stitchkit 0.50.0 → 0.52.0

package/dist/cli.js

@@ -4,10 +4,10 @@ import {
   emitResult,
   parseCliArgs,
   pollUntilDone
-} from "./index-0hj37z43.js";
+} from "./index-h55e1wyq.js";
 import"./index-yxpe3phd.js";
-import"./index-jewp9r0a.js";
-import"./index-h05ygjqx.js";
+import"./index-8qghvg18.js";
+import"./index-bmnhqtya.js";
 export {
   pollUntilDone,
   parseCliArgs,

package/dist/{index-jewp9r0a.js → index-8qghvg18.js}

@@ -1,7 +1,7 @@
 import {
   isRecord,
   resolveTraceContext
-} from "./index-h05ygjqx.js";
+} from "./index-bmnhqtya.js";
 
 // src/contract/errors.ts
 var APP_ERROR_BRAND = Symbol.for("stitchkit.AppError");

package/dist/{index-h05ygjqx.js → index-bmnhqtya.js}

@@ -136,6 +136,9 @@ function callRuntimeHandler(handler, context) {
   }
   return Reflect.apply(handler, undefined, [context]);
 }
+function transportResult(value) {
+  return value;
+}
 function mapObject(source, mapper) {
   const result = {};
   for (const [key, value] of typedEntries(source)) {
@@ -146,4 +149,4 @@ function mapObject(source, mapper) {
   return result;
 }
 
-export { __require, parseTrailingWildcard, typedEntries, isRecord, callRuntimeHandler, mapObject, createTraceContext, parseTraceparent, formatTraceparent, resolveTraceContext, childSpan, resolvePropagationContext };
+export { __require, parseTrailingWildcard, typedEntries, isRecord, callRuntimeHandler, transportResult, mapObject, createTraceContext, parseTraceparent, formatTraceparent, resolveTraceContext, childSpan, resolvePropagationContext };

package/dist/{index-a4qmxybq.js → index-d6jj3cp5.js}

@@ -2,7 +2,7 @@ import {
   assertCorsConfig,
   corsHeaders,
   corsPreflightResponse
-} from "./index-r1qp4rve.js";
+} from "./index-drsnz8gw.js";
 import {
   AppError,
   badRequest,
@@ -11,7 +11,6 @@ import {
   getClientInfo,
   getRequestContext,
   isUnsafeKey,
-  mergeMeta,
   normalizeError,
   parseQueryParams,
   recordedErrorMessage,
@@ -23,15 +22,13 @@ import {
   setRequestError,
   validateDeclaredOutput,
   zodIssues
-} from "./index-jewp9r0a.js";
+} from "./index-8qghvg18.js";
 import {
   __require,
-  callRuntimeHandler,
   isRecord,
   parseTrailingWildcard,
-  resolveTraceContext,
-  typedEntries
-} from "./index-h05ygjqx.js";
+  resolveTraceContext
+} from "./index-bmnhqtya.js";
 
 // src/server/multipart.ts
 var DEFAULT_MAX_REQUEST_BYTES = 25 * 1024 * 1024;
@@ -1607,152 +1604,6 @@ function createServerLifecycle(getAdapter) {
   };
 }
 
