stitchkit 0.122.2 → 0.123.0

package/dist/tools/cli/invoke.d.ts

@@ -39,6 +39,7 @@ import type { RuntimeToolDefinition } from '../runtime-tool-declaration.js';
 import { type CliCommandDefinition } from './command.js';
 import { type ExitCodeMap } from './format.js';
 import { type CliCommandPresentation, type CliPresentationPolicyConfig } from './policy.js';
+import { type CliStreamOperation } from './stream-surface.js';
 export type CliSurfaceSource<TAuth, TValue> = readonly TValue[] | ((auth: Awaited<TAuth> | undefined) => readonly TValue[]);
 /**
  * What an invocation needs to exist: the surface, the identity behind it and
@@ -107,7 +108,7 @@ export interface CliInvoker {
     readonly commands: readonly CliInvokerCommand[];
     /**
      * Run one parsed call. Never writes, never exits. An unknown command is a
-     * `NOT_FOUND` result rather than a throw, because a stream must answer the
+     * `UNKNOWN_OPERATION` result rather than a throw, because a stream must answer the
      * line that was wrong and keep reading the ones that follow.
      */
     invoke(command: string, args: Record<string, unknown>): Promise<CliInvocationResult>;
@@ -137,6 +138,7 @@ export declare function createCliInvoker<TAuth = unknown, TContext extends Recor
  */
 export declare function buildCliSurface<TAuth, TContext extends Record<string, unknown>, TGlobals extends ZodObject>(config: CliInvokerConfig<TAuth, TContext, TGlobals>, auth: Awaited<TAuth> | undefined, nativeHelp: Map<string, CliCommandPresentation>, applicationGlobalNames: ReadonlySet<string>, shapeIssue?: (name: string, descriptor: CliCommandPresentation, exists: boolean, passthroughField: string | undefined, globalNames: ReadonlySet<string>) => string | undefined): {
     tools: Map<string, MountableTool>;
+    streams: Map<string, CliStreamOperation>;
     help: Map<string, CliCommandPresentation>;
 };
 /** How a managed tool presents itself — the same shape a native command builds. */

package/dist/tools/cli/invoke.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"invoke.d.ts","sourceRoot":"","sources":["../../../src/tools/cli/invoke.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,KAAK,UAAU,EAA4C,MAAM,mBAAmB,CAAC;AAC9F,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAGzE,OAAO,EACL,KAAK,oBAAoB,EAI1B,MAAM,WAAW,CAAC;AACnB,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AACzD,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EACjC,MAAM,UAAU,CAAC;AAElB,MAAM,MAAM,gBAAgB,CAAC,KAAK,EAAE,MAAM,IACtC,SAAS,MAAM,EAAE,GACjB,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,KAAK,SAAS,MAAM,EAAE,CAAC,CAAC;AAE9D;;;;GAIG;AACH,MAAM,WAAW,gBAAgB,CAC/B,KAAK,GAAG,OAAO,EACf,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClE,QAAQ,SAAS,SAAS,GAAG,SAAS,CACtC,SAAQ,2BAA2B;IACnC,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,QAAQ,CAAC,EAAE,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC/C,uFAAuF;IACvF,YAAY,CAAC,EAAE,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IAC9D,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC3C,IAAI,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACtE,aAAa,CAAC,EAAE,QAAQ,CAAC;IACzB,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;IACtF,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAiBD,4EAA4E;AAC5E,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,2DAA2D;IAC3D,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,CAAC;IACF;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;AAED,oCAAoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,gEAAgE;AAChE,MAAM,WAAW,UAAU;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAChD;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACtF;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE;IAAE,SAAS,CAAC,EAAE,WAAW,CAAC;IAAC,SAAS,CAAC,EAAE,WAAW,CAAA;CAAE,GAC3D,mBAAmB,CAkBrB;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,GAAG,OAAO,EACf,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClE,QAAQ,SAAS,SAAS,GAAG,SAAS,EAEtC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,EACnD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,UAAU,CAAC,CA6DrB;AAgED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EACL,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,QAAQ,SAAS,SAAS,EAE1B,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,EACnD,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,EAChC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,EAC/C,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAAC,EAC3C,UAAU,CAAC,EAAE,CACX,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,OAAO,EACf,gBAAgB,EAAE,MAAM,GAAG,SAAS,EACpC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,KAC7B,MAAM,GAAG,SAAS,GACtB;IAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAA;CAAE,CAmClF;AAED,mFAAmF;AACnF,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,aAAa,GAClB,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,aAAa,CAAC,CAMzD"}
+{"version":3,"file":"invoke.d.ts","sourceRoot":"","sources":["../../../src/tools/cli/invoke.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,KAAK,UAAU,EAA4C,MAAM,mBAAmB,CAAC;AAE9F,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAGzE,OAAO,EACL,KAAK,oBAAoB,EAM1B,MAAM,WAAW,CAAC;AACnB,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AACzD,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EAEjC,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,KAAK,kBAAkB,EAAqB,MAAM,kBAAkB,CAAC;AAE9E,MAAM,MAAM,gBAAgB,CAAC,KAAK,EAAE,MAAM,IACtC,SAAS,MAAM,EAAE,GACjB,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,KAAK,SAAS,MAAM,EAAE,CAAC,CAAC;AAE9D;;;;GAIG;AACH,MAAM,WAAW,gBAAgB,CAC/B,KAAK,GAAG,OAAO,EACf,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClE,QAAQ,SAAS,SAAS,GAAG,SAAS,CACtC,SAAQ,2BAA2B;IACnC,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,QAAQ,CAAC,EAAE,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC/C,uFAAuF;IACvF,YAAY,CAAC,EAAE,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IAC9D,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC3C,IAAI,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACtE,aAAa,CAAC,EAAE,QAAQ,CAAC;IACzB,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;IACtF,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAiBD,4EAA4E;AAC5E,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,2DAA2D;IAC3D,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,CAAC;IACF;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;AAED,oCAAoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,gEAAgE;AAChE,MAAM,WAAW,UAAU;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAChD;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACtF;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE;IAAE,SAAS,CAAC,EAAE,WAAW,CAAC;IAAC,SAAS,CAAC,EAAE,WAAW,CAAA;CAAE,GAC3D,mBAAmB,CAkBrB;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,GAAG,OAAO,EACf,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClE,QAAQ,SAAS,SAAS,GAAG,SAAS,EAEtC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,EACnD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,UAAU,CAAC,CAmErB;AAmFD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EACL,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,QAAQ,SAAS,SAAS,EAE1B,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,EACnD,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,EAChC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,EAC/C,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAAC,EAC3C,UAAU,CAAC,EAAE,CACX,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,sBAAsB,EAClC,MAAM,EAAE,OAAO,EACf,gBAAgB,EAAE,MAAM,GAAG,SAAS,EACpC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,KAC7B,MAAM,GAAG,SAAS,GACtB;IACD,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAClC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACzC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;CAC3C,CAyEA;AAED,mFAAmF;AACnF,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,aAAa,GAClB,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,aAAa,CAAC,CAOzD"}

