stitchkit 0.1.0 → 0.3.0

package/dist/server/index.js

@@ -1,10 +1,17 @@
 import {
   parseSSE,
   streamSSE
-} from "../index-n7bmdwmz.js";
+} from "../index-4b1j82gp.js";
 import {
-  normalizeError
-} from "../index-gfzn1n4n.js";
+  corsHeaders,
+  corsPreflightResponse,
+  createHandler,
+  createServer,
+  parseMultipart,
+  staticRoute
+} from "../index-dpj1jcys.js";
+import"../index-q6ja2qwq.js";
+import"../index-0t460v7k.js";
 import {
   AppError,
   appError,
@@ -14,14 +21,21 @@ import {
   notFound,
   rateLimited,
   unauthorized
-} from "../index-7wfkbvss.js";
+} from "../index-kckky6zw.js";
 import {
   extractIp,
   generateTraceId,
   getClientInfo,
-  parseQueryParams,
+  resolveSocketIp,
   resolveTraceId
-} from "../index-ke4mx4ea.js";
+} from "../index-mwmpw6j1.js";
+import {
+  isUnsafeKey,
+  safeJsonParse
+} from "../index-kzfs85xp.js";
+import {
+  isRecord
+} from "../index-809wc1tt.js";
 // src/server/swept-map.ts
 function createSweptMap(options) {
   const store = new Map;
@@ -79,579 +93,8 @@ function cacheHeaders(maxAge, scope = "public") {
     "Cache-Control": `${scope}, max-age=${maxAge}`
   };
 }
-// src/server/multipart.ts
-var DEFAULT_MAX_UPLOAD_BYTES = 25 * 1024 * 1024;
-async function parseMultipart(req, fileField, fieldsSchema, maxBytes = DEFAULT_MAX_UPLOAD_BYTES) {
-  const declared = Number(req.headers.get("content-length") ?? 0);
-  if (declared > maxBytes) {
-    badRequest(`Upload exceeds the ${Math.round(maxBytes / 1024 / 1024)} MB limit`);
-  }
-  const formData = await req.formData();
-  const file = formData.get(fileField);
-  if (!file || !(file instanceof File)) {
-    badRequest(`Missing file field: ${fileField}`);
-  }
-  if (file.size > maxBytes) {
-    badRequest(`Upload exceeds the ${Math.round(maxBytes / 1024 / 1024)} MB limit`);
-  }
-  const fields = {};
-  for (const [key, value] of formData.entries()) {
-    if (key === fileField)
-      continue;
-    if (typeof value === "string") {
-      try {
-        fields[key] = JSON.parse(value);
-      } catch {
-        fields[key] = value;
-      }
-    }
-  }
-  const parsed = fieldsSchema ? fieldsSchema.parse(fields) : fields;
-  return { file, fields: parsed };
-}
-
-// src/server/context.ts
-var RESERVED_KEYS = new Set([
-  "params",
-  "input",
-  "source",
-  "req",
-  "url",
-  "headers",
-  "traceId",
-  "spanId",
-  "ipAddress",
-  "userAgent"
-]);
-async function readJsonBody(req) {
-  const text = await req.text();
-  if (text.trim() === "")
-    return {};
-  try {
-    return JSON.parse(text);
-  } catch {
-    badRequest("Invalid JSON body");
-  }
-}
-async function buildContext(req, url, method, pathParams, traceId) {
-  const parsedParams = method.paramsSchema ? method.paramsSchema.parse(pathParams) : undefined;
-  let parsedInput;
-  let file;
-  if (method.multipart) {
-    const multipart = await parseMultipart(req, method.multipart, method.inputSchema);
-    parsedInput = multipart.fields;
-    file = multipart.file;
-  } else if (method.inputSchema) {
-    if (req.method === "GET") {
-      parsedInput = method.inputSchema.parse(parseQueryParams(url));
-    } else if (req.method === "DELETE") {
-      const ct = req.headers.get("content-type");
-      if (ct?.includes("application/json")) {
-        parsedInput = method.inputSchema.parse(await readJsonBody(req));
-      } else {
-        parsedInput = method.inputSchema.parse(parseQueryParams(url));
-      }
-    } else {
-      parsedInput = method.inputSchema.parse(await readJsonBody(req));
-    }
-  }
-  const safePathParams = {};
-  for (const [k, v] of Object.entries(pathParams)) {
-    if (!RESERVED_KEYS.has(k))
-      safePathParams[k] = v;
-  }
-  return {
-    params: parsedParams,
-    input: parsedInput,
