stitchkit 0.111.1 → 0.111.3

package/dist/internal/exclusive-lock-owner.d.ts

@@ -0,0 +1,53 @@
+import { z } from 'zod';
+import { type FileIdentity } from './open-descriptors.js';
+import { type ProcessOwnerEvidence } from './process-instance.js';
+/** Who holds a lock, as its file records it. */
+declare const ExclusiveLockOwnerSchema: z.ZodObject<{
+    pid: z.ZodNumber;
+    host: z.ZodString;
+    acquiredAt: z.ZodString;
+    machine: z.ZodCatch<z.ZodOptional<z.ZodString>>;
+    process: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        platform: z.ZodEnum<{
+            darwin: "darwin";
+            linux: "linux";
+        }>;
+        bootId: z.ZodString;
+        namespace: z.ZodString;
+        startId: z.ZodString;
+    }, z.core.$strict>>>>;
+}, z.core.$strip>;
+export type ExclusiveLockOwner = z.infer<typeof ExclusiveLockOwnerSchema>;
+/** Why a present lock was or was not taken. */
+export interface ExclusiveLockDiagnosis {
+    readonly attribution: 'this-machine' | 'another-machine' | 'unattributable';
+    readonly liveness: 'alive' | 'gone' | 'not-probed';
+    /**
+     * The process evidence, plus `descriptor-closed`: the record names this very process, and no
+     * descriptor of this process is open on the lock — an earlier image of the PID left it.
+     */
+    readonly identity?: ProcessOwnerEvidence['identity'] | 'descriptor-closed';
+    readonly owner: ExclusiveLockOwner | null;
+    readonly cause?: unknown;
+}
+export declare function readOwner(text: string): {
+    owner: ExclusiveLockOwner | undefined;
+    ownerless: boolean;
+};
+/** A lock file as read: its recorded owner, if readable, and the file it was read from. */
+export interface RecordedLock extends FileIdentity {
+    readonly path: string;
+    readonly owner: ExclusiveLockOwner | undefined;
+}
+/**
+ * Judge the recorded owner of a lock file that was read, or of none when it was not.
+ *
+ * A record that names this process with matching kernel identity is held only while a descriptor
+ * of this process is open on the file: a holder keeps the descriptor it created the lock with
+ * until it releases, in every version that records a process identity. A process image replaced
+ * in place keeps its PID and start time but not that descriptor, so the lock it left is gone —
+ * judged alive, it would stay held until the PID changed.
+ */
+export declare function diagnose(lock: RecordedLock | undefined, declaredIdentity: string | undefined): Promise<ExclusiveLockDiagnosis>;
+export {};
+//# sourceMappingURL=exclusive-lock-owner.d.ts.map

package/dist/internal/exclusive-lock-owner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exclusive-lock-owner.d.ts","sourceRoot":"","sources":["../../src/internal/exclusive-lock-owner.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,YAAY,EAAuB,MAAM,oBAAoB,CAAC;AAE5E,OAAO,EAEL,KAAK,oBAAoB,EAE1B,MAAM,oBAAoB,CAAC;AAG5B,gDAAgD;AAChD,QAAA,MAAM,wBAAwB;;;;;;;;;;;;;;iBAO5B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,+CAA+C;AAC/C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,EAAE,cAAc,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;IAC5E,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,YAAY,CAAC;IACnD;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAC,UAAU,CAAC,GAAG,mBAAmB,CAAC;IAC3E,QAAQ,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG;IACvC,KAAK,EAAE,kBAAkB,GAAG,SAAS,CAAC;IACtC,SAAS,EAAE,OAAO,CAAC;CACpB,CAkBA;AAoBD,2FAA2F;AAC3F,MAAM,WAAW,YAAa,SAAQ,YAAY;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,GAAG,SAAS,CAAC;CAChD;AAED;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,YAAY,GAAG,SAAS,EAC9B,gBAAgB,EAAE,MAAM,GAAG,SAAS,GACnC,OAAO,CAAC,sBAAsB,CAAC,CAcjC"}

package/dist/internal/exclusive-lock.d.ts

@@ -1,30 +1,4 @@
-import { z } from 'zod';
-import { type ProcessOwnerEvidence } from './process-instance.js';
-/** Who holds a lock, as its file records it. */
-declare const ExclusiveLockOwnerSchema: z.ZodObject<{
-    pid: z.ZodNumber;
-    host: z.ZodString;
-    acquiredAt: z.ZodString;
-    machine: z.ZodCatch<z.ZodOptional<z.ZodString>>;
-    process: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodObject<{
-        platform: z.ZodEnum<{
-            darwin: "darwin";
-            linux: "linux";
-        }>;
-        bootId: z.ZodString;
-        namespace: z.ZodString;
-        startId: z.ZodString;
-    }, z.core.$strict>>>>;
-}, z.core.$strip>;
-export type ExclusiveLockOwner = z.infer<typeof ExclusiveLockOwnerSchema>;
-/** Why a present lock was not taken. */
-export interface ExclusiveLockDiagnosis {
-    readonly attribution: 'this-machine' | 'another-machine' | 'unattributable';
-    readonly liveness: 'alive' | 'gone' | 'not-probed';
-    readonly identity?: ProcessOwnerEvidence['identity'];
-    readonly owner: ExclusiveLockOwner | null;
-    readonly cause?: unknown;
-}
+import { type ExclusiveLockDiagnosis, type ExclusiveLockOwner } from './exclusive-lock-owner.js';
 /** A lock this process holds. */
 export interface HeldExclusiveLock {
     readonly path: string;
@@ -64,5 +38,4 @@ export type ExclusiveLockAttempt = {
 export declare function attemptExclusiveLock(path: string, options: ExclusiveLockAttemptOptions, depth?: number): Promise<ExclusiveLockAttempt>;
 /** Read the owner a present lock records, for a refusal that has to name it. */
 export declare function readExclusiveLockOwner(path: string): Promise<ExclusiveLockOwner | null>;
-export {};
 //# sourceMappingURL=exclusive-lock.d.ts.map

package/dist/internal/exclusive-lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exclusive-lock.d.ts","sourceRoot":"","sources":["../../src/internal/exclusive-lock.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAEL,KAAK,oBAAoB,EAG1B,MAAM,oBAAoB,CAAC;AAG5B,gDAAgD;AAChD,QAAA,MAAM,wBAAwB;;;;;;;;;;;;;;iBAO5B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,wCAAwC;AACxC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,EAAE,cAAc,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;IAC5E,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,YAAY,CAAC;IACnD,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,kFAAkF;IAClF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,yEAAyE;IACzE,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,uFAAuF;IACvF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACpC;IACE,kDAAkD;IAClD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,6CAA6C;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC;CAC7C,CAAC;AA8VN;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,2BAA2B,EACpC,KAAK,SAAI,GACR,OAAO,CAAC,oBAAoB,CAAC,CAgC/B;AAED,gFAAgF;AAChF,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAEpC"}
+{"version":3,"file":"exclusive-lock.d.ts","sourceRoot":"","sources":["../../src/internal/exclusive-lock.ts"],"names":[],"mappings":"AA6BA,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EAGxB,MAAM,wBAAwB,CAAC;AAMhC,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,kFAAkF;IAClF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,yEAAyE;IACzE,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,uFAAuF;IACvF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACpC;IACE,kDAAkD;IAClD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,6CAA6C;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC;CAC7C,CAAC;AAwSN;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,2BAA2B,EACpC,KAAK,SAAI,GACR,OAAO,CAAC,oBAAoB,CAAC,CAgC/B;AAED,gFAAgF;AAChF,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAEpC"}