package/dist/tools/cli/io.d.ts

@@ -2,6 +2,12 @@ import type { CliConfig } from './config.js';
 /** Where one invocation writes, reads and exits — injected sinks or the real process. */
 export interface CliIo {
     stdout: (text: string) => void;
+    /**
+     * Write to stdout and say whether its reader is still there. A feed has to
+     * learn that nobody reads it — `head -1` closing the pipe ends the command;
+     * an ordinary result is written once and has nothing to stop.
+     */
+    stdoutWhileOpen: (text: string) => boolean;
     stderr: (text: string) => void;
     exit: (code: number) => void;
     readStdin: () => Promise<string | null>;

package/dist/tools/cli/io.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"io.d.ts","sourceRoot":"","sources":["../../../src/tools/cli/io.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAG1C,yFAAyF;AACzF,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACzC;AAED,wBAAgB,WAAW,CACzB,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC,GAC9D,KAAK,CAqEP"}
+{"version":3,"file":"io.d.ts","sourceRoot":"","sources":["../../../src/tools/cli/io.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAG1C,yFAAyF;AACzF,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B;;;;OAIG;IACH,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACzC;AAOD,wBAAgB,WAAW,CACzB,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC,GAC9D,KAAK,CAuFP"}

package/dist/tools/cli/managed-surface.d.ts

@@ -3,6 +3,7 @@ import { type ToolResult } from '../execute-result.js';
 import type { MountableTool } from '../mount.js';
 import type { CliCommandPresentation } from './policy.js';
 import type { CliSession } from './session.js';
+import type { CliStreamOperation } from './stream-surface.js';
 /**
  * The managed surface, or the reason there isn't one.
  *
@@ -19,6 +20,7 @@ export type ManagedSurface<TAuth> = {
     auth: Awaited<TAuth> | undefined;
     help: Map<string, CliCommandPresentation>;
     tools: Map<string, MountableTool>;
+    streams: Map<string, CliStreamOperation>;
 } | {
     resolved: false;
     failure: Extract<ToolResult, {

package/dist/tools/cli/managed-surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"managed-surface.d.ts","sourceRoot":"","sources":["../../../src/tools/cli/managed-surface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxC,OAAO,EAAE,KAAK,UAAU,EAA4C,MAAM,mBAAmB,CAAC;AAC9F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAG9C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C;;;;;;;;;;GAUG;AACH,MAAM,MAAM,cAAc,CAAC,KAAK,IAC5B;IACE,QAAQ,EAAE,IAAI,CAAC;IACf,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC;IACjC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAC1C,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CACnC,GACD;IACE,QAAQ,EAAE,KAAK,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE;QAAE,EAAE,EAAE,KAAK,CAAA;KAAE,CAAC,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;CAC3C,CAAC;AAEN,wBAAsB,mBAAmB,CACvC,KAAK,EACL,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,QAAQ,SAAS,SAAS,EAE1B,OAAO,EAAE,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAC9C,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAChC,YAAY,EAAE,OAAO,GACpB,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAuChC"}
+{"version":3,"file":"managed-surface.d.ts","sourceRoot":"","sources":["../../../src/tools/cli/managed-surface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxC,OAAO,EAAE,KAAK,UAAU,EAA4C,MAAM,mBAAmB,CAAC;AAC9F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAG9C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,MAAM,MAAM,cAAc,CAAC,KAAK,IAC5B;IACE,QAAQ,EAAE,IAAI,CAAC;IACf,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC;IACjC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAC1C,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAClC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CAC1C,GACD;IACE,QAAQ,EAAE,KAAK,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE;QAAE,EAAE,EAAE,KAAK,CAAA;KAAE,CAAC,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;CAC3C,CAAC;AAEN,wBAAsB,mBAAmB,CACvC,KAAK,EACL,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,QAAQ,SAAS,SAAS,EAE1B,OAAO,EAAE,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAC9C,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAChC,YAAY,EAAE,OAAO,GACpB,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAuChC"}

package/dist/tools/cli/policy.d.ts

@@ -1,4 +1,6 @@
+import type { ZodType } from 'zod';
 import { describeSchemaFields } from './args-fields.js';
+import type { CliResultPolicy } from './command.js';
 export interface CliPresentationPolicyConfig {
     /** Command selected when argv contains no explicit command. */
     defaultCommand?: string;
@@ -6,6 +8,12 @@ export interface CliPresentationPolicyConfig {
     optionAliases?: Readonly<Record<string, Readonly<Record<string, string>>>>;
     /** Exact ordered argv-positional fields per command; an empty array disables positionals. */
     positionals?: Readonly<Record<string, readonly string[]>>;
+    /**
+     * Terminal presentation and success exit code of a managed command's result,
+     * keyed by command name — `{ lookup: defineCliResult(LookupOutput, { present, exitCode }) }`.
+     * Declared where the CLI is mounted, because a client and a server print nothing.
+     */
+    results?: Readonly<Record<string, CliResultPolicy<unknown>>>;
 }
 export interface CliCommandPresentation {
     description: string;
@@ -13,6 +21,10 @@ export interface CliCommandPresentation {
     unavailableReason?: string;
     argumentSchema: Parameters<typeof describeSchemaFields>[0];
     presentationSchema: Record<string, unknown>;
+    /** The schema a successful result is validated against; absent when none is declared. */
+    outputSchema?: ZodType;
+    /** A contract stream: the command prints a line per item, and `outputSchema` is one item. */
+    stream?: true;
     /** Canonical field name → one short alias. */
     aliases: ReadonlyMap<string, string>;
     /**
@@ -23,6 +35,8 @@ export interface CliCommandPresentation {
      */
     positionals?: readonly string[];
 }
+/** The result policy mounted for one command, if any. */
+export declare function cliResultPolicy(config: Pick<CliPresentationPolicyConfig, 'results'>, command: string): CliResultPolicy<unknown> | undefined;
 export declare function applyCliPresentationPolicy(command: string, descriptor: Omit<CliCommandPresentation, 'aliases' | 'positionals'>, config: CliPresentationPolicyConfig): CliCommandPresentation;
 /** Validate name-keyed policies only when the complete managed surface has resolved. */
 export declare function assertCliPoliciesResolved(commands: ReadonlyMap<string, CliCommandPresentation>, config: CliPresentationPolicyConfig): void;

