stitchkit 0.70.1 → 0.70.3

package/dist/application.js

@@ -1065,68 +1065,68 @@ function managedServerResource(config) {
   });
 }
 export {
-  ActivityIdSchema,
-  ActivityLiveStateSchema,
-  ActivitySnapshotSchema,
-  ActivityStageIdSchema,
-  ActivityStageSnapshotSchema,
-  ActivityTokenBrand,
-  ApplicationAdmissionError,
-  ApplicationAdmissionSnapshotSchema,
-  ApplicationHealthHandlerOptionsSchema,
-  ApplicationHealthSchema,
-  ApplicationIdSchema,
-  ApplicationLifecycleEventSchema,
-  ApplicationLifecycleSchema,
-  ApplicationOperationalHandlersOptionsSchema,
-  ApplicationResourceShutdownSchema,
-  ApplicationShutdownBudgetSchema,
-  ApplicationShutdownOptionsSchema,
-  ApplicationShutdownResultSchema,
-  ApplicationSnapshotSchema,
-  ApplicationSnapshotSinkStatusSchema,
-  ApplicationStatusProjectionSchema,
-  BoundedAdmissionPolicySchema,
-  BoundedAdmissionRefusalError,
-  BoundedAdmissionRefusalReasonSchema,
-  BoundedAdmissionSnapshotSchema,
-  BoundedAdmissionStateSchema,
-  BoundedChannelPolicySchema,
-  BoundedChannelReaderError,
-  BoundedChannelSnapshotSchema,
-  BoundedChannelStateSchema,
-  BoundedOperationWaitError,
-  BoundedRateBudgetSchema,
-  CreditWindowSnapshotSchema,
-  DiagnosticJournalCloseResultSchema,
-  DiagnosticJournalFailurePhaseSchema,
-  DiagnosticJournalFrameSchema,
-  DiagnosticJournalLimitsSchema,
-  DiagnosticJournalRefusalReasonSchema,
-  DiagnosticJournalStateSchema,
-  DiagnosticJournalStatusSchema,
-  DiagnosticJournalSubmitResultSchema,
-  DiagnosticJournalWaitResultSchema,
-  ManagedResourceSnapshotSchema,
-  ManagedResourceStateSchema,
-  ManagedScheduleDescriptorSchema,
-  ManagedScheduleErrorPolicySchema,
-  ManagedScheduleOverlapSchema,
-  ManagedScheduleStatusSchema,
-  applicationLifecycleEvent,
-  createActivityProjection,
-  createApplication,
-  createApplicationEventSink,
-  createApplicationHealthHandler,
-  createApplicationOperationalHandlers,
-  createApplicationSnapshotSink,
-  createBoundedAdmission,
-  createBoundedChannel,
-  createCreditWindow,
-  createDiagnosticJournal,
-  createManagedSchedule,
-  defineManagedResource,
-  managedResourceDependencyId,
+  projectApplicationStatus,
   managedServerResource,
-  projectApplicationStatus
+  managedResourceDependencyId,
+  defineManagedResource,
+  createManagedSchedule,
+  createDiagnosticJournal,
+  createCreditWindow,
+  createBoundedChannel,
+  createBoundedAdmission,
+  createApplicationSnapshotSink,
+  createApplicationOperationalHandlers,
+  createApplicationHealthHandler,
+  createApplicationEventSink,
+  createApplication,
+  createActivityProjection,
+  applicationLifecycleEvent,
+  ManagedScheduleStatusSchema,
+  ManagedScheduleOverlapSchema,
+  ManagedScheduleErrorPolicySchema,
+  ManagedScheduleDescriptorSchema,
+  ManagedResourceStateSchema,
+  ManagedResourceSnapshotSchema,
+  DiagnosticJournalWaitResultSchema,
+  DiagnosticJournalSubmitResultSchema,
+  DiagnosticJournalStatusSchema,
+  DiagnosticJournalStateSchema,
+  DiagnosticJournalRefusalReasonSchema,
+  DiagnosticJournalLimitsSchema,
+  DiagnosticJournalFrameSchema,
+  DiagnosticJournalFailurePhaseSchema,
+  DiagnosticJournalCloseResultSchema,
+  CreditWindowSnapshotSchema,
+  BoundedRateBudgetSchema,
+  BoundedOperationWaitError,
+  BoundedChannelStateSchema,
+  BoundedChannelSnapshotSchema,
+  BoundedChannelReaderError,
+  BoundedChannelPolicySchema,
+  BoundedAdmissionStateSchema,
+  BoundedAdmissionSnapshotSchema,
+  BoundedAdmissionRefusalReasonSchema,
+  BoundedAdmissionRefusalError,
+  BoundedAdmissionPolicySchema,
+  ApplicationStatusProjectionSchema,
+  ApplicationSnapshotSinkStatusSchema,
+  ApplicationSnapshotSchema,
+  ApplicationShutdownResultSchema,
+  ApplicationShutdownOptionsSchema,
+  ApplicationShutdownBudgetSchema,
+  ApplicationResourceShutdownSchema,
+  ApplicationOperationalHandlersOptionsSchema,
+  ApplicationLifecycleSchema,
+  ApplicationLifecycleEventSchema,
+  ApplicationIdSchema,
+  ApplicationHealthSchema,
+  ApplicationHealthHandlerOptionsSchema,
+  ApplicationAdmissionSnapshotSchema,
+  ApplicationAdmissionError,
+  ActivityTokenBrand,
+  ActivityStageSnapshotSchema,
+  ActivityStageIdSchema,
+  ActivitySnapshotSchema,
+  ActivityLiveStateSchema,
+  ActivityIdSchema
 };

