@nominalso/vibe-host 0.0.1 → 0.2.0

package/README.md

@@ -1,9 +1,8 @@
 # @nominalso/vibe-host
 
-Host-side SDK for embedding **Nominal Vibe Apps**. Used by the Nominal app (nom-ui) to receive requests from an
-embedded Vibe App over a typed `postMessage` protocol and dispatch them to Nominal APIs. The host ships a
-**complete, type-checked handler map** covering every protocol operation — you only supply a `clientConfig`
-pointing at the Nominal API, and the SDK wires up and dispatches all operations for you.
+Host-side SDK for embedding **Nominal Vibe Apps**. Used by the Nominal app (nom-ui) to receive requests from an embedded Vibe App over a typed `postMessage` protocol and dispatch them to Nominal APIs. The host ships a **complete, type-checked handler map** covering every protocol operation — you supply a `clientConfig` pointing at the Nominal API, and the SDK wires up and dispatches all operations for you.
+
+> **For AI agents:** you do **not** pass a `handlers` map. Provide `clientConfig` (where the Nominal API lives) and the SDK builds every handler. The iframe-side counterpart is `@nominalso/vibe-bridge`.
 
 ## Install
 
@@ -11,28 +10,93 @@ pointing at the Nominal API, and the SDK wires up and dispatches all operations
 npm install @nominalso/vibe-host
 ```
 
-## Usage
+Externalizes only `@hey-api/client-fetch`; TypeScript types are self-contained.
+
+## Quickstart
 
 ```tsx
 import { VibeAppHost } from '@nominalso/vibe-host'
 
 const host = new VibeAppHost({
+  // Iframe origin(s) allowed to talk to this host — must match exactly.
   trustedOrigins: ['https://my-vibe-app.lovable.app'],
+  // This Vibe App's base path in nom-ui (used to sync the browser URL).
   appBasePath: `/${tenant}/${subsidiary}/apps/${slug}`,
+  // Context pushed to the iframe on connect.
   getContext: () => ({ tenant, subsidiaryId, subsidiaries, user, lastClosedPeriodSlug }),
   // Points the built-in handler map at the Nominal API (e.g. nom-ui's proxy route).
-  // The SDK provides handlers for every protocol operation out of the box.
   clientConfig: { baseUrl: '/api/proxy', stripApiPrefix: true },
 })
 
-// Start listening before the iframe loads, then push context on its `load` event.
+// Start listening BEFORE the iframe loads, then push context on its `load` event.
 const unmount = host.mount()
-// host.pushContextTo(iframe.contentWindow)
+// once the iframe has loaded: host.pushContextTo(iframe.contentWindow)
 ```
 
-The iframe side is [`@nominalso/vibe-bridge`](https://www.npmjs.com/package/@nominalso/vibe-bridge). See the
-[repository](https://github.com/nominalso/vibe-apps-sdk#readme) for the full protocol, architecture, and the
-SSR / iframe-mounting notes.
+## API
+
+### `new VibeAppHost(options)`
+
+| Option           | Type                    | Description                                                                                               |
+| ---------------- | ----------------------- | --------------------------------------------------------------------------------------------------------- |
+| `trustedOrigins` | `string[]`              | Iframe origins allowed to talk to this host. Messages from other origins are ignored.                     |
+| `getContext`     | `() => HostContext`     | Returns the current context to send to the iframe (`hostVersion` is injected automatically).              |
+| `appBasePath`    | `string`                | Base URL path of this Vibe App in nom-ui, e.g. `/acme/1/apps/fixed-assets`.                               |
+| `clientConfig`   | `VibeApiClientOptions?` | Points the built-in handler map at the Nominal API. Defaults to `{ baseUrl: '', stripApiPrefix: false }`. |
+
+`VibeApiClientOptions` is `{ baseUrl: string; stripApiPrefix?: boolean }`. Set `stripApiPrefix: true` when routing through a proxy whose convention expects paths without the `/api` prefix.
+
+### `mount(iframeWindow?): () => void`
+
+Starts listening for bridge messages and sets up browser back/forward sync. Returns a cleanup function. Pass `iframeWindow` to immediately push context; if omitted, the host answers `GET_CONTEXT` polls but won't proactively push until you call `pushContextTo`.
