stitchkit 0.2.0 → 0.3.0

package/dist/tools.js

@@ -1,41 +1,77 @@
 import {
   createClient
-} from "./index-5sxnvwb1.js";
+} from "./index-4kz3aqpx.js";
 import {
-  isRecord
-} from "./index-809wc1tt.js";
+  isWithinDir
+} from "./index-q6ja2qwq.js";
 import {
   formatZodError,
-  normalizeError
-} from "./index-a35v22fh.js";
+  normalizeError,
+  validateHandlerOutput
+} from "./index-0t460v7k.js";
 import"./index-kckky6zw.js";
+import {
+  isUnsafeKey,
+  safeJsonParse
+} from "./index-kzfs85xp.js";
+import {
+  isRecord
+} from "./index-809wc1tt.js";
 
 // src/tools/agent.ts
 import { tool, zodSchema } from "ai";
 
-// src/tools/schema.ts
+// src/tools/coerce.ts
 import { z } from "zod";
+function needsJsonCoercion(field) {
+  if (field instanceof z.ZodArray || field instanceof z.ZodObject)
+    return true;
+  if (field instanceof z.ZodOptional || field instanceof z.ZodNullable || field instanceof z.ZodDefault) {
+    return needsJsonCoercion(field.unwrap());
+  }
+  return false;
+}
+function coerceJsonArgs(args, schema) {
+  if (!(schema instanceof z.ZodObject))
+    return args;
+  const shape = schema.shape;
+  const out = {};
+  for (const [key, value] of Object.entries(args)) {
+    const field = shape[key];
+    if (field && needsJsonCoercion(field) && typeof value === "string") {
+      try {
+        out[key] = safeJsonParse(value);
+        continue;
+      } catch {}
+    }
+    out[key] = value;
+  }
+  return out;
+}
+
+// src/tools/schema.ts
+import { z as z2 } from "zod";
 function objectShapeKeys(schema) {
-  return schema instanceof z.ZodObject ? Object.keys(schema.shape) : [];
+  return schema instanceof z2.ZodObject ? Object.keys(schema.shape) : [];
 }
 function mergeSchemas(paramsSchema, inputSchema) {
-  if (paramsSchema && !(paramsSchema instanceof z.ZodObject)) {
+  if (paramsSchema && !(paramsSchema instanceof z2.ZodObject)) {
     throw new Error("Tool params schema must be a z.object()");
   }
-  const paramsObject = paramsSchema instanceof z.ZodObject ? paramsSchema : undefined;
+  const paramsObject = paramsSchema instanceof z2.ZodObject ? paramsSchema : undefined;
   if (!inputSchema) {
-    return paramsObject ?? z.object({});
+    return paramsObject ?? z2.object({});
   }
-  if (inputSchema instanceof z.ZodObject) {
+  if (inputSchema instanceof z2.ZodObject) {
     if (paramsObject) {
       const conflicts = Object.keys(paramsObject.shape).filter((key) => (key in inputSchema.shape));
       if (conflicts.length > 0) {
         throw new Error(`Schema merge conflict: ${conflicts.join(", ")} appear in both params and input`);
       }
     }
-    return z.object({ ...paramsObject?.shape ?? {}, ...inputSchema.shape });
+    return z2.object({ ...paramsObject?.shape ?? {}, ...inputSchema.shape });
   }
-  return paramsObject ? z.intersection(paramsObject, inputSchema) : inputSchema;
+  return paramsObject ? z2.intersection(paramsObject, inputSchema) : inputSchema;
 }
 
