theokit 0.43.12 → 0.45.0

package/dist/chunk-6KDXP472.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/rate-limit/rate-limit-per-route.ts"],"mappings":";;;;;;;;AAgDA,SAAS,cAAc,OAAuB;AAC5C,QAAM,UAAU,MAAM,MAAM,GAAG,EAAE,CAAC;AAClC,MAAI,QAAQ,SAAS,KAAK,QAAQ,SAAS,GAAG,EAAG,QAAO,QAAQ,MAAM,GAAG,EAAE;AAC3E,SAAO;AACT;AAOO,SAAS,kBAAkB,MAAc,SAAmC;AACjF,QAAM,YAAY,cAAc,IAAI;AACpC,MAAI,OAAO,YAAY,UAAU;AAC/B,WAAO,cAAc,cAAc,OAAO;AAAA,EAC5C;AACA,UAAQ,YAAY;AACpB,SAAO,QAAQ,KAAK,SAAS;AAC/B;AAWA,eAAe,aAAa,OAAgC;AAC1D,QAAM,MAAM,MAAM,WAAW,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AAC5F,QAAM,QAAQ,IAAI,WAAW,GAAG;AAChC,MAAI,MAAM;AACV,aAAW,KAAK,MAAO,QAAO,OAAO,aAAa,CAAC;AAEnD,QAAM,SAAS,KAAK,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAClF,SAAO,OAAO,MAAM,GAAG,EAAE;AAC3B;AAMA,SAAS,WAAW,KAAsB,MAAkC;AAC1E,SAAO,kBAAkB,IAAI,QAAQ,UAAU,MAAS,EAAE,IAAI,IAAI;AACpE;AAUA,eAAsB,UACpB,KACA,OACA,YACiB;AACjB,MAAI,OAAO,UAAU,WAAY,QAAO,MAAM,GAAG;AAKjD,QAAM,KAAK,IAAI,QAAQ,iBAAiB;AACxC,UAAQ,OAAO;AAAA,IACb,KAAK,WAAW;AACd,YAAM,SAAS,WAAW,KAAK,UAAU;AACzC,aAAO,SAAS,WAAW,MAAM,aAAa,MAAM,CAAC,KAAK,MAAM,EAAE;AAAA,IACpE;AAAA,IACA,KAAK,QAAQ;AACX,YAAM,SAAU,IAA8C,MAAM;AACpE,aAAO,SAAS,QAAQ,MAAM,KAAK,MAAM,EAAE;AAAA,IAC7C;AAAA,IACA,KAAK;AAAA,IACL;AACE,aAAO,MAAM,EAAE;AAAA,EACnB;AACF;AASO,SAAS,uBAAuB,QAAgD;AAErF,QAAM,SACJ,cAAc,UAAU,SAAS,UAAU,EAAE,aAAa,WAAW,EAAE,YAAY;AACrF,QAAM,MAA4B,SAAS,EAAE,SAAS,OAAO,IAAI;AAEjE,QAAM,QAAQ,IAAI,SAAS,IAAI,cAAc;AAK7C,MAAI,EAAE,iBAAiB,gBAAgB;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,QAAM,gBAAgB;AACtB,QAAM,QAAQ,IAAI,SAAS;AAC3B,QAAM,aAAa,IAAI,cAAc;AAGrC,QAAM,cAAoD,CAAC;AAC3D,MAAI,IAAI,QAAQ;AACd,eAAW,CAAC,SAAS,CAAC,KAAK,OAAO,QAAQ,IAAI,MAAM,EAAG,aAAY,KAAK,CAAC,SAAS,CAAC,CAAC;AAAA,EACtF;AACA,MAAI,IAAI,eAAe;AACrB,eAAW,SAAS,IAAI,cAAe,aAAY,KAAK,KAAK;AAAA,EAC/D;AAEA,SAAO,eAAe,oBAAoB,KAAgD;AACxF,UAAM,MAAM,IAAI,OAAO;AACvB,QAAI;AACJ,eAAW,CAAC,SAAS,CAAC,KAAK,aAAa;AACtC,UAAI,kBAAkB,KAAK,OAAO,GAAG;AACnC,kBAAU;AACV;AAAA,MACF;AAAA,IACF;AACA,UAAM,YAAY,WAAW,IAAI;AACjC,QAAI,CAAC,WAAW;AAEd,aAAO,EAAE,SAAS,OAAO,SAAS,CAAC,EAAE;AAAA,IACvC;AAIA,UAAM,eAAe,OAAO,YAAY,cAAc,cAAc,cAAc,GAAG;AACrF,UAAM,MAAM,GAAG,MAAM,UAAU,KAAK,OAAO,UAAU,CAAC,IAAI,YAAY;AACtE,UAAM,QAAQ,cAAc,SAAS,KAAK,UAAU,QAAQ;AAE5D,QAAI,MAAM,QAAQ,UAAU,KAAK;AAC/B,YAAM,aAAa,KAAK,MAAM,MAAM,UAAU,KAAK,IAAI,KAAK,GAAI;AAChE,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS;AAAA,UACP,qBAAqB,OAAO,UAAU,GAAG;AAAA,UACzC,yBAAyB;AAAA,UACzB,eAAe,OAAO,UAAU;AAAA,QAClC;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS;AAAA,QACP,qBAAqB,OAAO,UAAU,GAAG;AAAA,QACzC,yBAAyB,OAAO,KAAK,IAAI,GAAG,UAAU,MAAM,MAAM,KAAK,CAAC;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AACF;AAmCA,eAAsB,qBACpB,SACA,OACA,YACA,MAA+B,CAAC,GACf;AACjB,QAAM,KAAK,IAAI,YAAY;AAC3B,UAAQ,OAAO;AAAA,IACb,KAAK,WAAW;AAGd,YAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,uBAAoB;AAClE,YAAM,SAAS,qBAAqB,SAAS,UAAU;AACvD,aAAO,SAAS,WAAW,MAAM,aAAa,MAAM,CAAC,KAAK,MAAM,EAAE;AAAA,IACpE;AAAA,IACA,KAAK,QAAQ;AACX,aAAO,IAAI,SAAS,QAAQ,IAAI,MAAM,KAAK,MAAM,EAAE;AAAA,IACrD;AAAA,IACA,KAAK;AAAA,IACL;AACE,aAAO,MAAM,EAAE;AAAA,EACnB;AACF;AAgBO,SAAS,0BAA0B,QAAgD;AACxF,QAAM,SACJ,cAAc,UAAU,SAAS,UAAU,EAAE,aAAa,WAAW,EAAE,YAAY;AACrF,QAAM,MAA4B,SAAS,EAAE,SAAS,OAAO,IAAI;AAEjE,QAAM,QAAQ,IAAI,SAAS,IAAI,cAAc;AAC7C,MAAI,EAAE,iBAAiB,gBAAgB;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,QAAM,gBAAgB;AACtB,QAAM,QAAS,IAAI,SAAS;AAC5B,QAAM,aAAa,IAAI,cAAc;AAErC,QAAM,cAAoD,CAAC;AAC3D,MAAI,IAAI,QAAQ;AACd,eAAW,CAAC,SAAS,CAAC,KAAK,OAAO,QAAQ,IAAI,MAAM,EAAG,aAAY,KAAK,CAAC,SAAS,CAAC,CAAC;AAAA,EACtF;AACA,MAAI,IAAI,eAAe;AACrB,eAAW,SAAS,IAAI,cAAe,aAAY,KAAK,KAAK;AAAA,EAC/D;AAEA,SAAO,eAAe,uBACpB,SACA,MAA+B,CAAC,GACN;AAG1B,UAAM,SAAS,IAAI,IAAI,QAAQ,GAAG;AAClC,UAAM,MAAM,GAAG,OAAO,QAAQ,GAAG,OAAO,MAAM;AAC9C,QAAI;AACJ,eAAW,CAAC,SAAS,CAAC,KAAK,aAAa;AACtC,UAAI,kBAAkB,KAAK,OAAO,GAAG;AACnC,kBAAU;AACV;AAAA,MACF;AAAA,IACF;AACA,UAAM,YAAY,WAAW,IAAI;AACjC,QAAI,CAAC,WAAW;AACd,aAAO,EAAE,SAAS,OAAO,SAAS,CAAC,EAAE;AAAA,IACvC;AAEA,UAAM,eAAe,OAAO,YAAY,cAAc,cAAc,cAAc,GAAG;AACrF,UAAM,MAAM,GAAG,MAAM,qBAAqB,SAAS,OAAO,YAAY,GAAG,CAAC,IAAI,YAAY;AAC1F,UAAM,QAAQ,cAAc,SAAS,KAAK,UAAU,QAAQ;AAE5D,QAAI,MAAM,QAAQ,UAAU,KAAK;AAC/B,YAAM,aAAa,KAAK,MAAM,MAAM,UAAU,KAAK,IAAI,KAAK,GAAI;AAChE,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS;AAAA,UACP,qBAAqB,OAAO,UAAU,GAAG;AAAA,UACzC,yBAAyB;AAAA,UACzB,eAAe,OAAO,UAAU;AAAA,QAClC;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS;AAAA,QACP,qBAAqB,OAAO,UAAU,GAAG;AAAA,QACzC,yBAAyB,OAAO,KAAK,IAAI,GAAG,UAAU,MAAM,MAAM,KAAK,CAAC;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-6LNIGF5P.js

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+import "tsx/esm";
+import {
+  findControllerFiles
+} from "./chunk-FXZZS7YW.js";
+
+// src/cli/commands/build/emit-controllers.ts
+import { mkdirSync, readFileSync, writeFileSync } from "fs";
+import { basename, dirname, join, relative, resolve } from "path";
+import { transformControllerSource } from "@theokit/http";
+var CONTROLLER_MANIFEST_FILE = "controllers.json";
+var CONTROLLER_OUT_DIR = "controllers";
+async function emitControllerArtifacts(opts) {
+  const controllersDir = resolve(opts.serverDir, CONTROLLER_OUT_DIR);
+  const files = findControllerFiles(controllersDir);
+  if (files.length === 0) return null;
+  const outDir = resolve(opts.distDir, CONTROLLER_OUT_DIR);
+  mkdirSync(outDir, { recursive: true });
+  const modules = [];
+  for (const file of files) {
+    const code = await transformControllerSource(readFileSync(file, "utf-8"), file);
+    const rel = relative(controllersDir, file).replace(/\.controller\.ts$/, ".controller.mjs");
+    const outPath = join(outDir, rel);
+    mkdirSync(dirname(outPath), { recursive: true });
+    writeFileSync(outPath, code);
+    modules.push(`${CONTROLLER_OUT_DIR}/${rel.split("\\").join("/")}`);
+  }
+  const manifest = { version: 1, modules };
+  writeFileSync(
+    resolve(opts.distDir, CONTROLLER_MANIFEST_FILE),
+    JSON.stringify(manifest, null, 2) + "\n"
+  );
+  return manifest;
+}
+function describeControllerArtifacts(manifest) {
+  if (manifest === null) return "controllers: none";
+  const names = manifest.modules.map((m) => basename(m, ".mjs")).join(", ");
+  return `controllers: ${manifest.modules.length} compiled (${names})`;
+}
+
+export {
+  CONTROLLER_MANIFEST_FILE,
+  emitControllerArtifacts,
+  describeControllerArtifacts
+};
+//# sourceMappingURL=chunk-6LNIGF5P.js.map

