stitchkit 0.89.0 → 0.90.1

package/dist/contract/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/contract/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE;QACL,2CAA2C;QAC3C,IAAI,EAAE,MAAM,CAAC;QACb,8BAA8B;QAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,gCAAgC;QAChC,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,0BAA0B;QAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAcD;;;;GAIG;AACH,qBAAa,QAAQ,CACnB,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAC1F,SAAQ,KAAK;aAEK,IAAI,EAAE,KAAK;aAEX,MAAM,EAAE,MAAM;aACd,OAAO,CAAC,EAAE,QAAQ;aAClB,IAAI,CAAC,EAAE,MAAM;IAC7B;;;;OAIG;aACa,OAAO,CAAC,EAAE,MAAM;IAXlC,YACkB,IAAI,EAAE,KAAK,EAC3B,OAAO,CAAC,EAAE,MAAM,EACA,MAAM,GAAE,MAAY,EACpB,OAAO,CAAC,EAAE,QAAQ,YAAA,EAClB,IAAI,CAAC,EAAE,MAAM,YAAA;IAC7B;;;;OAIG;IACa,OAAO,CAAC,EAAE,MAAM,YAAA,EAQjC;IAED,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,QAAQ,CAEvC;IAED,MAAM,IAAI,aAAa,CAStB;CACF;AAED,qCAAqC;AACrC,wBAAgB,QAAQ,CAAC,OAAO,SAAc,GAAG,KAAK,CAErD;AAED,6EAA6E;AAC7E,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAEpF;AAED,wCAAwC;AACxC,wBAAgB,YAAY,CAAC,OAAO,SAAiB,GAAG,KAAK,CAE5D;AAED,qCAAqC;AACrC,wBAAgB,SAAS,CAAC,OAAO,SAAc,GAAG,KAAK,CAEtD;AAED,0EAA0E;AAC1E,wBAAgB,QAAQ,CAAC,OAAO,SAAa,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAEvF;AAED,wCAAwC;AACxC,wBAAgB,WAAW,CAAC,OAAO,SAAsB,GAAG,KAAK,CAEhE;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmCE,CAAC;AAEnC,mFAAmF;AACnF,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,mBAAmB,CAAC;AAE/D,iEAAiE;AACjE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,eAAe,CAEvE;AAED,+FAA+F;AAC/F,wBAAgB,QAAQ,CACtB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,KAAK,CAOP"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/contract/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE;QACL,2CAA2C;QAC3C,IAAI,EAAE,MAAM,CAAC;QACb,8BAA8B;QAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,gCAAgC;QAChC,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,0BAA0B;QAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAcD;;;;GAIG;AACH,qBAAa,QAAQ,CACnB,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAC1F,SAAQ,KAAK;aAEK,IAAI,EAAE,KAAK;aAEX,MAAM,EAAE,MAAM;aACd,OAAO,CAAC,EAAE,QAAQ;aAClB,IAAI,CAAC,EAAE,MAAM;IAC7B;;;;OAIG;aACa,OAAO,CAAC,EAAE,MAAM;IAXlC,YACkB,IAAI,EAAE,KAAK,EAC3B,OAAO,CAAC,EAAE,MAAM,EACA,MAAM,GAAE,MAAY,EACpB,OAAO,CAAC,EAAE,QAAQ,YAAA,EAClB,IAAI,CAAC,EAAE,MAAM,YAAA;IAC7B;;;;OAIG;IACa,OAAO,CAAC,EAAE,MAAM,YAAA,EAQjC;IAED,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,QAAQ,CAEvC;IAED,MAAM,IAAI,aAAa,CAStB;CACF;AAED,qCAAqC;AACrC,wBAAgB,QAAQ,CAAC,OAAO,SAAc,GAAG,KAAK,CAErD;AAED,6EAA6E;AAC7E,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAEpF;AAED,wCAAwC;AACxC,wBAAgB,YAAY,CAAC,OAAO,SAAiB,GAAG,KAAK,CAE5D;AAED,qCAAqC;AACrC,wBAAgB,SAAS,CAAC,OAAO,SAAc,GAAG,KAAK,CAEtD;AAED,0EAA0E;AAC1E,wBAAgB,QAAQ,CAAC,OAAO,SAAa,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAEvF;AAED,wCAAwC;AACxC,wBAAgB,WAAW,CAAC,OAAO,SAAsB,GAAG,KAAK,CAEhE;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8CE,CAAC;AAEnC,mFAAmF;AACnF,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,mBAAmB,CAAC;AAE/D,iEAAiE;AACjE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,eAAe,CAEvE;AAED,+FAA+F;AAC/F,wBAAgB,QAAQ,CACtB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,KAAK,CAOP"}

