theokit 0.48.7 → 0.48.8

package/dist/{chunk-H6YBKIUN.js → chunk-ABUVJU3P.js}

@@ -8,6 +8,7 @@ import {
   enforceCsrf,
   incomingMessageToHandlerRequest,
   parseRequestBody,
+  safeAudit,
   sendError,
   sendJson,
   validateCsrfRequest,
@@ -18,6 +19,166 @@ import {
   serverErrorToEnvelope
 } from "./chunk-VQIUTCK2.js";
 
+// src/core/contracts/action-protocol.ts
+var CODE_TO_STATUS = {
+  VALIDATION_ERROR: 422,
+  BAD_REQUEST: 400,
+  UNAUTHORIZED: 401,
+  FORBIDDEN: 403,
+  NOT_FOUND: 404,
+  METHOD_NOT_ALLOWED: 405,
+  CONFLICT: 409,
+  CONTENT_TOO_LARGE: 413,
+  PAYLOAD_TOO_LARGE: 413,
+  UNSUPPORTED_MEDIA_TYPE: 415,
+  TOO_MANY_REQUESTS: 429,
+  INTERNAL_SERVER_ERROR: 500
+};
+var STATUS_TO_CODE = {
+  400: "BAD_REQUEST",
+  401: "UNAUTHORIZED",
+  403: "FORBIDDEN",
+  404: "NOT_FOUND",
+  405: "METHOD_NOT_ALLOWED",
+  409: "CONFLICT",
+  413: "PAYLOAD_TOO_LARGE",
+  415: "UNSUPPORTED_MEDIA_TYPE",
+  422: "VALIDATION_ERROR",
+  429: "TOO_MANY_REQUESTS",
+  500: "INTERNAL_SERVER_ERROR"
+};
+var ActionError = class _ActionError extends Error {
+  // Discriminator widened to the full union so subclasses can narrow to their
+  // specific literal (TypeScript would otherwise reject the override). Concrete
+  // values are still always exact literals at runtime.
+  type = "TheoActionError";
+  code;
+  status;
+  constructor(params) {
+    super(params.message ?? params.code);
+    this.code = params.code;
+    this.status = _ActionError.codeToStatus(params.code);
+    if (params.stack) {
+      this.stack = params.stack;
+    }
+  }
+  /**
+   * G5 T2.4 — canonical envelope view of the action error. Maps the G3
+   * ActionErrorCode to a canonical TheoErrorCode (VALIDATION_ERROR ↔
+   * UNPROCESSABLE_ENTITY, CONTENT_TOO_LARGE ↔ PAYLOAD_TOO_LARGE) so consumer
+   * UI / SDK code can switch on the unified envelope.
+   *
+   * Subclasses override to populate `ext` (see `ActionInputError.envelope`).
+   */
+  get envelope() {
+    return {
+      code: _ActionError.toTheoErrorCode(this.code),
+      message: this.message
+    };
+  }
+  /**
+   * Translate G3 ActionErrorCode → canonical TheoErrorCode (blueprint
+   * Recommendations § "G3 ActionError becomes inaugural envelope user").
+   */
+  static toTheoErrorCode(code) {
+    if (code === "VALIDATION_ERROR") return "UNPROCESSABLE_ENTITY";
+    if (code === "CONTENT_TOO_LARGE") return "PAYLOAD_TOO_LARGE";
+    return code;
+  }
+  static codeToStatus(code) {
+    return CODE_TO_STATUS[code];
+  }
+  static statusToCode(status) {
+    return STATUS_TO_CODE[status] ?? "INTERNAL_SERVER_ERROR";
+  }
+  /**
+   * Parse a serialized error JSON back into the typed class hierarchy.
+   * Distinguishes `TheoActionInputError` (with `issues` array) from
+   * `TheoActionError` via the `type` discriminator. Falls back to
+   * `INTERNAL_SERVER_ERROR` for malformed bodies (non-object, missing
+   * `type`, unknown `code`).
