@nominalso/vibe-host 0.1.0 → 0.3.0

package/README.md

@@ -18,7 +18,8 @@ Externalizes only `@hey-api/client-fetch`; TypeScript types are self-contained.
 import { VibeAppHost } from '@nominalso/vibe-host'
 
 const host = new VibeAppHost({
-  // Iframe origin(s) allowed to talk to this host — must match exactly.
+  // Iframe origin(s) allowed to talk to this host. Exact origins, or glob
+  // patterns (e.g. 'https://*.vercel.app') — add patterns only in non-prod.
   trustedOrigins: ['https://my-vibe-app.lovable.app'],
   // This Vibe App's base path in nom-ui (used to sync the browser URL).
   appBasePath: `/${tenant}/${subsidiary}/apps/${slug}`,
@@ -37,15 +38,28 @@ const unmount = host.mount()
 
 ### `new VibeAppHost(options)`
 
-| Option           | Type                    | Description                                                                                               |
-| ---------------- | ----------------------- | --------------------------------------------------------------------------------------------------------- |
-| `trustedOrigins` | `string[]`              | Iframe origins allowed to talk to this host. Messages from other origins are ignored.                     |
-| `getContext`     | `() => HostContext`     | Returns the current context to send to the iframe (`hostVersion` is injected automatically).              |
-| `appBasePath`    | `string`                | Base URL path of this Vibe App in nom-ui, e.g. `/acme/1/apps/fixed-assets`.                               |
-| `clientConfig`   | `VibeApiClientOptions?` | Points the built-in handler map at the Nominal API. Defaults to `{ baseUrl: '', stripApiPrefix: false }`. |
+| Option           | Type                    | Description                                                                                                                                                                                        |
+| ---------------- | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `trustedOrigins` | `string[]`              | Iframe origins allowed to talk to this host — exact origins or glob patterns (`https://*.vercel.app`, honoured unconditionally, so add only in non-prod). Messages from other origins are ignored. |
+| `getContext`     | `() => HostContext`     | Returns the current context to send to the iframe (`hostVersion` is injected automatically).                                                                                                       |
+| `appBasePath`    | `string`                | Base URL path of this Vibe App in nom-ui, e.g. `/acme/1/apps/fixed-assets`.                                                                                                                        |
+| `clientConfig`   | `VibeApiClientOptions?` | Points the built-in handler map at the Nominal API. Defaults to `{ baseUrl: '', stripApiPrefix: false }`.                                                                                          |
 
 `VibeApiClientOptions` is `{ baseUrl: string; stripApiPrefix?: boolean }`. Set `stripApiPrefix: true` when routing through a proxy whose convention expects paths without the `/api` prefix.
 
+#### Testing preview deployments with `trustedOrigins` patterns
+
+A pattern entry's `*` matches exactly one DNS label or port — anchored, scheme literal — so `https://*.vercel.app` matches `https://pr-7.vercel.app` but not `https://a.b.vercel.app` or `https://pr-7.vercel.app.evil.com`. Patterns are honoured unconditionally, so **gate the list on your own deploy environment** — keep production exact-only:
+
+```ts
+const trustedOrigins =
+  process.env.NOM_ENV === 'production'
+    ? ['https://app.nominal.so']
+    : ['https://app.nominal.so', 'https://*.vercel.app', 'https://*.lovable.app']
+```
+
+Because you cannot `postMessage` to a pattern, proactive context/subroute pushes target the exact entries plus any origin seen on a validated inbound message; a pattern-matched iframe still receives context via its `connect()` poll response.
+
 ### `mount(iframeWindow?): () => void`
 
 Starts listening for bridge messages and sets up browser back/forward sync. Returns a cleanup function. Pass `iframeWindow` to immediately push context; if omitted, the host answers `GET_CONTEXT` polls but won't proactively push until you call `pushContextTo`.

package/dist/index.cjs

@@ -20,14 +20,28 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  BridgeError: () => BridgeError,
+  HttpBridgeError: () => HttpBridgeError,
   VibeAppHost: () => VibeAppHost
 });
 module.exports = __toCommonJS(index_exports);
 
 // package.json
-var version = "0.1.0";
+var version = "0.3.0";
 
