theokit 0.4.0-beta.0 → 0.4.0

package/dist/chunk-CZM6WWWS.js

@@ -1,2450 +0,0 @@
-import {
-  AuthRequiredError
-} from "./chunk-PB4GR7EP.js";
-import {
-  DuplicateContextKeyError,
-  createOutbox,
-  createOutboxDispatcher,
-  createQueueClient
-} from "./chunk-GY5Q27BJ.js";
-
-// src/config/load-env.ts
-import { lstatSync, readFileSync, realpathSync, statSync } from "fs";
-import { resolve } from "path";
-import dotenv from "dotenv";
-import { expand } from "dotenv-expand";
-var MAX_ENV_FILE_BYTES = 1048576;
-var cache = /* @__PURE__ */ new Map();
-function _resetEnvCache() {
-  cache.clear();
-}
-function envFilesInPriorityOrder(mode) {
-  const files = [`.env.${mode}.local`, `.env.local`, `.env.${mode}`, `.env`];
-  if (mode === "test") {
-    return files.filter((f) => f !== ".env.local");
-  }
-  return files;
-}
-function readEnvFile(path) {
-  let stat;
-  try {
-    stat = statSync(path);
-  } catch {
-    return null;
-  }
-  if (!stat.isFile() && !stat.isFIFO()) return null;
-  if (stat.size > MAX_ENV_FILE_BYTES) {
-    console.warn(
-      `[theokit] .env file at ${path} exceeds ${MAX_ENV_FILE_BYTES} bytes \u2014 skipping (likely a generated artifact, not a real env file)`
-    );
-    return null;
-  }
-  try {
-    const lstat = lstatSync(path);
-    if (lstat.isSymbolicLink()) {
-      const real = realpathSync(path);
-      console.info(`[theokit] .env at ${path} is a symlink \u2192 ${real}`);
-    }
-  } catch {
-  }
-  try {
-    const content = readFileSync(path, "utf-8");
-    return dotenv.parse(content);
-  } catch {
-    return null;
-  }
-}
-function loadEnv(options = {}) {
-  const cwd = options.cwd ?? process.cwd();
-  const mode = options.mode ?? process.env.NODE_ENV ?? "development";
-  const cacheKey = `${cwd}:${mode}`;
-  if (!options.forceReload) {
-    const cached = cache.get(cacheKey);
-    if (cached) return cached;
-  }
-  const fileNames = envFilesInPriorityOrder(mode);
-  const filePaths = fileNames.map((f) => resolve(cwd, f));
-  const merged = {};
-  const loadedFromFiles = [];
-  for (const path of [...filePaths].reverse()) {
-    const parsed = readEnvFile(path);
-    if (parsed === null) continue;
-    for (const [k, v] of Object.entries(parsed)) {
-      merged[k] = v;
-    }
-    loadedFromFiles.unshift(path);
-  }
-  if (merged.NODE_ENV && process.env.__THEOKIT_USER_NODE_ENV === void 0) {
-    process.env.__THEOKIT_USER_NODE_ENV = merged.NODE_ENV;
-  }
-  delete merged.NODE_ENV;
-  const processEnvClone = {};
-  for (const [k, v] of Object.entries(process.env)) {
-    if (typeof v === "string") processEnvClone[k] = v;
-  }
-  try {
-    expand({ parsed: merged, processEnv: processEnvClone });
-  } catch (err) {
-    if (err instanceof RangeError) {
-      console.warn(
-        `[theokit] .env expansion overflow (likely circular reference like A=\${B}, B=\${A}). Leaving values as literals.`
-      );
-    } else {
-      throw err;
-    }
-  }
-  const loaded = {};
-  for (const [k, v] of Object.entries(merged)) {
-    if (process.env[k] !== void 0) continue;
-    process.env[k] = v;
-    loaded[k] = v;
-  }
-  process.env.__THEOKIT_PROCESSED_ENV = "true";
-  const result = { loaded, loadedFromFiles };
-  cache.set(cacheKey, result);
-  return result;
-}
-
-// src/server/security/csrf-readiness-store.ts
-var CsrfReadinessStore = class _CsrfReadinessStore {
-  static MAX_ENTRIES = 1e3;
-  entries = /* @__PURE__ */ new Map();
-  keyFor(event) {
-    return `${event.method}\0${event.path}\0${event.reason}`;
-  }
-  record(event) {
-    const key = this.keyFor(event);
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const existing = this.entries.get(key);
-    if (existing) {
-      existing.count++;
-      existing.lastSeen = now;
-      return;
-    }
-    if (this.entries.size >= _CsrfReadinessStore.MAX_ENTRIES) {
-      const firstKey = this.entries.keys().next().value;
-      if (firstKey !== void 0) this.entries.delete(firstKey);
-    }
-    this.entries.set(key, { count: 1, firstSeen: now, lastSeen: now });
-  }
-  summary() {
-    let total = 0;
-    const routes = [];
-    for (const [key, entry] of this.entries) {
-      const [method, path, reason] = key.split("\0");
-      routes.push({
-        method,
-        path,
-        reason,
-        count: entry.count,
-        firstSeen: entry.firstSeen,
-        lastSeen: entry.lastSeen
-      });
-      total += entry.count;
-    }
-    return {
-      generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      totalEvents: total,
-      routes
-    };
-  }
-  reset() {
-    this.entries.clear();
-  }
-};
-
-// src/core/contracts/action-protocol.ts
-var CODE_TO_STATUS = {
-  VALIDATION_ERROR: 422,
-  BAD_REQUEST: 400,
-  UNAUTHORIZED: 401,
-  FORBIDDEN: 403,
-  NOT_FOUND: 404,
-  METHOD_NOT_ALLOWED: 405,
-  CONFLICT: 409,
-  CONTENT_TOO_LARGE: 413,
-  PAYLOAD_TOO_LARGE: 413,
-  UNSUPPORTED_MEDIA_TYPE: 415,
-  TOO_MANY_REQUESTS: 429,
-  INTERNAL_SERVER_ERROR: 500
-};
-var STATUS_TO_CODE = {
-  400: "BAD_REQUEST",
-  401: "UNAUTHORIZED",
-  403: "FORBIDDEN",
-  404: "NOT_FOUND",
-  405: "METHOD_NOT_ALLOWED",
-  409: "CONFLICT",
-  413: "PAYLOAD_TOO_LARGE",
-  415: "UNSUPPORTED_MEDIA_TYPE",
-  422: "VALIDATION_ERROR",
-  429: "TOO_MANY_REQUESTS",
-  500: "INTERNAL_SERVER_ERROR"
-};
-var ActionError = class _ActionError extends Error {
-  // Discriminator widened to the full union so subclasses can narrow to their
-  // specific literal (TypeScript would otherwise reject the override). Concrete
-  // values are still always exact literals at runtime.
-  type = "TheoActionError";
-  code;
-  status;
-  constructor(params) {
-    super(params.message ?? params.code);
-    this.code = params.code;
-    this.status = _ActionError.codeToStatus(params.code);
-    if (params.stack) {
-      this.stack = params.stack;
-    }
-  }
-  static codeToStatus(code) {
-    return CODE_TO_STATUS[code];
-  }
-  static statusToCode(status) {
-    return STATUS_TO_CODE[status] ?? "INTERNAL_SERVER_ERROR";
-  }
-  /**
-   * Parse a serialized error JSON back into the typed class hierarchy.
-   * Distinguishes `TheoActionInputError` (with `issues` array) from
-   * `TheoActionError` via the `type` discriminator. Falls back to
-   * `INTERNAL_SERVER_ERROR` for malformed bodies (non-object, missing
-   * `type`, unknown `code`).
