stitchkit 0.110.5 → 0.111.0

package/CHANGELOG.md

@@ -15,6 +15,45 @@ additive**; the first breaking change landed in 0.10.0. Grep the file for
 
 ## [Unreleased]
 
+## [0.111.0] - 2026-10-17
+
+### ⚠️ Breaking changes
+
+**Who must act:** applications whose raw routes call `parseBody` on JSON larger than 1 MiB, and applications whose OAuth clients send `/register` or `/token` bodies larger than 64 KiB. Everyone else changes nothing.
+
+- `stitchkit/server` — **`parseBody` reads at most 1 MiB by default** and returns `null` for a larger body, where it used to read any size into memory. An unbounded read of a raw route's body is a hole in the bounded-everything rule (I10), and `maxJsonBodyBytes` never covered raw routes. Before: `await parseBody(req, Schema)` parsed a body of any size; after: pass the limit your route needs, `await parseBody(req, Schema, { maxBytes: 8 * 1024 * 1024 })`. → ADR 0262
+  **Affects:** `stitchkit/server` parseBody
+- `stitchkit/tools` — **`mountOAuthProvider` reads at most 64 KiB of a `/token` or `/register` body** and answers `413` with `invalid_request` for a larger one, where it used to read any size. Before: no limit; after: the default is 64 KiB and `mountOAuthProvider({ ..., maxRequestBodyBytes: 256 * 1024 })` raises it. → ADR 0262
+  **Affects:** `stitchkit/tools` mountOAuthProvider
+
+### Added
+
+- `stitchkit/observability`: `request.payloadMaxBytes` sets how much of a request body the audit row reads with `includePayload` (default: the handler's `maxJsonBodyBytes`, or 1 MiB), and an event whose body was larger carries `payloadTruncated: true` beside its `null` payload.
+- `stitchkit/tools`: `mountOAuthProvider({ maxRequestBodyBytes })` sets the most bytes `/token` and `/register` read of a request body (default 64 KiB).
+- `stitchkit`, `stitchkit/http`: `readBoundedBody(source, { maxBytes, signal?, limitError, abortError? })` reads a `ReadableStream<Uint8Array>`, an async byte iterable or a `null` body into bytes without reading past `maxBytes` plus one chunk. The source is cancelled when the limit is crossed and when the signal aborts, an abort is honoured before the first read and while a read never settles, and the caller picks both errors. A consuming project no longer needs its own copy; the request-text, unix-client, connection-response, capped-download and sandbox-gateway readers of the framework now run on the same chunk loop. → ADR 0262
+- `stitchkit/server`, `stitchkit/node`: `defineRequestIngress<T>(name)` returns a typed key whose `attach(request, value)` is called by the code that builds a `Request` (a local socket ingress, a relay) and whose `from(ctx)` an endpoint, `authorize`, `beforeHandle` or `onError` reads. A header, `clone()` and `new Request(request)` carry nothing; a request from another ingress has no value. `ctx.req` is documented, and tested on every HTTP context, as the very `Request` the handler received. → ADR 0261
+- `stitchkit upgrade` prints a second section, **Fixes that touch this project**, with the same verdicts as breaking items for every fix of the range that names what it touches (`fixes` and `fixesWithoutAffects` in `--json`); `release:check` requires the `**Affects:**` line on a Fixed item that leads with a public entrypoint, from the release after 0.110.6. → ADR 0263
+
+### Fixed
+
+- `stitchkit/server`, `stitchkit/node`: a `createUnixClientTransport` request that is aborted while its body is being read rejects with the abort reason at once instead of waiting for the next chunk of a stalled source, and cancels the body when it crosses the request size limit.
+  **Affects:** `stitchkit/server`, `stitchkit/node` createUnixClientTransport
+- `stitchkit/server`: with `observability.includePayload`, the audit row reads the cloned request body up to `payloadMaxBytes` (by default the handler's `maxJsonBodyBytes`, or 1 MiB; an endpoint's own `maxJsonBodyBytes` is not known when the body is cloned, so set `payloadMaxBytes` for endpoints that accept more) and cancels that branch there; before, the clone branch of the body stream drained the whole body into memory even when the handler's own branch was cut at `maxJsonBodyBytes`.
+  **Affects:** `stitchkit/server` createServer(observability.includePayload)
+
+## [0.110.6] - 2026-10-15
+
+### Added
+
+- `stitchkit/server`: `createServer({ proxyOrigin: { trustedPeer } })` restores the external HTTP/HTTPS scheme from a single trusted ingress before fetch composition and routing. It validates the real TCP peer and one `X-Forwarded-Proto`, rejects competing URL headers, preserves wire Host/ports and native cancellation, peer lookup and WebSocket upgrade. `trustProxy` remains client-IP-only. The server surface grows by one configuration type, `ProxyOriginConfig`, owned by this entrypoint so the trust decision is explicit and independently testable (I8, I9, I12).
+
+### Fixed
+
+- `stitchkit/process`: bounded process-group settlement observations remain readable through nested cleanup errors in Node CI, including up to 16 actual states, the group id, sample count and elapsed time. Observation failures retain their original cause. Cleanup deadlines and the definition of a live process are unchanged; these diagnostics do not claim to repair a historical native termination failure.
+  **Affects:** `stitchkit/process` runNativeCommand
+- `stitchkit/process`: stopping a process group repeats `SIGKILL` for members still confirmed alive within the original cleanup deadline. Fresh kernel absence ends further signals; dead-only, invalid and failed process observations never trigger a blind re-signal.
+  **Affects:** `stitchkit/process` runNativeCommand
+
 ## [0.110.5] - 2026-10-15
 
