From 9384c78ef26210ecaa96cec77d4a964f2e66b6aa Mon Sep 17 00:00:00 2001
From: Kris Nye <krisnye@gmail.com>
Date: Fri, 4 Sep 2026 01:19:44 -0700
Subject: [PATCH 1/4] feat(data-rpc): schema-driven bidirectional service
 projection across iframe/MessagePort

New @adobe/data-rpc package projects AsyncDataServices across a boundary in both
directions over one channel; only Data crosses the wire, far side synthesizes
equivalent-shaped members (incl. nested sub-services). Extracts shared memberKind
from create-lazy. Adds data-rpc-iframe Lit sample. Bumps to 0.10.10.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 package.json                                  |   2 +-
 packages/data-ai/.claude-plugin/plugin.json   |   2 +-
 packages/data-ai/package.json                 |   2 +-
 packages/data-gpu/package.json                |   2 +-
 packages/data-lit/package.json                |   2 +-
 packages/data-persistence/package.json        |   2 +-
 packages/data-react/package.json              |   2 +-
 packages/data-rpc-iframe/README.md            |  43 +++
 packages/data-rpc-iframe/index.html           |  25 ++
 packages/data-rpc-iframe/package.json         |  29 ++
 .../src/main/create-main-service.ts           |  32 ++
 .../src/main/main-panel-element.ts            |  91 ++++++
 .../data-rpc-iframe/src/main/main-panel.ts    |  11 +
 packages/data-rpc-iframe/src/main/main.ts     |  44 +++
 .../data-rpc-iframe/src/rpc-iframe.test.ts    |  62 ++++
 .../data-rpc-iframe/src/shared/handshake.ts   |  13 +
 .../src/shared/main-service.ts                |  43 +++
 .../data-rpc-iframe/src/shared/sub-service.ts |  57 ++++
 .../src/sub/create-sub-service.ts             |  45 +++
 .../src/sub/sub-panel-element.ts              |  71 +++++
 packages/data-rpc-iframe/src/sub/sub-panel.ts |  11 +
 packages/data-rpc-iframe/src/sub/sub.ts       |  37 +++
 packages/data-rpc-iframe/src/ui/panel.css.ts  |  47 +++
 .../src/ui/rpc-panel-element.ts               |  21 ++
 packages/data-rpc-iframe/sub.html             |  16 +
 packages/data-rpc-iframe/tsconfig.json        |  17 ++
 packages/data-rpc-iframe/vite.config.ts       |  27 ++
 packages/data-rpc/LICENSE                     |  21 ++
 packages/data-rpc/README.md                   | 137 +++++++++
 packages/data-rpc/package.json                |  38 +++
 .../data-rpc/src/consume/caller-context.ts    |  39 +++
 .../data-rpc/src/consume/make-generator.ts    |  88 ++++++
 packages/data-rpc/src/consume/make-observe.ts |  35 +++
 packages/data-rpc/src/consume/make-promise.ts |  39 +++
 packages/data-rpc/src/consume/make-void.ts    |  21 ++
 .../data-rpc/src/consume/reconstruct-error.ts |  15 +
 .../src/consume/synthesize-service.ts         |  73 +++++
 packages/data-rpc/src/create-endpoint.ts      | 209 +++++++++++++
 packages/data-rpc/src/endpoint.ts             |  67 ++++
 packages/data-rpc/src/host/host-context.ts    |  27 ++
 packages/data-rpc/src/host/marshal-error.ts   |  17 ++
 .../data-rpc/src/host/register-service.ts     | 190 ++++++++++++
 packages/data-rpc/src/id.ts                   |  12 +
 packages/data-rpc/src/index.ts                |   9 +
 packages/data-rpc/src/nested.test.ts          | 160 ++++++++++
 packages/data-rpc/src/protocol.ts             |  82 +++++
 packages/data-rpc/src/rpc.test.ts             | 288 ++++++++++++++++++
 packages/data-rpc/src/transport.ts            |  35 +++
 .../src/transports/loopback-transport.test.ts |  48 +++
 .../src/transports/loopback-transport.ts      | 106 +++++++
 .../transports/message-port-transport.test.ts |  63 ++++
 .../src/transports/message-port-transport.ts  |  63 ++++
 .../src/transports/window-transport.test.ts   |  52 ++++
 .../src/transports/window-transport.ts        |  76 +++++
 packages/data-rpc/tsconfig.json               |  14 +
 packages/data-rpc/vitest.workspace.ts         |  20 ++
 packages/data-solid/package.json              |   2 +-
 packages/data-sync/package.json               |   2 +-
 packages/data-testing/package.json            |   2 +-
 packages/data/package.json                    |   2 +-
 .../service/async-data-service/create-lazy.ts |  33 +-
 .../service/async-data-service/member-kind.ts |  35 +++
 .../src/service/async-data-service/public.ts  |   1 +
 pnpm-lock.yaml                                |  47 +++
 pnpm-workspace.yaml                           |   2 +
 65 files changed, 2883 insertions(+), 43 deletions(-)
 create mode 100644 packages/data-rpc-iframe/README.md
 create mode 100644 packages/data-rpc-iframe/index.html
 create mode 100644 packages/data-rpc-iframe/package.json
 create mode 100644 packages/data-rpc-iframe/src/main/create-main-service.ts
 create mode 100644 packages/data-rpc-iframe/src/main/main-panel-element.ts
 create mode 100644 packages/data-rpc-iframe/src/main/main-panel.ts
 create mode 100644 packages/data-rpc-iframe/src/main/main.ts
 create mode 100644 packages/data-rpc-iframe/src/rpc-iframe.test.ts
 create mode 100644 packages/data-rpc-iframe/src/shared/handshake.ts
 create mode 100644 packages/data-rpc-iframe/src/shared/main-service.ts
 create mode 100644 packages/data-rpc-iframe/src/shared/sub-service.ts
 create mode 100644 packages/data-rpc-iframe/src/sub/create-sub-service.ts
 create mode 100644 packages/data-rpc-iframe/src/sub/sub-panel-element.ts
 create mode 100644 packages/data-rpc-iframe/src/sub/sub-panel.ts
 create mode 100644 packages/data-rpc-iframe/src/sub/sub.ts
 create mode 100644 packages/data-rpc-iframe/src/ui/panel.css.ts
 create mode 100644 packages/data-rpc-iframe/src/ui/rpc-panel-element.ts
 create mode 100644 packages/data-rpc-iframe/sub.html
 create mode 100644 packages/data-rpc-iframe/tsconfig.json
 create mode 100644 packages/data-rpc-iframe/vite.config.ts
 create mode 100644 packages/data-rpc/LICENSE
 create mode 100644 packages/data-rpc/README.md
 create mode 100644 packages/data-rpc/package.json
 create mode 100644 packages/data-rpc/src/consume/caller-context.ts
 create mode 100644 packages/data-rpc/src/consume/make-generator.ts
 create mode 100644 packages/data-rpc/src/consume/make-observe.ts
 create mode 100644 packages/data-rpc/src/consume/make-promise.ts
 create mode 100644 packages/data-rpc/src/consume/make-void.ts
 create mode 100644 packages/data-rpc/src/consume/reconstruct-error.ts
 create mode 100644 packages/data-rpc/src/consume/synthesize-service.ts
 create mode 100644 packages/data-rpc/src/create-endpoint.ts
 create mode 100644 packages/data-rpc/src/endpoint.ts
 create mode 100644 packages/data-rpc/src/host/host-context.ts
 create mode 100644 packages/data-rpc/src/host/marshal-error.ts
 create mode 100644 packages/data-rpc/src/host/register-service.ts
 create mode 100644 packages/data-rpc/src/id.ts
 create mode 100644 packages/data-rpc/src/index.ts
 create mode 100644 packages/data-rpc/src/nested.test.ts
 create mode 100644 packages/data-rpc/src/protocol.ts
 create mode 100644 packages/data-rpc/src/rpc.test.ts
 create mode 100644 packages/data-rpc/src/transport.ts
 create mode 100644 packages/data-rpc/src/transports/loopback-transport.test.ts
 create mode 100644 packages/data-rpc/src/transports/loopback-transport.ts
 create mode 100644 packages/data-rpc/src/transports/message-port-transport.test.ts
 create mode 100644 packages/data-rpc/src/transports/message-port-transport.ts
 create mode 100644 packages/data-rpc/src/transports/window-transport.test.ts
 create mode 100644 packages/data-rpc/src/transports/window-transport.ts
 create mode 100644 packages/data-rpc/tsconfig.json
 create mode 100644 packages/data-rpc/vitest.workspace.ts
 create mode 100644 packages/data/src/service/async-data-service/member-kind.ts

diff --git a/package.json b/package.json
index ca0e555a..92d197cb 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "data-monorepo",
-  "version": "0.10.9",
+  "version": "0.10.10",
   "private": true,
   "engines": {
     "node": ">=24"
diff --git a/packages/data-ai/.claude-plugin/plugin.json b/packages/data-ai/.claude-plugin/plugin.json
index 6943da17..39a0d889 100644
--- a/packages/data-ai/.claude-plugin/plugin.json
+++ b/packages/data-ai/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "adobe-data-ai",
-  "version": "0.10.9",
+  "version": "0.10.10",
   "description": "Architecture skills for @adobe/data — data-oriented modelling, archetype iteration, hot-path performance, and related conventions.",
   "author": {
     "name": "Adobe"
diff --git a/packages/data-ai/package.json b/packages/data-ai/package.json
index 5f45b3da..7ed659b0 100644
--- a/packages/data-ai/package.json
+++ b/packages/data-ai/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@adobe/data-ai",
-  "version": "0.10.9",
+  "version": "0.10.10",
   "description": "Cross-agent architecture skills for @adobe/data — installable as a Claude Code plugin or copied into any Agent-Skills-compatible agent (Cursor, Codex).",
   "type": "module",
   "private": false,
diff --git a/packages/data-gpu/package.json b/packages/data-gpu/package.json
index e637c416..987f3b4f 100644
--- a/packages/data-gpu/package.json
+++ b/packages/data-gpu/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@adobe/data-gpu",
-  "version": "0.10.9",
+  "version": "0.10.10",
   "description": "Adobe data WebGPU plugins and types for graphics and compute",
   "type": "module",
   "private": false,
diff --git a/packages/data-lit/package.json b/packages/data-lit/package.json
index f0c3f1cd..6573f805 100644
--- a/packages/data-lit/package.json
+++ b/packages/data-lit/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@adobe/data-lit",
-  "version": "0.10.9",
+  "version": "0.10.10",
   "description": "Adobe data Lit bindings - hooks, elements, decorators",
   "type": "module",
   "private": false,
diff --git a/packages/data-persistence/package.json b/packages/data-persistence/package.json
index 6d5d3bf1..5ac6b376 100644
--- a/packages/data-persistence/package.json
+++ b/packages/data-persistence/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@adobe/data-persistence",
-    "version": "0.10.9",
+    "version": "0.10.10",
     "description": "Worker-based incremental persistence layer for @adobe/data ECS over OPFS (browser) and node:fs (server).",
     "type": "module",
     "sideEffects": false,
diff --git a/packages/data-react/package.json b/packages/data-react/package.json
index d7f7a1a5..e4c6e9c8 100644
--- a/packages/data-react/package.json
+++ b/packages/data-react/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@adobe/data-react",
-  "version": "0.10.9",
+  "version": "0.10.10",
   "description": "Adobe data React bindings — hooks and context for ECS database",
   "type": "module",
   "private": false,
diff --git a/packages/data-rpc-iframe/README.md b/packages/data-rpc-iframe/README.md
new file mode 100644
index 00000000..1a7c911c
--- /dev/null
+++ b/packages/data-rpc-iframe/README.md
@@ -0,0 +1,43 @@
+# data-rpc-iframe
+
+A runnable sample for [`@adobe/data-rpc`](../data-rpc): a **main frame** embeds a
+real **iframe** (the sub frame), and the two exchange async data services over a
+single `MessagePort` — **in both directions**.
+
+## Run it
+
+```bash
+pnpm --filter data-rpc-iframe dev
+```
+
+Then open http://localhost:3011/. The left column is the main frame; the right
+column is the sub frame (a genuine `<iframe>`).
+
+## What it demonstrates
+
+Each side both **exposes** its own service and **consumes** the peer's, so every
+communication kind runs in both directions:
+
+| kind | main → sub | sub → main |
+| --- | --- | --- |
+| **observe** | sub renders `main.time` live | main renders `sub.status` live |
+| **promise** | `sub.echo(msg)` | `main.echo(msg)` |
+| **generator** | `sub.countUp(5)` (pull-based) | `main.countUp(5)` |
+| **void** | `main.notify(msg)` → sub's inbox | `sub.log(msg)` → main's logs |
+
+It also shows a **nested sub-service**: `sub.calc` (a child service with
+`total`/`add`/`reset`) is shimmed recursively and driven from the main frame —
+`sub.calc.add(5)` (nested promise), `sub.calc.total` (nested observe), and
+`sub.calc.reset()` (nested void).
+
+## How the wiring works
+
+1. `main.ts` creates a `MessageChannel`, embeds `sub.html`, and on the iframe's
+   `load` posts `port2` to it via `window.postMessage` (same-origin).
+2. Each side wraps its port with `createMessagePortTransport`, creates a
+   `createRpcEndpoint`, then `expose`s its service and `consume`s the peer's.
+3. The Lit panels render reactively from the observed service state via
+   `@adobe/data-lit`'s `useObservableValues`.
+
+The service contracts live in `src/shared/`; the per-frame implementations and
+panels live in `src/main/` and `src/sub/`.
diff --git a/packages/data-rpc-iframe/index.html b/packages/data-rpc-iframe/index.html
new file mode 100644
index 00000000..6df94b4e
--- /dev/null
+++ b/packages/data-rpc-iframe/index.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>@adobe/data-rpc — iframe sample</title>
+  <style>
+    body { margin: 0; font-family: system-ui, sans-serif; padding: 1rem; }
+    h1 { font-size: 1.25rem; }
+    #layout { display: flex; gap: 1rem; align-items: flex-start; }
+    #app { flex: 1 1 0; --accent: #4a6; }
+    #frame-container { flex: 1 1 0; }
+  </style>
+</head>
+<body>
+  <h1>@adobe/data-rpc — bidirectional services across an iframe</h1>
+  <p>Left = main frame. Right = sub frame (a real iframe). Each drives the other's
+     observe / promise / generator / void members over one MessagePort.</p>
+  <div id="layout">
+    <div id="app"></div>
+    <div id="frame-container"></div>
+  </div>
+  <script type="module" src="/src/main/main.ts"></script>
+</body>
+</html>
diff --git a/packages/data-rpc-iframe/package.json b/packages/data-rpc-iframe/package.json
new file mode 100644
index 00000000..7f9ab4a7
--- /dev/null
+++ b/packages/data-rpc-iframe/package.json
@@ -0,0 +1,29 @@
+{
+  "name": "data-rpc-iframe",
+  "version": "0.10.9",
+  "description": "Sample: bidirectional @adobe/data-rpc services across a main frame and an iframe, over a MessagePort.",
+  "type": "module",
+  "private": true,
+  "exports": {
+    ".": "./src/main/main.ts"
+  },
+  "scripts": {
+    "build": "vite build",
+    "dev": "vite",
+    "test": "vitest --run --passWithNoTests",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  },
+  "dependencies": {
+    "@adobe/data": "workspace:*",
+    "@adobe/data-lit": "workspace:*",
+    "@adobe/data-rpc": "workspace:*",
+    "lit": "^3.3.1"
+  },
+  "devDependencies": {
+    "jsdom": "^24.1.0",
+    "typescript": "^5.8.3",
+    "vite": "^5.1.1",
+    "vite-plugin-checker": "^0.12.0",
+    "vitest": "^1.6.0"
+  }
+}
diff --git a/packages/data-rpc-iframe/src/main/create-main-service.ts b/packages/data-rpc-iframe/src/main/create-main-service.ts
new file mode 100644
index 00000000..a273ebbb
--- /dev/null
+++ b/packages/data-rpc-iframe/src/main/create-main-service.ts
@@ -0,0 +1,32 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import { Observe } from "@adobe/data/observe";
+import { MainService } from "../shared/main-service.js";
+
+const delay = (ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms));
+
+/** The MAIN frame's local implementation of {@link MainService}. */
+export function createMainService(): MainService {
+    const [time, setTime] = Observe.createState(0);
+    const [logs, setLogs] = Observe.createState<readonly string[]>([]);
+
+    let ticks = 0;
+    setInterval(() => setTime((ticks += 1)), 1000);
+
+    let received: readonly string[] = [];
+
+    return {
+        serviceName: "main",
+        schema: Observe.fromConstant(MainService.schema),
+        time,
+        logs,
+        echo: async (message) => `main echoes: ${message}`,
+        countUp: async function* (to) {
+            for (let i = 1; i <= to; i++) {
+                await delay(300);
+                yield i;
+            }
+        },
+        log: (message) => setLogs((received = [...received, message])),
+    };
+}
diff --git a/packages/data-rpc-iframe/src/main/main-panel-element.ts b/packages/data-rpc-iframe/src/main/main-panel-element.ts
new file mode 100644
index 00000000..8a188615
--- /dev/null
+++ b/packages/data-rpc-iframe/src/main/main-panel-element.ts
@@ -0,0 +1,91 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import { html } from "lit";
+import { customElement, property, state } from "lit/decorators.js";
+import { useObservableValues } from "@adobe/data-lit";
+import { RpcPanelElement } from "../ui/rpc-panel-element.js";
+import { panelStyles } from "../ui/panel.css.js";
+import type { MainService } from "../shared/main-service.js";
+import type { SubService } from "../shared/sub-service.js";
+
+const tagName = "main-panel";
+
+declare global {
+    interface HTMLElementTagNameMap {
+        [tagName]: MainPanelElement;
+    }
+}
+
+/**
+ * The MAIN frame's panel. Observes its own `time`/`logs` (local) and the sub's
+ * `status` (remote), and drives the sub's promise / generator / void members.
