stitchkit 0.3.0 → 0.4.0

package/dist/observability/event.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"event.d.ts","sourceRoot":"","sources":["../../src/observability/event.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,mCAAmC;IACnC,MAAM,EAAE,eAAe,CAAC;IACxB,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kCAAkC;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAC;IACnB,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,OAAO,EAAE,SAAS,GAAG,IAAI,CAAC;IAC1B,mDAAmD;IACnD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,4CAA4C;IAC5C,aAAa,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,SAAS,EAAE,IAAI,CAAC;CACjB"}
+{"version":3,"file":"event.d.ts","sourceRoot":"","sources":["../../src/observability/event.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,mCAAmC;IACnC,MAAM,EAAE,eAAe,CAAC;IACxB,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kCAAkC;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAC;IACnB,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,OAAO,EAAE,SAAS,GAAG,IAAI,CAAC;IAC1B,mDAAmD;IACnD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,4CAA4C;IAC5C,aAAa,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,SAAS,EAAE,IAAI,CAAC;CACjB"}

package/dist/observability/index.js

@@ -8,6 +8,7 @@ import {
 import {
   isRecord
 } from "../index-809wc1tt.js";
+import"../index-37x76zdn.js";
 
 // src/observability/context.ts
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -257,6 +258,8 @@ function createAuditHook(config) {
         resultSize: measure.resultSize,
         responseBytes: measure.responseBytes,
         userId: readString(context.userId),
+        authMethod: readString(context.authMethod),
+        clientId: readString(context.clientId),
         ipAddress: readString(context.ipAddress),
         userAgent: readString(context.userAgent),
         startedAt: new Date(Date.now() - durationMs)

package/dist/react.js

@@ -1,3 +1,5 @@
+import"./index-37x76zdn.js";
+
 // src/react/cache-bridge.ts
 function createCacheBridge(config) {
   const freshWindow = config.freshWindow ?? 500;

package/dist/server/implement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"implement.d.ts","sourceRoot":"","sources":["../../src/server/implement.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,KAAK,EAAE,QAAQ,EAAa,UAAU,EAAE,MAAM,SAAS,CAAC;AAE/D;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACrC,IAAI,SAAS,cAAc,GAAG,cAAc,EAC5C,QAAQ,EAAE,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,UAAU,CAoC3E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,SAAS,cAAc,MACjD,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EAC3C,UAAU,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,EAChC,UAAU,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,KAC1B,UAAU,CACd"}
+{"version":3,"file":"implement.d.ts","sourceRoot":"","sources":["../../src/server/implement.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,KAAK,EAAE,QAAQ,EAAa,UAAU,EAAE,MAAM,SAAS,CAAC;AAE/D;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACrC,IAAI,SAAS,cAAc,GAAG,cAAc,EAC5C,QAAQ,EAAE,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,UAAU,CAsC3E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,SAAS,cAAc,MACjD,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EAC3C,UAAU,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,EAChC,UAAU,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,KAC1B,UAAU,CACd"}

