stitchkit 0.104.2 → 0.105.1

package/dist/tools/schema/coerce.d.ts

@@ -8,6 +8,10 @@ import { z } from 'zod';
  * is repaired, not just a top-level field. The transform touches the **arguments**
  * only — it never rebuilds a schema, so it cannot alter what an object does with
  * an undeclared key (→ ADR 0034).
+ *
+ * A string that a union keeps as a string but that parses to an array the union's
+ * array member accepts is not repaired: it throws a `ZodError` naming the field,
+ * which every tool surface reports as a validation error.
  */
 export declare function coerceJsonArgs(args: Record<string, unknown>, schema: z.ZodType | undefined): Record<string, unknown>;
 //# sourceMappingURL=coerce.d.ts.map

package/dist/tools/schema/coerce.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coerce.d.ts","sourceRoot":"","sources":["../../../src/tools/schema/coerce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAuHxB;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,SAAS,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGzB"}
+{"version":3,"file":"coerce.d.ts","sourceRoot":"","sources":["../../../src/tools/schema/coerce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA2KxB;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,SAAS,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGzB"}

package/dist/tools/schema/flatten-join.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flatten-join.d.ts","sourceRoot":"","sources":["../../../src/tools/schema/flatten-join.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAExD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,sBAAsB,CAAC;IAC/B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAsED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,EAAE,GAAG,IAAI,CAK5E;AAsKD,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,eAAe,EAAE,EAC7B,aAAa,EAAE,MAAM,GACpB,sBAAsB,CAiCxB"}
+{"version":3,"file":"flatten-join.d.ts","sourceRoot":"","sources":["../../../src/tools/schema/flatten-join.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAExD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,sBAAsB,CAAC;IAC/B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAsED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,EAAE,GAAG,IAAI,CAK5E;AAqKD,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,eAAe,EAAE,EAC7B,aAAa,EAAE,MAAM,GACpB,sBAAsB,CAiCxB"}

package/dist/tools/surface.d.ts

@@ -1,12 +1,8 @@
 import type { ToolTransport } from '../contract/define.js';
 import { type ProjectedTool, type ToolSurfaceProjection } from './internal/surface-projector.js';
 import { type CollectToolsConfig, type MountableTool } from './mount.js';
-import { type RuntimeToolDefinition } from './runtime-tool.js';
-import type { RuntimeToolExecution } from './runtime-tool-execution.js';
-/** Contract and pathless runtime operations that form one tool surface. */
-export interface ToolSurfaceDefinition<TRuntime extends RuntimeToolExecution = RuntimeToolDefinition> extends ToolSurfaceProjection<TRuntime> {
-}
-interface CollectedContractTool<TRuntime extends RuntimeToolExecution> {
+import type { RuntimeToolDefinition } from './runtime-tool-declaration.js';
+interface CollectedContractTool<TRuntime extends RuntimeToolDefinition> {
     kind: 'contract';
     service: string;
     action: string;
@@ -15,7 +11,7 @@ interface CollectedContractTool<TRuntime extends RuntimeToolExecution> {
         kind: 'contract';
     }>;
 }
-interface CollectedRuntimeTool<TRuntime extends RuntimeToolExecution> {
+interface CollectedRuntimeTool<TRuntime extends RuntimeToolDefinition> {
     kind: 'runtime';
     service: string;
     action: string;
@@ -25,9 +21,9 @@ interface CollectedRuntimeTool<TRuntime extends RuntimeToolExecution> {
         kind: 'runtime';
     }>;
 }
-export type CollectedToolSurfaceEntry<TRuntime extends RuntimeToolExecution = RuntimeToolDefinition> = CollectedContractTool<TRuntime> | CollectedRuntimeTool<TRuntime>;
-export interface CollectToolSurfaceConfig<TRuntime extends RuntimeToolExecution = RuntimeToolDefinition> extends CollectToolsConfig {
-    surface: ToolSurfaceDefinition<TRuntime>;
+export type CollectedToolSurfaceEntry<TRuntime extends RuntimeToolDefinition = RuntimeToolDefinition> = CollectedContractTool<TRuntime> | CollectedRuntimeTool<TRuntime>;
+export interface CollectToolSurfaceConfig<TRuntime extends RuntimeToolDefinition = RuntimeToolDefinition> extends CollectToolsConfig {
+    surface: ToolSurfaceProjection<TRuntime>;
     transport: ToolTransport;
     /** Diagnostics disable this so they can report a broken surface. Default: true. */
     assertUniqueNames?: boolean;
@@ -36,6 +32,6 @@ export interface CollectToolSurfaceConfig<TRuntime extends RuntimeToolExecution
  * Resolve contracts and runtime definitions in their real mount order through
  * the same name, exposure and presentation-schema machinery as the mounts.
  */
-export declare function collectToolSurface<TRuntime extends RuntimeToolExecution>({ surface, transport, assertUniqueNames, ...collectConfig }: CollectToolSurfaceConfig<TRuntime>): CollectedToolSurfaceEntry<TRuntime>[];
+export declare function collectToolSurface<TRuntime extends RuntimeToolDefinition>({ surface, transport, assertUniqueNames, ...collectConfig }: CollectToolSurfaceConfig<TRuntime>): CollectedToolSurfaceEntry<TRuntime>[];
 export {};
 //# sourceMappingURL=surface.d.ts.map

