stitchkit 0.121.0 → 0.122.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (75) hide show
  1. package/CHANGELOG.md +62 -0
  2. package/dist/agent-runtime/browser-control-contract.d.ts +12 -0
  3. package/dist/agent-runtime/browser-control-contract.d.ts.map +1 -1
  4. package/dist/agent-runtime/control-schema.d.ts +27 -4
  5. package/dist/agent-runtime/control-schema.d.ts.map +1 -1
  6. package/dist/agent-runtime/event-schema.d.ts +33 -0
  7. package/dist/agent-runtime/event-schema.d.ts.map +1 -1
  8. package/dist/agent-runtime/run-acquisition.d.ts.map +1 -1
  9. package/dist/agent-runtime/run-execution-state.d.ts +6 -0
  10. package/dist/agent-runtime/run-execution-state.d.ts.map +1 -1
  11. package/dist/agent-runtime/run-model-attempts.d.ts.map +1 -1
  12. package/dist/agent-runtime/run-stream-parts.d.ts +11 -0
  13. package/dist/agent-runtime/run-stream-parts.d.ts.map +1 -1
  14. package/dist/agent-runtime/tool-progress.d.ts +21 -0
  15. package/dist/agent-runtime/tool-progress.d.ts.map +1 -0
  16. package/dist/entrypoints/agent-runtime/browser.js +7 -3
  17. package/dist/entrypoints/agent-runtime/harness.js +5 -5
  18. package/dist/entrypoints/agent-runtime/realtime.js +5 -5
  19. package/dist/entrypoints/agent-runtime.d.ts +1 -1
  20. package/dist/entrypoints/agent-runtime.d.ts.map +1 -1
  21. package/dist/entrypoints/agent-runtime.js +6 -4
  22. package/dist/entrypoints/cli.js +2 -1
  23. package/dist/entrypoints/server.d.ts +1 -0
  24. package/dist/entrypoints/server.d.ts.map +1 -1
  25. package/dist/entrypoints/server.js +107 -42
  26. package/dist/entrypoints/tools/agent.js +1 -1
  27. package/dist/entrypoints/tools/connections.js +7 -1
  28. package/dist/entrypoints/tools/mcp.js +2 -1
  29. package/dist/entrypoints/tools/toolkit.js +4 -3
  30. package/dist/{index-7zwtbak8.js → index-1fyea34p.js} +9 -4
  31. package/dist/index-332d0m9g.js +37 -0
  32. package/dist/{index-4qnzda76.js → index-7qyv50r4.js} +1 -1
  33. package/dist/{index-qctbzmg9.js → index-am1h8c9v.js} +69 -27
  34. package/dist/{index-0fra8xvy.js → index-aswegq1r.js} +18 -6
  35. package/dist/{index-yt7gyg5x.js → index-b51tzcgh.js} +1 -1
  36. package/dist/{index-aw6zahv1.js → index-dqpesdck.js} +2 -2
  37. package/dist/{index-sb9dr3tq.js → index-eh71zr32.js} +4 -4
  38. package/dist/{index-mnkk1ffz.js → index-hs76yzt7.js} +13 -1
  39. package/dist/{index-b0w7rbpt.js → index-t05a2ry4.js} +39 -3
  40. package/dist/{index-knmnj11j.js → index-y6ye582c.js} +7 -5
  41. package/dist/server/openapi-security.d.ts +73 -0
  42. package/dist/server/openapi-security.d.ts.map +1 -0
  43. package/dist/server/openapi.d.ts +12 -0
  44. package/dist/server/openapi.d.ts.map +1 -1
  45. package/dist/tools/agent.d.ts.map +1 -1
  46. package/dist/tools/cli/format.d.ts +11 -2
  47. package/dist/tools/cli/format.d.ts.map +1 -1
  48. package/dist/tools/cli/run-managed.d.ts.map +1 -1
  49. package/dist/tools/cli/run-native.d.ts.map +1 -1
  50. package/dist/tools/connections/mcp.d.ts.map +1 -1
  51. package/dist/tools/mcp/catalog.d.ts.map +1 -1
  52. package/dist/tools/mcp/mount.d.ts.map +1 -1
  53. package/dist/tools/mcp/register.d.ts +1 -2
  54. package/dist/tools/mcp/register.d.ts.map +1 -1
  55. package/dist/tools/mcp/runtime-tools.d.ts.map +1 -1
  56. package/dist/tools/read-operation.d.ts +21 -0
  57. package/dist/tools/read-operation.d.ts.map +1 -0
  58. package/dist/tools/runtime-call-context.d.ts +15 -0
  59. package/dist/tools/runtime-call-context.d.ts.map +1 -0
  60. package/llms/agent-runtime-browser.txt +4 -1
  61. package/llms/agent-runtime.2.txt +13 -108