package/dist/tools/cli/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/tools/cli/policy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,WAAW,2BAA2B;IAC1C,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,6FAA6F;IAC7F,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CAC3D;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,8CAA8C;IAC9C,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC;AAkFD,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,aAAa,CAAC,EACnE,MAAM,EAAE,2BAA2B,GAClC,sBAAsB,CAexB;AAED,wFAAwF;AACxF,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,sBAAsB,CAAC,EACrD,MAAM,EAAE,2BAA2B,GAClC,IAAI,CAWN"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/tools/cli/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAGnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,MAAM,WAAW,2BAA2B;IAC1C,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,6FAA6F;IAC7F,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1D;;;;OAIG;IACH,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,yFAAyF;IACzF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,6FAA6F;IAC7F,MAAM,CAAC,EAAE,IAAI,CAAC;IACd,8CAA8C;IAC9C,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC;AAkFD,yDAAyD;AACzD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,IAAI,CAAC,2BAA2B,EAAE,SAAS,CAAC,EACpD,OAAO,EAAE,MAAM,GACd,eAAe,CAAC,OAAO,CAAC,GAAG,SAAS,CAItC;AAED,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,aAAa,CAAC,EACnE,MAAM,EAAE,2BAA2B,GAClC,sBAAsB,CAexB;AAED,wFAAwF;AACxF,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,sBAAsB,CAAC,EACrD,MAAM,EAAE,2BAA2B,GAClC,IAAI,CAYN"}

package/dist/tools/cli/run-managed.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-managed.d.ts","sourceRoot":"","sources":["../../../src/tools/cli/run-managed.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,KAAK,CAAC;AAYrC,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,UAAU,EAAkB,MAAM,WAAW,CAAC;AAQ3E,wFAAwF;AACxF,wBAAsB,oBAAoB,CACxC,KAAK,EACL,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,QAAQ,SAAS,SAAS,EAC1B,OAAO,EAAE,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAkC1F"}
+{"version":3,"file":"run-managed.d.ts","sourceRoot":"","sources":["../../../src/tools/cli/run-managed.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,KAAK,CAAC;AAerC,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,UAAU,EAGhB,MAAM,WAAW,CAAC;AAQnB,wFAAwF;AACxF,wBAAsB,oBAAoB,CACxC,KAAK,EACL,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,QAAQ,SAAS,SAAS,EAC1B,OAAO,EAAE,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAkC1F"}

package/dist/tools/cli/run-native.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-native.d.ts","sourceRoot":"","sources":["../../../src/tools/cli/run-native.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,KAAK,CAAC;AACrC,OAAO,EACL,KAAK,oBAAoB,EAG1B,MAAM,WAAW,CAAC;AAInB,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,UAAU,EAAkB,MAAM,WAAW,CAAC;AAE3E;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EACL,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,QAAQ,SAAS,SAAS,EAE1B,OAAO,EAAE,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAC9C,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,EACzB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,IAAI,CAAC,CA0Ef"}
+{"version":3,"file":"run-native.d.ts","sourceRoot":"","sources":["../../../src/tools/cli/run-native.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,KAAK,CAAC;AACrC,OAAO,EACL,KAAK,oBAAoB,EAI1B,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,UAAU,EAGhB,MAAM,WAAW,CAAC;AAEnB;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EACL,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,QAAQ,SAAS,SAAS,EAE1B,OAAO,EAAE,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAC9C,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,EACzB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAgEf"}

package/dist/tools/cli/run-stream.d.ts

@@ -0,0 +1,23 @@
+import type { ZodObject } from 'zod';
+import type { CliRunOptions } from './args.js';
+import type { ManagedSurface } from './managed-surface.js';
+import { type CliRoute, type CliSession } from './session.js';
+import type { CliStreamOperation } from './stream-surface.js';
+type ResolvedManagedSurface<TAuth> = Extract<ManagedSurface<TAuth>, {
+    resolved: true;
+}>;
+/**
+ * Run one contract stream as a command: a line per item until the stream
+ * completes, fails, is cancelled, or its reader goes away.
+ *
+ * The call opens through the shared tool runner — the same validation, the
+ * same `lifecycle.beforeHandle` gate, the same hooks as every other command —
+ * and what the handler returns is read under the contract's own stream
+ * descriptor, exactly as the HTTP response reads it.
+ */
+export declare function runStreamCommand<TAuth, TContext extends Record<string, unknown>, TGlobals extends ZodObject>(session: CliSession<TAuth, TContext, TGlobals>, route: CliRoute<TGlobals>, managed: ResolvedManagedSurface<TAuth>, stream: CliStreamOperation, { toolArgs, options }: {
+    toolArgs: Record<string, unknown>;
+    options: CliRunOptions;
+}): Promise<void>;
+export {};
+//# sourceMappingURL=run-stream.d.ts.map

package/dist/tools/cli/run-stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-stream.d.ts","sourceRoot":"","sources":["../../../src/tools/cli/run-stream.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,KAAK,CAAC;AASrC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAG5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,UAAU,EAAkB,MAAM,WAAW,CAAC;AAC3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,KAAK,sBAAsB,CAAC,KAAK,IAAI,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC;AAKxF;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EACL,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,QAAQ,SAAS,SAAS,EAE1B,OAAO,EAAE,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAC9C,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,EACzB,OAAO,EAAE,sBAAsB,CAAC,KAAK,CAAC,EACtC,MAAM,EAAE,kBAAkB,EAC1B,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GACnF,OAAO,CAAC,IAAI,CAAC,CA0Df"}

