stitchkit 0.93.0 → 0.94.1

package/dist/entrypoints/server.js

@@ -0,0 +1,2009 @@
+import {
+  DEFAULT_STREAM_HEARTBEAT_MS,
+  UnixClientTransportError,
+  bindProcessSignals,
+  bindRealtimeServer,
+  composeWebSocketHandlers,
+  contextContributionDelta,
+  createHandler,
+  createImplementRegistry,
+  createScopedImplementRegistry,
+  createSocketIOServer,
+  createUnixClientTransport,
+  implementRegistry,
+  mergeContextContribution,
+  ndjsonRoute,
+  parseMultipart,
+  prepareContextContribution,
+  socketIoLane,
+  sseRoute,
+  streamingRoute,
+  webSocketLane
+} from "../index-p3vsv1fb.js";
+import"../index-y91ry9h2.js";
+import {
+  withDeadline
+} from "../index-b9aefrqd.js";
+import {
+  ShutdownOptionsSchema,
+  ShutdownResultSchema,
+  ShutdownStateSchema,
+  ShutdownStatusSchema,
+  createServerLifecycle
+} from "../index-3z73fh2c.js";
+import"../index-ndddxtyx.js";
+import"../index-dce5wxcq.js";
+import {
+  inputIsQuery
+} from "../index-48ffdxgk.js";
+import"../index-7p1f0vp2.js";
+import {
+  DEFAULT_CONTRACT_STREAM_FRAME_BYTES
+} from "../index-wqgjfstn.js";
+import {
+  signJwt,
+  verifyJwt,
+  verifyPkce
+} from "../index-e01r054k.js";
+import {
+  deriveCodeChallenge
+} from "../index-hr4tzbwq.js";
+import {
+  DEFAULT_CORS_ALLOW_HEADERS,
+  DEFAULT_CORS_EXPOSE_HEADERS,
+  corsHeaders,
+  corsPreflightResponse,
+  createImplement,
+  createMultipartStream,
+  createScopedImplement,
+  defineMultipartStream,
+  implement
+} from "../index-2gxzjvyr.js";
+import"../index-2bxbyab0.js";
+import"../index-rxfy4cq7.js";
+import"../index-k30h66yd.js";
+import {
+  joinRoutePath,
+  parseTrailingWildcard
+} from "../index-4gcnakhx.js";
+import"../index-6k1937bx.js";
+import {
+  isWithinDir,
+  realPathWithinDir
+} from "../index-sbdmyz75.js";
+import {
+  getTraceId
+} from "../index-zfrhfn82.js";
+import {
+  extractIp,
+  generateTraceId,
+  getClientInfo,
+  isPublicIp,
+  resolveSocketIp,
+  resolveTraceId
+} from "../index-35mh5bhj.js";
+import"../index-zcgf3gqf.js";
+import {
+  jsonSchemaFields,
+  toJsonSchema
+} from "../index-eqqvgdb3.js";
+import {
+  errorCode,
+  normalizeError
+} from "../index-znfs20ss.js";
+import {
+  formatZodError,
+  zodIssues
+} from "../index-p5r7qpdd.js";
+import {
+  AppError,
+  STITCH_ERROR_STATUS,
+  appError,
+  badRequest,
+  conflict,
+  forbidden,
+  isStitchErrorCode,
+  notFound,
+  rateLimited,
+  unauthorized
+} from "../index-2vtcmrj9.js";
+import {
+  isUnsafeKey
+} from "../index-kzfs85xp.js";
+import {
+  isRecord
+} from "../index-hffjpmq9.js";
+
+// src/application/file-state-store.ts
+import { mkdir, open, readdir, readFile, rename, stat, unlink } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+var ABANDONED_LOCK_MULTIPLIER = 10;
+var ABANDONED_HEARTBEATS = 30;
+var MIN_HEARTBEAT_MS = 10;
+var delay = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
+async function missing(error) {
+  return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+function existing(error) {
+  return error instanceof Error && "code" in error && error.code === "EEXIST";
+}
+async function ownerState(lockPath) {
+  let owner;
+  try {
+    owner = JSON.parse(await readFile(lockPath, "utf8"));
+  } catch {
+    return "unknown";
+  }
+  if (typeof owner !== "object" || owner === null || !("pid" in owner) || typeof owner.pid !== "number" || !Number.isSafeInteger(owner.pid) || owner.pid <= 0) {
+    return "unknown";
+  }
+  try {
+    process.kill(owner.pid, 0);
+    return "alive";
+  } catch (error) {
+    return error instanceof Error && "code" in error && error.code === "ESRCH" ? "gone" : "unknown";
+  }
+}
+async function sweepTemporaries(path, staleLockMs) {
+  const prefix = `${basename(path)}.tmp.`;
+  const directory = dirname(path);
+  let entries;
+  try {
+    entries = await readdir(directory);
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (!entry.startsWith(prefix))
+      continue;
+    const candidate = join(directory, entry);
+    const info = await stat(candidate).catch(() => null);
+    if (info && Date.now() - info.mtimeMs > staleLockMs) {
+      await unlink(candidate).catch(() => {
+        return;
+      });
+    }
+  }
+}
+async function reclaim(lockPath, observed, staleLockMs, abandonedAfterMs) {
+  const guardPath = `${lockPath}.reclaim`;
+  let guard;
+  try {
+    guard = await open(guardPath, "wx");
+  } catch (error) {
+    if (!existing(error))
+      throw error;
+    const orphan = await stat(guardPath).catch(() => null);
+    if (orphan && Date.now() - orphan.mtimeMs > staleLockMs) {
+      await unlink(guardPath).catch(() => {
+        return;
+      });
+    }
+    return false;
+  }
+  try {
+    const current = await stat(lockPath).catch(() => null);
+    if (!current || current.dev !== observed.dev || current.ino !== observed.ino || current.mtimeMs !== observed.mtimeMs) {
+      return false;
+    }
+    const owner = await ownerState(lockPath);
+    const age = Date.now() - current.mtimeMs;
+    if (owner !== "gone" && age < abandonedAfterMs)
+      return false;
+    await unlink(lockPath);
+    return true;
+  } finally {
+    await guard.close().catch(() => {
+      return;
+    });
+    await unlink(guardPath).catch(() => {
+      return;
+    });
+  }
+}
+function createFileStateStore(path, options) {
+  const lockPath = `${path}.lock`;
+  const lockTimeoutMs = options.lockTimeoutMs ?? 1e4;
+  const staleLockMs = options.staleLockMs ?? 3000;
+  const retryMs = options.retryMs ?? 10;
+  const heartbeatMs = Math.max(MIN_HEARTBEAT_MS, Math.floor(staleLockMs / 3));
+  const abandonedAfterMs = Math.max(staleLockMs * ABANDONED_LOCK_MULTIPLIER, heartbeatMs * ABANDONED_HEARTBEATS);
+  if (staleLockMs >= lockTimeoutMs) {
+    throw new Error(`[stitchkit] createFileStateStore: staleLockMs (${staleLockMs}) must be below lockTimeoutMs (${lockTimeoutMs}), or a crashed holder blocks every update until the timeout`);
+  }
+  let sweptTemporaries = false;
+  const parseFile = async () => {
+    let source;
+    try {
+      source = await readFile(path, "utf8");
+    } catch (error) {
+      if (await missing(error))
+        return null;
+      throw error;
+    }
+    try {
+      return options.schema.parse(JSON.parse(source));
+    } catch (error) {
+      await options.onCorrupt?.({ path, error });
+      if ((options.corrupt ?? "throw") === "empty")
+        return null;
+      throw error;
+    }
+  };
+  const acquire = async () => {
+    await mkdir(dirname(path), { recursive: true });
+    if (!sweptTemporaries) {
+      sweptTemporaries = true;
+      await sweepTemporaries(path, staleLockMs);
+    }
+    const deadline = Date.now() + lockTimeoutMs;
+    while (true) {
+      try {
+        const handle = await open(lockPath, "wx");
+        const token = crypto.randomUUID();
+        try {
+          await handle.writeFile(JSON.stringify({ token, pid: process.pid, acquiredAt: Date.now() }));
+          await handle.sync();
+        } catch (error) {
+          await handle.close().catch(() => {
+            return;
+          });
+          await unlink(lockPath).catch(() => {
+            return;
+          });
+          throw error;
+        }
+        return {
+          refresh: async () => {
+            const now = new Date;
+            await handle.utimes(now, now);
+          },
+          release: async () => {
+            await handle.close();
+            try {
+              const owner = JSON.parse(await readFile(lockPath, "utf8"));
+              if (isRecord(owner) && owner.token === token)
+                await unlink(lockPath);
+            } catch (error) {
+              if (!await missing(error))
+                throw error;
+            }
+          }
+        };
+      } catch (error) {
+        if (!existing(error))
+          throw error;
+        try {
+          const lock = await stat(lockPath);
+          if (Date.now() - lock.mtimeMs > staleLockMs) {
+            if (await reclaim(lockPath, lock, staleLockMs, abandonedAfterMs))
+              continue;
+          }
+        } catch (statError) {
+          if (await missing(statError))
+            continue;
+          throw statError;
