@vibesdotdev/kernel-rpc 0.0.0-stage → 1.0.0-rc.2

package/dist/transports/relay/listener/relay-listen-session.js

@@ -0,0 +1,207 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { dispatchRequest, FRAME, RPC_ERROR, rpcError } from '@vibesdotdev/kernel-rpc';
+import { connectionCloseFailure } from "../../../core/protocol/lifecycle/binding-close.js";
+import { toRpcError } from "../../../core/protocol/wire/verbs.js";
+import { attempt, attemptAsync } from "../../../core/protocol/lifecycle/attempt.js";
+import { channelIdInUse } from "../../../core/protocol/references/channel-ids.js";
+import { decodeBinaryFrame, encodeBinaryFrame, RelayJsonMessageSchema } from "../wire.js";
+import { RelayConsumers } from "./relay-consumers.js";
+/** How many handshaken consumers one relay session holds; past it the least recently used is evicted. */
+export const RELAY_MAX_CONSUMERS = 1024;
+export class RelayListenSession extends RelayConsumers {
+    // --------------------------------------------------------------------------- Incoming frame dispatch ---------------------------------------------------------------------------
+    /** Handle an incoming JSON message from the broker. §security rule 1: validates consumerId on every non-handshake request. */
+    async handleJsonMessage(msg, socket) {
+        const parsed = RelayJsonMessageSchema.safeParse(msg);
+        if (!parsed.success)
+            throw new CapabilityError('Invalid relay message.', 'INVALID_INPUT', { reason: 'rpc-relay-message-invalid', retryable: false });
+        const m = parsed.data;
+        this.activeSocket = socket;
+        if (m.type === 'rpc_request') {
+            const req = m.request;
+            // §security rule 1: __relay_handshake mints/registers the consumerId.
+            if (req.verb === 'invoke' && req.method === '__relay_handshake') {
+                // A closed session admits no consumer: the handshake is refused typed, nothing is allocated.
+                if (this.closedFlag) {
+                    socket.send(JSON.stringify({
+                        type: 'rpc_response',
+                        consumerId: m.consumerId,
+                        response: { id: req.id, error: rpcError(RPC_ERROR.DISCONNECTED, 'connection closed') }
+                    }));
+                    return;
+                }
+                const consumer = await this.getOrCreateConsumer(m.consumerId);
+                const handshakeResponse = {
+                    type: 'rpc_response',
+                    consumerId: consumer.consumerId,
+                    response: {
+                        id: req.id,
+                        // §security: return BOTH the rootRef AND the server-confirmed
+                        // consumerId. The client MUST use these on subsequent calls.
+                        result: { t: 'json', v: { rootRef: consumer.rootRef, consumerId: consumer.consumerId } }
+                    }
+                };
+                socket.send(JSON.stringify(handshakeResponse));
+                return;
+            }
+            // §security rule 1: every other request must carry a handshaken consumerId (the schema requires the
+            // field); `handleRpcRequest` refuses an unknown one `RPC_NO_TARGET` before any dispatch.
+            const response = await this.handleRpcRequest(req, m.consumerId, socket);
+            const outbound = {
+                type: 'rpc_response',
+                consumerId: m.consumerId,
+                response
+            };
+            socket.send(JSON.stringify(outbound));
+        }
+        else if (m.type === 'consumer_close') {
+            const failure = await this.closeConsumer(m.consumerId);
+            socket.send(JSON.stringify({
+                type: 'consumer_closed', consumerId: m.consumerId,
+                response: failure ? { id: m.id, error: toRpcError(failure) } : { id: m.id }
+            }));
+        }
+        else if (m.type === 'keepalive') {
+            socket.send(JSON.stringify({ type: 'keepalive' }));
+        }
+    }
+    /** Handle an incoming binary frame from the broker (consumer→owner stream data). §security rule 2: consumerId ownership is validated against the channel record. */
+    handleBinaryFrame(data, consumerId) {
+        const { channelId, frameType, payload } = decodeBinaryFrame(data);
+        const channel = this.channels.get(channelId);
+        if (!channel)
+            return;
+        // §security rule 2: channel isolation.
+        if (consumerId !== undefined && channel.owningConsumerId !== consumerId) {
+            return; // silently drop — no error on fire-and-forget binary path
+        }
+        if (frameType === FRAME.CLOSE) {
+            this.closeChannel(channelId);
+        }
+        else if (frameType === FRAME.DATA && payload.length > 0) {
+            channel.binding.write(payload);
+        }
+    }
+    /** Tear down the session and free all refs, then wait for every binding close it started. */
+    close() {
+        return this.shutdown().then((failure) => {
+            if (failure)
+                throw failure;
+        });
+    }
+    /** {@link close}, resolving to the typed failure instead of rejecting. */
+    shutdown() {
+        if (this.closing)
+            return this.closing;
+        const outcome = Promise.withResolvers();
+        this.closing = outcome.promise;
+        this.closedFlag = true;
+        for (const consumerId of this.consumers.keys())
+            void this.closeConsumer(consumerId);
+        for (const channelId of this.channels.keys())
+            this.closeChannel(channelId);
+        this.activeSocket = null;
+        void (async () => {
+            const consumers = await attemptAsync(() => this.consumerCloses.drain());
+            if (!consumers.ok)
+                this.closes.keepError(connectionCloseFailure(this.connectionId, consumers.failure));
+            outcome.resolve(await this.closes.settle());
+        })();
+        return this.closing;
+    }
+    async handleStreamRequest(req, consumer) {
+        if (req.verb !== 'stream') {
+            return { id: req.id, error: rpcError(RPC_ERROR.INVOKE_FAILED, 'not a stream') };
+        }
+        // The channel id is shared by every consumer of this daemon: a live or opening id is refused, never replaced.
+        if (!this.channelClaims.claim(req.id))
+            return channelIdInUse(req.id);
+        try {
+            return await this.openClaimedStream(req, consumer);
+        }
+        finally {
+            this.channelClaims.release(req.id);
+        }
+    }
+    async openClaimedStream(req, consumer) {
+        const dispatch = () => dispatchRequest(req, {
+            table: consumer.table,
+            pipeline: this.target.pipeline,
+            remotePeer: consumer.remotePeer,
+            decodeArgs: () => [],
+            classifyResult: this.target.classifyResult,
+            bindChannel: this.target.bindChannel,
+            kindOf: this.target.kindOf ?? (() => 'runtime/rpc')
+        });
+        const { response, binding } = await (this.target.runInvocation
+            ? this.target.runInvocation(dispatch, { id: consumer.consumerId, signal: consumer.connection.signal })
+            : dispatch());
+        if (response.error || !binding) {
+            // A refused binding (credit-governed, no stream credits here) is closed, its failure kept.
+            if (binding)
+                consumer.closes.keep(binding, req.id);
+            return response;
+        }
+        // The session closed while the binding was being made: close it (kept for close()) and refuse the channel.
+        if (this.closedFlag || consumer.closing) {
+            consumer.closes.keep(binding, req.id);
+            return { id: req.id, error: rpcError(RPC_ERROR.DISCONNECTED, 'connection closed') };
+        }
+        // §security rule 2: channelId is from req.id (broker-minted UUID); ownership
+        // is recorded. Only this consumer may subsequently write/close it.
+        const channelId = req.id;
+        const channelEntry = {
+            binding,
+            unsub: () => { },
+            channelId,
+            owningConsumerId: consumer.consumerId
+        };
+        const socket = this.activeSocket;
+        const unsub = binding.onData((data) => {
+            if (this.closedFlag || !socket)
+                return;
+            const frame = encodeBinaryFrame(channelId, FRAME.DATA, data);
+            socket.sendBinary(frame);
+        });
+        channelEntry.unsub = unsub;
+        this.channels.set(channelId, channelEntry);
+        // The owner's end: its CLOSE frame follows the channel's last DATA frame.
+        binding.onEnd?.(() => this.endChannel(channelId));
+        return response;
+    }
+    /** The owner ended the channel: send its CLOSE frame and forget it, without tearing the owner down. */
+    endChannel(channelId) {
+        const channel = this.channels.get(channelId);
+        if (!channel)
+            return;
+        this.channels.delete(channelId);
+        this.unsubscribe(channelId, channel);
+        if (!this.closedFlag && this.activeSocket) {
+            const sent = attempt(() => this.activeSocket.sendBinary(encodeBinaryFrame(channelId, FRAME.CLOSE)));
+            if (!sent.ok)
+                (this.consumers.get(channel.owningConsumerId)?.closes ?? this.closes).keepFailure(channelId, sent.failure);
+        }
+    }
+    /** Stop the channel's bytes; a binding whose unsubscribe failed is kept typed for close(). */
+    unsubscribe(channelId, channel) {
+        const released = attempt(() => channel.unsub());
+        if (!released.ok)
+            (this.consumers.get(channel.owningConsumerId)?.closes ?? this.closes).keepFailure(channelId, released.failure);
+    }
+    closeChannel(channelId) {
+        const channel = this.channels.get(channelId);
+        if (!channel)
+            return;
+        this.channels.delete(channelId);
+        if (!this.closedFlag && this.activeSocket) {
+            const closeFrame = encodeBinaryFrame(channelId, FRAME.CLOSE);
+            const sent = attempt(() => this.activeSocket.sendBinary(closeFrame));
+            if (!sent.ok)
+                (this.consumers.get(channel.owningConsumerId)?.closes ?? this.closes).keepFailure(channelId, sent.failure);
+        }
+        this.unsubscribe(channelId, channel);
+        // After the CLOSE frame, so frame order is unchanged; a failure is kept for close().
+        (this.consumers.get(channel.owningConsumerId)?.closes ?? this.closes).keep(channel.binding, channelId);
+    }
+}
+//# sourceMappingURL=relay-listen-session.js.map