-    ...file && { file },
-    source: "http",
-    req,
-    url,
-    headers: req.headers,
-    ...safePathParams,
-    traceId,
-    ...getClientInfo(req)
-  };
-}
-function buildErrorContext(req, url, traceId) {
-  return {
-    params: undefined,
-    input: undefined,
-    source: "http",
-    req,
-    url,
-    headers: req.headers,
-    traceId,
-    ...getClientInfo(req)
-  };
-}
-
-// src/server/logger.ts
-var c = {
-  reset: "\x1B[0m",
-  dim: "\x1B[2m",
-  red: "\x1B[31m",
-  green: "\x1B[32m",
-  yellow: "\x1B[33m",
-  blue: "\x1B[34m",
-  magenta: "\x1B[35m",
-  cyan: "\x1B[36m",
-  gray: "\x1B[90m"
-};
-var METHOD_COLOR = {
-  GET: c.green,
-  POST: c.yellow,
-  PUT: c.blue,
-  PATCH: c.cyan,
-  DELETE: c.red,
-  OPTIONS: c.gray
-};
-var isProd = false;
-function timestamp() {
-  const now = new Date;
-  const t = now.toLocaleTimeString("en-US", {
-    hour12: false,
-    hour: "2-digit",
-    minute: "2-digit",
-    second: "2-digit"
-  });
-  return `${t}.${now.getMilliseconds().toString().padStart(3, "0")}`;
-}
-function elapsedMs(startTime) {
-  return Number(process.hrtime.bigint() - startTime) / 1e6;
-}
-function levelForStatus(status) {
-  if (status >= 500)
-    return "error";
-  if (status >= 400)
-    return "warn";
-  return "info";
-}
-function buildLogFields(method, path, status, durationMs, traceId) {
-  return { traceId, method, path, status, durationMs };
-}
-function formatMs(ms) {
-  if (ms >= 1000)
-    return `${(ms / 1000).toFixed(2)}s`;
-  if (ms >= 1)
-    return `${Math.round(ms)}ms`;
-  return `${Math.round(ms * 1000)}µs`;
-}
-function durationColor(ms) {
-  if (ms >= 1000)
-    return c.red;
-  if (ms > 300)
-    return c.yellow;
-  return c.green;
-}
-function statusColor(status) {
-  if (status >= 500)
-    return c.red;
-  if (status >= 400)
-    return c.yellow;
-  if (status >= 300)
-    return c.cyan;
-  return c.green;
-}
-function ipLabel(ip) {
-  if (!ip || ip === "::1" || ip === "127.0.0.1")
-    return `${c.magenta}local${c.reset}`;
-  return `${c.dim}${ip}${c.reset}`;
-}
-var SKIP_PREFIXES = ["/_bun/", "/_bundle", "/favicon"];
-function shouldLog(pathname, method) {
-  if (method === "OPTIONS")
-    return false;
-  return !SKIP_PREFIXES.some((prefix) => pathname.startsWith(prefix));
-}
-function logIncoming(req, pathname, traceId) {
-  const log = { traceId, startTime: process.hrtime.bigint() };
-  if (!isProd) {
-    const mc = METHOD_COLOR[req.method] ?? c.dim;
-    console.log(`${c.gray}[${timestamp()}]${c.reset} ${mc}${req.method}${c.reset} ${c.dim}${traceId}${c.reset} ${c.cyan}→${c.reset} ${pathname} ${ipLabel(extractIp(req))}`);
-  }
-  return log;
-}
-function logOutgoing(req, pathname, status, log) {
-  const ms = elapsedMs(log.startTime);
-  if (isProd) {
-    console.log(JSON.stringify({
-      ts: new Date().toISOString(),
-      level: levelForStatus(status),
-      msg: `${req.method} ${pathname} ${status}`,
-      ...buildLogFields(req.method, pathname, status, Math.round(ms), log.traceId),
-      ip: extractIp(req) || undefined
-    }));
-    return;
-  }
-  const mc = METHOD_COLOR[req.method] ?? c.dim;
-  console.log(`${c.gray}[${timestamp()}]${c.reset} ${mc}${req.method}${c.reset} ${c.dim}${log.traceId}${c.reset} ${c.cyan}←${c.reset} ${pathname} ${statusColor(status)}${status}${c.reset} ${durationColor(ms)}${formatMs(ms)}${c.reset} ${ipLabel(extractIp(req))}`);
-}
-
-// src/server/middleware/cors.ts
-function corsHeaders(config, requestOrigin) {
-  let allowOrigin;
-  if (config.origin === undefined || config.origin === "*") {
-    allowOrigin = config.credentials ? requestOrigin ?? undefined : "*";
-  } else if (Array.isArray(config.origin)) {
-    allowOrigin = requestOrigin && config.origin.includes(requestOrigin) ? requestOrigin : undefined;
