@vibesdotdev/platform 0.0.0-stage → 1.0.0-rc.2

package/dist/fleets/bound-tool.js

@@ -0,0 +1,150 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { RpcDataSchema } from '@vibesdotdev/kernel-rpc';
+import { originOf, serviceEnvironment } from '@vibesdotdev/infra-core/service';
+import { readExecutionBindings, readTrustedRunContext, resolveToolCallerBearer } from '@vibesdotdev/tools/agents/trusted-context';
+import { isRemoteControlDescriptor } from "./remote-control.js";
+import { resolveStoredActingOrgId } from "./acting-org.js";
+import { getVibesPlatformInternalClient, resolvePlatformInternalToken } from "../internal-api/helper.js";
+/** Resolve only caller-owned, relay-reachable hosts. The JWT is scoped to this call. */
+export async function boundToolRequestScope(runtime, ctx, options = {}) {
+    const trusted = readTrustedRunContext(ctx);
+    if (!trusted.actorUserId || trusted.actorUserId !== trusted.userId)
+        throw new CapabilityError('Selected-host execution requires the authenticated actor.', 'PERMISSION_DENIED', {
+            reason: 'fleet-request-actor-unverified',
+            retryable: false
+        });
+    // The relay broker is the declared `platform` service; an undeclared one fails NOT_FOUND.
+    const origin = originOf(await runtime.query('infra/service').withId('platform').resolve(), await serviceEnvironment(runtime), 'primary');
+    // The caller's bearer (the active request's, else the run-bound one). A call that
+    // outlived its request with no run-bound bearer refuses: it never falls back to the
+    // internal service credential, which only a signed-out request still selects.
+    const caller = await resolveToolCallerBearer(runtime, ctx);
+    if (caller.bearer === null && caller.absence === 'no-active-request') {
+        throw new CapabilityError('Selected-host execution outlived its request and carries no caller bearer.', 'AUTH_REQUIRED', {
+            reason: 'not-signed-in',
+            retryable: false,
+            details: { absence: caller.absence }
+        });
+    }
+    // A tool that runs work on the user's host acts as the user: a signed-out caller never
+    // falls back to the internal service credential.
+    if (caller.bearer === null && options.requireCallerBearer) {
+        throw new CapabilityError('Running on a selected host requires the signed-in caller bearer.', 'AUTH_REQUIRED', {
+            reason: 'not-signed-in',
+            retryable: false,
+            details: { absence: caller.absence }
+        });
+    }
+    const bearer = caller.bearer;
+    const base = bearer
+        ? await runtime.query('runtime/client').withId('platform').resolve()
+        : null;
+    const headers = {
+        authorization: `Bearer ${bearer}`
+    };
+    // A request names its org; a consumer CLI or local MCP call carries none and
+    // acts in the org `vibes account set-org` stored, as `vibes fleet launch` did
+    // for the host it is now trying to reach.
+    const actingOrgId = trusted.orgId ?? (bearer && runtime.scope.hardware === 'consumer' ? await resolveStoredActingOrgId(runtime) : null);
+    if (actingOrgId)
+        headers['x-vibes-active-org'] = actingOrgId;
+    const platform = base?.forRequest({ origin, headers });
+    const service = platform ? null : await getVibesPlatformInternalClient(runtime);
+    const token = bearer ?? resolvePlatformInternalToken(runtime);
+    const credentialKey = 'fleet-request-actor';
+    return {
+        credentials: { get: async (key) => (key === credentialKey ? token : undefined) },
+        hosts: {
+            async resolve(hostId) {
+                // The relay admits an org-owned host in its owner's scope, so the
+                // connection acts in the host's organization; a personal host carries none.
