@vibesdotdev/kernel-rpc 0.0.0-stage → 1.0.0-rc.3

package/dist/core/protocol/transport/local-attestation.js

@@ -0,0 +1,109 @@
+export { constantTimeEqual, LOCAL_ATTESTATION_SECRET_PATTERN, LocalAttestationToken, revealLocalAttestation } from '@vibesdotdev/kernel/credentials';
+export { SocketAttestationEnvelopeSchema } from "../../../schemas/contracts/protocol/local-attestation.js";
+/**
+ * Local attestation (RC08): the one way a same-user local peer proves it was
+ * launched by the host that owns a runtime daemon, so the identity that launch
+ * established is admitted instead of refused.
+ *
+ * The trust boundary is the OS user. A daemon writes a fresh random secret to a
+ * 0600 claim file each time it starts (`@vibesdotdev/secrets/attestation`); only a
+ * process running as that user can read it. A client presents the secret in
+ * its transport handshake together with its declared launch identity, and a
+ * listen session that verifies the secret sets
+ * `remotePeer.verified = { source: 'local-attested', caller }`. Without a
+ * verified secret it sets nothing, and the kernel refuses every declared
+ * identity field (`caller-identity-unverified`).
+ *
+ * This module is universal: the verifier contract and the handshake record,
+ * with the kernel's token and constant-time compare re-exported (not
+ * redefined). The claim file is the secrets package's, on the runtime's
+ * filesystem adapter.
+ *
+ * The secret never appears in a log, an error, argv or env: the token redacts
+ * itself from every string, JSON and inspect form, and failures name only the
+ * claim path.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { revealLocalAttestation } from '@vibesdotdev/kernel/credentials';
+import { WireInvokeCallerSchema } from '@vibesdotdev/kernel/schemas';
+import { attempt } from "../lifecycle/attempt.js";
+import { RpcDeclaredCallerSchema } from "../wire/schemas.js";
+/** The `VerifiedTransportIdentity.source` a verified local attestation sets. */
+export const LOCAL_ATTESTED_SOURCE = 'local-attested';
+/**
+ * The identity a listen session admits for a presented attestation: the
+ * declared launch identity when the secret verifies, `undefined` otherwise
+ * (no verifier, no secret, a wrong or rotated secret).
+ */
+export function attestedIdentity(verifier, presented, declaredCaller) {
+    if (!verifier || !verifier.verify(presented))
+        return undefined;
+    const caller = WireInvokeCallerSchema.parse(declaredCaller);
+    return { source: LOCAL_ATTESTED_SOURCE, caller: caller ?? {} };
+}
+/** Build the socket handshake's attestation record. */
+export function socketAttestationRecord(presentation) {
+    return {
+        id: 'attest',
+        attest: { secret: revealLocalAttestation(presentation.token), caller: presentation.caller }
+    };
+}
+/** Whether a decoded socket message is the attestation envelope (the codec already parsed it whole). */
+export function isSocketAttestationRecord(message) {
+    return 'attest' in message;
+}
+/** The HTTP handshake header carrying the declared launch identity (base64url JSON). */
+export const LOCAL_ATTESTATION_CALLER_HEADER = 'x-rpc-attested-caller';
+/** Encode a declared caller for {@link LOCAL_ATTESTATION_CALLER_HEADER}. */
+export function encodeAttestedCaller(caller) {
+    const bytes = new TextEncoder().encode(JSON.stringify(caller));
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/** The reason a malformed attested-caller header is refused. */
+export const ATTESTED_CALLER_INVALID = 'rpc-attested-caller-invalid';
+/**
+ * Decode {@link LOCAL_ATTESTATION_CALLER_HEADER}. An absent header declares no
+ * identity (`undefined`). A present one that is not base64url JSON naming a
+ * caller fails closed: `INVALID_INPUT` `rpc-attested-caller-invalid`, so an
+ * attested connection is never admitted with an identity it did not state.
+ */
+export function decodeAttestedCaller(header) {
+    if (header === null)
+        return undefined;
+    const decoded = attempt(() => {
+        const binary = atob(header.replace(/-/g, '+').replace(/_/g, '/'));
+        return JSON.parse(new TextDecoder().decode(Uint8Array.from(binary, (char) => char.charCodeAt(0))));
+    });
+    if (!decoded.ok)
+        throw attestedCallerInvalid(decoded.failure);
+    const declared = RpcDeclaredCallerSchema.safeParse(decoded.value);
+    if (!declared.success)
+        throw attestedCallerInvalid();
+    return validateAttestedCaller(declared.data);
+}
+/**
+ * The declared launch identity of an attested handshake, validated. A plain
+ * object whose fields parse (an empty one declares nothing) is admitted; any
+ * other shape fails closed: `INVALID_INPUT` `rpc-attested-caller-invalid`
+ * (a caller that is not such an object never reaches here: parse it with
+ * `RpcDeclaredCallerSchema` and refuse with {@link attestedCallerInvalid}).
+ */
+export function validateAttestedCaller(declared, carrier = 'http-header') {
+    if (Object.keys(declared).length === 0)
+        return {};
+    const caller = WireInvokeCallerSchema.parse(declared);
+    if (!caller)
+        throw attestedCallerInvalid(undefined, carrier);
+    return caller;
+}
+/** The typed refusal of a declared launch identity that is not a plain object of caller fields, naming where it arrived. */
+export function attestedCallerInvalid(cause, carrier = 'http-header') {
+    const message = carrier === 'http-header'
+        ? `The ${LOCAL_ATTESTATION_CALLER_HEADER} header is not a base64url JSON caller.`
+        : 'The socket attestation record does not declare a valid caller.';
+    return new CapabilityError(message, 'INVALID_INPUT', { reason: ATTESTED_CALLER_INVALID, retryable: false, cause });
+}
+//# sourceMappingURL=local-attestation.js.map