-  } else {
-    allowOrigin = config.origin;
-  }
-  const headers = {
-    "Access-Control-Allow-Methods": config.methods ?? "GET, POST, PUT, PATCH, DELETE, OPTIONS",
-    "Access-Control-Allow-Headers": config.headers ?? "Content-Type, Authorization, X-Trace-Id"
-  };
-  if (allowOrigin !== undefined) {
-    headers["Access-Control-Allow-Origin"] = allowOrigin;
-  }
-  if (config.credentials) {
-    headers["Access-Control-Allow-Credentials"] = "true";
-  }
-  const variesByOrigin = Array.isArray(config.origin) || (config.origin === undefined || config.origin === "*") && Boolean(config.credentials);
-  if (variesByOrigin) {
-    headers.Vary = "Origin";
-  }
-  return headers;
-}
-function corsPreflightResponse(config, req) {
-  return new Response(null, {
-    status: 204,
-    headers: corsHeaders(config, req.headers.get("origin"))
-  });
-}
-
-// src/server/router.ts
-import { resolve, sep } from "node:path";
-function joinPath(...parts) {
-  const joined = parts.filter(Boolean).map((part) => part.replace(/^\/+|\/+$/g, "")).filter(Boolean).join("/");
-  return `/${joined}`;
-}
-function matchSegments(patternSegments, requestSegments) {
-  if (patternSegments.length !== requestSegments.length)
-    return null;
-  const params = {};
-  for (const [i, pattern] of patternSegments.entries()) {
-    const actual = requestSegments[i];
-    if (actual === undefined)
-      return null;
-    if (pattern.startsWith(":")) {
-      params[pattern.slice(1)] = decodeURIComponent(actual);
-    } else if (pattern !== actual) {
-      return null;
-    }
-  }
-  return params;
-}
-function buildRouteMap(groups) {
-  const map = new Map;
-  for (const { prefix, service, hooks } of groups) {
-    for (const [, method] of Object.entries(service.methods)) {
-      if (method.expose && !method.expose.includes("HTTP"))
-        continue;
-      const servicePath = joinPath("/", service.prefix, method.path === "/" ? "" : method.path);
-      const fullPath = prefix ? joinPath(prefix, servicePath) : servicePath;
-      const segments = fullPath.split("/").filter(Boolean);
-      const entries = map.get(method.method) ?? [];
-      entries.push({ method, service, pattern: fullPath, segments, groupHooks: hooks });
-      map.set(method.method, entries);
-    }
-  }
-  for (const [, entries] of map) {
-    entries.sort((a, b) => {
-      const len = Math.min(a.segments.length, b.segments.length);
-      for (let i = 0;i < len; i++) {
-        const aIsParam = a.segments[i]?.startsWith(":");
-        const bIsParam = b.segments[i]?.startsWith(":");
-        if (aIsParam !== bIsParam)
-          return aIsParam ? 1 : -1;
-      }
-      return a.segments.length - b.segments.length;
-    });
-  }
-  return map;
-}
-function matchRoute(routeMap, httpMethod, pathname) {
-  const entries = routeMap.get(httpMethod);
-  if (!entries)
-    return null;
-  const requestSegments = pathname.split("/").filter(Boolean);
-  for (const entry of entries) {
-    const pathParams = matchSegments(entry.segments, requestSegments);
-    if (pathParams) {
-      return {
-        method: entry.method,
-        service: entry.service,
-        pathParams,
-        groupHooks: entry.groupHooks
-      };
-    }
-  }
-  return null;
-}
-function allowedMethods(routeMap, pathname) {
-  const requestSegments = pathname.split("/").filter(Boolean);
-  const methods = [];
-  for (const [method, entries] of routeMap) {
-    for (const entry of entries) {
-      if (matchSegments(entry.segments, requestSegments)) {
-        methods.push(method);
-        break;
-      }
-    }
-  }
-  return methods;
-}
-function validateRoutes(routeMap) {
-  for (const [method, entries] of routeMap) {