+ */
+@customElement(tagName)
+export class MainPanelElement extends RpcPanelElement {
+    static styles = panelStyles;
+
+    @property({ attribute: false }) local!: MainService;
+    @property({ attribute: false }) remote!: SubService;
+
+    @state() private echoResult = "";
+    @state() private streamOut: readonly number[] = [];
+    @state() private calcResult = "";
+
+    render() {
+        const v = useObservableValues(
+            () => ({
+                time: this.local.time,
+                logs: this.local.logs,
+                status: this.remote.status,
+                calcTotal: this.remote.calc.total, // NESTED observe across the boundary
+            }),
+            [this.local, this.remote],
+        );
+        return html`
+            <h2>Main frame</h2>
+            <div class="row"><span class="label">Clock (local):</span><span class="value">${v?.time ?? 0}</span></div>
+            <div class="row"><span class="label">Sub status (observe):</span><span class="value">${v?.status ?? "…"}</span></div>
+            <div class="row"><span class="label">Logs from sub (void):</span></div>
+            <ul>${(v?.logs ?? []).map((m) => html`<li>${m}</li>`)}</ul>
+            <div class="row">
+                <button @click=${this.doEcho}>echo → sub (promise)</button>
+                <span class="value">${this.echoResult}</span>
+            </div>
+            <div class="row">
+                <button @click=${this.doStream}>countUp ← sub (generator)</button>
+                <span class="value">${this.streamOut.join(" ")}</span>
+            </div>
+            <div class="row">
+                <button @click=${this.doNotify}>notify → sub (void)</button>
+            </div>
+            <div class="row"><span class="label">sub.calc.total (nested observe):</span><span class="value">${v?.calcTotal ?? 0}</span></div>
+            <div class="row">
+                <button @click=${this.doCalcAdd}>calc.add(5) → sub (nested promise)</button>
+                <span class="value">${this.calcResult}</span>
+                <button @click=${this.doCalcReset}>calc.reset → sub (nested void)</button>
+            </div>
+        `;
+    }
+
+    private doEcho = async () => {
+        this.echoResult = await this.remote.echo(`hi from main @${new Date().toLocaleTimeString()}`);
+    };
+
+    private doStream = async () => {
+        this.streamOut = [];
+        for await (const n of this.remote.countUp(5)) this.streamOut = [...this.streamOut, n];
+    };
+
+    private doNotify = () => {
+        this.remote.notify(`hello from main @${new Date().toLocaleTimeString()}`);
+    };
+
+    private doCalcAdd = async () => {
+        this.calcResult = `= ${await this.remote.calc.add(5)}`;
+    };
+
+    private doCalcReset = () => {
+        this.remote.calc.reset();
+        this.calcResult = "";
+    };
+}
diff --git a/packages/data-rpc-iframe/src/main/main-panel.ts b/packages/data-rpc-iframe/src/main/main-panel.ts
new file mode 100644
index 00000000..e2d01e66
--- /dev/null
+++ b/packages/data-rpc-iframe/src/main/main-panel.ts
@@ -0,0 +1,11 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import { html, type TemplateResult } from "lit";
+import type { MainService } from "../shared/main-service.js";
+import type { SubService } from "../shared/sub-service.js";
+
+/** Lazy wrapper: imports the element module, then renders it with its services. */
+export const MainPanel = (args: { local: MainService; remote: SubService }): TemplateResult => {
+    void import("./main-panel-element.js");
+    return html`<main-panel .local=${args.local} .remote=${args.remote}></main-panel>`;
+};
diff --git a/packages/data-rpc-iframe/src/main/main.ts b/packages/data-rpc-iframe/src/main/main.ts
new file mode 100644
index 00000000..8ee7b6cd
--- /dev/null
+++ b/packages/data-rpc-iframe/src/main/main.ts
@@ -0,0 +1,44 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import { render } from "lit";
+import { createRpcEndpoint, createMessagePortTransport } from "@adobe/data-rpc";
+import { MainService } from "../shared/main-service.js";
+import { SubService } from "../shared/sub-service.js";
+import { HANDSHAKE, type HandshakeMessage } from "../shared/handshake.js";
+import { createMainService } from "./create-main-service.js";
+import { MainPanel } from "./main-panel.js";
+
+// Bootstrap the MAIN frame: embed the sub iframe, hand it one end of a
+// MessageChannel, then expose the main service and consume the sub service over
+// the other end. No top-level await (see repo CLAUDE.md) — all work is synchronous
+// wiring plus event callbacks.
+function init(): void {
+    const app = document.getElementById("app");
+    const frameContainer = document.getElementById("frame-container");
+    if (app === null || frameContainer === null) return;
+
+    const channel = new MessageChannel();
+
+    const iframe = document.createElement("iframe");
+    iframe.src = "/sub.html";
+    iframe.title = "sub frame";
+    iframe.style.cssText = "width: 100%; min-height: 360px; border: 0;";
+    iframe.addEventListener(
+        "load",
+        () => {
+            // Hand port2 to the sub. targetOrigin is this page's origin (same-origin sample).
+            iframe.contentWindow?.postMessage({ type: HANDSHAKE } satisfies HandshakeMessage, location.origin, [channel.port2]);
+        },
+        { once: true },
+    );
+    frameContainer.appendChild(iframe);
+
+    const endpoint = createRpcEndpoint(createMessagePortTransport(channel.port1));
+    const mainService = createMainService();
+    endpoint.expose("main", mainService, MainService.schema);
+    const subService = endpoint.consume("sub", SubService.schema);
+
+    render(MainPanel({ local: mainService, remote: subService }), app);
+}
+
+init();
diff --git a/packages/data-rpc-iframe/src/rpc-iframe.test.ts b/packages/data-rpc-iframe/src/rpc-iframe.test.ts
new file mode 100644
index 00000000..df621bc5
--- /dev/null
+++ b/packages/data-rpc-iframe/src/rpc-iframe.test.ts
@@ -0,0 +1,62 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+// Headless end-to-end coverage for the sample's SERVICE layer: wires the real
+// main/sub service implementations through two RPC endpoints over a genuine
+// MessageChannel (Node global) — the same handshake the frames use — and drives
+// every member kind in both directions. The Lit panels themselves are verified
+// in a real browser (see README); this keeps the sample's logic covered in CI.
+
+import { describe, it, expect } from "vitest";
+import { createRpcEndpoint, createMessagePortTransport } from "@adobe/data-rpc";
+import { MainService } from "./shared/main-service.js";
+import { SubService } from "./shared/sub-service.js";
+import { createMainService } from "./main/create-main-service.js";
+import { createSubService } from "./sub/create-sub-service.js";
+
+const nextValue = <T>(observe: (notify: (v: T) => void) => () => void) =>
+    new Promise<T>((resolve) => {
+        const un = observe((v) => {
+            resolve(v);
+            queueMicrotask(() => un());
+        });
+    });
+
+describe("data-rpc-iframe sample wiring", () => {
+    it("projects both services across a MessageChannel and runs every kind both ways", async () => {
+        const { port1, port2 } = new MessageChannel();
+        const mainEndpoint = createRpcEndpoint(createMessagePortTransport(port1));
+        const subEndpoint = createRpcEndpoint(createMessagePortTransport(port2));
+
+        mainEndpoint.expose("main", createMainService(), MainService.schema);
+        subEndpoint.expose("sub", createSubService(), SubService.schema);
+
+        const main = subEndpoint.consume("main", MainService.schema); // sub → main
+        const sub = mainEndpoint.consume("sub", SubService.schema); // main → sub
+
+        // promise, both directions
+        expect(await sub.echo("ping")).toBe("sub echoes: ping");
+        expect(await main.echo("ping")).toBe("main echoes: ping");
+
+        // generator, both directions
+        const drain = async (gen: AsyncGenerator<number>) => {
+            const out: number[] = [];
+            for await (const n of gen) out.push(n);
+            return out;
+        };
+        expect(await drain(sub.countUp(3))).toEqual([1, 2, 3]);
+        expect(await drain(main.countUp(2))).toEqual([1, 2]);
+
+        // void → observed effect, both directions
+        sub.notify("from-main");
+        expect(await nextValue(sub.inbox)).toContain("from-main");
+        main.log("from-sub");
+        expect(await nextValue(main.logs)).toContain("from-sub");
+
+        // observe, both directions (initial value)
+        expect(typeof (await nextValue(main.time))).toBe("number");
+        expect(typeof (await nextValue(sub.status))).toBe("string");
+
+        mainEndpoint.close();
+        subEndpoint.close();
+    });
+});
diff --git a/packages/data-rpc-iframe/src/shared/handshake.ts b/packages/data-rpc-iframe/src/shared/handshake.ts
new file mode 100644
index 00000000..9c7e9531
--- /dev/null
+++ b/packages/data-rpc-iframe/src/shared/handshake.ts
@@ -0,0 +1,13 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+/**
+ * The one-shot `window.postMessage` type the main frame uses to hand a
+ * `MessagePort` to the sub frame. After the handoff both sides talk over the
+ * port via `createMessagePortTransport`. Same-origin sample: `allowedOrigins`
+ * is just this page's origin.
+ */
+export const HANDSHAKE = "data-rpc-iframe:port" as const;
+
+export interface HandshakeMessage {
+    readonly type: typeof HANDSHAKE;
+}
diff --git a/packages/data-rpc-iframe/src/shared/main-service.ts b/packages/data-rpc-iframe/src/shared/main-service.ts
new file mode 100644
index 00000000..f452c009
--- /dev/null
+++ b/packages/data-rpc-iframe/src/shared/main-service.ts
@@ -0,0 +1,43 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import type { Observe } from "@adobe/data/observe";
+import { type Schema } from "@adobe/data/schema";
+import { AsyncDataService, type Service } from "@adobe/data/service";
+import type { Assert } from "@adobe/data/types";
+
+/**
+ * The service the MAIN frame exposes to the SUB frame. It carries one member of
+ * every kind so the sub can exercise observe / promise / generator / void
+ * against the main:
+ *  - `time`    OBSERVE   — the main's clock; the sub renders it live.
+ *  - `logs`    OBSERVE   — messages the main received (written by the sub via `log`).
+ *  - `echo`    PROMISE   — request/response.
+ *  - `countUp` GENERATOR — a pull-based stream.
+ *  - `log`     VOID      — fire-and-forget; its effect shows up in `logs`.
+ */
+export interface MainService extends Service {
+    time: Observe<number>;
+    logs: Observe<readonly string[]>;
+    echo: (message: string) => Promise<string>;
+    countUp: (to: number) => AsyncGenerator<number>;
+    log: (message: string) => void;
+}
+
+export namespace MainService {
+    export const schema = {
+        type: "object",
+        properties: {
+            time: { type: "observe", value: { type: "number" } },
+            logs: { type: "observe", value: { type: "array", items: { type: "string" } } },
+            echo: { type: "function", signature: { parameters: [{ type: "string" }], returns: { type: "promise", value: { type: "string" } } } },
+            countUp: { type: "function", signature: { parameters: [{ type: "number" }], returns: { type: "generator", value: { type: "number" } } } },
+            log: { type: "function", signature: { parameters: [{ type: "string" }] } },
+        },
+        required: ["time", "logs", "echo", "countUp", "log"],
+        additionalProperties: false,
+    } as const satisfies Schema;
+}
+
+// Compile-time proof the contract is a valid AsyncDataService fully described by its schema.
+type _Valid = Assert<AsyncDataService.IsValid<MainService>>;
+type _Complete = Assert<AsyncDataService.IsValidWithCompleteSchema<MainService, typeof MainService.schema>>;
diff --git a/packages/data-rpc-iframe/src/shared/sub-service.ts b/packages/data-rpc-iframe/src/shared/sub-service.ts
new file mode 100644
index 00000000..e6afa14b
--- /dev/null
+++ b/packages/data-rpc-iframe/src/shared/sub-service.ts
@@ -0,0 +1,57 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import type { Observe } from "@adobe/data/observe";
+import { type Schema } from "@adobe/data/schema";
+import { AsyncDataService, type Service } from "@adobe/data/service";
+import type { Assert } from "@adobe/data/types";
+
+/**
+ * The service the SUB frame exposes to the MAIN frame — the mirror of
+ * {@link MainService}, so every communication kind also runs main → sub:
+ *  - `status` OBSERVE   — the sub's status; the main renders it live.
+ *  - `inbox`  OBSERVE   — messages the sub received (written by the main via `notify`).
+ *  - `echo`   PROMISE   — request/response.
+ *  - `countUp` GENERATOR — a pull-based stream.
+ *  - `notify` VOID      — fire-and-forget; its effect shows up in `inbox`.
+ */
+export interface SubService extends Service {
+    status: Observe<string>;
+    inbox: Observe<readonly string[]>;
+    echo: (message: string) => Promise<string>;
+    countUp: (to: number) => AsyncGenerator<number>;
+    notify: (message: string) => void;
+    /** A NESTED sub-service — shimmed recursively across the boundary. */
+    calc: {
+        total: Observe<number>;
+        add: (n: number) => Promise<number>;
+        reset: () => void;
+    };
+}
+
+export namespace SubService {
+    export const schema = {
+        type: "object",
+        properties: {
+            status: { type: "observe", value: { type: "string" } },
+            inbox: { type: "observe", value: { type: "array", items: { type: "string" } } },
+            echo: { type: "function", signature: { parameters: [{ type: "string" }], returns: { type: "promise", value: { type: "string" } } } },
+            countUp: { type: "function", signature: { parameters: [{ type: "number" }], returns: { type: "generator", value: { type: "number" } } } },
+            notify: { type: "function", signature: { parameters: [{ type: "string" }] } },
+            calc: {
+                type: "object",
+                properties: {
+                    total: { type: "observe", value: { type: "number" } },
+                    add: { type: "function", signature: { parameters: [{ type: "number" }], returns: { type: "promise", value: { type: "number" } } } },
+                    reset: { type: "function" },
+                },
+                required: ["total", "add", "reset"],
+                additionalProperties: false,
+            },
+        },
+        required: ["status", "inbox", "echo", "countUp", "notify", "calc"],
+        additionalProperties: false,
+    } as const satisfies Schema;
+}
+
+type _Valid = Assert<AsyncDataService.IsValid<SubService>>;
+type _Complete = Assert<AsyncDataService.IsValidWithCompleteSchema<SubService, typeof SubService.schema>>;
diff --git a/packages/data-rpc-iframe/src/sub/create-sub-service.ts b/packages/data-rpc-iframe/src/sub/create-sub-service.ts
new file mode 100644
index 00000000..bc2e9633
--- /dev/null
+++ b/packages/data-rpc-iframe/src/sub/create-sub-service.ts
@@ -0,0 +1,45 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import { Observe } from "@adobe/data/observe";
+import { SubService } from "../shared/sub-service.js";
+
+const delay = (ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms));
+const STATUSES = ["idle", "working", "syncing", "ready"] as const;
+
+/** The SUB frame's local implementation of {@link SubService}. */
+export function createSubService(): SubService {
+    const [status, setStatus] = Observe.createState<string>(STATUSES[0]);
+    const [inbox, setInbox] = Observe.createState<readonly string[]>([]);
+
+    let i = 0;
+    setInterval(() => setStatus(STATUSES[(i += 1) % STATUSES.length]), 1500);
+
+    let received: readonly string[] = [];
+
+    // Nested sub-service state.
+    const [total, setTotal] = Observe.createState(0);
+    let runningTotal = 0;
+
+    return {
+        serviceName: "sub",
+        schema: Observe.fromConstant(SubService.schema),
+        status,
+        inbox,
+        echo: async (message) => `sub echoes: ${message}`,
+        countUp: async function* (to) {
+            for (let n = 1; n <= to; n++) {
+                await delay(300);
+                yield n;
+            }
+        },
+        notify: (message) => setInbox((received = [...received, message])),
+        calc: {
+            total,
+            add: async (n) => {
+                setTotal((runningTotal += n));
+                return runningTotal;
+            },
+            reset: () => setTotal((runningTotal = 0)),
+        },
+    };
+}
diff --git a/packages/data-rpc-iframe/src/sub/sub-panel-element.ts b/packages/data-rpc-iframe/src/sub/sub-panel-element.ts
new file mode 100644
index 00000000..449c9508
--- /dev/null
+++ b/packages/data-rpc-iframe/src/sub/sub-panel-element.ts
@@ -0,0 +1,71 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import { html } from "lit";
+import { customElement, property, state } from "lit/decorators.js";
+import { useObservableValues } from "@adobe/data-lit";
+import { RpcPanelElement } from "../ui/rpc-panel-element.js";
+import { panelStyles } from "../ui/panel.css.js";
+import type { MainService } from "../shared/main-service.js";
+import type { SubService } from "../shared/sub-service.js";
+
+const tagName = "sub-panel";
+
+declare global {
+    interface HTMLElementTagNameMap {
+        [tagName]: SubPanelElement;
+    }
+}
+
+/**
+ * The SUB frame's panel — mirror of the main panel. Observes its own
+ * `status`/`inbox` (local) and the main's `time` (remote), and drives the main's
+ * promise / generator / void members.
