stitchkit 0.104.1 → 0.105.0

package/dist/index-szybbezc.js

@@ -0,0 +1,455 @@
+import {
+  withSignalDeadline
+} from "./index-9tqbxv5p.js";
+import {
+  fetchGuarded,
+  PrivateAddressRefusal,
+  readCapped
+} from "./index-3h0ztg0z.js";
+import {
+  raceAbort
+} from "./index-b0kddvzw.js";
+import {
+  writeFileAtomicSync2
+} from "./index-ef8gdaq0.js";
+import {
+  assertPositiveSafeInteger
+} from "./index-0s4xebbg.js";
+import {
+  serializeCanonicalJson
+} from "./index-zsvzhjtk.js";
+
+// src/tools/cli/signature.ts
+import {
+  createPrivateKey,
+  createPublicKey,
+  sign as cryptoSign,
+  verify as cryptoVerify
+} from "node:crypto";
+import { z } from "zod";
+var CliBuildSignatureSchema2 = z.object({
+  algorithm: z.literal("ed25519"),
+  keyId: z.string().min(1),
+  signature: z.string().min(1)
+});
+function cliManifestSigningPayload2(manifest) {
+  return serializeCanonicalJson({
+    name: manifest.name,
+    version: manifest.version,
+    commit: manifest.commit,
+    builtAt: manifest.builtAt,
+    assets: manifest.assets.map((asset) => ({
+      platform: asset.platform,
+      arch: asset.arch,
+      compression: asset.compression,
+      size: asset.size,
+      sha256: asset.sha256
+    }))
+  });
+}
+function publicKeyOf(material) {
+  const trimmed = material.trim();
+  if (trimmed.includes("BEGIN PUBLIC KEY"))
+    return createPublicKey(trimmed);
+  const raw = Buffer.from(trimmed, "base64");
+  if (raw.length !== 32) {
+    throw new Error("[stitchkit] an Ed25519 public key is 32 bytes or SPKI PEM");
+  }
+  const spki = Buffer.concat([Buffer.from("302a300506032b6570032100", "hex"), raw]);
+  return createPublicKey({ key: spki, format: "der", type: "spki" });
+}
+function signCliManifest2(manifest, options) {
+  const signature = cryptoSign(null, Buffer.from(cliManifestSigningPayload2(manifest), "utf8"), createPrivateKey(typeof options.privateKey === "string" ? options.privateKey : { key: Buffer.from(options.privateKey), format: "der", type: "pkcs8" }));
+  return {
+    algorithm: "ed25519",
+    keyId: options.keyId,
+    signature: signature.toString("base64")
+  };
+}
+function verifyCliManifest2(manifest, signature, trust) {
+  const keys = trust?.keys;
+  if (!keys || Object.keys(keys).length === 0)
+    return "unenforced";
+  if (!signature)
+    return "missing";
+  const material = Object.hasOwn(keys, signature.keyId) ? keys[signature.keyId] : undefined;
+  if (material === undefined)
+    return "unknown-key";
+  try {
+    const ok = cryptoVerify(null, Buffer.from(cliManifestSigningPayload2(manifest), "utf8"), publicKeyOf(material), Buffer.from(signature.signature, "base64"));
+    return ok ? "valid" : "invalid";
+  } catch {
+    return "invalid";
+  }
+}
+function cliSignatureAccepted2(verdict) {
+  return verdict === "valid" || verdict === "unenforced";
+}
+
+// src/tools/cli/manifest.ts
+import { z as z2 } from "zod";
+var CliBuildTargetSchema2 = z2.object({
+  platform: z2.string().min(1),
+  arch: z2.string().min(1)
+});
+var CliBuildAssetSchema2 = CliBuildTargetSchema2.extend({
+  url: z2.url(),
+  compression: z2.enum(["gzip", "none"]).default("none"),
+  size: z2.int().positive(),
+  sha256: z2.string().regex(/^[0-9a-f]{64}$/, "sha256 must be 64 lowercase hex characters")
+});
+var CliBuildManifestSchema2 = z2.object({
+  name: z2.string().min(1),
+  version: z2.string().min(1),
+  commit: z2.string().min(1),
+  builtAt: z2.iso.datetime(),
+  assets: z2.array(CliBuildAssetSchema2),
+  signature: CliBuildSignatureSchema2.optional()
+});
+var CliBuildStampSchema2 = z2.object({
+  version: z2.string().min(1),
+  commit: z2.string().min(1),
+  builtAt: z2.iso.datetime()
+});
+function formatCliBuildStamp2(stamp, name) {
+  const prefix = name ? `${name} ` : "";
+  return `${prefix}${stamp.version} (${stamp.commit.slice(0, 12)}, built ${stamp.builtAt})`;
