stitchkit 0.108.1 → 0.108.3

package/dist/process/bun-child.d.ts

@@ -1,5 +1,6 @@
 import { EventEmitter } from 'node:events';
 import { Readable, Writable } from 'node:stream';
+import { type OwnerLossGuardInvocation } from './owner-loss-protocol.js';
 /** What a spawned command exposes to its owner: the subset of a Node child the package uses. */
 export interface OwnedChild extends EventEmitter {
     readonly pid?: number;
@@ -23,6 +24,7 @@ interface BunSpawnInput {
     cwd?: string;
     env?: NodeJS.ProcessEnv;
     group: boolean;
+    ownerLoss?: OwnerLossGuardInvocation;
 }
 /**
  * Whether the host is Bun. Bun's `node:child_process` can lose a child's `exit` event under
@@ -34,5 +36,13 @@ export declare function hostIsBun(): boolean;
 export declare function spawnBunChild(input: BunSpawnInput): OwnedChild;
 /** `spawnInheritedCommand` for Bun: a command with the caller's stdio. */
 export declare function spawnBunInheritedChild(input: BunSpawnInput): ObservableChild;
+export interface BunGuardTarget {
+    readonly pid: number;
+    readonly exitCode: number | null;
+    readonly signalCode: string | number | null;
+    readonly exited: Promise<unknown>;
+}
+/** Bun-native target observation for the standalone owner-loss guard. */
+export declare function spawnBunGuardTarget(executable: string, args: readonly string[]): BunGuardTarget;
 export {};
 //# sourceMappingURL=bun-child.d.ts.map

package/dist/process/bun-child.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bun-child.d.ts","sourceRoot":"","sources":["../../src/process/bun-child.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEjD,gGAAgG;AAChG,MAAM,WAAW,UAAW,SAAQ,YAAY;IAC9C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;CACvC;AAED,oEAAoE;AACpE,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;CACvC;AAED,UAAU,aAAa;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,SAAS,IAAI,OAAO,CAEnC;AAoKD,+DAA+D;AAC/D,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,UAAU,CA4B9D;AAED,0EAA0E;AAC1E,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,aAAa,GAAG,eAAe,CAmB5E"}
+{"version":3,"file":"bun-child.d.ts","sourceRoot":"","sources":["../../src/process/bun-child.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,EAAE,KAAK,wBAAwB,EAAyB,MAAM,uBAAuB,CAAC;AAG7F,gGAAgG;AAChG,MAAM,WAAW,UAAW,SAAQ,YAAY;IAC9C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;CACvC;AAED,oEAAoE;AACpE,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;CACvC;AAED,UAAU,aAAa;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,wBAAwB,CAAC;CACtC;AAED;;;;GAIG;AACH,wBAAgB,SAAS,IAAI,OAAO,CAEnC;AAqKD,+DAA+D;AAC/D,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,UAAU,CAgD9D;AAED,0EAA0E;AAC1E,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,aAAa,GAAG,eAAe,CAsC5E;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;CACnC;AAED,yEAAyE;AACzE,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,cAAc,CAMhB"}

package/dist/process/command-owner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-owner.d.ts","sourceRoot":"","sources":["../../src/process/command-owner.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9C,OAAO,EAEL,KAAK,oBAAoB,EAI1B,MAAM,YAAY,CAAC;AAEpB,OAAO,EAEL,KAAK,yBAAyB,EAG/B,MAAM,UAAU,CAAC;AAOlB,wFAAwF;AACxF,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,oBAAoB,EAC3B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,EACrC,MAAM,CAAC,EAAE,yBAAyB;;;;;;;;;;EAkKnC"}
+{"version":3,"file":"command-owner.d.ts","sourceRoot":"","sources":["../../src/process/command-owner.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9C,OAAO,EAEL,KAAK,oBAAoB,EAI1B,MAAM,YAAY,CAAC;AAEpB,OAAO,EAEL,KAAK,yBAAyB,EAG/B,MAAM,UAAU,CAAC;AAQlB,wFAAwF;AACxF,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,oBAAoB,EAC3B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,EACrC,MAAM,CAAC,EAAE,yBAAyB;;;;;;;;;;EA8KnC"}

package/dist/process/contract.d.ts

@@ -77,6 +77,9 @@ export declare const NativeCommandOptionsSchema: z.ZodPipe<z.ZodObject<{
         caller: "caller";
         own: "own";
     }>>;
+    ownerLoss: z.ZodOptional<z.ZodEnum<{
+        terminate: "terminate";
+    }>>;
     stdio: z.ZodDefault<z.ZodEnum<{
         inherit: "inherit";
         pipe: "pipe";
@@ -121,6 +124,7 @@ export declare const NativeCommandOptionsSchema: z.ZodPipe<z.ZodObject<{
     }) => void) | undefined;
     drainTimeoutMs?: number | undefined;
     group: "caller" | "own";
+    ownerLoss?: "terminate" | undefined;
     stdio: "inherit" | "pipe";
     cleanupTimeoutMs: number;
     stop: {
@@ -149,6 +153,7 @@ export declare const NativeCommandOptionsSchema: z.ZodPipe<z.ZodObject<{
     }) => void) | undefined;
     drainTimeoutMs?: number | undefined;
     group: "caller" | "own";
+    ownerLoss?: "terminate" | undefined;
     stdio: "inherit" | "pipe";
     stop?: {
         target: "group" | "leader";

