stitchkit 0.24.0 → 0.26.0

package/dist/{index-x8m8e7dc.js → index-q5w3cvvp.js}

@@ -7,7 +7,7 @@ import {
   isWithinDir,
   normalizeError,
   validateHandlerOutput
-} from "./index-4gawbm74.js";
+} from "./index-0d0rb85d.js";
 import {
   isRecord,
   isUnsafeKey,
@@ -76,13 +76,66 @@ function coerceJsonArgs(args, schema) {
 }
 
 // src/tools/flatten.ts
+import { z as z3 } from "zod";
+
+// src/tools/schema.ts
 import { z as z2 } from "zod";
+function objectShapeKeys(schema) {
+  return schema instanceof z2.ZodObject ? Object.keys(schema.shape) : [];
+}
+function keyPolicyOf(schema) {
+  return schema.def.catchall;
+}
+function rebuildObject(source, shape) {
+  return withKeyPolicy(z2.object(shape), keyPolicyOf(source));
+}
+function withKeyPolicy(object, policy) {
+  if (policy === undefined)
+    return object;
+  return object.catchall(representable(policy));
+}
+function representable(policy) {
+  if (policy instanceof z2.ZodNever || policy instanceof z2.ZodUnknown)
+    return policy;
+  if (!(policy instanceof z2.ZodType))
+    return z2.unknown();
+  try {
+    toJsonSchema(policy, "input");
+    return policy;
+  } catch {
+    return z2.unknown();
+  }
+}
+function mergeSchemas(paramsSchema, inputSchema) {
+  if (paramsSchema && !(paramsSchema instanceof z2.ZodObject)) {
+    throw new Error("Tool params schema must be a z.object()");
+  }
+  const paramsObject = paramsSchema instanceof z2.ZodObject ? paramsSchema : undefined;
+  if (!inputSchema) {
+    return paramsObject ?? z2.object({});
+  }
+  if (inputSchema instanceof z2.ZodObject) {
+    if (paramsObject) {
+      const conflicts = Object.keys(paramsObject.shape).filter((key) => (key in inputSchema.shape));
+      if (conflicts.length > 0) {
+        throw new Error(`Schema merge conflict: ${conflicts.join(", ")} appear in both params and input`);
+      }
+    }
+    return rebuildObject(inputSchema, {
+      ...paramsObject?.shape ?? {},
+      ...inputSchema.shape
+    });
+  }
+  return paramsObject ? z2.intersection(paramsObject, inputSchema) : inputSchema;
+}
+
+// src/tools/flatten.ts
 function flattenDiscriminatedUnion(union) {
   const discriminator = union.def.discriminator;
   const allDiscValues = [];
   const perKey = new Map;
   for (const opt of union.def.options) {
-    if (!(opt instanceof z2.ZodObject)) {
+    if (!(opt instanceof z3.ZodObject)) {
       throw new Error(`flattenDiscriminatedUnion: variant for discriminator '${discriminator}' is not a ZodObject`);
     }
     const discValues = stringLiteralOrEnumValues(opt.shape[discriminator]);
@@ -95,7 +148,7 @@ function flattenDiscriminatedUnion(union) {
       if (key === discriminator)
         continue;
       const entry = perKey.get(key) ?? { schemas: [], variants: [] };
-      entry.schemas.push(field instanceof z2.ZodOptional ? field.unwrap() : field);
+      entry.schemas.push(unwrapField(field));
       entry.variants.push(label);
       perKey.set(key, entry);
     }
@@ -106,23 +159,44 @@ function flattenDiscriminatedUnion(union) {
     throw new Error("flattenDiscriminatedUnion: union has no options");
   }
   const shape = {
-    [discriminator]: z2.enum([firstLiteral, ...restLiterals])
+    [discriminator]: z3.enum([firstLiteral, ...restLiterals])
   };
   for (const [key, entry] of perKey) {
     const advertised = mergeCollidingFields(entry.schemas);
     const hint = `Required if ${discriminator} = ${[...new Set(entry.variants)].join(" | ")}`;
