@vibesdotdev/kernel-rpc 0.0.0-stage → 1.0.0-rc.2

package/dist/transports/http/endpoints/index.d.ts

@@ -0,0 +1,5 @@
+export { DaemonEndpointAuthSchema, DaemonEndpointDescriptorSchema, DaemonEndpointHardwareSchema, DaemonEndpointMethodSchema, DaemonEndpointResponseSchema, daemonResponseInvalid, resolveDaemonEndpoint, type DaemonEndpoint, type DaemonEndpointAuth, type DaemonEndpointDescriptor, type DaemonEndpointHardware, type DaemonEndpointMethod, type DaemonEndpointRequest, type DaemonEndpointResponse, type DaemonEndpointServer } from '../schemas/daemon-endpoint.ts';
+export { daemonEndpointKind } from './daemon-endpoint.kind.ts';
+export { healthEndpointDescriptor } from './health.descriptor.ts';
+export { mcpEndpointDescriptor } from './mcp.descriptor.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/transports/http/endpoints/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/transports/http/endpoints/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,wBAAwB,EACxB,8BAA8B,EAC9B,4BAA4B,EAC5B,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,qBAAqB,EACrB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/transports/http/endpoints/index.js

@@ -0,0 +1,5 @@
+export { DaemonEndpointAuthSchema, DaemonEndpointDescriptorSchema, DaemonEndpointHardwareSchema, DaemonEndpointMethodSchema, DaemonEndpointResponseSchema, daemonResponseInvalid, resolveDaemonEndpoint } from "../schemas/daemon-endpoint.js";
+export { daemonEndpointKind } from "./daemon-endpoint.kind.js";
+export { healthEndpointDescriptor } from "./health.descriptor.js";
+export { mcpEndpointDescriptor } from "./mcp.descriptor.js";
+//# sourceMappingURL=index.js.map

package/dist/transports/http/endpoints/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/transports/http/endpoints/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,wBAAwB,EACxB,8BAA8B,EAC9B,4BAA4B,EAC5B,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,qBAAqB,EASrB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/transports/http/endpoints/mcp.descriptor.d.ts

@@ -0,0 +1,29 @@
+export declare const mcpEndpointDescriptor: {
+    id: string;
+    kind: "runtime/daemon/endpoint";
+    path: string;
+    methods: ("POST" | "DELETE" | "GET")[];
+    auth: "optional" | "required" | "none";
+    name?: string | undefined;
+    description?: string | undefined;
+    tags?: string[] | undefined;
+    hardware?: string[] | undefined;
+    enabled?: boolean | undefined;
+    priority?: number | undefined;
+    capabilityId?: string | undefined;
+    requiredContext?: string[] | undefined;
+    optionalContext?: string[] | undefined;
+    config?: unknown;
+    retention?: string | {
+        reason: string;
+        maxAgeDays?: number | undefined;
+        maxEntries?: number | undefined;
+        maxBytes?: number | undefined;
+        cascadeFrom?: string | undefined;
+        ageField?: string | undefined;
+        enforcedBy?: string | undefined;
+    } | undefined;
+    endpointHardware?: ("consumer" | "cloud")[] | undefined;
+};
+export default mcpEndpointDescriptor;
+//# sourceMappingURL=mcp.descriptor.d.ts.map

package/dist/transports/http/endpoints/mcp.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.descriptor.d.ts","sourceRoot":"","sources":["../../../../src/transports/http/endpoints/mcp.descriptor.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;CAShC,CAAC;AAEH,eAAe,qBAAqB,CAAC"}

package/dist/transports/http/endpoints/mcp.descriptor.js

@@ -0,0 +1,13 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export const mcpEndpointDescriptor = createRuntimeAsset({
+    id: 'runtime.endpoint.mcp',
+    kind: 'runtime/daemon/endpoint',
+    name: 'MCP Server',
+    description: 'Model Context Protocol server endpoint',
+    path: '/mcp',
+    methods: ['GET', 'POST', 'DELETE'],
+    auth: 'optional',
+    enabled: true
+});
+export default mcpEndpointDescriptor;
+//# sourceMappingURL=mcp.descriptor.js.map