package/dist/chunk-6LNIGF5P.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/commands/build/emit-controllers.ts"],"sourcesContent":["import { mkdirSync, readFileSync, writeFileSync } from 'node:fs'\nimport { basename, dirname, join, relative, resolve } from 'node:path'\n\nimport { transformControllerSource } from '@theokit/http'\n\nimport { findControllerFiles } from '../../../server/http/controller-dispatch.js'\n\n/**\n * theokit#123 — compile `server/controllers/**` into `dist` so production can serve them.\n *\n * ## Why production needed anything at all\n *\n * #122 made decorator controllers first-class in `theokit dev`, where a Vite `enforce:'pre'` swc\n * transform compiles them on the fly — parameter decorators (`@Body`/`@Param`/`@Query`) emit\n * metadata esbuild cannot produce. `theokit start` has no Vite and no transform, so an uncompiled\n * `.controller.ts` simply cannot load, and controller routes 404'd in production while working in\n * dev. That split is the whole issue.\n *\n * ## Why compile at BUILD time rather than load with swc at runtime\n *\n * `loadControllerWithSwc` would work in production and was the smaller diff. It is refused on\n * purpose: `@swc/core` is a peer dependency and a native binary, so that path makes every deployed\n * app carry a compiler it only needs once, and turns a missing optional peer into a runtime 404\n * instead of a build failure. Compilation belongs where the rest of the build already is — and it\n * is what the issue's root-cause note asks for.\n *\n * ## Why NOT in `generateManifest`\n *\n * ADR-5 keeps controllers out of the manifest, and that is preserved here: the manifest is the\n * deploy-adapter contract, and adding a parallel route source to it would ripple through every\n * adapter. This emits a SEPARATE artifact (`dist/controllers.json` + `dist/controllers/*.mjs`) that\n * only the Node start path reads. An adapter that knows nothing about controllers keeps working\n * exactly as before.\n */\n\n/** The build artifact `theokit start` reads to find compiled controllers. */\nexport interface ControllerBuildManifest {\n  version: 1\n  /** Emitted module paths, relative to `distDir`, in scan order. */\n  modules: string[]\n}\n\nexport const CONTROLLER_MANIFEST_FILE = 'controllers.json'\nconst CONTROLLER_OUT_DIR = 'controllers'\n\n/**\n * Compile every controller under `<serverDir>/controllers` into `<distDir>/controllers`.\n *\n * No controllers ⇒ **no artifact at all** (not an empty one). `theokit start` treats a missing\n * manifest as \"this app has no controllers\" and skips the whole branch, so a routes-only app pays\n * nothing and its `dist` is byte-identical to before — the ADR-5 posture, kept.\n */\nexport async function emitControllerArtifacts(opts: {\n  serverDir: string\n  distDir: string\n}): Promise<ControllerBuildManifest | null> {\n  const controllersDir = resolve(opts.serverDir, CONTROLLER_OUT_DIR)\n  const files = findControllerFiles(controllersDir)\n  if (files.length === 0) return null\n\n  const outDir = resolve(opts.distDir, CONTROLLER_OUT_DIR)\n  mkdirSync(outDir, { recursive: true })\n\n  const modules: string[] = []\n  for (const file of files) {\n    // Errors are NOT caught. A controller that fails to compile must fail the BUILD — swallowing it\n    // here would ship an app whose routes 404 at runtime with nothing pointing back at the cause,\n    // which is the exact failure mode this issue reports (error-handling.md § 2).\n    const code = await transformControllerSource(readFileSync(file, 'utf-8'), file)\n\n    // Mirror the source tree under `dist/controllers` so two files with the same basename in\n    // different folders cannot overwrite each other.