors).`,\n  ].join('\\n')\n}\n\n/**\n * Emit the warning, if there is one. The sink is injected so the behaviour is\n * exercisable without driving a whole build: the alternative was a caller that\n * only a full `theokit build` could reach, which in practice means a caller\n * nothing tests.\n */\nexport function warnUnappliedConfig(\n  config: TheoConfig,\n  adapter: Pick<DeployAdapter, 'appliesConfig'>,\n  target: string,\n  log: (message: string) => void,\n): void {\n  const dropped = findUnappliedConfig(config, adapter)\n  if (dropped.length === 0) return\n  log(`\\n${describeUnappliedConfig(target, dropped)}\\n`)\n}\n\n/**\n * A declared rate limit the chosen target cannot enforce.\n *\n * Its own class so a caller can distinguish it from a configuration typo — this is not the build\n * failing to understand the file, it is the build understanding it and refusing the combination.\n */\nexport class UnenforceableRateLimitError extends Error {\n  override readonly name = 'UnenforceableRateLimitError'\n  constructor(readonly target: string) {\n    super(\n      [\n        `Refusing to build for \\`${target}\\`: theo.config.ts declares a rate limit and this target does not enforce one.`,\n        ``,\n        `  The config reads as protection the deploy will not have. Nothing at runtime reports the`,\n        `  absence, so the first sign is abuse — which is why this refuses rather than warns.`,\n        ``,\n        `  Two honest ways forward:`,\n        `    • build for \\`node\\` and run \\`theokit start\\`, which applies the limit; or`,\n        `    • remove \\`rateLimit\\` from theo.config.ts, so the file states what actually runs.`,\n        ``,\n        `  There is deliberately no flag to keep the key and skip the check: a config that stays`,\n        `  while doing nothing is the state this refusal exists to end (usetheokit/theokit#461).`,\n      ].join('\\n'),\n    )\n  }\n}\n\n/**\n * Refuse a build whose target drops a DECLARED rate limit.\n *\n * Only `rateLimit`, and the narrowness is the design. A dropped `cors` or `serialization` degrades\n * where someone can see it, and `describeUnappliedConfig`'s warning is proportionate for those.\n * `rateLimit` is the one whose absence looks exactly like success, which is the same reasoning\n * `MissingRoutePolicyError` applies to an undeclared route policy: refuse where silence would be\n * read as safety.\n *\n * `'runtime-not-emitted-here'` is not judged. That adapter's runtime is someone else's and this\n * build cannot answer for it; refusing there would be asserting something unmeasured.\n */\nexport function assertRateLimitEnforceable(\n  config: TheoConfig,\n  adapter: Pick<DeployAdapter, 'enforcesRateLimit'>,\n  target: string,\n): void {\n  if (!isDeclared(config, 'rateLimit')) return\n\n  // B-257 — this reads `enforcesRateLimit`, NOT `appliesConfig`. They were one list until now, and\n  // `applied.includes('rateLimit')` returned before the throw, so adding that entry to silence the\n  // WARNING also switched off this REFUSAL — on a runtime where the limit still cannot hold.\n  //\n  // **An omitted field REFUSES.** The first cut defaulted to `'not-ours-to-judge'`, which inverted\n  // the rule it replaced: `appliesConfig ?? []` did not include `'rateLimit'`, so an adapter that\n  // declared nothing was refused; `?? 'not-ours-to-judge'` let it through. Measured on\n  // `static.ts`, which declares neither field and is registered at `registry.ts:28` — it went from\n  // refusing a declared limit to proceeding with a console warning. `:213-215` refuses exactly that\n  // outcome in its own words, and this member is on the EXPORTED `DeployAdapter`, so every\n  // third-party adapter inherited the inversion too.\n  //\n  // Abstaining is a CLAIM about somebody else's runtime, and a claim has to be made rather than\n  // inferred from silence.\n  const enforces = adapter.enforcesRateLimit ?? 'never'\n\n  // An adapter emitting no request handler is not judged. Its runtime is someone else's and this\n  // build cannot answer for it; refusing would assert something unmeasured. An ABSTAIN, and the\n  // reason it is not spelled `'never'`.\n  if (enforces === 'not-ours-to-judge') return\n\n  if (enforces === 'always') return\n\n  // `'never'`, and the default for an adapter that declared nothing. Refusing here is what the\n  // pre-B-257 rule did; reaching the store check below would let an undeclared adapter enforce by\n  // accident whenever a config happened to name one.\n  if (enforces === 'never') throw new UnenforceableRateLimitError(target)\n\n  // `'with-a-store'`: a per-invocation runtime enforces only when the config names a durable\n  // counter. Without one the in-process count dies with the invocation, and a limit that forgets is\n  // a limit that does not limit — the same class of failure as a shared bucket, by another road.\n  if (declaresRateLimitStore(config)) return\n\n  throw new UnenforceableRateLimitError(target)\n}\n\n/** Does the declared `rateLimit` name a store the emitted entry could construct? */\nfunction declaresRateLimitStore(config: TheoConfig): boolean {\n  const limit = (config as { rateLimit?: { store?: unknown } }).rateLimit\n  return typeof limit?.store === 'object' && limit.store !