stitchkit 0.118.1 → 0.120.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (180) hide show
  1. package/CHANGELOG.md +92 -0
  2. package/README.md +10 -7
  3. package/dist/browser/http.d.ts.map +1 -1
  4. package/dist/contract/client-types.d.ts +6 -3
  5. package/dist/contract/client-types.d.ts.map +1 -1
  6. package/dist/contract/define-validation.d.ts.map +1 -1
  7. package/dist/contract/define.d.ts +18 -12
  8. package/dist/contract/define.d.ts.map +1 -1
  9. package/dist/contract/endpoint-capabilities.d.ts +28 -0
  10. package/dist/contract/endpoint-capabilities.d.ts.map +1 -0
  11. package/dist/contract/factory.d.ts +49 -19
  12. package/dist/contract/factory.d.ts.map +1 -1
  13. package/dist/contract/tool-view.d.ts +1 -1
  14. package/dist/contract/tool-view.d.ts.map +1 -1
  15. package/dist/contract/transports.d.ts +5 -0
  16. package/dist/contract/transports.d.ts.map +1 -0
  17. package/dist/entrypoints/agent-runtime/coding-tools.js +9 -8
  18. package/dist/entrypoints/agent-runtime/harness.js +9 -8
  19. package/dist/entrypoints/agent-runtime/realtime.js +3 -3
  20. package/dist/entrypoints/agent-runtime/sandbox.js +10 -9
  21. package/dist/entrypoints/agent-runtime/sqlite/bun.js +12 -11
  22. package/dist/entrypoints/agent-runtime/sqlite/node.js +12 -11
  23. package/dist/entrypoints/agent-runtime/testing.js +12 -11
  24. package/dist/entrypoints/agent-runtime.js +22 -19
  25. package/dist/entrypoints/application/diagnostic-journal.js +3 -3
  26. package/dist/entrypoints/application/directory-inbox.js +4 -4
  27. package/dist/entrypoints/application/opentelemetry.js +1 -1
  28. package/dist/entrypoints/application.js +10 -10
  29. package/dist/entrypoints/cli/publish.js +4 -4
  30. package/dist/entrypoints/cli.js +13 -12
  31. package/dist/entrypoints/contract.d.ts +1 -1
  32. package/dist/entrypoints/contract.d.ts.map +1 -1
  33. package/dist/entrypoints/contract.js +6 -4
  34. package/dist/entrypoints/files.js +3 -3
  35. package/dist/entrypoints/geo/contract.d.ts +7 -0
  36. package/dist/entrypoints/geo/contract.d.ts.map +1 -0
  37. package/dist/entrypoints/geo/contract.js +6 -0
  38. package/dist/entrypoints/geo.js +60 -23
  39. package/dist/entrypoints/http.js +3 -3
  40. package/dist/entrypoints/index.js +9 -7
  41. package/dist/entrypoints/live.js +1 -1
  42. package/dist/entrypoints/node.js +7 -6
  43. package/dist/entrypoints/primitives.js +1 -1
  44. package/dist/entrypoints/process/owner-loss.js +1 -1
  45. package/dist/entrypoints/process.js +3 -3
  46. package/dist/entrypoints/react.js +1 -1
  47. package/dist/entrypoints/remote.js +4 -3
  48. package/dist/entrypoints/server.js +16 -15
  49. package/dist/entrypoints/telegram/screens.js +5 -5
  50. package/dist/entrypoints/telegram.js +7 -7
  51. package/dist/entrypoints/testing.js +7 -6
  52. package/dist/entrypoints/tools/agent.d.ts +9 -0
  53. package/dist/entrypoints/tools/agent.d.ts.map +1 -0
  54. package/dist/entrypoints/tools/agent.js +16 -0
  55. package/dist/entrypoints/tools/connections.js +7 -6
  56. package/dist/entrypoints/tools/contract.js +1 -1
  57. package/dist/entrypoints/tools/invoker.js +5 -4
  58. package/dist/entrypoints/tools/mcp.js +110 -9
  59. package/dist/entrypoints/tools/toolkit.d.ts +9 -0
  60. package/dist/entrypoints/tools/toolkit.d.ts.map +1 -0
  61. package/dist/entrypoints/tools/toolkit.js +40 -0
  62. package/dist/entrypoints/tools.d.ts +0 -10
  63. package/dist/entrypoints/tools.d.ts.map +1 -1
  64. package/dist/entrypoints/tools.js +38 -80
  65. package/dist/entrypoints/tracking/contract.js +5 -3
  66. package/dist/entrypoints/tracking/performance.js +3 -3
  67. package/dist/entrypoints/tracking.d.ts +1 -1
  68. package/dist/entrypoints/tracking.d.ts.map +1 -1
  69. package/dist/entrypoints/tracking.js +63 -83
  70. package/dist/entrypoints/xlsx.js +1 -1
  71. package/dist/geo/index.d.ts +2 -1
  72. package/dist/geo/index.d.ts.map +1 -1
  73. package/dist/geo/record.d.ts +8 -0
  74. package/dist/geo/record.d.ts.map +1 -0
  75. package/dist/geo/resolver.d.ts +1 -3
  76. package/dist/geo/resolver.d.ts.map +1 -1
  77. package/dist/geo/schema.d.ts +44 -0
  78. package/dist/geo/schema.d.ts.map +1 -0
  79. package/dist/geo/types.d.ts +2 -13
  80. package/dist/geo/types.d.ts.map +1 -1
