theokit 0.2.4 → 0.4.0

package/dist/chunk-TQYSPYKU.js

@@ -0,0 +1,131 @@
+// src/core/contracts/theo-error.ts
+var TheoError = class extends Error {
+  name = "TheoError";
+  code;
+  meta;
+  ext;
+  constructor(opts) {
+    super(opts.message, opts.cause !== void 0 ? { cause: opts.cause } : void 0);
+    this.code = opts.code;
+    this.meta = opts.meta;
+    this.ext = opts.ext;
+  }
+  /**
+   * The canonical envelope view of this error. Use when crossing the wire
+   * boundary or feeding telemetry — exposes the shape consumers can rely on
+   * without depending on the class identity.
+   */
+  get envelope() {
+    return {
+      code: this.code,
+      message: this.message,
+      cause: this.cause,
+      meta: this.meta,
+      ext: this.ext
+    };
+  }
+  /**
+   * JSON serialization — emits envelope shape only (no name/stack class
+   * internals). Per ADR D5, `meta.stack` is auto-stripped in non-dev to
+   * prevent accidental leak; other meta keys are preserved.
+   */
+  toJSON() {
+    const meta = this.meta ? sanitizeMeta(this.meta) : void 0;
+    return {
+      code: this.code,
+      message: this.message,
+      cause: this.cause,
+      meta,
+      ext: this.ext
+    };
+  }
+};
+function sanitizeMeta(meta) {
+  if (process.env.NODE_ENV === "development") {
+    return meta;
+  }
+  const out = {};
+  for (const [k, v] of Object.entries(meta)) {
+    if (k === "stack") continue;
+    out[k] = v;
+  }
+  return out;
+}
+
+// src/core/contracts/server-error-to-envelope.ts
+var ERROR_NAME_TO_CODE = /* @__PURE__ */ new Map([
+  ["AuthRequiredError", "UNAUTHORIZED"],
+  ["FileTooLargeError", "PAYLOAD_TOO_LARGE"],
+  ["RequestBodyTooLargeError", "PAYLOAD_TOO_LARGE"],
+  ["BodyTooLargeError", "PAYLOAD_TOO_LARGE"],
+  // RouterConventionError reaches the wire only during dev-error overlay;
+  // INTERNAL_SERVER_ERROR is appropriate, but we add a HintExt-shaped ext
+  // with the migration guidance for the devtools display.
+  ["RouterConventionError", "INTERNAL_SERVER_ERROR"]
+]);
+var META_EXTRACTORS = /* @__PURE__ */ new Map([
+  [
+    "FileTooLargeError",
+    (err) => {
+      const e = err;
+      return {
+        truncatedFilenames: e.truncatedFilenames ?? [],
+        maxFileSize: e.maxFileSize
+      };
+    }
+  ],
+  [
+    "RouterConventionError",
+    (err) => {
+      const e = err;
+      return {
+        file: e.file,
+        suggestion: e.suggestion,
+        migrationUrl: e.migrationUrl
+      };
+    }
+  ]
+]);
+var EXT_BUILDERS = /* @__PURE__ */ new Map([
+  [
+    "RouterConventionError",
+    () => ({
+      hint: "Run `theokit migrate router` to convert dotted-basename routes to directory-nested form."
+    })
+  ]
+]);
+function serverErrorToEnvelope(value) {
+  if (value instanceof TheoError) {
+    return value.envelope;
+  }
+  if (!(value instanceof Error)) {
+    return {
+      code: "INTERNAL_SERVER_ERROR",
+      message: typeof value === "string" ? value : "Unknown error"
+    };
+  }
+  const name = value.name;
+  const code = ERROR_NAME_TO_CODE.get(name) ?? "INTERNAL_SERVER_ERROR";
+  const extractor = META_EXTRACTORS.get(name);
+  const extra = extractor ? extractor(value) : null;
+  const meta = { name };
+  if (extra) {
+    for (const [k, v] of Object.entries(extra)) {
+      if (v !== void 0) meta[k] = v;
+    }
+  }
+  const extBuilder = EXT_BUILDERS.get(name);
+  const ext = extBuilder ? extBuilder(value) : void 0;
+  return {
+    code,
+    message: value.message,
+    cause: value.cause,
+    meta,
+    ext
+  };
+}
+
+export {
+  serverErrorToEnvelope
+};
+//# sourceMappingURL=chunk-TQYSPYKU.js.map