\n    const rel = relative(controllersDir, file).replace(/\\.controller\\.ts$/, '.controller.mjs')\n    const outPath = join(outDir, rel)\n    mkdirSync(dirname(outPath), { recursive: true })\n    writeFileSync(outPath, code)\n    modules.push(`${CONTROLLER_OUT_DIR}/${rel.split('\\\\').join('/')}`)\n  }\n\n  const manifest: ControllerBuildManifest = { version: 1, modules }\n  writeFileSync(\n    resolve(opts.distDir, CONTROLLER_MANIFEST_FILE),\n    JSON.stringify(manifest, null, 2) + '\\n',\n  )\n  return manifest\n}\n\n/** Human-facing summary for the build log (mirrors the cron/job emitters). */\nexport function describeControllerArtifacts(manifest: ControllerBuildManifest | null): string {\n  if (manifest === null) return 'controllers: none'\n  const names = manifest.modules.map((m) => basename(m, '.mjs')).join(', ')\n  return `controllers: ${manifest.modules.length} compiled (${names})`\n}\n"],"mappings":";;;;;;;AAAA,SAAS,WAAW,cAAc,qBAAqB;AACvD,SAAS,UAAU,SAAS,MAAM,UAAU,eAAe;AAE3D,SAAS,iCAAiC;AAuCnC,IAAM,2BAA2B;AACxC,IAAM,qBAAqB;AAS3B,eAAsB,wBAAwB,MAGF;AAC1C,QAAM,iBAAiB,QAAQ,KAAK,WAAW,kBAAkB;AACjE,QAAM,QAAQ,oBAAoB,cAAc;AAChD,MAAI,MAAM,WAAW,EAAG,QAAO;AAE/B,QAAM,SAAS,QAAQ,KAAK,SAAS,kBAAkB;AACvD,YAAU,QAAQ,EAAE,WAAW,KAAK,CAAC;AAErC,QAAM,UAAoB,CAAC;AAC3B,aAAW,QAAQ,OAAO;AAIxB,UAAM,OAAO,MAAM,0BAA0B,aAAa,MAAM,OAAO,GAAG,IAAI;AAI9E,UAAM,MAAM,SAAS,gBAAgB,IAAI,EAAE,QAAQ,qBAAqB,iBAAiB;AACzF,UAAM,UAAU,KAAK,QAAQ,GAAG;AAChC,cAAU,QAAQ,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AAC/C,kBAAc,SAAS,IAAI;AAC3B,YAAQ,KAAK,GAAG,kBAAkB,IAAI,IAAI,MAAM,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE;AAAA,EACnE;AAEA,QAAM,WAAoC,EAAE,SAAS,GAAG,QAAQ;AAChE;AAAA,IACE,QAAQ,KAAK,SAAS,wBAAwB;AAAA,IAC9C,KAAK,UAAU,UAAU,MAAM,CAAC,IAAI;AAAA,EACtC;AACA,SAAO;AACT;AAGO,SAAS,4BAA4B,UAAkD;AAC5F,MAAI,aAAa,KAAM,QAAO;AAC9B,QAAM,QAAQ,SAAS,QAAQ,IAAI,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,KAAK,IAAI;AACxE,SAAO,gBAAgB,SAAS,QAAQ,MAAM,cAAc,KAAK;AACnE;","names":[]}

package/dist/{chunk-IE6C4KZX.js → chunk-6VDYQ4I6.js}

@@ -3,384 +3,21 @@ import "tsx/esm";
 import {
   getApprovalRegistry
 } from "./chunk-TDNNBLGW.js";
+import {
+  dispatchCsrfWarn,
+  enforceCsrf,
+  incomingMessageToHandlerRequest,
+  parseRequestBody,
+  sendError,
+  sendJson,
+  validateCsrfRequest,
+  warnOnce
+} from "./chunk-FXZZS7YW.js";
 import {
   TheoError,
   serverErrorToEnvelope
 } from "./chunk-HGZL5EOI.js";
 
-// src/server/body-parser.ts
-import { basename } from "path";
-import Busboy from "busboy";
-var METHODS_WITH_BODY = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH"]);
-var DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024;
-var DEFAULT_MAX_FILES = 10;
-var DEFAULT_MAX_FIELD_SIZE = 1 * 1024 * 1024;
-var FileTooLargeError = class extends Error {
-  constructor(message, truncatedFilenames, maxFileSize) {
-    super(message);
-    this.truncatedFilenames = truncatedFilenames;
-    this.maxFileSize = maxFileSize;
-    this.name = "FileTooLargeError";
-  }
-  truncatedFilenames;
-  maxFileSize;
-  code = "FILE_TOO_LARGE";
-  status = 413;
-};
-function stashBodyPreview(req, body) {
-  try {
-    ;
-    req[DEVTOOLS_BODY_PREVIEW] = body;
-  } catch {
-  }
-}
-function parseJsonBody(req) {
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    req.on("data", (chunk) => chunks.push(chunk));
-    req.on("end", () => {
-      const raw = Buffer.concat(chunks).toString();
-      if (!raw) {
-        resolve(void 0);
-        return;
-      }