package/dist/process/contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../src/process/contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,QAAA,MAAM,6BAA6B;;;;;;;;;;;;2BAajC,CAAC;AACH;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;GAEG;AACH,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gGAAgG;AAChG,eAAO,MAAM,yBAAyB,UAAY,CAAC;AAEnD,QAAA,MAAM,6BAA6B;;;;;;;;;;;;;;;kBAOjC,CAAC;AACH;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAiC3F,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;gDAqBpB,UAAU,WACR,QAAQ,GAAG,QAAQ,UACpB,WAAW,KAChB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;uDAKX,uBAAuB,UAAU,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;uDAMrE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmF3C,CAAC;AACN;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,0BAA0B,CAAC,CAAC;AACrF,QAAA,MAAM,yBAAyB;;;;;;iBAU7B,CAAC;AACH;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,QAAA,MAAM,8BAA8B;;;EAAwC,CAAC;AAE7E;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;aAezB,IAAI,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB;IAdnF,2GAA2G;IAC3G,SAAgB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,GAAG,SAAS,CAAC;IAEnF,YACE,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY,GAAG;QAAE,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAA;KAAE,EACpF;IACF,YACE,IAAI,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB,EACjE,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY,GAAG;QAAE,MAAM,CAAC,EAAE,KAAK,CAAA;KAAE,EAC3C;CAgBH"}
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../src/process/contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,QAAA,MAAM,6BAA6B;;;;;;;;;;;;2BAajC,CAAC;AACH;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;GAEG;AACH,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gGAAgG;AAChG,eAAO,MAAM,yBAAyB,UAAY,CAAC;AAEnD,QAAA,MAAM,6BAA6B;;;;;;;;;;;;;;;kBAOjC,CAAC;AACH;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAiC3F,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;gDAqBpB,UAAU,WACR,QAAQ,GAAG,QAAQ,UACpB,WAAW,KAChB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;uDAKX,uBAAuB,UAAU,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;uDAMrE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4F3C,CAAC;AACN;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,0BAA0B,CAAC,CAAC;AACrF,QAAA,MAAM,yBAAyB;;;;;;iBAU7B,CAAC;AACH;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,QAAA,MAAM,8BAA8B;;;EAAwC,CAAC;AAE7E;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;aAezB,IAAI,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB;IAdnF,2GAA2G;IAC3G,SAAgB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,GAAG,SAAS,CAAC;IAEnF,YACE,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY,GAAG;QAAE,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAA;KAAE,EACpF;IACF,YACE,IAAI,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB,EACjE,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY,GAAG;QAAE,MAAM,CAAC,EAAE,KAAK,CAAA;KAAE,EAC3C;CAgBH"}

package/dist/process/launch.d.ts

@@ -56,7 +56,7 @@ export declare function launchNativeCommand({ options, driver, onSpawn, onFailur
 }): {
     stdout: AsyncIterable<Uint8Array<ArrayBufferLike>>;
     stderr: AsyncIterable<Uint8Array<ArrayBufferLike>>;
-    start(): void;
+    start(): Promise<number | undefined>;
     child: NativeCommandLaunchedProcess;
     leader: Promise<{
         kind: "exit";

package/dist/process/launch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"launch.d.ts","sourceRoot":"","sources":["../../src/process/launch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAsB,KAAK,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAEjF,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAElF,wFAAwF;AACxF,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IACjC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAC;IAC9D,EAAE,CACA,KAAK,EAAE,MAAM,GAAG,OAAO,EACvB,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAC7D,OAAO,CAAC;CACZ;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC;IAClE,OAAO,IAAI,OAAO,CAAC;CACpB;AAED,iGAAiG;AACjG,MAAM,WAAW,yBAAyB;IACxC,MAAM,CAAC,EAAE,MAAM,4BAA4B,CAAC;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,8EAA8E;AAC9E,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,0BAA0B,EACnC,MAAM,EAAE,yBAAyB,GAAG,SAAS;;;EAY9C;AAED,UAAU,kBAAkB;IAC1B,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACzB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAGD,uFAAuF;AACvF,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAEzF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAEhF;AAwED,yFAAyF;AACzF,wBAAgB,mBAAmB,CAAC,EAClC,OAAO,EACP,MAAM,EACN,OAAO,EACP,SAAS,EACT,cAAc,EACd,UAAU,GACX,EAAE;IACD,OAAO,EAAE,0BAA0B,CAAC;IACpC,MAAM,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAC9C,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,wDAAwD;IACxD,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAClC,kEAAkE;IAClE,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACvC,yEAAyE;IACzE,UAAU,EAAE,CAAC,SAAS,EAAE,sBAAsB,KAAK,IAAI,CAAC;CACzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoDA"}
+{"version":3,"file":"launch.d.ts","sourceRoot":"","sources":["../../src/process/launch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAsB,KAAK,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAIjF,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAElF,wFAAwF;AACxF,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IACjC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAC;IAC9D,EAAE,CACA,KAAK,EAAE,MAAM,GAAG,OAAO,EACvB,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAC7D,OAAO,CAAC;CACZ;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC;IAClE,OAAO,IAAI,OAAO,CAAC;CACpB;AAED,iGAAiG;AACjG,MAAM,WAAW,yBAAyB;IACxC,MAAM,CAAC,EAAE,MAAM,4BAA4B,CAAC;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,8EAA8E;AAC9E,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,0BAA0B,EACnC,MAAM,EAAE,yBAAyB,GAAG,SAAS;;;EAY9C;AAED,UAAU,kBAAkB;IAC1B,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACzB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAGD,uFAAuF;AACvF,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAEzF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAEhF;AAwED,yFAAyF;AACzF,wBAAgB,mBAAmB,CAAC,EAClC,OAAO,EACP,MAAM,EACN,OAAO,EACP,SAAS,EACT,cAAc,EACd,UAAU,GACX,EAAE;IACD,OAAO,EAAE,0BAA0B,CAAC;IACpC,MAAM,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAC9C,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,wDAAwD;IACxD,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAClC,kEAAkE;IAClE,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACvC,yEAAyE;IACzE,UAAU,EAAE,CAAC,SAAS,EAAE,sBAAsB,KAAK,IAAI,CAAC;CACzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0DA"}

