stitchkit 0.118.1 → 0.120.0

package/dist/{index-d9hq291n.js → index-4jpykzvw.js}

@@ -1,6 +1,11 @@
 import {
   resolveRouteParamsSchema
 } from "./index-m38ej7e5.js";
+import {
+  TOOL_TRANSPORTS2,
+  isHttpOnlyEndpoint,
+  assertEndpointExposure
+} from "./index-69t14s4a.js";
 import {
   isUnsafeKey
 } from "./index-zsarb5xp.js";
@@ -11,71 +16,10 @@ import {
   isRecord
 } from "./index-9jfdm5tg.js";
 
-// src/contract/tool-view.ts
-import { z } from "zod";
-var DECLARED_TOOL_VIEW = Symbol.for("stitchkit.toolView");
-function withToolView2(endpoint, view) {
-  const declared = { ...view, [DECLARED_TOOL_VIEW]: true };
-  return { ...endpoint, tool: { ...endpoint.tool, view: declared } };
-}
-function objectKeys(schema) {
-  return schema instanceof z.ZodObject ? new Set(Object.keys(schema.shape)) : new Set;
-}
-function assertToolView(prefix, key, ep) {
-  const where = `Contract "${prefix}": endpoint "${key}" tool.view`;
-  const tool = Reflect.get(ep, "tool");
-  const view = isRecord(tool) ? tool.view : undefined;
-  if (!isRecord(view))
-    throw new Error(`${where} must be an object`);
-  if (Reflect.get(view, DECLARED_TOOL_VIEW) !== true) {
-    throw new Error(`${where} must be declared with withToolView, which types its project`);
-  }
-  if (ep.rawResponse || ep.rawBody || ep.multipart || "responseMeta" in ep || "stream" in ep) {
-    throw new Error(`${where} is only for a JSON tool endpoint — this one is HTTP-only by kind`);
-  }
-  if (!ep.output) {
-    throw new Error(`${where} needs the endpoint's full output — the view is derived from it`);
-  }
-  const output = view.output;
-  const project = view.project;
-  if (output !== undefined && !(output instanceof z.ZodType)) {
-    throw new Error(`${where}.output must be a Zod schema`);
-  }
-  if (project !== undefined && typeof project !== "function") {
-    throw new Error(`${where}.project must be a function`);
-  }
-  const defaults = view.defaults;
-  if (defaults !== undefined && !isRecord(defaults)) {
-    throw new Error(`${where}.defaults must be an object`);
-  }
-  const entries = defaults === undefined ? [] : Object.entries(defaults);
-  if (output === undefined && project === undefined && entries.length === 0) {
-    throw new Error(`${where} declares no defaults, output or project — it would change nothing`);
-  }
-  if (entries.length === 0)
-    return;
-  if (!(ep.input instanceof z.ZodObject)) {
-    throw new Error(`${where}.defaults needs an object input schema to name keys of`);
-  }
-  const inputKeys = objectKeys(ep.input);
-  const paramKeys = objectKeys(ep.params);
-  for (const [name, value] of entries) {
-    if (paramKeys.has(name)) {
-      throw new Error(`${where}.defaults.${name} is a path param — a route segment has no default`);
-    }
-    if (!inputKeys.has(name)) {
-      throw new Error(`${where}.defaults.${name} is not a key of the endpoint's input`);
-    }
-    const field = ep.input.shape[name];
-    if (field === undefined || !z.safeParse(field, value).success) {
-      throw new Error(`${where}.defaults.${name} is not a valid value for that input key`);
-    }
-  }
-}
-
 // src/contract/define-validation.ts
 function assertMultipartEndpoint(prefix, key, ep) {
   const where = `Contract "${prefix}": multipart endpoint "${key}"`;
+  assertNoToolOptions(where, ep);
   if (ep.method !== "POST" && ep.method !== "PUT" && ep.method !== "PATCH") {
     throw new Error(`${where} must use POST, PUT or PATCH`);
   }
@@ -113,10 +57,6 @@ function assertRawEndpoint(prefix, key, ep) {
   if (ep.output)
     throw new Error(`${where} cannot declare an output schema`);
   assertNoToolOptions(where, ep);
-  const nonHttp = (ep.expose ?? []).filter((t) => t !== "HTTP");
-  if (nonHttp.length > 0) {
-    throw new Error(`${where} is HTTP-only — remove ${nonHttp.join(", ")} from expose`);
-  }
 }
 function assertStreamingResponseEndpoint(prefix, key, ep) {
   const where = `Contract "${prefix}": streaming endpoint "${key}"`;