package/dist/server/index.d.ts

@@ -3,15 +3,18 @@ export { cacheHeaders, createCache } from './cache';
 export { createHandler, createServer } from './create';
 export { createEventBus, type EventBus } from './event-bus';
 export { createImplement, implement } from './implement';
-export { type AuthHook, type AuthHookConfig, type AuthRule, type BearerResolverConfig, createAuthHook, createBearerResolver, extractToken, type JwtPayload, verifyJwt, } from './middleware/auth';
+export { type AuthHook, type AuthHookConfig, type AuthRule, type BearerResolverConfig, createAuthHook, createBearerResolver, extractToken, type JwtPayload, type SignJwtOptions, signJwt, verifyJwt, } from './middleware/auth';
 export { type CookieDef, type CookieOptions, defineCookie, parseCookies, serializeCookie, } from './middleware/cookies';
 export { type CorsConfig, corsHeaders, corsPreflightResponse, } from './middleware/cors';
+export { deriveCodeChallenge, type PkceMethod, verifyPkce } from './middleware/pkce';
 export { parseMultipart } from './multipart';
+export { generateOpenApiDocument, type OpenApiConfig, type OpenApiDocument, type OpenApiInfo, type OpenApiServer, openApiRoute, } from './openapi';
 export { createRateLimiter, type RateLimitConfig } from './rate-limit';
 export { type ClientIpOptions, extractIp, generateTraceId, getClientInfo, resolveSocketIp, resolveTraceId, } from './request';
 export { staticRoute } from './router';
 export type { SocketIOServerConfig, SocketIOServerHandle } from './socket-io';
-export { createSocketIOServer } from './socket-io';
+export { createSocketIOServer, socketIoLane } from './socket-io';
 export { type ParseSSEOptions, parseSSE, streamSSE } from './stream';
 export type { BunServer, BunServerConfig, HandlerConfig, Handlers, LifecycleHooks, MethodDef, RawRoute, RawRouteContext, RouteGroup, ServerPassthrough, ServiceDef, StitchLogger, } from './types';
+export { type ComposedLane, composeWebSocketHandlers, type WebSocketComposeConfig, type WebSocketLane, webSocketLane, } from './websocket';
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,WAAW,EACX,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,oBAAoB,EACzB,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,KAAK,UAAU,EACf,SAAS,GACV,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,UAAU,EACf,WAAW,EACX,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EACL,KAAK,eAAe,EACpB,SAAS,EACT,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,YAAY,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,KAAK,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrE,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,QAAQ,EACR,cAAc,EACd,SAAS,EACT,QAAQ,EACR,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,UAAU,EACV,YAAY,GACb,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,WAAW,EACX,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,oBAAoB,EACzB,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,OAAO,EACP,SAAS,GACV,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,UAAU,EACf,WAAW,EACX,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,KAAK,UAAU,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACrF,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EACL,uBAAuB,EACvB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,YAAY,GACb,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EACL,KAAK,eAAe,EACpB,SAAS,EACT,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,YAAY,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,KAAK,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrE,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,QAAQ,EACR,cAAc,EACd,SAAS,EACT,QAAQ,EACR,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,UAAU,EACV,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,KAAK,YAAY,EACjB,wBAAwB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,aAAa,GACd,MAAM,aAAa,CAAC"}

