@vibesdotdev/kernel-rpc 0.0.0-stage → 1.0.0-rc.3

package/dist/transports/messageport/connection/contracts.d.ts

@@ -0,0 +1,41 @@
+export { MessagePortRpcFrameSchema } from "../../../schemas/contracts/transports/messageport/contracts.ts";
+export type { MessagePortRpcFrame, RpcMessagePort } from "../../../schemas/contracts/transports/messageport/contracts.ts";
+export declare const MESSAGEPORT_RPC_PROTOCOL: {
+    readonly major: 1;
+    readonly minor: 0;
+};
+/**
+ * Serialized ceiling per message. `structuredClone` will happily move a
+ * gigabyte, and the frame is on the other side of a boundary we do not control.
+ */
+export declare const MESSAGEPORT_RPC_MAX_MESSAGE_BYTES: number;
+/**
+ * How long the consumer waits for one response.
+ *
+ * The outer custody deadline, not a feature policy: a host handler that wants
+ * longer should say so through its own contract rather than by holding a port
+ * call open indefinitely.
+ */
+export declare const MESSAGEPORT_RPC_DEFAULT_REQUEST_DEADLINE_MS = 15000;
+/**
+ * Concurrent inbound invokes per connection.
+ *
+ * Without a cap, a frame's messages become simultaneous in-flight host invokes
+ * with no backpressure: 50,000 frames, 50,000 open calls.
+ */
+export declare const MESSAGEPORT_RPC_MAX_IN_FLIGHT = 32;
+/**
+ * Most live callback refs one applet connection holds in EACH direction (SPEC rule 11): applet
+ * callbacks the host may call back, and host functions (unsubscribes) the applet may call.
+ */
+export declare const MESSAGEPORT_RPC_MAX_CALLBACK_REFS = 64;
+/**
+ * The transport name this lane reports on `RemotePeerInfo`.
+ *
+ * Re-exported from `runtime-rpc`, which owns the closed union. An adapter
+ * IMPLEMENTS a transport; it does not define which transports exist, and a base
+ * package must never depend on an adapter to learn one.
+ */
+export declare const MESSAGEPORT_RPC_TRANSPORT: "messageport";
+/** Minimal port surface, so a test can drive this without a DOM. */
+//# sourceMappingURL=contracts.d.ts.map

package/dist/transports/messageport/connection/contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../../../../src/transports/messageport/connection/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,gEAAgE,CAAC;AAC3G,YAAY,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,gEAAgE,CAAC;AAW1H,eAAO,MAAM,wBAAwB;;;CAAkC,CAAC;AAExE;;;GAGG;AACH,eAAO,MAAM,iCAAiC,QAAa,CAAC;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,2CAA2C,QAAS,CAAC;AAElE;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAChD;;;GAGG;AACH,eAAO,MAAM,iCAAiC,KAAK,CAAC;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,eAA4B,CAAC;AAEnE,oEAAoE"}

package/dist/transports/messageport/connection/contracts.js

@@ -0,0 +1,46 @@
+export { MessagePortRpcFrameSchema } from "../../../schemas/contracts/transports/messageport/contracts.js";
+/**
+ * Bounds for the MessagePort transport.
+ *
+ * A sandboxed applet frame is the one peer in this system that is assumed
+ * hostile, so the transport's job is to be boring under abuse: a message it will
+ * not read past, a deadline it will not wait past, and a refusal rather than a
+ * throw.
+ */
+import { RPC_TRANSPORT } from '@vibesdotdev/kernel-rpc';
+export const MESSAGEPORT_RPC_PROTOCOL = { major: 1, minor: 0 };
+/**
+ * Serialized ceiling per message. `structuredClone` will happily move a
+ * gigabyte, and the frame is on the other side of a boundary we do not control.
+ */
+export const MESSAGEPORT_RPC_MAX_MESSAGE_BYTES = 256 * 1024;
+/**
+ * How long the consumer waits for one response.
+ *
+ * The outer custody deadline, not a feature policy: a host handler that wants
+ * longer should say so through its own contract rather than by holding a port
+ * call open indefinitely.
+ */
+export const MESSAGEPORT_RPC_DEFAULT_REQUEST_DEADLINE_MS = 15_000;
+/**
+ * Concurrent inbound invokes per connection.
+ *
+ * Without a cap, a frame's messages become simultaneous in-flight host invokes
+ * with no backpressure: 50,000 frames, 50,000 open calls.
+ */
+export const MESSAGEPORT_RPC_MAX_IN_FLIGHT = 32;
+/**
+ * Most live callback refs one applet connection holds in EACH direction (SPEC rule 11): applet
+ * callbacks the host may call back, and host functions (unsubscribes) the applet may call.
+ */
+export const MESSAGEPORT_RPC_MAX_CALLBACK_REFS = 64;
+/**
+ * The transport name this lane reports on `RemotePeerInfo`.
+ *
+ * Re-exported from `runtime-rpc`, which owns the closed union. An adapter
+ * IMPLEMENTS a transport; it does not define which transports exist, and a base
+ * package must never depend on an adapter to learn one.
+ */
+export const MESSAGEPORT_RPC_TRANSPORT = RPC_TRANSPORT.messageport;
+/** Minimal port surface, so a test can drive this without a DOM. */
+//# sourceMappingURL=contracts.js.map

