@procedures/client 0.2.3 → 0.4.0

package/dist/server/request-auth.js

@@ -0,0 +1,32 @@
+/**
+ * The credentials of a network request (roadmap R18). A server transport reads them into
+ * `ServerRequest.credentials`, and leaves the secret headers out of the metadata, so a handler
+ * and a nested call do not see them. `ProcedureServer` examines them.
+ */
+/** The headers that carry a secret. They do not go into the metadata of a request. */
+const SECRET_HEADERS = new Set(["authorization", "proxy-authorization", "cookie", "x-api-key"]);
+/** The headers without the secret ones, and without the headers that are not text. */
+export function withoutSecretHeaders(headers) {
+    const out = {};
+    for (const [key, value] of Object.entries(headers)) {
+        if (!SECRET_HEADERS.has(key.toLowerCase()) && typeof value === "string")
+            out[key] = value;
+    }
+    return out;
+}
+/** The token of an `Authorization: Bearer <token>` header, or undefined. */
+export function bearerOf(header) {
+    return typeof header === "string" && header.startsWith("Bearer ") ? header.slice("Bearer ".length) : undefined;
+}
+/**
+ * The credentials of a request or of a WebSocket upgrade: the bearer token of its
+ * `Authorization` header, or else of its `token` query (a browser WebSocket cannot set headers).
+ */
+export function credentialsOf(request) {
+    const bearer = bearerOf(request.headers["authorization"]);
+    if (bearer !== undefined)
+        return { bearer };
+    const query = new URL(request.url ?? "/", "http://localhost").searchParams.get("token");
+    return query === null ? {} : { bearer: query };
+}
+//# sourceMappingURL=request-auth.js.map

package/dist/server/request-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-auth.js","sourceRoot":"","sources":["../../src/server/request-auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,sFAAsF;AACtF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,qBAAqB,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAEhG,sFAAsF;AACtF,MAAM,UAAU,oBAAoB,CAAC,OAAgC;IACnE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC5F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,QAAQ,CAAC,MAAe;IACtC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAAuE;IACnG,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;IAC1D,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxF,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACjD,CAAC"}

package/dist/server/types.d.ts

@@ -21,6 +21,38 @@ export interface ServerRequest<TReq = unknown> {
     metadata: Metadata;
     /** Abort signal for cancellation */
     signal?: AbortSignal;
+    /**
+     * The credentials that a network transport read from the request: the bearer token of an
+     * `Authorization` header, or of the `token` query of a WebSocket connection (roadmap R18). They
+     * are not in the metadata, so a handler and a nested call do not see them. A request without
+     * credentials comes from this process (a direct `handle()`, MCP over stdio).
+     */
+    credentials?: Credentials | undefined;
+    /** The principal of the request: who sends it. `ProcedureServer` sets it when it authenticates the request. */
+    principal?: Principal | undefined;
+}
+/** The credentials of a request. */
+export interface Credentials {
+    /** The bearer token that the request presents. */
+    readonly bearer?: string | undefined;
+}
+/** Who sends a request (roadmap R18). */
+export interface Principal {
+    /** The id of the principal. With the token of a host: "token". */
+    readonly id: string;
+    /** How the server authenticated it: "token", or the name of an authenticate function. */
+    readonly via: string;
+    /** More facts about the principal, from an authenticate function. */
+    readonly claims?: Readonly<Record<string, unknown>> | undefined;
+}
+/**
+ * The contract of a server transport (roadmap R18): a transport turns each protocol request
+ * into a `ServerRequest` (with its signal and its credentials), gives it to `handle()`, and turns
+ * the `ServerResponse` back (a value, a stream or an error). `Server` and `ProcedureServer`
+ * satisfy it, and a test can give a function.
+ */
+export interface RequestHandler {
+    handle(request: ServerRequest): Promise<ServerResponse>;
 }
 /**
  * Server response in unified RPC format.

