@vibesdotdev/platform 0.0.0-stage → 1.0.0-rc.1

package/dist/fleet-events/subscriber.js

@@ -0,0 +1,231 @@
+/**
+ * Platform-side fleet event subscriber (lane L6c — platform.md §Target design).
+ *
+ * **Platform owns host *records*; fleet owns host *lifecycle*. Fleet writes
+ * (emits events); platform reads (projects them into its own host row).** This
+ * module is the single place that boundary is crossed, and it is deliberately
+ * thin: it maps each `FleetHostEvent` to a record write platform already owns,
+ * through an injected `PlatformHostRecordWriter` port. The package owns the
+ * *projection logic*; `apps/platform-web/src/server/` owns the Drizzle-backed
+ * *persistence* the port resolves to (per platform/SPEC.md "Does not
+ * own" — app-local tables live in the app).
+ *
+ * The crucial invariant: **platform never *commands* fleet.** There is no
+ * `platform.hosts.heartbeat()` that fleet calls; instead fleet emits
+ * `host.health-changed` and platform *projects* it. The arrow only ever points
+ * fleet → platform. This module imports the event *contract* from
+ * `@vibesdotdev/platform/fleets` (types-only — no runtime cycle, fleet never imports
+ * platform) and calls *only* the writer port — it has no handle on a fleet
+ * lifecycle method to call back into (platform.md acceptance #2: "no write-back
+ * arrow").
+ *
+ * Fleet's published contract (fleet/src/boundary/platform-events.ts)
+ * carries three lifecycle events, each keyed to the platform record by
+ * `hostRecordId` (the FK into `hostSchema.id`):
+ *   - `host.registered`              the daemon committed → record `pending`.
+ *   - `host.health-changed`          reachability transitioned → liveness +
+ *                                    billing meter.
+ *   - `host.capabilities-discovered` discovery resolved → store capabilities.
+ *
+ * Note: fleet's `host.health-changed` carries a `FleetHostHealth` *reachability*
+ * enum (`unknown|reachable|degraded|unreachable`), NOT a raw platform
+ * `HostHeartbeat` — that is the actual L6a contract, which differs from the
+ * illustrative sketch in platform.md. The projector maps reachability onto the
+ * record's liveness column and feeds the billing anchor off the same signal,
+ * so billing still meters off liveness (acceptance #4) — it just reads liveness
+ * via the event rather than via a direct heartbeat command.
+ */
+import { CapabilityError, isCapabilityError, settle, settleNow, valueFreeFailure } from '@vibesdotdev/kernel';
+import { hostCapabilitiesSchema } from "../schemas/hosts/common.js";
+/**
+ * The status set fleet liveness events are permitted to advance *out of*. A
+ * `host.registered` acknowledges the daemon committed and may move a
+ * not-yet-committed row to `pending`; a `host.health-changed` (reachable) may
+ * advance `pending → active`. Neither may touch a `provisioning` row (the
+ * provision-settle edge is platform's) or a terminal row (`draining`/`retired`/
+ * `orphaned` — operator retirement is platform's). This is the fleet half of the
+ * transition partition documented in `../schemas/hosts/lifecycle.ts`; the
+ * platform half (`validateAdminStatusTransition`) stays admin-side.
+ */
+const FLEET_LIVENESS_FROM = ['pending', 'active'];
+/** Refusal reason when the fleet capabilities payload fails the platform schema. */
+const FLEET_CAPABILITIES_INVALID_REASON = 'fleet-capabilities-invalid';
+/**
+ * Map fleet reachability health onto the record's liveness `status` edge. Only a
+ * `reachable` host advances `pending → active`; a `degraded`/`unreachable`/
+ * `unknown` host records its health but does not regress status (retirement is
+ * the operator's job, not the projector's — platform.md §Target design). Returns
+ * `undefined` for "no status transition" so the patch records health alone.
+ */
+function statusForHealth(health) {
+    return health === 'reachable' ? 'active' : undefined;
+}
+/**
+ * Project a single `FleetHostEvent` into platform's host record via the writer
+ * port. This is the only boundary crossing in platform; it never calls back into
+ * fleet (it has no fleet handle to call — the import is types-only). Each event
+ * maps to exactly one record write (`host.health-changed` additionally meters
+ * billing off the same liveness signal).
+ *
+ * The exhaustive `switch` over the discriminated union means a new fleet event
+ * type fails the build here until it is given a projection — the boundary is the
+ * compiler's enforcement point.
