@vibesdotdev/platform 0.0.0-stage → 1.0.0-rc.1

package/dist/fleets/merged-view.d.ts

@@ -0,0 +1,129 @@
+/**
+ * D4 convergence utility: merge platform host records with live reachability
+ * from the runtime registry (fleet.md §D4).
+ *
+ * Platform records answer "what hosts exist and are enrolled?" — they are the
+ * canonical inventory, written by the daemon agent and the platform API.
+ *
+ * The runtime registry answers "which of those hosts is reachable right now?" —
+ * it is a live view populated by the fleet bootstrap adapters.
+ *
+ * A merged view is a platform record ANNOTATED with live reachability. This is
+ * the authoritative view for both the dashboard fleet tile and the /fleet page.
+ * Once consumed everywhere, `vibosos-fleet.ts` (the old platform-only path) can
+ * be deleted.
+ *
+ * EXPORTED from fleet so both apps share one implementation. Apps own
+ * only the final UI projection mapping.
+ */
+import * as z from 'zod/v4';
+import { type HostState } from '../schemas/hosts/common.ts';
+/**
+ * The fleet daemon the CLI runs heartbeats every 60 s by default
+ * (`fleet daemon --heartbeat-interval`, default 60 in fleet.daemon.command.impl.ts).
+ * A host is "heartbeat fresh" if its last heartbeat is within 3× that — 180 s —
+ * giving 2 missed beats of grace before flipping to degraded.
+ *
+ * This is the SINGLE source of truth for the liveness window across the suite:
+ * `vibes fleet status` imports it too, so the web tile and the CLI never disagree
+ * about whether a non-relay host is online. (Relay hosts are driven by the
+ * broker-written `relayReachable`, independent of heartbeat freshness.)
+ */
+export declare const HEARTBEAT_FRESH_THRESHOLD_MS = 180000;
+declare const platformHostCapabilitiesSchema: z.ZodObject<{
+    os: z.ZodOptional<z.ZodString>;
+}, z.core.$catchall<z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>;
+type PlatformHostCapabilities = z.infer<typeof platformHostCapabilitiesSchema>;
+/** A raw platform host record (minimal shape — what the platform client returns). */
+export interface PlatformHostRecord {
+    /** Platform-unique row id (UUID). */
+    id: string;
+    /** Stable kebab-case host id used by the runtime/rpc descriptor. */
+    hostId: string;
+    /** Human-readable name. */
+    name: string;
+    /** Lifecycle state on the platform record. */
+    status: HostState;
+    /** ISO timestamp of the last daemon heartbeat, or null if never. */
+    lastHeartbeatAt: string | null;
+    /**
+     * Whether the host's daemon currently holds a live relay socket to the broker
+     * DO. This is the AUTHORITATIVE presence signal (fleet-relay D-R1): the broker
+     * writes it true on connect / false on `webSocketClose`, so "Online" is a
+     * byproduct of socket state — no polling, no separate liveness probe. Drives
+     * `reachable` in the merge directly, independent of the runtime registry seed.
+     */
+    relayReachable?: boolean;
+    /** How the host was added — 'consumer' is BYO, 'cloud' is provisioned. */
+    environment?: 'consumer' | 'cloud';
+    /** Capabilities blob from the last heartbeat. */
+    capabilities?: PlatformHostCapabilities;
+    /** ISO timestamps */
+    createdAt: string;
+    updatedAt?: string | null;
+}
+/** Whether the host is currently reachable via the runtime registry. */
+export type HostReachability = 'reachable' | 'unreachable' | 'unknown';
+/**
+ * A platform host record merged with its live reachability from the runtime
+ * registry. This is the D4 convergence view.
+ */
+export interface MergedFleetHost {
+    /** Platform row id. */
+    id: string;
+    /** Stable host id (kebab). */
+    hostId: string;
+    name: string;
+    /**
+     * Coarse display status, derived from both platform state and live
+     * reachability:
+     *
+     *   - `online`   — platform `active` + registry `reachable` (relay-connected)
+     *   - `active`   — platform `active` + not relay-reachable + heartbeat fresh
+     *                  (daemon is reporting in; relay not yet connected)
+     *   - `degraded` — platform `active` + not relay-reachable + heartbeat stale
+     *                  (enrolled, was recently active, but heartbeat has lapsed)
+     *   - `pending`  — platform `pending` or `provisioning` (not yet enrolled)
+     *   - `offline`  — platform `pausing`, `paused`, `retired`, `draining`, or `orphaned`
+     *   - `unknown`  — reachability not yet probed and no fresh heartbeat
+     */
+    displayStatus: 'online' | 'active' | 'degraded' | 'pending' | 'offline' | 'unknown';
+    /** Whether the host is reachable in the runtime registry right now. */
+    reachability: HostReachability;
+    /** Platform record lifecycle state. */
+    platformStatus: PlatformHostRecord['status'];
+    /**
+     * How the host entered the fleet.
+     *
+     * - `'Added by you'` — BYO machine enrolled via the daemon CLI
+     * - `'From your account'` — cloud-provisioned machine
+     * - `'Direct address'` — added by direct address (consumer only)
+     */
+    addedBy: 'Added by you' | 'From your account' | 'Direct address';
+    /** ISO timestamp of the last known heartbeat or health probe. */
+    lastSeen: string | null;
+    /** Operating system label from capabilities (optional). */
+    os?: string;
+}
+/**
+ * Returns true if the ISO timestamp is within the heartbeat-fresh threshold.
+ * Exported for use in tests and UI helpers that need the same logic.
+ */
+export declare function isHeartbeatFresh(lastHeartbeatAt: string | null, nowMs?: number, thresholdMs?: number): boolean;
+/**
+ * Merge a list of platform host records with a set of reachable runtime ids.
+ *
+ * The `reachableIds` set contains the `hostId` values found in the runtime
+ * registry (i.e. `query('fleet/host').descriptors().map(d => d.hostId)`).
+ * When a host id is in the set, the host is reachable; otherwise the display
+ * status falls back to heartbeat freshness before degraded/unknown.
+ *
+ * This is a pure data transform — no async, no network. Callers resolve
+ * `reachableIds` from the runtime and pass it in.
+ *
+ * @param nowMs - Override the current time (default: `Date.now()`). Useful in
+ *                tests to avoid time-sensitive failures.
+ */
+export declare function mergePlatformWithReachability(platformRecords: readonly PlatformHostRecord[], reachableIds: ReadonlySet<string>, nowMs?: number): MergedFleetHost[];
+export {};
+//# sourceMappingURL=merged-view.d.ts.map

