stitchkit 0.88.0 → 0.90.0

package/dist/application.js

@@ -1,17 +1,3 @@
-import"./index-pq95qkbf.js";
-import {
-  ApplicationAdmissionError,
-  ApplicationRestartInputSchema,
-  ApplicationRestartOutcomeSchema,
-  ApplicationRestartResultSchema,
-  ApplicationShutdownBudgetSchema,
-  ApplicationShutdownOptionsSchema,
-  createApplication
-} from "./index-evcnmsc3.js";
-import {
-  defineManagedResource,
-  managedResourceDependencyId
-} from "./index-2k4yrqkc.js";
 import {
   ActivityIdSchema,
   ActivityLiveStateSchema,
@@ -28,6 +14,29 @@ import {
   createApplicationSnapshotSink,
   createManagedSchedule
 } from "./index-9f8ztey6.js";
+import {
+  DiagnosticJournalCloseResultSchema,
+  DiagnosticJournalFailurePhaseSchema,
+  DiagnosticJournalFrameSchema,
+  DiagnosticJournalLimitsSchema,
+  DiagnosticJournalLockPolicySchema,
+  DiagnosticJournalRefusalReasonSchema,
+  DiagnosticJournalStateSchema,
+  DiagnosticJournalStatusSchema,
+  DiagnosticJournalSubmitResultSchema,
+  DiagnosticJournalWaitResultSchema,
+  readDiagnosticJournalLockDiagnosis
+} from "./index-wc4x00bn.js";
+import"./index-pq95qkbf.js";
+import {
+  ApplicationAdmissionError,
+  ApplicationRestartInputSchema,
+  ApplicationRestartOutcomeSchema,
+  ApplicationRestartResultSchema,
+  ApplicationShutdownBudgetSchema,
+  ApplicationShutdownOptionsSchema,
+  createApplication
+} from "./index-t7fkyxcr.js";
 import {
   ApplicationAdmissionSnapshotSchema,
   ApplicationHealthSchema,
@@ -42,18 +51,9 @@ import {
   projectApplicationStatus
 } from "./index-3gye9wzb.js";
 import {
-  DiagnosticJournalCloseResultSchema,
-  DiagnosticJournalFailurePhaseSchema,
-  DiagnosticJournalFrameSchema,
-  DiagnosticJournalLimitsSchema,
-  DiagnosticJournalLockPolicySchema,
-  DiagnosticJournalRefusalReasonSchema,
-  DiagnosticJournalStateSchema,
-  DiagnosticJournalStatusSchema,
-  DiagnosticJournalSubmitResultSchema,
-  DiagnosticJournalWaitResultSchema,
-  readDiagnosticJournalLockDiagnosis
-} from "./index-wc4x00bn.js";
+  defineManagedResource,
+  managedResourceDependencyId
+} from "./index-2k4yrqkc.js";
 import {
   withDeadline
 } from "./index-b9aefrqd.js";
@@ -66,8 +66,10 @@ import {
   createBackoff
 } from "./index-s8cnx02s.js";
 import {
+  deltaWins,
+  diff,
   watchKeyString
-} from "./index-dre2ywck.js";
+} from "./index-2na0qrfn.js";
 import"./index-ywd0y6m1.js";
 import {
   BoundedChannelPolicySchema,
@@ -1563,17 +1565,20 @@ function createWatchHub(config) {
   const held = new Map;
   const maxWatches = config.maxWatchesPerSubscriber ?? 64;
   const holdMs = config.holdMs ?? 0;
+  const deltaMemoryBytes = config.deltaMemoryBytes ?? 262144;
   const same = config.same ?? ((previous, next) => JSON.stringify(stableValue(previous)) === JSON.stringify(stableValue(next)));
   let reads = 0;
   let closed = false;
-  function tell(key, deliver) {
+  function tell(key, deliver2) {
     try {
-      deliver();
+      deliver2();
+      return true;
     } catch (error) {
       config.logger?.warn?.("[stitchkit] watch subscriber threw", {
         key: watchKeyString(key),
         error: error instanceof Error ? error.message : String(error)
       });
+      return false;
     }
   }
   function announceState(source, state) {
@@ -1582,13 +1587,85 @@ function createWatchHub(config) {
       tell(source.key, () => subscriber.state(state));
     }
   }
-  function publish(source, value) {
+  function remember(source, revision, value, fingerprint) {
+    if (deltaMemoryBytes === 0)
+      return;
+    const bytes = (JSON.stringify(value) ?? "null").length;
+    if (bytes > deltaMemoryBytes)
+      return;
+    source.history.set(revision, { value, fingerprint, bytes });
+    source.historyBytes += bytes;
+    for (const [oldest, entry] of source.history) {
+      if (source.historyBytes <= deltaMemoryBytes)
+        break;
+      source.history.delete(oldest);
+      source.historyBytes -= entry.bytes;
+    }
+  }
+  function frameFor(source, subscriber) {
+    const value = source.value;
+    const fingerprint = source.fingerprint ?? valueFingerprint(value);
+    const full = {
+      kind: "full",
+      key: source.key,
+      revision: source.revision,
+      fingerprint,
+      value
+    };
+    const base = source.baselines.get(subscriber);
+    if (base === undefined)
+      return full;
+    if (base === source.revision) {
+      return { kind: "unchanged", key: source.key, revision: source.revision, fingerprint };
+    }
+    const held2 = source.history.get(base);