package/dist/transports/http/endpoints/mcp.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.descriptor.js","sourceRoot":"","sources":["../../../../src/transports/http/endpoints/mcp.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGzD,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAA2B;IACjF,EAAE,EAAE,sBAAsB;IAC1B,IAAI,EAAE,yBAAyB;IAC/B,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,wCAAwC;IACrD,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC;IAClC,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,IAAI;CACb,CAAC,CAAC;AAEH,eAAe,qBAAqB,CAAC"}

package/dist/transports/http/endpoints/mcp.impl.consumer.d.ts

@@ -0,0 +1,3 @@
+import { type DaemonEndpoint } from '../schemas/daemon-endpoint.ts';
+export declare function createMcpEndpointImplementation(): DaemonEndpoint;
+//# sourceMappingURL=mcp.impl.consumer.d.ts.map

package/dist/transports/http/endpoints/mcp.impl.consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.impl.consumer.d.ts","sourceRoot":"","sources":["../../../../src/transports/http/endpoints/mcp.impl.consumer.ts"],"names":[],"mappings":"AAAA,OAAO,EAEN,KAAK,cAAc,EACnB,MAAM,+BAA+B,CAAC;AAGvC,wBAAgB,+BAA+B,IAAI,cAAc,CAYhE"}

package/dist/transports/http/endpoints/mcp.impl.consumer.js

@@ -0,0 +1,16 @@
+import { DaemonEndpointResponseSchema } from "../schemas/daemon-endpoint.js";
+import { daemonResponseInvalid } from "./daemon-endpoint.kind.js";
+export function createMcpEndpointImplementation() {
+    return {
+        async handle(_req, res) {
+            const parsed = DaemonEndpointResponseSchema.safeParse(res);
+            if (!parsed.success)
+                throw daemonResponseInvalid();
+            const response = parsed.data;
+            response.statusCode = 501;
+            response.setHeader?.('content-type', 'application/json');
+            response.end?.(JSON.stringify({ error: 'MCP handler must be wired at daemon startup' }));
+        }
+    };
+}
+//# sourceMappingURL=mcp.impl.consumer.js.map

package/dist/transports/http/endpoints/mcp.impl.consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.impl.consumer.js","sourceRoot":"","sources":["../../../../src/transports/http/endpoints/mcp.impl.consumer.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,4BAA4B,EAE5B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,MAAM,UAAU,+BAA+B;IAC9C,OAAO;QACN,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG;YACrB,MAAM,MAAM,GAAG,4BAA4B,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,qBAAqB,EAAE,CAAC;YAEnD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;YAC7B,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;YAC1B,QAAQ,CAAC,SAAS,EAAE,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YACzD,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC,CAAC,CAAC;QAC1F,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/transports/http/http-implementation.d.ts

@@ -0,0 +1,14 @@
+import type { RuntimeRpcDescriptor, RuntimeRpcImplementation } from '@vibesdotdev/kernel-rpc';
+import type { HttpLifecycle } from '../../schemas/contracts/transports/http/http-connection.ts';
+import { type RpcCredentialRuntime } from './auth/credential.ts';
+/** A standalone HTTP listener owned by the selected runtime host. */
+/**
+ * Build a `runtime/rpc` impl (a transport) for an http descriptor. The descriptor's
+ * `auth` `CredentialReference` is resolved to a bearer at connect time through the
+ * owning runtime's `resolveCredential` — never a bare token (doc 11 §L4, D-RC05).
+ * The same runtime's lifecycle bounds the handshake.
+ */
+export declare function createHttpRpcImplementation(descriptorInput: RuntimeRpcDescriptor, runtime: RpcCredentialRuntime & {
+    readonly lifecycle: HttpLifecycle;
+}): RuntimeRpcImplementation;
+//# sourceMappingURL=http-implementation.d.ts.map

package/dist/transports/http/http-implementation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-implementation.d.ts","sourceRoot":"","sources":["../../../src/transports/http/http-implementation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAC9F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4DAA4D,CAAC;AAEhG,OAAO,EAA0B,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAGzF,qEAAqE;AAMrE;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAC1C,eAAe,EAAE,oBAAoB,EACrC,OAAO,EAAE,oBAAoB,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAA;CAAE,GACnE,wBAAwB,CAW1B"}

