stitchkit 0.2.0 → 0.3.0

package/dist/browser/http.d.ts

@@ -39,6 +39,11 @@ export interface HttpClientConfig {
         statusCodes?: number[];
     };
     parseError?: (body: unknown) => ErrorEnvelope['error'] | null;
+    /**
+     * Path prefixes whose `401` must NOT emit an `unauthorized` event — the
+     * login / session endpoints, where a `401` is an expected outcome. Matched
+     * against `URL.pathname`, so the prefixes start with `/`.
+     */
     authEndpoints?: string[];
     /**
      * Extra headers added to every request. A function is re-evaluated per

package/dist/browser/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/browser/http.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD,MAAM,MAAM,QAAQ,GAChB;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,GACzB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEvB,MAAM,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;AAEzD,qBAAa,QAAS,SAAQ,KAAK;aAEf,IAAI,EAAE,MAAM;aACZ,MAAM,EAAE,MAAM;aACd,OAAO,CAAC,EAAE,OAAO;aAEjB,IAAI,CAAC,EAAE,MAAM;gBAJb,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,MAAU,EAClB,OAAO,CAAC,EAAE,OAAO,YAAA,EACjC,OAAO,CAAC,EAAE,MAAM,EACA,IAAI,CAAC,EAAE,MAAM,YAAA;IAM/B,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ;CAG7C;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAU9E;AAED,MAAM,MAAM,cAAc,GACtB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACtB,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAEtD,4CAA4C;AAC5C,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;;OAKG;IACH,KAAK,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACvE,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAC9D,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED,KAAK,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;AACxD,KAAK,eAAe,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;AAE9C,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,eAAe,CAAC,CAAC;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAChC;AAED,yEAAyE;AACzE,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3E,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1E,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7D,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,IAAI,CAAC;IAClD,gFAAgF;IAChF,MAAM,IAAI,IAAI,CAAC;IACf,oEAAoE;IACpE,gBAAgB,IAAI,IAAI,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CA4JrE"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/browser/http.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD,MAAM,MAAM,QAAQ,GAChB;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,GACzB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEvB,MAAM,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;AAEzD,qBAAa,QAAS,SAAQ,KAAK;aAEf,IAAI,EAAE,MAAM;aACZ,MAAM,EAAE,MAAM;aACd,OAAO,CAAC,EAAE,OAAO;aAEjB,IAAI,CAAC,EAAE,MAAM;gBAJb,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,MAAU,EAClB,OAAO,CAAC,EAAE,OAAO,YAAA,EACjC,OAAO,CAAC,EAAE,MAAM,EACA,IAAI,CAAC,EAAE,MAAM,YAAA;IAM/B,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ;CAG7C;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAU9E;AAED,MAAM,MAAM,cAAc,GACtB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACtB,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAEtD,4CAA4C;AAC5C,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;;OAKG;IACH,KAAK,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACvE,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAC9D;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED,KAAK,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;AACxD,KAAK,eAAe,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;AAE9C,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,eAAe,CAAC,CAAC;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAChC;AAED,yEAAyE;AACzE,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3E,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1E,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7D,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,IAAI,CAAC;IAClD,gFAAgF;IAChF,MAAM,IAAI,IAAI,CAAC;IACf,oEAAoE;IACpE,gBAAgB,IAAI,IAAI,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CA4JrE"}

package/dist/{index-a35v22fh.js → index-0t460v7k.js}

@@ -21,9 +21,17 @@ function normalizeError(err) {
   if (err instanceof z.ZodError) {
     return new AppError("VALIDATION_ERROR", formatZodError(err), 400);
   }
-  const msg = err instanceof Error ? err.message : String(err);
-  const safeMessage = msg.length > 200 ? `${msg.slice(0, 200)}...` : msg;
-  return new AppError("INTERNAL_SERVER_ERROR", safeMessage, 500);
+  console.error("[stitchkit] unhandled error:", err);
+  return new AppError("INTERNAL_SERVER_ERROR", "Internal server error", 500);
+}
+function validateHandlerOutput(schema, data) {
+  const parsed = schema.safeParse(data);
+  if (parsed.success)
+    return { ok: true, data: parsed.data };
+  return {
+    ok: false,
+    message: `Handler output does not match the contract: ${formatZodError(parsed.error)}`
+  };
 }
 