-    const seen = new Map;
-    for (const entry of entries) {
-      const normalized = entry.segments.map((s) => s.startsWith(":") ? ":param" : s).join("/");
-      const key = `${method} /${normalized}`;
-      const existing = seen.get(key);
-      if (existing) {
-        throw new Error(`Duplicate route: ${method} ${entry.pattern} conflicts with ${existing}`);
-      }
-      seen.set(key, entry.pattern);
-    }
-  }
-}
-function matchRawRoute(rawRoutes, httpMethod, pathname) {
-  for (const route of rawRoutes) {
-    if (route.method !== "ALL" && route.method !== httpMethod)
-      continue;
-    if (route.path.endsWith("/*")) {
-      const prefix = route.path.slice(0, -2);
-      if (pathname === prefix || pathname.startsWith(`${prefix}/`)) {
-        return { route, params: {} };
-      }
-      continue;
-    }
-    if (route.path.includes("/:")) {
-      const routeSegs = route.path.split("/").filter(Boolean);
-      const pathSegs = pathname.split("/").filter(Boolean);
-      const params = matchSegments(routeSegs, pathSegs);
-      if (params)
-        return { route, params };
-      continue;
-    }
-    if (route.path === pathname)
-      return { route, params: {} };
-  }
-  return null;
-}
-function staticRoute(prefix, dir) {
-  const cleanPrefix = prefix.replace(/\/+$/, "");
-  const cleanDir = dir.replace(/\/+$/, "");
-  return {
-    method: "GET",
-    path: `${cleanPrefix}/*`,
-    handler: async (req) => {
-      const pathname = new URL(req.url).pathname;
-      const rel = pathname.slice(cleanPrefix.length).replace(/^\/+/, "");
-      const root = resolve(cleanDir);
-      const target = resolve(root, rel);
-      if (target !== root && !target.startsWith(root + sep)) {
-        return new Response("Forbidden", { status: 403 });
-      }
-      const file = Bun.file(target);
-      if (!await file.exists()) {
-        return new Response("Not found", { status: 404 });
-      }
-      return new Response(file);
-    }
-  };
-}
-
-// src/server/create.ts
-function createHandler(config) {
-  const { cors, hooks, logging = false } = config;
-  const customLogger = typeof logging === "object" ? logging : null;
-  const useDefaultLog = logging === true;
-  const resolveId = config.traceId ?? resolveTraceId;
-  const routeMap = buildRouteMap(normalizeGroups(config));
-  validateRoutes(routeMap);
-  async function dispatch(req, url, traceId, server) {
-    const shouldLogRequest = logging && shouldLog(url.pathname, req.method);
-    let reqLog;
-    if (shouldLogRequest && useDefaultLog) {
-      reqLog = logIncoming(req, url.pathname, traceId);
-    }
-    if (shouldLogRequest && customLogger) {
-      customLogger.debug(`${req.method} ${url.pathname}`, {
-        traceId,
-        method: req.method,
-        path: url.pathname,
-        ip: extractIp(req) || undefined
-      });
-      reqLog = { traceId, startTime: process.hrtime.bigint() };
-    }
-    const logDone = (status) => {
-      if (!reqLog)
-        return;
-      if (useDefaultLog)
-        logOutgoing(req, url.pathname, status, reqLog);
-      if (customLogger) {
-        const durationMs = Math.round(elapsedMs(reqLog.startTime));
-        const level = levelForStatus(status);
-        customLogger[level](`${req.method} ${url.pathname} ${status} ${durationMs}ms`, buildLogFields(req.method, url.pathname, status, durationMs, reqLog.traceId));
-      }
-    };
-    const respondError = async (err, errCtx, endpoint) => {
-      if (hooks?.onError) {
-        try {
-          const response = await hooks.onError(errCtx ?? buildErrorContext(req, url, traceId), err, endpoint);
-          if (response instanceof Response) {
-            const withCors = applyCors(response, cors, req);
-            logDone(withCors.status);