package/dist/transports/http/http-implementation.js

@@ -0,0 +1,26 @@
+import { readRpcDescriptor } from "../../core/protocol/references/descriptor-input.js";
+import { resolveConnectionToken } from "./auth/credential.js";
+import { connectHttp } from "./consumer/connect-http.js";
+/** A standalone HTTP listener owned by the selected runtime host. */
+// ---------------------------------------------------------------------------
+// KIND IMPL
+// ---------------------------------------------------------------------------
+/**
+ * Build a `runtime/rpc` impl (a transport) for an http descriptor. The descriptor's
+ * `auth` `CredentialReference` is resolved to a bearer at connect time through the
+ * owning runtime's `resolveCredential` — never a bare token (doc 11 §L4, D-RC05).
+ * The same runtime's lifecycle bounds the handshake.
+ */
+export function createHttpRpcImplementation(descriptorInput, runtime) {
+    const descriptor = readRpcDescriptor('createHttpRpcImplementation', descriptorInput, 'http');
+    const origin = descriptor.target.origin;
+    return {
+        id: descriptor.id,
+        descriptor,
+        connect: async () => {
+            const token = descriptor.auth ? await resolveConnectionToken(descriptor.auth, runtime) : undefined;
+            return connectHttp(origin, { lifecycle: runtime.lifecycle, token });
+        }
+    };
+}
+//# sourceMappingURL=http-implementation.js.map

package/dist/transports/http/http-implementation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-implementation.js","sourceRoot":"","sources":["../../../src/transports/http/http-implementation.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oDAAoD,CAAC;AACvF,OAAO,EAAE,sBAAsB,EAA6B,MAAM,sBAAsB,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,qEAAqE;AAErE,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAC1C,eAAqC,EACrC,OAAqE;IAErE,MAAM,UAAU,GAAG,iBAAiB,CAAC,6BAA6B,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;IACxC,OAAO;QACN,EAAE,EAAE,UAAU,CAAC,EAAE;QACjB,UAAU;QACV,OAAO,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,sBAAsB,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACnG,OAAO,WAAW,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/transports/http/index.d.ts

