stitchkit 0.93.0 → 0.94.1

package/dist/server/index.js

@@ -1,1745 +0,0 @@
-import {
-  DEFAULT_STREAM_HEARTBEAT_MS,
-  UnixClientTransportError,
-  bindProcessSignals,
-  bindRealtimeServer,
-  composeWebSocketHandlers,
-  createHandler,
-  createSocketIOServer,
-  createUnixClientTransport,
-  ndjsonRoute,
-  parseMultipart,
-  socketIoLane,
-  sseRoute,
-  streamingRoute,
-  webSocketLane
-} from "../index-n0f51dfn.js";
-import"../index-y91ry9h2.js";
-import {
-  withDeadline
-} from "../index-b9aefrqd.js";
-import {
-  ShutdownOptionsSchema,
-  ShutdownResultSchema,
-  ShutdownStateSchema,
-  ShutdownStatusSchema,
-  createServerLifecycle
-} from "../index-3z73fh2c.js";
-import"../index-f477k430.js";
-import"../index-2qzskm8h.js";
-import {
-  inputIsQuery,
-  parseSSE,
-  streamSSE
-} from "../index-v5573g1k.js";
-import {
-  composeAuthHooks,
-  createAuthHook,
-  createBearerResolver,
-  defineCookie,
-  extractToken,
-  parseCookieHeader,
-  parseCookies,
-  serializeCookie,
-  signJwt,
-  verifyJwt,
-  verifyPkce
-} from "../index-sr93cwf9.js";
-import {
-  deriveCodeChallenge
-} from "../index-hr4tzbwq.js";
-import {
-  DEFAULT_CORS_ALLOW_HEADERS,
-  DEFAULT_CORS_EXPOSE_HEADERS,
-  corsHeaders,
-  corsPreflightResponse,
-  createImplement,
-  createImplementRegistry,
-  createMultipartStream,
-  createScopedImplement,
-  createScopedImplementRegistry,
-  defineMultipartStream,
-  implement,
-  implementRegistry
-} from "../index-cxqhvq21.js";
-import {
-  isWithinDir,
-  realPathWithinDir
-} from "../index-sbdmyz75.js";
-import {
-  getTraceId
-} from "../index-tmwcrptx.js";
-import {
-  extractIp,
-  generateTraceId,
-  getClientInfo,
-  isPublicIp,
-  resolveSocketIp,
-  resolveTraceId
-} from "../index-f9mb610r.js";
-import {
-  errorCode,
-  formatZodError,
-  normalizeError,
-  zodIssues
-} from "../index-e0znv5gn.js";
-import {
-  DEFAULT_CONTRACT_STREAM_FRAME_BYTES,
-  joinRoutePath,
-  parseTrailingWildcard
-} from "../index-0a349c33.js";
-import"../index-rxfy4cq7.js";
-import"../index-6k1937bx.js";
-import"../index-zcgf3gqf.js";
-import {
-  jsonSchemaFields,
-  toJsonSchema
-} from "../index-cby4ar3v.js";
-import {
-  AppError,
-  STITCH_ERROR_STATUS,
-  appError,
-  badRequest,
-  conflict,
-  forbidden,
-  isStitchErrorCode,
-  notFound,
-  rateLimited,
-  unauthorized
-} from "../index-2vtcmrj9.js";
-import"../index-kzfs85xp.js";
-import {
-  isRecord
-} from "../index-77fekveh.js";
-// src/realtime/registry.ts
-var authorizedRoom = Symbol("stitchkit.authorized-room");
-function freezeRoom(name) {
-  return Object.freeze({ name, [authorizedRoom]: true });
-}
-function bindSocketRegistry(server, options) {
-  const members = new Map;
-  const minted = new WeakSet;
-  let revision = 0;
-  let closed = false;
-  const setups = new Set;
-  const maxBufferedFrames = Math.max(1, options.maxBufferedFrames ?? 1000);
-  const token = (name) => {
-    const created = freezeRoom(name);
-    minted.add(created);
-    return created;
-  };
-  const assertToken = (room) => {
-    if (!minted.has(room))
-      throw new Error("Room was not authorized by this registry");
-    return room.name;
-  };
-  const leaveQuietly = async (member, room) => {
-    try {
-      await member.connection.raw.leave(room);
-    } catch {}
-  };
-  const remove = async (member) => {
-    if (member.disconnected)
-      return;
-    member.disconnected = true;
-    member.connection.raw.off?.("disconnect", member.disconnect);
-    members.delete(member.connection.raw.id);
-    for (const room of member.joined)
-      await leaveQuietly(member, room);
-    member.joined.clear();
-    member.buffer = null;
-    revision += 1;
-  };
-  const replayMember = async (member) => {
-    if (!options.replay || member.disconnected || closed)
-      return !member.disconnected && !closed;
-    const attempts = Math.max(1, options.replayAttempts ?? 3);
-    for (let attempt = 0;attempt < attempts && !member.disconnected && !closed; attempt += 1) {
-      member.buffer = [];
-      member.overflow = false;
-      const before = await options.revision?.();
-      if (member.disconnected || closed)
-        break;
-      const frames = await options.replay({
-        identity: member.identity,
-        rooms: Object.freeze([...member.joined].map(token)),
-        revision: before
-      });
-      const after = await options.revision?.();
-      if (member.disconnected || closed)
-        break;
-      if (options.revision && !Object.is(before, after))
-        continue;
-      if (member.overflow)
-        continue;
-      for (const frame of frames)
-        member.connection.events.emit(frame.event, ...frame.args);
-      const buffered = member.buffer;
-      member.buffer = null;
-      for (const deferred of buffered ?? [])
-        deferred();
-      return !member.disconnected && !closed;
-    }
-    member.buffer = null;
-    member.overflow = false;
-    if (!member.disconnected)
-      await options.onResyncRequired?.(member.connection.raw.id, member.identity);
-    return false;
-  };
-  const resyncMember = (member) => {
-    if (member.replayPromise)
-      return member.replayPromise;
-    const active = replayMember(member).finally(() => {
-      if (member.replayPromise === active)
-        member.replayPromise = undefined;
-    });
-    member.replayPromise = active;
-    return active;
-  };
-  const setupConnection = async (connection) => {
-    if (closed)
-      return;
-    const member = {
-      connection,
-      identity: connection.raw.data,
-      authorized: new Set,
-      joined: new Set,
-      buffer: null,
-      overflow: false,
-      disconnected: false,
-      disconnect: () => {
-        return;
-      }
-    };
-    member.disconnect = () => void remove(member);
-    connection.raw.on("disconnect", member.disconnect);
-    members.set(connection.raw.id, member);
-    try {
-      const authorized = new Set(await options.rooms(connection.raw.data));
-      if (member.disconnected || closed) {
-        await remove(member);
-        return;
-      }
-      member.authorized = authorized;
-      for (const name of authorized) {
-        await connection.raw.join(name);
-        if (member.disconnected || closed) {
-          await leaveQuietly(member, name);
-          await remove(member);
-          return;
-        }
-        member.joined.add(name);
-      }
-      if (closed) {
-        await remove(member);
-        return;
-      }
-      revision += 1;
-      await resyncMember(member);
-    } catch {
-      await remove(member);
-    }
-  };
-  const stopListening = server.onConnection((connection) => {
-    let setup;
-    setup = setupConnection(connection).finally(() => setups.delete(setup));
-    setups.add(setup);
-    return setup;
-  });
-  return {
-    room: token,
-    async join(socketId, room) {
-      const name = assertToken(room);
-      const member = members.get(socketId);
-      if (!member)
-        throw new Error(`Unknown socket: ${socketId}`);
-      if (!member.authorized.has(name))
-        throw new Error(`Socket is not authorized for room: ${name}`);
-      if (member.joined.has(name))
-        return;