package/dist/transports/messageport/connection/contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../../../src/transports/messageport/connection/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,gEAAgE,CAAC;AAE3G;;;;;;;GAOG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAW,CAAC;AAExE;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,GAAG,GAAG,IAAI,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,MAAM,CAAC;AAElE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAChD;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,aAAa,CAAC,WAAW,CAAC;AAEnE,oEAAoE"}

package/dist/transports/messageport/connection/messageport-inbox.d.ts

@@ -0,0 +1,37 @@
+import { type CapabilityError } from '@vibesdotdev/kernel';
+import { type RefId, type RpcInvoke, type RpcLifecycle, type RpcResponse } from '@vibesdotdev/kernel-rpc';
+import type { RpcSource } from '../../../core/protocol/wire/rpc-data.ts';
+import { type RpcMessagePort } from './contracts.ts';
+export declare function byteLength<T>(value: T): number;
+export declare abstract class MessagePortInbox {
+    readonly rootRef: RefId;
+    readonly closed: Promise<void>;
+    protected port: RpcMessagePort;
+    protected pending: Map<string, (r: RpcResponse) => void>;
+    /** The REVERSE leg: the owner invoking a consumer-owned callback ref. Invoke */
+    protected requestHandler?: (req: RpcInvoke) => Promise<RpcResponse>;
+    protected inFlight: number;
+    protected portListener?: (event: {
+        data: RpcSource;
+    }) => void;
+    /** Refusals that could not be posted: kept typed until the connection's close reports them. */
+    protected postFailures: CapabilityError[];
+    protected resolveClosed: () => void;
+    protected closedFlag: boolean;
+    protected closing: Promise<void> | undefined;
+    protected deadlineMs: number;
+    protected lifecycle: RpcLifecycle;
+    /**
+         * `lifecycle` is the owning runtime's: every request's deadline is a bounded
+         * wait on it, so runtime disposal answers the in-flight calls too.
+         */
+    constructor(port: RpcMessagePort, rootRef: string, options: {
+        lifecycle: RpcLifecycle;
+        deadlineMs?: number;
+    });
+    protected receive(data: RpcSource): void;
+    /** Post, and if that is impossible, keep why for the close rather than throwing into a void. */
+    protected postSafely<F extends RpcSource>(frame: F): void;
+    protected post<F extends RpcSource>(frame: F): void;
+}
+//# sourceMappingURL=messageport-inbox.d.ts.map

package/dist/transports/messageport/connection/messageport-inbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"messageport-inbox.d.ts","sourceRoot":"","sources":["../../../../src/transports/messageport/connection/messageport-inbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAIP,KAAK,KAAK,EACV,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,WAAW,EACf,MAAM,yBAAyB,CAAC;AAIjC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAKP,KAAK,cAAc,EAClB,MAAM,gBAAgB,CAAC;AACxB,wBAAgB,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,CAK9C;AACD,8BAAsB,gBAAgB;IACtC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IAExB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/B,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC;IAE/B,SAAS,CAAC,OAAO,kBAAuB,WAAW,KAAK,IAAI,EAAI;IAEhE,gFAAgF;IAC/E,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,SAAS,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAErE,SAAS,CAAC,QAAQ,SAAK;IAEvB,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,SAAS,CAAA;KAAE,KAAK,IAAI,CAAC;IAE9D,+FAA+F;IAC9F,SAAS,CAAC,YAAY,EAAE,eAAe,EAAE,CAAM;IAEhD,SAAS,CAAC,aAAa,EAAG,MAAM,IAAI,CAAC;IAErC,SAAS,CAAC,UAAU,UAAS;IAE7B,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IAE7C,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC;IAE7B,SAAS,CAAC,SAAS,EAAE,YAAY,CAAC;IAElC;;;WAGI;gBACS,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,SAAS,EAAE,YAAY,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;IAa7G,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI;IAiExC,gGAAgG;IAC/F,SAAS,CAAC,UAAU,CAAC,CAAC,SAAS,SAAS,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI;IAO1D,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,SAAS,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI;CAOlD"}

