theokit 0.2.4 → 0.4.0

package/dist/{chunk-TPCT3MXV.js → chunk-ABVITXFH.js}

@@ -1,135 +1,6 @@
 #!/usr/bin/env node
 import "tsx/esm";
 
-// src/server/scan/module-loader.ts
-import { pathToFileURL } from "url";
-function createViteLoader(vite) {
-  return (path) => vite.ssrLoadModule(path);
-}
-function createProductionLoader() {
-  return async (path) => {
-    const url = pathToFileURL(path).href;
-    return import(url);
-  };
-}
-
-// src/server/rate-limit/rate-limit-store.ts
-var InMemoryStore = class _InMemoryStore {
-  store = /* @__PURE__ */ new Map();
-  /** Bound the map to prevent unbounded growth from pathological inputs. */
-  static MAX_ENTRIES = 1e5;
-  /** GC sweep interval, milliseconds. */
-  static GC_INTERVAL_MS = 3e4;
-  gcTimer = null;
-  constructor() {
-    if (typeof setInterval !== "undefined") {
-      const timer = setInterval(() => {
-        this.sweepExpired();
-      }, _InMemoryStore.GC_INTERVAL_MS);
-      this.gcTimer = timer;
-      const maybeUnref = timer.unref;
-      if (typeof maybeUnref === "function") maybeUnref.call(timer);
-    }
-  }
-  /**
-   * Synchronous fast-path used by the legacy sync `createRateLimiter`
-   * surface (`api-middleware.ts` is sync). The async `incr` delegates to
-   * this for in-memory; external adapters override `incr` directly.
-   */
-  incrSync(key, windowMs) {
-    if (!Number.isFinite(windowMs) || windowMs <= 0) {
-      throw new Error(
-        `InMemoryStore.incr: windowMs must be a positive finite number (got ${windowMs})`
-      );
-    }
-    const now = Date.now();
-    if (this.store.size >= _InMemoryStore.MAX_ENTRIES) {
-      const first = this.store.keys().next().value;
-      if (first !== void 0) this.store.delete(first);
-    }
-    const entry = this.store.get(key);
-    if (!entry || now >= entry.resetAt) {
-      const fresh = { count: 1, resetAt: now + windowMs };
-      this.store.set(key, fresh);
-      return { ...fresh };
-    }
-    entry.count++;
-    return { count: entry.count, resetAt: entry.resetAt };
-  }
-  /** Sweep expired entries. Called by the GC timer; safe to call manually. */
-  sweepExpired() {
-    const now = Date.now();
-    for (const [k, v] of this.store) {
-      if (v.resetAt <= now) this.store.delete(k);
-    }
-  }
-  /**
-   * Stop the GC timer. Call from tests or when discarding the store. After
-   * `dispose`, the store still works but no longer auto-sweeps.
-   */
-  dispose() {
-    if (this.gcTimer) {
-      clearInterval(this.gcTimer);
-      this.gcTimer = null;
-    }
-  }
-  // The async surface is required by the `RateLimitStore` interface
-  // (Redis/etc. adapters are inherently async). For the in-memory case
-  // we just adapt the sync implementations to Promises.
-  // eslint-disable-next-line @typescript-eslint/require-await -- interface contract: async return
-  async incr(key, windowMs) {
-    return this.incrSync(key, windowMs);
-  }
-  // eslint-disable-next-line @typescript-eslint/require-await -- interface contract: async return
-  async get(key) {
-    const now = Date.now();
-    const entry = this.store.get(key);
-    if (!entry) return null;
-    if (now >= entry.resetAt) return null;
-    return { count: entry.count, resetAt: entry.resetAt };
-  }
-  // eslint-disable-next-line @typescript-eslint/require-await -- interface contract: async return
-  async reset(key) {
-    this.store.delete(key);
-  }
-};
-
-// src/server/rate-limit/rate-limit.ts
-function createRateLimiter(config, opts = {}) {
-  const store = opts.store ?? new InMemoryStore();
-  const isInMemory = store instanceof InMemoryStore;
-  return function checkRateLimit(req) {
-    const key = req.socket?.remoteAddress ?? "unknown";
-    if (isInMemory) {
-      const state = store.incrSync(key, config.windowMs);
-      return resultFromState(state, config);
-    }
-    throw new Error(
-      "createRateLimiter: async RateLimitStore implementations are not supported by this sync fa\xE7ade. Use the InMemoryStore default or build a custom middleware around the async store directly."
