theokit 0.6.0 → 0.7.0

package/dist/{chunk-4NLIESWK.js → chunk-4I47JW5O.js}

@@ -1,5 +1,22 @@
 #!/usr/bin/env node
 import "tsx/esm";
+import {
+  resolveTransformer
+} from "./chunk-PBEH6NXR.js";
+import {
+  loadConfig
+} from "./chunk-IHMJV2OK.js";
+import {
+  BATCH_PATH,
+  CSP_REPORT_PATH,
+  CsrfReadinessStore,
+  TRACE_HEADER,
+  createCorsHandler,
+  extractTraceId,
+  handleBatchRequest,
+  handleCspReport,
+  handleCsrfReadiness
+} from "./chunk-CBGRFVF5.js";
 import {
   applySecurityHeaders,
   createPluginRunnerFromConfig,
@@ -10,13 +27,8 @@ import {
   findSuggestion,
   generateNonce,
   logRequest,
-  resolveTransformer,
-  safeAudit,
   sendError
-} from "./chunk-D4SV7JOG.js";
-import {
-  loadConfig
-} from "./chunk-IHMJV2OK.js";
+} from "./chunk-MV4LKTW6.js";
 import {
   buildServicesProxyConfig
 } from "./chunk-CCVC6P6B.js";
@@ -29,12 +41,10 @@ import {
 } from "./chunk-IEES3CHD.js";
 import {
   matchRoute,
+  scanServerActions,
   scanServerRoutes,
   scanWebSocketRoutes
-} from "./chunk-P2RS3WWY.js";
-import {
-  scanServerActions
-} from "./chunk-UVHRD33F.js";
+} from "./chunk-6FYD34NX.js";
 
 // src/vite-plugin/index.ts
 import { existsSync as existsSync7 } from "fs";
@@ -285,54 +295,6 @@ function broadcastRouteManifest(tree) {
   broadcastToDevtools("theo:devtools:manifest", manifest);
 }
 
-// src/server/security/csrf-readiness-store.ts
-var CsrfReadinessStore = class _CsrfReadinessStore {
-  static MAX_ENTRIES = 1e3;
-  entries = /* @__PURE__ */ new Map();
-  keyFor(event) {
-    return `${event.method}\0${event.path}\0${event.reason}`;
-  }
-  record(event) {
-    const key = this.keyFor(event);
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const existing = this.entries.get(key);
-    if (existing) {
-      existing.count++;
-      existing.lastSeen = now;
-      return;
-    }
-    if (this.entries.size >= _CsrfReadinessStore.MAX_ENTRIES) {
-      const firstKey = this.entries.keys().next().value;
-      if (firstKey !== void 0) this.entries.delete(firstKey);
-    }
-    this.entries.set(key, { count: 1, firstSeen: now, lastSeen: now });
-  }
-  summary() {
-    let total = 0;
-    const routes = [];
-    for (const [key, entry] of this.entries) {
-      const [method, path, reason] = key.split("\0");
-      routes.push({
-        method,
-        path,
-        reason,
-        count: entry.count,
-        firstSeen: entry.firstSeen,
-        lastSeen: entry.lastSeen
-      });
-      total += entry.count;
-    }
-    return {
-      generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      totalEvents: total,
-      routes
-    };
-  }
-  reset() {
-    this.entries.clear();
-  }
-};
-
 // src/vite-plugin/action-middleware.ts
 import { randomUUID } from "crypto";
 var PREFIX = "/api/__actions/";
@@ -416,361 +378,6 @@ function createActionMiddleware(vite, serverDir, options) {
   };
 }
 
-// src/server/http/batch-handler.ts
-import { z } from "zod";
-var STRIPPED_HEADERS = [
-  "authorization",
-  "cookie",
-  "x-forwarded-for",
-  "x-forwarded-host",
-  "x-forwarded-proto",
-  "x-real-ip",
-  "host"
-];
-var BATCH_PATH = "/api/__theo_batch__";
-var DEFAULT_MAX_BATCH = 32;
-var batchRequestSchema = z.object({
-  path: z.string().min(1),
-  method: z.string().min(1),
-  query: z.record(z.string(), z.unknown()).optional(),
-  body: z.unknown().optional(),
-  headers: z.record(z.string(), z.string()).optional()
-});
-var batchPayloadSchema = z.object({
-  requests: z.array(batchRequestSchema).min(1)
-});
-function sanitizeItemHeaders(itemHeaders, outerHeaders) {
-  const out = {};
-  if (itemHeaders) {
-    for (const [k, v] of Object.entries(itemHeaders)) {
-      const lower = k.toLowerCase();
-      if (!STRIPPED_HEADERS.includes(lower)) {
-        out[lower] = v;
-      }
-    }
-  }
-  if (outerHeaders) {
-    for (const stripped of STRIPPED_HEADERS) {
-      if (Object.hasOwn(outerHeaders, stripped)) {
-        out[stripped] = outerHeaders[stripped];
-      }
-    }
-  }
-  return out;
-}
-async function handleBatchRequest(payload, options) {