-// src/server/implement.ts
-function isStreamingImplementation(value) {
-  return typeof value === "object" && value !== null && "kind" in value && value.kind === "stitchkit.multipart.stream";
-}
-function defineMultipartStream(endpoint, config) {
-  return buildMultipartStream(endpoint, config.files, config.handler);
-}
-function buildMultipartStream(endpoint, files, handler) {
-  const receivers = {};
-  for (const [key, receiver] of typedEntries(files)) {
-    receivers[String(key)] = receiver;
-  }
-  const declared = Object.keys(endpoint.multipart.files);
-  const configured = Object.keys(receivers);
-  if (declared.length !== configured.length || declared.some((field) => !Object.hasOwn(receivers, field))) {
-    throw new Error("Streaming multipart receivers must exactly match declared file fields");
-  }
-  return {
-    kind: "stitchkit.multipart.stream",
-    receivers,
-    execute(ctx, streamedFiles) {
-      return callRuntimeHandler(handler, { ...ctx, files: streamedFiles });
-    }
-  };
-}
-function createMultipartStream() {
-  return (endpoint, config) => buildMultipartStream(endpoint, config.files, config.handler);
-}
-var HTTP_ONLY = Object.freeze(["HTTP"]);
-function bindContract(contract, handlers) {
-  const methods = {};
-  const groupScope = contract.meta.scope ?? "public";
-  for (const [key, endpoint] of typedEntries(contract.endpoints)) {
-    const typedHandler = handlers[String(key)];
-    const isStreaming = endpoint.multipart?.delivery === "stream";
-    if (!isStreaming && typeof typedHandler !== "function") {
-      throw new Error(`[stitchkit] implement: missing handler for "${contract.meta.prefix}.${String(key)}"`);
-    }
-    if (isStreaming && !isStreamingImplementation(typedHandler)) {
-      throw new Error(`[stitchkit] implement: streaming multipart endpoint "${contract.meta.prefix}.${String(key)}" must use defineMultipartStream()`);
-    }
-    const streamingHandler = isStreamingImplementation(typedHandler) ? typedHandler : undefined;
-    const regularHandler = typeof typedHandler === "function" ? typedHandler : undefined;
-    methods[String(key)] = {
-      method: endpoint.method,
-      path: endpoint.path,
-      desc: endpoint.desc,
-      serviceName: contract.meta.prefix,
-      key: String(key),
-      toolName: "toolName" in endpoint ? endpoint.toolName : undefined,
-      expose: endpoint.rawResponse || endpoint.rawBody || endpoint.responseMeta ? HTTP_ONLY : endpoint.expose,
-      scope: endpoint.scope ?? groupScope,
-      paramsSchema: endpoint.params,
-      inputSchema: endpoint.input,
-      outputSchema: endpoint.output,
-      multipart: endpoint.multipart,
-      multipartReceivers: streamingHandler?.receivers,
-      maxJsonBodyBytes: endpoint.maxJsonBodyBytes,
-      idempotent: endpoint.idempotent,
-      ui: "ui" in endpoint ? endpoint.ui : undefined,
-      annotations: "annotations" in endpoint ? endpoint.annotations : undefined,
-      mcp: "mcp" in endpoint ? endpoint.mcp : undefined,
-      meta: mergeMeta(contract.meta.meta, endpoint.meta),
-      rawResponse: endpoint.rawResponse,
-      rawBody: endpoint.rawBody,
-      responseMeta: endpoint.responseMeta,
-      contentType: "contentType" in endpoint ? endpoint.contentType : undefined,
-      handler: streamingHandler ? (ctx) => streamingHandler.execute(ctx, ctx.files ?? {}) : (ctx) => {
-        if (!regularHandler) {
-          throw new Error(`[stitchkit] implement: missing handler for "${contract.meta.prefix}.${String(key)}"`);
-        }
-        return callRuntimeHandler(regularHandler, ctx);