package/dist/tools/cli/session.d.ts

@@ -28,12 +28,20 @@ export interface CliRoute<TGlobals extends ZodObject> {
     commandArgv: string[];
     beforeSeparator: string[];
     helpRequested: boolean;
+    /** `--schema` — answered like help: before identity, validation and the call. */
+    schemaRequested: boolean;
 }
 /**
  * Lift the application's globals, route the rest and answer `--version`.
  * `undefined` means the invocation was already answered and `exit` was called.
  */
 export declare function resolveCliRoute<TAuth, TContext extends Record<string, unknown>, TGlobals extends ZodObject>(session: CliSession<TAuth, TContext, TGlobals>, argv: string[]): CliRoute<TGlobals> | undefined;
+/**
+ * `--schema`: one line of JSON carrying the JSON Schema of a command's input
+ * and of its successful result, converted from the very Zod schemas the call
+ * is validated against.
+ */
+export declare function renderCommandSchema(command: string, descriptor: CliCommandPresentation): string;
 /** The emit options every result path shares; only `json` and the tool name vary. */
 export declare function emitOptionsFor(config: Pick<CliConfig, 'errorHint' | 'exitCodes'>, json: boolean, toolName: string): EmitOptions;
 //# sourceMappingURL=session.d.ts.map

package/dist/tools/cli/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/tools/cli/session.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxC,OAAO,EAAE,KAAK,eAAe,EAAoB,MAAM,+BAA+B,CAAC;AAIvF,OAAO,EACL,KAAK,YAAY,EAIlB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,KAAK,oBAAoB,EAAgC,MAAM,WAAW,CAAC;AAEpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAClC,OAAO,EAA8B,KAAK,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAYnF,MAAM,WAAW,UAAU,CACzB,KAAK,EACL,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,QAAQ,SAAS,SAAS;IAE1B,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC7C,EAAE,EAAE,KAAK,CAAC;IACV,kBAAkB,EAAE,SAAS,eAAe,EAAE,CAAC;IAC/C,sBAAsB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAClD,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;CACjD;AAED,0FAA0F;AAC1F,wBAAgB,gBAAgB,CAC9B,KAAK,EACL,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,QAAQ,SAAS,SAAS,EAE1B,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAC5C,EAAE,EAAE,KAAK,GACR,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAiDvC;AAED,MAAM,WAAW,QAAQ,CAAC,QAAQ,SAAS,SAAS;IAClD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjC,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EACL,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,QAAQ,SAAS,SAAS,EAE1B,OAAO,EAAE,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAC9C,IAAI,EAAE,MAAM,EAAE,GACb,QAAQ,CAAC,QAAQ,CAAC,GAAG,SAAS,CA4DhC;AAED,qFAAqF;AACrF,wBAAgB,cAAc,CAC5B,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,GAAG,WAAW,CAAC,EAClD,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,MAAM,GACf,WAAW,CAOb"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/tools/cli/session.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxC,OAAO,EACL,KAAK,eAAe,EAGrB,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EACL,KAAK,YAAY,EAIlB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,KAAK,oBAAoB,EAAgC,MAAM,WAAW,CAAC;AAEpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAClC,OAAO,EAA8B,KAAK,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAanF,MAAM,WAAW,UAAU,CACzB,KAAK,EACL,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,QAAQ,SAAS,SAAS;IAE1B,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC7C,EAAE,EAAE,KAAK,CAAC;IACV,kBAAkB,EAAE,SAAS,eAAe,EAAE,CAAC;IAC/C,sBAAsB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAClD,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;CACjD;AAED,0FAA0F;AAC1F,wBAAgB,gBAAgB,CAC9B,KAAK,EACL,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,QAAQ,SAAS,SAAS,EAE1B,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAC5C,EAAE,EAAE,KAAK,GACR,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAiDvC;AAED,MAAM,WAAW,QAAQ,CAAC,QAAQ,SAAS,SAAS;IAClD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjC,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,iFAAiF;IACjF,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EACL,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,QAAQ,SAAS,SAAS,EAE1B,OAAO,EAAE,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAC9C,IAAI,EAAE,MAAM,EAAE,GACb,QAAQ,CAAC,QAAQ,CAAC,GAAG,SAAS,CAgEhC;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,sBAAsB,GACjC,MAAM,CAcR;AAED,qFAAqF;AACrF,wBAAgB,cAAc,CAC5B,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,GAAG,WAAW,CAAC,EAClD,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,MAAM,GACf,WAAW,CAOb"}

package/dist/tools/cli/stream-surface.d.ts

@@ -0,0 +1,17 @@
+import type { EndpointStreamDescriptor } from '../../contract/define.js';
+import type { ServiceDef } from '../../server/types.js';
+import type { MountableTool } from '../mount.js';
+/** One contract stream exposed as a command: how it is called and what it yields. */
+export interface CliStreamOperation {
+    tool: MountableTool;
+    descriptor: EndpointStreamDescriptor;
+}
+/**
+ * The contract streams a CLI carries, by command name.
+ *
+ * A stream is not a tool — a model call has one answer — so the tool surface
+ * never projects it. A terminal can carry a feed, a line per item, and this is
+ * the walk that finds the streams whose contract says so (`expose` lists `'CLI'`).
+ */
+export declare function collectCliStreams(services: readonly ServiceDef[]): Map<string, CliStreamOperation>;
+//# sourceMappingURL=stream-surface.d.ts.map

package/dist/tools/cli/stream-surface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-surface.d.ts","sourceRoot":"","sources":["../../../src/tools/cli/stream-surface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAK9C,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,aAAa,CAAC;IACpB,UAAU,EAAE,wBAAwB,CAAC;CACtC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,SAAS,UAAU,EAAE,GAC9B,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAuBjC"}

