theokit 0.48.13 → 0.50.0

package/dist/server/security/index.d.ts

@@ -1,6 +1,8 @@
 import { IncomingMessage, ServerResponse } from 'node:http';
+import { S as SecurityHeadersConfig, c as SecurityEnv, d as SecurityHeadersOptions } from '../../security-headers-Ccj7ncNx.js';
+export { C as CspMode, D as DEFAULT_CSP, a as DEFAULT_PERMISSIONS_POLICY, b as buildSecurityHeaders } from '../../security-headers-Ccj7ncNx.js';
 import { A as AuditLogger } from '../../audit-log-BQWM5YLG.js';
-export { C as CSRF_WARN_CODE, a as CSRF_WARN_DOCS_URL, b as CsrfLogger, c as CsrfMode, d as CsrfWarnPayload, D as DisallowedConfig, e as enforceCsrf, m as matchDisallowed, v as validateCsrf, f as validateCsrfRequest } from '../../csrf-BBrEZSBW.js';
+export { a as CSRF_WARN_CODE, b as CSRF_WARN_DOCS_URL, c as CsrfLogger, C as CsrfMode, d as CsrfWarnPayload, D as DisallowedConfig, e as enforceCsrf, m as matchDisallowed, v as validateCsrf, f as validateCsrfRequest } from '../../csrf-Dgot9qSM.js';
 import { C as CsrfReadinessStore } from '../../csrf-readiness-store-CjIoub3U.js';
 export { a as CsrfReadinessRouteSummary, b as CsrfReadinessSummary, c as CsrfWarnRecord } from '../../csrf-readiness-store-CjIoub3U.js';
 
@@ -73,121 +75,77 @@ declare function handleCsrfReadiness(req: IncomingMessage, res: ServerResponse,
 declare function handleCsrfReadinessRequest(request: Request, store: CsrfReadinessStore): Promise<Response | null>;
 
