stitchkit 0.108.2 → 0.108.4

package/dist/process/owner-loss-guard.d.ts

@@ -1,3 +1,12 @@
+/**
+ * Bootstrap the private owner-loss service before an application's own argv dispatcher.
+ *
+ * Call this once before routing argv in a single-file application that lazy-imports
+ * `stitchkit/process`. `false` means the application owns this invocation and may dispatch it;
+ * `true` means the package guard owns it and the application must skip its dispatcher. The guard's
+ * child and control channel keep the process alive for exactly their own lifetime.
+ */
+export declare function bootstrapNativeCommandOwnerLoss(): boolean;
 /** The built or source module that executes the guard protocol when launched directly. */
 export declare function ownerLossGuardEntry(): string;
 //# sourceMappingURL=owner-loss-guard.d.ts.map

package/dist/process/owner-loss-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"owner-loss-guard.d.ts","sourceRoot":"","sources":["../../src/process/owner-loss-guard.ts"],"names":[],"mappings":"AA+KA,0FAA0F;AAC1F,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C"}
+{"version":3,"file":"owner-loss-guard.d.ts","sourceRoot":"","sources":["../../src/process/owner-loss-guard.ts"],"names":[],"mappings":"AAyLA;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,IAAI,OAAO,CAEzD;AAED,0FAA0F;AAC1F,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C"}

package/dist/tools/cli/args-fields.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"args-fields.d.ts","sourceRoot":"","sources":["../../../src/tools/cli/args-fields.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,MAAM,MAAM,SAAS,GACjB,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,GACP,QAAQ,GACR,OAAO,CAAC;AAEZ,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,SAAS,CAAC;IAChB,uEAAuE;IACvE,WAAW,CAAC,EAAE,SAAS,CAAC;IACxB,iFAAiF;IACjF,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAC1B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,SAAS,GAAG,SAAS,GAC1B,IAAI,CAaN;AA6ED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAI1F;AAKD,4GAA4G;AAC5G;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAI/E;AAED,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAGzD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAKtE;AA8BD,qFAAqF;AACrF,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAKlD;AAuCD,gFAAgF;AAChF,wBAAgB,WAAW,CACzB,IAAI,EAAE,SAAS,GAAG,SAAS,EAC3B,MAAM,EAAE,MAAM,EAAE,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAaT;AAED,wBAAgB,SAAS,CACvB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,EAAE,MAAM,EAAE,EACd,KAAK,EAAE,OAAO,GACb,IAAI,CAsBN"}
+{"version":3,"file":"args-fields.d.ts","sourceRoot":"","sources":["../../../src/tools/cli/args-fields.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,MAAM,MAAM,SAAS,GACjB,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,GACP,QAAQ,GACR,OAAO,CAAC;AAEZ,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,SAAS,CAAC;IAChB,uEAAuE;IACvE,WAAW,CAAC,EAAE,SAAS,CAAC;IACxB,iFAAiF;IACjF,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAC1B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,SAAS,GAAG,SAAS,GAC1B,IAAI,CAaN;AAwGD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAI1F;AAKD,4GAA4G;AAC5G;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAI/E;AAED,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAGzD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAKtE;AA8BD,qFAAqF;AACrF,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAKlD;AAuCD,gFAAgF;AAChF,wBAAgB,WAAW,CACzB,IAAI,EAAE,SAAS,GAAG,SAAS,EAC3B,MAAM,EAAE,MAAM,EAAE,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAaT;AAED,wBAAgB,SAAS,CACvB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,EAAE,MAAM,EAAE,EACd,KAAK,EAAE,OAAO,GACb,IAAI,CAsBN"}

package/llms/agent-runtime-coding-tools.txt

@@ -21,7 +21,7 @@ artifact store is supplied, `read_output`.
 