package/dist/browser/live-state.d.ts

@@ -0,0 +1,126 @@
+import { z } from 'zod';
+export declare const LiveStatePhaseSchema: z.ZodEnum<{
+    closed: "closed";
+    idle: "idle";
+    live: "live";
+    opening: "opening";
+    "resync-required": "resync-required";
+    unavailable: "unavailable";
+}>;
+export type LiveStatePhase = z.infer<typeof LiveStatePhaseSchema>;
+export declare const LiveStateStopReasonSchema: z.ZodEnum<{
+    "buffer-overflow": "buffer-overflow";
+    "controller-capacity": "controller-capacity";
+    "controller-error": "controller-error";
+    gap: "gap";
+    "source-error": "source-error";
+    "source-unavailable": "source-unavailable";
+}>;
+export type LiveStateStopReason = z.infer<typeof LiveStateStopReasonSchema>;
+export declare const LiveStateControllerStatusSchema: z.ZodReadonly<z.ZodObject<{
+    phase: z.ZodEnum<{
+        closed: "closed";
+        idle: "idle";
+        live: "live";
+        opening: "opening";
+        "resync-required": "resync-required";
+        unavailable: "unavailable";
+    }>;
+    generation: z.ZodNumber;
+    hasValue: z.ZodBoolean;
+    bufferedEvents: z.ZodNumber;
+    bufferedBytes: z.ZodNumber;
+    receivedEvents: z.ZodNumber;
+    appliedEvents: z.ZodNumber;
+    duplicateEvents: z.ZodNumber;
+    gapEvents: z.ZodNumber;
+    refusedEvents: z.ZodNumber;
+    reason: z.ZodOptional<z.ZodEnum<{
+        "buffer-overflow": "buffer-overflow";
+        "controller-capacity": "controller-capacity";
+        "controller-error": "controller-error";
+        gap: "gap";
+        "source-error": "source-error";
+        "source-unavailable": "source-unavailable";
+    }>>;
+}, z.core.$strict>>;
+export type LiveStateControllerStatus = z.infer<typeof LiveStateControllerStatusSchema>;
+export interface LiveStateControllerSnapshot<TState> extends LiveStateControllerStatus {
+    readonly value?: TState;
+}
+export type LiveStateEventDecision<TState> = {
+    readonly outcome: 'applied';
+    readonly state: TState;
+} | {
+    readonly outcome: 'duplicate';
+} | {
+    readonly outcome: 'gap';
+};
+export interface LiveStateSourceOpenInput<TEvent> {
+    readonly signal: AbortSignal;
+    /** May run before `open()` resolves; the controller buffers those events finitely. */
+    readonly onEvent: (event: TEvent) => void;
+    /** Reports loss of this source generation. Reconnect policy remains source-owned. */
+    readonly onUnavailable: () => void;
+}
+export interface LiveStateSourceOpenResult<TState> {
+    /** State at the source's declared consistency point. */
+    readonly snapshot: TState;
+    /**
+     * Releases only resources owned by this opened source generation. Must be
+     * idempotent because abort-aware sources may already have begun cleanup.
+     */
+    close(): void | Promise<void>;
+}
+export interface LiveStateSource<TState, TEvent> {
+    /**
+     * Open one continuous generation.
+     *
+     * By resolution, every event after `snapshot`'s consistency point has already
+     * been or will be passed to `onEvent`. A source that performs an unrelated
+     * snapshot read followed by subscription does not satisfy this contract.
+     */
+    open(input: LiveStateSourceOpenInput<TEvent>): Promise<LiveStateSourceOpenResult<TState>>;
+}
+export interface LiveStateControllerError {
+    readonly error: unknown;
+    readonly generation: number;
+    readonly phase: LiveStatePhase;
+}
+export interface LiveStateSubscriberError<TState> {
+    readonly error: unknown;
+    readonly snapshot: LiveStateControllerSnapshot<TState>;
+}
+export interface LiveStateControllerConfig<TState, TEvent> {
+    readonly source: LiveStateSource<TState, TEvent>;
+    /** Provider-owned cursor/revision policy and state reduction. Must be synchronous. */
+    readonly applyEvent: (state: TState, event: TEvent) => LiveStateEventDecision<TState>;
+    readonly maxBufferedEvents: number;
+    readonly maxBufferedBytes: number;
+    /** Exact retained-byte accounting for an event waiting behind the snapshot boundary. */
+    readonly sizeOfEvent: (event: TEvent) => number;
+    readonly signal?: AbortSignal;
+    onControllerError?(failure: LiveStateControllerError): void;
+    onSubscriberError?(failure: LiveStateSubscriberError<TState>): void;
+}
+export interface LiveStateController<TState> {
+    /** Opens only from `idle`; use `resync()` after loss or an explicit refresh. */
+    start(): Promise<LiveStateControllerSnapshot<TState>>;
+    /**
+     * Fences the current generation and opens a fresh source boundary while
+     * bounded pending-operation capacity permits. Otherwise it returns
+     * `unavailable/controller-capacity`; retry after `resync-required` is published.
+     */
+    resync(): Promise<LiveStateControllerSnapshot<TState>>;
+    getSnapshot(): LiveStateControllerSnapshot<TState>;
+    /** Synchronous external-store subscription; async listeners are removed as invalid. */
+    subscribe(listener: (snapshot: LiveStateControllerSnapshot<TState>) => void): () => void;
+    /** Fences current work and closes any source handle that has already opened. */
+    close(): Promise<LiveStateControllerSnapshot<TState>>;
+}
+/**
+ * Keep one application state current across a provider-declared snapshot/event
+ * boundary without owning transport reconnect, schemas, replay storage or cursors.
+ */
+export declare function createLiveStateController<TState, TEvent>(config: LiveStateControllerConfig<TState, TEvent>): LiveStateController<TState>;
+//# sourceMappingURL=live-state.d.ts.map

