stitchkit 0.71.0 → 0.72.1

package/llms-full.txt

@@ -48,6 +48,7 @@ own, recorded as an ADR.
 |--------|--------|----------|-------|
 | `stitchkit` | browser **and** server | stable | `defineContract`, `createClient`, `createHttpClient`, `createSocketIOClient`, `parseSSE`, the error model |
 | `stitchkit/contract` | browser **and** server | stable | the contract layer alone — `defineContract`, errors, pagination |
+| `stitchkit/primitives` | browser **and** server | evolving | generic values and declarations for lifecycle, access, audit, delivery and exports |
 | `stitchkit/server` | server (Bun) | stable | `createServer`, `implement`, hooks, auth, Socket.IO server, server primitives |
 | `stitchkit/node` | server (Node ≥ 22) | stable | `serveNode` + the runtime-agnostic core — the Node mirror of `/server` |
 | `stitchkit/tools` | server | stable | `createMcpHandler`, `mountMcp`, `mountAgent`, the OAuth provider, native tools |
@@ -60,7 +61,7 @@ own, recorded as an ADR.
 | `stitchkit/testing` | tests on Bun or Node | stable | in-process generated clients over a real Fetch handler, plus the store and managed-resource conformance kits |
 | `stitchkit/declaration` | build and deployment tooling (Bun or Node) | evolving | `ProjectDeclarationSchema` — the one machine-readable statement a repository makes about itself |
 | `stitchkit/react` | browser | stable | `createCursorQuery`, `createCacheBridge` |
-| `stitchkit/agent-runtime` | server | evolving<br>_redefined in 10 of the 16 minors since 0.56.2, most recently 0.69.0_ | optional durable conversation/run loop, history, models, prompts, fencing and events |
+| `stitchkit/agent-runtime` | server | evolving<br>_redefined in 10 of the 17 minors since 0.56.2, most recently 0.69.0_ | optional durable conversation/run loop, history, models, prompts, fencing and events |
 | `stitchkit/agent-runtime/harness` | server | evolving | resource-aware process-local facade over the canonical Agent runtime; supervision stays outside |
 | `stitchkit/agent-runtime/coding-tools` | server (Bun or Node) | evolving | bounded host-authorized direct file and shell tools; a root boundary, not an OS sandbox |
 | `stitchkit/agent-runtime/openrouter` | server | evolving | isolated OpenRouter language-model adapter |
@@ -68,7 +69,7 @@ own, recorded as an ADR.
 | `stitchkit/agent-runtime/sqlite/bun` | server (Bun) | evolving | durable built-in SQLite store for the agent runtime |
 | `stitchkit/agent-runtime/sqlite/node` | server (Node ≥ 22.5) | evolving | durable built-in SQLite store for the agent runtime |
 | `stitchkit-tui` | terminal (Bun) | evolving | optional official OpenTUI host over a caller-composed headless runtime |
-| `stitchkit/application` | server | evolving<br>_redefined in 3 of the 16 minors since 0.56.2, most recently 0.67.0_ | managed resource graph, readiness, admission, schedules and bounded shutdown |
+| `stitchkit/application` | server | evolving<br>_redefined in 4 of the 17 minors since 0.56.2, most recently 0.72.0_ | managed resource graph, readiness, admission, schedules and bounded shutdown |
 | `stitchkit/application/grammy` | server | evolving | isolated grammY polling and webhook lifecycle adapters |
 | `stitchkit/application/opentelemetry` | server | evolving | maps application snapshots onto an injected OpenTelemetry `Meter` |
 
@@ -2565,6 +2566,49 @@ Set `finalLine: 'require-newline'` when the final newline is part of the
 protocol's truncation proof. The default `allow` continues to accept one valid
 final JSON document without a newline.
 
