@nexus_js/server 0.7.2 → 0.7.5

package/dist/actions.d.ts

@@ -77,6 +77,12 @@ export interface ActionOptions {
     schema?: {
         parse: (data: unknown) => unknown;
     };
+    /**
+     * Maximum request body size in bytes. Default: 10 MB.
+     * Lower this for actions that only receive small form payloads (e.g. login forms).
+     * Set to 0 to disable the limit (not recommended).
+     */
+    maxBodyBytes?: number;
 }
 export interface ActionResult<T = unknown> {
     data?: T;
@@ -115,6 +121,8 @@ export declare function createAction<TInput = FormData, TOutput = void>(optsOrFn
     handler: ActionFn<TInput, TOutput>;
 }), legacyOpts?: ActionOptions): ActionFn<TInput, TOutput>;
 export declare function registerAction(name: string, fn: ActionFn<unknown, unknown>, opts?: ActionOptions): void;
+/** Names of all registered server actions (after preload). Used by Shield-lite allowlists. */
+export declare function getRegisteredActionNames(): ReadonlySet<string>;
 export declare class ActionError extends Error {
     readonly status: number;
     readonly code?: string | undefined;
@@ -129,8 +137,12 @@ export declare class ActionAbortedError extends ActionError {
  */
 export declare function handleActionRequest(request: Request): Promise<Response>;
 /**
- * Validates that a request comes from a trusted Nexus client.
- * Checks x-nexus-action header and CSRF token.
+ * Validates that a request comes from a trusted Nexus client (inner CSRF check
+ * used by `createAction` wrappers). Verifies:
+ *  1. `x-nexus-action` custom header — cross-origin requests cannot add this
+ *     without a CORS preflight the server will reject.
+ *  2. `Origin` / `Referer` header sanity check — additional signal against
+ *     misconfigured CORS or non-standard clients.
  */
 export declare function validateRequest(ctx: NexusContext): Promise<void>;
 export { generateActionToken, validateActionToken, extractSessionId, generateSessionId } from './csrf.js';

package/dist/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAOjD,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,MAAM,QAAQ,CAAC,MAAM,GAAG,QAAQ,EAAE,OAAO,GAAG,IAAI,IAAI,CACxD,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,YAAY,GAAG;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,KACxC,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEpE,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE;QACP,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;KACnC,CAAC;CACH;AAED,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACvC,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA+BD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,YAAY,CAAC,MAAM,GAAG,QAAQ,EAAE,OAAO,GAAG,IAAI,EAC5D,QAAQ,EACJ,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,GACzB,CAAC,aAAa,GAAG;IAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EAC5D,UAAU,GAAE,aAAkB,GAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAqC3B;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,EAC9B,IAAI,GAAE,aAAkB,GACvB,IAAI,CAIN;AAED,qBAAa,WAAY,SAAQ,KAAK;aAGlB,MAAM,EAAE,MAAM;aACd,IAAI,CAAC,EAAE,MAAM;gBAF7B,OAAO,EAAE,MAAM,EACC,MAAM,GAAE,MAAY,EACpB,IAAI,CAAC,EAAE,MAAM,YAAA;CAKhC;AAED,qBAAa,kBAAmB,SAAQ,WAAW;;CAIlD;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAmM7E;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAKtE;AAGD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC1G,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACjF,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAIrF;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,YAAuB,GAChC;IACD,GAAG,EAAE,MAAM,WAAW,CAAC;IACvB,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CAClB,CAyBA"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAOjD,OAAO,EAKL,KAAK,eAAe,EACrB,MAAM,iBAAiB,CAAC;AAGzB,MAAM,MAAM,QAAQ,CAAC,MAAM,GAAG,QAAQ,EAAE,OAAO,GAAG,IAAI,IAAI,CACxD,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,YAAY,GAAG;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,KACxC,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEpE,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE;QACP,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;KACnC,CAAC;IACF;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACvC,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAyDD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,YAAY,CAAC,MAAM,GAAG,QAAQ,EAAE,OAAO,GAAG,IAAI,EAC5D,QAAQ,EACJ,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,GACzB,CAAC,aAAa,GAAG;IAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EAC5D,UAAU,GAAE,aAAkB,GAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAqC3B;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,EAC9B,IAAI,GAAE,aAAkB,GACvB,IAAI,CAKN;AAED,8FAA8F;AAC9F,wBAAgB,wBAAwB,IAAI,WAAW,CAAC,MAAM,CAAC,CAE9D;AAED,qBAAa,WAAY,SAAQ,KAAK;aAGlB,MAAM,EAAE,MAAM;aACd,IAAI,CAAC,EAAE,MAAM;gBAF7B,OAAO,EAAE,MAAM,EACC,MAAM,GAAE,MAAY,EACpB,IAAI,CAAC,EAAE,MAAM,YAAA;CAKhC;AAED,qBAAa,kBAAmB,SAAQ,WAAW;;CAIlD;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsV7E;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBtE;AAGD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC1G,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACjF,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAIrF;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,YAAuB,GAChC;IACD,GAAG,EAAE,MAAM,WAAW,CAAC;IACvB,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CAClB,CAyBA"}

package/dist/actions.js

@@ -27,10 +27,11 @@
  *   4. Client-side: $optimistic with built-in race guard.
  *      The createOptimistic() pending flag blocks double-submit.
  */
-import { createContext } from './context.js';
+import { createContext, NotFoundSignal, RedirectSignal } from './context.js';
 import { serialize, deserialize } from '@nexus_js/serialize';
 import { validateActionToken, extractSessionId, ACTION_TOKEN_HEADER, } from './csrf.js';
-import { createRateLimiter, registerLimiter, RateLimitError, } from './rate-limit.js';
+import { createRateLimiter, registerLimiter, getLimiter, RateLimitError, } from './rate-limit.js';
+import { emitDevRadar, newTraceId, sanitizeTelemetryValue } from './devradar.js';
 const ACTION_PREFIX = '/_nexus/action/';
 const idempotencyCache = new Map();
 const IDEMPOTENCY_TTL = 30_000; // 30 seconds
@@ -39,6 +40,32 @@ const IDEMPOTENCY_TTL = 30_000; // 30 seconds
 const inFlightActions = new Map();
 const actionQueues = new Map();
 const actionRegistry = new Map();
+/**
+ * SSR and islands coerce `action={myAction}` with `String(myAction)`. The value is the
+ * wrapper from `createAction`, whose default `Function#toString()` is the entire wrapper
+ * source (CSRF, rate limit, …) — that string was being used as the form URL. After
+ * registration we pin `toString` / `@@toPrimitive` to the real POST path.