-    shape[key] = z2.optional(advertised).describe(hint);
+    shape[key] = z3.optional(advertised).describe(hint);
+  }
+  return withKeyPolicy(z3.object(shape), mergeVariantKeyPolicies(union.def.options));
+}
+function mergeVariantKeyPolicies(options) {
+  let strict = 0;
+  let counted = 0;
+  for (const option of options) {
+    const policy = option instanceof z3.ZodObject ? keyPolicyOf(option) : undefined;
+    if (policy !== undefined && !(policy instanceof z3.ZodNever))
+      return z3.unknown();
+    counted++;
+    if (policy instanceof z3.ZodNever)
+      strict++;
+  }
+  if (counted === 0 || strict === 0)
+    return;
+  return strict === counted ? z3.never() : z3.unknown();
+}
+function unwrapField(field) {
+  if (field instanceof z3.ZodOptional || field instanceof z3.ZodDefault) {
+    return unwrapField(field.unwrap());
   }
-  return z2.object(shape);
+  return field;
 }
 function preserveDescription(from, to) {
   return from.description === undefined ? to : to.describe(from.description);
 }
 function stringLiteralOrEnumValues(field) {
   let raw = null;
-  if (field instanceof z2.ZodLiteral)
+  if (field instanceof z3.ZodLiteral)
     raw = field.def.values;
-  else if (field instanceof z2.ZodEnum)
+  else if (field instanceof z3.ZodEnum)
     raw = field.options;
   if (raw === null)
     return null;
@@ -134,7 +208,7 @@ function isFlattenableDU(union) {
   if (union.def.options.length === 0)
     return false;
   for (const opt of union.def.options) {
-    if (!(opt instanceof z2.ZodObject))
+    if (!(opt instanceof z3.ZodObject))
       return false;
     if (stringLiteralOrEnumValues(opt.shape[disc]) === null)
       return false;
@@ -156,31 +230,31 @@ function stripAnnotations(node) {
   }
 }
 function hasChecks(schema) {
-  if (!(schema instanceof z2.ZodType))
+  if (!(schema instanceof z3.ZodType))
     return false;
   const def = schema.def;
   if (isRecord(def) && Array.isArray(def.checks) && def.checks.length > 0)
     return true;
-  if (schema instanceof z2.ZodOptional || schema instanceof z2.ZodNullable || schema instanceof z2.ZodDefault) {
+  if (schema instanceof z3.ZodOptional || schema instanceof z3.ZodNullable || schema instanceof z3.ZodDefault) {
     return hasChecks(schema.unwrap());
   }
-  if (schema instanceof z2.ZodPipe)
+  if (schema instanceof z3.ZodPipe)
     return hasChecks(schema.def.in) || hasChecks(schema.def.out);
-  if (schema instanceof z2.ZodObject)
+  if (schema instanceof z3.ZodObject)
     return Object.values(schema.shape).some(hasChecks);
-  if (schema instanceof z2.ZodArray)
+  if (schema instanceof z3.ZodArray)
     return hasChecks(schema.element);
-  if (schema instanceof z2.ZodUnion)
+  if (schema instanceof z3.ZodUnion)
     return schema.def.options.some(hasChecks);
-  if (schema instanceof z2.ZodRecord)
+  if (schema instanceof z3.ZodRecord)
     return hasChecks(schema.valueType);
-  if (schema instanceof z2.ZodIntersection) {
+  if (schema instanceof z3.ZodIntersection) {
     return hasChecks(schema.def.left) || hasChecks(schema.def.right);
   }
   return false;
 }
 function normalizedJson(schema) {
-  if (!(schema instanceof z2.ZodType))
+  if (!(schema instanceof z3.ZodType))
     return "{}";
   const json = toJsonSchema(schema, "input", "any");
   stripAnnotations(json);
@@ -197,8 +271,8 @@ function mergeCollidingFields(schemas) {
   const only = values[0];
   if (values.length <= 1) {
     if (only === undefined)
-      return z2.unknown();