-      }
-    };
-  }
-  return {
-    name: contract.meta.prefix,
-    prefix: contract.meta.prefix,
-    scope: groupScope,
-    methods
-  };
-}
-function implement(contract, handlers) {
-  return bindContract(contract, handlers);
-}
-function createImplement() {
-  return (contract, handlers) => implement(contract, handlers);
-}
-function createScopedImplement() {
-  const implementScoped = (contract, handlers) => bindContract(contract, handlers);
-  const stream = (scope, endpoint, config) => {
-    if (endpoint.scope !== undefined && endpoint.scope !== scope) {
-      throw new Error(`[stitchkit] createScopedImplement.stream: endpoint declares scope "${endpoint.scope}" but "${String(scope)}" was given`);
-    }
-    return buildMultipartStream(endpoint, config.files, config.handler);
-  };
-  return Object.assign(implementScoped, { stream });
-}
-function createScopedImplementRegistry() {
-  return (contracts, handlers) => bindRegistry(contracts, handlers);
-}
-function isImplementationContract(value) {
-  return isRecord(value) && isRecord(value.meta) && typeof value.meta.prefix === "string" && isRecord(value.endpoints);
-}
-function bindRegistry(contracts, handlers) {
-  const contractKeys = Object.keys(contracts);
-  const handlerKeys = Object.keys(handlers);
-  const missing = contractKeys.filter((key) => !Object.hasOwn(handlers, key));
-  const extra = handlerKeys.filter((key) => !Object.hasOwn(contracts, key));
-  if (missing.length > 0 || extra.length > 0) {
-    throw new Error(`[stitchkit] implementRegistry: registry mismatch (missing: ${missing.join(", ") || "none"}; extra: ${extra.join(", ") || "none"})`);
-  }
-  const prefixes = new Map;
-  const services = [];
-  for (const [key, candidate] of Object.entries(contracts)) {
-    if (!isImplementationContract(candidate)) {
-      throw new TypeError(`[stitchkit] implementRegistry: registry entry "${key}" must be one contract; composed arrays and namespaces are not supported`);
-    }
-    const contract = candidate;
-    const previousKey = prefixes.get(contract.meta.prefix);
-    if (previousKey !== undefined) {
-      throw new Error(`[stitchkit] implementRegistry: duplicate contract prefix "${contract.meta.prefix}" at "${previousKey}" and "${key}"`);
-    }
-    prefixes.set(contract.meta.prefix, key);
-    const entryHandlers = handlers[key];
-    if (!isRecord(entryHandlers)) {
-      throw new TypeError(`[stitchkit] implementRegistry: handlers for "${key}" must be an object`);
-    }
-    const endpointKeys = Object.keys(contract.endpoints);
-    const handlerEntryKeys = Object.keys(entryHandlers);
-    const missingEndpoints = endpointKeys.filter((endpointKey) => !Object.hasOwn(entryHandlers, endpointKey));
-    const extraEndpoints = handlerEntryKeys.filter((endpointKey) => !Object.hasOwn(contract.endpoints, endpointKey));
-    if (missingEndpoints.length > 0 || extraEndpoints.length > 0) {
-      throw new Error(`[stitchkit] implementRegistry: handlers for "${key}" mismatch (missing: ${missingEndpoints.join(", ") || "none"}; extra: ${extraEndpoints.join(", ") || "none"})`);
-    }
-    services.push(bindContract(contract, entryHandlers));
-  }
-  return services;
-}
-function implementRegistry(contracts, handlers) {
-  return bindRegistry(contracts, handlers);
-}
-function createImplementRegistry() {
-  return (contracts, handlers) => bindRegistry(contracts, handlers);
-}
-
 // src/server/process-signals.ts
 var DEFAULT_SIGNALS = ["SIGINT", "SIGTERM"];
 var defaultSignalSource = {
@@ -2301,4 +2152,4 @@ function socketIoLane(websocket) {
   });
 }
 
