stitchkit 0.44.1 → 0.46.0

package/dist/observability/index.js

@@ -1,3 +1,9 @@
+import {
+  measureSize,
+  redact,
+  sanitizePayload,
+  truncatePreview
+} from "../index-c40tkxcd.js";
 import {
   childSpan,
   createTraceContext,
@@ -6,7 +12,6 @@ import {
   getTraceId,
   getUserId,
   isRecord,
-  isUnsafeKey,
   parseTraceparent,
   recordedErrorMessage,
   resolvePropagationContext,
@@ -17,88 +22,7 @@ import {
   setRequestError,
   setRequestUser,
   wrapInRequestContext
-} from "../index-yh0p5ddn.js";
-
-// src/observability/sanitize.ts
-var DEFAULT_SENSITIVE_KEYS = /(password|passwd|pwd|secret|token|apikey|api[-_ ]?key|auth|authorization|bearer|session|cookie|init[-_ ]?data|credential|private[-_ ]?key)/i;
-var DEFAULT_MAX_BYTES = 16000;
-var DEFAULT_MAX_DEPTH = 20;
-var MASK = "[redacted]";
-function redact(value, options = {}) {
-  const sensitive = options.sensitiveKeys ?? DEFAULT_SENSITIVE_KEYS;
-  const maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;
-  const ancestors = new Set;
-  const walk = (input, depth) => {
-    if (depth > maxDepth)
-      return "[max depth]";
-    if (input === null || input === undefined)
-      return null;
-    if (typeof input === "string" || typeof input === "number" || typeof input === "boolean") {
-      return input;
-    }
-    if (input instanceof Uint8Array || input instanceof ArrayBuffer) {
-      return { _type: "binary", size: input.byteLength };
-    }
-    if (input instanceof Blob) {
-      return { _type: "blob", size: input.size, mime: input.type };
-    }
-    if (typeof FormData !== "undefined" && input instanceof FormData) {
-      return { _type: "formdata", keys: [...input.keys()] };
-    }
-    if (Array.isArray(input)) {
-      if (ancestors.has(input))
-        return "[circular]";
-      ancestors.add(input);
-      const result = input.map((item) => walk(item, depth + 1));
-      ancestors.delete(input);
-      return result;
-    }
-    if (isRecord(input)) {
-      if (ancestors.has(input))
-        return "[circular]";
-      ancestors.add(input);
-      const out = {};
-      for (const [key, val] of Object.entries(input)) {
-        if (isUnsafeKey(key))
-          continue;
-        out[key] = sensitive.test(key) ? MASK : walk(val, depth + 1);
-      }
-      ancestors.delete(input);
-      return out;
-    }
-    return String(input);
-  };
-  return walk(value, 0);
-}
-function truncatePreview(value, maxBytes = DEFAULT_MAX_BYTES) {
-  const json = JSON.stringify(value);
-  const bytes = Buffer.byteLength(json, "utf8");
-  if (bytes <= maxBytes)
-    return value;
-  return {
-    _truncated: true,
-    _originalBytes: bytes,
-    preview: `${json.slice(0, maxBytes)}…`
-  };
-}
-function sanitizePayload(value, options = {}) {
-  if (value === undefined || value === null)
-    return null;
-  return truncatePreview(redact(value, options), options.maxBytes ?? DEFAULT_MAX_BYTES);
-}
-function measureSize(value) {
-  if (value === undefined || value === null) {
-    return { resultSize: null, responseBytes: 0 };
-  }
-  const responseBytes = Buffer.byteLength(JSON.stringify(value), "utf8");
-  if (Array.isArray(value)) {
-    return { resultSize: value.length, responseBytes };
-  }
-  if (isRecord(value) && Array.isArray(value.items) && "nextCursor" in value) {
-    return { resultSize: value.items.length, responseBytes };
-  }
-  return { resultSize: null, responseBytes };
-}
+} from "../index-5s8b7z6q.js";
 
