stitchkit 0.80.1 → 0.82.0

package/dist/{index-fxz0v7vg.js → index-7evdsyez.js}

@@ -5,88 +5,6 @@ import {
   isRecord
 } from "./index-77fekveh.js";
 
-// src/internal/random-hex.ts
-function randomHex(bytes) {
-  const arr = new Uint8Array(bytes);
-  crypto.getRandomValues(arr);
-  let hex = "";
-  for (const byte of arr)
-    hex += byte.toString(16).padStart(2, "0");
-  return hex;
-}
-
-// src/observability/trace.ts
-var TRACEPARENT_RE = /^([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})(.*)$/i;
-function createTraceContext() {
-  return { traceId: randomHex(16), spanId: randomHex(8) };
-}
-function parseTraceparent(header) {
-  if (!header)
-    return null;
-  const match = TRACEPARENT_RE.exec(header.trim());
-  if (!match?.[1] || !match[2] || !match[3] || !match[4] || match[5] === undefined)
-    return null;
-  const version = match[1].toLowerCase();
-  if (version === "ff")
-    return null;
-  const suffix = match[5];
-  if (version === "00" ? suffix !== "" : suffix !== "" && !/^(?:-[0-9a-f]{2,})+$/i.test(suffix)) {
-    return null;
-  }
-  const traceId = match[2].toLowerCase();
-  const parentSpanId = match[3].toLowerCase();
-  const traceFlags = match[4].toLowerCase();
-  if (/^0+$/.test(traceId) || /^0+$/.test(parentSpanId))
-    return null;
-  return { traceId, spanId: randomHex(8), parentSpanId, traceFlags };
-}
-function formatTraceparent(ctx) {
-  return `00-${ctx.traceId}-${ctx.spanId}-${ctx.traceFlags ?? "01"}`;
-}
-function resolveTraceContext(req) {
-  return parseTraceparent(req.headers.get("traceparent")) ?? createTraceContext();
-}
-function childSpan(parent) {
-  return {
-    traceId: parent.traceId,
-    spanId: randomHex(8),
-    parentSpanId: parent.spanId,
-    ...parent.tracestate !== undefined && { tracestate: parent.tracestate },
-    ...parent.baggage !== undefined && { baggage: parent.baggage },
-    ...parent.traceFlags !== undefined && { traceFlags: parent.traceFlags }
-  };
-}
-var encoder = new TextEncoder;
-function boundedPropagationValue(value, maxBytes, maxMembers) {
-  if (typeof value !== "string")
-    return;
-  const trimmed = value.trim();
-  if (!trimmed || encoder.encode(trimmed).byteLength > maxBytes)
-    return;
-  for (const character of trimmed) {
-    const code = character.charCodeAt(0);
-    if (code <= 31 || code === 127)
-      return;
-  }
-  const members = trimmed.split(",");
-  if (members.length > maxMembers || members.some((member) => !member.trim())) {
-    return;
-  }
-  return trimmed;
-}
-function resolvePropagationContext(metadata, fallback) {
-  const traceparent = metadata?.traceparent;
-  const parsed = typeof traceparent === "string" ? parseTraceparent(traceparent) : null;
-  const trace = traceparent === undefined ? fallback ?? createTraceContext() : parsed ?? createTraceContext();
-  const tracestate = parsed ? boundedPropagationValue(metadata?.tracestate, 512, 32) : undefined;
-  const baggage = boundedPropagationValue(metadata?.baggage, 8192, 180);
-  return {
-    ...trace,
-    ...tracestate !== undefined && { tracestate },
-    ...baggage !== undefined && { baggage }
-  };
-}
-
 // src/internal/errors.ts
 import { z } from "zod";
 function issuePath(path) {
@@ -191,4 +109,4 @@ function validateDeclaredOutput(schema, data, onStripped) {
   return validateHandlerOutput(schema, data, onStripped);
 }
 