-export { formatZodError, normalizeError };
+export { formatZodError, normalizeError, validateHandlerOutput };

package/dist/{index-n7bmdwmz.js → index-4b1j82gp.js}

@@ -1,3 +1,7 @@
+import {
+  normalizeError
+} from "./index-0t460v7k.js";
+
 // src/server/stream.ts
 function streamSSE(generator) {
   const encoder = new TextEncoder;
@@ -15,8 +19,8 @@ function streamSSE(generator) {
 `));
         controller.close();
       } catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        controller.enqueue(encoder.encode(`data: ${JSON.stringify({ error: msg })}
+        const envelope = normalizeError(err).toJSON();
+        controller.enqueue(encoder.encode(`data: ${JSON.stringify(envelope)}
 
 `));
         controller.close();
@@ -48,9 +52,9 @@ async function* parseSSE(response, options) {
       buffer = lines.pop() ?? "";
       for (const rawLine of lines) {
         const line = rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine;
-        if (!line.startsWith("data: "))
+        if (!line.startsWith("data:"))
           continue;
-        const data = line.slice(6);
+        const data = line.slice(5).replace(/^ /, "");
         if (data === "[DONE]")
           return;
         try {

package/dist/{index-5sxnvwb1.js → index-4kz3aqpx.js}

@@ -40,7 +40,7 @@ function createHttpClient(config) {
   let ssrCookies = null;
   let isLoggedOut = false;
   const listeners = new Set;
-  const authEndpoints = config.authEndpoints ?? ["auth/"];
+  const authEndpoints = config.authEndpoints ?? ["/auth/"];
   const parseError = config.parseError ?? parseApiErrorBody;
   function emit(event) {
     for (const fn of listeners) {
@@ -76,7 +76,7 @@ function createHttpClient(config) {
         async ({ request: request2, response }) => {
           if (response.status === 401) {
             const url = new URL(request2.url).pathname;
-            if (!isLoggedOut && !authEndpoints.some((path) => url.includes(path))) {
+            if (!isLoggedOut && !authEndpoints.some((path) => url.startsWith(path))) {
               isLoggedOut = true;
               emit({ type: "unauthorized" });
             }

package/dist/{index-v2z2v3mq.js → index-dpj1jcys.js}

@@ -1,6 +1,10 @@
 import {
-  normalizeError
-} from "./index-a35v22fh.js";
+  isWithinDir
+} from "./index-q6ja2qwq.js";
+import {
+  normalizeError,
+  validateHandlerOutput
+} from "./index-0t460v7k.js";
 import {
   AppError,
   badRequest
@@ -9,62 +13,103 @@ import {
   extractIp,
   getClientInfo,
   parseQueryParams,
+  resolveSocketIp,
   resolveTraceId
-} from "./index-ke4mx4ea.js";
+} from "./index-mwmpw6j1.js";
+import {
+  isUnsafeKey,
+  safeJsonParse
+} from "./index-kzfs85xp.js";
 
