stitchkit 0.112.1 → 0.112.3

package/CHANGELOG.md

@@ -15,6 +15,19 @@ additive**; the first breaking change landed in 0.10.0. Grep the file for
 
 ## [Unreleased]
 
+## [0.112.3] - 2026-10-26
+
+### Fixed
+
+- `stitchkit/tools/mcp`, `stitchkit/tools/connections` — a tool whose input holds a `z.tuple` is now served as a valid 2020-12 schema: the tuple is written as `prefixItems` (rest as `items`) instead of draft-07's `items` list, which Claude's MCP client refused (`must be object,boolean`) and dropped the tool without a server-side error. The stitchkit MCP client reads a tuple from an older server's document with the same meaning. → ADR 0270
+  **Affects:** `stitchkit/tools/mcp` behaviour; `stitchkit/tools/connections` behaviour
+
+## [0.112.2] - 2026-10-25
+
+### Added
+
+- `stitchkit/tracking` — `resolveTrackedClick` and `createTrackingClient` accept `hrefPolicy: 'full'` to retain internal and outbound click query parameters and fragments before consumer `decorate` redaction. The default `path-only` policy, navigation classification, labels and listener cleanup stay unchanged; URL credentials remain excluded.
+
 ## [0.112.1] - 2026-10-25
 
 ### Fixed

package/dist/entrypoints/agent-runtime/coding-tools.js

@@ -1,17 +1,17 @@
 import"../../index-ct75c3at.js";
-import"../../index-h7accrrv.js";
+import"../../index-jgwqc38k.js";
 import"../../index-fynr93w4.js";
 import {
   AgentCodingToolLimitsSchema2,
   AgentCodingToolAuthorizationSchema2,
   AgentCodingToolPathAuthorizationSchema2,
   createAgentCodingTools2
-} from "../../index-n0adphfg.js";
+} from "../../index-dsxrcseb.js";
 import"../../index-2kbysk9s.js";
 import"../../index-84bf5spd.js";
 import"../../index-7r4knwf8.js";
 import"../../index-zrtrjkbf.js";
-import"../../index-ff3agzaf.js";
+import"../../index-nk1mh535.js";
 export {
   AgentCodingToolAuthorizationSchema2 as AgentCodingToolAuthorizationSchema,
   AgentCodingToolLimitsSchema2 as AgentCodingToolLimitsSchema,

package/dist/entrypoints/agent-runtime/harness.js

@@ -5,15 +5,15 @@ import"../../index-8kzct1d6.js";
 import {
   composeAgentPrompt2,
   createAgentRuntime2
-} from "../../index-a0vj9edp.js";
+} from "../../index-b9yqb9e7.js";
 import"../../index-qaet40b2.js";
 import"../../index-mnkk1ffz.js";
 import"../../index-fynr93w4.js";
 import"../../index-epmnrnth.js";
 import"../../index-jy9wq8tp.js";
 import"../../index-ct75c3at.js";
-import"../../index-h7accrrv.js";
-import"../../index-02h0dfpr.js";
+import"../../index-jgwqc38k.js";
+import"../../index-z4ga1fa1.js";
 import"../../index-snef22zr.js";
 import"../../index-56yx8dxp.js";
 import"../../index-jna0ejsa.js";
@@ -29,7 +29,7 @@ import {
 } from "../../index-zrtrjkbf.js";
 import {
   defineRuntimeTool2
-} from "../../index-ff3agzaf.js";
+} from "../../index-nk1mh535.js";
 
 // src/agent-runtime/harness-contract.ts
 import { z } from "zod";

package/dist/entrypoints/agent-runtime/sandbox.js

@@ -3,9 +3,9 @@ import {
   missingSandboxRestrictions2,
   codingRefusal,
   createAgentCodingTools2
-} from "../../index-n0adphfg.js";
+} from "../../index-dsxrcseb.js";
 import"../../index-ct75c3at.js";
-import"../../index-h7accrrv.js";
+import"../../index-jgwqc38k.js";
 import"../../index-fynr93w4.js";
 import"../../index-2kbysk9s.js";
 import {
@@ -25,7 +25,7 @@ import {
 import {
   MAX_TIMER_MS
 } from "../../index-eemvahkc.js";
-import"../../index-ff3agzaf.js";
+import"../../index-nk1mh535.js";
 
 // src/agent-runtime/sandbox-bubblewrap.ts
 import { mkdir as mkdir2, mkdtemp, realpath, rm as rm2 } from "node:fs/promises";

package/dist/entrypoints/agent-runtime/sqlite/bun.js

@@ -1,22 +1,22 @@
 import"../../../index-jna0ejsa.js";
-import"../../../index-38gvr73z.js";
+import"../../../index-f2p949ax.js";
 import"../../../index-8kzct1d6.js";
 import {
   initializeAgentRuntimeSqlite2,
   createSqliteAgentRuntimeStore2
-} from "../../../index-fh2ht88b.js";
+} from "../../../index-c9vpsxw4.js";
 import"../../../index-kqnd6a85.js";
 import"../../../index-5w6t91ze.js";
-import"../../../index-n0adphfg.js";
+import"../../../index-dsxrcseb.js";
 import"../../../index-ct75c3at.js";
-import"../../../index-h7accrrv.js";
+import"../../../index-jgwqc38k.js";
 import"../../../index-fynr93w4.js";
 import"../../../index-2kbysk9s.js";
 import"../../../index-84bf5spd.js";
 import"../../../index-7r4knwf8.js";
 import"../../../index-snef22zr.js";
 import"../../../index-zrtrjkbf.js";
-import"../../../index-ff3agzaf.js";
+import"../../../index-nk1mh535.js";
 
 // src/agent-runtime/sqlite-bun.ts
 import { Database } from "bun:sqlite";

package/dist/entrypoints/agent-runtime/sqlite/node.js

@@ -1,22 +1,22 @@
 import"../../../index-jna0ejsa.js";
-import"../../../index-38gvr73z.js";
+import"../../../index-f2p949ax.js";
 import"../../../index-8kzct1d6.js";
 import {
   initializeAgentRuntimeSqlite2,
   createSqliteAgentRuntimeStore2
-} from "../../../index-fh2ht88b.js";
+} from "../../../index-c9vpsxw4.js";
 import"../../../index-kqnd6a85.js";
 import"../../../index-5w6t91ze.js";
-import"../../../index-n0adphfg.js";
+import"../../../index-dsxrcseb.js";
 import"../../../index-ct75c3at.js";
-import"../../../index-h7accrrv.js";
+import"../../../index-jgwqc38k.js";
 import"../../../index-fynr93w4.js";
 import"../../../index-2kbysk9s.js";
 import"../../../index-84bf5spd.js";
 import"../../../index-7r4knwf8.js";
 import"../../../index-snef22zr.js";
 import"../../../index-zrtrjkbf.js";
-import"../../../index-ff3agzaf.js";
+import"../../../index-nk1mh535.js";
 
 // src/agent-runtime/sqlite-node.ts
 import { DatabaseSync } from "node:sqlite";

package/dist/entrypoints/agent-runtime/testing.js

@@ -10,10 +10,10 @@ import {
   advanceToolChronology
 } from "../../index-jna0ejsa.js";
 import"../../index-5w6t91ze.js";
-import"../../index-n0adphfg.js";
-import"../../index-38gvr73z.js";
+import"../../index-dsxrcseb.js";
+import"../../index-f2p949ax.js";
 import"../../index-ct75c3at.js";
-import"../../index-h7accrrv.js";
+import"../../index-jgwqc38k.js";
 import"../../index-fynr93w4.js";
 import"../../index-2kbysk9s.js";
 import"../../index-84bf5spd.js";
@@ -21,12 +21,12 @@ import"../../index-7r4knwf8.js";
 import"../../index-snef22zr.js";
 import {
   createMemoryAgentRuntimeStore2
-} from "../../index-d4cnhfdn.js";
+} from "../../index-kenvdagc.js";
 import"../../index-zrtrjkbf.js";
 import {
   assertPositiveSafeInteger
 } from "../../index-0s4xebbg.js";
-import"../../index-ff3agzaf.js";
+import"../../index-nk1mh535.js";
 
