stitchkit 0.18.0 → 0.19.0

package/dist/browser/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/browser/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EAGX,gBAAgB,EAChB,eAAe,EAChB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAEL,KAAK,UAAU,IAAI,WAAW,EAG/B,MAAM,QAAQ,CAAC;AAkEhB,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClE,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;CACnD;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC1D,OAAO,GACP;KAAG,CAAC,IAAI,CAAC,GAAG,MAAM;CAAE,CAAC;AAEzB;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB,CAAC,CAAC,SAAS,MAAM,GAAG,KAAK;IAC5D,UAAU,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,CAAC;IAClE,eAAe,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACrC,KAAK,CAAC,CAAC,SAAS,MAAM,GAAG,KAAK,EAE9B,QAAQ,EAAE,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,EAChC,cAAc,EAAE,YAAY,GAAG,WAAW,EAC1C,cAAc,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAAC,GACvC,gBAAgB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAepC;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,EAC1E,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,GAAG;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;CAAE,CAKzF"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/browser/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EAGX,gBAAgB,EAChB,eAAe,EAChB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAEL,KAAK,UAAU,IAAI,WAAW,EAG/B,MAAM,QAAQ,CAAC;AA+EhB,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClE,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;CACnD;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC1D,OAAO,GACP;KAAG,CAAC,IAAI,CAAC,GAAG,MAAM;CAAE,CAAC;AAEzB;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB,CAAC,CAAC,SAAS,MAAM,GAAG,KAAK;IAC5D,UAAU,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,CAAC;IAClE,eAAe,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACrC,KAAK,CAAC,CAAC,SAAS,MAAM,GAAG,KAAK,EAE9B,QAAQ,EAAE,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,EAChC,cAAc,EAAE,YAAY,GAAG,WAAW,EAC1C,cAAc,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAAC,GACvC,gBAAgB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAepC;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,EAC1E,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,GAAG;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;CAAE,CAKzF"}

package/dist/browser/socket-io.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"socket-io.d.ts","sourceRoot":"","sources":["../../src/browser/socket-io.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AA2B9D;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,SAAS,CAAC;AAEvC,MAAM,WAAW,oBAAoB,CAAC,aAAa,SAAS,cAAc,GAAG,cAAc;IACzF,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,sDAAsD;IACtD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;OAMG;IACH,IAAI,CAAC,EACD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACvB,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACvE,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IAClD;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,2EAA2E;IAC3E,UAAU,CAAC,EAAE,KAAK,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IAC5C,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,uDAAuD;IACvD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mDAAmD;IACnD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;OAcG;IACH,2BAA2B,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC7C;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,cAAc,CAC7B,aAAa,SAAS,cAAc,EACpC,aAAa,SAAS,cAAc;IAEpC,6DAA6D;IAC7D,OAAO,IAAI,IAAI,CAAC;IAChB,+CAA+C;IAC/C,UAAU,IAAI,IAAI,CAAC;IACnB,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,EAAE,CAAC,CAAC,SAAS,MAAM,aAAa,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC;IAC5F,8DAA8D;IAC9D,IAAI,CAAC,CAAC,SAAS,MAAM,aAAa,GAAG,MAAM,EACzC,KAAK,EAAE,CAAC,EACR,GAAG,IAAI,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GACpC,IAAI,CAAC;IACR;;;;;;OAMG;IACH,kBAAkB,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;CACzF;AAED,wBAAgB,oBAAoB,CAClC,aAAa,SAAS,cAAc,EACpC,aAAa,SAAS,cAAc,EACpC,MAAM,EAAE,oBAAoB,CAAC,aAAa,CAAC,GAAG,cAAc,CAAC,aAAa,EAAE,aAAa,CAAC,CAyI3F"}
+{"version":3,"file":"socket-io.d.ts","sourceRoot":"","sources":["../../src/browser/socket-io.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AA0D9D;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,SAAS,CAAC;AAEvC,MAAM,WAAW,oBAAoB,CAAC,aAAa,SAAS,cAAc,GAAG,cAAc;IACzF,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,sDAAsD;IACtD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;OAMG;IACH,IAAI,CAAC,EACD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACvB,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACvE,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IAClD;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,2EAA2E;IAC3E,UAAU,CAAC,EAAE,KAAK,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IAC5C,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,uDAAuD;IACvD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mDAAmD;IACnD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;OAcG;IACH,2BAA2B,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC7C;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,cAAc,CAC7B,aAAa,SAAS,cAAc,EACpC,aAAa,SAAS,cAAc;IAEpC,6DAA6D;IAC7D,OAAO,IAAI,IAAI,CAAC;IAChB,+CAA+C;IAC/C,UAAU,IAAI,IAAI,CAAC;IACnB,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,EAAE,CAAC,CAAC,SAAS,MAAM,aAAa,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC;IAC5F,8DAA8D;IAC9D,IAAI,CAAC,CAAC,SAAS,MAAM,aAAa,GAAG,MAAM,EACzC,KAAK,EAAE,CAAC,EACR,GAAG,IAAI,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GACpC,IAAI,CAAC;IACR;;;;;;OAMG;IACH,kBAAkB,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;CACzF;AAED,wBAAgB,oBAAoB,CAClC,aAAa,SAAS,cAAc,EACpC,aAAa,SAAS,cAAc,EACpC,MAAM,EAAE,oBAAoB,CAAC,aAAa,CAAC,GAAG,cAAc,CAAC,aAAa,EAAE,aAAa,CAAC,CA8J3F"}

