theokit 0.12.0 → 0.13.0

package/dist/{chunk-GFMQJHXX.js → chunk-WR4F4EEZ.js}

@@ -5,375 +5,6 @@ import {
   serverErrorToEnvelope
 } from "./chunk-HGZL5EOI.js";
 
-// src/server/plugins/plugin-runner.ts
-var DuplicatePluginError = class extends Error {
-  constructor(name) {
-    super(`Plugin "${name}" is already registered.`);
-    this.name = "DuplicatePluginError";
-  }
-};
-var PluginRunner = class {
-  plugins = /* @__PURE__ */ new Set();
-  pluginScopes = /* @__PURE__ */ new Map();
-  onRequestHooks = [];
-  preHandlerHooks = [];
-  onResponseHooks = [];
-  onErrorHooks = [];
-  /**
-   * Parent app — proto-chain root for all child scopes. Has its OWN empty
-   * decorations map (parent never receives `decorateRequest` calls under
-   * the T3.1 contract; only child scopes do).
-   */
-  parentDecorations = /* @__PURE__ */ new Map();
-  parentApp = this.buildParentAppFacade();
-  has(name) {
-    return this.plugins.has(name);
-  }
-  /**
-   * Per T3.1 (C1 plugin scope encapsulation):
-   * 1. Reserve the plugin name (still rejects duplicates).
-   * 2. Build a CHILD TheoApp via `Object.create(parentApp)` — Fastify
-   *    `plugin-override.js:38` pattern. The child's own `decorateRequest`
-   *    populates per-scope `decorations`; the child's `addHook` still
-   *    forwards into the shared hook lists (hooks ARE process-global —
-   *    only decorations are scoped, mirroring Fastify's decoration vs
-   *    hook semantics).
-   * 3. Invoke `plugin.register(childApp)`.
-   *
-   * Cross-plugin decoration-key collisions are PERMITTED (per blueprint
-   * D1). The legacy `DuplicateDecorationError` is no longer thrown.
-   */
-  async register(plugin) {
-    if (this.plugins.has(plugin.name)) {
-      throw new DuplicatePluginError(plugin.name);
-    }
-    this.plugins.add(plugin.name);
-    const scope = this.buildPluginScope(plugin.name);
-    this.pluginScopes.set(plugin.name, scope);
-    try {
-      await plugin.register(scope.app);
-    } catch (err) {
-      this.plugins.delete(plugin.name);
-      this.pluginScopes.delete(plugin.name);
-      throw err;
-    }
-  }
-  /**
-   * Build the parent app facade. Hooks forward to shared lists.
-   * `decorateRequest` writes into the parent decorations map — used only
-   * if a future consumer registers a non-plugin "app-level" decoration
-   * directly. T3.1 contract: plugins decorate ONLY through child scopes.
-   */
-  buildParentAppFacade() {
-    const facade = {
-      addHook: (name, fn) => {
-        this.routeHookByName(name, fn);
-      },
-      // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-parameters -- T documents the per-decoration type for consumers
-      decorateRequest: (key, value) => {
-        this.parentDecorations.set(key, value);
-      }
-    };
-    return facade;
-  }
-  /**
-   * Build a child scope via `Object.create(parentApp)` so the child
-   * inherits the parent's facade methods through the prototype chain.
-   * Then override `decorateRequest` on the child instance so writes
-   * land in the per-scope `decorations` map (parent is NOT mutated).
-   */
-  buildPluginScope(_pluginName) {
-    const decorations = /* @__PURE__ */ new Map();
-    const childApp = Object.create(this.parentApp);
-    Object.defineProperty(childApp, "decorateRequest", {
-      // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-parameters -- T documents the per-decoration type for consumers
-      value: (key, value) => {
-        if (typeof key !== "string") {
-          throw new TypeError(
-            `decorateRequest: invalid key (expected string, got ${typeof key}). Plugin authors MUST pass string keys.`
-          );
-        }
-        decorations.set(key, value);
-      },
-      enumerable: false,
-      writable: false,
-      configurable: false
-    });
-    Object.defineProperty(childApp, "decorations", {
-      get: () => Object.fromEntries(decorations),
-      enumerable: false,
-      configurable: false
-    });
-    return { app: childApp, decorations };
-  }
-  routeHookByName(name, fn) {
-    switch (name) {
-      case "onRequest":
-        this.onRequestHooks.push(fn);
-        return;
-      case "preHandler":
-        this.preHandlerHooks.push(fn);
-        return;
-      case "onResponse":
-        this.onResponseHooks.push(fn);
-        return;
-      case "onError":
-        this.onErrorHooks.push(fn);
-        return;
-    }
-  }
-  /**
-   * Apply ALL plugin scopes' decorations into the request ctx. Per T3.1,
-   * sibling plugins MAY decorate the same key — last-writer-wins at apply
-   * time (ordering = registration order). This keeps the legacy
-   * `ctx.<key>` flat surface working for consumers that already aggregate
-   * decorations into a single bag.
-   */
-  applyDecorations(ctx) {
-    for (const scope of this.pluginScopes.values()) {
-      for (const [key, value] of scope.decorations.entries()) {
-        ctx[key] = value;
-      }
-    }
-  }
-  /**
-   * Apply ONLY one plugin's scoped decorations into `target`. Used by
-   * the T1.1 RED-3 test (sibling isolation proof) and by future scope-aware
-   * dispatch paths. Throws if the plugin name isn't registered.
-   */
-  applyScopedDecorations(pluginName, target) {
-    const scope = this.pluginScopes.get(pluginName);
-    if (!scope) throw new Error(`PluginRunner: unknown plugin "${pluginName}"`);
-    for (const [key, value] of scope.decorations.entries()) {
-      target[key] = value;
-    }
-  }
-  /** T1.1 RED-1/RED-4 introspection: returns the child TheoApp built for `pluginName`. */
-  getPluginScope(pluginName) {
-    const scope = this.pluginScopes.get(pluginName);
-    if (!scope) throw new Error(`PluginRunner: unknown plugin "${pluginName}"`);
-    return scope.app;
-  }
-  /** T1.1 RED-4: returns the parent TheoApp (root of every child's proto chain). */
-  getParentApp() {
-    return this.parentApp;
-  }
-  /** T1.1 RED-2: returns the parent's decorations map (NEVER touched by plugin decorate calls under T3.1 contract). */
-  getParentDecorations() {
-    return this.parentDecorations;
-  }
-  async runOnRequest(ctx) {
-    return this.runHookList(this.onRequestHooks, ctx);
-  }
-  async runPreHandler(ctx) {
-    return this.runHookList(this.preHandlerHooks, ctx);
-  }
-  async runOnResponse(ctx, options = {}) {
-    return this.runHookList(this.onResponseHooks, ctx, options);
-  }
-  /**
-   * Run all onError hooks. Swallows errors thrown inside hooks themselves to
-   * prevent recursion (an error in an error handler must not trigger onError
-   * again).
-   */
-  async runOnError(ctx, error) {
-    const errorCtx = { ...ctx, error };
-    for (const hook of this.onErrorHooks) {
-      try {
-        await hook(errorCtx);
-      } catch (innerErr) {
-        console.error(
-          `[plugin-runner] onError hook threw; suppressed to avoid recursion:`,
-          innerErr
-        );
-      }
-    }
-    return { shortCircuited: false };
-  }
-  async runHookList(hooks, ctx, options = {}) {
-    for (const hook of hooks) {
-      try {
-        await hook(ctx);
-      } catch (err) {
-        if (options.inErrorPath) {
-          console.error(`[plugin-runner] hook threw during error path; suppressed (EC-9):`, err);
-          continue;
-        }
-        throw err;
-      }
-      if (ctx.response.writableEnded || ctx.response.headersSent) {
-        return { shortCircuited: true };
-      }
-    }
-    return { shortCircuited: false };
-  }
-};
-
-// src/server/plugins/load-plugins.ts
-var InvalidPluginShapeError = class extends Error {
-  constructor(index, reason) {
-    super(`plugins[${index}] is not a valid TheoPlugin: ${reason}`);
-    this.name = "InvalidPluginShapeError";
-  }
-};
-function isPlugin(value, index) {
-  if (value == null || typeof value !== "object") {
-    throw new InvalidPluginShapeError(index, "expected an object");
-  }
-  const v = value;
-  if (typeof v.name !== "string" || v.name.length === 0) {
-    throw new InvalidPluginShapeError(index, 'missing "name" string');
-  }
-  if (typeof v.register !== "function") {
-    throw new InvalidPluginShapeError(index, 'missing "register" function');
-  }
-  return true;
-}
-async function createPluginRunnerFromConfig(plugins) {
-  if (plugins == null) return void 0;
-  if (!Array.isArray(plugins)) return void 0;
-  if (plugins.length === 0) return void 0;
-  const runner = new PluginRunner();
-  const pluginsArray = plugins;
-  for (let i = 0; i < pluginsArray.length; i++) {
-    const candidate = pluginsArray[i];
-    if (!isPlugin(candidate, i)) {
-      continue;
-    }
-    await runner.register(candidate);
-  }
-  return runner;
-}
-
-// src/server/rate-limit/rate-limit-store.ts
-var InMemoryStore = class _InMemoryStore {
-  store = /* @__PURE__ */ new Map();
-  /** Bound the map to prevent unbounded growth from pathological inputs. */
-  static MAX_ENTRIES = 1e5;
-  /** GC sweep interval, milliseconds. */
-  static GC_INTERVAL_MS = 3e4;
-  gcTimer = null;
-  constructor() {
-    if (typeof setInterval !== "undefined") {
-      const timer = setInterval(() => {
-        this.sweepExpired();
-      }, _InMemoryStore.GC_INTERVAL_MS);
-      this.gcTimer = timer;
-      const maybeUnref = timer.unref;
-      if (typeof maybeUnref === "function") maybeUnref.call(timer);
-    }
-  }
-  /**
-   * Synchronous fast-path used by the legacy sync `createRateLimiter`
-   * surface (`api-middleware.ts` is sync). The async `incr` delegates to
-   * this for in-memory; external adapters override `incr` directly.