 // src/agent-runtime/fault-bench.ts
 import { createServer } from "node:http";

package/dist/entrypoints/agent-runtime.js

@@ -5,7 +5,7 @@ import {
   missingSandboxRestrictions2,
   recordAgentSandboxProbe2,
   refuseUnknownSpillReference
-} from "../index-n0adphfg.js";
+} from "../index-dsxrcseb.js";
 import {
   AgentRecordIdSchema2,
   AgentRecordVersionSchema2,
@@ -58,7 +58,7 @@ import {
   AgentHistoryMutationSchema2,
   ACTIVE_AGENT_RUN_STATES2,
   createAgentRuntimeStore2
-} from "../index-38gvr73z.js";
+} from "../index-f2p949ax.js";
 import {
   AgentStoreEventKindSchema2,
   AgentStoreEventEnvelopeSchema2,
@@ -123,7 +123,7 @@ import {
   agentGoalStateSlot2,
   agentTodoStateSlot2,
   createAgentRuntime2
-} from "../index-a0vj9edp.js";
+} from "../index-b9yqb9e7.js";
 import {
   AgentConversationSummarySchema2,
   AgentConversationPageSchema2,
@@ -133,13 +133,13 @@ import"../index-fynr93w4.js";
 import"../index-epmnrnth.js";
 import"../index-jy9wq8tp.js";
 import"../index-ct75c3at.js";
-import"../index-h7accrrv.js";
-import"../index-02h0dfpr.js";
-import"../index-vqdjym30.js";
+import"../index-jgwqc38k.js";
+import"../index-z4ga1fa1.js";
+import"../index-zm1k7hhv.js";
 import {
   mountAgent2,
   buildToolManifest2
-} from "../index-c7h371gr.js";
+} from "../index-5jjda9a4.js";
 import {
   createBoundedSinkManager
 } from "../index-qaet40b2.js";
@@ -191,7 +191,7 @@ import"../index-84bf5spd.js";
 import"../index-7r4knwf8.js";
 import {
   createMemoryAgentRuntimeStore2
-} from "../index-d4cnhfdn.js";
+} from "../index-kenvdagc.js";
 import {
   createAgentRuntimeEventSink2
 } from "../index-616xh7f2.js";
@@ -202,11 +202,11 @@ import {
 import {
   assertPositiveSafeInteger
 } from "../index-0s4xebbg.js";
-import"../index-hvg9hctd.js";
+import"../index-eddzs589.js";
 import {
   defineRuntimeTool2,
   executableAgentRuntimeTools
-} from "../index-ff3agzaf.js";
+} from "../index-nk1mh535.js";
 import {
   createTraceContext2,
   childSpan2

package/dist/entrypoints/cli.js

@@ -16,12 +16,12 @@ import {
   renderCliView2,
   pollUntilDone2,
   createCli2
-} from "../index-bd7spznx.js";
+} from "../index-gpbk7yse.js";
 import"../index-fynr93w4.js";
 import"../index-ct75c3at.js";
-import"../index-h7accrrv.js";
-import"../index-02h0dfpr.js";
-import"../index-vqdjym30.js";
+import"../index-jgwqc38k.js";
+import"../index-z4ga1fa1.js";
+import"../index-zm1k7hhv.js";
 import {
   CliBuildSignatureSchema2,
   cliManifestSigningPayload2,
@@ -44,8 +44,8 @@ import {
 import {
   writeFileAtomicSync2
 } from "../index-07dcf2yn.js";
-import"../index-hvg9hctd.js";
-import"../index-ff3agzaf.js";
+import"../index-eddzs589.js";
+import"../index-nk1mh535.js";
 import {
   safeJsonParse
 } from "../index-zsarb5xp.js";

package/dist/entrypoints/testing.js

@@ -30,7 +30,7 @@ import {
   projectToolSurface,
   mcpProjectionCandidate,
   prepareProjectedMcpTools
-} from "../index-h7accrrv.js";
+} from "../index-jgwqc38k.js";
 import"../index-fynr93w4.js";
 import {
   createClient2,

package/dist/entrypoints/tools/connections.js

@@ -1,8 +1,8 @@
 import"../../index-ct75c3at.js";
 import {
   declaresDraft07,
-  withDefsDialect
-} from "../../index-h7accrrv.js";
+  withDraft2020Keywords
+} from "../../index-jgwqc38k.js";
 import"../../index-fynr93w4.js";
 import {
   markJsonSchemaObjectGuards,
@@ -26,7 +26,7 @@ import {
 } from "../../index-0s4xebbg.js";
 import {
   defineRuntimeTool2
-} from "../../index-ff3agzaf.js";
+} from "../../index-nk1mh535.js";
 import {
   TOOL_ERROR_PROJECTION
 } from "../../index-556g5hsh.js";
@@ -844,7 +844,7 @@ async function withConnectionToken(params, body) {
 function zodObjectFromJsonSchema(schema) {
   if (!schema || Object.keys(schema).length === 0)
     return z.looseObject({});
-  const parsed = z.fromJSONSchema(reconcileDefinitionKeyword(schema));
+  const parsed = z.fromJSONSchema(reconcileDialect(schema));
   if (parsed instanceof z.ZodObject) {
     markJsonSchemaObjectGuards(parsed);
     markRemoteUnionVerdict(parsed);
@@ -852,8 +852,8 @@ function zodObjectFromJsonSchema(schema) {
   }
   return z.looseObject({});
 }
-function reconcileDefinitionKeyword(schema) {
-  return declaresDraft07(schema.$schema) ? schema : withDefsDialect(schema);
+function reconcileDialect(schema) {
+  return declaresDraft07(schema.$schema) ? schema : withDraft2020Keywords(schema);
 }
 function sanitizeToolName(value) {
   return value.replace(/[^a-zA-Z0-9_-]+/g, "_").replace(/^_+|_+$/g, "") || "operation";

package/dist/entrypoints/tools/invoker.js

@@ -2,12 +2,12 @@ import"../../index-fynr93w4.js";
 import"../../index-epmnrnth.js";
 import"../../index-jy9wq8tp.js";
 import"../../index-ct75c3at.js";
-import"../../index-h7accrrv.js";
-import"../../index-02h0dfpr.js";
-import"../../index-vqdjym30.js";
+import"../../index-jgwqc38k.js";
+import"../../index-z4ga1fa1.js";
+import"../../index-zm1k7hhv.js";
 import {
   createToolInvoker2
-} from "../../index-jfk93gja.js";
+} from "../../index-4dh3hfs7.js";
 export {
   createToolInvoker2 as createToolInvoker
 };

package/dist/entrypoints/tools/mcp.js

@@ -2,9 +2,9 @@ import"../../index-ct75c3at.js";
 import"../../index-fynr93w4.js";
 import"../../index-epmnrnth.js";
 import"../../index-jy9wq8tp.js";
-import"../../index-h7accrrv.js";
-import"../../index-02h0dfpr.js";
-import"../../index-vqdjym30.js";
+import"../../index-jgwqc38k.js";
+import"../../index-z4ga1fa1.js";
+import"../../index-zm1k7hhv.js";
 import {
   RESOURCE_MIME_TYPE2,
   EXT_APPS_BUNDLE_PLACEHOLDER2,
@@ -20,9 +20,9 @@ import {
   createMcpHttpRoute2,
   createStdioMcpServer2,
   bindStdioProcessSignals2
-} from "../../index-651xsm48.js";
-import"../../index-hvg9hctd.js";
-import"../../index-ff3agzaf.js";
+} from "../../index-54q2mghq.js";
+import"../../index-eddzs589.js";
+import"../../index-nk1mh535.js";
 export {
   EXT_APPS_BUNDLE_PLACEHOLDER2 as EXT_APPS_BUNDLE_PLACEHOLDER,
   MCP_CATALOG_META_KEY2 as MCP_CATALOG_META_KEY,

