stitchkit 0.5.0 → 0.7.0

package/dist/browser/client.d.ts

@@ -1,4 +1,4 @@
-import type { ContractDef, EndpointDef, TypedHttpClient } from '../contract';
+import type { ContractDef, EndpointDef, ScopedHttpClient, TypedHttpClient } from '../contract';
 import { type HttpClient as HttpAdapter } from './http';
 /** Config for the built-in fetch client — used when no `HttpClient` is passed. */
 export interface ClientConfig {
@@ -7,10 +7,22 @@ export interface ClientConfig {
     credentials?: RequestCredentials;
     onError?: (status: number, body: unknown) => void;
 }
-/** Per-contract client tweaks — a dynamic URL `pathPrefix` and the keys it consumes. */
-export interface ContractClientConfig {
+/**
+ * The keys a `pathPrefix` consumes, as required `string` args. `never` (a plain
+ * client) collapses to `unknown`, so `EndpointArgs & unknown = EndpointArgs`.
+ */
+export type ScopedKeys<K extends string> = [K] extends [never] ? unknown : {
+    [P in K]: string;
+};
+/**
+ * Per-contract client tweaks — a dynamic URL `pathPrefix` and the keys it
+ * consumes. List the consumed keys in `stripPrefixKeys` (e.g. `['tenantId']`)
+ * and they become required, typed args on every method of the returned client —
+ * no hand-written scoped-client wrapper.
+ */
+export interface ContractClientConfig<K extends string = never> {
     pathPrefix?: string | ((args: Record<string, unknown>) => string);
-    stripPrefixKeys?: string[];
+    stripPrefixKeys?: readonly K[];
 }
 /**
  * Build a fully-typed client from a contract. Every endpoint becomes a typed
@@ -18,7 +30,7 @@ export interface ContractClientConfig {
  * (from `createHttpClient`) for cookie auth, SSR and retry, or a plain
  * `ClientConfig` for a bare fetch client.
  */
-export declare function createClient<T extends Record<string, EndpointDef>>(contract: ContractDef<T, string>, configOrClient: ClientConfig | HttpAdapter, contractConfig?: ContractClientConfig): TypedHttpClient<T>;
+export declare function createClient<T extends Record<string, EndpointDef>, const K extends string = never>(contract: ContractDef<T, string>, configOrClient: ClientConfig | HttpAdapter, contractConfig?: ContractClientConfig<K>): ScopedHttpClient<T, ScopedKeys<K>>;
 /**
  * Batch form of `createClient` — one fully-typed client per contract, built
  * from a `name → contract` registry. Each key keeps its own client type, so

package/dist/browser/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/browser/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG7E,OAAO,EAEL,KAAK,UAAU,IAAI,WAAW,EAG/B,MAAM,QAAQ,CAAC;AA8ChB,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClE,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;CACnD;AAED,wFAAwF;AACxF,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,CAAC;IAClE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EAChE,QAAQ,EAAE,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,EAChC,cAAc,EAAE,YAAY,GAAG,WAAW,EAC1C,cAAc,CAAC,EAAE,oBAAoB,GACpC,eAAe,CAAC,CAAC,CAAC,CAepB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,EAC1E,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,GAAG;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;CAAE,CAKzF"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/browser/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG/F,OAAO,EAEL,KAAK,UAAU,IAAI,WAAW,EAG/B,MAAM,QAAQ,CAAC;AA8ChB,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClE,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;CACnD;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC1D,OAAO,GACP;KAAG,CAAC,IAAI,CAAC,GAAG,MAAM;CAAE,CAAC;AAEzB;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB,CAAC,CAAC,SAAS,MAAM,GAAG,KAAK;IAC5D,UAAU,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,CAAC;IAClE,eAAe,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACrC,KAAK,CAAC,CAAC,SAAS,MAAM,GAAG,KAAK,EAE9B,QAAQ,EAAE,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,EAChC,cAAc,EAAE,YAAY,GAAG,WAAW,EAC1C,cAAc,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAAC,GACvC,gBAAgB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAepC;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,EAC1E,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,GAAG;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;CAAE,CAKzF"}

package/dist/cli.js

@@ -4,11 +4,11 @@ import {
   emitResult,
   parseCliArgs,
   pollUntilDone
-} from "./index-0ma1eqv4.js";
+} from "./index-p8byjw3e.js";
 import"./index-0ed3bx43.js";
 import"./index-x3fcszf8.js";
-import"./index-vhdvv00d.js";
-import"./index-afzt3nmx.js";
+import"./index-4843j09b.js";
+import"./index-9bk6r5ff.js";
 import"./index-kzfs85xp.js";
 import"./index-809wc1tt.js";
 import"./index-37x76zdn.js";