== null\n}\n"],"mappings":";;;;;;;;AAiCO,IAAM,kBAAkB;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAcA,SAAS,kBAAkB,SAAiC;AAC1D,QAAM,UAAU,YAAY;AAC5B,MAAI,YAAY,UAAa,YAAY,2BAA4B,QAAO;AAC5E,SAAO,CAAC,QAAQ,SAAS,OAAO;AAClC;AAGA,IAAM,aAA4C;AAAA,EAChD,WAAW;AAAA,EACX,MAAM;AAAA,EACN,MAAM;AAAA,EACN,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,SAAS;AAAA,EACT,iBAAiB;AACnB;AAEA,SAAS,WAAW,QAAoB,SAAiC;AACvE,QAAM,WAAW,OAAO;AACxB,UAAQ,SAAS;AAAA,IACf,KAAK;AACH,aAAO,OAAO,cAAc;AAAA,IAC9B,KAAK;AACH,aAAO,UAAU,SAAS;AAAA,IAC5B,KAAK;AAMH,aAAO,UAAU,SAAS,UAAa,SAAS,SAAS;AAAA,IAC3D,KAAK;AACH,aAAO,UAAU,eAAe,UAAa,SAAS,WAAW,OAAO,SAAS;AAAA,IACnF,KAAK;AACH,aAAO,UAAU,YAAY;AAAA,IAC/B,KAAK;AAKH,aAAO,OAAO,kBAAkB;AAAA,IAClC,KAAK;AACH,aAAO,OAAO,YAAY,UAAa,OAAO,QAAQ,SAAS;AAAA,EACnE;AACF;AAUO,SAAS,oBACd,QACA,SACiB;AACjB,QAAM,UAAU,QAAQ,iBAAiB,CAAC;AAC1C,MAAI,YAAY,2BAA4B,QAAO,CAAC;AACpD,SAAO,gBAAgB;AAAA,IACrB,CAAC,YAAY,WAAW,QAAQ,OAAO,KAAK,CAAC,QAAQ,SAAS,OAAO;AAAA,EACvE;AACF;AAMO,SAAS,wBAAwB,QAAgB,SAA2C;AACjG,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,QAAM,MAAM,QAAQ,WAAW;AAC/B,QAAM,OAAO,QAAQ,IAAI,CAAC,YAAY,WAAW,WAAW,OAAO,CAAC,EAAE,EAAE,KAAK,IAAI;AACjF,QAAM,YAAY,QAAQ,OAAO,CAAC,YAAY,CAAC,kBAAkB,OAAO,CAAC;AACzE,QAAM,UAAU,QAAQ,OAAO,iBAAiB;AAMhD,QAAM,UAAoB,CAAC;AAC3B,MAAI,UAAU,SAAS,KAAK,WAAW,QAAQ;AAC7C,YAAQ;AAAA,MACN,SAAS,UAAU,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA,MACvD,uBAAuB,UAAU,WAAW,IAAI,OAAO,MAAM,eAAe,UAAU,WAAW,IAAI,OAAO,MAAM;AAAA,IACpH;AAAA,EACF,WAAW,UAAU,SAAS,GAAG;AAC/B,YAAQ;AAAA,MACN,SAAS,UAAU,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,YAAY,UAAU,WAAW,IAAI,OAAO,MAAM;AAAA,IAC3G;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,GAAG;AACtB,YAAQ;AAAA,MACN,SAAS,QAAQ,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,kCAAkC,QAAQ,WAAW,IAAI,SAAS,OAAO;AAAA,MAC9H;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,OAAO,OAAO,QAAQ,MAAM,CAAC,kBAAkB,MAAM,WAAW,UAAU,mCAAmC,MAAM;AAAA,IACnH;AAAA,IACA,iDAAiD,MAAM,OAAO,MAAM;AAAA,IACpE,qBAAqB,MAAM,iBAAiB,eAAe;AAAA,IAC3D;AAAA,IACA,GAAG;AAAA,IACH;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAQO,SAAS,oBACd,QACA,SACA,QACA,KACM;AACN,QAAM,UAAU,oBAAoB,QAAQ,OAAO;AACnD,MAAI,QAAQ,WAAW,EAAG;AAC1B,MAAI;AAAA,EAAK,wBAAwB,QAAQ,OAAO,CAAC;AAAA,CAAI;AACvD;AAQO,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAErD,YAAqB,QAAgB;AACnC;AAAA,MACE;AAAA,QACE,2BAA2B,MAAM;AAAA,QACjC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI;AAAA,IACb;AAfmB;AAAA,EAgBrB;AAAA,EAhBqB;AAAA,EADH,OAAO;AAkB3B;AAcO,SAAS,2BACd,QACA,SACA,QACM;AACN,MAAI,CAAC,WAAW,QAAQ,WAAW,EAAG;AAgBtC,QAAM,WAAW,QAAQ,qBAAqB;AAK9C,MAAI,aAAa,oBAAqB;AAEtC,MAAI,aAAa,SAAU;AAK3B,MAAI,aAAa,QAAS,OAAM,IAAI,4BAA4B,MAAM;AAKtE,MAAI,uBAAuB,MAAM,EAAG;AAEpC,QAAM,IAAI,4BAA4B,MAAM;AAC9C;AAGA,SAAS,uBAAuB,QAA6B;AAC3D,QAAM,QAAS,OAA+C;AAC9D,SAAO,OAAO,OAAO,UAAU,YAAY,MAAM,UAAU;AAC7D;","names":[]}
+{"version":3,"sources":["../src/adapters/config-support.ts"],"sourcesContent":["/**\n * Which configuration a deploy target's emitted handler actually applies.\n *\n * `theo.config.ts` validates `rateLimit`, `security.cors`, `security.csrf`,\n * `security.disallowed` and `serialization` for every target. Applying them is\n * the handler's job, and the six Web-standards adapters build `executeRoute`'s\n * context from a subset of its fields, so the rest fall back to hard-coded\n * defaults on a deployed app (usetheokit/theokit#410). `security.cors` was read\n * only by the dev server until #409 wired it into `theokit start`; the six Web\n * targets still drop it.\n *\n * This module does not fix that. It makes it **audible at build time**: a\n * config key that is parsed and then dropped is named, with the target that\n * drops it and the next action. Silence was the defect — an operator who\n * declares a rate limit and gets none has no reason to look.\n *\n * It warns rather than refuses, deliberately. Refusing would break every\n * deployment that declares `rateLimit` today, and the real fix — wiring a\n * limiter that needs a per-runtime client address — is not a build away\n * (`docs/program/journeys/j07-rate-limit.md` § Correction measured what it\n * costs). Forcing an operator to delete valid configuration in order to ship\n * would trade a silent gap for a loud one that also loses information.\n */\nimport type { TheoConfig } from '../config/schema.js'\n\nimport { nodeAdapter } from './node.js'\nimport type { ConfigConcern, DeployAdapter } from './types.js'\n\n/**\n * The closed set. A concern belongs here when it is (a) declarable in\n * `theo.config.ts` and (b) applied by a request handler rather than at build\n * time — a build-time key cannot be silently dropped by a runtime.\n */\nexport const CONFIG_CONCERNS = [\n  'rateLimit',\n  'cors',\n  'csrf',\n  'disallowed',\n  'serialization',\n  'plugins',\n  'securityHeaders',\n] as const satisfies readonly ConfigConcern[]\n\n/**\n * Does any production target apply this concern?\n *\n * DERIVED from what the `node` adapter declares, rather than listed. This was a hand-maintained\n * `APPLIED_BY_NO_TARGET` set holding `cors`, kept in step with `nodeAdapter.appliesConfig` by a\n * test — and #409, which taught `theokit start` to apply `cors`, emptied it. An empty hardcoded\n * set is not merely redundant: it makes the branch below provably unreachable, which the linter\n * says out loud (`sonarjs/no-empty-collection`).\n *\n * Deriving keeps the branch honest AND reachable: the moment a concern is added that `node` does\n * not apply, the advice stops claiming a target exists for it, with nothing to remember.\n */\nfunction appliedByNoTarget(concern: ConfigConcern): boolean {\n  const applied = nodeAdapter.appliesConfig\n  if (applied === undefined || applied === 'runtime-not-emitted-here') return true\n  return !applied.includes(concern)\n}\n\n/** Where each concern lives in the config, for a message the operator can grep. */\nconst CONFIG_KEY: Record<ConfigConcern, string> = {\n  rateLimit: 'rateLimit',\n  cors: 'security.cors',\n  csrf: 'security.csrf',\n  disallowed: 'security.disallowed',\n  serialization: 'serialization',\n  plugins: 'plugins',\n  securityHeaders: 'security.headers',\n}\n\nfunction isDeclared(config: TheoConfig, concern: ConfigConcern): boolean {\n  const security = config.security\n  switch (concern) {\n    case 'rateLimit':\n      return config.rateLimit !