-   */
-  static fromJson(body) {
-    if (typeof body !== "object" || body === null) {
-      return new _ActionError({ code: "INTERNAL_SERVER_ERROR" });
-    }
-    const obj = body;
-    if (obj.type === "TheoActionInputError" && Array.isArray(obj.issues)) {
-      return new ActionInputError(obj.issues);
-    }
-    if (obj.type === "TheoActionError" && typeof obj.code === "string" && obj.code in CODE_TO_STATUS) {
-      return new _ActionError({
-        code: obj.code,
-        message: typeof obj.message === "string" ? obj.message : void 0
-      });
-    }
-    return new _ActionError({ code: "INTERNAL_SERVER_ERROR" });
-  }
-};
-var ActionInputError = class extends ActionError {
-  type = "TheoActionInputError";
-  issues;
-  fields;
-  constructor(rawIssues) {
-    super({ code: "VALIDATION_ERROR", message: "Validation failed" });
-    this.issues = extractUniversalIssues(rawIssues);
-    this.fields = buildFieldsMap(this.issues);
-  }
-};
-function buildFieldsMap(issues) {
-  const fields = {};
-  const seen = /* @__PURE__ */ new Set();
-  for (const issue of issues) {
-    const key = issue.path.length === 0 ? "" : issue.path.join(".");
-    const dedupeKey = `${key}\0${issue.message}`;
-    if (seen.has(dedupeKey)) continue;
-    seen.add(dedupeKey);
-    const bucket = fields[key] ?? [];
-    bucket.push(issue.message);
-    fields[key] = bucket;
-  }
-  return fields;
-}
-function extractUniversalIssues(raw) {
-  if (!Array.isArray(raw)) return [];
-  const out = [];
-  for (const entry of raw) {
-    if (typeof entry !== "object" || entry === null) continue;
-    const obj = entry;
-    if (!Array.isArray(obj.path)) continue;
-    if (typeof obj.message !== "string") continue;
-    const path = [];
-    let pathValid = true;
-    for (const seg of obj.path) {
-      if (typeof seg === "string" || typeof seg === "number") {
-        path.push(seg);
-      } else {
-        pathValid = false;
-        break;
-      }
-    }
-    if (!pathValid) continue;
-    out.push({
-      path,
-      message: obj.message,
-      code: typeof obj.code === "string" ? obj.code : void 0
-    });
-  }
-  return out;
-}
-function isActionError(value) {
-  return value instanceof ActionError;
-}
-function isInputError(value) {
-  return value instanceof ActionInputError;
-}
-
-// src/server/body-parser.ts
-import { basename } from "path";
-import Busboy from "busboy";
-var METHODS_WITH_BODY = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH"]);
-var DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024;
-var DEFAULT_MAX_FILES = 10;
-var DEFAULT_MAX_FIELD_SIZE = 1 * 1024 * 1024;
-var FileTooLargeError = class extends Error {
-  constructor(message, truncatedFilenames, maxFileSize) {
-    super(message);
-    this.truncatedFilenames = truncatedFilenames;
-    this.maxFileSize = maxFileSize;
-    this.name = "FileTooLargeError";
-  }
-  truncatedFilenames;
-  maxFileSize;
-  code = "FILE_TOO_LARGE";
-  status = 413;
-};
-function stashBodyPreview(req, body) {
-  try {
-    ;
-    req[DEVTOOLS_BODY_PREVIEW] = body;
-  } catch {
-  }
-}
-function parseJsonBody(req) {
-  return new Promise((resolve2, reject) => {
-    const chunks = [];
-    req.on("data", (chunk) => chunks.push(chunk));
-    req.on("end", () => {
-      const raw = Buffer.concat(chunks).toString();
-      if (!raw) {
-        resolve2(void 0);
-        return;
-      }
-      try {
-        resolve2(JSON.parse(raw));
-      } catch {
-        reject(new Error("Invalid JSON body"));
-      }
-    });
-    req.on("error", reject);
-  });
-}
-function parseMultipartBody(req, contentType, options) {
-  if (!contentType.includes("boundary=")) {
-    return Promise.reject(new Error("Missing multipart boundary"));
-  }
-  return new Promise((resolve2, reject) => {
-    const fields = {};
-    const files = [];
-    const truncatedFilenames = [];
-    let fileCount = 0;
-    const bb = Busboy({
-      headers: req.headers,
-      limits: {
-        fileSize: options.maxFileSize,
-        files: options.maxFiles,
-        fieldSize: options.maxFieldSize
-      }
-    });
-    bb.on("field", (name, value) => {
-      fields[name] = value;
-    });
-    bb.on(
-      "file",
-      (fieldname, stream, info) => {
-        fileCount++;
-        if (fileCount > options.maxFiles) {
-          stream.resume();
-          return;
-        }
-        const safeName = basename(info.filename || "unnamed");
-        const chunks = [];
-        let size = 0;
-        let truncated = false;
-        stream.on("data", (chunk) => {
-          size += chunk.length;
-          if (size > options.maxFileSize) {
-            truncated = true;
-            stream.resume();
-            return;
-          }
-          chunks.push(chunk);
-        });
-        stream.on("end", () => {
-          if (truncated) {
-            truncatedFilenames.push(safeName);
-            return;
-          }
-          const buffer = Buffer.concat(chunks);
-          files.push({
-            fieldname,
-            filename: safeName,
-            encoding: info.encoding,
-            mimeType: info.mimeType,
-            buffer,
-            size: buffer.length
-          });
-        });
-      }
-    );
-    bb.on("filesLimit", () => {
-      reject(new Error(`Too many files. Maximum: ${options.maxFiles}`));
-    });
-    bb.on("error", (err) => {
-      reject(err);
-    });
-    bb.on("close", () => {
-      if (truncatedFilenames.length > 0) {
-        reject(
-          new FileTooLargeError(
-            `File too large (max ${options.maxFileSize} bytes): ${truncatedFilenames.join(", ")}`,
-            truncatedFilenames,
-            options.maxFileSize
-          )
-        );
-        return;
-      }
-      resolve2({ fields, files });
-    });
-    req.pipe(bb);
-  });
-}
-var DEVTOOLS_BODY_PREVIEW = /* @__PURE__ */ Symbol("theo:devtools:bodyPreview");
-async function parseRequestBody(req, options) {
-  const method = req.method?.toUpperCase() ?? "GET";
-  if (!METHODS_WITH_BODY.has(method)) {
-    return { fields: {}, files: [], json: void 0 };
-  }
-  const contentType = req.headers["content-type"] ?? "";
-  if (contentType.includes("application/json")) {
-    const json = await parseJsonBody(req);
-    stashBodyPreview(req, json);
-    return { fields: {}, files: [], json };
-  }
-  if (contentType.includes("multipart/form-data")) {
-    const limits = {
-      maxFileSize: options?.maxFileSize ?? DEFAULT_MAX_FILE_SIZE,
-      maxFiles: options?.maxFiles ?? DEFAULT_MAX_FILES,
-      maxFieldSize: options?.maxFieldSize ?? DEFAULT_MAX_FIELD_SIZE
-    };
-    const { fields, files } = await parseMultipartBody(req, contentType, limits);
-    stashBodyPreview(req, {
-      fields,
-      files: files.map((f) => ({
-        fieldname: f.fieldname,
-        filename: f.filename,
-        mimeType: f.mimeType,
-        size: f.size
-      }))
-    });
-    return { fields, files };
-  }
-  if (!contentType) {
-    return { fields: {}, files: [] };
-  }
-  throw new Error(`Unsupported Content-Type: ${contentType}`);
-}
-
-// src/server/observability/request-log.ts
-var defaultLoggerFn = (log) => {
-  console.log(JSON.stringify(log));
-};
-function logRequest(info, customLogger, req) {
-  const log = {
-    level: "info",
-    ...info,
-    timestamp: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  const logger = customLogger ?? defaultLoggerFn;
-  logger(log);
-  broadcastRequestToDevtools(info, req);
-}
-function randomRequestId() {
-  return `req-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`;
-}
-function broadcastRequestToDevtools(info, req) {
-  const headers = req?.headers ? Object.fromEntries(
-    Object.entries(req.headers).map(([k, v]) => [
-      k,
-      Array.isArray(v) ? v.join(", ") : v ?? ""
-    ])
-  ) : void 0;
-  const stashedBody = req ? req[DEVTOOLS_BODY_PREVIEW] : void 0;
-  void Promise.all([
-    import("./broadcast-4SX7R5XE.js"),
-    import("./build-request-body-preview-EOP2Y4F3.js")
-  ]).then(([{ broadcastRequest }, { buildRequestBodyPreview }]) => {
-    const bodyInfo = buildRequestBodyPreview(stashedBody);
-    broadcastRequest({
-      id: randomRequestId(),
-      traceId: info.requestId,
-      method: info.method,
-      path: info.url,
-      status: info.status,
-      durationMs: info.duration,
-      startedAt: Date.now() - info.duration,
-      ...headers ? { headers } : {},
-      ...bodyInfo ? {
-        bodyPreview: bodyInfo.preview,
-        bodyLength: bodyInfo.length,
-        bodyTruncated: bodyInfo.truncated
-      } : {}
-    });
-  }).catch(() => {
-  });
-}
-
-// src/server/observability/logger.ts
-var LEVEL_ORDER = {
-  debug: 0,
-  info: 1,
-  warn: 2,
-  error: 3,
-  silent: 4
-};
-function shouldLog(msgLevel, configLevel) {
-  return LEVEL_ORDER[msgLevel] >= LEVEL_ORDER[configLevel];
-}
-function defaultOutput(log) {
-  console.log(JSON.stringify(log));
-}
-function createLogger(options) {
-  const level = options?.level ?? "info";
-  const output = options?.output ?? defaultOutput;
-  const baseContext = options?.context ?? {};
-  function log(msgLevel, msg, context) {
-    if (!shouldLog(msgLevel, level)) return;
-    const entry = {
-      level: msgLevel,
-      msg,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      ...baseContext,
-      ...context
-    };
-    if (entry.error instanceof Error) {
-      entry.error = entry.error.stack ?? entry.error.message;
-    }
-    output(entry);
-  }
-  return {
-    debug: (msg, ctx) => {
-      log("debug", msg, ctx);
-    },
-    info: (msg, ctx) => {
-      log("info", msg, ctx);
-    },
-    warn: (msg, ctx) => {
-      log("warn", msg, ctx);
-    },
-    error: (msg, ctx) => {
-      log("error", msg, ctx);
-    },
-    child(ctx) {
-      return createLogger({
-        level,
-        output,
-        context: { ...baseContext, ...ctx }
-      });
-    }
-  };
-}
-var _warnOnceSeen = /* @__PURE__ */ new Set();
-var MAX_SEEN = 1024;
-function _resetWarnOnceForTests() {
-  _warnOnceSeen.clear();
-}
-function warnOnce(key, payload) {
-  if (_warnOnceSeen.has(key)) return;
-  if (_warnOnceSeen.size >= MAX_SEEN) {
-    const oldest = _warnOnceSeen.values().next().value;
-    if (oldest !== void 0) _warnOnceSeen.delete(oldest);
-  }
-  _warnOnceSeen.add(key);
-  let line;
-  try {
-    line = JSON.stringify({ ...payload, warnOnce: true });
-  } catch {
-    line = `[warnOnce] ${key} \u2014 (payload could not be serialized)`;
-  }
-  console.warn(line);
-  broadcastWarnOnceToDevtools(key, payload);
-}
-function payloadField(payload, key, fallback = "") {
-  const value = payload[key];
-  if (typeof value === "string") return value;
-  if (typeof value === "number" || typeof value === "boolean") return String(value);
-  return fallback;
-}
-function randomDevtoolsId() {
-  return `warn-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`;
-}
-function broadcastWarnOnceToDevtools(key, payload) {
-  void import("./broadcast-4SX7R5XE.js").then(({ broadcastCsrfWarn, broadcastError }) => {
-    if (payload.event === "csrf.warn" && typeof payload.code === "string" && typeof payload.docsUrl === "string") {
-      broadcastCsrfWarn({
-        event: "csrf.warn",
-        code: payload.code,
-        docsUrl: payload.docsUrl,
-        method: payloadField(payload, "method"),
-        path: payloadField(payload, "path"),
-        reason: payloadField(payload, "reason")
-      });
-    } else {
-      broadcastError({
-        id: randomDevtoolsId(),
-        type: "console",
-        message: payloadField(payload, "event", key),
-        timestamp: Date.now()
-      });
-    }
-  }).catch(() => {
-  });
-}
-
-// src/server/observability/audit-log.ts
-var JsonStdoutSink = class {
-  log(event) {
-    const enriched = {
-      level: "audit",
-      ...event,
-      timestamp: event.timestamp ?? (/* @__PURE__ */ new Date()).toISOString()
-    };
-    try {
-      console.log(JSON.stringify(enriched, jsonReplacer));
-    } catch {
-      console.log(
-        `{"level":"audit","action":${JSON.stringify(event.action)},"timestamp":${JSON.stringify(enriched.timestamp)},"note":"payload could not be serialized"}`
-      );
-    }
-  }
-};
-function jsonReplacer(_key, value) {
-  if (typeof value === "bigint") return value.toString();
