@stigmer/server 3.14.0-dev.20260910084630

package/dist/transport/cors.d.ts

@@ -0,0 +1,51 @@
+/**
+ * CORS for the unified port's two lane families. Two deliberately different
+ * policies, both ported from verified Go behavior:
+ *
+ * REGISTRY lanes (`registryCorsHeaders`/`handleRegistryPreflight`): the
+ * byte-for-byte port of pkg/server/registry_cors.go (oss#571) —
+ * `Access-Control-Allow-Origin: *` on every response; OPTIONS answered 204
+ * with the fixed `GET, OPTIONS` / `Authorization, Content-Type` allow-lists.
+ * Asserted by the CW-10 conformance suite.
+ *
+ * RPC lane (`applyRpcCors`/`isRpcPreflight`): mirrors what the Go server's
+ * gRPC-Web wrapper actually does — improbable-eng/grpc-web v0.15.0 wrapping
+ * rs/cors v1.7.0 with AllowOriginFunc=allow-all, AllowedHeaders=["*"],
+ * AllowCredentials=true, MaxAge=600 (grpcweb/wrapper.go:70-76). Concretely:
+ * the request Origin is echoed (never `*` — credentials mode), preflights
+ * answer 200 with the requested method/headers echoed back, and
+ * `WithCorsForRegisteredEndpointsOnly(false)` means preflights succeed for
+ * ANY path, registered or not (server.go:777-784, the silent-preflight-404
+ * fix).
+ *
+ * One ratified extension (D2 delta 2): Go only classifies a preflight as
+ * gRPC-Web CORS when the requested headers include `x-grpc-web`
+ * (grpcweb/wrapper.go IsAcceptableGrpcCorsRequest). The Connect protocol's
+ * browser preflights carry `content-type` but not `x-grpc-web`, so under
+ * Go's predicate the protocol this server ADDS would be unusable from
+ * browsers. The RPC lane therefore answers every OPTIONS carrying
+ * `Access-Control-Request-Method` — a strict superset of Go's behavior,
+ * disclosed with the Connect delta rather than silent.
+ */
+import type { LaneRequest, LaneResponse } from "./lanes.js";
+/** Applies the registry lanes' unconditional allow-all header (Go registryCORS). */
+export declare function applyRegistryCorsHeaders(response: LaneResponse): void;
+/**
+ * Answers a registry-lane OPTIONS request exactly as Go's registryCORS:
+ * 204 with the fixed allow-lists. Returns false for non-OPTIONS requests.
+ */
+export declare function handleRegistryPreflight(request: LaneRequest, response: LaneResponse): boolean;
+/** rs/cors preflight predicate: OPTIONS carrying Access-Control-Request-Method. */
+export declare function isRpcPreflight(request: LaneRequest): boolean;
+/**
+ * Answers an RPC-lane preflight in rs/cors v1.7 shape: 200, Origin echoed,
+ * requested method and headers echoed, credentials allowed, Max-Age 600.
+ */
+export declare function handleRpcPreflight(request: LaneRequest, response: LaneResponse): void;
+/**
+ * Stamps actual-request (non-preflight) CORS headers on an RPC-lane
+ * response when the request is cross-origin: Origin echoed + credentials,
+ * as rs/cors handleActualRequest does for the Go wrapper.
+ */
+export declare function applyRpcCorsHeaders(request: LaneRequest, response: LaneResponse): void;
+//# sourceMappingURL=cors.d.ts.map

package/dist/transport/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/transport/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAK5D,oFAAoF;AACpF,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,CAErE;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,GACrB,OAAO,CAaT;AAED,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAK5D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,GACrB,IAAI,CAyBN;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,GACrB,IAAI,CAON"}