-export { randomHex, createTraceContext, parseTraceparent, formatTraceparent, resolveTraceContext, childSpan, resolvePropagationContext, formatZodError, zodIssues, errorCode, recordedErrorMessage, normalizeError, validateDeclaredOutput };
+export { formatZodError, zodIssues, errorCode, recordedErrorMessage, normalizeError, validateDeclaredOutput };

package/dist/{index-xcetq6j3.js → index-90d7h2cr.js}

@@ -2,11 +2,11 @@ import {
   contextContributionDelta,
   mergeContextContribution,
   prepareContextContribution
-} from "./index-m9kzax52.js";
+} from "./index-p18f59zy.js";
 import {
   base64UrlToBytes,
   bytesToBase64Url
-} from "./index-y01f4223.js";
+} from "./index-2bxcmqkb.js";
 import {
   forbidden,
   unauthorized
@@ -20,23 +20,32 @@ import {
 } from "./index-77fekveh.js";
 
 // src/server/middleware/cookies.ts
-function parseCookies(header) {
+function parseCookieHeader(header) {
   if (!header)
-    return {};
-  const cookies = {};
+    return [];
+  const pairs = [];
   for (const pair of header.split(";")) {
     const eq = pair.indexOf("=");
     if (eq === -1)
       continue;
     const key = pair.slice(0, eq).trim();
-    if (!key || isUnsafeKey(key))
+    if (!key)
       continue;
     const raw = pair.slice(eq + 1).trim();
+    let value = raw;
     try {
-      cookies[key] = decodeURIComponent(raw);
-    } catch {
-      cookies[key] = raw;
-    }
+      value = decodeURIComponent(raw);
+    } catch {}
+    pairs.push([key, value]);
+  }
+  return pairs;
+}
+function parseCookies(header) {
+  const cookies = {};
+  for (const [key, value] of parseCookieHeader(header)) {
+    if (isUnsafeKey(key))
+      continue;
+    cookies[key] = value;
   }
   return cookies;
 }
@@ -57,11 +66,21 @@ function serializeCookie(name, value, opts = {}) {
   return cookie;
 }
 function defineCookie(config) {
-  const { name, ...options } = config;
+  const { name, duplicates = "last", ...options } = config;
+  const getAll = (req) => parseCookieHeader(req.headers.get("cookie")).flatMap(([key, value]) => key === name ? [value] : []);
   return {
     get(req) {
-      return parseCookies(req.headers.get("cookie"))[name];
+      const values = getAll(req);
+      if (values.length === 0)
+        return;
+      if (duplicates === "first")
+        return values[0];
+      if (duplicates === "reject") {
+        return new Set(values).size === 1 ? values[0] : undefined;
+      }
+      return values[values.length - 1];
     },
+    getAll,
     set(value) {
       return serializeCookie(name, value, options);
     },
@@ -304,4 +323,4 @@ async function verifyPkce(verifier, challenge) {
   return derived === challenge;
 }
 
-export { parseCookies, serializeCookie, defineCookie, verifyJwt, signJwt, extractToken, createAuthHook, composeAuthHooks, createBearerResolver, deriveCodeChallenge, verifyPkce };
+export { parseCookieHeader, parseCookies, serializeCookie, defineCookie, verifyJwt, signJwt, extractToken, createAuthHook, composeAuthHooks, createBearerResolver, deriveCodeChallenge, verifyPkce };

package/dist/{index-t0z5p5w6.js → index-apn8repm.js}

@@ -4,7 +4,7 @@ import {
 } from "./index-2qzskm8h.js";
 import {
   zodIssues
-} from "./index-fxz0v7vg.js";
+} from "./index-7evdsyez.js";
 import {
   AppError
 } from "./index-0w9abg87.js";