package/dist/contract/define.d.ts

@@ -12,6 +12,13 @@ interface EndpointDefBase {
     input?: ZodType<unknown>;
     output?: ZodType<unknown>;
     multipart?: string;
+    /**
+     * Per-route upload ceiling in bytes for a `multipart` endpoint. Overrides the
+     * server's `maxUploadBytes` default; without either, the 25 MB framework
+     * default applies. Lets an avatar (5 MB) and a video (200 MB) declare their
+     * own caps. Ignored on non-multipart endpoints.
+     */
+    maxUploadBytes?: number;
     /**
      * HTTP client timeout in ms for this endpoint. Use it for slow synchronous
      * endpoints (AI generation) that need more than the client default. A
@@ -26,6 +33,10 @@ interface EndpointDefBase {
      * app concerns the generic core does not model — a feature gate, a rate tier,
      * a cache hint, a doc/owner tag. The consumer narrows the type when reading.
      * Never surfaced in the OpenAPI document (app-private, not the HTTP contract).
+     *
+     * Declare its type as a `type` / inline literal / `satisfies` — **not an
+     * `interface`** (an interface has no implicit index signature, so it is not
+     * assignable to `Record<string, unknown>`).
      */
     meta?: Record<string, unknown>;
 }
@@ -130,8 +141,11 @@ export type TypedClient<C extends Record<string, EndpointDef>> = {
 type ExposesHttp<E> = E extends {
     expose: readonly Transport[];
 } ? 'HTTP' extends E['expose'][number] ? true : false : true;
-export type TypedHttpClient<C extends Record<string, EndpointDef>> = {
-    [K in keyof C as ExposesHttp<C[K]> extends true ? K : never]: EndpointFn<C[K]>;
+type ArgsWith<E, Extra> = EndpointArgs<E> & Extra;
+export type ScopedEndpointFn<E, Extra> = [keyof ArgsWith<E, Extra>] extends [never] ? () => Promise<EndpointOutput<E>> : (args: ArgsWith<E, Extra>) => Promise<EndpointOutput<E>>;
+export type ScopedHttpClient<C extends Record<string, EndpointDef>, Extra> = {
+    [K in keyof C as ExposesHttp<C[K]> extends true ? K : never]: ScopedEndpointFn<C[K], Extra>;
 };
+export type TypedHttpClient<C extends Record<string, EndpointDef>> = ScopedHttpClient<C, unknown>;
 export {};
 //# sourceMappingURL=define.d.ts.map

