stitchkit 0.90.2 → 0.90.4

package/dist/tool-invoker.js

@@ -1,8 +1,8 @@
 import {
   createToolInvoker
-} from "./index-79hb1wyh.js";
-import"./index-2hrfpw2c.js";
-import"./index-44ht2790.js";
+} from "./index-7t0wq6j5.js";
+import"./index-32vjke6q.js";
+import"./index-vcnfwrtr.js";
 import"./index-vsbzgd7b.js";
 import"./index-f9mb610r.js";
 import"./index-2hryh65w.js";
@@ -12,7 +12,7 @@ import"./index-scs3f1eg.js";
 import"./index-zcgf3gqf.js";
 import"./index-7zbps32p.js";
 import"./index-kzfs85xp.js";
-import"./index-r159gjwy.js";
+import"./index-fenaekmk.js";
 import"./index-cby4ar3v.js";
 import"./index-77fekveh.js";
 export {

package/dist/tools/cli-args.d.ts

@@ -18,6 +18,26 @@
  * call does (ADR 0014 parity).
  */
 import { z } from 'zod';
+/**
+ * A requested aggregate view over the result.
+ *
+ * `--by` always names the grouping field, in every form it appears in, so the
+ * grammar has one meaning rather than two: `--top 5 --by status` is the five
+ * largest groups of `status`, exactly as `--count-by status --top 5` is.
+ */
+export type CliResultView = {
+    kind: 'count';
+    field: string;
+    top?: number;
+} | {
+    kind: 'sum';
+    field: string;
+    by?: string;
+    top?: number;
+} | {
+    kind: 'table';
+    fields: readonly string[];
+};
 /** CLI-behaviour flags, parsed out of argv before the tool arguments. */
 export interface CliRunOptions {
     /** `--json` — emit compact success/error JSON records for scripts. */
@@ -34,6 +54,8 @@ export interface CliRunOptions {
     dryRun: boolean;
     /** `--help` / `-h` — print usage for the command. */
     help: boolean;
+    /** `--count-by` / `--sum` / `--top` / `--table` — aggregate instead of the collection. */
+    view?: CliResultView;
 }
 export interface ParsedCliArgs {
     /** The flat tool-argument object handed to `executeToolMethod`. */
@@ -88,5 +110,32 @@ export declare function parseCliArgs(argv: string[], schema: z.ZodType | undefin
     optionAliases?: ReadonlyMap<string, string>;
     positionals?: readonly string[];
 }): ParsedCliArgs;
+/** The application's own global options, lifted out of one invocation's argv. */
+export interface CliGlobalOptionsParse {
+    /** argv with the application-global tokens removed, ready for routing. */
+    argv: string[];
+    /** The validated values, as the application's own schema types them. */
+    globals: Record<string, unknown>;
+}
+/**
+ * Lift the APPLICATION's global options out of argv, wherever they stand.
+ *
+ * These are not arguments of any operation: which identity key to use, which
+ * checkout a call speaks for, which profile. They belong to the invocation, so
+ * they may precede the command name as easily as follow it — and a command's
+ * own parser must never see them, or an app-global would read as an unknown
+ * flag on every operation that does not declare it.
+ *
+ * Stripping them BEFORE routing is what keeps this one grammar rather than two:
+ * `routeCliArgv` then sees a command where a command is, `parseCliArgs` sees
+ * only operation arguments, and `passthrough` cannot swallow an app-global into
+ * a freeform bag. The token shape is the same `classifyLongOptionToken` the
+ * framework's own globals use, so `--root /x`, `--root=/x` and a bare boolean
+ * `--verbose` all behave as they do everywhere else.
+ *
+ * `--` ends the sweep: past it every token is a literal value, so a positional
+ * that happens to read as `--root` survives intact.
+ */
+export declare function extractCliGlobalOptions(argv: readonly string[], schema: z.ZodObject | undefined): CliGlobalOptionsParse;
 export {};
 //# sourceMappingURL=cli-args.d.ts.map