-      await member.connection.raw.join(name);
-      if (!member.disconnected)
-        member.joined.add(name);
-      revision += 1;
-    },
-    async leave(socketId, room) {
-      const name = assertToken(room);
-      const member = members.get(socketId);
-      if (!member?.joined.has(name))
-        return;
-      await member.connection.raw.leave(name);
-      member.joined.delete(name);
-      revision += 1;
-    },
-    emitTo(room, event, ...args) {
-      const name = assertToken(room);
-      let recipients = 0;
-      for (const member of members.values()) {
-        if (!member.joined.has(name) || member.disconnected)
-          continue;
-        recipients += 1;
-        if (!member.buffer) {
-          member.connection.events.emit(event, ...args);
-        } else if (member.buffer.length >= maxBufferedFrames) {
-          member.overflow = true;
-        } else {
-          member.buffer.push(() => member.connection.events.emit(event, ...args));
-        }
-      }
-      return recipients;
-    },
-    resync: async (socketId) => {
-      const member = members.get(socketId);
-      return member ? resyncMember(member) : false;
-    },
-    snapshot() {
-      const connections = [...members.values()].map((member) => Object.freeze({
-        socketId: member.connection.raw.id,
-        identity: member.identity,
-        rooms: Object.freeze([...member.joined].sort()),
-        replaying: member.buffer !== null
-      }));
-      const roomMap = {};
-      for (const entry of connections) {
-        for (const name of entry.rooms) {
-          roomMap[name] = Object.freeze([...roomMap[name] ?? [], entry.socketId]);
-        }
-      }
-      return Object.freeze({
-        revision,
-        connections: Object.freeze(connections),
-        rooms: Object.freeze(roomMap)
-      });
-    },
-    async unbind() {
-      if (closed)
-        return;
-      closed = true;
-      stopListening();
-      await Promise.allSettled([...setups]);
-      const active = [...members.values()];
-      for (const member of active)
-        await remove(member);
-    }
-  };
-}
-// src/server/bun.ts
-import { chmodSync, statSync, unlinkSync } from "node:fs";
-function reclaimStaleUnixSocket(path) {
-  const stats = statSync(path, { throwIfNoEntry: false });
-  if (stats === undefined)
-    return;
-  if (!stats.isSocket()) {
-    throw new Error(`[stitchkit] createServer: "${path}" exists and is not a socket — refusing to remove it; remove it manually if it is debris`);
-  }
-  if (typeof process.getuid === "function" && stats.uid !== process.getuid()) {
-    throw new Error(`[stitchkit] createServer: unix socket "${path}" is owned by another user — refusing to reclaim it`);
-  }
-  const standalone = Bun.main.startsWith("/$bunfs/");
-  const interpreter = standalone ? Bun.which("bun") : process.execPath;
-  if (!interpreter) {
-    throw new Error(`[stitchkit] createServer: unix socket "${path}" already exists and no \`bun\` binary is on PATH to probe it from this compiled executable — remove the file manually if the previous process is dead`);
-  }
-  const probe = Bun.spawnSync({
-    cmd: [
-      interpreter,
-      "-e",
-      'try { const socket = await Bun.connect({ unix: Bun.env.STITCHKIT_UNIX_PROBE ?? "", socket: { data() { return undefined; } } }); socket.end(); process.exit(0); } catch (error) { process.exit(error && typeof error === "object" && "code" in error && error.code === "EACCES" ? 2 : 1); }'
-    ],
-    env: { ...process.env, STITCHKIT_UNIX_PROBE: path },
-    timeout: 2000
-  });
-  if (probe.exitedDueToTimeout) {
-    throw new Error(`[stitchkit] createServer: liveness probe for unix socket "${path}" timed out — refusing to reclaim; remove the file manually if the previous process is dead`);
-  }
-  if (probe.exitCode === 0 || probe.exitCode === 2) {
-    throw new Error(`[stitchkit] createServer: unix socket "${path}" is already in use${probe.exitCode === 2 ? " (connect permission denied)" : " by a live listener"}`);
-  }
-  unlinkSync(path);
-}
-function createServer(config) {
-  const {
-    websocket: configuredWebSocket,
-    socket,
-    development,
-    bun: bunExtra,
-    port = 3000,
-    hostname
-  } = config;
-  const unixPath = typeof config.unix === "string" ? config.unix : config.unix?.path;
-  const unixMode = typeof config.unix === "string" ? undefined : config.unix?.mode;
-  if (unixPath !== undefined) {
-    if (unixPath.length === 0) {
-      throw new Error("[stitchkit] createServer: `unix` must be a non-empty socket path");
-    }
-    if (config.port !== undefined || config.hostname !== undefined) {
-      throw new Error("[stitchkit] createServer: `unix` is mutually exclusive with `port`/`hostname`");
-    }
-    if (socket) {
-      throw new Error("[stitchkit] createServer: the Socket.IO lifecycle cannot listen on a unix socket — socket.io clients dial TCP only");
-    }
-  }
-  const socketRoutePrefix = socket?.route.path.replace(/\*socketPath$/, "");
-  const websocket = configuredWebSocket ?? socket?.websocket;
-  const openSockets = new Set;
-  const socketDrainWaiters = new Set;
-  let hadWebSockets = false;
-  const resolveSocketDrain = () => {
-    if (openSockets.size !== 0)
-      return;
-    for (const resolve of socketDrainWaiters)
-      resolve();
-    socketDrainWaiters.clear();
-  };
-  const waitForSocketDrain = () => {
-    if (openSockets.size === 0)
-      return Promise.resolve();
-    return new Promise((resolve) => socketDrainWaiters.add(resolve));
-  };
-  const waitForRequestDrain = async (server2) => {
-    while (server2.pendingRequests > 0) {
-      await new Promise((resolve) => setTimeout(resolve, 5));
-    }
-  };
-  const trackedWebSocket = websocket ? {
-    ...websocket,
-    open(ws) {
-      hadWebSockets = true;
-      openSockets.add(ws);
-      websocket.open?.(ws);
-    },
-    close(ws, code, reason) {
-      openSockets.delete(ws);
-      resolveSocketDrain();
-      websocket.close?.(ws, code, reason);
-    }
-  } : undefined;
-  let runtime;
-  const requireRuntime = () => {
-    if (!runtime)
-      throw new Error("[stitchkit] Bun server lifecycle started before Bun.serve");
-    return runtime;
-  };
-  const adapter = {
-    beginShutdown: () => socket?.beginShutdown(),
-    pendingRequests: () => runtime?.pendingRequests ?? 0,
-    pendingWebSockets: () => openSockets.size,
-    async closeRealtime() {
-      const logicalClose = socket?.close();
-      for (const ws of openSockets)
-        ws.close(1001, "Server shutting down");
-      await Promise.all([logicalClose, waitForSocketDrain()]);
-    },
-    async terminateRealtime() {
-      const count = openSockets.size;
-      const physicalClose = waitForSocketDrain();
-      for (const ws of [...openSockets])
-        ws.terminate();
-      await physicalClose;
-      return count;
-    },
-    async stopGracefully() {
-      await new Promise((resolve) => setTimeout(resolve, 0));
-      const server2 = requireRuntime();
-      if (server2.pendingRequests === 0 && openSockets.size === 0) {
-        const stopping2 = server2.stop(true);
-        if (!hadWebSockets)
-          await stopping2;