package/dist/chunk-TQYSPYKU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/contracts/theo-error.ts","../src/core/contracts/server-error-to-envelope.ts"],"sourcesContent":["/**\n * `TheoError` — envelope-emitting `Error` subclass per plan\n * g5-error-envelope-cross-layer v1.0 § Phase 1 / T1.2.\n *\n * Mirrors trpc's TRPCError ergonomic pattern (referencia:\n * trpc/packages/server/src/unstable-core-do-not-import/error/TRPCError.ts:65-87)\n * adapted for theokit's hybrid envelope model (blueprint Form 4).\n *\n * Per ADR D5: `meta.stack` is auto-stripped in non-dev builds when serialized\n * via `toJSON()` — defense against accidental stack leak to clients (encore\n * `json:\"-\"` analog).\n *\n * Lives in `core/contracts/` per architecture.md v3 invariant #3.\n */\n\nimport type { TheoErrorCode, TheoErrorEnvelope } from './error-envelope.js'\n\n/**\n * Constructor options. `code` and `message` are required; `cause` follows TC39\n * proposal-error-cause; `meta` and `ext` are opt-in per blueprint ADR D2.\n */\nexport interface TheoErrorOptions<TExt = unknown> {\n  readonly code: TheoErrorCode\n  readonly message: string\n  readonly cause?: unknown\n  readonly meta?: Record<string, unknown>\n  readonly ext?: TExt\n}\n\n/**\n * `TheoError` — envelope-emitting Error subclass. Use this anywhere in\n * `theokit/server`, route handlers, or middleware to emit a typed,\n * cross-layer-compatible error.\n *\n * Mirrors TRPCError pattern: `code` is required, `message` defaults to\n * code if omitted, `cause` chain is preserved via TC39 proposal-error-cause.\n */\nexport class TheoError<TExt = unknown> extends Error {\n  override readonly name = 'TheoError'\n  readonly code: TheoErrorCode\n  readonly meta?: Record<string, unknown>\n  readonly ext?: TExt\n\n  constructor(opts: TheoErrorOptions<TExt>) {\n    super(opts.message, opts.cause !== undefined ? { cause: opts.cause } : undefined)\n    this.code = opts.code\n    this.meta = opts.meta\n    this.ext = opts.ext\n  }\n\n  /**\n   * The canonical envelope view of this error. Use when crossing the wire\n   * boundary or feeding telemetry — exposes the shape consumers can rely on\n   * without depending on the class identity.\n   */\n  get envelope(): TheoErrorEnvelope<TExt> {\n    return {\n      code: this.code,\n      message: this.message,\n      cause: (this as Error & { cause?: unknown }).cause,\n      meta: this.meta,\n      ext: this.ext,\n    }\n  }\n\n  /**\n   * JSON serialization — emits envelope shape only (no name/stack class\n   * internals). Per ADR D5, `meta.stack` is auto-stripped in non-dev to\n   * prevent accidental leak; other meta keys are preserved.\n   */\n  toJSON(): TheoErrorEnvelope<TExt> {\n    const meta = this.meta ? sanitizeMeta(this.meta) : undefined\n    return {\n      code: this.code,\n      message: this.message,\n      cause: (this as Error & { cause?: unknown }).cause,\n      meta,\n      ext: this.ext,\n    }\n  }\n}\n\n/**\n * Strip server-only sensitive meta keys in non-dev builds. Per ADR D5,\n * `stack` is the canonical leak vector (trpc accidentally exposes it via\n * `config.isDev` even today — references/trpc getErrorShape.ts:29-31).\n * Default to safe-by-default; preserve in dev only.\n */\nfunction sanitizeMeta(meta: Record<string, unknown>): Record<string, unknown> | undefined {\n  // Treat anything other than NODE_ENV === 'development' as production-safe\n  // (CI, staging, production all strip). Matches the security posture in\n  // blueprint EC-5 (default STRICT).\n  if (process.env.NODE_ENV === 'development') {\n    return meta\n  }\n  const out: Record<string, unknown> = {}\n  for (const [k, v] of Object.entries(meta)) {\n    if (k === 'stack') continue\n    out[k] = v\n  }\n  return out\n}\n\n/**\n * Coerce any unknown value into a TheoError envelope.\n *\n * - If value is already a TheoError, returns it unchanged (no double-wrap).\n * - If value is a plain Error, wraps it as `INTERNAL_SERVER_ERROR` with\n *   `cause` chain preserving the original.\n * - Other values (string, undefined, object) are coerced safely with a\n *   meaningful message.\n *\n * Use at framework boundaries (route handler catch-all, middleware catch,\n * SDK egress) to ensure every error crossing the wire carries an envelope.\n */\nexport function fromUnknown(value: unknown): TheoError {\n  if (value instanceof TheoError) return value\n  if (value instanceof Error) {\n    return new TheoError({\n      code: 'INTERNAL_SERVER_ERROR',\n      message: value.message,\n      cause: value,\n    })\n  }\n  if (typeof value === 'string') {\n    return new TheoError({ code: 'INTERNAL_SERVER_ERROR', message: value })\n  }\n  if (value === undefined || value === null) {\n    return new TheoError({ code: 'INTERNAL_SERVER_ERROR', message: 'Unknown error' })\n  }\n  // Object / number / boolean / etc. — best-effort stringify\n  return new TheoError({\n    code: 'INTERNAL_SERVER_ERROR',\n    message: `Non-Error value thrown: ${safeStringify(value)}`,\n    cause: value,\n  })\n}\n\n/**\n * Best-effort stringify of an unknown value for error message context.\n * JSON.stringify first (preserves shape for diagnostics); on cycle/BigInt/symbol\n * failure, signal explicitly instead of falling back to `[object Object]`.\n */\nfunction safeStringify(value: unknown): string {\n  if (typeof value === 'string') return value\n  if (typeof value === 'number' || typeof value === 'boolean') return String(value)\n  if (typeof value === 'bigint') return `${value.toString()}n`\n  if (typeof value === 'symbol') return value.toString()\n  try {\n    return JSON.stringify(value)\n  } catch {\n    return '[unstringifiable value]'\n  }\n}\n","/**\n * G5 T2.5 — server-side boundary translation per blueprint ADR D3.\n *\n * Translates ad-hoc Error class instances (FileTooLargeError,\n * AuthRequiredError, RouterConventionError, etc.) into the canonical\n * `TheoErrorEnvelope` shape at the wire boundary. This is the SINGLE\n * boundary translation point — class identities stay in place inside the\n * codebase (no invasive call-site rewrites), but the envelope is what\n * crosses to clients.\n *\n * Pure; no I/O. Lives in `core/contracts/` per architecture.md v3\n * invariant #3 (canonical home for shared client↔server types). This file\n * is the EXCEPTION-of-an-exception: it intentionally inspects Error names\n * by string instead of `instanceof` to avoid `core/contracts/` taking a\n * dependency on `server/`. The mapping table is small and grep-discoverable.\n */\n\nimport type { TheoErrorCode, TheoErrorEnvelope } from './error-envelope.js'\nimport { TheoError } from './theo-error.js'\n\n/**\n * Mapping from ad-hoc Error class name to envelope code. Add entries here\n * when a new ad-hoc Error is introduced anywhere in `theokit/server/`.\n * Build-time errors (Duplicate*, ActionScanError, InvalidPluginShapeError)\n * are NOT in this table by design — they never cross the wire boundary,\n * so their canonical shape is `INTERNAL_SERVER_ERROR` via the default branch.\n */\nconst ERROR_NAME_TO_CODE: ReadonlyMap<string, TheoErrorCode> = new Map<string, TheoErrorCode>([\n  ['AuthRequiredError', 'UNAUTHORIZED'],\n  ['FileTooLargeError', 'PAYLOAD_TOO_LARGE'],\n  ['RequestBodyTooLargeError', 'PAYLOAD_TOO_LARGE'],\n  ['BodyTooLargeError', 'PAYLOAD_TOO_LARGE'],\n  // RouterConventionError reaches the wire only during dev-error overlay;\n  // INTERNAL_SERVER_ERROR is appropriate, but we add a HintExt-shaped ext\n  // with the migration guidance for the devtools display.\n  ['RouterConventionError', 'INTERNAL_SERVER_ERROR'],\n])\n\ntype MetaExtractor = (err: Error) => Record<string, unknown> | null\n\n/**\n * Class-specific metadata extractors. Each function receives the raw Error\n * and returns an object merged into envelope.meta (excluding name/message\n * which are reserved).\n */\nconst META_EXTRACTORS: ReadonlyMap<string, MetaExtractor> = new Map<string, MetaExtractor>([\n  [\n    'FileTooLargeError',\n    (err) => {\n      const e = err as Error & { truncatedFilenames?: string[]; maxFileSize?: number }\n      return {\n        truncatedFilenames: e.truncatedFilenames ?? [],\n        maxFileSize: e.maxFileSize,\n      }\n    },\n  ],\n  [\n    'RouterConventionError',\n    (err) => {\n      const e = err as Error & { file?: string; suggestion?: string; migrationUrl?: string }\n      return {\n        file: e.file,\n        suggestion: e.suggestion,\n        migrationUrl: e.migrationUrl,\n      }\n    },\n  ],\n])\n\ntype ExtBuilder = (err: Error) => unknown\n\n/**\n * Class-specific ext (extension slot) builders. RouterConventionError ships a\n * HintExt-shaped `{ hint }` so devtools / dev overlay can render the actionable\n * migration tip directly.\n */\nconst EXT_BUILDERS: ReadonlyMap<string, ExtBuilder> = new Map<string, ExtBuilder>([\n  [\n    'RouterConventionError',\n    () => ({\n      hint: 'Run `theokit migrate router` to convert dotted-basename routes to directory-nested form.',\n    }),\n  ],\n])\n\n/**\n * Translate any server-side Error instance into a canonical envelope.\n *\n * Pass-through behavior:\n * - `TheoError` instances return their `.envelope` unchanged.\n * - Plain `Error` with unknown name → `INTERNAL_SERVER_ERROR`.\n * - Non-Error values → wrapped via `TheoError.fromUnknown` semantics.\n *\n * Meta carries the source class `name` plus class-specific fields when an\n * extractor is registered. This keeps wire-side telemetry useful without\n * leaking implementation details.\n */\nexport function serverErrorToEnvelope(value: unknown): TheoErrorEnvelope {\n  if (value instanceof TheoError) {\n    return value.envelope\n  }\n  if (!(value instanceof Error)) {\n    return {\n      code: 'INTERNAL_SERVER_ERROR',\n      message: typeof value === 'string' ? value : 'Unknown error',\n    }\n  }\n  const name = value.name\n  const code = ERROR_NAME_TO_CODE.get(name) ?? 'INTERNAL_SERVER_ERROR'\n  const extractor = META_EXTRACTORS.get(name)\n  const extra = extractor ? extractor(value) : null\n  const meta: Record<string, unknown> = { name }\n  if (extra) {\n    for (const [k, v] of Object.entries(extra)) {\n      if (v !== undefined) meta[k] = v\n    }\n  }\n  const extBuilder = EXT_BUILDERS.get(name)\n  const ext = extBuilder ? extBuilder(value) : undefined\n  return {\n    code,\n    message: value.message,\n    cause: (value as Error & { cause?: unknown }).cause,\n    meta,\n    ext,\n  }\n}\n"],"mappings":";AAqCO,IAAM,YAAN,cAAwC,MAAM;AAAA,EACjC,OAAO;AAAA,EAChB;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAA8B;AACxC,UAAM,KAAK,SAAS,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,MAAS;AAChF,SAAK,OAAO,KAAK;AACjB,SAAK,OAAO,KAAK;AACjB,SAAK,MAAM,KAAK;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,WAAoC;AACtC,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,MACd,OAAQ,KAAqC;AAAA,MAC7C,MAAM,KAAK;AAAA,MACX,KAAK,KAAK;AAAA,IACZ;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,SAAkC;AAChC,UAAM,OAAO,KAAK,OAAO,aAAa,KAAK,IAAI,IAAI;AACnD,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,MACd,OAAQ,KAAqC;AAAA,MAC7C;AAAA,MACA,KAAK,KAAK;AAAA,IACZ;AAAA,EACF;AACF;AAQA,SAAS,aAAa,MAAoE;AAIxF,MAAI,QAAQ,IAAI,aAAa,eAAe;AAC1C,WAAO;AAAA,EACT;AACA,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,GAAG;AACzC,QAAI,MAAM,QAAS;AACnB,QAAI,CAAC,IAAI;AAAA,EACX;AACA,SAAO;AACT;;;AC1EA,IAAM,qBAAyD,oBAAI,IAA2B;AAAA,EAC5F,CAAC,qBAAqB,cAAc;AAAA,EACpC,CAAC,qBAAqB,mBAAmB;AAAA,EACzC,CAAC,4BAA4B,mBAAmB;AAAA,EAChD,CAAC,qBAAqB,mBAAmB;AAAA;AAAA;AAAA;AAAA,EAIzC,CAAC,yBAAyB,uBAAuB;AACnD,CAAC;AASD,IAAM,kBAAsD,oBAAI,IAA2B;AAAA,EACzF;AAAA,IACE;AAAA,IACA,CAAC,QAAQ;AACP,YAAM,IAAI;AACV,aAAO;AAAA,QACL,oBAAoB,EAAE,sBAAsB,CAAC;AAAA,QAC7C,aAAa,EAAE;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE;AAAA,IACA,CAAC,QAAQ;AACP,YAAM,IAAI;AACV,aAAO;AAAA,QACL,MAAM,EAAE;AAAA,QACR,YAAY,EAAE;AAAA,QACd,cAAc,EAAE;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AACF,CAAC;AASD,IAAM,eAAgD,oBAAI,IAAwB;AAAA,EAChF;AAAA,IACE;AAAA,IACA,OAAO;AAAA,MACL,MAAM;AAAA,IACR;AAAA,EACF;AACF,CAAC;AAcM,SAAS,sBAAsB,OAAmC;AACvE,MAAI,iBAAiB,WAAW;AAC9B,WAAO,MAAM;AAAA,EACf;AACA,MAAI,EAAE,iBAAiB,QAAQ;AAC7B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,SAAS,OAAO,UAAU,WAAW,QAAQ;AAAA,IAC/C;AAAA,EACF;AACA,QAAM,OAAO,MAAM;AACnB,QAAM,OAAO,mBAAmB,IAAI,IAAI,KAAK;AAC7C,QAAM,YAAY,gBAAgB,IAAI,IAAI;AAC1C,QAAM,QAAQ,YAAY,UAAU,KAAK,IAAI;AAC7C,QAAM,OAAgC,EAAE,KAAK;AAC7C,MAAI,OAAO;AACT,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC1C,UAAI,MAAM,OAAW,MAAK,CAAC,IAAI;AAAA,IACjC;AAAA,EACF;AACA,QAAM,aAAa,aAAa,IAAI,IAAI;AACxC,QAAM,MAAM,aAAa,WAAW,KAAK,IAAI;AAC7C,SAAO;AAAA,IACL;AAAA,IACA,SAAS,MAAM;AAAA,IACf,OAAQ,MAAsC;AAAA,IAC9C;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-TSLSIRBR.js

