stitchkit 0.103.11 → 0.103.13

package/llms/process.txt

@@ -15,7 +15,7 @@ description: Native IO для Bun и Node, с явно выбранной durabi
 type: guide
 status: active
 created: 2026-10-01 20:44 +07:00
-updated: 2026-10-02 16:28 +07:00
+updated: 2026-10-04 09:40 +07:00
 participants:
   - role: authored
     harness: Codex
@@ -25,6 +25,14 @@ participants:
     harness: Codex
     model: GPT-6
     at: 2026-10-02 00:08 +07:00
+  - role: implemented
+    harness: Codex
+    model: GPT-6
+    at: 2026-10-03 13:36 +07:00
+  - role: implemented
+    harness: Codex
+    model: GPT-6
+    at: 2026-10-04 09:21 +07:00
 ---
 
 # Native IO
@@ -227,9 +235,10 @@ independent of umask. Default `0600` stays private. Shared `0640` requires a com
 traversable directories; another UID also needs directory write permission to reclaim a
 proven-dead owner's file. Set `ownerlessGraceMs: null` to refuse every age-only reclaim,
 including ownerless reclaim guards. The default remains 5000 ms for existing clients.
-Восстановление stale reclaim guard использует тот же lock owner и следующий guard:
-проверка inode и удаление выполняются под ним. Конкурирующий writer не обходит guard,
-пока прежнее удаление приостановлено; live и unknown lifetime evidence остаются отказом.
+Stale reclaim guards use the same lock owner and a child guard for the inode check and
+unlink. Recovery depth is capped at 16; a deeper stale chain refuses recovery with a depth diagnosis retained as the cause of
+the bounded `LOCK_TIMEOUT`. Live owners, unknown process-lifetime evidence and unsafe records are never
+reclaimed. Concurrent writers cannot bypass a guard while a prior unlink is paused.
 
 ## Libraries with a Zod-only runtime
 
@@ -251,14 +260,59 @@ version: carry their reachable relative `.d.ts` closure, rather than emitting re
 instead emit declarations for only that DTO contract. Keep the library's manifest at runtime
 `dependencies: {}` and `peerDependencies: { zod: ... }` when that is its declared promise.
 
-Darwin consumers need the published native binaries at the bundled loader's relative native
-directory. A JS-only bundle is not portable evidence. Qualify the packed library outside its
-build tree in Bun and Node, test its declarations, and check that importing an unbundled
-Stitchkit leaf fails there. A separate schema-only entry must not import the native entry.
+The packaged Darwin loader has static references to both architecture addons. Bun compilation
+embeds the matching `.node` asset; ordinary Bun bundling emits native assets alongside its JS
+output. Publish **every output returned by `Bun.build`**, preserving relative paths. Copying only
+the JS file drops its native dependency. No runtime Stitchkit installation or manually chosen
+native path is required for these bundled artifacts.
+
+```sh
+bun build src/native.ts --target=bun --minify --outdir=dist
+bun build src/native.ts --compile --bytecode --format=esm --outfile=dist/native
+```
+
+For a JS build that previously used `--outfile=dist/native.js`, use
+`--outdir=dist --entry-naming=native.js` instead: the output can now include native assets.
+The standalone executable still uses `--outfile` because those assets are embedded inside it.
+
+Qualify the complete output outside its build tree and installed dependency graph. Test process
+identity, live-owner refusal, dead-owner recovery and contained file operations in the resulting
+JS bundle and standalone executable. Bun and Node package imports retain the same lazy loader;
+importing a portable leaf does not load a Darwin addon on another OS. Test declarations too,
+and check that importing an unbundled Stitchkit leaf fails in a deliberately isolated library
+distribution. A separate schema-only entry must not import the native entry.
+
+If the Darwin backend cannot load, `observeProcessInstance` still returns `unavailable`.
+Its backend `Error` preserves the original `cause`; JSON serialization carries only the stable
+`DARWIN_BACKEND_UNAVAILABLE` code, architecture, safe message and failure stage
+(`architecture`, `resolve`, `load` or `surface`), plus a recognized native error code when present.
+It excludes stack, paths and nested cause. This backend diagnosis does not reclassify kernel
+failures or turn unavailable identity into proof that an owner is dead. If a runtime provides
+no recognized native error code, the stage stays `load`; the loader never infers errno from text.
 
