stitchkit 0.94.0 → 0.95.0

package/dist/{index-97ac4gph.js → index-8zja4pkf.js}

@@ -16,7 +16,7 @@ import {
   createToolChronology,
   isAssistantHistoryEvidence,
   isCompleteAgentHistoryTurn
-} from "./index-1nd48tm9.js";
+} from "./index-gxrt5h6v.js";
 import {
   AgentAssistantPlaceholderSchema,
   AgentJsonObjectSchema,
@@ -33,11 +33,11 @@ import {
   createLocalStepDurability,
   createToolDurabilityContext,
   isAgentToolError
-} from "./index-cq4qfycf.js";
+} from "./index-79z7m7dt.js";
 import {
   ToolExecutionControlError,
   isToolExecutionControlError
-} from "./index-j05z5gn4.js";
+} from "./index-55hkhm67.js";
 import {
   isRecord,
   transportResult
@@ -1775,6 +1775,27 @@ function markProviderOrigin(error) {
 function hasProviderOrigin(error) {
   return typeof error === "object" && error !== null && providerOrigin.has(error);
 }
+function markProviderStream(stream) {
+  const reader = stream.getReader();
+  return new ReadableStream({
+    async pull(controller) {
+      let read;
+      try {
+        read = await reader.read();
+      } catch (error) {
+        controller.error(isOwnInputRefusal(error) ? error : markProviderOrigin(error));
+        return;
+      }
+      if (read.done)
+        controller.close();
+      else
+        controller.enqueue(read.value);
+    },
+    cancel(reason) {
+      return reader.cancel(reason);
+    }
+  });
+}
 
 // src/agent-runtime/run-operation-lifecycle.ts
 function createAgentRunOperationLifecycle(config) {
@@ -1840,7 +1861,8 @@ function createAgentRunOperationLifecycle(config) {
             }
             await startModelRequest(callId, step);
             try {
-              return await doStream();
+              const result = await doStream();
+              return { ...result, stream: markProviderStream(result.stream) };
             } catch (error) {
               throw isOwnInputRefusal(error) ? error : markProviderOrigin(error);
             }

package/dist/{index-2qzskm8h.js → index-dce5wxcq.js}

@@ -11,7 +11,7 @@ var RealtimeRequestPhaseEventSchema = z.object({
   requestId: z.string().min(1),
   event: z.string().min(1),
   phase: RealtimeRequestPhaseSchema,
-  elapsedMs: z.number().finite().nonnegative()
+  elapsedMs: z.number().nonnegative()
 }).strict();
 
