@vibesdotdev/kernel-rpc 0.0.0-stage → 1.0.0-rc.2

package/dist/transports/http/listener/projection-owner.js

@@ -0,0 +1,85 @@
+/** HTTP projections finalize through the supplied Runtime's canonical plugin lifecycle. */
+import { CapabilityError, createRuntimePlugin, isCapabilityError } from '@vibesdotdev/kernel';
+import { BaseRuntimeClient, getVibesClient, runtimeClientPlugin } from '@vibesdotdev/kernel/client';
+import { connectionCloseFailure, drainAll } from "../../../core/protocol/lifecycle/binding-close.js";
+import { RpcConnector } from "../../../core/protocol/lifecycle/connector.js";
+class HttpProjectionOwner extends BaseRuntimeClient {
+    projections = new Set();
+    onDispose() {
+        return drainAll([...this.projections].map(close => close()));
+    }
+    async mount(open, signal) {
+        const connector = new RpcConnector({
+            lifecycle: this.runtime.lifecycle, reason: 'http-projection', open, signal,
+            closed: mount => mount.connection.closed,
+            close: mount => mount.close()
+        });
+        let mounted;
+        let closing;
+        const finish = () => {
+            if (closing)
+                return closing;
+            const completion = Promise.withResolvers();
+            closing = completion.promise;
+            // Start local retraction synchronously, after publishing custody.
+            const outcomes = [
+                Promise.resolve().then(() => connector.dispose()), ...(mounted ? [mounted.close()] : [])
+            ];
+            void Promise.allSettled(outcomes).then(results => {
+                // An ended connection still has a retained close outcome; join that too.
+                const failures = [...new Set(results
+                        .filter(outcome => outcome.status === 'rejected').map(outcome => outcome.reason))];
+                if (failures.length === 0) {
+                    this.projections.delete(finish);
+                    completion.resolve(null);
+                    return;
+                }
+                if (failures.length === 1) {
+                    completion.resolve(isCapabilityError(failures[0])
+                        ? failures[0] : connectionCloseFailure('http-projection', failures[0]));
+                    return;
+                }
+                completion.resolve(new CapabilityError('HTTP projection cleanup failed.', 'UNAVAILABLE', {
+                    reason: 'rpc-projection-close-failed', retryable: false, cause: new AggregateError(failures)
+                }));
+            });
+            return closing;
+        };
+        this.projections.add(finish);
+        try {
+            mounted = await connector.connect();
+            const close = async () => {
+                const failure = await finish();
+                if (failure)
+                    throw failure;
+            };
+            return { ...mounted, close, [Symbol.dispose]: () => void finish() };
+        }
+        catch (failure) {
+            const cleanup = await finish();
+            if (cleanup)
+                throw new AggregateError([failure, cleanup], 'HTTP projection admission and cleanup failed.');
+            throw failure;
+        }
+    }
+}
+/** Each mount is a runtime client owned by the exact plugin view that opened it. */
+export async function ownHttpProjection(runtime, open, signal) {
+    const id = `runtime-rpc-http-projection-${crypto.randomUUID()}`;
+    let owner;
+    await runtime.registerPlugin(createRuntimePlugin({
+        id,
+        async onRegister(view) {
+            if (!view.hasKind('runtime/client'))
+                await view.registerPlugin(runtimeClientPlugin);
+            view.registerDescriptor('runtime/client', { kind: 'runtime/client', id });
+            view.registerLoader('runtime/client', id, async () => ({ impl: HttpProjectionOwner }));
+            owner = await getVibesClient(id, view);
+        },
+        onDispose: () => owner?.dispose()
+    }));
+    if (!owner)
+        throw new Error('HTTP projection client registration did not complete.');
+    return owner.mount(open, signal);
+}
+//# sourceMappingURL=projection-owner.js.map

package/dist/transports/http/listener/projection-owner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projection-owner.js","sourceRoot":"","sources":["../../../../src/transports/http/listener/projection-owner.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAE3F,OAAO,EACP,eAAe,EAAE,mBAAmB,EAAE,iBAAiB,EAEtD,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACpG,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,MAAM,mDAAmD,CAAC;AACrG,OAAO,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAK7E,MAAM,mBAAoB,SAAQ,iBAAiB;IACjC,WAAW,GAAG,IAAI,GAAG,EAAmB,CAAC;IAEpC,SAAS;QACxB,OAAO,QAAQ,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC;IAEJ,KAAK,CAAC,KAAK,CAAC,IAAwD,EAAE,MAAoB;QAEzF,MAAM,SAAS,GAAG,IAAI,YAAY,CAAmB;YACpD,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM;YAC1E,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM;YACxC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE;SAC7B,CAAC,CAAC;QACH,IAAI,OAAqC,CAAC;QAC1C,IAAI,OAAoD,CAAC;QACzD,MAAM,MAAM,GAAoB,GAAG,EAAE;YACpC,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;YAC5B,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,EAA0B,CAAC;YACnE,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;YAC7B,kEAAkE;YAClE,MAAM,QAAQ,GAAG;gBAChB,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACxF,CAAC;YACF,KAAK,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;gBAChD,yEAAyE;gBACzE,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO;yBAClC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACpF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC3B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBAChC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBACzB,OAAO;gBACR,CAAC;gBACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC3B,UAAU,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;wBAChD,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBACzE,OAAO;gBACR,CAAC;gBACD,UAAU,CAAC,OAAO,CAAC,IAAI,eAAe,CAAC,iCAAiC,EAAE,aAAa,EAAE;oBACxF,MAAM,EAAE,6BAA6B,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,cAAc,CAAC,QAAQ,CAAC;iBAC5F,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,OAAO,OAAO,CAAC;QAChB,CAAC,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC;YACJ,OAAO,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,KAAK,IAAmB,EAAE;gBACvC,MAAM,OAAO,GAAG,MAAM,MAAM,EAAE,CAAC;gBAC/B,IAAI,OAAO;oBAAE,MAAM,OAAO,CAAC;YAC5B,CAAC,CAAC;YACF,OAAO,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,EAAE,EAAE,CAAC;QACrE,CAAC;QAAC,OAAO,OAAO,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,MAAM,MAAM,EAAE,CAAC;YAC/B,IAAI,OAAO;gBAAE,MAAM,IAAI,cAAc,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,+CAA+C,CAAC,CAAC;YAC3G,MAAM,OAAO,CAAC;QACf,CAAC;IACF,CAAC;CACD;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACnC,OAAmB,EACnB,IAAwD,EACxD,MAAoB;IAEpB,MAAM,EAAE,GAAG,+BAA+B,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;IAChE,IAAI,KAAsC,CAAC;IAC3C,MAAM,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC;QAC7C,EAAE;QACF,KAAK,CAAC,UAAU,CAAC,IAAI;YACjB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;gBAAE,MAAM,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;YACpF,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC,cAAc,CAAC,gBAAgB,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC;YACvF,KAAK,GAAG,MAAM,cAAc,CAAsB,EAAE,EAAE,IAAI,CAAC,CAAC;QAChE,CAAC;QACD,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE;KACpC,CAAC,CAAC,CAAC;IACJ,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACrF,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACrC,CAAC"}