+## Resumable streams
+
+A stream that survives a dropped connection needs four things beyond opening it:
+re-open, back off before retrying, resume from where it stopped rather than
+restart, and stop for good on a terminal item. `resumableIterator` owns those
+four; your code keeps every decision that is about your data.
+
+```ts
+import { resumableIterator } from 'stitchkit'
+
+for await (const event of resumableIterator<Event, string>({
+  async open(cursor) {
+    const url = cursor ? `/api/events?after=${cursor}` : '/api/events'
+    return parseNDJSON(await fetch(url, { signal }))
+  },
+  advance: (event) => event.id,          // what "where it stopped" means
+  isTerminal: (event) => event.done,     // which item ends the stream
+  retry: { minDelayMs: 500, maxDelayMs: 30_000, jitter: 0.5 },
+  signal,
+  onAttempt: ({ number, delayMs, error }) => log.warn({ number, delayMs, error }),
+})) {
+  render(event)
+}
+```
+
+`open` receives the cursor produced by the last **delivered** item, so a source
+that fails after three items re-opens after the third, not from the beginning.
+A source that simply ends without a terminal item is treated as a dropped
+connection — that is the case a hand-written loop usually mistakes for
+completion, and it is why the stream stops resuming.
+
+**Jitter is not a detail.** Without it every consumer that lost the same server
+retries at the same instant and the fleet arrives together on a server that has
+just come back. The randomisation only ever *shortens* a delay, so `maxDelayMs`
+stays a real ceiling. `createBackoff({ minDelayMs, maxDelayMs, jitter })` is the
+same policy as a standalone value — `next()` and `reset()` — when you need the
+delays without the iterator.
+
+A delivered item resets the backoff, so a stream that reconnects, works for an
+hour and drops again starts its next retry at `minDelayMs` rather than the
+ceiling it reached last time. Aborting the signal ends the iteration promptly,
+including in the middle of a wait.
+
 
 ==============================================================================
 # Guide: MCP & agents  (docs/guide/mcp-and-agents.md)
@@ -5609,6 +5653,110 @@ retry rules do **not** disappear. They were never process-local glue and remain
 application-owned.
 
