stitchkit 0.118.1 → 0.119.0

package/dist/{index-d9hq291n.js → index-4jpykzvw.js}

@@ -1,6 +1,11 @@
 import {
   resolveRouteParamsSchema
 } from "./index-m38ej7e5.js";
+import {
+  TOOL_TRANSPORTS2,
+  isHttpOnlyEndpoint,
+  assertEndpointExposure
+} from "./index-69t14s4a.js";
 import {
   isUnsafeKey
 } from "./index-zsarb5xp.js";
@@ -11,71 +16,10 @@ import {
   isRecord
 } from "./index-9jfdm5tg.js";
 
-// src/contract/tool-view.ts
-import { z } from "zod";
-var DECLARED_TOOL_VIEW = Symbol.for("stitchkit.toolView");
-function withToolView2(endpoint, view) {
-  const declared = { ...view, [DECLARED_TOOL_VIEW]: true };
-  return { ...endpoint, tool: { ...endpoint.tool, view: declared } };
-}
-function objectKeys(schema) {
-  return schema instanceof z.ZodObject ? new Set(Object.keys(schema.shape)) : new Set;
-}
-function assertToolView(prefix, key, ep) {
-  const where = `Contract "${prefix}": endpoint "${key}" tool.view`;
-  const tool = Reflect.get(ep, "tool");
-  const view = isRecord(tool) ? tool.view : undefined;
-  if (!isRecord(view))
-    throw new Error(`${where} must be an object`);
-  if (Reflect.get(view, DECLARED_TOOL_VIEW) !== true) {
-    throw new Error(`${where} must be declared with withToolView, which types its project`);
-  }
-  if (ep.rawResponse || ep.rawBody || ep.multipart || "responseMeta" in ep || "stream" in ep) {
-    throw new Error(`${where} is only for a JSON tool endpoint — this one is HTTP-only by kind`);
-  }
-  if (!ep.output) {
-    throw new Error(`${where} needs the endpoint's full output — the view is derived from it`);
-  }
-  const output = view.output;
-  const project = view.project;
-  if (output !== undefined && !(output instanceof z.ZodType)) {
-    throw new Error(`${where}.output must be a Zod schema`);
-  }
-  if (project !== undefined && typeof project !== "function") {
-    throw new Error(`${where}.project must be a function`);
-  }
-  const defaults = view.defaults;
-  if (defaults !== undefined && !isRecord(defaults)) {
-    throw new Error(`${where}.defaults must be an object`);
-  }
-  const entries = defaults === undefined ? [] : Object.entries(defaults);
-  if (output === undefined && project === undefined && entries.length === 0) {
-    throw new Error(`${where} declares no defaults, output or project — it would change nothing`);
-  }
-  if (entries.length === 0)
-    return;
-  if (!(ep.input instanceof z.ZodObject)) {
-    throw new Error(`${where}.defaults needs an object input schema to name keys of`);
-  }
-  const inputKeys = objectKeys(ep.input);
-  const paramKeys = objectKeys(ep.params);
-  for (const [name, value] of entries) {
-    if (paramKeys.has(name)) {
-      throw new Error(`${where}.defaults.${name} is a path param — a route segment has no default`);
-    }
-    if (!inputKeys.has(name)) {
-      throw new Error(`${where}.defaults.${name} is not a key of the endpoint's input`);
-    }
-    const field = ep.input.shape[name];
-    if (field === undefined || !z.safeParse(field, value).success) {
-      throw new Error(`${where}.defaults.${name} is not a valid value for that input key`);
-    }
-  }
-}
-
 // src/contract/define-validation.ts
 function assertMultipartEndpoint(prefix, key, ep) {
   const where = `Contract "${prefix}": multipart endpoint "${key}"`;
+  assertNoToolOptions(where, ep);
   if (ep.method !== "POST" && ep.method !== "PUT" && ep.method !== "PATCH") {
     throw new Error(`${where} must use POST, PUT or PATCH`);
   }
@@ -113,10 +57,6 @@ function assertRawEndpoint(prefix, key, ep) {
   if (ep.output)
     throw new Error(`${where} cannot declare an output schema`);
   assertNoToolOptions(where, ep);
-  const nonHttp = (ep.expose ?? []).filter((t) => t !== "HTTP");
-  if (nonHttp.length > 0) {
-    throw new Error(`${where} is HTTP-only — remove ${nonHttp.join(", ")} from expose`);
-  }
 }
 function assertStreamingResponseEndpoint(prefix, key, ep) {
   const where = `Contract "${prefix}": streaming endpoint "${key}"`;