package/dist/transports/http/listener/reverse-response.d.ts

@@ -0,0 +1,4 @@
+import type { HttpListenSession } from './http-listen-session.ts';
+/** The negotiated reverse leg carries canonical invokes on the same authenticated connection. */
+export declare function reverseResponse(session: HttpListenSession, close: () => Promise<void>): Response;
+//# sourceMappingURL=reverse-response.d.ts.map

package/dist/transports/http/listener/reverse-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reverse-response.d.ts","sourceRoot":"","sources":["../../../../src/transports/http/listener/reverse-response.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAElE,iGAAiG;AACjG,wBAAgB,eAAe,CAAC,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAsBhG"}

package/dist/transports/http/listener/reverse-response.js

@@ -0,0 +1,27 @@
+import { jsonRequest } from "../../../core/protocol/wire/json-wire.js";
+import { SSE_REQUEST_EVENT } from "../wire.js";
+/** The negotiated reverse leg carries canonical invokes on the same authenticated connection. */
+export function reverseResponse(session, close) {
+    if (!session.reverseCalls || session.reverseAttached)
+        return new Response(null, { status: 409 });
+    const encoder = new TextEncoder();
+    let cancelled = false;
+    const stream = new ReadableStream({
+        start(controller) {
+            controller.enqueue(encoder.encode(': open\n\n'));
+            const attached = session.attachReverse(request => controller.enqueue(encoder.encode(`event: ${SSE_REQUEST_EVENT}\ndata: ${JSON.stringify(jsonRequest(request, session.wireDates))}\n\n`)), () => { if (!cancelled)
+                controller.close(); });
+            if (!attached)
+                controller.close();
+        },
+        cancel() {
+            cancelled = true;
+            // A dropped connection ends native invocation lifetimes as well as remote refs.
+            return close();
+        }
+    });
+    return new Response(stream, {
+        headers: { 'content-type': 'text/event-stream', 'cache-control': 'no-cache', connection: 'keep-alive' }
+    });
+}
+//# sourceMappingURL=reverse-response.js.map

package/dist/transports/http/listener/reverse-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reverse-response.js","sourceRoot":"","sources":["../../../../src/transports/http/listener/reverse-response.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAG/C,iGAAiG;AACjG,MAAM,UAAU,eAAe,CAAC,OAA0B,EAAE,KAA0B;IACrF,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,eAAe;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,MAAM,MAAM,GAAG,IAAI,cAAc,CAAa;QAC7C,KAAK,CAAC,UAAU;YACf,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;YACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,CACrC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,iBAAiB,WAAW,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,EAClJ,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;gBAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAC7C,CAAC;YACF,IAAI,CAAC,QAAQ;gBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QACD,MAAM;YACL,SAAS,GAAG,IAAI,CAAC;YACjB,gFAAgF;YAChF,OAAO,KAAK,EAAE,CAAC;QAChB,CAAC;KACD,CAAC,CAAC;IACH,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE;QAC3B,OAAO,EAAE,EAAE,cAAc,EAAE,mBAAmB,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE;KACvG,CAAC,CAAC;AACJ,CAAC"}

package/dist/transports/http/listener/stream-response.d.ts

@@ -0,0 +1,3 @@
+import type { HttpListenSession } from './http-listen-session.ts';
+export declare function streamResponse(session: HttpListenSession, channelId: string): Response;
+//# sourceMappingURL=stream-response.d.ts.map

package/dist/transports/http/listener/stream-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-response.d.ts","sourceRoot":"","sources":["../../../../src/transports/http/listener/stream-response.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,wBAAgB,cAAc,CAAC,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,GAAG,QAAQ,CAmDtF"}