 /**
- * Phase 6 — Default Security Headers (D4 / EC-2).
- *
- * Per-response security baseline. The framework applies these BEFORE the
- * route handler runs so a handler can still override via `res.setHeader`.
- *
- * EC-2 backward-compatibility: CSP ships in `report-only` mode by default
- * for 0.2.0. Existing apps with inline scripts or third-party CDN scripts
- * keep working but consumers see violation reports via their CSP report
- * collector (or browser DevTools). 0.3.0 will flip the default to
- * `enforce` after a release of visibility.
- */
-/**
- * Default Content-Security-Policy. Conservative-but-not-paralyzing:
- *
- *   - default-src 'self'              — every fetch falls back to same-origin
- *   - script-src 'self'               — T6.1 (0.3.0): `'unsafe-inline'`
- *                                         dropped. The SSR pipeline issues a
- *                                         per-request nonce that REPLACES
- *                                         this directive at runtime
- *                                         (`'nonce-<token>'`). For static /
- *                                         non-SSR contexts where no nonce is
- *                                         available, the policy is strict-
- *                                         no-inline — user inline scripts
- *                                         must be migrated to external
- *                                         `<script src="...">` or threaded
- *                                         through `ctx.nonce`.
- *   - style-src 'self' 'unsafe-inline' — Tailwind + TheoUI use style attrs
- *                                         in animation directives
- *   - img-src 'self' data: blob:      — supports inline data URIs, blobs
- *                                         from canvas exports
- *   - font-src 'self' data:           — Geist fonts inline-base64
- *   - connect-src 'self' ws: wss:     — WebSocket dev HMR + agent streams
- *   - frame-ancestors 'none'          — clickjacking defense
- */
-/**
- * T5.1 — default CSP includes the built-in report endpoint so violations
- * are visible without extra config. Apps that ship a custom `csp` string
- * override the report-uri.
- */
-declare const DEFAULT_CSP: string;
-/**
- * T1.1 — Default Permissions-Policy header (default-deny stance).
- *
- * Disables sensitive Web APIs that the vast majority of apps don't use.
- * Apps that DO need any of these opt in by overriding `permissionsPolicy`
- * in `config.security.headers`.
- *
- * The seven features listed are the most-abused for: tracking
- * (geolocation, accelerometer, gyroscope), spyware (camera, microphone),
- * fraud (payment), and hardware exfiltration (usb).
- *
- * Aligns with Mozilla baseline + OWASP Secure Headers + Lighthouse PWA.
+ * Apply security headers to a Node ServerResponse. Called by the
+ * api-middleware before the route handler runs. The handler can override
+ * any header via `res.setHeader()` — last write wins by Node convention.
  */
-declare const DEFAULT_PERMISSIONS_POLICY = "geolocation=(), camera=(), microphone=(), payment=(), usb=(), accelerometer=(), gyroscope=()";
-type CspMode = 'enforce' | 'report-only' | 'off';
-interface SecurityHeadersConfig {
-    /**
-     * Custom CSP policy string. When set, replaces the default verbatim.
-     * Pass `false` to disable CSP entirely (alias for `cspMode: 'off'`).
-     */
-    csp?: string | false;
+declare function applySecurityHeaders(res: ServerResponse, config: SecurityHeadersConfig, env: SecurityEnv, options?: SecurityHeadersOptions): void;
+
+interface CsrfMultiHeaderOptions {
     /**
-     * Enforcement mode for CSP. Default `report-only` for 0.2.0 (EC-2).
-     * 0.3.0 will default to `enforce`.
+     * Wildcard-aware allowlist of additional origins (beyond same-origin).
+     * Example: `['app.example.com', '*.staging.example.com']`.
      */
-    cspMode?: CspMode;
+    allowedOrigins?: readonly string[];
     /**
-     * Strict-Transport-Security value. Defaults to
-     * `max-age=31536000; includeSubDomains` in production. Pass `false` to
-     * suppress (e.g. internal LANs without TLS).
+     * Whether to trust `x-forwarded-host`/`x-forwarded-proto` headers when
+     * deriving the request's own origin. Default `false` (EC-5). Set to
+     * `true` only when running behind a reverse proxy that strips untrusted
+     * forwarded headers from inbound requests.
      */