package/dist/process/owned-child.d.ts

@@ -1,5 +1,6 @@
 import { type OwnedChild } from './bun-child.js';
 import type { NativeCommandLaunchedProcess } from './launch.js';
+import { type OwnerLossGuardInvocation } from './owner-loss-protocol.js';
 /** Only this native spawn can establish group ownership; structural PIDs cannot. */
 export declare function spawnOwnedCommand(input: {
     executable: string;
@@ -7,6 +8,7 @@ export declare function spawnOwnedCommand(input: {
     cwd?: string;
     env?: NodeJS.ProcessEnv;
     group: boolean;
+    ownerLoss?: OwnerLossGuardInvocation;
 }): OwnedChild;
 /** The same ownership rule as {@link spawnOwnedCommand}, for a child that inherits stdio. */
 export declare function spawnInheritedCommand(input: {
@@ -15,6 +17,7 @@ export declare function spawnInheritedCommand(input: {
     cwd?: string;
     env?: NodeJS.ProcessEnv;
     group: boolean;
+    ownerLoss?: OwnerLossGuardInvocation;
 }): NativeCommandLaunchedProcess;
 export declare function ownsCommandGroup(child: object): boolean;
 //# sourceMappingURL=owned-child.d.ts.map

package/dist/process/owned-child.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"owned-child.d.ts","sourceRoot":"","sources":["../../src/process/owned-child.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,UAAU,EAGhB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAA+B,4BAA4B,EAAE,MAAM,UAAU,CAAC;AAI1F,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,UAAU,CAIb;AAkED,6FAA6F;AAC7F,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,4BAA4B,CAa/B;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEvD"}
+{"version":3,"file":"owned-child.d.ts","sourceRoot":"","sources":["../../src/process/owned-child.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,UAAU,EAGhB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAA+B,4BAA4B,EAAE,MAAM,UAAU,CAAC;AAM1F,OAAO,EAAE,KAAK,wBAAwB,EAAyB,MAAM,uBAAuB,CAAC;AAI7F,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,wBAAwB,CAAC;CACtC,GAAG,UAAU,CAIb;AAsFD,6FAA6F;AAC7F,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,wBAAwB,CAAC;CACtC,GAAG,4BAA4B,CAkC/B;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEvD"}

package/dist/process/owner-loss-control.d.ts

@@ -0,0 +1,15 @@
+import type { Duplex } from 'node:stream';
+interface GuardedChild {
+    readonly pid?: number;
+    on(event: 'exit', listener: (code: number | null, signal: string | null) => void): unknown;
+}
+/** Tear down a newly created guard group if its private control channel is unavailable. */
+export declare function abortOwnerLossLaunch(pid: number | undefined): void;
+/** Bind one private inherited control socket to the guard process that owns it. */
+export declare function attachOwnerLossControl(child: GuardedChild, control: Duplex): void;
+/** Preserve the guard registration when an inherited-stdio child gets its transport wrapper. */
+export declare function transferOwnerLossControl(source: object, target: object): void;
+/** Ordinary children are already started; guarded children first prove that their target exists. */
+export declare function awaitCommandStart(child: GuardedChild): Promise<number | undefined>;
+export {};
+//# sourceMappingURL=owner-loss-control.d.ts.map

package/dist/process/owner-loss-control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-loss-control.d.ts","sourceRoot":"","sources":["../../src/process/owner-loss-control.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAe1C,UAAU,YAAY;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAC;CAC5F;AASD,2FAA2F;AAC3F,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAOlE;AAQD,mFAAmF;AACnF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAuDjF;AAED,gGAAgG;AAChG,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAG7E;AAED,oGAAoG;AACpG,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAIxF"}

package/dist/process/owner-loss-guard.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Bootstrap the private owner-loss service before an application's own argv dispatcher.
+ *
+ * Call this once before routing argv in a single-file application that lazy-imports
+ * `stitchkit/process`. `false` means the application owns this invocation and may dispatch it;
+ * `true` means the package guard owns it and the application must skip its dispatcher. The guard's
+ * child and control channel keep the process alive for exactly their own lifetime.
+ */
+export declare function bootstrapNativeCommandOwnerLoss(): boolean;
+/** The built or source module that executes the guard protocol when launched directly. */
+export declare function ownerLossGuardEntry(): string;
+//# sourceMappingURL=owner-loss-guard.d.ts.map

package/dist/process/owner-loss-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-loss-guard.d.ts","sourceRoot":"","sources":["../../src/process/owner-loss-guard.ts"],"names":[],"mappings":"AAyLA;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,IAAI,OAAO,CAEzD;AAED,0FAA0F;AAC1F,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C"}