package/dist/server/index.js

@@ -1,17 +1,42 @@
 import {
   parseSSE,
   streamSSE
-} from "../index-4b1j82gp.js";
+} from "../index-d4rwrjbc.js";
 import {
+  createAuthHook,
+  createBearerResolver,
+  defineCookie,
+  deriveCodeChallenge,
+  extractToken,
+  parseCookies,
+  serializeCookie,
+  signJwt,
+  verifyJwt,
+  verifyPkce
+} from "../index-1cf8jkhf.js";
+import {
+  inputIsQuery
+} from "../index-48ffdxgk.js";
+import {
+  jsonSchemaFields,
+  toJsonSchema
+} from "../index-0ed3bx43.js";
+import {
+  composeWebSocketHandlers,
   corsHeaders,
   corsPreflightResponse,
   createHandler,
+  createImplement,
   createServer,
+  createSocketIOServer,
+  implement,
   parseMultipart,
-  staticRoute
-} from "../index-dpj1jcys.js";
-import"../index-q6ja2qwq.js";
-import"../index-0t460v7k.js";
+  socketIoLane,
+  staticRoute,
+  webSocketLane
+} from "../index-3qmtdfpa.js";
+import"../index-x3fcszf8.js";
+import"../index-vhdvv00d.js";
 import {
   AppError,
   appError,
@@ -21,7 +46,7 @@ import {
   notFound,
   rateLimited,
   unauthorized
-} from "../index-kckky6zw.js";
+} from "../index-afzt3nmx.js";
 import {
   extractIp,
   generateTraceId,
@@ -29,13 +54,11 @@ import {
   resolveSocketIp,
   resolveTraceId
 } from "../index-mwmpw6j1.js";
-import {
-  isUnsafeKey,
-  safeJsonParse
-} from "../index-kzfs85xp.js";
+import"../index-kzfs85xp.js";
 import {
   isRecord
 } from "../index-809wc1tt.js";
+import"../index-37x76zdn.js";
 // src/server/swept-map.ts
 function createSweptMap(options) {
   const store = new Map;
@@ -146,194 +169,150 @@ function createEventBus(options = {}) {
     }
   };
 }
-// src/server/implement.ts
-function implement(contract, handlers) {
-  const methods = {};
-  const groupScope = contract.meta.scope ?? "public";
-  for (const [key, endpoint] of Object.entries(contract.endpoints)) {
-    const typedHandler = handlers[key];
-    methods[key] = {
-      method: endpoint.method,
-      path: endpoint.path,
-      desc: endpoint.desc,
-      toolName: "toolName" in endpoint ? endpoint.toolName : undefined,
-      expose: endpoint.expose,
-      scope: endpoint.scope ?? groupScope,
-      paramsSchema: endpoint.params,
-      inputSchema: endpoint.input,
-      outputSchema: endpoint.output,
-      multipart: endpoint.multipart,
-      handler: (ctx) => typedHandler(ctx)
-    };
-  }
-  return {
-    name: contract.meta.prefix,
-    prefix: contract.meta.prefix,
-    scope: groupScope,
-    methods
-  };
+// src/server/openapi.ts
+var ERROR_ENVELOPE_SCHEMA = {
+  type: "object",
+  properties: {
+    error: {
+      type: "object",
+      properties: {
+        code: { type: "string" },
+        message: { type: "string" },
+        details: {},
+        hint: { type: "string" }
+      },
+      required: ["code"]
+    }
+  },
+  required: ["error"]
+};
+function joinPath(...parts) {
+  const joined = parts.filter((p) => Boolean(p)).map((part) => part.replace(/^\/+|\/+$/g, "")).filter(Boolean).join("/");
+  return `/${joined}`;
 }
-function createImplement() {
-  return (contract, handlers) => implement(contract, handlers);
+function toOpenApiPath(path) {
+  return path.replace(/:([^/]+)/g, "{$1}");
 }
-// src/server/middleware/cookies.ts
-function parseCookies(header) {
-  if (!header)
+function safeJson(schema, io) {
+  if (!schema)
+    return {};
+  try {
+    return toJsonSchema(schema, io, "any");
+  } catch {
     return {};
-  const cookies = {};
-  for (const pair of header.split(";")) {
-    const eq = pair.indexOf("=");
-    if (eq === -1)
-      continue;
-    const key = pair.slice(0, eq).trim();