package/dist/contract/define.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define.d.ts","sourceRoot":"","sources":["../../src/contract/define.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAEtC,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;AAErE,eAAO,MAAM,cAAc,0CAA2C,CAAC;AACvE,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAExD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,KAAK,CAAC;AAE/D,UAAU,eAAe;IACvB,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,qFAAqF;IACrF,UAAU,CAAC,EAAE,SAAS,CAAC,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC;CAC3C;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,oFAAoF;IACpF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,kFAAkF;IAClF,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,mEAAmE;IACnE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,qEAAqE;IACrE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,UAAU,mBAAoB,SAAQ,eAAe;IACnD,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1B,QAAQ,CAAC,EAAE,KAAK,CAAC;CAClB;AAED,UAAU,eAAgB,SAAQ,eAAe;IAC/C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IAC9B,oEAAoE;IACpE,EAAE,CAAC,EAAE,cAAc,CAAC;IACpB,yEAAyE;IACzE,WAAW,CAAC,EAAE,uBAAuB,CAAC;CACvC;AAED,MAAM,MAAM,WAAW,GAAG,mBAAmB,GAAG,eAAe,CAAC;AAEhE,MAAM,WAAW,YAAY,CAAC,MAAM,SAAS,MAAM,GAAG,MAAM;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW,CAC1B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACnE,MAAM,SAAS,MAAM,GAAG,MAAM;IAE9B,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IAC3B,SAAS,EAAE,CAAC,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACxE,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,EACxB,SAAS,EAAE,CAAC,GACX,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC5B,wBAAgB,cAAc,CAC5B,MAAM,SAAS,MAAM,EACrB,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EAC3C,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,SAAS,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAmDjF,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAID,MAAM,WAAW,cAAc,CAAC,OAAO,GAAG,SAAS,EAAE,MAAM,GAAG,SAAS;IACrE,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAID,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;AAYtE,KAAK,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC;AAE9D,KAAK,aAAa,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,SAAS,EAAE,MAAM,CAAC,SAAS,MAAM,CAAA;CAAE,GACnE;KAAG,CAAC,IAAI,CAAC,GAAG,IAAI;CAAE,GAClB,OAAO,CAAC;AAEZ,KAAK,YAAY,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,GAClD,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,GAC5B,aAAa,CAAC,CAAC,CAAC,CAAC;AAEnB,KAAK,cAAc,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,SAAS,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;AAEpF,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC/D,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAChC,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;AAE1D,MAAM,MAAM,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI;KAC9D,CAAC,IAAI,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CACjC,CAAC;AAEF,KAAK,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,MAAM,EAAE,SAAS,SAAS,EAAE,CAAA;CAAE,GAC5D,MAAM,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAChC,IAAI,GACJ,KAAK,GACP,IAAI,CAAC;AAET,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI;KAClE,CAAC,IAAI,MAAM,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/E,CAAC"}
+{"version":3,"file":"define.d.ts","sourceRoot":"","sources":["../../src/contract/define.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAEtC,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;AAErE,eAAO,MAAM,cAAc,0CAA2C,CAAC;AACvE,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAExD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,KAAK,CAAC;AAE/D,UAAU,eAAe;IACvB,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;OAYG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,qFAAqF;IACrF,UAAU,CAAC,EAAE,SAAS,CAAC,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC;CAC3C;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,oFAAoF;IACpF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,kFAAkF;IAClF,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,mEAAmE;IACnE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,qEAAqE;IACrE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,UAAU,mBAAoB,SAAQ,eAAe;IACnD,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1B,QAAQ,CAAC,EAAE,KAAK,CAAC;CAClB;AAED,UAAU,eAAgB,SAAQ,eAAe;IAC/C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IAC9B,oEAAoE;IACpE,EAAE,CAAC,EAAE,cAAc,CAAC;IACpB,yEAAyE;IACzE,WAAW,CAAC,EAAE,uBAAuB,CAAC;CACvC;AAED,MAAM,MAAM,WAAW,GAAG,mBAAmB,GAAG,eAAe,CAAC;AAEhE,MAAM,WAAW,YAAY,CAAC,MAAM,SAAS,MAAM,GAAG,MAAM;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW,CAC1B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACnE,MAAM,SAAS,MAAM,GAAG,MAAM;IAE9B,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IAC3B,SAAS,EAAE,CAAC,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACxE,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,EACxB,SAAS,EAAE,CAAC,GACX,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC5B,wBAAgB,cAAc,CAC5B,MAAM,SAAS,MAAM,EACrB,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EAC3C,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,SAAS,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAmDjF,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAID,MAAM,WAAW,cAAc,CAAC,OAAO,GAAG,SAAS,EAAE,MAAM,GAAG,SAAS;IACrE,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAID,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;AAYtE,KAAK,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC;AAE9D,KAAK,aAAa,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,SAAS,EAAE,MAAM,CAAC,SAAS,MAAM,CAAA;CAAE,GACnE;KAAG,CAAC,IAAI,CAAC,GAAG,IAAI;CAAE,GAClB,OAAO,CAAC;AAEZ,KAAK,YAAY,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,GAClD,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,GAC5B,aAAa,CAAC,CAAC,CAAC,CAAC;AAEnB,KAAK,cAAc,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,SAAS,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;AAEpF,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC/D,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAChC,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;AAE1D,MAAM,MAAM,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI;KAC9D,CAAC,IAAI,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CACjC,CAAC;AAEF,KAAK,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,MAAM,EAAE,SAAS,SAAS,EAAE,CAAA;CAAE,GAC5D,MAAM,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAChC,IAAI,GACJ,KAAK,GACP,IAAI,CAAC;AAST,KAAK,QAAQ,CAAC,CAAC,EAAE,KAAK,IAAI,YAAY,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AAElD,MAAM,MAAM,gBAAgB,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC/E,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAChC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7D,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,KAAK,IAAI;KAC1E,CAAC,IAAI,MAAM,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;CAC5F,CAAC;AAIF,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,gBAAgB,CACnF,CAAC,EACD,OAAO,CACR,CAAC"}

package/dist/contract/errors.d.ts

@@ -42,6 +42,31 @@ export declare function forbidden(message?: string): never;
 export declare function conflict(message?: string, details?: Record<string, unknown>): never;
 /** Throw a `429 RATE_LIMITED` error. */
 export declare function rateLimited(message?: string): never;
-/** Throw an `AppError` for any `code`, mapping known codes to their HTTP status (else 500). */
+/**
+ * `code → HTTP status` for the error codes **stitchkit itself** emits — the
+ * typed helpers above, `normalizeError` (`VALIDATION_ERROR` /
+ * `INTERNAL_SERVER_ERROR`) and the router (`METHOD_NOT_ALLOWED`). This map is the
+ * single source of truth: `StitchErrorCode` is derived from its keys, so the two
+ * never drift. App-defined codes are free strings the core never sees (ADR 0002);
+ * these are stitchkit's own, published so a consumer can map stitch → app codes
+ * against a stable, typed reference instead of a hand-copied string list.
+ * → ADR 0026.
+ */
+export declare const STITCH_ERROR_STATUS: {
+    BAD_REQUEST: number;
+    UNAUTHORIZED: number;
+    FORBIDDEN: number;
+    NOT_FOUND: number;
+    METHOD_NOT_ALLOWED: number;
+    CONFLICT: number;
+    RATE_LIMITED: number;
+    VALIDATION_ERROR: number;
+    INTERNAL_SERVER_ERROR: number;
+};
+/** A code stitchkit itself emits — derived from `STITCH_ERROR_STATUS` (no dup). */
+export type StitchErrorCode = keyof typeof STITCH_ERROR_STATUS;
+/** Type guard — is `code` one of stitchkit's own error codes? */
+export declare function isStitchErrorCode(code: string): code is StitchErrorCode;
+/** Throw an `AppError` for any `code`, mapping a stitch code to its HTTP status (else 500). */
 export declare function appError(code: string, message?: string, details?: Record<string, unknown>): never;
 //# sourceMappingURL=errors.d.ts.map