-   */
-  incrSync(key, windowMs) {
-    if (!Number.isFinite(windowMs) || windowMs <= 0) {
-      throw new Error(
-        `InMemoryStore.incr: windowMs must be a positive finite number (got ${windowMs})`
-      );
-    }
-    const now = Date.now();
-    if (this.store.size >= _InMemoryStore.MAX_ENTRIES) {
-      const first = this.store.keys().next().value;
-      if (first !== void 0) this.store.delete(first);
-    }
-    const entry = this.store.get(key);
-    if (!entry || now >= entry.resetAt) {
-      const fresh = { count: 1, resetAt: now + windowMs };
-      this.store.set(key, fresh);
-      return { ...fresh };
-    }
-    entry.count++;
-    return { count: entry.count, resetAt: entry.resetAt };
-  }
-  /** Sweep expired entries. Called by the GC timer; safe to call manually. */
-  sweepExpired() {
-    const now = Date.now();
-    for (const [k, v] of this.store) {
-      if (v.resetAt <= now) this.store.delete(k);
-    }
-  }
-  /**
-   * Stop the GC timer. Call from tests or when discarding the store. After
-   * `dispose`, the store still works but no longer auto-sweeps.
-   */
-  dispose() {
-    if (this.gcTimer) {
-      clearInterval(this.gcTimer);
-      this.gcTimer = null;
-    }
-  }
-  // The async surface is required by the `RateLimitStore` interface
-  // (Redis/etc. adapters are inherently async). For the in-memory case
-  // we just adapt the sync implementations to Promises.
-  // eslint-disable-next-line @typescript-eslint/require-await -- interface contract: async return
-  async incr(key, windowMs) {
-    return this.incrSync(key, windowMs);
-  }
-  // eslint-disable-next-line @typescript-eslint/require-await -- interface contract: async return
-  async get(key) {
-    const now = Date.now();
-    const entry = this.store.get(key);
-    if (!entry) return null;
-    if (now >= entry.resetAt) return null;
-    return { count: entry.count, resetAt: entry.resetAt };
-  }
-  // eslint-disable-next-line @typescript-eslint/require-await -- interface contract: async return
-  async reset(key) {
-    this.store.delete(key);
-  }
-};
-
-// src/server/rate-limit/rate-limit.ts
-function createRateLimiter(config, opts = {}) {
-  const store = opts.store ?? new InMemoryStore();
-  const isInMemory = store instanceof InMemoryStore;
-  return function checkRateLimit(req) {
-    const key = req.socket?.remoteAddress ?? "unknown";
-    if (isInMemory) {
-      const state = store.incrSync(key, config.windowMs);
-      return resultFromState(state, config);
-    }
-    throw new Error(
-      "createRateLimiter: async RateLimitStore implementations are not supported by this sync fa\xE7ade. Use the InMemoryStore default or build a custom middleware around the async store directly."
-    );
-  };
-}
-function resultFromState(state, config) {
-  if (state.count > config.max) {
-    const retryAfter = Math.ceil((state.resetAt - Date.now()) / 1e3);
-    return {
-      limited: true,
-      headers: {
-        "X-RateLimit-Limit": String(config.max),
-        "X-RateLimit-Remaining": "0",
-        "Retry-After": String(retryAfter)
-      }
-    };
-  }
-  return {
-    limited: false,
-    headers: {
-      "X-RateLimit-Limit": String(config.max),
-      "X-RateLimit-Remaining": String(Math.max(0, config.max - state.count))
-    }
-  };
-}
-
-// src/server/scan/module-loader.ts
-import { pathToFileURL } from "url";
-function createViteLoader(vite) {
-  return (path) => vite.ssrLoadModule(path);
-}
-function createProductionLoader() {
-  return async (path) => {
-    const url = pathToFileURL(path).href;
-    return import(url);
-  };
-}
-
 // src/server/body-parser.ts
 import { basename } from "path";
 import Busboy from "busboy";
@@ -872,6 +503,13 @@ function validateCsrf(req) {
     host: host !== void 0 ? pickHeader(host) || null : null
   });
 }
+function validateCsrfRequest(request) {
+  return isCsrfValidFromHeaders({
+    csrfActionHeader: request.headers.get("x-theo-action"),
+    origin: request.headers.get("origin"),
+    host: request.headers.get("host")
+  });
+}
 function dispatchCsrfWarn2(req, reason, logger, auditLogger, pathFallback = "") {
   const payload = {
     event: "csrf.warn",
@@ -1205,796 +843,1165 @@ async function executeRoute(ctx) {
         return;
       }
     }
-    const rc = routeConfig;
-    const parseResult = await parseQueryAndBody(req, res, requestId);
-    if (!parseResult.ok) return;
-    const { query } = parseResult.data;
-    let { body } = parseResult.data;
-    const validationResult = runZodValidation(rc, res, requestId, { query, body, params });
-    if (!validationResult.ok) return;
-    body = validationResult.data.body;
-    if (pluginRunner) {
-      const preResult = await pluginRunner.runPreHandler(buildPluginCtx(ctx2));
-      if (preResult.shortCircuited) return;
-    }
-    const callableHandler = handler;
-    const handlerResult = await callableHandler({ query, body, params, request: req, ctx: ctx2 });
-    if (handlerResult === void 0 || handlerResult === null) {
-      sendJson(res, null, rc.status ?? 204, transformer);
-      if (pluginRunner) await pluginRunner.runOnResponse(buildPluginCtx(ctx2));
-      return;
-    }
-    if (handlerResult instanceof Response) {
-      const headersBag = {};
-      for (const [k, v] of handlerResult.headers) {
-        if (k.toLowerCase() !== "set-cookie") headersBag[k] = v;
-      }
-      const setCookies = handlerResult.headers.getSetCookie();
-      if (setCookies.length > 0) {
-        res.setHeader("Set-Cookie", setCookies);
-      }
-      res.writeHead(handlerResult.status, headersBag);
-      if (handlerResult.body) {
-        await pipeWebStreamToResponse(handlerResult.body, res, {
-          buildPluginCtx,
-          ctx: ctx2,
-          method,
-          pluginRunner,
-          requestId,
-          routePath: route.routePath
-        });
+    const rc = routeConfig;
+    const parseResult = await parseQueryAndBody(req, res, requestId);
+    if (!parseResult.ok) return;
+    const { query } = parseResult.data;
+    let { body } = parseResult.data;
+    const validationResult = runZodValidation(rc, res, requestId, { query, body, params });
+    if (!validationResult.ok) return;
+    body = validationResult.data.body;
+    if (pluginRunner) {
+      const preResult = await pluginRunner.runPreHandler(buildPluginCtx(ctx2));
+      if (preResult.shortCircuited) return;
+    }
+    const callableHandler = handler;
+    const handlerResult = await callableHandler({ query, body, params, request: req, ctx: ctx2 });
+    if (handlerResult === void 0 || handlerResult === null) {
+      sendJson(res, null, rc.status ?? 204, transformer);
+      if (pluginRunner) await pluginRunner.runOnResponse(buildPluginCtx(ctx2));
+      return;
+    }
+    if (handlerResult instanceof Response) {
+      const headersBag = {};
+      for (const [k, v] of handlerResult.headers) {
+        if (k.toLowerCase() !== "set-cookie") headersBag[k] = v;
+      }
+      const setCookies = handlerResult.headers.getSetCookie();
+      if (setCookies.length > 0) {
+        res.setHeader("Set-Cookie", setCookies);
+      }
+      res.writeHead(handlerResult.status, headersBag);
+      if (handlerResult.body) {
+        await pipeWebStreamToResponse(handlerResult.body, res, {
+          buildPluginCtx,
+          ctx: ctx2,
+          method,
+          pluginRunner,
+          requestId,
+          routePath: route.routePath
+        });
+      }
+      res.end();
+      if (pluginRunner) await pluginRunner.runOnResponse(buildPluginCtx(ctx2));
+      return;
+    }
+    let responseBody = handlerResult;
+    if (isZodLike(rc.response)) {
+      const parsed = rc.response.safeParse(handlerResult);
+      if (!parsed.success) {
+        throw new TheoError({
+          code: "INTERNAL_SERVER_ERROR",
+          message: "response validation failed",
+          ext: { issues: parsed.error?.issues }
+        });
+      }
+      responseBody = parsed.data;
+    }
+    sendJson(res, responseBody, rc.status ?? 200, transformer);
+    if (pluginRunner) await pluginRunner.runOnResponse(buildPluginCtx(ctx2));
+  } catch (err) {
+    if (pluginRunner) {
+      const errCtxObj = {};
+      pluginRunner.applyDecorations(errCtxObj);
+      await pluginRunner.runOnError(buildPluginCtx(errCtxObj), err);
+      if (res.writableEnded) {
+        await pluginRunner.runOnResponse(buildPluginCtx(errCtxObj), { inErrorPath: true });
+        return;
+      }
+    }
+    if (isAuthRequiredError(err)) {
+      const authErr = err;
+      sendError(res, authErr.code, authErr.message, authErr.status, void 0, requestId);
+      if (pluginRunner) {
+        const errCtxObj = {};
+        pluginRunner.applyDecorations(errCtxObj);
+        await pluginRunner.runOnResponse(buildPluginCtx(errCtxObj), { inErrorPath: true });
+      }
+      return;
+    }
+    sendError(
+      res,
+      "INTERNAL_ERROR",
+      err instanceof Error && err.message ? err.message : "Internal server error",
+      500,
+      void 0,
+      requestId
+    );
+    if (pluginRunner) {
+      const errCtxObj = {};
+      pluginRunner.applyDecorations(errCtxObj);
+      await pluginRunner.runOnResponse(buildPluginCtx(errCtxObj), { inErrorPath: true });
+    }
+  }
+}
+
+// src/core/contracts/action-protocol.ts
+var CODE_TO_STATUS = {
+  VALIDATION_ERROR: 422,
+  BAD_REQUEST: 400,
+  UNAUTHORIZED: 401,
+  FORBIDDEN: 403,
+  NOT_FOUND: 404,
+  METHOD_NOT_ALLOWED: 405,
+  CONFLICT: 409,
+  CONTENT_TOO_LARGE: 413,
+  PAYLOAD_TOO_LARGE: 413,
+  UNSUPPORTED_MEDIA_TYPE: 415,
+  TOO_MANY_REQUESTS: 429,
+  INTERNAL_SERVER_ERROR: 500
+};
+var STATUS_TO_CODE = {
+  400: "BAD_REQUEST",
+  401: "UNAUTHORIZED",
+  403: "FORBIDDEN",
+  404: "NOT_FOUND",
+  405: "METHOD_NOT_ALLOWED",
+  409: "CONFLICT",
+  413: "PAYLOAD_TOO_LARGE",
+  415: "UNSUPPORTED_MEDIA_TYPE",
+  422: "VALIDATION_ERROR",
+  429: "TOO_MANY_REQUESTS",
+  500: "INTERNAL_SERVER_ERROR"
+};
+var ActionError = class _ActionError extends Error {
+  // Discriminator widened to the full union so subclasses can narrow to their
+  // specific literal (TypeScript would otherwise reject the override). Concrete
+  // values are still always exact literals at runtime.