-    );
-  };
-}
-function resultFromState(state, config) {
-  if (state.count > config.max) {
-    const retryAfter = Math.ceil((state.resetAt - Date.now()) / 1e3);
-    return {
-      limited: true,
-      headers: {
-        "X-RateLimit-Limit": String(config.max),
-        "X-RateLimit-Remaining": "0",
-        "Retry-After": String(retryAfter)
-      }
-    };
-  }
-  return {
-    limited: false,
-    headers: {
-      "X-RateLimit-Limit": String(config.max),
-      "X-RateLimit-Remaining": String(Math.max(0, config.max - state.count))
-    }
-  };
-}
-
 // src/server/plugins/plugin-runner.ts
 var DuplicatePluginError = class extends Error {
   constructor(name) {
@@ -137,66 +8,156 @@ var DuplicatePluginError = class extends Error {
     this.name = "DuplicatePluginError";
   }
 };
-var DuplicateDecorationError = class extends Error {
-  constructor(key, existingPlugin, newPlugin) {
-    super(
-      `Plugin "${newPlugin}" tried to decorate ctx.${key}, but it is already declared by plugin "${existingPlugin}".`
-    );
-    this.name = "DuplicateDecorationError";
-  }
-};
 var PluginRunner = class {
   plugins = /* @__PURE__ */ new Set();
+  pluginScopes = /* @__PURE__ */ new Map();
   onRequestHooks = [];
   preHandlerHooks = [];
   onResponseHooks = [];
   onErrorHooks = [];
-  decorations = /* @__PURE__ */ new Map();
+  /**
+   * Parent app — proto-chain root for all child scopes. Has its OWN empty
+   * decorations map (parent never receives `decorateRequest` calls under
+   * the T3.1 contract; only child scopes do).
+   */
+  parentDecorations = /* @__PURE__ */ new Map();
+  parentApp = this.buildParentAppFacade();
   has(name) {
     return this.plugins.has(name);
   }
+  /**
+   * Per T3.1 (C1 plugin scope encapsulation):
+   * 1. Reserve the plugin name (still rejects duplicates).
+   * 2. Build a CHILD TheoApp via `Object.create(parentApp)` — Fastify
+   *    `plugin-override.js:38` pattern. The child's own `decorateRequest`
+   *    populates per-scope `decorations`; the child's `addHook` still
+   *    forwards into the shared hook lists (hooks ARE process-global —
+   *    only decorations are scoped, mirroring Fastify's decoration vs
+   *    hook semantics).
+   * 3. Invoke `plugin.register(childApp)`.
+   *
+   * Cross-plugin decoration-key collisions are PERMITTED (per blueprint
+   * D1). The legacy `DuplicateDecorationError` is no longer thrown.
+   */
   async register(plugin) {
     if (this.plugins.has(plugin.name)) {
       throw new DuplicatePluginError(plugin.name);
     }
     this.plugins.add(plugin.name);
-    const app = {
+    const scope = this.buildPluginScope(plugin.name);
+    this.pluginScopes.set(plugin.name, scope);
+    try {
+      await plugin.register(scope.app);
+    } catch (err) {
+      this.plugins.delete(plugin.name);
+      this.pluginScopes.delete(plugin.name);
+      throw err;
+    }
+  }
+  /**
+   * Build the parent app facade. Hooks forward to shared lists.
+   * `decorateRequest` writes into the parent decorations map — used only
+   * if a future consumer registers a non-plugin "app-level" decoration
+   * directly. T3.1 contract: plugins decorate ONLY through child scopes.
