stitchkit 0.103.8 → 0.103.10

package/CHANGELOG.md

@@ -15,6 +15,27 @@ additive**; the first breaking change landed in 0.10.0. Grep the file for
 
 ## [Unreleased]
 
+## [0.103.10] - 2026-10-01
+
+### Added
+
+- `stitchkit/process`: `onLeaderSettled` observes launcher exit before inherited-pipe drain and settles resource scopes once on terminal failure; callbacks have bounded cancellation and preserve initial causes. Public process identity observation/probing preserves unavailable evidence and its cause from the existing Linux/Darwin owner.
+- `stitchkit/files`: `ownerlessGraceMs: null` explicitly refuses age-based reclaim of unknown locks and guards; exact requested lock permissions survive restrictive umask, and failed descriptor setup cannot remove a replacement inode.
+- Document and qualify neutral library bundling from public imports and published declarations with Zod as its only runtime peer; full-kernel install remains a build-time choice.
+
+## [0.103.9] - 2026-10-01
+
+### Added
+
+- `stitchkit/files`: atomic create without replacement, explicit file/directory durability, publication-aware errors and opt-in strict descriptor reads with observed metadata.
+- `stitchkit/primitives`: bounded production `canonicalJson` preserving historical UTF-16 sorted bytes. Public surface ceiling grows by two names for the serializer and inferred options; files grows by the publication error and metadata type.
+- `stitchkit/process`: evolving POSIX Node/Bun one-shot command leaf with binary sinks, bounded capture, explicit environment policy and cancellation independent of the agent runtime (four public names; ADR 0224).
+
+### Fixed
+
+- Effect reconciliation releases caller waits on cancellation and ignores late results, including independently cancelled coalesced observers; document the external execution lease required across processes. Historical sticky uncertain remains unchanged; automatic absence-based retries require recipient authority.
+- Managed reads preserve the primary error when descriptor cleanup also fails. Native command and reconciliation deadlines refuse timer overflow instead of silently firing after 1 ms.
+
 ## [0.103.8] - 2026-10-01
 
 ### Fixed

package/dist/agent-runtime/sandbox-process.d.ts

@@ -1,6 +1,6 @@
-import { type ChildProcessWithoutNullStreams } from 'node:child_process';
+import type { ChildProcessWithoutNullStreams } from 'node:child_process';
 import { type SandboxProcess, type SandboxRunOptions } from './sandbox-contract.js';
-/** Owns the host wrapper through close, including bounded collection and process-group kill. */
+/** Sandbox admission and mandatory caps adapt the shared native command owner. */
 export declare function spawnSandboxProcess(executable: string, args: string[], limits: {
     timeoutMs: number;
     maxOutputBytes: number;

package/dist/agent-runtime/sandbox-process.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-process.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/sandbox-process.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,8BAA8B,EAAS,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAgB,KAAK,cAAc,EAAE,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE/F,gGAAgG;AAChG,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EAAE,EACd,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,EACrD,OAAO,GAAE,iBAAsB,EAC/B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,8BAA8B,KAAK,IAAI,GACxD,cAAc,CAoFhB"}
+{"version":3,"file":"sandbox-process.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/sandbox-process.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAGzE,OAAO,EAAgB,KAAK,cAAc,EAAE,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE/F,kFAAkF;AAClF,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EAAE,EACd,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,EACrD,OAAO,GAAE,iBAAsB,EAC/B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,8BAA8B,KAAK,IAAI,GACxD,cAAc,CA8ChB"}

package/dist/agent-runtime/store-conformance-lifecycle.d.ts

@@ -133,6 +133,11 @@ export declare function fencingPhase(store: AgentRuntimeStore, conversationId: s
                 parts: ({
                     type: "text";
                     text: string;
+                } | {
+                    type: "file";
+                    mediaType: string;
+                    reference: string;
+                    filename?: string | undefined;
                 } | {
                     type: "reasoning";
                     text: string;
@@ -141,11 +146,6 @@ export declare function fencingPhase(store: AgentRuntimeStore, conversationId: s
                         provider: string;
                         data: Record<string, import("zod").JSONType>;
                     } | undefined;
-                } | {
-                    type: "file";
-                    mediaType: string;
-                    reference: string;
-                    filename?: string | undefined;
                 } | {
                     type: "source";
                     sourceId: string;
@@ -313,6 +313,11 @@ export declare function fencingPhase(store: AgentRuntimeStore, conversationId: s
         parts: ({
             type: "text";
             text: string;
+        } | {
+            type: "file";
+            mediaType: string;
+            reference: string;
+            filename?: string | undefined;
         } | {
             type: "reasoning";
             text: string;
@@ -321,11 +326,6 @@ export declare function fencingPhase(store: AgentRuntimeStore, conversationId: s
                 provider: string;
                 data: Record<string, import("zod").JSONType>;
             } | undefined;
-        } | {
-            type: "file";
-            mediaType: string;
-            reference: string;
-            filename?: string | undefined;
         } | {
             type: "source";
             sourceId: string;

