theokit 0.68.0 → 0.70.0

package/dist/chunk-4D4YVXHR.js

@@ -0,0 +1,816 @@
+import {
+  validateCsrfRequest
+} from "./chunk-P6OS7652.js";
+import {
+  WEB_SHAPED_MIDDLEWARE,
+  evaluateRoutePolicy,
+  subjectFromContext
+} from "./chunk-IDWN2OSG.js";
+import {
+  RequestBodyConsumedError,
+  parseRequestBody
+} from "./chunk-ZDCCILMP.js";
+import {
+  scanMiddlewares
+} from "./chunk-V6Y2SMRG.js";
+import {
+  envelopeCodeToStatus
+} from "./chunk-ACKBVBUI.js";
+import {
+  TheoError,
+  serverErrorToEnvelope
+} from "./chunk-IZ3TIL6K.js";
+
+// src/core/contracts/client-safe-error.ts
+var INTERNAL_CODES = /* @__PURE__ */ new Set(["INTERNAL_ERROR", "INTERNAL_SERVER_ERROR"]);
+var GENERIC_INTERNAL_MESSAGE = "Internal server error";
+function redacts(code) {
+  return INTERNAL_CODES.has(code) && process.env.NODE_ENV === "production";
+}
+function clientSafeErrorMessage(code, message) {
+  return redacts(code) ? GENERIC_INTERNAL_MESSAGE : message;
+}
+function clientSafeErrorEnvelope(envelope) {
+  if (!redacts(envelope.code)) return envelope;
+  return { code: envelope.code, message: GENERIC_INTERNAL_MESSAGE };
+}
+
+// src/server/http/send-response.ts
+function sendJson(res, data, status = 200, transformer) {
+  const body = transformer ? transformer.serialize(data) : JSON.stringify(data);
+  res.writeHead(status, {
+    "Content-Type": "application/json",
+    "Content-Length": Buffer.byteLength(body)
+  });
+  res.end(body);
+}
+function oneLine(value) {
+  return value.replace(/[\r\n]/g, "\\n");
+}
+function sendError(res, codeOrInput, message, status, issues, requestId, options) {
+  let code;
+  if (typeof codeOrInput === "string") {
+    code = codeOrInput;
+    message = message ?? "";
+    status = status ?? 500;
+  } else {
+    code = codeOrInput.code;
+    message = codeOrInput.message;
+    status = codeOrInput.status;
+    issues = codeOrInput.issues;
+    requestId = codeOrInput.requestId;
+    options = codeOrInput.options;
+  }
+  const errorMessage = clientSafeErrorMessage(code, message);
+  if (code === "INTERNAL_ERROR") {
+    console.error(`[${oneLine(requestId ?? "no-id")}] ${oneLine(message)}`);
+  }
+  if (status === 404 && options?.custom404Html) {
+    const body = options.custom404Html;
+    res.writeHead(404, {
+      "Content-Type": "text/html; charset=utf-8",
+      "Content-Length": Buffer.byteLength(body)
+    });
+    res.end(body);
+    return;
+  }
+  if (status === 500 && options?.custom500Html) {
+    const body = options.custom500Html;
+    res.writeHead(500, {
+      "Content-Type": "text/html; charset=utf-8",
+      "Content-Length": Buffer.byteLength(body)
+    });
+    res.end(body);
+    return;
+  }
+  sendJson(
+    res,
+    {
+      error: {
+        code,
+        message: errorMessage,
+        ...requestId ? { requestId } : {},
+        ...issues ? { issues } : {}
+      }
+    },
+    status
+  );
+}
+
+// src/server/http/node-request.ts
+import { Readable } from "node:stream";
+function pickHeaderString(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) {
+    for (const v of value) if (typeof v === "string" && v.length > 0) return v;
+  }
+  return void 0;
+}
+function synthesizeAbsoluteUrl(req) {
+  const host = pickHeaderString(req.headers.host) ?? "localhost";
+  return `http://${host}${req.url ?? "/"}`;
+}
+function nodeHeadersToWeb(req) {
+  const headers = new Headers();
+  for (const [key, value] of Object.entries(req.headers)) {
+    if (value === void 0) continue;
+    if (Array.isArray(value)) {
+      headers.set(key, value.join(", "));
+    } else {
+      headers.set(key, value);
+    }
+  }
+  return headers;
+}
+function incomingMessageToWebRequest(req) {
+  const url = synthesizeAbsoluteUrl(req);
+  const headers = nodeHeadersToWeb(req);
+  const method = (req.method ?? "GET").toUpperCase();
+  const hasBody = method !== "GET" && method !== "HEAD";
+  if (!hasBody) {
+    return new Request(url, { method, headers });
+  }
+  const webStream = Readable.toWeb(req);
+  return new Request(url, {
+    method,
+    headers,
+    body: webStream,
+    // EC-2: Node 18+ requires `duplex: 'half'` when body is a stream.