package/dist/cli.js

@@ -4,10 +4,10 @@ import {
   emitResult,
   parseCliArgs,
   pollUntilDone
-} from "./index-akv8rk4w.js";
+} from "./index-xmncnw8z.js";
 import"./index-0ed3bx43.js";
-import"./index-ktn76xz0.js";
-import"./index-tm7dqzxc.js";
+import"./index-ng2v2ts4.js";
+import"./index-c7nyw0yt.js";
 export {
   pollUntilDone,
   parseCliArgs,

package/dist/contract/errors-factory.d.ts

@@ -0,0 +1,18 @@
+/** A typed thrower — throws an `AppError` with the declared code and status. */
+export type ErrorThrower = (message?: string, details?: Record<string, unknown>, hint?: string) => never;
+/** The handle `defineErrors` returns. `TDef` maps `CODE → HTTP status`. */
+export interface DefinedErrors<TDef extends Record<string, number>> {
+    /** One thrower per code — `errors.CODE(message?)` throws the matching `AppError`. */
+    errors: {
+        [K in keyof TDef]: ErrorThrower;
+    };
+    /** The code literals — `codes.CODE === 'CODE'`, for client-side matching. */
+    codes: {
+        readonly [K in keyof TDef]: K;
+    };
+    /** Type guard — is `code` one of this app's declared codes? */
+    isCode: (code: string) => code is keyof TDef & string;
+}
+/** Declare a set of domain error codes (`{ CODE: httpStatus }`). */
+export declare function defineErrors<const TDef extends Record<string, number>>(defs: TDef): DefinedErrors<TDef>;
+//# sourceMappingURL=errors-factory.d.ts.map

package/dist/contract/errors-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors-factory.d.ts","sourceRoot":"","sources":["../../src/contract/errors-factory.ts"],"names":[],"mappings":"AA8BA,gFAAgF;AAChF,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,IAAI,CAAC,EAAE,MAAM,KACV,KAAK,CAAC;AAEX,2EAA2E;AAC3E,MAAM,WAAW,aAAa,CAAC,IAAI,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAChE,qFAAqF;IACrF,MAAM,EAAE;SAAG,CAAC,IAAI,MAAM,IAAI,GAAG,YAAY;KAAE,CAAC;IAC5C,6EAA6E;IAC7E,KAAK,EAAE;QAAE,QAAQ,EAAE,CAAC,IAAI,MAAM,IAAI,GAAG,CAAC;KAAE,CAAC;IACzC,+DAA+D;IAC/D,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,GAAG,MAAM,CAAC;CACvD;AAED,oEAAoE;AACpE,wBAAgB,YAAY,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACpE,IAAI,EAAE,IAAI,GACT,aAAa,CAAC,IAAI,CAAC,CAgBrB"}