package/dist/contract/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/contract/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE;QACL,2CAA2C;QAC3C,IAAI,EAAE,MAAM,CAAC;QACb,8BAA8B;QAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,gCAAgC;QAChC,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,0BAA0B;QAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED;;;;GAIG;AACH,qBAAa,QAAS,SAAQ,KAAK;aAEf,IAAI,EAAE,MAAM;aAEZ,MAAM,EAAE,MAAM;aACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;aACjC,IAAI,CAAC,EAAE,MAAM;gBAJb,IAAI,EAAE,MAAM,EAC5B,OAAO,CAAC,EAAE,MAAM,EACA,MAAM,GAAE,MAAY,EACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA,EACjC,IAAI,CAAC,EAAE,MAAM,YAAA;IAM/B,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,QAAQ;IAIxC,MAAM,IAAI,aAAa;CAUxB;AAED,qCAAqC;AACrC,wBAAgB,QAAQ,CAAC,OAAO,SAAc,GAAG,KAAK,CAErD;AAED,6EAA6E;AAC7E,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAEpF;AAED,wCAAwC;AACxC,wBAAgB,YAAY,CAAC,OAAO,SAAiB,GAAG,KAAK,CAE5D;AAED,qCAAqC;AACrC,wBAAgB,SAAS,CAAC,OAAO,SAAc,GAAG,KAAK,CAEtD;AAED,0EAA0E;AAC1E,wBAAgB,QAAQ,CAAC,OAAO,SAAa,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAEvF;AAED,wCAAwC;AACxC,wBAAgB,WAAW,CAAC,OAAO,SAAsB,GAAG,KAAK,CAEhE;AAaD,+FAA+F;AAC/F,wBAAgB,QAAQ,CACtB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,KAAK,CAEP"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/contract/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE;QACL,2CAA2C;QAC3C,IAAI,EAAE,MAAM,CAAC;QACb,8BAA8B;QAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,gCAAgC;QAChC,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,0BAA0B;QAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED;;;;GAIG;AACH,qBAAa,QAAS,SAAQ,KAAK;aAEf,IAAI,EAAE,MAAM;aAEZ,MAAM,EAAE,MAAM;aACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;aACjC,IAAI,CAAC,EAAE,MAAM;gBAJb,IAAI,EAAE,MAAM,EAC5B,OAAO,CAAC,EAAE,MAAM,EACA,MAAM,GAAE,MAAY,EACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA,EACjC,IAAI,CAAC,EAAE,MAAM,YAAA;IAM/B,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,QAAQ;IAIxC,MAAM,IAAI,aAAa;CAUxB;AAED,qCAAqC;AACrC,wBAAgB,QAAQ,CAAC,OAAO,SAAc,GAAG,KAAK,CAErD;AAED,6EAA6E;AAC7E,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAEpF;AAED,wCAAwC;AACxC,wBAAgB,YAAY,CAAC,OAAO,SAAiB,GAAG,KAAK,CAE5D;AAED,qCAAqC;AACrC,wBAAgB,SAAS,CAAC,OAAO,SAAc,GAAG,KAAK,CAEtD;AAED,0EAA0E;AAC1E,wBAAgB,QAAQ,CAAC,OAAO,SAAa,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAEvF;AAED,wCAAwC;AACxC,wBAAgB,WAAW,CAAC,OAAO,SAAsB,GAAG,KAAK,CAEhE;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;CAUE,CAAC;AAEnC,mFAAmF;AACnF,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,mBAAmB,CAAC;AAE/D,iEAAiE;AACjE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,eAAe,CAEvE;AAED,+FAA+F;AAC/F,wBAAgB,QAAQ,CACtB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,KAAK,CAOP"}

package/dist/contract/index.d.ts

@@ -1,4 +1,4 @@
-export { ALL_TRANSPORTS, type ContractDef, type ContractMeta, defineContract, type EndpointDef, type EndpointFn, type EndpointToolAnnotations, type EndpointUiMeta, type HandlerContext, type HttpMethod, type RuntimeContext, type Transport, type TransportSource, type TypedClient, type TypedHttpClient, } from './define';
-export { AppError, appError, badRequest, conflict, type ErrorEnvelope, forbidden, notFound, rateLimited, unauthorized, } from './errors';
+export { ALL_TRANSPORTS, type ContractDef, type ContractMeta, defineContract, type EndpointDef, type EndpointFn, type EndpointToolAnnotations, type EndpointUiMeta, type HandlerContext, type HttpMethod, type RuntimeContext, type ScopedEndpointFn, type ScopedHttpClient, type Transport, type TransportSource, type TypedClient, type TypedHttpClient, } from './define';
+export { AppError, appError, badRequest, conflict, type ErrorEnvelope, forbidden, isStitchErrorCode, notFound, rateLimited, STITCH_ERROR_STATUS, type StitchErrorCode, unauthorized, } from './errors';
 export { type Paginated, paginatedSchema } from './pagination';
 //# sourceMappingURL=index.d.ts.map