  81. package/dist/{index-n5sv4z0w.js → index-0qyrcjfs.js} +16 -18
  82. package/dist/index-1psbyyhj.js +21 -0
  83. package/dist/{index-tsngj2b5.js → index-2fc1k9k2.js} +206 -206
  84. package/dist/index-3prvb42w.js +30 -0
  85. package/dist/{index-073nw9qr.js → index-3yb5kft5.js} +524 -522
  86. package/dist/{index-d9hq291n.js → index-4jpykzvw.js} +70 -81
  87. package/dist/index-568w258r.js +76 -0
  88. package/dist/index-69t14s4a.js +39 -0
  89. package/dist/{index-dky0dcmf.js → index-72r9k0av.js} +6 -2
  90. package/dist/{index-6p3frkv5.js → index-7zwtbak8.js} +9 -50
  91. package/dist/{index-90p34rts.js → index-8ryydawp.js} +7 -5
  92. package/dist/{index-vv1sch8a.js → index-8vzh5wpv.js} +13 -8
  93. package/dist/{index-75ns2ybj.js → index-8xyf8h2k.js} +1 -1
  94. package/dist/{index-xx1j310k.js → index-8yxgcyt6.js} +171 -169
  95. package/dist/{index-p6apg0jg.js → index-9frf01t9.js} +16 -9
  96. package/dist/{index-q0th8q0z.js → index-9mjrnqxs.js} +1 -3
  97. package/dist/{index-6f49krb5.js → index-aa50qwv4.js} +1 -1
  98. package/dist/{index-ega3yz4c.js → index-aqwg2dm5.js} +1 -1
  99. package/dist/{index-p0rf7sq9.js → index-bgcwxhxh.js} +225 -223
  100. package/dist/index-bph35vpy.js +77 -0
  101. package/dist/{index-tdpmfks8.js → index-bz479f0x.js} +1 -1
  102. package/dist/index-d3xdyjt6.js +38 -0
  103. package/dist/{index-q968hy6y.js → index-e452syyh.js} +1 -1
  104. package/dist/{index-86nbfysb.js → index-ff39f9dr.js} +3 -3
  105. package/dist/index-h1j71dr1.js +48 -0
  106. package/dist/{index-mgb7r8b8.js → index-jswst0h3.js} +1 -1
  107. package/dist/{index-095ya5hm.js → index-knmnj11j.js} +22 -191
  108. package/dist/{index-vwhrnp67.js → index-kz9734jc.js} +3 -3
  109. package/dist/{index-txg1npmg.js → index-mtwh9hyp.js} +1 -1
  110. package/dist/{index-dr3t5n1v.js → index-nn9qvkww.js} +46 -46
  111. package/dist/{index-ghtpfz4z.js → index-nyyam9ce.js} +2 -2
  112. package/dist/{index-qezhmp51.js → index-nz06qw5a.js} +3 -1
  113. package/dist/{index-1bx1xv1k.js → index-pfvde2fz.js} +5 -2
  114. package/dist/{index-w7jq3fz9.js → index-pq2m7t46.js} +1142 -1212
  115. package/dist/{index-yk4g8805.js → index-pq7rkwkk.js} +1 -30
  116. package/dist/{index-s80awwsw.js → index-qch1vcaa.js} +3 -1
  117. package/dist/{index-hdjmdwsj.js → index-qctbzmg9.js} +521 -511
  118. package/dist/{index-n8z3rvzw.js → index-qevqn3d3.js} +3 -5
  119. package/dist/{index-nqxrm176.js → index-r3db01kh.js} +1 -1
  120. package/dist/{index-v6vb5qx8.js → index-s3yxw6kt.js} +1 -1
  121. package/dist/{index-cqmqyjax.js → index-sa99p98w.js} +1 -1
  122. package/dist/index-sb9dr3tq.js +14 -0
  123. package/dist/{index-0gxvns6s.js → index-sba3e6m4.js} +1 -0
  124. package/dist/{index-f24bdt13.js → index-v1swr26p.js} +3 -1
  125. package/dist/{index-rhzkndr5.js → index-x4p3kw1p.js} +533 -530
  126. package/dist/{index-cycp3r3e.js → index-yb9n4pgj.js} +2 -2
  127. package/dist/{index-htxh46ej.js → index-ycqhyars.js} +2 -2
  128. package/dist/{index-9bwcthxw.js → index-yj6saztf.js} +31 -13
  129. package/dist/{index-f6m4c545.js → index-zrdcmg6j.js} +4 -6
  130. package/dist/{index-tvtacc9a.js → index-zyc64nbh.js} +1 -34
  131. package/dist/process/bun-child.d.ts +3 -2
  132. package/dist/process/bun-child.d.ts.map +1 -1
  133. package/dist/server/contract-method.d.ts.map +1 -1
  134. package/dist/tools/internal/surface-projector.d.ts.map +1 -1
  135. package/dist/tools/operations/async-operation-canonical-types.d.ts +1 -1
  136. package/dist/tracking/attribution.d.ts +21 -25
  137. package/dist/tracking/attribution.d.ts.map +1 -1
  138. package/dist/tracking/client-visit.d.ts +5 -7
  139. package/dist/tracking/client-visit.d.ts.map +1 -1
  140. package/dist/tracking/client.d.ts +2 -2
  141. package/dist/tracking/client.d.ts.map +1 -1
  142. package/dist/tracking/contract.d.ts +1 -1
  143. package/dist/tracking/host.d.ts +0 -1
  144. package/dist/tracking/host.d.ts.map +1 -1
  145. package/dist/tracking/privacy.d.ts +6 -0
  146. package/dist/tracking/privacy.d.ts.map +1 -1
  147. package/dist/tracking/schemas.d.ts +2 -2
  148. package/dist/tracking/schemas.d.ts.map +1 -1
  149. package/llms/agent-runtime-harness.txt +4 -3
  150. package/llms/agent-runtime-sandbox.txt +1 -1
  151. package/llms/agent-runtime.2.txt +3 -2
  152. package/llms/agent-runtime.3.txt +4 -46
