@snap-rail/protocol 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/lib/contract.js

@@ -0,0 +1,54 @@
+//#region lib/types/contract.js
+/**
+* Single-source wire contracts: one {@link defineContract} declaration per
+* domain yields everything a domain's wire surface needs — the rows that
+* merge into the protocol's open maps (via `interface RpcMethodMap extends
+* MethodRows<typeof contract> {}` in the same module), the request schemas
+* that ride with registration, and the frame payload schemas for
+* registration and client parsing. The hand-written trio (Api interface +
+* merge rows + schema table) said the same thing three times; here it is
+* said once.
+*
+* A row's response value type is declared through the phantom `res` field
+* (the builders lie about it so the type is reachable without a runtime
+* schema); runtime rows carry only `request` and, optionally, `response`.
+*
+* @module @snap-rail/protocol/contract
+*/
+/**
+* Open one method row: the request schema is mandatory (it is the
+* trust-boundary validator), the response value type is declared through
+* `.ret<T>()` or, with a runtime schema, `.res(schema)`.
+*
+* @param request - the request schema.
+*/
+function method(request) {
+	return {
+		ret() {
+			return { request };
+		},
+		res(response) {
+			return {
+				request,
+				response
+			};
+		}
+	};
+}
+/**
+* Declare one domain's wire surface. Keys are full wire names; every
+* conventional call site passes both tables (`methods: {}` when the domain
+* only pushes frames, `frames: {}` when it only serves methods).
+*
+* @param domain - the wire domain (diagnostic metadata; claims are separate).
+* @param def - the method and frame tables.
+*/
+function defineContract(domain, def) {
+	return {
+		domain,
+		methods: def.methods,
+		frames: def.frames
+	};
+}
+//#endregion
+export { defineContract, method };

package/lib/index.js

@@ -0,0 +1,138 @@
+import { defineContract, method } from "./contract.js";
+import { RpcBusinessError, RpcId, err, isRpcError, ok } from "./rpc.js";
+import { z } from "zod";
+//#region lib/types/schemas.js
+/**
+* Envelope validation at the trust boundary: the type/rpcId/method
+* structure of every inbound message. Per-method payload schemas travel
+* with each registration (`ctx.rpc.method`) — there is no central method
+* table. Host responses are produced by trusted code and are not
+* re-validated in phase 1.
+*
+* @module @snap-rail/protocol/schemas
+*/
+const rpcIdSchema = z.string().min(1).transform(RpcId);
+const clientRequestShape = z.object({
+	type: z.literal("client-request"),
+	rpcId: rpcIdSchema,
+	method: z.string().min(1),
+	payload: z.unknown()
+});
+/**
+* Parse an inbound client request envelope.
+* @param raw - the untrusted wire value.
+* @returns the parsed envelope with a branded rpcId.
+* @throws a zod error naming every envelope violation.
+*/
+function parseClientRequest(raw) {
+	return clientRequestShape.parse(raw);
+}
+const serverRequestShape = z.object({
+	type: z.literal("server-request"),
+	rpcId: rpcIdSchema,
+	method: z.string().min(1),
+	payload: z.unknown()
+});
+/**
+* Parse an inbound host frame on a client.
+* @param raw - the untrusted wire value.
+* @returns the parsed frame.
+* @throws a zod error naming every envelope violation.
+*/
+function parseServerRequest(raw) {
+	return serverRequestShape.parse(raw);
+}
+//#endregion
+//#region lib/types/client.js
+/**
+* The client carrier family: protocol invariants live in the base class;
+* platform differences are transport aspects only. Business failures come
+* back as `RpcResult` (never thrown here); transport failures are thrown by
+* the carrier; the two layers never mix.
+*
+* @module @snap-rail/protocol/client
+*/
+/**
+* Mint a fresh rpc id. `globalThis.crypto` keeps the client family free of
+* Node builtins so the same code bundles into the browser renderer.
+*/
+function freshId() {
+	return globalThis.crypto.randomUUID();
+}
+/** A thrown transport failure; carries no business semantics. */
+var RpcTransportError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "RpcTransportError";
+	}
+};
+/**
+* Protocol client base. Subclasses supply the unary transport; rpcId minting
+* and the echo check live here and nowhere else.
+*/
+var AbstractApiClient = class {
+	async call(method, payload) {
+		const rpcId = RpcId(freshId());
+		const response = await this.transport({
+			type: "client-request",
+			rpcId,
+			method,
+			payload
+		});
+		if (response.type !== "server-response") throw new RpcTransportError(`expected a server-response, received ${String(response.type)}`);
+		if (response.rpcId !== rpcId) throw new RpcTransportError(`rpcId echo mismatch: sent ${rpcId}, received ${response.rpcId}`);
+		return response.result;
+	}
+};
+/**
+* The isomorphic carrier: runs the real protocol against an injected handler
+* with no IPC at all. Tests exercise the exact envelope/result path a real
+* carrier travels.
+*/
+var InProcessApiClient = class extends AbstractApiClient {
+	queue = [];
+	resolvers = [];
+	finished = false;
+	transport;
+	/**
+	* @param handler - the gateway-side unary entry (`handleClientRequest`).
+	*/
+	constructor(handler) {
+		super();
+		this.transport = handler;
+	}
+	/** Deliver a host frame into the client's mux stream (test/pump side). */
+	pushFrame(frame) {
+		const resolver = this.resolvers.shift();
+		if (resolver !== void 0) resolver({
+			done: false,
+			value: frame
+		});
+		else this.queue.push(frame);
+	}
+	/** The mux stream as an async iterable; ends when {@link end} is called. */
+	frames() {
+		return { [Symbol.asyncIterator]: () => ({ next: () => {
+			const frame = this.queue.shift();
+			if (frame !== void 0) return Promise.resolve({
+				done: false,
+				value: frame
+			});
+			if (this.finished) return Promise.resolve({
+				done: true,
+				value: void 0
+			});
+			return new Promise((resolve) => this.resolvers.push(resolve));
+		} }) };
+	}
+	/** End the mux stream; pending and future iterations finish. */
+	end() {
+		this.finished = true;
+		for (const resolve of this.resolvers.splice(0)) resolve({
+			done: true,
+			value: void 0
+		});
+	}
+};
+//#endregion
+export { AbstractApiClient, InProcessApiClient, RpcBusinessError, RpcId, RpcTransportError, defineContract, err, isRpcError, method, ok, parseClientRequest, parseServerRequest };