package/dist/browser/live-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-state.d.ts","sourceRoot":"","sources":["../../src/browser/live-state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,oBAAoB;;;;;;;EAO/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,yBAAyB;;;;;;;EAOpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;mBAe/B,CAAC;AACd,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,MAAM,WAAW,2BAA2B,CAAC,MAAM,CAAE,SAAQ,yBAAyB;IACpF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,sBAAsB,CAAC,MAAM,IACrC;IAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GACjC;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAA;CAAE,CAAC;AAEhC,MAAM,WAAW,wBAAwB,CAAC,MAAM;IAC9C,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,sFAAsF;IACtF,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1C,qFAAqF;IACrF,QAAQ,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,yBAAyB,CAAC,MAAM;IAC/C,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,KAAK,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe,CAAC,MAAM,EAAE,MAAM;IAC7C;;;;;;OAMG;IACH,IAAI,CAAC,KAAK,EAAE,wBAAwB,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;CAC3F;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,wBAAwB,CAAC,MAAM;IAC9C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAC,MAAM,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,yBAAyB,CAAC,MAAM,EAAE,MAAM;IACvD,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,sFAAsF;IACtF,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACtF,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,wFAAwF;IACxF,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,iBAAiB,CAAC,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI,CAAC;IAC5D,iBAAiB,CAAC,CAAC,OAAO,EAAE,wBAAwB,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;CACrE;AAED,MAAM,WAAW,mBAAmB,CAAC,MAAM;IACzC,gFAAgF;IAChF,KAAK,IAAI,OAAO,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD;;;;OAIG;IACH,MAAM,IAAI,OAAO,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,WAAW,IAAI,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACnD,uFAAuF;IACvF,SAAS,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,2BAA2B,CAAC,MAAM,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IACzF,gFAAgF;IAChF,KAAK,IAAI,OAAO,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC,CAAC;CACvD;AAmBD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EACtD,MAAM,EAAE,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,GAChD,mBAAmB,CAAC,MAAM,CAAC,CAsZ7B"}