+ */
+export async function projectFleetEvent(event, writer) {
+    const result = await settle(() => projectEvent(event, writer));
+    if (!result.ok) {
+        if (isCapabilityError(result.cause))
+            throw result.cause;
+        throw new CapabilityError('Fleet event projection failed.', 'INTERNAL', {
+            reason: 'fleet-projection-failed', cause: valueFreeFailure(result.cause)
+        });
+    }
+}
+function projectEvent(event, writer) {
+    switch (event.type) {
+        case 'host.registered': {
+            // Fleet says the daemon committed (provisioned or discovered). Platform
+            // records the `pending` transition + the routing metadata. The guard
+            // keeps a `provisioning` row in provisioning (the settle edge is
+            // platform's) and never reactivates a terminal row.
+            return writer.applyLifecycle(event.hostRecordId, {
+                status: 'pending',
+                expectStatusIn: FLEET_LIVENESS_FROM,
+                fleetHostId: event.hostId,
+                rpcId: event.rpcId,
+                origin: event.origin
+            });
+        }
+        case 'host.health-changed': {
+            // Fleet asserts reachability. A `reachable` host advances pending→active
+            // and meters billing off this liveness signal; any other health records
+            // the health value without regressing status. The race guard
+            // (FLEET_LIVENESS_FROM) means a health event for a `provisioning` host is
+            // ignored for status (acceptance #3).
+            const status = statusForHealth(event.health);
+            const patch = {
+                health: event.health,
+                lastHeartbeatAt: event.at
+            };
+            if (status !== undefined) {
+                patch.status = status;
+                patch.expectStatusIn = FLEET_LIVENESS_FROM;
+            }
+            let primary;
+            async function write(operation) {
+                const outcome = await settle(operation);
+                if (!outcome.ok && primary === undefined)
+                    primary = outcome.cause;
+            }
+            const writes = [write(() => writer.applyLifecycle(event.hostRecordId, patch))];
+            if (event.health === 'reachable') {
+                // Both acquisitions are protected, and neither failure releases the
+                // delivery until the other admitted write has settled.
+                writes.push(write(() => writer.recordBillingLiveness(event.hostRecordId, event.at)));
+            }
+            return Promise.all(writes).then(() => {
+                if (primary !== undefined)
+                    throw primary;
+            });
+        }
+        case 'host.capabilities-discovered': {
+            // Fleet resolved what the host can run; platform stores it on the record.
+            // No status transition. The projector parses fleet's loosely-typed
+            // payload against the platform schema at this boundary: an invalid
+            // payload is a typed refusal, never a cast the writer must defend.
+            // Unknown keys are stripped and schema defaults applied, so the
+            // writer always stores the canonical shape.
+            const admission = settleNow(() => hostCapabilitiesSchema.safeParse(event.capabilities));
+            if (!admission.ok) {
+                if (isCapabilityError(admission.cause))
+                    throw admission.cause;
+                throw new CapabilityError('The fleet capabilities payload could not be read.', 'INVALID_INPUT', {
+                    reason: FLEET_CAPABILITIES_INVALID_REASON, cause: valueFreeFailure(admission.cause)
+                });
+            }
+            const parsed = admission.value;
+            if (!parsed.success) {
+                // A rejection, never a sync throw: the subscriber calls this from
+                // the synchronous emitter, which must never see a throw.
+                return Promise.reject(new CapabilityError('The fleet capabilities payload failed validation.', 'INVALID_INPUT', {
+                    reason: FLEET_CAPABILITIES_INVALID_REASON,
+                    details: {
+                        issues: parsed.error.issues.map((issue) => ({
+                            path: issue.path.map((segment) => String(segment)),
+                            code: issue.code
+                        }))
+                    }
+                }));
+            }
+            return writer.applyLifecycle(event.hostRecordId, {
+                capabilities: parsed.data
+            });
+        }
+        default: {
+            // Exhaustiveness guard — a new FleetHostEvent type must be given a
+            // projection here or the build fails.
+            event;
+            return Promise.reject(new CapabilityError('The fleet event type is unsupported.', 'INVALID_INPUT', {
+                reason: 'fleet-event-invalid'
+            }));
+        }
+    }
+}
+/**
+ * Subscribe the platform projector to a fleet host-event source. `subscribe` is
+ * the fleet emitter's `subscribe` (`FleetHostEventEmitter.subscribe` from
+ * `@vibesdotdev/platform/fleets`) — platform receives events and projects them; it returns
+ * a stop handle that also removes lifecycle cleanup. Async projection failures are parsed to a
+ * `CaughtFailure` at this boundary and forwarded to the required `onError`
+ * sink, so a transient record-write failure neither throws into the
+ * synchronous emitter (which isolates throwing subscribers) nor goes silent:
+ * the sink is required, so there is no unsunk path.
