stitchkit 0.0.1 → 0.1.0

package/dist/server/index.js

@@ -0,0 +1,965 @@
+import {
+  parseSSE,
+  streamSSE
+} from "../index-n7bmdwmz.js";
+import {
+  normalizeError
+} from "../index-gfzn1n4n.js";
+import {
+  AppError,
+  appError,
+  badRequest,
+  conflict,
+  forbidden,
+  notFound,
+  rateLimited,
+  unauthorized
+} from "../index-7wfkbvss.js";
+import {
+  extractIp,
+  generateTraceId,
+  getClientInfo,
+  parseQueryParams,
+  resolveTraceId
+} from "../index-ke4mx4ea.js";
+// src/server/swept-map.ts
+function createSweptMap(options) {
+  const store = new Map;
+  const timer = setInterval(() => {
+    const now = Date.now();
+    for (const [key, value] of store) {
+      if (options.isExpired(value, now))
+        store.delete(key);
+    }
+  }, options.intervalMs);
+  timer.unref();
+  return {
+    store,
+    destroy() {
+      clearInterval(timer);
+      store.clear();
+    }
+  };
+}
+
+// src/server/cache.ts
+function createCache() {
+  const { store, destroy } = createSweptMap({
+    intervalMs: 30000,
+    isExpired: (entry, now) => entry.expiresAt < now
+  });
+  return {
+    destroy,
+    get(key) {
+      const entry = store.get(key);
+      if (!entry)
+        return null;
+      if (entry.expiresAt < Date.now()) {
+        store.delete(key);
+        return null;
+      }
+      return entry.data;
+    },
+    set(key, data, maxAgeSeconds) {
+      store.set(key, { data, expiresAt: Date.now() + maxAgeSeconds * 1000 });
+    },
+    invalidate(prefix) {
+      for (const key of store.keys()) {
+        if (key.startsWith(prefix))
+          store.delete(key);
+      }
+    },
+    clear() {
+      store.clear();
+    }
+  };
+}
+function cacheHeaders(maxAge, scope = "public") {
+  return {
+    "Cache-Control": `${scope}, max-age=${maxAge}`
+  };
+}
+// src/server/multipart.ts
+var DEFAULT_MAX_UPLOAD_BYTES = 25 * 1024 * 1024;
+async function parseMultipart(req, fileField, fieldsSchema, maxBytes = DEFAULT_MAX_UPLOAD_BYTES) {
+  const declared = Number(req.headers.get("content-length") ?? 0);
+  if (declared > maxBytes) {
+    badRequest(`Upload exceeds the ${Math.round(maxBytes / 1024 / 1024)} MB limit`);
+  }
+  const formData = await req.formData();
+  const file = formData.get(fileField);
+  if (!file || !(file instanceof File)) {
+    badRequest(`Missing file field: ${fileField}`);
+  }
+  if (file.size > maxBytes) {
+    badRequest(`Upload exceeds the ${Math.round(maxBytes / 1024 / 1024)} MB limit`);
+  }
+  const fields = {};
+  for (const [key, value] of formData.entries()) {
+    if (key === fileField)
+      continue;
+    if (typeof value === "string") {
+      try {
+        fields[key] = JSON.parse(value);
+      } catch {
+        fields[key] = value;
+      }
+    }
+  }
+  const parsed = fieldsSchema ? fieldsSchema.parse(fields) : fields;
+  return { file, fields: parsed };
+}
+
+// src/server/context.ts
+var RESERVED_KEYS = new Set([
+  "params",
+  "input",
+  "source",
+  "req",
+  "url",
+  "headers",
+  "traceId",
+  "spanId",
+  "ipAddress",
+  "userAgent"
+]);
+async function readJsonBody(req) {
+  const text = await req.text();
+  if (text.trim() === "")
+    return {};
+  try {
+    return JSON.parse(text);
+  } catch {
+    badRequest("Invalid JSON body");
+  }
+}
+async function buildContext(req, url, method, pathParams, traceId) {
+  const parsedParams = method.paramsSchema ? method.paramsSchema.parse(pathParams) : undefined;
+  let parsedInput;
+  let file;
+  if (method.multipart) {
+    const multipart = await parseMultipart(req, method.multipart, method.inputSchema);
+    parsedInput = multipart.fields;