package/dist/tools/execute.d.ts

@@ -1,5 +1,5 @@
 import type { ZodType, z } from 'zod';
-import type { TransportSource } from '../contract/define.js';
+import type { EndpointStreamDescriptor, TransportSource } from '../contract/define.js';
 import type { RuntimeContext } from '../contract/runtime-context.js';
 import type { EndpointToolView } from '../contract/tool-view.js';
 import type { OperationIdentity } from '../server/types.js';
@@ -19,6 +19,12 @@ export interface ToolOperation extends OperationIdentity {
     outputSchema?: ZodType;
     /** Applied only by a runner built for the tool surface. → ADR 0196. */
     toolView?: EndpointToolView;
+    /**
+     * A contract stream: the handler's answer is the source itself, read item by
+     * item under this descriptor by the surface that carries it. No output schema
+     * applies to the source as a whole.
+     */
+    stream?: EndpointStreamDescriptor;
     handler(ctx: RuntimeContext): unknown | Promise<unknown>;
 }
 /** Executable extension parsed once inside the shared runner before resolution. */

package/dist/tools/execute.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../../src/tools/execute.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAI9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAE,KAAK,UAAU,EAAuB,MAAM,kBAAkB,CAAC;AAIxE,MAAM,MAAM,0BAA0B,GAAG,WAAW,GAAG,iBAAiB,CAAC;AAEzE,2FAA2F;AAC3F,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAE5C,YAAY,MAAM,EAAE,0BAA0B,EAI7C;CACF;AAaD,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,yBAAyB,CAEpC;AAED,4FAA4F;AAC5F,MAAM,WAAW,aAAc,SAAQ,iBAAiB;IACtD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1D;AAED,mFAAmF;AACnF,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC;IACpB,OAAO,EAAE,CACP,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjE;AAKD,wFAAwF;AACxF,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,OAAO,EAAE,eAAe,CAAC;CAC1B;AAED,0EAA0E;AAC1E,MAAM,WAAW,oBAAoB;IACnC,qCAAqC;IACrC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,0FAA0F;IAC1F,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;IAC1C,kEAAkE;IAClE,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,4EAA4E;IAC5E,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,+EAA+E;IAC/E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,QAAQ,EACd,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,UAAU,CAAC,CAgBrB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,IAAI,EAAE;IACJ,MAAM,EAAE,eAAe,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,iBAAiB,CAAC;CAC3B,EACD,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACrB,OAAO,CAAC,CAAC,CAAC,CAuBZ"}
+{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../../src/tools/execute.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,KAAK,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAEpF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAI9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAE,KAAK,UAAU,EAAuB,MAAM,kBAAkB,CAAC;AAIxE,MAAM,MAAM,0BAA0B,GAAG,WAAW,GAAG,iBAAiB,CAAC;AAEzE,2FAA2F;AAC3F,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAE5C,YAAY,MAAM,EAAE,0BAA0B,EAI7C;CACF;AAaD,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,yBAAyB,CAEpC;AAED,4FAA4F;AAC5F,MAAM,WAAW,aAAc,SAAQ,iBAAiB;IACtD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAClC,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1D;AAED,mFAAmF;AACnF,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC;IACpB,OAAO,EAAE,CACP,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjE;AAKD,wFAAwF;AACxF,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,OAAO,EAAE,eAAe,CAAC;CAC1B;AAED,0EAA0E;AAC1E,MAAM,WAAW,oBAAoB;IACnC,qCAAqC;IACrC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,0FAA0F;IAC1F,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;IAC1C,kEAAkE;IAClE,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,4EAA4E;IAC5E,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,+EAA+E;IAC/E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,QAAQ,EACd,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,UAAU,CAAC,CAgBrB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,IAAI,EAAE;IACJ,MAAM,EAAE,eAAe,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,iBAAiB,CAAC;CAC3B,EACD,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACrB,OAAO,CAAC,CAAC,CAAC,CAuBZ"}

package/dist/tools/invoker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"invoker.d.ts","sourceRoot":"","sources":["../../src/tools/invoker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAEzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAE,KAAK,UAAU,EAAuB,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAsD,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAG9F,wEAAwE;AACxE,MAAM,WAAW,iBAAiB;IAChC,iFAAiF;IACjF,SAAS,EAAE,aAAa,CAAC;IACzB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,+EAA+E;IAC/E,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,mFAAmF;AACnF,MAAM,WAAW,qBAAqB;IACpC,oFAAoF;IACpF,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,OAAO,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IAC1C,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,yDAAyD;IACzD,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;CAC7D;AAED,sFAAsF;AACtF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,MAAM,CACJ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,UAAU,CAAC,CAAC;IACvB,aAAa,CACX,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,UAAU,GAAG,SAAS,UAAU,EAAE,EAC5C,MAAM,EAAE,iBAAiB,GACxB,WAAW,CAgEb"}
+{"version":3,"file":"invoker.d.ts","sourceRoot":"","sources":["../../src/tools/invoker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAEzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAE,KAAK,UAAU,EAAuB,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAsD,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAG9F,wEAAwE;AACxE,MAAM,WAAW,iBAAiB;IAChC,iFAAiF;IACjF,SAAS,EAAE,aAAa,CAAC;IACzB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,+EAA+E;IAC/E,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,mFAAmF;AACnF,MAAM,WAAW,qBAAqB;IACpC,oFAAoF;IACpF,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,OAAO,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IAC1C,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,yDAAyD;IACzD,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;CAC7D;AAED,sFAAsF;AACtF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,MAAM,CACJ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,UAAU,CAAC,CAAC;IACvB,aAAa,CACX,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,UAAU,GAAG,SAAS,UAAU,EAAE,EAC5C,MAAM,EAAE,iBAAiB,GACxB,WAAW,CAiEb"}

package/dist/tools/remote.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../../src/tools/remote.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAKnE,OAAO,KAAK,EAAa,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAkE7D,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,aAAa,CAAC,EAAE,CACd,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACnE,QAAQ,EAAE,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,EAChC,IAAI,EAAE,UAAU,EAChB,OAAO,CAAC,EAAE,sBAAsB,GAC/B,UAAU,CAgEZ"}
+{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../../src/tools/remote.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAKnE,OAAO,KAAK,EAAa,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAkE7D,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,aAAa,CAAC,EAAE,CACd,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjE;AAYD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACnE,QAAQ,EAAE,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,EAChC,IAAI,EAAE,UAAU,EAChB,OAAO,CAAC,EAAE,sBAAsB,GAC/B,UAAU,CAmEZ"}

package/llms/cli.2.txt

@@ -292,6 +292,59 @@ your server. A channel is two documents at two addresses — which of them a bui
 consults is your decision, and `assertCliPublishable` is told about all of them
 rather than taught the shape of any.
 