 
+==============================================================================
+# Guide: Generic application primitives  (docs/guide/primitives.md)
+==============================================================================
+
+---
+title: Generic application primitives
+description: Declare lifecycle, access, exact values, audit, delivery and exports without moving application infrastructure into Stitchkit.
+type: guide
+status: active
+created: 2026-09-01
+updated: 2026-09-01
+---
+
+# Generic application primitives
+
+`stitchkit/primitives` is an optional browser-safe leaf. It declares values and policies; it does
+not own a database, transaction, scheduler, durable queue, transport or document generator.
+
+## Lifecycle and access
+
+```ts
+import { defineLifecycle, defineOwnerScope, definePermissionMatrix } from 'stitchkit/primitives';
+import { z } from 'zod';
+
+const lifecycle = defineLifecycle({
+  name: 'document',
+  states: ['draft', 'published'],
+  roles: ['author'],
+  transitions: {
+    publish: {
+      from: 'draft',
+      to: 'published',
+      by: ['author'],
+      payload: z.object({ note: z.string() }),
+    },
+  },
+});
+
+const permissions = definePermissionMatrix({
+  roles: ['reader', 'author'],
+  operations: ['read', 'publish'],
+  grants: {
+    reader: { read: true, publish: false },
+    author: { read: true, publish: true },
+  },
+});
+```
+
+Persist `transition(...).event` in the same application transaction as the next state. A state is
+an immutable branded value; `transition()` produces the next one. `availableTransitions()` and
+`transition()` read the same declaration.
+
+`defineOwnerScope` resolves one owner from authenticated identity. Reading across owners is a
+separate `acrossAllOwners(identity)` call and permission. Pass the resulting branded `OwnerScope`
+to the data adapter. This proves the scope was explicit; Stitchkit cannot prove what SQL an
+arbitrary adapter emits. `scanOwnerFilterRisks` maps existing caller-named manual filters before a
+migration.
+
+## Exact values and deadlines
+
+`defineMoney(currency)` stores integer minor units as a JSON string. Arithmetic keeps the currency
+literal in the type; division and rational shares return an explicit remainder. It does not own
+exchange rates.
+
+`defineUnitSystem` stores exact canonical decimal strings. Every conversion is an application
+rational with an id. A converted `QuantityProjection` is `derived` and carries both its source and
+conversion id; a form/database value can be marked `recorded`. Whether a derived projection is
+persisted or recomputed is an application decision.
+
+`defineDeadlinePolicy` requires an explicit `now`, IANA timezone and elapsed/calendar-day boundary.
+It returns the due instant, signed remaining days, overdue days and caller-owned category key.
+`queryBoundary(now)` returns instants suitable for a data-adapter predicate; reminders and
+escalations are not included.
+
+## Audit and delivery
+
+Put an audit decision beside each operation:
+
+```ts
+meta: { audit: audit.record(z.object({ changed: z.array(z.string()) })) }
+// or
+meta: { audit: audit.omit('read-only projection') }
+```
+
+`assertAuditDeclared(contract)` refuses silence. `createAuditRecord()` validates the change and
+returns a `DomainEvent`; the same id/value can feed both the journal and delivery.
+
+`defineDomainEventDelivery().plan(event)` is pure. Save that event and its destinations in the
+application's transaction. After commit, call `dispatch(event.id)`: the dispatcher accepts only an
+id and obtains actual work from `DomainEventOutbox.claim`. A transport returns `delivered`,
+`retryable`, `terminal` or `unknown`; the dispatcher calls the matching outbox transition. Only
+`retry` may schedule another claim, while `unknown` is held for inspection instead of guessed into
+a retry. The application owns retention and scheduling. There is deliberately no scheduler or
+distributed lease.
+
+## Exports
+
+`defineExportOperation` supplies one input and one result schema to an ordinary contract endpoint.
+A small result can be `ready` with a `ManagedFileRef`; a larger result can be `pending` with the id
+of the application's existing async operation. The input, scope, metadata and tool identity do not
+change. The application creates bytes and owns operation persistence; the managed-file boundary
+streams them.
+
+
 ==============================================================================
 # Guide: Application migration recipes  (docs/guide/application-migration-recipes.md)
 ==============================================================================
@@ -9293,6 +9441,69 @@ additive** — adopting it changes nothing in your code. (See
 So upgrading is: read the `### ⚠️ Breaking changes` of every version *above* your
 current one *up to* your target, and apply each snippet.
 
+## What your range does, and does not, do for you
+
+A caret range (`"stitchkit": "^0.71.0"`) is a real gate: it resolves `< 0.72.0`,
+so a plain `install` picks up every patch — fixes, new API, no code changes —
+and **never** crosses a minor. Crossing one is always something you chose.
+
+**An exact pin (`"stitchkit": "0.71.0"`) is a different arrangement, and it is
+easy to mistake for a safer version of the same one.** It does not opt you out
+of breaking changes; it opts you out of *every* change, patches included. No
+install will move you, nothing will warn you, and the gap grows quietly — a
+project pinned exactly for a few months is typically several minors behind and
+has had no signal at all that this is so. That is a legitimate choice, but it
+makes one thing your job rather than the resolver's:
+
+- **Check deliberately.** `npm view stitchkit version` against your pin, on
+  whatever cadence suits the project. Nothing else will raise it.
+- **Then upgrade across the whole gap at once**, exactly as below: apply the
+  `### ⚠️ Breaking changes` of every version above your pin up to your target,
+  in order. A pin held across four minors is four migrations, not one, and
+  three of them may be a single snippet each.
+
+The mechanical part is identical either way. Only the *noticing* differs, and an
+exact pin moves it onto you.
+
+## Released migration: 0.72.0
+
+Nothing you *pass* changed. Both items are about types you read or build, and
+both stop the compiler rather than surprising you at runtime.
+
+### If you read `perKey` off `BoundedAdmissionPolicy`
+
+`perKey` is now a union: the flat ceiling it always was, or `{ maxKeys, limits }`
+where the ceiling is resolved from the key. Declaring one is unchanged; reading
+one needs a narrowing.
+
+```ts
+// before
+const ceiling = policy.perKey?.maxConcurrent
+
+// after
+const ceiling =
+  policy.perKey && !('limits' in policy.perKey) ? policy.perKey.maxConcurrent : undefined
+```
+
+A shape carrying members of both branches — `{ maxKeys, maxConcurrent, limits }` —
+is refused at construction. It does *not* fail to typecheck: an excess-property
+check against a union admits any property some member declares, so this one is
+caught by `createBoundedAdmission`, not by `tsc`.
+
+### If you build a snapshot or a status by hand
+
+`CreditWindowSnapshot` gained `waiting` (producers parked in the new waiting
+`acquire`) and `DiagnosticJournalStatus` gained `lock`. Both are produced by the
+framework, so reading them is unaffected — but a test double stops compiling:
+
+```ts
+// before
+const snapshot: CreditWindowSnapshot = { state: 'open', capacityBytes: 100, /* … */ }
+
+// after
+const snapshot: CreditWindowSnapshot = { state: 'open', capacityBytes: 100, /* … */ waiting: 0 }
+```
+
 ## Released migration: 0.71.0
 