-    hsts?: string | false;
-    /** X-Frame-Options. Default DENY. */
-    frameOptions?: 'DENY' | 'SAMEORIGIN';
-    /** X-Content-Type-Options. Default `nosniff`. */
-    contentTypeOptions?: 'nosniff';
-    /** Referrer-Policy. Default `strict-origin-when-cross-origin`. */
-    referrerPolicy?: string;
+    trustForwardedHeaders?: boolean;
     /**
-     * T1.1 — Permissions-Policy directive string. When set, replaces the
-     * default verbatim (no merge — see ADR-EC-12). Pass `false` to disable
-     * the header entirely. Schema-level refinement rejects any string
-     * containing CR/LF (EC-3 — CWE-113 HTTP Response Splitting mitigation).
+     * Allow requests when none of Sec-Fetch-Site / Origin / Referer are
+     * present (e.g., handcrafted curl). Default `false`. Strict mode rejects
+     * such requests because cookies/sessions can still be sent.
      */
-    permissionsPolicy?: string | false;
-}
-interface SecurityEnv {
-    production: boolean;
+    allowRequestsWithoutOriginCheck?: boolean;
 }
+type CsrfDecision = {
+    allow: true;
+    signal: 'sec-fetch-site' | 'origin' | 'referer' | 'no-headers-allowed';
+} | {
+    allow: false;
+    signal: 'sec-fetch-site' | 'origin' | 'referer' | 'no-headers';
+    reason: string;
+};
 /**
- * T4.1 — Per-request options passed by the SSR pipeline.
+ * T5a.2 Phase B slice 2/6 — Web-Standards multi-header CSRF evaluator.
+ * Consumes `request.headers.get(name)` (native Headers API).
  *
- * - `nonce`: when set, the framework substitutes the `'unsafe-inline'`
- *   token in `script-src` with `'nonce-<nonce>'`. EC-3 forces
- *   `Cache-Control: private, no-store` so a CDN cannot cache the HTML
- *   (carrying one nonce) and re-serve it with a freshly-generated CSP
- *   header (carrying a different nonce).
- * - `prerender`: when true, the nonce is IGNORED. Prerendered HTML is
- *   generated at build time with no nonce in the script tags; mixing a
- *   runtime nonce in the header would block every script. EC-4.
+ * **EC-10 note:** the Web `Headers` API collapses multi-value headers into a
+ * single comma-separated string at parse time, and that string fails to parse
+ * as a URL — so a repeated Origin is rejected by the Origin branch rather than
+ * by a signal of its own. (`headers.getSetCookie()` — `Set-Cookie` is the only
+ * multi-value header the Web spec exposes; all others are single-valued at the
+ * API layer.)
+ *
+ * Available to `executeWebRequest` consumers who want an origin-based policy
+ * alongside the custom-header `validateCsrfRequest`.
  */
-interface SecurityHeadersOptions {
-    nonce?: string;
-    prerender?: boolean;
-}
+declare function evaluateCsrfMultiHeaderRequest(request: Request, options?: CsrfMultiHeaderOptions): CsrfDecision;
+
 /**
- * Build the security headers map for a given config + env. Pure function —
- * returned object can be inspected, logged, or applied to a response.
+ * Wildcard origin matching for CSRF allowlist.
+ *
+ * Per plan g3-server-actions-and-useaction v1.2 § Phase 2 / T2.1 + ADR D3.
+ * Port of Next.js csrf-protection.ts:6-94 — DNS case-insensitive matching
+ * with single (`*.example.com`) and double (`**.example.com`) asterisk
+ * subdomain wildcards.
+ *
+ * Single asterisk matches exactly one subdomain segment; double asterisk
+ * matches one or more (recursive). Bare `*` or `**` alone (no domain suffix)
+ * are rejected as invalid patterns — prevents `*` matching everything.
  */
-declare function buildSecurityHeaders(config: SecurityHeadersConfig, env: SecurityEnv, options?: SecurityHeadersOptions): Record<string, string>;
 /**
- * Apply security headers to a Node ServerResponse. Called by the
- * api-middleware before the route handler runs. The handler can override
- * any header via `res.setHeader()` — last write wins by Node convention.
+ * Match a domain against a wildcard pattern. DNS-spec case-insensitive
+ * (RFC 1035) via ASCII-only lowercasing (avoids Unicode quirks).
  */
-declare function applySecurityHeaders(res: ServerResponse, config: SecurityHeadersConfig, env: SecurityEnv, options?: SecurityHeadersOptions): void;
+declare function matchWildcardDomain(domain: string, pattern: string): boolean;
+/**
+ * Check whether `originDomain` is in `allowedOrigins`, with wildcard support.
+ * Returns `true` if any allowlist entry matches.
+ */
+declare function isCsrfOriginAllowed(originDomain: string, allowedOrigins?: readonly string[]): boolean;
 
