stitchkit 0.94.0 → 0.94.1

package/dist/entrypoints/tools.js

@@ -1,10 +1,10 @@
 import {
   ManagedFileError
-} from "../index-70yj2ebz.js";
+} from "../index-paz6sgdp.js";
 import {
   signJwt,
   verifyPkce
-} from "../index-e2z3ahw9.js";
+} from "../index-e01r054k.js";
 import"../index-hr4tzbwq.js";
 import {
   DEFAULT_CORS_ALLOW_HEADERS,
@@ -14,8 +14,8 @@ import {
   guardSignalCallback,
   mediaTypeEssence,
   reportSignalError
-} from "../index-xnj9bgxe.js";
-import"../index-kvj7f4hq.js";
+} from "../index-2gxzjvyr.js";
+import"../index-2bxbyab0.js";
 import {
   redact
 } from "../index-yw4fzmdz.js";
@@ -23,18 +23,20 @@ import {
   buildToolManifest,
   describeToolCatalog,
   mountAgent
-} from "../index-dcpdvjsc.js";
+} from "../index-863ea9jb.js";
 import {
   AgentToolError,
+  EffectUnresolvedError,
   createLocalStepDurability,
   isAgentToolError
-} from "../index-cq4qfycf.js";
+} from "../index-79z7m7dt.js";
 import"../index-rxfy4cq7.js";
 import {
   ALL_TRANSPORTS,
   TOOL_TRANSPORTS,
   defineContract
-} from "../index-gyr48nzg.js";
+} from "../index-k30h66yd.js";
+import"../index-4gcnakhx.js";
 import {
   ManagedFilePathSchema,
   ManagedFileRefSchema
@@ -50,7 +52,7 @@ import {
 } from "../index-m9zn6cpq.js";
 import {
   createToolInvoker
-} from "../index-rewkc2hj.js";
+} from "../index-p9sh0xx4.js";
 import {
   WaitTimeoutError,
   createCli,
@@ -58,11 +60,11 @@ import {
   fetchPinnedDocument,
   readCapped,
   runWaitOperation
-} from "../index-n6hxg8as.js";
+} from "../index-t9rhjr9f.js";
 import"../index-sbdmyz75.js";
 import {
   collectToolSurface
-} from "../index-vcvkq30w.js";
+} from "../index-hmp4800j.js";
 import {
   argumentsDigest
 } from "../index-0b1ess5e.js";
@@ -70,13 +72,13 @@ import {
   collectTools,
   createToolRunner,
   formatToolError
-} from "../index-2cr1cqhn.js";
+} from "../index-khtgb21r.js";
 import {
   ToolExecutionControlError,
   isToolExecutionControlError,
   parseToolCallArguments,
   toolResultFromError
-} from "../index-j05z5gn4.js";
+} from "../index-55hkhm67.js";
 import {
   getRequestContext,
   getTraceId,
@@ -92,7 +94,7 @@ import {
 import {
   createRuntimeToolFactory,
   defineRuntimeTool
-} from "../index-v38qyerb.js";
+} from "../index-xw3s75nj.js";
 import {
   PORTABLE_JSON_SCHEMA_FORMATS,
   assertToolName,
@@ -106,7 +108,7 @@ import {
   toolSurfaceOutputSchema,
   validateMcpRoundPolicy,
   validateResolvedInputRounds
-} from "../index-dydjcp8z.js";
+} from "../index-np4m8hd3.js";
 import {
   toJsonSchema
 } from "../index-eqqvgdb3.js";
@@ -126,47 +128,7 @@ import"../index-kzfs85xp.js";
 import {
   isRecord
 } from "../index-hffjpmq9.js";
-// src/server/oauth/metadata.ts
-var PROTECTED_RESOURCE_PATH = "/.well-known/oauth-protected-resource";
-function metadataPath(resource) {
-  const { pathname } = new URL(resource);
-  return pathname === "/" ? PROTECTED_RESOURCE_PATH : `${PROTECTED_RESOURCE_PATH}${pathname}`;
-}
-function protectedResourceMetadataUrl(resource) {
-  return `${new URL(resource).origin}${metadataPath(resource)}`;
-}
-function wwwAuthenticateHeader(resource) {
-  return `Bearer resource_metadata="${protectedResourceMetadataUrl(resource)}"`;
-}
-var PUBLIC_CORS = {
-  "Access-Control-Allow-Origin": "*",
-  "Access-Control-Allow-Methods": "GET, OPTIONS",
-  "Access-Control-Allow-Headers": DEFAULT_CORS_ALLOW_HEADERS
-};
-function oauthProtectedResourceRoute(config) {
-  const body = JSON.stringify({
-    resource: config.resource,
-    authorization_servers: config.authorizationServers,
-    ...config.scopesSupported && { scopes_supported: config.scopesSupported },
-    bearer_methods_supported: ["header"]
-  });
-  return {
-    method: "ALL",
-    path: metadataPath(config.resource),
-    handler: (req) => {
-      if (req.method === "OPTIONS")
-        return new Response(null, { status: 204, headers: PUBLIC_CORS });
-      if (req.method !== "GET")