+ */
+@customElement(tagName)
+export class SubPanelElement extends RpcPanelElement {
+    static styles = panelStyles;
+
+    @property({ attribute: false }) local!: SubService;
+    @property({ attribute: false }) remote!: MainService;
+
+    @state() private echoResult = "";
+    @state() private streamOut: readonly number[] = [];
+
+    render() {
+        const v = useObservableValues(
+            () => ({ status: this.local.status, inbox: this.local.inbox, time: this.remote.time }),
+            [this.local, this.remote],
+        );
+        return html`
+            <h2>Sub frame (iframe)</h2>
+            <div class="row"><span class="label">Status (local):</span><span class="value">${v?.status ?? "…"}</span></div>
+            <div class="row"><span class="label">Main clock (observe):</span><span class="value">${v?.time ?? 0}</span></div>
+            <div class="row"><span class="label">Inbox from main (void):</span></div>
+            <ul>${(v?.inbox ?? []).map((m) => html`<li>${m}</li>`)}</ul>
+            <div class="row">
+                <button @click=${this.doEcho}>echo → main (promise)</button>
+                <span class="value">${this.echoResult}</span>
+            </div>
+            <div class="row">
+                <button @click=${this.doStream}>countUp ← main (generator)</button>
+                <span class="value">${this.streamOut.join(" ")}</span>
+            </div>
+            <div class="row">
+                <button @click=${this.doLog}>log → main (void)</button>
+            </div>
+        `;
+    }
+
+    private doEcho = async () => {
+        this.echoResult = await this.remote.echo(`hi from sub @${new Date().toLocaleTimeString()}`);
+    };
+
+    private doStream = async () => {
+        this.streamOut = [];
+        for await (const n of this.remote.countUp(5)) this.streamOut = [...this.streamOut, n];
+    };
+
+    private doLog = () => {
+        this.remote.log(`hello from sub @${new Date().toLocaleTimeString()}`);
+    };
+}
diff --git a/packages/data-rpc-iframe/src/sub/sub-panel.ts b/packages/data-rpc-iframe/src/sub/sub-panel.ts
new file mode 100644
index 00000000..bb9d89ae
--- /dev/null
+++ b/packages/data-rpc-iframe/src/sub/sub-panel.ts
@@ -0,0 +1,11 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import { html, type TemplateResult } from "lit";
+import type { MainService } from "../shared/main-service.js";
+import type { SubService } from "../shared/sub-service.js";
+
+/** Lazy wrapper: imports the element module, then renders it with its services. */
+export const SubPanel = (args: { local: SubService; remote: MainService }): TemplateResult => {
+    void import("./sub-panel-element.js");
+    return html`<sub-panel .local=${args.local} .remote=${args.remote}></sub-panel>`;
+};
diff --git a/packages/data-rpc-iframe/src/sub/sub.ts b/packages/data-rpc-iframe/src/sub/sub.ts
new file mode 100644
index 00000000..cd4c180c
--- /dev/null
+++ b/packages/data-rpc-iframe/src/sub/sub.ts
@@ -0,0 +1,37 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import { render } from "lit";
+import { createRpcEndpoint, createMessagePortTransport } from "@adobe/data-rpc";
+import { MainService } from "../shared/main-service.js";
+import { SubService } from "../shared/sub-service.js";
+import { HANDSHAKE, type HandshakeMessage } from "../shared/handshake.js";
+import { createSubService } from "./create-sub-service.js";
+import { SubPanel } from "./sub-panel.js";
+
+// Bootstrap the SUB frame: wait for the main frame to hand over a MessagePort,
+// then expose the sub service and consume the main service over it.
+function init(): void {
+    const app = document.getElementById("app");
+    if (app === null) return;
+
+    window.addEventListener(
+        "message",
+        (event: MessageEvent) => {
+            if (event.origin !== location.origin) return; // same-origin trust boundary
+            const data = event.data as Partial<HandshakeMessage> | null;
+            if (data === null || data.type !== HANDSHAKE) return;
+            const port = event.ports[0];
+            if (port === undefined) return;
+
+            const endpoint = createRpcEndpoint(createMessagePortTransport(port));
+            const subService = createSubService();
+            endpoint.expose("sub", subService, SubService.schema);
+            const mainService = endpoint.consume("main", MainService.schema);
+
+            render(SubPanel({ local: subService, remote: mainService }), app);
+        },
+        { once: true },
+    );
+}
+
+init();
diff --git a/packages/data-rpc-iframe/src/ui/panel.css.ts b/packages/data-rpc-iframe/src/ui/panel.css.ts
new file mode 100644
index 00000000..eeddec88
--- /dev/null
+++ b/packages/data-rpc-iframe/src/ui/panel.css.ts
@@ -0,0 +1,47 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import { css } from "lit";
+
+/** Shared styling for both panels. */
+export const panelStyles = css`
+    :host {
+        display: block;
+        font-family: system-ui, sans-serif;
+        border: 2px solid var(--accent, #4a6);
+        border-radius: 8px;
+        padding: 1rem;
+    }
+    h2 {
+        margin: 0 0 0.5rem;
+        color: var(--accent, #4a6);
+    }
+    .row {
+        display: flex;
+        align-items: center;
+        gap: 0.5rem;
+        margin: 0.35rem 0;
+    }
+    .label {
+        font-weight: 600;
+        min-width: 9rem;
+    }
+    .value {
+        font-family: ui-monospace, monospace;
+    }
+    button {
+        cursor: pointer;
+        border: 1px solid var(--accent, #4a6);
+        background: transparent;
+        color: inherit;
+        border-radius: 4px;
+        padding: 0.25rem 0.6rem;
+    }
+    button:hover {
+        background: var(--accent, #4a6);
+        color: white;
+    }
+    ul {
+        margin: 0.25rem 0;
+        padding-left: 1.2rem;
+    }
+`;
diff --git a/packages/data-rpc-iframe/src/ui/rpc-panel-element.ts b/packages/data-rpc-iframe/src/ui/rpc-panel-element.ts
new file mode 100644
index 00000000..907197a8
--- /dev/null
+++ b/packages/data-rpc-iframe/src/ui/rpc-panel-element.ts
@@ -0,0 +1,21 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import { LitElement } from "lit";
+import { attachDecorator, withHooks } from "@adobe/data-lit";
+
+/**
+ * Base for the sample's panel elements: a plain `LitElement` with the
+ * `@adobe/data-lit` hooks decorator attached to `render`, so `useObservableValues`
+ * works. Each panel receives its `local` service and the `remote` (RPC-projected)
+ * peer service as properties — the bootstrap-container DI pattern.
+ */
+export abstract class RpcPanelElement extends LitElement {
+    constructor() {
+        super();
+        attachDecorator(this, "render", withHooks);
+    }
+
+    public override render(): unknown {
+        throw new Error("render must be overridden");
+    }
+}
diff --git a/packages/data-rpc-iframe/sub.html b/packages/data-rpc-iframe/sub.html
new file mode 100644
index 00000000..693ecf56
--- /dev/null
+++ b/packages/data-rpc-iframe/sub.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>data-rpc sub frame</title>
+  <style>
+    body { margin: 0; font-family: system-ui, sans-serif; }
+    #app { display: block; --accent: #a64; }
+  </style>
+</head>
+<body>
+  <div id="app"></div>
+  <script type="module" src="/src/sub/sub.ts"></script>
+</body>
+</html>
diff --git a/packages/data-rpc-iframe/tsconfig.json b/packages/data-rpc-iframe/tsconfig.json
new file mode 100644
index 00000000..b1baabdd
--- /dev/null
+++ b/packages/data-rpc-iframe/tsconfig.json
@@ -0,0 +1,17 @@
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "useDefineForClassFields": false,
+    "lib": ["ES2020", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "skipLibCheck": true,
+    "types": [],
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "noEmit": true,
+    "experimentalDecorators": true,
+    "strict": true
+  },
+  "include": ["src"]
+}
diff --git a/packages/data-rpc-iframe/vite.config.ts b/packages/data-rpc-iframe/vite.config.ts
new file mode 100644
index 00000000..9e845bbe
--- /dev/null
+++ b/packages/data-rpc-iframe/vite.config.ts
@@ -0,0 +1,27 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import { resolve } from "node:path";
+import { defineConfig } from "vite";
+import checker from "vite-plugin-checker";
+
+export default defineConfig({
+    plugins: [checker({ typescript: true })],
+    optimizeDeps: {
+        esbuildOptions: {
+            tsconfigRaw: {
+                compilerOptions: { experimentalDecorators: true, useDefineForClassFields: false },
+            },
+        },
+    },
+    root: ".",
+    build: {
+        outDir: "dist",
+        rollupOptions: {
+            input: {
+                main: resolve(__dirname, "index.html"),
+                sub: resolve(__dirname, "sub.html"),
+            },
+        },
+    },
+    server: { port: 3011, open: false },
+});
diff --git a/packages/data-rpc/LICENSE b/packages/data-rpc/LICENSE
new file mode 100644
index 00000000..4290d535
--- /dev/null
+++ b/packages/data-rpc/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025-2026 Adobe, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/packages/data-rpc/README.md b/packages/data-rpc/README.md
new file mode 100644
index 00000000..08d1c198
--- /dev/null
+++ b/packages/data-rpc/README.md
@@ -0,0 +1,137 @@
+# @adobe/data-rpc
+
+Schema-driven, **bidirectional** projection of `@adobe/data` async data services
+across a boundary — an iframe, a Worker, a `MessagePort`, anything with a
+message channel. Each side can both **expose** its own services and **consume**
+the peer's, over a single connection.
+
+## The core idea
+
+An `AsyncDataService` is fully described by a pure-JSON `Schema`, and every one
+of its members is one of five shapes:
+
+| member | schema | wire behavior |
+| --- | --- | --- |
+| `Observe<Data>` | `observe` | subscribe → streamed `Data` values |
+| `(...Data[]) => Observe<Data>` | `function` / `observe` | args + subscribe → streamed `Data` |
+| `(...Data[]) => Promise<Data \| void>` | `function` / `promise` | request → one `Data` reply |
+| `(...Data[]) => AsyncGenerator<Data>` | `function` / `generator` | pull-based stream of `Data` |
+| `(...Data[]) => void` | `function` (no `returns`) | fire-and-forget |
+
+**Only `Data` ever crosses the wire.** We never serialize an `Observe`,
+`Promise`, `AsyncGenerator`, or function. The consuming side *synthesizes* an
+equivalent-shaped service locally whose members are thin wrappers translating
+to/from `Data`-only messages. Gating `expose` on `AsyncDataService.IsValid`
+guarantees there is nothing but `Data` to marshal (an `Observe` is a function,
+so higher-order nesting is rejected at compile time).
+
+**Nested services** work too: a member whose schema is a child object with its
+own member `properties` is shimmed recursively on both sides (to any depth), and
+each leaf is addressed by its full path from the service root — so
+`remote.child.deep.greet(name)` round-trips exactly like a top-level member.
+
+## Define a service
+
+A projected service is an ordinary `@adobe/data` `AsyncDataService`: an interface
+of the five member shapes above, plus a sideloaded `Schema` that describes it
+exactly. The schema is the single source of truth — it drives the wrapping on
+both sides.
+
+```ts
+import type { Observe } from "@adobe/data/observe";
+import { type Schema } from "@adobe/data/schema";
+import { AsyncDataService, type Service } from "@adobe/data/service";
+import type { Assert } from "@adobe/data/types";
+
+export interface CounterService extends Service {
+  count: Observe<number>;                 // observe
+  add: (n: number) => Promise<number>;    // promise
+  reset: () => void;                      // void
+}
+
+export namespace CounterService {
+  export const schema = {
+    type: "object",
+    properties: {
+      count: { type: "observe", value: { type: "number" } },
+      add: { type: "function", signature: { parameters: [{ type: "number" }], returns: { type: "promise", value: { type: "number" } } } },
+      reset: { type: "function" },
+    },
+    required: ["count", "add", "reset"],
+    additionalProperties: false,
+  } as const satisfies Schema;
+}
+
+// Compile-time guard: the schema describes the service exactly (only Data crosses).
+type _Check = Assert<AsyncDataService.IsValidWithCompleteSchema<CounterService, typeof CounterService.schema>>;
+```
+
+## Usage
+
+```ts
+import { createRpcEndpoint, createMessagePortTransport } from "@adobe/data-rpc";
+
+// Each side over one MessagePort:
+const endpoint = createRpcEndpoint(createMessagePortTransport(port));
+
+// Expose a local service (schema must exactly describe it — compile-time checked):
+endpoint.expose("clock", myClockService, ClockService.schema);
+
+// Consume the peer's service with a compile-time schema → fully typed, sync:
+const remote = endpoint.consume("weather", WeatherService.schema);
+remote.temperature((t) => render(t));         // observe
+const forecast = await remote.forecast("NYC"); // promise
+for await (const d of remote.days(7)) { … }    // generator (pull-based)
+remote.refresh();                              // void
+
+// …or fetch the schema at runtime (resolves once the peer exposes it):
+const remote2 = await endpoint.consume("weather");
+```
+
+### iframe handshake
+
+The main frame hands the iframe one end of a `MessageChannel`, then both switch
+to a `MessagePort` transport:
+
+```ts
+const channel = new MessageChannel();
+iframe.addEventListener("load", () =>
+  iframe.contentWindow!.postMessage({ type: "port" }, origin, [channel.port2]),
+);
+const endpoint = createRpcEndpoint(createMessagePortTransport(channel.port1));
+```
+
+See the `data-rpc-iframe` sample for a complete main + sub frame demonstrating
+all four kinds in both directions.
+
+## Transports
+
+- `createMessagePortTransport(port)` — the primary iframe/worker transport.
+- `createWindowTransport(target, { allowedOrigins })` — `window.postMessage`, for
+  the initial port handoff, with origin allowlisting.
+- `createRpcLoopbackTransport()` — in-process pair for tests and single-process demos.
+
+`RpcTransport` is a small `send`/`onMessage`/`onClose`/`close` interface; bring
+your own for any other channel.
+
+## Trust (v1)
+
+Transport-level: origin allowlisting on the window transport, and the host only
+dispatches to explicitly `expose`d services. Incoming `Data` arguments are
+validated against `signature.parameters` before dispatch. A `canInvoke(service,
+member)` seam (default allow) is where per-member policy — e.g.
+`Schema.resolveExternalInvocation` — drops in later.
+
+## Semantics & limitations
+
+- **Observe first value is asynchronous** (a round-trip), unlike a local
+  `Observe.fromConstant`/`createState` which notifies synchronously.
+- **Generators are strictly pull-based** — the host advances one value per
+  `next()`; no unbounded buffering.
+- **Errors** are marshaled as `{ name, message, stack }` and reconstructed as a
+  plain `Error`; the remote subclass is not preserved. A throw in a `void`
+  handler has no wire channel — it is routed to the endpoint's `onError`.
+- **On close**, pending promise calls reject, consumed generators end, and all
+  host subscriptions/generators are released. A dropped subscription has no error
+  channel through `Observe<Data>`.
+- **Reconnection is out of scope** for v1 — a closed port ends all subscriptions.
diff --git a/packages/data-rpc/package.json b/packages/data-rpc/package.json
new file mode 100644
index 00000000..3985f6cd
--- /dev/null
+++ b/packages/data-rpc/package.json
@@ -0,0 +1,38 @@
+{
+    "name": "@adobe/data-rpc",
+    "version": "0.10.10",
+    "description": "Schema-driven, bidirectional projection of @adobe/data async data services across a boundary (iframe / MessagePort / Worker). Only Data crosses the wire.",
+    "type": "module",
+    "sideEffects": false,
+    "private": false,
+    "publishConfig": {
+        "registry": "https://registry.npmjs.org/",
+        "access": "public"
+    },
+    "files": [
+        "dist",
+        "README.md",
+        "LICENSE"
+    ],
+    "scripts": {
+        "build": "cp ../../LICENSE . 2>/dev/null || true; tsc -b",
+        "clean": "rm -rf dist node_modules",
+        "dev": "tsc -b -w --preserveWatchOutput",
+        "test": "vitest --run",
+        "typecheck": "tsc -b"
+    },
+    "dependencies": {
+        "@adobe/data": "workspace:*"
+    },
+    "devDependencies": {
+        "jsdom": "^24.1.0",
+        "typescript": "^5.8.3",
+        "vitest": "^1.6.0"
+    },
+    "exports": {
+        ".": {
+            "import": "./dist/index.js",
+            "types": "./dist/index.d.ts"
+        }
+    }
+}
diff --git a/packages/data-rpc/src/consume/caller-context.ts b/packages/data-rpc/src/consume/caller-context.ts
new file mode 100644
index 00000000..327fe7f3
--- /dev/null
+++ b/packages/data-rpc/src/consume/caller-context.ts
@@ -0,0 +1,39 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import type { Data } from "@adobe/data";
+import type { Notify } from "@adobe/data/observe";
+import type { RpcMessage } from "../protocol.js";
+
+/** One in-flight promise call, awaiting a `resolve`/`reject` for its id. */
+export interface CallSlot {
+    readonly resolve: (value: Data) => void;
+    readonly reject: (error: unknown) => void;
+    timer?: ReturnType<typeof setTimeout>;
+}
+
+/** The result delivered to one awaited generator `pull`. */
+export type PullResult =
+    | { readonly done: false; readonly value: Data }
+    | { readonly done: true; readonly value: Data | undefined }
+    | { readonly error: Error };
+
+/** One live consumed generator: a FIFO of pull resolvers awaiting yield/done/throw. */
+export interface CallerGenSlot {
+    readonly pulls: Array<(result: PullResult) => void>;
+}
+
+/**
+ * The caller-side surface the consume wrappers write into. The endpoint owns
+ * these tables and settles them from incoming response messages; the wrappers
+ * only allocate an id, register a slot, and send a request. All tables are keyed
+ * by a LOCAL id — unique per-originator, separate from the host-side tables.
