@vibesdotdev/platform 0.0.0-stage → 1.0.0-rc.2

package/dist/fleets/ci-executor.plugin.js

@@ -0,0 +1,28 @@
+import { createRuntimePlugin } from '@vibesdotdev/kernel';
+import { BUILD_RUNNER_BUN_VERSION } from "./provision/build-runner-setup.js";
+export const fleetExecutorDescriptor = {
+    id: 'fleet-host',
+    kind: 'ci/executor',
+    name: 'Fleet Host',
+    profiles: ['fleet'],
+    // A fleet host is a real machine: it can be linux, macos, or windows on x64 or arm64,
+    // which the disposable sandbox never is. Declaring that here is what makes
+    // `runsOn: macos` and `runsOn: windows` honest on enrolled fleet hosts.
+    os: ['linux', 'macos', 'windows'],
+    arch: ['x64', 'arm64'],
+    supportsReleasePackaging: false,
+    supportsCancellation: true,
+    priority: 200,
+    cacheToolchain: `fleet-host/bun-${BUILD_RUNNER_BUN_VERSION}`
+};
+/** The consumer names its priced compute source; brought machines may omit it. */
+export function createFleetCiExecutorPlugin(options = {}) {
+    return createRuntimePlugin({
+        id: 'platform/fleets/ci-executor',
+        name: 'Fleet CI Executor Metadata',
+        dependencies: ['ci'],
+        descriptors: [{ ...fleetExecutorDescriptor, ...options }]
+    });
+}
+export default createFleetCiExecutorPlugin();
+//# sourceMappingURL=ci-executor.plugin.js.map

package/dist/fleets/ci-executor.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-executor.plugin.js","sourceRoot":"","sources":["../../src/fleets/ci-executor.plugin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAE7E,MAAM,CAAC,MAAM,uBAAuB,GAA8B;IACjE,EAAE,EAAE,YAAY;IAChB,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE,YAAY;IAClB,QAAQ,EAAE,CAAC,OAAO,CAAC;IACnB,sFAAsF;IACtF,2EAA2E;IAC3E,wEAAwE;IACxE,EAAE,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC;IACjC,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;IACtB,wBAAwB,EAAE,KAAK;IAC/B,oBAAoB,EAAE,IAAI;IAC1B,QAAQ,EAAE,GAAG;IACb,cAAc,EAAE,kBAAkB,wBAAwB,EAAE;CAC5D,CAAC;AAEF,kFAAkF;AAClF,MAAM,UAAU,2BAA2B,CAC1C,UAA8D,EAAE;IAEhE,OAAO,mBAAmB,CAAC;QAC1B,EAAE,EAAE,6BAA6B;QACjC,IAAI,EAAE,4BAA4B;QAClC,YAAY,EAAE,CAAC,IAAI,CAAC;QACpB,WAAW,EAAE,CAAC,EAAE,GAAG,uBAAuB,EAAE,GAAG,OAAO,EAAE,CAAC;KACzD,CAAC,CAAC;AACJ,CAAC;AAED,eAAe,2BAA2B,EAAE,CAAC"}