package/dist/process/owner-loss-protocol.d.ts

@@ -0,0 +1,10 @@
+export declare const OWNER_LOSS_GUARD_FLAG = "--stitchkit-owner-loss-guard-v1";
+export interface OwnerLossGuardInvocation {
+    readonly entry: string;
+    readonly signalTarget: 'group' | 'leader';
+}
+/** The owner-loss guard is certified only on the two POSIX kernels exercised by release CI. */
+export declare function ownerLossAvailable(platform: NodeJS.Platform): boolean;
+/** Replace a direct command with the package-owned guard that becomes its process-group leader. */
+export declare function ownerLossGuardCommand(guard: OwnerLossGuardInvocation, executable: string, args: readonly string[]): [string, ...string[]];
+//# sourceMappingURL=owner-loss-protocol.d.ts.map

package/dist/process/owner-loss-protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-loss-protocol.d.ts","sourceRoot":"","sources":["../../src/process/owner-loss-protocol.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,qBAAqB,oCAAoC,CAAC;AAEvE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,OAAO,GAAG,QAAQ,CAAC;CAC3C;AAED,+FAA+F;AAC/F,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,OAAO,CAErE;AAED,mGAAmG;AACnG,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,wBAAwB,EAC/B,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CASvB"}

package/dist/process/owner-loss-socket.d.ts

@@ -0,0 +1,4 @@
+import { type Socket } from 'node:net';
+/** Bun's runtime accepts an inherited socket fd here before its Node types expose the overload. */
+export declare function connectOwnerLossSocket(fd: number): Socket;
+//# sourceMappingURL=owner-loss-socket.d.ts.map

package/dist/process/owner-loss-socket.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-loss-socket.d.ts","sourceRoot":"","sources":["../../src/process/owner-loss-socket.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AAEhD,mGAAmG;AACnG,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEzD"}

package/dist/tools/cli/args-fields.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"args-fields.d.ts","sourceRoot":"","sources":["../../../src/tools/cli/args-fields.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,MAAM,MAAM,SAAS,GACjB,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,GACP,QAAQ,GACR,OAAO,CAAC;AAEZ,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,SAAS,CAAC;IAChB,uEAAuE;IACvE,WAAW,CAAC,EAAE,SAAS,CAAC;IACxB,iFAAiF;IACjF,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAC1B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,SAAS,GAAG,SAAS,GAC1B,IAAI,CAaN;AA6ED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAI1F;AAKD,4GAA4G;AAC5G;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAI/E;AAED,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAGzD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAKtE;AA8BD,qFAAqF;AACrF,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAKlD;AAuCD,gFAAgF;AAChF,wBAAgB,WAAW,CACzB,IAAI,EAAE,SAAS,GAAG,SAAS,EAC3B,MAAM,EAAE,MAAM,EAAE,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAaT;AAED,wBAAgB,SAAS,CACvB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,EAAE,MAAM,EAAE,EACd,KAAK,EAAE,OAAO,GACb,IAAI,CAsBN"}
+{"version":3,"file":"args-fields.d.ts","sourceRoot":"","sources":["../../../src/tools/cli/args-fields.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,MAAM,MAAM,SAAS,GACjB,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,GACP,QAAQ,GACR,OAAO,CAAC;AAEZ,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,SAAS,CAAC;IAChB,uEAAuE;IACvE,WAAW,CAAC,EAAE,SAAS,CAAC;IACxB,iFAAiF;IACjF,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAC1B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,SAAS,GAAG,SAAS,GAC1B,IAAI,CAaN;AAwGD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAI1F;AAKD,4GAA4G;AAC5G;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAI/E;AAED,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAGzD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAKtE;AA8BD,qFAAqF;AACrF,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAKlD;AAuCD,gFAAgF;AAChF,wBAAgB,WAAW,CACzB,IAAI,EAAE,SAAS,GAAG,SAAS,EAC3B,MAAM,EAAE,MAAM,EAAE,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAaT;AAED,wBAAgB,SAAS,CACvB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,EAAE,MAAM,EAAE,EACd,KAAK,EAAE,OAAO,GACb,IAAI,CAsBN"}

package/llms/cli.2.txt

@@ -11,6 +11,113 @@ Parts of this slice:
 # Guide: CLI  (docs/guide/cli.md)  (continued)
 ==============================================================================
 
