stitchkit 0.70.4 → 0.70.6

package/dist/{index-c97p90dc.js → index-cx84zg25.js}

@@ -20,8 +20,11 @@ import {
   setRequestError
 } from "./index-w9m1wznn.js";
 import {
-  ShutdownOptionsSchema
-} from "./index-7wpgrqa8.js";
+  ShutdownOptionsSchema,
+  isStreamCancellation,
+  ownHttpStream,
+  settleStreamCleanup
+} from "./index-3z73fh2c.js";
 import {
   errorCode,
   normalizeError,
@@ -598,8 +601,28 @@ function streamingRoute(options) {
     handler: async (request, context) => {
       applyIdleTimeout(context.server, request, idleTimeoutSeconds);
       const departed = new AbortController;
-      const iterable = await options.source(request, { ...context, signal: departed.signal });
-      const iterator = iterable[Symbol.asyncIterator]();
+      const settled = Promise.withResolvers();
+      settled.promise.catch(() => {
+        return;
+      });
+      const pumped = Promise.withResolvers();
+      pumped.promise.catch(() => {
+        return;
+      });
+      let cancel = () => departed.abort();
+      ownHttpStream(request, { cancel: () => cancel(), settled: settled.promise });
+      let iterator;
+      try {
+        const iterable = await options.source(request, {
+          ...context,
+          signal: departed.signal
+        });
+        iterator = iterable[Symbol.asyncIterator]();
+      } catch (error) {
+        departed.abort();
+        settled.reject(error);
+        throw error;
+      }
       const encoder2 = new TextEncoder;
       let heartbeat = null;
       let closed = false;
@@ -613,15 +636,22 @@ function streamingRoute(options) {
         if (closed)
           return;
         closed = true;
+        stopHeartbeat();
+        signalDemand();
+        request.signal.removeEventListener("abort", onRequestAbort);
+        departed.abort();
+        const hook = Promise.withResolvers();
         try {
           options.onClose?.();
-          stopHeartbeat();
-          signalDemand();
-          departed.abort();
-          Promise.resolve(iterator.return?.(undefined)).catch(() => {
-            return;
-          });
-        } catch {}
+          hook.resolve();
+        } catch (error) {
+          hook.reject(error);
+        }
+        settleStreamCleanup([
+          hook.promise,
+          pumped.promise,
+          Promise.resolve().then(() => iterator.return?.(undefined))
+        ]).then(() => settled.resolve(), (error) => settled.reject(error));
       };
       let demand = null;
       const signalDemand = () => {
@@ -629,6 +659,7 @@ function streamingRoute(options) {
         demand = null;
         resolve?.();
       };
+      const onRequestAbort = () => cancel();
       const stream = new ReadableStream({
         start(controller) {
           const send = (text) => {
@@ -647,15 +678,16 @@ function streamingRoute(options) {
               controller.close();
             } catch {}
           };
-          if (request.signal.aborted) {
+          cancel = () => {
             release();
             finish();
+          };
+          if (request.signal.aborted || departed.signal.aborted) {
+            pumped.resolve();
+            cancel();
             return;
           }
-          request.signal.addEventListener("abort", () => {
-            release();
-            finish();
-          });
+          request.signal.addEventListener("abort", onRequestAbort, { once: true });
           send(framing.keepAlive);
           heartbeat = setInterval(() => {
             if ((controller.desiredSize ?? 1) > 0)
@@ -696,9 +728,13 @@ function streamingRoute(options) {
               if (framing.done)
                 send(framing.done);
             } catch (error) {
-              if (!closed)
+              if (closed) {
+                if (!isStreamCancellation(error, departed.signal))
+                  pumped.reject(error);
+              } else
                 send(framing.frame(normalizeError(error).toJSON()));
             } finally {
+              pumped.resolve();
               release();
               finish();
             }
@@ -890,9 +926,32 @@ function waitForAbort(signal) {
 function contractStreamResponse(request, context, source, descriptor, operationAbort) {
   const format = descriptor.format ?? "ndjson";
   const maxFrameBytes = descriptor.maxFrameBytes ?? DEFAULT_CONTRACT_STREAM_FRAME_BYTES;
+  const iterator = source[Symbol.asyncIterator]();
+  let pendingNext;
+  const settled = Promise.withResolvers();
+  settled.promise.catch(() => {
+    return;
+  });
   let lifetime;
   let lifetimeExpired = false;
-  if (descriptor.lifetimeMs !== undefined) {
+  let closing = false;
+  const closeSource = (cancelled = operationAbort.signal.aborted) => {
+    if (closing)
+      return;
+    closing = true;
+    if (lifetime !== undefined)
+      clearTimeout(lifetime);
+    operationAbort.abort();
+    settleStreamCleanup([
+      Promise.resolve(pendingNext).catch((error) => {
+        if (cancelled && !isStreamCancellation(error, operationAbort.signal))
+          throw error;
+      }),
+      Promise.resolve().then(() => iterator.return?.(undefined))
+    ]).then(() => settled.resolve(), (error) => settled.reject(error));
+  };
+  ownHttpStream(request, { cancel: () => closeSource(true), settled: settled.promise });
+  if (descriptor.lifetimeMs !== undefined && !closing) {
     lifetime = setTimeout(() => {
       lifetimeExpired = true;
       operationAbort.abort(new Error("Stream lifetime expired"));
@@ -900,12 +959,14 @@ function contractStreamResponse(request, context, source, descriptor, operationA
     lifetime.unref?.();
   }
   const frames = async function* () {
-    const iterator = source[Symbol.asyncIterator]();
+    if (closing)
+      return;
     const aborted = waitForAbort(operationAbort.signal);
     let terminalSeen = descriptor.terminal === undefined;
     try {
       for (;; ) {
-        const next = await Promise.race([iterator.next(), aborted]);
+        pendingNext = Promise.resolve(iterator.next());
+        const next = await Promise.race([pendingNext, aborted]);
         if (next.done)
           break;
         const parsed = descriptor.item.safeParse(next.value);
@@ -951,10 +1012,7 @@ function contractStreamResponse(request, context, source, descriptor, operationA
     } finally {
       if (lifetime !== undefined)
         clearTimeout(lifetime);
-      operationAbort.abort();
-      Promise.resolve(iterator.return?.(undefined)).catch(() => {
-        return;
-      });
+      closeSource();
     }
   };
   const route = streamingRoute({

