stitchkit 0.46.0 → 0.48.0

package/dist/{index-zwqty9zf.js → index-44xysy8r.js}

@@ -29,59 +29,431 @@ import {
   typedEntries,
   validateDeclaredOutput,
   zodIssues
-} from "./index-5s8b7z6q.js";
+} from "./index-ee621cmy.js";
 
 // src/server/multipart.ts
-var DEFAULT_MAX_UPLOAD_BYTES = 25 * 1024 * 1024;
-async function readBodyCapped(req, maxBytes) {
-  const reader = req.body?.getReader();
-  if (!reader)
-    return new Uint8Array(0);
-  const chunks = [];
-  let total = 0;
+var DEFAULT_MAX_REQUEST_BYTES = 25 * 1024 * 1024;
+var DEFAULT_MAX_FIELD_BYTES = 1024 * 1024;
+var DEFAULT_MAX_HEADER_BYTES = 64 * 1024;
+var DEFAULT_MAX_PARTS = 1000;
+var CRLF = new Uint8Array([13, 10]);
+var HEADER_END = new Uint8Array([13, 10, 13, 10]);
+var decoder = new TextDecoder;
+var encoder = new TextEncoder;
+function indexOfBytes(haystack, needle) {
+  outer:
+    for (let index = 0;index <= haystack.length - needle.length; index += 1) {
+      for (let offset = 0;offset < needle.length; offset += 1) {
+        if (haystack[index + offset] !== needle[offset])
+          continue outer;
+      }
+      return index;
+    }
+  return -1;
+}
+function startsWithBytes(value, prefix) {
+  if (value.length < prefix.length)
+    return false;
+  for (let index = 0;index < prefix.length; index += 1) {
+    if (value[index] !== prefix[index])
+      return false;
+  }
+  return true;
+}
+function concatBytes(left, right) {
+  if (left.length === 0)
+    return right.slice();
+  if (right.length === 0)
+    return left.slice();
+  const joined = new Uint8Array(left.length + right.length);
+  joined.set(left);
+  joined.set(right, left.length);
+  return joined;
+}
+function parseBoundary(req) {
+  const contentType = req.headers.get("content-type") ?? "";
+  if (!contentType.toLowerCase().startsWith("multipart/form-data")) {
+    badRequest("Request body must be multipart/form-data");
+  }
+  const match = /(?:^|;)\s*boundary=(?:"([^"]+)"|([^;\s]+))/i.exec(contentType);
+  const boundary = match?.[1] ?? match?.[2];
+  if (!boundary || boundary.length > 200)
+    badRequest("Invalid multipart boundary");
+  return boundary;
+}
+function parseDisposition(value) {
+  if (!value || !/^form-data(?:;|$)/i.test(value))
+    badRequest("Invalid multipart disposition");
+  const name = /(?:^|;)\s*name="([^"]*)"/i.exec(value)?.[1];
+  const filename = /(?:^|;)\s*filename="([^"]*)"/i.exec(value)?.[1];
+  if (!name || isUnsafeKey(name))
+    badRequest("Invalid multipart field name");
+  return filename === undefined ? { name } : { name, filename };
+}
+function parsePartHeaders(bytes) {
+  let text;
   try {
+    text = decoder.decode(bytes);
+  } catch {
+    badRequest("Invalid multipart headers");
+  }
+  const headers = new Headers;
+  for (const line of text.split(`\r
+`)) {
+    const separator = line.indexOf(":");
+    if (separator <= 0)
+      badRequest("Invalid multipart header");
+    headers.append(line.slice(0, separator).trim(), line.slice(separator + 1).trim());
+  }
+  const disposition = parseDisposition(headers.get("content-disposition") ?? undefined);
+  const rawContentType = headers.get("content-type");
+  const contentType = rawContentType?.split(";", 1)[0]?.trim().toLowerCase();
+  const rawSize = headers.get("content-length");
+  const declaredSize = rawSize === null ? undefined : Number(rawSize);
+  if (declaredSize !== undefined && (!Number.isSafeInteger(declaredSize) || declaredSize < 0)) {
+    badRequest("Invalid multipart part content-length");
+  }
+  return { ...disposition, contentType, declaredSize };
+}
+
+class MultipartStreamReader {
+  #reader;
