theokit 0.73.0 → 0.74.0

package/dist/chunk-4X43VTST.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapters/types.ts"],"sourcesContent":["import type { Plugin } from 'vite'\n\nimport type { TheoConfig } from '../config/schema.js'\nimport type { SecurityHeadersConfig } from '../core/contracts/security-headers.js'\n\nimport type { DeployedAgent } from './deployed-agents.js'\nimport type { DeployedCorsOptions } from './deployed-cors.js'\nimport type { DeployedCsrfOptions } from './deployed-csrf.js'\nimport type { DeployedRateLimitOptions } from './deployed-rate-limit.js'\nimport type {\n  DeployedAgentsDirOptions,\n  DeployedRuntimeConfigOptions,\n  DeployedServerDirOptions,\n} from './deployed-runtime-config.js'\n\n/**\n * Everything a filesystem deploy entry accepts.\n *\n * `vercel`, `aws-lambda` and `deno-deploy` declared this same six-member intersection, character\n * for character. Extracted after SonarCloud's duplication gate named it among the repeated blocks\n * on a pull request — the gate measuring something real, because a member added to the set had to\n * be added in three places or the targets would silently disagree about what they accept.\n *\n * `netlify` is deliberately NOT a user: it resolves `serverDir` as a literal `resolve(cwd, 'server')`\n * rather than from configuration, so it carries no `DeployedServerDirOptions`. Widening this type to\n * cover it would let netlify accept a `serverDir` it then ignores, which is the accepted-and-ignored\n * failure this framework refuses elsewhere. That netlify cannot take one is a separate gap, not a\n * reason to lie about the type.\n */\nexport type DeployedEntryOptions = {\n  securityHeaders?: SecurityHeadersConfig\n} & DeployedAgentsDirOptions &\n  DeployedCsrfOptions &\n  DeployedRuntimeConfigOptions &\n  DeployedServerDirOptions &\n  DeployedCorsOptions &\n  DeployedRateLimitOptions\n\n/**\n * Build context injected by the CLI into adapter.build.\n *\n * - `makeVitePlugins` — optional factory provided by CLI for adapters\n *   that drive `viteBuild()` directly (currently: `nodeAdapter`).\n *   When omitted, adapters that need Vite must fail with an actionable\n *   error. This inverts the previous direct edge `adapters → vite-plugin`\n *   per ADR-0001 v3 (T1.1 of the architecture-cleanup plan).\n *\n *   The factory MAY return a Promise — `theokit build` uses\n *   `theoPluginAsync` to wire the full Plugin[] chain (actions virtual\n *   module + typed client + services + @theokit/ui auto-chain) so adapters\n *   MUST `await` the result. See `cli/commands/build.ts` for the canonical\n *   invocation.\n */\n/** One server route, flattened to what an adapter can bake into an emitted entry (#369). */\nexport interface AdapterRoute {\n  /** Path relative to the project root — both the import specifier and the executor's lookup key. */\n  filePath: string\n  routePath: string\n  methods: readonly string[]\n}\n\nexport interface AdapterBuildContext {\n  /**\n   * `ssrStreaming` is here because the flag decides WHICH server entry the plugin emits, and\n   * without a field for it no caller could pass one. `vite-plugin/index.ts` reads\n   * `options.ssrStreaming === true`, so an absent field evaluated `undefined === true` forever:\n   * a project declaring `ssrStreaming: true` got the buffering entry, its server found no\n   * streaming renderer to call, and every response was the fully buffered document. Measured\n   * 2026-09-24 on a released build — TTFB tracked the slowest Suspense boundary (60ms delay ->\n   * 73ms, 800ms -> 815ms) with a single socket arrival. Same shape as `#95`, which added the\n   * three directories to this object for the same reason.\n   */\n  makeVitePlugins?: (opts: {\n    root: string\n    ssr?: boolean\n    ssrStreaming?: boolean\n  }) => Plugin[] | Promise<Plugin[]>\n  /**\n   * Scan the project's routes, INJECTED for the same reason `makeVitePlugins` is (#369).\n   *\n   * A Worker has no filesystem, so the Cloudflare entry has to bake its routes at build time\n   * instead of scanning for them at request time. Importing the scanner here would put an\n   * `adapters → server` edge in the graph — the layering inversion ADR-0001 v3 removed for\n   * `vite-plugin`, and the one `adapters-may-only-depend-on-core-router-services` refuses. The CLI\n   * already imports both sides, so it composes this and passes it in.\n   */\n  scanRoutes?: (serverDir: string) => {\n    routes: AdapterRoute[]\n    wsRoutes: string[]\n    /**\n     * The app's agents (#367). A different scan from the routes, served by a different function —\n     * which is precisely why no adapter had ever heard of them and every deployed\n     * `/api/agents/<name>` was a 404.\n     */\n    agents?: DeployedAgent[]\n    /**\n     * B-185 — the app's `server/context.ts`, project-relative, or `undefined` when it has none.\n     *\n     * A Worker has no filesystem on which to find it at request time, so a target that bakes its\n     * agents bakes this too (ADR 0014) and hands the factory to the subject resolver. Decided HERE,\n     * beside the agents, because this provider is the only place that holds `serverDir` — the same\n     * inversion argument the `agents` field above records for #367.\n     */\n    contextModule?: string\n  }\n}\n\n/**\n * A configuration key that a request handler applies at runtime. Build-time\n * keys are deliberately absent: a runtime cannot silently drop them.\n */\nexport type ConfigConcern =\n  | 'rateLimit'\n  | 'cors'\n  | 'csrf'\n  | 'disallowed'\n  | 'serialization'\n  | 'plugins'\n  | 'securityHeaders'\n\nexport interface DeployAdapter {\n  name: string\n  /**\n   * #382 — does the handler this adapter emits hand its runtime a response\n   * whose body is still being written?\n   *\n   * The claim is deliberately narrow, and it is the only part we can verify\n   * without a real deployment: `true` means the emitted contract carries a\n   * live body (a `Response` over a `ReadableStream`, or a chunk-by-chunk drain\n   * into the runtime's own writable) rather than a fully materialized string\n   * or buffer. It does NOT claim the platform was observed flushing early —\n   * that needs a deploy, and none of these targets has one in CI.\n   *\n   * Omitted means no, on purpose: a new adapter should have to state that it\n   * streams, because the failure mode of the opposite default is a target\n   * silently listed for something nobody exercised.\n   *\n   * `aws-lambda` is the one target that answers no by construction — its v2\n   * result object carries `body` as a string, so the response cannot exist\n   * before the run ends. Making it stream means `awslambda.streamifyResponse`\n   * plus a Function URL in `RESPONSE_STREAM` invoke mode, which this adapter\n   * does not emit and which would break every API Gateway deployment of it.\n   */\n  streamsResponses?: boolean\n  /**\n   * Which configuration keys the handler this adapter emits actually applies.\n   *\n   * Same contract as `streamsResponses`, for the same reason: omitted means\n   * **none**, on purpose. A new adapter should have to state what it honours,\n   * because the failure mode of the opposite default is a target that parses a\n   * rate limit, validates it, and refuses nothing — with no line anywhere\n   * saying so.\n   *\n   * `'runtime-not-emitted-here'` is a third answer, not a synonym for none: it\n   * belongs to an adapter that emits no request handler at all, so this build\n   * genuinely cannot say what the runtime applies. Reporting such a target as\n   * dropping configuration would be asserting rather than measuring.\n   *\n   * The declaration is a claim, and nothing here can verify it — a wrong claim\n   * reads exactly like a right one. What it buys is that dropping a concern\n   * becomes a visible edit instead of an omission.\n   */\n  /**\n   * #367 — can the handler this adapter emits serve an AGENT?\n   *\n   * Same contract as `streamsResponses` and `appliesConfig`, for the same reason: omitted means\n   * **no**, on purpose. The gap this answers went unnoticed because nothing in this layer had ever\n   * heard of agents — `grep -rc \"agent\"` over the 14 adapter files returned nothing — so an agent\n   * was served by no pipeline at all outside a machine running `theokit start`, in a framework\n   * whose stated reason to exist is that the agent ships through the same pipeline as the page.\n   *\n   * `true` claims the emitted entry routes `/api/agents/<name>` to `mountAgent`. It is a claim\n   * nothing here can verify, exactly like the other two; what it buys is that a target which drops\n   * agents has to say so rather than be silently assumed to serve them.\n   */\n  servesAgents?: boolean\n  appliesConfig?: readonly ConfigConcern[] | 'runtime-not-emitted-here'\n\n  /**\n   * B-257 — can the emitted entry ENFORCE a declared rate limit, and under what condition?\n   *\n   * Separate from `appliesConfig` because the two answer different questions and one list could not\n   * carry both. `findUnappliedConfig` reads the first to WARN; `assertRateLimitEnforceable` reads\n   * this one to REFUSE. Welded, adding `'rateLimit'` to stop a warning also satisfied\n   * `applied.includes('rateLimit')` and returned before the throw — switching the refusal off on a\n   * runtime where the limit still cannot hold. `config-support.ts:213-215` wrote that refusal\n   * because \"`rateLimit` is the one whose absence looks exactly like success\".\n   *\n   * `'always'`            a long-lived process; the in-process counter survives between requests.\n   * `'never'`             this adapter emits no request handler that could enforce anything. A\n   *                       TRUE claim, unlike the abstain below: nothing answers for a static\n   *                       export at runtime, so there is no other runtime to defer to.\n   * `'with-a-store'`      a per-invocation or per-isolate runtime. It enforces only when the config\n   *                       names a durable store, because an in-process counter there forgets, and a\n   *                       limit that forgets is a limit that does not limit.\n   * `'not-ours-to-judge'` this adapter emits no request handler OF ITS OWN, and another runtime\n   *                       answers for it. An ABSTAIN: `config-support.ts:105-108` calls that \"a\n   *                       different fact from saying no\", and refusing there would assert something\n   *                       unmeasured about somebody else's runtime.\n   *\n   * **Omitted REFUSES**, and it does not abstain. Abstaining is a claim about another runtime, and a\n   * claim is made rather than inferred from silence. The first cut defaulted to the abstain and\n   * inverted the rule it replaced: `appliesConfig ?? []` refused an adapter that declared nothing,\n   * while `?? 'not-ours-to-judge'` let it through. Measured on `static.ts`, which declares neither\n   * field and is registered — it went from refusing a declared limit to proceeding with a warning.\n   * This member is on the EXPORTED interface, so every third-party adapter inherited that inversion.\n   */\n  enforcesRateLimit?: 'always' | 'never' | 'with-a-store' | 'not-ours-to-judge'\n\n  /**\n   * Whether the deployed entry can read the project's SOURCE TREE while serving a request.\n   *\n   * The question behind four separate repairs, asked too late every time:\n   *\n   *     cloudflare   #369 / #367        routes and agents baked\n   *     vercel       B-319              routes baked\n   *     netlify      B-338              routes and agents baked\n   *     aws-lambda   B-344              routes and agents baked\n   *\n   * `false` means the entry MUST bake its routes and agents at build time. A runtime\n   * `scanServerRoutes` is a `readdirSync`, and where the artifact was uploaded alone there is nothing\n   * to read: measured on netlify and aws-lambda, every `/api/*` answered its own 404. Where a tree IS\n   * carried the route files are TypeScript, which a plain Node runtime cannot compile — the\n   * `SyntaxError: Unexpected token ')'` netlify answered with before B-338.\n   *\n   * `true` means the project directory is present at run time, so the scan is legitimate and cheaper\n   * than baking. `bun` and `deno-deploy` are the two, and `deno-deploy` can additionally compile the\n   * TypeScript it finds.\n   *\n   * **Omitted is neither answer**, and `a-deployed-entry-is-self-contained-where-it-must-be.test.ts`\n   * refuses it. This follows `enforcesRateLimit`'s own lesson one field up: its first cut defaulted to\n   * the permissive value and inverted the rule it replaced. A default of `true` would excuse a scan on\n   * a platform that cannot serve it; a default of `false` would demand baking from an adapter that\n   * has no reason to. Neither silence is safe, so silence is refused.\n   */\n  readsSourceAtRunTime?: boolean\n\n  /**\n   * Who makes the entry's bare specifiers resolvable.\n   *\n   * The entry imports `theokit/server/scan` and its siblings by bare specifier, and whether that\n   * breaks depends entirely on who resolves it afterwards — the table `docs/adr/0020` opens with:\n   *\n   * `'this-adapter'`             nobody else does, so the adapter bundles the entry itself through\n   *                              `bundleDeployedFunction`. Omitting the call ships source, and the\n   *                              platform answers\n   *                              `ERR_MODULE_NOT_FOUND: Cannot find package 'theokit'` — measured on\n   *                              vercel (B-316), netlify (B-339) and aws-lambda (B-342).\n   * `'the-platform'`             the platform's own bundler resolves at deploy time. `cloudflare`\n   *                              only: wrangler runs esbuild, validated live on 2026-09-26. Bundling\n   *                              twice would be work with no observable effect.\n   * `'the-project-at-run-time'`  the project's `node_modules` is present when the entry runs, so\n   *                              nothing has to be inlined. `bun` and `deno-deploy`.\n   *\n   * **Omitted is refused**, for the reason given on the field above: an entry whose specifiers nobody\n   * resolves does not fail late, it fails at import, and a silence that reads as one of the three\n   * answers would let that ship.\n   */\n  specifiersResolvedBy?: 'this-adapter' | 'the-platform' | 'the-project-at-run-time'\n  /**\n   * Why THIS target cannot stream, in the words its own maintainer would use.\n   *\n   * The refusal is computed centrally so it can run before anything is destroyed (B-336), and a central\n   * check cannot know that Lambda's v2 result object carries the body as a string or that\n   * `awslambda.streamifyResponse` is what would be needed. Declared here for the same reason\n   * `streamsResponses` is: the adapter is the only thing that knows.\n   *\n   * Read only when `streamsResponses` is not `true`. Absent is fine — the generic refusal still names\n   * the target, the config key and the alternatives.\n   */\n  streamingUnsupportedDetail?: string\n  build(config: TheoConfig, cwd: string, ctx?: AdapterBuildContext): Promise<void>\n}\n\nexport type BuildTarget =\n  | 'node'\n  | 'vercel'\n  | 'cloudflare'\n  | 'static'\n  | 'bun'\n  | 'deno-deploy'\n  | 'netlify'\n  | 'aws-lambda'\n  | 'theo-cloud'\n\n/**\n * Whether a target's emitted entry renders the HTML document on the server.\n *\n * The build printed `(SSR)` from `config.ssr` alone, so a target that delegates the document to a\n * static host was announced as server-rendering. Measured 2026-09-28 on a real project built with\n * `--target bun` and driven under Bun 1.3.14: the build said `✓ Build complete → bun (SSR)` and `GET /`\n * answered 531 bytes whose body was an empty `<div id=\"root\">`.\n *\n * This answers CAN the target render, not WILL it on this build — the config flag that turns rendering\n * on differs per target (`ssrStreaming` for Cloudflare, `ssr` for the rest), and each adapter already\n * knows its own. A caller wanting the second question asks both.\n *\n * Kept beside `VALID_TARGETS` rather than on `DeployAdapter`, because the CLI prints the note before\n * and after the adapter runs and never holds the emitted text. `check` in the test suite compares this\n * table against what each adapter's source actually reaches, in both directions, so it cannot drift\n * into describing a fleet that moved.\n */\nconst RENDERS_DOCUMENT: ReadonlySet<BuildTarget> = new Set<BuildTarget>([\n  'cloudflare',\n  'vercel',\n  'node',\n  'static',\n  'bun',\n])\n\nexport function targetRendersDocument(target: BuildTarget): boolean {\n  return RENDERS_DOCUMENT.has(target)\n}\n\nexport const VALID_TARGETS: BuildTarget[] = [\n  'node',\n  'vercel',\n  'cloudflare',\n  'static',\n  'bun',\n  'deno-deploy',\n  'netlify',\n  'aws-lambda',\n  'theo-cloud',\n]\n"],"mappings":";;;;AA8SA,IAAM,mBAA6C,oBAAI,IAAiB;AAAA,EACtE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAEM,SAAS,sBAAsB,QAA8B;AAClE,SAAO,iBAAiB,IAAI,MAAM;AACpC;AAEO,IAAM,gBAA+B;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;","names":[]}

package/dist/{chunk-FHQP23Z5.js → chunk-6R5F5YF2.js}

@@ -11,42 +11,45 @@ import { extname, join, relative } from "node:path";
 
