stitchkit 0.19.0 → 0.20.0

package/dist/{index-wpbn133x.js → index-f5e4efj1.js}

@@ -73,13 +73,8 @@ async function parseMultipart(req, fileField, fieldsSchema, maxBytes = DEFAULT_M
       continue;
     if (isUnsafeKey(key))
       continue;
-    if (typeof value === "string") {
-      try {
-        fields[key] = safeJsonParse(value);
-      } catch {
-        fields[key] = value;
-      }
-    }
+    if (typeof value === "string")
+      fields[key] = value;
   }
   return { file, fields: fieldsSchema ? fieldsSchema.parse(fields) : fields };
 }

package/dist/node.js

@@ -3,7 +3,7 @@ import {
   createImplement,
   createSocketIOServer,
   implement
-} from "./index-wpbn133x.js";
+} from "./index-f5e4efj1.js";
 import"./index-tje0q6gp.js";
 import {
   AppError,

package/dist/server/index.js

@@ -10,7 +10,7 @@ import {
   socketIoLane,
   staticRoute,
   webSocketLane
-} from "../index-wpbn133x.js";
+} from "../index-f5e4efj1.js";
 import {
   createAuthHook,
   createBearerResolver,

package/dist/server/multipart.d.ts

@@ -7,9 +7,16 @@ export interface MultipartResult {
 }
 /**
  * Parse a `multipart/form-data` request — extract the file at `fileField` and
- * the remaining fields (each JSON-decoded, then validated by `fieldsSchema`
- * when given). Rejects with a 400 if the file is missing or the upload exceeds
- * `maxBytes` (default 25 MB).
+ * the remaining fields, then validate them with `fieldsSchema` when given.
+ * Rejects with a 400 if the file is missing or the upload exceeds `maxBytes`
+ * (default 25 MB).
+ *
+ * A multipart text field is always a **string** (per the spec) and is handed to
+ * the schema as one — the schema decides its type, exactly as with query params:
+ * `z.coerce.number()` for a number, `z.coerce.boolean()` for a boolean, and
+ * `z.preprocess((v) => JSON.parse(String(v)), Schema)` to opt a field into JSON.
+ * Content is never sniffed to guess a type — the contract owns the type, not the
+ * value (so an id like `'33111715'` never turns into a number under a `z.string()`).
  */
 export declare function parseMultipart(req: Request, fileField: string, fieldsSchema?: ZodType<unknown>, maxBytes?: number): Promise<MultipartResult>;
 //# sourceMappingURL=multipart.d.ts.map

package/dist/server/multipart.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"multipart.d.ts","sourceRoot":"","sources":["../../src/server/multipart.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAInC,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,IAAI,CAAC;IACX,8EAA8E;IAC9E,MAAM,EAAE,OAAO,CAAC;CACjB;AA0CD;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,EAC/B,QAAQ,SAA2B,GAClC,OAAO,CAAC,eAAe,CAAC,CA6B1B"}
+{"version":3,"file":"multipart.d.ts","sourceRoot":"","sources":["../../src/server/multipart.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAInC,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,IAAI,CAAC;IACX,8EAA8E;IAC9E,MAAM,EAAE,OAAO,CAAC;CACjB;AA0CD;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,EAC/B,QAAQ,SAA2B,GAClC,OAAO,CAAC,eAAe,CAAC,CAyB1B"}

package/llms-full.txt

@@ -383,6 +383,25 @@ upload: {
 The client sends a `multipart/form-data` request; the field value must be a
 `Blob`. See [HTTP server → multipart](./server.md#multipart).
 
+### Multipart text fields
+
+Any non-file fields sent alongside the file are validated by the endpoint's
+`input` schema. A multipart text field is **always a string** (per the spec) —
+the schema owns its type, exactly as with [query input](#query-input-get--delete):
+
+```ts
+input: z.object({
+  id: z.string(),               // an id like '33111715' stays a string
+  count: z.coerce.number(),     // '5' → 5
+  active: z.coerce.boolean(),   // 'true' → true
+  meta: z.preprocess((v) => JSON.parse(String(v)), MetaSchema),  // opt a field into JSON
+})
+```
+
+The content is never sniffed to guess a type — a field is a string until the
+schema coerces it. Send a JSON blob as a stringified field and parse it with
+`z.preprocess`; do not rely on the framework to auto-decode it.
+
 ## Pagination
 
 Every list endpoint should return the cursor envelope — one shape, one infinite-

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stitchkit",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "Contract-first backend framework — one defineContract() into an HTTP API, MCP tools, AI-agent tools and a typed client. Bun and Node.",
   "keywords": [
     "bun",