+  #delimiter;
+  #initialBoundary;
+  #maxRequestBytes;
+  #buffer = new Uint8Array;
+  #readBytes = 0;
+  #sourceDone = false;
+  #terminal = false;
+  #activePart = false;
+  constructor(req, boundary, maxRequestBytes) {
+    if (!req.body)
+      badRequest("Multipart request body is empty");
+    this.#reader = req.body.getReader();
+    this.#delimiter = encoder.encode(`\r
+--${boundary}`);
+    this.#initialBoundary = encoder.encode(`--${boundary}`);
+    this.#maxRequestBytes = maxRequestBytes;
+  }
+  async start() {
+    await this.#ensure(this.#initialBoundary.length + 2);
+    if (!startsWithBytes(this.#buffer, this.#initialBoundary)) {
+      badRequest("Malformed multipart body");
+    }
+    this.#consume(this.#initialBoundary.length);
+    await this.#consumeBoundarySuffix();
+  }
+  async nextPart() {
+    if (this.#activePart)
+      badRequest("Multipart part stream was not fully consumed");
+    if (this.#terminal)
+      return null;
+    const header = await this.#readUntil(HEADER_END, DEFAULT_MAX_HEADER_BYTES);
+    const parsed = parsePartHeaders(header);
+    this.#activePart = true;
+    let ended = false;
+    const stream = new ReadableStream({
+      pull: async (controller) => {
+        if (ended) {
+          controller.close();
+          return;
+        }
+        try {
+          const chunk = await this.#readPartChunk();
+          if (chunk.value.length > 0)
+            controller.enqueue(chunk.value);
+          if (chunk.end) {
+            ended = true;
+            controller.close();
+          }
+        } catch (error) {
+          controller.error(error);
+          this.cancel(error);
+        }
+      },
+      cancel: (reason) => {
+        this.cancel(reason);
+      }
+    });
+    return { ...parsed, stream, consumed: () => ended };
+  }
+  cancel(reason) {
+    this.#reader.cancel(reason).catch(() => {});
+  }
+  release() {
+    this.#reader.releaseLock();
+  }
+  async#readPartChunk() {
     while (true) {
-      const { done, value } = await reader.read();
-      if (done)
-        break;
-      total += value.length;
-      if (total > maxBytes) {
-        await reader.cancel();
-        badRequest(`Upload exceeds the ${Math.round(maxBytes / 1024 / 1024)} MB limit`);
+      const boundaryIndex = indexOfBytes(this.#buffer, this.#delimiter);
+      if (boundaryIndex >= 0) {
+        const value = this.#buffer.slice(0, boundaryIndex);
+        this.#consume(boundaryIndex + this.#delimiter.length);
+        await this.#consumeBoundarySuffix();
+        this.#activePart = false;
+        return { value, end: true };
       }
-      chunks.push(value);
+      const retained = this.#delimiter.length - 1;
+      if (this.#buffer.length > retained) {
+        const emitLength = this.#buffer.length - retained;
+        const value = this.#buffer.slice(0, emitLength);
+        this.#consume(emitLength);
+        return { value, end: false };
+      }
+      if (this.#sourceDone)
+        badRequest("Incomplete multipart body");
+      await this.#readMore();
     }
-  } finally {
-    reader.releaseLock();
   }
-  const buffer = new Uint8Array(total);
+  async#consumeBoundarySuffix() {
+    await this.#ensure(2);
+    if (this.#buffer[0] === 45 && this.#buffer[1] === 45) {
+      this.#consume(2);
+      this.#terminal = true;
+      if (startsWithBytes(this.#buffer, CRLF))
+        this.#consume(2);
+      return;
+    }
+    if (!startsWithBytes(this.#buffer, CRLF))
+      badRequest("Malformed multipart boundary");
+    this.#consume(2);
+  }
+  async#readUntil(marker, maxBytes) {
+    while (true) {