+## A contract stream as a command
+
+A streaming endpoint whose `expose` lists `'CLI'` is a command that prints one
+line per item — `['HTTP', 'CLI']` for a stream both carry, `['CLI']` for a feed
+only a terminal reads:
+
+```ts
+watch: {
+  method: 'POST', path: '/watch', desc: 'Follow record events',
+  expose: ['HTTP', 'CLI'],
+  input: z.object({ record: z.string() }),
+  stream: { item: RecordEvent },
+}
+```
+
+```sh
+myapp watch_record --record main | head -n 5
+```
+
+The command is named from the contract prefix and the endpoint key
+(`records.watch` → `watch_record`); a stream takes no `tool` group, so it has no
+`tool.name`. `optionAliases` and `positionals` apply as to any command.
+
+The call opens through the same runner as every command — validation, the
+`lifecycle.beforeHandle` gate, hooks — and the handler's async iterable is read
+by the loop the HTTP response uses: each item is validated against
+`stream.item` (`STREAM_ITEM_INVALID` otherwise), a declared `terminal` item
+completes the command, and a stream that ends before it fails with
+`STREAM_TERMINAL_MISSING`. A stream proxied by `implementRemote` is a stream
+here too. Without a policy an item is one compact JSON line;
+`results[command].present` formats each item instead. A presenter that throws
+ends the feed with `CLI_PRESENTATION_FAILED` after the lines already printed.
+`exitCode` is refused for a stream at startup — a feed has no single result to
+classify.
+
+How a feed ends:
+
+| End | stdout / stderr | Exit |
+| --- | --- | --- |
+| the stream completes | every item | `0` |
+| stdout is closed (`head`, a pager that quit) | the items read so far | `0` |
+| `CliConfig.signal` aborts | nothing more, no error | `130` (`REQUEST_ABORTED`) |
+| `stream.lifetimeMs` passes | `STREAM_LIFETIME_EXCEEDED` on stderr | `7` |
+| the source or an item fails | the error on stderr | by its code |
+
+In every case the handler's `ctx.signal` aborts and the source is asked to
+close. The command does not wait for a source that ignores its signal: the
+deadline and the cancellation are the command's, not the source's.
+
+`--wait`, `--output-dir` and aggregate views do not apply to a stream and exit
+`2`; a stream command is not reachable through `createCliInvoker`, whose answer
+is one result per line.
+
 ## One operation per line — `createCliInvoker`
 
