theokit 0.48.13 → 0.50.0

package/dist/server/index.js

@@ -8,15 +8,24 @@ import {
   BodyTooLargeError,
   DEFAULT_MAX_BODY_BYTES,
   defineWebhook,
+  discord,
   dispatchWebhook,
+  github,
   readRawBody,
+  slack,
+  stripe,
+  telegram,
   timingSafeEqual
-} from "../chunk-AM3QABW5.js";
+} from "../chunk-BU6RJPPJ.js";
 import {
   MAX_ERROR_HTML_BYTES,
+  ProcedureInputError,
+  ProcedureOutputError,
+  callProcedure,
+  createOpenApiHandler,
   loadCustomErrorPages,
   serveStaticFile
-} from "../chunk-UW2TEAGR.js";
+} from "../chunk-ULDCFL2O.js";
 import {
   DuplicateJobNameError,
   InMemoryJobBackend,
@@ -28,18 +37,10 @@ import {
   defineJob,
   scanJobs,
   writeJobManifest
-} from "../chunk-FNTLKHZ7.js";
+} from "../chunk-JDN5SAAD.js";
 import {
-  ConsoleObservabilityAdapter,
-  NoopObservabilityAdapter,
-  NoopSpan,
-  SpanImpl,
-  TheoCloudObservabilityAdapter,
-  createObservabilityPlugin,
-  defineObservabilityAdapter,
-  resolveAdapter,
-  serializeSpansToOtlp
-} from "../chunk-O3JIAU3V.js";
+  defineObservabilityAdapter
+} from "../chunk-HJHGTFEJ.js";
 import "../chunk-GUBN5UTT.js";
 import {
   createRouteRateLimiter,
@@ -52,31 +53,33 @@ import {
   ChannelManager
 } from "../chunk-4PBJ266F.js";
 import "../chunk-7IHWXDJJ.js";
-import "../chunk-WPJOTQA5.js";
+import {
+  evaluateCsrfMultiHeaderRequest,
+  isCsrfOriginAllowed,
+  matchWildcardDomain
+} from "../chunk-WNJTJRM6.js";
 import {
   _resetEnvCache,
-  executeWebRequest,
+  loadEnv
+} from "../chunk-4X6H2BXP.js";
+import {
   jsonTransformer,
-  loadEnv,
   resolveTransformer,
-  superjsonTransformer,
-  validateRouteInput
-} from "../chunk-XR74JD4M.js";
+  superjsonTransformer
+} from "../chunk-OGLS76RN.js";
 import {
   ActionError,
   ActionInputError,
   BATCH_PATH,
   BatchPathConflictError,
   STRIPPED_HEADERS,
-  TRACE_HEADER,
-  TRACE_PARENT_HEADER,
   _resetMiddlewareCacheForTests,
   createCorsHandler,
   createCorsWebHandler,
+  createServerContext,
   executeAction,
   executeRoute,
-  extractTraceId,
-  extractTraceIdFromRequest,
+  executeWebRequest,
   extractUniversalIssues,
   handleBatchRequest,
   handleRequestError,
@@ -84,11 +87,11 @@ import {
   isActionError,
   isInputError,
   matchesOrigin,
-  parseTraceparent,
   runMiddlewareAndContext,
   sendError,
-  sendJson
-} from "../chunk-XALU5LCU.js";
+  sendJson,
+  validateRouteInput
+} from "../chunk-RWNYIU6A.js";
 import {
   DuplicateContextKeyError,
   createOutbox,
@@ -99,14 +102,31 @@ import {
   findSuggestion,
   levenshtein
 } from "../chunk-NTDN54XO.js";
+import {
+  ConsoleObservabilityAdapter,
+  NoopObservabilityAdapter,
+  NoopSpan,
+  SpanImpl,
+  TheoCloudObservabilityAdapter,
+  createObservabilityPlugin,
+  resolveAdapter,
+  serializeSpansToOtlp
+} from "../chunk-MCTC6HSE.js";
 import {
   FileTooLargeError,