@@ -0,0 +1,107 @@
+import {
+  safeAudit
+} from "./chunk-UD3LFGDL.js";
+
+// src/server/security/csrf.ts
+function matchDisallowed(path, patterns) {
+  for (const p of patterns) {
+    if (typeof p === "string") {
+      if (path === p) return true;
+    } else if (p instanceof RegExp) {
+      p.lastIndex = 0;
+      if (p.test(path)) return true;
+    }
+  }
+  return false;
+}
+var CSRF_WARN_CODE = "CSRF_STRICT_CUTOVER";
+var CSRF_WARN_DOCS_URL = "https://theokit.dev/upgrade/csrf-strict-cutover";
+function pickHeader(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value) && value.length > 0) return value[0];
+  return "";
+}
+function isCsrfValidFromHeaders(opts) {
+  if (opts.csrfActionHeader !== "1") {
+    return { valid: false, reason: "Missing X-Theo-Action header" };
+  }
+  if (opts.origin === null || opts.origin === "") {
+    return { valid: true };
+  }
+  if (opts.host === null || opts.host === "") {
+    return { valid: true };
+  }
+  try {
+    const originHost = new URL(opts.origin).host;
+    if (originHost !== opts.host) {
+      return { valid: false, reason: `Origin ${opts.origin} does not match host ${opts.host}` };
+    }
+  } catch {
+    return { valid: false, reason: `Invalid origin: ${opts.origin}` };
+  }
+  return { valid: true };
+}
+function validateCsrf(req) {
+  const action = req.headers["x-theo-action"];
+  const origin = req.headers.origin;
+  const host = req.headers.host;
+  return isCsrfValidFromHeaders({
+    csrfActionHeader: typeof action === "string" ? action : null,
+    origin: origin !== void 0 ? pickHeader(origin) || null : null,
+    host: host !== void 0 ? pickHeader(host) || null : null
+  });
+}
+function validateCsrfRequest(request) {
+  return isCsrfValidFromHeaders({
+    csrfActionHeader: request.headers.get("x-theo-action"),
+    origin: request.headers.get("origin"),
+    host: request.headers.get("host")
+  });
+}
+function dispatchCsrfWarn(req, reason, logger, auditLogger, pathFallback = "") {
+  const payload = {
+    event: "csrf.warn",
+    method: req.method ?? "UNKNOWN",
+    path: logger?.path ?? pathFallback,
+    reason,
+    code: CSRF_WARN_CODE,
+    docsUrl: CSRF_WARN_DOCS_URL
+  };
+  logger?.warn(payload);
+  safeAudit(auditLogger, {
+    action: "csrf.warn",
+    actor: { type: "anonymous" },
+    metadata: { ...payload }
+  });
+}
+function enforceCsrf(req, mode, logger, disallowed, auditLogger) {
+  if (mode === "off") {
+    return { allow: true };
+  }
+  const check = validateCsrf(req);
+  if (check.valid) {
+    return { allow: true };
+  }
+  if (disallowed?.behavior === "raise") {
+    const path = logger?.path ?? req.url ?? "";
+    if (matchDisallowed(path, disallowed.routes)) {
+      return { allow: false, reason: check.reason };
+    }
+  }
+  if (mode === "warn") {
+    dispatchCsrfWarn(req, check.reason, logger, auditLogger);
+    return { allow: true, reason: check.reason };
+  }
+  dispatchCsrfWarn(req, check.reason, logger, auditLogger);
+  return { allow: false, reason: check.reason };
+}
+
+export {
+  matchDisallowed,
+  CSRF_WARN_CODE,
+  CSRF_WARN_DOCS_URL,
+  validateCsrf,
+  validateCsrfRequest,
+  enforceCsrf
+};
+//# sourceMappingURL=chunk-TSLSIRBR.js.map

