feat(http)!: remove streamRequest in 0.4.0 — closes queue #64 + supersedes PR #86

[Goosterhof]

Summary

Removes streamRequest entirely from @script-development/fs-http's public API in version 0.4.0. This structural close supersedes PR #86 (queue #64 in-place fix-shape) — Commander dispositioned 2026-05-15 that removal is the right answer once Surveyor M3 evidence converged with the queue #64 + queue #22 stream-portion findings into a four-defect picture against a zero-consumer surface.

The four documented library-invariant violations on the removed surface

All shared the same root cause: streamRequest was a parallel transport built directly on native fetch, bypassing the option-honoring discipline that the axios-routed methods inherit for free from axios.create().

1. Queue chore(deps-dev): bump the stryker group with 2 updates #22 stream portion — withXSRFToken not honored uniformly across transport paths; streamRequest was the divergent path.
2. Queue chore(fs-router): republish 0.1.1 with corrected peer-deps (closes #63) #64 — streamRequest read document.cookie for XSRF-TOKEN and emitted X-XSRF-TOKEN unconditionally, ignoring options?.withXSRFToken.
3. Surveyor M3 F-1 — streamRequest × headers IGNORED. Service-wide options?.headers silently dropped; no per-call override surface.
4. Surveyor M3 F-2 — streamRequest × timeout IGNORED. Doctrine feat: add @script-development/fs-adapter-store package #8 silently bypassed on the streaming path. Overlaps queue feat(fs-http)!: remove DOM coupling from download/preview (0.3.0) — closes #59 #62 (AbortSignal absence).

Every per-defect fix would have been a band-aid on a parallel-transport divergence; the next refactor that added a new transport would reproduce the same gap class.

Zero realized consumer evidence

• Engineer-side grep during the queue chore(fs-router): republish 0.1.1 with corrected peer-deps (closes #63) #64 dispatch (PR fix(http): gate streamRequest XSRF cookie read on withXSRFToken — closes queue #64 #86 execution report).
• Sapper M3 Finding chore(deps): bump actions/checkout from 4 to 6 #1 consumer scan (reports/fs-packages/field/2026-05-15-sapper-m3-staleness-refresh.md).
• Liaison M3 consumer scan (reports/fs-packages/field/2026-05-15-liaison-m3-staleness-refresh.md) — no consumer territory passes data to streamRequest.

Three-spy grep convergence: the function had zero production call-sites across the entire war-room consumer fleet.

Cross-references

• Surveyor M3 field report (the matrix verdict that drove removal): reports/fs-packages/field/2026-05-15-surveyor-library-config-honor-surface-audit.md.
• PR fix(http): gate streamRequest XSRF cookie read on withXSRFToken — closes queue #64 #86 (queue chore(fs-router): republish 0.1.1 with corrected peer-deps (closes #63) #64 in-place fix-shape, superseded): closed by the Commander; this PR replaces it.
• Enforcement queue chore(fs-router): republish 0.1.1 with corrected peer-deps (closes #63) #64: disposition shifted to "streamRequest removal" 2026-05-15.

Replacement guidance

If a future streaming use case emerges in a consumer territory, prefer either:

1. axios with responseType: 'stream' via the standard getRequest / postRequest methods — inherits all HttpServiceOptions (headers, withCredentials, withXSRFToken, smartCredentials, timeout) and the per-call AxiosRequestConfig override surface for free.
2. A deliberate createStreamHttpService factory designed against the option-honoring matrix codified in fs-packages CLAUDE.md § Conventions (this PR adds the "Transport-surface discipline" bullet). Such a factory must enumerate every HttpServiceOptions field on day one with a corresponding test pinning each cell as HONORED or N/A-by-construction.

