theokit 0.5.3 → 0.6.0

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/config/define-config.ts","../src/core/validate-structure.ts","../src/core/errors.ts"],"sourcesContent":["import type { TheoConfig } from './schema.js'\n\n/**\n * Define Theo framework configuration.\n * Identity function — provides type inference for theo.config.ts.\n * Runtime validation happens in loadConfig(), not here.\n */\nexport function defineConfig(config: Partial<TheoConfig>): Partial<TheoConfig> {\n  return config\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Project-structure validator. Reads paths joined onto `projectRoot`,\n * with names from a fixed `ValidationRule[]` table. No HTTP input.\n */\nimport { existsSync } from 'node:fs'\nimport { join } from 'node:path'\n\nimport { TheoProjectError } from './errors.js'\n\ninterface ValidationRule {\n  path: string\n  errorMessage: string\n}\n\nconst REQUIRED_DIRS: ValidationRule[] = [\n  {\n    path: 'app',\n    errorMessage: 'Missing required directory: app/',\n  },\n]\n\nconst REQUIRED_FILES: ValidationRule[] = [\n  {\n    path: 'theo.config.ts',\n    errorMessage: 'Missing required file: theo.config.ts',\n  },\n  {\n    path: 'package.json',\n    errorMessage: 'Missing required file: package.json',\n  },\n]\n\nexport function validateProjectStructure(rootDir: string): void {\n  if (!existsSync(rootDir)) {\n    throw new TheoProjectError([`Project directory does not exist: ${rootDir}`], rootDir)\n  }\n\n  const errors: string[] = []\n\n  for (const rule of REQUIRED_DIRS) {\n    if (!existsSync(join(rootDir, rule.path))) {\n      errors.push(rule.errorMessage)\n    }\n  }\n\n  for (const rule of REQUIRED_FILES) {\n    if (!existsSync(join(rootDir, rule.path))) {\n      errors.push(rule.errorMessage)\n    }\n  }\n\n  if (errors.length > 0) {\n    throw new TheoProjectError(errors, rootDir)\n  }\n}\n","export class TheoProjectError extends Error {\n  public readonly errors: string[]\n  public readonly rootDir: string\n\n  constructor(errors: string[], rootDir: string) {\n    const errorLines = errors.map((e) => `  - ${e}`).join('\\n')\n\n    super(\n      `Invalid Theo project structure\\n\\n` +\n        `  Root: ${rootDir}\\n\\n` +\n        (errorLines ? `  Errors:\\n${errorLines}\\n` : ''),\n    )\n\n    this.name = 'TheoProjectError'\n    this.errors = errors\n    this.rootDir = rootDir\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOO,SAAS,aAAa,QAAkD;AAC7E,SAAO;AACT;;;ACLA,SAAS,kBAAkB;AAC3B,SAAS,YAAY;;;ACLd,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1B;AAAA,EACA;AAAA,EAEhB,YAAY,QAAkB,SAAiB;AAC7C,UAAM,aAAa,OAAO,IAAI,CAAC,MAAM,OAAO,CAAC,EAAE,EAAE,KAAK,IAAI;AAE1D;AAAA,MACE;AAAA;AAAA,UACa,OAAO;AAAA;AAAA,KACjB,aAAa;AAAA,EAAc,UAAU;AAAA,IAAO;AAAA,IACjD;AAEA,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,UAAU;AAAA,EACjB;AACF;;;ADHA,IAAM,gBAAkC;AAAA,EACtC;AAAA,IACE,MAAM;AAAA,IACN,cAAc;AAAA,EAChB;AACF;AAEA,IAAM,iBAAmC;AAAA,EACvC;AAAA,IACE,MAAM;AAAA,IACN,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,cAAc;AAAA,EAChB;AACF;AAEO,SAAS,yBAAyB,SAAuB;AAC9D,MAAI,CAAC,WAAW,OAAO,GAAG;AACxB,UAAM,IAAI,iBAAiB,CAAC,qCAAqC,OAAO,EAAE,GAAG,OAAO;AAAA,EACtF;AAEA,QAAM,SAAmB,CAAC;AAE1B,aAAW,QAAQ,eAAe;AAChC,QAAI,CAAC,WAAW,KAAK,SAAS,KAAK,IAAI,CAAC,GAAG;AACzC,aAAO,KAAK,KAAK,YAAY;AAAA,IAC/B;AAAA,EACF;AAEA,aAAW,QAAQ,gBAAgB;AACjC,QAAI,CAAC,WAAW,KAAK,SAAS,KAAK,IAAI,CAAC,GAAG;AACzC,aAAO,KAAK,KAAK,YAAY;AAAA,IAC/B;AAAA,EACF;AAEA,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,IAAI,iBAAiB,QAAQ,OAAO;AAAA,EAC5C;AACF;","names":[]}