package/dist/entrypoints/tools.js

@@ -21,19 +21,19 @@ import {
   findNonPortableFormats2,
   flattenToolJsonSchema2,
   findUntypedProperties2
-} from "../index-h7accrrv.js";
+} from "../index-jgwqc38k.js";
 import {
   ToolExecutionControlError2,
   isToolExecutionControlError2
-} from "../index-02h0dfpr.js";
+} from "../index-z4ga1fa1.js";
 import {
   collectTools2
-} from "../index-vqdjym30.js";
+} from "../index-zm1k7hhv.js";
 import {
   mountAgent2,
   describeToolCatalog2,
   buildToolManifest2
-} from "../index-c7h371gr.js";
+} from "../index-5jjda9a4.js";
 import"../index-m38ej7e5.js";
 import {
   ALL_TRANSPORTS2,
@@ -60,7 +60,7 @@ import {
   createMcpHttpRoute2,
   createStdioMcpServer2,
   bindStdioProcessSignals2
-} from "../index-651xsm48.js";
+} from "../index-54q2mghq.js";
 import {
   AsyncOperationCancelResultSchema2,
   createAsyncOperationSnapshotSchema2,
@@ -74,7 +74,7 @@ import {
   WaitTimeoutError,
   runWaitOperation,
   createCli2
-} from "../index-bd7spznx.js";
+} from "../index-gpbk7yse.js";
 import {
   ManagedFilePathSchema2,
   ManagedFileRefSchema2
@@ -89,7 +89,7 @@ import {
 } from "../index-pzw0fpek.js";
 import {
   createToolInvoker2
-} from "../index-jfk93gja.js";
+} from "../index-4dh3hfs7.js";
 import {
   ManagedFileError2
 } from "../index-2f9r0jgr.js";
@@ -111,14 +111,14 @@ import {
 } from "../index-yk4g8805.js";
 import {
   collectToolSurface
-} from "../index-hvg9hctd.js";
+} from "../index-eddzs589.js";
 import {
   getTraceId2
 } from "../index-r6v4mc67.js";
 import {
   defineRuntimeTool2,
   createRuntimeToolFactory2
-} from "../index-ff3agzaf.js";
+} from "../index-nk1mh535.js";
 import {
   formatZodError2
 } from "../index-1eeqpadm.js";

package/dist/entrypoints/tracking.js

@@ -204,17 +204,18 @@ function sendUnloadBeacon(url, body, sender = typeof navigator === "undefined" ?
 function label(target) {
   return (target?.textContent ?? "").trim().slice(0, 100) || undefined;
 }
-function sanitizedHref(value, origin) {
+function trackedHref(value, origin, policy) {
   if (!value)
     return;
   try {
     const url = new URL(value, origin);
-    return url.origin === origin ? url.pathname : `${url.origin}${url.pathname}`;
+    const path = `${url.pathname}${policy === "full" ? url.search + url.hash : ""}`;
+    return url.origin === origin ? path : `${url.origin}${path}`;
   } catch {
     return;
   }
 }
-function resolveTrackedClick(target, { origin, attributes = {}, isAction = () => true }) {
+function resolveTrackedClick(target, { origin, attributes = {}, isAction = () => true, hrefPolicy }) {
   if (!target)
     return null;
   const trackAttribute = attributes.track ?? "data-track";
@@ -247,12 +248,15 @@ function resolveTrackedClick(target, { origin, attributes = {}, isAction = () =>
       result.click = {
         element,
         elementText: label(tracked),
-        href: sanitizedHref(href, origin)
+        href: trackedHref(href, origin, hrefPolicy)
       };
     }
   }
   if (outbound && href) {
-    result.outbound = { href: sanitizedHref(href, origin) ?? href, label: label(anchor) };
+    result.outbound = {
+      href: trackedHref(href, origin, hrefPolicy) ?? href,
+      label: label(anchor)
+    };
   }
   return result.interaction || result.click || result.outbound ? result : null;
 }
@@ -299,7 +303,8 @@ function wireTrackingListeners(deps) {
     const click = resolveTrackedClick(target, {
       origin: host.page().origin,
       attributes: deps.clickAttributes,
-      isAction: deps.isAction
+      isAction: deps.isAction,
+      hrefPolicy: deps.hrefPolicy
     });
     if (!click)
       return;
@@ -789,6 +794,7 @@ function createTrackingClient(config) {
           });
       },
       clickAttributes: config.clickAttributes,
+      hrefPolicy: config.hrefPolicy,
       isAction: config.isAction
     });
     return () => {

package/dist/{index-jfk93gja.js → index-4dh3hfs7.js}

@@ -1,13 +1,13 @@
 import {
   assertUniqueToolName
-} from "./index-h7accrrv.js";
+} from "./index-jgwqc38k.js";
 import {
   toolErrorFromResult
-} from "./index-02h0dfpr.js";
+} from "./index-z4ga1fa1.js";
 import {
   collectTools2,
   createToolRunner
-} from "./index-vqdjym30.js";
+} from "./index-zm1k7hhv.js";
 import {
   AppError2
 } from "./index-j9gxbztg.js";

package/dist/{index-651xsm48.js → index-54q2mghq.js}

@@ -8,17 +8,17 @@ import {
   validateResolvedInputRounds,
   presentationMetadata,
   prepareProjectedMcpTools
-} from "./index-h7accrrv.js";
+} from "./index-jgwqc38k.js";
 import {
   parseToolCallArguments,
   toolResultFromError,
   observed
-} from "./index-02h0dfpr.js";
+} from "./index-z4ga1fa1.js";
 import {
   collectTools2,
   createToolRunner,
   formatToolError
-} from "./index-vqdjym30.js";
+} from "./index-zm1k7hhv.js";
 import {
   DEFAULT_CORS_ALLOW_HEADERS2,
   DEFAULT_PROCESS_SIGNALS,
@@ -31,7 +31,7 @@ import {
 } from "./index-e6c2spsd.js";
 import {
   collectToolSurface
-} from "./index-hvg9hctd.js";
+} from "./index-eddzs589.js";
 import {
   runWithRequestContext2,
   getRequestContext2

package/dist/{index-c7h371gr.js → index-5jjda9a4.js}

@@ -2,21 +2,21 @@ import {
   toolResultFromError,
   toolCauseFromResult,
   isToolExecutionControlError2
-} from "./index-02h0dfpr.js";
+} from "./index-z4ga1fa1.js";
 import {
   createToolRunner,
   formatToolError
-} from "./index-vqdjym30.js";
+} from "./index-zm1k7hhv.js";
 import {
   AgentToolError2,
   resolveToolDurability
 } from "./index-56yx8dxp.js";
 import {
   collectToolSurface
-} from "./index-hvg9hctd.js";
+} from "./index-eddzs589.js";
 import {
   agentPresenterOf
-} from "./index-ff3agzaf.js";
+} from "./index-nk1mh535.js";
 import {
   isRecord
 } from "./index-9jfdm5tg.js";

