@irisrun/channel-rest

Durable, replay-safe HTTP sessions. The in-process REST channel over node:http that owns the two-identifier protocol — a stable sessionId plus a single-use continuationToken rotated every committed turn — so a session can be paused and resumed across processes and a stale or forged token is refused loudly (4xx), never a silent 200.

What it is

makeRestChannel mints the sessionId, owns and issues the continuationToken, and streams a turn live over SSE and a hand-rolled, zero-dependency WebSocket (ws://…/v1/ws) — both records and model token deltas. Drop the Accept: text/event-stream header for one buffered JSON reply. A real external HTTP deploy is an env-gated smoke test.

The two-identifier protocol itself — token rotation (only on a committed turn), the atomic single-use claim, and the loud refusal taxonomy — lives in @irisrun/channel-core, the shared channel port; this package is the HTTP/SSE/WS transport over it and passes the shared channel-port conformance suite (see the normative channel-port spec).

Use it

iris serve ./image --port 8787     # REST + SSE + WS; add --web for the chat UI

See docs/Channels for the wire protocol and @irisrun/client-sdk for a typed client.

Part of Iris — own, portable, verifiable state.