theokit 0.48.13 → 0.50.0

package/dist/{chunk-XALU5LCU.js → chunk-RWNYIU6A.js}

@@ -5,15 +5,17 @@ import {
   createQueueClient
 } from "./chunk-47FFT43U.js";
 import {
+  RequestBodyConsumedError,
   parseRequestBody,
   warnOnce
-} from "./chunk-KD5G3YXI.js";
+} from "./chunk-72DMJBXI.js";
 import {
   scanMiddlewares
-} from "./chunk-FB2HBNIC.js";
+} from "./chunk-BX6EUYHU.js";
 import {
-  enforceCsrf
-} from "./chunk-OLGPYOLO.js";
+  enforceCsrf,
+  validateCsrfRequest
+} from "./chunk-P6OS7652.js";
 import {
   envelopeCodeToStatus
 } from "./chunk-ACKBVBUI.js";
@@ -21,6 +23,13 @@ import {
   TheoError,
   serverErrorToEnvelope
 } from "./chunk-IZ3TIL6K.js";
+import {
+  WEB_SHAPED_MIDDLEWARE
+} from "./chunk-D4VP2QPR.js";
+import {
+  evaluateRoutePolicy,
+  subjectFromContext
+} from "./chunk-YN4W7LCX.js";
 
 // src/core/contracts/action-protocol.ts
 var CODE_TO_STATUS = {
@@ -188,6 +197,20 @@ function isInputError(value) {
   return value instanceof ActionInputError;
 }
 
+// src/core/contracts/client-safe-error.ts
+var INTERNAL_CODES = /* @__PURE__ */ new Set(["INTERNAL_ERROR", "INTERNAL_SERVER_ERROR"]);
+var GENERIC_INTERNAL_MESSAGE = "Internal server error";
+function redacts(code) {
+  return INTERNAL_CODES.has(code) && process.env.NODE_ENV === "production";
+}
+function clientSafeErrorMessage(code, message) {
+  return redacts(code) ? GENERIC_INTERNAL_MESSAGE : message;
+}
+function clientSafeErrorEnvelope(envelope) {
+  if (!redacts(envelope.code)) return envelope;
+  return { code: envelope.code, message: GENERIC_INTERNAL_MESSAGE };
+}
+
 // src/server/http/send-response.ts
 function sendJson(res, data, status = 200, transformer) {
   const body = transformer ? transformer.serialize(data) : JSON.stringify(data);
@@ -197,6 +220,9 @@ function sendJson(res, data, status = 200, transformer) {
   });
   res.end(body);
 }
+function oneLine(value) {
+  return value.replace(/[\r\n]/g, "\\n");
+}
 function sendError(res, codeOrInput, message, status, issues, requestId, options) {
   let code;
   if (typeof codeOrInput === "string") {
@@ -211,9 +237,9 @@ function sendError(res, codeOrInput, message, status, issues, requestId, options
     requestId = codeOrInput.requestId;
     options = codeOrInput.options;
   }
-  const errorMessage = code === "INTERNAL_ERROR" && process.env.NODE_ENV === "production" ? "Internal server error" : message;
+  const errorMessage = clientSafeErrorMessage(code, message);
   if (code === "INTERNAL_ERROR") {
-    console.error(`[${requestId ?? "no-id"}] ${message}`);
+    console.error(`[${oneLine(requestId ?? "no-id")}] ${oneLine(message)}`);
   }
   if (status === 404 && options?.custom404Html) {
     const body = options.custom404Html;
@@ -247,74 +273,6 @@ function sendError(res, codeOrInput, message, status, issues, requestId, options
   );
 }
 
-// src/server/http/middleware-runner.ts
-import { existsSync } from "fs";
-import { join } from "path";
-var middlewareCache = /* @__PURE__ */ new Map();
-function _resetMiddlewareCacheForTests() {
-  middlewareCache.clear();
-}
-function getCachedScan(serverDir) {
-  let cached = middlewareCache.get(serverDir);
-  if (!cached) {
-    const singleFilePath = join(serverDir, "middleware.ts");
-    cached = {
-      singleFilePath,
-      singleFileExists: existsSync(singleFilePath),
-      dirMiddlewares: scanMiddlewares(serverDir)
-    };
-    middlewareCache.set(serverDir, cached);
-  }
-  return cached;
-}
-async function runOneMiddleware(mw, req, res) {
-  const state = { nextCalled: false };
-  await mw(req, res, () => {
-    state.nextCalled = true;
-  });
-  return state;
-}
-async function runMiddlewareAndContext(req, res, loadModule, serverDir) {
-  const { singleFilePath, singleFileExists, dirMiddlewares } = getCachedScan(serverDir);
-  const dirExists = dirMiddlewares.length > 0;
-  if (singleFileExists && dirExists) {
-    throw new Error(
-      "Ambiguous middleware configuration: found both server/middleware.ts and server/middleware/ directory. Use one or the other, not both."