package/dist/transport/cors.js

@@ -0,0 +1,67 @@
+/** rs/cors option in the Go wrapper: 10 minutes, "pre-flights every 5s for Chromium :(". */
+const RPC_PREFLIGHT_MAX_AGE_SECONDS = "600";
+/** Applies the registry lanes' unconditional allow-all header (Go registryCORS). */
+export function applyRegistryCorsHeaders(response) {
+    response.setHeader("Access-Control-Allow-Origin", "*");
+}
+/**
+ * Answers a registry-lane OPTIONS request exactly as Go's registryCORS:
+ * 204 with the fixed allow-lists. Returns false for non-OPTIONS requests.
+ */
+export function handleRegistryPreflight(request, response) {
+    if (request.method !== "OPTIONS") {
+        return false;
+    }
+    applyRegistryCorsHeaders(response);
+    response.setHeader("Access-Control-Allow-Methods", "GET, OPTIONS");
+    response.setHeader("Access-Control-Allow-Headers", "Authorization, Content-Type");
+    response.statusCode = 204;
+    response.end();
+    return true;
+}
+/** rs/cors preflight predicate: OPTIONS carrying Access-Control-Request-Method. */
+export function isRpcPreflight(request) {
+    return (request.method === "OPTIONS" &&
+        typeof request.headers["access-control-request-method"] === "string");
+}
+/**
+ * Answers an RPC-lane preflight in rs/cors v1.7 shape: 200, Origin echoed,
+ * requested method and headers echoed, credentials allowed, Max-Age 600.
+ */
+export function handleRpcPreflight(request, response) {
+    const origin = request.headers["origin"];
+    response.setHeader("Vary", [
+        "Origin",
+        "Access-Control-Request-Method",
+        "Access-Control-Request-Headers",
+    ]);
+    if (typeof origin === "string") {
+        response.setHeader("Access-Control-Allow-Origin", origin);
+        response.setHeader("Access-Control-Allow-Credentials", "true");
+        const requestedMethod = request.headers["access-control-request-method"];
+        if (typeof requestedMethod === "string") {
+            response.setHeader("Access-Control-Allow-Methods", requestedMethod.toUpperCase());
+        }
+        const requestedHeaders = request.headers["access-control-request-headers"];
+        if (typeof requestedHeaders === "string" && requestedHeaders !== "") {
+            response.setHeader("Access-Control-Allow-Headers", requestedHeaders);
+        }
+        response.setHeader("Access-Control-Max-Age", RPC_PREFLIGHT_MAX_AGE_SECONDS);
+    }
+    response.statusCode = 200;
+    response.end();
+}
+/**
+ * Stamps actual-request (non-preflight) CORS headers on an RPC-lane
+ * response when the request is cross-origin: Origin echoed + credentials,
+ * as rs/cors handleActualRequest does for the Go wrapper.
+ */
+export function applyRpcCorsHeaders(request, response) {
+    response.setHeader("Vary", "Origin");
+    const origin = request.headers["origin"];
+    if (typeof origin === "string") {
+        response.setHeader("Access-Control-Allow-Origin", origin);
+        response.setHeader("Access-Control-Allow-Credentials", "true");
+    }
+}
+//# sourceMappingURL=cors.js.map

package/dist/transport/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/transport/cors.ts"],"names":[],"mappings":"AA+BA,4FAA4F;AAC5F,MAAM,6BAA6B,GAAG,KAAK,CAAC;AAE5C,oFAAoF;AACpF,MAAM,UAAU,wBAAwB,CAAC,QAAsB;IAC7D,QAAQ,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAoB,EACpB,QAAsB;IAEtB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;IACnE,QAAQ,CAAC,SAAS,CAChB,8BAA8B,EAC9B,6BAA6B,CAC9B,CAAC;IACF,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,CAAC;IACf,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,cAAc,CAAC,OAAoB;IACjD,OAAO,CACL,OAAO,CAAC,MAAM,KAAK,SAAS;QAC5B,OAAO,OAAO,CAAC,OAAO,CAAC,+BAA+B,CAAC,KAAK,QAAQ,CACrE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAoB,EACpB,QAAsB;IAEtB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE;QACzB,QAAQ;QACR,+BAA+B;QAC/B,gCAAgC;KACjC,CAAC,CAAC;IACH,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,QAAQ,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;QAC1D,QAAQ,CAAC,SAAS,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;QAC/D,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;QACzE,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;YACxC,QAAQ,CAAC,SAAS,CAChB,8BAA8B,EAC9B,eAAe,CAAC,WAAW,EAAE,CAC9B,CAAC;QACJ,CAAC;QACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;QAC3E,IAAI,OAAO,gBAAgB,KAAK,QAAQ,IAAI,gBAAgB,KAAK,EAAE,EAAE,CAAC;YACpE,QAAQ,CAAC,SAAS,CAAC,8BAA8B,EAAE,gBAAgB,CAAC,CAAC;QACvE,CAAC;QACD,QAAQ,CAAC,SAAS,CAAC,wBAAwB,EAAE,6BAA6B,CAAC,CAAC;IAC9E,CAAC;IACD,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAoB,EACpB,QAAsB;IAEtB,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,QAAQ,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;QAC1D,QAAQ,CAAC,SAAS,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;IACjE,CAAC;AACH,CAAC"}