 ### Added
@@ -52,6 +91,7 @@ additive**; the first breaking change landed in 0.10.0. Grep the file for
 ### Fixed
 
 - Process-group cleanup accepts a fresh kernel absence after SIGKILL instead of relying only on a potentially stale process-table snapshot. Permission refusals and unknown/exiting states still require proof; the same cleanup deadline applies and failures retain their last observed states.
+  **Affects:** `stitchkit/process` runNativeCommand
 - A synchronously throwing injected Socket.IO peer loader now reaches `onConnectError`, clears connection intent and allows the next `connect()` to retry, just like an asynchronously rejected loader.
 
 ## [0.110.0] - 2026-10-14
@@ -66,6 +106,7 @@ additive**; the first breaking change landed in 0.10.0. Grep the file for
 ### Fixed
 
 - A fast owner-loss guard exit no longer overtakes a buffered start handshake or discards captured output while the handshake is in flight. The control stream determines whether the handshake was missing, and output readers attach before waiting for it. Native lifetime qualification checks descendant death within its cleanup window before asserting stable output.
+  **Affects:** `stitchkit/process` runNativeCommand(ownerLoss: 'terminate')
 
 ### Added
 
@@ -79,6 +120,7 @@ additive**; the first breaking change landed in 0.10.0. Grep the file for
   timer on a loaded host. The grace wait and the Darwin permission retry read the clock once for both
   the decision to wait and the length of the wait, so Node no longer prints `TimeoutNegativeWarning`
   to the application's stderr when the deadline passes between two reads.
+  **Affects:** `stitchkit/process` runNativeCommand
 
 ## [0.109.3] - 2026-10-13
 
@@ -206,6 +248,7 @@ scripts relied on spelling-based conversion of dotted values.
   `Command deadline exceeded`. Under Bun a command is now launched through `Bun.spawn`, presented to the
   command owner with the same events, streams, group ownership and failure reporting; Node still uses
   `node:child_process`. The deadline, stop policy and process-group cleanup are unchanged.
+  **Affects:** `stitchkit/process` runNativeCommand
 
 ## [0.108.0] - 2026-10-06
 

package/dist/agent-runtime/branch-observations.d.ts

@@ -25,20 +25,8 @@ export declare function branchObservation(ids: BranchIdentities, kind: string, r
     delayMs?: number | undefined;
     reason?: string | undefined;
 } | {
-    effectName: string;
-    phase: "intent";
-    runId: string;
-    id?: string | undefined;
-} | {
-    effectName: string;
-    phase: "accepted";
+    stepName: string;
     encoded: string;
-    via: "reconcile" | "run";
-    runId: string;
-    id?: string | undefined;
-} | {
-    effectName: string;
-    phase: "uncertain";
     runId: string;
     id?: string | undefined;
 } | {
@@ -53,15 +41,27 @@ export declare function branchObservation(ids: BranchIdentities, kind: string, r
     id: string;
     runId: string;
 } | {
-    stepName: string;
+    event: string;
+    id: string;
     encoded: string;
     runId: string;
+} | {
+    effectName: string;
+    phase: "intent";
+    runId: string;
     id?: string | undefined;
 } | {
-    event: string;
-    id: string;
+    effectName: string;
+    phase: "accepted";
     encoded: string;
+    via: "reconcile" | "run";
+    runId: string;
+    id?: string | undefined;
+} | {
+    effectName: string;
+    phase: "uncertain";
     runId: string;
+    id?: string | undefined;
 } | {
     bytes: number;
     sha256?: string | undefined;