@@ -153,10 +93,6 @@ function assertStreamingResponseEndpoint(prefix, key, ep) {
   if (ep.multipart)
     throw new Error(`${where} cannot be multipart`);
   assertNoToolOptions(where, ep);
-  const nonHttp = (ep.expose ?? []).filter((transport) => transport !== "HTTP");
-  if (nonHttp.length > 0) {
-    throw new Error(`${where} is HTTP-only — remove ${nonHttp.join(", ")} from expose`);
-  }
 }
 var UNGROUPED_TOOL_OPTIONS = {
   toolName: "tool.name",
@@ -214,10 +150,6 @@ function assertRawBodyEndpoint(prefix, key, ep) {
     throw new Error(`${where} must use POST, PUT or PATCH`);
   }
   assertNoToolOptions(where, ep);
-  const nonHttp = (ep.expose ?? []).filter((transport) => transport !== "HTTP");
-  if (nonHttp.length > 0) {
-    throw new Error(`${where} is HTTP-only — remove ${nonHttp.join(", ")} from expose`);
-  }
 }
 function assertSafelistedBodyEndpoint(prefix, key, ep) {
   const where = `Contract "${prefix}": safelistedBody endpoint "${key}"`;
@@ -245,15 +177,71 @@ function assertResponseMetaEndpoint(prefix, key, ep) {
   if (ep.rawResponse)
     throw new Error(`${where} cannot also be a rawResponse endpoint`);
   assertNoToolOptions(where, ep);
-  const nonHttp = (ep.expose ?? []).filter((transport) => transport !== "HTTP");
-  if (nonHttp.length > 0) {
-    throw new Error(`${where} is HTTP-only — remove ${nonHttp.join(", ")} from expose`);
+}
+
+// src/contract/tool-view.ts
+import { z } from "zod";
+var DECLARED_TOOL_VIEW = Symbol.for("stitchkit.toolView");
+function withToolView2(endpoint, view) {
+  const declared = { ...view, [DECLARED_TOOL_VIEW]: true };
+  return { ...endpoint, tool: { ...endpoint.tool, view: declared } };
+}
+function objectKeys(schema) {
+  return schema instanceof z.ZodObject ? new Set(Object.keys(schema.shape)) : new Set;
+}
+function assertToolView(prefix, key, ep) {
+  const where = `Contract "${prefix}": endpoint "${key}" tool.view`;
+  const tool = Reflect.get(ep, "tool");
+  const view = isRecord(tool) ? tool.view : undefined;
+  if (!isRecord(view))
+    throw new Error(`${where} must be an object`);
+  if (Reflect.get(view, DECLARED_TOOL_VIEW) !== true) {
+    throw new Error(`${where} must be declared with withToolView, which types its project`);
+  }
+  if (isHttpOnlyEndpoint(ep)) {
+    throw new Error(`${where} is only for a JSON tool endpoint — this one is HTTP-only by kind`);
+  }
+  if (!ep.output) {
+    throw new Error(`${where} needs the endpoint's full output — the view is derived from it`);
+  }
+  const output = view.output;
+  const project = view.project;
+  if (output !== undefined && !(output instanceof z.ZodType)) {
+    throw new Error(`${where}.output must be a Zod schema`);
+  }
+  if (project !== undefined && typeof project !== "function") {
+    throw new Error(`${where}.project must be a function`);
+  }
+  const defaults = view.defaults;
+  if (defaults !== undefined && !isRecord(defaults)) {
+    throw new Error(`${where}.defaults must be an object`);
+  }
+  const entries = defaults === undefined ? [] : Object.entries(defaults);
+  if (output === undefined && project === undefined && entries.length === 0) {
+    throw new Error(`${where} declares no defaults, output or project — it would change nothing`);
+  }
+  if (entries.length === 0)
+    return;
+  if (!(ep.input instanceof z.ZodObject)) {
+    throw new Error(`${where}.defaults needs an object input schema to name keys of`);
+  }
+  const inputKeys = objectKeys(ep.input);
+  const paramKeys = objectKeys(ep.params);
+  for (const [name, value] of entries) {
+    if (paramKeys.has(name)) {
+      throw new Error(`${where}.defaults.${name} is a path param — a route segment has no default`);
+    }
+    if (!inputKeys.has(name)) {
+      throw new Error(`${where}.defaults.${name} is not a key of the endpoint's input`);
+    }
+    const field = ep.input.shape[name];
+    if (field === undefined || !z.safeParse(field, value).success) {
+      throw new Error(`${where}.defaults.${name} is not a valid value for that input key`);
+    }
   }
 }
 