-        return new Response("Method Not Allowed", { status: 405 });
-      return new Response(body, {
-        status: 200,
-        headers: { "Content-Type": "application/json", ...PUBLIC_CORS }
-      });
-    }
-  };
-}
-// src/server/oauth/provider.ts
-import { randomUUID } from "node:crypto";
+// src/server/oauth/cimd.ts
 import { z } from "zod";
 function isPlainDisplayCharacter(character) {
   const codePoint = character.codePointAt(0);
@@ -195,13 +157,6 @@ function createSecureClientMetadataFetcher(policy = {}) {
     })
   };
 }
-var PUBLIC_CORS2 = {
-  "Access-Control-Allow-Origin": "*",
-  "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
-  "Access-Control-Allow-Headers": DEFAULT_CORS_ALLOW_HEADERS
-};
-var AS_METADATA_PATH = "/.well-known/oauth-authorization-server";
-var AUTH_CODE_TTL_MS = 60000;
 var DEFAULT_CIMD_MAX_BYTES = 64 * 1024;
 var DEFAULT_CIMD_TIMEOUT_MS = 5000;
 function assertPositiveInteger(name, value) {
@@ -280,17 +235,6 @@ function responseFreshness(headers, policy, now) {
   }
   return { freshnessMs: Math.min(maxTtl, policy.defaultTtlMs ?? 300000), store: true };
 }
-function safeClientName(value) {
-  if (value === undefined)
-    return;
-  const safe = Array.from(value).filter(isPlainDisplayCharacter).join("").trim().slice(0, 200);
-  return safe || undefined;
-}
-function parseScopes(value) {
-  if (!value)
-    return [];
-  return [...new Set(value.split(/\s+/u).filter(Boolean))];
-}
 function toRegisteredClient(metadata) {
   return {
     clientId: metadata.client_id,
@@ -467,15 +411,6 @@ function createCimdResolver(options) {
     return created;
   };
 }
-function json(body, status = 200, extraHeaders) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json", ...PUBLIC_CORS2, ...extraHeaders }
-  });
-}
-function oauthError(error, description, status = 400) {
-  return json({ error, error_description: description }, status);
-}
 function isRegistrableRedirectUri(value, applicationType) {
   try {
     const url = new URL(value);
@@ -504,6 +439,74 @@ function isLoopbackRedirectUri(value) {
     return false;
   }
 }
+// src/server/oauth/metadata.ts
+var PROTECTED_RESOURCE_PATH = "/.well-known/oauth-protected-resource";
+function metadataPath(resource) {
+  const { pathname } = new URL(resource);
+  return pathname === "/" ? PROTECTED_RESOURCE_PATH : `${PROTECTED_RESOURCE_PATH}${pathname}`;
+}
+function protectedResourceMetadataUrl(resource) {
+  return `${new URL(resource).origin}${metadataPath(resource)}`;
+}
+function wwwAuthenticateHeader(resource) {
+  return `Bearer resource_metadata="${protectedResourceMetadataUrl(resource)}"`;
+}
+var PUBLIC_CORS = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Methods": "GET, OPTIONS",
+  "Access-Control-Allow-Headers": DEFAULT_CORS_ALLOW_HEADERS
+};
+function oauthProtectedResourceRoute(config) {
+  const body = JSON.stringify({
+    resource: config.resource,
+    authorization_servers: config.authorizationServers,
+    ...config.scopesSupported && { scopes_supported: config.scopesSupported },
+    bearer_methods_supported: ["header"]
+  });
+  return {
+    method: "ALL",
+    path: metadataPath(config.resource),
+    handler: (req) => {
+      if (req.method === "OPTIONS")
+        return new Response(null, { status: 204, headers: PUBLIC_CORS });
+      if (req.method !== "GET")
+        return new Response("Method Not Allowed", { status: 405 });
+      return new Response(body, {
+        status: 200,
+        headers: { "Content-Type": "application/json", ...PUBLIC_CORS }
+      });
+    }
+  };
+}
+// src/server/oauth/endpoints.ts
+import { randomUUID } from "node:crypto";
+var PUBLIC_CORS2 = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+  "Access-Control-Allow-Headers": DEFAULT_CORS_ALLOW_HEADERS
+};
+var AS_METADATA_PATH = "/.well-known/oauth-authorization-server";
+var AUTH_CODE_TTL_MS = 60000;
+function safeClientName(value) {
+  if (value === undefined)
+    return;
