@vibesdotdev/host-bun 0.0.0-stage → 1.0.0-rc.3

package/dist/test-tooling/unix-http.impl.bun.js

@@ -0,0 +1,181 @@
+/** Real Bun HTTP transport for one isolated, protected test realm. */
+import { lstatSync, realpathSync } from 'node:fs';
+import { basename, dirname, isAbsolute, join, relative, sep } from 'node:path';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+import { serve } from 'bun';
+const declaration = z.object({
+    writableRoot: z.string().min(1),
+    followRedirects: z.boolean().optional(),
+    endpoints: z.array(z.object({ origin: z.string().min(1), socket: z.string().min(1) }).strict()).min(1)
+}).strict();
+// One scoped standard-fetch owner per isolated test realm. Retain custody
+// after foreign replacement until the original owner can restore it safely.
+let activeTransport;
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+const MAX_REDIRECTS = 20;
+const CROSS_ORIGIN_STRIPPED = ['authorization', 'cookie', 'proxy-authorization'];
+const BODY_HEADERS = ['content-type', 'content-length', 'content-encoding', 'content-language', 'content-location'];
+function invalid(cause) {
+    return new CapabilityError('Invalid declared Unix HTTP transport.', 'INVALID_INPUT', {
+        reason: 'test-unix-http-invalid', retryable: false, cause
+    });
+}
+/** A native host-fact read for admission; its failure refuses the declaration, keeping the native error as cause. */
+function admitted(read) {
+    try {
+        return read();
+    }
+    catch (error) {
+        throw invalid(error instanceof Error ? error : undefined);
+    }
+}
+function conflict() {
+    return new CapabilityError('The test HTTP transport already has an owner or was changed during ownership.', 'CONFLICT', {
+        reason: 'test-unix-http-custody-conflict', retryable: false
+    });
+}
+/** Bind real HTTP requests to declared pathname sockets. The OS execution
+ * owner must separately admit these exact sockets: this transport is not
+ * containment. No TCP fallback, response synthesis, DNS or abstract socket.
+ */
+function admittedEndpoints(input) {
+    const parsed = declaration.safeParse(input);
+    if (!parsed.success)
+        throw invalid();
+    if (!isAbsolute(parsed.data.writableRoot))
+        throw invalid();
+    const writableRoot = parsed.data.writableRoot;
+    const root = admitted(() => realpathSync(writableRoot));
+    const endpoints = new Map();
+    for (const endpoint of parsed.data.endpoints) {
+        if (!URL.canParse(endpoint.origin))
+            throw invalid();
+        const origin = new URL(endpoint.origin);
+        if (origin.protocol !== 'http:' || origin.origin !== endpoint.origin || origin.username || origin.password ||
+            !isAbsolute(endpoint.socket) || endpoint.socket.includes('\0'))
+            throw invalid();
+        const socket = join(admitted(() => realpathSync(dirname(endpoint.socket))), basename(endpoint.socket));
+        const part = relative(root, socket);
+        // An absent socket is admissible (the server creates it); anything else there must be a socket.
+        const existing = admitted(() => lstatSync(endpoint.socket, { throwIfNoEntry: false }));
+        if (existing !== undefined && !existing.isSocket())
+            throw invalid();
+        if (!part || isAbsolute(part) || part === '..' || part.startsWith(`..${sep}`) ||
+            endpoints.has(origin.origin) || [...endpoints.values()].includes(socket))
+            throw invalid();
+        endpoints.set(origin.origin, socket);
+    }
+    return endpoints;
+}
+/** Real server on one exact declared endpoint. Importing this Bun-only public
+ * entrypoint on an unsupported engine fails native module admission rather
+ * than using a Web fetch implementation that might ignore the unix option.
+ */
+export function createUnixHttpServer(input, origin, handler) {
+    const socket = admittedEndpoints(input).get(origin);
+    if (!socket)
+        throw invalid();
+    return serve({ unix: socket, fetch: handler });
+}
+export function createUnixHttpFetch(input) {
+    const endpoints = admittedEndpoints(input);
+    const nativeFetch = globalThis.fetch;
+    const followRedirects = input.followRedirects === true;
+    if (activeTransport)
+        throw conflict();
+    const transport = async (input, init) => {
+        const target = input instanceof Request ? input.url : String(input);
+        if (!URL.canParse(target))
+            throw invalid();
+        const origin = new URL(target).origin;
+        const socket = endpoints.get(origin);
+        if (!socket)
