stitchkit 0.67.0 → 0.68.0

package/dist/server/unix-client.d.ts

@@ -0,0 +1,25 @@
+import type { ClientFetch } from '../browser/transport';
+export interface UnixClientTransportConfig {
+    /** Absolute local socket path selected by deployment configuration. */
+    socketPath: string;
+    maxRequestBytes?: number;
+    maxResponseBytes?: number;
+    headersTimeoutMs?: number;
+    maxHeaderBytes?: number;
+    maxConnections?: number;
+    /** Redirects stay on this Unix transport. Default 5. */
+    maxRedirects?: number;
+}
+export interface UnixClientTransport {
+    readonly fetch: ClientFetch;
+    readonly closed: boolean;
+    close(): Promise<void>;
+}
+/**
+ * A Fetch-compatible Unix transport shared by Bun and Node. Socket selection is
+ * structural: every request, including redirects, is dispatched through the
+ * configured path and can never fall back to TCP.
+ */
+export declare function createUnixClientTransport(config: UnixClientTransportConfig): UnixClientTransport;
+export { type UnixClientDeliveryState, UnixClientTransportError, type UnixClientTransportErrorCode, } from './unix-client-error';
+//# sourceMappingURL=unix-client.d.ts.map

package/dist/server/unix-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unix-client.d.ts","sourceRoot":"","sources":["../../src/server/unix-client.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAWxD,MAAM,WAAW,yBAAyB;IACxC,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAoED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,yBAAyB,GAChC,mBAAmB,CAsPrB;AAED,OAAO,EACL,KAAK,uBAAuB,EAC5B,wBAAwB,EACxB,KAAK,4BAA4B,GAClC,MAAM,qBAAqB,CAAC"}

package/dist/testing.js

@@ -4,7 +4,7 @@ import {
 } from "./index-fhsmrzj7.js";
 import {
   createApplication
-} from "./index-physbf4z.js";
+} from "./index-6wzr93cg.js";
 import"./index-2k4yrqkc.js";
 import"./index-8eywc9zv.js";
 import {
@@ -25,15 +25,16 @@ import {
 import {
   createClient,
   createClients
-} from "./index-svqhcrrj.js";
-import"./index-48ffdxgk.js";
+} from "./index-zd4v31v2.js";
+import"./index-v5bayx1z.js";
 import {
   joinRoutePath
-} from "./index-pzyt11ch.js";
+} from "./index-9ky9hhg3.js";
 import {
   isRecord
 } from "./index-smpbdg6k.js";
-import"./index-xxye8j3k.js";
+import"./index-0w9abg87.js";
+import"./index-6k1937bx.js";
 
 // src/agent-runtime/testing.ts
 function createAgentRaceBarrier(timeoutMs = 5000) {

package/dist/tools.js

@@ -1,7 +1,7 @@
 import {
   signJwt,
   verifyPkce
-} from "./index-mfw1pec7.js";
+} from "./index-wqyrvhzz.js";
 import {
   DEFAULT_CORS_ALLOW_HEADERS,
   DEFAULT_PROCESS_SIGNALS,
@@ -9,7 +9,7 @@ import {
   defaultSignalSource,
   guardSignalCallback,
   reportSignalError
-} from "./index-y91zd0ch.js";
+} from "./index-pr0qsmjy.js";
 import {
   WaitTimeoutError,
   collectToolSurface,
@@ -24,7 +24,7 @@ import {
   formatToolError,
   readCapped,
   runWaitOperation
-} from "./index-1pgeyyee.js";
+} from "./index-7pn02bgv.js";
 import {
   ToolExecutionControlError,
   coerceJsonArgs,
@@ -32,7 +32,7 @@ import {
   isToolExecutionControlError,
   toolErrorFromResult,
   toolResultFromError
-} from "./index-wrhf06ak.js";
+} from "./index-avjd67h6.js";
 import {
   ManagedFileError
 } from "./index-bfcpjw20.js";
@@ -52,30 +52,28 @@ import"./index-6djpbnda.js";
 import"./index-cby4ar3v.js";
 import {
   redact
-} from "./index-6taryy00.js";
+} from "./index-dafax5md.js";
 import {
   getRequestContext,
   getTraceId,
-  normalizeError,
   runWithRequestContext
-} from "./index-tvwcrx2d.js";
-import {
-  defineContract
-} from "./index-wd8g8z6e.js";
-import {
-  ManagedFilePathSchema,
-  ManagedFileRefSchema
-} from "./index-6k1937bx.js";
+} from "./index-69m2278y.js";
 import {
+  defineContract,
+  normalizeError,
   resolvePropagationContext
-} from "./index-pzyt11ch.js";
+} from "./index-9ky9hhg3.js";
 import {
   isRecord
 } from "./index-smpbdg6k.js";
 import {
   AppError,
   STITCH_ERROR_STATUS
-} from "./index-xxye8j3k.js";
+} from "./index-0w9abg87.js";
+import {
+  ManagedFilePathSchema,
+  ManagedFileRefSchema
+} from "./index-6k1937bx.js";
 