-    return schemas.length > 1 && hasChecks(only) ? z2.unknown() : only;
+      return z3.unknown();
+    return schemas.length > 1 && hasChecks(only) ? z3.unknown() : only;
   }
   const merged = [];
   let allEnum = true;
@@ -214,47 +288,47 @@ function mergeCollidingFields(schemas) {
     const uniq = [...new Set(merged)];
     const [first, ...rest] = uniq;
     if (first !== undefined)
-      return z2.enum([first, ...rest]);
+      return z3.enum([first, ...rest]);
   }
-  return z2.unknown();
+  return z3.unknown();
 }
 function flattenUnionsDeep(schema) {
-  if (!(schema instanceof z2.ZodType))
-    return z2.unknown();
-  if (schema instanceof z2.ZodDiscriminatedUnion) {
+  if (!(schema instanceof z3.ZodType))
+    return z3.unknown();
+  if (schema instanceof z3.ZodDiscriminatedUnion) {
     if (!isFlattenableDU(schema))
       return schema;
     return preserveDescription(schema, flattenUnionsDeep(flattenDiscriminatedUnion(schema)));
   }
-  if (schema instanceof z2.ZodObject) {
+  if (schema instanceof z3.ZodObject) {
     const shape = {};
     for (const [key, field] of Object.entries(schema.shape)) {
       shape[key] = flattenUnionsDeep(field);
     }
-    return preserveDescription(schema, z2.object(shape));
+    return preserveDescription(schema, rebuildObject(schema, shape));
   }
-  if (schema instanceof z2.ZodArray) {
-    return preserveDescription(schema, z2.array(flattenUnionsDeep(schema.element)));
+  if (schema instanceof z3.ZodArray) {
+    return preserveDescription(schema, z3.array(flattenUnionsDeep(schema.element)));
   }
-  if (schema instanceof z2.ZodUnion) {
+  if (schema instanceof z3.ZodUnion) {
     const opts = schema.def.options.map((option) => flattenUnionsDeep(option));
     const [a, b, ...rest] = opts;
-    return a && b ? preserveDescription(schema, z2.union([a, b, ...rest])) : schema;
+    return a && b ? preserveDescription(schema, z3.union([a, b, ...rest])) : schema;
   }
-  if (schema instanceof z2.ZodRecord) {
-    return preserveDescription(schema, z2.record(schema.keyType, flattenUnionsDeep(schema.valueType)));
+  if (schema instanceof z3.ZodRecord) {
+    return preserveDescription(schema, z3.record(schema.keyType, flattenUnionsDeep(schema.valueType)));
   }
-  if (schema instanceof z2.ZodOptional) {
-    return preserveDescription(schema, z2.optional(flattenUnionsDeep(schema.unwrap())));
+  if (schema instanceof z3.ZodOptional) {
+    return preserveDescription(schema, z3.optional(flattenUnionsDeep(schema.unwrap())));
   }
-  if (schema instanceof z2.ZodNullable) {
-    return preserveDescription(schema, z2.nullable(flattenUnionsDeep(schema.unwrap())));
+  if (schema instanceof z3.ZodNullable) {
+    return preserveDescription(schema, z3.nullable(flattenUnionsDeep(schema.unwrap())));
   }
-  if (schema instanceof z2.ZodDefault) {
+  if (schema instanceof z3.ZodDefault) {
     return preserveDescription(schema, flattenUnionsDeep(schema.unwrap()).default(schema.def.defaultValue));
   }
-  if (schema instanceof z2.ZodIntersection) {
-    return preserveDescription(schema, z2.intersection(flattenUnionsDeep(schema.def.left), flattenUnionsDeep(schema.def.right)));
+  if (schema instanceof z3.ZodIntersection) {
+    return preserveDescription(schema, z3.intersection(flattenUnionsDeep(schema.def.left), flattenUnionsDeep(schema.def.right)));
   }
   return schema;
 }
@@ -262,31 +336,6 @@ function flattenUnionsDeep(schema) {
 // src/tools/mount.ts
 import { z as z4 } from "zod";
 