package/dist/transports/http/listener/stream-response.js

@@ -0,0 +1,52 @@
+import { frameClose, frameData } from '@vibesdotdev/kernel-rpc';
+import { attempt } from "../../../core/protocol/lifecycle/attempt.js";
+import { SSE_FRAME_EVENT, encodeBase64 } from "../wire.js";
+export function streamResponse(session, channelId) {
+    const encoder = new TextEncoder();
+    const stream = new ReadableStream({
+        start: (controller) => {
+            // Prime the stream: an SSE comment line forces the body to open and the consumer's reader to begin draining immediately (proxies otherwise buffer until first bytes; it also de-races the owner→consumer flush).
+            controller.enqueue(encoder.encode(': open\n\n'));
+            // The owner emits RAW session-output bytes; wrap each chunk with the 1-byte DATA frame header (the same framing the socket codec uses) so the consumer's `decodeFrame` reads it identically. base64-encode the framed record for the text/event-stream `data:` line.
+            session.attachSse(channelId, (chunk) => {
+                const enqueued = attempt(() => {
+                    const framed = frameData(chunk);
+                    controller.enqueue(encoder.encode(`event: ${SSE_FRAME_EVENT}
+data: ${encodeBase64(framed)}
+
+`));
+                });
+                // A TypeError is the stream already cancelled by the consumer (the
+                // channel's close path owns cleanup); anything else is kept typed.
+                if (!enqueued.ok && !(enqueued.failure instanceof TypeError))
+                    session.keepChannelFailure(channelId, enqueued.failure);
+            }, () => {
+                // The owner's end: a CLOSE frame after the last DATA frame, then the body ends.
+                const ended = attempt(() => {
+                    controller.enqueue(encoder.encode(`event: ${SSE_FRAME_EVENT}
+data: ${encodeBase64(frameClose())}
+
+`));
+                    controller.close();
+                });
+                // A TypeError is confirmed already-closed: the consumer cancelled the SSE body first.
+                if (!ended.ok && !(ended.failure instanceof TypeError))
+                    session.keepChannelFailure(channelId, ended.failure);
+            });
+        },
+        cancel: () => {
+            // The consumer closed the SSE connection → tear the channel down; a
+            // close failure is kept for the connection's close.
+            session.dropChannel(channelId);
+        }
+    });
+    return new Response(stream, {
+        status: 200,
+        headers: {
+            'content-type': 'text/event-stream',
+            'cache-control': 'no-cache',
+            connection: 'keep-alive'
+        }
+    });
+}
+//# sourceMappingURL=stream-response.js.map

package/dist/transports/http/listener/stream-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-response.js","sourceRoot":"","sources":["../../../../src/transports/http/listener/stream-response.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,6CAA6C,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE3D,MAAM,UAAU,cAAc,CAAC,OAA0B,EAAE,SAAiB;IAC1E,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,cAAc,CAAa;QAC7C,KAAK,EAAE,CAAC,UAAU,EAAE,EAAE;YACrB,iNAAiN;YACjN,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;YACjD,qQAAqQ;YACrQ,OAAO,CAAC,SAAS,CAChB,SAAS,EACT,CAAC,KAAK,EAAE,EAAE;gBACT,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE;oBAC7B,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;oBAChC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,eAAe;QAC1D,YAAY,CAAC,MAAM,CAAC;;CAE3B,CAAC,CAAC,CAAC;gBACE,CAAC,CAAC,CAAC;gBACH,mEAAmE;gBACnE,mEAAmE;gBACnE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,YAAY,SAAS,CAAC;oBAAE,OAAO,CAAC,kBAAkB,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YACvH,CAAC,EACD,GAAG,EAAE;gBACJ,gFAAgF;gBAChF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE;oBAC1B,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,eAAe;QAC1D,YAAY,CAAC,UAAU,EAAE,CAAC;;CAEjC,CAAC,CAAC,CAAC;oBACG,UAAU,CAAC,KAAK,EAAE,CAAC;gBACpB,CAAC,CAAC,CAAC;gBACH,sFAAsF;gBACtF,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,SAAS,CAAC;oBAAE,OAAO,CAAC,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAC9G,CAAC,CACD,CAAC;QACH,CAAC;QACD,MAAM,EAAE,GAAG,EAAE;YACZ,oEAAoE;YACpE,oDAAoD;YACpD,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAChC,CAAC;KACD,CAAC,CAAC;IAEH,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE;QAC3B,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACR,cAAc,EAAE,mBAAmB;YACnC,eAAe,EAAE,UAAU;YAC3B,UAAU,EAAE,YAAY;SACxB;KACD,CAAC,CAAC;AAEL,CAAC"}

package/dist/transports/http/runtime-rpc-http.plugin.d.ts

@@ -0,0 +1,41 @@
+import type { RuntimeRpcHttpPluginOptions } from "../../schemas/contracts/transports/http/runtime-rpc-http.plugin.ts";
+export { PluginOptionsInput } from "../../schemas/contracts/transports/http/runtime-rpc-http.plugin.ts";
+export type { RuntimeRpcHttpPluginOptions } from "../../schemas/contracts/transports/http/runtime-rpc-http.plugin.ts";
+/**
+ * Runtime RPC — http/SSE transport plugin (PHASE 4, GATED on L5).
+ *
+ * Self-registers the `runtime/rpc` kind (idempotent) and a loader that builds an
+ * http transport impl for any registered `runtime/rpc` descriptor whose
+ * `transport === 'http'`. Mirrors the unix/tcp plugins; the bootstrap layer
+ * supplies the concrete origin descriptors; the runtime's `resolveCredential`
+ * resolves each descriptor's `auth` reference to a connect-time bearer.
+ *
+ * THE HARD GATE (doc 11 §L4, acceptance #8): this plugin is the CONNECT side — it
+ * builds consumer transports to reach a remote runtime. The LISTEN side
+ * (`RpcHttpHandler` / `listenHttp`) is exported separately for a fleet daemon
+ * (L6d) to mount; it is the listen side that wires the L1 invoke pipeline into
+ * every arriving invoke, which is why http may be exposed at all. A remote bind
+ * MUST pass a `tokenRegistry` so the connection is authenticated; per-invoke
+ * authz/friction remain L5's, inside the pipeline.
+ */
+import type { RuntimeRef } from '@vibesdotdev/kernel';
+import { type RuntimeRpcDescriptor } from '@vibesdotdev/kernel-rpc';
+/**
+ * Register an http transport loader for one `runtime/rpc` descriptor. The
+ * canonical loader body for the connect side — exported so a wrapping plugin
+ * (e.g. `@vibesdotdev/platform/fleets/daemon`'s `fleet-daemon-connect`) can register the
+ * SAME transport under its OWN plugin id instead of cloning this plugin object
+ * (plugin registration is silently idempotent by id, so a clone that reuses
+ * `'runtime-rpc-http'` is dropped whenever both are loaded).
+ */
+export declare function registerHttpRpcLoader(runtime: RuntimeRef, descriptorInput: RuntimeRpcDescriptor): void;
+/**
+ * Register one live HTTP RPC identity as an exact disposable runtime asset.
+ * Discovery owners use this path so an upsert replaces the descriptor and
+ * transport together, and TTL eviction retracts both.
+ */
+export declare function registerDynamicHttpRpcAsset(runtime: RuntimeRef, descriptorInput: RuntimeRpcDescriptor): () => void;
+export declare function createRuntimeRpcHttpPlugin(optionsInput?: RuntimeRpcHttpPluginOptions): import("@vibesdotdev/kernel").RuntimePlugin;
+export declare const runtimeRpcHttpPlugin: import("@vibesdotdev/kernel").RuntimePlugin;
+export default runtimeRpcHttpPlugin;
+//# sourceMappingURL=runtime-rpc-http.plugin.d.ts.map