-      try {
-        resolve(JSON.parse(raw));
-      } catch {
-        reject(new Error("Invalid JSON body"));
-      }
-    });
-    req.on("error", reject);
-  });
-}
-function parseMultipartBody(req, contentType, options) {
-  if (!contentType.includes("boundary=")) {
-    return Promise.reject(new Error("Missing multipart boundary"));
-  }
-  return new Promise((resolve, reject) => {
-    const fields = {};
-    const files = [];
-    const truncatedFilenames = [];
-    let fileCount = 0;
-    const bb = Busboy({
-      headers: req.headers,
-      limits: {
-        fileSize: options.maxFileSize,
-        files: options.maxFiles,
-        fieldSize: options.maxFieldSize
-      }
-    });
-    bb.on("field", (name, value) => {
-      fields[name] = value;
-    });
-    bb.on(
-      "file",
-      (fieldname, stream, info) => {
-        fileCount++;
-        if (fileCount > options.maxFiles) {
-          stream.resume();
-          return;
-        }
-        const safeName = basename(info.filename || "unnamed");
-        const chunks = [];
-        let size = 0;
-        let truncated = false;
-        stream.on("data", (chunk) => {
-          size += chunk.length;
-          if (size > options.maxFileSize) {
-            truncated = true;
-            stream.resume();
-            return;
-          }
-          chunks.push(chunk);
-        });
-        stream.on("end", () => {
-          if (truncated) {
-            truncatedFilenames.push(safeName);
-            return;
-          }
-          const buffer = Buffer.concat(chunks);
-          files.push({
-            fieldname,
-            filename: safeName,
-            encoding: info.encoding,
-            mimeType: info.mimeType,
-            buffer,
-            size: buffer.length
-          });
-        });
-      }
-    );
-    bb.on("filesLimit", () => {
-      reject(new Error(`Too many files. Maximum: ${options.maxFiles}`));
-    });
-    bb.on("error", (err) => {
-      reject(err);
-    });
-    bb.on("close", () => {
-      if (truncatedFilenames.length > 0) {
-        reject(
-          new FileTooLargeError(
-            `File too large (max ${options.maxFileSize} bytes): ${truncatedFilenames.join(", ")}`,
-            truncatedFilenames,
-            options.maxFileSize
-          )
-        );
-        return;
-      }
-      resolve({ fields, files });
-    });
-    req.pipe(bb);
-  });
-}
-var DEVTOOLS_BODY_PREVIEW = /* @__PURE__ */ Symbol("theo:devtools:bodyPreview");
-async function parseRequestBody(req, options) {
-  const method = req.method?.toUpperCase() ?? "GET";
-  if (!METHODS_WITH_BODY.has(method)) {
-    return { fields: {}, files: [], json: void 0 };
-  }
-  const contentType = req.headers["content-type"] ?? "";
-  if (contentType.includes("application/json")) {
-    const json = await parseJsonBody(req);
-    stashBodyPreview(req, json);
-    return { fields: {}, files: [], json };
-  }
-  if (contentType.includes("multipart/form-data")) {
-    const limits = {
-      maxFileSize: options?.maxFileSize ?? DEFAULT_MAX_FILE_SIZE,
-      maxFiles: options?.maxFiles ?? DEFAULT_MAX_FILES,
-      maxFieldSize: options?.maxFieldSize ?? DEFAULT_MAX_FIELD_SIZE
-    };
-    const { fields, files } = await parseMultipartBody(req, contentType, limits);
-    stashBodyPreview(req, {
-      fields,
-      files: files.map((f) => ({
-        fieldname: f.fieldname,