  153. package/llms/agent-runtime.4.txt +113 -0
  154. package/llms/agent-runtime.txt +11 -13
  155. package/llms/cli.txt +1 -1
  156. package/llms/contract.txt +46 -24
  157. package/llms/geo-contract.txt +23 -0
  158. package/llms/geo.txt +40 -4
  159. package/llms/stitchkit.txt +16 -9
  160. package/llms/testing.txt +4 -6
  161. package/llms/tools-agent.txt +24 -0
  162. package/llms/tools-mcp.txt +71 -6
  163. package/llms/tools-toolkit.txt +23 -0
  164. package/llms/tools.2.txt +8 -5
  165. package/llms/tools.3.txt +9 -78
  166. package/llms/tools.txt +8 -8
  167. package/llms/tracking-contract.txt +1 -1
  168. package/llms/tracking.txt +27 -5
  169. package/llms/{upgrading-0.105.0-0.118.0.txt → upgrading-0.106.0-0.120.0.txt} +152 -410
  170. package/llms/upgrading-0.37.0-0.53.0.txt +969 -0
  171. package/llms/{upgrading-0.44.0-0.62.0.txt → upgrading-0.55.0-0.68.0.txt} +509 -528
  172. package/llms/{upgrading-0.63.0-0.83.0.txt → upgrading-0.69.0-0.95.0.txt} +506 -509
  173. package/llms/{upgrading-0.84.0-0.104.0.txt → upgrading-0.96.0-0.105.0.txt} +410 -506
  174. package/llms/upgrading.txt +5 -5
  175. package/llms-full.txt +475 -154
  176. package/llms.txt +17 -14
  177. package/package.json +32 -20
  178. package/llms/upgrading-0.37.0-0.44.0.txt +0 -444
  179. package/dist/{index-arjmb6de.js → index-1jwsfkfz.js} +0 -0
  180. package/dist/{index-qndsr7f0.js → index-5efrpfmj.js} +3 -3
@@ -16,28 +16,30 @@ import {
16
16
  ownHttpStream,
17
17
  settleStreamCleanup,
18
18
  ShutdownOptionsSchema2
19
- } from "./index-q0th8q0z.js";
19
+ } from "./index-9mjrnqxs.js";
20
20
  import {
21
21
  RELEASE_HEADER2
22
22
  } from "./index-n15jny5b.js";
23
+ import {
24
+ DEFAULT_PROCESS_SIGNALS,
25
+ defaultSignalSource,
26
+ reportSignalError,
27
+ guardSignalCallback
28
+ } from "./index-3prvb42w.js";
23
29
  import {
24
30
  isModuleNotFound
25
31
  } from "./index-srs8hj9c.js";
26
32
  import {
27
33
  bindContract,
28
34
  mediaTypeEssence
29
- } from "./index-cqmqyjax.js";
35
+ } from "./index-sa99p98w.js";
30
36
  import {
31
37
  assertCorsConfig,
32
38
  isOriginAllowed,
33
39
  corsPreflightResponse2,
34
40
  requestCorsHeaders,
35
- applyCors,
36
- DEFAULT_PROCESS_SIGNALS,
37
- defaultSignalSource,
38
- reportSignalError,
39
- guardSignalCallback
40
- } from "./index-yk4g8805.js";
41
+ applyCors
42
+ } from "./index-pq7rkwkk.js";
41
43
  import {
42
44
  runWithRequestContext2,
43
45
  getRequestContext2,
@@ -51,22 +53,22 @@ import {
51
53
  getClientInfo2,
52
54
  parseQueryParams
53
55
  } from "./index-kw1ws0cs.js";
56
+ import {
57
+ isUnsafeKey,
58
+ safeJsonParse
59
+ } from "./index-zsarb5xp.js";
54
60
  import {
55
61
  readBoundedChunks,
56
62
  concatChunks,
57
63
  readBoundedBody2
58
- } from "./index-qndsr7f0.js";
64
+ } from "./index-5efrpfmj.js";
65
+ import {
66
+ assertPositiveSafeInteger
67
+ } from "./index-0s4xebbg.js";
59
68
  import {
60
69
  abortReason,
61
70
  untilAborted
62
71
  } from "./index-a5qr2rj6.js";
63
- import {
64
- isUnsafeKey,
65
- safeJsonParse
66
- } from "./index-zsarb5xp.js";
67
- import {
68
- assertPositiveSafeInteger
69
- } from "./index-0s4xebbg.js";
70
72
  import {
71
73
  AppError2,
72
74
  badRequest2,
@@ -80,6 +82,101 @@ import {
80
82
  transportResult
81
83
  } from "./index-9jfdm5tg.js";
82
84
 
85
+ // src/server/context-contribution.ts
86
+ var RUNTIME_CONTEXT_RESERVED_KEYS = new Set([
87
+ "params",
88
+ "input",
89
+ "files",
90
+ "rawBody",
91
+ "source",
92
+ "req",
93
+ "url",
94
+ "headers",
95
+ "traceId",
96
+ "spanId",
97
+ "ipAddress",
98
+ "userAgent",
99
+ "signal",
100
+ "mcp",
101
+ "reportProgress"
102
+ ]);
103
+ function contributionError(scope, reason) {
104
+ return new TypeError(`[stitchkit] auth: invalid context contribution for scope ${JSON.stringify(scope)}: ${reason}`);
105
+ }
106
+ function descriptorsEqual(left, right) {
107
+ if (!left || !right)
108
+ return left === right;
109
+ if (left.enumerable !== right.enumerable || left.configurable !== right.configurable || left.writable !== right.writable) {
110
+ return false;
111
+ }
112
+ if ("value" in left || "value" in right) {
113
+ return "value" in left && "value" in right && Object.is(left.value, right.value);
114
+ }
115
+ return left.get === right.get && left.set === right.set;