package/dist/core/protocol/transport/local-attestation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-attestation.js","sourceRoot":"","sources":["../../../../src/core/protocol/transport/local-attestation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,gCAAgC,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACrJ,OAAO,EAAE,+BAA+B,EAAE,MAAM,0DAA0D,CAAC;AAE3G;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,eAAe,EAAsB,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAA4D,MAAM,6BAA6B,CAAC;AAC/H,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAA0B,MAAM,oBAAoB,CAAC;AAGrF,gFAAgF;AAChF,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAEtD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC/B,QAA8C,EAC9C,SAA6B,EAC7B,cAA6C;IAE7C,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC5D,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;AAChE,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,uBAAuB,CAAC,YAA0C;IACjF,OAAO;QACN,EAAE,EAAE,QAAQ;QACZ,MAAM,EAAE,EAAE,MAAM,EAAE,sBAAsB,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE;KAC3F,CAAC;AACH,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,yBAAyB,CACxC,OAA6D;IAE7D,OAAO,QAAQ,IAAI,OAAO,CAAC;AAC5B,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,MAAM,+BAA+B,GAAG,uBAAuB,CAAC;AAEvE,4EAA4E;AAC5E,MAAM,UAAU,oBAAoB,CAAC,MAA2B;IAC/D,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,uBAAuB,GAAG,6BAA6B,CAAC;AAErE;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAqB;IACzD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,uBAAuB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAClE,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,MAAM,qBAAqB,EAAE,CAAC;IACrD,OAAO,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAA2B,EAAE,UAAiC,aAAa;IACjH,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM;QAAE,MAAM,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC;AACf,CAAC;AAED,4HAA4H;AAC5H,MAAM,UAAU,qBAAqB,CAAC,KAAqB,EAAE,UAAiC,aAAa;IAC1G,MAAM,OAAO,GAAG,OAAO,KAAK,aAAa;QACxC,CAAC,CAAC,OAAO,+BAA+B,yCAAyC;QACjF,CAAC,CAAC,gEAAgE,CAAC;IACpE,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AACpH,CAAC"}

package/dist/core/protocol/transport/projection-close.d.ts

@@ -0,0 +1,12 @@
+/** One retained teardown outcome for a projection, including partial setup. */
+import { CapabilityError, type RuntimeRef } from '@vibesdotdev/kernel';
+import type { FederatedRuntimeRef } from '@vibesdotdev/kernel/federation';
+import type { RpcConnection } from '../../kinds/rpc.kind.ts';
+interface ProjectionRelease {
+    releaseRoot(): void;
+    settleReleases(): Promise<CapabilityError | null>;
+}
+/** Publish custody before callbacks; attempt every cleanup leg even if another refuses. */
+export declare function projectionCloser(runtime: RuntimeRef, mounted: () => FederatedRuntimeRef | undefined, connection: RpcConnection, consumer: ProjectionRelease): () => Promise<CapabilityError | null>;
+export {};
+//# sourceMappingURL=projection-close.d.ts.map

package/dist/core/protocol/transport/projection-close.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projection-close.d.ts","sourceRoot":"","sources":["../../../../src/core/protocol/transport/projection-close.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAE/E,OAAO,EAAE,eAAe,EAAyC,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC9G,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAI7D,UAAU,iBAAiB;IAC1B,WAAW,IAAI,IAAI,CAAC;IACpB,cAAc,IAAI,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;CAClD;AAQD,2FAA2F;AAC3F,wBAAgB,gBAAgB,CAC/B,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,MAAM,mBAAmB,GAAG,SAAS,EAC9C,UAAU,EAAE,aAAa,EACzB,QAAQ,EAAE,iBAAiB,GACzB,MAAM,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CA8BvC"}

package/dist/core/protocol/transport/projection-close.js

@@ -0,0 +1,47 @@
+/** One retained teardown outcome for a projection, including partial setup. */
+import { CapabilityError, isCapabilityError } from '@vibesdotdev/kernel';
+import { attempt, settled } from "../lifecycle/attempt.js";
+import { connectionCloseFailure } from "../lifecycle/binding-close.js";
+function projectionCloseFailure(cause) {
+    return new CapabilityError('The runtime projection did not close cleanly.', 'UNAVAILABLE', {
+        reason: 'rpc-projection-close-failed', retryable: false, cause
+    });
+}
+/** Publish custody before callbacks; attempt every cleanup leg even if another refuses. */
+export function projectionCloser(runtime, mounted, connection, consumer) {
+    let closing;
+    return () => {
+        if (closing)
+            return closing;
+        const completion = Promise.withResolvers();
+        closing = completion.promise;
+        const failures = [];
+        const ref = mounted();
+        // The kernel retracts federation before finalization and leaves lifecycle readable.
+        const unmounted = attempt(() => {
+            if (ref && !runtime.lifecycle.signal.aborted)
+                runtime.unmountRuntime(ref);
+        });
+        if (!unmounted.ok)
+            failures.push(projectionCloseFailure(unmounted.failure));
+        const rootReleased = attempt(() => consumer.releaseRoot());
+        if (!rootReleased.ok)
+            failures.push(projectionCloseFailure(rootReleased.failure));
+        const native = settled(Promise.resolve().then(() => connection.close()));
+        const releases = settled(Promise.resolve().then(() => consumer.settleReleases()));
+        void Promise.all([native, releases]).then(([closed, released]) => {
+            if (!closed.ok) {
+                failures.push(isCapabilityError(closed.failure)
+                    ? closed.failure : connectionCloseFailure(connection.rootRef, closed.failure));
+            }
+            if (!released.ok)
+                failures.push(projectionCloseFailure(released.failure));
+            else if (released.value)
+                failures.push(released.value);
+            completion.resolve(failures.length === 0 ? null : failures.length === 1 ? failures[0]
+                : projectionCloseFailure(new AggregateError(failures, 'Projection cleanup failed.')));
+        });
+        return closing;
+    };
+}
+//# sourceMappingURL=projection-close.js.map