+    file = multipart.file;
+  } else if (method.inputSchema) {
+    if (req.method === "GET") {
+      parsedInput = method.inputSchema.parse(parseQueryParams(url));
+    } else if (req.method === "DELETE") {
+      const ct = req.headers.get("content-type");
+      if (ct?.includes("application/json")) {
+        parsedInput = method.inputSchema.parse(await readJsonBody(req));
+      } else {
+        parsedInput = method.inputSchema.parse(parseQueryParams(url));
+      }
+    } else {
+      parsedInput = method.inputSchema.parse(await readJsonBody(req));
+    }
+  }
+  const safePathParams = {};
+  for (const [k, v] of Object.entries(pathParams)) {
+    if (!RESERVED_KEYS.has(k))
+      safePathParams[k] = v;
+  }
+  return {
+    params: parsedParams,
+    input: parsedInput,
+    ...file && { file },
+    source: "http",
+    req,
+    url,
+    headers: req.headers,
+    ...safePathParams,
+    traceId,
+    ...getClientInfo(req)
+  };
+}
+function buildErrorContext(req, url, traceId) {
+  return {
+    params: undefined,
+    input: undefined,
+    source: "http",
+    req,
+    url,
+    headers: req.headers,
+    traceId,
+    ...getClientInfo(req)
+  };
+}
+
+// src/server/logger.ts
+var c = {
+  reset: "\x1B[0m",
+  dim: "\x1B[2m",
+  red: "\x1B[31m",
+  green: "\x1B[32m",
+  yellow: "\x1B[33m",
+  blue: "\x1B[34m",
+  magenta: "\x1B[35m",
+  cyan: "\x1B[36m",
+  gray: "\x1B[90m"
+};
+var METHOD_COLOR = {
+  GET: c.green,
+  POST: c.yellow,
+  PUT: c.blue,
+  PATCH: c.cyan,
+  DELETE: c.red,
+  OPTIONS: c.gray
+};
+var isProd = false;
+function timestamp() {
+  const now = new Date;
+  const t = now.toLocaleTimeString("en-US", {
+    hour12: false,
+    hour: "2-digit",
+    minute: "2-digit",
+    second: "2-digit"
+  });
+  return `${t}.${now.getMilliseconds().toString().padStart(3, "0")}`;
+}
+function elapsedMs(startTime) {
+  return Number(process.hrtime.bigint() - startTime) / 1e6;
+}
+function levelForStatus(status) {
+  if (status >= 500)
+    return "error";
+  if (status >= 400)
+    return "warn";
+  return "info";
+}
+function buildLogFields(method, path, status, durationMs, traceId) {
+  return { traceId, method, path, status, durationMs };
+}
+function formatMs(ms) {
+  if (ms >= 1000)
+    return `${(ms / 1000).toFixed(2)}s`;
+  if (ms >= 1)
+    return `${Math.round(ms)}ms`;
+  return `${Math.round(ms * 1000)}µs`;
+}
+function durationColor(ms) {
+  if (ms >= 1000)
+    return c.red;
+  if (ms > 300)
+    return c.yellow;
+  return c.green;
+}
+function statusColor(status) {
+  if (status >= 500)
+    return c.red;
+  if (status >= 400)
+    return c.yellow;
+  if (status >= 300)
+    return c.cyan;
+  return c.green;
+}
+function ipLabel(ip) {
+  if (!ip || ip === "::1" || ip === "127.0.0.1")
+    return `${c.magenta}local${c.reset}`;
+  return `${c.dim}${ip}${c.reset}`;
+}
+var SKIP_PREFIXES = ["/_bun/", "/_bundle", "/favicon"];
+function shouldLog(pathname, method) {
+  if (method === "OPTIONS")
+    return false;
+  return !SKIP_PREFIXES.some((prefix) => pathname.startsWith(prefix));
+}
+function logIncoming(req, pathname, traceId) {
+  const log = { traceId, startTime: process.hrtime.bigint() };
+  if (!isProd) {
+    const mc = METHOD_COLOR[req.method] ?? c.dim;
+    console.log(`${c.gray}[${timestamp()}]${c.reset} ${mc}${req.method}${c.reset} ${c.dim}${traceId}${c.reset} ${c.cyan}→${c.reset} ${pathname} ${ipLabel(extractIp(req))}`);
+  }
+  return log;
+}
+function logOutgoing(req, pathname, status, log) {
+  const ms = elapsedMs(log.startTime);
+  if (isProd) {
+    console.log(JSON.stringify({
+      ts: new Date().toISOString(),