+ */
+export interface CallerContext {
+    readonly send: (msg: RpcMessage) => void;
+    readonly nextId: () => number;
+    readonly callPending: Map<number, CallSlot>;
+    readonly callerSubs: Map<number, Notify<Data>>;
+    readonly callerGens: Map<number, CallerGenSlot>;
+    readonly defaultTimeoutMs?: number;
+    readonly isClosed: () => boolean;
+}
diff --git a/packages/data-rpc/src/consume/make-generator.ts b/packages/data-rpc/src/consume/make-generator.ts
new file mode 100644
index 00000000..f5c4a529
--- /dev/null
+++ b/packages/data-rpc/src/consume/make-generator.ts
@@ -0,0 +1,88 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import type { Data } from "@adobe/data";
+import { marshalError } from "../host/marshal-error.js";
+import type { CallerContext, CallerGenSlot, PullResult } from "./caller-context.js";
+
+/**
+ * Projects a remote async-generator member, strictly pull-based: the host does
+ * not advance until this side asks. The first `next()` sends `iterate` (once),
+ * then every `next()` sends one `pull` and awaits the matching
+ * `yield`/`done`/`throw`. Early `return()` / `await using` disposal sends
+ * `return`; a thrown `throw(e)` injects `raise` so the host generator's `finally`
+ * runs. Once terminated it never resurrects (mirrors the local lazy generator).
+ *
+ * If the endpoint closes mid-stream the pending pull resolves `done` and further
+ * `next()` calls return `done` — a graceful end (an `Observe`/generator has no
+ * error channel guaranteed across a dropped transport).
+ */
+export function makeGenerator(
+    ctx: CallerContext,
+    service: string,
+    path: readonly string[],
+    args: readonly Data[],
+): AsyncGenerator<Data> {
+    const id = ctx.nextId();
+    const slot: CallerGenSlot = { pulls: [] };
+    ctx.callerGens.set(id, slot);
+
+    let started = false;
+    let finished = false;
+
+    const finish = () => {
+        finished = true;
+        ctx.callerGens.delete(id);
+    };
+
+    const gen: AsyncGenerator<Data> = {
+        async next(): Promise<IteratorResult<Data>> {
+            if (finished || ctx.isClosed()) {
+                finish();
+                return { done: true, value: undefined };
+            }
+            if (!started) {
+                started = true;
+                ctx.send({ kind: "iterate", id, service, path, args });
+            }
+            ctx.send({ kind: "pull", id });
+            const result = await new Promise<PullResult>((res) => slot.pulls.push(res));
+            if ("error" in result) {
+                finish();
+                throw result.error;
+            }
+            if (result.done) {
+                finish();
+                return { done: true, value: result.value };
+            }
+            return { done: false, value: result.value };
+        },
+
+        async return(value?: Data): Promise<IteratorResult<Data>> {
+            if (!finished) {
+                const wasStarted = started;
+                finish();
+                if (wasStarted) ctx.send({ kind: "return", id });
+            }
+            return { done: true, value: value as Data };
+        },
+
+        async throw(error?: unknown): Promise<IteratorResult<Data>> {
+            if (!finished) {
+                const wasStarted = started;
+                finish();
+                if (wasStarted) ctx.send({ kind: "raise", id, error: marshalError(error) });
+            }
+            throw error;
+        },
+
+        [Symbol.asyncIterator]() {
+            return this;
+        },
+
+        async [Symbol.asyncDispose](): Promise<void> {
+            await gen.return(undefined);
+        },
+    };
+
+    return gen;
+}
diff --git a/packages/data-rpc/src/consume/make-observe.ts b/packages/data-rpc/src/consume/make-observe.ts
new file mode 100644
index 00000000..ea73fd28
--- /dev/null
+++ b/packages/data-rpc/src/consume/make-observe.ts
@@ -0,0 +1,35 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import type { Data } from "@adobe/data";
+import type { Observe } from "@adobe/data/observe";
+import type { CallerContext } from "./caller-context.js";
+
+/**
+ * A local `Observe<Data>` that projects a remote observe member. On subscribe it
+ * allocates an id, registers the `notify`, and sends `subscribe`; each remote
+ * `next` for that id is routed back to `notify` by the endpoint. Unsubscribing
+ * deletes the id (so any `next` still in flight is dropped) and sends
+ * `unsubscribe`.
+ *
+ * Unlike a local `Observe` (e.g. `Observe.fromConstant`, which notifies
+ * synchronously on subscribe), the FIRST value here necessarily arrives
+ * asynchronously — it is a round-trip over the transport.
+ */
+export function makeObserve(
+    ctx: CallerContext,
+    service: string,
+    path: readonly string[],
+    args: readonly Data[],
+): Observe<Data> {
+    return (notify) => {
+        if (ctx.isClosed()) return () => undefined;
+        const id = ctx.nextId();
+        ctx.callerSubs.set(id, notify);
+        ctx.send({ kind: "subscribe", id, service, path, args });
+        return () => {
+            if (ctx.callerSubs.delete(id)) {
+                ctx.send({ kind: "unsubscribe", id });
+            }
+        };
+    };
+}
diff --git a/packages/data-rpc/src/consume/make-promise.ts b/packages/data-rpc/src/consume/make-promise.ts
new file mode 100644
index 00000000..022be319
--- /dev/null
+++ b/packages/data-rpc/src/consume/make-promise.ts
@@ -0,0 +1,39 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import type { Data } from "@adobe/data";
+import type { CallerContext, CallSlot } from "./caller-context.js";
+
+/**
+ * Projects a remote promise member: allocates an id, registers a pending slot,
+ * and sends `call`; the endpoint settles the slot from the matching
+ * `resolve`/`reject`. When `defaultTimeoutMs` is set, a timer rejects the call
+ * (and drops the slot, so a late `resolve` is ignored) if no reply arrives — the
+ * host still runs to completion, but a wedged transport no longer hangs forever.
+ */
+export function makePromise(
+    ctx: CallerContext,
+    service: string,
+    path: readonly string[],
+    args: readonly Data[],
+): Promise<Data> {
+    const label = `${service}.${path.join(".")}`;
+    return new Promise<Data>((resolve, reject) => {
+        if (ctx.isClosed()) {
+            reject(new Error(`rpc endpoint is closed (${label})`));
+            return;
+        }
+        const id = ctx.nextId();
+        const slot: CallSlot = { resolve, reject };
+        const deadline =
+            ctx.defaultTimeoutMs !== undefined ? Date.now() + ctx.defaultTimeoutMs : undefined;
+        if (ctx.defaultTimeoutMs !== undefined) {
+            slot.timer = setTimeout(() => {
+                if (ctx.callPending.delete(id)) {
+                    reject(new Error(`rpc call ${label} timed out after ${ctx.defaultTimeoutMs}ms`));
+                }
+            }, ctx.defaultTimeoutMs);
+        }
+        ctx.callPending.set(id, slot);
+        ctx.send({ kind: "call", id, service, path, args, deadline });
+    });
+}
diff --git a/packages/data-rpc/src/consume/make-void.ts b/packages/data-rpc/src/consume/make-void.ts
new file mode 100644
index 00000000..b5c4307e
--- /dev/null
+++ b/packages/data-rpc/src/consume/make-void.ts
@@ -0,0 +1,21 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import type { Data } from "@adobe/data";
+import type { CallerContext } from "./caller-context.js";
+
+/**
+ * Projects a remote void member: fire-and-forget `send`, no reply, no id table.
+ * A throw inside the host handler has no wire channel back here — it is routed to
+ * the host endpoint's `onError` and otherwise invisible to the caller (matching
+ * the local `void`-member contract).
+ */
+export function makeVoid(
+    ctx: CallerContext,
+    service: string,
+    path: readonly string[],
+    args: readonly Data[],
+): void {
+    if (ctx.isClosed()) return;
+    const id = ctx.nextId();
+    ctx.send({ kind: "send", id, service, path, args });
+}
diff --git a/packages/data-rpc/src/consume/reconstruct-error.ts b/packages/data-rpc/src/consume/reconstruct-error.ts
new file mode 100644
index 00000000..7a977e48
--- /dev/null
+++ b/packages/data-rpc/src/consume/reconstruct-error.ts
@@ -0,0 +1,15 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import type { RpcError } from "../protocol.js";
+
+/**
+ * Rebuild a local `Error` from a wire {@link RpcError}. The result is always a
+ * plain `Error` (the remote subclass is not reconstructable); `name` and the
+ * remote `stack` are preserved so logs point back at the true origin.
+ */
+export function reconstructError(error: RpcError): Error {
+    const e = new Error(error.message);
+    e.name = error.name;
+    if (error.stack !== undefined) e.stack = error.stack;
+    return e;
+}
diff --git a/packages/data-rpc/src/consume/synthesize-service.ts b/packages/data-rpc/src/consume/synthesize-service.ts
new file mode 100644
index 00000000..cd711391
--- /dev/null
+++ b/packages/data-rpc/src/consume/synthesize-service.ts
@@ -0,0 +1,73 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import type { Data } from "@adobe/data";
+import { Observe } from "@adobe/data/observe";
+import type { Schema } from "@adobe/data/schema";
+import { AsyncDataService, type Service } from "@adobe/data/service";
+import type { CallerContext } from "./caller-context.js";
+import { makeObserve } from "./make-observe.js";
+import { makePromise } from "./make-promise.js";
+import { makeGenerator } from "./make-generator.js";
+import { makeVoid } from "./make-void.js";
+
+/**
+ * Recursively shim a service's members from its schema. Each described member is
+ * either a LEAF (`observe`/`function`, classified with the same `memberKind` the
+ * local lazy wrapper uses and wrapped to forward over the transport) or a NESTED
+ * service (a child `object` schema with its own `properties`), which is shimmed
+ * as a matching nested object. Every leaf is addressed by its full `path` from
+ * the service root, so nested members round-trip exactly like top-level ones.
+ */
+function buildMembers(
+    ctx: CallerContext,
+    service: string,
+    properties: { readonly [key: string]: Schema },
+    path: readonly string[],
+): Record<string, unknown> {
+    const out: Record<string, unknown> = {};
+    for (const [key, member] of Object.entries(properties)) {
+        const memberPath = [...path, key];
+        if (member.type === "observe" || member.type === "function") {
+            const kind = AsyncDataService.memberKind(member);
+            switch (kind) {
+                case "observe":
+                    out[key] = makeObserve(ctx, service, memberPath, []);
+                    break;
+                case "fn:observe":
+                    out[key] = (...args: Data[]) => makeObserve(ctx, service, memberPath, args);
+                    break;
+                case "fn:promise":
+                    out[key] = (...args: Data[]) => makePromise(ctx, service, memberPath, args);
+                    break;
+                case "fn:generator":
+                    out[key] = (...args: Data[]) => makeGenerator(ctx, service, memberPath, args);
+                    break;
+                case "fn:void":
+                    out[key] = (...args: Data[]) => makeVoid(ctx, service, memberPath, args);
+                    break;
+            }
+        } else if (member.type === "object" || member.properties !== undefined) {
+            // Nested service — shim its members recursively under the extended path.
+            out[key] = buildMembers(ctx, service, member.properties ?? {}, memberPath);
+        } else {
+            // Not a leaf and not a container — let memberKind raise the precise error.
+            AsyncDataService.memberKind(member);
+        }
+    }
+    return out;
+}
+
+/**
+ * Builds an equivalent-shaped local service from a peer service's schema. The
+ * `schema` slot republishes the schema as a constant observable, so the projected
+ * service is introspectable exactly like any other. Nested services are shimmed
+ * on both sides so their members are reachable transparently.
+ */
+export function synthesizeService(ctx: CallerContext, name: string, schema: Schema): Service {
+    const service: Record<string, unknown> = {
+        serviceName: `rpc:${name}`,
+        schema: Observe.fromConstant(schema),
+        ...buildMembers(ctx, name, schema.properties ?? {}, []),
+    };
+    return service as Service;
+}
diff --git a/packages/data-rpc/src/create-endpoint.ts b/packages/data-rpc/src/create-endpoint.ts
new file mode 100644
index 00000000..e59e5cdf
--- /dev/null
+++ b/packages/data-rpc/src/create-endpoint.ts
@@ -0,0 +1,209 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import type { Data } from "@adobe/data";
+import type { Notify, Unobserve } from "@adobe/data/observe";
+import type { Schema } from "@adobe/data/schema";
+import type { Service } from "@adobe/data/service";
+import type { CallerContext, CallSlot, CallerGenSlot } from "./consume/caller-context.js";
+import { reconstructError } from "./consume/reconstruct-error.js";
+import { synthesizeService } from "./consume/synthesize-service.js";
+import type { RpcEndpoint, RpcEndpointOptions } from "./endpoint.js";
+import type { ExposedService, HostContext } from "./host/host-context.js";
+import { handleHostRequest } from "./host/register-service.js";
+import { createIdAllocator } from "./id.js";
+import { RPC_PROTOCOL_VERSION, type RpcMessage } from "./protocol.js";
+import type { RpcTransport } from "./transport.js";
+
+/**
+ * Create a bidirectional RPC endpoint over `transport`. Sends a `hello`
+ * handshake immediately; re-announces exposed services whenever the peer says
+ * `hello`, so services exposed before the peer connected are still discovered.
+ */
+export function createRpcEndpoint(transport: RpcTransport, options: RpcEndpointOptions = {}): RpcEndpoint {
+    const nextId = createIdAllocator();
+    const canInvoke = options.canInvoke ?? (() => true);
+    const onError = options.onError ?? ((error: unknown) => console.error("[data-rpc]", error));
+
+    let closed = false;
+    const send = (msg: RpcMessage) => {
+        if (!closed) transport.send(msg);
+    };
+
+    // ---- host-side state (keyed by the REMOTE caller's id) ----
+    const exposed = new Map<string, ExposedService>();
+    const hostSubs = new Map<number, Unobserve>();
+    const hostGens = new Map<number, AsyncGenerator<Data>>();
+    const hostCtx: HostContext = { send, exposed, hostSubs, hostGens, canInvoke, onError };
+
+    // ---- caller-side state (keyed by a LOCAL id) ----
+    const callPending = new Map<number, CallSlot>();
+    const callerSubs = new Map<number, Notify<Data>>();
+    const callerGens = new Map<number, CallerGenSlot>();
+    const schemaPending = new Map<number, (schema: Schema | null) => void>();
+    const availableSchemas = new Map<string, Schema>();
+    const awaiting = new Map<string, Array<(schema: Schema) => void>>();
+    const callerCtx: CallerContext = {
+        send,
+        nextId,
+        callPending,
+        callerSubs,
+        callerGens,
+        defaultTimeoutMs: options.defaultTimeoutMs,
+        isClosed: () => closed,
+    };
+
+    const flushAwaiting = (name: string, schema: Schema) => {
+        const waiters = awaiting.get(name);
+        if (waiters === undefined) return;
+        awaiting.delete(name);
+        for (const w of waiters) w(schema);
+    };
+
+    // ---- dispatcher ----
+    const unMessage = transport.onMessage((msg) => {
+        switch (msg.kind) {
+            case "hello": {
+                send({ kind: "welcome", protocol: RPC_PROTOCOL_VERSION });
+                // Re-announce everything already exposed for a peer that connected late.
+                for (const [name, ex] of exposed) send({ kind: "available", service: name, schema: ex.schema });
+                return;
+            }
+            case "welcome": {
+                if (msg.protocol !== RPC_PROTOCOL_VERSION) {
+                    onError(new Error(`data-rpc protocol mismatch: local ${RPC_PROTOCOL_VERSION}, peer ${msg.protocol}`));
+                }
+                return;
+            }
+            case "available": {
+                availableSchemas.set(msg.service, msg.schema);
+                flushAwaiting(msg.service, msg.schema);
+                return;
+            }
+            case "unavailable": {
+                availableSchemas.delete(msg.service);
+                return;
+            }
+            case "schema": {
+                const waiter = schemaPending.get(msg.id);
+                if (waiter !== undefined) {
+                    schemaPending.delete(msg.id);
+                    waiter(msg.schema);
+                }
+                return;
+            }
+            case "resolve": {
+                const slot = callPending.get(msg.id);
+                if (slot !== undefined) {
+                    if (slot.timer !== undefined) clearTimeout(slot.timer);
+                    callPending.delete(msg.id);
+                    slot.resolve(msg.value);
+                }
+                return;
+            }
+            case "reject": {
+                const slot = callPending.get(msg.id);
+                if (slot !== undefined) {
+                    if (slot.timer !== undefined) clearTimeout(slot.timer);
+                    callPending.delete(msg.id);
+                    slot.reject(reconstructError(msg.error));
+                }
+                return;
+            }
+            case "next": {
+                callerSubs.get(msg.id)?.(msg.value);
+                return;
+            }
+            case "yield":
+            case "done":
+            case "throw": {
+                const slot = callerGens.get(msg.id);
+                const resolvePull = slot?.pulls.shift();
+                if (resolvePull === undefined) return;
+                if (msg.kind === "yield") resolvePull({ done: false, value: msg.value });
+                else if (msg.kind === "done") resolvePull({ done: true, value: msg.value });
+                else resolvePull({ error: reconstructError(msg.error) });
+                return;
+            }
+            default:
+                // A request kind — route to the host side.
+                handleHostRequest(hostCtx, msg);
+                return;
+        }
+    });
+
+    const teardown = () => {
+        if (closed) return;
+        closed = true;
+        // Caller side: pending calls reject; observes drop (no error channel);
+        // generators end gracefully (pending pulls resolve `done`).