 // src/server/scan/detect-agent-policy.ts
 import { createRequire } from "node:module";
-var require_ = createRequire(import.meta.url);
-var ts = require_("typescript");
+var compiler;
+function ts_() {
+  compiler ??= createRequire(import.meta.url)("typescript");
+  return compiler;
+}
 var POLICY_EXPORT = "policy";
 function hasExportModifier(modifiers) {
   if (!modifiers) return false;
   for (const m of modifiers) {
-    if (m.kind === ts.SyntaxKind.ExportKeyword) return true;
+    if (m.kind === ts_().SyntaxKind.ExportKeyword) return true;
   }
   return false;
 }
 function variableStatementDeclaresPolicy(stmt) {
-  if (!hasExportModifier(ts.getModifiers(stmt))) return false;
+  if (!hasExportModifier(ts_().getModifiers(stmt))) return false;
   return stmt.declarationList.declarations.some(
-    (decl) => ts.isIdentifier(decl.name) && decl.name.text === POLICY_EXPORT
+    (decl) => ts_().isIdentifier(decl.name) && decl.name.text === POLICY_EXPORT
   );
 }
 function exportDeclarationDeclaresPolicy(stmt) {
-  if (!stmt.exportClause || !ts.isNamedExports(stmt.exportClause)) return false;
+  if (!stmt.exportClause || !ts_().isNamedExports(stmt.exportClause)) return false;
   return stmt.exportClause.elements.some((spec) => spec.name.text === POLICY_EXPORT);
 }
 function functionDeclarationDeclaresPolicy(stmt) {
-  return hasExportModifier(ts.getModifiers(stmt)) && stmt.name?.text === POLICY_EXPORT;
+  return hasExportModifier(ts_().getModifiers(stmt)) && stmt.name?.text === POLICY_EXPORT;
 }
 function declaresAgentPolicy(filePath, content) {
-  const sourceFile = ts.createSourceFile(
+  const sourceFile = ts_().createSourceFile(
     filePath,
     content,
-    ts.ScriptTarget.Latest,
+    ts_().ScriptTarget.Latest,
     /* setParentNodes */
     false,
-    ts.ScriptKind.TS
+    ts_().ScriptKind.TS
   );
   for (const stmt of sourceFile.statements) {
-    if (ts.isVariableStatement(stmt) && variableStatementDeclaresPolicy(stmt)) return true;
-    if (ts.isExportDeclaration(stmt) && exportDeclarationDeclaresPolicy(stmt)) return true;
-    if (ts.isFunctionDeclaration(stmt) && functionDeclarationDeclaresPolicy(stmt)) return true;
+    if (ts_().isVariableStatement(stmt) && variableStatementDeclaresPolicy(stmt)) return true;
+    if (ts_().isExportDeclaration(stmt) && exportDeclarationDeclaresPolicy(stmt)) return true;
+    if (ts_().isFunctionDeclaration(stmt) && functionDeclarationDeclaresPolicy(stmt)) return true;
   }
   return false;
 }
@@ -281,4 +284,4 @@ export {
   createFileStampCache,
   scanAgents
 };
-//# sourceMappingURL=chunk-FHQP23Z5.js.map
+//# sourceMappingURL=chunk-6R5F5YF2.js.map

package/dist/chunk-6R5F5YF2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/scan/agent-scan.ts","../src/server/scan/detect-agent-policy.ts","../src/server/scan/errors.ts","../src/server/scan/file-stamp-cache.ts"],"mappings":";;;;;;;;AAIA,SAAS,YAAY,cAAc,YAAAA,iBAAgB;AACnD,SAAS,SAAS,MAAM,gBAAgB;;;ACuBxC,SAAS,qBAAqB;AAkB9B,IAAI;AAEJ,SAAS,MAAiB;AACxB,eAAa,cAAc,YAAY,GAAG,EAAE,YAAY;AACxD,SAAO;AACT;AAEA,IAAM,gBAAgB;AAEtB,SAAS,kBAAkB,WAAwD;AACjF,MAAI,CAAC,UAAW,QAAO;AACvB,aAAW,KAAK,WAAW;AACzB,QAAI,EAAE,SAAS,IAAI,EAAE,WAAW,cAAe,QAAO;AAAA,EACxD;AACA,SAAO;AACT;AAGA,SAAS,gCAAgC,MAAqC;AAC5E,MAAI,CAAC,kBAAkB,IAAI,EAAE,aAAa,IAAI,CAAC,EAAG,QAAO;AACzD,SAAO,KAAK,gBAAgB,aAAa;AAAA,IACvC,CAAC,SAAS,IAAI,EAAE,aAAa,KAAK,IAAI,KAAK,KAAK,KAAK,SAAS;AAAA,EAChE;AACF;AAGA,SAAS,gCAAgC,MAAqC;AAC5E,MAAI,CAAC,KAAK,gBAAgB,CAAC,IAAI,EAAE,eAAe,KAAK,YAAY,EAAG,QAAO;AAC3E,SAAO,KAAK,aAAa,SAAS,KAAK,CAAC,SAAS,KAAK,KAAK,SAAS,aAAa;AACnF;AAGA,SAAS,kCAAkC,MAAuC;AAChF,SAAO,kBAAkB,IAAI,EAAE,aAAa,IAAI,CAAC,KAAK,KAAK,MAAM,SAAS;AAC5E;AAQO,SAAS,oBAAoB,UAAkB,SAA0B;AAC9E,QAAM,aAAa,IAAI,EAAE;AAAA,IACvB;AAAA,IACA;AAAA,IACA,IAAI,EAAE,aAAa;AAAA;AAAA,IACE;AAAA,IACrB,IAAI,EAAE,WAAW;AAAA,EACnB;AACA,aAAW,QAAQ,WAAW,YAAY;AACxC,QAAI,IAAI,EAAE,oBAAoB,IAAI,KAAK,gCAAgC,IAAI,EAAG,QAAO;AACrF,QAAI,IAAI,EAAE,oBAAoB,IAAI,KAAK,gCAAgC,IAAI,EAAG,QAAO;AACrF,QAAI,IAAI,EAAE,sBAAsB,IAAI,KAAK,kCAAkC,IAAI,EAAG,QAAO;AAAA,EAC3F;AACA,SAAO;AACT;;;ACnFO,IAAM,6BAA6B;AAmBnC,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAC7B,OAAO;AAAA,EAChB;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAAoC;AAC9C,UAAM,eAAe,KAAK,gBAAgB;AAC1C,UAAM,UAAU;AAAA,MACd;AAAA,MACA;AAAA,MACA,WAAW,KAAK,IAAI;AAAA,MACpB,gCAAgC,KAAK,UAAU;AAAA,MAC/C;AAAA,MACA,oBAAoB,YAAY;AAAA,MAChC;AAAA,IACF,EAAE,KAAK,IAAI;AACX,UAAM,OAAO;AACb,SAAK,OAAO,KAAK;AACjB,SAAK,aAAa,KAAK;AACvB,SAAK,eAAe;AAAA,EACtB;AACF;AAUA,IAAM,mCAAmC;AA2BlC,IAAM,0BAAN,cAAsC,MAAM;AAAA,EAC/B,OAAO;AAAA,EAChB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAAsC;AAChD,UAAM,eAAe,KAAK,gBAAgB;AAC1C,UAAM,UAAU,CAAC,GAAG,KAAK,OAAO,EAAE,KAAK,iBAAiB;AACxD,UAAM,UAAU;AAAA,MACd;AAAA,MACA;AAAA,MACA,cAAc,KAAK,IAAI;AAAA,MACvB,cAAc,KAAK,SAAS;AAAA,MAC5B,cAAc,QAAQ,KAAK,IAAI,CAAC;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA;AAAA,MACA;AAAA,MACA,kBAAkB,QAAQ,CAAC,KAAK,KAAK;AAAA,MACrC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,kBAAkB,QAAQ,CAAC,KAAK,KAAK;AAAA,MACrC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,oBAAoB,YAAY;AAAA,IAClC,EAAE,KAAK,IAAI;AACX,UAAM,OAAO;AACb,SAAK,OAAO,KAAK;AACjB,SAAK,YAAY,KAAK;AACtB,SAAK,UAAU;AACf,SAAK,eAAe;AAAA,EACtB;AACF;AAOA,IAAM,mCAAmC;AAgClC,IAAM,0BAAN,cAAsC,MAAM;AAAA,EAC/B,OAAO;AAAA,EAChB;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAAsC;AAChD,UAAM,eAAe,KAAK,gBAAgB;AAC1C,UAAM,UAAU;AAAA,MACd;AAAA,MACA;AAAA,MACA,YAAY,KAAK,IAAI;AAAA,MACrB,YAAY,KAAK,SAAS;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,oBAAoB,YAAY;AAAA,IAClC,EAAE,KAAK,IAAI;AACX,UAAM,OAAO;AACb,SAAK,OAAO,KAAK;AACjB,SAAK,YAAY,KAAK;AACtB,SAAK,eAAe;AAAA,EACtB;AACF;AAiCO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAChC,OAAO;AAAA,EAChB;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAAuC;AACjD,UAAM,UAAU;AAAA,MACd;AAAA,MACA;AAAA,MACA,cAAc,KAAK,IAAI;AAAA,MACvB,cAAc,KAAK,gBAAgB;AAAA,MACnC,cAAc,KAAK,kBAAkB;AAAA,MACrC;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK,KAAK,UAAU;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,IAAI;AACX,UAAM,OAAO;AACb,SAAK,OAAO,KAAK;AACjB,SAAK,mBAAmB,KAAK;AAC7B,SAAK,aAAa,KAAK;AAAA,EACzB;AACF;;;ACpQA,SAAS,gBAAgB;AASlB,SAAS,uBAA6C;AAC3D,QAAM,UAAU,oBAAI,IAAe;AAEnC,SAAO;AAAA,IACL,IAAI,UAAU,SAAS;AAGrB,YAAM,OAAO,SAAS,QAAQ;AAC9B,YAAM,MAAM,GAAG,QAAQ,IAAI,OAAO,KAAK,OAAO,CAAC,IAAI,OAAO,KAAK,IAAI,CAAC;AAEpE,YAAM,MAAM,QAAQ,IAAI,GAAG;AAI3B,UAAI,QAAQ,UAAa,QAAQ,IAAI,GAAG,EAAG,QAAO;AAElD,YAAM,QAAQ,QAAQ;AACtB,cAAQ,IAAI,KAAK,KAAK;AACtB,aAAO;AAAA,IACT;AAAA,IACA,QAAQ;AACN,cAAQ,MAAM;AAAA,IAChB;AAAA,EACF;AACF;;;AH7CA,IAAM,mBAAmB,oBAAI,IAAI,CAAC,OAAO,QAAQ,OAAO,MAAM,CAAC;AAE/D,IAAM,YAAY;AAUlB,IAAM,mBAAmB,oBAAI,IAAI;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAyBD,IAAM,sBAAsB,oBAAI,IAAY;AAErC,SAAS,WAAW,aAAqB,YAAkC;AAChF,QAAM,gBAAgB,cAAc;AAGpC,QAAM,YAAY,KAAK,aAAa,aAAa;AACjD,MAAI,CAAC,WAAW,SAAS,KAAK,CAACC,UAAS,SAAS,EAAE,YAAY,GAAG;AAkBhE,QAAI,eAAe,UAAa,CAAC,oBAAoB,IAAI,SAAS,GAAG;AACnE,0BAAoB,IAAI,SAAS;AACjC,cAAQ;AAAA,QACN,uBAAuB,KAAK,UAAU,aAAa,CAAC,gBAAgB,KAAK,UAAU,SAAS,CAAC,gJAEvC,KAAK,UAAU,WAAW,CAAC;AAAA,MAEnF;AAAA,IACF;AACA,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAAuB,CAAC;AAC9B,kBAAgB,WAAW,EAAE,YAAY,iBAAiB,GAAG,CAAC,YAAY;AACxE,QAAI,MAAM,SAAS,WAAW,OAAO;AACrC,UAAM,IAAI,QAAQ,OAAO,GAAG;AAC5B,UAAM,IAAI,MAAM,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM;AACvC,QAAI,UAAU,KAAK,GAAG,EAAG;AAIzB,UAAM,OAAO,IAAI,MAAM,GAAG,EAAE,MAAM,GAAG,EAAE;AACvC,QAAI,KAAK,KAAK,CAAC,YAAY,iBAAiB,IAAI,OAAO,CAAC,EAAG;AAI3D,QAAI,IAAI,SAAS,QAAQ,EAAG,OAAM,IAAI,MAAM,GAAG,EAAE;AACjD,QAAI,QAAQ,WAAW,QAAQ,GAAI;AACnC,UAAM,YAAY,eAAe,GAAG;AACpC,8BAA0B,SAAS,SAAS;AAC5C,YAAQ,KAAK;AAAA,MACX,UAAU;AAAA,MACV;AAAA,MACA,MAAM;AAAA,IACR,CAAC;AAAA,EACH,CAAC;AACD,SAAO;AACT;AAUA,IAAM,yBAAyB,qBAA8B;AAoB7D,SAAS,0BAA0B,UAAkB,WAAyB;AAG5E,QAAM,WAAW,uBAAuB;AAAA,IAAI;AAAA,IAAU,MACpD,oBAAoB,UAAU,aAAa,UAAU,MAAM,CAAC;AAAA,EAC9D;AACA,MAAI,CAAC,SAAU,OAAM,IAAI,wBAAwB,EAAE,MAAM,UAAU,UAAU,CAAC;AAChF;","names":["statSync","statSync"]}

package/dist/chunk-72RSCKMW.js

@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+import "tsx/esm";
+
+// src/adapters/deployed-baked-routes.ts
+function renderBakedRoutes(routes) {
+  const routeVar = (index) => `__theoRoute${String(index)}`;
+  return {
+    routeImports: routes.map(
+      (route, index) => `import * as ${routeVar(index)} from '../../${route.filePath}'`
+    ),
+    routeModuleEntries: routes.map(
+      (route, index) => `  ${JSON.stringify(route.filePath)}: ${routeVar(index)},`
+    ),
+    routeTableEntries: routes.map(
+      (route) => `  { filePath: ${JSON.stringify(route.filePath)}, routePath: ${JSON.stringify(route.routePath)}, methods: ${JSON.stringify([...route.methods ?? []])}, ...compilePattern(${JSON.stringify(route.routePath)}) },`
+    )
+  };
+}
+function routeRuntimeLines(moduleEntries, tableEntries, target) {
+  return [
+    `// #369 / B-319 \u2014 the routes are baked at build time. This entry used to reach for`,
+    `// \`scanServerRoutes\` on the server directory \u2014 a readdirSync, on a platform that uploads`,
+    `// a bundle and no source tree. The pattern is recompiled here from the same routePath the`,
+    `// scanner used, so one function decides precedence on every target.`,
+    `const ROUTE_MODULES = {`,
+    ...moduleEntries,
+    `}`,
+    ``,
+    `const routes = [`,
+    ...tableEntries,
+    `]`,
+    ``,
+    `// The executor asks for a module by the path the table names. Anything else was`,
+    `// never bundled, and saying so beats returning undefined and failing later on a`,
+    `// property access far from the cause.`,
+    `async function loadModule(path) {`,
+    `  const mod = ROUTE_MODULES[path]`,
+    `  if (mod === undefined) {`,
+    // No backticks in this message: it is emitted INTO a template literal, and a stray one closes
+    // it. That is how #344 shipped a SyntaxError, and the emitted-entry parse gate caught it.
+    "  throw new Error(`Route module '${path}' was not bundled into this deployment. This target uploads only what the build bundled, so every route is imported at build time. Re-run: theokit build --target " + target + "`)",
+    `  }`,
+    `  return mod`,
+    `}`,
+    ``
+  ];
+}
+
+export {
+  renderBakedRoutes,
+  routeRuntimeLines
+};
+//# sourceMappingURL=chunk-72RSCKMW.js.map

package/dist/chunk-72RSCKMW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapters/deployed-baked-routes.ts"],"sourcesContent":["/** One route as the build scanner found it, and as both emitters below read it. */\nexport interface BakedRoute {\n  readonly filePath: string\n  readonly routePath: string\n  readonly methods?: readonly string[]\n}\n\n/**\n * The static imports, module map and route table a target gets INSTEAD of a directory scan.\n *\n * ## Why baked at all\n *\n * A platform that uploads a bundle and nothing else has no directory to read. `scanServerRoutes` is\n * a `readdirSync`, so on such a target it finds nothing and every route answers 404 — measured on\n * Cloudflare (#369) and again on Vercel (B-319), where `.vercel/output/functions/api.func/` holds\n * `index.mjs`, `.vc-config.json` and `assets/`, and no `src/`.\n *\n * The imports are STATIC because that is the only kind a bundler follows. A dynamic `import(path)`\n * built from a string is precisely what the platform cannot resolve, and it is what the runtime\n * loader did.\n *\n * ## Why shared rather than copied per adapter\n *\n * Two adapters need this and a third may. B-315 is what copies of one call look like after a while:\n * the same option threaded correctly by two adapters and forgotten by three, which cost a live\n * deploy per target to find. One emitter; the target only supplies what its own error message says.\n *\n * `../../` is the depth both callers write their entry at — `.theokit/cloudflare/worker.mjs` and\n * `.theokit/vercel/entry.mjs` — while `filePath` is relative to the project root.\n */\nexport function renderBakedRoutes(routes: readonly BakedRoute[]): {\n  routeImports: string[]\n  routeModuleEntries: string[]\n  routeTableEntries: string[]\n} {\n  const routeVar = (index: number): string => `__theoRoute${String(index)}`\n  return {\n    routeImports: routes.map(\n      (route, index) => `import * as ${routeVar(index)} from '../../${route.filePath}'`,\n    ),\n    routeModuleEntries: routes.map(\n      (route, index) => `  ${JSON.stringify(route.filePath)}: ${routeVar(index)},`,\n    ),\n    routeTableEntries: routes.map(\n      (route) =>\n        `  { filePath: ${JSON.stringify(route.filePath)}, routePath: ${JSON.stringify(route.routePath)}, ` +\n        `methods: ${JSON.stringify([...(route.methods ?? [])])}, ` +\n        `...compilePattern(${JSON.stringify(route.routePath)}) },`,\n    ),\n  }\n}\n\n/**\n * The route-resolution runtime, as lines of the emitted entry.\n *\n * A module map, the literal table, and a loader that refuses anything the build did not bake —\n * fail-clear per `rules/error-handling.md`, because returning `undefined` here surfaces as a\n * property access far from the cause.\n *\n * `target` appears only in that refusal, so the message names the build command that fixes it. A\n * Vercel operator told to re-run `--target cloudflare` has been sent to the wrong place.\n */\nexport function routeRuntimeLines(\n  moduleEntries: string[],\n  tableEntries: string[],\n  target: string,\n): string[] {\n  return [\n    `// #369 / B-319 — the routes are baked at build time. This entry used to reach for`,\n    `// \\`scanServerRoutes\\` on the server directory — a readdirSync, on a platform that uploads`,\n    `// a bundle and no source tree. The pattern is recompiled here from the same routePath the`,\n    `// scanner used, so one function decides precedence on every target.`,\n    `const ROUTE_MODULES = {`,\n    ...moduleEntries,\n    `}`,\n    ``,\n    `const routes = [`,\n    ...tableEntries,\n    `]`,\n    ``,\n    `// The executor asks for a module by the path the table names. Anything else was`,\n    `// never bundled, and saying so beats returning undefined and failing later on a`,\n    `// property access far from the cause.`,\n    `async function loadModule(path) {`,\n    `  const mod = ROUTE_MODULES[path]`,\n    `  if (mod === undefined) {`,\n    // No backticks in this message: it is emitted INTO a template literal, and a stray one closes\n    // it. That is how #344 shipped a SyntaxError, and the emitted-entry parse gate caught it.\n    \"  throw new Error(`Route module '\" +\n      '${path}' +\n      \"' was not bundled into this deployment. \" +\n      'This target uploads only what the build bundled, so every route is imported at build time. ' +\n      'Re-run: theokit build --target ' +\n      target +\n      '`)',\n    `  }`,\n    `  return mod`,\n    `}`,\n    ``,\n  ]\n}\n"],"mappings":";;;;AA8BO,SAAS,kBAAkB,QAIhC;AACA,QAAM,WAAW,CAAC,UAA0B,cAAc,OAAO,KAAK,CAAC;AACvE,SAAO;AAAA,IACL,cAAc,OAAO;AAAA,MACnB,CAAC,OAAO,UAAU,eAAe,SAAS,KAAK,CAAC,gBAAgB,MAAM,QAAQ;AAAA,IAChF;AAAA,IACA,oBAAoB,OAAO;AAAA,MACzB,CAAC,OAAO,UAAU,KAAK,KAAK,UAAU,MAAM,QAAQ,CAAC,KAAK,SAAS,KAAK,CAAC;AAAA,IAC3E;AAAA,IACA,mBAAmB,OAAO;AAAA,MACxB,CAAC,UACC,iBAAiB,KAAK,UAAU,MAAM,QAAQ,CAAC,gBAAgB,KAAK,UAAU,MAAM,SAAS,CAAC,cAClF,KAAK,UAAU,CAAC,GAAI,MAAM,WAAW,CAAC,CAAE,CAAC,CAAC,uBACjC,KAAK,UAAU,MAAM,SAAS,CAAC;AAAA,IACxD;AAAA,EACF;AACF;AAYO,SAAS,kBACd,eACA,cACA,QACU;AACV,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAAA;AAAA,IAGA,+MAKE,SACA;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-SEGD3JUC.js → chunk-EQJF2EH5.js}