 // ../protocol-types/dist/index.js
+function normalizeSubroute(subroute) {
+  const normalized = subroute.startsWith("/") ? subroute : `/${subroute}`;
+  const path = normalized.split(/[?#]/)[0];
+  let decoded = path;
+  let prev;
+  do {
+    prev = decoded;
+    decoded = decoded.replace(/%25/gi, "%").replace(/%2e/gi, ".").replace(/%2f/gi, "/");
+  } while (decoded !== prev);
+  if (decoded.split("/").some((segment) => segment === "..")) return null;
+  return normalized;
+}
 var PROTOCOL_ID = "nominal-vibe-bridge";
 var PROTOCOL_VERSION = 1;
 var BRIDGE_KINDS = ["request", "response", "push", "command", "progress"];
@@ -44,6 +58,47 @@ function isBridgeMessage(data) {
   if (CORRELATED_KINDS_SET.has(d.kind) && typeof d.requestId !== "string") return false;
   return true;
 }
+var BridgeError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "BridgeError";
+  }
+};
+var HttpBridgeError = class extends BridgeError {
+  constructor(status, message) {
+    super("REQUEST_FAILED", message);
+    this.status = status;
+    this.name = "HttpBridgeError";
+  }
+};
+function isOriginPattern(entry) {
+  return entry.includes("*");
+}
+var patternCache = /* @__PURE__ */ new Map();
+function patternToRegExp(pattern) {
+  const cached = patternCache.get(pattern);
+  if (cached) return cached;
+  const escaped = pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const body = escaped.replace(/\\\*/g, "[^./:@?#\\s]+");
+  const compiled = new RegExp(`^${body}$`);
+  patternCache.set(pattern, compiled);
+  return compiled;
+}
+function matchesOrigin(origin, entry) {
+  if (!isOriginPattern(entry)) return origin === entry;
+  return patternToRegExp(entry).test(origin);
+}
+function isOriginAllowed(origin, allowlist, { allowPatterns }) {
+  for (const entry of allowlist) {
+    if (isOriginPattern(entry)) {
+      if (allowPatterns && matchesOrigin(origin, entry)) return true;
+    } else if (origin === entry) {
+      return true;
+    }
+  }
+  return false;
+}
 
 // ../api-client/dist/index.js
 var import_client_fetch = require("@hey-api/client-fetch");
@@ -375,10 +430,6 @@ var getSubsidiaryParentCurrenciesApiTenancySubsidiarySubsidiaryIdParentCurrencie
 };
 function createVibeApiClient({ baseUrl, stripApiPrefix }) {
   const client2 = (0, import_client_fetch2.createClient)((0, import_client_fetch2.createConfig)({ baseUrl }));
-  client2.interceptors.request.use((request) => {
-    console.log("[vibe-api-client] request url:", request.url);
-    return request;
-  });
   if (stripApiPrefix) {
     client2.interceptors.request.use(
       (request) => new Request(request.url.replace(`${baseUrl}/api/`, `${baseUrl}/`), request)
@@ -387,16 +438,28 @@ function createVibeApiClient({ baseUrl, stripApiPrefix }) {
   return client2;
 }
 