package/dist/tools/surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"surface.d.ts","sourceRoot":"","sources":["../../src/tools/surface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EACL,KAAK,aAAa,EAElB,KAAK,qBAAqB,EAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,KAAK,kBAAkB,EAAyB,KAAK,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7F,OAAO,EAAE,KAAK,qBAAqB,EAAwB,MAAM,gBAAgB,CAAC;AAClF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAErE,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB,CACpC,QAAQ,SAAS,oBAAoB,GAAG,qBAAqB,CAC7D,SAAQ,qBAAqB,CAAC,QAAQ,CAAC;CAAG;AAE5C,UAAU,qBAAqB,CAAC,QAAQ,SAAS,oBAAoB;IACnE,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,aAAa,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;CACpE;AAED,UAAU,oBAAoB,CAAC,QAAQ,SAAS,oBAAoB;IAClE,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,aAAa,CAAC;IACzB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,SAAS,CAAA;KAAE,CAAC,CAAC;CACnE;AAED,MAAM,MAAM,yBAAyB,CACnC,QAAQ,SAAS,oBAAoB,GAAG,qBAAqB,IAC3D,qBAAqB,CAAC,QAAQ,CAAC,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AAErE,MAAM,WAAW,wBAAwB,CACvC,QAAQ,SAAS,oBAAoB,GAAG,qBAAqB,CAC7D,SAAQ,kBAAkB;IAC1B,OAAO,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACzC,SAAS,EAAE,aAAa,CAAC;IACzB,mFAAmF;IACnF,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,SAAS,oBAAoB,EAAE,EACxE,OAAO,EACP,SAAS,EACT,iBAAwB,EACxB,GAAG,aAAa,EACjB,EAAE,wBAAwB,CAAC,QAAQ,CAAC,GAAG,yBAAyB,CAAC,QAAQ,CAAC,EAAE,CAkC5E"}
+{"version":3,"file":"surface.d.ts","sourceRoot":"","sources":["../../src/tools/surface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EACL,KAAK,aAAa,EAElB,KAAK,qBAAqB,EAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,KAAK,kBAAkB,EAAyB,KAAK,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE,UAAU,qBAAqB,CAAC,QAAQ,SAAS,qBAAqB;IACpE,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,aAAa,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;CACpE;AAED,UAAU,oBAAoB,CAAC,QAAQ,SAAS,qBAAqB;IACnE,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,aAAa,CAAC;IACzB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,SAAS,CAAA;KAAE,CAAC,CAAC;CACnE;AAED,MAAM,MAAM,yBAAyB,CACnC,QAAQ,SAAS,qBAAqB,GAAG,qBAAqB,IAC5D,qBAAqB,CAAC,QAAQ,CAAC,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AAErE,MAAM,WAAW,wBAAwB,CACvC,QAAQ,SAAS,qBAAqB,GAAG,qBAAqB,CAC9D,SAAQ,kBAAkB;IAC1B,OAAO,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACzC,SAAS,EAAE,aAAa,CAAC;IACzB,mFAAmF;IACnF,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,SAAS,qBAAqB,EAAE,EACzE,OAAO,EACP,SAAS,EACT,iBAAwB,EACxB,GAAG,aAAa,EACjB,EAAE,wBAAwB,CAAC,QAAQ,CAAC,GAAG,yBAAyB,CAAC,QAAQ,CAAC,EAAE,CAkC5E"}

package/dist/tools/transfer/define-download-tool.d.ts

@@ -14,5 +14,5 @@ export interface DefineDownloadToolConfig<TInput extends ZodObject> extends Mana
     present?: RuntimeToolPresenters<z.output<typeof ManagedFileRefSchema>>;
 }
 /** Define one guarded managed download operation. */
-export declare function defineDownloadTool<TInput extends ZodObject>(config: DefineDownloadToolConfig<TInput>): RuntimeToolDefinitionWithOutput<TInput, typeof ManagedFileRefSchema>;
+export declare function defineDownloadTool<TInput extends ZodObject>(config: DefineDownloadToolConfig<TInput>): RuntimeToolDefinitionWithOutput<TInput, typeof ManagedFileRefSchema, undefined, RuntimeToolPresenters<z.output<typeof ManagedFileRefSchema>>>;
 //# sourceMappingURL=define-download-tool.d.ts.map

package/dist/tools/transfer/define-download-tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define-download-tool.d.ts","sourceRoot":"","sources":["../../../src/tools/transfer/define-download-tool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExC,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,KAAK,uBAAuB,EAAyB,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAEL,KAAK,+BAA+B,EACpC,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAC;AAIzB,MAAM,WAAW,wBAAwB,CAAC,MAAM,SAAS,SAAS,CAChE,SAAQ,uBAAuB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,CACV,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EACvB,OAAO,EAAE,yBAAyB,CAAC,MAAM,CAAC,KACvC,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5C,KAAK,EAAE,mBAAmB,CAAC;IAC3B,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,GAAG,SAAS,CAAC;IAChE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAC;CACxE;AAED,qDAAqD;AACrD,wBAAgB,kBAAkB,CAAC,MAAM,SAAS,SAAS,EACzD,MAAM,EAAE,wBAAwB,CAAC,MAAM,CAAC,GACvC,+BAA+B,CAAC,MAAM,EAAE,OAAO,oBAAoB,CAAC,CAmCtE"}
+{"version":3,"file":"define-download-tool.d.ts","sourceRoot":"","sources":["../../../src/tools/transfer/define-download-tool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExC,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,KAAK,uBAAuB,EAAyB,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAEL,KAAK,+BAA+B,EACpC,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAC;AAIzB,MAAM,WAAW,wBAAwB,CAAC,MAAM,SAAS,SAAS,CAChE,SAAQ,uBAAuB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,CACV,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EACvB,OAAO,EAAE,yBAAyB,CAAC,MAAM,CAAC,KACvC,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5C,KAAK,EAAE,mBAAmB,CAAC;IAC3B,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,GAAG,SAAS,CAAC;IAChE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAC;CACxE;AAED,qDAAqD;AACrD,wBAAgB,kBAAkB,CAAC,MAAM,SAAS,SAAS,EACzD,MAAM,EAAE,wBAAwB,CAAC,MAAM,CAAC,GACvC,+BAA+B,CAChC,MAAM,EACN,OAAO,oBAAoB,EAC3B,SAAS,EACT,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAC7D,CAyCA"}

package/dist/tools/transfer/define-upload-tool.d.ts

@@ -12,5 +12,5 @@ export interface DefineUploadToolConfig<TOutput extends ZodType> extends Managed
     present?: RuntimeToolPresenters<z.output<TOutput>>;
 }
 /** Define one managed local-file upload operation. */
-export declare function defineUploadTool<TOutput extends ZodType>(config: DefineUploadToolConfig<TOutput>): RuntimeToolDefinitionWithOutput<typeof UploadToolInputSchema, TOutput>;
+export declare function defineUploadTool<TOutput extends ZodType>(config: DefineUploadToolConfig<TOutput>): RuntimeToolDefinitionWithOutput<typeof UploadToolInputSchema, TOutput, undefined, RuntimeToolPresenters<z.output<TOutput>>>;
 //# sourceMappingURL=define-upload-tool.d.ts.map