-            return withCors;
-          }
-        } catch {}
-      }
-      const appErr = normalizeError(err);
-      logDone(appErr.status);
-      return json(appErr.toJSON(), appErr.status, cors, req);
-    };
-    if (cors && req.method === "OPTIONS") {
-      const res = corsPreflightResponse(cors, req);
-      logDone(204);
-      return res;
-    }
-    if (hooks?.onRequest) {
-      const earlyResponse = await hooks.onRequest(req);
-      if (earlyResponse instanceof Response) {
-        logDone(earlyResponse.status);
-        return earlyResponse;
-      }
-    }
-    if (config.rawRoutes) {
-      const rawMatch = matchRawRoute(config.rawRoutes, req.method, url.pathname);
-      if (rawMatch) {
-        try {
-          const res = await rawMatch.route.handler(req, {
-            params: rawMatch.params,
-            server
-          });
-          const withCors = applyCors(res, cors, req);
-          logDone(withCors.status);
-          return withCors;
-        } catch (err) {
-          return respondError(err);
-        }
-      }
-    }
-    const match = matchRoute(routeMap, req.method, url.pathname);
-    if (!match) {
-      const allow = allowedMethods(routeMap, url.pathname);
-      if (allow.length > 0) {
-        const res = await respondError(new AppError("METHOD_NOT_ALLOWED", `Method ${req.method} not allowed`, 405));
-        res.headers.set("Allow", allow.join(", "));
-        return res;
-      }
-      return respondError(new AppError("NOT_FOUND", "Not found", 404));
-    }
-    const { method, pathParams, groupHooks } = match;
-    let ctx;
-    try {
-      ctx = await buildContext(req, url, method, pathParams, traceId);
-      if (hooks?.beforeHandle) {
-        await hooks.beforeHandle(ctx, method);
-      }
-      if (groupHooks?.beforeHandle) {
-        await groupHooks.beforeHandle(ctx, method);
-      }
-      let result = await method.handler(ctx);
-      if (groupHooks?.afterHandle) {
-        const transformed = await groupHooks.afterHandle(ctx, result, method);
-        if (transformed !== undefined)
-          result = transformed;
-      }
-      if (hooks?.afterHandle) {
-        const transformed = await hooks.afterHandle(ctx, result, method);
-        if (transformed !== undefined)
-          result = transformed;
-      }
-      if (method.outputSchema) {
-        result = method.outputSchema.parse(result);
-      }
-      if (result === undefined || result === null) {
-        logDone(204);
-        return new Response(null, { status: 204, headers: corsHeaders2(cors, req) });
-      }
-      logDone(200);
-      return json(result, 200, cors, req);
-    } catch (err) {
-      return respondError(err, ctx, method);
-    }
-  }
-  return async (req, server) => {
-    const url = new URL(req.url);
-    const traceId = resolveId(req);
-    const response = await dispatch(req, url, traceId, server);
-    if (!response.headers.has("x-request-id")) {
-      response.headers.set("x-request-id", traceId);
-    }
-    return response;
-  };
-}
-function createServer(config) {
-  const { routes, websocket, development, bun: bunExtra, port = 3000, hostname } = config;
-  const fetch = createHandler(config);
-  return websocket ? Bun.serve({
-    ...bunExtra,
-    ...routes && { routes },
-    ...development && { development },
-    port,
-    hostname,
-    websocket,
-    fetch
-  }) : Bun.serve({
-    ...bunExtra,
-    ...development && { development },
-    port,
-    hostname,
-    fetch
-  });
-}
-function normalizeGroups(config) {
-  const result = [];
-  if (config.services) {
-    for (const service of config.services) {
-      result.push({ prefix: "", service });
-    }
-  }
-  if (config.groups) {
-    for (const group of config.groups) {