-    );
-  }
-  if (dirExists) {
-    for (const mwPath of dirMiddlewares) {
-      const mod = await loadModule(mwPath);
-      const mw = mod.default;
-      if (typeof mw !== "function") continue;
-      const { nextCalled } = await runOneMiddleware(mw, req, res);
-      if (!nextCalled || res.writableEnded) {
-        return { ctx: {}, aborted: true };
-      }
-    }
-  }
-  if (singleFileExists) {
-    const mod = await loadModule(singleFilePath);
-    const mw = mod.default;
-    if (typeof mw === "function") {
-      const { nextCalled } = await runOneMiddleware(mw, req, res);
-      if (!nextCalled || res.writableEnded) {
-        return { ctx: {}, aborted: true };
-      }
-    }
-  }
-  let ctx = {};
-  const contextPath = join(serverDir, "context.ts");
-  if (existsSync(contextPath)) {
-    const mod = await loadModule(contextPath);
-    const createContext = mod.createContext;
-    if (typeof createContext === "function") {
-      ctx = await createContext({ request: req, response: res });
-    }
-  }
-  return { ctx, aborted: false };
-}
-
 // src/server/http/node-request.ts
 import { Readable } from "stream";
 function pickHeaderString(value) {
@@ -358,6 +316,13 @@ function incomingMessageToWebRequest(req) {
     ...{ duplex: "half" }
   });
 }
+function createWebRequestSource(req) {
+  let converted;
+  return {
+    method: (req.method ?? "GET").toUpperCase(),
+    toRequest: () => converted ??= incomingMessageToWebRequest(req)
+  };
+}
 function incomingMessageToHandlerRequest(req) {
   return new Request(synthesizeAbsoluteUrl(req), {
     method: (req.method ?? "GET").toUpperCase(),
@@ -365,17 +330,27 @@ function incomingMessageToHandlerRequest(req) {
   });
 }
 
-// src/core/contracts/auth-error-guard.ts
-function isAuthRequiredError(err) {
-  if (err == null || typeof err !== "object") return false;
-  const e = err;
-  return e.code === "AUTH_REQUIRED" && e.status === 401;
-}
-
-// src/server/security/csrf-warn-dispatch.ts
-function dispatchCsrfWarn(payload) {
-  const key = `${payload.event}:${payload.method}:${payload.path ?? ""}`;
-  warnOnce(key, payload);
+// src/server/http/validate-route-input.ts
+function validateRouteInput(config, raw) {
+  let query = raw.query;
+  if (config.query !== void 0) {
+    const parsed = config.query.safeParse(raw.query);
+    if (!parsed.success) return { ok: false, channel: "query", error: parsed.error };
+    query = parsed.data;
+  }
+  let body = raw.body;
+  if (config.body !== void 0) {
+    const parsed = config.body.safeParse(raw.body);
+    if (!parsed.success) return { ok: false, channel: "body", error: parsed.error };
+    body = parsed.data;
+  }
+  let params = raw.params;
+  if (config.params !== void 0) {
+    const parsed = config.params.safeParse(raw.params);
+    if (!parsed.success) return { ok: false, channel: "params", error: parsed.error };
+    params = parsed.data;
+  }
+  return { ok: true, query, body, params };
 }
 
 // src/server/http/execute-stages.ts
@@ -393,6 +368,10 @@ async function parseQueryAndBody(req, res, requestId) {
       body = void 0;
     }
   } catch (err) {
+    if (err instanceof RequestBodyConsumedError) {
+      sendError(res, "INTERNAL_ERROR", err.message, err.status, void 0, requestId);
+      return { ok: false };
+    }
     const message = err.message;
     const status = message.includes("Unsupported Content-Type") ? 415 : 400;
     sendError(res, "VALIDATION_ERROR", message, status, void 0, requestId);