package/dist/tools/transfer/define-upload-tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define-upload-tool.d.ts","sourceRoot":"","sources":["../../../src/tools/transfer/define-upload-tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAEtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,KAAK,uBAAuB,EAAyB,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAEL,KAAK,+BAA+B,EACpC,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAC;AAIzB,eAAO,MAAM,qBAAqB;;iBAEhC,CAAC;AAEH,MAAM,WAAW,sBAAsB,CAAC,OAAO,SAAS,OAAO,CAC7D,SAAQ,uBAAuB;IAC/B,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,MAAM,EAAE,CACN,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,yBAAyB,CAAC,OAAO,qBAAqB,CAAC,KAC7D,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,EAAE,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;CACpD;AAED,sDAAsD;AACtD,wBAAgB,gBAAgB,CAAC,OAAO,SAAS,OAAO,EACtD,MAAM,EAAE,sBAAsB,CAAC,OAAO,CAAC,GACtC,+BAA+B,CAAC,OAAO,qBAAqB,EAAE,OAAO,CAAC,CAyBxE"}
+{"version":3,"file":"define-upload-tool.d.ts","sourceRoot":"","sources":["../../../src/tools/transfer/define-upload-tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAEtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,KAAK,uBAAuB,EAAyB,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAEL,KAAK,+BAA+B,EACpC,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAC;AAIzB,eAAO,MAAM,qBAAqB;;iBAEhC,CAAC;AAEH,MAAM,WAAW,sBAAsB,CAAC,OAAO,SAAS,OAAO,CAC7D,SAAQ,uBAAuB;IAC/B,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,MAAM,EAAE,CACN,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,yBAAyB,CAAC,OAAO,qBAAqB,CAAC,KAC7D,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,EAAE,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;CACpD;AAED,sDAAsD;AACtD,wBAAgB,gBAAgB,CAAC,OAAO,SAAS,OAAO,EACtD,MAAM,EAAE,sBAAsB,CAAC,OAAO,CAAC,GACtC,+BAA+B,CAChC,OAAO,qBAAqB,EAC5B,OAAO,EACP,SAAS,EACT,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CACzC,CAyBA"}

package/dist/tools/transfer/define-view-file-tool.d.ts

@@ -6,5 +6,5 @@ export interface DefineViewFileToolConfig extends ManagedNativeToolConfig, ViewF
     present?: RuntimeToolPresenters<z.output<typeof ViewFileOutputSchema>>;
 }
 /** Define one protected managed multimodal media-inspection operation. */
-export declare function defineViewFileTool(config: DefineViewFileToolConfig): RuntimeToolDefinitionWithOutput<typeof ViewFileInputSchema, typeof ViewFileOutputSchema>;
+export declare function defineViewFileTool(config: DefineViewFileToolConfig): RuntimeToolDefinitionWithOutput<typeof ViewFileInputSchema, typeof ViewFileOutputSchema, undefined, RuntimeToolPresenters<z.output<typeof ViewFileOutputSchema>>>;
 //# sourceMappingURL=define-view-file-tool.d.ts.map

package/dist/tools/transfer/define-view-file-tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define-view-file-tool.d.ts","sourceRoot":"","sources":["../../../src/tools/transfer/define-view-file-tool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,EAAE,KAAK,uBAAuB,EAAyB,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAIL,KAAK,+BAA+B,EACpC,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,mBAAmB,EACnB,KAAK,eAAe,EACpB,oBAAoB,EACrB,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,wBAAyB,SAAQ,uBAAuB,EAAE,eAAe;IACxF,OAAO,CAAC,EAAE,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAC;CACxE;AAED,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,wBAAwB,GAC/B,+BAA+B,CAAC,OAAO,mBAAmB,EAAE,OAAO,oBAAoB,CAAC,CAwC1F"}
+{"version":3,"file":"define-view-file-tool.d.ts","sourceRoot":"","sources":["../../../src/tools/transfer/define-view-file-tool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,EAAE,KAAK,uBAAuB,EAAyB,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAIL,KAAK,+BAA+B,EACpC,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,mBAAmB,EACnB,KAAK,eAAe,EACpB,oBAAoB,EACrB,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,wBAAyB,SAAQ,uBAAuB,EAAE,eAAe;IACxF,OAAO,CAAC,EAAE,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAC;CACxE;AAED,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,wBAAwB,GAC/B,+BAA+B,CAChC,OAAO,mBAAmB,EAC1B,OAAO,oBAAoB,EAC3B,SAAS,EACT,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAC7D,CAwCA"}

package/dist/tools/transfer/managed-file-error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"managed-file-error.d.ts","sourceRoot":"","sources":["../../../src/tools/transfer/managed-file-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAuB,MAAM,uBAAuB,CAAC;AAmBtE,yFAAyF;AACzF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,CAyBnE;AAED,kGAAkG;AAClG,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,CAE/D"}
+{"version":3,"file":"managed-file-error.d.ts","sourceRoot":"","sources":["../../../src/tools/transfer/managed-file-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAuB,MAAM,uBAAuB,CAAC;AAmBtE,yFAAyF;AACzF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,CAiCnE;AAED,kGAAkG;AAClG,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,CAE/D"}

package/dist/tools/transfer/view-file-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"view-file-contract.d.ts","sourceRoot":"","sources":["../../../src/tools/transfer/view-file-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,qFAAqF;AACrF,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;;;;iBAG/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;2BAchC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,mBAAmB;;;iBAG9B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAgBlE,eAAO,MAAM,mBAAmB;;iBAM9B,CAAC"}
+{"version":3,"file":"view-file-contract.d.ts","sourceRoot":"","sources":["../../../src/tools/transfer/view-file-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,qFAAqF;AACrF,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;;;;iBAG/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;2BAchC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,mBAAmB;;;iBAG9B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,mBAAmB;;iBAM9B,CAAC"}

package/dist/tools/transfer/view-file.d.ts

@@ -13,7 +13,7 @@
  * sandboxed to a `baseDir`, and downloads are capped before they reach memory.
  */
 import type { McpServer } from '@modelcontextprotocol/server';
-import type { z } from 'zod';
+import { z } from 'zod';
 import type { McpMediaContent, ViewFileOutput } from './view-file-contract.js';
 import { ViewFileInputSchema } from './view-file-contract.js';
 export { type McpAnnotations, McpAnnotationsSchema, type McpMediaContent, McpMediaContentSchema, ViewFileErrorSchema, ViewFileInputSchema, type ViewFileOutput, ViewFileOutputSchema, } from './view-file-contract.js';

