stitchkit 0.114.0 → 0.114.2

package/dist/entrypoints/telegram.js

@@ -7,15 +7,20 @@ import {
   attemptExclusiveLock
 } from "../index-5v5a9k2n.js";
 import {
-  TelegramNotDispatchedError2,
-  isTelegramNotDispatchedError,
   TELEGRAM_SEND_FAILURE_REASONS2,
   classifyTelegramSendFailure2
-} from "../index-hs35ss3p.js";
+} from "../index-61hve0ez.js";
+import {
+  TelegramNotDispatchedError2,
+  isTelegramNotDispatchedError
+} from "../index-6j725ez5.js";
 import {
   TELEGRAM_TEXT_LIMIT2,
   truncateTelegramHtml2
 } from "../index-nmaqxdx7.js";
+import {
+  BOT_TOKEN_SECRET
+} from "../index-sznqf8fx.js";
 import {
   writeFileAtomic2
 } from "../index-07dcf2yn.js";
@@ -26,15 +31,12 @@ import {
   MAX_TIMER_MS,
   sleep
 } from "../index-eemvahkc.js";
-import {
-  assertPositiveSafeInteger
-} from "../index-0s4xebbg.js";
-import {
-  BOT_TOKEN_SECRET
-} from "../index-sznqf8fx.js";
 import {
   untilAborted
 } from "../index-a5qr2rj6.js";
+import {
+  assertPositiveSafeInteger
+} from "../index-0s4xebbg.js";
 import {
   argumentsDigest
 } from "../index-r7a7r7ha.js";
@@ -1087,12 +1089,16 @@ function createBudget(rate, fallback, now, sleepFor) {
       await acquire(cost, signal);
     if (signal?.aborted)
       throw signal.reason;
+    let result;
     try {
-      return await send();
+      result = await send();
     } catch (error) {
       pauseAfter(error);
       throw error;
     }
+    if (isRecord(result) && result.ok === false)
+      pauseAfter(result);
+    return result;
   };
   const budget = {
     run,

package/dist/entrypoints/testing.js

@@ -6,7 +6,7 @@ import"../index-p6apg0jg.js";
 import"../index-q0th8q0z.js";
 import {
   createApplication2
-} from "../index-v1tswj0z.js";
+} from "../index-txg1npmg.js";
 import"../index-w5s3xftz.js";
 import {
   RealtimeRequestTimeoutError2,
@@ -15,7 +15,7 @@ import {
 } from "../index-4s0fep5q.js";
 import {
   TOOL_TRANSPORTS2
-} from "../index-fsw1ybf3.js";
+} from "../index-d9hq291n.js";
 import {
   RealtimeRejectDirectionSchema,
   RealtimeRejectPhaseSchema,
@@ -35,7 +35,7 @@ import"../index-k42ckyzx.js";
 import {
   createClient2,
   createClients2
-} from "../index-c5at3ykd.js";
+} from "../index-tsngj2b5.js";
 import {
   assertPositiveSafeInteger
 } from "../index-0s4xebbg.js";

package/dist/entrypoints/tools/connections.js

@@ -11,28 +11,28 @@ import {
 import {
   withSignalDeadline
 } from "../../index-9tqbxv5p.js";
+import {
+  defineRuntimeTool2
+} from "../../index-ega3yz4c.js";
+import {
+  TOOL_ERROR_PROJECTION
+} from "../../index-98hv3sba.js";
 import {
   raceAbort
 } from "../../index-b0kddvzw.js";
 import {
   readBoundedChunks,
   concatChunks
-} from "../../index-5efrpfmj.js";
+} from "../../index-qndsr7f0.js";
 import {
   MAX_TIMER_MS
 } from "../../index-eemvahkc.js";
-import {
-  assertPositiveSafeInteger
-} from "../../index-0s4xebbg.js";
-import {
-  defineRuntimeTool2
-} from "../../index-ega3yz4c.js";
-import {
-  TOOL_ERROR_PROJECTION
-} from "../../index-98hv3sba.js";
 import {
   safeJsonParse
 } from "../../index-zsarb5xp.js";
+import {
+  assertPositiveSafeInteger
+} from "../../index-0s4xebbg.js";
 import {
   AppError2,
   STITCH_ERROR_STATUS2,

