stitchkit 0.45.0 → 0.46.0

package/dist/index-c40tkxcd.js

@@ -0,0 +1,181 @@
+import {
+  isRecord,
+  isUnsafeKey
+} from "./index-5s8b7z6q.js";
+
+// src/observability/sanitize.ts
+var SENSITIVE_WORDS = new Set([
+  "password",
+  "passwords",
+  "passwd",
+  "pwd",
+  "secret",
+  "secrets",
+  "token",
+  "tokens",
+  "apikey",
+  "auth",
+  "authorization",
+  "bearer",
+  "cookie",
+  "cookies",
+  "credential",
+  "credentials"
+]);
+var SENSITIVE_WORD_PAIRS = new Set([
+  "apikey",
+  "privatekey",
+  "initdata",
+  "sessionid",
+  "sessionkey"
+]);
+var SENSITIVE_EXACT = new Set(["session"]);
+function splitKeyWords(key) {
+  return key.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/).filter((word) => word.length > 0);
+}
+function isSensitiveKeyDefault(key) {
+  const words = splitKeyWords(key);
+  if (words.length === 1 && SENSITIVE_EXACT.has(words[0] ?? ""))
+    return true;
+  for (let index = 0;index < words.length; index += 1) {
+    const word = words[index] ?? "";
+    if (SENSITIVE_WORDS.has(word))
+      return true;
+    const next = words[index + 1];
+    if (next !== undefined && SENSITIVE_WORD_PAIRS.has(word + next))
+      return true;
+  }
+  return false;
+}
+var DEFAULT_MAX_BYTES = 16000;
+var DEFAULT_MAX_DEPTH = 20;
+var MASK = "[redacted]";
+function redact(value, options = {}) {
+  const custom = options.sensitiveKeys;
+  const isSensitive = custom === undefined ? isSensitiveKeyDefault : (key) => {
+    custom.lastIndex = 0;
+    return custom.test(key);
+  };
+  const maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;
+  const ancestors = new Set;
+  const walk = (input, depth) => {
+    if (depth > maxDepth)
+      return "[max depth]";
+    if (input === null || input === undefined)
+      return null;
+    if (typeof input === "string" || typeof input === "number" || typeof input === "boolean") {
+      return input;
+    }
+    if (input instanceof Uint8Array || input instanceof ArrayBuffer) {
+      return { _type: "binary", size: input.byteLength };
+    }
+    if (input instanceof Blob) {
+      return { _type: "blob", size: input.size, mime: input.type };
+    }
+    if (typeof FormData !== "undefined" && input instanceof FormData) {
+      return { _type: "formdata", keys: [...input.keys()] };
+    }
+    if (input instanceof Map) {
+      if (ancestors.has(input))
+        return "[circular]";
+      ancestors.add(input);
+      const result = [...input.entries()].map(([key, value2]) => [
+        walk(key, depth + 1),
+        walk(value2, depth + 1)
+      ]);
+      ancestors.delete(input);
+      return { _type: "map", entries: result };
+    }
+    if (input instanceof Set) {
+      if (ancestors.has(input))
+        return "[circular]";
+      ancestors.add(input);
+      const values = [...input].map((item) => walk(item, depth + 1));
+      ancestors.delete(input);
+      return { _type: "set", values };
+    }
+    if (input instanceof Error) {
+      return {
+        _type: "error",
+        name: input.name,
+        message: input.message,
+        ...input.stack !== undefined && { stack: input.stack }
+      };
+    }
+    if (Array.isArray(input)) {
+      if (ancestors.has(input))
+        return "[circular]";
+      ancestors.add(input);
+      const result = input.map((item) => walk(item, depth + 1));
+      ancestors.delete(input);
+      return result;
+    }
+    if (isRecord(input)) {
+      if (ancestors.has(input))
+        return "[circular]";
+      ancestors.add(input);
+      const out = {};
+      for (const key of Object.keys(input)) {
+        if (isUnsafeKey(key))
+          continue;
+        if (isSensitive(key)) {
+          out[key] = MASK;
+          continue;
+        }
+        try {
+          out[key] = walk(Reflect.get(input, key), depth + 1);
+        } catch {
+          out[key] = "[unreadable]";
+        }
+      }
+      ancestors.delete(input);
+      return out;
+    }
+    return String(input);
+  };
+  return walk(value, 0);
+}
+function truncatePreview(value, maxBytes = DEFAULT_MAX_BYTES) {
+  const json = JSON.stringify(value);
+  const bytes = new TextEncoder().encode(json);
+  if (bytes.byteLength <= maxBytes)
+    return value;
+  let end = Math.max(0, maxBytes);
+  while (end > 0 && ((bytes[end] ?? 0) & 192) === 128)
+    end -= 1;
+  const preview = new TextDecoder().decode(bytes.subarray(0, end));
+  return {
+    _truncated: true,
+    _originalBytes: bytes.byteLength,
+    preview: `${preview}…`
+  };
+}
+function sanitizePayload(value, options = {}) {
+  if (value === undefined || value === null)
+    return null;
+  try {
+    return truncatePreview(redact(value, options), options.maxBytes ?? DEFAULT_MAX_BYTES);
+  } catch {
+    return "[unserializable]";
+  }
+}
+function measureSize(value) {
+  if (value === undefined || value === null) {
+    return { resultSize: null, responseBytes: 0 };
+  }
+  let responseBytes = 0;
+  try {
+    responseBytes = new TextEncoder().encode(JSON.stringify(value)).byteLength;
+  } catch {
+    return { resultSize: null, responseBytes: 0, unserializable: true };
+  }
+  if (Array.isArray(value)) {
+    return { resultSize: value.length, responseBytes };
+  }
+  if (isRecord(value) && Array.isArray(value.items) && "nextCursor" in value) {
+    return { resultSize: value.items.length, responseBytes };
+  }
+  return { resultSize: null, responseBytes };
+}
+
+export { redact, truncatePreview, sanitizePayload, measureSize };