package/dist/{index-w0445741.js → index-hvftzz91.js}

@@ -8,7 +8,7 @@ import {
 } from "./index-8eywc9zv.js";
 import {
   ShutdownOptionsSchema
-} from "./index-7wpgrqa8.js";
+} from "./index-3z73fh2c.js";
 import {
   AppError
 } from "./index-0w9abg87.js";

package/dist/node.js

@@ -5,7 +5,7 @@ import {
   createHandler,
   createSocketIOServer,
   createUnixClientTransport
-} from "./index-c97p90dc.js";
+} from "./index-cx84zg25.js";
 import {
   createImplement,
   createImplementRegistry,
@@ -23,7 +23,7 @@ import {
   ShutdownStateSchema,
   ShutdownStatusSchema,
   createServerLifecycle
-} from "./index-7wpgrqa8.js";
+} from "./index-3z73fh2c.js";
 import"./index-nt1mp8km.js";
 import"./index-vj3vvpaa.js";
 import {

package/dist/server/contract-stream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract-stream.d.ts","sourceRoot":"","sources":["../../src/server/contract-stream.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,aAAa,CAAC;AAGrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAiB/C,gEAAgE;AAChE,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAC9B,UAAU,EAAE,wBAAwB,EACpC,cAAc,EAAE,eAAe,GAC9B,OAAO,CAAC,QAAQ,CAAC,CA6FnB"}
+{"version":3,"file":"contract-stream.d.ts","sourceRoot":"","sources":["../../src/server/contract-stream.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,aAAa,CAAC;AAQrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAiB/C,gEAAgE;AAChE,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAC9B,UAAU,EAAE,wBAAwB,EACpC,cAAc,EAAE,eAAe,GAC9B,OAAO,CAAC,QAAQ,CAAC,CAoHnB"}

package/dist/server/http-stream-lifetime.d.ts

@@ -0,0 +1,19 @@
+/** Request identity stays native: cloning it would break runtime timeout/upgrade APIs. */
+interface StreamLifetime {
+    cancel(): void;
+    settled: Promise<void>;
+}
+/** Abort-aware I/O may reject with the signal reason or wrap it as its cause. */
+export declare function isStreamCancellation(error: unknown, signal: AbortSignal): boolean;
+/** Internal bridge between Fetch-clean streaming routes and their managed server. */
+export declare function ownHttpStream(request: Request, stream: StreamLifetime): void;
+export declare function settleStreamCleanup(operations: readonly Promise<unknown>[]): Promise<void>;
+export declare function createHttpStreamTracker(): {
+    bind(request: Request, onComplete: () => void): () => void;
+    readonly pendingRequests: number;
+    cancel(): void;
+    assertClean: () => void;
+    drain(): Promise<void>;
+};
+export {};
+//# sourceMappingURL=http-stream-lifetime.d.ts.map