  62. package/llms/agent-runtime.3.txt +111 -1
  63. package/llms/cli.txt +30 -9
  64. package/llms/server.2.txt +48 -0
  65. package/llms/server.5.txt +2 -0
  66. package/llms/stitchkit.txt +3 -3
  67. package/llms/tools.2.txt +109 -0
  68. package/llms/tools.txt +34 -110
  69. package/llms/{upgrading-0.106.0-0.121.0.txt → upgrading-0.106.0-0.122.0.txt} +31 -3
  70. package/llms/upgrading.txt +1 -1
  71. package/llms-full.txt +165 -15
  72. package/llms.txt +6 -6
  73. package/package.json +2 -1
  74. package/dist/tools/durability-context.d.ts +0 -7
  75. package/dist/tools/durability-context.d.ts.map +0 -1
package/llms-full.txt CHANGED
@@ -84,13 +84,13 @@ own, recorded as an ADR.
84
84
  | `stitchkit/xlsx` | browser **and** server | evolving | a workbook from rows and typed columns, with no dependency; text never runs as a formula |
85
85
  | `stitchkit/oauth` | browser **and** server | evolving | provider-neutral Authorization Code + PKCE request and one-shot callback transaction mechanics |
86
86
  | `stitchkit/google` | server (Bun or Node) | evolving | optional Google code exchange and verified OIDC identity adapter |
87
- | `stitchkit/observability` | server | stable<br>_redefined in 2 of the 66 minors since 0.56.2, most recently 0.92.0_ | request/tool event projections — `createObservability`, trace context, sanitisation |
87
+ | `stitchkit/observability` | server | stable<br>_redefined in 2 of the 67 minors since 0.56.2, most recently 0.92.0_ | request/tool event projections — `createObservability`, trace context, sanitisation |
88
88
  | `stitchkit/testing` | tests on Bun or Node | stable | in-process generated clients over a real Fetch handler, the managed-resource conformance kit and manual time for schedules and retries |
89
89
  | `stitchkit/declaration` | browser + build and deployment tooling (Bun or Node) | evolving | `ProjectDeclarationSchema` — the one machine-readable statement a repository makes about itself |
90
90
  | `stitchkit/react` | browser + server rendering | stable | `createCursorQuery`, `createCacheBridge`, QueryClient and `ApiError` retry policy |
91
91
  | `stitchkit/react/keyboard` | browser | evolving | which part of a screen gets a key — ordered layers, one Escape per level, list zones with real focus; see [keyboard guide](keyboard.md) |
92
92
  | `stitchkit/react/keyboard/testing` | server (Bun or Node) | evolving | the keyboard layers and zones without a DOM — fakes for the window, elements and key events beside the two engines, to test the order of layers, `scope`/`inert` and the edges of a zone in milliseconds |
93
- | `stitchkit/agent-runtime` | server | evolving<br>_redefined in 26 of the 66 minors since 0.56.2, most recently 0.121.0_ | optional durable conversation/run loop, history, models, prompts, fencing and events |
93
+ | `stitchkit/agent-runtime` | server | evolving<br>_redefined in 26 of the 67 minors since 0.56.2, most recently 0.121.0_ | optional durable conversation/run loop, history, models, prompts, fencing and events |
94
94
  | `stitchkit/agent-runtime/sandbox` | server | evolving | optional Linux Bubblewrap sessions, durable workspaces and a host HTTP credential gateway; see [sandbox guide](sandbox.md) |
95
95
  | `stitchkit/agent-runtime/testing` | tests on Bun or Node | evolving | credential-free replay, scripted provider faults, deterministic race controls and the agent-store conformance kit |
96
96
  | `stitchkit/agent-runtime/harness` | server | evolving | resource-aware process-local facade over the canonical Agent runtime; supervision stays outside |
@@ -102,7 +102,7 @@ own, recorded as an ADR.