package/dist/transports/messageport/connection/messageport-inbox.js

@@ -0,0 +1,122 @@
+import {} from '@vibesdotdev/kernel';
+import { RPC_ERROR, asRefId, rpcError } from '@vibesdotdev/kernel-rpc';
+import { attempt, settled } from "../../../core/protocol/lifecycle/attempt.js";
+import { connectionCloseFailure } from "../../../core/protocol/lifecycle/binding-close.js";
+import { oversize } from "../../../core/protocol/wire/limits.js";
+import { MESSAGEPORT_RPC_DEFAULT_REQUEST_DEADLINE_MS, MESSAGEPORT_RPC_MAX_IN_FLIGHT, MESSAGEPORT_RPC_MAX_MESSAGE_BYTES, MessagePortRpcFrameSchema } from "./contracts.js";
+export function byteLength(value) {
+    const encoded = attempt(() => new TextEncoder().encode(JSON.stringify(value) ?? '').length);
+    // A value that cannot be serialized is over any ceiling, so the caller
+    // refuses it as too large rather than sending it.
+    return encoded.ok ? encoded.value : Number.POSITIVE_INFINITY;
+}
+export class MessagePortInbox {
+    rootRef;
+    closed;
+    port;
+    pending = new Map();
+    /** The REVERSE leg: the owner invoking a consumer-owned callback ref. Invoke */
+    requestHandler;
+    inFlight = 0;
+    portListener;
+    /** Refusals that could not be posted: kept typed until the connection's close reports them. */
+    postFailures = [];
+    resolveClosed;
+    closedFlag = false;
+    closing;
+    deadlineMs;
+    lifecycle;
+    /**
+         * `lifecycle` is the owning runtime's: every request's deadline is a bounded
+         * wait on it, so runtime disposal answers the in-flight calls too.
+         */
+    constructor(port, rootRef, options) {
+        this.port = port;
+        this.lifecycle = options.lifecycle;
+        this.rootRef = asRefId(rootRef);
+        this.deadlineMs = options.deadlineMs ?? MESSAGEPORT_RPC_DEFAULT_REQUEST_DEADLINE_MS;
+        this.closed = new Promise((resolve) => {
+            this.resolveClosed = resolve;
+        });
+        this.portListener = (event) => this.receive(event.data);
+        port.addEventListener('message', this.portListener);
+        port.start?.();
+    }
+    receive(data) {
+        // A closed connection stops listening. `close()` calls `port.close()`, but a wrapper port, or one whose optional `close` is absent, keeps delivering — and a handler running after close is a handler running without a lease.
+        if (this.closedFlag)
+            return;
+        // INBOUND is bounded before it is parsed.
+        if (byteLength(data) > MESSAGEPORT_RPC_MAX_MESSAGE_BYTES)
+            return;
+        // PARSED, never trusted. This is the direction the consumer does not
+        // control, and an unvalidated frame is the cheapest way to hurt it.
+        const frame = MessagePortRpcFrameSchema.safeParse(data);
+        if (!frame.success)
+            return;
+        if (frame.data.t === 'res') {
+            const resolve = this.pending.get(frame.data.res.id);
+            if (!resolve)
+                return;
+            this.pending.delete(frame.data.res.id);
+            resolve(frame.data.res);
+            return;
+        }
+        if (frame.data.t === 'req' && this.requestHandler) {
+            const req = frame.data.req;
+            // Concurrency is capped per connection. Without it, 50,000 frames become
+            // 50,000 simultaneous in-flight host invokes with no backpressure.
+            if (this.inFlight >= MESSAGEPORT_RPC_MAX_IN_FLIGHT) {
+                this.post({
+                    t: 'res',
+                    res: {
+                        id: req.id,
+                        error: rpcError(RPC_ERROR.INVOKE_FAILED, 'Too many concurrent applet requests')
+                    }
+                });
+                return;
+            }
+            this.inFlight += 1;
+            // This is the consumer's reverse leg, so only `invoke` belongs here. `release` and `stream` are the OWNER's, and they are handled by `listenMessagePort` — dropping them silently is what made every referenceable value leak for the life of a connection.
+            if (!('method' in req)) {
+                this.post({
+                    t: 'res',
+                    res: {
+                        id: req.id,
+                        error: rpcError(RPC_ERROR.NO_TARGET, 'This peer answers invoke only.')
+                    }
+                });
+                this.inFlight -= 1;
+                return;
+            }
+            void settled(this.requestHandler(req).then((res) => this.post({ t: 'res', res }))).then((answered) => {
+                this.inFlight -= 1;
+                if (answered.ok)
+                    return;
+                // A handler that throws, or a response past the size ceiling, used to surface as an unhandled rejection and take the host process with it.
+                this.postSafely({
+                    t: 'res',
+                    res: {
+                        id: req.id,
+                        error: rpcError(RPC_ERROR.INVOKE_FAILED, answered.failure instanceof Error ? answered.failure.message : 'Applet request failed')
+                    }
+                });
+            });
+        }
+    }
+    /** Post, and if that is impossible, keep why for the close rather than throwing into a void. */
+    postSafely(frame) {
+        const posted = attempt(() => this.post(frame));
+        // The error response itself cannot be posted, so the peer's own deadline
+        // answers this call RPC_DISCONNECTED; the close reports why.
+        if (!posted.ok)
+            this.postFailures.push(connectionCloseFailure(this.rootRef, posted.failure));
+    }
+    post(frame) {
+        if (byteLength(frame) > MESSAGEPORT_RPC_MAX_MESSAGE_BYTES) {
+            throw oversize(`Applet RPC frame exceeds ${MESSAGEPORT_RPC_MAX_MESSAGE_BYTES} bytes and was not sent.`, 'rpc-message-too-large', MESSAGEPORT_RPC_MAX_MESSAGE_BYTES);
+        }
+        this.port.postMessage(frame);
+    }
+}
+//# sourceMappingURL=messageport-inbox.js.map