+   */
+  buildParentAppFacade() {
+    const facade = {
       addHook: (name, fn) => {
-        switch (name) {
-          case "onRequest":
-            this.onRequestHooks.push(fn);
-            return;
-          case "preHandler":
-            this.preHandlerHooks.push(fn);
-            return;
-          case "onResponse":
-            this.onResponseHooks.push(fn);
-            return;
-          case "onError":
-            this.onErrorHooks.push(fn);
-            return;
-        }
+        this.routeHookByName(name, fn);
       },
-      // `T` lets call sites bind a stronger value type via the plugin API.
-      // The runtime body stores `value` without inspection, so T appears
-      // only on the parameter — that is the intended contract.
       // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-parameters -- T documents the per-decoration type for consumers
       decorateRequest: (key, value) => {
-        const existing = this.decorations.get(key);
-        if (existing) {
-          this.plugins.delete(plugin.name);
-          throw new DuplicateDecorationError(key, existing.pluginName, plugin.name);
-        }
-        this.decorations.set(key, { pluginName: plugin.name, value });
+        this.parentDecorations.set(key, value);
       }
     };
-    await plugin.register(app);
+    return facade;
+  }
+  /**
+   * Build a child scope via `Object.create(parentApp)` so the child
+   * inherits the parent's facade methods through the prototype chain.
+   * Then override `decorateRequest` on the child instance so writes
+   * land in the per-scope `decorations` map (parent is NOT mutated).
+   */
+  buildPluginScope(_pluginName) {
+    const decorations = /* @__PURE__ */ new Map();
+    const childApp = Object.create(this.parentApp);
+    Object.defineProperty(childApp, "decorateRequest", {
+      // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-parameters -- T documents the per-decoration type for consumers
+      value: (key, value) => {
+        if (typeof key !== "string") {
+          throw new TypeError(
+            `decorateRequest: invalid key (expected string, got ${typeof key}). Plugin authors MUST pass string keys.`
+          );
+        }
+        decorations.set(key, value);
+      },
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
+    Object.defineProperty(childApp, "decorations", {
+      get: () => Object.fromEntries(decorations),
+      enumerable: false,
+      configurable: false
+    });
+    return { app: childApp, decorations };
+  }
+  routeHookByName(name, fn) {
+    switch (name) {
+      case "onRequest":
+        this.onRequestHooks.push(fn);
+        return;
+      case "preHandler":
+        this.preHandlerHooks.push(fn);
+        return;
+      case "onResponse":
+        this.onResponseHooks.push(fn);
+        return;
+      case "onError":
+        this.onErrorHooks.push(fn);
+        return;
+    }
   }
+  /**
+   * Apply ALL plugin scopes' decorations into the request ctx. Per T3.1,
+   * sibling plugins MAY decorate the same key — last-writer-wins at apply
+   * time (ordering = registration order). This keeps the legacy
+   * `ctx.<key>` flat surface working for consumers that already aggregate
+   * decorations into a single bag.
+   */
   applyDecorations(ctx) {
-    for (const [key, entry] of this.decorations.entries()) {
-      ctx[key] = entry.value;
+    for (const scope of this.pluginScopes.values()) {
+      for (const [key, value] of scope.decorations.entries()) {
+        ctx[key] = value;
+      }
+    }
+  }
+  /**
+   * Apply ONLY one plugin's scoped decorations into `target`. Used by
+   * the T1.1 RED-3 test (sibling isolation proof) and by future scope-aware
+   * dispatch paths. Throws if the plugin name isn't registered.