116
+ }
117
+ function contextContributionDelta(original, shadow, scope) {
118
+ if (Object.getPrototypeOf(shadow) !== Object.getPrototypeOf(original)) {
119
+ throw contributionError(scope, "context prototype changes are not supported");
120
+ }
121
+ const originalKeys = Reflect.ownKeys(original);
122
+ const shadowKeys = Reflect.ownKeys(shadow);
123
+ const shadowKeySet = new Set(shadowKeys);
124
+ for (const key of originalKeys) {
125
+ if (!shadowKeySet.has(key)) {
126
+ const printable = typeof key === "string" ? JSON.stringify(key) : "a symbol key";
127
+ throw contributionError(scope, `context key ${printable} may not be deleted`);
128
+ }
129
+ }
130
+ const contribution = Object.create(null);
131
+ for (const key of shadowKeys) {
132
+ const originalDescriptor = Object.getOwnPropertyDescriptor(original, key);
133
+ const shadowDescriptor = Object.getOwnPropertyDescriptor(shadow, key);
134
+ if (!shadowDescriptor || descriptorsEqual(originalDescriptor, shadowDescriptor))
135
+ continue;
136
+ Object.defineProperty(contribution, key, shadowDescriptor);
137
+ }
138
+ return contribution;
139
+ }
140
+ function prepareContextContribution(value, scope) {
141
+ if (typeof value !== "object" || value === null || Array.isArray(value)) {
142
+ throw contributionError(scope, "expected a plain record");
143
+ }
144
+ let prototype;
145
+ let descriptors;
146
+ let keys;
147
+ try {
148
+ prototype = Object.getPrototypeOf(value);
149
+ descriptors = Object.getOwnPropertyDescriptors(value);
150
+ keys = Reflect.ownKeys(value);
151
+ } catch {
152
+ throw contributionError(scope, "record inspection failed");
153
+ }
154
+ if (prototype !== Object.prototype && prototype !== null) {
155
+ throw contributionError(scope, "expected Object.prototype or null prototype");
156
+ }
157
+ const prepared = Object.create(null);
158
+ for (const key of keys) {
159
+ if (typeof key !== "string") {
160
+ throw contributionError(scope, "symbol keys are not supported");
161
+ }
162
+ if (isUnsafeKey(key)) {
163
+ throw contributionError(scope, `unsafe key ${JSON.stringify(key)}`);
164
+ }
165
+ if (RUNTIME_CONTEXT_RESERVED_KEYS.has(key)) {
166
+ throw contributionError(scope, `reserved key ${JSON.stringify(key)}`);
167
+ }
168
+ const descriptor = descriptors[key];
169
+ if (!descriptor?.enumerable || !("value" in descriptor)) {
170
+ throw contributionError(scope, `key ${JSON.stringify(key)} must be enumerable data`);
171
+ }
172
+ prepared[key] = descriptor.value;
173
+ }
174
+ return prepared;
175
+ }
176
+ function mergeContextContribution(ctx, value, scope) {
177
+ Object.assign(ctx, prepareContextContribution(value, scope));
178
+ }
179
+
83
180
  // src/server/multipart-reader.ts
84
181
  var DEFAULT_MAX_HEADER_BYTES = 64 * 1024;
85
182
  var CRLF = new Uint8Array([13, 10]);
@@ -552,6 +649,110 @@ async function parseMultipart2(req, descriptor, fieldsSchema, receivers) {
552
649
  }
553
650
  }
554
651
 
652
+ // src/server/request-body.ts
653
+ async function readRequestText(req, maxBytes) {
654
+ if (req.signal.aborted)
655
+ throw abortReason(req.signal);
656
+ if (maxBytes === undefined)
657
+ return req.text();
658
+ assertPositiveSafeInteger("maxJsonBodyBytes", maxBytes, Error);
659
+ const result = await readBoundedChunks(req.body, { maxBytes, signal: req.signal });
660
+ if (result.kind === "over-limit")
661
+ badRequest2(`JSON body exceeds the ${maxBytes}-byte limit`);
662
+ return new TextDecoder().decode(concatChunks(result.chunks, result.total));
663
+ }
664
+
665
+ // src/server/context.ts
666
+ function parseJsonBody(req, text, method, cors) {
667
+ if (text.trim() === "")
668
+ return {};
669
+ const essence = mediaTypeEssence(req.headers.get("content-type"));
670
+ if (essence !== "application/json") {
671
+ if (!method.safelistedBody || essence !== "text/plain") {
672
+ badRequest2("Request body must be application/json");
673
+ }
674
+ const origin = req.headers.get("origin");
675
+ if (!cors || cors.origin === undefined || cors.origin === "*") {
676
+ forbidden2("A text/plain body requires an explicit cors.origin allow-list on the server");
677
+ }
678
+ if (!origin)
679
+ forbidden2("A text/plain body requires an Origin header");
680
+ if (!isOriginAllowed(cors, origin)) {
681