package/dist/contract/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/contract/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,cAAc,EACd,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,uBAAuB,EAC5B,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,eAAe,GACrB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,KAAK,aAAa,EAClB,SAAS,EACT,QAAQ,EACR,WAAW,EACX,YAAY,GACb,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,KAAK,SAAS,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/contract/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,cAAc,EACd,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,uBAAuB,EAC5B,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,eAAe,GACrB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,KAAK,aAAa,EAClB,SAAS,EACT,iBAAiB,EACjB,QAAQ,EACR,WAAW,EACX,mBAAmB,EACnB,KAAK,eAAe,EACpB,YAAY,GACb,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,KAAK,SAAS,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC"}

package/dist/contract/index.js

@@ -1,27 +1,31 @@
 import {
   ALL_TRANSPORTS,
   AppError,
+  STITCH_ERROR_STATUS,
   appError,
   badRequest,
   conflict,
   defineContract,
   forbidden,
+  isStitchErrorCode,
   notFound,
   paginatedSchema,
   rateLimited,
   unauthorized
-} from "../index-afzt3nmx.js";
+} from "../index-9bk6r5ff.js";
 import"../index-37x76zdn.js";
 export {
   unauthorized,
   rateLimited,
   paginatedSchema,
   notFound,
+  isStitchErrorCode,
   forbidden,
   defineContract,
   conflict,
   badRequest,
   appError,
+  STITCH_ERROR_STATUS,
   AppError,
   ALL_TRANSPORTS
 };

package/dist/{index-vhdvv00d.js → index-4843j09b.js}

@@ -1,6 +1,6 @@
 import {
   AppError
-} from "./index-afzt3nmx.js";
+} from "./index-9bk6r5ff.js";
 
 // src/internal/errors.ts
 import { z } from "zod";

package/dist/{index-kgjnt3hn.js → index-8hsj2qm9.js}

@@ -4,11 +4,11 @@ import {
 import {
   normalizeError,
   validateHandlerOutput
-} from "./index-vhdvv00d.js";
+} from "./index-4843j09b.js";
 import {
   AppError,
   badRequest
-} from "./index-afzt3nmx.js";
+} from "./index-9bk6r5ff.js";
 import {
   extractIp,
   getClientInfo,
@@ -129,7 +129,45 @@ function corsPreflightResponse(config, req) {
 
