theokit 0.2.0 → 0.2.1

package/dist/{chunk-OEB3OIYP.js → chunk-OJHO2X7C.js}

@@ -7,9 +7,6 @@ import {
   createOutboxDispatcher,
   createQueueClient
 } from "./chunk-GY5Q27BJ.js";
-import {
-  walkSourceFiles
-} from "./chunk-X2VVCJ4V.js";
 
 // src/config/load-env.ts
 import { lstatSync, readFileSync, realpathSync, statSync } from "fs";
@@ -108,6 +105,185 @@ function loadEnv(options = {}) {
   return result;
 }
 
+// src/server/security/csrf-readiness-store.ts
+var CsrfReadinessStore = class _CsrfReadinessStore {
+  static MAX_ENTRIES = 1e3;
+  entries = /* @__PURE__ */ new Map();
+  keyFor(event) {
+    return `${event.method}\0${event.path}\0${event.reason}`;
+  }
+  record(event) {
+    const key = this.keyFor(event);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const existing = this.entries.get(key);
+    if (existing) {
+      existing.count++;
+      existing.lastSeen = now;
+      return;
+    }
+    if (this.entries.size >= _CsrfReadinessStore.MAX_ENTRIES) {
+      const firstKey = this.entries.keys().next().value;
+      if (firstKey !== void 0) this.entries.delete(firstKey);
+    }
+    this.entries.set(key, { count: 1, firstSeen: now, lastSeen: now });
+  }
+  summary() {
+    let total = 0;
+    const routes = [];
+    for (const [key, entry] of this.entries) {
+      const [method, path, reason] = key.split("\0");
+      routes.push({
+        method,
+        path,
+        reason,
+        count: entry.count,
+        firstSeen: entry.firstSeen,
+        lastSeen: entry.lastSeen
+      });
+      total += entry.count;
+    }
+    return {
+      generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      totalEvents: total,
+      routes
+    };
+  }
+  reset() {
+    this.entries.clear();
+  }
+};
+
+// src/core/contracts/action-protocol.ts
+var CODE_TO_STATUS = {
+  VALIDATION_ERROR: 422,
+  BAD_REQUEST: 400,
+  UNAUTHORIZED: 401,
+  FORBIDDEN: 403,
+  NOT_FOUND: 404,
+  METHOD_NOT_ALLOWED: 405,
+  CONFLICT: 409,
+  CONTENT_TOO_LARGE: 413,
+  PAYLOAD_TOO_LARGE: 413,
+  UNSUPPORTED_MEDIA_TYPE: 415,
+  TOO_MANY_REQUESTS: 429,
+  INTERNAL_SERVER_ERROR: 500
+};
+var STATUS_TO_CODE = {
+  400: "BAD_REQUEST",
+  401: "UNAUTHORIZED",
+  403: "FORBIDDEN",
+  404: "NOT_FOUND",
+  405: "METHOD_NOT_ALLOWED",
+  409: "CONFLICT",
+  413: "PAYLOAD_TOO_LARGE",
+  415: "UNSUPPORTED_MEDIA_TYPE",
+  422: "VALIDATION_ERROR",
+  429: "TOO_MANY_REQUESTS",
+  500: "INTERNAL_SERVER_ERROR"
+};
+var ActionError = class _ActionError extends Error {
+  // Discriminator widened to the full union so subclasses can narrow to their
+  // specific literal (TypeScript would otherwise reject the override). Concrete
+  // values are still always exact literals at runtime.
+  type = "TheoActionError";
+  code;
+  status;
+  constructor(params) {
+    super(params.message ?? params.code);
+    this.code = params.code;
+    this.status = _ActionError.codeToStatus(params.code);
+    if (params.stack) {
+      this.stack = params.stack;
+    }
+  }
+  static codeToStatus(code) {
+    return CODE_TO_STATUS[code];
+  }
+  static statusToCode(status) {
+    return STATUS_TO_CODE[status] ?? "INTERNAL_SERVER_ERROR";
+  }
+  /**
+   * Parse a serialized error JSON back into the typed class hierarchy.
+   * Distinguishes `TheoActionInputError` (with `issues` array) from
+   * `TheoActionError` via the `type` discriminator. Falls back to
+   * `INTERNAL_SERVER_ERROR` for malformed bodies (non-object, missing
+   * `type`, unknown `code`).