package/dist/internal/open-descriptors.d.ts

@@ -0,0 +1,18 @@
+/** The file a descriptor must refer to, as `stat` identifies it. */
+export interface FileIdentity {
+    readonly ino: number;
+    readonly dev: number;
+}
+/**
+ * `true` when another descriptor of this process refers to the file at `path` — still the file
+ * `file` names — `false` when none does, and `null` when that cannot be told: the file is gone or
+ * replaced, or the listing is not proven complete. Unknown never proves that a holder is gone.
+ *
+ * The listing proves itself: the probe opens the file, and the answer counts only when the
+ * listing contains that fresh descriptor. A platform that lists a fixed few descriptors (a BSD
+ * `/dev/fd` without fdescfs lists 0–2) answers `null`, not a false "nobody holds it".
+ */
+export declare function holdsOpenDescriptor(path: string, file: FileIdentity, 
+/** @internal A fixture listing; the real one is always this process's own. */
+descriptorDirectory?: string): Promise<boolean | null>;
+//# sourceMappingURL=open-descriptors.d.ts.map

package/dist/internal/open-descriptors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-descriptors.d.ts","sourceRoot":"","sources":["../../src/internal/open-descriptors.ts"],"names":[],"mappings":"AAkBA,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,YAAY;AAClB,8EAA8E;AAC9E,mBAAmB,SAAuB,GACzC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAkCzB"}

package/dist/internal/with-exclusive-lock.d.ts

@@ -1,15 +1,5 @@
-/**
- * Run work under an exclusive lock between processes, waiting for it within a
- * deadline and a cancellation signal.
- *
- * The waiting is what the journal never needed and every other caller does: a
- * registry, a cursor or a mailbox is held for milliseconds, so a second process
- * should wait its turn rather than fail. It waits within a bound, stops the
- * moment its signal aborts — during the wait, not after it — and a refusal names
- * the resource and whoever holds it, so "timed out" is never the whole message.
- */
-import { type ExclusiveLockOwner } from './exclusive-lock.js';
-export type { ExclusiveLockOwner } from './exclusive-lock.js';
+import type { ExclusiveLockOwner } from './exclusive-lock-owner.js';
+export type { ExclusiveLockOwner } from './exclusive-lock-owner.js';
 /** Options of {@link withExclusiveLock}. */
 export interface ExclusiveLockOptions {
     /** What the lock guards, named in a refusal. Defaults to the lock path. */

package/dist/internal/with-exclusive-lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"with-exclusive-lock.d.ts","sourceRoot":"","sources":["../../src/internal/with-exclusive-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,gIAAgI;IAChI,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,+EAA+E;IAC/E,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED,qEAAqE;AACrE,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,GAAG,WAAW;IAC5D,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI;IALnC,IAAI,SAAwB;IACrC,YACW,IAAI,EAAE,cAAc,GAAG,cAAc,GAAG,WAAW,EACnD,KAAK,EAAE,MAAM;IACtB,wFAAwF;IAC/E,MAAM,EAAE,kBAAkB,GAAG,IAAI,EAC1C,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAG9B;CACF;AA2BD;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAC5C,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,CAAC,CAAC,CA2FZ"}
+{"version":3,"file":"with-exclusive-lock.d.ts","sourceRoot":"","sources":["../../src/internal/with-exclusive-lock.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAA0B,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGzF,YAAY,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,gIAAgI;IAChI,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,+EAA+E;IAC/E,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED,qEAAqE;AACrE,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,GAAG,WAAW;IAC5D,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI;IALnC,IAAI,SAAwB;IACrC,YACW,IAAI,EAAE,cAAc,GAAG,cAAc,GAAG,WAAW,EACnD,KAAK,EAAE,MAAM;IACtB,wFAAwF;IAC/E,MAAM,EAAE,kBAAkB,GAAG,IAAI,EAC1C,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAG9B;CACF;AA2BD;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAC5C,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,CAAC,CAAC,CA2FZ"}

package/dist/process/stream.d.ts

@@ -0,0 +1,27 @@
+import type { NativeCommandOptions, NativeCommandResult } from './contract.js';
+/** Options the stream owns: its readers are the capture, the sink and the pipes. */
+export type NativeCommandStreamOptions = Omit<NativeCommandOptions, 'capture' | 'onOutput' | 'stdio'>;
+/** A started command whose output is read as it appears. */
+export interface NativeCommandStream {
+    /** The leader's stdout; closes once the command finished and every byte was queued. */
+    readonly stdout: ReadableStream<Uint8Array>;
+    readonly stderr: ReadableStream<Uint8Array>;
+    /**
+     * Settles like `runNativeCommand` once the command ended and both streams were read to the end
+     * or cancelled: a stream nobody reads holds the child back, and with it this result. Its
+     * `stdout` and `stderr` are empty, the streams hold the bytes.
+     */
+    readonly result: Promise<NativeCommandResult>;
+    /** Stops the command with its stop policy and resolves once its resources are proven closed. */
+    stop(): Promise<void>;
+}
+/**
+ * Starts one command directly (no shell) like `runNativeCommand`, with the same group ownership,
+ * stop policy and bounds, and hands its output over as `ReadableStream`s instead of buffering it
+ * for the end. A slow reader slows the child (pipe backpressure); a cancelled stream drops what
+ * follows without stopping the command. When the command fails or is stopped, both streams error and
+ * the bytes still queued are dropped. A stream nobody reads holds the child back
+ * once it queued 1 MiB, so read large outputs concurrently or cancel the stream.
+ */
+export declare function streamNativeCommand(input: NativeCommandStreamOptions): NativeCommandStream;
+//# sourceMappingURL=stream.d.ts.map

package/dist/process/stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../src/process/stream.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAE5E,oFAAoF;AACpF,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAC3C,oBAAoB,EACpB,SAAS,GAAG,UAAU,GAAG,OAAO,CACjC,CAAC;AAEF,4DAA4D;AAC5D,MAAM,WAAW,mBAAmB;IAClC,uFAAuF;IACvF,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC9C,gGAAgG;IAChG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,0BAA0B,GAAG,mBAAmB,CA0B1F"}