+        }
+        if (Date.now() >= deadline) {
+          throw new Error(`[stitchkit] timed out acquiring state lock for ${path}`);
+        }
+        await delay(retryMs);
+      }
+    }
+  };
+  const write = async (state) => {
+    const validated = options.schema.parse(state);
+    const temporary = `${path}.tmp.${process.pid}.${crypto.randomUUID()}`;
+    const handle = await open(temporary, "wx");
+    try {
+      try {
+        await handle.writeFile(`${JSON.stringify(validated)}
+`);
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+      await rename(temporary, path);
+    } catch (error) {
+      await unlink(temporary).catch(() => {
+        return;
+      });
+      throw error;
+    }
+  };
+  return {
+    read: parseFile,
+    async update(transition) {
+      const lock = await acquire();
+      const heartbeat = setInterval(() => void lock.refresh().catch(() => {
+        return;
+      }), heartbeatMs);
+      try {
+        const next = await transition(await parseFile());
+        await write(next.state);
+        return next.result;
+      } finally {
+        clearInterval(heartbeat);
+        await lock.release();
+      }
+    }
+  };
+}
+// src/realtime/registry.ts
+var authorizedRoom = Symbol("stitchkit.authorized-room");
+function freezeRoom(name) {
+  return Object.freeze({ name, [authorizedRoom]: true });
+}
+async function leaveQuietly(member, room) {
+  try {
+    await member.connection.raw.leave(room);
+  } catch {}
+}
+async function replayMember(member, options, token, isClosed) {
+  if (!options.replay || member.disconnected || isClosed())
+    return !member.disconnected && !isClosed();
+  const attempts = Math.max(1, options.replayAttempts ?? 3);
+  for (let attempt = 0;attempt < attempts && !member.disconnected && !isClosed(); attempt += 1) {
+    member.buffer = [];
+    member.overflow = false;
+    const before = await options.revision?.();
+    if (member.disconnected || isClosed())
+      break;
+    const frames = await options.replay({
+      identity: member.identity,
+      rooms: Object.freeze([...member.joined].map(token)),
+      revision: before
+    });
+    const after = await options.revision?.();
+    if (member.disconnected || isClosed())
+      break;
+    if (options.revision && !Object.is(before, after))
+      continue;
+    if (member.overflow)
+      continue;
+    for (const frame of frames)
+      member.connection.events.emit(frame.event, ...frame.args);
+    const buffered = member.buffer;
+    member.buffer = null;
+    for (const deferred of buffered ?? [])
+      deferred();
+    return !member.disconnected && !isClosed();
+  }
+  member.buffer = null;
+  member.overflow = false;
+  if (!member.disconnected)
+    await options.onResyncRequired?.(member.connection.raw.id, member.identity);
+  return false;
+}
+function bindSocketRegistry(server, options) {
+  const members = new Map;
+  const minted = new WeakSet;
+  let revision = 0;
+  let closed = false;
+  const setups = new Set;
+  const maxBufferedFrames = Math.max(1, options.maxBufferedFrames ?? 1000);
+  const token = (name) => {
+    const created = freezeRoom(name);
+    minted.add(created);
+    return created;
+  };
+  const assertToken = (room) => {
+    if (!minted.has(room))
+      throw new Error("Room was not authorized by this registry");
+    return room.name;
+  };
+  const remove = async (member) => {
+    if (member.disconnected)
+      return;
+    member.disconnected = true;
+    member.connection.raw.off?.("disconnect", member.disconnect);
+    members.delete(member.connection.raw.id);
+    for (const room of member.joined)
+      await leaveQuietly(member, room);
+    member.joined.clear();
+    member.buffer = null;
+    revision += 1;
+  };
+  const resyncMember = (member) => {
+    if (member.replayPromise)
+      return member.replayPromise;
+    const active = replayMember(member, options, token, () => closed).finally(() => {
+      if (member.replayPromise === active)
+        member.replayPromise = undefined;
+    });
+    member.replayPromise = active;
+    return active;
+  };
+  const setupConnection = async (connection) => {
+    if (closed)
+      return;
+    const member = {
+      connection,
+      identity: connection.raw.data,
+      authorized: new Set,
+      joined: new Set,
+      buffer: null,
+      overflow: false,
+      disconnected: false,
+      disconnect: () => {
+        return;
+      }
+    };
+    member.disconnect = () => void remove(member);
+    connection.raw.on("disconnect", member.disconnect);
+    members.set(connection.raw.id, member);
+    try {
+      const authorized = new Set(await options.rooms(connection.raw.data));
+      if (member.disconnected || closed) {
+        await remove(member);
+        return;
+      }
+      member.authorized = authorized;
+      for (const name of authorized) {
+        await connection.raw.join(name);
+        if (member.disconnected || closed) {
+          await leaveQuietly(member, name);
+          await remove(member);
+          return;
+        }
+        member.joined.add(name);
+      }
+      if (closed) {
+        await remove(member);
+        return;
+      }
+      revision += 1;
+      await resyncMember(member);
+    } catch {
+      await remove(member);
+    }
+  };
+  const stopListening = server.onConnection((connection) => {
+    let setup;
+    setup = setupConnection(connection).finally(() => setups.delete(setup));
+    setups.add(setup);
+    return setup;
+  });
+  return {
+    room: token,
+    async join(socketId, room) {
+      const name = assertToken(room);
+      const member = members.get(socketId);
+      if (!member)
+        throw new Error(`Unknown socket: ${socketId}`);
+      if (!member.authorized.has(name))
+        throw new Error(`Socket is not authorized for room: ${name}`);
+      if (member.joined.has(name))
+        return;
+      await member.connection.raw.join(name);
+      if (!member.disconnected)
+        member.joined.add(name);
+      revision += 1;
+    },
+    async leave(socketId, room) {
+      const name = assertToken(room);
+      const member = members.get(socketId);
+      if (!member?.joined.has(name))
+        return;
+      await member.connection.raw.leave(name);
+      member.joined.delete(name);
+      revision += 1;
+    },
+    emitTo(room, event, ...args) {
+      const name = assertToken(room);
+      let recipients = 0;
+      for (const member of members.values()) {
+        if (!member.joined.has(name) || member.disconnected)
+          continue;
+        recipients += 1;
+        if (!member.buffer) {
+          member.connection.events.emit(event, ...args);
+        } else if (member.buffer.length >= maxBufferedFrames) {
+          member.overflow = true;
+        } else {
+          member.buffer.push(() => member.connection.events.emit(event, ...args));
+        }
+      }
+      return recipients;
+    },
+    resync: async (socketId) => {
+      const member = members.get(socketId);
+      return member ? resyncMember(member) : false;
+    },
+    snapshot() {
+      const connections = [...members.values()].map((member) => Object.freeze({
+        socketId: member.connection.raw.id,
+        identity: member.identity,
+        rooms: Object.freeze([...member.joined].sort()),
+        replaying: member.buffer !== null
+      }));
+      const roomMap = {};
+      for (const entry of connections) {
+        for (const name of entry.rooms) {
+          roomMap[name] = Object.freeze([...roomMap[name] ?? [], entry.socketId]);
+        }
+      }
+      return Object.freeze({
+        revision,
+        connections: Object.freeze(connections),
+        rooms: Object.freeze(roomMap)
+      });
+    },
+    async unbind() {
+      if (closed)
+        return;
+      closed = true;
+      stopListening();
+      await Promise.allSettled([...setups]);
+      const active = [...members.values()];
+      for (const member of active)
+        await remove(member);
+    }
+  };
+}
+// src/server/bun.ts
+import { chmodSync, statSync, unlinkSync } from "node:fs";
+function reclaimStaleUnixSocket(path) {
