stitchkit 0.3.0 → 0.4.0

package/dist/index-1cf8jkhf.js

@@ -0,0 +1,219 @@
+import {
+  forbidden,
+  unauthorized
+} from "./index-afzt3nmx.js";
+import {
+  isUnsafeKey,
+  safeJsonParse
+} from "./index-kzfs85xp.js";
+import {
+  isRecord
+} from "./index-809wc1tt.js";
+
+// src/server/middleware/cookies.ts
+function parseCookies(header) {
+  if (!header)
+    return {};
+  const cookies = {};
+  for (const pair of header.split(";")) {
+    const eq = pair.indexOf("=");
+    if (eq === -1)
+      continue;
+    const key = pair.slice(0, eq).trim();
+    if (!key || isUnsafeKey(key))
+      continue;
+    const raw = pair.slice(eq + 1).trim();
+    try {
+      cookies[key] = decodeURIComponent(raw);
+    } catch {
+      cookies[key] = raw;
+    }
+  }
+  return cookies;
+}
+function serializeCookie(name, value, opts = {}) {
+  let cookie = `${name}=${encodeURIComponent(value)}`;
+  if (opts.maxAge !== undefined)
+    cookie += `; Max-Age=${opts.maxAge}`;
+  if (opts.path)
+    cookie += `; Path=${opts.path}`;
+  if (opts.domain)
+    cookie += `; Domain=${opts.domain}`;
+  if (opts.secure)
+    cookie += "; Secure";
+  if (opts.httpOnly)
+    cookie += "; HttpOnly";
+  if (opts.sameSite)
+    cookie += `; SameSite=${opts.sameSite}`;
+  return cookie;
+}
+function defineCookie(config) {
+  const { name, ...options } = config;
+  return {
+    get(req) {
+      return parseCookies(req.headers.get("cookie"))[name];
+    },
+    set(value) {
+      return serializeCookie(name, value, options);
+    },
+    clear() {
+      return serializeCookie(name, "", { ...options, maxAge: 0 });
+    }
+  };
+}
+
+// src/server/middleware/auth.ts
+var MAX_TOKEN_BYTES = 8192;
+function decodeBase64Url(segment) {
+  if (!/^[A-Za-z0-9_-]*$/.test(segment) || segment.length % 4 === 1) {
+    throw new Error("invalid base64url segment");
+  }
+  const b64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = b64.padEnd(Math.ceil(b64.length / 4) * 4, "=");
+  return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
+}
+async function verifyJwt(token, secret, options = {}) {
+  if (!secret)
+    throw new Error("verifyJwt: a non-empty secret is required");
+  if (token.length > MAX_TOKEN_BYTES)
+    throw unauthorized("Token too large");
+  const [headerB64, payloadB64, signatureB64] = token.split(".");
+  if (!headerB64 || !payloadB64 || !signatureB64)
+    throw unauthorized("Invalid token format");
+  let header;
+  let payloadRaw;
+  let signature;
+  try {
+    const decoder = new TextDecoder;
+    header = JSON.parse(decoder.decode(decodeBase64Url(headerB64)));
+    payloadRaw = safeJsonParse(decoder.decode(decodeBase64Url(payloadB64)));
+    signature = decodeBase64Url(signatureB64);
+  } catch {
+    throw unauthorized("Malformed token");
+  }
+  if (!isRecord(payloadRaw))
+    throw unauthorized("Malformed token");
+  const payload = payloadRaw;
+  if (header.alg !== "HS256")
+    throw unauthorized("Unsupported token algorithm");
+  const encoder = new TextEncoder;
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["verify"]);
+  const data = encoder.encode(`${headerB64}.${payloadB64}`);
+  const valid = await crypto.subtle.verify("HMAC", key, signature, data);
+  if (!valid)
+    throw unauthorized("Invalid token signature");
+  const leeway = options.leewaySeconds ?? 60;
+  const now = Date.now() / 1000;
+  if ("exp" in payload) {
+    if (typeof payload.exp !== "number")
+      throw unauthorized("Malformed token");
+    if (payload.exp < now - leeway)
+      throw unauthorized("Token expired");
+  }
+  if ("nbf" in payload) {
+    if (typeof payload.nbf !== "number")