package/dist/tools/cli-args.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-args.d.ts","sourceRoot":"","sources":["../../src/tools/cli-args.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,yEAAyE;AACzE,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,IAAI,EAAE,OAAO,CAAC;IACd,iEAAiE;IACjE,IAAI,EAAE,OAAO,CAAC;IACd,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,KAAK,EAAE,OAAO,CAAC;IACf,qEAAqE;IACrE,MAAM,EAAE,OAAO,CAAC;IAChB,qDAAqD;IACrD,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,+BAA+B;IAC/B,OAAO,EAAE,aAAa,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,KAAK,SAAS,GACV,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,GACP,QAAQ,GACR,OAAO,CAAC;AAEZ,UAAU,SAAS;IACjB,IAAI,EAAE,SAAS,CAAC;IAChB,uEAAuE;IACvE,WAAW,CAAC,EAAE,SAAS,CAAC;CACzB;AAOD,eAAO,MAAM,oBAAoB,aAA+C,CAAC;AA0BjF;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,YAAY,CAsFlF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IAChC,IAAI,SAAsB;CACpC;AAuED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAI1F;AA8FD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EAAE,EACd,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,SAAS,EAC7B,MAAM,GAAE;IACN,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B,GACL,aAAa,CAwMf"}
+{"version":3,"file":"cli-args.d.ts","sourceRoot":"","sources":["../../src/tools/cli-args.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAEjD,yEAAyE;AACzE,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,IAAI,EAAE,OAAO,CAAC;IACd,iEAAiE;IACjE,IAAI,EAAE,OAAO,CAAC;IACd,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,KAAK,EAAE,OAAO,CAAC;IACf,qEAAqE;IACrE,MAAM,EAAE,OAAO,CAAC;IAChB,qDAAqD;IACrD,IAAI,EAAE,OAAO,CAAC;IACd,0FAA0F;IAC1F,IAAI,CAAC,EAAE,aAAa,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,+BAA+B;IAC/B,OAAO,EAAE,aAAa,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,KAAK,SAAS,GACV,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,GACP,QAAQ,GACR,OAAO,CAAC;AAEZ,UAAU,SAAS;IACjB,IAAI,EAAE,SAAS,CAAC;IAChB,uEAAuE;IACvE,WAAW,CAAC,EAAE,SAAS,CAAC;CACzB;AAQD,eAAO,MAAM,oBAAoB,aAA+C,CAAC;AA0BjF;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,YAAY,CAsFlF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IAChC,IAAI,SAAsB;CACpC;AAuED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAI1F;AA8FD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EAAE,EACd,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,SAAS,EAC7B,MAAM,GAAE;IACN,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B,GACL,aAAa,CAsOf;AAED,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC,0EAA0E;IAC1E,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,MAAM,EAAE,CAAC,CAAC,SAAS,GAAG,SAAS,GAC9B,qBAAqB,CA8CvB"}

package/dist/tools/cli-command.d.ts

@@ -5,6 +5,13 @@ import { type ToolResult } from './execute.js';
 export interface CliCommandContext<TInput extends ZodObject> extends CliWriters {
     input: z.output<TInput>;
     options: Readonly<CliRunOptions>;
+    /**
+     * The application's own global options for this invocation, already validated
+     * against `CliConfig.globalOptions`. Empty when the CLI declares none. Typed
+     * loosely because a command is defined independently of the CLI it is mounted
+     * on — read it through the same schema the application declared.
+     */
+    globals: Readonly<Record<string, unknown>>;
 }
 export interface CliCommandDefinitionBase<TInput extends ZodObject> {
     name: string;
@@ -41,5 +48,5 @@ export interface PreparedCliCommandEmission {
 export declare function prepareCliCommandEmission(definition: CliCommandDefinition, result: ToolResult, options: Readonly<CliRunOptions>): PreparedCliCommandEmission;
 export declare function cliCommandPresentationSchema(definition: CliCommandDefinition): Record<string, unknown>;
 /** Execute a CLI-only definition without inventing a tool operation identity. */
-export declare function executeCliCommand(definition: CliCommandDefinition, rawArgs: Record<string, unknown>, options: CliRunOptions, writers: CliWriters, coerceJson: boolean): Promise<ToolResult>;
+export declare function executeCliCommand(definition: CliCommandDefinition, rawArgs: Record<string, unknown>, options: CliRunOptions, writers: CliWriters, coerceJson: boolean, globals?: Readonly<Record<string, unknown>>): Promise<ToolResult>;
 //# sourceMappingURL=cli-command.d.ts.map