package/dist/entrypoints/tools.js

@@ -5,7 +5,7 @@ import {
   createLocalStepDurability2,
   AgentToolError2,
   isAgentToolError2
-} from "../index-56yx8dxp.js";
+} from "../index-tvtacc9a.js";
 import {
   normalizeError2
 } from "../index-k42ckyzx.js";
@@ -33,13 +33,13 @@ import {
   mountAgent2,
   describeToolCatalog2,
   buildToolManifest2
-} from "../index-1csp1hwm.js";
+} from "../index-6p3frkv5.js";
 import"../index-m38ej7e5.js";
 import {
   ALL_TRANSPORTS2,
   TOOL_TRANSPORTS2,
   defineContract2
-} from "../index-fsw1ybf3.js";
+} from "../index-d9hq291n.js";
 import {
   PROTECTED_RESOURCE_PATH2,
   protectedResourceMetadataUrl2,
@@ -74,7 +74,7 @@ import {
   WaitTimeoutError,
   runWaitOperation,
   createCli2
-} from "../index-k7z3j3hr.js";
+} from "../index-tnxsq7cw.js";
 import {
   ManagedFilePathSchema2,
   ManagedFileRefSchema2
@@ -87,9 +87,22 @@ import {
   contractOnlyService,
   mediaTypeEssence
 } from "../index-cqmqyjax.js";
+import {
+  DEFAULT_CORS_ALLOW_HEADERS2
+} from "../index-yk4g8805.js";
 import {
   createToolInvoker2
 } from "../index-vwhrnp67.js";
+import {
+  collectToolSurface
+} from "../index-86nbfysb.js";
+import {
+  getTraceId2
+} from "../index-r6v4mc67.js";
+import {
+  defineRuntimeTool2,
+  createRuntimeToolFactory2
+} from "../index-ega3yz4c.js";
 import {
   ManagedFileError2
 } from "../index-2f9r0jgr.js";
@@ -97,28 +110,15 @@ import {
   fetchGuarded,
   fetchPinnedDocument,
   readCapped
-} from "../index-cxpcdswt.js";
+} from "../index-mgb7r8b8.js";
 import"../index-1bx1xv1k.js";
 import {
   readBoundedChunks,
   concatChunks
-} from "../index-5efrpfmj.js";
+} from "../index-qndsr7f0.js";
 import {
   assertPositiveSafeInteger
 } from "../index-0s4xebbg.js";
-import {
-  DEFAULT_CORS_ALLOW_HEADERS2
-} from "../index-yk4g8805.js";
-import {
-  collectToolSurface
-} from "../index-86nbfysb.js";
-import {
-  getTraceId2
-} from "../index-r6v4mc67.js";
-import {
-  defineRuntimeTool2,
-  createRuntimeToolFactory2
-} from "../index-ega3yz4c.js";
 import {
   formatZodError2
 } from "../index-1eeqpadm.js";

package/dist/entrypoints/tracking.js

@@ -1,7 +1,7 @@
 import"../index-m38ej7e5.js";
 import {
   defineContract2
-} from "../index-fsw1ybf3.js";
+} from "../index-d9hq291n.js";
 import {
   ApiError2
 } from "../index-kfjkb396.js";

package/dist/{index-hs35ss3p.js → index-61hve0ez.js}

@@ -1,31 +1,10 @@
+import {
+  isTelegramNotDispatched
+} from "./index-6j725ez5.js";
 import {
   isRecord
 } from "./index-9jfdm5tg.js";
 
-// src/telegram/not-dispatched.ts
-class TelegramNotDispatchedError2 extends Error {
-  stage;
-  name = "TelegramNotDispatchedError";
-  code = "TELEGRAM_NOT_DISPATCHED";
-  constructor(stage, message, options) {
-    super(message, options);
-    this.stage = stage;
-  }
-}
-function isTelegramNotDispatchedError(error) {
-  return error instanceof TelegramNotDispatchedError2 || error instanceof Error && error.name === "TelegramNotDispatchedError" && Reflect.get(error, "code") === "TELEGRAM_NOT_DISPATCHED";
-}
-function isTelegramNotDispatched(error, depth = 0) {
-  if (error instanceof TelegramNotDispatchedError2)
-    return true;
-  if (typeof error !== "object" || error === null || depth > 4)
-    return false;
-  if (Reflect.get(error, "code") === "TELEGRAM_NOT_DISPATCHED")
-    return true;
-  const nested = Reflect.get(error, "cause") ?? Reflect.get(error, "error");
-  return nested !== error && isTelegramNotDispatched(nested, depth + 1);
-}
-
 // src/telegram/send-failure.ts
 var BY_DESCRIPTION = [
   [/bot was blocked by the user|bot was kicked/i, "blocked-by-user"],
@@ -176,4 +155,4 @@ function classifyTelegramEditRefusal(error) {
   return "other";
 }
 
