stitchkit 0.93.0 → 0.94.1

package/dist/index-p13mwz16.js

@@ -1,16 +0,0 @@
-import {
-  isRecord
-} from "./index-77fekveh.js";
-
-// src/internal/error-message.ts
-function messageOf(value) {
-  if (value instanceof Error)
-    return value.message;
-  if (typeof value === "string")
-    return value;
-  if (isRecord(value) && typeof value.message === "string")
-    return value.message;
-  return "";
-}
-
-export { messageOf };

package/dist/index-s8cnx02s.js

@@ -1,90 +0,0 @@
-// src/browser/resumable.ts
-import { z } from "zod";
-var PositiveSafeIntegerSchema = z.number().int().positive().safe();
-var BackoffPolicySchema = z.object({
-  minDelayMs: PositiveSafeIntegerSchema,
-  maxDelayMs: PositiveSafeIntegerSchema,
-  jitter: z.number().min(0).max(1)
-}).strict().readonly().refine((policy) => policy.maxDelayMs >= policy.minDelayMs, {
-  message: "maxDelayMs must be at least minDelayMs"
-});
-function backoffDelay(policy, attempt, random = Math.random) {
-  const exponential = Math.min(policy.maxDelayMs, policy.minDelayMs * 2 ** Math.max(0, attempt - 1));
-  const spread = exponential * policy.jitter * random();
-  return Math.max(1, Math.round(exponential - spread));
-}
-function createBackoff(policy, random = Math.random) {
-  const parsed = BackoffPolicySchema.parse(policy);
-  let attempt = 0;
-  return {
-    next() {
-      attempt += 1;
-      return backoffDelay(parsed, attempt, random);
-    },
-    reset() {
-      attempt = 0;
-    }
-  };
-}
-var DEFAULT_RETRY = { minDelayMs: 100, maxDelayMs: 30000, jitter: 0.5 };
-
-class ResumableAbortError extends Error {
-  constructor() {
-    super("Resumable iterator was aborted");
-    this.name = "ResumableAbortError";
-  }
-}
-function sleep(ms, signal) {
-  return new Promise((resolve, reject) => {
-    const timer = setTimeout(() => {
-      signal?.removeEventListener("abort", onAbort);
-      resolve();
-    }, ms);
-    function onAbort() {
-      clearTimeout(timer);
-      reject(new ResumableAbortError);
-    }
-    if (signal?.aborted) {
-      clearTimeout(timer);
-      reject(new ResumableAbortError);
-      return;
-    }
-    signal?.addEventListener("abort", onAbort, { once: true });
-  });
-}
-async function* resumableIterator(config) {
-  const backoff = createBackoff(config.retry ?? DEFAULT_RETRY, config.random);
-  let cursor;
-  let attempt = 0;
-  for (;; ) {
-    if (config.signal?.aborted)
-      return;
-    try {
-      const source = await config.open(cursor);
-      for await (const item of source) {
-        if (config.signal?.aborted)
-          return;
-        attempt = 0;
-        backoff.reset();
-        cursor = config.advance(item, cursor);
-        yield item;
-        if (config.isTerminal?.(item))
-          return;
-      }
-      throw new Error("Resumable source ended without a terminal item");
-    } catch (error) {
-      if (config.signal?.aborted || error instanceof ResumableAbortError)
-        return;
-      attempt += 1;
-      const delayMs = backoff.next();
-      config.onAttempt?.({ number: attempt, delayMs, error });
-      try {
-        await sleep(delayMs, config.signal);
-      } catch {
-        return;
-      }
-    }
-  }
-}
-
-export { BackoffPolicySchema, backoffDelay, createBackoff, resumableIterator };

package/dist/index-sr93cwf9.js

@@ -1,325 +0,0 @@
-import {
-  deriveCodeChallenge
-} from "./index-hr4tzbwq.js";
-import {
-  contextContributionDelta,
-  mergeContextContribution,
-  prepareContextContribution
-} from "./index-cxqhvq21.js";
-import {
-  base64UrlToBytes,
