@chances-ai/wire 24.0.0

package/dist/rpc/lines.js

@@ -0,0 +1,24 @@
+// Split a byte/string stream into LF-delimited lines. Splits on "\n" ONLY
+// (stripping a trailing "\r") and never on U+2028/U+2029 — those are valid
+// inside JSON strings, and Node's `readline` would wrongly break on them (pi
+// learned this the hard way: `modes/rpc/jsonl.ts`). `process.stdin` is an
+// AsyncIterable<Buffer>; the bespoke RPC server consumes the yielded lines.
+export async function* linesFromStream(stream) {
+    let buf = "";
+    for await (const chunk of stream) {
+        buf += typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8");
+        let nl = buf.indexOf("\n");
+        while (nl !== -1) {
+            let line = buf.slice(0, nl);
+            if (line.endsWith("\r"))
+                line = line.slice(0, -1);
+            yield line;
+            buf = buf.slice(nl + 1);
+            nl = buf.indexOf("\n");
+        }
+    }
+    const tail = buf.endsWith("\r") ? buf.slice(0, -1) : buf;
+    if (tail.length > 0)
+        yield tail;
+}
+//# sourceMappingURL=lines.js.map

package/dist/rpc/lines.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lines.js","sourceRoot":"","sources":["../../src/rpc/lines.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,2EAA2E;AAC3E,6EAA6E;AAC7E,0EAA0E;AAC1E,4EAA4E;AAE5E,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,eAAe,CACpC,MAA0C;IAE1C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,GAAG,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/E,IAAI,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5B,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAClD,MAAM,IAAI,CAAC;YACX,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YACxB,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACzD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,CAAC;AAClC,CAAC"}

