@snap-rail/protocol 0.0.0-stage → 0.1.3

package/lib/types/contract.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Single-source wire contracts: one {@link defineContract} declaration per
+ * domain yields everything a domain's wire surface needs — the rows that
+ * merge into the protocol's open maps (via `interface RpcMethodMap extends
+ * MethodRows<typeof contract> {}` in the same module), the request schemas
+ * that ride with registration, and the frame payload schemas for
+ * registration and client parsing. The hand-written trio (Api interface +
+ * merge rows + schema table) said the same thing three times; here it is
+ * said once.
+ *
+ * A row's response value type is declared through the phantom `res` field
+ * (the builders lie about it so the type is reachable without a runtime
+ * schema); runtime rows carry only `request` and, optionally, `response`.
+ *
+ * @module @snap-rail/protocol/contract
+ */
+import type { z } from 'zod';
+import type { RpcId, RpcResponse } from './rpc.ts';
+/** One method row of a domain contract. */
+export interface MethodRow<Req extends z.ZodType = z.ZodType, Res = unknown> {
+    /** The request schema — the trust-boundary validation at the host. */
+    request: Req;
+    /** Optional runtime response schema: adds the dispatch-time response
+     * self-check and the JSON Schema projection in `rpc.describe`. Absent in
+     * most rows: the response value type rides the phantom instead. */
+    response?: z.ZodType<Res>;
+    /** Phantom carrying the declared response value type; never present at
+     * runtime — the `method()` builders stamp it on the row's type only. */
+    readonly res: Res;
+}
+/**
+ * Open one method row: the request schema is mandatory (it is the
+ * trust-boundary validator), the response value type is declared through
+ * `.ret<T>()` or, with a runtime schema, `.res(schema)`.
+ *
+ * @param request - the request schema.
+ */
+export declare function method<Req extends z.ZodType>(request: Req): {
+    /** Declare the response value type without a runtime schema. */
+    ret<Res>(): MethodRow<Req, Res>;
+    /** Declare the response value type and a schema that validates it. */
+    res<Res>(response: z.ZodType<Res>): MethodRow<Req, Res>;
+};
+/** The runtime shape every domain contract shares (what the gateway serves). */
+export interface DomainContract {
+    /** The wire domain the contract belongs to (diagnostic metadata). */
+    readonly domain: string;
+    /** Method rows keyed by wire name (`domain.resource.verb`). */
+    readonly methods: Readonly<Record<string, MethodRow>>;
+    /** Frame payload schemas keyed by wire name (`domain/event`). */
+    readonly frames: Readonly<Record<string, z.ZodType>>;
+}
+/**
+ * Declare one domain's wire surface. Keys are full wire names; every
+ * conventional call site passes both tables (`methods: {}` when the domain
+ * only pushes frames, `frames: {}` when it only serves methods).
+ *
+ * @param domain - the wire domain (diagnostic metadata; claims are separate).
+ * @param def - the method and frame tables.
+ */
+export declare function defineContract<const M extends Readonly<Record<string, MethodRow>>, const F extends Readonly<Record<string, z.ZodType>>>(domain: string, def: {
+    methods: M;
+    frames: F;
+}): {
+    readonly domain: string;
+    readonly methods: M;
+    readonly frames: F;
+};
+/** The wire method signature one contract row yields (an `RpcMethodMap` row). */
+export type WireMethodOf<Row extends MethodRow> = (payload: z.output<Row['request']>) => Promise<RpcResponse<Row['res']>>;
+/**
+ * The `RpcMethodMap` rows a contract yields. Merge them from the contract's
+ * own module so importers of that module see the rows (the open-world rule):
+ *
+ * ```ts
+ * declare module '@snap-rail/protocol' {
+ *   interface RpcMethodMap extends MethodRows<typeof pluginsContract> {}
+ * }
+ * ```
+ */
+export type MethodRows<C extends DomainContract> = {
+    [K in keyof C['methods'] & string]: WireMethodOf<C['methods'][K]>;
+};
+/**
+ * The `FrameMap` rows a contract yields (payload = schema output); merged
+ * with `interface FrameMap extends FrameRows<typeof contract> {}`.
+ */
+export type FrameRows<C extends DomainContract> = {
+    [K in keyof C['frames'] & string]: z.output<C['frames'][K]>;
+};
+/** One method handler as {@link ContractHandlers} requires: parsed payload
+ * in, response value out (business failures throw `RpcBusinessError`). */
+export type ContractHandlerOf<Row extends MethodRow> = (payload: z.output<Row['request']>, rpcId: RpcId) => Row['res'] | Promise<Row['res']>;
+/** The handler table `ctx.rpc.serveContract` requires for one contract,
+ * keyed by the same wire names as the contract's method rows. */
+export type ContractHandlers<C extends DomainContract> = {
+    [K in keyof C['methods'] & string]: ContractHandlerOf<C['methods'][K]>;
+};
+//# sourceMappingURL=contract.d.ts.map

