stitchkit 0.67.0 → 0.68.0

package/dist/index-9ky9hhg3.js

@@ -0,0 +1,484 @@
+import {
+  isRecord
+} from "./index-smpbdg6k.js";
+import {
+  AppError
+} from "./index-0w9abg87.js";
+
+// src/contract/define.ts
+import { z } from "zod";
+
+// src/internal/route-pattern.ts
+var PARAM_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function joinRoutePath(...parts) {
+  const joined = parts.filter((part) => Boolean(part)).map((part) => part.replace(/^\/+|\/+$/g, "")).filter(Boolean).join("/");
+  return `/${joined}`;
+}
+function parseTrailingWildcard(path) {
+  const segments = path.split("/").filter(Boolean);
+  const paramNames = new Set;
+  let wildcard = null;
+  for (const [segmentIndex, segment] of segments.entries()) {
+    if (segment.startsWith(":")) {
+      const name2 = segment.slice(1);
+      if (!PARAM_IDENTIFIER.test(name2)) {
+        throw new Error(`Invalid route parameter name "${name2}" in path "${path}"`);
+      }
+      if (paramNames.has(name2)) {
+        throw new Error(`Duplicate route parameter name "${name2}" in path "${path}"`);
+      }
+      paramNames.add(name2);
+      continue;
+    }
+    if (!segment.startsWith("*")) {
+      if (segment.includes("*")) {
+        throw new Error(`Wildcard must occupy its own segment in path "${path}"`);
+      }
+      continue;
+    }
+    const name = segment.slice(1);
+    if (!PARAM_IDENTIFIER.test(name)) {
+      throw new Error(`Trailing wildcard in path "${path}" must be named, for example "/*filePath"`);
+    }
+    if (segmentIndex !== segments.length - 1) {
+      throw new Error(`Wildcard "*${name}" must be the final segment in path "${path}"`);
+    }
+    if (wildcard) {
+      throw new Error(`Path "${path}" contains more than one wildcard`);
+    }
+    if (paramNames.has(name)) {
+      throw new Error(`Duplicate route parameter name "${name}" in path "${path}"`);
+    }
+    wildcard = { name, segmentIndex };
+  }
+  return wildcard;
+}
+
+// src/internal/safe-json.ts
+function isUnsafeKey(key) {
+  return key === "__proto__";
+}
+function safeJsonParse(text) {
+  return JSON.parse(text, (key, value) => isUnsafeKey(key) ? undefined : value);
+}
+
+// src/contract/define.ts
+function defineContract(meta, endpoints) {
+  const toolTransports = new Map;
+  for (const [key, ep] of Object.entries(endpoints)) {
+    const wildcard = parseTrailingWildcard(ep.path);
+    if (wildcard) {
+      if (!ep.params) {
+        throw new Error(`Contract "${meta.prefix}": endpoint "${key}" wildcard "${wildcard.name}" requires a params schema field`);
+      }
+      const paramsJson = z.toJSONSchema(ep.params, { io: "input" });
+      if (!paramsJson.properties || !(wildcard.name in paramsJson.properties)) {
+        throw new Error(`Contract "${meta.prefix}": endpoint "${key}" params schema is missing wildcard field "${wildcard.name}"`);
+      }
+    }
+    if (ep.desc.trim() === "") {
+      throw new Error(`Contract "${meta.prefix}": endpoint "${key}" has an empty desc`);
+    }
+    if (ep.maxJsonBodyBytes !== undefined && (!Number.isSafeInteger(ep.maxJsonBodyBytes) || ep.maxJsonBodyBytes <= 0)) {
+      throw new Error(`Contract "${meta.prefix}": endpoint "${key}" maxJsonBodyBytes must be a positive safe integer, received ${ep.maxJsonBodyBytes}`);
+    }
+    if (ep.multipart)
+      assertMultipartEndpoint(meta.prefix, key, ep);
+    if (ep.rawResponse)
+      assertRawEndpoint(meta.prefix, key, ep);