+## One operation per line — `createCliInvoker`
+
+The most common way an agent drives a CLI is not one command: it is a stream —
+a JSON line per operation, an answer per line — and a resumable batch of the
+same. The mechanics contain nothing product-specific, and until now the
+framework left the one piece that cannot be written outside it: running an
+already-parsed call.
+
+```ts
+import { createCliInvoker, defineCliStreamCommand, defineCliBatchCommand } from 'stitchkit/cli'
+
+const invoker = await createCliInvoker({ name: 'myapp', services })
+
+const outcome = await invoker.invoke('create_item', { title: 'hello', tags: ['a'] })
+// { ok: true, exitCode: 0, data: { … } }   — nothing written, nothing exited
+```
+
+`invoke` runs the same pipeline a typed command runs — the same validation, the
+same `lifecycle` gate, the same hooks — and returns the handler's validated
+output with **the exit code the printed path would give**, from the same table.
+`data` is typed `unknown`: the surface is resolved at run time from services and
+runtime tools, so there is no compile-time name to key a result type on. Narrow
+it with the contract's own output schema. That table used to
+live inside the function that prints, so the only way to learn a code was to
+print it.
+
+Without this, a stream loop had to re-spawn the binary per line: arguments
+serialised back into `--flag value` strings, nested objects pushed through
+`JSON.stringify` into one argv slot and parsed again on the other side, the
+result read back out of stdout text. Three conversions of data the framework was
+already holding, plus a process start measured at 0.15 s — thirty seconds for a
+two-hundred-line manifest before any work begins. The ban on nesting one stream
+inside another was a consequence of that child process, not a rule anyone wanted.
+
+### Native commands in the stream
+
+A native command is in the invoker's surface when — and only when — it declares
+`output`:
+
+```ts
+const describe = defineCliCommand({
+  name: 'describe', description: 'Describe the catalogue',
+  input: z.object({ model: z.string() }),
+  output: z.object({ model: z.string(), ratios: z.array(z.string()) }),
+  handler: ({ input }) => ({ model: input.model, ratios: ['1:1', '16:9'] }),
+})
+
+await createCliInvoker({ name: 'myapp', services, commands: [describe] })
+// invoke('describe', { model: 'flux' }) → { ok: true, exitCode: 0, data: { … } }
+```
+
+A command that declares `output?: never` prints itself and returns nothing, so
+there is no result to hand back; it answers `NOT_FOUND` and stays on the command
+line, where stdout exists. Your stream command is one of these, which is why a
+stream still cannot invoke itself.
+
+On this path `present` is not called — it is stdout formatting, and there is no
+stdout — while `exitCode` is applied through the same function the command line
+uses, so a script branching on the code sees one answer from both. Anything the
+handler writes comes back as `written` rather than interleaving with your own
+output:
+
+```ts
+const outcome = await invoker.invoke('describe', { model: 'flux' })
+outcome.written // { stderr: 'warming the cache\n' } — absent when nothing was written
+```
+
+### Mounting the loop
+
+```ts
+await createCli({
+  name: 'myapp', version, services,
+  commands: [
+    defineCliStreamCommand({ name: 'jsonl', invoker }),
+    defineCliBatchCommand({ name: 'batch', invoker, checkpointPath: '.myapp-batch.json' }),
+  ],
+})
+```
+
+They are factories, not framework-owned names. Reserving `jsonl` and `batch`
+would take two names out of a namespace that belongs to the application — one
+that already has a `batch` command would either fail at startup or find its own
+command silently shadowed — so you mount them under whatever you call them, like
+any other command of yours.
+
+Each line is `{ id, command, args }`; each answer is the invocation result plus
+that `id`. A line that is not JSON, or has no `id`, is **answered** and the
+stream continues: a stream that goes quiet on one line leaves its consumer
+unable to tell which request it lost. Answers go to stdout, one object per line,
+and nothing else does.
+
+### Resuming a batch
+
+The checkpoint records, per id, a digest of the line that produced the recorded
+answer, and is written after **every** line by atomic rename — a checkpoint that
+only survives a clean finish protects against exactly the case that does not
+happen.
+
+A re-run replays what already ran. A line whose content changed under the same
+id is **refused**: replaying it would report success for an operation nobody
+ran, and re-running it would repeat a paid call. Both answer a question nobody
+asked.
+
+What stays yours: what makes a repeat safe (an idempotency key derived from the
+line id), which operations a batch may contain, and how much of it runs at once.
+That is product knowledge, and the framework has no business guessing it.
+
 ## Commands discovered from a running server
 
 A CLI compiled from contracts carries the surface of the build it was compiled

package/llms/cli.txt

@@ -238,11 +238,19 @@ string, the schema says what it should be:
 | `z.string()`         | `--name "box"` or a positional                 |
 | `z.number()`         | `--count 3` → `3`                              |
 | `z.boolean()`        | `--active` (presence) / `--active false` / `--no-active` |
+| `z.literal(1)` / `z.literal([1, 2])` | `--level 1` → `1`              |
+| `z.literal(true)`    | `--enabled` / `--no-enabled`                    |
+| `z.literal('007')`   | `--code 007` → `"007"`                          |
 | `z.enum([...])`      | `--size large`                                 |
 | `z.array(z.string())`| `--tag a --tag b` → `["a","b"]`                |
 | `z.object({...})`    | `--opts '{"k":"v"}'` (JSON) or `--opts.k v`    |
 | `.optional()` / `.default()` | not required                           |
 