-  return value;
-}
-function createNoOpLogger() {
-  return {
-    log() {
-    }
-  };
-}
-function safeAudit(logger, event) {
-  if (!logger) return;
-  try {
-    const r = logger.log(event);
-    if (r && typeof r.then === "function") {
-      r.catch(() => {
-      });
-    }
-  } catch {
-  }
-}
-
-// src/server/security/csrf.ts
-function matchDisallowed(path, patterns) {
-  for (const p of patterns) {
-    if (typeof p === "string") {
-      if (path === p) return true;
-    } else if (p instanceof RegExp) {
-      p.lastIndex = 0;
-      if (p.test(path)) return true;
-    }
-  }
-  return false;
-}
-var CSRF_WARN_CODE = "CSRF_STRICT_CUTOVER";
-var CSRF_WARN_DOCS_URL = "https://theokit.dev/upgrade/csrf-strict-cutover";
-function pickHeader(value) {
-  if (typeof value === "string") return value;
-  if (Array.isArray(value) && value.length > 0) return value[0];
-  return "";
-}
-function validateCsrf(req) {
-  if (req.headers["x-theo-action"] !== "1") {
-    return { valid: false, reason: "Missing X-Theo-Action header" };
-  }
-  const origin = req.headers.origin;
-  if (!origin) {
-    return { valid: true };
-  }
-  const host = req.headers.host;
-  if (!host) {
-    return { valid: true };
-  }
-  const originStr = pickHeader(origin);
-  const hostStr = pickHeader(host);
-  if (originStr === "" || hostStr === "") return { valid: true };
-  try {
-    const originHost = new URL(originStr).host;
-    if (originHost !== hostStr) {
-      return { valid: false, reason: `Origin ${originStr} does not match host ${hostStr}` };
-    }
-  } catch {
-    return { valid: false, reason: `Invalid origin: ${originStr}` };
-  }
-  return { valid: true };
-}
-function dispatchCsrfWarn(req, reason, logger, auditLogger, pathFallback = "") {
-  const payload = {
-    event: "csrf.warn",
-    method: req.method ?? "UNKNOWN",
-    path: logger?.path ?? pathFallback,
-    reason,
-    code: CSRF_WARN_CODE,
-    docsUrl: CSRF_WARN_DOCS_URL
-  };
-  logger?.warn(payload);
-  safeAudit(auditLogger, {
-    action: "csrf.warn",
-    actor: { type: "anonymous" },
-    metadata: { ...payload }
-  });
-}
-function enforceCsrf(req, mode, logger, disallowed, auditLogger) {
-  if (mode === "off") {
-    return { allow: true };
-  }
-  const check = validateCsrf(req);
-  if (check.valid) {
-    return { allow: true };
-  }
-  if (disallowed?.behavior === "raise") {
-    const path = logger?.path ?? req.url ?? "";
-    if (matchDisallowed(path, disallowed.routes)) {
-      return { allow: false, reason: check.reason };
-    }
-  }
-  if (mode === "warn") {
-    dispatchCsrfWarn(req, check.reason, logger, auditLogger);
-    return { allow: true, reason: check.reason };
-  }
-  dispatchCsrfWarn(req, check.reason, logger, auditLogger);
-  return { allow: false, reason: check.reason };
-}
-
-// src/server/http/send-response.ts
-function sendJson(res, data, status = 200, transformer) {
-  const body = transformer ? transformer.serialize(data) : JSON.stringify(data);
-  res.writeHead(status, {
-    "Content-Type": "application/json",
-    "Content-Length": Buffer.byteLength(body)
-  });
-  res.end(body);
-}
-function sendError(res, codeOrInput, message, status, issues, requestId, options) {
-  let code;
-  if (typeof codeOrInput === "string") {
-    code = codeOrInput;
-    message = message ?? "";
-    status = status ?? 500;
-  } else {
-    code = codeOrInput.code;
-    message = codeOrInput.message;
-    status = codeOrInput.status;
-    issues = codeOrInput.issues;
-    requestId = codeOrInput.requestId;
-    options = codeOrInput.options;
-  }
-  const errorMessage = code === "INTERNAL_ERROR" && process.env.NODE_ENV === "production" ? "Internal server error" : message;
-  if (code === "INTERNAL_ERROR") {
-    console.error(`[${requestId ?? "no-id"}] ${message}`);
-  }
-  if (status === 404 && options?.custom404Html) {
-    const body = options.custom404Html;
-    res.writeHead(404, {
-      "Content-Type": "text/html; charset=utf-8",
-      "Content-Length": Buffer.byteLength(body)
-    });
-    res.end(body);
-    return;
-  }
-  if (status === 500 && options?.custom500Html) {
-    const body = options.custom500Html;
-    res.writeHead(500, {
-      "Content-Type": "text/html; charset=utf-8",
-      "Content-Length": Buffer.byteLength(body)
-    });
-    res.end(body);
-    return;
-  }
-  sendJson(
-    res,
-    {
-      error: {
-        code,
-        message: errorMessage,
-        ...requestId ? { requestId } : {},
-        ...issues ? { issues } : {}
-      }
-    },
-    status
-  );
-}
-
-// src/server/scan/middleware-scan.ts
-import { readdirSync, existsSync, statSync as statSync2 } from "fs";
-import { join, extname } from "path";
-var MW_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx"]);
-function scanMiddlewares(serverDir) {
-  const mwDir = join(serverDir, "middleware");
-  if (!existsSync(mwDir) || !statSync2(mwDir).isDirectory()) {
-    return [];
-  }
-  const entries = readdirSync(mwDir, { withFileTypes: true });
-  const files = [];
-  for (const entry of entries) {
-    if (!entry.isFile()) continue;
-    if (entry.name.startsWith("_") || entry.name.startsWith(".")) continue;
-    const ext = extname(entry.name);
-    if (!MW_EXTENSIONS.has(ext)) continue;
-    files.push(join(mwDir, entry.name));
-  }
-  files.sort((a, b) => a.localeCompare(b));
-  return files;
-}
-
-// src/server/http/middleware-runner.ts
-import { existsSync as existsSync2 } from "fs";
-import { join as join2 } from "path";
-var middlewareCache = /* @__PURE__ */ new Map();
-function _resetMiddlewareCacheForTests() {
-  middlewareCache.clear();
-}
-function getCachedScan(serverDir) {
-  let cached = middlewareCache.get(serverDir);
-  if (!cached) {
-    const singleFilePath = join2(serverDir, "middleware.ts");
-    cached = {
-      singleFilePath,
-      singleFileExists: existsSync2(singleFilePath),
-      dirMiddlewares: scanMiddlewares(serverDir)
-    };
-    middlewareCache.set(serverDir, cached);
-  }
-  return cached;
-}
-async function runOneMiddleware(mw, req, res) {
-  const state = { nextCalled: false };
-  await mw(req, res, () => {
-    state.nextCalled = true;
-  });
-  return state;
-}
-async function runMiddlewareAndContext(req, res, loadModule, serverDir) {
-  const { singleFilePath, singleFileExists, dirMiddlewares } = getCachedScan(serverDir);
-  const dirExists = dirMiddlewares.length > 0;
-  if (singleFileExists && dirExists) {
-    throw new Error(
-      "Ambiguous middleware configuration: found both server/middleware.ts and server/middleware/ directory. Use one or the other, not both."
-    );
-  }
-  if (dirExists) {
-    for (const mwPath of dirMiddlewares) {
-      const mod = await loadModule(mwPath);
-      const mw = mod.default;
-      if (typeof mw !== "function") continue;
-      const { nextCalled } = await runOneMiddleware(mw, req, res);
-      if (!nextCalled || res.writableEnded) {
-        return { ctx: {}, aborted: true };
-      }
-    }
-  }
-  if (singleFileExists) {
-    const mod = await loadModule(singleFilePath);
-    const mw = mod.default;
-    if (typeof mw === "function") {
-      const { nextCalled } = await runOneMiddleware(mw, req, res);
-      if (!nextCalled || res.writableEnded) {
-        return { ctx: {}, aborted: true };
-      }
-    }
-  }
-  let ctx = {};
-  const contextPath = join2(serverDir, "context.ts");
-  if (existsSync2(contextPath)) {
-    const mod = await loadModule(contextPath);
-    const createContext = mod.createContext;
-    if (typeof createContext === "function") {
-      ctx = await createContext({ request: req, response: res });
-    }
-  }
-  return { ctx, aborted: false };
-}
-
-// src/server/security/csrf-warn-dispatch.ts
-function dispatchCsrfWarn2(payload) {
-  const key = `${payload.event}:${payload.method}:${payload.path ?? ""}`;
-  warnOnce(key, payload);
-}
-
-// src/server/http/execute-stages.ts
-async function parseQueryAndBody(req, res, requestId) {
-  const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
-  const query = Object.fromEntries(url.searchParams);
-  let body;
-  try {
-    const parsed = await parseRequestBody(req);
-    if (parsed.json !== void 0) {
-      body = parsed.json;
-    } else if (parsed.files.length > 0 || Object.keys(parsed.fields).length > 0) {
-      body = { ...parsed.fields, _files: parsed.files };
-    } else {
-      body = void 0;
-    }
-  } catch (err) {
-    const message = err.message;
-    const status = message.includes("Unsupported Content-Type") ? 415 : 400;
-    sendError(res, "VALIDATION_ERROR", message, status, void 0, requestId);
-    return { ok: false };
-  }
-  return { ok: true, data: { query, body } };
-}
-var isZodLike = (value) => typeof value === "object" && value !== null && typeof value.safeParse === "function";
-function runZodValidation(routeConfig, res, requestId, input) {
-  const { query, params } = input;
-  let { body } = input;
-  if (isZodLike(routeConfig.query)) {
-    const result = routeConfig.query.safeParse(query);
-    if (!result.success) {
-      sendError(
-        res,
-        "VALIDATION_ERROR",
-        "Invalid query parameters",
-        400,
-        result.error?.issues,
-        requestId
-      );
-      return { ok: false };
-    }
-    Object.assign(query, result.data);
-  }
-  if (isZodLike(routeConfig.body)) {
-    const result = routeConfig.body.safeParse(body);
-    if (!result.success) {
-      sendError(
-        res,
-        "VALIDATION_ERROR",
-        "Invalid request body",
-        400,
-        result.error?.issues,
-        requestId
-      );
-      return { ok: false };
-    }
-    body = result.data;
-  }
-  if (isZodLike(routeConfig.params)) {
-    const result = routeConfig.params.safeParse(params);
-    if (!result.success) {
-      sendError(
-        res,
-        "VALIDATION_ERROR",
-        "Invalid route parameters",
-        400,
-        result.error?.issues,
-        requestId
-      );
-      return { ok: false };
-    }
-    Object.assign(params, result.data);
-  }
-  return { ok: true, data: { query, body, params } };
-}
-
-// src/server/http/execute.ts
-var CSRF_PROTECTED_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
-async function pipeWebStreamToResponse(body, res, ctx) {
-  const reader = body.getReader();
-  try {
-    let done = false;
-    while (!done) {
-      const chunk = await reader.read();
-      done = chunk.done;
-      if (!done) res.write(chunk.value);
-    }
-  } catch (streamErr) {
-    warnOnce(`stream-error:${ctx.routePath}:${ctx.method}`, {
-      event: "stream.error",
-      requestId: ctx.requestId ?? "no-id",
-      route: ctx.routePath,
-      method: ctx.method,
-      message: streamErr instanceof Error ? streamErr.message : String(streamErr)
-    });
-    if (ctx.pluginRunner) {
-      try {
-        await ctx.pluginRunner.runOnError(ctx.buildPluginCtx(ctx.ctx), streamErr);
-      } catch {
-      }
-    }
-  } finally {
-    try {
-      reader.releaseLock();
-    } catch {
-    }
-  }
-}
-async function executeRoute(ctx) {
-  const {
-    route,
-    method,
-    params,
-    req,
-    res,
-    loadModule,
-    serverDir,
-    requestId,
-    pluginRunner,
-    transformer,
-    csrfMode = "strict",
-    disallowed,
-    jobBackend
-  } = ctx;
-  const buildPluginCtx = (ctxObj) => ({
-    request: req,
-    response: res,
-    ctx: ctxObj,
-    requestId: requestId ?? "no-id"
-  });
-  if (transformer && transformer.name !== "json") {
-    res.setHeader("x-theo-transformer", transformer.name);
-  }
-  try {
-    let ctx2 = {};
-    if (pluginRunner) {
-      pluginRunner.applyDecorations(ctx2);
-      const onReqResult = await pluginRunner.runOnRequest(buildPluginCtx(ctx2));
-      if (onReqResult.shortCircuited) return;
-    }
-    if (serverDir) {
-      const result = await runMiddlewareAndContext(req, res, loadModule, serverDir);
-      if (result.aborted) return;
-      ctx2 = result.ctx ?? {};
-      if (pluginRunner) pluginRunner.applyDecorations(ctx2);
-    }
-    if (jobBackend) {
-      if (ctx2.queue !== void 0) {
-        throw new DuplicateContextKeyError("queue", {
-          reason: "A plugin or middleware already decorated ctx.queue; choose a different key OR remove jobs.backend from theo.config.ts."