package/dist/durability/contract.d.ts

@@ -119,8 +119,9 @@ export type EffectOutcome<P> = {
 export interface EffectHandlers<P> {
     /**
      * Perform the effect, once, and return what the recipient named it — a
-     * message id, a turn id. Called at most once per name, across every process
-     * that shares the ledger.
+     * message id, a turn id. Called at most once per name while a caller-owned exclusive execution lease
+     * fences this conversation/run. Sharing a ledger alone is not an atomic claim;
+     * standalone callers must provide that lease across processes/port objects.
      */
     run(): P | Promise<P>;
     /**

package/dist/durability/contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../src/durability/contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EACV,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,UAAU,CAAC;AAElB;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC5E,UAAU,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACvE;AAED,4EAA4E;AAC5E,eAAO,MAAM,0BAA0B,oBAAoB,CAAC;AAE5D,8EAA8E;AAC9E,eAAO,MAAM,0BAA0B,oBAAoB,CAAC;AAE5D,yEAAyE;AACzE,eAAO,MAAM,2BAA2B,qBAAqB,CAAC;AAE9D,+FAA+F;AAC/F,eAAO,MAAM,4BAA4B,sBAAsB,CAAC;AAEhE,eAAO,MAAM,sBAAsB;;;;iBAKjC,CAAC;AAiBH,eAAO,MAAM,sBAAsB;;;;;;;;;;2BAGjC,CAAC;AAEH,eAAO,MAAM,2BAA2B;;;;;iBAMtC,CAAC;AAIH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;4BAWnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,IAAI,MAAM,CAAC;IACd,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG;QAAE,MAAM,IAAI,IAAI,CAAA;KAAE,CAAC;CACrE;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,oBAAoB,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,yEAAyE;IACzE,SAAS,CAAC,CAAC,IAAI,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;IACzC;;;;OAIG;IACH,KAAK,CAAC,EAAE;QACN,GAAG,IAAI,MAAM,CAAC;QACd,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG;YAAE,MAAM,IAAI,IAAI,CAAA;SAAE,CAAC;KACrE,CAAC;CACH;AAED,MAAM,WAAW,cAAc;IAC7B,yGAAyG;IACzG,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,CAAC,CAAC,IACvB;IAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAEtC,qDAAqD;AACrD,MAAM,WAAW,cAAc,CAAC,CAAC;IAC/B;;;;OAIG;IACH,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACtB;;;;;OAKG;IACH,SAAS,CAAC,MAAM,EAAE,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,2GAA2G;IAC3G,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;;OAMG;IACH,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,EAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAC1B,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,CAAC,CAAC,CAAC;IACd,8EAA8E;IAC9E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IAC7D,4CAA4C;IAC5C,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD;;;;;;;;OAQG;IACH,KAAK,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F;;;;;;OAMG;IACH,OAAO,CAAC,CAAC,GAAG,OAAO,EACjB,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,EACpC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,CAAC,CAAC,CAAC;IACd;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,EACjD,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,EAC3B,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAGzD;CACF;AAED,uEAAuE;AACvE,qBAAa,8BAA+B,SAAQ,KAAK;IACvD,YAAY,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAK3C;CACF;AAED,kFAAkF;AAClF,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,QAAQ,EAAE,MAAM,EAG3B;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAE5C,QAAQ,CAAC,UAAU,EAAE,MAAM;IAC3B,QAAQ,CAAC,MAAM,EACX,YAAY,GACZ,kBAAkB,GAClB,mBAAmB,GACnB,gBAAgB;IANtB,YACW,UAAU,EAAE,MAAM,EAClB,MAAM,EACX,YAAY,GACZ,kBAAkB,GAClB,mBAAmB,GACnB,gBAAgB,EACpB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAI9B;CACF;AAED;;;;;;GAMG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAGzD;CACF;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,IAAI,EAAE,MAAM,EAGvB;CACF"}
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../src/durability/contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EACV,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,UAAU,CAAC;AAElB;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC5E,UAAU,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACvE;AAED,4EAA4E;AAC5E,eAAO,MAAM,0BAA0B,oBAAoB,CAAC;AAE5D,8EAA8E;AAC9E,eAAO,MAAM,0BAA0B,oBAAoB,CAAC;AAE5D,yEAAyE;AACzE,eAAO,MAAM,2BAA2B,qBAAqB,CAAC;AAE9D,+FAA+F;AAC/F,eAAO,MAAM,4BAA4B,sBAAsB,CAAC;AAEhE,eAAO,MAAM,sBAAsB;;;;iBAKjC,CAAC;AAiBH,eAAO,MAAM,sBAAsB;;;;;;;;;;2BAGjC,CAAC;AAEH,eAAO,MAAM,2BAA2B;;;;;iBAMtC,CAAC;AAIH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;4BAWnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,IAAI,MAAM,CAAC;IACd,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG;QAAE,MAAM,IAAI,IAAI,CAAA;KAAE,CAAC;CACrE;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,oBAAoB,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,yEAAyE;IACzE,SAAS,CAAC,CAAC,IAAI,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;IACzC;;;;OAIG;IACH,KAAK,CAAC,EAAE;QACN,GAAG,IAAI,MAAM,CAAC;QACd,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG;YAAE,MAAM,IAAI,IAAI,CAAA;SAAE,CAAC;KACrE,CAAC;CACH;AAED,MAAM,WAAW,cAAc;IAC7B,yGAAyG;IACzG,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,CAAC,CAAC,IACvB;IAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAEtC,qDAAqD;AACrD,MAAM,WAAW,cAAc,CAAC,CAAC;IAC/B;;;;;OAKG;IACH,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACtB;;;;;OAKG;IACH,SAAS,CAAC,MAAM,EAAE,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,2GAA2G;IAC3G,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;;OAMG;IACH,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,EAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAC1B,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,CAAC,CAAC,CAAC;IACd,8EAA8E;IAC9E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IAC7D,4CAA4C;IAC5C,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD;;;;;;;;OAQG;IACH,KAAK,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F;;;;;;OAMG;IACH,OAAO,CAAC,CAAC,GAAG,OAAO,EACjB,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,EACpC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,CAAC,CAAC,CAAC;IACd;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,EACjD,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,EAC3B,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAGzD;CACF;AAED,uEAAuE;AACvE,qBAAa,8BAA+B,SAAQ,KAAK;IACvD,YAAY,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAK3C;CACF;AAED,kFAAkF;AAClF,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,QAAQ,EAAE,MAAM,EAG3B;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAE5C,QAAQ,CAAC,UAAU,EAAE,MAAM;IAC3B,QAAQ,CAAC,MAAM,EACX,YAAY,GACZ,kBAAkB,GAClB,mBAAmB,GACnB,gBAAgB;IANtB,YACW,UAAU,EAAE,MAAM,EAClB,MAAM,EACX,YAAY,GACZ,kBAAkB,GAClB,mBAAmB,GACnB,gBAAgB,EACpB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAI9B;CACF;AAED;;;;;;GAMG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAGzD;CACF;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,IAAI,EAAE,MAAM,EAGvB;CACF"}