package/dist/server/http-stream-lifetime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-stream-lifetime.d.ts","sourceRoot":"","sources":["../../src/server/http-stream-lifetime.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,UAAU,cAAc;IACtB,MAAM,IAAI,IAAI,CAAC;IACf,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAQD,iFAAiF;AACjF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAMjF;AAED,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,GAAG,IAAI,CAE5E;AAED,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,SAAS,OAAO,CAAC,OAAO,CAAC,EAAE,GACtC,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,wBAAgB,uBAAuB;kBAWrB,OAAO,cAAc,MAAM,IAAI,GAAG,MAAM,IAAI;8BAkCnC,MAAM;;;;EAehC"}

package/dist/server/index.js

@@ -13,7 +13,7 @@ import {
   sseRoute,
   streamingRoute,
   webSocketLane
-} from "../index-c97p90dc.js";
+} from "../index-cx84zg25.js";
 import {
   composeAuthHooks,
   createAuthHook,
@@ -60,7 +60,7 @@ import {
   ShutdownStateSchema,
   ShutdownStatusSchema,
   createServerLifecycle
-} from "../index-7wpgrqa8.js";
+} from "../index-3z73fh2c.js";
 import {
   jsonSchemaFields,
   toJsonSchema

package/dist/server/shutdown.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shutdown.d.ts","sourceRoot":"","sources":["../../src/server/shutdown.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,eAAO,MAAM,mBAAmB;;;;;;;EAO9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,qBAAqB;;;;;;iBAehC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;iBAM/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;iBAY/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB,CAAC,QAAQ;IAC3C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,eAAe,IAAI,MAAM,CAAC;IAC1B,iBAAiB,IAAI,MAAM,CAAC;IAC5B,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED,UAAU,eAAe;IACvB,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAC1E,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC9D;AAoFD,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,eAAe,GAAG,eAAe,CAiKxF"}
+{"version":3,"file":"shutdown.d.ts","sourceRoot":"","sources":["../../src/server/shutdown.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,eAAO,MAAM,mBAAmB;;;;;;;EAO9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,qBAAqB;;;;;;iBAehC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;iBAM/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;iBAY/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB,CAAC,QAAQ;IAC3C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,eAAe,IAAI,MAAM,CAAC;IAC1B,iBAAiB,IAAI,MAAM,CAAC;IAC5B,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED,UAAU,eAAe;IACvB,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAC1E,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC9D;AAoFD,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,eAAe,GAAG,eAAe,CA4KxF"}