-export { TelegramNotDispatchedError2, isTelegramNotDispatchedError, TELEGRAM_SEND_FAILURE_REASONS2, classifyTelegramSendFailure2, classifyTelegramEditRefusal };
+export { TELEGRAM_SEND_FAILURE_REASONS2, classifyTelegramSendFailure2, classifyTelegramEditRefusal };

package/dist/index-6j725ez5.js

@@ -0,0 +1,25 @@
+// src/telegram/not-dispatched.ts
+class TelegramNotDispatchedError2 extends Error {
+  stage;
+  name = "TelegramNotDispatchedError";
+  code = "TELEGRAM_NOT_DISPATCHED";
+  constructor(stage, message, options) {
+    super(message, options);
+    this.stage = stage;
+  }
+}
+function isTelegramNotDispatchedError(error) {
+  return error instanceof TelegramNotDispatchedError2 || error instanceof Error && error.name === "TelegramNotDispatchedError" && Reflect.get(error, "code") === "TELEGRAM_NOT_DISPATCHED";
+}
+function isTelegramNotDispatched(error, depth = 0) {
+  if (error instanceof TelegramNotDispatchedError2)
+    return true;
+  if (typeof error !== "object" || error === null || depth > 4)
+    return false;
+  if (Reflect.get(error, "code") === "TELEGRAM_NOT_DISPATCHED")
+    return true;
+  const nested = Reflect.get(error, "cause") ?? Reflect.get(error, "error");
+  return nested !== error && isTelegramNotDispatched(nested, depth + 1);
+}
+
+export { TelegramNotDispatchedError2, isTelegramNotDispatchedError, isTelegramNotDispatched };

package/dist/{index-1csp1hwm.js → index-6p3frkv5.js}

@@ -10,7 +10,7 @@ import {
 import {
   AgentToolError2,
   resolveToolDurability
-} from "./index-56yx8dxp.js";
+} from "./index-tvtacc9a.js";
 import {
   collectToolSurface
 } from "./index-86nbfysb.js";

package/dist/{index-erv5shjq.js → index-912sza5h.js}

@@ -5,7 +5,7 @@ import {
   fetchGuarded,
   PrivateAddressRefusal,
   readCapped
-} from "./index-cxpcdswt.js";
+} from "./index-mgb7r8b8.js";
 import {
   writeFileAtomicSync2
 } from "./index-07dcf2yn.js";

package/dist/{index-fy4av0hq.js → index-9bwcthxw.js}

@@ -1,6 +1,6 @@
 import {
   defineContract2
-} from "./index-fsw1ybf3.js";
+} from "./index-d9hq291n.js";
 import {
   bytesToBase64Url,
   base64UrlToBytes

package/dist/{index-523tq7y4.js → index-a3462dqf.js}

@@ -4,7 +4,7 @@ import {
   AgentSandboxRestrictionSchema2,
   AgentSandboxGradeSchema2,
   AGENT_CODING_TOOL_NAMES
-} from "./index-zktz242w.js";
+} from "./index-s47ac8zt.js";
 import {
   AgentRecordIdSchema2,
   AgentRecordVersionSchema2,

package/dist/{index-506kd458.js → index-aw6zahv1.js}

@@ -4,7 +4,7 @@ import {
 } from "./index-b0w7rbpt.js";
 import {
   createAgentRuntimeEventSink2
-} from "./index-616xh7f2.js";
+} from "./index-4qnzda76.js";
 import {
   assertPositiveSafeInteger
 } from "./index-0s4xebbg.js";

package/dist/{index-tpwbct8j.js → index-dc9ere5p.js}

@@ -17,7 +17,7 @@ import {
   replaceMessage,
   ArchiveSpillSchema,
   createAgentRuntimeStore2
-} from "./index-523tq7y4.js";
+} from "./index-a3462dqf.js";
 
 // src/agent-runtime/store-memory.ts
 import { z as z2 } from "zod";

package/dist/{index-cxpcdswt.js → index-mgb7r8b8.js}

@@ -3,13 +3,92 @@ import {
 } from "./index-b0kddvzw.js";
 import {
   readBoundedChunks
-} from "./index-5efrpfmj.js";
+} from "./index-qndsr7f0.js";
 