-// src/tools/schema.ts
-import { z as z3 } from "zod";
-function objectShapeKeys(schema) {
-  return schema instanceof z3.ZodObject ? Object.keys(schema.shape) : [];
-}
-function mergeSchemas(paramsSchema, inputSchema) {
-  if (paramsSchema && !(paramsSchema instanceof z3.ZodObject)) {
-    throw new Error("Tool params schema must be a z.object()");
-  }
-  const paramsObject = paramsSchema instanceof z3.ZodObject ? paramsSchema : undefined;
-  if (!inputSchema) {
-    return paramsObject ?? z3.object({});
-  }
-  if (inputSchema instanceof z3.ZodObject) {
-    if (paramsObject) {
-      const conflicts = Object.keys(paramsObject.shape).filter((key) => (key in inputSchema.shape));
-      if (conflicts.length > 0) {
-        throw new Error(`Schema merge conflict: ${conflicts.join(", ")} appear in both params and input`);
-      }
-    }
-    return z3.object({ ...paramsObject?.shape ?? {}, ...inputSchema.shape });
-  }
-  return paramsObject ? z3.intersection(paramsObject, inputSchema) : inputSchema;
-}
-
 // src/tools/execute.ts
 function toolResultFromError(err) {
   const appErr = normalizeError(err);
@@ -297,7 +346,7 @@ function toolResultFromError(err) {
     ...appErr.hint && { hint: appErr.hint }
   };
 }
-async function executeToolMethod(method, toolName, rawArgs, context, hooks, lifecycle, coerceJson = false) {
+async function executeToolMethod(method, toolName, rawArgs, context, hooks, lifecycle, coerceJson = false, onOutputStrip) {
   const startedAt = Date.now();
   const finish = async (result) => {
     await hooks?.afterToolCall?.(toolName, rawArgs, result, Date.now() - startedAt, context, method);
@@ -361,7 +410,7 @@ async function executeToolMethod(method, toolName, rawArgs, context, hooks, life
         data = transformed;
     }
     if (method.outputSchema) {
-      const checked = validateHandlerOutput(method.outputSchema, data);
+      const checked = validateHandlerOutput(method.outputSchema, data, onOutputStrip);
       if (!checked.ok) {
         return finish({
           ok: false,
@@ -388,6 +437,13 @@ var SINGULAR_EXCEPTIONS = new Set([
   "progress",
   "news"
 ]);
+var TOOL_NAME_RE = /^[a-zA-Z0-9_-]{1,64}$/;
+function normalizeService(value) {
+  return value.replace(/[^a-zA-Z0-9_]/g, "_");
+}
+function normalizeMethod(value) {
+  return value.replace(/[^a-zA-Z0-9_-]/g, "_");
+}
 function singularize(name) {
   if (SINGULAR_EXCEPTIONS.has(name))
     return name;
@@ -397,22 +453,44 @@ function singularize(name) {
     return name.slice(0, -1);
   return name;
 }
+function singularizeTail(name) {
+  const cut = name.lastIndexOf("_");
+  if (cut === -1)
+    return singularize(name);
+  return `${name.slice(0, cut + 1)}${singularize(name.slice(cut + 1))}`;
+}
+function hasUsableChars(value) {
+  return /[a-zA-Z0-9]/.test(value);
+}
+function assertToolName(name, serviceName, key) {
+  const where = `service "${serviceName}", method "${key}"`;
+  if (!TOOL_NAME_RE.test(name)) {
+    const why = name.length > 64 ? `is ${name.length} characters (max 64) — set an explicit \`toolName\`` : "must match [a-zA-Z0-9_-]";
+    throw new Error(`Tool name "${name}" (${where}) ${why}`);
+  }
+}
 function toToolName(serviceName, methodName) {
-  const normalized = serviceName.replace(/-/g, "_");
-  const singular = singularize(normalized);
-  if (methodName === "list")
+  const normalized = normalizeService(serviceName);
+  const singular = singularizeTail(normalized);
+  const method = normalizeMethod(methodName);
+  if (method === "list")
     return `list_${normalized}`;
-  if (methodName === "get")
+  if (method === "get")
     return `get_${singular}`;
-  if (methodName === "create")
+  if (method === "create")
     return `create_${singular}`;
-  if (methodName === "update")
+  if (method === "update")
     return `update_${singular}`;
-  if (methodName === "delete")
+  if (method === "delete")
     return `delete_${singular}`;
-  const snake = methodName.replace(/([A-Z])/g, "_$1").toLowerCase();
+  const snake = method.replace(/([A-Z])/g, "_$1").toLowerCase();
   return `${snake}_${singular}`.replace(/^_/, "");
 }
+function assertUniqueToolName(name, taken, surface) {
+  if (taken) {
+    throw new Error(`Duplicate ${surface} "${name}" across mounted services`);
+  }
+}
 