package/dist/server/streaming-route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"streaming-route.d.ts","sourceRoot":"","sources":["../../src/server/streaming-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAEzD,uFAAuF;AACvF,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,OAAQ,CAAC;AAEjD,MAAM,WAAW,qBAAqB,CAAC,OAAO,GAAG,OAAO;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,MAAM,CAAC,EAAE,UAAU,GAAG,KAAK,CAAC;IAC5B,sCAAsC;IACtC,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;OAOG;IACH,MAAM,EAAE,CACN,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,sBAAsB,CAAC,OAAO,CAAC,KACrC,aAAa,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,sBAAsB,CAAC,OAAO,GAAG,OAAO,CAAE,SAAQ,eAAe,CAAC,OAAO,CAAC;IACzF,4EAA4E;IAC5E,MAAM,EAAE,WAAW,CAAC;CACrB;AAiGD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,GAAG,OAAO,EAC9C,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC,GACtC,QAAQ,CAAC,OAAO,CAAC,CAiNnB;AAED,uFAAuF;AACvF,wBAAgB,WAAW,CAAC,OAAO,GAAG,OAAO,EAC3C,OAAO,EAAE,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,GACtD,QAAQ,CAAC,OAAO,CAAC,CAEnB;AAED,gFAAgF;AAChF,wBAAgB,QAAQ,CAAC,OAAO,GAAG,OAAO,EACxC,OAAO,EAAE,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,GACtD,QAAQ,CAAC,OAAO,CAAC,CAEnB"}
+{"version":3,"file":"streaming-route.d.ts","sourceRoot":"","sources":["../../src/server/streaming-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAOrD,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAEzD,uFAAuF;AACvF,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,OAAQ,CAAC;AAEjD,MAAM,WAAW,qBAAqB,CAAC,OAAO,GAAG,OAAO;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,MAAM,CAAC,EAAE,UAAU,GAAG,KAAK,CAAC;IAC5B,sCAAsC;IACtC,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;OAOG;IACH,MAAM,EAAE,CACN,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,sBAAsB,CAAC,OAAO,CAAC,KACrC,aAAa,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,sBAAsB,CAAC,OAAO,GAAG,OAAO,CAAE,SAAQ,eAAe,CAAC,OAAO,CAAC;IACzF,4EAA4E;IAC5E,MAAM,EAAE,WAAW,CAAC;CACrB;AAiGD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,GAAG,OAAO,EAC9C,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC,GACtC,QAAQ,CAAC,OAAO,CAAC,CA4OnB;AAED,uFAAuF;AACvF,wBAAgB,WAAW,CAAC,OAAO,GAAG,OAAO,EAC3C,OAAO,EAAE,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,GACtD,QAAQ,CAAC,OAAO,CAAC,CAEnB;AAED,gFAAgF;AAChF,wBAAgB,QAAQ,CAAC,OAAO,GAAG,OAAO,EACxC,OAAO,EAAE,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,GACtD,QAAQ,CAAC,OAAO,CAAC,CAEnB"}

package/dist/testing.js

@@ -4,7 +4,7 @@ import {
 } from "./index-x1th9s8c.js";
 import {
   createApplication
-} from "./index-w0445741.js";
+} from "./index-hvftzz91.js";
 import"./index-2k4yrqkc.js";
 import"./index-8eywc9zv.js";
 import {
@@ -12,7 +12,7 @@ import {
   RealtimeRequestInvalidAcknowledgementError,
   RealtimeRequestTimeoutError
 } from "./index-7b188kmz.js";
-import"./index-7wpgrqa8.js";
+import"./index-3z73fh2c.js";
 import {
   mcpProjectionCandidate,
   prepareProjectedMcpTools,