@@ -452,8 +431,457 @@ function runZodValidation(routeConfig, res, requestId, input) {
   return { ok: true, data: { query, body, params } };
 }
 
-// src/server/http/execute.ts
+// src/server/http/web-middleware-runner.ts
+async function runWebMiddleware(request, middleware, context) {
+  for (const mw of middleware) {
+    const result = await mw(request, context);
+    if (result instanceof Response) return result;
+  }
+  return void 0;
+}
+
+// src/server/web-handler.ts
+function searchParamsToObject(params) {
+  const out = {};
+  for (const [key, value] of params.entries()) {
+    if (!Object.hasOwn(out, key)) {
+      out[key] = value;
+      continue;
+    }
+    const existing = out[key];
+    if (Array.isArray(existing)) {
+      existing.push(value);
+    } else {
+      out[key] = [existing, value];
+    }
+  }
+  return out;
+}
+async function parseBodyInline(request) {
+  if (request.method === "GET" || request.method === "HEAD") return void 0;
+  const contentType = request.headers.get("content-type") ?? "";
+  if (contentType.includes("application/json")) {
+    const text = await request.text();
+    if (text.length === 0) return void 0;
+    try {
+      return JSON.parse(text);
+    } catch {
+      return void 0;
+    }
+  }
+  if (contentType.startsWith("text/")) {
+    const text = await request.text();
+    return text.length === 0 ? void 0 : text;
+  }
+  return void 0;
+}
+async function parseBodyFull(request) {
+  if (request.method === "GET" || request.method === "HEAD") return void 0;
+  const { parseWebRequestBody } = await import("./body-parser-web-4Z2QTPDU.js");
+  try {
+    const parsed = await parseWebRequestBody(request);
+    if (parsed.json === void 0 && Object.keys(parsed.fields).length === 0 && parsed.files.length === 0) {
+      return void 0;
+    }
+    return parsed;
+  } catch {
+    return void 0;
+  }
+}
+function validationErrorResponse(zodError, field) {
+  const envelope = {
+    code: "BAD_REQUEST",
+    message: `Validation failed: ${field}`,
+    ext: {
+      fields: zodError.issues.map((issue) => ({
+        path: issue.path.join("."),
+        message: issue.message
+      }))
+    }
+  };
+  return new Response(JSON.stringify(envelope), {
+    status: 400,
+    headers: { "content-type": "application/json" }
+  });
+}
+async function runHandler(config, request, bodyParser = "inline", paramsInput = {}, context = {}) {
+  const url = new URL(request.url);
+  const queryRaw = searchParamsToObject(url.searchParams);
+  const bodyRaw = bodyParser === "full" ? await parseBodyFull(request) : await parseBodyInline(request);
+  const paramsRaw = paramsInput;
+  const validated = validateRouteInput(config, {
+    query: queryRaw,
+    body: bodyRaw,
+    params: paramsRaw
+  });
+  if (!validated.ok) {
+    return { ok: false, response: validationErrorResponse(validated.error, validated.channel) };
+  }
+  const { query, body, params } = validated;
+  const decision = await evaluateRoutePolicy(config.policy, {
+    subject: subjectFromContext(context),
+    query,
+    body,
+    params
+  });
+  if (!decision.allowed) {
+    return { ok: false, response: accessDeniedResponse(decision.reason) };
+  }
+  const result = await config.handler({ query, body, params, request, context });
+  return validateResponseOutput(config.response, result) ?? { ok: true, result };
+}
+function validateResponseOutput(response, result) {