-  const parsed = batchPayloadSchema.parse(payload);
-  const max = options.max ?? DEFAULT_MAX_BATCH;
-  if (parsed.requests.length > max) {
-    throw new Error(`Batch size ${parsed.requests.length} exceeds max ${max}`);
-  }
-  const results = [];
-  for (const item of parsed.requests) {
-    const sanitized = {
-      ...item,
-      headers: sanitizeItemHeaders(item.headers, options.outerHeaders)
-    };
-    try {
-      const r = await options.execute(sanitized);
-      results.push(r);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      results.push({ error: { message } });
-    }
-  }
-  return { results };
-}
-
-// src/server/http/cors.ts
-var DEFAULT_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"];
-var DEFAULT_ALLOWED_HEADERS = ["Content-Type", "X-Theo-Action", "Authorization"];
-var DEFAULT_MAX_AGE = 600;
-function readOrigin(req) {
-  const raw = req.headers.origin;
-  if (raw === void 0) return void 0;
-  if (Array.isArray(raw)) {
-    return raw.find((v) => typeof v === "string" && v.length > 0);
-  }
-  return raw;
-}
-function matchesOrigin(origin, allowed) {
-  if (allowed === "*") return true;
-  if (typeof allowed === "string") return origin === allowed;
-  if (allowed instanceof RegExp) {
-    allowed.lastIndex = 0;
-    return allowed.test(origin);
-  }
-  if (Array.isArray(allowed)) {
-    for (const entry of allowed) {
-      if (typeof entry === "string" && origin === entry) return true;
-      if (entry instanceof RegExp) {
-        entry.lastIndex = 0;
-        if (entry.test(origin)) return true;
-      }
-    }
-    return false;
-  }
-  if (typeof allowed === "function") {
-    try {
-      return allowed(origin);
-    } catch {
-      return false;
-    }
-  }
-  return false;
-}
-function createCorsHandler(config) {
-  const methods = (config.methods ?? DEFAULT_METHODS).slice();
-  const allowedHeaders = (config.allowedHeaders ?? DEFAULT_ALLOWED_HEADERS).slice();
-  const maxAge = String(config.maxAge ?? DEFAULT_MAX_AGE);
-  const credentials = config.credentials === true;
-  return {
-    handlePreflight(req, res) {
-      if (req.method !== "OPTIONS") return false;
-      const acMethod = req.headers["access-control-request-method"];
-      if (!acMethod) return false;
-      const origin = readOrigin(req);
-      if (!origin) return false;
-      if (!matchesOrigin(origin, config.origins)) {
-        res.statusCode = 403;
-        res.end();
-        return true;
-      }
-      res.setHeader("Access-Control-Allow-Origin", origin);
-      res.setHeader("Access-Control-Allow-Methods", methods.join(", "));
-      res.setHeader("Access-Control-Allow-Headers", allowedHeaders.join(", "));
-      res.setHeader("Access-Control-Max-Age", maxAge);
-      res.setHeader("Vary", "Origin");
-      if (credentials) res.setHeader("Access-Control-Allow-Credentials", "true");
-      res.statusCode = 204;
-      res.end();
-      return true;
-    },
-    applyHeaders(req, res) {
-      const origin = readOrigin(req);
-      if (!origin) return;
-      if (!matchesOrigin(origin, config.origins)) return;
-      res.setHeader("Access-Control-Allow-Origin", origin);
-      res.setHeader("Vary", "Origin");
-      if (credentials) res.setHeader("Access-Control-Allow-Credentials", "true");
-      if (config.exposedHeaders && config.exposedHeaders.length > 0) {
-        res.setHeader("Access-Control-Expose-Headers", config.exposedHeaders.join(", "));
-      }
-    }
-  };
-}
-
-// src/server/http/trace-context.ts
-var TRACE_HEADER = "x-trace-id";
-var TRACE_PARENT_HEADER = "traceparent";
-var REQUEST_ID_HEADER = "x-request-id";
-var TRACEPARENT_RE = /^00-([0-9a-f]{32})-([0-9a-f]{16})-[0-9a-f]{2}$/;
-function parseTraceparent(value) {
-  if (!value) return null;
-  const m = TRACEPARENT_RE.exec(value);
-  if (!m) return null;
-  const traceId = m[1];
-  if (/^0+$/.test(traceId)) return null;
-  return traceId;
-}
-function pickHeader(value) {
-  if (Array.isArray(value)) {
-    for (const v of value) {
-      if (typeof v === "string" && v.length > 0) return v;
-    }
-    return null;
-  }