+Primitive literals use the same coercion through optional, nullable and default wrappers and as
+array elements. A literal set whose members have different primitive types stays lexical because
+argv has no type tag: for `z.literal([7, '007'])`, `--value 007` remains the string `"007"` rather
+than being guessed as the number `7`. The unchanged Zod schema makes the final admission decision.
+
 After a bare boolean flag, the next token is its value when it is exactly
 `true` or `false` — `--active false` turns it off, as it reads. Any other word
 there stays a positional, and `--` makes a literal `false` one too. The same
@@ -916,110 +924,3 @@ asset's address comes from the manifest, and the manifest's address belongs to
 your server. A channel is two documents at two addresses — which of them a build
 consults is your decision, and `assertCliPublishable` is told about all of them
 rather than taught the shape of any.
-
-## One operation per line — `createCliInvoker`
-
-The most common way an agent drives a CLI is not one command: it is a stream —
-a JSON line per operation, an answer per line — and a resumable batch of the
-same. The mechanics contain nothing product-specific, and until now the
-framework left the one piece that cannot be written outside it: running an
-already-parsed call.
-
-```ts
-import { createCliInvoker, defineCliStreamCommand, defineCliBatchCommand } from 'stitchkit/cli'
-
-const invoker = await createCliInvoker({ name: 'myapp', services })
-
-const outcome = await invoker.invoke('create_item', { title: 'hello', tags: ['a'] })
-// { ok: true, exitCode: 0, data: { … } }   — nothing written, nothing exited
-```
-
-`invoke` runs the same pipeline a typed command runs — the same validation, the
-same `lifecycle` gate, the same hooks — and returns the handler's validated
-output with **the exit code the printed path would give**, from the same table.
-`data` is typed `unknown`: the surface is resolved at run time from services and
-runtime tools, so there is no compile-time name to key a result type on. Narrow
-it with the contract's own output schema. That table used to
-live inside the function that prints, so the only way to learn a code was to
-print it.
-
-Without this, a stream loop had to re-spawn the binary per line: arguments
-serialised back into `--flag value` strings, nested objects pushed through
-`JSON.stringify` into one argv slot and parsed again on the other side, the
-result read back out of stdout text. Three conversions of data the framework was
-already holding, plus a process start measured at 0.15 s — thirty seconds for a
-two-hundred-line manifest before any work begins. The ban on nesting one stream
-inside another was a consequence of that child process, not a rule anyone wanted.
-
-### Native commands in the stream
-
-A native command is in the invoker's surface when — and only when — it declares
-`output`:
-
-```ts
-const describe = defineCliCommand({
-  name: 'describe', description: 'Describe the catalogue',
-  input: z.object({ model: z.string() }),
-  output: z.object({ model: z.string(), ratios: z.array(z.string()) }),
-  handler: ({ input }) => ({ model: input.model, ratios: ['1:1', '16:9'] }),
-})
-
-await createCliInvoker({ name: 'myapp', services, commands: [describe] })
-// invoke('describe', { model: 'flux' }) → { ok: true, exitCode: 0, data: { … } }
-```
-
-A command that declares `output?: never` prints itself and returns nothing, so
-there is no result to hand back; it answers `NOT_FOUND` and stays on the command
-line, where stdout exists. Your stream command is one of these, which is why a
-stream still cannot invoke itself.
-
-On this path `present` is not called — it is stdout formatting, and there is no
-stdout — while `exitCode` is applied through the same function the command line
-uses, so a script branching on the code sees one answer from both. Anything the
-handler writes comes back as `written` rather than interleaving with your own
-output:
-
-```ts
-const outcome = await invoker.invoke('describe', { model: 'flux' })
-outcome.written // { stderr: 'warming the cache\n' } — absent when nothing was written
-```
-
-### Mounting the loop
-
-```ts
-await createCli({
-  name: 'myapp', version, services,
-  commands: [
-    defineCliStreamCommand({ name: 'jsonl', invoker }),
-    defineCliBatchCommand({ name: 'batch', invoker, checkpointPath: '.myapp-batch.json' }),
-  ],
-})
-```
-
-They are factories, not framework-owned names. Reserving `jsonl` and `batch`
-would take two names out of a namespace that belongs to the application — one
-that already has a `batch` command would either fail at startup or find its own
-command silently shadowed — so you mount them under whatever you call them, like
-any other command of yours.
-
-Each line is `{ id, command, args }`; each answer is the invocation result plus
-that `id`. A line that is not JSON, or has no `id`, is **answered** and the
-stream continues: a stream that goes quiet on one line leaves its consumer
-unable to tell which request it lost. Answers go to stdout, one object per line,
-and nothing else does.
-
-### Resuming a batch
-
-The checkpoint records, per id, a digest of the line that produced the recorded
-answer, and is written after **every** line by atomic rename — a checkpoint that
-only survives a clean finish protects against exactly the case that does not
-happen.
-
-A re-run replays what already ran. A line whose content changed under the same
-id is **refused**: replaying it would report success for an operation nobody
-ran, and re-running it would repeat a paid call. Both answer a question nobody
-asked.
-
-What stays yours: what makes a repeat safe (an idempotency key derived from the
-line id), which operations a batch may contain, and how much of it runs at once.
-That is product knowledge, and the framework has no business guessing it.

package/llms/process-owner-loss.txt

@@ -0,0 +1,18 @@
+# stitchkit/process/owner-loss — stitchkit docs slice
+
+> Generated from the `docs/` tree by `bun run gen:llms`. The index of all slices is
+> `llms.txt` in this package.
+
+Contains: API reference: `stitchkit/process/owner-loss`  (docs/api/reference.md)
+
+==============================================================================
+# API reference: `stitchkit/process/owner-loss`  (docs/api/reference.md)
+==============================================================================
+
+## `stitchkit/process/owner-loss`
+
+Narrow startup entry for single-file applications that lazy-import `stitchkit/process`.
+
+| Export | Kind | Purpose |
+|---|---|---|
+| `bootstrapNativeCommandOwnerLoss` | function | call before application argv routing; returns `true` only when the package guard owns this invocation, so the application skips its dispatcher while preserving a lazy import of the full command runner |

package/llms/process.txt

@@ -139,6 +139,7 @@ console.log(captured.exitCode, new TextDecoder().decode(captured.stdout))
 const lifetime = new AbortController()
 await runNativeCommand({
   executable: '/usr/bin/git', args: ['status'], signal: lifetime.signal,
+  ownerLoss: 'terminate', // also stop its group if this JavaScript process is SIGKILLed
   onOutput: async (bytes, channel, outputSignal) => {
     outputSignal.throwIfAborted()
     await output.write(bytes, channel, outputSignal) // application-owned bounded sink
@@ -201,6 +202,35 @@ sink cause is kept; a cleanup failure is a `NativeCommandError` with `COMMAND_CL
 refuses with `COMMAND_UNAVAILABLE`; a descendant that has left the group on its own with `setsid` is
 outside this capability. This is one-shot execution, not a PTY, a supervisor or a daemon host.
 