+        for (const [, slot] of callPending) {
+            if (slot.timer !== undefined) clearTimeout(slot.timer);
+            slot.reject(new Error("data-rpc endpoint closed"));
+        }
+        callPending.clear();
+        callerSubs.clear();
+        for (const [, slot] of callerGens) {
+            for (const resolvePull of slot.pulls.splice(0)) resolvePull({ done: true, value: undefined });
+        }
+        callerGens.clear();
+        for (const [, waiter] of schemaPending) waiter(null);
+        schemaPending.clear();
+        awaiting.clear();
+        // Host side: release every subscription and generator.
+        for (const [, unobserve] of hostSubs) unobserve();
+        hostSubs.clear();
+        for (const [, gen] of hostGens) void gen.return(undefined).catch(() => undefined);
+        hostGens.clear();
+        unMessage();
+    };
+    transport.onClose(teardown);
+
+    // Initiate the handshake.
+    send({ kind: "hello", protocol: RPC_PROTOCOL_VERSION });
+
+    const expose: RpcEndpoint["expose"] = (name, service, schema) => {
+        // The type gate proves `schema` exactly describes `service`; store the plain schema.
+        const plainSchema = schema as Schema;
+        exposed.set(name, { service, schema: plainSchema });
+        send({ kind: "available", service: name, schema: plainSchema });
+        return () => {
+            if (exposed.delete(name)) send({ kind: "unavailable", service: name });
+        };
+    };
+
+    // Single implementation backing both `consume` overloads.
+    function consume(name: string, schema?: Schema): unknown {
+        if (schema !== undefined) {
+            return synthesizeService(callerCtx, name, schema);
+        }
+        const known = availableSchemas.get(name);
+        if (known !== undefined) {
+            return Promise.resolve(synthesizeService(callerCtx, name, known));
+        }
+        return new Promise<Service>((resolve) => {
+            const waiters = awaiting.get(name) ?? [];
+            waiters.push((s) => resolve(synthesizeService(callerCtx, name, s)));
+            awaiting.set(name, waiters);
+            // Proactively fetch in case the service is exposed but we missed the
+            // announcement (e.g. we connected after it was exposed).
+            const id = nextId();
+            schemaPending.set(id, (s) => {
+                if (s !== null) {
+                    availableSchemas.set(name, s);
+                    flushAwaiting(name, s);
+                }
+                // s === null: not yet exposed — keep waiting for a future `available`.
+            });
+            send({ kind: "get-schema", id, service: name });
+        });
+    }
+
+    return {
+        expose,
+        consume: consume as RpcEndpoint["consume"],
+        close() {
+            teardown();
+            transport.close();
+        },
+    };
+}
diff --git a/packages/data-rpc/src/endpoint.ts b/packages/data-rpc/src/endpoint.ts
new file mode 100644
index 00000000..fcbc0339
--- /dev/null
+++ b/packages/data-rpc/src/endpoint.ts
@@ -0,0 +1,67 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import { Schema } from "@adobe/data/schema";
+import { AsyncDataService, type Service } from "@adobe/data/service";
+
+/** Options for {@link createRpcEndpoint}. */
+export interface RpcEndpointOptions {
+    /**
+     * Authorization seam — return `false` to refuse a member call from the peer.
+     * Defaults to allow-all. This is where per-member policy (e.g.
+     * `Schema.resolveExternalInvocation`) drops in; it is SEPARATE from the
+     * argument validation the host always performs against `signature.parameters`.
+     */
+    readonly canInvoke?: (service: string, member: string) => boolean;
+    /**
+     * If set, a consumed promise call rejects after this many ms with no reply,
+     * so a wedged (but not closed) transport can't hang a call forever.
+     */
+    readonly defaultTimeoutMs?: number;
+    /**
+     * Receives errors that have no wire channel back to the caller — a throw in a
+     * host `void` handler, a refused/failed `subscribe`, or a generator cleanup
+     * failure. Defaults to `console.error`.
+     */
+    readonly onError?: (error: unknown) => void;
+}
+
+/**
+ * A bidirectional RPC endpoint over one transport. Each endpoint can both
+ * `expose` local services to the peer and `consume` the peer's services; the
+ * channel is symmetric.
+ */
+export interface RpcEndpoint {
+    /**
+     * Expose a local service to the peer. The `schema` must be a valid
+     * `AsyncDataService` schema that EXACTLY describes `service` — this is what
+     * guarantees only `Data` ever crosses the wire; a mismatch is a compile
+     * error carrying an `__rpcError` marker. Returns a teardown that stops new
+     * calls (and announces the service unavailable).
+     */
+    expose<T extends Service, const S extends Schema>(
+        name: string,
+        service: T,
+        schema: S &
+            (AsyncDataService.IsValidWithCompleteSchema<T, S> extends true
+                ? unknown
+                : {
+                      readonly __rpcError: "data-rpc: service must be a valid AsyncDataService fully described by this schema";
+                  }),
+    ): () => void;
+
+    /**
+     * Consume a peer service using a compile-time schema constant — returns a
+     * fully-typed projected service synchronously. The returned type reflects
+     * `Schema.ToType<S>` (deep-readonly, defaults widened), not necessarily the
+     * peer's hand-authored interface.
+     */
+    consume<const S extends Schema>(name: string, schema: S): Schema.ToType<S> & Service;
+    /**
+     * Consume a peer service whose schema is fetched at runtime — resolves once
+     * the peer has exposed it (safe to call before the peer exposes).
+     */
+    consume(name: string): Promise<Service>;
+
+    /** Tear down the endpoint: reject pending calls, end subscriptions/generators, close the transport. */
+    close(): void;
+}
diff --git a/packages/data-rpc/src/host/host-context.ts b/packages/data-rpc/src/host/host-context.ts
new file mode 100644
index 00000000..f6079a55
--- /dev/null
+++ b/packages/data-rpc/src/host/host-context.ts
@@ -0,0 +1,27 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import type { Data } from "@adobe/data";
+import type { Unobserve } from "@adobe/data/observe";
+import type { Schema } from "@adobe/data/schema";
+import type { Service } from "@adobe/data/service";
+import type { RpcMessage } from "../protocol.js";
+
+/** One exposed service and the schema that describes (and validates) its surface. */
+export interface ExposedService {
+    readonly service: Service;
+    readonly schema: Schema;
+}
+
+/**
+ * The host-side surface the request handler operates on. `hostSubs`/`hostGens`
+ * are keyed by the REMOTE caller's id (separate from the local caller tables),
+ * so the same numeric id can be live in both directions without collision.
+ */
+export interface HostContext {
+    readonly send: (msg: RpcMessage) => void;
+    readonly exposed: Map<string, ExposedService>;
+    readonly hostSubs: Map<number, Unobserve>;
+    readonly hostGens: Map<number, AsyncGenerator<Data>>;
+    readonly canInvoke: (service: string, member: string) => boolean;
+    readonly onError: (error: unknown) => void;
+}
diff --git a/packages/data-rpc/src/host/marshal-error.ts b/packages/data-rpc/src/host/marshal-error.ts
new file mode 100644
index 00000000..be71c885
--- /dev/null
+++ b/packages/data-rpc/src/host/marshal-error.ts
@@ -0,0 +1,17 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import type { RpcError } from "../protocol.js";
+
+/**
+ * Serialize a thrown value into the three wire-safe fields of {@link RpcError}.
+ * We never structured-clone the thrown value itself — that would drop its
+ * subclass prototype and any non-standard properties, and a non-`Error` throw
+ * (a string, an object) may not clone at all.
+ */
+export function marshalError(error: unknown): RpcError {
+    if (error instanceof Error) {
+        return { name: error.name, message: error.message, stack: error.stack };
+    }
+    // Non-Error throws (strings, plain objects): stringify into `message`.
+    return { name: "Error", message: typeof error === "string" ? error : String(error) };
+}
diff --git a/packages/data-rpc/src/host/register-service.ts b/packages/data-rpc/src/host/register-service.ts
new file mode 100644
index 00000000..069b5c4f
--- /dev/null
+++ b/packages/data-rpc/src/host/register-service.ts
@@ -0,0 +1,190 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import type { Data } from "@adobe/data";
+import type { Observe } from "@adobe/data/observe";
+import { validate, type Schema } from "@adobe/data/schema";
+import { reconstructError } from "../consume/reconstruct-error.js";
+import type { RpcError, RpcMessage } from "../protocol.js";
+import type { HostContext } from "./host-context.js";
+import { marshalError } from "./marshal-error.js";
+
+// A member read off an exposed service. Its concrete shape (observe value vs.
+// function returning observe/promise/generator/void) is guaranteed by the
+// `IsValidWithCompleteSchema` gate at `expose()`, so we read it as a permissive
+// callable/observable and dispatch by the request kind + member schema.
+type Member =
+    | Observe<Data>
+    | ((...args: Data[]) => Observe<Data> | Promise<Data | void> | AsyncGenerator<Data> | void);
+
+/**
+ * Resolve an authorized, argument-validated member for an incoming request.
+ * `path` addresses the member from the service root, walking through any nested
+ * services. Returns the leaf member schema + callable, or an `RpcError`
+ * describing why it was refused (service not exposed, member absent, not
+ * permitted, or bad args).
+ */
+function resolve(
+    ctx: HostContext,
+    service: string,
+    path: readonly string[],
+    args: readonly Data[],
+): { readonly memberSchema: Schema; readonly target: Member } | { readonly error: RpcError } {
+    const label = `${service}.${path.join(".")}`;
+    const exposed = ctx.exposed.get(service);
+    if (exposed === undefined) {
+        return { error: { name: "RpcError", message: `service "${service}" is not exposed` } };
+    }
+    if (path.length === 0) {
+        return { error: { name: "RpcError", message: `empty member path for service "${service}"` } };
+    }
+    if (!ctx.canInvoke(service, path.join("."))) {
+        return { error: { name: "RpcError", message: `"${label}" is not permitted` } };
+    }
+    // Walk the schema tree to the leaf member schema (through nested services).
+    let memberSchema: Schema = exposed.schema;
+    for (const key of path) {
+        const next = memberSchema.properties?.[key];
+        if (next === undefined) {
+            return { error: { name: "RpcError", message: `service "${service}" has no member "${label}"` } };
+        }
+        memberSchema = next;
+    }
+    const params = memberSchema.signature?.parameters;
+    if (params !== undefined) {
+        const errors: string[] = [];
+        params.forEach((p, i) => {
+            if (i >= args.length) errors.push(`missing required argument ${i} for "${label}"`);
+            else errors.push(...validate(p, args[i]));
+        });
+        if (errors.length > 0) {
+            return { error: { name: "RpcError", message: `invalid arguments for "${label}": ${errors.join("; ")}` } };
+        }
+    }
+    // Walk the service object tree to the leaf member (exists and matches its
+    // schema kind — guaranteed at expose()).
+    let target: unknown = exposed.service;
+    for (const key of path) {
+        target = (target as Record<string, unknown>)[key];
+    }
+    return { memberSchema, target: target as Member };
+}
+
+/**
+ * Handle one incoming REQUEST message against the host's exposed services.
+ * Response/announcement kinds are handled elsewhere (the caller side); this
+ * covers get-schema, call, send, subscribe/unsubscribe, and the pull-based
+ * generator lifecycle. Returns `true` if the message was a host request it
+ * handled, `false` otherwise (so the endpoint can route it to the caller side).
+ */
+export function handleHostRequest(ctx: HostContext, msg: RpcMessage): boolean {
+    switch (msg.kind) {
+        case "get-schema": {
+            const exposed = ctx.exposed.get(msg.service);
+            ctx.send({ kind: "schema", id: msg.id, service: msg.service, schema: exposed?.schema ?? null });
+            return true;
+        }
+
+        case "call": {
+            const r = resolve(ctx, msg.service, msg.path, msg.args);
+            if ("error" in r) {
+                ctx.send({ kind: "reject", id: msg.id, error: r.error });
+                return true;
+            }
+            const fn = r.target as (...args: Data[]) => Promise<Data | void>;
+            Promise.resolve()
+                .then(() => fn(...msg.args))
+                .then(
+                    (value) => ctx.send({ kind: "resolve", id: msg.id, value: value === undefined ? null : value }),
+                    (error) => ctx.send({ kind: "reject", id: msg.id, error: marshalError(error) }),
+                );
+            return true;
+        }
+
+        case "send": {
+            const r = resolve(ctx, msg.service, msg.path, msg.args);
+            if ("error" in r) {
+                ctx.onError(reconstructError(r.error));
+                return true;
+            }
+            // A void member's throw has no wire channel — surface it via onError.
+            try {
+                (r.target as (...args: Data[]) => void)(...msg.args);
+            } catch (error) {
+                ctx.onError(error);
+            }
+            return true;
+        }
+
+        case "subscribe": {
+            const r = resolve(ctx, msg.service, msg.path, msg.args);
+            if ("error" in r) {
+                // An observe has no error channel — surface the refusal via onError.
+                ctx.onError(reconstructError(r.error));
+                return true;
+            }
+            const observe: Observe<Data> =
+                r.memberSchema.type === "observe"
+                    ? (r.target as Observe<Data>)
+                    : (r.target as (...args: Data[]) => Observe<Data>)(...msg.args);
+            const unobserve = observe((value) => ctx.send({ kind: "next", id: msg.id, value }));
+            ctx.hostSubs.set(msg.id, unobserve);
+            return true;
+        }
+
+        case "unsubscribe": {
+            ctx.hostSubs.get(msg.id)?.();
+            ctx.hostSubs.delete(msg.id);
+            return true;
+        }
+
+        case "iterate": {
+            const r = resolve(ctx, msg.service, msg.path, msg.args);
+            if ("error" in r) {
+                ctx.send({ kind: "throw", id: msg.id, error: r.error });
+                return true;
+            }
+            const gen = (r.target as (...args: Data[]) => AsyncGenerator<Data>)(...msg.args);
+            ctx.hostGens.set(msg.id, gen);
+            return true;
+        }
+
+        case "pull": {
+            const gen = ctx.hostGens.get(msg.id);
+            if (gen === undefined) return true; // already returned / never iterated
+            gen.next().then(
+                (result) => {
+                    if (result.done) {
+                        ctx.hostGens.delete(msg.id);
+                        ctx.send({ kind: "done", id: msg.id, value: result.value ?? undefined });
+                    } else {
+                        ctx.send({ kind: "yield", id: msg.id, value: result.value });
+                    }
+                },
+                (error) => {
+                    ctx.hostGens.delete(msg.id);
+                    ctx.send({ kind: "throw", id: msg.id, error: marshalError(error) });
+                },
+            );
+            return true;
+        }
+
+        case "return": {
+            const gen = ctx.hostGens.get(msg.id);
+            ctx.hostGens.delete(msg.id);
+            void gen?.return(undefined).catch((error) => ctx.onError(error));
+            return true;
+        }
+
+        case "raise": {
+            const gen = ctx.hostGens.get(msg.id);
+            ctx.hostGens.delete(msg.id);
+            void gen?.throw(reconstructError(msg.error)).catch(() => {
+                // The injected error propagating back out is expected; swallow it.
+            });
+            return true;
+        }
+
+        default:
+            return false;
+    }
+}
diff --git a/packages/data-rpc/src/id.ts b/packages/data-rpc/src/id.ts
new file mode 100644
index 00000000..d974648f
--- /dev/null
+++ b/packages/data-rpc/src/id.ts
@@ -0,0 +1,12 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+/**
+ * Creates a per-endpoint monotonic id allocator. Ids identify in-flight calls,
+ * subscriptions, and generators originated by THIS endpoint; they need only be
+ * unique per-originator (see the caller/host table split in `create-endpoint`),
+ * so a simple local counter suffices.
+ */
+export function createIdAllocator(): () => number {
+    let next = 1;
+    return () => next++;
+}
diff --git a/packages/data-rpc/src/index.ts b/packages/data-rpc/src/index.ts
new file mode 100644
index 00000000..c2e2f7fa
--- /dev/null
+++ b/packages/data-rpc/src/index.ts
@@ -0,0 +1,9 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+export { RPC_PROTOCOL_VERSION, type RpcMessage, type RpcError, type RpcRequestKind, type RpcResponseKind } from "./protocol.js";
+export { type RpcTransport } from "./transport.js";
+export { type RpcEndpoint, type RpcEndpointOptions } from "./endpoint.js";
+export { createRpcEndpoint } from "./create-endpoint.js";
+export { createRpcLoopbackTransport } from "./transports/loopback-transport.js";
+export { createMessagePortTransport } from "./transports/message-port-transport.js";
+export { createWindowTransport, type WindowTransportOptions } from "./transports/window-transport.js";
diff --git a/packages/data-rpc/src/nested.test.ts b/packages/data-rpc/src/nested.test.ts
new file mode 100644
index 00000000..94922783
--- /dev/null
+++ b/packages/data-rpc/src/nested.test.ts
@@ -0,0 +1,160 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import { describe, it, expect } from "vitest";
+import { Observe } from "@adobe/data/observe";
+import type { Schema } from "@adobe/data/schema";
+import { AsyncDataService, type Service } from "@adobe/data/service";
+import type { Assert } from "@adobe/data/types";
+import { createRpcEndpoint } from "./create-endpoint.js";
+import { createRpcLoopbackTransport } from "./transports/loopback-transport.js";
+import { createMessagePortTransport } from "./transports/message-port-transport.js";
+
+// A service with a NESTED sub-service (`child`), itself described by a child
+// object schema whose properties are ordinary observe/promise/generator/void
+// members — and a doubly-nested `child.deep` to prove arbitrary depth.