package/dist/transports/relay/listener/relay-listen-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-listen-session.js","sourceRoot":"","sources":["../../../../src/transports/relay/listener/relay-listen-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAqD,MAAM,yBAAyB,CAAC;AAEzI,OAAO,EAAE,sBAAsB,EAAE,MAAM,mDAAmD,CAAC;AAC3F,OAAO,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,kDAAkD,CAAC;AAElF,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAE1F,OAAO,EAAE,cAAc,EAAiD,MAAM,sBAAsB,CAAC;AAIrG,yGAAyG;AACzG,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAExC,MAAM,OAAO,kBAAmB,SAAQ,cAAc;IACtD,kLAAkL;IAE9K,8HAA8H;IAC9H,KAAK,CAAC,iBAAiB,CAAC,GAAc,EAAE,MAAmB;QACvD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,wBAAwB,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACrJ,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC;QAE3B,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC;YAEtB,sEAAsE;YACtE,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;gBAC9D,6FAA6F;gBAC7F,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBAClB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;wBACvB,IAAI,EAAE,cAAc;wBACpB,UAAU,EAAE,CAAC,CAAC,UAAU;wBACxB,QAAQ,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,mBAAmB,CAAC,EAAE;qBACzD,CAAC,CAAC,CAAC;oBACpC,OAAO;gBACX,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;gBAC9D,MAAM,iBAAiB,GAA0B;oBAC7C,IAAI,EAAE,cAAc;oBACpB,UAAU,EAAE,QAAQ,CAAC,UAAU;oBAC/B,QAAQ,EAAE;wBACN,EAAE,EAAE,GAAG,CAAC,EAAE;wBACV,8DAA8D;wBAC9D,6DAA6D;wBAC7D,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,EAAE;qBAC3F;iBACJ,CAAC;gBACF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBAC/C,OAAO;YACX,CAAC;YAED,oGAAoG;YACpG,yFAAyF;YACzF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACxE,MAAM,QAAQ,GAA0B;gBACpC,IAAI,EAAE,cAAc;gBACpB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,QAAQ;aACX,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE1C,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACvD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;gBACvB,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU;gBACjD,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE;aAC9E,CAAC,CAAC,CAAC;QACR,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QACvD,CAAC;IACL,CAAC;IAEL,oKAAoK;IAChK,iBAAiB,CAAC,IAAgB,EAAE,UAAmB;QACnD,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,uCAAuC;QACvC,IAAI,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;YACtE,OAAO,CAAC,0DAA0D;QACtE,CAAC;QAED,IAAI,SAAS,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC;aAAM,IAAI,SAAS,KAAK,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;IACL,CAAC;IAEL,6FAA6F;IACzF,KAAK;QACD,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YACpC,IAAI,OAAO;gBAAE,MAAM,OAAO,CAAC;QAC/B,CAAC,CAAC,CAAC;IACP,CAAC;IAEL,0EAA0E;IACtE,QAAQ;QACJ,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QACtC,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAA0B,CAAC;QAChE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;YAAE,KAAK,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACpF,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC3E,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,KAAK,CAAC,KAAK,IAAI,EAAE;YACb,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC,SAAS,CAAC,EAAE;gBAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,sBAAsB,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACvG,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAChD,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,IAAI,CAAC,OAAO,CAAC;IACxB,CAAC;IAEK,KAAK,CAAC,mBAAmB,CAAC,GAAe,EAAE,QAAuB;QACpE,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxB,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC;QACpF,CAAC;QACD,8GAA8G;QAC9G,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACvD,CAAC;gBAAS,CAAC;YACP,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvC,CAAC;IACL,CAAC;IAEK,KAAK,CAAC,iBAAiB,CAAC,GAAc,EAAE,QAAuB;QACjE,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE;YACxC,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,UAAU,EAAE,GAAG,EAAE,CAAC,EAAE;YACpB,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;YAC1C,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACpC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC;SACtD,CAAC,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa;YAC1D,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACtG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAElB,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7B,2FAA2F;YAC3F,IAAI,OAAO;gBAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACnD,OAAO,QAAQ,CAAC;QACpB,CAAC;QACD,2GAA2G;QAC3G,IAAI,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACtC,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,mBAAmB,CAAC,EAAE,CAAC;QACxF,CAAC;QAED,6EAA6E;QAC7E,mEAAmE;QACnE,MAAM,SAAS,GAAG,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,YAAY,GAAiB;YAC/B,OAAO;YACP,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;YACf,SAAS;YACT,gBAAgB,EAAE,QAAQ,CAAC,UAAU;SACxC,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YAClC,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM;gBAAE,OAAO;YACvC,MAAM,KAAK,GAAG,iBAAiB,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC7D,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,YAAY,CAAC,KAAK,GAAG,KAAK,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC3C,0EAA0E;QAC1E,OAAO,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QAElD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAEL,uGAAuG;IACzF,UAAU,CAAC,SAAiB;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAa,CAAC,UAAU,CAAC,iBAAiB,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACrG,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7H,CAAC;IACL,CAAC;IAEL,8FAA8F;IAChF,WAAW,CAAC,SAAiB,EAAE,OAAqB;QAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrI,CAAC;IAEK,YAAY,CAAC,SAAiB;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACxC,MAAM,UAAU,GAAG,iBAAiB,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAa,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7H,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrC,qFAAqF;QACrF,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3G,CAAC;CACJ"}