package/dist/contract/index.js

@@ -8,7 +8,7 @@ import {
   defineErrors,
   encodeCursor,
   paginatedSchema
-} from "../index-2bxcmqkb.js";
+} from "../index-kazec06k.js";
 import {
   ManagedFilePathSchema,
   ManagedFileRefSchema
@@ -24,7 +24,7 @@ import {
   notFound,
   rateLimited,
   unauthorized
-} from "../index-0w9abg87.js";
+} from "../index-scs3f1eg.js";
 import"../index-kzfs85xp.js";
 import"../index-77fekveh.js";
 export {

package/dist/{index-qmgs7y68.js → index-1txvygak.js}

@@ -1,6 +1,6 @@
 import {
   normalizeError
-} from "./index-7evdsyez.js";
+} from "./index-2hryh65w.js";
 
 // src/internal/bounded-lines.ts
 var DEFAULT_STREAM_LINE_BYTES = 1024 * 1024;

package/dist/{index-8c3a7m4g.js → index-2hrfpw2c.js}

@@ -1,6 +1,6 @@
 import {
   executeToolMethod
-} from "./index-zyvby92n.js";
+} from "./index-44ht2790.js";
 import {
   assertToolExtensionCompatible,
   mergeSchemas,

package/dist/{index-7evdsyez.js → index-2hryh65w.js}

@@ -1,6 +1,6 @@
 import {
   AppError
-} from "./index-0w9abg87.js";
+} from "./index-scs3f1eg.js";
 import {
   isRecord
 } from "./index-77fekveh.js";