+    if ("stream" in ep)
+      assertStreamingResponseEndpoint(meta.prefix, key, ep);
+    if (ep.method === "HEAD")
+      assertHeadEndpoint(meta.prefix, key, ep);
+    if (ep.rawBody)
+      assertRawBodyEndpoint(meta.prefix, key, ep);
+    if ("responseMeta" in ep)
+      assertResponseMetaEndpoint(meta.prefix, key, ep);
+    if (!("toolName" in ep) || !ep.toolName)
+      continue;
+    const transports = new Set(ep.expose ? ep.expose.filter((t) => t !== "HTTP") : ["MCP", "AGENT"]);
+    if (transports.size === 0) {
+      throw new Error(`Contract "${meta.prefix}": endpoint "${key}" sets toolName "${ep.toolName}" but is not exposed on any tool transport (MCP / AGENT)`);
+    }
+    const existing = toolTransports.get(ep.toolName);
+    if (existing) {
+      for (const t of transports) {
+        if (existing.transports.has(t)) {
+          throw new Error(`Contract "${meta.prefix}": duplicate toolName "${ep.toolName}" on transport "${t}" (endpoints: "${existing.key}" and "${key}")`);
+        }
+        existing.transports.add(t);
+      }
+    } else {
+      toolTransports.set(ep.toolName, { key, transports });
+    }
+  }
+  return { meta, endpoints };
+}
+function assertPositiveLimit(where, name, value) {
+  if (value !== undefined && (!Number.isSafeInteger(value) || value <= 0)) {
+    throw new Error(`${where} ${name} must be a positive safe integer, received ${value}`);
+  }
+}
+function assertMultipartEndpoint(prefix, key, ep) {
+  const where = `Contract "${prefix}": multipart endpoint "${key}"`;
+  if (ep.method !== "POST" && ep.method !== "PUT" && ep.method !== "PATCH") {
+    throw new Error(`${where} must use POST, PUT or PATCH`);
+  }
+  const multipart = ep.multipart;
+  if (!multipart || typeof multipart !== "object") {
+    throw new Error(`${where} must declare a multipart descriptor`);
+  }
+  assertPositiveLimit(where, "maxRequestBytes", multipart.maxRequestBytes);
+  assertPositiveLimit(where, "maxFieldBytes", multipart.maxFieldBytes);
+  const entries = Object.entries(multipart.files);
+  if (entries.length === 0)
+    throw new Error(`${where} must declare at least one file field`);
+  for (const [field, policy] of entries) {
+    if (!field || isUnsafeKey(field))
+      throw new Error(`${where} has an invalid file field name`);
+    assertPositiveLimit(`${where} field "${field}"`, "maxBytes", policy.maxBytes);
+    assertPositiveLimit(`${where} field "${field}"`, "maxFiles", policy.maxFiles);
+    if (policy.multiple !== true && policy.maxFiles !== undefined) {
+      throw new Error(`${where} field "${field}" may set maxFiles only with multiple: true`);
+    }
+    if (policy.contentTypes) {
+      if (policy.contentTypes.length === 0) {
+        throw new Error(`${where} field "${field}" contentTypes cannot be empty`);
+      }
+      for (const contentType of policy.contentTypes) {
+        if (!/^[a-z0-9!#$&^_.+-]+\/(?:[a-z0-9!#$&^_.+-]+|\*)$/i.test(contentType)) {
+          throw new Error(`${where} field "${field}" has invalid content type policy "${contentType}"`);
+        }
+      }
+    }
+  }
+}
+function assertRawEndpoint(prefix, key, ep) {
+  const where = `Contract "${prefix}": raw endpoint "${key}"`;
+  if (ep.output)
+    throw new Error(`${where} cannot declare an output schema`);
+  if ("toolName" in ep && ep.toolName)
+    throw new Error(`${where} cannot set a toolName`);
+  if ("ui" in ep && ep.ui)