-export { CSP_REPORT_PATH, CSRF_READINESS_PATH, CSRF_READINESS_RESET_PATH, type CspMode, type CspReportHandlerOptions, type CspViolation, CsrfReadinessStore, DEFAULT_CSP, DEFAULT_PERMISSIONS_POLICY, type SecurityEnv, type SecurityHeadersConfig, type SecurityHeadersOptions, applySecurityHeaders, buildSecurityHeaders, handleCspReport, handleCspReportRequest, handleCsrfReadiness, handleCsrfReadinessRequest, normalizeLegacy, normalizeNew };
+export { CSP_REPORT_PATH, CSRF_READINESS_PATH, CSRF_READINESS_RESET_PATH, type CspReportHandlerOptions, type CspViolation, type CsrfDecision, type CsrfMultiHeaderOptions, CsrfReadinessStore, SecurityEnv, SecurityHeadersConfig, SecurityHeadersOptions, applySecurityHeaders, evaluateCsrfMultiHeaderRequest, handleCspReport, handleCspReportRequest, handleCsrfReadiness, handleCsrfReadinessRequest, isCsrfOriginAllowed, matchWildcardDomain, normalizeLegacy, normalizeNew };

package/dist/server/security/index.js

@@ -1,20 +1,26 @@
-import "../../chunk-WPJOTQA5.js";
+import {
+  evaluateCsrfMultiHeaderRequest,
+  isCsrfOriginAllowed,
+  matchWildcardDomain
+} from "../../chunk-WNJTJRM6.js";
 import {
   CSP_REPORT_PATH,
   CSRF_READINESS_PATH,
   CSRF_READINESS_RESET_PATH,
   CsrfReadinessStore,
-  DEFAULT_CSP,
-  DEFAULT_PERMISSIONS_POLICY,
   applySecurityHeaders,
-  buildSecurityHeaders,
   handleCspReport,
   handleCspReportRequest,
   handleCsrfReadiness,
   handleCsrfReadinessRequest,
   normalizeLegacy,
   normalizeNew
-} from "../../chunk-MTEWLGVY.js";
+} from "../../chunk-BPYMC7SU.js";
+import {
+  DEFAULT_CSP,
+  DEFAULT_PERMISSIONS_POLICY,
+  buildSecurityHeaders
+} from "../../chunk-IRQGAC4L.js";
 import {
   CSRF_WARN_CODE,
   CSRF_WARN_DOCS_URL,
@@ -22,7 +28,7 @@ import {
   matchDisallowed,
   validateCsrf,
   validateCsrfRequest
-} from "../../chunk-OLGPYOLO.js";
+} from "../../chunk-P6OS7652.js";
 import "../../chunk-AVQU5CQF.js";
 import "../../chunk-XTHN6JBX.js";
 export {
@@ -37,11 +43,14 @@ export {
   applySecurityHeaders,
   buildSecurityHeaders,
   enforceCsrf,
+  evaluateCsrfMultiHeaderRequest,
   handleCspReport,
   handleCspReportRequest,
   handleCsrfReadiness,
   handleCsrfReadinessRequest,
+  isCsrfOriginAllowed,
   matchDisallowed,
+  matchWildcardDomain,
   normalizeLegacy,
   normalizeNew,
   validateCsrf,

package/dist/server/webhook/index.d.ts

@@ -1,5 +1,5 @@
-import { D as DefineWebhookOptions, b as WebhookDefinition } from '../../webhook-types-DGIjjcaI.js';
-export { V as VerifyFn, a as VerifyResult, W as WebhookContext } from '../../webhook-types-DGIjjcaI.js';
+import { D as DefineWebhookOptions, b as WebhookDefinition, V as VerifyFn } from '../../webhook-types-DGIjjcaI.js';
+export { a as VerifyResult, W as WebhookContext } from '../../webhook-types-DGIjjcaI.js';
 
 /**
  * Constant-time byte comparison.
@@ -104,4 +104,91 @@ declare function defineWebhook(opts: DefineWebhookOptions): WebhookDefinition;
  */
 declare function dispatchWebhook(def: WebhookDefinition, request: Request): Promise<Response>;
 
