stitchkit 0.93.0 → 0.94.1

package/dist/index-2gxzjvyr.js

@@ -0,0 +1,266 @@
+import {
+  contractMethodFields
+} from "./index-2bxbyab0.js";
+import {
+  AppError
+} from "./index-2vtcmrj9.js";
+import {
+  callRuntimeHandler,
+  typedEntries
+} from "./index-hffjpmq9.js";
+
+// src/server/middleware/cors.ts
+var DEFAULT_CORS_ALLOW_HEADERS = "Content-Type, Authorization, X-Trace-Id, traceparent, tracestate";
+var DEFAULT_CORS_EXPOSE_HEADERS = "Content-Disposition, Content-Length, Content-Range, Accept-Ranges, ETag, Last-Modified, X-Request-Id, X-Build-Id";
+function assertCorsConfig(config) {
+  if (config.credentials && (config.origin === undefined || config.origin === "*")) {
+    throw new Error("[stitchkit] cors: `credentials: true` cannot be combined with a wildcard origin. " + "Set `origin` to an explicit string or list.");
+  }
+  if (config.origin === undefined) {
+    throw new Error("[stitchkit] cors: `origin` is required. Pass an explicit origin (or list), or '*' to deliberately allow every origin — omit `cors` entirely to emit no CORS headers.");
+  }
+  if (Array.isArray(config.origin) && config.origin.length === 0) {
+    throw new Error("[stitchkit] cors: `origin` cannot be an empty list. Pass explicit origins, or '*' to deliberately allow every origin.");
+  }
+}
+function resolveOrigin(config, requestOrigin) {
+  if (config.origin === undefined)
+    return;
+  if (config.origin === "*") {
+    return "*";
+  }
+  if (Array.isArray(config.origin)) {
+    if (!requestOrigin)
+      return;
+    const lower = requestOrigin.toLowerCase();
+    return config.origin.some((o) => o.toLowerCase() === lower) ? requestOrigin : undefined;
+  }
+  return config.origin;
+}
+function isOriginAllowed(config, requestOrigin) {
+  if (!config || config.origin === undefined || config.origin === "*")
+    return false;
+  if (!requestOrigin || requestOrigin === "null")
+    return false;
+  const lower = requestOrigin.toLowerCase();
+  const allowed = Array.isArray(config.origin) ? config.origin : [config.origin];
+  return allowed.some((origin) => origin.toLowerCase() === lower);
+}
+function corsHeaders(config, requestOrigin) {
+  const allowOrigin = resolveOrigin(config, requestOrigin);
+  const headers = {
+    "Access-Control-Allow-Methods": config.methods ?? "GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS",
+    "Access-Control-Allow-Headers": config.headers ?? DEFAULT_CORS_ALLOW_HEADERS
+  };
+  const expose = Array.isArray(config.exposeHeaders) ? config.exposeHeaders.join(", ") : config.exposeHeaders ?? DEFAULT_CORS_EXPOSE_HEADERS;
+  if (expose !== "") {
+    headers["Access-Control-Expose-Headers"] = expose;
+  }
+  if (allowOrigin !== undefined) {
+    headers["Access-Control-Allow-Origin"] = allowOrigin;
+    if (config.credentials) {
+      headers["Access-Control-Allow-Credentials"] = "true";
+    }
+  }
+  if (Array.isArray(config.origin)) {
+    headers.Vary = "Origin";
+  }
+  return headers;
+}
+function corsPreflightResponse(config, req) {
+  return new Response(null, {
+    status: 204,
+    headers: corsHeaders(config, req.headers.get("origin"))
+  });
+}
+function requestCorsHeaders(cors, req) {
+  if (!cors)
+    return {};
+  return corsHeaders(cors, req.headers.get("origin"));
+}
+function applyCors(res, cors, req) {
+  const extra = requestCorsHeaders(cors, req);
+  if (Object.keys(extra).length === 0)
+    return res;
+  try {
+    for (const [key, value] of Object.entries(extra))
+      setCorsHeader(res.headers, key, value);
+    return res;
+  } catch {
+    const headers = new Headers(res.headers);
+    for (const [key, value] of Object.entries(extra))
+      setCorsHeader(headers, key, value);
+    return new Response(res.body, {
+      status: res.status,
+      statusText: res.statusText,
+      headers
+    });
+  }
+}