package/dist/chunk-TSLSIRBR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/security/csrf.ts"],"sourcesContent":["import type { IncomingMessage } from 'node:http'\n\nimport type { AuditLogger } from '../observability/audit-log.js'\nimport { safeAudit } from '../observability/audit-log.js'\n\n/**\n * CSRF enforcement mode.\n *\n * - `off`     — skip CSRF entirely. Use only when you have another defense\n *               (e.g. you don't ship session cookies, all auth is bearer).\n * - `warn`    — log a structured warning when the check would fail, but\n *               still serve the request. Default for 0.2.0. Migration mode.\n * - `strict`  — reject failing requests with 403 + code `CSRF_INVALID`.\n *               Will become the default in 0.3.0.\n */\nexport type CsrfMode = 'off' | 'warn' | 'strict'\n\n/**\n * Per-request structured logger surface. Only `warn` is used by enforceCsrf;\n * we don't require a full Logger here so callers can pass a mock or the\n * console directly.\n */\nexport interface CsrfLogger {\n  warn: (payload: CsrfWarnPayload) => void\n  /** Optional path the request was destined for — used for log correlation. */\n  path?: string\n}\n\n/**\n * T5.1 — Rails-inspired per-route escalation.\n *\n * `routes` accepts string (exact match) or RegExp entries. When a request\n * path matches AND the request would otherwise emit a warning, the\n * `behavior` field decides what happens:\n *\n *   - `'warn'`  → normal warn dispatch (no-op vs default)\n *   - `'raise'` → escalate to 403 regardless of global `csrf` mode\n *\n * `'raise'` never downgrades: when global mode is `'off'`, validation is\n * skipped entirely and disallowed dispatch never runs.\n */\nexport interface DisallowedConfig {\n  routes: (string | RegExp)[]\n  behavior: 'warn' | 'raise'\n}\n\n/**\n * Test whether `path` matches any of the supplied patterns. String\n * patterns are EXACT (trailing slash matters — use RegExp for tolerance).\n *\n * EC-5: when a RegExp carries the `/g` flag, `.test()` mutates\n * `lastIndex` and the next invocation may miss. We reset `lastIndex`\n * before each test so the matcher is a pure function.\n */\nexport function matchDisallowed(path: string, patterns: readonly (string | RegExp)[]): boolean {\n  for (const p of patterns) {\n    if (typeof p === 'string') {\n      if (path === p) return true\n    } else if (p instanceof RegExp) {\n      p.lastIndex = 0\n      if (p.test(path)) return true\n    }\n    // Neither string nor RegExp: ignore silently (defensive — the public\n    // type forbids it but runtime data may slip past).\n  }\n  return false\n}\n\n/**\n * T2.2 — Stable cutover identifier shipped with every csrf.warn payload.\n *\n * Convention borrowed from Vite's `deprecations.ts:74` — a `code` plus a\n * `docsUrl` lets users (a) grep their logs for a single stable identifier\n * to find every csrf.warn line, and (b) click through directly to the\n * migration guide. Strings are exported constants so the analyzer (T2.3)\n * and migration guide can reference the same source of truth.\n */\nexport const CSRF_WARN_CODE = 'CSRF_STRICT_CUTOVER' as const\nexport const CSRF_WARN_DOCS_URL = 'https://theokit.dev/upgrade/csrf-strict-cutover' as const\n\n/**\n * Pick a header value, choosing the first entry when an array (Node sets\n * arrays for headers that legitimately appear multiple times). Returns\n * `''` when the header is absent or empty — callers treat `''` as \"skip\".\n */\nfunction pickHeader(value: string | string[] | undefined): string {\n  if (typeof value === 'string') return value\n  if (Array.isArray(value) && value.length > 0) return value[0]\n  return ''\n}\n\nexport interface CsrfWarnPayload {\n  event: 'csrf.warn'\n  method: string\n  path: string | undefined\n  reason: string\n  /**\n   * Stable identifier for the 0.2 → 0.3 CSRF strict cutover. Always\n   * `'CSRF_STRICT_CUTOVER'`. Grep-able from prod logs.\n   */\n  code: string\n  /**\n   * Link to the section of the migration guide explaining how to clear\n   * this specific warning class.\n   */\n  docsUrl: string\n}\n\n/**\n * T5a.2 Phase B (slice 1/6): pure header-only CSRF check extracted from\n * `validateCsrf(req: IncomingMessage)` so it can be re-used by the Web-\n * Standards `validateCsrfRequest(request: Request)` sibling. Per the T5a.2\n * plan v1.0 § Phase B, header-only leaves are first to migrate. This is\n * the dual-signature pattern (anti-pattern #2 avoidance): IncomingMessage\n * consumers unchanged; new Request consumers go through the same logic\n * via the shared helper.\n *\n * Pure logic — accepts pre-extracted header values as strings or null.\n */\nfunction isCsrfValidFromHeaders(opts: {\n  csrfActionHeader: string | null\n  origin: string | null\n  host: string | null\n}): { valid: true } | { valid: false; reason: string } {\n  // 1. Custom header must be present (primary defense — simple form posts\n  //    cannot set custom headers, browsers gate via CORS preflight)\n  if (opts.csrfActionHeader !== '1') {\n    return { valid: false, reason: 'Missing X-Theo-Action header' }\n  }\n\n  // 2. Origin matching (secondary defense)\n  if (opts.origin === null || opts.origin === '') {\n    // Browsers omit Origin for same-origin requests — treat as valid\n    return { valid: true }\n  }\n\n  if (opts.host === null || opts.host === '') {\n    return { valid: true }\n  }\n\n  try {\n    const originHost = new URL(opts.origin).host\n    if (originHost !== opts.host) {\n      return { valid: false, reason: `Origin ${opts.origin} does not match host ${opts.host}` }\n    }\n  } catch {\n    return { valid: false, reason: `Invalid origin: ${opts.origin}` }\n  }\n\n  return { valid: true }\n}\n\nexport function validateCsrf(\n  req: IncomingMessage,\n): { valid: true } | { valid: false; reason: string } {\n  // IncomingMessage adapter — normalize Node header shape to the pure\n  // helper's input shape (string|null).\n  const action = req.headers['x-theo-action']\n  const origin = req.headers.origin\n  const host = req.headers.host\n  return isCsrfValidFromHeaders({\n    csrfActionHeader: typeof action === 'string' ? action : null,\n    origin: origin !== undefined ? pickHeader(origin) || null : null,\n    host: host !== undefined ? pickHeader(host) || null : null,\n  })\n}\n\n/**\n * T5a.2 Phase B (slice 1/6) — Web-Standards-shaped CSRF validator.\n *\n * Mirror of `validateCsrf(req: IncomingMessage)` for the Web `Request`\n * shape. Consumes `request.headers.get(name)` (native Web `Headers` API)\n * instead of `req.headers[name]` (Node `IncomingMessage` indexer). Same\n * CSRF policy + same return shape — the difference is only the input\n * extraction.\n *\n * Used by `executeWebRequest` (T5a.2 Phase A) to enforce CSRF on the\n * Web-Standards request handler entry-point.\n */\nexport function validateCsrfRequest(\n  request: Request,\n): { valid: true } | { valid: false; reason: string } {\n  return isCsrfValidFromHeaders({\n    csrfActionHeader: request.headers.get('x-theo-action'),\n    origin: request.headers.get('origin'),\n    host: request.headers.get('host'),\n  })\n}\n\n/**\n * Enforce CSRF policy with mode-aware behavior. Wrapper over `validateCsrf`\n * that turns the boolean valid/invalid into a request-level allow decision,\n * gated by mode + structured warning in warn mode.\n *\n * Phase 5 — CSRF warn-first (EC-1). See plan docs/plans/nextjs-maturity-plan.md.\n */\n/**\n * Dispatch the csrf.warn payload to both the structured logger and the\n * audit sink (when configured). Extracted from `enforceCsrf` to keep that\n * function's complexity within ceiling.\n */\nfunction dispatchCsrfWarn(\n  req: IncomingMessage,\n  reason: string,\n  logger: CsrfLogger | undefined,\n  auditLogger: AuditLogger | undefined,\n  pathFallback = '',\n): void {\n  const payload: CsrfWarnPayload = {\n    event: 'csrf.warn',\n    method: req.method ?? 'UNKNOWN',\n    path: logger?.path ?? pathFallback,\n    reason,\n    code: CSRF_WARN_CODE,\n    docsUrl: CSRF_WARN_DOCS_URL,\n  }\n  logger?.warn(payload)\n  // `metadata` is typed as Record<string, unknown>; CsrfWarnPayload is a\n  // structurally-equivalent shape but lacks the index signature.\n  safeAudit(auditLogger, {\n    action: 'csrf.warn',\n    actor: { type: 'anonymous' },\n    metadata: { ...payload },\n  })\n}\n\nexport function enforceCsrf(\n  req: IncomingMessage,\n  mode: CsrfMode,\n  logger?: CsrfLogger,\n  disallowed?: DisallowedConfig,\n  auditLogger?: AuditLogger,\n): { allow: boolean; reason?: string } {\n  if (mode === 'off') {\n    // `off` short-circuits before disallowed dispatch — users who set\n    // csrf: 'off' globally have explicitly turned validation off, and\n    // disallowed must never re-introduce it. The escape hatch is to\n    // set csrf: 'warn' and use disallowed for surgical strict pockets.\n    return { allow: true }\n  }\n\n  const check = validateCsrf(req)\n  if (check.valid) {\n    return { allow: true }\n  }\n\n  // T5.1 — disallowed dispatch: when the failing request matches a\n  // disallowed pattern AND behavior is 'raise', escalate to 403 even if\n  // global mode is 'warn'. Strict mode would 403 anyway, so the branch\n  // is a no-op there.\n  if (disallowed?.behavior === 'raise') {\n    const path = logger?.path ?? req.url ?? ''\n    if (matchDisallowed(path, disallowed.routes)) {\n      return { allow: false, reason: check.reason }\n    }\n  }\n\n  if (mode === 'warn') {\n    // T2.1: emit via warnOnce by default — callers can override via the\n    // injected logger.warn (tests, custom log routers).\n    // T2.2: include the stable cutover code + docsUrl so logs are\n    // grep-able and click-through-able.\n    dispatchCsrfWarn(req, check.reason, logger, auditLogger)\n    return { allow: true, reason: check.reason }\n  }\n\n  // strict — 403 the request, AND emit a warn payload so the dev (and\n  // devtools UI) sees WHY it was blocked + the docsUrl to fix it.\n  // Without this, strict-mode users get a silent 403 with no context.\n  dispatchCsrfWarn(req, check.reason, logger, auditLogger)\n  return { allow: false, reason: check.reason }\n}\n"],"mappings":";;;;;AAsDO,SAAS,gBAAgB,MAAc,UAAiD;AAC7F,aAAW,KAAK,UAAU;AACxB,QAAI,OAAO,MAAM,UAAU;AACzB,UAAI,SAAS,EAAG,QAAO;AAAA,IACzB,WAAW,aAAa,QAAQ;AAC9B,QAAE,YAAY;AACd,UAAI,EAAE,KAAK,IAAI,EAAG,QAAO;AAAA,IAC3B;AAAA,EAGF;AACA,SAAO;AACT;AAWO,IAAM,iBAAiB;AACvB,IAAM,qBAAqB;AAOlC,SAAS,WAAW,OAA8C;AAChE,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,EAAG,QAAO,MAAM,CAAC;AAC5D,SAAO;AACT;AA8BA,SAAS,uBAAuB,MAIuB;AAGrD,MAAI,KAAK,qBAAqB,KAAK;AACjC,WAAO,EAAE,OAAO,OAAO,QAAQ,+BAA+B;AAAA,EAChE;AAGA,MAAI,KAAK,WAAW,QAAQ,KAAK,WAAW,IAAI;AAE9C,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAEA,MAAI,KAAK,SAAS,QAAQ,KAAK,SAAS,IAAI;AAC1C,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAEA,MAAI;AACF,UAAM,aAAa,IAAI,IAAI,KAAK,MAAM,EAAE;AACxC,QAAI,eAAe,KAAK,MAAM;AAC5B,aAAO,EAAE,OAAO,OAAO,QAAQ,UAAU,KAAK,MAAM,wBAAwB,KAAK,IAAI,GAAG;AAAA,IAC1F;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,OAAO,OAAO,QAAQ,mBAAmB,KAAK,MAAM,GAAG;AAAA,EAClE;AAEA,SAAO,EAAE,OAAO,KAAK;AACvB;AAEO,SAAS,aACd,KACoD;AAGpD,QAAM,SAAS,IAAI,QAAQ,eAAe;AAC1C,QAAM,SAAS,IAAI,QAAQ;AAC3B,QAAM,OAAO,IAAI,QAAQ;AACzB,SAAO,uBAAuB;AAAA,IAC5B,kBAAkB,OAAO,WAAW,WAAW,SAAS;AAAA,IACxD,QAAQ,WAAW,SAAY,WAAW,MAAM,KAAK,OAAO;AAAA,IAC5D,MAAM,SAAS,SAAY,WAAW,IAAI,KAAK,OAAO;AAAA,EACxD,CAAC;AACH;AAcO,SAAS,oBACd,SACoD;AACpD,SAAO,uBAAuB;AAAA,IAC5B,kBAAkB,QAAQ,QAAQ,IAAI,eAAe;AAAA,IACrD,QAAQ,QAAQ,QAAQ,IAAI,QAAQ;AAAA,IACpC,MAAM,QAAQ,QAAQ,IAAI,MAAM;AAAA,EAClC,CAAC;AACH;AAcA,SAAS,iBACP,KACA,QACA,QACA,aACA,eAAe,IACT;AACN,QAAM,UAA2B;AAAA,IAC/B,OAAO;AAAA,IACP,QAAQ,IAAI,UAAU;AAAA,IACtB,MAAM,QAAQ,QAAQ;AAAA,IACtB;AAAA,IACA,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AACA,UAAQ,KAAK,OAAO;AAGpB,YAAU,aAAa;AAAA,IACrB,QAAQ;AAAA,IACR,OAAO,EAAE,MAAM,YAAY;AAAA,IAC3B,UAAU,EAAE,GAAG,QAAQ;AAAA,EACzB,CAAC;AACH;AAEO,SAAS,YACd,KACA,MACA,QACA,YACA,aACqC;AACrC,MAAI,SAAS,OAAO;AAKlB,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAEA,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,MAAM,OAAO;AACf,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AAMA,MAAI,YAAY,aAAa,SAAS;AACpC,UAAM,OAAO,QAAQ,QAAQ,IAAI,OAAO;AACxC,QAAI,gBAAgB,MAAM,WAAW,MAAM,GAAG;AAC5C,aAAO,EAAE,OAAO,OAAO,QAAQ,MAAM,OAAO;AAAA,IAC9C;AAAA,EACF;AAEA,MAAI,SAAS,QAAQ;AAKnB,qBAAiB,KAAK,MAAM,QAAQ,QAAQ,WAAW;AACvD,WAAO,EAAE,OAAO,MAAM,QAAQ,MAAM,OAAO;AAAA,EAC7C;AAKA,mBAAiB,KAAK,MAAM,QAAQ,QAAQ,WAAW;AACvD,SAAO,EAAE,OAAO,OAAO,QAAQ,MAAM,OAAO;AAC9C;","names":[]}

package/dist/{chunk-XP7YXRHO.js → chunk-U6TPSW4L.js}

@@ -2,7 +2,7 @@
 import "tsx/esm";
 import {
   theoConfigSchema
-} from "./chunk-X4JAX2U3.js";
+} from "./chunk-4S2UCILN.js";
 
 // src/config/load-env.ts
 import { lstatSync, readFileSync, realpathSync, statSync } from "fs";
@@ -101,7 +101,6 @@ function loadEnv(options = {}) {
 // src/config/load-config.ts
 import { existsSync } from "fs";
 import { resolve as resolve2 } from "path";
-import { pathToFileURL } from "url";
 