-        else
-          stopping2.catch(() => {
-            return;
-          });
-        return;
-      }
-      const stopping = server2.stop(false);
-      if (!hadWebSockets) {
-        await stopping;
-        return;
-      }
-      stopping.catch(() => {
-        return;
-      });
-      await waitForRequestDrain(server2);
-    },
-    async forceStop() {
-      const logicalClose = socket?.close();
-      const physicalClose = waitForSocketDrain();
-      for (const ws of [...openSockets])
-        ws.terminate();
-      const stopping = requireRuntime().stop(true);
-      if (!hadWebSockets)
-        await stopping;
-      else
-        stopping.catch(() => {
-          return;
-        });
-      await Promise.all([logicalClose, physicalClose]);
-    }
-  };
-  const lifecycle = createServerLifecycle(() => adapter);
-  const handler = createHandler(config);
-  const consumerFetch = config.wrapFetch ? config.wrapFetch(handler) : handler;
-  const admittedFetch = lifecycle.wrapFetch(consumerFetch);
-  const fetch = async (request, server2) => {
-    if (socket && socketRoutePrefix) {
-      const pathname = new URL(request.url).pathname;
-      if (pathname.startsWith(socketRoutePrefix)) {
-        return await socket.route.handler(request, {
-          params: { socketPath: pathname.slice(socketRoutePrefix.length) },
-          server: server2
-        });
-      }
-    }
-    return admittedFetch(request, server2);
-  };
-  if (unixPath !== undefined) {
-    reclaimStaleUnixSocket(unixPath);
-    const { reusePort, ipv6Only, http3, http2, http1, idleTimeout, ...unixExtra } = bunExtra ?? {};
-    runtime = trackedWebSocket ? Bun.serve({
-      ...unixExtra,
-      ...development && { development },
-      unix: unixPath,
-      websocket: trackedWebSocket,
-      fetch
-    }) : Bun.serve({
-      ...unixExtra,
-      ...development && { development },
-      unix: unixPath,
-      fetch
-    });
-    if (unixMode !== undefined)
-      chmodSync(unixPath, unixMode);
-  } else {
-    runtime = trackedWebSocket ? Bun.serve({
-      ...bunExtra,
-      ...development && { development },
-      port,
-      hostname,
-      websocket: trackedWebSocket,
-      fetch
-    }) : Bun.serve({
-      ...bunExtra,
-      ...development && { development },
-      port,
-      hostname,
-      fetch
-    });
-  }
-  const server = runtime;
-  return {
-    url: server.url.toString().replace(/\/$/, ""),
-    port: server.port ?? (unixPath !== undefined ? 0 : port),
-    runtime: server,
-    get status() {
-      return lifecycle.status;
-    },
-    shutdown: lifecycle.shutdown
-  };
-}
-// src/server/swept-map.ts
-function createSweptMap(options) {
-  const store = new Map;
-  const timer = setInterval(() => {
-    const now = Date.now();
-    for (const [key, value] of store) {
-      if (options.isExpired(value, now))
-        store.delete(key);
-    }
-  }, options.intervalMs);
-  timer.unref();
-  return {
-    store,
-    destroy() {
-      clearInterval(timer);
-      store.clear();
-    }
-  };
-}
-
-// src/server/cache.ts
-function createCache(options = {}) {
-  const maxEntries = options.maxEntries ?? 1000;
-  if (!Number.isInteger(maxEntries) || maxEntries < 1) {
-    throw new Error("cache.maxEntries must be a positive integer");
-  }
-  const { store, destroy } = createSweptMap({
-    intervalMs: 30000,
-    isExpired: (entry, now) => entry.expiresAt < now
-  });
-  return {
-    destroy,
-    get(key) {
-      const entry = store.get(key);
-      if (!entry)
-        return null;
-      if (entry.expiresAt < Date.now()) {
-        store.delete(key);
-        return null;
-      }
-      return entry.data;
-    },
-    set(key, data, maxAgeSeconds) {
-      if (!Number.isFinite(maxAgeSeconds) || maxAgeSeconds < 0) {
-        throw new Error("cache maxAgeSeconds must be a non-negative finite number");
-      }
-      store.delete(key);
-      store.set(key, { data, expiresAt: Date.now() + maxAgeSeconds * 1000 });
-      while (store.size > maxEntries) {
-        const oldest = store.keys().next().value;
-        if (oldest === undefined)
-          break;
-        store.delete(oldest);
-      }
-    },
-    invalidate(prefix) {
-      for (const key of store.keys()) {
-        if (key.startsWith(prefix))
-          store.delete(key);
-      }
-    },
-    clear() {
-      store.clear();
-    }
-  };
-}
-function cacheHeaders(maxAge, scope = "public") {
-  return {
-    "Cache-Control": `${scope}, max-age=${maxAge}`
-  };
-}
-// src/server/error-hook.ts
-function createErrorHook(config) {
-  if (config.vocabulary && (config.codeMap !== undefined || config.unmappedCode !== undefined)) {
-    throw new Error("[stitchkit] createErrorHook: `vocabulary` carries the wire map — it cannot be combined with `codeMap` or `unmappedCode`");
-  }
-  return async (ctx, error, endpoint) => {
-    const appErr = normalizeError(error);
-    const stitchCode = isStitchErrorCode(appErr.code) ? appErr.code : undefined;
-    const vocabularyMap = config.vocabulary?.codeMap;
-    const configuredMap = vocabularyMap ?? config.codeMap;
-    const mapped = stitchCode === undefined ? undefined : configuredMap?.[stitchCode];
-    const fallback = mapped === undefined && stitchCode !== undefined ? typeof config.unmappedCode === "function" ? config.unmappedCode(stitchCode) : config.unmappedCode : undefined;
-    const code = mapped ?? fallback ?? appErr.code;
-    const info = {
-      code,
-      status: appErr.status,
-      message: appErr.message,
-      details: appErr.details,
-      hint: appErr.hint
-    };
-    await config.onError?.(error, info, ctx, endpoint);
-    const body = await config.render(info, ctx, endpoint);
-    return new Response(JSON.stringify(body), {
-      status: info.status,
-      headers: { "content-type": "application/json" }
-    });
-  };
-}
-// src/server/event-bus.ts
-function isDecision(value) {
-  if (typeof value !== "object" || value === null)
-    return false;
-  const outcome = Reflect.get(value, "outcome");
-  if (outcome === "allow" || outcome === "defer")
-    return true;
-  return outcome === "deny" && typeof Reflect.get(value, "reason") === "string";
-}
-function createEventBus(options = {}) {
-  const subscriptions = new Map;
-  const declared = options.topics;
-  function add(event, fn, once) {
-    let set = subscriptions.get(event);
-    if (!set) {
-      set = new Set;
-      subscriptions.set(event, set);
-    }
-    const sub = { fn, once };
-    set.add(sub);
-    return () => {
-      set.delete(sub);
-    };
-  }
-  function declarationFor(event, verb) {
-    if (declared === undefined) {
-      if (verb === "emit")
-        return;
-      throw new Error(`[stitchkit] event bus: ${verb}("${event}") needs declared topics — pass \`topics\` from defineEvents. Its delivery deadline and undecided outcome come from the declaration, and neither has a default.`);
-    }
-    const topic = Reflect.get(declared, event);
-    if (topic === undefined) {
-      throw new Error(`[stitchkit] event bus: "${event}" is not a declared topic. Declared: ${Object.keys(declared).join(", ") || "(none)"}.`);
-    }