+{"version":3,"sources":["../src/config/define-config.ts","../src/core/validate-structure.ts","../src/core/errors.ts"],"sourcesContent":["import type { TheoConfig } from './schema.js'\n\n/**\n * Define Theo framework configuration.\n * Identity function — provides type inference for theo.config.ts.\n * Runtime validation happens in loadConfig(), not here.\n */\nexport function defineConfig(config: Partial<TheoConfig>): Partial<TheoConfig> {\n  return config\n}\n","/* eslint-disable security/detect-non-literal-fs-filename --\n * Project-structure validator. Reads paths joined onto `projectRoot`,\n * with names from a fixed `ValidationRule[]` table. No HTTP input.\n */\nimport { existsSync } from 'node:fs'\nimport { join } from 'node:path'\n\nimport { TheoProjectError } from './errors.js'\n\ninterface ValidationRule {\n  path: string\n  errorMessage: string\n}\n\nconst REQUIRED_DIRS: ValidationRule[] = [\n  {\n    path: 'app',\n    errorMessage: 'Missing required directory: app/',\n  },\n]\n\nconst REQUIRED_FILES: ValidationRule[] = [\n  {\n    path: 'theo.config.ts',\n    errorMessage: 'Missing required file: theo.config.ts',\n  },\n  {\n    path: 'package.json',\n    errorMessage: 'Missing required file: package.json',\n  },\n]\n\nexport function validateProjectStructure(rootDir: string): void {\n  if (!existsSync(rootDir)) {\n    throw new TheoProjectError([`Project directory does not exist: ${rootDir}`], rootDir)\n  }\n\n  const errors: string[] = []\n\n  for (const rule of REQUIRED_DIRS) {\n    if (!existsSync(join(rootDir, rule.path))) {\n      errors.push(rule.errorMessage)\n    }\n  }\n\n  for (const rule of REQUIRED_FILES) {\n    if (!existsSync(join(rootDir, rule.path))) {\n      errors.push(rule.errorMessage)\n    }\n  }\n\n  if (errors.length > 0) {\n    throw new TheoProjectError(errors, rootDir)\n  }\n}\n","export class TheoProjectError extends Error {\n  public readonly errors: string[]\n  public readonly rootDir: string\n\n  constructor(errors: string[], rootDir: string) {\n    const errorLines = errors.map((e) => `  - ${e}`).join('\\n')\n\n    super(\n      `Invalid Theo project structure\\n\\n` +\n        `  Root: ${rootDir}\\n\\n` +\n        (errorLines ? `  Errors:\\n${errorLines}\\n` : ''),\n    )\n\n    this.name = 'TheoProjectError'\n    this.errors = errors\n    this.rootDir = rootDir\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOO,SAAS,aAAa,QAAkD;AAC7E,SAAO;AACT;;;ACLA,SAAS,kBAAkB;AAC3B,SAAS,YAAY;;;ACLd,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1B;AAAA,EACA;AAAA,EAEhB,YAAY,QAAkB,SAAiB;AAC7C,UAAM,aAAa,OAAO,IAAI,CAAC,MAAM,OAAO,CAAC,EAAE,EAAE,KAAK,IAAI;AAE1D;AAAA,MACE;AAAA;AAAA,UACa,OAAO;AAAA;AAAA,KACjB,aAAa;AAAA,EAAc,UAAU;AAAA,IAAO;AAAA,IACjD;AAEA,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,UAAU;AAAA,EACjB;AACF;;;ADHA,IAAM,gBAAkC;AAAA,EACtC;AAAA,IACE,MAAM;AAAA,IACN,cAAc;AAAA,EAChB;AACF;AAEA,IAAM,iBAAmC;AAAA,EACvC;AAAA,IACE,MAAM;AAAA,IACN,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,cAAc;AAAA,EAChB;AACF;AAEO,SAAS,yBAAyB,SAAuB;AAC9D,MAAI,CAAC,WAAW,OAAO,GAAG;AACxB,UAAM,IAAI,iBAAiB,CAAC,qCAAqC,OAAO,EAAE,GAAG,OAAO;AAAA,EACtF;AAEA,QAAM,SAAmB,CAAC;AAE1B,aAAW,QAAQ,eAAe;AAChC,QAAI,CAAC,WAAW,KAAK,SAAS,KAAK,IAAI,CAAC,GAAG;AACzC,aAAO,KAAK,KAAK,YAAY;AAAA,IAC/B;AAAA,EACF;AAEA,aAAW,QAAQ,gBAAgB;AACjC,QAAI,CAAC,WAAW,KAAK,SAAS,KAAK,IAAI,CAAC,GAAG;AACzC,aAAO,KAAK,KAAK,YAAY;AAAA,IAC/B;AAAA,EACF;AAEA,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,IAAI,iBAAiB,QAAQ,OAAO;AAAA,EAC5C;AACF;","names":[]}