package/dist/durability/effect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"effect.d.ts","sourceRoot":"","sources":["../../src/durability/effect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EAGrB,KAAK,oBAAoB,EAC1B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,KAAK,oBAAoB,EAA+B,MAAM,UAAU,CAAC;AAMlF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,CAAC;IACzC,UAAU,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAC7C;AAED,KAAK,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAkFhD,wBAAsB,aAAa,CAAC,CAAC,SAAS,KAAK,EACjD,OAAO,EAAE,mBAAmB,EAC5B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,EAC3B,OAAO,EAAE,gBAAgB,GAAG,SAAS,GACpC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CA0B3B"}
+{"version":3,"file":"effect.d.ts","sourceRoot":"","sources":["../../src/durability/effect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EAGrB,KAAK,oBAAoB,EAC1B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,KAAK,oBAAoB,EAA+B,MAAM,UAAU,CAAC;AAMlF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,CAAC;IACzC,UAAU,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAC7C;AAED,KAAK,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAuFhD,wBAAsB,aAAa,CAAC,CAAC,SAAS,KAAK,EACjD,OAAO,EAAE,mBAAmB,EAC5B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,EAC3B,OAAO,EAAE,gBAAgB,GAAG,SAAS,GACpC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CA0B3B"}

package/dist/durability/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/durability/engine.ts"],"names":[],"mappings":"AACA,OAAO,EAOL,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAGhC,MAAM,YAAY,CAAC;AAepB,YAAY,EACV,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,0BAA0B,EAC1B,oBAAoB,EACpB,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,EACrB,8BAA8B,GAC/B,MAAM,YAAY,CAAC;AAmBpB;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,0BAA0B,GAClC,mBAAmB,CAsLrB"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/durability/engine.ts"],"names":[],"mappings":"AAEA,OAAO,EAOL,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAGhC,MAAM,YAAY,CAAC;AAepB,YAAY,EACV,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,0BAA0B,EAC1B,oBAAoB,EACpB,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,EACrB,8BAA8B,GAC/B,MAAM,YAAY,CAAC;AAmBpB;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,0BAA0B,GAClC,mBAAmB,CA+LrB"}