+ */
+function patchRegisteredActionStringCoercion(fn, name) {
+    const url = ACTION_PREFIX + name;
+    Object.defineProperty(fn, 'toString', {
+        value: function nexusActionUrlString() {
+            return url;
+        },
+        configurable: true,
+        enumerable: false,
+    });
+    try {
+        Object.defineProperty(fn, Symbol.toPrimitive, {
+            value: () => url,
+            configurable: true,
+            enumerable: false,
+        });
+    }
+    catch {
+        /* ignore */
+    }
+}
 // ── Public API ────────────────────────────────────────────────────────────────
 /**
  * Defines a Server Action with integrated security, rate limiting, and
@@ -99,8 +126,13 @@ export function registerAction(name, fn, opts = {}) {
     const limiter = opts.rateLimit ? createRateLimiter(opts.rateLimit) : null;
     if (limiter)
         registerLimiter(name, limiter);
+    patchRegisteredActionStringCoercion(fn, name);
     actionRegistry.set(name, { fn, opts, name });
 }
+/** Names of all registered server actions (after preload). Used by Shield-lite allowlists. */
+export function getRegisteredActionNames() {
+    return new Set(actionRegistry.keys());
+}
 export class ActionError extends Error {
     status;
     code;
@@ -131,7 +163,28 @@ export async function handleActionRequest(request) {
             headers: { allow: 'POST' },
         });
     }
-    const actionName = url.pathname.slice(ACTION_PREFIX.length);
+    // ── Guard: opaque (null) Origin ────────────────────────────────────────────
+    // Sandboxed iframes (<iframe sandbox> without allow-same-origin) and data:
+    // URIs send the string "null" as the Origin header. This is never a
+    // legitimate same-origin action call and must be rejected before any CSRF
+    // header check — otherwise the custom-header tier can be bypassed.
+    const rawOrigin = request.headers.get('origin');
+    if (rawOrigin === 'null') {
+        emitDevRadar({
+            type: 'security:audit',
+            payload: { kind: 'csrf_blocked', message: 'Opaque (null) origin rejected', action: '?' },
+        });
+        return jsonResponse({ error: 'Forbidden: opaque origin', status: 403, code: 'OPAQUE_ORIGIN' }, 403);
+    }
+    // ── Guard: action name validation ──────────────────────────────────────────
+    // Ensure the action name extracted from the URL only contains characters that
+    // can appear in a valid registered action name. Rejects path-traversal
+    // sequences (../../ etc.) and injection attempts before any registry lookup.
+    const rawActionName = url.pathname.slice(ACTION_PREFIX.length);
+    if (!/^[\w][\w.-]*$/.test(rawActionName) || rawActionName.includes('..')) {
+        return jsonResponse({ error: 'Invalid action name', status: 400, code: 'INVALID_ACTION_NAME' }, 400);
+    }
+    const actionName = rawActionName;
     const registered = actionRegistry.get(actionName);
     if (!registered) {
         return jsonResponse({ error: `Action "${actionName}" not found`, status: 404 }, 404);
@@ -139,32 +192,80 @@ export async function handleActionRequest(request) {
     const { fn, opts } = registered;
     const race = opts.race ?? 'cancel';
     const timeout = opts.timeout ?? 30_000;
-    // ── CSRF token validation ──────────────────────────────────────────────────
+    // ── CSRF protection (dual-tier) ────────────────────────────────────────────
+    //
+    // Tier 1 — Custom header (default): Browsers cannot add arbitrary headers to
+    //   cross-origin requests without a CORS preflight the server will reject.
+    //   Requiring `x-nexus-action: 1` blocks all form-based CSRF attacks from
+    //   foreign origins without needing token generation on the server.
+    //
+    // Tier 2 — HMAC token (opt-in): When `x-nexus-action-token` is present the
+    //   server also validates the full HMAC-SHA256 signed, single-use, session-
+    //   bound token (generated via `generateActionToken`). This additionally
+    //   protects against same-origin XSS token theft.
+    //
+    // Flow:
+    //   token present  → Tier 2 full validation (strongest)
+    //   header present, no token → Tier 1 header check (standard)
+    //   neither present → 403 CSRF block
     if (opts.csrf !== false) {
         const token = request.headers.get(ACTION_TOKEN_HEADER);
-        const secret = process.env['NEXUS_SECRET'] ?? 'nexus-dev-secret-change-me';
-        const sessionId = extractSessionId(request);
-        if (!token) {
-            return jsonResponse({
-                error: 'Missing action token — possible CSRF attack',
-                status: 403,
-                code: 'MISSING_CSRF_TOKEN',
-            }, 403);
+        const nexusHeader = request.headers.get('x-nexus-action');
+        if (token) {
+            // Tier 2: full HMAC validation
+            const secret = process.env['NEXUS_SECRET'] ?? 'nexus-dev-secret-change-me';
+            const sessionId = extractSessionId(request);
+            const validation = validateActionToken(token, sessionId, actionName, secret);
+            if (!validation.valid) {
+                emitDevRadar({
+                    type: 'security:audit',
+                    payload: {
+                        kind: validation.replayed ? 'replay' : 'csrf_blocked',
+                        message: validation.reason ?? 'Invalid action token',
+                        action: actionName,
+                    },
+                });
+                return jsonResponse({
+                    error: validation.reason ?? 'Invalid action token',
+                    status: 403,
+                    code: validation.replayed ? 'REPLAY_ATTACK' : 'INVALID_CSRF_TOKEN',
+                }, 403);
+            }
         }
-        const validation = validateActionToken(token, sessionId, actionName, secret);
-        if (!validation.valid) {
+        else if (!nexusHeader) {
+            // Neither token nor custom header → CSRF attack or missing client header
+            emitDevRadar({
+                type: 'security:audit',
+                payload: {
+                    kind: 'csrf_blocked',
+                    message: 'Missing x-nexus-action header — possible CSRF attack',
+                    action: actionName,
+                },
+            });
             return jsonResponse({
-                error: validation.reason ?? 'Invalid action token',
+                error: 'Missing x-nexus-action header — possible CSRF attack',
                 status: 403,
-                code: validation.replayed ? 'REPLAY_ATTACK' : 'INVALID_CSRF_TOKEN',
+                code: 'MISSING_CSRF_HEADER',
             }, 403);
         }
+        // Tier 1 satisfied: nexusHeader present, no token → header-based CSRF protection
     }
     // ── Rate limiting ──────────────────────────────────────────────────────────
-    if (opts.rateLimit) {
-        const limiter = createRateLimiter(opts.rateLimit);
+    // Use the pre-registered limiter (created once at registerAction time).