@@ -0,0 +1,34 @@
+/**
+ * @vibesdotdev/kernel-rpc/http
+ *
+ * The HTTP/SSE remote transport for the `runtime/rpc` kind (PHASE 4 — GATED on
+ * L5). It carries the SAME three-verb protocol (`invoke` / `release` / `stream`)
+ * the unix/tcp transports do, but each verb is an HTTP leg:
+ *
+ *   - `invoke`  → `POST /rpc/invoke`            (request/response)
+ *   - `release` → `POST /rpc/release`           (202, fire-and-forget)
+ *   - `stream`  → `GET  /rpc/stream` (SSE, owner→consumer bytes)
+ *                 + `POST /rpc/stream/{write,close}` (consumer→owner bytes)
+ *
+ * THE HARD SECURITY GATE: the listen side dispatches every arriving invoke through
+ * the SAME `dispatchRequest` the unix transport uses — so L1's `authz → friction`
+ * pipeline runs identically on http-arrived invokes. A remote peer with a valid
+ * connection bearer is still DENIED an out-of-policy command by friction. The
+ * transport authenticates only the CONNECTION (the bearer, resolved from the
+ * descriptor's `auth` `CredentialReference`); per-invoke authorization is L5's.
+ */
+export { HttpConnection, type HttpConnectionInit, type HttpFetch, type HttpLifecycle } from './consumer/http-connection.ts';
+export { connectHttp, type ConnectHttpOptions } from './listener/http-transport.impl.ts';
+export { mountHttpRuntimeProjection, type HttpRuntimeMount, type HttpRuntimeProjectionMountOptions } from './listener/projection-mount.ts';
+export { HTTP_BEARER_IDENTITY_SOURCE, HttpListenSession } from './listener/http-listen-session.ts';
+export { listenHttp, type HttpListenBindOptions } from './listener/http-listen.ts';
+export { RpcHttpHandler, createHttpRpcImplementation, type HttpListenOptions, type HttpListenTarget, type HttpListener } from './listener/http-transport.impl.ts';
+export { CorsPolicy, DEFAULT_CORS_ALLOWED_ORIGINS, parseAllowedOriginsEnv, type CorsConfig, type CorsResolution } from './auth/cors.ts';
+export { resolveConnectionToken, type RpcCredentialRuntime } from './auth/credential.ts';
+export { DEFAULT_NONCE_TTL_MS, SubscribeNonceStore, type NonceConsumption, type NonceMintOptions, type NonceMintResult } from './auth/nonces.ts';
+export { redactStackTraces, type RedactStackOptions } from './auth/redact.ts';
+export { TokenRegistry, type ConnectionAuthInfo } from './auth/token-registry.ts';
+export { RPC_HTTP_ROUTE, SSE_FRAME_EVENT, decodeBase64, encodeBase64, type HttpHandshake, type HttpStreamClose, type HttpStreamWrite } from './wire.ts';
+export { createHttpRpcDescriptor } from './descriptors/http.rpc.descriptor.ts';
+export { createRuntimeRpcHttpPlugin, default, registerDynamicHttpRpcAsset, registerHttpRpcLoader, runtimeRpcHttpPlugin, type RuntimeRpcHttpPluginOptions } from './runtime-rpc-http.plugin.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/transports/http/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/transports/http/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,kBAAkB,EAAE,KAAK,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC5H,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACzF,OAAO,EACP,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,iCAAiC,EACrC,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACnG,OAAO,EAAE,UAAU,EAAE,KAAK,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACnF,OAAO,EACP,cAAc,EACd,2BAA2B,EAAE,KAAK,iBAAiB,EACnD,KAAK,gBAAgB,EAAE,KAAK,YAAY,EACvC,MAAM,mCAAmC,CAAC;AAG3C,OAAO,EACP,UAAU,EACV,4BAA4B,EAC5B,sBAAsB,EACtB,KAAK,UAAU,EACf,KAAK,cAAc,EAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACzF,OAAO,EACP,oBAAoB,EAAE,mBAAmB,EAAE,KAAK,gBAAgB,EAAE,KAAK,gBAAgB,EACvF,KAAK,eAAe,EACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGlF,OAAO,EACP,cAAc,EACd,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,KAAK,eAAe,EAC1G,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,OAAO,EACP,0BAA0B,EAAE,OAAO,EAAE,2BAA2B,EAChE,qBAAqB,EACrB,oBAAoB,EACpB,KAAK,2BAA2B,EAC/B,MAAM,8BAA8B,CAAC"}

package/dist/transports/http/index.js

@@ -0,0 +1,39 @@
+/**
+ * @vibesdotdev/kernel-rpc/http
+ *
+ * The HTTP/SSE remote transport for the `runtime/rpc` kind (PHASE 4 — GATED on
+ * L5). It carries the SAME three-verb protocol (`invoke` / `release` / `stream`)
+ * the unix/tcp transports do, but each verb is an HTTP leg:
+ *
+ *   - `invoke`  → `POST /rpc/invoke`            (request/response)
+ *   - `release` → `POST /rpc/release`           (202, fire-and-forget)
+ *   - `stream`  → `GET  /rpc/stream` (SSE, owner→consumer bytes)
+ *                 + `POST /rpc/stream/{write,close}` (consumer→owner bytes)
+ *
+ * THE HARD SECURITY GATE: the listen side dispatches every arriving invoke through
+ * the SAME `dispatchRequest` the unix transport uses — so L1's `authz → friction`
+ * pipeline runs identically on http-arrived invokes. A remote peer with a valid
+ * connection bearer is still DENIED an out-of-policy command by friction. The
+ * transport authenticates only the CONNECTION (the bearer, resolved from the
+ * descriptor's `auth` `CredentialReference`); per-invoke authorization is L5's.
+ */
+// --- Connect side (consumer) ---
+export { HttpConnection } from "./consumer/http-connection.js";
+export { connectHttp } from "./listener/http-transport.impl.js";
+export { mountHttpRuntimeProjection } from "./listener/projection-mount.js";
+// --- Listen side (owner) — connection auth → L1 invoke pipeline ---
+export { HTTP_BEARER_IDENTITY_SOURCE, HttpListenSession } from "./listener/http-listen-session.js";
+export { listenHttp } from "./listener/http-listen.js";
+export { RpcHttpHandler, createHttpRpcImplementation } from "./listener/http-transport.impl.js";
+// --- Connection auth primitives (lifted from daemon/auth; connection-level ONLY) ---
+export { CorsPolicy, DEFAULT_CORS_ALLOWED_ORIGINS, parseAllowedOriginsEnv } from "./auth/cors.js";
+export { resolveConnectionToken } from "./auth/credential.js";
+export { DEFAULT_NONCE_TTL_MS, SubscribeNonceStore } from "./auth/nonces.js";
+export { redactStackTraces } from "./auth/redact.js";
+export { TokenRegistry } from "./auth/token-registry.js";
+// --- Wire shape (verb-named routes; never kind-named) ---
+export { RPC_HTTP_ROUTE, SSE_FRAME_EVENT, decodeBase64, encodeBase64 } from "./wire.js";
+// --- Descriptor + plugin ---
+export { createHttpRpcDescriptor } from "./descriptors/http.rpc.descriptor.js";
+export { createRuntimeRpcHttpPlugin, default, registerDynamicHttpRpcAsset, registerHttpRpcLoader, runtimeRpcHttpPlugin } from "./runtime-rpc-http.plugin.js";
+//# sourceMappingURL=index.js.map