+      const index = indexOfBytes(this.#buffer, marker);
+      if (index >= 0) {
+        if (index > maxBytes)
+          badRequest("Multipart part headers are too large");
+        const value = this.#buffer.slice(0, index);
+        this.#consume(index + marker.length);
+        return value;
+      }
+      if (this.#buffer.length > maxBytes)
+        badRequest("Multipart part headers are too large");
+      if (this.#sourceDone)
+        badRequest("Incomplete multipart headers");
+      await this.#readMore();
+    }
+  }
+  async#ensure(length) {
+    while (this.#buffer.length < length && !this.#sourceDone)
+      await this.#readMore();
+    if (this.#buffer.length < length)
+      badRequest("Incomplete multipart body");
+  }
+  async#readMore() {
+    const result = await this.#reader.read();
+    if (result.done) {
+      this.#sourceDone = true;
+      return;
+    }
+    this.#readBytes += result.value.length;
+    if (this.#readBytes > this.#maxRequestBytes) {
+      this.cancel();
+      badRequest(`Multipart request exceeds ${this.#maxRequestBytes} bytes`);
+    }
+    this.#buffer = concatBytes(this.#buffer, result.value);
+  }
+  #consume(length) {
+    this.#buffer = this.#buffer.slice(length);
+  }
+}
+function matchesContentType(contentType, accepted) {
+  const normalized = contentType.toLowerCase();
+  return accepted.some((candidate) => {
+    const policy = candidate.toLowerCase();
+    return policy.endsWith("/*") ? normalized.startsWith(policy.slice(0, -1)) : normalized === policy;
+  });
+}
+function limitedStream(stream, maxBytes, label, signal) {
+  const reader = stream.getReader();
+  let total = 0;
+  const cancelReader = (reason) => {
+    reader.cancel(reason).catch(() => {});
+  };
+  return new ReadableStream({
+    async pull(controller) {
+      if (signal.aborted) {
+        cancelReader(signal.reason);
+        controller.error(signal.reason ?? new DOMException("Aborted", "AbortError"));
+        return;
+      }
+      try {
+        const result = await reader.read();
+        if (result.done) {
+          controller.close();
+          reader.releaseLock();
+          return;
+        }
+        total += result.value.length;
+        if (total > maxBytes) {
+          cancelReader();
+          badRequest(`${label} exceeds ${maxBytes} bytes`);
+        }
+        controller.enqueue(result.value);
+      } catch (error) {
+        controller.error(error);
+      }
+    },
+    cancel(reason) {
+      cancelReader(reason);
+    }
+  });
+}
+async function collectFile(part, stream) {
+  const chunks = [];
+  const reader = stream.getReader();
+  while (true) {
+    const result = await reader.read();
+    if (result.done)
+      break;
+    chunks.push(Uint8Array.from(result.value).buffer);
+  }
+  return new File(chunks, part.filename ?? "upload", {
+    type: part.contentType ?? "application/octet-stream"
+  });
+}
+async function readText(stream, maxBytes) {
+  const chunks = [];
+  const reader = stream.getReader();
+  let total = 0;
+  while (true) {
+    const result = await reader.read();
+    if (result.done)
+      break;
+    total += result.value.length;
+    if (total > maxBytes) {
+      await reader.cancel();
+      badRequest(`Multipart text field exceeds ${maxBytes} bytes`);
+    }
+    chunks.push(result.value);
+  }
+  const value = new Uint8Array(total);
   let offset = 0;
   for (const chunk of chunks) {
-    buffer.set(chunk, offset);
+    value.set(chunk, offset);
     offset += chunk.length;
   }
-  return buffer;
+  return decoder.decode(value);
 }