@@ -153,10 +93,6 @@ function assertStreamingResponseEndpoint(prefix, key, ep) {
   if (ep.multipart)
     throw new Error(`${where} cannot be multipart`);
   assertNoToolOptions(where, ep);
-  const nonHttp = (ep.expose ?? []).filter((transport) => transport !== "HTTP");
-  if (nonHttp.length > 0) {
-    throw new Error(`${where} is HTTP-only — remove ${nonHttp.join(", ")} from expose`);
-  }
 }
 var UNGROUPED_TOOL_OPTIONS = {
   toolName: "tool.name",
@@ -214,10 +150,6 @@ function assertRawBodyEndpoint(prefix, key, ep) {
     throw new Error(`${where} must use POST, PUT or PATCH`);
   }
   assertNoToolOptions(where, ep);
-  const nonHttp = (ep.expose ?? []).filter((transport) => transport !== "HTTP");
-  if (nonHttp.length > 0) {
-    throw new Error(`${where} is HTTP-only — remove ${nonHttp.join(", ")} from expose`);
-  }
 }
 function assertSafelistedBodyEndpoint(prefix, key, ep) {
   const where = `Contract "${prefix}": safelistedBody endpoint "${key}"`;
@@ -245,15 +177,71 @@ function assertResponseMetaEndpoint(prefix, key, ep) {
   if (ep.rawResponse)
     throw new Error(`${where} cannot also be a rawResponse endpoint`);
   assertNoToolOptions(where, ep);
-  const nonHttp = (ep.expose ?? []).filter((transport) => transport !== "HTTP");
-  if (nonHttp.length > 0) {
-    throw new Error(`${where} is HTTP-only — remove ${nonHttp.join(", ")} from expose`);
+}
+
+// src/contract/tool-view.ts
+import { z } from "zod";
+var DECLARED_TOOL_VIEW = Symbol.for("stitchkit.toolView");
+function withToolView2(endpoint, view) {
+  const declared = { ...view, [DECLARED_TOOL_VIEW]: true };
+  return { ...endpoint, tool: { ...endpoint.tool, view: declared } };
+}
+function objectKeys(schema) {
+  return schema instanceof z.ZodObject ? new Set(Object.keys(schema.shape)) : new Set;
+}
+function assertToolView(prefix, key, ep) {
+  const where = `Contract "${prefix}": endpoint "${key}" tool.view`;
+  const tool = Reflect.get(ep, "tool");
+  const view = isRecord(tool) ? tool.view : undefined;
+  if (!isRecord(view))
+    throw new Error(`${where} must be an object`);
+  if (Reflect.get(view, DECLARED_TOOL_VIEW) !== true) {
+    throw new Error(`${where} must be declared with withToolView, which types its project`);
+  }
+  if (isHttpOnlyEndpoint(ep)) {
+    throw new Error(`${where} is only for a JSON tool endpoint — this one is HTTP-only by kind`);
+  }
+  if (!ep.output) {
+    throw new Error(`${where} needs the endpoint's full output — the view is derived from it`);
+  }
+  const output = view.output;
+  const project = view.project;
+  if (output !== undefined && !(output instanceof z.ZodType)) {
+    throw new Error(`${where}.output must be a Zod schema`);
+  }
+  if (project !== undefined && typeof project !== "function") {
+    throw new Error(`${where}.project must be a function`);
+  }
+  const defaults = view.defaults;
+  if (defaults !== undefined && !isRecord(defaults)) {
+    throw new Error(`${where}.defaults must be an object`);
+  }
+  const entries = defaults === undefined ? [] : Object.entries(defaults);
+  if (output === undefined && project === undefined && entries.length === 0) {
+    throw new Error(`${where} declares no defaults, output or project — it would change nothing`);
+  }
+  if (entries.length === 0)
+    return;
+  if (!(ep.input instanceof z.ZodObject)) {
+    throw new Error(`${where}.defaults needs an object input schema to name keys of`);
+  }
+  const inputKeys = objectKeys(ep.input);
+  const paramKeys = objectKeys(ep.params);
+  for (const [name, value] of entries) {
+    if (paramKeys.has(name)) {
+      throw new Error(`${where}.defaults.${name} is a path param — a route segment has no default`);
+    }
+    if (!inputKeys.has(name)) {
+      throw new Error(`${where}.defaults.${name} is not a key of the endpoint's input`);
+    }
+    const field = ep.input.shape[name];
+    if (field === undefined || !z.safeParse(field, value).success) {
+      throw new Error(`${where}.defaults.${name} is not a valid value for that input key`);
+    }
   }
 }
 