package/dist/transports/messageport/connection/messageport-inbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"messageport-inbox.js","sourceRoot":"","sources":["../../../../src/transports/messageport/connection/messageport-inbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACP,SAAS,EACT,OAAO,EACP,QAAQ,EAKP,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,6CAA6C,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,mDAAmD,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,MAAM,uCAAuC,CAAC;AAEjE,OAAO,EACP,2CAA2C,EAC3C,6BAA6B,EAC7B,iCAAiC,EACjC,yBAAyB,EAExB,MAAM,gBAAgB,CAAC;AACxB,MAAM,UAAU,UAAU,CAAI,KAAQ;IACrC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5F,uEAAuE;IACvE,kDAAkD;IAClD,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC;AAC9D,CAAC;AACD,MAAM,OAAgB,gBAAgB;IAC7B,OAAO,CAAQ;IAEf,MAAM,CAAgB;IAErB,IAAI,CAAiB;IAErB,OAAO,GAAG,IAAI,GAAG,EAAoC,CAAC;IAEhE,gFAAgF;IACrE,cAAc,CAA4C;IAE3D,QAAQ,GAAG,CAAC,CAAC;IAEb,YAAY,CAAwC;IAE9D,+FAA+F;IACpF,YAAY,GAAsB,EAAE,CAAC;IAEtC,aAAa,CAAc;IAE3B,UAAU,GAAG,KAAK,CAAC;IAEnB,OAAO,CAA4B;IAEnC,UAAU,CAAS;IAEnB,SAAS,CAAe;IAElC;;;WAGI;IACH,YAAY,IAAoB,EAAE,OAAe,EAAE,OAAyD;QAC3G,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,2CAA2C,CAAC;QACpF,IAAI,CAAC,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC3C,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC;QAC9B,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,CAAC;IAEQ,OAAO,CAAC,IAAe;QAC/B,+NAA+N;QAC/N,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO;QAE5B,0CAA0C;QAC1C,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,iCAAiC;YAAE,OAAO;QAEjE,qEAAqE;QACrE,oEAAoE;QACpE,MAAM,KAAK,GAAG,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO;QAE3B,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpD,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO;QACR,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACnD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;YAC3B,yEAAyE;YACzE,mEAAmE;YACnE,IAAI,IAAI,CAAC,QAAQ,IAAI,6BAA6B,EAAE,CAAC;gBACpD,IAAI,CAAC,IAAI,CAAC;oBACT,CAAC,EAAE,KAAK;oBACR,GAAG,EAAE;wBACJ,EAAE,EAAE,GAAG,CAAC,EAAE;wBACV,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE,qCAAqC,CAAC;qBAC/E;iBACD,CAAC,CAAC;gBACH,OAAO;YACR,CAAC;YACD,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;YACnB,4PAA4P;YAC5P,IAAI,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC;oBACT,CAAC,EAAE,KAAK;oBACR,GAAG,EAAE;wBACJ,EAAE,EAAE,GAAG,CAAC,EAAE;wBACV,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,gCAAgC,CAAC;qBACtE;iBACD,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;gBACnB,OAAO;YACR,CAAC;YACD,KAAK,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;gBACpG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;gBACnB,IAAI,QAAQ,CAAC,EAAE;oBAAE,OAAO;gBACxB,2IAA2I;gBAC3I,IAAI,CAAC,UAAU,CAAC;oBACf,CAAC,EAAE,KAAK;oBACR,GAAG,EAAE;wBACJ,EAAE,EAAE,GAAG,CAAC,EAAE;wBACV,KAAK,EAAE,QAAQ,CACd,SAAS,CAAC,aAAa,EACvB,QAAQ,CAAC,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CACtF;qBACD;iBACD,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAEF,gGAAgG;IACrF,UAAU,CAAsB,KAAQ;QACjD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/C,yEAAyE;QACzE,6DAA6D;QAC7D,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9F,CAAC;IAEQ,IAAI,CAAsB,KAAQ;QAC1C,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,iCAAiC,EAAE,CAAC;YAC3D,MAAM,QAAQ,CAAC,4BAA4B,iCAAiC,0BAA0B,EAAE,uBAAuB,EAAE,iCAAiC,CAAC,CAAC;QACrK,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;CAED"}

package/dist/transports/messageport/descriptors/messageport.rpc.descriptor.d.ts

@@ -0,0 +1,12 @@
+export { DescriptorInput } from "../../../schemas/contracts/transports/messageport/descriptors/messageport.rpc.descriptor.ts";
+/**
+ * The sandboxed-frame RPC lane.
+ *
+ * `remoteScope` says consumer/local because the peer is a browser document on
+ * the user's machine, not a service: nothing about this lane should read as
+ * server authority.
+ */
+import { type RuntimeRpcDescriptor } from '../../../core/kinds/rpc.kind.ts';
+export declare function createMessagePortRpcDescriptor(id?: string, channel?: string): RuntimeRpcDescriptor;
+export default createMessagePortRpcDescriptor;
+//# sourceMappingURL=messageport.rpc.descriptor.d.ts.map

package/dist/transports/messageport/descriptors/messageport.rpc.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"messageport.rpc.descriptor.d.ts","sourceRoot":"","sources":["../../../../src/transports/messageport/descriptors/messageport.rpc.descriptor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,6FAA6F,CAAC;AAE9H;;;;;;GAMG;AACH,OAAO,EAA8B,KAAK,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAGxG,wBAAgB,8BAA8B,CAC7C,EAAE,SAAmB,EACrB,OAAO,SAAuB,GAC5B,oBAAoB,CAYtB;AAED,eAAe,8BAA8B,CAAC"}