package/dist/tools/connections/runtime.d.ts

@@ -21,7 +21,7 @@ export declare function withConnectionToken<T>(params: {
  * Turn a discovered JSON Schema into a `ZodObject`, falling back to a permissive
  * object when the external schema is absent or not an object. This is the typed
  * boundary: the schema crosses from an untrusted foreign document into Zod here
- * and nowhere else.
+ * and nowhere else. Its unions are left to the remote that owns the schema.
  */
 export declare function zodObjectFromJsonSchema(schema: Record<string, unknown> | undefined): ZodObject;
 /** Normalise a tool name into the characters every provider accepts. */

package/dist/tools/connections/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/tools/connections/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAK,MAAM,KAAK,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAI7D,oEAAoE;AACpE,MAAM,MAAM,uBAAuB,GAAG,CACpC,OAAO,CAAC,EAAE,cAAc,KACrB,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;AAEtD,UAAU,cAAc;IACtB,QAAQ,IAAI,IAAI,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EACzC,MAAM,EAAE;IACN,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,uBAAuB,CAAC;IACnC,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B,EACD,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,GAC9C,OAAO,CAAC,CAAC,CAAC,CAUZ;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAC1C,SAAS,CAQX;AAcD,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,sEAAsE;AACtE,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,EAAE,qBAAqB,KAAK,IAAI,CAAC;AAElF,6EAA6E;AAC7E,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAIhF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EACzC,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,EACjC,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,qBAAqB,EAC/C,SAAS,EAAE,0BAA0B,GACpC,qBAAqB,EAAE,CAczB"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/tools/connections/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAK,MAAM,KAAK,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAO7D,oEAAoE;AACpE,MAAM,MAAM,uBAAuB,GAAG,CACpC,OAAO,CAAC,EAAE,cAAc,KACrB,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;AAEtD,UAAU,cAAc;IACtB,QAAQ,IAAI,IAAI,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EACzC,MAAM,EAAE;IACN,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,uBAAuB,CAAC;IACnC,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B,EACD,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,GAC9C,OAAO,CAAC,CAAC,CAAC,CAUZ;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAC1C,SAAS,CASX;AAcD,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,sEAAsE;AACtE,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,EAAE,qBAAqB,KAAK,IAAI,CAAC;AAElF,6EAA6E;AAC7E,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAIhF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EACzC,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,EACjC,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,qBAAqB,EAC/C,SAAS,EAAE,0BAA0B,GACpC,qBAAqB,EAAE,CAczB"}

package/dist/tools/execute-args.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execute-args.d.ts","sourceRoot":"","sources":["../../src/tools/execute-args.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAKrE,qEAAqE;AACrE,MAAM,MAAM,uBAAuB,GAC/B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAC7C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAErD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,EACE,UAAkB,EAClB,WAAmB,GACpB,GAAE,IAAI,CAAC,oBAAoB,EAAE,YAAY,GAAG,aAAa,CAAM,GAC/D,uBAAuB,CAoEzB"}
+{"version":3,"file":"execute-args.d.ts","sourceRoot":"","sources":["../../src/tools/execute-args.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAMrE,qEAAqE;AACrE,MAAM,MAAM,uBAAuB,GAC/B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAC7C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAErD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,EACE,UAAkB,EAClB,WAAmB,GACpB,GAAE,IAAI,CAAC,oBAAoB,EAAE,YAAY,GAAG,aAAa,CAAM,GAC/D,uBAAuB,CAuEzB"}

package/dist/tools/schema/flatten-join.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flatten-join.d.ts","sourceRoot":"","sources":["../../../src/tools/schema/flatten-join.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAExD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,sBAAsB,CAAC;IAC/B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAsED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,EAAE,GAAG,IAAI,CAK5E;AAqKD,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,eAAe,EAAE,EAC7B,aAAa,EAAE,MAAM,GACpB,sBAAsB,CAiCxB"}
+{"version":3,"file":"flatten-join.d.ts","sourceRoot":"","sources":["../../../src/tools/schema/flatten-join.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAExD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,sBAAsB,CAAC;IAC/B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAsED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,EAAE,GAAG,IAAI,CAK5E;AAyLD,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,eAAe,EAAE,EAC7B,aAAa,EAAE,MAAM,GACpB,sBAAsB,CAuCxB"}

package/dist/tools/schema/json-schema-origin.d.ts

@@ -5,6 +5,23 @@ import { z } from 'zod';
  * provenance and never guesses from a transform's public shape or metadata.
  */
 export declare function markJsonSchemaObjectGuards(schema: z.core.$ZodType): void;
+/**
+ * Record that a schema restored from a foreign document leaves its unions to the remote.
+ *
+ * A foreign tool schema is the remote's presentation, and a presentation may join a
+ * discriminated union into one object whose shared field is an unlabelled `anyOf` (a stitchkit
+ * server with `flattenUnionInput` does, ADR 0205). Every value the remote accepts still passes
+ * such a union; which branch a value was meant for does not survive. Judged here, a wrong value
+ * can only be refused with every branch listed, while the remote, which holds the original
+ * schema, names the one field that is wrong.
+ */
+export declare function markRemoteUnionVerdict(schema: z.ZodObject): void;
+/**
+ * What a local parse refuses of a value the remote judges: everything but its unions. `null` when
+ * every refusal was a union's — the value goes to the remote, whose refusal is the answer.
+ * A schema that is not a restored foreign one keeps its own verdict whole.
+ */
+export declare function localVerdict(schema: z.core.$ZodType, error: z.ZodError): z.ZodError | null;
 /**
  * Schemas that can guide coercion at a proven foreign object boundary.
  * Intersections need both branches: one carries the key guard, while another

package/dist/tools/schema/json-schema-origin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"json-schema-origin.d.ts","sourceRoot":"","sources":["../../../src/tools/schema/json-schema-origin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAgCxB;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAiExE;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,GACtB,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,SAAS,CAsBxC"}
+{"version":3,"file":"json-schema-origin.d.ts","sourceRoot":"","sources":["../../../src/tools/schema/json-schema-origin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAgCxB;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAiExE;AAID;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,GAAG,IAAI,CAOhE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,GAAG,IAAI,CAK1F;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,GACtB,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,SAAS,CAsBxC"}

package/llms/cli.2.txt

@@ -149,6 +149,16 @@ One unconvertible schema does not take the connection down. The tool
 is skipped and **named** (`onSkippedTool`, or a stderr line by default), so a
 surface of two hundred tools is not lost to one.
 