 // src/tools/agent.ts
 import { jsonSchema, tool } from "ai";

package/llms-full.txt

@@ -58,9 +58,9 @@ own, recorded as an ADR.
 | `stitchkit/testing` | tests on Bun or Node | stable | in-process generated clients over a real Fetch handler, plus the store and managed-resource conformance kits |
 | `stitchkit/declaration` | build and deployment tooling (Bun or Node) | evolving | `ProjectDeclarationSchema` — the one machine-readable statement a repository makes about itself |
 | `stitchkit/react` | browser | stable | `createCursorQuery`, `createCacheBridge` |
-| `stitchkit/agent-runtime` | server | evolving<br>_redefined in 9 of the 12 minors since 0.56.2, most recently 0.66.0_ | optional durable conversation/run loop, history, models, prompts, fencing and events |
+| `stitchkit/agent-runtime` | server | evolving<br>_redefined in 9 of the 13 minors since 0.56.2, most recently 0.66.0_ | optional durable conversation/run loop, history, models, prompts, fencing and events |
 | `stitchkit/agent-runtime/openrouter` | server | evolving | isolated OpenRouter language-model adapter |
-| `stitchkit/application` | server | evolving<br>_redefined in 3 of the 12 minors since 0.56.2, most recently 0.67.0_ | managed resource graph, readiness, admission, schedules and bounded shutdown |
+| `stitchkit/application` | server | evolving<br>_redefined in 3 of the 13 minors since 0.56.2, most recently 0.67.0_ | managed resource graph, readiness, admission, schedules and bounded shutdown |
 | `stitchkit/application/grammy` | server | evolving | isolated grammY polling and webhook lifecycle adapters |
 | `stitchkit/application/opentelemetry` | server | evolving | maps application snapshots onto an injected OpenTelemetry `Meter` |
 
@@ -1521,6 +1521,57 @@ focused helper — not a sub-framework.
 | `createCache()` + `cacheHeaders()` | in-memory TTL cache; `Cache-Control` builder |
 | `createEventBus<EventMap>()` | typed in-process pub/sub |
 
+### Contract-first streams
+
+Use an endpoint `stream` descriptor when the item schema and completion belong
+to the contract, rather than handing an application-owned `Response` to
+`rawResponse`:
+
+```ts
+const Item = z.discriminatedUnion('kind', [
+  z.object({ kind: z.literal('line'), text: z.string() }),
+  z.object({ kind: z.literal('complete'), count: z.number().int() }),
+])
+
+const reports = defineContract({ prefix: 'reports' }, {
+  watch: {
+    method: 'GET', path: '/:id/watch', desc: 'Watch one report',
+    params: z.object({ id: z.string() }),
+    stream: {
+      item: Item,
+      format: 'ndjson',
+      maxFrameBytes: 64 * 1024,
+      terminal: z.object({ kind: z.literal('complete') }).loose(),
+    },
+  },
+})
+
+const service = implement(reports, {
+  watch: async function* ({ params, signal }) {
+    yield { kind: 'line', text: `starting ${params.id}` }
+    if (signal.aborted) return
+    yield { kind: 'complete', count: 1 }
+  },
+})
+```
+
+The handler return is inferred as `AsyncIterable<z.output<typeof Item>>`; an
+invalid JavaScript producer is rejected before its value reaches the wire. Data,
+safe errors and normal end use a framework envelope. The default encoded frame
+limit is 256 KiB. `format` defaults to `ndjson`; `heartbeatMs` defaults to five
+seconds; `idleTimeoutSeconds` defaults to disabled; `lifetimeMs` is optional.
+
+After headers, HTTP status can no longer report failure, so the stream sends a
+normalized code and never the raw internal exception. Normal producer completion
+sends an explicit `end`; when `terminal` is declared, at least one item must
+match it. Request abort and client iterator return abort `signal`, including a
+source waiting in `next()` or suspended at a yielded item.
+
+Contract streams are HTTP-only and cannot declare `output`, `rawResponse`,
+multipart or tool exposure. They do not provide replay, cursors or durable
+subscriptions. Keep using `streamingRoute` for an application-owned protocol and
+`rawResponse` for arbitrary response bodies. → ADR 0117.
+
 ### SSE streaming
 
 `streamSSE` returns a `Response`, so its endpoint declares
@@ -1834,23 +1885,46 @@ your own `(pathname) => boolean`.
 