+
+### `pushContextTo(iframeWindow): void`
+
+Pushes the current context to the iframe and stores the window reference for future pushes (e.g. subroute sync). Call once the iframe has loaded if you called `mount()` with no argument.
+
+### Exports
+
+`VibeAppHost`, and the types `VibeAppHostOptions`, `HostContext`, `HostHandlers`, `RequestHandlers`, `ContextPayload`, `VibeApiClientOptions`.
+
+## Mounting inside Next.js (nom-ui)
+
+The iframe is server-rendered, so it may start loading before React hydrates, and cross-origin `contentDocument` is always `null`. The robust pattern: `mount()` (no arg) immediately to start listening, then `pushContextTo(iframe.contentWindow)` from the iframe's `load` event.
+
+```tsx
+'use client'
+import { useEffect, useRef } from 'react'
+import { VibeAppHost } from '@nominalso/vibe-host'
+
+function VibeAppFrame({ host, src }: { host: VibeAppHost; src: string }) {
+  const iframeRef = useRef<HTMLIFrameElement>(null)
+
+  useEffect(() => {
+    const iframe = iframeRef.current
+    if (!iframe) return
+    const unmount = host.mount() // listen before the iframe loads
+    const onLoad = () => iframe.contentWindow && host.pushContextTo(iframe.contentWindow)
+    iframe.addEventListener('load', onLoad)
+    return () => {
+      iframe.removeEventListener('load', onLoad)
+      unmount()
+    }
+  }, [host])
+
+  return (
+    <iframe
+      ref={iframeRef}
+      src={src}
+      sandbox="allow-scripts allow-forms allow-same-origin allow-popups"
+    />
+  )
+}
+```
+
+Calling `contentWindow.postMessage` while the iframe is still at `about:blank` throws a `DOMException` — that's why context is pushed from the `load` event, not on effect setup.
+
+## How it fits together
+
+The iframe side is [`@nominalso/vibe-bridge`](https://www.npmjs.com/package/@nominalso/vibe-bridge). See the [repository](https://github.com/nominalso/vibe-apps-sdk#readme) for the full protocol and architecture.
 
 ## License
 

package/dist/index.cjs

@@ -20,14 +20,28 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  BridgeError: () => BridgeError,
+  HttpBridgeError: () => HttpBridgeError,
   VibeAppHost: () => VibeAppHost
 });
 module.exports = __toCommonJS(index_exports);
 
 // package.json
-var version = "0.0.1";
+var version = "0.2.0";
 
 // ../protocol-types/dist/index.js
+function normalizeSubroute(subroute) {
+  const normalized = subroute.startsWith("/") ? subroute : `/${subroute}`;
+  const path = normalized.split(/[?#]/)[0];
+  let decoded = path;
+  let prev;
+  do {
+    prev = decoded;
+    decoded = decoded.replace(/%25/gi, "%").replace(/%2e/gi, ".").replace(/%2f/gi, "/");
+  } while (decoded !== prev);
+  if (decoded.split("/").some((segment) => segment === "..")) return null;
+  return normalized;
+}
 var PROTOCOL_ID = "nominal-vibe-bridge";
 var PROTOCOL_VERSION = 1;
 var BRIDGE_KINDS = ["request", "response", "push", "command", "progress"];
@@ -44,6 +58,20 @@ function isBridgeMessage(data) {
   if (CORRELATED_KINDS_SET.has(d.kind) && typeof d.requestId !== "string") return false;
   return true;
 }
+var BridgeError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "BridgeError";
+  }
+};
+var HttpBridgeError = class extends BridgeError {
+  constructor(status, message) {
+    super("REQUEST_FAILED", message);
+    this.status = status;
+    this.name = "HttpBridgeError";
+  }
+};
 
 // ../api-client/dist/index.js
 var import_client_fetch = require("@hey-api/client-fetch");
@@ -375,10 +403,6 @@ var getSubsidiaryParentCurrenciesApiTenancySubsidiarySubsidiaryIdParentCurrencie
 };
 function createVibeApiClient({ baseUrl, stripApiPrefix }) {