 // src/server/multipart.ts
 var DEFAULT_MAX_UPLOAD_BYTES = 25 * 1024 * 1024;
-async function parseMultipart(req, fileField, fieldsSchema, maxBytes = DEFAULT_MAX_UPLOAD_BYTES) {
-  const declared = Number(req.headers.get("content-length") ?? 0);
-  if (declared > maxBytes) {
-    badRequest(`Upload exceeds the ${Math.round(maxBytes / 1024 / 1024)} MB limit`);
+async function readBodyCapped(req, maxBytes) {
+  const reader = req.body?.getReader();
+  if (!reader)
+    return new Uint8Array(0);
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      total += value.length;
+      if (total > maxBytes) {
+        await reader.cancel();
+        badRequest(`Upload exceeds the ${Math.round(maxBytes / 1024 / 1024)} MB limit`);
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const buffer = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    buffer.set(chunk, offset);
+    offset += chunk.length;
   }
-  const formData = await req.formData();
+  return buffer;
+}
+async function parseMultipart(req, fileField, fieldsSchema, maxBytes = DEFAULT_MAX_UPLOAD_BYTES) {
+  const body = await readBodyCapped(req, maxBytes);
+  const contentType = req.headers.get("content-type") ?? "";
+  const formData = await new Response(body, {
+    headers: { "content-type": contentType }
+  }).formData();
   const file = formData.get(fileField);
   if (!file || !(file instanceof File)) {
     badRequest(`Missing file field: ${fileField}`);
   }
-  if (file.size > maxBytes) {
-    badRequest(`Upload exceeds the ${Math.round(maxBytes / 1024 / 1024)} MB limit`);
-  }
   const fields = {};
   for (const [key, value] of formData.entries()) {
     if (key === fileField)
       continue;
+    if (isUnsafeKey(key))
+      continue;
     if (typeof value === "string") {
       try {
-        fields[key] = JSON.parse(value);
+        fields[key] = safeJsonParse(value);
       } catch {
         fields[key] = value;
       }
     }
   }
-  const parsed = fieldsSchema ? fieldsSchema.parse(fields) : fields;
-  return { file, fields: parsed };
+  return { file, fields: fieldsSchema ? fieldsSchema.parse(fields) : fields };
 }
 
 // src/server/middleware/cors.ts
-function corsHeaders(config, requestOrigin) {
-  let allowOrigin;
+function assertCorsConfig(config) {
+  if (config.credentials && (config.origin === undefined || config.origin === "*")) {
+    throw new Error("[stitchkit] cors: `credentials: true` cannot be combined with a wildcard origin. " + "Set `origin` to an explicit string or list.");
+  }
+}
+function resolveOrigin(config, requestOrigin) {
   if (config.origin === undefined || config.origin === "*") {
-    allowOrigin = config.credentials ? requestOrigin ?? undefined : "*";
-  } else if (Array.isArray(config.origin)) {
-    allowOrigin = requestOrigin && config.origin.includes(requestOrigin) ? requestOrigin : undefined;
-  } else {
-    allowOrigin = config.origin;
+    return "*";
+  }
+  if (Array.isArray(config.origin)) {
+    if (!requestOrigin)
+      return;
+    const lower = requestOrigin.toLowerCase();
+    return config.origin.some((o) => o.toLowerCase() === lower) ? requestOrigin : undefined;
   }
+  return config.origin;
+}
+function corsHeaders(config, requestOrigin) {
+  const allowOrigin = resolveOrigin(config, requestOrigin);
   const headers = {
     "Access-Control-Allow-Methods": config.methods ?? "GET, POST, PUT, PATCH, DELETE, OPTIONS",
     "Access-Control-Allow-Headers": config.headers ?? "Content-Type, Authorization, X-Trace-Id"
   };
   if (allowOrigin !== undefined) {
     headers["Access-Control-Allow-Origin"] = allowOrigin;
+    if (config.credentials) {
+      headers["Access-Control-Allow-Credentials"] = "true";
+    }
   }
-  if (config.credentials) {
-    headers["Access-Control-Allow-Credentials"] = "true";
-  }
-  const variesByOrigin = Array.isArray(config.origin) || (config.origin === undefined || config.origin === "*") && Boolean(config.credentials);
-  if (variesByOrigin) {
+  if (Array.isArray(config.origin)) {
     headers.Vary = "Origin";
   }
   return headers;
@@ -77,7 +122,8 @@ function corsPreflightResponse(config, req) {
 }
 
