theokit 0.4.0-beta.0 → 0.5.0

package/dist/chunk-5Z2727GV.js

@@ -0,0 +1,1324 @@
+import {
+  DuplicateContextKeyError,
+  createOutbox,
+  createOutboxDispatcher,
+  createQueueClient
+} from "./chunk-GY5Q27BJ.js";
+import {
+  parseRequestBody,
+  warnOnce
+} from "./chunk-Z5IGLBWE.js";
+import {
+  scanMiddlewares
+} from "./chunk-ZEGYW52B.js";
+import {
+  enforceCsrf
+} from "./chunk-TSLSIRBR.js";
+import {
+  AuthRequiredError
+} from "./chunk-4HBI7DHP.js";
+
+// src/core/contracts/action-protocol.ts
+var CODE_TO_STATUS = {
+  VALIDATION_ERROR: 422,
+  BAD_REQUEST: 400,
+  UNAUTHORIZED: 401,
+  FORBIDDEN: 403,
+  NOT_FOUND: 404,
+  METHOD_NOT_ALLOWED: 405,
+  CONFLICT: 409,
+  CONTENT_TOO_LARGE: 413,
+  PAYLOAD_TOO_LARGE: 413,
+  UNSUPPORTED_MEDIA_TYPE: 415,
+  TOO_MANY_REQUESTS: 429,
+  INTERNAL_SERVER_ERROR: 500
+};
+var STATUS_TO_CODE = {
+  400: "BAD_REQUEST",
+  401: "UNAUTHORIZED",
+  403: "FORBIDDEN",
+  404: "NOT_FOUND",
+  405: "METHOD_NOT_ALLOWED",
+  409: "CONFLICT",
+  413: "PAYLOAD_TOO_LARGE",
+  415: "UNSUPPORTED_MEDIA_TYPE",
+  422: "VALIDATION_ERROR",
+  429: "TOO_MANY_REQUESTS",
+  500: "INTERNAL_SERVER_ERROR"
+};
+var ActionError = class _ActionError extends Error {
+  // Discriminator widened to the full union so subclasses can narrow to their
+  // specific literal (TypeScript would otherwise reject the override). Concrete
+  // values are still always exact literals at runtime.
+  type = "TheoActionError";
+  code;
+  status;
+  constructor(params) {
+    super(params.message ?? params.code);
+    this.code = params.code;
+    this.status = _ActionError.codeToStatus(params.code);
+    if (params.stack) {
+      this.stack = params.stack;
+    }
+  }
+  /**
+   * G5 T2.4 — canonical envelope view of the action error. Maps the G3
+   * ActionErrorCode to a canonical TheoErrorCode (VALIDATION_ERROR ↔
+   * UNPROCESSABLE_ENTITY, CONTENT_TOO_LARGE ↔ PAYLOAD_TOO_LARGE) so consumer
+   * UI / SDK code can switch on the unified envelope.
+   *
+   * Subclasses override to populate `ext` (see `ActionInputError.envelope`).
+   */
+  get envelope() {
+    return {
+      code: _ActionError.toTheoErrorCode(this.code),
+      message: this.message
+    };
+  }
+  /**
+   * Translate G3 ActionErrorCode → canonical TheoErrorCode (blueprint
+   * Recommendations § "G3 ActionError becomes inaugural envelope user").
+   */
+  static toTheoErrorCode(code) {
+    if (code === "VALIDATION_ERROR") return "UNPROCESSABLE_ENTITY";
+    if (code === "CONTENT_TOO_LARGE") return "PAYLOAD_TOO_LARGE";
+    return code;
+  }
+  static codeToStatus(code) {
+    return CODE_TO_STATUS[code];
+  }
+  static statusToCode(status) {
+    return STATUS_TO_CODE[status] ?? "INTERNAL_SERVER_ERROR";
+  }
+  /**
+   * Parse a serialized error JSON back into the typed class hierarchy.
+   * Distinguishes `TheoActionInputError` (with `issues` array) from
+   * `TheoActionError` via the `type` discriminator. Falls back to
+   * `INTERNAL_SERVER_ERROR` for malformed bodies (non-object, missing
+   * `type`, unknown `code`).
+   */
+  static fromJson(body) {
+    if (typeof body !== "object" || body === null) {
+      return new _ActionError({ code: "INTERNAL_SERVER_ERROR" });
+    }
+    const obj = body;
+    if (obj.type === "TheoActionInputError" && Array.isArray(obj.issues)) {
+      return new ActionInputError(obj.issues);
+    }
+    if (obj.type === "TheoActionError" && typeof obj.code === "string" && obj.code in CODE_TO_STATUS) {
+      return new _ActionError({
+        code: obj.code,
+        message: typeof obj.message === "string" ? obj.message : void 0
+      });
+    }
+    return new _ActionError({ code: "INTERNAL_SERVER_ERROR" });
+  }
+};
+var ActionInputError = class extends ActionError {
+  type = "TheoActionInputError";
+  issues;
+  fields;
+  constructor(rawIssues) {
+    super({ code: "VALIDATION_ERROR", message: "Validation failed" });
+    this.issues = extractUniversalIssues(rawIssues);
+    this.fields = buildFieldsMap(this.issues);
+  }
+  /**
+   * G5 T2.4 — envelope view with ValidationFieldsExt populated from .fields.
+   * UI consumers can `switch (env.code)` on `UNPROCESSABLE_ENTITY` and read
+   * `(env.ext as ValidationFieldsExt).fields` for field-level rendering.