package/dist/fleets/merged-view.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"merged-view.d.ts","sourceRoot":"","sources":["../../src/fleets/merged-view.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAA0B,KAAK,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAEpF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,SAAU,CAAC;AAEpD,QAAA,MAAM,8BAA8B;;qQAAsE,CAAC;AAC3G,KAAK,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAE/E,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IAClC,qCAAqC;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,MAAM,EAAE,SAAS,CAAC;IAClB,oEAAoE;IACpE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,0EAA0E;IAC1E,WAAW,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC;IACnC,iDAAiD;IACjD,YAAY,CAAC,EAAE,wBAAwB,CAAC;IACxC,qBAAqB;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,wEAAwE;AACxE,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,aAAa,GAAG,SAAS,CAAC;AAEvE;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC/B,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IACpF,uEAAuE;IACvE,YAAY,EAAE,gBAAgB,CAAC;IAC/B,uCAAuC;IACvC,cAAc,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC7C;;;;;;OAMG;IACH,OAAO,EAAE,cAAc,GAAG,mBAAmB,GAAG,gBAAgB,CAAC;IACjE,iEAAiE;IACjE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,2DAA2D;IAC3D,EAAE,CAAC,EAAE,MAAM,CAAC;CACZ;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC/B,eAAe,EAAE,MAAM,GAAG,IAAI,EAC9B,KAAK,GAAE,MAAmB,EAC1B,WAAW,GAAE,MAAqC,GAChD,OAAO,CAKT;AAoCD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,CAC5C,eAAe,EAAE,SAAS,kBAAkB,EAAE,EAC9C,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,EACjC,KAAK,GAAE,MAAmB,GACxB,eAAe,EAAE,CAuCnB"}