+                const entry = (host) => {
+                    if (host?.relayReachable !== true)
+                        return null;
+                    const relayTarget = { transport: 'relay', brokerOrigin: origin, hostId };
+                    const target = host.ownerType === 'organization' && host.ownerId
+                        ? { ...relayTarget, actingOrgId: host.ownerId }
+                        : relayTarget;
+                    return {
+                        rpc: {
+                            id: host.id,
+                            kind: 'runtime/rpc',
+                            transport: 'relay',
+                            target,
+                            auth: { source: 'secret', key: credentialKey },
+                            remoteScope: { hardware: 'consumer' }
+                        },
+                        origin: 'discovered',
+                        sourceAdapterId: 'platform/request',
+                        registeredAt: new Date().toISOString(),
+                        relayReachable: true
+                    };
+                };
+                if (service)
+                    return entry((await service.hosts.resolve({
+                        hostId,
+                        userId: trusted.actorUserId,
+                        organizationId: trusted.orgId ?? trusted.organizationId
+                    })).host);
+                if (!platform)
+                    throw new Error('Authenticated host directory unavailable');
+                for (let offset = 0;;) {
+                    const { results } = await platform.hosts.list({ limit: 200, offset });
+                    const host = results.find((item) => item.hostId === hostId);
+                    if (host)
+                        return entry({ ...host, relayReachable: host.relayReachable === true });
+                    if (results.length < 200)
+                        return null;
+                    offset += results.length;
+                }
+            }
+        }
+    };
+}
+export async function invokeBoundTool(_runtime, fleet, hostId, toolId, input, ctx) {
+    const execution = readExecutionBindings(ctx);
+    if (execution?.hostTarget?.kind !== 'host' || execution.hostTarget.hostId !== hostId)
+        throw new Error('Selected host does not match the server-bound execution host');
+    const payload = RpcDataSchema.parse(input);
+    const result = await fleet.withHost(hostId, async (host) => {
+        const remote = await host.connect();
+        try {
+            const catalog = await remote.query({ kind: 'tools/tool', ids: [toolId], enabled: true });
+            if (!catalog.success) {
+                throw new CapabilityError('The selected host could not read its tool declarations.', 'UNAVAILABLE', {
+                    reason: 'fleet-bound-tool-query-failed',
+                    details: { hostId, toolId },
+                    cause: catalog
+                });
+            }
+            const descriptor = catalog.descriptors.find(item => item.id === toolId);
+            if (!isRemoteControlDescriptor(descriptor)) {
+                throw new CapabilityError('This tool has no registered Fleet remote-control capability.', 'INVALID_INPUT', {
+                    reason: 'fleet-bound-tool-unsupported',
+                    retryable: false,
+                    details: { toolId }
+                });
+            }
+            const selector = await remote.query('runtime/client');
+            const tools = await selector.withId('tools');
+            return {
+                value: await tools.invokeSystemTool(toolId, payload, {
+                    callId: ctx.callId,
+                    caller: ctx.caller,
+                    workspace: ctx.workspace,
+                    metadata: { ...ctx.metadata, executionHostId: hostId }
+                })
+            };
+        }
+        finally {
+            remote[Symbol.dispose]();
+        }
+    });
+    if (!result)
+        throw new CapabilityError('The selected host is unavailable or is not owned by the authenticated caller', 'NOT_FOUND', {
