@ethisyscore/extension-runtime 1.34.0 → 1.36.0

package/dist/{transport-BN9Mzn_m.d.cts → transport-CHa8ESUx.d.ts}

@@ -1,4 +1,4 @@
-import { d as BridgePushThemeEnvelope, c as BridgePushLocaleEnvelope, b as BridgePushDensityEnvelope, a as BridgePushA11yEnvelope, B as BridgeNavPushEnvelope } from './bridge-envelopes-BRKGSiSC.cjs';
+import { U as UploadDocumentMeta, d as BridgePushThemeEnvelope, c as BridgePushLocaleEnvelope, b as BridgePushDensityEnvelope, a as BridgePushA11yEnvelope, B as BridgeNavPushEnvelope } from './bridge-envelopes-DA6vxbyb.js';
 
 /**
  * Worker-side host transport for `renderMode: remote-runtime` extensions
@@ -55,11 +55,29 @@ type McpHttpRequest = {
     uri: string;
     capabilityToken: string;
     signal?: AbortSignal;
-};
+} | McpUploadRequest;
+/**
+ * Host-side document-upload request (a `kind` of {@link McpHttpRequest}).
+ * Carries the transferred bytes + advisory metadata plus the host-minted
+ * capability token. As with the other request kinds, the token is attached on
+ * the HOST side only and never crosses the worker port. Implementations POST
+ * the bytes as `application/octet-stream` (metadata in `x-cc-*` headers) to the
+ * kernel's capability-token-authed document-upload route; `data` on success is
+ * an {@link UploadDocumentResult}.
+ */
+interface McpUploadRequest {
+    kind: "uploadDocument";
+    meta: UploadDocumentMeta;
+    buffer: ArrayBuffer;
+    capabilityToken: string;
+    signal?: AbortSignal;
+}
 /**
  * Host-side HTTP client for MCP calls. Implementations are responsible for
  * carrying the supplied `capabilityToken` on the outbound request (typically
- * via `Authorization: Bearer`).
+ * via `Authorization: Bearer` / `PluginCap`). The `uploadDocument` kind is
+ * additive — implementations that predate it fall through to their unknown-kind
+ * branch until updated (the FE upload hook is inert until the host handles it).
  */
 interface McpHttpClient {
     fetch(request: McpHttpRequest): Promise<{
@@ -201,6 +219,7 @@ declare class WorkerRemoteDomTransport {
     private readonly coalesceMs;
     private readonly maxConcurrentMcpRequests;
     private readonly abortController;
+    private readonly inFlightAborts;
     private inFlightMcpRequests;
     private remoteDomConsumer;
     private bridgeMessageConsumer;
@@ -323,9 +342,25 @@ declare class WorkerRemoteDomTransport {
      * settles (regardless of resolution/rejection shape).
      */
     private dispatchMcp;
+    /**
+     * Create a per-request AbortController and register it under the request id
+     * so an inbound `ethisys:mcp:abort` can cancel just this call. If the
+     * transport is already disposed the controller starts aborted so the
+     * handler's `mcpClient.fetch` short-circuits immediately.
+     */
+    private registerRequestAbort;
+    /** Drop a settled request's AbortController. */
+    private releaseRequestAbort;
+    /**
+     * The signal to hand to `mcpClient.fetch` for a given request: the
+     * per-request controller when registered (client cancel path), falling back
+     * to the dispose-level controller.
+     */
+    private requestSignal;
     private handleInvokeTool;
     private handleGetResource;
+    private handleUploadDocument;
     private replyError;
 }
 