+    if (!held2)
+      return full;
+    const delta = diff(held2.value, value);
+    if (delta === undefined || !deltaWins(delta, value))
+      return full;
+    return {
+      kind: "delta",
+      key: source.key,
+      revision: source.revision,
+      fingerprint,
+      base,
+      delta
+    };
+  }
+  function adoptBaseline(source, subscriber, have) {
+    if (source.fingerprint === have.fingerprint) {
+      source.baselines.set(subscriber, source.revision);
+      return;
+    }
+    const named = source.history.get(have.revision);
+    if (named?.fingerprint === have.fingerprint) {
+      source.baselines.set(subscriber, have.revision);
+      return;
+    }
+    for (const [revision, entry] of source.history) {
+      if (entry.fingerprint !== have.fingerprint)
+        continue;
+      source.baselines.set(subscriber, revision);
+      return;
+    }
+  }
+  function deliver(source, subscriber) {
+    const frame = frameFor(source, subscriber);
+    const delivered = tell(source.key, () => subscriber.value(frame));
+    if (delivered)
+      source.baselines.set(subscriber, source.revision);
+    return delivered;
+  }
+  function publish(source, value, fingerprint) {
+    if (source.fingerprint !== undefined) {
+      remember(source, source.revision, source.value, source.fingerprint);
+    }
     source.revision += 1;
     source.value = value;
-    const frame = { key: source.key, revision: source.revision, value };
-    for (const subscriber of source.subscribers) {
-      tell(source.key, () => subscriber.value(frame));
-    }
+    source.fingerprint = fingerprint;
+    for (const subscriber of source.subscribers)
+      deliver(source, subscriber);
   }
   async function pump(source) {
     if (source.reading || closed)
@@ -1605,7 +1682,7 @@ function createWatchHub(config) {
           const unchanged = source.signature !== undefined && same(source.value, value);
           source.signature = signature;
           if (!unchanged)
-            publish(source, value);
+            publish(source, value, valueFingerprint(value));
           if (source.state.phase !== "live") {
             announceState(source, { key: source.key, phase: "live" });
           }
@@ -1655,6 +1732,9 @@ function createWatchHub(config) {
       subscribers: new Set,
       unsubscribes: [],
       revision: 0,
+      history: new Map,
+      historyBytes: 0,
+      baselines: new Map,
       reading: false,
       dirty: true,
       state: { key, phase: "opening" },
@@ -1696,7 +1776,7 @@ function createWatchHub(config) {
       const keys = new Set;
       held.set(subscriber, keys);
       return {
-        open(key, args) {
+        open(key, args, have) {
           if (closed)
             return { accepted: false, reason: "the watch hub is closed" };
           const operation = { service: key.service, action: key.action };
@@ -1718,13 +1798,18 @@ function createWatchHub(config) {
           const source = acquire(operation, key, args);
           source.subscribers.add(subscriber);
           keys.add(id);
+          if (have)
+            adoptBaseline(source, subscriber, have);
           try {
             if (source.signature !== undefined) {
-              subscriber.value({ key, revision: source.revision, value: source.value });
+              const frame = frameFor(source, subscriber);
+              subscriber.value(frame);
+              source.baselines.set(subscriber, source.revision);
             }
             subscriber.state(source.state);
           } catch (error) {
             source.subscribers.delete(subscriber);
+            source.baselines.delete(subscriber);
             keys.delete(id);
             release(source);
             return {
@@ -1743,6 +1828,7 @@ function createWatchHub(config) {
           if (!source)
             return;
           source.subscribers.delete(subscriber);
+          source.baselines.delete(subscriber);
           release(source);
         },
         detach() {
@@ -1751,6 +1837,7 @@ function createWatchHub(config) {
             if (!source)
               continue;
             source.subscribers.delete(subscriber);
+            source.baselines.delete(subscriber);
             release(source);
           }
           keys.clear();
@@ -1779,6 +1866,9 @@ function createWatchHub(config) {
     }
   };
 }
+function valueFingerprint(value) {
+  return argumentsDigest({ value });
+}
 function readErrorCode(error) {
   if (typeof error !== "object" || error === null)
     return;