   const client2 = (0, import_client_fetch2.createClient)((0, import_client_fetch2.createConfig)({ baseUrl }));
-  client2.interceptors.request.use((request) => {
-    console.log("[vibe-api-client] request url:", request.url);
-    return request;
-  });
   if (stripApiPrefix) {
     client2.interceptors.request.use(
       (request) => new Request(request.url.replace(`${baseUrl}/api/`, `${baseUrl}/`), request)
@@ -387,16 +411,28 @@ function createVibeApiClient({ baseUrl, stripApiPrefix }) {
   return client2;
 }
 
-// src/handlerMap.ts
+// src/handlers/call.ts
 async function call(fn, payload, client2) {
-  const { data } = await fn({ ...payload, client: client2 });
-  if (data == null) throw new Error("API returned no data");
+  const { data, response } = await fn({ ...payload, client: client2 });
+  if (data == null) {
+    if (response && !response.ok) {
+      throw new HttpBridgeError(
+        response.status,
+        `API request failed with status ${response.status}`
+      );
+    }
+    if (!response) {
+      throw new Error("API request produced no response");
+    }
+    return null;
+  }
   return data;
 }
-function createHandlerMap(options) {
-  const client2 = createVibeApiClient(options);
+
+// src/handlers/accounting.ts
+function accountingHandlers(client2) {
   return {
-    // Accounting — chart of accounts
+    // Chart of accounts
     GET_CHART_OF_ACCOUNTS: (p) => call(getCoaFlatApiAccountingSubsidiarySubsidiaryIdCoaAccountGet, p, client2),
     GET_COA_TREE: (p) => call(getCoaTreeApiAccountingSubsidiarySubsidiaryIdCoaGet, p, client2),
     GET_COA_FLAT_SIMPLE: (p) => call(
@@ -421,7 +457,7 @@ function createHandlerMap(options) {
     ),
     GET_ACCOUNTS: (p) => call(getAccountsApiAccountingAccountGet, p, client2),
     GET_ACCOUNT: (p) => call(getAccountApiAccountingAccountAccountIdGet, p, client2),
-    // Accounting — exchange rates
+    // Exchange rates
     GET_CONVERSION_RATES: (p) => call(getConversionRateApiAccountingCurrencyCurrencyConversionRatesGet, p, client2),
     GET_EFFECTIVE_EXCHANGE_RATE: (p) => call(getEffectiveExchangeRateApiAccountingConsolidationExchangeRateGet, p, client2),
     GET_EXCHANGE_RATE_BY_DATE: (p) => call(
@@ -429,7 +465,7 @@ function createHandlerMap(options) {
       p,
       client2
     ),
-    // Accounting — dimensions
+    // Dimensions
     GET_DIMENSIONS: (p) => call(getDimensionsApiAccountingDimensionGet, p, client2),
     GET_DIMENSION_VALUES: (p) => call(getDimensionValuesApiAccountingDimensionValueGet, p, client2),
     GET_DIMENSION_VALUES_HIERARCHICAL: (p) => call(
@@ -442,7 +478,7 @@ function createHandlerMap(options) {
       p,
       client2
     ),
-    // Accounting — journal entries
+    // Journal entries
     GET_JOURNAL_ENTRIES: (p) => call(
       getSubsidiaryJournalApiAccountingSubsidiarySubsidiaryIdJournalEntryGet,
       p,
@@ -457,8 +493,14 @@ function createHandlerMap(options) {
       getJournalEntryApiAccountingSubsidiarySubsidiaryIdJournalEntryJournalEntryIdGet,
       p,
       client2
-    ),
-    // Activity — period instances
+    )
+  };
+}
+
+// src/handlers/activity.ts
+function activityHandlers(client2) {
+  return {
+    // Period instances
     GET_PERIODS: (p) => call(getPeriodInstancesApiActivityPeriodInstanceGet, p, client2),
     GET_PERIOD_INSTANCE: (p) => call(getPeriodInstanceApiActivityPeriodInstancePeriodInstanceIdGet, p, client2),
     GET_PERIOD_INSTANCE_BY_SLUG: (p) => call(
@@ -471,14 +513,14 @@ function createHandlerMap(options) {
       p,
       client2
     ),
-    // Activity — activity definitions