+      level: levelForStatus(status),
+      msg: `${req.method} ${pathname} ${status}`,
+      ...buildLogFields(req.method, pathname, status, Math.round(ms), log.traceId),
+      ip: extractIp(req) || undefined
+    }));
+    return;
+  }
+  const mc = METHOD_COLOR[req.method] ?? c.dim;
+  console.log(`${c.gray}[${timestamp()}]${c.reset} ${mc}${req.method}${c.reset} ${c.dim}${log.traceId}${c.reset} ${c.cyan}←${c.reset} ${pathname} ${statusColor(status)}${status}${c.reset} ${durationColor(ms)}${formatMs(ms)}${c.reset} ${ipLabel(extractIp(req))}`);
+}
+
+// src/server/middleware/cors.ts
+function corsHeaders(config, requestOrigin) {
+  let allowOrigin;
+  if (config.origin === undefined || config.origin === "*") {
+    allowOrigin = config.credentials ? requestOrigin ?? undefined : "*";
+  } else if (Array.isArray(config.origin)) {
+    allowOrigin = requestOrigin && config.origin.includes(requestOrigin) ? requestOrigin : undefined;
+  } else {
+    allowOrigin = config.origin;
+  }
+  const headers = {
+    "Access-Control-Allow-Methods": config.methods ?? "GET, POST, PUT, PATCH, DELETE, OPTIONS",
+    "Access-Control-Allow-Headers": config.headers ?? "Content-Type, Authorization, X-Trace-Id"
+  };
+  if (allowOrigin !== undefined) {
+    headers["Access-Control-Allow-Origin"] = allowOrigin;
+  }
+  if (config.credentials) {
+    headers["Access-Control-Allow-Credentials"] = "true";
+  }
+  const variesByOrigin = Array.isArray(config.origin) || (config.origin === undefined || config.origin === "*") && Boolean(config.credentials);
+  if (variesByOrigin) {
+    headers.Vary = "Origin";
+  }
+  return headers;
+}
+function corsPreflightResponse(config, req) {
+  return new Response(null, {
+    status: 204,
+    headers: corsHeaders(config, req.headers.get("origin"))
+  });
+}
+
+// src/server/router.ts
+import { resolve, sep } from "node:path";
+function joinPath(...parts) {
+  const joined = parts.filter(Boolean).map((part) => part.replace(/^\/+|\/+$/g, "")).filter(Boolean).join("/");
+  return `/${joined}`;
+}
+function matchSegments(patternSegments, requestSegments) {
+  if (patternSegments.length !== requestSegments.length)
+    return null;
+  const params = {};
+  for (const [i, pattern] of patternSegments.entries()) {
+    const actual = requestSegments[i];
+    if (actual === undefined)
+      return null;
+    if (pattern.startsWith(":")) {
+      params[pattern.slice(1)] = decodeURIComponent(actual);
+    } else if (pattern !== actual) {
+      return null;
+    }
+  }
+  return params;
+}
+function buildRouteMap(groups) {
+  const map = new Map;
+  for (const { prefix, service, hooks } of groups) {
+    for (const [, method] of Object.entries(service.methods)) {
+      if (method.expose && !method.expose.includes("HTTP"))
+        continue;
+      const servicePath = joinPath("/", service.prefix, method.path === "/" ? "" : method.path);
+      const fullPath = prefix ? joinPath(prefix, servicePath) : servicePath;
+      const segments = fullPath.split("/").filter(Boolean);
+      const entries = map.get(method.method) ?? [];
+      entries.push({ method, service, pattern: fullPath, segments, groupHooks: hooks });
+      map.set(method.method, entries);
+    }
+  }
+  for (const [, entries] of map) {
+    entries.sort((a, b) => {
+      const len = Math.min(a.segments.length, b.segments.length);
+      for (let i = 0;i < len; i++) {
+        const aIsParam = a.segments[i]?.startsWith(":");
+        const bIsParam = b.segments[i]?.startsWith(":");
+        if (aIsParam !== bIsParam)
+          return aIsParam ? 1 : -1;
+      }
+      return a.segments.length - b.segments.length;