package/dist/durability/json.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../src/durability/json.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAoCxB,eAAO,MAAM,iBAAiB,qCAG7B,CAAC"}
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../src/durability/json.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,iBAAiB,qCAS7B,CAAC"}

package/dist/entrypoints/agent-runtime/harness.js

@@ -5,7 +5,7 @@ import"../../index-8kzct1d6.js";
 import {
   composeAgentPrompt2,
   createAgentRuntime2
-} from "../../index-90ppdx3q.js";
+} from "../../index-9jb61j5a.js";
 import"../../index-h97tqqp1.js";
 import"../../index-mnkk1ffz.js";
 import"../../index-n53mswt3.js";
@@ -15,7 +15,7 @@ import"../../index-9pw0a51a.js";
 import"../../index-ct75c3at.js";
 import"../../index-x87j7csh.js";
 import"../../index-m2xqkv55.js";
-import"../../index-5vyd0fkb.js";
+import"../../index-ary5s7k0.js";
 import"../../index-nggfa2yn.js";
 import"../../index-r5hsgkz5.js";
 import"../../index-n5yqxd3d.js";

package/dist/entrypoints/agent-runtime/sandbox.js

@@ -10,6 +10,10 @@ import"../../index-b2bz0kdm.js";
 import {
   createAgentCodingTools2
 } from "../../index-a4ajxwmb.js";
+import {
+  NativeCommandError2,
+  startNativeCommand
+} from "../../index-6m6a9ty4.js";
 import"../../index-tgzhq07n.js";
 
 // src/agent-runtime/sandbox-bubblewrap.ts
@@ -503,95 +507,39 @@ function createSandboxCodingAdapter(input) {
 }
 
 // src/agent-runtime/sandbox-process.ts
-import { spawn } from "node:child_process";
 function spawnSandboxProcess(executable, args, limits, options = {}, onSpawn) {
-  options.signal?.throwIfAborted();
-  const child = spawn(executable, args, {
+  const command = startNativeCommand({
+    executable,
+    args,
+    timeoutMs: limits.timeoutMs,
+    maxOutputBytes: limits.maxOutputBytes,
+    signal: options.signal,
+    capture: true,
+    envPolicy: "declared-only",
     env: {},
-    detached: true,
-    stdio: ["pipe", "pipe", "pipe"]
-  });
-  onSpawn?.(child);
-  const stdout = [];
-  const stderr = [];
-  let bytes = 0;
-  let failure;
-  let finished = false;
-  const kill = () => {
-    if (finished || child.pid === undefined)
-      return;
-    try {
-      process.kill(-child.pid, "SIGKILL");
-    } catch (error) {
-      if (!(error instanceof Error && ("code" in error) && error.code === "ESRCH"))
-        failure ??= error;
-    }
-  };
-  const abort = () => {
-    failure ??= options.signal?.reason ?? new Error("Sandbox command aborted");
-    kill();
-  };
-  const timer = setTimeout(() => {
-    failure ??= new SandboxError("SANDBOX_LIMIT", "Sandbox command deadline exceeded");
-    kill();
-  }, limits.timeoutMs);
-  timer.unref();
-  const result = new Promise((resolve, reject) => {
-    const collect = (target) => (chunk) => {
-      bytes += chunk.byteLength;
-      if (bytes > limits.maxOutputBytes) {
-        failure ??= new SandboxError("SANDBOX_LIMIT", "Sandbox output limit exceeded");
-        kill();
-      } else
-        target.push(chunk);
-    };
-    child.stdout.on("data", collect(stdout));
-    child.stderr.on("data", collect(stderr));
-    child.on("error", (error) => {
-      failure ??= new SandboxError("SANDBOX_UNAVAILABLE", "Sandbox process could not start", { cause: error });
-    });
-    child.stdin.on("error", (error) => {
-      if (!(("code" in error) && error.code === "EPIPE")) {
-        failure ??= error;
-        kill();
-      }
-    });
-    child.on("close", (code) => {
-      finished = true;
-      clearTimeout(timer);
-      options.signal?.removeEventListener("abort", abort);
-      if (failure !== undefined)
-        reject(failure);
-      else
-        resolve({
-          exitCode: code ?? 137,
-          stdout: Buffer.concat(stdout),
-          stderr: Buffer.concat(stderr)
-        });
-    });
+    killGraceMs: 0,
+    ...options.stdin !== undefined ? {
+      stdin: typeof options.stdin === "string" ? new TextEncoder().encode(options.stdin) : options.stdin,
+      maxStdinBytes: Math.max(1, typeof options.stdin === "string" ? Buffer.byteLength(options.stdin) : options.stdin.byteLength)
+    } : {}
+  }, onSpawn);
+  const result = command.result.then((result) => ({
+    exitCode: result.exitCode ?? 137,
+    stdout: result.stdout,
+    stderr: result.stderr
+  })).catch((error) => {
+    if (error instanceof NativeCommandError2)
+      throw new SandboxError(error.code === "COMMAND_LIMIT" ? "SANDBOX_LIMIT" : "SANDBOX_UNAVAILABLE", error.message, { cause: error });
+    throw error;
   });
   result.catch(() => {
     return;
   });
-  options.signal?.addEventListener("abort", abort, { once: true });
-  if (options.signal?.aborted)
-    abort();
-  child.stdin.end(options.stdin);
-  return {
-    result,
-    async stop() {
-      kill();
-      await result.then(() => {
-        return;
-      }, () => {
-        return;
-      });
-    }
-  };
+  return { result, stop: command.stop };
 }
 
