stitchkit 0.118.1 → 0.119.0

package/dist/{index-p0rf7sq9.js → index-s20s2mad.js}

@@ -16,7 +16,7 @@ import {
   ownHttpStream,
   settleStreamCleanup,
   ShutdownOptionsSchema2
-} from "./index-q0th8q0z.js";
+} from "./index-9mjrnqxs.js";
 import {
   RELEASE_HEADER2
 } from "./index-n15jny5b.js";
@@ -26,7 +26,7 @@ import {
 import {
   bindContract,
   mediaTypeEssence
-} from "./index-cqmqyjax.js";
+} from "./index-sa99p98w.js";
 import {
   assertCorsConfig,
   isOriginAllowed,
@@ -80,6 +80,101 @@ import {
   transportResult
 } from "./index-9jfdm5tg.js";
 
+// src/server/context-contribution.ts
+var RUNTIME_CONTEXT_RESERVED_KEYS = new Set([
+  "params",
+  "input",
+  "files",
+  "rawBody",
+  "source",
+  "req",
+  "url",
+  "headers",
+  "traceId",
+  "spanId",
+  "ipAddress",
+  "userAgent",
+  "signal",
+  "mcp",
+  "reportProgress"
+]);
+function contributionError(scope, reason) {
+  return new TypeError(`[stitchkit] auth: invalid context contribution for scope ${JSON.stringify(scope)}: ${reason}`);
+}
+function descriptorsEqual(left, right) {
+  if (!left || !right)
+    return left === right;
+  if (left.enumerable !== right.enumerable || left.configurable !== right.configurable || left.writable !== right.writable) {
+    return false;
+  }
+  if ("value" in left || "value" in right) {
+    return "value" in left && "value" in right && Object.is(left.value, right.value);
+  }
+  return left.get === right.get && left.set === right.set;
+}
+function contextContributionDelta(original, shadow, scope) {
+  if (Object.getPrototypeOf(shadow) !== Object.getPrototypeOf(original)) {
+    throw contributionError(scope, "context prototype changes are not supported");
+  }
+  const originalKeys = Reflect.ownKeys(original);
+  const shadowKeys = Reflect.ownKeys(shadow);
+  const shadowKeySet = new Set(shadowKeys);
+  for (const key of originalKeys) {
+    if (!shadowKeySet.has(key)) {
+      const printable = typeof key === "string" ? JSON.stringify(key) : "a symbol key";
+      throw contributionError(scope, `context key ${printable} may not be deleted`);
+    }
+  }
+  const contribution = Object.create(null);
+  for (const key of shadowKeys) {
+    const originalDescriptor = Object.getOwnPropertyDescriptor(original, key);
+    const shadowDescriptor = Object.getOwnPropertyDescriptor(shadow, key);
+    if (!shadowDescriptor || descriptorsEqual(originalDescriptor, shadowDescriptor))
+      continue;
+    Object.defineProperty(contribution, key, shadowDescriptor);
+  }
+  return contribution;
+}
+function prepareContextContribution(value, scope) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw contributionError(scope, "expected a plain record");
+  }
+  let prototype;
+  let descriptors;
+  let keys;
+  try {
+    prototype = Object.getPrototypeOf(value);
+    descriptors = Object.getOwnPropertyDescriptors(value);
+    keys = Reflect.ownKeys(value);
+  } catch {
+    throw contributionError(scope, "record inspection failed");
+  }
+  if (prototype !== Object.prototype && prototype !== null) {
+    throw contributionError(scope, "expected Object.prototype or null prototype");
+  }
+  const prepared = Object.create(null);
+  for (const key of keys) {
+    if (typeof key !== "string") {
+      throw contributionError(scope, "symbol keys are not supported");
+    }
+    if (isUnsafeKey(key)) {
+      throw contributionError(scope, `unsafe key ${JSON.stringify(key)}`);
+    }
+    if (RUNTIME_CONTEXT_RESERVED_KEYS.has(key)) {
+      throw contributionError(scope, `reserved key ${JSON.stringify(key)}`);
+    }
+    const descriptor = descriptors[key];
+    if (!descriptor?.enumerable || !("value" in descriptor)) {
+      throw contributionError(scope, `key ${JSON.stringify(key)} must be enumerable data`);
+    }
+    prepared[key] = descriptor.value;
+  }
+  return prepared;
+}
+function mergeContextContribution(ctx, value, scope) {
+  Object.assign(ctx, prepareContextContribution(value, scope));
+}
+
 // src/server/multipart-reader.ts
 var DEFAULT_MAX_HEADER_BYTES = 64 * 1024;
 var CRLF = new Uint8Array([13, 10]);
@@ -552,6 +647,110 @@ async function parseMultipart2(req, descriptor, fieldsSchema, receivers) {
   }
 }
 