+   */
+  static fromJson(body) {
+    if (typeof body !== "object" || body === null) {
+      return new _ActionError({ code: "INTERNAL_SERVER_ERROR" });
+    }
+    const obj = body;
+    if (obj.type === "TheoActionInputError" && Array.isArray(obj.issues)) {
+      return new ActionInputError(obj.issues);
+    }
+    if (obj.type === "TheoActionError" && typeof obj.code === "string" && obj.code in CODE_TO_STATUS) {
+      return new _ActionError({
+        code: obj.code,
+        message: typeof obj.message === "string" ? obj.message : void 0
+      });
+    }
+    return new _ActionError({ code: "INTERNAL_SERVER_ERROR" });
+  }
+};
+var ActionInputError = class extends ActionError {
+  type = "TheoActionInputError";
+  issues;
+  fields;
+  constructor(rawIssues) {
+    super({ code: "VALIDATION_ERROR", message: "Validation failed" });
+    this.issues = extractUniversalIssues(rawIssues);
+    this.fields = buildFieldsMap(this.issues);
+  }
+  /**
+   * G5 T2.4 — envelope view with ValidationFieldsExt populated from .fields.
+   * UI consumers can `switch (env.code)` on `UNPROCESSABLE_ENTITY` and read
+   * `(env.ext as ValidationFieldsExt).fields` for field-level rendering.
+   */
+  get envelope() {
+    return {
+      code: "UNPROCESSABLE_ENTITY",
+      message: this.message,
+      ext: { fields: this.fields }
+    };
+  }
+};
+function buildFieldsMap(issues) {
+  const fields = {};
+  const seen = /* @__PURE__ */ new Set();
+  for (const issue of issues) {
+    const key = issue.path.length === 0 ? "" : issue.path.join(".");
+    const dedupeKey = `${key}\0${issue.message}`;
+    if (seen.has(dedupeKey)) continue;
+    seen.add(dedupeKey);
+    const bucket = fields[key] ?? [];
+    bucket.push(issue.message);
+    fields[key] = bucket;
+  }
+  return fields;
+}
+function extractUniversalIssues(raw) {
+  if (!Array.isArray(raw)) return [];
+  const out = [];
+  for (const entry of raw) {
+    if (typeof entry !== "object" || entry === null) continue;
+    const obj = entry;
+    if (!Array.isArray(obj.path)) continue;
+    if (typeof obj.message !== "string") continue;
+    const path = [];
+    let pathValid = true;
+    for (const seg of obj.path) {
+      if (typeof seg === "string" || typeof seg === "number") {
+        path.push(seg);
+      } else {
+        pathValid = false;
+        break;
+      }
+    }
+    if (!pathValid) continue;
+    out.push({
+      path,
+      message: obj.message,
+      code: typeof obj.code === "string" ? obj.code : void 0
+    });
+  }
+  return out;
+}
+
 // src/core/contracts/auth-error-guard.ts
 function isAuthRequiredError(err) {
   if (err == null || typeof err !== "object") return false;
@@ -514,166 +675,6 @@ async function executeRoute(ctx) {
   }
 }
 
-// src/core/contracts/action-protocol.ts
-var CODE_TO_STATUS = {
-  VALIDATION_ERROR: 422,
-  BAD_REQUEST: 400,
-  UNAUTHORIZED: 401,
-  FORBIDDEN: 403,
-  NOT_FOUND: 404,
-  METHOD_NOT_ALLOWED: 405,
-  CONFLICT: 409,
-  CONTENT_TOO_LARGE: 413,
-  PAYLOAD_TOO_LARGE: 413,
-  UNSUPPORTED_MEDIA_TYPE: 415,
-  TOO_MANY_REQUESTS: 429,
-  INTERNAL_SERVER_ERROR: 500
-};
-var STATUS_TO_CODE = {
-  400: "BAD_REQUEST",
-  401: "UNAUTHORIZED",
-  403: "FORBIDDEN",
-  404: "NOT_FOUND",
-  405: "METHOD_NOT_ALLOWED",
-  409: "CONFLICT",
-  413: "PAYLOAD_TOO_LARGE",
-  415: "UNSUPPORTED_MEDIA_TYPE",
-  422: "VALIDATION_ERROR",
-  429: "TOO_MANY_REQUESTS",
-  500: "INTERNAL_SERVER_ERROR"
-};
-var ActionError = class _ActionError extends Error {
-  // Discriminator widened to the full union so subclasses can narrow to their
-  // specific literal (TypeScript would otherwise reject the override). Concrete
-  // values are still always exact literals at runtime.