package/dist/transport/demux.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Cleartext protocol demux for the unified port — the TS equivalent of Go's
+ * h2c wrapper (backend/libs/go/grpc/server.go, StartHTTP).
+ *
+ * Why this exists: Go's h2c handler transparently serves HTTP/2
+ * prior-knowledge AND HTTP/1.1 on one cleartext socket. Node's cleartext
+ * `http2.createServer` does not fall back to HTTP/1.1 (its `allowHTTP1`
+ * option is TLS/ALPN-only), and browsers only speak HTTP/1.1 on cleartext.
+ * The port's clients therefore split by protocol: native gRPC (runner,
+ * conformance harness) opens HTTP/2 with prior knowledge; browser gRPC-Web,
+ * Connect-over-1.1, and the REST lanes speak HTTP/1.1.
+ *
+ * Mechanism: every HTTP/2 prior-knowledge connection MUST begin with the
+ * 24-byte client connection preface (RFC 9113 §3.4). We peek the first bytes
+ * of each socket, decide the moment the bytes diverge from (or complete) the
+ * preface, and hand the socket to the matching protocol server. HTTP/1.1
+ * requests diverge at byte 0 ("GET", "POST", "OPTI"…), so the common browser
+ * path decides on the first chunk.
+ *
+ * The two handoffs are deliberately different (spike SP-A finding,
+ * 2026-08-23): Node's HTTP/1.1 parser reads the socket as a JS stream, so
+ * `unshift` replays the peeked bytes for it. Node's HTTP/2 core instead
+ * consumes the socket's NATIVE handle — bytes unshifted into the JS stream
+ * buffer never reach it, and the session fails with "bad client magic". The
+ * h2 lane therefore hands over a small replay Duplex (peeked bytes first,
+ * then the live socket), which http2 accepts through its JSStreamSocket
+ * path. Only HTTP/2 connections pay the wrapper; they are few and
+ * long-lived (the runner and harness hold channels open), so the per-byte
+ * JS-stream hop amortizes and HTTP/1.1 traffic stays on the raw socket.
+ *
+ * The CLI's readiness gate is a bare TCP probe (connect + close, no data —
+ * client-apps/cli/src/local/daemon/components.ts serverGate). Sockets that
+ * close before a decision are simply released; they must never log errors
+ * or crash the process.
+ *
+ * Proven by spike SP-A (D2 spike register): the co-located test exercises
+ * all four verified client transports against this demux.
+ */
+import type { Server as Http1Server } from "node:http";
+import type { Http2Server } from "node:http2";
+import { type Server } from "node:net";
+/**
+ * The HTTP/2 client connection preface (RFC 9113 §3.4). Byte-exact; a
+ * cleartext client either opens with these 24 bytes or it is not speaking
+ * HTTP/2 prior-knowledge.
+ */
+export declare const HTTP2_CONNECTION_PREFACE: Buffer<ArrayBuffer>;
+export interface DemuxTargets {
+    /** Serves browser gRPC-Web, Connect over 1.1, and the REST lanes. */
+    http1: Http1Server;
+    /** Serves native gRPC and the HTTP/2 flavors of Connect/gRPC-Web. */
+    http2: Http2Server;
+}
+/**
+ * Creates the TCP front server that peeks each connection's first bytes and
+ * routes the socket to the HTTP/1.1 or HTTP/2 server. The returned server is
+ * the one that binds the unified port; the protocol servers never listen
+ * themselves.
+ */
+export declare function createProtocolDemuxServer(targets: DemuxTargets): Server;
+//# sourceMappingURL=demux.d.ts.map

package/dist/transport/demux.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"demux.d.ts","sourceRoot":"","sources":["../../src/transport/demux.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,KAAK,EAAE,MAAM,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAgB,KAAK,MAAM,EAAe,MAAM,UAAU,CAAC;AAGlE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,qBAGpC,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,qEAAqE;IACrE,KAAK,EAAE,WAAW,CAAC;IACnB,qEAAqE;IACrE,KAAK,EAAE,WAAW,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CAIvE"}