package/dist/contract/factory.d.ts

@@ -0,0 +1,36 @@
+/**
+ * A `defineContract` bound to an application's scope vocabulary — so every
+ * contract MUST declare a `scope`, typed to that union.
+ *
+ * Plain `defineContract` defaults a missing `scope` to `'public'` (fail-open):
+ * forget it and the endpoint is public. A project that gates everything writes
+ * a thin wrapper to make `scope` required and typed — the same 30-line wrapper
+ * in every repo. `createContractFactory` is that wrapper, once:
+ *
+ * ```ts
+ * // app: one line
+ * const { defineContract } = createContractFactory<'public' | 'user' | 'admin'>();
+ *
+ * // scope is now REQUIRED and checked against the union — a typo or a missing
+ * // scope is a compile error, not a silent public endpoint.
+ * export const users = defineContract({ prefix: 'users', scope: 'user' }, { … });
+ * ```
+ *
+ * The scope vocabulary comes from the app; the core stays domain-free (ADR 0002).
+ * The returned contracts are ordinary `ContractDef`s — `implement`, `createClient`
+ * and the tool mounts treat them exactly as before.
+ */
+import type { ContractDef, EndpointDef } from './define';
+/** A `defineContract` whose `scope` is required and typed to `TScope`. */
+export type ScopedDefineContract<TScope extends string> = <const T extends Record<string, EndpointDef>>(meta: {
+    prefix: string;
+    scope: TScope;
+}, endpoints: T) => ContractDef<T, TScope>;
+/**
+ * Build a `defineContract` that requires a `scope` from the application's own
+ * union. Call once per app and re-export the returned `defineContract`.
+ */
+export declare function createContractFactory<TScope extends string>(): {
+    defineContract: ScopedDefineContract<TScope>;
+};
+//# sourceMappingURL=factory.d.ts.map

package/dist/contract/factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../src/contract/factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAGzD,0EAA0E;AAC1E,MAAM,MAAM,oBAAoB,CAAC,MAAM,SAAS,MAAM,IAAI,CACxD,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EAE3C,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EACvC,SAAS,EAAE,CAAC,KACT,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAE5B;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,SAAS,MAAM,KAAK;IAC9D,cAAc,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC;CAC9C,CAcA"}

package/dist/contract/index.d.ts

@@ -1,4 +1,6 @@
 export { ALL_TRANSPORTS, type ContractDef, type ContractMeta, defineContract, type EndpointDef, type EndpointFn, type EndpointToolAnnotations, type EndpointUiMeta, type FileDescriptor, type HandlerContext, type HttpMethod, type MultipartFile, type RuntimeContext, type ScopedEndpointFn, type ScopedHttpClient, type Transport, type TransportSource, type TypedClient, type TypedHttpClient, } from './define';
 export { AppError, appError, badRequest, conflict, type ErrorEnvelope, forbidden, isStitchErrorCode, notFound, rateLimited, STITCH_ERROR_STATUS, type StitchErrorCode, unauthorized, } from './errors';
+export { type DefinedErrors, defineErrors, type ErrorThrower, } from './errors-factory';
+export { createContractFactory, type ScopedDefineContract } from './factory';
 export { decodeCursor, encodeCursor, type Paginated, paginatedSchema, } from './pagination';
 //# sourceMappingURL=index.d.ts.map

package/dist/contract/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/contract/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,cAAc,EACd,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,uBAAuB,EAC5B,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,eAAe,GACrB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,KAAK,aAAa,EAClB,SAAS,EACT,iBAAiB,EACjB,QAAQ,EACR,WAAW,EACX,mBAAmB,EACnB,KAAK,eAAe,EACpB,YAAY,GACb,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,KAAK,SAAS,EACd,eAAe,GAChB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/contract/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,cAAc,EACd,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,uBAAuB,EAC5B,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,eAAe,GACrB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,KAAK,aAAa,EAClB,SAAS,EACT,iBAAiB,EACjB,QAAQ,EACR,WAAW,EACX,mBAAmB,EACnB,KAAK,eAAe,EACpB,YAAY,GACb,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,KAAK,aAAa,EAClB,YAAY,EACZ,KAAK,YAAY,GAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,KAAK,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAE7E,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,KAAK,SAAS,EACd,eAAe,GAChB,MAAM,cAAc,CAAC"}