 // src/server/router.ts
 import { readFile, stat } from "node:fs/promises";
-import { extname, resolve } from "node:path";
+import { resolve } from "node:path";
+
+// src/server/mime.ts
+import { extname } from "node:path";
+var MIME_BY_EXT = {
+  ".html": "text/html; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".avif": "image/avif",
+  ".ico": "image/x-icon",
+  ".woff2": "font/woff2",
+  ".txt": "text/plain; charset=utf-8",
+  ".wasm": "application/wasm",
+  ".mp4": "video/mp4",
+  ".webm": "video/webm",
+  ".mov": "video/quicktime",
+  ".ogv": "video/ogg",
+  ".mp3": "audio/mpeg",
+  ".m4a": "audio/mp4",
+  ".wav": "audio/wav",
+  ".flac": "audio/flac",
+  ".oga": "audio/ogg",
+  ".ogg": "audio/ogg",
+  ".pdf": "application/pdf",
+  ".zip": "application/zip"
+};
+function mimeForPath(path) {
+  return MIME_BY_EXT[extname(path).toLowerCase()] ?? "application/octet-stream";
+}
+
+// src/server/router.ts
 function joinPath(...parts) {
   const joined = parts.filter(Boolean).map((part) => part.replace(/^\/+|\/+$/g, "")).filter(Boolean).join("/");
   return `/${joined}`;
@@ -247,22 +285,6 @@ function matchRawRoute(rawRoutes, httpMethod, pathname) {
   }
   return null;
 }
-var STATIC_MIME = {
-  ".html": "text/html; charset=utf-8",
-  ".css": "text/css; charset=utf-8",
-  ".js": "text/javascript; charset=utf-8",
-  ".mjs": "text/javascript; charset=utf-8",
-  ".json": "application/json; charset=utf-8",
-  ".svg": "image/svg+xml",
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".gif": "image/gif",
-  ".webp": "image/webp",
-  ".ico": "image/x-icon",
-  ".woff2": "font/woff2",
-  ".txt": "text/plain; charset=utf-8"
-};
 function staticRoute(prefix, dir) {
   const cleanPrefix = prefix.replace(/\/+$/, "");
   const root = resolve(dir.replace(/\/+$/, ""));
@@ -288,7 +310,7 @@ function staticRoute(prefix, dir) {
       const body = await readFile(target);
       return new Response(body, {
         headers: {
-          "Content-Type": STATIC_MIME[extname(target).toLowerCase()] ?? "application/octet-stream",
+          "Content-Type": mimeForPath(target),
           "X-Content-Type-Options": "nosniff"
         }
       });
@@ -322,12 +344,13 @@ async function readJsonBody(req) {
     badRequest("Invalid JSON body");
   }
 }
-async function buildContext(req, url, method, pathParams, traceId, clientIp) {
+async function buildContext(req, url, method, pathParams, traceId, clientIp, maxUploadBytes) {
   const parsedParams = method.paramsSchema ? method.paramsSchema.parse(pathParams) : undefined;
   let parsedInput;
   let file;
   if (method.multipart) {
-    const multipart = await parseMultipart(req, method.multipart, method.inputSchema);
+    const cap = method.maxUploadBytes ?? maxUploadBytes;
+    const multipart = await parseMultipart(req, method.multipart, method.inputSchema, cap);
     parsedInput = multipart.fields;
     file = multipart.file;
   } else if (method.inputSchema) {
@@ -410,7 +433,13 @@ function elapsedMs(startTime) {
   return performance.now() - startTime;
 }
 function safePath(pathname) {
-  return pathname.replace(/[-]/g, "");
+  let out = "";
+  for (let i = 0;i < pathname.length; i++) {
+    const code = pathname.charCodeAt(i);
+    if (code > 31 && code !== 127)
+      out += pathname.charAt(i);
+  }
+  return out;
 }
 function levelForStatus(status) {
   if (status >= 500)
@@ -574,7 +603,7 @@ function createHandler(config) {
     const { method, pathParams, groupHooks } = match;
     let ctx;
     try {
-      ctx = await buildContext(req, url, method, pathParams, traceId, clientIp);
+      ctx = await buildContext(req, url, method, pathParams, traceId, clientIp, config.maxUploadBytes);
       if (hooks?.beforeHandle) {
         await hooks.beforeHandle(ctx, method);
       }
@@ -646,7 +675,8 @@ function normalizeGroups(config) {
   const result = [];
   if (config.services) {
     for (const service of config.services) {
-      result.push({ prefix: "", service });
+      const prefix = config.scopePrefixes?.[service.scope] ?? "";
+      result.push({ prefix, service });
     }
   }
   if (config.groups) {
@@ -690,6 +720,8 @@ function implement(contract, handlers) {
       method: endpoint.method,
       path: endpoint.path,
       desc: endpoint.desc,
+      serviceName: contract.meta.prefix,
+      key: String(key),
       toolName: "toolName" in endpoint ? endpoint.toolName : undefined,
       expose: endpoint.expose,
       scope: endpoint.scope ?? groupScope,
@@ -697,6 +729,7 @@ function implement(contract, handlers) {
       inputSchema: endpoint.input,
       outputSchema: endpoint.output,
       multipart: endpoint.multipart,
+      maxUploadBytes: endpoint.maxUploadBytes,
       ui: "ui" in endpoint ? endpoint.ui : undefined,
       annotations: "annotations" in endpoint ? endpoint.annotations : undefined,
       meta: endpoint.meta,
@@ -774,25 +807,58 @@ function composeWebSocketHandlers(lanes, config) {
 
 // src/server/socket-io.ts
 var noop = () => {};
+function isModuleNotFound(err) {
+  if (typeof err !== "object" || err === null)
+    return false;
+  const code = "code" in err ? err.code : undefined;
+  const message = "message" in err && typeof err.message === "string" ? err.message : "";
+  return code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND" || message.includes("Cannot find module") || message.includes("Cannot find package");
+}
+async function importPeer(load, pkg) {
+  try {
+    return await load();
+  } catch (err) {
+    if (isModuleNotFound(err)) {
+      throw new Error(`[stitchkit] createSocketIOServer needs the optional peer "${pkg}" — install it: bun add ${pkg}`, { cause: err });
+    }
+    throw err;
+  }
+}
 async function createSocketIOServer(config) {
   const path = config.path ?? "/socket.io/";
   const onBun = "Bun" in globalThis;
   const transports = config.transports ?? (onBun ? ["websocket", "polling"] : ["websocket"]);
-  const { Server } = await import("socket.io");
+  const pingTimeout = config.pingTimeout ?? 20000;
+  const pingInterval = config.pingInterval ?? 1e4;
+  const cors = {
+    origin: config.cors.origin,
+    credentials: config.cors.credentials ?? true,
+    methods: ["GET", "POST"]
+  };
+  const { Server } = await importPeer(() => import("socket.io"), "socket.io");
   const io = new Server({
+    ...config.serverOptions,
     path,
-    cors: {
-      origin: config.cors.origin,
-      credentials: config.cors.credentials ?? true,
-      methods: ["GET", "POST"]
-    },
+    cors,
     transports,
-    pingTimeout: config.pingTimeout ?? 20000,
-    pingInterval: config.pingInterval ?? 1e4
+    pingTimeout,
+    pingInterval
   });
   if (onBun) {
-    const { Server: Engine } = await import("@socket.io/bun-engine");
-    const engine = new Engine({ path });
+    const { Server: Engine } = await importPeer(() => import("@socket.io/bun-engine"), "@socket.io/bun-engine");
+    const engineOpts = {
+      path,
+      cors,
+      pingTimeout,
+      pingInterval
+    };
+    if (config.serverOptions?.maxHttpBufferSize !== undefined) {
+      engineOpts.maxHttpBufferSize = config.serverOptions.maxHttpBufferSize;
+    }
+    if (config.serverOptions?.upgradeTimeout !== undefined) {
+      engineOpts.upgradeTimeout = config.serverOptions.upgradeTimeout;
+    }
+    const engine = new Engine(engineOpts);
     io.bind(engine);
     const { websocket } = engine.handler();
     const route = {
@@ -827,4 +893,4 @@ function socketIoLane(websocket) {
   });
 }
 
