theokit 0.43.7 → 0.44.3

package/dist/chunk-FXZZS7YW.js

@@ -0,0 +1,605 @@
+#!/usr/bin/env node
+import "tsx/esm";
+
+// src/server/body-parser.ts
+import { basename } from "path";
+import Busboy from "busboy";
+var METHODS_WITH_BODY = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH"]);
+var DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024;
+var DEFAULT_MAX_FILES = 10;
+var DEFAULT_MAX_FIELD_SIZE = 1 * 1024 * 1024;
+var FileTooLargeError = class extends Error {
+  constructor(message, truncatedFilenames, maxFileSize) {
+    super(message);
+    this.truncatedFilenames = truncatedFilenames;
+    this.maxFileSize = maxFileSize;
+    this.name = "FileTooLargeError";
+  }
+  truncatedFilenames;
+  maxFileSize;
+  code = "FILE_TOO_LARGE";
+  status = 413;
+};
+function stashBodyPreview(req, body) {
+  try {
+    ;
+    req[DEVTOOLS_BODY_PREVIEW] = body;
+  } catch {
+  }
+}
+function parseJsonBody(req) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    req.on("data", (chunk) => chunks.push(chunk));
+    req.on("end", () => {
+      const raw = Buffer.concat(chunks).toString();
+      if (!raw) {
+        resolve(void 0);
+        return;
+      }
+      try {
+        resolve(JSON.parse(raw));
+      } catch {
+        reject(new Error("Invalid JSON body"));
+      }
+    });
+    req.on("error", reject);
+  });
+}
+function parseMultipartBody(req, contentType, options) {
+  if (!contentType.includes("boundary=")) {
+    return Promise.reject(new Error("Missing multipart boundary"));
+  }
+  return new Promise((resolve, reject) => {
+    const fields = {};
+    const files = [];
+    const truncatedFilenames = [];
+    let fileCount = 0;
+    const bb = Busboy({
+      headers: req.headers,
+      limits: {
+        fileSize: options.maxFileSize,
+        files: options.maxFiles,
+        fieldSize: options.maxFieldSize
+      }
+    });
+    bb.on("field", (name, value) => {
+      fields[name] = value;
+    });
+    bb.on(
+      "file",
+      (fieldname, stream, info) => {
+        fileCount++;
+        if (fileCount > options.maxFiles) {
+          stream.resume();
+          return;
+        }
+        const safeName = basename(info.filename || "unnamed");
+        const chunks = [];
+        let size = 0;
+        let truncated = false;
+        stream.on("data", (chunk) => {
+          size += chunk.length;
+          if (size > options.maxFileSize) {
+            truncated = true;
+            stream.resume();
+            return;
+          }
+          chunks.push(chunk);
+        });
+        stream.on("end", () => {
+          if (truncated) {
+            truncatedFilenames.push(safeName);
+            return;
+          }
+          const buffer = Buffer.concat(chunks);
+          files.push({
+            fieldname,
+            filename: safeName,
+            encoding: info.encoding,
+            mimeType: info.mimeType,
+            buffer,
+            size: buffer.length
+          });
+        });
+      }
+    );
+    bb.on("filesLimit", () => {
+      reject(new Error(`Too many files. Maximum: ${options.maxFiles}`));
+    });
+    bb.on("error", (err) => {
+      reject(err);
+    });
+    bb.on("close", () => {
+      if (truncatedFilenames.length > 0) {
+        reject(
+          new FileTooLargeError(
+            `File too large (max ${options.maxFileSize} bytes): ${truncatedFilenames.join(", ")}`,
+            truncatedFilenames,
+            options.maxFileSize
+          )
+        );
+        return;
+      }
+      resolve({ fields, files });
+    });
+    req.pipe(bb);
+  });
+}
+var DEVTOOLS_BODY_PREVIEW = /* @__PURE__ */ Symbol("theo:devtools:bodyPreview");
+async function parseRequestBody(req, options) {