package/dist/index-2na0qrfn.js

@@ -0,0 +1,214 @@
+import {
+  LiveStatePhaseSchema,
+  LiveStateStopReasonSchema
+} from "./index-ywd0y6m1.js";
+import {
+  stableValue
+} from "./index-a916km3r.js";
+
+// src/live/watch-delta.ts
+import { z } from "zod";
+var WatchDeltaSchema = z.lazy(() => z.union([
+  z.object({ t: z.literal("set"), v: z.unknown() }),
+  z.object({
+    t: z.literal("obj"),
+    set: z.record(z.string(), WatchDeltaSchema).optional(),
+    drop: z.array(z.string()).optional()
+  }),
+  z.object({ t: z.literal("arr"), ops: z.array(WatchArrayOpSchema) })
+]));
+var WatchArrayOpSchema = z.lazy(() => z.union([
+  z.object({
+    o: z.literal("copy"),
+    from: z.number().int().nonnegative(),
+    count: z.number().int().positive()
+  }),
+  z.object({
+    o: z.literal("patch"),
+    from: z.number().int().nonnegative(),
+    d: WatchDeltaSchema
+  }),
+  z.object({ o: z.literal("put"), v: z.unknown() })
+]));
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function signature(value) {
+  return JSON.stringify(stableValue(value)) ?? "undefined";
+}
+function diff(previous, next) {
+  if (signature(previous) === signature(next))
+    return;
+  if (isRecord(previous) && isRecord(next))
+    return objectDiff(previous, next);
+  if (Array.isArray(previous) && Array.isArray(next))
+    return arrayDiff(previous, next);
+  return { t: "set", v: next };
+}
+function objectDiff(previous, next) {
+  const set = {};
+  const drop = [];
+  for (const key of Object.keys(next)) {
+    if (!Object.hasOwn(previous, key)) {
+      set[key] = { t: "set", v: next[key] };
+      continue;
+    }
+    const nested = diff(previous[key], next[key]);
+    if (nested !== undefined)
+      set[key] = nested;
+  }
+  for (const key of Object.keys(previous)) {
+    if (!Object.hasOwn(next, key))
+      drop.push(key);
+  }
+  return {
+    t: "obj",
+    ...Object.keys(set).length > 0 && { set },
+    ...drop.length > 0 && { drop }
+  };
+}
+function arrayDiff(previous, next) {
+  const previousSignatures = previous.map(signature);
+  const positions = new Map;
+  previousSignatures.forEach((value, index) => {
+    const bucket = positions.get(value);
+    if (bucket)
+      bucket.push(index);
+    else
+      positions.set(value, [index]);
+  });
+  const taken = new Set;
+  const ops = [];
+  let cursor = 0;
+  const extend = (from) => {
+    const last = ops.at(-1);
+    if (last?.o !== "copy" || last.from + last.count !== from)
+      return false;
+    ops[ops.length - 1] = { o: "copy", from: last.from, count: last.count + 1 };
+    return true;
+  };
+  for (const element of next) {
+    const wanted = signature(element);
+    const last = ops.at(-1);
+    const continuation = last?.o === "copy" ? last.from + last.count : undefined;
+    if (continuation !== undefined && continuation < previous.length && previousSignatures[continuation] === wanted && !taken.has(continuation)) {
+      taken.add(continuation);
+      extend(continuation);
+      cursor = continuation + 1;
+      continue;
+    }
+    const bucket = positions.get(wanted);
+    const found = bucket?.find((index) => !taken.has(index));
+    if (found !== undefined) {
+      taken.add(found);
+      if (!extend(found))
+        ops.push({ o: "copy", from: found, count: 1 });
+      cursor = found + 1;
+      continue;
+    }
+    const counterpart = cursor < previous.length && !taken.has(cursor) ? cursor : undefined;
+    const nested = counterpart === undefined ? undefined : diff(previous[counterpart], element);
+    if (counterpart !== undefined && nested !== undefined) {
+      taken.add(counterpart);
+      ops.push({ o: "patch", from: counterpart, d: nested });
+      cursor = counterpart + 1;
+      continue;
+    }
+    ops.push({ o: "put", v: element });
+  }
+  return { t: "arr", ops };
+}
+function apply(previous, delta) {
+  if (delta.t === "set")
+    return delta.v;
+  if (delta.t === "obj") {
+    if (!isRecord(previous))
+      throw new Error("an object difference needs an object to apply to");
+    const result2 = { ...previous };
+    for (const key of delta.drop ?? [])
+      delete result2[key];
+    for (const [key, nested] of Object.entries(delta.set ?? {})) {
+      result2[key] = apply(Object.hasOwn(result2, key) ? result2[key] : undefined, nested);
+    }
+    return result2;
+  }
+  if (!Array.isArray(previous))
+    throw new Error("an array difference needs an array to apply to");
+  const result = [];
+  for (const op of delta.ops) {
+    if (op.o === "put") {
+      result.push(op.v);
+      continue;
+    }
+    if (op.from >= previous.length) {
+      throw new Error(`the difference reads element ${op.from} of an array of ${previous.length}`);
+    }
+    if (op.o === "patch") {
+      result.push(apply(previous[op.from], op.d));
+      continue;
+    }
+    if (op.from + op.count > previous.length) {
+      throw new Error(`the difference copies ${op.count} from ${op.from} of an array of ${previous.length}`);
+    }
+    result.push(...previous.slice(op.from, op.from + op.count));
+  }
+  return result;
+}
+function deltaWins(delta, value) {
+  return JSON.stringify(delta).length < (JSON.stringify(value) ?? "null").length;
+}
+
+// src/live/watch-contract.ts
+import { z as z2 } from "zod";
+var WatchKeySchema = z2.object({
+  service: z2.string().min(1),
+  action: z2.string().min(1),
+  digest: z2.string().min(1)
+}).strict().readonly();
+var WatchHaveSchema = z2.object({ revision: z2.number().int().nonnegative(), fingerprint: z2.string().min(1) }).strict().readonly();
+var WatchOpenSchema = z2.object({ key: WatchKeySchema, args: z2.unknown(), have: WatchHaveSchema.optional() }).readonly();
+var WatchAcceptedSchema = z2.object({
+  accepted: z2.boolean(),
+  reason: z2.string().optional()
+}).strict().readonly();
+var watchValueParts = {
+  key: WatchKeySchema,
+  revision: z2.number().int().nonnegative(),
+  fingerprint: z2.string().min(1)
+};
+var WatchValueSchema = z2.discriminatedUnion("kind", [
+  z2.object({ kind: z2.literal("full"), ...watchValueParts, value: z2.unknown() }).readonly(),
+  z2.object({
+    kind: z2.literal("delta"),
+    ...watchValueParts,
+    base: z2.number().int().nonnegative(),
+    delta: WatchDeltaSchema
+  }).readonly(),
+  z2.object({ kind: z2.literal("unchanged"), ...watchValueParts }).readonly()
+]);
+var WatchStateSchema = z2.object({
+  key: WatchKeySchema,
+  phase: LiveStatePhaseSchema,
+  reason: LiveStateStopReasonSchema.optional(),
+  code: z2.string().optional(),
+  message: z2.string().optional()
+}).readonly();
+var WATCH_OPEN = "stitchkit.watch.open";
+var WATCH_CLOSE = "stitchkit.watch.close";
+var WATCH_VALUE = "stitchkit.watch.value";
+var WATCH_STATE = "stitchkit.watch.state";
+var watchContract = {
+  serverToClient: {
+    [WATCH_VALUE]: { args: z2.tuple([WatchValueSchema]) },
+    [WATCH_STATE]: { args: z2.tuple([WatchStateSchema]) }
+  },
+  clientToServer: {
+    [WATCH_OPEN]: { args: z2.tuple([WatchOpenSchema]), ack: WatchAcceptedSchema },
+    [WATCH_CLOSE]: { args: z2.tuple([z2.object({ key: WatchKeySchema }).readonly()]) }
+  }
+};
+function watchKeyString(key) {
+  return `${key.service}/${key.action}/${key.digest}`;
+}
+
+export { WatchDeltaSchema, WatchArrayOpSchema, diff, apply, deltaWins, WatchKeySchema, WatchHaveSchema, WatchValueSchema, WatchStateSchema, WATCH_OPEN, WATCH_CLOSE, WATCH_VALUE, WATCH_STATE, watchContract, watchKeyString };