package/dist/server/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/server/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAGnE,YAAY,EAAE,MAAM,EAAE,CAAC;AAEvB;;;GAGG;AACH,MAAM,WAAW,aAAa,CAAC,IAAI,GAAG,OAAO;IAC3C,mDAAmD;IACnD,EAAE,EAAE,MAAM,CAAC;IAEX,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IAEf,sBAAsB;IACtB,OAAO,EAAE,IAAI,CAAC;IAEd,qDAAqD;IACrD,QAAQ,EAAE,QAAQ,CAAC;IAEnB,oCAAoC;IACpC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc,CAAC,IAAI,GAAG,OAAO;IAC5C,mCAAmC;IACnC,EAAE,EAAE,MAAM,CAAC;IAEX,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IAEf,iDAAiD;IACjD,OAAO,CAAC,EAAE,IAAI,CAAC;IAEf;;;;OAIG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;IAE7B,wBAAwB;IACxB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,CAAC,IAAI,GAAG,OAAO,EAAE,IAAI,GAAG,OAAO,IAAI,CAC1D,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,KACzB,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;AAE1D;;;GAGG;AACH,MAAM,WAAW,aAAa,CAAC,IAAI,GAAG,OAAO;IAC3C,2BAA2B;IAC3B,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;IAE7B,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,CAAC,IAAI,GAAG,OAAO,EAAE,IAAI,GAAG,OAAO,IAAI,CACzD,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,KACzB,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;AAEnC;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,IAAI,GAAG,OAAO,EAAE,IAAI,GAAG,OAAO,IAAI,CAC7D,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,KAC3B,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAE9B;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvB;;;OAGG;IACH,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtB;;OAEG;IACH,SAAS,IAAI,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,MAAM,EAAE,MAAM,EAOzB;CACF;AAED;;GAEG;AACH,qBAAa,WAAY,SAAQ,KAAK;aAGlB,IAAI,EAAE,MAAM;aACZ,SAAS,EAAE,OAAO;IAHpC,YACE,OAAO,EAAE,MAAM,EACC,IAAI,GAAE,MAAc,EACpB,SAAS,GAAE,OAAe,EAI3C;CACF"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/server/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAGnE,YAAY,EAAE,MAAM,EAAE,CAAC;AAEvB;;;GAGG;AACH,MAAM,WAAW,aAAa,CAAC,IAAI,GAAG,OAAO;IAC3C,mDAAmD;IACnD,EAAE,EAAE,MAAM,CAAC;IAEX,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IAEf,sBAAsB;IACtB,OAAO,EAAE,IAAI,CAAC;IAEd,qDAAqD;IACrD,QAAQ,EAAE,QAAQ,CAAC;IAEnB,oCAAoC;IACpC,MAAM,CAAC,EAAE,WAAW,CAAC;IAErB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAEtC,+GAA+G;IAC/G,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CACnC;AAED,oCAAoC;AACpC,MAAM,WAAW,WAAW;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED,yCAAyC;AACzC,MAAM,WAAW,SAAS;IACxB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,yFAAyF;IACzF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;CACjE;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACzD;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc,CAAC,IAAI,GAAG,OAAO;IAC5C,mCAAmC;IACnC,EAAE,EAAE,MAAM,CAAC;IAEX,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IAEf,iDAAiD;IACjD,OAAO,CAAC,EAAE,IAAI,CAAC;IAEf;;;;OAIG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;IAE7B,wBAAwB;IACxB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,CAAC,IAAI,GAAG,OAAO,EAAE,IAAI,GAAG,OAAO,IAAI,CAC1D,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,KACzB,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;AAE1D;;;GAGG;AACH,MAAM,WAAW,aAAa,CAAC,IAAI,GAAG,OAAO;IAC3C,2BAA2B;IAC3B,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;IAE7B,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,CAAC,IAAI,GAAG,OAAO,EAAE,IAAI,GAAG,OAAO,IAAI,CACzD,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,KACzB,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;AAEnC;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,IAAI,GAAG,OAAO,EAAE,IAAI,GAAG,OAAO,IAAI,CAC7D,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,KAC3B,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAE9B;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvB;;;OAGG;IACH,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtB;;OAEG;IACH,SAAS,IAAI,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,MAAM,EAAE,MAAM,EAOzB;CACF;AAED;;GAEG;AACH,qBAAa,WAAY,SAAQ,KAAK;aAGlB,IAAI,EAAE,MAAM;aACZ,SAAS,EAAE,OAAO;IAHpC,YACE,OAAO,EAAE,MAAM,EACC,IAAI,GAAE,MAAc,EACpB,SAAS,GAAE,OAAe,EAI3C;CACF"}

package/dist/server/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/server/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAmHH;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,MAAc;QACxB,KAAK,CACH,wBAAwB,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,GACxD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAC7C,EAAE,CACH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGlB,IAAI;IACJ,SAAS;IAH3B,YACE,OAAe,EACC,IAAI,GAAW,KAAK,EACpB,SAAS,GAAY,KAAK;QAE1C,KAAK,CAAC,OAAO,CAAC,CAAC;oBAHC,IAAI;yBACJ,SAAS;QAGzB,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/server/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAwJH;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,MAAc;QACxB,KAAK,CACH,wBAAwB,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,GACxD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAC7C,EAAE,CACH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGlB,IAAI;IACJ,SAAS;IAH3B,YACE,OAAe,EACC,IAAI,GAAW,KAAK,EACpB,SAAS,GAAY,KAAK;QAE1C,KAAK,CAAC,OAAO,CAAC,CAAC;oBAHC,IAAI;yBACJ,SAAS;QAGzB,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF"}