+  const safe = Array.from(value).filter(isPlainDisplayCharacter).join("").trim().slice(0, 200);
+  return safe || undefined;
+}
+function parseScopes(value) {
+  if (!value)
+    return [];
+  return [...new Set(value.split(/\s+/u).filter(Boolean))];
+}
+function json(body, status = 200, extraHeaders) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json", ...PUBLIC_CORS2, ...extraHeaders }
+  });
+}
+function oauthError(error, description, status = 400) {
+  return json({ error, error_description: description }, status);
+}
 function redirectWith(uri, params) {
   const url = new URL(uri);
   for (const [key, value] of Object.entries(params))
@@ -525,41 +528,9 @@ async function readForm(req) {
   }
   return new URLSearchParams(await req.text());
 }
-function mountOAuthProvider(config) {
-  const base = config.basePath ?? "/oauth";
-  const ttl = config.accessTokenTtlSec ?? 3600;
-  const registerPath = `${base}/register`;
-  const authorizePath = `${base}/authorize`;
-  const tokenPath = `${base}/token`;
-  const clientRegistration = config.clientRegistration ?? {};
-  const dcrRegistry = clientRegistration.dcr || undefined;
-  const dcrEnabled = dcrRegistry !== undefined;
-  const cimdConfig = clientRegistration.cimd === false ? undefined : clientRegistration.cimd ?? {};
-  const cimdEnabled = cimdConfig !== undefined;
-  const resolveCimd = cimdEnabled ? createCimdResolver({
-    cache: cimdConfig.cache,
-    fetcher: cimdConfig.fetcher ?? createSecureClientMetadataFetcher(),
-    onCacheEvent: cimdConfig.onCacheEvent
-  }) : undefined;
-  const resolveClient = async (clientId) => {
-    const preRegistered = await clientRegistration.preRegistered?.get(clientId);
-    if (preRegistered)
-      return preRegistered.clientId === clientId ? preRegistered : null;
-    const clientUrl = absoluteClientUrl(clientId);
-    if (clientUrl) {
-      if (!resolveCimd || clientUrl.protocol !== "https:")
-        return null;
-      try {
-        return await resolveCimd(clientId);
-      } catch {
-        return null;
-      }
-    }
-    const dcrClient = await dcrRegistry?.get(clientId);
-    return dcrClient?.clientId === clientId ? dcrClient : null;
-  };
-  const redirectToClient = (uri, params) => redirectWith(uri, { ...params, iss: config.issuer });
-  const metadataRoute = {
+function metadataRoute(ctx) {
+  const { config } = ctx;
+  return {
     method: "ALL",
     path: AS_METADATA_PATH,
     handler: (req) => {
@@ -567,22 +538,27 @@ function mountOAuthProvider(config) {
         return new Response(null, { status: 204, headers: PUBLIC_CORS2 });
       return json({
         issuer: config.issuer,
-        authorization_endpoint: `${config.issuer}${authorizePath}`,
-        token_endpoint: `${config.issuer}${tokenPath}`,
-        ...dcrEnabled && { registration_endpoint: `${config.issuer}${registerPath}` },
+        authorization_endpoint: `${config.issuer}${ctx.paths.authorize}`,
+        token_endpoint: `${config.issuer}${ctx.paths.token}`,
+        ...ctx.dcrRegistry !== undefined && {
+          registration_endpoint: `${config.issuer}${ctx.paths.register}`
+        },
         response_types_supported: ["code"],
         grant_types_supported: config.refreshTokens ? ["authorization_code", "refresh_token"] : ["authorization_code"],
         code_challenge_methods_supported: ["S256"],
         token_endpoint_auth_methods_supported: ["none"],
-        ...cimdEnabled && { client_id_metadata_document_supported: true },
+        ...ctx.cimdEnabled && { client_id_metadata_document_supported: true },
         authorization_response_iss_parameter_supported: true,
         ...config.scopesSupported && { scopes_supported: config.scopesSupported }
       });
     }
   };
-  const registerRoute = {
+}
+function registerRoute(ctx) {
+  const { config } = ctx;
+  return {
     method: "ALL",
-    path: registerPath,
+    path: ctx.paths.register,
     handler: async (req) => {
       if (req.method === "OPTIONS")