+      throw unauthorized("Malformed token");
+    if (payload.nbf > now + leeway)
+      throw unauthorized("Token not yet valid");
+  }
+  if (options.issuer !== undefined && payload.iss !== options.issuer) {
+    throw unauthorized("Token issuer mismatch");
+  }
+  if (options.audience !== undefined) {
+    const aud = payload.aud;
+    const ok = Array.isArray(aud) ? aud.includes(options.audience) : aud === options.audience;
+    if (!ok)
+      throw unauthorized("Token audience mismatch");
+  }
+  return payload;
+}
+function encodeBase64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes)
+    binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function signJwt(payload, secret, options = {}) {
+  if (!secret)
+    throw new Error("signJwt: a non-empty secret is required");
+  const now = Math.floor(Date.now() / 1000);
+  const claims = {
+    ...payload,
+    iat: now,
+    ...options.expiresInSec !== undefined && { exp: now + options.expiresInSec },
+    ...options.issuer !== undefined && { iss: options.issuer },
+    ...options.audience !== undefined && { aud: options.audience },
+    ...options.subject !== undefined && { sub: options.subject }
+  };
+  const encoder = new TextEncoder;
+  const headerB64 = encodeBase64Url(encoder.encode(JSON.stringify({ alg: "HS256", typ: "JWT" })));
+  const payloadB64 = encodeBase64Url(encoder.encode(JSON.stringify(claims)));
+  const signingInput = `${headerB64}.${payloadB64}`;
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(signingInput));
+  const signatureB64 = encodeBase64Url(new Uint8Array(signature));
+  return `${signingInput}.${signatureB64}`;
+}
+function extractToken(req, cookieName) {
+  const authHeader = req.headers.get("authorization");
+  if (authHeader?.startsWith("Bearer "))
+    return authHeader.slice(7);
+  if (cookieName) {
+    const cookies = parseCookies(req.headers.get("cookie"));
+    return cookies[cookieName] ?? null;
+  }
+  return null;
+}
+function createAuthHook(config) {
+  const onAnonymous = config.onAnonymous ?? (() => unauthorized());
+  const onForbidden = config.onForbidden ?? (() => forbidden());
+  return async (ctx, endpoint) => {
+    const identity = ctx.source === "http" ? await config.resolve(ctx) : await config.resolveFromContext?.(ctx) ?? null;
+    config.inject?.(ctx, identity);
+    const scope = endpoint.scope ?? config.defaultScope;
+    if (!scope)
+      return;
+    const rule = config.rules[scope];
+    if (!rule) {
+      throw new Error(`[stitchkit] auth: no rule for scope "${scope}"`);
+    }
+    if (rule === "public")
+      return;
+    if (!identity) {
+      onAnonymous();
+      return;
+    }
+    if (rule === "authenticated")
+      return;
+    if (!await rule(identity, ctx))
+      onForbidden();
+  };
+}
+function createBearerResolver(config) {
+  return async (req) => {
+    const token = extractToken(req);
+    if (!token)
+      return null;
+    return config.lookup(token, req);
+  };
+}
+
+// src/server/middleware/pkce.ts
+function base64UrlEncode(bytes) {
+  let binary = "";
+  for (const byte of bytes)
+    binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function deriveCodeChallenge(verifier) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return base64UrlEncode(new Uint8Array(digest));
+}
+async function verifyPkce(verifier, challenge) {
+  if (!verifier || !challenge)
+    return false;
+  const derived = await deriveCodeChallenge(verifier);
+  return derived === challenge;
+}
+
+export { parseCookies, serializeCookie, defineCookie, verifyJwt, signJwt, extractToken, createAuthHook, createBearerResolver, deriveCodeChallenge, verifyPkce };