package/dist/timers.d.ts

@@ -0,0 +1,60 @@
+/**
+ * The timer settings of the core, as data (roadmap R34).
+ *
+ * Each default time of the middleware, the transports and the server comes from this object, so
+ * a tool can read the settings without a call. `@procedures/systems` binds them to the symbols of
+ * the timer law of `systems`, and examines rules such as "the time of one try is less than the
+ * request time of the WebSocket". The values are milliseconds. The options of an application
+ * are Durations (roadmap R11), and they replace these values.
+ */
+/** The default times of the core, in milliseconds. */
+export interface TimerDefaults {
+    readonly retry: {
+        /** The tries after the first one. */
+        readonly maxRetries: number;
+        readonly retryDelayMs: number;
+        readonly backoffMultiplier: number;
+        /** The longest backoff. Infinity: no limit. */
+        readonly maxDelayMs: number;
+    };
+    readonly circuitBreaker: {
+        readonly failureWindowMs: number;
+        readonly resetTimeoutMs: number;
+    };
+    readonly cache: {
+        readonly ttlMs: number;
+        readonly statsIntervalMs: number;
+    };
+    readonly rateLimit: {
+        readonly windowMs: number;
+    };
+    readonly webSocketClient: {
+        /** The time of the handshake. */
+        readonly connectionTimeoutMs: number;
+        /** The time until the first frame of a call. */
+        readonly requestTimeoutMs: number;
+        readonly heartbeatIntervalMs: number;
+        readonly heartbeatTimeoutMs: number;
+        /** The pongs that can go missing, one after the other, before the connection closes. */
+        readonly heartbeatMisses: number;
+        readonly reconnectInitialDelayMs: number;
+        readonly reconnectMaxDelayMs: number;
+    };
+    readonly webSocketServer: {
+        readonly heartbeatIntervalMs: number;
+        readonly heartbeatMisses: number;
+        /** The time until the first frame of a call of the server to a client. */
+        readonly reverseRequestTimeoutMs: number;
+    };
+    readonly idempotency: {
+        /** The time that the server keeps the result of a keyed write. */
+        readonly ttlMs: number;
+    };
+    readonly server: {
+        /** The time that `ProcedureServer.stop()` waits for the calls that run. */
+        readonly stopGraceMs: number;
+    };
+}
+/** The default times of the core. The middleware, the transports and the server read them. */
+export declare const TIMER_DEFAULTS: TimerDefaults;
+//# sourceMappingURL=timers.d.ts.map

package/dist/timers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timers.d.ts","sourceRoot":"","sources":["../src/timers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,sDAAsD;AACtD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE;QACd,qCAAqC;QACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;QACnC,+CAA+C;QAC/C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,QAAQ,CAAC,cAAc,EAAE;QACvB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;KACjC,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;KAClC,CAAC;IACF,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,QAAQ,CAAC,eAAe,EAAE;QACxB,iCAAiC;QACjC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;QACrC,gDAAgD;QAChD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;QACrC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QACpC,wFAAwF;QACxF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;QACzC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;KACtC,CAAC;IACF,QAAQ,CAAC,eAAe,EAAE;QACxB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;QACrC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,0EAA0E;QAC1E,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;KAC1C,CAAC;IACF,QAAQ,CAAC,WAAW,EAAE;QACpB,kEAAkE;QAClE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE;QACf,2EAA2E;QAC3E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC;CACH;AAED,8FAA8F;AAC9F,eAAO,MAAM,cAAc,EAAE,aAqB3B,CAAC"}

package/dist/timers.js

@@ -0,0 +1,33 @@
+/**
+ * The timer settings of the core, as data (roadmap R34).
+ *
+ * Each default time of the middleware, the transports and the server comes from this object, so
+ * a tool can read the settings without a call. `@procedures/systems` binds them to the symbols of
+ * the timer law of `systems`, and examines rules such as "the time of one try is less than the
+ * request time of the WebSocket". The values are milliseconds. The options of an application
+ * are Durations (roadmap R11), and they replace these values.
+ */
+/** The default times of the core. The middleware, the transports and the server read them. */
+export const TIMER_DEFAULTS = Object.freeze({
+    retry: Object.freeze({ maxRetries: 3, retryDelayMs: 1000, backoffMultiplier: 2, maxDelayMs: Number.POSITIVE_INFINITY }),
+    circuitBreaker: Object.freeze({ failureWindowMs: 10_000, resetTimeoutMs: 30_000 }),
+    cache: Object.freeze({ ttlMs: 60_000, statsIntervalMs: 60_000 }),
+    rateLimit: Object.freeze({ windowMs: 60_000 }),
+    webSocketClient: Object.freeze({
+        connectionTimeoutMs: 10_000,
+        requestTimeoutMs: 30_000,
+        // 20 s: with the pong timeout of 5 s, the client finds a dead connection after 25 s, before a
+        // call on it reaches the request time of 30 s. Before, 30 s gave 35 s (the timer law, R34).
+        heartbeatIntervalMs: 20_000,
+        heartbeatTimeoutMs: 5_000,
+        heartbeatMisses: 1,
+        reconnectInitialDelayMs: 1_000,
+        reconnectMaxDelayMs: 30_000,
+    }),
+    // 15 s: with 2 misses, the server finds a dead client after 30 s, not later than a call of the
+    // server to it reaches its request time of 30 s. Before, 30 s gave 60 s (the timer law, R34).
+    webSocketServer: Object.freeze({ heartbeatIntervalMs: 15_000, heartbeatMisses: 2, reverseRequestTimeoutMs: 30_000 }),
+    idempotency: Object.freeze({ ttlMs: 10 * 60_000 }),
+    server: Object.freeze({ stopGraceMs: 0 }),
+});
+//# sourceMappingURL=timers.js.map