-        });
-      }
-      const outbox = createOutbox();
-      const queueClient = createQueueClient(jobBackend, outbox);
-      ctx2.queue = queueClient;
-      res.on("close", () => {
-        if (!res.writableFinished) outbox.discard();
-      });
-      res.on("finish", () => {
-        if (res.statusCode >= 400) {
-          outbox.discard();
-          return;
-        }
-        void outbox.flush(createOutboxDispatcher(jobBackend));
-      });
-    }
-    const mod = await loadModule(route.filePath);
-    const routeConfig = mod[method];
-    if (!routeConfig) {
-      sendError(
-        res,
-        "METHOD_NOT_ALLOWED",
-        `Method ${method} not allowed`,
-        405,
-        void 0,
-        requestId
-      );
-      return;
-    }
-    const handler = typeof routeConfig === "function" ? routeConfig : routeConfig.handler;
-    if (typeof handler !== "function") {
-      sendError(res, "INTERNAL_ERROR", "Route handler is not a function", 500, void 0, requestId);
-      return;
-    }
-    const routeOptOut = typeof routeConfig === "object" && routeConfig.csrf === false;
-    if (CSRF_PROTECTED_METHODS.has(method) && !routeOptOut) {
-      const decision = enforceCsrf(
-        req,
-        csrfMode,
-        {
-          // T3.3 DRY — see security/csrf-warn-dispatch.ts
-          warn: dispatchCsrfWarn2,
-          path: req.url
-        },
-        disallowed
-      );
-      if (!decision.allow) {
-        sendError(
-          res,
-          "CSRF_INVALID",
-          decision.reason ?? "CSRF check failed",
-          403,
-          void 0,
-          requestId
-        );
-        return;
-      }
-    }
-    const rc = routeConfig;
-    const parseResult = await parseQueryAndBody(req, res, requestId);
-    if (!parseResult.ok) return;
-    const { query } = parseResult.data;
-    let { body } = parseResult.data;
-    const validationResult = runZodValidation(rc, res, requestId, { query, body, params });
-    if (!validationResult.ok) return;
-    body = validationResult.data.body;
-    if (pluginRunner) {
-      const preResult = await pluginRunner.runPreHandler(buildPluginCtx(ctx2));
-      if (preResult.shortCircuited) return;
-    }
-    const callableHandler = handler;
-    const handlerResult = await callableHandler({ query, body, params, request: req, ctx: ctx2 });
-    if (handlerResult === void 0 || handlerResult === null) {
-      sendJson(res, null, rc.status ?? 204, transformer);
-      if (pluginRunner) await pluginRunner.runOnResponse(buildPluginCtx(ctx2));
-      return;
-    }
-    if (handlerResult instanceof Response) {
-      const headersBag = {};
-      for (const [k, v] of handlerResult.headers) {
-        if (k.toLowerCase() !== "set-cookie") headersBag[k] = v;
-      }
-      const setCookies = handlerResult.headers.getSetCookie();
-      if (setCookies.length > 0) {
-        res.setHeader("Set-Cookie", setCookies);
-      }
-      res.writeHead(handlerResult.status, headersBag);
-      if (handlerResult.body) {
-        await pipeWebStreamToResponse(handlerResult.body, res, {
-          buildPluginCtx,
-          ctx: ctx2,
-          method,
-          pluginRunner,
-          requestId,
-          routePath: route.routePath
-        });
-      }
-      res.end();
-      if (pluginRunner) await pluginRunner.runOnResponse(buildPluginCtx(ctx2));
-      return;
-    }
-    sendJson(res, handlerResult, rc.status ?? 200, transformer);
-    if (pluginRunner) await pluginRunner.runOnResponse(buildPluginCtx(ctx2));
-  } catch (err) {
-    if (pluginRunner) {
-      const errCtxObj = {};
-      pluginRunner.applyDecorations(errCtxObj);
-      await pluginRunner.runOnError(buildPluginCtx(errCtxObj), err);
-      if (res.writableEnded) {
-        await pluginRunner.runOnResponse(buildPluginCtx(errCtxObj), { inErrorPath: true });
-        return;
-      }
-    }
-    const isAuthError = err instanceof AuthRequiredError || err !== null && typeof err === "object" && err.code === "AUTH_REQUIRED" && err.status === 401;
-    if (isAuthError) {
-      const authErr = err;
-      sendError(res, authErr.code, authErr.message, authErr.status, void 0, requestId);
-      if (pluginRunner) {
-        const errCtxObj = {};
-        pluginRunner.applyDecorations(errCtxObj);
-        await pluginRunner.runOnResponse(buildPluginCtx(errCtxObj), { inErrorPath: true });
-      }
-      return;
-    }
-    sendError(
-      res,
-      "INTERNAL_ERROR",
-      err instanceof Error && err.message ? err.message : "Internal server error",
-      500,
-      void 0,
-      requestId
-    );
-    if (pluginRunner) {
-      const errCtxObj = {};
-      pluginRunner.applyDecorations(errCtxObj);
-      await pluginRunner.runOnResponse(buildPluginCtx(errCtxObj), { inErrorPath: true });
-    }
-  }
-}
-
-// src/server/http/form-data-to-object.ts
-import { z } from "zod";
-function formDataToObject(formData, schema, prefix = "") {
-  const shape = schema._def.shape();
-  const out = {};
-  for (const [key, rawValidator] of Object.entries(shape)) {
-    const fullKey = prefix + key;
-    const validator = unwrapWrappers(rawValidator);
-    if (validator instanceof z.ZodObject) {
-      const nestedPrefix = `${fullKey}.`;
-      const hasNestedKeys = [...formData.keys()].some((k) => k.startsWith(nestedPrefix));
-      if (hasNestedKeys) {
-        out[key] = formDataToObject(formData, validator, nestedPrefix);
-        continue;
-      }
-      out[key] = unwrapMissingDefault(rawValidator);
-      continue;
-    }
-    if (validator instanceof z.ZodArray) {
-      const values = formData.getAll(fullKey);
-      out[key] = coerceArrayElements(values, validator);
-      continue;
-    }
-    if (validator instanceof z.ZodBoolean) {
-      out[key] = coerceBoolean(formData, fullKey);
-      continue;
-    }
-    if (formData.has(fullKey)) {
-      const raw = formData.get(fullKey);
-      out[key] = coerceScalar(raw, validator);
-    } else {
-      out[key] = unwrapMissingDefault(rawValidator);
-    }
-  }
-  return out;
-}
-function unwrapWrappers(validator) {
-  let inner = validator;
-  while (inner instanceof z.ZodOptional || inner instanceof z.ZodNullable || inner instanceof z.ZodDefault) {
-    inner = inner._def.innerType;
-  }
-  return inner;
-}
-function unwrapMissingDefault(validator) {
-  let cursor = validator;
-  while (cursor instanceof z.ZodOptional || cursor instanceof z.ZodNullable || cursor instanceof z.ZodDefault) {
-    if (cursor instanceof z.ZodDefault) {
-      const def = cursor._def.defaultValue;
-      return typeof def === "function" ? def() : def;
-    }
-    if (cursor instanceof z.ZodNullable) return null;
-    cursor = cursor._def.innerType;
-  }
-  return void 0;
-}
-function coerceScalar(raw, validator) {
-  if (raw === null) return void 0;
-  if (validator instanceof z.ZodNumber) {
-    return typeof raw === "string" ? Number(raw) : raw;
-  }
-  return raw;
-}
-function coerceArrayElements(values, arrayValidator) {
-  const elementType = unwrapWrappers(arrayValidator._def.type);
-  if (elementType instanceof z.ZodNumber) {
-    return values.map((v) => typeof v === "string" ? Number(v) : v);
-  }
-  if (elementType instanceof z.ZodBoolean) {
-    return values.map((v) => {
-      if (v === "true") return true;
-      if (v === "false") return false;
-      return Boolean(v);
-    });
-  }
-  return values;
-}
-function coerceBoolean(formData, key) {
-  if (!formData.has(key)) return void 0;
-  const val = formData.get(key);
-  if (val === "true") return true;
-  if (val === "false") return false;
-  return Boolean(val);
-}
-
-// src/server/http/handle-request-error.ts
-async function handleRequestError(err, c) {
-  if (c.pluginRunner) {
-    const errCtxObj = {};
-    c.pluginRunner.applyDecorations(errCtxObj);
-    try {
-      await c.pluginRunner.runOnError(c.buildPluginCtx(errCtxObj), err);
-    } catch {
-    }
-    if (c.res.writableEnded) {
-      try {
-        await c.pluginRunner.runOnResponse(c.buildPluginCtx(errCtxObj), {
-          inErrorPath: true
-        });
-      } catch {
-      }
-      return;
-    }
-  }
-  const isAuthError = err instanceof AuthRequiredError || err !== null && typeof err === "object" && err.code === "AUTH_REQUIRED" && err.status === 401;
-  if (isAuthError) {
-    const authErr = err;
-    sendError(c.res, authErr.code, authErr.message, authErr.status, void 0, c.requestId);
-  } else {
-    sendError(
-      c.res,
-      "INTERNAL_ERROR",
-      err instanceof Error ? err.message : "Internal server error",
-      500,
-      void 0,
-      c.requestId
-    );
-  }
-  if (c.pluginRunner) {
-    const errCtxObj = {};
-    c.pluginRunner.applyDecorations(errCtxObj);
-    try {
-      await c.pluginRunner.runOnResponse(c.buildPluginCtx(errCtxObj), {
-        inErrorPath: true
-      });
-    } catch {
-    }
-  }
-}
-
-// src/server/http/serialize-action-result.ts
-import { stringify as devalueStringify } from "devalue";
-var DEFAULT_RESPONSE_BODY_SIZE_LIMIT = 5 * 1024 * 1024;
