stitchkit v0.110.6

Added

• stitchkit/server: createServer({ proxyOrigin: { trustedPeer } }) restores the external HTTP/HTTPS scheme from a single trusted ingress before fetch composition and routing. It validates the real TCP peer and one X-Forwarded-Proto, rejects competing URL headers, preserves wire Host/ports and native cancellation, peer lookup and WebSocket upgrade. trustProxy remains client-IP-only. The server surface grows by one configuration type, ProxyOriginConfig, owned by this entrypoint so the trust decision is explicit and independently testable (I8, I9, I12).

Fixed

• stitchkit/process: bounded process-group settlement observations remain readable through nested cleanup errors in Node CI, including up to 16 actual states, the group id, sample count and elapsed time. Observation failures retain their original cause. Cleanup deadlines and the definition of a live process are unchanged; these diagnostics do not claim to repair a historical native termination failure.
• stitchkit/process: stopping a process group repeats SIGKILL for members still confirmed alive within the original cleanup deadline. Fresh kernel absence ends further signals; dead-only, invalid and failed process observations never trigger a blind re-signal.