102
102
  | `stitchkit/agent-runtime/sqlite/bun` | server (Bun) | evolving | durable built-in SQLite store for the agent runtime |
103
103
  | `stitchkit/agent-runtime/sqlite/node` | server (Node ≥ 22.5) | evolving | durable built-in SQLite store for the agent runtime |
104
104
  | `stitchkit-tui` | terminal (Bun) | evolving | optional official OpenTUI host over a caller-composed headless runtime |
105
- | `stitchkit/application` | browser + server | evolving<br>_redefined in 14 of the 66 minors since 0.56.2, most recently 0.110.0_ | managed resource graph, readiness, admission, schedules, subtree restart and bounded shutdown |
105
+ | `stitchkit/application` | browser + server | evolving<br>_redefined in 14 of the 67 minors since 0.56.2, most recently 0.110.0_ | managed resource graph, readiness, admission, schedules, subtree restart and bounded shutdown |
106
106
  | `stitchkit/application/grammy` | server | evolving | a grammY bot as application resources — configuration, then polling with updates admitted by batch — and the webhook adapter |
107
107
  | `stitchkit/application/opentelemetry` | server | evolving | maps application snapshots onto an injected OpenTelemetry `Meter` |
108
108
  | `stitchkit/application/schemas` | browser + server | evolving | the application's snapshot, health and shutdown schemas alone, without the kernel |
@@ -2698,6 +2698,54 @@ const internal = openApiRoute('/internal/openapi.json', fullDoc) // behind aut
2698
2698
  const publicSpec = openApiRoute('/openapi.json', publicDoc) // curated
2699
2699
  ```
2700
2700
 
2701
+ ### Security schemes — `security`
2702
+
2703
+ A generic client reads the spec to learn how to authenticate, and a scope name
2704
+ alone does not tell it which header to send. Pass `security` to describe that in
2705
+ standard OpenAPI terms: named schemes become `components.securitySchemes`, and
2706
+ every protected operation gets a `security` requirement. It is keyed by the
2707
+ scopes your contracts already declare, so there is no second list of which
2708
+ endpoint is protected:
2709
+
2710
+ ```ts
2711
+ const publicDoc = generateOpenApiDocument({
2712
+ info: { title: 'Public API', version: '1.0.0' },
2713
+ services: [account],
2714
+ includeMethod: (m) => m.meta?.public === true,
2715
+ security: {
2716
+ schemes: {
2717
+ apiKey: { type: 'http', scheme: 'bearer', description: 'An account API key' },
2718
+ },
2719
+ // Each protected scope → the schemes that satisfy it, any one of them.
2720
+ scopes: { account: ['apiKey'] },
2721
+ },
2722
+ })
2723
+ ```
2724
+
2725
+ A scheme is `{ type: 'http', scheme: 'bearer' | 'basic' }` or
2726
+ `{ type: 'apiKey', in: 'header' | 'query' | 'cookie', name }` (a session cookie
2727
+ is the `cookie` form). An operation is described by the scope the auth hook
2728
+ checks it under:
2729
+
2730
+ | The operation's scope | In the document |
2731
+ |---|---|
2732
+ | `'public'` | no `security`, no 401/403 |
2733
+ | listed in `scopes` with schemes | `security: [{ apiKey: [] }, …]` and 401/403 |
2734
+ | listed with an empty list — a custom scope whose rule is `'public'` | no `security`, no 401/403 |
2735
+ | not listed | generation throws, naming the operation |
2736
+ | none of its own | read as `defaultScope` — pass the same value as `createAuthHook({ defaultScope })` |
2737
+
2738
+ Generation refuses a protected scope it cannot describe instead of emitting the
2739
+ operation as open — a client would otherwise call it without a credential. Only
2740
+ the operations the document advertises need a mapping: a method `includeMethod`
2741
+ filters out is never checked. A scheme `scopes` names but `schemes` does not
2742
+ declare, and an entry for `'public'`, are refused the same way.
2743
+
2744
+ The metadata describes your policy; it does not enforce it. The auth hook is
2745
+ still the only gate, and removing `security` changes the document, never a
2746
+ 401 or 403. Credential values never belong here: describe where the key goes,
2747
+ not what it is.
2748
+
2701
2749
 
2702
2750
  ==============================================================================
2703
2751
  # Guide: Typed client (docs/guide/client.md)
@@ -4134,6 +4182,36 @@ schema and annotations, and nothing else — it moves when the contract moves an
4134
4182
  not when a handler does. Raw SDK registrations stay consumer-owned and are
4135
4183
  outside it.
