theokit 0.43.7 → 0.44.3

package/dist/{chunk-UNLG36Z5.js → chunk-Q5OT7LZG.js}

@@ -2,385 +2,22 @@
 import "tsx/esm";
 import {
   getApprovalRegistry
-} from "./chunk-M6NMS5LR.js";
+} from "./chunk-TDNNBLGW.js";
+import {
+  dispatchCsrfWarn,
+  enforceCsrf,
+  incomingMessageToHandlerRequest,
+  parseRequestBody,
+  sendError,
+  sendJson,
+  validateCsrfRequest,
+  warnOnce
+} from "./chunk-FXZZS7YW.js";
 import {
   TheoError,
   serverErrorToEnvelope
 } from "./chunk-HGZL5EOI.js";
 
-// src/server/body-parser.ts
-import { basename } from "path";
-import Busboy from "busboy";
-var METHODS_WITH_BODY = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH"]);
-var DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024;
-var DEFAULT_MAX_FILES = 10;
-var DEFAULT_MAX_FIELD_SIZE = 1 * 1024 * 1024;
-var FileTooLargeError = class extends Error {
-  constructor(message, truncatedFilenames, maxFileSize) {
-    super(message);
-    this.truncatedFilenames = truncatedFilenames;
-    this.maxFileSize = maxFileSize;
-    this.name = "FileTooLargeError";
-  }
-  truncatedFilenames;
-  maxFileSize;
-  code = "FILE_TOO_LARGE";
-  status = 413;
-};
-function stashBodyPreview(req, body) {
-  try {
-    ;
-    req[DEVTOOLS_BODY_PREVIEW] = body;
-  } catch {
-  }
-}
-function parseJsonBody(req) {
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    req.on("data", (chunk) => chunks.push(chunk));
-    req.on("end", () => {
-      const raw = Buffer.concat(chunks).toString();
-      if (!raw) {
-        resolve(void 0);
-        return;
-      }
-      try {
-        resolve(JSON.parse(raw));
-      } catch {
-        reject(new Error("Invalid JSON body"));
-      }
-    });
-    req.on("error", reject);
-  });
-}
-function parseMultipartBody(req, contentType, options) {
-  if (!contentType.includes("boundary=")) {
-    return Promise.reject(new Error("Missing multipart boundary"));
-  }
-  return new Promise((resolve, reject) => {
-    const fields = {};
-    const files = [];
-    const truncatedFilenames = [];
-    let fileCount = 0;
-    const bb = Busboy({
-      headers: req.headers,
-      limits: {
-        fileSize: options.maxFileSize,
-        files: options.maxFiles,
-        fieldSize: options.maxFieldSize
-      }
-    });
-    bb.on("field", (name, value) => {
-      fields[name] = value;
-    });
-    bb.on(
-      "file",
-      (fieldname, stream, info) => {
-        fileCount++;
-        if (fileCount > options.maxFiles) {
-          stream.resume();
-          return;
-        }
-        const safeName = basename(info.filename || "unnamed");
-        const chunks = [];
-        let size = 0;
-        let truncated = false;
-        stream.on("data", (chunk) => {
-          size += chunk.length;
-          if (size > options.maxFileSize) {
-            truncated = true;
-            stream.resume();
-            return;
-          }
-          chunks.push(chunk);
-        });
-        stream.on("end", () => {
-          if (truncated) {
-            truncatedFilenames.push(safeName);
-            return;
-          }
-          const buffer = Buffer.concat(chunks);
-          files.push({
-            fieldname,
-            filename: safeName,
-            encoding: info.encoding,
-            mimeType: info.mimeType,
-            buffer,
-            size: buffer.length
-          });
-        });
-      }
-    );
-    bb.on("filesLimit", () => {
-      reject(new Error(`Too many files. Maximum: ${options.maxFiles}`));