package/dist/contract/index.js

@@ -5,8 +5,10 @@ import {
   appError,
   badRequest,
   conflict,
+  createContractFactory,
   decodeCursor,
   defineContract,
+  defineErrors,
   encodeCursor,
   forbidden,
   isStitchErrorCode,
@@ -14,7 +16,8 @@ import {
   paginatedSchema,
   rateLimited,
   unauthorized
-} from "../index-yzac2zbh.js";
+} from "../index-x62gnfsk.js";
+import"../index-809wc1tt.js";
 export {
   unauthorized,
   rateLimited,
@@ -23,8 +26,10 @@ export {
   isStitchErrorCode,
   forbidden,
   encodeCursor,
+  defineErrors,
   defineContract,
   decodeCursor,
+  createContractFactory,
   conflict,
   badRequest,
   appError,

package/dist/contract/pagination.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pagination.d.ts","sourceRoot":"","sources":["../../src/contract/pagination.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAEtC;;;;;;;GAOG;AACH,MAAM,WAAW,SAAS,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,EAAE,CAAC;IACX,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,CAAC,SAAS,OAAO,EAAE,UAAU,EAAE,CAAC;;;kBAK/D;AA4BD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEnD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GACjB,CAAC,GAAG,IAAI,CAQV"}
+{"version":3,"file":"pagination.d.ts","sourceRoot":"","sources":["../../src/contract/pagination.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGtC;;;;;;;GAOG;AACH,MAAM,WAAW,SAAS,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,EAAE,CAAC;IACX,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,CAAC,SAAS,OAAO,EAAE,UAAU,EAAE,CAAC;;;kBAK/D;AAuBD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEnD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GACjB,CAAC,GAAG,IAAI,CAQV"}

package/dist/index-809wc1tt.js

@@ -0,0 +1,18 @@
+// src/internal/typed.ts
+function typedEntries(value) {
+  return Object.entries(value);
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function mapObject(source, mapper) {
+  const result = {};
+  for (const [key, value] of typedEntries(source)) {
+    const mapped = mapper(key, value);
+    if (mapped !== undefined)
+      result[key] = mapped;
+  }
+  return result;
+}
+
+export { typedEntries, isRecord, mapObject };

package/dist/{index-tm7dqzxc.js → index-c7nyw0yt.js}

@@ -1,14 +1,6 @@
 import { createRequire } from "node:module";
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
-// src/internal/safe-json.ts
-function isUnsafeKey(key) {
-  return key === "__proto__";
-}
-function safeJsonParse(text) {
-  return JSON.parse(text, (key, value) => isUnsafeKey(key) ? undefined : value);
-}
-
 // src/internal/typed.ts
 function typedEntries(value) {
   return Object.entries(value);
@@ -17,4 +9,12 @@ function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
-export { __require, isUnsafeKey, safeJsonParse, typedEntries, isRecord };
+// src/internal/safe-json.ts
+function isUnsafeKey(key) {
+  return key === "__proto__";
+}
+function safeJsonParse(text) {
+  return JSON.parse(text, (key, value) => isUnsafeKey(key) ? undefined : value);
+}
+
+export { __require, typedEntries, isRecord, isUnsafeKey, safeJsonParse };

package/dist/{index-dz2k8d5h.js → index-dzx781tm.js}

@@ -4,7 +4,7 @@ import {
 import {
   isRecord,
   isUnsafeKey
-} from "./index-tm7dqzxc.js";
+} from "./index-c7nyw0yt.js";
 