 // src/tools/execute.ts
@@ -48,24 +84,34 @@ function toolResultFromError(err) {
     ...appErr.hint && { hint: appErr.hint }
   };
 }
-async function executeToolMethod(method, toolName, rawArgs, context, hooks, lifecycle) {
+async function executeToolMethod(method, toolName, rawArgs, context, hooks, lifecycle, coerceJson = false) {
   const startedAt = Date.now();
   const finish = async (result) => {
     await hooks?.afterToolCall?.(toolName, rawArgs, result, Date.now() - startedAt, context);
     return result;
   };
   if (hooks?.beforeToolCall) {
-    await hooks.beforeToolCall(toolName, rawArgs, context);
+    try {
+      await hooks.beforeToolCall(toolName, rawArgs, context);
+    } catch (err) {
+      return finish(toolResultFromError(err));
+    }
   }
   const paramKeys = new Set(objectShapeKeys(method.paramsSchema));
-  const paramArgs = {};
-  const inputArgs = {};
+  let paramArgs = {};
+  let inputArgs = {};
   for (const [key, value] of Object.entries(rawArgs)) {
+    if (isUnsafeKey(key))
+      continue;
     if (paramKeys.has(key))
       paramArgs[key] = value;
     else
       inputArgs[key] = value;
   }
+  if (coerceJson) {
+    paramArgs = coerceJsonArgs(paramArgs, method.paramsSchema);
+    inputArgs = coerceJsonArgs(inputArgs, method.inputSchema);
+  }
   let params;
   if (method.paramsSchema) {
     const result = method.paramsSchema.safeParse(paramArgs);
@@ -102,19 +148,17 @@ async function executeToolMethod(method, toolName, rawArgs, context, hooks, life
         data = transformed;
     }
     if (method.outputSchema) {
-      const parsed = method.outputSchema.safeParse(data);
-      if (!parsed.success) {
+      const checked = validateHandlerOutput(method.outputSchema, data);
+      if (!checked.ok) {
         return finish({
           ok: false,
           code: "INTERNAL_SERVER_ERROR",
-          details: {
-            message: `Handler output does not match the contract: ${formatZodError(parsed.error)}`
-          }
+          details: { message: checked.message }
         });
       }
-      data = parsed.data;
+      data = checked.data;
     }
-    const output = data === undefined || data === null ? { status: "ok" } : data;
+    const output = (data === undefined || data === null) && !method.outputSchema ? { status: "ok" } : data;
     return finish({ ok: true, data: output });
   } catch (err) {
     return finish(toolResultFromError(err));
@@ -124,50 +168,6 @@ async function executeToolMethod(method, toolName, rawArgs, context, hooks, life
 // src/tools/mount.ts
 import { z as z4 } from "zod";
 