package/dist/core/protocol/transport/projection-close.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projection-close.js","sourceRoot":"","sources":["../../../../src/core/protocol/transport/projection-close.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAE/E,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAuC,MAAM,qBAAqB,CAAC;AAG9G,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAOvE,SAAS,sBAAsB,CAAC,KAAoB;IACnD,OAAO,IAAI,eAAe,CAAC,+CAA+C,EAAE,aAAa,EAAE;QAC1F,MAAM,EAAE,6BAA6B,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK;KAC9D,CAAC,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,gBAAgB,CAC/B,OAAmB,EACnB,OAA8C,EAC9C,UAAyB,EACzB,QAA2B;IAE3B,IAAI,OAAoD,CAAC;IACzD,OAAO,GAAG,EAAE;QACX,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,EAA0B,CAAC;QACnE,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAC7B,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,oFAAoF;QACpF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE;YAC9B,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5E,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,YAAY,CAAC,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QAElF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;QAClF,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE;YAChE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBAChB,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC;oBAC9C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YACjF,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,QAAQ,CAAC,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;iBACrE,IAAI,QAAQ,CAAC,KAAK;gBAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACvD,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE;gBACrF,CAAC,CAAC,sBAAsB,CAAC,IAAI,cAAc,CAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAC,CAAC,CAAC;QACxF,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IAChB,CAAC,CAAC;AACH,CAAC"}

package/dist/core/protocol/transport/socket-connect-failure.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The one typing of a failed socket connect, shared by the unix and tcp transports (class checklist 2): an absent
+ * socket or a refused connection is `UNAVAILABLE` `socket-unreachable` (the one outcome a caller may treat as "no
+ * runtime there"); a timed-out connect is `TIMEOUT` `socket-connect-timeout`; a permission refusal is
+ * `PERMISSION_DENIED` `socket-permission-denied`; anything else keeps its message and cause under `INTERNAL`
+ * `socket-connect-failed`. An error that is already typed passes through. The socket error never escapes raw.
+ */
+import { CapabilityError, type CapabilityErrorDetails, type CaughtFailure } from '@vibesdotdev/kernel';
+/** Type a failed connect to `endpoint` (a path, or `host:port`), naming it in `details`. */
+export declare function connectFailure(endpoint: string, endpointDetails: CapabilityErrorDetails, error: CaughtFailure, timedOut: boolean): CapabilityError;
+/** The connect did not finish within its budget: `TIMEOUT` `socket-connect-timeout`. */
+export declare function connectTimeout(message: string, details: CapabilityErrorDetails, cause: CaughtFailure): CapabilityError;
+//# sourceMappingURL=socket-connect-failure.d.ts.map

package/dist/core/protocol/transport/socket-connect-failure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"socket-connect-failure.d.ts","sourceRoot":"","sources":["../../../../src/core/protocol/transport/socket-connect-failure.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,eAAe,EAAqB,KAAK,sBAAsB,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAM1H,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,sBAAsB,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,GAAG,eAAe,CAsBlJ;AAED,wFAAwF;AACxF,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,aAAa,GAAG,eAAe,CAEtH"}

package/dist/core/protocol/transport/socket-connect-failure.js

@@ -0,0 +1,42 @@
+/**
+ * The one typing of a failed socket connect, shared by the unix and tcp transports (class checklist 2): an absent
+ * socket or a refused connection is `UNAVAILABLE` `socket-unreachable` (the one outcome a caller may treat as "no
+ * runtime there"); a timed-out connect is `TIMEOUT` `socket-connect-timeout`; a permission refusal is
+ * `PERMISSION_DENIED` `socket-permission-denied`; anything else keeps its message and cause under `INTERNAL`
+ * `socket-connect-failed`. An error that is already typed passes through. The socket error never escapes raw.
+ */
+import { CapabilityError, isCapabilityError } from '@vibesdotdev/kernel';
+import { failureMessage, thrownCode } from "../wire/verbs.js";
+/** The errno codes that mean no runtime is listening at the endpoint. */
+const UNREACHABLE_CODES = new Set(['ENOENT', 'ECONNREFUSED']);
+/** Type a failed connect to `endpoint` (a path, or `host:port`), naming it in `details`. */
+export function connectFailure(endpoint, endpointDetails, error, timedOut) {
+    if (isCapabilityError(error))
+        return error;
+    const errno = thrownCode(error);
+    const message = failureMessage(error);
+    const details = errno === undefined ? { ...endpointDetails } : { ...endpointDetails, errno };
+    if (errno !== undefined && UNREACHABLE_CODES.has(errno)) {
+        return new CapabilityError(`No runtime is listening at ${endpoint} (${errno}).`, 'UNAVAILABLE', {
+            reason: 'socket-unreachable',
+            retryable: true,
+            details,
+            cause: error
+        });
+    }
+    if (errno === 'EACCES' || errno === 'EPERM') {
+        return new CapabilityError(`Connecting to ${endpoint} was refused by permissions: ${message}`, 'PERMISSION_DENIED', {
+            reason: 'socket-permission-denied',
+            details,
+            cause: error
+        });
+    }
+    if (timedOut)
+        return connectTimeout(message, details, error);
+    return new CapabilityError(message, 'INTERNAL', { reason: 'socket-connect-failed', details, cause: error });
+}
+/** The connect did not finish within its budget: `TIMEOUT` `socket-connect-timeout`. */
+export function connectTimeout(message, details, cause) {
+    return new CapabilityError(message, 'TIMEOUT', { reason: 'socket-connect-timeout', retryable: true, details, cause });
+}
+//# sourceMappingURL=socket-connect-failure.js.map