package/dist/{index-r6czv7yt.js → index-pwyedf7b.js}

@@ -1,6 +1,6 @@
 import {
   mapObjectTypeBoundary
-} from "./index-s4qsmgwe.js";
+} from "./index-tss6bk5c.js";
 
 // src/contract/define.ts
 import { z } from "zod";
@@ -228,10 +228,11 @@ var STITCH_ERROR_STATUS = {
   CONFLICT: 409,
   RATE_LIMITED: 429,
   VALIDATION_ERROR: 400,
+  REALTIME_CONTRACT_VIOLATION: 500,
   INTERNAL_SERVER_ERROR: 500
 };
 function isStitchErrorCode(code) {
-  return code in STITCH_ERROR_STATUS;
+  return Object.hasOwn(STITCH_ERROR_STATUS, code);
 }
 function appError(code, message, details) {
   throw new AppError(code, message, isStitchErrorCode(code) ? STITCH_ERROR_STATUS[code] : 500, details);
@@ -342,4 +343,4 @@ function decodeCursor(cursor, schema) {
     return null;
   }
 }
-export { parseTrailingWildcard, ALL_TRANSPORTS, defineContract, AppError, notFound, badRequest, unauthorized, forbidden, conflict, rateLimited, STITCH_ERROR_STATUS, isStitchErrorCode, appError, defineErrors, createContractFactory, paginatedSchema, encodeCursor, decodeCursor };
+export { parseTrailingWildcard, AppError, notFound, badRequest, unauthorized, forbidden, conflict, rateLimited, STITCH_ERROR_STATUS, isStitchErrorCode, appError, ALL_TRANSPORTS, defineContract, defineErrors, createContractFactory, paginatedSchema, encodeCursor, decodeCursor };

package/dist/{index-6jypn22c.js → index-r1qp4rve.js}

@@ -5,9 +5,17 @@ function assertCorsConfig(config) {
   if (config.credentials && (config.origin === undefined || config.origin === "*")) {
     throw new Error("[stitchkit] cors: `credentials: true` cannot be combined with a wildcard origin. " + "Set `origin` to an explicit string or list.");
   }
+  if (config.origin === undefined) {
+    throw new Error("[stitchkit] cors: `origin` is required. Pass an explicit origin (or list), or '*' to deliberately allow every origin — omit `cors` entirely to emit no CORS headers.");
+  }
+  if (Array.isArray(config.origin) && config.origin.length === 0) {
+    throw new Error("[stitchkit] cors: `origin` cannot be an empty list. Pass explicit origins, or '*' to deliberately allow every origin.");
+  }
 }
 function resolveOrigin(config, requestOrigin) {
-  if (config.origin === undefined || config.origin === "*") {
+  if (config.origin === undefined)
+    return;
+  if (config.origin === "*") {
     return "*";
   }
   if (Array.isArray(config.origin)) {