package/dist/tools/cli-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-command.d.ts","sourceRoot":"","sources":["../../src/tools/cli-command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAEjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EAAE,KAAK,UAAU,EAAuB,MAAM,WAAW,CAAC;AAGjE,MAAM,WAAW,iBAAiB,CAAC,MAAM,SAAS,SAAS,CAAE,SAAQ,UAAU;IAC7E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB,CAAC,MAAM,SAAS,SAAS;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,8BAA8B,CAC7C,MAAM,SAAS,SAAS,EACxB,OAAO,SAAS,OAAO,CACvB,SAAQ,wBAAwB,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,CACP,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC,KAC/B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACpD,0FAA0F;IAC1F,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1B,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;KAClC,KAAK,MAAM,CAAC;IACb,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC;CAClD;AAED,MAAM,WAAW,iCAAiC,CAAC,MAAM,SAAS,SAAS,CACzE,SAAQ,wBAAwB,CAAC,MAAM,CAAC;IACxC,MAAM,CAAC,EAAE,KAAK,CAAC;IACf,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,OAAO,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvE;AAED,MAAM,MAAM,oBAAoB,GAC5B,8BAA8B,CAAC,SAAS,EAAE,OAAO,CAAC,GAClD,iCAAiC,CAAC,SAAS,CAAC,CAAC;AAEjD,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,MAAM,SAAS,SAAS,EAAE,OAAO,SAAS,OAAO,EAChF,UAAU,EAAE,8BAA8B,CAAC,MAAM,EAAE,OAAO,CAAC,GAC1D,8BAA8B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACnD,wBAAgB,gBAAgB,CAAC,MAAM,SAAS,SAAS,EACvD,UAAU,EAAE,iCAAiC,CAAC,MAAM,CAAC,GACpD,iCAAiC,CAAC,MAAM,CAAC,CAAC;AAK7C,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,UAAU,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,+EAA+E;AAC/E,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,oBAAoB,EAChC,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,GAC/B,0BAA0B,CAwB5B;AAED,wBAAgB,4BAA4B,CAC1C,UAAU,EAAE,oBAAoB,GAC/B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAKzB;AAED,iFAAiF;AACjF,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,oBAAoB,EAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,UAAU,EACnB,UAAU,EAAE,OAAO,GAClB,OAAO,CAAC,UAAU,CAAC,CAmCrB"}
+{"version":3,"file":"cli-command.d.ts","sourceRoot":"","sources":["../../src/tools/cli-command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAEjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EAAE,KAAK,UAAU,EAAuB,MAAM,WAAW,CAAC;AAGjE,MAAM,WAAW,iBAAiB,CAAC,MAAM,SAAS,SAAS,CAAE,SAAQ,UAAU;IAC7E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;IACjC;;;;;OAKG;IACH,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,wBAAwB,CAAC,MAAM,SAAS,SAAS;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,8BAA8B,CAC7C,MAAM,SAAS,SAAS,EACxB,OAAO,SAAS,OAAO,CACvB,SAAQ,wBAAwB,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,CACP,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC,KAC/B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACpD,0FAA0F;IAC1F,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1B,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;KAClC,KAAK,MAAM,CAAC;IACb,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC;CAClD;AAED,MAAM,WAAW,iCAAiC,CAAC,MAAM,SAAS,SAAS,CACzE,SAAQ,wBAAwB,CAAC,MAAM,CAAC;IACxC,MAAM,CAAC,EAAE,KAAK,CAAC;IACf,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,OAAO,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvE;AAED,MAAM,MAAM,oBAAoB,GAC5B,8BAA8B,CAAC,SAAS,EAAE,OAAO,CAAC,GAClD,iCAAiC,CAAC,SAAS,CAAC,CAAC;AAEjD,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,MAAM,SAAS,SAAS,EAAE,OAAO,SAAS,OAAO,EAChF,UAAU,EAAE,8BAA8B,CAAC,MAAM,EAAE,OAAO,CAAC,GAC1D,8BAA8B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACnD,wBAAgB,gBAAgB,CAAC,MAAM,SAAS,SAAS,EACvD,UAAU,EAAE,iCAAiC,CAAC,MAAM,CAAC,GACpD,iCAAiC,CAAC,MAAM,CAAC,CAAC;AAK7C,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,UAAU,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,+EAA+E;AAC/E,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,oBAAoB,EAChC,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,GAC/B,0BAA0B,CAwB5B;AAED,wBAAgB,4BAA4B,CAC1C,UAAU,EAAE,oBAAoB,GAC/B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAKzB;AAED,iFAAiF;AACjF,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,oBAAoB,EAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,UAAU,EACnB,UAAU,EAAE,OAAO,EACnB,OAAO,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAM,GAC9C,OAAO,CAAC,UAAU,CAAC,CAoCrB"}

package/dist/tools/cli-installer.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Generate the one-line installer, from the manifest, on the server.
+ *
+ * A `curl … | sh` runs on a machine where nothing is installed yet — including
+ * `jq`. An installer that fetches the manifest and parses it therefore fails on
+ * exactly the machines it exists for. Generating the script *from* the manifest,
+ * with the URL and the digest already substituted, removes the dependency: the
+ * script downloads one file, checks one digest and renames it into place.
+ */
+import type { CliBuildAsset, CliBuildManifest } from './cli-manifest.js';
+export interface CliInstallerConfig {
+    manifest: CliBuildManifest;
+    /** The asset this script installs — one script per target. */
+    asset: CliBuildAsset;
+    /** The name the binary takes on the PATH; defaults to the manifest name. */
+    binaryName?: string;
+    /** Default install directory; overridable by `INSTALL_DIR` at run time. */
+    installDir?: string;
+}
+/**
+ * Render the installer for one asset.
+ *
+ * The three properties that matter, in the script rather than in a comment:
+ * no JSON parsing, the digest is checked against the **decompressed** bytes, and
+ * the final step is a rename — an interrupted download leaves a temporary file,
+ * never a half-written executable on someone's PATH.
+ */
+export declare function renderCliInstaller(config: CliInstallerConfig): string;
+//# sourceMappingURL=cli-installer.d.ts.map

package/dist/tools/cli-installer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-installer.d.ts","sourceRoot":"","sources":["../../src/tools/cli-installer.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEtE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,8DAA8D;IAC9D,KAAK,EAAE,aAAa,CAAC;IACrB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAOD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAuErE"}