-  type = "TheoActionError";
-  code;
-  status;
-  constructor(params) {
-    super(params.message ?? params.code);
-    this.code = params.code;
-    this.status = _ActionError.codeToStatus(params.code);
-    if (params.stack) {
-      this.stack = params.stack;
-    }
-  }
-  /**
-   * G5 T2.4 — canonical envelope view of the action error. Maps the G3
-   * ActionErrorCode to a canonical TheoErrorCode (VALIDATION_ERROR ↔
-   * UNPROCESSABLE_ENTITY, CONTENT_TOO_LARGE ↔ PAYLOAD_TOO_LARGE) so consumer
-   * UI / SDK code can switch on the unified envelope.
-   *
-   * Subclasses override to populate `ext` (see `ActionInputError.envelope`).
-   */
-  get envelope() {
-    return {
-      code: _ActionError.toTheoErrorCode(this.code),
-      message: this.message
-    };
-  }
-  /**
-   * Translate G3 ActionErrorCode → canonical TheoErrorCode (blueprint
-   * Recommendations § "G3 ActionError becomes inaugural envelope user").
-   */
-  static toTheoErrorCode(code) {
-    if (code === "VALIDATION_ERROR") return "UNPROCESSABLE_ENTITY";
-    if (code === "CONTENT_TOO_LARGE") return "PAYLOAD_TOO_LARGE";
-    return code;
-  }
-  static codeToStatus(code) {
-    return CODE_TO_STATUS[code];
-  }
-  static statusToCode(status) {
-    return STATUS_TO_CODE[status] ?? "INTERNAL_SERVER_ERROR";
-  }
-  /**
-   * Parse a serialized error JSON back into the typed class hierarchy.
-   * Distinguishes `TheoActionInputError` (with `issues` array) from
-   * `TheoActionError` via the `type` discriminator. Falls back to
-   * `INTERNAL_SERVER_ERROR` for malformed bodies (non-object, missing
-   * `type`, unknown `code`).
-   */
-  static fromJson(body) {
-    if (typeof body !== "object" || body === null) {
-      return new _ActionError({ code: "INTERNAL_SERVER_ERROR" });
-    }
-    const obj = body;
-    if (obj.type === "TheoActionInputError" && Array.isArray(obj.issues)) {
-      return new ActionInputError(obj.issues);
-    }
-    if (obj.type === "TheoActionError" && typeof obj.code === "string" && obj.code in CODE_TO_STATUS) {
-      return new _ActionError({
-        code: obj.code,
-        message: typeof obj.message === "string" ? obj.message : void 0
-      });
-    }
-    return new _ActionError({ code: "INTERNAL_SERVER_ERROR" });
-  }
-};
-var ActionInputError = class extends ActionError {
-  type = "TheoActionInputError";
-  issues;
-  fields;
-  constructor(rawIssues) {
-    super({ code: "VALIDATION_ERROR", message: "Validation failed" });
-    this.issues = extractUniversalIssues(rawIssues);
-    this.fields = buildFieldsMap(this.issues);
-  }
-  /**
-   * G5 T2.4 — envelope view with ValidationFieldsExt populated from .fields.
-   * UI consumers can `switch (env.code)` on `UNPROCESSABLE_ENTITY` and read
-   * `(env.ext as ValidationFieldsExt).fields` for field-level rendering.