package/dist/core/protocol/transport/socket-connect-failure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"socket-connect-failure.js","sourceRoot":"","sources":["../../../../src/core/protocol/transport/socket-connect-failure.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAmD,MAAM,qBAAqB,CAAC;AAC1H,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9D,yEAAyE;AACzE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;AAE9D,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,eAAuC,EAAE,KAAoB,EAAE,QAAiB;IAChI,IAAI,iBAAiB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,OAAO,GAA2B,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,eAAe,EAAE,KAAK,EAAE,CAAC;IACrH,IAAI,KAAK,KAAK,SAAS,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO,IAAI,eAAe,CAAC,8BAA8B,QAAQ,KAAK,KAAK,IAAI,EAAE,aAAa,EAAE;YAC/F,MAAM,EAAE,oBAAoB;YAC5B,SAAS,EAAE,IAAI;YACf,OAAO;YACP,KAAK,EAAE,KAAK;SACZ,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QAC7C,OAAO,IAAI,eAAe,CAAC,iBAAiB,QAAQ,gCAAgC,OAAO,EAAE,EAAE,mBAAmB,EAAE;YACnH,MAAM,EAAE,0BAA0B;YAClC,OAAO;YACP,KAAK,EAAE,KAAK;SACZ,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ;QAAE,OAAO,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7D,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAC7G,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,OAA+B,EAAE,KAAoB;IACpG,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AACvH,CAAC"}

package/dist/core/protocol/transport/sse.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The one SSE reader the HTTP and relay consumers share (a stream channel's owner→consumer bytes, the relay's
+ * reverse-invoke channel), and the bounds on what a peer can make it buffer. A record (the text up to a blank line)
+ * longer than {@link SSE_MAX_RECORD_CHARS} is refused `INVALID_INPUT` `rpc-sse-record-too-large` and the body is
+ * cancelled, so a peer that never sends a separator cannot grow the buffer without bound. A read error is returned
+ * as the attempt's failure for the caller to describe and keep; an abort the caller asked for is not a failure.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { type Attempt } from '../lifecycle/attempt.ts';
+/** The longest SSE record kept: one base64-framed message at the message ceiling, plus the event lines. */
+export declare const SSE_MAX_RECORD_CHARS: number;
+/** The reason an SSE record over {@link SSE_MAX_RECORD_CHARS} is refused with. */
+export declare const SSE_RECORD_TOO_LARGE = "rpc-sse-record-too-large";
+/**
+ * How many frames, and bytes, a consumer channel buffers before its first subscriber attaches. A channel past either
+ * ends disconnected with `INVALID_INPUT` `rpc-channel-buffer-full` as its cause: the peer cannot make this end hold
+ * an unbounded backlog for a subscriber that never comes.
+ */
+export declare const CHANNEL_PENDING_MAX_FRAMES = 1024;
+export declare const CHANNEL_PENDING_MAX_BYTES: number;
+export declare const CHANNEL_BUFFER_FULL = "rpc-channel-buffer-full";
+/** The typed failure a channel whose pre-attach buffer is full ends with. */
+export declare function channelBufferFull(channelId: string): CapabilityError;
+/** Read `body` to its end, handing each record (without its blank-line separator) to `onRecord`. Never rejects. */
+export declare function readSseRecords(body: ReadableStream<Uint8Array>, onRecord: (record: string) => void, signal?: AbortSignal): Promise<Attempt<void>>;
+//# sourceMappingURL=sse.d.ts.map

package/dist/core/protocol/transport/sse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.d.ts","sourceRoot":"","sources":["../../../../src/core/protocol/transport/sse.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAgB,KAAK,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAGrE,2GAA2G;AAC3G,eAAO,MAAM,oBAAoB,QAAwD,CAAC;AAE1F,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,6BAA6B,CAAC;AAE/D;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAC/C,eAAO,MAAM,yBAAyB,QAAwB,CAAC;AAC/D,eAAO,MAAM,mBAAmB,4BAA4B,CAAC;AAE7D,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,CAMpE;AAUD,mHAAmH;AACnH,wBAAsB,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAyCvJ"}