package/dist/tools/transfer/view-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"view-file.d.ts","sourceRoot":"","sources":["../../../src/tools/transfer/view-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAwB,MAAM,sBAAsB,CAAC;AAEjF,OAAO,EACL,KAAK,cAAc,EACnB,oBAAoB,EACpB,KAAK,eAAe,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,cAAc,EACnB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,KAAK,mBAAmB,EAAoB,MAAM,sBAAsB,CAAC;AAwBlF,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,KAAK,CAAC,EAAE,mBAAmB,CAAC;IAC5B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAyKD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,eAAe,EAAE,CAAC,CAE5B;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC,OAAO,CAAC,EACpD,OAAO,GAAE,eAAoB,EAC7B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,cAAc,CAAC,CAuBzB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,GAAE,eAAoB,GAAG,IAAI,CAgBpF"}
+{"version":3,"file":"view-file.d.ts","sourceRoot":"","sources":["../../../src/tools/transfer/view-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAwB,MAAM,sBAAsB,CAAC;AAEjF,OAAO,EACL,KAAK,cAAc,EACnB,oBAAoB,EACpB,KAAK,eAAe,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,cAAc,EACnB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,KAAK,mBAAmB,EAAoB,MAAM,sBAAsB,CAAC;AA0BlF,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,KAAK,CAAC,EAAE,mBAAmB,CAAC;IAC5B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAwKD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,eAAe,EAAE,CAAC,CAE5B;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC,OAAO,CAAC,EACpD,OAAO,GAAE,eAAoB,EAC7B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,cAAc,CAAC,CAuBzB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,GAAE,eAAoB,GAAG,IAAI,CAyBpF"}

package/dist/tools/transports.d.ts

@@ -8,7 +8,8 @@
  * definitions cannot disappear from the boot diagnostic.
  */
 import type { Transport } from '../contract/define.js';
-import { type ToolSurfaceDefinition } from './surface.js';
+import type { ToolSurfaceProjection } from './internal/surface-projector.js';
+import type { RuntimeToolDefinition } from './runtime-tool-declaration.js';
 /** Operation counts per transport, for one service or the whole fleet. */
 export type TransportCounts = Record<Transport, number>;
 /** The result of `summarizeTransports`. */
@@ -26,5 +27,5 @@ export interface TransportSummary {
         counts: TransportCounts;
     }>;
 }
-export declare function summarizeTransports(surface: ToolSurfaceDefinition): TransportSummary;
+export declare function summarizeTransports(surface: ToolSurfaceProjection<RuntimeToolDefinition>): TransportSummary;
 //# sourceMappingURL=transports.d.ts.map

package/dist/tools/transports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transports.d.ts","sourceRoot":"","sources":["../../src/tools/transports.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAIpD,OAAO,EAAsB,KAAK,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAE3E,0EAA0E;AAC1E,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAExD,2CAA2C;AAC3C,MAAM,WAAW,gBAAgB;IAC/B,8CAA8C;IAC9C,gBAAgB,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,MAAM,EAAE,eAAe,CAAC;IACxB,iFAAiF;IACjF,OAAO,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,UAAU,GAAG,SAAS,CAAC;QAC7B,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,eAAe,CAAC;KACzB,CAAC,CAAC;CACJ;AAwCD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,qBAAqB,GAAG,gBAAgB,CA6BpF"}
+{"version":3,"file":"transports.d.ts","sourceRoot":"","sources":["../../src/tools/transports.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAGpD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAGxE,0EAA0E;AAC1E,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAExD,2CAA2C;AAC3C,MAAM,WAAW,gBAAgB;IAC/B,8CAA8C;IAC9C,gBAAgB,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,MAAM,EAAE,eAAe,CAAC;IACxB,iFAAiF;IACjF,OAAO,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,UAAU,GAAG,SAAS,CAAC;QAC7B,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,eAAe,CAAC;KACzB,CAAC,CAAC;CACJ;AAwCD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,qBAAqB,CAAC,qBAAqB,CAAC,GACpD,gBAAgB,CA6BlB"}

package/llms/agent-runtime-browser.txt

@@ -21,7 +21,10 @@ terminal and provider-envelope schemas/types listed under
 including `AgentAttemptResetEventSchema` for `attempt-reset`),
 `AgentRuntimeEventCursorSchema`, `advanceAgentRuntimeEventCursor`,
 `AgentControlRequestSchema` / `AgentControlRequest`, `AgentControlResponseSchema` /
-`AgentControlResponse`, `AgentControlDeliverySchema` / `AgentControlDelivery`, `AgentMultiSessionCursorSchema` /
+`AgentControlResponse`, `AgentControlDeliverySchema` / `AgentControlDelivery`,
+`AgentControlErrorCodeSchema` / `AgentControlErrorCode` (the one vocabulary of every control
+error code: `FORBIDDEN`, `CONNECTION_CLOSED`, `REQUEST_CAPACITY`, `ATTACHMENT_CAPACITY`,
+`LEASE_CONFLICT`, `EVENT_OVERFLOW` and the rest), `AgentMultiSessionCursorSchema` /
 `AgentMultiSessionCursor`, `AgentConversationView`, `AgentControlView`,
 `advanceAgentMultiSessionCursor`, `createAgentControlView`, `reduceAgentControlSnapshot`,
 `reduceAgentControlEvent` and
@@ -51,9 +54,12 @@ attachment per conversation on that transport; share the controller between view
 `submit` requires a caller-owned idempotency key. Unknown-outcome mutations are never
 replayed automatically. `AgentControllerState` distinguishes connecting, ready,
 disconnected, error and closed and retains the canonical full `view` plus safe error
-code/message. Errors in automatic attach/refresh appear there. Reconnect attaches again
-and reads a snapshot; snapshot gaps coalesce, stale generations cannot overwrite state,
-and buffers/queues are bounded. Overflow or failed refresh is visible and requires
+code/message. Errors in automatic attach/refresh appear there, and so does an
+`access-denied` delivery: the server detached the conversation, the state becomes
+`error` with code `FORBIDDEN`, and nothing arrives until the controller attaches again.
+Reconnect attaches again and reads a snapshot; requests of the previous connection are
+rejected at once and release their capacity, snapshot gaps coalesce, stale generations
+cannot overwrite state, and buffers/queues are bounded. Overflow or failed refresh is visible and requires
 explicit recovery. Closing detaches without closing the shared transport or remote run.
 