+    });
+  }
+  return map;
+}
+function matchRoute(routeMap, httpMethod, pathname) {
+  const entries = routeMap.get(httpMethod);
+  if (!entries)
+    return null;
+  const requestSegments = pathname.split("/").filter(Boolean);
+  for (const entry of entries) {
+    const pathParams = matchSegments(entry.segments, requestSegments);
+    if (pathParams) {
+      return {
+        method: entry.method,
+        service: entry.service,
+        pathParams,
+        groupHooks: entry.groupHooks
+      };
+    }
+  }
+  return null;
+}
+function allowedMethods(routeMap, pathname) {
+  const requestSegments = pathname.split("/").filter(Boolean);
+  const methods = [];
+  for (const [method, entries] of routeMap) {
+    for (const entry of entries) {
+      if (matchSegments(entry.segments, requestSegments)) {
+        methods.push(method);
+        break;
+      }
+    }
+  }
+  return methods;
+}
+function validateRoutes(routeMap) {
+  for (const [method, entries] of routeMap) {
+    const seen = new Map;
+    for (const entry of entries) {
+      const normalized = entry.segments.map((s) => s.startsWith(":") ? ":param" : s).join("/");
+      const key = `${method} /${normalized}`;
+      const existing = seen.get(key);
+      if (existing) {
+        throw new Error(`Duplicate route: ${method} ${entry.pattern} conflicts with ${existing}`);
+      }
+      seen.set(key, entry.pattern);
+    }
+  }
+}
+function matchRawRoute(rawRoutes, httpMethod, pathname) {
+  for (const route of rawRoutes) {
+    if (route.method !== "ALL" && route.method !== httpMethod)
+      continue;
+    if (route.path.endsWith("/*")) {
+      const prefix = route.path.slice(0, -2);
+      if (pathname === prefix || pathname.startsWith(`${prefix}/`)) {
+        return { route, params: {} };
+      }
+      continue;
+    }
+    if (route.path.includes("/:")) {
+      const routeSegs = route.path.split("/").filter(Boolean);
+      const pathSegs = pathname.split("/").filter(Boolean);
+      const params = matchSegments(routeSegs, pathSegs);
+      if (params)
+        return { route, params };
+      continue;
+    }
+    if (route.path === pathname)
+      return { route, params: {} };
+  }
+  return null;
+}
+function staticRoute(prefix, dir) {
+  const cleanPrefix = prefix.replace(/\/+$/, "");
+  const cleanDir = dir.replace(/\/+$/, "");
+  return {
+    method: "GET",
+    path: `${cleanPrefix}/*`,
+    handler: async (req) => {
+      const pathname = new URL(req.url).pathname;
+      const rel = pathname.slice(cleanPrefix.length).replace(/^\/+/, "");
+      const root = resolve(cleanDir);
+      const target = resolve(root, rel);
+      if (target !== root && !target.startsWith(root + sep)) {
+        return new Response("Forbidden", { status: 403 });
+      }
+      const file = Bun.file(target);
+      if (!await file.exists()) {
+        return new Response("Not found", { status: 404 });
+      }
+      return new Response(file);
+    }
+  };
+}
+
+// src/server/create.ts
+function createHandler(config) {
+  const { cors, hooks, logging = false } = config;
+  const customLogger = typeof logging === "object" ? logging : null;
+  const useDefaultLog = logging === true;
+  const resolveId = config.traceId ?? resolveTraceId;
+  const routeMap = buildRouteMap(normalizeGroups(config));
+  validateRoutes(routeMap);
+  async function dispatch(req, url, traceId, server) {
+    const shouldLogRequest = logging && shouldLog(url.pathname, req.method);
+    let reqLog;
+    if (shouldLogRequest && useDefaultLog) {
+      reqLog = logIncoming(req, url.pathname, traceId);
+    }