 // src/server/request.ts
 function generateTraceId() {

package/dist/{index-ktn76xz0.js → index-ng2v2ts4.js}

@@ -66,6 +66,22 @@ function appError(code, message, details) {
 }
 // src/contract/pagination.ts
 import { z } from "zod";
+
+// src/internal/base64url.ts
+function bytesToBase64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes)
+    binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlToBytes(segment) {
+  if (!/^[A-Za-z0-9_-]*$/.test(segment) || segment.length % 4 === 1) {
+    throw new Error("invalid base64url segment");
+  }
+  const b64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = b64.padEnd(Math.ceil(b64.length / 4) * 4, "=");
+  return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
+}
 // src/internal/errors.ts
 import { z as z2 } from "zod";
 function formatZodError(error) {
@@ -112,4 +128,4 @@ function isWithinDir(root, target) {
   return target === root || target === base || target.startsWith(base + sep);
 }
 
-export { AppError, notFound, badRequest, unauthorized, forbidden, conflict, rateLimited, STITCH_ERROR_STATUS, isStitchErrorCode, appError, formatZodError, errorCode, normalizeError, validateHandlerOutput, isWithinDir };
+export { AppError, notFound, badRequest, unauthorized, forbidden, conflict, rateLimited, STITCH_ERROR_STATUS, isStitchErrorCode, appError, bytesToBase64Url, base64UrlToBytes, formatZodError, errorCode, normalizeError, validateHandlerOutput, isWithinDir };

package/dist/index-tje0q6gp.js

@@ -0,0 +1,44 @@
+// src/server/middleware/cors.ts
+var DEFAULT_CORS_ALLOW_HEADERS = "Content-Type, Authorization, X-Trace-Id, traceparent, tracestate";
+function assertCorsConfig(config) {
+  if (config.credentials && (config.origin === undefined || config.origin === "*")) {
+    throw new Error("[stitchkit] cors: `credentials: true` cannot be combined with a wildcard origin. " + "Set `origin` to an explicit string or list.");
+  }
+}
+function resolveOrigin(config, requestOrigin) {
+  if (config.origin === undefined || config.origin === "*") {
+    return "*";
+  }
+  if (Array.isArray(config.origin)) {
+    if (!requestOrigin)
+      return;
+    const lower = requestOrigin.toLowerCase();
+    return config.origin.some((o) => o.toLowerCase() === lower) ? requestOrigin : undefined;
+  }
+  return config.origin;
+}
+function corsHeaders(config, requestOrigin) {
+  const allowOrigin = resolveOrigin(config, requestOrigin);
+  const headers = {
+    "Access-Control-Allow-Methods": config.methods ?? "GET, POST, PUT, PATCH, DELETE, OPTIONS",
+    "Access-Control-Allow-Headers": config.headers ?? DEFAULT_CORS_ALLOW_HEADERS
+  };
+  if (allowOrigin !== undefined) {
+    headers["Access-Control-Allow-Origin"] = allowOrigin;
+    if (config.credentials) {
+      headers["Access-Control-Allow-Credentials"] = "true";
+    }
+  }
+  if (Array.isArray(config.origin)) {
+    headers.Vary = "Origin";
+  }
+  return headers;
+}
+function corsPreflightResponse(config, req) {
+  return new Response(null, {
+    status: 204,
+    headers: corsHeaders(config, req.headers.get("origin"))
+  });
+}
+
+export { DEFAULT_CORS_ALLOW_HEADERS, assertCorsConfig, corsHeaders, corsPreflightResponse };

package/dist/{index-6qv1fxqy.js → index-wpbn133x.js}

@@ -1,3 +1,8 @@
+import {
+  assertCorsConfig,
+  corsHeaders,
+  corsPreflightResponse
+} from "./index-tje0q6gp.js";
 import {
   AppError,
   badRequest,
@@ -5,7 +10,7 @@ import {
   isWithinDir,
   normalizeError,
   validateHandlerOutput
-} from "./index-ktn76xz0.js";
+} from "./index-ng2v2ts4.js";
 import {
   extractIp,
   getClientInfo,
@@ -13,13 +18,13 @@ import {
   resolveSocketIp,
   resolveTraceId,
   setRequestEndpoint
-} from "./index-dz2k8d5h.js";
+} from "./index-dzx781tm.js";
 import {
   __require,
   isUnsafeKey,
   safeJsonParse,
   typedEntries
-} from "./index-tm7dqzxc.js";
+} from "./index-c7nyw0yt.js";
 