+  const validatable = result !== void 0 && result !== null && !(result instanceof Response);
+  if (!validatable || !isZodLike(response)) return void 0;
+  const parsed = response.safeParse(result);
+  if (parsed.success) return { ok: true, result: parsed.data };
+  const err = new TheoError({
+    code: "INTERNAL_SERVER_ERROR",
+    message: "response validation failed",
+    ext: { issues: parsed.error?.issues }
+  });
+  return { ok: false, response: handlerErrorResponse(err) };
+}
+function toResponse(result, status) {
+  if (result === void 0) {
+    return new Response(null, { status: 204 });
+  }
+  if (result instanceof Response) {
+    return result;
+  }
+  return new Response(JSON.stringify(result), {
+    status: status ?? 200,
+    headers: { "content-type": "application/json" }
+  });
+}
+function handlerErrorResponse(err) {
+  const envelope = clientSafeErrorEnvelope(serverErrorToEnvelope(err));
+  const status = envelopeCodeToStatus(envelope.code);
+  return new Response(JSON.stringify(envelope), {
+    status,
+    headers: { "content-type": "application/json" }
+  });
+}
 var CSRF_PROTECTED_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+function mergeHookHeaders(response, hookHeaders) {
+  if ([...hookHeaders].length === 0) return response;
+  const merged = new Headers(response.headers);
+  for (const [k, v] of hookHeaders.entries()) {
+    if (k.toLowerCase() === "set-cookie") continue;
+    if (!merged.has(k)) merged.set(k, v);
+  }
+  for (const sc of hookHeaders.getSetCookie()) {
+    merged.append("Set-Cookie", sc);
+  }
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: merged
+  });
+}
+function methodNotAllowedResponse(method) {
+  const envelope = {
+    code: "METHOD_NOT_ALLOWED",
+    message: `Method ${method} not allowed`
+  };
+  return new Response(JSON.stringify(envelope), {
+    status: 405,
+    headers: { "content-type": "application/json" }
+  });
+}
+function shouldEnforceCsrf(method, config, csrfMode) {
+  if ((csrfMode ?? "strict") === "off") return false;
+  if (!CSRF_PROTECTED_METHODS.has(method)) return false;
+  return config?.csrf !== false;
+}
+function accessDeniedResponse(reason) {
+  const envelope = {
+    code: "FORBIDDEN",
+    message: `Access denied: ${reason}`
+  };
+  return new Response(JSON.stringify({ error: envelope }), {
+    status: 403,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function csrfFailedResponse(reason) {
+  const envelope = {
+    code: "FORBIDDEN",
+    message: `CSRF check failed: ${reason}`
+  };
+  return new Response(JSON.stringify(envelope), {
+    status: 403,
+    headers: { "content-type": "application/json" }
+  });
+}
+async function executeWebRequest(request, routeModule, opts = {}) {
+  const method = request.method.toUpperCase();
+  const config = routeModule[method];
+  if (opts.hooks === void 0) {
+    if (config === void 0 || typeof config.handler !== "function") {
+      return methodNotAllowedResponse(method);
+    }
+    if (shouldEnforceCsrf(method, config, opts.csrfMode)) {
+      const csrfCheck = validateCsrfRequest(request);
+      if (!csrfCheck.valid) return csrfFailedResponse(csrfCheck.reason);
+    }
+    try {
+      const context = {};
+      if (opts.middleware?.length) {
+        const shortCircuit = await runWebMiddleware(request, opts.middleware, context);
+        if (shortCircuit) return shortCircuit;
+      }
+      const outcome = await runHandler(
+        config,
+        request,
+        opts.bodyParser ?? "inline",