package/dist/timers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timers.js","sourceRoot":"","sources":["../src/timers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAmDH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,cAAc,GAAkB,MAAM,CAAC,MAAM,CAAC;IACzD,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC;IACvH,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;IAClF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;IAChE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC9C,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC;QAC7B,mBAAmB,EAAE,MAAM;QAC3B,gBAAgB,EAAE,MAAM;QACxB,8FAA8F;QAC9F,4FAA4F;QAC5F,mBAAmB,EAAE,MAAM;QAC3B,kBAAkB,EAAE,KAAK;QACzB,eAAe,EAAE,CAAC;QAClB,uBAAuB,EAAE,KAAK;QAC9B,mBAAmB,EAAE,MAAM;KAC5B,CAAC;IACF,+FAA+F;IAC/F,8FAA8F;IAC9F,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,mBAAmB,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC;IACpH,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC;IAClD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;CAC1C,CAAC,CAAC"}

package/dist/tracing/traceparent.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The W3C trace context (roadmap R16): `traceparent` is `00-<trace id>-<span id>-<flags>`, with a
+ * trace id of 32 hex digits and a span id of 16. The tracing middleware of a client sends it in
+ * the metadata of a call (and HTTP as the `traceparent` header). The tracing interceptor of a
+ * server continues that trace, and gives it to the nested calls, so one trace goes from the
+ * client to the last handler. Before, the client and the server made two traces.
+ */
+/** The metadata key of the W3C trace context of a call. */
+export declare const TRACEPARENT_METADATA_KEY = "traceparent";
+/** A trace context: the trace, the span of the caller, and the sampled flag. */
+export interface TraceContext {
+    readonly traceId: string;
+    readonly spanId: string;
+    readonly sampled: boolean;
+}
+/** This function makes a new trace id: 32 random hex digits. */
+export declare function newTraceId(): string;
+/** This function makes a new span id: 16 random hex digits. */
+export declare function newSpanId(): string;
+/** True when the ids have the W3C form. */
+export declare function isW3cIds(traceId: string, spanId: string): boolean;
+/** The `traceparent` of a trace and a span. */
+export declare function formatTraceparent(traceId: string, spanId: string, sampled?: boolean): string;
+/** The trace context of a `traceparent` value, or undefined when it is not valid. */
+export declare function parseTraceparent(value: unknown): TraceContext | undefined;
+//# sourceMappingURL=traceparent.d.ts.map

package/dist/tracing/traceparent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"traceparent.d.ts","sourceRoot":"","sources":["../../src/tracing/traceparent.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,2DAA2D;AAC3D,eAAO,MAAM,wBAAwB,gBAAgB,CAAC;AAMtD,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAUD,gEAAgE;AAChE,wBAAgB,UAAU,IAAI,MAAM,CAGnC;AAED,+DAA+D;AAC/D,wBAAgB,SAAS,IAAI,MAAM,CAGlC;AAED,2CAA2C;AAC3C,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEjE;AAED,+CAA+C;AAC/C,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,UAAO,GAAG,MAAM,CAEzF;AAED,qFAAqF;AACrF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAOzE"}

