feat(sdk): add customer-hosted ChatKit providers

[danielblignaut]

Outcome

Add customer-hosted ChatKit provider authoring to Dispatch's supported @trytilde/sdk packages. Customers can implement setup, scoped ingestion, rich delivery, contextual session tools, and custom streaming clients without the archived Harness SDK repository.

Key implementation choices

A framework-neutral signed Fetch contract separates provider-runtime credentials from user/admin clients. Canonical tool coordinates come from Tilde; providers interpret only their own platform extension data. Custom connections integrate with the existing context.session.tools object, and tool results unwrap the canonical API response.

Linq/AgentMail reference adapters and a streaming example live under packages/sdk/examples/custom-chatkit. Current rooms, runs, identity, and proxy APIs are preserved. OpenAPI is regenerated from API PR https://github.com/trytilde/api/pull/276; matching public docs are in trytilde/docs#36.

Repository context

• Branch, remotes, worktree, stashes, and existing PRs were inspected.
• Diff reviewed against trytilde/dispatch main at fcee72c, explicitly using the dispatch remote rather than the fork's origin.
• Unrelated source-checkout work is preserved in a separate worktree.

Validation

• Focused tests for changed surfaces ran.
• pnpm check scope: package typechecks and focused Vite+ lint ran; full OpenBot application checks were not run for this server-SDK-only change.
• Build scope: pnpm openbot sdk refresh, pnpm openbot sdk validate, and final builds of the two changed SDK packages passed; full OpenBot application build was not run.
• Protobuf and browser/Electron checks are not applicable: no proto or application-surface change.

openbot sdk refresh validated 732 operations and passed all 316 SDK tests against the final rebased API: core SDK 150, Vercel Node 152, other SDK packages 14. Example typechecking and package/export validation passed. Focused lint has only existing stringification warnings in older webhook tests. No live-platform/browser e2e was run.

Contracts, state, deployment, and security

• Public HTTP compatibility, resource identity, persisted configuration, and provider lifecycle impact reviewed.
• No ConnectRPC, OpenBot deployment checkpoints, environment names, or root secret configuration changed.
• Typed canonical context is separate from provider-specific extension data; Linq and AgentMail alone interpret their platform thread/message fields. SDK core forwards them opaquely.
• No secrets, generated deployment state, or browser/fork data included.

Deploy the additive API and upgrade its workers before releasing these packages. Backend hosts manage one-time signing keys, connection runtime credentials, and durable encrypted state. Streaming clients retain user authorization. Ajv reuses the repository's current version; no new external service or global toolchain is required.

Configuration ownership

• Actual base repository verified through GitHub: trytilde/dispatch.
• Tracked configuration/ contains only the canonical ignore-all .gitignore sentinel.
• No root environment or SOPS files committed. Fork configuration checks are not applicable.

Architecture and ADR review

• Boundaries reviewed against ADR-0030 (SDK ownership), ADR-0038 (metadata), and ADR-0042 (org/runtime identity).
• New ADR-0043 records the authoring boundary.

Package documentation and provider contracts

• SDK and Vercel Node READMEs document the new public functions and critical interfaces; the generated API client README remains accurate.
• No OpenBot initialization-provider contract is changed; the Fetch authoring contract is owned by the SDK subpath.

Changeset

• A minor Changeset covers @trytilde/sdk, @trytilde/sdk-vercel-ai-node, and @trytilde/api-client. SDK versions remain outside OpenBot's fixed group.

PR update record

• Complete pending record prepared with implementation, using all four headings and a Mermaid diagram.
• Renamed the record to verified PR feat(sdk): add customer-hosted ChatKit providers #154 and refreshed it after the final changes.

Change record.

Frontend evidence

Not applicable: no Dispatch app surface changed. The API companion owns its dashboard changes.

Known limitations and follow-ups

Deployment, SDK publication, and live-platform verification remain release activities. The AgentMail reference's manually provisioned webhook needs manual removal on disconnect as documented.

Final diff review

• Intentional task files only; current generated contracts replace the prior snapshot.
• Conventional Commit title; PR stays draft pending CI/human review.
• Current checks and feedback inspected after push; CI completion remains required before marking ready.
• no-greptile is requested at creation; no external review bot was requested.

Documentation

The update record, ADR-0043, package READMEs, and reference setup guide describe this complete change. Related API #276 and docs #36 must follow backend-first deployment order.