+ *
+ * This is the wiring `apps/platform-web` (server) uses:
+ *
+ * ```ts
+ * import { subscribeFleetHostEvents } from '@vibesdotdev/platform/fleet-events';
+ * subscribeFleetHostEvents(fleetEmitter.subscribe, platformHostRecordWriter, (failure, event) => {
+ * 	reportProjectionFailure(failure, event);
+ * }, runtime);
+ * ```
+ */
+export function subscribeFleetHostEvents(subscribe, writer, onError, runtime) {
+    async function deliver(event) {
+        const projection = await settle(() => projectFleetEvent(event, writer));
+        if (projection.ok)
+            return;
+        const diagnostic = await settle(() => onError(projection.cause, event));
+        if (!diagnostic.ok) {
+            runtime.diagnostics.error('Fleet event projection failed.', {
+                scope: 'platform', plugin: 'platform.fleet-events', error: projection.cause
+            });
+            runtime.diagnostics.error('Fleet event failure notification failed.', {
+                scope: 'platform', plugin: 'platform.fleet-events', error: diagnostic.cause
+            });
+        }
+    }
+    let stopped = false;
+    const unsubscribe = subscribe((event) => {
+        if (stopped || runtime.lifecycle.signal.aborted)
+            return;
+        void runtime.lifecycle.own(() => deliver(event));
+    });
+    const stop = () => {
+        if (stopped)
+            return;
+        stopped = true;
+        runtime.lifecycle.signal.removeEventListener('abort', stop);
+        const outcome = settleNow(unsubscribe);
+        if (!outcome.ok)
+            runtime.diagnostics.error('Fleet event unsubscribe failed.', {
+                scope: 'platform', plugin: 'platform.fleet-events', error: outcome.cause
+            });
+    };
+    if (runtime.lifecycle.signal.aborted)
+        stop();
+    else
+        runtime.lifecycle.signal.addEventListener('abort', stop, { once: true });
+    return stop;
+}
+//# sourceMappingURL=subscriber.js.map

package/dist/fleet-events/subscriber.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscriber.js","sourceRoot":"","sources":["../../src/fleet-events/subscriber.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAMH,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAuC,MAAM,qBAAqB,CAAC;AACnJ,OAAO,EAAE,sBAAsB,EAAyC,MAAM,4BAA4B,CAAC;AAqE3G;;;;;;;;;GASG;AACH,MAAM,mBAAmB,GAAyB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAExE,oFAAoF;AACpF,MAAM,iCAAiC,GAAG,4BAA4B,CAAC;AAEvE;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,MAAuB;IAC/C,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,KAAqB,EACrB,MAAgC;IAEhC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,MAAM,CAAC,KAAK,CAAC;QACxD,MAAM,IAAI,eAAe,CAAC,gCAAgC,EAAE,UAAU,EAAE;YACvE,MAAM,EAAE,yBAAyB,EAAE,KAAK,EAAE,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC;SACxE,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AAED,SAAS,YAAY,CACpB,KAAqB,EACrB,MAAgC;IAEhC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACxB,wEAAwE;YACxE,qEAAqE;YACrE,iEAAiE;YACjE,oDAAoD;YACpD,OAAO,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,YAAY,EAAE;gBAChD,MAAM,EAAE,SAAS;gBACjB,cAAc,EAAE,mBAAmB;gBACnC,WAAW,EAAE,KAAK,CAAC,MAAM;gBACzB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;aACpB,CAAC,CAAC;QACJ,CAAC;QACD,KAAK,qBAAqB,CAAC,CAAC,CAAC;YAC5B,yEAAyE;YACzE,wEAAwE;YACxE,6DAA6D;YAC7D,0EAA0E;YAC1E,sCAAsC;YACtC,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAuB;gBACjC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,eAAe,EAAE,KAAK,CAAC,EAAE;aACzB,CAAC;YACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;gBACtB,KAAK,CAAC,cAAc,GAAG,mBAAmB,CAAC;YAC5C,CAAC;YACD,IAAI,OAAkC,CAAC;YACvC,KAAK,UAAU,KAAK,CAAC,SAA8B;gBAClD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;gBACxC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;YACnE,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YAC/E,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,oEAAoE;gBACpE,uDAAuD;gBACvD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACtF,CAAC;YACD,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;gBACpC,IAAI,OAAO,KAAK,SAAS;oBAAE,MAAM,OAAO,CAAC;YAC1C,CAAC,CAAC,CAAC;QACJ,CAAC;QACD,KAAK,8BAA8B,CAAC,CAAC,CAAC;YACrC,0EAA0E;YAC1E,mEAAmE;YACnE,mEAAmE;YACnE,mEAAmE;YACnE,gEAAgE;YAChE,4CAA4C;YAC5C,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;YACxF,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;gBACnB,IAAI,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC;oBAAE,MAAM,SAAS,CAAC,KAAK,CAAC;gBAC9D,MAAM,IAAI,eAAe,CAAC,mDAAmD,EAAE,eAAe,EAAE;oBAC/F,MAAM,EAAE,iCAAiC,EAAE,KAAK,EAAE,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC;iBACnF,CAAC,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACrB,kEAAkE;gBAClE,yDAAyD;gBACzD,OAAO,OAAO,CAAC,MAAM,CACpB,IAAI,eAAe,CAAC,mDAAmD,EAAE,eAAe,EAAE;oBACzF,MAAM,EAAE,iCAAiC;oBACzC,OAAO,EAAE;wBACT,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;4BAC3C,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;4BAClD,IAAI,EAAE,KAAK,CAAC,IAAI;yBAChB,CAAC,CAAC;qBACH;iBACA,CAAC,CACF,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,YAAY,EAAE;gBAChD,YAAY,EAAE,MAAM,CAAC,IAAI;aACzB,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACT,mEAAmE;YACnE,sCAAsC;YACtC,KAAqB,CAAC;YACtB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,sCAAsC,EAAE,eAAe,EAAE;gBAClG,MAAM,EAAE,qBAAqB;aAC7B,CAAC,CAAC,CAAC;QACL,CAAC;IACF,CAAC;AACF,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,wBAAwB,CACvC,SAAoE,EACpE,MAAgC,EAChC,OAAgE,EAChE,OAAmB;IAEnB,KAAK,UAAU,OAAO,CAAC,KAAqB;QAC3C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QACxE,IAAI,UAAU,CAAC,EAAE;YAAE,OAAO;QAC1B,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBAC3D,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,uBAAuB,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK;aAC3E,CAAC,CAAC;YACH,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,0CAA0C,EAAE;gBACrE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,uBAAuB,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK;aAC3E,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;QACvC,IAAI,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QACxD,KAAK,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,GAAG,EAAE;QACjB,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,iCAAiC,EAAE;gBAC7E,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,uBAAuB,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK;aACxE,CAAC,CAAC;IACJ,CAAC,CAAC;IACF,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO;QAAE,IAAI,EAAE,CAAC;;QACxC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACb,CAAC"}

package/dist/fleets/acting-org.d.ts

@@ -0,0 +1,12 @@
+import type { VibesRuntime } from '@vibesdotdev/kernel';
+/**
+ * The organization this CLI acts in: the value `vibes account set-org`
+ * persisted, or null for the personal workspace.
+ *
+ * A Bearer-JWT caller has no `activeOrg` cookie, so without an explicit
+ * `x-vibes-active-org` it can only ever act in its personal workspace —
+ * `vibes fleet enroll-token create` once registered every machine under the
+ * user even with an active org set.
+ */
+export declare function resolveStoredActingOrgId(runtime: VibesRuntime): Promise<string | null>;
+//# sourceMappingURL=acting-org.d.ts.map

package/dist/fleets/acting-org.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acting-org.d.ts","sourceRoot":"","sources":["../../src/fleets/acting-org.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAK5F"}

package/dist/fleets/acting-org.js

@@ -0,0 +1,17 @@
+import { ActingOrgConfigSchema } from "../schemas/fleet-cli.js";
+/**
+ * The organization this CLI acts in: the value `vibes account set-org`
+ * persisted, or null for the personal workspace.
+ *
+ * A Bearer-JWT caller has no `activeOrg` cookie, so without an explicit
+ * `x-vibes-active-org` it can only ever act in its personal workspace —
+ * `vibes fleet enroll-token create` once registered every machine under the
+ * user even with an active org set.
+ */
+export async function resolveStoredActingOrgId(runtime) {
+    const { loadConfigForScope } = await import('@vibesdotdev/config/services/config');
+    // The global config file the handed runtime's roots name (config's own reader).