+   */
+  get envelope() {
+    return {
+      code: "UNPROCESSABLE_ENTITY",
+      message: this.message,
+      ext: { fields: this.fields }
+    };
+  }
+};
+function buildFieldsMap(issues) {
+  const fields = {};
+  const seen = /* @__PURE__ */ new Set();
+  for (const issue of issues) {
+    const key = issue.path.length === 0 ? "" : issue.path.join(".");
+    const dedupeKey = `${key}\0${issue.message}`;
+    if (seen.has(dedupeKey)) continue;
+    seen.add(dedupeKey);
+    const bucket = fields[key] ?? [];
+    bucket.push(issue.message);
+    fields[key] = bucket;
+  }
+  return fields;
+}
+function extractUniversalIssues(raw) {
+  if (!Array.isArray(raw)) return [];
+  const out = [];
+  for (const entry of raw) {
+    if (typeof entry !== "object" || entry === null) continue;
+    const obj = entry;
+    if (!Array.isArray(obj.path)) continue;
+    if (typeof obj.message !== "string") continue;
+    const path = [];
+    let pathValid = true;
+    for (const seg of obj.path) {
+      if (typeof seg === "string" || typeof seg === "number") {
+        path.push(seg);
+      } else {
+        pathValid = false;
+        break;
+      }
+    }
+    if (!pathValid) continue;
+    out.push({
+      path,
+      message: obj.message,
+      code: typeof obj.code === "string" ? obj.code : void 0
+    });
+  }
+  return out;
+}
+function isActionError(value) {
+  return value instanceof ActionError;
+}
+function isInputError(value) {
+  return value instanceof ActionInputError;
+}
+
+// src/server/http/send-response.ts
+function sendJson(res, data, status = 200, transformer) {
+  const body = transformer ? transformer.serialize(data) : JSON.stringify(data);
+  res.writeHead(status, {
+    "Content-Type": "application/json",
+    "Content-Length": Buffer.byteLength(body)
+  });
+  res.end(body);
+}
+function sendError(res, codeOrInput, message, status, issues, requestId, options) {
+  let code;
+  if (typeof codeOrInput === "string") {
+    code = codeOrInput;
+    message = message ?? "";
+    status = status ?? 500;
+  } else {
+    code = codeOrInput.code;
+    message = codeOrInput.message;
+    status = codeOrInput.status;
+    issues = codeOrInput.issues;
+    requestId = codeOrInput.requestId;
+    options = codeOrInput.options;
+  }
+  const errorMessage = code === "INTERNAL_ERROR" && process.env.NODE_ENV === "production" ? "Internal server error" : message;
+  if (code === "INTERNAL_ERROR") {
+    console.error(`[${requestId ?? "no-id"}] ${message}`);
+  }
+  if (status === 404 && options?.custom404Html) {
+    const body = options.custom404Html;
+    res.writeHead(404, {
+      "Content-Type": "text/html; charset=utf-8",
+      "Content-Length": Buffer.byteLength(body)
+    });
+    res.end(body);
+    return;
+  }
+  if (status === 500 && options?.custom500Html) {
+    const body = options.custom500Html;
+    res.writeHead(500, {
+      "Content-Type": "text/html; charset=utf-8",
+      "Content-Length": Buffer.byteLength(body)
+    });
+    res.end(body);
+    return;
+  }
+  sendJson(
+    res,
+    {
+      error: {
+        code,
+        message: errorMessage,
+        ...requestId ? { requestId } : {},
+        ...issues ? { issues } : {}
+      }
+    },
+    status
+  );
+}
+
+// src/server/http/middleware-runner.ts
+import { existsSync } from "fs";
+import { join } from "path";
+var middlewareCache = /* @__PURE__ */ new Map();
+function _resetMiddlewareCacheForTests() {
+  middlewareCache.clear();
+}
+function getCachedScan(serverDir) {
+  let cached = middlewareCache.get(serverDir);
+  if (!cached) {
+    const singleFilePath = join(serverDir, "middleware.ts");
+    cached = {
+      singleFilePath,
+      singleFileExists: existsSync(singleFilePath),
+      dirMiddlewares: scanMiddlewares(serverDir)
+    };
+    middlewareCache.set(serverDir, cached);
+  }
+  return cached;
+}
+async function runOneMiddleware(mw, req, res) {
+  const state = { nextCalled: false };
+  await mw(req, res, () => {
+    state.nextCalled = true;
+  });
+  return state;
+}
+async function runMiddlewareAndContext(req, res, loadModule, serverDir) {
+  const { singleFilePath, singleFileExists, dirMiddlewares } = getCachedScan(serverDir);
+  const dirExists = dirMiddlewares.length > 0;
+  if (singleFileExists && dirExists) {
+    throw new Error(
+      "Ambiguous middleware configuration: found both server/middleware.ts and server/middleware/ directory. Use one or the other, not both."