package/dist/{index-a0vj9edp.js → index-b9yqb9e7.js}

@@ -14,7 +14,7 @@ import {
 import {
   ToolExecutionControlError2,
   isToolExecutionControlError2
-} from "./index-02h0dfpr.js";
+} from "./index-z4ga1fa1.js";
 import {
   agentDurableEventId2
 } from "./index-mnkk1ffz.js";

package/dist/{index-fh2ht88b.js → index-c9vpsxw4.js}

@@ -19,7 +19,7 @@ import {
   appendEventIn,
   ArchiveProjectionSchema,
   createAgentRuntimeStore2
-} from "./index-38gvr73z.js";
+} from "./index-f2p949ax.js";
 import {
   AgentConversationPageSchema2,
   AgentConversationMessagePageSchema2

package/dist/{index-n0adphfg.js → index-dsxrcseb.js}

@@ -27,7 +27,7 @@ import {
 } from "./index-j4zh647a.js";
 import {
   defineRuntimeTool2
-} from "./index-ff3agzaf.js";
+} from "./index-nk1mh535.js";
 import {
   AppError2,
   forbidden2,

package/dist/{index-hvg9hctd.js → index-eddzs589.js}

@@ -1,12 +1,12 @@
 import {
   projectToolSurface
-} from "./index-h7accrrv.js";
+} from "./index-jgwqc38k.js";
 import {
   contractToolMountable
-} from "./index-vqdjym30.js";
+} from "./index-zm1k7hhv.js";
 import {
   runtimeToolMountable
-} from "./index-ff3agzaf.js";
+} from "./index-nk1mh535.js";
 
 // src/tools/surface.ts
 function collectToolSurface({

package/dist/{index-38gvr73z.js → index-f2p949ax.js}

@@ -4,7 +4,7 @@ import {
   AgentSandboxRestrictionSchema2,
   AgentSandboxGradeSchema2,
   AGENT_CODING_TOOL_NAMES
-} from "./index-n0adphfg.js";
+} from "./index-dsxrcseb.js";
 import {
   AgentRecordIdSchema2,
   AgentRecordVersionSchema2,

package/dist/{index-bd7spznx.js → index-gpbk7yse.js}

@@ -14,15 +14,15 @@ import {
   objectShapeKeys,
   assertUniqueToolName,
   buildToolPresentationSchema
-} from "./index-h7accrrv.js";
+} from "./index-jgwqc38k.js";
 import {
   toolResultFromError,
   toolErrorFromResult
-} from "./index-02h0dfpr.js";
+} from "./index-z4ga1fa1.js";
 import {
   createToolRunner,
   formatToolError
-} from "./index-vqdjym30.js";
+} from "./index-zm1k7hhv.js";
 import {
   fetchGuarded,
   readCapped
@@ -35,7 +35,7 @@ import {
 } from "./index-eemvahkc.js";
 import {
   collectToolSurface
-} from "./index-hvg9hctd.js";
+} from "./index-eddzs589.js";
 import {
   isUnsafeKey,
   safeJsonParse

package/dist/{index-h7accrrv.js → index-jgwqc38k.js}

@@ -763,6 +763,27 @@ import { z as z2 } from "zod";
 var DRAFT_07_MARKER = "draft-07";
 var DRAFT_07_KEYWORD = "definitions";
 var DEFS_KEYWORD = "$defs";
+var SCHEMA_KEYWORDS = [
+  "items",
+  "additionalItems",
+  "additionalProperties",
+  "contains",
+  "propertyNames",
+  "not",
+  "if",
+  "then",
+  "else",
+  "unevaluatedItems",
+  "unevaluatedProperties"
+];
+var SCHEMA_LIST_KEYWORDS = ["allOf", "anyOf", "oneOf", "prefixItems"];
+var SCHEMA_MAP_KEYWORDS = [
+  "properties",
+  "patternProperties",
+  "dependentSchemas",
+  DRAFT_07_KEYWORD,
+  DEFS_KEYWORD
+];
 function declaresDraft07(dialect) {
   return typeof dialect === "string" && dialect.includes(DRAFT_07_MARKER);
 }
@@ -777,12 +798,51 @@ function rewriteDefinitionPointers(value) {
   }
   return rewritten;
 }
-function withDefsDialect(schema) {
-  const definitions = schema[DRAFT_07_KEYWORD];
-  if (!isRecord(definitions) || DEFS_KEYWORD in schema)
+function mapValues(value, rewrite) {
+  if (!isRecord(value))
+    return value;
+  const rewritten = {};
+  for (const [name, child] of Object.entries(value))
+    rewritten[name] = rewrite(child);
+  return rewritten;
+}
+function withPositionalItems(schema) {
+  if (!isRecord(schema))
     return schema;
   const rewritten = {};
-  for (const [key, value] of Object.entries(schema)) {
+  for (const [key, child] of Object.entries(schema)) {
+    if (SCHEMA_KEYWORDS.includes(key))
+      rewritten[key] = withPositionalItems(child);
+    else if (SCHEMA_LIST_KEYWORDS.includes(key) && Array.isArray(child)) {
+      rewritten[key] = child.map(withPositionalItems);
+    } else if (SCHEMA_MAP_KEYWORDS.includes(key)) {
+      rewritten[key] = mapValues(child, withPositionalItems);
+    } else
+      rewritten[key] = child;
+  }
+  const { items, additionalItems } = rewritten;
+  if (!Array.isArray(items))
+    return rewritten;
+  const positional = {};
+  for (const [key, child] of Object.entries(rewritten)) {
+    if (key === "items")
+      positional.prefixItems = items;
+    else if (key !== "additionalItems")
+      positional[key] = child;
+  }
+  if (additionalItems !== undefined)
+    positional.items = additionalItems;
+  return positional;
+}
+function withDraft2020Keywords(schema) {
+  const positional = withPositionalItems(schema);
+  if (!isRecord(positional))
+    return schema;
+  const definitions = positional[DRAFT_07_KEYWORD];
+  if (!isRecord(definitions) || DEFS_KEYWORD in positional)
+    return positional;
+  const rewritten = {};
+  for (const [key, value] of Object.entries(positional)) {
     if (key === DRAFT_07_KEYWORD)
       continue;
     rewritten[key] = rewriteDefinitionPointers(value);
@@ -977,7 +1037,7 @@ function isObjectPresentationSchema(schema) {
   return schema.type === "object" && isRecord(schema.properties);
 }
 function presentationMetadata(schema) {
-  return withDefsDialect(withoutDialect(schema));
+  return withDraft2020Keywords(withoutDialect(schema));
 }
 
 // src/tools/internal/surface-projector.ts
@@ -1244,4 +1304,4 @@ function prepareProjectedMcpTools(tools, config = {}) {
   return prepared;
 }
 
-export { toolSurfaceOutputSchema, applyToolViewDefaults, projectToolView, objectShapeKeys, rebuildObject, mergeSchemas, staticInputRounds, validateMcpRoundPolicy, validateResolvedInputRounds, assertToolName, assertUniqueToolName, PORTABLE_JSON_SCHEMA_FORMATS2, findNonPortableFormats2, declaresDraft07, withDefsDialect, flattenToolJsonSchema2, buildToolPresentationSchema, presentationMetadata, findUntypedProperties2, assertToolExtensionCompatible, projectRuntimeTool, projectToolSurface, mcpProjectionCandidate, prepareProjectedMcpTools };
+export { toolSurfaceOutputSchema, applyToolViewDefaults, projectToolView, objectShapeKeys, rebuildObject, mergeSchemas, staticInputRounds, validateMcpRoundPolicy, validateResolvedInputRounds, assertToolName, assertUniqueToolName, PORTABLE_JSON_SCHEMA_FORMATS2, findNonPortableFormats2, declaresDraft07, withDraft2020Keywords, flattenToolJsonSchema2, buildToolPresentationSchema, presentationMetadata, findUntypedProperties2, assertToolExtensionCompatible, projectRuntimeTool, projectToolSurface, mcpProjectionCandidate, prepareProjectedMcpTools };

package/dist/{index-d4cnhfdn.js → index-kenvdagc.js}

@@ -17,7 +17,7 @@ import {
   replaceMessage,
   ArchiveSpillSchema,
   createAgentRuntimeStore2
-} from "./index-38gvr73z.js";
+} from "./index-f2p949ax.js";
 