+    // The `RequestInit` type omits it (Web spec gap); cast accordingly.
+    ...{ duplex: "half" }
+  });
+}
+function createWebRequestSource(req) {
+  let converted;
+  return {
+    method: (req.method ?? "GET").toUpperCase(),
+    toRequest: () => converted ??= incomingMessageToWebRequest(req)
+  };
+}
+function incomingMessageToHandlerRequest(req) {
+  return new Request(synthesizeAbsoluteUrl(req), {
+    method: (req.method ?? "GET").toUpperCase(),
+    headers: nodeHeadersToWeb(req)
+  });
+}
+
+// src/server/http/validate-route-input.ts
+function validateRouteInput(config, raw) {
+  let query = raw.query;
+  if (config.query !== void 0) {
+    const parsed = config.query.safeParse(raw.query);
+    if (!parsed.success) return { ok: false, channel: "query", error: parsed.error };
+    query = parsed.data;
+  }
+  let body = raw.body;
+  if (config.body !== void 0) {
+    const parsed = config.body.safeParse(raw.body);
+    if (!parsed.success) return { ok: false, channel: "body", error: parsed.error };
+    body = parsed.data;
+  }
+  let params = raw.params;
+  if (config.params !== void 0) {
+    const parsed = config.params.safeParse(raw.params);
+    if (!parsed.success) return { ok: false, channel: "params", error: parsed.error };
+    params = parsed.data;
+  }
+  return { ok: true, query, body, params };
+}
+
+// src/server/http/execute-stages.ts
+async function parseQueryAndBody(req, res, requestId) {
+  const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+  const query = Object.fromEntries(url.searchParams);
+  let body;
+  let raw;
+  try {
+    const parsed = await parseRequestBody(req);
+    raw = parsed.raw;
+    if (parsed.json !== void 0) {
+      body = parsed.json;
+    } else if (parsed.files.length > 0 || Object.keys(parsed.fields).length > 0) {
+      body = { ...parsed.fields, _files: parsed.files };
+    } else {
+      body = void 0;
+    }
+  } catch (err) {
+    if (err instanceof RequestBodyConsumedError) {
+      sendError(res, "INTERNAL_ERROR", err.message, err.status, void 0, requestId);
+      return { ok: false };
+    }
+    const message = err.message;
+    const status = message.includes("Unsupported Content-Type") ? 415 : 400;
+    sendError(res, "VALIDATION_ERROR", message, status, void 0, requestId);
+    return { ok: false };
+  }
+  return { ok: true, data: { query, body, raw } };
+}
+var isZodLike = (value) => typeof value === "object" && value !== null && typeof value.safeParse === "function";
+function runZodValidation(routeConfig, res, requestId, input) {
+  const { query, params } = input;
+  let { body } = input;
+  if (isZodLike(routeConfig.query)) {
+    const result = routeConfig.query.safeParse(query);
+    if (!result.success) {
+      sendError(
+        res,
+        "VALIDATION_ERROR",
+        "Invalid query parameters",
+        400,
+        result.error?.issues,
+        requestId
+      );
+      return { ok: false };
+    }
+    Object.assign(query, result.data);
+  }
+  if (isZodLike(routeConfig.body)) {
+    const result = routeConfig.body.safeParse(body);
+    if (!result.success) {
+      sendError(
+        res,
+        "VALIDATION_ERROR",
+        "Invalid request body",
+        400,
+        result.error?.issues,
+        requestId
+      );
+      return { ok: false };
+    }
+    body = result.data;
+  }
+  if (isZodLike(routeConfig.params)) {
+    const result = routeConfig.params.safeParse(params);
+    if (!result.success) {
+      sendError(
+        res,
+        "VALIDATION_ERROR",
+        "Invalid route parameters",
+        400,
+        result.error?.issues,
+        requestId
+      );
+      return { ok: false };
+    }
+    Object.assign(params, result.data);
+  }