         return new Response(null, { status: 204, headers: PUBLIC_CORS2 });
@@ -605,9 +581,9 @@ function mountOAuthProvider(config) {
       if (!Array.isArray(redirectUris) || redirectUris.length === 0 || !redirectUris.every((u) => typeof u === "string" && isRegistrableRedirectUri(u, applicationType))) {
         return oauthError("invalid_redirect_uri", applicationType === "web" ? "redirect_uris must be a non-empty array of absolute https URLs (a web client cannot register an http loopback URI)" : "redirect_uris must be a non-empty array of absolute https URLs (http is allowed only on a loopback host)");
       }
-      if (!dcrRegistry)
+      if (!ctx.dcrRegistry)
         throw new Error("DCR route mounted without a DCR registry");
-      const client = await dcrRegistry.register({
+      const client = await ctx.dcrRegistry.register({
         redirectUris,
         clientName: typeof meta.client_name === "string" ? meta.client_name : undefined,
         tokenEndpointAuthMethod,
@@ -624,9 +600,12 @@ function mountOAuthProvider(config) {
       }, 201);
     }
   };
-  const authorizeRoute = {
+}
+function authorizeRoute(ctx) {
+  const { config } = ctx;
+  return {
     method: "ALL",
-    path: authorizePath,
+    path: ctx.paths.authorize,
     handler: async (req) => {
       if (req.method === "OPTIONS")
         return new Response(null, { status: 204, headers: PUBLIC_CORS2 });
@@ -643,34 +622,34 @@ function mountOAuthProvider(config) {
       if (!clientId || !redirectUri) {
         return oauthError("invalid_request", "client_id and redirect_uri are required");
       }
-      const client = await resolveClient(clientId);
+      const client = await ctx.resolveClient(clientId);
       if (!client)
         return oauthError("invalid_client", "Unknown client_id", 401);
       if (!client.redirectUris.includes(redirectUri)) {
         return oauthError("invalid_request", "redirect_uri does not match a registered URI");
       }
       if (responseType !== "code") {
-        return redirectToClient(redirectUri, {
+        return ctx.redirectToClient(redirectUri, {
           error: "unsupported_response_type",
           ...state && { state }
         });
       }
       if (!codeChallenge || codeChallengeMethod !== "S256") {
-        return redirectToClient(redirectUri, {
+        return ctx.redirectToClient(redirectUri, {
           error: "invalid_request",
           error_description: "PKCE S256 code_challenge is required",
           ...state && { state }
         });
       }
       if (!resource) {
-        return redirectToClient(redirectUri, {
+        return ctx.redirectToClient(redirectUri, {
           error: "invalid_target",
           error_description: "resource parameter is required",
           ...state && { state }
         });
       }
       if (resource !== config.resource) {
-        return redirectToClient(redirectUri, {
+        return ctx.redirectToClient(redirectUri, {
           error: "invalid_target",
           error_description: "resource is not served by this authorization server",
           ...state && { state }
@@ -679,7 +658,7 @@ function mountOAuthProvider(config) {
       const requestedScopes = parseScopes(scope);
       const supportedScopes = new Set(config.scopesSupported ?? []);
       if (config.scopesSupported && requestedScopes.some((requestedScope2) => !supportedScopes.has(requestedScope2))) {
-        return redirectToClient(redirectUri, {
+        return ctx.redirectToClient(redirectUri, {
           error: "invalid_scope",
           error_description: "One or more requested scopes are not supported",
           ...state && { state }
@@ -725,18 +704,15 @@ function mountOAuthProvider(config) {
         userId: result.userId,
         expiresAt: Date.now() + AUTH_CODE_TTL_MS
       });
-      return redirectToClient(redirectUri, { code, ...state && { state } });