 The most common way an agent drives a CLI is not one command: it is a stream —
@@ -344,7 +397,7 @@ await createCliInvoker({ name: 'myapp', services, commands: [describe] })
 ```
 
 A command that declares `output?: never` prints itself and returns nothing, so
-there is no result to hand back; it answers `NOT_FOUND` and stays on the command
+there is no result to hand back; it answers `UNKNOWN_OPERATION` and stays on the command
 line, where stdout exists. Your stream command is one of these, which is why a
 stream still cannot invoke itself.
 
@@ -573,6 +626,7 @@ SDK nor the `ai` peer.
 |--------|------|---------|
 | `createCli` | function | build and run a CLI from contracts; a runtime catalogue field conflicting with reserved/global argv options disables only that entry, retained in help with its reason; invocation returns `CLI_COMMAND_UNAVAILABLE` before side effects — [guide](../guide/cli.md#when-one-runtime-command-cannot-be-represented-in-argv) |
 | `defineCliCommand` | function | define one Zod-typed CLI-only executable command with optional validated-result presentation/exit policy |
+| `defineCliResult` | function | type a managed command's `present` / `exitCode` policy against its output schema, for `CliConfig.results` — [guide](../guide/cli.md#the-same-policy-for-a-managed-command) |
 | `parseCliArgs` | function | argv → typed tool args against a schema; inline `--field:=JSON` assigns a whole JSON value, including null, while ordinary string flags remain lexical; named array options together with bare positionals require an explicit `positionals` policy (advanced) |
 | `routeCliArgv` | function | select the command out of argv without duplicating the global-option grammar (advanced) |
 | `extractCliGlobalOptions` | function | lift the application's own global options out of argv before routing (advanced) |
@@ -623,6 +677,7 @@ SDK nor the `ai` peer.
 | `CliCommandDefinitionBase` | _type_ | native command name, description and input schema |
 | `CliCommandDefinitionWithOutput` | _type_ | native command with validated declared output and typed optional `present` / successful `exitCode` callbacks |
 | `CliCommandDefinitionWithoutOutput` | _type_ | native void command without an output contract |
+| `CliResultPolicy` | _type_ | `present` / successful `exitCode` callbacks of one command, typed against its validated result; `CliConfig.results` holds one per managed command |
 | `CliCommandContext` | _type_ | parsed input, framework run options, the application's `globals` and stdout/stderr writers |
 | `CliRunOptions` | _type_ | parsed global flags (`--json` compacts success/error records, `--wait`, …) |
 | `ParsedCliArgs` | _type_ | result of `parseCliArgs` |

package/llms/cli.txt

@@ -219,6 +219,49 @@ result on stdout and reports `CLI_PRESENTATION_FAILED` separately, as described
 under [Aggregate views](#aggregate-views). Void native commands cannot declare
 either callback.
 
+### The same policy for a managed command
+
+A command that comes from a contract or a runtime tool declares the same two
+callbacks where the CLI is mounted — `CliConfig.results`, keyed by command name.
+A client and a server print nothing, so the policy belongs to the CLI, not to
+the contract. `defineCliResult` types both callbacks against the operation's
+output schema:
+
+```ts
+import { createCli, defineCliResult } from 'stitchkit/cli'
+
+await createCli({
+  name: 'myapp',
+  version: '1.0.0',
+  services: [recordService],
+  results: {
+    lookup: defineCliResult(LookupOutput, {
+      present: ({ result, options }) =>
+        options.json ? `${JSON.stringify(result)}\n` : `${result.location ?? 'not found'}\n`,
+      exitCode: (result) => (result.found ? 0 : 1),
+    }),
+  },
+})
+```
+
+The guarantees are the native ones, because one function applies both: the
+callbacks run only after the operation's output is validated, `present` is
+called with and without `--json` — honouring it is the presenter's — and
+returns the exact stdout bytes, a throwing `present` reports
+`CLI_PRESENTATION_FAILED`, and a throwing or out-of-range `exitCode` becomes
+`INTERNAL_SERVER_ERROR`.
+
+The schema handed to `defineCliResult` is the command's own output schema — the
+object the contract declares, or the item schema of a stream. A policy typed
+against any other schema is a startup error, as is a key naming no managed
+command or naming a native one.
+
+The policy speaks for the command's own result only. An
+[aggregate view](#aggregate-views) (`--table`, `--count-by`, …) answers a
+different question, and after `--wait` the result is the polled command's, so
+both print without the policy. `createCliInvoker` applies `exitCode` — the
+in-process code equals the printed one — and never calls `present`.
+
 `--version`, a selected native command and its command help run before
 `resolveAuth`, services, context or runtime-tool factories. Top-level help is
 also credential-free when managed surfaces are static. A dynamic factory must
@@ -417,6 +460,7 @@ same Zod schema an HTTP or MCP call does.
 | `--output-dir <dir>`  | Download result media into a directory                     |
 | `--quiet`             | Suppress non-essential stderr output                       |
 | `--dry-run`           | Print the resolved call without executing                  |
+| `--schema`            | One JSON line: the JSON Schema of a command's input and output |
 | `--help`, `-h`        | Usage — top-level or per-command flag table                |
 | `--help <text>`       | List only the commands matching a substring                |
 | `--count-by <field>`  | Count records per distinct value — see [Aggregate views](#aggregate-views) |
@@ -432,9 +476,32 @@ newline-terminated JSON record on its respective stream; progress and CLI usage
 diagnostics remain ordinary stderr text. This keeps stdout pipeable and
 `2>/dev/null` clean. The process exit code carries the error class (`0` ok,
 `VALIDATION_ERROR → 1`, `UNAUTHORIZED → 2`, `FORBIDDEN → 3`, `NOT_FOUND → 4`,
+`UNKNOWN_OPERATION → 4`, `TIMEOUT → 7`, `STREAM_LIFETIME_EXCEEDED → 7`,
 `CLI_PRESENTATION_FAILED → 8`,
 …) — override per app with `exitCodes`.
 
+### The schema of a command — `--schema`
+
+`myapp <command> --schema` prints one line of JSON and exits `0` without
+validating arguments or calling anything:
+
+```json
+{"command":"lookup","input":{"type":"object","properties":{"name":{"type":"string"}},"required":["name"]},"output":{"type":"object","properties":{"found":{"type":"boolean"}},"required":["found"]}}
+```
+
+`input` is the schema the command's arguments are read by — the one `--help`
+renders — and `output` is the JSON Schema of the result, both derived from the
+operation's Zod schemas and both in JSON Schema draft-07, so a script or another
+program can hold a command to its schema without a copy. A command without a
+declared output carries no `output`; a
+[stream command](#a-contract-stream-as-a-command) carries `item` instead.
+Managed and native commands answer alike. Like `--help`, the answer needs no
+identity when the managed surface is static; a surface built by a
+`services` or `runtimeTools` function resolves identity first to learn its
+commands. `schema` is a reserved option name: a command field called `schema`
+is a startup error for a contract command and makes a runtime-catalogue command
+unavailable, like every other reserved name.
+
 ### A narrower question than "all of them"
 
 On a discovered surface `--help` is the only way to learn what exists, and that
@@ -519,7 +586,7 @@ reason in `details.message` on stderr; the default exit code is 1. `--json`
 compacts the error as usual; `exitCodes` and `errorHint` apply. The refusal precedes
 command argument parsing, stdin, context, hooks and the handler; `--dry-run` cannot
 turn it into success. A known unavailable `--wait` target returns the same refusal;
-an unknown target keeps `NOT_FOUND`.
+an unknown target answers `UNKNOWN_OPERATION`.
 
 This isolates only reserved/global **field** conflicts in `runtimeTools`.
 Native commands and contract-defined `services` still fail at startup for those

package/llms/contract.txt

@@ -222,7 +222,10 @@ Six intrinsic HTTP-only forms intersect an **implicit factory default** with HTT