-  if (typeof value === "string" && value.length > 0) return value;
-  return null;
-}
-function resolveTraceIdFromHeaders(traceparent, requestId) {
-  if (traceparent !== null) {
-    const parsed = parseTraceparent(traceparent);
-    if (parsed !== null) return parsed;
-  }
-  if (requestId !== null) return requestId;
-  return globalThis.crypto.randomUUID();
-}
-function extractTraceId(req) {
-  return resolveTraceIdFromHeaders(
-    pickHeader(req.headers[TRACE_PARENT_HEADER]),
-    pickHeader(req.headers[REQUEST_ID_HEADER])
-  );
-}
-
-// src/server/security/csp-report.ts
-var CSP_REPORT_PATH = "/__theo/csp-report";
-var MAX_BODY = 16 * 1024;
-function pickHeader2(value) {
-  if (typeof value === "string") return value;
-  if (Array.isArray(value) && value.length > 0) return value[0];
-  return "";
-}
-function toStringSafe(value, fallback = "(missing)") {
-  if (typeof value === "string") return value;
-  if (typeof value === "number" || typeof value === "boolean") return String(value);
-  return fallback;
-}
-function normalizeLegacy(raw) {
-  return {
-    blockedUrl: toStringSafe(raw["blocked-uri"]),
-    documentUrl: toStringSafe(raw["document-uri"]),
-    violatedDirective: toStringSafe(raw["violated-directive"]),
-    effectiveDirective: typeof raw["effective-directive"] === "string" ? raw["effective-directive"] : void 0,
-    originalPolicy: typeof raw["original-policy"] === "string" ? raw["original-policy"] : void 0,
-    disposition: raw.disposition === "enforce" || raw.disposition === "report" ? raw.disposition : void 0,
-    statusCode: typeof raw["status-code"] === "number" ? raw["status-code"] : void 0,
-    sourceFile: typeof raw["source-file"] === "string" ? raw["source-file"] : void 0,
-    lineNumber: typeof raw["line-number"] === "number" ? raw["line-number"] : void 0,
-    columnNumber: typeof raw["column-number"] === "number" ? raw["column-number"] : void 0
-  };
-}
-function normalizeNew(entry) {
-  if (!entry || typeof entry !== "object") return null;
-  const body = entry.body;
-  if (!body || typeof body !== "object") return null;
-  const b = body;
-  return {
-    blockedUrl: toStringSafe(b.blockedURL),
-    documentUrl: toStringSafe(b.documentURL),
-    violatedDirective: toStringSafe(b.violatedDirective),
-    effectiveDirective: typeof b.effectiveDirective === "string" ? b.effectiveDirective : void 0,
-    originalPolicy: typeof b.originalPolicy === "string" ? b.originalPolicy : void 0,
-    disposition: b.disposition === "enforce" || b.disposition === "report" ? b.disposition : void 0,
-    statusCode: typeof b.statusCode === "number" ? b.statusCode : void 0,
-    sourceFile: typeof b.sourceFile === "string" ? b.sourceFile : void 0,
-    lineNumber: typeof b.lineNumber === "number" ? b.lineNumber : void 0,
-    columnNumber: typeof b.columnNumber === "number" ? b.columnNumber : void 0
-  };
-}
-async function readBody(req, maxBytes) {
-  return await new Promise((resolve8, reject) => {
-    const chunks = [];
-    let total = 0;
-    req.on("data", (chunk) => {
-      total += chunk.length;
-      if (total > maxBytes) {
-        reject(new Error("body too large"));
-        req.destroy();
-        return;
-      }
-      chunks.push(chunk);
-    });
-    req.on("end", () => {
-      resolve8(Buffer.concat(chunks).toString("utf8"));
-    });
-    req.on("error", reject);
-  });
-}
-async function handleCspReport(req, res, opts) {
-  const ctHeader = req.headers["content-type"];
-  const ct = pickHeader2(ctHeader);
-  let raw;
-  try {
-    raw = await readBody(req, MAX_BODY);
-  } catch {
-    res.statusCode = 413;
-    res.end();
-    return;
-  }
-  let violations;
-  try {
-    if (ct.startsWith("application/csp-report")) {
-      const parsed = JSON.parse(raw);
-      const inner = parsed["csp-report"];
-      if (!inner || typeof inner !== "object") {
-        res.statusCode = 204;
-        res.end();
-        return;
-      }
-      violations = [normalizeLegacy(inner)];
-    } else if (ct.startsWith("application/reports+json")) {
-      const parsed = JSON.parse(raw);