 // src/contract/define.ts
-var ALL_TRANSPORTS2 = ["HTTP", "MCP", "AGENT", "CLI"];
-var TOOL_TRANSPORTS2 = ["MCP", "AGENT", "CLI"];
 function defineContract2(meta, endpoints) {
   const materializedEndpoints = {};
   for (const [key, endpoint] of Object.entries(endpoints)) {
@@ -262,6 +250,7 @@ function defineContract2(meta, endpoints) {
   }
   const toolTransports = new Map;
   for (const [key, ep] of Object.entries(materializedEndpoints)) {
+    assertEndpointExposure(meta.prefix, key, ep);
     if (ep.desc.trim() === "") {
       throw new Error(`Contract "${meta.prefix}": endpoint "${key}" has an empty desc`);
     }
@@ -289,7 +278,7 @@ function defineContract2(meta, endpoints) {
     }
     const transports = new Set(ep.expose ? ep.expose.filter((t) => t !== "HTTP") : ["MCP", "AGENT"]);
     if (transports.size === 0) {
-      throw new Error(`Contract "${meta.prefix}": endpoint "${key}" sets tool options but is not exposed on any tool transport (${TOOL_TRANSPORTS2.join(" / ")}) — a contract factory with toolExposure 'explicit' makes an omitted expose HTTP-only`);
+      throw new Error(`Contract "${meta.prefix}": endpoint "${key}" sets tool options but is not exposed on any tool transport (${TOOL_TRANSPORTS2.join(" / ")}) — add a tool transport to expose or the factory default`);
     }
     if (tool.view !== undefined)
       assertToolView(meta.prefix, key, ep);
@@ -310,4 +299,4 @@ function defineContract2(meta, endpoints) {
   return { meta, endpoints: materializedEndpoints };
 }
 
-export { withToolView2, ALL_TRANSPORTS2, TOOL_TRANSPORTS2, defineContract2 };
+export { withToolView2, defineContract2 };