+`ownerLoss: 'terminate'` binds the command group to this JavaScript process even when it cannot run
+cleanup. A package-owned guard becomes the process-group leader, starts the requested executable in
+that group and holds one end of a private inherited kernel channel. The caller holds the other end.
+`SIGKILL`, a crash or any abrupt caller exit closes that end; EOF makes the guard KILL its own group.
+There is no liveness polling and no later PID lookup. Because the guard is still the group leader
+when it signals, its PGID cannot have been reused by a neighbour. The option is available on Linux
+and Darwin under Bun and Node, requires `group: 'own'`, and other platforms refuse it with
+`COMMAND_UNAVAILABLE`. It adds one short-lived process and one descriptor per guarded command, so it
+is opt-in. `onLeaderStarted({ pid })` reports the guard/group leader with this option; output, stdin,
+exit status, deadlines, cancellation and `onLeaderSettled` retain the requested command's behaviour.
+
+An unbundled application already launches the package's own guard module. A single-file bundle
+whose application entry also owns argv routing must load the narrow bootstrap before its dispatcher
+and skip dispatch when it claims the private guard invocation. This is especially relevant when the
+full command runner stays behind a dynamic import:
+
+```ts
+import { bootstrapNativeCommandOwnerLoss } from 'stitchkit/process/owner-loss'
+
+if (!bootstrapNativeCommandOwnerLoss()) {
+  await dispatch(process.argv.slice(2)) // may lazy-import `stitchkit/process`
+}
+```
+
+The bootstrap carries the package-owned guard into the bundle. It returns `false` for application
+argv and `true` only for the private child started by `runNativeCommand`, so the application does
+not read a guard flag or filename. The built file is self-contained; no installed `node_modules`
+is needed beside it.
+
 ### Stopping a command: the `stop` policy
 
 A caller abort, the `timeoutMs` deadline, an exceeded output budget and a failing sink all stop the
@@ -235,13 +265,13 @@ dropped, never passed to `onOutput` and never captured, so a leader that writes
 does not meet a broken pipe. The result rejects with the abort reason once the group is gone and the
 pipes are closed, so it can take `graceMs` plus `cleanupTimeoutMs` after the abort.
 
-The grace is a timer inside the process that runs the command. If that process exits first, the
-timer is gone and the group, which is detached into its own session, keeps running: nothing in this
-package can bound it from outside. Abort `killOn` in your shutdown path, so the group is killed
-before the process exits, and let the supervisor own the case where the process dies without a
-shutdown. Under systemd, keep `KillMode=control-group` (the default) so the stop of the unit
-reaches every process in its cgroup, whatever its process group; launchd only kills the job's own
-process group, which a command's group is not.
+The grace is a timer inside the process that runs the command. Without `ownerLoss`, if that process
+exits first, the timer is gone and the group, which is detached into its own session, keeps running.
+Abort `killOn` in your shutdown path so a deliberate shutdown kills the group before exit. For an
+abrupt-exit guarantee, choose `ownerLoss: 'terminate'`; for all groups in a service, let the service
+supervisor own the wider boundary. Under systemd, keep `KillMode=control-group` (the default) so the
+stop of the unit reaches every process in its cgroup, whatever its process group; launchd only kills
+the job's own process group, which an unguarded detached command's group is not.
 
 ### Stopping a group and its descendants
 
@@ -302,7 +332,7 @@ becomes `runNativeCommand`; shell policy, command admission, logging, redaction,
 decoder and the operator sink stay with the application. Long signal-only commands stay streaming;
 bounded tar or capture commands get their own explicit limits.
 
-A child the caller holds until it exits is the same call. A guardian that forwards its own SIGTERM
+A child the caller holds until it exits is the same call. A host that forwards its own SIGTERM
 passes an abort signal and `stop: { target: 'leader', signal: 'SIGTERM', graceMs }`. It records the
 pid in `onLeaderStarted({ pid })`, which runs once right after the leader exists (a throw stops the
 command with that error), and the leader's exit code and signal in `onLeaderSettled`: `'exit'`
@@ -312,7 +342,9 @@ long the output pipes may stay open after the leader exited: a holder that left
 `setsid` keeps them open, and without the option the command waits for it until `timeoutMs` or
 the signal; with it the command ends with `COMMAND_CLEANUP` (a holder inside the group is already
 stopped by `descendants`). A worker whose whole group must stop on abort is the default
-`target: 'group'`. A command that uses the caller's terminal is the next section. Importing one leaf does not make
+`target: 'group'`. Add `ownerLoss: 'terminate'` when the worker must also die after an abrupt host
+loss; in that mode `onLeaderStarted` reports the package guard that leads the same group. A command
+that uses the caller's terminal is the next section. Importing one leaf does not make
 installing the whole npm package smaller; choose a dependency after measuring packed size and its
 dependency closure.
 