package/lib/types/contract.js

@@ -0,0 +1,45 @@
+/**
+ * Single-source wire contracts: one {@link defineContract} declaration per
+ * domain yields everything a domain's wire surface needs — the rows that
+ * merge into the protocol's open maps (via `interface RpcMethodMap extends
+ * MethodRows<typeof contract> {}` in the same module), the request schemas
+ * that ride with registration, and the frame payload schemas for
+ * registration and client parsing. The hand-written trio (Api interface +
+ * merge rows + schema table) said the same thing three times; here it is
+ * said once.
+ *
+ * A row's response value type is declared through the phantom `res` field
+ * (the builders lie about it so the type is reachable without a runtime
+ * schema); runtime rows carry only `request` and, optionally, `response`.
+ *
+ * @module @snap-rail/protocol/contract
+ */
+/**
+ * Open one method row: the request schema is mandatory (it is the
+ * trust-boundary validator), the response value type is declared through
+ * `.ret<T>()` or, with a runtime schema, `.res(schema)`.
+ *
+ * @param request - the request schema.
+ */
+export function method(request) {
+    return {
+        ret() {
+            return { request };
+        },
+        res(response) {
+            return { request, response };
+        },
+    };
+}
+/**
+ * Declare one domain's wire surface. Keys are full wire names; every
+ * conventional call site passes both tables (`methods: {}` when the domain
+ * only pushes frames, `frames: {}` when it only serves methods).
+ *
+ * @param domain - the wire domain (diagnostic metadata; claims are separate).
+ * @param def - the method and frame tables.
+ */
+export function defineContract(domain, def) {
+    return { domain, methods: def.methods, frames: def.frames };
+}
+//# sourceMappingURL=contract.js.map

package/lib/types/frames.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The frame table base: every push frame (a host-initiated `ServerRequest`)
+ * is keyed by its wire frame name in `FrameMap`, the twin of
+ * {@link RpcMethodMap} for the host-initiated quadrant. This module holds
+ * the OPEN merge base only — every domain's rows live with its owner's
+ * contract module (field → `@snap-rail/equipment` `./wire`, ModbusTCP →
+ * `@snap-rail/driver-modbus/contract`, station →
+ * `@snap-rail/station-rpc/contract`, production stats →
+ * `@snap-rail/process-production/contract`). A program sees the rows of
+ * every contract it imports — the open-world rule.
+ *
+ * Naming: frames are `domain/event` — kebab-case segments joined by `/` —
+ * while methods are `domain.resource.verb` joined by `.`. The first frame
+ * segment is the owning domain, the same vocabulary method domains use;
+ * `ctx.rpc.claimDomain` guards both.
+ *
+ * @module @snap-rail/protocol/frames
+ */
+/** Payload type per frame name; open for declaration merging. */
+export interface FrameMap {
+}
+/** Frame names on the wire. */
+export type FrameName = keyof FrameMap & string;
+/** The payload type of a frame, derived from its row. */
+export type FramePayload<K extends FrameName> = FrameMap[K];
+//# sourceMappingURL=frames.d.ts.map