+**A discovered schema is checked locally, except for its unions.** The arguments are
+coerced and parsed against the schema the server advertised, so a missing field or a
+wrong scalar is refused before anything is sent. A union in that schema is not judged
+here: a server's presentation may join a discriminated union into one object whose
+shared field is an unlabelled `anyOf` (a stitchkit server with `flattenUnionInput`
+does), and judged against that, a wrong value could only be refused with every branch
+listed. The value goes to the server, which holds the original schema, and its refusal
+names the one wrong field — `blocks.0.data.artifactId: expected string` rather than
+`No union branch matched — branch 1 … and 6 more branches`.
+
 MCP connection limits follow the operation phase. `initialize`, the initialized
 notification, `tools/list` and legacy endpoint discovery use `limits.discovery`;
 `tools/call` uses `limits.call`. A mounted call's handshake still uses discovery

package/llms/files.txt

@@ -32,7 +32,7 @@ available from `stitchkit/contract`.
 | `writeFileAtomic` / `writeFileAtomicSync` / `WriteFileAtomicOptions` | function / _type_ | replace a file atomically: a random staging name created exclusively (never through a planted link), the mode set on the descriptor before the file is visible (default `0o600`, not masked by the umask), `fsync`, rename; a failure leaves the target and no staging file. The asynchronous form keeps the event loop running. A process killed before publication leaves its staging file; sweeping it is the caller's job |
 | `isAtomicStagingName` | function | true for a staging file name of an atomic write of this library (`.stitchkit-<24 lowercase hex>.tmp`, also used by the managed writer and the chunk spool); the form is a stable contract, and changing it is a breaking change ([ADR 0242](../decisions/0242-atomic-staging-name-is-a-public-contract.md)) |
 | `sweepAtomicStaging` / `SweepAtomicStagingOptions` | function / _type_ | remove abandoned staging files from one `directory`: only regular files matching `isAtomicStagingName` and older than the required `olderThanMs`, never following a symlink or entering a subdirectory; stops on `signal`; returns the removed names, `[]` for a `directory` that does not exist |
-| `withExclusiveLock` / `ExclusiveLockOptions` / `ExclusiveLock` / `ExclusiveLockOwner` | function / _type_ | run work under an exclusive lock between processes — a file recording its owner (pid, host, machine identity, time and nullable kernel process identity); waits up to `timeoutMs` (default 10 s) and stops on `signal`; a dead owner on this machine is taken over, a live, slow or foreign one never is; the lock is published with its owner already recorded (temporary file plus hard link), so a stalled holder is never displaced; a legacy empty lock file is taken by age only when `ownerlessGraceMs` is a number (default `null`: never; an abandoned empty reclaim guard is taken after 5 000 ms unless a value is set); exact `mode` is independent of umask; shared readers need a common group and traversable directories |
+| `withExclusiveLock` / `ExclusiveLockOptions` / `ExclusiveLock` / `ExclusiveLockOwner` | function / _type_ | run work under an exclusive lock between processes — a file recording its owner (pid, host, machine identity, time and nullable kernel process identity); waits up to `timeoutMs` (default 10 s) and stops on `signal`; a dead owner on this machine is taken over, a live, slow or foreign one never is; a lock recorded by this very process is held only while one of its descriptors is open on it, so the lock an earlier image of the same PID left (`bun --watch` restarts in place) is taken over at once; the lock is published with its owner already recorded (temporary file plus hard link), so a stalled holder is never displaced; a legacy empty lock file is taken by age only when `ownerlessGraceMs` is a number (default `null`: never; an abandoned empty reclaim guard is taken after 5 000 ms unless a value is set); exact `mode` is independent of umask; shared readers need a common group and traversable directories |
 | `ExclusiveLockError` | class | `LOCK_TIMEOUT` naming the resource and its holder, or `LOCK_ABORTED` with the signal's reason |
 | `createChunkSpool` | function | the server half of a chunked upload: parts on disk under `owner` + client-minted `uploadId`, each with a size+sha256 receipt; idempotent `open` and `put`, the first writer of a part wins across processes, `assemble` in order once every part is in, `sweep` of untouched uploads — [guide](../guide/client.md#chunked-uploads) |
 | `ChunkSpool` / `ChunkSpoolConfig` / `ChunkSpoolKey` / `ChunkSpoolOpen` / `ChunkSpoolPart` / `ChunkSpoolAssembly` | _type_ | the spool, its directory, part size, file limit, meta schema and age; an upload's key; its declaration; one part; the assembled parts with a concatenating `stream()` |

package/llms/process.2.txt

@@ -0,0 +1,32 @@
+# stitchkit/process — stitchkit docs slice, part 2 of 2
+
+> Generated from the `docs/` tree by `bun run gen:llms`. The index of all slices is
+> `llms.txt` in this package.
+
+Parts of this slice:
+- `llms/process.txt`: Guide: Native IO  (docs/guide/native-io.md)
+- `llms/process.2.txt`: API reference: `stitchkit/process`  (docs/api/reference.md)
+
+==============================================================================
+# API reference: `stitchkit/process`  (docs/api/reference.md)
+==============================================================================
+
+## `stitchkit/process`
+
+Native POSIX Bun/Node one-shot command execution. See [native IO](../guide/native-io.md).
+
+| Export | Kind | Purpose |
+|---|---|---|
+| `runNativeCommand` | function | caller-lifetime streaming or explicitly bounded binary capture |
+| `streamNativeCommand` | function | starts a command under the same group ownership, stop policy and bounds as `runNativeCommand` and returns `stdout` / `stderr` as `ReadableStream<Uint8Array>`, `result` and `stop()`; a slow reader slows the child, a cancelled stream drops its bytes, a failed command errors both streams |
+| `NativeCommandStream` | type | what `streamNativeCommand` returns: `stdout`, `stderr`, `result` (its buffers are empty) and `stop()` |
+| `NativeCommandStreamOptions` | type | `NativeCommandOptions` without `capture`, `onOutput` and `stdio`, which the streams own |
+| `NativeCommandOptions` | type | executable/args, env policy, signal/deadline, bytes sink, finite cleanup limits, the `stop` policy and `descendants` (`'terminate-after-leader'`, the default: stop the group after the leader exits, or `'leave'`); `stdio` (`'pipe'`, or `'inherit'` for the caller's descriptors, refusing the pipe-only options) and `group` (`'own'`, or `'caller'`: joins the caller's process group, stops only the leader, refuses `descendants`, `ownerLoss` and a group stop); `ownerLoss: 'terminate'` (optional Linux/Darwin Bun/Node guard: kernel channel EOF after abrupt caller death KILLs its owned group, unsupported platforms refuse); `onLeaderStarted({ pid })` (once after the group leader exists; the package guard's PID under `ownerLoss`), `drainTimeoutMs` (bound on the pipes staying open after the leader exited, `COMMAND_CLEANUP`); an unknown key is refused by name, a removed one (`killGraceMs`) with its replacement |
+| `NativeCommandStopPolicy` | type | how a cancelled command stops: `target` `'group'` (signal every member) or `'leader'` (signal only the leader; its exit ends the grace), `signal` (default `SIGTERM`), `graceMs` (at most one hour) before KILL to the group, and `killOn`, an `AbortSignal` that skips the grace; default `{ target: 'group', signal: 'SIGTERM', graceMs: 100 }` |
+| `NativeCommandResult` | type | observed nullable exit code/signal, `descendantsStopped` (members left in the group after the leader exited were stopped) and captured stdout/stderr bytes |
+| `NativeCommandError` | class | COMMAND_LIMIT with machine reason `deadline` or `output-budget`; COMMAND_UNAVAILABLE / COMMAND_CLEANUP have no limit reason; COMMAND_CLEANUP means the command's resources were not proven closed, either past `cleanupTimeoutMs` after a stop or past `drainTimeoutMs` after the leader exited, and `cause` holds that bound's failure. Preserves internal cause and existing constructor; caller-created limits without supplied reason remain unclassified |
+
+| `NativeCommandSettlement` | type | `exit` (the leader ended on its own), `stopped` (the command was stopped and the leader's exit after the stop observed: the stop's `cause` with `exitCode`/`signal`) or `error` (no exit observed), including synchronous native launch failure; `onLeaderSettled` runs once before drain, bounded by cleanupTimeoutMs, with a cancellable settlement signal; schema/pre-abort refusal creates no settlement obligation |
+| `observeProcessInstance` / `ProcessInstanceObservation` | function / type | Linux/Darwin lifetime observation; observed identity or unavailable with its original cause, never guessed absence |
+| `ProcessInstanceSchema` / `ProcessInstance` | schema / type | platform, boot ID, namespace and process start identity from the shared native reader |
+| `probeProcessOwner` / `ProcessOwnerEvidence` | function / type | compare lifetimes on one caller-established machine; matched, boot change, reused PID, gone, legacy or unavailable with cause |