+  const stats = statSync(path, { throwIfNoEntry: false });
+  if (stats === undefined)
+    return;
+  if (!stats.isSocket()) {
+    throw new Error(`[stitchkit] createServer: "${path}" exists and is not a socket — refusing to remove it; remove it manually if it is debris`);
+  }
+  if (typeof process.getuid === "function" && stats.uid !== process.getuid()) {
+    throw new Error(`[stitchkit] createServer: unix socket "${path}" is owned by another user — refusing to reclaim it`);
+  }
+  const standalone = Bun.main.startsWith("/$bunfs/");
+  const interpreter = standalone ? Bun.which("bun") : process.execPath;
+  if (!interpreter) {
+    throw new Error(`[stitchkit] createServer: unix socket "${path}" already exists and no \`bun\` binary is on PATH to probe it from this compiled executable — remove the file manually if the previous process is dead`);
+  }
+  const probe = Bun.spawnSync({
+    cmd: [
+      interpreter,
+      "-e",
+      'try { const socket = await Bun.connect({ unix: Bun.env.STITCHKIT_UNIX_PROBE ?? "", socket: { data() { return undefined; } } }); socket.end(); process.exit(0); } catch (error) { process.exit(error && typeof error === "object" && "code" in error && error.code === "EACCES" ? 2 : 1); }'
+    ],
+    env: { ...process.env, STITCHKIT_UNIX_PROBE: path },
+    timeout: 2000
+  });
+  if (probe.exitedDueToTimeout) {
+    throw new Error(`[stitchkit] createServer: liveness probe for unix socket "${path}" timed out — refusing to reclaim; remove the file manually if the previous process is dead`);
+  }
+  if (probe.exitCode === 0 || probe.exitCode === 2) {
+    throw new Error(`[stitchkit] createServer: unix socket "${path}" is already in use${probe.exitCode === 2 ? " (connect permission denied)" : " by a live listener"}`);
+  }
+  unlinkSync(path);
+}
+function assertUnixListenConfig(config, unixPath) {
+  if (unixPath.length === 0) {
+    throw new Error("[stitchkit] createServer: `unix` must be a non-empty socket path");
+  }
+  if (config.port !== undefined || config.hostname !== undefined) {
+    throw new Error("[stitchkit] createServer: `unix` is mutually exclusive with `port`/`hostname`");
+  }
+  if (config.socket) {
+    throw new Error("[stitchkit] createServer: the Socket.IO lifecycle cannot listen on a unix socket — socket.io clients dial TCP only");
+  }
+}
+async function waitForRequestDrain(server) {
+  while (server.pendingRequests > 0) {
+    await new Promise((resolve) => setTimeout(resolve, 5));
+  }
+}
+function createServer(config) {
+  const {
+    websocket: configuredWebSocket,
+    socket,
+    development,
+    bun: bunExtra,
+    port = 3000,
+    hostname
+  } = config;
+  const unixPath = typeof config.unix === "string" ? config.unix : config.unix?.path;
+  const unixMode = typeof config.unix === "string" ? undefined : config.unix?.mode;
+  if (unixPath !== undefined)
+    assertUnixListenConfig(config, unixPath);
+  const socketRoutePrefix = socket?.route.path.replace(/\*socketPath$/, "");
+  const websocket = configuredWebSocket ?? socket?.websocket;
+  const openSockets = new Set;
+  const socketDrainWaiters = new Set;
+  let hadWebSockets = false;
+  const resolveSocketDrain = () => {
+    if (openSockets.size !== 0)
+      return;
+    for (const resolve of socketDrainWaiters)
+      resolve();
+    socketDrainWaiters.clear();
+  };
+  const waitForSocketDrain = () => {
+    if (openSockets.size === 0)
+      return Promise.resolve();
+    return new Promise((resolve) => socketDrainWaiters.add(resolve));
+  };
+  const trackedWebSocket = websocket ? {
+    ...websocket,
+    open(ws) {
+      hadWebSockets = true;
+      openSockets.add(ws);
+      websocket.open?.(ws);
+    },
+    close(ws, code, reason) {
+      openSockets.delete(ws);
+      resolveSocketDrain();
+      websocket.close?.(ws, code, reason);
+    }
+  } : undefined;
+  let runtime;
+  const requireRuntime = () => {
+    if (!runtime)
+      throw new Error("[stitchkit] Bun server lifecycle started before Bun.serve");
+    return runtime;
+  };
+  const adapter = {
+    beginShutdown: () => socket?.beginShutdown(),
+    pendingRequests: () => runtime?.pendingRequests ?? 0,
+    pendingWebSockets: () => openSockets.size,
+    async closeRealtime() {
+      const logicalClose = socket?.close();
+      for (const ws of openSockets)
+        ws.close(1001, "Server shutting down");
+      await Promise.all([logicalClose, waitForSocketDrain()]);
+    },
+    async terminateRealtime() {
+      const count = openSockets.size;
+      const physicalClose = waitForSocketDrain();
+      for (const ws of [...openSockets])
+        ws.terminate();
+      await physicalClose;
+      return count;
+    },
+    async stopGracefully() {
+      await new Promise((resolve) => setTimeout(resolve, 0));
+      const server2 = requireRuntime();
+      if (server2.pendingRequests === 0 && openSockets.size === 0) {
+        const stopping2 = server2.stop(true);
+        if (!hadWebSockets)
+          await stopping2;
+        else
+          stopping2.catch(() => {
+            return;
+          });
+        return;
+      }
+      const stopping = server2.stop(false);
+      if (!hadWebSockets) {
+        await stopping;
+        return;
+      }
+      stopping.catch(() => {
+        return;
+      });
+      await waitForRequestDrain(server2);
+    },
+    async forceStop() {
+      const logicalClose = socket?.close();
+      const physicalClose = waitForSocketDrain();
+      for (const ws of [...openSockets])
+        ws.terminate();
+      const stopping = requireRuntime().stop(true);
+      if (!hadWebSockets)
+        await stopping;
+      else
+        stopping.catch(() => {
+          return;
+        });
+      await Promise.all([logicalClose, physicalClose]);
+    }
+  };
+  const lifecycle = createServerLifecycle(() => adapter);
+  const handler = createHandler(config);
+  const consumerFetch = config.wrapFetch ? config.wrapFetch(handler) : handler;
+  const admittedFetch = lifecycle.wrapFetch(consumerFetch);
+  const fetch = async (request, server2) => {
+    if (socket && socketRoutePrefix) {
+      const pathname = new URL(request.url).pathname;
+      if (pathname.startsWith(socketRoutePrefix)) {
+        return await socket.route.handler(request, {
+          params: { socketPath: pathname.slice(socketRoutePrefix.length) },
+          server: server2
+        });
+      }
+    }
+    return admittedFetch(request, server2);
+  };
+  if (unixPath !== undefined) {
+    reclaimStaleUnixSocket(unixPath);
+    const { reusePort, ipv6Only, http3, http2, http1, idleTimeout, ...unixExtra } = bunExtra ?? {};
+    runtime = trackedWebSocket ? Bun.serve({
+      ...unixExtra,
+      ...development && { development },
+      unix: unixPath,
+      websocket: trackedWebSocket,
+      fetch
+    }) : Bun.serve({
+      ...unixExtra,
+      ...development && { development },
+      unix: unixPath,
+      fetch
+    });
+    if (unixMode !== undefined)
+      chmodSync(unixPath, unixMode);
+  } else {
+    runtime = trackedWebSocket ? Bun.serve({
+      ...bunExtra,
+      ...development && { development },
+      port,
+      hostname,
+      websocket: trackedWebSocket,
+      fetch
+    }) : Bun.serve({
+      ...bunExtra,
+      ...development && { development },
+      port,
+      hostname,
+      fetch
+    });
+  }
+  const server = runtime;
+  return {
+    url: server.url.toString().replace(/\/$/, ""),
+    port: server.port ?? (unixPath !== undefined ? 0 : port),
+    runtime: server,
+    get status() {
+      return lifecycle.status;
+    },
+    shutdown: lifecycle.shutdown
+  };
+}
+// src/server/swept-map.ts
+function createSweptMap(options) {
+  const store = new Map;
+  const timer = setInterval(() => {
+    const now = Date.now();
+    for (const [key, value] of store) {
+      if (options.isExpired(value, now))
+        store.delete(key);
+    }
+  }, options.intervalMs);
+  timer.unref();
+  return {
+    store,
+    destroy() {
+      clearInterval(timer);
+      store.clear();
+    }
+  };
+}
+
+// src/server/cache.ts
+function createCache(options = {}) {
+  const maxEntries = options.maxEntries ?? 1000;