package/dist/transports/relay/listener/reverse-proxy.d.ts

@@ -0,0 +1,7 @@
+import { type RefId, type RpcLifecycle } from '@vibesdotdev/kernel-rpc';
+import type { RelaySocket } from '../relay-transport.impl.ts';
+export /** The owner-side stand-in for a consumer-owned ref: it serves its allowlisted methods by sending them back. */ interface ReverseProxy {
+    readonly __refId: RefId;
+}
+export declare function buildReverseProxy(id: string, kind: string, methods: readonly string[], socket: RelaySocket, consumerId: string, lifecycle: RpcLifecycle): ReverseProxy;
+//# sourceMappingURL=reverse-proxy.d.ts.map

package/dist/transports/relay/listener/reverse-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reverse-proxy.d.ts","sourceRoot":"","sources":["../../../../src/transports/relay/listener/reverse-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqD,KAAK,KAAK,EAAkB,KAAK,YAAY,EAAkB,MAAM,yBAAyB,CAAC;AAM3J,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAG9D,MAAM,CAAC,gHAAgH,WAC7G,YAAY;IAClB,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;CAC3B;AAED,wBAAgB,iBAAiB,CAC7B,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,MAAM,EAAE,WAAW,EACnB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,YAAY,GACxB,YAAY,CAkGd"}