+   */
+  applyScopedDecorations(pluginName, target) {
+    const scope = this.pluginScopes.get(pluginName);
+    if (!scope) throw new Error(`PluginRunner: unknown plugin "${pluginName}"`);
+    for (const [key, value] of scope.decorations.entries()) {
+      target[key] = value;
     }
   }
+  /** T1.1 RED-1/RED-4 introspection: returns the child TheoApp built for `pluginName`. */
+  getPluginScope(pluginName) {
+    const scope = this.pluginScopes.get(pluginName);
+    if (!scope) throw new Error(`PluginRunner: unknown plugin "${pluginName}"`);
+    return scope.app;
+  }
+  /** T1.1 RED-4: returns the parent TheoApp (root of every child's proto chain). */
+  getParentApp() {
+    return this.parentApp;
+  }
+  /** T1.1 RED-2: returns the parent's decorations map (NEVER touched by plugin decorate calls under T3.1 contract). */
+  getParentDecorations() {
+    return this.parentDecorations;
+  }
   async runOnRequest(ctx) {
     return this.runHookList(this.onRequestHooks, ctx);
   }
@@ -317,6 +278,135 @@ function resolveTransformer(selector) {
   return selector;
 }
 
+// src/server/scan/module-loader.ts
+import { pathToFileURL } from "url";
+function createViteLoader(vite) {
+  return (path) => vite.ssrLoadModule(path);
+}
+function createProductionLoader() {
+  return async (path) => {
+    const url = pathToFileURL(path).href;
+    return import(url);
+  };
+}
+
+// src/server/rate-limit/rate-limit-store.ts
+var InMemoryStore = class _InMemoryStore {
+  store = /* @__PURE__ */ new Map();
+  /** Bound the map to prevent unbounded growth from pathological inputs. */
+  static MAX_ENTRIES = 1e5;
+  /** GC sweep interval, milliseconds. */
+  static GC_INTERVAL_MS = 3e4;
+  gcTimer = null;
+  constructor() {
+    if (typeof setInterval !== "undefined") {
+      const timer = setInterval(() => {
+        this.sweepExpired();
+      }, _InMemoryStore.GC_INTERVAL_MS);
+      this.gcTimer = timer;
+      const maybeUnref = timer.unref;
+      if (typeof maybeUnref === "function") maybeUnref.call(timer);
+    }
+  }
+  /**
+   * Synchronous fast-path used by the legacy sync `createRateLimiter`
+   * surface (`api-middleware.ts` is sync). The async `incr` delegates to
+   * this for in-memory; external adapters override `incr` directly.
+   */
+  incrSync(key, windowMs) {
+    if (!Number.isFinite(windowMs) || windowMs <= 0) {
+      throw new Error(
+        `InMemoryStore.incr: windowMs must be a positive finite number (got ${windowMs})`
+      );
+    }
+    const now = Date.now();
+    if (this.store.size >= _InMemoryStore.MAX_ENTRIES) {
+      const first = this.store.keys().next().value;
+      if (first !== void 0) this.store.delete(first);
+    }
+    const entry = this.store.get(key);
+    if (!entry || now >= entry.resetAt) {
+      const fresh = { count: 1, resetAt: now + windowMs };
+      this.store.set(key, fresh);
+      return { ...fresh };
+    }
+    entry.count++;
+    return { count: entry.count, resetAt: entry.resetAt };
+  }
+  /** Sweep expired entries. Called by the GC timer; safe to call manually. */
+  sweepExpired() {
+    const now = Date.now();
+    for (const [k, v] of this.store) {
+      if (v.resetAt <= now) this.store.delete(k);
+    }
+  }
+  /**
+   * Stop the GC timer. Call from tests or when discarding the store. After
+   * `dispose`, the store still works but no longer auto-sweeps.
+   */
+  dispose() {
+    if (this.gcTimer) {
+      clearInterval(this.gcTimer);
+      this.gcTimer = null;
+    }
+  }
+  // The async surface is required by the `RateLimitStore` interface
+  // (Redis/etc. adapters are inherently async). For the in-memory case
+  // we just adapt the sync implementations to Promises.