package/dist/index-37x76zdn.js

@@ -0,0 +1,4 @@
+import { createRequire } from "node:module";
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+
+export { __require };

package/dist/{index-dpj1jcys.js → index-3qmtdfpa.js}

@@ -1,14 +1,14 @@
 import {
   isWithinDir
-} from "./index-q6ja2qwq.js";
+} from "./index-x3fcszf8.js";
 import {
   normalizeError,
   validateHandlerOutput
-} from "./index-0t460v7k.js";
+} from "./index-vhdvv00d.js";
 import {
   AppError,
   badRequest
-} from "./index-kckky6zw.js";
+} from "./index-afzt3nmx.js";
 import {
   extractIp,
   getClientInfo,
@@ -20,6 +20,12 @@ import {
   isUnsafeKey,
   safeJsonParse
 } from "./index-kzfs85xp.js";
+import {
+  typedEntries
+} from "./index-809wc1tt.js";
+import {
+  __require
+} from "./index-37x76zdn.js";
 
 // src/server/multipart.ts
 var DEFAULT_MAX_UPLOAD_BYTES = 25 * 1024 * 1024;
@@ -674,4 +680,150 @@ function json(data, status, cors, req) {
   return Response.json(data, { status, headers: corsHeaders2(cors, req) });
 }
 
-export { parseMultipart, corsHeaders, corsPreflightResponse, staticRoute, createHandler, createServer };
+// src/server/implement.ts
+function implement(contract, handlers) {
+  const methods = {};
+  const groupScope = contract.meta.scope ?? "public";
+  for (const [key, endpoint] of typedEntries(contract.endpoints)) {
+    const typedHandler = handlers[key];
+    methods[String(key)] = {
+      method: endpoint.method,
+      path: endpoint.path,
+      desc: endpoint.desc,
+      toolName: "toolName" in endpoint ? endpoint.toolName : undefined,
+      expose: endpoint.expose,
+      scope: endpoint.scope ?? groupScope,
+      paramsSchema: endpoint.params,
+      inputSchema: endpoint.input,
+      outputSchema: endpoint.output,
+      multipart: endpoint.multipart,
+      ui: "ui" in endpoint ? endpoint.ui : undefined,
+      annotations: "annotations" in endpoint ? endpoint.annotations : undefined,
+      handler: (ctx) => typedHandler(ctx)
+    };
+  }
+  return {
+    name: contract.meta.prefix,
+    prefix: contract.meta.prefix,
+    scope: groupScope,
+    methods
+  };
+}
+function createImplement() {
+  return (contract, handlers) => implement(contract, handlers);
+}
+
+// src/server/websocket.ts
+function webSocketLane(lane) {
+  const { match, handlers } = lane;
+  return {
+    match,
+    handlers: {
+      message(ws, message) {
+        if (match(ws))
+          handlers.message(ws, message);
+      },
+      open(ws) {
+        if (match(ws))
+          handlers.open?.(ws);
+      },
+      close(ws, code, reason) {
+        if (match(ws))
+          handlers.close?.(ws, code, reason);
+      },
+      drain(ws) {
+        if (match(ws))
+          handlers.drain?.(ws);
+      },
+      ping(ws, data) {
+        if (match(ws))
+          handlers.ping?.(ws, data);
+      },
+      pong(ws, data) {
+        if (match(ws))
+          handlers.pong?.(ws, data);
+      }
+    }
+  };
+}
+function composeWebSocketHandlers(lanes, config) {
+  const pick = (ws) => lanes.find((lane) => lane.match(ws));
+  return {
+    ...config,
+    message(ws, message) {
+      pick(ws)?.handlers.message(ws, message);
+    },
+    open(ws) {
+      pick(ws)?.handlers.open?.(ws);
+    },
+    close(ws, code, reason) {
+      pick(ws)?.handlers.close?.(ws, code, reason);
+    },
+    drain(ws) {
+      pick(ws)?.handlers.drain?.(ws);
+    },
+    ping(ws, data) {
+      pick(ws)?.handlers.ping?.(ws, data);
+    },
+    pong(ws, data) {
+      pick(ws)?.handlers.pong?.(ws, data);
+    }
+  };
+}
+
+// src/server/socket-io.ts
+var noop = () => {};
+async function createSocketIOServer(config) {
+  const path = config.path ?? "/socket.io/";
+  const onBun = "Bun" in globalThis;
+  const transports = config.transports ?? (onBun ? ["websocket", "polling"] : ["websocket"]);
+  const { Server } = await import("socket.io");
+  const io = new Server({
+    path,
+    cors: {
+      origin: config.cors.origin,
+      credentials: config.cors.credentials ?? true,
+      methods: ["GET", "POST"]
+    },
+    transports,
+    pingTimeout: config.pingTimeout ?? 20000,
+    pingInterval: config.pingInterval ?? 1e4
+  });
+  if (onBun) {
+    const { Server: Engine } = await import("@socket.io/bun-engine");
+    const engine = new Engine({ path });
+    io.bind(engine);
+    const { websocket } = engine.handler();
+    const route = {
+      method: "ALL",
+      path: `${path.replace(/\/+$/, "")}/*`,
+      handler: (req, ctx) => {
+        if (!ctx.server) {
+          throw new Error("[stitchkit] createSocketIOServer route needs a running Bun server — mount it via createServer.");
+        }
+        return engine.handleRequest(req, ctx.server);
+      }
+    };
+    return { io, websocket, route, attach: noop };
+  }
+  return {
+    io,
+    attach: (server) => io.attach(server),
+    websocket: { open: noop, message: noop, close: noop, maxPayloadLength: 0 },
+    route: {
+      method: "ALL",
+      path: `${path.replace(/\/+$/, "")}/*`,
+      handler: () => {
+        throw new Error("[stitchkit] On Node, Socket.IO attaches via serveNode({ socket }) — this route is not mounted.");
+      }
+    }
+  };
+}
+function socketIoLane(websocket) {
+  return webSocketLane({
+    match: (_ws) => true,
+    handlers: websocket
+  });
+}
+
+export { parseMultipart, corsHeaders, corsPreflightResponse, staticRoute, createHandler, createServer, implement, createImplement, webSocketLane, composeWebSocketHandlers, createSocketIOServer, socketIoLane };