+  const method = req.method?.toUpperCase() ?? "GET";
+  if (!METHODS_WITH_BODY.has(method)) {
+    return { fields: {}, files: [], json: void 0 };
+  }
+  const contentType = req.headers["content-type"] ?? "";
+  if (contentType.includes("application/json")) {
+    const json = await parseJsonBody(req);
+    stashBodyPreview(req, json);
+    return { fields: {}, files: [], json };
+  }
+  if (contentType.includes("multipart/form-data")) {
+    const limits = {
+      maxFileSize: options?.maxFileSize ?? DEFAULT_MAX_FILE_SIZE,
+      maxFiles: options?.maxFiles ?? DEFAULT_MAX_FILES,
+      maxFieldSize: options?.maxFieldSize ?? DEFAULT_MAX_FIELD_SIZE
+    };
+    const { fields, files } = await parseMultipartBody(req, contentType, limits);
+    stashBodyPreview(req, {
+      fields,
+      files: files.map((f) => ({
+        fieldname: f.fieldname,
+        filename: f.filename,
+        mimeType: f.mimeType,
+        size: f.size
+      }))
+    });
+    return { fields, files };
+  }
+  if (!contentType) {
+    return { fields: {}, files: [] };
+  }
+  throw new Error(`Unsupported Content-Type: ${contentType}`);
+}
+
+// src/server/observability/request-log.ts
+var defaultLoggerFn = (log) => {
+  console.log(JSON.stringify(log));
+};
+function logRequest(info, customLogger, req) {
+  const log = {
+    level: "info",
+    ...info,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const logger = customLogger ?? defaultLoggerFn;
+  logger(log);
+  broadcastRequestToDevtools(info, req);
+}
+function randomRequestId() {
+  return `req-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`;
+}
+function broadcastToDevtoolsCore(info, headers, stashedBody) {
+  void Promise.all([
+    import("./broadcast-LUMOJIJT.js"),
+    import("./build-request-body-preview-XPZ2GYMG.js")
+  ]).then(([{ broadcastRequest }, { buildRequestBodyPreview }]) => {
+    const bodyInfo = buildRequestBodyPreview(stashedBody);
+    broadcastRequest({
+      id: randomRequestId(),
+      traceId: info.requestId,
+      method: info.method,
+      path: info.url,
+      status: info.status,
+      durationMs: info.duration,
+      startedAt: Date.now() - info.duration,
+      ...headers ? { headers } : {},
+      ...bodyInfo ? {
+        bodyPreview: bodyInfo.preview,
+        bodyLength: bodyInfo.length,
+        bodyTruncated: bodyInfo.truncated
+      } : {}
+    });
+  }).catch(() => {
+  });
+}
+function broadcastRequestToDevtools(info, req) {
+  const headers = req?.headers ? Object.fromEntries(
+    Object.entries(req.headers).map(([k, v]) => [
+      k,
+      Array.isArray(v) ? v.join(", ") : v ?? ""
+    ])
+  ) : void 0;
+  const stashedBody = req ? req[DEVTOOLS_BODY_PREVIEW] : void 0;
+  broadcastToDevtoolsCore(info, headers, stashedBody);
+}
+
+// src/server/observability/logger.ts
+var _warnOnceSeen = /* @__PURE__ */ new Set();
+var MAX_SEEN = 1024;
+function warnOnce(key, payload) {
+  if (_warnOnceSeen.has(key)) return;
+  if (_warnOnceSeen.size >= MAX_SEEN) {
+    const oldest = _warnOnceSeen.values().next().value;
+    if (oldest !== void 0) _warnOnceSeen.delete(oldest);
+  }
+  _warnOnceSeen.add(key);
+  let line;
+  try {
+    line = JSON.stringify({ ...payload, warnOnce: true });
+  } catch {
+    line = `[warnOnce] ${key} \u2014 (payload could not be serialized)`;
+  }
+  console.warn(line);
+  broadcastWarnOnceToDevtools(key, payload);
+}
+function payloadField(payload, key, fallback = "") {
+  const value = payload[key];
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  return fallback;
+}
+function randomDevtoolsId() {
+  return `warn-${String(Date.now())}-${Math.random().toString(36).slice(2, 8)}`;
+}
+function broadcastWarnOnceToDevtools(key, payload) {