package/dist/fleets/merged-view.js

@@ -0,0 +1,130 @@
+/**
+ * D4 convergence utility: merge platform host records with live reachability
+ * from the runtime registry (fleet.md §D4).
+ *
+ * Platform records answer "what hosts exist and are enrolled?" — they are the
+ * canonical inventory, written by the daemon agent and the platform API.
+ *
+ * The runtime registry answers "which of those hosts is reachable right now?" —
+ * it is a live view populated by the fleet bootstrap adapters.
+ *
+ * A merged view is a platform record ANNOTATED with live reachability. This is
+ * the authoritative view for both the dashboard fleet tile and the /fleet page.
+ * Once consumed everywhere, `vibosos-fleet.ts` (the old platform-only path) can
+ * be deleted.
+ *
+ * EXPORTED from fleet so both apps share one implementation. Apps own
+ * only the final UI projection mapping.
+ */
+import * as z from 'zod/v4';
+import { JsonValueSchema } from '@vibesdotdev/kernel/schemas/json';
+import { hostCapabilitiesSchema } from "../schemas/hosts/common.js";
+/**
+ * The fleet daemon the CLI runs heartbeats every 60 s by default
+ * (`fleet daemon --heartbeat-interval`, default 60 in fleet.daemon.command.impl.ts).
+ * A host is "heartbeat fresh" if its last heartbeat is within 3× that — 180 s —
+ * giving 2 missed beats of grace before flipping to degraded.
+ *
+ * This is the SINGLE source of truth for the liveness window across the suite:
+ * `vibes fleet status` imports it too, so the web tile and the CLI never disagree
+ * about whether a non-relay host is online. (Relay hosts are driven by the
+ * broker-written `relayReachable`, independent of heartbeat freshness.)
+ */
+export const HEARTBEAT_FRESH_THRESHOLD_MS = 180_000;
+const platformHostCapabilitiesSchema = hostCapabilitiesSchema.pick({ os: true }).catchall(JsonValueSchema);
+/**
+ * Returns true if the ISO timestamp is within the heartbeat-fresh threshold.
+ * Exported for use in tests and UI helpers that need the same logic.
+ */
+export function isHeartbeatFresh(lastHeartbeatAt, nowMs = Date.now(), thresholdMs = HEARTBEAT_FRESH_THRESHOLD_MS) {
+    if (!lastHeartbeatAt)
+        return false;
+    const ts = Date.parse(lastHeartbeatAt);
+    if (isNaN(ts))
+        return false;
+    return nowMs - ts <= thresholdMs;
+}
+/**
+ * Map a platform record + live reachability + heartbeat freshness to the
+ * coarse display status.
+ *
+ * Decision matrix for `active` platform records:
+ *   reachable                      → 'online'   (relay-connected, strongest)
+ *   not reachable + fresh hb       → 'active'   (reporting in, relay not yet connected)
+ *   not reachable + stale hb       → 'degraded' (was active, has since gone silent)
+ *   not reachable + null hb        → 'unknown'  (enrolled but never sent a heartbeat)
+ */
+function deriveDisplayStatus(platformStatus, reachability, heartbeatFresh, hasHeartbeat) {
+    if (platformStatus === 'pending' || platformStatus === 'provisioning')
+        return 'pending';
+    if (platformStatus !== 'active')
+        return 'offline';
+    // active platform record
+    if (reachability === 'reachable')
+        return 'online';
+    if (heartbeatFresh)
+        return 'active';
+    if (hasHeartbeat)
+        return 'degraded'; // had one, now stale
+    return 'unknown'; // enrolled but no heartbeat ever seen
+}
+/**
+ * Map a platform record's environment field to the human-readable addedBy label.
+ * 'consumer' = BYO machine (enrolled), 'cloud' = provisioned VM.
+ */
+function deriveAddedBy(environment) {
+    if (environment === 'cloud')
+        return 'From your account';
+    return 'Added by you';
+}
+/**
+ * Merge a list of platform host records with a set of reachable runtime ids.
+ *
+ * The `reachableIds` set contains the `hostId` values found in the runtime
+ * registry (i.e. `query('fleet/host').descriptors().map(d => d.hostId)`).
+ * When a host id is in the set, the host is reachable; otherwise the display
+ * status falls back to heartbeat freshness before degraded/unknown.
+ *
+ * This is a pure data transform — no async, no network. Callers resolve
+ * `reachableIds` from the runtime and pass it in.
+ *
+ * @param nowMs - Override the current time (default: `Date.now()`). Useful in
+ *                tests to avoid time-sensitive failures.
+ */
+export function mergePlatformWithReachability(platformRecords, reachableIds, nowMs = Date.now()) {
+    return platformRecords.map((record) => {
+        // Paused, pausing, and terminal hosts cannot accept work, even if the
+        // relay flag or registry seed still reflects their prior connection.
+        const unavailable = record.status === 'pausing' ||
+            record.status === 'paused' ||
+            record.status === 'retired' ||
+            record.status === 'draining' ||
+            record.status === 'orphaned';
+        // Relay presence (broker-written, D-R1) is the authoritative "reachable now"
+        // signal; the runtime-registry seed is a secondary source. Either one marks
+        // the host reachable. (Previously only the registry seed counted, and the
+        // hq-web seeder filtered on a nonexistent `daemonEndpoint` field → it was
+        // always empty → every host read "offline" forever.)
+        const reachability = unavailable
+            ? 'unreachable'
+            : record.relayReachable || reachableIds.has(record.hostId)
+                ? 'reachable'
+                : record.status === 'active'
+                    ? 'unreachable'
+                    : 'unknown';
+        const heartbeatFresh = isHeartbeatFresh(record.lastHeartbeatAt, nowMs);
+        const hasHeartbeat = record.lastHeartbeatAt !== null;
+        return {
+            id: record.id,
+            hostId: record.hostId,
+            name: record.name,
+            displayStatus: deriveDisplayStatus(record.status, reachability, heartbeatFresh, hasHeartbeat),
+            reachability,
+            platformStatus: record.status,
+            addedBy: deriveAddedBy(record.environment),
+            lastSeen: record.lastHeartbeatAt ?? null,
+            os: record.capabilities?.os
+        };
+    });
+}
+//# sourceMappingURL=merged-view.js.map