+            reason: 'fleet-host-not-reachable',
+            retryable: false
+        });
+    return result.value;
+}
+//# sourceMappingURL=bound-tool.js.map

package/dist/fleets/bound-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bound-tool.js","sourceRoot":"","sources":["../../src/fleets/bound-tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAA2C,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EAAE,aAAa,EAAiC,MAAM,yBAAyB,CAAC;AACvF,OAAO,EACN,QAAQ,EACR,kBAAkB,EAGlB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACN,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,MAAM,2CAA2C,CAAC;AAKnD,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EACN,8BAA8B,EAC9B,4BAA4B,EAC5B,MAAM,2BAA2B,CAAC;AAEnC,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,OAAqB,EACrB,GAAoB,EACpB,UAA6C,EAAE;IAE/C,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,MAAM;QACjE,MAAM,IAAI,eAAe,CAAC,2DAA2D,EAAE,mBAAmB,EAAE;YAC3G,MAAM,EAAE,gCAAgC;YACxC,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,0FAA0F;IAC1F,MAAM,MAAM,GAAG,QAAQ,CACtB,MAAM,OAAO,CAAC,KAAK,CAA2C,eAAe,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,EAC3G,MAAM,kBAAkB,CAAC,OAAO,CAAC,EACjC,SAAS,CACT,CAAC;IACF,kFAAkF;IAClF,oFAAoF;IACpF,8EAA8E;IAC9E,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,mBAAmB,EAAE,CAAC;QACtE,MAAM,IAAI,eAAe,CAAC,4EAA4E,EAAE,eAAe,EAAE;YACxH,MAAM,EAAE,eAAe;YACvB,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;SACpC,CAAC,CAAC;IACJ,CAAC;IACD,uFAAuF;IACvF,iDAAiD;IACjD,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;QAC3D,MAAM,IAAI,eAAe,CAAC,kEAAkE,EAAE,eAAe,EAAE;YAC9G,MAAM,EAAE,eAAe;YACvB,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;SACpC,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,MAAM,IAAI,GAAG,MAAM;QAClB,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAA2B,gBAAgB,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;QAC9F,CAAC,CAAC,IAAI,CAAC;IACR,MAAM,OAAO,GAAkD;QAC9D,aAAa,EAAE,UAAU,MAAM,EAAE;KACjC,CAAC;IACF,6EAA6E;IAC7E,8EAA8E;IAC9E,0CAA0C;IAC1C,MAAM,WAAW,GAChB,OAAO,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrH,IAAI,WAAW;QAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,WAAW,CAAC;IAC7D,MAAM,QAAQ,GAAG,IAAI,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,8BAA8B,CAAC,OAAO,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,MAAM,IAAI,4BAA4B,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,aAAa,GAAG,qBAAqB,CAAC;IAC5C,OAAO;QACN,WAAW,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAW,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;QACxF,KAAK,EAAE;YACN,KAAK,CAAC,OAAO,CAAC,MAAM;gBACnB,kEAAkE;gBAClE,4EAA4E;gBAC5E,MAAM,KAAK,GAAG,CACb,IAA0G,EAC3E,EAAE;oBACjC,IAAI,IAAI,EAAE,cAAc,KAAK,IAAI;wBAAE,OAAO,IAAI,CAAC;oBAC/C,MAAM,WAAW,GAAG,EAAE,SAAS,EAAE,OAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;oBAClF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,KAAK,cAAc,IAAI,IAAI,CAAC,OAAO;wBAC/D,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE;wBAC/C,CAAC,CAAC,WAAW,CAAC;oBACf,OAAO;wBACN,GAAG,EAAE;4BACJ,EAAE,EAAE,IAAI,CAAC,EAAE;4BACX,IAAI,EAAE,aAAa;4BACnB,SAAS,EAAE,OAAO;4BAClB,MAAM;4BACN,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,aAAa,EAAE;4BAC9C,WAAW,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE;yBACrC;wBACD,MAAM,EAAE,YAAY;wBACpB,eAAe,EAAE,kBAAkB;wBACnC,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACtC,cAAc,EAAE,IAAI;qBACpB,CAAC;gBACH,CAAC,CAAC;gBACF,IAAI,OAAO;oBACV,OAAO,KAAK,CACX,CACC,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;wBAC3B,MAAM;wBACN,MAAM,EAAE,OAAO,CAAC,WAAY;wBAC5B,cAAc,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,cAAc;qBACvD,CAAC,CACF,CAAC,IAAI,CACN,CAAC;gBACH,IAAI,CAAC,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBAC3E,KAAK,IAAI,MAAM,GAAG,CAAC,IAAK,CAAC;oBACxB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;oBACtE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;oBAC5D,IAAI,IAAI;wBAAE,OAAO,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC,CAAC;oBAClF,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG;wBAAE,OAAO,IAAI,CAAC;oBACtC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;gBAC1B,CAAC;YACF,CAAC;SACD;KACD,CAAC;AACH,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,QAAsB,EACtB,KAA0B,EAC1B,MAAc,EACd,MAAc,EACd,KAAY,EACZ,GAAoB;IAEpB,MAAM,SAAS,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,SAAS,EAAE,UAAU,EAAE,IAAI,KAAK,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,KAAK,MAAM;QACnF,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACzF,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBACtB,MAAM,IAAI,eAAe,CAAC,yDAAyD,EAAE,aAAa,EAAE;oBACnG,MAAM,EAAE,+BAA+B;oBACvC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;oBAC3B,KAAK,EAAE,OAAO;iBACd,CAAC,CAAC;YACJ,CAAC;YACD,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;YACxE,IAAI,CAAC,yBAAyB,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,eAAe,CAAC,8DAA8D,EAAE,eAAe,EAAE;oBAC1G,MAAM,EAAE,8BAA8B;oBACtC,SAAS,EAAE,KAAK;oBAChB,OAAO,EAAE,EAAE,MAAM,EAAE;iBACnB,CAAC,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAiB,gBAAgB,CAAC,CAAC;YACtE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7C,OAAO;gBACN,KAAK,EAAE,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE;oBACpD,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,QAAQ,EAAE,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE;iBACtD,CAAC;aACF,CAAC;QACH,CAAC;gBAAS,CAAC;YACV,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,CAAC;IACF,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QACV,MAAM,IAAI,eAAe,CAAC,8EAA8E,EAAE,WAAW,EAAE;YACtH,MAAM,EAAE,0BAA0B;YAClC,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,OAAO,MAAM,CAAC,KAAK,CAAC;AACrB,CAAC"}

package/dist/fleets/boundary/platform-events.d.ts

@@ -0,0 +1,177 @@
+/**
+ * The fleet-side platform-boundary EMITTER (fleet.md §4.8, L6a/L6b).
+ *
+ * Fleet owns host *lifecycle* (daemon supervision, health, capability
+ * discovery, RPC exposure); platform owns the host *record* (id, owner, region,
+ * billing, routing). The boundary between them is event-shaped and one-way:
+ * **fleet emits, platform projects.** This module is the fleet-side half — it
+ * defines the `FleetHostEvent` contract and a small emitter the fleet host
+ * calls. It NEVER writes platform's store; platform's own subscriber
+ * (`platform/src/fleet-events/subscriber.ts`, the dedicated L6c lane
+ * in platform.md) consumes these events and projects them into the row platform
+ * owns.
+ *
+ * The two lanes must agree on the `FleetHostEvent` schema below; this is the
+ * fleet-side source of truth for the event shape (fleet.md §4.8 — "the two must
+ * agree on the event schema below").
+ *
+ * Three lifecycle events (fleet.md §4.8, §10 boundary-events):
+ *   - `host.registered`              a fleet/host entered the reachable-runtime
+ *                                    registry (provisioned or discovered).
+ *   - `host.health-changed`          a host's reachability health transitioned.
+ *   - `host.capabilities-discovered` `discoverCapabilities()` resolved what a
+ *                                    host can run; platform stores the result.
+ */
+import * as z from 'zod/v4';
+/**
+ * A host became reachable (entered the reachable-runtime registry). Carries the
+ * registry origin so platform can distinguish a provisioned, billable resource
+ * from a discovered candidate (fleet.md §4.1, §10 open-question 1). The host
+ * record FK is the join key platform projects onto.
+ */
+export declare const FleetHostRegisteredEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"host.registered">;
+    hostId: z.ZodString;
+    hostRecordId: z.ZodString;
+    origin: z.ZodEnum<{
+        discovered: "discovered";
+        provisioned: "provisioned";
+    }>;
+    sourceAdapterId: z.ZodString;
+    rpcId: z.ZodString;
+    at: z.ZodString;
+}, z.core.$strip>;
+export type FleetHostRegisteredEvent = z.infer<typeof FleetHostRegisteredEventSchema>;
+/**
+ * A host's reachability health transitioned (probe result changed). Fleet owns
+ * health; platform stores the latest value for routing/UX. `previous` is absent
+ * on the first observation.