 | Export | Kind | Summary |
 |--------|------|---------|
-| `createAgentCodingTools` | function | construct direct host-authorized bounded file, listing, glob, search, exact-snippet edit, shell and artifact runtime-tool definitions; every ordinary refusal is a typed code with an instructive `hint`, and filesystem operations use Linux `/proc/self/fd` or the packaged macOS Node-API backend and otherwise fail closed |
+| `createAgentCodingTools` | function | construct direct host-authorized bounded file, listing, glob, search, exact-snippet edit, shell and artifact runtime-tool definitions; `edit_file` inserts `newText` literally in both single and `replaceAll` modes; every ordinary refusal is a typed code with an instructive `hint`, and filesystem operations use Linux `/proc/self/fd` or the packaged macOS Node-API backend and otherwise fail closed |
 | `AGENT_CODING_TOOL_NAMES` | const | the mounted tool names — `read_file`, `write_file`, `edit_file`, `list_directory`, `glob`, `search_files`, `run_command`, `read_output` |
 | `AgentCodingToolDefinition` | _type_ | peer-free structural direct-tool shape accepted by the canonical runtime-tool surface |
 | `AgentCodingToolConfig` | _type_ | absolute root, required operation authorization, optional async/sync `authorizePath({ path })` shared by direct file effects and discovery, finite executable alias map, exact child environment and optional limits |

package/llms/agent-runtime.txt

@@ -322,8 +322,9 @@ includes the exact workspace-relative `recoveryPath`; an absolute path outside t
 suggested replacement. Applying the suggestion still passes the same descriptor-relative
 containment and symlink checks.
 
-`edit_file` replaces one exact snippet. `oldText` is itself the freshness guard for the region it
-changes, so the digest is the optional `expectedSha256` and an edit is one call; pass the digest
+`edit_file` replaces one exact snippet. It inserts `newText` literally in both single and
+`replaceAll` modes, including JavaScript replacement tokens such as `$$`, `$&`, `` $` `` and `$'`.
+`oldText` is itself the freshness guard for the region it changes, so the digest is the optional `expectedSha256` and an edit is one call; pass the digest
 `read_file` returned when you want the whole-file guarantee, and read the `sha256` it returns to
 chain the next edit without re-reading. The read, the occurrence count and the construction of the
 new content all happen inside one per-target lock, so two concurrent edits of different snippets in

package/llms/cli.2.txt

@@ -11,6 +11,113 @@ Parts of this slice:
 # Guide: CLI  (docs/guide/cli.md)  (continued)
 ==============================================================================
 
+## One operation per line — `createCliInvoker`
+
+The most common way an agent drives a CLI is not one command: it is a stream —
+a JSON line per operation, an answer per line — and a resumable batch of the
+same. The mechanics contain nothing product-specific, and until now the
+framework left the one piece that cannot be written outside it: running an
+already-parsed call.
+
+```ts
+import { createCliInvoker, defineCliStreamCommand, defineCliBatchCommand } from 'stitchkit/cli'
+
+const invoker = await createCliInvoker({ name: 'myapp', services })
+
+const outcome = await invoker.invoke('create_item', { title: 'hello', tags: ['a'] })
+// { ok: true, exitCode: 0, data: { … } }   — nothing written, nothing exited
+```
+
+`invoke` runs the same pipeline a typed command runs — the same validation, the
+same `lifecycle` gate, the same hooks — and returns the handler's validated
+output with **the exit code the printed path would give**, from the same table.
+`data` is typed `unknown`: the surface is resolved at run time from services and
+runtime tools, so there is no compile-time name to key a result type on. Narrow