+   */
+  static fromJson(body) {
+    if (typeof body !== "object" || body === null) {
+      return new _ActionError({ code: "INTERNAL_SERVER_ERROR" });
+    }
+    const obj = body;
+    if (obj.type === "TheoActionInputError" && Array.isArray(obj.issues)) {
+      return new ActionInputError(obj.issues);
+    }
+    if (obj.type === "TheoActionError" && typeof obj.code === "string" && obj.code in CODE_TO_STATUS) {
+      return new _ActionError({
+        code: obj.code,
+        message: typeof obj.message === "string" ? obj.message : void 0
+      });
+    }
+    return new _ActionError({ code: "INTERNAL_SERVER_ERROR" });
+  }
+};
+var ActionInputError = class extends ActionError {
+  type = "TheoActionInputError";
+  issues;
+  fields;
+  constructor(rawIssues) {
+    super({ code: "VALIDATION_ERROR", message: "Validation failed" });
+    this.issues = extractUniversalIssues(rawIssues);
+    this.fields = buildFieldsMap(this.issues);
+  }
+};
+function buildFieldsMap(issues) {
+  const fields = {};
+  const seen = /* @__PURE__ */ new Set();
+  for (const issue of issues) {
+    const key = issue.path.length === 0 ? "" : issue.path.join(".");
+    const dedupeKey = `${key}\0${issue.message}`;
+    if (seen.has(dedupeKey)) continue;
+    seen.add(dedupeKey);
+    const bucket = fields[key] ?? [];
+    bucket.push(issue.message);
+    fields[key] = bucket;
+  }
+  return fields;
+}
+function extractUniversalIssues(raw) {
+  if (!Array.isArray(raw)) return [];
+  const out = [];
+  for (const entry of raw) {
+    if (typeof entry !== "object" || entry === null) continue;
+    const obj = entry;
+    if (!Array.isArray(obj.path)) continue;
+    if (typeof obj.message !== "string") continue;
+    const path = [];
+    let pathValid = true;
+    for (const seg of obj.path) {
+      if (typeof seg === "string" || typeof seg === "number") {
+        path.push(seg);
+      } else {
+        pathValid = false;
+        break;
+      }
+    }
+    if (!pathValid) continue;
+    out.push({
+      path,
+      message: obj.message,
+      code: typeof obj.code === "string" ? obj.code : void 0
+    });
+  }
+  return out;
+}
+function isActionError(value) {
+  return value instanceof ActionError;
+}
+function isInputError(value) {
+  return value instanceof ActionInputError;
+}
+
 // src/server/body-parser.ts
 import { basename } from "path";
 import Busboy from "busboy";
@@ -127,6 +303,13 @@ var FileTooLargeError = class extends Error {
   code = "FILE_TOO_LARGE";
   status = 413;
 };
+function stashBodyPreview(req, body) {
+  try {
+    ;
+    req[DEVTOOLS_BODY_PREVIEW] = body;
+  } catch {
+  }
+}
 function parseJsonBody(req) {
   return new Promise((resolve2, reject) => {
     const chunks = [];
@@ -226,6 +409,7 @@ function parseMultipartBody(req, contentType, options) {
     req.pipe(bb);
   });
 }
+var DEVTOOLS_BODY_PREVIEW = /* @__PURE__ */ Symbol("theo:devtools:bodyPreview");
 async function parseRequestBody(req, options) {
   const method = req.method?.toUpperCase() ?? "GET";
   if (!METHODS_WITH_BODY.has(method)) {
@@ -234,6 +418,7 @@ async function parseRequestBody(req, options) {
   const contentType = req.headers["content-type"] ?? "";
   if (contentType.includes("application/json")) {
     const json = await parseJsonBody(req);
+    stashBodyPreview(req, json);
     return { fields: {}, files: [], json };
   }
   if (contentType.includes("multipart/form-data")) {
@@ -243,6 +428,15 @@ async function parseRequestBody(req, options) {
       maxFieldSize: options?.maxFieldSize ?? DEFAULT_MAX_FIELD_SIZE
     };
     const { fields, files } = await parseMultipartBody(req, contentType, limits);
+    stashBodyPreview(req, {
+      fields,
+      files: files.map((f) => ({
+        fieldname: f.fieldname,
+        filename: f.filename,
+        mimeType: f.mimeType,
+        size: f.size
+      }))
+    });
     return { fields, files };
   }
   if (!contentType) {