package/dist/{index-758zx2ha.js → index-dggwnnjv.js}

@@ -1,7 +1,7 @@
 import {
   getRequestContext,
   runWithRequestContext
-} from "./index-dwf1f2ap.js";
+} from "./index-vsbzgd7b.js";
 import {
   objectShapeKeys
 } from "./index-mgtxfe6b.js";
@@ -12,7 +12,7 @@ import {
   formatZodError,
   normalizeError,
   validateDeclaredOutput
-} from "./index-fxz0v7vg.js";
+} from "./index-7evdsyez.js";
 import {
   AppError,
   STITCH_ERROR_STATUS,

package/dist/{index-dwf1f2ap.js → index-f9mb610r.js}

@@ -1,6 +1,3 @@
-import {
-  resolveTraceContext
-} from "./index-fxz0v7vg.js";
 import {
   isUnsafeKey
 } from "./index-kzfs85xp.js";
@@ -177,62 +174,4 @@ function isPublicIp(value) {
   return true;
 }
 
-// src/observability/context.ts
-import { AsyncLocalStorage } from "node:async_hooks";
-var storage;
-var requestStorage = () => {
-  storage ??= new AsyncLocalStorage;
-  return storage;
-};
-function runWithRequestContext(ctx, fn) {
-  return requestStorage().run(ctx, fn);
-}
-function getRequestContext() {
-  return requestStorage().getStore();
-}
-function getTraceId() {
-  return requestStorage().getStore()?.trace.traceId;
-}
-function getUserId() {
-  return requestStorage().getStore()?.userId;
-}
-function setRequestUser(userId) {
-  const ctx = requestStorage().getStore();
-  if (ctx)
-    ctx.userId = userId;
-}
-function setRequestEndpoint(serviceName, action) {
-  const ctx = requestStorage().getStore();
-  if (ctx) {
-    ctx.serviceName = serviceName;
-    ctx.action = action;
-  }
-}
-function setRequestDimensions(dimensions) {
-  const ctx = requestStorage().getStore();
-  if (ctx)
-    ctx.dimensions = { ...ctx.dimensions, ...dimensions };
-}
-function setRequestError(error) {
-  const ctx = requestStorage().getStore();
-  if (ctx)
-    ctx.error = error;
-}
-function wrapInRequestContext(handler, options = {}) {
-  return (req, server) => {
-    const ctx = {
-      trace: resolveTraceContext(req),
-      source: "http",
-      method: req.method,
-      path: new URL(req.url, "http://localhost").pathname,
-      startedAt: process.hrtime.bigint(),
-      ...getClientInfo(req, {
-        trustProxy: options.trustProxy,
-        socketIp: resolveSocketIp(req, server)
-      })
-    };
-    return runWithRequestContext(ctx, () => handler(req, server));
-  };
-}
-
-export { generateTraceId, resolveTraceId, resolveSocketIp, extractIp, getClientInfo, parseQueryParams, isPublicIp, runWithRequestContext, getRequestContext, getTraceId, getUserId, setRequestUser, setRequestEndpoint, setRequestDimensions, setRequestError, wrapInRequestContext };
+export { generateTraceId, resolveTraceId, resolveSocketIp, extractIp, getClientInfo, parseQueryParams, isPublicIp };

package/dist/{index-5mtc969c.js → index-fwbkp2jn.js}

@@ -1,6 +1,6 @@
 import {
   executeToolMethod
-} from "./index-758zx2ha.js";
+} from "./index-dggwnnjv.js";
 import {
   assertToolExtensionCompatible,
   mergeSchemas,

package/dist/index-p13mwz16.js

@@ -0,0 +1,16 @@
+import {
+  isRecord
+} from "./index-77fekveh.js";
+
+// src/internal/error-message.ts
+function messageOf(value) {
+  if (value instanceof Error)
+    return value.message;
+  if (typeof value === "string")
+    return value;
+  if (isRecord(value) && typeof value.message === "string")
+    return value.message;
+  return "";
+}
+
+export { messageOf };