-async function parseMultipart(req, fileField, fieldsSchema, maxBytes = DEFAULT_MAX_UPLOAD_BYTES) {
-  const body = await readBodyCapped(req, maxBytes);
-  const contentType = req.headers.get("content-type") ?? "";
-  const formData = await new Response(body, {
-    headers: { "content-type": contentType }
-  }).formData();
-  const file = formData.get(fileField);
-  if (!file || !(file instanceof File)) {
-    badRequest(`Missing file field: ${fileField}`);
+function required(policy) {
+  return policy.required !== false;
+}
+async function parseMultipart(req, descriptor, fieldsSchema, receivers) {
+  const maxRequestBytes = descriptor.maxRequestBytes ?? DEFAULT_MAX_REQUEST_BYTES;
+  const contentLength = Number(req.headers.get("content-length"));
+  if (Number.isFinite(contentLength) && contentLength > maxRequestBytes) {
+    badRequest(`Multipart request exceeds ${maxRequestBytes} bytes`);
   }
+  const boundary = parseBoundary(req);
+  const parser = new MultipartStreamReader(req, boundary, maxRequestBytes);
   const fields = {};
-  for (const [key, value] of formData.entries()) {
-    if (key === fileField)
-      continue;
-    if (isUnsafeKey(key))
-      continue;
-    if (typeof value === "string")
-      fields[key] = value;
+  const files = {};
+  const counts = new Map;
+  const cleanups = [];
+  let rolledBack = false;
+  const rollback = async () => {
+    if (rolledBack)
+      return;
+    rolledBack = true;
+    for (let index = cleanups.length - 1;index >= 0; index -= 1) {
+      try {
+        await cleanups[index]?.();
+      } catch (error) {
+        console.error("[stitchkit] multipart receiver cleanup failed", error);
+      }
+    }
+  };
+  try {
+    await parser.start();
+    let partCount = 0;
+    while (true) {
+      const part = await parser.nextPart();
+      if (!part)
+        break;
+      partCount += 1;
+      if (partCount > DEFAULT_MAX_PARTS)
+        badRequest("Too many multipart parts");
+      const policy = descriptor.files[part.name];
+      const isFile = part.filename !== undefined || part.contentType !== undefined;
+      if (!isFile) {
+        if (policy)
+          badRequest(`Multipart file field "${part.name}" must contain a file`);
+        if (Object.hasOwn(fields, part.name)) {
+          badRequest(`Duplicate multipart text field: ${part.name}`);
+        }
+        fields[part.name] = await readText(part.stream, descriptor.maxFieldBytes ?? DEFAULT_MAX_FIELD_BYTES);
+        continue;
+      }
+      if (!policy)
+        badRequest(`Unexpected multipart file field: ${part.name}`);
+      const count = (counts.get(part.name) ?? 0) + 1;
+      counts.set(part.name, count);
+      const maxFiles = policy.multiple === true ? policy.maxFiles ?? DEFAULT_MAX_PARTS : 1;
+      if (count > maxFiles)
+        badRequest(`Too many files for multipart field: ${part.name}`);
+      const contentType = part.contentType ?? "";
+      if (policy.contentTypes && !matchesContentType(contentType, policy.contentTypes)) {
+        badRequest(`Unsupported content type for multipart field "${part.name}"`);
+      }
+      const maxFileBytes = policy.maxBytes ?? maxRequestBytes;
+      if (part.declaredSize !== undefined && part.declaredSize > maxFileBytes) {
+        badRequest(`Multipart field "${part.name}" exceeds ${maxFileBytes} bytes`);
+      }
+      const stream = limitedStream(part.stream, maxFileBytes, `Multipart field "${part.name}"`, req.signal);
+      let value;
+      if (descriptor.delivery === "stream") {
+        const receiver = receivers?.[part.name];
+        if (!receiver)
+          badRequest(`Missing multipart receiver for field: ${part.name}`);