4136
4184
 
4185
+ ### Saying which tools only read — `readOnlyHint`
4186
+
4187
+ A host reads a tool's `annotations` to group tools and to choose permission
4188
+ defaults, and a CLI mounted over this surface reads them to decide what a
4189
+ refused view may withhold ([CLI → views](./cli.md#aggregate-views)). The server publishes the
4190
+ annotations the tool declared, and states `readOnlyHint: true` for a read that
4191
+ declared none:
4192
+
4193
+ | The tool | Published `readOnlyHint` |
4194
+ |---|---|
4195
+ | declares `readOnlyHint`, either way | as declared |
4196
+ | `GET` with no `readOnlyHint` | `true` |
4197
+ | `GET` declaring `destructiveHint: true` and no `readOnlyHint` | none |
4198
+ | any other method with no `readOnlyHint` | none |
4199
+
4200
+ A runtime tool follows the same rule by its `identity.method`. A raw SDK
4201
+ registration (`mountWait`, `mountViewFile` and the like) publishes only what it
4202
+ passes. The catalog digest hashes the published annotations, so it moves once
4203
+ when a server starts publishing the derived hint.
4204
+
4205
+ > **A `GET` with an effect must say so.** Hosts may run a tool that publishes
4206
+ > `readOnlyHint: true` without asking. An endpoint that changes something on
4207
+ > `GET` — marks as seen, rotates a token — declares
4208
+ > `tool: { annotations: { readOnlyHint: false } }`.
4209
+
4210
+ A client connection (`defineMcpClientConnection`) carries the hints a server
4211
+ published onto the tools it mounts, field by field: a hint of the wrong type is
4212
+ dropped and the tool stays. The mounted tool is as read-only as its server says
4213
+ it is, and a surface that re-publishes mounted tools passes those hints on.
4214
+
4137
4215
  ### Shaping arguments before validation — `beforeToolCall`
4138
4216
 
4139
4217
  `beforeToolCall` sees the arguments as they arrived and may **replace** them:
@@ -4315,7 +4393,10 @@ render: async (ctx) => {
4315
4393
 
4316
4394
  `reportProgress` is present on every **tool** call — MCP, agent and CLI — so a
4317
4395
  handler never branches on transport, and it does nothing wherever nobody is
4318
- listening. It is absent on the HTTP transport, which has no channel for it, so a
4396
+ listening. Under the agent runtime somebody is: each report becomes a transient
4397
+ `tool-progress` event of the run, so the person watching the agent sees the
4398
+ stage while the model still reads only the tool's result (see
4399
+ [Agent runtime → events](./agent-runtime.md)). It is absent on the HTTP transport, which has no channel for it, so a
4319
4400
  handler that also serves HTTP writes `ctx.reportProgress?.(…)`. It never throws and never
4320
4401
  rejects: a message about work must not be able to kill the work it describes, so
4321
4402
  a refused notification leaves the host exactly where a host that never asked for
@@ -6785,6 +6866,19 @@ or it keeps the failed attempt's partial text on screen.
6785
6866
  start and output on completion. A mounted typed failure carries the same safe
6786
6867
  `{ error, retryable, details?, _hint? }` envelope as the durable result; an unknown
6787
6868
  internal cause remains generic and stays in local observability only;
6869
+ - `tool-progress` is transient: what a running tool handler reported through
6870
+ `ctx.reportProgress` — `message`, `progress` and `total`, the fields an MCP host
6871
+ receives — with the call's `callId` and `toolName`. It never enters the
6872
+ model's input or the durable history. A message longer than
6873
+ `AGENT_TOOL_PROGRESS_MESSAGE_MAX` (280) is cut, reports of one call closer
6874
+ than 250 ms apart are dropped, and a report after the call's terminal
6875
+ `tool-status` or after its attempt was abandoned is dropped; the terminal
6876
+ status carries the final word. `reduceAgentControlEvent` keeps the last
6877
+ report of each running call in `transientByRun[runId].tools[callId]` and
6878
+ removes it on that call's `completed`, `failed` or `interrupted`. The runtime
6879
+ hands its reporter to a call through the SDK tool context, beside its step
6880
+ ledger; a tool that declares its own `contextSchema` keeps that contract and
6881
+ reports nowhere;
6788
6882
  - `terminal` follows the winning terminal CAS.