package/dist/{index-m9kzax52.js → index-p18f59zy.js}

@@ -1,6 +1,7 @@
 import {
-  mergeMeta
-} from "./index-y01f4223.js";
+  mergeMeta,
+  resolveRouteParamsSchema
+} from "./index-2bxcmqkb.js";
 import {
   isUnsafeKey
 } from "./index-kzfs85xp.js";
@@ -92,7 +93,7 @@ function bindContract(contract, handlers) {
       toolName: "toolName" in endpoint ? endpoint.toolName : undefined,
       expose: endpoint.rawResponse || endpoint.rawBody || endpoint.responseMeta || "stream" in endpoint && endpoint.stream ? HTTP_ONLY : endpoint.expose,
       scope: endpoint.scope ?? groupScope,
-      paramsSchema: endpoint.params,
+      paramsSchema: resolveRouteParamsSchema(endpoint.path, endpoint.params),
       inputSchema: endpoint.input,
       outputSchema: endpoint.output,
       stream: "stream" in endpoint ? endpoint.stream : undefined,
@@ -106,6 +107,7 @@ function bindContract(contract, handlers) {
       meta: mergeMeta(contract.meta.meta, endpoint.meta),
       rawResponse: endpoint.rawResponse,
       rawBody: endpoint.rawBody,
+      safelistedBody: endpoint.safelistedBody,
       responseMeta: endpoint.responseMeta,
       contentType: "contentType" in endpoint ? endpoint.contentType : undefined,
       handler: streamingHandler ? (ctx) => streamingHandler.execute(ctx, ctx.files ?? {}) : (ctx) => {
@@ -196,7 +198,7 @@ function createImplementRegistry() {
 
 // src/server/middleware/cors.ts
 var DEFAULT_CORS_ALLOW_HEADERS = "Content-Type, Authorization, X-Trace-Id, traceparent, tracestate";
-var DEFAULT_CORS_EXPOSE_HEADERS = "Content-Disposition, Content-Length, Content-Range, Accept-Ranges, ETag, Last-Modified, X-Request-Id";
+var DEFAULT_CORS_EXPOSE_HEADERS = "Content-Disposition, Content-Length, Content-Range, Accept-Ranges, ETag, Last-Modified, X-Request-Id, X-Build-Id";
 function assertCorsConfig(config) {
   if (config.credentials && (config.origin === undefined || config.origin === "*")) {
     throw new Error("[stitchkit] cors: `credentials: true` cannot be combined with a wildcard origin. " + "Set `origin` to an explicit string or list.");
@@ -222,6 +224,15 @@ function resolveOrigin(config, requestOrigin) {
   }
   return config.origin;
 }
+function isOriginAllowed(config, requestOrigin) {
+  if (!config || config.origin === undefined || config.origin === "*")
+    return false;
+  if (!requestOrigin || requestOrigin === "null")
+    return false;
+  const lower = requestOrigin.toLowerCase();
+  const allowed = Array.isArray(config.origin) ? config.origin : [config.origin];
+  return allowed.some((origin) => origin.toLowerCase() === lower);
+}
 function corsHeaders(config, requestOrigin) {
   const allowOrigin = resolveOrigin(config, requestOrigin);
   const headers = {
@@ -250,6 +261,11 @@ function corsPreflightResponse(config, req) {
   });
 }
 
+// src/internal/media-type.ts
+function mediaTypeEssence(contentType) {
+  return (contentType ?? "").split(";", 1)[0]?.trim().toLowerCase() ?? "";
+}
+
 // src/server/process-signal-common.ts
 var DEFAULT_PROCESS_SIGNALS = ["SIGINT", "SIGTERM"];
 var defaultSignalSource = {
@@ -373,4 +389,4 @@ function mergeContextContribution(ctx, value, scope) {
   Object.assign(ctx, prepareContextContribution(value, scope));
 }
 