package/dist/cli.js

@@ -20,10 +20,10 @@ import"./index-0w9abg87.js";
 import"./index-qyrqwr4c.js";
 import"./index-6k1937bx.js";
 export {
-  DEFAULT_EXIT_CODES,
-  createCli,
-  defineCliCommand,
-  emitResult,
+  pollUntilDone,
   parseCliArgs,
-  pollUntilDone
+  emitResult,
+  defineCliCommand,
+  createCli,
+  DEFAULT_EXIT_CODES
 };

package/dist/contract/index.js

@@ -23,25 +23,25 @@ import {
 } from "../index-f6n5n7nz.js";
 import"../index-ksp6e2ye.js";
 export {
-  ALL_TRANSPORTS,
-  AppError,
-  ContractStreamFrameSchema,
-  DEFAULT_CONTRACT_STREAM_FRAME_BYTES,
-  ManagedFilePathSchema,
-  ManagedFileRefSchema,
-  STITCH_ERROR_STATUS,
-  appError,
-  badRequest,
-  conflict,
-  createContractFactory,
-  decodeCursor,
-  defineContract,
-  defineErrors,
-  encodeCursor,
-  forbidden,
-  isStitchErrorCode,
-  notFound,
-  paginatedSchema,
+  unauthorized,
   rateLimited,
-  unauthorized
+  paginatedSchema,
+  notFound,
+  isStitchErrorCode,
+  forbidden,
+  encodeCursor,
+  defineErrors,
+  defineContract,
+  decodeCursor,
+  createContractFactory,
+  conflict,
+  badRequest,
+  appError,
+  STITCH_ERROR_STATUS,
+  ManagedFileRefSchema,
+  ManagedFilePathSchema,
+  DEFAULT_CONTRACT_STREAM_FRAME_BYTES,
+  ContractStreamFrameSchema,
+  AppError,
+  ALL_TRANSPORTS
 };

package/dist/declaration.d.ts

@@ -1,6 +1,10 @@
 /**
  * The project declaration — the one machine-readable statement a repository
  * chooses to make about itself.
+ * Identity names its buildable source/artifact, not product membership, a
+ * checkout or a harness workspace. Explicit product↔repository membership is
+ * many-to-many and belongs to an external registry with its own access policy;
+ * dependencies do not create membership or require private companion metadata.
  *
  * The schema lives in the published framework, not in the repository that fills
  * it in, because it has readers that must never disagree: the project itself,