-    });
-    bb.on("error", (err) => {
-      reject(err);
-    });
-    bb.on("close", () => {
-      if (truncatedFilenames.length > 0) {
-        reject(
-          new FileTooLargeError(
-            `File too large (max ${options.maxFileSize} bytes): ${truncatedFilenames.join(", ")}`,
-            truncatedFilenames,
-            options.maxFileSize
-          )
-        );
-        return;
-      }
-      resolve({ fields, files });
-    });
-    req.pipe(bb);
-  });
-}
-var DEVTOOLS_BODY_PREVIEW = /* @__PURE__ */ Symbol("theo:devtools:bodyPreview");
-async function parseRequestBody(req, options) {
-  const method = req.method?.toUpperCase() ?? "GET";
-  if (!METHODS_WITH_BODY.has(method)) {
-    return { fields: {}, files: [], json: void 0 };
-  }
-  const contentType = req.headers["content-type"] ?? "";
-  if (contentType.includes("application/json")) {
-    const json = await parseJsonBody(req);
-    stashBodyPreview(req, json);
-    return { fields: {}, files: [], json };
-  }
-  if (contentType.includes("multipart/form-data")) {
-    const limits = {
-      maxFileSize: options?.maxFileSize ?? DEFAULT_MAX_FILE_SIZE,
-      maxFiles: options?.maxFiles ?? DEFAULT_MAX_FILES,
-      maxFieldSize: options?.maxFieldSize ?? DEFAULT_MAX_FIELD_SIZE
-    };
-    const { fields, files } = await parseMultipartBody(req, contentType, limits);
-    stashBodyPreview(req, {
-      fields,
-      files: files.map((f) => ({
-        fieldname: f.fieldname,
-        filename: f.filename,
-        mimeType: f.mimeType,
-        size: f.size
-      }))
-    });
-    return { fields, files };
-  }
-  if (!contentType) {
-    return { fields: {}, files: [] };
-  }
-  throw new Error(`Unsupported Content-Type: ${contentType}`);
-}
-
-// src/server/observability/request-log.ts
-var defaultLoggerFn = (log) => {
-  console.log(JSON.stringify(log));
-};
-function logRequest(info, customLogger, req) {
-  const log = {
-    level: "info",
-    ...info,
-    timestamp: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  const logger = customLogger ?? defaultLoggerFn;
-  logger(log);
-  broadcastRequestToDevtools(info, req);
-}
-function randomRequestId() {
-  return `req-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`;
-}
-function broadcastToDevtoolsCore(info, headers, stashedBody) {
-  void Promise.all([
-    import("./broadcast-LUMOJIJT.js"),
-    import("./build-request-body-preview-QMWD2IXK.js")
-  ]).then(([{ broadcastRequest }, { buildRequestBodyPreview }]) => {
-    const bodyInfo = buildRequestBodyPreview(stashedBody);
-    broadcastRequest({
-      id: randomRequestId(),
-      traceId: info.requestId,
-      method: info.method,
-      path: info.url,
-      status: info.status,
-      durationMs: info.duration,
-      startedAt: Date.now() - info.duration,
-      ...headers ? { headers } : {},
-      ...bodyInfo ? {
-        bodyPreview: bodyInfo.preview,
-        bodyLength: bodyInfo.length,
-        bodyTruncated: bodyInfo.truncated
-      } : {}
-    });
-  }).catch(() => {
-  });
-}
-function broadcastRequestToDevtools(info, req) {
-  const headers = req?.headers ? Object.fromEntries(
-    Object.entries(req.headers).map(([k, v]) => [
-      k,
-      Array.isArray(v) ? v.join(", ") : v ?? ""
-    ])
-  ) : void 0;
-  const stashedBody = req ? req[DEVTOOLS_BODY_PREVIEW] : void 0;
-  broadcastToDevtoolsCore(info, headers, stashedBody);
-}
-
-// src/server/observability/logger.ts