-export { defineMultipartStream, createMultipartStream, contractOnlyService, implement, createImplement, createScopedImplement, createScopedImplementRegistry, implementRegistry, createImplementRegistry, DEFAULT_CORS_ALLOW_HEADERS, DEFAULT_CORS_EXPOSE_HEADERS, assertCorsConfig, corsHeaders, corsPreflightResponse, DEFAULT_PROCESS_SIGNALS, defaultSignalSource, reportSignalError, guardSignalCallback, RUNTIME_CONTEXT_RESERVED_KEYS, contextContributionDelta, prepareContextContribution, mergeContextContribution };
+export { mediaTypeEssence, defineMultipartStream, createMultipartStream, contractOnlyService, implement, createImplement, createScopedImplement, createScopedImplementRegistry, implementRegistry, createImplementRegistry, DEFAULT_CORS_ALLOW_HEADERS, DEFAULT_CORS_EXPOSE_HEADERS, assertCorsConfig, isOriginAllowed, corsHeaders, corsPreflightResponse, DEFAULT_PROCESS_SIGNALS, defaultSignalSource, reportSignalError, guardSignalCallback, RUNTIME_CONTEXT_RESERVED_KEYS, contextContributionDelta, prepareContextContribution, mergeContextContribution };

package/dist/{index-hb5pf3s4.js → index-qmgs7y68.js}

@@ -1,6 +1,6 @@
 import {
   normalizeError
-} from "./index-fxz0v7vg.js";
+} from "./index-7evdsyez.js";
 
 // src/internal/bounded-lines.ts
 var DEFAULT_STREAM_LINE_BYTES = 1024 * 1024;

package/dist/{index-2rwwmr7v.js → index-s4ckmrac.js}

@@ -3,7 +3,7 @@ import {
 } from "./index-dx9xehwt.js";
 import {
   contractToolMountable
-} from "./index-5mtc969c.js";
+} from "./index-fwbkp2jn.js";
 import {
   projectToolSurface
 } from "./index-mgtxfe6b.js";

package/dist/{index-h4pj6fta.js → index-s8cnx02s.js}

@@ -8,15 +8,18 @@ var BackoffPolicySchema = z.object({
 }).strict().readonly().refine((policy) => policy.maxDelayMs >= policy.minDelayMs, {
   message: "maxDelayMs must be at least minDelayMs"
 });
+function backoffDelay(policy, attempt, random = Math.random) {
+  const exponential = Math.min(policy.maxDelayMs, policy.minDelayMs * 2 ** Math.max(0, attempt - 1));
+  const spread = exponential * policy.jitter * random();
+  return Math.max(1, Math.round(exponential - spread));
+}
 function createBackoff(policy, random = Math.random) {
-  const { minDelayMs, maxDelayMs, jitter } = BackoffPolicySchema.parse(policy);
+  const parsed = BackoffPolicySchema.parse(policy);
   let attempt = 0;
   return {
     next() {
-      const exponential = Math.min(maxDelayMs, minDelayMs * 2 ** attempt);
       attempt += 1;
-      const spread = exponential * jitter * random();
-      return Math.max(1, Math.round(exponential - spread));
+      return backoffDelay(parsed, attempt, random);
     },
     reset() {
       attempt = 0;
@@ -84,4 +87,4 @@ async function* resumableIterator(config) {
   }
 }
 
-export { BackoffPolicySchema, createBackoff, resumableIterator };
+export { BackoffPolicySchema, backoffDelay, createBackoff, resumableIterator };