package/dist/declaration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"declaration.d.ts","sourceRoot":"","sources":["../src/declaration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;GAOG;AACH,eAAO,MAAM,kCAAkC,IAAI,CAAC;AAoBpD,+EAA+E;AAC/E,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK/D;AAUD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,aAO3B,CAAC;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,uCAQlC,CAAC;AAEJ,yEAAyE;AACzE,eAAO,MAAM,qBAAqB;;;;;kBAOvB,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,aAW9B,CAAC;AAEJ,+EAA+E;AAC/E,eAAO,MAAM,qBAAqB,aAEiD,CAAC;AAEpF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB;;;;kBAavB,CAAC;AAEZ,kDAAkD;AAClD,eAAO,MAAM,oBAAoB;;;EAAwC,CAAC;AAoG1E,eAAO,MAAM,oBAAoB;;;kBAKtB,CAAC;AAEZ;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;;;kBAMpC,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;kBA0BnB,CAAC;AAEZ;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,uBAAuB;;;;kBAezB,CAAC;AAEZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,gFAAgF;AAChF,eAAO,MAAM,kBAAkB;;;;;;;;;;;kBAciD,CAAC;AAEjF,0CAA0C;AAC1C,eAAO,MAAM,6BAA6B;;;EAA+B,CAAC;AAE1E;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;;;;;;kBAK1B,CAAC;AAEZ;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB;;;;kBAMzB,CAAC;AAEZ,2EAA2E;AAC3E,eAAO,MAAM,oBAAoB;;;;;;kBAEtB,CAAC;AAEZ,0EAA0E;AAC1E,eAAO,MAAM,qBAAqB;;;;;;EAA0D,CAAC;AAE7F;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;kBAclC,CAAC;AAEJ,6EAA6E;AAC7E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA0DjC,CAAC;AAyCL,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAKpE;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,OAAO,GAAG,kBAAkB,CAU3E;AAED,+CAA+C;AAC/C,wBAAgB,eAAe,CAC7B,WAAW,EAAE,kBAAkB,EAC/B,IAAI,EAAE,MAAM,GACX,WAAW,GAAG,SAAS,CAEzB"}
+{"version":3,"file":"declaration.d.ts","sourceRoot":"","sources":["../src/declaration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;GAOG;AACH,eAAO,MAAM,kCAAkC,IAAI,CAAC;AAoBpD,+EAA+E;AAC/E,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK/D;AAUD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,aAO3B,CAAC;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,uCAQlC,CAAC;AAEJ,yEAAyE;AACzE,eAAO,MAAM,qBAAqB;;;;;kBAOvB,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,aAW9B,CAAC;AAEJ,+EAA+E;AAC/E,eAAO,MAAM,qBAAqB,aAEiD,CAAC;AAEpF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qBAAqB;;;;kBAavB,CAAC;AAEZ,kDAAkD;AAClD,eAAO,MAAM,oBAAoB;;;EAAwC,CAAC;AAoG1E,eAAO,MAAM,oBAAoB;;;kBAKtB,CAAC;AAEZ;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;;;kBAMpC,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;kBA0BnB,CAAC;AAEZ;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,uBAAuB;;;;kBAezB,CAAC;AAEZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,gFAAgF;AAChF,eAAO,MAAM,kBAAkB;;;;;;;;;;;kBAciD,CAAC;AAEjF,0CAA0C;AAC1C,eAAO,MAAM,6BAA6B;;;EAA+B,CAAC;AAE1E;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;;;;;;kBAK1B,CAAC;AAEZ;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB;;;;kBAMzB,CAAC;AAEZ,2EAA2E;AAC3E,eAAO,MAAM,oBAAoB;;;;;;kBAEtB,CAAC;AAEZ,0EAA0E;AAC1E,eAAO,MAAM,qBAAqB;;;;;;EAA0D,CAAC;AAE7F;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;kBAclC,CAAC;AAEJ,6EAA6E;AAC7E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA0DjC,CAAC;AAyCL,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAKpE;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,OAAO,GAAG,kBAAkB,CAU3E;AAED,+CAA+C;AAC/C,wBAAgB,eAAe,CAC7B,WAAW,EAAE,kBAAkB,EAC/B,IAAI,EAAE,MAAM,GACX,WAAW,GAAG,SAAS,CAEzB"}

package/dist/declaration.js

@@ -157,27 +157,27 @@ function findProjectRole(declaration, name) {
   return declaration.roles.find((role) => role.name === name);
 }
 export {
-  BindingVariableSchema,
-  PROJECT_DECLARATION_SCHEMA_VERSION,
-  ProjectBuildInputSchema,
-  ProjectBuildSchema,
-  ProjectCommandSchema,
-  ProjectDeclarationSchema,
-  ProjectDescriptionSchema,
-  ProjectEnvShapeSchema,
-  ProjectEnvVariableSchema,
-  ProjectIdentitySchema,
-  ProjectListenerSchema,
-  ProjectMigrationsSchema,
-  ProjectReleaseSchema,
-  ProjectRequirementPhaseSchema,
-  ProjectRequirementSchema,
-  ProjectRoleCommandSchema,
-  ProjectRoleSchema,
-  ProjectRunModeSchema,
-  ProjectSlugSchema,
-  RepositoryPathSchema,
-  findProjectRole,
+  parseProjectDeclaration,
   namesAMachine,
-  parseProjectDeclaration
+  findProjectRole,
+  RepositoryPathSchema,
+  ProjectSlugSchema,
+  ProjectRunModeSchema,
+  ProjectRoleSchema,
+  ProjectRoleCommandSchema,
+  ProjectRequirementSchema,
+  ProjectRequirementPhaseSchema,
+  ProjectReleaseSchema,
+  ProjectMigrationsSchema,
+  ProjectListenerSchema,
+  ProjectIdentitySchema,
+  ProjectEnvVariableSchema,
+  ProjectEnvShapeSchema,
+  ProjectDescriptionSchema,
+  ProjectDeclarationSchema,
+  ProjectCommandSchema,
+  ProjectBuildSchema,
+  ProjectBuildInputSchema,
+  PROJECT_DECLARATION_SCHEMA_VERSION,
+  BindingVariableSchema
 };