 This delivery removes a runtime kernel installation; it does not remove the build-time
 Stitchkit installation or create an independent lightweight npm package.
 
+## Qualification boundaries
+
+Native command cleanup owns the child before launch subscriptions are installed. Setup
+refusal still settles leader closure and teardown within the cleanup budget; failure to
+prove closure reports `COMMAND_CLEANUP` with the original failure retained. Process-group
+signaling requires evidence from the actual detached launcher, not a structural PID field.
+The built-in sandbox transport carries that ownership across the package's split entrypoints.
+Internal finite deadlines and Darwin retry admission use monotonic elapsed time.
+
+Linux UID-refusal qualification is a separate privileged installed-package proof in Bun
+and real Node; an unsupported platform or insufficient UID reports an explicit skip.
+A generic native-owner marker does not certify the privileged case. Real Darwin CI remains
+the qualification for native Darwin behavior.
+
+Local filesystem tests do not attest delayed NFS visibility, shared-volume microVM or gVisor
+ownership, actual PGID reuse, power-loss durability or macOS full-sync behavior. Those
+require their actual topology or failure environment. The default ownerless grace remains
+5000 ms; stricter callers can retain `ownerlessGraceMs: null`. No age-only observation
+proves a partially published owner's process dead.
+
 ==============================================================================
 # API reference: `stitchkit/process`  (docs/api/reference.md)
 ==============================================================================

package/llms-full.txt

@@ -7900,6 +7900,12 @@ boundary is required. Send and projection callbacks own their external deadlines
 ---
 title: Optional process sandbox
 description: Linux namespace isolation, durable workspaces and a host credential gateway.
+updated: 2026-10-03 14:47 +07:00
+participants:
+  - role: implemented
+    harness: Codex
+    model: GPT-6
+    at: 2026-10-03 14:47 +07:00
 ---
 
 # Optional process sandbox
@@ -7969,7 +7975,9 @@ Unsupported backends omit the binding and the factory refuses explicitly.
 Stop also kills coding commands. Both launch paths share the configured
 `maxConcurrentCommands` admission limit (default 8); an occupied slot gives
 `SANDBOX_BUSY` before another process starts. This counts direct commands, not
-guest descendants. Required restrictions are checked again during preparation;
+guest descendants. A direct launch retains its slot through terminal group cleanup,
+including descendants that outlive the leader. Required restrictions are checked again
+during preparation;
 a network-policy change invalidates an outstanding prepared launch. After
 reconnect, create the coding profile from the new handle; old tools remain stopped.
 
@@ -8037,7 +8045,7 @@ description: Native IO для Bun и Node, с явно выбранной durabi
 type: guide
 status: active
 created: 2026-10-01 20:44 +07:00
-updated: 2026-10-02 16:28 +07:00
+updated: 2026-10-04 09:40 +07:00
 participants:
   - role: authored
     harness: Codex
@@ -8047,6 +8055,14 @@ participants:
     harness: Codex
     model: GPT-6
     at: 2026-10-02 00:08 +07:00
+  - role: implemented
+    harness: Codex
+    model: GPT-6
+    at: 2026-10-03 13:36 +07:00
+  - role: implemented
+    harness: Codex
+    model: GPT-6
+    at: 2026-10-04 09:21 +07:00
 ---
 
 # Native IO
@@ -8249,9 +8265,10 @@ independent of umask. Default `0600` stays private. Shared `0640` requires a com
 traversable directories; another UID also needs directory write permission to reclaim a
 proven-dead owner's file. Set `ownerlessGraceMs: null` to refuse every age-only reclaim,
 including ownerless reclaim guards. The default remains 5000 ms for existing clients.
-Восстановление stale reclaim guard использует тот же lock owner и следующий guard:
-проверка inode и удаление выполняются под ним. Конкурирующий writer не обходит guard,
-пока прежнее удаление приостановлено; live и unknown lifetime evidence остаются отказом.
+Stale reclaim guards use the same lock owner and a child guard for the inode check and
+unlink. Recovery depth is capped at 16; a deeper stale chain refuses recovery with a depth diagnosis retained as the cause of
+the bounded `LOCK_TIMEOUT`. Live owners, unknown process-lifetime evidence and unsafe records are never
+reclaimed. Concurrent writers cannot bypass a guard while a prior unlink is paused.
 