package/dist/{index-zyvby92n.js → index-44ht2790.js}

@@ -6,12 +6,12 @@ import {
   formatZodError,
   normalizeError,
   validateDeclaredOutput
-} from "./index-7evdsyez.js";
+} from "./index-2hryh65w.js";
 import {
   AppError,
   STITCH_ERROR_STATUS,
   isStitchErrorCode
-} from "./index-0w9abg87.js";
+} from "./index-scs3f1eg.js";
 import {
   coerceJsonArgs
 } from "./index-7zbps32p.js";

package/dist/{index-27gm3d6g.js → index-6q3zjwaz.js}

@@ -3,7 +3,7 @@ import {
   inputIsQuery,
   parseSSE,
   readBoundedUtf8Lines
-} from "./index-qmgs7y68.js";
+} from "./index-1txvygak.js";
 import {
   ApiError,
   RequestCancellationError,
@@ -16,7 +16,7 @@ import {
   ContractStreamFrameSchema,
   DEFAULT_CONTRACT_STREAM_FRAME_BYTES,
   parseTrailingWildcard
-} from "./index-2bxcmqkb.js";
+} from "./index-kazec06k.js";
 import {
   isRecord,
   mapObject,

package/dist/{index-mnm4qp0p.js → index-79hb1wyh.js}

@@ -1,13 +1,13 @@
 import {
   collectTools,
   createToolRunner
-} from "./index-8c3a7m4g.js";
+} from "./index-2hrfpw2c.js";
 import {
   toolErrorFromResult
-} from "./index-zyvby92n.js";
+} from "./index-44ht2790.js";
 import {
   AppError
-} from "./index-0w9abg87.js";
+} from "./index-scs3f1eg.js";
 import {
   assertUniqueToolName
 } from "./index-r159gjwy.js";

package/dist/{index-apn8repm.js → index-7gqx71yd.js}

@@ -4,10 +4,10 @@ import {
 } from "./index-2qzskm8h.js";
 import {
   zodIssues
-} from "./index-7evdsyez.js";
+} from "./index-2hryh65w.js";
 import {
   AppError
-} from "./index-0w9abg87.js";
+} from "./index-scs3f1eg.js";
 