package/dist/transports/relay/listener/reverse-proxy.js

@@ -0,0 +1,106 @@
+import { asRefId, isLifecycleDeadline, RPC_ERROR, rpcError } from '@vibesdotdev/kernel-rpc';
+import { attempt, attemptAsync, rethrow } from "../../../core/protocol/lifecycle/attempt.js";
+import { isString } from "../../../core/protocol/wire/value-kinds.js";
+import { rpcFailure, wireError } from "../../../core/protocol/wire/verbs.js";
+import { snapshotInline } from "../../../core/protocol/wire/wire-value.js";
+import { RelayJsonMessageSchema } from "../wire.js";
+export function buildReverseProxy(id, kind, methods, socket, consumerId, lifecycle) {
+    const methodSet = new Set(methods);
+    const invokeRemote = async (method, args) => {
+        // F: enforce allowlist. Empty set DENIES ALL (the old `size > 0` short-circuit
+        // was the bug — size===0 skipped the check, so no declared methods = allow all).
+        // Correct semantics: `!methodSet.has(method)` always rejects non-members.
+        if (!methodSet.has(method)) {
+            throw rpcError('RPC_METHOD_DENIED', `Method '${method}' not in allowed methods for ref '${id}'`);
+        }
+        const req = {
+            verb: 'invoke',
+            id: crypto.randomUUID(),
+            targetRef: asRefId(id),
+            method,
+            args: args.map((a) => ({ t: 'json', v: snapshotInline(a) }))
+        };
+        // §3.7: carry consumerId so broker routes response to that consumer's channel.
+        const message = { type: 'rpc_request', consumerId, request: req };
+        const reqId = req.id;
+        // One bounded wait on the owning runtime's lifecycle: its deadline, and
+        // runtime disposal, end the wait and unhook the response handler.
+        const waited = await attemptAsync(() => lifecycle.wait((signal) => new Promise((resolve, reject) => {
+            const pending = { active: true };
+            const unhook = () => {
+                pending.active = false;
+                socket.removeMessageHandler?.(handler);
+            };
+            const handler = (evt) => {
+                if (!pending.active || !isString(evt.data))
+                    return;
+                const text = evt.data;
+                const json = attempt(() => JSON.parse(text));
+                if (!json.ok) {
+                    unhook();
+                    reject(json.failure instanceof SyntaxError
+                        ? rpcFailure(RPC_ERROR.DISCONNECTED, 'Invalid relay response.', undefined, 'rpc-response-invalid')
+                        : json.failure);
+                    return;
+                }
+                const parsed = RelayJsonMessageSchema.safeParse(json.value);
+                if (!parsed.success) {
+                    unhook();
+                    reject(rpcFailure(RPC_ERROR.DISCONNECTED, 'Invalid relay response.', undefined, 'rpc-response-invalid'));
+                    return;
+                }
+                const msg = parsed.data;
+                // Both identities must match; other valid messages belong to their own calls.
+                if (msg.type !== 'rpc_response' || msg.consumerId !== consumerId || msg.response.id !== reqId)
+                    return;
+                unhook();
+                const response = msg.response;
+                if (response.error) {
+                    reject(wireError(response.error));
+                    return;
+                }
+                const result = response.result;
+                resolve(result?.t === 'json' ? result.v : result);
+            };
+            signal.addEventListener('abort', unhook, { once: true });
+            socket.addEventListener('message', handler);
+            socket.send(JSON.stringify(message));
+        }), { timeoutMs: REVERSE_INVOKE_DEADLINE_MS, reason: 'relay-reverse-invoke' }));
+        if (waited.ok)
+            return waited.value;
+        if (isLifecycleDeadline(waited.failure))
+            throw rpcError(RPC_ERROR.DISCONNECTED, 'reverse invoke timed out');
+        return rethrow(waited.failure);
+    };
+    const proxyTarget = kind === 'function'
+        ? Object.assign(function () { }, { __refId: asRefId(id) })
+        : { __refId: asRefId(id) };
+    const handler = {
+        get(_t, prop) {
+            if (prop === '__refId')
+                return asRefId(id);
+            if (!isString(prop))
+                return undefined;
+            // F: Proxy get trap enforces allowlist. Empty set DENIES ALL (removed the
+            // `size > 0` short-circuit that allowed empty-methods refs to bypass the check).
+            if (!methodSet.has(prop))
+                return undefined;
+            return (...args) => invokeRemote(prop, args);
+        },
+        has(t, prop) {
+            // `in` agrees with `get` (the runtime's invoke gate reads a member only
+            // after `prop in impl`): a key this proxy answers is present and every
+            // other key is absent, except a non-configurable own key of the target
+            // (a function ref's `prototype`), which the Proxy invariant keeps present.
+            return handler.get?.(t, prop, t) !== undefined || Object.getOwnPropertyDescriptor(t, prop)?.configurable === false;
+        },
+        apply(_t, _this, args) {
+            // F: for direct function calls, use 'call' as the synthetic method name.
+            // If 'call' is not in the allowlist, invokeRemote will reject.
+            return invokeRemote('call', args);
+        }
+    };
+    return new Proxy(proxyTarget, handler);
+}
+const REVERSE_INVOKE_DEADLINE_MS = 30_000;
+//# sourceMappingURL=reverse-proxy.js.map