 class RealtimeRequestTimeoutError extends Error {

package/dist/index-e01r054k.js

@@ -0,0 +1,105 @@
+import {
+  deriveCodeChallenge
+} from "./index-hr4tzbwq.js";
+import {
+  base64UrlToBytes,
+  bytesToBase64Url
+} from "./index-rxfy4cq7.js";
+import {
+  unauthorized
+} from "./index-2vtcmrj9.js";
+import {
+  safeJsonParse
+} from "./index-kzfs85xp.js";
+import {
+  isRecord
+} from "./index-hffjpmq9.js";
+
+// src/server/middleware/jwt.ts
+var MAX_TOKEN_BYTES = 8192;
+async function verifyJwt(token, secret, options = {}) {
+  if (!secret)
+    throw new Error("verifyJwt: a non-empty secret is required");
+  if (token.length > MAX_TOKEN_BYTES)
+    throw unauthorized("Token too large");
+  const [headerB64, payloadB64, signatureB64] = token.split(".");
+  if (!headerB64 || !payloadB64 || !signatureB64)
+    throw unauthorized("Invalid token format");
+  let header;
+  let payloadRaw;
+  let signature;
+  try {
+    const decoder = new TextDecoder;
+    header = JSON.parse(decoder.decode(base64UrlToBytes(headerB64)));
+    payloadRaw = safeJsonParse(decoder.decode(base64UrlToBytes(payloadB64)));
+    signature = base64UrlToBytes(signatureB64);
+  } catch {
+    throw unauthorized("Malformed token");
+  }
+  if (!isRecord(payloadRaw))
+    throw unauthorized("Malformed token");
+  const payload = payloadRaw;
+  if (header.alg !== "HS256")
+    throw unauthorized("Unsupported token algorithm");
+  const encoder = new TextEncoder;
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["verify"]);
+  const data = encoder.encode(`${headerB64}.${payloadB64}`);
+  const valid = await crypto.subtle.verify("HMAC", key, signature, data);
+  if (!valid)
+    throw unauthorized("Invalid token signature");
+  const leeway = options.leewaySeconds ?? 60;
+  const now = Date.now() / 1000;
+  if ("exp" in payload) {
+    if (typeof payload.exp !== "number")
+      throw unauthorized("Malformed token");
+    if (payload.exp < now - leeway)
+      throw unauthorized("Token expired");
+  }
+  if ("nbf" in payload) {
+    if (typeof payload.nbf !== "number")
+      throw unauthorized("Malformed token");
+    if (payload.nbf > now + leeway)
+      throw unauthorized("Token not yet valid");
+  }
+  if (options.issuer !== undefined && payload.iss !== options.issuer) {
+    throw unauthorized("Token issuer mismatch");
+  }
+  if (options.audience !== undefined) {
+    const aud = payload.aud;
+    const ok = Array.isArray(aud) ? aud.includes(options.audience) : aud === options.audience;
+    if (!ok)
+      throw unauthorized("Token audience mismatch");
+  }
+  return payload;
+}
+async function signJwt(payload, secret, options = {}) {
+  if (!secret)
+    throw new Error("signJwt: a non-empty secret is required");
+  const now = Math.floor(Date.now() / 1000);
+  const claims = {
+    ...payload,
+    iat: now,
+    ...options.expiresInSec !== undefined && { exp: now + options.expiresInSec },
+    ...options.issuer !== undefined && { iss: options.issuer },
+    ...options.audience !== undefined && { aud: options.audience },
+    ...options.subject !== undefined && { sub: options.subject }
+  };
+  const encoder = new TextEncoder;
+  const headerB64 = bytesToBase64Url(encoder.encode(JSON.stringify({ alg: "HS256", typ: "JWT" })));
+  const payloadB64 = bytesToBase64Url(encoder.encode(JSON.stringify(claims)));
+  const signingInput = `${headerB64}.${payloadB64}`;
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(signingInput));
+  const signatureB64 = bytesToBase64Url(new Uint8Array(signature));
+  return `${signingInput}.${signatureB64}`;
+}
+
+// src/server/middleware/pkce.ts
+async function verifyPkce(verifier, challenge) {
+  if (!verifier || !challenge)
+    return false;
+  const derived = await deriveCodeChallenge(verifier);
+  return derived === challenge;
+}
+
+export { verifyJwt, signJwt, verifyPkce };