package/dist/transports/messageport/descriptors/messageport.rpc.descriptor.js

@@ -0,0 +1,25 @@
+import { DescriptorInput } from "../../../schemas/contracts/transports/messageport/descriptors/messageport.rpc.descriptor.js";
+export { DescriptorInput } from "../../../schemas/contracts/transports/messageport/descriptors/messageport.rpc.descriptor.js";
+/**
+ * The sandboxed-frame RPC lane.
+ *
+ * `remoteScope` says consumer/local because the peer is a browser document on
+ * the user's machine, not a service: nothing about this lane should read as
+ * server authority.
+ */
+import { RuntimeRpcDescriptorSchema } from "../../../core/kinds/rpc.kind.js";
+import { readInput } from "../../../core/protocol/references/caller-input.js";
+export function createMessagePortRpcDescriptor(id = 'applet-sandbox', channel = 'applet-runner-port') {
+    const input = readInput('createMessagePortRpcDescriptor', DescriptorInput, { id, channel });
+    return readInput('createMessagePortRpcDescriptor', RuntimeRpcDescriptorSchema, {
+        id: input.id,
+        kind: 'runtime/rpc',
+        name: 'Sandboxed frame runtime',
+        description: 'MessagePort transport to a cross-origin, credential-free applet frame. Arriving invokes gate through the L1 pipeline.',
+        transport: 'messageport',
+        target: { transport: 'messageport', channel: input.channel },
+        remoteScope: { hardware: 'consumer', substrate: 'local' }
+    });
+}
+export default createMessagePortRpcDescriptor;
+//# sourceMappingURL=messageport.rpc.descriptor.js.map

package/dist/transports/messageport/descriptors/messageport.rpc.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"messageport.rpc.descriptor.js","sourceRoot":"","sources":["../../../../src/transports/messageport/descriptors/messageport.rpc.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,6FAA6F,CAAC;AAC9H,OAAO,EAAE,eAAe,EAAE,MAAM,6FAA6F,CAAC;AAE9H;;;;;;GAMG;AACH,OAAO,EAAE,0BAA0B,EAA6B,MAAM,iCAAiC,CAAC;AACxG,OAAO,EAAE,SAAS,EAAE,MAAM,mDAAmD,CAAC;AAE9E,MAAM,UAAU,8BAA8B,CAC7C,EAAE,GAAG,gBAAgB,EACrB,OAAO,GAAG,oBAAoB;IAE9B,MAAM,KAAK,GAAG,SAAS,CAAC,gCAAgC,EAAE,eAAe,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5F,OAAO,SAAS,CAAC,gCAAgC,EAAE,0BAA0B,EAAE;QAC9E,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EACV,uHAAuH;QACxH,SAAS,EAAE,aAAa;QACxB,MAAM,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;QAC5D,WAAW,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE;KACzD,CAAC,CAAC;AACJ,CAAC;AAED,eAAe,8BAA8B,CAAC"}

package/dist/transports/messageport/docs/runtime-rpc-messageport.docs.descriptor.d.ts

@@ -0,0 +1,4 @@
+import type { DocsTopicDescriptor } from '@vibesdotdev/docs-contracts';
+declare const descriptor: DocsTopicDescriptor;
+export default descriptor;
+//# sourceMappingURL=runtime-rpc-messageport.docs.descriptor.d.ts.map

package/dist/transports/messageport/docs/runtime-rpc-messageport.docs.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-rpc-messageport.docs.descriptor.d.ts","sourceRoot":"","sources":["../../../../src/transports/messageport/docs/runtime-rpc-messageport.docs.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAsCvE,QAAA,MAAM,UAAU,EAAE,mBAyBjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/transports/messageport/docs/runtime-rpc-messageport.docs.descriptor.js

@@ -0,0 +1,63 @@
+const markdown = `---
+title: MessagePort RPC transport
+summary: The sandboxed-frame lane for the runtime/rpc kind
+tags: [runtime, rpc, transport, sandbox, applets]
+parent: runtime
+order: 6
+id: runtime-rpc-messageport
+---
+
+# MessagePort RPC transport
+
+A sandboxed cross-origin frame already holds a MessagePort from its host. This
+turns that port into an \`RpcConnection\`, so the frame talks to the host through
+the same three verbs and the same \`authz\` pipeline as any other peer.
+
+There is no frame-specific protocol. That is the whole point: an applet frame is
+the one peer assumed hostile, and a second gate chain for the least trusted peer
+is the worst place to have one.
+
+## Bounds
+
+- **256 KB** per message. \`structuredClone\` will happily move a gigabyte.
+- **15 s** default request deadline — outer custody, not a feature policy. Both
+  ends take the owning runtime's \`lifecycle\`; each deadline is a bounded
+  \`lifecycle.wait\`, so disposing the runtime answers in-flight calls too.
+- **No streams.** \`openStream\` refuses rather than pretending: a framed byte
+  channel over \`postMessage\` would be a second framing in a lane that already
+  has one.
+
+## What it does not do
+
+It does not decide what a peer may reach. The owner puts exactly one object in
+its reference table and the \`authz\` chain gates each invoke; a peer cannot
+fabricate a ref, because \`dispatchRequest\` derefs through the owner's table.
+`;
+const descriptor = {
+    kind: 'docs/topic',
+    id: 'runtime-rpc-messageport',
+    title: 'MessagePort RPC transport',
+    summary: 'The sandboxed-frame lane for the runtime/rpc kind',
+    body: { type: 'markdown', sourceType: 'raw', source: markdown },
+    parent: 'runtime',
+    order: 6,
+    tags: ['runtime', 'rpc', 'transport', 'sandbox', 'applets'],
+    surfaces: ['cli', 'web'],
+    hardware: ['consumer', 'cloud'],
+    enabled: true,
+    man: {
+        name: 'runtime-rpc-messageport — sandboxed-frame RPC lane',
+        section: 1,
+        synopsis: 'vibes man runtime-rpc-messageport',
+        options: [],
+        examples: [
+            {
+                description: 'Wrap a port the host handed you',
+                command: "const connection = new MessagePortRpcConnection(port, rootRef, { lifecycle: runtime.lifecycle });"
+            }
+        ],
+        seeAlso: ['runtime-rpc', 'applets']
+    }
+};
+export default descriptor;
+//# sourceMappingURL=runtime-rpc-messageport.docs.descriptor.js.map