-  bytesToBase64Url
-} from "./index-rxfy4cq7.js";
-import {
-  forbidden,
-  unauthorized
-} from "./index-2vtcmrj9.js";
-import {
-  isUnsafeKey,
-  safeJsonParse
-} from "./index-kzfs85xp.js";
-import {
-  isRecord
-} from "./index-77fekveh.js";
-
-// src/server/middleware/cookies.ts
-function parseCookieHeader(header) {
-  if (!header)
-    return [];
-  const pairs = [];
-  for (const pair of header.split(";")) {
-    const eq = pair.indexOf("=");
-    if (eq === -1)
-      continue;
-    const key = pair.slice(0, eq).trim();
-    if (!key)
-      continue;
-    const raw = pair.slice(eq + 1).trim();
-    let value = raw;
-    try {
-      value = decodeURIComponent(raw);
-    } catch {}
-    pairs.push([key, value]);
-  }
-  return pairs;
-}
-function parseCookies(header) {
-  const cookies = {};
-  for (const [key, value] of parseCookieHeader(header)) {
-    if (isUnsafeKey(key))
-      continue;
-    cookies[key] = value;
-  }
-  return cookies;
-}
-function serializeCookie(name, value, opts = {}) {
-  let cookie = `${name}=${encodeURIComponent(value)}`;
-  if (opts.maxAge !== undefined)
-    cookie += `; Max-Age=${opts.maxAge}`;
-  if (opts.path)
-    cookie += `; Path=${opts.path}`;
-  if (opts.domain)
-    cookie += `; Domain=${opts.domain}`;
-  if (opts.secure)
-    cookie += "; Secure";
-  if (opts.httpOnly)
-    cookie += "; HttpOnly";
-  if (opts.sameSite)
-    cookie += `; SameSite=${opts.sameSite}`;
-  return cookie;
-}
-function defineCookie(config) {
-  const { name, duplicates = "last", ...options } = config;
-  const getAll = (req) => parseCookieHeader(req.headers.get("cookie")).flatMap(([key, value]) => key === name ? [value] : []);
-  return {
-    get(req) {
-      const values = getAll(req);
-      if (values.length === 0)
-        return;
-      if (duplicates === "first")
-        return values[0];
-      if (duplicates === "reject") {
-        return new Set(values).size === 1 ? values[0] : undefined;
-      }
-      return values[values.length - 1];
-    },
-    getAll,
-    set(value) {
-      return serializeCookie(name, value, options);
-    },
-    clear() {
-      return serializeCookie(name, "", { ...options, maxAge: 0 });
-    }
-  };
-}
-
-// src/server/middleware/auth.ts
-var MAX_TOKEN_BYTES = 8192;
-async function verifyJwt(token, secret, options = {}) {
-  if (!secret)
-    throw new Error("verifyJwt: a non-empty secret is required");
-  if (token.length > MAX_TOKEN_BYTES)
-    throw unauthorized("Token too large");
-  const [headerB64, payloadB64, signatureB64] = token.split(".");
-  if (!headerB64 || !payloadB64 || !signatureB64)
-    throw unauthorized("Invalid token format");
-  let header;
-  let payloadRaw;
-  let signature;
-  try {
-    const decoder = new TextDecoder;
-    header = JSON.parse(decoder.decode(base64UrlToBytes(headerB64)));
-    payloadRaw = safeJsonParse(decoder.decode(base64UrlToBytes(payloadB64)));
-    signature = base64UrlToBytes(signatureB64);
-  } catch {
-    throw unauthorized("Malformed token");
-  }
-  if (!isRecord(payloadRaw))
-    throw unauthorized("Malformed token");
-  const payload = payloadRaw;
-  if (header.alg !== "HS256")
-    throw unauthorized("Unsupported token algorithm");
-  const encoder = new TextEncoder;
-  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["verify"]);
-  const data = encoder.encode(`${headerB64}.${payloadB64}`);
-  const valid = await crypto.subtle.verify("HMAC", key, signature, data);
-  if (!valid)
-    throw unauthorized("Invalid token signature");
-  const leeway = options.leewaySeconds ?? 60;