 // src/server/multipart.ts
 var DEFAULT_MAX_UPLOAD_BYTES = 25 * 1024 * 1024;
@@ -79,48 +84,6 @@ async function parseMultipart(req, fileField, fieldsSchema, maxBytes = DEFAULT_M
   return { file, fields: fieldsSchema ? fieldsSchema.parse(fields) : fields };
 }
 
-// src/server/middleware/cors.ts
-function assertCorsConfig(config) {
-  if (config.credentials && (config.origin === undefined || config.origin === "*")) {
-    throw new Error("[stitchkit] cors: `credentials: true` cannot be combined with a wildcard origin. " + "Set `origin` to an explicit string or list.");
-  }
-}
-function resolveOrigin(config, requestOrigin) {
-  if (config.origin === undefined || config.origin === "*") {
-    return "*";
-  }
-  if (Array.isArray(config.origin)) {
-    if (!requestOrigin)
-      return;
-    const lower = requestOrigin.toLowerCase();
-    return config.origin.some((o) => o.toLowerCase() === lower) ? requestOrigin : undefined;
-  }
-  return config.origin;
-}
-function corsHeaders(config, requestOrigin) {
-  const allowOrigin = resolveOrigin(config, requestOrigin);
-  const headers = {
-    "Access-Control-Allow-Methods": config.methods ?? "GET, POST, PUT, PATCH, DELETE, OPTIONS",
-    "Access-Control-Allow-Headers": config.headers ?? "Content-Type, Authorization, X-Trace-Id"
-  };
-  if (allowOrigin !== undefined) {
-    headers["Access-Control-Allow-Origin"] = allowOrigin;
-    if (config.credentials) {
-      headers["Access-Control-Allow-Credentials"] = "true";
-    }
-  }
-  if (Array.isArray(config.origin)) {
-    headers.Vary = "Origin";
-  }
-  return headers;
-}
-function corsPreflightResponse(config, req) {
-  return new Response(null, {
-    status: 204,
-    headers: corsHeaders(config, req.headers.get("origin"))
-  });
-}
-
 // src/server/router.ts
 import { readFile, stat } from "node:fs/promises";
 import { resolve } from "node:path";
@@ -192,7 +155,7 @@ function buildRouteMap(groups) {
       const fullPath = prefix ? joinPath(prefix, servicePath) : servicePath;
       const segments = fullPath.split("/").filter(Boolean);
       const entries = map.get(method.method) ?? [];
-      entries.push({ method, service, pattern: fullPath, segments, groupHooks: hooks });
+      entries.push({ method, pattern: fullPath, segments, groupHooks: hooks });
       map.set(method.method, entries);
     }
   }
@@ -220,7 +183,6 @@ function matchRoute(routeMap, httpMethod, pathname) {
     if (pathParams) {
       return {
         method: entry.method,
-        service: entry.service,
         pathParams,
         groupHooks: entry.groupHooks
       };
@@ -569,8 +531,9 @@ function createHandler(config) {
     if (hooks?.onRequest) {
       const earlyResponse = await hooks.onRequest(req);
       if (earlyResponse instanceof Response) {
-        logDone(earlyResponse.status);
-        return earlyResponse;
+        const withCors = applyCors(earlyResponse, cors, req);
+        logDone(withCors.status);
+        return withCors;
       }
     }
     if (config.rawRoutes) {
@@ -895,4 +858,4 @@ function socketIoLane(websocket) {
   });
 }
 