 ## Libraries with a Zod-only runtime
 
@@ -8273,14 +8290,59 @@ version: carry their reachable relative `.d.ts` closure, rather than emitting re
 instead emit declarations for only that DTO contract. Keep the library's manifest at runtime
 `dependencies: {}` and `peerDependencies: { zod: ... }` when that is its declared promise.
 
-Darwin consumers need the published native binaries at the bundled loader's relative native
-directory. A JS-only bundle is not portable evidence. Qualify the packed library outside its
-build tree in Bun and Node, test its declarations, and check that importing an unbundled
-Stitchkit leaf fails there. A separate schema-only entry must not import the native entry.
+The packaged Darwin loader has static references to both architecture addons. Bun compilation
+embeds the matching `.node` asset; ordinary Bun bundling emits native assets alongside its JS
+output. Publish **every output returned by `Bun.build`**, preserving relative paths. Copying only
+the JS file drops its native dependency. No runtime Stitchkit installation or manually chosen
+native path is required for these bundled artifacts.
+
+```sh
+bun build src/native.ts --target=bun --minify --outdir=dist
+bun build src/native.ts --compile --bytecode --format=esm --outfile=dist/native
+```
+
+For a JS build that previously used `--outfile=dist/native.js`, use
+`--outdir=dist --entry-naming=native.js` instead: the output can now include native assets.
+The standalone executable still uses `--outfile` because those assets are embedded inside it.
+
+Qualify the complete output outside its build tree and installed dependency graph. Test process
+identity, live-owner refusal, dead-owner recovery and contained file operations in the resulting
+JS bundle and standalone executable. Bun and Node package imports retain the same lazy loader;
+importing a portable leaf does not load a Darwin addon on another OS. Test declarations too,
+and check that importing an unbundled Stitchkit leaf fails in a deliberately isolated library
+distribution. A separate schema-only entry must not import the native entry.
+
+If the Darwin backend cannot load, `observeProcessInstance` still returns `unavailable`.
+Its backend `Error` preserves the original `cause`; JSON serialization carries only the stable
+`DARWIN_BACKEND_UNAVAILABLE` code, architecture, safe message and failure stage
+(`architecture`, `resolve`, `load` or `surface`), plus a recognized native error code when present.
+It excludes stack, paths and nested cause. This backend diagnosis does not reclassify kernel
+failures or turn unavailable identity into proof that an owner is dead. If a runtime provides
+no recognized native error code, the stage stays `load`; the loader never infers errno from text.
 
 This delivery removes a runtime kernel installation; it does not remove the build-time
 Stitchkit installation or create an independent lightweight npm package.
 
+## Qualification boundaries
+
+Native command cleanup owns the child before launch subscriptions are installed. Setup
+refusal still settles leader closure and teardown within the cleanup budget; failure to
+prove closure reports `COMMAND_CLEANUP` with the original failure retained. Process-group
+signaling requires evidence from the actual detached launcher, not a structural PID field.
+The built-in sandbox transport carries that ownership across the package's split entrypoints.
+Internal finite deadlines and Darwin retry admission use monotonic elapsed time.
+
+Linux UID-refusal qualification is a separate privileged installed-package proof in Bun
+and real Node; an unsupported platform or insufficient UID reports an explicit skip.
+A generic native-owner marker does not certify the privileged case. Real Darwin CI remains
+the qualification for native Darwin behavior.
+
+Local filesystem tests do not attest delayed NFS visibility, shared-volume microVM or gVisor
+ownership, actual PGID reuse, power-loss durability or macOS full-sync behavior. Those
+require their actual topology or failure environment. The default ownerless grace remains
+5000 ms; stricter callers can retain `ownerlessGraceMs: null`. No age-only observation
+proves a partially published owner's process dead.
+
 
 ==============================================================================
 # Guide: Generic application primitives  (docs/guide/primitives.md)
@@ -8874,6 +8936,16 @@ there stays a positional, and `--` makes a literal `false` one too. The same
 holds for a short alias, a framework flag such as `--json false` and an
 application option.
 