+            throw new CapabilityError('HTTP destination was not declared by this test workload.', 'UNAVAILABLE', {
+                reason: 'test-unix-http-undeclared-origin', retryable: false
+            });
+        // A native redirect must not initiate an undeclared destination inside
+        // fetch. Default: return the real redirect response for an explicit
+        // caller choice. With `followRedirects`, follow it here, hop by hop,
+        // only to declared origins.
+        const send = (target, requestInit, socketPath) => nativeFetch(target, { ...requestInit, redirect: 'manual', unix: socketPath, verbose: false });
+        if (!followRedirects)
+            return send(input, init, socket);
+        // One normalized request (method, headers, replayable body, signal) so every
+        // hop is built from the same facts whether the caller passed a URL or a Request.
+        const request = input instanceof Request ? new Request(input, init) : new Request(String(input), init);
+        const policy = request.redirect;
+        const requestBody = request.method === 'GET' || request.method === 'HEAD' ? undefined : await request.clone().arrayBuffer();
+        const headers = new Headers(request.headers);
+        let method = request.method;
+        let body = requestBody;
+        let current = new URL(request.url);
+        let response = await send(current.href, { method, headers, body, signal: request.signal }, socket);
+        for (let hops = 0; REDIRECT_STATUSES.has(response.status) && policy !== 'manual'; hops++) {
+            const location = response.headers.get('location');
+            if (location === null)
+                return response;
+            if (policy === 'error')
+                throw new CapabilityError('The test HTTP transport refused a redirect.', 'UNAVAILABLE', {
+                    reason: 'test-unix-http-redirect-refused', retryable: false
+                });
+            if (hops >= MAX_REDIRECTS)
+                throw new CapabilityError('Too many test HTTP redirects.', 'UNAVAILABLE', {
+                    reason: 'test-unix-http-redirect-limit', retryable: false
+                });
+            const previous = current;
+            current = new URL(location, previous);
+            const next = endpoints.get(current.origin);
+            if (!next)
+                throw new CapabilityError('HTTP redirect destination was not declared by this test workload.', 'UNAVAILABLE', {
+                    reason: 'test-unix-http-undeclared-origin', retryable: false
+                });
+            // Fetch-spec hygiene: credentials never cross origins; a rewritten GET carries no body headers.
+            if (current.origin !== previous.origin)
+                for (const name of CROSS_ORIGIN_STRIPPED)
+                    headers.delete(name);
+            if (response.status === 303 ? method !== 'HEAD' : (response.status === 301 || response.status === 302) && method === 'POST') {
+                method = 'GET';
+                body = undefined;
+                for (const name of BODY_HEADERS)
+                    headers.delete(name);
+            }
+            await response.body?.cancel();
+            response = await send(current.href, { method, headers, body, signal: request.signal }, next);
+        }
+        return response;
+    };
+    return Object.assign(transport, {
+        preconnect() {
+            throw new CapabilityError('IP preconnection is not granted by the Unix HTTP workload.', 'UNAVAILABLE', {
+                reason: 'test-unix-http-preconnect-denied', retryable: false
+            });
+        }
+    });
+}
+/** Scoped bridge for owners that use standard Web fetch. Install only inside
+ * a separately protected, isolated workload; it never modifies response data
+ * or feature code. Overlapping owners and foreign changes fail visibly.
+ */
+export function installUnixHttpTransport(input) {
+    if (activeTransport)
+        throw conflict();
+    const original = globalThis.fetch;
+    const transport = createUnixHttpFetch(input);
+    let disposed = false;
+    activeTransport = transport;
+    globalThis.fetch = transport;
+    return {
+        fetch: transport,
+        [Symbol.dispose]() {
+            if (disposed)
+                return;
+            if (globalThis.fetch !== transport)
+                throw conflict();
+            globalThis.fetch = original;
+            activeTransport = undefined;
+            disposed = true;
+        }
+    };
+}
+//# sourceMappingURL=unix-http.impl.bun.js.map