== undefined\n    case 'cors':\n      return security?.cors !== undefined\n    case 'csrf':\n      // `csrf` carries `.default('strict')` (config/schemas/security.ts:100) and\n      // the deployed fallback is also `'strict'` (server/http/execute.ts:144).\n      // A config that says `'strict'` therefore gets what it asked for, by\n      // coincidence rather than by wiring -- reporting it dropped would be noise\n      // over an identical outcome. Only a weaker setting is silently ignored.\n      return security?.csrf !== undefined && security.csrf !== 'strict'\n    case 'disallowed':\n      return security?.disallowed !== undefined && security.disallowed.routes.length > 0\n    case 'securityHeaders':\n      return security?.headers !== undefined\n    case 'serialization':\n      // Same shape: `.default('json')` (config/schema.ts:147), and a target with\n      // no transformer serializes as JSON. `'json'` is honoured by coincidence;\n      // `'superjson'` is the case where the deployed app quietly disagrees with\n      // the file.\n      return config.serialization !== 'json'\n    case 'plugins':\n      return config.plugins !== undefined && config.plugins.length > 0\n  }\n}\n\n/**\n * The concerns this config declares and this adapter does not apply.\n *\n * An adapter that emits no request handler of its own answers\n * `'runtime-not-emitted-here'` and is never reported against: it is not that\n * the configuration is dropped, it is that this build cannot know. Saying\n * nothing is the honest output, and it is a different fact from saying no.\n */\nexport function findUnappliedConfig(\n  config: TheoConfig,\n  adapter: Pick<DeployAdapter, 'appliesConfig'>,\n): ConfigConcern[] {\n  const applied = adapter.appliesConfig ?? []\n  if (applied === 'runtime-not-emitted-here') return []\n  return CONFIG_CONCERNS.filter(\n    (concern) => isDeclared(config, concern) && !applied.includes(concern),\n  )\n}\n\n/**\n * The build-time message. Empty string when nothing was dropped, so the caller\n * neither branches nor prints a header over an empty list.\n */\nexport function describeUnappliedConfig(target: string, dropped: readonly ConfigConcern[]): string {\n  if (dropped.length === 0) return ''\n  const one = dropped.length === 1\n  const list = dropped.map((concern) => `      - ${CONFIG_KEY[concern]}`).join('\\n')\n  const elsewhere = dropped.filter((concern) => !appliedByNoTarget(concern))\n  const nowhere = dropped.filter(appliedByNoTarget)\n\n  // The advice has to change with the target, or it degenerates. Building for\n  // `node` with only `security.cors` dropped once produced \"deploy to `node`,\n  // which applies all of the above except security.cors\" -- an instruction to\n  // do what you are already doing, about the one key it then excepts.\n  const actions: string[] = []\n  if (elsewhere.length > 0 && target !== 'node') {\n    actions.push(\n      `    - ${elsewhere.map((c) => CONFIG_KEY[c]).join(', ')}: build for \\`node\\` and run \\`theokit start\\`,`,\n      `      which applies ${elsewhere.length === 1 ? 'it' : 'them'}; or remove ${elsewhere.length === 1 ? 'it' : 'them'} so the file states what runs.`,\n    )\n  } else if (elsewhere.length > 0) {\n    actions.push(\n      `    - ${elsewhere.map((c) => CONFIG_KEY[c]).join(', ')}: remove ${elsewhere.length === 1 ? 'it' : 'them'} so the file states what runs.`,\n    )\n  }\n  if (nowhere.length > 0) {\n    actions.push(\n      `    - ${nowhere.map((c) => CONFIG_KEY[c]).join(', ')}: no production target applies ${nowhere.length === 1 ? 'this' : 'these'} today`,\n      `      (usetheokit/theokit#409) -- terminate it in front of the app, or remove it.`,\n    )\n  }\n\n  return [\n    `  ! ${String(dropped.length)} configuration ${one ? 'key is' : 'keys are'} validated and NOT applied on \\`${target}\\`:`,\n    list,\n    `    The handler this target emits never reads ${one ? 'it' : 'them'}, so the deployed app`,\n    `    behaves as if ${one ? 'the key were' : 'the keys were'} absent.`,\n    `    What to do:`,\n    ...actions,\n    `    Tracked: usetheokit/theokit#410 (deploy targets), usetheokit/theokit#409 (cors).`,\n  ].join('\\n')\n}\n\n/**\n * Emit the warning, if there is one. The sink is injected so the behaviour is\n * exercisable without driving a whole build: the alternative was a caller that\n * only a full `theokit build` could reach, which in practice means a caller\n * nothing tests.\n */\nexport function warnUnappliedConfig(\n  config: TheoConfig,\n  adapter: Pick<DeployAdapter, 'appliesConfig'>,\n  target: string,\n  log: (message: string) => void,\n): void {\n  const dropped = findUnappliedConfig(config, adapter)\n  if (dropped.length === 0) return\n  log(`\\n${describeUnappliedConfig(target, dropped)}\\n`)\n}\n\n/**\n * A declared rate limit the chosen target cannot enforce.\n *\n * Its own class so a caller can distinguish it from a configuration typo — this is not the build\n * failing to understand the file, it is the build understanding it and refusing the combination.\n */\nexport class UnenforceableRateLimitError extends Error {\n  override readonly name = 'UnenforceableRateLimitError'\n  constructor(readonly target: string) {\n    super(\n      [\n        `Refusing to build for \\`${target}\\`: theo.config.ts declares a rate limit and this target does not enforce one.`,\n        ``,\n        `  The config reads as protection the deploy will not have. Nothing at runtime reports the`,\n        `  absence, so the first sign is abuse — which is why this refuses rather than warns.