package/dist/{index-k9ay6v6d.js → index-vchzar7e.js}

@@ -1,3 +1,6 @@
+import {
+  RELEASE_HEADER
+} from "./index-y91ry9h2.js";
 import {
   ShutdownOptionsSchema,
   isStreamCancellation,
@@ -7,7 +10,7 @@ import {
 import {
   createValidatedRealtimeSocket,
   isModuleNotFound
-} from "./index-t0z5p5w6.js";
+} from "./index-apn8repm.js";
 import {
   DEFAULT_PROCESS_SIGNALS,
   RUNTIME_CONTEXT_RESERVED_KEYS,
@@ -16,35 +19,42 @@ import {
   corsPreflightResponse,
   defaultSignalSource,
   guardSignalCallback,
+  isOriginAllowed,
+  mediaTypeEssence,
   reportSignalError
-} from "./index-m9kzax52.js";
+} from "./index-p18f59zy.js";
 import {
-  extractIp,
-  getClientInfo,
   getRequestContext,
-  parseQueryParams,
-  resolveSocketIp,
-  resolveTraceId,
   runWithRequestContext,
   setRequestEndpoint,
   setRequestError
-} from "./index-dwf1f2ap.js";
+} from "./index-vsbzgd7b.js";
+import {
+  extractIp,
+  getClientInfo,
+  parseQueryParams,
+  resolveSocketIp,
+  resolveTraceId
+} from "./index-f9mb610r.js";
 import {
   errorCode,
   normalizeError,
   recordedErrorMessage,
-  resolveTraceContext,
   validateDeclaredOutput
-} from "./index-fxz0v7vg.js";
+} from "./index-7evdsyez.js";
 import {
   DEFAULT_CONTRACT_STREAM_FRAME_BYTES,
   joinRoutePath,
   parseTrailingWildcard
-} from "./index-y01f4223.js";
+} from "./index-2bxcmqkb.js";
 import {
   AppError,
-  badRequest
+  badRequest,
+  forbidden
 } from "./index-0w9abg87.js";
+import {
+  resolveTraceContext
+} from "./index-zcgf3gqf.js";
 import {
   isUnsafeKey,
   safeJsonParse
@@ -829,11 +839,23 @@ async function readRequestText(req, maxBytes) {
 }
 