package/dist/cli.js

@@ -5,23 +5,23 @@ import {
   emitResult,
   parseCliArgs,
   pollUntilDone
-} from "./index-9hw9eq48.js";
+} from "./index-7601qfg1.js";
 import"./index-sbdmyz75.js";
-import"./index-rcgsnrr6.js";
-import"./index-kc6h6hg0.js";
-import"./index-0vfdh685.js";
-import"./index-wn9cb82y.js";
+import"./index-31jw8fjq.js";
+import"./index-8c3a7m4g.js";
+import"./index-zyvby92n.js";
 import"./index-vsbzgd7b.js";
 import"./index-f9mb610r.js";
-import"./index-r159gjwy.js";
-import"./index-cby4ar3v.js";
-import"./index-7zbps32p.js";
 import"./index-7evdsyez.js";
 import"./index-2bxcmqkb.js";
 import"./index-6k1937bx.js";
 import"./index-0w9abg87.js";
 import"./index-zcgf3gqf.js";
+import"./index-7zbps32p.js";
 import"./index-kzfs85xp.js";
+import"./index-kc6h6hg0.js";
+import"./index-r159gjwy.js";
+import"./index-cby4ar3v.js";
 import"./index-77fekveh.js";
 export {
   pollUntilDone,

package/dist/index-2na0qrfn.js

@@ -0,0 +1,214 @@
+import {
+  LiveStatePhaseSchema,
+  LiveStateStopReasonSchema
+} from "./index-ywd0y6m1.js";
+import {
+  stableValue
+} from "./index-a916km3r.js";
+
+// src/live/watch-delta.ts
+import { z } from "zod";
+var WatchDeltaSchema = z.lazy(() => z.union([
+  z.object({ t: z.literal("set"), v: z.unknown() }),
+  z.object({
+    t: z.literal("obj"),
+    set: z.record(z.string(), WatchDeltaSchema).optional(),
+    drop: z.array(z.string()).optional()
+  }),
+  z.object({ t: z.literal("arr"), ops: z.array(WatchArrayOpSchema) })
+]));
+var WatchArrayOpSchema = z.lazy(() => z.union([
+  z.object({
+    o: z.literal("copy"),
+    from: z.number().int().nonnegative(),
+    count: z.number().int().positive()
+  }),
+  z.object({
+    o: z.literal("patch"),
+    from: z.number().int().nonnegative(),
+    d: WatchDeltaSchema
+  }),
+  z.object({ o: z.literal("put"), v: z.unknown() })
+]));
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function signature(value) {
+  return JSON.stringify(stableValue(value)) ?? "undefined";
+}
+function diff(previous, next) {
+  if (signature(previous) === signature(next))
+    return;
+  if (isRecord(previous) && isRecord(next))
+    return objectDiff(previous, next);
+  if (Array.isArray(previous) && Array.isArray(next))
+    return arrayDiff(previous, next);
+  return { t: "set", v: next };
+}
+function objectDiff(previous, next) {
+  const set = {};
+  const drop = [];
+  for (const key of Object.keys(next)) {
+    if (!Object.hasOwn(previous, key)) {
+      set[key] = { t: "set", v: next[key] };
+      continue;
+    }
+    const nested = diff(previous[key], next[key]);
+    if (nested !== undefined)
+      set[key] = nested;
+  }
+  for (const key of Object.keys(previous)) {
+    if (!Object.hasOwn(next, key))
+      drop.push(key);
+  }
+  return {
+    t: "obj",
+    ...Object.keys(set).length > 0 && { set },
+    ...drop.length > 0 && { drop }
+  };
+}
+function arrayDiff(previous, next) {
+  const previousSignatures = previous.map(signature);
+  const positions = new Map;
+  previousSignatures.forEach((value, index) => {
+    const bucket = positions.get(value);
+    if (bucket)
+      bucket.push(index);
+    else
+      positions.set(value, [index]);
+  });
+  const taken = new Set;
+  const ops = [];
+  let cursor = 0;
+  const extend = (from) => {
+    const last = ops.at(-1);
+    if (last?.o !== "copy" || last.from + last.count !== from)
+      return false;
+    ops[ops.length - 1] = { o: "copy", from: last.from, count: last.count + 1 };
+    return true;
+  };
+  for (const element of next) {
+    const wanted = signature(element);
+    const last = ops.at(-1);
+    const continuation = last?.o === "copy" ? last.from + last.count : undefined;
+    if (continuation !== undefined && continuation < previous.length && previousSignatures[continuation] === wanted && !taken.has(continuation)) {
+      taken.add(continuation);
+      extend(continuation);
+      cursor = continuation + 1;
+      continue;
+    }
+    const bucket = positions.get(wanted);
+    const found = bucket?.find((index) => !taken.has(index));
+    if (found !== undefined) {
+      taken.add(found);
+      if (!extend(found))