6789
6883
 
6790
6884
  `loop.checkpointEveryEvents` batches ordinary stream parts (default `20`) and
@@ -10767,15 +10861,36 @@ Rules worth knowing before you rely on them:
10767
10861
  A failed call still reports its own error and exit code. An aggregate over an
10768
10862
  error is not an answer to the question that was asked.
10769
10863
 
10770
- If the command succeeds but its requested view cannot be built, the CLI writes
10771
- the complete original result to stdout, using the normal JSON format (`--json`
10772
- still selects compact output). It writes a separate structured
10773
- `CLI_PRESENTATION_FAILED` diagnostic to stderr and exits with `8`, configurable
10774
- through `exitCodes`. Its `details.operationSucceeded: true` and `retryable: false`
10775
- distinguish a presentation refusal from a failed operation; `details.cause`
10776
- preserves the safe reason. Recover the answer from stdout instead of repeating
10777
- the mutation. Domain retry hints are not appended to this diagnostic. CLI
10778
- argument errors detected before execution still exit with `2`
10864
+ If the command succeeds but its requested view cannot be built, the CLI writes a
10865
+ structured `CLI_PRESENTATION_FAILED` diagnostic to stderr and exits with `8`,
10866
+ configurable through `exitCodes`. Its `details.operationSucceeded: true` and
10867
+ `retryable: false` distinguish a presentation refusal from a failed operation;
10868
+ `details.cause` preserves the safe reason, such as the misspelled field and the
10869
+ fields that are there. Domain retry hints are not appended to this diagnostic.
10870
+
10871
+ What reaches stdout depends on whether the command can be called again for its answer,
10872
+ and `details.resultOnStdout` states which case occurred:
10873
+
10874
+ | Command | stdout | Recover the answer by |
10875
+ |---|---|---|
10876
+ | has an effect | the complete original result in the normal JSON format (`--json` still selects compact output) | reading stdout — never by repeating the mutation |
10877
+ | only reads | nothing | repeating the command with a corrected view |
10878
+
10879
+ A managed command only reads when its tool declares `annotations.readOnlyHint: true`,
10880
+ or declares no `readOnlyHint` and its method is `GET`. `readOnlyHint: false`, or
10881
+ `destructiveHint: true` without a `readOnlyHint`, on a `GET` endpoint keeps the result on stdout. A native
10882
+ `defineCliCommand` declares neither fact, so a failed `present` always keeps the validated
10883
+ result on stdout.
10884
+
10885
+ A CLI that mounts a server's tools through `defineMcpClientConnection` never sees the
10886
+ method — every MCP call is a `POST` — so it reads the `readOnlyHint` the server
10887
+ publishes. A Stitchkit server publishes it for every `GET` by the rule above
10888
+ ([MCP → `readOnlyHint`](./mcp-and-agents.md#saying-which-tools-only-read--readonlyhint)),
10889
+ so the same command behaves the same over the contract and over MCP. The hint is the
10890
+ server's word: a server that labels a write as read-only makes the CLI withhold that
10891
+ write's result on a refused view, and repeating the command repeats the effect.
10892
+
10893
+ CLI argument errors detected before execution still exit with `2`
10779
10894
  and have no successful result to preserve.
10780
10895
 
10781
10896
  ## Named profiles
@@ -17203,6 +17318,34 @@ charts, no merged cells and no streaming: an application that needs them takes a
17203
17318
 
17204
17319
  # Upgrading stitchkit
17205
17320
 
17321
+ ## Released migration: 0.122.0
17322
+
17323
+ ### read-view-refusal
17324
+
17325
+ **Who must act:** scripts and agents that read stdout after a managed CLI command exits with
17326
+ `CLI_PRESENTATION_FAILED` (`8` by default) when that command is a `GET` endpoint or a tool
17327
+ declaring `annotations.readOnlyHint: true`. Commands with an effect and native
17328
+ `defineCliCommand` presenters change nothing.
17329
+
17330
+ A read no longer prints its complete result when the requested view is refused; stdout is
17331
+ empty and the diagnostic carries `details.resultOnStdout: false`.