+  type = "TheoActionError";
+  code;
+  status;
+  constructor(params) {
+    super(params.message ?? params.code);
+    this.code = params.code;
+    this.status = _ActionError.codeToStatus(params.code);
+    if (params.stack) {
+      this.stack = params.stack;
+    }
+  }
+  /**
+   * G5 T2.4 — canonical envelope view of the action error. Maps the G3
+   * ActionErrorCode to a canonical TheoErrorCode (VALIDATION_ERROR ↔
+   * UNPROCESSABLE_ENTITY, CONTENT_TOO_LARGE ↔ PAYLOAD_TOO_LARGE) so consumer
+   * UI / SDK code can switch on the unified envelope.
+   *
+   * Subclasses override to populate `ext` (see `ActionInputError.envelope`).
+   */
+  get envelope() {
+    return {
+      code: _ActionError.toTheoErrorCode(this.code),
+      message: this.message
+    };
+  }
+  /**
+   * Translate G3 ActionErrorCode → canonical TheoErrorCode (blueprint
+   * Recommendations § "G3 ActionError becomes inaugural envelope user").
+   */
+  static toTheoErrorCode(code) {
+    if (code === "VALIDATION_ERROR") return "UNPROCESSABLE_ENTITY";
+    if (code === "CONTENT_TOO_LARGE") return "PAYLOAD_TOO_LARGE";
+    return code;
+  }
+  static codeToStatus(code) {
+    return CODE_TO_STATUS[code];
+  }
+  static statusToCode(status) {
+    return STATUS_TO_CODE[status] ?? "INTERNAL_SERVER_ERROR";
+  }
+  /**
+   * Parse a serialized error JSON back into the typed class hierarchy.
+   * Distinguishes `TheoActionInputError` (with `issues` array) from
+   * `TheoActionError` via the `type` discriminator. Falls back to
+   * `INTERNAL_SERVER_ERROR` for malformed bodies (non-object, missing
+   * `type`, unknown `code`).
+   */
+  static fromJson(body) {
+    if (typeof body !== "object" || body === null) {
+      return new _ActionError({ code: "INTERNAL_SERVER_ERROR" });
+    }
+    const obj = body;
+    if (obj.type === "TheoActionInputError" && Array.isArray(obj.issues)) {
+      return new ActionInputError(obj.issues);
+    }
+    if (obj.type === "TheoActionError" && typeof obj.code === "string" && obj.code in CODE_TO_STATUS) {
+      return new _ActionError({
+        code: obj.code,
+        message: typeof obj.message === "string" ? obj.message : void 0
+      });
+    }
+    return new _ActionError({ code: "INTERNAL_SERVER_ERROR" });
+  }
+};
+var ActionInputError = class extends ActionError {
+  type = "TheoActionInputError";
+  issues;
+  fields;
+  constructor(rawIssues) {
+    super({ code: "VALIDATION_ERROR", message: "Validation failed" });
+    this.issues = extractUniversalIssues(rawIssues);
+    this.fields = buildFieldsMap(this.issues);
+  }
+  /**
+   * G5 T2.4 — envelope view with ValidationFieldsExt populated from .fields.
+   * UI consumers can `switch (env.code)` on `UNPROCESSABLE_ENTITY` and read
+   * `(env.ext as ValidationFieldsExt).fields` for field-level rendering.
+   */
+  get envelope() {
+    return {
+      code: "UNPROCESSABLE_ENTITY",
+      message: this.message,
+      ext: { fields: this.fields }
+    };
+  }
+};
+function buildFieldsMap(issues) {
+  const fields = {};
+  const seen = /* @__PURE__ */ new Set();
+  for (const issue of issues) {
+    const key = issue.path.length === 0 ? "" : issue.path.join(".");
+    const dedupeKey = `${key}\0${issue.message}`;
+    if (seen.has(dedupeKey)) continue;
+    seen.add(dedupeKey);
+    const bucket = fields[key] ?? [];
+    bucket.push(issue.message);
+    fields[key] = bucket;
+  }
+  return fields;
+}
+function extractUniversalIssues(raw) {
+  if (!Array.isArray(raw)) return [];
+  const out = [];
+  for (const entry of raw) {
+    if (typeof entry !== "object" || entry === null) continue;
+    const obj = entry;
+    if (!Array.isArray(obj.path)) continue;
+    if (typeof obj.message !== "string") continue;
+    const path = [];
+    let pathValid = true;
+    for (const seg of obj.path) {
+      if (typeof seg === "string" || typeof seg === "number") {
+        path.push(seg);
+      } else {
+        pathValid = false;
+        break;
+      }
+    }
+    if (!pathValid) continue;
+    out.push({
+      path,
+      message: obj.message,
+      code: typeof obj.code === "string" ? obj.code : void 0
+    });
+  }
+  return out;
+}
+
+// src/server/http/form-data-to-object.ts
+import { z } from "zod";
+function formDataToObject(formData, schema, prefix = "") {
+  const shape = schema.shape;
+  const out = {};
+  for (const [key, rawValidator] of Object.entries(shape)) {
+    const fullKey = prefix + key;
+    const validator = unwrapWrappers(rawValidator);
+    if (validator instanceof z.ZodObject) {
+      const nestedPrefix = `${fullKey}.`;
+      const hasNestedKeys = [...formData.keys()].some((k) => k.startsWith(nestedPrefix));
+      if (hasNestedKeys) {
+        out[key] = formDataToObject(formData, validator, nestedPrefix);
+        continue;
       }
-      res.end();
-      if (pluginRunner) await pluginRunner.runOnResponse(buildPluginCtx(ctx2));
-      return;
+      out[key] = unwrapMissingDefault(rawValidator);
+      continue;
     }
-    let responseBody = handlerResult;
-    if (isZodLike(rc.response)) {
-      const parsed = rc.response.safeParse(handlerResult);
-      if (!parsed.success) {
-        throw new TheoError({
-          code: "INTERNAL_SERVER_ERROR",
-          message: "response validation failed",
-          ext: { issues: parsed.error?.issues }
-        });
-      }
-      responseBody = parsed.data;
+    if (validator instanceof z.ZodArray) {
+      const values = formData.getAll(fullKey);
+      out[key] = coerceArrayElements(values, validator);
+      continue;
     }
-    sendJson(res, responseBody, rc.status ?? 200, transformer);
-    if (pluginRunner) await pluginRunner.runOnResponse(buildPluginCtx(ctx2));
-  } catch (err) {
-    if (pluginRunner) {
-      const errCtxObj = {};
-      pluginRunner.applyDecorations(errCtxObj);
-      await pluginRunner.runOnError(buildPluginCtx(errCtxObj), err);
-      if (res.writableEnded) {
-        await pluginRunner.runOnResponse(buildPluginCtx(errCtxObj), { inErrorPath: true });
-        return;
-      }
+    if (validator instanceof z.ZodBoolean) {
+      out[key] = coerceBoolean(formData, fullKey);
+      continue;
     }
-    if (isAuthRequiredError(err)) {
-      const authErr = err;
-      sendError(res, authErr.code, authErr.message, authErr.status, void 0, requestId);
-      if (pluginRunner) {
-        const errCtxObj = {};
-        pluginRunner.applyDecorations(errCtxObj);
-        await pluginRunner.runOnResponse(buildPluginCtx(errCtxObj), { inErrorPath: true });
-      }
-      return;
+    if (formData.has(fullKey)) {
+      const raw = formData.get(fullKey);
+      out[key] = coerceScalar(raw, validator);
+    } else {
+      out[key] = unwrapMissingDefault(rawValidator);
     }
-    sendError(
-      res,
-      "INTERNAL_ERROR",
-      err instanceof Error && err.message ? err.message : "Internal server error",
-      500,
-      void 0,
-      requestId
-    );
-    if (pluginRunner) {
-      const errCtxObj = {};
-      pluginRunner.applyDecorations(errCtxObj);
-      await pluginRunner.runOnResponse(buildPluginCtx(errCtxObj), { inErrorPath: true });
+  }
+  return out;
+}
+function unwrapWrappers(validator) {
+  let inner = validator;
+  while (inner instanceof z.ZodOptional || inner instanceof z.ZodNullable || inner instanceof z.ZodDefault) {
+    inner = getInnerType(inner);
+  }
+  return inner;
+}
+function getInnerType(wrapper) {
+  const def = wrapper.def;
+  if (def.innerType) return def.innerType;
+  const legacyDef = wrapper._def;
+  if (legacyDef?.innerType) return legacyDef.innerType;
+  return wrapper;
+}
+function unwrapMissingDefault(validator) {
+  let cursor = validator;
+  while (cursor instanceof z.ZodOptional || cursor instanceof z.ZodNullable || cursor instanceof z.ZodDefault) {
+    if (cursor instanceof z.ZodDefault) {
+      const def = cursor.def;
+      return typeof def.defaultValue === "function" ? def.defaultValue() : def.defaultValue;
     }
+    if (cursor instanceof z.ZodNullable) return null;
+    cursor = getInnerType(cursor);
+  }
+  return void 0;
+}
+function coerceScalar(raw, validator) {
+  if (raw === null) return void 0;
+  if (validator instanceof z.ZodNumber) {
+    return typeof raw === "string" ? Number(raw) : raw;
+  }
+  return raw;
+}
+function coerceArrayElements(values, arrayValidator) {
+  const def = arrayValidator.def;
+  const elementSchema = def.element ?? (def.type instanceof z.ZodType ? def.type : void 0);
+  const elementType = elementSchema ? unwrapWrappers(elementSchema) : void 0;
+  if (elementType instanceof z.ZodNumber) {
+    return values.map((v) => typeof v === "string" ? Number(v) : v);
+  }
+  if (elementType instanceof z.ZodBoolean) {
+    return values.map((v) => {
+      if (v === "true") return true;
+      if (v === "false") return false;
+      return Boolean(v);
+    });
   }
+  return values;
+}
+function coerceBoolean(formData, key) {
+  if (!formData.has(key)) return void 0;
+  const val = formData.get(key);
+  if (val === "true") return true;
+  if (val === "false") return false;
+  return Boolean(val);
 }
 
-// src/core/contracts/action-protocol.ts
-var CODE_TO_STATUS = {
-  VALIDATION_ERROR: 422,
+// src/core/contracts/envelope-code-to-status.ts
+var CODE_TO_STATUS2 = {
+  // 4xx — client errors
   BAD_REQUEST: 400,
   UNAUTHORIZED: 401,
   FORBIDDEN: 403,
   NOT_FOUND: 404,
   METHOD_NOT_ALLOWED: 405,
   CONFLICT: 409,
-  CONTENT_TOO_LARGE: 413,
+  PRECONDITION_FAILED: 412,
   PAYLOAD_TOO_LARGE: 413,
   UNSUPPORTED_MEDIA_TYPE: 415,
+  UNPROCESSABLE_ENTITY: 422,
   TOO_MANY_REQUESTS: 429,
-  INTERNAL_SERVER_ERROR: 500
-};
-var STATUS_TO_CODE = {
-  400: "BAD_REQUEST",
-  401: "UNAUTHORIZED",
-  403: "FORBIDDEN",
-  404: "NOT_FOUND",
-  405: "METHOD_NOT_ALLOWED",
-  409: "CONFLICT",
-  413: "PAYLOAD_TOO_LARGE",
-  415: "UNSUPPORTED_MEDIA_TYPE",
-  422: "VALIDATION_ERROR",
-  429: "TOO_MANY_REQUESTS",
-  500: "INTERNAL_SERVER_ERROR"
+  RATE_LIMITED: 429,
+  // 5xx — server errors
+  INTERNAL_SERVER_ERROR: 500,
+  NOT_IMPLEMENTED: 501,
+  BAD_GATEWAY: 502,
+  SERVICE_UNAVAILABLE: 503,
+  GATEWAY_TIMEOUT: 504,
+  // SDK-domain codes — intentionally 500
+  AGENT_RUN_ERROR: 500,
+  PROVIDER_KEY_MISSING: 500,
+  BUDGET_EXCEEDED: 500,
+  CREDENTIAL_POOL_EXHAUSTED: 500
 };
-var ActionError = class _ActionError extends Error {
-  // Discriminator widened to the full union so subclasses can narrow to their
-  // specific literal (TypeScript would otherwise reject the override). Concrete
-  // values are still always exact literals at runtime.