package/dist/core/protocol/transport/sse.js

@@ -0,0 +1,89 @@
+/**
+ * The one SSE reader the HTTP and relay consumers share (a stream channel's owner→consumer bytes, the relay's
+ * reverse-invoke channel), and the bounds on what a peer can make it buffer. A record (the text up to a blank line)
+ * longer than {@link SSE_MAX_RECORD_CHARS} is refused `INVALID_INPUT` `rpc-sse-record-too-large` and the body is
+ * cancelled, so a peer that never sends a separator cannot grow the buffer without bound. A read error is returned
+ * as the attempt's failure for the caller to describe and keep; an abort the caller asked for is not a failure.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { attemptAsync } from "../lifecycle/attempt.js";
+import { RPC_MAX_MESSAGE_BYTES } from "../wire/limits.js";
+/** The longest SSE record kept: one base64-framed message at the message ceiling, plus the event lines. */
+export const SSE_MAX_RECORD_CHARS = Math.ceil((RPC_MAX_MESSAGE_BYTES + 1) / 3) * 4 + 1024;
+/** The reason an SSE record over {@link SSE_MAX_RECORD_CHARS} is refused with. */
+export const SSE_RECORD_TOO_LARGE = 'rpc-sse-record-too-large';
+/**
+ * How many frames, and bytes, a consumer channel buffers before its first subscriber attaches. A channel past either
+ * ends disconnected with `INVALID_INPUT` `rpc-channel-buffer-full` as its cause: the peer cannot make this end hold
+ * an unbounded backlog for a subscriber that never comes.
+ */
+export const CHANNEL_PENDING_MAX_FRAMES = 1024;
+export const CHANNEL_PENDING_MAX_BYTES = RPC_MAX_MESSAGE_BYTES;
+export const CHANNEL_BUFFER_FULL = 'rpc-channel-buffer-full';
+/** The typed failure a channel whose pre-attach buffer is full ends with. */
+export function channelBufferFull(channelId) {
+    return new CapabilityError(`Stream channel '${channelId}' buffered more than it may before a subscriber attached.`, 'INVALID_INPUT', {
+        reason: CHANNEL_BUFFER_FULL,
+        retryable: false,
+        details: { channelId, maxFrames: CHANNEL_PENDING_MAX_FRAMES, maxBytes: CHANNEL_PENDING_MAX_BYTES }
+    });
+}
+function recordTooLarge() {
+    return new CapabilityError('An SSE record exceeded the size this end keeps.', 'INVALID_INPUT', {
+        reason: SSE_RECORD_TOO_LARGE,
+        retryable: false,
+        details: { limit: SSE_MAX_RECORD_CHARS }
+    });
+}
+/** Read `body` to its end, handing each record (without its blank-line separator) to `onRecord`. Never rejects. */
+export async function readSseRecords(body, onRecord, signal) {
+    const reader = body.getReader();
+    const decoder = new TextDecoder();
+    let cancellation;
+    const cancel = () => { cancellation ??= attemptAsync(() => reader.cancel()); };
+    if (signal?.aborted)
+        cancel();
+    else
+        signal?.addEventListener('abort', cancel, { once: true });
+    let buffer = '';
+    const read = await attemptAsync(async () => {
+        for (;;) {
+            if (signal?.aborted)
+                break;
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            buffer += decoder.decode(value, { stream: true });
+            let sep;
+            while ((sep = buffer.indexOf('\n\n')) !== -1) {
+                const record = buffer.slice(0, sep);
+                buffer = buffer.slice(sep + 2);
+                onRecord(record);
+                if (signal?.aborted)
+                    break;
+            }
+            if (buffer.length > SSE_MAX_RECORD_CHARS)
+                throw recordTooLarge();
+        }
+    });
+    // A refused or failed read stops the body; the cancel's own outcome adds nothing to the failure already kept.
+    if (!read.ok)
+        cancel();
+    signal?.removeEventListener('abort', cancel);
+    const cancelled = cancellation ? await cancellation : undefined;
+    reader.releaseLock();
+    if (!signal?.aborted)
+        return read;
+    // An abort the caller asked for is not a failure; only a cancel that failed for another cause is.
+    const closedByAbort = cancelled === undefined || cancelled.ok || cancelled.failure === signal.reason
+        || (cancelled.failure instanceof DOMException && cancelled.failure.name === 'AbortError');
+    if (closedByAbort)
+        return { ok: true, value: undefined };
+    return {
+        ok: false,
+        failure: new CapabilityError('The SSE reader did not close cleanly.', 'UNAVAILABLE', {
+            reason: 'rpc-sse-close-failed', cause: cancelled.failure, retryable: false
+        })
+    };
+}
+//# sourceMappingURL=sse.js.map

package/dist/core/protocol/transport/sse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.js","sourceRoot":"","sources":["../../../../src/core/protocol/transport/sse.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAgB,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,2GAA2G;AAC3G,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,qBAAqB,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;AAE1F,kFAAkF;AAClF,MAAM,CAAC,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AAE/D;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAC/C,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC;AAC/D,MAAM,CAAC,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AAE7D,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IAClD,OAAO,IAAI,eAAe,CAAC,mBAAmB,SAAS,2DAA2D,EAAE,eAAe,EAAE;QACpI,MAAM,EAAE,mBAAmB;QAC3B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,0BAA0B,EAAE,QAAQ,EAAE,yBAAyB,EAAE;KAClG,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc;IACtB,OAAO,IAAI,eAAe,CAAC,iDAAiD,EAAE,eAAe,EAAE;QAC9F,MAAM,EAAE,oBAAoB;QAC5B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE;KACxC,CAAC,CAAC;AACJ,CAAC;AAED,mHAAmH;AACnH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAgC,EAAE,QAAkC,EAAE,MAAoB;IAC9H,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,YAAgD,CAAC;IACrD,MAAM,MAAM,GAAG,GAAG,EAAE,GAAG,YAAY,KAAK,YAAY,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,EAAE,CAAC;;QACzB,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,IAAI,EAAE;QAC1C,SAAS,CAAC;YACT,IAAI,MAAM,EAAE,OAAO;gBAAE,MAAM;YAC3B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,IAAI,GAAW,CAAC;YAChB,OAAO,CAAC,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACpC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;gBAC/B,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACjB,IAAI,MAAM,EAAE,OAAO;oBAAE,MAAM;YAC5B,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,GAAG,oBAAoB;gBAAE,MAAM,cAAc,EAAE,CAAC;QAClE,CAAC;IACF,CAAC,CAAC,CAAC;IACH,8GAA8G;IAC9G,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,MAAM,CAAC,WAAW,EAAE,CAAC;IACrB,IAAI,CAAC,MAAM,EAAE,OAAO;QAAE,OAAO,IAAI,CAAC;IAElC,kGAAkG;IAClG,MAAM,aAAa,GAAG,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,EAAE,IAAI,SAAS,CAAC,OAAO,KAAK,MAAM,CAAC,MAAM;WAChG,CAAC,SAAS,CAAC,OAAO,YAAY,YAAY,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;IAC3F,IAAI,aAAa;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACzD,OAAO;QACN,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,IAAI,eAAe,CAAC,uCAAuC,EAAE,aAAa,EAAE;YACpF,MAAM,EAAE,sBAAsB,EAAE,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK;SAC1E,CAAC;KACF,CAAC;AACH,CAAC"}

package/dist/core/protocol/wire/frame.d.ts

@@ -0,0 +1,34 @@
+import type { Frame, FrameCapabilities, StreamEnding } from "../../../schemas/contracts/protocol/wire/frame.ts";
+export { FailureEndingSchema, StreamEndingSchema } from "../../../schemas/contracts/protocol/wire/frame.ts";
+export type { Frame, FrameCapabilities, FrameType, StreamEnding } from "../../../schemas/contracts/protocol/wire/frame.ts";
+/** Frame type tags. */
+export declare const FRAME: {
+    readonly DATA: 0;
+    readonly CLOSE: 1;
+    readonly CREDIT: 2;
+};
+/** The most DATA frames one grant, or one channel's outstanding credit, may admit. */
+export declare const RPC_MAX_STREAM_CREDITS = 1024;
+/** The largest CLOSE body: a typed ending is a code and a reason, never a value. */
+export declare const CLOSE_BODY_MAX_BYTES = 512;
+/** Whether `credits` is one admissible grant. */
+export declare function isCreditGrant(credits: number): boolean;
+/** Prepend the 1-byte DATA header to a payload, returning a new buffer. */
+export declare function frameData(payload: Uint8Array): Uint8Array;
+/** A CLOSE frame: header only, or carrying the owner's typed ending (credit-negotiated connections only). */
+export declare function frameClose(ending?: StreamEnding): Uint8Array;
+/** A CREDIT frame admitting `credits` more DATA frames. */
+export declare function frameCredit(credits: number): Uint8Array;
+/** A failure's own `code` and `reason`, read as a typed ending; any other field is dropped. */
+/** The typed ending a failure carries, when it carries a well-formed code and reason: nothing else of it crosses. */
+export declare function endingOfFailure(failure: unknown): StreamEnding | undefined;
+/**
+ * Decode a single framed record (header + body) into a {@link Frame}.
+ * The caller is responsible for record boundaries on a stream transport; this
+ * decodes one already-delimited record.
+ */
+export declare function decodeFrame(record: Uint8Array): Exclude<Frame, {
+    readonly type: typeof FRAME.CREDIT;
+}>;
+export declare function decodeFrame(record: Uint8Array, capabilities: FrameCapabilities): Frame;
+//# sourceMappingURL=frame.d.ts.map

package/dist/core/protocol/wire/frame.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frame.d.ts","sourceRoot":"","sources":["../../../../src/core/protocol/wire/frame.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,mDAAmD,CAAC;AAEhH,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AAC5G,YAAY,EAAE,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,mDAAmD,CAAC;AAmC3H,uBAAuB;AACvB,eAAO,MAAM,KAAK;;;;CAIR,CAAC;AAEX,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAE3C,oFAAoF;AACpF,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAMxC,iDAAiD;AACjD,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,OAAO,EAAE,UAAU,GAAG,UAAU,CAKzD;AAKD,6GAA6G;AAC7G,wBAAgB,UAAU,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,UAAU,CAQ5D;AAED,2DAA2D;AAC3D,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CAMvD;AA4BD,+FAA+F;AAE/F,qHAAqH;AACrH,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAG1E;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,KAAK,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,KAAK,CAAC,MAAM,CAAA;CAAE,CAAC,CAAC;AACxG,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,GAAG,KAAK,CAAC"}