package/dist/tracing/traceparent.js

@@ -0,0 +1,53 @@
+/**
+ * The W3C trace context (roadmap R16): `traceparent` is `00-<trace id>-<span id>-<flags>`, with a
+ * trace id of 32 hex digits and a span id of 16. The tracing middleware of a client sends it in
+ * the metadata of a call (and HTTP as the `traceparent` header). The tracing interceptor of a
+ * server continues that trace, and gives it to the nested calls, so one trace goes from the
+ * client to the last handler. Before, the client and the server made two traces.
+ */
+/** The metadata key of the W3C trace context of a call. */
+export const TRACEPARENT_METADATA_KEY = "traceparent";
+const TRACEPARENT = /^00-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/;
+const ZERO_TRACE = "0".repeat(32);
+const ZERO_SPAN = "0".repeat(16);
+function randomHex(bytes) {
+    const values = new Uint8Array(bytes);
+    const crypto = globalThis.crypto;
+    if (crypto?.getRandomValues)
+        crypto.getRandomValues(values);
+    else
+        for (let index = 0; index < bytes; index++)
+            values[index] = Math.floor(Math.random() * 256);
+    return Array.from(values, (value) => value.toString(16).padStart(2, "0")).join("");
+}
+/** This function makes a new trace id: 32 random hex digits. */
+export function newTraceId() {
+    const id = randomHex(16);
+    return id === ZERO_TRACE ? newTraceId() : id;
+}
+/** This function makes a new span id: 16 random hex digits. */
+export function newSpanId() {
+    const id = randomHex(8);
+    return id === ZERO_SPAN ? newSpanId() : id;
+}
+/** True when the ids have the W3C form. */
+export function isW3cIds(traceId, spanId) {
+    return /^[0-9a-f]{32}$/.test(traceId) && /^[0-9a-f]{16}$/.test(spanId) && traceId !== ZERO_TRACE && spanId !== ZERO_SPAN;
+}
+/** The `traceparent` of a trace and a span. */
+export function formatTraceparent(traceId, spanId, sampled = true) {
+    return `00-${traceId}-${spanId}-${sampled ? "01" : "00"}`;
+}
+/** The trace context of a `traceparent` value, or undefined when it is not valid. */
+export function parseTraceparent(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const match = TRACEPARENT.exec(value.trim().toLowerCase());
+    if (!match)
+        return undefined;
+    const [, traceId, spanId, flags] = match;
+    if (traceId === ZERO_TRACE || spanId === ZERO_SPAN)
+        return undefined;
+    return { traceId: traceId, spanId: spanId, sampled: (parseInt(flags, 16) & 1) === 1 };
+}
+//# sourceMappingURL=traceparent.js.map

package/dist/tracing/traceparent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"traceparent.js","sourceRoot":"","sources":["../../src/tracing/traceparent.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,2DAA2D;AAC3D,MAAM,CAAC,MAAM,wBAAwB,GAAG,aAAa,CAAC;AAEtD,MAAM,WAAW,GAAG,kDAAkD,CAAC;AACvE,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAClC,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AASjC,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAI,UAAmF,CAAC,MAAM,CAAC;IAC3G,IAAI,MAAM,EAAE,eAAe;QAAE,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;;QACvD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,EAAE,KAAK,EAAE;YAAE,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC;IACjG,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACrF,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,UAAU;IACxB,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IACzB,OAAO,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,SAAS;IACvB,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,QAAQ,CAAC,OAAe,EAAE,MAAc;IACtD,OAAO,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,OAAO,KAAK,UAAU,IAAI,MAAM,KAAK,SAAS,CAAC;AAC3H,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,MAAc,EAAE,OAAO,GAAG,IAAI;IAC/E,OAAO,MAAM,OAAO,IAAI,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5D,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC;IACzC,IAAI,OAAO,KAAK,UAAU,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrE,OAAO,EAAE,OAAO,EAAE,OAAQ,EAAE,MAAM,EAAE,MAAO,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAM,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3F,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package",
   "name": "@procedures/client",
-  "version": "0.2.3",
+  "version": "0.4.0",
   "description": "Procedures as data for TypeScript: define typed procedures once and call them in process, over HTTP, WebSocket, the CLI or MCP. Streaming, middleware, retries, caching and a JSON program format.",
   "keywords": [
     "rpc",
@@ -43,6 +43,10 @@
       "types": "./dist/browser.d.ts",
       "import": "./dist/browser.js"
     },
+    "./node": {
+      "types": "./dist/node.d.ts",
+      "import": "./dist/node.js"
+    },
     "./register": {
       "types": "./dist/register.d.ts",
       "import": "./dist/register.js"
@@ -68,9 +72,6 @@
       "import": "./dist/server/index.js"
     }
   },
-  "bin": {
-    "client-registry": "./dist/procedures/cli/index.js"
-  },
   "files": [
     "dist",
     "src",
@@ -90,14 +91,20 @@
     "provenance": true
   },
   "dependencies": {
+    "@mark1russell7/algebra": "^0.5.0",
+    "@mark1russell7/quantity": "^0.2.0",
+    "@mark1russell7/service": "^0.4.0",
     "ws": "^8.18.3",
     "zod": "^4.6.5"
   },
   "devDependencies": {
     "@mark1russell7/cue": "^1.0.0",
+    "@stryker-mutator/core": "10.0.0",
+    "@stryker-mutator/vitest-runner": "10.0.0",
     "@types/express": "^5.0.0",
     "@types/node": "^22.0.0",
     "@types/ws": "^8.18.1",
+    "fast-check": "^4.10.2",
     "typescript": "^7.0.2",
     "vitest": "^5.0.3"
   },