-  const now = Date.now() / 1000;
-  if ("exp" in payload) {
-    if (typeof payload.exp !== "number")
-      throw unauthorized("Malformed token");
-    if (payload.exp < now - leeway)
-      throw unauthorized("Token expired");
-  }
-  if ("nbf" in payload) {
-    if (typeof payload.nbf !== "number")
-      throw unauthorized("Malformed token");
-    if (payload.nbf > now + leeway)
-      throw unauthorized("Token not yet valid");
-  }
-  if (options.issuer !== undefined && payload.iss !== options.issuer) {
-    throw unauthorized("Token issuer mismatch");
-  }
-  if (options.audience !== undefined) {
-    const aud = payload.aud;
-    const ok = Array.isArray(aud) ? aud.includes(options.audience) : aud === options.audience;
-    if (!ok)
-      throw unauthorized("Token audience mismatch");
-  }
-  return payload;
-}
-async function signJwt(payload, secret, options = {}) {
-  if (!secret)
-    throw new Error("signJwt: a non-empty secret is required");
-  const now = Math.floor(Date.now() / 1000);
-  const claims = {
-    ...payload,
-    iat: now,
-    ...options.expiresInSec !== undefined && { exp: now + options.expiresInSec },
-    ...options.issuer !== undefined && { iss: options.issuer },
-    ...options.audience !== undefined && { aud: options.audience },
-    ...options.subject !== undefined && { sub: options.subject }
-  };
-  const encoder = new TextEncoder;
-  const headerB64 = bytesToBase64Url(encoder.encode(JSON.stringify({ alg: "HS256", typ: "JWT" })));
-  const payloadB64 = bytesToBase64Url(encoder.encode(JSON.stringify(claims)));
-  const signingInput = `${headerB64}.${payloadB64}`;
-  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
-  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(signingInput));
-  const signatureB64 = bytesToBase64Url(new Uint8Array(signature));
-  return `${signingInput}.${signatureB64}`;
-}
-function extractToken(req, cookieName) {
-  const authHeader = req.headers.get("authorization");
-  if (authHeader?.startsWith("Bearer "))
-    return authHeader.slice(7);
-  if (cookieName) {
-    const cookies = parseCookies(req.headers.get("cookie"));
-    return cookies[cookieName] ?? null;
-  }
-  return null;
-}
-function isThenable(value) {
-  try {
-    return "then" in value && typeof value.then === "function";
-  } catch {
-    return false;
-  }
-}
-var scopedAuthHookBrand = Symbol("stitchkit.scoped-auth-hook");
-var authOwnershipPlans = new WeakMap;
-function createShadowContext(ctx) {
-  const shadow = {
-    params: ctx.params,
-    input: ctx.input,
-    source: ctx.source
-  };
-  Object.defineProperties(shadow, Object.getOwnPropertyDescriptors(ctx));
-  return shadow;
-}
-function createAuthHook(config) {
-  const onAnonymous = config.onAnonymous ?? (() => unauthorized());
-  const onForbidden = config.onForbidden ?? (() => forbidden());
-  async function auth(ctx, endpoint) {
-    const identity = ctx.source === "http" ? await config.resolve(ctx) : await config.resolveFromContext?.(ctx) ?? null;
-    config.inject?.(ctx, identity);
-    const scope = endpoint.scope ?? config.defaultScope;
-    if (!scope)
-      return;
-    const entry = Object.hasOwn(config.rules, scope) ? config.rules[scope] : undefined;
-    if (!entry) {
-      throw new Error(`[stitchkit] auth: no rule for scope "${scope}"`);
-    }
-    const rule = typeof entry === "object" ? entry.rule : entry;
-    if (typeof entry === "object" && entry.inject && identity !== null) {
-      const fields = entry.inject(identity, ctx);
-      if (typeof fields === "object" && fields !== null && isThenable(fields)) {