-        filename: f.filename,
-        mimeType: f.mimeType,
-        size: f.size
-      }))
-    });
-    return { fields, files };
-  }
-  if (!contentType) {
-    return { fields: {}, files: [] };
-  }
-  throw new Error(`Unsupported Content-Type: ${contentType}`);
-}
-
-// src/server/observability/request-log.ts
-var defaultLoggerFn = (log) => {
-  console.log(JSON.stringify(log));
-};
-function logRequest(info, customLogger, req) {
-  const log = {
-    level: "info",
-    ...info,
-    timestamp: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  const logger = customLogger ?? defaultLoggerFn;
-  logger(log);
-  broadcastRequestToDevtools(info, req);
-}
-function randomRequestId() {
-  return `req-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`;
-}
-function broadcastToDevtoolsCore(info, headers, stashedBody) {
-  void Promise.all([
-    import("./broadcast-LUMOJIJT.js"),
-    import("./build-request-body-preview-XPZ2GYMG.js")
-  ]).then(([{ broadcastRequest }, { buildRequestBodyPreview }]) => {
-    const bodyInfo = buildRequestBodyPreview(stashedBody);
-    broadcastRequest({
-      id: randomRequestId(),
-      traceId: info.requestId,
-      method: info.method,
-      path: info.url,
-      status: info.status,
-      durationMs: info.duration,
-      startedAt: Date.now() - info.duration,
-      ...headers ? { headers } : {},
-      ...bodyInfo ? {
-        bodyPreview: bodyInfo.preview,
-        bodyLength: bodyInfo.length,
-        bodyTruncated: bodyInfo.truncated
-      } : {}
-    });
-  }).catch(() => {
-  });
-}
-function broadcastRequestToDevtools(info, req) {
-  const headers = req?.headers ? Object.fromEntries(
-    Object.entries(req.headers).map(([k, v]) => [
-      k,
-      Array.isArray(v) ? v.join(", ") : v ?? ""
-    ])
-  ) : void 0;
-  const stashedBody = req ? req[DEVTOOLS_BODY_PREVIEW] : void 0;
-  broadcastToDevtoolsCore(info, headers, stashedBody);
-}
-
-// src/server/observability/logger.ts
-var _warnOnceSeen = /* @__PURE__ */ new Set();
-var MAX_SEEN = 1024;
-function warnOnce(key, payload) {
-  if (_warnOnceSeen.has(key)) return;
-  if (_warnOnceSeen.size >= MAX_SEEN) {
-    const oldest = _warnOnceSeen.values().next().value;
-    if (oldest !== void 0) _warnOnceSeen.delete(oldest);
-  }
-  _warnOnceSeen.add(key);
-  let line;
-  try {
-    line = JSON.stringify({ ...payload, warnOnce: true });
-  } catch {
-    line = `[warnOnce] ${key} \u2014 (payload could not be serialized)`;
-  }
-  console.warn(line);
-  broadcastWarnOnceToDevtools(key, payload);
-}
-function payloadField(payload, key, fallback = "") {
-  const value = payload[key];
-  if (typeof value === "string") return value;
-  if (typeof value === "number" || typeof value === "boolean") return String(value);
-  return fallback;
-}
-function randomDevtoolsId() {
-  return `warn-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`;
-}
-function broadcastWarnOnceToDevtools(key, payload) {
-  void import("./broadcast-LUMOJIJT.js").then(({ broadcastCsrfWarn, broadcastError }) => {
-    if (payload.event === "csrf.warn" && typeof payload.code === "string" && typeof payload.docsUrl === "string") {
-      broadcastCsrfWarn({
-        event: "csrf.warn",
-        code: payload.code,
-        docsUrl: payload.docsUrl,
-        method: payloadField(payload, "method"),
-        path: payloadField(payload, "path"),