package/lib/types/frames.js

@@ -0,0 +1,20 @@
+/**
+ * The frame table base: every push frame (a host-initiated `ServerRequest`)
+ * is keyed by its wire frame name in `FrameMap`, the twin of
+ * {@link RpcMethodMap} for the host-initiated quadrant. This module holds
+ * the OPEN merge base only — every domain's rows live with its owner's
+ * contract module (field → `@snap-rail/equipment` `./wire`, ModbusTCP →
+ * `@snap-rail/driver-modbus/contract`, station →
+ * `@snap-rail/station-rpc/contract`, production stats →
+ * `@snap-rail/process-production/contract`). A program sees the rows of
+ * every contract it imports — the open-world rule.
+ *
+ * Naming: frames are `domain/event` — kebab-case segments joined by `/` —
+ * while methods are `domain.resource.verb` joined by `.`. The first frame
+ * segment is the owning domain, the same vocabulary method domains use;
+ * `ctx.rpc.claimDomain` guards both.
+ *
+ * @module @snap-rail/protocol/frames
+ */
+export {};
+//# sourceMappingURL=frames.js.map

package/lib/types/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The channel-independent RPC contract between host and clients: the
+ * four-quadrant message model, the open method and frame merge bases,
+ * boundary schemas, and the client carrier family.
+ *
+ * @module @snap-rail/protocol
+ */
+export * from './rpc.ts';
+export * from './methods.ts';
+export * from './surfaces.ts';
+export * from './frames.ts';
+export * from './contract.ts';
+export * from './schemas.ts';
+export * from './client.ts';
+//# sourceMappingURL=index.d.ts.map

package/lib/types/index.js

@@ -0,0 +1,15 @@
+/**
+ * The channel-independent RPC contract between host and clients: the
+ * four-quadrant message model, the open method and frame merge bases,
+ * boundary schemas, and the client carrier family.
+ *
+ * @module @snap-rail/protocol
+ */
+export * from "./rpc.js";
+export * from "./methods.js";
+export * from "./surfaces.js";
+export * from "./frames.js";
+export * from "./contract.js";
+export * from "./schemas.js";
+export * from "./client.js";
+//# sourceMappingURL=index.js.map

