Working on RealmGateway support, need AnyStruct, gotta merge.

c++/src/capnp/any.h

@@ -186,6 +186,8 @@ struct AnyPointer {
 #if !CAPNP_LITE
   class Pipeline {
   public:
+    typedef AnyPointer Pipelines;
+
     inline Pipeline(decltype(nullptr)) {}
     inline explicit Pipeline(kj::Own<PipelineHook>&& hook): hook(kj::mv(hook)) {}
 
@@ -321,9 +323,11 @@ public:
   // Version of getPipelinedCap() passing the array by move.  May avoid a copy in some cases.
   // Default implementation just calls the other version.
 
-  static inline kj::Own<PipelineHook> from(AnyPointer::Pipeline&& pipeline) {
-    return kj::mv(pipeline.hook);
-  }
+  template <typename Pipeline, typename = FromPipeline<Pipeline>>
+  static inline kj::Own<PipelineHook> from(Pipeline&& pipeline);
+
+private:
+  template <typename T> struct FromImpl;
 };
 
 #endif  // !CAPNP_LITE
@@ -491,6 +495,25 @@ struct PointerHelpers<AnyPointer, Kind::OTHER> {
 
 }  // namespace _ (private)
 
+template <typename T>
+struct PipelineHook::FromImpl {
+  static inline kj::Own<PipelineHook> apply(typename T::Pipeline&& pipeline) {
+    return from(kj::mv(pipeline._typeless));
+  }
+};
+
+template <>
+struct PipelineHook::FromImpl<AnyPointer> {
+  static inline kj::Own<PipelineHook> apply(AnyPointer::Pipeline&& pipeline) {
+    return kj::mv(pipeline.hook);
+  }
+};
+
+template <typename Pipeline, typename T>
+inline kj::Own<PipelineHook> PipelineHook::from(Pipeline&& pipeline) {
+  return FromImpl<T>::apply(kj::fwd<Pipeline>(pipeline));
+}
+
 }  // namespace capnp
 
 #endif  // CAPNP_ANY_H_

c++/src/capnp/common.h

@@ -181,6 +181,10 @@ template <typename T>
 using FromBuilder = typename kj::Decay<T>::Builds;
 // FromBuilder<MyType::Builder> = MyType (for any Cap'n Proto type).
 
+template <typename T>
+using FromPipeline = typename kj::Decay<T>::Pipelines;
+// FromBuilder<MyType::Pipeline> = MyType (for any Cap'n Proto type).
+
 template <typename T>
 using FromClient = typename kj::Decay<T>::Calls;
 // FromReader<MyType::Client> = MyType (for any Cap'n Proto interface type).

c++/src/capnp/compiler/capnpc-c++.c++

@@ -1721,6 +1721,7 @@ private:
         kj::mv(methodDecls),
         "private:\n"
         "  ::capnp::AnyPointer::Pipeline _typeless;\n"
+        "  friend class ::capnp::PipelineHook;\n"
         "  template <typename, ::capnp::Kind>\n"
         "  friend struct ::capnp::ToDynamic_;\n"
         "};\n"

c++/src/capnp/compiler/grammar.capnp.h

@@ -466,6 +466,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -549,6 +550,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -632,6 +634,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -838,6 +841,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -938,6 +942,7 @@ public:
   inline  ::capnp::compiler::Expression::Pipeline getValue();
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1027,6 +1032,7 @@ public:
   inline  ::capnp::compiler::Expression::Pipeline getFunction();
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1117,6 +1123,7 @@ public:
   inline  ::capnp::compiler::LocatedText::Pipeline getName();
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1481,6 +1488,7 @@ public:
   inline Id::Pipeline getId();
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1569,6 +1577,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1654,6 +1663,7 @@ public:
   inline Value::Pipeline getValue();
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1743,6 +1753,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1847,6 +1858,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1963,6 +1975,7 @@ public:
   inline DefaultValue::Pipeline getDefaultValue();
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -2052,6 +2065,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -2153,6 +2167,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -2232,6 +2247,7 @@ public:
   inline  ::capnp::compiler::Expression::Pipeline getTarget();
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -2322,6 +2338,7 @@ public:
   inline  ::capnp::compiler::Expression::Pipeline getValue();
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -2407,6 +2424,7 @@ public:
   inline DefaultValue::Pipeline getDefaultValue();
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -2496,6 +2514,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -2574,6 +2593,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -2659,6 +2679,7 @@ public:
   inline Results::Pipeline getResults();
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -2748,6 +2769,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -2887,6 +2909,7 @@ public:
   inline  ::capnp::compiler::Expression::Pipeline getType();
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -2966,6 +2989,7 @@ public:
   inline  ::capnp::compiler::Declaration::Pipeline getRoot();
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };

c++/src/capnp/compiler/lexer.capnp.h

@@ -244,6 +244,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -363,6 +364,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -441,6 +443,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -519,6 +522,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };

c++/src/capnp/persistent.capnp

@@ -52,8 +52,28 @@ interface Persistent@0xc8cb212fcd9f5691(SturdyRef) {
   # to specify the `SturdyRef` parameter, since this type may differ from app to app or even host
   # to host.
 
-  save @0 () -> (sturdyRef :SturdyRef);
+  save @0 SaveParams -> SaveResults;
   # Save a capability persistently so that it can be restored by a future connection.  Not all
   # capabilities can be saved -- application interfaces should define which capabilities support
   # this and which do not.
+
+  struct SaveParams {}
+  struct SaveResults {
+    sturdyRef @0 :SturdyRef;
+  }
+}
+
+interface RealmGateway(InternalRef, ExternalRef) {
+  # Interface invoked when a SturdyRef is about to cross realms. The RPC system supports providing
+  # a RealmGateway as a callback hook when setting up RPC over some VatNetwork.
+
+  import @0 (cap :Persistent(ExternalRef), params :Persistent(InternalRef).SaveParams)
+         -> Persistent(InternalRef).SaveResults;
+  # Given an external capability, save it and return an internal reference. Used when someone
+  # inside the realm tries to save a capability from outside the realm.
+
+  export @1 (cap :Persistent(InternalRef), params :Persistent(ExternalRef).SaveParams)
+         -> Persistent(ExternalRef).SaveResults;
+  # Given an internal capability, save it and return an external reference. Used when someone
+  # outside the realm tries to save a capability from inside the realm.
 }

c++/src/capnp/rpc-prelude.h

@@ -26,6 +26,7 @@
 #define CAPNP_RPC_PRELUDE_H_
 
 #include "capability.h"
+#include "persistent.capnp.h"
 
 namespace capnp {
 
@@ -65,7 +66,8 @@ public:
 
 class RpcSystemBase {
 public:
-  RpcSystemBase(VatNetworkBase& network, kj::Maybe<Capability::Client> bootstrapInterface);
+  RpcSystemBase(VatNetworkBase& network, kj::Maybe<Capability::Client> bootstrapInterface,
+                kj::Maybe<RealmGateway<>::Client> gateway);
   RpcSystemBase(VatNetworkBase& network, SturdyRefRestorerBase& restorer);
   RpcSystemBase(RpcSystemBase&& other) noexcept;
   ~RpcSystemBase() noexcept(false);

c++/src/capnp/rpc-twoparty.capnp.h

@@ -166,6 +166,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -239,6 +240,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -307,6 +309,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -375,6 +378,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -458,6 +462,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -543,6 +548,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };

c++/src/capnp/rpc.c++

@@ -265,11 +265,12 @@ private:
 class RpcConnectionState final: public kj::TaskSet::ErrorHandler, public kj::Refcounted {
 public:
   RpcConnectionState(kj::Maybe<Capability::Client> bootstrapInterface,
+                     kj::Maybe<RealmGateway<>::Client> gateway,
                      kj::Maybe<SturdyRefRestorerBase&> restorer,
                      kj::Own<VatNetworkBase::Connection>&& connectionParam,
                      kj::Own<kj::PromiseFulfiller<void>>&& disconnectFulfiller)
-      : bootstrapInterface(kj::mv(bootstrapInterface)), restorer(restorer),
-        disconnectFulfiller(kj::mv(disconnectFulfiller)), tasks(*this) {
+      : bootstrapInterface(kj::mv(bootstrapInterface)), gateway(kj::mv(gateway)),
+        restorer(restorer), disconnectFulfiller(kj::mv(disconnectFulfiller)), tasks(*this) {
     connection.init<Connected>(kj::mv(connectionParam));
     tasks.add(messageLoop());
   }
@@ -513,6 +514,7 @@ private:
   // OK, now we can define RpcConnectionState's member data.
 
   kj::Maybe<Capability::Client> bootstrapInterface;
+  kj::Maybe<RealmGateway<>::Client> gateway;
   kj::Maybe<SturdyRefRestorerBase&> restorer;
 
   typedef kj::Own<VatNetworkBase::Connection> Connected;
@@ -574,6 +576,28 @@ private:
 
     Request<AnyPointer, AnyPointer> newCall(
         uint64_t interfaceId, uint16_t methodId, kj::Maybe<MessageSize> sizeHint) override {
+      if (interfaceId == typeId<Persistent<>>() && methodId == 0) {
+        KJ_IF_MAYBE(g, connectionState->gateway) {
+          // Wait, this is a call to Persistent.save() and we need to translate it through our
+          // gateway.
+          //
+          // We pull a neat trick here: We actually end up returning a RequestHook for an import
+          // request on the gateway cap, but with the "root" of the request actually pointing
+          // to the "params" field of the real request.
+
+          sizeHint = sizeHint.map([](MessageSize hint) {
+            ++hint.capCount;
+            hint.wordCount += sizeInWords<RealmGateway<>::ImportParams>();
+          });
+
+          auto request = g->importRequest(sizeHint);
+          request.setCap(Persistent<>::Client(addRef()));
+
+          return Request<AnyPointer, AnyPointer>(request.getParams(),
+              RequestHook::from(kj::mv(request)));
+        }
+      }
+
       if (!connectionState->connection.is<Connected>()) {
         return newBrokenRequest(kj::cp(connectionState->connection.get<Disconnected>()), sizeHint);
       }
@@ -594,6 +618,26 @@ private:
                                 kj::Own<CallContextHook>&& context) override {
       // Implement call() by copying params and results messages.
 
+      if (interfaceId == typeId<Persistent<>>() && methodId == 0) {
+        KJ_IF_MAYBE(g, connectionState->gateway) {
+          // Wait, this is a call to Persistent.save() and we need to translate it through our
+          // gateway.
+          auto params = context->getParams().getAs<Persistent<>::SaveParams>();
+
+          auto requestSize = params.totalSize();
+          ++requestSize.capCount;
+          requestSize.wordCount += sizeInWords<RealmGateway<>::ImportParams>();
+
+          auto request = g->importRequest(requestSize);
+          request.setCap(Persistent<>::Client(addRef()));
+          request.setParams(params);
+
+          context->allowCancellation();
+          context->releaseParams();
+          return context->directTailCall(RequestHook::from(kj::mv(request)));
+        }
+      }
+
       auto params = context->getParams();
       auto request = newCall(interfaceId, methodId, params.targetSize());
 
@@ -2090,10 +2134,10 @@ private:
       answer.callContext = *context;
     }
 
-    auto promiseAndPipeline = capability->call(
-        call.getInterfaceId(), call.getMethodId(), context->addRef());
+    auto promiseAndPipeline = startCall(
+        call.getInterfaceId(), call.getMethodId(), kj::mv(capability), context->addRef());
 
-    // Things may have changed -- in particular if call() immediately called
+    // Things may have changed -- in particular if startCall() immediately called
     // context->directTailCall().
 