-export { DEFAULT_MAX_CONCURRENT_MCP_REQUESTS as D, type InputEventPayload as I, type McpHttpClient as M, WORKER_TRANSPORT_PROTOCOL as W, type McpHttpRequest as a, type WorkerCtor as b, type WorkerHandshakePayload as c, type WorkerLike as d, WorkerRemoteDomTransport as e, type WorkerRemoteDomTransportOptions as f };
+export { DEFAULT_MAX_CONCURRENT_MCP_REQUESTS as D, type InputEventPayload as I, type McpHttpClient as M, WORKER_TRANSPORT_PROTOCOL as W, type McpHttpRequest as a, type McpUploadRequest as b, type WorkerCtor as c, type WorkerHandshakePayload as d, type WorkerLike as e, WorkerRemoteDomTransport as f, type WorkerRemoteDomTransportOptions as g };

package/dist/{transport-Jfd9KXAh.d.ts → transport-DJE6ljme.d.cts}

@@ -1,4 +1,4 @@
-import { d as BridgePushThemeEnvelope, c as BridgePushLocaleEnvelope, b as BridgePushDensityEnvelope, a as BridgePushA11yEnvelope, B as BridgeNavPushEnvelope } from './bridge-envelopes-BRKGSiSC.js';
+import { U as UploadDocumentMeta, d as BridgePushThemeEnvelope, c as BridgePushLocaleEnvelope, b as BridgePushDensityEnvelope, a as BridgePushA11yEnvelope, B as BridgeNavPushEnvelope } from './bridge-envelopes-DA6vxbyb.cjs';
 
 /**
  * Worker-side host transport for `renderMode: remote-runtime` extensions
@@ -55,11 +55,29 @@ type McpHttpRequest = {
     uri: string;
     capabilityToken: string;
     signal?: AbortSignal;
-};
+} | McpUploadRequest;
+/**
+ * Host-side document-upload request (a `kind` of {@link McpHttpRequest}).
+ * Carries the transferred bytes + advisory metadata plus the host-minted
+ * capability token. As with the other request kinds, the token is attached on
+ * the HOST side only and never crosses the worker port. Implementations POST
+ * the bytes as `application/octet-stream` (metadata in `x-cc-*` headers) to the
+ * kernel's capability-token-authed document-upload route; `data` on success is
+ * an {@link UploadDocumentResult}.
+ */
+interface McpUploadRequest {
+    kind: "uploadDocument";
+    meta: UploadDocumentMeta;
+    buffer: ArrayBuffer;
+    capabilityToken: string;
+    signal?: AbortSignal;
+}
 /**
  * Host-side HTTP client for MCP calls. Implementations are responsible for
  * carrying the supplied `capabilityToken` on the outbound request (typically
- * via `Authorization: Bearer`).
+ * via `Authorization: Bearer` / `PluginCap`). The `uploadDocument` kind is
+ * additive — implementations that predate it fall through to their unknown-kind
+ * branch until updated (the FE upload hook is inert until the host handles it).
  */
 interface McpHttpClient {
     fetch(request: McpHttpRequest): Promise<{
@@ -201,6 +219,7 @@ declare class WorkerRemoteDomTransport {
     private readonly coalesceMs;
     private readonly maxConcurrentMcpRequests;
     private readonly abortController;
+    private readonly inFlightAborts;
     private inFlightMcpRequests;
     private remoteDomConsumer;
     private bridgeMessageConsumer;
@@ -323,9 +342,25 @@ declare class WorkerRemoteDomTransport {
      * settles (regardless of resolution/rejection shape).
      */
     private dispatchMcp;
+    /**
+     * Create a per-request AbortController and register it under the request id
+     * so an inbound `ethisys:mcp:abort` can cancel just this call. If the
+     * transport is already disposed the controller starts aborted so the
+     * handler's `mcpClient.fetch` short-circuits immediately.
+     */
+    private registerRequestAbort;
+    /** Drop a settled request's AbortController. */
+    private releaseRequestAbort;
+    /**
+     * The signal to hand to `mcpClient.fetch` for a given request: the
+     * per-request controller when registered (client cancel path), falling back
+     * to the dispose-level controller.
+     */
+    private requestSignal;
     private handleInvokeTool;
     private handleGetResource;
+    private handleUploadDocument;
     private replyError;
 }
 