+    // Previously, a new limiter instance was created per-request, which reset
+    // the sliding-window state and made rate limiting completely ineffective.
+    const limiter = getLimiter(actionName);
+    if (limiter) {
         const result = limiter.check(request);
         if (!result.allowed) {
+            emitDevRadar({
+                type: 'security:audit',
+                payload: {
+                    kind: 'rate_limited',
+                    message: `Retry in ${result.retryAfter}s`,
+                    action: actionName,
+                },
+            });
             return new Response(JSON.stringify({
                 error: `Rate limit exceeded. Retry in ${result.retryAfter}s.`,
                 status: 429,
@@ -182,14 +283,26 @@ export async function handleActionRequest(request) {
     }
     // ── Idempotency check ──────────────────────────────────────────────────────
     const idempotencyKey = request.headers.get('x-nexus-idempotency');
+    const traceId = newTraceId();
+    const islandHdr = request.headers.get('x-nexus-island') ?? undefined;
     if (idempotencyKey && opts.idempotent) {
         const cached = idempotencyCache.get(idempotencyKey);
         if (cached && Date.now() < cached.expiresAt) {
+            emitDevRadar({
+                type: 'action:result',
+                payload: {
+                    id: traceId,
+                    name: actionName,
+                    output: sanitizeTelemetryValue(cached.result),
+                    duration: 0,
+                    cached: true,
+                },
+            });
             return jsonResponse({ data: cached.result, status: cached.status, idempotencyKey }, cached.status);
         }
     }
     // ── Race condition management ──────────────────────────────────────────────
-    const islandId = request.headers.get('x-nexus-island') ?? 'global';
+    const islandId = islandHdr ?? 'global';
     const raceKey = `${islandId}:${actionName}`;
     if (race === 'reject') {
         if (inFlightActions.has(raceKey)) {
@@ -226,7 +339,20 @@ export async function handleActionRequest(request) {
     const startTime = Date.now();
     try {
         // Deserialize input using Nexus transport (preserves Date, Map, Set, etc.)
-        const input = await deserializeInput(request);
+        const input = await deserializeInput(request, opts.maxBodyBytes ?? MAX_ACTION_BODY_BYTES);
+        emitDevRadar({
+            type: 'action:call',
+            payload: {
+                id: traceId,
+                name: actionName,
+                input: sanitizeTelemetryValue(input),
+                timestamp: Date.now(),
+                ...(islandHdr !== undefined ? { islandId: islandHdr } : {}),
+                ...(idempotencyKey != null && idempotencyKey !== ''
+                    ? { idempotencyKey }
+                    : {}),
+            },
+        });
         let result;
         let attempts = 0;
         const maxAttempts = 1 + (opts.retries ?? 0);
@@ -236,6 +362,8 @@ export async function handleActionRequest(request) {
                 break;
             }
             catch (err) {
+                if (err instanceof RedirectSignal || err instanceof NotFoundSignal)
+                    throw err;
                 attempts++;
                 if (err instanceof ActionError || err instanceof ActionAbortedError)
                     throw err;
@@ -245,6 +373,16 @@ export async function handleActionRequest(request) {
             }
         }
         const duration = Date.now() - startTime;
+        emitDevRadar({
+            type: 'action:result',
+            payload: {
+                id: traceId,
+                name: actionName,
+                output: sanitizeTelemetryValue(result),
+                duration,
+                cached: false,
+            },
+        });
         // Cache idempotent results
         if (idempotencyKey && opts.idempotent) {
             idempotencyCache.set(idempotencyKey, {
@@ -277,9 +415,44 @@ export async function handleActionRequest(request) {
                 code: 'CANCELLED',
             }, 409);
         }
+        if (err instanceof RedirectSignal) {
+            emitDevRadar({
+                type: 'action:redirect',
+                payload: {
+                    id: traceId,
+                    name: actionName,
+                    location: err.location,
+                    status: err.status,
+                    duration: Date.now() - startTime,
+                },
+            });
+            return redirectResponseFromSignal(err);
+        }
+        if (err instanceof NotFoundSignal) {
+            return jsonResponse({ error: 'Not Found', status: 404 }, 404);
+        }
         if (err instanceof ActionError) {
+            emitDevRadar({
+                type: 'action:error',
+                payload: {
+                    id: traceId,
+                    name: actionName,
+                    error: err.message,
+                    duration: Date.now() - startTime,
+                    ...(err.code !== undefined ? { code: err.code } : {}),
+                },
+            });
             return jsonResponse({ error: err.message, status: err.status, code: err.code }, err.status);
         }
+        emitDevRadar({
+            type: 'action:error',
+            payload: {
+                id: traceId,
+                name: actionName,
+                error: err instanceof Error ? err.message : String(err),
+                duration: Date.now() - startTime,
+            },
+        });
         console.error(`[Nexus Action] "${actionName}" failed:`, err);
         return jsonResponse({ error: 'Internal Server Error', status: 500 }, 500);
     }
@@ -290,13 +463,27 @@ export async function handleActionRequest(request) {
     }
 }
 /**
- * Validates that a request comes from a trusted Nexus client.
- * Checks x-nexus-action header and CSRF token.
+ * Validates that a request comes from a trusted Nexus client (inner CSRF check
+ * used by `createAction` wrappers). Verifies:
+ *  1. `x-nexus-action` custom header — cross-origin requests cannot add this
+ *     without a CORS preflight the server will reject.
+ *  2. `Origin` / `Referer` header sanity check — additional signal against
+ *     misconfigured CORS or non-standard clients.
  */
 export async function validateRequest(ctx) {
     const nexusHeader = ctx.request.headers.get('x-nexus-action');
     if (!nexusHeader) {
-        throw new ActionError('Missing Nexus action header', 403, 'MISSING_HEADER');
+        throw new ActionError('Missing x-nexus-action header', 403, 'MISSING_HEADER');
+    }
+    // Origin / Referer check: block requests that carry an explicit foreign origin.