package/dist/agent-runtime/sandbox-broker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-broker.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/sandbox-broker.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE7E,6FAA6F;AAC7F,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,oBAAoB,EACrC,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI;;;GA4HlC"}
+{"version":3,"file":"sandbox-broker.d.ts","sourceRoot":"","sources":["../../src/agent-runtime/sandbox-broker.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgB,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE7E,6FAA6F;AAC7F,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,oBAAoB,EACrC,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI;;;GA4GlC"}

package/dist/browser/stream.d.ts

@@ -1,6 +1,7 @@
 import type { StreamFinalLinePolicy } from '../contract/define.js';
-import { type StreamByteSource } from '../internal/bounded-lines.js';
-export { DEFAULT_STREAM_LINE_BYTES, type StreamByteSource, StreamLineLimitError, StreamTruncatedLineError, } from '../internal/bounded-lines.js';
+import type { StreamByteSource } from '../internal/stream-chunks.js';
+export { DEFAULT_STREAM_LINE_BYTES, StreamLineLimitError, StreamTruncatedLineError, } from '../internal/bounded-lines.js';
+export type { StreamByteSource } from '../internal/stream-chunks.js';
 /** Options for `parseNDJSON` and `createNDJSONDecoder`. */
 export interface ParseNDJSONOptions {
     /** Maximum bytes retained for one line; past it, `StreamLineLimitError`. Default 1 MiB. */

package/dist/browser/stream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../src/browser/stream.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,yBAAyB,EACzB,KAAK,gBAAgB,EACrB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AAEnC,2DAA2D;AAC3D,MAAM,WAAW,kBAAkB;IACjC,2FAA2F;IAC3F,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACnD;;;OAGG;IACH,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,4FAA4F;IAC5F,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAiBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAuB,WAAW,CAAC,CAAC,EAClC,MAAM,EAAE,gBAAgB,EACxB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,cAAc,CAAC,CAAC,CAAC,CA4BnB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,CAAC,EAAE,CAAC;IAC7B,GAAG,IAAI,CAAC,EAAE,CAAC;CACZ;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EACnC,OAAO,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,QAAQ,CAAC,GAC3C,aAAa,CAAC,CAAC,CAAC,CAkClB;AAED,8BAA8B;AAC9B,MAAM,WAAW,eAAe;IAC9B,+FAA+F;IAC/F,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACnD,4FAA4F;IAC5F,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAuB,QAAQ,CAAC,CAAC,EAC/B,MAAM,EAAE,gBAAgB,EACxB,OAAO,CAAC,EAAE,eAAe,GACxB,cAAc,CAAC,CAAC,CAAC,CA6BnB"}
+{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../src/browser/stream.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAMhE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElE,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElE,2DAA2D;AAC3D,MAAM,WAAW,kBAAkB;IACjC,2FAA2F;IAC3F,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACnD;;;OAGG;IACH,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,4FAA4F;IAC5F,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAiBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAuB,WAAW,CAAC,CAAC,EAClC,MAAM,EAAE,gBAAgB,EACxB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,cAAc,CAAC,CAAC,CAAC,CA4BnB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,CAAC,EAAE,CAAC;IAC7B,GAAG,IAAI,CAAC,EAAE,CAAC;CACZ;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EACnC,OAAO,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,QAAQ,CAAC,GAC3C,aAAa,CAAC,CAAC,CAAC,CAkClB;AAED,8BAA8B;AAC9B,MAAM,WAAW,eAAe;IAC9B,+FAA+F;IAC/F,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACnD,4FAA4F;IAC5F,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAuB,QAAQ,CAAC,CAAC,EAC/B,MAAM,EAAE,gBAAgB,EACxB,OAAO,CAAC,EAAE,eAAe,GACxB,cAAc,CAAC,CAAC,CAAC,CA6BnB"}

package/dist/contract/runtime-context.d.ts

@@ -81,7 +81,9 @@ export interface RuntimeContext {
      * validation failure). Absent on the non-HTTP transports (MCP / agent / CLI /
      * a bring-your-own lane), which carry no `Request`, so they are optional and a
      * reader narrows them. Web Fetch types only — the core stays Fetch-clean
-     * (→ ADR 0013).
+     * (→ ADR 0013). On every HTTP context it is the very `Request` the handler of
+     * the core received, never a copy: a `RequestIngress` key attached by the code
+     * that built that request reads its value through this identity.
      */
     req?: Request;
     url?: URL;