+    if (shouldLogRequest && customLogger) {
+      customLogger.debug(`${req.method} ${url.pathname}`, {
+        traceId,
+        method: req.method,
+        path: url.pathname,
+        ip: extractIp(req) || undefined
+      });
+      reqLog = { traceId, startTime: process.hrtime.bigint() };
+    }
+    const logDone = (status) => {
+      if (!reqLog)
+        return;
+      if (useDefaultLog)
+        logOutgoing(req, url.pathname, status, reqLog);
+      if (customLogger) {
+        const durationMs = Math.round(elapsedMs(reqLog.startTime));
+        const level = levelForStatus(status);
+        customLogger[level](`${req.method} ${url.pathname} ${status} ${durationMs}ms`, buildLogFields(req.method, url.pathname, status, durationMs, reqLog.traceId));
+      }
+    };
+    const respondError = async (err, errCtx, endpoint) => {
+      if (hooks?.onError) {
+        try {
+          const response = await hooks.onError(errCtx ?? buildErrorContext(req, url, traceId), err, endpoint);
+          if (response instanceof Response) {
+            const withCors = applyCors(response, cors, req);
+            logDone(withCors.status);
+            return withCors;
+          }
+        } catch {}
+      }
+      const appErr = normalizeError(err);
+      logDone(appErr.status);
+      return json(appErr.toJSON(), appErr.status, cors, req);
+    };
+    if (cors && req.method === "OPTIONS") {
+      const res = corsPreflightResponse(cors, req);
+      logDone(204);
+      return res;
+    }
+    if (hooks?.onRequest) {
+      const earlyResponse = await hooks.onRequest(req);
+      if (earlyResponse instanceof Response) {
+        logDone(earlyResponse.status);
+        return earlyResponse;
+      }
+    }
+    if (config.rawRoutes) {
+      const rawMatch = matchRawRoute(config.rawRoutes, req.method, url.pathname);
+      if (rawMatch) {
+        try {
+          const res = await rawMatch.route.handler(req, {
+            params: rawMatch.params,
+            server
+          });
+          const withCors = applyCors(res, cors, req);
+          logDone(withCors.status);
+          return withCors;
+        } catch (err) {
+          return respondError(err);
+        }
+      }
+    }
+    const match = matchRoute(routeMap, req.method, url.pathname);
+    if (!match) {
+      const allow = allowedMethods(routeMap, url.pathname);
+      if (allow.length > 0) {
+        const res = await respondError(new AppError("METHOD_NOT_ALLOWED", `Method ${req.method} not allowed`, 405));
+        res.headers.set("Allow", allow.join(", "));
+        return res;
+      }
+      return respondError(new AppError("NOT_FOUND", "Not found", 404));
+    }
+    const { method, pathParams, groupHooks } = match;
+    let ctx;
+    try {
+      ctx = await buildContext(req, url, method, pathParams, traceId);
+      if (hooks?.beforeHandle) {
+        await hooks.beforeHandle(ctx, method);
+      }
+      if (groupHooks?.beforeHandle) {
+        await groupHooks.beforeHandle(ctx, method);
+      }
+      let result = await method.handler(ctx);
+      if (groupHooks?.afterHandle) {
+        const transformed = await groupHooks.afterHandle(ctx, result, method);
+        if (transformed !== undefined)
+          result = transformed;
+      }
+      if (hooks?.afterHandle) {
+        const transformed = await hooks.afterHandle(ctx, result, method);
+        if (transformed !== undefined)
+          result = transformed;
+      }
+      if (method.outputSchema) {
+        result = method.outputSchema.parse(result);
+      }
+      if (result === undefined || result === null) {
+        logDone(204);