package/dist/index-568w258r.js

@@ -0,0 +1,76 @@
+import {
+  DEFAULT_CORS_ALLOW_HEADERS2
+} from "./index-pq7rkwkk.js";
+
+// src/server/oauth/metadata.ts
+var PROTECTED_RESOURCE_PATH2 = "/.well-known/oauth-protected-resource";
+function metadataPath(resource) {
+  const { pathname } = new URL(resource);
+  return pathname === "/" ? PROTECTED_RESOURCE_PATH2 : `${PROTECTED_RESOURCE_PATH2}${pathname}`;
+}
+function protectedResourceMetadataUrl2(resource) {
+  return `${new URL(resource).origin}${metadataPath(resource)}`;
+}
+function wwwAuthenticateHeader2(resource) {
+  return `Bearer resource_metadata="${protectedResourceMetadataUrl2(resource)}"`;
+}
+var PUBLIC_CORS = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Methods": "GET, OPTIONS",
+  "Access-Control-Allow-Headers": DEFAULT_CORS_ALLOW_HEADERS2
+};
+function oauthProtectedResourceRoute2(config) {
+  const body = JSON.stringify({
+    resource: config.resource,
+    authorization_servers: config.authorizationServers,
+    ...config.scopesSupported && { scopes_supported: config.scopesSupported },
+    bearer_methods_supported: ["header"]
+  });
+  return {
+    method: "ALL",
+    path: metadataPath(config.resource),
+    handler: (req) => {
+      if (req.method === "OPTIONS")
+        return new Response(null, { status: 204, headers: PUBLIC_CORS });
+      if (req.method !== "GET")
+        return new Response("Method Not Allowed", { status: 405 });
+      return new Response(body, {
+        status: 200,
+        headers: { "Content-Type": "application/json", ...PUBLIC_CORS }
+      });
+    }
+  };
+}
+
+// src/tools/mcp/progress.ts
+function mcpProgressToken(context) {
+  const token = context.mcpReq._meta?.progressToken;
+  return typeof token === "string" || typeof token === "number" ? token : undefined;
+}
+function createMcpProgressReporter(context) {
+  const token = mcpProgressToken(context);
+  if (token === undefined)
+    return async () => {
+      return;
+    };
+  let sent = 0;
+  let highWater = 0;
+  return async (update) => {
+    sent += 1;
+    const value = update.progress ?? Math.max(sent, highWater + 1);
+    highWater = Math.max(highWater, value);
+    try {
+      await context.mcpReq.notify({
+        method: "notifications/progress",
+        params: {
+          progressToken: token,
+          progress: value,
+          ...update.total !== undefined && { total: update.total },
+          ...update.message !== undefined && { message: update.message }
+        }
+      });
+    } catch {}
+  };
+}
+
+export { PROTECTED_RESOURCE_PATH2, protectedResourceMetadataUrl2, wwwAuthenticateHeader2, oauthProtectedResourceRoute2, mcpProgressToken, createMcpProgressReporter };

package/dist/index-69t14s4a.js

@@ -0,0 +1,39 @@
+// src/contract/endpoint-capabilities.ts
+import { z } from "zod";
+
+// src/contract/transports.ts
+var ALL_TRANSPORTS2 = ["HTTP", "MCP", "AGENT", "CLI"];
+var TOOL_TRANSPORTS2 = ["MCP", "AGENT", "CLI"];
+
+// src/contract/endpoint-capabilities.ts
+var HTTP_ONLY_FEATURES = [
+  "rawResponse",
+  "rawBody",
+  "responseMeta",
+  "multipart",
+  "stream"
+];
+var HTTP_ONLY_EXPOSURE = Object.freeze(["HTTP"]);
+var ExposureSchema = z.array(z.enum(ALL_TRANSPORTS2)).refine((transports) => new Set(transports).size === transports.length, {
+  message: "Each transport appears at most once"
+}).readonly();
+function isHttpOnlyEndpoint(endpoint) {
+  return endpoint.method === "HEAD" || HTTP_ONLY_FEATURES.some((feature) => Boolean(endpoint[feature]));
+}
+function assertEndpointExposure(prefix, key, endpoint) {
+  if (endpoint.expose === undefined)
+    return;
+  const exposure = ExposureSchema.safeParse(endpoint.expose);
+  const where = `Contract "${prefix}": endpoint "${key}"`;
+  if (!exposure.success) {
+    throw new Error(`${where} expose must be an array of distinct transports: ${ALL_TRANSPORTS2.join(" / ")}`);
+  }
+  if (isHttpOnlyEndpoint(endpoint)) {
+    const unsupported = exposure.data.filter((transport) => transport !== "HTTP");
+    if (unsupported.length > 0) {
+      throw new Error(`${where} is HTTP-only — remove ${unsupported.join(", ")} from expose`);
+    }
+  }
+}
+
+export { ALL_TRANSPORTS2, TOOL_TRANSPORTS2, HTTP_ONLY_EXPOSURE, ExposureSchema, isHttpOnlyEndpoint, assertEndpointExposure };