-    const expected = { emit: "emit", serial: "emitSerial", decision: "decide" };
-    if (expected[topic.mode] !== verb) {
-      throw new Error(`[stitchkit] event bus: "${event}" is declared with mode '${topic.mode}', so it is delivered with ${expected[topic.mode]}(), not ${verb}().`);
-    }
-    return topic;
-  }
-  function planned(event) {
-    const set = subscriptions.get(event) ?? new Set;
-    return { set, subs: [...set] };
-  }
-  function report(error, event) {
-    options.onListenerError?.(error, event);
-  }
-  return {
-    emit(event, data) {
-      declarationFor(event, "emit");
-      const { set, subs } = planned(event);
-      for (const sub of subs) {
-        if (!set.has(sub))
-          continue;
-        if (sub.once)
-          set.delete(sub);
-        try {
-          const result = sub.fn(data);
-          if (result instanceof Promise)
-            result.catch((err) => report(err, event));
-        } catch (err) {
-          report(err, event);
-        }
-      }
-    },
-    async emitSerial(event, data) {
-      const topic = declarationFor(event, "emitSerial");
-      const timeoutMs = topic?.listenerTimeoutMs ?? 0;
-      const { set, subs } = planned(event);
-      for (const sub of subs) {
-        if (!set.has(sub))
-          continue;
-        if (sub.once)
-          set.delete(sub);
-        try {
-          const outcome = await withDeadline(sub.fn(data), timeoutMs);
-          if (!outcome.settled) {
-            report(new Error(`listener did not settle within ${timeoutMs}ms`), event);
-          }
-        } catch (err) {
-          report(err, event);
-        }
-      }
-    },
-    async decide(event, data) {
-      const topic = declarationFor(event, "decide");
-      const timeoutMs = topic?.listenerTimeoutMs ?? 0;
-      const undecided = topic?.whenAllDefer ?? "deny";
-      const { set, subs } = planned(event);
-      let allowed = false;
-      for (const sub of subs) {
-        if (!set.has(sub))
-          continue;
-        if (sub.once)
-          set.delete(sub);
-        let vote;
-        try {
-          const outcome = await withDeadline(sub.fn(data), timeoutMs);
-          if (!outcome.settled) {
-            vote = { outcome: "deny", reason: `listener did not vote within ${timeoutMs}ms` };
-          } else if (isDecision(outcome.value)) {
-            vote = outcome.value;
-          } else {
-            vote = {
-              outcome: "deny",
-              reason: 'listener returned no decision — a decision listener returns { outcome: "allow" | "deny" | "defer" }'
-            };
-          }
-        } catch (err) {
-          vote = {
-            outcome: "deny",
-            reason: err instanceof Error ? `listener threw: ${err.message}` : "listener threw"
-          };
-        }
-        if (vote.outcome === "deny") {
-          report(new Error(vote.reason), event);
-          return vote;
-        }
-        if (vote.outcome === "allow")
-          allowed = true;
-      }
-      if (allowed)
-        return { outcome: "allow" };
-      return undecided === "allow" ? { outcome: "allow" } : { outcome: "deny", reason: "no listener claimed this event" };
-    },
-    on(event, handler) {
-      return add(event, handler, false);
-    },
-    once(event, handler) {
-      return add(event, handler, true);
-    },
-    off(event, handler) {
-      const set = subscriptions.get(event);
-      if (!set)
-        return;
-      for (const sub of set) {
-        if (sub.fn === handler)
-          set.delete(sub);
-      }
-    },
-    clear() {
-      subscriptions.clear();
-    }
-  };
-}
-// src/server/file.ts
-import { readFile, stat } from "node:fs/promises";
-import { resolve } from "node:path";
-
-// src/server/mime.ts
-import { extname } from "node:path";
-var MIME_BY_EXT = {
-  ".html": "text/html; charset=utf-8",
-  ".css": "text/css; charset=utf-8",
-  ".js": "text/javascript; charset=utf-8",
-  ".mjs": "text/javascript; charset=utf-8",
-  ".json": "application/json; charset=utf-8",
-  ".svg": "image/svg+xml",
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".gif": "image/gif",
-  ".webp": "image/webp",
-  ".avif": "image/avif",
-  ".ico": "image/x-icon",
-  ".woff2": "font/woff2",
-  ".txt": "text/plain; charset=utf-8",
-  ".wasm": "application/wasm",
-  ".mp4": "video/mp4",
-  ".webm": "video/webm",
-  ".mov": "video/quicktime",
-  ".ogv": "video/ogg",
-  ".mp3": "audio/mpeg",
-  ".m4a": "audio/mp4",
-  ".wav": "audio/wav",
-  ".flac": "audio/flac",
-  ".oga": "audio/ogg",
-  ".ogg": "audio/ogg",
-  ".pdf": "application/pdf",
-  ".zip": "application/zip"
-};
-function mimeForPath(path) {
-  return MIME_BY_EXT[extname(path).toLowerCase()] ?? "application/octet-stream";
-}
-
-// src/server/file.ts
-function staticRoute(prefix, dir) {
-  const cleanPrefix = prefix.replace(/\/+$/, "");
-  const root = resolve(dir.replace(/\/+$/, ""));
-  return {
-    method: "GET",
-    path: `${cleanPrefix}/*filePath`,
-    handler: async (req) => {
-      const pathname = new URL(req.url).pathname;
-      let rel;
-      try {
-        rel = decodeURIComponent(pathname.slice(cleanPrefix.length)).replace(/^\/+/, "");
-      } catch {
-        return new Response("Bad request", { status: 400 });
-      }
-      const target = resolve(root, rel);
-      if (!isWithinDir(root, target))
-        return new Response("Forbidden", { status: 403 });
-      const realTarget = await realPathWithinDir(root, target);
-      if (realTarget === null)
-        return new Response("Not found", { status: 404 });
-      const info = await stat(realTarget).catch(() => null);
-      if (!info?.isFile())
-        return new Response("Not found", { status: 404 });
-      return new Response(await readFile(realTarget), {
-        headers: {
-          "Content-Type": mimeForPath(realTarget),
-          "X-Content-Type-Options": "nosniff"
-        }
-      });
-    }
-  };
-}
-function parseByteRange(header, size) {
-  if (!header)
-    return null;
-  const match = /^bytes=(.+)$/.exec(header.trim());
-  const rawSpec = match?.[1];
-  if (rawSpec === undefined)
-    return null;
-  const spec = rawSpec.trim();
-  if (spec.includes(","))
-    return null;
-  const dash = spec.indexOf("-");
-  if (dash === -1)
-    return null;
-  const startStr = spec.slice(0, dash).trim();
-  const endStr = spec.slice(dash + 1).trim();
-  if (startStr === "") {
-    if (!/^\d+$/.test(endStr))
-      return null;
-    const suffix = Number(endStr);
-    if (suffix === 0 || size === 0)
-      return "unsatisfiable";
-    return { start: Math.max(0, size - suffix), end: size - 1 };
-  }
-  if (!/^\d+$/.test(startStr))
-    return null;
-  const start = Number(startStr);
-  if (size === 0 || start >= size)
-    return "unsatisfiable";
-  if (endStr === "")
-    return { start, end: size - 1 };
-  if (!/^\d+$/.test(endStr))
-    return null;
-  const end = Number(endStr);
-  if (end < start)
-    return null;
-  return { start, end: end >= size ? size - 1 : end };
-}
-function weakETag(size, mtimeMs) {
-  return `W/"${size.toString(16)}-${Math.floor(mtimeMs).toString(16)}"`;
-}
-function leSeconds(aMs, bMs) {