package/dist/contract/runtime-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-context.d.ts","sourceRoot":"","sources":["../../src/contract/runtime-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAIhD;;;;;;GAMG;AACH,wBAAgB,SAAS,CACvB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACjD,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAChD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAQrC;AAED,mFAAmF;AACnF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,2DAA2D;AAC3D,MAAM,MAAM,eAAe,GACvB,gBAAgB,GAChB,UAAU,GACV,WAAW,GACX,SAAS,GACT,UAAU,CAAC;AAEf;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACjC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAE7E,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,eAAe,CAAC;IACxB;;;;;;;OAOG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,2EAA2E;IAC3E,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,iBAAiB,CAAC;IACnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAID,MAAM,WAAW,cAAc,CAAC,OAAO,GAAG,SAAS,EAAE,MAAM,GAAG,SAAS;IACrE,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,eAAe,CAAC;IACxB;+DAC2D;IAC3D,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,iBAAiB,CAAC;IACnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB"}
+{"version":3,"file":"runtime-context.d.ts","sourceRoot":"","sources":["../../src/contract/runtime-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAIhD;;;;;;GAMG;AACH,wBAAgB,SAAS,CACvB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACjD,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAChD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAQrC;AAED,mFAAmF;AACnF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,2DAA2D;AAC3D,MAAM,MAAM,eAAe,GACvB,gBAAgB,GAChB,UAAU,GACV,WAAW,GACX,SAAS,GACT,UAAU,CAAC;AAEf;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACjC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAE7E,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,eAAe,CAAC;IACxB;;;;;;;;;OASG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,2EAA2E;IAC3E,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,iBAAiB,CAAC;IACnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAID,MAAM,WAAW,cAAc,CAAC,OAAO,GAAG,SAAS,EAAE,MAAM,GAAG,SAAS;IACrE,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,eAAe,CAAC;IACxB;+DAC2D;IAC3D,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,iBAAiB,CAAC;IACnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB"}

package/dist/entrypoints/agent-runtime/coding-tools.js

@@ -6,10 +6,10 @@ import {
   AgentCodingToolAuthorizationSchema2,
   AgentCodingToolPathAuthorizationSchema2,
   createAgentCodingTools2
-} from "../../index-bm180f2d.js";
+} from "../../index-ey15wx6j.js";
 import"../../index-2kbysk9s.js";
 import"../../index-84bf5spd.js";
-import"../../index-e1sjcjfy.js";
+import"../../index-7r4knwf8.js";
 import"../../index-zrtrjkbf.js";
 import"../../index-636mggad.js";
 export {

package/dist/entrypoints/agent-runtime/sandbox.js

@@ -3,7 +3,7 @@ import {
   missingSandboxRestrictions2,
   codingRefusal,
   createAgentCodingTools2
-} from "../../index-bm180f2d.js";
+} from "../../index-ey15wx6j.js";
 import"../../index-ct75c3at.js";
 import"../../index-q6crhe1n.js";
 import"../../index-fynr93w4.js";
@@ -17,8 +17,11 @@ import {
   nativeCommandOwner,
   terminateOwnedGroup,
   startNativeCommand
-} from "../../index-e1sjcjfy.js";
+} from "../../index-7r4knwf8.js";
 import"../../index-zrtrjkbf.js";
+import {
+  readBoundedBody2
+} from "../../index-qndsr7f0.js";
 import {
   MAX_TIMER_MS
 } from "../../index-eemvahkc.js";
@@ -108,15 +111,10 @@ async function createSandboxBroker(socketPath, getPolicy, onError) {
     req.on("aborted", abort);
     res.on("close", abort);
     try {
-      const chunks = [];
-      let size = 0;
-      for await (const chunk of req) {
-        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        size += bytes.byteLength;
-        if (size > maxBytes)
-          throw new SandboxError("SANDBOX_LIMIT", "Sandbox request limit exceeded");
-        chunks.push(bytes);
-      }
+      const requestBody = await readBoundedBody2(req, {
+        maxBytes,
+        limitError: () => new SandboxError("SANDBOX_LIMIT", "Sandbox request limit exceeded")
+      });
       const target = new URL(req.url, rule.origin);
       if (target.origin !== new URL(rule.origin).origin)
         throw new SandboxError("SANDBOX_NETWORK_DENIED", "Sandbox network denied");
@@ -133,31 +131,19 @@ async function createSandboxBroker(socketPath, getPolicy, onError) {
         headers,
         redirect: "manual",
         signal: controller.signal,
-        ...size > 0 && { body: Buffer.concat(chunks) }
+        ...requestBody.byteLength > 0 && { body: requestBody }
       });
       if (response.status >= 300 && response.status < 400) {
         await response.body?.cancel();
         throw new SandboxError("SANDBOX_NETWORK_DENIED", "Sandbox redirects are denied");
       }
-      const reader = response.body?.getReader();
-      const output = [];
-      size = 0;
-      try {
-        while (reader) {
-          const next = await reader.read();
-          if (next.done)
-            break;
-          size += next.value.byteLength;
-          if (size > maxBytes)
-            throw new SandboxError("SANDBOX_LIMIT", "Sandbox response limit exceeded");
-          output.push(next.value);
-        }
-      } finally {
-        await reader?.cancel();
-      }
+      const output = await readBoundedBody2(response.body, {
+        maxBytes,
+        limitError: () => new SandboxError("SANDBOX_LIMIT", "Sandbox response limit exceeded")
+      });
       const type = response.headers.get("content-type");
       res.writeHead(response.status, type ? { "content-type": type } : {});
-      res.end(Buffer.concat(output));
+      res.end(output);
     } catch (cause) {
       try {
         onError(cause);