package/dist/{index-dky0dcmf.js → index-72r9k0av.js}

@@ -2,6 +2,12 @@ import {
   isRecord
 } from "./index-9jfdm5tg.js";
 
+// src/application/diagnostic-journal-contract.ts
+import { z as z3 } from "zod";
+
+// src/application/diagnostic-journal-read-contract.ts
+import { z as z2 } from "zod";
+
 // src/application/diagnostic-journal-frame.ts
 import { z } from "zod";
 var DiagnosticJournalFrameSchema2 = z.object({
@@ -12,7 +18,6 @@ var DiagnosticJournalFrameSchema2 = z.object({
 }).strict().readonly();
 
 // src/application/diagnostic-journal-read-contract.ts
-import { z as z2 } from "zod";
 var ByteCountSchema = z2.number().int().nonnegative();
 var LocationSchema = z2.object({
   file: z2.string(),
@@ -88,7 +93,6 @@ class DiagnosticJournalRecoveryError2 extends Error {
 }
 
 // src/application/diagnostic-journal-contract.ts
-import { z as z3 } from "zod";
 var PositiveSafeIntegerSchema = z3.number().int().positive();
 var FileModeSchema = z3.number().int().min(0).max(511);
 var DiagnosticJournalLimitsSchema2 = z3.object({

package/dist/{index-6p3frkv5.js → index-7zwtbak8.js}

@@ -2,21 +2,23 @@ import {
   toolResultFromError,
   toolCauseFromResult,
   isToolExecutionControlError2
-} from "./index-v6vb5qx8.js";
+} from "./index-s3yxw6kt.js";
 import {
   createToolRunner,
   formatToolError
-} from "./index-htxh46ej.js";
+} from "./index-ycqhyars.js";
 import {
-  AgentToolError2,
   resolveToolDurability
-} from "./index-tvtacc9a.js";
+} from "./index-sb9dr3tq.js";
+import {
+  AgentToolError2
+} from "./index-1psbyyhj.js";
 import {
   collectToolSurface
-} from "./index-86nbfysb.js";
+} from "./index-ff39f9dr.js";
 import {
   agentPresenterOf
-} from "./index-ega3yz4c.js";
+} from "./index-aqwg2dm5.js";
 import {
   isRecord
 } from "./index-9jfdm5tg.js";
@@ -111,47 +113,4 @@ function mountAgent2(services, config = {}) {
   return tools;
 }
 
-// src/tools/manifest.ts
-function utf8Length(value) {
-  return new TextEncoder().encode(JSON.stringify(value)).byteLength;
-}
-function describeToolCatalog2(config) {
-  const deferred = new Set(config.deferredNames ?? []);
-  const entries = collectToolSurface({
-    surface: config,
-    transport: config.transport,
-    extend: config.extend,
-    flattenUnionInput: config.flattenUnionInput
-  }).map(({ kind, service, action, mountable }) => {
-    const schemaBytes = utf8Length(mountable.presentationSchema);
-    return {
-      name: mountable.name,
-      description: mountable.method.desc,
-      inputSchema: mountable.presentationSchema,
-      source: { kind, service, action },
-      schemaBytes,
-      deferred: deferred.has(mountable.name)
-    };
-  });
-  if (config.maxSchemaBytes !== undefined) {
-    const total = entries.reduce((sum, entry) => sum + entry.schemaBytes, 0);
-    if (total > config.maxSchemaBytes) {
-      throw new TypeError(`Tool catalog schemas use ${total} bytes, exceeding maxSchemaBytes ${config.maxSchemaBytes}`);
-    }
-  }
-  return entries;
-}
-function buildToolManifest2(config) {
-  return collectToolSurface({
-    surface: config,
-    transport: config.transport,
-    extend: config.extend,
-    flattenUnionInput: config.flattenUnionInput
-  }).map(({ mountable }) => ({
-    name: mountable.name,
-    description: mountable.method.desc,
-    inputSchema: mountable.presentationSchema
-  }));
-}
-
-export { mountAgent2, describeToolCatalog2, buildToolManifest2 };
+export { mountAgent2 };