package/dist/{info-CORLCPEJ.js → info-CSGWIAXA.js}

@@ -2,12 +2,12 @@
 import "tsx/esm";
 import {
   loadConfig
-} from "./chunk-DUKXQNM7.js";
-import "./chunk-FGOX37NB.js";
-import "./chunk-X32KQH5C.js";
+} from "./chunk-IHMJV2OK.js";
+import "./chunk-BNGBG2SQ.js";
+import "./chunk-CCVC6P6B.js";
 import {
   scanRoutes
-} from "./chunk-CG563V5M.js";
+} from "./chunk-IEES3CHD.js";
 import "./chunk-KT3MWNZG.js";
 
 // src/cli/commands/info.ts
@@ -101,4 +101,4 @@ export {
   buildInfo,
   infoCommand
 };
-//# sourceMappingURL=info-CORLCPEJ.js.map
+//# sourceMappingURL=info-CSGWIAXA.js.map

package/dist/{netlify-O7G3RLK4.js → netlify-DUB7BZ4E.js}

@@ -2,11 +2,11 @@
 import "tsx/esm";
 import {
   nodeAdapter
-} from "./chunk-MWYSRZI4.js";
+} from "./chunk-EQV67HZL.js";
 import {
   assertServicesUnsupported,
   readManifest
-} from "./chunk-X32KQH5C.js";
+} from "./chunk-CCVC6P6B.js";
 import "./chunk-KT3MWNZG.js";
 
 // src/adapters/netlify.ts
@@ -148,4 +148,4 @@ export {
   netlifyAdapter,
   renderNetlifyFunction
 };
-//# sourceMappingURL=netlify-O7G3RLK4.js.map
+//# sourceMappingURL=netlify-DUB7BZ4E.js.map

package/dist/{node-LXPQLMVB.js → node-ELE236WK.js}

@@ -2,10 +2,10 @@
 import "tsx/esm";
 import {
   nodeAdapter
-} from "./chunk-MWYSRZI4.js";
-import "./chunk-X32KQH5C.js";
+} from "./chunk-EQV67HZL.js";
+import "./chunk-CCVC6P6B.js";
 import "./chunk-KT3MWNZG.js";
 export {
   nodeAdapter
 };
-//# sourceMappingURL=node-LXPQLMVB.js.map
+//# sourceMappingURL=node-ELE236WK.js.map