-export { DEFAULT_MAX_CONCURRENT_MCP_REQUESTS as D, type InputEventPayload as I, type McpHttpClient as M, WORKER_TRANSPORT_PROTOCOL as W, type McpHttpRequest as a, type WorkerCtor as b, type WorkerHandshakePayload as c, type WorkerLike as d, WorkerRemoteDomTransport as e, type WorkerRemoteDomTransportOptions as f };
+export { DEFAULT_MAX_CONCURRENT_MCP_REQUESTS as D, type InputEventPayload as I, type McpHttpClient as M, WORKER_TRANSPORT_PROTOCOL as W, type McpHttpRequest as a, type McpUploadRequest as b, type WorkerCtor as c, type WorkerHandshakePayload as d, type WorkerLike as e, WorkerRemoteDomTransport as f, type WorkerRemoteDomTransportOptions as g };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ethisyscore/extension-runtime",
-  "version": "1.34.0",
+  "version": "1.36.0",
   "description": "Host + plugin runtime for EthisysCore Contract A (host-rendered) and Contract B (worker remote-runtime) extensions.",
   "type": "module",
   "main": "./dist/index.cjs",

package/dist/bridge-envelopes-BRKGSiSC.d.cts

@@ -1,63 +0,0 @@
-/**
- * Wire-shape constants and type guards for host→plugin bridge push messages
- * (WI 4858 sub-plan 2). These types ride the existing MessagePort channel
- * alongside the `ethisys:mcp:*` and `ethisys:remotedom` envelopes — the
- * `type` discriminant keeps them fully separate at the dispatch site.
- *
- * The host posts bridge pushes through `WorkerRemoteDomTransport.hostPort`;
- * the plugin side reads them in `createPortBridgeClient` (plugin-ui package).
- * In-realm (Tier T) plugins use `InMemoryBridgeTransport` which calls the
- * subscriber callbacks directly — no serialisation needed.
- */
-declare const BRIDGE_PUSH_THEME: "ethisys:bridge:theme";
-declare const BRIDGE_PUSH_LOCALE: "ethisys:bridge:locale";
-declare const BRIDGE_PUSH_DENSITY: "ethisys:bridge:density";
-declare const BRIDGE_PUSH_A11Y: "ethisys:bridge:a11y";
-declare const BRIDGE_NAV_PUSH: "ethisys:bridge:nav";
-declare const BRIDGE_SESSION_TOKEN_PUSH: "ethisys:bridge:token";
-/** Theme push: host → plugin whenever the host theme changes. */
-interface BridgePushThemeEnvelope {
-    readonly type: typeof BRIDGE_PUSH_THEME;
-    /** "light" | "dark" | "high-contrast" */
-    readonly mode: string;
-    /** Flat design-token map (CSS-variable-name → value). May be empty. */
-    readonly tokens: Readonly<Record<string, string>>;
-}
-/** Locale push: host → plugin whenever the active locale changes. */
-interface BridgePushLocaleEnvelope {
-    readonly type: typeof BRIDGE_PUSH_LOCALE;
-    /** BCP 47 tag, e.g. "en-GB". */
-    readonly locale: string;
-    /** "ltr" | "rtl" */
-    readonly dir: "ltr" | "rtl";
-}
-/** Density push: host → plugin when the UI density preference changes. */
-interface BridgePushDensityEnvelope {
-    readonly type: typeof BRIDGE_PUSH_DENSITY;
-    /** "comfortable" | "compact" */
-    readonly density: string;
-}
-/** A11y push: host → plugin when accessibility prefs change. */
-interface BridgePushA11yEnvelope {
-    readonly type: typeof BRIDGE_PUSH_A11Y;
-    readonly reducedMotion: boolean;
-    readonly highContrast: boolean;
-}
-/** Nav push: host → plugin when the SPA location changes. */
-interface BridgeNavPushEnvelope {
-    readonly type: typeof BRIDGE_NAV_PUSH;
-    /** Current SPA path (pathname + search). */
-    readonly path: string;
-    /** `window.history.length` at the time of push. */
-    readonly historyLength: number;
-}
-/** Host → plugin: push a short-lived frontend-session token. */
-interface BridgeSessionTokenPushEnvelope {
-    readonly type: typeof BRIDGE_SESSION_TOKEN_PUSH;
-    /** Opaque JWT string — audience-restricted to the plugin's own backend. */
-    readonly token: string;
-    /** Absolute epoch-ms at which the token expires. Refresh fires 30 s before. */
-    readonly expiresAtMs: number;
-}
-
-export type { BridgeNavPushEnvelope as B, BridgePushA11yEnvelope as a, BridgePushDensityEnvelope as b, BridgePushLocaleEnvelope as c, BridgePushThemeEnvelope as d, BridgeSessionTokenPushEnvelope as e };