@@ -27,9 +27,10 @@ function deployedAgentsFragment(source, host = {}) {
   if (source === void 0) return EMPTY;
   if (source.kind === "baked" && source.agents.length === 0) return EMPTY;
   const pathname = host.pathname ?? "url.pathname";
+  const baseUrl = host.baseUrl ?? "url.origin";
   const notFound = host.notFound ?? "notFoundResponse()";
   const prefix = host.importPrefix ?? "";
-  const resolution = source.kind === "baked" ? bakedResolution(source.agents, source.contextModule, host.pluginRunnerExpr) : scannedResolution({ ...source, pluginRunnerExpr: host.pluginRunnerExpr });
+  const resolution = source.kind === "baked" ? bakedResolution(source.agents, source.contextModule, host.pluginRunnerExpr, baseUrl) : scannedResolution({ ...source, pluginRunnerExpr: host.pluginRunnerExpr, baseUrl });
   return {
     hostBypass: ` && !__theoIsAgentCardPath(${pathname})`,
     imports: [
@@ -123,7 +124,7 @@ function deployedAgentsFragment(source, host = {}) {
     ]
   };
 }
-function bakedResolution(agents, contextModule, pluginRunnerExpr) {
+function bakedResolution(agents, contextModule, pluginRunnerExpr, baseUrl) {
   const varOf = (index) => `__theoAgent${String(index)}`;
   return {
     imports: [
@@ -214,7 +215,7 @@ function bakedResolution(agents, contextModule, pluginRunnerExpr) {
       `          const node = agentNodes.find((a) => a.filePath === filePath)`,
       `          return node === undefined ? undefined : agents[node.name]`,
       `        },`,
-      `        baseUrl: url.origin,`,
+      `        baseUrl: ${baseUrl},`,
       ...AUX_DEPS_PARITY,
       `      }`
     ]
@@ -257,7 +258,7 @@ function scannedResolution(source) {
       `      const auxDeps = {`,
       `        agents: agentsCache,`,
       `        loadModule: ${source.loadModule},`,
-      `        baseUrl: url.origin,`,
+      `        baseUrl: ${source.baseUrl},`,
       ...AUX_DEPS_PARITY,
       `      }`
     ]
@@ -674,7 +675,7 @@ function deployedRuntimeConfigFragment(options) {
   const spread = [];
   if (pluginsModule !== void 0) {
     imports.push(
-      `import { createPluginRunnerFromConfig } from 'theokit/server'`,
+      `import { createPluginRunnerFromConfig } from 'theokit/server/plugins'`,
       `// #425 \u2014 the app's own plugins, resolved on the build machine and written beside this entry.`,
       `// A closure has no literal, so this is an import rather than a baked value.`,
       `import theoRuntimeConfig from '${pluginsModule}'`
@@ -687,7 +688,7 @@ function deployedRuntimeConfigFragment(options) {
     spread.push(`pluginRunner: await THEO_PLUGIN_RUNNER`);
   }
   if (serialization !== void 0) {
-    imports.push(`import { resolveTransformer } from 'theokit/server'`);
+    imports.push(`import { resolveTransformer } from 'theokit/server/http'`);
     declarations.push(
       `// #425 \u2014 a literal, because \`config.serialization\` is a SELECTOR and not a transformer.`,
       `// Same string, same function \`theokit start\` calls, so the deployed response and the local`,
@@ -727,4 +728,4 @@ export {
   deployedRuntimeConfigFragment,
   deployedTraceFragment
 };
-//# sourceMappingURL=chunk-SEGD3JUC.js.map
+//# sourceMappingURL=chunk-EQJF2EH5.js.map