-export { parseMultipart, corsHeaders, corsPreflightResponse, staticRoute, createHandler, createServer, implement, createImplement, webSocketLane, composeWebSocketHandlers, createSocketIOServer, socketIoLane };
+export { parseMultipart, corsHeaders, corsPreflightResponse, mimeForPath, staticRoute, createHandler, createServer, implement, createImplement, webSocketLane, composeWebSocketHandlers, createSocketIOServer, socketIoLane };

package/dist/{index-afzt3nmx.js → index-9bk6r5ff.js}

@@ -72,18 +72,22 @@ function conflict(message = "Conflict", details) {
 function rateLimited(message = "Too many requests") {
   throw new AppError("RATE_LIMITED", message, 429);
 }
-var ERROR_STATUS = {
-  NOT_FOUND: 404,
+var STITCH_ERROR_STATUS = {
   BAD_REQUEST: 400,
   UNAUTHORIZED: 401,
   FORBIDDEN: 403,
+  NOT_FOUND: 404,
+  METHOD_NOT_ALLOWED: 405,
   CONFLICT: 409,
   RATE_LIMITED: 429,
   VALIDATION_ERROR: 400,
   INTERNAL_SERVER_ERROR: 500
 };
+function isStitchErrorCode(code) {
+  return code in STITCH_ERROR_STATUS;
+}
 function appError(code, message, details) {
-  throw new AppError(code, message, ERROR_STATUS[code] ?? 500, details);
+  throw new AppError(code, message, isStitchErrorCode(code) ? STITCH_ERROR_STATUS[code] : 500, details);
 }
 // src/contract/pagination.ts
 import { z } from "zod";
@@ -93,4 +97,4 @@ function paginatedSchema(itemSchema) {
     nextCursor: z.string().nullable()
   });
 }
-export { ALL_TRANSPORTS, defineContract, AppError, notFound, badRequest, unauthorized, forbidden, conflict, rateLimited, appError, paginatedSchema };
+export { ALL_TRANSPORTS, defineContract, AppError, notFound, badRequest, unauthorized, forbidden, conflict, rateLimited, STITCH_ERROR_STATUS, isStitchErrorCode, appError, paginatedSchema };

package/dist/{index-1cf8jkhf.js → index-hty3443r.js}

@@ -1,7 +1,7 @@
 import {
   forbidden,
   unauthorized
-} from "./index-afzt3nmx.js";
+} from "./index-9bk6r5ff.js";
 import {
   isUnsafeKey,
   safeJsonParse