package/dist/{index-sees8yf8.js → index-ensd0r74.js}

@@ -329,6 +329,90 @@ var systemClock = {
   }
 };
 var DEFAULT_OVERLAP = { mode: "skip" };
+function scheduleState(activated, stopped, accepting, active) {
+  if (!activated)
+    return stopped ? "stopped" : "inactive";
+  if (!accepting)
+    return active > 0 ? "draining" : "stopped";
+  return active > 0 ? "running" : "scheduled";
+}
+function wallAt(monotonicAt, anchor) {
+  if (monotonicAt === null)
+    return null;
+  return new Date(anchor.wallNow + monotonicAt - anchor.monotonicNow).toISOString();
+}
+function overlapDecision(overlap, active) {
+  if (overlap.mode === "skip")
+    return active > 0 ? "skip" : "start";
+  if (overlap.mode === "queue-one")
+    return active > 0 ? "queue" : "start";
+  return active >= overlap.maxConcurrent ? "skip" : "start";
+}
+function reportScheduleError(config, error, context) {
+  if (!config.onError)
+    return;
+  Promise.resolve().then(() => config.onError?.(error, context)).catch(() => {});
+}
+async function waitForSettled(active, clock, context, deadlineAt) {
+  if (active.size === 0 || context.signal.aborted)
+    return;
+  await new Promise((resolve) => {
+    let settled = false;
+    let deadlineTimer = null;
+    const finish = () => {
+      if (settled)
+        return;
+      settled = true;
+      deadlineTimer?.cancel();
+      context.signal.removeEventListener("abort", finish);
+      resolve();
+    };
+    context.signal.addEventListener("abort", finish, { once: true });
+    if (deadlineAt !== undefined) {
+      deadlineTimer = clock.schedule(finish, Math.max(0, deadlineAt - context.now()));
+    }
+    Promise.allSettled([...active]).then(finish);
+  });
+}
+async function executeRun(deps, scheduledAt) {
+  const { config, descriptor, clock, counts, resourceContext } = deps;
+  const startedAt = clock.now();
+  const wallStartedAt = clock.wallNow().getTime();
+  const runContext = {
+    applicationId: resourceContext.applicationId,
+    signal: resourceContext.signal,
+    scheduledAt,
+    startedAt,
+    now: () => clock.now()
+  };
+  counts.runsStarted += 1;
+  counts.lastScheduledAt = new Date(wallStartedAt + scheduledAt - startedAt).toISOString();
+  counts.lastStartedAt = new Date(wallStartedAt).toISOString();
+  deps.changed();
+  try {
+    await Promise.resolve();
+    await config.run(runContext);
+  } catch (error) {
+    counts.runsFailed += 1;
+    counts.lastFinishedAt = clock.wallNow().toISOString();
+    reportScheduleError(config, error, runContext);
+    if (descriptor.errorPolicy === "stop-schedule") {
+      resourceContext.reportHealth("unhealthy");
+      deps.stopAdmission();
+    } else {
+      resourceContext.reportHealth("degraded");
+    }
+    return;
+  }
+  counts.runsCompleted += 1;
+  counts.lastFinishedAt = clock.wallNow().toISOString();
+  if (descriptor.errorPolicy === "continue" && deps.isAccepting()) {
+    resourceContext.reportHealth("healthy");
+  }
+}
+function elapsedIntervals(scheduledAt, observedAt, everyMs) {
+  return Math.max(1, Math.floor((observedAt - scheduledAt) / everyMs) + 1);
+}
 function createManagedSchedule(config) {
   const descriptor = ManagedScheduleDescriptorSchema.parse({
     id: config.id,
@@ -347,13 +431,15 @@ function createManagedSchedule(config) {
   let activationContext = null;
   let nextRunAt = null;
   let queuedAt = null;
-  let runsStarted = 0;
-  let runsCompleted = 0;
-  let runsFailed = 0;
-  let ticksSkipped = 0;
-  let lastScheduledAt = null;
-  let lastStartedAt = null;
-  let lastFinishedAt = null;
+  const counts = {
+    runsStarted: 0,
+    runsCompleted: 0,
+    runsFailed: 0,
+    ticksSkipped: 0,
+    lastScheduledAt: null,
+    lastStartedAt: null,
+    lastFinishedAt: null
+  };
   let changedAt = clock.wallNow().toISOString();
   const active = new Set;
   const changed = () => {
@@ -374,43 +460,20 @@ function createManagedSchedule(config) {
     cancelFuture();
     changed();
   };
-  const reportError = (error, context) => {
-    if (!config.onError)
-      return;
-    Promise.resolve().then(() => config.onError?.(error, context)).catch(() => {});
-  };
-  const state = () => {
-    if (!activated)
-      return stopped ? "stopped" : "inactive";
-    if (!accepting)
-      return active.size > 0 ? "draining" : "stopped";
-    return active.size > 0 ? "running" : "scheduled";
-  };
-  const wallAt = (monotonicAt, anchor) => {
-    if (monotonicAt === null)
-      return null;
-    return new Date(anchor.wallNow + monotonicAt - anchor.monotonicNow).toISOString();
-  };
   const status = () => {
     const captured = clock.wallNow();
     const anchor = { monotonicNow: clock.now(), wallNow: captured.getTime() };
     return ManagedScheduleStatusSchema.parse({
       descriptor,
-      state: state(),
+      state: scheduleState(activated, stopped, accepting, active.size),
       revision,
       capturedAt: captured.toISOString(),
       changedAt,
       accepting,
       active: active.size,
       queued: queuedAt !== null,