 // src/tools/mount.ts
 function applyExtend(base, extra) {
@@ -421,12 +499,12 @@ function applyExtend(base, extra) {
     if (conflicts.length > 0) {
       throw new Error(`Tool extend conflict: ${conflicts.join(", ")} already declared by the contract`);
     }
-    return z4.object({ ...extra, ...base.shape });
+    return rebuildObject(base, { ...extra, ...base.shape });
   }
   return z4.intersection(z4.object(extra), base);
 }
 function collectTools(service, transport, config = {}) {
-  const { extend, flattenUnionInput = false } = config;
+  const { extend, flattenUnionInput = false, assertNames = true } = config;
   const tools = [];
   for (const [methodName, method] of Object.entries(service.methods)) {
     if (transport === "CLI") {
@@ -438,6 +516,12 @@ function collectTools(service, transport, config = {}) {
     if (method.multipart)
       continue;
     const name = method.toolName ?? toToolName(service.name, methodName);
+    if (assertNames && transport !== "CLI") {
+      if (!method.toolName && !hasUsableChars(service.name)) {
+        throw new Error(`Service prefix "${service.name}" (method "${methodName}") has no characters usable in a tool name — set an explicit \`toolName\` or rename the prefix`);
+      }
+      assertToolName(name, service.name, methodName);
+    }
     const baseSchema = flattenUnionInput ? mergeSchemas(method.paramsSchema ? flattenUnionsDeep(method.paramsSchema) : undefined, method.inputSchema ? flattenUnionsDeep(method.inputSchema) : undefined) : mergeSchemas(method.paramsSchema, method.inputSchema);
     const shouldExtend = !!extend && (!extend.filter || extend.filter(service, method));
     const schema = shouldExtend && extend ? applyExtend(baseSchema, extend.schema) : baseSchema;
@@ -453,7 +537,7 @@ function createToolRunner(config) {
       extraContext = await config.extend.resolve(rawArgs);
     }
     const cleanArgs = tool.shouldExtend && extendKeys ? Object.fromEntries(Object.entries(rawArgs).filter(([key]) => !extendKeys.has(key))) : rawArgs;
-    return executeToolMethod(tool.method, tool.name, cleanArgs, { ...config.context, ...extraContext, source: config.source }, config.hooks, config.lifecycle, config.coerceJsonArgs ?? true);
+    return executeToolMethod(tool.method, tool.name, cleanArgs, { ...config.context, ...extraContext, source: config.source }, config.hooks, config.lifecycle, config.coerceJsonArgs ?? true, config.onOutputStrip ? (paths) => config.onOutputStrip?.(tool.name, paths) : undefined);
   };
 }
 function formatToolError(result, toolName, errorHint) {
@@ -796,7 +880,6 @@ async function pollUntilDone(params) {
 }
 