-// src/handlerMap.ts
+// src/handlers/call.ts
 async function call(fn, payload, client2) {
-  const { data } = await fn({ ...payload, client: client2 });
-  if (data == null) throw new Error("API returned no data");
+  const { data, response } = await fn({ ...payload, client: client2 });
+  if (data == null) {
+    if (response && !response.ok) {
+      throw new HttpBridgeError(
+        response.status,
+        `API request failed with status ${response.status}`
+      );
+    }
+    if (!response) {
+      throw new Error("API request produced no response");
+    }
+    return null;
+  }
   return data;
 }
-function createHandlerMap(options) {
-  const client2 = createVibeApiClient(options);
+
+// src/handlers/accounting.ts
+function accountingHandlers(client2) {
   return {
-    // Accounting — chart of accounts
+    // Chart of accounts
     GET_CHART_OF_ACCOUNTS: (p) => call(getCoaFlatApiAccountingSubsidiarySubsidiaryIdCoaAccountGet, p, client2),
     GET_COA_TREE: (p) => call(getCoaTreeApiAccountingSubsidiarySubsidiaryIdCoaGet, p, client2),
     GET_COA_FLAT_SIMPLE: (p) => call(
@@ -421,7 +484,7 @@ function createHandlerMap(options) {
     ),
     GET_ACCOUNTS: (p) => call(getAccountsApiAccountingAccountGet, p, client2),
     GET_ACCOUNT: (p) => call(getAccountApiAccountingAccountAccountIdGet, p, client2),
-    // Accounting — exchange rates
+    // Exchange rates
     GET_CONVERSION_RATES: (p) => call(getConversionRateApiAccountingCurrencyCurrencyConversionRatesGet, p, client2),
     GET_EFFECTIVE_EXCHANGE_RATE: (p) => call(getEffectiveExchangeRateApiAccountingConsolidationExchangeRateGet, p, client2),
     GET_EXCHANGE_RATE_BY_DATE: (p) => call(
@@ -429,7 +492,7 @@ function createHandlerMap(options) {
       p,
       client2
     ),
-    // Accounting — dimensions
+    // Dimensions
     GET_DIMENSIONS: (p) => call(getDimensionsApiAccountingDimensionGet, p, client2),
     GET_DIMENSION_VALUES: (p) => call(getDimensionValuesApiAccountingDimensionValueGet, p, client2),
     GET_DIMENSION_VALUES_HIERARCHICAL: (p) => call(
@@ -442,7 +505,7 @@ function createHandlerMap(options) {
       p,
       client2
     ),
-    // Accounting — journal entries
+    // Journal entries
     GET_JOURNAL_ENTRIES: (p) => call(
       getSubsidiaryJournalApiAccountingSubsidiarySubsidiaryIdJournalEntryGet,
       p,
@@ -457,8 +520,14 @@ function createHandlerMap(options) {
       getJournalEntryApiAccountingSubsidiarySubsidiaryIdJournalEntryJournalEntryIdGet,
       p,
       client2
-    ),
-    // Activity — period instances
+    )
+  };
+}
+
+// src/handlers/activity.ts
+function activityHandlers(client2) {
+  return {
+    // Period instances
     GET_PERIODS: (p) => call(getPeriodInstancesApiActivityPeriodInstanceGet, p, client2),
     GET_PERIOD_INSTANCE: (p) => call(getPeriodInstanceApiActivityPeriodInstancePeriodInstanceIdGet, p, client2),
     GET_PERIOD_INSTANCE_BY_SLUG: (p) => call(
@@ -471,14 +540,14 @@ function createHandlerMap(options) {
       p,
       client2
     ),
-    // Activity — activity definitions
+    // Activity definitions
     GET_ACTIVITY_DEFINITIONS: (p) => call(getActivityDefinitionsApiActivityActivityDefinitionGet, p, client2),
     GET_ACTIVITY_DEFINITION: (p) => call(
       getActivityDefinitionByIdApiActivityActivityDefinitionActivityDefinitionIdGet,
       p,
       client2
     ),
-    // Activity — activity instances
+    // Activity instances
     GET_ACTIVITY_INSTANCES: (p) => call(getActivityInstancesApiActivityActivityInstanceGet, p, client2),
     GET_ACTIVITY_INSTANCE: (p) => call(getActivityInstanceApiActivityActivityInstanceActivityInstanceIdGet, p, client2),
     GET_ACTIVITY_INSTANCE_BY_PERIOD: (p) => call(
@@ -496,28 +565,43 @@ function createHandlerMap(options) {
       p,
       client2
     ),
-    // Activity — task definitions
+    // Task definitions
     GET_TASK_DEFINITIONS: (p) => call(getAllTasksDefinitionsApiActivityTaskDefinitionGet, p, client2),
     GET_TASK_DEFINITION: (p) => call(getTaskDefinitionByIdApiActivityTaskDefinitionTaskDefinitionIdGet, p, client2),
     CREATE_TASK_DEFINITION: (p) => call(createTaskDefinitionApiActivityTaskDefinitionPost, p, client2),
     UPDATE_TASK_DEFINITION: (p) => call(updateTaskDefinitionApiActivityTaskDefinitionTaskDefinitionIdPut, p, client2),
     GET_TASK_DEFINITIONS_BY_FILTER: (p) => call(getAllTasksDefinitionsByFilterApiActivityTaskDefinitionQueryPost, p, client2),
-    // Activity — task instances
+    // Task instances
     GET_TASK_INSTANCES: (p) => call(getAllTaskInstancesApiActivityTaskInstanceGet, p, client2),
     GET_TASK_INSTANCE: (p) => call(getTaskInstanceByIdApiActivityTaskInstanceTaskInstanceIdGet, p, client2),
     POST_TASK_OUTPUT: (p) => call(updateTaskInstanceApiActivityTaskInstanceTaskInstanceIdPut, p, client2),
-    GET_TASK_INSTANCES_BY_FILTER: (p) => call(getAllTaskInstancesByFilterApiActivityTaskInstanceQueryPost, p, client2),
-    // Audit trail
+    GET_TASK_INSTANCES_BY_FILTER: (p) => call(getAllTaskInstancesByFilterApiActivityTaskInstanceQueryPost, p, client2)
+  };
+}
+
+// src/handlers/audit-trail.ts
+function auditTrailHandlers(client2) {
+  return {
     GET_AUDIT_EVENTS: (p) => call(getEventsApiAuditTrailEventGet, p, client2),
-    GET_ENTITY_AUDIT_EVENTS: (p) => call(getEntityEventsApiAuditTrailEventEntityTargetTypeTargetIdPost, p, client2),
-    // Period manager
+    GET_ENTITY_AUDIT_EVENTS: (p) => call(getEntityEventsApiAuditTrailEventEntityTargetTypeTargetIdPost, p, client2)
+  };
+}
+
+// src/handlers/period-manager.ts
+function periodManagerHandlers(client2) {
+  return {
     GET_FISCAL_CALENDARS: (p) => call(
       getFiscalCalendarsBySubsidiaryApiPeriodManagerFiscalCalendarBySubsidiarySubsidiaryIdGet,
       p,
       client2
     ),
-    GET_FISCAL_CALENDAR: (p) => call(getFiscalCalendarByIdApiPeriodManagerFiscalCalendarCalendarIdGet, p, client2),
-    // Tenancy
+    GET_FISCAL_CALENDAR: (p) => call(getFiscalCalendarByIdApiPeriodManagerFiscalCalendarCalendarIdGet, p, client2)
+  };
+}
+
+// src/handlers/tenancy.ts
+function tenancyHandlers(client2) {
+  return {
     GET_SUBSIDIARIES: (p) => call(getAllSubsidiariesApiTenancySubsidiaryGet, p, client2),
     GET_SUBSIDIARY: (p) => call(getSubsidiaryApiTenancySubsidiarySubsidiaryIdGet, p, client2),
     GET_SUBSIDIARY_PARENT_CURRENCIES: (p) => call(
@@ -529,46 +613,122 @@ function createHandlerMap(options) {
   };
 }
 