package/dist/{index-78q1qm7v.js → index-kdkvp26v.js}

@@ -190,7 +190,7 @@ function collectQueryParams(args, skipKeys) {
 }
 function createClient(contract, configOrClient, contractConfig) {
   const client = {};
-  const makeMethod = isHttpAdapter(configOrClient) ? (endpoint) => createHttpMethod(endpoint, contract.meta.prefix, configOrClient, contractConfig) : (endpoint) => createFetchMethod(endpoint, contract.meta.prefix, configOrClient);
+  const makeMethod = isHttpAdapter(configOrClient) ? (endpoint) => createHttpMethod(endpoint, contract.meta.prefix, configOrClient, contractConfig) : (endpoint) => createFetchMethod(endpoint, contract.meta.prefix, configOrClient, contractConfig);
   for (const [key, endpoint] of typedEntries(contract.endpoints)) {
     if (endpoint.expose && !endpoint.expose.includes("HTTP"))
       continue;
@@ -257,9 +257,16 @@ function createHttpMethod(endpoint, prefix, client, config) {
     return client[httpMethod](url, Object.keys(payload).length > 0 ? payload : undefined, withTimeout(undefined, endpoint.timeout));
   };
 }
-function createFetchMethod(endpoint, prefix, config) {
+function createFetchMethod(endpoint, prefix, config, contractConfig) {
+  const prefixKeys = new Set(contractConfig?.stripPrefixKeys ?? []);
   return async (args) => {
-    let url = buildFetchUrl(config.baseUrl, prefix, endpoint.path, args);
+    let pathPrefixStr = "";
+    if (contractConfig?.pathPrefix) {
+      pathPrefixStr = typeof contractConfig.pathPrefix === "function" ? contractConfig.pathPrefix(args ?? {}) : contractConfig.pathPrefix;
+      if (pathPrefixStr && !pathPrefixStr.endsWith("/"))
+        pathPrefixStr += "/";
+    }
+    let url = buildFetchUrl(config.baseUrl, prefix, endpoint.path, args, pathPrefixStr);
     const headers = {
       Accept: "application/json",
       ...typeof config.headers === "function" ? config.headers() : config.headers
@@ -267,7 +274,7 @@ function createFetchMethod(endpoint, prefix, config) {
     const isQuery = inputIsQuery(endpoint.method);
     const hasBody = !isQuery && !endpoint.multipart && endpoint.input && args;
     if (isQuery && args) {
-      const remaining = stripParams(args, endpoint.path);
+      const remaining = stripParams(args, endpoint.path, prefixKeys);
       const searchParams = new URLSearchParams;
       for (const [k, v] of Object.entries(remaining)) {
         if (v === undefined || v === null)
@@ -291,7 +298,7 @@ function createFetchMethod(endpoint, prefix, config) {
       }
       const formData = new FormData;
       formData.append(endpoint.multipart, file);
-      appendFormFields(formData, stripParams(args, endpoint.path), new Set([endpoint.multipart]));
+      appendFormFields(formData, stripParams(args, endpoint.path, prefixKeys), new Set([endpoint.multipart]));
       const res2 = await fetch(url, {
         method: endpoint.method,
         headers,
@@ -310,7 +317,9 @@ function createFetchMethod(endpoint, prefix, config) {
       method: endpoint.method,
       headers,
       credentials: config.credentials,
-      ...hasBody && { body: JSON.stringify(stripParams(hasBody, endpoint.path)) }
+      ...hasBody && {
+        body: JSON.stringify(stripParams(hasBody, endpoint.path, prefixKeys))
+      }
     });
     if (!res.ok) {
       await throwForErrorResponse(res, config, { error: res.statusText });
@@ -341,8 +350,8 @@ function extractParamNames(path) {
   const matches = path.match(/:(\w+)/g);
   return matches ? matches.map((m) => m.slice(1)) : [];
 }
-function buildFetchUrl(baseUrl, prefix, path, args) {
-  let fullPath = `/${prefix}${path === "/" ? "" : path}`;
+function buildFetchUrl(baseUrl, prefix, path, args, pathPrefix = "") {
+  let fullPath = `/${pathPrefix}${prefix}${path === "/" ? "" : path}`;
   if (args) {
     fullPath = fullPath.replace(/:(\w+)/g, (_, key) => {
       const val = args[key];
@@ -354,15 +363,15 @@ function buildFetchUrl(baseUrl, prefix, path, args) {
   }
   return `${baseUrl}${fullPath}`;
 }
-function stripParams(args, path) {
-  const paramNames = new Set;
+function stripParams(args, path, extra) {
+  const skip = new Set(extra);
   for (const match of path.matchAll(/:(\w+)/g)) {
     if (match[1])
-      paramNames.add(match[1]);
+      skip.add(match[1]);
   }
   const result = {};
   for (const [k, v] of Object.entries(args)) {
-    if (!paramNames.has(k))
+    if (!skip.has(k))
       result[k] = v;
   }
   return result;

package/dist/{index-d4rwrjbc.js → index-mahbaen9.js}

@@ -1,6 +1,6 @@
 import {
   normalizeError
-} from "./index-vhdvv00d.js";
+} from "./index-4843j09b.js";
 
 // src/server/stream.ts
 function streamSSE(generator) {

package/dist/{index-0ma1eqv4.js → index-p8byjw3e.js}

@@ -9,7 +9,7 @@ import {
   formatZodError,
   normalizeError,
   validateHandlerOutput
-} from "./index-vhdvv00d.js";
+} from "./index-4843j09b.js";
 import {
   isUnsafeKey,
   safeJsonParse
@@ -134,12 +134,12 @@ function toolResultFromError(err) {
 async function executeToolMethod(method, toolName, rawArgs, context, hooks, lifecycle, coerceJson = false) {
   const startedAt = Date.now();
   const finish = async (result) => {
-    await hooks?.afterToolCall?.(toolName, rawArgs, result, Date.now() - startedAt, context);
+    await hooks?.afterToolCall?.(toolName, rawArgs, result, Date.now() - startedAt, context, method);
     return result;
   };
   if (hooks?.beforeToolCall) {
     try {
-      await hooks.beforeToolCall(toolName, rawArgs, context);
+      await hooks.beforeToolCall(toolName, rawArgs, context, method);
     } catch (err) {
       return finish(toolResultFromError(err));
     }