+  TRACE_HEADER,
+  TRACE_PARENT_HEADER,
   _resetWarnOnceForTests,
   createLogger,
+  extractTraceId,
+  extractTraceIdFromRequest,
+  extractW3CTraceContext,
   logRequest,
   parseRequestBody,
+  parseTraceparent,
+  parseTraceparentContext,
   warnOnce
-} from "../chunk-KD5G3YXI.js";
+} from "../chunk-72DMJBXI.js";
 import {
   DuplicateDecorationError,
   DuplicatePluginError,
@@ -122,9 +142,12 @@ import {
 import {
   createProductionLoader,
   createViteLoader
-} from "../chunk-7LVM22VG.js";
+} from "../chunk-OQCRCXCP.js";
 import {
+  ACTION_SCHEMAS_DIR,
   ActionScanError,
+  _resetRouteScanCacheForTests,
+  compareRouteSpecificity,
   compilePattern,
   generateManifest,
   loadManifest,
@@ -134,27 +157,30 @@ import {
   scanServerRoutes,
   scanWebSocketRoutes,
   writeManifest
-} from "../chunk-YGAXV5HR.js";
+} from "../chunk-6J4JWHDJ.js";
 import "../chunk-DV34VG3N.js";
+import "../chunk-L4VFNFDL.js";
 import {
   scanMiddlewares
-} from "../chunk-FB2HBNIC.js";
+} from "../chunk-BX6EUYHU.js";
 import {
   CSP_REPORT_PATH,
   CSRF_READINESS_PATH,
   CSRF_READINESS_RESET_PATH,
   CsrfReadinessStore,
-  DEFAULT_CSP,
-  DEFAULT_PERMISSIONS_POLICY,
   applySecurityHeaders,
-  buildSecurityHeaders,
   handleCspReport,
   handleCspReportRequest,
   handleCsrfReadiness,
   handleCsrfReadinessRequest,
   normalizeLegacy,
   normalizeNew
-} from "../chunk-MTEWLGVY.js";
+} from "../chunk-BPYMC7SU.js";
+import {
+  DEFAULT_CSP,
+  DEFAULT_PERMISSIONS_POLICY,
+  buildSecurityHeaders
+} from "../chunk-IRQGAC4L.js";
 import {
   CSRF_WARN_CODE,
   CSRF_WARN_DOCS_URL,
@@ -162,7 +188,7 @@ import {
   matchDisallowed,
   validateCsrf,
   validateCsrfRequest
-} from "../chunk-OLGPYOLO.js";
+} from "../chunk-P6OS7652.js";
 import {
   JsonStdoutSink,
   createNoOpLogger,
@@ -204,7 +230,7 @@ import {
   resetProviderRegistry,
   resolveProvider,
   tryResolveProvider
-} from "../chunk-6E5WKMDS.js";
+} from "../chunk-3PBAN2YE.js";
 import {
   AuthRequiredError,
   _resetKeyCacheForTests,
@@ -230,7 +256,7 @@ import {
   verifyBackupCode,
   verifyOAuthState,
   verifyTotp
-} from "../chunk-646CA6RV.js";
+} from "../chunk-RQW5YMH7.js";
 import {
   appendCookieToHeaders,
   appendDeleteCookieToHeaders,
@@ -241,9 +267,10 @@ import {
   serializeCookie,
   setCookie
 } from "../chunk-4FWBKX6G.js";
+import "../chunk-YSJOZEI6.js";
 import {
   generateNonce
-} from "../chunk-JA2ZAT5Q.js";
+} from "../chunk-Z4PJMZLM.js";
 import {
   InMemoryUsageStorage,
   InMemoryUsageStorage2,
@@ -266,11 +293,12 @@ import {
   translateCronToVercel,
   validateCronSchedule,
   writeCronManifest
-} from "../chunk-LXAESF4Y.js";
+} from "../chunk-HK4AZBKX.js";
 import "../chunk-VZTYCAO6.js";
-import "../chunk-RWNSW4FM.js";
+import "../chunk-UMNXCU3K.js";
 import "../chunk-52PDWL5S.js";