package/dist/{openapi-TEOUOIJ2.js → openapi-KSY272CW.js}

@@ -2,13 +2,13 @@
 import "tsx/esm";
 import {
   loadConfig
-} from "./chunk-DUKXQNM7.js";
-import "./chunk-FGOX37NB.js";
-import "./chunk-X32KQH5C.js";
+} from "./chunk-IHMJV2OK.js";
+import "./chunk-BNGBG2SQ.js";
+import "./chunk-CCVC6P6B.js";
 import {
   emitOpenApi,
   loadRoutesForOpenApi
-} from "./chunk-WGHJD6I7.js";
+} from "./chunk-JAIKGP3Q.js";
 import {
   generateManifest
 } from "./chunk-HDA6M7P4.js";
@@ -81,4 +81,4 @@ function emitOpenApiInMemory(manifest, config) {
 export {
   openapiCommand
 };
-//# sourceMappingURL=openapi-TEOUOIJ2.js.map
+//# sourceMappingURL=openapi-KSY272CW.js.map

package/dist/registry-B7FA6KMI.js

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+import "tsx/esm";
+import "./chunk-KT3MWNZG.js";
+
+// src/adapters/registry.ts
+var adapterRegistry = {
+  node: async () => (await import("./node-ELE236WK.js")).nodeAdapter,
+  vercel: async () => (await import("./vercel-LGDQWYZD.js")).vercelAdapter,
+  cloudflare: async () => (await import("./cloudflare-U5GYYI47.js")).cloudflareAdapter,
+  static: async () => (await import("./static-YWF2M6YT.js")).staticAdapter,
+  bun: async () => (await import("./bun-UTDVN6R4.js")).bunAdapter,
+  "deno-deploy": async () => (await import("./deno-deploy-3QHJ3AJQ.js")).denoDeployAdapter,
+  netlify: async () => (await import("./netlify-DUB7BZ4E.js")).netlifyAdapter,
+  "aws-lambda": async () => (await import("./aws-lambda-WT4HRBNL.js")).awsLambdaAdapter,
+  "theo-cloud": async () => (await import("./theo-cloud-EUK56I7O.js")).theoCloudAdapter
+};
+async function resolveAdapter(target) {
+  const factory = adapterRegistry[target];
+  return factory();
+}
+export {
+  adapterRegistry,
+  resolveAdapter
+};
+//# sourceMappingURL=registry-B7FA6KMI.js.map

package/dist/{routes-GAXVWJUK.js → routes-NWJA5L5I.js}

@@ -5,9 +5,9 @@ import {
 } from "./chunk-XMS5VRIK.js";
 import {
   loadConfig
-} from "./chunk-DUKXQNM7.js";
-import "./chunk-FGOX37NB.js";
-import "./chunk-X32KQH5C.js";
+} from "./chunk-IHMJV2OK.js";
+import "./chunk-BNGBG2SQ.js";
+import "./chunk-CCVC6P6B.js";
 import {
   scanServerRoutes,
   scanWebSocketRoutes
@@ -63,4 +63,4 @@ async function routesCommand() {
 export {
   routesCommand
 };
-//# sourceMappingURL=routes-GAXVWJUK.js.map
+//# sourceMappingURL=routes-NWJA5L5I.js.map

package/dist/{scan-NQFI5S7P.js → scan-I5PT6TUX.js}

@@ -2,9 +2,9 @@
 import "tsx/esm";
 import {
   scanRoutes
-} from "./chunk-CG563V5M.js";
+} from "./chunk-IEES3CHD.js";
 import "./chunk-KT3MWNZG.js";
 export {
   scanRoutes
 };
-//# sourceMappingURL=scan-NQFI5S7P.js.map
+//# sourceMappingURL=scan-I5PT6TUX.js.map