package/lib/rpc.js

@@ -0,0 +1,67 @@
+//#region lib/types/rpc.js
+/**
+* The four-quadrant message model: every logical message is classified by
+* "who initiates × request/response", decoupled from the physical channel.
+* Swapping the carrier (in-process, Electron IPC, a future WebSocket) leaves
+* the quadrants unchanged; direction is a property of the message, never
+* inferred from the channel.
+*
+* rpcId discipline: whoever initiates mints; a response always echoes the
+* corresponding request's rpcId and never mints a new id. Pure-push frames
+* mint a fresh id per push; answerable frames (a future approval/question
+* family) reuse one stable id until answered.
+*
+* @module @snap-rail/protocol/rpc
+*/
+/** Mint an rpc identifier. Only carriers and frame pumps mint; business code never does. */
+function RpcId(value) {
+	return value;
+}
+/**
+* Construct a success result.
+* @param value - the method's return value.
+*/
+function ok(value) {
+	return {
+		ok: true,
+		value
+	};
+}
+/**
+* Construct a business-error result.
+* @param code - the error code.
+* @param details - code-specific details (required).
+*/
+function err(code, details) {
+	return {
+		ok: false,
+		error: {
+			code,
+			details
+		}
+	};
+}
+/**
+* Thrown by method handlers to fail with a business error; the gateway
+* converts it into `{ ok: false, error }` on the wire. Carrying it as a
+* throw keeps handler happy paths free of result wrapping.
+*/
+var RpcBusinessError = class extends Error {
+	error;
+	constructor(error) {
+		super(`rpc business error: ${error.code}`);
+		this.error = error;
+		this.name = "RpcBusinessError";
+	}
+};
+/**
+* Type guard narrowing an unknown value to {@link RpcError}.
+* @param value - candidate error.
+*/
+function isRpcError(value) {
+	if (value === null || typeof value !== "object") return false;
+	const record = value;
+	return typeof record.code === "string" && "details" in record;
+}
+//#endregion
+export { RpcBusinessError, RpcId, err, isRpcError, ok };