-    if (!key || isUnsafeKey(key))
-      continue;
-    const raw = pair.slice(eq + 1).trim();
-    try {
-      cookies[key] = decodeURIComponent(raw);
-    } catch {
-      cookies[key] = raw;
-    }
   }
-  return cookies;
 }
-function serializeCookie(name, value, opts = {}) {
-  let cookie = `${name}=${encodeURIComponent(value)}`;
-  if (opts.maxAge !== undefined)
-    cookie += `; Max-Age=${opts.maxAge}`;
-  if (opts.path)
-    cookie += `; Path=${opts.path}`;
-  if (opts.domain)
-    cookie += `; Domain=${opts.domain}`;
-  if (opts.secure)
-    cookie += "; Secure";
-  if (opts.httpOnly)
-    cookie += "; HttpOnly";
-  if (opts.sameSite)
-    cookie += `; SameSite=${opts.sameSite}`;
-  return cookie;
-}
-function defineCookie(config) {
-  const { name, ...options } = config;
+function errorResponse(description) {
   return {
-    get(req) {
-      return parseCookies(req.headers.get("cookie"))[name];
-    },
-    set(value) {
-      return serializeCookie(name, value, options);
-    },
-    clear() {
-      return serializeCookie(name, "", { ...options, maxAge: 0 });
-    }
+    description,
+    content: { "application/json": { schema: ERROR_ENVELOPE_SCHEMA } }
   };
 }
-
-// src/server/middleware/auth.ts
-var MAX_TOKEN_BYTES = 8192;
-function decodeBase64Url(segment) {
-  if (!/^[A-Za-z0-9_-]*$/.test(segment) || segment.length % 4 === 1) {
-    throw new Error("invalid base64url segment");
-  }
-  const b64 = segment.replace(/-/g, "+").replace(/_/g, "/");
-  const padded = b64.padEnd(Math.ceil(b64.length / 4) * 4, "=");
-  return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
-}
-async function verifyJwt(token, secret, options = {}) {
-  if (!secret)
-    throw new Error("verifyJwt: a non-empty secret is required");
-  if (token.length > MAX_TOKEN_BYTES)
-    throw unauthorized("Token too large");
-  const [headerB64, payloadB64, signatureB64] = token.split(".");
-  if (!headerB64 || !payloadB64 || !signatureB64)
-    throw unauthorized("Invalid token format");
-  let header;
-  let payloadRaw;
-  let signature;
-  try {
-    const decoder = new TextDecoder;
-    header = JSON.parse(decoder.decode(decodeBase64Url(headerB64)));
-    payloadRaw = safeJsonParse(decoder.decode(decodeBase64Url(payloadB64)));
-    signature = decodeBase64Url(signatureB64);
-  } catch {
-    throw unauthorized("Malformed token");
-  }
-  if (!isRecord(payloadRaw))
-    throw unauthorized("Malformed token");
-  const payload = payloadRaw;
-  if (header.alg !== "HS256")
-    throw unauthorized("Unsupported token algorithm");
-  const encoder = new TextEncoder;
-  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["verify"]);
-  const data = encoder.encode(`${headerB64}.${payloadB64}`);
-  const valid = await crypto.subtle.verify("HMAC", key, signature, data);
-  if (!valid)
-    throw unauthorized("Invalid token signature");
-  const leeway = options.leewaySeconds ?? 60;
-  const now = Date.now() / 1000;
-  if ("exp" in payload) {
-    if (typeof payload.exp !== "number")
-      throw unauthorized("Malformed token");
-    if (payload.exp < now - leeway)
-      throw unauthorized("Token expired");
-  }
-  if ("nbf" in payload) {
-    if (typeof payload.nbf !== "number")
-      throw unauthorized("Malformed token");
-    if (payload.nbf > now + leeway)
-      throw unauthorized("Token not yet valid");
-  }
-  if (options.issuer !== undefined && payload.iss !== options.issuer) {
-    throw unauthorized("Token issuer mismatch");
-  }
-  if (options.audience !== undefined) {
-    const aud = payload.aud;
-    const ok = Array.isArray(aud) ? aud.includes(options.audience) : aud === options.audience;