+it with the contract's own output schema. That table used to
+live inside the function that prints, so the only way to learn a code was to
+print it.
+
+Without this, a stream loop had to re-spawn the binary per line: arguments
+serialised back into `--flag value` strings, nested objects pushed through
+`JSON.stringify` into one argv slot and parsed again on the other side, the
+result read back out of stdout text. Three conversions of data the framework was
+already holding, plus a process start measured at 0.15 s — thirty seconds for a
+two-hundred-line manifest before any work begins. The ban on nesting one stream
+inside another was a consequence of that child process, not a rule anyone wanted.
+
+### Native commands in the stream
+
+A native command is in the invoker's surface when — and only when — it declares
+`output`:
+
+```ts
+const describe = defineCliCommand({
+  name: 'describe', description: 'Describe the catalogue',
+  input: z.object({ model: z.string() }),
+  output: z.object({ model: z.string(), ratios: z.array(z.string()) }),
+  handler: ({ input }) => ({ model: input.model, ratios: ['1:1', '16:9'] }),
+})
+
+await createCliInvoker({ name: 'myapp', services, commands: [describe] })
+// invoke('describe', { model: 'flux' }) → { ok: true, exitCode: 0, data: { … } }
+```
+
+A command that declares `output?: never` prints itself and returns nothing, so
+there is no result to hand back; it answers `NOT_FOUND` and stays on the command
+line, where stdout exists. Your stream command is one of these, which is why a
+stream still cannot invoke itself.
+
+On this path `present` is not called — it is stdout formatting, and there is no
+stdout — while `exitCode` is applied through the same function the command line
+uses, so a script branching on the code sees one answer from both. Anything the
+handler writes comes back as `written` rather than interleaving with your own
+output:
+
+```ts
+const outcome = await invoker.invoke('describe', { model: 'flux' })
+outcome.written // { stderr: 'warming the cache\n' } — absent when nothing was written
+```
+
+### Mounting the loop
+
+```ts
+await createCli({
+  name: 'myapp', version, services,
+  commands: [
+    defineCliStreamCommand({ name: 'jsonl', invoker }),
+    defineCliBatchCommand({ name: 'batch', invoker, checkpointPath: '.myapp-batch.json' }),
+  ],
+})
+```
+
+They are factories, not framework-owned names. Reserving `jsonl` and `batch`
+would take two names out of a namespace that belongs to the application — one
+that already has a `batch` command would either fail at startup or find its own
+command silently shadowed — so you mount them under whatever you call them, like
+any other command of yours.
+
+Each line is `{ id, command, args }`; each answer is the invocation result plus
+that `id`. A line that is not JSON, or has no `id`, is **answered** and the
+stream continues: a stream that goes quiet on one line leaves its consumer
+unable to tell which request it lost. Answers go to stdout, one object per line,
+and nothing else does.
+
+### Resuming a batch
+
+The checkpoint records, per id, a digest of the line that produced the recorded
+answer, and is written after **every** line by atomic rename — a checkpoint that
+only survives a clean finish protects against exactly the case that does not
+happen.
+
+A re-run replays what already ran. A line whose content changed under the same
+id is **refused**: replaying it would report success for an operation nobody
+ran, and re-running it would repeat a paid call. Both answer a question nobody
+asked.
+
+What stays yours: what makes a repeat safe (an idempotency key derived from the
+line id), which operations a batch may contain, and how much of it runs at once.
+That is product knowledge, and the framework has no business guessing it.
+
 ## Commands discovered from a running server
 