-   */
-  get envelope() {
-    return {
-      code: "UNPROCESSABLE_ENTITY",
-      message: this.message,
-      ext: { fields: this.fields }
-    };
-  }
-};
-function buildFieldsMap(issues) {
-  const fields = {};
-  const seen = /* @__PURE__ */ new Set();
-  for (const issue of issues) {
-    const key = issue.path.length === 0 ? "" : issue.path.join(".");
-    const dedupeKey = `${key}\0${issue.message}`;
-    if (seen.has(dedupeKey)) continue;
-    seen.add(dedupeKey);
-    const bucket = fields[key] ?? [];
-    bucket.push(issue.message);
-    fields[key] = bucket;
-  }
-  return fields;
-}
-function extractUniversalIssues(raw) {
-  if (!Array.isArray(raw)) return [];
-  const out = [];
-  for (const entry of raw) {
-    if (typeof entry !== "object" || entry === null) continue;
-    const obj = entry;
-    if (!Array.isArray(obj.path)) continue;
-    if (typeof obj.message !== "string") continue;
-    const path = [];
-    let pathValid = true;
-    for (const seg of obj.path) {
-      if (typeof seg === "string" || typeof seg === "number") {
-        path.push(seg);
-      } else {
-        pathValid = false;
-        break;
-      }
-    }
-    if (!pathValid) continue;
-    out.push({
-      path,
-      message: obj.message,
-      code: typeof obj.code === "string" ? obj.code : void 0
-    });
-  }
-  return out;
-}
-
 // src/server/http/form-data-to-object.ts
 import { z } from "zod";
 function formDataToObject(formData, schema, prefix = "") {
@@ -1183,6 +1184,188 @@ async function handleActionError(err, c) {
   });
 }
 
+// src/server/http/batch-handler.ts
+import { z as z2 } from "zod";
+var STRIPPED_HEADERS = [
+  "authorization",
+  "cookie",
+  "x-forwarded-for",
+  "x-forwarded-host",
+  "x-forwarded-proto",
+  "x-real-ip",
+  "host"
+];
+var BATCH_PATH = "/api/__theo_batch__";
+var DEFAULT_MAX_BATCH = 32;
+var batchRequestSchema = z2.object({
+  path: z2.string().min(1),
+  method: z2.string().min(1),
+  query: z2.record(z2.string(), z2.unknown()).optional(),
+  body: z2.unknown().optional(),
+  headers: z2.record(z2.string(), z2.string()).optional()
+});
+var batchPayloadSchema = z2.object({
+  requests: z2.array(batchRequestSchema).min(1)
+});
+function sanitizeItemHeaders(itemHeaders, outerHeaders) {
+  const out = {};
+  if (itemHeaders) {
+    for (const [k, v] of Object.entries(itemHeaders)) {
+      const lower = k.toLowerCase();
+      if (!STRIPPED_HEADERS.includes(lower)) {
+        out[lower] = v;
+      }
+    }
+  }
+  if (outerHeaders) {
+    for (const stripped of STRIPPED_HEADERS) {
+      if (Object.hasOwn(outerHeaders, stripped)) {
+        out[stripped] = outerHeaders[stripped];
+      }
+    }
+  }
+  return out;
+}
+async function handleBatchRequest(payload, options) {
+  const parsed = batchPayloadSchema.parse(payload);
+  const max = options.max ?? DEFAULT_MAX_BATCH;
+  if (parsed.requests.length > max) {
+    throw new Error(`Batch size ${parsed.requests.length} exceeds max ${max}`);
+  }
+  const results = [];
+  for (const item of parsed.requests) {
+    const sanitized = {
+      ...item,
+      headers: sanitizeItemHeaders(item.headers, options.outerHeaders)
+    };
+    try {
+      const r = await options.execute(sanitized);
+      results.push(r);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      results.push({ error: { message } });
+    }
+  }
+  return { results };
+}
+
+// src/server/http/cors.ts
+var DEFAULT_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"];
+var DEFAULT_ALLOWED_HEADERS = ["Content-Type", "X-Theo-Action", "Authorization"];
+var DEFAULT_MAX_AGE = 600;
+function readOrigin(req) {
+  const raw = req.headers.origin;
+  if (raw === void 0) return void 0;
+  if (Array.isArray(raw)) {
+    return raw.find((v) => typeof v === "string" && v.length > 0);
+  }
+  return raw;
+}
+function matchesOrigin(origin, allowed) {
+  if (allowed === "*") return true;