+    const config = await loadConfigForScope('global', runtime);
+    return ActingOrgConfigSchema.parse(config).activeOrgId ?? null;
+}
+//# sourceMappingURL=acting-org.js.map

package/dist/fleets/acting-org.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acting-org.js","sourceRoot":"","sources":["../../src/fleets/acting-org.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAAqB;IACnE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,qCAAqC,CAAC,CAAC;IACnF,gFAAgF;IAChF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3D,OAAO,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC;AAChE,CAAC"}

package/dist/fleets/bootstrap/index.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Fleet discovery bootstrap (hqx-w1-fleet, item 1).
+ *
+ * A real consumable that takes adapter instances + the reachable-runtime registry
+ * and runs the discovery loop:
+ *
+ *   - Initial sweep: all adapters run concurrently; errors are isolated (one bad
+ *     adapter never kills the loop — correction #4 / fleet.md §4.6).
+ *   - Periodic refresh: each adapter re-sweeps on `refreshIntervalMs` (default
+ *     60 000 ms), a tick on the owning runtime's lifecycle (RC07) that its
+ *     disposal clears; a sweep still running when the tick fires is not
+ *     overlapped. A finite host refuses the tick (`lifecycle-interval-finite`):
+ *     it passes `refreshIntervalMs: Infinity` and refreshes on demand. The
+ *     registry upserts by `rpc.id` so stale entries are replaced.
+ *   - Health TTL eviction: entries whose `registeredAt + ttlSeconds` have elapsed
+ *     are removed on each refresh cycle (fleet.md §10 open-question 1 — discovered
+ *     entries are evictable; provisioned/sticky entries carry no `ttlSeconds`).
+ *   - Teardown: the loop stops when the caller's signal fires or the owning
+ *     runtime begins disposal.
+ *
+ * Factory helpers construct the three standard adapters with their real deps:
+ *   Adapter construction lives with each adapter package
+ *   (fleet-pairing-direct/-platform/-mdns); consumers wire them directly.
+ *
+ * The bootstrap is a PURE function: it returns a `FleetBootstrap` handle rather
+ * than mutating any global state so tests can run multiple instances and consumer
+ * wiring can own the lifecycle.
+ */
+import { type RuntimeLifecycle } from '@vibesdotdev/kernel';
+import type { FleetDiscoveryAdapter } from '../discovery-contract.ts';
+import type { ReachableRuntimeRegistry } from '../registry/reachable-runtime.ts';
+/** Options that tune the bootstrap loop. */
+export interface FleetBootstrapOptions {
+    /**
+     * The owning runtime's lifecycle (`runtime.lifecycle`): the refresh tick is
+     * its interval, and its disposal stops the loop.
+     */
+    readonly lifecycle: Pick<RuntimeLifecycle, 'interval' | 'signal'>;
+    /**
+     * How long (ms) between periodic refresh sweeps. Default 60 000 (one minute).
+     * Set to `Infinity` to disable periodic refresh after the initial sweep.
+     */
+    readonly refreshIntervalMs?: number;
+    /**
+     * Override TTL (seconds) for discovered entries, applied when an adapter does
+     * not advertise its own TTL. Default = `DEFAULT_DISCOVERED_TTL_SECONDS` (120).
+     * Set to `0` to disable TTL eviction for all adapters.
+     */
+    readonly ttlSeconds?: number;
+    /**
+     * An optional logger for adapter errors and lifecycle events. Receives
+     * structured log records so the caller can route them to any logging surface.
+     */
+    readonly onEvent?: (ev: BootstrapEvent) => void;
+}
+/** Lifecycle/error events emitted by the bootstrap loop. */
+export type BootstrapEvent = {
+    type: 'sweep-start';
+    adapterId: string;
+    cycle: number;
+} | {
+    type: 'sweep-complete';
+    adapterId: string;
+    cycle: number;
+    registered: number;
+} | {
+    type: 'sweep-error';
+    adapterId: string;
+    cycle: number;
+    error: unknown;
+} | {
+    type: 'eviction';
+    rpcId: string;
+    ttlSeconds: number;
+    ageSeconds: number;
+} | {
+    type: 'stopped';
+};
+/** A running fleet bootstrap handle. */
+export interface FleetBootstrap {
+    /**
+     * Trigger an immediate out-of-band refresh across all adapters (bypasses the
+     * normal interval timer). Useful when the caller knows the topology just
+     * changed (e.g. a new pairing just completed). Returns the number of
+     * descriptors registered across all adapters in this sweep.
+     */
+    refresh(): Promise<number>;
+    /** Gracefully stop the bootstrap loop. Idempotent. */
+    stop(): void;
+    /** Whether the loop is still running. */
+    readonly running: boolean;
+}
+/**
+ * Start the fleet discovery bootstrap loop. Takes adapter instances + the
+ * reachable-runtime registry and drives the discovery loop: initial sweep,
+ * periodic refresh (on `refreshIntervalMs`), health TTL eviction, and per-adapter
+ * error isolation so one bad adapter never kills the loop.