 // src/server/router.ts
-import { resolve, sep } from "node:path";
+import { readFile, stat } from "node:fs/promises";
+import { extname, resolve } from "node:path";
 function joinPath(...parts) {
   const joined = parts.filter(Boolean).map((part) => part.replace(/^\/+|\/+$/g, "")).filter(Boolean).join("/");
   return `/${joined}`;
@@ -195,25 +241,51 @@ function matchRawRoute(rawRoutes, httpMethod, pathname) {
   }
   return null;
 }
+var STATIC_MIME = {
+  ".html": "text/html; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".ico": "image/x-icon",
+  ".woff2": "font/woff2",
+  ".txt": "text/plain; charset=utf-8"
+};
 function staticRoute(prefix, dir) {
   const cleanPrefix = prefix.replace(/\/+$/, "");
-  const cleanDir = dir.replace(/\/+$/, "");
+  const root = resolve(dir.replace(/\/+$/, ""));
   return {
     method: "GET",
     path: `${cleanPrefix}/*`,
     handler: async (req) => {
       const pathname = new URL(req.url).pathname;
-      const rel = pathname.slice(cleanPrefix.length).replace(/^\/+/, "");
-      const root = resolve(cleanDir);
+      let rel;
+      try {
+        rel = decodeURIComponent(pathname.slice(cleanPrefix.length)).replace(/^\/+/, "");
+      } catch {
+        return new Response("Bad request", { status: 400 });
+      }
       const target = resolve(root, rel);
-      if (target !== root && !target.startsWith(root + sep)) {
+      if (!isWithinDir(root, target)) {
         return new Response("Forbidden", { status: 403 });
       }
-      const file = Bun.file(target);
-      if (!await file.exists()) {
+      const info = await stat(target).catch(() => null);
+      if (!info?.isFile()) {
         return new Response("Not found", { status: 404 });
       }
-      return new Response(file);
+      const body = await readFile(target);
+      return new Response(body, {
+        headers: {
+          "Content-Type": STATIC_MIME[extname(target).toLowerCase()] ?? "application/octet-stream",
+          "X-Content-Type-Options": "nosniff"
+        }
+      });
     }
   };
 }
@@ -235,13 +307,16 @@ async function readJsonBody(req) {
   const text = await req.text();
   if (text.trim() === "")
     return {};
+  if (!req.headers.get("content-type")?.includes("application/json")) {
+    badRequest("Request body must be application/json");
+  }
   try {
-    return JSON.parse(text);
+    return safeJsonParse(text);
   } catch {
     badRequest("Invalid JSON body");
   }
 }
-async function buildContext(req, url, method, pathParams, traceId) {
+async function buildContext(req, url, method, pathParams, traceId, clientIp) {
   const parsedParams = method.paramsSchema ? method.paramsSchema.parse(pathParams) : undefined;
   let parsedInput;
   let file;
@@ -265,7 +340,7 @@ async function buildContext(req, url, method, pathParams, traceId) {
   }
   const safePathParams = {};
   for (const [k, v] of Object.entries(pathParams)) {
-    if (!RESERVED_KEYS.has(k))
+    if (!RESERVED_KEYS.has(k) && !isUnsafeKey(k))
       safePathParams[k] = v;
   }
   return {
@@ -278,10 +353,10 @@ async function buildContext(req, url, method, pathParams, traceId) {
     headers: req.headers,
     ...safePathParams,
     traceId,
-    ...getClientInfo(req)
+    ...getClientInfo(req, clientIp)
   };
 }
-function buildErrorContext(req, url, traceId) {
+function buildErrorContext(req, url, traceId, clientIp) {
   return {
     params: undefined,
     input: undefined,
@@ -290,7 +365,7 @@ function buildErrorContext(req, url, traceId) {
     url,
     headers: req.headers,
     traceId,
-    ...getClientInfo(req)
+    ...getClientInfo(req, clientIp)
   };
 }
 