package/dist/entrypoints/agent-runtime/sqlite/bun.js

@@ -1,20 +1,20 @@
 import"../../../index-jna0ejsa.js";
-import"../../../index-mpg1t7nv.js";
+import"../../../index-0z3kfphz.js";
 import"../../../index-8kzct1d6.js";
 import {
   initializeAgentRuntimeSqlite2,
   createSqliteAgentRuntimeStore2
-} from "../../../index-5pbtbce0.js";
+} from "../../../index-7c957abz.js";
 import"../../../index-kqnd6a85.js";
 import"../../../index-5w6t91ze.js";
-import"../../../index-bm180f2d.js";
+import"../../../index-ey15wx6j.js";
 import"../../../index-ct75c3at.js";
 import"../../../index-q6crhe1n.js";
 import"../../../index-fynr93w4.js";
 import"../../../index-2kbysk9s.js";
 import"../../../index-84bf5spd.js";
+import"../../../index-7r4knwf8.js";
 import"../../../index-snef22zr.js";
-import"../../../index-e1sjcjfy.js";
 import"../../../index-zrtrjkbf.js";
 import"../../../index-636mggad.js";
 

package/dist/entrypoints/agent-runtime/sqlite/node.js

@@ -1,20 +1,20 @@
 import"../../../index-jna0ejsa.js";
-import"../../../index-mpg1t7nv.js";
+import"../../../index-0z3kfphz.js";
 import"../../../index-8kzct1d6.js";
 import {
   initializeAgentRuntimeSqlite2,
   createSqliteAgentRuntimeStore2
-} from "../../../index-5pbtbce0.js";
+} from "../../../index-7c957abz.js";
 import"../../../index-kqnd6a85.js";
 import"../../../index-5w6t91ze.js";
-import"../../../index-bm180f2d.js";
+import"../../../index-ey15wx6j.js";
 import"../../../index-ct75c3at.js";
 import"../../../index-q6crhe1n.js";
 import"../../../index-fynr93w4.js";
 import"../../../index-2kbysk9s.js";
 import"../../../index-84bf5spd.js";
+import"../../../index-7r4knwf8.js";
 import"../../../index-snef22zr.js";
-import"../../../index-e1sjcjfy.js";
 import"../../../index-zrtrjkbf.js";
 import"../../../index-636mggad.js";
 

package/dist/entrypoints/agent-runtime/testing.js

@@ -10,18 +10,18 @@ import {
   advanceToolChronology
 } from "../../index-jna0ejsa.js";
 import"../../index-5w6t91ze.js";
-import"../../index-bm180f2d.js";
-import"../../index-mpg1t7nv.js";
+import"../../index-ey15wx6j.js";
+import"../../index-0z3kfphz.js";
 import"../../index-ct75c3at.js";
 import"../../index-q6crhe1n.js";
 import"../../index-fynr93w4.js";
 import"../../index-2kbysk9s.js";
 import"../../index-84bf5spd.js";
+import"../../index-7r4knwf8.js";
 import"../../index-snef22zr.js";
 import {
   createMemoryAgentRuntimeStore2
-} from "../../index-9ket8wzx.js";
-import"../../index-e1sjcjfy.js";
+} from "../../index-mnk5vgdr.js";
 import"../../index-zrtrjkbf.js";
 import {
   assertPositiveSafeInteger