+}
+function currentCliBuildTarget2() {
+  return { platform: process.platform, arch: process.arch };
+}
+function selectCliBuildAsset2(manifest, target = currentCliBuildTarget2()) {
+  return manifest.assets.find((asset) => asset.platform === target.platform && asset.arch === target.arch);
+}
+function isManifestList(value) {
+  return Array.isArray(value);
+}
+function assertCliPublishable2(previous, next) {
+  const published = previous === undefined ? [] : isManifestList(previous) ? previous : [previous];
+  for (const candidate of published) {
+    if (candidate.version !== next.version)
+      continue;
+    if (candidate.commit === next.commit)
+      continue;
+    throw new Error(`[stitchkit] ${next.name} ${next.version} was already published from commit ${candidate.commit}; ` + `refusing to republish it from ${next.commit} — bump the version instead`);
+  }
+}
+
+// src/tools/cli/update.ts
+import { createHash as createHash2, randomBytes } from "node:crypto";
+import { existsSync, readFileSync, statSync, unlinkSync } from "node:fs";
+import { basename, dirname, extname, join } from "node:path";
+
+// src/tools/cli/publication-assets.ts
+import { createHash } from "node:crypto";
+import { Readable } from "node:stream";
+import { setImmediate as nextTurn } from "node:timers/promises";
+import { createGunzip, createGzip } from "node:zlib";
+
+// src/tools/cli/publication-control.ts
+function waitForPublication(operation, signal) {
+  return raceAbort(operation, signal, (value) => {
+    if (value instanceof ReadableStream && !value.locked)
+      value.cancel(signal.reason).catch(() => {
+        return;
+      });
+  });
+}
+function withPublicationDeadline(timeoutMs, caller, body) {
+  return withSignalDeadline(timeoutMs, caller, () => new Error(`CLI publication exceeded ${timeoutMs} ms`), body);
+}
+
+// src/tools/cli/publication-assets.ts
+async function collectCliBytes(source, maxBytes, signal) {
+  assertPositiveSafeInteger("CLI asset byte cap", maxBytes, RangeError);
+  const blocks = [];
+  let total = 0;
+  let filled = 0;
+  let block;
+  const consume = (chunk) => {
+    signal?.throwIfAborted();
+    if (!(chunk instanceof Uint8Array))
+      throw new TypeError("CLI asset stream must contain Uint8Array chunks");
+    if (total + chunk.byteLength > maxBytes)
+      throw new RangeError(`CLI asset exceeds ${maxBytes} bytes`);
+    for (let offset = 0;offset < chunk.byteLength; ) {
+      if (!block || filled === block.length) {
+        block = new Uint8Array(Math.min(64 * 1024, maxBytes - total));
+        blocks.push(block);
+        filled = 0;
+      }
+      const count = Math.min(chunk.byteLength - offset, block.length - filled);
+      block.set(chunk.subarray(offset, offset + count), filled);
+      filled += count;
+      total += count;
+      offset += count;
+    }
+  };
+  if (source instanceof Uint8Array)
+    consume(source);
+  else {
+    const reader = source.getReader();
+    let chunks = 0;
+    try {
+      for (;; ) {
+        const next = signal ? await waitForPublication(reader.read(), signal) : await reader.read();
+        if (next.done)
+          break;
+        consume(next.value);
+        if (++chunks % 128 === 0) {
+          if (signal)
+            await waitForPublication(nextTurn(), signal);
+          else
+            await nextTurn();
+        }
+      }
+    } catch (error) {
+      reader.cancel(error).catch(() => {
+        return;
+      });
+      throw error;
+    } finally {
+      reader.releaseLock();
+    }
+  }
+  signal?.throwIfAborted();
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of blocks) {
+    const count = Math.min(chunk.length, total - offset);
+    bytes.set(chunk.subarray(0, count), offset);
+    offset += count;
+  }
+  return bytes;
+}
+async function transformAsset(bytes, kind, maxBytes, signal) {