package/dist/files.js

@@ -8,8 +8,8 @@ import {
   ManagedFileRefSchema
 } from "./index-6k1937bx.js";
 export {
-  ManagedFileError,
-  ManagedFilePathSchema,
+  createManagedFileBoundary,
   ManagedFileRefSchema,
-  createManagedFileBoundary
+  ManagedFilePathSchema,
+  ManagedFileError
 };

package/dist/{index-4g196jmf.js → index-1zxf9x2z.js}

@@ -54,7 +54,20 @@ var DEFAULT_MAX_PARTS = 1000;
 var CRLF = new Uint8Array([13, 10]);
 var HEADER_END = new Uint8Array([13, 10, 13, 10]);
 var decoder = new TextDecoder;
+var headerDecoder = new TextDecoder("utf-8", { fatal: true });
 var encoder = new TextEncoder;
+var TOKEN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+function hasControl(value, allowTab = false) {
+  for (let index = 0;index < value.length; index++) {
+    const code = value.charCodeAt(index);
+    if (code < 32 && !(allowTab && code === 9) || code === 127)
+      return true;
+  }
+  return false;
+}
+function trimWhitespace(value) {
+  return value.replace(/^[ \t]+|[ \t]+$/g, "");
+}
 function indexOfBytes(haystack, needle) {
   outer:
     for (let index = 0;index <= haystack.length - needle.length; index += 1) {
@@ -97,10 +110,49 @@ function parseBoundary(req) {
   return boundary;
 }
 function parseDisposition(value) {
-  if (!value || !/^form-data(?:;|$)/i.test(value))
+  if (!value)
     badRequest("Invalid multipart disposition");
-  const name = /(?:^|;)\s*name="([^"]*)"/i.exec(value)?.[1];
-  const filename = /(?:^|;)\s*filename="([^"]*)"/i.exec(value)?.[1];
+  const separator = value.indexOf(";");
+  const kind = separator < 0 ? value : value.slice(0, separator);
+  if (trimWhitespace(kind).toLowerCase() !== "form-data") {
+    badRequest("Invalid multipart disposition");
+  }
+  const parameters = new Map;
+  let rest = separator < 0 ? "" : value.slice(separator);
+  while (rest.length > 0) {
+    const match = /^;[ \t]*([^=; \t]+)[ \t]*=[ \t]*(?:"((?:[^"\\]|\\.)*)"|([^; \t]+))[ \t]*/.exec(rest);
+    if (!match?.[1])
+      badRequest("Invalid multipart disposition parameter");
+    const key = match[1].toLowerCase();
+    if (!TOKEN.test(key) || parameters.has(key)) {
+      badRequest("Invalid or duplicate multipart disposition parameter");
+    }
+    const quoted = match[2];
+    const raw = match[3] ?? "";
+    if (quoted === undefined && !TOKEN.test(raw)) {
+      badRequest("Invalid multipart disposition parameter");
+    }
+    const decoded = quoted === undefined ? raw : quoted.replace(/\\(.)/g, "$1");
+    if (hasControl(decoded))
+      badRequest("Invalid multipart disposition parameter");
+    parameters.set(key, decoded);
+    rest = rest.slice(match[0].length);
+  }
+  const name = parameters.get("name");
+  let filename = parameters.get("filename");
+  const extended = parameters.get("filename*");
+  if (extended !== undefined) {
+    const match = /^utf-8'[A-Za-z0-9-]*'((?:[!#$&+.^_`|~0-9A-Za-z-]|%[0-9A-Fa-f]{2})*)$/i.exec(extended);
+    if (!match)
+      badRequest("Invalid multipart extended filename");
+    try {
+      filename = decodeURIComponent(match[1] ?? "");
+    } catch {
+      badRequest("Invalid multipart extended filename");
+    }
+    if (hasControl(filename))
+      badRequest("Invalid multipart extended filename");
+  }
   if (!name || isUnsafeKey(name))
     badRequest("Invalid multipart field name");
   return filename === undefined ? { name } : { name, filename };
@@ -108,23 +160,33 @@ function parseDisposition(value) {
 function parsePartHeaders(bytes) {
   let text;
   try {
-    text = decoder.decode(bytes);
+    text = headerDecoder.decode(bytes);
   } catch {
     badRequest("Invalid multipart headers");
   }
-  const headers = new Headers;
+  const headers = new Map;
   for (const line of text.split(`\r
 `)) {
     const separator = line.indexOf(":");
     if (separator <= 0)
       badRequest("Invalid multipart header");
-    headers.append(line.slice(0, separator).trim(), line.slice(separator + 1).trim());
+    const name = line.slice(0, separator).toLowerCase();
+    const value = trimWhitespace(line.slice(separator + 1));
+    if (!TOKEN.test(name) || hasControl(value, true)) {
+      badRequest("Invalid multipart header");
+    }
+    if (headers.has(name))
+      badRequest("Duplicate multipart header");
+    headers.set(name, value);
   }
   const disposition = parseDisposition(headers.get("content-disposition") ?? undefined);
   const rawContentType = headers.get("content-type");
   const contentType = rawContentType?.split(";", 1)[0]?.trim().toLowerCase();
   const rawSize = headers.get("content-length");
-  const declaredSize = rawSize === null ? undefined : Number(rawSize);
+  if (rawSize !== undefined && !/^[0-9]+$/.test(rawSize)) {
+    badRequest("Invalid multipart part content-length");
+  }
+  const declaredSize = rawSize === undefined ? undefined : Number(rawSize);
   if (declaredSize !== undefined && (!Number.isSafeInteger(declaredSize) || declaredSize < 0)) {
     badRequest("Invalid multipart part content-length");
   }
@@ -906,6 +968,31 @@ function contractStreamResponse(request, context, source, descriptor, operationA
   return Promise.resolve(route.handler(request, context));
 }
 