 // src/observability/audit.ts
 function toolErrorMessage(result) {
@@ -195,52 +119,57 @@ function createObservability(config) {
           userAgent: context.userAgent,
           startedAt: new Date(Date.now() - durationMs)
         });
-      })();
+      })().catch(() => {});
     }
   } : undefined;
   const toolCall = config.tools ? {
     afterToolCall: ({ toolName, args, result, durationMs, context, endpoint, error }) => {
-      const toolConfig = config.tools;
-      if (!toolConfig)
-        return;
-      const emit = createEmitter(toolConfig);
-      const requestCtx = getRequestContext();
-      const span = requestCtx ? childSpan(requestCtx.trace) : createTraceContext();
-      const measure = result.ok ? measureSize(result.data) : { resultSize: null, responseBytes: 0 };
-      const mcp = context.source === "mcp" ? readMcpContext(context.mcp) : undefined;
-      emit({
-        source: context.source,
-        method: "TOOL",
-        httpMethod: endpoint.method,
-        path: `/${context.source}/${toolName}`,
-        serviceName: endpoint.serviceName,
-        action: endpoint.key,
-        ...requestCtx?.dimensions !== undefined && {
-          dimensions: requestCtx.dimensions
-        },
-        toolName,
-        ...mcp !== undefined && { mcp },
-        traceId: span.traceId,
-        spanId: span.spanId,
-        parentSpanId: span.parentSpanId,
-        ok: result.ok,
-        statusCode: result.ok ? 200 : 400,
-        durationMs,
-        errorCode: result.ok ? undefined : result.code,
-        errorMessage: result.ok ? undefined : auditErrorMessage(result, error),
-        ...!result.ok && result.details !== undefined && {
-          errorDetail: sanitizePayload(result.details, toolConfig.sanitize)
-        },
-        payload: sanitizePayload(args, toolConfig.sanitize),
-        resultSize: measure.resultSize,
-        responseBytes: measure.responseBytes,
-        userId: readString(context.userId),
-        authMethod: readString(context.authMethod),
-        clientId: readString(context.clientId),
-        ipAddress: readString(context.ipAddress),
-        userAgent: readString(context.userAgent),
-        startedAt: new Date(Date.now() - durationMs)
-      });
+      try {
+        const toolConfig = config.tools;
+        if (!toolConfig)
+          return;
+        const emit = createEmitter(toolConfig);
+        const requestCtx = getRequestContext();
+        const span = requestCtx ? childSpan(requestCtx.trace) : createTraceContext();
+        const measure = result.ok ? measureSize(result.data) : { resultSize: null, responseBytes: 0 };
+        const mcp = context.source === "mcp" ? readMcpContext(context.mcp) : undefined;
+        const toolPhase = mcp?.outcome === "input_required" ? "input-round" : "operation";
+        emit({
+          source: context.source,
+          method: "TOOL",
+          httpMethod: endpoint.method,
+          path: `/${context.source}/${toolName}`,
+          serviceName: endpoint.serviceName,
+          action: endpoint.key,
+          ...requestCtx?.dimensions !== undefined && {
+            dimensions: requestCtx.dimensions
+          },
+          toolName,
+          toolPhase,
+          ...mcp !== undefined && { mcp },
+          traceId: span.traceId,
+          spanId: span.spanId,
+          parentSpanId: span.parentSpanId,
+          ok: result.ok,
+          statusCode: result.ok ? 200 : 400,
+          durationMs,
+          errorCode: result.ok ? undefined : result.code,
+          errorMessage: result.ok ? undefined : auditErrorMessage(result, error),
+          ...!result.ok && result.details !== undefined && {
+            errorDetail: sanitizePayload(result.details, toolConfig.sanitize)
+          },
+          payload: sanitizePayload(args, toolConfig.sanitize),
+          resultSize: measure.resultSize,
+          responseBytes: measure.responseBytes,
+          ..."unserializable" in measure && measure.unserializable && { resultUnserializable: true },
+          userId: readString(context.userId),
+          authMethod: readString(context.authMethod),
+          clientId: readString(context.clientId),
+          ipAddress: readString(context.ipAddress),
+          userAgent: readString(context.userAgent),
+          startedAt: new Date(Date.now() - durationMs)
+        });
+      } catch {}
     }
   } : undefined;
   return {

package/dist/observability/sanitize.d.ts

@@ -4,7 +4,12 @@ export type JsonValue = string | number | boolean | null | JsonValue[] | {
 };
 /** Tuning for `redact` / `sanitizePayload`. */
 export interface SanitizeOptions {
-    /** Keys whose VALUE is masked. Default covers passwords, tokens, secrets… */
+    /**
+     * Keys whose VALUE is masked, tested against the raw key name. When omitted,
+     * the default matcher splits the key into words (camelCase, `-`, `_`, spaces)
+     * and masks it when a word IS a secret term — so `sessionToken` and
+     * `X-Api-Key` are masked while `authorId` and `sessionCount` survive.
+     */
     sensitiveKeys?: RegExp;
     /** Cap on the serialised payload — anything larger collapses to a preview. Default 16 KB. */
     maxBytes?: number;
@@ -17,6 +22,8 @@ export interface SizeMeasure {
     resultSize: number | null;
     /** Serialised byte length. */
     responseBytes: number;
+    /** Set when the value cannot be serialised at all (bigint, a cycle). */
+    unserializable?: true;
 }
 /**
  * Deep-copy `value` into a JSON-safe shape: secret-named keys masked, binary

package/dist/observability/sanitize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../src/observability/sanitize.ts"],"names":[],"mappings":"AAOA,8EAA8E;AAC9E,MAAM,MAAM,SAAS,GACjB,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,SAAS,EAAE,GACX;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAEjC,+CAA+C;AAC/C,MAAM,WAAW,eAAe;IAC9B,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6FAA6F;IAC7F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,mCAAmC;AACnC,MAAM,WAAW,WAAW;IAC1B,wEAAwE;IACxE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,8BAA8B;IAC9B,aAAa,EAAE,MAAM,CAAC;CACvB;AASD;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE,eAAoB,GAAG,SAAS,CAoD/E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,SAAoB,GAAG,SAAS,CASzF;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,eAAoB,GAC5B,SAAS,GAAG,IAAI,CAGlB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CAcvD"}
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../src/observability/sanitize.ts"],"names":[],"mappings":"AAOA,8EAA8E;AAC9E,MAAM,MAAM,SAAS,GACjB,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,SAAS,EAAE,GACX;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAEjC,+CAA+C;AAC/C,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6FAA6F;IAC7F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,mCAAmC;AACnC,MAAM,WAAW,WAAW;IAC1B,wEAAwE;IACxE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,8BAA8B;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,cAAc,CAAC,EAAE,IAAI,CAAC;CACvB;AAwED;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE,eAAoB,GAAG,SAAS,CA4F/E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,SAAoB,GAAG,SAAS,CAgBzF;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,eAAoB,GAC5B,SAAS,GAAG,IAAI,CAOlB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CAqBvD"}