package/dist/transports/http/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/transports/http/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,kCAAkC;AAClC,OAAO,EAAE,cAAc,EAA+D,MAAM,+BAA+B,CAAC;AAC5H,OAAO,EAAE,WAAW,EAA2B,MAAM,mCAAmC,CAAC;AACzF,OAAO,EACP,0BAA0B,EAGzB,MAAM,gCAAgC,CAAC;AAExC,qEAAqE;AACrE,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACnG,OAAO,EAAE,UAAU,EAA8B,MAAM,2BAA2B,CAAC;AACnF,OAAO,EACP,cAAc,EACd,2BAA2B,EAE1B,MAAM,mCAAmC,CAAC;AAE3C,sFAAsF;AACtF,OAAO,EACP,UAAU,EACV,4BAA4B,EAC5B,sBAAsB,EAGrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAA6B,MAAM,sBAAsB,CAAC;AACzF,OAAO,EACP,oBAAoB,EAAE,mBAAmB,EAExC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAA2B,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,aAAa,EAA2B,MAAM,0BAA0B,CAAC;AAElF,2DAA2D;AAC3D,OAAO,EACP,cAAc,EACd,eAAe,EAAE,YAAY,EAAE,YAAY,EAC1C,MAAM,WAAW,CAAC;AAEnB,8BAA8B;AAC9B,OAAO,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,OAAO,EACP,0BAA0B,EAAE,OAAO,EAAE,2BAA2B,EAChE,qBAAqB,EACrB,oBAAoB,EAEnB,MAAM,8BAA8B,CAAC"}

package/dist/transports/http/listener/body.d.ts

@@ -0,0 +1,8 @@
+/** The bounded HTTP body reader shared by RPC and daemon ingress. */
+import { type CaughtFailure } from '@vibesdotdev/kernel';
+/**
+ * Read at most the wire ceiling. Refusal cancels the stream before retaining an
+ * excess chunk. A cancellation failure is reported; read failures propagate.
+ */
+export declare function readBoundedBody(request: Request, reportFailure: (failure: CaughtFailure) => void): Promise<string | Response>;
+//# sourceMappingURL=body.d.ts.map

package/dist/transports/http/listener/body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body.d.ts","sourceRoot":"","sources":["../../../../src/transports/http/listener/body.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKzD;;;GAGG;AACH,wBAAsB,eAAe,CACpC,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,IAAI,GAC7C,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,CAsC5B"}