+ *
+ * Returns a `FleetBootstrap` handle for manual refresh and teardown.
+ * Pass `signal` (an `AbortSignal`) for graceful shutdown (e.g. process-exit).
+ */
+export declare function startFleetBootstrap(adapters: readonly FleetDiscoveryAdapter[], registry: ReachableRuntimeRegistry, options: FleetBootstrapOptions & {
+    signal?: AbortSignal;
+}): FleetBootstrap;
+export type { FleetDiscoveryAdapter } from '../discovery-contract.ts';
+export type { ReachableRuntimeRegistry, ReachableRuntimeEntry } from '../registry/reachable-runtime.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/fleets/bootstrap/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/fleets/bootstrap/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAU,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEtE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAIjF,4CAA4C;AAC5C,MAAM,WAAW,qBAAqB;IACrC;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,GAAG,QAAQ,CAAC,CAAC;IAClE;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,cAAc,KAAK,IAAI,CAAC;CAChD;AAED,4DAA4D;AAC5D,MAAM,MAAM,cAAc,GACvB;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAChF;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACzE;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC3E;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AAEvB,wCAAwC;AACxC,MAAM,WAAW,cAAc;IAC9B;;;;;OAKG;IACH,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,sDAAsD;IACtD,IAAI,IAAI,IAAI,CAAC;IACb,yCAAyC;IACzC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC1B;AAgDD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAClC,QAAQ,EAAE,SAAS,qBAAqB,EAAE,EAC1C,QAAQ,EAAE,wBAAwB,EAClC,OAAO,EAAE,qBAAqB,GAAG;IAAE,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GACvD,cAAc,CA8EhB;AAKD,YAAY,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACtE,YAAY,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/fleets/bootstrap/index.js

@@ -0,0 +1,147 @@
+/**
+ * Fleet discovery bootstrap (hqx-w1-fleet, item 1).
+ *
+ * A real consumable that takes adapter instances + the reachable-runtime registry
+ * and runs the discovery loop:
+ *
+ *   - Initial sweep: all adapters run concurrently; errors are isolated (one bad
+ *     adapter never kills the loop — correction #4 / fleet.md §4.6).
+ *   - Periodic refresh: each adapter re-sweeps on `refreshIntervalMs` (default
+ *     60 000 ms), a tick on the owning runtime's lifecycle (RC07) that its
+ *     disposal clears; a sweep still running when the tick fires is not
+ *     overlapped. A finite host refuses the tick (`lifecycle-interval-finite`):
+ *     it passes `refreshIntervalMs: Infinity` and refreshes on demand. The
+ *     registry upserts by `rpc.id` so stale entries are replaced.
+ *   - Health TTL eviction: entries whose `registeredAt + ttlSeconds` have elapsed
+ *     are removed on each refresh cycle (fleet.md §10 open-question 1 — discovered
+ *     entries are evictable; provisioned/sticky entries carry no `ttlSeconds`).
+ *   - Teardown: the loop stops when the caller's signal fires or the owning
+ *     runtime begins disposal.
+ *
+ * Factory helpers construct the three standard adapters with their real deps:
+ *   Adapter construction lives with each adapter package
+ *   (fleet-pairing-direct/-platform/-mdns); consumers wire them directly.
+ *
+ * The bootstrap is a PURE function: it returns a `FleetBootstrap` handle rather
+ * than mutating any global state so tests can run multiple instances and consumer
+ * wiring can own the lifecycle.