package/dist/entrypoints/agent-runtime.js

@@ -5,7 +5,7 @@ import {
   missingSandboxRestrictions2,
   recordAgentSandboxProbe2,
   refuseUnknownSpillReference
-} from "../index-bm180f2d.js";
+} from "../index-ey15wx6j.js";
 import {
   AgentRecordIdSchema2,
   AgentRecordVersionSchema2,
@@ -58,7 +58,7 @@ import {
   AgentHistoryMutationSchema2,
   ACTIVE_AGENT_RUN_STATES2,
   createAgentRuntimeStore2
-} from "../index-mpg1t7nv.js";
+} from "../index-0z3kfphz.js";
 import {
   AgentStoreEventKindSchema2,
   AgentStoreEventEnvelopeSchema2,
@@ -188,13 +188,13 @@ import {
 import"../index-56yx8dxp.js";
 import"../index-2kbysk9s.js";
 import"../index-84bf5spd.js";
+import"../index-7r4knwf8.js";
 import {
   createMemoryAgentRuntimeStore2
-} from "../index-9ket8wzx.js";
+} from "../index-mnk5vgdr.js";
 import {
   createAgentRuntimeEventSink2
 } from "../index-616xh7f2.js";
-import"../index-e1sjcjfy.js";
 import"../index-zrtrjkbf.js";
 import {
   MAX_TIMER_MS

package/dist/entrypoints/bin/upgrade-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upgrade-cli.d.ts","sourceRoot":"","sources":["../../../src/entrypoints/bin/upgrade-cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,KAAK,MAAM,EAA2C,MAAM,SAAS,CAAC;AAI/E,OAAO,EACL,KAAK,aAAa,EAKnB,MAAM,8BAA8B,CAAC;AA4BtC,mGAAmG;AACnG,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;CAChC;AAED,yFAAyF;AACzF,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAWD;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,EAAE,GAAE,eAGH,GACA;IAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAAC,SAAS,EAAE,SAAS,EAAE,CAAA;CAAE,CAiCtD;AAoCD,MAAM,WAAW,gBAAgB;IAC/B,+BAA+B;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,CA+DvE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CASrF"}
+{"version":3,"file":"upgrade-cli.d.ts","sourceRoot":"","sources":["../../../src/entrypoints/bin/upgrade-cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,KAAK,MAAM,EAA2C,MAAM,SAAS,CAAC;AAI/E,OAAO,EACL,KAAK,aAAa,EAOnB,MAAM,8BAA8B,CAAC;AA8BtC,mGAAmG;AACnG,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;CAChC;AAED,yFAAyF;AACzF,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAWD;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,EAAE,GAAE,eAGH,GACA;IAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAAC,SAAS,EAAE,SAAS,EAAE,CAAA;CAAE,CAiCtD;AAoCD,MAAM,WAAW,gBAAgB;IAC/B,+BAA+B;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,CA8EvE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CASrF"}