package/dist/{schema-D3v8VB7o.d.ts → schema-BpH6ivDY.d.ts}

@@ -25,14 +25,13 @@ declare const ServiceDefinitionSchema: z.ZodObject<{
     type: z.ZodOptional<z.ZodEnum<{
         server: "server";
         worker: "worker";
-        frontend: "frontend";
     }>>;
     port: z.ZodNumber;
     proxy: z.ZodString;
     dev: z.ZodString;
     build: z.ZodOptional<z.ZodString>;
     start: z.ZodString;
-    openapi: z.ZodOptional<z.ZodString>;
+    openapi: z.ZodOptional<z.ZodURL>;
     healthcheck: z.ZodDefault<z.ZodString>;
     cors: z.ZodDefault<z.ZodBoolean>;
     env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -56,14 +55,13 @@ declare const servicesConfigSchema: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodO
     type: z.ZodOptional<z.ZodEnum<{
         server: "server";
         worker: "worker";
-        frontend: "frontend";
     }>>;
     port: z.ZodNumber;
     proxy: z.ZodString;
     dev: z.ZodString;
     build: z.ZodOptional<z.ZodString>;
     start: z.ZodString;
-    openapi: z.ZodOptional<z.ZodString>;
+    openapi: z.ZodOptional<z.ZodURL>;
     healthcheck: z.ZodDefault<z.ZodString>;
     cors: z.ZodDefault<z.ZodBoolean>;
     env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;

package/dist/{schema-Z5VJ2I76.js → schema-NPI4NJEF.js}

@@ -12,8 +12,8 @@ import {
   storageSchema,
   theoConfigSchema,
   uploadSchema
-} from "./chunk-FGOX37NB.js";
-import "./chunk-X32KQH5C.js";
+} from "./chunk-BNGBG2SQ.js";
+import "./chunk-CCVC6P6B.js";
 import "./chunk-KT3MWNZG.js";
 export {
   cacheSchema,
@@ -28,4 +28,4 @@ export {
   theoConfigSchema,
   uploadSchema
 };
-//# sourceMappingURL=schema-Z5VJ2I76.js.map
+//# sourceMappingURL=schema-NPI4NJEF.js.map

package/dist/server/auth/index.js

@@ -1,4 +1,5 @@
 import {
+  AuthRequiredError,
   _resetKeyCacheForTests,
   assertProductionSecret,
   checkThrottle,
@@ -15,21 +16,18 @@ import {
   generateTotpSecret,
   pkceChallengeFromVerifier,
   recordAttempt,
+  requireAuth,
   rotateIfNeeded,
   rotateIfNeededWeb,
   totpUri,
   verifyBackupCode,
   verifyOAuthState,
   verifyTotp
-} from "../../chunk-NZXH2LQQ.js";
+} from "../../chunk-SJIRP73B.js";
 import {
   generateNonce
 } from "../../chunk-C3ZZ56YZ.js";
 import "../../chunk-ZJQ4O76G.js";
-import {
-  AuthRequiredError,
-  requireAuth
-} from "../../chunk-4HBI7DHP.js";
 import "../../chunk-DGUM43GV.js";
 export {
   AuthRequiredError,

package/dist/server/define/index.d.ts

@@ -71,6 +71,13 @@ interface ActionConfig<TInput extends z.ZodType, TCtx = unknown> {
      * boolean string / number / array coercion (Astro pattern).
      */
     accept?: ActionAccept;
+    /**
+     * Opt OUT of CSRF enforcement for this action. Default (omitted) keeps the
+     * multi-header CSRF gate active. Set `false` for endpoints intentionally
+     * callable without the `X-Theo-Action` header (e.g. public webhooks). The
+     * runtime in `server/http/action-execute.ts` reads this flag.
+     */
+    csrf?: false;
     handler: (ctx: {
         input: z.infer<TInput>;
         ctx: TCtx;

package/dist/server/define/index.js

@@ -9,7 +9,7 @@ import {
   defineWebChannel,
   defineWebSocket,
   defineWebSocketWeb
-} from "../../chunk-H4J2LECY.js";
+} from "../../chunk-6BUUZ2PK.js";
 import "../../chunk-DGUM43GV.js";
 export {
   defineAction,