 // src/internal/secure-fetch.ts
 import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+
+// src/internal/pinned-http.ts
 import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
-import { isIP } from "node:net";
+async function requestPinned(url, resolved, signal, headers = {}) {
+  const transport = url.protocol === "https:" ? httpsRequest : httpRequest;
+  const incoming = await new Promise((resolve, reject) => {
+    let answered = false;
+    const request = transport({
+      protocol: url.protocol,
+      hostname: resolved.address,
+      family: resolved.family,
+      port: url.port || undefined,
+      path: `${url.pathname}${url.search}`,
+      method: "GET",
+      signal,
+      ...url.protocol === "https:" ? { servername: url.hostname } : {},
+      headers: { host: url.host, accept: "*/*", ...headers }
+    }, (response) => {
+      answered = true;
+      resolve(response);
+    });
+    request.once("error", (error) => {
+      if (answered)
+        return;
+      reject(signal?.aborted && signal.reason !== undefined ? signal.reason : error);
+    });
+    request.end();
+  });
+  return pinnedResponse(incoming);
+}
+function pinnedResponse(incoming) {
+  const status = incoming.statusCode ?? 0;
+  const headers = new Headers;
+  for (const [name, value] of Object.entries(incoming.headers)) {
+    if (Array.isArray(value)) {
+      for (const item of value)
+        headers.append(name, item);
+    } else if (value !== undefined) {
+      headers.set(name, value);
+    }
+  }
+  if (status === 204 || status === 205 || status === 304) {
+    incoming.resume();
+    return new Response(null, { status, statusText: incoming.statusMessage, headers });
+  }
+  let done = false;
+  const body = new ReadableStream({
+    start(controller) {
+      incoming.on("data", (chunk) => {
+        if (done)
+          return;
+        controller.enqueue(chunk);
+        if ((controller.desiredSize ?? 1) <= 0)
+          incoming.pause();
+      });
+      incoming.once("end", () => {
+        if (done)
+          return;
+        done = true;
+        controller.close();
+      });
+      incoming.once("error", (error) => {
+        if (done)
+          return;
+        done = true;
+        controller.error(error);
+      });
+    },
+    pull() {
+      incoming.resume();
+    },
+    cancel() {
+      done = true;
+      incoming.destroy();
+    }
+  });
+  return new Response(body, { status, statusText: incoming.statusMessage, headers });
+}
+
+// src/internal/secure-fetch.ts
 var NUMERIC_HOST = /^(0x[0-9a-f]+|[0-9.]+)$/i;
 var MAX_REDIRECTS = 5;
 function assertHttpUrl(url) {
@@ -102,9 +181,10 @@ function isPrivateIp(ip) {
   }
   return false;
 }
-async function assertPublicUrl(url, signal) {
-  await resolvePublicAddress(url, signal);
-}
+var defaultLookup = async (host) => {
+  const records = await lookup(host, { all: true });
+  return Array.isArray(records) ? records : [records];
+};
 async function fetchGuarded(start, allowPrivate, options = {}) {
   const timeoutMs = options.timeoutMs ?? 15000;
   const bodyTimeoutMs = options.bodyTimeoutMs ?? 120000;
@@ -120,15 +200,16 @@ async function fetchGuarded(start, allowPrivate, options = {}) {
     controller.abort(new Error(`fetch did not produce response headers within ${timeoutMs}ms`));
   }, timeoutMs);
   headerTimer.unref?.();
+  const transport = options.transport ?? requestPinned;
   let settled = false;
   try {
     let url = start;
     for (let hop = 0;hop <= MAX_REDIRECTS; hop++) {
-      if (allowPrivate)
-        assertHttpUrl(url);
-      else
-        await assertPublicUrl(url, signal);
-      const res = await fetch(url, { redirect: "manual", signal });
+      if (url.username || url.password) {
+        throw new Error("refusing to fetch a URL that carries credentials");
+      }
+      const resolved = await resolveAddress(url, allowPrivate, signal, options.dns);
+      const res = await transport(url, resolved, signal);
       const location = res.status >= 300 && res.status < 400 ? res.headers.get("location") : null;
       if (location === null) {
         settled = true;
@@ -148,11 +229,27 @@ async function fetchGuarded(start, allowPrivate, options = {}) {
       clearTimeout(headerTimer);
   }
 }
+async function resolveAddress(url, allowPrivate, signal, dns) {
+  if (!allowPrivate)
+    return resolvePublicAddress(url, signal, dns);
+  assertHttpUrl(url);
+  const host = url.hostname.replace(/^\[|\]$/g, "");
+  if (!host)
+    throw new Error("refusing to fetch a URL with no host");
+  const ipFamily = isIP(host);
+  if (ipFamily)
+    return { address: host, family: ipFamily === 6 ? 6 : 4 };
+  const records = await (dns ?? defaultLookup)(host, { all: true });
+  const record = records[0];
+  if (!record)
+    throw new Error("host resolved to no addresses");
+  return { address: record.address, family: record.family === 6 ? 6 : 4 };
+}
 