-        throw new Error(`[stitchkit] auth: the inject of scope "${scope}" must be synchronous — an async inject merges a Promise, not fields`);
-      }
-      mergeContextContribution(ctx, fields, scope);
-    }
-    if (rule === "public")
-      return;
-    if (!identity) {
-      onAnonymous();
-      return;
-    }
-    if (rule === "authenticated")
-      return;
-    const result = await rule(identity, ctx);
-    if (result === false) {
-      onForbidden();
-      return;
-    }
-    if (result === true)
-      return;
-    mergeContextContribution(ctx, result, scope);
-  }
-  auth[scopedAuthHookBrand] = () => {
-    return;
-  };
-  authOwnershipPlans.set(auth, {
-    defaultScope: config.defaultScope,
-    hook: auth,
-    scopes: new Set(Object.keys(config.rules))
-  });
-  return auth;
-}
-function composeAuthHooks(config) {
-  const plans = [];
-  for (const hook of config.hooks) {
-    const plan = authOwnershipPlans.get(hook);
-    if (!plan) {
-      throw new TypeError("[stitchkit] auth: composeAuthHooks accepts only hooks created by createAuthHook or composeAuthHooks");
-    }
-    if (plan.defaultScope !== undefined && plan.defaultScope !== config.defaultScope) {
-      throw new TypeError(`[stitchkit] auth: child default scope ${JSON.stringify(plan.defaultScope)} must match the composite default scope`);
-    }
-    plans.push(plan);
-  }
-  const defaultScope = config.defaultScope;
-  if (defaultScope !== undefined && !plans.some((plan) => plan.scopes.has(defaultScope))) {
-    throw new TypeError(`[stitchkit] auth: composite default scope ${JSON.stringify(defaultScope)} has no owner`);
-  }
-  const ownedScopes = new Set;
-  for (const plan of plans) {
-    for (const scope of plan.scopes)
-      ownedScopes.add(scope);
-  }
-  async function composed(ctx, endpoint) {
-    const scope = endpoint.scope ?? config.defaultScope;
-    if (!scope)
-      return;
-    const owners = plans.filter((plan) => plan.scopes.has(scope));
-    if (owners.length === 0) {
-      throw new Error(`[stitchkit] auth: no rule for scope "${scope}"`);
-    }
-    const scopedEndpoint = { ...endpoint, scope };
-    const contribution = Object.create(null);
-    const contributionOwners = new Set;
-    for (const owner of owners) {
-      ctx.signal?.throwIfAborted();
-      const shadow = createShadowContext(ctx);
-      await owner.hook(shadow, scopedEndpoint);
-      const ownerContribution = prepareContextContribution(contextContributionDelta(ctx, shadow, scope), scope);
-      for (const key of Object.keys(ownerContribution)) {
-        if (contributionOwners.has(key)) {
-          throw new TypeError(`[stitchkit] auth: multiple owners contributed context key ${JSON.stringify(key)} for scope ${JSON.stringify(scope)}`);
-        }
-        contributionOwners.add(key);
-      }
-      Object.assign(contribution, ownerContribution);
-    }
-    ctx.signal?.throwIfAborted();
-    mergeContextContribution(ctx, contribution, scope);
-  }
-  composed[scopedAuthHookBrand] = () => {
-    return;
-  };
-  authOwnershipPlans.set(composed, {
-    defaultScope: config.defaultScope,
-    hook: composed,
-    scopes: ownedScopes
-  });
-  return composed;
-}
-function createBearerResolver(config) {
-  return async (req) => {
-    const token = extractToken(req);
-    if (!token)
-      return null;
-    return config.lookup(token, req);
-  };
-}
-
-// src/server/middleware/pkce.ts
-async function verifyPkce(verifier, challenge) {
-  if (!verifier || !challenge)
-    return false;