-// src/uploadHandler.ts
-async function uploadHandler(payload, sendProgress) {
-  const attachmentId = crypto.randomUUID();
-  for (const progress of [25, 50, 75, 100]) {
-    await new Promise((r) => setTimeout(r, 400));
-    sendProgress({ attachmentId, progress });
+// src/handlerMap.ts
+function createHandlerMap(options) {
+  const client2 = createVibeApiClient(options);
+  return {
+    ...accountingHandlers(client2),
+    ...activityHandlers(client2),
+    ...auditTrailHandlers(client2),
+    ...periodManagerHandlers(client2),
+    ...tenancyHandlers(client2)
+  };
+}
+
+// src/rateLimiter.ts
+var DEFAULT_RATE_LIMIT = 60;
+function createRateLimiter(limit = DEFAULT_RATE_LIMIT, windowMs = 6e4) {
+  return { timestamps: [], limit, windowMs };
+}
+function checkRateLimit(state) {
+  const now = Date.now();
+  const cutoff = now - state.windowMs;
+  state.timestamps = state.timestamps.filter((t) => t > cutoff);
+  if (state.timestamps.length >= state.limit) {
+    return false;
   }
-  return { attachmentId, name: payload.fileName };
+  state.timestamps.push(now);
+  return true;
+}
+
+// src/unwired.ts
+function warnUnwired(command) {
+  return () => {
+    console.warn(`[vibe-host] Received "${command}" command but no handler is wired \u2014 ignoring.`);
+  };
+}
+function rejectUnwired(op) {
+  return () => Promise.reject(
+    new BridgeError("NOT_WIRED", `[vibe-host] Received "${op}" request but no handler is wired.`)
+  );
 }
 