+  const codec = kind === "gzip" ? createGzip() : createGunzip();
+  const output = Readable.toWeb(codec);
+  codec.end(bytes);
+  try {
+    return await collectCliBytes(output, maxBytes, signal);
+  } finally {
+    codec.destroy();
+  }
+}
+function gzipCliAsset(bytes, maxBytes, signal) {
+  return transformAsset(bytes, "gzip", maxBytes, signal);
+}
+async function decodeCliAsset(transferred, asset, maxBytes, signal) {
+  assertPositiveSafeInteger("CLI asset byte cap", maxBytes, RangeError);
+  assertPositiveSafeInteger("CLI asset size", asset.size, RangeError);
+  if (asset.size > maxBytes)
+    throw new RangeError(`CLI asset declared size exceeds ${maxBytes} bytes`);
+  const bytes = asset.compression === "gzip" ? await transformAsset(transferred, "gunzip", asset.size, signal) : transferred;
+  if (bytes.length !== asset.size)
+    throw new Error(`CLI asset is ${bytes.length} bytes, manifest says ${asset.size}`);
+  const sha256 = createHash("sha256").update(bytes).digest("hex");
+  if (sha256 !== asset.sha256)
+    throw new Error("CLI asset digest does not match the manifest (checksum mismatch) — refusing to install it");
+  return { bytes, sha256 };
+}
+
+// src/tools/cli/update.ts
+var DEFAULT_CHECK_TIMEOUT_MS = 2000;
+var DEFAULT_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
+var DEFAULT_DOWNLOAD_TIMEOUT_MS = 120000;
+var DEFAULT_VERIFY_TIMEOUT_MS = 30000;
+var MANIFEST_MAX_BYTES = 256 * 1024;
+var DEFAULT_MAX_ASSET_BYTES = 256 * 1024 * 1024;
+function parseVersion(value) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?/.exec(value.trim());
+  if (!match)
+    return;
+  const numbers = [match[1], match[2], match[3]].map((part) => Number(part));
+  if (numbers.some((part) => !Number.isFinite(part)))
+    return;
+  return { numbers, prerelease: match[4] };
+}
+function compareCliVersions2(left, right) {
+  const a = parseVersion(left);
+  const b = parseVersion(right);
+  if (!a || !b)
+    return;
+  for (let index = 0;index < 3; index++) {
+    const difference = (a.numbers[index] ?? 0) - (b.numbers[index] ?? 0);
+    if (difference !== 0)
+      return difference < 0 ? -1 : 1;
+  }
+  if (a.prerelease === b.prerelease)
+    return 0;
+  if (a.prerelease === undefined)
+    return 1;
+  if (b.prerelease === undefined)
+    return -1;
+  const leftParts = a.prerelease.split(".");
+  const rightParts = b.prerelease.split(".");
+  for (let index = 0;index < Math.max(leftParts.length, rightParts.length); index++) {
+    const leftPart = leftParts[index];
+    const rightPart = rightParts[index];
+    if (leftPart === rightPart)
+      continue;
+    if (leftPart === undefined)
+      return -1;
+    if (rightPart === undefined)
+      return 1;
+    const leftNumeric = /^\d+$/.test(leftPart);
+    const rightNumeric = /^\d+$/.test(rightPart);
+    if (leftNumeric !== rightNumeric)
+      return leftNumeric ? -1 : 1;
+    if (leftNumeric) {
+      const leftDigits = leftPart.replace(/^0+(?=\d)/, "");
+      const rightDigits = rightPart.replace(/^0+(?=\d)/, "");
+      if (leftDigits.length !== rightDigits.length)
+        return leftDigits.length < rightDigits.length ? -1 : 1;
+      if (leftDigits === rightDigits)
+        continue;
+      return leftDigits < rightDigits ? -1 : 1;
+    }
+    return leftPart < rightPart ? -1 : 1;
+  }
+  return 0;
+}
+async function checkCliUpdate2(config) {
+  const now = config.now ?? Date.now();
+  const interval = config.intervalMs ?? DEFAULT_CHECK_INTERVAL_MS;
+  if (config.lastCheckedAt !== undefined && now - config.lastCheckedAt < interval) {
+    return { status: "skipped", nextCheckAt: config.lastCheckedAt + interval };
+  }
+  try {
+    const response = await fetchGuarded(new URL(config.manifestUrl), config.allowPrivateHosts ?? false, {
+      timeoutMs: config.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS,