package/lib/types/methods.d.ts

@@ -0,0 +1,100 @@
+/**
+ * The platform domain's method rows plus the open bases themselves: the
+ * wire's platform surface is `host.*` and `window.*` (transport-adjacent,
+ * owned by the gateway and the shell). Every other domain's rows live with
+ * their owners and merge in from their contract modules:
+ * field → `@snap-rail/equipment` (`./wire`), ModbusTCP →
+ * `@snap-rail/driver-modbus/contract`, station → `@snap-rail/station-rpc/contract`,
+ * plugin admin → `@snap-rail/app-boot/contract`. A program sees the rows of
+ * every contract it imports — the open-world rule.
+ *
+ * Reserved-method discipline: the map holds only implemented methods; an
+ * unknown method fails loud at dispatch (`bad-request`) — no
+ * not-implemented fallback code.
+ *
+ * @module @snap-rail/protocol/methods
+ */
+import type { RpcResponse } from './rpc.ts';
+/** Host-level introspection. */
+export interface HostApi {
+    /** Describe the running application: identity for handshakes and About panels. */
+    describe(payload: {}): Promise<RpcResponse<{
+        name: string;
+        version: string;
+        bin: string;
+    }>>;
+}
+/** One wire domain as `rpc.describe` serves it. */
+export interface DomainInfo {
+    /** The claimed prefix (`field`, `field.modbus`). */
+    prefix: string;
+    /** The claiming plugin's fiber name. */
+    owner: string;
+}
+/** One registered method as `rpc.describe` serves it. */
+export interface MethodInfo {
+    name: string;
+    /** The request schema as JSON Schema (omitted when not representable). */
+    requestSchema?: unknown;
+    /** The optional response schema as JSON Schema. */
+    responseSchema?: unknown;
+}
+/** One registered frame as `rpc.describe` serves it. */
+export interface FrameInfo {
+    name: string;
+    /** The payload schema as JSON Schema (omitted when not representable). */
+    payloadSchema?: unknown;
+}
+/** Wire-level capability discovery. */
+export interface RpcIntrospectApi {
+    /** Every live domain claim, method route, and frame registration — the
+     * surface an external tool (settings UI, agent, future plugin installer)
+     * lists before calling. */
+    describe(payload: {}): Promise<RpcResponse<{
+        domains: readonly DomainInfo[];
+        methods: readonly MethodInfo[];
+        frames: readonly FrameInfo[];
+    }>>;
+}
+/**
+ * Native window controls for frameless shells. Controls drive the main
+ * window.
+ */
+export interface WindowApi {
+    /** Apply a window action (`minimize`, `toggle-maximize`, `close`); `false` when no window exists to act on. */
+    control(payload: {
+        action: 'minimize' | 'toggle-maximize' | 'close';
+    }): Promise<RpcResponse<{
+        applied: boolean;
+    }>>;
+    /** Native zip picker for the plugin installer; `null` when cancelled. */
+    pickZip(payload: {
+        title?: string | undefined;
+    }): Promise<RpcResponse<string | null>>;
+    /** Native zip saver (generated-plugin export); `null` when cancelled. */
+    saveZip(payload: {
+        title?: string | undefined;
+        defaultFileName: string;
+    }): Promise<RpcResponse<string | null>>;
+    /** Relaunch the app (suite switches need a fresh boot to remount). */
+    relaunch(payload: Record<string, never>): Promise<RpcResponse<{
+        applied: true;
+    }>>;
+}
+/** Every unary method callable by a client, keyed by its wire method name.
+ * Open for declaration merging — see the module note for where rows live. */
+export interface RpcMethodMap {
+    'host.describe': HostApi['describe'];
+    'rpc.describe': RpcIntrospectApi['describe'];
+    'window.control': WindowApi['control'];
+    'window.pick-zip': WindowApi['pickZip'];
+    'window.save-zip': WindowApi['saveZip'];
+    'window.relaunch': WindowApi['relaunch'];
+}
+/** Method names on the wire. */
+export type MethodName = keyof RpcMethodMap & string;
+/** The request payload type of a method, derived from its signature. */
+export type RequestPayload<K extends MethodName> = Parameters<RpcMethodMap[K]>[0];
+/** The success value type of a method, derived from its signature. */
+export type ResponseValue<K extends MethodName> = Awaited<ReturnType<RpcMethodMap[K]>> extends RpcResponse<infer T> ? T : never;
+//# sourceMappingURL=methods.d.ts.map

package/lib/types/methods.js

@@ -0,0 +1,18 @@
+/**
+ * The platform domain's method rows plus the open bases themselves: the
+ * wire's platform surface is `host.*` and `window.*` (transport-adjacent,
+ * owned by the gateway and the shell). Every other domain's rows live with
+ * their owners and merge in from their contract modules:
+ * field → `@snap-rail/equipment` (`./wire`), ModbusTCP →
+ * `@snap-rail/driver-modbus/contract`, station → `@snap-rail/station-rpc/contract`,
+ * plugin admin → `@snap-rail/app-boot/contract`. A program sees the rows of
+ * every contract it imports — the open-world rule.
+ *
+ * Reserved-method discipline: the map holds only implemented methods; an
+ * unknown method fails loud at dispatch (`bad-request`) — no
+ * not-implemented fallback code.
+ *
+ * @module @snap-rail/protocol/methods
+ */
+export {};
+//# sourceMappingURL=methods.js.map