+// src/server/request-body.ts
+async function readRequestText(req, maxBytes) {
+  if (req.signal.aborted)
+    throw abortReason(req.signal);
+  if (maxBytes === undefined)
+    return req.text();
+  assertPositiveSafeInteger("maxJsonBodyBytes", maxBytes, Error);
+  const result = await readBoundedChunks(req.body, { maxBytes, signal: req.signal });
+  if (result.kind === "over-limit")
+    badRequest2(`JSON body exceeds the ${maxBytes}-byte limit`);
+  return new TextDecoder().decode(concatChunks(result.chunks, result.total));
+}
+
+// src/server/context.ts
+function parseJsonBody(req, text, method, cors) {
+  if (text.trim() === "")
+    return {};
+  const essence = mediaTypeEssence(req.headers.get("content-type"));
+  if (essence !== "application/json") {
+    if (!method.safelistedBody || essence !== "text/plain") {
+      badRequest2("Request body must be application/json");
+    }
+    const origin = req.headers.get("origin");
+    if (!cors || cors.origin === undefined || cors.origin === "*") {
+      forbidden2("A text/plain body requires an explicit cors.origin allow-list on the server");
+    }
+    if (!origin)
+      forbidden2("A text/plain body requires an Origin header");
+    if (!isOriginAllowed(cors, origin)) {
+      forbidden2("A text/plain body is accepted only from an allowed origin");
+    }
+  }
+  try {
+    return safeJsonParse(text);
+  } catch {
+    badRequest2("Invalid JSON body");
+  }
+}
+function buildBaseContext(req, url, pathParams, traceId, clientIp) {
+  const safePathParams = {};
+  for (const [k, v] of Object.entries(pathParams)) {
+    if (!RUNTIME_CONTEXT_RESERVED_KEYS.has(k) && !isUnsafeKey(k))
+      safePathParams[k] = v;
+  }
+  return {
+    params: pathParams,
+    input: undefined,
+    source: "http",
+    req,
+    url,
+    headers: req.headers,
+    signal: req.signal,
+    ...safePathParams,
+    traceId,
+    ...getClientInfo2(req, clientIp)
+  };
+}
+function parsePathParamsInto(ctx, method) {
+  if (method.paramsSchema) {
+    ctx.params = method.paramsSchema.parse(ctx.params);
+  }
+}
+async function parseRequestPayloadInto(ctx, req, url, method, maxJsonBodyBytes, cors) {
+  if (method.multipart) {
+    const multipart = await parseMultipart2(req, method.multipart, method.inputSchema, method.multipartReceivers);
+    ctx.input = multipart.fields;
+    ctx.files = multipart.files;
+    return multipart;
+  }
+  if (method.inputSchema) {
+    if (req.method === "GET") {
+      ctx.input = method.inputSchema.parse(parseQueryParams(url));
+    } else if (req.method === "DELETE") {
+      if (mediaTypeEssence(req.headers.get("content-type")) === "application/json") {
+        const text = await readRequestText(req, method.maxJsonBodyBytes ?? maxJsonBodyBytes);
+        if (method.rawBody)
+          ctx.rawBody = text;
+        ctx.input = method.inputSchema.parse(parseJsonBody(req, text, method, cors));
+      } else {
+        ctx.input = method.inputSchema.parse(parseQueryParams(url));
+      }
+    } else {
+      const text = await readRequestText(req, method.maxJsonBodyBytes ?? maxJsonBodyBytes);
+      if (method.rawBody)
+        ctx.rawBody = text;
+      ctx.input = method.inputSchema.parse(parseJsonBody(req, text, method, cors));
+    }
+  }
+  return;
+}
+function buildErrorContext(req, url, traceId, clientIp) {
+  return {
+    params: undefined,
+    input: undefined,
+    source: "http",
+    req,
+    url,
+    headers: req.headers,
+    signal: req.signal,
+    traceId,
+    ...getClientInfo2(req, clientIp)
+  };
+}
+
 // src/server/streaming-pump.ts
 async function pumpFrames(p) {
   let sinceYield = 0;
@@ -792,205 +991,6 @@ function sseRoute2(options) {
   return streamingRoute2({ ...options, format: "sse" });
 }
 