+function setCorsHeader(headers, key, value) {
+  if (key !== "Vary") {
+    headers.set(key, value);
+    return;
+  }
+  const existing = headers.get("Vary");
+  if (existing === null || existing.trim() === "") {
+    headers.set("Vary", value);
+    return;
+  }
+  const present = existing.split(",").some((field) => field.trim().toLowerCase() === "origin");
+  if (!present)
+    headers.set("Vary", `${existing}, ${value}`);
+}
+
+// src/server/implement.ts
+function isStreamingImplementation(value) {
+  return typeof value === "object" && value !== null && "kind" in value && value.kind === "stitchkit.multipart.stream";
+}
+function defineMultipartStream(endpoint, config) {
+  return buildMultipartStream(endpoint, config.files, config.handler);
+}
+function buildMultipartStream(endpoint, files, handler) {
+  const receivers = {};
+  for (const [key, receiver] of typedEntries(files)) {
+    receivers[String(key)] = receiver;
+  }
+  const declared = Object.keys(endpoint.multipart.files);
+  const configured = Object.keys(receivers);
+  if (declared.length !== configured.length || declared.some((field) => !Object.hasOwn(receivers, field))) {
+    throw new Error("Streaming multipart receivers must exactly match declared file fields");
+  }
+  return {
+    kind: "stitchkit.multipart.stream",
+    receivers,
+    execute(ctx, streamedFiles) {
+      return callRuntimeHandler(handler, { ...ctx, files: streamedFiles });
+    }
+  };
+}
+function createMultipartStream() {
+  return (endpoint, config) => buildMultipartStream(endpoint, config.files, config.handler);
+}
+function isStreamingEndpoint(endpoint) {
+  return endpoint.multipart?.delivery === "stream";
+}
+function contractOnlyService(contract) {
+  const handlers = {};
+  for (const [key, endpoint] of Object.entries(contract.endpoints)) {
+    if (isStreamingEndpoint(endpoint)) {
+      const receivers = {};
+      for (const field of Object.keys(endpoint.multipart.files)) {
+        receivers[field] = () => {
+          throw new Error("[stitchkit] contract-only service: handlers are not callable");
+        };
+      }
+      const streaming = {
+        kind: "stitchkit.multipart.stream",
+        receivers,
+        execute: () => {
+          throw new Error("[stitchkit] contract-only service: handlers are not callable");
+        }
+      };
+      handlers[key] = streaming;
+      continue;
+    }
+    handlers[key] = () => {
+      throw new Error("[stitchkit] contract-only service: handlers are not callable");
+    };
+  }
+  return bindContract(contract, handlers);
+}
+function stubHandler(label) {
+  return () => {
+    throw new AppError("NOT_IMPLEMENTED", `[stitchkit] ${label} is declared by its contract and has no handler`, 501);
+  };
+}
+function bindContract(contract, handlers, options) {
+  const methods = {};
+  const groupScope = contract.meta.scope ?? "public";
+  for (const [key, endpoint] of typedEntries(contract.endpoints)) {
+    const label = `${contract.meta.prefix}.${String(key)}`;
+    let typedHandler = handlers[String(key)];
+    const isStreaming = endpoint.multipart?.delivery === "stream";
+    if (!isStreaming && typeof typedHandler !== "function") {
+      if (options?.onMissingHandler !== "stub") {
+        throw new Error(`[stitchkit] implement: missing handler for "${label}"`);
+      }
+      console.warn(`[stitchkit] implement: "${label}" has no handler and is mounted as a 501 stub`);
+      typedHandler = stubHandler(label);
+    }
+    if (isStreaming && !isStreamingImplementation(typedHandler)) {
+      throw new Error(`[stitchkit] implement: streaming multipart endpoint "${contract.meta.prefix}.${String(key)}" must use defineMultipartStream()`);
+    }
+    const streamingHandler = isStreamingImplementation(typedHandler) ? typedHandler : undefined;