 // src/config/errors.ts
 var TheoConfigError = class extends Error {
@@ -124,6 +123,38 @@ ${issueLines}
   }
 };
 
+// src/config/import-user-module.ts
+import { pathToFileURL } from "url";
+var CYCLE_PATTERNS = [
+  // Node 22 strict ESM cycle detection when a registered loader hook
+  // re-enters its own evaluation context.
+  "require() ES Module",
+  "in a cycle",
+  // Vite SSR throws this when it cannot resolve an out-of-root URL.
+  "Failed to load url",
+  "Does the file exist?",
+  // Node native ESM resolver throws this for `.ts` files when no
+  // tsx loader is registered globally (the common test-worker case).
+  "Cannot find module",
+  // ERR_UNKNOWN_FILE_EXTENSION for `.ts` files.
+  "Unknown file extension"
+];
+function isLoaderInteropError(err) {
+  if (!(err instanceof Error)) return false;
+  const msg = err.message;
+  return CYCLE_PATTERNS.some((p) => msg.includes(p));
+}
+async function importUserModule(absoluteFilePath, parentURL = import.meta.url) {
+  const fileURL = pathToFileURL(absoluteFilePath).href;
+  try {
+    return await import(fileURL);
+  } catch (err) {
+    if (!isLoaderInteropError(err)) throw err;
+    const { tsImport } = await import("tsx/esm/api");
+    return await tsImport(fileURL, parentURL);
+  }
+}
+
 // src/config/load-config.ts
 var CONFIG_FILE = "theo.config.ts";
 function deepMerge(base, override) {
@@ -151,7 +182,7 @@ async function loadConfig(dir) {
   }
   let mod;
   try {
-    mod = await import(pathToFileURL(configPath).href);
+    mod = await importUserModule(configPath);
   } catch (err) {
     throw new TheoConfigError([{ field: "_file", message: err.message }], configPath);
   }
@@ -174,7 +205,7 @@ async function loadConfig(dir) {
     const envPath = resolve2(dir, envFile);
     if (existsSync(envPath)) {
       try {
-        const envMod = await import(pathToFileURL(envPath).href);
+        const envMod = await importUserModule(envPath);
         const envConfig = envMod.default;
         if (envConfig != null && typeof envConfig === "object") {
           rawConfig = deepMerge(rawConfig, envConfig);
@@ -196,7 +227,8 @@ async function loadConfig(dir) {
 }
 
 export {
+  importUserModule,
   loadEnv,
   loadConfig
 };
-//# sourceMappingURL=chunk-XP7YXRHO.js.map
+//# sourceMappingURL=chunk-U6TPSW4L.js.map