package/llms/process.txt

@@ -1,9 +1,12 @@
-# stitchkit/process — stitchkit docs slice
+# stitchkit/process — stitchkit docs slice, part 1 of 2
 
 > Generated from the `docs/` tree by `bun run gen:llms`. The index of all slices is
 > `llms.txt` in this package.
+> Continues in `llms/process.2.txt`.
 
-Contains: Guide: Native IO  (docs/guide/native-io.md) · API reference: `stitchkit/process`  (docs/api/reference.md)
+Parts of this slice:
+- `llms/process.txt`: Guide: Native IO  (docs/guide/native-io.md)
+- `llms/process.2.txt`: API reference: `stitchkit/process`  (docs/api/reference.md)
 
 ==============================================================================
 # Guide: Native IO  (docs/guide/native-io.md)
@@ -147,6 +150,27 @@ await runNativeCommand({
 })
 ```
 
+To read output as it appears, use `streamNativeCommand`: the same owner, group ownership, `stop`
+policy and bounds, with the output as `ReadableStream<Uint8Array>`.
+
+```ts
+import { streamNativeCommand } from 'stitchkit/process'
+
+const lifetime = new AbortController()
+const command = streamNativeCommand({
+  executable: '/usr/bin/tail', args: ['-f', '/var/log/app.log'], signal: lifetime.signal,
+})
+void command.stderr.cancel() // not interested: dropped, the command keeps running
+for await (const bytes of command.stdout) handle(bytes) // a slow reader slows the child
+await command.result // settles like `runNativeCommand`; `stop()` ends the group and waits for it
+```
+
+The streams own `capture`, `onOutput` and `stdio`; passing one is refused. Each stream queues up to 1 MiB, so
+a small output can be read in any order, even after `result`; past that an unread stream fills its pipe
+and holds the command, and its `result`, until the signal or `timeoutMs`, so read large outputs
+concurrently or cancel the stream you ignore. Cancelling a stream drops its later bytes and leaves the command running. When the
+command fails or is stopped, both streams error and the bytes still queued are dropped.
+
 A command needs a caller `signal` or a finite `timeoutMs` (1 to 2147483647 ms, the native timer
 range; a larger value is refused, never turned into 1 ms). Streaming runs for the caller's lifetime,
 with no hidden 60-second timeout or 1 MiB output limit. `capture` defaults to false; `true` requires
@@ -456,6 +480,16 @@ unlink. Recovery depth is capped at 16; a deeper stale chain refuses recovery wi
 the bounded `LOCK_TIMEOUT`. Live owners, unknown process-lifetime evidence and unsafe records are never
 reclaimed. Concurrent writers cannot bypass a guard while a prior unlink is paused.
 
+A record that names this very process is held only while a descriptor of this process is open
+on the lock: the holder keeps the one it created the lock with until it releases. A process image
+replaced in place — `execve`, which is how `bun --watch` restarts — keeps its PID and kernel start
+time, so its record still matches, but not that descriptor, and the new image takes the lock over
+at once instead of waiting for the PID to change. Worker threads and a second copy of the package
+in the same process share the descriptor table, so a hold any of them takes is never displaced.
+The check counts only when `/dev/fd` lists the descriptor it opens itself; a listing it cannot
+prove complete means "unknown", which never reclaims. A replaced image of another process is
+still judged alive.
+
 ## Libraries with a Zod-only runtime
 
 Public leaves keep optional peers out of their import closure. Installing `stitchkit` still
@@ -698,24 +732,3 @@ A sandbox admission slot is released once a direct command's pipes have closed a
 A `COMMAND_CLEANUP` outcome means the death of its group was not proven, so the slot stays
 occupied, `stop` keeps rejecting with the cleanup error, and the sandbox session is recreated to
 recover.
-
-==============================================================================
-# API reference: `stitchkit/process`  (docs/api/reference.md)
-==============================================================================
-
-## `stitchkit/process`
-
-Native POSIX Bun/Node one-shot command execution. See [native IO](../guide/native-io.md).
-
-| Export | Kind | Purpose |
-|---|---|---|
-| `runNativeCommand` | function | caller-lifetime streaming or explicitly bounded binary capture |
-| `NativeCommandOptions` | type | executable/args, env policy, signal/deadline, bytes sink, finite cleanup limits, the `stop` policy and `descendants` (`'terminate-after-leader'`, the default: stop the group after the leader exits, or `'leave'`); `stdio` (`'pipe'`, or `'inherit'` for the caller's descriptors, refusing the pipe-only options) and `group` (`'own'`, or `'caller'`: joins the caller's process group, stops only the leader, refuses `descendants`, `ownerLoss` and a group stop); `ownerLoss: 'terminate'` (optional Linux/Darwin Bun/Node guard: kernel channel EOF after abrupt caller death KILLs its owned group, unsupported platforms refuse); `onLeaderStarted({ pid })` (once after the group leader exists; the package guard's PID under `ownerLoss`), `drainTimeoutMs` (bound on the pipes staying open after the leader exited, `COMMAND_CLEANUP`); an unknown key is refused by name, a removed one (`killGraceMs`) with its replacement |
-| `NativeCommandStopPolicy` | type | how a cancelled command stops: `target` `'group'` (signal every member) or `'leader'` (signal only the leader; its exit ends the grace), `signal` (default `SIGTERM`), `graceMs` (at most one hour) before KILL to the group, and `killOn`, an `AbortSignal` that skips the grace; default `{ target: 'group', signal: 'SIGTERM', graceMs: 100 }` |
-| `NativeCommandResult` | type | observed nullable exit code/signal, `descendantsStopped` (members left in the group after the leader exited were stopped) and captured stdout/stderr bytes |
-| `NativeCommandError` | class | COMMAND_LIMIT with machine reason `deadline` or `output-budget`; COMMAND_UNAVAILABLE / COMMAND_CLEANUP have no limit reason; COMMAND_CLEANUP means the command's resources were not proven closed, either past `cleanupTimeoutMs` after a stop or past `drainTimeoutMs` after the leader exited, and `cause` holds that bound's failure. Preserves internal cause and existing constructor; caller-created limits without supplied reason remain unclassified |
-
-| `NativeCommandSettlement` | type | `exit` (the leader ended on its own), `stopped` (the command was stopped and the leader's exit after the stop observed: the stop's `cause` with `exitCode`/`signal`) or `error` (no exit observed), including synchronous native launch failure; `onLeaderSettled` runs once before drain, bounded by cleanupTimeoutMs, with a cancellable settlement signal; schema/pre-abort refusal creates no settlement obligation |
-| `observeProcessInstance` / `ProcessInstanceObservation` | function / type | Linux/Darwin lifetime observation; observed identity or unavailable with its original cause, never guessed absence |