+  if (!Number.isInteger(maxEntries) || maxEntries < 1) {
+    throw new Error("cache.maxEntries must be a positive integer");
+  }
+  const { store, destroy } = createSweptMap({
+    intervalMs: 30000,
+    isExpired: (entry, now) => entry.expiresAt < now
+  });
+  return {
+    destroy,
+    get(key) {
+      const entry = store.get(key);
+      if (!entry)
+        return null;
+      if (entry.expiresAt < Date.now()) {
+        store.delete(key);
+        return null;
+      }
+      return entry.data;
+    },
+    set(key, data, maxAgeSeconds) {
+      if (!Number.isFinite(maxAgeSeconds) || maxAgeSeconds < 0) {
+        throw new Error("cache maxAgeSeconds must be a non-negative finite number");
+      }
+      store.delete(key);
+      store.set(key, { data, expiresAt: Date.now() + maxAgeSeconds * 1000 });
+      while (store.size > maxEntries) {
+        const oldest = store.keys().next().value;
+        if (oldest === undefined)
+          break;
+        store.delete(oldest);
+      }
+    },
+    invalidate(prefix) {
+      for (const key of store.keys()) {
+        if (key.startsWith(prefix))
+          store.delete(key);
+      }
+    },
+    clear() {
+      store.clear();
+    }
+  };
+}
+function cacheHeaders(maxAge, scope = "public") {
+  return {
+    "Cache-Control": `${scope}, max-age=${maxAge}`
+  };
+}
+// src/server/error-hook.ts
+function createErrorHook(config) {
+  if (config.vocabulary && (config.codeMap !== undefined || config.unmappedCode !== undefined)) {
+    throw new Error("[stitchkit] createErrorHook: `vocabulary` carries the wire map — it cannot be combined with `codeMap` or `unmappedCode`");
+  }
+  return async (ctx, error, endpoint) => {
+    const appErr = normalizeError(error);
+    const stitchCode = isStitchErrorCode(appErr.code) ? appErr.code : undefined;
+    const vocabularyMap = config.vocabulary?.codeMap;
+    const configuredMap = vocabularyMap ?? config.codeMap;
+    const mapped = stitchCode === undefined ? undefined : configuredMap?.[stitchCode];
+    const fallback = mapped === undefined && stitchCode !== undefined ? typeof config.unmappedCode === "function" ? config.unmappedCode(stitchCode) : config.unmappedCode : undefined;
+    const code = mapped ?? fallback ?? appErr.code;
+    const info = {
+      code,
+      status: appErr.status,
+      message: appErr.message,
+      details: appErr.details,
+      hint: appErr.hint
+    };
+    await config.onError?.(error, info, ctx, endpoint);
+    const body = await config.render(info, ctx, endpoint);
+    return new Response(JSON.stringify(body), {
+      status: info.status,
+      headers: { "content-type": "application/json" }
+    });
+  };
+}
+// src/server/event-bus.ts
+function isDecision(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const outcome = Reflect.get(value, "outcome");
+  if (outcome === "allow" || outcome === "defer")
+    return true;
+  return outcome === "deny" && typeof Reflect.get(value, "reason") === "string";
+}
+function createEventBus(options = {}) {
+  const subscriptions = new Map;
+  const declared = options.topics;
+  function add(event, fn, once) {
+    let set = subscriptions.get(event);
+    if (!set) {
+      set = new Set;
+      subscriptions.set(event, set);
+    }
+    const sub = { fn, once };
+    set.add(sub);
+    return () => {
+      set.delete(sub);
+    };
+  }
+  function declarationFor(event, verb) {
+    if (declared === undefined) {
+      if (verb === "emit")
+        return;
+      throw new Error(`[stitchkit] event bus: ${verb}("${event}") needs declared topics — pass \`topics\` from defineEvents. Its delivery deadline and undecided outcome come from the declaration, and neither has a default.`);
+    }
+    const topic = Reflect.get(declared, event);
+    if (topic === undefined) {
+      throw new Error(`[stitchkit] event bus: "${event}" is not a declared topic. Declared: ${Object.keys(declared).join(", ") || "(none)"}.`);
+    }
+    const expected = { emit: "emit", serial: "emitSerial", decision: "decide" };
+    if (expected[topic.mode] !== verb) {
+      throw new Error(`[stitchkit] event bus: "${event}" is declared with mode '${topic.mode}', so it is delivered with ${expected[topic.mode]}(), not ${verb}().`);
+    }
+    return topic;
+  }
+  function planned(event) {
+    const set = subscriptions.get(event) ?? new Set;
+    return { set, subs: [...set] };
+  }
+  function report(error, event) {
+    options.onListenerError?.(error, event);
+  }
+  return {
+    emit(event, data) {
+      declarationFor(event, "emit");
+      const { set, subs } = planned(event);
+      for (const sub of subs) {
+        if (!set.has(sub))
+          continue;
+        if (sub.once)
+          set.delete(sub);
+        try {
+          const result = sub.fn(data);
+          if (result instanceof Promise)
+            result.catch((err) => report(err, event));
+        } catch (err) {
+          report(err, event);
+        }
+      }
+    },
+    async emitSerial(event, data) {
+      const topic = declarationFor(event, "emitSerial");
+      const timeoutMs = topic?.listenerTimeoutMs ?? 0;
+      const { set, subs } = planned(event);
+      for (const sub of subs) {
+        if (!set.has(sub))
+          continue;
+        if (sub.once)
+          set.delete(sub);
+        try {
+          const outcome = await withDeadline(sub.fn(data), timeoutMs);
+          if (!outcome.settled) {
+            report(new Error(`listener did not settle within ${timeoutMs}ms`), event);
+          }
+        } catch (err) {
+          report(err, event);
+        }
+      }
+    },
+    async decide(event, data) {
+      const topic = declarationFor(event, "decide");
+      const timeoutMs = topic?.listenerTimeoutMs ?? 0;
+      const undecided = topic?.whenAllDefer ?? "deny";
+      const { set, subs } = planned(event);
+      let allowed = false;
+      for (const sub of subs) {
+        if (!set.has(sub))
+          continue;
+        if (sub.once)
+          set.delete(sub);
+        let vote;
+        try {
+          const outcome = await withDeadline(sub.fn(data), timeoutMs);
+          if (!outcome.settled) {
+            vote = { outcome: "deny", reason: `listener did not vote within ${timeoutMs}ms` };
+          } else if (isDecision(outcome.value)) {
+            vote = outcome.value;
+          } else {
+            vote = {
+              outcome: "deny",
+              reason: 'listener returned no decision — a decision listener returns { outcome: "allow" | "deny" | "defer" }'
+            };
+          }
+        } catch (err) {
+          vote = {
+            outcome: "deny",
+            reason: err instanceof Error ? `listener threw: ${err.message}` : "listener threw"
+          };
+        }
+        if (vote.outcome === "deny") {
+          report(new Error(vote.reason), event);
+          return vote;
+        }
+        if (vote.outcome === "allow")
+          allowed = true;
+      }
+      if (allowed)
+        return { outcome: "allow" };
+      return undecided === "allow" ? { outcome: "allow" } : { outcome: "deny", reason: "no listener claimed this event" };
+    },
+    on(event, handler) {
+      return add(event, handler, false);
+    },
+    once(event, handler) {
+      return add(event, handler, true);
+    },
+    off(event, handler) {
+      const set = subscriptions.get(event);
+      if (!set)
+        return;
+      for (const sub of set) {
+        if (sub.fn === handler)
+          set.delete(sub);
+      }
+    },
+    clear() {
+      subscriptions.clear();
+    }
+  };
+}
+// src/server/file.ts
+import { readFile as readFile2, stat as stat2 } from "node:fs/promises";
+import { resolve } from "node:path";
+
+// src/server/mime.ts
+import { extname } from "node:path";
+var MIME_BY_EXT = {
+  ".html": "text/html; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".avif": "image/avif",
+  ".ico": "image/x-icon",
+  ".woff2": "font/woff2",
+  ".txt": "text/plain; charset=utf-8",
+  ".wasm": "application/wasm",
+  ".mp4": "video/mp4",
+  ".webm": "video/webm",
+  ".mov": "video/quicktime",
+  ".ogv": "video/ogg",
+  ".mp3": "audio/mpeg",
+  ".m4a": "audio/mp4",