-export { parseMultipart, corsHeaders, corsPreflightResponse, mimeForPath, staticRoute, createHandler, createServer, implement, createImplement, webSocketLane, composeWebSocketHandlers, createSocketIOServer, socketIoLane };
+export { parseMultipart, mimeForPath, staticRoute, createHandler, createServer, implement, createImplement, webSocketLane, composeWebSocketHandlers, createSocketIOServer, socketIoLane };

package/dist/{index-yzac2zbh.js → index-x62gnfsk.js}

@@ -1,3 +1,7 @@
+import {
+  mapObject
+} from "./index-809wc1tt.js";
+
 // src/contract/define.ts
 var ALL_TRANSPORTS = ["HTTP", "MCP", "AGENT", "CLI"];
 function defineContract(meta, endpoints) {
@@ -92,8 +96,51 @@ function isStitchErrorCode(code) {
 function appError(code, message, details) {
   throw new AppError(code, message, isStitchErrorCode(code) ? STITCH_ERROR_STATUS[code] : 500, details);
 }
+// src/contract/errors-factory.ts
+function defineErrors(defs) {
+  const errors = mapObject(defs, (code, status) => (message, details, hint) => {
+    throw new AppError(String(code), message, status, details, hint);
+  });
+  const codes = mapObject(defs, (code) => code);
+  const known = new Set(Object.keys(defs));
+  return {
+    errors,
+    codes,
+    isCode: (code) => known.has(code)
+  };
+}
+// src/contract/factory.ts
+function createContractFactory() {
+  return {
+    defineContract: (meta, endpoints) => {
+      const validated = defineContract({ prefix: meta.prefix }, endpoints);
+      return {
+        endpoints: validated.endpoints,
+        meta: { prefix: meta.prefix, scope: meta.scope }
+      };
+    }
+  };
+}
 // src/contract/pagination.ts
 import { z } from "zod";
+
+// src/internal/base64url.ts
+function bytesToBase64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes)
+    binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlToBytes(segment) {
+  if (!/^[A-Za-z0-9_-]*$/.test(segment) || segment.length % 4 === 1) {
+    throw new Error("invalid base64url segment");
+  }
+  const b64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = b64.padEnd(Math.ceil(b64.length / 4) * 4, "=");
+  return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
+}
+
+// src/contract/pagination.ts
 function paginatedSchema(itemSchema) {
   return z.object({
     items: z.array(itemSchema),
@@ -101,16 +148,10 @@ function paginatedSchema(itemSchema) {
   });
 }
 function toBase64Url(str) {
-  const bytes = new TextEncoder().encode(str);
-  let binary = "";
-  for (const byte of bytes)
-    binary += String.fromCharCode(byte);
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  return bytesToBase64Url(new TextEncoder().encode(str));
 }
 function fromBase64Url(value) {
-  const base64 = value.replace(/-/g, "+").replace(/_/g, "/");
-  const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
-  return new TextDecoder().decode(Uint8Array.from(atob(padded), (c) => c.charCodeAt(0)));
+  return new TextDecoder().decode(base64UrlToBytes(value));
 }
 function encodeCursor(value) {
   return toBase64Url(JSON.stringify(value));
@@ -125,4 +166,4 @@ function decodeCursor(cursor, schema) {
     return null;
   }
 }
-export { ALL_TRANSPORTS, defineContract, AppError, notFound, badRequest, unauthorized, forbidden, conflict, rateLimited, STITCH_ERROR_STATUS, isStitchErrorCode, appError, paginatedSchema, encodeCursor, decodeCursor };
+export { ALL_TRANSPORTS, defineContract, AppError, notFound, badRequest, unauthorized, forbidden, conflict, rateLimited, STITCH_ERROR_STATUS, isStitchErrorCode, appError, defineErrors, createContractFactory, paginatedSchema, encodeCursor, decodeCursor };

package/dist/{index-akv8rk4w.js → index-xmncnw8z.js}

@@ -7,12 +7,12 @@ import {
   isWithinDir,
   normalizeError,
   validateHandlerOutput
-} from "./index-ktn76xz0.js";
+} from "./index-ng2v2ts4.js";
 import {
   isRecord,
   isUnsafeKey,
   safeJsonParse
-} from "./index-tm7dqzxc.js";
+} from "./index-c7nyw0yt.js";
 