package/dist/tools/cli-manifest.d.ts

@@ -0,0 +1,83 @@
+/**
+ * The build manifest a CLI is distributed by — one schema, so the publisher,
+ * the server and the installed binary cannot disagree about it.
+ *
+ * Everything here is Zod and arithmetic: no filesystem, no network. The half
+ * that downloads lives in `cli-update.ts`, the half that writes shell in
+ * `cli-installer.ts`, and both read these shapes.
+ */
+import { z } from 'zod';
+/** What a build runs on. The values are Node's own, so a CLI can name its own. */
+export declare const CliBuildTargetSchema: z.ZodObject<{
+    platform: z.ZodString;
+    arch: z.ZodString;
+}, z.core.$strip>;
+export type CliBuildTarget = z.infer<typeof CliBuildTargetSchema>;
+/**
+ * One downloadable build.
+ *
+ * `size` and `sha256` describe the **decompressed** bytes — what will actually
+ * be executed. A digest over the transferred archive proves the transfer and
+ * says nothing about the file that ends up on the PATH, which is the one the
+ * user runs.
+ */
+export declare const CliBuildAssetSchema: z.ZodObject<{
+    platform: z.ZodString;
+    arch: z.ZodString;
+    url: z.ZodURL;
+    compression: z.ZodDefault<z.ZodEnum<{
+        gzip: "gzip";
+        none: "none";
+    }>>;
+    size: z.ZodInt;
+    sha256: z.ZodString;
+}, z.core.$strip>;
+export type CliBuildAsset = z.infer<typeof CliBuildAssetSchema>;
+/**
+ * The document a CLI's distribution endpoint serves.
+ *
+ * `commit` and `builtAt` are here, not only inside the binary, because the
+ * question "is what I am running the build this version means" is asked from
+ * both sides.
+ */
+export declare const CliBuildManifestSchema: z.ZodObject<{
+    name: z.ZodString;
+    version: z.ZodString;
+    commit: z.ZodString;
+    builtAt: z.ZodISODateTime;
+    assets: z.ZodArray<z.ZodObject<{
+        platform: z.ZodString;
+        arch: z.ZodString;
+        url: z.ZodURL;
+        compression: z.ZodDefault<z.ZodEnum<{
+            gzip: "gzip";
+            none: "none";
+        }>>;
+        size: z.ZodInt;
+        sha256: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type CliBuildManifest = z.infer<typeof CliBuildManifestSchema>;
+/** The stamp a build carries inside itself, so the tool can say what it is. */
+export declare const CliBuildStampSchema: z.ZodObject<{
+    version: z.ZodString;
+    commit: z.ZodString;
+    builtAt: z.ZodISODateTime;
+}, z.core.$strip>;
+export type CliBuildStamp = z.infer<typeof CliBuildStampSchema>;
+/** One line a `--version` can print: what it is, not what the reader infers. */
+export declare function formatCliBuildStamp(stamp: CliBuildStamp, name?: string): string;
+/** The target the running process is on, in the manifest's own vocabulary. */
+export declare function currentCliBuildTarget(): CliBuildTarget;
+/** The asset for one target, or `undefined` when this build was not published. */
+export declare function selectCliBuildAsset(manifest: CliBuildManifest, target?: CliBuildTarget): CliBuildAsset | undefined;
+/**
+ * Refuse republishing a version from a different commit.
+ *
+ * A version is a promise about contents. Publishing `1.4.2` twice from two trees
+ * means everyone who already installed `1.4.2` is told they are current and
+ * never receives the fix — and nothing about their machine looks wrong. The
+ * check is one comparison and belongs in the publisher, before the upload.
+ */
+export declare function assertCliPublishable(previous: CliBuildManifest | undefined, next: CliBuildManifest): void;
+//# sourceMappingURL=cli-manifest.d.ts.map

package/dist/tools/cli-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-manifest.d.ts","sourceRoot":"","sources":["../../src/tools/cli-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,kFAAkF;AAClF,eAAO,MAAM,oBAAoB;;;iBAG/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;iBAK9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;iBAMjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB;;;;iBAI9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAG/E;AAED,8EAA8E;AAC9E,wBAAgB,qBAAqB,IAAI,cAAc,CAEtD;AAED,kFAAkF;AAClF,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,GAAE,cAAwC,GAC/C,aAAa,GAAG,SAAS,CAI3B;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,EACtC,IAAI,EAAE,gBAAgB,GACrB,IAAI,CAQN"}

package/dist/tools/cli-policy.d.ts

@@ -13,7 +13,12 @@ export interface CliCommandPresentation {
     presentationSchema: Record<string, unknown>;
     /** Canonical field name → one short alias. */
     aliases: ReadonlyMap<string, string>;
-    /** `undefined` retains automatic non-boolean schema order. */
+    /**
+     * `undefined` retains automatic non-boolean schema order. A trailing ARRAY
+     * field is variadic — it takes every remaining token. An array declared
+     * anywhere else keeps taking exactly one (a JSON-array token), and command
+     * help says which is which: only the variadic tail renders as `<name...>`.
+     */
     positionals?: readonly string[];
 }
 export declare function applyCliPresentationPolicy(command: string, descriptor: Omit<CliCommandPresentation, 'aliases' | 'positionals'>, config: CliPresentationPolicyConfig): CliCommandPresentation;

package/dist/tools/cli-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-policy.d.ts","sourceRoot":"","sources":["../../src/tools/cli-policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAGlD,MAAM,WAAW,2BAA2B;IAC1C,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,6FAA6F;IAC7F,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CAC3D;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,8CAA8C;IAC9C,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,8DAA8D;IAC9D,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC;AAkFD,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,aAAa,CAAC,EACnE,MAAM,EAAE,2BAA2B,GAClC,sBAAsB,CAexB;AAED,wFAAwF;AACxF,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,sBAAsB,CAAC,EACrD,MAAM,EAAE,2BAA2B,GAClC,IAAI,CAWN"}
+{"version":3,"file":"cli-policy.d.ts","sourceRoot":"","sources":["../../src/tools/cli-policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAGlD,MAAM,WAAW,2BAA2B;IAC1C,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,6FAA6F;IAC7F,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CAC3D;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,8CAA8C;IAC9C,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC;AAkFD,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,IAAI,CAAC,sBAAsB,EAAE,SAAS,GAAG,aAAa,CAAC,EACnE,MAAM,EAAE,2BAA2B,GAClC,sBAAsB,CAexB;AAED,wFAAwF;AACxF,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,sBAAsB,CAAC,EACrD,MAAM,EAAE,2BAA2B,GAClC,IAAI,CAWN"}