-export { BodyTooLargeError, DEFAULT_MAX_BODY_BYTES, DefineWebhookOptions, type RawBodyResult, type ReadRawBodyOptions, WebhookDefinition, defineWebhook, dispatchWebhook, readRawBody, timingSafeEqual };
+/**
+ * Stripe webhook signature verification per official spec.
+ *
+ * Header format: `stripe-signature: t=<ts>, v1=<sig1>[, v1=<sig2>]...`
+ * Basestring: `${t}.${rawBody}`
+ * Algorithm: HMAC-SHA256(secret, basestring) → hex
+ *
+ * Multi-key (rotation): pass `secret` as `string[]` — verifier tries each
+ * until one matches (or all fail).
+ *
+ * Replay window: `toleranceSeconds` (default 300 = 5 min, matching
+ * stripe-node defaults). Requests outside the window return `{ ok: false,
+ * reason: 'timestamp out of tolerance' }`.
+ *
+ * @see https://docs.stripe.com/webhooks/signatures
+ */
+interface StripeWebhookOptions {
+    /** Webhook signing secret (`whsec_...`). Pass array for key rotation. */
+    secret: string | readonly string[];
+    /** Replay window in seconds. Default 300 (5 minutes). */
+    toleranceSeconds?: number;
+}
+declare function stripe(opts: StripeWebhookOptions): VerifyFn;
+
+/**
+ * GitHub webhook signature verification per official spec.
+ *
+ * Header: `X-Hub-Signature-256: sha256=<hex>`
+ * Algorithm: HMAC-SHA256(secret, rawBody) → hex
+ *
+ * No timestamp → no replay window. Replay protection is the caller's
+ * responsibility (idempotent handler).
+ *
+ * @see https://docs.github.com/en/webhooks/using-webhooks/validating-webhook-deliveries
+ */
+interface GitHubWebhookOptions {
+    /** Webhook secret. Pass array for key rotation. */
+    secret: string | readonly string[];
+}
+declare function github(opts: GitHubWebhookOptions): VerifyFn;
+
+/**
+ * Slack webhook signature verification per official spec.
+ *
+ * Headers: `X-Slack-Request-Timestamp: <ts>` + `X-Slack-Signature: v0=<hex>`
+ * Basestring: `v0:${ts}:${rawBody}`
+ * Algorithm: HMAC-SHA256(signingSecret, basestring) → hex → `v0=<hex>`
+ *
+ * Replay window: `toleranceSeconds` (default 300 = 5 min, matching
+ * bolt-js + Slack official guidance).
+ *
+ * No multi-key rotation (Slack doesn't support it natively — each app
+ * has one signing secret).
+ *
+ * @see https://api.slack.com/authentication/verifying-requests-from-slack
+ */
+interface SlackWebhookOptions {
+    /** Slack app's Signing Secret. */
+    signingSecret: string;
+    /** Replay window in seconds. Default 300 (5 minutes). */
+    toleranceSeconds?: number;
+}
+declare function slack(opts: SlackWebhookOptions): VerifyFn;
+
+interface TelegramWebhookOptions {
+    /** The `secret_token` configured on `setWebhook` (1–256 chars). */
+    secretToken: string;
+}
+declare function telegram(opts: TelegramWebhookOptions): VerifyFn;
+
+/**
+ * M27 — Discord interaction webhook verification.
+ *
+ * Discord signs each request with Ed25519. Headers: `X-Signature-Ed25519` (hex signature) and
+ * `X-Signature-Timestamp`. The signed message is `timestamp + rawBody`; verify against the app's
+ * public key (hex). Uses Web Crypto Ed25519 (Node ≥ 22) — no third-party crypto (Rule 9 / Web
+ * Standards G8).
+ *
+ * @see https://discord.com/developers/docs/interactions/overview#setting-up-an-endpoint-validating-security-request-headers
+ */
+
+interface DiscordWebhookOptions {
+    /** The Discord application's public key (hex). */
+    publicKey: string;
+}
+declare function discord(opts: DiscordWebhookOptions): VerifyFn;
+
+export { BodyTooLargeError, DEFAULT_MAX_BODY_BYTES, DefineWebhookOptions, type DiscordWebhookOptions, type GitHubWebhookOptions, type RawBodyResult, type ReadRawBodyOptions, type SlackWebhookOptions, type StripeWebhookOptions, type TelegramWebhookOptions, VerifyFn, WebhookDefinition, defineWebhook, discord, dispatchWebhook, github, readRawBody, slack, stripe, telegram, timingSafeEqual };

package/dist/server/webhook/index.js

@@ -2,18 +2,28 @@ import {
   BodyTooLargeError,
   DEFAULT_MAX_BODY_BYTES,
   defineWebhook,
+  discord,
   dispatchWebhook,
+  github,
   readRawBody,
+  slack,
+  stripe,
+  telegram,
   timingSafeEqual
-} from "../../chunk-AM3QABW5.js";
-import "../../chunk-RWNSW4FM.js";
+} from "../../chunk-BU6RJPPJ.js";
+import "../../chunk-UMNXCU3K.js";
 import "../../chunk-XTHN6JBX.js";
 export {
   BodyTooLargeError,
   DEFAULT_MAX_BODY_BYTES,
   defineWebhook,
+  discord,
   dispatchWebhook,
+  github,
   readRawBody,
+  slack,
+  stripe,
+  telegram,
   timingSafeEqual
 };
 //# sourceMappingURL=index.js.map