 // src/agent-runtime/sandbox-process-owner.ts
-import { spawn as spawn2 } from "node:child_process";
+import { spawn } from "node:child_process";
 function sandboxProcessOwner(assertActive, maximum) {
   const children = new Map;
   const admit = () => {
@@ -616,7 +564,7 @@ function sandboxProcessOwner(assertActive, maximum) {
     },
     spawn(input) {
       admit();
-      const child = spawn2(input.executable, [...input.args], {
+      const child = spawn(input.executable, [...input.args], {
         cwd: input.cwd,
         env: input.environment,
         detached: true,

package/dist/entrypoints/agent-runtime.js

@@ -110,7 +110,7 @@ import {
   agentGoalStateSlot2,
   agentTodoStateSlot2,
   createAgentRuntime2
-} from "../index-90ppdx3q.js";
+} from "../index-9jb61j5a.js";
 import {
   AgentConversationSummarySchema2,
   AgentConversationPageSchema2,
@@ -175,7 +175,7 @@ import {
   StepAbortedError2,
   ParkRecordDecodeError2,
   ParkAbortedError2
-} from "../index-5vyd0fkb.js";
+} from "../index-ary5s7k0.js";
 import {
   AgentSandboxRestrictionSchema2,
   AgentSandboxGradeSchema2,

package/dist/entrypoints/application/diagnostic-journal.js

@@ -14,9 +14,10 @@ import {
 import {
   createBoundedChannel2
 } from "../../index-w0eqdhyd.js";
+import"../../index-nybn2err.js";
 import {
   attemptExclusiveLock
-} from "../../index-7kxw1awn.js";
+} from "../../index-ga597cvy.js";
 import {
   isRecord
 } from "../../index-9jfdm5tg.js";

package/dist/entrypoints/cli.js

@@ -30,7 +30,7 @@ import"../index-yex7eg1v.js";
 import"../index-r956rndn.js";
 import {
   writeFileAtomicSync2
-} from "../index-aan6hqb9.js";
+} from "../index-12m2v2a9.js";
 import"../index-dnn9z96q.js";
 import {
   argumentsDigest

package/dist/entrypoints/files.d.ts

@@ -1,6 +1,8 @@
 export { type ManagedFilePath, ManagedFilePathSchema, type ManagedFileRef, ManagedFileRefSchema, } from '../contract/file-ref.js';
+export type { FileObservation } from '../files/boundary.js';
 export { createManagedFileBoundary, type ManagedFileBoundary, type ManagedFileBoundaryConfig, ManagedFileError, type ManagedFileErrorCode, type ManagedFileInspection, type ManagedFileInspectionInput, type ManagedFileInspector, type ManagedFileReadOptions, type ManagedFileSource, type ManagedFileWriteOptions, } from '../files/boundary.js';
 export { CHUNK_SPOOL_ERROR_CODES, type ChunkSpool, type ChunkSpoolAssembly, type ChunkSpoolConfig, type ChunkSpoolErrorCode, type ChunkSpoolKey, type ChunkSpoolOpen, type ChunkSpoolPart, createChunkSpool, isChunkSpoolErrorCode, } from '../files/chunk-spool.js';
 export { type WriteFileAtomicOptions, writeFileAtomic, writeFileAtomicSync, } from '../internal/atomic-file.js';
+export { AtomicFilePublicationError } from '../internal/atomic-publication.js';
 export { type ExclusiveLock, ExclusiveLockError, type ExclusiveLockOptions, type ExclusiveLockOwner, withExclusiveLock, } from '../internal/with-exclusive-lock.js';
 //# sourceMappingURL=files.d.ts.map