package/dist/tools/cli-profile.d.ts

@@ -0,0 +1,40 @@
+import type { z } from 'zod';
+import { AppError } from '../contract/errors.js';
+/** A refusal a CLI can report as an ordinary error result. */
+export declare class CliProfileError extends AppError {
+    constructor(message: string, code?: 'NOT_FOUND' | 'BAD_REQUEST' | 'FORBIDDEN');
+}
+export interface CliProfileStoreConfig<TSchema extends z.ZodType> {
+    /** Directory holding one `<name>.json` per profile, mode 0700. */
+    directory: string;
+    /** What one profile file must contain — an address and a credential, typically. */
+    schema: TSchema;
+    /**
+     * How to create a missing profile, in the application's own words. It is
+     * printed with the refusal, because "profile not found" without the command
+     * that creates it leaves the reader to guess the file format.
+     */
+    createHint?: (name: string, path: string) => string;
+    /** Where the substitution notice goes; default stderr. */
+    announce?: (line: string) => void;
+}
+export interface ResolvedCliProfile<TValue> {
+    name: string;
+    path: string;
+    value: TValue;
+    /** True when no name was asked for and the only configured profile was taken. */
+    substituted: boolean;
+}
+export interface CliProfileStore<TValue> {
+    directory: string;
+    pathFor(name: string): string;
+    list(): string[];
+    read(name: string): TValue;
+    /** Write a profile, creating the directory 0700 and the file 0600. */
+    write(name: string, value: unknown): string;
+    /** The rule this module exists for. `undefined` means "no name was given". */
+    resolve(name: string | undefined): ResolvedCliProfile<TValue>;
+}
+/** Build a profile store over a directory of `0600` JSON files. */
+export declare function createCliProfileStore<TSchema extends z.ZodType>(config: CliProfileStoreConfig<TSchema>): CliProfileStore<z.output<TSchema>>;
+//# sourceMappingURL=cli-profile.d.ts.map

package/dist/tools/cli-profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-profile.d.ts","sourceRoot":"","sources":["../../src/tools/cli-profile.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAO9C,8DAA8D;AAC9D,qBAAa,eAAgB,SAAQ,QAAQ;IAC3C,YAAY,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,WAAW,GAAG,aAAa,GAAG,WAAyB,EAGzF;CACF;AAED,MAAM,WAAW,qBAAqB,CAAC,OAAO,SAAS,CAAC,CAAC,OAAO;IAC9D,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,MAAM,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACpD,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB,CAAC,MAAM;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,eAAe,CAAC,MAAM;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B,IAAI,IAAI,MAAM,EAAE,CAAC;IACjB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,sEAAsE;IACtE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC;IAC5C,8EAA8E;IAC9E,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;CAC/D;AAWD,mEAAmE;AACnE,wBAAgB,qBAAqB,CAAC,OAAO,SAAS,CAAC,CAAC,OAAO,EAC7D,MAAM,EAAE,qBAAqB,CAAC,OAAO,CAAC,GACrC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAqFpC"}

package/dist/tools/cli-update.d.ts

@@ -0,0 +1,64 @@
+import { type CliBuildAsset, type CliBuildManifest, type CliBuildTarget } from './cli-manifest.js';
+export interface CliUpdateCheckConfig {
+    manifestUrl: string;
+    currentVersion: string;
+    /** At most one network check per interval; default 24 h. */
+    intervalMs?: number;
+    /** When the last check happened, from the application's own state. */
+    lastCheckedAt?: number;
+    now?: number;
+    /** Header+body deadline for the check; default 2 s. */
+    timeoutMs?: number;
+    target?: CliBuildTarget;
+    allowPrivateHosts?: boolean;
+}
+/**
+ * Four answers, never three. "Could not ask" is not "up to date": collapsing
+ * them is how a tool goes quiet about its own staleness for months.
+ */
+export type CliUpdateCheck = {
+    status: 'skipped';
+    nextCheckAt: number;
+} | {
+    status: 'current';
+    version: string;
+} | {
+    status: 'outdated';
+    version: string;
+    manifest: CliBuildManifest;
+    asset?: CliBuildAsset;
+} | {
+    status: 'unknown';
+    reason: string;
+};
+/**
+ * Compare two versions, or refuse to. `undefined` means "these are not
+ * comparable", which the caller reports as unknown rather than guessing an
+ * order — an update prompt derived from a guess is worse than no prompt.
+ */
+export declare function compareCliVersions(left: string, right: string): number | undefined;
+/** Ask whether a newer build exists. Never throws; never blocks for long. */
+export declare function checkCliUpdate(config: CliUpdateCheckConfig): Promise<CliUpdateCheck>;
+export interface CliUpdateApplyConfig {
+    asset: CliBuildAsset;
+    /** The file to replace; defaults to the running executable. */
+    targetPath?: string;
+    timeoutMs?: number;
+    maxBytes?: number;
+    allowPrivateHosts?: boolean;
+}
+export interface AppliedCliUpdate {
+    path: string;
+    bytes: number;
+    sha256: string;
+}
+/**
+ * Download, verify and replace the binary.
+ *
+ * The digest is taken over the decompressed bytes — the file that will be
+ * executed — and the last step is a rename inside the target's own directory,
+ * so the executable on the PATH is either the old one or the new one and never
+ * a partial write.
+ */
+export declare function applyCliUpdate(config: CliUpdateApplyConfig): Promise<AppliedCliUpdate>;
+//# sourceMappingURL=cli-update.d.ts.map