`,\n        ``,\n        `  Two honest ways forward:`,\n        `    • build for \\`node\\` and run \\`theokit start\\`, which applies the limit; or`,\n        `    • remove \\`rateLimit\\` from theo.config.ts, so the file states what actually runs.`,\n        ``,\n        `  There is deliberately no flag to keep the key and skip the check: a config that stays`,\n        `  while doing nothing is the state this refusal exists to end (usetheokit/theokit#461).`,\n      ].join('\\n'),\n    )\n  }\n}\n\n/**\n * Refuse a build whose target drops a DECLARED rate limit.\n *\n * Only `rateLimit`, and the narrowness is the design. A dropped `cors` or `serialization` degrades\n * where someone can see it, and `describeUnappliedConfig`'s warning is proportionate for those.\n * `rateLimit` is the one whose absence looks exactly like success, which is the same reasoning\n * `MissingRoutePolicyError` applies to an undeclared route policy: refuse where silence would be\n * read as safety.\n *\n * `'runtime-not-emitted-here'` is not judged. That adapter's runtime is someone else's and this\n * build cannot answer for it; refusing there would be asserting something unmeasured.\n */\n/**\n * Refuse a target that cannot stream when the config says responses stream.\n *\n * Lives here rather than inside an adapter's `build()` because of WHEN it has to run. The refusal was\n * thrown from `buildAwsLambda`, which `runAdapterBuild` reaches a hundred lines after `cleanOutDir` has\n * emptied the output — so a project with `ssrStreaming: true` lost a working build to a refusal about\n * streaming. Measured 2026-09-28: 302 files in `.theokit/client/assets` before, 0 after (B-336).\n *\n * The alternatives are DERIVED from the registry rather than written into the sentence. A hardcoded\n * list was correct when it was written and nothing kept it correct, which is the same class of drift\n * `adapter-streaming-contract.test.ts` now pins.\n */\nexport function assertStreamingSupported(\n  config: Pick<TheoConfig, 'ssrStreaming'>,\n  adapter: Pick<DeployAdapter, 'streamsResponses' | 'streamingUnsupportedDetail'>,\n  target: string,\n  streamingTargets?: readonly string[],\n): void {\n  if (!config.ssrStreaming) return\n  if (adapter.streamsResponses === true) return\n\n  const detail =\n    adapter.streamingUnsupportedDetail === undefined ? '' : ` ${adapter.streamingUnsupportedDetail}`\n\n  // The alternatives are named only when the CALLER could know them. An adapter cannot: asking the\n  // registry from inside one closes `adapter -> config-support -> registry -> adapter`, and the Acyclic\n  // Dependencies Principle is not negotiable here (`rules/architecture.md`). So the CLI passes the list\n  // it already has, and a direct call to an adapter's build gets the same refusal without it.\n  const alternatives =\n    streamingTargets === undefined || streamingTargets.length === 0\n      ? ''\n      : ` Build a streaming target instead (${streamingTargets.join(', ')}), or set`\n  const orSet = alternatives === '' ? ' Set' : alternatives\n\n  throw new Error(\n    `[adapter-${target}] ssrStreaming is on, but the ${target} target does not stream responses.` +\n      `${detail}${orSet} ssrStreaming: false in theo.config.ts.`,\n  )\n}\n\nexport function assertRateLimitEnforceable(\n  config: TheoConfig,\n  adapter: Pick<DeployAdapter, 'enforcesRateLimit'>,\n  target: string,\n): void {\n  if (!isDeclared(config, 'rateLimit')) return\n\n  // B-257 — this reads `enforcesRateLimit`, NOT `appliesConfig`. They were one list until now, and\n  // `applied.includes('rateLimit')` returned before the throw, so adding that entry to silence the\n  // WARNING also switched off this REFUSAL — on a runtime where the limit still cannot hold.\n  //\n  // **An omitted field REFUSES.** The first cut defaulted to `'not-ours-to-judge'`, which inverted\n  // the rule it replaced: `appliesConfig ?? []` did not include `'rateLimit'`, so an adapter that\n  // declared nothing was refused; `?? 'not-ours-to-judge'` let it through. Measured on\n  // `static.ts`, which declares neither field and is registered at `registry.ts:28` — it went from\n  // refusing a declared limit to proceeding with a console warning. `:213-215` refuses exactly that\n  // outcome in its own words, and this member is on the EXPORTED `DeployAdapter`, so every\n  // third-party adapter inherited the inversion too.\n  //\n  // Abstaining is a CLAIM about somebody else's runtime, and a claim has to be made rather than\n  // inferred from silence.\n  const enforces = adapter.enforcesRateLimit ?? 'never'\n\n  // An adapter emitting no request handler is not judged. Its runtime is someone else's and this\n  // build cannot answer for it; refusing would assert something unmeasured. An ABSTAIN, and the\n  // reason it is not spelled `'never'`.\n  if (enforces === 'not-ours-to-judge') return\n\n  if (enforces === 'always') return\n\n  // `'never'`, and the default for an adapter that declared nothing. Refusing here is what the\n  // pre-B-257 rule did; reaching the store check below would let an undeclared adapter enforce by\n  // accident whenever a config happened to name one.\n  if (enforces === 'never') throw new UnenforceableRateLimitError(target)\n\n  // `'with-a-store'`: a per-invocation runtime enforces only when the config names a durable\n  // counter. Without one the in-process count dies with the invocation, and a limit that forgets is\n  // a limit that does not limit — the same class of failure as a shared bucket, by another road.