-      for (const service of group.services) {
-        result.push({ prefix: group.pathPrefix ?? "", service, hooks: group.hooks });
-      }
-    }
-  }
-  return result;
-}
-function corsHeaders2(cors, req) {
-  if (!cors)
-    return {};
-  return corsHeaders(cors, req.headers.get("origin"));
-}
-function applyCors(res, cors, req) {
-  const extra = corsHeaders2(cors, req);
-  if (Object.keys(extra).length === 0)
-    return res;
-  const headers = new Headers(res.headers);
-  for (const [key, value] of Object.entries(extra))
-    headers.set(key, value);
-  return new Response(res.body, {
-    status: res.status,
-    statusText: res.statusText,
-    headers
-  });
-}
-function json(data, status, cors, req) {
-  return Response.json(data, { status, headers: corsHeaders2(cors, req) });
-}
 // src/server/event-bus.ts
-function createEventBus() {
+function createEventBus(options = {}) {
   const subscriptions = new Map;
   function add(event, fn, once) {
     let set = subscriptions.get(event);
@@ -675,11 +118,12 @@ function createEventBus() {
           set.delete(sub);
         try {
           const result = sub.fn(data);
-          if (result instanceof Promise)
-            result.catch(() => {
-              return;
-            });
-        } catch {}
+          if (result instanceof Promise) {
+            result.catch((err) => options.onListenerError?.(err, event));
+          }
+        } catch (err) {
+          options.onListenerError?.(err, event);
+        }
       }
     },
     on(event, handler) {
@@ -738,14 +182,17 @@ function parseCookies(header) {
     return {};
   const cookies = {};
   for (const pair of header.split(";")) {
-    const [key, ...rest] = pair.split("=");
-    if (!key)
+    const eq = pair.indexOf("=");
+    if (eq === -1)
       continue;
-    const raw = rest.join("=").trim();
+    const key = pair.slice(0, eq).trim();
+    if (!key || isUnsafeKey(key))
+      continue;
+    const raw = pair.slice(eq + 1).trim();
     try {
-      cookies[key.trim()] = decodeURIComponent(raw);
+      cookies[key] = decodeURIComponent(raw);
     } catch {
-      cookies[key.trim()] = raw;
+      cookies[key] = raw;
     }
   }
   return cookies;
@@ -782,26 +229,37 @@ function defineCookie(config) {
 }
 
 // src/server/middleware/auth.ts
+var MAX_TOKEN_BYTES = 8192;
 function decodeBase64Url(segment) {
+  if (!/^[A-Za-z0-9_-]*$/.test(segment) || segment.length % 4 === 1) {
+    throw new Error("invalid base64url segment");
+  }
   const b64 = segment.replace(/-/g, "+").replace(/_/g, "/");
   const padded = b64.padEnd(Math.ceil(b64.length / 4) * 4, "=");
-  return Uint8Array.from(atob(padded), (c2) => c2.charCodeAt(0));
+  return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
 }
-async function verifyJwt(token, secret) {
+async function verifyJwt(token, secret, options = {}) {
+  if (!secret)
+    throw new Error("verifyJwt: a non-empty secret is required");
+  if (token.length > MAX_TOKEN_BYTES)
+    throw unauthorized("Token too large");
   const [headerB64, payloadB64, signatureB64] = token.split(".");
   if (!headerB64 || !payloadB64 || !signatureB64)
     throw unauthorized("Invalid token format");
   let header;
-  let payload;
+  let payloadRaw;
   let signature;
   try {
     const decoder = new TextDecoder;
     header = JSON.parse(decoder.decode(decodeBase64Url(headerB64)));
-    payload = JSON.parse(decoder.decode(decodeBase64Url(payloadB64)));
+    payloadRaw = safeJsonParse(decoder.decode(decodeBase64Url(payloadB64)));
     signature = decodeBase64Url(signatureB64);
   } catch {
     throw unauthorized("Malformed token");
   }
+  if (!isRecord(payloadRaw))
+    throw unauthorized("Malformed token");
+  const payload = payloadRaw;