package/dist/rpc/protocol.d.ts

@@ -0,0 +1,315 @@
+import { z } from "zod";
+import type { JSONValue } from "@chances-ai/runtime";
+/** Bumped on any breaking wire change. Carried in the `ready` handshake.
+ *  v2 (M2 / docs/6.2): additive `rseq` cursor + relay control frames. Old
+ *  clients ignore the extra field + unknown frames, so v2 is wire-compatible —
+ *  the bump is a capability signal, not a break. */
+export declare const PROTOCOL_VERSION: 2;
+export declare const PROTOCOL_NAME: "chances-rpc";
+export declare const CommandSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+    type: z.ZodLiteral<"prompt">;
+    id: z.ZodOptional<z.ZodString>;
+    text: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    type: "prompt";
+    text: string;
+    id?: string | undefined;
+}, {
+    type: "prompt";
+    text: string;
+    id?: string | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"abort">;
+    id: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: "abort";
+    id?: string | undefined;
+}, {
+    type: "abort";
+    id?: string | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"set_model">;
+    id: z.ZodOptional<z.ZodString>;
+    provider: z.ZodOptional<z.ZodString>;
+    model: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: "set_model";
+    id?: string | undefined;
+    provider?: string | undefined;
+    model?: string | undefined;
+}, {
+    type: "set_model";
+    id?: string | undefined;
+    provider?: string | undefined;
+    model?: string | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"get_state">;
+    id: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: "get_state";
+    id?: string | undefined;
+}, {
+    type: "get_state";
+    id?: string | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"get_models">;
+    id: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: "get_models";
+    id?: string | undefined;
+}, {
+    type: "get_models";
+    id?: string | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"permission_response">;
+    id: z.ZodString;
+    allow: z.ZodBoolean;
+    remember: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    type: "permission_response";
+    id: string;
+    allow: boolean;
+    remember?: boolean | undefined;
+}, {
+    type: "permission_response";
+    id: string;
+    allow: boolean;
+    remember?: boolean | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"set_options">;
+    id: z.ZodOptional<z.ZodString>;
+    toolChunks: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    type: "set_options";
+    id?: string | undefined;
+    toolChunks?: boolean | undefined;
+}, {
+    type: "set_options";
+    id?: string | undefined;
+    toolChunks?: boolean | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"ping">;
+    id: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: "ping";
+    id?: string | undefined;
+}, {
+    type: "ping";
+    id?: string | undefined;
+}>]>;
+export type Command = z.infer<typeof CommandSchema>;
+export type CommandType = Command["type"];
+export type PromptCommand = Extract<Command, {
+    type: "prompt";
+}>;
+export type RpcErrorCode = "PARSE_ERROR" | "UNKNOWN_COMMAND" | "AGENT_BUSY" | "BAD_REQUEST" | "INTERNAL";
+export interface RpcError {
+    code: RpcErrorCode;
+    message: string;
+}
+export interface ModelInfo {
+    provider: string;
+    model: string;
+}
+export interface ReadyFrame {
+    type: "ready";
+    protocol: typeof PROTOCOL_NAME;
+    version: typeof PROTOCOL_VERSION;
+    agent: {
+        name: string;
+        version: string;
+    };
+    sessionId: string;
+    models: ModelInfo[];
+    capabilities: {
+        permissionPrompt: true;
+        toolChunks: boolean;
+        steering: false;
+        /** (M2) Relay reconnect/replay available. OPTIONAL: `RpcServer` is consumed
+         *  UNCHANGED (docs/6.2 §5) and never sets it, so it is absent on the raw
+         *  engine `ready`. The actual reconnect handshake is the relay's
+         *  {@link RelayWelcomeFrame}; this field is reserved for a future relay that
+         *  stamps it + for documentation. */
+        reconnect?: boolean;
+    };
+}
+/** Reply to a command, correlated by the command's `id` (echoed, may be null
+ * for un-attributable transport errors — codex C9). */
+export interface ResponseFrame {
+    type: "response";
+    id: string | null;
+    command: CommandType | "parse";
+    ok: boolean;
+    data?: JSONValue;
+    error?: RpcError;
+}
+export interface RequestPermissionFrame {
+    type: "request_permission";
+    /** Permission id; the client answers with `permission_response {id}`. */
+    id: string;
+    /** The originating tool call (codex Round-1 MUST-FIX #3). */
+    callId?: string;
+    tool: string;
+    category: string;
+    summary: string;
+    args: JSONValue;
+    cacheKey?: string;
+}
+export type StopReason = "end" | "cancelled" | "error";
+/** Streamed agent events, mapped from the internal `AppEvent` union. */
+export type EventFrame = {
+    type: "turn_start";
+    commandId?: string;
+    turnId: string;
+    prompt: string;
+    sessionId?: string;
+} | {
+    type: "assistant_delta";
+    turnId: string;
+    text: string;
+    agentId?: string;
+} | {
+    type: "tool_call";
+    callId: string;
+    name: string;
+    args: JSONValue;
+    agentId?: string;
+} | {
+    type: "tool_result";
+    callId: string;
+    name: string;
+    ok: boolean;
+    output: string;
+    agentId?: string;
+} | {
+    type: "tool_chunk";
+    callId: string;
+    sessionId: string;
+    seq: number;