package/src/adapters/http/client/transport.ts

@@ -12,6 +12,21 @@ import type {
 } from "../../../client/types.js";
 
 import type { HttpTransportOptions } from "./types.js";
+import { DELIVERY_METADATA_KEY, RETRY_AFTER_METADATA_KEY, isNotSentError } from "../../../client/middleware/items.js";
+
+/**
+ * The wait that an error response asks for, in milliseconds: `retryAfterMs` of the body of the
+ * server transport, or else the Retry-After header (seconds, or an HTTP date).
+ */
+function retryAfterMsOf(header: string | null, body: unknown): number | undefined {
+  const fromBody = (body as { retryAfterMs?: unknown } | null | undefined)?.retryAfterMs;
+  if (typeof fromBody === "number" && Number.isFinite(fromBody) && fromBody >= 0) return fromBody;
+  if (header === null || header.trim() === "") return undefined;
+  const seconds = Number(header);
+  if (Number.isFinite(seconds) && seconds >= 0) return seconds * 1000;
+  const date = Date.parse(header);
+  return Number.isNaN(date) ? undefined : Math.max(0, date - Date.now());
+}
 
 /** The media type of a stream response: one JSON value on each line. */
 const NDJSON = "application/x-ndjson";
@@ -32,6 +47,8 @@ import {
   createAbortError,
   createErrorFromException,
 } from "../shared/index.js";
+import { optionalMs } from "../../../duration.js";
+import { PROTOCOL_HEADER, PROTOCOL_VERSION } from "../../../protocol.js";
 
 /**
  * HTTP Client Transport
@@ -74,7 +91,7 @@ export class HttpTransport implements Transport {
     this.headerConverter =
       options.headerConverter || createDefaultHeaderConverter();
     this.defaultHeaders = options.defaultHeaders || {};
-    this.timeout = options.timeout;
+    this.timeout = optionalMs(options.timeout, "timeout");
   }
 
   /**
@@ -123,6 +140,8 @@ export class HttpTransport implements Transport {
           [HTTPHeaders.CONTENT_TYPE]: "application/json",
           // A streaming procedure answers with NDJSON; other procedures with JSON
           Accept: `${NDJSON}, application/json`,
+          // The protocol version of this client (roadmap R25)
+          [PROTOCOL_HEADER]: String(PROTOCOL_VERSION),
           ...this.defaultHeaders,
           ...metadataHeaders,
         },
@@ -153,6 +172,13 @@ export class HttpTransport implements Transport {
       // the client kept only the HTTP status ("HTTP 500").
       const status = this.httpStatusToUniversal(response.status as HTTPStatus, responseBody);
       finished = true;
+      if (status.type === "error") {
+        const retryAfter = retryAfterMsOf(response.headers.get("Retry-After"), responseBody);
+        if (retryAfter !== undefined) metadata[RETRY_AFTER_METADATA_KEY] = retryAfter;
+        // The reason of a FORBIDDEN error (roadmap R25)
+        const reason = (responseBody as { reason?: unknown } | null | undefined)?.reason;
+        if (typeof reason === "string") metadata["reason"] = reason;
+      }
 
       // Yield single response item
       yield {
@@ -183,7 +209,9 @@ export class HttpTransport implements Transport {
           retryable: errorDetails.retryable,
         },
         payload: null as TRes,
-        metadata: {},
+        // A refused connection sent nothing. After a reset or a timeout, the server can have
+        // the request, so only an idempotent call can go again (R1).
+        metadata: { [DELIVERY_METADATA_KEY]: isNotSentError(error) ? "not-sent" : "indeterminate" },
       };
     } finally {
       if (timeoutId) clearTimeout(timeoutId);
@@ -251,7 +279,7 @@ export class HttpTransport implements Transport {
         id,
         status: { type: "error", code: "STREAM_ENDED", message: "The stream ended without its end line", retryable: true },
         payload: null as TRes,
-        metadata,
+        metadata: { ...metadata, [DELIVERY_METADATA_KEY]: "indeterminate" },
       };
     } finally {
       reader.releaseLock();

package/src/adapters/http/client/types.ts

@@ -6,6 +6,7 @@
  */
 
 import type { UrlStrategy, HttpMethodStrategy, HeaderConverter } from "../shared/index.js";
+import type { Duration } from "../../../duration.js";
 