+    const regularHandler = typeof typedHandler === "function" ? typedHandler : undefined;
+    methods[String(key)] = {
+      ...contractMethodFields(contract, String(key), endpoint),
+      multipartReceivers: streamingHandler?.receivers,
+      handler: streamingHandler ? (ctx) => streamingHandler.execute(ctx, ctx.files ?? {}) : (ctx) => {
+        if (!regularHandler) {
+          throw new Error(`[stitchkit] implement: missing handler for "${contract.meta.prefix}.${String(key)}"`);
+        }
+        return callRuntimeHandler(regularHandler, ctx);
+      }
+    };
+  }
+  return {
+    name: contract.meta.prefix,
+    prefix: contract.meta.prefix,
+    scope: groupScope,
+    methods
+  };
+}
+function implement(contract, handlers, options) {
+  return bindContract(contract, handlers, options);
+}
+function createImplement() {
+  return (contract, handlers, options) => implement(contract, handlers, options);
+}
+function createScopedImplement() {
+  const implementScoped = (contract, handlers, options) => bindContract(contract, handlers, options);
+  const stream = (scope, endpoint, config) => {
+    if (endpoint.scope !== undefined && endpoint.scope !== scope) {
+      throw new Error(`[stitchkit] createScopedImplement.stream: endpoint declares scope "${endpoint.scope}" but "${String(scope)}" was given`);
+    }
+    return buildMultipartStream(endpoint, config.files, config.handler);
+  };
+  const declare = (_contract) => (handlers) => handlers;
+  return Object.assign(implementScoped, { stream, declare });
+}
+
+// src/server/process-signal-common.ts
+var DEFAULT_PROCESS_SIGNALS = ["SIGINT", "SIGTERM"];
+var defaultSignalSource = {
+  on: (signal, handler) => {
+    process.on(signal, handler);
+  },
+  off: (signal, handler) => {
+    process.off(signal, handler);
+  },
+  raiseDefault: (signal) => {
+    if (process.listenerCount(signal) > 0)
+      return false;
+    process.kill(process.pid, signal);
+    return true;
+  }
+};
+function reportSignalError(phase, error, onError) {
+  try {
+    onError?.(phase, error);
+  } catch {}
+}
+function guardSignalCallback(run, phase, onError) {
+  try {
+    run();
+  } catch (error) {
+    reportSignalError(phase, error, onError);
+  }
+}
+
+// src/internal/media-type.ts
+function mediaTypeEssence(contentType) {
+  return (contentType ?? "").split(";", 1)[0]?.trim().toLowerCase() ?? "";
+}
+
+export { DEFAULT_CORS_ALLOW_HEADERS, DEFAULT_CORS_EXPOSE_HEADERS, assertCorsConfig, isOriginAllowed, corsHeaders, corsPreflightResponse, requestCorsHeaders, applyCors, defineMultipartStream, createMultipartStream, contractOnlyService, bindContract, implement, createImplement, createScopedImplement, DEFAULT_PROCESS_SIGNALS, defaultSignalSource, reportSignalError, guardSignalCallback, mediaTypeEssence };

package/dist/index-35mh5bhj.js

@@ -0,0 +1,177 @@
+import {
+  isUnsafeKey
+} from "./index-kzfs85xp.js";
+import {
+  isRecord
+} from "./index-hffjpmq9.js";
+
+// src/internal/request.ts
+function generateTraceId() {
+  return `${Date.now().toString(36)}-${crypto.randomUUID().slice(0, 8)}`;
+}
+function resolveTraceId(req) {
+  const header = req.headers.get("x-request-id") ?? req.headers.get("x-trace-id");
+  const trimmed = header?.trim();
+  if (trimmed && trimmed.length <= 128 && /^[\w.-]+$/.test(trimmed)) {
+    return trimmed;
+  }
+  return generateTraceId();
+}
+function resolveSocketIp(req, server) {
+  if (typeof server === "object" && server !== null && "requestIP" in server && typeof server.requestIP === "function") {
+    const addr = server.requestIP(req);
+    if (isRecord(addr) && typeof addr.address === "string" && addr.address) {
+      return addr.address;
+    }
+  }
+  if ("ip" in req && typeof req.ip === "string" && req.ip)
+    return req.ip;
+  return;
+}
+function extractIp(req, options = {}) {
+  if (options.trustProxy) {