package/dist/entrypoints/bin/upgrade-cli.js

@@ -47,6 +47,31 @@ function breakingItems(section) {
   flush();
   return items;
 }
+function fixedSectionItems(releaseBody) {
+  const items = [];
+  let section;
+  let fenced = false;
+  const flush = () => {
+    if (section)
+      items.push(...breakingItems(section.join(`
+`)));
+    section = undefined;
+  };
+  for (const line of releaseBody.split(`
+`)) {
+    if (FENCE.test(line))
+      fenced = !fenced;
+    if (!fenced && /^### /.test(line)) {
+      flush();
+      if (/^### Fixed\b/.test(line))
+        section = [];
+      continue;
+    }
+    section?.push(line);
+  }
+  flush();
+  return items;
+}
 function affectsLineOf(itemMarkdown) {
   let fenced = false;
   const lines = [];
@@ -127,13 +152,13 @@ function parseAffectsLine(line) {
 // src/internal/upgrade-plan.ts
 var BREAKING_HEADING = /^### \s*⚠️?\s*Breaking changes[^\n]*$/m;
 var NOT_DECLARED = "Not declared in this legacy changelog section.";
-function leadingEntrypoints(item) {
+function leadingEntrypoints(item, accept = () => true) {
   let rest = item.replace(/^[-*+] /, "").replace(/^\*\*/, "");
   const names = [];
   for (;; ) {
-    const match = /^`(stitchkit(?:\/[a-z0-9][a-z0-9-]*)*)`/.exec(rest);
+    const match = /^`(stitchkit(?:-[a-z0-9-]+)?(?:\/[a-z0-9][a-z0-9-]*)*)`/.exec(rest);
     const name = match?.[1];
-    if (!match || name === undefined)
+    if (!match || name === undefined || !accept(name))
       break;
     names.push(name);
     rest = rest.slice(match[0].length);
@@ -157,18 +182,32 @@ function itemAudience(item) {
   const who = /\*\*Who must act:\*\*\s*(.*?)(?=\s+See \[|\s+→|\s+\*\*Affects:\*\*|$)/.exec(flat)?.[1];
   return who?.trim() || undefined;
 }
+function upgradeItem(version, item, title = itemTitle) {
+  const line = affectsLineOf(item);
+  return {
+    version,
+    entrypoints: leadingEntrypoints(item),
+    title: title(item.replace(/^[ \t]*\*\*Affects:\*\*.*$/gm, "").trimEnd()),
+    affects: line === undefined ? undefined : parseAffectsLine(line),
+    markdown: item
+  };
+}
+function fixTitle(item) {
+  const flat = item.replace(/\s+/g, " ").replace(/^[-*+] /, "").trim();
+  const prefix = /^(?:`stitchkit[^`]*`(?:, and |, | and | \+ )?)+\s*[:—-]?\s*/.exec(flat);
+  const text = flat.slice(prefix?.[0].length ?? 0).replace(/\*\*/g, "");
+  const sentence = /^(.*?[.!?])(?:\s|$)/.exec(text)?.[1] ?? text;
+  const trimmed = sentence.replace(/[.:]$/, "");
+  return trimmed.length > 100 ? `${trimmed.slice(0, 99)}…` : trimmed;
+}
+function fixedItem(version, item) {
+  return upgradeItem(version, item, fixTitle);
+}
 function sectionItems(version, markdown, sectionAudience) {
-  return breakingItems(markdown).map(({ markdown: item }) => {
-    const line = affectsLineOf(item);
-    return {
-      version,
-      entrypoints: leadingEntrypoints(item),
-      title: itemTitle(item),
-      affects: line === undefined ? undefined : parseAffectsLine(line),
-      whoMustAct: itemAudience(item) ?? sectionAudience,
-      markdown: item
-    };
-  });
+  return breakingItems(markdown).map(({ markdown: item }) => ({
+    ...upgradeItem(version, item),
+    whoMustAct: itemAudience(item) ?? sectionAudience
+  }));
 }
 function semverParts(version) {
   const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
@@ -190,14 +229,14 @@ function compareSemver(left, right) {
   }
   return 0;
 }
-function planUpgrade(changelog, from, to) {
+function releasesInRange(changelog, from, to) {
   semverParts(from);
   semverParts(to);
   if (compareSemver(from, to) >= 0) {
     throw new Error(`Upgrade range must increase: ${from} → ${to}`);
   }
   const releases = [...changelog.matchAll(/^## \[(\d+\.\d+\.\d+)\].*$/gm)];
-  const changes = [];
+  const found = [];
   for (const [index, release] of releases.entries()) {
     const version = release[1];
     if (version === undefined)
@@ -206,7 +245,13 @@ function planUpgrade(changelog, from, to) {
       continue;
     const bodyStart = (release.index ?? 0) + release[0].length;
     const bodyEnd = releases[index + 1]?.index ?? changelog.length;
-    const body = changelog.slice(bodyStart, bodyEnd);
+    found.push({ version, body: changelog.slice(bodyStart, bodyEnd) });
+  }
+  return found;
+}
+function planUpgrade(changelog, from, to) {
+  const changes = [];
+  for (const { version, body } of releasesInRange(changelog, from, to)) {
     const breakingHeader = BREAKING_HEADING.exec(body);
     if (!breakingHeader)
       continue;
@@ -225,6 +270,17 @@ function planUpgrade(changelog, from, to) {
   }
   return changes.sort((left, right) => compareSemver(left.version, right.version));
 }
+function fixedItems(version, body) {
+  return fixedSectionItems(body).map(({ markdown }) => fixedItem(version, markdown));
+}
+function planFixes(changelog, from, to) {
+  const releases = releasesInRange(changelog, from, to).sort((left, right) => compareSemver(left.version, right.version));
+  const all = releases.flatMap(({ version, body }) => fixedItems(version, body));
+  return {
+    declared: all.filter((item) => item.affects !== undefined),
+    withoutAffects: all.filter((item) => item.affects === undefined).length
+  };
+}
 function renderUpgradePlan(changes, from, to) {
   const header = `# Stitchkit upgrade ${from} → ${to}`;
   if (changes.length === 0)
@@ -411,10 +467,8 @@ var VERDICT_TEXT = {
   behavioural: "behavioural — check by hand",
   "not-declared": "not declared — check by hand"
 };
-function renderUpgradeVerdicts(verdicts) {
-  if (verdicts.length === 0)
-    return "";
-  const lines = ["## Does it touch this project?", ""];
+function renderVerdictLines(verdicts) {
+  const lines = [];
   for (const { item, verdict } of verdicts) {
     const where = item.entrypoints.length > 0 ? ` ${item.entrypoints.map((name) => `\`${name}\``).join(", ")}` : "";
     lines.push(`- **${item.version}**${where} — ${item.title}: **${VERDICT_TEXT[verdict.kind]}**`);
@@ -425,23 +479,47 @@ function renderUpgradeVerdicts(verdicts) {
       for (const file of verdict.files)
         lines.push(`  - ${file}`);
   }
+  return lines;
+}
+function renderUpgradeVerdicts(verdicts) {
+  if (verdicts.length === 0)
+    return "";
+  return `${["## Does it touch this project?", "", ...renderVerdictLines(verdicts)].join(`
+`)}
+`;
+}
+function renderUpgradeFixes(verdicts, withoutAffects) {
+  if (verdicts.length === 0 && withoutAffects === 0)
+    return "";
+  const lines = ["## Fixes that touch this project", ""];
+  lines.push(...renderVerdictLines(verdicts));
+  if (verdicts.length === 0)
+    lines.push("No fix of this range names what it touches.");
+  if (withoutAffects > 0)
+    lines.push("", `${withoutAffects} more fix${withoutAffects === 1 ? "" : "es"} in this range carry no machine line and are not judged here.`);
   return `${lines.join(`
 `)}
 `;
 }
 function upgradeVerdictsJson(verdicts) {
-  return verdicts.map(({ item, verdict }) => ({
+  return verdicts.map((entry) => verdictJson(entry, entry.item.whoMustAct));
+}
+function upgradeFixesJson(verdicts) {
+  return verdicts.map((entry) => verdictJson(entry));
+}
+function verdictJson({ item, verdict }, whoMustAct) {
+  return {
     version: item.version,
     entrypoints: item.entrypoints,
     title: item.title,
-    whoMustAct: item.whoMustAct,
+    ...whoMustAct !== undefined && { whoMustAct },
     affects: item.affects ?? null,
     verdict: verdict.kind,
     ...verdict.kind === "affects" && { uses: verdict.uses },
     ...(verdict.kind === "behavioural" || verdict.kind === "not-declared") && {
       files: verdict.files
     }
-  }));
+  };
 }
 