 // src/agent-runtime/store-memory.ts
 import { z as z2 } from "zod";

package/dist/{index-ff3agzaf.js → index-nk1mh535.js}

@@ -1,6 +1,6 @@
 import {
   projectRuntimeTool
-} from "./index-h7accrrv.js";
+} from "./index-jgwqc38k.js";
 import {
   isRecord
 } from "./index-9jfdm5tg.js";

package/dist/{index-02h0dfpr.js → index-z4ga1fa1.js}

@@ -12,7 +12,7 @@ import {
   applyToolViewDefaults,
   projectToolView,
   objectShapeKeys
-} from "./index-h7accrrv.js";
+} from "./index-jgwqc38k.js";
 import {
   runWithRequestContext2,
   getRequestContext2

package/dist/{index-vqdjym30.js → index-zm1k7hhv.js}

@@ -3,11 +3,11 @@ import {
   mergeSchemas,
   assertToolExtensionCompatible,
   projectToolSurface
-} from "./index-h7accrrv.js";
+} from "./index-jgwqc38k.js";
 import {
   toolErrorFromResult,
   executeToolMethod
-} from "./index-02h0dfpr.js";
+} from "./index-z4ga1fa1.js";
 import {
   isRetryableStatus2
 } from "./index-j9gxbztg.js";

package/dist/json-schema/dialect.d.ts

@@ -1,17 +1,19 @@
 /** True when a document says, in its own `$schema`, that it is draft-07. */
 export declare function declaresDraft07(dialect: unknown): boolean;
 /**
- * Move a document's top-level `definitions` to `$defs`, carrying its pointers.
+ * Write a document in the keywords of 2020-12, the dialect an MCP client reads
+ * tool schemas in. Two draft-07 keywords mean something else there or nothing:
+ * reusable subschemas move from `definitions` to `$defs` with their pointers,
+ * and a tuple's `items` list becomes `prefixItems`.
  *
- * A JSON Schema document that names one dialect and uses another's keyword is
- * not a style question: a reader registers reusable subschemas from the keyword
- * the dialect declares and then cannot resolve `#/definitions/x` at all. Both
- * halves of this framework met that document — the MCP SDK stamps 2020-12 onto
- * the metadata it is handed, and our own MCP client obeyed the stamp.
+ * A document that names one dialect and uses another's keyword is not a style
+ * question: a reader registers subschemas from the keyword its dialect declares
+ * and cannot resolve `#/definitions/x`, and a reader that validates the schema
+ * itself refuses an `items` list and drops the whole tool.
  *
- * Only the top level moves. A `definitions` deeper in the document may be a
- * property literally called "definitions", and guessing which is worse than
- * leaving it where the author put it.
+ * Only the top-level `definitions` moves. A `definitions` deeper in the
+ * document may be a property literally called "definitions", and guessing which
+ * is worse than leaving it where the author put it.
  */
-export declare function withDefsDialect(schema: Record<string, unknown>): Record<string, unknown>;
+export declare function withDraft2020Keywords(schema: Record<string, unknown>): Record<string, unknown>;
 //# sourceMappingURL=dialect.d.ts.map

package/dist/json-schema/dialect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dialect.d.ts","sourceRoot":"","sources":["../../src/json-schema/dialect.ts"],"names":[],"mappings":"AAQA,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAEzD;AAeD;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUxF"}
+{"version":3,"file":"dialect.d.ts","sourceRoot":"","sources":["../../src/json-schema/dialect.ts"],"names":[],"mappings":"AAiCA,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAEzD;AAmDD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYzB"}

package/dist/tools/schema/presentation.d.ts

@@ -16,9 +16,10 @@ export declare function isObjectPresentationSchema(schema: ToolPresentationSchem
  * Metadata passed to the Zod identity carrier.
  *
  * The SDK supplies its own dialect and it is 2020-12, so the document has to
- * speak 2020-12: a draft-07 `definitions` block under a 2020-12 `$schema` is a
- * document that says one thing and does another, and a client that believes the
- * stamp cannot resolve a single `#/definitions/...` pointer in it.
+ * speak 2020-12: draft-07 `definitions` under a 2020-12 `$schema` leave every
+ * `#/definitions/...` pointer unresolvable, and a tuple's draft-07 `items` list
+ * is not a schema there, so a client that validates tool schemas drops the tool.
+ * → ADR 0185, ADR 0268.
  */
 export declare function presentationMetadata(schema: ToolPresentationSchema): ToolPresentationSchema;
 //# sourceMappingURL=presentation.d.ts.map

package/dist/tools/schema/presentation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"presentation.d.ts","sourceRoot":"","sources":["../../../src/tools/schema/presentation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,WAAW,CAAC;AAEnB,MAAM,WAAW,sBAAsB;IACrC,YAAY,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IACzC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,eAAe,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IAClC,uFAAuF;IACvF,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC9C;AA+KD,+EAA+E;AAC/E,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,sBAAsB,GAC7B,sBAAsB,CAkDxB;AAoCD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAElF;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,sBAAsB,GAAG,sBAAsB,CAE3F"}
+{"version":3,"file":"presentation.d.ts","sourceRoot":"","sources":["../../../src/tools/schema/presentation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,WAAW,CAAC;AAEnB,MAAM,WAAW,sBAAsB;IACrC,YAAY,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IACzC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,eAAe,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IAClC,uFAAuF;IACvF,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC9C;AA+KD,+EAA+E;AAC/E,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,sBAAsB,GAC7B,sBAAsB,CAkDxB;AAoCD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAElF;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,sBAAsB,GAAG,sBAAsB,CAE3F"}

package/dist/tracking/clicks.d.ts

@@ -24,6 +24,8 @@ export interface ResolveTrackedClickOptions {
     attributes?: TrackedClickAttributes;
     /** Whether an action name is one the application knows. Default: any. */
     isAction?: (action: string) => boolean;
+    /** Click URLs omit query/fragment by default. `full` retains both for consumer redaction. */
+    hrefPolicy?: 'path-only' | 'full';
 }
 export interface TrackedClick {
     interaction?: {
@@ -42,5 +44,5 @@ export interface TrackedClick {
     /** The click navigates away — send its facts on the unload path. */
     leavesPage: boolean;
 }
-export declare function resolveTrackedClick(target: ClickTarget | null, { origin, attributes, isAction }: ResolveTrackedClickOptions): TrackedClick | null;
+export declare function resolveTrackedClick(target: ClickTarget | null, { origin, attributes, isAction, hrefPolicy }: ResolveTrackedClickOptions): TrackedClick | null;
 //# sourceMappingURL=clicks.d.ts.map

