stitchkit 0.60.0 → 0.60.1

package/dist/{index-6fbp58g8.js → index-tvwcrx2d.js}

@@ -1,13 +1,15 @@
 import {
-  AppError,
   isUnsafeKey
-} from "./index-v6e8hnkx.js";
+} from "./index-wd8g8z6e.js";
 import {
   resolveTraceContext
 } from "./index-pzyt11ch.js";
 import {
   isRecord
 } from "./index-smpbdg6k.js";
+import {
+  AppError
+} from "./index-xxye8j3k.js";
 
 // src/internal/errors.ts
 import { z } from "zod";

package/dist/{index-v6e8hnkx.js → index-wd8g8z6e.js}

@@ -2,89 +2,6 @@ import {
   parseTrailingWildcard
 } from "./index-pzyt11ch.js";
 
-// src/contract/errors.ts
-var APP_ERROR_BRAND = Symbol.for("stitchkit.AppError");
-
-class AppError extends Error {
-  code;
-  status;
-  details;
-  hint;
-  traceId;
-  constructor(code, message, status = 500, details, hint, traceId) {
-    super(message ?? code);
-    this.code = code;
-    this.status = status;
-    this.details = details;
-    this.hint = hint;
-    this.traceId = traceId;
-    this.name = "AppError";
-    Object.defineProperty(this, APP_ERROR_BRAND, { value: true });
-  }
-  static is(err) {
-    return typeof err === "object" && err !== null && APP_ERROR_BRAND in err;
-  }
-  toJSON() {
-    return {
-      error: {
-        code: this.code,
-        message: this.message,
-        ...this.details && { details: this.details },
-        ...this.hint && { hint: this.hint }
-      }
-    };
-  }
-}
-function notFound(message = "Not found") {
-  throw new AppError("NOT_FOUND", message, 404);
-}
-function badRequest(message, details) {
-  throw new AppError("BAD_REQUEST", message, 400, details);
-}
-function unauthorized(message = "Unauthorized") {
-  throw new AppError("UNAUTHORIZED", message, 401);
-}
-function forbidden(message = "Forbidden") {
-  throw new AppError("FORBIDDEN", message, 403);
-}
-function conflict(message = "Conflict", details) {
-  throw new AppError("CONFLICT", message, 409, details);
-}
-function rateLimited(message = "Too many requests") {
-  throw new AppError("RATE_LIMITED", message, 429);
-}
-var STITCH_ERROR_STATUS = {
-  BAD_REQUEST: 400,
-  UNAUTHORIZED: 401,
-  FORBIDDEN: 403,
-  NOT_FOUND: 404,
-  METHOD_NOT_ALLOWED: 405,
-  CONFLICT: 409,
-  RATE_LIMITED: 429,
-  VALIDATION_ERROR: 400,
-  FILE_INVALID_PATH: 400,
-  FILE_OUTSIDE_ROOT: 400,
-  FILE_NOT_FOUND: 404,
-  FILE_NOT_REGULAR: 422,
-  FILE_INSPECTION_REJECTED: 422,
-  FILE_TOO_LARGE: 413,
-  FILE_EXISTS: 409,
-  REALTIME_CONTRACT_VIOLATION: 500,
-  APPLICATION_NOT_ACCEPTING: 503,
-  WAIT_TIMEOUT: 408,
-  WAIT_FAILED: 409,
-  DOWNLOAD_NOT_FOUND: 404,
-  VIEW_HTTP_ERROR: 502,
-  OPERATION_NOT_SUCCEEDED: 409,
-  INTERNAL_SERVER_ERROR: 500
-};
-function isStitchErrorCode(code) {
-  return Object.hasOwn(STITCH_ERROR_STATUS, code);
-}
-function appError(code, message, details) {
-  throw new AppError(code, message, isStitchErrorCode(code) ? STITCH_ERROR_STATUS[code] : 500, details);
-}
-
 // src/contract/define.ts
 import { z } from "zod";
 