package/dist/server/http/index.js

@@ -22,7 +22,7 @@ import {
   runMiddlewareAndContext,
   sendError,
   sendJson
-} from "../../chunk-KJLECZWQ.js";
+} from "../../chunk-3FYJ7R7N.js";
 import "../../chunk-GY5Q27BJ.js";
 import "../../chunk-Z5IGLBWE.js";
 import "../../chunk-ZEGYW52B.js";
@@ -38,7 +38,6 @@ import {
   serializeCookie,
   setCookie
 } from "../../chunk-ZJQ4O76G.js";
-import "../../chunk-4HBI7DHP.js";
 import "../../chunk-DGUM43GV.js";
 export {
   BATCH_PATH,

package/dist/server/index.d.ts

@@ -31,7 +31,7 @@ import { z } from 'zod';
 import { IncomingMessage } from 'node:http';
 import { W as WebOnRequestHook, b as WebPreHandlerHook, c as WebOnResponseHook, d as WebOnErrorHook } from '../plugin-types-DNJGxr4Z.js';
 export { e as HookName, H as HookResult, O as OnErrorHook, f as OnRequestHook, g as OnResponseHook, P as PluginContext, h as PluginErrorContext, i as PreHandlerHook, R as RunHookOptions, a as TheoApp, T as TheoPlugin, j as definePlugin } from '../plugin-types-DNJGxr4Z.js';
-export { a as ServiceDefinition, S as ServicesConfig, b as ServicesConfigInput, c as ServicesConfigOutput } from '../schema-D3v8VB7o.js';
+export { a as ServiceDefinition, S as ServicesConfig, b as ServicesConfigInput, c as ServicesConfigOutput } from '../schema-BpH6ivDY.js';
 import 'vite';
 
 /**
@@ -687,6 +687,25 @@ declare function serializeResponse(data: unknown): SerializedResponse;
  */
 declare function deserializeResponse(serialized: SerializedResponse): unknown;
 
+/**
+ * T3.2 — Web-Standards middleware runner for the `executeWebRequest` path.
+ *
+ * The Node request path (`http/execute.ts`) runs middleware via
+ * `runMiddlewareAndContext`, which is coupled to Node `req`/`res`. Per G8
+ * (Web Standards over Node APIs) the Web path needs a `Request`-shaped runner;
+ * this is it. Extracted to a sibling so `web-handler.ts` stays under its LoC
+ * budget (G6).
+ *
+ * Ordering invariant (EC-3): the caller runs the CSRF gate BEFORE invoking this
+ * runner, mirroring the Node path (CSRF stage precedes user middleware).
+ *
+ * NOTE (D4 / EC-12): this is its own middleware contract — `(request, context)`.
+ * Full semantic parity with the Node `defineMiddleware` contract is part of the
+ * deferred Node→Web pipeline convergence, not this slice.
+ */
+/** A Web-path middleware: mutate `context`, or return a `Response` to short-circuit. */
+type WebMiddleware = (request: Request, context: Record<string, unknown>) => Promise<Response | undefined> | Response | undefined | void;
+
 /**
  * The route module exported by a `server/routes/*.ts` file (after T2.6 G6
  * router lockdown). Method-named exports map to `defineRoute` results.
@@ -710,6 +729,20 @@ type WebRouteModule = Partial<Record<'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE'
  */
 interface ExecuteWebRequestOptions {
     csrfMode?: 'off' | 'strict';
+    /**
+     * T3.1 — route params resolved upstream by `matchRoute` (e.g. `{ id: '42' }`
+     * for `/users/:id`). Threaded to the handler's `params` input and validated
+     * against `config.params` (Zod) when declared. Defaults to `{}` — callers
+     * that don't supply params keep the prior behavior (additive, backward-compat).
+     */
+    params?: Record<string, string>;
+    /**
+     * T3.2 — Web-Standards middleware chain. Runs in order AFTER the CSRF gate
+     * (EC-3) and BEFORE the handler. A middleware returning a `Response`
+     * short-circuits (handler not reached); mutating `context` passes data to
+     * the handler. Omitted → zero overhead (handler runs directly).
+     */
+    middleware?: readonly WebMiddleware[];
     /**
      * T5a.2 Phase E — body parser strategy.
      *