+    text: string;
+    bytes: number;
+    dropped?: number;
+    terminal?: true;
+    state?: "running" | "exited" | "killed";
+    exitCode?: number;
+    reason?: "exit" | "signal" | "timeout" | "io-error";
+    agentId?: string;
+} | {
+    type: "usage";
+    model: string;
+    inputTokens: number;
+    outputTokens: number;
+    costUsd: number;
+    agentId?: string;
+} | {
+    type: "compaction_start";
+    reason: string;
+    beforeTokens: number;
+} | {
+    type: "compaction_end";
+    reason: string;
+    ok: boolean;
+    savedTokens?: number;
+    durationMs: number;
+} | {
+    type: "subagent_done";
+    taskId: string;
+    agentName: string;
+    status: "completed" | "failed" | "cancelled";
+    durationMs: number;
+    tokens?: {
+        input: number;
+        output: number;
+    };
+} | {
+    type: "error";
+    code: string;
+    message: string;
+} | {
+    type: "result";
+    commandId?: string;
+    turnId?: string;
+    text: string;
+    usage: {
+        inputTokens: number;
+        outputTokens: number;
+        costUsd: number;
+    };
+    stopReason: StopReason;
+};
+/**
+ * Engine→client frames. The optional `rseq` is the **relay-assigned monotonic
+ * cursor** (M2 / docs/6.2 §3.2): the serve `ReplayHub` stamps it on every
+ * outbound frame at the write boundary; `RpcServer` never sets it (the engine
+ * is cursor-agnostic). It is named **`rseq`, not `seq`**, on purpose: the
+ * `tool_chunk` variant ALREADY carries a top-level `seq` (its own chunk-ordering
+ * counter, protocol line ~128). A relay cursor named `seq` would produce a
+ * duplicate JSON key on tool_chunk frames — `JSON.parse` keeps the LAST, so the
+ * client would read the chunk's seq as the cursor and corrupt reconnect on any
+ * streaming turn. `rseq` is collision-free across every variant. It doubles as
+ * the SSE `id:` value in the M5/M6 transports (an SSE field, not a JSON key, so
+ * the name is independent there).
+ */
+export type ServerFrame = (ReadyFrame | ResponseFrame | RequestPermissionFrame | EventFrame) & {
+    rseq?: number;
+};
+/** Sent once per attach, BEFORE any replayed/live frame. Carries the relay's
+ *  reconnect snapshot so a fresh OR resuming client knows where it stands
+ *  without inferring from the stream (goose/OpenHands "subscribe pushes state"). */
+export interface RelayWelcomeFrame {
+    type: "relay_welcome";
+    /** Per-attach fencing token. Reserved for the M5 stateless POST transport
+     *  (which echoes `{epoch}` since it has no socket to gate by); NOT enforced on
+     *  the M2 WebSocket (fan-out has no exclusive lock to fence). */
+    epoch: number;
+    /** The highest `rseq` the relay has assigned so far (the live head). */
+    headSeq: number;
+    /** True iff the client's `Last-Event-ID` predates the ring floor — its cursor
+     *  is unrecoverable, so it must discard its transcript and take the full ring
+     *  replay that follows (cold reload — never a silent gap). [goose
+     *  `ClientTooFarBehind`.] */
+    reset: boolean;
+    /** Whether a turn is in flight right now (snoop-derived: `turn_start` → true,
+     *  `result` → false), so a reconnecting client can lock its composer. */
+    busy: boolean;
+    /** Ids of `request_permission` frames still open (unanswered) at attach time,
+     *  re-sent right after the welcome so a parked turn is answerable. */
+    pendingPermissionIds: string[];
+    /** (v21 M4 / docs/6.5 §5) Controller-lease snapshot. `lease` = whether the
+     *  optional single-controller lease is enabled (default false ⇒ fan-out: any
+     *  paired device drives, the engine serializes turns via AGENT_BUSY). When
+     *  enabled, `holder` is the clientId currently allowed to drive (null =
+     *  unclaimed) and `controlEpoch` increments on each handoff. A client compares
+     *  its own clientId to `holder` to know if it is the controller or a read-only
+     *  viewer. */
+    lease: boolean;
+    holder: string | null;
+    controlEpoch: number;
+}
+/** Stand-alone cold-reload signal. M2 carries the same intent inside
+ *  {@link RelayWelcomeFrame.reset}; this variant exists for forward-compat with
+ *  a mid-stream reset under M3. */
+export interface ResetFrame {
+    type: "reset";
+}
+export type RelayFrame = RelayWelcomeFrame | ResetFrame;
+/** Everything a client may receive on the wire: engine frames + relay control. */
+export type ClientInboundFrame = ServerFrame | RelayFrame;
+/** The JSON key the relay cursor is spliced under. Centralised so the splicer,
+ *  the reader, and the round-trip test agree. */
+export declare const RSEQ_KEY: "rseq";
+/**
+ * Splice the relay cursor onto an already-serialized frame line as the FIRST
+ * key — an O(1) string op, **payload-agnostic** (it never parses the frame, so
+ * it carries unchanged to the M3 ACP wire). Safe because every `ServerFrame`
+ * serializes to a non-empty object `{"type":...,...}` (≥1 field ⇒ the byte at
+ * index 0 is always `{` and index 1 is `"`), so splicing `"rseq":N,` after the
+ * opening brace yields valid JSON with `rseq` first. `line` may or may not end
+ * in `\n`; the splice is before the first key, so the trailing newline is
+ * untouched.
+ */
+export declare function stampSeq(line: string, seq: number): string;
+/** Read the relay cursor off a parsed inbound frame (`undefined` ⇒ a control
+ *  frame or a pre-M2 relay). Kept beside {@link stampSeq} so the key never drifts. */
+export declare function readRseq(frame: ClientInboundFrame): number | undefined;
+//# sourceMappingURL=protocol.d.ts.map

