capsite/toybox: ingress is a capability; a hello-world web vat

E(vatAdmin).makeIngress(labels) reserves a mount and returns an ingress;
whoever holds it serves requests carrying those labels by calling
E(ingress).serve(handler). A vat gets one in its params, like any other
remote object; nothing in a vat's module is an entrypoint. A request
reaches the handler as passable data (method, path, labels, body), and
the response comes back as data (status, headers, body). The handler is
a live reference for now: after a restart its mount answers 503.

vats/hello.js serves hello, world; pnpm hello creates it on a running
toybox (client.js is the Node OCapN client, shared with the tests).

pnpm start and pnpm switchboard never ran: systemd-socket-activate wants
absolute paths for unix sockets.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

toybox/test/ocapn.test.js

@@ -5,42 +5,17 @@ import { join } from "node:path";
 import { after, before, test } from "node:test";
 import assert from "node:assert/strict";
 import { E, Far } from "@endo/far";
-import { makeClient, swissnumFromBytes } from "@endo/ocapn";
-import { newWebSocketRpcSession } from "capnweb";
-import WebSocket from "ws";
-import { locationOf, makeRpcNetLayer } from "../netlayer.js";
+import { connectClient } from "../client.js";
 import { freePort, here, startWorkerd } from "./workerd.js";
 
 const vatSrc = (name) => readFile(join(here, "vats", name), "utf8");
 
-/**
- * An OCapN client on the admin socket: registers its own gateway with the
- * router there, and reaches every other peer through it.
- *
- * @param {string} adminSock
- * @param {string} designator
- */
-const connectClient = async (adminSock, designator) => {
-	const ws = new WebSocket(`ws+unix:${adminSock}:/`);
-	await new Promise((resolve, reject) => (ws.once("open", resolve), ws.once("error", reject)));
-	const session = newWebSocketRpcSession(ws);
-	const ocapn = makeClient({ debugLabel: designator, verbose: !!process.env.OCAPN_LOG });
-	const netlayer = await ocapn.registerNetlayer(
-		makeRpcNetLayer({ designator, openGateway: (d) => session.gateway(d) }),
-	);
-	await session.register(designator, netlayer.gateway);
-	const vatAdmin = await ocapn.enlivenSturdyRef(
-		ocapn.makeSturdyRef(locationOf("vatAdmin"), swissnumFromBytes(new TextEncoder().encode("vatAdmin"))),
-	);
-	return { vatAdmin, close: () => (ocapn.shutdown(), ws.close()) };
-};
-
-let dir, server, client;
+let dir, port, server, client;
 
 before(async () => {
 	dir = await mkdtemp(join(tmpdir(), "toybox-ocapn-"));
 	await mkdir(join(dir, "state"));
-	const port = await freePort();
+	port = await freePort();
 	server = await startWorkerd(
 		"config.capnp",
 		[
@@ -50,7 +25,7 @@ before(async () => {
 		{ port, host: "127.0.0.1" },
 		[join(dir, "admin.sock")],
 	);
-	client = await connectClient(join(dir, "admin.sock"), "client-1");
+	client = await connectClient(join(dir, "admin.sock"), "client-1", { verbose: !!process.env.OCAPN_LOG });
 });
 
 after(async () => {
@@ -77,3 +52,17 @@ test("a counter vat counts; two counter vats count apart", async () => {
 	assert.equal(await E(a).read(), 2);
 	assert.equal(await E(b).read(), 1);
 });
+
+test("a vat serves the web through the ingress it is given", async () => {
+	const ingress = await E(client.vatAdmin).makeIngress({ vat: "hello" });
+	await E(client.vatAdmin).createVat(await vatSrc("hello.js"), { ingress });
+	const resp = await fetch(`http://127.0.0.1:${port}/greet?vat=hello`);
+	assert.equal(resp.status, 200);
+	assert.equal(resp.headers.get("content-type"), "text/html; charset=utf-8");
+	assert.match(await resp.text(), /<h1>Hello, world<\/h1><p>from a toybox vat, at \/greet<\/p>/);
+});
+
+test("an ingress nobody serves is a 503", async () => {
+	await E(client.vatAdmin).makeIngress({ vat: "idle" });
+	assert.equal((await fetch(`http://127.0.0.1:${port}/?vat=idle`)).status, 503);
+});