+  // eslint-disable-next-line @typescript-eslint/require-await -- interface contract: async return
+  async incr(key, windowMs) {
+    return this.incrSync(key, windowMs);
+  }
+  // eslint-disable-next-line @typescript-eslint/require-await -- interface contract: async return
+  async get(key) {
+    const now = Date.now();
+    const entry = this.store.get(key);
+    if (!entry) return null;
+    if (now >= entry.resetAt) return null;
+    return { count: entry.count, resetAt: entry.resetAt };
+  }
+  // eslint-disable-next-line @typescript-eslint/require-await -- interface contract: async return
+  async reset(key) {
+    this.store.delete(key);
+  }
+};
+
+// src/server/rate-limit/rate-limit.ts
+function createRateLimiter(config, opts = {}) {
+  const store = opts.store ?? new InMemoryStore();
+  const isInMemory = store instanceof InMemoryStore;
+  return function checkRateLimit(req) {
+    const key = req.socket?.remoteAddress ?? "unknown";
+    if (isInMemory) {
+      const state = store.incrSync(key, config.windowMs);
+      return resultFromState(state, config);
+    }
+    throw new Error(
+      "createRateLimiter: async RateLimitStore implementations are not supported by this sync fa\xE7ade. Use the InMemoryStore default or build a custom middleware around the async store directly."
+    );
+  };
+}
+function resultFromState(state, config) {
+  if (state.count > config.max) {
+    const retryAfter = Math.ceil((state.resetAt - Date.now()) / 1e3);
+    return {
+      limited: true,
+      headers: {
+        "X-RateLimit-Limit": String(config.max),
+        "X-RateLimit-Remaining": "0",
+        "Retry-After": String(retryAfter)
+      }
+    };
+  }
+  return {
+    limited: false,
+    headers: {
+      "X-RateLimit-Limit": String(config.max),
+      "X-RateLimit-Remaining": String(Math.max(0, config.max - state.count))
+    }
+  };
+}
+
 // src/server/body-parser.ts
 import { basename } from "path";
 import Busboy from "busboy";
@@ -495,14 +585,7 @@ function logRequest(info, customLogger, req) {
 function randomRequestId() {
   return `req-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`;
 }
-function broadcastRequestToDevtools(info, req) {
-  const headers = req?.headers ? Object.fromEntries(
-    Object.entries(req.headers).map(([k, v]) => [
-      k,
-      Array.isArray(v) ? v.join(", ") : v ?? ""
-    ])
-  ) : void 0;
-  const stashedBody = req ? req[DEVTOOLS_BODY_PREVIEW] : void 0;
+function broadcastToDevtoolsCore(info, headers, stashedBody) {
   void Promise.all([
     import("./broadcast-QOQGUNNK.js"),
     import("./build-request-body-preview-II2235E6.js")
@@ -526,6 +609,16 @@ function broadcastRequestToDevtools(info, req) {
   }).catch(() => {
   });
 }
+function broadcastRequestToDevtools(info, req) {
+  const headers = req?.headers ? Object.fromEntries(
+    Object.entries(req.headers).map(([k, v]) => [
+      k,
+      Array.isArray(v) ? v.join(", ") : v ?? ""
+    ])
+  ) : void 0;
+  const stashedBody = req ? req[DEVTOOLS_BODY_PREVIEW] : void 0;
+  broadcastToDevtoolsCore(info, headers, stashedBody);
+}
 
 // src/server/observability/logger.ts
 var _warnOnceSeen = /* @__PURE__ */ new Set();
@@ -637,6 +730,88 @@ function sendError(res, codeOrInput, message, status, issues, requestId, options
   );
 }
 
+// src/server/security/security-headers.ts