+    );
+  }
+  if (dirExists) {
+    for (const mwPath of dirMiddlewares) {
+      const mod = await loadModule(mwPath);
+      const mw = mod.default;
+      if (typeof mw !== "function") continue;
+      const { nextCalled } = await runOneMiddleware(mw, req, res);
+      if (!nextCalled || res.writableEnded) {
+        return { ctx: {}, aborted: true };
+      }
+    }
+  }
+  if (singleFileExists) {
+    const mod = await loadModule(singleFilePath);
+    const mw = mod.default;
+    if (typeof mw === "function") {
+      const { nextCalled } = await runOneMiddleware(mw, req, res);
+      if (!nextCalled || res.writableEnded) {
+        return { ctx: {}, aborted: true };
+      }
+    }
+  }
+  let ctx = {};
+  const contextPath = join(serverDir, "context.ts");
+  if (existsSync(contextPath)) {
+    const mod = await loadModule(contextPath);
+    const createContext = mod.createContext;
+    if (typeof createContext === "function") {
+      ctx = await createContext({ request: req, response: res });
+    }
+  }
+  return { ctx, aborted: false };
+}
+
+// src/server/security/csrf-warn-dispatch.ts
+function dispatchCsrfWarn(payload) {
+  const key = `${payload.event}:${payload.method}:${payload.path ?? ""}`;
+  warnOnce(key, payload);
+}
+
+// src/server/http/execute-stages.ts
+async function parseQueryAndBody(req, res, requestId) {
+  const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+  const query = Object.fromEntries(url.searchParams);
+  let body;
+  try {
+    const parsed = await parseRequestBody(req);
+    if (parsed.json !== void 0) {
+      body = parsed.json;
+    } else if (parsed.files.length > 0 || Object.keys(parsed.fields).length > 0) {
+      body = { ...parsed.fields, _files: parsed.files };
+    } else {
+      body = void 0;
+    }
+  } catch (err) {
+    const message = err.message;
+    const status = message.includes("Unsupported Content-Type") ? 415 : 400;
+    sendError(res, "VALIDATION_ERROR", message, status, void 0, requestId);
+    return { ok: false };
+  }
+  return { ok: true, data: { query, body } };
+}
+var isZodLike = (value) => typeof value === "object" && value !== null && typeof value.safeParse === "function";
+function runZodValidation(routeConfig, res, requestId, input) {
+  const { query, params } = input;
+  let { body } = input;
+  if (isZodLike(routeConfig.query)) {
+    const result = routeConfig.query.safeParse(query);
+    if (!result.success) {
+      sendError(
+        res,
+        "VALIDATION_ERROR",
+        "Invalid query parameters",
+        400,
+        result.error?.issues,
+        requestId
+      );
+      return { ok: false };
+    }
+    Object.assign(query, result.data);
+  }
+  if (isZodLike(routeConfig.body)) {
+    const result = routeConfig.body.safeParse(body);
+    if (!result.success) {
+      sendError(
+        res,
+        "VALIDATION_ERROR",
+        "Invalid request body",
+        400,
+        result.error?.issues,
+        requestId
+      );
+      return { ok: false };
+    }
+    body = result.data;
+  }
+  if (isZodLike(routeConfig.params)) {
+    const result = routeConfig.params.safeParse(params);
+    if (!result.success) {
+      sendError(
+        res,
+        "VALIDATION_ERROR",
+        "Invalid route parameters",
+        400,
+        result.error?.issues,
+        requestId
+      );
+      return { ok: false };
+    }
+    Object.assign(params, result.data);
+  }
+  return { ok: true, data: { query, body, params } };
+}
+
+// src/server/http/execute.ts
+var CSRF_PROTECTED_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+async function pipeWebStreamToResponse(body, res, ctx) {
+  const reader = body.getReader();
+  try {
+    let done = false;
+    while (!done) {
+      const chunk = await reader.read();
+      done = chunk.done;
+      if (!done) res.write(chunk.value);
+    }
+  } catch (streamErr) {
+    warnOnce(`stream-error:${ctx.routePath}:${ctx.method}`, {
+      event: "stream.error",
+      requestId: ctx.requestId ?? "no-id",
+      route: ctx.routePath,
+      method: ctx.method,
+      message: streamErr instanceof Error ? streamErr.message : String(streamErr)
+    });
+    if (ctx.pluginRunner) {
+      try {
+        await ctx.pluginRunner.runOnError(ctx.buildPluginCtx(ctx.ctx), streamErr);
+      } catch {
+      }
+    }
+  } finally {
+    try {
+      reader.releaseLock();
+    } catch {
+    }
+  }
+}
+async function executeRoute(ctx) {
+  const {
+    route,
+    method,
+    params,
+    req,
+    res,
+    loadModule,
+    serverDir,
+    requestId,
+    pluginRunner,
+    transformer,
+    csrfMode = "strict",
+    disallowed,
+    jobBackend
+  } = ctx;
+  const buildPluginCtx = (ctxObj) => ({
+    request: req,
+    response: res,
+    ctx: ctxObj,
+    requestId: requestId ?? "no-id"
+  });
+  if (transformer && transformer.name !== "json") {
+    res.setHeader("x-theo-transformer", transformer.name);
+  }
+  try {
+    let ctx2 = {};
+    if (pluginRunner) {
+      pluginRunner.applyDecorations(ctx2);
+      const onReqResult = await pluginRunner.runOnRequest(buildPluginCtx(ctx2));
+      if (onReqResult.shortCircuited) return;
+    }
+    if (serverDir) {
+      const result = await runMiddlewareAndContext(req, res, loadModule, serverDir);
+      if (result.aborted) return;
+      ctx2 = result.ctx ?? {};
+      if (pluginRunner) pluginRunner.applyDecorations(ctx2);
+    }
+    if (jobBackend) {
+      if (ctx2.queue !== void 0) {
+        throw new DuplicateContextKeyError("queue", {
+          reason: "A plugin or middleware already decorated ctx.queue; choose a different key OR remove jobs.backend from theo.config.ts."