-  type = "TheoActionError";
-  code;
-  status;
-  constructor(params) {
-    super(params.message ?? params.code);
-    this.code = params.code;
-    this.status = _ActionError.codeToStatus(params.code);
-    if (params.stack) {
-      this.stack = params.stack;
+function envelopeCodeToStatus(code) {
+  return CODE_TO_STATUS2[code] ?? 500;
+}
+
+// src/server/http/handle-request-error.ts
+async function handleRequestError(err, c) {
+  if (c.pluginRunner) {
+    const errCtxObj = {};
+    c.pluginRunner.applyDecorations(errCtxObj);
+    try {
+      await c.pluginRunner.runOnError(c.buildPluginCtx(errCtxObj), err);
+    } catch {
+    }
+    if (c.res.writableEnded) {
+      try {
+        await c.pluginRunner.runOnResponse(c.buildPluginCtx(errCtxObj), {
+          inErrorPath: true
+        });
+      } catch {
+      }
+      return;
+    }
+  }
+  if (isAuthRequiredError(err)) {
+    const authErr = err;
+    sendError(c.res, authErr.code, authErr.message, authErr.status, void 0, c.requestId);
+  } else {
+    const envelope = serverErrorToEnvelope(err);
+    if (envelope.code === "INTERNAL_SERVER_ERROR") {
+      sendError(
+        c.res,
+        "INTERNAL_ERROR",
+        err instanceof Error ? err.message : "Internal server error",
+        500,
+        void 0,
+        c.requestId
+      );
+    } else {
+      sendError(
+        c.res,
+        envelope.code,
+        envelope.message,
+        envelopeCodeToStatus(envelope.code),
+        void 0,
+        c.requestId
+      );
     }
   }
-  /**
-   * G5 T2.4 — canonical envelope view of the action error. Maps the G3
-   * ActionErrorCode to a canonical TheoErrorCode (VALIDATION_ERROR ↔
-   * UNPROCESSABLE_ENTITY, CONTENT_TOO_LARGE ↔ PAYLOAD_TOO_LARGE) so consumer
-   * UI / SDK code can switch on the unified envelope.
-   *
-   * Subclasses override to populate `ext` (see `ActionInputError.envelope`).
-   */
-  get envelope() {
+  if (c.pluginRunner) {
+    const errCtxObj = {};
+    c.pluginRunner.applyDecorations(errCtxObj);
+    try {
+      await c.pluginRunner.runOnResponse(c.buildPluginCtx(errCtxObj), {
+        inErrorPath: true
+      });
+    } catch {
+    }
+  }
+}
+
+// src/server/http/serialize-action-result.ts
+import { stringify as devalueStringify } from "devalue";
+var DEFAULT_RESPONSE_BODY_SIZE_LIMIT = 5 * 1024 * 1024;
+function serializeActionResult(result, options = {}) {
+  const limit = options.responseBodySizeLimit ?? DEFAULT_RESPONSE_BODY_SIZE_LIMIT;
+  if (result.error !== void 0) {
+    const body2 = result.error instanceof ActionInputError ? JSON.stringify({
+      type: result.error.type,
+      code: result.error.code,
+      message: result.error.message,
+      issues: result.error.issues,
+      fields: result.error.fields
+    }) : JSON.stringify({
+      type: result.error.type,
+      code: result.error.code,
+      message: result.error.message
+    });
+    if (Buffer.byteLength(body2, "utf8") > limit) {
+      throw new ActionError({
+        code: "PAYLOAD_TOO_LARGE",
+        message: `Serialized error body exceeds limit (${limit} bytes)`
+      });
+    }
     return {
-      code: _ActionError.toTheoErrorCode(this.code),
-      message: this.message
+      type: "error",
+      status: result.error.status,
+      contentType: "application/json",
+      body: body2
     };
   }
-  /**
-   * Translate G3 ActionErrorCode → canonical TheoErrorCode (blueprint
-   * Recommendations § "G3 ActionError becomes inaugural envelope user").
-   */
-  static toTheoErrorCode(code) {
-    if (code === "VALIDATION_ERROR") return "UNPROCESSABLE_ENTITY";
-    if (code === "CONTENT_TOO_LARGE") return "PAYLOAD_TOO_LARGE";
-    return code;
-  }
-  static codeToStatus(code) {
-    return CODE_TO_STATUS[code];
+  if (result.data === void 0) {
+    return { type: "empty", status: 204 };
   }
-  static statusToCode(status) {
-    return STATUS_TO_CODE[status] ?? "INTERNAL_SERVER_ERROR";
+  if (result.data instanceof Response) {
+    throw new ActionError({
+      code: "INTERNAL_SERVER_ERROR",
+      message: "Action handler cannot serialize Response objects \u2014 return plain data instead"
+    });
   }
-  /**
-   * Parse a serialized error JSON back into the typed class hierarchy.
-   * Distinguishes `TheoActionInputError` (with `issues` array) from
-   * `TheoActionError` via the `type` discriminator. Falls back to
-   * `INTERNAL_SERVER_ERROR` for malformed bodies (non-object, missing
-   * `type`, unknown `code`).
-   */
-  static fromJson(body) {
-    if (typeof body !== "object" || body === null) {
-      return new _ActionError({ code: "INTERNAL_SERVER_ERROR" });
-    }
-    const obj = body;
-    if (obj.type === "TheoActionInputError" && Array.isArray(obj.issues)) {
-      return new ActionInputError(obj.issues);
-    }
-    if (obj.type === "TheoActionError" && typeof obj.code === "string" && obj.code in CODE_TO_STATUS) {
-      return new _ActionError({
-        code: obj.code,
-        message: typeof obj.message === "string" ? obj.message : void 0
-      });
-    }
-    return new _ActionError({ code: "INTERNAL_SERVER_ERROR" });
+  let body;
+  try {
+    body = devalueStringify(result.data, {
+      URL: (value) => value instanceof URL && value.href
+    });
+  } catch (e) {
+    throw new ActionError({
+      code: "INTERNAL_SERVER_ERROR",
+      message: `Action data not serializable: ${e instanceof Error ? e.message : String(e)}`
+    });
   }
-};
-var ActionInputError = class extends ActionError {
-  type = "TheoActionInputError";
-  issues;
-  fields;
-  constructor(rawIssues) {
-    super({ code: "VALIDATION_ERROR", message: "Validation failed" });
-    this.issues = extractUniversalIssues(rawIssues);
-    this.fields = buildFieldsMap(this.issues);
+  if (Buffer.byteLength(body, "utf8") > limit) {
+    throw new ActionError({
+      code: "PAYLOAD_TOO_LARGE",
+      message: `Serialized response body exceeds limit (${limit} bytes)`
+    });
   }
-  /**
-   * G5 T2.4 — envelope view with ValidationFieldsExt populated from .fields.
-   * UI consumers can `switch (env.code)` on `UNPROCESSABLE_ENTITY` and read
-   * `(env.ext as ValidationFieldsExt).fields` for field-level rendering.