-  return Math.floor(aMs / 1000) <= Math.floor(bMs / 1000);
-}
-function isNotModified(req, v) {
-  const inm = req.headers.get("if-none-match");
-  if (inm !== null) {
-    const value = inm.trim();
-    if (value === "*")
-      return true;
-    if (v.etag === undefined)
-      return false;
-    return value.split(",").map((t) => t.trim()).includes(v.etag);
-  }
-  const ims = req.headers.get("if-modified-since");
-  if (ims !== null) {
-    if (v.lastModifiedMs === undefined)
-      return false;
-    const since = Date.parse(ims);
-    if (Number.isNaN(since))
-      return false;
-    return leSeconds(v.lastModifiedMs, since);
-  }
-  return false;
-}
-function ifRangeMatches(req, v) {
-  const ir = req.headers.get("if-range");
-  if (ir === null)
-    return true;
-  const value = ir.trim();
-  if (v.etag !== undefined && value === v.etag)
-    return true;
-  if (v.lastModifiedMs !== undefined) {
-    const asDate = Date.parse(value);
-    if (!Number.isNaN(asDate))
-      return leSeconds(v.lastModifiedMs, asDate);
-  }
-  return false;
-}
-function asciiFilename(filename) {
-  let out = "";
-  for (let i = 0;i < filename.length; i++) {
-    const code = filename.charCodeAt(i);
-    out += code >= 32 && code < 127 && code !== 34 && code !== 92 ? filename.charAt(i) : "_";
-  }
-  return out;
-}
-function contentDisposition(disposition, filename) {
-  return `${disposition}; filename="${asciiFilename(filename)}"; filename*=UTF-8''${encodeURIComponent(filename)}`;
-}
-async function serveFile(req, opts) {
-  if (req.method !== "GET" && req.method !== "HEAD") {
-    return new Response("Method not allowed", {
-      status: 405,
-      headers: { Allow: "GET, HEAD" }
-    });
-  }
-  const file = Bun.file(opts.path);
-  if (!await file.exists()) {
-    return new Response("Not found", { status: 404 });
-  }
-  const size = file.size;
-  const mtimeMs = file.lastModified;
-  const contentType = opts.contentType ?? mimeForPath(opts.path);
-  const useEtag = opts.etag !== false;
-  const useLastModified = opts.lastModified !== false;
-  const etag = useEtag ? weakETag(size, mtimeMs) : undefined;
-  const validators = {
-    etag,
-    lastModifiedMs: useLastModified ? mtimeMs : undefined
-  };
-  const isHead = req.method === "HEAD";
-  const base = new Headers;
-  base.set("Accept-Ranges", "bytes");
-  base.set("X-Content-Type-Options", "nosniff");
-  if (etag)
-    base.set("ETag", etag);
-  if (useLastModified)
-    base.set("Last-Modified", new Date(mtimeMs).toUTCString());
-  if (opts.cacheControl)
-    base.set("Cache-Control", opts.cacheControl);
-  if (opts.filename) {
-    base.set("Content-Disposition", contentDisposition(opts.disposition ?? "inline", opts.filename));
-  } else if (opts.disposition) {
-    base.set("Content-Disposition", opts.disposition);
-  }
-  if ((useEtag || useLastModified) && isNotModified(req, validators)) {
-    return new Response(null, { status: 304, headers: base });
-  }
-  const rangeHeader = req.headers.get("range");
-  const range = rangeHeader !== null && ifRangeMatches(req, validators) ? parseByteRange(rangeHeader, size) : null;
-  if (range === "unsatisfiable") {
-    base.set("Content-Range", `bytes */${size}`);
-    base.set("Content-Type", contentType);
-    return new Response(null, { status: 416, headers: base });
-  }
-  if (range) {
-    const length = range.end - range.start + 1;
-    base.set("Content-Type", contentType);
-    base.set("Content-Range", `bytes ${range.start}-${range.end}/${size}`);
-    base.set("Content-Length", String(length));
-    const body = isHead ? null : file.slice(range.start, range.end + 1);
-    return new Response(body, { status: 206, headers: base });
-  }
-  base.set("Content-Type", contentType);
-  base.set("Content-Length", String(size));
-  return new Response(isHead ? null : file, { status: 200, headers: base });
-}
-// src/server/file-state-store.ts
-import { mkdir, open, readdir, readFile as readFile2, rename, stat as stat2, unlink } from "node:fs/promises";
-import { basename, dirname, join } from "node:path";
-var ABANDONED_LOCK_MULTIPLIER = 10;
-var ABANDONED_HEARTBEATS = 30;
-var MIN_HEARTBEAT_MS = 10;
-var delay = (milliseconds) => new Promise((resolve2) => setTimeout(resolve2, milliseconds));
-async function missing(error) {
-  return error instanceof Error && "code" in error && error.code === "ENOENT";
-}
-function existing(error) {
-  return error instanceof Error && "code" in error && error.code === "EEXIST";
-}
-async function ownerState(lockPath) {
-  let owner;
-  try {
-    owner = JSON.parse(await readFile2(lockPath, "utf8"));
-  } catch {
-    return "unknown";
-  }
-  if (typeof owner !== "object" || owner === null || !("pid" in owner) || typeof owner.pid !== "number" || !Number.isSafeInteger(owner.pid) || owner.pid <= 0) {
-    return "unknown";
-  }
-  try {
-    process.kill(owner.pid, 0);
-    return "alive";
-  } catch (error) {
-    return error instanceof Error && "code" in error && error.code === "ESRCH" ? "gone" : "unknown";
-  }
-}
-async function sweepTemporaries(path, staleLockMs) {
-  const prefix = `${basename(path)}.tmp.`;
-  const directory = dirname(path);
-  let entries;
-  try {
-    entries = await readdir(directory);
-  } catch {
-    return;
-  }
-  for (const entry of entries) {
-    if (!entry.startsWith(prefix))
-      continue;
-    const candidate = join(directory, entry);
-    const info = await stat2(candidate).catch(() => null);
-    if (info && Date.now() - info.mtimeMs > staleLockMs) {
-      await unlink(candidate).catch(() => {
-        return;
-      });
-    }
-  }
-}
-async function reclaim(lockPath, observed, staleLockMs, abandonedAfterMs) {
-  const guardPath = `${lockPath}.reclaim`;
-  let guard;
-  try {
-    guard = await open(guardPath, "wx");
-  } catch (error) {
-    if (!existing(error))
-      throw error;
-    const orphan = await stat2(guardPath).catch(() => null);
-    if (orphan && Date.now() - orphan.mtimeMs > staleLockMs) {
-      await unlink(guardPath).catch(() => {
-        return;
-      });
-    }
-    return false;
-  }
-  try {
-    const current = await stat2(lockPath).catch(() => null);
-    if (!current || current.dev !== observed.dev || current.ino !== observed.ino || current.mtimeMs !== observed.mtimeMs) {
-      return false;
-    }
-    const owner = await ownerState(lockPath);
-    const age = Date.now() - current.mtimeMs;
-    if (owner !== "gone" && age < abandonedAfterMs)
-      return false;
-    await unlink(lockPath);
-    return true;
-  } finally {
-    await guard.close().catch(() => {
-      return;
-    });
-    await unlink(guardPath).catch(() => {
-      return;
-    });
-  }
-}
-function createFileStateStore(path, options) {
-  const lockPath = `${path}.lock`;
-  const lockTimeoutMs = options.lockTimeoutMs ?? 1e4;
-  const staleLockMs = options.staleLockMs ?? 3000;
-  const retryMs = options.retryMs ?? 10;
-  const heartbeatMs = Math.max(MIN_HEARTBEAT_MS, Math.floor(staleLockMs / 3));
-  const abandonedAfterMs = Math.max(staleLockMs * ABANDONED_LOCK_MULTIPLIER, heartbeatMs * ABANDONED_HEARTBEATS);
-  if (staleLockMs >= lockTimeoutMs) {