package/lib/types/rpc.d.ts

@@ -0,0 +1,132 @@
+/**
+ * The four-quadrant message model: every logical message is classified by
+ * "who initiates × request/response", decoupled from the physical channel.
+ * Swapping the carrier (in-process, Electron IPC, a future WebSocket) leaves
+ * the quadrants unchanged; direction is a property of the message, never
+ * inferred from the channel.
+ *
+ * rpcId discipline: whoever initiates mints; a response always echoes the
+ * corresponding request's rpcId and never mints a new id. Pure-push frames
+ * mint a fresh id per push; answerable frames (a future approval/question
+ * family) reuse one stable id until answered.
+ *
+ * @module @snap-rail/protocol/rpc
+ */
+import type { Branded } from '@snap-rail/util';
+/** Identifier correlating a request with its response. */
+export type RpcId = Branded<string, 'RpcId'>;
+/** Mint an rpc identifier. Only carriers and frame pumps mint; business code never does. */
+export declare function RpcId(value: string): RpcId;
+/** ① A client-initiated request: call a host method.
+ * @param rpcId - minted by the client.
+ * @param method - the method key; also the discriminator handlers dispatch on.
+ * @param payload - the business payload, validated per method at the host.
+ */
+export interface ClientRequest {
+    type: 'client-request';
+    rpcId: RpcId;
+    method: string;
+    payload: unknown;
+}
+/** ② The response to a {@link ClientRequest}. Always echoes its rpcId.
+ * @param rpcId - echoed from the request; never minted here.
+ * @param result - business outcome; methods do not throw business errors.
+ */
+export interface ServerResponse {
+    type: 'server-response';
+    rpcId: RpcId;
+    result: RpcResult<unknown>;
+}
+/** ③ A host-initiated request: a push frame (or a future answerable request).
+ * @param rpcId - minted by the host frame pump; fresh per push frame.
+ * @param method - the frame type.
+ * @param payload - the frame payload.
+ */
+export interface ServerRequest {
+    type: 'server-request';
+    rpcId: RpcId;
+    method: string;
+    payload: unknown;
+}
+/** ④ The response to a {@link ServerRequest}. Always echoes its rpcId. */
+export interface ClientResponse {
+    type: 'client-response';
+    rpcId: RpcId;
+    result: RpcResult<unknown>;
+}
+/** Every wire message; narrowed via `switch (message.type)`. */
+export type RpcMessage = ClientRequest | ServerResponse | ServerRequest | ClientResponse;
+/** Business outcome of a method. Transport failures are carrier exceptions; the two layers never mix. */
+export type RpcResult<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    error: RpcError;
+};
+/** Details required per error code; adding a code = one map row (compile-checked). */
+export interface RpcErrorDetailsMap {
+    'bad-request': {
+        issues: readonly string[];
+    };
+    'not-found': {
+        what: string;
+    };
+    'conflict': {
+        what: string;
+    };
+    'unavailable': {
+        what: string;
+    };
+    'internal': {
+        hint?: string;
+    };
+}
+/** Discriminated error union; `code` discriminates, `details` narrows. */
+export type RpcError = {
+    [K in keyof RpcErrorDetailsMap]: {
+        code: K;
+        details: RpcErrorDetailsMap[K];
+    };
+}[keyof RpcErrorDetailsMap];
+/** Narrow request form seen by typed signatures; carriers complete it into a full form. */
+export type RpcRequest<P> = {
+    rpcId: RpcId;
+    payload: P;
+};
+/** Narrow response form seen by typed signatures. */
+export type RpcResponse<T> = {
+    rpcId: RpcId;
+    result: RpcResult<T>;
+};
+/**
+ * Construct a success result.
+ * @param value - the method's return value.
+ */
+export declare function ok<T>(value: T): RpcResult<T>;
+/**
+ * Construct a business-error result.
+ * @param code - the error code.
+ * @param details - code-specific details (required).
+ */
+export declare function err<K extends keyof RpcErrorDetailsMap>(code: K, details: RpcErrorDetailsMap[K]): {
+    ok: false;
+    error: Extract<RpcError, {
+        code: K;
+    }>;
+};
+/**
+ * Thrown by method handlers to fail with a business error; the gateway
+ * converts it into `{ ok: false, error }` on the wire. Carrying it as a
+ * throw keeps handler happy paths free of result wrapping.
+ */
+export declare class RpcBusinessError extends Error {
+    readonly error: RpcError;
+    constructor(error: RpcError);
+}
+/**
+ * Type guard narrowing an unknown value to {@link RpcError}.
+ * @param value - candidate error.
+ */
+export declare function isRpcError(value: unknown): value is RpcError;
+//# sourceMappingURL=rpc.d.ts.map