-function serializeActionResult(result, options = {}) {
-  const limit = options.responseBodySizeLimit ?? DEFAULT_RESPONSE_BODY_SIZE_LIMIT;
-  if (result.error !== void 0) {
-    const body2 = result.error instanceof ActionInputError ? JSON.stringify({
-      type: result.error.type,
-      code: result.error.code,
-      message: result.error.message,
-      issues: result.error.issues,
-      fields: result.error.fields
-    }) : JSON.stringify({
-      type: result.error.type,
-      code: result.error.code,
-      message: result.error.message
-    });
-    if (Buffer.byteLength(body2, "utf8") > limit) {
-      throw new ActionError({
-        code: "PAYLOAD_TOO_LARGE",
-        message: `Serialized error body exceeds limit (${limit} bytes)`
-      });
-    }
-    return {
-      type: "error",
-      status: result.error.status,
-      contentType: "application/json",
-      body: body2
-    };
-  }
-  if (result.data === void 0) {
-    return { type: "empty", status: 204 };
-  }
-  if (result.data instanceof Response) {
-    throw new ActionError({
-      code: "INTERNAL_SERVER_ERROR",
-      message: "Action handler cannot serialize Response objects \u2014 return plain data instead"
-    });
-  }
-  let body;
-  try {
-    body = devalueStringify(result.data, {
-      URL: (value) => value instanceof URL && value.href
-    });
-  } catch (e) {
-    throw new ActionError({
-      code: "INTERNAL_SERVER_ERROR",
-      message: `Action data not serializable: ${e instanceof Error ? e.message : String(e)}`
-    });
-  }
-  if (Buffer.byteLength(body, "utf8") > limit) {
-    throw new ActionError({
-      code: "PAYLOAD_TOO_LARGE",
-      message: `Serialized response body exceeds limit (${limit} bytes)`
-    });
-  }
-  return {
-    type: "data",
-    status: 200,
-    contentType: "application/json+devalue",
-    body
-  };
-}
-
-// src/server/http/action-execute.ts
-var __IS_DEV = (() => {
-  try {
-    return import.meta.env?.DEV === true;
-  } catch {
-    return process.env.NODE_ENV !== "production";
-  }
-})();
-function isActionConfig(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const candidate = value;
-  if (typeof candidate.handler !== "function") return false;
-  const input = candidate.input;
-  return typeof input?.safeParse === "function";
-}
-async function executeAction(filePath, exportName, req, res, loadModule, serverDir, requestId, pluginRunner, csrfMode = "strict", disallowed) {
-  return executeActionWithOptions({
-    filePath,
-    exportName,
-    req,
-    res,
-    loadModule,
-    serverDir,
-    requestId,
-    pluginRunner,
-    csrfMode,
-    disallowed
-  });
-}
-async function loadActionConfig(loadModule, filePath, exportName, res, requestId) {
-  const mod = await loadModule(filePath);
-  const exportedValue = mod[exportName];
-  if (!isActionConfig(exportedValue)) {
-    sendError(res, "NOT_FOUND", `Action "${exportName}" not found`, 404, void 0, requestId);
-    return null;
-  }
-  return exportedValue;
-}
-function enforceCsrfForAction(req, res, ctx) {
-  if (ctx.actionConfig.csrf === false) return true;
-  const decision = enforceCsrf(
-    req,
-    ctx.csrfMode,
-    {
-      // T3.3 DRY — canonical dispatcher
-      warn: dispatchCsrfWarn2,
-      path: req.url
-    },
-    ctx.disallowed
-  );
-  if (decision.allow) return true;
-  sendError(
-    res,
-    "CSRF_INVALID",
-    decision.reason ?? "CSRF check failed",
-    403,
-    void 0,
-    ctx.requestId
-  );
-  return false;
-}
-async function runPreHandlerPipeline(p) {
-  if (p.serverDir) {
-    const result = await runMiddlewareAndContext(p.req, p.res, p.loadModule, p.serverDir);
-    if (result.aborted) return false;
-    Object.assign(p.ctx, result.ctx ?? {});
-    p.pluginRunner?.applyDecorations(p.ctx);
-  }
-  if (p.pluginRunner) {
-    const preResult = await p.pluginRunner.runPreHandler(p.buildPluginCtx(p.ctx));
-    if (preResult.shortCircuited) return false;
-  }
-  return true;
-}
-async function readActionBody(req, res, requestId, actionConfig) {
-  try {
-    const parsed = await parseRequestBody(req);
-    const accept = actionConfig.accept ?? "json";
-    let body;
-    if (accept === "form") {
-      body = formDataToObject(
-        synthesizeFormData(parsed),
-        actionConfig.input
-      );
-    } else if (parsed.json !== void 0) {
-      body = parsed.json;
-    } else {
-      body = parsed.fields;
-    }
-    return { ok: true, body };
-  } catch (err) {
-    sendError(res, "VALIDATION_ERROR", err.message, 400, void 0, requestId);
-    return { ok: false };
-  }
-}
-function synthesizeFormData(parsed) {
-  const fd = new FormData();
-  for (const [name, value] of Object.entries(parsed.fields)) {
-    fd.append(name, value);
-  }
-  for (const file of parsed.files) {
-    const blob = new Blob([file.buffer], {
-      type: file.mimeType
-    });
-    fd.append(file.fieldname, blob, file.filename);
-  }
-  return fd;
-}
-function writeSerialized(res, serialized) {
-  if (serialized.type === "empty") {
-    res.statusCode = serialized.status;
-    res.end();
-    return;
-  }
-  res.statusCode = serialized.status;
-  res.setHeader("Content-Type", serialized.contentType);
-  res.end(serialized.body);
-}
-async function emitActionCallTelemetry(name, startedAt, input, outcome) {
-  if (!__IS_DEV) return;
-  try {
-    const mod = await import("./dispatcher-AQJGI3HU.js");
-    mod.dispatcher.onActionCall({
-      // eslint-disable-next-line sonarjs/pseudo-random -- non-secret correlation id
-      id: `act-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`,
-      timestamp: startedAt,
-      name,
-      input,
-      output: outcome.status === "success" ? outcome.output : void 0,
-      error: outcome.status === "error" ? {
-        code: outcome.error.code,
-        message: outcome.error.message,
-        fields: outcome.error instanceof ActionInputError ? outcome.error.fields : void 0
-      } : void 0,
-      durationMs: Date.now() - startedAt,
-      status: outcome.status
-    });
-  } catch {
-  }
-}
-async function executeActionWithOptions(opts) {
-  const {
-    filePath,
-    exportName,
-    req,
-    res,
-    loadModule,
-    serverDir,
-    requestId,
-    pluginRunner,
-    csrfMode = "strict",
-    disallowed
-  } = opts;
-  const buildPluginCtx = (ctxObj) => ({
-    request: req,
-    response: res,
-    ctx: ctxObj,
-    requestId: requestId ?? "no-id"
-  });
-  let ctx = {};
-  try {
-    if ((req.method ?? "GET").toUpperCase() !== "POST") {
-      sendError(res, "METHOD_NOT_ALLOWED", "Actions only accept POST", 405, void 0, requestId);
-      return;
-    }
-    if (pluginRunner) {
-      pluginRunner.applyDecorations(ctx);
-      const onReqResult = await pluginRunner.runOnRequest(buildPluginCtx(ctx));
-      if (onReqResult.shortCircuited) return;
-    }
-    const actionConfig = await loadActionConfig(loadModule, filePath, exportName, res, requestId);
-    if (!actionConfig) return;
-    if (!enforceCsrfForAction(req, res, { actionConfig, csrfMode, disallowed, requestId })) {
-      return;
-    }
-    const pipeline = {
-      ctx,
-      buildPluginCtx,
-      pluginRunner,
-      serverDir,
-      loadModule,
-      req,
-      res
-    };
-    if (!await runPreHandlerPipeline(pipeline)) return;
-    ctx = pipeline.ctx;
-    const bodyOutcome = await readActionBody(req, res, requestId, actionConfig);
-    if (!bodyOutcome.ok) return;
-    const actionName = exportName === "default" ? deriveActionNameFromPath(filePath) : exportName;
-    const startedAt = Date.now();
-    const result = actionConfig.input.safeParse(bodyOutcome.body);
-    if (!result.success) {
-      const inputErr = new ActionInputError(result.error?.issues ?? []);
-      writeSerialized(res, serializeActionResult({ data: void 0, error: inputErr }));
-      await emitActionCallTelemetry(actionName, startedAt, bodyOutcome.body, {
-        status: "error",
-        error: inputErr
-      });
-      return;
-    }
-    await runActionHandler({
-      actionConfig,
-      actionName,
-      startedAt,
-      input: result.data,
-      ctx,
-      res,
-      pluginRunner,
-      buildPluginCtx
-    });
-  } catch (err) {
-    await handleActionError(err, { req, res, ctx, requestId, pluginRunner, buildPluginCtx });
-  }
-}
-function deriveActionNameFromPath(filePath) {
-  const base = filePath.split(/[\\/]/).pop() ?? "unknown";
-  return base.replace(/\.[jt]sx?$/, "");
-}
-function isActionErrorLike(err) {
-  if (err === null || typeof err !== "object") return false;
-  const obj = err;
-  return (obj.type === "TheoActionError" || obj.type === "TheoActionInputError") && typeof obj.code === "string" && typeof obj.status === "number";
-}
-async function runActionHandler(args) {
-  try {
-    const handlerResult = await args.actionConfig.handler({ input: args.input, ctx: args.ctx });
-    writeSerialized(args.res, serializeActionResult({ data: handlerResult, error: void 0 }));
-    if (args.pluginRunner) {
-      await args.pluginRunner.runOnResponse(args.buildPluginCtx(args.ctx));