+        return new Response(null, { status: 204, headers: corsHeaders2(cors, req) });
+      }
+      logDone(200);
+      return json(result, 200, cors, req);
+    } catch (err) {
+      return respondError(err, ctx, method);
+    }
+  }
+  return async (req, server) => {
+    const url = new URL(req.url);
+    const traceId = resolveId(req);
+    const response = await dispatch(req, url, traceId, server);
+    if (!response.headers.has("x-request-id")) {
+      response.headers.set("x-request-id", traceId);
+    }
+    return response;
+  };
+}
+function createServer(config) {
+  const { routes, websocket, development, bun: bunExtra, port = 3000, hostname } = config;
+  const fetch = createHandler(config);
+  return websocket ? Bun.serve({
+    ...bunExtra,
+    ...routes && { routes },
+    ...development && { development },
+    port,
+    hostname,
+    websocket,
+    fetch
+  }) : Bun.serve({
+    ...bunExtra,
+    ...development && { development },
+    port,
+    hostname,
+    fetch
+  });
+}
+function normalizeGroups(config) {
+  const result = [];
+  if (config.services) {
+    for (const service of config.services) {
+      result.push({ prefix: "", service });
+    }
+  }
+  if (config.groups) {
+    for (const group of config.groups) {
+      for (const service of group.services) {
+        result.push({ prefix: group.pathPrefix ?? "", service, hooks: group.hooks });
+      }
+    }
+  }
+  return result;
+}
+function corsHeaders2(cors, req) {
+  if (!cors)
+    return {};
+  return corsHeaders(cors, req.headers.get("origin"));
+}
+function applyCors(res, cors, req) {
+  const extra = corsHeaders2(cors, req);
+  if (Object.keys(extra).length === 0)
+    return res;
+  const headers = new Headers(res.headers);
+  for (const [key, value] of Object.entries(extra))
+    headers.set(key, value);
+  return new Response(res.body, {
+    status: res.status,
+    statusText: res.statusText,
+    headers
+  });
+}
+function json(data, status, cors, req) {
+  return Response.json(data, { status, headers: corsHeaders2(cors, req) });
+}
+// src/server/event-bus.ts
+function createEventBus() {
+  const subscriptions = new Map;
+  function add(event, fn, once) {
+    let set = subscriptions.get(event);
+    if (!set) {
+      set = new Set;
+      subscriptions.set(event, set);
+    }
+    const sub = { fn, once };
+    set.add(sub);
+    return () => {
+      set.delete(sub);
+    };
+  }
+  return {
+    emit(event, data) {
+      const set = subscriptions.get(event);
+      if (!set)
+        return;
+      for (const sub of [...set]) {
+        if (sub.once)
+          set.delete(sub);
+        try {
+          const result = sub.fn(data);
+          if (result instanceof Promise)
+            result.catch(() => {
+              return;
+            });
+        } catch {}
+      }
+    },
+    on(event, handler) {
+      return add(event, handler, false);
+    },
+    once(event, handler) {
+      return add(event, handler, true);
+    },
+    off(event, handler) {
+      const set = subscriptions.get(event);
+      if (!set)
+        return;
+      for (const sub of set) {
+        if (sub.fn === handler)
+          set.delete(sub);
+      }
+    },
+    clear() {
+      subscriptions.clear();
+    }
+  };
+}
+// src/server/implement.ts
+function implement(contract, handlers) {
+  const methods = {};
+  const groupScope = contract.meta.scope ?? "public";
+  for (const [key, endpoint] of Object.entries(contract.endpoints)) {
+    const typedHandler = handlers[key];
+    methods[key] = {
+      method: endpoint.method,
+      path: endpoint.path,
+      desc: endpoint.desc,