     {
@@ -2137,6 +2181,33 @@ private:
     }
   }
 
+  ClientHook::VoidPromiseAndPipeline startCall(
+      uint64_t interfaceId, uint64_t methodId,
+      kj::Own<ClientHook>&& capability, kj::Own<CallContextHook>&& context) {
+    if (interfaceId == typeId<Persistent<>>() && methodId == 0) {
+      KJ_IF_MAYBE(g, gateway) {
+        // Wait, this is a call to Persistent.save() and we need to translate it through our
+        // gateway.
+
+        auto params = context->getParams().getAs<Persistent<>::SaveParams>();
+
+        auto requestSize = params.totalSize();
+        ++requestSize.capCount;
+        requestSize.wordCount += sizeInWords<RealmGateway<>::ExportParams>();
+
+        auto request = g->exportRequest(requestSize);
+        request.setCap(Persistent<>::Client(capability->addRef()));
+        request.setParams(params);
+
+        context->allowCancellation();
+        context->releaseParams();
+        return context->directTailCall(RequestHook::from(kj::mv(request)));
+      }
+    }
+
+    return capability->call(interfaceId, methodId, context->addRef());
+  }
+
   kj::Maybe<kj::Own<ClientHook>> getMessageTarget(const rpc::MessageTarget::Reader& target) {
     switch (target.which()) {
       case rpc::MessageTarget::IMPORTED_CAP: {
@@ -2470,8 +2541,10 @@ private:
 
 class RpcSystemBase::Impl final: public kj::TaskSet::ErrorHandler {
 public:
-  Impl(VatNetworkBase& network, kj::Maybe<Capability::Client> bootstrapInterface)
-      : network(network), bootstrapInterface(kj::mv(bootstrapInterface)), tasks(*this) {
+  Impl(VatNetworkBase& network, kj::Maybe<Capability::Client> bootstrapInterface,
+       kj::Maybe<RealmGateway<>::Client> gateway)
+      : network(network), bootstrapInterface(kj::mv(bootstrapInterface)),
+        gateway(kj::mv(gateway)), tasks(*this) {
     tasks.add(acceptLoop());
   }
   Impl(VatNetworkBase& network, SturdyRefRestorerBase& restorer)
@@ -2521,6 +2594,7 @@ public:
 private:
   VatNetworkBase& network;
   kj::Maybe<Capability::Client> bootstrapInterface;
+  kj::Maybe<RealmGateway<>::Client> gateway;
   kj::Maybe<SturdyRefRestorerBase&> restorer;
   kj::TaskSet tasks;
 
@@ -2539,7 +2613,8 @@ private:
         connections.erase(connectionPtr);
       }));
       auto newState = kj::refcounted<RpcConnectionState>(
-          bootstrapInterface, restorer, kj::mv(connection), kj::mv(onDisconnect.fulfiller));
+          bootstrapInterface, gateway, restorer, kj::mv(connection),
+          kj::mv(onDisconnect.fulfiller));
       RpcConnectionState& result = *newState;
       connections.insert(std::make_pair(connectionPtr, kj::mv(newState)));
       return result;
@@ -2564,8 +2639,9 @@ private:
 };
 
 RpcSystemBase::RpcSystemBase(VatNetworkBase& network,
-                             kj::Maybe<Capability::Client> bootstrapInterface)
-    : impl(kj::heap<Impl>(network, kj::mv(bootstrapInterface))) {}
+                             kj::Maybe<Capability::Client> bootstrapInterface,
+                             kj::Maybe<RealmGateway<>::Client> gateway)
+    : impl(kj::heap<Impl>(network, kj::mv(bootstrapInterface), kj::mv(gateway))) {}
 RpcSystemBase::RpcSystemBase(VatNetworkBase& network, SturdyRefRestorerBase& restorer)
     : impl(kj::heap<Impl>(network, restorer)) {}
 RpcSystemBase::RpcSystemBase(RpcSystemBase&& other) noexcept = default;