package/dist/rpc/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/rpc/protocol.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD;;;oDAGoD;AACpD,eAAO,MAAM,gBAAgB,EAAG,CAAU,CAAC;AAC3C,eAAO,MAAM,aAAa,EAAG,aAAsB,CAAC;AAiBpD,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAqBxB,CAAC;AAEH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AACpD,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAC1C,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,CAAC;AAKjE,MAAM,MAAM,YAAY,GACpB,aAAa,GACb,iBAAiB,GACjB,YAAY,GACZ,aAAa,GACb,UAAU,CAAC;AAEf,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,OAAO,aAAa,CAAC;IAC/B,OAAO,EAAE,OAAO,gBAAgB,CAAC;IACjC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,YAAY,EAAE;QACZ,gBAAgB,EAAE,IAAI,CAAC;QACvB,UAAU,EAAE,OAAO,CAAC;QACpB,QAAQ,EAAE,KAAK,CAAC;QAChB;;;;6CAIqC;QACrC,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,CAAC;CACH;AAED;uDACuD;AACvD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,KAAK,CAAC,EAAE,QAAQ,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,yEAAyE;IACzE,EAAE,EAAE,MAAM,CAAC;IACX,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,WAAW,GAAG,OAAO,CAAC;AAEvD,wEAAwE;AACxE,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9F;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3E;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GACtF;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GACpG;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,KAAK,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GACD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9G;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAClE;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACjG;IACE,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C,GACD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAChD;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE,UAAU,EAAE,UAAU,CAAC;CACxB,CAAC;AAEN;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,UAAU,GAAG,aAAa,GAAG,sBAAsB,GAAG,UAAU,CAAC,GAAG;IAC7F,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAQF;;oFAEoF;AACpF,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,eAAe,CAAC;IACtB;;qEAEiE;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB;;;iCAG6B;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf;6EACyE;IACzE,IAAI,EAAE,OAAO,CAAC;IACd;0EACsE;IACtE,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B;;;;;;kBAMc;IACd,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;mCAEmC;AACnC,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,MAAM,UAAU,GAAG,iBAAiB,GAAG,UAAU,CAAC;AAExD,kFAAkF;AAClF,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,UAAU,CAAC;AAE1D;iDACiD;AACjD,eAAO,MAAM,QAAQ,EAAG,MAAe,CAAC;AAExC;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED;sFACsF;AACtF,wBAAgB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,GAAG,SAAS,CAGtE"}