 // src/realtime/rejected-frame.ts
 var REALTIME_REJECTION_KEY = "@stitchkit/realtime-rejected";

package/dist/{index-7601qfg1.js → index-8dph3pw6.js}

@@ -3,18 +3,18 @@ import {
 } from "./index-sbdmyz75.js";
 import {
   collectToolSurface
-} from "./index-31jw8fjq.js";
+} from "./index-wb15909q.js";
 import {
   createToolRunner,
   formatToolError
-} from "./index-8c3a7m4g.js";
+} from "./index-2hrfpw2c.js";
 import {
   toolResultFromError
-} from "./index-zyvby92n.js";
+} from "./index-44ht2790.js";
 import {
   formatZodError,
   validateDeclaredOutput
-} from "./index-7evdsyez.js";
+} from "./index-2hryh65w.js";
 import {
   coerceJsonArgs
 } from "./index-7zbps32p.js";

package/dist/{index-90d7h2cr.js → index-bg8ypxzn.js}

@@ -2,15 +2,15 @@ import {
   contextContributionDelta,
   mergeContextContribution,
   prepareContextContribution
-} from "./index-p18f59zy.js";
+} from "./index-z78bjcxj.js";
 import {
   base64UrlToBytes,
   bytesToBase64Url
-} from "./index-2bxcmqkb.js";
+} from "./index-kazec06k.js";
 import {
   forbidden,
   unauthorized
-} from "./index-0w9abg87.js";
+} from "./index-scs3f1eg.js";
 import {
   isUnsafeKey,
   safeJsonParse

package/dist/{index-vchzar7e.js → index-db51n3xr.js}

@@ -10,7 +10,7 @@ import {
 import {
   createValidatedRealtimeSocket,
   isModuleNotFound
-} from "./index-apn8repm.js";
+} from "./index-7gqx71yd.js";
 import {
   DEFAULT_PROCESS_SIGNALS,
   RUNTIME_CONTEXT_RESERVED_KEYS,
@@ -22,7 +22,7 @@ import {
   isOriginAllowed,
   mediaTypeEssence,
   reportSignalError
-} from "./index-p18f59zy.js";
+} from "./index-z78bjcxj.js";
 import {
   getRequestContext,
   runWithRequestContext,
@@ -41,17 +41,17 @@ import {
   normalizeError,
   recordedErrorMessage,
   validateDeclaredOutput
-} from "./index-7evdsyez.js";
+} from "./index-2hryh65w.js";
 import {
   DEFAULT_CONTRACT_STREAM_FRAME_BYTES,
   joinRoutePath,
   parseTrailingWildcard
-} from "./index-2bxcmqkb.js";
+} from "./index-kazec06k.js";
 import {
   AppError,
   badRequest,
   forbidden
-} from "./index-0w9abg87.js";
+} from "./index-scs3f1eg.js";
 import {
   resolveTraceContext
 } from "./index-zcgf3gqf.js";

package/dist/{index-hw2chdvy.js → index-f475yj00.js}

@@ -36,7 +36,7 @@ import {
 import {
   ToolExecutionControlError,
   isToolExecutionControlError
-} from "./index-zyvby92n.js";
+} from "./index-44ht2790.js";
 import {
   isRecord,
   transportResult

package/dist/{index-q3ve2d1k.js → index-gbqjt8jz.js}

@@ -4,16 +4,16 @@ import {
 } from "./index-7rkhw9ec.js";
 import {
   collectToolSurface
-} from "./index-31jw8fjq.js";
+} from "./index-wb15909q.js";
 import {
   createToolRunner,
   formatToolError
-} from "./index-8c3a7m4g.js";
+} from "./index-2hrfpw2c.js";
 import {
   isToolExecutionControlError,
   toolCauseFromResult,
   toolResultFromError
-} from "./index-zyvby92n.js";
+} from "./index-44ht2790.js";
 import {
   isRecord
 } from "./index-77fekveh.js";