package/dist/transports/relay/listener/reverse-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reverse-proxy.js","sourceRoot":"","sources":["../../../../src/transports/relay/listener/reverse-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,QAAQ,EAAiE,MAAM,yBAAyB,CAAC;AAC3J,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,6CAA6C,CAAC;AAE7F,OAAO,EAAE,QAAQ,EAAE,MAAM,4CAA4C,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAE3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAOpD,MAAM,UAAU,iBAAiB,CAC7B,EAAU,EACV,IAAY,EACZ,OAA0B,EAC1B,MAAmB,EACnB,UAAkB,EAClB,SAAuB;IAEvB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAEnC,MAAM,YAAY,GAAG,KAAK,EAAE,MAAc,EAAE,IAA0B,EAAoB,EAAE;QACxF,+EAA+E;QAC/E,iFAAiF;QACjF,0EAA0E;QAC1E,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,MAAM,QAAQ,CAAC,mBAAmB,EAAE,WAAW,MAAM,qCAAqC,EAAE,GAAG,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,GAAG,GAAc;YACnB,IAAI,EAAE,QAAQ;YACd,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;YACvB,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;YACtB,MAAM;YACN,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAa,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SAC1E,CAAC;QACF,+EAA+E;QAC/E,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAClE,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC;QACrB,wEAAwE;QACxE,kEAAkE;QAClE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAClD,CAAC,MAAM,EAAE,EAAE,CACP,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,GAAS,EAAE;gBACtB,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC;gBACvB,MAAM,CAAC,oBAAoB,EAAE,CAAC,OAAO,CAAC,CAAC;YAC3C,CAAC,CAAC;YACF,MAAM,OAAO,GAAG,CAAC,GAAgD,EAAE,EAAE;gBACjE,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,OAAO;gBACnD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;gBACtB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC7C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;oBACX,MAAM,EAAE,CAAC;oBACT,MAAM,CAAC,IAAI,CAAC,OAAO,YAAY,WAAW;wBACtC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,YAAY,EAAE,yBAAyB,EAAE,SAAS,EAAE,sBAAsB,CAAC;wBAClG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBACpB,OAAO;gBACX,CAAC;gBACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAClB,MAAM,EAAE,CAAC;oBACT,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,YAAY,EAAE,yBAAyB,EAAE,SAAS,EAAE,sBAAsB,CAAC,CAAC,CAAC;oBACzG,OAAO;gBACX,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC;gBACxB,8EAA8E;gBAC9E,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,UAAU,KAAK,UAAU,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,KAAK;oBAAE,OAAO;gBACtG,MAAM,EAAE,CAAC;gBACT,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;gBAC9B,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;oBACjB,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;oBAClC,OAAO;gBACX,CAAC;gBACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;gBAC/B,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACtD,CAAC,CAAC;YACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACzC,CAAC,CAAC,EACN,EAAE,SAAS,EAAE,0BAA0B,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAC5E,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC;QACnC,IAAI,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC;YAAE,MAAM,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,0BAA0B,CAAC,CAAC;QAC5G,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC,CAAC;IAEF,MAAM,WAAW,GACb,IAAI,KAAK,UAAU;QACf,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,cAAa,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QACzD,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IAEnC,MAAM,OAAO,GAA+B;QACxC,GAAG,CAAC,EAAE,EAAE,IAAI;YACR,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACtC,0EAA0E;YAC1E,iFAAiF;YACjF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC3C,OAAO,CAAC,GAAG,IAAiB,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9D,CAAC;QACD,GAAG,CAAC,CAAC,EAAE,IAAI;YACP,wEAAwE;YACxE,uEAAuE;YACvE,uEAAuE;YACvE,2EAA2E;YAC3E,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,wBAAwB,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,YAAY,KAAK,KAAK,CAAC;QACvH,CAAC;QACD,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI;YACjB,yEAAyE;YACzE,+DAA+D;YAC/D,OAAO,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;KACJ,CAAC;IACF,OAAO,IAAI,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,0BAA0B,GAAG,MAAM,CAAC"}

package/dist/transports/relay/relay-rpc-loader.d.ts

@@ -0,0 +1,9 @@
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import { type RuntimeRpcDescriptor } from '@vibesdotdev/kernel-rpc';
+/**
+ * Register a relay transport loader for one `runtime/rpc` descriptor.
+ */
+export declare function registerRelayRpcLoader(runtime: RuntimeRef, descriptorInput: RuntimeRpcDescriptor): void;
+/** Register one live relay identity as an exact disposable runtime asset. */
+export declare function registerDynamicRelayRpcAsset(runtime: RuntimeRef, descriptorInput: RuntimeRpcDescriptor): () => void;
+//# sourceMappingURL=relay-rpc-loader.d.ts.map

package/dist/transports/relay/relay-rpc-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-rpc-loader.d.ts","sourceRoot":"","sources":["../../../src/transports/relay/relay-rpc-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAW,KAAK,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAgB7E;;GAEG;AACH,wBAAgB,sBAAsB,CACrC,OAAO,EAAE,UAAU,EACnB,eAAe,EAAE,oBAAoB,GACnC,IAAI,CAQN;AAED,6EAA6E;AAC7E,wBAAgB,4BAA4B,CAC3C,OAAO,EAAE,UAAU,EACnB,eAAe,EAAE,oBAAoB,GACnC,MAAM,IAAI,CASZ"}

package/dist/transports/relay/relay-rpc-loader.js

@@ -0,0 +1,30 @@
+import { createRuntimeImplementation } from '@vibesdotdev/kernel';
+import { rpcKind } from '@vibesdotdev/kernel-rpc';
+import { readRpcDescriptor } from "../../core/protocol/references/descriptor-input.js";
+function createRelayRpcLoader(descriptor, runtime) {
+    return async () => {
+        // The loader defers the transport implementation until a descriptor resolves.
+        const { createRelayRpcImplementation } = await import("./relay-transport.impl.js");
+        return createRuntimeImplementation({
+            kind: 'runtime/rpc',
+            id: descriptor.id,
+            constraint: { hardware: [descriptor.remoteScope?.hardware ?? 'consumer'] },
+            implementation: createRelayRpcImplementation(descriptor, runtime)
+        });
+    };
+}
+/**
+ * Register a relay transport loader for one `runtime/rpc` descriptor.
+ */
+export function registerRelayRpcLoader(runtime, descriptorInput) {
+    const descriptor = readRpcDescriptor('registerRelayRpcLoader', descriptorInput, 'relay');
+    runtime.registerLoader('runtime/rpc', descriptor.id, createRelayRpcLoader(descriptor, runtime), { constraint: { hardware: [descriptor.remoteScope?.hardware ?? 'consumer'] } });
+}
+/** Register one live relay identity as an exact disposable runtime asset. */
+export function registerDynamicRelayRpcAsset(runtime, descriptorInput) {
+    const descriptor = readRpcDescriptor('registerDynamicRelayRpcAsset', descriptorInput, 'relay');
+    if (!runtime.hasKind(rpcKind.id))
+        runtime.registerKind(rpcKind);
+    return runtime.registerDynamicAsset(rpcKind.id, descriptor, createRelayRpcLoader(descriptor, runtime), { constraint: { hardware: [descriptor.remoteScope?.hardware ?? 'consumer'] } });
+}
+//# sourceMappingURL=relay-rpc-loader.js.map