package/dist/bridge-envelopes-BRKGSiSC.d.ts

@@ -1,63 +0,0 @@
-/**
- * Wire-shape constants and type guards for host→plugin bridge push messages
- * (WI 4858 sub-plan 2). These types ride the existing MessagePort channel
- * alongside the `ethisys:mcp:*` and `ethisys:remotedom` envelopes — the
- * `type` discriminant keeps them fully separate at the dispatch site.
- *
- * The host posts bridge pushes through `WorkerRemoteDomTransport.hostPort`;
- * the plugin side reads them in `createPortBridgeClient` (plugin-ui package).
- * In-realm (Tier T) plugins use `InMemoryBridgeTransport` which calls the
- * subscriber callbacks directly — no serialisation needed.
- */
-declare const BRIDGE_PUSH_THEME: "ethisys:bridge:theme";
-declare const BRIDGE_PUSH_LOCALE: "ethisys:bridge:locale";
-declare const BRIDGE_PUSH_DENSITY: "ethisys:bridge:density";
-declare const BRIDGE_PUSH_A11Y: "ethisys:bridge:a11y";
-declare const BRIDGE_NAV_PUSH: "ethisys:bridge:nav";
-declare const BRIDGE_SESSION_TOKEN_PUSH: "ethisys:bridge:token";
-/** Theme push: host → plugin whenever the host theme changes. */
-interface BridgePushThemeEnvelope {
-    readonly type: typeof BRIDGE_PUSH_THEME;
-    /** "light" | "dark" | "high-contrast" */
-    readonly mode: string;
-    /** Flat design-token map (CSS-variable-name → value). May be empty. */
-    readonly tokens: Readonly<Record<string, string>>;
-}
-/** Locale push: host → plugin whenever the active locale changes. */
-interface BridgePushLocaleEnvelope {
-    readonly type: typeof BRIDGE_PUSH_LOCALE;
-    /** BCP 47 tag, e.g. "en-GB". */
-    readonly locale: string;
-    /** "ltr" | "rtl" */
-    readonly dir: "ltr" | "rtl";
-}
-/** Density push: host → plugin when the UI density preference changes. */
-interface BridgePushDensityEnvelope {
-    readonly type: typeof BRIDGE_PUSH_DENSITY;
-    /** "comfortable" | "compact" */
-    readonly density: string;
-}
-/** A11y push: host → plugin when accessibility prefs change. */
-interface BridgePushA11yEnvelope {
-    readonly type: typeof BRIDGE_PUSH_A11Y;
-    readonly reducedMotion: boolean;
-    readonly highContrast: boolean;
-}
-/** Nav push: host → plugin when the SPA location changes. */
-interface BridgeNavPushEnvelope {
-    readonly type: typeof BRIDGE_NAV_PUSH;
-    /** Current SPA path (pathname + search). */
-    readonly path: string;
-    /** `window.history.length` at the time of push. */
-    readonly historyLength: number;
-}
-/** Host → plugin: push a short-lived frontend-session token. */
-interface BridgeSessionTokenPushEnvelope {
-    readonly type: typeof BRIDGE_SESSION_TOKEN_PUSH;
-    /** Opaque JWT string — audience-restricted to the plugin's own backend. */
-    readonly token: string;
-    /** Absolute epoch-ms at which the token expires. Refresh fires 30 s before. */
-    readonly expiresAtMs: number;
-}
-
-export type { BridgeNavPushEnvelope as B, BridgePushA11yEnvelope as a, BridgePushDensityEnvelope as b, BridgePushLocaleEnvelope as c, BridgePushThemeEnvelope as d, BridgeSessionTokenPushEnvelope as e };