+  return { ok: true, data: { query, body, params } };
+}
+
+// src/server/http/web-middleware-runner.ts
+async function runWebMiddleware(request, middleware, context, downstream) {
+  const runFrom = async (index) => {
+    if (index >= middleware.length) {
+      return downstream === void 0 ? void 0 : await downstream(request, context);
+    }
+    const invocations = [];
+    const rejections = /* @__PURE__ */ new Map();
+    let frameSettled = false;
+    let yieldedInvocation;
+    const next = () => {
+      const started = runFrom(index + 1);
+      invocations.push(started);
+      started.catch((reason) => {
+        if (frameSettled) {
+          reportOne(started, reason);
+          return;
+        }
+        rejections.set(started, reason);
+      });
+      return started;
+    };
+    const reportOne = (invocation, reason) => {
+      if (invocation === yieldedInvocation) return;
+      const detail = reason instanceof Error ? reason.stack ?? reason.message : String(reason);
+      console.warn(
+        `[theokit] a middleware invoked next() and the downstream rejected, but the frame did not yield that result, so this failure reached no client: ${detail}`
+      );
+    };
+    const report = (yielded) => {
+      yieldedInvocation = yielded;
+      frameSettled = true;
+      for (const [invocation, reason] of rejections) reportOne(invocation, reason);
+      if (invocations.length > 1) {
+        console.warn(
+          `[theokit] a middleware called next() ${String(invocations.length)} times, so the downstream ran that many times against the same context object, concurrently and with no synchronisation. Only the last result is used; the rest are discarded with their side effects already performed. Call next() once, or make the downstream idempotent.`
+        );
+      }
+    };
+    let own;
+    try {
+      own = await middleware[index](request, context, next);
+    } catch (error) {
+      let held;
+      for (const [invocation, reason] of rejections) {
+        if (reason === error) held = invocation;
+      }
+      report(held);
+      throw error;
+    }
+    if (own instanceof Response) {
+      report();
+      return own;
+    }
+    if (invocations.length > 0) {
+      const yielded = invocations[invocations.length - 1];
+      try {
+        return await yielded;
+      } finally {
+        report(yielded);
+      }
+    }
+    report();
+    return await runFrom(index + 1);
+  };
+  return runFrom(0);
+}
+
+// src/server/web-handler.ts
+function searchParamsToObject(params) {
+  const out = {};
+  for (const [key, value] of params.entries()) {
+    if (!Object.hasOwn(out, key)) {
+      out[key] = value;
+      continue;
+    }
+    const existing = out[key];
+    if (Array.isArray(existing)) {
+      existing.push(value);
+    } else {
+      out[key] = [existing, value];
+    }
+  }
+  return out;
+}
+async function parseBodyInline(request) {
+  if (request.method === "GET" || request.method === "HEAD") return void 0;
+  const contentType = request.headers.get("content-type") ?? "";
+  if (contentType.includes("application/json")) {
+    const text = await request.text();
+    if (text.length === 0) return void 0;
+    try {
+      return JSON.parse(text);
+    } catch {
+      return void 0;
+    }
+  }
+  if (contentType.startsWith("text/")) {
+    const text = await request.text();
+    return text.length === 0 ? void 0 : text;
+  }
+  return void 0;
+}
+async function parseBodyFull(request) {
+  if (request.method === "GET" || request.method === "HEAD") return void 0;
+  const { parseWebRequestBody } = await import("./body-parser-web-ON5CUTEL.js");
+  try {
+    const parsed = await parseWebRequestBody(request);