package/dist/chunk-U6TPSW4L.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config/load-env.ts","../src/config/load-config.ts","../src/config/errors.ts","../src/config/import-user-module.ts"],"sourcesContent":["/* eslint-disable security/detect-non-literal-fs-filename --\n * Reads `.env` files from a CLI-controlled `cwd`. File names are a fixed\n * literal set. Build-time + CLI tool; no HTTP input.\n */\n/**\n * `loadEnv()` — auto-loads `.env` files into `process.env` for server code.\n *\n * Implements the Next.js `loadEnvConfig` algorithm\n * (`referencias/next.js/packages/next-env/index.ts:114-180`) with TheoKit\n * adaptations:\n *\n * - EC-1: 1MB file-size cap (anti-OOM, anti-supply-chain).\n * - EC-2: `_resetEnvCache()` test-only side-door.\n * - EC-8: `dotenv-expand` circular-ref safe (lib-provided).\n * - EC-13: log when `.env` is a symlink (transparency).\n * - D6: real `process.env` wins over `.env`-file values.\n * - NODE_ENV stash: `.env`-set NODE_ENV NEVER overrides the real\n *   `process.env.NODE_ENV`. Stashed in `__THEOKIT_USER_NODE_ENV` instead.\n */\n\nimport { lstatSync, readFileSync, realpathSync, statSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nimport dotenv from 'dotenv'\nimport { expand, type DotenvPopulateInput } from 'dotenv-expand'\n\nimport type { LoadEnvOptions, LoadEnvResult } from './load-env-types.js'\n\n/** EC-1: 1MB cap. Real `.env`s are < 10KB. */\nconst MAX_ENV_FILE_BYTES = 1_048_576\n\nconst cache = new Map<string, LoadEnvResult>()\n\n/** Test-only side-door for EC-2 — clear the module-level cache between vitest test files. */\nexport function _resetEnvCache(): void {\n  cache.clear()\n}\n\nfunction envFilesInPriorityOrder(mode: string): string[] {\n  // Top of list = highest priority. Will be read in REVERSE so first-in\n  // wins via overwrite during merge.\n  const files = [`.env.${mode}.local`, `.env.local`, `.env.${mode}`, `.env`]\n  // Test mode skips `.env.local` per dotenv convention (avoid leaking dev\n  // secrets into the test suite).\n  if (mode === 'test') {\n    return files.filter((f) => f !== '.env.local')\n  }\n  return files\n}\n\nfunction readEnvFile(path: string): Record<string, string> | null {\n  let stat\n  try {\n    stat = statSync(path)\n  } catch {\n    return null // ENOENT / EACCES → skip\n  }\n\n  // Allow files + FIFOs (1Password/SOPS pipe support).\n  if (!stat.isFile() && !stat.isFIFO()) return null\n\n  // EC-1 — anti-OOM cap.\n  if (stat.size > MAX_ENV_FILE_BYTES) {\n    console.warn(\n      `[theokit] .env file at ${path} exceeds ${MAX_ENV_FILE_BYTES} bytes — skipping (likely a generated artifact, not a real env file)`,\n    )\n    return null\n  }\n\n  // EC-13 — symlink transparency. Don't refuse; just log.\n  try {\n    const lstat = lstatSync(path)\n    if (lstat.isSymbolicLink()) {\n      const real = realpathSync(path)\n      // eslint-disable-next-line no-console -- intentional transparency log on a build-time tool\n      console.info(`[theokit] .env at ${path} is a symlink → ${real}`)\n    }\n  } catch {\n    // lstat failure is non-fatal — fall through to read.\n  }\n\n  try {\n    const content = readFileSync(path, 'utf-8')\n    return dotenv.parse(content)\n  } catch {\n    return null\n  }\n}\n\n// eslint-disable-next-line complexity -- canonical env-load algorithm (priority → expand → guards → apply); inlining branches is clearer than extracting micro-helpers\nexport function loadEnv(options: LoadEnvOptions = {}): LoadEnvResult {\n  const cwd = options.cwd ?? process.cwd()\n  const mode = options.mode ?? process.env.NODE_ENV ?? 'development'\n  const cacheKey = `${cwd}:${mode}`\n\n  if (!options.forceReload) {\n    const cached = cache.get(cacheKey)\n    if (cached) return cached\n  }\n\n  const fileNames = envFilesInPriorityOrder(mode)\n  const filePaths = fileNames.map((f) => resolve(cwd, f))\n\n  // Read in REVERSE — lower-priority files first, so higher-priority\n  // (lower-index) overwrites during merge.\n  const merged: Record<string, string> = {}\n  const loadedFromFiles: string[] = []\n  for (const path of [...filePaths].reverse()) {\n    const parsed = readEnvFile(path)\n    if (parsed === null) continue\n    for (const [k, v] of Object.entries(parsed)) {\n      merged[k] = v\n    }\n    loadedFromFiles.unshift(path) // keep priority order in result\n  }\n\n  // NODE_ENV stash — `.env`-set NODE_ENV never overrides real process.env.NODE_ENV.\n  if (merged.NODE_ENV && process.env.__THEOKIT_USER_NODE_ENV === undefined) {\n    process.env.__THEOKIT_USER_NODE_ENV = merged.NODE_ENV\n  }\n  delete merged.NODE_ENV // never propagate\n\n  // EC-8 — dotenv-expand@11 stack-overflows on circular refs (A=${B}, B=${A}).\n  // Wrap in try/catch — on overflow, leave the parsed map untouched (literal\n  // values survive). Tested via test_loadEnv_circular_expand_no_loop_EC8.\n  // Pass a CLONE of process.env (string-only, filtered) so expand can\n  // reference real env without mutating it.\n  const processEnvClone: DotenvPopulateInput = {}\n  for (const [k, v] of Object.entries(process.env)) {\n    if (typeof v === 'string') processEnvClone[k] = v\n  }\n  try {\n    expand({ parsed: merged, processEnv: processEnvClone })\n  } catch (err) {\n    if (err instanceof RangeError) {\n      console.warn(\n        `[theokit] .env expansion overflow (likely circular reference like A=\\${B}, B=\\${A}). Leaving values as literals.`,\n      )\n    } else {\n      throw err\n    }\n  }\n\n  // Apply: D6 — real process.env wins over file values.\n  const loaded: Record<string, string> = {}\n  for (const [k, v] of Object.entries(merged)) {\n    if (process.env[k] !== undefined) continue // real env wins\n    process.env[k] = v\n    loaded[k] = v\n  }\n\n  // Sentinel\n  process.env.__THEOKIT_PROCESSED_ENV = 'true'\n\n  const result: LoadEnvResult = { loaded, loadedFromFiles }\n  cache.set(cacheKey, result)\n  return result\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Config loader. Reads `theo.config.{ts,js,mjs}` under the user's `cwd`.\n * Names are a fixed set of literals; `cwd` is a CLI arg resolved to\n * absolute. Build-time tool — no HTTP input.\n */\nimport { existsSync } from 'node:fs'\nimport { resolve } from 'node:path'\n\nimport { TheoConfigError } from './errors.js'\nimport { importUserModule } from './import-user-module.js'\nimport { loadEnv } from './load-env.js'\nimport { theoConfigSchema } from './schema.js'\nimport type { TheoConfig } from './schema.js'\n\nconst CONFIG_FILE = 'theo.config.ts'\n\n/**\n * Deep merges two plain objects. Override values take precedence.\n * Arrays are replaced (not concatenated).\n * Protects against prototype pollution (EC-4).\n */\nexport function deepMerge(\n  base: Record<string, unknown>,\n  override: Record<string, unknown>,\n): Record<string, unknown> {\n  const result = { ...base }\n  for (const key of Object.keys(override)) {\n    // EC-4: Prevent prototype pollution\n    if (key === '__proto__' || key === 'constructor' || key === 'prototype') continue\n\n    const baseVal = base[key]\n    const overVal = override[key]\n\n    if (\n      overVal !== null &&\n      typeof overVal === 'object' &&\n      !Array.isArray(overVal) &&\n      baseVal !== null &&\n      typeof baseVal === 'object' &&\n      !Array.isArray(baseVal)\n    ) {\n      result[key] = deepMerge(\n        baseVal as Record<string, unknown>,\n        overVal as Record<string, unknown>,\n      )\n    } else {\n      result[key] = overVal\n    }\n  }\n  return result\n}\n\nexport async function loadConfig(dir: string): Promise<TheoConfig> {\n  // T1.3 — Load .env BEFORE reading theo.config.ts. Defensive: CLI commands\n  // (dev/build/start) already call loadEnv() first, but programmatic users\n  // who call loadConfig directly (tests, custom scripts) need this too.\n  // Module-level cache makes the second call a Map-lookup (no FS).\n  loadEnv({ cwd: dir })\n\n  const configPath = resolve(dir, CONFIG_FILE)\n\n  if (!existsSync(configPath)) {\n    return theoConfigSchema.parse({})\n  }\n\n  let mod: Record<string, unknown>\n  try {\n    mod = await importUserModule(configPath)\n  } catch (err) {\n    throw new TheoConfigError([{ field: '_file', message: (err as Error).message }], configPath)\n  }\n\n  const userConfig = mod.default\n\n  if (userConfig == null || typeof userConfig !== 'object') {\n    throw new TheoConfigError(\n      [\n        {\n          field: '_export',\n          message: 'theo.config.ts must use export default defineConfig({...})',\n        },\n      ],\n      configPath,\n    )\n  }\n\n  // Merge with per-environment config if NODE_ENV is set\n  let rawConfig = userConfig as Record<string, unknown>\n  const nodeEnv = process.env.NODE_ENV\n\n  if (nodeEnv) {\n    const envFile = `theo.config.${nodeEnv}.ts`\n    const envPath = resolve(dir, envFile)\n\n    if (existsSync(envPath)) {\n      try {\n        const envMod = await importUserModule(envPath)\n        const envConfig = envMod.default\n\n        if (envConfig != null && typeof envConfig === 'object') {\n          rawConfig = deepMerge(rawConfig, envConfig as Record<string, unknown>)\n        }\n      } catch (err) {\n        throw new TheoConfigError([{ field: '_file', message: (err as Error).message }], envPath)\n      }\n    }\n  }\n\n  const result = theoConfigSchema.safeParse(rawConfig)\n\n  if (!result.success) {\n    const issues = result.error.issues.map((i) => ({\n      field: i.path.join('.'),\n      message: i.message,\n    }))\n    throw new TheoConfigError(issues, configPath)\n  }\n\n  return result.data\n}\n","export interface ConfigIssue {\n  field: string\n  message: string\n}\n\nexport class TheoConfigError extends Error {\n  public readonly issues: ConfigIssue[]\n  public readonly configPath: string\n\n  constructor(issues: ConfigIssue[], configPath: string) {\n    const issueLines = issues.map((i) => `  - ${i.field}: ${i.message}`).join('\\n')\n\n    super(\n      `Invalid theo.config.ts\\n\\n` +\n        `  File: ${configPath}\\n\\n` +\n        (issueLines ? `  Issues:\\n${issueLines}\\n` : ''),\n    )\n\n    this.name = 'TheoConfigError'\n    this.issues = issues\n    this.configPath = configPath\n  }\n}\n","/**\n * Helper for loading user-authored TypeScript modules at runtime.\n *\n * Why this exists: theokit framework code (`load-config.ts`, `job-scan.ts`,\n * `cron-scan.ts`, `integrate-ui.ts`, `static.ts`) dynamically imports\n * `.ts` files from user space (`theo.config.ts`, `server/jobs/*.ts`,\n * `static-paths.ts`, etc.). Two execution environments must work:\n *\n *   1. **Production CLI** — `dist/cli/index.js` starts with\n *      `import \"tsx/esm\"` which registers a global Node ESM loader hook.\n *      Subsequent `await import('foo.ts')` calls are intercepted by the\n *      hook, transformed in-place, and returned as ESM namespaces.\n *\n *   2. **Vitest tests** — Vitest runs framework code through Vite's SSR\n *      pipeline. Dynamic imports inside framework modules are hijacked\n *      by Vite's `loadAndTransform`, which cannot resolve absolute paths\n *      outside the Vite project root (e.g., `/tmp/test-fixture/foo.ts`).\n *      Even with `server.deps.external` configured to hand the path\n *      back to Node, the registered tsx/esm loader hits a `require()`\n *      ESM cycle error on Node 22 because the calling stack contains\n *      both the loader's own evaluation context AND the importer.\n *\n * `tsImport()` from `tsx/esm/api` is the documented escape hatch for\n * exactly this scenario: it transforms the source file via tsx's\n * standalone pipeline and evaluates the result via a fresh namespace,\n * bypassing both Vite SSR and any registered global hook.\n *\n * Strategy:\n *   - Try native `await import()` first (zero overhead in production\n *     where tsx hook is registered).\n *   - On failure with the well-known cycle/resolution errors, fall back\n *     to `tsImport()`. Other errors (genuine syntax errors, missing\n *     module, etc.) propagate unchanged.\n *\n * Idempotent and side-effect-free.\n */\nimport { pathToFileURL } from 'node:url'\n\nconst CYCLE_PATTERNS = [\n  // Node 22 strict ESM cycle detection when a registered loader hook\n  // re-enters its own evaluation context.\n  'require() ES Module',\n  'in a cycle',\n  // Vite SSR throws this when it cannot resolve an out-of-root URL.\n  'Failed to load url',\n  'Does the file exist?',\n  // Node native ESM resolver throws this for `.ts` files when no\n  // tsx loader is registered globally (the common test-worker case).\n  'Cannot find module',\n  // ERR_UNKNOWN_FILE_EXTENSION for `.ts` files.\n  'Unknown file extension',\n]\n\nfunction isLoaderInteropError(err: unknown): boolean {\n  if (!(err instanceof Error)) return false\n  const msg = err.message\n  return CYCLE_PATTERNS.some((p) => msg.includes(p))\n}\n\n/**\n * Load a user-authored TS/JS module at the given absolute file path.\n * `parentURL` defaults to the URL of this module file.\n *\n * @returns module namespace object (matches `await import(...)` return)\n */\nexport async function importUserModule(\n  absoluteFilePath: string,\n  parentURL: string = import.meta.url,\n): Promise<Record<string, unknown>> {\n  const fileURL = pathToFileURL(absoluteFilePath).href\n  try {\n    return (await import(fileURL)) as Record<string, unknown>\n  } catch (err) {\n    if (!isLoaderInteropError(err)) throw err\n    // Fallback: tsx programmatic API. Imports are inline, no global hook\n    // mutation, no Vite SSR interference. Slower per call (~10-50ms vs\n    // microseconds for registered loader) but only used as a last resort.\n    const { tsImport } = (await import('tsx/esm/api')) as {\n      tsImport: (\n        specifier: string,\n        options: string | { parentURL: string; tsconfig?: string; namespace?: string },\n      ) => Promise<Record<string, unknown>>\n    }\n    // Bypass tsconfig — tsx's default bundler-style resolver handles\n    // `.js → .ts` fallback for relative imports under the user's module.\n    // Passing an explicit tsconfig sometimes shadows the default and\n    // breaks the `.js → .ts` rewrite chain inside the namespaced loader\n    // (verified empirically in cron-scan/job-scan vitest workers).\n    return await tsImport(fileURL, parentURL)\n  }\n}\n"],"mappings":";;;;;;;AAoBA,SAAS,WAAW,cAAc,cAAc,gBAAgB;AAChE,SAAS,eAAe;AAExB,OAAO,YAAY;AACnB,SAAS,cAAwC;AAKjD,IAAM,qBAAqB;AAE3B,IAAM,QAAQ,oBAAI,IAA2B;AAO7C,SAAS,wBAAwB,MAAwB;AAGvD,QAAM,QAAQ,CAAC,QAAQ,IAAI,UAAU,cAAc,QAAQ,IAAI,IAAI,MAAM;AAGzE,MAAI,SAAS,QAAQ;AACnB,WAAO,MAAM,OAAO,CAAC,MAAM,MAAM,YAAY;AAAA,EAC/C;AACA,SAAO;AACT;AAEA,SAAS,YAAY,MAA6C;AAChE,MAAI;AACJ,MAAI;AACF,WAAO,SAAS,IAAI;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AAGA,MAAI,CAAC,KAAK,OAAO,KAAK,CAAC,KAAK,OAAO,EAAG,QAAO;AAG7C,MAAI,KAAK,OAAO,oBAAoB;AAClC,YAAQ;AAAA,MACN,0BAA0B,IAAI,YAAY,kBAAkB;AAAA,IAC9D;AACA,WAAO;AAAA,EACT;AAGA,MAAI;AACF,UAAM,QAAQ,UAAU,IAAI;AAC5B,QAAI,MAAM,eAAe,GAAG;AAC1B,YAAM,OAAO,aAAa,IAAI;AAE9B,cAAQ,KAAK,qBAAqB,IAAI,wBAAmB,IAAI,EAAE;AAAA,IACjE;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,MAAI;AACF,UAAM,UAAU,aAAa,MAAM,OAAO;AAC1C,WAAO,OAAO,MAAM,OAAO;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,QAAQ,UAA0B,CAAC,GAAkB;AACnE,QAAM,MAAM,QAAQ,OAAO,QAAQ,IAAI;AACvC,QAAM,OAAO,QAAQ,QAAQ,QAAQ,IAAI,YAAY;AACrD,QAAM,WAAW,GAAG,GAAG,IAAI,IAAI;AAE/B,MAAI,CAAC,QAAQ,aAAa;AACxB,UAAM,SAAS,MAAM,IAAI,QAAQ;AACjC,QAAI,OAAQ,QAAO;AAAA,EACrB;AAEA,QAAM,YAAY,wBAAwB,IAAI;AAC9C,QAAM,YAAY,UAAU,IAAI,CAAC,MAAM,QAAQ,KAAK,CAAC,CAAC;AAItD,QAAM,SAAiC,CAAC;AACxC,QAAM,kBAA4B,CAAC;AACnC,aAAW,QAAQ,CAAC,GAAG,SAAS,EAAE,QAAQ,GAAG;AAC3C,UAAM,SAAS,YAAY,IAAI;AAC/B,QAAI,WAAW,KAAM;AACrB,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,GAAG;AAC3C,aAAO,CAAC,IAAI;AAAA,IACd;AACA,oBAAgB,QAAQ,IAAI;AAAA,EAC9B;AAGA,MAAI,OAAO,YAAY,QAAQ,IAAI,4BAA4B,QAAW;AACxE,YAAQ,IAAI,0BAA0B,OAAO;AAAA,EAC/C;AACA,SAAO,OAAO;AAOd,QAAM,kBAAuC,CAAC;AAC9C,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,QAAQ,GAAG,GAAG;AAChD,QAAI,OAAO,MAAM,SAAU,iBAAgB,CAAC,IAAI;AAAA,EAClD;AACA,MAAI;AACF,WAAO,EAAE,QAAQ,QAAQ,YAAY,gBAAgB,CAAC;AAAA,EACxD,SAAS,KAAK;AACZ,QAAI,eAAe,YAAY;AAC7B,cAAQ;AAAA,QACN;AAAA,MACF;AAAA,IACF,OAAO;AACL,YAAM;AAAA,IACR;AAAA,EACF;AAGA,QAAM,SAAiC,CAAC;AACxC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,GAAG;AAC3C,QAAI,QAAQ,IAAI,CAAC,MAAM,OAAW;AAClC,YAAQ,IAAI,CAAC,IAAI;AACjB,WAAO,CAAC,IAAI;AAAA,EACd;AAGA,UAAQ,IAAI,0BAA0B;AAEtC,QAAM,SAAwB,EAAE,QAAQ,gBAAgB;AACxD,QAAM,IAAI,UAAU,MAAM;AAC1B,SAAO;AACT;;;ACxJA,SAAS,kBAAkB;AAC3B,SAAS,WAAAA,gBAAe;;;ACDjB,IAAM,kBAAN,cAA8B,MAAM;AAAA,EACzB;AAAA,EACA;AAAA,EAEhB,YAAY,QAAuB,YAAoB;AACrD,UAAM,aAAa,OAAO,IAAI,CAAC,MAAM,OAAO,EAAE,KAAK,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,IAAI;AAE9E;AAAA,MACE;AAAA;AAAA,UACa,UAAU;AAAA;AAAA,KACpB,aAAa;AAAA,EAAc,UAAU;AAAA,IAAO;AAAA,IACjD;AAEA,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,aAAa;AAAA,EACpB;AACF;;;ACcA,SAAS,qBAAqB;AAE9B,IAAM,iBAAiB;AAAA;AAAA;AAAA,EAGrB;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EAEA;AACF;AAEA,SAAS,qBAAqB,KAAuB;AACnD,MAAI,EAAE,eAAe,OAAQ,QAAO;AACpC,QAAM,MAAM,IAAI;AAChB,SAAO,eAAe,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC;AACnD;AAQA,eAAsB,iBACpB,kBACA,YAAoB,YAAY,KACE;AAClC,QAAM,UAAU,cAAc,gBAAgB,EAAE;AAChD,MAAI;AACF,WAAQ,MAAM,OAAO;AAAA,EACvB,SAAS,KAAK;AACZ,QAAI,CAAC,qBAAqB,GAAG,EAAG,OAAM;AAItC,UAAM,EAAE,SAAS,IAAK,MAAM,OAAO,aAAa;AAWhD,WAAO,MAAM,SAAS,SAAS,SAAS;AAAA,EAC1C;AACF;;;AF5EA,IAAM,cAAc;AAOb,SAAS,UACd,MACA,UACyB;AACzB,QAAM,SAAS,EAAE,GAAG,KAAK;AACzB,aAAW,OAAO,OAAO,KAAK,QAAQ,GAAG;AAEvC,QAAI,QAAQ,eAAe,QAAQ,iBAAiB,QAAQ,YAAa;AAEzE,UAAM,UAAU,KAAK,GAAG;AACxB,UAAM,UAAU,SAAS,GAAG;AAE5B,QACE,YAAY,QACZ,OAAO,YAAY,YACnB,CAAC,MAAM,QAAQ,OAAO,KACtB,YAAY,QACZ,OAAO,YAAY,YACnB,CAAC,MAAM,QAAQ,OAAO,GACtB;AACA,aAAO,GAAG,IAAI;AAAA,QACZ;AAAA,QACA;AAAA,MACF;AAAA,IACF,OAAO;AACL,aAAO,GAAG,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,WAAW,KAAkC;AAKjE,UAAQ,EAAE,KAAK,IAAI,CAAC;AAEpB,QAAM,aAAaC,SAAQ,KAAK,WAAW;AAE3C,MAAI,CAAC,WAAW,UAAU,GAAG;AAC3B,WAAO,iBAAiB,MAAM,CAAC,CAAC;AAAA,EAClC;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,iBAAiB,UAAU;AAAA,EACzC,SAAS,KAAK;AACZ,UAAM,IAAI,gBAAgB,CAAC,EAAE,OAAO,SAAS,SAAU,IAAc,QAAQ,CAAC,GAAG,UAAU;AAAA,EAC7F;AAEA,QAAM,aAAa,IAAI;AAEvB,MAAI,cAAc,QAAQ,OAAO,eAAe,UAAU;AACxD,UAAM,IAAI;AAAA,MACR;AAAA,QACE;AAAA,UACE,OAAO;AAAA,UACP,SAAS;AAAA,QACX;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI,YAAY;AAChB,QAAM,UAAU,QAAQ,IAAI;AAE5B,MAAI,SAAS;AACX,UAAM,UAAU,eAAe,OAAO;AACtC,UAAM,UAAUA,SAAQ,KAAK,OAAO;AAEpC,QAAI,WAAW,OAAO,GAAG;AACvB,UAAI;AACF,cAAM,SAAS,MAAM,iBAAiB,OAAO;AAC7C,cAAM,YAAY,OAAO;AAEzB,YAAI,aAAa,QAAQ,OAAO,cAAc,UAAU;AACtD,sBAAY,UAAU,WAAW,SAAoC;AAAA,QACvE;AAAA,MACF,SAAS,KAAK;AACZ,cAAM,IAAI,gBAAgB,CAAC,EAAE,OAAO,SAAS,SAAU,IAAc,QAAQ,CAAC,GAAG,OAAO;AAAA,MAC1F;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,iBAAiB,UAAU,SAAS;AAEnD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,SAAS,OAAO,MAAM,OAAO,IAAI,CAAC,OAAO;AAAA,MAC7C,OAAO,EAAE,KAAK,KAAK,GAAG;AAAA,MACtB,SAAS,EAAE;AAAA,IACb,EAAE;AACF,UAAM,IAAI,gBAAgB,QAAQ,UAAU;AAAA,EAC9C;AAEA,SAAO,OAAO;AAChB;","names":["resolve","resolve"]}