-    if (!ok)
-      throw unauthorized("Token audience mismatch");
-  }
-  return payload;
-}
-function extractToken(req, cookieName) {
-  const authHeader = req.headers.get("authorization");
-  if (authHeader?.startsWith("Bearer "))
-    return authHeader.slice(7);
-  if (cookieName) {
-    const cookies = parseCookies(req.headers.get("cookie"));
-    return cookies[cookieName] ?? null;
+function errorResponses(scope) {
+  const responses = {
+    "400": errorResponse("Validation error"),
+    "500": errorResponse("Server error")
+  };
+  if (scope && scope !== "public") {
+    responses["401"] = errorResponse("Unauthorized");
+    responses["403"] = errorResponse("Forbidden");
   }
-  return null;
+  return responses;
 }
-function createAuthHook(config) {
-  const onAnonymous = config.onAnonymous ?? (() => unauthorized());
-  const onForbidden = config.onForbidden ?? (() => forbidden());
-  return async (ctx, endpoint) => {
-    const identity = ctx.source === "http" ? await config.resolve(ctx) : await config.resolveFromContext?.(ctx) ?? null;
-    config.inject?.(ctx, identity);
-    const scope = endpoint.scope ?? config.defaultScope;
-    if (!scope)
-      return;
-    const rule = config.rules[scope];
-    if (!rule) {
-      throw new Error(`[stitchkit] auth: no rule for scope "${scope}"`);
-    }
-    if (rule === "public")
-      return;
-    if (!identity) {
-      onAnonymous();
-      return;
+function generateOpenApiDocument(config) {
+  const groups = [
+    ...(config.services ?? []).map((service) => ({ pathPrefix: undefined, service })),
+    ...(config.groups ?? []).flatMap((group) => group.services.map((service) => ({ pathPrefix: group.pathPrefix, service })))
+  ];
+  const paths = {};
+  for (const { pathPrefix, service } of groups) {
+    for (const [key, method] of Object.entries(service.methods)) {
+      if (method.expose && !method.expose.includes("HTTP"))
+        continue;
+      const servicePath = joinPath("/", service.prefix, method.path === "/" ? "" : method.path);
+      const fullPath = toOpenApiPath(pathPrefix ? joinPath(pathPrefix, servicePath) : servicePath);
+      const parameters = [];
+      for (const field of jsonSchemaFields(safeJson(method.paramsSchema, "input"))) {
+        parameters.push({
+          name: field.name,
+          in: "path",
+          required: true,
+          schema: field.schema,
+          ...field.description && { description: field.description }
+        });
+      }
+      const inputInQuery = inputIsQuery(method.method);
+      if (inputInQuery && method.inputSchema) {
+        for (const field of jsonSchemaFields(safeJson(method.inputSchema, "input"))) {
+          parameters.push({
+            name: field.name,
+            in: "query",
+            required: field.required,
+            schema: field.schema,
+            ...field.description && { description: field.description }
+          });
+        }
+      }
+      const responses = { ...errorResponses(method.scope) };
+      if (method.outputSchema) {
+        responses["200"] = {
+          description: "Success",
+          content: { "application/json": { schema: safeJson(method.outputSchema, "output") } }
+        };
+      } else {
+        responses["204"] = { description: "No content" };
+      }
+      const operation = {
+        summary: method.desc,
+        operationId: `${service.name}_${key}`,
+        ...parameters.length > 0 && { parameters },
+        responses
+      };
+      if (!inputInQuery && (method.inputSchema || method.multipart)) {
+        if (method.multipart) {