-| `ProcessInstanceSchema` / `ProcessInstance` | schema / type | platform, boot ID, namespace and process start identity from the shared native reader |
-| `probeProcessOwner` / `ProcessOwnerEvidence` | function / type | compare lifetimes on one caller-established machine; matched, boot change, reused PID, gone, legacy or unavailable with cause |

package/llms/tools-connections.txt

@@ -27,7 +27,7 @@ and approval path.
 | `ConnectionPhase` / `ConnectionOperation` / `ConnectionFailureContext` | _type_ | closed operation/phase vocabulary and measured read context for existing typed connection errors |
 | `ConnectionTimeoutError` / `ConnectionResponseTooLargeError` | class | bounded operation refusal, with phase, operation and finite observed bytes; safe tool projection retains the raw cause locally |
 | `defineOpenApiConnection` | function | declare one OpenAPI document (object, JSON text or JSON URL) as a tool surface |
-| `mountConnections` | function | discover every connection and return readonly `RuntimeToolDefinition`s for `mountAgent` |
+| `mountConnections` | function | discover every connection and return readonly `RuntimeToolDefinition`s for `mountAgent`; a call's arguments are parsed against the discovered schema before sending, except its unions, which the server judges (ADR 0266) |
 | `ConnectionAuthorizationRequiredError` | class | typed reauthorization signal raised on `401` with credentials resolved again on the next call |
 | `ConnectionBudgetExceededError` | class | the mount would expose more foreign tools than its declared budget |
 | `ConnectionRequestError` | class | any non-`2xx` connection response other than the reauthorization signal |

package/llms/tools.txt

@@ -770,12 +770,17 @@ A field that is a number in every variant is advertised as a number, not as a
 bare description. Scalar collisions keep every provable kind in a deterministic
 JSON Schema type array. If any alternative is an object or array, the property
 retains distinct structural alternatives in `anyOf`: object properties, typed
-array items, bounds and nullable values remain available to the model. The
+array items, bounds and nullable values remain available to the model. Each
+alternative is described by the discriminator values that select it
+(`When type = image.`, or `When type = photo | video.` for a shape two values share),
+so the model can pair a shape with its value; the order of the alternatives is
+canonical, not the order of the variants. The
 containing discriminated union still becomes one object; flat mode does not
 promise to remove every nested union keyword. Only a branch whose kind is
 actually unknowable, such as a free-form schema or unresolved reference, leaves
-the collision unconstrained. → ADRs [0044](../decisions/0044-a-collided-field-keeps-its-type.md)
-and [0205](../decisions/0205-flat-tool-collisions-retain-structural-alternatives.md).
+the collision unconstrained. → ADRs [0044](../decisions/0044-a-collided-field-keeps-its-type.md),
+[0205](../decisions/0205-flat-tool-collisions-retain-structural-alternatives.md)
+and [0267](../decisions/0267-a-flat-alternative-names-the-values-that-select-it.md).
 
 It is **deep** because the projection walks the generated JSON Schema document,
 including objects, arrays, tuples and schema-definition nodes. Structurally

package/llms-full.txt

@@ -4428,12 +4428,17 @@ A field that is a number in every variant is advertised as a number, not as a
 bare description. Scalar collisions keep every provable kind in a deterministic
 JSON Schema type array. If any alternative is an object or array, the property
 retains distinct structural alternatives in `anyOf`: object properties, typed
-array items, bounds and nullable values remain available to the model. The
+array items, bounds and nullable values remain available to the model. Each
+alternative is described by the discriminator values that select it
+(`When type = image.`, or `When type = photo | video.` for a shape two values share),
+so the model can pair a shape with its value; the order of the alternatives is
+canonical, not the order of the variants. The
 containing discriminated union still becomes one object; flat mode does not
 promise to remove every nested union keyword. Only a branch whose kind is
 actually unknowable, such as a free-form schema or unresolved reference, leaves
-the collision unconstrained. → ADRs [0044](../decisions/0044-a-collided-field-keeps-its-type.md)
-and [0205](../decisions/0205-flat-tool-collisions-retain-structural-alternatives.md).
+the collision unconstrained. → ADRs [0044](../decisions/0044-a-collided-field-keeps-its-type.md),
+[0205](../decisions/0205-flat-tool-collisions-retain-structural-alternatives.md)
+and [0267](../decisions/0267-a-flat-alternative-names-the-values-that-select-it.md).
 
 It is **deep** because the projection walks the generated JSON Schema document,
 including objects, arrays, tuples and schema-definition nodes. Structurally
@@ -8586,6 +8591,27 @@ await runNativeCommand({
 })
 ```
 
+To read output as it appears, use `streamNativeCommand`: the same owner, group ownership, `stop`
+policy and bounds, with the output as `ReadableStream<Uint8Array>`.
+
+```ts
+import { streamNativeCommand } from 'stitchkit/process'
+
+const lifetime = new AbortController()
+const command = streamNativeCommand({
+  executable: '/usr/bin/tail', args: ['-f', '/var/log/app.log'], signal: lifetime.signal,
+})
+void command.stderr.cancel() // not interested: dropped, the command keeps running
+for await (const bytes of command.stdout) handle(bytes) // a slow reader slows the child
+await command.result // settles like `runNativeCommand`; `stop()` ends the group and waits for it
+```
+
+The streams own `capture`, `onOutput` and `stdio`; passing one is refused. Each stream queues up to 1 MiB, so
+a small output can be read in any order, even after `result`; past that an unread stream fills its pipe
+and holds the command, and its `result`, until the signal or `timeoutMs`, so read large outputs
+concurrently or cancel the stream you ignore. Cancelling a stream drops its later bytes and leaves the command running. When the
+command fails or is stopped, both streams error and the bytes still queued are dropped.
+
 A command needs a caller `signal` or a finite `timeoutMs` (1 to 2147483647 ms, the native timer
 range; a larger value is refused, never turned into 1 ms). Streaming runs for the caller's lifetime,
 with no hidden 60-second timeout or 1 MiB output limit. `capture` defaults to false; `true` requires
@@ -8895,6 +8921,16 @@ unlink. Recovery depth is capped at 16; a deeper stale chain refuses recovery wi
 the bounded `LOCK_TIMEOUT`. Live owners, unknown process-lifetime evidence and unsafe records are never
 reclaimed. Concurrent writers cannot bypass a guard while a prior unlink is paused.
 