 /**
  * HTTP Client Transport Configuration
@@ -28,6 +29,6 @@ export interface HttpTransportOptions {
   /** Default headers applied to all requests */
   defaultHeaders?: Record<string, string>;
 
-  /** Timeout for fetch requests (milliseconds) */
-  timeout?: number;
+  /** The time to the first item of a response, for example `seconds(30)` */
+  timeout?: Duration;
 }

package/src/adapters/http/server/transport.ts

@@ -10,16 +10,23 @@ import { createServer } from "http";
 import type { Server as HttpServer } from "http";
 import type { ServerTransport, ServerRequest, ServerResponse } from "../../../server/types.js";
 import type { Metadata } from "../../../client/types.js";
-import type { Server } from "../../../server/index.js";
+import type { RequestHandler } from "../../../server/types.js";
 import { HTTPMethod, HTTPHeaders, decodeMetadataHeader, METADATA_HEADER_LIMIT } from "../shared/index.js";
 import { ERROR_REGISTRY } from "../../../client/errors/index.js";
 import type { HttpServerTransportOptions } from "./types.js";
 import { createPatternServerUrlStrategy } from "./strategies.js";
 import { checkBrowserRequest, type BrowserGuardOptions } from "../../../server/browser-guard.js";
+import { bearerOf, withoutSecretHeaders } from "../../../server/request-auth.js";
+import { PROTOCOL_HEADER, PROTOCOL_VERSION, errorCodeOf, httpStatusOf, protocolVersionOf } from "../../../protocol.js";
 
 /** The media type of a stream response: one JSON value on each line. */
 const NDJSON = "application/x-ndjson";
 
+/** True when a stream response can run without an end (`STREAM_METADATA_KEY` of procedure-server.ts). */
+function isUnboundedStream(response: { metadata?: Record<string, unknown> | undefined }): boolean {
+  return response.metadata?.["stream"] === "unbounded";
+}
+
 /** The metadata keys that the transport sets: a query parameter or a header cannot replace them. */
 const RESERVED_METADATA = new Set(["headers", "query", "params"]);
 
@@ -35,10 +42,9 @@ class BodyError extends Error {
 
 /** The code and message of a thrown error, with its retryable flag (deep dive TRN-7). */
 function errorOf(error: unknown): { code: string; message: string; retryable: boolean } {
-  const code = (error as { code?: unknown } | undefined)?.code;
   const retryable = (error as { retryable?: unknown } | undefined)?.retryable;
   return {
-    code: typeof code === "string" ? code : "HANDLER_ERROR",
+    code: errorCodeOf(error),
     message: error instanceof Error ? error.message : String(error),
     retryable: typeof retryable === "boolean" ? retryable : false,
   };
@@ -64,24 +70,6 @@ function write(res: Response, chunk: string, signal: AbortSignal): Promise<void>
   });
 }
 
-/**
- * The HTTP status of the error codes of a procedure invocation (they are not in the error
- * registry, so before, a validation error was a 500).
- */
-const INVOCATION_HTTP_STATUS: Record<string, number> = {
-  VALIDATION_ERROR: 400,
-  NOT_EXPOSED: 403,
-  NOT_DECLARED: 403,
-  FORBIDDEN: 403,
-  NOT_FOUND: 404,
-  NO_HANDLER: 404,
-  ABORTED: 499,
-  TIMEOUT: 504,
-  OUTPUT_VALIDATION_ERROR: 500,
-  NO_OUTPUT: 500,
-  HANDLER_ERROR: 500,
-};
-
 /**
  * HTTP server transport adapter for Express.
  *
@@ -126,7 +114,7 @@ export class HttpServerTransport implements ServerTransport {
     corsOptions: HttpServerTransportOptions["corsOptions"] | undefined;
     httpServer: HttpServer | undefined;
   };
-  private server: Server;
+  private server: RequestHandler;
   /** The controllers of the requests in progress: stop() aborts them (deep dive TRN-15) */
   private openRequests = new Set<AbortController>();
   private stopped = false;
@@ -134,7 +122,7 @@ export class HttpServerTransport implements ServerTransport {
   /** The browser checks of each procedure call (see `server/browser-guard.ts`) */
   private readonly guard: BrowserGuardOptions;
 