+  ".wav": "audio/wav",
+  ".flac": "audio/flac",
+  ".oga": "audio/ogg",
+  ".ogg": "audio/ogg",
+  ".pdf": "application/pdf",
+  ".zip": "application/zip"
+};
+function mimeForPath(path) {
+  return MIME_BY_EXT[extname(path).toLowerCase()] ?? "application/octet-stream";
+}
+
+// src/server/file.ts
+function staticRoute(prefix, dir) {
+  const cleanPrefix = prefix.replace(/\/+$/, "");
+  const root = resolve(dir.replace(/\/+$/, ""));
+  return {
+    method: "GET",
+    path: `${cleanPrefix}/*filePath`,
+    handler: async (req) => {
+      const pathname = new URL(req.url).pathname;
+      let rel;
+      try {
+        rel = decodeURIComponent(pathname.slice(cleanPrefix.length)).replace(/^\/+/, "");
+      } catch {
+        return new Response("Bad request", { status: 400 });
+      }
+      const target = resolve(root, rel);
+      if (!isWithinDir(root, target))
+        return new Response("Forbidden", { status: 403 });
+      const realTarget = await realPathWithinDir(root, target);
+      if (realTarget === null)
+        return new Response("Not found", { status: 404 });
+      const info = await stat2(realTarget).catch(() => null);
+      if (!info?.isFile())
+        return new Response("Not found", { status: 404 });
+      return new Response(await readFile2(realTarget), {
+        headers: {
+          "Content-Type": mimeForPath(realTarget),
+          "X-Content-Type-Options": "nosniff"
+        }
+      });
+    }
+  };
+}
+function parseByteRange(header, size) {
+  if (!header)
+    return null;
+  const match = /^bytes=(.+)$/.exec(header.trim());
+  const rawSpec = match?.[1];
+  if (rawSpec === undefined)
+    return null;
+  const spec = rawSpec.trim();
+  if (spec.includes(","))
+    return null;
+  const dash = spec.indexOf("-");
+  if (dash === -1)
+    return null;
+  const startStr = spec.slice(0, dash).trim();
+  const endStr = spec.slice(dash + 1).trim();
+  if (startStr === "") {
+    if (!/^\d+$/.test(endStr))
+      return null;
+    const suffix = Number(endStr);
+    if (suffix === 0 || size === 0)
+      return "unsatisfiable";
+    return { start: Math.max(0, size - suffix), end: size - 1 };
+  }
+  if (!/^\d+$/.test(startStr))
+    return null;
+  const start = Number(startStr);
+  if (size === 0 || start >= size)
+    return "unsatisfiable";
+  if (endStr === "")
+    return { start, end: size - 1 };
+  if (!/^\d+$/.test(endStr))
+    return null;
+  const end = Number(endStr);
+  if (end < start)
+    return null;
+  return { start, end: end >= size ? size - 1 : end };
+}
+function weakETag(size, mtimeMs) {
+  return `W/"${size.toString(16)}-${Math.floor(mtimeMs).toString(16)}"`;
+}
+function leSeconds(aMs, bMs) {
+  return Math.floor(aMs / 1000) <= Math.floor(bMs / 1000);
+}
+function isNotModified(req, v) {
+  const inm = req.headers.get("if-none-match");
+  if (inm !== null) {
+    const value = inm.trim();
+    if (value === "*")
+      return true;
+    if (v.etag === undefined)
+      return false;
+    return value.split(",").map((t) => t.trim()).includes(v.etag);
+  }
+  const ims = req.headers.get("if-modified-since");
+  if (ims !== null) {
+    if (v.lastModifiedMs === undefined)
+      return false;
+    const since = Date.parse(ims);
+    if (Number.isNaN(since))
+      return false;
+    return leSeconds(v.lastModifiedMs, since);
+  }
+  return false;
+}
+function ifRangeMatches(req, v) {
+  const ir = req.headers.get("if-range");
+  if (ir === null)
+    return true;
+  const value = ir.trim();
+  if (v.etag !== undefined && value === v.etag)
+    return true;
+  if (v.lastModifiedMs !== undefined) {
+    const asDate = Date.parse(value);
+    if (!Number.isNaN(asDate))
+      return leSeconds(v.lastModifiedMs, asDate);
+  }
+  return false;
+}
+function asciiFilename(filename) {
+  let out = "";
+  for (let i = 0;i < filename.length; i++) {
+    const code = filename.charCodeAt(i);
+    out += code >= 32 && code < 127 && code !== 34 && code !== 92 ? filename.charAt(i) : "_";
+  }
+  return out;
+}
+function contentDisposition(disposition, filename) {
+  return `${disposition}; filename="${asciiFilename(filename)}"; filename*=UTF-8''${encodeURIComponent(filename)}`;
+}
+async function serveFile(req, opts) {
+  if (req.method !== "GET" && req.method !== "HEAD") {
+    return new Response("Method not allowed", {
+      status: 405,
+      headers: { Allow: "GET, HEAD" }
+    });
+  }
+  const file = Bun.file(opts.path);
+  if (!await file.exists()) {
+    return new Response("Not found", { status: 404 });
+  }
+  const size = file.size;
+  const mtimeMs = file.lastModified;
+  const contentType = opts.contentType ?? mimeForPath(opts.path);
+  const useEtag = opts.etag !== false;
+  const useLastModified = opts.lastModified !== false;
+  const etag = useEtag ? weakETag(size, mtimeMs) : undefined;
+  const validators = {
+    etag,
+    lastModifiedMs: useLastModified ? mtimeMs : undefined
+  };
+  const isHead = req.method === "HEAD";
+  const base = new Headers;
+  base.set("Accept-Ranges", "bytes");
+  base.set("X-Content-Type-Options", "nosniff");
+  if (etag)
+    base.set("ETag", etag);
+  if (useLastModified)
+    base.set("Last-Modified", new Date(mtimeMs).toUTCString());
+  if (opts.cacheControl)
+    base.set("Cache-Control", opts.cacheControl);
+  if (opts.filename) {
+    base.set("Content-Disposition", contentDisposition(opts.disposition ?? "inline", opts.filename));
+  } else if (opts.disposition) {
+    base.set("Content-Disposition", opts.disposition);
+  }
+  if ((useEtag || useLastModified) && isNotModified(req, validators)) {
+    return new Response(null, { status: 304, headers: base });
+  }
+  const rangeHeader = req.headers.get("range");
+  const range = rangeHeader !== null && ifRangeMatches(req, validators) ? parseByteRange(rangeHeader, size) : null;
+  if (range === "unsatisfiable") {
+    base.set("Content-Range", `bytes */${size}`);
+    base.set("Content-Type", contentType);
+    return new Response(null, { status: 416, headers: base });
+  }
+  if (range) {
+    const length = range.end - range.start + 1;
+    base.set("Content-Type", contentType);
+    base.set("Content-Range", `bytes ${range.start}-${range.end}/${size}`);
+    base.set("Content-Length", String(length));
+    const body = isHead ? null : file.slice(range.start, range.end + 1);
+    return new Response(body, { status: 206, headers: base });
+  }
+  base.set("Content-Type", contentType);
+  base.set("Content-Length", String(size));
+  return new Response(isHead ? null : file, { status: 200, headers: base });
+}
+// src/server/lifecycle.ts
+function composeLifecycleHooks(...hooks) {
+  return {
+    onRequest: async (request) => {
+      for (const hook of hooks) {
+        const response = await hook?.onRequest?.(request);
+        if (response instanceof Response)
+          return response;
+      }
+      return;
+    },
+    authorize: async (ctx, endpoint) => {
+      for (const hook of hooks)
+        await hook?.authorize?.(ctx, endpoint);
+    },
+    beforeHandle: async (ctx, endpoint) => {
+      for (const hook of hooks)
+        await hook?.beforeHandle?.(ctx, endpoint);
+    },
+    afterHandle: async (ctx, result, endpoint) => {
+      let current = result;
+      for (const hook of hooks) {
+        const transformed = await hook?.afterHandle?.(ctx, current, endpoint);
+        if (transformed !== undefined)
+          current = transformed;
+      }
+      return current;
+    },
+    onError: async (ctx, error, endpoint) => {
+      for (const hook of hooks) {
+        const response = await hook?.onError?.(ctx, error, endpoint);
+        if (response instanceof Response)
+          return response;
+      }
+      return;
+    }
+  };
+}
+// src/server/middleware/cookies.ts
+function parseCookieHeader(header) {
+  if (!header)
+    return [];
+  const pairs = [];
+  for (const pair of header.split(";")) {
+    const eq = pair.indexOf("=");
+    if (eq === -1)
+      continue;
+    const key = pair.slice(0, eq).trim();
+    if (!key)
+      continue;
+    const raw = pair.slice(eq + 1).trim();
+    let value = raw;
+    try {
+      value = decodeURIComponent(raw);
