Hardening qualification

Historical baseline: verified implementation. Results below apply only to this baseline and the recorded environment; they are not a statement of current support or release status.

This is the earlier hardening snapshot. See the conformance follow-up for the subsequent fixes and later local/remote qualification.

All results are local, on macOS arm64 / Node 24.16.0 / pnpm 10.34.5.

ChangesCopy Anchor Link

• Preserve Unicode, FormData content types and dictionary keys; reject paths that Fetch would normalize to a different endpoint.
• Bound recursive metadata inference and index strict routes at client creation. Keep strict serialization separate from the core runtime.
• Support generated parameter records and document HTTP errors, response parsing, metadata validation and extension execution boundaries.
• Add native HTTP, Chromium, adversarial URL and installed-consumer checks, together with schema-scale and comparable bundle measurements.
• Provide an executable generated-schema guide and private security reporting instructions.

VerifiedCopy Anchor Link

• Frozen-lockfile installation completed successfully.
• pnpm check passed: formatting, typed lint, real generator fixture comparison, strict TypeScript, runtime/local HTTP tests, coverage, build, publint, attw, installed tarball consumers, core size and TypeScript scale budgets.
• 210 Vitest tests passed. Coverage: statements 95.20%, branches 93.43%, functions 97.01%, lines 96.28%; all original 90% gates remain enabled.
• pnpm test:browser passed in Chromium: both built clients, multipart boundaries, Unicode, credentialed CORS, cookie omission, AbortSignal and streamed extensions.
• Core release size metric: 1959 / 2048 bytes transitive gzip.
• 5000-route / 25-operation TypeScript fixture: 1873299 instantiations, 898458 KB compiler memory, 2.53 seconds check time on this run.
• The 10000-route strict-chain microbenchmark was about 1.65 microseconds/request; see methodology and limits, not a real-network speed claim.
• Comparable single-file gzip: core 1850 B, strict 6475 B, metadata 3867 B, openapi-fetch 0.17.0 2833 B. These are different feature sets.

Deliberate boundariesCopy Anchor Link

HTTP status mode, response parsing, strict validation and request extension order are now explicitly documented and regression-tested. This does not add a complete JSON Schema validator or make transport/parse failures become HTTP result unions. Recursive serialization inference that cannot determine a wire representation is rejected with a controlled error; ordinary JSON object recursion remains supported.

No push, npm publication, remote CI execution, GitHub release configuration change or private-reporting setting change was performed. Firefox/WebKit and remote OS matrix results are not established by the local Chromium/Node results. See the support matrix, onboarding guide and security reporting process.