package/dist/observability/trace.d.ts

@@ -20,6 +20,8 @@ export interface TraceContext {
     tracestate?: string;
     /** Valid bounded W3C baggage, retained for propagation only. */
     baggage?: string;
+    /** W3C trace flags byte, preserved end to end (for example `00` or `01`). */
+    traceFlags?: string;
 }
 /** A fresh root trace — a new trace id, a new span id, no parent. */
 export declare function createTraceContext(): TraceContext;
@@ -30,7 +32,7 @@ export declare function createTraceContext(): TraceContext;
  * missing or malformed header.
  */
 export declare function parseTraceparent(header: string | null | undefined): TraceContext | null;
-/** Render a `TraceContext` as a `traceparent` header value (sampled flag `01`). */
+/** Render a `TraceContext` with its actual W3C trace-flags byte. */
 export declare function formatTraceparent(ctx: TraceContext): string;
 /**
  * The trace for an incoming request — the caller's `traceparent` continued

package/dist/observability/trace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trace.d.ts","sourceRoot":"","sources":["../../src/observability/trace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAaD,qEAAqE;AACrE,wBAAgB,kBAAkB,IAAI,YAAY,CAEjD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,YAAY,GAAG,IAAI,CASvF;AAED,mFAAmF;AACnF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,YAAY,GAAG,MAAM,CAE3D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,YAAY,CAE9D;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CAQ5D;AAuBD;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC7C,QAAQ,CAAC,EAAE,YAAY,GACtB,YAAY,CAgBd"}
+{"version":3,"file":"trace.d.ts","sourceRoot":"","sources":["../../src/observability/trace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAaD,qEAAqE;AACrE,wBAAgB,kBAAkB,IAAI,YAAY,CAEjD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,YAAY,GAAG,IAAI,CAmBvF;AAED,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,YAAY,GAAG,MAAM,CAE3D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,YAAY,CAE9D;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CAS5D;AAuBD;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC7C,QAAQ,CAAC,EAAE,YAAY,GACtB,YAAY,CAkBd"}

package/dist/react/cache-bridge.d.ts

@@ -40,6 +40,8 @@ export interface CacheBridgeConfig<TEvents> {
     handlers: CacheBridgeHandlers<TEvents>;
     /** Window (ms) after `markFresh()` during which `isFresh()` returns true. Default 500. */
     freshWindow?: number;
+    /** Maximum remembered freshness keys. Oldest entries are evicted first. Default 1,000. */
+    maxFreshKeys?: number;
 }
 export interface CacheBridge {
     connect(): void;
@@ -47,6 +49,8 @@ export interface CacheBridge {
     /** Mark a query key as just-mutated. Call from a mutation's onSuccess so
      *  handlers can skip a stale socket echo via `ctx.isFresh()`. */
     markFresh(key: QueryKey): void;
+    /** Forget every freshness marker without changing socket subscriptions. */
+    clearFresh(): void;
 }
 export declare function createCacheBridge<TEvents>(config: CacheBridgeConfig<TEvents>): CacheBridge;
 export {};

package/dist/react/cache-bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache-bridge.d.ts","sourceRoot":"","sources":["../../src/react/cache-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEnE,wEAAwE;AACxE,MAAM,WAAW,iBAAiB,CAAC,OAAO;IACxC,EAAE,CAAC,CAAC,SAAS,MAAM,OAAO,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC;CACjF;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,WAAW,CAAC;IACzB,gFAAgF;IAChF,OAAO,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC;CACjC;AAED,oEAAoE;AACpE,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC;AAE3E,MAAM,MAAM,kBAAkB,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,kBAAkB,KAAK,IAAI,CAAC;AAE7F,MAAM,MAAM,mBAAmB,CAAC,OAAO,IAAI;KACxC,CAAC,IAAI,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;CAC7E,CAAC;AAEF,MAAM,WAAW,iBAAiB,CAAC,OAAO;IACxC,MAAM,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACnC;;;;;OAKG;IACH,WAAW,EAAE,WAAW,GAAG,CAAC,MAAM,WAAW,CAAC,CAAC;IAC/C,QAAQ,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACvC,0FAA0F;IAC1F,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,IAAI,IAAI,CAAC;IAChB,UAAU,IAAI,IAAI,CAAC;IACnB;qEACiE;IACjE,SAAS,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI,CAAC;CAChC;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,WAAW,CA8C1F"}
+{"version":3,"file":"cache-bridge.d.ts","sourceRoot":"","sources":["../../src/react/cache-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEnE,wEAAwE;AACxE,MAAM,WAAW,iBAAiB,CAAC,OAAO;IACxC,EAAE,CAAC,CAAC,SAAS,MAAM,OAAO,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC;CACjF;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,WAAW,CAAC;IACzB,gFAAgF;IAChF,OAAO,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC;CACjC;AAED,oEAAoE;AACpE,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC;AAE3E,MAAM,MAAM,kBAAkB,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,kBAAkB,KAAK,IAAI,CAAC;AAE7F,MAAM,MAAM,mBAAmB,CAAC,OAAO,IAAI;KACxC,CAAC,IAAI,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;CAC7E,CAAC;AAEF,MAAM,WAAW,iBAAiB,CAAC,OAAO;IACxC,MAAM,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACnC;;;;;OAKG;IACH,WAAW,EAAE,WAAW,GAAG,CAAC,MAAM,WAAW,CAAC,CAAC;IAC/C,QAAQ,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACvC,0FAA0F;IAC1F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0FAA0F;IAC1F,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,IAAI,IAAI,CAAC;IAChB,UAAU,IAAI,IAAI,CAAC;IACnB;qEACiE;IACjE,SAAS,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC/B,2EAA2E;IAC3E,UAAU,IAAI,IAAI,CAAC;CACpB;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,WAAW,CAsF1F"}

package/dist/react.js

@@ -1,15 +1,35 @@
 import {
   isRecord
-} from "./index-s4qsmgwe.js";
+} from "./index-tss6bk5c.js";
 