package/dist/server-boundary-6B4ZQUY7.js

@@ -0,0 +1,148 @@
+import {
+  resolveTheoRootDir
+} from "./chunk-VQPHPQ5L.js";
+import "./chunk-SL7YUHPV.js";
+import "./chunk-WOBSEO75.js";
+import "./chunk-RWNYIU6A.js";
+import "./chunk-47FFT43U.js";
+import "./chunk-NTDN54XO.js";
+import "./chunk-MCTC6HSE.js";
+import "./chunk-72DMJBXI.js";
+import "./chunk-VSLTKX5L.js";
+import "./chunk-TNI4MARH.js";
+import "./chunk-OQCRCXCP.js";
+import {
+  ACTION_SCHEMAS_DIR
+} from "./chunk-6J4JWHDJ.js";
+import "./chunk-DV34VG3N.js";
+import "./chunk-L4VFNFDL.js";
+import "./chunk-BX6EUYHU.js";
+import "./chunk-BPYMC7SU.js";
+import "./chunk-IRQGAC4L.js";
+import "./chunk-P6OS7652.js";
+import "./chunk-AVQU5CQF.js";
+import "./chunk-ACKBVBUI.js";
+import "./chunk-IZ3TIL6K.js";
+import "./chunk-3PBAN2YE.js";
+import "./chunk-YSJOZEI6.js";
+import "./chunk-Z4PJMZLM.js";
+import "./chunk-UMNXCU3K.js";
+import "./chunk-52PDWL5S.js";
+import "./chunk-5K4TDLRG.js";
+import "./chunk-ZWN3AODA.js";
+import "./chunk-D4VP2QPR.js";
+import "./chunk-YN4W7LCX.js";
+import "./chunk-XTHN6JBX.js";
+
+// src/vite-plugin/server-boundary.ts
+import { existsSync, statSync } from "fs";
+import { dirname, isAbsolute, join, relative, resolve } from "path";
+import { fileURLToPath } from "url";
+var THEO_SERVER_SPECIFIER = "theokit/server";
+var SOURCE_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mts", ".mjs", ".cts", ".cjs"];
+var ServerOnlyImportError = class extends Error {
+  name = "ServerOnlyImportError";
+  /** The server-only module, as named in the message. */
+  module;
+  /** The importing file, as named in the message. */
+  importer;
+  constructor(opts) {
+    const wroteSomethingElse = opts.specifier !== void 0 && opts.specifier !== opts.module;
+    const message = [
+      `Server-only import in the client bundle: ${opts.module} cannot be imported from client code.`,
+      ``,
+      `  Imported: ${opts.module}`,
+      ...wroteSomethingElse ? [`  Written:  ${String(opts.specifier)}`] : [],
+      `  From:     ${opts.importer}`,
+      ``,
+      `That module runs on the server. It reads the file system, opens the database and holds`,
+      `your secrets, so a browser bundle containing it ships all three to every visitor.`,
+      ``,
+      `Call the server from client code instead:`,
+      ``,
+      // Both bindings are the ones the virtual modules actually export — `client` from
+      // `app-typed-client.ts` and `actions` from `actions-virtual-module.ts`. A remedy naming a
+      // symbol nobody exports reads as actionable and is not, so
+      // `tests/unit/server-boundary-rule.test.ts` asserts both against the emitters — the same
+      // discipline `tests/unit/policy-gate-remedy-is-importable.test.ts` applies to the policy gate.
+      `  import { client } from '@theo/client'    // typed from your server/routes/**`,
+      `  import { actions } from '@theo/actions'  // typed from your server/actions/**`,
+      ``,
+      `Need only the TYPES? Add \`type\` to the import \u2014 a type-only import is erased before the`,