+        opts.params ?? {},
+        context
+      );
+      if (!outcome.ok) return outcome.response;
+      return toResponse(outcome.result, config.status);
+    } catch (err) {
+      return handlerErrorResponse(err);
+    }
+  }
+  return runWithHooks(request, config, opts, opts.hooks);
+}
+async function runPreHandlerPipeline(hookCtx, request, config, opts, hooks) {
+  const method = request.method.toUpperCase();
+  const runList = async (list) => {
+    for (const hook of list) {
+      if (hookCtx.response !== void 0) return;
+      await hook(hookCtx);
+    }
+  };
+  if (hooks.onRequest) await runList(hooks.onRequest);
+  if (hookCtx.response === void 0 && shouldEnforceCsrf(method, config, opts.csrfMode)) {
+    const csrfCheck = validateCsrfRequest(request);
+    if (!csrfCheck.valid) hookCtx.response = csrfFailedResponse(csrfCheck.reason);
+  }
+  if (hookCtx.response === void 0 && hooks.preHandler) {
+    await runList(hooks.preHandler);
+  }
+  if (hookCtx.response === void 0) {
+    await runHandlerStage(hookCtx, request, config, opts, method);
+  }
+}
+async function runHandlerStage(hookCtx, request, config, opts, method) {
+  if (config === void 0 || typeof config.handler !== "function") {
+    hookCtx.response = methodNotAllowedResponse(method);
+    return;
+  }
+  if (opts.middleware?.length) {
+    const shortCircuit = await runWebMiddleware(request, opts.middleware, hookCtx.ctx);
+    if (shortCircuit) {
+      hookCtx.response = shortCircuit;
+      return;
+    }
+  }
+  const outcome = await runHandler(
+    config,
+    request,
+    opts.bodyParser ?? "inline",
+    opts.params ?? {},
+    hookCtx.ctx
+  );
+  hookCtx.response = outcome.ok ? toResponse(outcome.result, config.status) : outcome.response;
+}
+async function runWithHooks(request, config, opts, hooks) {
+  const hookCtx = {
+    request,
+    responseHeaders: new Headers(),
+    ctx: {},
+    requestId: opts.requestId ?? globalThis.crypto.randomUUID()
+  };
+  try {
+    await runPreHandlerPipeline(hookCtx, request, config, opts, hooks);
+    if (hooks.onResponse) {
+      for (const hook of hooks.onResponse) {
+        await hook(hookCtx);
+      }
+    }
+    const finalResponse = hookCtx.response ?? new Response(
+      JSON.stringify({ code: "INTERNAL_SERVER_ERROR", message: "No response built" }),
+      {
+        status: 500,
+        headers: { "content-type": "application/json" }
+      }
+    );
+    return mergeHookHeaders(finalResponse, hookCtx.responseHeaders);
+  } catch (err) {
+    return runErrorHooks(err, hookCtx, hooks.onError);
+  }
+}
+async function runErrorHooks(err, hookCtx, onError) {
+  const errorResponse = handlerErrorResponse(err);
+  if (onError !== void 0) {
+    const errorCtx = {
+      ...hookCtx,
+      response: errorResponse,
+      error: err
+    };
+    for (const hook of onError) {
+      try {
+        await hook(errorCtx);
+      } catch {
+      }
+    }
+  }
+  return mergeHookHeaders(errorResponse, hookCtx.responseHeaders);
+}
+
+// src/server/http/middleware-runner.ts
+import { existsSync } from "fs";
+import { join } from "path";
+
+// src/server/http/node-web-adapter.ts
+async function writeWebResponseToServerResponse(response, res) {
+  const setCookies = response.headers.getSetCookie();
+  if (setCookies.length > 0) {
+    res.setHeader("Set-Cookie", setCookies);
+  }
+  const otherHeaders = {};
+  for (const [key, value] of response.headers.entries()) {