 A CLI compiled from contracts carries the surface of the build it was compiled

package/llms/cli.txt

@@ -238,11 +238,19 @@ string, the schema says what it should be:
 | `z.string()`         | `--name "box"` or a positional                 |
 | `z.number()`         | `--count 3` → `3`                              |
 | `z.boolean()`        | `--active` (presence) / `--active false` / `--no-active` |
+| `z.literal(1)` / `z.literal([1, 2])` | `--level 1` → `1`              |
+| `z.literal(true)`    | `--enabled` / `--no-enabled`                    |
+| `z.literal('007')`   | `--code 007` → `"007"`                          |
 | `z.enum([...])`      | `--size large`                                 |
 | `z.array(z.string())`| `--tag a --tag b` → `["a","b"]`                |
 | `z.object({...})`    | `--opts '{"k":"v"}'` (JSON) or `--opts.k v`    |
 | `.optional()` / `.default()` | not required                           |
 
+Primitive literals use the same coercion through optional, nullable and default wrappers and as
+array elements. A literal set whose members have different primitive types stays lexical because
+argv has no type tag: for `z.literal([7, '007'])`, `--value 007` remains the string `"007"` rather
+than being guessed as the number `7`. The unchanged Zod schema makes the final admission decision.
+
 After a bare boolean flag, the next token is its value when it is exactly
 `true` or `false` — `--active false` turns it off, as it reads. Any other word
 there stays a positional, and `--` makes a literal `false` one too. The same
@@ -916,110 +924,3 @@ asset's address comes from the manifest, and the manifest's address belongs to
 your server. A channel is two documents at two addresses — which of them a build
 consults is your decision, and `assertCliPublishable` is told about all of them
 rather than taught the shape of any.
-
-## One operation per line — `createCliInvoker`
-
-The most common way an agent drives a CLI is not one command: it is a stream —
-a JSON line per operation, an answer per line — and a resumable batch of the
-same. The mechanics contain nothing product-specific, and until now the
-framework left the one piece that cannot be written outside it: running an
-already-parsed call.
-
-```ts
-import { createCliInvoker, defineCliStreamCommand, defineCliBatchCommand } from 'stitchkit/cli'
-
-const invoker = await createCliInvoker({ name: 'myapp', services })
-
-const outcome = await invoker.invoke('create_item', { title: 'hello', tags: ['a'] })
-// { ok: true, exitCode: 0, data: { … } }   — nothing written, nothing exited
-```
-
-`invoke` runs the same pipeline a typed command runs — the same validation, the
-same `lifecycle` gate, the same hooks — and returns the handler's validated
-output with **the exit code the printed path would give**, from the same table.
-`data` is typed `unknown`: the surface is resolved at run time from services and
-runtime tools, so there is no compile-time name to key a result type on. Narrow
-it with the contract's own output schema. That table used to
-live inside the function that prints, so the only way to learn a code was to
-print it.
-
-Without this, a stream loop had to re-spawn the binary per line: arguments
-serialised back into `--flag value` strings, nested objects pushed through
-`JSON.stringify` into one argv slot and parsed again on the other side, the
-result read back out of stdout text. Three conversions of data the framework was
-already holding, plus a process start measured at 0.15 s — thirty seconds for a
-two-hundred-line manifest before any work begins. The ban on nesting one stream
-inside another was a consequence of that child process, not a rule anyone wanted.
-
-### Native commands in the stream
-
-A native command is in the invoker's surface when — and only when — it declares
-`output`:
-
-```ts
-const describe = defineCliCommand({
-  name: 'describe', description: 'Describe the catalogue',
-  input: z.object({ model: z.string() }),
-  output: z.object({ model: z.string(), ratios: z.array(z.string()) }),
-  handler: ({ input }) => ({ model: input.model, ratios: ['1:1', '16:9'] }),
-})
-
-await createCliInvoker({ name: 'myapp', services, commands: [describe] })
-// invoke('describe', { model: 'flux' }) → { ok: true, exitCode: 0, data: { … } }
-```
-
-A command that declares `output?: never` prints itself and returns nothing, so
-there is no result to hand back; it answers `NOT_FOUND` and stays on the command
-line, where stdout exists. Your stream command is one of these, which is why a
-stream still cannot invoke itself.
-
-On this path `present` is not called — it is stdout formatting, and there is no
-stdout — while `exitCode` is applied through the same function the command line
-uses, so a script branching on the code sees one answer from both. Anything the
-handler writes comes back as `written` rather than interleaving with your own
-output:
-
-```ts
-const outcome = await invoker.invoke('describe', { model: 'flux' })
-outcome.written // { stderr: 'warming the cache\n' } — absent when nothing was written
-```
-
-### Mounting the loop
-
-```ts
-await createCli({
-  name: 'myapp', version, services,
-  commands: [
-    defineCliStreamCommand({ name: 'jsonl', invoker }),
-    defineCliBatchCommand({ name: 'batch', invoker, checkpointPath: '.myapp-batch.json' }),
-  ],
-})
-```
-
-They are factories, not framework-owned names. Reserving `jsonl` and `batch`
-would take two names out of a namespace that belongs to the application — one
-that already has a `batch` command would either fail at startup or find its own
-command silently shadowed — so you mount them under whatever you call them, like
-any other command of yours.
-
-Each line is `{ id, command, args }`; each answer is the invocation result plus
-that `id`. A line that is not JSON, or has no `id`, is **answered** and the
-stream continues: a stream that goes quiet on one line leaves its consumer
-unable to tell which request it lost. Answers go to stdout, one object per line,
-and nothing else does.
-
-### Resuming a batch
-
-The checkpoint records, per id, a digest of the line that produced the recorded
-answer, and is written after **every** line by atomic rename — a checkpoint that
-only survives a clean finish protects against exactly the case that does not
-happen.
-
-A re-run replays what already ran. A line whose content changed under the same
-id is **refused**: replaying it would report success for an operation nobody
-ran, and re-running it would repeat a paid call. Both answer a question nobody
-asked.
-
-What stays yours: what makes a repeat safe (an idempotency key derived from the
-line id), which operations a batch may contain, and how much of it runs at once.
-That is product knowledge, and the framework has no business guessing it.