package/dist/chunk-EQJF2EH5.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapters/deployed-agents.ts","../src/adapters/deployed-cors.ts","../src/adapters/deployed-csrf.ts","../src/adapters/security-headers.ts","../src/adapters/deployed-rate-limit.ts","../src/adapters/deployed-runtime-config.ts","../src/adapters/deployed-trace.ts"],"sourcesContent":["/**\n * Serving an agent from a generated deploy entry (usetheokit/theokit#367).\n *\n * ## The gap this closes\n *\n * `grep -rc \"agent\" packages/theo/src/adapters/*.ts` used to return nothing across 14 files. The\n * notion did not exist in this layer at all: every generated entry routes `/api/` exclusively\n * through `scanServerRoutes` + `executeRoute`, and an agent is a DIFFERENT scan served by a\n * DIFFERENT function — `scanAgents` + `mountAgent`. So `/api/agents/chat` matched no file route and\n * fell into `notFoundResponse()` on every target.\n *\n * For a framework whose stated reason to exist is \"the agent is a file, delivered by the same\n * pipeline that serves the page\", that is the gap which contradicts the sentence: the agent was\n * delivered by no pipeline at all outside a machine running `theokit start`.\n *\n * ## Why baking, and why `../../`\n *\n * A Worker has no filesystem to scan and no path to `import()`, which is the same reason routes are\n * baked (#369). The agent modules are resolved on the build machine and emitted as static imports,\n * relative to the entry's directory — every target that can do this writes two levels below the\n * project root, so the arithmetic is the one `renderBakedRoutes` already does.\n *\n * ## Which targets can do it\n *\n * Only the ones whose output is BUNDLED from the project: `cloudflare` (wrangler), `bun` and\n * `deno-deploy` resolve the emitted import against the app's own source tree. `vercel`, `netlify`\n * and `aws-lambda` receive a standalone function directory that never sees the app's modules, so\n * an agent cannot travel there by this road at all. Same split as plugins (#425), same cause.\n *\n * ## The table is keyed by NAME\n *\n * The URL carries the name, the access policy is judged under the name, and the run's spans are\n * labelled with it (#406). Keying by file path would make the lookup depend on the server's\n * directory layout — which changes per deploy, and which is exactly the value #406 removed from\n * telemetry for the same reason.\n */\n\n/** One agent, as `scanAgents` reports it. Structural, so the adapters need no `server/` import. */\nexport interface DeployedAgent {\n  /** Path relative to the project root — the specifier the static import uses. */\n  readonly filePath: string\n  /** The URL the agent answers on. */\n  readonly agentPath: string\n  /** The agent's NAME — what the URL carries, the policy is judged under, and spans are labelled. */\n  readonly name: string\n}\n\nexport interface DeployedAgentsFragment {\n  /** Top-level imports of the agent modules. */\n  readonly imports: string[]\n  /** Module-scope declarations — the name→module table. */\n  readonly declarations: string[]\n  /** The request-handler branch, to be emitted before the file-route table is consulted. */\n  readonly branch: string[]\n  /**\n   * SI-020 — the condition a host ANDs into its non-API early-return guard, so an agent card path\n   * is not handed to static assets before this fragment's branch is reached.\n   *\n   * Empty string when the fragment emits nothing, so a host that interpolates it unconditionally\n   * never references a name that was not declared.\n   */\n  readonly hostBypass: string\n}\n\nconst EMPTY: DeployedAgentsFragment = { imports: [], declarations: [], branch: [], hostBypass: '' }\n\n/**\n * How the host entry names the things this branch has to use.\n *\n * The fragment is generated code injected into three entries that do NOT agree on their own\n * vocabulary — Bun reads `pathname`, Cloudflare reads `url.pathname`; Deno calls `notFound()`,\n * Cloudflare calls `notFoundResponse()`; Cloudflare wraps each branch in the security baseline\n * while Bun and Deno wrap once at the caller; Deno resolves npm packages with an `npm:` prefix.\n *\n * Naming those differences is what keeps this ONE fragment. The alternative — three near-identical\n * branches, one per adapter — is the copy that `serveThroughPluginLifecycle` was extracted to undo\n * after it had drifted five ways (#405).\n */\n/**\n * How the target REACHES its agent modules — and the two answers are genuinely different, not a\n * copy waiting to be merged.\n *\n * A Worker has no filesystem: its agents must be resolved on the build machine and emitted as\n * static imports, which is what `renderBakedRoutes` already does for routes there. Bun and Deno DO\n * have a filesystem and already scan their routes at request time; making them bake would couple an\n * agent's existence to a rebuild for no gain. The split mirrors the one routes already have on\n * exactly these targets, which is the argument for keeping it.\n */\nexport type DeployedAgentsSource =\n  | {\n      readonly kind: 'baked'\n      /** Scanned on the build machine, emitted as static imports. */\n      readonly agents: readonly DeployedAgent[]\n      /**\n       * B-185 — the app's `server/context.ts`, as a specifier relative to the emitted entry, or\n       * `undefined` when the app has none. A Worker has no filesystem on which to find it, so it is\n       * baked like the agent modules beside it (ADR 0014). `undefined` is the ordinary case for an\n       * app that declares no context, and emitting an import of a file that is not there would\n       * fail the BUILD rather than the request — which is why `planDeployedPlugins` takes the same\n       * road for plugins.\n       */\n      readonly contextModule?: string\n    }\n  | {\n      readonly kind: 'scan'\n      /** Expression yielding the project root at runtime. */\n      readonly projectRoot: string\n      /** Expression yielding the module loader the entry already builds. */\n      readonly loadModule: string\n      /**\n       * A statement that guarantees `loadModule` is usable, for a host that builds its loader\n       * lazily. Deno's `loaderCache` is created on the route path, which runs AFTER this branch —\n       * so without this the agent branch would call `null`.\n       */\n      readonly ensureLoader?: string\n      /** The configured agents directory as a quoted literal. Absent ⇒ `scanAgents` defaults to `agents`. */\n      readonly agentsDirLiteral?: string\n      /**\n       * B-185 — an expression yielding the app's `server/` directory, which this host already\n       * declares (`bun.ts:95`, `deno-deploy.ts:69`) and already hands to `executeRoute`. A host\n       * with a filesystem locates its own `context.ts`, so it needs no baking (ADR 0014, and the\n       * split `deployed-agents.ts` already argues for routes two docblocks above).\n       */\n      readonly serverDir?: string\n    }\n\nexport interface DeployedAgentsHost {\n  /** Expression yielding the request path inside the handler. Default `url.pathname`. */\n  readonly pathname?: string\n  /**\n   * Expression yielding the request's origin inside the handler. Default `url.origin`.\n   *\n   * The default is an implicit contract on the HOST: it must declare a `URL` object named `url`, in\n   * the same scope the fragment lands in. `vercel` and `netlify` satisfy it — `aws-lambda` did not,\n   * and the two ways it failed are worth naming because a host author hits one or the other:\n   *\n   *   - **scope** — its `url` lives in `eventV2ToRequest`, and the fragment lands in `routeRequest`\n   *   - **type**  — its `url` is a STRING (`'https://' + host + path`), so `.origin` is `undefined`\n   *\n   * Measured 2026-09-29 on a real deployed Function URL: `/api/health` answered 200 and\n   * `/api/agents/chat` answered 502, with `ReferenceError: url is not defined at routeRequest`.\n   * Parameterising it makes the requirement a signature rather than a convention — the same move\n   * `pathname` above already made for the other half of the same expression.\n   */\n  readonly baseUrl?: string\n  /** Call producing the 404 response. Default `notFoundResponse()`. */\n  readonly notFound?: string\n  /** Whether THIS branch applies the security baseline, or the caller already does. */\n  readonly wrapSecurityHeaders?: boolean\n  /** Prefix for bare package specifiers. Deno needs `npm:`; the others need nothing. */\n  readonly importPrefix?: string\n  /**\n   * Expression yielding the entry's plugin runner, or `undefined` when the app declared no plugins\n   * and the build emitted no module to bind.\n   *\n   * `deployedRuntimeConfigFragment` already declares `const THEO_PLUGIN_RUNNER` at module scope and\n   * spreads `pluginRunner: await THEO_PLUGIN_RUNNER` into `executeRoute`; an adapter passes that\n   * same expression here rather than building a second runner, because a runner rebuilt per request\n   * re-runs every plugin's `register` -- which is where a plugin allocates the state its hooks read.\n   */\n  readonly pluginRunnerExpr?: string\n}\n\n/**\n * The two `AuxRouteDeps` fields a deployed entry must supply to match what dev already does.\n *\n * Both dev callers pass them — `vite-plugin/agent-middleware.ts:161,164` and\n * `cli/commands/start/handlers.ts:226,229` — and a first draft of this fragment passed neither,\n * on a quotation from `serve-aux-routes.ts:83-85` that names three routes (\"card, approvals,\n * stream\") while the dispatcher serves six. Two reviewers measured the same two consequences:\n *\n * - `csrfMode` unset defaults to `'strict'` (`serve-aux-routes.ts:379`), so an app declaring\n *   `security: { csrf: 'off' }` got `off` on `POST /api/agents/<name>` and `strict` on its `/mcp`\n *   sibling one line away — verbatim the divergence `deployed-csrf.ts`'s own header exists to\n *   record, re-created on a route this slice had just made reachable.\n * - `resolveApiKey` unset makes the thread follow-up answer a permanent 501 on every deploy\n *   target (`serve-aux-routes.ts:359-365`), naming a framework-internal parameter to the caller.\n *\n * Both values are already in scope: `CSRF_CONFIG` is spread into `mountAgent` in the same emitted\n * function, and `resolveProvider` is already on its import line.\n */\nconst AUX_DEPS_PARITY = [\n  `        ...CSRF_CONFIG,`,\n  `        resolveApiKey: (model, plugins) => resolveProvider(model, { plugins }).apiKey,`,\n] as const\n\n/** The prefix the agent convention owns. Matches `handlers.ts`'s own `tryServeAgent`. */\nconst AGENT_PREFIX = '/api/agents/'\n\n/**\n * The second shape the aux dispatcher owns. `matchGetAuxRoute` serves M15's\n * `GET /.well-known/<name>/agent-card.json`, and a guard admitting only {@link AGENT_PREFIX} left\n * five of the dispatcher's six families reachable on a deploy target and excluded the sixth — by\n * the guard, not by a decision, and silently.\n *\n * A prefix rather than the matcher's own `isAgentCardPath`: the guard exists to keep a url nobody\n * answers from paying for anything, and importing the matcher's predicate into every emitted entry\n * would buy a narrower pre-filter at the cost of a module the branch already declines without.\n */\nconst WELL_KNOWN_PREFIX = '/.well-known/'\n\n/**\n * What a deployed entry needs in order to serve the app's agents.\n *\n * @param agents - the agents scanned on the build machine. Empty emits nothing at all.\n */\n/**\n * The scan source every filesystem host with a lazily-created loader shares.\n *\n * Four adapters — `netlify`, `vercel`, `aws-lambda`, `deno-deploy` — emit an entry that resolves\n * `serverDir` itself, caches its loader in `loaderCache`, and creates that cache on first use.\n * They therefore hand this fragment the SAME six fields, and writing them out four times is the\n * copy `serveThroughPluginLifecycle` was extracted to undo after it had drifted five ways (#405).\n *\n * B-235 is what made it four: wiring three more targets duplicated the block three more times, and\n * the duplication gate on new code is what said so — 4.2% against a 3% ceiling. The gate was right\n * and the fix is the one it implies, not a threshold.\n *\n * `bun` is deliberately NOT a caller. It names its loader `loadModule` and creates it eagerly, so\n * it has no `ensureLoader` — a parameter to cover that difference would make this function a\n * switch over its callers, which is the shape that drifts.\n */\nexport function scannedFromLoaderCache(agentsDirLiteral?: string): DeployedAgentsSource {\n  return {\n    kind: 'scan',\n    projectRoot: 'cwd',\n    agentsDirLiteral,\n    loadModule: 'loaderCache',\n    serverDir: 'serverDir',\n    ensureLoader: 'if (!loaderCache) loaderCache = createProductionLoader()',\n  }\n}\n\n/**\n * The JSON 404 `vercel` and `aws-lambda` answer a routing miss with.\n *\n * An expression rather than a call, because the fragment interpolates `notFound` into a `return`\n * and neither host declares a helper for it.\n */\nexport const JSON_NOT_FOUND_RESPONSE = `new Response(JSON.stringify({ error: { code: 'NOT_FOUND' } }), { status: 404, headers: { 'content-type': 'application/json' } })`\n\nexport function deployedAgentsFragment(\n  source: DeployedAgentsSource | undefined,\n  host: DeployedAgentsHost = {},\n): DeployedAgentsFragment {\n  if (source === undefined) return EMPTY\n  if (source.kind === 'baked' && source.agents.length === 0) return EMPTY\n\n  const pathname = host.pathname ?? 'url.pathname'\n  const baseUrl = host.baseUrl ?? 'url.origin'\n  const notFound = host.notFound ?? 'notFoundResponse()'\n  const prefix = host.importPrefix ?? ''\n\n  const resolution =\n    source.kind === 'baked'\n      ? bakedResolution(source.agents, source.contextModule, host.pluginRunnerExpr, baseUrl)\n      : scannedResolution({ ...source, pluginRunnerExpr: host.pluginRunnerExpr, baseUrl })\n\n  return {\n    hostBypass: ` && !__theoIsAgentCardPath(${pathname})`,\n    imports: [\n      // `theokit/adapters/agent-mount`, not `theokit/server`: `mount-agent` is deliberately not on\n      // the app-facing surface (ADR 0041), and a generated entry is not an app. See that module.\n      // B-185 — the identity entry differs by host: a filesystem host LOCATES its own\n      // `context.ts`, a Worker is handed the baked factory (ADR 0014). `createWebShim` is not here\n      // because all three entries already import it at module level.\n      `import { mountAgent, resolveProvider, matchAgentAuxRoute, serveMatchedAuxRoute${resolution.identityImport}${source.kind === 'scan' ? ', scanAgents' : ''} } from '${prefix}theokit/adapters/agent-mount'`,\n      ...resolution.imports,\n    ],\n    declarations: [\n      ...resolution.declarations,\n      // SI-020 — the host's `/api/` guard decides between the API surface and static assets, and it\n      // runs BEFORE this branch. Widening the branch guard alone left the `.well-known` arm as dead\n      // code on all three targets: present in the source, unreachable in the emitted program. The\n      // host consults this predicate, so the card path escapes the asset branch and NOTHING else\n      // under `/.well-known/` does — a blanket prefix bypass would route `/.well-known/security.txt`\n      // away from assets, trading an unreachable card for a broken namespace.\n      //\n      // Same shape as `agent-card-handler.ts`'s own WELL_KNOWN. That is a COPY, not a shared\n      // definition, and saying otherwise was the claim an inventory judge falsified: changing the\n      // handler to serve `/agent.json` left every card test green, because this guard and that\n      // matcher are checked separately and never against each other. The drift that matters here —\n      // this guard narrowing while the matcher still serves the path — is caught by\n      // `a-deployed-worker-reaches-the-agent-card.test.ts`, which drives a real request. The other\n      // direction is not, and is the honest limit of this line.\n      String.raw`const __theoIsAgentCardPath = (p) => /^\\/\\.well-known\\/[^/]+\\/agent-card\\.json$/.test(p)`,\n      // B-185 — one factory, two call sites: the aux branch on a hit, and the run handler below.\n      // Declared rather than inlined twice so the mechanism ADR 0014 decides has a single home.\n      // `async` because the entry's plugin runner is a promise: `createPluginRunnerFromConfig` is\n      // async, so the runtime-config fragment declares `const THEO_PLUGIN_RUNNER = createPluginRunnerFromConfig(...)`\n      // WITHOUT awaiting it, and every consumer awaits at the point of use. `await` is a reserved\n      // word everywhere in an ES module, so a non-async factory carrying that binding does not\n      // merely misbehave -- the entry does not parse, and `tests/unit/adapter-entry-parses.test.ts`\n      // is where that is caught. It went red at HEAD before this line existed, on a first version\n      // of this fix whose own test asserted `toContain('await THEO_PLUGIN_RUNNER')`: the presence\n      // of the token that breaks the parse. That test file's header says why, in its own words --\n      // `toContain` does not care whether the string is a program.\n      //\n      // Laziness is unaffected. The shim was always built eagerly inside this factory; what ADR-1\n      // refuses is paying for a url nobody answers, and neither call site is reached by one.\n      `async function __theoResolveSubject(request) {`,\n      ...resolution.identity,\n      `  return resolveSubject`,\n      `}`,\n    ],\n    branch: [\n      `    // #367 — the agent convention owns this prefix. It is answered BEFORE the file-route`,\n      `    // table because an agent matches no file route: falling through is how a deployed`,\n      `    // \\`/api/agents/<name>\\` used to 404 on every target.`,\n      `    if (`,\n      `      ${pathname}.startsWith(${JSON.stringify(AGENT_PREFIX)}) ||`,\n      `      ${pathname}.startsWith(${JSON.stringify(WELL_KNOWN_PREFIX)})`,\n      `    ) {`,\n      ...resolution.auxPrelude,\n      `      // B-185 — the aux dispatcher is asked FIRST, and declining costs nothing: the matcher`,\n      `      // reads the url and the scanned nodes, never a module (ADR-1). A miss falls through to`,\n      `      // the run handler exactly as before, so this branch owns the sub-paths and nothing more.`,\n      `      const auxRoute = await matchAgentAuxRoute(request.method, ${pathname}, auxDeps)`,\n      `      if (auxRoute !== null) {`,\n      `        // B-185 — identity is resolved only now. Building it costs a web shim and, where the`,\n      `        // app declares one, a call into its own \\`createContext\\`; a url this dispatcher`,\n      `        // merely declined must pay for neither (resolve-agent-subject.ts:93-96).`,\n      `        const auxResponse = await serveMatchedAuxRoute(auxRoute, request, {`,\n      `          ...auxDeps,`,\n      `          resolveSubject: await __theoResolveSubject(request),`,\n      `        })`,\n      host.wrapSecurityHeaders === true\n        ? `        return withSecurityHeaders(auxResponse, SECURITY_HEADERS)`\n        : `        return auxResponse`,\n      `      }`,\n      `      // B-185 — only the agent prefix has a run handler behind it. A \\`.well-known\\` url the`,\n      `      // dispatcher declined must NOT slice a prefix it does not carry: the name would be`,\n      `      // garbage and mountAgent would answer 500 for what is a routing miss.`,\n      `      if (!${pathname}.startsWith(${JSON.stringify(AGENT_PREFIX)})) return ${notFound}`,\n      `      const agentName = ${pathname}.slice(${String(AGENT_PREFIX.length)}).split('/')[0]`,\n      ...resolution.lookup,\n      `      // A name nobody scanned is a 404, exactly like any other unknown path. Handing`,\n      `      // \\`undefined\\` to mountAgent would surface as a 500 for what is a routing miss.`,\n      `      if (mod === undefined) return ${notFound}`,\n      `      const agentResponse = await mountAgent(mod, request, (model, plugins) => resolveProvider(model, { plugins }).apiKey, {`,\n      `        agentName,`,\n      `        // B-185 — mount-agent.ts:121 has accepted this since #365 and 0 of 23 adapters passed`,\n      `        // one, so agent-access.ts:146 judged every deployed policy against \\`subject: null\\`.`,\n      `        // A run is not a decline: it is about to do real work, so the shim this builds is not`,\n      `        // the cost ADR-1 refuses.`,\n      `        resolveSubject: await __theoResolveSubject(request),`,\n      `        ...CSRF_CONFIG,`,\n      `      })`,\n      host.wrapSecurityHeaders === true\n        ? `      return withSecurityHeaders(agentResponse, SECURITY_HEADERS)`\n        : `      return agentResponse`,\n      `    }`,\n    ],\n  }\n}\n\ninterface AgentResolution {\n  imports: string[]\n  declarations: string[]\n  /** Lines that must leave `mod` bound to the agent's module, or `undefined`. */\n  lookup: string[]\n  /**\n   * B-185 — lines that must leave `auxDeps` bound to an `AuxRouteDeps`, plus the expression for\n   * its `agents`. They run BEFORE {@link AgentResolution.lookup} so a declined aux route performs\n   * no module load, which is what ADR-1 buys and what a later ordering would spend.\n   */\n  auxPrelude: string[]\n  /**\n   * B-185 — lines that must leave `resolveSubject` bound to a resolver, or to `undefined`. Emitted\n   * only where a match has already happened, because building one costs a web shim and\n   * `resolve-agent-subject.ts:93-96` states that a declined url must never run the application's\n   * `createContext`.\n   */\n  identity: string[]\n  /**\n   * B-185 — what {@link AgentResolution.identity} imports, appended to the `agent-mount` line, or\n   * `''` where identity is not resolved at all.\n   *\n   * It lives HERE, beside the lines that CALL it, because a first draft decided it in a separate\n   * `identityEntryFor` that switched the same discriminated union a second time. The two could not\n   * disagree then — the conditions were identical — which is what made it latent rather than live.\n   * A later drift would emit an entry that CALLS a symbol it never imported, and nothing catches\n   * that: the stub-coverage guard derives its requirement FROM the imports, so a missing import\n   * shrinks the requirement instead of failing, and `node --check` is syntax rather than\n   * resolution. It would surface as a `ReferenceError` inside a deployed Worker.\n   */\n  identityImport: string\n}\n\n/** No filesystem: every agent module is a static import decided on the build machine. */\nfunction bakedResolution(\n  agents: readonly DeployedAgent[],\n  contextModule: string | undefined,\n  pluginRunnerExpr: string | undefined,\n  baseUrl: string,\n): AgentResolution {\n  const varOf = (index: number): string => `__theoAgent${String(index)}`\n  return {\n    imports: [\n      ...agents.map((agent, index) => `import * as ${varOf(index)} from '../../${agent.filePath}'`),\n      // B-185 — the app's context module, baked exactly like the agents above it (ADR 0014).\n      ...(contextModule === undefined\n        ? []\n        : [\n            // SI-022 — DYNAMIC, not a top-level static import. B-185 added this import; before it\n            // a Worker did not load the app's `server/context.ts` at all. A module-scope throw\n            // there — the commonest shape being a required-env-var check — then went from costing\n            // nothing to taking the ENTIRE target down: the import fails, the module never\n            // evaluates, and every route dies rather than only the one that wanted an identity.\n            //\n            // That is strictly worse than what `resolve-agent-subject.ts:69-72` promises. It says\n            // a throwing `createContext` reaches the branch's own error handler and becomes a 500,\n            // which is a failure scoped to the request that needed identity. A throw at IMPORT\n            // time reaches no handler at all.\n            //\n            // A relative `import()` is statically analysable, so wrangler bundles the module\n            // exactly as it bundled the static form — the reason ADR 0014 bakes it is unaffected.\n            // What changes is WHEN it evaluates, and therefore what a failure costs. It is only\n            // a real improvement if the import stays inside the thunk; see the factory below.\n            `const __theoContext = () => import('../../${contextModule}')`,\n          ]),\n    ],\n    declarations: [\n      `// #367 — the app's agents, keyed by NAME because that is what the URL carries, what the`,\n      `// access policy is judged under, and what the run's spans are labelled with (#406).`,\n      `const agents = {`,\n      ...agents.map((agent, index) => `  ${JSON.stringify(agent.name)}: ${varOf(index)},`),\n      `}`,\n      `// B-185 — the node list the aux dispatcher matches a url against. There is deliberately NO`,\n      `// second table keyed by file path: \\`test_the_table_is_keyed_by_agent_name_not_by_file_path\\``,\n      `// forbids one, and the reason it gives is the right one — a path key makes a lookup depend on`,\n      `// the server's directory layout. The loader below reaches the module THROUGH this list, so the`,\n      `// layout appears once, here, and the module table above stays keyed by the name the URL, the`,\n      `// access policy and the run's spans all carry (#406).