+interface ParentService extends Service {
+    root: Observe<number>;
+    child: {
+        value: Observe<number>;
+        add: (a: number, b: number) => Promise<number>;
+        stream: (to: number) => AsyncGenerator<number>;
+        bump: () => void;
+        deep: {
+            greet: (name: string) => Promise<string>;
+        };
+    };
+}
+
+namespace ParentService {
+    export const schema = {
+        type: "object",
+        properties: {
+            root: { type: "observe", value: { type: "number" } },
+            child: {
+                type: "object",
+                properties: {
+                    value: { type: "observe", value: { type: "number" } },
+                    add: { type: "function", signature: { parameters: [{ type: "number" }, { type: "number" }], returns: { type: "promise", value: { type: "number" } } } },
+                    stream: { type: "function", signature: { parameters: [{ type: "number" }], returns: { type: "generator", value: { type: "number" } } } },
+                    bump: { type: "function" },
+                    deep: {
+                        type: "object",
+                        properties: {
+                            greet: { type: "function", signature: { parameters: [{ type: "string" }], returns: { type: "promise", value: { type: "string" } } } },
+                        },
+                        required: ["greet"],
+                        additionalProperties: false,
+                    },
+                },
+                required: ["value", "add", "stream", "bump", "deep"],
+                additionalProperties: false,
+            },
+        },
+        required: ["root", "child"],
+        additionalProperties: false,
+    } as const satisfies Schema;
+}
+
+// A nested service passes both gates: it is a valid AsyncDataService (nested
+// organizational objects are allowed) and its schema describes it exactly.
+type _Valid = Assert<AsyncDataService.IsValid<ParentService>>;
+type _Complete = Assert<AsyncDataService.IsValidWithCompleteSchema<ParentService, typeof ParentService.schema>>;
+
+function makeParent(seed: number) {
+    const [root] = Observe.createState(seed);
+    const [value, setValue] = Observe.createState(seed * 10);
+    let current = seed * 10;
+    const stats = { streamFinally: 0 };
+
+    const service: ParentService = {
+        serviceName: `parent-${seed}`,
+        schema: Observe.fromConstant(ParentService.schema),
+        root,
+        child: {
+            value,
+            add: async (a, b) => a + b,
+            stream: async function* (to) {
+                try { for (let i = 1; i <= to; i++) yield i; }
+                finally { stats.streamFinally++; }
+            },
+            bump: () => setValue((current += 1)),
+            deep: {
+                greet: async (name) => `hello ${name}`,
+            },
+        },
+    };
+    return { service, stats };
+}
+
+const flush = async (times = 8) => {
+    for (let i = 0; i < times; i++) await new Promise((r) => setTimeout(r, 0));
+};
+
+describe("nested services", () => {
+    it("shims nested members on both sides and round-trips every kind", async () => {
+        const { a, b } = createRpcLoopbackTransport();
+        const ea = createRpcEndpoint(a);
+        const eb = createRpcEndpoint(b);
+        const host = makeParent(3);
+        ea.expose("parent", host.service, ParentService.schema);
+        const parent = eb.consume("parent", ParentService.schema);
+
+        // nested promise + doubly-nested promise
+        expect(await parent.child.add(2, 3)).toBe(5);
+        expect(await parent.child.deep.greet("world")).toBe("hello world");
+
+        // nested generator
+        const out: number[] = [];
+        for await (const n of parent.child.stream(3)) out.push(n);
+        expect(out).toEqual([1, 2, 3]);
+        expect(host.stats.streamFinally).toBe(1);
+
+        // nested observe + nested void mutation
+        const seen: number[] = [];
+        const un = parent.child.value((v) => seen.push(v));
+        await flush();
+        expect(seen).toEqual([30]); // seed*10
+        parent.child.bump();
+        await flush();
+        expect(seen).toEqual([30, 31]);
+        un();
+
+        // top-level observe still works alongside the nested tree
+        let rootSeen: number | undefined;
+        const un2 = parent.root((v) => { rootSeen = v; });
+        await flush();
+        expect(rootSeen).toBe(3);
+        un2();
+
+        ea.close();
+        eb.close();
+    });
+
+    it("rejects a nested call with invalid arguments (path-addressed validation)", async () => {
+        const { a, b } = createRpcLoopbackTransport();
+        const ea = createRpcEndpoint(a);
+        const eb = createRpcEndpoint(b);
+        ea.expose("parent", makeParent(1).service, ParentService.schema);
+        const parent = eb.consume("parent", ParentService.schema);
+
+        const untyped = parent as unknown as { child: { add: (...args: unknown[]) => Promise<number> } };
+        await expect(untyped.child.add("nope", 2)).rejects.toThrowError(/invalid arguments.*parent\.child\.add/);
+
+        ea.close();
+        eb.close();
+    });
+
+    it("addresses nested members over a real MessageChannel (the iframe transport)", async () => {
+        const { port1, port2 } = new MessageChannel();
+        const ea = createRpcEndpoint(createMessagePortTransport(port1));
+        const eb = createRpcEndpoint(createMessagePortTransport(port2));
+        ea.expose("parent", makeParent(2).service, ParentService.schema);
+        const parent = eb.consume("parent", ParentService.schema);
+
+        expect(await parent.child.deep.greet("port")).toBe("hello port");
+        expect(await parent.child.add(20, 22)).toBe(42);
+
+        ea.close();
+        eb.close();
+    });
+});
diff --git a/packages/data-rpc/src/protocol.ts b/packages/data-rpc/src/protocol.ts
new file mode 100644
index 00000000..788a049e
--- /dev/null
+++ b/packages/data-rpc/src/protocol.ts
@@ -0,0 +1,82 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import type { Data } from "@adobe/data";
+import type { Schema } from "@adobe/data/schema";
+
+/**
+ * The wire protocol for `@adobe/data-rpc`.
+ *
+ * Every payload that crosses the boundary is `Data` (JSON + Set/Map/Blob) — never
+ * an `Observe`, `Promise`, `AsyncGenerator`, or function. The far side synthesizes
+ * equivalent-shaped members locally; only their `Data` values travel. A service
+ * gated on `AsyncDataService.IsValid` provably contains nothing else to marshal.
+ *
+ * The channel is symmetric: both endpoints originate requests. Direction is
+ * implicit in the message `kind` — the request and response kind sets are
+ * disjoint — so an `id` need only be unique per-originator. Each endpoint keeps
+ * SEPARATE caller-side and host-side pending tables; the same numeric id may be
+ * live in both directions at once with no cross-talk.
+ */
+
+/** Bumped when the wire shape changes incompatibly; peers exchange it in the handshake. */
+export const RPC_PROTOCOL_VERSION = 1;
+
+/**
+ * Serialized form of a thrown value. We never structured-clone the thrown value
+ * itself (that drops the subclass prototype and non-standard props); the host
+ * captures these three fields and the caller reconstructs a plain `Error`.
+ */
+export interface RpcError {
+    readonly name: string;
+    readonly message: string;
+    readonly stack?: string;
+}
+
+/** REQUEST kinds — always sent by the calling side toward the hosting side. */
+export type RpcRequestKind =
+    | "hello" | "get-schema"
+    | "call" | "send"
+    | "subscribe" | "unsubscribe"
+    | "iterate" | "pull" | "return" | "raise";
+
+/** RESPONSE / announcement kinds — always sent by the hosting side toward the caller. */
+export type RpcResponseKind =
+    | "welcome" | "available" | "unavailable" | "schema"
+    | "resolve" | "reject"
+    | "next"
+    | "yield" | "done" | "throw";
+
+export type RpcMessage =
+    // ---- handshake (both sides send `hello`, reply `welcome`) ----
+    | { readonly kind: "hello"; readonly protocol: number }
+    | { readonly kind: "welcome"; readonly protocol: number }
+
+    // ---- exposure announcements (host → caller) ----
+    | { readonly kind: "available"; readonly service: string; readonly schema: Schema }
+    | { readonly kind: "unavailable"; readonly service: string }
+
+    // ---- schema fetch (runtime `consume(name)`) ----
+    | { readonly kind: "get-schema"; readonly id: number; readonly service: string }
+    | { readonly kind: "schema"; readonly id: number; readonly service: string; readonly schema: Schema | null }
+
+    // ---- promise call ----
+    | { readonly kind: "call"; readonly id: number; readonly service: string; readonly path: readonly string[]; readonly args: readonly Data[]; readonly deadline?: number }
+    | { readonly kind: "resolve"; readonly id: number; readonly value: Data }
+    | { readonly kind: "reject"; readonly id: number; readonly error: RpcError }
+
+    // ---- void fire-and-forget ----
+    | { readonly kind: "send"; readonly id: number; readonly service: string; readonly path: readonly string[]; readonly args: readonly Data[] }
+
+    // ---- observe subscription ----
+    | { readonly kind: "subscribe"; readonly id: number; readonly service: string; readonly path: readonly string[]; readonly args: readonly Data[] }
+    | { readonly kind: "next"; readonly id: number; readonly value: Data }
+    | { readonly kind: "unsubscribe"; readonly id: number }
+
+    // ---- pull-based async generator (strict lockstep: one `pull` ⇒ one `yield`/`done`/`throw`) ----
+    | { readonly kind: "iterate"; readonly id: number; readonly service: string; readonly path: readonly string[]; readonly args: readonly Data[] }
+    | { readonly kind: "pull"; readonly id: number }
+    | { readonly kind: "yield"; readonly id: number; readonly value: Data }
+    | { readonly kind: "done"; readonly id: number; readonly value?: Data }
+    | { readonly kind: "throw"; readonly id: number; readonly error: RpcError }
+    | { readonly kind: "return"; readonly id: number }
+    | { readonly kind: "raise"; readonly id: number; readonly error: RpcError };
diff --git a/packages/data-rpc/src/rpc.test.ts b/packages/data-rpc/src/rpc.test.ts
new file mode 100644
index 00000000..c042c51a
--- /dev/null
+++ b/packages/data-rpc/src/rpc.test.ts
@@ -0,0 +1,288 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import { describe, it, expect, vi } from "vitest";
+import { Observe } from "@adobe/data/observe";
+import type { Schema } from "@adobe/data/schema";
+import { AsyncDataService, type Service } from "@adobe/data/service";
+import type { Assert } from "@adobe/data/types";
+import { createRpcEndpoint } from "./create-endpoint.js";
+import type { RpcEndpointOptions } from "./endpoint.js";
+import { createRpcLoopbackTransport } from "./transports/loopback-transport.js";
+
+// ---------------------------------------------------------------------------
+// A demo service exercising every member kind (observe / fn:observe / promise /
+// generator / void) plus failure paths (rejecting promise, throwing generator,
+// throwing void). Exposed by BOTH endpoints so every kind runs in both directions.
+// ---------------------------------------------------------------------------
+
+interface DemoService extends Service {
+    value: Observe<number>;
+    tracked: Observe<number>;
+    selectDouble: (n: number) => Observe<number>;
+    add: (a: number, b: number) => Promise<number>;
+    fail: (message: string) => Promise<number>;
+    countUp: (to: number) => AsyncGenerator<number>;
+    explode: (to: number) => AsyncGenerator<number>;
+    bump: () => void;
+    boom: () => void;
+}
+
+namespace DemoService {
+    export const schema = {
+        type: "object",
+        properties: {
+            value: { type: "observe", value: { type: "number" } },
+            tracked: { type: "observe", value: { type: "number" } },
+            selectDouble: { type: "function", signature: { parameters: [{ type: "number" }], returns: { type: "observe", value: { type: "number" } } } },
+            add: { type: "function", signature: { parameters: [{ type: "number" }, { type: "number" }], returns: { type: "promise", value: { type: "number" } } } },
+            fail: { type: "function", signature: { parameters: [{ type: "string" }], returns: { type: "promise", value: { type: "number" } } } },
+            countUp: { type: "function", signature: { parameters: [{ type: "number" }], returns: { type: "generator", value: { type: "number" } } } },
+            explode: { type: "function", signature: { parameters: [{ type: "number" }], returns: { type: "generator", value: { type: "number" } } } },
+            bump: { type: "function" },
+            boom: { type: "function" },
+        },
+        required: ["value", "tracked", "selectDouble", "add", "fail", "countUp", "explode", "bump", "boom"],
+        additionalProperties: false,
+    } as const satisfies Schema;
+}
+
+// Compile-time proof: DemoService is a valid AsyncDataService fully described by its schema.
+type _ValidDemo = Assert<AsyncDataService.IsValid<DemoService>>;
+type _CompleteDemo = Assert<AsyncDataService.IsValidWithCompleteSchema<DemoService, typeof DemoService.schema>>;
+
+function makeDemo(seed: number) {
+    const [value, setValue] = Observe.createState(seed);
+    let current = seed;
+    let activeObservers = 0;
+    const stats = { countUpFinally: 0, explodeFinally: 0, get activeObservers() { return activeObservers; } };
+
+    // A hand-written observe so we can prove the host unsubscribes on unsubscribe/close.
+    const tracked: Observe<number> = (notify) => {
+        activeObservers++;
+        notify(seed);
+        return () => { activeObservers--; };
+    };
+
+    const service: DemoService = {
+        serviceName: `demo-${seed}`,
+        schema: Observe.fromConstant(DemoService.schema),
+        value,
+        tracked,
+        selectDouble: (n) => Observe.fromConstant(n * 2),
+        add: async (a, b) => a + b,
+        fail: async (message) => { throw new Error(message); },
+        countUp: async function* (to) {
+            try { for (let i = 1; i <= to; i++) yield i; }
+            finally { stats.countUpFinally++; }
+        },
+        explode: async function* (to) {
+            try { for (let i = 1; i <= to; i++) yield i; throw new Error("explode"); }
+            finally { stats.explodeFinally++; }
+        },
+        bump: () => { current += 1; setValue(current); },
+        boom: () => { throw new Error("boom"); },
+    };
+    return { service, stats };
+}
+
+const flush = async (times = 8) => {
+    for (let i = 0; i < times; i++) await new Promise((r) => setTimeout(r, 0));
+};
+
+function setup(opts?: { a?: RpcEndpointOptions; b?: RpcEndpointOptions }) {
+    const { a, b } = createRpcLoopbackTransport();
+    const demoA = makeDemo(10);
+    const demoB = makeDemo(20);
+    const ea = createRpcEndpoint(a, opts?.a);
+    const eb = createRpcEndpoint(b, opts?.b);
+    const unExposeA = ea.expose("A", demoA.service, DemoService.schema);
+    const unExposeB = eb.expose("B", demoB.service, DemoService.schema);
+    const aToB = ea.consume("B", DemoService.schema); // A consumes B's service
+    const bToA = eb.consume("A", DemoService.schema); // B consumes A's service
+    return { ea, eb, demoA, demoB, aToB, bToA, unExposeA, unExposeB };
+}
+
+describe("promise members (both directions)", () => {
+    it("resolves across the wire in both directions", async () => {
+        const { aToB, bToA } = setup();
+        expect(await aToB.add(2, 3)).toBe(5);
+        expect(await bToA.add(10, 1)).toBe(11);
+    });
+
+    it("propagates a rejection with reconstructed name/message", async () => {
+        const { aToB } = setup();
+        await expect(aToB.fail("kaboom")).rejects.toThrowError("kaboom");
+    });
+
+    it("keeps ids independent per originator (bidirectional, both id=1)", async () => {
+        const { aToB, bToA } = setup();
+        const [r1, r2] = await Promise.all([aToB.add(1, 2), bToA.add(3, 4)]);
+        expect(r1).toBe(3);
+        expect(r2).toBe(7);
+    });
+});
+
+describe("observe members (both directions)", () => {
+    it("streams the initial value asynchronously and reacts to a void mutation", async () => {
+        const { aToB, demoB } = setup();
+        const seen: number[] = [];
+        const un = aToB.value((v) => seen.push(v));
+        // First value is a round-trip → NOT synchronous (unlike a local Observe).