-    }
-    await emitActionCallTelemetry(args.actionName, args.startedAt, args.input, {
-      status: "success",
-      output: handlerResult
-    });
-  } catch (err) {
-    if (isActionErrorLike(err)) {
-      writeSerialized(args.res, serializeActionResult({ data: void 0, error: err }));
-      await emitActionCallTelemetry(args.actionName, args.startedAt, args.input, {
-        status: "error",
-        error: err
-      });
-      return;
-    }
-    const wrapped = new ActionError({
-      code: "INTERNAL_SERVER_ERROR",
-      message: err instanceof Error ? err.message : "Action handler threw"
-    });
-    await emitActionCallTelemetry(args.actionName, args.startedAt, args.input, {
-      status: "error",
-      error: wrapped
-    });
-    throw err;
-  }
-}
-async function handleActionError(err, c) {
-  return handleRequestError(err, {
-    req: c.req,
-    res: c.res,
-    requestId: c.requestId,
-    pluginRunner: c.pluginRunner,
-    buildPluginCtx: c.buildPluginCtx
-  });
-}
-
-// src/server/observability/suggest.ts
-function levenshtein(a, b) {
-  const m = a.length;
-  const n = b.length;
-  const dp = Array.from(
-    { length: m + 1 },
-    () => Array.from({ length: n + 1 }).fill(0)
-  );
-  for (let i = 0; i <= m; i++) dp[i][0] = i;
-  for (let j = 0; j <= n; j++) dp[0][j] = j;
-  for (let i = 1; i <= m; i++) {
-    for (let j = 1; j <= n; j++) {
-      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
-      dp[i][j] = Math.min(dp[i - 1][j] + 1, dp[i][j - 1] + 1, dp[i - 1][j - 1] + cost);
-    }
-  }
-  return dp[m][n];
-}
-function findSuggestion(input, candidates, maxDistance = 3) {
-  let best = null;
-  let bestDist = maxDistance + 1;
-  for (const c of candidates) {
-    const d = levenshtein(input, c);
-    if (d < bestDist) {
-      bestDist = d;
-      best = c;
-    }
-  }
-  return best;
-}
-
-// src/server/scan/module-loader.ts
-import { pathToFileURL } from "url";
-function createViteLoader(vite) {
-  return (path) => vite.ssrLoadModule(path);
-}
-function createProductionLoader() {
-  return async (path) => {
-    const url = pathToFileURL(path).href;
-    return import(url);
-  };
-}
-
-// src/server/http/batch-handler.ts
-import { z as z2 } from "zod";
-var STRIPPED_HEADERS = [
-  "authorization",
-  "cookie",
-  "x-forwarded-for",
-  "x-forwarded-host",
-  "x-forwarded-proto",
-  "x-real-ip",
-  "host"
-];
-var BATCH_PATH = "/api/__theo_batch__";
-var DEFAULT_MAX_BATCH = 32;
-var BatchPathConflictError = class extends Error {
-  constructor(path) {
-    super(
-      `Server route conflicts with reserved batch path ${path}. Rename the route or disable batching in theo.config.ts.`
-    );
-    this.name = "BatchPathConflictError";
-  }
-};
-var batchRequestSchema = z2.object({
-  path: z2.string().min(1),
-  method: z2.string().min(1),
-  query: z2.record(z2.unknown()).optional(),
-  body: z2.unknown().optional(),
-  headers: z2.record(z2.string()).optional()
-});
-var batchPayloadSchema = z2.object({
-  requests: z2.array(batchRequestSchema).min(1)
-});
-function sanitizeItemHeaders(itemHeaders, outerHeaders) {
-  const out = {};
-  if (itemHeaders) {
-    for (const [k, v] of Object.entries(itemHeaders)) {
-      const lower = k.toLowerCase();
-      if (!STRIPPED_HEADERS.includes(lower)) {
-        out[lower] = v;
-      }
-    }
-  }
-  if (outerHeaders) {
-    for (const stripped of STRIPPED_HEADERS) {
-      if (Object.hasOwn(outerHeaders, stripped)) {
-        out[stripped] = outerHeaders[stripped];
-      }
-    }
-  }
-  return out;
-}
-async function handleBatchRequest(payload, options) {
-  const parsed = batchPayloadSchema.parse(payload);
-  const max = options.max ?? DEFAULT_MAX_BATCH;
-  if (parsed.requests.length > max) {
-    throw new Error(`Batch size ${parsed.requests.length} exceeds max ${max}`);
-  }
-  const results = [];
-  for (const item of parsed.requests) {
-    const sanitized = {
-      ...item,
-      headers: sanitizeItemHeaders(item.headers, options.outerHeaders)
-    };
-    try {
-      const r = await options.execute(sanitized);
-      results.push(r);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      results.push({ error: { message } });
-    }
-  }
-  return { results };
-}
-
-// src/server/http/cors.ts
-var DEFAULT_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"];
-var DEFAULT_ALLOWED_HEADERS = ["Content-Type", "X-Theo-Action", "Authorization"];
-var DEFAULT_MAX_AGE = 600;
-function readOrigin(req) {
-  const raw = req.headers.origin;
-  if (raw === void 0) return void 0;
-  if (Array.isArray(raw)) {
-    return raw.find((v) => typeof v === "string" && v.length > 0);
-  }
-  return raw;
-}
-function matchesOrigin(origin, allowed) {
-  if (allowed === "*") return true;
-  if (typeof allowed === "string") return origin === allowed;
-  if (allowed instanceof RegExp) {
-    allowed.lastIndex = 0;
-    return allowed.test(origin);
-  }
-  if (Array.isArray(allowed)) {
-    for (const entry of allowed) {
-      if (typeof entry === "string" && origin === entry) return true;
-      if (entry instanceof RegExp) {
-        entry.lastIndex = 0;
-        if (entry.test(origin)) return true;
-      }
-    }
-    return false;
-  }
-  if (typeof allowed === "function") {
-    try {
-      return allowed(origin);
-    } catch {
-      return false;
-    }
-  }
-  return false;
-}
-function createCorsHandler(config) {
-  const methods = (config.methods ?? DEFAULT_METHODS).slice();
-  const allowedHeaders = (config.allowedHeaders ?? DEFAULT_ALLOWED_HEADERS).slice();
-  const maxAge = String(config.maxAge ?? DEFAULT_MAX_AGE);
-  const credentials = config.credentials === true;
-  return {
-    handlePreflight(req, res) {
-      if (req.method !== "OPTIONS") return false;
-      const acMethod = req.headers["access-control-request-method"];
-      if (!acMethod) return false;
-      const origin = readOrigin(req);
-      if (!origin) return false;
-      if (!matchesOrigin(origin, config.origins)) {
-        res.statusCode = 403;
-        res.end();
-        return true;
-      }
-      res.setHeader("Access-Control-Allow-Origin", origin);
-      res.setHeader("Access-Control-Allow-Methods", methods.join(", "));
-      res.setHeader("Access-Control-Allow-Headers", allowedHeaders.join(", "));
-      res.setHeader("Access-Control-Max-Age", maxAge);
-      res.setHeader("Vary", "Origin");
-      if (credentials) res.setHeader("Access-Control-Allow-Credentials", "true");
-      res.statusCode = 204;
-      res.end();
-      return true;
-    },
-    applyHeaders(req, res) {
-      const origin = readOrigin(req);
-      if (!origin) return;
-      if (!matchesOrigin(origin, config.origins)) return;
-      res.setHeader("Access-Control-Allow-Origin", origin);
-      res.setHeader("Vary", "Origin");
-      if (credentials) res.setHeader("Access-Control-Allow-Credentials", "true");
-      if (config.exposedHeaders && config.exposedHeaders.length > 0) {
-        res.setHeader("Access-Control-Expose-Headers", config.exposedHeaders.join(", "));
-      }
-    }
-  };
-}
-
-// src/server/http/trace-context.ts
-import { randomUUID } from "crypto";
-var TRACE_HEADER = "x-trace-id";
-var TRACE_PARENT_HEADER = "traceparent";
-var REQUEST_ID_HEADER = "x-request-id";
-var TRACEPARENT_RE = /^00-([0-9a-f]{32})-([0-9a-f]{16})-[0-9a-f]{2}$/;
-function parseTraceparent(value) {
-  if (!value) return null;
-  const m = TRACEPARENT_RE.exec(value);
-  if (!m) return null;
-  const traceId = m[1];
-  if (/^0+$/.test(traceId)) return null;
-  return traceId;
-}
-function pickHeader2(value) {
-  if (Array.isArray(value)) {
-    for (const v of value) {
-      if (typeof v === "string" && v.length > 0) return v;
-    }
-    return null;
-  }
-  if (typeof value === "string" && value.length > 0) return value;
-  return null;
-}
-function extractTraceId(req) {
-  const traceparent = pickHeader2(req.headers[TRACE_PARENT_HEADER]);
-  if (traceparent) {
-    const parsed = parseTraceparent(traceparent);
-    if (parsed) return parsed;
-  }
-  const requestId = pickHeader2(req.headers[REQUEST_ID_HEADER]);
-  if (requestId) return requestId;
-  return randomUUID();
-}
-
-// src/server/rate-limit/rate-limit-store.ts
-var InMemoryStore = class _InMemoryStore {
-  store = /* @__PURE__ */ new Map();
-  /** Bound the map to prevent unbounded growth from pathological inputs. */
-  static MAX_ENTRIES = 1e5;
-  /** GC sweep interval, milliseconds. */
-  static GC_INTERVAL_MS = 3e4;
-  gcTimer = null;
-  constructor() {
-    if (typeof setInterval !== "undefined") {
-      const timer = setInterval(() => {
-        this.sweepExpired();
-      }, _InMemoryStore.GC_INTERVAL_MS);
-      this.gcTimer = timer;
-      const maybeUnref = timer.unref;
-      if (typeof maybeUnref === "function") maybeUnref.call(timer);
-    }
-  }
-  /**
-   * Synchronous fast-path used by the legacy sync `createRateLimiter`
-   * surface (`api-middleware.ts` is sync). The async `incr` delegates to
-   * this for in-memory; external adapters override `incr` directly.