package/dist/transport/demux.js

@@ -0,0 +1,107 @@
+import { createServer } from "node:net";
+import { Duplex } from "node:stream";
+/**
+ * The HTTP/2 client connection preface (RFC 9113 §3.4). Byte-exact; a
+ * cleartext client either opens with these 24 bytes or it is not speaking
+ * HTTP/2 prior-knowledge.
+ */
+export const HTTP2_CONNECTION_PREFACE = Buffer.from("PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n", "latin1");
+/**
+ * Creates the TCP front server that peeks each connection's first bytes and
+ * routes the socket to the HTTP/1.1 or HTTP/2 server. The returned server is
+ * the one that binds the unified port; the protocol servers never listen
+ * themselves.
+ */
+export function createProtocolDemuxServer(targets) {
+    return createServer({ noDelay: true }, (socket) => {
+        routeByPreface(socket, targets);
+    });
+}
+function routeByPreface(socket, targets) {
+    const peeked = [];
+    let peekedLength = 0;
+    const cleanup = () => {
+        socket.removeListener("data", onData);
+        socket.removeListener("error", onPeekError);
+        socket.removeListener("close", cleanup);
+    };
+    // A socket that errors or closes mid-peek (TCP probes, port scanners,
+    // clients giving up) is released without routing — silently, because the
+    // readiness gate produces one of these on every daemon boot.
+    const onPeekError = () => {
+        cleanup();
+        socket.destroy();
+    };
+    const onData = (chunk) => {
+        peeked.push(chunk);
+        peekedLength += chunk.length;
+        const seen = Buffer.concat(peeked, Math.min(peekedLength, HTTP2_CONNECTION_PREFACE.length));
+        const comparable = seen.subarray(0, Math.min(seen.length, HTTP2_CONNECTION_PREFACE.length));
+        if (!HTTP2_CONNECTION_PREFACE.subarray(0, comparable.length).equals(comparable)) {
+            handoffHttp1();
+            return;
+        }
+        if (peekedLength >= HTTP2_CONNECTION_PREFACE.length) {
+            handoffHttp2();
+            return;
+        }
+        // A strict prefix of the preface: keep peeking until it completes or
+        // diverges. (No real client fragments 24 bytes, but TCP permits it.)
+    };
+    function handoffHttp1() {
+        cleanup();
+        socket.pause();
+        // The HTTP/1.1 parser reads the JS stream, so unshift replays the
+        // peeked bytes and the server parses the connection from byte 0.
+        socket.unshift(Buffer.concat(peeked, peekedLength));
+        targets.http1.emit("connection", socket);
+        socket.resume();
+    }
+    function handoffHttp2() {
+        cleanup();
+        socket.pause();
+        const replay = createReplayDuplex(socket, Buffer.concat(peeked, peekedLength));
+        targets.http2.emit("connection", replay);
+    }
+    socket.on("data", onData);
+    socket.on("error", onPeekError);
+    socket.on("close", cleanup);
+}
+/**
+ * A Duplex that delivers `head` before the socket's live bytes and forwards
+ * writes/shutdown to the socket. Required for the h2 handoff only: http2
+ * consumes the native socket handle directly, so JS-level `unshift` cannot
+ * replay peeked bytes for it (verified in spike SP-A). Backpressure maps
+ * both ways: a full Duplex buffer pauses the socket; http2 reads resume it.
+ */
+function createReplayDuplex(socket, head) {
+    const replay = new Duplex({
+        read() {
+            socket.resume();
+        },
+        write(chunk, encoding, callback) {
+            socket.write(chunk, encoding, callback);
+        },
+        final(callback) {
+            socket.end(callback);
+        },
+        destroy(error, callback) {
+            socket.destroy();
+            callback(error);
+        },
+    });
+    socket.on("data", (chunk) => {
+        if (!replay.push(chunk)) {
+            socket.pause();
+        }
+    });
+    socket.on("end", () => {
+        replay.push(null);
+    });
+    socket.on("error", (error) => {
+        replay.destroy(error);
+    });
+    replay.push(head);
+    return replay;
+}
+//# sourceMappingURL=demux.js.map

package/dist/transport/demux.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"demux.js","sourceRoot":"","sources":["../../src/transport/demux.ts"],"names":[],"mappings":"AAwCA,OAAO,EAAE,YAAY,EAA4B,MAAM,UAAU,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,IAAI,CACjD,kCAAkC,EAClC,QAAQ,CACT,CAAC;AASF;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAqB;IAC7D,OAAO,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE;QAChD,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,OAAqB;IAC3D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC5C,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC,CAAC;IAEF,sEAAsE;IACtE,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,WAAW,GAAG,GAAS,EAAE;QAC7B,OAAO,EAAE,CAAC;QACV,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAQ,EAAE;QACrC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,YAAY,IAAI,KAAK,CAAC,MAAM,CAAC;QAE7B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CACxB,MAAM,EACN,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,wBAAwB,CAAC,MAAM,CAAC,CACxD,CAAC;QACF,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAC9B,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,wBAAwB,CAAC,MAAM,CAAC,CACvD,CAAC;QAEF,IACE,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAC7D,UAAU,CACX,EACD,CAAC;YACD,YAAY,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QACD,IAAI,YAAY,IAAI,wBAAwB,CAAC,MAAM,EAAE,CAAC;YACpD,YAAY,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QACD,qEAAqE;QACrE,qEAAqE;IACvE,CAAC,CAAC;IAEF,SAAS,YAAY;QACnB,OAAO,EAAE,CAAC;QACV,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,kEAAkE;QAClE,iEAAiE;QACjE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,EAAE,CAAC;IAClB,CAAC;IAED,SAAS,YAAY;QACnB,OAAO,EAAE,CAAC;QACV,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,kBAAkB,CAC/B,MAAM,EACN,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CACpC,CAAC;QACF,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAChC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,MAAc,EAAE,IAAY;IACtD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;QACxB,IAAI;YACF,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,CAAC;QACD,KAAK,CACH,KAAa,EACb,QAAwB,EACxB,QAAwC;YAExC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,QAAwC;YAC5C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,CACL,KAAmB,EACnB,QAAwC;YAExC,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;QAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;QACpB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QAC3B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClB,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/transport/health.d.ts