package/dist/transports/relay/relay-rpc-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-rpc-loader.js","sourceRoot":"","sources":["../../../src/transports/relay/relay-rpc-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAmB,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,OAAO,EAA6B,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,oDAAoD,CAAC;AAEvF,SAAS,oBAAoB,CAAC,UAAgC,EAAE,OAAmB;IAClF,OAAO,KAAK,IAAI,EAAE;QACjB,8EAA8E;QAC9E,MAAM,EAAE,4BAA4B,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;QACnF,OAAO,2BAA2B,CAAC;YAClC,IAAI,EAAE,aAAa;YACnB,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,QAAQ,IAAI,UAAU,CAAC,EAAE;YAC1E,cAAc,EAAE,4BAA4B,CAAC,UAAU,EAAE,OAAO,CAAC;SACjE,CAAC,CAAC;IACJ,CAAC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACrC,OAAmB,EACnB,eAAqC;IAErC,MAAM,UAAU,GAAG,iBAAiB,CAAC,wBAAwB,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IACzF,OAAO,CAAC,cAAc,CACrB,aAAa,EACb,UAAU,CAAC,EAAE,EACb,oBAAoB,CAAC,UAAU,EAAE,OAAO,CAAC,EACzC,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,QAAQ,IAAI,UAAU,CAAC,EAAE,EAAE,CAC9E,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,4BAA4B,CAC3C,OAAmB,EACnB,eAAqC;IAErC,MAAM,UAAU,GAAG,iBAAiB,CAAC,8BAA8B,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAC/F,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAAE,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAChE,OAAO,OAAO,CAAC,oBAAoB,CAClC,OAAO,CAAC,EAAE,EACV,UAAU,EACV,oBAAoB,CAAC,UAAU,EAAE,OAAO,CAAC,EACzC,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,QAAQ,IAAI,UAAU,CAAC,EAAE,EAAE,CAC9E,CAAC;AACH,CAAC"}

package/dist/transports/relay/relay-server.d.ts

@@ -0,0 +1,58 @@
+import type { RelaySocket } from "../../schemas/contracts/transports/relay/relay-server.ts";
+export { ServeRelaySocketInput } from "../../schemas/contracts/transports/relay/relay-server.ts";
+export type { RelaySocket } from "../../schemas/contracts/transports/relay/relay-server.ts";
+/**
+ * Relay SERVER adapter (daemon side) — the canonical `serveRelaySocket` export.
+ *
+ * This is the export R3 (`fleet-daemon`) codes against via its
+ * `relay-server-adapter.seam.ts`: a `RelayServerAdapterFn`
+ *
+ *   (socket: RelaySocket, target: HttpListenTarget) => Promise<void>
+ *
+ * that runs ONE relay session until the socket closes, dispatching every inbound
+ * frame through `target.pipeline` (the L5 authz → friction gates). It resolves
+ * when the session is fully torn down (all refs released, channels closed).
+ *
+ * THE CANONICAL `RelaySocket` SHAPE (reconciled post-Wave-1):
+ *   R1's earlier internal socket used `addEventListener('message'|'close')`; R3's
+ *   seam used `onMessage` / `onBinary` / a `closed` promise. The cleaner R3 shape
+ *   is the converged-on canonical seam — this module exposes IT and bridges it to
+ *   R1's existing `RelayListenSession` internally. The bridge keeps a SINGLE
+ *   dispatch path (`RelayListenSession.handleJsonMessage` / `handleBinaryFrame`),
+ *   so the L5 pipeline still fires on every invoke — no second code path, no
+ *   ungated seam.
+ *
+ * SECURITY (fleet-relay §4):
+ *   - Connect-level auth happens BEFORE the socket reaches this adapter (the
+ *     daemon's `connectRelay` performs the Bearer host-token upgrade + 401 guard).
+ *     This adapter receives ONLY authenticated sockets.
+ *   - Every inbound invoke still runs through `target.pipeline` (rule 1). An ungated
+ *     relay daemon stays impossible: this adapter requires a `pipeline` on `target`
+ *     and there is no path that bypasses `RelayListenSession.handleRpcRequest` →
+ *     `dispatchRequest`.
+ *   - One fresh `DefaultReferenceTable` per session → per-connection ref isolation
+ *     (rule 3): two consumers multiplexed onto one daemon socket never share refs.
+ */
+import type { HttpListenTarget } from '@vibesdotdev/kernel-rpc/http';
+import type { RelayListenTarget } from './listener/relay-listen-session.ts';
+/**
+ * Serve one authenticated relay socket session (the daemon side, §3.7 canonical).
+ *
+ * Runs until `socket.closed` resolves, then tears the session down. The returned
+ * promise resolves when the session's refs + channels are fully freed, and
+ * rejects with the typed `rpc-channel-close-failed` error when a channel's
+ * binding did not close cleanly.
+ *
+ * `target` is the L5-gated listen target — structurally an {@link HttpListenTarget}
+ * (root / pipeline / classifyResult / bindChannel / kindOf), the SAME shape the
+ * http listener uses, plus the owning runtime's `lifecycle`, which bounds every
+ * reverse-leg invoke; it doubles as R1's {@link RelayListenTarget}.
+ */
+export declare function serveRelaySocket(socketInput: RelaySocket, targetInput: HttpListenTarget & Pick<RelayListenTarget, 'lifecycle'>): Promise<void>;
+/**
+ * The canonical root ref a fresh session would advertise — exposed for callers that
+ * need the rootRef without serving (rarely needed; the broker fetches it via the
+ * `__relay_handshake` synthetic invoke). Kept for parity with the seam doc.
+ */
+export type { HttpListenTarget } from '@vibesdotdev/kernel-rpc/http';
+//# sourceMappingURL=relay-server.d.ts.map