+    // Same-origin and same-site fetch() calls either omit Origin or match the host.
+    const origin = ctx.request.headers.get('origin');
+    const referer = ctx.request.headers.get('referer');
+    const host = ctx.request.headers.get('host') ?? '';
+    const suspectOrigin = origin && !origin.includes(host.split(':')[0] ?? host);
+    const suspectReferer = !origin && referer && !referer.includes(host.split(':')[0] ?? host);
+    if (suspectOrigin || suspectReferer) {
+        throw new ActionError(`Cross-origin action request blocked (host: ${host})`, 403, 'CROSS_ORIGIN_BLOCKED');
     }
 }
 // Re-export security primitives for use in app code
@@ -342,10 +529,21 @@ export function createActionGuard(name, strategy = 'cancel') {
     };
 }
 // ── Helpers ───────────────────────────────────────────────────────────────────
-async function deserializeInput(request) {
+/** Maximum request body for a single server action (10 MB). Override per-action via opts.maxBodyBytes. */
+const MAX_ACTION_BODY_BYTES = 10 * 1_024 * 1_024;
+async function deserializeInput(request, maxBytes = MAX_ACTION_BODY_BYTES) {
+    // DoS protection: reject oversized bodies before reading any bytes.
+    // Prevents memory exhaustion from clients that stream arbitrarily large payloads.
+    const cl = parseInt(request.headers.get('content-length') ?? '0', 10);
+    if (Number.isFinite(cl) && cl > maxBytes) {
+        throw new ActionError(`Request body too large (${cl} bytes, limit ${maxBytes})`, 413, 'PAYLOAD_TOO_LARGE');
+    }
     const contentType = request.headers.get('content-type') ?? '';
     if (contentType.includes('application/json')) {
         const text = await request.text();
+        if (text.length > maxBytes) {
+            throw new ActionError('Request body too large', 413, 'PAYLOAD_TOO_LARGE');
+        }
         try {
             return deserialize(text);
         }
@@ -357,7 +555,11 @@ async function deserializeInput(request) {
         contentType.includes('application/x-www-form-urlencoded')) {
         return request.formData();
     }
-    return request.text();
+    const text = await request.text();
+    if (text.length > maxBytes) {
+        throw new ActionError('Request body too large', 413, 'PAYLOAD_TOO_LARGE');
+    }
+    return text;
 }
 function jsonResponse(body, status) {
     return new Response(JSON.stringify(body), {
@@ -365,6 +567,14 @@ function jsonResponse(body, status) {
         headers: { 'content-type': 'application/json' },
     });
 }
+function redirectResponseFromSignal(err) {
+    const headers = new Headers();
+    headers.set('Location', err.location);
+    err.responseHeaders.forEach((value, key) => {
+        headers.append(key, value);
+    });
+    return new Response(null, { status: err.status, headers });
+}
 async function waitInQueue(key) {
     return new Promise((resolve) => {
         const queue = actionQueues.get(key) ?? [];

package/dist/actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"actions.js","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,GAEf,MAAM,iBAAiB,CAAC;AAiEzB,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAQxC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA4B,CAAC;AAC7D,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,aAAa;AAE7C,iFAAiF;AACjF,qDAAqD;AACrD,MAAM,eAAe,GAAG,IAAI,GAAG,EAA2B,CAAC;AAI3D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAwB,CAAC;AAQrD,MAAM,cAAc,GAAG,IAAI,GAAG,EAA4B,CAAC;AAE3D,iFAAiF;AAEjF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,YAAY,CAC1B,QAE4D,EAC5D,aAA4B,EAAE;IAE9B,6EAA6E;IAC7E,MAAM,EAAE,GAAK,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC1E,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;IAEpE,4DAA4D;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE1E,OAAO,KAAK,EACV,KAAa,EACb,GAA2C,EACzB,EAAE;QACpB,qBAAqB;QACrB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACxB,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAED,mBAAmB;QACnB,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAW,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC;gBAC3E,MAAM,IAAI,WAAW,CAAC,kBAAkB,GAAG,EAAE,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAED,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,EAA8B,EAC9B,OAAsB,EAAE;IAExB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,IAAI,OAAO;QAAE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5C,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGlB;IACA;IAHlB,YACE,OAAe,EACC,SAAiB,GAAG,EACpB,IAAa;QAE7B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAc;QACpB,SAAI,GAAJ,IAAI,CAAS;QAG7B,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,WAAW;IACjD;QACE,KAAK,CAAC,0CAA0C,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACpE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAgB;IACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEjC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,IAAI,QAAQ,CAAC,oBAAoB,EAAE;YACxC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAElD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,WAAW,UAAU,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;IAChC,MAAM,IAAI,GAAM,IAAI,CAAC,IAAI,IAAO,QAAQ,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC;IAEvC,8EAA8E;IAC9E,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACxB,MAAM,KAAK,GAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,4BAA4B,CAAC;QAC9E,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,YAAY,CAAC;gBAClB,KAAK,EAAG,6CAA6C;gBACrD,MAAM,EAAE,GAAG;gBACX,IAAI,EAAI,oBAAoB;aAC7B,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QACD,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7E,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,YAAY,CAAC;gBAClB,KAAK,EAAG,UAAU,CAAC,MAAM,IAAI,sBAAsB;gBACnD,MAAM,EAAE,GAAG;gBACX,IAAI,EAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,oBAAoB;aACrE,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,MAAM,GAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAQ,iCAAiC,MAAM,CAAC,UAAU,IAAI;gBACnE,MAAM,EAAO,GAAG;gBAChB,IAAI,EAAS,cAAc;gBAC3B,UAAU,EAAG,MAAM,CAAC,UAAU;gBAC9B,OAAO,EAAM,MAAM,CAAC,OAAO;aAC5B,CAAC,EACF;gBACE,MAAM,EAAG,GAAG;gBACZ,OAAO,EAAE;oBACP,cAAc,EAAG,kBAAkB;oBACnC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;iBAC3B;aACF,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClE,IAAI,cAAc,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACpD,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,OAAO,YAAY,CACjB,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,EAC9D,MAAM,CAAC,MAAM,CACd,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,QAAQ,CAAC;IACnE,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,UAAU,EAAE,CAAC;IAE5C,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,YAAY,CAAC;gBAClB,KAAK,EAAE,4BAA4B;gBACnC,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,mBAAmB;aAC1B,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,KAAK,CAAC,IAAI,kBAAkB,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED,8EAA8E;IAC9E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IAEzC,sCAAsC;IACtC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;QAC7C,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,UAAU;IACV,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;QAChC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,wBAAwB,OAAO,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC,EAAE,OAAO,CAAC,CAAC;IAEZ,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAEzC,6EAA6E;IAC7E,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,2EAA2E;QAC3E,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAE9C,IAAI,MAAe,CAAC;QACpB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;QAE5C,OAAO,QAAQ,GAAG,WAAW,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;gBACxC,MAAM;YACR,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,QAAQ,EAAE,CAAC;gBACX,IAAI,GAAG,YAAY,WAAW,IAAI,GAAG,YAAY,kBAAkB;oBAAE,MAAM,GAAG,CAAC;gBAC/E,IAAI,QAAQ,IAAI,WAAW;oBAAE,MAAM,GAAG,CAAC;gBACvC,MAAM,KAAK,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,sBAAsB;YACrD,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAExC,2BAA2B;QAC3B,IAAI,cAAc,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACtC,gBAAgB,CAAC,GAAG,CAAC,cAAc,EAAE;gBACnC,MAAM;gBACN,MAAM,EAAE,GAAG;gBACX,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe;aACxC,CAAC,CAAC;YACH,mCAAmC;YACnC,qBAAqB,EAAE,CAAC;QAC1B,CAAC;QAED,0CAA0C;QAC1C,MAAM,UAAU,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE;YAC9B,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,MAAM,CAAC,QAAQ,CAAC;gBACpC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrE;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,YAAY,CAAC,OAAO,CAAC,CAAC;QAEtB,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO,YAAY,CAAC;gBAClB,KAAK,EAAE,sBAAsB;gBAC7B,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,WAAW;aAClB,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;YAC/B,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9F,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,mBAAmB,UAAU,WAAW,EAAE,GAAG,CAAC,CAAC;QAC7D,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5E,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAiB;IACrD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC9D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,WAAW,CAAC,6BAA6B,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC1G,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGjF,iFAAiF;AAEjF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,WAAyB,QAAQ;IAOjC,IAAI,iBAAiB,GAA2B,IAAI,CAAC;IACrD,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,OAAO;QACL,GAAG;YACD,IAAI,QAAQ,KAAK,QAAQ,IAAI,iBAAiB,EAAE,CAAC;gBAC/C,iBAAiB,CAAC,KAAK,EAAE,CAAC;YAC5B,CAAC;YACD,iBAAiB,GAAG,IAAI,eAAe,EAAE,CAAC;YAC1C,QAAQ,GAAG,IAAI,CAAC;YAChB,iBAAiB,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAChF,OAAO,iBAAiB,CAAC,MAAM,CAAC;QAClC,CAAC;QACD,KAAK;YACH,iBAAiB,EAAE,KAAK,EAAE,CAAC;YAC3B,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;QACD,IAAI,OAAO;YACT,OAAO,iBAAiB,EAAE,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC;QACpD,CAAC;QACD,IAAI,OAAO;YACT,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF,KAAK,UAAU,gBAAgB,CAAC,OAAgB;IAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAE9D,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,IACE,WAAW,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAC3C,WAAW,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EACzD,CAAC;QACD,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC5B,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,MAAc;IACjD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACxB,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC,CAAC,kCAAkC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACzC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,8BAA8B;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,IAAI;QAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,iCAAiC;AAC7D,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC;QACtD,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS;YAAE,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE7E,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,UAAU,EACV,cAAc,GAEf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAuEjF,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAQxC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA4B,CAAC;AAC7D,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,aAAa;AAE7C,iFAAiF;AACjF,qDAAqD;AACrD,MAAM,eAAe,GAAG,IAAI,GAAG,EAA2B,CAAC;AAI3D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAwB,CAAC;AAQrD,MAAM,cAAc,GAAG,IAAI,GAAG,EAA4B,CAAC;AAE3D;;;;;GAKG;AACH,SAAS,mCAAmC,CAAC,EAA8B,EAAE,IAAY;IACvF,MAAM,GAAG,GAAG,aAAa,GAAG,IAAI,CAAC;IACjC,MAAM,CAAC,cAAc,CAAC,EAAE,EAAE,UAAU,EAAE;QACpC,KAAK,EAAE,SAAS,oBAAoB;YAClC,OAAO,GAAG,CAAC;QACb,CAAC;QACD,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,WAAW,EAAE;YAC5C,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG;YAChB,YAAY,EAAE,IAAI;YAClB,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,YAAY,CAC1B,QAE4D,EAC5D,aAA4B,EAAE;IAE9B,6EAA6E;IAC7E,MAAM,EAAE,GAAK,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC1E,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;IAEpE,4DAA4D;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE1E,OAAO,KAAK,EACV,KAAa,EACb,GAA2C,EACzB,EAAE;QACpB,qBAAqB;QACrB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACxB,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAED,mBAAmB;QACnB,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAW,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC;gBAC3E,MAAM,IAAI,WAAW,CAAC,kBAAkB,GAAG,EAAE,