-var _warnOnceSeen = /* @__PURE__ */ new Set();
-var MAX_SEEN = 1024;
-function warnOnce(key, payload) {
-  if (_warnOnceSeen.has(key)) return;
-  if (_warnOnceSeen.size >= MAX_SEEN) {
-    const oldest = _warnOnceSeen.values().next().value;
-    if (oldest !== void 0) _warnOnceSeen.delete(oldest);
-  }
-  _warnOnceSeen.add(key);
-  let line;
-  try {
-    line = JSON.stringify({ ...payload, warnOnce: true });
-  } catch {
-    line = `[warnOnce] ${key} \u2014 (payload could not be serialized)`;
-  }
-  console.warn(line);
-  broadcastWarnOnceToDevtools(key, payload);
-}
-function payloadField(payload, key, fallback = "") {
-  const value = payload[key];
-  if (typeof value === "string") return value;
-  if (typeof value === "number" || typeof value === "boolean") return String(value);
-  return fallback;
-}
-function randomDevtoolsId() {
-  return `warn-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`;
-}
-function broadcastWarnOnceToDevtools(key, payload) {
-  void import("./broadcast-LUMOJIJT.js").then(({ broadcastCsrfWarn, broadcastError }) => {
-    if (payload.event === "csrf.warn" && typeof payload.code === "string" && typeof payload.docsUrl === "string") {
-      broadcastCsrfWarn({
-        event: "csrf.warn",
-        code: payload.code,
-        docsUrl: payload.docsUrl,
-        method: payloadField(payload, "method"),
-        path: payloadField(payload, "path"),
-        reason: payloadField(payload, "reason")
-      });
-    } else {
-      broadcastError({
-        id: randomDevtoolsId(),
-        type: "console",
-        message: payloadField(payload, "event", key),
-        timestamp: Date.now()
-      });
-    }
-  }).catch(() => {
-  });
-}
-
-// src/server/http/send-response.ts
-function sendJson(res, data, status = 200, transformer) {
-  const body = transformer ? transformer.serialize(data) : JSON.stringify(data);
-  res.writeHead(status, {
-    "Content-Type": "application/json",
-    "Content-Length": Buffer.byteLength(body)
-  });
-  res.end(body);
-}
-function sendError(res, codeOrInput, message, status, issues, requestId, options) {
-  let code;
-  if (typeof codeOrInput === "string") {
-    code = codeOrInput;
-    message = message ?? "";
-    status = status ?? 500;
-  } else {
-    code = codeOrInput.code;
-    message = codeOrInput.message;
-    status = codeOrInput.status;
-    issues = codeOrInput.issues;
-    requestId = codeOrInput.requestId;
-    options = codeOrInput.options;
-  }
-  const errorMessage = code === "INTERNAL_ERROR" && process.env.NODE_ENV === "production" ? "Internal server error" : message;
-  if (code === "INTERNAL_ERROR") {
-    console.error(`[${requestId ?? "no-id"}] ${message}`);
-  }
-  if (status === 404 && options?.custom404Html) {
-    const body = options.custom404Html;
-    res.writeHead(404, {
-      "Content-Type": "text/html; charset=utf-8",
-      "Content-Length": Buffer.byteLength(body)
-    });
-    res.end(body);
-    return;
-  }
-  if (status === 500 && options?.custom500Html) {
-    const body = options.custom500Html;
-    res.writeHead(500, {
-      "Content-Type": "text/html; charset=utf-8",
-      "Content-Length": Buffer.byteLength(body)
-    });
-    res.end(body);
-    return;
-  }
-  sendJson(
-    res,
-    {
-      error: {
-        code,
-        message: errorMessage,
-        ...requestId ? { requestId } : {},
-        ...issues ? { issues } : {}
-      }
-    },
-    status
-  );
-}
-
-// src/server/http/node-request.ts