package/dist/tracking/clicks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clicks.d.ts","sourceRoot":"","sources":["../../src/tracking/clicks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,4EAA4E;AAC5E,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAAC;IAC9C,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC1C,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,4BAA4B;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,0BAA0B;IACzC,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,sBAAsB,CAAC;IACpC,yEAAyE;IACzE,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,oEAAoE;IACpE,UAAU,EAAE,OAAO,CAAC;CACrB;AAgBD,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,WAAW,GAAG,IAAI,EAC1B,EAAE,MAAM,EAAE,UAAe,EAAE,QAAqB,EAAE,EAAE,0BAA0B,GAC7E,YAAY,GAAG,IAAI,CA0CrB"}
+{"version":3,"file":"clicks.d.ts","sourceRoot":"","sources":["../../src/tracking/clicks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,4EAA4E;AAC5E,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAAC;IAC9C,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC1C,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,4BAA4B;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,0BAA0B;IACzC,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,sBAAsB,CAAC;IACpC,yEAAyE;IACzE,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,6FAA6F;IAC7F,UAAU,CAAC,EAAE,WAAW,GAAG,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,oEAAoE;IACpE,UAAU,EAAE,OAAO,CAAC;CACrB;AAqBD,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,WAAW,GAAG,IAAI,EAC1B,EAAE,MAAM,EAAE,UAAe,EAAE,QAAqB,EAAE,UAAU,EAAE,EAAE,0BAA0B,GACzF,YAAY,GAAG,IAAI,CA6CrB"}

package/dist/tracking/client-listeners.d.ts

@@ -25,6 +25,7 @@ export interface TrackingListenerDeps<TType extends string> {
     releaseLease(): void;
     readonly clickAttributes: Parameters<typeof resolveTrackedClick>[1]['attributes'];
     readonly isAction: Parameters<typeof resolveTrackedClick>[1]['isAction'];
+    readonly hrefPolicy: Parameters<typeof resolveTrackedClick>[1]['hrefPolicy'];
 }
 export declare function wireTrackingListeners<TType extends string>(deps: TrackingListenerDeps<TType>): Array<() => void>;
 //# sourceMappingURL=client-listeners.d.ts.map

package/dist/tracking/client-listeners.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-listeners.d.ts","sourceRoot":"","sources":["../../src/tracking/client-listeners.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EAAE,yBAAyB,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC3C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAE7D,MAAM,WAAW,oBAAoB,CAAC,KAAK,SAAS,MAAM;IACxD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACnD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC;IAC1D,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC;IAC3D,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACrE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC;IACnC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IACxC,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,WAAW,IAAI,MAAM,CAAC;IACtB,YAAY,IAAI,IAAI,CAAC;IACrB,QAAQ,CAAC,eAAe,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAClF,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;CAC1E;AAED,wBAAgB,qBAAqB,CAAC,KAAK,SAAS,MAAM,EACxD,IAAI,EAAE,oBAAoB,CAAC,KAAK,CAAC,GAChC,KAAK,CAAC,MAAM,IAAI,CAAC,CAsEnB"}
+{"version":3,"file":"client-listeners.d.ts","sourceRoot":"","sources":["../../src/tracking/client-listeners.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EAAE,yBAAyB,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC3C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAE7D,MAAM,WAAW,oBAAoB,CAAC,KAAK,SAAS,MAAM;IACxD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACnD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC;IAC1D,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC;IAC3D,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACrE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC;IACnC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IACxC,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,WAAW,IAAI,MAAM,CAAC;IACtB,YAAY,IAAI,IAAI,CAAC;IACrB,QAAQ,CAAC,eAAe,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAClF,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACzE,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;CAC9E;AAED,wBAAgB,qBAAqB,CAAC,KAAK,SAAS,MAAM,EACxD,IAAI,EAAE,oBAAoB,CAAC,KAAK,CAAC,GAChC,KAAK,CAAC,MAAM,IAAI,CAAC,CAuEnB"}

package/dist/tracking/client.d.ts

@@ -12,7 +12,7 @@
  * session. → ADR 0166.
  */
 import type { ReferrerRule, ResolvedAttribution } from './attribution.js';
-import type { TrackedClickAttributes } from './clicks.js';
+import type { ResolveTrackedClickOptions, TrackedClickAttributes } from './clicks.js';
 import type { TrackingHost } from './host.js';
 import type { TrackingOutbox } from './outbox.js';
 import type { TrackEventsRequest, TrackEventsResponse, TrackingEventEnvelope, VisitBootstrapResponse, VisitEntryContext } from './schemas.js';
@@ -88,6 +88,8 @@ export interface TrackingClientConfig<TMetadata extends object, TEvent extends T
     isAction?: (action: string) => boolean;
     referrerMap?: readonly ReferrerRule[];
     clickAttributes?: TrackedClickAttributes;
+    /** Click URL retention before `decorate`. Default `path-only`; `full` includes query/fragment. */
+    hrefPolicy?: ResolveTrackedClickOptions['hrefPolicy'];
     scrollMilestones?: readonly number[];
     /** Heartbeat and flush period. Default 30 s. */
     heartbeatMs?: number;