+  if (typeof allowed === "string") return origin === allowed;
+  if (allowed instanceof RegExp) {
+    allowed.lastIndex = 0;
+    return allowed.test(origin);
+  }
+  if (Array.isArray(allowed)) {
+    for (const entry of allowed) {
+      if (typeof entry === "string" && origin === entry) return true;
+      if (entry instanceof RegExp) {
+        entry.lastIndex = 0;
+        if (entry.test(origin)) return true;
+      }
+    }
+    return false;
+  }
+  if (typeof allowed === "function") {
+    try {
+      return allowed(origin);
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+function createCorsHandler(config) {
+  const methods = (config.methods ?? DEFAULT_METHODS).slice();
+  const allowedHeaders = (config.allowedHeaders ?? DEFAULT_ALLOWED_HEADERS).slice();
+  const maxAge = String(config.maxAge ?? DEFAULT_MAX_AGE);
+  const credentials = config.credentials === true;
+  return {
+    handlePreflight(req, res) {
+      if (req.method !== "OPTIONS") return false;
+      const acMethod = req.headers["access-control-request-method"];
+      if (!acMethod) return false;
+      const origin = readOrigin(req);
+      if (!origin) return false;
+      if (!matchesOrigin(origin, config.origins)) {
+        res.statusCode = 403;
+        res.end();
+        return true;
+      }
+      res.setHeader("Access-Control-Allow-Origin", origin);
+      res.setHeader("Access-Control-Allow-Methods", methods.join(", "));
+      res.setHeader("Access-Control-Allow-Headers", allowedHeaders.join(", "));
+      res.setHeader("Access-Control-Max-Age", maxAge);
+      res.setHeader("Vary", "Origin");
+      if (credentials) res.setHeader("Access-Control-Allow-Credentials", "true");
+      res.statusCode = 204;
+      res.end();
+      return true;
+    },
+    applyHeaders(req, res) {
+      const origin = readOrigin(req);
+      if (!origin) return;
+      if (!matchesOrigin(origin, config.origins)) return;
+      res.setHeader("Access-Control-Allow-Origin", origin);
+      res.setHeader("Vary", "Origin");
+      if (credentials) res.setHeader("Access-Control-Allow-Credentials", "true");
+      if (config.exposedHeaders && config.exposedHeaders.length > 0) {
+        res.setHeader("Access-Control-Expose-Headers", config.exposedHeaders.join(", "));
+      }
+    }
+  };
+}
+
+// src/server/http/trace-context.ts
+var TRACE_HEADER = "x-trace-id";
+var TRACE_PARENT_HEADER = "traceparent";
+var REQUEST_ID_HEADER = "x-request-id";
+var TRACEPARENT_RE = /^00-([0-9a-f]{32})-([0-9a-f]{16})-[0-9a-f]{2}$/;
+function parseTraceparent(value) {
+  if (!value) return null;
+  const m = TRACEPARENT_RE.exec(value);
+  if (!m) return null;
+  const traceId = m[1];
+  if (/^0+$/.test(traceId)) return null;
+  return traceId;
+}
+function pickHeader(value) {
+  if (Array.isArray(value)) {
+    for (const v of value) {
+      if (typeof v === "string" && v.length > 0) return v;
+    }
+    return null;
+  }
+  if (typeof value === "string" && value.length > 0) return value;
+  return null;
+}
+function resolveTraceIdFromHeaders(traceparent, requestId) {
+  if (traceparent !== null) {
+    const parsed = parseTraceparent(traceparent);
+    if (parsed !== null) return parsed;
+  }
+  if (requestId !== null) return requestId;
+  return globalThis.crypto.randomUUID();
+}
+function extractTraceId(req) {
+  return resolveTraceIdFromHeaders(
+    pickHeader(req.headers[TRACE_PARENT_HEADER]),
+    pickHeader(req.headers[REQUEST_ID_HEADER])
+  );
+}
+
 // src/server/observability/suggest.ts
 function levenshtein(a, b) {
   const m = a.length;
@@ -1818,6 +2001,227 @@ function createProductionLoader() {
   };
 }
 
+// src/server/security/csp-report.ts
+var CSP_REPORT_PATH = "/__theo/csp-report";
+var MAX_BODY = 16 * 1024;
+function pickHeader2(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value) && value.length > 0) return value[0];
+  return "";
+}