package/dist/transports/http/runtime-rpc-http.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-rpc-http.plugin.d.ts","sourceRoot":"","sources":["../../../src/transports/http/runtime-rpc-http.plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oEAAoE,CAAC;AAEtH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oEAAoE,CAAC;AACxG,YAAY,EAAE,2BAA2B,EAAE,MAAM,oEAAoE,CAAC;AACtH;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAW,KAAK,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAoB7E;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACpC,OAAO,EAAE,UAAU,EACnB,eAAe,EAAE,oBAAoB,GACnC,IAAI,CAQN;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAC1C,OAAO,EAAE,UAAU,EACnB,eAAe,EAAE,oBAAoB,GACnC,MAAM,IAAI,CASZ;AAED,wBAAgB,0BAA0B,CAAC,YAAY,GAAE,2BAAgC,+CAwBxF;AAED,eAAO,MAAM,oBAAoB,6CAA+B,CAAC;AAEjE,eAAe,oBAAoB,CAAC"}

package/dist/transports/http/runtime-rpc-http.plugin.js

@@ -0,0 +1,70 @@
+import { PluginOptionsInput } from "../../schemas/contracts/transports/http/runtime-rpc-http.plugin.js";
+export { PluginOptionsInput } from "../../schemas/contracts/transports/http/runtime-rpc-http.plugin.js";
+import { createRuntimeImplementation, createRuntimePlugin } from '@vibesdotdev/kernel';
+import { rpcKind } from '@vibesdotdev/kernel-rpc';
+import { readInput } from "../../core/protocol/references/caller-input.js";
+import { readRpcDescriptor } from "../../core/protocol/references/descriptor-input.js";
+/** Transport plugin options, read once (protocol/caller-input.ts). */
+function createHttpRpcLoader(descriptor, runtime) {
+    return async () => {
+        const { createHttpRpcImplementation } = await import("./listener/http-transport.impl.js");
+        return createRuntimeImplementation({
+            kind: 'runtime/rpc',
+            id: descriptor.id,
+            // A remote http target is a non-local candidate; advertise its scope hint
+            // (default cloud) so the L1 resolver only inserts it on an explicit remote.
+            constraint: { hardware: [descriptor.remoteScope?.hardware ?? 'cloud'] },
+            implementation: createHttpRpcImplementation(descriptor, runtime)
+        });
+    };
+}
+/**
+ * Register an http transport loader for one `runtime/rpc` descriptor. The
+ * canonical loader body for the connect side — exported so a wrapping plugin
+ * (e.g. `@vibesdotdev/platform/fleets/daemon`'s `fleet-daemon-connect`) can register the
+ * SAME transport under its OWN plugin id instead of cloning this plugin object
+ * (plugin registration is silently idempotent by id, so a clone that reuses
+ * `'runtime-rpc-http'` is dropped whenever both are loaded).
+ */
+export function registerHttpRpcLoader(runtime, descriptorInput) {
+    const descriptor = readRpcDescriptor('registerHttpRpcLoader', descriptorInput, 'http');
+    runtime.registerLoader('runtime/rpc', descriptor.id, createHttpRpcLoader(descriptor, runtime), { constraint: { hardware: [descriptor.remoteScope?.hardware ?? 'cloud'] } });
+}
+/**
+ * Register one live HTTP RPC identity as an exact disposable runtime asset.
+ * Discovery owners use this path so an upsert replaces the descriptor and
+ * transport together, and TTL eviction retracts both.
+ */
+export function registerDynamicHttpRpcAsset(runtime, descriptorInput) {
+    const descriptor = readRpcDescriptor('registerDynamicHttpRpcAsset', descriptorInput, 'http');
+    if (!runtime.hasKind(rpcKind.id))
+        runtime.registerKind(rpcKind);
+    return runtime.registerDynamicAsset(rpcKind.id, descriptor, createHttpRpcLoader(descriptor, runtime), { constraint: { hardware: [descriptor.remoteScope?.hardware ?? 'cloud'] } });
+}
+export function createRuntimeRpcHttpPlugin(optionsInput = {}) {
+    const options = readInput('createRuntimeRpcHttpPlugin', PluginOptionsInput, optionsInput) ?? {};
+    const descriptors = (options.descriptors ?? []).filter((d) => d.transport === 'http');
+    return createRuntimePlugin({
+        id: 'runtime-rpc-http',
+        name: 'Runtime RPC — http/SSE transport',
+        description: 'HTTP/SSE remote transport for the runtime/rpc kind (phase 4, gated on L5). connect() maps the three verbs onto POST /rpc/invoke, POST /rpc/release, and a GET /rpc/stream SSE channel; the listen side dispatches every arriving invoke through the L1 authz → friction pipeline. Connection bearer resolves from the descriptor auth.',
+        dependencies: [],
+        descriptors,
+        async onRegister(runtime) {
+            // Register the runtime/rpc kind only when absent — ACTUALLY idempotent,
+            // as this plugin's header has always claimed. Declaring `kinds: [rpcKind]`
+            // made registerPlugin throw "Kind 'runtime/rpc' is already registered"
+            // whenever any other rpc plugin (unix/tcp/fleet-daemon-connect) had
+            // registered the shared kind first.
+            if (!runtime.hasKind(rpcKind.id)) {
+                runtime.registerKind(rpcKind);
+            }
+            for (const descriptor of descriptors) {
+                registerHttpRpcLoader(runtime, descriptor);
+            }
+        }
+    });
+}
+export const runtimeRpcHttpPlugin = createRuntimeRpcHttpPlugin();
+export default runtimeRpcHttpPlugin;
+//# sourceMappingURL=runtime-rpc-http.plugin.js.map