-// src/server/context-contribution.ts
-var RUNTIME_CONTEXT_RESERVED_KEYS = new Set([
-  "params",
-  "input",
-  "files",
-  "rawBody",
-  "source",
-  "req",
-  "url",
-  "headers",
-  "traceId",
-  "spanId",
-  "ipAddress",
-  "userAgent",
-  "signal",
-  "mcp",
-  "reportProgress"
-]);
-function contributionError(scope, reason) {
-  return new TypeError(`[stitchkit] auth: invalid context contribution for scope ${JSON.stringify(scope)}: ${reason}`);
-}
-function descriptorsEqual(left, right) {
-  if (!left || !right)
-    return left === right;
-  if (left.enumerable !== right.enumerable || left.configurable !== right.configurable || left.writable !== right.writable) {
-    return false;
-  }
-  if ("value" in left || "value" in right) {
-    return "value" in left && "value" in right && Object.is(left.value, right.value);
-  }
-  return left.get === right.get && left.set === right.set;
-}
-function contextContributionDelta(original, shadow, scope) {
-  if (Object.getPrototypeOf(shadow) !== Object.getPrototypeOf(original)) {
-    throw contributionError(scope, "context prototype changes are not supported");
-  }
-  const originalKeys = Reflect.ownKeys(original);
-  const shadowKeys = Reflect.ownKeys(shadow);
-  const shadowKeySet = new Set(shadowKeys);
-  for (const key of originalKeys) {
-    if (!shadowKeySet.has(key)) {
-      const printable = typeof key === "string" ? JSON.stringify(key) : "a symbol key";
-      throw contributionError(scope, `context key ${printable} may not be deleted`);
-    }
-  }
-  const contribution = Object.create(null);
-  for (const key of shadowKeys) {
-    const originalDescriptor = Object.getOwnPropertyDescriptor(original, key);
-    const shadowDescriptor = Object.getOwnPropertyDescriptor(shadow, key);
-    if (!shadowDescriptor || descriptorsEqual(originalDescriptor, shadowDescriptor))
-      continue;
-    Object.defineProperty(contribution, key, shadowDescriptor);
-  }
-  return contribution;
-}
-function prepareContextContribution(value, scope) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    throw contributionError(scope, "expected a plain record");
-  }
-  let prototype;
-  let descriptors;
-  let keys;
-  try {
-    prototype = Object.getPrototypeOf(value);
-    descriptors = Object.getOwnPropertyDescriptors(value);
-    keys = Reflect.ownKeys(value);
-  } catch {
-    throw contributionError(scope, "record inspection failed");
-  }
-  if (prototype !== Object.prototype && prototype !== null) {
-    throw contributionError(scope, "expected Object.prototype or null prototype");
-  }
-  const prepared = Object.create(null);
-  for (const key of keys) {
-    if (typeof key !== "string") {
-      throw contributionError(scope, "symbol keys are not supported");
-    }
-    if (isUnsafeKey(key)) {
-      throw contributionError(scope, `unsafe key ${JSON.stringify(key)}`);
-    }
-    if (RUNTIME_CONTEXT_RESERVED_KEYS.has(key)) {
-      throw contributionError(scope, `reserved key ${JSON.stringify(key)}`);
-    }
-    const descriptor = descriptors[key];
-    if (!descriptor?.enumerable || !("value" in descriptor)) {
-      throw contributionError(scope, `key ${JSON.stringify(key)} must be enumerable data`);
-    }
-    prepared[key] = descriptor.value;
-  }
-  return prepared;
-}
-function mergeContextContribution(ctx, value, scope) {
-  Object.assign(ctx, prepareContextContribution(value, scope));
-}
-
-// src/server/request-body.ts
-async function readRequestText(req, maxBytes) {
-  if (req.signal.aborted)
-    throw abortReason(req.signal);
-  if (maxBytes === undefined)
-    return req.text();
-  assertPositiveSafeInteger("maxJsonBodyBytes", maxBytes, Error);
-  const result = await readBoundedChunks(req.body, { maxBytes, signal: req.signal });
-  if (result.kind === "over-limit")
-    badRequest2(`JSON body exceeds the ${maxBytes}-byte limit`);