package/lib/types/rpc.js

@@ -0,0 +1,57 @@
+/**
+ * The four-quadrant message model: every logical message is classified by
+ * "who initiates × request/response", decoupled from the physical channel.
+ * Swapping the carrier (in-process, Electron IPC, a future WebSocket) leaves
+ * the quadrants unchanged; direction is a property of the message, never
+ * inferred from the channel.
+ *
+ * rpcId discipline: whoever initiates mints; a response always echoes the
+ * corresponding request's rpcId and never mints a new id. Pure-push frames
+ * mint a fresh id per push; answerable frames (a future approval/question
+ * family) reuse one stable id until answered.
+ *
+ * @module @snap-rail/protocol/rpc
+ */
+/** Mint an rpc identifier. Only carriers and frame pumps mint; business code never does. */
+export function RpcId(value) {
+    return value;
+}
+/**
+ * Construct a success result.
+ * @param value - the method's return value.
+ */
+export function ok(value) {
+    return { ok: true, value };
+}
+/**
+ * Construct a business-error result.
+ * @param code - the error code.
+ * @param details - code-specific details (required).
+ */
+export function err(code, details) {
+    return { ok: false, error: { code, details } };
+}
+/**
+ * Thrown by method handlers to fail with a business error; the gateway
+ * converts it into `{ ok: false, error }` on the wire. Carrying it as a
+ * throw keeps handler happy paths free of result wrapping.
+ */
+export class RpcBusinessError extends Error {
+    error;
+    constructor(error) {
+        super(`rpc business error: ${error.code}`);
+        this.error = error;
+        this.name = 'RpcBusinessError';
+    }
+}
+/**
+ * Type guard narrowing an unknown value to {@link RpcError}.
+ * @param value - candidate error.
+ */
+export function isRpcError(value) {
+    if (value === null || typeof value !== 'object')
+        return false;
+    const record = value;
+    return typeof record.code === 'string' && 'details' in record;
+}
+//# sourceMappingURL=rpc.js.map

package/lib/types/schemas.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Envelope validation at the trust boundary: the type/rpcId/method
+ * structure of every inbound message. Per-method payload schemas travel
+ * with each registration (`ctx.rpc.method`) — there is no central method
+ * table. Host responses are produced by trusted code and are not
+ * re-validated in phase 1.
+ *
+ * @module @snap-rail/protocol/schemas
+ */
+import { type ClientRequest, type ServerRequest } from './rpc.ts';
+/**
+ * Parse an inbound client request envelope.
+ * @param raw - the untrusted wire value.
+ * @returns the parsed envelope with a branded rpcId.
+ * @throws a zod error naming every envelope violation.
+ */
+export declare function parseClientRequest(raw: unknown): ClientRequest;
+/**
+ * Parse an inbound host frame on a client.
+ * @param raw - the untrusted wire value.
+ * @returns the parsed frame.
+ * @throws a zod error naming every envelope violation.
+ */
+export declare function parseServerRequest(raw: unknown): ServerRequest;
+//# sourceMappingURL=schemas.d.ts.map