+    throw new Error(`${where} cannot set MCP ui metadata`);
+  if ("annotations" in ep && ep.annotations) {
+    throw new Error(`${where} cannot set MCP annotations`);
+  }
+  const nonHttp = (ep.expose ?? []).filter((t) => t !== "HTTP");
+  if (nonHttp.length > 0) {
+    throw new Error(`${where} is HTTP-only — remove ${nonHttp.join(", ")} from expose`);
+  }
+}
+function assertStreamingResponseEndpoint(prefix, key, ep) {
+  const where = `Contract "${prefix}": streaming endpoint "${key}"`;
+  if (!("stream" in ep) || !ep.stream || typeof ep.stream !== "object") {
+    throw new Error(`${where} must declare a stream descriptor`);
+  }
+  if (!ep.stream.item || typeof ep.stream.item.parse !== "function") {
+    throw new Error(`${where} must declare an item schema`);
+  }
+  assertPositiveLimit(where, "maxFrameBytes", ep.stream.maxFrameBytes);
+  assertPositiveLimit(where, "lifetimeMs", ep.stream.lifetimeMs);
+  assertPositiveLimit(where, "heartbeatMs", ep.stream.heartbeatMs);
+  if (ep.stream.idleTimeoutSeconds !== undefined && (!Number.isSafeInteger(ep.stream.idleTimeoutSeconds) || ep.stream.idleTimeoutSeconds < 0)) {
+    throw new Error(`${where} idleTimeoutSeconds must be a non-negative safe integer`);
+  }
+  if (ep.output)
+    throw new Error(`${where} cannot declare an output schema`);
+  if (ep.rawResponse)
+    throw new Error(`${where} cannot also be rawResponse`);
+  if (ep.multipart)
+    throw new Error(`${where} cannot be multipart`);
+  if ("toolName" in ep && ep.toolName)
+    throw new Error(`${where} cannot set a toolName`);
+  const nonHttp = (ep.expose ?? []).filter((transport) => transport !== "HTTP");
+  if (nonHttp.length > 0) {
+    throw new Error(`${where} is HTTP-only — remove ${nonHttp.join(", ")} from expose`);
+  }
+}
+function assertHeadEndpoint(prefix, key, ep) {
+  const where = `Contract "${prefix}": HEAD endpoint "${key}"`;
+  if (!ep.rawResponse)
+    throw new Error(`${where} must declare rawResponse: true`);
+  if (ep.input)
+    throw new Error(`${where} cannot declare an input schema`);
+  if (ep.multipart)
+    throw new Error(`${where} cannot be multipart`);
+  if (ep.rawBody)
+    throw new Error(`${where} cannot retain a raw body`);
+}
+function assertRawBodyEndpoint(prefix, key, ep) {
+  const where = `Contract "${prefix}": rawBody endpoint "${key}"`;
+  if (!ep.input)
+    throw new Error(`${where} must declare an input schema`);
+  if (ep.multipart)
+    throw new Error(`${where} cannot be multipart`);
+  if (ep.method !== "POST" && ep.method !== "PUT" && ep.method !== "PATCH") {
+    throw new Error(`${where} must use POST, PUT or PATCH`);
+  }
+  if ("toolName" in ep && ep.toolName)
+    throw new Error(`${where} cannot set a toolName`);
+  if ("ui" in ep && ep.ui)
+    throw new Error(`${where} cannot set MCP ui metadata`);
+  if ("annotations" in ep && ep.annotations) {
+    throw new Error(`${where} cannot set MCP annotations`);
+  }
+  const nonHttp = (ep.expose ?? []).filter((transport) => transport !== "HTTP");
+  if (nonHttp.length > 0) {
+    throw new Error(`${where} is HTTP-only — remove ${nonHttp.join(", ")} from expose`);
+  }
+}
+function assertResponseMetaEndpoint(prefix, key, ep) {
+  const where = `Contract "${prefix}": responseMeta endpoint "${key}"`;
+  if (!ep.responseMeta || typeof ep.responseMeta !== "object") {
+    throw new Error(`${where} must declare responseMeta as an object`);
+  }
+  const status = ep.responseMeta.status;