 ### Unix domain sockets
 
-The same typed client dials a local daemon's socket file
-([server side](server.md#local-daemon-over-a-unix-socket)):
+The same typed client dials a local daemon's socket file through an explicit,
+owned Bun/Node transport ([server side](server.md#local-daemon-over-a-unix-socket)):
 
 ```ts
+import { createHttpClient } from 'stitchkit'
+import { createUnixClientTransport } from 'stitchkit/server' // or stitchkit/node
+
+const transport = createUnixClientTransport({
+  socketPath: '/run/my-daemon.sock',
+  maxRequestBytes: 4 * 1024 * 1024,
+  maxResponseBytes: 16 * 1024 * 1024,
+})
 const http = createHttpClient({
-  baseUrl: 'http://localhost', // required prefix source; its host is ignored
-  unix: '/run/my-daemon.sock',
+  baseUrl: 'http://my-daemon', // URL/Host source; never dialled as TCP
+  fetch: transport.fetch,
+  retry: { limit: 0 },
 })
 const daemon = createClient(daemonContract, http)
+
+// At application shutdown:
+await transport.close()
 ```
 
-`baseUrl` stays required — it supplies the path prefix and the `Host` header,
-while the connection itself goes through the socket file. Bun runtime only:
-other runtimes ignore the option and dial `baseUrl` over TCP (Node's fetch
-would need an undici dispatcher — out of scope). A missing socket file
-surfaces as a normal `ApiError` and is not retried (transport retry stays
-connection-refused-only).
+`baseUrl` stays required because it supplies the URL and `Host` header. The
+adapter structurally owns dispatch: relative and absolute redirects use the same
+socket, and a missing socket cannot fall through to that host over TCP. Defaults
+are 16 MiB request/response bodies, 64 KiB headers, 30 s to response headers,
+eight connections and five redirects.
+
+`UnixClientTransportError` carries a stable `code` and `delivery`:
+`not-dispatched`, `possibly-dispatched` or `response-received`. Only the first
+proves that the remote operation did not begin; Stitchkit never silently retries
+an ambiguous write. Response consumption/cancellation belongs to the operation,
+and `close()` interrupts active work and destroys owned connections.
+
+The legacy `createHttpClient({ unix: '/absolute/path' })` spelling remains a
+Bun-only convenience. On a non-Bun runtime it now refuses before dispatch
+instead of ignoring the selection and dialing TCP. `unix` and an injected
+`fetch` are mutually exclusive; use `createUnixClientTransport` for portable,
+explicit lifecycle ownership. → ADR 0116.
 
 `trace: true` mints a fresh root trace per request. The stitchkit server
 [continues an inbound `traceparent`](./observability.md#trace-context), so the
@@ -2218,6 +2292,41 @@ sends one. The result keeps the full `react-query-kit` surface (`.getKey()`,
 `useSuspenseInfiniteQuery`, every option). The endpoint must return the
 `{ items, nextCursor }` envelope — see [Contracts → pagination](./contracts.md#pagination).
 
+## Contract-first streams
+
+When an endpoint declares `stream`, `createClient` returns a schema-derived
+owned iterator rather than an untyped `Response`:
+
+```ts
+const Progress = z.discriminatedUnion('kind', [
+  z.object({ kind: z.literal('line'), text: z.string() }),
+  z.object({ kind: z.literal('complete'), count: z.number().int() }),
+])
+
+const contract = defineContract({ prefix: 'reports' }, {
+  watch: {
+    method: 'GET', path: '/:id/watch', desc: 'Watch one report',
+    params: z.object({ id: z.string() }),
+    stream: {
+      item: Progress,
+      format: 'ndjson',                 // default; `sse` is also supported
+      maxFrameBytes: 64 * 1024,         // default 256 KiB
+      terminal: z.object({ kind: z.literal('complete') }).loose(),
+    },
+  },
+})
+
+const stream = await createClient(contract, http).watch({ id: 'r-1' })
+for await (const item of stream) console.log(item) // inferred from Progress
+```
+
+The iterator validates every frame and item. Normal completion requires the
+wire `end` frame and, when declared, at least one matching terminal item; EOF is
+`STREAM_TRUNCATED`, and a missing terminal is `STREAM_TERMINAL_MISSING`.
+`return()`/`break`, caller abort, producer failure and optional `lifetimeMs`
+converge on the request operation. See the
+[server half](./server.md#contract-first-streams). → ADR 0117.
+
 ## SSE
 