+    } catch {}
+    pairs.push([key, value]);
+  }
+  return pairs;
+}
+function parseCookies(header) {
+  const cookies = {};
+  for (const [key, value] of parseCookieHeader(header)) {
+    if (isUnsafeKey(key))
+      continue;
+    cookies[key] = value;
+  }
+  return cookies;
+}
+function serializeCookie(name, value, opts = {}) {
+  let cookie = `${name}=${encodeURIComponent(value)}`;
+  if (opts.maxAge !== undefined)
+    cookie += `; Max-Age=${opts.maxAge}`;
+  if (opts.path)
+    cookie += `; Path=${opts.path}`;
+  if (opts.domain)
+    cookie += `; Domain=${opts.domain}`;
+  if (opts.secure)
+    cookie += "; Secure";
+  if (opts.httpOnly)
+    cookie += "; HttpOnly";
+  if (opts.sameSite)
+    cookie += `; SameSite=${opts.sameSite}`;
+  return cookie;
+}
+function defineCookie(config) {
+  const { name, duplicates = "last", ...options } = config;
+  const getAll = (req) => parseCookieHeader(req.headers.get("cookie")).flatMap(([key, value]) => key === name ? [value] : []);
+  return {
+    get(req) {
+      const values = getAll(req);
+      if (values.length === 0)
+        return;
+      if (duplicates === "first")
+        return values[0];
+      if (duplicates === "reject") {
+        return new Set(values).size === 1 ? values[0] : undefined;
+      }
+      return values[values.length - 1];
+    },
+    getAll,
+    set(value) {
+      return serializeCookie(name, value, options);
+    },
+    clear() {
+      return serializeCookie(name, "", { ...options, maxAge: 0 });
+    }
+  };
+}
+
+// src/server/middleware/auth.ts
+function extractToken(req, cookieName) {
+  const authHeader = req.headers.get("authorization");
+  if (authHeader?.startsWith("Bearer "))
+    return authHeader.slice(7);
+  if (cookieName) {
+    const cookies = parseCookies(req.headers.get("cookie"));
+    return cookies[cookieName] ?? null;
+  }
+  return null;
+}
+function isThenable(value) {
+  try {
+    return "then" in value && typeof value.then === "function";
+  } catch {
+    return false;
+  }
+}
+var scopedAuthHookBrand = Symbol("stitchkit.scoped-auth-hook");
+var authOwnershipPlans = new WeakMap;
+function createShadowContext(ctx) {
+  const shadow = {
+    params: ctx.params,
+    input: ctx.input,
+    source: ctx.source
+  };
+  Object.defineProperties(shadow, Object.getOwnPropertyDescriptors(ctx));
+  return shadow;
+}
+function createAuthHook(config) {
+  const onAnonymous = config.onAnonymous ?? (() => unauthorized());
+  const onForbidden = config.onForbidden ?? (() => forbidden());
+  async function auth(ctx, endpoint) {
+    const identity = ctx.source === "http" ? await config.resolve(ctx) : await config.resolveFromContext?.(ctx) ?? null;
+    config.inject?.(ctx, identity);
+    const scope = endpoint.scope ?? config.defaultScope;
+    if (!scope)
+      return;
+    const entry = Object.hasOwn(config.rules, scope) ? config.rules[scope] : undefined;
+    if (!entry) {
+      throw new Error(`[stitchkit] auth: no rule for scope "${scope}"`);
+    }
+    const rule = typeof entry === "object" ? entry.rule : entry;
+    if (typeof entry === "object" && entry.inject && identity !== null) {
+      const fields = entry.inject(identity, ctx);
+      if (typeof fields === "object" && fields !== null && isThenable(fields)) {
+        throw new Error(`[stitchkit] auth: the inject of scope "${scope}" must be synchronous — an async inject merges a Promise, not fields`);
+      }
+      mergeContextContribution(ctx, fields, scope);
+    }
+    if (rule === "public")
+      return;
+    if (!identity) {
+      onAnonymous();
+      return;
+    }
+    if (rule === "authenticated")
+      return;
+    const result = await rule(identity, ctx);
+    if (result === false) {
+      onForbidden();
+      return;
+    }
+    if (result === true)
+      return;
+    mergeContextContribution(ctx, result, scope);
+  }
+  auth[scopedAuthHookBrand] = () => {
+    return;
+  };
+  authOwnershipPlans.set(auth, {
+    defaultScope: config.defaultScope,
+    hook: auth,
+    scopes: new Set(Object.keys(config.rules))
+  });
+  return auth;
+}
+function composeAuthHooks(config) {
+  const plans = [];
+  for (const hook of config.hooks) {
+    const plan = authOwnershipPlans.get(hook);
+    if (!plan) {
+      throw new TypeError("[stitchkit] auth: composeAuthHooks accepts only hooks created by createAuthHook or composeAuthHooks");
+    }
+    if (plan.defaultScope !== undefined && plan.defaultScope !== config.defaultScope) {
+      throw new TypeError(`[stitchkit] auth: child default scope ${JSON.stringify(plan.defaultScope)} must match the composite default scope`);
+    }
+    plans.push(plan);
+  }
+  const defaultScope = config.defaultScope;
+  if (defaultScope !== undefined && !plans.some((plan) => plan.scopes.has(defaultScope))) {
+    throw new TypeError(`[stitchkit] auth: composite default scope ${JSON.stringify(defaultScope)} has no owner`);
+  }
+  const ownedScopes = new Set;
+  for (const plan of plans) {
+    for (const scope of plan.scopes)
+      ownedScopes.add(scope);
+  }
+  async function composed(ctx, endpoint) {
+    const scope = endpoint.scope ?? config.defaultScope;
+    if (!scope)
+      return;
+    const owners = plans.filter((plan) => plan.scopes.has(scope));
+    if (owners.length === 0) {
+      throw new Error(`[stitchkit] auth: no rule for scope "${scope}"`);
+    }
+    const scopedEndpoint = { ...endpoint, scope };
+    const contribution = Object.create(null);
+    const contributionOwners = new Set;
+    for (const owner of owners) {
+      ctx.signal?.throwIfAborted();
+      const shadow = createShadowContext(ctx);
+      await owner.hook(shadow, scopedEndpoint);
+      const ownerContribution = prepareContextContribution(contextContributionDelta(ctx, shadow, scope), scope);
+      for (const key of Object.keys(ownerContribution)) {
+        if (contributionOwners.has(key)) {
+          throw new TypeError(`[stitchkit] auth: multiple owners contributed context key ${JSON.stringify(key)} for scope ${JSON.stringify(scope)}`);
+        }
+        contributionOwners.add(key);
+      }
+      Object.assign(contribution, ownerContribution);
+    }
+    ctx.signal?.throwIfAborted();
+    mergeContextContribution(ctx, contribution, scope);
+  }
+  composed[scopedAuthHookBrand] = () => {
+    return;
+  };
+  authOwnershipPlans.set(composed, {
+    defaultScope: config.defaultScope,
+    hook: composed,
+    scopes: ownedScopes
+  });
+  return composed;
+}
+function createBearerResolver(config) {
+  return async (req) => {
+    const token = extractToken(req);
+    if (!token)
+      return null;
+    return config.lookup(token, req);
+  };
+}
+// src/server/middleware/trust-fence.ts
+var DEFAULT_PORTS = new Set(["80", "443"]);
+function readAuthority(value) {
+  if (value.includes("*"))
+    return;
+  const match = /^(\[[^\]]+\]|[^:[\]]+)(?::(\d{1,5}))?$/.exec(value.trim());
+  if (!match?.[1])
+    return;
+  const port = match[2] ?? null;
+  if (port !== null) {
+    const numeric = Number(port);
+    if (numeric < 1 || numeric > 65535)
+      return;
+  }
+  let url;
+  try {
+    url = new URL(`http://${match[1]}`);
+  } catch {
+    return;
+  }
+  if (url.pathname !== "/" || url.search !== "" || url.username !== "" || url.hostname === "") {
+    return;
+  }
+  return { hostname: url.hostname, port };
+}
+function comparablePort(port) {
+  return port === null || DEFAULT_PORTS.has(port) ? null : port;
+}
+function isLoopbackAddress(address) {
+  if (address === "")
+    return false;
+  const bare = address.replace(/^\[|\]$/g, "").replace(/^::ffff:/i, "");
+  if (bare === "::1")
+    return true;
+  const octets = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(bare);
+  return octets?.[1] === "127";
+}
+function createTrustFence(config) {
+  if (config.trustedHosts.length === 0) {
+    throw new Error("[stitchkit] trust fence: `trustedHosts` cannot be empty — a fence that trusts nothing refuses every request, which is never what a running server wants. List the authorities this server answers on.");
+  }
+  const trusted = [];
+  for (const entry of config.trustedHosts) {