+    // Activity definitions
     GET_ACTIVITY_DEFINITIONS: (p) => call(getActivityDefinitionsApiActivityActivityDefinitionGet, p, client2),
     GET_ACTIVITY_DEFINITION: (p) => call(
       getActivityDefinitionByIdApiActivityActivityDefinitionActivityDefinitionIdGet,
       p,
       client2
     ),
-    // Activity — activity instances
+    // Activity instances
     GET_ACTIVITY_INSTANCES: (p) => call(getActivityInstancesApiActivityActivityInstanceGet, p, client2),
     GET_ACTIVITY_INSTANCE: (p) => call(getActivityInstanceApiActivityActivityInstanceActivityInstanceIdGet, p, client2),
     GET_ACTIVITY_INSTANCE_BY_PERIOD: (p) => call(
@@ -496,28 +538,43 @@ function createHandlerMap(options) {
       p,
       client2
     ),
-    // Activity — task definitions
+    // Task definitions
     GET_TASK_DEFINITIONS: (p) => call(getAllTasksDefinitionsApiActivityTaskDefinitionGet, p, client2),
     GET_TASK_DEFINITION: (p) => call(getTaskDefinitionByIdApiActivityTaskDefinitionTaskDefinitionIdGet, p, client2),
     CREATE_TASK_DEFINITION: (p) => call(createTaskDefinitionApiActivityTaskDefinitionPost, p, client2),
     UPDATE_TASK_DEFINITION: (p) => call(updateTaskDefinitionApiActivityTaskDefinitionTaskDefinitionIdPut, p, client2),
     GET_TASK_DEFINITIONS_BY_FILTER: (p) => call(getAllTasksDefinitionsByFilterApiActivityTaskDefinitionQueryPost, p, client2),
-    // Activity — task instances
+    // Task instances
     GET_TASK_INSTANCES: (p) => call(getAllTaskInstancesApiActivityTaskInstanceGet, p, client2),
     GET_TASK_INSTANCE: (p) => call(getTaskInstanceByIdApiActivityTaskInstanceTaskInstanceIdGet, p, client2),
     POST_TASK_OUTPUT: (p) => call(updateTaskInstanceApiActivityTaskInstanceTaskInstanceIdPut, p, client2),
-    GET_TASK_INSTANCES_BY_FILTER: (p) => call(getAllTaskInstancesByFilterApiActivityTaskInstanceQueryPost, p, client2),
-    // Audit trail
+    GET_TASK_INSTANCES_BY_FILTER: (p) => call(getAllTaskInstancesByFilterApiActivityTaskInstanceQueryPost, p, client2)
+  };
+}
+
+// src/handlers/audit-trail.ts
+function auditTrailHandlers(client2) {
+  return {
     GET_AUDIT_EVENTS: (p) => call(getEventsApiAuditTrailEventGet, p, client2),
-    GET_ENTITY_AUDIT_EVENTS: (p) => call(getEntityEventsApiAuditTrailEventEntityTargetTypeTargetIdPost, p, client2),
-    // Period manager
+    GET_ENTITY_AUDIT_EVENTS: (p) => call(getEntityEventsApiAuditTrailEventEntityTargetTypeTargetIdPost, p, client2)
+  };
+}
+
+// src/handlers/period-manager.ts
+function periodManagerHandlers(client2) {
+  return {
     GET_FISCAL_CALENDARS: (p) => call(
       getFiscalCalendarsBySubsidiaryApiPeriodManagerFiscalCalendarBySubsidiarySubsidiaryIdGet,
       p,
       client2
     ),
-    GET_FISCAL_CALENDAR: (p) => call(getFiscalCalendarByIdApiPeriodManagerFiscalCalendarCalendarIdGet, p, client2),
-    // Tenancy
+    GET_FISCAL_CALENDAR: (p) => call(getFiscalCalendarByIdApiPeriodManagerFiscalCalendarCalendarIdGet, p, client2)
+  };
+}
+
+// src/handlers/tenancy.ts
+function tenancyHandlers(client2) {
+  return {
     GET_SUBSIDIARIES: (p) => call(getAllSubsidiariesApiTenancySubsidiaryGet, p, client2),
     GET_SUBSIDIARY: (p) => call(getSubsidiaryApiTenancySubsidiarySubsidiaryIdGet, p, client2),
     GET_SUBSIDIARY_PARENT_CURRENCIES: (p) => call(
@@ -529,46 +586,115 @@ function createHandlerMap(options) {
   };
 }
 
-// src/uploadHandler.ts
-async function uploadHandler(payload, sendProgress) {
-  const attachmentId = crypto.randomUUID();
-  for (const progress of [25, 50, 75, 100]) {
-    await new Promise((r) => setTimeout(r, 400));
-    sendProgress({ attachmentId, progress });