package/dist/tools/cli-update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-update.d.ts","sourceRoot":"","sources":["../../src/tools/cli-update.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,gBAAgB,EAErB,KAAK,cAAc,EAGpB,MAAM,gBAAgB,CAAC;AASxB,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAC;IAAC,KAAK,CAAC,EAAE,aAAa,CAAA;CAAE,GAC1F;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAe1C;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAalF;AAED,6EAA6E;AAC7E,wBAAsB,cAAc,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CA2C1F;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,aAAa,CAAC;IACrB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAmC5F"}

package/dist/tools/cli-view.d.ts

@@ -0,0 +1,12 @@
+import { type CliResultView } from './cli-args.js';
+/** What a view produces: a JSON value, or the one human-facing shape. */
+export type CliViewOutput = {
+    kind: 'json';
+    data: unknown;
+} | {
+    kind: 'text';
+    text: string;
+};
+/** Compute the requested view, or refuse it with a message naming the field. */
+export declare function renderCliView(data: unknown, view: CliResultView): CliViewOutput;
+//# sourceMappingURL=cli-view.d.ts.map

package/dist/tools/cli-view.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-view.d.ts","sourceRoot":"","sources":["../../src/tools/cli-view.ts"],"names":[],"mappings":"AAeA,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAElE,yEAAyE;AACzE,MAAM,MAAM,aAAa,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAuH7F,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,aAAa,CA+B/E"}

package/dist/tools/cli.d.ts

@@ -1,3 +1,4 @@
+import type { ZodObject, z } from 'zod';
 import type { ServiceDef, StitchLogger } from '../server/types.js';
 import { type CliCommandDefinition } from './cli-command.js';
 import { type ExitCodeMap } from './cli-format.js';
@@ -6,7 +7,7 @@ import { type CliWaitConfig } from './cli-wait.js';
 import { type ErrorHintFn, type ToolCallHooks, type ToolLifecycle } from './execute.js';
 import type { RuntimeToolDefinition } from './runtime-tool.js';
 export type CliSurfaceSource<TAuth, TValue> = readonly TValue[] | ((auth: Awaited<TAuth> | undefined) => readonly TValue[]);
-export interface CliConfig<TAuth = unknown, TContext extends Record<string, unknown> = Record<string, unknown>> extends CliPresentationPolicyConfig {
+export interface CliConfig<TAuth = unknown, TContext extends Record<string, unknown> = Record<string, unknown>, TGlobals extends ZodObject = ZodObject> extends CliPresentationPolicyConfig {
     /** Program name — shown in help and unknown-command messages. */
     name: string;
     /** Program version — printed by `--version`. */
@@ -23,13 +24,27 @@ export interface CliConfig<TAuth = unknown, TContext extends Record<string, unkn
      * promise of one.
      */
     auth?: TAuth | Promise<TAuth>;
-    /** Lazily resolve identity only when a managed command/surface actually needs it. */
-    resolveAuth?: () => TAuth | Promise<TAuth>;
+    /**
+     * Lazily resolve identity only when a managed command/surface actually needs
+     * it. Receives the application's global options, so `--caller <key>` can
+     * select WHICH identity this invocation speaks as.
+     */
+    resolveAuth?: (globals: z.output<TGlobals>) => TAuth | Promise<TAuth>;
+    /**
+     * The application's OWN global options — invocation context that belongs to
+     * no single operation: which identity key, which checkout, which profile.
+     * Declared as a Zod object of optional fields; `createCli` lifts these flags
+     * out of argv wherever they stand (before or after the command name),
+     * validates them against this schema and keeps them out of every operation's
+     * arguments. A name that collides with a framework option or with a field of
+     * any command is a startup error, never silent shadowing.
+     */
+    globalOptions?: TGlobals;
     /**
      * Context merged into every handler. Typed against the app's context shape
      * when the CLI is built via `createToolkit<AppContext>()`.
      */
-    context?: (auth: Awaited<TAuth> | undefined) => TContext;
+    context?: (auth: Awaited<TAuth> | undefined, globals: z.output<TGlobals>) => TContext;
     /** Explicit cancellation for this invocation; applications may bind SIGINT to it. */
     signal?: AbortSignal;
     /** Tool-call observability hooks — `afterToolCall` fires for every result,
@@ -87,5 +102,5 @@ export interface CliConfig<TAuth = unknown, TContext extends Record<string, unkn
     stdin?: () => Promise<string | null>;
 }
 /** Build and run one mixed contract/runtime/native CLI surface, then exit. */
-export declare function createCli<TAuth = unknown, TContext extends Record<string, unknown> = Record<string, unknown>>(config: CliConfig<TAuth, TContext>): Promise<void>;
+export declare function createCli<TAuth = unknown, TContext extends Record<string, unknown> = Record<string, unknown>, TGlobals extends ZodObject = ZodObject>(config: CliConfig<TAuth, TContext, TGlobals>): Promise<void>;
 //# sourceMappingURL=cli.d.ts.map