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAED,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,EAA8B,EAC9B,OAAsB,EAAE;IAExB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,IAAI,OAAO;QAAE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5C,mCAAmC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC9C,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,wBAAwB;IACtC,OAAO,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGlB;IACA;IAHlB,YACE,OAAe,EACC,SAAiB,GAAG,EACpB,IAAa;QAE7B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAc;QACpB,SAAI,GAAJ,IAAI,CAAS;QAG7B,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,WAAW;IACjD;QACE,KAAK,CAAC,0CAA0C,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACpE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAgB;IACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEjC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,IAAI,QAAQ,CAAC,oBAAoB,EAAE;YACxC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,2EAA2E;IAC3E,oEAAoE;IACpE,0EAA0E;IAC1E,mEAAmE;IACnE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACzB,YAAY,CAAC;YACX,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,+BAA+B,EAAE,MAAM,EAAE,GAAG,EAAE;SACzF,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;IACtG,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,uEAAuE;IACvE,6EAA6E;IAC7E,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;IACvG,CAAC;IAED,MAAM,UAAU,GAAG,aAAa,CAAC;IACjC,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAElD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,WAAW,UAAU,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;IAChC,MAAM,IAAI,GAAM,IAAI,CAAC,IAAI,IAAO,QAAQ,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC;IAEvC,8EAA8E;IAC9E,EAAE;IACF,6EAA6E;IAC7E,2EAA2E;IAC3E,0EAA0E;IAC1E,oEAAoE;IACpE,EAAE;IACF,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,kDAAkD;IAClD,EAAE;IACF,QAAQ;IACR,wDAAwD;IACxD,8DAA8D;IAC9D,qCAAqC;IACrC,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACxB,MAAM,KAAK,GAAS,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAE1D,IAAI,KAAK,EAAE,CAAC;YACV,+BAA+B;YAC/B,MAAM,MAAM,GAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,4BAA4B,CAAC;YAC9E,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YAC7E,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gBACtB,YAAY,CAAC;oBACX,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE;wBACP,IAAI,EAAK,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc;wBACxD,OAAO,EAAE,UAAU,CAAC,MAAM,IAAI,sBAAsB;wBACpD,MAAM,EAAG,UAAU;qBACpB;iBACF,CAAC,CAAC;gBACH,OAAO,YAAY,CAAC;oBAClB,KAAK,EAAG,UAAU,CAAC,MAAM,IAAI,sBAAsB;oBACnD,MAAM,EAAE,GAAG;oBACX,IAAI,EAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,oBAAoB;iBACrE,EAAE,GAAG,CAAC,CAAC;YACV,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YACxB,yEAAyE;YACzE,YAAY,CAAC;gBACX,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE;oBACP,IAAI,EAAK,cAAc;oBACvB,OAAO,EAAE,sDAAsD;oBAC/D,MAAM,EAAG,UAAU;iBACpB;aACF,CAAC,CAAC;YACH,OAAO,YAAY,CAAC;gBAClB,KAAK,EAAG,sDAAsD;gBAC9D,MAAM,EAAE,GAAG;gBACX,IAAI,EAAI,qBAAqB;aAC9B,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QACD,iFAAiF;IACnF,CAAC;IAED,8EAA8E;IAC9E,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,OAAO,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,YAAY,CAAC;gBACX,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE;oBACP,IAAI,EAAK,cAAc;oBACvB,OAAO,EAAE,YAAY,MAAM,CAAC,UAAU,GAAG;oBACzC,MAAM,EAAG,UAAU;iBACpB;aACF,CAAC,CAAC;YACH,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAQ,iCAAiC,MAAM,CAAC,UAAU,IAAI;gBACnE,MAAM,EAAO,GAAG;gBAChB,IAAI,EAAS,cAAc;gBAC3B,UAAU,EAAG,MAAM,CAAC,UAAU;gBAC9B,OAAO,EAAM,MAAM,CAAC,OAAO;aAC5B,CAAC,EACF;gBACE,MAAM,EAAG,GAAG;gBACZ,OAAO,EAAE;oBACP,cAAc,EAAG,kBAAkB;oBACnC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;iBAC3B;aACF,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,SAAS,CAAC;IAErE,IAAI,cAAc,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACpD,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,YAAY,CAAC;gBACX,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE;oBACP,EAAE,EAAQ,OAAO;oBACjB,IAAI,EAAM,UAAU;oBACpB,MAAM,EAAI,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC;oBAC/C,QAAQ,EAAE,CAAC;oBACX,MAAM,EAAI,IAAI;iBACf;aACF,CAAC,CAAC;YACH,OAAO,YAAY,CACjB,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,EAC9D,MAAM,CAAC,MAAM,CACd,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,SAAS,IAAI,QAAQ,CAAC;IACvC,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,UAAU,EAAE,CAAC;IAE5C,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,YAAY,CAAC;gBAClB,KAAK,EAAE,4BAA4B;gBACnC,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,mBAAmB;aAC1B,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,KAAK,CAAC,IAAI,kBAAkB,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED,8EAA8E;IAC9E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IAEzC,sCAAsC;IACtC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;QAC7C,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,UAAU;IACV,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;QAChC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,wBAAwB,OAAO,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC,EAAE,OAAO,CAAC,CAAC;IAEZ,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAEzC,6EAA6E;IAC7E,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,2EAA2E;QAC3E,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,IAAI,qBAAqB,CAAC,CAAC;QAE1F,YAAY,CAAC;YACX,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE;gBACP,EAAE,EAAS,OAAO;gBAClB,IAAI,EAAO,UAAU;gBACrB,KAAK,EAAM,sBAAsB,CAAC,KAAK,CAAC;gBACxC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,cAAc,IAAI,IAAI,IAAI,cAAc,KAAK,EAAE;oBACjD,CAAC,CAAC,EAAE,cAAc,EAAE;oBACpB,CAAC,CAAC,EAAE,CAAC;aACR;SACF,CAAC,CAAC;QAEH,IAAI,MAAe,CAAC;QACpB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;QAE5C,OAAO,QAAQ,GAAG,WAAW,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;gBACxC,MAAM;YACR,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,cAAc,IAAI,GAAG,YAAY,cAAc;oBAAE,MAAM,GAAG,CAAC;gBAC9E,QAAQ,EAAE,CAAC;gBACX,IAAI,GAAG,YAAY,WAAW,IAAI,GAAG,YAAY,kBAAkB;oBAAE,MAAM,GAAG,CAAC;gBAC/E,IAAI,QAAQ,IAAI,WAAW;oBAAE,MAAM,GAAG,CAAC;gBACvC,MAAM,KAAK,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,sBAAsB;YACrD,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAExC,YAAY,CAAC;YACX,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE;gBACP,EAAE,EAAQ,OAAO;gBACjB,IAAI,EAAM,UAAU;gBACpB,MAAM,EAAI,sBAAsB,CAAC,MAAM,CAAC;gBACxC,QAAQ;gBACR,MAAM,EAAI,KAAK;aAChB;SACF,CAAC,CAAC;QAEH,2BAA2B;QAC3B,IAAI,cAAc,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACtC,gBAAgB,CAAC,GAAG,CAAC,cAAc,EAAE;gBACnC,MAAM;gBACN,MAAM,EAAE,GAAG;gBACX,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe;aACxC,CAAC,CAAC;YACH,mCAAmC;YACnC,qBAAqB,EAAE,CAAC;QAC1B,CAAC;QAED,0CAA0C;QAC1C,MAAM,UAAU,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE;YAC9B,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,MAAM,CAAC,QAAQ,CAAC;gBACpC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrE;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,YAAY,CAAC,OAAO,CAAC,CAAC;QAEtB,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO,YAAY,CAAC;gBAClB,KAAK,EAAE,sBAAsB;gBAC7B,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,WAAW;aAClB,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YAClC,YAAY,CAAC;gBACX,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE;oBACP,EAAE,EAAE,OAAO;oBACX,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACjC;aACF,CAAC,CAAC;YACH,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YAClC,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;YAC/B,YAAY,CAAC;gBACX,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE;oBACP,EAAE,EAAQ,OAAO;oBACjB,IAAI,EAAM,UAAU;oBACpB,KAAK,EAAK,GAAG,CAAC,OAAO;oBACrB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAChC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtD;aACF,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9F,CAAC;QAED,YAAY,CAAC;YACX,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE;gBACP,EAAE,EAAQ,OAAO;gBACjB,IAAI,EAAM,UAAU;gBACpB,KAAK,EAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBAC1D,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACjC;SACF,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,mBAAmB,UAAU,WAAW,EAAE,GAAG,CAAC,CAAC;QAC7D,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5E,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAiB;IACrD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC9D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,WAAW,CAAC,+BAA+B,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAChF,CAAC;IAED,gFAAgF;IAChF,gFAAgF;IAChF,MAAM,MAAM,GAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,IAAI,GAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAEtD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IAE3F,IAAI,aAAa,IAAI,cAAc,EAAE,CAAC;QACpC,MAAM,IAAI,WAAW,CACnB,8CAA8C,IAAI,GAAG,EACrD,GAAG,EACH,sBAAsB,CACvB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC1G,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGjF,iFAAiF;AAEjF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,WAAyB,QAAQ;IAOjC,IAAI,iBAAiB,GAA2B,IAAI,CAAC;IACrD,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,OAAO;QACL,GAAG;YACD,IAAI,QAAQ,KAAK,QAAQ,IAAI,iBAAiB,EAAE,CAAC;gBAC/C,iBAAiB,CAAC,KAAK,EAAE,CAAC;YAC5B,CAAC;YACD,iBAAiB,GAAG,IAAI,eAAe,EAAE,CAAC;YAC1C,QAAQ,GAAG,IAAI,CAAC;YAChB,iBAAiB,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAChF,OAAO,iBAAiB,CAAC,MAAM,CAAC;QAClC,CAAC;QACD,KAAK;YACH,iBAAiB,EAAE,KAAK,EAAE,CAAC;YAC3B,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;QACD,IAAI,OAAO;YACT,OAAO,iBAAiB,EAAE,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC;QACpD,CAAC;QACD,IAAI,OAAO;YACT,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF,0GAA0G;AAC1G,MAAM,qBAAqB,GAAG,EAAE,GAAG,KAAK,GAAG,KAAK,CAAC;AAEjD,KAAK,UAAU,gBAAgB,CAAC,OAAgB,EAAE,QAAQ,GAAG,qBAAqB;IAChF,oEAAoE;IACpE,kFAAkF;IAClF,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IACtE,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC;QACzC,MAAM,IAAI,WAAW,CACnB,2BAA2B,EAAE,iBAAiB,QAAQ,GAAG,EACzD,GAAG,EACH,mBAAmB,CACpB,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAE9D,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,WAAW,CAAC,wBAAwB,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC;YACH,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,IACE,WAAW,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAC3C,WAAW,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EACzD,CAAC;QACD,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,WAAW,CAAC,wBAAwB,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,MAAc;IACjD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,0BAA0B,CAAC,GAAmB;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACzC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACxB,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC,CAAC,kCAAkC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACzC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,8BAA8B;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,IAAI;QAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,iCAAiC;AAC7D,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC;QACtD,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS;YAAE,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/constants.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Default Nexus Studio HTTP port (CLI `nexus studio` / dev dashboard).
+ * Keep in sync with any tooling that prints the Studio URL.
+ */
+export declare const STUDIO_DEFAULT_PORT = 4000;
+//# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,eAAO,MAAM,mBAAmB,OAAO,CAAC"}

package/dist/constants.js

@@ -0,0 +1,6 @@
+/**
+ * Default Nexus Studio HTTP port (CLI `nexus studio` / dev dashboard).
+ * Keep in sync with any tooling that prints the Studio URL.
+ */
+export const STUDIO_DEFAULT_PORT = 4000;
+//# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC"}

package/dist/context.d.ts

@@ -8,6 +8,16 @@ export interface NexusContext {
     url: URL;
     headers: Headers;
     locals: Record<string, unknown>;
+    /**
+     * Vault-lite: merged `process.env` at boot plus hot patches (Studio / dev endpoint).
+     * Use `ctx.secrets.get('STRIPE_KEY')` instead of `process.env` when you need live rotation.
+     */
+    secrets: ReadonlyMap<string, string>;
+    /**
+     * Merged result of `nxPretext(ctx)` from each layout (outer→inner) and the page, in parallel.
+     * Later routes override keys. Serialized to `__NEXUS_PRETEXT__` for `$pretext()` on the client.