+        expect(seen).toEqual([]);
+        await flush();
+        expect(seen).toEqual([20]);
+        aToB.bump(); // void member, other direction of the same channel
+        await flush();
+        expect(seen).toEqual([20, 21]);
+        expect(demoB.stats.activeObservers).toBe(0); // value uses createState, tracked is separate
+        un();
+    });
+
+    it("fn:observe forwards args and streams the derived value", async () => {
+        const { bToA } = setup();
+        const seen: number[] = [];
+        const un = bToA.selectDouble(21)((v) => seen.push(v));
+        await flush();
+        expect(seen).toEqual([42]);
+        un();
+    });
+
+    it("drops an in-flight next after unsubscribe", async () => {
+        const { aToB } = setup();
+        const seen: number[] = [];
+        const un = aToB.value((v) => seen.push(v));
+        un(); // unsubscribe before the first (async) next can arrive
+        await flush();
+        expect(seen).toEqual([]);
+    });
+
+    it("releases the host subscription on unsubscribe", async () => {
+        const { aToB, demoB } = setup();
+        const un = aToB.tracked(() => undefined);
+        await flush();
+        expect(demoB.stats.activeObservers).toBe(1);
+        un();
+        await flush();
+        expect(demoB.stats.activeObservers).toBe(0);
+    });
+});
+
+describe("generator members (both directions)", () => {
+    it("streams pull-based values in both directions", async () => {
+        const { aToB, bToA } = setup();
+        const collect = async (gen: AsyncGenerator<number>) => {
+            const out: number[] = [];
+            for await (const n of gen) out.push(n);
+            return out;
+        };
+        expect(await collect(aToB.countUp(3))).toEqual([1, 2, 3]);
+        expect(await collect(bToA.countUp(2))).toEqual([1, 2]);
+    });
+
+    it("propagates a generator throw to the consumer", async () => {
+        const { aToB } = setup();
+        const gen = aToB.explode(2);
+        expect((await gen.next()).value).toBe(1);
+        expect((await gen.next()).value).toBe(2);
+        await expect(gen.next()).rejects.toThrowError("explode");
+    });
+
+    it("runs host finally on early return / dispose", async () => {
+        const { aToB, demoB } = setup();
+        const gen = aToB.countUp(100);
+        expect((await gen.next()).value).toBe(1);
+        await gen.return(undefined);
+        await flush();
+        expect(demoB.stats.countUpFinally).toBe(1);
+        expect((await gen.next()).done).toBe(true);
+    });
+});
+
+describe("void members", () => {
+    it("routes a host-handler throw to onError (no wire reply)", async () => {
+        const onError = vi.fn();
+        const { aToB } = setup({ b: { onError } });
+        aToB.boom();
+        await flush();
+        expect(onError).toHaveBeenCalledOnce();
+        expect((onError.mock.calls[0][0] as Error).message).toBe("boom");
+    });
+});
+
+describe("schema discovery", () => {
+    it("consumes with a runtime-fetched schema (after expose)", async () => {
+        const { eb } = setup();
+        const svc = (await eb.consume("A")) as DemoService;
+        expect(await svc.add(4, 5)).toBe(9);
+    });
+
+    it("supports consume-before-expose ordering", async () => {
+        const { a, b } = createRpcLoopbackTransport();
+        const ea = createRpcEndpoint(a);
+        const eb = createRpcEndpoint(b);
+        const pending = eb.consume("late"); // not yet exposed
+        const demo = makeDemo(7);
+        ea.expose("late", demo.service, DemoService.schema);
+        const svc = (await pending) as DemoService;
+        expect(await svc.add(1, 1)).toBe(2);
+    });
+
+    it("republishes the schema on the projected service's observable slot", async () => {
+        const { aToB } = setup();
+        let seen: Schema | undefined;
+        aToB.schema?.((s) => { seen = s; });
+        expect(seen).toEqual(DemoService.schema);
+    });
+});
+
+describe("trust boundary", () => {
+    it("rejects a call denied by canInvoke", async () => {
+        const { aToB } = setup({ b: { canInvoke: (_svc, member) => member !== "add" } });
+        await expect(aToB.add(1, 2)).rejects.toThrowError(/not permitted/);
+    });
+
+    it("rejects a call with invalid Data arguments (never invokes the member)", async () => {
+        const { aToB, demoB } = setup();
+        const invoke = vi.spyOn(demoB.service, "add");
+        // Untyped path: send a string where the schema requires a number.
+        const untyped = aToB as unknown as { add: (...args: unknown[]) => Promise<number> };
+        await expect(untyped.add("x", "y")).rejects.toThrowError(/invalid arguments/);
+        expect(invoke).not.toHaveBeenCalled();
+    });
+});
+
+describe("teardown", () => {
+    it("rejects a pending call when the endpoint closes mid-flight", async () => {
+        const { ea, aToB } = setup();
+        const pending = aToB.add(1, 2); // registered synchronously
+        ea.close(); // before any reply can arrive
+        await expect(pending).rejects.toThrowError(/closed/);
+    });
+
+    it("releases host subscriptions when the channel closes", async () => {
+        const { ea, aToB, demoB } = setup();
+        aToB.tracked(() => undefined);
+        await flush();
+        expect(demoB.stats.activeObservers).toBe(1);
+        ea.close();
+        await flush();
+        expect(demoB.stats.activeObservers).toBe(0);
+    });
+
+    it("runs host generator finally when the channel closes mid-stream", async () => {
+        const { ea, aToB, demoB } = setup();
+        const gen = aToB.countUp(100);
+        expect((await gen.next()).value).toBe(1);
+        ea.close();
+        await flush();
+        expect(demoB.stats.countUpFinally).toBe(1);
+    });
+
+    it("ends a consumed generator gracefully after close", async () => {
+        const { ea, aToB } = setup();
+        const gen = aToB.countUp(100);
+        expect((await gen.next()).value).toBe(1);
+        ea.close();
+        expect((await gen.next()).done).toBe(true);
+    });
+});
diff --git a/packages/data-rpc/src/transport.ts b/packages/data-rpc/src/transport.ts
new file mode 100644
index 00000000..1230b2dc
--- /dev/null
+++ b/packages/data-rpc/src/transport.ts
@@ -0,0 +1,35 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import type { RpcMessage } from "./protocol.js";
+
+/**
+ * Runtime-agnostic, bidirectional message channel carrying {@link RpcMessage}s.
+ *
+ * Mirrors the `@adobe/data-sync` `SyncTransport` shape (send / onMessage /
+ * onClose / close). RPC is symmetric, so `Send` and `Receive` default to the
+ * same `RpcMessage` union. Implementations are provided for a `MessagePort`
+ * (the primary iframe/worker transport), a `Window` (the initial port handoff),
+ * and an in-process loopback pair (tests / demos).
+ *
+ * The transport does not own serialization — callers pass structured objects and
+ * the underlying channel structured-clones them. Ordering of `send` calls is
+ * preserved and delivery is assumed reliable.
+ */
+export interface RpcTransport<Send = RpcMessage, Receive = RpcMessage> {
+    /**
+     * Send a message to the remote end. `transfer` optionally lists
+     * `Transferable`s handed off zero-copy (e.g. an `ArrayBuffer`); transports
+     * over channels without transfer semantics ignore it.
+     */
+    readonly send: (msg: Send, transfer?: readonly Transferable[]) => void;
+    /** Register a listener for messages from the remote end. Returns an unsubscribe. */
+    readonly onMessage: (listener: (msg: Receive) => void) => () => void;
+    /**
+     * Register a listener that fires once when the channel closes — local
+     * `close()`, remote close, or drop. Returns an unsubscribe. Firing is
+     * idempotent (at most once).
+     */
+    readonly onClose: (listener: () => void) => () => void;
+    /** Tear down the channel. */
+    readonly close: () => void;
+}
diff --git a/packages/data-rpc/src/transports/loopback-transport.test.ts b/packages/data-rpc/src/transports/loopback-transport.test.ts
new file mode 100644
index 00000000..273a896f
--- /dev/null
+++ b/packages/data-rpc/src/transports/loopback-transport.test.ts
@@ -0,0 +1,48 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import { describe, it, expect, vi } from "vitest";
+import type { RpcMessage } from "../protocol.js";
+import { createRpcLoopbackTransport } from "./loopback-transport.js";
+
+const msg = (protocol: number): RpcMessage => ({ kind: "hello", protocol });
+
+describe("createRpcLoopbackTransport", () => {
+    it("delivers asynchronously (never synchronously with send)", async () => {
+        const { a, b } = createRpcLoopbackTransport();
+        const received: RpcMessage[] = [];
+        b.onMessage((m) => received.push(m));
+        a.send(msg(1));
+        expect(received).toEqual([]); // not yet — delivery is scheduled
+        await new Promise((r) => setTimeout(r, 0));
+        expect(received).toEqual([msg(1)]);
+    });
+
+    it("buffers messages sent before a listener registers, in order", async () => {
+        const { a, b } = createRpcLoopbackTransport();
+        a.send(msg(1));
+        a.send(msg(2));
+        const received: RpcMessage[] = [];
+        b.onMessage((m) => received.push(m));
+        await new Promise((r) => setTimeout(r, 0));
+        expect(received).toEqual([msg(1), msg(2)]);
+    });
+
+    it("fires every onClose listener once when either side closes", async () => {
+        const { a, b } = createRpcLoopbackTransport();
+        const onCloseA = vi.fn();
+        const onCloseB = vi.fn();
+        a.onClose(onCloseA);
+        b.onClose(onCloseB);
+        b.close();
+        expect(onCloseA).toHaveBeenCalledOnce();
+        expect(onCloseB).toHaveBeenCalledOnce();
+        a.close(); // idempotent — no second fire
+        expect(onCloseA).toHaveBeenCalledOnce();
+    });
+
+    it("throws on a non-cloneable payload, like a real port", () => {
+        const { a } = createRpcLoopbackTransport();
+        // A function is not structured-cloneable; sending one must throw here too.
+        expect(() => a.send({ kind: "next", id: 1, value: (() => 0) as never })).toThrow();
+    });
+});
diff --git a/packages/data-rpc/src/transports/loopback-transport.ts b/packages/data-rpc/src/transports/loopback-transport.ts
new file mode 100644
index 00000000..3f380550
--- /dev/null
+++ b/packages/data-rpc/src/transports/loopback-transport.ts
@@ -0,0 +1,106 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import type { RpcMessage } from "../protocol.js";
+import type { RpcTransport } from "../transport.js";
+
+type Listener = (msg: RpcMessage) => void;
+
+/**
+ * One directed, buffered, asynchronous pipe. Delivery is scheduled on a
+ * microtask (never synchronous with `send`) to model a real `MessagePort`,
+ * where the first value of a subscription necessarily arrives after the
+ * subscribe call returns. Messages sent before a listener registers are
+ * buffered and flushed once one does. FIFO order is preserved.
+ */
+function createDirectedPipe() {
+    const listeners = new Set<Listener>();
+    const pending: RpcMessage[] = [];
+    let flushScheduled = false;
+    let closed = false;
+
+    const drain = () => {
+        flushScheduled = false;
+        if (closed) return;
+        while (pending.length > 0 && listeners.size > 0) {
+            const msg = pending.shift()!;
+            for (const l of listeners) l(msg);
+        }
+    };
+    const schedule = () => {
+        if (flushScheduled || closed) return;
+        flushScheduled = true;
+        queueMicrotask(drain);
+    };
+
+    return {
+        push(msg: RpcMessage) {
+            if (closed) return;
+            pending.push(msg);
+            schedule();
+        },
+        onMessage(listener: Listener) {
+            listeners.add(listener);
+            if (pending.length > 0) schedule();
+            return () => listeners.delete(listener);
+        },
+        close() {
+            closed = true;
+            pending.length = 0;
+            listeners.clear();
+        },
+    };
+}
+
+/**
+ * A paired in-process loopback transport for tests and single-process demos.
+ * Messages sent on `a` are delivered asynchronously to `b`'s listeners and
+ * vice-versa. Each message is `structuredClone`d on `send`, exactly as a
+ * `MessagePort` would — so a non-cloneable payload throws here too, and no
+ * live references leak across the (simulated) boundary. Closing either side
+ * tears down the whole channel and fires every `onClose` listener once.
+ */
+export function createRpcLoopbackTransport(): { a: RpcTransport; b: RpcTransport } {
+    const aToB = createDirectedPipe(); // a.send → b.onMessage
+    const bToA = createDirectedPipe(); // b.send → a.onMessage
+
+    let closed = false;
+    const closeA = new Set<() => void>();
+    const closeB = new Set<() => void>();
+
+    const doClose = () => {
+        if (closed) return;
+        closed = true;
+        aToB.close();
+        bToA.close();
+        for (const l of closeA) l();
+        for (const l of closeB) l();
+        closeA.clear();
+        closeB.clear();
+    };
+
+    const makeSide = (
+        out: ReturnType<typeof createDirectedPipe>,
+        inbound: ReturnType<typeof createDirectedPipe>,
+        closeListeners: Set<() => void>,
+    ): RpcTransport => ({
+        send(msg) {
+            if (closed) return;
+            // Clone on send to model the structured-clone boundary of a real port.
+            out.push(structuredClone(msg));
+        },
+        onMessage(listener) {
+            return inbound.onMessage(listener);
+        },
+        onClose(listener) {
+            if (closed) { listener(); return () => undefined; }
+            closeListeners.add(listener);
+            return () => closeListeners.delete(listener);
+        },
+        close: doClose,
+    });
+
+    return {
+        a: makeSide(aToB, bToA, closeA),
+        b: makeSide(bToA, aToB, closeB),
+    };
+}
diff --git a/packages/data-rpc/src/transports/message-port-transport.test.ts b/packages/data-rpc/src/transports/message-port-transport.test.ts
new file mode 100644
index 00000000..c098842f
--- /dev/null
+++ b/packages/data-rpc/src/transports/message-port-transport.test.ts
@@ -0,0 +1,63 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import { describe, it, expect } from "vitest";
+import { Observe } from "@adobe/data/observe";
+import type { Schema } from "@adobe/data/schema";
+import { type Service } from "@adobe/data/service";
+import { createRpcEndpoint } from "../create-endpoint.js";
+import type { RpcMessage } from "../protocol.js";
+import { createMessagePortTransport } from "./message-port-transport.js";
+
+interface Calc extends Service {
+    value: Observe<number>;
+    add: (a: number, b: number) => Promise<number>;
+}
+const calcSchema = {
+    type: "object",
+    properties: {
+        value: { type: "observe", value: { type: "number" } },
+        add: { type: "function", signature: { parameters: [{ type: "number" }, { type: "number" }], returns: { type: "promise", value: { type: "number" } } } },
+    },
+    required: ["value", "add"],
+    additionalProperties: false,
+} as const satisfies Schema;
+
+function makeCalc(): Calc {
+    return {
+        serviceName: "calc",
+        schema: Observe.fromConstant(calcSchema),
+        value: Observe.fromConstant(1),
+        add: async (a: number, b: number) => a + b,
+    };
+}
+
+describe("createMessagePortTransport", () => {
+    it("carries a full RPC round-trip over a MessageChannel", async () => {
+        const { port1, port2 } = new MessageChannel();
+        const ea = createRpcEndpoint(createMessagePortTransport(port1));
+        const eb = createRpcEndpoint(createMessagePortTransport(port2));
+        ea.expose("calc", makeCalc(), calcSchema);
+        const remote = eb.consume("calc", calcSchema);
+        expect(await remote.add(2, 40)).toBe(42);
+        ea.close();
+        eb.close();
+    });
+
+    it("buffers messages that arrive before a listener registers, then flushes them", async () => {
+        const { port1, port2 } = new MessageChannel();
+        // Send on port1 before wrapping port2 with a transport/listener.
+        port1.postMessage({ kind: "hello", protocol: 1 } satisfies RpcMessage);
+
+        const transport = createMessagePortTransport(port2);
+        // Give the port a tick to receive-and-buffer the pre-listener message.
+        await new Promise((r) => setTimeout(r, 0));
+
+        const received: RpcMessage[] = [];
+        transport.onMessage((m) => received.push(m));
+        await new Promise((r) => setTimeout(r, 0));
+
+        expect(received).toEqual([{ kind: "hello", protocol: 1 }]);
+        transport.close();
+        port1.close();
+    });
+});
diff --git a/packages/data-rpc/src/transports/message-port-transport.ts b/packages/data-rpc/src/transports/message-port-transport.ts
new file mode 100644
index 00000000..f5119bd4
--- /dev/null
+++ b/packages/data-rpc/src/transports/message-port-transport.ts
@@ -0,0 +1,63 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import type { RpcMessage } from "../protocol.js";
+import type { RpcTransport } from "../transport.js";
+
+/**
+ * The primary iframe/worker transport: an {@link RpcTransport} over a
+ * `MessagePort`. Assigning `onmessage` implicitly starts the port; we also call
+ * `start()` explicitly so the transport is robust if the caller later switches
+ * to `addEventListener`. Messages arriving before a listener registers are
+ * buffered and flushed on the first `onMessage`, mirroring the loopback and
+ * matching the fact that the port begins delivering as soon as it is wired.
+ *
+ * A `MessagePort` has no native "remote closed" event, so `onClose` fires only
+ * on a local `close()`; a peer going away is surfaced instead via the
+ * `unavailable` announcement (or a per-call timeout).
+ */
+export function createMessagePortTransport(port: MessagePort): RpcTransport {
+    const listeners = new Set<(msg: RpcMessage) => void>();
+    const closeListeners = new Set<() => void>();
+    const pending: RpcMessage[] = [];
+    let closed = false;
+
+    port.onmessage = (event: MessageEvent) => {
+        // Invariant: only RpcMessages are posted on a data-rpc port.