package/dist/fleets/client.d.ts

@@ -0,0 +1,97 @@
+import { type DeclaredExecuteOptions, type DeclaredSpawnOptions, type RuntimeRefHandle, type VibesRuntime, type KindContext } from '@vibesdotdev/kernel';
+import { BaseRuntimeClient, type RuntimeClient, type RuntimeClientDescriptor } from '@vibesdotdev/kernel/client';
+import { type RpcDecoded, type RemoteRuntime } from '@vibesdotdev/kernel-rpc';
+import type { FleetHostDescriptor } from './kinds/host.kind.ts';
+import type { ReachableRuntimeEntry } from './registry/reachable-runtime.ts';
+import { type FleetRequestCredentials } from './request-credentials.ts';
+import type { ToolCallContext } from '@vibesdotdev/kernel';
+import type { ExecuteResult, ProcessHandle } from '@vibesdotdev/kernel/execution';
+import * as z from 'zod/v4';
+declare const executionSessionChoiceSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    status: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type ExecutionSessionChoice = z.infer<typeof executionSessionChoiceSchema>;
+export declare const fleetClientDescriptor: RuntimeClientDescriptor;
+/** Host-owned, authenticated lookup for one request. */
+export interface FleetRequestHostResolver {
+    resolve(hostId: string): Promise<ReachableRuntimeEntry | null>;
+}
+export interface FleetRequestScope {
+    /** Must return only a host the active request is authorized to reach. */
+    hosts: FleetRequestHostResolver;
+    /**
+     * This request's connect credentials. Composed as the private custody
+     * runtime's `secrets/store`, so the reached host's `auth` reference resolves
+     * through `runtime.resolveCredential` (RC05), never ambient state.
+     */
+    credentials?: FleetRequestCredentials;
+}
+/**
+ * A reachable host mounted in private runtime custody for one callback.
+ * The runtime and ref expire when `withHost()` returns; a connected
+ * `RemoteRuntime` owns its own socket and remains valid until disposed.
+ */
+export interface FleetScopedHost {
+    readonly runtime: VibesRuntime;
+    readonly descriptor: FleetHostDescriptor;
+    readonly ref: RuntimeRefHandle;
+    connect(): Promise<RemoteRuntime>;
+}
+export interface FleetClientContract extends RuntimeClient {
+    /**
+     * Run a declared command on one caller-authorized host. `request.declaration`
+     * names the child's own variables and the host variables it inherits; the
+     * host composes the environment. PATH, HOME and a composed env never travel.
+     */
+    executeCommand(hostId: string, request: DeclaredExecuteOptions, ctx: ToolCallContext): Promise<ExecuteResult>;
+    /**
+     * Read one file from a caller-authorized host through the `filesystem/adapter`
+     * its daemon exposes; the host's adapter decides which paths it admits.
+     */
+    readFile(hostId: string, path: string, ctx: ToolCallContext): Promise<Uint8Array>;
+    /** Spawn a declared request on one caller-authorized host; the handle's exit settles after its output drained. */
+    spawnCommand(hostId: string, request: DeclaredSpawnOptions, ctx: ToolCallContext): Promise<ProcessHandle>;
+    listExecutionSessions(hostId: string, kind: 'browser' | 'desktop', ctx: ToolCallContext): Promise<ExecutionSessionChoice[]>;
+    invokeBoundTool<Input>(hostId: string, toolId: string, input: Input, ctx: ToolCallContext): Promise<RpcDecoded>;
+    forRequest(scope: FleetRequestScope): FleetClientContract;
+    withHost<T>(hostId: string, use: (host: FleetScopedHost) => Promise<T>): Promise<T | null>;
+}
+/**
+ * Runtime port `VibesRuntime` (Runtime SPEC `./client`): a request-custody
+ * runtime is declared from the host's `environment` and `declaredScope`,
+ * which `RuntimeRef` does not carry.
+ */
+export declare class FleetClient extends BaseRuntimeClient<VibesRuntime> implements FleetClientContract {
+    private readonly requestScope?;
+    constructor(descriptor?: RuntimeClientDescriptor, context?: KindContext<VibesRuntime>, runtime?: VibesRuntime, requestScope?: FleetRequestScope);
+    forRequest(scope: FleetRequestScope): FleetClient;
+    invokeBoundTool<Input>(hostId: string, toolId: string, input: Input, ctx: ToolCallContext): Promise<RpcDecoded>;
+    /**
+     * Execute a declared request on one caller-authorized host; never resolve
+     * credentials or RPC from ambient state. The request is forwarded unchanged:
+     * the receiving host admits it and composes the child environment itself.
+     */
+    executeCommand(hostId: string, request: DeclaredExecuteOptions, ctx: ToolCallContext): Promise<ExecuteResult>;
+    readFile(hostId: string, path: string, ctx: ToolCallContext): Promise<Uint8Array>;
+    /** Owner-checked names for configuration surfaces; no credentials or session internals leave the client. */
+    listExecutionSessions(hostId: string, kind: 'browser' | 'desktop', ctx: ToolCallContext): Promise<ExecutionSessionChoice[]>;
+    withHost<T>(hostId: string, use: (host: FleetScopedHost) => Promise<T>): Promise<T | null>;
+    /**
+     * Spawn a declared request on one caller-authorized host and return a local
+     * `ProcessHandle` over the wire (`adaptWireProcessHandle`). The request is
+     * forwarded unchanged; the host admits it and composes the child environment.
+     * The connection and the request-custody runtime belong to the process: they
+     * are released only once its exit settles, and the adapter settles exit only
+     * after stdout and stderr have delivered everything.
+     */
+    spawnCommand(hostId: string, request: DeclaredSpawnOptions, ctx: ToolCallContext): Promise<ProcessHandle>;
+    /** Settle every release independently; cleanup must never replace the operation outcome. */
+    private releaseResources;
+    /** Mount one caller-authorized host in private custody; the caller disposes it. */
+    private mountHost;
+}
+export declare function getVibesFleetClient(runtime: VibesRuntime): Promise<FleetClientContract>;
+export default FleetClient;
+//# sourceMappingURL=client.d.ts.map

package/dist/fleets/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/fleets/client.ts"],"names":[],"mappings":"AAEA,OAAO,EAQN,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EAEzB,KAAK,gBAAgB,EAErB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACN,iBAAiB,EAGjB,KAAK,aAAa,EAClB,KAAK,uBAAuB,EAC5B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAsB,KAAK,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAElG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAE7E,OAAO,EAAmC,KAAK,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACzG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAElF,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,QAAA,MAAM,4BAA4B;;;;iBAAuF,CAAC;AAC1H,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,qBAAqB,EAAE,uBAOlC,CAAC;AAEH,wDAAwD;AACxD,MAAM,WAAW,wBAAwB;IACxC,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,iBAAiB;IACjC,yEAAyE;IACzE,KAAK,EAAE,wBAAwB,CAAC;IAChC;;;;OAIG;IACH,WAAW,CAAC,EAAE,uBAAuB,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;IAC/B,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;CAClC;AA4BD,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACzD;;;;OAIG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9G;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAClF,kHAAkH;IAClH,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1G,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,SAAS,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IAC5H,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChH,UAAU,CAAC,KAAK,EAAE,iBAAiB,GAAG,mBAAmB,CAAC;IAC1D,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;CAC3F;AAED;;;;GAIG;AACH,qBAAa,WAAY,SAAQ,iBAAiB,CAAC,YAAY,CAAE,YAAW,mBAAmB;IAC9F,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAoB;gBAGjD,UAAU,GAAE,uBAA+C,EAC3D,OAAO,CAAC,EAAE,WAAW,CAAC,YAAY,CAAC,EACnC,OAAO,CAAC,EAAE,YAAY,EACtB,YAAY,CAAC,EAAE,iBAAiB;IAMjC,UAAU,CAAC,KAAK,EAAE,iBAAiB,GAAG,WAAW;IAI3C,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;IAOrH;;;;OAIG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC;IAgB7G,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;IAkBvF,4GAA4G;IACtG,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,SAAS,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC;IAc3H,QAAQ,CAAC,CAAC,EACf,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GACxC,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAUpB;;;;;;;OAOG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC;IAkC/G,4FAA4F;YAC9E,gBAAgB;IAgB9B,mFAAmF;YACrE,SAAS;CAwCvB;AA4CD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAEvF;AAED,eAAe,WAAW,CAAC"}