 // src/react/cache-bridge.ts
 function createCacheBridge(config) {
   const freshWindow = config.freshWindow ?? 500;
+  const maxFreshKeys = config.maxFreshKeys ?? 1000;
+  if (!Number.isFinite(freshWindow) || freshWindow < 0) {
+    throw new Error("cacheBridge.freshWindow must be a non-negative finite number");
+  }
+  if (!Number.isInteger(maxFreshKeys) || maxFreshKeys < 1) {
+    throw new Error("cacheBridge.maxFreshKeys must be a positive integer");
+  }
   const freshAt = new Map;
+  const expiryTimers = new Map;
   let unsubscribers = [];
   const isFresh = (key) => {
-    const ts = freshAt.get(JSON.stringify(key));
-    return ts !== undefined && Date.now() - ts < freshWindow;
+    const serialised = JSON.stringify(key);
+    const ts = freshAt.get(serialised);
+    if (ts === undefined)
+      return false;
+    if (Date.now() - ts < freshWindow)
+      return true;
+    freshAt.delete(serialised);
+    return false;
+  };
+  const clearFresh = () => {
+    for (const timer of expiryTimers.values())
+      clearTimeout(timer);
+    expiryTimers.clear();
+    freshAt.clear();
   };
   return {
     connect() {
@@ -31,10 +51,31 @@ function createCacheBridge(config) {
       for (const off of unsubscribers)
         off();
       unsubscribers = [];
+      clearFresh();
     },
     markFresh(key) {
-      freshAt.set(JSON.stringify(key), Date.now());
-    }
+      const serialised = JSON.stringify(key);
+      const existingTimer = expiryTimers.get(serialised);
+      if (existingTimer)
+        clearTimeout(existingTimer);
+      freshAt.delete(serialised);
+      freshAt.set(serialised, Date.now());
+      expiryTimers.set(serialised, setTimeout(() => {
+        freshAt.delete(serialised);
+        expiryTimers.delete(serialised);
+      }, freshWindow));
+      while (freshAt.size > maxFreshKeys) {
+        const oldest = freshAt.keys().next().value;
+        if (oldest === undefined)
+          break;
+        freshAt.delete(oldest);
+        const timer = expiryTimers.get(oldest);
+        if (timer)
+          clearTimeout(timer);
+        expiryTimers.delete(oldest);
+      }
+    },
+    clearFresh
   };
 }
 // src/react/cursor-query.ts

package/dist/realtime/contract.d.ts

@@ -0,0 +1,39 @@
+import type { z } from 'zod';
+import type { AppError } from '../contract/errors';
+export interface RealtimeEventDefinition<TArgs extends z.ZodType<unknown[]> = z.ZodType<unknown[]>, TAck extends z.ZodType | undefined = z.ZodType | undefined> {
+    args: TArgs;
+    ack?: TAck;
+}
+export type RealtimeEventRegistry = Record<string, RealtimeEventDefinition>;
+export interface RealtimeContract<TServerToClient extends RealtimeEventRegistry, TClientToServer extends RealtimeEventRegistry> {
+    serverToClient: TServerToClient;
+    clientToServer: TClientToServer;
+}
+export declare function defineRealtimeContract<const TServerToClient extends RealtimeEventRegistry, const TClientToServer extends RealtimeEventRegistry>(contract: RealtimeContract<TServerToClient, TClientToServer>): RealtimeContract<TServerToClient, TClientToServer>;
+export type RealtimeEventArguments<TDefinition extends RealtimeEventDefinition> = [
+    ...z.output<TDefinition['args']>,
+    ...(TDefinition extends {
+        ack: infer TAck extends z.ZodType;
+    } ? [(value: z.input<TAck>) => void] : [])
+];
+export type RealtimeEmitArguments<TDefinition extends RealtimeEventDefinition> = [
+    ...(z.input<TDefinition['args']> extends unknown[] ? z.input<TDefinition['args']> : never),
+    ...(TDefinition extends {
+        ack: infer TAck extends z.ZodType;
+    } ? [(value: z.output<TAck>) => void] : [])
+];
+export type RealtimeEventHandler<TDefinition extends RealtimeEventDefinition> = (...args: RealtimeEventArguments<TDefinition>) => void;
+export type InferRealtimeEventMap<TRegistry extends RealtimeEventRegistry> = {
+    [TEvent in keyof TRegistry]: RealtimeEventHandler<TRegistry[TEvent]>;
+};
+export type RealtimeRejectDirection = 'client-inbound' | 'client-outbound' | 'server-inbound' | 'server-outbound';
+export interface RealtimeRejectedEvent {
+    event: string;
+    direction: RealtimeRejectDirection;
+    phase: 'arguments' | 'acknowledgement';
+    reason: 'unknown-event' | 'invalid-arguments' | 'invalid-acknowledgement-value' | 'missing-acknowledgement';
+    fault: 'peer' | 'local';
+    error: AppError<'REALTIME_CONTRACT_VIOLATION'>;
+}
+export type RealtimeRejectedEventHook = (rejected: RealtimeRejectedEvent) => void | Promise<void>;
+//# sourceMappingURL=contract.d.ts.map