+      toolName: "toolName" in endpoint ? endpoint.toolName : undefined,
+      expose: endpoint.expose,
+      scope: endpoint.scope ?? groupScope,
+      paramsSchema: endpoint.params,
+      inputSchema: endpoint.input,
+      outputSchema: endpoint.output,
+      multipart: endpoint.multipart,
+      handler: (ctx) => typedHandler(ctx)
+    };
+  }
+  return {
+    name: contract.meta.prefix,
+    prefix: contract.meta.prefix,
+    scope: groupScope,
+    methods
+  };
+}
+function createImplement() {
+  return (contract, handlers) => implement(contract, handlers);
+}
+// src/server/middleware/cookies.ts
+function parseCookies(header) {
+  if (!header)
+    return {};
+  const cookies = {};
+  for (const pair of header.split(";")) {
+    const [key, ...rest] = pair.split("=");
+    if (!key)
+      continue;
+    const raw = rest.join("=").trim();
+    try {
+      cookies[key.trim()] = decodeURIComponent(raw);
+    } catch {
+      cookies[key.trim()] = raw;
+    }
+  }
+  return cookies;
+}
+function serializeCookie(name, value, opts = {}) {
+  let cookie = `${name}=${encodeURIComponent(value)}`;
+  if (opts.maxAge !== undefined)
+    cookie += `; Max-Age=${opts.maxAge}`;
+  if (opts.path)
+    cookie += `; Path=${opts.path}`;
+  if (opts.domain)
+    cookie += `; Domain=${opts.domain}`;
+  if (opts.secure)
+    cookie += "; Secure";
+  if (opts.httpOnly)
+    cookie += "; HttpOnly";
+  if (opts.sameSite)
+    cookie += `; SameSite=${opts.sameSite}`;
+  return cookie;
+}
+function defineCookie(config) {
+  const { name, ...options } = config;
+  return {
+    get(req) {
+      return parseCookies(req.headers.get("cookie"))[name];
+    },
+    set(value) {
+      return serializeCookie(name, value, options);
+    },
+    clear() {
+      return serializeCookie(name, "", { ...options, maxAge: 0 });
+    }
+  };
+}
+
+// src/server/middleware/auth.ts
+function decodeBase64Url(segment) {
+  const b64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = b64.padEnd(Math.ceil(b64.length / 4) * 4, "=");
+  return Uint8Array.from(atob(padded), (c2) => c2.charCodeAt(0));
+}
+async function verifyJwt(token, secret) {
+  const [headerB64, payloadB64, signatureB64] = token.split(".");
+  if (!headerB64 || !payloadB64 || !signatureB64)
+    throw unauthorized("Invalid token format");
+  let header;
+  let payload;
+  let signature;
+  try {
+    const decoder = new TextDecoder;
+    header = JSON.parse(decoder.decode(decodeBase64Url(headerB64)));
+    payload = JSON.parse(decoder.decode(decodeBase64Url(payloadB64)));
+    signature = decodeBase64Url(signatureB64);
+  } catch {
+    throw unauthorized("Malformed token");
+  }
+  if (header.alg !== "HS256")
+    throw unauthorized("Unsupported token algorithm");
+  const encoder = new TextEncoder;
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["verify"]);
+  const data = encoder.encode(`${headerB64}.${payloadB64}`);
+  const valid = await crypto.subtle.verify("HMAC", key, signature, data);
+  if (!valid)
+    throw unauthorized("Invalid token signature");
+  const now = Date.now() / 1000;
+  if (typeof payload.exp === "number" && payload.exp < now) {
+    throw unauthorized("Token expired");
+  }
+  if (typeof payload.nbf === "number" && payload.nbf > now) {
+    throw unauthorized("Token not yet valid");
+  }
+  return payload;
+}
+function extractToken(req, cookieName) {
+  const authHeader = req.headers.get("authorization");
+  if (authHeader?.startsWith("Bearer "))
+    return authHeader.slice(7);
+  if (cookieName) {
+    const cookies = parseCookies(req.headers.get("cookie"));
+    return cookies[cookieName] ?? null;