 // src/tools/cli.ts
-import { mkdir, writeFile } from "node:fs/promises";
 import { basename, resolve } from "node:path";
 import process from "node:process";
 
@@ -913,6 +996,17 @@ async function readCapped(res, max) {
   return Buffer.concat(chunks);
 }
 
+// src/internal/write-download.ts
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+async function writeDownload(root, target, data) {
+  if (!isWithinDir(root, target)) {
+    throw new Error("download name escapes the output dir");
+  }
+  await mkdir(dirname(target), { recursive: true });
+  await writeFile(target, data);
+}
+
 // src/tools/cli.ts
 var GLOBAL_OPTIONS = [
   ["--json", "Emit raw JSON on stdout (for piping / scripts)"],
@@ -1036,7 +1130,6 @@ function renderCommandHelp(name, command, tool) {
 var DEFAULT_DOWNLOAD_MAX_BYTES = 100 * 1024 * 1024;
 async function downloadResults(files, dir, stderr, quiet, allowPrivate, maxBytes) {
   const root = resolve(dir);
-  await mkdir(root, { recursive: true });
   for (const file of files) {
     try {
       const res = await fetchGuarded(new URL(file.url), allowPrivate);
@@ -1046,9 +1139,7 @@ async function downloadResults(files, dir, stderr, quiet, allowPrivate, maxBytes
       if (!buffer)
         throw new Error(`file exceeds the ${maxBytes}-byte cap`);
       const target = resolve(root, basename(file.name));
-      if (!isWithinDir(root, target))
-        throw new Error("download name escapes the output dir");
-      await writeFile(target, buffer);
+      await writeDownload(root, target, buffer);
       if (!quiet)
         stderr(`saved ${target} (${(buffer.length / 1024).toFixed(0)}KB)
 `);
@@ -1070,9 +1161,7 @@ async function createCli(config) {
   const tools = new Map;
   for (const service of services) {
     for (const mountable of collectTools(service, "CLI")) {
-      if (tools.has(mountable.name)) {
-        throw new Error(`Duplicate CLI command "${mountable.name}" across mounted services`);
-      }
+      assertUniqueToolName(mountable.name, tools.has(mountable.name), "CLI command");
       tools.set(mountable.name, mountable);
     }
   }
@@ -1167,4 +1256,4 @@ function safeInputSchema(tool) {
   }
 }
 
-export { coerceJsonArgs, toolResultFromError, flattenDiscriminatedUnion, flattenUnionsDeep, collectTools, createToolRunner, formatToolError, fetchGuarded, readCapped, parseCliArgs, DEFAULT_EXIT_CODES, emitResult, pollUntil, pollUntilDone, createCli };
+export { coerceJsonArgs, toolResultFromError, flattenDiscriminatedUnion, flattenUnionsDeep, assertToolName, assertUniqueToolName, collectTools, createToolRunner, formatToolError, fetchGuarded, readCapped, writeDownload, parseCliArgs, DEFAULT_EXIT_CODES, emitResult, pollUntil, pollUntilDone, createCli };

package/dist/index.js

@@ -16,7 +16,7 @@ import {
   paginatedSchema,
   rateLimited,
   unauthorized
-} from "./index-x62gnfsk.js";
+} from "./index-h4y2wg3n.js";
 import {
   isRecord,
   mapObject,
@@ -28,6 +28,25 @@ function inputIsQuery(method) {
   return method === "GET" || method === "DELETE";
 }
 
+// src/browser/client-multipart.ts
+function isFileDescriptor(value) {
+  return typeof value === "object" && value !== null && !(value instanceof Blob) && "uri" in value && typeof value.uri === "string" && "name" in value && typeof value.name === "string" && "type" in value && typeof value.type === "string";
+}
+function isMultipartFile(value) {
+  return value instanceof Blob || isFileDescriptor(value);
+}
+function appendMultipartFile(form, field, file) {
+  const sink = form;
+  sink.append(field, file);
+}
+function appendFormFields(formData, values, skipKeys) {
+  for (const [key, value] of Object.entries(values)) {
+    if (skipKeys.has(key) || value === undefined || value === null)
+      continue;
+    formData.append(key, typeof value === "string" ? value : JSON.stringify(value));
+  }
+}
+
 // src/browser/http.ts
 import ky, { isHTTPError } from "ky";
 
@@ -407,23 +426,6 @@ function createFetchMethod(endpoint, prefix, config, contractConfig) {
     return endpoint.output ? endpoint.output.parse(json) : json;
   };
 }
-function isFileDescriptor(value) {
-  return typeof value === "object" && value !== null && !(value instanceof Blob) && "uri" in value && typeof value.uri === "string" && "name" in value && typeof value.name === "string" && "type" in value && typeof value.type === "string";
-}
-function isMultipartFile(value) {
-  return value instanceof Blob || isFileDescriptor(value);
-}
-function appendMultipartFile(form, field, file) {
-  const sink = form;
-  sink.append(field, file);
-}
-function appendFormFields(formData, values, skipKeys) {
-  for (const [key, value] of Object.entries(values)) {
-    if (skipKeys.has(key) || value === undefined || value === null)
-      continue;
-    formData.append(key, typeof value === "string" ? value : JSON.stringify(value));
-  }
-}
 async function throwForErrorResponse(res, config, fallbackBody) {
   const body = await res.json().catch(() => fallbackBody);
   config.onError?.(res.status, body);