+        });
+      }
+      const outbox = createOutbox();
+      const queueClient = createQueueClient(jobBackend, outbox);
+      ctx2.queue = queueClient;
+      res.on("close", () => {
+        if (!res.writableFinished) outbox.discard();
+      });
+      res.on("finish", () => {
+        if (res.statusCode >= 400) {
+          outbox.discard();
+          return;
+        }
+        void outbox.flush(createOutboxDispatcher(jobBackend));
+      });
+    }
+    const mod = await loadModule(route.filePath);
+    const routeConfig = mod[method];
+    if (!routeConfig) {
+      sendError(
+        res,
+        "METHOD_NOT_ALLOWED",
+        `Method ${method} not allowed`,
+        405,
+        void 0,
+        requestId
+      );
+      return;
+    }
+    const handler = typeof routeConfig === "function" ? routeConfig : routeConfig.handler;
+    if (typeof handler !== "function") {
+      sendError(res, "INTERNAL_ERROR", "Route handler is not a function", 500, void 0, requestId);
+      return;
+    }
+    const routeOptOut = typeof routeConfig === "object" && routeConfig.csrf === false;
+    if (CSRF_PROTECTED_METHODS.has(method) && !routeOptOut) {
+      const decision = enforceCsrf(
+        req,
+        csrfMode,
+        {
+          // T3.3 DRY — see security/csrf-warn-dispatch.ts
+          warn: dispatchCsrfWarn,
+          path: req.url
+        },
+        disallowed
+      );
+      if (!decision.allow) {
+        sendError(
+          res,
+          "CSRF_INVALID",
+          decision.reason ?? "CSRF check failed",
+          403,
+          void 0,
+          requestId
+        );
+        return;
+      }
+    }
+    const rc = routeConfig;
+    const parseResult = await parseQueryAndBody(req, res, requestId);
+    if (!parseResult.ok) return;
+    const { query } = parseResult.data;
+    let { body } = parseResult.data;
+    const validationResult = runZodValidation(rc, res, requestId, { query, body, params });
+    if (!validationResult.ok) return;
+    body = validationResult.data.body;
+    if (pluginRunner) {
+      const preResult = await pluginRunner.runPreHandler(buildPluginCtx(ctx2));
+      if (preResult.shortCircuited) return;
+    }
+    const callableHandler = handler;
+    const handlerResult = await callableHandler({ query, body, params, request: req, ctx: ctx2 });
+    if (handlerResult === void 0 || handlerResult === null) {
+      sendJson(res, null, rc.status ?? 204, transformer);
+      if (pluginRunner) await pluginRunner.runOnResponse(buildPluginCtx(ctx2));
+      return;
+    }
+    if (handlerResult instanceof Response) {
+      const headersBag = {};
+      for (const [k, v] of handlerResult.headers) {
+        if (k.toLowerCase() !== "set-cookie") headersBag[k] = v;
+      }
+      const setCookies = handlerResult.headers.getSetCookie();
+      if (setCookies.length > 0) {
+        res.setHeader("Set-Cookie", setCookies);
+      }
+      res.writeHead(handlerResult.status, headersBag);
+      if (handlerResult.body) {
+        await pipeWebStreamToResponse(handlerResult.body, res, {
+          buildPluginCtx,
+          ctx: ctx2,
+          method,
+          pluginRunner,
+          requestId,
+          routePath: route.routePath
+        });
+      }
+      res.end();
+      if (pluginRunner) await pluginRunner.runOnResponse(buildPluginCtx(ctx2));
+      return;
+    }
+    sendJson(res, handlerResult, rc.status ?? 200, transformer);
+    if (pluginRunner) await pluginRunner.runOnResponse(buildPluginCtx(ctx2));
+  } catch (err) {
+    if (pluginRunner) {
+      const errCtxObj = {};
+      pluginRunner.applyDecorations(errCtxObj);
+      await pluginRunner.runOnError(buildPluginCtx(errCtxObj), err);
+      if (res.writableEnded) {
+        await pluginRunner.runOnResponse(buildPluginCtx(errCtxObj), { inErrorPath: true });
+        return;
+      }
+    }
+    const isAuthError = err instanceof AuthRequiredError || err !== null && typeof err === "object" && err.code === "AUTH_REQUIRED" && err.status === 401;
+    if (isAuthError) {
+      const authErr = err;
+      sendError(res, authErr.code, authErr.message, authErr.status, void 0, requestId);
+      if (pluginRunner) {
+        const errCtxObj = {};
+        pluginRunner.applyDecorations(errCtxObj);
+        await pluginRunner.runOnResponse(buildPluginCtx(errCtxObj), { inErrorPath: true });
+      }
+      return;
+    }
+    sendError(
+      res,
+      "INTERNAL_ERROR",
+      err instanceof Error && err.message ? err.message : "Internal server error",
+      500,
+      void 0,
+      requestId
+    );
+    if (pluginRunner) {
+      const errCtxObj = {};
+      pluginRunner.applyDecorations(errCtxObj);
+      await pluginRunner.runOnResponse(buildPluginCtx(errCtxObj), { inErrorPath: true });
+    }
+  }
+}
+
+// src/server/http/form-data-to-object.ts
+import { z } from "zod";
+function formDataToObject(formData, schema, prefix = "") {
+  const shape = schema._def.shape();
+  const out = {};
+  for (const [key, rawValidator] of Object.entries(shape)) {
+    const fullKey = prefix + key;
+    const validator = unwrapWrappers(rawValidator);
+    if (validator instanceof z.ZodObject) {
+      const nestedPrefix = `${fullKey}.`;
+      const hasNestedKeys = [...formData.keys()].some((k) => k.startsWith(nestedPrefix));
+      if (hasNestedKeys) {
+        out[key] = formDataToObject(formData, validator, nestedPrefix);
+        continue;
+      }
+      out[key] = unwrapMissingDefault(rawValidator);
+      continue;
+    }