package/dist/fleets/merged-view.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"merged-view.js","sourceRoot":"","sources":["../../src/fleets/merged-view.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAkB,MAAM,4BAA4B,CAAC;AAEpF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAC;AAEpD,MAAM,8BAA8B,GAAG,sBAAsB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AA6E3G;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC/B,eAA8B,EAC9B,QAAgB,IAAI,CAAC,GAAG,EAAE,EAC1B,cAAsB,4BAA4B;IAElD,IAAI,CAAC,eAAe;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,KAAK,GAAG,EAAE,IAAI,WAAW,CAAC;AAClC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,mBAAmB,CAC3B,cAA4C,EAC5C,YAA8B,EAC9B,cAAuB,EACvB,YAAqB;IAErB,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,cAAc;QAAE,OAAO,SAAS,CAAC;IACxF,IAAI,cAAc,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAClD,yBAAyB;IACzB,IAAI,YAAY,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAC;IAClD,IAAI,cAAc;QAAE,OAAO,QAAQ,CAAC;IACpC,IAAI,YAAY;QAAE,OAAO,UAAU,CAAC,CAAC,qBAAqB;IAC1D,OAAO,SAAS,CAAC,CAAC,sCAAsC;AACzD,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,WAAoB;IAC1C,IAAI,WAAW,KAAK,OAAO;QAAE,OAAO,mBAAmB,CAAC;IACxD,OAAO,cAAc,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,6BAA6B,CAC5C,eAA8C,EAC9C,YAAiC,EACjC,QAAgB,IAAI,CAAC,GAAG,EAAE;IAE1B,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAmB,EAAE;QACtD,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,WAAW,GAChB,MAAM,CAAC,MAAM,KAAK,SAAS;YAC3B,MAAM,CAAC,MAAM,KAAK,QAAQ;YAC1B,MAAM,CAAC,MAAM,KAAK,SAAS;YAC3B,MAAM,CAAC,MAAM,KAAK,UAAU;YAC5B,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC;QAE9B,6EAA6E;QAC7E,4EAA4E;QAC5E,0EAA0E;QAC1E,0EAA0E;QAC1E,qDAAqD;QACrD,MAAM,YAAY,GAAqB,WAAW;YACjD,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,MAAM,CAAC,cAAc,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;gBACzD,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ;oBAC3B,CAAC,CAAC,aAAa;oBACf,CAAC,CAAC,SAAS,CAAC;QAEf,MAAM,cAAc,GAAG,gBAAgB,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QACvE,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,KAAK,IAAI,CAAC;QAErD,OAAO;YACN,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,aAAa,EAAE,mBAAmB,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,CAAC;YAC7F,YAAY;YACZ,cAAc,EAAE,MAAM,CAAC,MAAM;YAC7B,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC;YAC1C,QAAQ,EAAE,MAAM,CAAC,eAAe,IAAI,IAAI;YACxC,EAAE,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE;SAC3B,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/fleets/pairing/direct/direct-discovery.d.ts

@@ -0,0 +1,57 @@
+/**
+ * `fleet/discovery/direct` — direct-IP discovery adapter (fleet.md §4.6).
+ *
+ * The simplest discovery adapter: an operator supplies a host address
+ * (`host:port`, `tcp://host:port`, or an `https://`/`http://` origin) and the
+ * adapter registers a `runtime/rpc` descriptor for it. No socket scan, no cloud
+ * call — it trusts the operator's address and makes it a discoverable target.
+ *
+ * It finds nothing on its own (no probe); it *registers* an
+ * operator-asserted reachable runtime. Reachability is verified later by the
+ * resolver/connect, not here (discovery is registration, not a liveness probe).
+ *
+ * Lifecycle: NONE. This adapter has no `destroy` — it didn't create the host
+ * (correction #4). If the operator-supplied host is itself a provisioned
+ * sandbox, `infra/sandbox` owns its teardown, not this adapter.
+ */
+import { type RuntimeRpcDescriptor } from '@vibesdotdev/kernel-rpc';
+import type { FleetDiscoveryAdapter } from '@vibesdotdev/platform/fleets/pairing';
+import { DIRECT_DISCOVERY_ADAPTER_ID, type DirectHostInput } from './ids.ts';
+export { DIRECT_DISCOVERY_ADAPTER_ID, type DirectHostInput };
+export { DIRECT_HOSTS_INPUT_KIND, DirectDiscoveryAdapterSchema, DirectDiscoveryProviderSchema, type DirectDiscoveryProvider } from './ids.ts';
+/** A parsed address — the transport-specific shape used to build the target. */
+type ParsedAddress = {
+    transport: 'tcp';
+    host: string;
+    port: number;
+} | {
+    transport: 'http';
+    origin: string;
+};
+/**
+ * Parse an operator-supplied address into a transport + target.
+ *
+ * - `http://` / `https://` → http origin (origin is normalized, no trailing slash).
+ * - `tcp://host:port` or bare `host:port` → tcp host + port.
+ * - IPv6 hosts MUST be bracketed — `[::1]:8080` / `tcp://[2001:db8::1]:9000`
+ *   (brackets are stripped from the parsed host). An unbracketed address with
+ *   multiple colons (e.g. a bare `2001:db8::1`) is ambiguous and rejected —
+ *   the naive last-colon split would silently misparse it into a bogus
+ *   host + port.
+ *
+ * Throws on an address with no port (tcp) or an unparseable form — a direct
+ * target must be concrete.
+ */
+export declare function parseDirectAddress(address: string): ParsedAddress;
+/**
+ * Build the `runtime/rpc` descriptor for one direct host. The output validates
+ * against L4a's frozen `RuntimeRpcDescriptorSchema`; this function throws if it
+ * ever does not (a guard against drift).
+ */
+export declare function buildDirectRpcDescriptor(input: DirectHostInput): RuntimeRpcDescriptor;
+/**
+ * Create a direct-IP discovery adapter over a fixed set of operator-supplied
+ * hosts. `discover()` yields one `runtime/rpc` descriptor per input, in order.
+ */
+export declare function createDirectDiscoveryAdapter(hosts: readonly DirectHostInput[]): FleetDiscoveryAdapter;
+//# sourceMappingURL=direct-discovery.d.ts.map