 The Agent coding tools. Two of the three changes are visible to the compiler;
@@ -12020,6 +12231,8 @@ The browser-and-server entrypoint. Re-exports everything from
 | `createRetainedTopics` | function | retained last-value store for sticky events — [guide](../guide/realtime.md#sticky-events) |
 | `parseSSE` | function | parse an SSE `Response` into an async generator — [guide](../guide/client.md#sse) |
 | `parseNDJSON` | function | parse bounded fatal-UTF-8 NDJSON; blank keep-alives are skipped and `finalLine: 'require-newline'` can make the delimiter mandatory — [guide](../guide/client.md#ndjson) |
+| `resumableIterator` | function | re-open a long-lived stream from the last delivered cursor, with jittered backoff, a caller-owned terminal item and prompt abort — [guide](../guide/client.md#resumable-streams) |
+| `createBackoff` | function | exponential backoff with subtractive jitter as a value: `next()` / `reset()` |
 | `ContractStreamFrameSchema` / `ContractStreamFrame` | schema / _type_ | default on-the-wire `data` / safe `error` / `end` envelope of a contract-first stream |
 | `ContractStreamFraming` / `ContractStreamCompletion` | _types_ | opt-in item-vs-envelope framing and terminal-vs-stream-end completion policies |
 | `StreamFinalLinePolicy` | _type_ | permissive or newline-required final NDJSON line policy |
@@ -12063,6 +12276,10 @@ The browser-and-server entrypoint. Re-exports everything from
 | `RetainedTopics` | _type_ | the `createRetainedTopics` handle |
 | `ParseSSEOptions` | _type_ | options for `parseSSE` |
 | `ParseNDJSONOptions` | _type_ | options for `parseNDJSON` |
+| `BackoffPolicySchema` / `BackoffPolicy` | schema / _type_ | `minDelayMs`, `maxDelayMs` and a `0`–`1` jitter fraction; a ceiling below the floor is refused |
+| `Backoff` | _type_ | the backoff handle returned by `createBackoff` |
+| `ResumableIteratorConfig` | _type_ | caller-owned `open` / `advance` / `isTerminal`, retry policy, abort signal and `onAttempt` observer |
+| `ResumableAttempt` | _type_ | attempt number, the delay about to be waited and the error that caused it |
 
 ### Trace (client)
 
@@ -12174,6 +12391,51 @@ from the root `stitchkit`.
 