-        reason: payloadField(payload, "reason")
-      });
-    } else {
-      broadcastError({
-        id: randomDevtoolsId(),
-        type: "console",
-        message: payloadField(payload, "event", key),
-        timestamp: Date.now()
-      });
-    }
-  }).catch(() => {
-  });
-}
-
-// src/server/http/send-response.ts
-function sendJson(res, data, status = 200, transformer) {
-  const body = transformer ? transformer.serialize(data) : JSON.stringify(data);
-  res.writeHead(status, {
-    "Content-Type": "application/json",
-    "Content-Length": Buffer.byteLength(body)
-  });
-  res.end(body);
-}
-function sendError(res, codeOrInput, message, status, issues, requestId, options) {
-  let code;
-  if (typeof codeOrInput === "string") {
-    code = codeOrInput;
-    message = message ?? "";
-    status = status ?? 500;
-  } else {
-    code = codeOrInput.code;
-    message = codeOrInput.message;
-    status = codeOrInput.status;
-    issues = codeOrInput.issues;
-    requestId = codeOrInput.requestId;
-    options = codeOrInput.options;
-  }
-  const errorMessage = code === "INTERNAL_ERROR" && process.env.NODE_ENV === "production" ? "Internal server error" : message;
-  if (code === "INTERNAL_ERROR") {
-    console.error(`[${requestId ?? "no-id"}] ${message}`);
-  }
-  if (status === 404 && options?.custom404Html) {
-    const body = options.custom404Html;
-    res.writeHead(404, {
-      "Content-Type": "text/html; charset=utf-8",
-      "Content-Length": Buffer.byteLength(body)
-    });
-    res.end(body);
-    return;
-  }
-  if (status === 500 && options?.custom500Html) {
-    const body = options.custom500Html;
-    res.writeHead(500, {
-      "Content-Type": "text/html; charset=utf-8",
-      "Content-Length": Buffer.byteLength(body)
-    });
-    res.end(body);
-    return;
-  }
-  sendJson(
-    res,
-    {
-      error: {
-        code,
-        message: errorMessage,
-        ...requestId ? { requestId } : {},
-        ...issues ? { issues } : {}
-      }
-    },
-    status
-  );
-}
-
-// src/server/http/node-request.ts
-import { Readable } from "stream";
-function pickHeaderString(value) {
-  if (typeof value === "string") return value;
-  if (Array.isArray(value)) {
-    for (const v of value) if (typeof v === "string" && v.length > 0) return v;
-  }
-  return void 0;
-}
-function synthesizeAbsoluteUrl(req) {
-  const host = pickHeaderString(req.headers.host) ?? "localhost";
-  return `http://${host}${req.url ?? "/"}`;
-}
-function nodeHeadersToWeb(req) {
-  const headers = new Headers();
-  for (const [key, value] of Object.entries(req.headers)) {
-    if (value === void 0) continue;
-    if (Array.isArray(value)) {
-      headers.set(key, value.join(", "));
-    } else {
-      headers.set(key, value);
-    }
-  }
-  return headers;
-}
-function incomingMessageToWebRequest(req) {
-  const url = synthesizeAbsoluteUrl(req);
-  const headers = nodeHeadersToWeb(req);
-  const method = (req.method ?? "GET").toUpperCase();
-  const hasBody = method !== "GET" && method !== "HEAD";
-  if (!hasBody) {
-    return new Request(url, { method, headers });
-  }
-  const webStream = Readable.toWeb(req);
-  return new Request(url, {
-    method,
-    headers,
-    body: webStream,
-    // EC-2: Node 18+ requires `duplex: 'half'` when body is a stream.
-    // The `RequestInit` type omits it (Web spec gap); cast accordingly.