package/llms/process-owner-loss.txt

@@ -0,0 +1,18 @@
+# stitchkit/process/owner-loss — stitchkit docs slice
+
+> Generated from the `docs/` tree by `bun run gen:llms`. The index of all slices is
+> `llms.txt` in this package.
+
+Contains: API reference: `stitchkit/process/owner-loss`  (docs/api/reference.md)
+
+==============================================================================
+# API reference: `stitchkit/process/owner-loss`  (docs/api/reference.md)
+==============================================================================
+
+## `stitchkit/process/owner-loss`
+
+Narrow startup entry for single-file applications that lazy-import `stitchkit/process`.
+
+| Export | Kind | Purpose |
+|---|---|---|
+| `bootstrapNativeCommandOwnerLoss` | function | call before application argv routing; returns `true` only when the package guard owns this invocation, so the application skips its dispatcher while preserving a lazy import of the full command runner |

package/llms/process.txt

@@ -213,6 +213,24 @@ and Darwin under Bun and Node, requires `group: 'own'`, and other platforms refu
 is opt-in. `onLeaderStarted({ pid })` reports the guard/group leader with this option; output, stdin,
 exit status, deadlines, cancellation and `onLeaderSettled` retain the requested command's behaviour.
 
+An unbundled application already launches the package's own guard module. A single-file bundle
+whose application entry also owns argv routing must load the narrow bootstrap before its dispatcher
+and skip dispatch when it claims the private guard invocation. This is especially relevant when the
+full command runner stays behind a dynamic import:
+
+```ts
+import { bootstrapNativeCommandOwnerLoss } from 'stitchkit/process/owner-loss'
+
+if (!bootstrapNativeCommandOwnerLoss()) {
+  await dispatch(process.argv.slice(2)) // may lazy-import `stitchkit/process`
+}
+```
+
+The bootstrap carries the package-owned guard into the bundle. It returns `false` for application
+argv and `true` only for the private child started by `runNativeCommand`, so the application does
+not read a guard flag or filename. The built file is self-contained; no installed `node_modules`
+is needed beside it.
+
 ### Stopping a command: the `stop` policy
 
 A caller abort, the `timeoutMs` deadline, an exceeded output budget and a failing sink all stop the

package/llms/stitchkit.txt

@@ -70,6 +70,7 @@ own, recorded as an ADR.
 | `stitchkit/cli/publish` | build and release tooling (Bun or Node, POSIX) | evolving | `publishCli` — commit a verified CLI distribution and move its public manifest last; see [CLI guide](cli.md#publishing-a-complete-version) |
 | `stitchkit/remote` | browser **and** server | stable | peer-free `implementRemote` for thin HTTP proxy processes |
 | `stitchkit/process` | server (Bun or Node, POSIX) | evolving | finite native commands, byte sinks, bounded capture, process-group cancellation and opt-in Linux/Darwin owner-loss cleanup |
+| `stitchkit/process/owner-loss` | bundled server entry (Bun, POSIX) | evolving | narrow bootstrap that keeps the process runner lazy while carrying its owner-loss guard in a single-file bundle |
 | `stitchkit/files/packaging` | build time (Bun or Node) | evolving | installed native asset graph, integrity, Bun packaging plugin and the artifact loader check; no runtime install policy |
 | `stitchkit/files` | server (Bun or Node) | stable | peer-free managed local-file boundary |
 | `stitchkit/telegram` | server (Bun or Node) | evolving | peer-free Telegram platform primitives — Mini App `initData` verification, send-failure classification, resumable broadcasts, the operator channel with dedupe, a Bot API transport that separates a request that never left from an unknown outcome, local Bot API files, webhook ownership and durable webhook update intake |

package/llms-full.txt

@@ -62,6 +62,7 @@ own, recorded as an ADR.
 | `stitchkit/cli/publish` | build and release tooling (Bun or Node, POSIX) | evolving | `publishCli` — commit a verified CLI distribution and move its public manifest last; see [CLI guide](cli.md#publishing-a-complete-version) |
 | `stitchkit/remote` | browser **and** server | stable | peer-free `implementRemote` for thin HTTP proxy processes |
 | `stitchkit/process` | server (Bun or Node, POSIX) | evolving | finite native commands, byte sinks, bounded capture, process-group cancellation and opt-in Linux/Darwin owner-loss cleanup |
+| `stitchkit/process/owner-loss` | bundled server entry (Bun, POSIX) | evolving | narrow bootstrap that keeps the process runner lazy while carrying its owner-loss guard in a single-file bundle |
 | `stitchkit/files/packaging` | build time (Bun or Node) | evolving | installed native asset graph, integrity, Bun packaging plugin and the artifact loader check; no runtime install policy |
 | `stitchkit/files` | server (Bun or Node) | stable | peer-free managed local-file boundary |
 | `stitchkit/telegram` | server (Bun or Node) | evolving | peer-free Telegram platform primitives — Mini App `initData` verification, send-failure classification, resumable broadcasts, the operator channel with dedupe, a Bot API transport that separates a request that never left from an unknown outcome, local Bot API files, webhook ownership and durable webhook update intake |
@@ -5510,8 +5511,9 @@ includes the exact workspace-relative `recoveryPath`; an absolute path outside t
 suggested replacement. Applying the suggestion still passes the same descriptor-relative
 containment and symlink checks.
 
