feat(sdk): @punktfunk/host — the Effect TypeScript SDK (M3)

New top-level sdk/ package (RFC §7): a typed management-API client plus
the lifecycle event stream, built on Effect, two surfaces over one core:

- @punktfunk/host — the Promise facade front door: connect() resolves
  URL/token/TLS pin from the host's own files (zero config on the box),
  fails fast on bad credentials, pf.events.on() with typed callbacks
  (exact kinds, domain.* prefixes, "*", "dropped", "unknown"),
  pf.request() for the REST surface. Effect never required.
- @punktfunk/host/effect — the PunktfunkHost service + PunktfunkHostLive
  layer, Stream-based events()/eventsRaw(), typed errors
  (AuthError | ApiError | TransportError | VersionSkew — a 2xx that
  fails its schema is a typed skew, not undefined later), and every
  wire shape as an effect/Schema: REST generated via orval
  client:'effect' from api/openapi.json (S3 spike: works well; the
  text/event-stream payload is out of its reach), events hand-mirrored
  from the host's snapshot-tested wire format as a kind-discriminated
  union.

One reconnecting SSE core under both surfaces: spec-shaped parser,
exponential+jittered backoff (capped, resets after a healthy
connection), Last-Event-ID resume, 401 terminal. Default is LIVE tail
only — a fresh notify script must not re-fire on the host's replayed
ring (since: 0 opts into full replay).

TLS: the pin trusts exactly the host's self-signed identity cert
(chain-verified; hostname check waived — the cert is deliberately
CN-only for fingerprint pinning). Bun via fetch tls, Node via an undici
dispatcher (optionalDependency).

definePlugin() accepts both main shapes (async fn | Effect requiring
PunktfunkHost). Examples in both styles; README carries the compat
contract + systemd/Task Scheduler templates.

11 bun tests green (wire decode against the Rust snapshot strings,
SSE parser/reconnect/Last-Event-ID/401, both surfaces vs a mock host).
Live-verified against a real host on Bun AND Node through the pinned
loopback hop: connect → REST mutate → live event received → resume
cursor advanced; a wrong CA is rejected. npm publish + CI wiring
deferred (npm org = RFC open question 1).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

sdk/src/core.ts

@@ -0,0 +1,47 @@
+// The one HTTP implementation both surfaces share (RFC §7: two surfaces, one core): the
+// Effect service wraps these with typed errors; the Promise facade calls them directly.
+import type { ResolvedConfig } from "./config.js";
+
+/** A non-2xx response, with the host's `ApiError` envelope message when present. */
+export class HttpStatusError extends Error {
+	constructor(
+		readonly status: number,
+		message: string,
+	) {
+		super(message);
+	}
+}
+
+/**
+ * One management-API request under `/api/v1`. Returns the parsed JSON body (or `undefined`
+ * for 204/empty). Throws [`HttpStatusError`] on a non-2xx (401 included — callers type it).
+ */
+export const httpRequest = async (
+	cfg: ResolvedConfig,
+	method: string,
+	apiPath: string,
+	body?: unknown,
+): Promise<unknown> => {
+	const headers: Record<string, string> = {
+		authorization: `Bearer ${cfg.token}`,
+	};
+	if (body !== undefined) headers["content-type"] = "application/json";
+	const resp = await cfg.fetch(`${cfg.url}/api/v1${apiPath}`, {
+		method,
+		headers,
+		body: body !== undefined ? JSON.stringify(body) : undefined,
+	});
+	if (!resp.ok) {
+		let message = `HTTP ${resp.status}`;
+		try {
+			const err = (await resp.json()) as { error?: string };
+			if (typeof err.error === "string") message = err.error;
+		} catch {
+			// non-JSON error body — keep the status message
+		}
+		throw new HttpStatusError(resp.status, message);
+	}
+	if (resp.status === 204) return undefined;
+	const text = await resp.text();
+	return text.length === 0 ? undefined : JSON.parse(text);
+};