package/dist/index-48ffdxgk.js

@@ -0,0 +1,6 @@
+// src/internal/http-input.ts
+function inputIsQuery(method) {
+  return method === "GET" || method === "DELETE";
+}
+
+export { inputIsQuery };

package/dist/{index-4kz3aqpx.js → index-78q1qm7v.js}

@@ -1,3 +1,6 @@
+import {
+  inputIsQuery
+} from "./index-48ffdxgk.js";
 import {
   isRecord,
   mapObject,
@@ -261,7 +264,7 @@ function createFetchMethod(endpoint, prefix, config) {
       Accept: "application/json",
       ...typeof config.headers === "function" ? config.headers() : config.headers
     };
-    const isQuery = endpoint.method === "GET" || endpoint.method === "DELETE";
+    const isQuery = inputIsQuery(endpoint.method);
     const hasBody = !isQuery && !endpoint.multipart && endpoint.input && args;
     if (isQuery && args) {
       const remaining = stripParams(args, endpoint.path);

package/dist/{index-kckky6zw.js → index-afzt3nmx.js}

@@ -1,5 +1,5 @@
 // src/contract/define.ts
-var ALL_TRANSPORTS = ["HTTP", "MCP", "AGENT"];
+var ALL_TRANSPORTS = ["HTTP", "MCP", "AGENT", "CLI"];
 function defineContract(meta, endpoints) {
   const toolTransports = new Map;
   for (const [key, ep] of Object.entries(endpoints)) {

package/dist/{index-4b1j82gp.js → index-d4rwrjbc.js}

@@ -1,6 +1,6 @@
 import {
   normalizeError
-} from "./index-0t460v7k.js";
+} from "./index-vhdvv00d.js";
 
 // src/server/stream.ts
 function streamSSE(generator) {

package/dist/{index-0t460v7k.js → index-vhdvv00d.js}

@@ -1,6 +1,6 @@
 import {
   AppError
-} from "./index-kckky6zw.js";
+} from "./index-afzt3nmx.js";
 
 // src/internal/errors.ts
 import { z } from "zod";

package/dist/index-x3fcszf8.js

@@ -0,0 +1,8 @@
+// src/internal/within-dir.ts
+import { sep } from "node:path";
+function isWithinDir(root, target) {
+  const base = root.endsWith(sep) ? root.slice(0, -sep.length) : root;
+  return target === root || target === base || target.startsWith(base + sep);
+}
+
+export { isWithinDir };

package/dist/index.js

@@ -3,11 +3,12 @@ import {
   createClient,
   createClients,
   createHttpClient
-} from "./index-4kz3aqpx.js";
+} from "./index-78q1qm7v.js";
 import {
   parseSSE
-} from "./index-4b1j82gp.js";
-import"./index-0t460v7k.js";
+} from "./index-d4rwrjbc.js";
+import"./index-48ffdxgk.js";
+import"./index-vhdvv00d.js";
 import {
   ALL_TRANSPORTS,
   AppError,
@@ -20,10 +21,18 @@ import {
   paginatedSchema,
   rateLimited,
   unauthorized
-} from "./index-kckky6zw.js";
+} from "./index-afzt3nmx.js";
 import"./index-809wc1tt.js";
+import"./index-37x76zdn.js";
 // src/browser/socket-io.ts
 import { io } from "socket.io-client";
+function toIoAuth(auth) {
+  if (typeof auth !== "function")
+    return auth;
+  return (cb) => {
+    Promise.resolve().then(auth).then(cb, () => cb({}));
+  };
+}
 function createSocketIOClient(config) {
   let socket = null;
   const connectionListeners = new Set;
@@ -42,6 +51,9 @@ function createSocketIOClient(config) {
       socket = io(config.url, {
         path: config.path ?? "/socket.io/",
         withCredentials: config.withCredentials ?? true,
+        auth: toIoAuth(config.auth),
+        ...config.query && { query: config.query },
+        ...config.extraHeaders && { extraHeaders: config.extraHeaders },
         transports: config.transports ?? ["websocket", "polling"],
         autoConnect: false,
         reconnection: true,