+     */
+    pretext?: Record<string, unknown>;
     /** Set a response header */
     setHeader: (key: string, value: string) => void;
     /** Set a cookie */
@@ -28,11 +38,12 @@ export interface CookieOptions {
     secure?: boolean;
     sameSite?: 'Strict' | 'Lax' | 'None';
 }
-/** Internal redirect signal */
+/** Internal redirect signal — carries response headers (e.g. Set-Cookie on logout). */
 export declare class RedirectSignal {
     readonly location: string;
     readonly status: number;
-    constructor(location: string, status: number);
+    readonly responseHeaders: Headers;
+    constructor(location: string, status: number, responseHeaders: Headers);
 }
 /** Internal not-found signal */
 export declare class NotFoundSignal {

package/dist/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,GAAG,EAAE,GAAG,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,4BAA4B;IAC5B,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD,mBAAmB;IACnB,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,aAAa,KAAK,IAAI,CAAC;IACvE,yBAAyB;IACzB,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAChD,+DAA+D;IAC/D,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,KAAK,KAAK,CAAC;IAC5E,kCAAkC;IAClC,QAAQ,EAAE,MAAM,KAAK,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,IAAI,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;CACtC;AAED,+BAA+B;AAC/B,qBAAa,cAAc;aAEP,QAAQ,EAAE,MAAM;aAChB,MAAM,EAAE,MAAM;gBADd,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM;CAEjC;AAED,gCAAgC;AAChC,qBAAa,cAAc;CAAG;AAE9B,wBAAgB,aAAa,CAC3B,OAAO,EAAE,OAAO,EAChB,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAClC,YAAY,CAwCd"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,GAAG,EAAE,GAAG,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC;;;OAGG;IACH,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,4BAA4B;IAC5B,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD,mBAAmB;IACnB,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,aAAa,KAAK,IAAI,CAAC;IACvE,yBAAyB;IACzB,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAChD,+DAA+D;IAC/D,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,KAAK,KAAK,CAAC;IAC5E,kCAAkC;IAClC,QAAQ,EAAE,MAAM,KAAK,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,IAAI,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;CACtC;AAED,uFAAuF;AACvF,qBAAa,cAAc;aAEP,QAAQ,EAAE,MAAM;aAChB,MAAM,EAAE,MAAM;aACd,eAAe,EAAE,OAAO;gBAFxB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,OAAO;CAE3C;AAED,gCAAgC;AAChC,qBAAa,cAAc;CAAG;AAE9B,wBAAgB,aAAa,CAC3B,OAAO,EAAE,OAAO,EAChB,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAClC,YAAY,CAyCd"}

package/dist/context.js

@@ -2,13 +2,16 @@
  * Nexus Request Context — passed to every page, layout and server action.
  * Inspired by SvelteKit's RequestEvent and Next.js's Request/Response pattern.
  */
-/** Internal redirect signal */
+import { getVaultSecretsMap } from '@nexus_js/security';
+/** Internal redirect signal — carries response headers (e.g. Set-Cookie on logout). */
 export class RedirectSignal {
     location;
     status;
-    constructor(location, status) {
+    responseHeaders;
+    constructor(location, status, responseHeaders) {
         this.location = location;
         this.status = status;
+        this.responseHeaders = responseHeaders;
     }
 }
 /** Internal not-found signal */
@@ -24,6 +27,7 @@ export function createContext(request, params = {}) {
         url,
         headers: request.headers,
         locals: {},
+        secrets: getVaultSecretsMap(),
         setHeader(key, value) {
             responseHeaders.set(key, value);
         },
@@ -49,7 +53,7 @@ export function createContext(request, params = {}) {
             return cookies[name];
         },
         redirect(location, status = 302) {
-            throw new RedirectSignal(location, status);
+            throw new RedirectSignal(location, status, responseHeaders);
         },
         notFound() {
             throw new NotFoundSignal();

package/dist/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA8BH,+BAA+B;AAC/B,MAAM,OAAO,cAAc;IAEP;IACA;IAFlB,YACkB,QAAgB,EAChB,MAAc;QADd,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;IAC7B,CAAC;CACL;AAED,gCAAgC;AAChC,MAAM,OAAO,cAAc;CAAG;AAE9B,MAAM,UAAU,aAAa,CAC3B,OAAgB,EAChB,SAAiC,EAAE;IAEnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,eAAe,GAAG,IAAI,OAAO,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAElE,OAAO;QACL,OAAO;QACP,MAAM;QACN,GAAG;QACH,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,EAAE;QAEV,SAAS,CAAC,GAAG,EAAE,KAAK;YAClB,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;QAED,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE;YAC9B,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACvD,IAAI,IAAI,CAAC,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/C,IAAI,IAAI,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACrD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACpE,IAAI,IAAI,CAAC,OAAO;gBAAE,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACtE,IAAI,IAAI,CAAC,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1C,IAAI,IAAI,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,IAAI,CAAC,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC3D,eAAe,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,CAAC;QAED,SAAS,CAAC,IAAI;YACZ,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QAED,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG;YAC7B,MAAM,IAAI,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;QAED,QAAQ;YACN,MAAM,IAAI,cAAc,EAAE,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,GAAG;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAwCxD,uFAAuF;AACvF,MAAM,OAAO,cAAc;IAEP;IACA;IACA;IAHlB,YACkB,QAAgB,EAChB,MAAc,EACd,eAAwB;QAFxB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;QACd,oBAAe,GAAf,eAAe,CAAS;IACvC,CAAC;CACL;AAED,gCAAgC;AAChC,MAAM,OAAO,cAAc;CAAG;AAE9B,MAAM,UAAU,aAAa,CAC3B,OAAgB,EAChB,SAAiC,EAAE;IAEnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,eAAe,GAAG,IAAI,OAAO,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAElE,OAAO;QACL,OAAO;QACP,MAAM;QACN,GAAG;QACH,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,kBAAkB,EAAE;QAE7B,SAAS,CAAC,GAAG,EAAE,KAAK;YAClB,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;QAED,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE;YAC9B,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACvD,IAAI,IAAI,CAAC,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/C,IAAI,IAAI,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACrD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACpE,IAAI,IAAI,CAAC,OAAO;gBAAE,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACtE,IAAI,IAAI,CAAC,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1C,IAAI,IAAI,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,IAAI,CAAC,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC3D,eAAe,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,CAAC;QAED,SAAS,CAAC,IAAI;YACZ,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QAED,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG;YAC7B,MAAM,IAAI,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;QAC9D,CAAC;QAED,QAAQ;YACN,MAAM,IAAI,cAAc,EAAE,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,GAAG;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/csrf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAcH,gDAAgD;AAChD,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAE1D,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAK,OAAO,CAAC;IAClB,MAAM,CAAC,EAAG,MAAM,CAAC;IACjB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAID;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAG,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAM,MAAM,GACjB,MAAM,CAMR;AAID;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAO,MAAM,EAClB,SAAS,EAAG,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAM,MAAM,GACjB,qBAAqB,CAiDvB;AAkCD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAczD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C"}
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAiBH,gDAAgD;AAChD,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAE1D,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAK,OAAO,CAAC;IAClB,MAAM,CAAC,EAAG,MAAM,CAAC;IACjB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAID;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAG,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAM,MAAM,GACjB,MAAM,CAMR;AAID;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAO,MAAM,EAClB,SAAS,EAAG,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAM,MAAM,GACjB,qBAAqB,CAkDvB;AAkCD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAczD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C"}