+ */
+import { settle } from '@vibesdotdev/kernel';
+import { registerDiscovered } from "../discovery-contract.js";
+// --- eviction helpers -------------------------------------------------------
+function evictStaleEntries(registry, onEvent) {
+    const now = Date.now();
+    for (const entry of registry.all()) {
+        if (entry.ttlSeconds === undefined || entry.ttlSeconds <= 0)
+            continue;
+        const registeredMs = new Date(entry.registeredAt).getTime();
+        const ageSeconds = (now - registeredMs) / 1000;
+        if (ageSeconds >= entry.ttlSeconds) {
+            registry.deregister(entry.rpc.id);
+            onEvent?.({
+                type: 'eviction',
+                rpcId: entry.rpc.id,
+                ttlSeconds: entry.ttlSeconds,
+                ageSeconds: Math.round(ageSeconds)
+            });
+        }
+    }
+}
+// --- core sweep -------------------------------------------------------------
+async function runAdapterSweep(adapter, registry, cycle, options, signal) {
+    const { ttlSeconds, onEvent } = options;
+    onEvent?.({ type: 'sweep-start', adapterId: adapter.id, cycle });
+    const result = await settle(() => registerDiscovered(adapter, registry, { signal, ttlSeconds }));
+    if (result.ok) {
+        onEvent?.({ type: 'sweep-complete', adapterId: adapter.id, cycle, registered: result.value.length });
+        return result.value.length;
+    }
+    onEvent?.({ type: 'sweep-error', adapterId: adapter.id, cycle, error: result.cause });
+    return 0;
+}
+// --- bootstrap factory -------------------------------------------------------
+/**
+ * Start the fleet discovery bootstrap loop. Takes adapter instances + the
+ * reachable-runtime registry and drives the discovery loop: initial sweep,
+ * periodic refresh (on `refreshIntervalMs`), health TTL eviction, and per-adapter
+ * error isolation so one bad adapter never kills the loop.
+ *
+ * Returns a `FleetBootstrap` handle for manual refresh and teardown.
+ * Pass `signal` (an `AbortSignal`) for graceful shutdown (e.g. process-exit).
+ */
+export function startFleetBootstrap(adapters, registry, options) {
+    const { refreshIntervalMs = 60_000, onEvent, signal, lifecycle } = options;
+    let stopped = false;
+    let cycleCounter = 0;
+    let stopTick;
+    // Teardown sources: the caller's signal and the owning runtime's disposal.
+    const abortController = new AbortController();
+    const onAbort = () => stop();
+    signal?.addEventListener('abort', onAbort, { once: true });
+    lifecycle.signal.addEventListener('abort', onAbort, { once: true });
+    function stop() {
+        if (stopped)
+            return;
+        stopped = true;
+        abortController.abort();
+        stopTick?.();
+        stopTick = undefined;
+        signal?.removeEventListener('abort', onAbort);
+        lifecycle.signal.removeEventListener('abort', onAbort);
+        onEvent?.({ type: 'stopped' });
+    }
+    async function sweep() {
+        const cycle = ++cycleCounter;
+        const innerSignal = abortController.signal;
+        // Evict stale entries before the new sweep so the registry is consistent.
+        evictStaleEntries(registry, onEvent);
+        // Run all adapters concurrently; errors are isolated per adapter.
+        const counts = await Promise.all(adapters.map((adapter) => runAdapterSweep(adapter, registry, cycle, { ttlSeconds: options.ttlSeconds, onEvent }, innerSignal)));
+        return counts.reduce((a, b) => a + b, 0);
+    }
+    /** One scheduled sweep; a tick that finds the previous sweep still running is skipped. */
+    let inFlight = null;
+    function scheduledSweep() {
+        if (stopped || inFlight)
+            return;
+        const cycle = cycleCounter + 1;
+        inFlight = (async () => {
+            const result = await settle(sweep);
+            if (result.ok)
+                return result.value;
+            onEvent?.({ type: 'sweep-error', adapterId: '__bootstrap__', cycle, error: result.cause });
+            return 0;
+        })().finally(() => { inFlight = null; });
+    }
+    if (signal?.aborted || lifecycle.signal.aborted) {
+        stop();
+    }
+    else {
+        // The periodic tick is armed first so a finite host's refusal surfaces
+        // before any sweep starts.
+        if (refreshIntervalMs !== Infinity) {
+            try {
+                stopTick = lifecycle.interval(scheduledSweep, refreshIntervalMs);
+            }
+            catch (error) {
+                // Release the teardown listeners, then surface the refusal.
+                stop();
+                throw error;
+            }
+        }
+        // Initial sweep (the caller can await `refresh()` for its own sweep).