17332
+
17333
+ ```sh
17334
+ # before: the full list arrived on stdout beside the diagnostic
17335
+ app user_list --table id,nosuchcolumn > users.json # exit 8, users.json holds every record
17336
+
17337
+ # after: repeat the read with a field the diagnostic names
17338
+ app user_list --table id,nosuchcolumn # exit 8, stdout empty
17339
+ app user_list --table id,name
17340
+ ```
17341
+
17342
+ A `GET` endpoint whose call has an effect that must not be repeated declares it, and keeps
17343
+ its result on stdout:
17344
+
17345
+ ```ts
17346
+ tool: { name: 'token_rotate', annotations: { readOnlyHint: false } }
17347
+ ```
17348
+
17206
17349
  ## Released migration: 0.121.0
17207
17350
 
17208
17351
  ### bounded-coding-search
@@ -23101,6 +23244,8 @@ Also re-exports the error helpers from `stitchkit/contract`.
23101
23244
  | `OpenApiConfig` | _type_ | config for `generateOpenApiDocument` (incl. `includeMethod` — curate a public subset) — [guide](../guide/server.md#curating-the-spec--includemethod) |
23102
23245
  | `OpenApiDocument` | _type_ | the generated document |
23103
23246
  | `OpenApiInfo` | _type_ | the spec `info` block |
23247
+ | `OpenApiSecurity` | _type_ | `OpenApiConfig.security` — named schemes and the schemes each protected scope accepts — [guide](../guide/server.md#security-schemes--security) |
23248
+ | `OpenApiSecurityScheme` | _type_ | one way a caller presents its credential: HTTP bearer or basic, or an API key in a header, query or cookie |
23104
23249
  | `OpenApiServer` | _type_ | a spec `servers` entry |
23105
23250
 
23106
23251
  ---
@@ -23734,7 +23879,9 @@ Delivery exports are `AgentAdmissionEventSchema`, `AgentAttemptResetEventSchema`
23734
23879
  `AgentRunStateEventSchema`, `AgentRunOperationEventSchema`, `AgentTerminalEventSchema`,
23735
23880
  `AgentTransientDeltaEventSchema`,
23736
23881
  `AgentReasoningStartEventSchema`, `AgentReasoningDeltaEventSchema`,
23737
- `AgentReasoningEndEventSchema`, `AgentToolStatusEventSchema`, `AgentRuntimeEvent`,
23882
+ `AgentReasoningEndEventSchema`, `AgentToolStatusEventSchema`, `AgentToolProgressEventSchema` (what a
23883
+ running tool reported through `ctx.reportProgress`, transient and never part of the model's input),
23884
+ `AgentRuntimeEvent`,
23738
23885
  `AgentRuntimeEventCursor`, `AgentRuntimeEventCursorSchema`, `AgentRuntimeCursorAdvance`,
23739
23886
  `advanceAgentRuntimeEventCursor`, `agentDurableEventId`, `AgentRuntimeEventSink`,
23740
23887
  `AgentRuntimeEventSinkConfig` and `createAgentRuntimeEventSink`. Cursor gaps require a canonical
@@ -23888,7 +24035,10 @@ including `AgentAttemptResetEventSchema` for `attempt-reset`),
23888
24035
  `AgentControlErrorCodeSchema` / `AgentControlErrorCode` (the one vocabulary of every control
23889
24036
  error code: `FORBIDDEN`, `CONNECTION_CLOSED`, `REQUEST_CAPACITY`, `ATTACHMENT_CAPACITY`,
23890
24037
  `LEASE_CONFLICT`, `EVENT_OVERFLOW` and the rest), `AgentMultiSessionCursorSchema` /
23891
- `AgentMultiSessionCursor`, `AgentConversationView`, `AgentControlView`,
24038
+ `AgentMultiSessionCursor`, `AgentConversationView`, `AgentControlView`, `AgentRunTransient` (a
24039
+ run's streamed text, reasoning and running tool calls before its next checkpoint),
24040
+ `AgentToolActivity` (one running call with its last reported progress),
24041
+ `AGENT_TOOL_PROGRESS_MESSAGE_MAX` (the longest progress message a run publishes),