@@ -0,0 +1,15 @@
+import type { ConnectRouter } from "@connectrpc/connect";
+import { HealthCheckResponse_ServingStatus as ServingStatus } from "@stigmer/protos/grpc/health/v1/health_pb";
+type StatusListener = (status: ServingStatus) => void;
+export declare class HealthState {
+    private readonly statuses;
+    private readonly listeners;
+    constructor();
+    setOverall(status: ServingStatus): void;
+    status(service: string): ServingStatus | undefined;
+    subscribe(service: string, listener: StatusListener): () => void;
+}
+/** Registers the health service backed by the given state. */
+export declare function registerHealthService(router: ConnectRouter, state: HealthState): void;
+export {};
+//# sourceMappingURL=health.d.ts.map

package/dist/transport/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/transport/health.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAEL,iCAAiC,IAAI,aAAa,EACnD,MAAM,0CAA0C,CAAC;AAElD,KAAK,cAAc,GAAG,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;AAKtD,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0C;;IAMpE,UAAU,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;IAOvC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAIlD,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,MAAM,IAAI;CAQjE;AAED,8DAA8D;AAC9D,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,WAAW,GACjB,IAAI,CAkEN"}

package/dist/transport/health.js

@@ -0,0 +1,105 @@
+/**
+ * gRPC health service (grpc.health.v1) — the readiness gate.
+ *
+ * Ports the Go server's health posture (backend/libs/go/grpc/server.go):
+ * the overall status ("" service) starts NOT_SERVING at construction and
+ * flips SERVING only after the composition root completes — "ready" means
+ * "wired and answering RPCs", never merely "port bound" (server.go:739-742).
+ * Shutdown flips NOT_SERVING FIRST, before the drain (Stop, :247-265).
+ * The CLI's serverGate TCP probe keys off the port bind, which the boot
+ * sequence therefore performs only after this state is SERVING.
+ *
+ * Semantics match grpc-go's health server: Check on an unknown service is
+ * NOT_FOUND; Watch answers immediately with the current status
+ * (SERVICE_UNKNOWN if unset), stays open, and streams changes.
+ */
+import { Code, ConnectError } from "@connectrpc/connect";
+import { Health, HealthCheckResponse_ServingStatus as ServingStatus, } from "@stigmer/protos/grpc/health/v1/health_pb";
+/** The "" service name = the server's overall health (gRPC convention). */
+const OVERALL = "";
+export class HealthState {
+    statuses = new Map();
+    listeners = new Map();
+    constructor() {
+        this.statuses.set(OVERALL, ServingStatus.NOT_SERVING);
+    }
+    setOverall(status) {
+        this.statuses.set(OVERALL, status);
+        for (const listener of this.listeners.get(OVERALL) ?? []) {
+            listener(status);
+        }
+    }
+    status(service) {
+        return this.statuses.get(service);
+    }
+    subscribe(service, listener) {
+        const set = this.listeners.get(service) ?? new Set();
+        set.add(listener);
+        this.listeners.set(service, set);
+        return () => {
+            set.delete(listener);
+        };
+    }
+}
+/** Registers the health service backed by the given state. */
+export function registerHealthService(router, state) {
+    router.service(Health, {
+        check: (request) => {
+            const status = state.status(request.service);
+            if (status === undefined) {
+                throw new ConnectError(`unknown service ${request.service}`, Code.NotFound);
+            }
+            return { status };
+        },
+        list: () => {
+            const statuses = {};
+            const overall = state.status(OVERALL);
+            if (overall !== undefined) {
+                statuses[OVERALL] = { status: overall };
+            }
+            return { statuses };
+        },
+        watch: async function* (request, context) {
+            // Immediate current status (SERVICE_UNKNOWN for unset — grpc-go keeps
+            // the stream OPEN in that case rather than failing, so a client can
+            // watch a service that registers later).
+            let latest = state.status(request.service) ?? ServingStatus.SERVICE_UNKNOWN;
+            yield { status: latest };
+            // Stream every change until the client disconnects. The queue-plus-
+            // notify shape keeps updates ordered even if several arrive while the
+            // consumer is mid-yield.
+            const pending = [];
+            let notify;
+            const unsubscribe = state.subscribe(request.service, (status) => {
+                pending.push(status);
+                notify?.();
+            });
+            const abort = new Promise((resolve) => {
+                context.signal.addEventListener("abort", () => resolve(), {
+                    once: true,
+                });
+            });
+            try {
+                while (!context.signal.aborted) {
+                    if (pending.length === 0) {
+                        await Promise.race([
+                            abort,
+                            new Promise((resolve) => (notify = resolve)),
+                        ]);
+                        notify = undefined;
+                        continue;
+                    }
+                    const next = pending.shift();
+                    if (next !== undefined && next !== latest) {
+                        latest = next;
+                        yield { status: next };
+                    }
+                }
+            }
+            finally {
+                unsubscribe();
+            }
+        },
+    });
+}
+//# sourceMappingURL=health.js.map