+        ops.push({ o: "copy", from: found, count: 1 });
+      cursor = found + 1;
+      continue;
+    }
+    const counterpart = cursor < previous.length && !taken.has(cursor) ? cursor : undefined;
+    const nested = counterpart === undefined ? undefined : diff(previous[counterpart], element);
+    if (counterpart !== undefined && nested !== undefined) {
+      taken.add(counterpart);
+      ops.push({ o: "patch", from: counterpart, d: nested });
+      cursor = counterpart + 1;
+      continue;
+    }
+    ops.push({ o: "put", v: element });
+  }
+  return { t: "arr", ops };
+}
+function apply(previous, delta) {
+  if (delta.t === "set")
+    return delta.v;
+  if (delta.t === "obj") {
+    if (!isRecord(previous))
+      throw new Error("an object difference needs an object to apply to");
+    const result2 = { ...previous };
+    for (const key of delta.drop ?? [])
+      delete result2[key];
+    for (const [key, nested] of Object.entries(delta.set ?? {})) {
+      result2[key] = apply(Object.hasOwn(result2, key) ? result2[key] : undefined, nested);
+    }
+    return result2;
+  }
+  if (!Array.isArray(previous))
+    throw new Error("an array difference needs an array to apply to");
+  const result = [];
+  for (const op of delta.ops) {
+    if (op.o === "put") {
+      result.push(op.v);
+      continue;
+    }
+    if (op.from >= previous.length) {
+      throw new Error(`the difference reads element ${op.from} of an array of ${previous.length}`);
+    }
+    if (op.o === "patch") {
+      result.push(apply(previous[op.from], op.d));
+      continue;
+    }
+    if (op.from + op.count > previous.length) {
+      throw new Error(`the difference copies ${op.count} from ${op.from} of an array of ${previous.length}`);
+    }
+    result.push(...previous.slice(op.from, op.from + op.count));
+  }
+  return result;
+}
+function deltaWins(delta, value) {
+  return JSON.stringify(delta).length < (JSON.stringify(value) ?? "null").length;
+}
+
+// src/live/watch-contract.ts
+import { z as z2 } from "zod";
+var WatchKeySchema = z2.object({
+  service: z2.string().min(1),
+  action: z2.string().min(1),
+  digest: z2.string().min(1)
+}).strict().readonly();
+var WatchHaveSchema = z2.object({ revision: z2.number().int().nonnegative(), fingerprint: z2.string().min(1) }).strict().readonly();
+var WatchOpenSchema = z2.object({ key: WatchKeySchema, args: z2.unknown(), have: WatchHaveSchema.optional() }).readonly();
+var WatchAcceptedSchema = z2.object({
+  accepted: z2.boolean(),
+  reason: z2.string().optional()
+}).strict().readonly();
+var watchValueParts = {
+  key: WatchKeySchema,
+  revision: z2.number().int().nonnegative(),
+  fingerprint: z2.string().min(1)
+};
+var WatchValueSchema = z2.discriminatedUnion("kind", [
+  z2.object({ kind: z2.literal("full"), ...watchValueParts, value: z2.unknown() }).readonly(),
+  z2.object({
+    kind: z2.literal("delta"),
+    ...watchValueParts,
+    base: z2.number().int().nonnegative(),
+    delta: WatchDeltaSchema
+  }).readonly(),
+  z2.object({ kind: z2.literal("unchanged"), ...watchValueParts }).readonly()
+]);
+var WatchStateSchema = z2.object({
+  key: WatchKeySchema,
+  phase: LiveStatePhaseSchema,
+  reason: LiveStateStopReasonSchema.optional(),
+  code: z2.string().optional(),
+  message: z2.string().optional()
+}).readonly();
+var WATCH_OPEN = "stitchkit.watch.open";
+var WATCH_CLOSE = "stitchkit.watch.close";
+var WATCH_VALUE = "stitchkit.watch.value";
+var WATCH_STATE = "stitchkit.watch.state";
+var watchContract = {
+  serverToClient: {
+    [WATCH_VALUE]: { args: z2.tuple([WatchValueSchema]) },
+    [WATCH_STATE]: { args: z2.tuple([WatchStateSchema]) }
+  },
+  clientToServer: {
+    [WATCH_OPEN]: { args: z2.tuple([WatchOpenSchema]), ack: WatchAcceptedSchema },
+    [WATCH_CLOSE]: { args: z2.tuple([z2.object({ key: WatchKeySchema }).readonly()]) }
+  }
+};
+function watchKeyString(key) {
+  return `${key.service}/${key.action}/${key.digest}`;
+}
+
+export { WatchDeltaSchema, WatchArrayOpSchema, diff, apply, deltaWins, WatchKeySchema, WatchHaveSchema, WatchValueSchema, WatchStateSchema, WATCH_OPEN, WATCH_CLOSE, WATCH_VALUE, WATCH_STATE, watchContract, watchKeyString };