package/dist/rpc/protocol.js

@@ -0,0 +1,70 @@
+// Wire protocol for the bespoke Stable RPC transport (5.2).
+//
+// Schema-first (codex C2): inbound frames — untrusted client input — are
+// validated by zod; outbound frames are typed structurally (the server
+// constructs them, so a schema would only re-state the type). One LF-NDJSON
+// object per line; see docs/5.2-design.md § D3.
+import { z } from "zod";
+/** Bumped on any breaking wire change. Carried in the `ready` handshake.
+ *  v2 (M2 / docs/6.2): additive `rseq` cursor + relay control frames. Old
+ *  clients ignore the extra field + unknown frames, so v2 is wire-compatible —
+ *  the bump is a capability signal, not a break. */
+export const PROTOCOL_VERSION = 2;
+export const PROTOCOL_NAME = "chances-rpc";
+// `z.json()`-equivalent for `args` payloads (zod 3 has no built-in json).
+const jsonValue = z.lazy(() => z.union([
+    z.string(),
+    z.number(),
+    z.boolean(),
+    z.null(),
+    z.array(jsonValue),
+    z.record(jsonValue),
+]));
+// ---------------------------------------------------------------------------
+// Inbound commands (stdin → server). Validated.
+export const CommandSchema = z.discriminatedUnion("type", [
+    z.object({ type: z.literal("prompt"), id: z.string().optional(), text: z.string() }),
+    z.object({ type: z.literal("abort"), id: z.string().optional() }),
+    z.object({
+        type: z.literal("set_model"),
+        id: z.string().optional(),
+        provider: z.string().optional(),
+        model: z.string().optional(),
+    }),
+    z.object({ type: z.literal("get_state"), id: z.string().optional() }),
+    z.object({ type: z.literal("get_models"), id: z.string().optional() }),
+    // `id` here is the permission-request id being answered (NOT a command
+    // correlation id — permission_response gets no response of its own).
+    z.object({
+        type: z.literal("permission_response"),
+        id: z.string(),
+        allow: z.boolean(),
+        remember: z.boolean().optional(),
+    }),
+    z.object({ type: z.literal("set_options"), id: z.string().optional(), toolChunks: z.boolean().optional() }),
+    z.object({ type: z.literal("ping"), id: z.string().optional() }),
+]);
+/** The JSON key the relay cursor is spliced under. Centralised so the splicer,
+ *  the reader, and the round-trip test agree. */
+export const RSEQ_KEY = "rseq";
+/**
+ * Splice the relay cursor onto an already-serialized frame line as the FIRST
+ * key — an O(1) string op, **payload-agnostic** (it never parses the frame, so
+ * it carries unchanged to the M3 ACP wire). Safe because every `ServerFrame`
+ * serializes to a non-empty object `{"type":...,...}` (≥1 field ⇒ the byte at
+ * index 0 is always `{` and index 1 is `"`), so splicing `"rseq":N,` after the
+ * opening brace yields valid JSON with `rseq` first. `line` may or may not end
+ * in `\n`; the splice is before the first key, so the trailing newline is
+ * untouched.
+ */
+export function stampSeq(line, seq) {
+    // `{"type":...}` → `{"rseq":<seq>,"type":...}`. Slice(1) drops the leading `{`.
+    return `{"${RSEQ_KEY}":${seq},${line.slice(1)}`;
+}
+/** Read the relay cursor off a parsed inbound frame (`undefined` ⇒ a control
+ *  frame or a pre-M2 relay). Kept beside {@link stampSeq} so the key never drifts. */
+export function readRseq(frame) {
+    const v = frame[RSEQ_KEY];
+    return typeof v === "number" ? v : undefined;
+}
+//# sourceMappingURL=protocol.js.map

package/dist/rpc/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../src/rpc/protocol.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,4EAA4E;AAC5E,gDAAgD;AAEhD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;oDAGoD;AACpD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAU,CAAC;AAC3C,MAAM,CAAC,MAAM,aAAa,GAAG,aAAsB,CAAC;AAEpD,0EAA0E;AAC1E,MAAM,SAAS,GAAyB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAClD,CAAC,CAAC,KAAK,CAAC;IACN,CAAC,CAAC,MAAM,EAAE;IACV,CAAC,CAAC,MAAM,EAAE;IACV,CAAC,CAAC,OAAO,EAAE;IACX,CAAC,CAAC,IAAI,EAAE;IACR,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;IAClB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;CACpB,CAAC,CACqB,CAAC;AAE1B,8EAA8E;AAC9E,gDAAgD;AAEhD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACxD,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACpF,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;IACjE,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QAC5B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC;IACF,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;IACrE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;IACtE,uEAAuE;IACvE,qEAAqE;IACrE,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;QACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;QAClB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC3G,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;CACjE,CAAC,CAAC;AAsLH;iDACiD;AACjD,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAe,CAAC;AAExC;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,GAAW;IAChD,gFAAgF;IAChF,OAAO,KAAK,QAAQ,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAClD,CAAC;AAED;sFACsF;AACtF,MAAM,UAAU,QAAQ,CAAC,KAAyB;IAChD,MAAM,CAAC,GAAI,KAAkC,CAAC,QAAQ,CAAC,CAAC;IACxD,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC"}