\n  if (declaresRateLimitStore(config)) return\n\n  throw new UnenforceableRateLimitError(target)\n}\n\n/** Does the declared `rateLimit` name a store the emitted entry could construct? */\nfunction declaresRateLimitStore(config: TheoConfig): boolean {\n  const limit = (config as { rateLimit?: { store?: unknown } }).rateLimit\n  return typeof limit?.store === 'object' && limit.store !== null\n}\n"],"mappings":";;;;;;;;AAiCO,IAAM,kBAAkB;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAcA,SAAS,kBAAkB,SAAiC;AAC1D,QAAM,UAAU,YAAY;AAC5B,MAAI,YAAY,UAAa,YAAY,2BAA4B,QAAO;AAC5E,SAAO,CAAC,QAAQ,SAAS,OAAO;AAClC;AAGA,IAAM,aAA4C;AAAA,EAChD,WAAW;AAAA,EACX,MAAM;AAAA,EACN,MAAM;AAAA,EACN,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,SAAS;AAAA,EACT,iBAAiB;AACnB;AAEA,SAAS,WAAW,QAAoB,SAAiC;AACvE,QAAM,WAAW,OAAO;AACxB,UAAQ,SAAS;AAAA,IACf,KAAK;AACH,aAAO,OAAO,cAAc;AAAA,IAC9B,KAAK;AACH,aAAO,UAAU,SAAS;AAAA,IAC5B,KAAK;AAMH,aAAO,UAAU,SAAS,UAAa,SAAS,SAAS;AAAA,IAC3D,KAAK;AACH,aAAO,UAAU,eAAe,UAAa,SAAS,WAAW,OAAO,SAAS;AAAA,IACnF,KAAK;AACH,aAAO,UAAU,YAAY;AAAA,IAC/B,KAAK;AAKH,aAAO,OAAO,kBAAkB;AAAA,IAClC,KAAK;AACH,aAAO,OAAO,YAAY,UAAa,OAAO,QAAQ,SAAS;AAAA,EACnE;AACF;AAUO,SAAS,oBACd,QACA,SACiB;AACjB,QAAM,UAAU,QAAQ,iBAAiB,CAAC;AAC1C,MAAI,YAAY,2BAA4B,QAAO,CAAC;AACpD,SAAO,gBAAgB;AAAA,IACrB,CAAC,YAAY,WAAW,QAAQ,OAAO,KAAK,CAAC,QAAQ,SAAS,OAAO;AAAA,EACvE;AACF;AAMO,SAAS,wBAAwB,QAAgB,SAA2C;AACjG,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,QAAM,MAAM,QAAQ,WAAW;AAC/B,QAAM,OAAO,QAAQ,IAAI,CAAC,YAAY,WAAW,WAAW,OAAO,CAAC,EAAE,EAAE,KAAK,IAAI;AACjF,QAAM,YAAY,QAAQ,OAAO,CAAC,YAAY,CAAC,kBAAkB,OAAO,CAAC;AACzE,QAAM,UAAU,QAAQ,OAAO,iBAAiB;AAMhD,QAAM,UAAoB,CAAC;AAC3B,MAAI,UAAU,SAAS,KAAK,WAAW,QAAQ;AAC7C,YAAQ;AAAA,MACN,SAAS,UAAU,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA,MACvD,uBAAuB,UAAU,WAAW,IAAI,OAAO,MAAM,eAAe,UAAU,WAAW,IAAI,OAAO,MAAM;AAAA,IACpH;AAAA,EACF,WAAW,UAAU,SAAS,GAAG;AAC/B,YAAQ;AAAA,MACN,SAAS,UAAU,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,YAAY,UAAU,WAAW,IAAI,OAAO,MAAM;AAAA,IAC3G;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,GAAG;AACtB,YAAQ;AAAA,MACN,SAAS,QAAQ,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,kCAAkC,QAAQ,WAAW,IAAI,SAAS,OAAO;AAAA,MAC9H;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,OAAO,OAAO,QAAQ,MAAM,CAAC,kBAAkB,MAAM,WAAW,UAAU,mCAAmC,MAAM;AAAA,IACnH;AAAA,IACA,iDAAiD,MAAM,OAAO,MAAM;AAAA,IACpE,qBAAqB,MAAM,iBAAiB,eAAe;AAAA,IAC3D;AAAA,IACA,GAAG;AAAA,IACH;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAQO,SAAS,oBACd,QACA,SACA,QACA,KACM;AACN,QAAM,UAAU,oBAAoB,QAAQ,OAAO;AACnD,MAAI,QAAQ,WAAW,EAAG;AAC1B,MAAI;AAAA,EAAK,wBAAwB,QAAQ,OAAO,CAAC;AAAA,CAAI;AACvD;AAQO,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAErD,YAAqB,QAAgB;AACnC;AAAA,MACE;AAAA,QACE,2BAA2B,MAAM;AAAA,QACjC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI;AAAA,IACb;AAfmB;AAAA,EAgBrB;AAAA,EAhBqB;AAAA,EADH,OAAO;AAkB3B;AA0BO,SAAS,yBACd,QACA,SACA,QACA,kBACM;AACN,MAAI,CAAC,OAAO,aAAc;AAC1B,MAAI,QAAQ,qBAAqB,KAAM;AAEvC,QAAM,SACJ,QAAQ,+BAA+B,SAAY,KAAK,IAAI,QAAQ,0BAA0B;AAMhG,QAAM,eACJ,qBAAqB,UAAa,iBAAiB,WAAW,IAC1D,KACA,sCAAsC,iBAAiB,KAAK,IAAI,CAAC;AACvE,QAAM,QAAQ,iBAAiB,KAAK,SAAS;AAE7C,QAAM,IAAI;AAAA,IACR,YAAY,MAAM,iCAAiC,MAAM,qCACpD,MAAM,GAAG,KAAK;AAAA,EACrB;AACF;AAEO,SAAS,2BACd,QACA,SACA,QACM;AACN,MAAI,CAAC,WAAW,QAAQ,WAAW,EAAG;AAgBtC,QAAM,WAAW,QAAQ,qBAAqB;AAK9C,MAAI,aAAa,oBAAqB;AAEtC,MAAI,aAAa,SAAU;AAK3B,MAAI,aAAa,QAAS,OAAM,IAAI,4BAA4B,MAAM;AAKtE,MAAI,uBAAuB,MAAM,EAAG;AAEpC,QAAM,IAAI,4BAA4B,MAAM;AAC9C;AAGA,SAAS,uBAAuB,QAA6B;AAC3D,QAAM,QAAS,OAA+C;AAC9D,SAAO,OAAO,OAAO,UAAU,YAAY,MAAM,UAAU;AAC7D;","names":[]}

package/dist/{deno-deploy-IVACZ62D.js → deno-deploy-6H354VRA.js}

@@ -2,10 +2,10 @@
 import "tsx/esm";
 import {
   planDeployedPlugins
-} from "./chunk-V5SSTT3C.js";
+} from "./chunk-C43AHOHI.js";
 import {
   deployedEntryPreamble
-} from "./chunk-IB5VIXLR.js";
+} from "./chunk-XLFDYTWO.js";
 import {
   agentsDirLiteral,
   deployedAgentsFragment,
@@ -16,10 +16,10 @@ import {
   rateLimitCheckFragment,
   scannedFromLoaderCache,
   serverDirLiteral
-} from "./chunk-C5CAL3DX.js";
+} from "./chunk-EQJF2EH5.js";
 import {
   nodeAdapter
-} from "./chunk-G7U7FQVC.js";
+} from "./chunk-UFBBFP75.js";
 import "./chunk-WSMLSIS5.js";
 import {
   assertServicesUnsupported,
@@ -32,7 +32,13 @@ import { resolve } from "path";
 var FRAMEWORK_IMPORTS = [
   `// Use npm: specifier so Deno resolves theokit from the user's package.json`,
   `// equivalent (works in both local 'deno run' and Deno Deploy).`,
-  `import { scanServerRoutes, matchRoute, executeRoute, createProductionLoader, scanWebSocketRoutes, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler } from 'npm:theokit/server'`,
+  // Sub-paths, not the umbrella. `theokit/server` is DEPRECATED by the framework itself with a
+  // REMOVAL scheduled, so this entry would stop loading on that release, before a request exists —
+  // measured on Deno 2.9.5, where the warning printed on every start. This was the only adapter still
+  // on the umbrella; the split below is the mapping four siblings already use and Bun proves by
+  // running.
+  `import { scanServerRoutes, matchRoute, createProductionLoader, scanWebSocketRoutes } from 'npm:theokit/server/scan'`,
+  `import { executeRoute, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler } from 'npm:theokit/server/http'`,
   `import { createWebShim } from 'npm:theokit/adapters/web-shim'`,
   `import { buildSecurityHeaders, withSecurityHeaders } from 'npm:theokit/adapters/security-headers'`,
   `// T3.3 \u2014 WS bridge for Deno runtime`,
@@ -85,7 +91,7 @@ function renderDenoEntry(port, opts = {}) {
     // B-027 — `npm:`, like every other specifier this target emits (`:37-43`). A bare one does
     // not resolve on Deno Deploy, and the harness asserts the prefix is here before rewriting it.