package/dist/internal/errors.d.ts

@@ -29,8 +29,13 @@ export declare function normalizeError(err: unknown): AppError;
  * Validate a handler's return value against the contract `output` schema. A
  * mismatch is a **server** fault (the handler broke its own contract) — shared
  * by the HTTP and tool transports so both report it identically.
+ *
+ * `onStripped` is the migration diagnostic: a handler returning more than its
+ * contract declares has the extra fields **deleted**, correctly but invisibly —
+ * types cannot catch it (structural typing does not reject excess properties) and
+ * nothing logs it. Pass a reporter to find out; omit it and nothing is computed.
  */
-export declare function validateHandlerOutput(schema: ZodType, data: unknown): {
+export declare function validateHandlerOutput(schema: ZodType, data: unknown, onStripped?: (paths: string[]) => void): {
     ok: true;
     data: unknown;
 } | {

package/dist/internal/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/internal/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAOvC,wBAAgB,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,GAAG,MAAM,CAMxD;AAED,qFAAqF;AACrF,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,GAAG,eAAe,EAAE,CAM9D;AAKD;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAI1D;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,CAgBrD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,OAAO,GACZ;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAO9D"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/internal/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAQvC,wBAAgB,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,GAAG,MAAM,CAMxD;AAED,qFAAqF;AACrF,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,GAAG,eAAe,EAAE,CAM9D;AAKD;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAI1D;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,CAgBrD;AA4BD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,OAAO,EACb,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,GACrC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAe9D"}

package/dist/internal/write-download.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Write a downloaded body to disk, with the containment check both download
+ * paths need.
+ *
+ * Shared by the CLI's `--output-dir` and the `mountDownload` native tool. It
+ * deliberately takes an **already-resolved** target rather than building one:
+ * the two callers derive the filename differently (an untrusted `file.name` vs a
+ * name derived from the URL) and, more importantly, report the path back to the
+ * user — so composing it here would silently change one of those outputs from
+ * relative to absolute.
+ *
+ * The containment re-check is cheap and belongs on this side: both callers reduce
+ * the name to a basename first, but that is an invariant of *their* code, and
+ * this is where the write actually happens.
+ */
+export declare function writeDownload(root: string, target: string, data: Uint8Array): Promise<void>;
+//# sourceMappingURL=write-download.d.ts.map

package/dist/internal/write-download.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-download.d.ts","sourceRoot":"","sources":["../../src/internal/write-download.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,IAAI,CAAC,CAMf"}

package/dist/node.js

@@ -3,7 +3,7 @@ import {
   createImplement,
   createSocketIOServer,
   implement
-} from "./index-g8kyab85.js";
+} from "./index-bkccbx64.js";
 import"./index-tje0q6gp.js";
 import {
   AppError,
@@ -14,7 +14,7 @@ import {
   notFound,
   rateLimited,
   unauthorized
-} from "./index-4gawbm74.js";
+} from "./index-0d0rb85d.js";
 import"./index-dzx781tm.js";
 import"./index-khwedj16.js";
 import"./index-c7nyw0yt.js";

package/dist/server/create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../src/server/create.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAEV,eAAe,EACf,aAAa,EAGd,MAAM,SAAS,CAAC;AAEjB,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CA8NxF;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,uBAsBnD"}
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../src/server/create.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAEV,eAAe,EACf,aAAa,EAGd,MAAM,SAAS,CAAC;AAEjB,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CA0OxF;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,uBAsBnD"}