+    if (validator instanceof z.ZodArray) {
+      const values = formData.getAll(fullKey);
+      out[key] = coerceArrayElements(values, validator);
+      continue;
+    }
+    if (validator instanceof z.ZodBoolean) {
+      out[key] = coerceBoolean(formData, fullKey);
+      continue;
+    }
+    if (formData.has(fullKey)) {
+      const raw = formData.get(fullKey);
+      out[key] = coerceScalar(raw, validator);
+    } else {
+      out[key] = unwrapMissingDefault(rawValidator);
+    }
+  }
+  return out;
+}
+function unwrapWrappers(validator) {
+  let inner = validator;
+  while (inner instanceof z.ZodOptional || inner instanceof z.ZodNullable || inner instanceof z.ZodDefault) {
+    inner = inner._def.innerType;
+  }
+  return inner;
+}
+function unwrapMissingDefault(validator) {
+  let cursor = validator;
+  while (cursor instanceof z.ZodOptional || cursor instanceof z.ZodNullable || cursor instanceof z.ZodDefault) {
+    if (cursor instanceof z.ZodDefault) {
+      const def = cursor._def.defaultValue;
+      return typeof def === "function" ? def() : def;
+    }
+    if (cursor instanceof z.ZodNullable) return null;
+    cursor = cursor._def.innerType;
+  }
+  return void 0;
+}
+function coerceScalar(raw, validator) {
+  if (raw === null) return void 0;
+  if (validator instanceof z.ZodNumber) {
+    return typeof raw === "string" ? Number(raw) : raw;
+  }
+  return raw;
+}
+function coerceArrayElements(values, arrayValidator) {
+  const elementType = unwrapWrappers(arrayValidator._def.type);
+  if (elementType instanceof z.ZodNumber) {
+    return values.map((v) => typeof v === "string" ? Number(v) : v);
+  }
+  if (elementType instanceof z.ZodBoolean) {
+    return values.map((v) => {
+      if (v === "true") return true;
+      if (v === "false") return false;
+      return Boolean(v);
+    });
+  }
+  return values;
+}
+function coerceBoolean(formData, key) {
+  if (!formData.has(key)) return void 0;
+  const val = formData.get(key);
+  if (val === "true") return true;
+  if (val === "false") return false;
+  return Boolean(val);
+}
+
+// src/server/http/handle-request-error.ts
+async function handleRequestError(err, c) {
+  if (c.pluginRunner) {
+    const errCtxObj = {};
+    c.pluginRunner.applyDecorations(errCtxObj);
+    try {
+      await c.pluginRunner.runOnError(c.buildPluginCtx(errCtxObj), err);
+    } catch {
+    }
+    if (c.res.writableEnded) {
+      try {
+        await c.pluginRunner.runOnResponse(c.buildPluginCtx(errCtxObj), {
+          inErrorPath: true
+        });
+      } catch {
+      }
+      return;
+    }
+  }
+  const isAuthError = err instanceof AuthRequiredError || err !== null && typeof err === "object" && err.code === "AUTH_REQUIRED" && err.status === 401;
+  if (isAuthError) {
+    const authErr = err;
+    sendError(c.res, authErr.code, authErr.message, authErr.status, void 0, c.requestId);
+  } else {
+    sendError(
+      c.res,
+      "INTERNAL_ERROR",
+      err instanceof Error ? err.message : "Internal server error",
+      500,
+      void 0,
+      c.requestId
+    );
+  }
+  if (c.pluginRunner) {
+    const errCtxObj = {};
+    c.pluginRunner.applyDecorations(errCtxObj);
+    try {
+      await c.pluginRunner.runOnResponse(c.buildPluginCtx(errCtxObj), {
+        inErrorPath: true
+      });
+    } catch {
+    }
+  }
+}
+
+// src/server/http/serialize-action-result.ts
+import { stringify as devalueStringify } from "devalue";
+var DEFAULT_RESPONSE_BODY_SIZE_LIMIT = 5 * 1024 * 1024;
+function serializeActionResult(result, options = {}) {
+  const limit = options.responseBodySizeLimit ?? DEFAULT_RESPONSE_BODY_SIZE_LIMIT;
+  if (result.error !== void 0) {
+    const body2 = result.error instanceof ActionInputError ? JSON.stringify({
+      type: result.error.type,
+      code: result.error.code,
+      message: result.error.message,
+      issues: result.error.issues,
+      fields: result.error.fields
+    }) : JSON.stringify({
+      type: result.error.type,
+      code: result.error.code,
+      message: result.error.message
+    });
+    if (Buffer.byteLength(body2, "utf8") > limit) {
+      throw new ActionError({
+        code: "PAYLOAD_TOO_LARGE",
+        message: `Serialized error body exceeds limit (${limit} bytes)`
+      });
+    }
+    return {
+      type: "error",
+      status: result.error.status,
+      contentType: "application/json",
+      body: body2
+    };
+  }
+  if (result.data === void 0) {
+    return { type: "empty", status: 204 };
+  }
+  if (result.data instanceof Response) {
+    throw new ActionError({
+      code: "INTERNAL_SERVER_ERROR",
+      message: "Action handler cannot serialize Response objects \u2014 return plain data instead"
+    });
+  }
+  let body;
+  try {
+    body = devalueStringify(result.data, {
+      URL: (value) => value instanceof URL && value.href
+    });
+  } catch (e) {
+    throw new ActionError({
+      code: "INTERNAL_SERVER_ERROR",
+      message: `Action data not serializable: ${e instanceof Error ? e.message : String(e)}`
+    });
+  }
+  if (Buffer.byteLength(body, "utf8") > limit) {
+    throw new ActionError({
+      code: "PAYLOAD_TOO_LARGE",
+      message: `Serialized response body exceeds limit (${limit} bytes)`
+    });
+  }
+  return {
+    type: "data",
+    status: 200,
+    contentType: "application/json+devalue",
+    body
+  };
+}
+
+// src/server/http/action-execute.ts
+var __IS_DEV = (() => {
+  try {
+    return import.meta.env?.DEV === true;
+  } catch {
+    return process.env.NODE_ENV !== "production";
+  }
+})();