     ...opts.rateLimit === void 0 ? [] : [
-      `import { createRateLimiterWeb } from 'npm:theokit/server'`,
+      `import { createRateLimiterWeb } from 'npm:theokit/server/rate-limit'`,
       `import { resolveClientIpFromRequest } from 'npm:theokit/server/rate-limit'`,
       ``
     ],
@@ -204,6 +210,10 @@ async function buildDeno(config, cwd, deps = {}, ctx) {
   );
 }
 var denoDeployAdapter = {
+  // Same as `bun`, plus the runtime compiles the TypeScript it finds — which is why a scan that
+  // answered `SyntaxError` on netlify is legitimate here. The last runtime scanner in the fleet.
+  readsSourceAtRunTime: true,
+  specifiersResolvedBy: "the-project-at-run-time",
   name: "deno-deploy",
   streamsResponses: true,
   // #409 / #410 — the generated entry calls `executeRoute` with routes, loader
@@ -228,4 +238,4 @@ export {
   denoDeployAdapter,
   renderDenoEntry
 };
-//# sourceMappingURL=deno-deploy-IVACZ62D.js.map
+//# sourceMappingURL=deno-deploy-6H354VRA.js.map

package/dist/deno-deploy-6H354VRA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapters/deno-deploy.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Deno Deploy adapter. Writes to `cwd/.theokit/deno-deploy/`. Build-time.\n */\nimport { mkdirSync, writeFileSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nimport type { TheoConfig } from '../config/schema.js'\nimport { assertServicesUnsupported, readManifest } from '../services/index.js'\n\nimport { deployedAgentsFragment, scannedFromLoaderCache } from './deployed-agents.js'\nimport { planDeployedPlugins } from './deployed-plugins-module.js'\nimport { deployedEntryPreamble } from './deployed-preamble.js'\nimport { deployedRateLimitFragment, rateLimitCheckFragment } from './deployed-rate-limit.js'\nimport {\n  agentsDirLiteral,\n  deployedRuntimeConfigFragment,\n  serverDirLiteral,\n} from './deployed-runtime-config.js'\nimport { deployedTraceFragment } from './deployed-trace.js'\nimport { nodeAdapter } from './node.js'\nimport { describeDeployedSecurityHeaders } from './security-headers.js'\nimport type { AdapterBuildContext, DeployAdapter, DeployedEntryOptions } from './types.js'\n\nexport interface DenoBuildDeps {\n  runNodeBuild?: (config: TheoConfig, cwd: string, ctx?: AdapterBuildContext) => Promise<void>\n  writeEntry?: (path: string, content: string) => void\n  ensureDir?: (path: string) => void\n}\n\n/**\n * The framework imports this entry opens with, as `npm:` specifiers.\n *\n * Extracted from `renderDenoEntry` when adding the configured-directory literal pushed it past the\n * per-function line budget. A cohesive block — every line is one import of the same package family\n * — so lifting it keeps the budget a signal about the renderer rather than about its preamble.\n */\nconst FRAMEWORK_IMPORTS: readonly string[] = [\n  `// Use npm: specifier so Deno resolves theokit from the user's package.json`,\n  `// equivalent (works in both local 'deno run' and Deno Deploy).`,\n  // Sub-paths, not the umbrella. `theokit/server` is DEPRECATED by the framework itself with a\n  // REMOVAL scheduled, so this entry would stop loading on that release, before a request exists —\n  // measured on Deno 2.9.5, where the warning printed on every start. This was the only adapter still\n  // on the umbrella; the split below is the mapping four siblings already use and Bun proves by\n  // running.\n  `import { scanServerRoutes, matchRoute, createProductionLoader, scanWebSocketRoutes } from 'npm:theokit/server/scan'`,\n  `import { executeRoute, extractTraceIdFromRequest, TRACE_HEADER, createCorsWebHandler } from 'npm:theokit/server/http'`,\n  `import { createWebShim } from 'npm:theokit/adapters/web-shim'`,\n  `import { buildSecurityHeaders, withSecurityHeaders } from 'npm:theokit/adapters/security-headers'`,\n  `// T3.3 — WS bridge for Deno runtime`,\n  `import { createDenoWsBridge } from 'npm:theokit/adapters/ws-shim'`,\n]\n\n/** The target's name, in the five places that spell it. Adding a sixth tripped the duplicate-literal gate. */\n/* The name in the places a gate does NOT read. `assertServicesUnsupported` keeps the literal:\n * `services-other-adapters-reject.test.ts:30` requires each adapter to name ITSELF there, so a\n * copy-paste carrying another adapter's name cannot hide behind a constant. */\nconst TARGET = 'deno-deploy'\n\nexport function renderDenoEntry(port: number, opts: DeployedEntryOptions = {}): string {\n  const runtimeConfig = deployedRuntimeConfigFragment(opts)\n  const agentsFragment = deployedAgentsFragment(scannedFromLoaderCache(agentsDirLiteral(opts)), {\n    notFound: 'notFound()',\n    importPrefix: 'npm:',\n    // B-185 — bound only when the runtime-config fragment declared the const, which is\n    // exactly when a plugins module was emitted. Referencing it otherwise would emit an\n    // identifier the entry never declares.\n    pluginRunnerExpr:\n      opts.runtimeConfigModule === undefined ? undefined : 'await THEO_PLUGIN_RUNNER',\n  })\n  return [\n    `// Generated by Theo — Deno Deploy Adapter`,\n    `// Deploy: deployctl deploy --project=<name> .theokit/deno/server.ts`,\n    `// Requires Deno >= 1.40 (Deno.serve + npm: specifier support)`,\n    ``,\n    `// Runtime guard`,\n    `if (typeof Deno === 'undefined') {`,\n    `  throw new Error('TheoDenoDeployAdapter must run inside Deno.')`,\n    `}`,\n    ``,\n    ...FRAMEWORK_IMPORTS,\n    ``,\n    `const port = Number(Deno.env.get('PORT') ?? '${port}')`,\n    `const cwd = Deno.cwd()`,\n    `const serverDir = cwd + '/' + ${serverDirLiteral(opts)}`,\n    `let routesCache = null`,\n    `let wsRoutesCache = null`,\n    `let loaderCache = null`,\n    ``,\n    `// #410 — the security baseline \\`theokit start\\` puts on every response,`,\n    `// carried here as a literal because the deployed isolate has no`,\n    `// theo.config.ts to read. Non-API paths 404 here and are served by Deno`,\n    `// Deploy's static asset handler, so this covers the API and not the`,\n    `// document (usetheokit/theokit#412).