package/dist/transports/http/listener/body.js

@@ -0,0 +1,52 @@
+/** The bounded HTTP body reader shared by RPC and daemon ingress. */
+import {} from '@vibesdotdev/kernel';
+import { attemptAsync, rethrow } from "../../../core/protocol/lifecycle/attempt.js";
+import { HOST_FAILURES } from "../../../core/protocol/transport/failure-describer.js";
+import { RPC_MAX_MESSAGE_BYTES } from "../../../core/protocol/wire/limits.js";
+/**
+ * Read at most the wire ceiling. Refusal cancels the stream before retaining an
+ * excess chunk. A cancellation failure is reported; read failures propagate.
+ */
+export async function readBoundedBody(request, reportFailure) {
+    const reader = request.body?.getReader();
+    const refuse = async () => {
+        if (reader) {
+            const cancelled = await attemptAsync(() => reader.cancel());
+            if (!cancelled.ok)
+                reportFailure(HOST_FAILURES.describe(cancelled.failure));
+        }
+        return Response.json({
+            error: { code: 'INVALID_INPUT', message: 'RPC request body is too large.', reason: 'rpc-request-too-large' }
+        }, { status: 413 });
+    };
+    try {
+        if (Number(request.headers.get('content-length')) > RPC_MAX_MESSAGE_BYTES)
+            return await refuse();
+        const chunks = [];
+        let received = 0;
+        if (reader) {
+            for (;;) {
+                const step = await attemptAsync(() => reader.read());
+                if (!step.ok)
+                    return rethrow(HOST_FAILURES.describe(step.failure));
+                if (step.value.done)
+                    break;
+                if (step.value.value.byteLength > RPC_MAX_MESSAGE_BYTES - received)
+                    return await refuse();
+                received += step.value.value.byteLength;
+                chunks.push(step.value.value);
+            }
+        }
+        const body = new Uint8Array(received);
+        let offset = 0;
+        for (const chunk of chunks) {
+            body.set(chunk, offset);
+            offset += chunk.byteLength;
+        }
+        return new TextDecoder().decode(body);
+    }
+    finally {
+        reader?.releaseLock();
+    }
+}
+//# sourceMappingURL=body.js.map

package/dist/transports/http/listener/body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body.js","sourceRoot":"","sources":["../../../../src/transports/http/listener/body.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,OAAO,EAAsB,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,OAAgB,EAChB,aAA+C;IAE/C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,KAAK,IAAuB,EAAE;QAC5C,IAAI,MAAM,EAAE,CAAC;YACZ,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,SAAS,CAAC,EAAE;gBAAE,aAAa,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC;YACpB,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,uBAAuB,EAAE;SAC5G,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACrB,CAAC,CAAC;IAEF,IAAI,CAAC;QACJ,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,GAAG,qBAAqB;YAAE,OAAO,MAAM,MAAM,EAAE,CAAC;QAEjG,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,MAAM,EAAE,CAAC;YACZ,SAAS,CAAC;gBACT,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;gBACrD,IAAI,CAAC,IAAI,CAAC,EAAE;oBAAE,OAAO,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBACnE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI;oBAAE,MAAM;gBAC3B,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,qBAAqB,GAAG,QAAQ;oBAAE,OAAO,MAAM,MAAM,EAAE,CAAC;gBAC1F,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;QACF,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC5B,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;QAC5B,CAAC;QACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;YAAS,CAAC;QACV,MAAM,EAAE,WAAW,EAAE,CAAC;IACvB,CAAC;AACF,CAAC"}