+    if (key.toLowerCase() === "set-cookie") continue;
+    otherHeaders[key] = value;
+  }
+  res.writeHead(response.status, response.statusText, otherHeaders);
+  if (response.body === null) {
+    res.end();
+    return;
+  }
+  const reader = response.body.getReader();
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      res.write(value);
+    }
+    res.end();
+  } finally {
+    reader.releaseLock();
+  }
+}
+
+// src/server/http/middleware-runner.ts
+var middlewareCache = /* @__PURE__ */ new Map();
+function _resetMiddlewareCacheForTests() {
+  middlewareCache.clear();
+}
+function getCachedScan(serverDir) {
+  let cached = middlewareCache.get(serverDir);
+  if (!cached) {
+    const singleFilePath = join(serverDir, "middleware.ts");
+    cached = {
+      singleFilePath,
+      singleFileExists: existsSync(singleFilePath),
+      dirMiddlewares: scanMiddlewares(serverDir)
+    };
+    middlewareCache.set(serverDir, cached);
+  }
+  return cached;
+}
+async function runWebShapedMiddleware(mw, req, res, context) {
+  const request = createWebRequestSource(req).toRequest();
+  const result = await mw(request, context);
+  if (!(result instanceof Response)) return { shortCircuited: false };
+  await writeWebResponseToServerResponse(result, res);
+  return { shortCircuited: true };
+}
+function isWebShaped(mw) {
+  return WEB_SHAPED_MIDDLEWARE in mw;
+}
+async function runScannedMiddleware(mw, req, res, context) {
+  if (isWebShaped(mw)) {
+    const { shortCircuited } = await runWebShapedMiddleware(mw, req, res, context);
+    return { aborted: shortCircuited };
+  }
+  const { nextCalled } = await runOneMiddleware(mw, req, res);
+  return { aborted: !nextCalled || res.writableEnded };
+}
+async function runOneMiddleware(mw, req, res) {
+  const state = { nextCalled: false };
+  await mw(req, res, () => {
+    state.nextCalled = true;
+  });
+  return state;
+}
+async function runMiddlewareAndContext(req, res, loadModule, serverDir) {
+  const { singleFilePath, singleFileExists, dirMiddlewares } = getCachedScan(serverDir);
+  const dirExists = dirMiddlewares.length > 0;
+  const middlewareCtx = {};
+  if (singleFileExists && dirExists) {
+    throw new Error(
+      "Ambiguous middleware configuration: found both server/middleware.ts and server/middleware/ directory. Use one or the other, not both."
+    );
+  }
+  if (dirExists) {
+    for (const mwPath of dirMiddlewares) {
+      const mod = await loadModule(mwPath);
+      const mw = mod.default;
+      if (typeof mw !== "function") continue;
+      const { aborted } = await runScannedMiddleware(mw, req, res, middlewareCtx);
+      if (aborted) return { ctx: middlewareCtx, aborted: true };
+    }
+  }
+  if (singleFileExists) {
+    const mod = await loadModule(singleFilePath);
+    const mw = mod.default;
+    if (typeof mw === "function") {
+      const { aborted } = await runScannedMiddleware(mw, req, res, middlewareCtx);
+      if (aborted) return { ctx: middlewareCtx, aborted: true };
+    }
+  }
+  const factoryCtx = await createServerContext(req, res, loadModule, serverDir);
+  if (factoryCtx === null || typeof factoryCtx !== "object") {
+    return { ctx: middlewareCtx, aborted: false };
+  }
+  return { ctx: { ...middlewareCtx, ...factoryCtx }, aborted: false };
+}
+async function createServerContext(req, res, loadModule, serverDir) {
+  const contextPath = join(serverDir, "context.ts");
+  if (!existsSync(contextPath)) return {};