package/dist/realtime/contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../src/realtime/contract.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnD,MAAM,WAAW,uBAAuB,CACtC,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EACzD,IAAI,SAAS,CAAC,CAAC,OAAO,GAAG,SAAS,GAAG,CAAC,CAAC,OAAO,GAAG,SAAS;IAE1D,IAAI,EAAE,KAAK,CAAC;IACZ,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;AAE5E,MAAM,WAAW,gBAAgB,CAC/B,eAAe,SAAS,qBAAqB,EAC7C,eAAe,SAAS,qBAAqB;IAE7C,cAAc,EAAE,eAAe,CAAC;IAChC,cAAc,EAAE,eAAe,CAAC;CACjC;AAED,wBAAgB,sBAAsB,CACpC,KAAK,CAAC,eAAe,SAAS,qBAAqB,EACnD,KAAK,CAAC,eAAe,SAAS,qBAAqB,EACnD,QAAQ,EAAE,gBAAgB,CAAC,eAAe,EAAE,eAAe,CAAC,sDAE7D;AAED,MAAM,MAAM,sBAAsB,CAAC,WAAW,SAAS,uBAAuB,IAAI;IAChF,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAChC,GAAG,CAAC,WAAW,SAAS;QAAE,GAAG,EAAE,MAAM,IAAI,SAAS,CAAC,CAAC,OAAO,CAAA;KAAE,GACzD,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,GAChC,EAAE,CAAC;CACR,CAAC;AAEF,MAAM,MAAM,qBAAqB,CAAC,WAAW,SAAS,uBAAuB,IAAI;IAC/E,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,SAAS,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC;IAC1F,GAAG,CAAC,WAAW,SAAS;QAAE,GAAG,EAAE,MAAM,IAAI,SAAS,CAAC,CAAC,OAAO,CAAA;KAAE,GACzD,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,GACjC,EAAE,CAAC;CACR,CAAC;AAEF,MAAM,MAAM,oBAAoB,CAAC,WAAW,SAAS,uBAAuB,IAAI,CAC9E,GAAG,IAAI,EAAE,sBAAsB,CAAC,WAAW,CAAC,KACzC,IAAI,CAAC;AAEV,MAAM,MAAM,qBAAqB,CAAC,SAAS,SAAS,qBAAqB,IAAI;KAC1E,MAAM,IAAI,MAAM,SAAS,GAAG,oBAAoB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;CACrE,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAC/B,gBAAgB,GAChB,iBAAiB,GACjB,gBAAgB,GAChB,iBAAiB,CAAC;AAEtB,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,uBAAuB,CAAC;IACnC,KAAK,EAAE,WAAW,GAAG,iBAAiB,CAAC;IACvC,MAAM,EACF,eAAe,GACf,mBAAmB,GACnB,+BAA+B,GAC/B,yBAAyB,CAAC;IAC9B,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACxB,KAAK,EAAE,QAAQ,CAAC,6BAA6B,CAAC,CAAC;CAChD;AAED,MAAM,MAAM,yBAAyB,GAAG,CACtC,QAAQ,EAAE,qBAAqB,KAC5B,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/dist/realtime/index.d.ts

@@ -0,0 +1,3 @@
+export { defineRealtimeContract, type InferRealtimeEventMap, type RealtimeContract, type RealtimeEmitArguments, type RealtimeEventArguments, type RealtimeEventDefinition, type RealtimeEventHandler, type RealtimeEventRegistry, type RealtimeRejectDirection, type RealtimeRejectedEvent, type RealtimeRejectedEventHook, } from './contract';
+export type { ValidatedRealtimeSocket } from './socket';
+//# sourceMappingURL=index.d.ts.map

package/dist/realtime/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/realtime/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,GAC/B,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC"}

package/dist/realtime/rejection.d.ts

@@ -0,0 +1,10 @@
+import type { RealtimeRejectDirection, RealtimeRejectedEvent } from './contract';
+export declare function realtimeContractViolation(options: {
+    event: string;
+    direction: RealtimeRejectDirection;
+    phase: 'arguments' | 'acknowledgement';
+    reason: RealtimeRejectedEvent['reason'];
+    fault: RealtimeRejectedEvent['fault'];
+    cause?: unknown;
+}): RealtimeRejectedEvent;
+//# sourceMappingURL=rejection.d.ts.map

package/dist/realtime/rejection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rejection.d.ts","sourceRoot":"","sources":["../../src/realtime/rejection.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEjF,wBAAgB,yBAAyB,CAAC,OAAO,EAAE;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,uBAAuB,CAAC;IACnC,KAAK,EAAE,WAAW,GAAG,iBAAiB,CAAC;IACvC,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACxC,KAAK,EAAE,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GAAG,qBAAqB,CAkBxB"}