-import "../chunk-U267AOWS.js";
+import "../chunk-5K4TDLRG.js";
+import "../chunk-ZWN3AODA.js";
 import {
   action,
   defineChannel,
@@ -281,7 +309,13 @@ import {
   tool,
   uiMessageStreamResponse,
   websocket
-} from "../chunk-J5MXCGKA.js";
+} from "../chunk-DHAD2O3S.js";
+import "../chunk-D4VP2QPR.js";
+import {
+  evaluateRoutePolicy,
+  requireOwner,
+  subjectFromContext
+} from "../chunk-YN4W7LCX.js";
 import {
   HEALTH_PATH,
   READY_PATH,
@@ -294,98 +328,6 @@ import {
 } from "../chunk-SAFGDIPQ.js";
 import "../chunk-XTHN6JBX.js";
 
-// src/server/openapi/serve-docs.ts
-import { existsSync, readFileSync, statSync } from "fs";
-import { resolve } from "path";
-var MAX_SPEC_BYTES = 10 * 1024 * 1024;
-var DEFAULT_CDN = "https://cdn.jsdelivr.net/npm/@scalar/api-reference";
-function createOpenApiHandler(opts = {}) {
-  const docsPath = opts.docsPath ?? "/api/docs";
-  const jsonPath = opts.openapiJsonPath ?? "/api/docs/openapi.json";
-  const rawSpecFile = opts.specFilePath ?? ".theokit/openapi.json";
-  const title = opts.pageTitle ?? "API Reference";
-  const cdn = opts.cdnUrl ?? DEFAULT_CDN;
-  if (hasDotDotSegment(rawSpecFile)) {
-    throw new Error(`[theokit:openapi] specFilePath must not contain ".." segments: ${rawSpecFile}`);
-  }
-  const specFile = resolve(rawSpecFile);
-  return (request) => {
-    if (request.method !== "GET") return null;
-    const url = new URL(request.url);
-    if (url.pathname === docsPath) {
-      const cdnHost = new URL(cdn).host;
-      return new Response(renderScalarHtml(title, jsonPath, cdn), {
-        status: 200,
-        headers: {
-          "content-type": "text/html; charset=utf-8",
-          "content-security-policy": `script-src 'self' 'unsafe-eval' ${cdnHost}; style-src 'self' 'unsafe-inline'; img-src 'self' data: ${cdnHost}; font-src 'self' data: ${cdnHost}; connect-src 'self' ${cdnHost}`
-        }
-      });
-    }
-    if (url.pathname === jsonPath) {
-      return serveSpecFile(specFile);
-    }
-    return null;
-  };
-}
-function hasDotDotSegment(p) {
-  return p.split(/[/\\]/).includes("..");
-}
-function escapeHtml(s) {
-  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-}
-function renderScalarHtml(title, specUrl, cdnUrl) {
-  return `<!DOCTYPE html>
-<html>
-<head>
-  <meta charset="utf-8">
-  <title>${escapeHtml(title)}</title>
-  <meta name="viewport" content="width=device-width,initial-scale=1">
-</head>
-<body>
-  <script id="api-reference" data-url="${escapeHtml(specUrl)}"></script>
-  <script src="${escapeHtml(cdnUrl)}"></script>
-</body>
-</html>`;
-}
-function serveSpecFile(filePath) {
-  if (!existsSync(filePath)) {
-    return jsonResponse(503, {
-      error: {
-        code: "OPENAPI_NOT_EMITTED",
-        message: "OpenAPI spec not generated yet. Start the dev server and visit a route first."