 // src/entrypoints/bin/upgrade-cli.ts
@@ -455,11 +533,13 @@ Options
   --to <version>       target version (default: the version of this package)
   --cwd <dir>          project to read the installed version and imports from (default: .)
   --changelog <path>   changelog to plan from (default: the one in this package)
-  --json               print the breaking items and their verdicts as JSON
+  --json               print the breaking items, the fixes and their verdicts as JSON
 
 Each breaking item is matched against what the project imports from stitchkit:
 "affects this project" (with file:line), "not used here", "behavioural — check
 by hand" or, for an item written before machine lines, "not declared — check by hand".
+The fixes of the range that name what they touch get the same verdicts in a
+second section; a fix that carries no such line is only counted.
 `;
 var SKIPPED_DIRECTORIES = new Set(["node_modules", ".git", ".next", ".turbo", ".cache"]);
 var OUTPUT_DIRECTORIES = new Set(["dist", "build", "out", "coverage"]);
@@ -555,7 +635,7 @@ ${USAGE}`, code: 1 };
   const json = argv.includes("--json");
   if (from === to) {
     return json ? {
-      output: `${JSON.stringify({ from, to, items: [], unscanned: [] }, null, 2)}
+      output: `${JSON.stringify({ from, to, items: [], fixes: [], fixesWithoutAffects: 0, unscanned: [] }, null, 2)}
 `,
       code: 0
     } : { output: `Already on ${to}. Nothing to upgrade.
@@ -569,14 +649,28 @@ ${USAGE}`, code: 1 };
     throw new Error(`Cannot read the changelog at ${changelogPath}`);
   }
   const plan = planUpgrade(changelog, from, to);
+  const fixes = planFixes(changelog, from, to);
   const { sources, unscanned } = projectSources(cwd);
-  const verdicts = upgradeVerdicts(plan.flatMap((change) => change.items), scanStitchkitImports(sources));
+  const imports = scanStitchkitImports(sources);
+  const verdicts = upgradeVerdicts(plan.flatMap((change) => change.items), imports);
+  const fixVerdicts = upgradeVerdicts(fixes.declared, imports);
   if (json) {
-    const document = { from, to, items: upgradeVerdictsJson(verdicts), unscanned };
+    const document = {
+      from,
+      to,
+      items: upgradeVerdictsJson(verdicts),
+      fixes: upgradeFixesJson(fixVerdicts),
+      fixesWithoutAffects: fixes.withoutAffects,
+      unscanned
+    };
     return { output: `${JSON.stringify(document, null, 2)}
 `, code: 0 };
   }
-  const usage = renderUpgradeVerdicts(verdicts);
+  const usage = [
+    renderUpgradeVerdicts(verdicts),
+    renderUpgradeFixes(fixVerdicts, fixes.withoutAffects)
+  ].filter(Boolean).join(`
+`);
   const skipped = unscanned.length === 0 ? "" : `
 ## Not scanned