-export { parseMultipart, createHandler, ShutdownStateSchema, ShutdownOptionsSchema, ShutdownStatusSchema, ShutdownResultSchema, createServerLifecycle, defineMultipartStream, createMultipartStream, implement, createImplement, createScopedImplement, createScopedImplementRegistry, implementRegistry, createImplementRegistry, bindProcessSignals, bindRealtimeServer, webSocketLane, composeWebSocketHandlers, createSocketIOServer, socketIoLane };
+export { parseMultipart, createHandler, ShutdownStateSchema, ShutdownOptionsSchema, ShutdownStatusSchema, ShutdownResultSchema, createServerLifecycle, bindProcessSignals, bindRealtimeServer, webSocketLane, composeWebSocketHandlers, createSocketIOServer, socketIoLane };

package/dist/index-drsnz8gw.js

@@ -0,0 +1,249 @@
+import {
+  mergeMeta
+} from "./index-8qghvg18.js";
+import {
+  callRuntimeHandler,
+  isRecord,
+  transportResult,
+  typedEntries
+} from "./index-bmnhqtya.js";
+
+// src/server/middleware/cors.ts
+var DEFAULT_CORS_ALLOW_HEADERS = "Content-Type, Authorization, X-Trace-Id, traceparent, tracestate";
+var DEFAULT_CORS_EXPOSE_HEADERS = "Content-Disposition, Content-Length, Content-Range, Accept-Ranges, ETag, Last-Modified, X-Request-Id";
+function assertCorsConfig(config) {
+  if (config.credentials && (config.origin === undefined || config.origin === "*")) {
+    throw new Error("[stitchkit] cors: `credentials: true` cannot be combined with a wildcard origin. " + "Set `origin` to an explicit string or list.");
+  }
+  if (config.origin === undefined) {
+    throw new Error("[stitchkit] cors: `origin` is required. Pass an explicit origin (or list), or '*' to deliberately allow every origin — omit `cors` entirely to emit no CORS headers.");
+  }
+  if (Array.isArray(config.origin) && config.origin.length === 0) {
+    throw new Error("[stitchkit] cors: `origin` cannot be an empty list. Pass explicit origins, or '*' to deliberately allow every origin.");
+  }
+}
+function resolveOrigin(config, requestOrigin) {
+  if (config.origin === undefined)
+    return;
+  if (config.origin === "*") {
+    return "*";
+  }
+  if (Array.isArray(config.origin)) {
+    if (!requestOrigin)
+      return;
+    const lower = requestOrigin.toLowerCase();
+    return config.origin.some((o) => o.toLowerCase() === lower) ? requestOrigin : undefined;
+  }
+  return config.origin;
+}
+function corsHeaders(config, requestOrigin) {
+  const allowOrigin = resolveOrigin(config, requestOrigin);
+  const headers = {
+    "Access-Control-Allow-Methods": config.methods ?? "GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS",
+    "Access-Control-Allow-Headers": config.headers ?? DEFAULT_CORS_ALLOW_HEADERS
+  };
+  const expose = Array.isArray(config.exposeHeaders) ? config.exposeHeaders.join(", ") : config.exposeHeaders ?? DEFAULT_CORS_EXPOSE_HEADERS;
+  if (expose !== "") {
+    headers["Access-Control-Expose-Headers"] = expose;
+  }
+  if (allowOrigin !== undefined) {
+    headers["Access-Control-Allow-Origin"] = allowOrigin;
+    if (config.credentials) {
+      headers["Access-Control-Allow-Credentials"] = "true";
+    }
+  }
+  if (Array.isArray(config.origin)) {
+    headers.Vary = "Origin";
+  }
+  return headers;
+}
+function corsPreflightResponse(config, req) {
+  return new Response(null, {
+    status: 204,
+    headers: corsHeaders(config, req.headers.get("origin"))
+  });
+}
+
+// src/server/implement.ts
+function isStreamingImplementation(value) {
+  return typeof value === "object" && value !== null && "kind" in value && value.kind === "stitchkit.multipart.stream";
+}
+function defineMultipartStream(endpoint, config) {
+  return buildMultipartStream(endpoint, config.files, config.handler);
+}
+function buildMultipartStream(endpoint, files, handler) {
+  const receivers = {};
+  for (const [key, receiver] of typedEntries(files)) {
+    receivers[String(key)] = receiver;
+  }
+  const declared = Object.keys(endpoint.multipart.files);
+  const configured = Object.keys(receivers);