+    if (parsed.json === void 0 && Object.keys(parsed.fields).length === 0 && parsed.files.length === 0) {
+      return void 0;
+    }
+    return parsed;
+  } catch {
+    return void 0;
+  }
+}
+function validationErrorResponse(zodError, field) {
+  const envelope = {
+    code: "BAD_REQUEST",
+    message: `Validation failed: ${field}`,
+    ext: {
+      fields: zodError.issues.map((issue) => ({
+        path: issue.path.join("."),
+        message: issue.message
+      }))
+    }
+  };
+  return new Response(JSON.stringify(envelope), {
+    status: 400,
+    headers: { "content-type": "application/json" }
+  });
+}
+async function runHandler(config, request, bodyParser = "inline", paramsInput = {}, context = {}) {
+  const url = new URL(request.url);
+  const queryRaw = searchParamsToObject(url.searchParams);
+  const bodyRaw = bodyParser === "full" ? await parseBodyFull(request) : await parseBodyInline(request);
+  const paramsRaw = paramsInput;
+  const validated = validateRouteInput(config, {
+    query: queryRaw,
+    body: bodyRaw,
+    params: paramsRaw
+  });
+  if (!validated.ok) {
+    return { ok: false, response: validationErrorResponse(validated.error, validated.channel) };
+  }
+  const { query, body, params } = validated;
+  const decision = await evaluateRoutePolicy(config.policy, {
+    subject: subjectFromContext(context),
+    query,
+    body,
+    params
+  });
+  if (!decision.allowed) {
+    return { ok: false, response: accessDeniedResponse(decision.reason) };
+  }
+  const result = await config.handler({ query, body, params, request, context });
+  return validateResponseOutput(config.response, result) ?? { ok: true, result };
+}
+function validateResponseOutput(response, result) {
+  const validatable = result !== void 0 && result !== null && !(result instanceof Response);
+  if (!validatable || !isZodLike(response)) return void 0;
+  const parsed = response.safeParse(result);
+  if (parsed.success) return { ok: true, result: parsed.data };
+  const err = new TheoError({
+    code: "INTERNAL_SERVER_ERROR",
+    message: "response validation failed",
+    ext: { issues: parsed.error?.issues }
+  });
+  return { ok: false, response: handlerErrorResponse(err) };
+}
+function toResponse(result, status) {
+  if (result === void 0) {
+    return new Response(null, { status: 204 });
+  }
+  if (result instanceof Response) {
+    return result;
+  }
+  return new Response(JSON.stringify(result), {
+    status: status ?? 200,
+    headers: { "content-type": "application/json" }
+  });
+}
+function handlerErrorResponse(err) {
+  const envelope = clientSafeErrorEnvelope(serverErrorToEnvelope(err));
+  const status = envelopeCodeToStatus(envelope.code);
+  return new Response(JSON.stringify(envelope), {
+    status,
+    headers: { "content-type": "application/json" }
+  });
+}
+var CSRF_PROTECTED_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+function mergeHookHeaders(response, hookHeaders) {
+  if ([...hookHeaders].length === 0) return response;
+  const merged = new Headers(response.headers);
+  for (const [k, v] of hookHeaders.entries()) {
+    if (k.toLowerCase() === "set-cookie") continue;
+    if (!merged.has(k)) merged.set(k, v);
+  }
+  for (const sc of hookHeaders.getSetCookie()) {
+    merged.append("Set-Cookie", sc);
+  }
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: merged
+  });
+}
+function methodNotAllowedResponse(method) {
+  const envelope = {
+    code: "METHOD_NOT_ALLOWED",
+    message: `Method ${method} not allowed`
+  };
+  return new Response(JSON.stringify(envelope), {
+    status: 405,
+    headers: { "content-type": "application/json" }
+  });
+}
+function shouldEnforceCsrf(method, config, csrfMode) {
+  if ((csrfMode ?? "strict") === "off") return false;