package/dist/server/index.js

@@ -119,6 +119,7 @@ import {
   streamAgentRun
 } from "../chunk-RESN62GB.js";
 import {
+  AuthRequiredError,
   _resetKeyCacheForTests,
   assertProductionSecret,
   checkThrottle,
@@ -135,13 +136,14 @@ import {
   generateTotpSecret,
   pkceChallengeFromVerifier,
   recordAttempt,
+  requireAuth,
   rotateIfNeeded,
   rotateIfNeededWeb,
   totpUri,
   verifyBackupCode,
   verifyOAuthState,
   verifyTotp
-} from "../chunk-NZXH2LQQ.js";
+} from "../chunk-SJIRP73B.js";
 import {
   generateNonce
 } from "../chunk-C3ZZ56YZ.js";
@@ -181,7 +183,7 @@ import {
   defineWebChannel,
   defineWebSocket,
   defineWebSocketWeb
-} from "../chunk-H4J2LECY.js";
+} from "../chunk-6BUUZ2PK.js";
 import {
   MAX_ERROR_HTML_BYTES,
   loadCustomErrorPages,
@@ -198,6 +200,7 @@ import {
   _resetMiddlewareCacheForTests,
   createCorsHandler,
   createCorsWebHandler,
+  envelopeCodeToStatus,
   executeAction,
   executeRoute,
   extractTraceId,
@@ -211,7 +214,7 @@ import {
   runMiddlewareAndContext,
   sendError,
   sendJson
-} from "../chunk-KJLECZWQ.js";
+} from "../chunk-3FYJ7R7N.js";
 import {
   DuplicateContextKeyError,
   createOutbox,
@@ -252,10 +255,6 @@ import {
   serializeCookie,
   setCookie
 } from "../chunk-ZJQ4O76G.js";
-import {
-  AuthRequiredError,
-  requireAuth
-} from "../chunk-4HBI7DHP.js";
 import "../chunk-DGUM43GV.js";
 
 // src/server/openapi/serve-docs.ts
@@ -266,12 +265,13 @@ var DEFAULT_CDN = "https://cdn.jsdelivr.net/npm/@scalar/api-reference";
 function createOpenApiHandler(opts = {}) {
   const docsPath = opts.docsPath ?? "/api/docs";
   const jsonPath = opts.openapiJsonPath ?? "/api/docs/openapi.json";
-  const specFile = resolve(opts.specFilePath ?? ".theokit/openapi.json");
+  const rawSpecFile = opts.specFilePath ?? ".theokit/openapi.json";
   const title = opts.pageTitle ?? "API Reference";
   const cdn = opts.cdnUrl ?? DEFAULT_CDN;
-  if (specFile.includes("..")) {
-    throw new Error(`[theokit:openapi] specFilePath must not contain ".." segments: ${specFile}`);
+  if (hasDotDotSegment(rawSpecFile)) {
+    throw new Error(`[theokit:openapi] specFilePath must not contain ".." segments: ${rawSpecFile}`);
   }
+  const specFile = resolve(rawSpecFile);
   return (request) => {
     if (request.method !== "GET") return null;
     const url = new URL(request.url);
@@ -291,6 +291,9 @@ function createOpenApiHandler(opts = {}) {
     return null;
   };
 }
+function hasDotDotSegment(p) {
+  return p.split(/[/\\]/).includes("..");
+}
 function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
@@ -1095,6 +1098,15 @@ function deserializeResponse(serialized) {
   return superjson.deserialize(serialized);
 }
 