package/dist/transports/http/runtime-rpc-http.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-rpc-http.plugin.js","sourceRoot":"","sources":["../../../src/transports/http/runtime-rpc-http.plugin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,oEAAoE,CAAC;AACxG,OAAO,EAAE,kBAAkB,EAAE,MAAM,oEAAoE,CAAC;AAqBxG,OAAO,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACvF,OAAO,EAAE,OAAO,EAA6B,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,gDAAgD,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,oDAAoD,CAAC;AAEvF,sEAAsE;AAEtE,SAAS,mBAAmB,CAAC,UAAgC,EAAE,OAAmB;IACjF,OAAO,KAAK,IAAI,EAAE;QACjB,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,mCAAmC,CAAC,CAAC;QAC1F,OAAO,2BAA2B,CAAC;YAClC,IAAI,EAAE,aAAa;YACnB,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,0EAA0E;YAC1E,4EAA4E;YAC5E,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,QAAQ,IAAI,OAAO,CAAC,EAAE;YACvE,cAAc,EAAE,2BAA2B,CAAC,UAAU,EAAE,OAAO,CAAC;SAChE,CAAC,CAAC;IACJ,CAAC,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACpC,OAAmB,EACnB,eAAqC;IAErC,MAAM,UAAU,GAAG,iBAAiB,CAAC,uBAAuB,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;IACvF,OAAO,CAAC,cAAc,CACrB,aAAa,EACb,UAAU,CAAC,EAAE,EACb,mBAAmB,CAAC,UAAU,EAAE,OAAO,CAAC,EACxC,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,QAAQ,IAAI,OAAO,CAAC,EAAE,EAAE,CAC3E,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAC1C,OAAmB,EACnB,eAAqC;IAErC,MAAM,UAAU,GAAG,iBAAiB,CAAC,6BAA6B,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;IAC7F,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAAE,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAChE,OAAO,OAAO,CAAC,oBAAoB,CAClC,OAAO,CAAC,EAAE,EACV,UAAU,EACV,mBAAmB,CAAC,UAAU,EAAE,OAAO,CAAC,EACxC,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,QAAQ,IAAI,OAAO,CAAC,EAAE,EAAE,CAC3E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,eAA4C,EAAE;IACxF,MAAM,OAAO,GAAG,SAAS,CAAC,4BAA4B,EAAE,kBAAkB,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC;IAChG,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC;IACtF,OAAO,mBAAmB,CAAC;QAC1B,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,kCAAkC;QACxC,WAAW,EACV,wUAAwU;QACzU,YAAY,EAAE,EAAE;QAChB,WAAW;QACX,KAAK,CAAC,UAAU,CAAC,OAAmB;YACnC,wEAAwE;YACxE,2EAA2E;YAC3E,uEAAuE;YACvE,oEAAoE;YACpE,oCAAoC;YACpC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAC/B,CAAC;YACD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;gBACtC,qBAAqB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAC5C,CAAC;QACF,CAAC;KACD,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,0BAA0B,EAAE,CAAC;AAEjE,eAAe,oBAAoB,CAAC"}

package/dist/transports/http/schemas/daemon-endpoint.d.ts

@@ -0,0 +1,83 @@
+import * as z from 'zod/v4';
+import { CapabilityError, type RuntimeScope, type VibesRuntime } from '@vibesdotdev/kernel';
+export declare const DaemonEndpointMethodSchema: z.ZodEnum<{
+    POST: "POST";
+    DELETE: "DELETE";
+    GET: "GET";
+}>;
+export declare const DaemonEndpointAuthSchema: z.ZodEnum<{
+    optional: "optional";
+    required: "required";
+    none: "none";
+}>;
+export declare const DaemonEndpointHardwareSchema: z.ZodEnum<{
+    consumer: "consumer";
+    cloud: "cloud";
+}>;
+export declare const DaemonEndpointDescriptorSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    priority: z.ZodOptional<z.ZodNumber>;
+    capabilityId: z.ZodOptional<z.ZodString>;
+    requiredContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    optionalContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    config: z.ZodOptional<z.ZodUnknown>;
+    retention: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        maxEntries: z.ZodOptional<z.ZodNumber>;
+        maxBytes: z.ZodOptional<z.ZodNumber>;
+        cascadeFrom: z.ZodOptional<z.ZodString>;
+        ageField: z.ZodOptional<z.ZodString>;
+        reason: z.ZodString;
+        enforcedBy: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>>;
+    kind: z.ZodLiteral<"runtime/daemon/endpoint">;
+    path: z.ZodString;
+    methods: z.ZodArray<z.ZodEnum<{
+        POST: "POST";
+        DELETE: "DELETE";
+        GET: "GET";
+    }>>;
+    auth: z.ZodDefault<z.ZodEnum<{
+        optional: "optional";
+        required: "required";
+        none: "none";
+    }>>;
+    endpointHardware: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        consumer: "consumer";
+        cloud: "cloud";
+    }>>>;
+}, z.core.$strip>;
+export type DaemonEndpointMethod = z.infer<typeof DaemonEndpointMethodSchema>;
+export type DaemonEndpointAuth = z.infer<typeof DaemonEndpointAuthSchema>;
+export type DaemonEndpointHardware = z.infer<typeof DaemonEndpointHardwareSchema>;
+export type DaemonEndpointDescriptor = z.infer<typeof DaemonEndpointDescriptorSchema>;
+export interface DaemonEndpointRequest {
+    readonly method?: string;
+    readonly url?: string;
+    readonly headers?: Readonly<Record<string, string | readonly string[] | undefined>>;
+}
+export interface DaemonEndpointResponse {
+    statusCode?: number;
+    setHeader?(name: string, value: string | number | readonly string[]): void;
+    end?(chunk?: string): void;
+}
+export interface DaemonEndpointServer {
+    on(event: string, listener: (...args: never[]) => void): DaemonEndpointServer;
+}
+export interface DaemonEndpoint {
+    handle(req: DaemonEndpointRequest, res: DaemonEndpointResponse, context?: {
+        readonly runtime: VibesRuntime;
+    }): Promise<void>;
+    onMount?(server: DaemonEndpointServer): void;
+    onUnmount?(): void;
+}
+/** Validation preserves the host response object so endpoint writes reach it. */
+export declare const DaemonEndpointResponseSchema: z.ZodCustom<DaemonEndpointResponse, DaemonEndpointResponse>;
+export declare function daemonResponseInvalid(): CapabilityError;
+export declare function resolveDaemonEndpoint(candidates: DaemonEndpointDescriptor[], scope: RuntimeScope): DaemonEndpointDescriptor | undefined;
+//# sourceMappingURL=daemon-endpoint.d.ts.map