@@ -326,7 +401,10 @@ function timestamp() {
   return `${t}.${now.getMilliseconds().toString().padStart(3, "0")}`;
 }
 function elapsedMs(startTime) {
-  return Number(process.hrtime.bigint() - startTime) / 1e6;
+  return performance.now() - startTime;
+}
+function safePath(pathname) {
+  return pathname.replace(/[-]/g, "");
 }
 function levelForStatus(status) {
   if (status >= 500)
@@ -372,15 +450,15 @@ function shouldLog(pathname, method) {
     return false;
   return !SKIP_PREFIXES.some((prefix) => pathname.startsWith(prefix));
 }
-function logIncoming(req, pathname, traceId) {
-  const log = { traceId, startTime: process.hrtime.bigint() };
+function logIncoming(req, pathname, traceId, ipAddress) {
+  const log = { traceId, startTime: performance.now() };
   if (!isProd) {
     const mc = METHOD_COLOR[req.method] ?? c.dim;
-    console.log(`${c.gray}[${timestamp()}]${c.reset} ${mc}${req.method}${c.reset} ${c.dim}${traceId}${c.reset} ${c.cyan}→${c.reset} ${pathname} ${ipLabel(extractIp(req))}`);
+    console.log(`${c.gray}[${timestamp()}]${c.reset} ${mc}${req.method}${c.reset} ${c.dim}${traceId}${c.reset} ${c.cyan}→${c.reset} ${safePath(pathname)} ${ipLabel(ipAddress ?? "")}`);
   }
   return log;
 }
-function logOutgoing(req, pathname, status, log) {
+function logOutgoing(req, pathname, status, log, ipAddress) {
   const ms = elapsedMs(log.startTime);
   if (isProd) {
     console.log(JSON.stringify({
@@ -388,42 +466,45 @@ function logOutgoing(req, pathname, status, log) {
       level: levelForStatus(status),
       msg: `${req.method} ${pathname} ${status}`,
       ...buildLogFields(req.method, pathname, status, Math.round(ms), log.traceId),
-      ip: extractIp(req) || undefined
+      ip: ipAddress
     }));
     return;
   }
   const mc = METHOD_COLOR[req.method] ?? c.dim;
-  console.log(`${c.gray}[${timestamp()}]${c.reset} ${mc}${req.method}${c.reset} ${c.dim}${log.traceId}${c.reset} ${c.cyan}←${c.reset} ${pathname} ${statusColor(status)}${status}${c.reset} ${durationColor(ms)}${formatMs(ms)}${c.reset} ${ipLabel(extractIp(req))}`);
+  console.log(`${c.gray}[${timestamp()}]${c.reset} ${mc}${req.method}${c.reset} ${c.dim}${log.traceId}${c.reset} ${c.cyan}←${c.reset} ${safePath(pathname)} ${statusColor(status)}${status}${c.reset} ${durationColor(ms)}${formatMs(ms)}${c.reset} ${ipLabel(ipAddress ?? "")}`);
 }
 
 // src/server/create.ts
 function createHandler(config) {
-  const { cors, hooks, logging = false } = config;
+  const { cors, hooks, logging = false, trustProxy = false } = config;
+  if (cors)
+    assertCorsConfig(cors);
   const customLogger = typeof logging === "object" ? logging : null;
   const useDefaultLog = logging === true;
   const resolveId = config.traceId ?? resolveTraceId;
   const routeMap = buildRouteMap(normalizeGroups(config));
   validateRoutes(routeMap);
-  async function dispatch(req, url, traceId, server) {
+  async function dispatch(req, url, traceId, server, clientIp) {
     const shouldLogRequest = logging && shouldLog(url.pathname, req.method);
+    const ipAddress = extractIp(req, clientIp) || undefined;
     let reqLog;
     if (shouldLogRequest && useDefaultLog) {
-      reqLog = logIncoming(req, url.pathname, traceId);
+      reqLog = logIncoming(req, url.pathname, traceId, ipAddress);
     }
     if (shouldLogRequest && customLogger) {
       customLogger.debug(`${req.method} ${url.pathname}`, {
         traceId,
         method: req.method,
         path: url.pathname,
-        ip: extractIp(req) || undefined
+        ip: ipAddress
       });
-      reqLog = { traceId, startTime: process.hrtime.bigint() };
+      reqLog = { traceId, startTime: performance.now() };
     }
     const logDone = (status) => {
       if (!reqLog)
         return;
       if (useDefaultLog)
-        logOutgoing(req, url.pathname, status, reqLog);
+        logOutgoing(req, url.pathname, status, reqLog, ipAddress);
       if (customLogger) {
         const durationMs = Math.round(elapsedMs(reqLog.startTime));
         const level = levelForStatus(status);
@@ -433,7 +514,7 @@ function createHandler(config) {
     const respondError = async (err, errCtx, endpoint) => {
       if (hooks?.onError) {
         try {
-          const response = await hooks.onError(errCtx ?? buildErrorContext(req, url, traceId), err, endpoint);
+          const response = await hooks.onError(errCtx ?? buildErrorContext(req, url, traceId, clientIp), err, endpoint);
           if (response instanceof Response) {
             const withCors = applyCors(response, cors, req);
             logDone(withCors.status);
@@ -463,7 +544,8 @@ function createHandler(config) {
         try {
           const res = await rawMatch.route.handler(req, {
             params: rawMatch.params,
-            server
+            server,
+            ipAddress
           });
           const withCors = applyCors(res, cors, req);
           logDone(withCors.status);
@@ -486,7 +568,7 @@ function createHandler(config) {
     const { method, pathParams, groupHooks } = match;
     let ctx;
     try {
-      ctx = await buildContext(req, url, method, pathParams, traceId);
+      ctx = await buildContext(req, url, method, pathParams, traceId, clientIp);
       if (hooks?.beforeHandle) {
         await hooks.beforeHandle(ctx, method);
       }
@@ -505,7 +587,11 @@ function createHandler(config) {
           result = transformed;
       }
       if (method.outputSchema) {
-        result = method.outputSchema.parse(result);
+        const checked = validateHandlerOutput(method.outputSchema, result);
+        if (!checked.ok) {
+          throw new AppError("INTERNAL_SERVER_ERROR", checked.message, 500);
+        }
+        result = checked.data;
       }
       if (result === undefined || result === null) {
         logDone(204);
@@ -520,10 +606,14 @@ function createHandler(config) {
   return async (req, server) => {
     const url = new URL(req.url, "http://localhost");
     const traceId = resolveId(req);
-    const response = await dispatch(req, url, traceId, server);
-    if (!response.headers.has("x-request-id")) {
+    const clientIp = {
+      trustProxy,
+      socketIp: resolveSocketIp(req, server)
+    };
+    const response = await dispatch(req, url, traceId, server, clientIp);
+    try {
       response.headers.set("x-request-id", traceId);
-    }
+    } catch {}
     return response;
   };
 }