-      }
-    });
-  }
-  try {
-    const stat = statSync(filePath);
-    if (stat.size > MAX_SPEC_BYTES) {
-      return jsonResponse(413, {
-        error: {
-          code: "OPENAPI_TOO_LARGE",
-          message: `Spec file exceeds ${MAX_SPEC_BYTES / 1024 / 1024}MB limit`
-        }
-      });
-    }
-    const content = readFileSync(filePath, "utf-8");
-    return new Response(content, {
-      status: 200,
-      headers: { "content-type": "application/json", "cache-control": "no-cache" }
-    });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to read OpenAPI spec file";
-    return jsonResponse(500, {
-      error: { code: "OPENAPI_READ_FAILED", message }
-    });
-  }
-}
-function jsonResponse(status, body) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "content-type": "application/json" }
-  });
-}
-
 // src/cache/constants.ts
 var CACHE_TAG_MAX_LENGTH = 256;
 var CACHE_TAG_MAX_ITEMS = 128;
@@ -592,9 +534,12 @@ var variesCookieWarnedRoutes = /* @__PURE__ */ new WeakSet();
 var oversizedWarnedRoutes = /* @__PURE__ */ new WeakSet();
 function defineCachedRoute(engine, config) {
   const { cache, handler, ...rest } = config;
-  const maxAge = validateMaxAge(cache.maxAge, "defineCachedRoute");
-  const swr = validateExpire(cache.swr, maxAge, "defineCachedRoute");
-  if (cache.cacheVersion !== void 0 && cache.cacheVersion === "") {
+  const defaults = engine.defaults;
+  const maxAge = validateMaxAge(cache.maxAge ?? defaults.maxAge, "defineCachedRoute");
+  const swr = validateExpire(cache.swr ?? defaults.swr, maxAge, "defineCachedRoute");
+  const cacheVersion = cache.cacheVersion ?? defaults.cacheVersion;
+  const cacheErrors = cache.cacheErrors ?? defaults.cacheErrors ?? false;
+  if (cacheVersion === "") {
     throw new Error("defineCachedRoute: cacheVersion must be non-empty if provided");
   }
   const maxEntrySize = cache.maxEntrySize ?? DEFAULT_MAX_ENTRY_SIZE;
@@ -632,7 +577,7 @@ function defineCachedRoute(engine, config) {
       getKey: cache.getKey
     });
     const cached = await engine.tryReadCached(key, {
-      cacheVersion: cache.cacheVersion
+      cacheVersion
     });
     const routeCacheCtx = {
       engine,
@@ -642,6 +587,8 @@ function defineCachedRoute(engine, config) {
       maxEntrySize,
       maxAge,
       swr,
+      cacheVersion,
+      cacheErrors,
       baseTags,
       webRequest
     };
@@ -670,16 +617,11 @@ function buildRouteCacheEntry(value, ctx) {
     maxAge: ctx.maxAge,
     swr: ctx.swr ?? ctx.maxAge * 60,
     tags: [...ctx.baseTags, pathTag],
-    cacheVersion: ctx.cache.cacheVersion
+    cacheVersion: ctx.cacheVersion
   };
 }
 async function persistAndReturn(ctx, response) {
-  const cacheableResult = await tryCacheResponse(
-    response,
-    ctx.cache,
-    ctx.routeConfig,
-    ctx.maxEntrySize
-  );
+  const cacheableResult = await tryCacheResponse(response, ctx);
   if (!cacheableResult) {
     return response;
   }
@@ -690,7 +632,7 @@ function scheduleRouteRevalidate(ctx, handler, handlerCtx) {
   void (async () => {
     try {
       const response = await invokeHandlerAsResponse(handler, handlerCtx);
-      const result = await tryCacheResponse(response, ctx.cache, ctx.routeConfig, ctx.maxEntrySize);
+      const result = await tryCacheResponse(response, ctx);
       if (!result) return;
       await ctx.engine.set(ctx.key, buildRouteCacheEntry(result, ctx));
     } catch {
@@ -724,7 +666,8 @@ async function invokeHandlerAsResponse(handler, ctx) {
   if (raw instanceof Response) return raw;
   return Response.json(raw);
 }
-async function tryCacheResponse(response, cache, routeConfig, maxEntrySize) {