+    const authority = readAuthority(entry);
+    if (!authority) {
+      throw new Error(`[stitchkit] trust fence: "${entry}" is not an authority. An entry is \`host\` or \`host:port\` — no scheme, no path, no credentials, no wildcard. An entry that cannot be read back as a canonical authority is refused here rather than quietly matching nothing.`);
+    }
+    trusted.push(authority);
+  }
+  const trustedOrigins = [];
+  for (const entry of config.trustedOrigins ?? []) {
+    const authority = readAuthority(entry);
+    if (!authority) {
+      throw new Error(`[stitchkit] trust fence: trustedOrigins entry "${entry}" is not an authority. An entry is \`host\` or \`host:port\` — no scheme, no path, no wildcard, the same form as trustedHosts.`);
+    }
+    trustedOrigins.push(authority);
+  }
+  function refuse(refusal) {
+    config.onRefused?.(refusal);
+    config.logger?.warn?.("[stitchkit] trust fence refused a request", {
+      reason: refusal.reason,
+      lane: refusal.lane,
+      host: refusal.host,
+      origin: refusal.origin
+    });
+    return refusal;
+  }
+  function check(request, lane) {
+    const host = request.headers.get("host");
+    const origin = request.headers.get("origin");
+    const site = request.headers.get("sec-fetch-site");
+    if (host === null) {
+      return refuse({ reason: "missing-host", lane, host, origin, site });
+    }
+    const requested = readAuthority(host);
+    if (!requested) {
+      return refuse({ reason: "untrusted-host", lane, host, origin, site });
+    }
+    const matched = trusted.some((entry) => entry.hostname === requested.hostname && (entry.port === null || entry.port === requested.port));
+    if (!matched) {
+      return refuse({ reason: "untrusted-host", lane, host, origin, site });
+    }
+    if (site === "cross-site") {
+      return refuse({ reason: "cross-site", lane, host, origin, site });
+    }
+    if (origin !== null && origin !== "null") {
+      let originAuthority;
+      try {
+        const parsed = new URL(origin);
+        originAuthority = { hostname: parsed.hostname, port: parsed.port || null };
+      } catch {
+        originAuthority = undefined;
+      }
+      const sameAuthority = originAuthority !== undefined && originAuthority.hostname === requested.hostname && comparablePort(originAuthority.port) === comparablePort(requested.port);
+      const declared = originAuthority !== undefined && trustedOrigins.some((entry) => entry.hostname === originAuthority.hostname && (entry.port === null || entry.port === originAuthority.port));
+      const agrees = sameAuthority || declared;
+      if (!agrees) {
+        return refuse({ reason: "origin-mismatch", lane, host, origin, site });
+      }
+    }
+    return;
+  }
+  return {
+    hooks: {
+      onRequest: (request) => check(request, "http") === undefined ? undefined : new Response(null, { status: 403 })
+    },
+    allowRequest: (request) => check(request, "socket") === undefined,
+    check
+  };
+}
+// src/server/openapi.ts
+var ERROR_ENVELOPE_SCHEMA = {
+  type: "object",
+  properties: {
+    error: {
+      type: "object",
+      properties: {
+        code: { type: "string" },
+        message: { type: "string" },
+        details: {},
+        hint: { type: "string" }
+      },
+      required: ["code"]
+    }
+  },
+  required: ["error"]
+};
+function toOpenApiPath(path) {
+  return path.replace(/:([^/]+)/g, "{$1}");
+}
+function safeJson(schema, io) {
+  if (!schema)
+    return {};
+  try {
+    return toJsonSchema(schema, io, "any");
+  } catch {
+    return {};
+  }
+}
+function errorResponse(description) {
+  return {
+    description,
+    content: { "application/json": { schema: ERROR_ENVELOPE_SCHEMA } }
+  };
+}
+function errorResponses(scope) {
+  const responses = {
+    "400": errorResponse("Validation error"),
+    "500": errorResponse("Server error")
+  };
+  if (scope && scope !== "public") {
+    responses["401"] = errorResponse("Unauthorized");
+    responses["403"] = errorResponse("Forbidden");
+  }
+  return responses;
+}
+function generateOpenApiDocument(config) {
+  const groups = [
+    ...(config.services ?? []).map((service) => ({ pathPrefix: undefined, service })),
+    ...(config.groups ?? []).flatMap((group) => group.services.map((service) => ({ pathPrefix: group.pathPrefix, service })))
+  ];
+  const paths = {};
+  for (const { pathPrefix, service } of groups) {
+    for (const [key, method] of Object.entries(service.methods)) {
+      if (method.expose && !method.expose.includes("HTTP"))
+        continue;
+      if (config.includeMethod && !config.includeMethod(method))
+        continue;
+      const servicePath = joinRoutePath("/", service.prefix, method.path === "/" ? "" : method.path);
+      const fullPath = toOpenApiPath(pathPrefix ? joinRoutePath(pathPrefix, servicePath) : servicePath);
+      const parameters = [];
+      const trailingWildcard = parseTrailingWildcard(fullPath);
+      let wildcardSchema = { type: "string" };
+      for (const field of jsonSchemaFields(safeJson(method.paramsSchema, "input"))) {
+        if (trailingWildcard && field.name === trailingWildcard.name) {
+          wildcardSchema = field.schema;
+          continue;
+        }
+        parameters.push({
+          name: field.name,
+          in: "path",
+          required: true,
+          schema: field.schema,
+          ...field.description && { description: field.description }
+        });
+      }
+      const inputInQuery = inputIsQuery(method.method);
+      if (inputInQuery && method.inputSchema) {
+        for (const field of jsonSchemaFields(safeJson(method.inputSchema, "input"))) {
+          parameters.push({
+            name: field.name,
+            in: "query",
+            required: field.required,
+            schema: field.schema,
+            ...field.description && { description: field.description }
+          });
+        }
+      }
+      const responses = { ...errorResponses(method.scope) };
+      if (method.rawResponse) {
+        responses["200"] = method.method === "HEAD" ? { description: "Headers only" } : {
+          description: "Success",
+          content: {
+            [method.contentType ?? "application/octet-stream"]: {
+              schema: { type: "string", format: "binary" }
+            }
+          }
+        };
+      } else if (method.stream) {
+        const mediaType = method.stream.format === "sse" ? "text/event-stream" : "application/x-ndjson";
+        responses["200"] = {
+          description: "Validated streaming response",
+          content: {
+            [mediaType]: {
+              schema: { type: "string" },
+              "x-stitchkit-item-schema": safeJson(method.stream.item, "output"),
+              "x-stitchkit-max-frame-bytes": method.stream.maxFrameBytes ?? DEFAULT_CONTRACT_STREAM_FRAME_BYTES,
+              "x-stitchkit-terminal-required": Boolean(method.stream.terminal),
+              "x-stitchkit-stream-framing": method.stream.framing ?? "envelope",
+              "x-stitchkit-stream-completion": method.stream.completion ?? "stream-end",
+              "x-stitchkit-final-line": method.stream.finalLine ?? "allow"
+            }
+          }
+        };
+      } else if (method.outputSchema) {
+        responses[String(method.responseMeta?.status ?? 200)] = {
+          description: "Success",
+          content: { "application/json": { schema: safeJson(method.outputSchema, "output") } }
+        };
+      } else {
+        responses[String(method.responseMeta?.status ?? 204)] = { description: "No content" };
+      }
+      const operation = {
+        summary: method.desc,
+        operationId: `${service.name}_${key}`,
+        "x-stitchkit-scope": method.scope,
+        "x-stitchkit-has-input": Boolean(method.inputSchema),
+        "x-stitchkit-has-output": Boolean(method.outputSchema || method.stream),
+        ...method.stream && { "x-stitchkit-stream": true },
+        ...parameters.length > 0 && { parameters },
+        responses
+      };
+      if (trailingWildcard) {
+        operation["x-stitchkit-trailing-wildcard"] = {
+          parameter: trailingWildcard.name,
+          required: true,