package/dist/{index-rcgsnrr6.js → index-31jw8fjq.js}

@@ -1,9 +1,9 @@
+import {
+  contractToolMountable
+} from "./index-8c3a7m4g.js";
 import {
   runtimeToolMountable
 } from "./index-kc6h6hg0.js";
-import {
-  contractToolMountable
-} from "./index-0vfdh685.js";
 import {
   projectToolSurface
 } from "./index-r159gjwy.js";

package/dist/{index-9hw9eq48.js → index-7601qfg1.js}

@@ -3,33 +3,33 @@ import {
 } from "./index-sbdmyz75.js";
 import {
   collectToolSurface
-} from "./index-rcgsnrr6.js";
+} from "./index-31jw8fjq.js";
 import {
   createToolRunner,
   formatToolError
-} from "./index-0vfdh685.js";
+} from "./index-8c3a7m4g.js";
 import {
   toolResultFromError
-} from "./index-wn9cb82y.js";
-import {
-  assertUniqueToolName,
-  buildToolPresentationSchema,
-  objectShapeKeys
-} from "./index-r159gjwy.js";
-import {
-  jsonSchemaFields
-} from "./index-cby4ar3v.js";
-import {
-  coerceJsonArgs
-} from "./index-7zbps32p.js";
+} from "./index-zyvby92n.js";
 import {
   formatZodError,
   validateDeclaredOutput
 } from "./index-7evdsyez.js";
+import {
+  coerceJsonArgs
+} from "./index-7zbps32p.js";
 import {
   isUnsafeKey,
   safeJsonParse
 } from "./index-kzfs85xp.js";
+import {
+  assertUniqueToolName,
+  buildToolPresentationSchema,
+  objectShapeKeys
+} from "./index-r159gjwy.js";
+import {
+  jsonSchemaFields
+} from "./index-cby4ar3v.js";
 import {
   isRecord
 } from "./index-77fekveh.js";

package/dist/{index-3xnq72rz.js → index-7rkhw9ec.js}

@@ -18,4 +18,17 @@ function isAgentToolError(value) {
   return typeof value === "object" && value !== null && AGENT_TOOL_ERROR_BRAND in value;
 }
 