@@ -255,7 +449,7 @@ async function parseRequestBody(req, options) {
 var defaultLoggerFn = (log) => {
   console.log(JSON.stringify(log));
 };
-function logRequest(info, customLogger) {
+function logRequest(info, customLogger, req) {
   const log = {
     level: "info",
     ...info,
@@ -263,13 +457,24 @@ function logRequest(info, customLogger) {
   };
   const logger = customLogger ?? defaultLoggerFn;
   logger(log);
-  broadcastRequestToDevtools(info);
+  broadcastRequestToDevtools(info, req);
 }
 function randomRequestId() {
   return `req-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`;
 }
-function broadcastRequestToDevtools(info) {
-  void import("./broadcast-4SX7R5XE.js").then(({ broadcastRequest }) => {
+function broadcastRequestToDevtools(info, req) {
+  const headers = req?.headers ? Object.fromEntries(
+    Object.entries(req.headers).map(([k, v]) => [
+      k,
+      Array.isArray(v) ? v.join(", ") : v ?? ""
+    ])
+  ) : void 0;
+  const stashedBody = req ? req[DEVTOOLS_BODY_PREVIEW] : void 0;
+  void Promise.all([
+    import("./broadcast-4SX7R5XE.js"),
+    import("./build-request-body-preview-EOP2Y4F3.js")
+  ]).then(([{ broadcastRequest }, { buildRequestBodyPreview }]) => {
+    const bodyInfo = buildRequestBodyPreview(stashedBody);
     broadcastRequest({
       id: randomRequestId(),
       traceId: info.requestId,
@@ -277,7 +482,13 @@ function broadcastRequestToDevtools(info) {
       path: info.url,
       status: info.status,
       durationMs: info.duration,
-      startedAt: Date.now() - info.duration
+      startedAt: Date.now() - info.duration,
+      ...headers ? { headers } : {},
+      ...bodyInfo ? {
+        bodyPreview: bodyInfo.preview,
+        bodyLength: bodyInfo.length,
+        bodyTruncated: bodyInfo.truncated
+      } : {}
     });
   }).catch(() => {
   });
@@ -954,6 +1165,90 @@ async function executeRoute(ctx) {
   }
 }
 
+// src/server/http/form-data-to-object.ts
+import { z } from "zod";
+function formDataToObject(formData, schema, prefix = "") {
+  const shape = schema._def.shape();
+  const out = {};
+  for (const [key, rawValidator] of Object.entries(shape)) {
+    const fullKey = prefix + key;
+    const validator = unwrapWrappers(rawValidator);
+    if (validator instanceof z.ZodObject) {
+      const nestedPrefix = `${fullKey}.`;
+      const hasNestedKeys = [...formData.keys()].some((k) => k.startsWith(nestedPrefix));
+      if (hasNestedKeys) {
+        out[key] = formDataToObject(formData, validator, nestedPrefix);
+        continue;
+      }
+      out[key] = unwrapMissingDefault(rawValidator);
+      continue;
+    }
+    if (validator instanceof z.ZodArray) {
+      const values = formData.getAll(fullKey);
+      out[key] = coerceArrayElements(values, validator);
+      continue;
+    }
+    if (validator instanceof z.ZodBoolean) {
+      out[key] = coerceBoolean(formData, fullKey);
+      continue;
+    }
+    if (formData.has(fullKey)) {
+      const raw = formData.get(fullKey);
+      out[key] = coerceScalar(raw, validator);
+    } else {
+      out[key] = unwrapMissingDefault(rawValidator);
+    }
+  }
+  return out;
+}
+function unwrapWrappers(validator) {
+  let inner = validator;
+  while (inner instanceof z.ZodOptional || inner instanceof z.ZodNullable || inner instanceof z.ZodDefault) {
+    inner = inner._def.innerType;
+  }
+  return inner;
+}
+function unwrapMissingDefault(validator) {
+  let cursor = validator;
+  while (cursor instanceof z.ZodOptional || cursor instanceof z.ZodNullable || cursor instanceof z.ZodDefault) {
+    if (cursor instanceof z.ZodDefault) {
+      const def = cursor._def.defaultValue;
+      return typeof def === "function" ? def() : def;
+    }
+    if (cursor instanceof z.ZodNullable) return null;
+    cursor = cursor._def.innerType;
+  }
+  return void 0;
+}
+function coerceScalar(raw, validator) {
+  if (raw === null) return void 0;
+  if (validator instanceof z.ZodNumber) {