+  void import("./broadcast-LUMOJIJT.js").then(({ broadcastCsrfWarn, broadcastError }) => {
+    if (payload.event === "csrf.warn" && typeof payload.code === "string" && typeof payload.docsUrl === "string") {
+      broadcastCsrfWarn({
+        event: "csrf.warn",
+        code: payload.code,
+        docsUrl: payload.docsUrl,
+        method: payloadField(payload, "method"),
+        path: payloadField(payload, "path"),
+        reason: payloadField(payload, "reason")
+      });
+    } else {
+      broadcastError({
+        id: randomDevtoolsId(),
+        type: "console",
+        message: payloadField(payload, "event", key),
+        timestamp: Date.now()
+      });
+    }
+  }).catch(() => {
+  });
+}
+
+// src/server/http/send-response.ts
+function sendJson(res, data, status = 200, transformer) {
+  const body = transformer ? transformer.serialize(data) : JSON.stringify(data);
+  res.writeHead(status, {
+    "Content-Type": "application/json",
+    "Content-Length": Buffer.byteLength(body)
+  });
+  res.end(body);
+}
+function sendError(res, codeOrInput, message, status, issues, requestId, options) {
+  let code;
+  if (typeof codeOrInput === "string") {
+    code = codeOrInput;
+    message = message ?? "";
+    status = status ?? 500;
+  } else {
+    code = codeOrInput.code;
+    message = codeOrInput.message;
+    status = codeOrInput.status;
+    issues = codeOrInput.issues;
+    requestId = codeOrInput.requestId;
+    options = codeOrInput.options;
+  }
+  const errorMessage = code === "INTERNAL_ERROR" && process.env.NODE_ENV === "production" ? "Internal server error" : message;
+  if (code === "INTERNAL_ERROR") {
+    console.error(`[${requestId ?? "no-id"}] ${message}`);
+  }
+  if (status === 404 && options?.custom404Html) {
+    const body = options.custom404Html;
+    res.writeHead(404, {
+      "Content-Type": "text/html; charset=utf-8",
+      "Content-Length": Buffer.byteLength(body)
+    });
+    res.end(body);
+    return;
+  }
+  if (status === 500 && options?.custom500Html) {
+    const body = options.custom500Html;
+    res.writeHead(500, {
+      "Content-Type": "text/html; charset=utf-8",
+      "Content-Length": Buffer.byteLength(body)
+    });
+    res.end(body);
+    return;
+  }
+  sendJson(
+    res,
+    {
+      error: {
+        code,
+        message: errorMessage,
+        ...requestId ? { requestId } : {},
+        ...issues ? { issues } : {}
+      }
+    },
+    status
+  );
+}
+
+// src/server/http/node-request.ts
+import { Readable } from "stream";
+function pickHeaderString(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) {
+    for (const v of value) if (typeof v === "string" && v.length > 0) return v;
+  }
+  return void 0;
+}
+function synthesizeAbsoluteUrl(req) {
+  const host = pickHeaderString(req.headers.host) ?? "localhost";
+  return `http://${host}${req.url ?? "/"}`;
+}
+function nodeHeadersToWeb(req) {
+  const headers = new Headers();
+  for (const [key, value] of Object.entries(req.headers)) {
+    if (value === void 0) continue;
+    if (Array.isArray(value)) {
+      headers.set(key, value.join(", "));
+    } else {
+      headers.set(key, value);
+    }
+  }
+  return headers;
+}
+function incomingMessageToWebRequest(req) {
+  const url = synthesizeAbsoluteUrl(req);
+  const headers = nodeHeadersToWeb(req);
+  const method = (req.method ?? "GET").toUpperCase();
+  const hasBody = method !== "GET" && method !== "HEAD";
+  if (!hasBody) {
+    return new Request(url, { method, headers });
+  }
+  const webStream = Readable.toWeb(req);
+  return new Request(url, {
+    method,
+    headers,
+    body: webStream,
+    // EC-2: Node 18+ requires `duplex: 'half'` when body is a stream.