package/dist/fleets/client.js

@@ -0,0 +1,257 @@
+import { WireFunctionSchema } from "../schemas/fleet-wire.js";
+import { getLogger } from '@vibesdotdev/logging/contexts';
+import { bootstrapVibesRuntime, CapabilityError, createRuntimePlugin, registerRuntimeEnvironment, settle, settleNow, valueFreeFailure } from '@vibesdotdev/kernel';
+import { BaseRuntimeClient, getVibesClient, RuntimeClientDescriptorSchema } from '@vibesdotdev/kernel/client';
+import { getVibesRemoteFrom } from '@vibesdotdev/kernel-rpc';
+import { adaptWireProcessHandle, runtimeRpcExecutionPlugin } from '@vibesdotdev/kernel-rpc/execution';
+import { mountReachableRuntimeEntry } from "./registry-bridge.plugin.js";
+import { registerFleetRequestCredentials } from "./request-credentials.js";
+import { boundToolRequestScope, invokeBoundTool } from "./bound-tool.js";
+import * as z from 'zod/v4';
+import { decodeFileContent } from '@vibesdotdev/filesystem/wire';
+const executionSessionChoiceSchema = z.object({ id: z.string().min(1), name: z.string(), status: z.string().optional() });
+export const fleetClientDescriptor = RuntimeClientDescriptorSchema.parse({
+    id: 'fleet',
+    kind: 'runtime/client',
+    name: 'Fleet Client',
+    description: 'Request-scoped access to authorized reachable runtimes without mutating the shared host runtime.',
+    enabled: true
+});
+/**
+ * Runtime port `VibesRuntime` (Runtime SPEC `./client`): a request-custody
+ * runtime is declared from the host's `environment` and `declaredScope`,
+ * which `RuntimeRef` does not carry.
+ */
+export class FleetClient extends BaseRuntimeClient {
+    requestScope;
+    constructor(descriptor = fleetClientDescriptor, context, runtime, requestScope) {
+        super(descriptor, context, runtime);
+        this.requestScope = requestScope;
+    }
+    forRequest(scope) {
+        return new FleetClient(this.descriptor, undefined, this.runtime, scope);
+    }
+    async invokeBoundTool(hostId, toolId, input, ctx) {
+        const scoped = this.requestScope
+            ? this
+            : this.forRequest(await boundToolRequestScope(this.runtime, ctx, { requireCallerBearer: toolId === 'runbook' }));
+        return invokeBoundTool(this.runtime, scoped, hostId, toolId, input, ctx);
+    }
+    /**
+     * Execute a declared request on one caller-authorized host; never resolve
+     * credentials or RPC from ambient state. The request is forwarded unchanged:
+     * the receiving host admits it and composes the child environment itself.
+     */
+    async executeCommand(hostId, request, ctx) {
+        const scoped = this.requestScope ? this : this.forRequest(await boundToolRequestScope(this.runtime, ctx));
+        const result = await scoped.withHost(hostId, async (host) => {
+            const remote = await host.connect();
+            try {
+                const execution = await remote.query('runtime/execution');
+                if (!execution)
+                    throw new CapabilityError(`Host '${hostId}' exposed no 'runtime/execution' capability over the fleet wire.`, 'UNAVAILABLE', { reason: 'fleet-host-execution-unavailable', retryable: false });
+                return await execution.execute(request);
+            }
+            finally {
+                await this.releaseResources([() => remote[Symbol.dispose]()]);
+            }
+        });
+        if (!result)
+            throw new CapabilityError('The selected host is unavailable or is not owned by the authenticated caller', 'NOT_FOUND', { reason: 'fleet-host-not-reachable', retryable: false });
+        return result;
+    }
+    async readFile(hostId, path, ctx) {
+        const scoped = this.requestScope ? this : this.forRequest(await boundToolRequestScope(this.runtime, ctx));
+        const result = await scoped.withHost(hostId, async (host) => {
+            const remote = await host.connect();
+            try {
+                const filesystem = await remote.query('filesystem/adapter');
+                if (!filesystem)
+                    throw new CapabilityError(`Host '${hostId}' exposed no 'filesystem/adapter' over the fleet wire.`, 'UNAVAILABLE', { reason: 'fleet-host-filesystem-unavailable', retryable: false });
+                const content = decodeFileContent(await filesystem.readFile(path));
+                if (content instanceof Uint8Array)
+                    return content;
+                return new TextEncoder().encode(content);
+            }
+            finally {
+                await this.releaseResources([() => remote[Symbol.dispose]()]);
+            }
+        });
+        if (!result)
+            throw new CapabilityError('The selected host is unavailable or is not owned by the authenticated caller', 'NOT_FOUND', { reason: 'fleet-host-not-reachable', retryable: false });
+        return result;
+    }
+    /** Owner-checked names for configuration surfaces; no credentials or session internals leave the client. */
+    async listExecutionSessions(hostId, kind, ctx) {
+        const context = {
+            ...ctx, metadata: {
+                ...ctx.metadata,
+                executionBindings: ctx.metadata?.executionBindings ?? { hostTarget: { kind: 'host', hostId }, apiSessionIds: [] }
+            }
+        };
+        const response = await this.invokeBoundTool(hostId, kind, { action: 'session.list' }, context);
+        const envelope = z.object({ sessions: z.array(executionSessionChoiceSchema).optional(), data: z.array(executionSessionChoiceSchema).optional() }).parse(response);
+        const sessions = kind === 'browser' ? envelope.sessions : envelope.data;
+        if (!sessions)
+            throw new CapabilityError(`The selected host returned no ${kind} session roster`, 'UNAVAILABLE', { reason: 'fleet-session-roster-missing', retryable: false });
+        return sessions;
+    }
+    async withHost(hostId, use) {
+        const mounted = await this.mountHost(hostId);
+        if (!mounted)
+            return null;
+        try {
+            return await use(mounted.host);
+        }
+        finally {
+            await this.releaseResources([() => mounted.dispose()]);
+        }
+    }
+    /**
+     * Spawn a declared request on one caller-authorized host and return a local
+     * `ProcessHandle` over the wire (`adaptWireProcessHandle`). The request is
+     * forwarded unchanged; the host admits it and composes the child environment.
+     * The connection and the request-custody runtime belong to the process: they
+     * are released only once its exit settles, and the adapter settles exit only
+     * after stdout and stderr have delivered everything.
+     */