package/dist/realtime/socket.d.ts

@@ -0,0 +1,30 @@
+import type { StitchLogger } from '../logger';
+import type { RealtimeEmitArguments, RealtimeEventHandler, RealtimeEventRegistry, RealtimeRejectDirection, RealtimeRejectedEventHook } from './contract';
+interface ValidatedRealtimeSocketOptions<TInbound extends RealtimeEventRegistry, TOutbound extends RealtimeEventRegistry> {
+    target: object;
+    inbound: TInbound;
+    outbound: TOutbound;
+    inboundDirection: RealtimeRejectDirection;
+    outboundDirection: RealtimeRejectDirection;
+    onRejected?: RealtimeRejectedEventHook;
+    logger?: StitchLogger;
+    subscribe?: (event: string, handler: (...args: unknown[]) => void) => () => void;
+}
+/** Runtime target forms supported by the realtime adapter and their required capabilities. */
+export declare const REALTIME_TARGET_FORMS: ({
+    name: "Server";
+    capabilities: ("emit" | "off" | "on")[];
+} | {
+    name: "Socket";
+    capabilities: ("emit" | "off" | "on")[];
+} | {
+    name: "BroadcastOperator";
+    capabilities: "emit"[];
+})[];
+export interface ValidatedRealtimeSocket<TInbound extends RealtimeEventRegistry, TOutbound extends RealtimeEventRegistry> {
+    on<TEvent extends keyof TInbound & string>(event: TEvent, handler: RealtimeEventHandler<TInbound[TEvent]>): () => void;
+    emit<TEvent extends keyof TOutbound & string>(event: TEvent, ...args: RealtimeEmitArguments<TOutbound[TEvent]>): void;
+}
+export declare function createValidatedRealtimeSocket<const TInbound extends RealtimeEventRegistry, const TOutbound extends RealtimeEventRegistry>({ target, inbound, outbound, inboundDirection, outboundDirection, onRejected, logger, subscribe, }: ValidatedRealtimeSocketOptions<TInbound, TOutbound>): ValidatedRealtimeSocket<TInbound, TOutbound>;
+export {};
+//# sourceMappingURL=socket.d.ts.map

package/dist/realtime/socket.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"socket.d.ts","sourceRoot":"","sources":["../../src/realtime/socket.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,EACV,qBAAqB,EAErB,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EAEvB,yBAAyB,EAC1B,MAAM,YAAY,CAAC;AAGpB,UAAU,8BAA8B,CACtC,QAAQ,SAAS,qBAAqB,EACtC,SAAS,SAAS,qBAAqB;IAEvC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,QAAQ,CAAC;IAClB,QAAQ,EAAE,SAAS,CAAC;IACpB,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,iBAAiB,EAAE,uBAAuB,CAAC;IAC3C,UAAU,CAAC,EAAE,yBAAyB,CAAC;IACvC,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;CAClF;AAED,8FAA8F;AAC9F,eAAO,MAAM,qBAAqB;;;;;;;;;IAOhC,CAAC;AAEH,MAAM,WAAW,uBAAuB,CACtC,QAAQ,SAAS,qBAAqB,EACtC,SAAS,SAAS,qBAAqB;IAEvC,EAAE,CAAC,MAAM,SAAS,MAAM,QAAQ,GAAG,MAAM,EACvC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAC9C,MAAM,IAAI,CAAC;IACd,IAAI,CAAC,MAAM,SAAS,MAAM,SAAS,GAAG,MAAM,EAC1C,KAAK,EAAE,MAAM,EACb,GAAG,IAAI,EAAE,qBAAqB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAChD,IAAI,CAAC;CACT;AA+DD,wBAAgB,6BAA6B,CAC3C,KAAK,CAAC,QAAQ,SAAS,qBAAqB,EAC5C,KAAK,CAAC,SAAS,SAAS,qBAAqB,EAC7C,EACA,MAAM,EACN,OAAO,EACP,QAAQ,EACR,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,MAAM,EACN,SAAS,GACV,EAAE,8BAA8B,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,uBAAuB,CAC9E,QAAQ,EACR,SAAS,CACV,CA0HA"}

package/dist/server/cache.d.ts

@@ -1,9 +1,13 @@
+export interface CacheOptions {
+    /** Maximum retained entries. Oldest entries are evicted first. Default 1,000. */
+    maxEntries?: number;
+}
 /**
  * In-memory key/value cache with a per-entry TTL. Expired entries are swept on
  * a 30-second timer; `destroy()` stops it. For response `Cache-Control`
  * headers use `cacheHeaders()` instead.
  */
-export declare function createCache(): {
+export declare function createCache(options?: CacheOptions): {
     destroy: () => void;
     get(key: string): unknown | null;
     set(key: string, data: unknown, maxAgeSeconds: number): void;

package/dist/server/cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../src/server/cache.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,wBAAgB,WAAW;;aAQd,MAAM,GAAG,OAAO,GAAG,IAAI;aAUvB,MAAM,QAAQ,OAAO,iBAAiB,MAAM;uBAIlC,MAAM;;EAU5B;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,KAAK,GAAE,QAAQ,GAAG,SAAoB,GACrC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIxB"}
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../src/server/cache.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,YAAY;IAC3B,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,OAAO,GAAE,YAAiB;;aAYzC,MAAM,GAAG,OAAO,GAAG,IAAI;aAUvB,MAAM,QAAQ,OAAO,iBAAiB,MAAM;uBAalC,MAAM;;EAU5B;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,KAAK,GAAE,QAAQ,GAAG,SAAoB,GACrC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIxB"}

package/dist/server/error-hook.d.ts

@@ -21,6 +21,7 @@
  *     NOT_FOUND: 'not_found', METHOD_NOT_ALLOWED: 'not_found',
  *     CONFLICT: 'conflict', RATE_LIMITED: 'rate_limited',
  *     INTERNAL_SERVER_ERROR: 'internal',
+ *     REALTIME_CONTRACT_VIOLATION: 'internal',
  *   } satisfies Record<StitchErrorCode, string>,
  *   render: (info, ctx) => ({
  *     ok: false,