`,\n      `const agentNodes = [`,\n      ...agents.map(\n        (agent) =>\n          `  { filePath: ${JSON.stringify(agent.filePath)}, agentPath: ${JSON.stringify(agent.agentPath)}, name: ${JSON.stringify(agent.name)} },`,\n      ),\n      `]`,\n    ],\n    lookup: [\n      `      const mod = Object.prototype.hasOwnProperty.call(agents, agentName)`,\n      `        ? agents[agentName]`,\n      `        : undefined`,\n    ],\n    identityImport: contextModule === undefined ? '' : ', createSubjectResolverFromFactory',\n    identity:\n      contextModule === undefined\n        ? [\n            `  // B-185 — this app declares no \\`server/context.ts\\`, so there is no factory to`,\n            `  // bake and an anonymous caller is the honest answer. A policy that admits`,\n            `  // nobody is the correct outcome, not an error.`,\n            `        const resolveSubject = undefined`,\n          ]\n        : [\n            `  // B-185 — a Worker has no filesystem to find \\`context.ts\\` on, so the module is baked`,\n            `  // and its factory handed straight to the resolver (ADR 0014).`,\n            `  //`,\n            `  // This function has TWO callers and is lazy on purpose. Both build a shim, and that is`,\n            `  // correct at both: the aux branch calls it only AFTER a match, and the run handler is`,\n            `  // about to do real work. What neither pays for is the app's own \\`createContext\\` on a`,\n            `  // url nobody answers — the resolver is a thunk, and \\`agent-access.ts:146\\` returns early`,\n            `  // for an absent or public policy without ever invoking it.`,\n            `        const { req: __theoReq, res: __theoRes } = createWebShim(request)`,\n            `  const resolveSubject = createSubjectResolverFromFactory(`,\n            // The import happens HERE, inside the factory, and `createSubjectResolverFromFactory`\n            // calls the factory inside the thunk it returns (`resolve-agent-subject.ts:127-133`).\n            // A first version of this fix awaited the import as an ARGUMENT, which evaluated it\n            // eagerly inside `__theoResolveSubject` — both call sites await that before\n            // `agent-access.ts:145` returns early for an absent or `'public'` policy. The blast\n            // radius was then every agent request rather than the one that wanted an identity,\n            // and the laziness invariant the lines above assert was broken. Found by the\n            // inventory judge while the change was still in the working tree.\n            `    async (__theoArgs) => (await __theoContext()).createContext(__theoArgs),`,\n            `    __theoReq,`,\n            `    __theoRes,`,\n            `    ${pluginRunnerExpr ?? 'undefined'},`,\n            `  )`,\n          ],\n    auxPrelude: [\n      `      // B-185 — the aux dispatcher needs nodes carrying \\`filePath\\` and a loader keyed by it.`,\n      `      // The loader resolves the path to a NAME through the node list, then reads the same`,\n      `      // name-keyed table the url lookup uses: one map, one layout mention, no filesystem`,\n      `      // (ADR-2). A linear find over a handful of agents is not worth a second table that`,\n      `      // \\`test_the_table_is_keyed_by_agent_name_not_by_file_path\\` exists to forbid.`,\n      `      const auxDeps = {`,\n      `        agents: agentNodes,`,\n      `        loadModule: async (filePath) => {`,\n      `          const node = agentNodes.find((a) => a.filePath === filePath)`,\n      `          return node === undefined ? undefined : agents[node.name]`,\n      `        },`,\n      `        baseUrl: ${baseUrl},`,\n      ...AUX_DEPS_PARITY,\n      `      }`,\n    ],\n  }\n}\n\n/** A filesystem: scan once and load on demand, exactly as this entry already treats its routes. */\nfunction scannedResolution(source: {\n  projectRoot: string\n  loadModule: string\n  ensureLoader?: string\n  agentsDirLiteral?: string\n  serverDir?: string\n  pluginRunnerExpr?: string\n  baseUrl: string\n}): AgentResolution {\n  // The configured directory as a second argument, or nothing. `scanAgents` defaults the name to\n  // `agents`, which is right for a project that never set one and wrong for every project that did.\n  const agentsDirArg = source.agentsDirLiteral === undefined ? '' : `, ${source.agentsDirLiteral}`\n\n  return {\n    imports: [],\n    declarations: [\n      `// #367 — scanned on first use and cached, the same shape this entry already gives routes.`,\n      `// Baking would tie an agent's existence to a rebuild on a target that has a filesystem.`,\n      `let agentsCache = null`,\n    ],\n    lookup: [\n      `      const agentNode = agentsCache.find((a) => a.name === agentName)`,\n      `      const mod = agentNode === undefined ? undefined : await ${source.loadModule}(agentNode.filePath)`,\n    ],\n    identityImport: source.serverDir === undefined ? '' : ', createAgentSubjectResolver',\n    identity:\n      source.serverDir === undefined\n        ? [`        const resolveSubject = undefined`]\n        : [\n            `  // B-185 — this host HAS a filesystem, so it locates its own \\`context.ts\\` and the`,\n            `  // existing resolver works unchanged; nothing is baked (ADR 0014). Lazy for the reason`,\n            `  // the baked branch gives: both callers build a shim, and neither runs the app's own`,\n            `  // \\`createContext\\` for a url nobody answers.`,\n            `        const { req: __theoReq, res: __theoRes } = createWebShim(request)`,\n            `  const resolveSubject = createAgentSubjectResolver({`,\n            `    req: __theoReq,`,\n            `    res: __theoRes,`,\n            `    loadModule: ${source.loadModule},`,\n            `    serverDir: ${source.serverDir},`,\n            `    pluginRunner: ${source.pluginRunnerExpr ?? 'undefined'},`,\n            `        })`,\n          ],\n    auxPrelude: [\n      ...(source.ensureLoader === undefined ? [] : [`      ${source.ensureLoader}`]),\n      `      // B-185 — hoisted above the lookup so a declined aux route loads no module. The scan`,\n      `      // LISTS agent files; it imports none, so moving it here costs a declined request`,\n      `      // nothing it was not already paying.`,\n      `      if (!agentsCache) agentsCache = scanAgents(${source.projectRoot}${agentsDirArg})`,\n      `      const auxDeps = {`,\n      `        agents: agentsCache,`,\n      `        loadModule: ${source.loadModule},`,\n      `        baseUrl: ${source.baseUrl},`,\n      ...AUX_DEPS_PARITY,\n      `      }`,\n    ],\n  }\n}\n","/**\n * The CORS configuration a deployed entry carries, baked at build time.\n *\n * ## The defect this closes\n *\n * `security.cors` reached exactly one consumer: Vite's `configureServer` hook. So an app that\n * worked cross-origin under `theokit dev` stopped working the moment anything else served it —\n * `theokit start` (fixed separately) and all six Web deploy targets (usetheokit/theokit#409). Same\n * config, same code, no error and no warning; the failure surfaces in a browser as a blocked fetch\n * on the deployed URL, three layers from the key that had quietly stopped being read.\n *\n * The pure half was written twice and called once: `createCorsWebHandler` — the Web mirror — had no\n * caller anywhere in the repository. Nothing here reimplements it.\n *\n * ## A callback origin is REFUSED, not silently dropped\n *\n * `corsSchema.origins` accepts `z.function(...)` alongside the string / RegExp / array shapes. A\n * deployed function has no `theo.config.ts` to read, and there is no literal for a closure — so a\n * build that baked only the serialisable shapes would produce an app whose CORS silently allowed\n * nothing, which is the exact class of failure this issue reports.\n *\n * `docs/program/three-target-parity.md` § 3 is explicit about the alternative: \"a target that cannot serve\n * a capability refuses by name. Silent degradation is the failure mode this rule exists to\n * prevent.\" So the build throws, naming the target, the key and the two ways forward.\n */\nimport type { TheoConfig } from '../config/schema.js'\n\ntype CorsConfig = NonNullable<NonNullable<TheoConfig['security']>['cors']>\n\n/**\n * The CORS slice of an adapter's build options.\n *\n * Narrow and named once, matching how `securityHeaders` and `DeployedCsrfOptions` already reach the\n * emitters: each renderer receives what it uses, and six signatures name one type instead of six\n * inline shapes that can drift.\n */\nexport interface DeployedCorsOptions {\n  cors?: CorsConfig\n}\n\n/**\n * Thrown at BUILD time when the declared CORS cannot be carried to a deployed target.\n *\n * A build error is the point: the alternative is a deploy that looks configured and refuses every\n * cross-origin request, discovered by a browser rather than by the build.\n */\nexport class UnserializableCorsOriginError extends Error {\n  constructor(target: string) {\n    super(\n      `security.cors.origins is a function, and the \\`${target}\\` target cannot carry it: a deployed ` +\n        `function has no theo.config.ts to read, and a callback cannot be written into the emitted ` +\n        `entry. Replace it with the origin, a RegExp, or an array of either — all of which travel — ` +\n        `or build for \\`node\\` and run \\`theokit start\\`, which evaluates the callback at runtime.`,\n    )\n    this.name = 'UnserializableCorsOriginError'\n  }\n}\n\n/** Source text for one origin matcher: a RegExp as a literal, anything else as JSON. */\nfunction renderOrigin(origin: unknown, target: string): string {\n  if (typeof origin === 'function') throw new UnserializableCorsOriginError(target)\n  if (origin instanceof RegExp) return String(origin)\n  if (Array.isArray(origin)) return `[${origin.map((o) => renderOrigin(o, target)).join(', ')}]`\n  return JSON.stringify(origin)\n}\n\n/**\n * Source text for the CORS config, or `undefined` when the app declared none.\n *\n * RegExp entries are emitted as regex literals for the reason `deployed-csrf.ts` gives at length:\n * `JSON.stringify` renders a RegExp as `{}`, and `matchesOrigin` checks `instanceof RegExp`, so a\n * JSON-rendered origin would sit in the emitted file looking configured and matching nothing.\n *\n * @throws UnserializableCorsOriginError when `origins` is a callback\n */\nexport function renderDeployedCorsLiteral(cors: CorsConfig | undefined, target: string): string {\n  if (cors === undefined) return 'undefined'\n\n  const parts = [`origins: ${renderOrigin(cors.origins, target)}`]\n  if (cors.methods !== undefined) parts.push(`methods: ${JSON.stringify(cors.methods)}`)\n  if (cors.allowedHeaders !== undefined)\n    parts.push(`allowedHeaders: ${JSON.stringify(cors.allowedHeaders)}`)\n  if (cors.exposedHeaders !== undefined)\n    parts.push(`exposedHeaders: ${JSON.stringify(cors.exposedHeaders)}`)\n  // Both carry schema defaults, so they are always present and always emitted — unlike the\n  // optional fields above, whose absence is a real answer the handler already has one for.\n  parts.push(\n    `credentials: ${JSON.stringify(cors.credentials)}`,\n    `maxAge: ${JSON.stringify(cors.maxAge)}`,\n  )\n\n  return `{ ${parts.join(', ')} }`\n}\n\n/**\n * The lines that declare the CORS handler in a generated entry.\n *\n * `null` when nothing was declared, which is what \"no cors block\" meant before and still means: no\n * headers, not permissive ones.\n */\nexport function deployedCorsFragment(cors: CorsConfig | undefined, target: string): string[] {\n  return [\n    `// #409 — the CORS the app declared, carried as a literal because a deployed function has no`,\n    `// theo.config.ts to read. \\`null\\` when the app declared none: no headers, not permissive ones.`,\n    `const CORS_CONFIG = ${renderDeployedCorsLiteral(cors, target)}`,\n    `const CORS_HANDLER = CORS_CONFIG === undefined ? null : createCorsWebHandler(CORS_CONFIG)`,\n    ``,\n    `/** Answer a preflight before routing — an OPTIONS the router handles never gets a CORS answer. */`,\n    `function corsPreflight(request) {`,\n    `  return CORS_HANDLER === null ? null : CORS_HANDLER.handlePreflightRequest(request)`,\n    `}`,\n    ``,\n    `/** Put the headers on whatever the app answered, including its 404s — a browser reads a 404`,\n    ` *  without them as a CORS failure rather than as the 404 it is. */`,\n    `function withCors(request, response) {`,\n    `  if (CORS_HANDLER !== null) CORS_HANDLER.applyCorsHeaders(request, response.headers)`,\n    `  return response`,\n    `}`,\n  ]\n}\n","/**\n * The CSRF configuration a deployed entry carries, baked at build time.\n *\n * ## The defect this closes\n *\n * The six Web-standards adapter entries built `executeRoute`'s context from an eight-field\n * literal, and neither `csrfMode` nor `disallowed` was among the eight (usetheokit/theokit#410).\n * `executeRoute` defaults an absent mode to `'strict'`, so an app declaring\n * `security: { csrf: 'off' }` — or `'warn'` — got `'strict'` on every deploy target: a `POST` that\n * works under `theokit dev` and `theokit start` answers `403 CSRF_INVALID` on Vercel, naming a\n * mechanism the operator had switched off. The config still validated and the build still\n * succeeded; the behaviour simply changed.\n *\n * The deployed function has no `theo.config.ts` to read, which is why the value is carried as a\n * literal — the same shape `security.headers` already uses (`renderSecurityHeadersConfigLiteral`).\n *\n * ## Why this is not `JSON.stringify`\n *\n * `disallowed.routes` accepts RegExp entries (`config/schemas/security.ts`), and `JSON.stringify`\n * renders a RegExp as `{}`. That is not a formatting problem: `matchDisallowed` checks\n * `p instanceof RegExp`, so a `{}` matches nothing while reading, in the emitted file, as a rule\n * that is present and configured. Reaching for JSON here would reproduce this issue's own defect —\n * configuration that survives validation and quietly stops applying — one layer further down.\n */\nimport type { TheoConfig } from '../config/schema.js'\n\ntype SecurityConfig = NonNullable<TheoConfig['security']>\n\n/**\n * The two slices of `security` that reach `executeRoute`'s context.\n *\n * Narrow rather than the whole block, matching how `securityHeaders` is already passed: each\n * renderer receives what it uses and nothing else, so a headers change cannot reach the CSRF\n * literal and vice versa.\n */\nexport interface DeployedCsrfOptions {\n  csrf?: SecurityConfig['csrf']\n  disallowed?: SecurityConfig['disallowed']\n}\n\n/**\n * Source text for one route pattern.\n *\n * A RegExp is emitted as a regex literal so it arrives as a RegExp; a string goes through\n * `JSON.stringify`, which is the correct escaper for a JS string literal (quotes, backslashes,\n * control characters, line separators).\n */\nfunction renderRoutePattern(pattern: string | RegExp): string {\n  return pattern instanceof RegExp ? String(pattern) : JSON.stringify(pattern)\n}\n\n/**\n * Source text for the CSRF slice of `executeRoute`'s context.\n *\n * Absent values are OMITTED rather than defaulted. `executeRoute` already defaults an absent\n * `csrfMode` to `'strict'`, and writing `'strict'` here would put that default in a second place\n * where the two can disagree — which is the class of drift the whole issue is about.\n *\n * @param security - the declared csrf slices, or `undefined` when the app declared no security block\n */\nexport function renderDeployedCsrfLiteral(security: DeployedCsrfOptions | undefined): string {\n  if (security === undefined) return '{}'\n\n  const parts: string[] = []\n  if (security.csrf !== undefined) parts.push(`csrfMode: ${JSON.stringify(security.csrf)}`)\n\n  const { disallowed } = security\n  if (disallowed !== undefined) {\n    const routes = disallowed.routes.map(renderRoutePattern).join(', ')\n    parts.push(\n      `disallowed: { routes: [${routes}], behavior: ${JSON.stringify(disallowed.behavior)} }`,\n    )\n  }\n\n  // `{}` and not `{ }` when nothing was declared: the emitted file is read by people, and the\n  // two-space version reads as though something was meant to be there.\n  return parts.length === 0 ? '{}' : `{ ${parts.join(', ')} }`\n}\n\n/**\n * The lines that declare `CSRF_CONFIG` in a generated entry.\n *\n * One function rather than the same six lines pasted into each of the six adapters: that\n * duplication is how the eight-field context literal came to be wrong in six places at once, and\n * repeating the fix in the same shape would leave the next field with the same six places to be\n * forgotten in. It also keeps the two largest emitters under the `max-lines-per-function` ceiling,\n * which `vercel.ts` already extracts fragments to respect.\n *\n * @param opts - the declared csrf slices, passed straight through from the adapter's build options\n * @param home - what the target has instead of a config file, for the comment's second sentence\n */\nexport function deployedCsrfFragment(\n  opts: DeployedCsrfOptions,\n  home = 'a deployed function',\n): string[] {\n  return [\n    `// #410 — the CSRF mode and per-route escalation the app declared. Carried as a`,\n    `// literal for the same reason as the headers above: ${home} has no theo.config.ts`,\n    `// to read. Absent keys stay absent so executeRoute's own default ('strict') applies,`,\n    `// rather than this file becoming a second place it can drift.`,\n    `const CSRF_CONFIG = ${renderDeployedCsrfLiteral(opts)}`,\n  ]\n}\n","/**\n * The security headers a deployed target puts on its responses.\n *\n * `theokit start` applies the configured baseline to every response it writes\n * (`cli/commands/start/request-handler.ts`). None of the six Web-standards\n * deploy adapters applied any, so the same page carried a CSP,\n * `X-Frame-Options`, HSTS and `nosniff` under `theokit start` and none of them\n * once deployed (usetheokit/theokit#410, GHSA-87qq-fgcr-384x).\n *\n * This module is the seam that closes that half of the gap. It has two halves\n * and they live together on purpose: the code that writes the literal into a\n * generated entry and the code that reads it at request time have to agree on\n * one shape, and a shape stated in two files drifts.\n *\n * - **Build time** — {@link renderSecurityHeadersConfigLiteral} turns\n *   `security.headers` into a JSON literal the adapter inlines. A deployed\n *   runtime has no `theo.config.ts` to read, so the configuration travels as\n *   data.\n * - **Request time** — the generated entry calls {@link buildSecurityHeaders}\n *   on that literal and hands every response to {@link withSecurityHeaders}.\n *   The same function `theokit start` calls, on the same input, so the two\n *   cannot disagree about what the configuration means.\n *\n * ## The per-request nonce, and where it stops\n *\n * `buildSecurityHeaders` accepts a per-request `nonce` and substitutes it into\n * `script-src`. A nonce cannot survive a build-time literal — it is minted per\n * response — so a target reaches one only if it renders the HTML at request\n * time and can put the same value on the script tags it emits.\n *\n * Two paths do, and this docblock named one of them until 2026-09-24:\n *\n *   - **Cloudflare with `ssrStreaming: true`** — the worker calls\n *     `renderStreamingWeb(request, { nonce })`, and that renderer threads the\n *     value into `renderToReadableStream` and into the hydration script\n *     (`router/entry-server.ts`).\n *   - **node** — `theokit start` mints one per request\n *     (`cli/commands/start/request-handler.ts:272`) and stamps it onto the\n *     inline scripts in the head. The `node` deploy adapter serves through that\n *     same handler, which is what its own comment says\n *     (`adapters/node.ts:24`).\n *\n * The six Web-standards targets that DO declare a limit here — aws-lambda, bun,\n * deno-deploy, netlify, vercel, and Cloudflare without `ssrStreaming` — serve\n * HTML written at build time, or no HTML at all, and carry a **nonce-less\n * CSP**: the same answer `buildSecurityHeaders` already gives a prerendered\n * route (EC-4), for the same reason — a nonce in the header with no nonce on\n * the tag blocks every inline script.\n *\n * `node` declares no `mintsNonce` at all, because it never calls\n * {@link describeDeployedSecurityHeaders}. That is a gap in what its build\n * PRINTS, not a wrong declaration, and closing it is its own change rather than\n * a line in the item that corrected this paragraph.\n *\n * That asymmetry is real and is not smoothed over. It is stated in the emitted\n * entry, printed by the build through\n * {@link describeDeployedSecurityHeaders}, and written down in\n * `docs/surfaces/build-adapters.md`.\n */\nimport { generateNonce } from '../core/contracts/nonce.js'\nimport type { SecurityHeadersConfig } from '../core/contracts/security-headers.js'\nimport { buildSecurityHeaders } from '../core/contracts/security-headers.js'\n\n/**\n * Re-exported so a generated entry has ONE import for the whole concern.\n *\n * Reaching it through `theokit/server/security` would work and would also drag\n * that barrel's CSRF surface into a Worker bundle, for a function that is forty\n * lines of string concatenation. It is defined in `core/contracts/`, which is\n * the module every target may import from — `adapters → server` is not an edge\n * in the DAG, and the header policy was never server code.\n */\nexport { buildSecurityHeaders }\n\n/**\n * Re-exported for the same reason, and so the streamed Cloudflare worker mints\n * its nonce with the identical primitive `theokit start` uses\n * (`cli/commands/start/request-handler.ts`) rather than a second, hand-rolled\n * one. It is already runtime-portable: Web Crypto first, with a named error\n * when the runtime has none.\n */\nexport { generateNonce }\n\n/**\n * The `security.headers` block, as a literal a generated entry can carry.\n *\n * `{}` when the app declares none — which is not the same as \"no headers\".\n * `buildSecurityHeaders({})` returns the full default baseline, and `{}` is\n * exactly what `theokit start` passes when `security.headers` is absent\n * (`cli/commands/start/index.ts`). An app with no security block gets the same\n * baseline deployed as it gets locally.\n */\n/**\n * The two declarations every deploy entry emits to carry the security baseline.\n *\n * Four adapters wrote these same two lines — `netlify`, `vercel`, `aws-lambda`, `deno-deploy` —\n * each under a comment naming its own host's static-asset boundary. The COMMENT differs and is\n * meant to; the declarations do not.\n *\n * Extracted after SonarCloud's duplication gate failed a PR at 4.0% against a 3% ceiling and named\n * this as the largest repeated block among the changed files. The gate was measuring something\n * real: a literal renderer and a builder call, copied four times, is four places to update when\n * either changes.\n *\n * Returns the lines rather than a joined string, because every caller splices them into an array\n * of emitted lines.\n */\nexport function securityHeadersDeclarations(config: SecurityHeadersConfig | undefined): string[] {\n  return [\n    `const SECURITY_HEADERS_CONFIG = ${renderSecurityHeadersConfigLiteral(config)}`,\n    `const SECURITY_HEADERS = buildSecurityHeaders(SECURITY_HEADERS_CONFIG, { production: true })`,\n  ]\n}\n\nexport function renderSecurityHeadersConfigLiteral(\n  headers: SecurityHeadersConfig | undefined,\n): string {\n  return JSON.stringify(headers ?? {})\n}\n\n/**\n * Put the headers on a response, without overruling the handler.\n *\n * `theokit start` sets the baseline BEFORE the route handler runs, so a handler\n * can override it with `res.setHeader` (last write wins, Node convention). On a\n * Web target the response arrives already built, so the equivalent of \"the\n * handler wins\" is to skip a header the response already carries: a route that\n * set its own `Content-Security-Policy` keeps it.\n *\n * Mutates and returns the same `Response` rather than constructing a\n * replacement, because these responses are handed to the runtime while their\n * body is still being written (#382) and re-wrapping the stream is exactly the\n * second buffering point that change removed.\n *\n * Mutation is safe for every response these entries produce: the Fetch spec\n * gives a locally constructed `Response` the `response` header guard, which\n * permits `set` for every name used here. The `immutable` guard belongs to\n * responses that came back from `fetch()`, and none of the six emitted handlers\n * returns one — each builds its response from `createWebShim`, from a `new\n * Response(...)`, or from the SSR renderer. The WebSocket upgrade, which is the\n * one response an adapter gets from its runtime rather than building, is\n * deliberately not routed through here.\n */\nexport function withSecurityHeaders(response: Response, headers: Record<string, string>): Response {\n  const missing = Object.entries(headers).filter(([key]) => !response.headers.has(key))\n  // Nothing to add, so nothing to rebuild. This also keeps the response IDENTITY for every caller\n  // that already had every header, which is what the mutating version always did.