package/dist/fleets/pairing/direct/direct-discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"direct-discovery.d.ts","sourceRoot":"","sources":["../../../../src/fleets/pairing/direct/direct-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAEN,KAAK,oBAAoB,EACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EAAE,2BAA2B,EAAE,KAAK,eAAe,EAAE,MAAM,UAAU,CAAC;AAI7E,OAAO,EAAE,2BAA2B,EAAE,KAAK,eAAe,EAAE,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,6BAA6B,EAAE,KAAK,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAE9I,gFAAgF;AAChF,KAAK,aAAa,GACf;IAAE,SAAS,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,CAwCjE;AAUD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,eAAe,GAAG,oBAAoB,CAoBrF;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,GAAG,qBAAqB,CAUrG"}

package/dist/fleets/pairing/direct/direct-discovery.descriptor.d.ts

@@ -0,0 +1,27 @@
+export declare const directDiscoveryDescriptor: {
+    id: string;
+    kind: "fleet/discovery";
+    method: string;
+    emitsTransport: ("unix" | "tcp" | "http" | "relay")[];
+    name?: string | undefined;
+    description?: string | undefined;
+    tags?: string[] | undefined;
+    hardware?: string[] | undefined;
+    enabled?: boolean | undefined;
+    priority?: number | undefined;
+    capabilityId?: string | undefined;
+    requiredContext?: string[] | undefined;
+    optionalContext?: string[] | undefined;
+    config?: unknown;
+    retention?: string | {
+        reason: string;
+        maxAgeDays?: number | undefined;
+        maxEntries?: number | undefined;
+        maxBytes?: number | undefined;
+        cascadeFrom?: string | undefined;
+        ageField?: string | undefined;
+        enforcedBy?: string | undefined;
+    } | undefined;
+    inputKinds?: string[] | undefined;
+};
+//# sourceMappingURL=direct-discovery.descriptor.d.ts.map

package/dist/fleets/pairing/direct/direct-discovery.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"direct-discovery.descriptor.d.ts","sourceRoot":"","sources":["../../../../src/fleets/pairing/direct/direct-discovery.descriptor.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;CAOpC,CAAC"}

package/dist/fleets/pairing/direct/direct-discovery.descriptor.js

@@ -0,0 +1,11 @@
+import { FleetDiscoveryDescriptorSchema } from "../kinds/discovery.kind.js";
+import { DIRECT_DISCOVERY_ADAPTER_ID, DIRECT_HOSTS_INPUT_KIND } from "./ids.js";
+export const directDiscoveryDescriptor = FleetDiscoveryDescriptorSchema.parse({
+    id: DIRECT_DISCOVERY_ADAPTER_ID,
+    kind: 'fleet/discovery',
+    name: 'Direct host discovery',
+    method: 'direct',
+    inputKinds: [DIRECT_HOSTS_INPUT_KIND],
+    emitsTransport: ['tcp', 'http']
+});
+//# sourceMappingURL=direct-discovery.descriptor.js.map

package/dist/fleets/pairing/direct/direct-discovery.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"direct-discovery.descriptor.js","sourceRoot":"","sources":["../../../../src/fleets/pairing/direct/direct-discovery.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAEhF,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC,KAAK,CAAC;IAC7E,EAAE,EAAE,2BAA2B;IAC/B,IAAI,EAAE,iBAAiB;IACvB,IAAI,EAAE,uBAAuB;IAC7B,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,CAAC,uBAAuB,CAAC;IACrC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;CAC/B,CAAC,CAAC"}