+A record that names this very process is held only while a descriptor of this process is open
+on the lock: the holder keeps the one it created the lock with until it releases. A process image
+replaced in place — `execve`, which is how `bun --watch` restarts — keeps its PID and kernel start
+time, so its record still matches, but not that descriptor, and the new image takes the lock over
+at once instead of waiting for the PID to change. Worker threads and a second copy of the package
+in the same process share the descriptor table, so a hold any of them takes is never displaced.
+The check counts only when `/dev/fd` lists the descriptor it opens itself; a listing it cannot
+prove complete means "unknown", which never reclaims. A replaced image of another process is
+still judged alive.
+
 ## Libraries with a Zod-only runtime
 
 Public leaves keep optional peers out of their import closure. Installing `stitchkit` still
@@ -10750,6 +10786,16 @@ One unconvertible schema does not take the connection down. The tool
 is skipped and **named** (`onSkippedTool`, or a stderr line by default), so a
 surface of two hundred tools is not lost to one.
 
+**A discovered schema is checked locally, except for its unions.** The arguments are
+coerced and parsed against the schema the server advertised, so a missing field or a
+wrong scalar is refused before anything is sent. A union in that schema is not judged
+here: a server's presentation may join a discriminated union into one object whose
+shared field is an unlabelled `anyOf` (a stitchkit server with `flattenUnionInput`
+does), and judged against that, a wrong value could only be refused with every branch
+listed. The value goes to the server, which holds the original schema, and its refusal
+names the one wrong field — `blocks.0.data.artifactId: expected string` rather than
+`No union branch matched — branch 1 … and 6 more branches`.
+
 MCP connection limits follow the operation phase. `initialize`, the initialized
 notification, `tools/list` and legacy endpoint discovery use `limits.discovery`;
 `tools/call` uses `limits.call`. A mounted call's handshake still uses discovery
@@ -22883,7 +22929,7 @@ and approval path.
 | `ConnectionPhase` / `ConnectionOperation` / `ConnectionFailureContext` | _type_ | closed operation/phase vocabulary and measured read context for existing typed connection errors |
 | `ConnectionTimeoutError` / `ConnectionResponseTooLargeError` | class | bounded operation refusal, with phase, operation and finite observed bytes; safe tool projection retains the raw cause locally |
 | `defineOpenApiConnection` | function | declare one OpenAPI document (object, JSON text or JSON URL) as a tool surface |
-| `mountConnections` | function | discover every connection and return readonly `RuntimeToolDefinition`s for `mountAgent` |
+| `mountConnections` | function | discover every connection and return readonly `RuntimeToolDefinition`s for `mountAgent`; a call's arguments are parsed against the discovered schema before sending, except its unions, which the server judges (ADR 0266) |
 | `ConnectionAuthorizationRequiredError` | class | typed reauthorization signal raised on `401` with credentials resolved again on the next call |
 | `ConnectionBudgetExceededError` | class | the mount would expose more foreign tools than its declared budget |
 | `ConnectionRequestError` | class | any non-`2xx` connection response other than the reauthorization signal |
@@ -22992,7 +23038,7 @@ available from `stitchkit/contract`.
 | `writeFileAtomic` / `writeFileAtomicSync` / `WriteFileAtomicOptions` | function / _type_ | replace a file atomically: a random staging name created exclusively (never through a planted link), the mode set on the descriptor before the file is visible (default `0o600`, not masked by the umask), `fsync`, rename; a failure leaves the target and no staging file. The asynchronous form keeps the event loop running. A process killed before publication leaves its staging file; sweeping it is the caller's job |
 | `isAtomicStagingName` | function | true for a staging file name of an atomic write of this library (`.stitchkit-<24 lowercase hex>.tmp`, also used by the managed writer and the chunk spool); the form is a stable contract, and changing it is a breaking change ([ADR 0242](../decisions/0242-atomic-staging-name-is-a-public-contract.md)) |
 | `sweepAtomicStaging` / `SweepAtomicStagingOptions` | function / _type_ | remove abandoned staging files from one `directory`: only regular files matching `isAtomicStagingName` and older than the required `olderThanMs`, never following a symlink or entering a subdirectory; stops on `signal`; returns the removed names, `[]` for a `directory` that does not exist |
-| `withExclusiveLock` / `ExclusiveLockOptions` / `ExclusiveLock` / `ExclusiveLockOwner` | function / _type_ | run work under an exclusive lock between processes — a file recording its owner (pid, host, machine identity, time and nullable kernel process identity); waits up to `timeoutMs` (default 10 s) and stops on `signal`; a dead owner on this machine is taken over, a live, slow or foreign one never is; the lock is published with its owner already recorded (temporary file plus hard link), so a stalled holder is never displaced; a legacy empty lock file is taken by age only when `ownerlessGraceMs` is a number (default `null`: never; an abandoned empty reclaim guard is taken after 5 000 ms unless a value is set); exact `mode` is independent of umask; shared readers need a common group and traversable directories |
+| `withExclusiveLock` / `ExclusiveLockOptions` / `ExclusiveLock` / `ExclusiveLockOwner` | function / _type_ | run work under an exclusive lock between processes — a file recording its owner (pid, host, machine identity, time and nullable kernel process identity); waits up to `timeoutMs` (default 10 s) and stops on `signal`; a dead owner on this machine is taken over, a live, slow or foreign one never is; a lock recorded by this very process is held only while one of its descriptors is open on it, so the lock an earlier image of the same PID left (`bun --watch` restarts in place) is taken over at once; the lock is published with its owner already recorded (temporary file plus hard link), so a stalled holder is never displaced; a legacy empty lock file is taken by age only when `ownerlessGraceMs` is a number (default `null`: never; an abandoned empty reclaim guard is taken after 5 000 ms unless a value is set); exact `mode` is independent of umask; shared readers need a common group and traversable directories |
 | `ExclusiveLockError` | class | `LOCK_TIMEOUT` naming the resource and its holder, or `LOCK_ABORTED` with the signal's reason |
 | `createChunkSpool` | function | the server half of a chunked upload: parts on disk under `owner` + client-minted `uploadId`, each with a size+sha256 receipt; idempotent `open` and `put`, the first writer of a part wins across processes, `assemble` in order once every part is in, `sweep` of untouched uploads — [guide](../guide/client.md#chunked-uploads) |
 | `ChunkSpool` / `ChunkSpoolConfig` / `ChunkSpoolKey` / `ChunkSpoolOpen` / `ChunkSpoolPart` / `ChunkSpoolAssembly` | _type_ | the spool, its directory, part size, file limit, meta schema and age; an upload's key; its declaration; one part; the assembled parts with a concatenating `stream()` |
@@ -23566,6 +23612,9 @@ Native POSIX Bun/Node one-shot command execution. See [native IO](../guide/nativ
 | Export | Kind | Purpose |
 |---|---|---|
 | `runNativeCommand` | function | caller-lifetime streaming or explicitly bounded binary capture |
+| `streamNativeCommand` | function | starts a command under the same group ownership, stop policy and bounds as `runNativeCommand` and returns `stdout` / `stderr` as `ReadableStream<Uint8Array>`, `result` and `stop()`; a slow reader slows the child, a cancelled stream drops its bytes, a failed command errors both streams |
+| `NativeCommandStream` | type | what `streamNativeCommand` returns: `stdout`, `stderr`, `result` (its buffers are empty) and `stop()` |
+| `NativeCommandStreamOptions` | type | `NativeCommandOptions` without `capture`, `onOutput` and `stdio`, which the streams own |
 | `NativeCommandOptions` | type | executable/args, env policy, signal/deadline, bytes sink, finite cleanup limits, the `stop` policy and `descendants` (`'terminate-after-leader'`, the default: stop the group after the leader exits, or `'leave'`); `stdio` (`'pipe'`, or `'inherit'` for the caller's descriptors, refusing the pipe-only options) and `group` (`'own'`, or `'caller'`: joins the caller's process group, stops only the leader, refuses `descendants`, `ownerLoss` and a group stop); `ownerLoss: 'terminate'` (optional Linux/Darwin Bun/Node guard: kernel channel EOF after abrupt caller death KILLs its owned group, unsupported platforms refuse); `onLeaderStarted({ pid })` (once after the group leader exists; the package guard's PID under `ownerLoss`), `drainTimeoutMs` (bound on the pipes staying open after the leader exited, `COMMAND_CLEANUP`); an unknown key is refused by name, a removed one (`killGraceMs`) with its replacement |
 | `NativeCommandStopPolicy` | type | how a cancelled command stops: `target` `'group'` (signal every member) or `'leader'` (signal only the leader; its exit ends the grace), `signal` (default `SIGTERM`), `graceMs` (at most one hour) before KILL to the group, and `killOn`, an `AbortSignal` that skips the grace; default `{ target: 'group', signal: 'SIGTERM', graceMs: 100 }` |
 | `NativeCommandResult` | type | observed nullable exit code/signal, `descendantsStopped` (members left in the group after the leader exited were stopped) and captured stdout/stderr bytes |