package/llms-full.txt

@@ -960,8 +960,11 @@ const result = await server.shutdown({
 })
 ```
 
-The first call closes HTTP and Socket.IO admission, then gives admitted HTTP/application work the
-full `gracePeriodMs` budget. Once that work drains, `realtimeCloseTimeoutMs` (default `1_000`)
+The first call closes HTTP and Socket.IO admission and cancels owned contract streams and
+`streamingRoute` / `ndjsonRoute` / `sseRoute` sources. Their supplied `signal` is the lifetime:
+waiting producers must honour it, and their iterator cleanup must finish. No separate application
+abort controller or copied shutdown loop is required. Admitted finite HTTP/application work and
+stream cleanup share the full `gracePeriodMs` budget. Once that work drains, `realtimeCloseTimeoutMs` (default `1_000`)
 bounds WebSocket close handshakes inside the same outer deadline. Any upgraded sockets still open
 at that boundary are terminated without shortening HTTP grace, and graceful runtime shutdown
 continues. If the outer grace budget or external signal forces destructive teardown,
@@ -970,11 +973,18 @@ the first options win. New
 ordinary HTTP work receives `503`, `Retry-After` and `Connection: close` outside
 `wrapFetch`. `result.outcome` is `clean` or `forced`; a forced result preserves
 the pending snapshot and reason while final pending counters describe the
-post-close transport state. `forcedWebSockets` counts both sockets terminated at the dedicated
+post-close transport state and any still-owned stream cleanup. A streaming request increments
+`completedRequests` only after its source cleanup settles, not when its `Response` is returned.
+`abortedRequests` counts requests pending at outer force, not subscriptions closed cooperatively
+during grace. `forcedWebSockets` counts both sockets terminated at the dedicated
 realtime bound and sockets terminated by outer force; `pendingWebSocketsAtForce` is only the latter
 snapshot, so a clean result can truthfully report a bounded realtime termination. A graceful phase error still runs forced cleanup and
 then rejects with the original error; a forced transport that cannot confirm
-completion before `forceTimeoutMs` rejects instead of reporting a false zero.
+completion before `forceTimeoutMs` rejects instead of reporting a false zero. An uncooperative
+stream stays pending even if its connection is gone; a cleanup error rejects shutdown.
+Standalone `createHandler` and arbitrary raw `Response` bodies have no managed source ownership:
+their embedding host/producer owns cancellation. Request identity must be retained by `wrapFetch`
+when forwarding to owned streaming routes; it is also required by native timeout/upgrade APIs.
 `runtime` is a diagnostics escape hatch, not a second canonical stop path.
 
 ### Trusted HTTPS in development
@@ -4538,6 +4548,61 @@ boundary, validate with the exported schema, and write only the current
 version. Core deliberately does not guess an application's database migration
 or silently accept an unknown future version.
 
+### Purging a conversation
+
+```ts
+import { purgeAgentConversation } from 'stitchkit/agent-runtime';
+
+const result = await purgeAgentConversation(store, {
+  conversationId,
+  expectedVersion: snapshot.version, // optional stale-intent protection
+});
+```
+
+The optional `AgentRuntimeStore.purgeConversation` capability is implemented by the memory and
+initialized Bun/Node SQLite stores. The helper returns `unsupported` for stores without it; it
+never pretends deletion succeeded. Other outcomes are `purged`, `already_purged`,
+`active` (with `runIds`), or `conflict` (with `actualVersion`). Storage failures reject.
+
+Purge refuses queued, running and interrupt-requested runs. It does not interrupt, force-abandon
+or wait for a provider. Authorize the destructive request in the host, close its conversation
+ingress/attachments, then settle runs through normal interruption or explicitly justified recovery.
+Retry purge after they are terminal. An optional expected version must match the current snapshot;
+a version conflict requires a fresh deletion decision, not blind retry with a new version.
+
+Successful purge atomically removes messages (including compacted inactive rows), all runs and
+retained terminal assistants, admissions/idempotency receipts, conversation heads and their owned
+indexes. It retains only a permanent conversation-ID tombstone. Purging an unknown ID reserves it
+as well, so a submit paused before admission cannot create it later. Repeating the call returns
+`already_purged`, regardless of the original expected version. A lost response is safely retried
+with the same ID; **new chats require a new ID**.
+
+Every later runtime mutation rejects with `AgentConversationPurgedError`, including fresh and
+duplicate admissions, checkpoints, recovery and compaction. Existing controller leases grant no
+exception. Existing reads return empty snapshots, absent runs and empty message pages; purged
+conversations disappear from the SQLite catalog and recovery scans. Snapshots retain their
+existing empty `version: 0` shape; use the purge result, not an empty snapshot, as deletion evidence.
+
+SQLite commits the tombstone and all deletions in one `BEGIN IMMEDIATE` transaction. Failure before
+commit rolls everything back; reopen/recovery cannot restore committed deleted records. Same-thread
+connection contention rejects promptly without effects; retry after the competing operation settles.
+Initialization adds the tombstone table and write guards to schema v1 transactionally, without
+changing application tables or `user_version`. Guards also fence older writers. `initialize: false`
+on an original v1 database does not add purge capability; open an initialized writer first.
+
+Consumer-owned model selections, projections, attachment files, delivery/outbox records and event