package/dist/core/protocol/wire/frame.js

@@ -0,0 +1,131 @@
+import { FailureEndingSchema, StreamEndingSchema } from "../../../schemas/contracts/protocol/wire/frame.js";
+export { FailureEndingSchema, StreamEndingSchema } from "../../../schemas/contracts/protocol/wire/frame.js";
+/**
+ * Stream-channel framing — the 1-byte header for the `stream` fast-path.
+ *
+ * Once a `stream` channel is open, bytes flow with a 1-byte frame header only:
+ * no JSON envelope, no per-chunk correlation id. A session's onOutput bytes ride
+ * this, so a high-rate PTY does not pay the invoke-envelope cost per chunk.
+ *
+ * Frame layout (network order):
+ *   byte 0     : frame type
+ *   bytes 1..  : type-specific body
+ *
+ * Frame types:
+ *   DATA   (0x00) : body is the raw payload bytes (stdin→PTY or PTY→stdout).
+ *   CLOSE  (0x01) : no body: the channel is closing; the peer should stop. On a
+ *                   connection that negotiated stream credits, CLOSE may carry
+ *                   the owner's typed ending: strict JSON `{ code, reason }`,
+ *                   both strings, at most {@link CLOSE_BODY_MAX_BYTES} bytes.
+ *   CREDIT (0x02) : only on a connection that negotiated stream credits. Body
+ *                   is a 4-byte big-endian grant, 1..{@link RPC_MAX_STREAM_CREDITS}:
+ *                   the consumer admits that many more DATA frames.
+ *
+ * Without the negotiated capability a CREDIT frame, or a CLOSE with a body, is
+ * an invalid frame, exactly as before the capability existed.
+ *
+ * The in-process transport does not need framing (it hands `Uint8Array` chunks
+ * directly), but the unix/tcp transports do — a single socket multiplexes the
+ * invoke envelope and N stream channels, and each channel needs a self-delimited
+ * record. Keeping the framing in the base package means every transport frames
+ * identically; only the byte sink differs.
+ */
+import { CapabilityError, CaughtFailureSchema } from '@vibesdotdev/kernel';
+import { HOST_FAILURES } from "../transport/failure-describer.js";
+/** Frame type tags. */
+export const FRAME = {
+    DATA: 0x00,
+    CLOSE: 0x01,
+    CREDIT: 0x02
+};
+/** The most DATA frames one grant, or one channel's outstanding credit, may admit. */
+export const RPC_MAX_STREAM_CREDITS = 1024;
+/** The largest CLOSE body: a typed ending is a code and a reason, never a value. */
+export const CLOSE_BODY_MAX_BYTES = 512;
+/** What a connection negotiated that widens the frames it reads. */
+const NO_FRAME_CAPABILITIES = { streamCredits: false };
+/** Whether `credits` is one admissible grant. */
+export function isCreditGrant(credits) {
+    return Number.isSafeInteger(credits) && credits >= 1 && credits <= RPC_MAX_STREAM_CREDITS;
+}
+/** Prepend the 1-byte DATA header to a payload, returning a new buffer. */
+export function frameData(payload) {
+    const out = new Uint8Array(payload.length + 1);
+    out[0] = FRAME.DATA;
+    out.set(payload, 1);
+    return out;
+}
+const encoder = new TextEncoder();
+const decoder = new TextDecoder('utf-8', { fatal: true });
+/** A CLOSE frame: header only, or carrying the owner's typed ending (credit-negotiated connections only). */
+export function frameClose(ending) {
+    if (!ending)
+        return new Uint8Array([FRAME.CLOSE]);
+    const body = encoder.encode(JSON.stringify(StreamEndingSchema.parse(ending)));
+    if (body.length > CLOSE_BODY_MAX_BYTES)
+        throw invalidFrame();
+    const out = new Uint8Array(body.length + 1);
+    out[0] = FRAME.CLOSE;
+    out.set(body, 1);
+    return out;
+}
+/** A CREDIT frame admitting `credits` more DATA frames. */
+export function frameCredit(credits) {
+    if (!isCreditGrant(credits))
+        throw invalidFrame();
+    const out = new Uint8Array(5);
+    out[0] = FRAME.CREDIT;
+    new DataView(out.buffer).setUint32(1, credits, false);
+    return out;
+}
+/** A decoded frame. DATA carries a payload slice; CLOSE may carry a typed ending; CREDIT carries a grant. */
+function invalidFrame(cause) {
+    return new CapabilityError('Invalid RPC stream frame.', 'INVALID_INPUT', {
+        reason: 'rpc-frame-invalid', retryable: false,
+        cause: cause === undefined ? undefined : HOST_FAILURES.describe(cause)
+    });
+}
+/** A CLOSE body: strict `{ code, reason }` JSON within the byte ceiling; anything else is an invalid frame. */
+function decodeEnding(body) {
+    if (body.length > CLOSE_BODY_MAX_BYTES)
+        throw invalidFrame();
+    let text;
+    try {
+        text = JSON.parse(decoder.decode(body));
+    }
+    catch (cause) {
+        // A body that is not UTF-8 JSON is an invalid frame, never the decoder's raw error.
+        const failure = CaughtFailureSchema.parse(cause);
+        if (failure instanceof SyntaxError || failure instanceof TypeError)
+            throw invalidFrame(failure);
+        throw failure;
+    }
+    const parsed = StreamEndingSchema.safeParse(text);
+    if (!parsed.success)
+        throw invalidFrame(parsed.error);
+    return parsed.data;
+}
+/** A failure's own `code` and `reason`, read as a typed ending; any other field is dropped. */
+/** The typed ending a failure carries, when it carries a well-formed code and reason: nothing else of it crosses. */
+export function endingOfFailure(failure) {
+    const parsed = FailureEndingSchema.safeParse(failure);
+    return parsed.success ? { code: parsed.data.code, reason: parsed.data.reason } : undefined;
+}
+export function decodeFrame(record, capabilities = NO_FRAME_CAPABILITIES) {
+    const type = record[0];
+    if (type === FRAME.DATA)
+        return { type: FRAME.DATA, payload: record.subarray(1) };
+    if (type === FRAME.CLOSE && record.length === 1)
+        return { type: FRAME.CLOSE };
+    if (!capabilities.streamCredits)
+        throw invalidFrame();
+    if (type === FRAME.CLOSE)
+        return { type: FRAME.CLOSE, ending: decodeEnding(record.subarray(1)) };
+    if (type === FRAME.CREDIT && record.length === 5) {
+        const credits = new DataView(record.buffer, record.byteOffset + 1, 4).getUint32(0, false);
+        if (isCreditGrant(credits))
+            return { type: FRAME.CREDIT, credits };
+    }
+    throw invalidFrame();
+}
+//# sourceMappingURL=frame.js.map