+    async spawnCommand(hostId, request, ctx) {
+        const scoped = this.requestScope ? this : this.forRequest(await boundToolRequestScope(this.runtime, ctx));
+        const mounted = await scoped.mountHost(hostId);
+        if (!mounted) {
+            throw new CapabilityError('The selected host is unavailable or is not owned by the authenticated caller', 'NOT_FOUND', {
+                reason: 'fleet-host-not-reachable',
+                retryable: false
+            });
+        }
+        let remote;
+        const release = async () => {
+            await this.releaseResources([
+                () => remote?.[Symbol.dispose](),
+                () => mounted.dispose()
+            ]);
+        };
+        try {
+            remote = await mounted.host.connect();
+            const execution = await remote.query('runtime/execution');
+            if (!execution) {
+                throw new CapabilityError(`Host '${hostId}' exposed no 'runtime/execution' capability over the fleet wire.`, 'UNAVAILABLE', {
+                    reason: 'fleet-host-execution-unavailable',
+                    retryable: false
+                });
+            }
+            const handle = await adaptWireProcessHandle(mounted.host.runtime, await execution.spawn(request));
+            void settle(async () => { try {
+                await handle.exited;
+            }
+            finally {
+                await release();
+            } });
+            return handle;
+        }
+        catch (error) {
+            await release();
+            throw error;
+        }
+    }
+    /** Settle every release independently; cleanup must never replace the operation outcome. */
+    async releaseResources(resources) {
+        const outcomes = await Promise.all(resources.map((release) => settle(release)));
+        for (const outcome of outcomes) {
+            if (!outcome.ok) {
+                const logged = settleNow(() => {
+                    getLogger('platform:fleet', this.runtime).error('Fleet resource cleanup failed.', { error: valueFreeFailure(outcome.cause) });
+                });
+                if (!logged.ok) {
+                    settleNow(() => this.runtime.diagnostics.error('fleet.cleanup-failed', {
+                        scope: 'platform', plugin: 'fleet', error: logged.cause
+                    }));
+                }
+            }
+        }
+    }
+    /** Mount one caller-authorized host in private custody; the caller disposes it. */
+    async mountHost(hostId) {
+        const scope = this.requestScope;
+        if (!scope) {
+            throw new CapabilityError('Fleet client requires an authenticated per-request host resolver.', 'PERMISSION_DENIED', { reason: 'fleet-request-scope-missing', retryable: false });
+        }
+        const entry = await scope.hosts.resolve(hostId);
+        if (!entry)
+            return null;
+        if (entry.rpc.transport !== 'http' && entry.rpc.transport !== 'relay') {
+            throw new CapabilityError(`Fleet request resolver returned unsupported transport '${entry.rpc.transport}' for '${hostId}'.`, 'UNAVAILABLE', { reason: 'fleet-transport-unsupported', retryable: false });
+        }
+        const remoteHardware = entry.rpc.remoteScope?.hardware ?? 'consumer';
+        const scopedRuntime = await bootstrapVibesRuntime({
+            environment: requestCustodyEnvironment(this.runtime, remoteHardware),
+            // The custody runtime owns the spawn's whole lifetime, so it also
+            // composes the execution-wire client that adapts the spawn port into a
+            // local ProcessHandle (runtimeRpcExecutionPlugin registers it).
+            composition: { kind: 'literal', plugins: [async () => ({ default: runtimeRpcExecutionPlugin })] },
+            binding: 'owned'
+        });
+        if (scope.credentials)
+            registerFleetRequestCredentials(scopedRuntime, scope.credentials);
+        const mount = mountReachableRuntimeEntry(scopedRuntime, entry, { registerHttpLoader: true });
+        const ref = { runtimeId: mount.descriptor.id, local: false };
+        return {
+            host: {
+                runtime: scopedRuntime,
+                descriptor: mount.descriptor,
+                ref,
+                connect: () => getVibesRemoteFrom(scopedRuntime, ref.runtimeId)
+            },
+            dispose: async () => {
+                await this.releaseResources([() => mount.dispose(), () => scopedRuntime.dispose()]);
+            }
+        };
+    }
+}
+/**
+ * The environment plugin of one request-custody runtime: a registration of the
+ * host's one environment (its capture, per-key state, loader, secrets and
+ * invocation store factory; rc02-rc03 §2.2.1 rule 5), declared on the reached
+ * host's hardware class so the `runtime/rpc` and `fleet/host` assets mounted
+ * for it, which are constrained to that hardware, resolve there.
+ *
+ * It is bound to no workspace (rc02-rc03 §2.4). The custody runtime addresses
+ * a reached host, whose workspace is not this host's: the declaration drops the
+ * host's `workspace` (root and access) and the registration answers no
+ * binding, so `runtime/workspace-path` there is `workspace-unbound` instead of
+ * handing the local workspace (and its write access) to a remote call. Every
+ * other member answers from the host environment itself.
+ */
+function requestCustodyEnvironment(host, hardware) {
+    const environment = host.environment;
+    const { workspace: _hostWorkspace, ...hostScope } = host.declaredScope;
+    const scope = { ...hostScope, hardware };
+    const declared = new Proxy(environment, {
+        get(target, key) {
+            if (key === 'scope')
+                return scope;
+            if (key === 'workspaceBinding')
+                return unboundWorkspace;
+            const value = target[key];
+            const callable = WireFunctionSchema.safeParse(value);
+            return callable.success ? callable.data.bind(target) : value;
+        }
+    });
+    return createRuntimePlugin({
+        id: 'fleet.request-custody-environment',
+        name: 'Fleet request custody environment',
+        description: "The host's environment, declared on one reached host's hardware for a request-scoped mount.",
+        onRegister(runtime) {
+            registerRuntimeEnvironment(runtime, declared);
+        }
+    });
+}
+/** A request-custody registration captures no workspace binding. */
+function unboundWorkspace() {
+    return null;
+}
+export function getVibesFleetClient(runtime) {
+    return getVibesClient('fleet', runtime);
+}
+export default FleetClient;
+//# sourceMappingURL=client.js.map