+      return ctx.redirectToClient(redirectUri, { code, ...state && { state } });
     }
   };
-  const issueAccessToken = (userId, audience, clientId, scope) => signJwt({ scope, client_id: clientId }, config.signingSecret, {
-    issuer: config.issuer,
-    audience,
-    subject: userId,
-    expiresInSec: ttl
-  });
-  const tokenRoute = {
+}
+function tokenRoute(ctx) {
+  const { config } = ctx;
+  return {
     method: "ALL",
-    path: tokenPath,
+    path: ctx.paths.token,
     handler: async (req) => {
       if (req.method === "OPTIONS")
         return new Response(null, { status: 204, headers: PUBLIC_CORS2 });
@@ -764,7 +740,7 @@ function mountOAuthProvider(config) {
         if (!await verifyPkce(verifier, data.codeChallenge)) {
           return oauthError("invalid_grant", "PKCE verification failed");
         }
-        const accessToken = await issueAccessToken(data.userId, data.resource, data.clientId, data.scope);
+        const accessToken = await ctx.issueAccessToken(data.userId, data.resource, data.clientId, data.scope);
         let refreshToken;
         if (config.refreshTokens) {
           refreshToken = randomUUID();
@@ -778,7 +754,7 @@ function mountOAuthProvider(config) {
         return json({
           access_token: accessToken,
           token_type: "Bearer",
-          expires_in: ttl,
+          expires_in: ctx.ttl,
           ...data.scope && { scope: data.scope },
           ...refreshToken && { refresh_token: refreshToken }
         });
@@ -796,13 +772,13 @@ function mountOAuthProvider(config) {
           return oauthError("invalid_grant", "Unknown or used refresh token");
         if (data.clientId !== clientId)
           return oauthError("invalid_grant", "client_id mismatch");
-        const accessToken = await issueAccessToken(data.userId, data.resource, data.clientId, data.scope);
+        const accessToken = await ctx.issueAccessToken(data.userId, data.resource, data.clientId, data.scope);
         const newRefresh = randomUUID();
         await config.refreshTokens.save(newRefresh, data);
         return json({
           access_token: accessToken,
           token_type: "Bearer",
-          expires_in: ttl,
+          expires_in: ctx.ttl,
           ...data.scope && { scope: data.scope },
           refresh_token: newRefresh
         });
@@ -810,7 +786,60 @@ function mountOAuthProvider(config) {
       return oauthError("unsupported_grant_type", `Unsupported grant_type: ${grantType ?? "none"}`);
     }
   };
-  return dcrEnabled ? [metadataRoute, registerRoute, authorizeRoute, tokenRoute] : [metadataRoute, authorizeRoute, tokenRoute];
+}
+
+// src/server/oauth/provider.ts
+function mountOAuthProvider(config) {
+  const base = config.basePath ?? "/oauth";
+  const ttl = config.accessTokenTtlSec ?? 3600;
+  const registerPath = `${base}/register`;
+  const authorizePath = `${base}/authorize`;
+  const tokenPath = `${base}/token`;
+  const clientRegistration = config.clientRegistration ?? {};
+  const dcrRegistry = clientRegistration.dcr || undefined;
+  const dcrEnabled = dcrRegistry !== undefined;
+  const cimdConfig = clientRegistration.cimd === false ? undefined : clientRegistration.cimd ?? {};
+  const cimdEnabled = cimdConfig !== undefined;
+  const resolveCimd = cimdEnabled ? createCimdResolver({
+    cache: cimdConfig.cache,
+    fetcher: cimdConfig.fetcher ?? createSecureClientMetadataFetcher(),
+    onCacheEvent: cimdConfig.onCacheEvent
+  }) : undefined;
+  const resolveClient = async (clientId) => {
+    const preRegistered = await clientRegistration.preRegistered?.get(clientId);
+    if (preRegistered)
+      return preRegistered.clientId === clientId ? preRegistered : null;
+    const clientUrl = absoluteClientUrl(clientId);
+    if (clientUrl) {
+      if (!resolveCimd || clientUrl.protocol !== "https:")
+        return null;
+      try {
+        return await resolveCimd(clientId);
+      } catch {
+        return null;
+      }
+    }