package/dist/transports/messageport/docs/runtime-rpc-messageport.docs.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-rpc-messageport.docs.descriptor.js","sourceRoot":"","sources":["../../../../src/transports/messageport/docs/runtime-rpc-messageport.docs.descriptor.ts"],"names":[],"mappings":"AAEA,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkChB,CAAC;AAEF,MAAM,UAAU,GAAwB;IACvC,IAAI,EAAE,YAAY;IAClB,EAAE,EAAE,yBAAyB;IAC7B,KAAK,EAAE,2BAA2B;IAClC,OAAO,EAAE,mDAAmD;IAC5D,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC/D,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC;IAC3D,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;IACxB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;IACb,GAAG,EAAE;QACJ,IAAI,EAAE,oDAAoD;QAC1D,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,mCAAmC;QAC7C,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE;YACT;gBACC,WAAW,EAAE,iCAAiC;gBAC9C,OAAO,EAAE,mGAAmG;aAC5G;SACD;QACD,OAAO,EAAE,CAAC,aAAa,EAAE,SAAS,CAAC;KACnC;CACD,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/transports/messageport/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * @vibesdotdev/kernel-rpc/messageport
+ *
+ * MessagePort transport for the `runtime/rpc` kind — the sandboxed-frame lane.
+ *
+ * The applet runner is a cross-origin, credential-free document that already
+ * receives a MessagePort from its host. This turns that port into an
+ * `RpcConnection`, so a sandboxed frame talks to the host through the same three
+ * verbs and the same `authz -> friction` pipeline as any other peer. There is no
+ * applet-specific protocol.
+ */
+export { MESSAGEPORT_RPC_DEFAULT_REQUEST_DEADLINE_MS, MESSAGEPORT_RPC_MAX_IN_FLIGHT, MESSAGEPORT_RPC_MAX_MESSAGE_BYTES, MESSAGEPORT_RPC_PROTOCOL, MESSAGEPORT_RPC_TRANSPORT, MessagePortRpcFrameSchema, type MessagePortRpcFrame, type RpcMessagePort } from './connection/contracts.ts';
+export { createMessagePortRpcDescriptor } from './descriptors/messageport.rpc.descriptor.ts';
+export { MessagePortRpcConnection } from './messageport-connection.ts';
+export { listenMessagePort, type MessagePortListenTarget, type MessagePortListener } from './messageport-listener.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/transports/messageport/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/transports/messageport/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACP,2CAA2C,EAC3C,6BAA6B,EAAE,iCAAiC,EAAE,wBAAwB,EAAE,yBAAyB,EACrH,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EAClB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,8BAA8B,EAAE,MAAM,6CAA6C,CAAC;AAC7F,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EACP,iBAAiB,EAAE,KAAK,uBAAuB,EAAE,KAAK,mBAAmB,EACxE,MAAM,2BAA2B,CAAC"}

package/dist/transports/messageport/index.js

@@ -0,0 +1,16 @@
+/**
+ * @vibesdotdev/kernel-rpc/messageport
+ *
+ * MessagePort transport for the `runtime/rpc` kind — the sandboxed-frame lane.
+ *
+ * The applet runner is a cross-origin, credential-free document that already
+ * receives a MessagePort from its host. This turns that port into an
+ * `RpcConnection`, so a sandboxed frame talks to the host through the same three
+ * verbs and the same `authz -> friction` pipeline as any other peer. There is no
+ * applet-specific protocol.
+ */
+export { MESSAGEPORT_RPC_DEFAULT_REQUEST_DEADLINE_MS, MESSAGEPORT_RPC_MAX_IN_FLIGHT, MESSAGEPORT_RPC_MAX_MESSAGE_BYTES, MESSAGEPORT_RPC_PROTOCOL, MESSAGEPORT_RPC_TRANSPORT, MessagePortRpcFrameSchema } from "./connection/contracts.js";
+export { createMessagePortRpcDescriptor } from "./descriptors/messageport.rpc.descriptor.js";
+export { MessagePortRpcConnection } from "./messageport-connection.js";
+export { listenMessagePort } from "./messageport-listener.js";
+//# sourceMappingURL=index.js.map