-    ...{ duplex: "half" }
-  });
-}
-function incomingMessageToHandlerRequest(req) {
-  return new Request(synthesizeAbsoluteUrl(req), {
-    method: (req.method ?? "GET").toUpperCase(),
-    headers: nodeHeadersToWeb(req)
-  });
-}
-
 // src/core/contracts/auth-error-guard.ts
 function isAuthRequiredError(err) {
   if (err == null || typeof err !== "object") return false;
@@ -488,119 +125,6 @@ function createOutboxDispatcher(backend) {
   };
 }
 
-// src/server/security/csrf-warn-dispatch.ts
-function dispatchCsrfWarn(payload) {
-  const key = `${payload.event}:${payload.method}:${payload.path ?? ""}`;
-  warnOnce(key, payload);
-}
-
-// src/server/observability/audit-log.ts
-function safeAudit(logger, event) {
-  if (!logger) return;
-  try {
-    const r = logger.log(event);
-    if (r && typeof r.then === "function") {
-      r.catch(() => {
-      });
-    }
-  } catch {
-  }
-}
-
-// src/server/security/csrf.ts
-function matchDisallowed(path, patterns) {
-  for (const p of patterns) {
-    if (typeof p === "string") {
-      if (path === p) return true;
-    } else if (p instanceof RegExp) {
-      p.lastIndex = 0;
-      if (p.test(path)) return true;
-    }
-  }
-  return false;
-}
-var CSRF_WARN_CODE = "CSRF_STRICT_CUTOVER";
-var CSRF_WARN_DOCS_URL = "https://theokit.dev/upgrade/csrf-strict-cutover";
-function pickHeader(value) {
-  if (typeof value === "string") return value;
-  if (Array.isArray(value) && value.length > 0) return value[0];
-  return "";
-}
-function isCsrfValidFromHeaders(opts) {
-  if (opts.csrfActionHeader !== "1") {
-    return { valid: false, reason: "Missing X-Theo-Action header" };
-  }
-  if (opts.origin === null || opts.origin === "") {
-    return { valid: true };
-  }
-  if (opts.host === null || opts.host === "") {
-    return { valid: true };
-  }
-  try {
-    const originHost = new URL(opts.origin).host;
-    if (originHost !== opts.host) {
-      return { valid: false, reason: `Origin ${opts.origin} does not match host ${opts.host}` };
-    }
-  } catch {
-    return { valid: false, reason: `Invalid origin: ${opts.origin}` };
-  }
-  return { valid: true };
-}
-function validateCsrf(req) {
-  const action = req.headers["x-theo-action"];
-  const origin = req.headers.origin;
-  const host = req.headers.host;
-  return isCsrfValidFromHeaders({
-    csrfActionHeader: typeof action === "string" ? action : null,
-    origin: origin !== void 0 ? pickHeader(origin) || null : null,
-    host: host !== void 0 ? pickHeader(host) || null : null
-  });
-}
-function validateCsrfRequest(request) {
-  return isCsrfValidFromHeaders({
-    csrfActionHeader: request.headers.get("x-theo-action"),
-    origin: request.headers.get("origin"),
-    host: request.headers.get("host")
-  });
-}
-function dispatchCsrfWarn2(req, reason, logger, auditLogger, pathFallback = "") {
-  const payload = {
-    event: "csrf.warn",
-    method: req.method ?? "UNKNOWN",
-    path: logger?.path ?? pathFallback,
-    reason,
-    code: CSRF_WARN_CODE,
-    docsUrl: CSRF_WARN_DOCS_URL
-  };
-  logger?.warn(payload);
-  safeAudit(auditLogger, {
-    action: "csrf.warn",
-    actor: { type: "anonymous" },
-    metadata: { ...payload }
-  });
-}
-function enforceCsrf(req, mode, logger, disallowed, auditLogger) {
-  if (mode === "off") {
-    return { allow: true };
-  }
-  const check = validateCsrf(req);
-  if (check.valid) {
-    return { allow: true };
-  }
-  if (disallowed?.behavior === "raise") {
-    const path = logger?.path ?? req.url ?? "";
-    if (matchDisallowed(path, disallowed.routes)) {
-      return { allow: false, reason: check.reason };
-    }
-  }
-  if (mode === "warn") {
-    dispatchCsrfWarn2(req, check.reason, logger, auditLogger);
-    return { allow: true, reason: check.reason };
-  }
-  dispatchCsrfWarn2(req, check.reason, logger, auditLogger);
-  return { allow: false, reason: check.reason };
-}
-
 // src/server/http/execute-stages.ts
 async function parseQueryAndBody(req, res, requestId) {
   const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
@@ -2377,15 +1901,6 @@ function generateNonce() {
 }
 
 export {
-  logRequest,
-  warnOnce,
-  dispatchCsrfWarn,
-  safeAudit,
-  validateCsrfRequest,
-  enforceCsrf,
-  sendError,
-  incomingMessageToWebRequest,
-  incomingMessageToHandlerRequest,
   executeRoute,
   executeAction,
   findSuggestion,
@@ -2407,4 +1922,4 @@ export {
   applySecurityHeaders,
   generateNonce
 };
-//# sourceMappingURL=chunk-IE6C4KZX.js.map
+//# sourceMappingURL=chunk-6VDYQ4I6.js.map