+  if (declared.length !== configured.length || declared.some((field) => !Object.hasOwn(receivers, field))) {
+    throw new Error("Streaming multipart receivers must exactly match declared file fields");
+  }
+  return {
+    kind: "stitchkit.multipart.stream",
+    receivers,
+    execute(ctx, streamedFiles) {
+      return callRuntimeHandler(handler, { ...ctx, files: streamedFiles });
+    }
+  };
+}
+function createMultipartStream() {
+  return (endpoint, config) => buildMultipartStream(endpoint, config.files, config.handler);
+}
+function isStreamingEndpoint(endpoint) {
+  return endpoint.multipart?.delivery === "stream";
+}
+function contractOnlyService(contract) {
+  const handlers = {};
+  for (const [key, endpoint] of Object.entries(contract.endpoints)) {
+    if (isStreamingEndpoint(endpoint)) {
+      const receivers = {};
+      for (const field of Object.keys(endpoint.multipart.files)) {
+        receivers[field] = () => {
+          throw new Error("[stitchkit] contract-only service: handlers are not callable");
+        };
+      }
+      const streaming = {
+        kind: "stitchkit.multipart.stream",
+        receivers,
+        execute: () => {
+          throw new Error("[stitchkit] contract-only service: handlers are not callable");
+        }
+      };
+      handlers[key] = streaming;
+      continue;
+    }
+    handlers[key] = () => {
+      throw new Error("[stitchkit] contract-only service: handlers are not callable");
+    };
+  }
+  return bindContract(contract, handlers);
+}
+var HTTP_ONLY = Object.freeze(["HTTP"]);
+function bindContract(contract, handlers) {
+  const methods = {};
+  const groupScope = contract.meta.scope ?? "public";
+  for (const [key, endpoint] of typedEntries(contract.endpoints)) {
+    const typedHandler = handlers[String(key)];
+    const isStreaming = endpoint.multipart?.delivery === "stream";
+    if (!isStreaming && typeof typedHandler !== "function") {
+      throw new Error(`[stitchkit] implement: missing handler for "${contract.meta.prefix}.${String(key)}"`);
+    }
+    if (isStreaming && !isStreamingImplementation(typedHandler)) {
+      throw new Error(`[stitchkit] implement: streaming multipart endpoint "${contract.meta.prefix}.${String(key)}" must use defineMultipartStream()`);
+    }
+    const streamingHandler = isStreamingImplementation(typedHandler) ? typedHandler : undefined;
+    const regularHandler = typeof typedHandler === "function" ? typedHandler : undefined;
+    methods[String(key)] = {
+      method: endpoint.method,
+      path: endpoint.path,
+      desc: endpoint.desc,
+      serviceName: contract.meta.prefix,
+      key: String(key),
+      toolName: "toolName" in endpoint ? endpoint.toolName : undefined,
+      expose: endpoint.rawResponse || endpoint.rawBody || endpoint.responseMeta ? HTTP_ONLY : endpoint.expose,
+      scope: endpoint.scope ?? groupScope,
+      paramsSchema: endpoint.params,
+      inputSchema: endpoint.input,
+      outputSchema: endpoint.output,
+      multipart: endpoint.multipart,
+      multipartReceivers: streamingHandler?.receivers,
+      maxJsonBodyBytes: endpoint.maxJsonBodyBytes,
+      idempotent: endpoint.idempotent,
+      ui: "ui" in endpoint ? endpoint.ui : undefined,
+      annotations: "annotations" in endpoint ? endpoint.annotations : undefined,
+      mcp: "mcp" in endpoint ? endpoint.mcp : undefined,
+      meta: mergeMeta(contract.meta.meta, endpoint.meta),
+      rawResponse: endpoint.rawResponse,
+      rawBody: endpoint.rawBody,
+      responseMeta: endpoint.responseMeta,
+      contentType: "contentType" in endpoint ? endpoint.contentType : undefined,
+      handler: streamingHandler ? (ctx) => streamingHandler.execute(ctx, ctx.files ?? {}) : (ctx) => {
+        if (!regularHandler) {
+          throw new Error(`[stitchkit] implement: missing handler for "${contract.meta.prefix}.${String(key)}"`);
+        }
+        return callRuntimeHandler(regularHandler, ctx);
+      }
+    };
+  }
+  return {
+    name: contract.meta.prefix,
+    prefix: contract.meta.prefix,