package/dist/transports/relay/relay-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-server.d.ts","sourceRoot":"","sources":["../../../src/transports/relay/relay-server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0DAA0D,CAAC;AAE5F,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AACjG,YAAY,EAAE,WAAW,EAAE,MAAM,0DAA0D,CAAC;AAC5F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAmE5E;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CACrC,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,gBAAgB,GAAG,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,GAClE,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED;;;;GAIG;AACH,YAAY,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/transports/relay/relay-server.js

@@ -0,0 +1,86 @@
+import { ServeRelaySocketInput } from "../../schemas/contracts/transports/relay/relay-server.js";
+export { ServeRelaySocketInput } from "../../schemas/contracts/transports/relay/relay-server.js";
+import { readInput } from "../../core/protocol/references/caller-input.js";
+import { createRelayServerAdapter } from "./relay-transport.impl.js";
+/**
+ * Bridge a canonical `RelaySocket` (onMessage/onBinary/closed) into R1's internal
+ * `addEventListener('message'|'close')` socket shape so the existing
+ * `createRelayServerAdapter` + `RelayListenSession` drive it unchanged.
+ *
+ * The bridge is the ONLY place the two shapes meet; everything downstream (the
+ * session, the reverse-proxy, the binary codec) sees R1's internal socket.
+ */
+function bridgeToInternalSocket(socket) {
+    const messageHandlers = [];
+    const closeHandlers = [];
+    let closedFired = false;
+    // Forward the canonical socket's inbound frames to the internal 'message' handlers.
+    socket.onMessage((data) => {
+        for (const h of messageHandlers)
+            h({ data });
+    });
+    socket.onBinary((data) => {
+        for (const h of messageHandlers)
+            h({ data });
+    });
+    function addEventListener(event, handler) {
+        if (event === 'message') {
+            // SAFETY: the overloads pair 'message' with a MessageHandler, so this handler is one.
+            messageHandlers.push(handler);
+        }
+        else {
+            // SAFETY: the overloads pair 'close' with a CloseHandler, so this handler is one.
+            closeHandlers.push(handler);
+        }
+    }
+    const internal = {
+        send: (data) => socket.send(data),
+        sendBinary: (data) => socket.sendBinary(data),
+        addEventListener,
+        close: (code, reason) => {
+            socket.close();
+            // Fire the internal close handlers so the session tears down even when the
+            // local side initiates the close.
+            fireClose(code, reason);
+        }
+    };
+    function fireClose(code, reason) {
+        if (closedFired)
+            return;
+        closedFired = true;
+        for (const h of closeHandlers)
+            h({ code, reason });
+    }
+    return { internal, fireClose: () => fireClose() };
+}
+/**
+ * Serve one authenticated relay socket session (the daemon side, §3.7 canonical).
+ *
+ * Runs until `socket.closed` resolves, then tears the session down. The returned
+ * promise resolves when the session's refs + channels are fully freed, and
+ * rejects with the typed `rpc-channel-close-failed` error when a channel's
+ * binding did not close cleanly.
+ *
+ * `target` is the L5-gated listen target — structurally an {@link HttpListenTarget}
+ * (root / pipeline / classifyResult / bindChannel / kindOf), the SAME shape the
+ * http listener uses, plus the owning runtime's `lifecycle`, which bounds every
+ * reverse-leg invoke; it doubles as R1's {@link RelayListenTarget}.
+ */
+export async function serveRelaySocket(socketInput, targetInput) {
+    const { socket, target } = readInput('serveRelaySocket', ServeRelaySocketInput, { socket: socketInput, target: targetInput });
+    const { internal, fireClose } = bridgeToInternalSocket(socket);
+    // Build R1's adapter over the bridged socket. The adapter wires the internal
+    // 'message'/'close' events to the RelayListenSession (single dispatch path).
+    const adapter = createRelayServerAdapter({ ...target, socket: internal });
+    try {
+        // The session lives until the underlying socket closes.
+        await socket.closed;
+    }
+    finally {
+        // Drive the internal close handlers (tears down the session: refs + channels),
+        // then close the adapter explicitly (idempotent — it reports the same outcome).
+        fireClose();
+        await adapter.close();
+    }
+}
+//# sourceMappingURL=relay-server.js.map