-  return new TextDecoder().decode(concatChunks(result.chunks, result.total));
-}
-
-// src/server/context.ts
-function parseJsonBody(req, text, method, cors) {
-  if (text.trim() === "")
-    return {};
-  const essence = mediaTypeEssence(req.headers.get("content-type"));
-  if (essence !== "application/json") {
-    if (!method.safelistedBody || essence !== "text/plain") {
-      badRequest2("Request body must be application/json");
-    }
-    const origin = req.headers.get("origin");
-    if (!cors || cors.origin === undefined || cors.origin === "*") {
-      forbidden2("A text/plain body requires an explicit cors.origin allow-list on the server");
-    }
-    if (!origin)
-      forbidden2("A text/plain body requires an Origin header");
-    if (!isOriginAllowed(cors, origin)) {
-      forbidden2("A text/plain body is accepted only from an allowed origin");
-    }
-  }
-  try {
-    return safeJsonParse(text);
-  } catch {
-    badRequest2("Invalid JSON body");
-  }
-}
-function buildBaseContext(req, url, pathParams, traceId, clientIp) {
-  const safePathParams = {};
-  for (const [k, v] of Object.entries(pathParams)) {
-    if (!RUNTIME_CONTEXT_RESERVED_KEYS.has(k) && !isUnsafeKey(k))
-      safePathParams[k] = v;
-  }
-  return {
-    params: pathParams,
-    input: undefined,
-    source: "http",
-    req,
-    url,
-    headers: req.headers,
-    signal: req.signal,
-    ...safePathParams,
-    traceId,
-    ...getClientInfo2(req, clientIp)
-  };
-}
-function parsePathParamsInto(ctx, method) {
-  if (method.paramsSchema) {
-    ctx.params = method.paramsSchema.parse(ctx.params);
-  }
-}
-async function parseRequestPayloadInto(ctx, req, url, method, maxJsonBodyBytes, cors) {
-  if (method.multipart) {
-    const multipart = await parseMultipart2(req, method.multipart, method.inputSchema, method.multipartReceivers);
-    ctx.input = multipart.fields;
-    ctx.files = multipart.files;
-    return multipart;
-  }
-  if (method.inputSchema) {
-    if (req.method === "GET") {
-      ctx.input = method.inputSchema.parse(parseQueryParams(url));
-    } else if (req.method === "DELETE") {
-      if (mediaTypeEssence(req.headers.get("content-type")) === "application/json") {
-        const text = await readRequestText(req, method.maxJsonBodyBytes ?? maxJsonBodyBytes);
-        if (method.rawBody)
-          ctx.rawBody = text;
-        ctx.input = method.inputSchema.parse(parseJsonBody(req, text, method, cors));
-      } else {
-        ctx.input = method.inputSchema.parse(parseQueryParams(url));
-      }
-    } else {
-      const text = await readRequestText(req, method.maxJsonBodyBytes ?? maxJsonBodyBytes);
-      if (method.rawBody)
-        ctx.rawBody = text;
-      ctx.input = method.inputSchema.parse(parseJsonBody(req, text, method, cors));
-    }
-  }
-  return;
-}
-function buildErrorContext(req, url, traceId, clientIp) {
-  return {
-    params: undefined,
-    input: undefined,
-    source: "http",
-    req,
-    url,
-    headers: req.headers,
-    signal: req.signal,
-    traceId,
-    ...getClientInfo2(req, clientIp)
-  };
-}
-
 // src/server/contract-stream.ts
 function encodedBytes(value, format) {
   const json = JSON.stringify(value);
@@ -2342,7 +2342,7 @@ function webSocketLane2(lane) {
     handlers: {
       message(ws, message) {
         if (match(ws))
-          handlers.message(ws, message);
+          handlers.message?.(ws, message);
       },
       open(ws) {
         if (match(ws))
@@ -2372,7 +2372,7 @@ function composeWebSocketHandlers2(lanes, config) {
   return {
     ...config,
     message(ws, message) {
-      pick(ws)?.handlers.message(ws, message);
+      pick(ws)?.handlers.message?.(ws, message);
     },
     open(ws) {
       pick(ws)?.handlers.open?.(ws);
@@ -2577,6 +2577,12 @@ function socketIoLane2(websocket) {
   });
 }
 