-   */
-  get envelope() {
-    return {
-      code: "UNPROCESSABLE_ENTITY",
-      message: this.message,
-      ext: { fields: this.fields }
-    };
+  return {
+    type: "data",
+    status: 200,
+    contentType: "application/json+devalue",
+    body
+  };
+}
+
+// src/server/http/action-execute.ts
+var __IS_DEV = (() => {
+  try {
+    return import.meta.env?.DEV === true;
+  } catch {
+    return process.env.NODE_ENV !== "production";
   }
-};
-function buildFieldsMap(issues) {
-  const fields = {};
-  const seen = /* @__PURE__ */ new Set();
-  for (const issue of issues) {
-    const key = issue.path.length === 0 ? "" : issue.path.join(".");
-    const dedupeKey = `${key}\0${issue.message}`;
-    if (seen.has(dedupeKey)) continue;
-    seen.add(dedupeKey);
-    const bucket = fields[key] ?? [];
-    bucket.push(issue.message);
-    fields[key] = bucket;
+})();
+function isActionConfig(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const candidate = value;
+  if (typeof candidate.handler !== "function") return false;
+  const input = candidate.input;
+  return typeof input?.safeParse === "function";
+}
+async function executeAction(filePath, exportName, req, res, loadModule, serverDir, requestId, pluginRunner, csrfMode = "strict", disallowed) {
+  return executeActionWithOptions({
+    filePath,
+    exportName,
+    req,
+    res,
+    loadModule,
+    serverDir,
+    requestId,
+    pluginRunner,
+    csrfMode,
+    disallowed
+  });
+}
+async function loadActionConfig(loadModule, filePath, exportName, res, requestId) {
+  const mod = await loadModule(filePath);
+  const exportedValue = mod[exportName];
+  if (!isActionConfig(exportedValue)) {
+    sendError(res, "NOT_FOUND", `Action "${exportName}" not found`, 404, void 0, requestId);
+    return null;
   }
-  return fields;
+  return exportedValue;
 }
-function extractUniversalIssues(raw) {
-  if (!Array.isArray(raw)) return [];
-  const out = [];
-  for (const entry of raw) {
-    if (typeof entry !== "object" || entry === null) continue;
-    const obj = entry;
-    if (!Array.isArray(obj.path)) continue;
-    if (typeof obj.message !== "string") continue;
-    const path = [];
-    let pathValid = true;
-    for (const seg of obj.path) {
-      if (typeof seg === "string" || typeof seg === "number") {
-        path.push(seg);
-      } else {
-        pathValid = false;
-        break;
-      }
-    }
-    if (!pathValid) continue;
-    out.push({
-      path,
-      message: obj.message,
-      code: typeof obj.code === "string" ? obj.code : void 0
-    });
+function enforceCsrfForAction(req, res, ctx) {
+  if (ctx.actionConfig.csrf === false) return true;
+  const decision = enforceCsrf(
+    req,
+    ctx.csrfMode,
+    {
+      // T3.3 DRY — canonical dispatcher
+      warn: dispatchCsrfWarn,
+      path: req.url
+    },
+    ctx.disallowed
+  );
+  if (decision.allow) return true;
+  sendError(
+    res,
+    "CSRF_INVALID",
+    decision.reason ?? "CSRF check failed",
+    403,
+    void 0,
+    ctx.requestId
+  );
+  return false;
+}
+async function runPreHandlerPipeline(p) {
+  if (p.serverDir) {
+    const result = await runMiddlewareAndContext(p.req, p.res, p.loadModule, p.serverDir);
+    if (result.aborted) return false;
+    Object.assign(p.ctx, result.ctx ?? {});
+    p.pluginRunner?.applyDecorations(p.ctx);
+  }
+  if (p.pluginRunner) {
+    const preResult = await p.pluginRunner.runPreHandler(p.buildPluginCtx(p.ctx));
+    if (preResult.shortCircuited) return false;
   }
-  return out;
+  return true;
 }
-
-// src/server/http/form-data-to-object.ts
-import { z } from "zod";
-function formDataToObject(formData, schema, prefix = "") {
-  const shape = schema.shape;
-  const out = {};
-  for (const [key, rawValidator] of Object.entries(shape)) {
-    const fullKey = prefix + key;
-    const validator = unwrapWrappers(rawValidator);
-    if (validator instanceof z.ZodObject) {
-      const nestedPrefix = `${fullKey}.`;
-      const hasNestedKeys = [...formData.keys()].some((k) => k.startsWith(nestedPrefix));
-      if (hasNestedKeys) {
-        out[key] = formDataToObject(formData, validator, nestedPrefix);
-        continue;
-      }
-      out[key] = unwrapMissingDefault(rawValidator);
-      continue;
-    }
-    if (validator instanceof z.ZodArray) {
-      const values = formData.getAll(fullKey);
-      out[key] = coerceArrayElements(values, validator);
-      continue;
-    }
-    if (validator instanceof z.ZodBoolean) {
-      out[key] = coerceBoolean(formData, fullKey);
-      continue;
-    }
-    if (formData.has(fullKey)) {
-      const raw = formData.get(fullKey);
-      out[key] = coerceScalar(raw, validator);
+async function readActionBody(req, res, requestId, actionConfig) {
+  try {
+    const parsed = await parseRequestBody(req);
+    const accept = actionConfig.accept ?? "json";
+    let body;
+    if (accept === "form") {
+      body = formDataToObject(
+        synthesizeFormData(parsed),
+        actionConfig.input
+      );
+    } else if (parsed.json !== void 0) {
+      body = parsed.json;
     } else {
-      out[key] = unwrapMissingDefault(rawValidator);
+      body = parsed.fields;
     }
+    return { ok: true, body };
+  } catch (err) {
+    sendError(res, "VALIDATION_ERROR", err.message, 400, void 0, requestId);
+    return { ok: false };
   }
-  return out;
 }
-function unwrapWrappers(validator) {
-  let inner = validator;
-  while (inner instanceof z.ZodOptional || inner instanceof z.ZodNullable || inner instanceof z.ZodDefault) {
-    inner = getInnerType(inner);
+function synthesizeFormData(parsed) {
+  const fd = new FormData();
+  for (const [name, value] of Object.entries(parsed.fields)) {
+    fd.append(name, value);
   }
-  return inner;
-}
-function getInnerType(wrapper) {
-  const def = wrapper.def;
-  if (def.innerType) return def.innerType;
-  const legacyDef = wrapper._def;
-  if (legacyDef?.innerType) return legacyDef.innerType;
-  return wrapper;
-}
-function unwrapMissingDefault(validator) {
-  let cursor = validator;
-  while (cursor instanceof z.ZodOptional || cursor instanceof z.ZodNullable || cursor instanceof z.ZodDefault) {
-    if (cursor instanceof z.ZodDefault) {
-      const def = cursor.def;
-      return typeof def.defaultValue === "function" ? def.defaultValue() : def.defaultValue;
-    }
-    if (cursor instanceof z.ZodNullable) return null;
-    cursor = getInnerType(cursor);
+  for (const file of parsed.files) {
+    const blob = new Blob([file.buffer], {
+      type: file.mimeType
+    });
+    fd.append(file.fieldname, blob, file.filename);
   }
-  return void 0;
+  return fd;
 }
-function coerceScalar(raw, validator) {
-  if (raw === null) return void 0;
-  if (validator instanceof z.ZodNumber) {
-    return typeof raw === "string" ? Number(raw) : raw;
+function writeSerialized(res, serialized) {
+  if (serialized.type === "empty") {
+    res.statusCode = serialized.status;
+    res.end();
+    return;
   }
-  return raw;
+  res.statusCode = serialized.status;
+  res.setHeader("Content-Type", serialized.contentType);
+  res.end(serialized.body);
 }
-function coerceArrayElements(values, arrayValidator) {
-  const def = arrayValidator.def;
-  const elementSchema = def.element ?? (def.type instanceof z.ZodType ? def.type : void 0);
-  const elementType = elementSchema ? unwrapWrappers(elementSchema) : void 0;
-  if (elementType instanceof z.ZodNumber) {
-    return values.map((v) => typeof v === "string" ? Number(v) : v);
+async function emitActionCallTelemetry(name, startedAt, input, outcome) {
+  if (!__IS_DEV) return;
+  try {
+    const mod = await import("./dispatcher-EJHL6JMJ.js");
+    mod.dispatcher.onActionCall({
+      // eslint-disable-next-line sonarjs/pseudo-random -- non-secret correlation id
+      id: `act-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`,
+      timestamp: startedAt,
+      name,
+      input,
+      output: outcome.status === "success" ? outcome.output : void 0,
+      error: outcome.status === "error" ? {
+        code: outcome.error.code,
+        message: outcome.error.message,
+        fields: outcome.error instanceof ActionInputError ? outcome.error.fields : void 0
+      } : void 0,
+      durationMs: Date.now() - startedAt,
+      status: outcome.status
+    });
+  } catch {
   }
-  if (elementType instanceof z.ZodBoolean) {
-    return values.map((v) => {
-      if (v === "true") return true;
-      if (v === "false") return false;
-      return Boolean(v);
+}
+async function executeActionWithOptions(opts) {
+  const {
+    filePath,
+    exportName,
+    req,
+    res,
+    loadModule,
+    serverDir,
+    requestId,
+    pluginRunner,
+    csrfMode = "strict",
+    disallowed
+  } = opts;
+  const buildPluginCtx = (ctxObj) => ({
+    request: req,
+    response: res,
+    ctx: ctxObj,
+    requestId: requestId ?? "no-id"
+  });
+  let ctx = {};
+  try {
+    if ((req.method ?? "GET").toUpperCase() !== "POST") {
+      sendError(res, "METHOD_NOT_ALLOWED", "Actions only accept POST", 405, void 0, requestId);
+      return;
+    }
+    if (pluginRunner) {
+      pluginRunner.applyDecorations(ctx);
+      const onReqResult = await pluginRunner.runOnRequest(buildPluginCtx(ctx));
+      if (onReqResult.shortCircuited) return;
+    }
+    const actionConfig = await loadActionConfig(loadModule, filePath, exportName, res, requestId);
+    if (!actionConfig) return;
+    if (!enforceCsrfForAction(req, res, { actionConfig, csrfMode, disallowed, requestId })) {
+      return;
+    }
+    const pipeline = {
+      ctx,
+      buildPluginCtx,
+      pluginRunner,
+      serverDir,
+      loadModule,
+      req,
+      res
+    };
+    if (!await runPreHandlerPipeline(pipeline)) return;
+    ctx = pipeline.ctx;
+    const bodyOutcome = await readActionBody(req, res, requestId, actionConfig);
+    if (!bodyOutcome.ok) return;