package/dist/core/protocol/wire/frame.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frame.js","sourceRoot":"","sources":["../../../../src/core/protocol/wire/frame.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AAC5G,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AAE5G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAsB,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAElE,uBAAuB;AACvB,MAAM,CAAC,MAAM,KAAK,GAAG;IACpB,IAAI,EAAE,IAAI;IACV,KAAK,EAAE,IAAI;IACX,MAAM,EAAE,IAAI;CACH,CAAC;AAEX,sFAAsF;AACtF,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAE3C,oFAAoF;AACpF,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAExC,oEAAoE;AAEpE,MAAM,qBAAqB,GAAsB,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;AAE1E,iDAAiD;AACjD,MAAM,UAAU,aAAa,CAAC,OAAe;IAC5C,OAAO,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,IAAI,sBAAsB,CAAC;AAC3F,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,SAAS,CAAC,OAAmB;IAC5C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/C,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;IACpB,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACpB,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAE1D,6GAA6G;AAC7G,MAAM,UAAU,UAAU,CAAC,MAAqB;IAC/C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9E,IAAI,IAAI,CAAC,MAAM,GAAG,oBAAoB;QAAE,MAAM,YAAY,EAAE,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5C,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;IACrB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACjB,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,WAAW,CAAC,OAAe;IAC1C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,MAAM,YAAY,EAAE,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;IACtB,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACtD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,6GAA6G;AAE7G,SAAS,YAAY,CAAC,KAAqB;IAC1C,OAAO,IAAI,eAAe,CAAC,2BAA2B,EAAE,eAAe,EAAE;QACxE,MAAM,EAAE,mBAAmB,EAAE,SAAS,EAAE,KAAK;QAC7C,KAAK,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC;KACtE,CAAC,CAAC;AACJ,CAAC;AAED,+GAA+G;AAC/G,SAAS,YAAY,CAAC,IAAgB;IACrC,IAAI,IAAI,CAAC,MAAM,GAAG,oBAAoB;QAAE,MAAM,YAAY,EAAE,CAAC;IAC7D,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACJ,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,oFAAoF;QACpF,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,OAAO,YAAY,WAAW,IAAI,OAAO,YAAY,SAAS;YAAE,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAChG,MAAM,OAAO,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,+FAA+F;AAE/F,qHAAqH;AACrH,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC/C,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5F,CAAC;AASD,MAAM,UAAU,WAAW,CAAC,MAAkB,EAAE,eAAkC,qBAAqB;IACtG,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,IAAI,IAAI,KAAK,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAC9E,IAAI,CAAC,YAAY,CAAC,aAAa;QAAE,MAAM,YAAY,EAAE,CAAC;IACtD,IAAI,IAAI,KAAK,KAAK,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,IAAI,IAAI,KAAK,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1F,IAAI,aAAa,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,YAAY,EAAE,CAAC;AACtB,CAAC"}

package/dist/core/protocol/wire/inline-value.d.ts

@@ -0,0 +1,27 @@
+import type { WireClassifier } from "../../../schemas/contracts/protocol/wire/wire-value.ts";
+import type { RpcData } from './rpc-data.ts';
+/** Default classifier: everything is inline JSON. Used when no refs are expected. */
+export declare const inlineOnly: WireClassifier;
+/**
+ * The one validated snapshot of an inline value: exactly what crosses the
+ * wire (Codex re-review: send the validated representation, never re-read the
+ * original).
+ *
+ * The declared inline types are JSON's plus `Date`. The walk reads every
+ * property, every array index and calls every `toJSON` exactly once, and it
+ * never calls a method the value supplies (arrays are walked by index over
+ * `length`, not through their own `map`), so a stateful getter, `toJSON` or
+ * overridden array method cannot hand the wire a different shape than the one
+ * validated. Own keys are kept as own data properties, a key named
+ * `__proto__` included, and the snapshot's prototype is always the plain one.
+ * A cancellation handle (`AbortSignal`) anywhere, including inside a class
+ * instance or behind a `toJSON`, is refused `rpc-cancellation-unsupported`;
+ * a cycle, a BigInt, or any failure while traversing (a throwing getter,
+ * index or `toJSON`) is refused `rpc-value-unserializable`. Every refusal
+ * carries a fixed message and no cause, so no serializer or application text
+ * leaks into the diagnostic envelope.
+ */
+export declare function snapshotInline<T>(value: T): RpcData;
+/** Refuse, typed, an inline value the wire cannot carry (see {@link snapshotInline}). */
+export declare function assertInlineCarriable<T>(value: T): void;
+//# sourceMappingURL=inline-value.d.ts.map

package/dist/core/protocol/wire/inline-value.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inline-value.d.ts","sourceRoot":"","sources":["../../../../src/core/protocol/wire/inline-value.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,KAAK,EAAE,OAAO,EAAmB,MAAM,eAAe,CAAC;AAI9D,qFAAqF;AACrF,eAAO,MAAM,UAAU,EAAE,cAA2C,CAAC;AAwBrE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAuDnD;AAED,yFAAyF;AACzF,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAEvD"}