package/dist/chunk-UD3LFGDL.js

@@ -0,0 +1,45 @@
+// src/server/observability/audit-log.ts
+var JsonStdoutSink = class {
+  log(event) {
+    const enriched = {
+      level: "audit",
+      ...event,
+      timestamp: event.timestamp ?? (/* @__PURE__ */ new Date()).toISOString()
+    };
+    try {
+      console.log(JSON.stringify(enriched, jsonReplacer));
+    } catch {
+      console.log(
+        `{"level":"audit","action":${JSON.stringify(event.action)},"timestamp":${JSON.stringify(enriched.timestamp)},"note":"payload could not be serialized"}`
+      );
+    }
+  }
+};
+function jsonReplacer(_key, value) {
+  if (typeof value === "bigint") return value.toString();
+  return value;
+}
+function createNoOpLogger() {
+  return {
+    log() {
+    }
+  };
+}
+function safeAudit(logger, event) {
+  if (!logger) return;
+  try {
+    const r = logger.log(event);
+    if (r && typeof r.then === "function") {
+      r.catch(() => {
+      });
+    }
+  } catch {
+  }
+}
+
+export {
+  JsonStdoutSink,
+  createNoOpLogger,
+  safeAudit
+};
+//# sourceMappingURL=chunk-UD3LFGDL.js.map