+// src/handlerMap.ts
+function createHandlerMap(options) {
+  const client2 = createVibeApiClient(options);
+  return {
+    ...accountingHandlers(client2),
+    ...activityHandlers(client2),
+    ...auditTrailHandlers(client2),
+    ...periodManagerHandlers(client2),
+    ...tenancyHandlers(client2)
+  };
+}
+
+// src/rateLimiter.ts
+var DEFAULT_RATE_LIMIT = 60;
+function createRateLimiter(limit = DEFAULT_RATE_LIMIT, windowMs = 6e4) {
+  return { timestamps: [], limit, windowMs };
+}
+function checkRateLimit(state) {
+  const now = Date.now();
+  const cutoff = now - state.windowMs;
+  state.timestamps = state.timestamps.filter((t) => t > cutoff);
+  if (state.timestamps.length >= state.limit) {
+    return false;
   }
-  return { attachmentId, name: payload.fileName };
+  state.timestamps.push(now);
+  return true;
+}
+
+// src/unwired.ts
+function warnUnwired(command) {
+  return () => {
+    console.warn(`[vibe-host] Received "${command}" command but no handler is wired \u2014 ignoring.`);
+  };
+}
+function rejectUnwired(op) {
+  return () => Promise.reject(
+    new BridgeError("NOT_WIRED", `[vibe-host] Received "${op}" request but no handler is wired.`)
+  );
 }
 
 // src/VibeAppHost.ts
 var VibeAppHost = class {
-  constructor({ trustedOrigins, getContext, appBasePath, clientConfig }) {
+  constructor(opts) {
     this.iframeWindow = null;
+    /**
+     * Source windows we've already logged a successful handshake for. The bridge
+     * polls `GET_CONTEXT` on an interval until it connects, so without this the
+     * "Vibe App connected" line repeats on every poll (SSOT §13 F3).
+     */
+    this.handshakeLoggedWindows = /* @__PURE__ */ new WeakSet();
     this.kindHandlers = {
       request: (msg, source, origin) => this.handleRequest(msg, source, origin),
       command: (msg) => this.dispatchCommand(msg)
     };
-    this.commandHandlers = {
-      REPORT_SUBROUTE: (payload) => {
-        const newPath = payload.subroute === "/" ? this.appBasePath : `${this.appBasePath}${payload.subroute}`;
-        const method = payload.replace ? "replaceState" : "pushState";
-        window.history[method](null, "", newPath);
-      }
-    };
+    const { trustedOrigins, getContext, appBasePath, clientConfig } = opts;
     this.trustedOrigins = new Set(trustedOrigins);
     this.getContext = getContext;
     this.appBasePath = appBasePath;
+    this.onRequestComplete = opts.onRequestComplete;
+    this.rateLimiter = createRateLimiter(opts.rateLimit ?? DEFAULT_RATE_LIMIT);
     this.boundHandleMessage = this.handleMessage.bind(this);
     this.boundHandlePopState = this.handlePopState.bind(this);
-    this.handlers = this.initializeHandlers(clientConfig || { baseUrl: "", stripApiPrefix: false });
+    this.handlers = this.initializeHandlers(
+      clientConfig || { baseUrl: "", stripApiPrefix: false },
+      opts
+    );
+    this.commandHandlers = this.buildCommandHandlers(opts);
   }
   dispatchCommand(msg) {
     const handler = this.commandHandlers[msg.type];
-    handler(msg.payload);
+    if (!handler) {
+      console.warn(`[vibe-host] Received unknown command "${msg.type}" \u2014 ignoring.`);
+      return;
+    }
+    try {
+      handler(msg.payload);
+    } catch (err) {
+      console.warn(`[vibe-host] Command "${msg.type}" handler threw \u2014 ignoring.`, err);
+    }
   }
-  initializeHandlers(clientConfig) {
+  /**
+   * Commands: `REPORT_SUBROUTE` is handled internally (transport + traversal
+   * guard, item `l`); navigation/UI side effects are injected by the consumer,
+   * falling back to warn-and-ignore (DP4).