package/dist/fleets/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/fleets/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EACN,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,0BAA0B,EAC1B,MAAM,EACN,SAAS,EACT,gBAAgB,EAQhB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACN,iBAAiB,EACjB,cAAc,EACd,6BAA6B,EAG7B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAuC,MAAM,yBAAyB,CAAC;AAClG,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAwB,MAAM,mCAAmC,CAAC;AAG5H,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,+BAA+B,EAAgC,MAAM,0BAA0B,CAAC;AAGzG,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAwB,MAAM,8BAA8B,CAAC;AAEvF,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAG1H,MAAM,CAAC,MAAM,qBAAqB,GAA4B,6BAA6B,CAAC,KAAK,CAAC;IACjG,EAAE,EAAE,OAAO;IACX,IAAI,EAAE,gBAAgB;IACtB,IAAI,EAAE,cAAc;IACpB,WAAW,EACV,kGAAkG;IACnG,OAAO,EAAE,IAAI;CACb,CAAC,CAAC;AA4EH;;;;GAIG;AACH,MAAM,OAAO,WAAY,SAAQ,iBAA+B;IAC9C,YAAY,CAAqB;IAElD,YACC,aAAsC,qBAAqB,EAC3D,OAAmC,EACnC,OAAsB,EACtB,YAAgC;QAEhC,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IAClC,CAAC;IAED,UAAU,CAAC,KAAwB;QAClC,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,eAAe,CAAQ,MAAc,EAAE,MAAc,EAAE,KAAY,EAAE,GAAoB;QAC9F,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY;YAC/B,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,mBAAmB,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC,CAAC,CAAC;QAClH,OAAO,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,OAA+B,EAAE,GAAoB;QACzF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1G,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,CAAC;gBACJ,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAAsC,mBAAmB,CAAC,CAAC;gBAC/F,IAAI,CAAC,SAAS;oBAAE,MAAM,IAAI,eAAe,CAAC,SAAS,MAAM,kEAAkE,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,kCAAkC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC9M,OAAO,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACzC,CAAC;oBAAS,CAAC;gBACV,MAAM,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/D,CAAC;QACF,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,eAAe,CAAC,8EAA8E,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9L,OAAO,MAAM,CAAC;IACf,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,IAAY,EAAE,GAAoB;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1G,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,CAAC;gBACJ,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CAAqC,oBAAoB,CAAC,CAAC;gBAChG,IAAI,CAAC,UAAU;oBAAE,MAAM,IAAI,eAAe,CAAC,SAAS,MAAM,wDAAwD,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,mCAAmC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;gBACtM,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;gBACnE,IAAI,OAAO,YAAY,UAAU;oBAAE,OAAO,OAAO,CAAC;gBAClD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC1C,CAAC;oBAAS,CAAC;gBACV,MAAM,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/D,CAAC;QACF,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,eAAe,CAAC,8EAA8E,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9L,OAAO,MAAM,CAAC;IACf,CAAC;IAED,4GAA4G;IAC5G,KAAK,CAAC,qBAAqB,CAAC,MAAc,EAAE,IAA2B,EAAE,GAAoB;QAC5F,MAAM,OAAO,GAAG;YACf,GAAG,GAAG,EAAE,QAAQ,EAAE;gBACjB,GAAG,GAAG,CAAC,QAAQ;gBACf,iBAAiB,EAAE,GAAG,CAAC,QAAQ,EAAE,iBAAiB,IAAI,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;aACjH;SACD,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/F,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClK,MAAM,QAAQ,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QACxE,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,eAAe,CAAC,iCAAiC,IAAI,iBAAiB,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9K,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,QAAQ,CACb,MAAc,EACd,GAA0C;QAE1C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,IAAI,CAAC;YACJ,OAAO,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;gBAAS,CAAC;YACV,MAAM,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxD,CAAC;IACF,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,OAA6B,EAAE,GAAoB;QACrF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1G,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,IAAI,eAAe,CAAC,8EAA8E,EAAE,WAAW,EAAE;gBACtH,MAAM,EAAE,0BAA0B;gBAClC,SAAS,EAAE,KAAK;aAChB,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,MAAiC,CAAC;QACtC,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;YACzC,MAAM,IAAI,CAAC,gBAAgB,CAAC;gBAC3B,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;gBAChC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE;aACvB,CAAC,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,CAAC;YACJ,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAAkC,mBAAmB,CAAC,CAAC;YAC3F,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChB,MAAM,IAAI,eAAe,CAAC,SAAS,MAAM,kEAAkE,EAAE,aAAa,EAAE;oBAC3H,MAAM,EAAE,kCAAkC;oBAC1C,SAAS,EAAE,KAAK;iBAChB,CAAC,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAClG,KAAK,MAAM,CAAC,KAAK,IAAI,EAAE,GAAG,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,MAAM,CAAC;YAAC,CAAC;oBAAS,CAAC;gBAAC,MAAM,OAAO,EAAE,CAAC;YAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvF,OAAO,MAAM,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,EAAE,CAAC;YAChB,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;IAED,4FAA4F;IACpF,KAAK,CAAC,gBAAgB,CAAC,SAAoD;QAClF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAChF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE;oBAC7B,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC/H,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBAChB,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,sBAAsB,EAAE;wBACtE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK;qBACvD,CAAC,CAAC,CAAC;gBACL,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,mFAAmF;IAC3E,KAAK,CAAC,SAAS,CAAC,MAAc;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,IAAI,eAAe,CAAC,mEAAmE,EAAE,mBAAmB,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAClL,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,KAAK,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;YACvE,MAAM,IAAI,eAAe,CACxB,0DAA0D,KAAK,CAAC,GAAG,CAAC,SAAS,UAAU,MAAM,IAAI,EACjG,aAAa,EACb,EAAE,MAAM,EAAE,6BAA6B,EAAE,SAAS,EAAE,KAAK,EAAE,CAC3D,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,IAAI,UAAU,CAAC;QACrE,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAAC;YACjD,WAAW,EAAE,yBAAyB,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC;YACpE,kEAAkE;YAClE,uEAAuE;YACvE,gEAAgE;YAChE,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC,EAAE;YACjG,OAAO,EAAE,OAAO;SAChB,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,WAAW;YAAE,+BAA+B,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACzF,MAAM,KAAK,GAAG,0BAA0B,CAAC,aAAa,EAAE,KAAK,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,MAAM,GAAG,GAAqB,EAAE,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAE/E,OAAO;YACN,IAAI,EAAE;gBACL,OAAO,EAAE,aAAa;gBACtB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,GAAG;gBACH,OAAO,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,aAAa,EAAE,GAAG,CAAC,SAAS,CAAC;aAC/D;YACD,OAAO,EAAE,KAAK,IAAI,EAAE;gBACnB,MAAM,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACrF,CAAC;SACD,CAAC;IACH,CAAC;CACD;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,yBAAyB,CAAC,IAAkB,EAAE,QAAkC;IACxF,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACrC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,SAAS,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC;IACvE,MAAM,KAAK,GAAiB,EAAE,GAAG,SAAS,EAAE,QAAQ,EAAE,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE;QACvC,GAAG,CAAC,MAAM,EAAE,GAA6B;YACxC,IAAI,GAAG,KAAK,OAAO;gBAAE,OAAO,KAAK,CAAC;YAClC,IAAI,GAAG,KAAK,kBAAkB;gBAAE,OAAO,gBAAgB,CAAC;YACxD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACrD,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC9D,CAAC;KACD,CAAC,CAAC;IACH,OAAO,mBAAmB,CAAC;QAC1B,EAAE,EAAE,mCAAmC;QACvC,IAAI,EAAE,mCAAmC;QACzC,WAAW,EAAE,6FAA6F;QAC1G,UAAU,CAAC,OAAO;YACjB,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/C,CAAC;KACD,CAAC,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,SAAS,gBAAgB;IACxB,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAqB;IACxD,OAAO,cAAc,CAAsB,OAAO,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,eAAe,WAAW,CAAC"}