package/lib/types/client.d.ts

@@ -0,0 +1,66 @@
+/**
+ * The client carrier family: protocol invariants live in the base class;
+ * platform differences are transport aspects only. Business failures come
+ * back as `RpcResult` (never thrown here); transport failures are thrown by
+ * the carrier; the two layers never mix.
+ *
+ * @module @snap-rail/protocol/client
+ */
+import type { ClientRequest, RpcResult, ServerRequest, ServerResponse } from './rpc.ts';
+import type { MethodName, RequestPayload, ResponseValue } from './methods.ts';
+/** A thrown transport failure; carries no business semantics. */
+export declare class RpcTransportError extends Error {
+    constructor(message: string, options?: ErrorOptions);
+}
+/** Signature of the raw unary transport: send one full-form request, get its full-form response. */
+export type UnaryTransport = (request: ClientRequest) => Promise<ServerResponse>;
+/**
+ * Protocol client base. Subclasses supply the unary transport; rpcId minting
+ * and the echo check live here and nowhere else.
+ */
+export declare abstract class AbstractApiClient {
+    /**
+     * The transport aspect: deliver one full-form client request and settle
+     * with its full-form server response.
+     */
+    protected abstract transport: UnaryTransport;
+    /**
+     * Call a unary method with the business payload directly; the carrier
+     * mints the rpcId and wraps the envelope.
+     *
+     * Two overloads, one open-world rule: a method known to {@link RpcMethodMap}
+     * (directly or via the caller's own declaration merge) is fully typed;
+     * any other method name is accepted as `(string, unknown)` — the caller
+     * owns the payload contract in that position. The same dual shape the
+     * cordis service surface uses: augmentation is opt-in, never required.
+     *
+     * @param method - the wire method name.
+     * @param payload - the business payload.
+     * @returns the business result; `ok: false` is a normal outcome, not an
+     * exception. Transport failures and rpcId echo mismatches throw.
+     */
+    call<K extends MethodName>(method: K, payload: RequestPayload<K>): Promise<RpcResult<ResponseValue<K>>>;
+    call(method: string, payload: unknown): Promise<RpcResult<unknown>>;
+}
+/**
+ * The isomorphic carrier: runs the real protocol against an injected handler
+ * with no IPC at all. Tests exercise the exact envelope/result path a real
+ * carrier travels.
+ */
+export declare class InProcessApiClient extends AbstractApiClient {
+    private readonly queue;
+    private resolvers;
+    private finished;
+    protected readonly transport: UnaryTransport;
+    /**
+     * @param handler - the gateway-side unary entry (`handleClientRequest`).
+     */
+    constructor(handler: (request: ClientRequest) => Promise<ServerResponse>);
+    /** Deliver a host frame into the client's mux stream (test/pump side). */
+    pushFrame(frame: ServerRequest): void;
+    /** The mux stream as an async iterable; ends when {@link end} is called. */
+    frames(): AsyncIterable<ServerRequest>;
+    /** End the mux stream; pending and future iterations finish. */
+    end(): void;
+}
+//# sourceMappingURL=client.d.ts.map

package/lib/types/client.js

@@ -0,0 +1,93 @@
+/**
+ * The client carrier family: protocol invariants live in the base class;
+ * platform differences are transport aspects only. Business failures come
+ * back as `RpcResult` (never thrown here); transport failures are thrown by
+ * the carrier; the two layers never mix.
+ *
+ * @module @snap-rail/protocol/client
+ */
+import { RpcId } from "./rpc.js";
+/**
+ * Mint a fresh rpc id. `globalThis.crypto` keeps the client family free of
+ * Node builtins so the same code bundles into the browser renderer.
+ */
+function freshId() {
+    return globalThis.crypto.randomUUID();
+}
+/** A thrown transport failure; carries no business semantics. */
+export class RpcTransportError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'RpcTransportError';
+    }
+}
+/**
+ * Protocol client base. Subclasses supply the unary transport; rpcId minting
+ * and the echo check live here and nowhere else.
+ */
+export class AbstractApiClient {
+    async call(method, payload) {
+        const rpcId = RpcId(freshId());
+        const response = await this.transport({
+            type: 'client-request',
+            rpcId,
+            method,
+            payload,
+        });
+        if (response.type !== 'server-response') {
+            throw new RpcTransportError(`expected a server-response, received ${String(response.type)}`);
+        }
+        if (response.rpcId !== rpcId) {
+            throw new RpcTransportError(`rpcId echo mismatch: sent ${rpcId}, received ${response.rpcId}`);
+        }
+        return response.result;
+    }
+}
+/**
+ * The isomorphic carrier: runs the real protocol against an injected handler
+ * with no IPC at all. Tests exercise the exact envelope/result path a real
+ * carrier travels.
+ */
+export class InProcessApiClient extends AbstractApiClient {
+    queue = [];
+    resolvers = [];
+    finished = false;
+    transport;
+    /**
+     * @param handler - the gateway-side unary entry (`handleClientRequest`).
+     */
+    constructor(handler) {
+        super();
+        this.transport = handler;
+    }
+    /** Deliver a host frame into the client's mux stream (test/pump side). */
+    pushFrame(frame) {
+        const resolver = this.resolvers.shift();
+        if (resolver !== undefined)
+            resolver({ done: false, value: frame });
+        else
+            this.queue.push(frame);
+    }
+    /** The mux stream as an async iterable; ends when {@link end} is called. */
+    frames() {
+        return {
+            [Symbol.asyncIterator]: () => ({
+                next: () => {
+                    const frame = this.queue.shift();
+                    if (frame !== undefined)
+                        return Promise.resolve({ done: false, value: frame });
+                    if (this.finished)
+                        return Promise.resolve({ done: true, value: undefined });
+                    return new Promise(resolve => this.resolvers.push(resolve));
+                },
+            }),
+        };
+    }
+    /** End the mux stream; pending and future iterations finish. */
+    end() {
+        this.finished = true;
+        for (const resolve of this.resolvers.splice(0))
+            resolve({ done: true, value: undefined });
+    }
+}
+//# sourceMappingURL=client.js.map