+ */
+export declare const FleetHostHealthChangedEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"host.health-changed">;
+    hostId: z.ZodString;
+    hostRecordId: z.ZodString;
+    health: z.ZodEnum<{
+        unknown: "unknown";
+        degraded: "degraded";
+        reachable: "reachable";
+        unreachable: "unreachable";
+    }>;
+    previous: z.ZodOptional<z.ZodEnum<{
+        unknown: "unknown";
+        degraded: "degraded";
+        reachable: "reachable";
+        unreachable: "unreachable";
+    }>>;
+    at: z.ZodString;
+}, z.core.$strip>;
+export type FleetHostHealthChangedEvent = z.infer<typeof FleetHostHealthChangedEventSchema>;
+/**
+ * `discoverCapabilities()` resolved what a host can run (fleet.md §4.2). The
+ * `capabilities` payload is the platform `hostCapabilitiesSchema` shape; fleet
+ * does not interpret it — platform's subscriber projects it into the record's
+ * capabilities/`daemons`/`actions`. Typed loosely (the platform schema is the
+ * canonical validator) to keep this Phase-2 package decoupled from the platform
+ * reorg.
+ */
+export declare const FleetHostCapabilitiesDiscoveredEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"host.capabilities-discovered">;
+    hostId: z.ZodString;
+    hostRecordId: z.ZodString;
+    capabilities: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    at: z.ZodString;
+}, z.core.$strip>;
+export type FleetHostCapabilitiesDiscoveredEvent = z.infer<typeof FleetHostCapabilitiesDiscoveredEventSchema>;
+/**
+ * The fleet-side host lifecycle event contract (fleet.md §4.8). A discriminated
+ * union on `type` — the platform subscriber narrows on it. This is the schema
+ * the fleet emitter and the platform projector must agree on.
+ */
+export declare const FleetHostEventSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"host.registered">;
+    hostId: z.ZodString;
+    hostRecordId: z.ZodString;
+    origin: z.ZodEnum<{
+        discovered: "discovered";
+        provisioned: "provisioned";
+    }>;
+    sourceAdapterId: z.ZodString;
+    rpcId: z.ZodString;
+    at: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"host.health-changed">;
+    hostId: z.ZodString;
+    hostRecordId: z.ZodString;
+    health: z.ZodEnum<{
+        unknown: "unknown";
+        degraded: "degraded";
+        reachable: "reachable";
+        unreachable: "unreachable";
+    }>;
+    previous: z.ZodOptional<z.ZodEnum<{
+        unknown: "unknown";
+        degraded: "degraded";
+        reachable: "reachable";
+        unreachable: "unreachable";
+    }>>;
+    at: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"host.capabilities-discovered">;
+    hostId: z.ZodString;
+    hostRecordId: z.ZodString;
+    capabilities: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    at: z.ZodString;
+}, z.core.$strip>], "type">;
+export type FleetHostEvent = z.infer<typeof FleetHostEventSchema>;
+/** The set of fleet host event `type` discriminants (frozen). */
+export type FleetHostEventType = FleetHostEvent['type'];
+/**
+ * A subscriber to fleet host lifecycle events. Platform's L6c subscriber
+ * implements one of these and registers it with the emitter; fleet never knows
+ * (or cares) what the subscriber does with the event.
+ */
+export type FleetHostEventListener = (event: FleetHostEvent) => void;
+/** Unsubscribe handle returned by `subscribe`. Idempotent. */
+export type FleetHostEventUnsubscribe = () => void;
+/**
+ * The fleet-side emitter the fleet host calls. EMITS ONLY — it has no knowledge
+ * of platform's store; platform subscribes and projects (fleet.md §4.8). Each
+ * emitted event is validated against `FleetHostEventSchema` before dispatch so a
+ * malformed event never reaches a subscriber (the boundary is the schema's
+ * enforcement point).