package/dist/test-tooling/unix-http.impl.bun.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unix-http.impl.bun.js","sourceRoot":"","sources":["../../src/test-tooling/unix-http.impl.bun.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,KAAK,EAAE,MAAM,KAAK,CAAC;AAE5B,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACvC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACtG,CAAC,CAAC,MAAM,EAAE,CAAC;AACZ,0EAA0E;AAC1E,4EAA4E;AAC5E,IAAI,eAAyC,CAAC;AAC9C,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAClF,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,qBAAqB,GAAG,CAAC,eAAe,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAAC;AACjF,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;AACpH,SAAS,OAAO,CAAC,KAAa;IAC7B,OAAO,IAAI,eAAe,CAAC,uCAAuC,EAAE,eAAe,EAAE;QACpF,MAAM,EAAE,wBAAwB,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK;KACzD,CAAC,CAAC;AACJ,CAAC;AACD,qHAAqH;AACrH,SAAS,QAAQ,CAAI,IAAa;IACjC,IAAI,CAAC;QACJ,OAAO,IAAI,EAAE,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,OAAO,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC;AACF,CAAC;AACD,SAAS,QAAQ;IAChB,OAAO,IAAI,eAAe,CAAC,+EAA+E,EAAE,UAAU,EAAE;QACvH,MAAM,EAAE,iCAAiC,EAAE,SAAS,EAAE,KAAK;KAC3D,CAAC,CAAC;AACJ,CAAC;AAaD;;;GAGG;AACH,SAAS,iBAAiB,CAAC,KAA0B;IACpD,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,OAAO,EAAE,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IAC3D,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;IAC9C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,MAAM,OAAO,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ;YACzG,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,OAAO,EAAE,CAAC;QACjF,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACvG,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,gGAAgG;QAChG,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACvF,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE;YAAE,MAAM,OAAO,EAAE,CAAC;QACpE,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;YAC5E,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,MAAM,OAAO,EAAE,CAAC;QAC3F,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAA0B,EAAE,MAAc,EAC9E,OAA2D;IAC3D,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM;QAAE,MAAM,OAAO,EAAE,CAAC;IAC7B,OAAO,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAA0B;IAC7D,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC;IACrC,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC;IACvD,IAAI,eAAe;QAAE,MAAM,QAAQ,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,KAAK,EAAE,KAAkC,EAAE,IAAkC,EAAE,EAAE;QAClG,MAAM,MAAM,GAAG,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,MAAM,OAAO,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QACtC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,eAAe,CAAC,0DAA0D,EAAE,aAAa,EAAE;gBACjH,MAAM,EAAE,kCAAkC,EAAE,SAAS,EAAE,KAAK;aAC5D,CAAC,CAAC;QACH,uEAAuE;QACvE,oEAAoE;QACpE,qEAAqE;QACrE,4BAA4B;QAC5B,MAAM,IAAI,GAAG,CAAC,MAA8B,EAAE,WAA4C,EAAE,UAAkB,EAAE,EAAE,CACjH,WAAW,CAAC,MAAM,EAAE,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/F,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACvD,6EAA6E;QAC7E,iFAAiF;QACjF,MAAM,OAAO,GAAG,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;QACvG,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;QAChC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5H,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC5B,IAAI,IAAI,GAA4B,WAAW,CAAC;QAChD,IAAI,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;QACnG,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,KAAK,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;YAC1F,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,QAAQ,CAAC;YACvC,IAAI,MAAM,KAAK,OAAO;gBAAE,MAAM,IAAI,eAAe,CAAC,6CAA6C,EAAE,aAAa,EAAE;oBAC/G,MAAM,EAAE,iCAAiC,EAAE,SAAS,EAAE,KAAK;iBAC3D,CAAC,CAAC;YACH,IAAI,IAAI,IAAI,aAAa;gBAAE,MAAM,IAAI,eAAe,CAAC,+BAA+B,EAAE,aAAa,EAAE;oBACpG,MAAM,EAAE,+BAA+B,EAAE,SAAS,EAAE,KAAK;iBACzD,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,OAAO,CAAC;YACzB,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,eAAe,CAAC,mEAAmE,EAAE,aAAa,EAAE;oBACxH,MAAM,EAAE,kCAAkC,EAAE,SAAS,EAAE,KAAK;iBAC5D,CAAC,CAAC;YACH,gGAAgG;YAChG,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;gBAAE,KAAK,MAAM,IAAI,IAAI,qBAAqB;oBAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC7H,MAAM,GAAG,KAAK,CAAC;gBACf,IAAI,GAAG,SAAS,CAAC;gBACjB,KAAK,MAAM,IAAI,IAAI,YAAY;oBAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvD,CAAC;YACD,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9B,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE;QAC/B,UAAU;YACT,MAAM,IAAI,eAAe,CAAC,4DAA4D,EAAE,aAAa,EAAE;gBACtG,MAAM,EAAE,kCAAkC,EAAE,SAAS,EAAE,KAAK;aAC5D,CAAC,CAAC;QACJ,CAAC;KACD,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAA0B;IAClE,IAAI,eAAe;QAAE,MAAM,QAAQ,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC;IAClC,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,eAAe,GAAG,SAAS,CAAC;IAC5B,UAAU,CAAC,KAAK,GAAG,SAAS,CAAC;IAC7B,OAAO;QACN,KAAK,EAAE,SAAS;QAChB,CAAC,MAAM,CAAC,OAAO,CAAC;YACf,IAAI,QAAQ;gBAAE,OAAO;YACrB,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS;gBAAE,MAAM,QAAQ,EAAE,CAAC;YACrD,UAAU,CAAC,KAAK,GAAG,QAAQ,CAAC;YAC5B,eAAe,GAAG,SAAS,CAAC;YAC5B,QAAQ,GAAG,IAAI,CAAC;QACjB,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/transpiler/transpiler.plugin.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Registers the Bun host's `runtime/transpiler`: the canonical `typescript` id
+ * at the host priority, over the runtime's base (the source as written). Its
+ * transpile is the applet serve-host's `Bun.Transpiler` call, so the host has
+ * one; the module loads when the kind is first resolved.
+ */
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+/** Register the kind and its base (when absent), then the Bun host's TypeScript transpiler over them. */
+export declare function registerBunTranspiler(runtime: RuntimeRef): void;
+//# sourceMappingURL=transpiler.plugin.d.ts.map