package/dist/{index-90p34rts.js → index-8ryydawp.js}

@@ -1,14 +1,14 @@
 import {
   withSignalDeadline
 } from "./index-9tqbxv5p.js";
+import {
+  writeFileAtomicSync2
+} from "./index-ac6vvm30.js";
 import {
   fetchGuarded,
   PrivateAddressRefusal,
   readCapped
-} from "./index-mgb7r8b8.js";
-import {
-  writeFileAtomicSync2
-} from "./index-ac6vvm30.js";
+} from "./index-jswst0h3.js";
 import {
   raceAbort
 } from "./index-b0kddvzw.js";
@@ -19,6 +19,9 @@ import {
   serializeCanonicalJson
 } from "./index-zsvzhjtk.js";
 
+// src/tools/cli/manifest.ts
+import { z as z2 } from "zod";
+
 // src/tools/cli/signature.ts
 import {
   createPrivateKey,
@@ -87,7 +90,6 @@ function cliSignatureAccepted2(verdict) {
 }
 
 // src/tools/cli/manifest.ts
-import { z as z2 } from "zod";
 var CliBuildTargetSchema2 = z2.object({
   platform: z2.string().min(1),
   arch: z2.string().min(1)

package/dist/{index-vv1sch8a.js → index-8vzh5wpv.js}

@@ -1,10 +1,3 @@
-// src/tracking/beacon.ts
-function sendUnloadBeacon2(url, body, sender = typeof navigator === "undefined" ? undefined : navigator) {
-  if (!sender || typeof sender.sendBeacon !== "function")
-    return false;
-  return sender.sendBeacon(url, body);
-}
-
 // src/tracking/privacy.ts
 var MASK = "[masked]";
 var MAX_REDACTED_CHARS = 16384;
@@ -77,6 +70,11 @@ function redactTrackingText2(input) {
     }
   }).replace(ASSIGNMENT, (whole, prefix, key, assignment) => isSecretField(key.replace(/^["']|["']$/g, "")) ? `${prefix}${key}${assignment}${MASK}` : whole);
 }
+function maskTrackingParameters(input, names) {
+  if (names.size === 0)
+    return input;
+  return input.replace(PARAMETER, (whole, separator, key) => names.has(decodeKey(key)) ? `${separator}${key}=${MASK}` : whole);
+}
 function redactTrackingValue2(value) {
   if (typeof value === "string")
     return redactTrackingText2(value);
@@ -91,4 +89,11 @@ function redactTrackingValue2(value) {
   return value;
 }
 
-export { sendUnloadBeacon2, redactTrackingText2, redactTrackingValue2 };
+// src/tracking/beacon.ts
+function sendUnloadBeacon2(url, body, sender = typeof navigator === "undefined" ? undefined : navigator) {
+  if (!sender || typeof sender.sendBeacon !== "function")
+    return false;
+  return sender.sendBeacon(url, body);
+}
+
+export { redactTrackingText2, maskTrackingParameters, redactTrackingValue2, sendUnloadBeacon2 };

package/dist/{index-75ns2ybj.js → index-8xyf8h2k.js}

@@ -1,6 +1,6 @@
 import {
   withExclusiveLock2
-} from "./index-nqxrm176.js";
+} from "./index-r3db01kh.js";
 import {
   readBoundedFile
 } from "./index-m616f0yz.js";