+ */
+export interface FleetHostEventEmitter {
+    readonly lastFailure?: import('@vibesdotdev/kernel').CapabilityErrorOptions['cause'];
+    /** Register a subscriber. Returns an idempotent unsubscribe handle. */
+    subscribe(listener: FleetHostEventListener): FleetHostEventUnsubscribe;
+    /**
+     * Emit a host lifecycle event to all subscribers, synchronously and in
+     * registration order. Validates against `FleetHostEventSchema` first; throws
+     * `ZodError` on a malformed event (programmer error — never reached at the
+     * boundary). A throwing subscriber does not stop the others.
+     */
+    emit(event: FleetHostEvent): void;
+    /** Convenience emitters that stamp `at` (ISO-8601 now) when omitted. */
+    hostRegistered(event: Omit<FleetHostRegisteredEvent, 'type' | 'at'> & {
+        at?: string;
+    }): void;
+    hostHealthChanged(event: Omit<FleetHostHealthChangedEvent, 'type' | 'at'> & {
+        at?: string;
+    }): void;
+    hostCapabilitiesDiscovered(event: Omit<FleetHostCapabilitiesDiscoveredEvent, 'type' | 'at'> & {
+        at?: string;
+    }): void;
+}
+/**
+ * Create a fleet-side host lifecycle event emitter (fleet.md §4.8). The fleet
+ * host owns one and calls it on register / health-transition / capability
+ * discovery; platform's L6c subscriber `subscribe()`s to it. Synchronous,
+ * dependency-light, in-process — the transport across an actual process
+ * boundary (if any) is the subscriber's concern, not this emitter's.
+ *
+ * `clock` is injectable for deterministic tests; defaults to `Date.now`.
+ */
+export declare function createFleetHostEventEmitter(options?: {
+    clock?: () => Date;
+}): FleetHostEventEmitter;
+//# sourceMappingURL=platform-events.d.ts.map

package/dist/fleets/boundary/platform-events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-events.d.ts","sourceRoot":"","sources":["../../../src/fleets/boundary/platform-events.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;iBAczC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;GAIG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;iBAY5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;;;GAOG;AACH,eAAO,MAAM,0CAA0C;;;;;;iBAUrD,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAI/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,iEAAiE;AACjE,MAAM,MAAM,kBAAkB,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;AAExD;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;AAErE,8DAA8D;AAC9D,MAAM,MAAM,yBAAyB,GAAG,MAAM,IAAI,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,qBAAqB,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACrF,uEAAuE;IACvE,SAAS,CAAC,QAAQ,EAAE,sBAAsB,GAAG,yBAAyB,CAAC;IACvE;;;;;OAKG;IACH,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAAC;IAClC,wEAAwE;IACxE,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAC,GAAG;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC7F,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAC,GAAG;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACnG,0BAA0B,CACzB,KAAK,EAAE,IAAI,CAAC,oCAAoC,EAAE,MAAM,GAAG,IAAI,CAAC,GAAG;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GAChF,IAAI,CAAC;CACR;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,IAAI,CAAA;CAAE,GAAG,qBAAqB,CAoCnG"}

package/dist/fleets/boundary/platform-events.js

@@ -0,0 +1,142 @@
+import { settleNow } from '@vibesdotdev/kernel';
+/**
+ * The fleet-side platform-boundary EMITTER (fleet.md §4.8, L6a/L6b).
+ *
+ * Fleet owns host *lifecycle* (daemon supervision, health, capability
+ * discovery, RPC exposure); platform owns the host *record* (id, owner, region,
+ * billing, routing). The boundary between them is event-shaped and one-way:
+ * **fleet emits, platform projects.** This module is the fleet-side half — it
+ * defines the `FleetHostEvent` contract and a small emitter the fleet host
+ * calls. It NEVER writes platform's store; platform's own subscriber
+ * (`platform/src/fleet-events/subscriber.ts`, the dedicated L6c lane
+ * in platform.md) consumes these events and projects them into the row platform
+ * owns.