 class PrivateAddressRefusal extends Error {
   name = "PrivateAddressRefusal";
 }
-async function resolvePublicAddress(url, signal) {
+async function resolvePublicAddress(url, signal, dns) {
   assertHttpUrl(url);
   const host = url.hostname.replace(/^\[|\]$/g, "");
   if (!host)
@@ -169,7 +266,7 @@ async function resolvePublicAddress(url, signal) {
   if (host === "localhost" || host.endsWith(".local") || host.endsWith(".internal")) {
     throw new PrivateAddressRefusal("refusing to fetch an internal host");
   }
-  const pending = lookup(host, { all: true });
+  const pending = (dns ?? defaultLookup)(host, { all: true });
   const records = signal ? await raceAbort(pending, signal) : await pending;
   for (const record of records) {
     if (isPrivateIp(record.address)) {
@@ -202,61 +299,24 @@ async function fetchPinnedDocument(start, options) {
       throw new Error("document URL cannot contain credentials");
     }
     const resolved = await resolvePublicAddress(url, signal);
-    const transport = url.protocol === "https:" ? httpsRequest : httpRequest;
-    const response = await new Promise((resolve, reject) => {
-      const request = transport({
-        protocol: url.protocol,
-        hostname: resolved.address,
-        family: resolved.family,
-        port: url.port || undefined,
-        path: `${url.pathname}${url.search}`,
-        method: "GET",
-        signal,
-        servername: url.hostname,
-        headers: {
-          host: url.host,
-          accept: "application/json",
-          ...options.headers
-        }
-      }, (incoming) => {
-        const headers = new Headers;
-        for (const [name, value] of Object.entries(incoming.headers)) {
-          if (Array.isArray(value)) {
-            for (const item of value)
-              headers.append(name, item);
-          } else if (value !== undefined) {
-            headers.set(name, value);
-          }
-        }
-        const chunks = [];
-        let total = 0;
-        incoming.on("data", (chunk) => {
-          total += chunk.byteLength;
-          if (total > options.maxBytes) {
-            incoming.destroy(new Error("response body exceeds configured byte limit"));
-            return;
-          }
-          chunks.push(chunk);
-        });
-        incoming.once("error", reject);
-        incoming.once("end", () => {
-          const body = new Uint8Array(total);
-          let offset = 0;
-          for (const chunk of chunks) {
-            body.set(chunk, offset);
-            offset += chunk.byteLength;
-          }
-          resolve({ status: incoming.statusCode ?? 0, headers, body, url });
-        });
-      });
-      request.once("error", reject);
-      request.end();
+    const response = await requestPinned(url, resolved, signal, {
+      accept: "application/json",
+      ...options.headers
     });
+    const body = await readCapped(response, options.maxBytes);
+    if (body === null)
+      throw new Error("response body exceeds configured byte limit");
+    const document = {
+      status: response.status,
+      headers: response.headers,
+      body: new Uint8Array(body),
+      url
+    };
     if (response.status < 300 || response.status >= 400)
-      return response;
+      return document;
     const location = response.headers.get("location");
     if (!location)
-      return response;
+      return document;
     url = new URL(location, url);
   }
   throw new Error("too many redirects");

package/dist/{index-7fc0c2np.js → index-n3v695sb.js}

@@ -22,7 +22,7 @@ import {
   createLocalStepDurability2,
   isAgentToolError2,
   createToolDurabilityContext
-} from "./index-56yx8dxp.js";
+} from "./index-tvtacc9a.js";
 import {
   canonicalAgentJson2,
   createToolChronology,