package/dist/transpiler/transpiler.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transpiler.plugin.d.ts","sourceRoot":"","sources":["../../src/transpiler/transpiler.plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAA+B,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AASnF,yGAAyG;AACzG,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CAO/D"}

package/dist/transpiler/transpiler.plugin.js

@@ -0,0 +1,18 @@
+/**
+ * Registers the Bun host's `runtime/transpiler`: the canonical `typescript` id
+ * at the host priority, over the runtime's base (the source as written). Its
+ * transpile is the applet serve-host's `Bun.Transpiler` call, so the host has
+ * one; the module loads when the kind is first resolved.
+ */
+import { createRuntimeImplementation } from '@vibesdotdev/kernel';
+import { HOST_TRANSPILER_PRIORITY, RUNTIME_TRANSPILER_KIND, TYPESCRIPT_TRANSPILER_ID, registerRuntimeTranspiler } from '@vibesdotdev/kernel/kinds/transpiler.kind';
+/** Register the kind and its base (when absent), then the Bun host's TypeScript transpiler over them. */
+export function registerBunTranspiler(runtime) {
+    registerRuntimeTranspiler(runtime);
+    runtime.registerLoader(RUNTIME_TRANSPILER_KIND, TYPESCRIPT_TRANSPILER_ID, async () => {
+        const { transpileTypeScriptSource } = await import("../applet-serve-host/applet-serve-host.impl.bun.js");
+        const implementation = { transpileTypeScript: transpileTypeScriptSource };
+        return createRuntimeImplementation({ kind: RUNTIME_TRANSPILER_KIND, id: TYPESCRIPT_TRANSPILER_ID, priority: HOST_TRANSPILER_PRIORITY, implementation });
+    }, { priority: HOST_TRANSPILER_PRIORITY });
+}
+//# sourceMappingURL=transpiler.plugin.js.map