 // src/VibeAppHost.ts
 var VibeAppHost = class {
-  constructor({ trustedOrigins, getContext, appBasePath, clientConfig }) {
+  constructor(opts) {
+    /**
+     * Concrete iframe origins observed on validated inbound messages. Because you
+     * cannot `postMessage` to a glob pattern, proactive pushes target these
+     * learned origins (plus the exact allowlist entries) rather than the patterns.
+     */
+    this.connectedOrigins = /* @__PURE__ */ new Set();
     this.iframeWindow = null;
+    /**
+     * Source windows we've already logged a successful handshake for. The bridge
+     * polls `GET_CONTEXT` on an interval until it connects, so without this the
+     * "Vibe App connected" line repeats on every poll (SSOT §13 F3).
+     */
+    this.handshakeLoggedWindows = /* @__PURE__ */ new WeakSet();
     this.kindHandlers = {
       request: (msg, source, origin) => this.handleRequest(msg, source, origin),
       command: (msg) => this.dispatchCommand(msg)
     };
-    this.commandHandlers = {
-      REPORT_SUBROUTE: (payload) => {
-        const newPath = payload.subroute === "/" ? this.appBasePath : `${this.appBasePath}${payload.subroute}`;
-        const method = payload.replace ? "replaceState" : "pushState";
-        window.history[method](null, "", newPath);
-      }
-    };
+    const { trustedOrigins, getContext, appBasePath, clientConfig } = opts;
     this.trustedOrigins = new Set(trustedOrigins);
+    this.exactOrigins = trustedOrigins.filter((entry) => !isOriginPattern(entry));
     this.getContext = getContext;
     this.appBasePath = appBasePath;
+    this.onRequestComplete = opts.onRequestComplete;
+    this.rateLimiter = createRateLimiter(opts.rateLimit ?? DEFAULT_RATE_LIMIT);
     this.boundHandleMessage = this.handleMessage.bind(this);
     this.boundHandlePopState = this.handlePopState.bind(this);
-    this.handlers = this.initializeHandlers(clientConfig || { baseUrl: "", stripApiPrefix: false });
+    this.handlers = this.initializeHandlers(
+      clientConfig || { baseUrl: "", stripApiPrefix: false },
+      opts
+    );
+    this.commandHandlers = this.buildCommandHandlers(opts);
   }
   dispatchCommand(msg) {
     const handler = this.commandHandlers[msg.type];
-    handler(msg.payload);
+    if (!handler) {
+      console.warn(`[vibe-host] Received unknown command "${msg.type}" \u2014 ignoring.`);
+      return;
+    }
+    try {
+      handler(msg.payload);
+    } catch (err) {
+      console.warn(`[vibe-host] Command "${msg.type}" handler threw \u2014 ignoring.`, err);
+    }
   }
-  initializeHandlers(clientConfig) {
+  /**
+   * Commands: `REPORT_SUBROUTE` is handled internally (transport + traversal
+   * guard, item `l`); navigation/UI side effects are injected by the consumer,
+   * falling back to warn-and-ignore (DP4).
+   */
+  buildCommandHandlers(opts) {
+    return {
+      REPORT_SUBROUTE: (payload) => {
+        const safe = normalizeSubroute(payload.subroute);
+        if (safe === null) return;
+        const newPath = safe === "/" ? this.appBasePath : `${this.appBasePath}${safe}`;
+        const method = payload.replace ? "replaceState" : "pushState";
+        window.history[method](null, "", newPath);
+      },
+      NAVIGATE: opts.onNavigate ?? warnUnwired("NAVIGATE"),
+      SET_SIDE_NAV: opts.onSetSideNav ?? warnUnwired("SET_SIDE_NAV"),
+      SWITCH_SUBSIDIARY: opts.onSwitchSubsidiary ?? warnUnwired("SWITCH_SUBSIDIARY")
+    };
+  }
+  /**
+   * Requests: the built-in API map (hey-api), plus the injected/awaited side
+   * effects with safe defaults — unwired `UPLOAD_FILE` rejects with a coded
+   * error; unwired `INVALIDATE_CACHE` resolves to a no-op (DP4).
+   */
+  initializeHandlers(clientConfig, opts) {
     return {
       ...createHandlerMap(clientConfig),
-      UPLOAD_FILE: uploadHandler
+      UPLOAD_FILE: opts.onUpload ?? rejectUnwired("UPLOAD_FILE"),
+      INVALIDATE_CACHE: opts.onInvalidateCache ?? (async () => ({ invalidated: false }))
     };
   }
   /**
@@ -589,6 +749,7 @@ var VibeAppHost = class {
       window.removeEventListener("message", this.boundHandleMessage);
       window.removeEventListener("popstate", this.boundHandlePopState);
       this.iframeWindow = null;
+      this.connectedOrigins.clear();
     };
   }
   /**