@@ -286,4 +203,4 @@ function base64UrlToBytes(segment) {
   const padded = b64.padEnd(Math.ceil(b64.length / 4) * 4, "=");
   return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
 }
-export { isUnsafeKey, safeJsonParse, defineContract, mergeMeta, AppError, notFound, badRequest, unauthorized, forbidden, conflict, rateLimited, STITCH_ERROR_STATUS, isStitchErrorCode, appError, bytesToBase64Url, base64UrlToBytes };
+export { isUnsafeKey, safeJsonParse, defineContract, mergeMeta, bytesToBase64Url, base64UrlToBytes };

package/dist/{index-2akar0rq.js → index-wrhf06ak.js}

@@ -7,17 +7,19 @@ import {
   normalizeError,
   runWithRequestContext,
   validateDeclaredOutput
-} from "./index-6fbp58g8.js";
+} from "./index-tvwcrx2d.js";
 import {
-  AppError,
-  STITCH_ERROR_STATUS,
-  isStitchErrorCode,
   isUnsafeKey,
   safeJsonParse
-} from "./index-v6e8hnkx.js";
+} from "./index-wd8g8z6e.js";
 import {
   isRecord
 } from "./index-smpbdg6k.js";
+import {
+  AppError,
+  STITCH_ERROR_STATUS,
+  isStitchErrorCode
+} from "./index-xxye8j3k.js";
 
 // src/tools/coerce.ts
 import { z } from "zod";

package/dist/index-xxye8j3k.js

@@ -0,0 +1,85 @@
+// src/contract/errors.ts
+var APP_ERROR_BRAND = Symbol.for("stitchkit.AppError");
+
+class AppError extends Error {
+  code;
+  status;
+  details;
+  hint;
+  traceId;
+  constructor(code, message, status = 500, details, hint, traceId) {
+    super(message ?? code);
+    this.code = code;
+    this.status = status;
+    this.details = details;
+    this.hint = hint;
+    this.traceId = traceId;
+    this.name = "AppError";
+    Object.defineProperty(this, APP_ERROR_BRAND, { value: true });
+  }
+  static is(err) {
+    return typeof err === "object" && err !== null && APP_ERROR_BRAND in err;
+  }
+  toJSON() {
+    return {
+      error: {
+        code: this.code,
+        message: this.message,
+        ...this.details && { details: this.details },
+        ...this.hint && { hint: this.hint }
+      }
+    };
+  }
+}
+function notFound(message = "Not found") {
+  throw new AppError("NOT_FOUND", message, 404);
+}
+function badRequest(message, details) {
+  throw new AppError("BAD_REQUEST", message, 400, details);
+}
+function unauthorized(message = "Unauthorized") {
+  throw new AppError("UNAUTHORIZED", message, 401);
+}
+function forbidden(message = "Forbidden") {
+  throw new AppError("FORBIDDEN", message, 403);
+}
+function conflict(message = "Conflict", details) {
+  throw new AppError("CONFLICT", message, 409, details);
+}
+function rateLimited(message = "Too many requests") {
+  throw new AppError("RATE_LIMITED", message, 429);
+}
+var STITCH_ERROR_STATUS = {
+  BAD_REQUEST: 400,
+  UNAUTHORIZED: 401,
+  FORBIDDEN: 403,
+  NOT_FOUND: 404,
+  METHOD_NOT_ALLOWED: 405,
+  CONFLICT: 409,
+  RATE_LIMITED: 429,
+  VALIDATION_ERROR: 400,
+  FILE_INVALID_PATH: 400,
+  FILE_OUTSIDE_ROOT: 400,
+  FILE_NOT_FOUND: 404,
+  FILE_NOT_REGULAR: 422,
+  FILE_INSPECTION_REJECTED: 422,
+  FILE_TOO_LARGE: 413,
+  FILE_EXISTS: 409,
+  REALTIME_CONTRACT_VIOLATION: 500,
+  APPLICATION_NOT_ACCEPTING: 503,
+  GRAMMY_WEBHOOK_NOT_ACCEPTING: 503,
+  WAIT_TIMEOUT: 408,
+  WAIT_FAILED: 409,
+  DOWNLOAD_NOT_FOUND: 404,
+  VIEW_HTTP_ERROR: 502,
+  OPERATION_NOT_SUCCEEDED: 409,
+  INTERNAL_SERVER_ERROR: 500
+};
+function isStitchErrorCode(code) {
+  return Object.hasOwn(STITCH_ERROR_STATUS, code);
+}
+function appError(code, message, details) {
+  throw new AppError(code, message, isStitchErrorCode(code) ? STITCH_ERROR_STATUS[code] : 500, details);
+}
+
+export { AppError, notFound, badRequest, unauthorized, forbidden, conflict, rateLimited, STITCH_ERROR_STATUS, isStitchErrorCode, appError };

