stitchkit 0.45.0 → 0.47.0

package/dist/{index-36f1xkdb.js → index-nrytvb30.js}

@@ -6,7 +6,7 @@ import {
   isUnsafeKey,
   safeJsonParse,
   unauthorized
-} from "./index-yh0p5ddn.js";
+} from "./index-ee621cmy.js";
 
 // src/server/middleware/cookies.ts
 function parseCookies(header) {
@@ -151,13 +151,13 @@ function extractToken(req, cookieName) {
 function createAuthHook(config) {
   const onAnonymous = config.onAnonymous ?? (() => unauthorized());
   const onForbidden = config.onForbidden ?? (() => forbidden());
-  return async (ctx, endpoint) => {
+  async function auth(ctx, endpoint) {
     const identity = ctx.source === "http" ? await config.resolve(ctx) : await config.resolveFromContext?.(ctx) ?? null;
     config.inject?.(ctx, identity);
     const scope = endpoint.scope ?? config.defaultScope;
     if (!scope)
       return;
-    const rule = config.rules[scope];
+    const rule = Object.hasOwn(config.rules, scope) ? config.rules[scope] : undefined;
     if (!rule) {
       throw new Error(`[stitchkit] auth: no rule for scope "${scope}"`);
     }
@@ -171,7 +171,8 @@ function createAuthHook(config) {
       return;
     if (!await rule(identity, ctx))
       onForbidden();
-  };
+  }
+  return auth;
 }
 function createBearerResolver(config) {
   return async (req) => {

package/dist/{index-6jypn22c.js → index-r1qp4rve.js}

@@ -5,9 +5,17 @@ function assertCorsConfig(config) {
   if (config.credentials && (config.origin === undefined || config.origin === "*")) {
     throw new Error("[stitchkit] cors: `credentials: true` cannot be combined with a wildcard origin. " + "Set `origin` to an explicit string or list.");
   }
+  if (config.origin === undefined) {
+    throw new Error("[stitchkit] cors: `origin` is required. Pass an explicit origin (or list), or '*' to deliberately allow every origin — omit `cors` entirely to emit no CORS headers.");
+  }
+  if (Array.isArray(config.origin) && config.origin.length === 0) {
+    throw new Error("[stitchkit] cors: `origin` cannot be an empty list. Pass explicit origins, or '*' to deliberately allow every origin.");
+  }
 }
 function resolveOrigin(config, requestOrigin) {
-  if (config.origin === undefined || config.origin === "*") {
+  if (config.origin === undefined)
+    return;
+  if (config.origin === "*") {
     return "*";
   }
   if (Array.isArray(config.origin)) {

package/dist/{index-s4qsmgwe.js → index-tss6bk5c.js}

@@ -5,6 +5,9 @@ function typedEntries(value) {
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function transportResult(value) {
+  return value;
+}
 function mapObject(source, mapper) {
   const result = {};
   for (const [key, value] of typedEntries(source)) {
@@ -18,4 +21,4 @@ function mapObjectTypeBoundary(source, mapper) {
   return mapObject(source, (key, value) => mapper(key, value));
 }
 
-export { typedEntries, isRecord, mapObject, mapObjectTypeBoundary };
+export { typedEntries, isRecord, transportResult, mapObject, mapObjectTypeBoundary };

package/dist/index-yxpe3phd.js

@@ -0,0 +1,63 @@
+// src/internal/within-dir.ts
+import { realpath } from "node:fs/promises";
+import { sep } from "node:path";
+function isWithinDir(root, target) {
+  const base = root.endsWith(sep) ? root.slice(0, -sep.length) : root;
+  return target === root || target === base || target.startsWith(base + sep);
+}
+async function realPathWithinDir(root, target) {
+  const [realRoot, realTarget] = await Promise.all([
+    realpath(root).catch(() => null),
+    realpath(target).catch(() => null)
+  ]);
+  if (realRoot === null || realTarget === null)
+    return null;
+  return isWithinDir(realRoot, realTarget) ? realTarget : null;
+}
+
+// src/tools/json-schema.ts
+import { z } from "zod";
+function toJsonSchema(schema, io, unrepresentable = "throw", target = "draft-2020-12") {
+  return z.toJSONSchema(schema, {
+    io,
+    target,
+    unrepresentable,
+    cycles: "ref"
+  });
+}
+function isObjectNode(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function jsonSchemaFields(jsonSchema) {
+  const properties = jsonSchema.properties;
+  if (!isObjectNode(properties)) {
+    const conjunctive = Array.isArray(jsonSchema.allOf);
+    const members = conjunctive ? jsonSchema.allOf : Array.isArray(jsonSchema.oneOf) ? jsonSchema.oneOf : Array.isArray(jsonSchema.anyOf) ? jsonSchema.anyOf : [];
+    const byName = new Map;
+    for (const member of Array.isArray(members) ? members : []) {
+      if (!isObjectNode(member))
+        continue;
+      for (const field of jsonSchemaFields(member)) {
+        const existing = byName.get(field.name);
+        const required2 = existing ? conjunctive ? existing.required || field.required : existing.required && field.required : field.required;
+        byName.set(field.name, existing ? { ...field, required: required2 } : field);
+      }
+    }
+    return [...byName.values()];
+  }
+  const required = new Set(Array.isArray(jsonSchema.required) ? jsonSchema.required.filter((k) => typeof k === "string") : []);
+  const fields = [];
+  for (const [name, raw] of Object.entries(properties)) {
+    const schema = isObjectNode(raw) ? raw : {};
+    const description = typeof schema.description === "string" ? schema.description : undefined;
+    fields.push({
+      name,
+      schema,
+      required: required.has(name),
+      ...description && { description }
+    });
+  }
+  return fields;
+}
+
+export { isWithinDir, realPathWithinDir, toJsonSchema, jsonSchemaFields };

package/dist/index.d.ts

@@ -4,6 +4,7 @@ export type { RealtimeClient, RealtimeClientOptions, SocketEventMap, SocketIOCli
 export { createRealtimeClient, createSocketIOClient } from './browser/socket-io';
 export { type ParseSSEOptions, parseSSE } from './browser/stream';
 export * from './contract';
+export type { StitchLogger } from './logger';
 export { childSpan, createTraceContext, formatTraceparent, parseTraceparent, type TraceContext, } from './observability/trace';
 export * from './realtime';
 export { createRetainedTopics, type RetainedTopics } from './retained';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,wBAAwB,EACxB,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,QAAQ,EACR,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,mBAAmB,GACzB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,cAAc,EACd,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,KAAK,eAAe,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAClE,cAAc,YAAY,CAAC;AAG3B,OAAO,EACL,SAAS,EACT,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,YAAY,GAClB,MAAM,uBAAuB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,wBAAwB,EACxB,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,QAAQ,EACR,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,mBAAmB,GACzB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,cAAc,EACd,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,KAAK,eAAe,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAClE,cAAc,YAAY,CAAC;AAC3B,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAG7C,OAAO,EACL,SAAS,EACT,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,YAAY,GAClB,MAAM,uBAAuB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC"}