+      `bundler ever sees it:`,
+      ``,
+      `  import type { ... } from '${opts.specifier ?? opts.module}'`,
+      ``,
+      `And if this file is itself server code, move it under your server directory, so the client`,
+      `graph has no way to reach it.`
+    ].join("\n");
+    super(message);
+    this.module = opts.module;
+    this.importer = opts.importer;
+  }
+};
+function isUnder(child, parent) {
+  const rel = relative(parent, child);
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+}
+function nameSourceFile(target) {
+  if (existsSync(target) && statSync(target).isFile()) return target;
+  const stem = target.replace(/\.[cm]?[jt]sx?$/, "");
+  for (const ext of SOURCE_EXTENSIONS) {
+    if (existsSync(`${stem}${ext}`)) return `${stem}${ext}`;
+  }
+  for (const ext of SOURCE_EXTENSIONS) {
+    if (existsSync(join(target, `index${ext}`))) return join(target, `index${ext}`);
+  }
+  return target;
+}
+function forHumans(path, projectRoot) {
+  return isUnder(path, projectRoot) ? relative(projectRoot, path) : path;
+}
+function frameworkServerSpecifier(target, theoServerDir) {
+  const demangled = target.replace(/[\\/]index\.[cm]?[jt]sx?(?=[\\/])/, "");
+  const subpath = relative(theoServerDir, demangled).replace(/\\/g, "/").replace(/(^|\/)index\.[cm]?[jt]sx?$/, "");
+  return subpath === "" ? THEO_SERVER_SPECIFIER : `${THEO_SERVER_SPECIFIER}/${subpath}`;
+}
+function serverOnlyImportBoundary(opts) {
+  const projectRoot = opts.projectRoot;
+  const serverDir = opts.serverDir;
+  const isomorphicSchemasDir = join(serverDir, "actions", ACTION_SCHEMAS_DIR);
+  const theoServerDir = join(resolveTheoRootDir(dirname(fileURLToPath(import.meta.url))), "server");
+  return {
+    name: "theo:server-only-import-boundary",
+    enforce: "pre",
+    resolveId(source, importer, options) {
+      if (options.ssr === true) return void 0;
+      if (importer === void 0) return void 0;
+      if (source === THEO_SERVER_SPECIFIER || source.startsWith(`${THEO_SERVER_SPECIFIER}/`)) {
+        throw new ServerOnlyImportError({
+          module: source,
+          importer: forHumans(importer, projectRoot)
+        });
+      }
+      if (source.startsWith(".") || isAbsolute(source)) {
+        const target = isAbsolute(source) ? source : resolve(dirname(importer), source);
+        if (isUnder(target, theoServerDir)) {
+          throw new ServerOnlyImportError({
+            module: frameworkServerSpecifier(target, theoServerDir),
+            importer: forHumans(importer, projectRoot)
+          });
+        }
+        if (isUnder(target, serverDir) && !isUnder(target, isomorphicSchemasDir)) {
+          throw new ServerOnlyImportError({
+            module: forHumans(nameSourceFile(target), projectRoot),
+            importer: forHumans(importer, projectRoot),
+            specifier: source
+          });
+        }
+      }
+      return void 0;
+    }
+  };
+}
+export {
+  ServerOnlyImportError,
+  serverOnlyImportBoundary
+};
+//# sourceMappingURL=server-boundary-6B4ZQUY7.js.map