+function toStringSafe(value, fallback = "(missing)") {
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  return fallback;
+}
+function normalizeLegacy(raw) {
+  return {
+    blockedUrl: toStringSafe(raw["blocked-uri"]),
+    documentUrl: toStringSafe(raw["document-uri"]),
+    violatedDirective: toStringSafe(raw["violated-directive"]),
+    effectiveDirective: typeof raw["effective-directive"] === "string" ? raw["effective-directive"] : void 0,
+    originalPolicy: typeof raw["original-policy"] === "string" ? raw["original-policy"] : void 0,
+    disposition: raw.disposition === "enforce" || raw.disposition === "report" ? raw.disposition : void 0,
+    statusCode: typeof raw["status-code"] === "number" ? raw["status-code"] : void 0,
+    sourceFile: typeof raw["source-file"] === "string" ? raw["source-file"] : void 0,
+    lineNumber: typeof raw["line-number"] === "number" ? raw["line-number"] : void 0,
+    columnNumber: typeof raw["column-number"] === "number" ? raw["column-number"] : void 0
+  };
+}
+function normalizeNew(entry) {
+  if (!entry || typeof entry !== "object") return null;
+  const body = entry.body;
+  if (!body || typeof body !== "object") return null;
+  const b = body;
+  return {
+    blockedUrl: toStringSafe(b.blockedURL),
+    documentUrl: toStringSafe(b.documentURL),
+    violatedDirective: toStringSafe(b.violatedDirective),
+    effectiveDirective: typeof b.effectiveDirective === "string" ? b.effectiveDirective : void 0,
+    originalPolicy: typeof b.originalPolicy === "string" ? b.originalPolicy : void 0,
+    disposition: b.disposition === "enforce" || b.disposition === "report" ? b.disposition : void 0,
+    statusCode: typeof b.statusCode === "number" ? b.statusCode : void 0,
+    sourceFile: typeof b.sourceFile === "string" ? b.sourceFile : void 0,
+    lineNumber: typeof b.lineNumber === "number" ? b.lineNumber : void 0,
+    columnNumber: typeof b.columnNumber === "number" ? b.columnNumber : void 0
+  };
+}
+async function readBody(req, maxBytes) {
+  return await new Promise((resolve, reject) => {
+    const chunks = [];
+    let total = 0;
+    req.on("data", (chunk) => {
+      total += chunk.length;
+      if (total > maxBytes) {
+        reject(new Error("body too large"));
+        req.destroy();
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", () => {
+      resolve(Buffer.concat(chunks).toString("utf8"));
+    });
+    req.on("error", reject);
+  });
+}
+async function handleCspReport(req, res, opts) {
+  const ctHeader = req.headers["content-type"];
+  const ct = pickHeader2(ctHeader);
+  let raw;
+  try {
+    raw = await readBody(req, MAX_BODY);
+  } catch {
+    res.statusCode = 413;
+    res.end();
+    return;
+  }
+  let violations;
+  try {
+    if (ct.startsWith("application/csp-report")) {
+      const parsed = JSON.parse(raw);
+      const inner = parsed["csp-report"];
+      if (!inner || typeof inner !== "object") {
+        res.statusCode = 204;
+        res.end();
+        return;
+      }
+      violations = [normalizeLegacy(inner)];
+    } else if (ct.startsWith("application/reports+json")) {
+      const parsed = JSON.parse(raw);
+      const entries = Array.isArray(parsed) ? parsed : [];
+      violations = entries.map((e) => normalizeNew(e)).filter((v) => v !== null);
+    } else {
+      res.statusCode = 415;
+      res.end();
+      return;
+    }
+  } catch {
+    res.statusCode = 400;
+    res.end();
+    return;
+  }
+  for (const v of violations) {
+    safeAudit(opts.auditLogger, {
+      action: "csp.violation",
+      metadata: v
+    });
+    try {
+      opts.devtoolsDispatcher?.onCspViolation?.(v);
+    } catch {
+    }
+    try {
+      opts.onViolation?.(v);
+    } catch {
+    }
+  }
+  res.statusCode = 204;
+  res.end();
+}
+
+// src/server/security/csrf-readiness-endpoint.ts
+var CSRF_READINESS_PATH = "/__theo/csrf-readiness";