 // src/contract/define.ts
-var ALL_TRANSPORTS2 = ["HTTP", "MCP", "AGENT", "CLI"];
-var TOOL_TRANSPORTS2 = ["MCP", "AGENT", "CLI"];
 function defineContract2(meta, endpoints) {
   const materializedEndpoints = {};
   for (const [key, endpoint] of Object.entries(endpoints)) {
@@ -262,6 +250,7 @@ function defineContract2(meta, endpoints) {
   }
   const toolTransports = new Map;
   for (const [key, ep] of Object.entries(materializedEndpoints)) {
+    assertEndpointExposure(meta.prefix, key, ep);
     if (ep.desc.trim() === "") {
       throw new Error(`Contract "${meta.prefix}": endpoint "${key}" has an empty desc`);
     }
@@ -289,7 +278,7 @@ function defineContract2(meta, endpoints) {
     }
     const transports = new Set(ep.expose ? ep.expose.filter((t) => t !== "HTTP") : ["MCP", "AGENT"]);
     if (transports.size === 0) {
-      throw new Error(`Contract "${meta.prefix}": endpoint "${key}" sets tool options but is not exposed on any tool transport (${TOOL_TRANSPORTS2.join(" / ")}) — a contract factory with toolExposure 'explicit' makes an omitted expose HTTP-only`);
+      throw new Error(`Contract "${meta.prefix}": endpoint "${key}" sets tool options but is not exposed on any tool transport (${TOOL_TRANSPORTS2.join(" / ")}) — add a tool transport to expose or the factory default`);
     }
     if (tool.view !== undefined)
       assertToolView(meta.prefix, key, ep);
@@ -310,4 +299,4 @@ function defineContract2(meta, endpoints) {
   return { meta, endpoints: materializedEndpoints };
 }
 
-export { withToolView2, ALL_TRANSPORTS2, TOOL_TRANSPORTS2, defineContract2 };
+export { withToolView2, defineContract2 };

package/dist/{index-ghtpfz4z.js → index-57gqaq8b.js}

@@ -8,7 +8,7 @@ import {
   AgentSeedReceiptSchema2,
   AgentHistoryMutationSchema2,
   isActiveRunState
-} from "./index-xx1j310k.js";
+} from "./index-8yxgcyt6.js";
 import {
   AgentRecordIdSchema2,
   AgentMessageSchema2
@@ -17,7 +17,7 @@ import {
   replaceMessage,
   ArchiveSpillSchema,
   createAgentRuntimeStore2
-} from "./index-cycp3r3e.js";
+} from "./index-rxcgp4b9.js";
 
 // src/agent-runtime/store-memory.ts
 import { z as z2 } from "zod";

package/dist/index-69t14s4a.js

@@ -0,0 +1,39 @@
+// src/contract/endpoint-capabilities.ts
+import { z } from "zod";
+
+// src/contract/transports.ts
+var ALL_TRANSPORTS2 = ["HTTP", "MCP", "AGENT", "CLI"];
+var TOOL_TRANSPORTS2 = ["MCP", "AGENT", "CLI"];
+
+// src/contract/endpoint-capabilities.ts
+var HTTP_ONLY_FEATURES = [
+  "rawResponse",
+  "rawBody",
+  "responseMeta",
+  "multipart",
+  "stream"
+];
+var HTTP_ONLY_EXPOSURE = Object.freeze(["HTTP"]);
+var ExposureSchema = z.array(z.enum(ALL_TRANSPORTS2)).refine((transports) => new Set(transports).size === transports.length, {
+  message: "Each transport appears at most once"
+}).readonly();
+function isHttpOnlyEndpoint(endpoint) {
+  return endpoint.method === "HEAD" || HTTP_ONLY_FEATURES.some((feature) => Boolean(endpoint[feature]));
+}
+function assertEndpointExposure(prefix, key, endpoint) {
+  if (endpoint.expose === undefined)
+    return;
+  const exposure = ExposureSchema.safeParse(endpoint.expose);
+  const where = `Contract "${prefix}": endpoint "${key}"`;
+  if (!exposure.success) {
+    throw new Error(`${where} expose must be an array of distinct transports: ${ALL_TRANSPORTS2.join(" / ")}`);
+  }
+  if (isHttpOnlyEndpoint(endpoint)) {
+    const unsupported = exposure.data.filter((transport) => transport !== "HTTP");
+    if (unsupported.length > 0) {
+      throw new Error(`${where} is HTTP-only — remove ${unsupported.join(", ")} from expose`);
+    }
+  }
+}
+
+export { ALL_TRANSPORTS2, TOOL_TRANSPORTS2, HTTP_ONLY_EXPOSURE, ExposureSchema, isHttpOnlyEndpoint, assertEndpointExposure };