package/lib/types/contract.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Single-source wire contracts: one {@link defineContract} declaration per
+ * domain yields everything a domain's wire surface needs — the rows that
+ * merge into the protocol's open maps (via `interface RpcMethodMap extends
+ * MethodRows<typeof contract> {}` in the same module), the request schemas
+ * that ride with registration, and the frame payload schemas for
+ * registration and client parsing. The hand-written trio (Api interface +
+ * merge rows + schema table) said the same thing three times; here it is
+ * said once.
+ *
+ * A row's response value type is declared through the phantom `res` field
+ * (the builders lie about it so the type is reachable without a runtime
+ * schema); runtime rows carry only `request` and, optionally, `response`.
+ *
+ * @module @snap-rail/protocol/contract
+ */
+import type { z } from 'zod';
+import type { RpcId, RpcResponse } from './rpc.ts';
+/** One method row of a domain contract. */
+export interface MethodRow<Req extends z.ZodType = z.ZodType, Res = unknown> {
+    /** The request schema — the trust-boundary validation at the host. */
+    request: Req;
+    /** Optional runtime response schema: adds the dispatch-time response
+     * self-check and the JSON Schema projection in `rpc.describe`. Absent in
+     * most rows: the response value type rides the phantom instead. */
+    response?: z.ZodType<Res>;
+    /** Phantom carrying the declared response value type; never present at
+     * runtime — the `method()` builders stamp it on the row's type only. */
+    readonly res: Res;
+}
+/**
+ * Open one method row: the request schema is mandatory (it is the
+ * trust-boundary validator), the response value type is declared through
+ * `.ret<T>()` or, with a runtime schema, `.res(schema)`.
+ *
+ * @param request - the request schema.
+ */
+export declare function method<Req extends z.ZodType>(request: Req): {
+    /** Declare the response value type without a runtime schema. */
+    ret<Res>(): MethodRow<Req, Res>;
+    /** Declare the response value type and a schema that validates it. */
+    res<Res>(response: z.ZodType<Res>): MethodRow<Req, Res>;
+};
+/** The runtime shape every domain contract shares (what the gateway serves). */
+export interface DomainContract {
+    /** The wire domain the contract belongs to (diagnostic metadata). */
+    readonly domain: string;
+    /** Method rows keyed by wire name (`domain.resource.verb`). */
+    readonly methods: Readonly<Record<string, MethodRow>>;
+    /** Frame payload schemas keyed by wire name (`domain/event`). */
+    readonly frames: Readonly<Record<string, z.ZodType>>;
+}
+/**
+ * Declare one domain's wire surface. Keys are full wire names; every
+ * conventional call site passes both tables (`methods: {}` when the domain
+ * only pushes frames, `frames: {}` when it only serves methods).
+ *
+ * @param domain - the wire domain (diagnostic metadata; claims are separate).
+ * @param def - the method and frame tables.
+ */
+export declare function defineContract<const M extends Readonly<Record<string, MethodRow>>, const F extends Readonly<Record<string, z.ZodType>>>(domain: string, def: {
+    methods: M;
+    frames: F;
+}): {
+    readonly domain: string;
+    readonly methods: M;
+    readonly frames: F;
+};
+/** The wire method signature one contract row yields (an `RpcMethodMap` row). */
+export type WireMethodOf<Row extends MethodRow> = (payload: z.output<Row['request']>) => Promise<RpcResponse<Row['res']>>;
+/**
+ * The `RpcMethodMap` rows a contract yields. Merge them from the contract's
+ * own module so importers of that module see the rows (the open-world rule):
+ *
+ * ```ts
+ * declare module '@snap-rail/protocol' {
+ *   interface RpcMethodMap extends MethodRows<typeof pluginsContract> {}
+ * }
+ * ```
+ */
+export type MethodRows<C extends DomainContract> = {
+    [K in keyof C['methods'] & string]: WireMethodOf<C['methods'][K]>;
+};
+/**
+ * The `FrameMap` rows a contract yields (payload = schema output); merged
+ * with `interface FrameMap extends FrameRows<typeof contract> {}`.
+ */
+export type FrameRows<C extends DomainContract> = {
+    [K in keyof C['frames'] & string]: z.output<C['frames'][K]>;
+};
+/** One method handler as {@link ContractHandlers} requires: parsed payload
+ * in, response value out (business failures throw `RpcBusinessError`). */
+export type ContractHandlerOf<Row extends MethodRow> = (payload: z.output<Row['request']>, rpcId: RpcId) => Row['res'] | Promise<Row['res']>;
+/** The handler table `ctx.rpc.serveContract` requires for one contract,
+ * keyed by the same wire names as the contract's method rows. */
+export type ContractHandlers<C extends DomainContract> = {
+    [K in keyof C['methods'] & string]: ContractHandlerOf<C['methods'][K]>;
+};
+//# sourceMappingURL=contract.d.ts.map