+ *
+ * The two lanes must agree on the `FleetHostEvent` schema below; this is the
+ * fleet-side source of truth for the event shape (fleet.md §4.8 — "the two must
+ * agree on the event schema below").
+ *
+ * Three lifecycle events (fleet.md §4.8, §10 boundary-events):
+ *   - `host.registered`              a fleet/host entered the reachable-runtime
+ *                                    registry (provisioned or discovered).
+ *   - `host.health-changed`          a host's reachability health transitioned.
+ *   - `host.capabilities-discovered` `discoverCapabilities()` resolved what a
+ *                                    host can run; platform stores the result.
+ */
+import * as z from 'zod/v4';
+import { FleetHostHealthSchema } from "../kinds/host.kind.js";
+/**
+ * A host became reachable (entered the reachable-runtime registry). Carries the
+ * registry origin so platform can distinguish a provisioned, billable resource
+ * from a discovered candidate (fleet.md §4.1, §10 open-question 1). The host
+ * record FK is the join key platform projects onto.
+ */
+export const FleetHostRegisteredEventSchema = z.object({
+    type: z.literal('host.registered'),
+    /** The `fleet/host` descriptor id (the runtime-side identity). */
+    hostId: z.string().min(1),
+    /** FK to platform `hostSchema.id` — the record platform owns. */
+    hostRecordId: z.string().min(1),
+    /** How the host entered the registry — drives platform's lifecycle handling. */
+    origin: z.enum(['provisioned', 'discovered']),
+    /** The adapter that registered it (e.g. 'infra/sandbox', 'fleet/discovery/mdns'). */
+    sourceAdapterId: z.string().min(1),
+    /** The `runtime/rpc` descriptor id naming this host's reachable runtime. */
+    rpcId: z.string().min(1),
+    /** When the event was emitted, ISO-8601. */
+    at: z.string().min(1)
+});
+/**
+ * A host's reachability health transitioned (probe result changed). Fleet owns
+ * health; platform stores the latest value for routing/UX. `previous` is absent
+ * on the first observation.
+ */
+export const FleetHostHealthChangedEventSchema = z.object({
+    type: z.literal('host.health-changed'),
+    /** The `fleet/host` descriptor id. */
+    hostId: z.string().min(1),
+    /** FK to platform `hostSchema.id`. */
+    hostRecordId: z.string().min(1),
+    /** The new reachability health. */
+    health: FleetHostHealthSchema,
+    /** The prior health, if this is not the first observation. */
+    previous: FleetHostHealthSchema.optional(),
+    /** When the probe that produced this transition completed, ISO-8601. */
+    at: z.string().min(1)
+});
+/**
+ * `discoverCapabilities()` resolved what a host can run (fleet.md §4.2). The
+ * `capabilities` payload is the platform `hostCapabilitiesSchema` shape; fleet
+ * does not interpret it — platform's subscriber projects it into the record's
+ * capabilities/`daemons`/`actions`. Typed loosely (the platform schema is the
+ * canonical validator) to keep this Phase-2 package decoupled from the platform
+ * reorg.
+ */
+export const FleetHostCapabilitiesDiscoveredEventSchema = z.object({
+    type: z.literal('host.capabilities-discovered'),
+    /** The `fleet/host` descriptor id. */
+    hostId: z.string().min(1),
+    /** FK to platform `hostSchema.id`. */
+    hostRecordId: z.string().min(1),
+    /** The discovered capabilities — the platform `hostCapabilitiesSchema` shape. */
+    capabilities: z.record(z.string(), z.unknown()),
+    /** When discovery completed, ISO-8601. */
+    at: z.string().min(1)
+});
+/**
+ * The fleet-side host lifecycle event contract (fleet.md §4.8). A discriminated
+ * union on `type` — the platform subscriber narrows on it. This is the schema
+ * the fleet emitter and the platform projector must agree on.