\n  if (missing.length === 0) return response\n\n  // B-263 — a Response the framework did not construct carries an immutable headers guard, and\n  // `headers.set()` on one throws `TypeError: Can't modify immutable headers.` Measured on a live\n  // Cloudflare deploy, 2026-09-26, read from `wrangler tail`: the worker forwarded `/robots.txt`\n  // from its ASSETS binding, this function tried to stamp the baseline onto that response, and the\n  // request answered HTTP 500 / error 1101 instead of a text file.\n  //\n  // It had never fired because every response this had ever been handed was one the framework built\n  // itself. The two paths that hand it a FOREIGN response are Cloudflare's asset branches, and\n  // Cloudflare's asset handler answered those requests before the worker ran until `run_worker_first`\n  // was set in the same session. The line was shipped and unreachable.\n  //\n  // A new Response over the same body is the only way to add a header to an immutable one. Status,\n  // statusText and every header the response already carried are copied, because losing any of them\n  // turns a 404 into a 200 or makes a browser sniff a stylesheet.\n  const next = new Headers(response.headers)\n  for (const [key, value] of missing) next.set(key, value)\n\n  return new Response(response.body, {\n    status: response.status,\n    statusText: response.statusText,\n    headers: next,\n  })\n}\n\nexport interface DeployedSecurityHeaderLimits {\n  target: string\n  /** The app's `security.headers` block, or undefined when it declares none. */\n  securityHeaders: SecurityHeadersConfig | undefined\n  /**\n   * Does the emitted handler render HTML at request time and mint a CSP nonce\n   * for it? Among the targets that CALL this function, true only for Cloudflare\n   * with `ssrStreaming: true`. `node` also mints one and is not among them —\n   * see the note in this module's header docblock.\n   */\n  mintsNonce: boolean\n  /**\n   * Is the HTML document served by a platform static host rather than by the\n   * handler this build emits? True wherever the emitted handler answers\n   * `/api/*` and returns 404 for everything else.\n   */\n  /**\n   * Who puts the security headers on the HTML DOCUMENT — a different question from who serves it,\n   * and the two used to be collapsed into one boolean (usetheokit/theokit#412).\n   *\n   * - `handler` — this target's own handler returns the document, so it carries the same baseline\n   *   every API response carries. No caveat.\n   * - `platform-configured` — the platform's static host serves the document, AND this build emits\n   *   the configuration that puts the headers on it (`.vercel/output/config.json`, `netlify.toml`).\n   *   Still worth stating, because nothing here has seen a deployed response.\n   * - `platform-unmanaged` — the platform serves it and this build owns no artifact that could\n   *   configure it. This is the real remaining gap, and it stays named.\n   *\n   * The two-value version reported `platform-configured` targets with the same message as\n   * `platform-unmanaged` ones, telling an operator to go and do work the build had already done —\n   * and a stale limitation reads exactly like a current one.\n   */\n  documentHeaders: 'handler' | 'platform-configured' | 'platform-unmanaged'\n}\n\n/**\n * What the build tells the operator, once, per target.\n *\n * Silent degradation is the failure mode `docs/program/three-target-parity.md` exists\n * to prevent. Two things degrade quietly here and both are named rather than\n * discovered in production: a CSP that refuses inline scripts on a deploy while\n * allowing them locally, and an HTML document that never passes through the\n * handler these headers are attached to.\n *\n * The header names are read from the map the entry will actually carry, not\n * from a list written next to it. A configuration that switches HSTS or the CSP\n * off would otherwise be announced as sending them.\n */\nexport function describeDeployedSecurityHeaders(limits: DeployedSecurityHeaderLimits): string {\n  const headers = buildSecurityHeaders(limits.securityHeaders ?? {}, { production: true })\n  const names = Object.keys(headers)\n  if (names.length === 0) {\n    return `  ! \\`${limits.target}\\` sends no security headers: the configuration switched every one of them off.`\n  }\n\n  const lines = [\n    `  ✓ security headers on every response \\`${limits.target}\\` returns: ${names.join(', ')}.`,\n  ]\n  const sendsCsp = names.some((name) => name.startsWith('Content-Security-Policy'))\n  if (sendsCsp && !limits.mintsNonce) {\n    lines.push(\n      `    - The CSP carries no nonce: this target serves HTML written at build time,`,\n      `      so there is no per-request value to put on a script tag. An inline`,\n      `      <script> is refused by \\`script-src 'self'\\` here, while the same page`,\n      `      under \\`theokit start\\` gets a nonce and runs it. Move inline scripts to`,\n      `      \\`<script src=\"...\">\\`, or set \\`security.headers.cspMode: 'report-only'\\``,\n      `      while you migrate.`,\n    )\n  }\n  if (limits.documentHeaders === 'platform-configured') {\n    lines.push(\n      `    - The HTML document is served by the platform's static host, and reaches`,\n      `      the browser with these headers through config this build emits. That`,\n      `      path is not verified by a deploy from here — the values come from the`,\n      `      same function the handler uses, but no response has been read back.`,\n    )\n  }\n  if (limits.documentHeaders === 'platform-unmanaged') {\n    lines.push(\n      `    - The HTML document does NOT pass through this handler — the platform's`,\n      `      static host serves it — so these headers reach \\`/api/*\\` responses and`,\n      `      not the page. This build emits no artifact that could configure it, so`,\n      `      set the document's headers on the platform (usetheokit/theokit#412).`,\n    )\n  }\n  return lines.join('\\n')\n}\n","/**\n * The rate limit a deployed entry carries, baked at build time.\n *\n * ## What #508 asked for, and what this answers\n *\n * `theokit build` refuses the six Web-standards targets when `theo.config.ts` declares a\n * `rateLimit` (`UnenforceableRateLimitError`). That refusal is honest and it is not enforcement.\n * The issue names three things standing between the refusal and a working limit: per-runtime\n * caller-address resolution, a refusal that survives where the address cannot be resolved, and\n * storage that outlives one invocation.\n *\n * For `bun` all three already have answers, which is why it is the target that moves first:\n *\n * - **Address** — `Bun.serve`'s handler is `fetch(request, server)`, and `server.requestIP(request)`\n *   returns the peer address without depending on a proxy header a client could set.\n * - **Storage** — `Bun.serve` is a long-lived process. `createRateLimiterWeb`'s default\n *   `InMemoryStore` therefore behaves exactly as it does under `theokit start`, which is the\n *   deployment `node` already ships.\n * - **Refusal** — see below: every shape whose key cannot be resolved in a deployed entry throws\n *   at BUILD time rather than degrading.\n *\n * ## Why the other five are not here\n *\n * Cloudflare, AWS Lambda, Netlify and Vercel are per-invocation runtimes: an in-process counter\n * does not survive between requests, so a limiter built on one forgets. A limit that forgets is a\n * limit that does not limit — the same class of failure as the shared bucket, reached by a\n * different road. Deno Deploy evicts isolates for the same reason. Those need an external counter,\n * which is a storage design and not a wiring change, so they keep refusing by name.\n *\n * Being explicit about that boundary is the point. The failure this whole area exists to prevent is\n * a config that reads as protection while protecting nothing.\n */\nimport type { TheoConfig } from '../config/schema.js'\n\ntype RateLimitConfig = NonNullable<TheoConfig['rateLimit']>\n\n/** The rate-limit slice of an adapter's build options, named once like `DeployedCorsOptions`. */\nexport interface DeployedRateLimitOptions {\n  rateLimit?: RateLimitConfig\n}\n\n/**\n * Thrown at BUILD time when a declared rate limit cannot be carried into a deployed entry.\n *\n * Distinct from {@link UnenforceableRateLimitError}, and the distinction is not cosmetic: that one\n * means *this target enforces no limit at all*, this one means *this target enforces limits, and\n * cannot carry THIS one*. An operator reading the first looks for another target; an operator\n * reading the second changes the key.\n */\nexport class UnserialisableRateLimitError extends Error {\n  override readonly name = 'UnserialisableRateLimitError'\n  constructor(\n    readonly target: string,\n    readonly reason: string,\n    ways: readonly string[],\n  ) {\n    super(\n      [\n        `Refusing to build for \\`${target}\\`: theo.config.ts declares a rate limit this target cannot carry.`,\n        ``,\n        `  ${reason}`,\n        ``,\n        `  Ways forward:`,\n        ...ways.map((w) => `    • ${w}`),\n        ``,\n        `  This refuses rather than dropping the key, because a rate limit that silently does not`,\n        `  apply looks exactly like one that does (usetheokit/theokit#461, #508).`,\n      ].join('\\n'),\n    )\n  }\n}\n\n/** The base shape every accepted config narrows to: a window, a ceiling, and an IP key. */\ninterface BakeableRateLimit {\n  windowMs: number\n  max: number\n  /**\n   * How many proxies sit in front of the app, for the forwarded-header path. Dropped before the\n   * entry until B-027: the schema declares it (`config/schemas/rate-limit.ts:36`) and the generated\n   * code could not honour it, so a deployment behind a proxy keyed every visitor on the proxy.\n   */\n  trustProxy: boolean | number\n  /**\n   * B-257 — the durable counter the entry constructs, or `undefined` for the in-process default.\n   *\n   * A reference rather than an instance: this is baked into a generated file, so it must survive\n   * being written as source. `factory` is the one field that cannot be escaped — see\n   * `bakeableStore` below.\n   */\n  store?: BakeableStore\n}\n\n/** A durable store named by `theo.config.ts`, in the form a generated entry can construct. */\ninterface BakeableStore {\n  /** The specifier the entry imports from. Written through `JSON.stringify`. */\n  module: string\n  /** The exported name it constructs. VALIDATED, never escaped — it becomes a bare identifier. */\n  factory: string\n  /** Constructor options. Written through `JSON.stringify`. */\n  options?: Record<string, string | number | boolean>\n}\n\n/**\n * A JavaScript identifier, and nothing else.\n *\n * `factory` becomes a bare identifier in `import { <factory> } from …`, where `JSON.stringify` would\n * emit `import { \"x\" }` and not parse. So it cannot be escaped — only validated. Without this, a\n * `theo.config.ts` carrying `factory: \"x } from 'evil'; //\"` writes arbitrary code into every\n * generated entry, and that file usually arrives with the clone.\n */\nconst IDENTIFIER = /^[A-Za-z_$][\\w$]*$/\n\n/**\n * The words that are well-formed identifiers and cannot be BOUND.\n *\n * `IDENTIFIER` answers \"could this be a name?\"; the emitter needs \"can this be THIS name?\", and the\n * two differ on exactly this set. `factory` lands as a bare binding in\n * `import { <factory> } from '<module>'`, where `import { default }` is a SyntaxError — so a config\n * naming one produces a generated entry that does not parse, and the deploy fails pointing at the\n * emitted file rather than at the line that caused it.\n *\n * `default` is the one a real config reaches by accident, because `export default createStore` is\n * the ordinary shape of the module being named. The rest are here because the cost of the list is\n * one comparison and the cost of an omission is a deploy that fails somewhere else.\n *\n * Reserved words only. `defaultStore` is a legal binding, and a substring match would refuse it —\n * an over-correction that breaks working configs to protect against a shape they do not have.\n */\nconst NOT_BINDABLE = new Set([\n  'await',\n  'break',\n  'case',\n  'catch',\n  'class',\n  'const',\n  'continue',\n  'debugger',\n  'default',\n  'delete',\n  'do',\n  'else',\n  'enum',\n  'export',\n  'extends',\n  'false',\n  'finally',\n  'for',\n  'function',\n  'if',\n  'import',\n  'in',\n  'instanceof',\n  'new',\n  'null',\n  'return',\n  'super',\n  'switch',\n  'this',\n  'throw',\n  'true',\n  'try',\n  'typeof',\n  'var',\n  'void',\n  'while',\n  'with',\n  'yield',\n])\n\n/**\n * Refuse a `store` a generated entry could not construct — or could construct into a hole.\n *\n * Extracted from `bakeableRateLimit` because it is its own responsibility and because inlining it\n * took that function to a cyclomatic complexity of 18 against a ceiling of 15. The three refusals\n * are one question asked of three fields, which is the shape SRP asks for.\n *\n * The third is the one that cannot be solved by escaping. `module` and `options` are written through\n * `JSON.stringify`, as `trustProxy` already is at the emit site. `factory` lands as a BARE\n * IDENTIFIER in `import { <factory> } from …`, where a quoted string does not parse — so it is\n * validated, and a config that fails the check is refused by name rather than interpolated raw.\n */\nfunction assertBakeableStore(store: unknown, target: string): void {\n  if (store === undefined) return\n\n  if (!isStoreShaped(store)) {\n    throw new UnserialisableRateLimitError(\n      target,\n      '`security.rateLimit.store` must be an object naming a module and a factory.',\n      [\n        \"declare `store: { module: '@upstash/redis', factory: 'Redis' }`\",\n        'omit `store` and let the build refuse this target, which is honest about not limiting',\n      ],\n    )\n  }\n\n  const { module: mod, factory } = store as Record<string, unknown>\n\n  if (typeof mod !== 'string' || mod.length === 0) {\n    throw new UnserialisableRateLimitError(\n      target,\n      '`security.rateLimit.store.module` must be the specifier the entry imports from.',\n      [\"declare `module: '@upstash/redis'`\", 'omit `store`'],\n    )\n  }\n\n  if (typeof factory !== 'string' || !IDENTIFIER.test(factory) || NOT_BINDABLE.has(factory)) {\n    throw new UnserialisableRateLimitError(\n      target,\n      '`security.rateLimit.store.factory` must be a plain identifier — it is written into the ' +\n        'generated entry as `import { <factory> }`, where a quoted string would not parse, so it ' +\n        'is validated rather than escaped. Anything else would put arbitrary source in every ' +\n        'deployment this config builds.',\n      [\n        \"name the export directly: `factory: 'Redis'`\",\n        'omit `store` and let the build refuse this target',\n      ],\n    )\n  }\n\n  // `options` is typed `Record<string, string | number | boolean>` and the type is erased before\n  // this runs, so the declaration protects nobody: the value arrives from a config file. Three\n  // measured escapes, and the third is why this is a refusal rather than a comment —\n  // `JSON.stringify` throws a raw TypeError naming JSON on a BigInt and on a cycle, and on a\n  // FUNCTION it throws nothing and omits the key. The option was then simply absent from the\n  // emitted entry, with no diagnostic: a store configured and not configured, which is the same\n  // silence this whole feature exists to remove.\n  const { options } = store as Record<string, unknown>\n  if (options !== undefined) {\n    if (typeof options !== 'object' || options === null || Array.isArray(options)) {\n      throw new UnserialisableRateLimitError(\n        target,\n        '`security.rateLimit.store.options` must be an object of scalar values.',\n        [\n          \"declare `options: { url: 'redis://…', retries: 3 }`\",\n          'omit `options` and configure the store inside the factory',\n        ],\n      )\n    }\n\n    const offending = Object.entries(options as Record<string, unknown>).find(\n      ([, v]) => typeof v !== 'string' && typeof v !== 'number' && typeof v !== 'boolean',\n    )\n    if (offending !== undefined) {\n      throw new UnserialisableRateLimitError(\n        target,\n        `\\`security.rateLimit.store.options.${offending[0]}\\` must be a string, number or boolean.`,\n        [\n          'declare scalars only — strings, numbers and booleans',\n          'move anything else into the factory itself, which the generated entry calls at runtime',\n        ],\n      )\n    }\n  }\n}\n\n/**\n * The ONE predicate both sides read — the call emitter here and `assertBakeableStore`'s first\n * refusal. They were two, differing on arrays: this one accepted `store: []` while the refusal\n * rejected it, so the declaration threw while the call side would still have emitted `await`. The\n * build refused first, so no bad entry reached disk — and the pair exists to agree BY CONSTRUCTION\n * rather than because one check happens to run earlier.\n */\nfunction isStoreShaped(store: unknown): boolean {\n  return typeof store === 'object' && store !== null && !Array.isArray(store)\n}\n\n/**\n * Narrow a declared rate limit to what a deployed entry can actually enforce, or refuse by name.\n *\n * Accepts the base `{ windowMs, max }` and the explicit `keyBy: 'ip'`, which is what the address\n * resolution below can key. Everything else throws:\n *\n * - a **function** `keyBy` has no literal — the same wall `deployed-cors.ts` hits on a callback\n *   origin, and refused for the same reason;\n * - `keyBy: 'session' | 'user'` needs a session the deployed entry does not resolve at the point\n *   the limit runs, which is before routing;\n * - `routes` needs the matched route, decided after this check. Refusing it is honest today and is\n *   the natural next slice.\n */\nfunction bakeableRateLimit(\n  rateLimit: RateLimitConfig | undefined,\n  target: string,\n): BakeableRateLimit | undefined {\n  if (rateLimit === undefined) return undefined\n  const cfg = rateLimit as Record<string, unknown>\n\n  if (typeof cfg.keyBy === 'function') {\n    throw new UnserialisableRateLimitError(\n      target,\n      '`security.rateLimit.keyBy` is a function, and a deployed entry has no literal for a closure.',\n      [\n        \"use `keyBy: 'ip'` (the default), which this target resolves from the connection\",\n        'build for `node` and run `theokit start`, which can call the function',\n      ],\n    )\n  }\n  if (cfg.keyBy === 'session' || cfg.keyBy === 'user') {\n    throw new UnserialisableRateLimitError(\n      target,\n      `\\`security.rateLimit.keyBy: '${cfg.keyBy}'\\` needs a resolved session, and the limit runs before routing.`,\n      [\n        \"use `keyBy: 'ip'`, which is resolvable at that point\",\n        'build for `node` and run `theokit start`',\n      ],\n    )\n  }\n  assertBakeableStore(cfg.store, target)\n\n  if (cfg.routes !== undefined) {\n    throw new UnserialisableRateLimitError(\n      target,\n      '`security.rateLimit.routes` needs the matched route, which is decided after the limit runs here.',\n      [\n        'declare a single global limit (`windowMs` + `max`)',\n        'build for `node` and run `theokit start`, which applies per-route limits',\n      ],\n    )\n  }\n\n  const windowMs = cfg.windowMs\n  const max = cfg.max\n  if (typeof windowMs !== 'number' || typeof max !== 'number') return undefined\n  // `?? false` and not `|| false`: `trustProxy: 0` is a number and falsy, and it means the same to\n  // the resolver as `false` — but emitting `false` where the operator wrote `0` makes the generated\n  // entry disagree with the config a reader compares it against.\n  const trustProxy = cfg.trustProxy\n  return {\n    windowMs,\n    max,\n    trustProxy:\n      typeof trustProxy === 'boolean' || typeof trustProxy === 'number' ? trustProxy : false,\n    // Validated above — `module` and `options` are escaped at emit time, `factory` was checked\n    // against IDENTIFIER because it cannot be.\n    store: cfg.store as BakeableStore | undefined,\n  }\n}\n\n/**\n * The generated declarations and helper for a target that keys on the connection's peer address.\n *\n * `addressExpression` is the per-runtime half the issue calls out — the one thing that genuinely\n * differs between targets. Bun passes `server`; a future Deno slice would pass its\n * `ServeHandlerInfo`. Everything else here is shared.\n *\n * Returns `[]` when nothing was declared, so an app without a limit emits no limiter at all rather\n * than an inert one.\n */\nexport function deployedRateLimitFragment(\n  rateLimit: RateLimitConfig | undefined,\n  target: string,\n  addressExpression: string,\n  /**\n   * The parameter list `callerAddress` is DECLARED with, because the runtime source differs per\n   * target and only `bun` binds these two names (`bun.ts:158`). `cloudflare.ts:452` binds\n   * `(request, env, ctx)`, `vercel.ts:39` `(nodeReq, nodeRes)`, `netlify.ts:84` `(request, context)`,\n   * `deno-deploy.ts:90` `(request)` and `aws-lambda.ts:152` `(event)`. An expression naming\n   * `context`, `info`, `event` or `nodeReq` inside a function declared `(request, server)` is an\n   * unbound identifier, and the entry throws on the first limited request.\n   */\n  params = 'request, server',\n  /**\n   * The specifier prefix this target needs — `'npm:'` on Deno Deploy, empty everywhere else.\n   *\n   * B-257: this function now emits its OWN import for the durable limiter, rather than relying on\n   * each adapter to remember one. The previous shape had THREE sides to keep in step — the\n   * declaration here, the call in `rateLimitCheckFragment`, and a per-adapter import line — and the\n   * third was not joined: six adapters imported `createRateLimiterWeb` and none imported\n   * `createDurableRateLimiterWeb`, so a store-carrying entry referenced a free variable and would\n   * have thrown `ReferenceError` while evaluating its module body. Not at the first limited request:\n   * at LOAD, taking down every route including those declaring no limit.\n   *\n   * `cloudflare.ts:370-373` documents that exact defect from B-027, one symbol earlier. Owning the\n   * import here is what stops a fourth recurrence.\n   */\n  importPrefix = '',\n): string[] {\n  const baked = bakeableRateLimit(rateLimit, target)\n  if (baked === undefined) return []\n  return [\n    `// #508 — the limit the app declared, carried as a literal because a deployed entry has no`,\n    `// theo.config.ts to read.`,\n    `//`,\n    `// WHERE THIS COUNTER LIVES, and it is not the same answer per target. On a long-lived server`,\n    `// (\\`bun\\`) the process outlives a request and the count holds. On a per-invocation or`,\n    `// per-isolate runtime — Cloudflare, AWS Lambda, Netlify, Vercel, Deno Deploy — it does not:`,\n    `// the limit is PER INSTANCE, and a caller spread across instances gets that many budgets.`,\n    `// The address is resolved correctly either way; the counting is what B-257 is about, and`,\n    `// \\`theokit build\\` refuses a declared limit on those five until it is.`,\n    // B-262 — ONE builder, one signature, always async. The emitter used to branch here:\n    // `createRateLimiterWeb` returns a value and `createDurableRateLimiterWeb` returns a Promise, so\n    // the CALL SITE had to know which it got and emit `await` or not. A call site whose shape changes\n    // with the config is what produced B-257's missing `await`, and `buildRateLimiter` removes the\n    // decision rather than documenting it.\n    `import { buildRateLimiter } from '${importPrefix}theokit/server/rate-limit'`,\n    ...(baked.store === undefined\n      ? [\n          `const RATE_LIMIT = buildRateLimiter({ windowMs: ${baked.windowMs}, max: ${baked.max} }, undefined)`,\n        ]\n      : [\n          // B-257 — a durable counter, named by the app. `module` and the options are JSON literals;\n          // `factory` was validated against IDENTIFIER at bake time because it lands here as a bare\n          // identifier and no escape can make that safe.\n          //\n          // The limiter's own import is emitted HERE rather than by each adapter. See `importPrefix`.\n          `import { ${baked.store.factory} } from ${JSON.stringify(baked.store.module)}`,\n          `const RATE_LIMIT_STORE = new ${baked.store.factory}(${JSON.stringify(baked.store.options ?? {})})`,\n          `const RATE_LIMIT = buildRateLimiter(`,\n          `  { windowMs: ${baked.windowMs}, max: ${baked.max} },`,\n          `  RATE_LIMIT_STORE,`,\n          `)`,\n        ]),\n    ``,\n    `// How many proxies the deployment declared in front of it. \\`client-ip.ts\\` reads a forwarded`,\n    `// header only when this says one wrote it: the header is whatever the client typed, so`,\n    `// trusting it unasked lets anyone rotate a forged value past the limiter with one \\`curl -H\\`.`,\n    `const TRUST_PROXY = ${JSON.stringify(baked.trustProxy)}`,\n    ``,\n    `/**`,\n    ` * The caller's address, from the connection rather than from a header.