package/lib/types/contract.js

@@ -0,0 +1,45 @@
+/**
+ * Single-source wire contracts: one {@link defineContract} declaration per
+ * domain yields everything a domain's wire surface needs — the rows that
+ * merge into the protocol's open maps (via `interface RpcMethodMap extends
+ * MethodRows<typeof contract> {}` in the same module), the request schemas
+ * that ride with registration, and the frame payload schemas for
+ * registration and client parsing. The hand-written trio (Api interface +
+ * merge rows + schema table) said the same thing three times; here it is
+ * said once.
+ *
+ * A row's response value type is declared through the phantom `res` field
+ * (the builders lie about it so the type is reachable without a runtime
+ * schema); runtime rows carry only `request` and, optionally, `response`.
+ *
+ * @module @snap-rail/protocol/contract
+ */
+/**
+ * Open one method row: the request schema is mandatory (it is the
+ * trust-boundary validator), the response value type is declared through
+ * `.ret<T>()` or, with a runtime schema, `.res(schema)`.
+ *
+ * @param request - the request schema.
+ */
+export function method(request) {
+    return {
+        ret() {
+            return { request };
+        },
+        res(response) {
+            return { request, response };
+        },
+    };
+}
+/**
+ * Declare one domain's wire surface. Keys are full wire names; every
+ * conventional call site passes both tables (`methods: {}` when the domain
+ * only pushes frames, `frames: {}` when it only serves methods).
+ *
+ * @param domain - the wire domain (diagnostic metadata; claims are separate).
+ * @param def - the method and frame tables.
+ */
+export function defineContract(domain, def) {
+    return { domain, methods: def.methods, frames: def.frames };
+}
+//# sourceMappingURL=contract.js.map

package/lib/types/frames.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The frame table base: every push frame (a host-initiated `ServerRequest`)
+ * is keyed by its wire frame name in `FrameMap`, the twin of
+ * {@link RpcMethodMap} for the host-initiated quadrant. This module holds
+ * the OPEN merge base only — every domain's rows live with its owner's
+ * contract module (field → `@snap-rail/equipment` `./wire`, ModbusTCP →
+ * `@snap-rail/driver-modbus/contract`, station →
+ * `@snap-rail/station-rpc/contract`, production stats →
+ * `@snap-rail/process-production/contract`). A program sees the rows of
+ * every contract it imports — the open-world rule.
+ *
+ * Naming: frames are `domain/event` — kebab-case segments joined by `/` —
+ * while methods are `domain.resource.verb` joined by `.`. The first frame
+ * segment is the owning domain, the same vocabulary method domains use;
+ * `ctx.rpc.claimDomain` guards both.
+ *
+ * @module @snap-rail/protocol/frames
+ */
+/** Payload type per frame name; open for declaration merging. */
+export interface FrameMap {
+}
+/** Frame names on the wire. */
+export type FrameName = keyof FrameMap & string;
+/** The payload type of a frame, derived from its row. */
+export type FramePayload<K extends FrameName> = FrameMap[K];
+//# sourceMappingURL=frames.d.ts.map

package/lib/types/frames.js

@@ -0,0 +1,20 @@
+/**
+ * The frame table base: every push frame (a host-initiated `ServerRequest`)
+ * is keyed by its wire frame name in `FrameMap`, the twin of
+ * {@link RpcMethodMap} for the host-initiated quadrant. This module holds
+ * the OPEN merge base only — every domain's rows live with its owner's
+ * contract module (field → `@snap-rail/equipment` `./wire`, ModbusTCP →
+ * `@snap-rail/driver-modbus/contract`, station →
+ * `@snap-rail/station-rpc/contract`, production stats →
+ * `@snap-rail/process-production/contract`). A program sees the rows of
+ * every contract it imports — the open-world rule.
+ *
+ * Naming: frames are `domain/event` — kebab-case segments joined by `/` —
+ * while methods are `domain.resource.verb` joined by `.`. The first frame
+ * segment is the owning domain, the same vocabulary method domains use;
+ * `ctx.rpc.claimDomain` guards both.
+ *
+ * @module @snap-rail/protocol/frames
+ */
+export {};
+//# sourceMappingURL=frames.js.map

package/lib/types/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The channel-independent RPC contract between host and clients: the
+ * four-quadrant message model, the open method and frame merge bases,
+ * boundary schemas, and the client carrier family.
+ *
+ * @module @snap-rail/protocol
+ */
+export * from './rpc.ts';
+export * from './methods.ts';
+export * from './frames.ts';
+export * from './contract.ts';
+export * from './schemas.ts';
+export * from './client.ts';
+//# sourceMappingURL=index.d.ts.map

package/lib/types/index.js

@@ -0,0 +1,14 @@
+/**
+ * The channel-independent RPC contract between host and clients: the
+ * four-quadrant message model, the open method and frame merge bases,
+ * boundary schemas, and the client carrier family.
+ *
+ * @module @snap-rail/protocol
+ */
+export * from "./rpc.js";
+export * from "./methods.js";
+export * from "./frames.js";
+export * from "./contract.js";
+export * from "./schemas.js";
+export * from "./client.js";
+//# sourceMappingURL=index.js.map