package/dist/tools/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/tools/cli.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAQhE,OAAO,EACL,KAAK,oBAAoB,EAI1B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAsB,KAAK,WAAW,EAAc,MAAM,cAAc,CAAC;AAChF,OAAO,EAIL,KAAK,2BAA2B,EACjC,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,KAAK,aAAa,EAAiB,MAAM,YAAY,CAAC;AAC/D,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,aAAa,EAGnB,MAAM,WAAW,CAAC;AAInB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAI5D,MAAM,MAAM,gBAAgB,CAAC,KAAK,EAAE,MAAM,IACtC,SAAS,MAAM,EAAE,GACjB,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,KAAK,SAAS,MAAM,EAAE,CAAC,CAAC;AAE9D,MAAM,WAAW,SAAS,CACxB,KAAK,GAAG,OAAO,EACf,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAClE,SAAQ,2BAA2B;IACnC,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC/C,uFAAuF;IACvF,YAAY,CAAC,EAAE,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IAC9D,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC3C;;;;OAIG;IACH,IAAI,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,qFAAqF;IACrF,WAAW,CAAC,EAAE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3C;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,KAAK,QAAQ,CAAC;IACzD,qFAAqF;IACrF,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;+DAC2D;IAC3D,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;;OAIG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,wEAAwE;IACxE,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,0EAA0E;IAC1E,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kEAAkE;IAClE,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACrC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrE;;;OAGG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,oEAAoE;IACpE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,oEAAoE;IACpE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,gEAAgE;IAChE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACtC;AAmUD,8EAA8E;AAC9E,wBAAsB,SAAS,CAC7B,KAAK,GAAG,OAAO,EACf,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClE,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CA+RnD"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/tools/cli.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxC,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAShE,OAAO,EACL,KAAK,oBAAoB,EAI1B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAsB,KAAK,WAAW,EAAc,MAAM,cAAc,CAAC;AAChF,OAAO,EAIL,KAAK,2BAA2B,EACjC,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,KAAK,aAAa,EAAiB,MAAM,YAAY,CAAC;AAC/D,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,aAAa,EAInB,MAAM,WAAW,CAAC;AAKnB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAI5D,MAAM,MAAM,gBAAgB,CAAC,KAAK,EAAE,MAAM,IACtC,SAAS,MAAM,EAAE,GACjB,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,KAAK,SAAS,MAAM,EAAE,CAAC,CAAC;AAE9D,MAAM,WAAW,SAAS,CACxB,KAAK,GAAG,OAAO,EACf,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClE,QAAQ,SAAS,SAAS,GAAG,SAAS,CACtC,SAAQ,2BAA2B;IACnC,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC/C,uFAAuF;IACvF,YAAY,CAAC,EAAE,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IAC9D,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC3C;;;;OAIG;IACH,IAAI,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACtE;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,QAAQ,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;IACtF,qFAAqF;IACrF,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;+DAC2D;IAC3D,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;;OAIG;IACH,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,wEAAwE;IACxE,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,0EAA0E;IAC1E,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kEAAkE;IAClE,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACrC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrE;;;OAGG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,oEAAoE;IACpE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,oEAAoE;IACpE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,gEAAgE;IAChE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACtC;AAsXD,8EAA8E;AAC9E,wBAAsB,SAAS,CAC7B,KAAK,GAAG,OAAO,EACf,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClE,QAAQ,SAAS,SAAS,GAAG,SAAS,EACtC,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CA8c7D"}

package/dist/tools/connections/index.d.ts

@@ -11,9 +11,10 @@
  * outbound request is checked against the connection's own host (plus any
  * explicit `allowHosts`), and credentials are resolved separately for each call.
  */
+export type { RuntimeToolTransport } from '../runtime-tool.js';
 export { defineMcpClientConnection, defineOpenApiConnection } from './define.js';
 export { ConnectionAuthorizationRequiredError, ConnectionBudgetExceededError, ConnectionRequestError, ConnectionUrlError, } from './errors.js';
 export { mountConnections } from './mount.js';
-export type { ConnectionTokenProvider } from './runtime.js';
+export type { ConnectionTokenProvider, ConnectionToolSkipReporter, SkippedConnectionTool, } from './runtime.js';
 export type { ConnectionBudget, ConnectionDefinition, ConnectionMountOptions, McpClientConnection, McpClientConnectionConfig, McpConnectionTransport, McpToolFilter, OpenApiConnection, OpenApiConnectionConfig, } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/tools/connections/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/connections/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAC9E,OAAO,EACL,oCAAoC,EACpC,6BAA6B,EAC7B,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,YAAY,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AACzD,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,yBAAyB,EACzB,sBAAsB,EACtB,aAAa,EACb,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/connections/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,YAAY,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAC9E,OAAO,EACL,oCAAoC,EACpC,6BAA6B,EAC7B,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,YAAY,EACV,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,yBAAyB,EACzB,sBAAsB,EACtB,aAAa,EACb,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,SAAS,CAAC"}