+ */
+export const FleetHostEventSchema = z.discriminatedUnion('type', [
+    FleetHostRegisteredEventSchema,
+    FleetHostHealthChangedEventSchema,
+    FleetHostCapabilitiesDiscoveredEventSchema
+]);
+/**
+ * Create a fleet-side host lifecycle event emitter (fleet.md §4.8). The fleet
+ * host owns one and calls it on register / health-transition / capability
+ * discovery; platform's L6c subscriber `subscribe()`s to it. Synchronous,
+ * dependency-light, in-process — the transport across an actual process
+ * boundary (if any) is the subscriber's concern, not this emitter's.
+ *
+ * `clock` is injectable for deterministic tests; defaults to `Date.now`.
+ */
+export function createFleetHostEventEmitter(options) {
+    let lastFailure;
+    const listeners = new Set();
+    const now = () => (options?.clock?.() ?? new Date()).toISOString();
+    function emit(event) {
+        // Validate at the boundary — a malformed event must never reach a subscriber.
+        const parsed = FleetHostEventSchema.parse(event);
+        for (const listener of Array.from(listeners)) {
+            const result = settleNow(() => listener(parsed));
+            if (!result.ok)
+                lastFailure = result.cause;
+        }
+    }
+    return {
+        get lastFailure() { return lastFailure; },
+        subscribe(listener) {
+            listeners.add(listener);
+            let active = true;
+            return () => {
+                if (!active)
+                    return;
+                active = false;
+                listeners.delete(listener);
+            };
+        },
+        emit,
+        hostRegistered(event) {
+            emit({ ...event, type: 'host.registered', at: event.at ?? now() });
+        },
+        hostHealthChanged(event) {
+            emit({ ...event, type: 'host.health-changed', at: event.at ?? now() });
+        },
+        hostCapabilitiesDiscovered(event) {
+            emit({ ...event, type: 'host.capabilities-discovered', at: event.at ?? now() });
+        }
+    };
+}
+//# sourceMappingURL=platform-events.js.map

package/dist/fleets/boundary/platform-events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-events.js","sourceRoot":"","sources":["../../../src/fleets/boundary/platform-events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAClC,kEAAkE;IAClE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,iEAAiE;IACjE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,gFAAgF;IAChF,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC7C,qFAAqF;IACrF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,4EAA4E;IAC5E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,4CAA4C;IAC5C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACrB,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IACtC,sCAAsC;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,sCAAsC;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,mCAAmC;IACnC,MAAM,EAAE,qBAAqB;IAC7B,8DAA8D;IAC9D,QAAQ,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAC1C,wEAAwE;IACxE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACrB,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IAClE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC;IAC/C,sCAAsC;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,sCAAsC;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,iFAAiF;IACjF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC/C,0CAA0C;IAC1C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACrB,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAChE,8BAA8B;IAC9B,iCAAiC;IACjC,0CAA0C;CAC1C,CAAC,CAAC;AA0CH;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAAgC;IAC3E,IAAI,WAA0E,CAAC;IAC/E,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;IACpD,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAEnE,SAAS,IAAI,CAAC,KAAqB;QAClC,8EAA8E;QAC9E,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjD,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5C,CAAC;IACF,CAAC;IAED,OAAO;QACN,IAAI,WAAW,KAAK,OAAO,WAAW,CAAC,CAAC,CAAC;QACzC,SAAS,CAAC,QAAQ;YACjB,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,IAAI,MAAM,GAAG,IAAI,CAAC;YAClB,OAAO,GAAG,EAAE;gBACX,IAAI,CAAC,MAAM;oBAAE,OAAO;gBACpB,MAAM,GAAG,KAAK,CAAC;gBACf,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5B,CAAC,CAAC;QACH,CAAC;QACD,IAAI;QACJ,cAAc,CAAC,KAAK;YACnB,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,iBAAiB,CAAC,KAAK;YACtB,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,0BAA0B,CAAC,KAAK;YAC/B,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;KACD,CAAC;AACH,CAAC"}