 For a streaming endpoint, consume the response with `parseSSE`:
@@ -2233,7 +2342,9 @@ for await (const event of parseSSE(res)) {
 
 The server side is [`streamSSE`](./server.md#sse-streaming), or
 [`sseRoute`](./server.md#long-lived-subscriptions) for a subscription that stays
-open.
+open. One line is bounded by `maxLineBytes` (default 1 MiB), UTF-8 is decoded
+strictly and malformed input throws. Supply `onParseError` only when
+skip-and-report is an explicit application policy.
 
 ## NDJSON
 
@@ -2265,8 +2376,9 @@ convenience: a long-lived stream must send something while it is idle or
 intermediaries drop it, and an empty line is the natural pulse for this framing.
 Writing the rule down on both sides is what stops it being a verbal agreement —
 the server's keep-alive and the reader's skip are one decision with two
-implementations. A frame that is not valid JSON goes to `onParseError` rather
-than throwing, so one bad line does not end the subscription.
+implementations. One line is bounded by `maxLineBytes` (default 1 MiB), UTF-8 is
+decoded strictly and malformed input throws. Passing `onParseError` explicitly
+selects tolerant skip-and-report behaviour.
 
 
 ==============================================================================
@@ -4530,6 +4642,69 @@ try {
 `release()` is idempotent. Admission and counter increment are atomic, so work
 cannot slip between the shutdown check and drain accounting.
 
+### Bounded operation admission
+
+Compose `createBoundedAdmission` when accepted work also competes for a finite
+process-local resource:
+
+```ts
+const generations = createBoundedAdmission({
+  upstream: app.admission,
+  policy: {
+    global: { maxConcurrent: 8, rate: { limit: 120, intervalMs: 60_000 } },
+    perKey: { maxConcurrent: 1, maxKeys: 2_000 },
+  },
+})
+
+await generations.run(accountId, ({ signal }) => generate({ signal }), {
+  signal: request.signal,
+  timeoutMs: 30_000,
+})
+```
+
+Acquisition is no-queue and atomic across every configured budget. Refusal names
+the exact bound; only a rate refusal carries `retryAfterMs`. `maxKeys` keeps the
+per-key registry finite, and expired idle entries are retired.
+
+The caller timeout is a wait budget, not proof that the resource stopped. It
+aborts the signal and settles the caller, but the lease remains active until the
+underlying Promise actually settles. `drain()` therefore reports real work;
+`force()` closes admission and reports remaining work without claiming to have
+terminated it. → ADR 0118.
+
+### Bounded delivery and byte credit
+
+`createBoundedChannel` is for one asynchronous reader when an event bus is not a
+queue:
+
+```ts
+const output = createBoundedChannel<string>({
+  policy: 'ordered',
+  maxItems: 64,
+  maxBytes: 256 * 1024,
+  sizeOf: (value) => new TextEncoder().encode(value).byteLength,
+})
+
+const progress = createBoundedChannel<{ revision: number }>({
+  policy: 'latest',
+  maxItems: 1,
+  maxBytes: 128,
+  sizeOf: () => 128,
+})
+```
+
+`ordered` never overwrites accepted values; overflow is a reasoned refusal.
+`latest` retains exactly one pending replaceable value and reports
+`coalesced`. Offers never create a hidden writer queue, and only one `next()` may
+wait. Close chooses `drain` (default) or `discard`; abort discards; failure
+rejects the parked and all later reads.
+
+`createCreditWindow({ capacityBytes })` is the smaller primitive for a protocol
+that already owns its queue but needs exact byte permission. Each credit lease
+replenishes once; it is flow-control credit, not a durable acknowledgement. The
+application snapshot sink now shares the same latest-value mechanics without
+changing its revision or status contract. → ADR 0119.
+
 Shutdown performs one phase barrier at a time: stop admission everywhere,
 cancel future schedules, drain admitted work, then close in reverse stable
 topological order. Every hook shares the same grace deadline. Forced cleanup
@@ -4804,6 +4979,56 @@ asynchronous subscriber callback racing cleanup: publish `getSnapshot()` before
 closing the outer sink, so any older or duplicate late delivery is rejected as
 stale instead of dropping the final state.
 