-`edit_file` replaces one exact snippet. `oldText` is itself the freshness guard for the region it
-changes, so the digest is the optional `expectedSha256` and an edit is one call; pass the digest
+`edit_file` replaces one exact snippet. It inserts `newText` literally in both single and
+`replaceAll` modes, including JavaScript replacement tokens such as `$$`, `$&`, `` $` `` and `$'`.
+`oldText` is itself the freshness guard for the region it changes, so the digest is the optional `expectedSha256` and an edit is one call; pass the digest
 `read_file` returned when you want the whole-file guarantee, and read the `sha256` it returns to
 chain the next edit without re-reading. The read, the occurrence count and the construction of the
 new content all happen inside one per-target lock, so two concurrent edits of different snippets in
@@ -8396,6 +8398,24 @@ and Darwin under Bun and Node, requires `group: 'own'`, and other platforms refu
 is opt-in. `onLeaderStarted({ pid })` reports the guard/group leader with this option; output, stdin,
 exit status, deadlines, cancellation and `onLeaderSettled` retain the requested command's behaviour.
 
+An unbundled application already launches the package's own guard module. A single-file bundle
+whose application entry also owns argv routing must load the narrow bootstrap before its dispatcher
+and skip dispatch when it claims the private guard invocation. This is especially relevant when the
+full command runner stays behind a dynamic import:
+
+```ts
+import { bootstrapNativeCommandOwnerLoss } from 'stitchkit/process/owner-loss'
+
+if (!bootstrapNativeCommandOwnerLoss()) {
+  await dispatch(process.argv.slice(2)) // may lazy-import `stitchkit/process`
+}
+```
+
+The bootstrap carries the package-owned guard into the bundle. It returns `false` for application
+argv and `true` only for the private child started by `runNativeCommand`, so the application does
+not read a guard flag or filename. The built file is self-contained; no installed `node_modules`
+is needed beside it.
+
 ### Stopping a command: the `stop` policy
 
 A caller abort, the `timeoutMs` deadline, an exceeded output budget and a failing sink all stop the
@@ -9622,11 +9642,19 @@ string, the schema says what it should be:
 | `z.string()`         | `--name "box"` or a positional                 |
 | `z.number()`         | `--count 3` → `3`                              |
 | `z.boolean()`        | `--active` (presence) / `--active false` / `--no-active` |
+| `z.literal(1)` / `z.literal([1, 2])` | `--level 1` → `1`              |
+| `z.literal(true)`    | `--enabled` / `--no-enabled`                    |
+| `z.literal('007')`   | `--code 007` → `"007"`                          |
 | `z.enum([...])`      | `--size large`                                 |
 | `z.array(z.string())`| `--tag a --tag b` → `["a","b"]`                |
 | `z.object({...})`    | `--opts '{"k":"v"}'` (JSON) or `--opts.k v`    |
 | `.optional()` / `.default()` | not required                           |
 
+Primitive literals use the same coercion through optional, nullable and default wrappers and as
+array elements. A literal set whose members have different primitive types stays lexical because
+argv has no type tag: for `z.literal([7, '007'])`, `--value 007` remains the string `"007"` rather
+than being guessed as the number `7`. The unchanged Zod schema makes the final admission decision.
+
 After a bare boolean flag, the next token is its value when it is exactly
 `true` or `false` — `--active false` turns it off, as it reads. Any other word
 there stays a positional, and `--` makes a literal `false` one too. The same
@@ -21816,7 +21844,7 @@ artifact store is supplied, `read_output`.
 