+          const inputJson = safeJson(method.inputSchema, "input");
+          const baseProps = isRecord(inputJson.properties) ? inputJson.properties : {};
+          const baseRequired = Array.isArray(inputJson.required) ? inputJson.required : [];
+          operation.requestBody = {
+            required: true,
+            content: {
+              "multipart/form-data": {
+                schema: {
+                  type: "object",
+                  properties: {
+                    ...baseProps,
+                    [method.multipart]: { type: "string", format: "binary" }
+                  },
+                  required: [...baseRequired, method.multipart]
+                }
+              }
+            }
+          };
+        } else if (method.inputSchema) {
+          const required = jsonSchemaFields(safeJson(method.inputSchema, "input")).some((f) => f.required);
+          operation.requestBody = {
+            required,
+            content: { "application/json": { schema: safeJson(method.inputSchema, "input") } }
+          };
+        }
+      }
+      const pathItem = paths[fullPath] ?? {};
+      pathItem[method.method.toLowerCase()] = operation;
+      paths[fullPath] = pathItem;
     }
-    if (rule === "authenticated")
-      return;
-    if (!await rule(identity, ctx))
-      onForbidden();
+  }
+  return {
+    openapi: "3.1.0",
+    info: config.info,
+    ...config.servers && { servers: config.servers },
+    paths
   };
 }
-function createBearerResolver(config) {
-  return async (req) => {
-    const token = extractToken(req);
-    if (!token)
-      return null;
-    return config.lookup(token, req);
+function openApiRoute(path, document) {
+  return {
+    method: "GET",
+    path,
+    handler: () => Response.json(document)
   };
 }
 // src/server/rate-limit.ts
@@ -383,42 +362,15 @@ function createRateLimiter() {
     }
   };
 }
-// src/server/socket-io.ts
-import { Server as BunEngine } from "@socket.io/bun-engine";
-import { Server as SocketIOServer } from "socket.io";
-function createSocketIOServer(config) {
-  const path = config.path ?? "/socket.io/";
-  const io = new SocketIOServer({
-    path,
-    cors: {
-      origin: config.cors.origin,
-      credentials: config.cors.credentials ?? true,
-      methods: ["GET", "POST"]
-    },
-    transports: config.transports ?? ["websocket", "polling"],
-    pingTimeout: config.pingTimeout ?? 20000,
-    pingInterval: config.pingInterval ?? 1e4
-  });
-  const engine = new BunEngine({ path });
-  io.bind(engine);
-  const { websocket } = engine.handler();
-  const route = {
-    method: "ALL",
-    path: `${path.replace(/\/+$/, "")}/*`,
-    handler: (req, ctx) => {
-      if (!ctx.server) {
-        throw new Error("[stitchkit] createSocketIOServer route needs a running Bun server — mount it via createServer.");
-      }
-      return engine.handleRequest(req, ctx.server);
-    }
-  };
-  return { io, websocket, route };
-}
 export {
+  webSocketLane,
+  verifyPkce,
   verifyJwt,
   unauthorized,
   streamSSE,
   staticRoute,
+  socketIoLane,
+  signJwt,
   serializeCookie,
   resolveTraceId,
   resolveSocketIp,
@@ -426,13 +378,16 @@ export {
   parseSSE,
   parseMultipart,
   parseCookies,
+  openApiRoute,
   notFound,
   implement,
   getClientInfo,
   generateTraceId,
+  generateOpenApiDocument,
   forbidden,
   extractToken,
   extractIp,
+  deriveCodeChallenge,
   defineCookie,
   createSocketIOServer,
   createServer,
@@ -446,6 +401,7 @@ export {
   corsPreflightResponse,
   corsHeaders,
   conflict,
+  composeWebSocketHandlers,
   cacheHeaders,
   badRequest,
   appError,