 See [agent composition](../guide/agent-composition.md) for a complete wiring example.

package/llms/agent-runtime-harness.txt

@@ -12,20 +12,6 @@ Also read:
 # Guide: Agent composition  (docs/guide/agent-composition.md)
 ==============================================================================
 
----
-title: "Agent composition without a second runtime"
-description: "Compose contract tools, authenticated realtime control, React views and exact-run behavioral checks."
-type: architecture
-status: active
-created: 2026-09-30 22:45 +07:00
-updated: 2026-09-30 23:03 +07:00
-participants:
-  - role: authored
-    harness: Codex
-    model: GPT-6
-    at: 2026-09-30 22:45 +07:00
----
-
 # Compose an agent application
 
 Use these pieces when an application wants the existing headless harness and a generic
@@ -41,7 +27,7 @@ import {
   createAgentHarnessFileResources,
   createHeadlessAgentHarness,
 } from 'stitchkit/agent-runtime/harness';
-import { createAgentHarnessTools } from 'stitchkit/agent-runtime/harness-tools';
+import { composeToolLifecycle, mountAgent } from 'stitchkit/tools';
 
 const resources = createAgentHarnessFileResources({
   roots: [{ id: 'guide', kind: 'instruction', path: instructionRoot }],
@@ -50,27 +36,31 @@ const resources = createAgentHarnessFileResources({
 const harness = createHeadlessAgentHarness({
   protocol, store, models, promptBudget,
   resources,
-  tools: createAgentHarnessTools(({ context, run }) => ({
-    services: [catalogService],
-    context: { ...context, messageId: run.assistantMessageId },
-    runtimeTools: resources.runtimeTools,
-    lifecycle: authorizeTools,
-    hooks: observeTools,
-  })),
+  tools: ({ context, run, toolFenceLifecycle }) =>
+    mountAgent([catalogService], {
+      context: { ...context, messageId: run.assistantMessageId },
+      runtimeTools: resources.runtimeTools,
+      lifecycle: composeToolLifecycle(authorizeTools, toolFenceLifecycle),
+      hooks: observeTools,
+    }),
 });
 ```
 
-The factory composes application authorization then the runtime fence through `mountAgent`.
-The optional harness-tools leaf preserves the complete tool types, including MCP presenter
-declarations; install the same `ai` and `@modelcontextprotocol/server` peers as for
-`stitchkit/tools`. The base harness stays AI-only. Every mount option remains available, including registry, runtime tools, extension,
-coercion, output stripping, hooks and durability. Async per-run configuration is supported.
-The original tools callback still accepts arbitrary typed AI SDK tools and prepareStep.
+`tools` is called for each run with its validated context. Mount through `mountAgent` and
+compose your authorization with the run's `toolFenceLifecycle` by `composeToolLifecycle`: the
+fence rejects a call from a run that no longer owns the conversation, and it must run exactly
+once. Every mount option remains available, including registry, runtime tools, extension,
+coercion, output stripping, hooks and durability, and the callback may be async. The same callback
+still accepts arbitrary typed AI SDK tools and prepareStep. `stitchkit/tools` needs the same `ai` and
+`@modelcontextprotocol/server` peers as any `mountAgent` use; the base harness stays AI-only.
 The resource reader is explicitly selected: filtered allowlists do not gain tools merely
 because a loader exists. Root IDs, kinds, provenance and limits are unchanged.
 
 ## Server and browser
 
+`stitchkit/agent-runtime/realtime` and `stitchkit/agent-runtime/react` are evolving and
+experimental: no application has committed to them yet, so expect their shape to change.
+
 ```ts
 import { bindAgentHarnessRealtime } from 'stitchkit/agent-runtime/realtime';
 