+  if (status !== undefined && (!Number.isSafeInteger(status) || status < 200 || status > 299)) {
+    throw new Error(`${where} status must be a successful 2xx integer, received ${status}`);
+  }
+  if (ep.output && (status === 204 || status === 205)) {
+    throw new Error(`${where} cannot combine output with bodyless status ${status}`);
+  }
+  if (ep.rawResponse)
+    throw new Error(`${where} cannot also be a rawResponse endpoint`);
+  if ("toolName" in ep && ep.toolName)
+    throw new Error(`${where} cannot set a toolName`);
+  if ("ui" in ep && ep.ui)
+    throw new Error(`${where} cannot set MCP ui metadata`);
+  if ("annotations" in ep && ep.annotations) {
+    throw new Error(`${where} cannot set MCP annotations`);
+  }
+  const nonHttp = (ep.expose ?? []).filter((transport) => transport !== "HTTP");
+  if (nonHttp.length > 0) {
+    throw new Error(`${where} is HTTP-only — remove ${nonHttp.join(", ")} from expose`);
+  }
+}
+function mergeMeta(contractMeta, endpointMeta) {
+  if (!contractMeta)
+    return endpointMeta;
+  if (!endpointMeta)
+    return { ...contractMeta };
+  return { ...contractMeta, ...endpointMeta };
+}
+// src/contract/errors-factory.ts
+import { z as z2 } from "zod";
+// src/contract/pagination.ts
+import { z as z3 } from "zod";
+
+// src/internal/base64url.ts
+function bytesToBase64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes)
+    binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlToBytes(segment) {
+  if (!/^[A-Za-z0-9_-]*$/.test(segment) || segment.length % 4 === 1) {
+    throw new Error("invalid base64url segment");
+  }
+  const b64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = b64.padEnd(Math.ceil(b64.length / 4) * 4, "=");
+  return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
+}
+// src/contract/stream.ts
+import { z as z4 } from "zod";
+var DEFAULT_CONTRACT_STREAM_FRAME_BYTES = 256 * 1024;
+var ContractStreamFrameSchema = z4.discriminatedUnion("type", [
+  z4.object({ type: z4.literal("data"), data: z4.unknown() }).strict(),
+  z4.object({
+    type: z4.literal("error"),
+    error: z4.object({
+      code: z4.string(),
+      message: z4.string().optional(),
+      details: z4.unknown().optional(),
+      hint: z4.string().optional()
+    }).strict()
+  }).strict(),
+  z4.object({ type: z4.literal("end") }).strict()
+]);
+// src/internal/errors.ts
+import { z as z5 } from "zod";
+function issuePath(path) {
+  return path.length > 0 ? path.map(String).join(".") : "(root)";
+}
+function formatZodError(error) {
+  const issues = error.issues.slice(0, 5);
+  const lines = issues.map((issue) => `${issuePath(issue.path)}: ${issue.message}`);
+  const suffix = error.issues.length > 5 ? `
+...and ${error.issues.length - 5} more issues` : "";
+  return lines.join(`
+`) + suffix;
+}
+function zodIssues(error) {
+  return error.issues.map((issue) => ({
+    path: issuePath(issue.path),
+    code: issue.code,
+    message: issue.message
+  }));
+}
+var MAX_DETAIL_ISSUES = 20;
+function errorCode(err) {
+  if (AppError.is(err))
+    return err.code;
+  if (err instanceof z5.ZodError)
+    return "VALIDATION_ERROR";
+  return;
+}
+function recordedErrorMessage(code, envelopeMessage, thrown) {
+  if ((code === "INTERNAL_SERVER_ERROR" || code === "REALTIME_CONTRACT_VIOLATION") && thrown !== undefined) {
+    if (thrown instanceof Error)
+      return thrown.message;
+    if (typeof thrown === "string")
+      return thrown;