+var DEFAULT_CSP = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' ws: wss:; frame-ancestors 'none'; report-uri /__theo/csp-report";
+var DEFAULT_PERMISSIONS_POLICY = "geolocation=(), camera=(), microphone=(), payment=(), usb=(), accelerometer=(), gyroscope=()";
+var DEFAULT_HSTS = "max-age=31536000; includeSubDomains";
+function applyNonceToCsp(policy, nonce) {
+  return policy.split(";").map((directive) => {
+    const trimmed = directive.trim();
+    if (!trimmed.startsWith("script-src")) return directive;
+    if (trimmed.includes("'unsafe-inline'")) {
+      return directive.replace("'unsafe-inline'", `'nonce-${nonce}'`);
+    }
+    return `${directive} 'nonce-${nonce}'`;
+  }).join(";");
+}
+function applyCsp(out, config, effectiveNonce) {
+  if (config.csp === false || config.cspMode === "off") return;
+  let policy = typeof config.csp === "string" ? config.csp : DEFAULT_CSP;
+  if (effectiveNonce) {
+    policy = applyNonceToCsp(policy, effectiveNonce);
+  }
+  const mode = config.cspMode ?? "enforce";
+  if (mode === "enforce") {
+    out["Content-Security-Policy"] = policy;
+  } else {
+    out["Content-Security-Policy-Report-Only"] = policy;
+  }
+}
+function buildSecurityHeaders(config, env, options = {}) {
+  const out = {};
+  const effectiveNonce = options.prerender ? void 0 : options.nonce;
+  applyCsp(out, config, effectiveNonce);
+  out["X-Frame-Options"] = config.frameOptions ?? "DENY";
+  out["X-Content-Type-Options"] = config.contentTypeOptions ?? "nosniff";
+  out["Referrer-Policy"] = config.referrerPolicy ?? "strict-origin-when-cross-origin";
+  if (config.permissionsPolicy !== false) {
+    out["Permissions-Policy"] = typeof config.permissionsPolicy === "string" ? config.permissionsPolicy : DEFAULT_PERMISSIONS_POLICY;
+  }
+  if (env.production && config.hsts !== false) {
+    out["Strict-Transport-Security"] = typeof config.hsts === "string" ? config.hsts : DEFAULT_HSTS;
+  }
+  if (effectiveNonce) {
+    out["Cache-Control"] = "private, no-store";
+  }
+  return out;
+}
+function applySecurityHeaders(res, config, env, options = {}) {
+  const headers = buildSecurityHeaders(config, env, options);
+  for (const [key, value] of Object.entries(headers)) {
+    res.setHeader(key, value);
+  }
+}
+
+// src/server/auth/nonce.ts
+function bytesToBase64(bytes) {
+  if (typeof Buffer !== "undefined") {
+    return Buffer.from(bytes).toString("base64");
+  }
+  let binary = "";
+  for (const b of bytes) {
+    binary += String.fromCharCode(b);
+  }
+  return btoa(binary);
+}
+var cachedWebCrypto;
+function getWebCrypto() {
+  if (cachedWebCrypto === void 0) {
+    const candidate = globalThis.crypto;
+    cachedWebCrypto = candidate && typeof candidate.getRandomValues === "function" ? candidate : null;
+  }
+  if (!cachedWebCrypto) {
+    throw new Error(
+      "generateNonce: Web Crypto unavailable. TheoKit requires Node.js 19+, Bun, Deno, or any modern Edge runtime where `globalThis.crypto.getRandomValues` is present."
+    );
+  }
+  return cachedWebCrypto;
+}
+function generateNonce() {
+  const buf = new Uint8Array(16);
+  getWebCrypto().getRandomValues(buf);
+  return bytesToBase64(buf);
+}
+
 // src/server/auth/auth.ts
 var AuthRequiredError = class extends Error {
   code = "AUTH_REQUIRED";
@@ -785,31 +960,36 @@ function pickHeader(value) {