@@ -82,11 +72,19 @@ const binding = bindAgentHarnessRealtime(harness, socket, {
   },
   onError: reportServerError,
 });
+
+// When an application withdraws someone's access, tell the binding.
+await removeMember(conversationId, userId);
+binding.revoke(conversationId, (identity) => identity.userId === userId);
 ```
 
 `socket` is the existing `createSocketIOServer` handle, attached to `createServer` (Bun)
-or the Node adapter. The access policy checks every operation, file/reference and metadata
-as well as snapshot/event reads. Session handshake authentication alone is insufficient.
+or the Node adapter. The access policy checks every request, file/reference and metadata, and
+the attach that opens a stream. Events then flow under that grant without a call per token;
+Without a `revoke()` call a grant lasts until the socket disconnects or the conversation is detached: events keep flowing even if your own permission data changed. That fail-open default is deliberate (one check per request, not one per token), so call `revoke` whenever access is withdrawn. `revoke` ends the grant, the next event is re-authorized (`source: 'delivery'`), and a refusal
+or failure detaches the conversation and delivers `access-denied`, which puts the controller in
+`error` with code `FORBIDDEN` instead of leaving a frozen view. Session handshake
+authentication alone is insufficient.
 Conversation ownership and observer/controller roles are application policy; the canonical
 control server additionally enforces its exclusive controller lease.
 
@@ -124,7 +122,10 @@ view does not interrupt its remote run. Use explicit `interrupt` for cancellatio
 Reconnect reattaches and reads durable state. Mutations are not retried automatically:
 if an acknowledgement is lost, retain the original idempotency key. Incoming event
 buffers and outgoing requests have finite limits; capacity/overflow/lease failures stay
-visible. A server overflow deliberately disconnects the transport; reconnect explicitly.
+visible, each with a code from the one `AgentControlErrorCode` vocabulary. A reconnect
+rejects the requests of the previous connection at once and attaches again, so they
+cannot hold capacity the new attach needs. A server overflow deliberately disconnects the
+transport; reconnect explicitly.
 
 ## Check behavior, not just admission
 

package/llms/agent-runtime-react.txt

@@ -15,7 +15,7 @@ Also read:
 
 ## `stitchkit/agent-runtime/react`
 
-Optional evolving React peer leaf. `useAgent` takes a controller and subscribes through
+Optional evolving React peer leaf, experimental: no committed consumer yet. `useAgent` takes a controller and subscribes through
 `useSyncExternalStore`, returning the same `AgentControllerState` as `getSnapshot()`.
 Create and close the controller at application/session scope. Multiple components can
 observe it; StrictMode and unmount release only the component's own subscription.

package/llms/agent-runtime-realtime.txt

@@ -15,11 +15,20 @@ Also read:
 
 ## `stitchkit/agent-runtime/realtime`
 
-Optional evolving Socket.IO server binding. `bindAgentHarnessRealtime` takes `(harness, socket, config)` and returns `close()` for its subscriptions and control connections, without closing
-socket or harness. `AgentHarnessRealtimeConfig` requires `authorize({ identity, request,
-signal })`: return `{ context }` after verifying the session principal, conversation,
-operation, files and metadata, or `null`. Identity is `socket.data` from the application's
-verified handshake. Every request and event delivery is authorized. Observe access does
+Optional evolving Socket.IO server binding, experimental: no committed consumer yet.
+`bindAgentHarnessRealtime` takes `(harness, socket, config)` and returns an
+`AgentHarnessRealtimeBinding`: `close()` for its subscriptions and control connections, without closing
+socket or harness, and `revoke(conversationId, matches?)`. `AgentHarnessRealtimeConfig` requires
+`authorize({ identity, request, source, signal })`: return `{ context }` after verifying the session
+principal, conversation, operation, files and metadata, or `null`. Identity is `socket.data` from the
+application's verified handshake. Every request is authorized on arrival. The events of an
+attached conversation are delivered under the grant the latest successful request created, so a
+token stream costs no authorization call per event. `revoke` drops the grant of every matching
+socket; the next event is re-authorized (`source: 'delivery'`, an `operation: 'snapshot'` request),
+and a refusal or failure detaches the conversation and sends an `access-denied` delivery, which
+turns the browser controller into an `error` state. Without a `revoke` call a grant lasts until the socket disconnects or the conversation
+is detached; this fail-open default is deliberate, so call `revoke` whenever access to a conversation may
+have been withdrawn. An authorization that began before a `revoke` never restores the grant. Observe access does
 not grant mutation; controller leases and approval policy still belong to the harness.
 
 `maxPendingEvents` and `maxPendingAttachments` forward to the canonical control server;

package/llms/agent-runtime-sandbox.txt

@@ -12,17 +12,6 @@ Also read:
 # Guide: Optional process sandbox  (docs/guide/sandbox.md)
 ==============================================================================
 
----
-title: Optional process sandbox
-description: Linux namespace isolation, durable workspaces and a host credential gateway.
-updated: 2026-10-03 14:47 +07:00
-participants:
-  - role: implemented
-    harness: Codex
-    model: GPT-6
-    at: 2026-10-03 14:47 +07:00
----
-
 # Optional process sandbox
 
 `stitchkit/agent-runtime/sandbox` is a server-only, evolving API. Existing coding
@@ -86,6 +75,9 @@ access the same workspace through the host's contained-file implementation;
 commands run inside the namespace with `/workspace` as their root. The host-only
 `handle.coding` binding never belongs in model input or persisted state.
 Unsupported backends omit the binding and the factory refuses explicitly.
+When the adapter's `probe()` or `prepare()` fails, the agent gets `SANDBOX_UNAVAILABLE` with a
+fixed reason; the adapter's own error is the refusal's `cause`, delivered to the mount's
+`hooks.onToolError`, which is where an application logs it.
 
 Stop also kills coding commands. Both launch paths share the configured
 `maxConcurrentCommands` admission limit (default 8); an occupied slot gives

package/llms/agent-runtime.3.txt

@@ -97,7 +97,7 @@ Server-only optional application runtime. See the
 
 | Export | Kind | Summary |
 |--------|------|---------|
-| `AgentConversationArchiveSchema` / `AgentConversationArchive` / `encodeAgentConversationArchive` / `decodeAgentConversationArchive` / `canonicalAgentJson` | schema / _type_ / functions | canonical validated conversation archive with exact ledger events, recovery projection and durable spill payloads |
+| `AgentConversationArchiveSchema` / `AgentConversationArchive` / `encodeAgentConversationArchive` / `decodeAgentConversationArchive` / `canonicalAgentJson` | schema / _type_ / functions | canonical validated conversation archive (`canonicalAgentJson` is `canonicalJson` with the node and byte limits at their maximum, reading `-0` as `0` like `z.json()`) with exact ledger events, recovery projection and durable spill payloads |
 | `AgentStoreEventEnvelopeSchema` / `AgentStoreEventEnvelope` / `AgentStoreEventKindSchema` / `AgentStoreEventKind` / `AgentStoreEventPageSchema` / `AgentStoreEventPage` | schema / _type_ | append-only event envelope, closed current vocabulary (including `provider/request` and `provider/response`) and bounded page |
 | `AppendAgentStoreEventSchema` / `AppendAgentStoreEvent` / `ReadAgentStoreEventsSchema` / `ReadAgentStoreEvents` | schema / _type_ | required append and bounded-read store contracts |