package/dist/index-kzfs85xp.js

@@ -0,0 +1,9 @@
+// src/internal/safe-json.ts
+function isUnsafeKey(key) {
+  return key === "__proto__";
+}
+function safeJsonParse(text) {
+  return JSON.parse(text, (key, value) => isUnsafeKey(key) ? undefined : value);
+}
+
+export { isUnsafeKey, safeJsonParse };

package/dist/index-mwmpw6j1.js

@@ -0,0 +1,60 @@
+import {
+  isUnsafeKey
+} from "./index-kzfs85xp.js";
+import {
+  isRecord
+} from "./index-809wc1tt.js";
+
+// src/server/request.ts
+function generateTraceId() {
+  return `${Date.now().toString(36)}-${crypto.randomUUID().slice(0, 8)}`;
+}
+function resolveTraceId(req) {
+  const header = req.headers.get("x-request-id") ?? req.headers.get("x-trace-id");
+  const trimmed = header?.trim();
+  if (trimmed && trimmed.length <= 128 && /^[\w.-]+$/.test(trimmed)) {
+    return trimmed;
+  }
+  return generateTraceId();
+}
+function resolveSocketIp(req, server) {
+  if (typeof server === "object" && server !== null && "requestIP" in server && typeof server.requestIP === "function") {
+    const addr = server.requestIP(req);
+    if (isRecord(addr) && typeof addr.address === "string" && addr.address) {
+      return addr.address;
+    }
+  }
+  if ("ip" in req && typeof req.ip === "string" && req.ip)
+    return req.ip;
+  return;
+}
+function extractIp(req, options = {}) {
+  if (options.trustProxy) {
+    const forwarded = req.headers.get("x-forwarded-for");
+    if (forwarded)
+      return (forwarded.split(",")[0] ?? "").trim().replace(/^::ffff:/, "");
+    const realIp = req.headers.get("x-real-ip");
+    if (realIp)
+      return realIp.trim().replace(/^::ffff:/, "");
+  }
+  return (options.socketIp ?? "").replace(/^::ffff:/, "");
+}
+function getClientInfo(req, options = {}) {
+  return {
+    ipAddress: extractIp(req, options) || undefined,
+    userAgent: req.headers.get("user-agent") ?? undefined
+  };
+}
+function parseQueryParams(url) {
+  const query = {};
+  for (const key of new Set(url.searchParams.keys())) {
+    if (isUnsafeKey(key))
+      continue;
+    const values = url.searchParams.getAll(key);
+    const [first] = values;
+    query[key] = values.length === 1 && first !== undefined ? first : values;
+  }
+  return query;
+}
+
+export { generateTraceId, resolveTraceId, resolveSocketIp, extractIp, getClientInfo, parseQueryParams };