package/dist/transpiler/transpiler.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transpiler.plugin.js","sourceRoot":"","sources":["../../src/transpiler/transpiler.plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,2BAA2B,EAAmB,MAAM,qBAAqB,CAAC;AACnF,OAAO,EACN,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EAEzB,MAAM,2CAA2C,CAAC;AAEnD,yGAAyG;AACzG,MAAM,UAAU,qBAAqB,CAAC,OAAmB;IACxD,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,CAAC,cAAc,CAAC,uBAAuB,EAAE,wBAAwB,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,MAAM,CAAC,oDAAoD,CAAC,CAAC;QACzG,MAAM,cAAc,GAAsB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,CAAC;QAC7F,OAAO,2BAA2B,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,EAAE,wBAAwB,EAAE,QAAQ,EAAE,wBAAwB,EAAE,cAAc,EAAE,CAAC,CAAC;IACzJ,CAAC,EAAE,EAAE,QAAQ,EAAE,wBAAwB,EAAE,CAAC,CAAC;AAC5C,CAAC"}

package/native/held-launch/Cargo.toml

@@ -0,0 +1,23 @@
+[workspace]
+
+[package]
+name = "vibes-held-launch"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[lib]
+name = "vibes_held_launch"
+crate-type = ["rlib", "cdylib"]
+
+[[bin]]
+name = "vibes-held-launch"
+path = "src/bin/vibes-held-launch.rs"
+
+[dependencies]
+# build-native stages the published crateRoot at this explicit relative path.
+# Prepare that owned build workspace before invoking Cargo; no checkout fallback.
+vibes-native-core = { path = "../vibes-native-core" }
+
+[profile.release]
+panic = "abort"