 | `AgentStoreTransitionSchema` / `AgentStoreTransition` / `AgentStoreEventDraft` / `AgentStoreEventDecodeAccepted` / `AgentStoreEventDecodeIgnored` / `AgentStoreEventDecodeResult` / `decodeAgentStoreEvent` | schema / _types_ / function | normalized runtime mutations, append drafts and strict current/ignorable future-event decoding outcomes |
@@ -107,7 +107,7 @@ Server-only optional application runtime. See the
 | `defineStateSlot` / `AgentStateSlotDefinition` / `AgentStateSlotStore` / `AgentStateSlotValue` / `AnyAgentStateSlot` / `createAgentStateSlotStore` / `renderAgentStateSlots` | functions / _types_ | typed durable state written as ledger events and injected on every provider request |
 | `agentGoalStateSlot` / `agentTodoStateSlot` / `createAgentStateTools` | constants / function | built-in goal/todo state and bound `goal_*` / `todo_write` Agent tools |
 | `AgentSandboxGradeSchema` / `AgentSandboxGrade` / `AgentSandboxRestrictionSchema` / `AgentSandboxRestriction` / `AgentProcessSandbox` | schema / _type_ | host-provided process sandbox capability and explicit restriction vocabulary |
-| `probeAgentProcessSandbox` / `missingSandboxRestrictions` / `recordAgentSandboxProbe` | functions | process-cached probe, fail-closed required-gap calculation and durable probe record |
+| `probeAgentProcessSandbox` / `missingSandboxRestrictions` / `recordAgentSandboxProbe` | functions | probe cached per sandbox object (keep the sandbox long-lived), fail-closed required-gap calculation and durable probe record; a probe that throws or returns no valid grade resolves to `unavailable` with a fixed reason, its cause emitted as a process warning (the coding tools instead carry it as the refusal's `cause` to the mount's `onToolError` hook) |
 | `AgentSandboxProcess` / `AgentSandboxOutputStream` | _types_ | structural child/output interface for optional lifecycle-owned `AgentProcessSandbox.spawn`, without Node ambient type dependencies |
 | `AgentEventSearchResultSchema` / `AgentEventSearchResult` / `createSqliteAgentEventSearch` / `createAgentEventSearchTools` | schema / _type_ / functions | authorized FTS5 search with exact event addresses and `session_*` tools |
 | `createSqliteAgentSpillStore` | function | durable content-address-checked artifact storage, bounded read/search, retention facts and archive participation |

package/llms/agent-runtime.txt

@@ -13,15 +13,6 @@ Parts of this slice:
 # Guide: Agent application runtime  (docs/guide/agent-runtime.md)
 ==============================================================================
 
----
-title: "Agent application runtime"
-description: Configure Stitchkit's optional durable history, stream loop, run coordination and managed-tool fencing.
-type: architecture
-status: active
-created: 2026-08-22
-updated: 2026-10-02 16:28 +07:00
----
-
 # Agent application runtime
 
 > **Maturity: evolving.** This surface is still finding its shape and may be

package/llms/application.2.txt

@@ -278,15 +278,6 @@ boundary is required. Send and projection callbacks own their external deadlines
 # Guide: Application migration recipes  (docs/guide/application-migration-recipes.md)
 ==============================================================================
 
----
-title: Application migration recipes
-description: Executable patterns for moving database, poller, queue and operational publishing lifecycle into the managed application kernel.
-type: architecture
-status: active
-created: 2026-08-24
-updated: 2026-10-04 13:28 +07:00
----
-
 # Application migration recipes
 
 These recipes are the migration companion to the
@@ -438,10 +429,10 @@ guard must refuse. Filesystem mutations made inside inbox transactions call
 `assertHeld` immediately before publication or cleanup.
 
 For `createFileStateStore`, remove `staleLockMs` and `retryMs` from configuration.
-`lockTimeoutMs` remains the acquisition budget. Timestamp age no longer revokes
+`lockTimeoutMs` is the acquisition budget. Timestamp age never revokes
 a live or unknown writer. Stop and verify old writers before recovering a legacy
-pid-only lock; do not invent owner metadata. Historical temporary files are no
-longer deleted by age. See the [durable intake contract](application-kernel.md#durable-process-facts-and-owner-notifications).
+pid-only lock; do not invent owner metadata. Temporary files are never
+deleted by age. See the [durable intake contract](application-kernel.md#durable-process-facts-and-owner-notifications).
 
 ## Long-running poller
 

package/llms/application.3.txt

@@ -36,7 +36,7 @@ cutovers are covered by the executable
 | `NotificationOutboxItem` / `NotificationOutboxReceipt` / `NotificationOutboxState` / `NotificationSend` / `NotificationFailureClassification` / `DroppedNotification` / `EnqueueNotification` | _type_ | versioned queue records, stable send identity and delivery decisions |
 | `notificationOutboxStateSchema` | function | strict persisted-state schema over an application payload schema |
 | `notificationOutboxResource` / `NotificationOutboxResource` / `NotificationOutboxResourceConfig` | function / _type_ | thin managed-resource scheduler over an outbox handle |
-| `createDirectoryInbox` (from `stitchkit/application/directory-inbox`) / `DirectoryInbox` / `DirectoryInboxConfig` / `DirectoryInboxDelivery` / `DirectoryInboxResource` | function / _type_ | one managed directory inbox for files or durable `accept({ source, key, entry })`; first payload wins, bounded capacity/bytes/receipts and renewable fenced leases; delivery begins after readiness and effects remain at least once |
+| `createDirectoryInbox` (from `stitchkit/application/directory-inbox`) / `DirectoryInbox` / `DirectoryInboxConfig` / `DirectoryInboxDelivery` / `DirectoryInboxResource` | function / _type_ | one managed directory inbox for files or durable `accept({ source, key, entry })` (`entry` is the schema's input, stored as given); a hard-linked file is set aside as `invalid`; first payload wins, bounded capacity/bytes/receipts and renewable fenced leases; delivery begins after readiness and effects remain at least once |
 | `DirectoryInboxIdentitySchema` / `DirectoryInboxIdentity` / `DirectoryInboxAccept` / `DirectoryInboxAcceptResultSchema` / `DirectoryInboxAcceptResult` | schema / _type_ | validated source/key, typed entry and durable accepted/duplicate result with filename; duplicates do not replace the first payload |
 | `StateStoreUpdateContext` | _type_ | real active protected transaction: `assertHeld()` refuses after ownership loss or completion; custom adapters supply this context to their transition |
 | `DirectoryInboxStateSchema` / `DirectoryInboxState` / `DirectoryInboxRejection` / `DirectoryInboxRejectionReasonSchema` / `DirectoryInboxRejectionReason` | schema / _type_ | the inbox's claims, receipts and rejections (`invalid`, `too-large`, `attempt-limit`) |
@@ -122,9 +122,10 @@ cutovers are covered by the executable
 | Export | Kind | Summary |
 |--------|------|---------|
 | `createDiagnosticJournal` | function | create one schema-owned FIFO JSONL writer with bounded retained memory, exclusive local path ownership and finite rotation |
-| `DiagnosticJournalConfig` / `DiagnosticJournal` | _type_ | owner schema/path/limits/failure observer and the synchronous `submit`, bounded-wait `flush`/`close`, status handle |
+| `DiagnosticJournalConfig` / `DiagnosticJournal` | _type_ | owner schema/path/limits/failure observer, `startupScan` (`tails` by default, or `full`), `onStartupRefusal` (`quarantine` by default, or `fail`) and the synchronous `submit`, bounded-wait `flush`/`close`, status handle |
 | `DiagnosticJournalLimitsSchema` / `DiagnosticJournalLimits` | schema / _type_ | positive event, pending-item, pending-byte, file-byte and retained-file limits |