package/dist/transport/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../src/transport/health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EACL,MAAM,EACN,iCAAiC,IAAI,aAAa,GACnD,MAAM,0CAA0C,CAAC;AAIlD,2EAA2E;AAC3E,MAAM,OAAO,GAAG,EAAE,CAAC;AAEnB,MAAM,OAAO,WAAW;IACL,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC5C,SAAS,GAAG,IAAI,GAAG,EAA+B,CAAC;IAEpE;QACE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IACxD,CAAC;IAED,UAAU,CAAC,MAAqB;QAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YACzD,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,MAAM,CAAC,OAAe;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,SAAS,CAAC,OAAe,EAAE,QAAwB;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,EAAkB,CAAC;QACrE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACjC,OAAO,GAAG,EAAE;YACV,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC,CAAC;IACJ,CAAC;CACF;AAED,8DAA8D;AAC9D,MAAM,UAAU,qBAAqB,CACnC,MAAqB,EACrB,KAAkB;IAElB,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE;QACrB,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE;YACjB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,YAAY,CACpB,mBAAmB,OAAO,CAAC,OAAO,EAAE,EACpC,IAAI,CAAC,QAAQ,CACd,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB,CAAC;QAED,IAAI,EAAE,GAAG,EAAE;YACT,MAAM,QAAQ,GAA8C,EAAE,CAAC;YAC/D,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC1C,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtB,CAAC;QAED,KAAK,EAAE,KAAK,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO;YACtC,sEAAsE;YACtE,oEAAoE;YACpE,yCAAyC;YACzC,IAAI,MAAM,GACR,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,eAAe,CAAC;YACjE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YAEzB,oEAAoE;YACpE,sEAAsE;YACtE,yBAAyB;YACzB,MAAM,OAAO,GAAoB,EAAE,CAAC;YACpC,IAAI,MAAgC,CAAC;YACrC,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE;gBAC9D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrB,MAAM,EAAE,EAAE,CAAC;YACb,CAAC,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAC1C,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE;oBACxD,IAAI,EAAE,IAAI;iBACX,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC;gBACH,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC/B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBACzB,MAAM,OAAO,CAAC,IAAI,CAAC;4BACjB,KAAK;4BACL,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;yBACnD,CAAC,CAAC;wBACH,MAAM,GAAG,SAAS,CAAC;wBACnB,SAAS;oBACX,CAAC;oBACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;oBAC7B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;wBAC1C,MAAM,GAAG,IAAI,CAAC;wBACd,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;oBACzB,CAAC;gBACH,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,WAAW,EAAE,CAAC;YAChB,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/transport/lanes.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Shared request/response types for the unified port's lanes. The demux
+ * routes each connection to the HTTP/1.1 or HTTP/2 server, and BOTH run the
+ * same lane router — so every lane handler must accept both protocol
+ * stacks' shapes (the members used — headers, method, url, setHeader,
+ * statusCode, end — behave identically on both).
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { Http2ServerRequest, Http2ServerResponse } from "node:http2";
+export type LaneRequest = IncomingMessage | Http2ServerRequest;
+export type LaneResponse = ServerResponse | Http2ServerResponse;
+export type LaneHandler = (request: LaneRequest, response: LaneResponse) => void;
+//# sourceMappingURL=lanes.d.ts.map