+    const dcrClient = await dcrRegistry?.get(clientId);
+    return dcrClient?.clientId === clientId ? dcrClient : null;
+  };
+  const redirectToClient = (uri, params) => redirectWith(uri, { ...params, iss: config.issuer });
+  const issueAccessToken = (userId, audience, clientId, scope) => signJwt({ scope, client_id: clientId }, config.signingSecret, {
+    issuer: config.issuer,
+    audience,
+    subject: userId,
+    expiresInSec: ttl
+  });
+  const ctx = {
+    config,
+    ttl,
+    paths: { register: registerPath, authorize: authorizePath, token: tokenPath },
+    dcrRegistry,
+    cimdEnabled,
+    resolveClient,
+    redirectToClient,
+    issueAccessToken
+  };
+  return dcrEnabled ? [metadataRoute(ctx), registerRoute(ctx), authorizeRoute(ctx), tokenRoute(ctx)] : [metadataRoute(ctx), authorizeRoute(ctx), tokenRoute(ctx)];
 }
 // src/tools/lifecycle.ts
 function composeToolLifecycle(...hooks) {
@@ -1053,13 +1082,17 @@ import { z as z3 } from "zod";
 // src/tools/mcp/round.ts
 import {
   acceptedContent,
-  CLIENT_INFO_META_KEY,
   inputRequired,
-  inputResponse,
-  PROTOCOL_VERSION_META_KEY
+  inputResponse
 } from "@modelcontextprotocol/server";
 import { z as z2 } from "zod";
 
+// src/tools/mcp/round-context.ts
+import {
+  CLIENT_INFO_META_KEY,
+  PROTOCOL_VERSION_META_KEY
+} from "@modelcontextprotocol/server";
+
 // src/tools/mcp/progress.ts
 function mcpProgressToken(context) {
   const token = context.mcpReq._meta?.progressToken;
@@ -1091,7 +1124,7 @@ function createMcpProgressReporter(context) {
   };
 }
 
-// src/tools/mcp/round.ts
+// src/tools/mcp/round-context.ts
 function transportContext(context, toolName, outcome, round) {
   const protocolVersionValue = isRecord(context.mcpReq.envelope) ? Reflect.get(context.mcpReq.envelope, PROTOCOL_VERSION_META_KEY) : undefined;
   const protocolVersion = typeof protocolVersionValue === "string" ? protocolVersionValue : undefined;
@@ -1153,6 +1186,8 @@ async function failedResolution(options) {
   const result = await runRoundFailure(options.tool, options.rawArgs, options.runTool, options.context, options.code, options.message);
   return { kind: "response", response: options.formatFailure(result) };
 }
+
+// src/tools/mcp/round.ts
 function roundPlanDigest(requests) {
   return argumentsDigest({
     plan: requests.map((request) => ({
@@ -1178,6 +1213,54 @@ async function resolveRequests(options, policy) {
   validateResolvedInputRounds(options.tool, resolved, options.runtime?.maxRounds ?? 1);
   return { requests: resolved, guarded: false };
 }
+async function askRound(runtime, context, request, state) {
+  const requestState = await runtime.codec.mint(state, context);
+  return {
+    kind: "response",
+    response: inputRequired({
+      inputRequests: {
+        [request.key]: inputRequired.elicit({
+          message: request.message,
+          requestedSchema: request.schema
+        })
+      },
+      requestState
+    })
+  };
+}
+function readRoundAnswer(context, request) {
+  const view = inputResponse(context.mcpReq.inputResponses, request.key);
+  if (view.kind !== "elicit") {
+    return {
+      refusal: {
+        outcome: "invalid",
+        code: "INVALID_INPUT_RESPONSE",
+        message: "Expected an elicitation response for the current round"
+      }
+    };
+  }
+  if (view.action !== "accept") {
+    const declined = view.action === "decline";
+    return {
+      refusal: {
+        outcome: declined ? "declined" : "cancelled",
+        code: declined ? "INPUT_DECLINED" : "INPUT_CANCELLED",
+        message: declined ? "Required input was declined" : "Required input was cancelled"
+      }
+    };
+  }
+  const content = acceptedContent(context.mcpReq.inputResponses, request.key, request.schema);
+  if (!content) {
+    return {
+      refusal: {
+        outcome: "invalid",
+        code: "INVALID_INPUT_RESPONSE",
+        message: "Accepted input failed its declared schema"
+      }
+    };
+  }