 | `DiagnosticJournalLockPolicySchema` / `DiagnosticJournalLockPolicy` | schema / _type_ | `refuse` (default) or `reclaim-stale`, which reclaims only a lock whose recorded owner is provably gone |
+| `DiagnosticJournalStartupScanSchema` / `DiagnosticJournalStartupScan` | schema / _type_ | how much of the retained generations opening a journal reads: `tails` (default) checks only the end of each file for a torn line, `full` parses every line |
 | `readDiagnosticJournalLockDiagnosis` / `DiagnosticJournalLockDiagnosis` | function / _type_ | why a `reclaim-stale` acquisition refused — attribution, PID liveness and optional process `identity` evidence (`matched`, `different-boot`, `reused-pid`, `pid-gone`, `legacy`, `unavailable`) — read off the thrown `EEXIST` |
 | `DiagnosticJournalSubmitResultSchema` / `DiagnosticJournalSubmitResult` | schema / _type_ | accepted epoch/sequence or explicit invalid, oversized, capacity, closed or failed refusal |
 | `DiagnosticJournalStatusSchema` / `DiagnosticJournalStatus` | schema / _type_ | state, limits, exact admission/write/failure counters, pending ownership, rotations, partial tails and last safe sequences |
@@ -137,8 +138,10 @@ cutovers are covered by the executable
 | `DiagnosticJournalWaitOptions` / `DiagnosticJournalFailure` | _type_ | caller wait signal/timeout and isolated internal failure callback record |
 | `DiagnosticJournalAnomalySchema` / `DiagnosticJournalAnomaly` | schema / _type_ | corrupt-row reason, file, zero-based byte offset, one-based line, tail/interior position and skipped bytes |
 | `createDiagnosticJournalReadResultSchema` / `DiagnosticJournalReadResult` | function / _type_ | owner-schema frame output or explicit anomaly; retains transformed event output types |
-| `DiagnosticJournalRecoveryStatusSchema` / `DiagnosticJournalRecoveryStatus` | schema / _type_ | bounded startup inspection counts and first/last anomaly locations |
-| `DiagnosticJournalRecoveryError` | class | torn single-file startup refusal carrying recovery observations, preserving evidence and releasing its lock |
+| `DiagnosticJournalRecoveryStatusSchema` / `DiagnosticJournalRecoveryStatus` | schema / _type_ | bounded startup inspection counts, first/last anomaly locations and every quarantined file beside the journal (`quarantined`, this open's moves first with their `reason`, at most 32; `quarantinedUnlisted` counts the rest); evolving and `.strict()`, so every shape change is a breaking changelog item |
+| `DiagnosticJournalStartupRefusalPolicySchema` / `DiagnosticJournalStartupRefusalPolicy` | schema / _type_ | `quarantine` (default) renames a file opening cannot keep in place to `<file>.quarantined-<epoch>` and starts; `fail` throws and moves nothing |
+| `DiagnosticJournalStartupRefusalReasonSchema` / `DiagnosticJournalStartupRefusalReason` | schema / _type_ | `torn-without-retention-slot \| not-a-regular-file \| unreadable` |
+| `DiagnosticJournalRecoveryError` / `DiagnosticJournalRecoveryErrorOptions` | class / _type_ | typed startup refusal (`reason`, `file`, optional `recovery`, `quarantineFailed`) thrown under `fail` or when moving a file aside failed; preserves evidence and releases its lock |
 
 `accepted` is bounded in-memory admission and `written` is completed append, not `fsync` or durable
 delivery. Its filesystem reader is in the diagnostic-journal leaf; there is no managed replay/upload API. See the

package/llms/application.txt

@@ -13,15 +13,6 @@ Parts of this slice:
 # Guide: Managed application kernel  (docs/guide/application-kernel.md)
 ==============================================================================
 
----
-title: Managed application kernel
-description: Compose process-local resources, schedules, readiness, drain and optional provider adapters without building a second job platform.
-type: architecture
-status: active
-created: 2026-08-23
-updated: 2026-10-04 13:28 +07:00
----
-
 # Managed application kernel
 
 > **Maturity: evolving.** This surface is still finding its shape and may be
@@ -205,9 +196,8 @@ lifecycle context; the application decides when a database/provider probe runs.
 
 **A `reportHealth` call inside `start` is kept.** A resource that says nothing
 is assumed healthy once it is ready; one that reports its own health has already
-answered the question, and the answer stands. (It used to be overwritten — and
-the example above hides that, because `healthy` is the same value that
-overwrote it.)
+answered the question, and the answer stands. The readiness default never
+overwrites it.
 
 **Reporting the same health again is not a change.** A resource may confirm its
 health on a timer; a report with the value it already reported publishes
@@ -703,9 +693,48 @@ The caller owns file selection and coordination with an active rotator.
 Writer startup inspects retained and active files under its lock. On damage,
 `journal.getStatus().recovery` contains counts and first/last anomaly locations, reconstructed
 again on restart from the preserved bytes. This describes startup observations, not live
-continuous inspection. `maxFiles: 1` cannot preserve a torn active file by rotation and throws
-`DiagnosticJournalRecoveryError` before removing any evidence; configure at least two slots.
-Normal rotation retains the existing finite eviction policy. → [ADR 0219](../decisions/0219-journal-damage-is-data-and-io-failure-is-failure.md).
+continuous inspection. Normal rotation retains the existing finite eviction policy.
+→ [ADR 0219](../decisions/0219-journal-damage-is-data-and-io-failure-is-failure.md).
+
+A file opening cannot keep in place — a torn active file with `maxFiles: 1`, a generation name
+that is not a regular file, a retained file it cannot read — is renamed to
+`<file>.quarantined-<epoch>` beside it, and the journal starts (`onStartupRefusal: 'quarantine'`,
+the default). Nothing is deleted; quarantined files are outside retention and yours to remove.
+Every open lists them in `getStatus().recovery.quarantined` until you do: the ones it moved
+first, with their `reason`, then the ones earlier runs left, without one — at most 32, and
+`quarantinedUnlisted` counts the rest.
+A journal whose damage must stop the process — one that is a source of truth, not diagnostics —
+declares `onStartupRefusal: 'fail'` and gets a typed `DiagnosticJournalRecoveryError`:
+
+```ts
+import { DiagnosticJournalRecoveryError } from 'stitchkit/application'
+
+// A diagnostic journal: start, then say what is set aside.
+const journal = await createDiagnosticJournal({ ...config })
+const { quarantined = [], quarantinedUnlisted = 0 } = journal.getStatus().recovery ?? {}
+for (const entry of quarantined) {
+  // `reason` is present only for a file this start moved; an earlier run's has none.
+  internalLogger.warn({ file: entry.file, movedTo: entry.quarantinedAs, reason: entry.reason })
+}
+if (quarantinedUnlisted > 0) internalLogger.warn({ quarantinedUnlisted })
+
+// A journal that is a source of truth: refuse to start over damage.
+try {
+  await createDiagnosticJournal({ ...config, onStartupRefusal: 'fail' })
+} catch (error) {
+  if (error instanceof DiagnosticJournalRecoveryError) {
+    // error.reason: 'torn-without-retention-slot' | 'not-a-regular-file' | 'unreadable'
+  }
+  throw error
+}
+```
+
+A quarantining journal writes, so the managed resource that owns it reports `healthy`, and its
+dependants read `recovery` from the value they `use()`. There is no degraded journal: the kernel
+degrades only optional resources, and a required resource cannot depend on one.
+`DiagnosticJournalRecoveryStatusSchema` is evolving and `.strict()`; if you embed it in your own
+protocol, every change to its shape is listed under breaking changes.
+→ [ADR 0240](../decisions/0240-a-diagnostic-journal-quarantines-what-it-cannot-keep.md).
 
 Shutdown performs one phase barrier at a time: stop admission everywhere,
 cancel future schedules, drain admitted work, then close in reverse stable