+    scope: groupScope,
+    methods
+  };
+}
+function implement(contract, handlers) {
+  return bindContract(contract, handlers);
+}
+function createImplement() {
+  return (contract, handlers) => implement(contract, handlers);
+}
+function createScopedImplement() {
+  const implementScoped = (contract, handlers) => bindContract(contract, handlers);
+  const stream = (scope, endpoint, config) => {
+    if (endpoint.scope !== undefined && endpoint.scope !== scope) {
+      throw new Error(`[stitchkit] createScopedImplement.stream: endpoint declares scope "${endpoint.scope}" but "${String(scope)}" was given`);
+    }
+    return buildMultipartStream(endpoint, config.files, config.handler);
+  };
+  const declare = (_contract) => (handlers) => handlers;
+  return Object.assign(implementScoped, { stream, declare });
+}
+function createScopedImplementRegistry() {
+  return (contracts, handlers) => transportResult(bindRegistry(contracts, handlers));
+}
+function isImplementationContract(value) {
+  return isRecord(value) && isRecord(value.meta) && typeof value.meta.prefix === "string" && isRecord(value.endpoints);
+}
+function bindRegistry(contracts, handlers) {
+  const contractKeys = Object.keys(contracts);
+  const handlerKeys = Object.keys(handlers);
+  const missing = contractKeys.filter((key) => !Object.hasOwn(handlers, key));
+  const extra = handlerKeys.filter((key) => !Object.hasOwn(contracts, key));
+  if (missing.length > 0 || extra.length > 0) {
+    throw new Error(`[stitchkit] implementRegistry: registry mismatch (missing: ${missing.join(", ") || "none"}; extra: ${extra.join(", ") || "none"})`);
+  }
+  const prefixes = new Map;
+  const services = [];
+  const byKey = {};
+  for (const [key, candidate] of Object.entries(contracts)) {
+    if (!isImplementationContract(candidate)) {
+      throw new TypeError(`[stitchkit] implementRegistry: registry entry "${key}" must be one contract; composed arrays and namespaces are not supported`);
+    }
+    const contract = candidate;
+    const groupScope = contract.meta.scope ?? "public";
+    const identity = `${groupScope}\x00${contract.meta.prefix}`;
+    const previousKey = prefixes.get(identity);
+    if (previousKey !== undefined) {
+      throw new Error(`[stitchkit] implementRegistry: duplicate contract prefix "${contract.meta.prefix}" in scope "${groupScope}" at "${previousKey}" and "${key}"`);
+    }
+    prefixes.set(identity, key);
+    const entryHandlers = handlers[key];
+    if (!isRecord(entryHandlers)) {
+      throw new TypeError(`[stitchkit] implementRegistry: handlers for "${key}" must be an object`);
+    }
+    const endpointKeys = Object.keys(contract.endpoints);
+    const handlerEntryKeys = Object.keys(entryHandlers);
+    const missingEndpoints = endpointKeys.filter((endpointKey) => !Object.hasOwn(entryHandlers, endpointKey));
+    const extraEndpoints = handlerEntryKeys.filter((endpointKey) => !Object.hasOwn(contract.endpoints, endpointKey));
+    if (missingEndpoints.length > 0 || extraEndpoints.length > 0) {
+      throw new Error(`[stitchkit] implementRegistry: handlers for "${key}" mismatch (missing: ${missingEndpoints.join(", ") || "none"}; extra: ${extraEndpoints.join(", ") || "none"})`);
+    }
+    const service = bindContract(contract, entryHandlers);
+    services.push(service);
+    byKey[key] = service;
+  }
+  Object.defineProperty(services, "byKey", { value: byKey, enumerable: false });
+  return transportResult(services);
+}
+function implementRegistry(contracts, handlers) {
+  return transportResult(bindRegistry(contracts, handlers));
+}
+function createImplementRegistry() {
+  return (contracts, handlers) => transportResult(bindRegistry(contracts, handlers));
+}
+
+export { DEFAULT_CORS_ALLOW_HEADERS, DEFAULT_CORS_EXPOSE_HEADERS, assertCorsConfig, corsHeaders, corsPreflightResponse, defineMultipartStream, createMultipartStream, contractOnlyService, implement, createImplement, createScopedImplement, createScopedImplementRegistry, implementRegistry, createImplementRegistry };