+  const mod = await loadModule(contextPath);
+  const createContext = mod.createContext;
+  if (typeof createContext !== "function") return {};
+  return await createContext({ request: req, response: res });
+}
+
+// src/core/contracts/auth-error-guard.ts
+function isAuthRequiredError(err) {
+  if (err == null || typeof err !== "object") return false;
+  const e = err;
+  return e.code === "AUTH_REQUIRED" && e.status === 401;
+}
+
+// src/server/security/csrf-warn-dispatch.ts
+function dispatchCsrfWarn(payload) {
+  const key = `${payload.event}:${payload.method}:${payload.path ?? ""}`;
+  warnOnce(key, payload);
+}
+
+// src/server/http/execute.ts
+var CSRF_PROTECTED_METHODS2 = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+async function waitForDrain(res) {
+  if (typeof res.once !== "function") return;
+  await new Promise((resolve) => {
+    let settled = false;
+    const finish = () => {
+      if (settled) return;
+      settled = true;
+      if (typeof res.off === "function") {
+        res.off("drain", finish);
+        res.off("close", finish);
+        res.off("error", finish);
+      }
+      resolve();
+    };
+    res.once("drain", finish);
+    res.once("close", finish);
+    res.once("error", finish);
+  });
+}
 async function pipeWebStreamToResponse(body, res, ctx) {
   const reader = body.getReader();
   try {
@@ -461,7 +889,7 @@ async function pipeWebStreamToResponse(body, res, ctx) {
     while (!done) {
       const chunk = await reader.read();
       done = chunk.done;
-      if (!done) res.write(chunk.value);
+      if (!done && res.write(chunk.value) === false) await waitForDrain(res);
     }
   } catch (streamErr) {
     warnOnce(`stream-error:${ctx.routePath}:${ctx.method}`, {
@@ -477,12 +905,15 @@ async function pipeWebStreamToResponse(body, res, ctx) {
       } catch {
       }
     }
+    res.destroy(streamErr instanceof Error ? streamErr : new Error(String(streamErr)));
+    return false;
   } finally {
     try {
       reader.releaseLock();
     } catch {
     }
   }
+  return true;
 }
 async function executeRoute(ctx) {
   const {
@@ -562,7 +993,7 @@ async function executeRoute(ctx) {
       return;
     }
     const routeOptOut = typeof routeConfig === "object" && routeConfig.csrf === false;
-    if (CSRF_PROTECTED_METHODS.has(method) && !routeOptOut) {
+    if (CSRF_PROTECTED_METHODS2.has(method) && !routeOptOut) {
       const decision = enforceCsrf(
         req,
         csrfMode,
@@ -598,6 +1029,23 @@ async function executeRoute(ctx) {
       if (preResult.shortCircuited) return;
     }
     const callableHandler = handler;
+    const accessDecision = await evaluateRoutePolicy(rc.policy, {
+      subject: subjectFromContext(ctx2),
+      query,
+      body,
+      params
+    });
+    if (!accessDecision.allowed) {
+      sendError(
+        res,
+        "FORBIDDEN",
+        `Access denied: ${accessDecision.reason}`,
+        403,
+        void 0,
+        requestId
+      );
+      return;
+    }
     const handlerResult = await callableHandler({ query, body, params, request: webRequest, ctx: ctx2 });
     if (handlerResult === void 0 || handlerResult === null) {
       sendJson(res, null, rc.status ?? 204, transformer);
@@ -614,8 +1062,9 @@ async function executeRoute(ctx) {
         res.setHeader("Set-Cookie", setCookies);
       }
       res.writeHead(handlerResult.status, headersBag);
+      let bodyCompleted = true;
       if (handlerResult.body) {