+      bodyTimeoutMs: config.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS
+    });
+    if (!response.ok)
+      return { status: "unknown", reason: `manifest responded ${response.status}` };
+    const body = await readCapped(response, MANIFEST_MAX_BYTES);
+    if (!body)
+      return { status: "unknown", reason: "manifest is larger than expected" };
+    const parsed = CliBuildManifestSchema2.safeParse(JSON.parse(body.toString("utf8")));
+    if (!parsed.success)
+      return { status: "unknown", reason: "manifest did not validate" };
+    const manifest = parsed.data;
+    const order = compareCliVersions2(config.currentVersion, manifest.version);
+    if (order === undefined) {
+      return {
+        status: "unknown",
+        reason: `cannot compare ${config.currentVersion} with ${manifest.version}`
+      };
+    }
+    const verdict = verifyCliManifest2(manifest, manifest.signature, config.trust);
+    if (order >= 0)
+      return { status: "current", version: manifest.version, signature: verdict };
+    if (!cliSignatureAccepted2(verdict)) {
+      return { status: "unknown", reason: `manifest signature: ${verdict}` };
+    }
+    const asset = selectCliBuildAsset2(manifest, config.target ?? currentCliBuildTarget2());
+    return {
+      status: "outdated",
+      version: manifest.version,
+      manifest,
+      ...asset && { asset },
+      signature: verdict
+    };
+  } catch (error) {
+    if (error instanceof PrivateAddressRefusal) {
+      return {
+        status: "unknown",
+        reason: `${error.message} — the manifest endpoint is not public. Set ` + "`allowPrivateHosts` if it is your own deployment; the download keeps " + "its own setting, because an asset URL comes from the document."
+      };
+    }
+    return {
+      status: "unknown",
+      reason: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+async function applyCliUpdate2(config) {
+  const target = config.targetPath ?? process.execPath;
+  if (config.trust) {
+    if (!config.manifest) {
+      throw new Error("[stitchkit] update: a trust root needs the manifest the asset came from");
+    }
+    const verdict = verifyCliManifest2(config.manifest, config.manifest.signature, config.trust);
+    if (!cliSignatureAccepted2(verdict)) {
+      throw new Error(`[stitchkit] update: refusing to install — manifest signature ${verdict}`);
+    }
+    if (!config.manifest.assets.some((asset) => asset.sha256 === config.asset.sha256)) {
+      throw new Error("[stitchkit] update: the asset is not one the signed manifest names");
+    }
+  }
+  const response = await fetchGuarded(new URL(config.asset.url), config.allowPrivateHosts ?? false, {
+    timeoutMs: config.timeoutMs ?? DEFAULT_DOWNLOAD_TIMEOUT_MS,
+    bodyTimeoutMs: config.timeoutMs ?? DEFAULT_DOWNLOAD_TIMEOUT_MS
+  });
+  if (!response.ok) {
+    throw new Error(`[stitchkit] update download responded ${response.status}`);
+  }
+  const transferred = await readCapped(response, config.maxBytes ?? DEFAULT_MAX_ASSET_BYTES);
+  if (!transferred)
+    throw new Error("[stitchkit] update download exceeded the size ceiling");
+  const { bytes, sha256 } = await decodeCliAsset(transferred, config.asset, config.maxBytes ?? DEFAULT_MAX_ASSET_BYTES);
+  if (config.verify)
+    await verifyCandidate(target, bytes, config.verify, config.verifyTimeoutMs);
+  const backup = config.backupPath ? keepReplacedBinary(target, config.backupPath) : undefined;
+  writeFileAtomicSync2(target, bytes, { mode: 493 });
+  return {
+    path: target,
+    bytes: bytes.length,
+    sha256,
+    ...backup && { backupPath: backup.path, backupSha256: backup.sha256 }
+  };
+}
+async function verifyCandidate(target, bytes, verify, timeoutMs = DEFAULT_VERIFY_TIMEOUT_MS) {
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw new RangeError("[stitchkit] update: verifyTimeoutMs must be a positive number");