package/dist/{index-p9d4cxt5.js → index-gff2mxzk.js}

@@ -6,7 +6,7 @@ import {
   mapObject,
   parseTrailingWildcard,
   typedEntries
-} from "./index-h05ygjqx.js";
+} from "./index-bmnhqtya.js";
 
 // src/browser/cancellation.ts
 class RequestCancellationError extends Error {

package/dist/{index-0hj37z43.js → index-h55e1wyq.js}

@@ -14,10 +14,10 @@ import {
   runWithRequestContext,
   safeJsonParse,
   validateDeclaredOutput
-} from "./index-jewp9r0a.js";
+} from "./index-8qghvg18.js";
 import {
   isRecord
-} from "./index-h05ygjqx.js";
+} from "./index-bmnhqtya.js";
 
 // src/tools/coerce.ts
 import { z } from "zod";

package/dist/{index-v58mwa19.js → index-psrxjvbw.js}

@@ -1,9 +1,9 @@
 import {
   isUnsafeKey
-} from "./index-jewp9r0a.js";
+} from "./index-8qghvg18.js";
 import {
   isRecord
-} from "./index-h05ygjqx.js";
+} from "./index-bmnhqtya.js";
 
 // src/observability/sanitize.ts
 var SENSITIVE_WORDS = new Set([

package/dist/{index-03j2t778.js → index-tw7mhqgy.js}

@@ -5,10 +5,10 @@ import {
   isUnsafeKey,
   safeJsonParse,
   unauthorized
-} from "./index-jewp9r0a.js";
+} from "./index-8qghvg18.js";
 import {
   isRecord
-} from "./index-h05ygjqx.js";
+} from "./index-bmnhqtya.js";
 
 // src/server/middleware/cookies.ts
 function parseCookies(header) {
@@ -150,6 +150,9 @@ function extractToken(req, cookieName) {
   }
   return null;
 }
+function isThenable(value) {
+  return "then" in value && typeof value.then === "function";
+}
 function createAuthHook(config) {
   const onAnonymous = config.onAnonymous ?? (() => unauthorized());
   const onForbidden = config.onForbidden ?? (() => forbidden());
@@ -159,10 +162,18 @@ function createAuthHook(config) {
     const scope = endpoint.scope ?? config.defaultScope;
     if (!scope)
       return;
-    const rule = Object.hasOwn(config.rules, scope) ? config.rules[scope] : undefined;
-    if (!rule) {
+    const entry = Object.hasOwn(config.rules, scope) ? config.rules[scope] : undefined;
+    if (!entry) {
       throw new Error(`[stitchkit] auth: no rule for scope "${scope}"`);
     }
+    const rule = typeof entry === "object" ? entry.rule : entry;
+    if (typeof entry === "object" && entry.inject && identity !== null) {
+      const fields = entry.inject(identity, ctx);
+      if (isThenable(fields)) {
+        throw new Error(`[stitchkit] auth: the inject of scope "${scope}" must be synchronous — an async inject merges a Promise, not fields`);
+      }
+      Object.assign(ctx, fields);
+    }
     if (rule === "public")
       return;
     if (!identity) {

package/dist/node.d.ts

@@ -6,7 +6,7 @@
  */
 export { AppError, appError, badRequest, conflict, forbidden, notFound, rateLimited, unauthorized, } from './contract';
 export { createHandler } from './server/create';
-export { createImplement, createImplementRegistry, createMultipartStream, createScopedImplement, createScopedImplementRegistry, type ExactRegistryHandlers, type ExactScopedRegistryHandlers, type ImplementationRegistry, implement, implementRegistry, type MultipartStreamConfig, type RegistryHandlers, type ScopedImplementationRegistry, type ScopedRegistryHandlers, type StreamScope, } from './server/implement';
+export { createImplement, createImplementRegistry, createMultipartStream, createScopedImplement, createScopedImplementRegistry, type ExactRegistryHandlers, type ExactScopedRegistryHandlers, type ImplementationRegistry, implement, implementRegistry, type KeyedServices, type MultipartStreamConfig, type RegistryHandlers, type ScopedImplementationRegistry, type ScopedRegistryHandlers, type StreamScope, } from './server/implement';
 export type { LogFormat } from './server/logger';
 export { type NodeRuntimeServer, type NodeServerConfig, type NodeServerHandle, type NodeSocketLifecycle, serveNode, } from './server/node';
 export { bindProcessSignals, type ProcessSignalName, type ProcessSignalsBinding, type ProcessSignalsErrorPhase, type ProcessSignalsOptions, type ShutdownTarget, type SignalSource, } from './server/process-signals';