 // src/server/context.ts
-function parseJsonBody(req, text) {
+function parseJsonBody(req, text, method, cors) {
   if (text.trim() === "")
     return {};
-  if (!req.headers.get("content-type")?.includes("application/json")) {
-    badRequest("Request body must be application/json");
+  const essence = mediaTypeEssence(req.headers.get("content-type"));
+  if (essence !== "application/json") {
+    if (!method.safelistedBody || essence !== "text/plain") {
+      badRequest("Request body must be application/json");
+    }
+    const origin = req.headers.get("origin");
+    if (!cors || cors.origin === undefined || cors.origin === "*") {
+      forbidden("A text/plain body requires an explicit cors.origin allow-list on the server");
+    }
+    if (!origin)
+      forbidden("A text/plain body requires an Origin header");
+    if (!isOriginAllowed(cors, origin)) {
+      forbidden("A text/plain body is accepted only from an allowed origin");
+    }
   }
   try {
     return safeJsonParse(text);
@@ -865,7 +887,7 @@ function parsePathParamsInto(ctx, method) {
     ctx.params = method.paramsSchema.parse(ctx.params);
   }
 }
-async function parseRequestPayloadInto(ctx, req, url, method, maxJsonBodyBytes) {
+async function parseRequestPayloadInto(ctx, req, url, method, maxJsonBodyBytes, cors) {
   if (method.multipart) {
     const multipart = await parseMultipart(req, method.multipart, method.inputSchema, method.multipartReceivers);
     ctx.input = multipart.fields;
@@ -876,12 +898,11 @@ async function parseRequestPayloadInto(ctx, req, url, method, maxJsonBodyBytes)
     if (req.method === "GET") {
       ctx.input = method.inputSchema.parse(parseQueryParams(url));
     } else if (req.method === "DELETE") {
-      const ct = req.headers.get("content-type");
-      if (ct?.includes("application/json")) {
+      if (mediaTypeEssence(req.headers.get("content-type")) === "application/json") {
         const text = await readRequestText(req, method.maxJsonBodyBytes ?? maxJsonBodyBytes);
         if (method.rawBody)
           ctx.rawBody = text;
-        ctx.input = method.inputSchema.parse(parseJsonBody(req, text));
+        ctx.input = method.inputSchema.parse(parseJsonBody(req, text, method, cors));
       } else {
         ctx.input = method.inputSchema.parse(parseQueryParams(url));
       }
@@ -889,7 +910,7 @@ async function parseRequestPayloadInto(ctx, req, url, method, maxJsonBodyBytes)
       const text = await readRequestText(req, method.maxJsonBodyBytes ?? maxJsonBodyBytes);
       if (method.rawBody)
         ctx.rawBody = text;
-      ctx.input = method.inputSchema.parse(parseJsonBody(req, text));
+      ctx.input = method.inputSchema.parse(parseJsonBody(req, text, method, cors));
     }
   }
   return;
@@ -1331,16 +1352,29 @@ function matchSegments(patternSegments, requestSegments) {
     if (actual === undefined)
       return null;
     if (pattern.startsWith(":")) {
-      params[pattern.slice(1)] = decodeURIComponent(actual);
+      const decoded = decodeSegment(actual);
+      if (decoded === null)
+        return null;
+      params[pattern.slice(1)] = decoded;
     } else if (pattern !== actual) {
       return null;
     }
   }
   if (wildcardName) {
-    params[wildcardName] = requestSegments.slice(prefixLength).map(decodeURIComponent).join("/");
+    const decoded = requestSegments.slice(prefixLength).map(decodeSegment);
+    if (decoded.some((segment) => segment === null))
+      return null;
+    params[wildcardName] = decoded.join("/");
   }
   return params;
 }
+function decodeSegment(segment) {
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return null;
+  }
+}
 function segmentRank(segment) {
   if (segment?.startsWith("*"))
     return 2;
@@ -1473,6 +1507,17 @@ function matchRawRoute(rawRoutes, httpMethod, pathname) {
 }
 function validateRawRoutes(rawRoutes) {
   const routes = rawRoutes ?? [];
+  for (const route of routes) {
+    if (route.serviceName !== undefined && route.serviceName.trim().length === 0) {
+      throw new Error(`Raw route ${route.method} ${route.path} has an empty serviceName`);
+    }
+    if (route.action !== undefined && route.action.trim().length === 0) {
+      throw new Error(`Raw route ${route.method} ${route.path} has an empty action`);
+    }
+    if (route.action !== undefined && route.serviceName === undefined) {
+      throw new Error(`Raw route ${route.method} ${route.path} declares action without serviceName`);
+    }
+  }
   const shapes = routes.map((route) => rawRouteShape(route.path));
   const conflicts = [];
   for (const [laterIndex, later] of routes.entries()) {
@@ -1720,6 +1765,9 @@ function createHandler(config) {
     if (config.rawRoutes) {
       const rawMatch = matchRawRoute(config.rawRoutes, req.method, url.pathname);
       if (rawMatch) {
+        if (rawMatch.route.serviceName !== undefined) {
+          setRequestEndpoint(rawMatch.route.serviceName, rawMatch.route.action);
+        }
         try {
           const res = await rawMatch.route.handler(req, {
             params: rawMatch.params,
@@ -1756,7 +1804,7 @@ function createHandler(config) {
       if (groupHooks?.authorize) {
         await groupHooks.authorize(ctx, method);
       }
-      multipartLifecycle = await parseRequestPayloadInto(ctx, req, url, method, config.maxJsonBodyBytes);
+      multipartLifecycle = await parseRequestPayloadInto(ctx, req, url, method, config.maxJsonBodyBytes, cors);
       if (hooks?.beforeHandle) {
         await hooks.beforeHandle(ctx, method);
       }
@@ -1851,6 +1899,9 @@ function createHandler(config) {
       const response = await dispatch(req, url, traceId2, server, clientIp, startedAt);
       try {
         response.headers.set("x-request-id", traceId2);
+        const buildId = config.release?.current();
+        if (buildId)
+          response.headers.set(RELEASE_HEADER, buildId);
       } catch {}
       return response;
     };