package/dist/fleets/pairing/direct/direct-discovery.impl.d.ts

@@ -0,0 +1,67 @@
+import type { FleetDiscoveryAdapter } from '../../discovery-contract.ts';
+import { type DirectDiscoveryProvider, type DirectHostInput } from './ids.ts';
+/** Runtime-selected provider; each adapter keeps its own caller-supplied hosts. */
+export default class DirectDiscoveryImplementation implements DirectDiscoveryProvider {
+    readonly id = "fleet/discovery/direct";
+    discover(signal?: AbortSignal): AsyncIterable<{
+        id: string;
+        kind: "runtime/rpc";
+        transport: "cef" | "unix" | "tcp" | "http" | "relay" | "messageport" | "tauri";
+        target: {
+            transport: "unix";
+            socketPath: string;
+        } | {
+            transport: "tcp";
+            host: string;
+            port: number;
+        } | {
+            transport: "http";
+            origin: string;
+        } | {
+            transport: "cef";
+            channel: string;
+        } | {
+            transport: "messageport";
+            channel: string;
+        } | {
+            transport: "relay";
+            brokerOrigin: string;
+            hostId: string;
+            actingOrgId?: string | undefined;
+        } | {
+            transport: "tauri";
+            channel: string;
+        };
+        name?: string | undefined;
+        description?: string | undefined;
+        tags?: string[] | undefined;
+        hardware?: string[] | undefined;
+        enabled?: boolean | undefined;
+        priority?: number | undefined;
+        capabilityId?: string | undefined;
+        requiredContext?: string[] | undefined;
+        optionalContext?: string[] | undefined;
+        config?: unknown;
+        retention?: string | {
+            reason: string;
+            maxAgeDays?: number | undefined;
+            maxEntries?: number | undefined;
+            maxBytes?: number | undefined;
+            cascadeFrom?: string | undefined;
+            ageField?: string | undefined;
+            enforcedBy?: string | undefined;
+        } | undefined;
+        auth?: {
+            source: "secret";
+            key: string;
+            store?: string | undefined;
+            operation?: object | undefined;
+        } | undefined;
+        remoteScope?: {
+            hardware?: "consumer" | "cloud" | undefined;
+            substrate?: string | undefined;
+        } | undefined;
+    }>;
+    create(hosts: readonly DirectHostInput[]): FleetDiscoveryAdapter;
+}
+//# sourceMappingURL=direct-discovery.impl.d.ts.map

package/dist/fleets/pairing/direct/direct-discovery.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"direct-discovery.impl.d.ts","sourceRoot":"","sources":["../../../../src/fleets/pairing/direct/direct-discovery.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEzE,OAAO,EAA+B,KAAK,uBAAuB,EAAE,KAAK,eAAe,EAAE,MAAM,UAAU,CAAC;AAE3G,mFAAmF;AACnF,MAAM,CAAC,OAAO,OAAO,6BAA8B,YAAW,uBAAuB;IACpF,QAAQ,CAAC,EAAE,4BAA+B;IAE1C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAI7B,MAAM,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,GAAG,qBAAqB;CAGhE"}

package/dist/fleets/pairing/direct/direct-discovery.impl.js

@@ -0,0 +1,13 @@
+import { createDirectDiscoveryAdapter } from "./direct-discovery.js";
+import { DIRECT_DISCOVERY_ADAPTER_ID } from "./ids.js";
+/** Runtime-selected provider; each adapter keeps its own caller-supplied hosts. */
+export default class DirectDiscoveryImplementation {
+    id = DIRECT_DISCOVERY_ADAPTER_ID;
+    discover(signal) {
+        return this.create([]).discover(signal);
+    }
+    create(hosts) {
+        return createDirectDiscoveryAdapter(hosts);
+    }
+}
+//# sourceMappingURL=direct-discovery.impl.js.map

package/dist/fleets/pairing/direct/direct-discovery.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"direct-discovery.impl.js","sourceRoot":"","sources":["../../../../src/fleets/pairing/direct/direct-discovery.impl.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,2BAA2B,EAAsD,MAAM,UAAU,CAAC;AAE3G,mFAAmF;AACnF,MAAM,CAAC,OAAO,OAAO,6BAA6B;IACxC,EAAE,GAAG,2BAA2B,CAAC;IAE1C,QAAQ,CAAC,MAAoB;QAC5B,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,CAAC,KAAiC;QACvC,OAAO,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;CACD"}