-      runsStarted,
-      runsCompleted,
-      runsFailed,
-      ticksSkipped,
-      nextRunAt: wallAt(nextRunAt, anchor),
-      lastScheduledAt,
-      lastStartedAt,
-      lastFinishedAt
+      ...counts,
+      nextRunAt: wallAt(nextRunAt, anchor)
     });
   };
   let startExecution = () => {
@@ -428,37 +491,16 @@ function createManagedSchedule(config) {
     const resourceContext = activationContext;
     if (!accepting || !resourceContext)
       return;
-    const startedAt = clock.now();
-    const wallStartedAt = clock.wallNow().getTime();
-    const runContext = {
-      applicationId: resourceContext.applicationId,
-      signal: resourceContext.signal,
-      scheduledAt,
-      startedAt,
-      now: () => clock.now()
-    };
-    runsStarted += 1;
-    lastScheduledAt = new Date(wallStartedAt + scheduledAt - startedAt).toISOString();
-    lastStartedAt = new Date(wallStartedAt).toISOString();
-    changed();
-    let tracked;
-    tracked = Promise.resolve().then(() => config.run(runContext)).then(() => {
-      runsCompleted += 1;
-      lastFinishedAt = clock.wallNow().toISOString();
-      if (descriptor.errorPolicy === "continue" && accepting) {
-        resourceContext.reportHealth("healthy");
-      }
-    }, (error) => {
-      runsFailed += 1;
-      lastFinishedAt = clock.wallNow().toISOString();
-      reportError(error, runContext);
-      if (descriptor.errorPolicy === "stop-schedule") {
-        resourceContext.reportHealth("unhealthy");
-        stopAdmission();
-      } else {
-        resourceContext.reportHealth("degraded");
-      }
-    }).finally(() => {
+    const tracked = executeRun({
+      config,
+      descriptor,
+      clock,
+      counts,
+      resourceContext,
+      changed,
+      stopAdmission,
+      isAccepting: () => accepting
+    }, scheduledAt).finally(() => {
       active.delete(tracked);
       changed();
       settleExecution();
@@ -468,30 +510,16 @@ function createManagedSchedule(config) {
   const dispatchTick = (scheduledAt) => {
     if (!accepting)
       return;
-    if (descriptor.overlap.mode === "skip") {
-      if (active.size > 0) {
-        ticksSkipped += 1;
-        changed();
-        return;
-      }
+    const decision = overlapDecision(descriptor.overlap, active.size);
+    if (decision === "start") {
       startExecution(scheduledAt);
       return;
     }
-    if (descriptor.overlap.mode === "queue-one") {
-      if (active.size > 0) {
-        queuedAt = scheduledAt;
-        changed();
-        return;
-      }
-      startExecution(scheduledAt);
-      return;
-    }
-    if (active.size >= descriptor.overlap.maxConcurrent) {
-      ticksSkipped += 1;
-      changed();
-      return;
-    }
-    startExecution(scheduledAt);
+    if (decision === "queue")
+      queuedAt = scheduledAt;
+    else
+      counts.ticksSkipped += 1;
+    changed();
   };
   const arm = () => {
     if (!accepting || nextRunAt === null)
@@ -502,38 +530,17 @@ function createManagedSchedule(config) {
       if (!accepting || nextRunAt === null)
         return;
       const scheduledAt = nextRunAt;
-      const observedAt = clock.now();
-      const elapsedIntervals = Math.max(1, Math.floor((observedAt - scheduledAt) / descriptor.everyMs) + 1);
-      if (elapsedIntervals > 1) {
-        ticksSkipped += elapsedIntervals - 1;
+      const elapsed = elapsedIntervals(scheduledAt, clock.now(), descriptor.everyMs);
+      if (elapsed > 1) {
+        counts.ticksSkipped += elapsed - 1;
         changed();
       }
-      nextRunAt = scheduledAt + elapsedIntervals * descriptor.everyMs;
+      nextRunAt = scheduledAt + elapsed * descriptor.everyMs;
       arm();
       dispatchTick(scheduledAt);
     }, delayMs);
   };
-  const waitForActive = async (context, deadlineAt) => {
-    if (active.size === 0 || context.signal.aborted)
-      return;
-    await new Promise((resolve) => {
-      let settled = false;
-      let deadlineTimer = null;
-      const finish = () => {
-        if (settled)
-          return;
-        settled = true;
-        deadlineTimer?.cancel();
-        context.signal.removeEventListener("abort", finish);
-        resolve();
-      };
-      context.signal.addEventListener("abort", finish, { once: true });
-      if (deadlineAt !== undefined) {
-        deadlineTimer = clock.schedule(finish, Math.max(0, deadlineAt - context.now()));
-      }
-      Promise.allSettled([...active]).then(finish);
-    });
-  };
+  const waitForActive = (context, deadlineAt) => waitForSettled(active, clock, context, deadlineAt);
   const drain = async (context) => {
     stopAdmission();
     await waitForActive(context, context.deadlineAt);

package/dist/{index-1nd48tm9.js → index-gxrt5h6v.js}

@@ -36,7 +36,8 @@ var AgentStoreEventKindSchema = z.enum([
   "approval/response-rejected",
   "durability/step",
   "durability/park",
-  "durability/event"
+  "durability/event",
+  "durability/effect"
 ]);
 var AgentStoreEventEnvelopeSchema = z.object({
   schemaVersion: z.int().positive(),