package/lib/types/methods.d.ts

@@ -0,0 +1,100 @@
+/**
+ * The platform domain's method rows plus the open bases themselves: the
+ * wire's platform surface is `host.*` and `window.*` (transport-adjacent,
+ * owned by the gateway and the shell). Every other domain's rows live with
+ * their owners and merge in from their contract modules:
+ * field → `@snap-rail/equipment` (`./wire`), ModbusTCP →
+ * `@snap-rail/driver-modbus/contract`, station → `@snap-rail/station-rpc/contract`,
+ * plugin admin → `@snap-rail/app-boot/contract`. A program sees the rows of
+ * every contract it imports — the open-world rule.
+ *
+ * Reserved-method discipline: the map holds only implemented methods; an
+ * unknown method fails loud at dispatch (`bad-request`) — no
+ * not-implemented fallback code.
+ *
+ * @module @snap-rail/protocol/methods
+ */
+import type { RpcResponse } from './rpc.ts';
+/** Host-level introspection. */
+export interface HostApi {
+    /** Describe the running application: identity for handshakes and About panels. */
+    describe(payload: {}): Promise<RpcResponse<{
+        name: string;
+        version: string;
+        bin: string;
+    }>>;
+}
+/** One wire domain as `rpc.describe` serves it. */
+export interface DomainInfo {
+    /** The claimed prefix (`field`, `field.modbus`). */
+    prefix: string;
+    /** The claiming plugin's fiber name. */
+    owner: string;
+}
+/** One registered method as `rpc.describe` serves it. */
+export interface MethodInfo {
+    name: string;
+    /** The request schema as JSON Schema (omitted when not representable). */
+    requestSchema?: unknown;
+    /** The optional response schema as JSON Schema. */
+    responseSchema?: unknown;
+}
+/** One registered frame as `rpc.describe` serves it. */
+export interface FrameInfo {
+    name: string;
+    /** The payload schema as JSON Schema (omitted when not representable). */
+    payloadSchema?: unknown;
+}
+/** Wire-level capability discovery. */
+export interface RpcIntrospectApi {
+    /** Every live domain claim, method route, and frame registration — the
+     * surface an external tool (settings UI, agent, future plugin installer)
+     * lists before calling. */
+    describe(payload: {}): Promise<RpcResponse<{
+        domains: readonly DomainInfo[];
+        methods: readonly MethodInfo[];
+        frames: readonly FrameInfo[];
+    }>>;
+}
+/**
+ * Native window controls for frameless shells. Controls drive the main
+ * window.
+ */
+export interface WindowApi {
+    /** Apply a window action (`minimize`, `toggle-maximize`, `close`); `false` when no window exists to act on. */
+    control(payload: {
+        action: 'minimize' | 'toggle-maximize' | 'close';
+    }): Promise<RpcResponse<{
+        applied: boolean;
+    }>>;
+    /** Native zip picker for the plugin installer; `null` when cancelled. */
+    pickZip(payload: {
+        title?: string | undefined;
+    }): Promise<RpcResponse<string | null>>;
+    /** Native zip saver (generated-plugin export); `null` when cancelled. */
+    saveZip(payload: {
+        title?: string | undefined;
+        defaultFileName: string;
+    }): Promise<RpcResponse<string | null>>;
+    /** Relaunch the app (suite switches need a fresh boot to remount). */
+    relaunch(payload: Record<string, never>): Promise<RpcResponse<{
+        applied: true;
+    }>>;
+}
+/** Every unary method callable by a client, keyed by its wire method name.
+ * Open for declaration merging — see the module note for where rows live. */
+export interface RpcMethodMap {
+    'host.describe': HostApi['describe'];
+    'rpc.describe': RpcIntrospectApi['describe'];
+    'window.control': WindowApi['control'];
+    'window.pick-zip': WindowApi['pickZip'];
+    'window.save-zip': WindowApi['saveZip'];
+    'window.relaunch': WindowApi['relaunch'];
+}
+/** Method names on the wire. */
+export type MethodName = keyof RpcMethodMap & string;
+/** The request payload type of a method, derived from its signature. */
+export type RequestPayload<K extends MethodName> = Parameters<RpcMethodMap[K]>[0];
+/** The success value type of a method, derived from its signature. */
+export type ResponseValue<K extends MethodName> = Awaited<ReturnType<RpcMethodMap[K]>> extends RpcResponse<infer T> ? T : never;
+//# sourceMappingURL=methods.d.ts.map

package/lib/types/methods.js

@@ -0,0 +1,18 @@
+/**
+ * The platform domain's method rows plus the open bases themselves: the
+ * wire's platform surface is `host.*` and `window.*` (transport-adjacent,
+ * owned by the gateway and the shell). Every other domain's rows live with
+ * their owners and merge in from their contract modules:
+ * field → `@snap-rail/equipment` (`./wire`), ModbusTCP →
+ * `@snap-rail/driver-modbus/contract`, station → `@snap-rail/station-rpc/contract`,
+ * plugin admin → `@snap-rail/app-boot/contract`. A program sees the rows of
+ * every contract it imports — the open-world rule.
+ *
+ * Reserved-method discipline: the map holds only implemented methods; an
+ * unknown method fails loud at dispatch (`bad-request`) — no
+ * not-implemented fallback code.
+ *
+ * @module @snap-rail/protocol/methods
+ */
+export {};
+//# sourceMappingURL=methods.js.map