+  }
+  return null;
+}
+function createAuthHook(config) {
+  const onAnonymous = config.onAnonymous ?? (() => unauthorized());
+  const onForbidden = config.onForbidden ?? (() => forbidden());
+  return async (ctx, endpoint) => {
+    if (!(ctx.req instanceof Request))
+      return;
+    const identity = await config.resolve(ctx);
+    config.inject?.(ctx, identity);
+    const scope = endpoint.scope ?? config.defaultScope;
+    if (!scope)
+      return;
+    const rule = config.rules[scope];
+    if (!rule || rule === "public")
+      return;
+    if (!identity) {
+      onAnonymous();
+      return;
+    }
+    if (rule === "authenticated")
+      return;
+    if (!await rule(identity, ctx))
+      onForbidden();
+  };
+}
+function createBearerResolver(config) {
+  return async (req) => {
+    const token = extractToken(req);
+    if (!token)
+      return null;
+    return config.lookup(token, req);
+  };
+}
+// src/server/rate-limit.ts
+function refillBucket(entry, config, now) {
+  const elapsed = (now - entry.lastRefill) / 1000;
+  entry.tokens = Math.min(config.max, entry.tokens + elapsed / config.window * config.max);
+  entry.lastRefill = now;
+}
+function createRateLimiter() {
+  const { store: buckets, destroy } = createSweptMap({
+    intervalMs: 60000,
+    isExpired: (entry, now) => now - entry.lastRefill > 300000
+  });
+  return {
+    destroy,
+    check(key, config) {
+      const now = Date.now();
+      let entry = buckets.get(key);
+      if (!entry) {
+        entry = { tokens: config.max, lastRefill: now };
+        buckets.set(key, entry);
+      }
+      refillBucket(entry, config, now);
+      if (entry.tokens < 1)
+        return false;
+      entry.tokens -= 1;
+      return true;
+    },
+    remaining(key, config) {
+      const entry = buckets.get(key);
+      if (!entry)
+        return config.max;
+      refillBucket(entry, config, Date.now());
+      return Math.floor(entry.tokens);
+    }
+  };
+}
+// src/server/socket-io.ts
+import { Server as BunEngine } from "@socket.io/bun-engine";
+import { Server as SocketIOServer } from "socket.io";
+function createSocketIOServer(config) {
+  const path = config.path ?? "/socket.io/";
+  const io = new SocketIOServer({
+    path,
+    cors: {
+      origin: config.cors.origin,
+      credentials: config.cors.credentials ?? true,
+      methods: ["GET", "POST"]
+    },
+    transports: config.transports ?? ["websocket", "polling"],
+    pingTimeout: config.pingTimeout ?? 20000,
+    pingInterval: config.pingInterval ?? 1e4
+  });
+  const engine = new BunEngine({ path });
+  io.bind(engine);
+  const { websocket } = engine.handler();
+  const route = {
+    method: "ALL",
+    path: `${path.replace(/\/+$/, "")}/*`,
+    handler: (req, ctx) => {
+      if (!ctx.server) {
+        throw new Error("[stitchkit] createSocketIOServer route needs a running Bun server — mount it via createServer.");
+      }
+      return engine.handleRequest(req, ctx.server);
+    }
+  };
+  return { io, websocket, route };
+}
+export {
+  verifyJwt,
+  unauthorized,
+  streamSSE,
+  staticRoute,
+  serializeCookie,
+  resolveTraceId,
+  rateLimited,
+  parseSSE,
+  parseMultipart,
+  parseCookies,
+  notFound,
+  implement,
+  getClientInfo,
+  generateTraceId,
+  forbidden,
+  extractToken,
+  extractIp,
+  defineCookie,
+  createSocketIOServer,
+  createServer,
+  createRateLimiter,
+  createImplement,
+  createHandler,
+  createEventBus,
+  createCache,
+  createBearerResolver,
+  createAuthHook,
+  corsPreflightResponse,
+  corsHeaders,
+  conflict,
+  cacheHeaders,
+  badRequest,
+  appError,
+  AppError
+};