package/dist/tracking/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/tracking/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEvE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAYvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EAErB,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,WAAW,CAAC;AAInB,wFAAwF;AACxF,MAAM,WAAW,yBAAyB,CAAC,KAAK,SAAS,MAAM;IAC7D,QAAQ,EAAE,KAAK,CAAC;IAChB,SAAS,EAAE,KAAK,CAAC;IACjB,WAAW,EAAE,KAAK,CAAC;IACnB,SAAS,EAAE,KAAK,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;IACb,aAAa,EAAE,KAAK,CAAC;IACrB,WAAW,EAAE,KAAK,CAAC;CACpB;AAED,2DAA2D;AAC3D,eAAO,MAAM,iCAAiC;uBAClC,WAAW;wBACV,YAAY;0BACV,cAAc;wBAChB,mBAAmB;oBACvB,OAAO;4BACC,gBAAgB;0BAClB,aAAa;CAC0B,CAAC;AAEvD,2EAA2E;AAC3E,MAAM,MAAM,qBAAqB,CAAC,SAAS,IAAI;KAC5C,CAAC,IAAI,MAAM,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,SAAS,GAAG,CAAC,GAAG,KAAK;CAC5E,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC;AAC5B,qEAAqE;AACrE,MAAM,MAAM,kBAAkB,CAAC,SAAS,IAAI;KACzC,CAAC,IAAI,MAAM,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,SAAS,GAAG,KAAK,GAAG,CAAC;CAC5E,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC;AAE5B,sGAAsG;AACtG,MAAM,WAAW,OAAO,CAAC,SAAS;IAChC,CAAC,CAAC,SAAS,qBAAqB,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;IAC5D,CAAC,CAAC,SAAS,kBAAkB,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;CAClF;AAED,MAAM,WAAW,oBAAoB,CACnC,SAAS,SAAS,MAAM,EACxB,MAAM,SAAS,qBAAqB,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,qBAAqB,CACpF,MAAM,SAAS,GAAG,MAAM,CACzB;IAED,IAAI,EAAE,YAAY,CAAC;IACnB,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,OAAO,EAAE,yBAAyB,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC;IAC7D,oEAAoE;IACpE,SAAS,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACzE;;;OAGG;IACH,OAAO,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC/E;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,qBAAqB,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,MAAM,CAAC;IAC9E;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC;IAC1D,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IAChC,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACnD,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IACtC,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD;AAED,MAAM,WAAW,cAAc,CAAC,SAAS,SAAS,MAAM;IACtD,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1B,sFAAsF;IACtF,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACnD,yEAAyE;IACzE,KAAK,IAAI,MAAM,IAAI,CAAC;IACpB,OAAO,IAAI,MAAM,GAAG,IAAI,CAAC;IACzB,eAAe,IAAI,MAAM,GAAG,IAAI,CAAC;IACjC,8FAA8F;IAC9F,WAAW,IAAI,mBAAmB,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,MAAM,KAAK,CAAC,KAAK,SAAS,MAAM,IAAI,IAAI,CAC5C,qBAAqB,CAAC,KAAK,CAAC,EAC5B,SAAS,GAAG,SAAS,GAAG,iBAAiB,GAAG,iBAAiB,CAC9D,CAAC;AA0CF,wBAAgB,oBAAoB,CAClC,SAAS,SAAS,MAAM,EACxB,MAAM,SAAS,qBAAqB,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,qBAAqB,CACpF,MAAM,SAAS,GAAG,MAAM,CACzB,EACD,MAAM,EAAE,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,cAAc,CAAC,SAAS,CAAC,CAgM5E"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/tracking/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEvE,OAAO,KAAK,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAYnF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EAErB,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,WAAW,CAAC;AAInB,wFAAwF;AACxF,MAAM,WAAW,yBAAyB,CAAC,KAAK,SAAS,MAAM;IAC7D,QAAQ,EAAE,KAAK,CAAC;IAChB,SAAS,EAAE,KAAK,CAAC;IACjB,WAAW,EAAE,KAAK,CAAC;IACnB,SAAS,EAAE,KAAK,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;IACb,aAAa,EAAE,KAAK,CAAC;IACrB,WAAW,EAAE,KAAK,CAAC;CACpB;AAED,2DAA2D;AAC3D,eAAO,MAAM,iCAAiC;uBAClC,WAAW;wBACV,YAAY;0BACV,cAAc;wBAChB,mBAAmB;oBACvB,OAAO;4BACC,gBAAgB;0BAClB,aAAa;CAC0B,CAAC;AAEvD,2EAA2E;AAC3E,MAAM,MAAM,qBAAqB,CAAC,SAAS,IAAI;KAC5C,CAAC,IAAI,MAAM,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,SAAS,GAAG,CAAC,GAAG,KAAK;CAC5E,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC;AAC5B,qEAAqE;AACrE,MAAM,MAAM,kBAAkB,CAAC,SAAS,IAAI;KACzC,CAAC,IAAI,MAAM,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,SAAS,GAAG,KAAK,GAAG,CAAC;CAC5E,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC;AAE5B,sGAAsG;AACtG,MAAM,WAAW,OAAO,CAAC,SAAS;IAChC,CAAC,CAAC,SAAS,qBAAqB,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;IAC5D,CAAC,CAAC,SAAS,kBAAkB,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;CAClF;AAED,MAAM,WAAW,oBAAoB,CACnC,SAAS,SAAS,MAAM,EACxB,MAAM,SAAS,qBAAqB,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,qBAAqB,CACpF,MAAM,SAAS,GAAG,MAAM,CACzB;IAED,IAAI,EAAE,YAAY,CAAC;IACnB,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,OAAO,EAAE,yBAAyB,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC;IAC7D,oEAAoE;IACpE,SAAS,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACzE;;;OAGG;IACH,OAAO,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC/E;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,qBAAqB,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,MAAM,CAAC;IAC9E;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC;IAC1D,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IAChC,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACnD,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IACtC,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,kGAAkG;IAClG,UAAU,CAAC,EAAE,0BAA0B,CAAC,YAAY,CAAC,CAAC;IACtD,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD;AAED,MAAM,WAAW,cAAc,CAAC,SAAS,SAAS,MAAM;IACtD,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1B,sFAAsF;IACtF,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACnD,yEAAyE;IACzE,KAAK,IAAI,MAAM,IAAI,CAAC;IACpB,OAAO,IAAI,MAAM,GAAG,IAAI,CAAC;IACzB,eAAe,IAAI,MAAM,GAAG,IAAI,CAAC;IACjC,8FAA8F;IAC9F,WAAW,IAAI,mBAAmB,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,MAAM,KAAK,CAAC,KAAK,SAAS,MAAM,IAAI,IAAI,CAC5C,qBAAqB,CAAC,KAAK,CAAC,EAC5B,SAAS,GAAG,SAAS,GAAG,iBAAiB,GAAG,iBAAiB,CAC9D,CAAC;AA0CF,wBAAgB,oBAAoB,CAClC,SAAS,SAAS,MAAM,EACxB,MAAM,SAAS,qBAAqB,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,qBAAqB,CACpF,MAAM,SAAS,GAAG,MAAM,CACzB,EACD,MAAM,EAAE,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,cAAc,CAAC,SAAS,CAAC,CAiM5E"}

package/llms/tracking.txt

@@ -100,6 +100,24 @@ createTrackingClient<BrowserEvents, TrackingEventEnvelope<keyof BrowserEvents> &
 })
 ```
 
+### Click URL retention
+
+`resolveTrackedClick(target, { origin, hrefPolicy: 'full' })` and
+`createTrackingClient({ …, hrefPolicy: 'full' })` retain the clicked URL's pathname,
+query and fragment. Internal URLs are relative (`/item?offer=one#details`);
+outbound URLs include their origin (`https://other.example/item?offer=one#details`).
+URL credentials are excluded. Omitting the option, or selecting `path-only`,
+keeps the default that omits query and fragment. Navigation classification,
+labels and subscriptions are independent of this policy.
+
+Full URLs may contain sensitive values. Supply your application's password and
+secret redactor through `decorate` before enabling `full`: it receives the retained
+`event.metadata.href` and must return the redacted metadata. The returned event is
+what the outbox, synchronous unload and normal delivery receive. The framework
+has no application-specific password policy. This option controls click and
+outbound-click metadata; it does not change attribution, page tracking or interaction
+metadata. Use the same redactor on your other ingestion paths.
+
 A `bootstrap` operation that needs extra fields of its own (a locale, a RUM
 flag) is not the factory's: build the `entry` schema with
 `createTrackingSchemas(…).entry.extend({ … })` and declare that endpoint yourself.
@@ -234,7 +252,7 @@ application's — it owns the router and the session. The server half is
 | Export | Kind | Summary |
 |--------|------|---------|
 | `createTrackingClient` | function | the client: visit lease and renewal, pending queue, synchronous identity from reserved sequences, outbox and flush lease, delivery, the string-body page-leave beacon plus a queued copy, visible time, scroll milestones, declarative clicks, heartbeats |
-| `TrackingClient` / `TrackingClientConfig` | _type_ | `track` / `onNavigate` / `start` / `visitId` / `browserStreamId` / `attribution`, and the host, `buildId`, `builtin` names, `bootstrap`, `deliver`, optional `decorate` (your `eventExtras` on every minted event), `unload` / `unloadUrl`, `outbox`, `onUnauthorized`, `onVisit`, `onFailure`, `isAction`, `referrerMap`, `clickAttributes`, `scrollMilestones`, `batchSize`, periods and limits |
+| `TrackingClient` / `TrackingClientConfig` | _type_ | `track` / `onNavigate` / `start` / `visitId` / `browserStreamId` / `attribution`, and the host, `buildId`, `builtin` names, `bootstrap`, `deliver`, optional `decorate` (your `eventExtras` on every minted event), `unload` / `unloadUrl`, `outbox`, `onUnauthorized`, `onVisit`, `onFailure`, `isAction`, `referrerMap`, `clickAttributes`, `hrefPolicy` (`path-only` by default; `full` retains click query/fragment before `decorate`), `scrollMilestones`, `batchSize`, periods and limits |
 | `TrackFn` / `EventsWithMetadata` / `EventsWithoutMetadata` | _type_ | `track(type)` / `track(type, metadata)` typed by the application's metadata map, and the two halves of that map |
 | `BuiltinTrackingEventTypes` / `CONVENTIONAL_TRACKING_EVENT_TYPES` | _type_ / const | the application's names for the events the client emits itself; the conventional `PAGE_VIEW` … `INTERACTION` set |
 | `browserTrackingHost` / `TrackingHost` / `TrackingPageContext` | function / _type_ | everything the client takes from a browser tab behind one interface — page context, visibility, scroll depth, events, intervals, clocks, storage — so a test or a non-tab host can supply its own |
@@ -258,6 +276,6 @@ application's — it owns the router and the session. The server half is
 | `createOncePerPage` / `OncePerPage` | function / _type_ | one fact per key per page within a window — the guard a twice-mounted component cannot keep itself |
 | `resolveAttribution` / `ResolveAttributionInput` / `ResolvedAttribution` / `AttributionStorage` / `ReferrerRule` | function / _type_ | first-touch once, current-touch on every new UTM; the referrer → source/medium map is the application's, there is no built-in list |
 | `parseUtmFromSearch` / `parseReferrer` | function | the two parsers `resolveAttribution` is built from |
-| `resolveTrackedClick` / `ResolveTrackedClickOptions` / `TrackedClick` / `TrackedClickAttributes` / `ClickTarget` | function / _type_ | `data-track` → click, `data-track-action` → interaction, a link to another origin → outbound; attribute names configurable; `leavesPage` says which path to send on |
+| `resolveTrackedClick` / `ResolveTrackedClickOptions` / `TrackedClick` / `TrackedClickAttributes` / `ClickTarget` | function / _type_ | `data-track` → click, `data-track-action` → interaction, a link to another origin → outbound; attribute names configurable; `hrefPolicy: 'full'` retains query/fragment (default `path-only` omits them), URL credentials excluded; `leavesPage` says which path to send on |
 
 ---

package/llms-full.txt

@@ -511,6 +511,24 @@ createTrackingClient<BrowserEvents, TrackingEventEnvelope<keyof BrowserEvents> &
 })
 ```
 