 | Export | Kind | Summary |
 |--------|------|---------|
-| `createAgentCodingTools` | function | construct direct host-authorized bounded file, listing, glob, search, exact-snippet edit, shell and artifact runtime-tool definitions; every ordinary refusal is a typed code with an instructive `hint`, and filesystem operations use Linux `/proc/self/fd` or the packaged macOS Node-API backend and otherwise fail closed |
+| `createAgentCodingTools` | function | construct direct host-authorized bounded file, listing, glob, search, exact-snippet edit, shell and artifact runtime-tool definitions; `edit_file` inserts `newText` literally in both single and `replaceAll` modes; every ordinary refusal is a typed code with an instructive `hint`, and filesystem operations use Linux `/proc/self/fd` or the packaged macOS Node-API backend and otherwise fail closed |
 | `AGENT_CODING_TOOL_NAMES` | const | the mounted tool names — `read_file`, `write_file`, `edit_file`, `list_directory`, `glob`, `search_files`, `run_command`, `read_output` |
 | `AgentCodingToolDefinition` | _type_ | peer-free structural direct-tool shape accepted by the canonical runtime-tool surface |
 | `AgentCodingToolConfig` | _type_ | absolute root, required operation authorization, optional async/sync `authorizePath({ path })` shared by direct file effects and discovery, finite executable alias map, exact child environment and optional limits |
@@ -23069,6 +23097,14 @@ Native POSIX Bun/Node one-shot command execution. See [native IO](../guide/nativ
 | `ProcessInstanceSchema` / `ProcessInstance` | schema / type | platform, boot ID, namespace and process start identity from the shared native reader |
 | `probeProcessOwner` / `ProcessOwnerEvidence` | function / type | compare lifetimes on one caller-established machine; matched, boot change, reused PID, gone, legacy or unavailable with cause |
 
+## `stitchkit/process/owner-loss`
+
+Narrow startup entry for single-file applications that lazy-import `stitchkit/process`.
+
+| Export | Kind | Purpose |
+|---|---|---|
+| `bootstrapNativeCommandOwnerLoss` | function | call before application argv routing; returns `true` only when the package guard owns this invocation, so the application skips its dispatcher while preserving a lazy import of the full command runner |
+
 ## `stitchkit/files/packaging`
 
 `stitchkit/files/packaging` owns `createNativePackaging` and the types

package/llms.txt

@@ -9,7 +9,7 @@ Build with stitchkit: define a contract once, then `implement` it and serve it (
 Load the slice for each entrypoint your code imports — `import … from 'stitchkit/server'` → `llms/server.txt`; the root `stitchkit` import → `llms/stitchkit.txt`. A slice holds that entrypoint's API reference section and the guide pages whose home it is; every guide lives in exactly one slice, and a slice that needs another's guide names it under "Also read". Each file is at most 50.0 KB; a longer one continues in numbered parts, each naming the next at its top. Moving across versions: load `llms/upgrading.txt` and the range slices it lists between your version and the target. `llms-full.txt` inlines everything; it is far larger than a context window, so do not read it whole.
 