   if (Array.isArray(value) && value.length > 0) return value[0];
   return "";
 }
-function validateCsrf(req) {
-  if (req.headers["x-theo-action"] !== "1") {
+function isCsrfValidFromHeaders(opts) {
+  if (opts.csrfActionHeader !== "1") {
     return { valid: false, reason: "Missing X-Theo-Action header" };
   }
-  const origin = req.headers.origin;
-  if (!origin) {
+  if (opts.origin === null || opts.origin === "") {
     return { valid: true };
   }
-  const host = req.headers.host;
-  if (!host) {
+  if (opts.host === null || opts.host === "") {
     return { valid: true };
   }
-  const originStr = pickHeader(origin);
-  const hostStr = pickHeader(host);
-  if (originStr === "" || hostStr === "") return { valid: true };
   try {
-    const originHost = new URL(originStr).host;
-    if (originHost !== hostStr) {
-      return { valid: false, reason: `Origin ${originStr} does not match host ${hostStr}` };
+    const originHost = new URL(opts.origin).host;
+    if (originHost !== opts.host) {
+      return { valid: false, reason: `Origin ${opts.origin} does not match host ${opts.host}` };
     }
   } catch {
-    return { valid: false, reason: `Invalid origin: ${originStr}` };
+    return { valid: false, reason: `Invalid origin: ${opts.origin}` };
   }
   return { valid: true };
 }
+function validateCsrf(req) {
+  const action = req.headers["x-theo-action"];
+  const origin = req.headers.origin;
+  const host = req.headers.host;
+  return isCsrfValidFromHeaders({
+    csrfActionHeader: typeof action === "string" ? action : null,
+    origin: origin !== void 0 ? pickHeader(origin) || null : null,
+    host: host !== void 0 ? pickHeader(host) || null : null
+  });
+}
 function dispatchCsrfWarn2(req, reason, logger, auditLogger, pathFallback = "") {
   const payload = {
     event: "csrf.warn",
@@ -1268,6 +1448,29 @@ var ActionError = class _ActionError extends Error {
       this.stack = params.stack;
     }
   }
+  /**
+   * G5 T2.4 — canonical envelope view of the action error. Maps the G3
+   * ActionErrorCode to a canonical TheoErrorCode (VALIDATION_ERROR ↔
+   * UNPROCESSABLE_ENTITY, CONTENT_TOO_LARGE ↔ PAYLOAD_TOO_LARGE) so consumer
+   * UI / SDK code can switch on the unified envelope.
+   *
+   * Subclasses override to populate `ext` (see `ActionInputError.envelope`).
+   */
+  get envelope() {
+    return {
+      code: _ActionError.toTheoErrorCode(this.code),
+      message: this.message
+    };
+  }
+  /**
+   * Translate G3 ActionErrorCode → canonical TheoErrorCode (blueprint
+   * Recommendations § "G3 ActionError becomes inaugural envelope user").
+   */
+  static toTheoErrorCode(code) {
+    if (code === "VALIDATION_ERROR") return "UNPROCESSABLE_ENTITY";
+    if (code === "CONTENT_TOO_LARGE") return "PAYLOAD_TOO_LARGE";
+    return code;
+  }
   static codeToStatus(code) {
     return CODE_TO_STATUS[code];
   }
@@ -1307,6 +1510,18 @@ var ActionInputError = class extends ActionError {
     this.issues = extractUniversalIssues(rawIssues);
     this.fields = buildFieldsMap(this.issues);
   }
+  /**
+   * G5 T2.4 — envelope view with ValidationFieldsExt populated from .fields.
+   * UI consumers can `switch (env.code)` on `UNPROCESSABLE_ENTITY` and read
+   * `(env.ext as ValidationFieldsExt).fields` for field-level rendering.