+        const result = await receiver({
+          metadata: {
+            field: part.name,
+            filename: part.filename ?? "upload",
+            contentType: contentType || "application/octet-stream",
+            size: part.declaredSize
+          },
+          stream,
+          signal: req.signal
+        });
+        cleanups.push(result.cleanup);
+        if (!part.consumed()) {
+          await stream.cancel();
+          badRequest(`Multipart receiver for "${part.name}" did not consume its stream`);
+        }
+        value = result.value;
+      } else {
+        value = await collectFile(part, stream);
+      }
+      if (policy.multiple === true) {
+        const existing = files[part.name];
+        if (Array.isArray(existing))
+          existing.push(value);
+        else
+          files[part.name] = [value];
+      } else {
+        files[part.name] = value;
+      }
+    }
+    for (const [field, policy] of Object.entries(descriptor.files)) {
+      const count = counts.get(field) ?? 0;
+      if (required(policy) && count === 0)
+        badRequest(`Missing multipart file field: ${field}`);
+      if (policy.multiple === true && count === 0 && !required(policy))
+        files[field] = [];
+    }
+    return {
+      files,
+      fields: fieldsSchema ? fieldsSchema.parse(fields) : fields,
+      rollback
+    };
+  } catch (error) {
+    parser.cancel(error);
+    await rollback();
+    throw error;
+  } finally {
+    parser.release();
   }
-  return { file, fields: fieldsSchema ? fieldsSchema.parse(fields) : fields };
 }
 
 // src/server/request-body.ts
@@ -167,17 +539,19 @@ function buildBaseContext(req, url, pathParams, traceId, clientIp) {
     ...getClientInfo(req, clientIp)
   };
 }
-async function parseRequestInto(ctx, req, url, method, maxUploadBytes, maxJsonBodyBytes) {
+function parsePathParamsInto(ctx, method) {
   if (method.paramsSchema) {
     ctx.params = method.paramsSchema.parse(ctx.params);
   }
+}
+async function parseRequestPayloadInto(ctx, req, url, method, maxJsonBodyBytes) {
   if (method.multipart) {
-    const cap = method.maxUploadBytes ?? maxUploadBytes;
-    const multipart = await parseMultipart(req, method.multipart, method.inputSchema, cap);
+    const multipart = await parseMultipart(req, method.multipart, method.inputSchema, method.multipartReceivers);
     ctx.input = multipart.fields;
-    if (multipart.file)
-      ctx.file = multipart.file;
-  } else if (method.inputSchema) {
+    ctx.files = multipart.files;
+    return multipart;
+  }
+  if (method.inputSchema) {
     if (req.method === "GET") {
       ctx.input = method.inputSchema.parse(parseQueryParams(url));
     } else if (req.method === "DELETE") {
@@ -197,6 +571,7 @@ async function parseRequestInto(ctx, req, url, method, maxUploadBytes, maxJsonBo
       ctx.input = method.inputSchema.parse(parseJsonBody(req, text));
     }
   }
+  return;
 }
 function buildErrorContext(req, url, traceId, clientIp) {
   return {
@@ -781,8 +1156,16 @@ function createHandler(config) {
     const { method, pathParams, groupHooks } = match;
     const ctx = buildBaseContext(req, url, pathParams, traceId, clientIp);
     setRequestEndpoint(method.serviceName, method.key);
+    let multipartLifecycle;
     try {
-      await parseRequestInto(ctx, req, url, method, config.maxUploadBytes, config.maxJsonBodyBytes);
+      parsePathParamsInto(ctx, method);
+      if (hooks?.authorize) {
+        await hooks.authorize(ctx, method);
+      }
+      if (groupHooks?.authorize) {
+        await groupHooks.authorize(ctx, method);