-      const entries = Array.isArray(parsed) ? parsed : [];
-      violations = entries.map((e) => normalizeNew(e)).filter((v) => v !== null);
-    } else {
-      res.statusCode = 415;
-      res.end();
-      return;
-    }
-  } catch {
-    res.statusCode = 400;
-    res.end();
-    return;
-  }
-  for (const v of violations) {
-    safeAudit(opts.auditLogger, {
-      action: "csp.violation",
-      metadata: v
-    });
-    try {
-      opts.devtoolsDispatcher?.onCspViolation?.(v);
-    } catch {
-    }
-    try {
-      opts.onViolation?.(v);
-    } catch {
-    }
-  }
-  res.statusCode = 204;
-  res.end();
-}
-
-// src/server/security/csrf-readiness-endpoint.ts
-var CSRF_READINESS_PATH = "/__theo/csrf-readiness";
-var CSRF_READINESS_RESET_PATH = "/__theo/csrf-readiness/reset";
-function originMatchesHost(req) {
-  const origin = req.headers.origin;
-  if (typeof origin !== "string") return false;
-  const host = req.headers.host;
-  if (typeof host !== "string") return false;
-  try {
-    const parsed = new URL(origin);
-    return parsed.host === host;
-  } catch {
-    return false;
-  }
-}
-function sendJson(res, status, body) {
-  res.writeHead(status, { "content-type": "application/json" });
-  res.end(JSON.stringify(body));
-}
-function sendNoContent(res) {
-  res.writeHead(204);
-  res.end();
-}
-function sendError2(res, status, code, message) {
-  res.writeHead(status, { "content-type": "application/json" });
-  res.end(JSON.stringify({ error: { code, message } }));
-}
-async function handleCsrfReadiness(req, res, store) {
-  const url = (req.url ?? "").split("?")[0];
-  const method = req.method ?? "GET";
-  if (url === CSRF_READINESS_PATH) {
-    if (method === "GET") {
-      sendJson(res, 200, store.summary());
-      return true;
-    }
-    sendError2(res, 405, "METHOD_NOT_ALLOWED", `Use GET on ${CSRF_READINESS_PATH}`);
-    return true;
-  }
-  if (url === CSRF_READINESS_RESET_PATH) {
-    if (method !== "POST") {
-      sendError2(res, 405, "METHOD_NOT_ALLOWED", `Use POST on ${CSRF_READINESS_RESET_PATH}`);
-      return true;
-    }
-    const hasHeader = req.headers["x-theo-action"] === "1";
-    if (!hasHeader || !originMatchesHost(req)) {
-      sendError2(res, 403, "CSRF_INVALID", "Reset requires X-Theo-Action: 1 + same-origin");
-      return true;
-    }
-    store.reset();
-    sendNoContent(res);
-    return true;
-  }
-  return false;
-}
-
 // src/vite-plugin/api-middleware.ts
 function shouldBypassApiMiddleware(url, prefixes) {
   if (!url.startsWith("/api/")) return true;
@@ -1145,7 +752,7 @@ async function runConfigureServer(server, ctx) {
   server.watcher.on("unlink", handleRouteChange);
   if (ctx.resolvedOpenApi !== void 0) {
     const openApiCfg = ctx.resolvedOpenApi;
-    const { reEmitOpenApi } = await import("./dev-emit-4WG3B5BM.js");
+    const { reEmitOpenApi } = await import("./dev-emit-OUPI7NAQ.js");
     const openApiServerDir = resolve4(ctx.projectRoot, "server");
     const openApiDistDir = resolve4(ctx.projectRoot, ctx.resolvedDistDir);
     const isRouteFileForOpenApi = (file) => file.startsWith(openApiServerDir) && /\.(ts|tsx|js|mjs)$/.test(file);
@@ -2131,13 +1738,13 @@ async function theoPluginAsync(rootOrOptions) {
       })
     );
   }
-  const { appTypedClientPlugin } = await import("./app-typed-client-4GIKUKRT.js");
+  const { appTypedClientPlugin } = await import("./app-typed-client-SAETWZT5.js");
   const appClientPlugin = appTypedClientPlugin({
     cwd: projectRoot,
     serverDir: resolve7(projectRoot, "server"),
     distDir: resolve7(projectRoot, ".theokit")
   });
-  const { actionsVirtualModule } = await import("./actions-virtual-module-DL74V6SR.js");
+  const { actionsVirtualModule } = await import("./actions-virtual-module-4WVKHQ2X.js");
   const actionsPlugin = actionsVirtualModule({
     serverDir: resolve7(projectRoot, "server"),
     distDir: resolve7(projectRoot, ".theokit")
@@ -2303,4 +1910,4 @@ export {
   theoPluginAsync,
   theoPlugin
 };
-//# sourceMappingURL=chunk-4NLIESWK.js.map
+//# sourceMappingURL=chunk-4I47JW5O.js.map