package/native/held-launch/abi-manifest.json

@@ -0,0 +1,234 @@
+{
+  "version": 1,
+  "description": "Held-launch ABI candidate. Distributed artifact gates must compare actual exported symbols and mechanically extracted signatures; any mismatch is a hard failure. Source signatures include the shared last_error_plane!(vhl) macro export. No native certification is claimed until the actual paired helper/library and runtime consumer are verified.",
+  "artifact": {
+    "linkage": "cdylib",
+    "name": "libvibes_held_launch.dylib"
+  },
+  "symbolsGolden": "native/held-launch/symbols.golden",
+  "symbols": {
+    "target": [
+      "_vhl_advance_ready",
+      "_vhl_control_fd",
+      "_vhl_control_interest",
+      "_vhl_dispose",
+      "_vhl_events_cancel",
+      "_vhl_events_create",
+      "_vhl_events_dispose",
+      "_vhl_events_finish",
+      "_vhl_events_watch_child",
+      "_vhl_events_watch_fd",
+      "_vhl_exec_status",
+      "_vhl_identity",
+      "_vhl_last_error",
+      "_vhl_pid",
+      "_vhl_ready",
+      "_vhl_reap",
+      "_vhl_release",
+      "_vhl_resize",
+      "_vhl_spawn",
+      "_vhl_take_fd",
+      "_vhl_terminate"
+    ],
+    "implemented": [
+      "_vhl_advance_ready",
+      "_vhl_control_fd",
+      "_vhl_control_interest",
+      "_vhl_dispose",
+      "_vhl_events_cancel",
+      "_vhl_events_create",
+      "_vhl_events_dispose",
+      "_vhl_events_finish",
+      "_vhl_events_watch_child",
+      "_vhl_events_watch_fd",
+      "_vhl_exec_status",
+      "_vhl_identity",
+      "_vhl_last_error",
+      "_vhl_pid",
+      "_vhl_ready",
+      "_vhl_reap",
+      "_vhl_release",
+      "_vhl_resize",
+      "_vhl_spawn",
+      "_vhl_take_fd",
+      "_vhl_terminate"
+    ],
+    "additive": []
+  },
+  "functions": [
+    {
+      "name": "vhl_advance_ready",
+      "parameters": [
+        "ptr"
+      ],
+      "returns": "i32",
+      "typescriptBound": false
+    },
+    {
+      "name": "vhl_control_fd",
+      "parameters": [
+        "ptr"
+      ],
+      "returns": "i32",
+      "typescriptBound": false
+    },
+    {
+      "name": "vhl_control_interest",
+      "parameters": [
+        "ptr"
+      ],
+      "returns": "i32",
+      "typescriptBound": false
+    },
+    {
+      "name": "vhl_dispose",
+      "parameters": [
+        "ptr"
+      ],
+      "returns": "i32",
+      "typescriptBound": false
+    },
+    {
+      "name": "vhl_events_cancel",
+      "parameters": ["ptr", "u64"],
+      "returns": "i32",
+      "typescriptBound": false
+    },
+    {
+      "name": "vhl_events_create",
+      "parameters": ["ptr", "ptr", "usize", "usize"],
+      "returns": "ptr",
+      "typescriptBound": false
+    },
+    {
+      "name": "vhl_events_dispose",
+      "parameters": ["ptr"],
+      "returns": "i32",
+      "typescriptBound": false
+    },
+    {
+      "name": "vhl_events_finish",
+      "parameters": ["ptr"],
+      "returns": "i32",
+      "typescriptBound": false
+    },
+    {
+      "name": "vhl_events_watch_child",
+      "parameters": ["ptr", "ptr", "u64"],
+      "returns": "i32",
+      "typescriptBound": false
+    },
+    {
+      "name": "vhl_events_watch_fd",
+      "parameters": ["ptr", "i32", "u8", "u64"],
+      "returns": "i32",
+      "typescriptBound": false
+    },
+    {
+      "name": "vhl_exec_status",
+      "parameters": [
+        "ptr",
+        "ptr"
+      ],
+      "returns": "i32",
+      "typescriptBound": false
+    },
+    {
+      "name": "vhl_identity",
+      "parameters": ["ptr", "ptr", "ptr", "usize"],
+      "returns": "isize",
+      "typescriptBound": false
+    },
+    {
+      "name": "vhl_last_error",
+      "parameters": [],
+      "returns": "cstring",
+      "typescriptBound": false
+    },
+    {
+      "name": "vhl_pid",
+      "parameters": [
+        "ptr"
+      ],
+      "returns": "i64",
+      "typescriptBound": false
+    },
+    {
+      "name": "vhl_ready",
+      "parameters": [
+        "ptr",
+        "u32",
+        "u32",
+        "ptr",
+        "usize"
+      ],
+      "returns": "i32",
+      "typescriptBound": false
+    },
+    {
+      "name": "vhl_reap",
+      "parameters": [
+        "ptr",
+        "ptr"
+      ],
+      "returns": "i32",
+      "typescriptBound": false
+    },
+    {
+      "name": "vhl_release",
+      "parameters": [
+        "ptr",
+        "u32",
+        "u32",
+        "ptr",
+        "usize"
+      ],
+      "returns": "i32",
+      "typescriptBound": false
+    },
+    {
+      "name": "vhl_resize",
+      "parameters": [
+        "ptr",
+        "u16",
+        "u16"
+      ],
+      "returns": "i32",
+      "typescriptBound": false
+    },
+    {
+      "name": "vhl_spawn",
+      "parameters": [
+        "cstring",
+        "cstring",
+        "ptr",
+        "usize",
+        "usize",
+        "u8",
+        "u8",
+        "u8",
+        "u16",
+        "u16"
+      ],
+      "returns": "ptr",
+      "typescriptBound": false
+    },
+    {
+      "name": "vhl_take_fd",
+      "parameters": [
+        "ptr",
+        "u8"
+      ],
+      "returns": "i32",
+      "typescriptBound": false
+    },
+    {
+      "name": "vhl_terminate",
+      "parameters": [
+        "ptr"
+      ],
+      "returns": "i32",
+      "typescriptBound": false
+    }
+  ]
+}