+function isActionConfig(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const candidate = value;
+  if (typeof candidate.handler !== "function") return false;
+  const input = candidate.input;
+  return typeof input?.safeParse === "function";
+}
+async function executeAction(filePath, exportName, req, res, loadModule, serverDir, requestId, pluginRunner, csrfMode = "strict", disallowed) {
+  return executeActionWithOptions({
+    filePath,
+    exportName,
+    req,
+    res,
+    loadModule,
+    serverDir,
+    requestId,
+    pluginRunner,
+    csrfMode,
+    disallowed
+  });
+}
+async function loadActionConfig(loadModule, filePath, exportName, res, requestId) {
+  const mod = await loadModule(filePath);
+  const exportedValue = mod[exportName];
+  if (!isActionConfig(exportedValue)) {
+    sendError(res, "NOT_FOUND", `Action "${exportName}" not found`, 404, void 0, requestId);
+    return null;
+  }
+  return exportedValue;
+}
+function enforceCsrfForAction(req, res, ctx) {
+  if (ctx.actionConfig.csrf === false) return true;
+  const decision = enforceCsrf(
+    req,
+    ctx.csrfMode,
+    {
+      // T3.3 DRY — canonical dispatcher
+      warn: dispatchCsrfWarn,
+      path: req.url
+    },
+    ctx.disallowed
+  );
+  if (decision.allow) return true;
+  sendError(
+    res,
+    "CSRF_INVALID",
+    decision.reason ?? "CSRF check failed",
+    403,
+    void 0,
+    ctx.requestId
+  );
+  return false;
+}
+async function runPreHandlerPipeline(p) {
+  if (p.serverDir) {
+    const result = await runMiddlewareAndContext(p.req, p.res, p.loadModule, p.serverDir);
+    if (result.aborted) return false;
+    Object.assign(p.ctx, result.ctx ?? {});
+    p.pluginRunner?.applyDecorations(p.ctx);
+  }
+  if (p.pluginRunner) {
+    const preResult = await p.pluginRunner.runPreHandler(p.buildPluginCtx(p.ctx));
+    if (preResult.shortCircuited) return false;
+  }
+  return true;
+}
+async function readActionBody(req, res, requestId, actionConfig) {
+  try {
+    const parsed = await parseRequestBody(req);
+    const accept = actionConfig.accept ?? "json";
+    let body;
+    if (accept === "form") {
+      body = formDataToObject(
+        synthesizeFormData(parsed),
+        actionConfig.input
+      );
+    } else if (parsed.json !== void 0) {
+      body = parsed.json;
+    } else {
+      body = parsed.fields;
+    }
+    return { ok: true, body };
+  } catch (err) {
+    sendError(res, "VALIDATION_ERROR", err.message, 400, void 0, requestId);
+    return { ok: false };
+  }
+}
+function synthesizeFormData(parsed) {
+  const fd = new FormData();
+  for (const [name, value] of Object.entries(parsed.fields)) {
+    fd.append(name, value);
+  }
+  for (const file of parsed.files) {
+    const blob = new Blob([file.buffer], {
+      type: file.mimeType
+    });
+    fd.append(file.fieldname, blob, file.filename);
+  }
+  return fd;
+}
+function writeSerialized(res, serialized) {
+  if (serialized.type === "empty") {
+    res.statusCode = serialized.status;
+    res.end();
+    return;
+  }
+  res.statusCode = serialized.status;
+  res.setHeader("Content-Type", serialized.contentType);
+  res.end(serialized.body);
+}
+async function emitActionCallTelemetry(name, startedAt, input, outcome) {
+  if (!__IS_DEV) return;
+  try {
+    const mod = await import("./dispatcher-63LBXYLE.js");
+    mod.dispatcher.onActionCall({
+      // eslint-disable-next-line sonarjs/pseudo-random -- non-secret correlation id
+      id: `act-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`,
+      timestamp: startedAt,
+      name,
+      input,
+      output: outcome.status === "success" ? outcome.output : void 0,
+      error: outcome.status === "error" ? {
+        code: outcome.error.code,
+        message: outcome.error.message,
+        fields: outcome.error instanceof ActionInputError ? outcome.error.fields : void 0
+      } : void 0,
+      durationMs: Date.now() - startedAt,
+      status: outcome.status
+    });
+  } catch {
+  }
+}
+async function executeActionWithOptions(opts) {
+  const {
+    filePath,
+    exportName,
+    req,
+    res,
+    loadModule,
+    serverDir,
+    requestId,
+    pluginRunner,
+    csrfMode = "strict",
+    disallowed
+  } = opts;
+  const buildPluginCtx = (ctxObj) => ({
+    request: req,
+    response: res,
+    ctx: ctxObj,
+    requestId: requestId ?? "no-id"
+  });
+  let ctx = {};
+  try {
+    if ((req.method ?? "GET").toUpperCase() !== "POST") {
+      sendError(res, "METHOD_NOT_ALLOWED", "Actions only accept POST", 405, void 0, requestId);
+      return;
+    }
+    if (pluginRunner) {
+      pluginRunner.applyDecorations(ctx);
+      const onReqResult = await pluginRunner.runOnRequest(buildPluginCtx(ctx));
+      if (onReqResult.shortCircuited) return;
+    }
+    const actionConfig = await loadActionConfig(loadModule, filePath, exportName, res, requestId);
+    if (!actionConfig) return;
+    if (!enforceCsrfForAction(req, res, { actionConfig, csrfMode, disallowed, requestId })) {
+      return;
+    }
+    const pipeline = {
+      ctx,
+      buildPluginCtx,
+      pluginRunner,
+      serverDir,
+      loadModule,
+      req,
+      res
+    };
+    if (!await runPreHandlerPipeline(pipeline)) return;
+    ctx = pipeline.ctx;
+    const bodyOutcome = await readActionBody(req, res, requestId, actionConfig);
+    if (!bodyOutcome.ok) return;
+    const actionName = exportName === "default" ? deriveActionNameFromPath(filePath) : exportName;
+    const startedAt = Date.now();
+    const result = actionConfig.input.safeParse(bodyOutcome.body);