-import { Readable } from "stream";
-function pickHeaderString(value) {
-  if (typeof value === "string") return value;
-  if (Array.isArray(value)) {
-    for (const v of value) if (typeof v === "string" && v.length > 0) return v;
-  }
-  return void 0;
-}
-function synthesizeAbsoluteUrl(req) {
-  const host = pickHeaderString(req.headers.host) ?? "localhost";
-  return `http://${host}${req.url ?? "/"}`;
-}
-function nodeHeadersToWeb(req) {
-  const headers = new Headers();
-  for (const [key, value] of Object.entries(req.headers)) {
-    if (value === void 0) continue;
-    if (Array.isArray(value)) {
-      headers.set(key, value.join(", "));
-    } else {
-      headers.set(key, value);
-    }
-  }
-  return headers;
-}
-function incomingMessageToWebRequest(req) {
-  const url = synthesizeAbsoluteUrl(req);
-  const headers = nodeHeadersToWeb(req);
-  const method = (req.method ?? "GET").toUpperCase();
-  const hasBody = method !== "GET" && method !== "HEAD";
-  if (!hasBody) {
-    return new Request(url, { method, headers });
-  }
-  const webStream = Readable.toWeb(req);
-  return new Request(url, {
-    method,
-    headers,
-    body: webStream,
-    // EC-2: Node 18+ requires `duplex: 'half'` when body is a stream.
-    // The `RequestInit` type omits it (Web spec gap); cast accordingly.
-    ...{ duplex: "half" }
-  });
-}
-function incomingMessageToHandlerRequest(req) {
-  return new Request(synthesizeAbsoluteUrl(req), {
-    method: (req.method ?? "GET").toUpperCase(),
-    headers: nodeHeadersToWeb(req)
-  });
-}
-
 // src/core/contracts/auth-error-guard.ts
 function isAuthRequiredError(err) {
   if (err == null || typeof err !== "object") return false;
@@ -488,119 +125,6 @@ function createOutboxDispatcher(backend) {
   };
 }
 
-// src/server/security/csrf-warn-dispatch.ts
-function dispatchCsrfWarn(payload) {
-  const key = `${payload.event}:${payload.method}:${payload.path ?? ""}`;
-  warnOnce(key, payload);
-}
-
-// src/server/observability/audit-log.ts
-function safeAudit(logger, event) {
-  if (!logger) return;
-  try {
-    const r = logger.log(event);
-    if (r && typeof r.then === "function") {
-      r.catch(() => {
-      });
-    }
-  } catch {
-  }
-}
-
-// src/server/security/csrf.ts
-function matchDisallowed(path, patterns) {
-  for (const p of patterns) {
-    if (typeof p === "string") {
-      if (path === p) return true;
-    } else if (p instanceof RegExp) {
-      p.lastIndex = 0;
-      if (p.test(path)) return true;
-    }
-  }
-  return false;
-}
-var CSRF_WARN_CODE = "CSRF_STRICT_CUTOVER";
-var CSRF_WARN_DOCS_URL = "https://theokit.dev/upgrade/csrf-strict-cutover";
-function pickHeader(value) {
-  if (typeof value === "string") return value;
-  if (Array.isArray(value) && value.length > 0) return value[0];
-  return "";
-}
-function isCsrfValidFromHeaders(opts) {
-  if (opts.csrfActionHeader !== "1") {
-    return { valid: false, reason: "Missing X-Theo-Action header" };
-  }
-  if (opts.origin === null || opts.origin === "") {
-    return { valid: true };
-  }
-  if (opts.host === null || opts.host === "") {
-    return { valid: true };
-  }
-  try {
-    const originHost = new URL(opts.origin).host;
-    if (originHost !== opts.host) {
-      return { valid: false, reason: `Origin ${opts.origin} does not match host ${opts.host}` };
-    }
-  } catch {
-    return { valid: false, reason: `Invalid origin: ${opts.origin}` };
-  }
-  return { valid: true };
-}
-function validateCsrf(req) {