package/dist/transports/messageport/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/transports/messageport/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACP,2CAA2C,EAC3C,6BAA6B,EAAE,iCAAiC,EAAE,wBAAwB,EAAE,yBAAyB,EACrH,yBAAyB,EAGxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,8BAA8B,EAAE,MAAM,6CAA6C,CAAC;AAC7F,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EACP,iBAAiB,EAChB,MAAM,2BAA2B,CAAC"}

package/dist/transports/messageport/messageport-connection.d.ts

@@ -0,0 +1,9 @@
+import { MessagePortInbox } from './connection/messageport-inbox.ts';
+import { type RefId, type RpcChannel, type RpcConnection, type RpcInvoke, type RpcRequest, type RpcResponse } from '@vibesdotdev/kernel-rpc';
+export declare class MessagePortRpcConnection extends MessagePortInbox implements RpcConnection {
+    send(req: RpcRequest): Promise<RpcResponse>;
+    openStream(_ref: RefId, channel: string): Promise<RpcChannel>;
+    onRequest(handler: (req: RpcInvoke) => Promise<RpcResponse>): void;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=messageport-connection.d.ts.map

package/dist/transports/messageport/messageport-connection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"messageport-connection.d.ts","sourceRoot":"","sources":["../../../src/transports/messageport/messageport-connection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAGrE,OAAO,EAIP,KAAK,KAAK,EACV,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,WAAW,EACf,MAAM,yBAAyB,CAAC;AAIjC,qBAAa,wBAAyB,SAAQ,gBAAiB,YAAW,aAAa;IACjF,IAAI,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IA+C3C,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAMnE,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,SAAS,KAAK,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI;IAIlE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAwBrB"}

package/dist/transports/messageport/messageport-connection.js

@@ -0,0 +1,82 @@
+import { MessagePortInbox } from "./connection/messageport-inbox.js";
+/** `RpcConnection` over a MessagePort. */
+import { isCapabilityError } from '@vibesdotdev/kernel';
+import { RPC_ERROR, isLifecycleDeadline, rpcError } from '@vibesdotdev/kernel-rpc';
+import { attempt, attemptAsync, rethrow } from "../../core/protocol/lifecycle/attempt.js";
+import { connectionCloseFailure } from "../../core/protocol/lifecycle/binding-close.js";
+export class MessagePortRpcConnection extends MessagePortInbox {
+    async send(req) {
+        if (this.closedFlag) {
+            return { id: req.id, error: rpcError(RPC_ERROR.DISCONNECTED, 'Applet RPC connection is closed') };
+        }
+        const waited = await attemptAsync(() => this.lifecycle.wait((signal) => new Promise((resolve) => {
+            this.pending.set(req.id, resolve);
+            // The wait already answered the caller; settle this work too, so the
+            // runtime does not track an abandoned request until disposal.
+            signal.addEventListener('abort', () => {
+                this.pending.delete(req.id);
+                resolve({ id: req.id, error: rpcError(RPC_ERROR.DISCONNECTED, 'Applet RPC request was abandoned') });
+            }, { once: true });
+            const posted = attempt(() => this.post({ t: 'req', req }));
+            if (!posted.ok) {
+                this.pending.delete(req.id);
+                resolve({
+                    id: req.id,
+                    error: rpcError(RPC_ERROR.DISCONNECTED, posted.failure instanceof Error ? posted.failure.message : 'Applet RPC send failed')
+                });
+            }
+        }), { timeoutMs: this.deadlineMs, reason: 'applet-rpc-request' }));
+        if (waited.ok)
+            return waited.value;
+        // DISCONNECTED, not a new code.
+        if (isLifecycleDeadline(waited.failure)) {
+            return {
+                id: req.id,
+                error: rpcError(RPC_ERROR.DISCONNECTED, `Applet RPC request exceeded ${this.deadlineMs}ms`)
+            };
+        }
+        // The owning runtime was disposed: the call is answered, not abandoned.
+        if (isCapabilityError(waited.failure) && (waited.failure.code === 'CANCELLED' || waited.failure.code === 'UNAVAILABLE')) {
+            return { id: req.id, error: rpcError(RPC_ERROR.DISCONNECTED, waited.failure.message) };
+        }
+        return rethrow(waited.failure);
+    }
+    async openStream(_ref, channel) {
+        throw new Error(`Applet RPC has no stream channel "${channel}". A framed byte channel over postMessage would be a second framing in a lane that already has one.`);
+    }
+    onRequest(handler) {
+        this.requestHandler = handler;
+    }
+    close() {
+        if (this.closing)
+            return this.closing;
+        const outcome = Promise.withResolvers();
+        this.closing = outcome.promise;
+        this.closedFlag = true;
+        // Every in-flight call is answered, not abandoned. A dangling promise in
+        // applet code is indistinguishable from a hung applet.
+        for (const [id, resolve] of this.pending) {
+            resolve({ id, error: rpcError(RPC_ERROR.DISCONNECTED, 'Applet RPC connection closed') });
+        }
+        this.pending.clear();
+        const failures = this.postFailures.splice(0);
+        const detached = attempt(() => {
+            if (this.portListener)
+                this.port.removeEventListener?.('message', this.portListener);
+        });
+        if (!detached.ok)
+            failures.push(connectionCloseFailure(this.rootRef, detached.failure));
+        const closed = attempt(() => this.port.close?.());
+        if (!closed.ok)
+            failures.push(connectionCloseFailure(this.rootRef, closed.failure));
+        this.resolveClosed();
+        if (failures.length === 1)
+            outcome.reject(failures[0]);
+        else if (failures.length > 1)
+            outcome.reject(connectionCloseFailure(this.rootRef, new AggregateError(failures)));
+        else
+            outcome.resolve();
+        return this.closing;
+    }
+}
+//# sourceMappingURL=messageport-connection.js.map