package/dist/transports/relay/relay-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-server.js","sourceRoot":"","sources":["../../../src/transports/relay/relay-server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AACjG,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AAoCjG,OAAO,EAAE,SAAS,EAAE,MAAM,gDAAgD,CAAC;AAE3E,OAAO,EAAE,wBAAwB,EAA2C,MAAM,2BAA2B,CAAC;AAU9G;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAAC,MAAmB;IAGlD,MAAM,eAAe,GAAqB,EAAE,CAAC;IAC7C,MAAM,aAAa,GAAmB,EAAE,CAAC;IACzC,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,oFAAoF;IACpF,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE;QACzB,KAAK,MAAM,CAAC,IAAI,eAAe;YAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE;QACxB,KAAK,MAAM,CAAC,IAAI,eAAe;YAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAIH,SAAS,gBAAgB,CAAC,KAA0B,EAAE,OAAsC;QAC3F,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,sFAAsF;YACtF,eAAe,CAAC,IAAI,CAAC,OAAyB,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACP,kFAAkF;YAClF,aAAa,CAAC,IAAI,CAAC,OAAuB,CAAC,CAAC;QAC7C,CAAC;IACF,CAAC;IAED,MAAM,QAAQ,GAAwB;QACrC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QACjC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;QAC7C,gBAAgB;QAChB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACvB,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,2EAA2E;YAC3E,kCAAkC;YAClC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzB,CAAC;KACD,CAAC;IAEF,SAAS,SAAS,CAAC,IAAa,EAAE,MAAe;QAChD,IAAI,WAAW;YAAE,OAAO;QACxB,WAAW,GAAG,IAAI,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,aAAa;YAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,WAAwB,EACxB,WAAoE;IAEpE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,kBAAkB,EAAE,qBAAqB,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAC9H,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAE/D,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,OAAO,GAAG,wBAAwB,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAE1E,IAAI,CAAC;QACJ,wDAAwD;QACxD,MAAM,MAAM,CAAC,MAAM,CAAC;IACrB,CAAC;YAAS,CAAC;QACV,+EAA+E;QAC/E,gFAAgF;QAChF,SAAS,EAAE,CAAC;QACZ,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACF,CAAC"}

package/dist/transports/relay/relay-transport.impl.d.ts

@@ -0,0 +1,35 @@
+import type { RpcConnection, RuntimeRpcDescriptor, RuntimeRpcImplementation } from '@vibesdotdev/kernel-rpc';
+import { type RpcCredentialRuntime } from '@vibesdotdev/kernel-rpc/http';
+import type { RelayLifecycle } from '../../schemas/contracts/transports/relay/relay-connection.ts';
+import type { ConnectRelayOptions } from "../../schemas/contracts/transports/relay/relay-transport.impl.ts";
+export { createRelayServerAdapter } from "./listener/relay-adapter.ts";
+export { ConnectRelayInput, RelayListenTargetInput, RelayServerAdapterInput } from "../../schemas/contracts/transports/relay/relay-transport.impl.ts";
+export type { ConnectRelayOptions, RelayServerAdapter, RelayServerAdapterOptions, RelaySocket } from "../../schemas/contracts/transports/relay/relay-transport.impl.ts";
+/** `connectRelay` input, read once (protocol/caller-input.ts). */
+/** Every field of {@link RelayServerAdapterOptions}, read once by `createRelayServerAdapter`. */
+/**
+ * Open a relay connection to a daemon through the broker.
+ *
+ * 1. POST /api/relay/rpc?hostId=<id>  with a synthetic `__relay_connect` invoke
+ *    to fetch the root ref from the broker (the broker must support this sentinel).
+ *    If the broker returns 503, there is no daemon socket → `RPC_DISCONNECTED`.
+ * 2. Return an `RpcConnection` backed by `RelayConnection`.
+ *
+ * The handshake is one attempt of the connect state machine: bounded by
+ * `timeoutMs` on the runtime's lifecycle (`RPC_DISCONNECTED` on its deadline)
+ * and cancelled by `signal` or runtime disposal.
+ */
+export declare function connectRelay(brokerOriginInput: string, hostIdInput: string, optionsInput: ConnectRelayOptions): Promise<RpcConnection>;
+/**
+ * Build a `runtime/rpc` impl (a transport) for a relay descriptor. The
+ * descriptor's `auth` `CredentialReference` is resolved to a bearer at connect
+ * time through the owning runtime's `resolveCredential` — never a bare token
+ * (D-RC05). The same runtime's lifecycle bounds the handshake.
+ */
+export declare function createRelayRpcImplementation(descriptorInput: RuntimeRpcDescriptor, runtime: RpcCredentialRuntime & {
+    readonly lifecycle: RelayLifecycle;
+}): RuntimeRpcImplementation;
+/** The reason a relay adapter's close reports inbound messages it failed to handle. */
+export declare const RELAY_MESSAGE_FAILED = "rpc-relay-message-failed";
+export type { RelayListenTarget } from './listener/relay-listen-session.ts';
+//# sourceMappingURL=relay-transport.impl.d.ts.map

package/dist/transports/relay/relay-transport.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-transport.impl.d.ts","sourceRoot":"","sources":["../../../src/transports/relay/relay-transport.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAyB,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAEpI,OAAO,EAA0B,KAAK,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAOjG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8DAA8D,CAAC;AACnG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AAO5G,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,kEAAkE,CAAC;AAEtJ,YAAY,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,WAAW,EAAE,MAAM,kEAAkE,CAAC;AAExK,kEAAkE;AAElE,iGAAiG;AAMjG;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CACjC,iBAAiB,EAAE,MAAM,EACzB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,mBAAmB,GAC/B,OAAO,CAAC,aAAa,CAAC,CAiHxB;AAMD;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC3C,eAAe,EAAE,oBAAoB,EACrC,OAAO,EAAE,oBAAoB,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAA;CAAE,GACpE,wBAAwB,CAgB1B;AAED,uFAAuF;AACvF,eAAO,MAAM,oBAAoB,6BAA6B,CAAC;AAE/D,YAAY,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC"}