+  if (!CSRF_PROTECTED_METHODS.has(method)) return false;
+  return config?.csrf !== false;
+}
+function accessDeniedResponse(reason) {
+  const envelope = {
+    code: "FORBIDDEN",
+    message: `Access denied: ${reason}`
+  };
+  return new Response(JSON.stringify({ error: envelope }), {
+    status: 403,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function csrfFailedResponse(reason) {
+  const envelope = {
+    code: "FORBIDDEN",
+    message: `CSRF check failed: ${reason}`
+  };
+  return new Response(JSON.stringify(envelope), {
+    status: 403,
+    headers: { "content-type": "application/json" }
+  });
+}
+async function executeWebRequest(request, routeModule, opts = {}) {
+  const method = request.method.toUpperCase();
+  const config = routeModule[method];
+  if (opts.hooks === void 0) {
+    if (config === void 0 || typeof config.handler !== "function") {
+      return methodNotAllowedResponse(method);
+    }
+    if (shouldEnforceCsrf(method, config, opts.csrfMode)) {
+      const csrfCheck = validateCsrfRequest(request);
+      if (!csrfCheck.valid) return csrfFailedResponse(csrfCheck.reason);
+    }
+    try {
+      const context = {};
+      const runRoute = async () => {
+        const outcome = await runHandler(
+          config,
+          request,
+          opts.bodyParser ?? "inline",
+          opts.params ?? {},
+          context
+        );
+        return outcome.ok ? toResponse(outcome.result, config.status) : outcome.response;
+      };
+      if (opts.middleware?.length) {
+        const response = await runWebMiddleware(request, opts.middleware, context, runRoute);
+        if (response !== void 0) return response;
+      }
+      return await runRoute();
+    } catch (err) {
+      return handlerErrorResponse(err);
+    }
+  }
+  return runWithHooks(request, config, opts, opts.hooks);
+}
+async function runPreHandlerPipeline(hookCtx, request, config, opts, hooks) {
+  const method = request.method.toUpperCase();
+  const runList = async (list) => {
+    for (const hook of list) {
+      if (hookCtx.response !== void 0) return;
+      await hook(hookCtx);
+    }
+  };
+  if (hooks.onRequest) await runList(hooks.onRequest);
+  if (hookCtx.response === void 0 && shouldEnforceCsrf(method, config, opts.csrfMode)) {
+    const csrfCheck = validateCsrfRequest(request);
+    if (!csrfCheck.valid) hookCtx.response = csrfFailedResponse(csrfCheck.reason);
+  }
+  if (hookCtx.response === void 0 && hooks.preHandler) {
+    await runList(hooks.preHandler);
+  }
+  if (hookCtx.response === void 0) {
+    await runHandlerStage(hookCtx, request, config, opts, method);
+  }
+}
+async function runHandlerStage(hookCtx, request, config, opts, method) {
+  if (config === void 0 || typeof config.handler !== "function") {
+    hookCtx.response = methodNotAllowedResponse(method);
+    return;
+  }
+  const runRoute = async () => {
+    const outcome = await runHandler(
+      config,
+      request,
+      opts.bodyParser ?? "inline",
+      opts.params ?? {},
+      hookCtx.ctx
+    );
+    return outcome.ok ? toResponse(outcome.result, config.status) : outcome.response;
+  };
+  if (opts.middleware?.length) {
+    const response = await runWebMiddleware(request, opts.middleware, hookCtx.ctx, runRoute);
+    if (response !== void 0) {
+      hookCtx.response = response;
+      return;
+    }
+  }
+  hookCtx.response = await runRoute();
+}
+async function runWithHooks(request, config, opts, hooks) {
+  const hookCtx = {
+    request,
+    responseHeaders: new Headers(),
+    ctx: {},
+    requestId: opts.requestId ?? globalThis.crypto.randomUUID()
+  };
+  try {
+    await runPreHandlerPipeline(hookCtx, request, config, opts, hooks);
+    if (hooks.onResponse) {