+    // The `RequestInit` type omits it (Web spec gap); cast accordingly.
+    ...{ duplex: "half" }
+  });
+}
+function incomingMessageToHandlerRequest(req) {
+  return new Request(synthesizeAbsoluteUrl(req), {
+    method: (req.method ?? "GET").toUpperCase(),
+    headers: nodeHeadersToWeb(req)
+  });
+}
+
+// src/server/http/controller-dispatch.ts
+import { readdirSync } from "fs";
+import { join } from "path";
+import { createDecoratorHandler, isControllerClass } from "@theokit/http";
+
+// src/server/security/csrf-warn-dispatch.ts
+function dispatchCsrfWarn(payload) {
+  const key = `${payload.event}:${payload.method}:${payload.path ?? ""}`;
+  warnOnce(key, payload);
+}
+
+// src/server/observability/audit-log.ts
+function safeAudit(logger, event) {
+  if (!logger) return;
+  try {
+    const r = logger.log(event);
+    if (r && typeof r.then === "function") {
+      r.catch(() => {
+      });
+    }
+  } catch {
+  }
+}
+
+// src/server/security/csrf.ts
+function matchDisallowed(path, patterns) {
+  for (const p of patterns) {
+    if (typeof p === "string") {
+      if (path === p) return true;
+    } else if (p instanceof RegExp) {
+      p.lastIndex = 0;
+      if (p.test(path)) return true;
+    }
+  }
+  return false;
+}
+var CSRF_WARN_CODE = "CSRF_STRICT_CUTOVER";
+var CSRF_WARN_DOCS_URL = "https://theokit.dev/upgrade/csrf-strict-cutover";
+function pickHeader(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value) && value.length > 0) return value[0];
+  return "";
+}
+function isCsrfValidFromHeaders(opts) {
+  if (opts.csrfActionHeader !== "1") {
+    return { valid: false, reason: "Missing X-Theo-Action header" };
+  }
+  if (opts.origin === null || opts.origin === "") {
+    return { valid: true };
+  }
+  if (opts.host === null || opts.host === "") {
+    return { valid: true };
+  }
+  try {
+    const originHost = new URL(opts.origin).host;
+    if (originHost !== opts.host) {
+      return { valid: false, reason: `Origin ${opts.origin} does not match host ${opts.host}` };
+    }
+  } catch {
+    return { valid: false, reason: `Invalid origin: ${opts.origin}` };
+  }
+  return { valid: true };
+}
+function validateCsrf(req) {
+  const action = req.headers["x-theo-action"];
+  const origin = req.headers.origin;
+  const host = req.headers.host;
+  return isCsrfValidFromHeaders({
+    csrfActionHeader: typeof action === "string" ? action : null,
+    origin: origin !== void 0 ? pickHeader(origin) || null : null,
+    host: host !== void 0 ? pickHeader(host) || null : null
+  });
+}
+function validateCsrfRequest(request) {
+  return isCsrfValidFromHeaders({
+    csrfActionHeader: request.headers.get("x-theo-action"),
+    origin: request.headers.get("origin"),
+    host: request.headers.get("host")
+  });
+}
+function dispatchCsrfWarn2(req, reason, logger, auditLogger, pathFallback = "") {
+  const payload = {
+    event: "csrf.warn",
+    method: req.method ?? "UNKNOWN",
+    path: logger?.path ?? pathFallback,
+    reason,
+    code: CSRF_WARN_CODE,
+    docsUrl: CSRF_WARN_DOCS_URL
+  };
+  logger?.warn(payload);
+  safeAudit(auditLogger, {
+    action: "csrf.warn",
+    actor: { type: "anonymous" },
+    metadata: { ...payload }
+  });
+}
+function enforceCsrf(req, mode, logger, disallowed, auditLogger) {
+  if (mode === "off") {
+    return { allow: true };
+  }
+  const check = validateCsrf(req);
+  if (check.valid) {
+    return { allow: true };
+  }
+  if (disallowed?.behavior === "raise") {
+    const path = logger?.path ?? req.url ?? "";
+    if (matchDisallowed(path, disallowed.routes)) {
+      return { allow: false, reason: check.reason };
+    }
+  }
+  if (mode === "warn") {
+    dispatchCsrfWarn2(req, check.reason, logger, auditLogger);