c++/src/capnp/rpc.capnp.h

@@ -537,6 +537,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -617,6 +618,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -733,6 +735,7 @@ public:
   inline SendResultsTo::Pipeline getSendResultsTo();
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -826,6 +829,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -960,6 +964,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1038,6 +1043,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1137,6 +1143,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1215,6 +1222,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1300,6 +1308,7 @@ public:
   inline Context::Pipeline getContext();
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1398,6 +1407,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1489,6 +1499,7 @@ public:
   inline  ::capnp::rpc::MessageTarget::Pipeline getTarget();
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1574,6 +1585,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1665,6 +1677,7 @@ public:
   inline  ::capnp::rpc::MessageTarget::Pipeline getTarget();
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1754,6 +1767,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1839,6 +1853,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1961,6 +1976,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -2044,6 +2060,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -2128,6 +2145,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -2208,6 +2226,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -2296,6 +2315,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };

c++/src/capnp/rpc.h

@@ -53,7 +53,8 @@ public:
             typename ThirdPartyCapId, typename JoinResult>
   RpcSystem(
       VatNetwork<VatId, ProvisionId, RecipientId, ThirdPartyCapId, JoinResult>& network,
-      kj::Maybe<Capability::Client> bootstrapInterface);
+      kj::Maybe<Capability::Client> bootstrapInterface,
+      kj::Maybe<RealmGateway<>::Client> gateway = nullptr);
 
   template <typename ProvisionId, typename RecipientId,
             typename ThirdPartyCapId, typename JoinResult,
@@ -99,6 +100,17 @@ RpcSystem<VatId> makeRpcServer(
 // See also ez-rpc.h, which has simpler instructions for the common case of a two-party
 // client-server RPC connection.
 
+template <typename VatId, typename ProvisionId, typename RecipientId,
+          typename ThirdPartyCapId, typename JoinResult,
+          typename InternalRef, typename ExternalRef>
+RpcSystem<VatId> makeRpcServer(
+    VatNetwork<VatId, ProvisionId, RecipientId, ThirdPartyCapId, JoinResult>& network,
+    Capability::Client bootstrapInterface,
+    typename RealmGateway<InternalRef, ExternalRef>::Client gateway);
+// Make an RPC server for a VatNetwork that resides in a different realm from the application.
+// The given RealmGateway is used to translate SturdyRefs between the app's ("internal") format
+// and the network's ("external") format.
+
 template <typename VatId, typename LocalSturdyRefObjectId,
           typename ProvisionId, typename RecipientId, typename ThirdPartyCapId, typename JoinResult>
 RpcSystem<VatId> makeRpcServer(
@@ -134,6 +146,16 @@ RpcSystem<VatId> makeRpcClient(
 // See also ez-rpc.h, which has simpler instructions for the common case of a two-party
 // client-server RPC connection.
 
+template <typename VatId, typename ProvisionId, typename RecipientId,
+          typename ThirdPartyCapId, typename JoinResult,
+          typename InternalRef, typename ExternalRef>
+RpcSystem<VatId> makeRpcClient(
+    VatNetwork<VatId, ProvisionId, RecipientId, ThirdPartyCapId, JoinResult>& network,
+    typename RealmGateway<InternalRef, ExternalRef>::Client gateway);
+// Make an RPC client for a VatNetwork that resides in a different realm from the application.
+// The given RealmGateway is used to translate SturdyRefs between the app's ("internal") format
+// and the network's ("external") format.
+
 template <typename SturdyRefObjectId>
 class SturdyRefRestorer: public _::SturdyRefRestorerBase {
   // ** DEPRECATED **
@@ -310,8 +332,9 @@ template <typename ProvisionId, typename RecipientId,
           typename ThirdPartyCapId, typename JoinResult>
 RpcSystem<VatId>::RpcSystem(
       VatNetwork<VatId, ProvisionId, RecipientId, ThirdPartyCapId, JoinResult>& network,
-      kj::Maybe<Capability::Client> bootstrap)
-    : _::RpcSystemBase(network, kj::mv(bootstrap)) {}
+      kj::Maybe<Capability::Client> bootstrap,
+      kj::Maybe<RealmGateway<>::Client> gateway)
+    : _::RpcSystemBase(network, kj::mv(bootstrap), kj::mv(gateway)) {}
 
 template <typename VatId>
 template <typename ProvisionId, typename RecipientId,
@@ -341,6 +364,17 @@ RpcSystem<VatId> makeRpcServer(
   return RpcSystem<VatId>(network, kj::mv(bootstrapInterface));
 }
 