package/dist/entrypoints/files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/entrypoints/files.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,cAAc,EACnB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,gBAAgB,EAChB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,uBAAuB,EACvB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,sBAAsB,EAC3B,eAAe,EACf,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,KAAK,aAAa,EAClB,kBAAkB,EAClB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC"}
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/entrypoints/files.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,cAAc,EACnB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EACL,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,gBAAgB,EAChB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,uBAAuB,EACvB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,sBAAsB,EAC3B,eAAe,EACf,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EACL,KAAK,aAAa,EAClB,kBAAkB,EAClB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC"}

package/dist/entrypoints/files.js

@@ -5,17 +5,21 @@ import {
 import {
   ManagedFileError2,
   createManagedFileBoundary2
-} from "../index-v4a2fjtk.js";
+} from "../index-sybedc8b.js";
 import {
   AppError2
 } from "../index-n53mswt3.js";
+import"../index-nybn2err.js";
 import {
   attemptExclusiveLock
-} from "../index-7kxw1awn.js";
+} from "../index-ga597cvy.js";
 import {
   writeFileAtomic2,
   writeFileAtomicSync2
-} from "../index-aan6hqb9.js";
+} from "../index-12m2v2a9.js";
+import {
+  AtomicFilePublicationError2
+} from "../index-8a9ksm91.js";
 // src/files/chunk-spool.ts
 import { createHash, randomBytes } from "node:crypto";
 import {
@@ -297,7 +301,10 @@ function pause(ms, signal) {
 async function withExclusiveLock(path, run, options = {}) {
   const label = options.label ?? path;
   const timeoutMs = nonNegative("timeoutMs", options.timeoutMs, DEFAULT_TIMEOUT_MS);
-  const ownerlessGraceMs = nonNegative("ownerlessGraceMs", options.ownerlessGraceMs, DEFAULT_OWNERLESS_GRACE_MS);
+  const ownerlessGraceMs = options.ownerlessGraceMs === null ? null : nonNegative("ownerlessGraceMs", options.ownerlessGraceMs, DEFAULT_OWNERLESS_GRACE_MS);
+  const mode = options.mode ?? 384;
+  if (!Number.isInteger(mode) || mode < 0 || mode > 511)
+    throw new RangeError("[stitchkit] withExclusiveLock: mode must be permission bits from 0000 to 0777");
   const { signal } = options;
   const deadline = performance.now() + timeoutMs;
   let delay = FIRST_RETRY_MS;
@@ -306,7 +313,7 @@ async function withExclusiveLock(path, run, options = {}) {
       throw new ExclusiveLockError("LOCK_ABORTED", label, null, `[stitchkit] waiting for the lock on "${label}" was cancelled`, { cause: signal.reason });
     }
     const attempt = await attemptExclusiveLock(path, {
-      mode: options.mode ?? 384,
+      mode,
       reclaim: true,
       ownerlessGraceMs,
       ...options.machineIdentity !== undefined && {
@@ -330,13 +337,14 @@ async function withExclusiveLock(path, run, options = {}) {
     const remaining = deadline - performance.now();
     if (remaining <= 0) {
       const holder = attempt.diagnosis?.owner ?? null;
-      throw new ExclusiveLockError("LOCK_TIMEOUT", label, holder, `[stitchkit] the lock on "${label}" is held by ${describeHolder(holder)}${describeEvidence(attempt.diagnosis)}; gave up after ${timeoutMs} ms`, { cause: attempt.error });
+      throw new ExclusiveLockError("LOCK_TIMEOUT", label, holder, `[stitchkit] the lock on "${label}" is held by ${describeHolder(holder)}${describeEvidence(attempt.diagnosis)}; gave up after ${timeoutMs} ms`, { cause: attempt.diagnosis?.cause ?? attempt.error });
     }
     await pause(Math.min(delay * (0.5 + Math.random() / 2), remaining), signal);
     delay = Math.min(delay * 2, MAX_RETRY_MS);
   }
 }
 export {
+  AtomicFilePublicationError2 as AtomicFilePublicationError,
   CHUNK_SPOOL_ERROR_CODES,
   ExclusiveLockError,
   ManagedFileError2 as ManagedFileError,

package/dist/entrypoints/primitives.js

@@ -1,6 +1,12 @@
 import {
   ManagedFileRefSchema2
 } from "../index-xqhede6x.js";
+import {
+  isJsonData
+} from "../index-c1jmtxa0.js";
+import {
+  serializeCanonicalJson
+} from "../index-zsvzhjtk.js";
 