package/dist/transport/lanes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lanes.d.ts","sourceRoot":"","sources":["../../src/transport/lanes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAE1E,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,kBAAkB,CAAC;AAC/D,MAAM,MAAM,YAAY,GAAG,cAAc,GAAG,mBAAmB,CAAC;AAEhE,MAAM,MAAM,WAAW,GAAG,CACxB,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,YAAY,KACnB,IAAI,CAAC"}

package/dist/transport/lanes.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=lanes.js.map

package/dist/transport/lanes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lanes.js","sourceRoot":"","sources":["../../src/transport/lanes.ts"],"names":[],"mappings":""}

package/dist/transport/registry/lanes.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Registry proxy lanes — the unified port's plain-HTTP JSON endpoints,
+ * ported from pkg/domain/workflow/registry/{task_kind_registry,
+ * model_registry}.go and wrapped in the registryCORS contract
+ * (pkg/server/registry_cors.go, oss#571). The CW-10 conformance suite
+ * (test/conformance/src/suites/registry-proxy.conformance.test.ts) is the
+ * executable spec these lanes are built against.
+ *
+ * The documents come from the workflow domain's registry module — the
+ * domain owns the registry, the transport serves FROM it (Go's ownership,
+ * restored by the workflow-family port's DD-A; the model-registry store's
+ * refresh lifecycle is the composition root's concern now, not a lane
+ * concern).
+ *
+ * Behavior per lane (Go task_kind_registry.go:33-51):
+ *   OPTIONS → 204 + the fixed registryCORS allow-lists,
+ *   GET     → 200, application/json, Cache-Control: public, max-age=3600,
+ *             Access-Control-Allow-Origin: *,
+ *   other   → 405 (with the allow-all header — the CORS wrap is
+ *             unconditional in Go).
+ */
+import type { ModelCatalogProvider } from "../../domain/workflow/registry/model-catalog-provider.js";
+import type { LaneHandler } from "../lanes.js";
+export interface RegistryLanes {
+    taskKindRegistryLane: LaneHandler;
+    modelRegistryLane: LaneHandler;
+}
+export interface RegistryLanesOptions {
+    /** The task-kind registry document (static per release). */
+    taskKindRegistryDocument: string;
+    /** The composed model-catalog provider the lane serves from (DD-008). */
+    modelRegistryStore: ModelCatalogProvider;
+}
+export declare function createRegistryLanes(options: RegistryLanesOptions): RegistryLanes;
+//# sourceMappingURL=lanes.d.ts.map

package/dist/transport/registry/lanes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lanes.d.ts","sourceRoot":"","sources":["../../../src/transport/registry/lanes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0DAA0D,CAAC;AAErG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAK/C,MAAM,WAAW,aAAa;IAC5B,oBAAoB,EAAE,WAAW,CAAC;IAClC,iBAAiB,EAAE,WAAW,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,4DAA4D;IAC5D,wBAAwB,EAAE,MAAM,CAAC;IACjC,yEAAyE;IACzE,kBAAkB,EAAE,oBAAoB,CAAC;CAC1C;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,oBAAoB,GAC5B,aAAa,CAKf"}

package/dist/transport/registry/lanes.js

@@ -0,0 +1,26 @@
+import { applyRegistryCorsHeaders, handleRegistryPreflight } from "../cors.js";
+/** Registries are static per release: cacheable for an hour (Go handlers). */
+const REGISTRY_CACHE_CONTROL = "public, max-age=3600";
+export function createRegistryLanes(options) {
+    return {
+        taskKindRegistryLane: registryLane(() => options.taskKindRegistryDocument),
+        modelRegistryLane: registryLane(() => options.modelRegistryStore.document()),
+    };
+}
+function registryLane(document) {
+    return (request, response) => {
+        if (handleRegistryPreflight(request, response)) {
+            return;
+        }
+        applyRegistryCorsHeaders(response);
+        if (request.method !== "GET") {
+            response.statusCode = 405;
+            response.end();
+            return;
+        }
+        response.setHeader("Content-Type", "application/json");
+        response.setHeader("Cache-Control", REGISTRY_CACHE_CONTROL);
+        response.end(document());
+    };
+}
+//# sourceMappingURL=lanes.js.map