package/dist/fleets/daemon/bun/index.d.ts

@@ -0,0 +1,9 @@
+import { type FleetDaemon, type FleetDaemonOptions } from '../fleet-daemon.ts';
+export * from '../index.ts';
+/**
+ * Start the daemon. The listener is bound through the receiving host's own runtime (`options.runtime`), which
+ * selects the native HTTP host, so starting is asynchronous and a refused construction (an ungated or
+ * unauthenticated non-loopback bind) rejects.
+ */
+export declare function startFleetDaemon(options: FleetDaemonOptions): Promise<FleetDaemon>;
+//# sourceMappingURL=index.d.ts.map

package/dist/fleets/daemon/bun/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/fleets/daemon/bun/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAqB,KAAK,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAElG,cAAc,aAAa,CAAC;AAE5B;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAElF"}

package/dist/fleets/daemon/bun/index.js

@@ -0,0 +1,13 @@
+/** Bun host binding; portable fleet contracts remain on the parent daemon surface. */
+import { listenHttp } from '@vibesdotdev/kernel-rpc/http';
+import { createFleetDaemon } from "../fleet-daemon.js";
+export * from "../index.js";
+/**
+ * Start the daemon. The listener is bound through the receiving host's own runtime (`options.runtime`), which
+ * selects the native HTTP host, so starting is asynchronous and a refused construction (an ungated or
+ * unauthenticated non-loopback bind) rejects.
+ */
+export function startFleetDaemon(options) {
+    return createFleetDaemon(options, (port, target, host) => listenHttp(port, target, { runtime: options.runtime, host }));
+}
+//# sourceMappingURL=index.js.map

package/dist/fleets/daemon/bun/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/fleets/daemon/bun/index.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAA6C,MAAM,oBAAoB,CAAC;AAElG,cAAc,aAAa,CAAC;AAE5B;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAA2B;IAC3D,OAAO,iBAAiB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACzH,CAAC"}