package/dist/tools/connections/index.js

@@ -1,7 +1,10 @@
 import {
   defineRuntimeTool
-} from "../../index-kc6h6hg0.js";
-import"../../index-r159gjwy.js";
+} from "../../index-8z9we758.js";
+import {
+  declaresDraft07,
+  withDefsDialect
+} from "../../index-fenaekmk.js";
 import"../../index-cby4ar3v.js";
 import {
   isRecord
@@ -527,14 +530,35 @@ async function withConnectionToken(params, body) {
 function zodObjectFromJsonSchema(schema) {
   if (!schema || Object.keys(schema).length === 0)
     return z.looseObject({});
-  const parsed = z.fromJSONSchema(schema);
+  const parsed = z.fromJSONSchema(reconcileDefinitionKeyword(schema));
   if (parsed instanceof z.ZodObject)
     return parsed;
   return z.looseObject({});
 }
+function reconcileDefinitionKeyword(schema) {
+  return declaresDraft07(schema.$schema) ? schema : withDefsDialect(schema);
+}
 function sanitizeToolName(value) {
   return value.replace(/[^a-zA-Z0-9_-]+/g, "_").replace(/^_+|_+$/g, "") || "operation";
 }
+function reportSkippedConnectionTool(skipped) {
+  console.warn(`[stitchkit] connection "${skipped.connection}": tool "${skipped.tool}" not mounted — ${skipped.reason}`);
+}
+function mountToolsTolerantly(entries, connection, nameOf, build, onSkipped) {
+  const mounted = [];
+  for (const entry of entries) {
+    try {
+      mounted.push(build(entry));
+    } catch (error) {
+      onSkipped({
+        connection,
+        tool: nameOf(entry),
+        reason: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  return mounted;
+}
 
 // src/tools/connections/schema-budget.ts
 var schemaBytes = new WeakMap;
@@ -551,7 +575,7 @@ function jsonSchemaBytes(schema) {
 }
 
 // src/tools/connections/mcp.ts
-async function mountMcpConnection(connection, instanceId) {
+async function mountMcpConnection(connection, instanceId, onSkipped) {
   const url = assertConnectionUrl(connection.transport.url, connection.name);
   const allowedHosts = connectionAllowedHosts(url, connection.allowHosts);
   assertAllowedHost(url, allowedHosts, connection.name);
@@ -568,7 +592,7 @@ async function mountMcpConnection(connection, instanceId) {
   }).finally(() => discovery.teardown());
   const discovered = readDiscoveredTools(listed, connection.name);
   const filtered = filterMcpTools(discovered, connection.tools);
-  return filtered.map((tool) => {
+  return mountToolsTolerantly(filtered, connection.name, (tool) => tool.name, (tool) => {
     const name = tool.name;
     const description = tool.description ?? `External MCP tool "${name}"`;
     const input = zodObjectFromJsonSchema(tool.inputSchema);
@@ -576,6 +600,7 @@ async function mountMcpConnection(connection, instanceId) {
       name,
       description,
       identity: { serviceName: connection.name, action: name, method: "POST" },
+      ...connection.transports && { transports: connection.transports },
       input,
       output: z2.unknown(),
       handler: (context) => {
@@ -592,7 +617,7 @@ async function mountMcpConnection(connection, instanceId) {
     });
     recordForeignSchemaBytes(definition, jsonSchemaBytes(tool.inputSchema));
     return definition;
-  });
+  }, onSkipped);
 }
 function readDiscoveredTools(listed, connectionName) {
   if (!isRecord(listed) || !Array.isArray(listed.tools)) {
@@ -684,7 +709,7 @@ function assertOpenApiOperation(document, operation, pathItem) {
 }
 
 // src/tools/connections/openapi.ts
-async function mountOpenApiConnection(connection, instanceId) {
+async function mountOpenApiConnection(connection, instanceId, onSkipped) {
   const timeoutMs = connectionTimeoutMs(connection.timeoutMs);
   const maxResponseBytes = connectionMaxResponseBytes(connection.maxResponseBytes);
   const loaded = await loadOpenApiDocument(connection, timeoutMs, maxResponseBytes);
@@ -695,7 +720,7 @@ async function mountOpenApiConnection(connection, instanceId) {
   assertAllowedHost(new URL(baseUrl), allowedHosts, connection.name);
   const operations = collectOperations(document);
   const names = new Set;
-  return operations.map((entry) => {
+  return mountToolsTolerantly(operations, connection.name, operationKey, (entry) => {
     assertOpenApiOperation(document, entry.operation, entry.pathItem);
     const rawName = operationKey(entry);
     const name = uniqueToolName(connection.name, rawName, names);
@@ -711,6 +736,7 @@ async function mountOpenApiConnection(connection, instanceId) {
         action: rawName,
         method: entry.method
       },
+      ...connection.transports && { transports: connection.transports },
       input,
       output: z3.unknown(),
       handler: (context) => withConnectionToken({ instanceId, provider: connection.token, context }, async (token) => {
@@ -753,7 +779,7 @@ async function mountOpenApiConnection(connection, instanceId) {
     });
     recordForeignSchemaBytes(definition, jsonSchemaBytes(schema));
     return definition;
-  });
+  }, onSkipped);
 }
 async function loadOpenApiDocument(connection, timeoutMs, maxResponseBytes) {
   if (typeof connection.spec === "object" && connection.spec !== null) {
@@ -1005,9 +1031,10 @@ function asRecord(value) {
 // src/tools/connections/mount.ts
 async function mountConnections(connections, options = {}) {
   const tools = [];
+  const onSkipped = options.onSkippedTool ?? reportSkippedConnectionTool;
   for (const connection of connections) {
     const instanceId = instanceIdOf(connection);
-    const mounted = connection.kind === "mcp" ? await mountMcpConnection(connection, instanceId) : await mountOpenApiConnection(connection, instanceId);
+    const mounted = connection.kind === "mcp" ? await mountMcpConnection(connection, instanceId, onSkipped) : await mountOpenApiConnection(connection, instanceId, onSkipped);
     tools.push(...mounted);
   }
   const limit = options.budget?.maxTools;