+ forbidden2("A text/plain body is accepted only from an allowed origin");
682
+ }
683
+ }
684
+ try {
685
+ return safeJsonParse(text);
686
+ } catch {
687
+ badRequest2("Invalid JSON body");
688
+ }
689
+ }
690
+ function buildBaseContext(req, url, pathParams, traceId, clientIp) {
691
+ const safePathParams = {};
692
+ for (const [k, v] of Object.entries(pathParams)) {
693
+ if (!RUNTIME_CONTEXT_RESERVED_KEYS.has(k) && !isUnsafeKey(k))
694
+ safePathParams[k] = v;
695
+ }
696
+ return {
697
+ params: pathParams,
698
+ input: undefined,
699
+ source: "http",
700
+ req,
701
+ url,
702
+ headers: req.headers,
703
+ signal: req.signal,
704
+ ...safePathParams,
705
+ traceId,
706
+ ...getClientInfo2(req, clientIp)
707
+ };
708
+ }
709
+ function parsePathParamsInto(ctx, method) {
710
+ if (method.paramsSchema) {
711
+ ctx.params = method.paramsSchema.parse(ctx.params);
712
+ }
713
+ }
714
+ async function parseRequestPayloadInto(ctx, req, url, method, maxJsonBodyBytes, cors) {
715
+ if (method.multipart) {
716
+ const multipart = await parseMultipart2(req, method.multipart, method.inputSchema, method.multipartReceivers);
717
+ ctx.input = multipart.fields;
718
+ ctx.files = multipart.files;
719
+ return multipart;
720
+ }
721
+ if (method.inputSchema) {
722
+ if (req.method === "GET") {
723
+ ctx.input = method.inputSchema.parse(parseQueryParams(url));
724
+ } else if (req.method === "DELETE") {
725
+ if (mediaTypeEssence(req.headers.get("content-type")) === "application/json") {
726
+ const text = await readRequestText(req, method.maxJsonBodyBytes ?? maxJsonBodyBytes);
727
+ if (method.rawBody)
728
+ ctx.rawBody = text;
729
+ ctx.input = method.inputSchema.parse(parseJsonBody(req, text, method, cors));
730
+ } else {
731
+ ctx.input = method.inputSchema.parse(parseQueryParams(url));
732
+ }
733
+ } else {
734
+ const text = await readRequestText(req, method.maxJsonBodyBytes ?? maxJsonBodyBytes);
735
+ if (method.rawBody)
736
+ ctx.rawBody = text;
737
+ ctx.input = method.inputSchema.parse(parseJsonBody(req, text, method, cors));
738
+ }
739
+ }
740
+ return;
741
+ }
742
+ function buildErrorContext(req, url, traceId, clientIp) {
743
+ return {
744
+ params: undefined,
745
+ input: undefined,
746
+ source: "http",
747
+ req,
748
+ url,
749
+ headers: req.headers,
750
+ signal: req.signal,
751
+ traceId,
752
+ ...getClientInfo2(req, clientIp)
753
+ };
754
+ }
755
+
555
756
  // src/server/streaming-pump.ts
556
757
  async function pumpFrames(p) {
557
758
  let sinceYield = 0;
@@ -792,205 +993,6 @@ function sseRoute2(options) {
792
993
  return streamingRoute2({ ...options, format: "sse" });
793
994
  }
794
995
 
795
- // src/server/context-contribution.ts
796
- var RUNTIME_CONTEXT_RESERVED_KEYS = new Set([
797
- "params",
798
- "input",
799
- "files",
800
- "rawBody",
801
- "source",
802
- "req",
803
- "url",
804
- "headers",
805
- "traceId",
806
- "spanId",
807
- "ipAddress",
808
- "userAgent",
809
- "signal",
810
- "mcp",
811
- "reportProgress"
812
- ]);
813
- function contributionError(scope, reason) {
814
- return new TypeError(`[stitchkit] auth: invalid context contribution for scope ${JSON.stringify(scope)}: ${reason}`);
815
- }
816
- function descriptorsEqual(left, right) {
817
- if (!left || !right)
818
- return left === right;
819
- if (left.enumerable !== right.enumerable || left.configurable !== right.configurable || left.writable !== right.writable) {
820
- return false;
821
- }
822
- if ("value" in left || "value" in right) {
823
- return "value" in left && "value" in right && Object.is(left.value, right.value);
824
- }
825
- return left.get === right.get && left.set === right.set;
826
- }
827
- function contextContributionDelta(original, shadow, scope) {
828
- if (Object.getPrototypeOf(shadow) !== Object.getPrototypeOf(original)) {
829
- throw contributionError(scope, "context prototype changes are not supported");
830
- }
831
- const originalKeys = Reflect.ownKeys(original);
832
- const shadowKeys = Reflect.ownKeys(shadow);
833
- const shadowKeySet = new Set(shadowKeys);
834
- for (const key of originalKeys) {
835
- if (!shadowKeySet.has(key)) {
836
- const printable = typeof key === "string" ? JSON.stringify(key) : "a symbol key";
837
- throw contributionError(scope, `context key ${printable} may not be deleted`);