+## Bound a handler and a local worker with one lease policy
+
+Use a bounded admission when two entry paths consume the same finite local
+capacity. Composing it with `application.admission` keeps readiness and shutdown
+as the upstream gate:
+
+```ts
+const work = createBoundedAdmission({
+  upstream: app.admission,
+  policy: {
+    global: { maxConcurrent: 4 },
+    perKey: { maxConcurrent: 1, maxKeys: 1_000 },
+  },
+})
+
+const fromHttp = (key: string, signal: AbortSignal) =>
+  work.run(key, (context) => render(context.signal), { signal, timeoutMs: 20_000 })
+
+const fromWorker = (key: string) =>
+  work.run(key, (context) => reconcile(context.signal))
+```
+
+A timeout in `fromHttp` does not free a permit while `render` remains active.
+At shutdown call `work.stopAdmission()` with the other admission owners and
+await `work.drain(...)`; the result reports the actual remainder.
+
+## Replace ad-hoc output and progress queues
+
+Ordered output and replaceable progress are separate declarations:
+
+```ts
+const lines = createBoundedChannel<string>({
+  policy: 'ordered', maxItems: 100, maxBytes: 1_000_000,
+  sizeOf: (line) => new TextEncoder().encode(line).byteLength,
+})
+
+const state = createBoundedChannel<{ revision: number; percent: number }>({
+  policy: 'latest', maxItems: 1, maxBytes: 64,
+  sizeOf: () => 64,
+})
+
+const lineResult = lines.offer('one durable-in-process ordering unit')
+const stateResult = state.offer({ revision: 2, percent: 50 })
+```
+
+Handle `refused` from `lines` at the protocol boundary; do not turn it into
+implicit loss. A `coalesced` state result is expected latest-value behaviour,
+not evidence that an ordered event was delivered. Neither channel is durable;
+persist first when restart replay is required.
+
 ## Handing a handle to the resources that depend on it
 
 `dependsOn` carries ordering. To carry the object as well, return a `value` from
@@ -8038,6 +8263,56 @@ implement `AgentRuntimeStoreDriver` and compose the aggregate with
    runtime): bootstrap the server, one HTTP request, and any feature you rely on
    (Socket.IO connect, an MCP tool call, a multipart upload, …).
 
+## Released migration: 0.68.0
+
+### Make Unix transport selection explicit outside Bun
+
+The legacy `unix` option remains a Bun convenience, but on Node or another
+runtime it now fails before dispatch. Replace it with the owned adapter and close
+that adapter with the application:
+
+```ts
+// before — unsafe outside Bun: an unsupported fetch could dial baseUrl over TCP
+const http = createHttpClient({ baseUrl, unix: '/run/service.sock' })
+
+// after — Bun and Node; every dispatch and redirect stays on the socket
+import { createUnixClientTransport } from 'stitchkit/server' // or stitchkit/node
+const transport = createUnixClientTransport({ socketPath: '/run/service.sock' })
+const http = createHttpClient({ baseUrl, fetch: transport.fetch })
+// during shutdown
+await transport.close()
+```
+
+Do not automatically replay `possibly-dispatched`: a timeout or connection loss
+after bytes left the process does not prove that a write did not happen.
+
+### Choose tolerant stream parsing explicitly
+
+`parseNDJSON` and `parseSSE` now throw on malformed JSON, invalid UTF-8 and an
+over-limit line. The default line ceiling is 1 MiB. If a feed deliberately skips
+bad records, retain that policy explicitly:
+
+```ts
+// before — malformed input disappeared implicitly
+parseNDJSON(response)
+
+// after — ordinary fail-closed path
+parseNDJSON(response, { maxLineBytes: 256 * 1024 })
+
+// after — deliberately tolerant path
+parseNDJSON(response, { onParseError: (raw, error) => report(raw, error) })
+```
+
+### Extend exhaustive framework-error handling
+
+If a switch makes `StitchErrorCode` exhaustive, add
+`STREAM_ITEM_INVALID`, `STREAM_FRAME_TOO_LARGE`,
+`STREAM_TERMINAL_MISSING` and `STREAM_LIFETIME_EXCEEDED`. A partial application
+status map needs no change (ADR 0105).
+
+The admission/channel APIs and endpoint `stream` descriptor are additive; raw
+responses and raw `streamingRoute` remain supported.
+
 ## Released migration: 0.67.0
 