package/dist/server-boundary-6B4ZQUY7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/vite-plugin/server-boundary.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKA,SAAS,YAAY,gBAAgB;AACrC,SAAS,SAAS,YAAY,MAAM,UAAU,eAAe;AAC7D,SAAS,qBAAqB;AAkB9B,IAAM,wBAAwB;AAG9B,IAAM,oBAAoB,CAAC,OAAO,QAAQ,OAAO,QAAQ,QAAQ,QAAQ,QAAQ,MAAM;AA0BhF,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAC7B,OAAO;AAAA;AAAA,EAEhB;AAAA;AAAA,EAEA;AAAA,EAET,YAAY,MAAoC;AAC9C,UAAM,qBAAqB,KAAK,cAAc,UAAa,KAAK,cAAc,KAAK;AACnF,UAAM,UAAU;AAAA,MACd,4CAA4C,KAAK,MAAM;AAAA,MACvD;AAAA,MACA,eAAe,KAAK,MAAM;AAAA,MAC1B,GAAI,qBAAqB,CAAC,eAAe,OAAO,KAAK,SAAS,CAAC,EAAE,IAAI,CAAC;AAAA,MACtE,eAAe,KAAK,QAAQ;AAAA,MAC5B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,+BAA+B,KAAK,aAAa,KAAK,MAAM;AAAA,MAC5D;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,IAAI;AACX,UAAM,OAAO;AACb,SAAK,SAAS,KAAK;AACnB,SAAK,WAAW,KAAK;AAAA,EACvB;AACF;AAGA,SAAS,QAAQ,OAAe,QAAyB;AACvD,QAAM,MAAM,SAAS,QAAQ,KAAK;AAClC,SAAO,QAAQ,MAAM,CAAC,IAAI,WAAW,IAAI,KAAK,CAAC,WAAW,GAAG;AAC/D;AAUA,SAAS,eAAe,QAAwB;AAC9C,MAAI,WAAW,MAAM,KAAK,SAAS,MAAM,EAAE,OAAO,EAAG,QAAO;AAC5D,QAAM,OAAO,OAAO,QAAQ,mBAAmB,EAAE;AACjD,aAAW,OAAO,mBAAmB;AACnC,QAAI,WAAW,GAAG,IAAI,GAAG,GAAG,EAAE,EAAG,QAAO,GAAG,IAAI,GAAG,GAAG;AAAA,EACvD;AACA,aAAW,OAAO,mBAAmB;AACnC,QAAI,WAAW,KAAK,QAAQ,QAAQ,GAAG,EAAE,CAAC,EAAG,QAAO,KAAK,QAAQ,QAAQ,GAAG,EAAE;AAAA,EAChF;AACA,SAAO;AACT;AAGA,SAAS,UAAU,MAAc,aAA6B;AAC5D,SAAO,QAAQ,MAAM,WAAW,IAAI,SAAS,aAAa,IAAI,IAAI;AACpE;AAgBA,SAAS,yBAAyB,QAAgB,eAA+B;AAC/E,QAAM,YAAY,OAAO,QAAQ,qCAAqC,EAAE;AACxE,QAAM,UAAU,SAAS,eAAe,SAAS,EAC9C,QAAQ,OAAO,GAAG,EAClB,QAAQ,8BAA8B,EAAE;AAC3C,SAAO,YAAY,KAAK,wBAAwB,GAAG,qBAAqB,IAAI,OAAO;AACrF;AAoDO,SAAS,yBAAyB,MAAqC;AAC5E,QAAM,cAAc,KAAK;AACzB,QAAM,YAAY,KAAK;AACvB,QAAM,uBAAuB,KAAK,WAAW,WAAW,kBAAkB;AAI1E,QAAM,gBAAgB,KAAK,mBAAmB,QAAQ,cAAc,YAAY,GAAG,CAAC,CAAC,GAAG,QAAQ;AAEhG,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,IAET,UAAU,QAAQ,UAAU,SAAS;AAEnC,UAAI,QAAQ,QAAQ,KAAM,QAAO;AAGjC,UAAI,aAAa,OAAW,QAAO;AAMnC,UAAI,WAAW,yBAAyB,OAAO,WAAW,GAAG,qBAAqB,GAAG,GAAG;AACtF,cAAM,IAAI,sBAAsB;AAAA,UAC9B,QAAQ;AAAA,UACR,UAAU,UAAU,UAAU,WAAW;AAAA,QAC3C,CAAC;AAAA,MACH;AAIA,UAAI,OAAO,WAAW,GAAG,KAAK,WAAW,MAAM,GAAG;AAChD,cAAM,SAAS,WAAW,MAAM,IAAI,SAAS,QAAQ,QAAQ,QAAQ,GAAG,MAAM;AAK9E,YAAI,QAAQ,QAAQ,aAAa,GAAG;AAClC,gBAAM,IAAI,sBAAsB;AAAA,YAC9B,QAAQ,yBAAyB,QAAQ,aAAa;AAAA,YACtD,UAAU,UAAU,UAAU,WAAW;AAAA,UAC3C,CAAC;AAAA,QACH;AAEA,YAAI,QAAQ,QAAQ,SAAS,KAAK,CAAC,QAAQ,QAAQ,oBAAoB,GAAG;AACxE,gBAAM,IAAI,sBAAsB;AAAA,YAC9B,QAAQ,UAAU,eAAe,MAAM,GAAG,WAAW;AAAA,YACrD,UAAU,UAAU,UAAU,WAAW;AAAA,YACzC,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AAAA,MACF;AAEA,aAAO;AAAA,IACT;AAAA,EACF;AACF;","names":[]}