   if (header.alg !== "HS256")
     throw unauthorized("Unsupported token algorithm");
   const encoder = new TextEncoder;
@@ -810,12 +268,28 @@ async function verifyJwt(token, secret) {
   const valid = await crypto.subtle.verify("HMAC", key, signature, data);
   if (!valid)
     throw unauthorized("Invalid token signature");
+  const leeway = options.leewaySeconds ?? 60;
   const now = Date.now() / 1000;
-  if (typeof payload.exp === "number" && payload.exp < now) {
-    throw unauthorized("Token expired");
+  if ("exp" in payload) {
+    if (typeof payload.exp !== "number")
+      throw unauthorized("Malformed token");
+    if (payload.exp < now - leeway)
+      throw unauthorized("Token expired");
+  }
+  if ("nbf" in payload) {
+    if (typeof payload.nbf !== "number")
+      throw unauthorized("Malformed token");
+    if (payload.nbf > now + leeway)
+      throw unauthorized("Token not yet valid");
+  }
+  if (options.issuer !== undefined && payload.iss !== options.issuer) {
+    throw unauthorized("Token issuer mismatch");
   }
-  if (typeof payload.nbf === "number" && payload.nbf > now) {
-    throw unauthorized("Token not yet valid");
+  if (options.audience !== undefined) {
+    const aud = payload.aud;
+    const ok = Array.isArray(aud) ? aud.includes(options.audience) : aud === options.audience;
+    if (!ok)
+      throw unauthorized("Token audience mismatch");
   }
   return payload;
 }
@@ -833,15 +307,16 @@ function createAuthHook(config) {
   const onAnonymous = config.onAnonymous ?? (() => unauthorized());
   const onForbidden = config.onForbidden ?? (() => forbidden());
   return async (ctx, endpoint) => {
-    if (!(ctx.req instanceof Request))
-      return;
-    const identity = await config.resolve(ctx);
+    const identity = ctx.source === "http" ? await config.resolve(ctx) : await config.resolveFromContext?.(ctx) ?? null;
     config.inject?.(ctx, identity);
     const scope = endpoint.scope ?? config.defaultScope;
     if (!scope)
       return;
     const rule = config.rules[scope];
-    if (!rule || rule === "public")
+    if (!rule) {
+      throw new Error(`[stitchkit] auth: no rule for scope "${scope}"`);
+    }
+    if (rule === "public")
       return;
     if (!identity) {
       onAnonymous();
@@ -867,6 +342,7 @@ function refillBucket(entry, config, now) {
   entry.tokens = Math.min(config.max, entry.tokens + elapsed / config.window * config.max);
   entry.lastRefill = now;
 }
+var MAX_BUCKETS = 1e5;
 function createRateLimiter() {
   const { store: buckets, destroy } = createSweptMap({
     intervalMs: 60000,
@@ -876,15 +352,26 @@ function createRateLimiter() {
     destroy,
     check(key, config) {
       const now = Date.now();
-      let entry = buckets.get(key);
-      if (!entry) {
-        entry = { tokens: config.max, lastRefill: now };
+      const entry = buckets.get(key);
+      if (entry) {
+        buckets.delete(key);
         buckets.set(key, entry);
+        refillBucket(entry, config, now);
+        if (entry.tokens < 1)
+          return false;
+        entry.tokens -= 1;
+        return true;
+      }
+      if (buckets.size >= MAX_BUCKETS) {
+        const lru = buckets.keys().next().value;
+        if (lru !== undefined)
+          buckets.delete(lru);
       }
-      refillBucket(entry, config, now);
-      if (entry.tokens < 1)
+      const fresh = { tokens: config.max, lastRefill: now };
+      buckets.set(key, fresh);
+      if (fresh.tokens < 1)
         return false;
-      entry.tokens -= 1;
+      fresh.tokens -= 1;
       return true;
     },
     remaining(key, config) {
@@ -934,6 +421,7 @@ export {
   staticRoute,
   serializeCookie,
   resolveTraceId,
+  resolveSocketIp,
   rateLimited,
   parseSSE,
   parseMultipart,