-// src/tools/coerce.ts
-import { z as z2 } from "zod";
-function needsJsonCoercion(field) {
-  if (field instanceof z2.ZodArray || field instanceof z2.ZodObject)
-    return true;
-  if (field instanceof z2.ZodOptional || field instanceof z2.ZodNullable || field instanceof z2.ZodDefault) {
-    return needsJsonCoercion(field.unwrap());
-  }
-  return false;
-}
-var jsonCoerce = (val) => {
-  if (typeof val !== "string")
-    return val;
-  try {
-    return JSON.parse(val);
-  } catch {
-    return val;
-  }
-};
-function withJsonCoercion(schema) {
-  const shape = schema.shape;
-  const coerced = {};
-  for (const key of Object.keys(shape)) {
-    const field = shape[key];
-    if (!field || !needsJsonCoercion(field)) {
-      if (field)
-        coerced[key] = field;
-      continue;
-    }
-    let inner = field;
-    const wrappers = [];
-    while (inner instanceof z2.ZodOptional || inner instanceof z2.ZodNullable) {
-      wrappers.push(inner instanceof z2.ZodOptional ? "optional" : "nullable");
-      inner = inner.unwrap();
-    }
-    let result = z2.preprocess(jsonCoerce, inner);
-    for (const wrapper of wrappers.reverse()) {
-      result = wrapper === "optional" ? z2.optional(result) : z2.nullable(result);
-    }
-    coerced[key] = result;
-  }
-  return z2.object(coerced);
-}
-
 // src/tools/flatten.ts
 import { z as z3 } from "zod";
 function flattenDiscriminatedUnion(union) {
@@ -209,7 +209,7 @@ function flattenDiscriminatedUnion(union) {
   for (const [key, field] of Object.entries(fieldSchemas)) {
     const variants = fieldToVariants.get(key) ?? [];
     const hint = `Required if ${discriminator} = ${variants.join(" | ")}`;
-    shape[key] = field instanceof z3.ZodType ? field.describe(hint) : field;
+    shape[key] = field.describe(hint);
   }
   return z3.object(shape);
 }
@@ -262,7 +262,7 @@ function applyExtend(base, extra) {
   return z4.intersection(z4.object(extra), base);
 }
 function collectTools(service, transport, config = {}) {
-  const { extend, coerceJsonArgs = true, flattenUnionInput = false } = config;
+  const { extend, flattenUnionInput = false } = config;
   const tools = [];
   for (const [methodName, method] of Object.entries(service.methods)) {
     if (method.expose && !method.expose.includes(transport))
@@ -274,9 +274,6 @@ function collectTools(service, transport, config = {}) {
     if (flattenUnionInput && baseSchema instanceof z4.ZodDiscriminatedUnion) {
       baseSchema = flattenDiscriminatedUnion(baseSchema);
     }
-    if (coerceJsonArgs && baseSchema instanceof z4.ZodObject) {
-      baseSchema = withJsonCoercion(baseSchema);
-    }
     const shouldExtend = !!extend && (!extend.filter || extend.filter(service, method));
     const schema = shouldExtend && extend ? applyExtend(baseSchema, extend.schema) : baseSchema;
     tools.push({ method, name, schema, shouldExtend });
@@ -291,7 +288,7 @@ function createToolRunner(config) {
       extraContext = await config.extend.resolve(rawArgs);
     }
     const cleanArgs = extendKeys ? Object.fromEntries(Object.entries(rawArgs).filter(([key]) => !extendKeys.has(key))) : rawArgs;
-    return executeToolMethod(tool.method, tool.name, cleanArgs, { ...config.context, ...extraContext, source: config.source }, config.hooks, config.lifecycle);
+    return executeToolMethod(tool.method, tool.name, cleanArgs, { ...config.context, ...extraContext, source: config.source }, config.hooks, config.lifecycle, config.coerceJsonArgs ?? true);
   };
 }
 function formatToolError(result, toolName, errorHint) {
@@ -321,12 +318,12 @@ function mountAgent(services, config = {}) {
     context: config.context,
     hooks: config.hooks,
     lifecycle: config.lifecycle,
-    errorHint: config.errorHint
+    errorHint: config.errorHint,
+    coerceJsonArgs: config.coerceJsonArgs
   });
   for (const service of serviceList) {
     for (const mountable of collectTools(service, "AGENT", {
       extend: config.extend,
-      coerceJsonArgs: config.coerceJsonArgs,
       flattenUnionInput: config.flattenUnionInput
     })) {
       if (mountable.name in tools) {
@@ -364,11 +361,15 @@ function toJsonSchema(schema, io) {
 
 // src/tools/manifest.ts
 function buildToolManifest(tools) {
-  return tools.map((t) => ({
-    name: t.name,
-    description: t.method.desc,
-    inputSchema: toJsonSchema(t.schema, "input")
-  }));
+  return tools.map((t) => {
+    let inputSchema;
+    try {
+      inputSchema = toJsonSchema(t.schema, "input");
+    } catch {
+      inputSchema = {};
+    }
+    return { name: t.name, description: t.method.desc, inputSchema };
+  });
 }
 // src/tools/mcp.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -468,14 +469,14 @@ function mountMcp(mcpServer, services, config = {}) {
     context: config.context,
     hooks: config.hooks,
     lifecycle: config.lifecycle,
-    errorHint: config.errorHint
+    errorHint: config.errorHint,
+    coerceJsonArgs: config.coerceJsonArgs
   });
   const seen = new Set;
   const failures = [];
   for (const service of serviceList) {
     for (const mountable of collectTools(service, "MCP", {
       extend: config.extend,
-      coerceJsonArgs: config.coerceJsonArgs,
       flattenUnionInput: config.flattenUnionInput
     })) {
       const prepared = prepareMcpTool(mountable, policy, config.logger, failures, seen);
@@ -521,6 +522,9 @@ import {
 } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 var EVENT_TTL_MS = 10 * 60 * 1000;
 var SESSION_TTL_MS = 30 * 60 * 1000;
+var SWEEP_INTERVAL_MS = 60 * 1000;
+var MAX_EVENTS = 1e4;
+var MAX_SESSIONS = 1000;
 