-   */
-  incrSync(key, windowMs) {
-    if (!Number.isFinite(windowMs) || windowMs <= 0) {
-      throw new Error(
-        `InMemoryStore.incr: windowMs must be a positive finite number (got ${windowMs})`
-      );
-    }
-    const now = Date.now();
-    if (this.store.size >= _InMemoryStore.MAX_ENTRIES) {
-      const first = this.store.keys().next().value;
-      if (first !== void 0) this.store.delete(first);
-    }
-    const entry = this.store.get(key);
-    if (!entry || now >= entry.resetAt) {
-      const fresh = { count: 1, resetAt: now + windowMs };
-      this.store.set(key, fresh);
-      return { ...fresh };
-    }
-    entry.count++;
-    return { count: entry.count, resetAt: entry.resetAt };
-  }
-  /** Sweep expired entries. Called by the GC timer; safe to call manually. */
-  sweepExpired() {
-    const now = Date.now();
-    for (const [k, v] of this.store) {
-      if (v.resetAt <= now) this.store.delete(k);
-    }
-  }
-  /**
-   * Stop the GC timer. Call from tests or when discarding the store. After
-   * `dispose`, the store still works but no longer auto-sweeps.
-   */
-  dispose() {
-    if (this.gcTimer) {
-      clearInterval(this.gcTimer);
-      this.gcTimer = null;
-    }
-  }
-  // The async surface is required by the `RateLimitStore` interface
-  // (Redis/etc. adapters are inherently async). For the in-memory case
-  // we just adapt the sync implementations to Promises.
-  // eslint-disable-next-line @typescript-eslint/require-await -- interface contract: async return
-  async incr(key, windowMs) {
-    return this.incrSync(key, windowMs);
-  }
-  // eslint-disable-next-line @typescript-eslint/require-await -- interface contract: async return
-  async get(key) {
-    const now = Date.now();
-    const entry = this.store.get(key);
-    if (!entry) return null;
-    if (now >= entry.resetAt) return null;
-    return { count: entry.count, resetAt: entry.resetAt };
-  }
-  // eslint-disable-next-line @typescript-eslint/require-await -- interface contract: async return
-  async reset(key) {
-    this.store.delete(key);
-  }
-};
-
-// src/server/rate-limit/rate-limit.ts
-function createRateLimiter(config, opts = {}) {
-  const store = opts.store ?? new InMemoryStore();
-  const isInMemory = store instanceof InMemoryStore;
-  return function checkRateLimit(req) {
-    const key = req.socket?.remoteAddress ?? "unknown";
-    if (isInMemory) {
-      const state = store.incrSync(key, config.windowMs);
-      return resultFromState(state, config);
-    }
-    throw new Error(
-      "createRateLimiter: async RateLimitStore implementations are not supported by this sync fa\xE7ade. Use the InMemoryStore default or build a custom middleware around the async store directly."
-    );
-  };
-}
-function resultFromState(state, config) {
-  if (state.count > config.max) {
-    const retryAfter = Math.ceil((state.resetAt - Date.now()) / 1e3);
-    return {
-      limited: true,
-      headers: {
-        "X-RateLimit-Limit": String(config.max),
-        "X-RateLimit-Remaining": "0",
-        "Retry-After": String(retryAfter)
-      }
-    };
-  }
-  return {
-    limited: false,
-    headers: {
-      "X-RateLimit-Limit": String(config.max),
-      "X-RateLimit-Remaining": String(Math.max(0, config.max - state.count))
-    }
-  };
-}
-
-// src/server/security/csp-report.ts
-var CSP_REPORT_PATH = "/__theo/csp-report";
-var MAX_BODY = 16 * 1024;
-function pickHeader3(value) {
-  if (typeof value === "string") return value;
-  if (Array.isArray(value) && value.length > 0) return value[0];
-  return "";
-}
-function toStringSafe(value, fallback = "(missing)") {
-  if (typeof value === "string") return value;
-  if (typeof value === "number" || typeof value === "boolean") return String(value);
-  return fallback;
-}
-function normalizeLegacy(raw) {
-  return {
-    blockedUrl: toStringSafe(raw["blocked-uri"]),
-    documentUrl: toStringSafe(raw["document-uri"]),
-    violatedDirective: toStringSafe(raw["violated-directive"]),
-    effectiveDirective: typeof raw["effective-directive"] === "string" ? raw["effective-directive"] : void 0,
-    originalPolicy: typeof raw["original-policy"] === "string" ? raw["original-policy"] : void 0,
-    disposition: raw.disposition === "enforce" || raw.disposition === "report" ? raw.disposition : void 0,
-    statusCode: typeof raw["status-code"] === "number" ? raw["status-code"] : void 0,
-    sourceFile: typeof raw["source-file"] === "string" ? raw["source-file"] : void 0,
-    lineNumber: typeof raw["line-number"] === "number" ? raw["line-number"] : void 0,
-    columnNumber: typeof raw["column-number"] === "number" ? raw["column-number"] : void 0
-  };
-}
-function normalizeNew(entry) {
-  if (!entry || typeof entry !== "object") return null;
-  const body = entry.body;
-  if (!body || typeof body !== "object") return null;
-  const b = body;
-  return {
-    blockedUrl: toStringSafe(b.blockedURL),
-    documentUrl: toStringSafe(b.documentURL),
-    violatedDirective: toStringSafe(b.violatedDirective),
-    effectiveDirective: typeof b.effectiveDirective === "string" ? b.effectiveDirective : void 0,
-    originalPolicy: typeof b.originalPolicy === "string" ? b.originalPolicy : void 0,
-    disposition: b.disposition === "enforce" || b.disposition === "report" ? b.disposition : void 0,
-    statusCode: typeof b.statusCode === "number" ? b.statusCode : void 0,
-    sourceFile: typeof b.sourceFile === "string" ? b.sourceFile : void 0,
-    lineNumber: typeof b.lineNumber === "number" ? b.lineNumber : void 0,
-    columnNumber: typeof b.columnNumber === "number" ? b.columnNumber : void 0
-  };
-}
-async function readBody(req, maxBytes) {
-  return await new Promise((resolve2, reject) => {
-    const chunks = [];
-    let total = 0;
-    req.on("data", (chunk) => {
-      total += chunk.length;
-      if (total > maxBytes) {
-        reject(new Error("body too large"));
-        req.destroy();
-        return;
-      }
-      chunks.push(chunk);
-    });
-    req.on("end", () => {
-      resolve2(Buffer.concat(chunks).toString("utf8"));
-    });
-    req.on("error", reject);
-  });
-}
-async function handleCspReport(req, res, opts) {
-  const ctHeader = req.headers["content-type"];
-  const ct = pickHeader3(ctHeader);
-  let raw;
-  try {
-    raw = await readBody(req, MAX_BODY);
-  } catch {
-    res.statusCode = 413;
-    res.end();
-    return;
-  }
-  let violations;
-  try {
-    if (ct.startsWith("application/csp-report")) {
-      const parsed = JSON.parse(raw);
-      const inner = parsed["csp-report"];
-      if (!inner || typeof inner !== "object") {
-        res.statusCode = 204;
-        res.end();
-        return;
-      }
-      violations = [normalizeLegacy(inner)];
-    } else if (ct.startsWith("application/reports+json")) {
-      const parsed = JSON.parse(raw);
-      const entries = Array.isArray(parsed) ? parsed : [];
-      violations = entries.map((e) => normalizeNew(e)).filter((v) => v !== null);
-    } else {
-      res.statusCode = 415;
-      res.end();
-      return;
-    }
-  } catch {
-    res.statusCode = 400;
-    res.end();
-    return;
-  }
-  for (const v of violations) {
-    safeAudit(opts.auditLogger, {
-      action: "csp.violation",
-      metadata: v
-    });
-    try {
-      opts.devtoolsDispatcher?.onCspViolation?.(v);
-    } catch {
-    }
-    try {
-      opts.onViolation?.(v);
-    } catch {
-    }
-  }
-  res.statusCode = 204;
-  res.end();
-}
-
-// src/server/security/csrf-readiness-endpoint.ts
-var CSRF_READINESS_PATH = "/__theo/csrf-readiness";
-var CSRF_READINESS_RESET_PATH = "/__theo/csrf-readiness/reset";
-function originMatchesHost(req) {
-  const origin = req.headers.origin;
-  if (typeof origin !== "string") return false;
-  const host = req.headers.host;
-  if (typeof host !== "string") return false;
-  try {
-    const parsed = new URL(origin);
-    return parsed.host === host;
-  } catch {
-    return false;
-  }
-}
-function sendJson2(res, status, body) {
-  res.writeHead(status, { "content-type": "application/json" });
-  res.end(JSON.stringify(body));
-}
-function sendNoContent(res) {
-  res.writeHead(204);
-  res.end();
-}
-function sendError2(res, status, code, message) {
-  res.writeHead(status, { "content-type": "application/json" });
-  res.end(JSON.stringify({ error: { code, message } }));
-}
-async function handleCsrfReadiness(req, res, store) {
-  const url = (req.url ?? "").split("?")[0];
-  const method = req.method ?? "GET";
-  if (url === CSRF_READINESS_PATH) {
-    if (method === "GET") {
-      sendJson2(res, 200, store.summary());
-      return true;
-    }
-    sendError2(res, 405, "METHOD_NOT_ALLOWED", `Use GET on ${CSRF_READINESS_PATH}`);
-    return true;
-  }
-  if (url === CSRF_READINESS_RESET_PATH) {
-    if (method !== "POST") {
-      sendError2(res, 405, "METHOD_NOT_ALLOWED", `Use POST on ${CSRF_READINESS_RESET_PATH}`);
-      return true;
-    }
-    const hasHeader = req.headers["x-theo-action"] === "1";
-    if (!hasHeader || !originMatchesHost(req)) {
-      sendError2(res, 403, "CSRF_INVALID", "Reset requires X-Theo-Action: 1 + same-origin");
-      return true;
-    }
-    store.reset();
-    sendNoContent(res);
-    return true;
-  }
-  return false;
-}
-
-// src/server/security/security-headers.ts
-var DEFAULT_CSP = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' ws: wss:; frame-ancestors 'none'; report-uri /__theo/csp-report";