@@ -608,7 +769,7 @@ var VibeAppHost = class {
       type: "CONTEXT_PUSH",
       payload: { ...this.getContext(), hostVersion: version }
     };
-    for (const origin of this.trustedOrigins) {
+    for (const origin of this.concreteTargets()) {
       target.postMessage(message, origin);
     }
   }
@@ -628,24 +789,55 @@ var VibeAppHost = class {
       type,
       payload
     };
-    for (const origin of this.trustedOrigins) {
+    for (const origin of this.concreteTargets()) {
       this.iframeWindow.postMessage(message, origin);
     }
   }
   async handleMessage(event) {
-    if (!this.trustedOrigins.has(event.origin)) return;
+    if (!isOriginAllowed(event.origin, this.trustedOrigins, { allowPatterns: true })) return;
     if (!isBridgeMessage(event.data)) return;
+    this.connectedOrigins.add(event.origin);
     await this.kindHandlers[event.data.kind]?.(event.data, event.source, event.origin);
   }
+  /**
+   * Concrete origins a proactive push may target: the exact allowlist entries
+   * plus any origins seen on validated inbound messages. Never includes glob
+   * patterns (you cannot `postMessage` to one). When only exact origins are
+   * configured this equals the configured set, so behaviour is unchanged.
+   */
+  concreteTargets() {
+    return /* @__PURE__ */ new Set([...this.exactOrigins, ...this.connectedOrigins]);
+  }
   async handleRequest(msg, source, origin) {
     const { requestId, type } = msg;
     if (type === "GET_CONTEXT") {
-      const ctx = { ...this.getContext(), hostVersion: version };
-      const bridgeVersion = msg.payload?.bridgeVersion ?? "unknown";
-      console.log(
-        `[vibe-host] Vibe App connected \u2014 bridge: ${bridgeVersion}, host: ${version}, tenant: ${ctx.tenant}, user: ${ctx.user.displayName}`
-      );
-      this.respond(source, origin, { kind: "response", type, requestId, ok: true, data: ctx });
+      try {
+        const ctx = { ...this.getContext(), hostVersion: version };
+        if (!this.handshakeLoggedWindows.has(source)) {
+          this.handshakeLoggedWindows.add(source);
+          const bridgeVersion = msg.payload?.bridgeVersion ?? "unknown";
+          console.log(
+            `[vibe-host] Vibe App connected \u2014 bridge: ${bridgeVersion}, host: ${version}, tenant: ${ctx.tenant}, user: ${ctx.user.displayName}`
+          );
+        }
+        this.respond(source, origin, { kind: "response", type, requestId, ok: true, data: ctx });
+      } catch (err) {
+        const error = err instanceof Error ? err.message : String(err);
+        const code = err instanceof BridgeError ? err.code : "CONTEXT_ERROR";
+        this.respond(source, origin, { kind: "response", type, requestId, ok: false, error, code });
+      }
+      return;
+    }
+    if (!checkRateLimit(this.rateLimiter)) {
+      this.respond(source, origin, {
+        kind: "response",
+        type,
+        requestId,
+        ok: false,
+        error: `Too many requests. Limit is ${this.rateLimiter.limit} per minute.`,
+        code: "RATE_LIMITED"
+      });
+      this.onRequestComplete?.({ type, ok: false, payload: msg.payload });
       return;
     }
     const sendProgress = (payload) => {
@@ -663,9 +855,21 @@ var VibeAppHost = class {
       const handler = this.handlers[type];
       const data = await handler(msg.payload, sendProgress);
       this.respond(source, origin, { kind: "response", type, requestId, ok: true, data });
+      this.onRequestComplete?.({ type, ok: true, payload: msg.payload });
     } catch (err) {
       const error = err instanceof Error ? err.message : String(err);
-      this.respond(source, origin, { kind: "response", type, requestId, ok: false, error });
+      const code = err instanceof BridgeError ? err.code : void 0;
+      const status = err instanceof HttpBridgeError ? err.status : void 0;
+      this.respond(source, origin, {
+        kind: "response",
+        type,
+        requestId,
+        ok: false,
+        error,
+        code,
+        status
+      });
+      this.onRequestComplete?.({ type, ok: false, payload: msg.payload });
     }
   }
   respond(target, origin, response) {
@@ -677,5 +881,7 @@ var VibeAppHost = class {
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  BridgeError,
+  HttpBridgeError,
   VibeAppHost
 });