 class InMemoryEventStore {
   events = new Map;
@@ -528,6 +532,11 @@ class InMemoryEventStore {
   async storeEvent(streamId, message) {
     const eventId = String(++this.counter);
     this.events.set(eventId, { streamId, message, timestamp: Date.now() });
+    if (this.events.size > MAX_EVENTS) {
+      const oldest = this.events.keys().next().value;
+      if (oldest !== undefined)
+        this.events.delete(oldest);
+    }
     return eventId;
   }
   async getStreamIdForEventId(eventId) {
@@ -562,18 +571,21 @@ function createMcpHandler(config) {
   }
   const eventStore = new InMemoryEventStore;
   const sessions = new Map;
+  const closeTransport = (transport) => {
+    transport.close().catch((err) => {
+      console.error("[stitchkit] MCP transport close failed:", err);
+    });
+  };
   setInterval(() => {
     eventStore.cleanup();
     const cutoff = Date.now() - SESSION_TTL_MS;
     for (const [id, session] of sessions) {
       if (session.lastSeen < cutoff) {
         sessions.delete(id);
-        session.transport.close().catch(() => {
-          return;
-        });
+        closeTransport(session.transport);
       }
     }
-  }, EVENT_TTL_MS).unref();
+  }, SWEEP_INTERVAL_MS).unref();
   return async (req) => {
     const auth = await config.auth(req);
     if (!auth) {
@@ -591,6 +603,22 @@ function createMcpHandler(config) {
       }
       return existing.transport.handleRequest(req);
     }
+    if (sessions.size >= MAX_SESSIONS) {
+      let oldestId;
+      let oldestSeen = Number.POSITIVE_INFINITY;
+      for (const [id, session] of sessions) {
+        if (session.lastSeen < oldestSeen) {
+          oldestSeen = session.lastSeen;
+          oldestId = id;
+        }
+      }
+      if (oldestId !== undefined) {
+        const evicted = sessions.get(oldestId);
+        sessions.delete(oldestId);
+        if (evicted)
+          closeTransport(evicted.transport);
+      }
+    }
     const newSessionId = randomUUID();
     const transport = new WebStandardStreamableHTTPServerTransport({
       sessionIdGenerator: () => newSessionId,
@@ -658,8 +686,10 @@ function implementRemote(contract, http, options) {
 import { lookup } from "node:dns/promises";
 import { readFile, stat } from "node:fs/promises";
 import { isIP } from "node:net";
-import { extname, resolve, sep } from "node:path";
+import { extname, resolve } from "node:path";
 import { z as z7 } from "zod";
+var NUMERIC_HOST = /^(0x[0-9a-f]+|[0-9.]+)$/i;
+var MAX_REDIRECTS = 5;
 var MAX_INLINE_BYTES = 20 * 1024 * 1024;
 var EXT_MIME = {
   ".png": "image/png",
@@ -702,6 +732,9 @@ async function assertPublicUrl(url) {
       throw new Error("refusing to fetch a private address");
     return;
   }
+  if (NUMERIC_HOST.test(host)) {
+    throw new Error("refusing to fetch a non-canonical numeric host");
+  }
   if (host === "localhost" || host.endsWith(".local") || host.endsWith(".internal")) {
     throw new Error("refusing to fetch an internal host");
   }
@@ -712,6 +745,22 @@ async function assertPublicUrl(url) {
     }
   }
 }
+async function fetchGuarded(start, allowPrivate) {
+  let url = start;
+  for (let hop = 0;hop <= MAX_REDIRECTS; hop++) {
+    if (!allowPrivate)
+      await assertPublicUrl(url);
+    const res = await fetch(url, { redirect: "manual" });
+    if (res.status < 300 || res.status >= 400)
+      return res;
+    const location = res.headers.get("location");
+    if (!location)
+      return res;
+    await res.body?.cancel();
+    url = new URL(location, url);
+  }
+  throw new Error("too many redirects");
+}
 async function readCapped(res, max) {
   const reader = res.body?.getReader();
   if (!reader)
@@ -739,9 +788,7 @@ async function fetchSource(pathOrUrl, options) {
   const extMime = EXT_MIME[extname(pathOrUrl).toLowerCase()];
   if (pathOrUrl.startsWith("http://") || pathOrUrl.startsWith("https://")) {
     const url = new URL(pathOrUrl);
-    if (!options.allowPrivateHosts)
-      await assertPublicUrl(url);
-    const res = await fetch(url);
+    const res = await fetchGuarded(url, options.allowPrivateHosts ?? false);
     if (!res.ok)
       throw new Error(`HTTP ${res.status}`);
     const headerMime = (res.headers.get("content-type") ?? "").split(";")[0]?.trim() ?? "";
@@ -759,7 +806,7 @@ async function fetchSource(pathOrUrl, options) {
   }
   const root = resolve(options.baseDir);
   const target = resolve(root, pathOrUrl);
-  if (target !== root && !target.startsWith(root + sep)) {
+  if (!isWithinDir(root, target)) {
     throw new Error("path escapes the allowed directory");
   }
   const info = await stat(target).catch(() => null);
@@ -821,7 +868,6 @@ function mountViewFile(server, options = {}) {
   });
 }
 export {
-  withJsonCoercion,
   validateMcpSchemas,
   resolveMedia,
   mountViewFile,
@@ -832,6 +878,7 @@ export {
   createStdioMcpServer,
   createMcpHandler,
   collectTools,
+  coerceJsonArgs,
   buildToolManifest,
   buildMcpServer
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stitchkit",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Contract-first backend framework — one defineContract() into an HTTP API, MCP tools, AI-agent tools and a typed client. Bun and Node.",
   "keywords": [
     "bun",