`,\n    ` *`,\n    ` * A header a client can set is a key a client can choose, which makes the bucket theirs to`,\n    ` * split. An address this runtime cannot resolve returns \\`undefined\\`, and the caller answers`,\n    ` * 503 rather than keying on a constant: one shared bucket is a budget the first caller each`,\n    ` * window exhausts for everyone, which is worse than no limiting at all.`,\n    ` */`,\n    `const addr = (v) => (typeof v === 'string' && v.trim() !== '' ? v.trim() : undefined)`,\n    `function callerAddress(${params}) {`,\n    `  return addr(${addressExpression})`,\n    `}`,\n    ``,\n    `/** The 503 a caller this runtime cannot name gets, instead of everyone's shared bucket. */`,\n    `function unnamedCaller() {`,\n    `  return new Response(`,\n    `    JSON.stringify({ error: { code: 'CALLER_UNRESOLVED', message: ${JSON.stringify(\n      `${target} could not resolve the caller's address, and a rate limit keyed on a constant is a denial of service`,\n    )} } }),`,\n    `    { status: 503, headers: { 'Content-Type': 'application/json' } },`,\n    `  )`,\n    `}`,\n    ``,\n    `/** The 429 a limited caller gets, carrying the limiter's own headers. */`,\n    `function rateLimited(result) {`,\n    `  return new Response(JSON.stringify({ error: { code: 'RATE_LIMITED', message: 'Too many requests' } }), {`,\n    `    status: 429,`,\n    `    headers: { 'Content-Type': 'application/json', ...result.headers },`,\n    `  })`,\n    `}`,\n  ]\n}\n\n/**\n * The check itself, as generated source, placed inside the runtime's request handler.\n *\n * Extracted for the reason `bun.ts` extracts its other fragments: the emitter is one array literal,\n * so every line the entry gains counts against `max-lines-per-function`, and this one pushed it\n * past the ceiling.\n *\n * Runs AFTER the CORS preflight and BEFORE routing: a limited caller should not reach a handler,\n * and a browser still needs its CORS answer to read the 429 as a 429 rather than as a network\n * failure.\n */\nexport function rateLimitCheckFragment(\n  rateLimit: RateLimitConfig | undefined,\n  indent: string,\n  /** The arguments `callerAddress` is CALLED with — see `deployedRateLimitFragment`'s `params`. */\n  args = 'request, server',\n  /** How this target answers a caller over its budget. Only `bun` can use the default. */\n  refuse = 'return withCors(request, withSecurityHeaders(rateLimited(limit), SECURITY_HEADERS))',\n  /** How it answers a caller it could not name. Same shape, different body. */\n  refuseUnnamed = 'return withCors(request, withSecurityHeaders(unnamedCaller(), SECURITY_HEADERS))',\n): string[] {\n  if (rateLimit === undefined) return []\n  return [\n    `${indent}const caller = callerAddress(${args})`,\n    `${indent}if (caller === undefined) {`,\n    `${indent}  ${refuseUnnamed}`,\n    `${indent}}`,\n    // B-257 — the call side of the pair. `deployedRateLimitFragment` emits the DECLARATION; this\n    // emits the CALL, and the two branch on the same fact or the entry names a symbol it never\n    // declared. A durable limiter returns a promise; the sync facade does not.\n    // B-262 — `await` unconditionally. `buildRateLimiter` is always async, so this line no longer\n    // asks what the config declared. The conditional it replaces is where B-257's defect lived:\n    // a Promise read for `limited` is always `undefined`, always falsy, and every request passes.\n    `${indent}const limit = await RATE_LIMIT(caller)`,\n    `${indent}if (limit.limited) {`,\n    `${indent}  ${refuse}`,\n    `${indent}}`,\n  ]\n}\n","/**\n * The configuration a deployed entry could not apply (usetheokit/theokit#425).\n *\n * ## Why this is not another literal renderer\n *\n * `deployed-csrf.ts` and `deployed-cors.ts` bake their values into the emitted source, which works\n * because `csrf` is an enum and `disallowed` is a `{ routes, behavior }` object — plain data, and a\n * deployed function has no `theo.config.ts` to read.\n *\n * The two concerns left over from #410 turn out to be different from each other, and the difference\n * is the whole design:\n *\n * - **`serialization` is plain data too.** The config field is `z.enum(['json', 'superjson'])`\n *   (`config/schema.ts:147`) — a selector, not a transformer. `resolveTransformer` turns it into the\n *   functions, and it already ships from `theokit/server`. So this half is a literal like the rest,\n *   and the deployed entry resolves it exactly the way `theokit start` does\n *   (`cli/commands/start/index.ts:108`), from the same string, through the same function.\n * - **`plugins` genuinely carries functions.** A plugin is constructed in `theo.config.ts` and there\n *   is no literal for a closure, so this half needs the entry to import a module instead.\n *\n * ## Static import, not `import()` in the request path\n *\n * The tempting shortcut is `await import('../../theo.config.js')` inside the handler. It trades a\n * silent failure for a louder one on targets with no filesystem, and it moves configuration\n * resolution into every request on the targets that do have one.\n *\n * What this emits instead is a TOP-LEVEL import of a module the build already resolved and wrote\n * beside the entry — the same shape `renderBakedRoutes` uses for route modules (#369): decide on\n * the build machine, emit a static specifier. It is evaluated once at module load, the target's\n * bundler can see through it, and a plugin that needs an API the target lacks fails the build\n * rather than the first request.\n *\n * ## Why each half is optional\n *\n * An app that declares neither concern must produce the entry it produced before this existed.\n * Importing a module the build did not emit fails at load, and spreading an empty object costs an\n * allocation per request for nothing. So an empty request renders to nothing at all, and the\n * caller's `executeRoute` literal is unchanged.\n *\n * The halves are independent on purpose: an app that only picks `superjson` must not be made to\n * carry a plugins module, and an app with plugins and default JSON must not gain a transformer\n * lookup. Coupling them would have made the common case pay for the rare one.\n */\n\n/**\n * The option every Web-standards adapter grows to carry non-serialisable configuration.\n *\n * Composed into each adapter's option type the way `DeployedCsrfOptions` already is, so the six\n * targets cannot drift into six spellings of the same field.\n */\n/**\n * The project's `serverDir`, carried into every generated entrypoint (#RFC server-layout).\n *\n * Separate from the other option groups because it is not a runtime feature toggle: it is the\n * project's own layout, and an adapter that hardcodes `'server'` agrees with the default by\n * COINCIDENCE. The moment a project sets the option — the entire point of it existing — the\n * generated entrypoint resolves a directory that is not there, and only after deploy: the build\n * succeeds, the bundle is written, and routes 404 in production with nothing naming the cause.\n */\nexport interface DeployedServerDirOptions {\n  /** Project-relative server directory. Absent ⇒ the schema default, `server`. */\n  serverDir?: string\n}\n\n/**\n * The server directory as a quoted TypeScript literal, ready to interpolate into generated source.\n *\n * `JSON.stringify` rather than wrapping in quotes by hand: the value reaches this from user config,\n * so a directory containing a quote or a backslash would otherwise emit a syntax error into\n * somebody else's build — a worse failure than the one this fixes.\n */\nexport function serverDirLiteral(opts: DeployedServerDirOptions): string {\n  return JSON.stringify(opts.serverDir ?? 'server')\n}\n\n/**\n * The agents directory, same shape and same reason as `serverDir` above.\n *\n * `scanAgents(projectRoot, agentsDirName = 'agents')` takes the name as its SECOND parameter\n * (`server/scan/agent-scan.ts:56`). Nine call sites pass the configured value; the generated\n * deploy entry was the only one that did not, so the default won and a project whose agents live\n * under the documented `core/agents` (`config/schema.ts:66`) served none of them — 404 per agent,\n * after deploy, with nothing naming the cause. Measured 2026-09-21 by executing `buildBun`\n * against a config carrying both directories and reading what it emitted.\n */\nexport interface DeployedAgentsDirOptions {\n  /** Project-relative agents directory. Absent ⇒ the schema default, `agents`. */\n  agentsDir?: string\n}\n\nexport function agentsDirLiteral(opts: DeployedAgentsDirOptions): string {\n  return JSON.stringify(opts.agentsDir ?? 'agents')\n}\n\nexport interface DeployedRuntimeConfigOptions {\n  /**\n   * Specifier of the plugins module the build wrote beside the entry, or `undefined` when the app\n   * declares no plugins and the build wrote none.\n   */\n  runtimeConfigModule?: string\n  /**\n   * The app's `serialization` selector, carried as a literal.\n   *\n   * `'json'` and `undefined` both mean the default, and neither emits anything: `executeRoute`\n   * already falls back to `JSON.stringify`, and the `x-theo-transformer` header is deliberately\n   * absent for the default so a client is told only when there is something to be told.\n   */\n  serialization?: 'json' | 'superjson'\n}\n\n/** The three places an entry has to grow to carry non-serialisable configuration. */\nexport interface DeployedRuntimeConfigFragment {\n  /** Top-level imports. Empty when the build emitted no config module. */\n  readonly imports: string[]\n  /** Module-scope declarations — evaluated once, at load. Empty when there is nothing to carry. */\n  readonly declarations: string[]\n  /**\n   * Spread into the entry's `executeRoute({ … })` literal, inside an async function.\n   *\n   * Empty string when there is nothing to carry, so the call site keeps the exact shape it had.\n   */\n  readonly executeRouteSpread: string\n}\n\nconst EMPTY: DeployedRuntimeConfigFragment = {\n  imports: [],\n  declarations: [],\n  executeRouteSpread: '',\n}\n\n/**\n * What a deployed entry needs in order to apply `config.plugins` and `config.serialization`.\n *\n * @param moduleSpecifier - specifier of the runtime-config module the build emitted beside the\n *   entry, or `undefined` when the app declared neither concern and the build emitted none.\n */\nexport function deployedRuntimeConfigFragment(\n  options: DeployedRuntimeConfigOptions | undefined,\n): DeployedRuntimeConfigFragment {\n  const pluginsModule = options?.runtimeConfigModule\n  // 'json' is the default and emits nothing — see `serialization` above.\n  const serialization = options?.serialization === 'superjson' ? 'superjson' : undefined\n  if (pluginsModule === undefined && serialization === undefined) return EMPTY\n\n  const imports: string[] = []\n  const declarations: string[] = []\n  const spread: string[] = []\n\n  if (pluginsModule !== undefined) {\n    imports.push(\n      `import { createPluginRunnerFromConfig } from 'theokit/server/plugins'`,\n      `// #425 — the app's own plugins, resolved on the build machine and written beside this entry.`,\n      `// A closure has no literal, so this is an import rather than a baked value.`,\n      `import theoRuntimeConfig from '${pluginsModule}'`,\n    )\n    declarations.push(\n      `// Built ONCE, at module load. A runner rebuilt per request would re-run every plugin's`,\n      `// \\`register\\`, which is where a plugin allocates the state its hooks then read.`,\n      `const THEO_PLUGIN_RUNNER = createPluginRunnerFromConfig(theoRuntimeConfig.plugins)`,\n    )\n    // Awaited, not passed along: `createPluginRunnerFromConfig` is async because `register` is, and\n    // a pending promise handed to `executeRoute` is a truthy object with none of the runner's\n    // methods — every hook would silently not fire, which is this issue's own defect one layer in.\n    spread.push(`pluginRunner: await THEO_PLUGIN_RUNNER`)\n  }\n\n  if (serialization !== undefined) {\n    imports.push(`import { resolveTransformer } from 'theokit/server/http'`)\n    declarations.push(\n      `// #425 — a literal, because \\`config.serialization\\` is a SELECTOR and not a transformer.`,\n      `// Same string, same function \\`theokit start\\` calls, so the deployed response and the local`,\n      `// one cannot disagree about what the app asked for — including the \\`x-theo-transformer\\``,\n      `// header, whose absence is what made this a data bug rather than a formatting one.`,\n      `const THEO_TRANSFORMER = resolveTransformer('${serialization}')`,\n    )\n    spread.push(`transformer: THEO_TRANSFORMER`)\n  }\n\n  return { imports, declarations, executeRouteSpread: `${spread.join(', ')},` }\n}\n","/**\n * The request id a deployed entry uses, and the header it echoes back.\n *\n * ## The defect this closes\n *\n * Every generated entry minted a fresh `randomUUID()` per request and set no correlation header\n * at all on a success path (usetheokit/theokit#410). Both Node paths do the opposite: they resolve\n * an incoming `traceparent` / `x-request-id` through `extractTraceId` and echo the result under\n * both `x-request-id` and `x-trace-id` (`cli/commands/start/request-handler.ts`,\n * `vite-plugin/api-middleware.ts`).\n *\n * The consequence is that a trace crossing into a deployed function starts over. The caller's id\n * is discarded, and the response carries nothing to correlate against — so a request that fails in\n * production cannot be tied to the client that made it, which is the one situation the id exists\n * for.\n *\n * ## Why `setHeader` before the handler, rather than wrapping the response\n *\n * It is what the Node path does, and the shim reproduces Node's semantics exactly: `writeHead`\n * MERGES into the header map rather than replacing it (`web-shim.ts`), so a header set here\n * survives the handler's own `writeHead` and a handler that sets its own id still wins. Wrapping\n * the finished `Response` instead would have to mutate a response whose body is already streaming\n * (#382), and would miss the branches that return before the shim is built.\n */\n\n/**\n * Lines that resolve the request id and echo it, as generated source.\n *\n * @param requestVar - the name the entry gave the Web `Request` in scope\n * @param indent - leading whitespace, so the emitted file stays readable\n */\nexport function deployedTraceFragment(requestVar: string, indent: string): string[] {\n  return [\n    `${indent}// #410 — honour the caller's trace id instead of minting a new one, and echo it.`,\n    `${indent}// \\`extractTraceIdFromRequest\\` validates the caller-controlled \\`x-request-id\\``,\n    `${indent}// before trusting it, and falls back to a fresh UUID when neither header is present.`,\n    `${indent}const requestId = extractTraceIdFromRequest(${requestVar})`,\n    `${indent}res.setHeader('x-request-id', requestId)`,\n    `${indent}res.setHeader(TRACE_HEADER, requestId)`,\n  ]\n}\n"],"mappings":";;;;;;;AAgEA,IAAM,QAAgC,EAAE,SAAS,CAAC,GAAG,cAAc,CAAC,GAAG,QAAQ,CAAC,GAAG,YAAY,GAAG;AAqHlG,IAAM,kBAAkB;AAAA,EACtB;AAAA,EACA;AACF;AAGA,IAAM,eAAe;AAYrB,IAAM,oBAAoB;AAuBnB,SAAS,uBAAuBA,mBAAiD;AACtF,SAAO;AAAA,IACL,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAAA;AAAA,IACA,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,cAAc;AAAA,EAChB;AACF;AAQO,IAAM,0BAA0B;AAEhC,SAAS,uBACd,QACA,OAA2B,CAAC,GACJ;AACxB,MAAI,WAAW,OAAW,QAAO;AACjC,MAAI,OAAO,SAAS,WAAW,OAAO,OAAO,WAAW,EAAG,QAAO;AAElE,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,UAAU,KAAK,WAAW;AAChC,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,SAAS,KAAK,gBAAgB;AAEpC,QAAM,aACJ,OAAO,SAAS,UACZ,gBAAgB,OAAO,QAAQ,OAAO,eAAe,KAAK,kBAAkB,OAAO,IACnF,kBAAkB,EAAE,GAAG,QAAQ,kBAAkB,KAAK,kBAAkB,QAAQ,CAAC;AAEvF,SAAO;AAAA,IACL,YAAY,8BAA8B,QAAQ;AAAA,IAClD,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMP,iFAAiF,WAAW,cAAc,GAAG,OAAO,SAAS,SAAS,iBAAiB,EAAE,YAAY,MAAM;AAAA,MAC3K,GAAG,WAAW;AAAA,IAChB;AAAA,IACA,cAAc;AAAA,MACZ,GAAG,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAed,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAeP;AAAA,MACA,GAAG,WAAW;AAAA,MACd;AAAA,MACA;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS,QAAQ,eAAe,KAAK,UAAU,YAAY,CAAC;AAAA,MAC5D,SAAS,QAAQ,eAAe,KAAK,UAAU,iBAAiB,CAAC;AAAA,MACjE;AAAA,MACA,GAAG,WAAW;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,mEAAmE,QAAQ;AAAA,MAC3E;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK,wBAAwB,OACzB,sEACA;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc,QAAQ,eAAe,KAAK,UAAU,YAAY,CAAC,aAAa,QAAQ;AAAA,MACtF,2BAA2B,QAAQ,UAAU,OAAO,aAAa,MAAM,CAAC;AAAA,MACxE,GAAG,WAAW;AAAA,MACd;AAAA,MACA;AAAA,MACA,uCAAuC,QAAQ;AAAA,MAC/C;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK,wBAAwB,OACzB,sEACA;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACF;AAoCA,SAAS,gBACP,QACA,eACA,kBACA,SACiB;AACjB,QAAM,QAAQ,CAAC,UAA0B,cAAc,OAAO,KAAK,CAAC;AACpE,SAAO;AAAA,IACL,SAAS;AAAA,MACP,GAAG,OAAO,IAAI,CAAC,OAAO,UAAU,eAAe,MAAM,KAAK,CAAC,gBAAgB,MAAM,QAAQ,GAAG;AAAA;AAAA,MAE5F,GAAI,kBAAkB,SAClB,CAAC,IACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAgBE,6CAA6C,aAAa;AAAA,MAC5D;AAAA,IACN;AAAA,IACA,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAG,OAAO,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,UAAU,MAAM,IAAI,CAAC,KAAK,MAAM,KAAK,CAAC,GAAG;AAAA,MACnF;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAG,OAAO;AAAA,QACR,CAAC,UACC,iBAAiB,KAAK,UAAU,MAAM,QAAQ,CAAC,gBAAgB,KAAK,UAAU,MAAM,SAAS,CAAC,WAAW,KAAK,UAAU,MAAM,IAAI,CAAC;AAAA,MACvI;AAAA,MACA;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,gBAAgB,kBAAkB,SAAY,KAAK;AAAA,IACnD,UACE,kBAAkB,SACd;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MASA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,oBAAoB,WAAW;AAAA,MACtC;AAAA,IACF;AAAA,IACN,YAAY;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,oBAAoB,OAAO;AAAA,MAC3B,GAAG;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;AAGA,SAAS,kBAAkB,QAQP;AAGlB,QAAM,eAAe,OAAO,qBAAqB,SAAY,KAAK,KAAK,OAAO,gBAAgB;AAE9F,SAAO;AAAA,IACL,SAAS,CAAC;AAAA,IACV,cAAc;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN;AAAA,MACA,iEAAiE,OAAO,UAAU;AAAA,IACpF;AAAA,IACA,gBAAgB,OAAO,cAAc,SAAY,KAAK;AAAA,IACtD,UACE,OAAO,cAAc,SACjB,CAAC,0CAA0C,IAC3C;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,mBAAmB,OAAO,UAAU;AAAA,MACpC,kBAAkB,OAAO,SAAS;AAAA,MAClC,qBAAqB,OAAO,oBAAoB,WAAW;AAAA,MAC3D;AAAA,IACF;AAAA,IACN,YAAY;AAAA,MACV,GAAI,OAAO,iBAAiB,SAAY,CAAC,IAAI,CAAC,SAAS,OAAO,YAAY,EAAE;AAAA,MAC5E;AAAA,MACA;AAAA,MACA;AAAA,MACA,oDAAoD,OAAO,WAAW,GAAG,YAAY;AAAA,MACrF;AAAA,MACA;AAAA,MACA,uBAAuB,OAAO,UAAU;AAAA,MACxC,oBAAoB,OAAO,OAAO;AAAA,MAClC,GAAG;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;;;AC9fO,IAAM,gCAAN,cAA4C,MAAM;AAAA,EACvD,YAAY,QAAgB;AAC1B;AAAA,MACE,kDAAkD,MAAM;AAAA,IAI1D;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAGA,SAAS,aAAa,QAAiB,QAAwB;AAC7D,MAAI,OAAO,WAAW,WAAY,OAAM,IAAI,8BAA8B,MAAM;AAChF,MAAI,kBAAkB,OAAQ,QAAO,OAAO,MAAM;AAClD,MAAI,MAAM,QAAQ,MAAM,EAAG,QAAO,IAAI,OAAO,IAAI,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC;AAC3F,SAAO,KAAK,UAAU,MAAM;AAC9B;AAWO,SAAS,0BAA0B,MAA8B,QAAwB;AAC9F,MAAI,SAAS,OAAW,QAAO;AAE/B,QAAM,QAAQ,CAAC,YAAY,aAAa,KAAK,SAAS,MAAM,CAAC,EAAE;AAC/D,MAAI,KAAK,YAAY,OAAW,OAAM,KAAK,YAAY,KAAK,UAAU,KAAK,OAAO,CAAC,EAAE;AACrF,MAAI,KAAK,mBAAmB;AAC1B,UAAM,KAAK,mBAAmB,KAAK,UAAU,KAAK,cAAc,CAAC,EAAE;AACrE,MAAI,KAAK,mBAAmB;AAC1B,UAAM,KAAK,mBAAmB,KAAK,UAAU,KAAK,cAAc,CAAC,EAAE;AAGrE,QAAM;AAAA,IACJ,gBAAgB,KAAK,UAAU,KAAK,WAAW,CAAC;AAAA,IAChD,WAAW,KAAK,UAAU,KAAK,MAAM,CAAC;AAAA,EACxC;AAEA,SAAO,KAAK,MAAM,KAAK,IAAI,CAAC;AAC9B;AAQO,SAAS,qBAAqB,MAA8B,QAA0B;AAC3F,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,uBAAuB,0BAA0B,MAAM,MAAM,CAAC;AAAA,IAC9D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;ACxEA,SAAS,mBAAmB,SAAkC;AAC5D,SAAO,mBAAmB,SAAS,OAAO,OAAO,IAAI,KAAK,UAAU,OAAO;AAC7E;AAWO,SAAS,0BAA0B,UAAmD;AAC3F,MAAI,aAAa,OAAW,QAAO;AAEnC,QAAM,QAAkB,CAAC;AACzB,MAAI,SAAS,SAAS,OAAW,OAAM,KAAK,aAAa,KAAK,UAAU,SAAS,IAAI,CAAC,EAAE;AAExF,QAAM,EAAE,WAAW,IAAI;AACvB,MAAI,eAAe,QAAW;AAC5B,UAAM,SAAS,WAAW,OAAO,IAAI,kBAAkB,EAAE,KAAK,IAAI;AAClE,UAAM;AAAA,MACJ,0BAA0B,MAAM,gBAAgB,KAAK,UAAU,WAAW,QAAQ,CAAC;AAAA,IACrF;AAAA,EACF;AAIA,SAAO,MAAM,WAAW,IAAI,OAAO,KAAK,MAAM,KAAK,IAAI,CAAC;AAC1D;AAcO,SAAS,qBACd,MACA,OAAO,uBACG;AACV,SAAO;AAAA,IACL;AAAA,IACA,wDAAwD,IAAI;AAAA,IAC5D;AAAA,IACA;AAAA,IACA,uBAAuB,0BAA0B,IAAI,CAAC;AAAA,EACxD;AACF;;;ACKO,SAAS,4BAA4B,QAAqD;AAC/F,SAAO;AAAA,IACL,mCAAmC,mCAAmC,MAAM,CAAC;AAAA,IAC7E;AAAA,EACF;AACF;AAEO,SAAS,mCACd,SACQ;AACR,SAAO,KAAK,UAAU,WAAW,CAAC,CAAC;AACrC;AAuGO,SAAS,gCAAgC,QAA8C;AAC5F,QAAM,UAAU,qBAAqB,OAAO,mBAAmB,CAAC,GAAG,EAAE,YAAY,KAAK,CAAC;AACvF,QAAM,QAAQ,OAAO,KAAK,OAAO;AACjC,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO,SAAS,OAAO,MAAM;AAAA,EAC/B;AAEA,QAAM,QAAQ;AAAA,IACZ,iDAA4C,OAAO,MAAM,eAAe,MAAM,KAAK,IAAI,CAAC;AAAA,EAC1F;AACA,QAAM,WAAW,MAAM,KAAK,CAAC,SAAS,KAAK,WAAW,yBAAyB,CAAC;AAChF,MAAI,YAAY,CAAC,OAAO,YAAY;AAClC,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,oBAAoB,uBAAuB;AACpD,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,oBAAoB,sBAAsB;AACnD,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;;;AClNO,IAAM,+BAAN,cAA2C,MAAM;AAAA,EAEtD,YACW,QACA,QACT,MACA;AACA;AAAA,MACE;AAAA,QACE,2BAA2B,MAAM;AAAA,QACjC;AAAA,QACA,KAAK,MAAM;AAAA,QACX;AAAA,QACA;AAAA,QACA,GAAG,KAAK,IAAI,CAAC,MAAM,cAAS,CAAC,EAAE;AAAA,QAC/B;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI;AAAA,IACb;AAhBS;AACA;AAAA,EAgBX;AAAA,EAjBW;AAAA,EACA;AAAA,EAHO,OAAO;AAoB3B;AAwCA,IAAM,aAAa;AAkBnB,IAAM,eAAe,oBAAI,IAAI;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAcD,SAAS,oBAAoB,OAAgB,QAAsB;AACjE,MAAI,UAAU,OAAW;AAEzB,MAAI,CAAC,cAAc,KAAK,GAAG;AACzB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,EAAE,QAAQ,KAAK,QAAQ,IAAI;AAEjC,MAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,GAAG;AAC/C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,CAAC,sCAAsC,cAAc;AAAA,IACvD;AAAA,EACF;AAEA,MAAI,OAAO,YAAY,YAAY,CAAC,WAAW,KAAK,OAAO,KAAK,aAAa,IAAI,OAAO,GAAG;AACzF,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MAIA;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AASA,QAAM,EAAE,QAAQ,IAAI;AACpB,MAAI,YAAY,QAAW;AACzB,QAAI,OAAO,YAAY,YAAY,YAAY,QAAQ,MAAM,QAAQ,OAAO,GAAG;AAC7E,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,YAAY,OAAO,QAAQ,OAAkC,EAAE;AAAA,MACnE,CAAC,CAAC,EAAE,CAAC,MAAM,OAAO,MAAM,YAAY,OAAO,MAAM,YAAY,OAAO,MAAM;AAAA,IAC5E;AACA,QAAI,cAAc,QAAW;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,QACA,sCAAsC,UAAU,CAAC,CAAC;AAAA,QAClD;AAAA,UACE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AASA,SAAS,cAAc,OAAyB;AAC9C,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAeA,SAAS,kBACP,WACA,QAC+B;AAC/B,MAAI,cAAc,OAAW,QAAO;AACpC,QAAM,MAAM;AAEZ,MAAI,OAAO,IAAI,UAAU,YAAY;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,UAAU,aAAa,IAAI,UAAU,QAAQ;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,MACA,gCAAgC,IAAI,KAAK;AAAA,MACzC;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,sBAAoB,IAAI,OAAO,MAAM;AAErC,MAAI,IAAI,WAAW,QAAW;AAC5B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAW,IAAI;AACrB,QAAM,MAAM,IAAI;AAChB,MAAI,OAAO,aAAa,YAAY,OAAO,QAAQ,SAAU,QAAO;AAIpE,QAAM,aAAa,IAAI;AACvB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,YACE,OAAO,eAAe,aAAa,OAAO,eAAe,WAAW,aAAa;AAAA;AAAA;AAAA,IAGnF,OAAO,IAAI;AAAA,EACb;AACF;AAYO,SAAS,0BACd,WACA,QACA,mBASA,SAAS,mBAeT,eAAe,IACL;AACV,QAAM,QAAQ,kBAAkB,WAAW,MAAM;AACjD,MAAI,UAAU,OAAW,QAAO,CAAC;AACjC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,qCAAqC,YAAY;AAAA,IACjD,GAAI,MAAM,UAAU,SAChB;AAAA,MACE,mDAAmD,MAAM,QAAQ,UAAU,MAAM,GAAG;AAAA,IACtF,IACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAME,YAAY,MAAM,MAAM,OAAO,WAAW,KAAK,UAAU,MAAM,MAAM,MAAM,CAAC;AAAA,MAC5E,gCAAgC,MAAM,MAAM,OAAO,IAAI,KAAK,UAAU,MAAM,MAAM,WAAW,CAAC,CAAC,CAAC;AAAA,MAChG;AAAA,MACA,iBAAiB,MAAM,QAAQ,UAAU,MAAM,GAAG;AAAA,MAClD;AAAA,MACA;AAAA,IACF;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,uBAAuB,KAAK,UAAU,MAAM,UAAU,CAAC;AAAA,IACvD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,0BAA0B,MAAM;AAAA,IAChC,iBAAiB,iBAAiB;AAAA,IAClC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,qEAAqE,KAAK;AAAA,MACxE,GAAG,MAAM;AAAA,IACX,CAAC;AAAA,IACD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAaO,SAAS,uBACd,WACA,QAEA,OAAO,mBAEP,SAAS,uFAET,gBAAgB,oFACN;AACV,MAAI,cAAc,OAAW,QAAO,CAAC;AACrC,SAAO;AAAA,IACL,GAAG,MAAM,gCAAgC,IAAI;AAAA,IAC7C,GAAG,MAAM;AAAA,IACT,GAAG,MAAM,KAAK,aAAa;AAAA,IAC3B,GAAG,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOT,GAAG,MAAM;AAAA,IACT,GAAG,MAAM;AAAA,IACT,GAAG,MAAM,KAAK,MAAM;AAAA,IACpB,GAAG,MAAM;AAAA,EACX;AACF;;;ACjaO,SAAS,iBAAiB,MAAwC;AACvE,SAAO,KAAK,UAAU,KAAK,aAAa,QAAQ;AAClD;AAiBO,SAAS,iBAAiB,MAAwC;AACvE,SAAO,KAAK,UAAU,KAAK,aAAa,QAAQ;AAClD;AAgCA,IAAMC,SAAuC;AAAA,EAC3C,SAAS,CAAC;AAAA,EACV,cAAc,CAAC;AAAA,EACf,oBAAoB;AACtB;AAQO,SAAS,8BACd,SAC+B;AAC/B,QAAM,gBAAgB,SAAS;AAE/B,QAAM,gBAAgB,SAAS,kBAAkB,cAAc,cAAc;AAC7E,MAAI,kBAAkB,UAAa,kBAAkB,OAAW,QAAOA;AAEvE,QAAM,UAAoB,CAAC;AAC3B,QAAM,eAAyB,CAAC;AAChC,QAAM,SAAmB,CAAC;AAE1B,MAAI,kBAAkB,QAAW;AAC/B,YAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA,kCAAkC,aAAa;AAAA,IACjD;AACA,iBAAa;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAIA,WAAO,KAAK,wCAAwC;AAAA,EACtD;AAEA,MAAI,kBAAkB,QAAW;AAC/B,YAAQ,KAAK,0DAA0D;AACvE,iBAAa;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,gDAAgD,aAAa;AAAA,IAC/D;AACA,WAAO,KAAK,+BAA+B;AAAA,EAC7C;AAEA,SAAO,EAAE,SAAS,cAAc,oBAAoB,GAAG,OAAO,KAAK,IAAI,CAAC,IAAI;AAC9E;;;ACpJO,SAAS,sBAAsB,YAAoB,QAA0B;AAClF,SAAO;AAAA,IACL,GAAG,MAAM;AAAA,IACT,GAAG,MAAM;AAAA,IACT,GAAG,MAAM;AAAA,IACT,GAAG,MAAM,+CAA+C,UAAU;AAAA,IAClE,GAAG,MAAM;AAAA,IACT,GAAG,MAAM;AAAA,EACX;AACF;","names":["agentsDirLiteral","EMPTY"]}