 responses and `HEAD`. Under `['HTTP', 'CLI']` they receive `['HTTP']`; under
 `['CLI']` or `[]` they receive `[]`, not an implicitly reopened HTTP route.
 An **explicit** non-HTTP exposure on any of them is a definition error, not a
-silent downgrade. `safelistedBody` only changes HTTP parsing and remains
+silent downgrade — with one exception: a streaming response may list `'CLI'`
+(`['HTTP', 'CLI']`, or `['CLI']` for a feed only a terminal reads) and then runs
+as a [command printing a line per item](./cli.md#a-contract-stream-as-a-command).
+It is still never an MCP or agent tool. `safelistedBody` only changes HTTP parsing and remains
 multi-transport. A factory policy applies only to contracts authored through
 that factory, not to contracts another helper builds internally.
 

package/llms/files-packaging.txt

@@ -49,3 +49,13 @@ has no `outputPath`, because nothing is written beside the executable. Keep comp
 without splitting, preserve every output, and write each asset's `bytes` to its `outputPath`.
 This evolving entrypoint is a build dependency; runtime imports do not reach it.
 The detailed recipe is in [native IO](../guide/native-io.md#public-native-packaging).
+
+It also owns the build of a client into one self-contained file:
+
+| Export | Kind | Summary |
+|--------|------|---------|
+| `buildClientArtifact` | function | bundle a client entry into one self-contained file with its SHA-256, refuse forbidden modules in the graph, optionally pack and verify an npm archive — [guide](../guide/native-io.md#a-client-as-one-self-contained-file) |
+| `ClientArtifactOptions` | _type_ | entry, output file, runtime, forbidden modules and the optional package to pack and verify |
+| `ClientArtifact` | _type_ | the built file, its SHA-256 and size, the bundled modules and the verified archive |
+| `ForbiddenModule` | _type_ | a package name, a source path fragment or a `RegExp` over module paths |
+| `ForbiddenModuleError` | class | the refusal of a bundle that reaches a forbidden module: `module` and `importedBy` |

package/llms/process.2.txt

@@ -5,7 +5,74 @@
 
 Parts of this slice:
 - `llms/process.txt`: Guide: Native IO  (docs/guide/native-io.md)
-- `llms/process.2.txt`: API reference: `stitchkit/process`  (docs/api/reference.md)
+- `llms/process.2.txt`: Guide: Native IO  (docs/guide/native-io.md) · API reference: `stitchkit/process`  (docs/api/reference.md)
+
+==============================================================================
+# Guide: Native IO  (docs/guide/native-io.md)  (continued)
+==============================================================================
+
+## A client as one self-contained file
+
+A package that owns a server usually ships a typed client for it, and the client's consumers
+must not inherit the server's dependencies. `buildClientArtifact` (`stitchkit/files/packaging`)
+bundles one entry module into a single file, publishes its SHA-256 beside it and can prove an
+npm archive of it:
+
+```ts
+import { buildClientArtifact } from 'stitchkit/files/packaging'
+
+const artifact = await buildClientArtifact({
+  entry: 'src/api-client.ts',
+  outFile: 'dist/api-client.js',              // + dist/api-client.js.sha256
+  forbiddenModules: ['chalk', '@acme/terminal-ui', 'src/terminal/', /providers\//],
+  package: {
+    name: '@acme/api-client', version: '1.4.0', outDir: 'dist',
+    exports: ['createApiClient'],
+  },
+})
+// artifact.file, artifact.sha256, artifact.bytes, artifact.modules, artifact.package.tarball
+```
+
+- **`forbiddenModules`** refuses a bundle whose module graph reaches a listed module with a
+  `ForbiddenModuleError` naming the module and what imports it. A bare or scoped name
+  (`'chalk'`, `'@scope/pkg'`) is a package: it is matched by the specifier that imports it, so a
+  linked or workspace package is caught wherever it really lives, and by its installed path. A
+  string with a slash matches a fragment of the project's own source path; a `RegExp` is tested
+  against each module's absolute path. Nothing is left at `outFile` when the build is refused.
+- **`package`** packs the file as an npm archive, installs it into an empty directory, imports
+  it by name and checks every name in `exports`. A client that still reaches for the building
+  package's `node_modules` fails there, before it reaches a consumer; a failed proof removes the
+  file and its hash again.
+- **`runtime`** is the platform the file is built for — `node` by default, which Bun also runs,
+  or `bun` or `browser`; a module the platform does not have fails the build.
+
+The build, the pack and the verification each run Bun as a bounded command: `timeoutMs`
+(default 120 s) is the deadline of each step, `signal` cancels, and `executable` names the Bun
+binary when it is not `bun` on `PATH`.
+
+## Qualification boundaries
+
+Native command cleanup owns the child before launch subscriptions are installed. Setup
+refusal still settles leader closure and teardown within the cleanup budget; failure to
+prove closure reports `COMMAND_CLEANUP` with the original failure retained. Process-group
+signaling requires evidence from the actual detached launcher, not a structural PID field.
+The built-in sandbox transport carries that ownership across the package's split entrypoints.
+Internal finite deadlines and Darwin retry admission use monotonic elapsed time.
+
+Linux UID-refusal qualification is a separate privileged installed-package proof in Bun
+and real Node; an unsupported platform or insufficient UID reports an explicit skip.
+A generic native-owner marker does not certify the privileged case. Real Darwin CI remains
+the qualification for native Darwin behavior.
+
+Local filesystem tests do not attest delayed NFS visibility, shared-volume microVM or gVisor
+ownership, actual PGID reuse, power-loss durability or macOS full-sync behavior. Those
+require their actual topology or failure environment. No age-only observation proves a
+process dead; the lock's owner record exists before its name does.
+
+A sandbox admission slot is released once a direct command's pipes have closed and its owner has settled.
+A `COMMAND_CLEANUP` outcome means the death of its group was not proven, so the slot stays
+occupied, `stop` keeps rejecting with the cleanup error, and the sandbox session is recreated to
+recover.
 
 ==============================================================================
 # API reference: `stitchkit/process`  (docs/api/reference.md)
@@ -18,6 +85,13 @@ Native POSIX Bun/Node one-shot command execution. See [native IO](../guide/nativ
 | Export | Kind | Purpose |
 |---|---|---|
 | `runNativeCommand` | function | caller-lifetime streaming or explicitly bounded binary capture |
+| `createOperationProcesses` | function | run contract operations in one-call child processes: `unary` / `stream` return contract handlers bounded by `maxConcurrent`, `maxResponseBytes` and `timeoutMs` — [guide](../guide/native-io.md#a-contract-operation-in-a-process-of-its-own) |
+| `runOperationProcess` | function | the child side: read one call from stdin, run it against `implement(contract, handlers)` services, write the answer |
+| `OperationProcessesConfig` | _type_ | the child command and the three bounds of `createOperationProcesses` |
+| `OperationProcesses` | _type_ | `unary(contract, key)`, `stream(contract, key)` and the `active` count |
+| `OperationCallContext` | _type_ | what a process-operation handler reads of its call: `params`, `input` and the caller's `signal` |
+| `OperationProcessService` | _type_ | what `runOperationProcess` reads of a service; the result of `implement` fits |
+| `OperationProcessIo` | _type_ | injectable call source, writer and stop signal of `runOperationProcess` |
 | `streamNativeCommand` | function | starts a command under the same group ownership, stop policy and bounds as `runNativeCommand` and returns `stdout` / `stderr` as `ReadableStream<Uint8Array>`, `result` and `stop()`; a slow reader slows the child, a cancelled stream drops its bytes, a failed command errors both streams |
 | `NativeCommandStream` | type | what `streamNativeCommand` returns: `stdout`, `stderr`, `result` (its buffers are empty) and `stop()` |
 | `NativeCommandStreamOptions` | type | `NativeCommandOptions` without `capture`, `onOutput` and `stdio`, which the streams own |