-  const derived = await deriveCodeChallenge(verifier);
-  return derived === challenge;
-}
-
-export { parseCookieHeader, parseCookies, serializeCookie, defineCookie, verifyJwt, signJwt, extractToken, createAuthHook, composeAuthHooks, createBearerResolver, verifyPkce };

package/dist/index-tmwcrptx.js

@@ -1,85 +0,0 @@
-import {
-  getClientInfo,
-  resolveSocketIp
-} from "./index-f9mb610r.js";
-import {
-  resolveTraceContext
-} from "./index-zcgf3gqf.js";
-import {
-  isUnsafeKey
-} from "./index-kzfs85xp.js";
-
-// src/observability/context.ts
-import { AsyncLocalStorage } from "node:async_hooks";
-var storage;
-var requestStorage = () => {
-  storage ??= new AsyncLocalStorage;
-  return storage;
-};
-function runWithRequestContext(ctx, fn) {
-  return requestStorage().run(ctx, fn);
-}
-function getRequestContext() {
-  return requestStorage().getStore();
-}
-function getTraceId() {
-  return requestStorage().getStore()?.trace.traceId;
-}
-function getUserId() {
-  return requestStorage().getStore()?.userId;
-}
-function setRequestUser(userId) {
-  const ctx = requestStorage().getStore();
-  if (ctx)
-    ctx.userId = userId;
-}
-function setRequestEndpoint(serviceName, action) {
-  const ctx = requestStorage().getStore();
-  if (ctx) {
-    ctx.serviceName = serviceName;
-    if (action !== undefined)
-      ctx.action = action;
-  }
-}
-function setRequestDimensions(dimensions, options = {}) {
-  const ctx = requestStorage().getStore();
-  if (!ctx)
-    return;
-  const next = { ...ctx.dimensions };
-  for (const [key, value] of Object.entries(dimensions)) {
-    if (isUnsafeKey(key))
-      throw new Error('Request dimension name cannot be "__proto__"');
-    const exists = Object.hasOwn(next, key);
-    if (exists && options.collision === "preserve")
-      continue;
-    if (exists && options.collision === "error") {
-      throw new Error(`Request dimension "${key}" is already set`);
-    }
-    next[key] = value;
-  }
-  ctx.dimensions = next;
-}
-function setRequestError(error) {
-  const ctx = requestStorage().getStore();
-  if (ctx)
-    ctx.error = error;
-}
-function wrapInRequestContext(handler, options = {}) {
-  return (req, server) => {
-    const ctx = {
-      trace: resolveTraceContext(req),
-      source: "http",
-      kind: "request",
-      method: req.method,
-      path: new URL(req.url, "http://localhost").pathname,
-      startedAt: process.hrtime.bigint(),
-      ...getClientInfo(req, {
-        trustProxy: options.trustProxy,
-        socketIp: resolveSocketIp(req, server)
-      })
-    };
-    return runWithRequestContext(ctx, () => handler(req, server));
-  };
-}
-
-export { runWithRequestContext, getRequestContext, getTraceId, getUserId, setRequestUser, setRequestEndpoint, setRequestDimensions, setRequestError, wrapInRequestContext };

package/dist/index-v5573g1k.js

@@ -1,142 +0,0 @@
-import {
-  normalizeError
-} from "./index-e0znv5gn.js";
-
-// src/internal/bounded-lines.ts
-var DEFAULT_STREAM_LINE_BYTES = 1024 * 1024;
-function lineLimit(value) {
-  const resolved = value ?? DEFAULT_STREAM_LINE_BYTES;
-  if (!Number.isSafeInteger(resolved) || resolved <= 0) {
-    throw new TypeError("maxLineBytes must be a positive safe integer");
-  }
-  return resolved;
-}
-function joinBytes(left, right) {
-  if (left.byteLength === 0)
-    return right.slice();
-  const result = new Uint8Array(left.byteLength + right.byteLength);
-  result.set(left);
-  result.set(right, left.byteLength);
-  return result;
-}
-async function* readBoundedUtf8Lines(response, maxLineBytes, requireFinalNewline = false) {