+    return typeof raw === "string" ? Number(raw) : raw;
+  }
+  return raw;
+}
+function coerceArrayElements(values, arrayValidator) {
+  const elementType = unwrapWrappers(arrayValidator._def.type);
+  if (elementType instanceof z.ZodNumber) {
+    return values.map((v) => typeof v === "string" ? Number(v) : v);
+  }
+  if (elementType instanceof z.ZodBoolean) {
+    return values.map((v) => {
+      if (v === "true") return true;
+      if (v === "false") return false;
+      return Boolean(v);
+    });
+  }
+  return values;
+}
+function coerceBoolean(formData, key) {
+  if (!formData.has(key)) return void 0;
+  const val = formData.get(key);
+  if (val === "true") return true;
+  if (val === "false") return false;
+  return Boolean(val);
+}
+
 // src/server/http/handle-request-error.ts
 async function handleRequestError(err, c) {
   if (c.pluginRunner) {
@@ -999,7 +1294,78 @@ async function handleRequestError(err, c) {
   }
 }
 
+// src/server/http/serialize-action-result.ts
+import { stringify as devalueStringify } from "devalue";
+var DEFAULT_RESPONSE_BODY_SIZE_LIMIT = 5 * 1024 * 1024;
+function serializeActionResult(result, options = {}) {
+  const limit = options.responseBodySizeLimit ?? DEFAULT_RESPONSE_BODY_SIZE_LIMIT;
+  if (result.error !== void 0) {
+    const body2 = result.error instanceof ActionInputError ? JSON.stringify({
+      type: result.error.type,
+      code: result.error.code,
+      message: result.error.message,
+      issues: result.error.issues,
+      fields: result.error.fields
+    }) : JSON.stringify({
+      type: result.error.type,
+      code: result.error.code,
+      message: result.error.message
+    });
+    if (Buffer.byteLength(body2, "utf8") > limit) {
+      throw new ActionError({
+        code: "PAYLOAD_TOO_LARGE",
+        message: `Serialized error body exceeds limit (${limit} bytes)`
+      });
+    }
+    return {
+      type: "error",
+      status: result.error.status,
+      contentType: "application/json",
+      body: body2
+    };
+  }
+  if (result.data === void 0) {
+    return { type: "empty", status: 204 };
+  }
+  if (result.data instanceof Response) {
+    throw new ActionError({
+      code: "INTERNAL_SERVER_ERROR",
+      message: "Action handler cannot serialize Response objects \u2014 return plain data instead"
+    });
+  }
+  let body;
+  try {
+    body = devalueStringify(result.data, {
+      URL: (value) => value instanceof URL && value.href
+    });
+  } catch (e) {
+    throw new ActionError({
+      code: "INTERNAL_SERVER_ERROR",
+      message: `Action data not serializable: ${e instanceof Error ? e.message : String(e)}`
+    });
+  }
+  if (Buffer.byteLength(body, "utf8") > limit) {
+    throw new ActionError({
+      code: "PAYLOAD_TOO_LARGE",
+      message: `Serialized response body exceeds limit (${limit} bytes)`
+    });
+  }
+  return {
+    type: "data",
+    status: 200,
+    contentType: "application/json+devalue",
+    body
+  };
+}
+
 // src/server/http/action-execute.ts
+var __IS_DEV = (() => {
+  try {
+    return import.meta.env?.DEV === true;
+  } catch {
+    return process.env.NODE_ENV !== "production";
+  }
+})();
 function isActionConfig(value) {
   if (typeof value !== "object" || value === null) return false;
   const candidate = value;
@@ -1066,16 +1432,72 @@ async function runPreHandlerPipeline(p) {
   }
   return true;
 }
-async function readActionBody(req, res, requestId) {
+async function readActionBody(req, res, requestId, actionConfig) {
   try {
     const parsed = await parseRequestBody(req);
-    const body = parsed.json !== void 0 ? parsed.json : parsed.fields;
+    const accept = actionConfig.accept ?? "json";
+    let body;
+    if (accept === "form") {
+      body = formDataToObject(
+        synthesizeFormData(parsed),
+        actionConfig.input
+      );
+    } else if (parsed.json !== void 0) {
+      body = parsed.json;
+    } else {
+      body = parsed.fields;
+    }
     return { ok: true, body };