-        await pipeWebStreamToResponse(handlerResult.body, res, {
+        bodyCompleted = await pipeWebStreamToResponse(handlerResult.body, res, {
           buildPluginCtx,
           ctx: ctx2,
           method,
@@ -624,7 +1073,7 @@ async function executeRoute(ctx) {
           routePath: route.routePath
         });
       }
-      res.end();
+      if (bodyCompleted) res.end();
       if (pluginRunner) await pluginRunner.runOnResponse(buildPluginCtx(ctx2));
       return;
     }
@@ -979,7 +1428,7 @@ function enforceCsrfForAction(req, res, ctx) {
   );
   return false;
 }
-async function runPreHandlerPipeline(p) {
+async function runPreHandlerPipeline2(p) {
   if (p.serverDir) {
     const result = await runMiddlewareAndContext(p.req, p.res, p.loadModule, p.serverDir);
     if (result.aborted) return false;
@@ -1103,7 +1552,7 @@ async function executeActionWithOptions(opts) {
       req,
       res
     };
-    if (!await runPreHandlerPipeline(pipeline)) return;
+    if (!await runPreHandlerPipeline2(pipeline)) return;
     ctx = pipeline.ctx;
     const bodyOutcome = await readActionBody(req, res, requestId, actionConfig);
     if (!bodyOutcome.ok) return;
@@ -1373,50 +1822,6 @@ function createCorsWebHandler(config) {
   };
 }
 
-// src/server/http/trace-context.ts
-var TRACE_HEADER = "x-trace-id";
-var TRACE_PARENT_HEADER = "traceparent";
-var REQUEST_ID_HEADER = "x-request-id";
-var TRACEPARENT_RE = /^00-([0-9a-f]{32})-([0-9a-f]{16})-[0-9a-f]{2}$/;
-function parseTraceparent(value) {
-  if (!value) return null;
-  const m = TRACEPARENT_RE.exec(value);
-  if (!m) return null;
-  const traceId = m[1];
-  if (/^0+$/.test(traceId)) return null;
-  return traceId;
-}
-function pickHeader(value) {
-  if (Array.isArray(value)) {
-    for (const v of value) {
-      if (typeof v === "string" && v.length > 0) return v;
-    }
-    return null;
-  }
-  if (typeof value === "string" && value.length > 0) return value;
-  return null;
-}
-function resolveTraceIdFromHeaders(traceparent, requestId) {
-  if (traceparent !== null) {
-    const parsed = parseTraceparent(traceparent);
-    if (parsed !== null) return parsed;
-  }
-  if (requestId !== null) return requestId;
-  return globalThis.crypto.randomUUID();
-}
-function extractTraceId(req) {
-  return resolveTraceIdFromHeaders(
-    pickHeader(req.headers[TRACE_PARENT_HEADER]),
-    pickHeader(req.headers[REQUEST_ID_HEADER])
-  );
-}
-function extractTraceIdFromRequest(request) {
-  return resolveTraceIdFromHeaders(
-    request.headers.get(TRACE_PARENT_HEADER),
-    request.headers.get(REQUEST_ID_HEADER)
-  );
-}
-
 export {
   ActionError,
   ActionInputError,
@@ -1426,11 +1831,15 @@ export {
   dispatchCsrfWarn,
   sendJson,
   sendError,
-  isZodLike,
-  _resetMiddlewareCacheForTests,
-  runMiddlewareAndContext,
   incomingMessageToWebRequest,
+  createWebRequestSource,
   incomingMessageToHandlerRequest,
+  validateRouteInput,
+  executeWebRequest,
+  writeWebResponseToServerResponse,
+  _resetMiddlewareCacheForTests,
+  runMiddlewareAndContext,
+  createServerContext,
   executeRoute,
   handleRequestError,
   handleWebRequestError,
@@ -1441,11 +1850,6 @@ export {
   handleBatchRequest,
   matchesOrigin,
   createCorsHandler,
-  createCorsWebHandler,
-  TRACE_HEADER,
-  TRACE_PARENT_HEADER,
-  parseTraceparent,
-  extractTraceId,
-  extractTraceIdFromRequest
+  createCorsWebHandler
 };
-//# sourceMappingURL=chunk-XALU5LCU.js.map
+//# sourceMappingURL=chunk-RWNYIU6A.js.map