-  const reader = response.body?.getReader();
-  if (!reader)
-    return;
-  const limit = lineLimit(maxLineBytes);
-  const decoder = new TextDecoder("utf-8", { fatal: true });
-  let pending = new Uint8Array;
-  try {
-    for (;; ) {
-      const chunk = await reader.read();
-      if (chunk.done)
-        break;
-      let start = 0;
-      for (let index = 0;index < chunk.value.byteLength; index += 1) {
-        if (chunk.value[index] !== 10)
-          continue;
-        const lineBytes = joinBytes(pending, chunk.value.slice(start, index));
-        if (lineBytes.byteLength > limit) {
-          throw new RangeError(`Stream line exceeds the ${limit} byte limit`);
-        }
-        yield decoder.decode(lineBytes);
-        pending = new Uint8Array;
-        start = index + 1;
-      }
-      pending = joinBytes(pending, chunk.value.slice(start));
-      if (pending.byteLength > limit) {
-        throw new RangeError(`Stream line exceeds the ${limit} byte limit`);
-      }
-    }
-    if (pending.byteLength > 0) {
-      if (requireFinalNewline) {
-        throw new SyntaxError("Stream ended with an unterminated final line");
-      }
-      yield decoder.decode(pending);
-    }
-  } finally {
-    await reader.cancel().catch(() => {
-      return;
-    });
-    reader.releaseLock();
-  }
-}
-
-// src/server/stream.ts
-function streamSSE(generator) {
-  const encoder = new TextEncoder;
-  let cancelled = false;
-  const stream = new ReadableStream({
-    async start(controller) {
-      try {
-        for await (const chunk of generator) {
-          if (cancelled)
-            return;
-          const data = JSON.stringify(chunk);
-          controller.enqueue(encoder.encode(`data: ${data}
-
-`));
-        }
-        if (cancelled)
-          return;
-        controller.enqueue(encoder.encode(`data: [DONE]
-
-`));
-        controller.close();
-      } catch (err) {
-        if (cancelled)
-          return;
-        const envelope = normalizeError(err).toJSON();
-        controller.enqueue(encoder.encode(`data: ${JSON.stringify(envelope)}
-
-`));
-        controller.close();
-      }
-    },
-    cancel() {
-      cancelled = true;
-      generator.return(undefined).catch(() => {
-        return;
-      });
-    }
-  });
-  return new Response(stream, {
-    headers: {
-      "Content-Type": "text/event-stream",
-      "Cache-Control": "no-cache",
-      Connection: "keep-alive"
-    }
-  });
-}
-async function* parseSSE(response, options) {
-  try {
-    for await (const rawLine of readBoundedUtf8Lines(response, options?.maxLineBytes ?? DEFAULT_STREAM_LINE_BYTES)) {
-      const line = rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine;
-      if (!line.startsWith("data:"))
-        continue;
-      const data = line.slice(5).replace(/^ /, "");
-      if (data === "[DONE]")
-        return;
-      try {
-        yield JSON.parse(data);
-      } catch (error) {
-        const failure = error instanceof Error ? error : new Error(String(error));
-        if (!options?.onParseError)
-          throw failure;
-        options.onParseError(data, failure);
-      }
-    }
-  } catch (error) {
-    const failure = error instanceof Error ? error : new Error(String(error));
-    if (!options?.onParseError)
-      throw failure;
-    options.onParseError("", failure);
-  }
-}
-
-// src/internal/http-input.ts
-function inputIsQuery(method) {
-  return method === "GET" || method === "DELETE";
-}
-
-export { inputIsQuery, DEFAULT_STREAM_LINE_BYTES, readBoundedUtf8Lines, streamSSE, parseSSE };