package/dist/transport/registry/lanes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lanes.js","sourceRoot":"","sources":["../../../src/transport/registry/lanes.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAG/E,8EAA8E;AAC9E,MAAM,sBAAsB,GAAG,sBAAsB,CAAC;AActD,MAAM,UAAU,mBAAmB,CACjC,OAA6B;IAE7B,OAAO;QACL,oBAAoB,EAAE,YAAY,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC;QAC1E,iBAAiB,EAAE,YAAY,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,EAAE,CAAC;KAC7E,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,QAAsB;IAC1C,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC3B,IAAI,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7B,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;YAC1B,QAAQ,CAAC,GAAG,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QACvD,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;QAC5D,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC;AACJ,CAAC"}

package/dist/transport/server.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The unified-port server: one TCP port serving native gRPC, gRPC-Web, the
+ * Connect protocol, and the plain-HTTP REST lanes — the TS equivalent of
+ * the Go server's Run() routing block (pkg/server/server.go:775-843).
+ *
+ * Lane priority ports Go's verified if-chain exactly (server.go:812-836):
+ *
+ *   1. exact match  /v1/proxy/task-kind-registry   (registry proxy)
+ *   2. exact match  /v1/proxy/model-registry       (registry proxy)
+ *   3. prefix       /v1/skill-artifacts            (seam — lands with the
+ *                                                   skill domain sub-project)
+ *   4. guarded      console statics                (phase 2, DD-005/DD-012 —
+ *                                                   GET/HEAD only, never RPC
+ *                                                   or /v1/* paths; absent
+ *                                                   when no export is bundled)
+ *   5. RPC adapter  gRPC + gRPC-Web + Connect      (replaces Go's lanes
+ *                                                   4–5; WebSocket retired
+ *                                                   per ratified delta 1)
+ *   6. 404          (the adapter's fallback — CW-10 asserts unknown
+ *                    /v1/proxy/* paths land here)
+ *
+ * The demux (demux.ts) fronts the port; both protocol servers run this same
+ * lane router. Shutdown is Go's order (grpc lib Stop, server.go:247-265):
+ * health NOT_SERVING first, drain in-flight requests up to 10s, then
+ * destroy what remains.
+ */
+import type { ConnectRouter, Interceptor } from "@connectrpc/connect";
+import type { Logger } from "../boot/logger.js";
+import type { LaneHandler } from "./lanes.js";
+export type { LaneHandler } from "./lanes.js";
+export interface UnifiedPortServerOptions {
+    logger: Logger;
+    /** RPC surface registration (health service now; domains per sub-project). */
+    routes: (router: ConnectRouter) => void;
+    /** The pipeline chain, outermost first (pipeline/interceptors). */
+    interceptors: Interceptor[];
+    /** Lane 1: bundled task-kind registry proxy. */
+    taskKindRegistryLane: LaneHandler;
+    /** Lane 2: bundled + refreshed model registry proxy. */
+    modelRegistryLane: LaneHandler;
+    /**
+     * Lane 3 seam: skill artifact transfer (#675). Absent until the skill
+     * domain sub-project lands its handlers; the prefix then falls through to
+     * the adapter's 404, which is also what Go answers for unknown paths.
+     */
+    skillTransferLane?: LaneHandler;
+    /**
+     * Lane 4: console statics + /config.json (DD-012). Present only when a
+     * console export is bundled/configured — absent, every request flows
+     * exactly as before the lane existed. The eligibility guard lives with
+     * the handler (console/handler.ts): GET/HEAD only, never /v1/* or
+     * service-shaped paths.
+     */
+    consoleLane?: LaneHandler;
+}
+export interface UnifiedPortServer {
+    /** Binds the port. Call only after the composition root completed (the CLI's serverGate treats port-bind as readiness). */
+    listen(port: number, host?: string): Promise<number>;
+    /** Drains and closes: callers flip health NOT_SERVING before invoking. */
+    shutdown(): Promise<void>;
+}
+export declare function createUnifiedPortServer(options: UnifiedPortServerOptions): UnifiedPortServer;
+//# sourceMappingURL=server.d.ts.map

package/dist/transport/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/transport/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAOtE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAiBhD,OAAO,KAAK,EAAE,WAAW,EAA6B,MAAM,YAAY,CAAC;AAEzE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,MAAM,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;IACxC,mEAAmE;IACnE,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,gDAAgD;IAChD,oBAAoB,EAAE,WAAW,CAAC;IAClC,wDAAwD;IACxD,iBAAiB,EAAE,WAAW,CAAC;IAC/B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,WAAW,CAAC;IAChC;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,2HAA2H;IAC3H,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,0EAA0E;IAC1E,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,wBAAwB,GAChC,iBAAiB,CAoHnB"}