package/dist/rpc/rpc-server.d.ts

@@ -0,0 +1,56 @@
+import type { EngineHost } from "./driver.js";
+import { BoundedNdjsonWriter } from "./writer.js";
+export interface RpcServerOptions {
+    host: EngineHost;
+    writer: BoundedNdjsonWriter;
+    agent: {
+        name: string;
+        version: string;
+    };
+    /** `--yes`: auto-approve every tool permission (trusted automation). When
+     * false (default), each permission is round-tripped to the client. */
+    autoApprove?: boolean;
+    /** Forward `tool:chunk` (live PTY output) by default (N2). */
+    toolChunks?: boolean;
+    /** stderr sink for the routed bus `log` event (defaults to process.stderr). */
+    logSink?: (line: string) => void;
+}
+export declare class RpcServer {
+    private readonly host;
+    private readonly writer;
+    private readonly agent;
+    private readonly autoApprove;
+    private toolChunks;
+    private readonly logSink;
+    private built;
+    private unsub;
+    private activeTurn;
+    /** The in-flight `handlePrompt` promise (fire-and-forget from the read
+     * loop). Tracked so shutdown can await its terminal `result` before
+     * closing the writer (Round-2 M1). */
+    private activePrompt;
+    private readonly pending;
+    private readonly resolvedIds;
+    private readonly resolvedSet;
+    private shuttingDown;
+    constructor(opts: RpcServerOptions);
+    /** Drive the server until `lines` ends, then shut down. Returns an exit code. */
+    run(lines: AsyncIterable<string>): Promise<number>;
+    /** Idempotent shutdown. Order (Round-1 S4): cancel the turn → deny pending
+     * permissions (so a turn blocked in the resolver unwinds — M2) → dispose
+     * (disposers may emit their LAST bus frames, still subscribed) → flush →
+     * close. */
+    shutdown(): Promise<void>;
+    private handleLine;
+    private dispatch;
+    private handlePrompt;
+    private makeResolver;
+    private resolvePermission;
+    /** Resolve every outstanding permission with deny — unblocks a turn parked
+     * in the resolver on `abort` / shutdown (Round-1 M2). */
+    private denyAllPending;
+    private markResolved;
+    private respondOk;
+    private respondError;
+}
+//# sourceMappingURL=rpc-server.d.ts.map

package/dist/rpc/rpc-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc-server.d.ts","sourceRoot":"","sources":["../../src/rpc/rpc-server.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAe,UAAU,EAAE,MAAM,aAAa,CAAC;AAU3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAkBlD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC;0EACsE;IACtE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoC;IAC1D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAU;IACtC,OAAO,CAAC,UAAU,CAAU;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IAEjD,OAAO,CAAC,KAAK,CAA4B;IACzC,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,UAAU,CAAqE;IACvF;;0CAEsC;IACtC,OAAO,CAAC,YAAY,CAA8B;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsD;IAC9E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgB;IAC5C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,YAAY,CAAS;gBAEjB,IAAI,EAAE,gBAAgB;IASlC,iFAAiF;IAC3E,GAAG,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAuCxD;;;gBAGY;IACN,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;YAwBjB,UAAU;YAkCV,QAAQ;YA4CR,YAAY;IAsC1B,OAAO,CAAC,YAAY;IA2BpB,OAAO,CAAC,iBAAiB;IASzB;6DACyD;IACzD,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,YAAY;IAWpB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,YAAY;CAGrB"}