Changes

• Source: streamRequest removed from packages/http/src/http.ts (the function body + the registration entry in the returned service object). The apiUrl local remains — still used by axios.create({baseURL}) and the smartCredentials middleware.
• Types: streamRequest method signature removed from HttpService in packages/http/src/types.ts. No helper type existed solely for it.
• Tests: the entire describe('streamRequest', ...) block removed from packages/http/tests/http.spec.ts (8 tests). The streamRequest toHaveProperty assertion removed from the factory-creation expectation. The top-of-file document.cookie and fetch global stubs removed (only streamRequest exercised them).
• Mock parity: streamRequest: vi.fn() entries dropped from packages/loading/tests/middleware.spec.ts and packages/cached-adapter-store/tests/cached-adapter-store.spec.ts — both used HttpService typing on their fakes and would have failed typecheck after the signature removal.
• Docs: streamRequest section dropped from docs/packages/http.md and replaced with a deprecation-note callout pointing at the CHANGELOG. README's streamRequest bullet dropped. The download/preview API Reference rows in both surfaces also corrected to the current 0.3.0 signature ((endpoint, options?) → Promise<AxiosResponse<Blob>>) — caught the Warden M2 standing drift in the same pass.
• CHANGELOG: new ## 0.4.0 — 2026-05-15 section with the breaking-removal record and replacement guidance.

Version cascade (pre-1.0 caret semver)

• fs-http 0.3.0 → 0.4.0 (breaking removal)
• fs-loading 0.1.2 → 0.1.3 — peer range widened to ^0.1.0 || ^0.2.0 || ^0.3.0 || ^0.4.0
• fs-adapter-store 0.1.6 → 0.1.7 — same peer-range widening
• fs-cached-adapter-store 0.1.0 → 0.1.1 — same peer-range widening

Lockfile regenerated; every node_modules/@script-development/* resolves to the workspace (link: true). No nested registry copies.

CLAUDE.md doctrine

A new bullet under ## Conventions codifies the "Transport-surface discipline" rule — every fs-http transport method must inherit option-honoring from axios.create(), or explicitly enumerate and honor every HttpServiceOptions field with a test pinning each cell as HONORED or N/A-by-construction. The streamRequest removal is the precedent record.

Verification (all 8 gates, locally)

Gate	Status	Notes
1. npm audit	PASS	0 vulnerabilities, 725 deps
2. npm run format:check	PASS	oxfmt clean across 544 files
3. npm run lint	PASS	oxlint 0 warnings / 0 errors
4. npm run build	PASS	tsdown dual ESM + CJS for all 11 packages
5. npm run typecheck	PASS	clean across the workspace
6. npm run lint:pkg	PRE-EXISTING RED	enforcement queue #70 — publint 0.3.21 sideEffects Suggestion across all 11 packages, blanket-fails the wrapper from queue #31. Identical posture to current main. Out-of-scope for this PR; flagged in execution report for follow-up Armorer.
7. npm run test:coverage	PASS	workspace 1712/1712 tests; fs-http per-package 100% Stmts/Branches/Funcs/Lines
8. npx stryker run (per package)	PASS	fs-http 96.23% (was 95.74% on main); fs-loading 92.50%; fs-adapter-store 100%; fs-cached-adapter-store 94.81%. All ≥90%; no new survivors introduced by this PR.

Out of scope

• The queue chore(deps-dev): bump the stryker group with 2 updates #22 axios-methods withXSRFToken default-flip deliberation — separate open General disposition; this PR closes only the streamRequest portion.
• The queue feat(fs-http)!: remove DOM coupling from download/preview (0.3.0) — closes #59 #62 AbortSignal-first-class disposition — Quartermaster lane; this PR does not touch the axios-routed methods.
• The queue chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 #41 Armorer wave (consumer-territory ^0.4.0 retargeting) — separate dispatch in lockstep with this PR.
• The queue fs-dialog: forward host <dialog> ARIA attributes via dialog.open() options (#67) #70 publint sideEffects red on Gate 6 — separate Armorer dispatch.

[cloudflare-workers-and-pages]

Deploying fs-packages with    Cloudflare Pages

Latest commit:	e2e91a9
Status:	✅  Deploy successful!
Preview URL:	https://f1ae5624.fs-packages.pages.dev
Branch Preview URL:	https://engineer-streamrequest-remov.fs-packages.pages.dev

View logs