package/dist/{index-3hn10n4c.js → index-y91zd0ch.js}

@@ -1,7 +1,7 @@
 import {
   isUnsafeKey,
   mergeMeta
-} from "./index-v6e8hnkx.js";
+} from "./index-wd8g8z6e.js";
 import {
   callRuntimeHandler,
   isRecord,

package/dist/index.js

@@ -19,7 +19,7 @@ import {
   parseTrailingWildcard,
   rateLimited,
   unauthorized
-} from "./index-9h1vba8n.js";
+} from "./index-t8xrqc9g.js";
 import {
   isRecord,
   mapObject,

package/dist/node.js

@@ -3,7 +3,7 @@ import {
   bindRealtimeServer,
   createHandler,
   createSocketIOServer
-} from "./index-f7521k0x.js";
+} from "./index-2cgbdckv.js";
 import {
   createImplement,
   createImplementRegistry,
@@ -12,7 +12,7 @@ import {
   createScopedImplementRegistry,
   implement,
   implementRegistry
-} from "./index-3hn10n4c.js";
+} from "./index-y91zd0ch.js";
 import"./index-557by2db.js";
 import {
   ShutdownOptionsSchema,
@@ -21,7 +21,11 @@ import {
   ShutdownStatusSchema,
   createServerLifecycle
 } from "./index-dk6e56g0.js";
-import"./index-6fbp58g8.js";
+import"./index-tvwcrx2d.js";
+import"./index-wd8g8z6e.js";
+import"./index-6k1937bx.js";
+import"./index-pzyt11ch.js";
+import"./index-smpbdg6k.js";
 import {
   AppError,
   appError,
@@ -31,10 +35,7 @@ import {
   notFound,
   rateLimited,
   unauthorized
-} from "./index-v6e8hnkx.js";
-import"./index-6k1937bx.js";
-import"./index-pzyt11ch.js";
-import"./index-smpbdg6k.js";
+} from "./index-xxye8j3k.js";
 // src/server/node.ts
 import { serve } from "srvx/node";
 

package/dist/observability/index.js

@@ -10,7 +10,7 @@ import {
   redact,
   sanitizePayload,
   truncatePreview
-} from "../index-8es1hrv4.js";
+} from "../index-6taryy00.js";
 import {
   getRequestContext,
   getTraceId,
@@ -22,8 +22,8 @@ import {
   setRequestError,
   setRequestUser,
   wrapInRequestContext
-} from "../index-6fbp58g8.js";
-import"../index-v6e8hnkx.js";
+} from "../index-tvwcrx2d.js";
+import"../index-wd8g8z6e.js";
 import"../index-6k1937bx.js";
 import {
   childSpan,
@@ -36,6 +36,7 @@ import {
 import {
   isRecord
 } from "../index-smpbdg6k.js";
+import"../index-xxye8j3k.js";
 
 // src/observability/audit.ts
 function toolErrorMessage(result) {

package/dist/remote.js

@@ -4,14 +4,16 @@ import {
 } from "./index-svqhcrrj.js";
 import"./index-48ffdxgk.js";
 import {
-  AppError,
   mergeMeta
-} from "./index-v6e8hnkx.js";
+} from "./index-wd8g8z6e.js";
 import"./index-6k1937bx.js";
 import"./index-pzyt11ch.js";
 import {
   isRecord
 } from "./index-smpbdg6k.js";
+import {
+  AppError
+} from "./index-xxye8j3k.js";
 