package/dist/index-q6ja2qwq.js

@@ -0,0 +1,7 @@
+// src/internal/within-dir.ts
+import { sep } from "node:path";
+function isWithinDir(root, target) {
+  return target === root || target.startsWith(root + sep);
+}
+
+export { isWithinDir };

package/dist/index.js

@@ -3,11 +3,11 @@ import {
   createClient,
   createClients,
   createHttpClient
-} from "./index-5sxnvwb1.js";
+} from "./index-4kz3aqpx.js";
 import {
   parseSSE
-} from "./index-n7bmdwmz.js";
-import"./index-809wc1tt.js";
+} from "./index-4b1j82gp.js";
+import"./index-0t460v7k.js";
 import {
   ALL_TRANSPORTS,
   AppError,
@@ -21,6 +21,7 @@ import {
   rateLimited,
   unauthorized
 } from "./index-kckky6zw.js";
+import"./index-809wc1tt.js";
 // src/browser/socket-io.ts
 import { io } from "socket.io-client";
 function createSocketIOClient(config) {

package/dist/internal/errors.d.ts

@@ -1,5 +1,17 @@
-import { z } from 'zod';
+import { type ZodType, z } from 'zod';
 import { AppError } from '../contract';
 export declare function formatZodError(error: z.ZodError): string;
 export declare function normalizeError(err: unknown): AppError;
+/**
+ * Validate a handler's return value against the contract `output` schema. A
+ * mismatch is a **server** fault (the handler broke its own contract) — shared
+ * by the HTTP and tool transports so both report it identically.
+ */
+export declare function validateHandlerOutput(schema: ZodType, data: unknown): {
+    ok: true;
+    data: unknown;
+} | {
+    ok: false;
+    message: string;
+};
 //# sourceMappingURL=errors.d.ts.map

package/dist/internal/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/internal/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,wBAAgB,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,GAAG,MAAM,CASxD;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,CAWrD"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/internal/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,wBAAgB,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,GAAG,MAAM,CASxD;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,CAYrD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,OAAO,GACZ;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAO9D"}

package/dist/internal/safe-json.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Prototype-pollution defence for untrusted input. Assigning a `__proto__` key
+ * onto a plain object (`obj[key] = value`, a JSON reviver, a merge) invokes the
+ * `__proto__` setter and rewires the prototype chain — the single real
+ * pollution vector at an assignment boundary. `constructor` / `prototype` as
+ * plain own keys are inert (they shadow, they do not poison), so they are NOT
+ * stripped — dropping them would silently corrupt legitimate data fields.
+ *
+ * Every boundary that ingests client-controlled keys (JSON bodies, query
+ * strings, cookies, multipart fields, tool arguments) routes through here.
+ */
+/** True for a key that must never be copied onto a plain object from untrusted input. */
+export declare function isUnsafeKey(key: string): boolean;
+/**
+ * `JSON.parse` that strips the `__proto__` key from the result. Throws on
+ * invalid JSON, exactly like `JSON.parse` — callers handle that as a 400.
+ */
+export declare function safeJsonParse(text: string): unknown;
+//# sourceMappingURL=safe-json.d.ts.map

package/dist/internal/safe-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-json.d.ts","sourceRoot":"","sources":["../../src/internal/safe-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,yFAAyF;AACzF,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEhD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD"}

package/dist/internal/within-dir.d.ts

@@ -0,0 +1,7 @@
+/**
+ * True when `target` (an already-`resolve`d absolute path) stays inside `root`.
+ * Blocks `..`, absolute and otherwise-escaping paths — the shared containment
+ * check behind `staticRoute` and `view_file`'s local-file branch.
+ */
+export declare function isWithinDir(root: string, target: string): boolean;
+//# sourceMappingURL=within-dir.d.ts.map

package/dist/internal/within-dir.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"within-dir.d.ts","sourceRoot":"","sources":["../../src/internal/within-dir.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEjE"}