 Three application-kernel changes. Two of them fix silent failures, so the most
@@ -10431,7 +10706,7 @@ The browser-and-server entrypoint. Re-exports everything from
 | `createUrlBuilders` | function | build one exact URL builder per contract in a registry |
 | `UrlBuilderConfig` | _type_ | explicit `{ baseUrl }` source for a URL builder |
 | `ClientConfig` | _type_ | config for `createClient`'s bare-fetch mode (2nd arg, no `HttpClient`) |
-| `ClientFetch` | _type_ | injectable Fetch-compatible transport used by framework testing adapters |
+| `ClientFetch` | _type_ | injectable Fetch-compatible transport used by framework and application-owned adapters |
 | `ClientRequestOptions` | _type_ | per-call `{ signal?: AbortSignal }` passed through an endpoint callable's `.withOptions(...)`; caller abort is distinct from timeout — [guide](../guide/client.md#per-call-cancellation) |
 | `ContractClientConfig` | _type_ | per-tenant / resource-scoped client config — dynamic `pathPrefix` + `stripPrefixKeys` ([guide](../guide/client.md#contractclientconfig--per-tenant--resource-scoped-clients)) |
 | `contractEndpointMatchers` | function | compile exact pathname matchers for selected HTTP contract operations and expected-401 policy |
@@ -10440,7 +10715,7 @@ The browser-and-server entrypoint. Re-exports everything from
 | `ApiError` | class | a non-2xx response, with `code` / `status` / `details` / `hint` and optional readonly `traceId` from `x-request-id` |
 | `HttpClient` | _type_ | the transport interface `createClient` builds on |
 | `ConfiguredHttpClient` | _type_ | a framework-created `HttpClient` carrying its readonly `baseUrl` for URL builders |
-| `HttpClientConfig` | _type_ | config for `createHttpClient`; retry `limit` counts retries after the initial attempt (default 2 = at most 3 GET attempts), with `statusCodes: []` by default; `unix` dials a unix domain socket (Bun only) — [details](../guide/client.md#createhttpclient) |
+| `HttpClientConfig` | _type_ | config for `createHttpClient`; retry `limit` counts retries after the initial attempt (default 2 = at most 3 GET attempts), with `statusCodes: []` by default; `fetch` installs an explicit transport and is mutually exclusive with the legacy Bun-only `unix` option — [details](../guide/client.md#createhttpclient) |
 | `UnauthorizedMatcher` | _type_ | exact `(pathname) => boolean` policy accepted by `suppressUnauthorizedFor` |
 | `RequestOptions` | _type_ | per-call options — params, timeout, response type |
 | `HeaderProvider` | _type_ | static or per-request headers |
@@ -10458,6 +10733,8 @@ The browser-and-server entrypoint. Re-exports everything from
 | `createRetainedTopics` | function | retained last-value store for sticky events — [guide](../guide/realtime.md#sticky-events) |
 | `parseSSE` | function | parse an SSE `Response` into an async generator — [guide](../guide/client.md#sse) |
 | `parseNDJSON` | function | parse an NDJSON `Response`; blank keep-alive lines are skipped — [guide](../guide/client.md#ndjson) |
+| `ContractStreamFrameSchema` / `ContractStreamFrame` | schema / _type_ | internal-on-the-wire `data` / safe `error` / `end` envelope of a contract-first stream |
+| `DEFAULT_CONTRACT_STREAM_FRAME_BYTES` | const | default maximum encoded contract-stream frame: 256 KiB |
 | `SocketIOClient` | _type_ | low-level client handle; `emit` reports disconnected drops and `emitWithAck` exposes the native Promise primitive used by validated `request()` |
 | `SocketIOClientPeerLoaders` | _type_ | inject `socket.io-client` so a bundler can put it in a self-contained artifact |
 | `SocketIOClientConfig` | _type_ | config for `createSocketIOClient` (incl. `retain`, `onConnectError`, `onDroppedEmit`) |
@@ -10533,6 +10810,7 @@ from the root `stitchkit`.
 | `ContractDef` | _type_ | a defined contract |
 | `ContractMeta` | _type_ | a contract's `prefix` + optional `scope` and `meta` (a default every endpoint shallow-merges over) |
 | `EndpointDef` | _type_ | a single endpoint definition; `output` declares JSON response presence (`null` is data, `undefined` is invalid) |
+| `EndpointStreamDescriptor` | _type_ | HTTP-only schema-derived stream declaration: item schema, NDJSON/SSE framing, frame/lifetime/heartbeat/idle bounds and optional terminal predicate — [guide](../guide/server.md#contract-first-streams) |
 | `HeadEndpointDef` | _type_ | explicit HTTP-only, bodyless `HEAD` endpoint definition |
 | `EndpointResponseMeta` | _type_ | static success metadata declared by an HTTP-only typed-data endpoint |
 | `ResponseMetadata` | _type_ | per-request outbound collector exposed as `ctx.response` only for a `responseMeta` endpoint |
@@ -10791,6 +11069,12 @@ Also re-exports the error helpers from `stitchkit/contract`.
 | `StreamingRouteOptions` | _type_ | options for `streamingRoute` / `ndjsonRoute` / `sseRoute` |
 | `StreamingSourceContext` | _type_ | what a streaming source is given, including the cancellation `signal` |
 | `StreamingFormat` | _type_ | `'ndjson' \| 'sse'` |
+| `createUnixClientTransport` | function | owned Fetch-compatible Unix-socket transport on Bun and Node; every redirect stays on the socket — [guide](../guide/client.md#unix-domain-sockets) |
+| `UnixClientTransportConfig` | _type_ | absolute socket path plus request/response/header/connection/redirect bounds |
+| `UnixClientTransport` | _type_ | `{ fetch, closed, close() }`; `close()` settles owned active work |
+| `UnixClientTransportError` | class | stable transport failure with `code` and dispatch certainty in `delivery` |
+| `UnixClientTransportErrorCode` | _type_ | finite Unix transport failure-code union |
+| `UnixClientDeliveryState` | _type_ | `not-dispatched \| possibly-dispatched \| response-received`; input to application retry policy, never an implicit retry |
 