 ---
 
+## `stitchkit/primitives`
+
+Browser-and-server-safe declarations for facts an application wants to define once. See the
+[primitives guide](../guide/primitives.md). Storage, transactions, data-adapter predicates,
+schedules, transports and file generation remain application-owned.
+
+| Export | Kind | Summary |
+|--------|------|---------|
+| `defineLifecycle` | function | immutable finite-state transition declaration, role/payload validation, available-action projection and transition event |
+| `LifecycleState` / `LifecycleTransitionDefinition` / `LifecycleDefinition` | _types_ | branded state value and the declaration inferred from application strings |
+| `LifecycleTransitionInput` / `LifecycleTransitionResult` / `LifecycleTransitionSuccess` / `LifecycleTransitionFailure` | _types_ | typed execution input and distinct transition/state, role and payload outcomes |
+| `LifecycleTransitionEventSchema` / `LifecycleTransitionEvent` | schema / _type_ | canonical event returned for application-atomic persistence |
+| `defineOwnerScope` | function | resolve one owner from identity or require the explicit `acrossAllOwners` capability |
+| `OwnerScope` / `OwnerScopeDefinition` / `OwnerScopeResolution` | _types_ | branded adapter input and its resolved/refused outcomes |
+| `definePermissionMatrix` | function | exhaustive role × operation decisions with server check and client capability projection |
+| `PermissionGrantMatrix` / `PermissionCheckResult` | _types_ | compile-time complete matrix and unknown/allowed/denied runtime result |
+| `defineMoney` / `createMoneySchema` | functions | fixed-currency JSON-safe minor-unit value and Zod schema |
+| `addMoney` / `subtractMoney` / `multiplyMoney` / `shareMoney` / `splitMoney` | functions | exact same-currency arithmetic with explicit indivisible remainder |
+| `Money` / `MoneyShare` / `MoneySplit` | _types_ | currency-literal value and remainder-bearing operation results |
+| `defineUnitSystem` / `createQuantitySchema` / `addQuantity` | functions | exact decimal quantities and caller-declared finite conversions |
+| `Quantity` / `UnitConversion` / `QuantityProjection` | _types_ | unit-literal value, rational conversion and recorded/derived provenance |
+| `QuantityProjectionSchema` | schema | transport-safe recorded/derived quantity union |
+| `defineDeadlinePolicy` | function | elapsed- or calendar-day projection with explicit timezone, threshold, current time and caller category keys |
+| `DeadlineResultSchema` / `DeadlineResult` | schema / _type_ | due instant, remaining/overdue days and projected category |
+| `audit` | constant | constructors for explicit `record(changeSchema)` or `omit(reason)` endpoint metadata |
+| `assertAuditDeclared` | function | refuse a contract operation with no audit decision |
+| `createAuditRecord` | function | validate one declared change and return the canonical event value |
+| `AuditPolicy` / `AuditRecordPolicy` / `AuditOmitPolicy` / `CreateAuditRecordInput` | _types_ | audit declaration and record input contracts |
+| `AuditRecordSchema` / `AuditRecord` | schema / _type_ | domain-event-shaped audit record |
+| `createDomainEventSchema` | function | wrap a typed payload in the canonical event envelope |
+| `DomainEventSchema` / `DomainEvent` | schema / _type_ | generic event with stable id, time, subject and optional actor |
+| `DomainEventActorSchema` / `DomainEventActor` | schema / _type_ | structured actor identity and application role |
+| `DomainEventSubjectSchema` / `DomainEventSubject` | schema / _type_ | generic subject type/id pair |
+| `defineDomainEventDelivery` | function | plan routes and dispatch only application-outbox claims by committed event id |
+| `DomainEventDestinationSchema` / `DomainEventDestination` | schema / _type_ | transport-neutral destination identity |
+| `DomainEventDeliveryOutcomeSchema` / `DomainEventDeliveryOutcome` | schema / _type_ | delivered, retryable, terminal or unknown transport result |
+| `DomainEventDeliveryClaimSchema` / `DomainEventDeliveryClaim` | schema / _type_ | application-owned atomic outbox claim |
+| `DomainEventOutbox` / `DomainEventRoute` / `DomainEventTransport` | _types_ | host capabilities composed by process-local delivery |
+| `DomainEventDeliveryPlan` / `DomainEventDispatchResult` | _types_ | transaction input and bounded dispatch summary |
+| `defineExportOperation` / `createExportResultSchema` | functions | one typed contract operation returning a ready managed file or pending operation id |
+| `scanMoneyNumberRisks` / `scanOwnerFilterRisks` | functions | source-text migration diagnostics with caller-owned identifiers |
+| `SourceText` / `SourceRisk` | _types_ | migration scanner input and exact path/line evidence |
+
+---
+
 ## `stitchkit/server`
 