838
- }
839
- }
840
- const contribution = Object.create(null);
841
- for (const key of shadowKeys) {
842
- const originalDescriptor = Object.getOwnPropertyDescriptor(original, key);
843
- const shadowDescriptor = Object.getOwnPropertyDescriptor(shadow, key);
844
- if (!shadowDescriptor || descriptorsEqual(originalDescriptor, shadowDescriptor))
845
- continue;
846
- Object.defineProperty(contribution, key, shadowDescriptor);
847
- }
848
- return contribution;
849
- }
850
- function prepareContextContribution(value, scope) {
851
- if (typeof value !== "object" || value === null || Array.isArray(value)) {
852
- throw contributionError(scope, "expected a plain record");
853
- }
854
- let prototype;
855
- let descriptors;
856
- let keys;
857
- try {
858
- prototype = Object.getPrototypeOf(value);
859
- descriptors = Object.getOwnPropertyDescriptors(value);
860
- keys = Reflect.ownKeys(value);
861
- } catch {
862
- throw contributionError(scope, "record inspection failed");
863
- }
864
- if (prototype !== Object.prototype && prototype !== null) {
865
- throw contributionError(scope, "expected Object.prototype or null prototype");
866
- }
867
- const prepared = Object.create(null);
868
- for (const key of keys) {
869
- if (typeof key !== "string") {
870
- throw contributionError(scope, "symbol keys are not supported");
871
- }
872
- if (isUnsafeKey(key)) {
873
- throw contributionError(scope, `unsafe key ${JSON.stringify(key)}`);
874
- }
875
- if (RUNTIME_CONTEXT_RESERVED_KEYS.has(key)) {
876
- throw contributionError(scope, `reserved key ${JSON.stringify(key)}`);
877
- }
878
- const descriptor = descriptors[key];
879
- if (!descriptor?.enumerable || !("value" in descriptor)) {
880
- throw contributionError(scope, `key ${JSON.stringify(key)} must be enumerable data`);
881
- }
882
- prepared[key] = descriptor.value;
883
- }
884
- return prepared;
885
- }
886
- function mergeContextContribution(ctx, value, scope) {
887
- Object.assign(ctx, prepareContextContribution(value, scope));
888
- }
889
-
890
- // src/server/request-body.ts
891
- async function readRequestText(req, maxBytes) {
892
- if (req.signal.aborted)
893
- throw abortReason(req.signal);
894
- if (maxBytes === undefined)
895
- return req.text();
896
- assertPositiveSafeInteger("maxJsonBodyBytes", maxBytes, Error);
897
- const result = await readBoundedChunks(req.body, { maxBytes, signal: req.signal });
898
- if (result.kind === "over-limit")
899
- badRequest2(`JSON body exceeds the ${maxBytes}-byte limit`);
900
- return new TextDecoder().decode(concatChunks(result.chunks, result.total));
901
- }
902
-
903
- // src/server/context.ts
904
- function parseJsonBody(req, text, method, cors) {
905
- if (text.trim() === "")
906
- return {};
907
- const essence = mediaTypeEssence(req.headers.get("content-type"));
908
- if (essence !== "application/json") {
909
- if (!method.safelistedBody || essence !== "text/plain") {
910
- badRequest2("Request body must be application/json");
911
- }
912
- const origin = req.headers.get("origin");
913
- if (!cors || cors.origin === undefined || cors.origin === "*") {
914
- forbidden2("A text/plain body requires an explicit cors.origin allow-list on the server");
915
- }
916
- if (!origin)
917
- forbidden2("A text/plain body requires an Origin header");
918
- if (!isOriginAllowed(cors, origin)) {
919
- forbidden2("A text/plain body is accepted only from an allowed origin");
920
- }
921
- }
922
- try {
923
- return safeJsonParse(text);
924
- } catch {
925
- badRequest2("Invalid JSON body");
926
- }
927
- }
928
- function buildBaseContext(req, url, pathParams, traceId, clientIp) {
929
- const safePathParams = {};
930
- for (const [k, v] of Object.entries(pathParams)) {
931
- if (!RUNTIME_CONTEXT_RESERVED_KEYS.has(k) && !isUnsafeKey(k))
932
- safePathParams[k] = v;
933
- }
934
- return {
935
- params: pathParams,
936
- input: undefined,
937
- source: "http",
938
- req,
939
- url,
940
- headers: req.headers,
941
- signal: req.signal,
942
- ...safePathParams,
943
- traceId,
944
- ...getClientInfo2(req, clientIp)
945
- };
946
- }
947
- function parsePathParamsInto(ctx, method) {
948
- if (method.paramsSchema) {
949
- ctx.params = method.paramsSchema.parse(ctx.params);
950
- }
951
- }
952
- async function parseRequestPayloadInto(ctx, req, url, method, maxJsonBodyBytes, cors) {