`,\n    ...deployedEntryPreamble(runtimeConfig, agentsFragment, opts, TARGET),\n    ``,\n    `function notFound() {`,\n    `  return new Response(JSON.stringify({ error: { code: 'NOT_FOUND' } }), {`,\n    `    status: 404,`,\n    `    headers: { 'Content-Type': 'application/json' },`,\n    `  })`,\n    `}`,\n    ``,\n    // B-027 — `npm:`, like every other specifier this target emits (`:37-43`). A bare one does\n    // not resolve on Deno Deploy, and the harness asserts the prefix is here before rewriting it.\n    ...(opts.rateLimit === undefined\n      ? []\n      : [\n          `import { createRateLimiterWeb } from 'npm:theokit/server/rate-limit'`,\n          `import { resolveClientIpFromRequest } from 'npm:theokit/server/rate-limit'`,\n          ``,\n        ]),\n    ...deployedRateLimitFragment(\n      opts.rateLimit,\n      TARGET,\n      // `info.remoteAddr` is the runtime's own answer. A `UnixAddr` has no `hostname`, so the\n      // optional chain is what keeps the read from throwing there rather than a guess.\n      `info?.remoteAddr?.hostname ?? resolveClientIpFromRequest(request, TRUST_PROXY)`,\n      'request, info',\n      // B-257 — `npm:`, like every other specifier this target emits. A bare one does not resolve\n      // on Deno Deploy, and the durable limiter's import is emitted by the fragment rather than\n      // here, so the prefix has to travel with it.\n      'npm:',\n    ),\n    ``,\n    // The serve handler's SECOND parameter is bound here for the first time: `Deno.serve` has\n    // always passed it and the emitted entry discarded it.\n    `Deno.serve({ port }, async (request, info) => {`,\n    `  // #409 — the preflight is answered BEFORE anything routes: an OPTIONS the router`,\n    `  // handles is an OPTIONS the browser never gets a CORS answer to.`,\n    `  const preflight = corsPreflight(request)`,\n    `  if (preflight !== null) return withSecurityHeaders(preflight, SECURITY_HEADERS)`,\n    ...rateLimitCheckFragment(opts.rateLimit, '  ', 'request, info'),\n    ``,\n    `  // LCR0103 — the upgrade branch sits BELOW the limiter, and the order is the point.`,\n    `  // It used to sit above, under the comment \"a 101 carries no document and no script,`,\n    `  // so the security baseline does not apply to it\". That is true of the security`,\n    `  // HEADERS — a document concern — and false of the limiter, which is a resource`,\n    `  // concern: a long-lived socket is the most expensive thing this entry hands out, so`,\n    `  // the upgrade is the path that most needs a budget, not the one that may skip it.`,\n    `  // T3.3 — Detect WebSocket upgrade and delegate to the Deno bridge.`,\n    `  // A 101 carries no document and no script, so the security baseline does`,\n    `  // not apply to it.`,\n    `  if (request.headers.get('upgrade')?.toLowerCase() === 'websocket') {`,\n    `    if (!wsRoutesCache) wsRoutesCache = scanWebSocketRoutes(serverDir)`,\n    `    if (wsRoutesCache.length === 0) return notFound()`,\n    `    const denoWs = createDenoWsBridge({`,\n    `      onOpen: () => {},`,\n    `      onMessage: (ws, data) => { ws.send(data) },`,\n    `      onClose: () => {},`,\n    `    }, Deno)`,\n    `    return denoWs.handle(request)`,\n    `  }`,\n    `  return withCors(request, withSecurityHeaders(await handleRequest(request), SECURITY_HEADERS))`,\n    `})`,\n    ``,\n    `async function handleRequest(request) {`,\n    `  const url = new URL(request.url)`,\n    ``,\n    `  if (!url.pathname.startsWith('/api/')${agentsFragment.hostBypass}) {`,\n    `    // Static + SPA fallback are served by Deno Deploy's static asset handler.`,\n    `    return notFound()`,\n    `  }`,\n    ``,\n    `  if (!routesCache) routesCache = scanServerRoutes(serverDir)`,\n    `  if (!loaderCache) loaderCache = createProductionLoader()`,\n    ``,\n    ...agentsFragment.branch,\n    ``,\n    `  const match = matchRoute(url.pathname, routesCache)`,\n    `  if (!match) return notFound()`,\n    ``,\n    `  const { req, res, toResponse } = createWebShim(request)`,\n    ...deployedTraceFragment('request', '  '),\n    `  const method = request.method.toUpperCase()`,\n    `  // #382 — not awaited: toResponse() settles at the headers and carries a`,\n    `  // live body, so Deno.serve streams while the handler writes.`,\n    `  return toResponse(executeRoute({ route: match.route, method, params: match.params, req, res, loadModule: loaderCache, serverDir, requestId, ...CSRF_CONFIG, ${runtimeConfig.executeRouteSpread} }))`,\n    `}`,\n    ``,\n    `console.log('Theo (Deno Deploy) listening on :' + port)`,\n  ].join('\\n')\n}\n\nexport async function buildDeno(\n  config: TheoConfig,\n  cwd: string,\n  deps: DenoBuildDeps = {},\n  ctx?: AdapterBuildContext,\n): Promise<void> {\n  // Wave 2 (T2.2) — reject polyglot services on this adapter.\n  assertServicesUnsupported('deno-deploy', readManifest(cwd))\n\n  const runNodeBuild = deps.runNodeBuild ?? nodeAdapter.build.bind(nodeAdapter)\n  await runNodeBuild(config, cwd, ctx)\n\n  const outputDir = resolve(cwd, '.theokit/deno')\n  const ensureDir = deps.ensureDir ?? ((p: string) => mkdirSync(p, { recursive: true }))\n  ensureDir(outputDir)\n\n  const pluginsPlan = planDeployedPlugins(config.plugins, denoDeployAdapter.name)\n  const entry = renderDenoEntry(config.port, {\n    securityHeaders: config.security?.headers,\n    csrf: config.security?.csrf,\n    disallowed: config.security?.disallowed,\n    cors: config.security?.cors,\n    // #425 — a selector, not a transformer, so it rides as a literal like the values above.