package/dist/internal/http-input.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Where a method's input travels over HTTP — the single source of truth for the
+ * convention shared by the typed client (what it SENDS) and the OpenAPI
+ * generator (what it DOCUMENTS), so the two cannot drift. GET and DELETE carry
+ * their input as query parameters; the body verbs (POST / PUT / PATCH) carry it
+ * as a request body.
+ *
+ * The server runtime is a tolerant superset of this: it additionally accepts a
+ * DELETE *body* when the request carries an `application/json` content-type. The
+ * canonical form a client uses and the spec documents is the query form.
+ */
+export declare function inputIsQuery(method: string): boolean;
+//# sourceMappingURL=http-input.d.ts.map

package/dist/internal/http-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-input.d.ts","sourceRoot":"","sources":["../../src/internal/http-input.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEpD"}

package/dist/internal/secure-fetch.d.ts

@@ -0,0 +1,27 @@
+/** True for a loopback / private / link-local / ULA / CGNAT IP literal. */
+export declare function isPrivateIp(ip: string): boolean;
+/**
+ * Refuse a URL that is not `http(s)`, has no host, or whose host is — or
+ * resolves to — a private/internal address. Called on the initial URL and on
+ * every redirect hop, so a public host cannot `302` to an internal address or
+ * to a `file:` / `gopher:` / `data:` scheme.
+ */
+export declare function assertPublicUrl(url: URL): Promise<void>;
+/**
+ * Fetch a URL with the SSRF guard enforced on the initial URL and on every
+ * redirect hop — a public host can otherwise `302` to an internal address or a
+ * non-http(s) scheme.
+ *
+ * Note: the DNS resolution here and the resolution `fetch` performs are
+ * separate, so a hostile resolver retains a narrow rebinding window. The
+ * per-hop re-check is the larger and fully-closed hole; a static private DNS
+ * record is rejected outright.
+ */
+export declare function fetchGuarded(start: URL, allowPrivate: boolean): Promise<Response>;
+/**
+ * Read a response body into a buffer, aborting (and returning `null`) if it
+ * exceeds `max` bytes — the size cap that keeps a hostile or unbounded stream
+ * from OOM-ing the process. A missing body yields an empty buffer.
+ */
+export declare function readCapped(res: Response, max: number): Promise<Buffer | null>;
+//# sourceMappingURL=secure-fetch.d.ts.map

package/dist/internal/secure-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-fetch.d.ts","sourceRoot":"","sources":["../../src/internal/secure-fetch.ts"],"names":[],"mappings":"AA8CA,2EAA2E;AAC3E,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAkC/C;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CA0B7D;AAED;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAavF;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoBnF"}

package/dist/internal/within-dir.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"within-dir.d.ts","sourceRoot":"","sources":["../../src/internal/within-dir.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEjE"}
+{"version":3,"file":"within-dir.d.ts","sourceRoot":"","sources":["../../src/internal/within-dir.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAQjE"}

package/dist/node.d.ts

@@ -1,4 +1,13 @@
+/**
+ * `stitchkit/node` — the Node entrypoint. Everything a Node app needs without
+ * touching the Bun-named `createServer`: the Fetch-clean `createHandler`, the
+ * srvx-backed `serveNode`, `implement`, the error helpers and (lazily-loaded,
+ * Node-safe) `createSocketIOServer`.
+ */
+export { AppError, appError, badRequest, conflict, forbidden, notFound, rateLimited, unauthorized, } from './contract';
 export { createHandler } from './server/create';
+export { createImplement, implement } from './server/implement';
 export { type NodeServerConfig, type NodeServerHandle, serveNode } from './server/node';
-export type { HandlerConfig } from './server/types';
+export { createSocketIOServer, type SocketIOServerConfig, type SocketIOServerHandle, } from './server/socket-io';
+export type { HandlerConfig, RawRoute, RawRouteContext, ServiceDef, } from './server/types';
 //# sourceMappingURL=node.d.ts.map