-  constructor(server: Server, options: HttpServerTransportOptions = {}) {
+  constructor(server: RequestHandler, options: HttpServerTransportOptions = {}) {
     this.server = server;
     const basePath = options.basePath ?? "/api";
     this.options = {
@@ -198,7 +186,8 @@ export class HttpServerTransport implements ServerTransport {
           HTTPHeaders.TRACE_ID,
           HTTPHeaders.SPAN_ID,
           HTTPHeaders.PARENT_SPAN_ID,
-          HTTPHeaders.TIMEOUT,
+          "traceparent",
+          PROTOCOL_HEADER,
           HTTPHeaders.METADATA,
           "collection",
           "collectionName",
@@ -256,6 +245,18 @@ export class HttpServerTransport implements ServerTransport {
    * Converts to unified RPC format, processes, and sends response.
    */
   private async handleHttpRequest(req: Request, res: Response): Promise<void> {
+    // The protocol version of this server, on each response (roadmap R25)
+    res.setHeader(PROTOCOL_HEADER, String(PROTOCOL_VERSION));
+    const version = protocolVersionOf(req.headers[PROTOCOL_HEADER.toLowerCase()]);
+    if (version !== undefined && version > PROTOCOL_VERSION) {
+      res.status(400).json({
+        error: `This server speaks the protocol ${PROTOCOL_VERSION}, and the request uses ${version}`,
+        code: "PROTOCOL_VERSION",
+        retryable: false,
+        protocol: PROTOCOL_VERSION,
+      });
+      return;
+    }
     if (this.stopped) {
       res.status(503).json({ error: "Server stopped", code: "SERVER_STOPPED", retryable: true });
       return;
@@ -360,6 +361,26 @@ export class HttpServerTransport implements ServerTransport {
   ): Promise<void> {
     const ndjson = String(req.headers.accept ?? "").includes(NDJSON);
 
+    if (!ndjson && isUnboundedStream(response)) {
+      // The last item of a stream without an end never comes: refuse the call, and end the stream
+      // (roadmap R15: before, the request waited until a timeout)
+      void Promise.resolve(stream[Symbol.asyncIterator]().return?.()).catch(() => undefined);
+      this.serverResponseToHttp(
+        {
+          id: response.id,
+          status: {
+            type: "error",
+            code: "NOT_ACCEPTABLE",
+            message: `This procedure gives a stream that can run without an end. Send "Accept: ${NDJSON}" to read its items.`,
+            retryable: false,
+          },
+          metadata: {},
+        },
+        res
+      );
+      return;
+    }
+
     if (!ndjson) {
       let last: { value: unknown } | undefined;
       try {
@@ -424,11 +445,14 @@ export class HttpServerTransport implements ServerTransport {
     const id =
       (req.headers["x-request-id"] as string) ??
       `req-${Date.now()}-${Math.random()}`;
+    const bearer = bearerOf(req.headers["authorization"]);
 
     // Build metadata from headers and query params. The flattened query parameters cannot
     // replace headers, query or params (before, "?headers=x" replaced metadata.headers).
+    // The headers without the secrets: the credentials go in request.credentials, not in the
+    // metadata, so a handler and a nested call do not see them (roadmap R18)
     const metadata: Metadata = {
-      headers: req.headers as Record<string, string>,
+      headers: withoutSecretHeaders(req.headers as Record<string, string>),
       query: req.query,
       params: req.params,
     };
@@ -505,6 +529,8 @@ export class HttpServerTransport implements ServerTransport {
       method,
       payload,
       metadata,
+      // A network request: ProcedureServer examines the token (roadmap R18)
+      credentials: bearer === undefined ? {} : { bearer },
     };
   }
 
@@ -524,7 +550,7 @@ export class HttpServerTransport implements ServerTransport {
       // HTTP status via the error registry rather than parseInt (which yields NaN -> 500, so every
       // error became a 500). See documentation/BUGS-2026-07.md (M7).
       const mapped =
-        INVOCATION_HTTP_STATUS[status.code] ??
+        httpStatusOf(status.code) ??
         (ERROR_REGISTRY as Record<string, { httpStatus?: number }>)[status.code]?.httpStatus;
       httpStatusCode = mapped ?? (status.type === "success" ? 200 : 500);
     } else if (typeof status.code === "number") {
@@ -551,10 +577,19 @@ export class HttpServerTransport implements ServerTransport {
       }
       res.json(payload);
     } else {
+      // The wait that the error asks for: a Retry-After header in seconds, and the exact
+      // milliseconds in the body (R12)
+      const retryAfterMs = metadata["retry-after"];
+      const hasRetryAfter = typeof retryAfterMs === "number" && Number.isFinite(retryAfterMs) && retryAfterMs >= 0;
+      if (hasRetryAfter) res.setHeader("Retry-After", String(Math.ceil(retryAfterMs / 1000)));
+      // The reason of a FORBIDDEN error travels on each face (roadmap R25)
+      const reason = typeof metadata["reason"] === "string" ? metadata["reason"] : undefined;
       res.json({
         error: status.message,
         code: status.code,
         retryable: status.retryable,
+        ...(hasRetryAfter ? { retryAfterMs } : {}),
+        ...(reason !== undefined ? { reason } : {}),
       });
     }
   }