+    const forwarded = req.headers.get("x-forwarded-for");
+    if (forwarded)
+      return (forwarded.split(",")[0] ?? "").trim().replace(/^::ffff:/, "");
+    const realIp = req.headers.get("x-real-ip");
+    if (realIp)
+      return realIp.trim().replace(/^::ffff:/, "");
+  }
+  return (options.socketIp ?? "").replace(/^::ffff:/, "");
+}
+function getClientInfo(req, options = {}) {
+  return {
+    ipAddress: extractIp(req, options) || undefined,
+    userAgent: req.headers.get("user-agent") ?? undefined
+  };
+}
+function parseQueryParams(url) {
+  const query = {};
+  for (const key of new Set(url.searchParams.keys())) {
+    if (isUnsafeKey(key))
+      continue;
+    const values = url.searchParams.getAll(key);
+    const [first] = values;
+    query[key] = values.length === 1 && first !== undefined ? first : values;
+  }
+  return query;
+}
+var IPV4_RESERVED = [
+  ["0.0.0.0", 8],
+  ["10.0.0.0", 8],
+  ["100.64.0.0", 10],
+  ["127.0.0.0", 8],
+  ["169.254.0.0", 16],
+  ["172.16.0.0", 12],
+  ["192.0.0.0", 24],
+  ["192.0.2.0", 24],
+  ["192.88.99.0", 24],
+  ["192.168.0.0", 16],
+  ["198.18.0.0", 15],
+  ["198.51.100.0", 24],
+  ["203.0.113.0", 24],
+  ["224.0.0.0", 4],
+  ["240.0.0.0", 4]
+];
+function parseIpv4(value) {
+  const parts = value.split(".");
+  if (parts.length !== 4)
+    return;
+  let result = 0;
+  for (const part of parts) {
+    if (!/^(0|[1-9]\d{0,2})$/.test(part))
+      return;
+    const octet = Number(part);
+    if (octet > 255)
+      return;
+    result = result * 256 + octet;
+  }
+  return result;
+}
+function parseIpv6(value) {
+  const address = value.split("%")[0] ?? "";
+  if (!address.includes(":"))
+    return;
+  const halves = address.split("::");
+  if (halves.length > 2)
+    return;
+  const groups = [];
+  const tail = [];
+  const push = (into, text) => {
+    if (text === "")
+      return true;
+    for (const piece of text.split(":")) {
+      if (piece.includes(".")) {
+        const v4 = parseIpv4(piece);
+        if (v4 === undefined)
+          return false;
+        into.push(v4 >>> 16 & 65535, v4 & 65535);
+        continue;
+      }
+      if (!/^[0-9a-fA-F]{1,4}$/.test(piece))
+        return false;
+      into.push(Number.parseInt(piece, 16));
+    }
+    return true;
+  };
+  if (!push(groups, halves[0] ?? ""))
+    return;
+  if (halves.length === 2 && !push(tail, halves[1] ?? ""))
+    return;
+  const missing = 8 - groups.length - tail.length;
+  if (halves.length === 2 ? missing < 0 : missing !== 0)
+    return;
+  const words = [
+    ...groups,
+    ...Array(halves.length === 2 ? missing : 0).fill(0),
+    ...tail
+  ];
+  if (words.length !== 8)
+    return;
+  const bytes = new Uint8Array(16);
+  words.forEach((word, index) => {
+    bytes[index * 2] = word >>> 8 & 255;
+    bytes[index * 2 + 1] = word & 255;
+  });
+  return bytes;
+}
+function hasPrefix(bytes, prefix, bits) {
+  for (let index = 0;index < bits; index += 1) {
+    const byte = bytes[index >> 3] ?? 0;
+    const against = prefix[index >> 3] ?? 0;
+    const mask = 128 >> index % 8;
+    if ((byte & mask) !== (against & mask))
+      return false;
+  }
+  return true;
+}
+function isPublicIp(value) {
+  const address = value.trim();
+  if (!address)
+    return false;
+  const v4 = parseIpv4(address);
+  if (v4 !== undefined) {
+    return !IPV4_RESERVED.some(([network, bits]) => {
+      const base = parseIpv4(network);
+      if (base === undefined)
+        return false;
+      const mask = bits === 0 ? 0 : 4294967295 << 32 - bits >>> 0;
+      return (v4 & mask) >>> 0 === (base & mask) >>> 0;
+    });
+  }
+  const bytes = parseIpv6(address);
+  if (!bytes)
+    return false;
+  if (hasPrefix(bytes, [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 255, 255], 96)) {
+    return isPublicIp(Array.from(bytes.slice(12)).join("."));