package/dist/node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACxF,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,WAAW,EACX,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACxF,OAAO,EACL,oBAAoB,EACpB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,aAAa,EACb,QAAQ,EACR,eAAe,EACf,UAAU,GACX,MAAM,gBAAgB,CAAC"}

package/dist/node.js

@@ -1,19 +1,39 @@
 import {
-  createHandler
-} from "./index-dpj1jcys.js";
-import"./index-q6ja2qwq.js";
-import"./index-0t460v7k.js";
-import"./index-kckky6zw.js";
+  createHandler,
+  createImplement,
+  createSocketIOServer,
+  implement
+} from "./index-3qmtdfpa.js";
+import"./index-x3fcszf8.js";
+import"./index-vhdvv00d.js";
+import {
+  AppError,
+  appError,
+  badRequest,
+  conflict,
+  forbidden,
+  notFound,
+  rateLimited,
+  unauthorized
+} from "./index-afzt3nmx.js";
 import"./index-mwmpw6j1.js";
 import"./index-kzfs85xp.js";
 import"./index-809wc1tt.js";
+import"./index-37x76zdn.js";
 // src/server/node.ts
 import { serve } from "srvx";
 async function serveNode(config) {
-  const { port = 3000, hostname, ...handlerConfig } = config;
+  const { port = 3000, hostname, socket, ...handlerConfig } = config;
   const handler = createHandler(handlerConfig);
   const server = serve({ port, hostname, fetch: handler });
   await server.ready();
+  if (socket) {
+    const nodeServer = server.node?.server;
+    if (!nodeServer || !("maxRequestsPerSocket" in nodeServer)) {
+      throw new Error("[stitchkit] serveNode: expected a node:http.Server for Socket.IO (none / http2).");
+    }
+    socket.attach(nodeServer);
+  }
   const listenUrl = server.url ?? `http://${hostname ?? "localhost"}:${port}`;
   const resolvedPort = Number(new URL(listenUrl).port) || port;
   const resolvedHost = hostname ?? "localhost";
@@ -24,6 +44,17 @@ async function serveNode(config) {
   };
 }
 export {
+  unauthorized,
   serveNode,
-  createHandler
+  rateLimited,
+  notFound,
+  implement,
+  forbidden,
+  createSocketIOServer,
+  createImplement,
+  createHandler,
+  conflict,
+  badRequest,
+  appError,
+  AppError
 };

package/dist/observability/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/observability/audit.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAc,MAAM,kBAAkB,CAAC;AAElE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAe,KAAK,eAAe,EAAmB,MAAM,YAAY,CAAC;AAGhF,oCAAoC;AACpC,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,KAAK,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,iFAAiF;IACjF,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC;IAC1C,yEAAyE;IACzE,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B;AAED,qEAAqE;AACrE,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,IAAI,EAAE,CAAC,CAAC,EACN,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,KACpD,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpD;;;OAGG;IACH,QAAQ,EAAE,aAAa,CAAC;CACzB;AAmBD,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,CA6F9D"}
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/observability/audit.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAc,MAAM,kBAAkB,CAAC;AAElE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAe,KAAK,eAAe,EAAmB,MAAM,YAAY,CAAC;AAGhF,oCAAoC;AACpC,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,KAAK,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,iFAAiF;IACjF,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC;IAC1C,yEAAyE;IACzE,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B;AAED,qEAAqE;AACrE,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,IAAI,EAAE,CAAC,CAAC,EACN,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,KACpD,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpD;;;OAGG;IACH,QAAQ,EAAE,aAAa,CAAC;CACzB;AAmBD,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,CA+F9D"}

package/dist/observability/event.d.ts

@@ -39,6 +39,10 @@ export interface RequestEvent {
     responseBytes: number;
     /** Resolved user id, when authenticated. */
     userId?: string;
+    /** How the caller authenticated, when the app records it on the context. */
+    authMethod?: string;
+    /** Client id the call was made under (e.g. an OAuth client), when recorded. */
+    clientId?: string;
     /** Client IP. */
     ipAddress?: string;
     /** Client user-agent. */