package/dist/transports/http/schemas/daemon-endpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-endpoint.d.ts","sourceRoot":"","sources":["../../../../src/transports/http/schemas/daemon-endpoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EACN,eAAe,EAEf,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,MAAM,qBAAqB,CAAC;AAE7B,eAAO,MAAM,0BAA0B;;;;EAAoC,CAAC;AAC5E,eAAO,MAAM,wBAAwB;;;;EAA2C,CAAC;AACjF,eAAO,MAAM,4BAA4B;;;EAAgC,CAAC;AAE1E,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAMzC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,sBAAsB;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAC3E,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACpC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,GAAG,oBAAoB,CAAC;CAC9E;AAED,MAAM,WAAW,cAAc;IAC9B,MAAM,CACL,GAAG,EAAE,qBAAqB,EAC1B,GAAG,EAAE,sBAAsB,EAC3B,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;KAAE,GAC1C,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,CAAC,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC7C,SAAS,CAAC,IAAI,IAAI,CAAC;CACnB;AAQD,iFAAiF;AACjF,eAAO,MAAM,4BAA4B,6DAExC,CAAC;AAEF,wBAAgB,qBAAqB,IAAI,eAAe,CAMvD;AAED,wBAAgB,qBAAqB,CACpC,UAAU,EAAE,wBAAwB,EAAE,EACtC,KAAK,EAAE,YAAY,GACjB,wBAAwB,GAAG,SAAS,CAQtC"}

package/dist/transports/http/schemas/daemon-endpoint.js

@@ -0,0 +1,32 @@
+import * as z from 'zod/v4';
+import { CapabilityError, RuntimeDescriptorSchema } from '@vibesdotdev/kernel';
+export const DaemonEndpointMethodSchema = z.enum(['GET', 'POST', 'DELETE']);
+export const DaemonEndpointAuthSchema = z.enum(['required', 'optional', 'none']);
+export const DaemonEndpointHardwareSchema = z.enum(['consumer', 'cloud']);
+export const DaemonEndpointDescriptorSchema = RuntimeDescriptorSchema.extend({
+    kind: z.literal('runtime/daemon/endpoint'),
+    path: z.string().min(1),
+    methods: z.array(DaemonEndpointMethodSchema).min(1),
+    auth: DaemonEndpointAuthSchema.default('none'),
+    endpointHardware: z.array(DaemonEndpointHardwareSchema).optional()
+});
+const DaemonEndpointResponseMembersSchema = z.object({
+    statusCode: z.number().optional(),
+    setHeader: z.function().optional(),
+    end: z.function().optional()
+});
+/** Validation preserves the host response object so endpoint writes reach it. */
+export const DaemonEndpointResponseSchema = z.custom(value => DaemonEndpointResponseMembersSchema.safeParse(value).success);
+export function daemonResponseInvalid() {
+    return new CapabilityError('A daemon endpoint requires a structural HTTP response.', 'INVALID_INPUT', { reason: 'daemon-response-invalid' });
+}
+export function resolveDaemonEndpoint(candidates, scope) {
+    const enabled = candidates.filter((descriptor) => descriptor.enabled !== false);
+    const matching = enabled.filter((descriptor) => {
+        if (!descriptor.endpointHardware || descriptor.endpointHardware.length === 0)
+            return true;
+        return descriptor.endpointHardware.some((hardware) => hardware === scope.hardware);
+    });
+    return matching[0] ?? enabled[0];
+}
+//# sourceMappingURL=daemon-endpoint.js.map

package/dist/transports/http/schemas/daemon-endpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-endpoint.js","sourceRoot":"","sources":["../../../../src/transports/http/schemas/daemon-endpoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EACN,eAAe,EACf,uBAAuB,EAGvB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC5E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AACjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAE1E,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAC5E,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,IAAI,EAAE,wBAAwB,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9C,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,QAAQ,EAAE;CAClE,CAAC,CAAC;AAiCH,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CACnD,KAAK,CAAC,EAAE,CAAC,mCAAmC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CACrE,CAAC;AAEF,MAAM,UAAU,qBAAqB;IACpC,OAAO,IAAI,eAAe,CACzB,wDAAwD,EACxD,eAAe,EACf,EAAE,MAAM,EAAE,yBAAyB,EAAE,CACrC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CACpC,UAAsC,EACtC,KAAmB;IAEnB,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE;QAC9C,IAAI,CAAC,UAAU,CAAC,gBAAgB,IAAI,UAAU,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1F,OAAO,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC"}