package/dist/node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,WAAW,EACX,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,6BAA6B,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAC3B,SAAS,EACT,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,4BAA4B,EACjC,KAAK,sBAAsB,EAC3B,KAAK,WAAW,GACjB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,SAAS,GACV,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,YAAY,GAClB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,cAAc,EACnB,oBAAoB,EACpB,KAAK,aAAa,EAClB,mBAAmB,EACnB,KAAK,cAAc,EACnB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wBAAwB,IAAI,oBAAoB,EAChD,KAAK,wBAAwB,IAAI,oBAAoB,EACrD,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,aAAa,EACb,UAAU,EACV,QAAQ,EACR,eAAe,EACf,aAAa,EACb,cAAc,EACd,UAAU,GACX,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,WAAW,EACX,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,6BAA6B,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAC3B,SAAS,EACT,iBAAiB,EACjB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,4BAA4B,EACjC,KAAK,sBAAsB,EAC3B,KAAK,WAAW,GACjB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,SAAS,GACV,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,YAAY,GAClB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,cAAc,EACnB,oBAAoB,EACpB,KAAK,aAAa,EAClB,mBAAmB,EACnB,KAAK,cAAc,EACnB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wBAAwB,IAAI,oBAAoB,EAChD,KAAK,wBAAwB,IAAI,oBAAoB,EACrD,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,aAAa,EACb,UAAU,EACV,QAAQ,EACR,eAAe,EACf,aAAa,EACb,cAAc,EACd,UAAU,GACX,MAAM,gBAAgB,CAAC"}

package/dist/node.js

@@ -6,17 +6,18 @@ import {
   bindProcessSignals,
   bindRealtimeServer,
   createHandler,
+  createServerLifecycle,
+  createSocketIOServer
+} from "./index-d6jj3cp5.js";
+import {
   createImplement,
   createImplementRegistry,
   createMultipartStream,
   createScopedImplement,
   createScopedImplementRegistry,
-  createServerLifecycle,
-  createSocketIOServer,
   implement,
   implementRegistry
-} from "./index-a4qmxybq.js";
-import"./index-r1qp4rve.js";
+} from "./index-drsnz8gw.js";
 import {
   AppError,
   appError,
@@ -26,8 +27,8 @@ import {
   notFound,
   rateLimited,
   unauthorized
-} from "./index-jewp9r0a.js";
-import"./index-h05ygjqx.js";
+} from "./index-8qghvg18.js";
+import"./index-bmnhqtya.js";
 // src/server/node.ts
 import { serve } from "srvx/node";
 async function serveNode(config) {

package/dist/observability/index.js

@@ -3,7 +3,7 @@ import {
   redact,
   sanitizePayload,
   truncatePreview
-} from "../index-v58mwa19.js";
+} from "../index-psrxjvbw.js";
 import {
   getRequestContext,
   getTraceId,
@@ -15,7 +15,7 @@ import {
   setRequestError,
   setRequestUser,
   wrapInRequestContext
-} from "../index-jewp9r0a.js";
+} from "../index-8qghvg18.js";
 import {
   childSpan,
   createTraceContext,
@@ -24,7 +24,7 @@ import {
   parseTraceparent,
   resolvePropagationContext,
   resolveTraceContext
-} from "../index-h05ygjqx.js";
+} from "../index-bmnhqtya.js";
 
 // src/observability/status.ts
 import { z } from "zod";