953
- if (method.multipart) {
954
- const multipart = await parseMultipart2(req, method.multipart, method.inputSchema, method.multipartReceivers);
955
- ctx.input = multipart.fields;
956
- ctx.files = multipart.files;
957
- return multipart;
958
- }
959
- if (method.inputSchema) {
960
- if (req.method === "GET") {
961
- ctx.input = method.inputSchema.parse(parseQueryParams(url));
962
- } else if (req.method === "DELETE") {
963
- if (mediaTypeEssence(req.headers.get("content-type")) === "application/json") {
964
- const text = await readRequestText(req, method.maxJsonBodyBytes ?? maxJsonBodyBytes);
965
- if (method.rawBody)
966
- ctx.rawBody = text;
967
- ctx.input = method.inputSchema.parse(parseJsonBody(req, text, method, cors));
968
- } else {
969
- ctx.input = method.inputSchema.parse(parseQueryParams(url));
970
- }
971
- } else {
972
- const text = await readRequestText(req, method.maxJsonBodyBytes ?? maxJsonBodyBytes);
973
- if (method.rawBody)
974
- ctx.rawBody = text;
975
- ctx.input = method.inputSchema.parse(parseJsonBody(req, text, method, cors));
976
- }
977
- }
978
- return;
979
- }
980
- function buildErrorContext(req, url, traceId, clientIp) {
981
- return {
982
- params: undefined,
983
- input: undefined,
984
- source: "http",
985
- req,
986
- url,
987
- headers: req.headers,
988
- signal: req.signal,
989
- traceId,
990
- ...getClientInfo2(req, clientIp)
991
- };
992
- }
993
-
994
996
  // src/server/contract-stream.ts
995
997
  function encodedBytes(value, format) {
996
998
  const json = JSON.stringify(value);
@@ -2342,7 +2344,7 @@ function webSocketLane2(lane) {
2342
2344
  handlers: {
2343
2345
  message(ws, message) {
2344
2346
  if (match(ws))
2345
- handlers.message(ws, message);
2347
+ handlers.message?.(ws, message);
2346
2348
  },
2347
2349
  open(ws) {
2348
2350
  if (match(ws))
@@ -2372,7 +2374,7 @@ function composeWebSocketHandlers2(lanes, config) {
2372
2374
  return {
2373
2375
  ...config,
2374
2376
  message(ws, message) {
2375
- pick(ws)?.handlers.message(ws, message);
2377
+ pick(ws)?.handlers.message?.(ws, message);
2376
2378
  },
2377
2379
  open(ws) {
2378
2380
  pick(ws)?.handlers.open?.(ws);
@@ -2577,6 +2579,12 @@ function socketIoLane2(websocket) {
2577
2579
  });
2578
2580
  }
2579
2581
 
2582
+ // src/server/unix-client.ts
2583
+ import {
2584
+ Agent,
2585
+ request as httpRequest
2586
+ } from "node:http";
2587
+
2580
2588
  // src/server/unix-client-error.ts
2581
2589
  class UnixClientTransportError2 extends Error {
2582
2590
  code;
@@ -2589,12 +2597,6 @@ class UnixClientTransportError2 extends Error {
2589
2597
  }
2590
2598
  }
2591
2599
 
2592
- // src/server/unix-client.ts
2593
- import {
2594
- Agent,
2595
- request as httpRequest
2596
- } from "node:http";
2597
-
2598
2600
  // src/server/unix-client-body.ts
2599
2601
  async function readBoundedRequestBody(request, maxBytes) {
2600
2602
  if (!request.body)
@@ -0,0 +1,77 @@
1
+ import {
2
+ sleep
3
+ } from "./index-eemvahkc.js";
4
+
5
+ // src/tools/operations/wait-core.ts
6
+ var DEFAULT_BACKOFF = [2, 3, 5, 5, 8, 10];
7
+ var DEFAULT_TIMEOUT = 600;
8
+
9
+ class WaitTimeoutError extends Error {
10
+ constructor() {
11
+ super("wait deadline elapsed before the first snapshot");
12
+ this.name = "WaitTimeoutError";
13
+ }
14
+ }
15
+ async function pollUntil(params) {
16
+ const backoff = params.backoff?.length ? params.backoff : DEFAULT_BACKOFF;
17
+ const lastBackoff = backoff[backoff.length - 1] ?? 5;
18
+ const timeoutSec = params.timeoutSec ?? DEFAULT_TIMEOUT;
19
+ const pause = params.sleepFn ?? sleep;
20
+ const now = params.nowFn ?? (() => performance.now());
21
+ const startedAt = now();
22
+ const deadline = startedAt + timeoutSec * 1000;
23
+ let last;
24
+ for (let attempt = 0;; attempt++) {
25
+ params.signal?.throwIfAborted();
26
+ const remainingBeforePoll = Math.max(0, deadline - now());
27
+ if (remainingBeforePoll === 0 && last) {
28
+ return { state: last.state, timedOut: true };
29
+ }
30
+ const deadlineController = new AbortController;
31
+ const onCallerAbort = () => deadlineController.abort(params.signal?.reason);
32
+ params.signal?.addEventListener("abort", onCallerAbort, { once: true });
33
+ const deadlineTimer = setTimeout(() => deadlineController.abort(new WaitTimeoutError), remainingBeforePoll);