package/dist/index-ke4mx4ea.js

@@ -1,38 +0,0 @@
-// src/server/request.ts
-function generateTraceId() {
-  return Date.now().toString(36) + Math.random().toString(36).slice(2, 8);
-}
-function resolveTraceId(req) {
-  const header = req.headers.get("x-request-id") ?? req.headers.get("x-trace-id");
-  const trimmed = header?.trim();
-  if (trimmed && trimmed.length <= 128 && /^[\w.-]+$/.test(trimmed)) {
-    return trimmed;
-  }
-  return generateTraceId();
-}
-function extractIp(req) {
-  const forwarded = req.headers.get("x-forwarded-for");
-  if (forwarded)
-    return (forwarded.split(",")[0] ?? "").trim().replace("::ffff:", "");
-  const realIp = req.headers.get("x-real-ip");
-  if (realIp)
-    return realIp.trim().replace("::ffff:", "");
-  return "";
-}
-function getClientInfo(req) {
-  return {
-    ipAddress: extractIp(req) || undefined,
-    userAgent: req.headers.get("user-agent") ?? undefined
-  };
-}
-function parseQueryParams(url) {
-  const query = {};
-  for (const key of new Set(url.searchParams.keys())) {
-    const values = url.searchParams.getAll(key);
-    const [first] = values;
-    query[key] = values.length === 1 && first !== undefined ? first : values;
-  }
-  return query;
-}
-
-export { generateTraceId, resolveTraceId, extractIp, getClientInfo, parseQueryParams };