package/dist/transports/http/listener/http-bindings.d.ts

@@ -0,0 +1,82 @@
+import type { OwnerChannel } from '../../../schemas/contracts/transports/http/http-listen-session.ts';
+export type { OwnerChannel } from '../../../schemas/contracts/transports/http/http-listen-session.ts';
+import type { CaughtFailure } from '@vibesdotdev/kernel';
+import { CapabilityError, DefaultReferenceTable, type RemotePeerInfo } from '@vibesdotdev/kernel';
+import { type ProxyFactory, type RefId, type RpcInvoke, type RpcResponse } from '@vibesdotdev/kernel-rpc';
+import { createFunctionCallbacks } from '../../../core/protocol/references/function-callbacks.ts';
+import type { VerifiedTransportIdentity } from '@vibesdotdev/kernel/schemas';
+import { BindingCloses, LegFailures } from '../../../core/protocol/lifecycle/binding-close.ts';
+import { ChannelIdClaims } from '../../../core/protocol/references/channel-ids.ts';
+import type { HttpListenTarget } from "../../../schemas/contracts/transports/http/http-listen-session.ts";
+import type { ConnectionAuthInfo } from '../auth/token-registry.ts';
+export declare abstract class HttpBindings {
+    protected readonly target: HttpListenTarget;
+    readonly connectionId: string;
+    /** Both peers explicitly admitted Date metadata before session allocation. */
+    readonly wireDates: boolean;
+    readonly reverseCalls: boolean;
+    protected readonly table: DefaultReferenceTable;
+    protected readonly rootRef: string;
+    protected readonly remotePeer: RemotePeerInfo;
+    /** Stream channels keyed by the consumer-minted channelId. */
+    protected readonly channels: Map<string, OwnerChannel>;
+    protected readonly channelClaims: ChannelIdClaims;
+    /** Every binding close this connection started; failures kept typed until reported. */
+    protected readonly closes: BindingCloses;
+    /** What became of each channel no longer live: the owner ended it, or its binding close (typed failure or `null`). */
+    protected readonly settled: Map<string, {
+        ended: true;
+    } | {
+        ended: false;
+        outcome: Promise<CapabilityError | null>;
+    }>;
+    /** The connection's close outcome, once it began closing (never rejects). */
+    protected closing: Promise<CapabilityError | null> | null;
+    protected closedFlag: boolean;
+    protected readonly connection: AbortController;
+    protected readonly received: LegFailures;
+    protected readonly callbacks: ReturnType<typeof createFunctionCallbacks> | undefined;
+    private reverseWrite;
+    protected reverseEnd: (() => void) | undefined;
+    /** @param auth the registry entry the connection's bearer resolved to, if any. */
+    constructor(target: HttpListenTarget, connectionId?: string, auth?: ConnectionAuthInfo, 
+    /** A verified local attestation's identity (RC08); it takes precedence over `auth.caller`. */
+    attested?: VerifiedTransportIdentity, 
+    /** Both peers explicitly admitted Date metadata before session allocation. */
+    wireDates?: boolean, reverseCalls?: boolean);
+    /** A consumer-owned ref (callback) the OWNER would have to invoke back. */
+    protected readonly proxyFactory: ProxyFactory<ReturnType<ReturnType<typeof createFunctionCallbacks>['callbackFor']>>;
+    get reverseAttached(): boolean;
+    attachReverse(write: (request: RpcInvoke) => void, end: () => void): boolean;
+    answerReverse(response: RpcResponse): boolean;
+    protected closeReverse(): void;
+    /** Open a stream channel for a `stream` request that arrived as the SSE GET. */
+    openChannel(channelId: string, ref: RefId, channel: string): Promise<{
+        ok: boolean;
+        code?: string;
+        reason?: string;
+    }>;
+    protected openClaimedChannel(channelId: string, ref: RefId, channel: string): Promise<{
+        ok: boolean;
+        code?: string;
+    }>;
+    /** Attach the SSE writer for a channel: flushes whatever buffered before the SSE GET arrived, then routes every owner→consumer frame straight to the SSE leg. */
+    attachSse(channelId: string, write: (frame: Uint8Array) => void, end: () => void): void;
+    /** The owner ended the channel: its CLOSE frame follows its last bytes, and the owner is not torn down. */
+    protected endChannel(channelId: string): void;
+    /** Consumer→owner bytes for a channel (PTY stdin). */
+    writeChannel(channelId: string, data: Uint8Array): void;
+    /** Forget a channel and stop its bytes; the caller closes its binding. */
+    protected detachChannel(channelId: string): OwnerChannel | undefined;
+    /** Keep a failure of this channel's SSE leg, typed, for the connection's close. */
+    keepChannelFailure(channelId: string, failure: CaughtFailure): void;
+    /** Stop a channel's bytes; a binding whose unsubscribe failed is kept typed for the connection's close. */
+    protected unsubscribe(channelId: string, channel: OwnerChannel): void;
+    /** Close a channel the consumer asked to close and answer what became of it, once that settled: `closed` when its binding closed (now, or earlier when its SSE leg dropped — joined, never answered before it settles), */
+    closeChannel(channelId: string): Promise<'closed' | 'already-ended' | 'unknown'>;
+    /** The consumer dropped a channel's SSE leg: close it; a failure is kept for {@link close}. */
+    dropChannel(channelId: string): void;
+    /** Start a binding's close and record its outcome for a later consumer close (and {@link close}). */
+    protected closeBinding(channel: OwnerChannel, channelId: string): Promise<CapabilityError | null>;
+}
+//# sourceMappingURL=http-bindings.d.ts.map