+          schema: wildcardSchema,
+          description: `Matches zero or more trailing path segments and exposes their '/'-joined remainder as params.${trailingWildcard.name}.`
+        };
+      }
+      if (!inputInQuery && (method.inputSchema || method.multipart)) {
+        if (method.multipart) {
+          const inputJson = safeJson(method.inputSchema, "input");
+          const baseProps = isRecord(inputJson.properties) ? inputJson.properties : {};
+          const baseRequired = Array.isArray(inputJson.required) ? inputJson.required : [];
+          const fileProperties = {};
+          const requiredFiles = [];
+          for (const [field, policy] of Object.entries(method.multipart.files)) {
+            const binary = {
+              type: "string",
+              format: "binary",
+              ...policy.maxBytes !== undefined && { maxLength: policy.maxBytes },
+              ...policy.contentTypes !== undefined && {
+                "x-accepted-content-types": policy.contentTypes
+              }
+            };
+            fileProperties[field] = policy.multiple === true ? {
+              type: "array",
+              items: binary,
+              minItems: policy.required === false ? 0 : 1,
+              ...policy.maxFiles !== undefined && { maxItems: policy.maxFiles }
+            } : binary;
+            if (policy.required !== false)
+              requiredFiles.push(field);
+          }
+          operation.requestBody = {
+            required: baseRequired.length > 0 || requiredFiles.length > 0,
+            content: {
+              "multipart/form-data": {
+                schema: {
+                  type: "object",
+                  properties: {
+                    ...baseProps,
+                    ...fileProperties
+                  },
+                  required: [...baseRequired, ...requiredFiles]
+                }
+              }
+            }
+          };
+        } else if (method.inputSchema) {
+          const required = jsonSchemaFields(safeJson(method.inputSchema, "input")).some((f) => f.required);
+          const schema = safeJson(method.inputSchema, "input");
+          operation.requestBody = {
+            required,
+            content: method.safelistedBody ? { "application/json": { schema }, "text/plain": { schema } } : { "application/json": { schema } }
+          };
+        }
+      }
+      const pathItem = paths[fullPath] ?? {};
+      pathItem[method.method.toLowerCase()] = operation;
+      paths[fullPath] = pathItem;
+    }
+  }
+  return {
+    openapi: "3.1.0",
+    info: config.info,
+    ...config.servers && { servers: config.servers },
+    paths
+  };
+}
+function openApiRoute(path, document) {
+  return {
+    method: "GET",
+    path,
+    handler: () => Response.json(document)
+  };
+}
+// src/server/rate-limit.ts
+function refillBucket(entry, config, now) {
+  const elapsed = (now - entry.lastRefill) / 1000;
+  entry.tokens = Math.min(config.max, entry.tokens + elapsed / config.window * config.max);
+  entry.lastRefill = now;
+}
+var MAX_BUCKETS = 1e5;
+function createRateLimiter() {
+  const { store: buckets, destroy } = createSweptMap({
+    intervalMs: 60000,
+    isExpired: (entry, now) => now - entry.lastRefill > 300000
+  });
+  return {
+    destroy,
+    check(key, config) {
+      const now = Date.now();
+      const entry = buckets.get(key);
+      if (entry) {
+        buckets.delete(key);
+        buckets.set(key, entry);
+        refillBucket(entry, config, now);
+        if (entry.tokens < 1)
+          return false;
+        entry.tokens -= 1;
+        return true;
+      }
+      if (buckets.size >= MAX_BUCKETS) {
+        const lru = buckets.keys().next().value;
+        if (lru !== undefined)
+          buckets.delete(lru);
+      }
+      const fresh = { tokens: config.max, lastRefill: now };
+      buckets.set(key, fresh);
+      if (fresh.tokens < 1)
+        return false;
+      fresh.tokens -= 1;
+      return true;
+    },
+    remaining(key, config) {
+      const entry = buckets.get(key);
+      if (!entry)
+        return config.max;
+      refillBucket(entry, config, Date.now());
+      return Math.floor(entry.tokens);
+    }
+  };
+}
+// src/server/raw.ts
+function respondJson(data) {
+  if (data === null || data === undefined)
+    return new Response(null, { status: 204 });
+  return Response.json(data);
+}
+function errorResponse2(error) {
+  const appErr = normalizeError(error);
+  const res = Response.json(appErr.toJSON(), { status: appErr.status });
+  const traceId = getTraceId();
+  if (traceId)
+    res.headers.set("x-request-id", traceId);
+  return res;
+}
+async function parseBody(req, schema) {
+  const raw = await req.json().catch(() => null);
+  if (raw === null)
+    return null;
+  const parsed = schema.safeParse(raw);
+  return parsed.success ? parsed.data : null;
+}
+// src/server/release-signal.ts
+function bindReleaseRefreshSignal(marker, options = {}) {
+  const signal = options.signal ?? "SIGUSR2";
+  const source = options.source ?? process;
+  const handler = () => {
+    try {
+      options.onRefresh?.(marker.refresh());
+    } catch (error) {
+      try {
+        options.onError?.(error);
+      } catch {}
+    }
+  };
+  source.on(signal, handler);
+  return () => source.off(signal, handler);
+}
+// src/server/stream.ts
+function streamSSE(generator) {
+  const encoder = new TextEncoder;
+  let cancelled = false;
+  const stream = new ReadableStream({
+    async start(controller) {
+      try {
+        for await (const chunk of generator) {
+          if (cancelled)
+            return;
+          const data = JSON.stringify(chunk);
+          controller.enqueue(encoder.encode(`data: ${data}
+
+`));
+        }
+        if (cancelled)
+          return;
+        controller.enqueue(encoder.encode(`data: [DONE]
+
+`));
+        controller.close();
+      } catch (err) {
+        if (cancelled)
+          return;
+        const envelope = normalizeError(err).toJSON();
+        controller.enqueue(encoder.encode(`data: ${JSON.stringify(envelope)}
+
+`));
+        controller.close();
+      }
+    },
+    cancel() {
+      cancelled = true;
+      generator.return(undefined).catch(() => {
+        return;
+      });
+    }
+  });
+  return new Response(stream, {
+    headers: {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache",
+      Connection: "keep-alive"
+    }
+  });
+}
+export {
+  zodIssues,
+  webSocketLane,
+  weakETag,
+  verifyPkce,
+  verifyJwt,
+  unauthorized,
+  streamingRoute,
+  streamSSE,
+  staticRoute,
+  sseRoute,
+  socketIoLane,
+  signJwt,
+  serveFile,
+  serializeCookie,
+  respondJson,
+  resolveTraceId,
+  resolveSocketIp,
+  rateLimited,
+  parseMultipart,
+  parseCookies,
+  parseCookieHeader,
+  parseByteRange,
+  parseBody,
+  openApiRoute,
+  notFound,
+  normalizeError,
+  ndjsonRoute,
+  isWithinDir,
+  isStitchErrorCode,
+  isPublicIp,
+  isLoopbackAddress,
+  implementRegistry,
+  implement,
+  getClientInfo,
+  generateTraceId,
+  generateOpenApiDocument,
+  formatZodError,
+  forbidden,
+  extractToken,
+  extractIp,
+  errorResponse2 as errorResponse,
+  errorCode,
+  deriveCodeChallenge,
+  defineMultipartStream,
+  defineCookie,
+  createUnixClientTransport,
+  createTrustFence,
+  createSocketIOServer,
+  createServer,
+  createScopedImplementRegistry,
+  createScopedImplement,
+  createRateLimiter,
+  createMultipartStream,
+  createImplementRegistry,
+  createImplement,
+  createHandler,
+  createFileStateStore,
+  createEventBus,
+  createErrorHook,
+  createCache,
+  createBearerResolver,
+  createAuthHook,
+  corsPreflightResponse,
+  corsHeaders,
+  conflict,
+  composeWebSocketHandlers,
+  composeLifecycleHooks,
+  composeAuthHooks,
+  cacheHeaders,
+  bindSocketRegistry,
+  bindReleaseRefreshSignal,
+  bindRealtimeServer,
+  bindProcessSignals,
+  badRequest,
+  appError,
+  UnixClientTransportError,
+  ShutdownStatusSchema,
+  ShutdownStateSchema,
+  ShutdownResultSchema,
+  ShutdownOptionsSchema,
+  STITCH_ERROR_STATUS,
+  DEFAULT_STREAM_HEARTBEAT_MS,
+  DEFAULT_CORS_EXPOSE_HEADERS,
+  DEFAULT_CORS_ALLOW_HEADERS,
+  AppError
+};