package/lib/types/schemas.js

@@ -0,0 +1,43 @@
+/**
+ * Envelope validation at the trust boundary: the type/rpcId/method
+ * structure of every inbound message. Per-method payload schemas travel
+ * with each registration (`ctx.rpc.method`) — there is no central method
+ * table. Host responses are produced by trusted code and are not
+ * re-validated in phase 1.
+ *
+ * @module @snap-rail/protocol/schemas
+ */
+import { z } from 'zod';
+import { RpcId } from "./rpc.js";
+const rpcIdSchema = z.string().min(1).transform(RpcId);
+const clientRequestShape = z.object({
+    type: z.literal('client-request'),
+    rpcId: rpcIdSchema,
+    method: z.string().min(1),
+    payload: z.unknown(),
+});
+/**
+ * Parse an inbound client request envelope.
+ * @param raw - the untrusted wire value.
+ * @returns the parsed envelope with a branded rpcId.
+ * @throws a zod error naming every envelope violation.
+ */
+export function parseClientRequest(raw) {
+    return clientRequestShape.parse(raw);
+}
+const serverRequestShape = z.object({
+    type: z.literal('server-request'),
+    rpcId: rpcIdSchema,
+    method: z.string().min(1),
+    payload: z.unknown(),
+});
+/**
+ * Parse an inbound host frame on a client.
+ * @param raw - the untrusted wire value.
+ * @returns the parsed frame.
+ * @throws a zod error naming every envelope violation.
+ */
+export function parseServerRequest(raw) {
+    return serverRequestShape.parse(raw);
+}
+//# sourceMappingURL=schemas.js.map

package/lib/types/surfaces.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The surface vocabulary: one renderer window role. `main` is the operator
+ * window (the app's only always-present surface); `ball` is the auxiliary
+ * always-on-top surface a plugin drives through the Shell seam — the floating
+ * ball.
+ *
+ * A surface is an identity, not a layout. Every surface boots the same
+ * renderer with its own client entry (`snapRail.client.surfaces`) and its own
+ * seed set; a plugin face binds to exactly one surface and reads
+ * `ctx.client.surface` to know which. Auxiliary surfaces never subscribe to
+ * equipment points directly — they consume host-aggregated frames, because a
+ * hidden surface must not keep a data path alive and a shown one must not
+ * need a second subscription graph.
+ *
+ * The whitelist is closed on purpose: a plugin may not name an arbitrary URL
+ * or spawn an arbitrary window — the Shell owns every window and only these
+ * two roles exist.
+ *
+ * @module @snap-rail/protocol/surfaces
+ */
+/** Every surface id, in boot order (`main` first). */
+export declare const SURFACE_IDS: readonly ["main", "ball"];
+/** The always-on-top auxiliary surfaces: windows the Shell creates lazily. */
+export declare const AUX_SURFACE_IDS: readonly ["ball"];
+/** One renderer window role. */
+export type SurfaceId = (typeof SURFACE_IDS)[number];
+/** One auxiliary surface role. */
+export type AuxSurfaceId = (typeof AUX_SURFACE_IDS)[number];
+/**
+ * Whether a wire value names a surface.
+ *
+ * @param value - the candidate (any wire value).
+ * @returns true when the value is a {@link SurfaceId}.
+ */
+export declare function isSurfaceId(value: unknown): value is SurfaceId;
+/**
+ * Whether a wire value names an auxiliary surface.
+ *
+ * @param value - the candidate (any wire value).
+ * @returns true when the value is an {@link AuxSurfaceId}.
+ */
+export declare function isAuxSurfaceId(value: unknown): value is AuxSurfaceId;
+//# sourceMappingURL=surfaces.d.ts.map