+  }
+  return envelopeMessage;
+}
+function normalizeError(err) {
+  if (AppError.is(err)) {
+    if (err.code === "REALTIME_CONTRACT_VIOLATION") {
+      return new AppError("REALTIME_CONTRACT_VIOLATION", "Realtime contract violation", 500);
+    }
+    return err;
+  }
+  if (err instanceof z5.ZodError) {
+    return new AppError("VALIDATION_ERROR", formatZodError(err), 400, {
+      issues: zodIssues(err).slice(0, MAX_DETAIL_ISSUES)
+    });
+  }
+  console.error("[stitchkit] unhandled error:", err);
+  return new AppError("INTERNAL_SERVER_ERROR", "Internal server error", 500);
+}
+function strippedPaths(before, after, prefix) {
+  if (Array.isArray(before)) {
+    if (!Array.isArray(after))
+      return [];
+    return before.flatMap((item, i) => strippedPaths(item, after[i], `${prefix}[${i}]`));
+  }
+  if (!isRecord(before) || !isRecord(after))
+    return [];
+  const paths = [];
+  for (const [key, value] of Object.entries(before)) {
+    const path = prefix ? `${prefix}.${key}` : key;
+    if (!(key in after)) {
+      paths.push(path);
+      continue;
+    }
+    paths.push(...strippedPaths(value, after[key], path));
+  }
+  return paths;
+}
+function validateHandlerOutput(schema, data, onStripped) {
+  const parsed = schema.safeParse(data);
+  if (parsed.success) {
+    if (onStripped) {
+      const paths = strippedPaths(data, parsed.data, "");
+      if (paths.length > 0)
+        onStripped(paths);
+    }
+    return { ok: true, data: parsed.data };
+  }
+  return {
+    ok: false,
+    message: `Handler output does not match the contract: ${formatZodError(parsed.error)}`
+  };
+}
+function validateDeclaredOutput(schema, data, onStripped) {
+  if (!schema) {
+    if (data === undefined || data === null)
+      return { ok: true, data };
+    return {
+      ok: false,
+      message: "Handler returned data but the contract declares no output"
+    };
+  }
+  if (data === undefined) {
+    return {
+      ok: false,
+      message: "Handler returned undefined but the contract declares an output"
+    };
+  }
+  return validateHandlerOutput(schema, data, onStripped);
+}
+
+// src/observability/trace.ts
+var TRACEPARENT_RE = /^([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})(.*)$/i;
+function randomHex(bytes) {
+  const arr = new Uint8Array(bytes);
+  crypto.getRandomValues(arr);
+  let hex = "";
+  for (const byte of arr)
+    hex += byte.toString(16).padStart(2, "0");
+  return hex;
+}
+function createTraceContext() {
+  return { traceId: randomHex(16), spanId: randomHex(8) };
+}
+function parseTraceparent(header) {
+  if (!header)
+    return null;
+  const match = TRACEPARENT_RE.exec(header.trim());
+  if (!match?.[1] || !match[2] || !match[3] || !match[4] || match[5] === undefined)
+    return null;
+  const version = match[1].toLowerCase();
+  if (version === "ff")
+    return null;
+  const suffix = match[5];
+  if (version === "00" ? suffix !== "" : suffix !== "" && !/^(?:-[0-9a-f]{2,})+$/i.test(suffix)) {
+    return null;
+  }
+  const traceId = match[2].toLowerCase();
+  const parentSpanId = match[3].toLowerCase();
+  const traceFlags = match[4].toLowerCase();
+  if (/^0+$/.test(traceId) || /^0+$/.test(parentSpanId))
+    return null;
+  return { traceId, spanId: randomHex(8), parentSpanId, traceFlags };
+}
+function formatTraceparent(ctx) {
+  return `00-${ctx.traceId}-${ctx.spanId}-${ctx.traceFlags ?? "01"}`;
+}
+function resolveTraceContext(req) {