+async function tryCacheResponse(response, ctx) {
+  const { cache, routeConfig, maxEntrySize } = ctx;
   if (response.headers.has("set-cookie")) {
     if (!setCookieWarnedRoutes.has(routeConfig)) {
       setCookieWarnedRoutes.add(routeConfig);
@@ -737,7 +680,7 @@ async function tryCacheResponse(response, cache, routeConfig, maxEntrySize) {
   if (response.headers.get("transfer-encoding")?.toLowerCase() === "chunked") {
     return void 0;
   }
-  if (response.status >= 400 && !cache.cacheErrors) return void 0;
+  if (response.status >= 400 && !ctx.cacheErrors) return void 0;
   if (cache.cacheable && !cache.cacheable(response)) return void 0;
   const text = await response.clone().text();
   if (text.length > maxEntrySize) {
@@ -756,23 +699,23 @@ async function tryCacheResponse(response, cache, routeConfig, maxEntrySize) {
   });
   return { body: text, status: response.status, headers };
 }
+function toCacheStatusHeader(status) {
+  if (status === "hit") return "HIT";
+  if (status === "stale") return "STALE";
+  return "MISS";
+}
 function buildResponseFromCache(value, status, maxAge, swr) {
   const headers = new Headers(value.headers);
   if (!headers.has("cache-control")) {
     headers.set("cache-control", getCacheControlHeader({ maxAge, swr: swr ?? maxAge * 60 }));
   }
-  if (process.env.NODE_ENV !== "production") {
-    let cacheStatusHeader = "MISS";
-    if (status === "hit") cacheStatusHeader = "HIT";
-    else if (status === "stale") cacheStatusHeader = "STALE";
-    headers.set("X-Theo-Cache", cacheStatusHeader);
-  }
+  headers.set("X-Theo-Cache", toCacheStatusHeader(status));
   return new Response(value.body, { status: value.status, headers });
 }
 
 // src/cache/cache-engine.ts
 function createCacheEngine(opts) {
-  const { storage, onError } = opts;
+  const { storage, defaults = {}, onError } = opts;
   const inFlight = /* @__PURE__ */ new Map();
   const bgInFlight = /* @__PURE__ */ new Set();
   const undefinedLoaderWarned = /* @__PURE__ */ new Set();
@@ -796,8 +739,8 @@ function createCacheEngine(opts) {
   function claimAndRun(key, fn, options, skipWrite) {
     let resolveOuter;
     let rejectOuter;
-    const outerPromise = new Promise((resolve2, reject) => {
-      resolveOuter = resolve2;
+    const outerPromise = new Promise((resolve, reject) => {
+      resolveOuter = resolve;
       rejectOuter = reject;
     });
     void outerPromise.catch(() => {
@@ -872,14 +815,12 @@ function createCacheEngine(opts) {
     if (skipWrite) return value;
     if (options.skipCacheWhen?.(value)) return value;
     if (options.validate) {
-      let isValid = true;
       try {
-        isValid = options.validate(value);
+        if (!options.validate(value)) return value;
       } catch (err) {
         onError?.(err, { phase: "set", key });
         return value;
       }
-      if (!isValid) return value;
     }
     if (value === void 0) {
       if (!undefinedLoaderWarned.has(key)) {
@@ -916,6 +857,7 @@ function createCacheEngine(opts) {
   }
   return {
     storage,
+    defaults,
     getOrCompute,
     async tryReadCached(key, opts2) {
       const result = await tryReadCached(key, {
@@ -1135,47 +1077,6 @@ function deserializeResponse(serialized) {
   return superjson.deserialize(serialized);
 }
 
-// src/server/http/in-process-caller.ts
-var ProcedureInputError = class extends Error {
-  channel;
-  issues;
-  constructor(channel, error) {
-    super(`Invalid ${channel} for in-process procedure call: ${error.message}`);
-    this.name = "ProcedureInputError";
-    this.channel = channel;
-    this.issues = error.issues;