package/dist/{index-6p3frkv5.js → index-6a69xzrx.js}

@@ -2,21 +2,21 @@ import {
   toolResultFromError,
   toolCauseFromResult,
   isToolExecutionControlError2
-} from "./index-v6vb5qx8.js";
+} from "./index-s3yxw6kt.js";
 import {
   createToolRunner,
   formatToolError
-} from "./index-htxh46ej.js";
+} from "./index-ycqhyars.js";
 import {
   AgentToolError2,
   resolveToolDurability
 } from "./index-tvtacc9a.js";
 import {
   collectToolSurface
-} from "./index-86nbfysb.js";
+} from "./index-ff39f9dr.js";
 import {
   agentPresenterOf
-} from "./index-ega3yz4c.js";
+} from "./index-aqwg2dm5.js";
 import {
   isRecord
 } from "./index-9jfdm5tg.js";

package/dist/{index-dky0dcmf.js → index-72r9k0av.js}

@@ -2,6 +2,12 @@ import {
   isRecord
 } from "./index-9jfdm5tg.js";
 
+// src/application/diagnostic-journal-contract.ts
+import { z as z3 } from "zod";
+
+// src/application/diagnostic-journal-read-contract.ts
+import { z as z2 } from "zod";
+
 // src/application/diagnostic-journal-frame.ts
 import { z } from "zod";
 var DiagnosticJournalFrameSchema2 = z.object({
@@ -12,7 +18,6 @@ var DiagnosticJournalFrameSchema2 = z.object({
 }).strict().readonly();
 
 // src/application/diagnostic-journal-read-contract.ts
-import { z as z2 } from "zod";
 var ByteCountSchema = z2.number().int().nonnegative();
 var LocationSchema = z2.object({
   file: z2.string(),
@@ -88,7 +93,6 @@ class DiagnosticJournalRecoveryError2 extends Error {
 }
 
 // src/application/diagnostic-journal-contract.ts
-import { z as z3 } from "zod";
 var PositiveSafeIntegerSchema = z3.number().int().positive();
 var FileModeSchema = z3.number().int().min(0).max(511);
 var DiagnosticJournalLimitsSchema2 = z3.object({

package/dist/{index-vv1sch8a.js → index-8vzh5wpv.js}

@@ -1,10 +1,3 @@
-// src/tracking/beacon.ts
-function sendUnloadBeacon2(url, body, sender = typeof navigator === "undefined" ? undefined : navigator) {
-  if (!sender || typeof sender.sendBeacon !== "function")
-    return false;
-  return sender.sendBeacon(url, body);
-}
-
 // src/tracking/privacy.ts
 var MASK = "[masked]";
 var MAX_REDACTED_CHARS = 16384;
@@ -77,6 +70,11 @@ function redactTrackingText2(input) {
     }
   }).replace(ASSIGNMENT, (whole, prefix, key, assignment) => isSecretField(key.replace(/^["']|["']$/g, "")) ? `${prefix}${key}${assignment}${MASK}` : whole);
 }
+function maskTrackingParameters(input, names) {
+  if (names.size === 0)
+    return input;
+  return input.replace(PARAMETER, (whole, separator, key) => names.has(decodeKey(key)) ? `${separator}${key}=${MASK}` : whole);
+}
 function redactTrackingValue2(value) {
   if (typeof value === "string")
     return redactTrackingText2(value);
@@ -91,4 +89,11 @@ function redactTrackingValue2(value) {
   return value;
 }
 
-export { sendUnloadBeacon2, redactTrackingText2, redactTrackingValue2 };
+// src/tracking/beacon.ts
+function sendUnloadBeacon2(url, body, sender = typeof navigator === "undefined" ? undefined : navigator) {
+  if (!sender || typeof sender.sendBeacon !== "function")
+    return false;
+  return sender.sendBeacon(url, body);
+}
+
+export { redactTrackingText2, maskTrackingParameters, redactTrackingValue2, sendUnloadBeacon2 };