-var DEFAULT_PERMISSIONS_POLICY = "geolocation=(), camera=(), microphone=(), payment=(), usb=(), accelerometer=(), gyroscope=()";
-var DEFAULT_HSTS = "max-age=31536000; includeSubDomains";
-function applyNonceToCsp(policy, nonce) {
-  return policy.split(";").map((directive) => {
-    const trimmed = directive.trim();
-    if (!trimmed.startsWith("script-src")) return directive;
-    if (trimmed.includes("'unsafe-inline'")) {
-      return directive.replace("'unsafe-inline'", `'nonce-${nonce}'`);
-    }
-    return `${directive} 'nonce-${nonce}'`;
-  }).join(";");
-}
-function applyCsp(out, config, effectiveNonce) {
-  if (config.csp === false || config.cspMode === "off") return;
-  let policy = typeof config.csp === "string" ? config.csp : DEFAULT_CSP;
-  if (effectiveNonce) {
-    policy = applyNonceToCsp(policy, effectiveNonce);
-  }
-  const mode = config.cspMode ?? "enforce";
-  if (mode === "enforce") {
-    out["Content-Security-Policy"] = policy;
-  } else {
-    out["Content-Security-Policy-Report-Only"] = policy;
-  }
-}
-function buildSecurityHeaders(config, env, options = {}) {
-  const out = {};
-  const effectiveNonce = options.prerender ? void 0 : options.nonce;
-  applyCsp(out, config, effectiveNonce);
-  out["X-Frame-Options"] = config.frameOptions ?? "DENY";
-  out["X-Content-Type-Options"] = config.contentTypeOptions ?? "nosniff";
-  out["Referrer-Policy"] = config.referrerPolicy ?? "strict-origin-when-cross-origin";
-  if (config.permissionsPolicy !== false) {
-    out["Permissions-Policy"] = typeof config.permissionsPolicy === "string" ? config.permissionsPolicy : DEFAULT_PERMISSIONS_POLICY;
-  }
-  if (env.production && config.hsts !== false) {
-    out["Strict-Transport-Security"] = typeof config.hsts === "string" ? config.hsts : DEFAULT_HSTS;
-  }
-  if (effectiveNonce) {
-    out["Cache-Control"] = "private, no-store";
-  }
-  return out;
-}
-function applySecurityHeaders(res, config, env, options = {}) {
-  const headers = buildSecurityHeaders(config, env, options);
-  for (const [key, value] of Object.entries(headers)) {
-    res.setHeader(key, value);
-  }
-}
-
-// src/server/plugins/plugin-runner.ts
-var DuplicatePluginError = class extends Error {
-  constructor(name) {
-    super(`Plugin "${name}" is already registered.`);
-    this.name = "DuplicatePluginError";
-  }
-};
-var DuplicateDecorationError = class extends Error {
-  constructor(key, existingPlugin, newPlugin) {
-    super(
-      `Plugin "${newPlugin}" tried to decorate ctx.${key}, but it is already declared by plugin "${existingPlugin}".`
-    );
-    this.name = "DuplicateDecorationError";
-  }
-};
-var PluginRunner = class {
-  plugins = /* @__PURE__ */ new Set();
-  onRequestHooks = [];
-  preHandlerHooks = [];
-  onResponseHooks = [];
-  onErrorHooks = [];
-  decorations = /* @__PURE__ */ new Map();
-  has(name) {
-    return this.plugins.has(name);
-  }
-  async register(plugin) {
-    if (this.plugins.has(plugin.name)) {
-      throw new DuplicatePluginError(plugin.name);
-    }
-    this.plugins.add(plugin.name);
-    const app = {
-      addHook: (name, fn) => {
-        switch (name) {
-          case "onRequest":
-            this.onRequestHooks.push(fn);
-            return;
-          case "preHandler":
-            this.preHandlerHooks.push(fn);
-            return;
-          case "onResponse":
-            this.onResponseHooks.push(fn);
-            return;
-          case "onError":
-            this.onErrorHooks.push(fn);
-            return;
-        }
-      },
-      // `T` lets call sites bind a stronger value type via the plugin API.
-      // The runtime body stores `value` without inspection, so T appears
-      // only on the parameter — that is the intended contract.
-      // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-parameters -- T documents the per-decoration type for consumers
-      decorateRequest: (key, value) => {
-        const existing = this.decorations.get(key);
-        if (existing) {
-          this.plugins.delete(plugin.name);
-          throw new DuplicateDecorationError(key, existing.pluginName, plugin.name);
-        }
-        this.decorations.set(key, { pluginName: plugin.name, value });
-      }
-    };
-    await plugin.register(app);
-  }
-  applyDecorations(ctx) {
-    for (const [key, entry] of this.decorations.entries()) {
-      ctx[key] = entry.value;
-    }
-  }
-  async runOnRequest(ctx) {
-    return this.runHookList(this.onRequestHooks, ctx);
-  }
-  async runPreHandler(ctx) {
-    return this.runHookList(this.preHandlerHooks, ctx);
-  }
-  async runOnResponse(ctx, options = {}) {
-    return this.runHookList(this.onResponseHooks, ctx, options);
-  }
-  /**
-   * Run all onError hooks. Swallows errors thrown inside hooks themselves to
-   * prevent recursion (an error in an error handler must not trigger onError
-   * again).
-   */
-  async runOnError(ctx, error) {
-    const errorCtx = { ...ctx, error };
-    for (const hook of this.onErrorHooks) {
-      try {
-        await hook(errorCtx);
-      } catch (innerErr) {
-        console.error(
-          `[plugin-runner] onError hook threw; suppressed to avoid recursion:`,
-          innerErr
-        );
-      }
-    }
-    return { shortCircuited: false };
-  }
-  async runHookList(hooks, ctx, options = {}) {
-    for (const hook of hooks) {
-      try {
-        await hook(ctx);
-      } catch (err) {
-        if (options.inErrorPath) {
-          console.error(`[plugin-runner] hook threw during error path; suppressed (EC-9):`, err);
-          continue;
-        }
-        throw err;
-      }
-      if (ctx.response.writableEnded || ctx.response.headersSent) {
-        return { shortCircuited: true };
-      }
-    }
-    return { shortCircuited: false };
-  }
-};
-
-// src/server/plugins/load-plugins.ts
-var InvalidPluginShapeError = class extends Error {
-  constructor(index, reason) {
-    super(`plugins[${index}] is not a valid TheoPlugin: ${reason}`);
-    this.name = "InvalidPluginShapeError";
-  }
-};
-function isPlugin(value, index) {
-  if (value == null || typeof value !== "object") {
-    throw new InvalidPluginShapeError(index, "expected an object");
-  }
-  const v = value;
-  if (typeof v.name !== "string" || v.name.length === 0) {
-    throw new InvalidPluginShapeError(index, 'missing "name" string');
-  }
-  if (typeof v.register !== "function") {
-    throw new InvalidPluginShapeError(index, 'missing "register" function');
-  }
-  return true;
-}
-async function createPluginRunnerFromConfig(plugins) {
-  if (plugins == null) return void 0;
-  if (!Array.isArray(plugins)) return void 0;
-  if (plugins.length === 0) return void 0;
-  const runner = new PluginRunner();
-  const pluginsArray = plugins;
-  for (let i = 0; i < pluginsArray.length; i++) {
-    const candidate = pluginsArray[i];
-    if (!isPlugin(candidate, i)) {
-      continue;
-    }
-    await runner.register(candidate);
-  }
-  return runner;
-}
-
-// src/server/transformer.ts
-import superjson from "superjson";
-var superjsonTransformer = {
-  name: "superjson",
-  serialize: (v) => JSON.stringify(superjson.serialize(v)),
-  deserialize: (raw) => {
-    const parsed = JSON.parse(raw);
-    return superjson.deserialize(parsed);
-  }
-};
-var jsonTransformer = {
-  name: "json",
-  serialize: (v) => JSON.stringify(v),
-  deserialize: (raw) => JSON.parse(raw)
-};
-var BUILT_INS = {
-  superjson: superjsonTransformer,
-  json: jsonTransformer
-};
-function resolveTransformer(selector) {
-  if (typeof selector === "string") {
-    const built = BUILT_INS[selector];
-    if (built === void 0) {
-      throw new Error(
-        `Unknown transformer "${selector}". Built-in options: ${Object.keys(BUILT_INS).join(", ")}.`
-      );
-    }
-    return built;
-  }
-  if (typeof selector !== "object" || typeof selector.serialize !== "function" || typeof selector.deserialize !== "function") {
-    throw new Error(
-      `Custom transformer must have serialize and deserialize functions. Got: ${JSON.stringify(selector)}`
-    );
-  }
-  return selector;
-}
-
-export {
-  _resetEnvCache,
-  loadEnv,
-  CsrfReadinessStore,
-  ActionError,
-  ActionInputError,
-  extractUniversalIssues,
-  isActionError,
-  isInputError,
-  FileTooLargeError,
-  parseRequestBody,
-  logRequest,
-  createLogger,
-  _resetWarnOnceForTests,
-  warnOnce,
-  JsonStdoutSink,
-  createNoOpLogger,
-  safeAudit,
-  matchDisallowed,
-  CSRF_WARN_CODE,
-  CSRF_WARN_DOCS_URL,
-  validateCsrf,
-  enforceCsrf,
-  sendJson,
-  sendError,
-  scanMiddlewares,
-  _resetMiddlewareCacheForTests,
-  runMiddlewareAndContext,
-  executeRoute,
-  executeAction,
-  levenshtein,
-  findSuggestion,
-  createViteLoader,
-  createProductionLoader,
-  STRIPPED_HEADERS,
-  BATCH_PATH,
-  BatchPathConflictError,
-  handleBatchRequest,
-  matchesOrigin,
-  createCorsHandler,
-  TRACE_HEADER,
-  TRACE_PARENT_HEADER,
-  parseTraceparent,
-  extractTraceId,
-  InMemoryStore,
-  createRateLimiter,
-  CSP_REPORT_PATH,
-  normalizeLegacy,
-  normalizeNew,
-  handleCspReport,
-  CSRF_READINESS_PATH,
-  CSRF_READINESS_RESET_PATH,
-  handleCsrfReadiness,
-  DEFAULT_CSP,
-  DEFAULT_PERMISSIONS_POLICY,
-  buildSecurityHeaders,
-  applySecurityHeaders,
-  DuplicatePluginError,
-  DuplicateDecorationError,
-  PluginRunner,
-  InvalidPluginShapeError,
-  createPluginRunnerFromConfig,
-  superjsonTransformer,
-  jsonTransformer,
-  resolveTransformer
-};
-//# sourceMappingURL=chunk-CZM6WWWS.js.map