 // src/tools/remote.ts
 var HTTP_ONLY = Object.freeze(["HTTP"]);

package/dist/server/index.js

@@ -7,7 +7,7 @@ import {
   parseMultipart,
   socketIoLane,
   webSocketLane
-} from "../index-f7521k0x.js";
+} from "../index-2cgbdckv.js";
 import {
   composeAuthHooks,
   createAuthHook,
@@ -20,7 +20,7 @@ import {
   signJwt,
   verifyJwt,
   verifyPkce
-} from "../index-3w74r08v.js";
+} from "../index-mfw1pec7.js";
 import {
   DEFAULT_CORS_ALLOW_HEADERS,
   DEFAULT_CORS_EXPOSE_HEADERS,
@@ -34,7 +34,7 @@ import {
   defineMultipartStream,
   implement,
   implementRegistry
-} from "../index-3hn10n4c.js";
+} from "../index-y91zd0ch.js";
 import {
   isWithinDir,
   realPathWithinDir
@@ -65,7 +65,16 @@ import {
   resolveSocketIp,
   resolveTraceId,
   zodIssues
-} from "../index-6fbp58g8.js";
+} from "../index-tvwcrx2d.js";
+import"../index-wd8g8z6e.js";
+import"../index-6k1937bx.js";
+import {
+  joinRoutePath,
+  parseTrailingWildcard
+} from "../index-pzyt11ch.js";
+import {
+  isRecord
+} from "../index-smpbdg6k.js";
 import {
   AppError,
   STITCH_ERROR_STATUS,
@@ -77,15 +86,7 @@ import {
   notFound,
   rateLimited,
   unauthorized
-} from "../index-v6e8hnkx.js";
-import"../index-6k1937bx.js";
-import {
-  joinRoutePath,
-  parseTrailingWildcard
-} from "../index-pzyt11ch.js";
-import {
-  isRecord
-} from "../index-smpbdg6k.js";
+} from "../index-xxye8j3k.js";
 // src/server/bun.ts
 import { chmodSync, statSync, unlinkSync } from "node:fs";
 function reclaimStaleUnixSocket(path) {

package/dist/testing.js

@@ -4,7 +4,7 @@ import {
 } from "./index-vtjgx3vv.js";
 import {
   createApplication
-} from "./index-1zencgcb.js";
+} from "./index-82e74yfx.js";
 import"./index-8eywc9zv.js";
 import {
   RealtimeRequestDisconnectedError,
@@ -32,6 +32,7 @@ import {
 import {
   isRecord
 } from "./index-smpbdg6k.js";
+import"./index-xxye8j3k.js";
 
 // src/agent-runtime/testing.ts
 function createAgentRaceBarrier(timeoutMs = 5000) {

package/dist/tools.js

@@ -1,7 +1,7 @@
 import {
   signJwt,
   verifyPkce
-} from "./index-3w74r08v.js";
+} from "./index-mfw1pec7.js";
 import {
   DEFAULT_CORS_ALLOW_HEADERS,
   DEFAULT_PROCESS_SIGNALS,
@@ -9,7 +9,7 @@ import {
   defaultSignalSource,
   guardSignalCallback,
   reportSignalError
-} from "./index-3hn10n4c.js";
+} from "./index-y91zd0ch.js";
 import {
   WaitTimeoutError,
   collectToolSurface,
@@ -24,7 +24,7 @@ import {
   formatToolError,
   readCapped,
   runWaitOperation
-} from "./index-8pc5s3pz.js";
+} from "./index-1pgeyyee.js";
 import {
   ToolExecutionControlError,
   coerceJsonArgs,
@@ -32,7 +32,7 @@ import {
   isToolExecutionControlError,
   toolErrorFromResult,
   toolResultFromError
-} from "./index-2akar0rq.js";
+} from "./index-wrhf06ak.js";
 import {
   ManagedFileError
 } from "./index-bfcpjw20.js";
@@ -52,18 +52,16 @@ import"./index-6djpbnda.js";
 import"./index-cby4ar3v.js";
 import {
   redact
-} from "./index-8es1hrv4.js";
+} from "./index-6taryy00.js";
 import {
   getRequestContext,
   getTraceId,
   normalizeError,
   runWithRequestContext
-} from "./index-6fbp58g8.js";
+} from "./index-tvwcrx2d.js";
 import {
-  AppError,
-  STITCH_ERROR_STATUS,
   defineContract
-} from "./index-v6e8hnkx.js";
+} from "./index-wd8g8z6e.js";
 import {
   ManagedFilePathSchema,
   ManagedFileRefSchema
@@ -74,6 +72,10 @@ import {
 import {
   isRecord
 } from "./index-smpbdg6k.js";
+import {
+  AppError,
+  STITCH_ERROR_STATUS
+} from "./index-xxye8j3k.js";
 