-  const action = req.headers["x-theo-action"];
-  const origin = req.headers.origin;
-  const host = req.headers.host;
-  return isCsrfValidFromHeaders({
-    csrfActionHeader: typeof action === "string" ? action : null,
-    origin: origin !== void 0 ? pickHeader(origin) || null : null,
-    host: host !== void 0 ? pickHeader(host) || null : null
-  });
-}
-function validateCsrfRequest(request) {
-  return isCsrfValidFromHeaders({
-    csrfActionHeader: request.headers.get("x-theo-action"),
-    origin: request.headers.get("origin"),
-    host: request.headers.get("host")
-  });
-}
-function dispatchCsrfWarn2(req, reason, logger, auditLogger, pathFallback = "") {
-  const payload = {
-    event: "csrf.warn",
-    method: req.method ?? "UNKNOWN",
-    path: logger?.path ?? pathFallback,
-    reason,
-    code: CSRF_WARN_CODE,
-    docsUrl: CSRF_WARN_DOCS_URL
-  };
-  logger?.warn(payload);
-  safeAudit(auditLogger, {
-    action: "csrf.warn",
-    actor: { type: "anonymous" },
-    metadata: { ...payload }
-  });
-}
-function enforceCsrf(req, mode, logger, disallowed, auditLogger) {
-  if (mode === "off") {
-    return { allow: true };
-  }
-  const check = validateCsrf(req);
-  if (check.valid) {
-    return { allow: true };
-  }
-  if (disallowed?.behavior === "raise") {
-    const path = logger?.path ?? req.url ?? "";
-    if (matchDisallowed(path, disallowed.routes)) {
-      return { allow: false, reason: check.reason };
-    }
-  }
-  if (mode === "warn") {
-    dispatchCsrfWarn2(req, check.reason, logger, auditLogger);
-    return { allow: true, reason: check.reason };
-  }
-  dispatchCsrfWarn2(req, check.reason, logger, auditLogger);
-  return { allow: false, reason: check.reason };
-}
-
 // src/server/http/execute-stages.ts
 async function parseQueryAndBody(req, res, requestId) {
   const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
@@ -1515,7 +1039,7 @@ function writeSerialized(res, serialized) {
 async function emitActionCallTelemetry(name, startedAt, input, outcome) {
   if (!__IS_DEV) return;
   try {
-    const mod = await import("./dispatcher-EJHL6JMJ.js");
+    const mod = await import("./dispatcher-KMZBGMM5.js");
     mod.dispatcher.onActionCall({
       // eslint-disable-next-line sonarjs/pseudo-random -- non-secret correlation id
       id: `act-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`,
@@ -2272,9 +1796,14 @@ function resolveDiscoveryCwd(compiled, projectRoot) {
   const optedIn = (compiled.settingSources?.length ?? 0) > 0;
   return projectRoot !== void 0 && optedIn ? projectRoot : void 0;
 }
+function trimTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value[end - 1] === "/") end -= 1;
+  return value.slice(0, end);
+}
 function resolveSessionBaseDir(projectRoot) {
   if (projectRoot === void 0) return void 0;
-  return `${projectRoot.replace(/\/+$/, "")}/.data/agent-sessions`;
+  return `${trimTrailingSlashes(projectRoot)}/.data/agent-sessions`;
 }
 
 // src/server/scan/module-loader.ts
@@ -2372,15 +1901,6 @@ function generateNonce() {
 }
 
 export {
-  logRequest,
-  warnOnce,
-  dispatchCsrfWarn,
-  safeAudit,
-  validateCsrfRequest,
-  enforceCsrf,
-  sendError,
-  incomingMessageToWebRequest,
-  incomingMessageToHandlerRequest,
   executeRoute,
   executeAction,
   findSuggestion,
@@ -2402,4 +1922,4 @@ export {
   applySecurityHeaders,
   generateNonce
 };
-//# sourceMappingURL=chunk-UNLG36Z5.js.map
+//# sourceMappingURL=chunk-Q5OT7LZG.js.map