+    const actionName = exportName === "default" ? deriveActionNameFromPath(filePath) : exportName;
+    const startedAt = Date.now();
+    const result = actionConfig.input.safeParse(bodyOutcome.body);
+    if (!result.success) {
+      const inputErr = new ActionInputError(result.error?.issues ?? []);
+      writeSerialized(res, serializeActionResult({ data: void 0, error: inputErr }));
+      await emitActionCallTelemetry(actionName, startedAt, bodyOutcome.body, {
+        status: "error",
+        error: inputErr
+      });
+      return;
+    }
+    await runActionHandler({
+      actionConfig,
+      actionName,
+      startedAt,
+      input: result.data,
+      ctx,
+      res,
+      pluginRunner,
+      buildPluginCtx
     });
+  } catch (err) {
+    await handleActionError(err, { req, res, ctx, requestId, pluginRunner, buildPluginCtx });
   }
-  return values;
 }
-function coerceBoolean(formData, key) {
-  if (!formData.has(key)) return void 0;
-  const val = formData.get(key);
-  if (val === "true") return true;
-  if (val === "false") return false;
-  return Boolean(val);
+function deriveActionNameFromPath(filePath) {
+  const base = filePath.split(/[\\/]/).pop() ?? "unknown";
+  return base.replace(/\.[jt]sx?$/, "");
 }
-
-// src/core/contracts/envelope-code-to-status.ts
-var CODE_TO_STATUS2 = {
-  // 4xx — client errors
-  BAD_REQUEST: 400,
-  UNAUTHORIZED: 401,
-  FORBIDDEN: 403,
-  NOT_FOUND: 404,
-  METHOD_NOT_ALLOWED: 405,
-  CONFLICT: 409,
-  PRECONDITION_FAILED: 412,
-  PAYLOAD_TOO_LARGE: 413,
-  UNSUPPORTED_MEDIA_TYPE: 415,
-  UNPROCESSABLE_ENTITY: 422,
-  TOO_MANY_REQUESTS: 429,
-  RATE_LIMITED: 429,
-  // 5xx — server errors
-  INTERNAL_SERVER_ERROR: 500,
-  NOT_IMPLEMENTED: 501,
-  BAD_GATEWAY: 502,
-  SERVICE_UNAVAILABLE: 503,
-  GATEWAY_TIMEOUT: 504,
-  // SDK-domain codes — intentionally 500
-  AGENT_RUN_ERROR: 500,
-  PROVIDER_KEY_MISSING: 500,
-  BUDGET_EXCEEDED: 500,
-  CREDENTIAL_POOL_EXHAUSTED: 500
-};
-function envelopeCodeToStatus(code) {
-  return CODE_TO_STATUS2[code] ?? 500;
+function isActionErrorLike(err) {
+  if (err === null || typeof err !== "object") return false;
+  const obj = err;
+  return (obj.type === "TheoActionError" || obj.type === "TheoActionInputError") && typeof obj.code === "string" && typeof obj.status === "number";
 }
-
-// src/server/http/handle-request-error.ts
-async function handleRequestError(err, c) {
-  if (c.pluginRunner) {
-    const errCtxObj = {};
-    c.pluginRunner.applyDecorations(errCtxObj);
-    try {
-      await c.pluginRunner.runOnError(c.buildPluginCtx(errCtxObj), err);
-    } catch {
+async function runActionHandler(args) {
+  try {
+    const handlerResult = await args.actionConfig.handler({ input: args.input, ctx: args.ctx });
+    writeSerialized(args.res, serializeActionResult({ data: handlerResult, error: void 0 }));
+    if (args.pluginRunner) {
+      await args.pluginRunner.runOnResponse(args.buildPluginCtx(args.ctx));
     }
-    if (c.res.writableEnded) {
-      try {
-        await c.pluginRunner.runOnResponse(c.buildPluginCtx(errCtxObj), {
-          inErrorPath: true
-        });
-      } catch {
-      }
+    await emitActionCallTelemetry(args.actionName, args.startedAt, args.input, {
+      status: "success",
+      output: handlerResult
+    });
+  } catch (err) {
+    if (isActionErrorLike(err)) {
+      writeSerialized(args.res, serializeActionResult({ data: void 0, error: err }));
+      await emitActionCallTelemetry(args.actionName, args.startedAt, args.input, {
+        status: "error",
+        error: err
+      });
       return;
     }
+    const wrapped = new ActionError({
+      code: "INTERNAL_SERVER_ERROR",
+      message: err instanceof Error ? err.message : "Action handler threw"
+    });
+    await emitActionCallTelemetry(args.actionName, args.startedAt, args.input, {
+      status: "error",
+      error: wrapped
+    });
+    throw err;
   }
-  if (isAuthRequiredError(err)) {
-    const authErr = err;
-    sendError(c.res, authErr.code, authErr.message, authErr.status, void 0, c.requestId);
-  } else {
-    const envelope = serverErrorToEnvelope(err);
-    if (envelope.code === "INTERNAL_SERVER_ERROR") {
-      sendError(
-        c.res,
-        "INTERNAL_ERROR",
-        err instanceof Error ? err.message : "Internal server error",
-        500,
-        void 0,
-        c.requestId
-      );
-    } else {
-      sendError(
-        c.res,
-        envelope.code,
-        envelope.message,
-        envelopeCodeToStatus(envelope.code),
-        void 0,
-        c.requestId
-      );
+}
+async function handleActionError(err, c) {
+  return handleRequestError(err, {
+    req: c.req,
+    res: c.res,
+    requestId: c.requestId,
+    pluginRunner: c.pluginRunner,
+    buildPluginCtx: c.buildPluginCtx
+  });
+}
+
+// src/server/observability/suggest.ts
+function levenshtein(a, b) {
+  const m = a.length;
+  const n = b.length;
+  const dp = Array.from(
+    { length: m + 1 },
+    () => Array.from({ length: n + 1 }).fill(0)
+  );
+  for (let i = 0; i <= m; i++) dp[i][0] = i;
+  for (let j = 0; j <= n; j++) dp[0][j] = j;
+  for (let i = 1; i <= m; i++) {
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      dp[i][j] = Math.min(dp[i - 1][j] + 1, dp[i][j - 1] + 1, dp[i - 1][j - 1] + cost);
     }
   }
-  if (c.pluginRunner) {
-    const errCtxObj = {};
-    c.pluginRunner.applyDecorations(errCtxObj);
-    try {
-      await c.pluginRunner.runOnResponse(c.buildPluginCtx(errCtxObj), {
-        inErrorPath: true
-      });
-    } catch {
+  return dp[m][n];
+}
+function findSuggestion(input, candidates, maxDistance = 3) {
+  let best = null;
+  let bestDist = maxDistance + 1;
+  for (const c of candidates) {
+    const d = levenshtein(input, c);
+    if (d < bestDist) {
+      bestDist = d;
+      best = c;
     }
   }
+  return best;
 }
 
-// src/server/http/serialize-action-result.ts
-import { stringify as devalueStringify } from "devalue";
-var DEFAULT_RESPONSE_BODY_SIZE_LIMIT = 5 * 1024 * 1024;
-function serializeActionResult(result, options = {}) {
-  const limit = options.responseBodySizeLimit ?? DEFAULT_RESPONSE_BODY_SIZE_LIMIT;
-  if (result.error !== void 0) {
-    const body2 = result.error instanceof ActionInputError ? JSON.stringify({
-      type: result.error.type,
-      code: result.error.code,
-      message: result.error.message,
-      issues: result.error.issues,
-      fields: result.error.fields
-    }) : JSON.stringify({
-      type: result.error.type,
-      code: result.error.code,
-      message: result.error.message
-    });
-    if (Buffer.byteLength(body2, "utf8") > limit) {
-      throw new ActionError({
-        code: "PAYLOAD_TOO_LARGE",
-        message: `Serialized error body exceeds limit (${limit} bytes)`
-      });
+// src/server/plugins/plugin-runner.ts
+var DuplicatePluginError = class extends Error {
+  constructor(name) {
+    super(`Plugin "${name}" is already registered.`);
+    this.name = "DuplicatePluginError";
+  }
+};
+var PluginRunner = class {
+  plugins = /* @__PURE__ */ new Set();
+  pluginScopes = /* @__PURE__ */ new Map();
+  onRequestHooks = [];
+  preHandlerHooks = [];
+  onResponseHooks = [];
+  onErrorHooks = [];
+  /**
+   * Parent app — proto-chain root for all child scopes. Has its OWN empty
+   * decorations map (parent never receives `decorateRequest` calls under
+   * the T3.1 contract; only child scopes do).
+   */
+  parentDecorations = /* @__PURE__ */ new Map();
+  parentApp = this.buildParentAppFacade();
+  has(name) {
+    return this.plugins.has(name);
+  }
+  /**
+   * Per T3.1 (C1 plugin scope encapsulation):
+   * 1. Reserve the plugin name (still rejects duplicates).
+   * 2. Build a CHILD TheoApp via `Object.create(parentApp)` — Fastify
+   *    `plugin-override.js:38` pattern. The child's own `decorateRequest`
+   *    populates per-scope `decorations`; the child's `addHook` still
+   *    forwards into the shared hook lists (hooks ARE process-global —
+   *    only decorations are scoped, mirroring Fastify's decoration vs
+   *    hook semantics).
+   * 3. Invoke `plugin.register(childApp)`.
+   *
+   * Cross-plugin decoration-key collisions are PERMITTED (per blueprint
+   * D1). The legacy `DuplicateDecorationError` is no longer thrown.
+   */
+  async register(plugin) {
+    if (this.plugins.has(plugin.name)) {
+      throw new DuplicatePluginError(plugin.name);
     }
-    return {
-      type: "error",
-      status: result.error.status,
-      contentType: "application/json",
-      body: body2
+    this.plugins.add(plugin.name);
+    const scope = this.buildPluginScope(plugin.name);
+    this.pluginScopes.set(plugin.name, scope);
+    try {
+      await plugin.register(scope.app);
+    } catch (err) {
+      this.plugins.delete(plugin.name);
+      this.pluginScopes.delete(plugin.name);
+      throw err;
+    }
+  }
+  /**
+   * Build the parent app facade. Hooks forward to shared lists.
+   * `decorateRequest` writes into the parent decorations map — used only
+   * if a future consumer registers a non-plugin "app-level" decoration
+   * directly. T3.1 contract: plugins decorate ONLY through child scopes.
+   */
+  buildParentAppFacade() {
+    const facade = {
+      addHook: (name, fn) => {
+        this.routeHookByName(name, fn);
+      },
+      // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-parameters -- T documents the per-decoration type for consumers
+      decorateRequest: (key, value) => {
+        this.parentDecorations.set(key, value);
+      }
     };
+    return facade;
   }
-  if (result.data === void 0) {
-    return { type: "empty", status: 204 };
+  /**
+   * Build a child scope via `Object.create(parentApp)` so the child
+   * inherits the parent's facade methods through the prototype chain.
+   * Then override `decorateRequest` on the child instance so writes
+   * land in the per-scope `decorations` map (parent is NOT mutated).