 ### OpenAPI
 
@@ -10840,6 +11124,39 @@ cutovers are covered by the executable
 | `ApplicationHealthHandlerOptions` / `ApplicationHealthHandlerOptionsSchema` | _type_ / schema | liveness/readiness selection and sanitized `Retry-After` policy |
 | `ApplicationOperationalHandlers` / `ApplicationOperationalHandlersOptions` / `ApplicationOperationalHandlersOptionsSchema` | _type_ / schema | conventional status/readiness/liveness route surface and shared retry policy |
 
+### Bounded admission
+
+| Export | Kind | Summary |
+|--------|------|---------|
+| `createBoundedAdmission` | function | process-local no-queue global/per-key concurrency and rate leases, optionally composed with application admission |
+| `BoundedAdmissionPolicySchema` / `BoundedAdmissionPolicy` | schema / _type_ | finite global budget and optional finite per-key budget with `maxKeys` |
+| `BoundedRateBudgetSchema` / `BoundedRateBudget` | schema / _type_ | `{ limit, intervalMs }` monotonic sliding-window budget |
+| `BoundedAdmissionStateSchema` / `BoundedAdmissionState` | schema / _type_ | `accepting \| draining \| closed` |
+| `BoundedAdmissionRefusalReasonSchema` / `BoundedAdmissionRefusalReason` | schema / _type_ | exact local/upstream refusal vocabulary |
+| `BoundedAdmissionSnapshotSchema` / `BoundedAdmissionSnapshot` | schema / _type_ | absolute active/lifetime/refusal/rate-accounting counters |
+| `BoundedAdmission` / `BoundedAdmissionConfig` / `BoundedAdmissionClock` | _type_ | handle, policy/upstream/clock configuration and monotonic clock seam |
+| `BoundedAdmissionResult` / `BoundedAdmissionLeaseResult` / `BoundedAdmissionRefusedResult` | _type_ | explicit leased-or-refused acquisition result; retry time exists only for rate bounds |
+| `BoundedOperationLease` | _type_ | idempotent release lease, optionally carrying its key |
+| `BoundedOperationRunContext` / `BoundedOperationRunOptions` | _type_ | underlying work signal and caller abort/timeout wait budget |
+| `BoundedAdmissionDrainOptions` / `BoundedAdmissionDrainResult` / `BoundedAdmissionForceResult` | _type_ | bounded drain inputs and honest remaining-work results |
+| `BoundedAdmissionRefusalError` | class | `run()` refusal with reason and optional `retryAfterMs` |
+| `BoundedOperationWaitError` | class | caller wait ended as `cancelled` or `timed-out`; underlying capacity remains leased until work settles |
+
+### Bounded delivery
+
+| Export | Kind | Summary |
+|--------|------|---------|
+| `createBoundedChannel` | function | finite single-reader async channel with explicit ordered or latest-value policy |
+| `BoundedChannelPolicySchema` / `BoundedChannelPolicy` | schema / _type_ | `ordered \| latest` retention policy |
+| `BoundedChannelStateSchema` / `BoundedChannelState` | schema / _type_ | `open \| draining \| closed \| failed` |
+| `BoundedChannelSnapshotSchema` / `BoundedChannelSnapshot` | schema / _type_ | exact retained count/bytes, waiter and outcome counters |
+| `BoundedChannel` / `BoundedChannelConfig` / `BoundedChannelCloseOptions` | _type_ | iterator/offer handle, explicit count/byte/size policy and drain/discard close mode |
+| `BoundedChannelOfferResult` | _type_ | `delivered`, `queued`, `coalesced`, or reasoned `refused` outcome |
+| `BoundedChannelReaderError` | class | refusal of a second concurrent pending `next()` |
+| `createCreditWindow` | function | finite byte-credit lease window with exact once-only replenishment |
+| `CreditWindow` / `CreditWindowSnapshot` / `CreditWindowSnapshotSchema` | _type_ / schema | byte-credit handle and absolute accounting record |
+| `CreditAcquireResult` / `CreditLease` | _type_ | reasoned refusal or idempotently releasable byte-credit lease |
+
 ### Managed schedules
 