package/native/held-launch/src/bin/vibes-held-launch.rs

@@ -0,0 +1,35 @@
+//! Trusted private-FD helper. Never accepts workload values in argv or env.
+use std::os::fd::FromRawFd;
+use std::os::unix::net::UnixStream;
+
+/// The fixed helper modes besides the held (session) launch.
+enum Mode { Direct, Daemon }
+
+fn main() {
+    let mut args = std::env::args_os().skip(1);
+    let first = args.next();
+    let mode = match first.as_ref().and_then(|value| value.to_str()) {
+        Some("--direct") => Some(Mode::Direct),
+        Some("--daemon") => Some(Mode::Daemon),
+        _ => None
+    };
+    let fd = (if mode.is_some() { args.next() } else { first }).and_then(|value| value.to_str().and_then(|s| s.parse::<i32>().ok()));
+    if args.next().is_some() || fd.is_none_or(|fd| fd <= 2) {
+        eprintln!("held-launch: control-argument-invalid");
+        std::process::exit(126);
+    }
+    // The trusted spawning owner transferred exactly this inherited endpoint.
+    let control = unsafe { UnixStream::from_raw_fd(fd.unwrap_or(-1)) };
+    let error = match mode {
+        Some(Mode::Direct) => vibes_held_launch::run_direct_helper(control),
+        // The daemon helper exits 0 once it has forked the workload: that exit reparents it.
+        Some(Mode::Daemon) => match vibes_held_launch::run_daemon_helper(control) {
+            None => std::process::exit(0),
+            Some(error) => error
+        },
+        None => vibes_held_launch::run_helper(control)
+    };
+    // Fixed phase/errno only: an exec error never prints command/env/payload.
+    eprintln!("held-launch: {} errno={}", error.0, error.1.unwrap_or(0));
+    std::process::exit(126);
+}