+  return { content };
+}
 async function resolveMcpRound(options) {
   const { policy } = options;
   if (!policy) {
@@ -1242,25 +1325,13 @@ async function resolveMcpRound(options) {
     const request2 = requests[0];
     if (!request2)
       throw new Error("[stitchkit] validated MRTR policy has no first round");
-    const requestState = await options.runtime.codec.mint({
+    return askRound(options.runtime, options.context, request2, {
       identity: operationIdentity(options.tool),
       argumentsDigest: digest,
       round: 0,
       accepted: {},
       planDigest
-    }, options.context);
-    return {
-      kind: "response",
-      response: inputRequired({
-        inputRequests: {
-          [request2.key]: inputRequired.elicit({
-            message: request2.message,
-            requestedSchema: request2.schema
-          })
-        },
-        requestState
-      })
-    };
+    });
   }
   if (state.planDigest !== planDigest || state.round >= requests.length) {
     return failedResolution({
@@ -1273,33 +1344,16 @@ async function resolveMcpRound(options) {
   const request = requests[state.round];
   if (!request)
     throw new Error("[stitchkit] validated MRTR state points outside its policy");
-  const view = inputResponse(options.context.mcpReq.inputResponses, request.key);
-  if (view.kind !== "elicit") {
+  const answer = readRoundAnswer(options.context, request);
+  if ("refusal" in answer) {
     return failedResolution({
       ...options,
-      context: transportContext(options.context, options.tool.name, "invalid", state.round),
-      code: "INVALID_INPUT_RESPONSE",
-      message: "Expected an elicitation response for the current round"
-    });
-  }
-  if (view.action !== "accept") {
-    const outcome = view.action === "decline" ? "declined" : "cancelled";
-    return failedResolution({
-      ...options,
-      context: transportContext(options.context, options.tool.name, outcome, state.round),
-      code: view.action === "decline" ? "INPUT_DECLINED" : "INPUT_CANCELLED",
-      message: view.action === "decline" ? "Required input was declined" : "Required input was cancelled"
-    });
-  }
-  const content = acceptedContent(options.context.mcpReq.inputResponses, request.key, request.schema);
-  if (!content) {
-    return failedResolution({
-      ...options,
-      context: transportContext(options.context, options.tool.name, "invalid", state.round),
-      code: "INVALID_INPUT_RESPONSE",
-      message: "Accepted input failed its declared schema"
+      context: transportContext(options.context, options.tool.name, answer.refusal.outcome, state.round),
+      code: answer.refusal.code,
+      message: answer.refusal.message
     });
   }
+  const { content } = answer;
   const accepted = { ...state.accepted, [request.key]: content };
   const nextRound = state.round + 1;
   const nextRequest = requests[nextRound];
@@ -1310,25 +1364,13 @@ async function resolveMcpRound(options) {
         return { kind: "response", response: options.formatFailure(guarded) };
       }
     }
-    const requestState = await options.runtime.codec.mint({
+    return askRound(options.runtime, options.context, nextRequest, {
       identity: state.identity,
       argumentsDigest: state.argumentsDigest,
       round: nextRound,
       accepted,
       planDigest
-    }, options.context);
-    return {
-      kind: "response",
-      response: inputRequired({
-        inputRequests: {
-          [nextRequest.key]: inputRequired.elicit({
-            message: nextRequest.message,
-            requestedSchema: nextRequest.schema
-          })
-        },
-        requestState
-      })
-    };
+    });
   }
   return {
     kind: "continue",
@@ -2960,6 +3002,7 @@ export {
   McpMediaContentSchema,
   McpAnnotationsSchema,
   MCP_CATALOG_META_KEY,
+  EffectUnresolvedError,
   EXT_APPS_BUNDLE_PLACEHOLDER,
   AsyncOperationCancelResultSchema,
   AgentToolError