feat(routes): execute conventional context providers in generated request scopes (#95 remainder)

[ScriptedAlchemy]

Summary

Closes the provider-execution gap in the conventional route graph (#95 remainder; prerequisite for the #104 reference app): src/providers/*.{ts,tsx} modules are now executed once per generated request and their values mounted at (await agent()).providers.<camelCaseKey>.

Contract

• Each provider default-exports a factory (context: { invocation, signal }) => value | Promise<value>; AgentProviderContext / AgentProviderFactory are exported from agent-bundle (and agent-bundle/config), with AgentRenderInvocation re-exported as a type from the runtime root so authoring needs no internal import.
• Build-time validation (parse-only, never evaluates modules): AB4940 default export missing/not a function, AB4941 two filenames deriving the same camel-cased key, AB4942 the reserved processLifetime key. Registered in docs/diagnostics.md; authoring documented in docs/entry-conventions.md.
• The generated shared Flight worker executes providers sequentially in deterministic sorted-key order, per request, after feat(runtime): mount state kernel and notice ledger into generated request scopes (#233) #251's state bindings are acquired and before runAgentRequest; a thrown factory fails the request closed (state/notice bindings still release through the existing finally).
• Projects with zero providers emit byte-identical generated sources (sha256-pinned in tests).

Gates (local)

• workspace tsc + @agent-bundle/runtime typecheck — pass
• route-graph + entry-shell scoped units — 46/46
• generated-route-server integration (root pool) — 9/9, including a new end-to-end proof: provider value observed in a generated tool and in a shared event route via two native thin clients, plus a throwing provider failing closed with key + source in the error
• runtime packaging boundaries — 7/7 (stateless/provider-less artifacts unchanged)
• rslint on touched files — clean

Refs #95, #104.

[changeset-bot]

🦋 Changeset detected

Latest commit: f93b2a7

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
agent-bundle	Minor
@agent-bundle/runtime	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T02:07:22.665543Z	f93b2a7	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f93b2a7a09

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Mount providers in standalone event execution

When an event route sets config.runtime: 'standalone', or a shared route takes its configured standalone fallback, the hook wrapper renders the component directly through renderStandaloneEventRoute; providers are forwarded only here to compileMcpEntries. Consequently provider factories never execute on those event requests, and a route using the documented (await agent()).providers context fails outside a request scope instead of receiving its provider values. Forward the providers into the standalone hook compilation and install the request context around that render as well.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Keep the optional runtime out of compiler-only declarations

When a consumer installs only agent-bundle and omits its explicitly optional @agent-bundle/runtime peer, importing the package or agent-bundle/config for compiler-only use now makes TypeScript resolve this declaration import and report that @agent-bundle/runtime cannot be found. The workspace does not expose this because it always supplies the peer. Keep AgentProviderContext structurally self-contained, or isolate the runtime-dependent provider types behind a surface whose peer is required, so existing config-only consumers continue to type-check.

Useful? React with 👍 / 👎.