@@ -346,6 +378,7 @@ its own, so:
   because a group signal would reach the caller;
 - `descendants` does not apply and is refused: what the leader leaves behind belongs to the
   caller's group, and `descendantsStopped` is always `false`;
+- `ownerLoss` is refused: an owner-loss guard must lead a group that belongs only to the command;
 - a Ctrl-C reaches the caller too; handle `SIGINT` in the caller when it must outlive the command.
 
 The two options are independent: `stdio: 'inherit'` alone keeps colour and `isatty` for a command
@@ -677,7 +710,7 @@ Native POSIX Bun/Node one-shot command execution. See [native IO](../guide/nativ
 | Export | Kind | Purpose |
 |---|---|---|
 | `runNativeCommand` | function | caller-lifetime streaming or explicitly bounded binary capture |
-| `NativeCommandOptions` | type | executable/args, env policy, signal/deadline, bytes sink, finite cleanup limits, the `stop` policy and `descendants` (`'terminate-after-leader'`, the default: stop the group after the leader exits, or `'leave'`); `stdio` (`'pipe'`, or `'inherit'` for the caller's descriptors, refusing the pipe-only options) and `group` (`'own'`, or `'caller'`: joins the caller's process group, stops only the leader, refuses `descendants` and a group stop); `onLeaderStarted({ pid })` (once, after the leader exists), `drainTimeoutMs` (bound on the pipes staying open after the leader exited, `COMMAND_CLEANUP`); an unknown key is refused by name, a removed one (`killGraceMs`) with its replacement |
+| `NativeCommandOptions` | type | executable/args, env policy, signal/deadline, bytes sink, finite cleanup limits, the `stop` policy and `descendants` (`'terminate-after-leader'`, the default: stop the group after the leader exits, or `'leave'`); `stdio` (`'pipe'`, or `'inherit'` for the caller's descriptors, refusing the pipe-only options) and `group` (`'own'`, or `'caller'`: joins the caller's process group, stops only the leader, refuses `descendants`, `ownerLoss` and a group stop); `ownerLoss: 'terminate'` (optional Linux/Darwin Bun/Node guard: kernel channel EOF after abrupt caller death KILLs its owned group, unsupported platforms refuse); `onLeaderStarted({ pid })` (once after the group leader exists; the package guard's PID under `ownerLoss`), `drainTimeoutMs` (bound on the pipes staying open after the leader exited, `COMMAND_CLEANUP`); an unknown key is refused by name, a removed one (`killGraceMs`) with its replacement |
 | `NativeCommandStopPolicy` | type | how a cancelled command stops: `target` `'group'` (signal every member) or `'leader'` (signal only the leader; its exit ends the grace), `signal` (default `SIGTERM`), `graceMs` (at most one hour) before KILL to the group, and `killOn`, an `AbortSignal` that skips the grace; default `{ target: 'group', signal: 'SIGTERM', graceMs: 100 }` |
 | `NativeCommandResult` | type | observed nullable exit code/signal, `descendantsStopped` (members left in the group after the leader exited were stopped) and captured stdout/stderr bytes |
 | `NativeCommandError` | class | COMMAND_LIMIT with machine reason `deadline` or `output-budget`; COMMAND_UNAVAILABLE / COMMAND_CLEANUP have no limit reason; COMMAND_CLEANUP means the command's resources were not proven closed, either past `cleanupTimeoutMs` after a stop or past `drainTimeoutMs` after the leader exited, and `cause` holds that bound's failure. Preserves internal cause and existing constructor; caller-created limits without supplied reason remain unclassified |

package/llms/stitchkit.txt

@@ -69,7 +69,8 @@ own, recorded as an ADR.
 | `stitchkit/cli` | server | stable | `createCli` / `createCliInvoker` — runtime and strict NodeNext declarations without MCP SDK / `ai` |
 | `stitchkit/cli/publish` | build and release tooling (Bun or Node, POSIX) | evolving | `publishCli` — commit a verified CLI distribution and move its public manifest last; see [CLI guide](cli.md#publishing-a-complete-version) |
 | `stitchkit/remote` | browser **and** server | stable | peer-free `implementRemote` for thin HTTP proxy processes |
-| `stitchkit/process` | server (Bun or Node, POSIX) | evolving | finite native commands, byte sinks, bounded capture and process-group cancellation |
+| `stitchkit/process` | server (Bun or Node, POSIX) | evolving | finite native commands, byte sinks, bounded capture, process-group cancellation and opt-in Linux/Darwin owner-loss cleanup |
+| `stitchkit/process/owner-loss` | bundled server entry (Bun, POSIX) | evolving | narrow bootstrap that keeps the process runner lazy while carrying its owner-loss guard in a single-file bundle |
 | `stitchkit/files/packaging` | build time (Bun or Node) | evolving | installed native asset graph, integrity, Bun packaging plugin and the artifact loader check; no runtime install policy |
 | `stitchkit/files` | server (Bun or Node) | stable | peer-free managed local-file boundary |
 | `stitchkit/telegram` | server (Bun or Node) | evolving | peer-free Telegram platform primitives — Mini App `initData` verification, send-failure classification, resumable broadcasts, the operator channel with dedupe, a Bot API transport that separates a request that never left from an unknown outcome, local Bot API files, webhook ownership and durable webhook update intake |