-    throw new Error(`[stitchkit] createFileStateStore: staleLockMs (${staleLockMs}) must be below lockTimeoutMs (${lockTimeoutMs}), or a crashed holder blocks every update until the timeout`);
-  }
-  let sweptTemporaries = false;
-  const parseFile = async () => {
-    let source;
-    try {
-      source = await readFile2(path, "utf8");
-    } catch (error) {
-      if (await missing(error))
-        return null;
-      throw error;
-    }
-    try {
-      return options.schema.parse(JSON.parse(source));
-    } catch (error) {
-      await options.onCorrupt?.({ path, error });
-      if ((options.corrupt ?? "throw") === "empty")
-        return null;
-      throw error;
-    }
-  };
-  const acquire = async () => {
-    await mkdir(dirname(path), { recursive: true });
-    if (!sweptTemporaries) {
-      sweptTemporaries = true;
-      await sweepTemporaries(path, staleLockMs);
-    }
-    const deadline = Date.now() + lockTimeoutMs;
-    while (true) {
-      try {
-        const handle = await open(lockPath, "wx");
-        const token = crypto.randomUUID();
-        try {
-          await handle.writeFile(JSON.stringify({ token, pid: process.pid, acquiredAt: Date.now() }));
-          await handle.sync();
-        } catch (error) {
-          await handle.close().catch(() => {
-            return;
-          });
-          await unlink(lockPath).catch(() => {
-            return;
-          });
-          throw error;
-        }
-        return {
-          refresh: async () => {
-            const now = new Date;
-            await handle.utimes(now, now);
-          },
-          release: async () => {
-            await handle.close();
-            try {
-              const owner = JSON.parse(await readFile2(lockPath, "utf8"));
-              if (isRecord(owner) && owner.token === token)
-                await unlink(lockPath);
-            } catch (error) {
-              if (!await missing(error))
-                throw error;
-            }
-          }
-        };
-      } catch (error) {
-        if (!existing(error))
-          throw error;
-        try {
-          const lock = await stat2(lockPath);
-          if (Date.now() - lock.mtimeMs > staleLockMs) {
-            if (await reclaim(lockPath, lock, staleLockMs, abandonedAfterMs))
-              continue;
-          }
-        } catch (statError) {
-          if (await missing(statError))
-            continue;
-          throw statError;
-        }
-        if (Date.now() >= deadline) {
-          throw new Error(`[stitchkit] timed out acquiring state lock for ${path}`);
-        }
-        await delay(retryMs);
-      }
-    }
-  };
-  const write = async (state) => {
-    const validated = options.schema.parse(state);
-    const temporary = `${path}.tmp.${process.pid}.${crypto.randomUUID()}`;
-    const handle = await open(temporary, "wx");
-    try {
-      try {
-        await handle.writeFile(`${JSON.stringify(validated)}
-`);
-        await handle.sync();
-      } finally {
-        await handle.close();
-      }
-      await rename(temporary, path);
-    } catch (error) {
-      await unlink(temporary).catch(() => {
-        return;
-      });
-      throw error;
-    }
-  };
-  return {
-    read: parseFile,
-    async update(transition) {
-      const lock = await acquire();
-      const heartbeat = setInterval(() => void lock.refresh().catch(() => {
-        return;
-      }), heartbeatMs);
-      try {
-        const next = await transition(await parseFile());
-        await write(next.state);
-        return next.result;
-      } finally {
-        clearInterval(heartbeat);
-        await lock.release();
-      }
-    }
-  };
-}
-// src/server/lifecycle.ts
-function composeLifecycleHooks(...hooks) {
-  return {
-    onRequest: async (request) => {
-      for (const hook of hooks) {
-        const response = await hook?.onRequest?.(request);
-        if (response instanceof Response)
-          return response;
-      }
-      return;
-    },
-    authorize: async (ctx, endpoint) => {
-      for (const hook of hooks)
-        await hook?.authorize?.(ctx, endpoint);
-    },
-    beforeHandle: async (ctx, endpoint) => {
-      for (const hook of hooks)
-        await hook?.beforeHandle?.(ctx, endpoint);
-    },
-    afterHandle: async (ctx, result, endpoint) => {
-      let current = result;
-      for (const hook of hooks) {
-        const transformed = await hook?.afterHandle?.(ctx, current, endpoint);
-        if (transformed !== undefined)
-          current = transformed;
-      }
-      return current;
-    },
-    onError: async (ctx, error, endpoint) => {
-      for (const hook of hooks) {
-        const response = await hook?.onError?.(ctx, error, endpoint);
-        if (response instanceof Response)
-          return response;
-      }
-      return;
-    }
-  };
-}
-// src/server/middleware/trust-fence.ts
-var DEFAULT_PORTS = new Set(["80", "443"]);
-function readAuthority(value) {
-  if (value.includes("*"))
-    return;
-  const match = /^(\[[^\]]+\]|[^:[\]]+)(?::(\d{1,5}))?$/.exec(value.trim());
-  if (!match?.[1])
-    return;
-  const port = match[2] ?? null;
-  if (port !== null) {
-    const numeric = Number(port);
-    if (numeric < 1 || numeric > 65535)
-      return;
-  }
-  let url;
-  try {
-    url = new URL(`http://${match[1]}`);
-  } catch {
-    return;
-  }
-  if (url.pathname !== "/" || url.search !== "" || url.username !== "" || url.hostname === "") {
-    return;
-  }
-  return { hostname: url.hostname, port };
-}
-function comparablePort(port) {
-  return port === null || DEFAULT_PORTS.has(port) ? null : port;
-}
-function isLoopbackAddress(address) {
-  if (address === "")
-    return false;
-  const bare = address.replace(/^\[|\]$/g, "").replace(/^::ffff:/i, "");
-  if (bare === "::1")
-    return true;
-  const octets = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(bare);
-  return octets?.[1] === "127";
-}
-function createTrustFence(config) {
-  if (config.trustedHosts.length === 0) {
-    throw new Error("[stitchkit] trust fence: `trustedHosts` cannot be empty — a fence that trusts nothing refuses every request, which is never what a running server wants. List the authorities this server answers on.");
-  }
-  const trusted = [];
-  for (const entry of config.trustedHosts) {
-    const authority = readAuthority(entry);
-    if (!authority) {
-      throw new Error(`[stitchkit] trust fence: "${entry}" is not an authority. An entry is \`host\` or \`host:port\` — no scheme, no path, no credentials, no wildcard. An entry that cannot be read back as a canonical authority is refused here rather than quietly matching nothing.`);
-    }
-    trusted.push(authority);
-  }
-  const trustedOrigins = [];
-  for (const entry of config.trustedOrigins ?? []) {
-    const authority = readAuthority(entry);
-    if (!authority) {
-      throw new Error(`[stitchkit] trust fence: trustedOrigins entry "${entry}" is not an authority. An entry is \`host\` or \`host:port\` — no scheme, no path, no wildcard, the same form as trustedHosts.`);
-    }
-    trustedOrigins.push(authority);
-  }
-  function refuse(refusal) {
-    config.onRefused?.(refusal);
-    config.logger?.warn?.("[stitchkit] trust fence refused a request", {