+// src/server/unix-client.ts
+import {
+  Agent,
+  request as httpRequest
+} from "node:http";
+
 // src/server/unix-client-error.ts
 class UnixClientTransportError2 extends Error {
   code;
@@ -2589,12 +2595,6 @@ class UnixClientTransportError2 extends Error {
   }
 }
 
-// src/server/unix-client.ts
-import {
-  Agent,
-  request as httpRequest
-} from "node:http";
-
 // src/server/unix-client-body.ts
 async function readBoundedRequestBody(request, maxBytes) {
   if (!request.body)

package/dist/{index-v6vb5qx8.js → index-s3yxw6kt.js}

@@ -12,7 +12,7 @@ import {
   applyToolViewDefaults,
   projectToolView,
   objectShapeKeys
-} from "./index-rhzkndr5.js";
+} from "./index-x4p3kw1p.js";
 import {
   runWithRequestContext2,
   getRequestContext2

package/dist/{index-cqmqyjax.js → index-sa99p98w.js}

@@ -1,6 +1,6 @@
 import {
   contractMethodFields
-} from "./index-1bx1xv1k.js";
+} from "./index-pfvde2fz.js";
 import {
   AppError2
 } from "./index-qcn84byh.js";

package/dist/{index-0gxvns6s.js → index-sba3e6m4.js}

@@ -15,6 +15,7 @@ function createAsyncOperationSnapshotSchema2(config) {
     z.object({ phase: z.literal("cancelled"), ...progress })
   ]);
 }
+
 // src/tools/transfer/view-file-contract.ts
 import { z as z2 } from "zod";
 var MAX_VIEW_FILES = 20;

package/dist/{index-f24bdt13.js → index-v1swr26p.js}

@@ -9,6 +9,9 @@ import {
   ApplicationIdSchema2
 } from "./index-w5s3xftz.js";
 
+// src/application/activity.ts
+import { z as z2 } from "zod";
+
 // src/application/latest-sink.ts
 import { z } from "zod";
 var SnapshotRevisionSchema = z.number().int().nonnegative();
@@ -131,7 +134,6 @@ function createApplicationSnapshotSink2(config) {
 }
 
 // src/application/activity.ts
-import { z as z2 } from "zod";
 var BoundedOperationalIdSchema = z2.string().min(1).max(64).regex(/^[a-zA-Z0-9][a-zA-Z0-9._:-]*$/);
 var NonNegativeIntegerSchema = z2.number().int().nonnegative();
 var ActivityIdSchema2 = BoundedOperationalIdSchema;