package/dist/{chunk-6U67SO5U.js → chunk-HK57MPSZ.js}

@@ -13,7 +13,7 @@ import {
   mintRunId,
   parseAgentRequestBody,
   readAgentPolicy
-} from "./chunk-WBB3MEEN.js";
+} from "./chunk-2NG5T77O.js";
 import {
   createServerContext
 } from "./chunk-SYIQV4UH.js";
@@ -570,4 +570,4 @@ export {
   createAgentSubjectResolver,
   createSubjectResolverFromFactory
 };
-//# sourceMappingURL=chunk-6U67SO5U.js.map
+//# sourceMappingURL=chunk-HK57MPSZ.js.map

package/dist/{chunk-R7G2B2WH.js → chunk-HKF6YNY4.js}

@@ -12,42 +12,45 @@ import { extname, join, relative } from "path";
 
 // src/server/scan/detect-agent-policy.ts
 import { createRequire } from "module";
-var require_ = createRequire(import.meta.url);
-var ts = require_("typescript");
+var compiler;
+function ts_() {
+  compiler ??= createRequire(import.meta.url)("typescript");
+  return compiler;
+}
 var POLICY_EXPORT = "policy";
 function hasExportModifier(modifiers) {
   if (!modifiers) return false;
   for (const m of modifiers) {
-    if (m.kind === ts.SyntaxKind.ExportKeyword) return true;
+    if (m.kind === ts_().SyntaxKind.ExportKeyword) return true;
   }
   return false;
 }
 function variableStatementDeclaresPolicy(stmt) {
-  if (!hasExportModifier(ts.getModifiers(stmt))) return false;
+  if (!hasExportModifier(ts_().getModifiers(stmt))) return false;
   return stmt.declarationList.declarations.some(
-    (decl) => ts.isIdentifier(decl.name) && decl.name.text === POLICY_EXPORT
+    (decl) => ts_().isIdentifier(decl.name) && decl.name.text === POLICY_EXPORT
   );
 }
 function exportDeclarationDeclaresPolicy(stmt) {
-  if (!stmt.exportClause || !ts.isNamedExports(stmt.exportClause)) return false;
+  if (!stmt.exportClause || !ts_().isNamedExports(stmt.exportClause)) return false;
   return stmt.exportClause.elements.some((spec) => spec.name.text === POLICY_EXPORT);
 }
 function functionDeclarationDeclaresPolicy(stmt) {
-  return hasExportModifier(ts.getModifiers(stmt)) && stmt.name?.text === POLICY_EXPORT;
+  return hasExportModifier(ts_().getModifiers(stmt)) && stmt.name?.text === POLICY_EXPORT;
 }
 function declaresAgentPolicy(filePath, content) {
-  const sourceFile = ts.createSourceFile(
+  const sourceFile = ts_().createSourceFile(
     filePath,
     content,
-    ts.ScriptTarget.Latest,
+    ts_().ScriptTarget.Latest,
     /* setParentNodes */
     false,
-    ts.ScriptKind.TS
+    ts_().ScriptKind.TS
   );
   for (const stmt of sourceFile.statements) {
-    if (ts.isVariableStatement(stmt) && variableStatementDeclaresPolicy(stmt)) return true;
-    if (ts.isExportDeclaration(stmt) && exportDeclarationDeclaresPolicy(stmt)) return true;
-    if (ts.isFunctionDeclaration(stmt) && functionDeclarationDeclaresPolicy(stmt)) return true;
+    if (ts_().isVariableStatement(stmt) && variableStatementDeclaresPolicy(stmt)) return true;
+    if (ts_().isExportDeclaration(stmt) && exportDeclarationDeclaresPolicy(stmt)) return true;
+    if (ts_().isFunctionDeclaration(stmt) && functionDeclarationDeclaresPolicy(stmt)) return true;
   }
   return false;
 }
@@ -115,4 +118,4 @@ function assertAgentDeclaresPolicy(filePath, agentPath) {
 export {
   scanAgents
 };
-//# sourceMappingURL=chunk-R7G2B2WH.js.map
+//# sourceMappingURL=chunk-HKF6YNY4.js.map