package/dist/fleets/daemon/daemon-root.d.ts

@@ -0,0 +1,148 @@
+import type { RpcSource } from '@vibesdotdev/kernel-rpc';
+/**
+ * The daemon root — the object a remote consumer reaches over the `runtime/rpc`
+ * wire (fleet.md §4.2; L6d phase 4).
+ *
+ * `getVibesRemote(hostId)` returns a proxy whose `.query(kindId)` routes through
+ * `invoke(rootRef, 'query', [kindId])` to THIS object's `query`. So the root's
+ * single job is to resolve a kind id to the host-side impl the daemon exposes —
+ * for L6d that is the host's own `runtime/execution` (execute/spawn/session),
+ * mounted onto the daemon's OWN local runtime. Reaching it is the spec's
+ * `query('runtime/execution').on(hostRef)` over the daemon, just spelled with the
+ * `getVibesRemote` sugar.
+ *
+ * The root exposes `runtime/execution` (always) and optionally `autoloop/monitor`
+ * when the host has the autoloop consumer plugin registered. It carries no
+ * execution capabilities of its own — it *exposes* the kind's impl, it does not
+ * *be* execution (corrections #2/#3). Substrate/PTY/shell live on the execution
+ * impl + its `runtime/environment`, never on the host root.
+ */
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import type { RuntimeExecution } from '@vibesdotdev/kernel/execution';
+import { type DeclaredExecutionHost } from './execution-listen-policy.ts';
+/**
+ * The kind id the daemon exposes the read-only autoloop loop monitor under. A
+ * cloud surface (hq-web) resolves it over the relay with
+ * `getVibesRemote(hostId).query('autoloop/monitor')` to enumerate the host's loops.
+ * The daemon does NOT depend on `@vibesdotdev/autoloop`; it exposes whatever object
+ * the optional `resolveMonitor` returns under this id (the autoloop consumer plugin
+ * registers the actual impl on the host runtime).
+ */
+export declare const MONITOR_KIND_ID = "autoloop/monitor";
+/**
+ * The read-only monitor surface the daemon may expose. Structurally aliased (not
+ * imported from autoloop) to keep fleet-daemon dependency-light. The autoloop
+ * impl satisfies this shape.
+ */
+export interface DaemonLoopMonitor {
+    listLoops(options?: RpcSource): Promise<RpcSource>;
+    getLoop(instanceId: string): Promise<RpcSource>;
+    listEvents(instanceId: string, limit?: number): Promise<RpcSource>;
+}
+/**
+ * The remote-facing root surface. Its sole method is `query`, in two forms:
+ * `query(kindId)` resolves a kind id to the host-side impl the daemon exposes
+ * (L6d resolves `runtime/execution`; the optional fleet fan-out adds read-only
+ * `autoloop/monitor`), and `query({ kind, ids, … })` is the runtime daemon's
+ * canonical descriptor query, answered by its own handler on this host's
+ * runtime (so `getRemotePathRoots` reads a fleet host's roots).
+ */
+export interface FleetDaemonRoot {
+    /** Resolve a kind id to an exposed impl, or answer the canonical descriptor query. */
+    query(input: RpcSource): RpcSource;
+}
+/**
+ * The receiving host: its own runtime answers the canonical descriptor query
+ * and composes every declared child environment; its own signal is the only
+ * cancellation.
+ */
+export interface FleetDaemonHost extends DeclaredExecutionHost {
+    readonly runtime: VibesRuntime;
+}
+/**
+ * How the daemon resolves the host-side `runtime/execution` impl it exposes. A
+ * function so the daemon can mount its OWN local runtime's execution (resolving it
+ * via `runtime.query('runtime/execution').resolve()` is async, so the
+ * caller resolves once at start and hands the impl in here).
+ */
+export type ExecutionResolver = () => RuntimeExecution;
+/**
+ * How the daemon resolves the read-only `autoloop/monitor` impl, if exposed. A
+ * function so the caller resolves it once (from the host runtime's
+ * `query('autoloop/monitor')`) and hands it in. Optional — a daemon without the
+ * autoloop consumer plugin simply does not expose the monitor (the consumer's
+ * `query('autoloop/monitor')` then fails, which hq-web reports as
+ * "monitoring unavailable").
+ */
+export type MonitorResolver = () => DaemonLoopMonitor;
+/**
+ * The kind id the daemon exposes feature `runtime/client`s under (D-DAEMON-CLIENT).
+ * A consumer reaches a host's client by id with
+ * `getVibesRemote(hostId).query('runtime/client').withId('<id>')` — so a remote
+ * desktop/browser client (or any future feature client) is reachable on a fleet
+ * host with NO per-feature daemon change. The daemon exposes a selector object
+ * whose `withId(id)` resolves the host-side client and returns it as a wire ref.
+ */
+export declare const CLIENT_KIND_ID = "runtime/client";
+/**
+ * Resolve a host-side feature client by its `runtime/client` id. Returns the raw
+ * host-side client impl (the daemon root wire-wraps it); return `undefined` for
+ * an unknown id (the root then throws a precise "no client with id" error).
+ */
+export type ClientResolver = (clientId: string) => RpcSource;