 // src/primitives/audit.ts
 import { z as z2 } from "zod";
@@ -76,14 +82,27 @@ function createAuditRecord(input) {
     payload: { operation: input.operation, change }
   });
 }
-// src/primitives/deadline.ts
+// src/primitives/canonical-json.ts
 import { z as z3 } from "zod";
+var CanonicalJsonOptionsSchema = z3.strictObject({
+  maxDepth: z3.number().int().min(0).max(100).default(100),
+  maxNodes: z3.number().int().positive().default(1e5),
+  maxBytes: z3.number().int().positive().default(1024 * 1024)
+});
+function canonicalJson(value, options = {}) {
+  const limits = CanonicalJsonOptionsSchema.parse(options);
+  if (!isJsonData(value, { ...limits, omitObjectUndefined: true }))
+    throw new TypeError("Expected bounded plain JSON: dense arrays, finite numbers, no -0, cycles or accessors");
+  return serializeCanonicalJson(value);
+}
+// src/primitives/deadline.ts
+import { z as z4 } from "zod";
 var DAY_MS = 86400000;
-var DeadlineResultSchema = z3.object({
-  dueAt: z3.iso.datetime({ offset: true }),
-  remainingDays: z3.number().int(),
-  overdueDays: z3.number().int().nonnegative(),
-  category: z3.string().min(1)
+var DeadlineResultSchema = z4.object({
+  dueAt: z4.iso.datetime({ offset: true }),
+  remainingDays: z4.number().int(),
+  overdueDays: z4.number().int().nonnegative(),
+  category: z4.string().min(1)
 });
 function partsInZone(value, timeZone) {
   const parts = new Intl.DateTimeFormat("en-CA", {
@@ -163,26 +182,26 @@ function defineDeadlinePolicy(config) {
   });
 }
 // src/primitives/delivery.ts
-import { z as z4 } from "zod";
-var DomainEventDestinationSchema = z4.object({
-  id: z4.string().min(1),
-  transport: z4.string().min(1),
-  address: z4.string().min(1)
+import { z as z5 } from "zod";
+var DomainEventDestinationSchema = z5.object({
+  id: z5.string().min(1),
+  transport: z5.string().min(1),
+  address: z5.string().min(1)
 });
-var DomainEventDeliveryOutcomeSchema = z4.discriminatedUnion("outcome", [
-  z4.object({ outcome: z4.literal("delivered"), receipt: z4.string().min(1).optional() }),
-  z4.object({
-    outcome: z4.literal("retryable"),
-    code: z4.string().min(1),
-    retryAt: z4.iso.datetime({ offset: true })
+var DomainEventDeliveryOutcomeSchema = z5.discriminatedUnion("outcome", [
+  z5.object({ outcome: z5.literal("delivered"), receipt: z5.string().min(1).optional() }),
+  z5.object({
+    outcome: z5.literal("retryable"),
+    code: z5.string().min(1),
+    retryAt: z5.iso.datetime({ offset: true })
   }),
-  z4.object({ outcome: z4.literal("terminal"), code: z4.string().min(1) }),
-  z4.object({ outcome: z4.literal("unknown"), code: z4.string().min(1) })
+  z5.object({ outcome: z5.literal("terminal"), code: z5.string().min(1) }),
+  z5.object({ outcome: z5.literal("unknown"), code: z5.string().min(1) })
 ]);
-var DomainEventDeliveryClaimSchema = z4.object({
+var DomainEventDeliveryClaimSchema = z5.object({
   event: DomainEventSchema,
   destination: DomainEventDestinationSchema,
-  attempt: z4.number().int().positive()
+  attempt: z5.number().int().positive()
 });
 function defineDomainEventDelivery(config) {
   const maxClaims = config.maxClaimsPerDispatch ?? 100;
@@ -244,17 +263,17 @@ function defineDomainEventDelivery(config) {
   });
 }
 // src/primitives/export-operation.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 function createExportResultSchema(operationId) {
-  return z5.discriminatedUnion("state", [
-    z5.object({
-      state: z5.literal("ready"),
+  return z6.discriminatedUnion("state", [
+    z6.object({
+      state: z6.literal("ready"),
       file: ManagedFileRefSchema2.extend({
-        mediaType: z5.string().min(1),
-        name: z5.string().min(1)
+        mediaType: z6.string().min(1),
+        name: z6.string().min(1)
       })
     }),
-    z5.object({ state: z5.literal("pending"), operationId })
+    z6.object({ state: z6.literal("pending"), operationId })
   ]);
 }
 function defineExportOperation(config) {
@@ -288,20 +307,20 @@ function defineExportOperation(config) {
   });
 }
 // src/primitives/lifecycle.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 var lifecycleStateBrand = Symbol("stitchkit.lifecycle.state");
-var LifecycleTransitionEventSchema = z6.object({
-  id: z6.string().min(1),
-  type: z6.literal("lifecycle.transitioned"),
-  occurredAt: z6.iso.datetime({ offset: true }),
-  actor: z6.object({ id: z6.string().min(1), role: z6.string().min(1) }),
-  subject: z6.object({ type: z6.string().min(1), id: z6.string().min(1) }),
-  payload: z6.object({
-    lifecycle: z6.string().min(1),
-    transition: z6.string().min(1),
-    from: z6.string().min(1),
-    to: z6.string().min(1),
-    data: z6.unknown()
+var LifecycleTransitionEventSchema = z7.object({
+  id: z7.string().min(1),
+  type: z7.literal("lifecycle.transitioned"),
+  occurredAt: z7.iso.datetime({ offset: true }),
+  actor: z7.object({ id: z7.string().min(1), role: z7.string().min(1) }),
+  subject: z7.object({ type: z7.string().min(1), id: z7.string().min(1) }),
+  payload: z7.object({
+    lifecycle: z7.string().min(1),
+    transition: z7.string().min(1),
+    from: z7.string().min(1),
+    to: z7.string().min(1),
+    data: z7.unknown()
   })
 });
 function stateMatches(expected, actual) {
@@ -433,12 +452,12 @@ function scanOwnerFilterRisks(sources, ownerKeys = ["ownerId"]) {
   return risks;
 }
 // src/primitives/money.ts
-import { z as z7 } from "zod";
-var IntegerStringSchema = z7.string().regex(/^-?(?:0|[1-9]\d*)$/);
+import { z as z8 } from "zod";
+var IntegerStringSchema = z8.string().regex(/^-?(?:0|[1-9]\d*)$/);
 function createMoneySchema(currency) {
-  return z7.object({
+  return z8.object({
     minor: IntegerStringSchema,
-    currency: z7.literal(currency)
+    currency: z8.literal(currency)
   });
 }
 function parseMinor(value) {
@@ -577,7 +596,7 @@ function definePermissionMatrix(config) {
   });
 }
 // src/primitives/quantity.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 
 // src/primitives/decimal.ts
 var DECIMAL_PATTERN = /^-?(?:0|[1-9]\d*)(?:\.\d+)?$/;
@@ -631,7 +650,7 @@ function multiplyDecimalRatio(value, numerator, denominator) {
 }
 