+      for (const hook of hooks.onResponse) {
+        await hook(hookCtx);
+      }
+    }
+    const finalResponse = hookCtx.response ?? new Response(
+      JSON.stringify({ code: "INTERNAL_SERVER_ERROR", message: "No response built" }),
+      {
+        status: 500,
+        headers: { "content-type": "application/json" }
+      }
+    );
+    return mergeHookHeaders(finalResponse, hookCtx.responseHeaders);
+  } catch (err) {
+    return runErrorHooks(err, hookCtx, hooks.onError);
+  }
+}
+async function runErrorHooks(err, hookCtx, onError) {
+  const errorResponse = handlerErrorResponse(err);
+  if (onError !== void 0) {
+    const errorCtx = {
+      ...hookCtx,
+      response: errorResponse,
+      error: err
+    };
+    for (const [index, hook] of onError.entries()) {
+      try {
+        await hook(errorCtx);
+      } catch (hookError) {
+        try {
+          const reason = hookError instanceof Error ? hookError.stack ?? hookError.message : String(hookError);
+          const named = hook.name === "" ? "" : ` (${hook.name})`;
+          console.warn(
+            `[theokit] onError hook threw and was swallowed to avoid recursion: hook ${String(index)}${named} \u2014 the error it was given still produced a response, but whatever this hook reports to is NOT receiving it: ${reason}`
+          );
+        } catch {
+        }
+      }
+    }
+  }
+  return mergeHookHeaders(errorResponse, hookCtx.responseHeaders);
+}
+
+// src/server/http/middleware-runner.ts
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+
+// src/server/http/node-web-adapter.ts
+async function writeWebResponseToServerResponse(response, res) {
+  const setCookies = response.headers.getSetCookie();
+  if (setCookies.length > 0) {
+    res.setHeader("Set-Cookie", setCookies);
+  }
+  const otherHeaders = {};
+  for (const [key, value] of response.headers.entries()) {
+    if (key.toLowerCase() === "set-cookie") continue;
+    otherHeaders[key] = value;
+  }
+  res.writeHead(response.status, response.statusText, otherHeaders);
+  if (response.body === null) {
+    res.end();
+    return;
+  }
+  const reader = response.body.getReader();
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      res.write(value);
+    }
+    res.end();
+  } finally {
+    reader.releaseLock();
+  }
+}
+
+// src/server/http/middleware-runner.ts
+var USER_MODULE_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx"];
+function resolveUserModule(dir, base) {
+  for (const ext of USER_MODULE_EXTENSIONS) {
+    const candidate = join(dir, `${base}${ext}`);
+    if (existsSync(candidate)) return candidate;
+  }
+  return void 0;
+}
+var middlewareCache = /* @__PURE__ */ new Map();
+function _resetMiddlewareCacheForTests() {
+  middlewareCache.clear();
+}
+function getCachedScan(serverDir) {
+  let cached = middlewareCache.get(serverDir);
+  if (!cached) {
+    const singleFilePath = resolveUserModule(serverDir, "middleware") ?? join(serverDir, "middleware.ts");
+    cached = {
+      singleFilePath,
+      singleFileExists: existsSync(singleFilePath),
+      dirMiddlewares: scanMiddlewares(serverDir)
+    };
+    middlewareCache.set(serverDir, cached);
+  }
+  return cached;
+}
+var MiddlewareNextUnavailableError = class extends Error {
+  constructor() {
+    super(
+      "`next` is not available in `server/middleware/*.ts`. That path runs BEFORE routing, so it has no downstream response to give you: there is nothing to await and nothing to observe afterwards. Return a `Response` to answer the request, or return nothing to continue. For code that must run AFTER the route, use the Web path \u2014 `executeWebRequest`, whose runner passes a `next` that reaches the route (`http/web-middleware-runner.ts`)."