package/lib/types/rpc.d.ts

@@ -0,0 +1,132 @@
+/**
+ * The four-quadrant message model: every logical message is classified by
+ * "who initiates × request/response", decoupled from the physical channel.
+ * Swapping the carrier (in-process, Electron IPC, a future WebSocket) leaves
+ * the quadrants unchanged; direction is a property of the message, never
+ * inferred from the channel.
+ *
+ * rpcId discipline: whoever initiates mints; a response always echoes the
+ * corresponding request's rpcId and never mints a new id. Pure-push frames
+ * mint a fresh id per push; answerable frames (a future approval/question
+ * family) reuse one stable id until answered.
+ *
+ * @module @snap-rail/protocol/rpc
+ */
+import type { Branded } from '@snap-rail/util';
+/** Identifier correlating a request with its response. */
+export type RpcId = Branded<string, 'RpcId'>;
+/** Mint an rpc identifier. Only carriers and frame pumps mint; business code never does. */
+export declare function RpcId(value: string): RpcId;
+/** ① A client-initiated request: call a host method.
+ * @param rpcId - minted by the client.
+ * @param method - the method key; also the discriminator handlers dispatch on.
+ * @param payload - the business payload, validated per method at the host.
+ */
+export interface ClientRequest {
+    type: 'client-request';
+    rpcId: RpcId;
+    method: string;
+    payload: unknown;
+}
+/** ② The response to a {@link ClientRequest}. Always echoes its rpcId.
+ * @param rpcId - echoed from the request; never minted here.
+ * @param result - business outcome; methods do not throw business errors.
+ */
+export interface ServerResponse {
+    type: 'server-response';
+    rpcId: RpcId;
+    result: RpcResult<unknown>;
+}
+/** ③ A host-initiated request: a push frame (or a future answerable request).
+ * @param rpcId - minted by the host frame pump; fresh per push frame.
+ * @param method - the frame type.
+ * @param payload - the frame payload.
+ */
+export interface ServerRequest {
+    type: 'server-request';
+    rpcId: RpcId;
+    method: string;
+    payload: unknown;
+}
+/** ④ The response to a {@link ServerRequest}. Always echoes its rpcId. */
+export interface ClientResponse {
+    type: 'client-response';
+    rpcId: RpcId;
+    result: RpcResult<unknown>;
+}
+/** Every wire message; narrowed via `switch (message.type)`. */
+export type RpcMessage = ClientRequest | ServerResponse | ServerRequest | ClientResponse;
+/** Business outcome of a method. Transport failures are carrier exceptions; the two layers never mix. */
+export type RpcResult<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    error: RpcError;
+};
+/** Details required per error code; adding a code = one map row (compile-checked). */
+export interface RpcErrorDetailsMap {
+    'bad-request': {
+        issues: readonly string[];
+    };
+    'not-found': {
+        what: string;
+    };
+    'conflict': {
+        what: string;
+    };
+    'unavailable': {
+        what: string;
+    };
+    'internal': {
+        hint?: string;
+    };
+}
+/** Discriminated error union; `code` discriminates, `details` narrows. */
+export type RpcError = {
+    [K in keyof RpcErrorDetailsMap]: {
+        code: K;
+        details: RpcErrorDetailsMap[K];
+    };
+}[keyof RpcErrorDetailsMap];
+/** Narrow request form seen by typed signatures; carriers complete it into a full form. */
+export type RpcRequest<P> = {
+    rpcId: RpcId;
+    payload: P;
+};
+/** Narrow response form seen by typed signatures. */
+export type RpcResponse<T> = {
+    rpcId: RpcId;
+    result: RpcResult<T>;
+};
+/**
+ * Construct a success result.
+ * @param value - the method's return value.
+ */
+export declare function ok<T>(value: T): RpcResult<T>;
+/**
+ * Construct a business-error result.
+ * @param code - the error code.
+ * @param details - code-specific details (required).
+ */
+export declare function err<K extends keyof RpcErrorDetailsMap>(code: K, details: RpcErrorDetailsMap[K]): {
+    ok: false;
+    error: Extract<RpcError, {
+        code: K;
+    }>;
+};
+/**
+ * Thrown by method handlers to fail with a business error; the gateway
+ * converts it into `{ ok: false, error }` on the wire. Carrying it as a
+ * throw keeps handler happy paths free of result wrapping.
+ */
+export declare class RpcBusinessError extends Error {
+    readonly error: RpcError;
+    constructor(error: RpcError);
+}
+/**
+ * Type guard narrowing an unknown value to {@link RpcError}.
+ * @param value - candidate error.
+ */
+export declare function isRpcError(value: unknown): value is RpcError;
+//# sourceMappingURL=rpc.d.ts.map