package/dist/transports/http/wire.d.ts

@@ -0,0 +1,52 @@
+export { HttpHandshakeRefusalSchema, HttpHandshakeSchema, HttpStreamCloseSchema, HttpStreamWriteSchema } from "../../schemas/contracts/transports/http/wire.ts";
+export type { HttpHandshake, HttpStreamClose, HttpStreamWrite } from "../../schemas/contracts/transports/http/wire.ts";
+/**
+ * The http/SSE wire shape for the three-verb protocol.
+ *
+ * This is the ONE place the http transport names its routes. The routes are NOT
+ * named after kind methods (doc 11 §L4 rejects the `07` design: "If the word
+ * `resize` appears in the protocol, the protocol is wrong"). They are named after
+ * the THREE protocol verbs and the connection handshake — nothing kind-specific.
+ *
+ *   GET  /rpc/health           → authenticated availability, 204; allocates no connection.
+ *   POST /rpc/disconnect       → close connection refs/channels, 202; idempotent.
+ *   GET  /rpc/connect          → handshake: connection auth + advertise root ref id.
+ *   POST /rpc/invoke           → JSON RpcInvoke → JSON RpcResponse; negotiated reverse replies → 202.
+ *   GET  /rpc/invoke           → negotiated owner→consumer RpcInvoke callbacks as SSE.
+ *   POST /rpc/release          → the `release` verb. Body: JSON RpcRelease. → 202 (fire-and-forget).
+ *   GET  /rpc/stream           → the `stream` verb's OWNER→consumer byte channel, as SSE.
+ *                                 Query: ?ref=&channel=&channelId=. Each event carries
+ *                                 base64 frame bytes; the consumer decodes the 1-byte
+ *                                 frame header exactly as the socket codec does.
+ *   POST /rpc/stream/write     → the `stream` verb's consumer→OWNER bytes (PTY stdin).
+ *                                 Body: JSON { channelId, data:base64 }. → 202.
+ *   POST /rpc/stream/close     → close a stream channel. Body: JSON { channelId }. → 202.
+ *
+ * SSE is server→client only, so a stream channel is two HTTP legs: the SSE GET
+ * carries owner→consumer bytes; the write/close POSTs carry consumer→owner. Both
+ * legs tag every frame with the same `channelId` so the two ends correlate — the
+ * same multiplexing key the socket codec uses.
+ */
+/** The consumer advertises Date support before the owner allocates its session. */
+export declare const HTTP_WIRE_DATES_QUERY = "wire.dates";
+export declare const HTTP_REVERSE_CALLS_QUERY = "wire.callbacks";
+export declare const SSE_REQUEST_EVENT = "invoke";
+/** The http route paths. Verb-named + the handshake; never kind-named. */
+export declare const RPC_HTTP_ROUTE: {
+    readonly HEALTH: "/rpc/health";
+    readonly CONNECT: "/rpc/connect";
+    readonly DISCONNECT: "/rpc/disconnect";
+    readonly INVOKE: "/rpc/invoke";
+    readonly RELEASE: "/rpc/release";
+    readonly STREAM: "/rpc/stream";
+    readonly STREAM_WRITE: "/rpc/stream/write";
+    readonly STREAM_CLOSE: "/rpc/stream/close";
+};
+/** The SSE event name carrying a base64-framed stream chunk (owner→consumer). */
+export declare const SSE_FRAME_EVENT = "frame";
+/** The handshake response body: the connection id + the root ref id. */
+/** Base64-encode raw bytes for an SSE frame / a write body. */
+export declare function encodeBase64(bytes: Uint8Array): string;
+/** Decode a base64 SSE frame / write body back to raw bytes. */
+export declare function decodeBase64(b64: string): Uint8Array;
+//# sourceMappingURL=wire.d.ts.map

package/dist/transports/http/wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../../../src/transports/http/wire.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAC;AAChK,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC;AACvH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,mFAAmF;AACnF,eAAO,MAAM,qBAAqB,eAAe,CAAC;AAClD,eAAO,MAAM,wBAAwB,mBAAmB,CAAC;AACzD,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C,0EAA0E;AAC1E,eAAO,MAAM,cAAc;;;;;;;;;CASjB,CAAC;AAEX,iFAAiF;AACjF,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC,wEAAwE;AAExE,+DAA+D;AAC/D,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAItD;AAED,gEAAgE;AAChE,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAKpD"}