+   */
+  get envelope() {
+    return {
+      code: "UNPROCESSABLE_ENTITY",
+      message: this.message,
+      ext: { fields: this.fields }
+    };
+  }
 };
 function buildFieldsMap(issues) {
   const fields = {};
@@ -1664,7 +1879,7 @@ function writeSerialized(res, serialized) {
 async function emitActionCallTelemetry(name, startedAt, input, outcome) {
   if (!__IS_DEV) return;
   try {
-    const mod = await import("./dispatcher-E6QV32BO.js");
+    const mod = await import("./dispatcher-EJME6C6M.js");
     mod.dispatcher.onActionCall({
       // eslint-disable-next-line sonarjs/pseudo-random -- non-secret correlation id
       id: `act-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`,
@@ -1838,89 +2053,9 @@ function findSuggestion(input, candidates, maxDistance = 3) {
   return best;
 }
 
-// src/server/security/security-headers.ts
-var DEFAULT_CSP = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' ws: wss:; frame-ancestors 'none'; report-uri /__theo/csp-report";
-var DEFAULT_PERMISSIONS_POLICY = "geolocation=(), camera=(), microphone=(), payment=(), usb=(), accelerometer=(), gyroscope=()";
-var DEFAULT_HSTS = "max-age=31536000; includeSubDomains";
-function applyNonceToCsp(policy, nonce) {
-  return policy.split(";").map((directive) => {
-    const trimmed = directive.trim();
-    if (!trimmed.startsWith("script-src")) return directive;
-    if (trimmed.includes("'unsafe-inline'")) {
-      return directive.replace("'unsafe-inline'", `'nonce-${nonce}'`);
-    }
-    return `${directive} 'nonce-${nonce}'`;
-  }).join(";");
-}
-function applyCsp(out, config, effectiveNonce) {
-  if (config.csp === false || config.cspMode === "off") return;
-  let policy = typeof config.csp === "string" ? config.csp : DEFAULT_CSP;
-  if (effectiveNonce) {
-    policy = applyNonceToCsp(policy, effectiveNonce);
-  }
-  const mode = config.cspMode ?? "enforce";
-  if (mode === "enforce") {
-    out["Content-Security-Policy"] = policy;
-  } else {
-    out["Content-Security-Policy-Report-Only"] = policy;
-  }
-}
-function buildSecurityHeaders(config, env, options = {}) {
-  const out = {};
-  const effectiveNonce = options.prerender ? void 0 : options.nonce;
-  applyCsp(out, config, effectiveNonce);
-  out["X-Frame-Options"] = config.frameOptions ?? "DENY";
-  out["X-Content-Type-Options"] = config.contentTypeOptions ?? "nosniff";
-  out["Referrer-Policy"] = config.referrerPolicy ?? "strict-origin-when-cross-origin";
-  if (config.permissionsPolicy !== false) {
-    out["Permissions-Policy"] = typeof config.permissionsPolicy === "string" ? config.permissionsPolicy : DEFAULT_PERMISSIONS_POLICY;
-  }
-  if (env.production && config.hsts !== false) {
-    out["Strict-Transport-Security"] = typeof config.hsts === "string" ? config.hsts : DEFAULT_HSTS;
-  }
-  if (effectiveNonce) {
-    out["Cache-Control"] = "private, no-store";
-  }
-  return out;
-}
-function applySecurityHeaders(res, config, env, options = {}) {
-  const headers = buildSecurityHeaders(config, env, options);
-  for (const [key, value] of Object.entries(headers)) {
-    res.setHeader(key, value);
-  }
-}
-
-// src/server/auth/nonce.ts
-function bytesToBase64(bytes) {
-  if (typeof Buffer !== "undefined") {
-    return Buffer.from(bytes).toString("base64");
-  }
-  let binary = "";
-  for (const b of bytes) {
-    binary += String.fromCharCode(b);
-  }
-  return btoa(binary);
-}
-var cachedWebCrypto;
-function getWebCrypto() {
-  if (cachedWebCrypto === void 0) {
-    const candidate = globalThis.crypto;
-    cachedWebCrypto = candidate && typeof candidate.getRandomValues === "function" ? candidate : null;
-  }
-  if (!cachedWebCrypto) {
-    throw new Error(
-      "generateNonce: Web Crypto unavailable. TheoKit requires Node.js 19+, Bun, Deno, or any modern Edge runtime where `globalThis.crypto.getRandomValues` is present."
-    );
-  }
-  return cachedWebCrypto;
-}
-function generateNonce() {
-  const buf = new Uint8Array(16);
-  getWebCrypto().getRandomValues(buf);
-  return bytesToBase64(buf);
-}
-
 export {
+  createPluginRunnerFromConfig,
+  resolveTransformer,
   logRequest,
   warnOnce,
   safeAudit,
@@ -1933,8 +2068,6 @@ export {
   createRateLimiter,
   buildSecurityHeaders,
   applySecurityHeaders,
-  createPluginRunnerFromConfig,
-  resolveTransformer,
   generateNonce
 };
-//# sourceMappingURL=chunk-TPCT3MXV.js.map
+//# sourceMappingURL=chunk-ABVITXFH.js.map