+  }
+  const candidate = join(dirname(target), `.${basename(target)}.candidate-${randomBytes(8).toString("hex")}${extname(target)}`);
+  writeFileAtomicSync2(candidate, bytes, { mode: 493 });
+  const controller = new AbortController;
+  let timer;
+  const deadline = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      const error = new Error(`verification did not finish within ${timeoutMs} ms`);
+      controller.abort(error);
+      reject(error);
+    }, timeoutMs);
+  });
+  try {
+    await Promise.race([
+      Promise.resolve().then(() => verify(candidate, controller.signal)),
+      deadline
+    ]);
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    throw new Error(`[stitchkit] update: the new build failed verification — ${reason}`, {
+      cause: error
+    });
+  } finally {
+    clearTimeout(timer);
+    try {
+      unlinkSync(candidate);
+    } catch {}
+  }
+}
+function keepReplacedBinary(target, backupPath) {
+  if (!existsSync(target))
+    return;
+  const previous = readFileSync(target);
+  writeFileAtomicSync2(backupPath, previous, { mode: statSync(target).mode & 511 });
+  return { path: backupPath, sha256: createHash2("sha256").update(previous).digest("hex") };
+}
+function rollbackCliUpdate2(config) {
+  const target = config.targetPath ?? process.execPath;
+  if (!existsSync(config.backupPath)) {
+    throw new Error(`[stitchkit] rollback: no backup at ${config.backupPath}`);
+  }
+  const bytes = readFileSync(config.backupPath);
+  const sha256 = createHash2("sha256").update(bytes).digest("hex");
+  if (sha256 !== config.expectedSha256) {
+    throw new Error(`[stitchkit] rollback: backup digest ${sha256} does not match the expected ${config.expectedSha256} — refusing to restore it`);
+  }
+  writeFileAtomicSync2(target, bytes, { mode: statSync(config.backupPath).mode & 511 });
+  return { path: target, bytes: bytes.length, sha256 };
+}
+
+export { CliBuildSignatureSchema2, cliManifestSigningPayload2, signCliManifest2, verifyCliManifest2, cliSignatureAccepted2, CliBuildTargetSchema2, CliBuildAssetSchema2, CliBuildManifestSchema2, CliBuildStampSchema2, formatCliBuildStamp2, currentCliBuildTarget2, selectCliBuildAsset2, assertCliPublishable2, waitForPublication, withPublicationDeadline, collectCliBytes, gzipCliAsset, decodeCliAsset, compareCliVersions2, checkCliUpdate2, applyCliUpdate2, rollbackCliUpdate2 };

package/dist/{index-2hyavjjj.js → index-wbhdzxar.js}

@@ -1,16 +1,16 @@
 import {
   isRetryableStatus2
-} from "./index-x928baz2.js";
+} from "./index-j9gxbztg.js";
 import {
   rebuildObject,
   mergeSchemas,
   assertToolExtensionCompatible,
   projectToolSurface
-} from "./index-77nxk6ay.js";
+} from "./index-r393tnfp.js";
 import {
   toolErrorFromResult,
   executeToolMethod
-} from "./index-2vnh05w4.js";
+} from "./index-2k91mewf.js";
 
 // src/tools/mount.ts
 import { z } from "zod";

package/dist/{index-4e0ah203.js → index-wdy68sh6.js}

@@ -2,7 +2,7 @@ import {
   AppError2,
   badRequest2,
   forbidden2
-} from "./index-x928baz2.js";
+} from "./index-j9gxbztg.js";
 import {
   isStreamCancellation,
   ownHttpStream,
@@ -14,7 +14,7 @@ import {
   recordedErrorMessage,
   normalizeError2,
   validateDeclaredOutput
-} from "./index-kb8styz3.js";
+} from "./index-rpzewktb.js";
 import {
   resolveTraceContext2
 } from "./index-yex7eg1v.js";
@@ -34,7 +34,10 @@ import {
 import {
   bindContract,
   mediaTypeEssence
-} from "./index-g2j7pnak.js";
+} from "./index-cmzvhhtd.js";
+import {
+  assertPositiveSafeInteger
+} from "./index-0s4xebbg.js";
 import {
   assertCorsConfig,
   isOriginAllowed,
@@ -900,16 +903,11 @@ function throwIfRequestAborted(req) {
   if (req.signal.aborted)
     throw requestAbortReason(req);
 }
-function assertJsonBodyLimit(maxBytes, owner) {
-  if (maxBytes !== undefined && (!Number.isSafeInteger(maxBytes) || maxBytes <= 0)) {