+  return parseTraceparent(req.headers.get("traceparent")) ?? createTraceContext();
+}
+function childSpan(parent) {
+  return {
+    traceId: parent.traceId,
+    spanId: randomHex(8),
+    parentSpanId: parent.spanId,
+    ...parent.tracestate !== undefined && { tracestate: parent.tracestate },
+    ...parent.baggage !== undefined && { baggage: parent.baggage },
+    ...parent.traceFlags !== undefined && { traceFlags: parent.traceFlags }
+  };
+}
+var encoder = new TextEncoder;
+function boundedPropagationValue(value, maxBytes, maxMembers) {
+  if (typeof value !== "string")
+    return;
+  const trimmed = value.trim();
+  if (!trimmed || encoder.encode(trimmed).byteLength > maxBytes)
+    return;
+  for (const character of trimmed) {
+    const code = character.charCodeAt(0);
+    if (code <= 31 || code === 127)
+      return;
+  }
+  const members = trimmed.split(",");
+  if (members.length > maxMembers || members.some((member) => !member.trim())) {
+    return;
+  }
+  return trimmed;
+}
+function resolvePropagationContext(metadata, fallback) {
+  const traceparent = metadata?.traceparent;
+  const parsed = typeof traceparent === "string" ? parseTraceparent(traceparent) : null;
+  const trace = traceparent === undefined ? fallback ?? createTraceContext() : parsed ?? createTraceContext();
+  const tracestate = parsed ? boundedPropagationValue(metadata?.tracestate, 512, 32) : undefined;
+  const baggage = boundedPropagationValue(metadata?.baggage, 8192, 180);
+  return {
+    ...trace,
+    ...tracestate !== undefined && { tracestate },
+    ...baggage !== undefined && { baggage }
+  };
+}
+
+export { joinRoutePath, parseTrailingWildcard, isUnsafeKey, safeJsonParse, defineContract, mergeMeta, bytesToBase64Url, base64UrlToBytes, DEFAULT_CONTRACT_STREAM_FRAME_BYTES, ContractStreamFrameSchema, formatZodError, zodIssues, errorCode, recordedErrorMessage, normalizeError, validateDeclaredOutput, createTraceContext, parseTraceparent, formatTraceparent, resolveTraceContext, childSpan, resolvePropagationContext };

package/dist/{index-wrhf06ak.js → index-avjd67h6.js}

@@ -2,16 +2,16 @@ import {
   objectShapeKeys
 } from "./index-6djpbnda.js";
 import {
-  formatZodError,
   getRequestContext,
-  normalizeError,
-  runWithRequestContext,
-  validateDeclaredOutput
-} from "./index-tvwcrx2d.js";
+  runWithRequestContext
+} from "./index-69m2278y.js";
 import {
+  formatZodError,
   isUnsafeKey,
-  safeJsonParse
-} from "./index-wd8g8z6e.js";
+  normalizeError,
+  safeJsonParse,
+  validateDeclaredOutput
+} from "./index-9ky9hhg3.js";
 import {
   isRecord
 } from "./index-smpbdg6k.js";
@@ -19,7 +19,7 @@ import {
   AppError,
   STITCH_ERROR_STATUS,
   isStitchErrorCode
-} from "./index-xxye8j3k.js";
+} from "./index-0w9abg87.js";
 
 // src/tools/coerce.ts
 import { z } from "zod";

package/dist/{index-413xk7ga.js → index-cq9q73nf.js}

@@ -77,6 +77,8 @@ function defineContract(meta, endpoints) {
       assertMultipartEndpoint(meta.prefix, key, ep);
     if (ep.rawResponse)
       assertRawEndpoint(meta.prefix, key, ep);
+    if ("stream" in ep)
+      assertStreamingResponseEndpoint(meta.prefix, key, ep);
     if (ep.method === "HEAD")
       assertHeadEndpoint(meta.prefix, key, ep);
     if (ep.rawBody)
@@ -158,6 +160,33 @@ function assertRawEndpoint(prefix, key, ep) {
     throw new Error(`${where} is HTTP-only — remove ${nonHttp.join(", ")} from expose`);
   }
 }