 ## Entrypoint slices
-- **stitchkit**: [llms/stitchkit.txt](llms/stitchkit.txt) 46.5 KB → [llms/stitchkit.2.txt](llms/stitchkit.2.txt) 36.5 KB
+- **stitchkit**: [llms/stitchkit.txt](llms/stitchkit.txt) 46.7 KB → [llms/stitchkit.2.txt](llms/stitchkit.2.txt) 36.5 KB
 - **stitchkit/live**: [llms/live.txt](llms/live.txt) 21.2 KB
 - **stitchkit/react**: [llms/react.txt](llms/react.txt) 8.6 KB
 - **stitchkit/react/keyboard**: [llms/react-keyboard.txt](llms/react-keyboard.txt) 9.2 KB
@@ -18,17 +18,17 @@ Load the slice for each entrypoint your code imports — `import … from 'stitc
 - **stitchkit/tools/contract**: [llms/tools-contract.txt](llms/tools-contract.txt) 0.2 KB
 - **stitchkit/tools/invoker**: [llms/tools-invoker.txt](llms/tools-invoker.txt) 0.2 KB
 - **stitchkit/tools/connections**: [llms/tools-connections.txt](llms/tools-connections.txt) 3.7 KB
-- **stitchkit/cli**: [llms/cli.txt](llms/cli.txt) 47.0 KB → [llms/cli.2.txt](llms/cli.2.txt) 15.4 KB
+- **stitchkit/cli**: [llms/cli.txt](llms/cli.txt) 42.8 KB → [llms/cli.2.txt](llms/cli.2.txt) 20.1 KB
 - **stitchkit/cli/publish**: [llms/cli-publish.txt](llms/cli-publish.txt) 1.5 KB
 - **stitchkit/remote**: [llms/remote.txt](llms/remote.txt) 1.0 KB
 - **stitchkit/contract**: [llms/contract.txt](llms/contract.txt) 31.9 KB
 - **stitchkit/primitives**: [llms/primitives.txt](llms/primitives.txt) 11.7 KB
 - **stitchkit/server**: [llms/server.txt](llms/server.txt) 45.3 KB → [llms/server.2.txt](llms/server.2.txt) 14.6 KB → [llms/server.3.txt](llms/server.3.txt) 45.6 KB → [llms/server.4.txt](llms/server.4.txt) 38.3 KB → [llms/server.5.txt](llms/server.5.txt) 22.1 KB
 - **stitchkit/observability**: [llms/observability.txt](llms/observability.txt) 45.9 KB
-- **stitchkit/agent-runtime**: [llms/agent-runtime.txt](llms/agent-runtime.txt) 37.0 KB → [llms/agent-runtime.2.txt](llms/agent-runtime.2.txt) 46.7 KB → [llms/agent-runtime.3.txt](llms/agent-runtime.3.txt) 34.7 KB
+- **stitchkit/agent-runtime**: [llms/agent-runtime.txt](llms/agent-runtime.txt) 37.1 KB → [llms/agent-runtime.2.txt](llms/agent-runtime.2.txt) 46.7 KB → [llms/agent-runtime.3.txt](llms/agent-runtime.3.txt) 34.7 KB
 - **stitchkit/agent-runtime/testing**: [llms/agent-runtime-testing.txt](llms/agent-runtime-testing.txt) 2.6 KB
 - **stitchkit/agent-runtime/harness**: [llms/agent-runtime-harness.txt](llms/agent-runtime-harness.txt) 11.0 KB
-- **stitchkit/agent-runtime/coding-tools**: [llms/agent-runtime-coding-tools.txt](llms/agent-runtime-coding-tools.txt) 4.9 KB
+- **stitchkit/agent-runtime/coding-tools**: [llms/agent-runtime-coding-tools.txt](llms/agent-runtime-coding-tools.txt) 5.0 KB
 - **stitchkit/agent-runtime/browser**: [llms/agent-runtime-browser.txt](llms/agent-runtime-browser.txt) 3.8 KB
 - **stitchkit/agent-runtime/openrouter**: [llms/agent-runtime-openrouter.txt](llms/agent-runtime-openrouter.txt) 1.1 KB
 - **stitchkit/agent-runtime/sqlite/bun**: [llms/agent-runtime-sqlite-bun.txt](llms/agent-runtime-sqlite-bun.txt) 1.8 KB
@@ -56,7 +56,8 @@ Load the slice for each entrypoint your code imports — `import … from 'stitc
 - **stitchkit/node**: [llms/node.txt](llms/node.txt) 3.1 KB
 - **stitchkit/agent-runtime/react**: [llms/agent-runtime-react.txt](llms/agent-runtime-react.txt) 1.0 KB
 - **stitchkit/agent-runtime/realtime**: [llms/agent-runtime-realtime.txt](llms/agent-runtime-realtime.txt) 2.6 KB
-- **stitchkit/process**: [llms/process.txt](llms/process.txt) 44.9 KB
+- **stitchkit/process**: [llms/process.txt](llms/process.txt) 45.8 KB
+- **stitchkit/process/owner-loss**: [llms/process-owner-loss.txt](llms/process-owner-loss.txt) 0.9 KB
 - **stitchkit/files/packaging**: [llms/files-packaging.txt](llms/files-packaging.txt) 3.5 KB
 
 ## Upgrading slices

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stitchkit",
-  "version": "0.108.2",
+  "version": "0.108.4",
   "description": "Contract-first backend framework — one defineContract() into an HTTP API, MCP tools, AI-agent tools and a typed client. Bun and Node.",
   "keywords": [
     "bun",
@@ -249,6 +249,10 @@
       "types": "./dist/entrypoints/process.d.ts",
       "import": "./dist/entrypoints/process.js"
     },
+    "./process/owner-loss": {
+      "types": "./dist/entrypoints/process/owner-loss.d.ts",
+      "import": "./dist/entrypoints/process/owner-loss.js"
+    },
     "./files/packaging": {
       "types": "./dist/entrypoints/files/packaging.d.ts",
       "import": "./dist/entrypoints/files/packaging.js"