+template <typename VatId, typename ProvisionId, typename RecipientId,
+          typename ThirdPartyCapId, typename JoinResult,
+          typename InternalRef, typename ExternalRef>
+RpcSystem<VatId> makeRpcServer(
+    VatNetwork<VatId, ProvisionId, RecipientId, ThirdPartyCapId, JoinResult>& network,
+    Capability::Client bootstrapInterface,
+    typename RealmGateway<InternalRef, ExternalRef>::Client gateway) {
+  return RpcSystem<VatId>(network, kj::mv(bootstrapInterface),
+      gateway.template castAs<RealmGateway<>>());
+}
+
 template <typename VatId, typename LocalSturdyRefObjectId,
           typename ProvisionId, typename RecipientId, typename ThirdPartyCapId, typename JoinResult>
 RpcSystem<VatId> makeRpcServer(
@@ -356,6 +390,15 @@ RpcSystem<VatId> makeRpcClient(
   return RpcSystem<VatId>(network, nullptr);
 }
 
+template <typename VatId, typename ProvisionId,
+          typename RecipientId, typename ThirdPartyCapId, typename JoinResult,
+          typename InternalRef, typename ExternalRef>
+RpcSystem<VatId> makeRpcClient(
+    VatNetwork<VatId, ProvisionId, RecipientId, ThirdPartyCapId, JoinResult>& network,
+    typename RealmGateway<InternalRef, ExternalRef>::Client gateway) {
+  return RpcSystem<VatId>(network, nullptr, gateway.template castAs<RealmGateway<>>());
+}
+
 }  // namespace capnp
 
 #endif  // CAPNP_RPC_H_

c++/src/capnp/schema.capnp.h

@@ -639,6 +639,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -717,6 +718,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -800,6 +802,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -908,6 +911,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -986,6 +990,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1074,6 +1079,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1164,6 +1170,7 @@ public:
   inline  ::capnp::schema::Value::Pipeline getValue();
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1303,6 +1310,7 @@ public:
   inline  ::capnp::schema::Type::Pipeline getType();
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1423,6 +1431,7 @@ public:
   inline Ordinal::Pipeline getOrdinal();
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1523,6 +1532,7 @@ public:
   inline  ::capnp::schema::Value::Pipeline getDefaultValue();
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1596,6 +1606,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1680,6 +1691,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1773,6 +1785,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1857,6 +1870,7 @@ public:
   inline  ::capnp::schema::Brand::Pipeline getBrand();
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -1992,6 +2006,7 @@ public:
   inline  ::capnp::schema::Brand::Pipeline getResultBrand();
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -2195,6 +2210,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -2274,6 +2290,7 @@ public:
   inline  ::capnp::schema::Type::Pipeline getElementType();
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -2358,6 +2375,7 @@ public:
   inline  ::capnp::schema::Brand::Pipeline getBrand();
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -2442,6 +2460,7 @@ public:
   inline  ::capnp::schema::Brand::Pipeline getBrand();
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -2526,6 +2545,7 @@ public:
   inline  ::capnp::schema::Brand::Pipeline getBrand();
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -2617,6 +2637,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -2695,6 +2716,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -2768,6 +2790,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -2846,6 +2869,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -2940,6 +2964,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -3029,6 +3054,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -3248,6 +3274,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -3343,6 +3370,7 @@ public:
   inline  ::capnp::schema::Brand::Pipeline getBrand();
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -3431,6 +3459,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -3524,6 +3553,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };
@@ -3607,6 +3637,7 @@ public:
 
 private:
   ::capnp::AnyPointer::Pipeline _typeless;
+  friend class ::capnp::PipelineHook;
   template <typename, ::capnp::Kind>
   friend struct ::capnp::ToDynamic_;
 };