+      }
+      multipartLifecycle = await parseRequestPayloadInto(ctx, req, url, method, config.maxJsonBodyBytes);
       if (hooks?.beforeHandle) {
         await hooks.beforeHandle(ctx, method);
       }
@@ -841,6 +1224,7 @@ function createHandler(config) {
       complete(responseStatus);
       return body;
     } catch (err) {
+      await multipartLifecycle?.rollback();
       return respondError(err, ctx, method);
     }
   }
@@ -939,15 +1323,42 @@ function json(data, status, cors, req) {
 }
 
 // src/server/implement.ts
+function isStreamingImplementation(value) {
+  return typeof value === "object" && value !== null && "kind" in value && value.kind === "stitchkit.multipart.stream";
+}
+function defineMultipartStream(endpoint, config) {
+  const receivers = {};
+  for (const [key, receiver] of typedEntries(config.files)) {
+    receivers[String(key)] = receiver;
+  }
+  const declared = Object.keys(endpoint.multipart.files);
+  const configured = Object.keys(receivers);
+  if (declared.length !== configured.length || declared.some((field) => !Object.hasOwn(receivers, field))) {
+    throw new Error("Streaming multipart receivers must exactly match declared file fields");
+  }
+  return {
+    kind: "stitchkit.multipart.stream",
+    receivers,
+    execute(ctx, files) {
+      return callRuntimeHandler(config.handler, { ...ctx, files });
+    }
+  };
+}
 var HTTP_ONLY = Object.freeze(["HTTP"]);
 function implement(contract, handlers) {
   const methods = {};
   const groupScope = contract.meta.scope ?? "public";
   for (const [key, endpoint] of typedEntries(contract.endpoints)) {
     const typedHandler = handlers[key];
-    if (typeof typedHandler !== "function") {
+    const isStreaming = endpoint.multipart?.delivery === "stream";
+    if (!isStreaming && typeof typedHandler !== "function") {
       throw new Error(`[stitchkit] implement: missing handler for "${contract.meta.prefix}.${String(key)}"`);
     }
+    if (isStreaming && !isStreamingImplementation(typedHandler)) {
+      throw new Error(`[stitchkit] implement: streaming multipart endpoint "${contract.meta.prefix}.${String(key)}" must use defineMultipartStream()`);
+    }
+    const streamingHandler = isStreamingImplementation(typedHandler) ? typedHandler : undefined;
+    const regularHandler = typeof typedHandler === "function" ? typedHandler : undefined;
     methods[String(key)] = {
       method: endpoint.method,
       path: endpoint.path,
@@ -961,7 +1372,7 @@ function implement(contract, handlers) {
       inputSchema: endpoint.input,
       outputSchema: endpoint.output,
       multipart: endpoint.multipart,
-      maxUploadBytes: endpoint.maxUploadBytes,
+      multipartReceivers: streamingHandler?.receivers,
       maxJsonBodyBytes: endpoint.maxJsonBodyBytes,
       idempotent: endpoint.idempotent,
       ui: "ui" in endpoint ? endpoint.ui : undefined,
@@ -972,7 +1383,12 @@ function implement(contract, handlers) {
       rawBody: endpoint.rawBody,
       responseMeta: endpoint.responseMeta,
       contentType: "contentType" in endpoint ? endpoint.contentType : undefined,
-      handler: (ctx) => callRuntimeHandler(typedHandler, ctx)
+      handler: streamingHandler ? (ctx) => streamingHandler.execute(ctx, ctx.files ?? {}) : (ctx) => {
+        if (!regularHandler) {
+          throw new Error(`[stitchkit] implement: missing handler for "${contract.meta.prefix}.${String(key)}"`);
+        }
+        return callRuntimeHandler(regularHandler, ctx);
+      }
     };
   }
   return {
@@ -1352,4 +1768,4 @@ function socketIoLane(websocket) {
   });
 }
 