 // src/tools/agent.ts
 import { jsonSchema, tool } from "ai";

package/llms-full.txt

@@ -7496,10 +7496,12 @@ if (error instanceof AgentRuntimeConflictError) …
 `ActivityTokenBrand` is exported, so `ActivityProjection` can be implemented by
 a test double. `STITCH_ERROR_STATUS` gained `APPLICATION_NOT_ACCEPTING` (503) —
 only an exhaustive `satisfies Record<StitchErrorCode, …>` map stops compiling,
-and the fix is one line. `GRAMMY_WEBHOOK_NOT_ACCEPTING` is deliberately *not*
-registered: the registry belongs to the generic core, and a provider name has no
-place in a union every consumer imports. It travels as itself through a partial
-`codeMap`.
+and the fix is one line. (`GRAMMY_WEBHOOK_NOT_ACCEPTING` joined it in 0.60.1,
+under the same rule — see ADR 0105. This section briefly said the opposite: that
+an adapter's code stays out of the registry. It does not, and leaving it out was
+the worse of the two, because `isStitchErrorCode` then answered `false` and the
+code reached the wire spelled stitchkit's way, past both `codeMap` and
+`unmappedCode`.)
 
 `application.shutdown()` no longer accepts `retryAfterSeconds`. Delete it from
 the call — the kernel never read it. If you meant the HTTP `Retry-After` a
@@ -7995,58 +7997,6 @@ The Node-shaped callback is gone, and the policy is now composed with shutdown
 admission on both runtimes: a handshake arriving during drain is refused for
 you.
 
-## Released migration: 0.46.0
-
-### `REALTIME_CONTRACT_VIOLATION` joined the error registry
-
-Realtime contract failures use the framework error model instead of a bare
-`ZodError`, so an exhaustive map stops compiling until the code is added:
-
-```ts
-// before
-{ …, INTERNAL_SERVER_ERROR: 'internal' } satisfies Record<StitchErrorCode, string>
-// after
-{ …, INTERNAL_SERVER_ERROR: 'internal', REALTIME_CONTRACT_VIOLATION: 'internal' } satisfies Record<StitchErrorCode, string>
-```
-
-Only an exhaustive map breaks. Since 0.56.1 `codeMap` itself is partial, so a
-map without the `satisfies` keeps compiling and lets the code travel as itself.
-
-### `RealtimeRejectedEvent.error` is an `AppError`
-
-```ts
-// before
-onRejected: ({ error }) => error.issues
-// after
-onRejected: ({ error }) => error.details?.issues   // the ZodError moves to error.cause
-```
-
-The envelope gained `reason` and `fault`. The consequence worth checking: code
-reading `.issues` directly does not fail to compile if the handler is loosely
-typed — it silently reads `undefined`. Grep for `.issues` on rejection handlers.
-
-### CLI construction refuses reserved names
-
-A contract field or tool named `json`, `wait`, `quiet`, `dry-run`, `help`,
-`version`, `wait-timeout` or `output-dir` now **throws while the CLI is built**,
-instead of being silently shadowed:
-
-```ts
-// before: app schedule_job --wait 2h  → {"path":"2h"}, exit 0
-// after:  building a CLI over a contract with a "wait" field throws
-```
-
-This one fires at startup, not at call time, so an application shipping such a
-field crashes on boot after the upgrade. That is deliberate — the old behaviour
-corrupted arguments silently — but it means the upgrade is not safe to deploy
-without building the CLI once locally.
-
-### `createToolLogger` writes to stderr
-
-stdout is the JSON-RPC channel of a stdio MCP server, and the previous
-`console.info` default corrupted it. Pass `log` to redirect if your process
-collected tool logs from stdout.
-
 ## Released migration: 0.48.0
 
 ### Typed-client request options move to `.withOptions`
@@ -8172,6 +8122,58 @@ contract shape.
    (`STITCH_ERROR_STATUS`, `serveFile`, `scopePrefixes`, `afterToolCall`'s
    `MethodDef`, `maxUploadBytes`) are available to adopt, not required.
 