   } catch (err) {
     sendError(res, "VALIDATION_ERROR", err.message, 400, void 0, requestId);
     return { ok: false };
   }
 }
+function synthesizeFormData(parsed) {
+  const fd = new FormData();
+  for (const [name, value] of Object.entries(parsed.fields)) {
+    fd.append(name, value);
+  }
+  for (const file of parsed.files) {
+    const blob = new Blob([file.buffer], {
+      type: file.mimeType
+    });
+    fd.append(file.fieldname, blob, file.filename);
+  }
+  return fd;
+}
+function writeSerialized(res, serialized) {
+  if (serialized.type === "empty") {
+    res.statusCode = serialized.status;
+    res.end();
+    return;
+  }
+  res.statusCode = serialized.status;
+  res.setHeader("Content-Type", serialized.contentType);
+  res.end(serialized.body);
+}
+async function emitActionCallTelemetry(name, startedAt, input, outcome) {
+  if (!__IS_DEV) return;
+  try {
+    const mod = await import("./dispatcher-AQJGI3HU.js");
+    mod.dispatcher.onActionCall({
+      // eslint-disable-next-line sonarjs/pseudo-random -- non-secret correlation id
+      id: `act-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`,
+      timestamp: startedAt,
+      name,
+      input,
+      output: outcome.status === "success" ? outcome.output : void 0,
+      error: outcome.status === "error" ? {
+        code: outcome.error.code,
+        message: outcome.error.message,
+        fields: outcome.error instanceof ActionInputError ? outcome.error.fields : void 0
+      } : void 0,
+      durationMs: Date.now() - startedAt,
+      status: outcome.status
+    });
+  } catch {
+  }
+}
 async function executeActionWithOptions(opts) {
   const {
     filePath,
@@ -1122,22 +1544,24 @@ async function executeActionWithOptions(opts) {
     };
     if (!await runPreHandlerPipeline(pipeline)) return;
     ctx = pipeline.ctx;
-    const bodyOutcome = await readActionBody(req, res, requestId);
+    const bodyOutcome = await readActionBody(req, res, requestId, actionConfig);
     if (!bodyOutcome.ok) return;
+    const actionName = exportName === "default" ? deriveActionNameFromPath(filePath) : exportName;
+    const startedAt = Date.now();
     const result = actionConfig.input.safeParse(bodyOutcome.body);
     if (!result.success) {
-      sendError(
-        res,
-        "VALIDATION_ERROR",
-        "Invalid action input",
-        400,
-        result.error?.issues,
-        requestId
-      );
+      const inputErr = new ActionInputError(result.error?.issues ?? []);
+      writeSerialized(res, serializeActionResult({ data: void 0, error: inputErr }));
+      await emitActionCallTelemetry(actionName, startedAt, bodyOutcome.body, {
+        status: "error",
+        error: inputErr
+      });
       return;
     }
     await runActionHandler({
       actionConfig,
+      actionName,
+      startedAt,
       input: result.data,
       ctx,
       res,
@@ -1148,12 +1572,44 @@ async function executeActionWithOptions(opts) {
     await handleActionError(err, { req, res, ctx, requestId, pluginRunner, buildPluginCtx });
   }
 }
+function deriveActionNameFromPath(filePath) {
+  const base = filePath.split(/[\\/]/).pop() ?? "unknown";
+  return base.replace(/\.[jt]sx?$/, "");
+}
+function isActionErrorLike(err) {
+  if (err === null || typeof err !== "object") return false;
+  const obj = err;
+  return (obj.type === "TheoActionError" || obj.type === "TheoActionInputError") && typeof obj.code === "string" && typeof obj.status === "number";
+}
 async function runActionHandler(args) {
-  const handlerResult = await args.actionConfig.handler({ input: args.input, ctx: args.ctx });
-  const status = handlerResult === void 0 || handlerResult === null ? 204 : 200;
-  sendJson(args.res, handlerResult ?? null, status);
-  if (args.pluginRunner) {
-    await args.pluginRunner.runOnResponse(args.buildPluginCtx(args.ctx));
+  try {
+    const handlerResult = await args.actionConfig.handler({ input: args.input, ctx: args.ctx });