 // src/tools/coerce.ts
 import { z } from "zod";

package/dist/{index-yv93m4yr.js → index-ynnh9x6h.js}

@@ -1,12 +1,14 @@
 import {
+  base64UrlToBytes,
+  bytesToBase64Url,
   forbidden,
   unauthorized
-} from "./index-ktn76xz0.js";
+} from "./index-ng2v2ts4.js";
 import {
   isRecord,
   isUnsafeKey,
   safeJsonParse
-} from "./index-tm7dqzxc.js";
+} from "./index-c7nyw0yt.js";
 
 // src/server/middleware/cookies.ts
 function parseCookies(header) {
@@ -62,14 +64,6 @@ function defineCookie(config) {
 
 // src/server/middleware/auth.ts
 var MAX_TOKEN_BYTES = 8192;
-function decodeBase64Url(segment) {
-  if (!/^[A-Za-z0-9_-]*$/.test(segment) || segment.length % 4 === 1) {
-    throw new Error("invalid base64url segment");
-  }
-  const b64 = segment.replace(/-/g, "+").replace(/_/g, "/");
-  const padded = b64.padEnd(Math.ceil(b64.length / 4) * 4, "=");
-  return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
-}
 async function verifyJwt(token, secret, options = {}) {
   if (!secret)
     throw new Error("verifyJwt: a non-empty secret is required");
@@ -83,9 +77,9 @@ async function verifyJwt(token, secret, options = {}) {
   let signature;
   try {
     const decoder = new TextDecoder;
-    header = JSON.parse(decoder.decode(decodeBase64Url(headerB64)));
-    payloadRaw = safeJsonParse(decoder.decode(decodeBase64Url(payloadB64)));
-    signature = decodeBase64Url(signatureB64);
+    header = JSON.parse(decoder.decode(base64UrlToBytes(headerB64)));
+    payloadRaw = safeJsonParse(decoder.decode(base64UrlToBytes(payloadB64)));
+    signature = base64UrlToBytes(signatureB64);
   } catch {
     throw unauthorized("Malformed token");
   }
@@ -125,12 +119,6 @@ async function verifyJwt(token, secret, options = {}) {
   }
   return payload;
 }
-function encodeBase64Url(bytes) {
-  let binary = "";
-  for (const byte of bytes)
-    binary += String.fromCharCode(byte);
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
 async function signJwt(payload, secret, options = {}) {
   if (!secret)
     throw new Error("signJwt: a non-empty secret is required");
@@ -144,12 +132,12 @@ async function signJwt(payload, secret, options = {}) {
     ...options.subject !== undefined && { sub: options.subject }
   };
   const encoder = new TextEncoder;
-  const headerB64 = encodeBase64Url(encoder.encode(JSON.stringify({ alg: "HS256", typ: "JWT" })));
-  const payloadB64 = encodeBase64Url(encoder.encode(JSON.stringify(claims)));
+  const headerB64 = bytesToBase64Url(encoder.encode(JSON.stringify({ alg: "HS256", typ: "JWT" })));
+  const payloadB64 = bytesToBase64Url(encoder.encode(JSON.stringify(claims)));
   const signingInput = `${headerB64}.${payloadB64}`;
   const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
   const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(signingInput));
-  const signatureB64 = encodeBase64Url(new Uint8Array(signature));
+  const signatureB64 = bytesToBase64Url(new Uint8Array(signature));
   return `${signingInput}.${signatureB64}`;
 }
 function extractToken(req, cookieName) {
@@ -197,15 +185,9 @@ function createBearerResolver(config) {
 }
 
 // src/server/middleware/pkce.ts
-function base64UrlEncode(bytes) {
-  let binary = "";
-  for (const byte of bytes)
-    binary += String.fromCharCode(byte);
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
 async function deriveCodeChallenge(verifier) {
   const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
-  return base64UrlEncode(new Uint8Array(digest));
+  return bytesToBase64Url(new Uint8Array(digest));
 }
 async function verifyPkce(verifier, challenge) {
   if (!verifier || !challenge)