+   */
+  buildPluginScope(_pluginName) {
+    const decorations = /* @__PURE__ */ new Map();
+    const childApp = Object.create(this.parentApp);
+    Object.defineProperty(childApp, "decorateRequest", {
+      // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-parameters -- T documents the per-decoration type for consumers
+      value: (key, value) => {
+        if (typeof key !== "string") {
+          throw new TypeError(
+            `decorateRequest: invalid key (expected string, got ${typeof key}). Plugin authors MUST pass string keys.`
+          );
+        }
+        decorations.set(key, value);
+      },
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
+    Object.defineProperty(childApp, "decorations", {
+      get: () => Object.fromEntries(decorations),
+      enumerable: false,
+      configurable: false
+    });
+    return { app: childApp, decorations };
+  }
+  routeHookByName(name, fn) {
+    switch (name) {
+      case "onRequest":
+        this.onRequestHooks.push(fn);
+        return;
+      case "preHandler":
+        this.preHandlerHooks.push(fn);
+        return;
+      case "onResponse":
+        this.onResponseHooks.push(fn);
+        return;
+      case "onError":
+        this.onErrorHooks.push(fn);
+        return;
+    }
+  }
+  /**
+   * Apply ALL plugin scopes' decorations into the request ctx. Per T3.1,
+   * sibling plugins MAY decorate the same key — last-writer-wins at apply
+   * time (ordering = registration order). This keeps the legacy
+   * `ctx.<key>` flat surface working for consumers that already aggregate
+   * decorations into a single bag.
+   */
+  applyDecorations(ctx) {
+    for (const scope of this.pluginScopes.values()) {
+      for (const [key, value] of scope.decorations.entries()) {
+        ctx[key] = value;
+      }
+    }
   }
-  if (result.data instanceof Response) {
-    throw new ActionError({
-      code: "INTERNAL_SERVER_ERROR",
-      message: "Action handler cannot serialize Response objects \u2014 return plain data instead"
-    });
+  /**
+   * Apply ONLY one plugin's scoped decorations into `target`. Used by
+   * the T1.1 RED-3 test (sibling isolation proof) and by future scope-aware
+   * dispatch paths. Throws if the plugin name isn't registered.
+   */
+  applyScopedDecorations(pluginName, target) {
+    const scope = this.pluginScopes.get(pluginName);
+    if (!scope) throw new Error(`PluginRunner: unknown plugin "${pluginName}"`);
+    for (const [key, value] of scope.decorations.entries()) {
+      target[key] = value;
+    }
   }
-  let body;
-  try {
-    body = devalueStringify(result.data, {
-      URL: (value) => value instanceof URL && value.href
-    });
-  } catch (e) {
-    throw new ActionError({
-      code: "INTERNAL_SERVER_ERROR",
-      message: `Action data not serializable: ${e instanceof Error ? e.message : String(e)}`
-    });
+  /** T1.1 RED-1/RED-4 introspection: returns the child TheoApp built for `pluginName`. */
+  getPluginScope(pluginName) {
+    const scope = this.pluginScopes.get(pluginName);
+    if (!scope) throw new Error(`PluginRunner: unknown plugin "${pluginName}"`);
+    return scope.app;
   }
-  if (Buffer.byteLength(body, "utf8") > limit) {
-    throw new ActionError({
-      code: "PAYLOAD_TOO_LARGE",
-      message: `Serialized response body exceeds limit (${limit} bytes)`
-    });
+  /** T1.1 RED-4: returns the parent TheoApp (root of every child's proto chain). */
+  getParentApp() {
+    return this.parentApp;
   }
-  return {
-    type: "data",
-    status: 200,
-    contentType: "application/json+devalue",
-    body
-  };
-}
-
-// src/server/http/action-execute.ts
-var __IS_DEV = (() => {
-  try {
-    return import.meta.env?.DEV === true;
-  } catch {
-    return process.env.NODE_ENV !== "production";
+  /** T1.1 RED-2: returns the parent's decorations map (NEVER touched by plugin decorate calls under T3.1 contract). */
+  getParentDecorations() {
+    return this.parentDecorations;
   }
-})();
-function isActionConfig(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const candidate = value;
-  if (typeof candidate.handler !== "function") return false;
-  const input = candidate.input;
-  return typeof input?.safeParse === "function";
-}
-async function executeAction(filePath, exportName, req, res, loadModule, serverDir, requestId, pluginRunner, csrfMode = "strict", disallowed) {
-  return executeActionWithOptions({
-    filePath,
-    exportName,
-    req,
-    res,
-    loadModule,
-    serverDir,
-    requestId,
-    pluginRunner,
-    csrfMode,
-    disallowed
-  });
-}
-async function loadActionConfig(loadModule, filePath, exportName, res, requestId) {
-  const mod = await loadModule(filePath);
-  const exportedValue = mod[exportName];
-  if (!isActionConfig(exportedValue)) {
-    sendError(res, "NOT_FOUND", `Action "${exportName}" not found`, 404, void 0, requestId);
-    return null;
+  async runOnRequest(ctx) {
+    return this.runHookList(this.onRequestHooks, ctx);
   }
-  return exportedValue;
-}
-function enforceCsrfForAction(req, res, ctx) {
-  if (ctx.actionConfig.csrf === false) return true;
-  const decision = enforceCsrf(
-    req,
-    ctx.csrfMode,
-    {
-      // T3.3 DRY — canonical dispatcher
-      warn: dispatchCsrfWarn,
-      path: req.url
-    },
-    ctx.disallowed
-  );
-  if (decision.allow) return true;
-  sendError(
-    res,
-    "CSRF_INVALID",
-    decision.reason ?? "CSRF check failed",
-    403,
-    void 0,
-    ctx.requestId
-  );
-  return false;
-}
-async function runPreHandlerPipeline(p) {
-  if (p.serverDir) {
-    const result = await runMiddlewareAndContext(p.req, p.res, p.loadModule, p.serverDir);
-    if (result.aborted) return false;
-    Object.assign(p.ctx, result.ctx ?? {});
-    p.pluginRunner?.applyDecorations(p.ctx);
+  async runPreHandler(ctx) {
+    return this.runHookList(this.preHandlerHooks, ctx);
   }
-  if (p.pluginRunner) {
-    const preResult = await p.pluginRunner.runPreHandler(p.buildPluginCtx(p.ctx));
-    if (preResult.shortCircuited) return false;
+  async runOnResponse(ctx, options = {}) {
+    return this.runHookList(this.onResponseHooks, ctx, options);
   }
-  return true;
-}
-async function readActionBody(req, res, requestId, actionConfig) {
-  try {
-    const parsed = await parseRequestBody(req);
-    const accept = actionConfig.accept ?? "json";
-    let body;
-    if (accept === "form") {
-      body = formDataToObject(
-        synthesizeFormData(parsed),
-        actionConfig.input
-      );
-    } else if (parsed.json !== void 0) {
-      body = parsed.json;
-    } else {
-      body = parsed.fields;
+  /**
+   * Run all onError hooks. Swallows errors thrown inside hooks themselves to
+   * prevent recursion (an error in an error handler must not trigger onError
+   * again).
+   */
+  async runOnError(ctx, error) {
+    const errorCtx = { ...ctx, error };
+    for (const hook of this.onErrorHooks) {
+      try {
+        await hook(errorCtx);
+      } catch (innerErr) {
+        console.error(
+          `[plugin-runner] onError hook threw; suppressed to avoid recursion:`,
+          innerErr
+        );
+      }
     }
-    return { ok: true, body };
-  } catch (err) {
-    sendError(res, "VALIDATION_ERROR", err.message, 400, void 0, requestId);
-    return { ok: false };
-  }
-}
-function synthesizeFormData(parsed) {
-  const fd = new FormData();
-  for (const [name, value] of Object.entries(parsed.fields)) {
-    fd.append(name, value);
+    return { shortCircuited: false };
   }
-  for (const file of parsed.files) {
-    const blob = new Blob([file.buffer], {
-      type: file.mimeType
-    });
-    fd.append(file.fieldname, blob, file.filename);
+  async runHookList(hooks, ctx, options = {}) {
+    for (const hook of hooks) {
+      try {
+        await hook(ctx);
+      } catch (err) {
+        if (options.inErrorPath) {
+          console.error(`[plugin-runner] hook threw during error path; suppressed (EC-9):`, err);
+          continue;
+        }
+        throw err;
+      }
+      if (ctx.response.writableEnded || ctx.response.headersSent) {
+        return { shortCircuited: true };
+      }
+    }
+    return { shortCircuited: false };
   }
-  return fd;
-}
-function writeSerialized(res, serialized) {
-  if (serialized.type === "empty") {
-    res.statusCode = serialized.status;
-    res.end();
-    return;
+};
+
+// src/server/plugins/load-plugins.ts
+var InvalidPluginShapeError = class extends Error {
+  constructor(index, reason) {
+    super(`plugins[${index}] is not a valid TheoPlugin: ${reason}`);
+    this.name = "InvalidPluginShapeError";
   }
-  res.statusCode = serialized.status;
-  res.setHeader("Content-Type", serialized.contentType);
-  res.end(serialized.body);
-}
-async function emitActionCallTelemetry(name, startedAt, input, outcome) {
-  if (!__IS_DEV) return;
-  try {
-    const mod = await import("./dispatcher-EJHL6JMJ.js");
-    mod.dispatcher.onActionCall({
-      // eslint-disable-next-line sonarjs/pseudo-random -- non-secret correlation id
-      id: `act-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`,
-      timestamp: startedAt,
-      name,
-      input,
-      output: outcome.status === "success" ? outcome.output : void 0,
-      error: outcome.status === "error" ? {
-        code: outcome.error.code,
-        message: outcome.error.message,
-        fields: outcome.error instanceof ActionInputError ? outcome.error.fields : void 0
-      } : void 0,
-      durationMs: Date.now() - startedAt,
-      status: outcome.status
-    });
-  } catch {
+};
+function isPlugin(value, index) {
+  if (value == null || typeof value !== "object") {
+    throw new InvalidPluginShapeError(index, "expected an object");
   }
-}
-async function executeActionWithOptions(opts) {
-  const {
-    filePath,
-    exportName,
-    req,
-    res,
-    loadModule,
-    serverDir,
-    requestId,
-    pluginRunner,
-    csrfMode = "strict",
-    disallowed
-  } = opts;
-  const buildPluginCtx = (ctxObj) => ({
-    request: req,
-    response: res,
-    ctx: ctxObj,
-    requestId: requestId ?? "no-id"
-  });
-  let ctx = {};
-  try {
-    if ((req.method ?? "GET").toUpperCase() !== "POST") {
-      sendError(res, "METHOD_NOT_ALLOWED", "Actions only accept POST", 405, void 0, requestId);
-      return;
+  const v = value;
+  if (typeof v.name !== "string" || v.name.length === 0) {
+    throw new InvalidPluginShapeError(index, 'missing "name" string');
+  }
+  if (typeof v.register !== "function") {
+    throw new InvalidPluginShapeError(index, 'missing "register" function');
+  }
+  return true;
+}
+async function createPluginRunnerFromConfig(plugins) {
+  if (plugins == null) return void 0;
+  if (!Array.isArray(plugins)) return void 0;
+  if (plugins.length === 0) return void 0;
+  const runner = new PluginRunner();
+  const pluginsArray = plugins;
+  for (let i = 0; i < pluginsArray.length; i++) {
+    const candidate = pluginsArray[i];
+    if (!isPlugin(candidate, i)) {
+      continue;
     }
-    if (pluginRunner) {
-      pluginRunner.applyDecorations(ctx);
-      const onReqResult = await pluginRunner.runOnRequest(buildPluginCtx(ctx));
-      if (onReqResult.shortCircuited) return;
+    await runner.register(candidate);
+  }
+  return runner;
+}
+
+// src/server/rate-limit/rate-limit-store.ts
+var InMemoryStore = class _InMemoryStore {
+  store = /* @__PURE__ */ new Map();
+  /** Bound the map to prevent unbounded growth from pathological inputs. */
+  static MAX_ENTRIES = 1e5;
+  /** GC sweep interval, milliseconds. */
+  static GC_INTERVAL_MS = 3e4;
+  gcTimer = null;
+  constructor() {
+    if (typeof setInterval !== "undefined") {
+      const timer = setInterval(() => {
+        this.sweepExpired();
+      }, _InMemoryStore.GC_INTERVAL_MS);
+      this.gcTimer = timer;
+      const maybeUnref = timer.unref;
+      if (typeof maybeUnref === "function") maybeUnref.call(timer);
     }
-    const actionConfig = await loadActionConfig(loadModule, filePath, exportName, res, requestId);
-    if (!actionConfig) return;
-    if (!enforceCsrfForAction(req, res, { actionConfig, csrfMode, disallowed, requestId })) {
-      return;
+  }
+  /**
+   * Synchronous fast-path used by the legacy sync `createRateLimiter`
+   * surface (`api-middleware.ts` is sync). The async `incr` delegates to
+   * this for in-memory; external adapters override `incr` directly.