package/dist/transports/http/wire.js

@@ -0,0 +1,62 @@
+export { HttpHandshakeRefusalSchema, HttpHandshakeSchema, HttpStreamCloseSchema, HttpStreamWriteSchema } from "../../schemas/contracts/transports/http/wire.js";
+/**
+ * The http/SSE wire shape for the three-verb protocol.
+ *
+ * This is the ONE place the http transport names its routes. The routes are NOT
+ * named after kind methods (doc 11 §L4 rejects the `07` design: "If the word
+ * `resize` appears in the protocol, the protocol is wrong"). They are named after
+ * the THREE protocol verbs and the connection handshake — nothing kind-specific.
+ *
+ *   GET  /rpc/health           → authenticated availability, 204; allocates no connection.
+ *   POST /rpc/disconnect       → close connection refs/channels, 202; idempotent.
+ *   GET  /rpc/connect          → handshake: connection auth + advertise root ref id.
+ *   POST /rpc/invoke           → JSON RpcInvoke → JSON RpcResponse; negotiated reverse replies → 202.
+ *   GET  /rpc/invoke           → negotiated owner→consumer RpcInvoke callbacks as SSE.
+ *   POST /rpc/release          → the `release` verb. Body: JSON RpcRelease. → 202 (fire-and-forget).
+ *   GET  /rpc/stream           → the `stream` verb's OWNER→consumer byte channel, as SSE.
+ *                                 Query: ?ref=&channel=&channelId=. Each event carries
+ *                                 base64 frame bytes; the consumer decodes the 1-byte
+ *                                 frame header exactly as the socket codec does.
+ *   POST /rpc/stream/write     → the `stream` verb's consumer→OWNER bytes (PTY stdin).
+ *                                 Body: JSON { channelId, data:base64 }. → 202.
+ *   POST /rpc/stream/close     → close a stream channel. Body: JSON { channelId }. → 202.
+ *
+ * SSE is server→client only, so a stream channel is two HTTP legs: the SSE GET
+ * carries owner→consumer bytes; the write/close POSTs carry consumer→owner. Both
+ * legs tag every frame with the same `channelId` so the two ends correlate — the
+ * same multiplexing key the socket codec uses.
+ */
+/** The consumer advertises Date support before the owner allocates its session. */
+export const HTTP_WIRE_DATES_QUERY = 'wire.dates';
+export const HTTP_REVERSE_CALLS_QUERY = 'wire.callbacks';
+export const SSE_REQUEST_EVENT = 'invoke';
+/** The http route paths. Verb-named + the handshake; never kind-named. */
+export const RPC_HTTP_ROUTE = {
+    HEALTH: '/rpc/health',
+    CONNECT: '/rpc/connect',
+    DISCONNECT: '/rpc/disconnect',
+    INVOKE: '/rpc/invoke',
+    RELEASE: '/rpc/release',
+    STREAM: '/rpc/stream',
+    STREAM_WRITE: '/rpc/stream/write',
+    STREAM_CLOSE: '/rpc/stream/close'
+};
+/** The SSE event name carrying a base64-framed stream chunk (owner→consumer). */
+export const SSE_FRAME_EVENT = 'frame';
+/** The handshake response body: the connection id + the root ref id. */
+/** Base64-encode raw bytes for an SSE frame / a write body. */
+export function encodeBase64(bytes) {
+    let binary = '';
+    for (let i = 0; i < bytes.length; i++)
+        binary += String.fromCharCode(bytes[i]);
+    return btoa(binary);
+}
+/** Decode a base64 SSE frame / write body back to raw bytes. */
+export function decodeBase64(b64) {
+    const binary = atob(b64);
+    const out = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        out[i] = binary.charCodeAt(i);
+    return out;
+}
+//# sourceMappingURL=wire.js.map

package/dist/transports/http/wire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.js","sourceRoot":"","sources":["../../../src/transports/http/wire.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAC;AAEhK;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,mFAAmF;AACnF,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAClD,MAAM,CAAC,MAAM,wBAAwB,GAAG,gBAAgB,CAAC;AACzD,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAE1C,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAG;IAC7B,MAAM,EAAE,aAAa;IACrB,OAAO,EAAE,cAAc;IACvB,UAAU,EAAE,iBAAiB;IAC7B,MAAM,EAAE,aAAa;IACrB,OAAO,EAAE,cAAc;IACvB,MAAM,EAAE,aAAa;IACrB,YAAY,EAAE,mBAAmB;IACjC,YAAY,EAAE,mBAAmB;CACxB,CAAC;AAEX,iFAAiF;AACjF,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,wEAAwE;AAExE,+DAA+D;AAC/D,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC7C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,YAAY,CAAC,GAAW;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC;AACZ,CAAC"}

package/dist/transports/messageport/applet-callbacks.d.ts

@@ -0,0 +1,10 @@
+import type { DefaultReferenceTable } from '@vibesdotdev/kernel';
+import type { RpcSource } from '../../core/protocol/wire/rpc-data.ts';
+import type { MessagePortListenTarget } from '../../schemas/contracts/transports/messageport/messageport-listener.ts';
+export declare function createAppletCallbacks(table: DefaultReferenceTable, target: MessagePortListenTarget, post: (frame: RpcSource) => void, isClosed: () => boolean): {
+    callbackFor: (refId: string) => ((...values: unknown[]) => Promise<RpcSource | undefined>);
+    classifyOwnerResult: import("../../index.ts").WireClassifier;
+    classifyCallbackResult: import("../../index.ts").WireClassifier;
+    callbackAnswers: Map<string, (res: import("../../index.ts").RpcResponse) => void>;
+};
+//# sourceMappingURL=applet-callbacks.d.ts.map

package/dist/transports/messageport/applet-callbacks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"applet-callbacks.d.ts","sourceRoot":"","sources":["../../../src/transports/messageport/applet-callbacks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAC;AAEtE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wEAAwE,CAAC;AAGtH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,EAAE,QAAQ,EAAE,MAAM,OAAO;sCAQwpB,GAAG;;;;EADxzB"}

package/dist/transports/messageport/applet-callbacks.js

@@ -0,0 +1,11 @@
+import { createFunctionCallbacks } from "../../core/protocol/references/function-callbacks.js";
+import { MESSAGEPORT_RPC_DEFAULT_REQUEST_DEADLINE_MS, MESSAGEPORT_RPC_MAX_CALLBACK_REFS } from "./connection/contracts.js";
+export function createAppletCallbacks(table, target, post, isClosed) {
+    return createFunctionCallbacks(table, {
+        lifecycle: target.lifecycle,
+        deadlineMs: target.deadlineMs ?? MESSAGEPORT_RPC_DEFAULT_REQUEST_DEADLINE_MS,
+        maxRefs: MESSAGEPORT_RPC_MAX_CALLBACK_REFS,
+        classifyResult: target.classifyResult
+    }, request => post({ t: 'req', req: request }), isClosed);
+}
+//# sourceMappingURL=applet-callbacks.js.map

package/dist/transports/messageport/applet-callbacks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"applet-callbacks.js","sourceRoot":"","sources":["../../../src/transports/messageport/applet-callbacks.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uBAAuB,EAAE,MAAM,sDAAsD,CAAC;AAE/F,OAAO,EAAE,2CAA2C,EAAE,iCAAiC,EAAE,MAAM,2BAA2B,CAAC;AAE3H,MAAM,UAAU,qBAAqB,CAAC,KAA4B,EAAE,MAA+B,EAAE,IAAgC,EAAE,QAAuB;IAC7J,OAAO,uBAAuB,CAAC,KAAK,EAAE;QACrC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,2CAA2C;QAC5E,OAAO,EAAE,iCAAiC;QAC1C,cAAc,EAAE,MAAM,CAAC,cAAc;KACrC,EAAE,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC3D,CAAC"}