package/dist/server/error-hook.d.ts

@@ -22,11 +22,16 @@
  *     CONFLICT: 'conflict', RATE_LIMITED: 'rate_limited',
  *     INTERNAL_SERVER_ERROR: 'internal',
  *   } satisfies Record<StitchErrorCode, string>,
- *   render: (info) => ({ ok: false, error: { code: info.code, message: info.message } }),
+ *   render: (info, ctx) => ({
+ *     ok: false,
+ *     error: { code: info.code, message: info.message },
+ *     traceId: ctx.traceId,
+ *   }),
  * });
  * createServer({ services, hooks: { onError } });
  * ```
  */
+import type { RuntimeContext } from '../contract';
 import { type StitchErrorCode } from '../contract';
 import type { LifecycleHooks } from './types';
 /** The normalised error handed to `render` — code already remapped. */
@@ -51,9 +56,15 @@ export interface ErrorHookConfig<TWireCode extends string = string> {
      */
     codeMap?: Record<StitchErrorCode, TWireCode>;
     /** Build the response body from the resolved error. */
-    render: (info: ResolvedError) => unknown;
+    /**
+     * Build the response body from the resolved error. `ctx` is the request's
+     * `RuntimeContext` — read `ctx.traceId` / `ctx.spanId` to put a correlation id
+     * in the envelope, which is the ordinary reason to have one. Declaring the
+     * parameter is optional: a one-argument `render` stays assignable.
+     */
+    render: (info: ResolvedError, ctx: RuntimeContext) => unknown;
     /** Observe the raw thrown value before rendering — logging / metrics. */
-    onError?: (error: unknown, info: ResolvedError) => void;
+    onError?: (error: unknown, info: ResolvedError, ctx: RuntimeContext) => void;
 }
 /** Build an `onError` hook from a code map + envelope renderer. */
 export declare function createErrorHook<TWireCode extends string = string>(config: ErrorHookConfig<TWireCode>): NonNullable<LifecycleHooks['onError']>;

package/dist/server/error-hook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error-hook.d.ts","sourceRoot":"","sources":["../../src/server/error-hook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAEtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;IACb,mBAAmB;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,oCAAoC;AACpC,MAAM,WAAW,eAAe,CAAC,SAAS,SAAS,MAAM,GAAG,MAAM;IAChE;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IAC7C,uDAAuD;IACvD,MAAM,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,OAAO,CAAC;IACzC,yEAAyE;IACzE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,KAAK,IAAI,CAAC;CACzD;AAED,mEAAmE;AACnE,wBAAgB,eAAe,CAAC,SAAS,SAAS,MAAM,GAAG,MAAM,EAC/D,MAAM,EAAE,eAAe,CAAC,SAAS,CAAC,GACjC,WAAW,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAyBxC"}
+{"version":3,"file":"error-hook.d.ts","sourceRoot":"","sources":["../../src/server/error-hook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAEtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;IACb,mBAAmB;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,oCAAoC;AACpC,MAAM,WAAW,eAAe,CAAC,SAAS,SAAS,MAAM,GAAG,MAAM;IAChE;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IAC7C,uDAAuD;IACvD;;;;;OAKG;IACH,MAAM,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC;IAC9D,yEAAyE;IACzE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC;CAC9E;AAED,mEAAmE;AACnE,wBAAgB,eAAe,CAAC,SAAS,SAAS,MAAM,GAAG,MAAM,EAC/D,MAAM,EAAE,eAAe,CAAC,SAAS,CAAC,GACjC,WAAW,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAyBxC"}

package/dist/server/implement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"implement.d.ts","sourceRoot":"","sources":["../../src/server/implement.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,KAAK,EAAE,QAAQ,EAAa,UAAU,EAAE,MAAM,SAAS,CAAC;AAE/D;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACrC,IAAI,SAAS,cAAc,GAAG,cAAc,EAC5C,QAAQ,EAAE,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,UAAU,CA+C3E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,SAAS,cAAc,MACjD,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EAC3C,UAAU,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,EAChC,UAAU,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,KAC1B,UAAU,CACd"}
+{"version":3,"file":"implement.d.ts","sourceRoot":"","sources":["../../src/server/implement.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG5E,OAAO,KAAK,EAAE,QAAQ,EAAa,UAAU,EAAE,MAAM,SAAS,CAAC;AAE/D;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACrC,IAAI,SAAS,cAAc,GAAG,cAAc,EAC5C,QAAQ,EAAE,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,UAAU,CAgD3E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,SAAS,cAAc,MACjD,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EAC3C,UAAU,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,EAChC,UAAU,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,KAC1B,UAAU,CACd"}