+// src/server/http/web-middleware-runner.ts
+async function runWebMiddleware(request, middleware, context) {
+  for (const mw of middleware) {
+    const result = await mw(request, context);
+    if (result instanceof Response) return result;
+  }
+  return void 0;
+}
+
 // src/server/web-handler.ts
 function searchParamsToObject(params) {
   const out = {};
@@ -1159,11 +1171,11 @@ function validationErrorResponse(zodError, field) {
     headers: { "content-type": "application/json" }
   });
 }
-async function runHandler(config, request, bodyParser = "inline") {
+async function runHandler(config, request, bodyParser = "inline", paramsInput = {}, context = {}) {
   const url = new URL(request.url);
   const queryRaw = searchParamsToObject(url.searchParams);
   const bodyRaw = bodyParser === "full" ? await parseBodyFull(request) : await parseBodyInline(request);
-  const paramsRaw = {};
+  const paramsRaw = paramsInput;
   let query = queryRaw;
   if (config.query !== void 0) {
     const parsed = config.query.safeParse(queryRaw);
@@ -1185,7 +1197,7 @@ async function runHandler(config, request, bodyParser = "inline") {
       return { ok: false, response: validationErrorResponse(parsed.error, "params") };
     params = parsed.data;
   }
-  const result = await config.handler({ query, body, params, request });
+  const result = await config.handler({ query, body, params, request, context });
   return { ok: true, result };
 }
 function toResponse(result) {
@@ -1208,36 +1220,6 @@ function handlerErrorResponse(err) {
     headers: { "content-type": "application/json" }
   });
 }
-function envelopeCodeToStatus(code) {
-  switch (code) {
-    case "BAD_REQUEST":
-      return 400;
-    case "UNAUTHORIZED":
-      return 401;
-    case "FORBIDDEN":
-      return 403;
-    case "NOT_FOUND":
-      return 404;
-    case "METHOD_NOT_ALLOWED":
-      return 405;
-    case "PAYLOAD_TOO_LARGE":
-      return 413;
-    case "UNPROCESSABLE_ENTITY":
-      return 422;
-    case "TOO_MANY_REQUESTS":
-    case "RATE_LIMITED":
-      return 429;
-    case "BAD_GATEWAY":
-      return 502;
-    case "SERVICE_UNAVAILABLE":
-      return 503;
-    case "GATEWAY_TIMEOUT":
-      return 504;
-    case "INTERNAL_SERVER_ERROR":
-    default:
-      return 500;
-  }
-}
 var CSRF_PROTECTED_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
 function mergeHookHeaders(response, hookHeaders) {
   if ([...hookHeaders].length === 0) return response;
@@ -1287,7 +1269,18 @@ async function executeWebRequest(request, routeModule, opts = {}) {
       if (!csrfCheck.valid) return csrfFailedResponse(csrfCheck.reason);
     }
     try {
-      const outcome = await runHandler(config, request, opts.bodyParser ?? "inline");
+      const context = {};
+      if (opts.middleware?.length) {
+        const shortCircuit = await runWebMiddleware(request, opts.middleware, context);
+        if (shortCircuit) return shortCircuit;
+      }
+      const outcome = await runHandler(
+        config,
+        request,
+        opts.bodyParser ?? "inline",
+        opts.params ?? {},
+        context
+      );
       if (!outcome.ok) return outcome.response;
       return toResponse(outcome.result);
     } catch (err) {
@@ -1313,13 +1306,29 @@ async function runPreHandlerPipeline(hookCtx, request, config, opts, hooks) {
     await runList(hooks.preHandler);
   }
   if (hookCtx.response === void 0) {
-    if (config === void 0 || typeof config.handler !== "function") {
-      hookCtx.response = methodNotAllowedResponse(method);
+    await runHandlerStage(hookCtx, request, config, opts, method);
+  }
+}
+async function runHandlerStage(hookCtx, request, config, opts, method) {
+  if (config === void 0 || typeof config.handler !== "function") {
+    hookCtx.response = methodNotAllowedResponse(method);
+    return;
+  }
+  if (opts.middleware?.length) {
+    const shortCircuit = await runWebMiddleware(request, opts.middleware, hookCtx.ctx);
+    if (shortCircuit) {
+      hookCtx.response = shortCircuit;
       return;
     }
-    const outcome = await runHandler(config, request, opts.bodyParser ?? "inline");
-    hookCtx.response = outcome.ok ? toResponse(outcome.result) : outcome.response;
   }
+  const outcome = await runHandler(
+    config,
+    request,
+    opts.bodyParser ?? "inline",
+    opts.params ?? {},
+    hookCtx.ctx
+  );
+  hookCtx.response = outcome.ok ? toResponse(outcome.result) : outcome.response;
 }
 async function runWithHooks(request, config, opts, hooks) {
   const hookCtx = {