+### Click URL retention
+
+`resolveTrackedClick(target, { origin, hrefPolicy: 'full' })` and
+`createTrackingClient({ …, hrefPolicy: 'full' })` retain the clicked URL's pathname,
+query and fragment. Internal URLs are relative (`/item?offer=one#details`);
+outbound URLs include their origin (`https://other.example/item?offer=one#details`).
+URL credentials are excluded. Omitting the option, or selecting `path-only`,
+keeps the default that omits query and fragment. Navigation classification,
+labels and subscriptions are independent of this policy.
+
+Full URLs may contain sensitive values. Supply your application's password and
+secret redactor through `decorate` before enabling `full`: it receives the retained
+`event.metadata.href` and must return the redacted metadata. The returned event is
+what the outbox, synchronous unload and normal delivery receive. The framework
+has no application-specific password policy. This option controls click and
+outbound-click metadata; it does not change attribution, page tracking or interaction
+metadata. Use the same redactor on your other ingestion paths.
+
 A `bootstrap` operation that needs extra fields of its own (a locale, a RUM
 flag) is not the factory's: build the `entry` schema with
 `createTrackingSchemas(…).entry.extend({ … })` and declare that endpoint yourself.
@@ -23280,7 +23298,7 @@ application's — it owns the router and the session. The server half is
 | Export | Kind | Summary |
 |--------|------|---------|
 | `createTrackingClient` | function | the client: visit lease and renewal, pending queue, synchronous identity from reserved sequences, outbox and flush lease, delivery, the string-body page-leave beacon plus a queued copy, visible time, scroll milestones, declarative clicks, heartbeats |
-| `TrackingClient` / `TrackingClientConfig` | _type_ | `track` / `onNavigate` / `start` / `visitId` / `browserStreamId` / `attribution`, and the host, `buildId`, `builtin` names, `bootstrap`, `deliver`, optional `decorate` (your `eventExtras` on every minted event), `unload` / `unloadUrl`, `outbox`, `onUnauthorized`, `onVisit`, `onFailure`, `isAction`, `referrerMap`, `clickAttributes`, `scrollMilestones`, `batchSize`, periods and limits |
+| `TrackingClient` / `TrackingClientConfig` | _type_ | `track` / `onNavigate` / `start` / `visitId` / `browserStreamId` / `attribution`, and the host, `buildId`, `builtin` names, `bootstrap`, `deliver`, optional `decorate` (your `eventExtras` on every minted event), `unload` / `unloadUrl`, `outbox`, `onUnauthorized`, `onVisit`, `onFailure`, `isAction`, `referrerMap`, `clickAttributes`, `hrefPolicy` (`path-only` by default; `full` retains click query/fragment before `decorate`), `scrollMilestones`, `batchSize`, periods and limits |
 | `TrackFn` / `EventsWithMetadata` / `EventsWithoutMetadata` | _type_ | `track(type)` / `track(type, metadata)` typed by the application's metadata map, and the two halves of that map |
 | `BuiltinTrackingEventTypes` / `CONVENTIONAL_TRACKING_EVENT_TYPES` | _type_ / const | the application's names for the events the client emits itself; the conventional `PAGE_VIEW` … `INTERACTION` set |
 | `browserTrackingHost` / `TrackingHost` / `TrackingPageContext` | function / _type_ | everything the client takes from a browser tab behind one interface — page context, visibility, scroll depth, events, intervals, clocks, storage — so a test or a non-tab host can supply its own |
@@ -23304,7 +23322,7 @@ application's — it owns the router and the session. The server half is
 | `createOncePerPage` / `OncePerPage` | function / _type_ | one fact per key per page within a window — the guard a twice-mounted component cannot keep itself |
 | `resolveAttribution` / `ResolveAttributionInput` / `ResolvedAttribution` / `AttributionStorage` / `ReferrerRule` | function / _type_ | first-touch once, current-touch on every new UTM; the referrer → source/medium map is the application's, there is no built-in list |
 | `parseUtmFromSearch` / `parseReferrer` | function | the two parsers `resolveAttribution` is built from |
-| `resolveTrackedClick` / `ResolveTrackedClickOptions` / `TrackedClick` / `TrackedClickAttributes` / `ClickTarget` | function / _type_ | `data-track` → click, `data-track-action` → interaction, a link to another origin → outbound; attribute names configurable; `leavesPage` says which path to send on |
+| `resolveTrackedClick` / `ResolveTrackedClickOptions` / `TrackedClick` / `TrackedClickAttributes` / `ClickTarget` | function / _type_ | `data-track` → click, `data-track-action` → interaction, a link to another origin → outbound; attribute names configurable; `hrefPolicy: 'full'` retains query/fragment (default `path-only` omits them), URL credentials excluded; `leavesPage` says which path to send on |
 
 ---
 

package/llms.txt

@@ -45,7 +45,7 @@ Load the slice for each entrypoint your code imports — `import … from 'stitc
 - **stitchkit/telegram**: [llms/telegram.txt](llms/telegram.txt) 36.6 KB
 - **stitchkit/telegram/html**: [llms/telegram-html.txt](llms/telegram-html.txt) 2.7 KB
 - **stitchkit/telegram/screens**: [llms/telegram-screens.txt](llms/telegram-screens.txt) 21.2 KB
-- **stitchkit/tracking**: [llms/tracking.txt](llms/tracking.txt) 16.8 KB
+- **stitchkit/tracking**: [llms/tracking.txt](llms/tracking.txt) 18.1 KB
 - **stitchkit/release**: [llms/release.txt](llms/release.txt) 8.9 KB
 - **stitchkit/tracking/server**: [llms/tracking-server.txt](llms/tracking-server.txt) 2.5 KB
 - **stitchkit/geo**: [llms/geo.txt](llms/geo.txt) 4.1 KB

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stitchkit",
-  "version": "0.112.1",
+  "version": "0.112.3",
   "description": "Contract-first backend framework — one defineContract() into an HTTP API, MCP tools, AI-agent tools and a typed client. Bun and Node.",
   "keywords": [
     "bun",
@@ -378,6 +378,7 @@
     "@types/react-dom": "^19.3.0",
     "@typescript/typescript6": "^6.0.2",
     "ai": "^7.0.111",
+    "ajv": "^8.20.0",
     "fake-indexeddb": "^6.2.5",
     "google-auth-library": "^11.1.0",
     "grammy": "^1.46.0",