+  }
+  if (!hasPrefix(bytes, [32], 3))
+    return false;
+  if (hasPrefix(bytes, [32, 1, 0, 0], 23))
+    return false;
+  if (hasPrefix(bytes, [32, 1, 13, 184], 32))
+    return false;
+  return true;
+}
+
+export { generateTraceId, resolveTraceId, resolveSocketIp, extractIp, getClientInfo, parseQueryParams, isPublicIp };

package/dist/index-48ffdxgk.js

@@ -0,0 +1,6 @@
+// src/internal/http-input.ts
+function inputIsQuery(method) {
+  return method === "GET" || method === "DELETE";
+}
+
+export { inputIsQuery };

package/dist/index-4gcnakhx.js

@@ -0,0 +1,82 @@
+import {
+  isUnsafeKey
+} from "./index-kzfs85xp.js";
+
+// src/internal/route-pattern.ts
+import { z } from "zod";
+var PARAM_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function joinRoutePath(...parts) {
+  const joined = parts.filter((part) => Boolean(part)).map((part) => part.replace(/^\/+|\/+$/g, "")).filter(Boolean).join("/");
+  return `/${joined}`;
+}
+function parseRoutePattern(path) {
+  const segments = path.split("/").filter(Boolean);
+  const parameters = [];
+  const names = new Set;
+  for (const [segmentIndex, segment] of segments.entries()) {
+    const marker = segment.at(0);
+    if (marker !== ":" && marker !== "*") {
+      if (segment.includes("*")) {
+        throw new Error(`Wildcard must occupy its own segment in path "${path}"`);
+      }
+      continue;
+    }
+    const name = segment.slice(1);
+    if (marker === "*" && name === "") {
+      throw new Error(`Trailing wildcard in path "${path}" must be named, for example "/*filePath"`);
+    }
+    if (!PARAM_IDENTIFIER.test(name) || isUnsafeKey(name)) {
+      const label = marker === "*" ? "wildcard" : "route parameter";
+      throw new Error(`Invalid ${label} name "${name}" in path "${path}"`);
+    }
+    if (names.has(name)) {
+      throw new Error(`Duplicate route parameter name "${name}" in path "${path}"`);
+    }
+    if (marker === "*" && segmentIndex !== segments.length - 1) {
+      throw new Error(`Wildcard "*${name}" must be the final segment in path "${path}"`);
+    }
+    names.add(name);
+    parameters.push({
+      name,
+      kind: marker === "*" ? "wildcard" : "segment",
+      segmentIndex
+    });
+  }
+  return parameters;
+}
+function resolveRouteParamsSchema(path, schema) {
+  const parameters = parseRoutePattern(path);
+  if (parameters.length === 0)
+    return schema;
+  if (!schema) {
+    const shape = {};
+    for (const parameter of parameters)
+      shape[parameter.name] = z.string();
+    return z.object(shape);
+  }
+  const jsonSchema = z.toJSONSchema(schema, { io: "input", unrepresentable: "any" });
+  const properties = jsonSchema.properties;
+  if (!properties) {
+    throw new Error(`Route params schema for path "${path}" must be an object schema with a property per path field`);
+  }
+  for (const parameter of parameters) {
+    if (!(parameter.name in properties)) {
+      const kind = parameter.kind === "wildcard" ? "wildcard" : "path";
+      throw new Error(`Route params schema for path "${path}" is missing ${kind} field "${parameter.name}"`);
+    }
+  }
+  const names = new Set(parameters.map((parameter) => parameter.name));
+  const required = Array.isArray(jsonSchema.required) ? jsonSchema.required : [];
+  for (const field of required) {
+    if (typeof field === "string" && !names.has(field)) {
+      throw new Error(`Route params schema for path "${path}" requires field "${field}" that the path does not carry`);
+    }
+  }
+  return schema;
+}
+function parseTrailingWildcard(path) {
+  const wildcard = parseRoutePattern(path).find((parameter) => parameter.kind === "wildcard");
+  return wildcard ? { name: wildcard.name, segmentIndex: wildcard.segmentIndex } : null;
+}
+
+export { joinRoutePath, resolveRouteParamsSchema, parseTrailingWildcard };