+        scheduledSweep();
+    }
+    return {
+        async refresh() {
+            if (stopped)
+                return 0;
+            return sweep();
+        },
+        stop,
+        get running() {
+            return !stopped;
+        }
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/fleets/bootstrap/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/fleets/bootstrap/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,MAAM,EAAyB,MAAM,qBAAqB,CAAC;AAEpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAqD9D,+EAA+E;AAE/E,SAAS,iBAAiB,CACzB,QAAkC,EAClC,OAA0C;IAE1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC;YAAE,SAAS;QACtE,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;QAC5D,MAAM,UAAU,GAAG,CAAC,GAAG,GAAG,YAAY,CAAC,GAAG,IAAI,CAAC;QAC/C,IAAI,UAAU,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACpC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClC,OAAO,EAAE,CAAC;gBACT,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE;gBACnB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;aAClC,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;AACF,CAAC;AAED,+EAA+E;AAE/E,KAAK,UAAU,eAAe,CAC7B,OAA8B,EAC9B,QAAkC,EAClC,KAAa,EACb,OAA8D,EAC9D,MAAoB;IAEpB,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACxC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IACjG,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACrG,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACtF,OAAO,CAAC,CAAC;AAEV,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAClC,QAA0C,EAC1C,QAAkC,EAClC,OAAyD;IAEzD,MAAM,EAAE,iBAAiB,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAC3E,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,QAAkC,CAAC;IAEvC,2EAA2E;IAC3E,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;IAC9C,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpE,SAAS,IAAI;QACZ,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,eAAe,CAAC,KAAK,EAAE,CAAC;QACxB,QAAQ,EAAE,EAAE,CAAC;QACb,QAAQ,GAAG,SAAS,CAAC;QACrB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,SAAS,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACvD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,UAAU,KAAK;QACnB,MAAM,KAAK,GAAG,EAAE,YAAY,CAAC;QAC7B,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC;QAC3C,0EAA0E;QAC1E,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACrC,kEAAkE;QAClE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CACxB,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,WAAW,CAAC,CACnG,CACD,CAAC;QACF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,0FAA0F;IAC1F,IAAI,QAAQ,GAA2B,IAAI,CAAC;IAC5C,SAAS,cAAc;QACtB,IAAI,OAAO,IAAI,QAAQ;YAAE,OAAO;QAChC,MAAM,KAAK,GAAG,YAAY,GAAG,CAAC,CAAC;QAC/B,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;YACtB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC;YACnC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YAC3F,OAAO,CAAC,CAAC;QACV,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,MAAM,EAAE,OAAO,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACjD,IAAI,EAAE,CAAC;IACR,CAAC;SAAM,CAAC;QACP,uEAAuE;QACvE,2BAA2B;QAC3B,IAAI,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC;gBACJ,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;YAClE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,4DAA4D;gBAC5D,IAAI,EAAE,CAAC;gBACP,MAAM,KAAK,CAAC;YACb,CAAC;QACF,CAAC;QACD,sEAAsE;QACtE,cAAc,EAAE,CAAC;IAClB,CAAC;IAED,OAAO;QACN,KAAK,CAAC,OAAO;YACZ,IAAI,OAAO;gBAAE,OAAO,CAAC,CAAC;YACtB,OAAO,KAAK,EAAE,CAAC;QAChB,CAAC;QACD,IAAI;QACJ,IAAI,OAAO;YACV,OAAO,CAAC,OAAO,CAAC;QACjB,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/fleets/bound-tool.d.ts

@@ -0,0 +1,10 @@
+import { type VibesRuntime, type ToolCallContext } from '@vibesdotdev/kernel';
+import { type RpcDecoded } from '@vibesdotdev/kernel-rpc';
+import type { FleetClientContract, FleetRequestScope } from './client.ts';
+/** Resolve only caller-owned, relay-reachable hosts. The JWT is scoped to this call. */
+export declare function boundToolRequestScope(runtime: VibesRuntime, ctx: ToolCallContext, options?: {
+    requireCallerBearer?: boolean;
+}): Promise<FleetRequestScope>;
+export type BoundToolCallContext = Pick<ToolCallContext, 'callId' | 'metadata' | 'caller' | 'workspace'>;
+export declare function invokeBoundTool<Input>(_runtime: VibesRuntime, fleet: FleetClientContract, hostId: string, toolId: string, input: Input, ctx: ToolCallContext): Promise<RpcDecoded>;
+//# sourceMappingURL=bound-tool.d.ts.map

package/dist/fleets/bound-tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bound-tool.d.ts","sourceRoot":"","sources":["../../src/fleets/bound-tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EAA+B,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAcvF,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAS1E,wFAAwF;AACxF,wBAAsB,qBAAqB,CAC1C,OAAO,EAAE,YAAY,EACrB,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE;IAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC7C,OAAO,CAAC,iBAAiB,CAAC,CAoG5B;AAED,MAAM,MAAM,oBAAoB,GAAG,IAAI,CACtC,eAAe,EACf,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,CAC9C,CAAC;AAQF,wBAAsB,eAAe,CAAC,KAAK,EAC1C,QAAQ,EAAE,YAAY,EACtB,KAAK,EAAE,mBAAmB,EAC1B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,eAAe,GAClB,OAAO,CAAC,UAAU,CAAC,CA4CrB"}