-      reason: refusal.reason,
-      lane: refusal.lane,
-      host: refusal.host,
-      origin: refusal.origin
-    });
-    return refusal;
-  }
-  function check(request, lane) {
-    const host = request.headers.get("host");
-    const origin = request.headers.get("origin");
-    const site = request.headers.get("sec-fetch-site");
-    if (host === null) {
-      return refuse({ reason: "missing-host", lane, host, origin, site });
-    }
-    const requested = readAuthority(host);
-    if (!requested) {
-      return refuse({ reason: "untrusted-host", lane, host, origin, site });
-    }
-    const matched = trusted.some((entry) => entry.hostname === requested.hostname && (entry.port === null || entry.port === requested.port));
-    if (!matched) {
-      return refuse({ reason: "untrusted-host", lane, host, origin, site });
-    }
-    if (site === "cross-site") {
-      return refuse({ reason: "cross-site", lane, host, origin, site });
-    }
-    if (origin !== null && origin !== "null") {
-      let originAuthority;
-      try {
-        const parsed = new URL(origin);
-        originAuthority = { hostname: parsed.hostname, port: parsed.port || null };
-      } catch {
-        originAuthority = undefined;
-      }
-      const sameAuthority = originAuthority !== undefined && originAuthority.hostname === requested.hostname && comparablePort(originAuthority.port) === comparablePort(requested.port);
-      const declared = originAuthority !== undefined && trustedOrigins.some((entry) => entry.hostname === originAuthority.hostname && (entry.port === null || entry.port === originAuthority.port));
-      const agrees = sameAuthority || declared;
-      if (!agrees) {
-        return refuse({ reason: "origin-mismatch", lane, host, origin, site });
-      }
-    }
-    return;
-  }
-  return {
-    hooks: {
-      onRequest: (request) => check(request, "http") === undefined ? undefined : new Response(null, { status: 403 })
-    },
-    allowRequest: (request) => check(request, "socket") === undefined,
-    check
-  };
-}
-// src/server/openapi.ts
-var ERROR_ENVELOPE_SCHEMA = {
-  type: "object",
-  properties: {
-    error: {
-      type: "object",
-      properties: {
-        code: { type: "string" },
-        message: { type: "string" },
-        details: {},
-        hint: { type: "string" }
-      },
-      required: ["code"]
-    }
-  },
-  required: ["error"]
-};
-function toOpenApiPath(path) {
-  return path.replace(/:([^/]+)/g, "{$1}");
-}
-function safeJson(schema, io) {
-  if (!schema)
-    return {};
-  try {
-    return toJsonSchema(schema, io, "any");
-  } catch {
-    return {};
-  }
-}
-function errorResponse(description) {
-  return {
-    description,
-    content: { "application/json": { schema: ERROR_ENVELOPE_SCHEMA } }
-  };
-}
-function errorResponses(scope) {
-  const responses = {
-    "400": errorResponse("Validation error"),
-    "500": errorResponse("Server error")
-  };
-  if (scope && scope !== "public") {
-    responses["401"] = errorResponse("Unauthorized");
-    responses["403"] = errorResponse("Forbidden");
-  }
-  return responses;
-}
-function generateOpenApiDocument(config) {
-  const groups = [
-    ...(config.services ?? []).map((service) => ({ pathPrefix: undefined, service })),
-    ...(config.groups ?? []).flatMap((group) => group.services.map((service) => ({ pathPrefix: group.pathPrefix, service })))
-  ];
-  const paths = {};
-  for (const { pathPrefix, service } of groups) {
-    for (const [key, method] of Object.entries(service.methods)) {
-      if (method.expose && !method.expose.includes("HTTP"))
-        continue;
-      if (config.includeMethod && !config.includeMethod(method))
-        continue;
-      const servicePath = joinRoutePath("/", service.prefix, method.path === "/" ? "" : method.path);
-      const fullPath = toOpenApiPath(pathPrefix ? joinRoutePath(pathPrefix, servicePath) : servicePath);
-      const parameters = [];
-      const trailingWildcard = parseTrailingWildcard(fullPath);
-      let wildcardSchema = { type: "string" };
-      for (const field of jsonSchemaFields(safeJson(method.paramsSchema, "input"))) {
-        if (trailingWildcard && field.name === trailingWildcard.name) {
-          wildcardSchema = field.schema;
-          continue;
-        }
-        parameters.push({
-          name: field.name,
-          in: "path",
-          required: true,
-          schema: field.schema,
-          ...field.description && { description: field.description }
-        });
-      }
-      const inputInQuery = inputIsQuery(method.method);
-      if (inputInQuery && method.inputSchema) {
-        for (const field of jsonSchemaFields(safeJson(method.inputSchema, "input"))) {
-          parameters.push({
-            name: field.name,
-            in: "query",
-            required: field.required,
-            schema: field.schema,
-            ...field.description && { description: field.description }
-          });
-        }
-      }
-      const responses = { ...errorResponses(method.scope) };
-      if (method.rawResponse) {
-        responses["200"] = method.method === "HEAD" ? { description: "Headers only" } : {
-          description: "Success",
-          content: {
-            [method.contentType ?? "application/octet-stream"]: {
-              schema: { type: "string", format: "binary" }
-            }
-          }
-        };
-      } else if (method.stream) {
-        const mediaType = method.stream.format === "sse" ? "text/event-stream" : "application/x-ndjson";
-        responses["200"] = {
-          description: "Validated streaming response",
-          content: {
-            [mediaType]: {
-              schema: { type: "string" },
-              "x-stitchkit-item-schema": safeJson(method.stream.item, "output"),
-              "x-stitchkit-max-frame-bytes": method.stream.maxFrameBytes ?? DEFAULT_CONTRACT_STREAM_FRAME_BYTES,
-              "x-stitchkit-terminal-required": Boolean(method.stream.terminal),
-              "x-stitchkit-stream-framing": method.stream.framing ?? "envelope",
-              "x-stitchkit-stream-completion": method.stream.completion ?? "stream-end",
-              "x-stitchkit-final-line": method.stream.finalLine ?? "allow"
-            }
-          }
-        };
-      } else if (method.outputSchema) {
-        responses[String(method.responseMeta?.status ?? 200)] = {
-          description: "Success",
-          content: { "application/json": { schema: safeJson(method.outputSchema, "output") } }
-        };
-      } else {
-        responses[String(method.responseMeta?.status ?? 204)] = { description: "No content" };
-      }
-      const operation = {
-        summary: method.desc,
-        operationId: `${service.name}_${key}`,
-        "x-stitchkit-scope": method.scope,
-        "x-stitchkit-has-input": Boolean(method.inputSchema),
-        "x-stitchkit-has-output": Boolean(method.outputSchema || method.stream),
-        ...method.stream && { "x-stitchkit-stream": true },
-        ...parameters.length > 0 && { parameters },
-        responses
-      };
-      if (trailingWildcard) {