+/**
+ * A generically-proxied host-side kind impl plus the EXACT method names a consumer
+ * may invoke back across the wire. Used for kinds the daemon proxies structurally
+ * (e.g. `filesystem/adapter` for a remote code-session workspace): the daemon
+ * declares the async I/O surface explicitly (path utilities are pure and run
+ * consumer-side, so they are NOT part of the wire surface).
+ */
+export interface ProxiedKind {
+    readonly impl: object;
+    readonly methods: readonly string[];
+}
+/** Resolve an additional proxied kind by id, or `undefined` when unexposed. */
+export type KindResolver = (kindId: string) => ProxiedKind | undefined;
+/**
+ * OPTIONAL generalizations of the daemon root beyond `runtime/execution` +
+ * `autoloop/monitor` (D-DAEMON-CLIENT). Every proxied invoke crosses the SAME
+ * L5-gated pipeline as execution — these add no ungated path.
+ */
+export interface FleetDaemonRootExtensions {
+    /**
+     * Proxy `runtime/client` by id. When supplied, `query('runtime/client')` yields
+     * a `withId(id)` selector; `withId(id)` resolves the host-side client and returns
+     * it as a wire ref so a consumer invokes its methods back over the wire.
+     */
+    readonly resolveClient?: ClientResolver;
+    /**
+     * OPTIONAL explicit wire-method surface for a resolved client. Defaults to
+     * enumerating the client's own + prototype methods ({@link wireMethodNames}).
+     * Supply this to pin a narrow, audited method set for a client.
+     */
+    readonly clientWireMethods?: (clientId: string, client: NonNullable<RpcSource>) => readonly string[];
+    /**
+     * Proxy additional kinds by id (e.g. `filesystem/adapter` for a remote
+     * code-session workspace). Returns the impl + its explicit async wire surface.
+     */
+    readonly resolveKind?: KindResolver;
+}
+/**
+ * Build the daemon root over the receiving host (its own runtime composes every
+ * declared child environment and answers the canonical descriptor query) and a
+ * resolved host-side `runtime/execution` impl, and
+ * OPTIONALLY a read-only `autoloop/monitor` + generalized proxies (D-DAEMON-CLIENT:
+ * `runtime/client` by id, and additional kinds like `filesystem/adapter`). The
+ * returned root's `query('runtime/execution')` yields the execution impl;
+ * `query('autoloop/monitor')` yields the monitor (when `resolveMonitor` is
+ * supplied); `query('runtime/client')` yields a `withId(id)` selector (when
+ * `extensions.resolveClient` is supplied); any kind `extensions.resolveKind`
+ * resolves is proxied as a wire ref; any other kind id throws.
+ *
+ * SECURITY: every proxied surface (monitor, client, kind) crosses the SAME
+ * L5-gated invoke pipeline as execution (the daemon's `target.pipeline`). It adds
+ * no ungated path — `withId`/client/kind invokes are authz+friction gated exactly
+ * like an execution invoke, and connection auth still gates the whole connection.
+ */
+export declare function createFleetDaemonRoot(host: FleetDaemonHost, resolveExecution: ExecutionResolver, resolveMonitor?: MonitorResolver, extensions?: FleetDaemonRootExtensions): FleetDaemonRoot;
+//# sourceMappingURL=daemon-root.d.ts.map

package/dist/fleets/daemon/daemon-root.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-root.d.ts","sourceRoot":"","sources":["../../../src/fleets/daemon/daemon-root.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzD;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAgD,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAItE,OAAO,EAKN,KAAK,qBAAqB,EAC1B,MAAM,8BAA8B,CAAC;AAEtC;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAElD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IACjC,SAAS,CAAC,OAAO,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACnD,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChD,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CACnE;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC/B,sFAAsF;IACtF,KAAK,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAgB,SAAQ,qBAAqB;IAC7D,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;CAC/B;AAsDD;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,gBAAgB,CAAC;AAEvD;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,iBAAiB,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAE/C;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,CAAC;AAE7D;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,+EAA+E;AAC/E,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,WAAW,GAAG,SAAS,CAAC;AAEvE;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACzC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,cAAc,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,SAAS,CAAC,KAAK,SAAS,MAAM,EAAE,CAAC;IACrG;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CACpC,IAAI,EAAE,eAAe,EACrB,gBAAgB,EAAE,iBAAiB,EACnC,cAAc,CAAC,EAAE,eAAe,EAChC,UAAU,CAAC,EAAE,yBAAyB,GACpC,eAAe,CA+EjB"}