-  }
-};
-var ProcedureOutputError = class extends Error {
-  issues;
-  constructor(error) {
-    super(`In-process procedure output failed its response schema: ${error.message}`);
-    this.name = "ProcedureOutputError";
-    this.issues = error.issues;
-  }
-};
-function inProcessRequest() {
-  return new Request("theo://in-process/procedure", { method: "POST" });
-}
-async function callProcedure(config, input = {}, ctx) {
-  const validated = validateRouteInput(config, input);
-  if (!validated.ok) throw new ProcedureInputError(validated.channel, validated.error);
-  const result = await config.handler({
-    query: validated.query,
-    body: validated.body,
-    params: validated.params,
-    request: inProcessRequest(),
-    ctx
-  });
-  const responseSchema = config.response;
-  if (responseSchema !== void 0 && !(result instanceof Response)) {
-    const parsed = responseSchema.safeParse(result);
-    if (!parsed.success) throw new ProcedureOutputError(parsed.error);
-    return parsed.data;
-  }
-  return result;
-}
-
 // src/server/http/ctx-reconciliation.ts
 var CTX_WRITERS = {
   /** Writer 1 — user `context.ts` factory. THE typed surface (`TCtx`). execute.ts:131 */
@@ -1210,6 +1111,7 @@ if (typeof globalThis !== "undefined") {
   }
 }
 export {
+  ACTION_SCHEMAS_DIR,
   ActionError,
   ActionInputError,
   ActionScanError,
@@ -1283,6 +1185,7 @@ export {
   _resetEnvCache,
   _resetKeyCacheForTests,
   _resetMiddlewareCacheForTests,
+  _resetRouteScanCacheForTests,
   _resetWarnOnceForTests,
   action,
   appendCookieToHeaders,
@@ -1297,6 +1200,7 @@ export {
   callProcedure,
   checkThrottle,
   clearOidcCache,
+  compareRouteSpecificity,
   compilePattern,
   compileRouteRules,
   composeInstructions,
@@ -1322,6 +1226,7 @@ export {
   createRateLimiterWeb,
   createRouteRateLimiter,
   createRouteRateLimiterWeb,
+  createServerContext,
   createSessionManager,
   createSessionManagerWeb,
   createVendorAgentTool,
@@ -1344,12 +1249,15 @@ export {
   deriveKey,
   deriveKeyFromRequest,
   deserializeResponse,
+  discord,
   discoverOidcProvider,
   dispatchWebhook,
   effectiveContextWindow,
   encrypt,
   enforceCsrf,
   envelopeCodeToStatus,
+  evaluateCsrfMultiHeaderRequest,
+  evaluateRoutePolicy,
   executeAction,
   executeRoute,
   executeWebRequest,
@@ -1357,6 +1265,7 @@ export {
   extractTraceId,
   extractTraceIdFromRequest,
   extractUniversalIssues,
+  extractW3CTraceContext,
   findSuggestion,
   fromUnknown,
   frontmatterValue,
@@ -1372,6 +1281,7 @@ export {
   getCookie,
   getCookieFromRequest,
   getStorageManager,
+  github,
   handleBatchRequest,
   handleChannelWebhook,
   handleCspReport,
@@ -1384,6 +1294,7 @@ export {
   initCacheEngine,
   isActionError,
   isChannelPath,
+  isCsrfOriginAllowed,
   isInputError,
   jsonTransformer,
   levenshtein,
@@ -1397,6 +1308,7 @@ export {
   matchDisallowed,
   matchRoute,
   matchRoutePattern,
+  matchWildcardDomain,
   matchesOrigin,
   middleware,
   normalizeLegacy,
@@ -1405,6 +1317,7 @@ export {
   parseCookieHeader,
   parseRequestBody,
   parseTraceparent,
+  parseTraceparentContext,
   pkceChallengeFromVerifier,
   plugin,
   readAppResource,
@@ -1412,6 +1325,7 @@ export {
   recordAttempt,
   registerProvider,
   requireAuth,
+  requireOwner,
   resetProviderRegistry,
   resolveAdapter,
   resolveProvider,
@@ -1442,9 +1356,13 @@ export {
   serveStaticFile,
   serverErrorToEnvelope,
   setCookie,
+  slack,
   splitFrontmatter,
   streamAgentTurnInProcess,
+  stripe,
+  subjectFromContext,
   superjsonTransformer,
+  telegram,
   timingSafeEqual,
   tool,
   totpUri,