package/dist/chunk-UD3LFGDL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/observability/audit-log.ts"],"sourcesContent":["/**\n * T4.1 — Audit logging interface + default JSON stdout sink.\n *\n * Per ADR D4: define the interface; ship a zero-dep default; reserve\n * adapter shapes for Postgres, File, OpenTelemetry, Sentry as follow-up\n * packages. Persistence has heavy deps (`pg`, `better-sqlite3`); we\n * keep core dep-free and let users opt in.\n *\n * Compatibility:\n *   - Node / Bun / Deno / Vercel — console.log is sync, captured.\n *   - Edge runtimes (CF Workers, Vercel Edge) — console.log is captured\n *     but may be rate-limited by the platform. For high-volume edge audit,\n *     implement a custom sink writing to a queue / HTTP endpoint.\n */\n\nexport interface AuditEvent {\n  /** Domain-qualified verb. Convention: `<domain>.<verb>` (e.g. csrf.warn, session.rotated). */\n  action: string\n  /** Who triggered the event. Anonymous = no auth at time of event. */\n  actor?: { type: 'user' | 'system' | 'anonymous'; id?: string }\n  /** What was operated on (optional). */\n  resource?: { type: string; id?: string }\n  /** Arbitrary event-specific metadata. JSON-serializable. */\n  metadata?: Record<string, unknown>\n  /** ISO 8601 timestamp. If absent, sink fills in `new Date().toISOString()`. */\n  timestamp?: string\n  /** Optional trace id (populated by middleware from `x-trace-id`). */\n  traceId?: string\n}\n\nexport interface AuditLogger {\n  log(event: AuditEvent): void | Promise<void>\n}\n\n/**\n * Default sink: one JSON line per event to stdout. Sync. Never throws.\n *\n * EC: circular refs / BigInt values fall back to a placeholder line so\n * the event is still observable (action + traceId) without crashing the\n * request lifecycle.\n */\nexport class JsonStdoutSink implements AuditLogger {\n  log(event: AuditEvent): void {\n    const enriched = {\n      level: 'audit' as const,\n      ...event,\n      timestamp: event.timestamp ?? new Date().toISOString(),\n    }\n    try {\n      // eslint-disable-next-line no-console -- JsonStdoutSink IS the audit output\n      console.log(JSON.stringify(enriched, jsonReplacer))\n    } catch {\n      // eslint-disable-next-line no-console -- fallback when payload won't serialize\n      console.log(\n        `{\"level\":\"audit\",\"action\":${JSON.stringify(event.action)},\"timestamp\":${JSON.stringify(enriched.timestamp)},\"note\":\"payload could not be serialized\"}`,\n      )\n    }\n  }\n}\n\n/**\n * Replacer that walks BigInt → string. Circular ref handling is via the\n * outer try/catch (JSON.stringify throws TypeError on cycles; we drop to\n * the fallback line). We don't implement custom cycle-breaking walker\n * because the audit payload is meant to be JSON — if user metadata has\n * a cycle, the right answer is to fix the caller, not silently lose\n * the structure.\n */\nfunction jsonReplacer(_key: string, value: unknown): unknown {\n  if (typeof value === 'bigint') return value.toString()\n  return value\n}\n\n/**\n * No-op logger. Returned when `config.audit` is unset. Zero overhead;\n * framework wiring sites null-check before calling.\n */\nexport function createNoOpLogger(): AuditLogger {\n  return {\n    log() {\n      // intentionally empty\n    },\n  }\n}\n\n/**\n * T4.2 — Safe-emit wrapper. Used by framework wiring sites (csrf.ts,\n * rate-limit.ts, session.ts) so a logger throw NEVER propagates into\n * the request handler.\n */\nexport function safeAudit(logger: AuditLogger | undefined, event: AuditEvent): void {\n  if (!logger) return\n  try {\n    const r = logger.log(event)\n    // Discard the Promise — async sinks are fire-and-forget by design.\n    if (r && typeof r.then === 'function') {\n      r.catch(() => {\n        // swallow async sink failures — audit must never crash the request\n      })\n    }\n  } catch {\n    // swallow sync sink failures — audit must never crash the request\n  }\n}\n"],"mappings":";AAyCO,IAAM,iBAAN,MAA4C;AAAA,EACjD,IAAI,OAAyB;AAC3B,UAAM,WAAW;AAAA,MACf,OAAO;AAAA,MACP,GAAG;AAAA,MACH,WAAW,MAAM,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,IACvD;AACA,QAAI;AAEF,cAAQ,IAAI,KAAK,UAAU,UAAU,YAAY,CAAC;AAAA,IACpD,QAAQ;AAEN,cAAQ;AAAA,QACN,6BAA6B,KAAK,UAAU,MAAM,MAAM,CAAC,gBAAgB,KAAK,UAAU,SAAS,SAAS,CAAC;AAAA,MAC7G;AAAA,IACF;AAAA,EACF;AACF;AAUA,SAAS,aAAa,MAAc,OAAyB;AAC3D,MAAI,OAAO,UAAU,SAAU,QAAO,MAAM,SAAS;AACrD,SAAO;AACT;AAMO,SAAS,mBAAgC;AAC9C,SAAO;AAAA,IACL,MAAM;AAAA,IAEN;AAAA,EACF;AACF;AAOO,SAAS,UAAU,QAAiC,OAAyB;AAClF,MAAI,CAAC,OAAQ;AACb,MAAI;AACF,UAAM,IAAI,OAAO,IAAI,KAAK;AAE1B,QAAI,KAAK,OAAO,EAAE,SAAS,YAAY;AACrC,QAAE,MAAM,MAAM;AAAA,MAEd,CAAC;AAAA,IACH;AAAA,EACF,QAAQ;AAAA,EAER;AACF;","names":[]}

package/dist/chunk-UUFYP2UM.js

@@ -0,0 +1,161 @@
+import {
+  extractTraceContext,
+  generateNewTraceContext
+} from "./chunk-6NEXVBPY.js";
+import {
+  __require
+} from "./chunk-DGUM43GV.js";
+
+// src/server/webhook/timing-safe-equal.ts
+var cachedNodeImpl;
+function resolveNodeImpl() {
+  if (cachedNodeImpl !== void 0) return cachedNodeImpl;
+  try {
+    const cryptoMod = __require("crypto");
+    cachedNodeImpl = cryptoMod.timingSafeEqual ?? null;
+  } catch {
+    cachedNodeImpl = null;
+  }
+  return cachedNodeImpl;
+}
+function timingSafeEqual(a, b) {
+  if (!(a instanceof Uint8Array) || !(b instanceof Uint8Array)) {
+    throw new TypeError(
+      `timingSafeEqual expects Uint8Array arguments (got ${typeof a} and ${typeof b})`
+    );
+  }
+  if (a.length !== b.length) return false;
+  if (a.length === 0) return true;
+  const nodeImpl = resolveNodeImpl();
+  if (nodeImpl) return nodeImpl(a, b);
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) {
+    diff |= a[i] ^ b[i];
+  }
+  return diff === 0;
+}
+
+// src/server/webhook/raw-body.ts
+var DEFAULT_MAX_BODY_BYTES = 1e6;
+var BodyTooLargeError = class extends Error {
+  constructor(limit, actualSeen) {
+    super(`Request body exceeds maxBodyBytes: seen ${actualSeen} bytes, limit ${limit} bytes`);
+    this.limit = limit;
+    this.actualSeen = actualSeen;
+    this.name = "BodyTooLargeError";
+  }
+  limit;
+  actualSeen;
+  status = 413;
+  code = "BODY_TOO_LARGE";
+};
+async function readRawBody(request, options = {}) {
+  const maxBodyBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
+  const clone = request.clone();
+  if (clone.body === null) {
+    return { rawBody: "", bodyClone: request };
+  }
+  const reader = clone.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    for (; ; ) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      total += value.byteLength;
+      if (total > maxBodyBytes) {
+        void reader.cancel();
+        throw new BodyTooLargeError(maxBodyBytes, total);
+      }
+      chunks.push(value);
+    }
+  } finally {
+    try {
+      reader.releaseLock();
+    } catch {
+    }
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  const rawBody = new TextDecoder().decode(bytes);
+  return { rawBody, bodyClone: request };
+}
+
+// src/server/webhook/define-webhook.ts
+function defineWebhook(opts) {
+  return {
+    verify: opts.verify,
+    handler: opts.handler,
+    maxBodyBytes: opts.maxBodyBytes,
+    __theokit_kind: "webhook"
+  };
+}
+async function dispatchWebhook(def, request) {
+  let rawBody;
+  let bodyClone;
+  try {
+    const result2 = await readRawBody(request, { maxBodyBytes: def.maxBodyBytes });
+    rawBody = result2.rawBody;
+    bodyClone = result2.bodyClone;
+  } catch (err) {
+    if (err instanceof BodyTooLargeError) {
+      return new Response(JSON.stringify({ error: err.code, message: err.message }), {
+        status: 413,
+        headers: { "content-type": "application/json" }
+      });
+    }
+    return new Response(
+      JSON.stringify({
+        error: "BAD_REQUEST",
+        message: err instanceof Error ? err.message : "failed to read body"
+      }),
+      { status: 400, headers: { "content-type": "application/json" } }
+    );
+  }
+  const incomingTrace = extractTraceContext(request.headers);
+  const traceId = incomingTrace?.trace_id ?? generateNewTraceContext().trace_id;
+  let verifyResult;
+  try {
+    verifyResult = await def.verify(bodyClone);
+  } catch (err) {
+    verifyResult = {
+      ok: false,
+      reason: `verify threw: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  if (!verifyResult.ok) {
+    return new Response(
+      JSON.stringify({ error: "WEBHOOK_VERIFY_FAILED", message: verifyResult.reason }),
+      { status: 401, headers: { "content-type": "application/json" } }
+    );
+  }
+  const ctx = {
+    request: bodyClone,
+    rawBody,
+    traceId,
+    signal: request.signal
+  };
+  const result = await def.handler(ctx);
+  if (result instanceof Response) return result;
+  if (result === void 0 || result === null) {
+    return new Response(null, { status: 204 });
+  }
+  return new Response(JSON.stringify(result), {
+    status: 200,
+    headers: { "content-type": "application/json" }
+  });
+}
+
+export {
+  timingSafeEqual,
+  DEFAULT_MAX_BODY_BYTES,
+  BodyTooLargeError,
+  readRawBody,
+  defineWebhook,
+  dispatchWebhook
+};
+//# sourceMappingURL=chunk-UUFYP2UM.js.map