package/dist/server/error-hook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error-hook.d.ts","sourceRoot":"","sources":["../../src/server/error-hook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAEtE,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzD,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;IACb,mBAAmB;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,oCAAoC;AACpC,MAAM,WAAW,eAAe,CAAC,SAAS,SAAS,MAAM,GAAG,MAAM;IAChE;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IAC7C,uDAAuD;IACvD;;;;;OAKG;IACH,MAAM,EAAE,CACN,IAAI,EAAE,aAAa,EACnB,GAAG,EAAE,cAAc,EACnB,QAAQ,CAAC,EAAE,SAAS,KACjB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC;;;;OAIG;IACH,OAAO,CAAC,EAAE,CACR,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,aAAa,EACnB,GAAG,EAAE,cAAc,EACnB,QAAQ,CAAC,EAAE,SAAS,KACjB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC;AAED,mEAAmE;AACnE,wBAAgB,eAAe,CAAC,SAAS,SAAS,MAAM,GAAG,MAAM,EAC/D,MAAM,EAAE,eAAe,CAAC,SAAS,CAAC,GACjC,WAAW,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CA0BxC"}
+{"version":3,"file":"error-hook.d.ts","sourceRoot":"","sources":["../../src/server/error-hook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAEtE,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzD,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;IACb,mBAAmB;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,oCAAoC;AACpC,MAAM,WAAW,eAAe,CAAC,SAAS,SAAS,MAAM,GAAG,MAAM;IAChE;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IAC7C,uDAAuD;IACvD;;;;;OAKG;IACH,MAAM,EAAE,CACN,IAAI,EAAE,aAAa,EACnB,GAAG,EAAE,cAAc,EACnB,QAAQ,CAAC,EAAE,SAAS,KACjB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC;;;;OAIG;IACH,OAAO,CAAC,EAAE,CACR,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,aAAa,EACnB,GAAG,EAAE,cAAc,EACnB,QAAQ,CAAC,EAAE,SAAS,KACjB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC;AAED,mEAAmE;AACnE,wBAAgB,eAAe,CAAC,SAAS,SAAS,MAAM,GAAG,MAAM,EAC/D,MAAM,EAAE,eAAe,CAAC,SAAS,CAAC,GACjC,WAAW,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CA0BxC"}

package/dist/server/file.d.ts

@@ -1,3 +1,9 @@
+import type { RawRoute } from './types';
+/**
+ * Build a basic static-file route. URL-derived paths pass both lexical and
+ * realpath containment checks, so an in-root symlink cannot escape `dir`.
+ */
+export declare function staticRoute(prefix: string, dir: string): RawRoute;
 /** An inclusive byte range `[start, end]`. */
 export interface ByteRange {
     start: number;

package/dist/server/file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file.d.ts","sourceRoot":"","sources":["../../src/server/file.ts"],"names":[],"mappings":"AAaA,8CAA8C;AAC9C,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,IAAI,EAAE,MAAM,GACX,SAAS,GAAG,eAAe,GAAG,IAAI,CAkCpC;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9D;AA6ED,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;IACtC,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,6CAA6C;IAC7C,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwEvF"}
+{"version":3,"file":"file.d.ts","sourceRoot":"","sources":["../../src/server/file.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,QAAQ,CA4BjE;AAED,8CAA8C;AAC9C,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,IAAI,EAAE,MAAM,GACX,SAAS,GAAG,eAAe,GAAG,IAAI,CAkCpC;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9D;AA6ED,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;IACtC,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,6CAA6C;IAC7C,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwEvF"}

package/dist/server/implement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"implement.d.ts","sourceRoot":"","sources":["../../src/server/implement.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG5E,OAAO,KAAK,EAAE,QAAQ,EAAa,UAAU,EAAE,MAAM,SAAS,CAAC;AAK/D;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACrC,IAAI,SAAS,cAAc,GAAG,cAAc,EAC5C,QAAQ,EAAE,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,UAAU,CAgE3E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,SAAS,cAAc,MACjD,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,YACjC,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,YACtB,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,KAC1B,UAAU,CACd"}
+{"version":3,"file":"implement.d.ts","sourceRoot":"","sources":["../../src/server/implement.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG5E,OAAO,KAAK,EAAE,QAAQ,EAAa,UAAU,EAAE,MAAM,SAAS,CAAC;AAK/D;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACrC,IAAI,SAAS,cAAc,GAAG,cAAc,EAC5C,QAAQ,EAAE,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,UAAU,CAoE3E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,SAAS,cAAc,MACjD,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,YACjC,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,YACtB,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,KAC1B,UAAU,CACd"}