package/native/held-launch/src/events.rs

@@ -0,0 +1,99 @@
+//! Execution ABI over the shared native reactor. No process registry or timers.
+use std::ffi::c_void;
+use std::os::fd::BorrowedFd;
+use std::sync::Arc;
+use vibes_native_core::process_events::{ChildExitEvent, EventReactor, Watch};
+use super::{Launch, launch, launch_error, record};
+
+pub struct Events { reactor: EventReactor }
+type Callback = unsafe extern "C" fn(u64, u8, i32);
+
+/// The callback is host-thread-safe and stays alive until finish=1. `user` is
+/// reserved and MUST be null; the callback ABI has exactly three arguments.
+#[unsafe(no_mangle)]
+pub unsafe extern "C" fn vhl_events_create(callback: *const c_void, user: *mut c_void,
+    max_watches: usize, max_pending_commands: usize) -> *mut Events {
+    if callback.is_null() || !user.is_null() {
+        record("events-callback-invalid", None);
+        return std::ptr::null_mut();
+    }
+    let callback: Callback = unsafe { std::mem::transmute(callback) };
+    match EventReactor::new(Arc::new(move |id, event, detail| unsafe { callback(id, event, detail) }), max_watches, max_pending_commands) {
+        Ok(reactor) => Box::into_raw(Box::new(Events { reactor })),
+        Err(error) => { record("events-create", error.raw_os_error()); std::ptr::null_mut() }
+    }
+}
+
+unsafe fn owner<'a>(pointer: *mut Events) -> Result<&'a Events, i32> {
+    if pointer.is_null() { return Err(record("events-owner-invalid", None)); }
+    Ok(unsafe { &*pointer })
+}
+
+#[unsafe(no_mangle)]
+pub unsafe extern "C" fn vhl_events_watch_fd(pointer: *mut Events, fd: i32, interest: u8, id: u64) -> i32 {
+    let owner = match unsafe { owner(pointer) } { Ok(owner) => owner, Err(error) => return error };
+    if fd < 0 { return record("events-fd-invalid", None); }
+    let watch = match Watch::fd(unsafe { BorrowedFd::borrow_raw(fd) }, interest) {
+        Ok(watch) => watch,
+        Err(error) => return record("events-fd", error.raw_os_error()),
+    };
+    match owner.reactor.watch(id, watch) { Ok(()) => 1, Err(error) => record("events-watch", error.raw_os_error()) }
+}
+
+#[unsafe(no_mangle)]
+pub unsafe extern "C" fn vhl_events_watch_child(pointer: *mut Events, child_pointer: *mut Launch, id: u64) -> i32 {
+    let owner = match unsafe { owner(pointer) } { Ok(owner) => owner, Err(error) => return error };
+    let handle = match unsafe { launch(child_pointer) } { Ok(handle) => handle, Err(error) => return error };
+    let Some(child) = handle.child.as_mut() else { return record("handle-disposed", None); };
+    let watch = match child.try_observe_exit() {
+        Ok(true) => Watch::ExitedChild,
+        Err(error) => return launch_error(error),
+        Ok(false) => match ChildExitEvent::enroll(child.pid()) {
+            Ok(event) => Watch::Child(event),
+            Err(error) => {
+                // A helper can exit between the parent's observation and kernel
+                // enrollment. Only the actual retained parent's wait proves it.
+                match child.try_observe_exit() {
+                    Ok(true) => Watch::ExitedChild,
+                    Ok(false) => return record("events-child-enroll", error.raw_os_error()),
+                    Err(error) => return launch_error(error),
+                }
+            }
+        },
+    };
+    match owner.reactor.watch(id, watch) { Ok(()) => 1, Err(error) => record("events-watch", error.raw_os_error()) }
+}
+
+#[unsafe(no_mangle)]
+pub unsafe extern "C" fn vhl_events_cancel(pointer: *mut Events, id: u64) -> i32 {
+    let owner = match unsafe { owner(pointer) } { Ok(owner) => owner, Err(error) => return error };
+    match owner.reactor.cancel(id) {
+        Ok(true) => 1, // One pending ACK; repeated pending cancellation is coalesced.
+        Ok(false) => 2, // Already terminal; no new ACK. Its terminal callback may be in flight.
+        Err(error) => record("events-cancel", error.raw_os_error()),
+    }
+}
+
+/// Acceptance retains the pointer and coalesces repeated calls. Event 4 is not
+/// thread quiescence; retain callback and library until events_finish succeeds.
+#[unsafe(no_mangle)]
+pub unsafe extern "C" fn vhl_events_dispose(pointer: *mut Events) -> i32 {
+    let owner = match unsafe { owner(pointer) } { Ok(owner) => owner, Err(error) => return error };
+    match owner.reactor.dispose() {
+        Ok(()) => 1,
+        Err(error) => record("events-dispose", error.raw_os_error()),
+    }
+}
+
+/// 0: thread still running, retain everything; 1: joined and pointer invalidated;
+/// -1: fixed failure with pointer retained. Never joins a running thread.
+#[unsafe(no_mangle)]
+pub unsafe extern "C" fn vhl_events_finish(pointer: *mut Events) -> i32 {
+    if pointer.is_null() { return record("events-owner-invalid", None); }
+    let owner = unsafe { &mut *pointer };
+    match owner.reactor.finish() {
+        Ok(false) => 0,
+        Ok(true) => { drop(unsafe { Box::from_raw(pointer) }); 1 },
+        Err(error) => record("events-finish", error.raw_os_error()),
+    }
+}