+logs remain outside this boundary. Retain an authorized cleanup intent plus any needed opaque file
+references in consumer storage, purge first, then retry idempotent consumer cleanup. Invalidate local
+caches/subscriptions so an old delivered event cannot repopulate a UI. The library never traverses
+paths, revokes remote artifacts or claims a cross-store transaction. Nor does logical purge securely
+wipe database free pages, WAL or backups. Memory tombstones last only for that store instance.
+
+Custom normalized drivers may opt in through `AgentConversationPurgeDriver` on `driver.conversations`.
+Their transaction must serialize `isPurged`, head/active-run checks, `remove`, and **all** mutations
+for the same ID, including absent-ID admission. An optimistic head CAS alone is insufficient. `remove`
+must delete every owned payload/index and preserve the tombstone; errors must roll back the entire
+transaction. Drivers without this guarantee must leave the capability absent. See ADR 0138.
+
 ## Events and reconnect
 
 `publish` receives event classes with different guarantees:
@@ -5219,6 +5284,12 @@ try {
 `release()` is idempotent. Admission and counter increment are atomic, so work
 cannot slip between the shutdown check and drain accounting.
 
+`managedServerResource` already owns contract/streaming-route response lifetimes. It cancels
+their supplied signals at admission close and awaits source cleanup before dependent resources
+close. Do not add application admission leases or a second cancellation registry for those
+streams. A source that ignores cancellation or fails its cleanup prevents a clean shutdown;
+the existing grace and force budgets still bound the result.
+
 ### Bounded operation admission
 
 Compose `createBoundedAdmission` when accepted work also competes for a finite
@@ -11943,7 +12014,7 @@ Also re-exports the error helpers from `stitchkit/contract`.
 | `BunServerHandle` | _type_ | managed Bun handle (`url`, `port`, `runtime`, `status`, `shutdown`) |
 | `ManagedServerHandle` | _type_ | shared lifecycle shape generic over the runtime escape hatch |
 | `ShutdownOptionsSchema` / `ShutdownOptions` | schema / _type_ | HTTP/application grace, a separate WebSocket close-handshake bound, bounded forced-completion timeout, retry hint and optional external abort signal |
-| `ShutdownStatusSchema` / `ShutdownStatus` | schema / _type_ | live state and request/WebSocket counters |
+| `ShutdownStatusSchema` / `ShutdownStatus` | schema / _type_ | live state and request/WebSocket counters; owned streams remain pending through source cleanup |
 | `ShutdownResultSchema` / `ShutdownResult` | schema / _type_ | clean/forced result with final counters, outer-force snapshots and `forcedWebSockets` including bounded realtime terminations |
 | `ShutdownStateSchema` / `ShutdownState` | schema / _type_ | managed lifecycle state machine |
 | `ServiceDef` | _type_ | the result of `implement` |
@@ -12302,6 +12373,11 @@ Server-only optional application runtime. See the
 | `AgentHistoryMutationSchema` | schema | typed canonical message mutation applied inside the winning state transaction |
 | `RecoverAgentRunSchema` | schema | explicit abandon/requeue recovery decision; acquired runs require replay-safe evidence |
 | `createMemoryAgentRuntimeStore` | function | process-local reference adapter, not production durability |
+| `purgeAgentConversation` | function | dispatch optional atomic deletion; returns `unsupported`, `active`, `conflict`, `purged` or `already_purged` |
+| `AgentConversationPurgeInputSchema` / `AgentConversationPurgeInput` | schema / _type_ | conversation ID and optional expected snapshot version |
+| `AgentConversationPurgeResultSchema` / `AgentConversationPurgeResult` | schema / _type_ | typed deletion/refusal outcomes; active refusal includes run IDs |
+| `AgentConversationPurgedError` | class | runtime mutation rejected because its conversation ID is permanently purged |
+| `AgentConversationPurgeDriver` | _type_ | optional `driver.conversations` capability: serialized tombstone read and atomic removal of all owned records |
 | `projectAgentHistory` | function | asynchronously project canonical records and resolved multimodal files into provider-valid AI SDK messages |
 | `defineModelRegistry` | function | typed language-model descriptors, capabilities and provider construction |
 | `AgentModelCatalogSchema` / `AgentModelCatalog` | schema / _type_ | provider-neutral complete/partial model catalog with separately sourced popularity, metrics, prices and observation time |
@@ -12403,6 +12479,12 @@ neither grows with the length of the conversation, and neither needs anything ne
 conversation — that is what the store's reducer validates against, and what the runtime builds a
 prompt from (→ ADR 0112).
 
+`AgentRuntimeStore.purgeConversation` is optional; `purgeAgentConversation(store, input)` explicitly
+handles unsupported stores. Official memory and initialized SQLite stores refuse active runs,
+remove every owned payload and reserve the conversation ID permanently. Empty snapshots are not
+deletion receipts. Consumer metadata, files, event logs and UI cache invalidation remain outside
+the transaction. See [purging a conversation](../guide/agent-runtime.md#purging-a-conversation).
+
 Store command/result exports are `AcceptInputAndAssignRun`, `AcceptInputAndAssignRunSchema`,
 `AcquireAgentRun`, `AcquireAgentRunSchema`, `CheckpointRunAssistant`,
 `CheckpointRunAssistantSchema`, `CommitRunTerminal`, `CommitRunTerminalSchema`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stitchkit",
-  "version": "0.70.4",
+  "version": "0.70.6",
   "description": "Contract-first backend framework — one defineContract() into an HTTP API, MCP tools, AI-agent tools and a typed client. Bun and Node.",
   "keywords": [
     "bun",