package/llms.txt

@@ -13,12 +13,12 @@ Load the slice for each entrypoint your code imports — `import … from 'stitc
 - **stitchkit/live**: [llms/live.txt](llms/live.txt) 21.2 KB
 - **stitchkit/react**: [llms/react.txt](llms/react.txt) 8.6 KB
 - **stitchkit/react/keyboard**: [llms/react-keyboard.txt](llms/react-keyboard.txt) 9.2 KB
-- **stitchkit/tools**: [llms/tools.txt](llms/tools.txt) 46.4 KB → [llms/tools.2.txt](llms/tools.2.txt) 30.4 KB → [llms/tools.3.txt](llms/tools.3.txt) 26.3 KB
+- **stitchkit/tools**: [llms/tools.txt](llms/tools.txt) 46.7 KB → [llms/tools.2.txt](llms/tools.2.txt) 30.4 KB → [llms/tools.3.txt](llms/tools.3.txt) 26.3 KB
 - **stitchkit/tools/mcp**: [llms/tools-mcp.txt](llms/tools-mcp.txt) 1.8 KB
 - **stitchkit/tools/contract**: [llms/tools-contract.txt](llms/tools-contract.txt) 0.2 KB
 - **stitchkit/tools/invoker**: [llms/tools-invoker.txt](llms/tools-invoker.txt) 0.2 KB
-- **stitchkit/tools/connections**: [llms/tools-connections.txt](llms/tools-connections.txt) 3.7 KB
-- **stitchkit/cli**: [llms/cli.txt](llms/cli.txt) 44.6 KB → [llms/cli.2.txt](llms/cli.2.txt) 20.6 KB
+- **stitchkit/tools/connections**: [llms/tools-connections.txt](llms/tools-connections.txt) 3.8 KB
+- **stitchkit/cli**: [llms/cli.txt](llms/cli.txt) 44.6 KB → [llms/cli.2.txt](llms/cli.2.txt) 21.3 KB
 - **stitchkit/cli/publish**: [llms/cli-publish.txt](llms/cli-publish.txt) 1.5 KB
 - **stitchkit/remote**: [llms/remote.txt](llms/remote.txt) 1.0 KB
 - **stitchkit/contract**: [llms/contract.txt](llms/contract.txt) 31.9 KB
@@ -41,7 +41,7 @@ Load the slice for each entrypoint your code imports — `import … from 'stitc
 - **stitchkit/application/schemas**: [llms/application-schemas.txt](llms/application-schemas.txt) 1.8 KB
 - **stitchkit/testing**: [llms/testing.txt](llms/testing.txt) 33.6 KB
 - **stitchkit/agent-runtime/sandbox**: [llms/agent-runtime-sandbox.txt](llms/agent-runtime-sandbox.txt) 8.3 KB
-- **stitchkit/files**: [llms/files.txt](llms/files.txt) 5.5 KB
+- **stitchkit/files**: [llms/files.txt](llms/files.txt) 5.7 KB
 - **stitchkit/telegram**: [llms/telegram.txt](llms/telegram.txt) 36.6 KB
 - **stitchkit/telegram/html**: [llms/telegram-html.txt](llms/telegram-html.txt) 2.7 KB
 - **stitchkit/telegram/screens**: [llms/telegram-screens.txt](llms/telegram-screens.txt) 21.2 KB
@@ -56,7 +56,7 @@ Load the slice for each entrypoint your code imports — `import … from 'stitc
 - **stitchkit/node**: [llms/node.txt](llms/node.txt) 3.1 KB
 - **stitchkit/agent-runtime/react**: [llms/agent-runtime-react.txt](llms/agent-runtime-react.txt) 1.0 KB
 - **stitchkit/agent-runtime/realtime**: [llms/agent-runtime-realtime.txt](llms/agent-runtime-realtime.txt) 2.6 KB
-- **stitchkit/process**: [llms/process.txt](llms/process.txt) 45.8 KB
+- **stitchkit/process**: [llms/process.txt](llms/process.txt) 44.4 KB → [llms/process.2.txt](llms/process.2.txt) 4.3 KB
 - **stitchkit/process/owner-loss**: [llms/process-owner-loss.txt](llms/process-owner-loss.txt) 0.9 KB
 - **stitchkit/files/packaging**: [llms/files-packaging.txt](llms/files-packaging.txt) 3.5 KB
 - **stitchkit/http**: [llms/http.txt](llms/http.txt) 0.9 KB