-    throw new Error(`${owner} must be a positive safe integer, received ${maxBytes}`);
-  }
-}
 async function readRequestText(req, maxBytes) {
   throwIfRequestAborted(req);
   if (maxBytes === undefined)
     return req.text();
-  assertJsonBodyLimit(maxBytes, "maxJsonBodyBytes");
+  assertPositiveSafeInteger("maxJsonBodyBytes", maxBytes, Error);
   const reader = req.body?.getReader();
   if (!reader)
     return "";
@@ -1117,7 +1115,10 @@ function contractStreamResponse(request, context, source, descriptor, operationA
         const parsed = descriptor.item.safeParse(next.value);
         if (!parsed.success) {
           console.error("[stitchkit] contract stream item failed validation:", parsed.error);
-          throw new AppError2("STREAM_ITEM_INVALID", "Stream item did not match its contract", 500);
+          throw new AppError2("STREAM_ITEM_INVALID", {
+            message: "Stream item did not match its contract",
+            status: 500
+          });
         }
         const item = parsed.data;
         const terminal = descriptor.terminal?.safeParse(item).success ?? false;
@@ -1126,14 +1127,20 @@ function contractStreamResponse(request, context, source, descriptor, operationA
         const frame = descriptor.framing === "item" ? item : { type: "data", data: item };
         if (encodedBytes(frame, format) > maxFrameBytes) {
           console.error(`[stitchkit] contract stream frame exceeded its ${maxFrameBytes} byte limit`);
-          throw new AppError2("STREAM_FRAME_TOO_LARGE", "Stream item exceeded its declared frame limit", 500);
+          throw new AppError2("STREAM_FRAME_TOO_LARGE", {
+            message: "Stream item exceeded its declared frame limit",
+            status: 500
+          });
         }
         yield frame;
         if (terminal && descriptor.completion === "terminal")
           return;
       }
       if (!terminalSeen) {
-        throw new AppError2("STREAM_TERMINAL_MISSING", "Stream completed before its declared terminal item", 500);
+        throw new AppError2("STREAM_TERMINAL_MISSING", {
+          message: "Stream completed before its declared terminal item",
+          status: 500
+        });
       }
       if (descriptor.framing !== "item")
         yield { type: "end" };
@@ -1145,7 +1152,10 @@ function contractStreamResponse(request, context, source, descriptor, operationA
           return;
         yield {
           type: "error",
-          error: new AppError2("STREAM_LIFETIME_EXCEEDED", "Stream exceeded its declared lifetime", 408).toJSON().error
+          error: new AppError2("STREAM_LIFETIME_EXCEEDED", {
+            message: "Stream exceeded its declared lifetime",
+            status: 408
+          }).toJSON().error
         };
         return;
       }
@@ -1221,7 +1231,10 @@ async function endpointResponse(state, request, outcome) {
 }
 function rawEndpointResponse(state, request, { match: { method }, result }) {
   if (!(result instanceof Response)) {
-    throw new AppError2("INTERNAL_SERVER_ERROR", `Raw endpoint ${method.serviceName}.${method.key} must return a Response`, 500);
+    throw new AppError2("INTERNAL_SERVER_ERROR", {
+      message: `Raw endpoint ${method.serviceName}.${method.key} must return a Response`,
+      status: 500
+    });
   }
   const response = method.method === "HEAD" ? new Response(null, {
     status: result.status,
@@ -1236,7 +1249,10 @@ async function streamEndpointResponse(state, request, { match: { method, pathPar
   const { req, server, clientIp } = request;
   if (!method.stream || !streamAbort || !isAsyncIterable(result)) {
     streamAbort?.abort();
-    throw new AppError2("INTERNAL_SERVER_ERROR", `Streaming endpoint ${method.serviceName}.${method.key} must return an AsyncIterable`, 500);
+    throw new AppError2("INTERNAL_SERVER_ERROR", {