+    return { allow: true, reason: check.reason };
+  }
+  dispatchCsrfWarn2(req, check.reason, logger, auditLogger);
+  return { allow: false, reason: check.reason };
+}
+
+// src/server/http/controller-dispatch.ts
+var CSRF_PROTECTED_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+function findControllerFiles(dir) {
+  const found = [];
+  const walk = (current) => {
+    let entries;
+    try {
+      entries = readdirSync(current, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const full = join(current, entry.name);
+      if (entry.isDirectory()) walk(full);
+      else if (entry.name.endsWith(".controller.ts") || entry.name.endsWith(".controller.mjs"))
+        found.push(full);
+    }
+  };
+  walk(dir);
+  return found;
+}
+async function scanControllerModules(controllersDir, loadModule) {
+  const files = findControllerFiles(controllersDir);
+  const modules = [];
+  for (const filePath of files) {
+    const mod = await loadModule(filePath);
+    for (const exported of Object.values(mod)) {
+      if (typeof exported === "function" && isControllerClass(exported)) {
+        modules.push({ filePath, cls: exported, exports: mod });
+      }
+    }
+  }
+  return modules;
+}
+async function scanControllers(controllersDir, loadModule) {
+  const modules = await scanControllerModules(controllersDir, loadModule);
+  return modules.map((m) => m.cls);
+}
+async function createControllerDispatcher(opts) {
+  const classes = await scanControllers(opts.controllersDir, opts.loadModule);
+  if (classes.length === 0) return null;
+  const handle = createDecoratorHandler({ controllers: classes, serveAgent: opts.serveAgent });
+  return {
+    dispatch: (request) => handle(request),
+    matches: (method, pathname) => handle.matches(method, pathname)
+  };
+}
+async function writeControllerResponse(res, response) {
+  const headersBag = {};
+  for (const [k, v] of response.headers) {
+    if (k.toLowerCase() !== "set-cookie") headersBag[k] = v;
+  }
+  const setCookies = response.headers.getSetCookie();
+  if (setCookies.length > 0) res.setHeader("Set-Cookie", setCookies);
+  res.writeHead(response.status, headersBag);
+  const body = response.body ? await response.text() : "";
+  res.end(body || void 0);
+}
+async function dispatchControllerRequest(args) {
+  const { req, res, csrfMode, disallowed, requestId } = args;
+  const dispatcher = await createControllerDispatcher({
+    controllersDir: args.controllersDir,
+    loadModule: args.loadModule,
+    serveAgent: args.serveAgent
+  });
+  if (!dispatcher) return false;
+  const method = (req.method ?? "GET").toUpperCase();
+  const webRequest = incomingMessageToWebRequest(req);
+  const pathname = new URL(webRequest.url).pathname;
+  if (CSRF_PROTECTED_METHODS.has(method) && dispatcher.matches(method, pathname)) {
+    const decision = enforceCsrf(
+      req,
+      csrfMode,
+      { warn: dispatchCsrfWarn, path: req.url },
+      disallowed
+    );
+    if (!decision.allow) {
+      sendError(
+        res,
+        "CSRF_INVALID",
+        decision.reason ?? "CSRF check failed",
+        403,
+        void 0,
+        requestId
+      );
+      return true;
+    }
+  }
+  const response = await dispatcher.dispatch(webRequest);
+  if (response === null) return false;
+  await writeControllerResponse(res, response);
+  return true;
+}
+
+export {
+  parseRequestBody,
+  logRequest,
+  warnOnce,
+  dispatchCsrfWarn,
+  safeAudit,
+  validateCsrfRequest,
+  enforceCsrf,
+  sendJson,
+  sendError,
+  incomingMessageToWebRequest,
+  incomingMessageToHandlerRequest,
+  findControllerFiles,
+  scanControllerModules,
+  dispatchControllerRequest
+};
+//# sourceMappingURL=chunk-FXZZS7YW.js.map