package/dist/fleets/pairing/direct/direct-discovery.js

@@ -0,0 +1,120 @@
+/**
+ * `fleet/discovery/direct` — direct-IP discovery adapter (fleet.md §4.6).
+ *
+ * The simplest discovery adapter: an operator supplies a host address
+ * (`host:port`, `tcp://host:port`, or an `https://`/`http://` origin) and the
+ * adapter registers a `runtime/rpc` descriptor for it. No socket scan, no cloud
+ * call — it trusts the operator's address and makes it a discoverable target.
+ *
+ * It finds nothing on its own (no probe); it *registers* an
+ * operator-asserted reachable runtime. Reachability is verified later by the
+ * resolver/connect, not here (discovery is registration, not a liveness probe).
+ *
+ * Lifecycle: NONE. This adapter has no `destroy` — it didn't create the host
+ * (correction #4). If the operator-supplied host is itself a provisioned
+ * sandbox, `infra/sandbox` owns its teardown, not this adapter.
+ */
+import { RuntimeRpcDescriptorSchema } from '@vibesdotdev/kernel-rpc';
+import { DIRECT_DISCOVERY_ADAPTER_ID } from "./ids.js";
+// Re-export the static descriptor identity + port type so the public surface
+// (index.ts and tests) stays centralized in the identity module.
+export { DIRECT_DISCOVERY_ADAPTER_ID };
+export { DIRECT_HOSTS_INPUT_KIND, DirectDiscoveryAdapterSchema, DirectDiscoveryProviderSchema } from "./ids.js";
+/**
+ * Parse an operator-supplied address into a transport + target.
+ *
+ * - `http://` / `https://` → http origin (origin is normalized, no trailing slash).
+ * - `tcp://host:port` or bare `host:port` → tcp host + port.
+ * - IPv6 hosts MUST be bracketed — `[::1]:8080` / `tcp://[2001:db8::1]:9000`
+ *   (brackets are stripped from the parsed host). An unbracketed address with
+ *   multiple colons (e.g. a bare `2001:db8::1`) is ambiguous and rejected —
+ *   the naive last-colon split would silently misparse it into a bogus
+ *   host + port.
+ *
+ * Throws on an address with no port (tcp) or an unparseable form — a direct
+ * target must be concrete.
+ */
+export function parseDirectAddress(address) {
+    const trimmed = address.trim();
+    if (/^https?:\/\//i.test(trimmed)) {
+        // http(s) origin. Normalize via URL and drop any path/trailing slash.
+        const url = new URL(trimmed);
+        return { transport: 'http', origin: url.origin };
+    }
+    // tcp://host:port or bare host:port.
+    const withoutScheme = trimmed.replace(/^tcp:\/\//i, '');
+    // Bracketed IPv6: [host]:port — strip the brackets from the host.
+    if (withoutScheme.startsWith('[')) {
+        const closingBracket = withoutScheme.indexOf(']');
+        const host = closingBracket > 1 ? withoutScheme.slice(1, closingBracket) : '';
+        const rest = closingBracket >= 0 ? withoutScheme.slice(closingBracket + 1) : '';
+        if (host.length === 0 || !rest.startsWith(':')) {
+            throw new Error(`fleet/discovery/direct: address '${address}' is not a valid [ipv6]:port form — a direct target must carry a concrete port`);
+        }
+        return { transport: 'tcp', host, port: parsePort(rest.slice(1), address) };
+    }
+    // An unbracketed address with more than one colon is (at best) a bare
+    // IPv6 literal with no port; never guess a host/port split out of it.
+    const colonCount = withoutScheme.split(':').length - 1;
+    if (colonCount > 1) {
+        throw new Error(`fleet/discovery/direct: address '${address}' looks like an unbracketed IPv6 literal — use '[host]:port' (a direct target must carry a concrete port)`);
+    }
+    const lastColon = withoutScheme.lastIndexOf(':');
+    if (lastColon <= 0 || lastColon === withoutScheme.length - 1) {
+        throw new Error(`fleet/discovery/direct: address '${address}' is not a valid host:port or http(s):// origin`);
+    }
+    const host = withoutScheme.slice(0, lastColon);
+    return { transport: 'tcp', host, port: parsePort(withoutScheme.slice(lastColon + 1), address) };
+}
+function parsePort(portStr, address) {
+    const port = Number(portStr);
+    if (!/^\d+$/.test(portStr) || !Number.isInteger(port) || port <= 0 || port > 65535) {
+        throw new Error(`fleet/discovery/direct: '${portStr}' is not a valid port in '${address}'`);
+    }
+    return port;
+}
+/**
+ * Build the `runtime/rpc` descriptor for one direct host. The output validates
+ * against L4a's frozen `RuntimeRpcDescriptorSchema`; this function throws if it
+ * ever does not (a guard against drift).
+ */
+export function buildDirectRpcDescriptor(input) {
+    const parsed = parseDirectAddress(input.address);
+    const descriptor = {
+        id: input.id,
+        kind: 'runtime/rpc',
+        name: input.name ?? `Direct host ${input.address}`,
+        description: `Operator-registered direct discovery target (${input.address}).`,
+        enabled: true,
+        transport: parsed.transport,
+        target: parsed
+    };
+    if (input.auth)
+        descriptor.auth = input.auth;
+    if (input.remoteScope)
+        descriptor.remoteScope = input.remoteScope;
+    // Self-check against the FROZEN schema (acceptance criterion #4): the emitted
+    // descriptor MUST be a valid runtime/rpc descriptor.
+    const ok = RuntimeRpcDescriptorSchema.safeParse(descriptor);
+    if (!ok.success) {
+        throw new Error(`fleet/discovery/direct: built an invalid runtime/rpc descriptor: ${ok.error.message}`);
+    }
+    return descriptor;
+}
+/**
+ * Create a direct-IP discovery adapter over a fixed set of operator-supplied
+ * hosts. `discover()` yields one `runtime/rpc` descriptor per input, in order.
+ */
+export function createDirectDiscoveryAdapter(hosts) {
+    return {
+        id: DIRECT_DISCOVERY_ADAPTER_ID,
+        async *discover(signal) {
+            for (const host of hosts) {
+                if (signal?.aborted)
+                    return;
+                yield buildDirectRpcDescriptor(host);
+            }
+        }
+    };
+}
+//# sourceMappingURL=direct-discovery.js.map