-export { AgentToolError, isAgentToolError };
+// src/tools/durability-context.ts
+var contexts = new WeakMap;
+function createToolDurabilityContext(factory) {
+  const context = {};
+  contexts.set(context, factory);
+  return context;
+}
+function resolveToolDurability(context, callId, signal) {
+  if (typeof context !== "object" || context === null)
+    return;
+  return contexts.get(context)?.(callId, signal);
+}
+
+export { AgentToolError, isAgentToolError, createToolDurabilityContext, resolveToolDurability };

package/dist/{index-0vfdh685.js → index-8c3a7m4g.js}

@@ -1,6 +1,6 @@
 import {
   executeToolMethod
-} from "./index-wn9cb82y.js";
+} from "./index-zyvby92n.js";
 import {
   assertToolExtensionCompatible,
   mergeSchemas,

package/dist/{index-t7gh5w3v.js → index-bn2cjajt.js}

@@ -21,6 +21,9 @@ import {
 import { createRequire } from "node:module";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+function containedEntryKind(entry) {
+  return entry.isDirectory() ? "directory" : entry.isSymbolicLink() ? "symlink" : entry.isFile() ? "file" : "other";
+}
 var FILE_TYPE_MASK = 61440;
 var FILE_TYPE_DIRECTORY = 16384;
 var FILE_TYPE_REGULAR = 32768;
@@ -174,14 +177,18 @@ async function listContainedDirectory(root, relative, maxEntries, authorizePath)
     const raw = [...await listAt(current)];
     raw.sort((left, right) => left.name.localeCompare(right.name));
     const admitted = [];
+    const denied = [];
     for (const entry of raw) {
       const entryPath = relative === "." ? entry.name : path.join(relative, entry.name);
-      if (!authorizePath || await authorizePath(entryPath))
-        admitted.push(entry);
+      if (authorizePath && !await authorizePath(entryPath)) {
+        denied.push({ name: entry.name, kind: containedEntryKind(entry) });
+        continue;
+      }
+      admitted.push(entry);
     }
     const entries = [];
     for (const entry of admitted.slice(0, maxEntries)) {
-      const kind = entry.isDirectory() ? "directory" : entry.isSymbolicLink() ? "symlink" : entry.isFile() ? "file" : "other";
+      const kind = containedEntryKind(entry);
       if (kind !== "file") {
         entries.push({ name: entry.name, kind });
         continue;
@@ -198,7 +205,12 @@ async function listContainedDirectory(root, relative, maxEntries, authorizePath)
         return left.name.localeCompare(right.name);
       return left.kind === "directory" ? -1 : right.kind === "directory" ? 1 : 0;
     });
-    return { entries, truncated: admitted.length > maxEntries };
+    return {
+      entries,
+      truncated: admitted.length > maxEntries,
+      denied: denied.slice(0, maxEntries),
+      deniedTruncated: denied.length > maxEntries
+    };
   } finally {
     await current.close();
   }
@@ -424,6 +436,8 @@ async function scanContainedFiles(input) {
   let truncated = false;
   let skippedDirectories = 0;
   let skippedSymlinks = 0;
+  const denied = [];
+  let deniedTruncated = false;
   const root = await openPinnedDirectory(input.root);
   const visit = async (directory, relativeDirectory, depth) => {
     if (truncated)
@@ -437,8 +451,15 @@ async function scanContainedFiles(input) {
     for (const entry of entries) {
       const relative = relativeDirectory ? path.join(relativeDirectory, entry.name) : entry.name;
       const kind = entry.isDirectory() ? "directory" : entry.isSymbolicLink() ? "symlink" : entry.isFile() ? "file" : "other";
-      if (input.authorizePath && !await input.authorizePath(relative, kind))
+      if (kind === "file" && input.includeFile && !input.includeFile(relative))
+        continue;
+      if (input.authorizePath && !await input.authorizePath(relative, kind)) {
+        if (denied.length < input.maxFiles)
+          denied.push({ relative, kind });
+        else
+          deniedTruncated = true;
         continue;
+      }
       if (entry.isSymbolicLink()) {
         if (input.symlinks === "refuse") {
           throw new Error(`Contained file traversal refuses symlink: ${relative}`);
@@ -497,7 +518,7 @@ async function scanContainedFiles(input) {
   } finally {
     await root.close();
   }
-  return { files, truncated, skippedDirectories, skippedSymlinks };
+  return { files, truncated, skippedDirectories, skippedSymlinks, denied, deniedTruncated };
 }
 
 export { listContainedDirectory, missingContainedDirectories, openContainedParent, openContainedFile, assertContainedFileCurrent, assertContainedParentCurrent, writeContainedFile, containedEntryMetadata, openContainedParentFile, readContainedUtf8Handle, walkContainedFiles, scanContainedFiles };