23892
24042
  `advanceAgentMultiSessionCursor`, `createAgentControlView`, `reduceAgentControlSnapshot`,
23893
24043
  `reduceAgentControlEvent` and
23894
24044
  `agentDurableEventId`. It imports no model provider, executor, store, event sink
package/llms.txt CHANGED
@@ -14,25 +14,25 @@ Load the slice for each entrypoint your code imports — `import … from 'stitc
14
14
  - **stitchkit/react**: [llms/react.txt](llms/react.txt) 8.7 KB
15
15
  - **stitchkit/react/keyboard**: [llms/react-keyboard.txt](llms/react-keyboard.txt) 22.7 KB
16
16
  - **stitchkit/react/keyboard/testing**: [llms/react-keyboard-testing.txt](llms/react-keyboard-testing.txt) 1.9 KB
17
- - **stitchkit/tools**: [llms/tools.txt](llms/tools.txt) 46.7 KB → [llms/tools.2.txt](llms/tools.2.txt) 30.5 KB → [llms/tools.3.txt](llms/tools.3.txt) 21.0 KB
17
+ - **stitchkit/tools**: [llms/tools.txt](llms/tools.txt) 43.2 KB → [llms/tools.2.txt](llms/tools.2.txt) 35.7 KB → [llms/tools.3.txt](llms/tools.3.txt) 21.0 KB
18
18
  - **stitchkit/tools/mcp**: [llms/tools-mcp.txt](llms/tools-mcp.txt) 6.6 KB
19
19
  - **stitchkit/tools/agent**: [llms/tools-agent.txt](llms/tools-agent.txt) 1.1 KB
20
20
  - **stitchkit/tools/toolkit**: [llms/tools-toolkit.txt](llms/tools-toolkit.txt) 0.9 KB
21
21
  - **stitchkit/tools/contract**: [llms/tools-contract.txt](llms/tools-contract.txt) 0.2 KB
22
22
  - **stitchkit/tools/invoker**: [llms/tools-invoker.txt](llms/tools-invoker.txt) 0.2 KB
23
23
  - **stitchkit/tools/connections**: [llms/tools-connections.txt](llms/tools-connections.txt) 3.9 KB
24
- - **stitchkit/cli**: [llms/cli.txt](llms/cli.txt) 36.6 KB → [llms/cli.2.txt](llms/cli.2.txt) 36.4 KB
24
+ - **stitchkit/cli**: [llms/cli.txt](llms/cli.txt) 37.8 KB → [llms/cli.2.txt](llms/cli.2.txt) 36.4 KB
25
25
  - **stitchkit/cli/publish**: [llms/cli-publish.txt](llms/cli-publish.txt) 1.5 KB
26
26
  - **stitchkit/remote**: [llms/remote.txt](llms/remote.txt) 1.0 KB
27
27
  - **stitchkit/contract**: [llms/contract.txt](llms/contract.txt) 33.8 KB
28
28
  - **stitchkit/primitives**: [llms/primitives.txt](llms/primitives.txt) 13.2 KB
29
- - **stitchkit/server**: [llms/server.txt](llms/server.txt) 44.2 KB → [llms/server.2.txt](llms/server.2.txt) 20.9 KB → [llms/server.3.txt](llms/server.3.txt) 47.0 KB → [llms/server.4.txt](llms/server.4.txt) 38.6 KB → [llms/server.5.txt](llms/server.5.txt) 23.2 KB
29
+ - **stitchkit/server**: [llms/server.txt](llms/server.txt) 44.2 KB → [llms/server.2.txt](llms/server.2.txt) 23.1 KB → [llms/server.3.txt](llms/server.3.txt) 47.0 KB → [llms/server.4.txt](llms/server.4.txt) 38.6 KB → [llms/server.5.txt](llms/server.5.txt) 23.5 KB
30
30
  - **stitchkit/observability**: [llms/observability.txt](llms/observability.txt) 46.9 KB
31
- - **stitchkit/agent-runtime**: [llms/agent-runtime.txt](llms/agent-runtime.txt) 47.6 KB → [llms/agent-runtime.2.txt](llms/agent-runtime.2.txt) 47.6 KB → [llms/agent-runtime.3.txt](llms/agent-runtime.3.txt) 39.7 KB → [llms/agent-runtime.4.txt](llms/agent-runtime.4.txt) 11.7 KB
31
+ - **stitchkit/agent-runtime**: [llms/agent-runtime.txt](llms/agent-runtime.txt) 47.6 KB → [llms/agent-runtime.2.txt](llms/agent-runtime.2.txt) 43.3 KB → [llms/agent-runtime.3.txt](llms/agent-runtime.3.txt) 45.1 KB → [llms/agent-runtime.4.txt](llms/agent-runtime.4.txt) 11.7 KB
32
32
  - **stitchkit/agent-runtime/testing**: [llms/agent-runtime-testing.txt](llms/agent-runtime-testing.txt) 2.6 KB