34
+ deadlineTimer.unref?.();
35
+ let state;
36
+ try {
37
+ state = await params.poll(deadlineController.signal);
38
+ } catch (error) {
39
+ if (params.signal?.aborted)
40
+ throw params.signal.reason ?? error;
41
+ if (deadlineController.signal.aborted && now() >= deadline) {
42
+ if (last)
43
+ return { state: last.state, timedOut: true };
44
+ throw new WaitTimeoutError;
45
+ }
46
+ throw error;
47
+ } finally {
48
+ clearTimeout(deadlineTimer);
49
+ params.signal?.removeEventListener("abort", onCallerAbort);
50
+ }
51
+ params.signal?.throwIfAborted();
52
+ last = { state };
53
+ if (params.done(state))
54
+ return { state, timedOut: false };
55
+ const elapsedMs = now() - startedAt;
56
+ const elapsedSec = elapsedMs / 1000;
57
+ params.onTick?.(attempt + 1, elapsedSec);
58
+ if (elapsedSec >= timeoutSec)
59
+ return { state, timedOut: true };
60
+ const waitSec = backoff[Math.min(attempt, backoff.length - 1)] ?? lastBackoff;
61
+ await pause(Math.min(waitSec * 1000, Math.max(0, deadline - now())), params.signal);
62
+ }
63
+ }
64
+ function runWaitOperation(params) {
65
+ return pollUntil({
66
+ poll: (signal) => params.poll(params.input, signal),
67
+ done: params.done,
68
+ backoff: params.backoff,
69
+ timeoutSec: params.timeoutSec,
70
+ sleepFn: params.sleepFn,
71
+ onTick: params.onTick,
72
+ signal: params.signal,
73
+ nowFn: params.nowFn
74
+ });
75
+ }
76
+
77
+ export { WaitTimeoutError, pollUntil, runWaitOperation };
@@ -3,7 +3,7 @@ import {
3
3
  ProcessInstanceSchema2,
4
4
  readProcessInstance,
5
5
  probeProcessOwner2
6
- } from "./index-n8z3rvzw.js";
6
+ } from "./index-qevqn3d3.js";
7
7
  import {
8
8
  BoundedFileReadError,
9
9
  readBoundedFile
@@ -0,0 +1,38 @@
1
+ // src/geo/schema.ts
2
+ import { z } from "zod";
3
+ var GeoTextSchema = z.string().min(1);
4
+ var GeoNonnegativeIntegerSchema = z.number().int().nonnegative();
5
+ var GeoLocalizedNamesSchema = z.record(GeoTextSchema, GeoTextSchema).readonly();
6
+ var GeoLocalizedNameSetSchema = z.strictObject({
7
+ continent: GeoLocalizedNamesSchema.optional(),
8
+ country: GeoLocalizedNamesSchema.optional(),
9
+ registeredCountry: GeoLocalizedNamesSchema.optional(),
10
+ region: GeoLocalizedNamesSchema.optional(),
11
+ city: GeoLocalizedNamesSchema.optional()
12
+ }).readonly();
13
+ var GeoAttributionSchema2 = z.strictObject({
14
+ continentCode: GeoTextSchema.optional(),
15
+ continentName: GeoTextSchema.optional(),
16
+ continentGeonameId: GeoNonnegativeIntegerSchema.optional(),
17
+ countryCode: GeoTextSchema.optional(),
18
+ countryName: GeoTextSchema.optional(),
19
+ countryGeonameId: GeoNonnegativeIntegerSchema.optional(),
20
+ registeredCountryCode: GeoTextSchema.optional(),
21
+ registeredCountryName: GeoTextSchema.optional(),
22
+ registeredCountryGeonameId: GeoNonnegativeIntegerSchema.optional(),
23
+ regionCode: GeoTextSchema.optional(),
24
+ regionName: GeoTextSchema.optional(),
25
+ regionGeonameId: GeoNonnegativeIntegerSchema.optional(),
26
+ city: GeoTextSchema.optional(),
27
+ cityGeonameId: GeoNonnegativeIntegerSchema.optional(),
28
+ postalCode: GeoTextSchema.optional(),
29
+ latitude: z.number().min(-90).max(90).optional(),
30
+ longitude: z.number().min(-180).max(180).optional(),
31
+ timezone: GeoTextSchema.optional(),
32
+ accuracyRadiusKm: GeoNonnegativeIntegerSchema.optional(),
33
+ autonomousSystemNumber: z.number().optional(),
34
+ autonomousSystemOrganization: GeoTextSchema.optional(),
35
+ localizedNames: GeoLocalizedNameSetSchema.optional()
36
+ }).readonly();
37
+
38
+ export { GeoTextSchema, GeoAttributionSchema2 };
@@ -4,7 +4,7 @@ import {
4
4
  import {
5
5
  descriptorPath,
6
6
  NumericFileHandle
7
- } from "./index-arjmb6de.js";
7
+ } from "./index-1jwsfkfz.js";
8
8
  import {
9
9
  stagingName
10
10
  } from "./index-tt30h7mr.js";
@@ -1,12 +1,12 @@
1
1
  import {
2
2
  projectToolSurface
3
- } from "./index-rhzkndr5.js";
3
+ } from "./index-x4p3kw1p.js";
4
4
  import {
5
5
  contractToolMountable
6
- } from "./index-htxh46ej.js";
6
+ } from "./index-ycqhyars.js";
7
7
  import {
8
8
  runtimeToolMountable
9
- } from "./index-ega3yz4c.js";
9
+ } from "./index-aqwg2dm5.js";
10
10
 
11
11
  // src/tools/surface.ts
12
12
  function collectToolSurface({