+## Released migration: 0.46.0
+
+### `REALTIME_CONTRACT_VIOLATION` joined the error registry
+
+Realtime contract failures use the framework error model instead of a bare
+`ZodError`, so an exhaustive map stops compiling until the code is added:
+
+```ts
+// before
+{ …, INTERNAL_SERVER_ERROR: 'internal' } satisfies Record<StitchErrorCode, string>
+// after
+{ …, INTERNAL_SERVER_ERROR: 'internal', REALTIME_CONTRACT_VIOLATION: 'internal' } satisfies Record<StitchErrorCode, string>
+```
+
+Only an exhaustive map breaks. Since 0.56.1 `codeMap` itself is partial, so a
+map without the `satisfies` keeps compiling and lets the code travel as itself.
+
+### `RealtimeRejectedEvent.error` is an `AppError`
+
+```ts
+// before
+onRejected: ({ error }) => error.issues
+// after
+onRejected: ({ error }) => error.details?.issues   // the ZodError moves to error.cause
+```
+
+The envelope gained `reason` and `fault`. The consequence worth checking: code
+reading `.issues` directly does not fail to compile if the handler is loosely
+typed — it silently reads `undefined`. Grep for `.issues` on rejection handlers.
+
+### CLI construction refuses reserved names
+
+A contract field or tool named `json`, `wait`, `quiet`, `dry-run`, `help`,
+`version`, `wait-timeout` or `output-dir` now **throws while the CLI is built**,
+instead of being silently shadowed:
+
+```ts
+// before: app schedule_job --wait 2h  → {"path":"2h"}, exit 0
+// after:  building a CLI over a contract with a "wait" field throws
+```
+
+This one fires at startup, not at call time, so an application shipping such a
+field crashes on boot after the upgrade. That is deliberate — the old behaviour
+corrupted arguments silently — but it means the upgrade is not safe to deploy
+without building the CLI once locally.
+
+### `createToolLogger` writes to stderr
+
+stdout is the JSON-RPC channel of a stdio MCP server, and the previous
+`console.info` default corrupted it. Pass `log` to redirect if your process
+collected tool logs from stdout.
+
 ## Released migration: 0.44.0
 
 ### MCP TypeScript SDK v2 and protocol `2026-07-28`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stitchkit",
-  "version": "0.60.0",
+  "version": "0.60.1",
   "description": "Contract-first backend framework — one defineContract() into an HTTP API, MCP tools, AI-agent tools and a typed client. Bun and Node.",
   "keywords": [
     "bun",
@@ -207,18 +207,18 @@
     "@openrouter/ai-sdk-provider": "^3.0.0",
     "@socket.io/bun-engine": "^0.1.1",
     "@socket.io/component-emitter": "^3.1.2",
-    "@tanstack/react-query": "5.101.4",
-    "@types/bun": "^1.3.14",
+    "@tanstack/react-query": "5.102.3",
+    "@types/bun": "^1.4.0",
     "@types/json-schema": "^7.0.15",
     "@types/react": "^19.2.18",
     "@typescript/typescript6": "^6.0.2",
-    "ai": "^7.0.65",
+    "ai": "^7.0.78",
     "grammy": "^1.45.1",
     "react": "^19.2.8",
     "react-query-kit": "^3.3.4",
     "socket.io": "^4.8.3",
     "socket.io-client": "^4.8.3",
-    "srvx": "^0.12.5",
+    "srvx": "^0.12.7",
     "typescript": "^7.0.2",
     "zod": "^4.4.3"
   }