+Every declared non-array option is single-use, including framework and
+application globals. Bare, separate-value, inline, negative and short-alias
+forms of a command option count as the same name: `--active=false --active`,
+`--active false --no-active` and `-f --active` are argument errors even when
+the values agree. Duplicates are refused before command execution. Array
+options accumulate across long and short forms; unknown non-dotted passthrough
+options retain their raw-list grammar. Tokens after `--` are literal data.
+Command `--help` and `-h` keep their diagnostic precedence over malformed
+operation arguments; application globals are validated before routing.
+
 Without presentation configuration, positional arguments fill non-boolean
 fields in declaration order, so `myapp generate "a fox"` is
 `--prompt "a fox"`. A piped value fills the first required unset field:

package/llms.txt

@@ -17,7 +17,7 @@ Load the slice for each entrypoint your code imports — `import … from 'stitc
 - **stitchkit/tools/contract**: [llms/tools-contract.txt](llms/tools-contract.txt) 0.2 KB
 - **stitchkit/tools/invoker**: [llms/tools-invoker.txt](llms/tools-invoker.txt) 0.2 KB
 - **stitchkit/tools/connections**: [llms/tools-connections.txt](llms/tools-connections.txt) 3.1 KB
-- **stitchkit/cli**: [llms/cli.txt](llms/cli.txt) 43.6 KB → [llms/cli.2.txt](llms/cli.2.txt) 8.1 KB
+- **stitchkit/cli**: [llms/cli.txt](llms/cli.txt) 44.2 KB → [llms/cli.2.txt](llms/cli.2.txt) 8.1 KB
 - **stitchkit/remote**: [llms/remote.txt](llms/remote.txt) 1.0 KB
 - **stitchkit/contract**: [llms/contract.txt](llms/contract.txt) 31.9 KB
 - **stitchkit/primitives**: [llms/primitives.txt](llms/primitives.txt) 11.2 KB
@@ -38,7 +38,7 @@ Load the slice for each entrypoint your code imports — `import … from 'stitc
 - **stitchkit/application/diagnostic-journal**: [llms/application-diagnostic-journal.txt](llms/application-diagnostic-journal.txt) 1.8 KB
 - **stitchkit/application/schemas**: [llms/application-schemas.txt](llms/application-schemas.txt) 1.8 KB
 - **stitchkit/testing**: [llms/testing.txt](llms/testing.txt) 30.8 KB
-- **stitchkit/agent-runtime/sandbox**: [llms/agent-runtime-sandbox.txt](llms/agent-runtime-sandbox.txt) 8.1 KB
+- **stitchkit/agent-runtime/sandbox**: [llms/agent-runtime-sandbox.txt](llms/agent-runtime-sandbox.txt) 8.3 KB
 - **stitchkit/files**: [llms/files.txt](llms/files.txt) 4.5 KB
 - **stitchkit/telegram**: [llms/telegram.txt](llms/telegram.txt) 26.9 KB
 - **stitchkit/telegram/html**: [llms/telegram-html.txt](llms/telegram-html.txt) 2.7 KB
@@ -55,7 +55,7 @@ Load the slice for each entrypoint your code imports — `import … from 'stitc
 - **stitchkit/agent-runtime/react**: [llms/agent-runtime-react.txt](llms/agent-runtime-react.txt) 1.0 KB
 - **stitchkit/agent-runtime/realtime**: [llms/agent-runtime-realtime.txt](llms/agent-runtime-realtime.txt) 1.8 KB
 - **stitchkit/agent-runtime/harness-tools**: [llms/agent-runtime-harness-tools.txt](llms/agent-runtime-harness-tools.txt) 1.3 KB
-- **stitchkit/process**: [llms/process.txt](llms/process.txt) 18.6 KB
+- **stitchkit/process**: [llms/process.txt](llms/process.txt) 21.7 KB
 
 ## Upgrading slices
 - **Upgrading — how to move across versions**: [llms/upgrading.txt](llms/upgrading.txt) 10.3 KB

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stitchkit",
-  "version": "0.103.11",
+  "version": "0.103.13",
   "description": "Contract-first backend framework — one defineContract() into an HTTP API, MCP tools, AI-agent tools and a typed client. Bun and Node.",
   "keywords": [
     "bun",
@@ -42,6 +42,8 @@
   "files": [
     "dist",
     "native/*.node",
+    "darwin-native.cjs",
+    "darwin-native.d.cts",
     "llms.txt",
     "llms-full.txt",
     "llms",
@@ -49,6 +51,9 @@
     "CHANGELOG.md",
     "LICENSE"
   ],
+  "imports": {
+    "#stitchkit-darwin-native": "./darwin-native.cjs"
+  },
   "exports": {
     ".": {
       "types": "./dist/entrypoints/index.d.ts",