+      message: `Streaming endpoint ${method.serviceName}.${method.key} must return an AsyncIterable`,
+      status: 500
+    });
   }
   const response = await contractStreamResponse(req, { params: pathParams, server, ipAddress: clientIp.socketIp }, result, method.stream, streamAbort);
   const withCors = applyCors(response, state.cors, req);
@@ -1263,18 +1279,24 @@ async function dataEndpointResponse(state, request, {
       result = transformed;
   }
   if (result instanceof Response) {
-    throw new AppError2("INTERNAL_SERVER_ERROR", `${method.serviceName}.${method.key} produced a Response on the data path — only a \`rawResponse: true\` endpoint may return one (an afterHandle hook must return data)`, 500);
+    throw new AppError2("INTERNAL_SERVER_ERROR", {
+      message: `${method.serviceName}.${method.key} produced a Response on the data path — only a \`rawResponse: true\` endpoint may return one (an afterHandle hook must return data)`,
+      status: 500
+    });
   }
   const checked = validateDeclaredOutput(method.outputSchema, result, config.warnOnOutputStrip && method.outputSchema ? (paths) => {
     warn(`[stitchkit] output strip ${method.serviceName}.${method.key}: ${paths.join(", ")}`);
   } : undefined);
   if (!checked.ok) {
-    throw new AppError2("INTERNAL_SERVER_ERROR", checked.message, 500);
+    throw new AppError2("INTERNAL_SERVER_ERROR", { message: checked.message, status: 500 });
   }
   result = checked.data;
   const responseStatus = method.responseMeta?.status ?? (method.outputSchema ? 200 : 204);
   if (method.outputSchema && (responseStatus === 204 || responseStatus === 205)) {
-    throw new AppError2("INTERNAL_SERVER_ERROR", `${method.serviceName}.${method.key} cannot combine output with bodyless status ${responseStatus}`, 500);
+    throw new AppError2("INTERNAL_SERVER_ERROR", {
+      message: `${method.serviceName}.${method.key} cannot combine output with bodyless status ${responseStatus}`,
+      status: 500
+    });
   }
   const responseHeaders = new Headers(requestCorsHeaders(cors, req));
   applyResponseMetadata(responseHeaders, responseMetadata, `${method.serviceName}.${method.key}`);
@@ -1784,7 +1806,7 @@ function createHandlerState(config) {
   const { cors, hooks, logging = false, observability } = config;
   if (cors)
     assertCorsConfig(cors);
-  assertJsonBodyLimit(config.maxJsonBodyBytes, "HandlerConfig.maxJsonBodyBytes");
+  assertPositiveSafeInteger("HandlerConfig.maxJsonBodyBytes", config.maxJsonBodyBytes, Error);
   const logConfig = resolveLoggingConfig(logging);
   const customLogger = logConfig?.logger ?? null;
   const useDefaultLog = logConfig !== null && !logConfig.logger;
@@ -2151,11 +2173,14 @@ async function dispatch(state, req, url, traceId, server, clientIp, startedAt) {
   if (!match) {
     const allow = allowedMethods(routeMap, url.pathname);
     if (allow.length > 0) {
-      const res = await respondError(new AppError2("METHOD_NOT_ALLOWED", `Method ${req.method} not allowed`, 405));
+      const res = await respondError(new AppError2("METHOD_NOT_ALLOWED", {
+        message: `Method ${req.method} not allowed`,
+        status: 405
+      }));
       res.headers.set("Allow", allow.join(", "));
       return res;
     }
-    return respondError(new AppError2("NOT_FOUND", "Not found", 404));
+    return respondError(new AppError2("NOT_FOUND", { message: "Not found", status: 404 }));
   }
   return dispatchEndpoint(state, request, match);
 }
@@ -3175,9 +3200,7 @@ var DEFAULT_MAX_REDIRECTS = 5;
 var DEFAULT_MAX_HEADER_BYTES2 = 64 * 1024;
 function positiveInteger(value, fallback, name) {
   const resolved = value ?? fallback;
-  if (!Number.isSafeInteger(resolved) || resolved <= 0) {
-    throw new TypeError(`${name} must be a positive safe integer`);
-  }
+  assertPositiveSafeInteger(name, resolved);
   return resolved;
 }
 function nonNegativeInteger(value, fallback, name) {