package/lib/types/rpc.js

@@ -0,0 +1,57 @@
+/**
+ * The four-quadrant message model: every logical message is classified by
+ * "who initiates × request/response", decoupled from the physical channel.
+ * Swapping the carrier (in-process, Electron IPC, a future WebSocket) leaves
+ * the quadrants unchanged; direction is a property of the message, never
+ * inferred from the channel.
+ *
+ * rpcId discipline: whoever initiates mints; a response always echoes the
+ * corresponding request's rpcId and never mints a new id. Pure-push frames
+ * mint a fresh id per push; answerable frames (a future approval/question
+ * family) reuse one stable id until answered.
+ *
+ * @module @snap-rail/protocol/rpc
+ */
+/** Mint an rpc identifier. Only carriers and frame pumps mint; business code never does. */
+export function RpcId(value) {
+    return value;
+}
+/**
+ * Construct a success result.
+ * @param value - the method's return value.
+ */
+export function ok(value) {
+    return { ok: true, value };
+}
+/**
+ * Construct a business-error result.
+ * @param code - the error code.
+ * @param details - code-specific details (required).
+ */
+export function err(code, details) {
+    return { ok: false, error: { code, details } };
+}
+/**
+ * Thrown by method handlers to fail with a business error; the gateway
+ * converts it into `{ ok: false, error }` on the wire. Carrying it as a
+ * throw keeps handler happy paths free of result wrapping.
+ */
+export class RpcBusinessError extends Error {
+    error;
+    constructor(error) {
+        super(`rpc business error: ${error.code}`);
+        this.error = error;
+        this.name = 'RpcBusinessError';
+    }
+}
+/**
+ * Type guard narrowing an unknown value to {@link RpcError}.
+ * @param value - candidate error.
+ */
+export function isRpcError(value) {
+    if (value === null || typeof value !== 'object')
+        return false;
+    const record = value;
+    return typeof record.code === 'string' && 'details' in record;
+}
+//# sourceMappingURL=rpc.js.map

package/lib/types/schemas.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Envelope validation at the trust boundary: the type/rpcId/method
+ * structure of every inbound message. Per-method payload schemas travel
+ * with each registration (`ctx.rpc.method`) — there is no central method
+ * table. Host responses are produced by trusted code and are not
+ * re-validated in phase 1.
+ *
+ * @module @snap-rail/protocol/schemas
+ */
+import { type ClientRequest, type ServerRequest } from './rpc.ts';
+/**
+ * Parse an inbound client request envelope.
+ * @param raw - the untrusted wire value.
+ * @returns the parsed envelope with a branded rpcId.
+ * @throws a zod error naming every envelope violation.
+ */
+export declare function parseClientRequest(raw: unknown): ClientRequest;
+/**
+ * Parse an inbound host frame on a client.
+ * @param raw - the untrusted wire value.
+ * @returns the parsed frame.
+ * @throws a zod error naming every envelope violation.
+ */
+export declare function parseServerRequest(raw: unknown): ServerRequest;
+//# sourceMappingURL=schemas.d.ts.map

package/lib/types/schemas.js

@@ -0,0 +1,43 @@
+/**
+ * Envelope validation at the trust boundary: the type/rpcId/method
+ * structure of every inbound message. Per-method payload schemas travel
+ * with each registration (`ctx.rpc.method`) — there is no central method
+ * table. Host responses are produced by trusted code and are not
+ * re-validated in phase 1.
+ *
+ * @module @snap-rail/protocol/schemas
+ */
+import { z } from 'zod';
+import { RpcId } from "./rpc.js";
+const rpcIdSchema = z.string().min(1).transform(RpcId);
+const clientRequestShape = z.object({
+    type: z.literal('client-request'),
+    rpcId: rpcIdSchema,
+    method: z.string().min(1),
+    payload: z.unknown(),
+});
+/**
+ * Parse an inbound client request envelope.
+ * @param raw - the untrusted wire value.
+ * @returns the parsed envelope with a branded rpcId.
+ * @throws a zod error naming every envelope violation.
+ */
+export function parseClientRequest(raw) {
+    return clientRequestShape.parse(raw);
+}
+const serverRequestShape = z.object({
+    type: z.literal('server-request'),
+    rpcId: rpcIdSchema,
+    method: z.string().min(1),
+    payload: z.unknown(),
+});
+/**
+ * Parse an inbound host frame on a client.
+ * @param raw - the untrusted wire value.
+ * @returns the parsed frame.
+ * @throws a zod error naming every envelope violation.
+ */
+export function parseServerRequest(raw) {
+    return serverRequestShape.parse(raw);
+}
+//# sourceMappingURL=schemas.js.map

package/package.json

@@ -1,6 +1,28 @@
 {
   "name": "@snap-rail/protocol",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "description": "Channel-independent four-quadrant RPC contract between host and clients",
+  "version": "0.1.1",
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/**/*.js",
+    "lib/types/**/*.d.ts"
+  ],
+  "license": "Apache-2.0",
+  "dependencies": {
+    "zod": "^4.4.3",
+    "@snap-rail/util": "^0.1.2"
+  },
+  "snapRail": {
+    "layer": "base"
+  }
 }

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.