@rkat/toolkit version 0.9.0 is an ESM package supporting Node 22 or newer. The service libraries run without Meerkat, Meta or a model. The browser UI has a separate entrypoint.
Install
Build from source
Fromsdk/typescript/ in the source checkout:
dist; packing creates a local archive. Select the actual returned archive in an isolated consumer.
Native application composition
Import the native classes from@rkat/toolkit/native-host and their selected
input types from @rkat/toolkit/private-host. This optional POSIX composition
uses the local Connect gateway and the matching @rkat/meta-sdk. Use the matching SDK release. Service
connector imports remain independent of this entrypoint.
For Restore and replacement, configure one dedicated
MetaBuilder, then await
its normal build(). For fresh preparation, await the Connect binding’s
build() instead: it joins native initialization with the trusted finalizer and
adoption. The finalizer accepts a SelectedHostArtifact and returns a promise of
the exact published HostBootstrapSelection.
The application supplies the actual gateway, persistent state, session service
and roster callbacks. Keep that configuration and its source lease with the
original transaction. Do not replace the configured transport or prepared
application carrier. A replacement uses the native declareSpecUpdate option
only when its transaction calls for it; an expected revision of zero is valid.
After a successful build, retain host.hostControl with that runtime and await
runtime.shutdown() when closing the application. A
GatewayStartupCleanupError retains its original errors and a cleanup
capability for the same runtime; retain and await that capability’s shutdown()
if startup cleanup rejects. Creating another host binding is not cleanup.
For fresh preparation, host.preparationAttempt and host.settlement preserve
the actual preparation, finalization and native outcomes. Abort joins work that
has entered; failure does not prove rollback or authorize replay.
See host composition for startup and reconnect rules. The source companion sdk/typescript/NATIVE-HOST.md describes the native SDK prerequisites and lifecycle contract.
Import an explicit operation
SlackContext contains baseUrl and fetch: (request: Request) => Promise<Response>. The selected closure injects authentication privately and binds the actual account.
slack.getUser(user, { includeLocale, signal }?) reads one exact user profile
through that same binding. The host separately authorizes users:read; the
operation does not request scopes or run automatically during history reads.
The result preserves optional profile fields and the exact user ID. A name is
display information, not proof of channel membership or an email recipient.
Transport contract
The borrowed Fetch must preserve destination, method, headers, body, manual redirect mode and cancellation signal. It must not replay, retarget, add default query parameters or switch accounts. Auth refresh cannot secretly repeat a write. Construction captures the endpoint and Fetch function. Later context-property changes do not retarget that operation instance. The host still owns current grants, credential lifecycle, network policy, transport pools and retirement. Requests use manual redirects, omitted ambient credentials and no caching. The library cannot undo a redirect already performed by a nonconforming host closure. This is trusted in-process composition, not a sandbox against hostile JavaScript.Data and cancellation
Request objects use a plain JSON data profile. The library refuses accessors, functions, sparse arrays, cycles and unsafe/nonfinite numbers before sending. JavaScript binary64 and safe-integer limits remain relevant; arbitrary Python integers are not part of this profile. Responses use strict bounded JSON parsing. Duplicate keys, malformed encoding and unsupported response shapes fail. The pinned runtime parser isjsonc-parser 3.3.1.
Deadlines initiate abort and await Fetch settlement and reader cleanup. They cannot impose a hard cleanup bound on a host implementation that ignores abort. There is no automatic retry or transport close.
Service operation reference
Current methods and the differences from Python.
Browser UI
Mount controlled views backed by authenticated host owners.
sdk/typescript/package.json; public declarations are generated from sdk/typescript/src/.