package/dist/transports/http/listener/http-bindings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-bindings.d.ts","sourceRoot":"","sources":["../../../../src/transports/http/listener/http-bindings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mEAAmE,CAAC;AACtG,YAAY,EAAE,YAAY,EAAE,MAAM,mEAAmE,CAAC;AACtG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAClG,OAAO,EAAwC,KAAK,YAAY,EAAE,KAAK,KAAK,EAAE,KAAK,SAAS,EAAE,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAChJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AAClG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAE7E,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,mDAAmD,CAAC;AAE/F,OAAO,EAAqB,eAAe,EAAE,MAAM,kDAAkD,CAAC;AACtG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mEAAmE,CAAC;AAC1G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAGpE,8BAAsB,YAAY;IA8BhC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB;IAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM;IAI7B,8EAA8E;IAC9E,QAAQ,CAAC,SAAS;IAClB,QAAQ,CAAC,YAAY;IApCvB,SAAS,CAAC,QAAQ,CAAC,KAAK,wBAAsC;IAE9D,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEnC,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IAE9C,8DAA8D;IAC7D,SAAS,CAAC,QAAQ,CAAC,QAAQ,4BAAmC;IAE/D,SAAS,CAAC,QAAQ,CAAC,aAAa,kBAAsC;IAEtE,uFAAuF;IACtF,SAAS,CAAC,QAAQ,CAAC,MAAM,gBAAuB;IAEjD,sHAAsH;IACrH,SAAS,CAAC,QAAQ,CAAC,OAAO;eAA4B,IAAI;;eAAc,KAAK;iBAAW,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;OAAM;IAE9H,6EAA6E;IAC5E,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,IAAI,CAAQ;IAElE,SAAS,CAAC,UAAU,UAAS;IAC7B,SAAS,CAAC,QAAQ,CAAC,UAAU,kBAAyB;IACtD,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IACzC,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,GAAG,SAAS,CAAC;IACrF,OAAO,CAAC,YAAY,CAA6C;IACjE,SAAS,CAAC,UAAU,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;IAE/C,kFAAkF;gBAE7D,MAAM,EAAE,gBAAgB,EAClC,YAAY,GAAE,MAA4B,EACnD,IAAI,CAAC,EAAE,kBAAkB;IACzB,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,yBAAyB;IACpC,8EAA8E;IACrE,SAAS,UAAQ,EACjB,YAAY,UAAQ;IAqB/B,2EAA2E;IAC1E,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAQlH;IAEF,IAAI,eAAe,IAAI,OAAO,CAA4C;IAE1E,aAAa,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,KAAK,IAAI,EAAE,GAAG,EAAE,MAAM,IAAI,GAAG,OAAO;IAO5E,aAAa,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO;IAQ7C,SAAS,CAAC,YAAY,IAAI,IAAI;IAa/B,gFAAgF;IACzE,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;cAU5G,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAgD3H,iKAAiK;IAChK,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,EAAE,GAAG,EAAE,MAAM,IAAI,GAAG,IAAI;IAUxF,2GAA2G;IAC1G,SAAS,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAS9C,sDAAsD;IACrD,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,IAAI;IAKxD,0EAA0E;IACzE,SAAS,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAQrE,mFAAmF;IAClF,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,IAAI;IAIpE,2GAA2G;IAC1G,SAAS,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI;IAKtE,2NAA2N;IACpN,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,eAAe,GAAG,SAAS,CAAC;IAcvF,+FAA+F;IAC9F,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAKrC,qGAAqG;IACpG,SAAS,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;CAKjG"}