+    writeSerialized(args.res, serializeActionResult({ data: handlerResult, error: void 0 }));
+    if (args.pluginRunner) {
+      await args.pluginRunner.runOnResponse(args.buildPluginCtx(args.ctx));
+    }
+    await emitActionCallTelemetry(args.actionName, args.startedAt, args.input, {
+      status: "success",
+      output: handlerResult
+    });
+  } catch (err) {
+    if (isActionErrorLike(err)) {
+      writeSerialized(args.res, serializeActionResult({ data: void 0, error: err }));
+      await emitActionCallTelemetry(args.actionName, args.startedAt, args.input, {
+        status: "error",
+        error: err
+      });
+      return;
+    }
+    const wrapped = new ActionError({
+      code: "INTERNAL_SERVER_ERROR",
+      message: err instanceof Error ? err.message : "Action handler threw"
+    });
+    await emitActionCallTelemetry(args.actionName, args.startedAt, args.input, {
+      status: "error",
+      error: wrapped
+    });
+    throw err;
   }
 }
 async function handleActionError(err, c) {
@@ -1197,28 +1653,6 @@ function findSuggestion(input, candidates, maxDistance = 3) {
   return best;
 }
 
-// src/server/scan/action-scan.ts
-import { existsSync as existsSync3, statSync as statSync3 } from "fs";
-import { extname as extname2, join as join3, relative } from "path";
-var ACTION_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx"]);
-function scanServerActions(serverDir) {
-  const actionsDir = join3(serverDir, "actions");
-  if (!existsSync3(actionsDir) || !statSync3(actionsDir).isDirectory()) {
-    return [];
-  }
-  const results = [];
-  walkSourceFiles(actionsDir, { extensions: ACTION_EXTENSIONS }, (absPath) => {
-    let rel = relative(actionsDir, absPath);
-    rel = rel.replace(/\\/g, "/");
-    rel = rel.slice(0, -extname2(rel).length);
-    results.push({
-      filePath: absPath,
-      actionPath: rel
-    });
-  });
-  return results;
-}
-
 // src/server/scan/module-loader.ts
 import { pathToFileURL } from "url";
 function createViteLoader(vite) {
@@ -1232,7 +1666,7 @@ function createProductionLoader() {
 }
 
 // src/server/http/batch-handler.ts
-import { z } from "zod";
+import { z as z2 } from "zod";
 var STRIPPED_HEADERS = [
   "authorization",
   "cookie",
@@ -1252,15 +1686,15 @@ var BatchPathConflictError = class extends Error {
     this.name = "BatchPathConflictError";
   }
 };
-var batchRequestSchema = z.object({
-  path: z.string().min(1),
-  method: z.string().min(1),
-  query: z.record(z.unknown()).optional(),
-  body: z.unknown().optional(),
-  headers: z.record(z.string()).optional()
+var batchRequestSchema = z2.object({
+  path: z2.string().min(1),
+  method: z2.string().min(1),
+  query: z2.record(z2.unknown()).optional(),
+  body: z2.unknown().optional(),
+  headers: z2.record(z2.string()).optional()
 });
-var batchPayloadSchema = z.object({
-  requests: z.array(batchRequestSchema).min(1)
+var batchPayloadSchema = z2.object({
+  requests: z2.array(batchRequestSchema).min(1)
 });
 function sanitizeItemHeaders(itemHeaders, outerHeaders) {
   const out = {};
@@ -1535,88 +1969,6 @@ function resultFromState(state, config) {
   };
 }
 
-// src/server/scan/match.ts
-function compilePattern(routePath) {
-  const paramNames = [];
-  const regexStr = routePath.replace(/:(?:\.\.\.)?([^/]+)/g, (match, name) => {
-    paramNames.push(name);
-    return match.startsWith(":...") ? "(.+)" : "([^/]+)";
-  });
-  return { pattern: new RegExp(`^${regexStr}$`), paramNames };
-}
-function matchRoute(url, routes) {
-  let path = url.split("?")[0];
-  if (path.length > 1 && path.endsWith("/")) {
-    path = path.slice(0, -1);
-  }
-  for (const route of routes) {
-    const match = route.pattern.exec(path);
-    if (match) {
-      const params = {};
-      route.paramNames.forEach((name, i) => {
-        params[name] = match[i + 1];
-      });
-      return { route, params };
-    }
-  }
-  return null;
-}
-
-// src/server/scan/scan.ts