package/dist/server/index.d.ts

@@ -2,11 +2,11 @@ export { AppError, appError, badRequest, conflict, forbidden, isStitchErrorCode,
 export { errorCode, formatZodError, normalizeError, type ZodIssueSummary, zodIssues, } from '../internal/errors';
 export { isWithinDir } from '../internal/within-dir';
 export { type BunFetchComposition as FetchComposition, type BunFetchHandler as FetchHandler, type BunHandlerConfig as HandlerConfig, type BunRawRoute as RawRoute, type BunRawRouteContext as RawRouteContext, type BunServer, type BunServerConfig, createServer, type ServerPassthrough, } from './bun';
-export { cacheHeaders, createCache } from './cache';
+export { type CacheOptions, cacheHeaders, createCache } from './cache';
 export { createHandler } from './create';
 export { createErrorHook, type ErrorHookConfig, type ResolvedError, } from './error-hook';
 export { createEventBus, type DefaultEventMap, type EventBus, type EventBusOptions, type EventHandler, } from './event-bus';
-export { type ByteRange, parseByteRange, type ServeFileOptions, serveFile, weakETag, } from './file';
+export { type ByteRange, parseByteRange, type ServeFileOptions, serveFile, staticRoute, weakETag, } from './file';
 export { createImplement, implement } from './implement';
 export type { LogFormat } from './logger';
 export { type AuthHook, type AuthHookConfig, type AuthRule, type BearerResolverConfig, createAuthHook, createBearerResolver, extractToken, type JwtPayload, type SignJwtOptions, signJwt, type VerifyJwtOptions, verifyJwt, } from './middleware/auth';
@@ -17,8 +17,8 @@ export { type MultipartResult, parseMultipart } from './multipart';
 export { generateOpenApiDocument, type OpenApiConfig, type OpenApiDocument, type OpenApiInfo, type OpenApiServer, openApiRoute, } from './openapi';
 export { createRateLimiter, type RateLimitConfig } from './rate-limit';
 export { errorResponse, parseBody, respondJson } from './raw';
+export { bindRealtimeServer, type RealtimeServer, type RealtimeServerConnection, type RealtimeServerHandle, } from './realtime';
 export { type ClientIpOptions, extractIp, generateTraceId, getClientInfo, resolveSocketIp, resolveTraceId, } from './request';
-export { staticRoute } from './router';
 export type { SocketIOServerConfig, SocketIOServerHandle } from './socket-io';
 export { createSocketIOServer, socketIoLane } from './socket-io';
 export { type ParseSSEOptions, parseSSE, streamSSE } from './stream';

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,SAAS,EACT,iBAAiB,EACjB,QAAQ,EACR,WAAW,EACX,mBAAmB,EACnB,KAAK,eAAe,EACpB,YAAY,GACb,MAAM,aAAa,CAAC;AAIrB,OAAO,EACL,SAAS,EACT,cAAc,EACd,cAAc,EACd,KAAK,eAAe,EACpB,SAAS,GACV,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EACL,KAAK,mBAAmB,IAAI,gBAAgB,EAC5C,KAAK,eAAe,IAAI,YAAY,EACpC,KAAK,gBAAgB,IAAI,aAAa,EACtC,KAAK,WAAW,IAAI,QAAQ,EAC5B,KAAK,kBAAkB,IAAI,eAAe,EAC1C,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,YAAY,EACZ,KAAK,iBAAiB,GACvB,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,SAAS,EACd,cAAc,EACd,KAAK,gBAAgB,EACrB,SAAS,EACT,QAAQ,GACT,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,YAAY,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,oBAAoB,EACzB,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,OAAO,EACP,KAAK,gBAAgB,EACrB,SAAS,GACV,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,UAAU,EACf,WAAW,EACX,qBAAqB,EACrB,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,KAAK,UAAU,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACrF,OAAO,EAAE,KAAK,eAAe,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EACL,uBAAuB,EACvB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,YAAY,GACb,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AAC9D,OAAO,EACL,KAAK,eAAe,EACpB,SAAS,EACT,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,YAAY,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,KAAK,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrE,YAAY,EACV,QAAQ,EACR,cAAc,EACd,aAAa,EACb,UAAU,EACV,SAAS,EACT,iBAAiB,EACjB,UAAU,EACV,UAAU,EACV,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,KAAK,YAAY,EACjB,wBAAwB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,aAAa,GACd,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,SAAS,EACT,iBAAiB,EACjB,QAAQ,EACR,WAAW,EACX,mBAAmB,EACnB,KAAK,eAAe,EACpB,YAAY,GACb,MAAM,aAAa,CAAC;AAIrB,OAAO,EACL,SAAS,EACT,cAAc,EACd,cAAc,EACd,KAAK,eAAe,EACpB,SAAS,GACV,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EACL,KAAK,mBAAmB,IAAI,gBAAgB,EAC5C,KAAK,eAAe,IAAI,YAAY,EACpC,KAAK,gBAAgB,IAAI,aAAa,EACtC,KAAK,WAAW,IAAI,QAAQ,EAC5B,KAAK,kBAAkB,IAAI,eAAe,EAC1C,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,YAAY,EACZ,KAAK,iBAAiB,GACvB,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,KAAK,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,SAAS,EACd,cAAc,EACd,KAAK,gBAAgB,EACrB,SAAS,EACT,WAAW,EACX,QAAQ,GACT,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,YAAY,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,oBAAoB,EACzB,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,OAAO,EACP,KAAK,gBAAgB,EACrB,SAAS,GACV,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,UAAU,EACf,WAAW,EACX,qBAAqB,EACrB,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,KAAK,UAAU,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACrF,OAAO,EAAE,KAAK,eAAe,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EACL,uBAAuB,EACvB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,YAAY,GACb,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AAC9D,OAAO,EACL,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,GAC1B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,eAAe,EACpB,SAAS,EACT,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,KAAK,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrE,YAAY,EACV,QAAQ,EACR,cAAc,EACd,aAAa,EACb,UAAU,EACV,SAAS,EACT,iBAAiB,EACjB,UAAU,EACV,UAAU,EACV,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,KAAK,YAAY,EACjB,wBAAwB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,aAAa,GACd,MAAM,aAAa,CAAC"}