33
33
  - **stitchkit/agent-runtime/harness**: [llms/agent-runtime-harness.txt](llms/agent-runtime-harness.txt) 11.0 KB
34
34
  - **stitchkit/agent-runtime/coding-tools**: [llms/agent-runtime-coding-tools.txt](llms/agent-runtime-coding-tools.txt) 5.0 KB
35
- - **stitchkit/agent-runtime/browser**: [llms/agent-runtime-browser.txt](llms/agent-runtime-browser.txt) 3.8 KB
35
+ - **stitchkit/agent-runtime/browser**: [llms/agent-runtime-browser.txt](llms/agent-runtime-browser.txt) 4.0 KB
36
36
  - **stitchkit/agent-runtime/openrouter**: [llms/agent-runtime-openrouter.txt](llms/agent-runtime-openrouter.txt) 1.1 KB
37
37
  - **stitchkit/agent-runtime/sqlite/bun**: [llms/agent-runtime-sqlite-bun.txt](llms/agent-runtime-sqlite-bun.txt) 1.8 KB
38
38
  - **stitchkit/agent-runtime/sqlite/node**: [llms/agent-runtime-sqlite-node.txt](llms/agent-runtime-sqlite-node.txt) 1.7 KB
@@ -72,7 +72,7 @@ Load the slice for each entrypoint your code imports — `import … from 'stitc
72
72
 
73
73
  ## Upgrading slices
74
74
  - **Upgrading — how to move across versions**: [llms/upgrading.txt](llms/upgrading.txt) 12.7 KB
75
- - **Upgrading 0.106.0 → 0.121.0**: [llms/upgrading-0.106.0-0.121.0.txt](llms/upgrading-0.106.0-0.121.0.txt) 33.4 KB
75
+ - **Upgrading 0.106.0 → 0.122.0**: [llms/upgrading-0.106.0-0.122.0.txt](llms/upgrading-0.106.0-0.122.0.txt) 34.4 KB
76
76
  - **Upgrading 0.96.0 → 0.105.0**: [llms/upgrading-0.96.0-0.105.0.txt](llms/upgrading-0.96.0-0.105.0.txt) 45.8 KB
77
77
  - **Upgrading 0.69.0 → 0.95.0**: [llms/upgrading-0.69.0-0.95.0.txt](llms/upgrading-0.69.0-0.95.0.txt) 46.6 KB
78
78
  - **Upgrading 0.55.0 → 0.68.0**: [llms/upgrading-0.55.0-0.68.0.txt](llms/upgrading-0.55.0-0.68.0.txt) 47.0 KB
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "stitchkit",
3
- "version": "0.121.0",
3
+ "version": "0.122.1",
4
4
  "description": "Contract-first backend framework — one defineContract() into an HTTP API, MCP tools, AI-agent tools and a typed client. Bun and Node.",
5
5
  "keywords": [
6
6
  "bun",
@@ -405,6 +405,7 @@
405
405
  "@modelcontextprotocol/server": "^2.4.0",
406
406
  "@openrouter/ai-sdk-provider": "^3.1.0",
407
407
  "@opentelemetry/api": "^1.10.0",
408
+ "@seriousme/openapi-schema-validator": "^2.11.0",
408
409
  "@socket.io/bun-engine": "^0.1.2",
409
410
  "@socket.io/component-emitter": "^3.1.2",
410
411
  "@tanstack/react-query": "5.105.3",
@@ -1,7 +0,0 @@
1
- import type { LocalStepDurability } from '../durability/contract.js';
2
- type Factory = (callId: string, signal?: AbortSignal) => LocalStepDurability;
3
- /** Opaque SDK context; no credentials, functions or runtime objects enter provider messages. */
4
- export declare function createToolDurabilityContext(factory: Factory): object;
5
- export declare function resolveToolDurability(context: unknown, callId: string, signal?: AbortSignal): LocalStepDurability | undefined;
6
- export {};
7
- //# sourceMappingURL=durability-context.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"durability-context.d.ts","sourceRoot":"","sources":["../../src/tools/durability-context.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAElE,KAAK,OAAO,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,mBAAmB,CAAC;AAG7E,gGAAgG;AAChG,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAIpE;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,WAAW,GACnB,mBAAmB,GAAG,SAAS,CAGjC"}