\n    serialization: config.serialization,\n    // #425 — the ONE concern that is not a literal. A closure cannot be baked, so a plugin\n    // declared by module specifier is imported by the emitted module instead; a constructed one\n    // is refused by name at build time rather than dropped in silence.\n    runtimeConfigModule: pluginsPlan?.moduleSpecifier,\n    // #95 — the configured directories, which `build.ts:210` already threads into the Vite\n    // plugins. Without these two lines the literals above fall to their defaults and a project\n    // with a custom dir deploys an entry that resolves a directory it does not have.\n    serverDir: config.serverDir,\n    agentsDir: config.agentsDir,\n  })\n  const write =\n    deps.writeEntry ??\n    ((p, c) => {\n      writeFileSync(p, c)\n    })\n  if (pluginsPlan !== undefined) {\n    // Beside the entry, so the emitted import is a sibling. Written through the same seam as\n    // the entry so a test that captures one captures both (#425).\n    write(resolve(outputDir, 'theo.plugins.mjs'), pluginsPlan.source)\n  }\n  write(resolve(outputDir, 'server.ts'), entry)\n\n  // eslint-disable-next-line no-console -- CLI build progress\n  console.log('\\n  ✓ Deno Deploy output → .theokit/deno/server.ts')\n  // eslint-disable-next-line no-console -- CLI build progress\n  console.log(\n    `${describeDeployedSecurityHeaders({\n      target: TARGET,\n      securityHeaders: config.security?.headers,\n      mintsNonce: false,\n      documentHeaders: 'platform-unmanaged',\n    })}\\n`,\n  )\n}\n\nexport const denoDeployAdapter: DeployAdapter = {\n  // Same as `bun`, plus the runtime compiles the TypeScript it finds — which is why a scan that\n  // answered `SyntaxError` on netlify is legitimate here. The last runtime scanner in the fleet.\n  readsSourceAtRunTime: true,\n  specifiersResolvedBy: 'the-project-at-run-time',\n  name: 'deno-deploy',\n  streamsResponses: true,\n  // #409 / #410 — the generated entry calls `executeRoute` with routes, loader\n  // and serverDir only. CSRF, route policy, file middleware and Zod validation\n  // still run because they live inside `executeRoute`; none of the remaining\n  // configurable concerns reach it. Declared explicitly rather than omitted so\n  // the gap is a statement in the source and not an absence.\n  //\n  // `securityHeaders` IS applied -- to every response this isolate returns. The\n  // document comes from Deno Deploy's static asset handler and does not pass\n  // through it (usetheokit/theokit#412).\n  servesAgents: true,\n  appliesConfig: ['securityHeaders', 'csrf', 'disallowed', 'cors', 'serialization', 'plugins'],\n  // B-257 — per-invocation: an in-process counter does not survive, so a declared limit needs a durable store.\n  enforcesRateLimit: 'with-a-store',\n  build(config, cwd, ctx) {\n    return buildDeno(config, cwd, {}, ctx)\n  },\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGA,SAAS,WAAW,qBAAqB;AACzC,SAAS,eAAe;AAgCxB,IAAM,oBAAuC;AAAA,EAC3C;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAMA,IAAM,SAAS;AAER,SAAS,gBAAgB,MAAc,OAA6B,CAAC,GAAW;AACrF,QAAM,gBAAgB,8BAA8B,IAAI;AACxD,QAAM,iBAAiB,uBAAuB,uBAAuB,iBAAiB,IAAI,CAAC,GAAG;AAAA,IAC5F,UAAU;AAAA,IACV,cAAc;AAAA;AAAA;AAAA;AAAA,IAId,kBACE,KAAK,wBAAwB,SAAY,SAAY;AAAA,EACzD,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH;AAAA,IACA,gDAAgD,IAAI;AAAA,IACpD;AAAA,IACA,iCAAiC,iBAAiB,IAAI,CAAC;AAAA,IACvD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,sBAAsB,eAAe,gBAAgB,MAAM,MAAM;AAAA,IACpE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAAA;AAAA,IAGA,GAAI,KAAK,cAAc,SACnB,CAAC,IACD;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACJ,GAAG;AAAA,MACD,KAAK;AAAA,MACL;AAAA;AAAA;AAAA,MAGA;AAAA,MACA;AAAA;AAAA;AAAA;AAAA,MAIA;AAAA,IACF;AAAA,IACA;AAAA;AAAA;AAAA,IAGA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,uBAAuB,KAAK,WAAW,MAAM,eAAe;AAAA,IAC/D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,0CAA0C,eAAe,UAAU;AAAA,IACnE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,eAAe;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG,sBAAsB,WAAW,IAAI;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA,iKAAiK,cAAc,kBAAkB;AAAA,IACjM;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,eAAsB,UACpB,QACA,KACA,OAAsB,CAAC,GACvB,KACe;AAEf,4BAA0B,eAAe,aAAa,GAAG,CAAC;AAE1D,QAAM,eAAe,KAAK,gBAAgB,YAAY,MAAM,KAAK,WAAW;AAC5E,QAAM,aAAa,QAAQ,KAAK,GAAG;AAEnC,QAAM,YAAY,QAAQ,KAAK,eAAe;AAC9C,QAAM,YAAY,KAAK,cAAc,CAAC,MAAc,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AACpF,YAAU,SAAS;AAEnB,QAAM,cAAc,oBAAoB,OAAO,SAAS,kBAAkB,IAAI;AAC9E,QAAM,QAAQ,gBAAgB,OAAO,MAAM;AAAA,IACzC,iBAAiB,OAAO,UAAU;AAAA,IAClC,MAAM,OAAO,UAAU;AAAA,IACvB,YAAY,OAAO,UAAU;AAAA,IAC7B,MAAM,OAAO,UAAU;AAAA;AAAA,IAEvB,eAAe,OAAO;AAAA;AAAA;AAAA;AAAA,IAItB,qBAAqB,aAAa;AAAA;AAAA;AAAA;AAAA,IAIlC,WAAW,OAAO;AAAA,IAClB,WAAW,OAAO;AAAA,EACpB,CAAC;AACD,QAAM,QACJ,KAAK,eACJ,CAAC,GAAG,MAAM;AACT,kBAAc,GAAG,CAAC;AAAA,EACpB;AACF,MAAI,gBAAgB,QAAW;AAG7B,UAAM,QAAQ,WAAW,kBAAkB,GAAG,YAAY,MAAM;AAAA,EAClE;AACA,QAAM,QAAQ,WAAW,WAAW,GAAG,KAAK;AAG5C,UAAQ,IAAI,8DAAoD;AAEhE,UAAQ;AAAA,IACN,GAAG,gCAAgC;AAAA,MACjC,QAAQ;AAAA,MACR,iBAAiB,OAAO,UAAU;AAAA,MAClC,YAAY;AAAA,MACZ,iBAAiB;AAAA,IACnB,CAAC,CAAC;AAAA;AAAA,EACJ;AACF;AAEO,IAAM,oBAAmC;AAAA;AAAA;AAAA,EAG9C,sBAAsB;AAAA,EACtB,sBAAsB;AAAA,EACtB,MAAM;AAAA,EACN,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUlB,cAAc;AAAA,EACd,eAAe,CAAC,mBAAmB,QAAQ,cAAc,QAAQ,iBAAiB,SAAS;AAAA;AAAA,EAE3F,mBAAmB;AAAA,EACnB,MAAM,QAAQ,KAAK,KAAK;AACtB,WAAO,UAAU,QAAQ,KAAK,CAAC,GAAG,GAAG;AAAA,EACvC;AACF;","names":[]}