 Server-only. Builds and runs the HTTP server, and carries the server primitives.
@@ -12423,7 +12685,9 @@ cutovers are covered by the executable
 | Export | Kind | Summary |
 |--------|------|---------|
 | `createBoundedAdmission` | function | process-local no-queue global/per-key concurrency and rate leases, optionally composed with application admission |
-| `BoundedAdmissionPolicySchema` / `BoundedAdmissionPolicy` | schema / _type_ | finite global budget and optional finite per-key budget with `maxKeys` |
+| `BoundedAdmissionPolicySchema` / `BoundedAdmissionPolicy` | schema / _type_ | finite global budget and optional finite per-key budget with `maxKeys`, declared either as one flat ceiling or as a resolver — never both |
+| `BoundedAdmissionPerKeyLimitsSchema` / `BoundedAdmissionPerKeyLimits` | schema / _type_ | one key's resolved ceiling: `maxConcurrent` and optional `rate` |
+| `BoundedAdmissionPerKeyLimitResolver` | _type_ | `(key) => limits`, resolved on a key's first admission and cached until the key is evicted |
 | `BoundedRateBudgetSchema` / `BoundedRateBudget` | schema / _type_ | `{ limit, intervalMs }` monotonic sliding-window budget |
 | `BoundedAdmissionStateSchema` / `BoundedAdmissionState` | schema / _type_ | `accepting \| draining \| closed` |
 | `BoundedAdmissionRefusalReasonSchema` / `BoundedAdmissionRefusalReason` | schema / _type_ | exact local/upstream refusal vocabulary |
@@ -12450,6 +12714,8 @@ cutovers are covered by the executable
 | `createCreditWindow` | function | finite byte-credit lease window with exact once-only replenishment |
 | `CreditWindow` / `CreditWindowSnapshot` / `CreditWindowSnapshotSchema` | _type_ / schema | byte-credit handle and absolute accounting record |
 | `CreditAcquireResult` / `CreditLease` | _type_ | reasoned refusal or idempotently releasable byte-credit lease |
+| `CreditAcquireWaitOptions` | _type_ | `signal` / `timeoutMs` for the waiting `acquire` overload; absent budget waits until credit, close or abort |
+| `CreditWaitResult` / `CreditWaitRefusalReason` | _type_ | waiting-acquire outcome; `insufficient-credit` is absent by construction, `timed-out` and `aborted` replace it |
 
 ### Bounded diagnostic journal
 
@@ -12458,6 +12724,7 @@ cutovers are covered by the executable
 | `createDiagnosticJournal` | function | create one schema-owned FIFO JSONL writer with bounded retained memory, exclusive local path ownership and finite rotation |
 | `DiagnosticJournalConfig` / `DiagnosticJournal` | _type_ | owner schema/path/limits/failure observer and the synchronous `submit`, bounded-wait `flush`/`close`, status handle |
 | `DiagnosticJournalLimitsSchema` / `DiagnosticJournalLimits` | schema / _type_ | positive event, pending-item, pending-byte, file-byte and retained-file limits |
+| `DiagnosticJournalLockPolicySchema` / `DiagnosticJournalLockPolicy` | schema / _type_ | `refuse` (default) or `reclaim-stale`, which reclaims only a lock whose recorded owner is provably gone |
 | `DiagnosticJournalSubmitResultSchema` / `DiagnosticJournalSubmitResult` | schema / _type_ | accepted epoch/sequence or explicit invalid, oversized, capacity, closed or failed refusal |
 | `DiagnosticJournalStatusSchema` / `DiagnosticJournalStatus` | schema / _type_ | state, limits, exact admission/write/failure counters, pending ownership, rotations, partial tails and last safe sequences |
 | `DiagnosticJournalFrameSchema` / `DiagnosticJournalFrame` | schema / _type_ | version-1 JSONL frame carrying process epoch, contiguous accepted sequence and schema-validated JSON event |