+    );
+    this.name = "MiddlewareNextUnavailableError";
+  }
+};
+var nodePathHasNoDownstream = () => {
+  throw new MiddlewareNextUnavailableError();
+};
+async function runWebShapedMiddleware(mw, req, res, context) {
+  const request = createWebRequestSource(req).toRequest();
+  const result = await mw(request, context, nodePathHasNoDownstream);
+  if (!(result instanceof Response)) return { shortCircuited: false };
+  await writeWebResponseToServerResponse(result, res);
+  return { shortCircuited: true };
+}
+function isWebShaped(mw) {
+  return WEB_SHAPED_MIDDLEWARE in mw;
+}
+async function runScannedMiddleware(mw, req, res, context) {
+  if (isWebShaped(mw)) {
+    const { shortCircuited } = await runWebShapedMiddleware(mw, req, res, context);
+    return { aborted: shortCircuited };
+  }
+  const { nextCalled } = await runOneMiddleware(mw, req, res);
+  return { aborted: !nextCalled || res.writableEnded };
+}
+var SILENT_MIDDLEWARE_WARNING_MS = 1e4;
+async function runOneMiddleware(mw, req, res) {
+  const state = { nextCalled: false };
+  let signalNext;
+  const nextCalled = new Promise((resolve) => {
+    signalNext = resolve;
+  });
+  await mw(req, res, () => {
+    state.nextCalled = true;
+    signalNext();
+  });
+  if (state.nextCalled || res.writableEnded) return state;
+  const signals = [nextCalled, warnAboutSilence(mw)];
+  const ended = responseEnded(res);
+  if (ended !== void 0) signals.push(ended);
+  await Promise.race(signals);
+  return state;
+}
+function responseEnded(res) {
+  if (typeof res.once !== "function") return void 0;
+  return new Promise((resolve) => {
+    res.once("finish", resolve);
+    res.once("close", resolve);
+  });
+}
+function warnAboutSilence(mw) {
+  return new Promise((resolve) => {
+    const timer = setTimeout(() => {
+      const named = mw.name === "" ? "an anonymous middleware" : `\`${mw.name}\``;
+      console.warn(
+        `[theokit] ${named} in server/middleware/ has neither called next() nor written a response after ${String(SILENT_MIDDLEWARE_WARNING_MS)}ms. The request is waiting on it. Call next() to continue, or write a response to answer \u2014 doing neither holds the socket open.`
+      );
+      resolve();
+    }, SILENT_MIDDLEWARE_WARNING_MS);
+    if (typeof timer.unref === "function") timer.unref();
+  });
+}
+async function runMiddlewareAndContext(req, res, loadModule, serverDir) {
+  const { singleFilePath, singleFileExists, dirMiddlewares } = getCachedScan(serverDir);
+  const dirExists = dirMiddlewares.length > 0;
+  const middlewareCtx = {};
+  if (singleFileExists && dirExists) {
+    throw new Error(
+      "Ambiguous middleware configuration: found both server/middleware.ts and server/middleware/ directory. Use one or the other, not both."
+    );
+  }
+  if (dirExists) {
+    for (const mwPath of dirMiddlewares) {
+      const mod = await loadModule(mwPath);
+      const mw = mod.default;
+      if (typeof mw !== "function") continue;
+      const { aborted } = await runScannedMiddleware(mw, req, res, middlewareCtx);
+      if (aborted) return { ctx: middlewareCtx, aborted: true };
+    }
+  }
+  if (singleFileExists) {
+    const mod = await loadModule(singleFilePath);
+    const mw = mod.default;
+    if (typeof mw === "function") {
+      const { aborted } = await runScannedMiddleware(mw, req, res, middlewareCtx);
+      if (aborted) return { ctx: middlewareCtx, aborted: true };
+    }
+  }
+  const factoryCtx = await createServerContext(req, res, loadModule, serverDir);
+  if (factoryCtx === null || typeof factoryCtx !== "object") {
+    return { ctx: middlewareCtx, aborted: false };
+  }
+  return { ctx: { ...middlewareCtx, ...factoryCtx }, aborted: false };
+}
+async function createServerContext(req, res, loadModule, serverDir) {
+  const contextPath = resolveUserModule(serverDir, "context");
+  if (contextPath === void 0) return {};
+  const mod = await loadModule(contextPath);
+  const createContext = mod.createContext;
+  if (typeof createContext !== "function") return {};
+  return await createContext({ request: req, response: res });
+}
+
+export {
+  sendJson,
+  sendError,
+  parseQueryAndBody,
+  isZodLike,
+  runZodValidation,
+  incomingMessageToWebRequest,
+  createWebRequestSource,
+  incomingMessageToHandlerRequest,
+  validateRouteInput,
+  executeWebRequest,
+  writeWebResponseToServerResponse,
+  resolveUserModule,
+  _resetMiddlewareCacheForTests,
+  MiddlewareNextUnavailableError,
+  runMiddlewareAndContext,
+  createServerContext
+};
+//# sourceMappingURL=chunk-4D4YVXHR.js.map