package/dist/{index-s4qsmgwe.js → index-tss6bk5c.js}

@@ -5,6 +5,9 @@ function typedEntries(value) {
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function transportResult(value) {
+  return value;
+}
 function mapObject(source, mapper) {
   const result = {};
   for (const [key, value] of typedEntries(source)) {
@@ -18,4 +21,4 @@ function mapObjectTypeBoundary(source, mapper) {
   return mapObject(source, (key, value) => mapper(key, value));
 }
 
-export { typedEntries, isRecord, mapObject, mapObjectTypeBoundary };
+export { typedEntries, isRecord, transportResult, mapObject, mapObjectTypeBoundary };

package/dist/{index-36f1xkdb.js → index-w1s873ng.js}

@@ -6,7 +6,7 @@ import {
   isUnsafeKey,
   safeJsonParse,
   unauthorized
-} from "./index-yh0p5ddn.js";
+} from "./index-5s8b7z6q.js";
 
 // src/server/middleware/cookies.ts
 function parseCookies(header) {
@@ -157,7 +157,7 @@ function createAuthHook(config) {
     const scope = endpoint.scope ?? config.defaultScope;
     if (!scope)
       return;
-    const rule = config.rules[scope];
+    const rule = Object.hasOwn(config.rules, scope) ? config.rules[scope] : undefined;
     if (!rule) {
       throw new Error(`[stitchkit] auth: no rule for scope "${scope}"`);
     }

package/dist/index-yxpe3phd.js

@@ -0,0 +1,63 @@
+// src/internal/within-dir.ts
+import { realpath } from "node:fs/promises";
+import { sep } from "node:path";
+function isWithinDir(root, target) {
+  const base = root.endsWith(sep) ? root.slice(0, -sep.length) : root;
+  return target === root || target === base || target.startsWith(base + sep);
+}
+async function realPathWithinDir(root, target) {
+  const [realRoot, realTarget] = await Promise.all([
+    realpath(root).catch(() => null),
+    realpath(target).catch(() => null)
+  ]);
+  if (realRoot === null || realTarget === null)
+    return null;
+  return isWithinDir(realRoot, realTarget) ? realTarget : null;
+}
+
+// src/tools/json-schema.ts
+import { z } from "zod";
+function toJsonSchema(schema, io, unrepresentable = "throw", target = "draft-2020-12") {
+  return z.toJSONSchema(schema, {
+    io,
+    target,
+    unrepresentable,
+    cycles: "ref"
+  });
+}
+function isObjectNode(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function jsonSchemaFields(jsonSchema) {
+  const properties = jsonSchema.properties;
+  if (!isObjectNode(properties)) {
+    const conjunctive = Array.isArray(jsonSchema.allOf);
+    const members = conjunctive ? jsonSchema.allOf : Array.isArray(jsonSchema.oneOf) ? jsonSchema.oneOf : Array.isArray(jsonSchema.anyOf) ? jsonSchema.anyOf : [];
+    const byName = new Map;
+    for (const member of Array.isArray(members) ? members : []) {
+      if (!isObjectNode(member))
+        continue;
+      for (const field of jsonSchemaFields(member)) {
+        const existing = byName.get(field.name);
+        const required2 = existing ? conjunctive ? existing.required || field.required : existing.required && field.required : field.required;
+        byName.set(field.name, existing ? { ...field, required: required2 } : field);
+      }
+    }
+    return [...byName.values()];
+  }
+  const required = new Set(Array.isArray(jsonSchema.required) ? jsonSchema.required.filter((k) => typeof k === "string") : []);
+  const fields = [];
+  for (const [name, raw] of Object.entries(properties)) {
+    const schema = isObjectNode(raw) ? raw : {};
+    const description = typeof schema.description === "string" ? schema.description : undefined;
+    fields.push({
+      name,
+      schema,
+      required: required.has(name),
+      ...description && { description }
+    });
+  }
+  return fields;
+}
+
+export { isWithinDir, realPathWithinDir, toJsonSchema, jsonSchemaFields };