package/llms.txt

@@ -12,6 +12,7 @@ Build with stitchkit: define a contract once, then `implement` it and serve it (
 - [MCP & agents](https://github.com/max-listov/stitchkit/blob/master/docs/guide/mcp-and-agents.md): contracts as MCP tools (createMcpHandler) and AI-agent tools (mountAgent); tool lifecycle, extend, identity
 - [Agent application runtime](https://github.com/max-listov/stitchkit/blob/master/docs/guide/agent-runtime.md): optional durable history, prompt/model composition, stream loop, coordination, fencing and events
 - [Managed application kernel](https://github.com/max-listov/stitchkit/blob/master/docs/guide/application-kernel.md): process-local resources, readiness, admission, schedules, projections and optional provider adapters
+- [Generic application primitives](https://github.com/max-listov/stitchkit/blob/master/docs/guide/primitives.md): lifecycle transitions, owner scope, permissions, exact money and quantities, deadlines, audit, delivery and exports — declared, not persisted
 - [Application migration recipes](https://github.com/max-listov/stitchkit/blob/master/docs/guide/application-migration-recipes.md): executable database, poller, queue-consumer and operational publishing cutovers
 - [CLI](https://github.com/max-listov/stitchkit/blob/master/docs/guide/cli.md): contracts as a command-line program
 - [Realtime](https://github.com/max-listov/stitchkit/blob/master/docs/guide/realtime.md): Socket.IO server/client wrappers, handshake auth, the cache bridge, a raw WebSocket lane

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stitchkit",
-  "version": "0.71.0",
+  "version": "0.72.1",
   "description": "Contract-first backend framework — one defineContract() into an HTTP API, MCP tools, AI-agent tools and a typed client. Bun and Node.",
   "keywords": [
     "bun",
@@ -73,6 +73,10 @@
       "types": "./dist/contract/index.d.ts",
       "import": "./dist/contract/index.js"
     },
+    "./primitives": {
+      "types": "./dist/primitives.d.ts",
+      "import": "./dist/primitives.js"
+    },
     "./server": {
       "types": "./dist/server/index.d.ts",
       "import": "./dist/server/index.js"
@@ -148,7 +152,7 @@
   "scripts": {
     "build:native-contained-files": "node scripts/build-contained-files-native.mjs",
     "check": "bun x tsc --noEmit",
-    "build:browser": "bun build src/index.ts src/react.ts src/contract/index.ts src/declaration.ts src/agent-runtime-browser.ts --outdir dist --target node --packages external --splitting --root src",
+    "build:browser": "bun build src/index.ts src/react.ts src/contract/index.ts src/primitives.ts src/declaration.ts src/agent-runtime-browser.ts --outdir dist --target node --packages external --splitting --root src",
     "build:server": "bun build src/server/index.ts src/node.ts src/tools.ts src/tool-invoker.ts src/cli.ts src/remote.ts src/files.ts src/testing.ts src/observability/index.ts src/agent-runtime.ts src/agent-runtime-harness.ts src/agent-runtime-coding-tools.ts src/agent-runtime-openrouter.ts src/agent-runtime-sqlite-bun.ts src/agent-runtime-sqlite-node.ts src/application.ts src/application-grammy.ts src/application-opentelemetry.ts src/telegram.ts --outdir dist --target node --packages external --splitting --root src",
     "build:js": "bun run build:browser && bun run build:server && bun scripts/preserve-webpack-ignore.mjs",
     "build:types": "bun x tsc -p tsconfig.build.json --emitDeclarationOnly && bun scripts/rewrite-declaration-specifiers.mjs",