package/dist/index-c1jmtxa0.js

@@ -1,74 +0,0 @@
-// src/internal/json-data.ts
-function isJsonData(value, limits) {
-  const ancestors = new Set;
-  let nodes = 0;
-  let bytes = 0;
-  const charge = (amount) => {
-    bytes += amount;
-    return bytes <= limits.maxBytes;
-  };
-  const textSize = (text) => {
-    if (text.length > limits.maxBytes)
-      return limits.maxBytes + 1;
-    return new TextEncoder().encode(JSON.stringify(text)).byteLength;
-  };
-  const visit = (item, depth) => {
-    if (++nodes > limits.maxNodes || depth > limits.maxDepth)
-      return false;
-    if (item === null)
-      return charge(4);
-    if (typeof item === "string")
-      return charge(textSize(item));
-    if (typeof item === "boolean")
-      return charge(item ? 4 : 5);
-    if (typeof item === "number")
-      return Number.isFinite(item) && !Object.is(item, -0) && charge(String(item).length);
-    if (typeof item !== "object" || ancestors.has(item))
-      return false;
-    const array = Array.isArray(item);
-    const prototype = Object.getPrototypeOf(item);
-    if (array ? prototype !== Array.prototype : prototype !== Object.prototype && prototype !== null)
-      return false;
-    if (array && item.length > limits.maxNodes - nodes)
-      return false;
-    const keys = Reflect.ownKeys(item);
-    if (keys.length > limits.maxNodes - nodes + (array ? 1 : 0))
-      return false;
-    if (array && keys.length !== item.length + 1)
-      return false;
-    ancestors.add(item);
-    try {
-      if (!charge(2))
-        return false;
-      let members = 0;
-      for (const key of keys) {
-        if (array && key === "length")
-          continue;
-        if (typeof key !== "string")
-          return false;
-        if (array && (!/^(0|[1-9][0-9]*)$/.test(key) || Number(key) >= item.length))
-          return false;
-        const descriptor = Object.getOwnPropertyDescriptor(item, key);
-        if (!descriptor?.enumerable || !("value" in descriptor))
-          return false;
-        if (!array && limits.omitObjectUndefined && descriptor.value === undefined) {
-          if (++nodes > limits.maxNodes)
-            return false;
-          continue;
-        }
-        if (members++ > 0 && !charge(1))
-          return false;
-        if (!array && !charge(textSize(key) + 1))
-          return false;
-        if (!visit(descriptor.value, depth + 1))
-          return false;
-      }
-      return true;
-    } finally {
-      ancestors.delete(item);
-    }
-  };
-  return visit(value, 0);
-}
-
-export { isJsonData };

package/dist/index-d4pa2bgs.js

@@ -1,42 +0,0 @@
-// src/internal/darwin-binding.ts
-import { existsSync } from "node:fs";
-import { createRequire } from "node:module";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-function hasFunctions(value, names) {
-  return typeof value === "object" && value !== null && names.every((name) => typeof Reflect.get(value, name) === "function");
-}
-var darwinBinding;
-function loadDarwinBinding() {
-  if (darwinBinding)
-    return darwinBinding;
-  const directory = path.dirname(fileURLToPath(import.meta.url));
-  const binary = `darwin-${process.arch}.node`;
-  const candidates = [
-    path.resolve(directory, "../native", binary),
-    path.resolve(directory, "../../native", binary)
-  ];
-  const selected = candidates.find((candidate) => existsSync(candidate));
-  if (!selected) {
-    throw new Error(`Contained filesystem operations need the packaged Darwin ${process.arch} backend`);
-  }
-  const loaded = createRequire(import.meta.url)(selected);
-  const methods = [
-    "openDirectoryAt",
-    "openFileAt",
-    "createFileAt",
-    "createDirectoryAt",
-    "statAt",
-    "listAt",
-    "renameAt",
-    "unlinkAt",
-    "processIdentity"
-  ];
-  if (!hasFunctions(loaded, methods)) {
-    throw new Error("The packaged Darwin contained-files backend has an invalid surface");
-  }
-  darwinBinding = loaded;
-  return darwinBinding;
-}
-
-export { loadDarwinBinding };