 // src/primitives/quantity.ts
-var DecimalStringSchema = z8.string().refine((value) => {
+var DecimalStringSchema = z9.string().refine((value) => {
   try {
     return formatDecimal(parseDecimal(value)) === value;
   } catch {
@@ -639,7 +658,7 @@ var DecimalStringSchema = z8.string().refine((value) => {
   }
 }, "expected a canonical decimal string");
 function createQuantitySchema(unit) {
-  return z8.object({ value: DecimalStringSchema, unit: z8.literal(unit) });
+  return z9.object({ value: DecimalStringSchema, unit: z9.literal(unit) });
 }
 function quantity(value, unit) {
   return Object.freeze({ value: formatDecimal(parseDecimal(value)), unit });
@@ -653,16 +672,16 @@ function addQuantity(left, right) {
   }
   return quantity(formatDecimal(addDecimal(parseDecimal(left.value), parseDecimal(right.value))), left.unit);
 }
-var QuantityProjectionSchema = z8.discriminatedUnion("kind", [
-  z8.object({
-    kind: z8.literal("recorded"),
-    quantity: z8.object({ value: DecimalStringSchema, unit: z8.string().min(1) })
+var QuantityProjectionSchema = z9.discriminatedUnion("kind", [
+  z9.object({
+    kind: z9.literal("recorded"),
+    quantity: z9.object({ value: DecimalStringSchema, unit: z9.string().min(1) })
   }),
-  z8.object({
-    kind: z8.literal("derived"),
-    quantity: z8.object({ value: DecimalStringSchema, unit: z8.string().min(1) }),
-    source: z8.object({ value: DecimalStringSchema, unit: z8.string().min(1) }),
-    conversionId: z8.string().min(1)
+  z9.object({
+    kind: z9.literal("derived"),
+    quantity: z9.object({ value: DecimalStringSchema, unit: z9.string().min(1) }),
+    source: z9.object({ value: DecimalStringSchema, unit: z9.string().min(1) }),
+    conversionId: z9.string().min(1)
   })
 ]);
 function defineUnitSystem(config) {
@@ -727,6 +746,7 @@ export {
   addQuantity,
   assertAuditDeclared,
   audit,
+  canonicalJson,
   createAuditRecord,
   createDomainEventSchema,
   createExportResultSchema,