-import { existsSync as existsSync4, statSync as statSync4 } from "fs";
-import { extname as extname3, join as join4, relative as relative2 } from "path";
-var ROUTE_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx"]);
-function fileToRoutePath(filePath, routesDir) {
-  let rel = relative2(routesDir, filePath);
-  const ext = extname3(rel);
-  rel = rel.slice(0, -ext.length);
-  rel = rel.replace(/\\/g, "/");
-  if (rel.endsWith("/index")) {
-    rel = rel.slice(0, -6);
-  } else if (rel === "index") {
-    rel = "";
-  }
-  rel = rel.replace(/\[\.\.\.([^\]]+)\]/g, ":...$1");
-  rel = rel.replace(/\[([^\]]+)\]/g, ":$1");
-  return `/api/${rel}`;
-}
-function scanServerRoutes(serverDir) {
-  const routesDir = join4(serverDir, "routes");
-  if (!existsSync4(routesDir) || !statSync4(routesDir).isDirectory()) {
-    return [];
-  }
-  const results = [];
-  walkSourceFiles(routesDir, { extensions: ROUTE_EXTENSIONS }, (absPath) => {
-    const routePath = fileToRoutePath(absPath, routesDir);
-    const { pattern, paramNames } = compilePattern(routePath);
-    results.push({
-      filePath: absPath,
-      routePath,
-      paramNames,
-      pattern
-    });
-  });
-  const conflicting = results.find((r) => r.routePath === "/api/__theo_batch__");
-  if (conflicting) {
-    throw new Error(
-      `Server route ${conflicting.filePath} resolves to '/api/__theo_batch__' which is reserved for the batch endpoint. Rename the route or disable batching in theo.config.ts.`
-    );
-  }
-  const isCatchAll = (route) => route.routePath.includes(":...");
-  results.sort((a, b) => {
-    const aStatic = a.paramNames.length === 0;
-    const bStatic = b.paramNames.length === 0;
-    const aCatchAll = isCatchAll(a);
-    const bCatchAll = isCatchAll(b);
-    if (aStatic && !bStatic) return -1;
-    if (!aStatic && bStatic) return 1;
-    if (aCatchAll && !bCatchAll) return 1;
-    if (!aCatchAll && bCatchAll) return -1;
-    return a.routePath.localeCompare(b.routePath);
-  });
-  return results;
-}
-
 // src/server/security/csp-report.ts
 var CSP_REPORT_PATH = "/__theo/csp-report";
 var MAX_BODY = 16 * 1024;
@@ -2029,33 +2381,15 @@ function resolveTransformer(selector) {
   return selector;
 }
 
-// src/server/scan/ws-scan.ts
-import { existsSync as existsSync5, statSync as statSync5 } from "fs";
-import { extname as extname4, join as join5, relative as relative3 } from "path";
-var WS_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx"]);
-function scanWebSocketRoutes(serverDir) {
-  const wsDir = join5(serverDir, "ws");
-  if (!existsSync5(wsDir) || !statSync5(wsDir).isDirectory()) {
-    return [];
-  }
-  const results = [];
-  walkSourceFiles(wsDir, { extensions: WS_EXTENSIONS }, (absPath) => {
-    let rel = relative3(wsDir, absPath);
-    rel = rel.replace(/\\/g, "/");
-    rel = rel.slice(0, -extname4(rel).length);
-    if (rel.endsWith("/index")) rel = rel.slice(0, -6);
-    else if (rel === "index") rel = "";
-    results.push({
-      filePath: absPath,
-      wsPath: `/ws/${rel}`
-    });
-  });
-  return results;
-}
-
 export {
   _resetEnvCache,
   loadEnv,
+  CsrfReadinessStore,
+  ActionError,
+  ActionInputError,
+  extractUniversalIssues,
+  isActionError,
+  isInputError,
   FileTooLargeError,
   parseRequestBody,
   logRequest,
@@ -2079,7 +2413,6 @@ export {
   executeAction,
   levenshtein,
   findSuggestion,
-  scanServerActions,
   createViteLoader,
   createProductionLoader,
   STRIPPED_HEADERS,
@@ -2094,9 +2427,6 @@ export {
   extractTraceId,
   InMemoryStore,
   createRateLimiter,
-  compilePattern,
-  matchRoute,
-  scanServerRoutes,
   CSP_REPORT_PATH,
   normalizeLegacy,
   normalizeNew,
@@ -2115,7 +2445,6 @@ export {
   createPluginRunnerFromConfig,
   superjsonTransformer,
   jsonTransformer,
-  resolveTransformer,
-  scanWebSocketRoutes
+  resolveTransformer
 };
-//# sourceMappingURL=chunk-OEB3OIYP.js.map
+//# sourceMappingURL=chunk-OJHO2X7C.js.map