-export { parseMultipart, createHandler, implement, createImplement, bindRealtimeServer, webSocketLane, composeWebSocketHandlers, createSocketIOServer, socketIoLane };
+export { parseMultipart, createHandler, defineMultipartStream, implement, createImplement, bindRealtimeServer, webSocketLane, composeWebSocketHandlers, createSocketIOServer, socketIoLane };

package/dist/{index-pwyedf7b.js → index-45dz4m51.js}

@@ -47,6 +47,11 @@ function parseTrailingWildcard(path) {
   return wildcard;
 }
 
+// src/internal/safe-json.ts
+function isUnsafeKey(key) {
+  return key === "__proto__";
+}
+
 // src/contract/define.ts
 var ALL_TRANSPORTS = ["HTTP", "MCP", "AGENT", "CLI"];
 function defineContract(meta, endpoints) {
@@ -68,6 +73,8 @@ function defineContract(meta, endpoints) {
     if (ep.maxJsonBodyBytes !== undefined && (!Number.isSafeInteger(ep.maxJsonBodyBytes) || ep.maxJsonBodyBytes <= 0)) {
       throw new Error(`Contract "${meta.prefix}": endpoint "${key}" maxJsonBodyBytes must be a positive safe integer, received ${ep.maxJsonBodyBytes}`);
     }
+    if (ep.multipart)
+      assertMultipartEndpoint(meta.prefix, key, ep);
     if (ep.rawResponse)
       assertRawEndpoint(meta.prefix, key, ep);
     if (ep.method === "HEAD")
@@ -96,6 +103,45 @@ function defineContract(meta, endpoints) {
   }
   return { meta, endpoints };
 }
+function assertPositiveLimit(where, name, value) {
+  if (value !== undefined && (!Number.isSafeInteger(value) || value <= 0)) {
+    throw new Error(`${where} ${name} must be a positive safe integer, received ${value}`);
+  }
+}
+function assertMultipartEndpoint(prefix, key, ep) {
+  const where = `Contract "${prefix}": multipart endpoint "${key}"`;
+  if (ep.method !== "POST" && ep.method !== "PUT" && ep.method !== "PATCH") {
+    throw new Error(`${where} must use POST, PUT or PATCH`);
+  }
+  const multipart = ep.multipart;
+  if (!multipart || typeof multipart !== "object") {
+    throw new Error(`${where} must declare a multipart descriptor`);
+  }
+  assertPositiveLimit(where, "maxRequestBytes", multipart.maxRequestBytes);
+  assertPositiveLimit(where, "maxFieldBytes", multipart.maxFieldBytes);
+  const entries = Object.entries(multipart.files);
+  if (entries.length === 0)
+    throw new Error(`${where} must declare at least one file field`);
+  for (const [field, policy] of entries) {
+    if (!field || isUnsafeKey(field))
+      throw new Error(`${where} has an invalid file field name`);
+    assertPositiveLimit(`${where} field "${field}"`, "maxBytes", policy.maxBytes);
+    assertPositiveLimit(`${where} field "${field}"`, "maxFiles", policy.maxFiles);
+    if (policy.multiple !== true && policy.maxFiles !== undefined) {
+      throw new Error(`${where} field "${field}" may set maxFiles only with multiple: true`);
+    }
+    if (policy.contentTypes) {
+      if (policy.contentTypes.length === 0) {
+        throw new Error(`${where} field "${field}" contentTypes cannot be empty`);
+      }
+      for (const contentType of policy.contentTypes) {
+        if (!/^[a-z0-9!#$&^_.+-]+\/(?:[a-z0-9!#$&^_.+-]+|\*)$/i.test(contentType)) {
+          throw new Error(`${where} field "${field}" has invalid content type policy "${contentType}"`);
+        }
+      }
+    }
+  }
+}
 function assertRawEndpoint(prefix, key, ep) {
   const where = `Contract "${prefix}": raw endpoint "${key}"`;
   if (ep.output)

package/dist/{index-c40tkxcd.js → index-8ekq6res.js}

@@ -1,7 +1,7 @@
 import {
   isRecord,
   isUnsafeKey
-} from "./index-5s8b7z6q.js";
+} from "./index-ee621cmy.js";
 
 // src/observability/sanitize.ts
 var SENSITIVE_WORDS = new Set([