package/dist/fleets/pairing/direct/direct-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"direct-discovery.js","sourceRoot":"","sources":["../../../../src/fleets/pairing/direct/direct-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EACN,0BAA0B,EAE1B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,2BAA2B,EAAwB,MAAM,UAAU,CAAC;AAE7E,6EAA6E;AAC7E,iEAAiE;AACjE,OAAO,EAAE,2BAA2B,EAAwB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,6BAA6B,EAAgC,MAAM,UAAU,CAAC;AAO9I;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,sEAAsE;QACtE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IAClD,CAAC;IACD,qCAAqC;IACrC,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAExD,kEAAkE;IAClE,IAAI,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,cAAc,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,GAAG,cAAc,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACd,oCAAoC,OAAO,gFAAgF,CAC3H,CAAC;QACH,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;IAC5E,CAAC;IAED,sEAAsE;IACtE,sEAAsE;IACtE,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACvD,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACd,oCAAoC,OAAO,2GAA2G,CACtJ,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,SAAS,IAAI,CAAC,IAAI,SAAS,KAAK,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACd,oCAAoC,OAAO,iDAAiD,CAC5F,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC/C,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;AACjG,CAAC;AAED,SAAS,SAAS,CAAC,OAAe,EAAE,OAAe;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,6BAA6B,OAAO,GAAG,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAsB;IAC9D,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,UAAU,GAAyB;QACxC,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,eAAe,KAAK,CAAC,OAAO,EAAE;QAClD,WAAW,EAAE,gDAAgD,KAAK,CAAC,OAAO,IAAI;QAC9E,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,MAAM;KACd,CAAC;IACF,IAAI,KAAK,CAAC,IAAI;QAAE,UAAU,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IAC7C,IAAI,KAAK,CAAC,WAAW;QAAE,UAAU,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IAClE,8EAA8E;IAC9E,qDAAqD;IACrD,MAAM,EAAE,GAAG,0BAA0B,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,oEAAoE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAiC;IAC7E,OAAO;QACN,EAAE,EAAE,2BAA2B;QAC/B,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAoB;YACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBAC1B,IAAI,MAAM,EAAE,OAAO;oBAAE,OAAO;gBAC5B,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;YACtC,CAAC;QACF,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/fleets/pairing/direct/ids.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Static descriptor identity + port types for the direct-IP discovery adapter.
+ *
+ * Lives in a separate identity module so callers can use the stable adapter id
+ * and input types without importing implementation code.
+ */
+import * as z from 'zod/v4';
+import type { RuntimeRpcDescriptor, CredentialReference } from '@vibesdotdev/kernel-rpc';
+import type { FleetDiscoveryAdapter } from '../../discovery-contract.ts';
+/** Runtime-resolved direct discovery that binds inputs to one caller's operation. */
+export interface DirectDiscoveryProvider extends FleetDiscoveryAdapter {
+    create(hosts: readonly DirectHostInput[]): FleetDiscoveryAdapter;
+}
+/** Validate discovery ports returned by a selected implementation. */
+export declare const DirectDiscoveryAdapterSchema: z.ZodCustom<FleetDiscoveryAdapter, FleetDiscoveryAdapter>;
+/** The implementation port advertised by the direct-host input protocol. */
+export declare const DirectDiscoveryProviderSchema: z.ZodCustom<DirectDiscoveryProvider, DirectDiscoveryProvider>;
+export declare const DIRECT_HOSTS_INPUT_KIND = "direct-hosts";
+/** Adapter id — the `fleet/discovery` impl key. */
+export declare const DIRECT_DISCOVERY_ADAPTER_ID = "fleet/discovery/direct";
+/** One operator-supplied host to register as a direct-discovery target. */
+export interface DirectHostInput {
+    /**
+     * The registry id for the emitted `runtime/rpc` descriptor. Stable and
+     * operator-chosen so a re-register upserts the same entry.
+     */
+    readonly id: string;
+    /**
+     * The host address. One of:
+     *   - `'10.0.0.5:7777'` / `'tcp://10.0.0.5:7777'` → tcp target
+     *   - `'https://box.lan'` / `'http://10.0.0.5:8080'` → http target
+     */
+    readonly address: string;
+    /** Optional human-readable name for the descriptor. */
+    readonly name?: string;
+    /**
+     * Optional connection credential — a `CredentialReference` into secrets/store,
+     * NEVER a bare token. A bearer token authorizes a *connection*; per-invoke
+     * authz + friction are L5's gates (correction #5).
+     */
+    readonly auth?: CredentialReference;
+    /** Optional scope hint advertised for resolver bias. */
+    readonly remoteScope?: RuntimeRpcDescriptor['remoteScope'];
+}
+//# sourceMappingURL=ids.d.ts.map