package/dist/index-gte38nbm.js

@@ -0,0 +1,101 @@
+import {
+  AppError,
+  STITCH_ERROR_STATUS
+} from "./index-scs3f1eg.js";
+
+// src/agent-runtime/sandbox.ts
+import { z } from "zod";
+var AgentSandboxRestrictionSchema = z.enum([
+  "network-denied",
+  "write-contained",
+  "secrets-hidden",
+  "process-contained"
+]);
+var AgentSandboxGradeSchema = z.discriminatedUnion("grade", [
+  z.object({ grade: z.literal("full"), restrictions: z.array(AgentSandboxRestrictionSchema) }).strict(),
+  z.object({
+    grade: z.literal("partial"),
+    restrictions: z.array(AgentSandboxRestrictionSchema),
+    gaps: z.array(AgentSandboxRestrictionSchema)
+  }).strict(),
+  z.object({ grade: z.literal("unavailable"), reason: z.string().min(1) }).strict()
+]);
+var probes = new WeakMap;
+function probeAgentProcessSandbox(sandbox, options = {}) {
+  if (options.refresh)
+    probes.delete(sandbox);
+  const present = probes.get(sandbox);
+  if (present)
+    return present;
+  const pending = Promise.resolve(sandbox.probe()).then((grade) => AgentSandboxGradeSchema.parse(grade));
+  probes.set(sandbox, pending);
+  return pending;
+}
+function missingSandboxRestrictions(grade, required) {
+  if (grade.grade === "unavailable")
+    return required;
+  const present = new Set(grade.restrictions);
+  return required.filter((restriction) => !present.has(restriction));
+}
+async function recordAgentSandboxProbe(input) {
+  const grade = await probeAgentProcessSandbox(input.sandbox);
+  const missing = missingSandboxRestrictions(grade, input.required);
+  await input.store.appendEvent({
+    conversationId: input.conversationId,
+    kind: "sandbox/probed",
+    payload: {
+      result: grade,
+      required: [...input.required],
+      missing: [...missing]
+    }
+  });
+  return grade;
+}
+
+// src/agent-runtime/coding-tool-refusals.ts
+function codingRefusal(code, message, options = {}) {
+  throw new AppError(code, message, STITCH_ERROR_STATUS[code], { message, ...options.details }, options.hint);
+}
+function codingPathRefusal(code, message, path, options = {}) {
+  codingRefusal(code, message, {
+    details: { path, ...options.details },
+    ...options.hint && { hint: options.hint }
+  });
+}
+function refuseMissingCodingPath(error, relative) {
+  const code = error?.code;
+  if (error instanceof Error && error.message.includes("is not a regular file")) {
+    codingPathRefusal("BAD_REQUEST", "This path is not a regular file", relative, {
+      hint: "Use list_directory to see what is here."
+    });
+  }
+  if (code === "ENOENT") {
+    codingPathRefusal("NOT_FOUND", "This path does not exist", relative, {
+      hint: "Use list_directory or glob to find the right path."
+    });
+  }
+  if (code === "ENOTDIR") {
+    codingPathRefusal("BAD_REQUEST", "A segment of this path is not a directory", relative, {
+      hint: "Check the path with list_directory."
+    });
+  }
+  if (code === "ELOOP") {
+    codingPathRefusal("FORBIDDEN", "This path is a symlink, which is not followed", relative, {
+      hint: "Read or write the target directly, by its own workspace-relative path."
+    });
+  }
+  if (code === "EISDIR") {
+    codingPathRefusal("BAD_REQUEST", "This path is not a regular file", relative, {
+      hint: "Use list_directory to see what is here."
+    });
+  }
+  throw error;
+}
+function refuseUnknownSpillReference(reference) {
+  codingRefusal("SPILL_REFERENCE_UNKNOWN", `No spilled output is held under \`${reference}\``, {
+    details: { reference },
+    hint: "Use the reference returned by the command that spilled its output, not a session or call id."
+  });
+}
+
+export { AgentSandboxRestrictionSchema, AgentSandboxGradeSchema, probeAgentProcessSandbox, missingSandboxRestrictions, recordAgentSandboxProbe, codingRefusal, codingPathRefusal, refuseMissingCodingPath, refuseUnknownSpillReference };