+    if (!result.success) {
+      const inputErr = new ActionInputError(result.error?.issues ?? []);
+      writeSerialized(res, serializeActionResult({ data: void 0, error: inputErr }));
+      await emitActionCallTelemetry(actionName, startedAt, bodyOutcome.body, {
+        status: "error",
+        error: inputErr
+      });
+      return;
+    }
+    await runActionHandler({
+      actionConfig,
+      actionName,
+      startedAt,
+      input: result.data,
+      ctx,
+      res,
+      pluginRunner,
+      buildPluginCtx
+    });
+  } catch (err) {
+    await handleActionError(err, { req, res, ctx, requestId, pluginRunner, buildPluginCtx });
+  }
+}
+function deriveActionNameFromPath(filePath) {
+  const base = filePath.split(/[\\/]/).pop() ?? "unknown";
+  return base.replace(/\.[jt]sx?$/, "");
+}
+function isActionErrorLike(err) {
+  if (err === null || typeof err !== "object") return false;
+  const obj = err;
+  return (obj.type === "TheoActionError" || obj.type === "TheoActionInputError") && typeof obj.code === "string" && typeof obj.status === "number";
+}
+async function runActionHandler(args) {
+  try {
+    const handlerResult = await args.actionConfig.handler({ input: args.input, ctx: args.ctx });
+    writeSerialized(args.res, serializeActionResult({ data: handlerResult, error: void 0 }));
+    if (args.pluginRunner) {
+      await args.pluginRunner.runOnResponse(args.buildPluginCtx(args.ctx));
+    }
+    await emitActionCallTelemetry(args.actionName, args.startedAt, args.input, {
+      status: "success",
+      output: handlerResult
+    });
+  } catch (err) {
+    if (isActionErrorLike(err)) {
+      writeSerialized(args.res, serializeActionResult({ data: void 0, error: err }));
+      await emitActionCallTelemetry(args.actionName, args.startedAt, args.input, {
+        status: "error",
+        error: err
+      });
+      return;
+    }
+    const wrapped = new ActionError({
+      code: "INTERNAL_SERVER_ERROR",
+      message: err instanceof Error ? err.message : "Action handler threw"
+    });
+    await emitActionCallTelemetry(args.actionName, args.startedAt, args.input, {
+      status: "error",
+      error: wrapped
+    });
+    throw err;
+  }
+}
+async function handleActionError(err, c) {
+  return handleRequestError(err, {
+    req: c.req,
+    res: c.res,
+    requestId: c.requestId,
+    pluginRunner: c.pluginRunner,
+    buildPluginCtx: c.buildPluginCtx
+  });
+}
+
+// src/server/http/batch-handler.ts
+import { z as z2 } from "zod";
+var STRIPPED_HEADERS = [
+  "authorization",
+  "cookie",
+  "x-forwarded-for",
+  "x-forwarded-host",
+  "x-forwarded-proto",
+  "x-real-ip",
+  "host"
+];
+var BATCH_PATH = "/api/__theo_batch__";
+var DEFAULT_MAX_BATCH = 32;
+var BatchPathConflictError = class extends Error {
+  constructor(path) {
+    super(
+      `Server route conflicts with reserved batch path ${path}. Rename the route or disable batching in theo.config.ts.`
+    );
+    this.name = "BatchPathConflictError";
+  }
+};
+var batchRequestSchema = z2.object({
+  path: z2.string().min(1),
+  method: z2.string().min(1),
+  query: z2.record(z2.string(), z2.unknown()).optional(),
+  body: z2.unknown().optional(),
+  headers: z2.record(z2.string(), z2.string()).optional()
+});
+var batchPayloadSchema = z2.object({
+  requests: z2.array(batchRequestSchema).min(1)
+});
+function sanitizeItemHeaders(itemHeaders, outerHeaders) {
+  const out = {};
+  if (itemHeaders) {
+    for (const [k, v] of Object.entries(itemHeaders)) {
+      const lower = k.toLowerCase();
+      if (!STRIPPED_HEADERS.includes(lower)) {
+        out[lower] = v;
+      }
+    }
+  }
+  if (outerHeaders) {
+    for (const stripped of STRIPPED_HEADERS) {
+      if (Object.hasOwn(outerHeaders, stripped)) {
+        out[stripped] = outerHeaders[stripped];
+      }
+    }
+  }
+  return out;
+}
+async function handleBatchRequest(payload, options) {
+  const parsed = batchPayloadSchema.parse(payload);
+  const max = options.max ?? DEFAULT_MAX_BATCH;
+  if (parsed.requests.length > max) {
+    throw new Error(`Batch size ${parsed.requests.length} exceeds max ${max}`);
+  }
+  const results = [];
+  for (const item of parsed.requests) {
+    const sanitized = {
+      ...item,
+      headers: sanitizeItemHeaders(item.headers, options.outerHeaders)
+    };
+    try {
+      const r = await options.execute(sanitized);
+      results.push(r);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      results.push({ error: { message } });
+    }
+  }
+  return { results };
+}
+
+// src/server/http/cors.ts
+var DEFAULT_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"];
+var DEFAULT_ALLOWED_HEADERS = ["Content-Type", "X-Theo-Action", "Authorization"];
+var DEFAULT_MAX_AGE = 600;
+function readOrigin(req) {
+  const raw = req.headers.origin;
+  if (raw === void 0) return void 0;
+  if (Array.isArray(raw)) {
+    return raw.find((v) => typeof v === "string" && v.length > 0);
+  }
+  return raw;
+}
+function matchesOrigin(origin, allowed) {
+  if (allowed === "*") return true;
+  if (typeof allowed === "string") return origin === allowed;
+  if (allowed instanceof RegExp) {
+    allowed.lastIndex = 0;
+    return allowed.test(origin);
+  }
+  if (Array.isArray(allowed)) {
+    for (const entry of allowed) {
+      if (typeof entry === "string" && origin === entry) return true;
+      if (entry instanceof RegExp) {
+        entry.lastIndex = 0;
+        if (entry.test(origin)) return true;
+      }
+    }
+    return false;
+  }