+// src/server/error-dispatch.ts
+async function dispatchErrorHooks(config) {
+  for (const [scope, hooks] of [
+    ["group", config.group],
+    ["global", config.global]
+  ]) {
+    if (!hooks?.onError)
+      continue;
+    try {
+      const response = await hooks.onError(config.context, config.error, config.endpoint);
+      if (response instanceof Response)
+        return config.respond(response);
+    } catch (error) {
+      const message = `[stitchkit] ${scope} onError failed`;
+      try {
+        if (config.logger) {
+          config.logger.error(message, { error, traceId: config.context.traceId });
+        } else
+          console.error(message, error);
+      } catch {}
+    }
+  }
+  return;
+}
+
 // src/server/logger.ts
 var c = {
   reset: "\x1B[0m",
@@ -1507,7 +1594,7 @@ function createHandler(config) {
         } catch {}
       }
     };
-    const respondError = async (err, errCtx, endpoint) => {
+    const respondError = async (err, errCtx, endpoint, group) => {
       if (isClientClosedRequest(req, err)) {
         const response = applyCors(new Response(null, { status: 499, statusText: "Client Closed Request" }), cors, req);
         complete(response.status, undefined, "cancelled");
@@ -1524,17 +1611,22 @@ function createHandler(config) {
           details: known?.details
         });
       };
-      if (hooks?.onError) {
-        try {
-          const response = await hooks.onError(errCtx ?? buildErrorContext(req, url, traceId, clientIp), err, endpoint);
-          if (response instanceof Response) {
-            recordFailure();
-            const withCors = applyCors(response, cors, req);
-            complete(withCors.status, errorCode(err));
-            return withCors;
-          }
-        } catch {}
-      }
+      const customResponse = await dispatchErrorHooks({
+        context: errCtx ?? buildErrorContext(req, url, traceId, clientIp),
+        error: err,
+        endpoint,
+        group,
+        global: hooks,
+        logger: customLogger,
+        respond: (response) => {
+          recordFailure();
+          const withCors = applyCors(response, cors, req);
+          complete(withCors.status, errorCode(err));
+          return withCors;
+        }
+      });
+      if (customResponse)
+        return customResponse;
       const appErr = normalizeError(err);
       recordFailure(appErr);
       complete(appErr.status, appErr.code);
@@ -1677,7 +1769,7 @@ function createHandler(config) {
       return body;
     } catch (err) {
       await multipartLifecycle?.rollback();
-      return respondError(err, ctx, method);
+      return respondError(err, ctx, method, groupHooks);
     }
   }
   return async (req, server) => {