package/dist/{index-cp20z0n6.js → index-j7q0xj6d.js}

@@ -12,14 +12,16 @@ import {
   writeContainedFile
 } from "./index-bn2cjajt.js";
 import {
+  codingPathRefusal,
+  codingRefusal,
   missingSandboxRestrictions,
-  probeAgentProcessSandbox
-} from "./index-gskm1k5a.js";
+  probeAgentProcessSandbox,
+  refuseMissingCodingPath
+} from "./index-gte38nbm.js";
 import {
-  AppError,
   conflict,
   forbidden
-} from "./index-0w9abg87.js";
+} from "./index-scs3f1eg.js";
 import {
   defineRuntimeTool
 } from "./index-kc6h6hg0.js";
@@ -178,56 +180,6 @@ import { realpath as realpath2 } from "node:fs/promises";
 // src/agent-runtime/coding-tool-paths.ts
 import { lstat, realpath } from "node:fs/promises";
 import path from "node:path";
-
-// src/agent-runtime/coding-tool-refusals.ts
-var REFUSAL_STATUS = {
-  BAD_REQUEST: 400,
-  FORBIDDEN: 403,
-  NOT_FOUND: 404,
-  CONFLICT: 409,
-  SANDBOX_UNAVAILABLE: 503,
-  SANDBOX_INSUFFICIENT: 503
-};
-function codingRefusal(code, message, options = {}) {
-  throw new AppError(code, message, REFUSAL_STATUS[code], { message, ...options.details }, options.hint);
-}
-function codingPathRefusal(code, message, path, options = {}) {
-  codingRefusal(code, message, {
-    details: { path, ...options.details },
-    ...options.hint && { hint: options.hint }
-  });
-}
-function refuseMissingCodingPath(error, relative) {
-  const code = error?.code;
-  if (error instanceof Error && error.message.includes("is not a regular file")) {
-    codingPathRefusal("BAD_REQUEST", "This path is not a regular file", relative, {
-      hint: "Use list_directory to see what is here."
-    });
-  }
-  if (code === "ENOENT") {
-    codingPathRefusal("NOT_FOUND", "This path does not exist", relative, {
-      hint: "Use list_directory or glob to find the right path."
-    });
-  }
-  if (code === "ENOTDIR") {
-    codingPathRefusal("BAD_REQUEST", "A segment of this path is not a directory", relative, {
-      hint: "Check the path with list_directory."
-    });
-  }
-  if (code === "ELOOP") {
-    codingPathRefusal("FORBIDDEN", "This path is a symlink, which is not followed", relative, {
-      hint: "Read or write the target directly, by its own workspace-relative path."
-    });
-  }
-  if (code === "EISDIR") {
-    codingPathRefusal("BAD_REQUEST", "This path is not a regular file", relative, {
-      hint: "Use list_directory to see what is here."
-    });
-  }
-  throw error;
-}
-
-// src/agent-runtime/coding-tool-paths.ts
 function within(root, target) {
   const relative = path.relative(root, target);
   return relative === "" || !relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative);
@@ -1348,4 +1300,4 @@ function createAgentCodingTools(config) {
   ];
 }
 
-export { codingRefusal, AgentCodingToolLimitsSchema, AgentCodingToolAuthorizationSchema, AgentCodingToolPathAuthorizationSchema, createAgentCodingTools };
+export { AgentCodingToolLimitsSchema, AgentCodingToolAuthorizationSchema, AgentCodingToolPathAuthorizationSchema, createAgentCodingTools };

package/dist/{index-2bxcmqkb.js → index-kazec06k.js}

@@ -2,7 +2,7 @@ import {
   AppError,
   STITCH_ERROR_STATUS,
   isStitchErrorCode
-} from "./index-0w9abg87.js";
+} from "./index-scs3f1eg.js";
 import {
   isUnsafeKey
 } from "./index-kzfs85xp.js";

package/dist/{index-0w9abg87.js → index-scs3f1eg.js}

@@ -77,6 +77,9 @@ var STITCH_ERROR_STATUS = {
   STREAM_FRAME_TOO_LARGE: 500,
   STREAM_TERMINAL_MISSING: 500,
   STREAM_LIFETIME_EXCEEDED: 408,
+  SANDBOX_UNAVAILABLE: 503,
+  SANDBOX_INSUFFICIENT: 503,
+  SPILL_REFERENCE_UNKNOWN: 404,
   INTERNAL_SERVER_ERROR: 500
 };
 function isStitchErrorCode(code) {

package/dist/{index-31jw8fjq.js → index-wb15909q.js}

@@ -1,6 +1,6 @@
 import {
   contractToolMountable
-} from "./index-8c3a7m4g.js";
+} from "./index-2hrfpw2c.js";
 import {
   runtimeToolMountable
 } from "./index-kc6h6hg0.js";

package/dist/{index-p18f59zy.js → index-z78bjcxj.js}

@@ -1,7 +1,7 @@
 import {
   mergeMeta,
   resolveRouteParamsSchema
-} from "./index-2bxcmqkb.js";
+} from "./index-kazec06k.js";
 import {
   isUnsafeKey
 } from "./index-kzfs85xp.js";