+  if (typeof allowed === "function") {
+    try {
+      return allowed(origin);
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+function createCorsHandler(config) {
+  const methods = (config.methods ?? DEFAULT_METHODS).slice();
+  const allowedHeaders = (config.allowedHeaders ?? DEFAULT_ALLOWED_HEADERS).slice();
+  const maxAge = String(config.maxAge ?? DEFAULT_MAX_AGE);
+  const credentials = config.credentials === true;
+  return {
+    handlePreflight(req, res) {
+      if (req.method !== "OPTIONS") return false;
+      const acMethod = req.headers["access-control-request-method"];
+      if (!acMethod) return false;
+      const origin = readOrigin(req);
+      if (!origin) return false;
+      if (!matchesOrigin(origin, config.origins)) {
+        res.statusCode = 403;
+        res.end();
+        return true;
+      }
+      res.setHeader("Access-Control-Allow-Origin", origin);
+      res.setHeader("Access-Control-Allow-Methods", methods.join(", "));
+      res.setHeader("Access-Control-Allow-Headers", allowedHeaders.join(", "));
+      res.setHeader("Access-Control-Max-Age", maxAge);
+      res.setHeader("Vary", "Origin");
+      if (credentials) res.setHeader("Access-Control-Allow-Credentials", "true");
+      res.statusCode = 204;
+      res.end();
+      return true;
+    },
+    applyHeaders(req, res) {
+      const origin = readOrigin(req);
+      if (!origin) return;
+      if (!matchesOrigin(origin, config.origins)) return;
+      res.setHeader("Access-Control-Allow-Origin", origin);
+      res.setHeader("Vary", "Origin");
+      if (credentials) res.setHeader("Access-Control-Allow-Credentials", "true");
+      if (config.exposedHeaders && config.exposedHeaders.length > 0) {
+        res.setHeader("Access-Control-Expose-Headers", config.exposedHeaders.join(", "));
+      }
+    }
+  };
+}
+function createCorsWebHandler(config) {
+  const methods = (config.methods ?? DEFAULT_METHODS).slice();
+  const allowedHeaders = (config.allowedHeaders ?? DEFAULT_ALLOWED_HEADERS).slice();
+  const maxAge = String(config.maxAge ?? DEFAULT_MAX_AGE);
+  const credentials = config.credentials === true;
+  return {
+    handlePreflightRequest(request) {
+      if (request.method !== "OPTIONS") return null;
+      const acMethod = request.headers.get("access-control-request-method");
+      if (acMethod === null || acMethod.length === 0) return null;
+      const origin = request.headers.get("origin");
+      if (origin === null || origin.length === 0) return null;
+      if (!matchesOrigin(origin, config.origins)) {
+        return new Response(null, { status: 403 });
+      }
+      const headers = new Headers({
+        "Access-Control-Allow-Origin": origin,
+        "Access-Control-Allow-Methods": methods.join(", "),
+        "Access-Control-Allow-Headers": allowedHeaders.join(", "),
+        "Access-Control-Max-Age": maxAge,
+        Vary: "Origin"
+      });
+      if (credentials) headers.set("Access-Control-Allow-Credentials", "true");
+      return new Response(null, { status: 204, headers });
+    },
+    applyCorsHeaders(request, target) {
+      const origin = request.headers.get("origin");
+      if (origin === null || origin.length === 0) return;
+      if (!matchesOrigin(origin, config.origins)) return;
+      target.set("Access-Control-Allow-Origin", origin);
+      target.set("Vary", "Origin");
+      if (credentials) target.set("Access-Control-Allow-Credentials", "true");
+      if (config.exposedHeaders !== void 0 && config.exposedHeaders.length > 0) {
+        target.set("Access-Control-Expose-Headers", config.exposedHeaders.join(", "));
+      }
+    }
+  };
+}
+
+// src/server/http/trace-context.ts
+var TRACE_HEADER = "x-trace-id";
+var TRACE_PARENT_HEADER = "traceparent";
+var REQUEST_ID_HEADER = "x-request-id";
+var TRACEPARENT_RE = /^00-([0-9a-f]{32})-([0-9a-f]{16})-[0-9a-f]{2}$/;
+function parseTraceparent(value) {
+  if (!value) return null;
+  const m = TRACEPARENT_RE.exec(value);
+  if (!m) return null;
+  const traceId = m[1];
+  if (/^0+$/.test(traceId)) return null;
+  return traceId;
+}
+function pickHeader(value) {
+  if (Array.isArray(value)) {
+    for (const v of value) {
+      if (typeof v === "string" && v.length > 0) return v;
+    }
+    return null;
+  }
+  if (typeof value === "string" && value.length > 0) return value;
+  return null;
+}
+function resolveTraceIdFromHeaders(traceparent, requestId) {
+  if (traceparent !== null) {
+    const parsed = parseTraceparent(traceparent);
+    if (parsed !== null) return parsed;
+  }
+  if (requestId !== null) return requestId;
+  return globalThis.crypto.randomUUID();
+}
+function extractTraceId(req) {
+  return resolveTraceIdFromHeaders(
+    pickHeader(req.headers[TRACE_PARENT_HEADER]),
+    pickHeader(req.headers[REQUEST_ID_HEADER])
+  );
+}
+function extractTraceIdFromRequest(request) {
+  return resolveTraceIdFromHeaders(
+    request.headers.get(TRACE_PARENT_HEADER),
+    request.headers.get(REQUEST_ID_HEADER)
+  );
+}
+
+export {
+  ActionError,
+  ActionInputError,
+  extractUniversalIssues,
+  isActionError,
+  isInputError,
+  sendJson,
+  sendError,
+  _resetMiddlewareCacheForTests,
+  runMiddlewareAndContext,
+  executeRoute,
+  executeAction,
+  STRIPPED_HEADERS,
+  BATCH_PATH,
+  BatchPathConflictError,
+  handleBatchRequest,
+  matchesOrigin,
+  createCorsHandler,
+  createCorsWebHandler,
+  TRACE_HEADER,
+  TRACE_PARENT_HEADER,
+  parseTraceparent,
+  extractTraceId,
+  extractTraceIdFromRequest
+};
+//# sourceMappingURL=chunk-5Z2727GV.js.map