 | Export | Kind | Summary |
@@ -11556,6 +11873,7 @@ runtime-agnostic pieces of `stitchkit/server` and the error helpers.
 | `serveNode` | function | build the router and start a Node HTTP server (via `srvx`) |
 | `createHandler` | function | the router as a bare `(req) => Response` (same as `/server`) |
 | `createSocketIOServer` | function | the typed Node Socket.IO server (`io` + `attach`; no Bun engine declarations) |
+| `createUnixClientTransport` | function | the same fail-closed Bun/Node Unix client adapter exported by `stitchkit/server` |
 | `implement` / `createImplement` / `createScopedImplement` / `createScopedImplementRegistry` / `createMultipartStream` | function | bind a contract to typed handlers, optionally typed per endpoint scope (same as `/server`) |
 | `NodeServerConfig` | _type_ | config for `serveNode` |
 | `NodeServerHandle` | _type_ | managed Node handle (`url`, `port`, `runtime`, `status`, `shutdown`) |
@@ -11563,6 +11881,8 @@ runtime-agnostic pieces of `stitchkit/server` and the error helpers.
 | `NodeSocketLifecycle` | _type_ | Bun-free Socket.IO lifecycle accepted by `serveNode` |
 | `HandlerConfig` / `ServiceDef` / `RawRoute` / `RawRouteContext` | _type_ | runtime-neutral handler types; raw routes default their host server to `unknown` |
 | `SocketIORequestPolicy` / `SocketIOServerConfig` / `SocketIOPeerLoaders` / `SocketIOServerHandle` | _type_ | runtime-neutral handshake policy, config, optional-peer loaders and the Bun-free Node handle with `io`, `attach` and lifecycle |
+| `UnixClientTransportConfig` / `UnixClientTransport` | _type_ | Unix socket bounds and owned Fetch-compatible handle |
+| `UnixClientTransportError` / `UnixClientTransportErrorCode` / `UnixClientDeliveryState` | class / _type_ | stable failure plus dispatch certainty; no cross-transport fallback |
 | `AppError` + `appError` / `badRequest` / `unauthorized` / `forbidden` / `notFound` / `conflict` / `rateLimited` | — | error helpers (same as `/contract`) |
 
 ---

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stitchkit",
-  "version": "0.67.0",
+  "version": "0.68.0",
   "description": "Contract-first backend framework — one defineContract() into an HTTP API, MCP tools, AI-agent tools and a typed client. Bun and Node.",
   "keywords": [
     "bun",

package/dist/index-48ffdxgk.js

@@ -1,6 +0,0 @@
-// src/internal/http-input.ts
-function inputIsQuery(method) {
-  return method === "GET" || method === "DELETE";
-}
-
-export { inputIsQuery };