+   */
+  buildCommandHandlers(opts) {
+    return {
+      REPORT_SUBROUTE: (payload) => {
+        const safe = normalizeSubroute(payload.subroute);
+        if (safe === null) return;
+        const newPath = safe === "/" ? this.appBasePath : `${this.appBasePath}${safe}`;
+        const method = payload.replace ? "replaceState" : "pushState";
+        window.history[method](null, "", newPath);
+      },
+      NAVIGATE: opts.onNavigate ?? warnUnwired("NAVIGATE"),
+      SET_SIDE_NAV: opts.onSetSideNav ?? warnUnwired("SET_SIDE_NAV"),
+      SWITCH_SUBSIDIARY: opts.onSwitchSubsidiary ?? warnUnwired("SWITCH_SUBSIDIARY")
+    };
+  }
+  /**
+   * Requests: the built-in API map (hey-api), plus the injected/awaited side
+   * effects with safe defaults — unwired `UPLOAD_FILE` rejects with a coded
+   * error; unwired `INVALIDATE_CACHE` resolves to a no-op (DP4).
+   */
+  initializeHandlers(clientConfig, opts) {
     return {
       ...createHandlerMap(clientConfig),
-      UPLOAD_FILE: uploadHandler
+      UPLOAD_FILE: opts.onUpload ?? rejectUnwired("UPLOAD_FILE"),
+      INVALIDATE_CACHE: opts.onInvalidateCache ?? (async () => ({ invalidated: false }))
     };
   }
   /**
@@ -640,12 +766,33 @@ var VibeAppHost = class {
   async handleRequest(msg, source, origin) {
     const { requestId, type } = msg;
     if (type === "GET_CONTEXT") {
-      const ctx = { ...this.getContext(), hostVersion: version };
-      const bridgeVersion = msg.payload?.bridgeVersion ?? "unknown";
-      console.log(
-        `[vibe-host] Vibe App connected \u2014 bridge: ${bridgeVersion}, host: ${version}, tenant: ${ctx.tenant}, user: ${ctx.user.displayName}`
-      );
-      this.respond(source, origin, { kind: "response", type, requestId, ok: true, data: ctx });
+      try {
+        const ctx = { ...this.getContext(), hostVersion: version };
+        if (!this.handshakeLoggedWindows.has(source)) {
+          this.handshakeLoggedWindows.add(source);
+          const bridgeVersion = msg.payload?.bridgeVersion ?? "unknown";
+          console.log(
+            `[vibe-host] Vibe App connected \u2014 bridge: ${bridgeVersion}, host: ${version}, tenant: ${ctx.tenant}, user: ${ctx.user.displayName}`
+          );
+        }
+        this.respond(source, origin, { kind: "response", type, requestId, ok: true, data: ctx });
+      } catch (err) {
+        const error = err instanceof Error ? err.message : String(err);
+        const code = err instanceof BridgeError ? err.code : "CONTEXT_ERROR";
+        this.respond(source, origin, { kind: "response", type, requestId, ok: false, error, code });
+      }
+      return;
+    }
+    if (!checkRateLimit(this.rateLimiter)) {
+      this.respond(source, origin, {
+        kind: "response",
+        type,
+        requestId,
+        ok: false,
+        error: `Too many requests. Limit is ${this.rateLimiter.limit} per minute.`,
+        code: "RATE_LIMITED"
+      });
+      this.onRequestComplete?.({ type, ok: false, payload: msg.payload });
       return;
     }
     const sendProgress = (payload) => {
@@ -663,9 +810,21 @@ var VibeAppHost = class {
       const handler = this.handlers[type];
       const data = await handler(msg.payload, sendProgress);
       this.respond(source, origin, { kind: "response", type, requestId, ok: true, data });
+      this.onRequestComplete?.({ type, ok: true, payload: msg.payload });
     } catch (err) {
       const error = err instanceof Error ? err.message : String(err);
-      this.respond(source, origin, { kind: "response", type, requestId, ok: false, error });
+      const code = err instanceof BridgeError ? err.code : void 0;
+      const status = err instanceof HttpBridgeError ? err.status : void 0;
+      this.respond(source, origin, {
+        kind: "response",
+        type,
+        requestId,
+        ok: false,
+        error,
+        code,
+        status
+      });
+      this.onRequestComplete?.({ type, ok: false, payload: msg.payload });
     }
   }
   respond(target, origin, response) {
@@ -677,5 +836,7 @@ var VibeAppHost = class {
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  BridgeError,
+  HttpBridgeError,
   VibeAppHost
 });