+   */
+  incrSync(key, windowMs) {
+    if (!Number.isFinite(windowMs) || windowMs <= 0) {
+      throw new Error(
+        `InMemoryStore.incr: windowMs must be a positive finite number (got ${windowMs})`
+      );
     }
-    const pipeline = {
-      ctx,
-      buildPluginCtx,
-      pluginRunner,
-      serverDir,
-      loadModule,
-      req,
-      res
-    };
-    if (!await runPreHandlerPipeline(pipeline)) return;
-    ctx = pipeline.ctx;
-    const bodyOutcome = await readActionBody(req, res, requestId, actionConfig);
-    if (!bodyOutcome.ok) return;
-    const actionName = exportName === "default" ? deriveActionNameFromPath(filePath) : exportName;
-    const startedAt = Date.now();
-    const result = actionConfig.input.safeParse(bodyOutcome.body);
-    if (!result.success) {
-      const inputErr = new ActionInputError(result.error?.issues ?? []);
-      writeSerialized(res, serializeActionResult({ data: void 0, error: inputErr }));
-      await emitActionCallTelemetry(actionName, startedAt, bodyOutcome.body, {
-        status: "error",
-        error: inputErr
-      });
-      return;
+    const now = Date.now();
+    if (this.store.size >= _InMemoryStore.MAX_ENTRIES) {
+      const first = this.store.keys().next().value;
+      if (first !== void 0) this.store.delete(first);
     }
-    await runActionHandler({
-      actionConfig,
-      actionName,
-      startedAt,
-      input: result.data,
-      ctx,
-      res,
-      pluginRunner,
-      buildPluginCtx
-    });
-  } catch (err) {
-    await handleActionError(err, { req, res, ctx, requestId, pluginRunner, buildPluginCtx });
+    const entry = this.store.get(key);
+    if (!entry || now >= entry.resetAt) {
+      const fresh = { count: 1, resetAt: now + windowMs };
+      this.store.set(key, fresh);
+      return { ...fresh };
+    }
+    entry.count++;
+    return { count: entry.count, resetAt: entry.resetAt };
   }
-}
-function deriveActionNameFromPath(filePath) {
-  const base = filePath.split(/[\\/]/).pop() ?? "unknown";
-  return base.replace(/\.[jt]sx?$/, "");
-}
-function isActionErrorLike(err) {
-  if (err === null || typeof err !== "object") return false;
-  const obj = err;
-  return (obj.type === "TheoActionError" || obj.type === "TheoActionInputError") && typeof obj.code === "string" && typeof obj.status === "number";
-}
-async function runActionHandler(args) {
-  try {
-    const handlerResult = await args.actionConfig.handler({ input: args.input, ctx: args.ctx });
-    writeSerialized(args.res, serializeActionResult({ data: handlerResult, error: void 0 }));
-    if (args.pluginRunner) {
-      await args.pluginRunner.runOnResponse(args.buildPluginCtx(args.ctx));
+  /** Sweep expired entries. Called by the GC timer; safe to call manually. */
+  sweepExpired() {
+    const now = Date.now();
+    for (const [k, v] of this.store) {
+      if (v.resetAt <= now) this.store.delete(k);
     }
-    await emitActionCallTelemetry(args.actionName, args.startedAt, args.input, {
-      status: "success",
-      output: handlerResult
-    });
-  } catch (err) {
-    if (isActionErrorLike(err)) {
-      writeSerialized(args.res, serializeActionResult({ data: void 0, error: err }));
-      await emitActionCallTelemetry(args.actionName, args.startedAt, args.input, {
-        status: "error",
-        error: err
-      });
-      return;
+  }
+  /**
+   * Stop the GC timer. Call from tests or when discarding the store. After
+   * `dispose`, the store still works but no longer auto-sweeps.
+   */
+  dispose() {
+    if (this.gcTimer) {
+      clearInterval(this.gcTimer);
+      this.gcTimer = null;
     }
-    const wrapped = new ActionError({
-      code: "INTERNAL_SERVER_ERROR",
-      message: err instanceof Error ? err.message : "Action handler threw"
-    });
-    await emitActionCallTelemetry(args.actionName, args.startedAt, args.input, {
-      status: "error",
-      error: wrapped
-    });
-    throw err;
   }
-}
-async function handleActionError(err, c) {
-  return handleRequestError(err, {
-    req: c.req,
-    res: c.res,
-    requestId: c.requestId,
-    pluginRunner: c.pluginRunner,
-    buildPluginCtx: c.buildPluginCtx
-  });
-}
+  // The async surface is required by the `RateLimitStore` interface
+  // (Redis/etc. adapters are inherently async). For the in-memory case
+  // we just adapt the sync implementations to Promises.
+  // eslint-disable-next-line @typescript-eslint/require-await -- interface contract: async return
+  async incr(key, windowMs) {
+    return this.incrSync(key, windowMs);
+  }
+  // eslint-disable-next-line @typescript-eslint/require-await -- interface contract: async return
+  async get(key) {
+    const now = Date.now();
+    const entry = this.store.get(key);
+    if (!entry) return null;
+    if (now >= entry.resetAt) return null;
+    return { count: entry.count, resetAt: entry.resetAt };
+  }
+  // eslint-disable-next-line @typescript-eslint/require-await -- interface contract: async return
+  async reset(key) {
+    this.store.delete(key);
+  }
+};
 
-// src/server/observability/suggest.ts
-function levenshtein(a, b) {
-  const m = a.length;
-  const n = b.length;
-  const dp = Array.from(
-    { length: m + 1 },
-    () => Array.from({ length: n + 1 }).fill(0)
-  );
-  for (let i = 0; i <= m; i++) dp[i][0] = i;
-  for (let j = 0; j <= n; j++) dp[0][j] = j;
-  for (let i = 1; i <= m; i++) {
-    for (let j = 1; j <= n; j++) {
-      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
-      dp[i][j] = Math.min(dp[i - 1][j] + 1, dp[i][j - 1] + 1, dp[i - 1][j - 1] + cost);
+// src/server/rate-limit/rate-limit.ts
+function createRateLimiter(config, opts = {}) {
+  const store = opts.store ?? new InMemoryStore();
+  const isInMemory = store instanceof InMemoryStore;
+  return function checkRateLimit(req) {
+    const key = req.socket?.remoteAddress ?? "unknown";
+    if (isInMemory) {
+      const state = store.incrSync(key, config.windowMs);
+      return resultFromState(state, config);
     }
-  }
-  return dp[m][n];
+    throw new Error(
+      "createRateLimiter: async RateLimitStore implementations are not supported by this sync fa\xE7ade. Use the InMemoryStore default or build a custom middleware around the async store directly."
+    );
+  };
 }
-function findSuggestion(input, candidates, maxDistance = 3) {
-  let best = null;
-  let bestDist = maxDistance + 1;
-  for (const c of candidates) {
-    const d = levenshtein(input, c);
-    if (d < bestDist) {
-      bestDist = d;
-      best = c;
-    }
+function resultFromState(state, config) {
+  if (state.count > config.max) {
+    const retryAfter = Math.ceil((state.resetAt - Date.now()) / 1e3);
+    return {
+      limited: true,
+      headers: {
+        "X-RateLimit-Limit": String(config.max),
+        "X-RateLimit-Remaining": "0",
+        "Retry-After": String(retryAfter)
+      }
+    };
   }
-  return best;
+  return {
+    limited: false,
+    headers: {
+      "X-RateLimit-Limit": String(config.max),
+      "X-RateLimit-Remaining": String(Math.max(0, config.max - state.count))
+    }
+  };
+}
+
+// src/server/scan/module-loader.ts
+import { pathToFileURL } from "url";
+function createViteLoader(vite) {
+  return (path) => vite.ssrLoadModule(path);
+}
+function createProductionLoader() {
+  return async (path) => {
+    const url = pathToFileURL(path).href;
+    return import(url);
+  };
 }
 
 // src/server/security/security-headers.ts
@@ -2083,6 +2090,7 @@ export {
   logRequest,
   warnOnce,
   safeAudit,
+  validateCsrfRequest,
   sendError,
   executeRoute,
   executeAction,
@@ -2095,4 +2103,4 @@ export {
   applySecurityHeaders,
   generateNonce
 };
-//# sourceMappingURL=chunk-GFMQJHXX.js.map
+//# sourceMappingURL=chunk-WR4F4EEZ.js.map