+function assertStreamingResponseEndpoint(prefix, key, ep) {
+  const where = `Contract "${prefix}": streaming endpoint "${key}"`;
+  if (!("stream" in ep) || !ep.stream || typeof ep.stream !== "object") {
+    throw new Error(`${where} must declare a stream descriptor`);
+  }
+  if (!ep.stream.item || typeof ep.stream.item.parse !== "function") {
+    throw new Error(`${where} must declare an item schema`);
+  }
+  assertPositiveLimit(where, "maxFrameBytes", ep.stream.maxFrameBytes);
+  assertPositiveLimit(where, "lifetimeMs", ep.stream.lifetimeMs);
+  assertPositiveLimit(where, "heartbeatMs", ep.stream.heartbeatMs);
+  if (ep.stream.idleTimeoutSeconds !== undefined && (!Number.isSafeInteger(ep.stream.idleTimeoutSeconds) || ep.stream.idleTimeoutSeconds < 0)) {
+    throw new Error(`${where} idleTimeoutSeconds must be a non-negative safe integer`);
+  }
+  if (ep.output)
+    throw new Error(`${where} cannot declare an output schema`);
+  if (ep.rawResponse)
+    throw new Error(`${where} cannot also be rawResponse`);
+  if (ep.multipart)
+    throw new Error(`${where} cannot be multipart`);
+  if ("toolName" in ep && ep.toolName)
+    throw new Error(`${where} cannot set a toolName`);
+  const nonHttp = (ep.expose ?? []).filter((transport) => transport !== "HTTP");
+  if (nonHttp.length > 0) {
+    throw new Error(`${where} is HTTP-only — remove ${nonHttp.join(", ")} from expose`);
+  }
+}
 function assertHeadEndpoint(prefix, key, ep) {
   const where = `Contract "${prefix}": HEAD endpoint "${key}"`;
   if (!ep.rawResponse)
@@ -291,6 +320,10 @@ var STITCH_ERROR_STATUS = {
   DOWNLOAD_NOT_FOUND: 404,
   VIEW_HTTP_ERROR: 502,
   OPERATION_NOT_SUCCEEDED: 409,
+  STREAM_ITEM_INVALID: 500,
+  STREAM_FRAME_TOO_LARGE: 500,
+  STREAM_TERMINAL_MISSING: 500,
+  STREAM_LIFETIME_EXCEEDED: 408,
   INTERNAL_SERVER_ERROR: 500
 };
 function isStitchErrorCode(code) {
@@ -427,4 +460,20 @@ function decodeCursor(cursor, schema) {
     return null;
   }
 }
-export { parseTrailingWildcard, ALL_TRANSPORTS, defineContract, AppError, notFound, badRequest, unauthorized, forbidden, conflict, rateLimited, STITCH_ERROR_STATUS, isStitchErrorCode, appError, defineErrors, createContractFactory, ManagedFilePathSchema, ManagedFileRefSchema, paginatedSchema, encodeCursor, decodeCursor };
+// src/contract/stream.ts
+import { z as z5 } from "zod";
+var DEFAULT_CONTRACT_STREAM_FRAME_BYTES = 256 * 1024;
+var ContractStreamFrameSchema = z5.discriminatedUnion("type", [
+  z5.object({ type: z5.literal("data"), data: z5.unknown() }).strict(),
+  z5.object({
+    type: z5.literal("error"),
+    error: z5.object({
+      code: z5.string(),
+      message: z5.string().optional(),
+      details: z5.unknown().optional(),
+      hint: z5.string().optional()
+    }).strict()
+  }).strict(),
+  z5.object({ type: z5.literal("end") }).strict()
+]);
+export { parseTrailingWildcard, ALL_TRANSPORTS, defineContract, AppError, notFound, badRequest, unauthorized, forbidden, conflict, rateLimited, STITCH_ERROR_STATUS, isStitchErrorCode, appError, defineErrors, createContractFactory, ManagedFilePathSchema, ManagedFileRefSchema, paginatedSchema, encodeCursor, decodeCursor, DEFAULT_CONTRACT_STREAM_FRAME_BYTES, ContractStreamFrameSchema };

package/dist/{index-6taryy00.js → index-dafax5md.js}

@@ -1,6 +1,6 @@
 import {
   isUnsafeKey
-} from "./index-wd8g8z6e.js";
+} from "./index-9ky9hhg3.js";
 import {
   isRecord
 } from "./index-smpbdg6k.js";