package/dist/server/middleware/auth.d.ts

@@ -13,6 +13,23 @@ export interface VerifyJwtOptions {
     audience?: string;
 }
 export declare function verifyJwt(token: string, secret: string, options?: VerifyJwtOptions): Promise<JwtPayload>;
+/** Tuning for `signJwt`. */
+export interface SignJwtOptions {
+    /** Lifetime in seconds — sets `exp` to now + this. Omit for no expiry. */
+    expiresInSec?: number;
+    /** `iss` claim. */
+    issuer?: string;
+    /** `aud` claim. */
+    audience?: string;
+    /** `sub` claim. */
+    subject?: string;
+}
+/**
+ * Sign a payload as an HS256 JWT — the issuing counterpart of `verifyJwt`.
+ * Used to mint OAuth access tokens whose audience binds them to one resource.
+ * `iat` is always set; `exp` / `iss` / `aud` / `sub` follow `options`.
+ */
+export declare function signJwt(payload: JwtPayload, secret: string, options?: SignJwtOptions): Promise<string>;
 export declare function extractToken(req: Request, cookieName?: string): string | null;
 /**
  * Per-scope access predicate. `endpoint.scope` selects which rule applies:

package/dist/server/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAIrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAG1C,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,8BAA8B;AAC9B,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAiBD,wBAAsB,SAAS,CAC7B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,UAAU,CAAC,CAgErB;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU7E;AAUD;;;;;;;GAOG;AACH,MAAM,MAAM,QAAQ,CAAC,SAAS,IAC1B,QAAQ,GACR,eAAe,GACf,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAExF,MAAM,WAAW,cAAc,CAAC,SAAS;IACvC,kEAAkE;IAClE,OAAO,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC5D;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC3F,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3C,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,KAAK,IAAI,CAAC;IAC5E,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,KAAK,CAAC;IAC1B,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,KAAK,CAAC;CAC3B;AAED,MAAM,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnF;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,SAAS,CAAC,GAAG,QAAQ,CAgCrF;AAID;;;;GAIG;AACH,MAAM,WAAW,oBAAoB,CAAC,SAAS;IAC7C,4EAA4E;IAC5E,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;CACpE;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAC5C,MAAM,EAAE,oBAAoB,CAAC,SAAS,CAAC,GACtC,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAM7C"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAIrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAG1C,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,8BAA8B;AAC9B,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAiBD,wBAAsB,SAAS,CAC7B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,UAAU,CAAC,CAgErB;AAED,4BAA4B;AAC5B,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mBAAmB;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAQD;;;;GAIG;AACH,wBAAsB,OAAO,CAC3B,OAAO,EAAE,UAAU,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,CA+BjB;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU7E;AAUD;;;;;;;GAOG;AACH,MAAM,MAAM,QAAQ,CAAC,SAAS,IAC1B,QAAQ,GACR,eAAe,GACf,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAExF,MAAM,WAAW,cAAc,CAAC,SAAS;IACvC,kEAAkE;IAClE,OAAO,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC5D;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC3F,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3C,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,KAAK,IAAI,CAAC;IAC5E,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,KAAK,CAAC;IAC1B,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,KAAK,CAAC;CAC3B;AAED,MAAM,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnF;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,SAAS,CAAC,GAAG,QAAQ,CAgCrF;AAID;;;;GAIG;AACH,MAAM,WAAW,oBAAoB,CAAC,SAAS;IAC7C,4EAA4E;IAC5E,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;CACpE;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAC5C,MAAM,EAAE,oBAAoB,CAAC,SAAS,CAAC,GACtC,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAM7C"}

package/dist/server/middleware/pkce.d.ts

@@ -0,0 +1,17 @@
+/**
+ * PKCE (RFC 7636) verification for the OAuth authorization-code flow. The client
+ * sends a `code_challenge` at `/authorize` and the matching `code_verifier` at
+ * `/token`; the server confirms they correspond so an intercepted code is
+ * useless without the verifier.
+ */
+/** The only PKCE method OAuth 2.1 permits for public clients. */
+export type PkceMethod = 'S256';
+/** Derive the S256 `code_challenge` from a `code_verifier`. */
+export declare function deriveCodeChallenge(verifier: string): Promise<string>;
+/**
+ * Verify a `code_verifier` against the stored S256 `code_challenge`. S256 is the
+ * only method OAuth 2.1 permits for public clients — `plain` is intentionally
+ * not supported (it offers no protection against a leaked challenge).
+ */
+export declare function verifyPkce(verifier: string, challenge: string): Promise<boolean>;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/server/middleware/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../../src/server/middleware/pkce.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,iEAAiE;AACjE,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC;AAQhC,+DAA+D;AAC/D,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG3E;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAItF"}

package/dist/server/node.d.ts

@@ -1,7 +1,16 @@
+import type { Server as HttpServer } from 'node:http';
 import type { HandlerConfig } from './types';
 export interface NodeServerConfig extends HandlerConfig {
     port?: number;
     hostname?: string;
+    /**
+     * A Socket.IO handle from `createSocketIOServer` — attached to the underlying
+     * `node:http.Server` (srvx `server.node.server`) once it is listening, so
+     * Socket.IO owns the HTTP `upgrade` event on the same port.
+     */
+    socket?: {
+        attach(server: HttpServer): void;
+    };
 }
 export interface NodeServerHandle {
     url: string;

package/dist/server/node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/server/node.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7C;AAED,wBAAsB,SAAS,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgBnF"}
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/server/node.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,WAAW,CAAC;AAGtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAAA;KAAE,CAAC;CAC/C;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7C;AAED,wBAAsB,SAAS,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA6BnF"}