package/dist/transports/messageport/messageport-connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"messageport-connection.js","sourceRoot":"","sources":["../../../src/transports/messageport/messageport-connection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,0CAA0C;AAC1C,OAAO,EAAE,iBAAiB,EAAwB,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EACP,SAAS,EACT,mBAAmB,EACnB,QAAQ,EAOP,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,0CAA0C,CAAC;AAC1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAC;AAExF,MAAM,OAAO,wBAAyB,SAAQ,gBAAgB;IAC9D,KAAK,CAAC,IAAI,CAAC,GAAe;QACxB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,iCAAiC,CAAC,EAAE,CAAC;QACnG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAC1D,CAAC,MAAM,EAAE,EAAE,CACV,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,EAAE;YACpC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAClC,qEAAqE;YACrE,8DAA8D;YAC9D,MAAM,CAAC,gBAAgB,CACtB,OAAO,EACP,GAAG,EAAE;gBACJ,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC5B,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,kCAAkC,CAAC,EAAE,CAAC,CAAC;YACtG,CAAC,EACD,EAAE,IAAI,EAAE,IAAI,EAAE,CACd,CAAC;YACF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBAChB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC5B,OAAO,CAAC;oBACP,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,KAAK,EAAE,QAAQ,CACd,SAAS,CAAC,YAAY,EACtB,MAAM,CAAC,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CACnF;iBACD,CAAC,CAAC;YACJ,CAAC;QACF,CAAC,CAAC,EACH,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAC5D,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC;QACnC,gCAAgC;QAChC,IAAI,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,OAAO;gBACN,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,+BAA+B,IAAI,CAAC,UAAU,IAAI,CAAC;aAC3F,CAAC;QACH,CAAC;QACD,wEAAwE;QACxE,IAAI,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa,CAAC,EAAE,CAAC;YACzH,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACxF,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAEF,KAAK,CAAC,UAAU,CAAC,IAAW,EAAE,OAAe;QAC3C,MAAM,IAAI,KAAK,CACd,qCAAqC,OAAO,qGAAqG,CACjJ,CAAC;IACH,CAAC;IAEF,SAAS,CAAC,OAAiD;QACzD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC;IAC/B,CAAC;IAEF,KAAK;QACH,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QACtC,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAQ,CAAC;QAC9C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,yEAAyE;QACzE,uDAAuD;QACvD,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,8BAA8B,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAsB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE;YAC7B,IAAI,IAAI,CAAC,YAAY;gBAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;aAClD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;;YAC5G,OAAO,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC;IACrB,CAAC;CACD"}

package/dist/transports/messageport/messageport-listener.d.ts

@@ -0,0 +1,14 @@
+import type { MessagePortListener, MessagePortListenTarget } from "../../schemas/contracts/transports/messageport/messageport-listener.ts";
+export { ListenMessagePortInput, OversizedRequestIdSchema } from "../../schemas/contracts/transports/messageport/messageport-listener.ts";
+export type { MessagePortInvocationBoundary, MessagePortListener, MessagePortListenTarget } from "../../schemas/contracts/transports/messageport/messageport-listener.ts";
+import { type RpcMessagePort } from './connection/contracts.ts';
+/** The id of an oversized request, read from one shallow property without parsing the frame. */
+/**
+ * Serve one applet over one MessagePort.
+ *
+ * The peer is UNTRUSTED — cross-origin and credential-free — so the same three
+ * bounds apply here as on the consumer side: a size ceiling before parsing, a
+ * concurrency cap, and no unhandled rejection reachable from a frame.
+ */
+export declare function listenMessagePort(portInput: RpcMessagePort, targetInput: MessagePortListenTarget): MessagePortListener;
+//# sourceMappingURL=messageport-listener.d.ts.map

package/dist/transports/messageport/messageport-listener.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"messageport-listener.d.ts","sourceRoot":"","sources":["../../../src/transports/messageport/messageport-listener.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,wEAAwE,CAAC;AAG3I,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,wEAAwE,CAAC;AAC1I,YAAY,EAAE,6BAA6B,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,wEAAwE,CAAC;AAkB1K,OAAO,EAOP,KAAK,cAAc,EAClB,MAAM,2BAA2B,CAAC;AAwBnC,gGAAgG;AAEhG;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAChC,SAAS,EAAE,cAAc,EACzB,WAAW,EAAE,uBAAuB,GAClC,mBAAmB,CA8HrB"}