-        operation["x-stitchkit-trailing-wildcard"] = {
-          parameter: trailingWildcard.name,
-          required: true,
-          schema: wildcardSchema,
-          description: `Matches zero or more trailing path segments and exposes their '/'-joined remainder as params.${trailingWildcard.name}.`
-        };
-      }
-      if (!inputInQuery && (method.inputSchema || method.multipart)) {
-        if (method.multipart) {
-          const inputJson = safeJson(method.inputSchema, "input");
-          const baseProps = isRecord(inputJson.properties) ? inputJson.properties : {};
-          const baseRequired = Array.isArray(inputJson.required) ? inputJson.required : [];
-          const fileProperties = {};
-          const requiredFiles = [];
-          for (const [field, policy] of Object.entries(method.multipart.files)) {
-            const binary = {
-              type: "string",
-              format: "binary",
-              ...policy.maxBytes !== undefined && { maxLength: policy.maxBytes },
-              ...policy.contentTypes !== undefined && {
-                "x-accepted-content-types": policy.contentTypes
-              }
-            };
-            fileProperties[field] = policy.multiple === true ? {
-              type: "array",
-              items: binary,
-              minItems: policy.required === false ? 0 : 1,
-              ...policy.maxFiles !== undefined && { maxItems: policy.maxFiles }
-            } : binary;
-            if (policy.required !== false)
-              requiredFiles.push(field);
-          }
-          operation.requestBody = {
-            required: baseRequired.length > 0 || requiredFiles.length > 0,
-            content: {
-              "multipart/form-data": {
-                schema: {
-                  type: "object",
-                  properties: {
-                    ...baseProps,
-                    ...fileProperties
-                  },
-                  required: [...baseRequired, ...requiredFiles]
-                }
-              }
-            }
-          };
-        } else if (method.inputSchema) {
-          const required = jsonSchemaFields(safeJson(method.inputSchema, "input")).some((f) => f.required);
-          const schema = safeJson(method.inputSchema, "input");
-          operation.requestBody = {
-            required,
-            content: method.safelistedBody ? { "application/json": { schema }, "text/plain": { schema } } : { "application/json": { schema } }
-          };
-        }
-      }
-      const pathItem = paths[fullPath] ?? {};
-      pathItem[method.method.toLowerCase()] = operation;
-      paths[fullPath] = pathItem;
-    }
-  }
-  return {
-    openapi: "3.1.0",
-    info: config.info,
-    ...config.servers && { servers: config.servers },
-    paths
-  };
-}
-function openApiRoute(path, document) {
-  return {
-    method: "GET",
-    path,
-    handler: () => Response.json(document)
-  };
-}
-// src/server/rate-limit.ts
-function refillBucket(entry, config, now) {
-  const elapsed = (now - entry.lastRefill) / 1000;
-  entry.tokens = Math.min(config.max, entry.tokens + elapsed / config.window * config.max);
-  entry.lastRefill = now;
-}
-var MAX_BUCKETS = 1e5;
-function createRateLimiter() {
-  const { store: buckets, destroy } = createSweptMap({
-    intervalMs: 60000,
-    isExpired: (entry, now) => now - entry.lastRefill > 300000
-  });
-  return {
-    destroy,
-    check(key, config) {
-      const now = Date.now();
-      const entry = buckets.get(key);
-      if (entry) {
-        buckets.delete(key);
-        buckets.set(key, entry);
-        refillBucket(entry, config, now);
-        if (entry.tokens < 1)
-          return false;
-        entry.tokens -= 1;
-        return true;
-      }
-      if (buckets.size >= MAX_BUCKETS) {
-        const lru = buckets.keys().next().value;
-        if (lru !== undefined)
-          buckets.delete(lru);
-      }
-      const fresh = { tokens: config.max, lastRefill: now };
-      buckets.set(key, fresh);
-      if (fresh.tokens < 1)
-        return false;
-      fresh.tokens -= 1;
-      return true;
-    },
-    remaining(key, config) {
-      const entry = buckets.get(key);
-      if (!entry)
-        return config.max;
-      refillBucket(entry, config, Date.now());
-      return Math.floor(entry.tokens);
-    }
-  };
-}
-// src/server/raw.ts
-function respondJson(data) {
-  if (data === null || data === undefined)
-    return new Response(null, { status: 204 });
-  return Response.json(data);
-}
-function errorResponse2(error) {
-  const appErr = normalizeError(error);
-  const res = Response.json(appErr.toJSON(), { status: appErr.status });
-  const traceId = getTraceId();
-  if (traceId)
-    res.headers.set("x-request-id", traceId);
-  return res;
-}
-async function parseBody(req, schema) {
-  const raw = await req.json().catch(() => null);
-  if (raw === null)
-    return null;
-  const parsed = schema.safeParse(raw);
-  return parsed.success ? parsed.data : null;
-}
-// src/server/release-signal.ts
-function bindReleaseRefreshSignal(marker, options = {}) {
-  const signal = options.signal ?? "SIGUSR2";
-  const source = options.source ?? process;
-  const handler = () => {
-    try {
-      options.onRefresh?.(marker.refresh());
-    } catch (error) {
-      try {
-        options.onError?.(error);
-      } catch {}
-    }
-  };
-  source.on(signal, handler);
-  return () => source.off(signal, handler);
-}
-export {
-  zodIssues,
-  webSocketLane,
-  weakETag,
-  verifyPkce,
-  verifyJwt,
-  unauthorized,
-  streamingRoute,
-  streamSSE,
-  staticRoute,
-  sseRoute,
-  socketIoLane,
-  signJwt,
-  serveFile,
-  serializeCookie,
-  respondJson,
-  resolveTraceId,
-  resolveSocketIp,
-  rateLimited,
-  parseSSE,
-  parseMultipart,
-  parseCookies,
-  parseCookieHeader,
-  parseByteRange,
-  parseBody,
-  openApiRoute,
-  notFound,
-  normalizeError,
-  ndjsonRoute,
-  isWithinDir,
-  isStitchErrorCode,
-  isPublicIp,
-  isLoopbackAddress,
-  implementRegistry,
-  implement,
-  getClientInfo,
-  generateTraceId,
-  generateOpenApiDocument,
-  formatZodError,
-  forbidden,
-  extractToken,
-  extractIp,
-  errorResponse2 as errorResponse,
-  errorCode,
-  deriveCodeChallenge,
-  defineMultipartStream,
-  defineCookie,
-  createUnixClientTransport,
-  createTrustFence,
-  createSocketIOServer,
-  createServer,
-  createScopedImplementRegistry,
-  createScopedImplement,
-  createRateLimiter,
-  createMultipartStream,
-  createImplementRegistry,
-  createImplement,
-  createHandler,
-  createFileStateStore,
-  createEventBus,
-  createErrorHook,
-  createCache,
-  createBearerResolver,
-  createAuthHook,
-  corsPreflightResponse,
-  corsHeaders,
-  conflict,
-  composeWebSocketHandlers,
-  composeLifecycleHooks,
-  composeAuthHooks,
-  cacheHeaders,
-  bindSocketRegistry,
-  bindReleaseRefreshSignal,
-  bindRealtimeServer,
-  bindProcessSignals,
-  badRequest,
-  appError,
-  UnixClientTransportError,
-  ShutdownStatusSchema,
-  ShutdownStateSchema,
-  ShutdownResultSchema,
-  ShutdownOptionsSchema,
-  STITCH_ERROR_STATUS,
-  DEFAULT_STREAM_HEARTBEAT_MS,
-  DEFAULT_CORS_EXPOSE_HEADERS,
-  DEFAULT_CORS_ALLOW_HEADERS,
-  AppError
-};