+var CSRF_READINESS_RESET_PATH = "/__theo/csrf-readiness/reset";
+function originMatchesHost(req) {
+  const origin = req.headers.origin;
+  if (typeof origin !== "string") return false;
+  const host = req.headers.host;
+  if (typeof host !== "string") return false;
+  try {
+    const parsed = new URL(origin);
+    return parsed.host === host;
+  } catch {
+    return false;
+  }
+}
+function sendJson2(res, status, body) {
+  res.writeHead(status, { "content-type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function sendNoContent(res) {
+  res.writeHead(204);
+  res.end();
+}
+function sendError2(res, status, code, message) {
+  res.writeHead(status, { "content-type": "application/json" });
+  res.end(JSON.stringify({ error: { code, message } }));
+}
+async function handleCsrfReadiness(req, res, store) {
+  const url = (req.url ?? "").split("?")[0];
+  const method = req.method ?? "GET";
+  if (url === CSRF_READINESS_PATH) {
+    if (method === "GET") {
+      sendJson2(res, 200, store.summary());
+      return true;
+    }
+    sendError2(res, 405, "METHOD_NOT_ALLOWED", `Use GET on ${CSRF_READINESS_PATH}`);
+    return true;
+  }
+  if (url === CSRF_READINESS_RESET_PATH) {
+    if (method !== "POST") {
+      sendError2(res, 405, "METHOD_NOT_ALLOWED", `Use POST on ${CSRF_READINESS_RESET_PATH}`);
+      return true;
+    }
+    const hasHeader = req.headers["x-theo-action"] === "1";
+    if (!hasHeader || !originMatchesHost(req)) {
+      sendError2(res, 403, "CSRF_INVALID", "Reset requires X-Theo-Action: 1 + same-origin");
+      return true;
+    }
+    store.reset();
+    sendNoContent(res);
+    return true;
+  }
+  return false;
+}
+
+// src/server/security/csrf-readiness-store.ts
+var CsrfReadinessStore = class _CsrfReadinessStore {
+  static MAX_ENTRIES = 1e3;
+  entries = /* @__PURE__ */ new Map();
+  keyFor(event) {
+    return `${event.method}\0${event.path}\0${event.reason}`;
+  }
+  record(event) {
+    const key = this.keyFor(event);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const existing = this.entries.get(key);
+    if (existing) {
+      existing.count++;
+      existing.lastSeen = now;
+      return;
+    }
+    if (this.entries.size >= _CsrfReadinessStore.MAX_ENTRIES) {
+      const firstKey = this.entries.keys().next().value;
+      if (firstKey !== void 0) this.entries.delete(firstKey);
+    }
+    this.entries.set(key, { count: 1, firstSeen: now, lastSeen: now });
+  }
+  summary() {
+    let total = 0;
+    const routes = [];
+    for (const [key, entry] of this.entries) {
+      const [method, path, reason] = key.split("\0");
+      routes.push({
+        method,
+        path,
+        reason,
+        count: entry.count,
+        firstSeen: entry.firstSeen,
+        lastSeen: entry.lastSeen
+      });
+      total += entry.count;
+    }
+    return {
+      generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      totalEvents: total,
+      routes
+    };
+  }
+  reset() {
+    this.entries.clear();
+  }
+};
+
 // src/server/security/security-headers.ts
 var DEFAULT_CSP = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' ws: wss:; frame-ancestors 'none'; report-uri /__theo/csp-report";
 var DEFAULT_PERMISSIONS_POLICY = "geolocation=(), camera=(), microphone=(), payment=(), usb=(), accelerometer=(), gyroscope=()";
@@ -1903,6 +2307,11 @@ function generateNonce() {
 export {
   executeRoute,
   executeAction,
+  BATCH_PATH,
+  handleBatchRequest,
+  createCorsHandler,
+  TRACE_HEADER,
+  extractTraceId,
   findSuggestion,
   createPluginRunnerFromConfig,
   createRateLimiter,
@@ -1918,8 +2327,12 @@ export {
   mountAgent,
   createViteLoader,
   createProductionLoader,
+  CSP_REPORT_PATH,
+  handleCspReport,
+  handleCsrfReadiness,
+  CsrfReadinessStore,
   buildSecurityHeaders,
   applySecurityHeaders,
   generateNonce
 };
-//# sourceMappingURL=chunk-H6YBKIUN.js.map
+//# sourceMappingURL=chunk-ABUVJU3P.js.map