+        const msg = event.data as RpcMessage;
+        if (listeners.size === 0) {
+            pending.push(msg);
+            return;
+        }
+        for (const l of listeners) l(msg);
+    };
+    port.start();
+
+    return {
+        send(msg, transfer) {
+            if (closed) return;
+            port.postMessage(msg, transfer ? [...transfer] : []);
+        },
+        onMessage(listener) {
+            listeners.add(listener);
+            for (const msg of pending.splice(0)) listener(msg);
+            return () => listeners.delete(listener);
+        },
+        onClose(listener) {
+            if (closed) {
+                listener();
+                return () => undefined;
+            }
+            closeListeners.add(listener);
+            return () => closeListeners.delete(listener);
+        },
+        close() {
+            if (closed) return;
+            closed = true;
+            port.onmessage = null;
+            port.close();
+            for (const l of closeListeners) l();
+            closeListeners.clear();
+            listeners.clear();
+        },
+    };
+}
diff --git a/packages/data-rpc/src/transports/window-transport.test.ts b/packages/data-rpc/src/transports/window-transport.test.ts
new file mode 100644
index 00000000..3a6af560
--- /dev/null
+++ b/packages/data-rpc/src/transports/window-transport.test.ts
@@ -0,0 +1,52 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+// @vitest-environment jsdom
+
+import { describe, it, expect } from "vitest";
+import type { RpcMessage } from "../protocol.js";
+import { createWindowTransport } from "./window-transport.js";
+
+const hello: RpcMessage = { kind: "hello", protocol: 1 };
+
+describe("createWindowTransport", () => {
+    it("delivers messages from an allowed origin", async () => {
+        const transport = createWindowTransport(window, { allowedOrigins: ["https://trusted.example"] });
+        const received: RpcMessage[] = [];
+        transport.onMessage((m) => received.push(m));
+
+        window.dispatchEvent(new MessageEvent("message", { data: hello, origin: "https://trusted.example" }));
+        expect(received).toEqual([hello]);
+        transport.close();
+    });
+
+    it("drops messages from a disallowed origin", async () => {
+        const transport = createWindowTransport(window, { allowedOrigins: ["https://trusted.example"] });
+        const received: RpcMessage[] = [];
+        transport.onMessage((m) => received.push(m));
+
+        window.dispatchEvent(new MessageEvent("message", { data: hello, origin: "https://evil.example" }));
+        expect(received).toEqual([]);
+        transport.close();
+    });
+
+    it("ignores non-RpcMessage payloads even from an allowed origin", async () => {
+        const transport = createWindowTransport(window, { allowedOrigins: ["https://trusted.example"] });
+        const received: RpcMessage[] = [];
+        transport.onMessage((m) => received.push(m));
+
+        window.dispatchEvent(new MessageEvent("message", { data: "just a string", origin: "https://trusted.example" }));
+        window.dispatchEvent(new MessageEvent("message", { data: { foo: 1 }, origin: "https://trusted.example" }));
+        expect(received).toEqual([]);
+        transport.close();
+    });
+
+    it("stops delivering after close", async () => {
+        const transport = createWindowTransport(window, { allowedOrigins: ["https://trusted.example"] });
+        const received: RpcMessage[] = [];
+        transport.onMessage((m) => received.push(m));
+        transport.close();
+
+        window.dispatchEvent(new MessageEvent("message", { data: hello, origin: "https://trusted.example" }));
+        expect(received).toEqual([]);
+    });
+});
diff --git a/packages/data-rpc/src/transports/window-transport.ts b/packages/data-rpc/src/transports/window-transport.ts
new file mode 100644
index 00000000..b3d112dd
--- /dev/null
+++ b/packages/data-rpc/src/transports/window-transport.ts
@@ -0,0 +1,76 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import type { RpcMessage } from "../protocol.js";
+import type { RpcTransport } from "../transport.js";
+
+/** Options for {@link createWindowTransport}. */
+export interface WindowTransportOptions {
+    /** Origins accepted on inbound `message` events; all others are dropped (v1 trust boundary). */
+    readonly allowedOrigins: readonly string[];
+    /**
+     * `targetOrigin` for outbound `postMessage`. Defaults to the sole
+     * `allowedOrigins` entry when there is exactly one, otherwise `"*"`.
+     * Specify explicitly whenever posting sensitive payloads.
+     */
+    readonly targetOrigin?: string;
+}
+
+/**
+ * An {@link RpcTransport} over `window.postMessage`, primarily for the initial
+ * `MessagePort` handoff between a page and its iframe (after which both sides
+ * switch to {@link createMessagePortTransport}). Inbound events are dropped
+ * unless their `origin` is allowlisted and the payload looks like an
+ * {@link RpcMessage}. Listens on the current global `window`; sends to `target`.
+ */
+export function createWindowTransport(target: Window, options: WindowTransportOptions): RpcTransport {
+    const listeners = new Set<(msg: RpcMessage) => void>();
+    const closeListeners = new Set<() => void>();
+    const pending: RpcMessage[] = [];
+    let closed = false;
+
+    const targetOrigin =
+        options.targetOrigin ?? (options.allowedOrigins.length === 1 ? options.allowedOrigins[0] : "*");
+
+    const handler = (event: MessageEvent) => {
+        if (!options.allowedOrigins.includes(event.origin)) return; // untrusted origin
+        const data: unknown = event.data;
+        if (typeof data !== "object" || data === null || typeof (data as { kind?: unknown }).kind !== "string") {
+            return; // not one of ours
+        }
+        const msg = data as RpcMessage;
+        if (listeners.size === 0) {
+            pending.push(msg);
+            return;
+        }
+        for (const l of listeners) l(msg);
+    };
+    window.addEventListener("message", handler);
+
+    return {
+        send(msg, transfer) {
+            if (closed) return;
+            target.postMessage(msg, targetOrigin, transfer ? [...transfer] : []);
+        },
+        onMessage(listener) {
+            listeners.add(listener);
+            for (const msg of pending.splice(0)) listener(msg);
+            return () => listeners.delete(listener);
+        },
+        onClose(listener) {
+            if (closed) {
+                listener();
+                return () => undefined;
+            }
+            closeListeners.add(listener);
+            return () => closeListeners.delete(listener);
+        },
+        close() {
+            if (closed) return;
+            closed = true;
+            window.removeEventListener("message", handler);
+            for (const l of closeListeners) l();
+            closeListeners.clear();
+            listeners.clear();
+        },
+    };
+}
diff --git a/packages/data-rpc/tsconfig.json b/packages/data-rpc/tsconfig.json
new file mode 100644
index 00000000..5e7f4c4e
--- /dev/null
+++ b/packages/data-rpc/tsconfig.json
@@ -0,0 +1,14 @@
+{
+    "extends": "../data/tsconfig-base.json",
+    "compilerOptions": {
+        "rootDir": "src",
+        "outDir": "dist",
+        "composite": true,
+        "types": ["node"],
+        "lib": ["ES2024", "DOM", "DOM.Iterable"]
+    },
+    "include": ["src/**/*"],
+    "references": [
+        { "path": "../data" }
+    ]
+}
diff --git a/packages/data-rpc/vitest.workspace.ts b/packages/data-rpc/vitest.workspace.ts
new file mode 100644
index 00000000..0dfc577f
--- /dev/null
+++ b/packages/data-rpc/vitest.workspace.ts
@@ -0,0 +1,20 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+import { defineWorkspace } from "vitest/config";
+
+// Default project runs under node — Node 24 provides `MessageChannel`,
+// `MessagePort`, and `structuredClone` as globals, so the loopback and
+// MessagePort transports are exercised faithfully. Tests that need a DOM
+// `window`/`MessageEvent` (the window transport) opt in per-file with
+// `// @vitest-environment jsdom`.
+export default defineWorkspace([
+    {
+        test: {
+            name: "node",
+            environment: "node",
+            include: ["src/**/*.test.ts"],
+            exclude: ["**/node_modules/**", "**/dist/**"],
+            silent: false,
+            reporters: "verbose",
+        },
+    },
+]);
diff --git a/packages/data-solid/package.json b/packages/data-solid/package.json
index 2239b05a..295f816c 100644
--- a/packages/data-solid/package.json
+++ b/packages/data-solid/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@adobe/data-solid",
-  "version": "0.10.9",
+  "version": "0.10.10",
   "description": "Adobe data SolidJS bindings — context and provider for ECS database",
   "type": "module",
   "private": false,
diff --git a/packages/data-sync/package.json b/packages/data-sync/package.json
index dd30c769..dc53b89d 100644
--- a/packages/data-sync/package.json
+++ b/packages/data-sync/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@adobe/data-sync",
-    "version": "0.10.9",
+    "version": "0.10.10",
     "description": "Multi-user real-time synchronisation for @adobe/data ECS — server, client, and in-process loopback.",
     "type": "module",
     "sideEffects": false,
diff --git a/packages/data-testing/package.json b/packages/data-testing/package.json
index 7431781b..471580f2 100644
--- a/packages/data-testing/package.json
+++ b/packages/data-testing/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@adobe/data-testing",
-  "version": "0.10.9",
+  "version": "0.10.10",
   "description": "Conformance-testing utilities (Match + Conformance runners) for @adobe/data ECS features",
   "type": "module",
   "sideEffects": false,
diff --git a/packages/data/package.json b/packages/data/package.json
index 62cf0719..49d2ec91 100644
--- a/packages/data/package.json
+++ b/packages/data/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@adobe/data",
-  "version": "0.10.9",
+  "version": "0.10.10",
   "description": "Adobe data oriented programming library",
   "type": "module",
   "sideEffects": false,
diff --git a/packages/data/src/service/async-data-service/create-lazy.ts b/packages/data/src/service/async-data-service/create-lazy.ts
index 6279a2d7..5de41ee2 100644
--- a/packages/data/src/service/async-data-service/create-lazy.ts
+++ b/packages/data/src/service/async-data-service/create-lazy.ts
@@ -4,6 +4,7 @@ import { Observe } from "../../observe/index.js";
 import { Schema } from "../../schema/index.js";
 import { Service } from "../service.js";
 import { EquivalentTypes } from "../../types/types.js";
+import { memberKind } from "./member-kind.js";
 
 // ============================================================================
 // TYPE INFERENCE HELPERS
@@ -48,38 +49,6 @@ type LazyServiceSchema = Schema & {
 type SchemaMatchesService<T extends Service, S extends Schema> =
   EquivalentTypes<Schema.ToType<S>, Omit<T, keyof Service>>;
 
-// ============================================================================
-// RUNTIME WRAPPER KIND
-// ============================================================================
-
-type WrapKind = "observe" | "fn:observe" | "fn:promise" | "fn:generator" | "fn:void";
-
-// The runtime wrapper strategy for a service member, derived from its schema:
-// an `observe` value, or a `function` classified by what it returns. Well-typed
-// callers can never reach a throw (the LazyServiceSchema constraint rejects
-// unsupported members at compile time); the throws defend untyped/`any` callers.
-function memberKind(member: Schema): WrapKind {
-  if (member.type === "observe") return "observe";
-  if (member.type === "function") {
-    const returns = member.signature?.returns;
-    if (returns === undefined) return "fn:void"; // absent returns ⇒ void
-    switch (returns.type) {
-      case "observe": return "fn:observe";
-      case "promise": return "fn:promise";
-      case "generator": return "fn:generator";
-      default:
-        // A present `returns` with an unrecognized type must not silently become
-        // void (that would drop the result); fail loudly instead.
-        throw new Error(
-          `createLazy: unsupported function returns schema type "${returns.type}" — must be observe, promise, generator, or omitted (void)`,
-        );
-    }
-  }
-  throw new Error(
-    `createLazy: unsupported member schema type "${member.type}" — service members must be observe or function schemas`,
-  );
-}
-
 // ============================================================================
 // MAIN FUNCTION SIGNATURE
 // ============================================================================
diff --git a/packages/data/src/service/async-data-service/member-kind.ts b/packages/data/src/service/async-data-service/member-kind.ts
new file mode 100644
index 00000000..d8095abb
--- /dev/null
+++ b/packages/data/src/service/async-data-service/member-kind.ts
@@ -0,0 +1,35 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import { Schema } from "../../schema/index.js";
+
+// The runtime wrapper strategy for a service member, derived from its schema:
+// an `observe` value, or a `function` classified by what it returns.
+export type WrapKind = "observe" | "fn:observe" | "fn:promise" | "fn:generator" | "fn:void";
+
+// Classify a service member's schema into the runtime wrapper strategy it needs:
+// an `observe` value, or a `function` classified by what it returns. Well-typed
+// callers can never reach a throw (the caller's schema constraint rejects
+// unsupported members at compile time); the throws defend untyped/`any` callers.
+// Shared by `createLazy` (local lazy wrapping) and `@adobe/data-rpc` (cross-boundary
+// projection) — both drive identical per-member dispatch from the same schema.
+export function memberKind(member: Schema): WrapKind {
+  if (member.type === "observe") return "observe";
+  if (member.type === "function") {
+    const returns = member.signature?.returns;
+    if (returns === undefined) return "fn:void"; // absent returns ⇒ void
+    switch (returns.type) {
+      case "observe": return "fn:observe";
+      case "promise": return "fn:promise";
+      case "generator": return "fn:generator";
+      default:
+        // A present `returns` with an unrecognized type must not silently become
+        // void (that would drop the result); fail loudly instead.
+        throw new Error(
+          `memberKind: unsupported function returns schema type "${returns.type}" — must be observe, promise, generator, or omitted (void)`,
+        );
+    }
+  }
+  throw new Error(
+    `memberKind: unsupported member schema type "${member.type}" — service members must be observe or function schemas`,
+  );
+}
diff --git a/packages/data/src/service/async-data-service/public.ts b/packages/data/src/service/async-data-service/public.ts
index 4bf7dbbb..18a0449c 100644
--- a/packages/data/src/service/async-data-service/public.ts
+++ b/packages/data/src/service/async-data-service/public.ts
@@ -3,4 +3,5 @@
 export * from "./is-valid.js";
 export * from "./is-valid-with-partial-schema.js";
 export * from "./is-valid-with-complete-schema.js";
+export * from "./member-kind.js";
 export * from "./create-lazy.js";
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index ed8e1561..71a1de2f 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -526,6 +526,53 @@ importers:
         specifier: ^1.6.0
         version: 1.6.0(@types/node@25.6.0)(@vitest/browser@1.6.0)(jsdom@24.1.0)
 
+  packages/data-rpc:
+    dependencies:
+      '@adobe/data':
+        specifier: workspace:*
+        version: link:../data
+    devDependencies:
+      jsdom:
+        specifier: ^24.1.0
+        version: 24.1.0
+      typescript:
+        specifier: ^5.8.3
+        version: 5.8.3
+      vitest:
+        specifier: ^1.6.0
+        version: 1.6.0(@types/node@25.6.0)(@vitest/browser@1.6.0)(jsdom@24.1.0)
+
+  packages/data-rpc-iframe:
+    dependencies:
+      '@adobe/data':
+        specifier: workspace:*
+        version: link:../data
+      '@adobe/data-lit':
+        specifier: workspace:*
+        version: link:../data-lit
+      '@adobe/data-rpc':
+        specifier: workspace:*
+        version: link:../data-rpc
+      lit:
+        specifier: ^3.3.1
+        version: 3.3.1
+    devDependencies:
+      jsdom:
+        specifier: ^24.1.0
+        version: 24.1.0
+      typescript:
+        specifier: ^5.8.3
+        version: 5.8.3
+      vite:
+        specifier: ^5.1.1
+        version: 5.1.1(@types/node@25.6.0)
+      vite-plugin-checker:
+        specifier: ^0.12.0
+        version: 0.12.0(typescript@5.8.3)(vite@5.1.1)
+      vitest:
+        specifier: ^1.6.0
+        version: 1.6.0(@types/node@25.6.0)(@vitest/browser@1.6.0)(jsdom@24.1.0)
+
   packages/data-solid:
     dependencies:
       '@adobe/data':
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index a3c0a75e..768f5fbd 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -4,6 +4,8 @@ packages:
   - 'packages/data-testing'
   - 'packages/data-persistence'
   - 'packages/data-sync'
+  - 'packages/data-rpc'
+  - 'packages/data-rpc-iframe'
   - 'packages/data-lit'
   - 'packages/data-lit-todo'
   - 'packages/data-react'

From d45f8d0a6fed78f0cfb5a64f3e4e5bbe7a42a783 Mon Sep 17 00:00:00 2001
From: Kris Nye <krisnye@gmail.com>
Date: Fri, 4 Sep 2026 12:04:55 -0700
Subject: [PATCH 2/4] feat(data-rpc): support Observe values as (nested) call
 arguments via a reverse channel
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

An Observe passed as/inside a call argument streams caller→callee: the caller
sends a ref and streams values back on demand (arg-subscribe/arg-next/
arg-unsubscribe); the callee reconstructs a local Observe. Only Data crosses.
Providers released on op-teardown and endpoint close. Relaxes the expose gate to
schema-describes-service (like createLazy), since IsValid rejects Observe args.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 packages/data-rpc/README.md                   |   8 +
 packages/data-rpc/src/arg-observe.test.ts     | 143 ++++++++++++++++++
 packages/data-rpc/src/arg-observe.ts          |  97 ++++++++++++
 .../data-rpc/src/consume/caller-context.ts    |   9 ++
 .../data-rpc/src/consume/make-generator.ts    |   7 +-
 packages/data-rpc/src/consume/make-observe.ts |  16 +-
 packages/data-rpc/src/consume/make-promise.ts |  19 ++-
 packages/data-rpc/src/consume/make-void.ts    |  18 ++-
 .../src/consume/synthesize-service.ts         |  10 +-
 packages/data-rpc/src/create-endpoint.ts      |  83 +++++++++-
 packages/data-rpc/src/endpoint.ts             |  19 ++-
 packages/data-rpc/src/host/host-context.ts    |   5 +
 .../data-rpc/src/host/register-service.ts     |  21 ++-
 packages/data-rpc/src/protocol.ts             |  10 +-
 14 files changed, 424 insertions(+), 41 deletions(-)
 create mode 100644 packages/data-rpc/src/arg-observe.test.ts
 create mode 100644 packages/data-rpc/src/arg-observe.ts

diff --git a/packages/data-rpc/README.md b/packages/data-rpc/README.md
index 08d1c198..bd17c77f 100644
--- a/packages/data-rpc/README.md
+++ b/packages/data-rpc/README.md
@@ -30,6 +30,14 @@ own member `properties` is shimmed recursively on both sides (to any depth), and
 each leaf is addressed by its full path from the service root — so
 `remote.child.deep.greet(name)` round-trips exactly like a top-level member.
 
+**`Observe` arguments** work too, in reverse: an `Observe` passed as (or nested
+inside) a call argument — e.g. `display(foo: { a: Observe<number>, b: Observe<string> }): Observe<string>` —
+is a stream from the *caller* to the *callee*. The caller sends a ref instead of
+the function and streams its values back on demand; the callee reconstructs a
+local `Observe`. Describe such an argument with an `observe` schema at that
+position. (Supported for arguments to promise/observe/generator members; a void
+member can't release them, so avoid observe args there.)
+
 ## Define a service
 
 A projected service is an ordinary `@adobe/data` `AsyncDataService`: an interface
diff --git a/packages/data-rpc/src/arg-observe.test.ts b/packages/data-rpc/src/arg-observe.test.ts
new file mode 100644
index 00000000..6f26779b
--- /dev/null
+++ b/packages/data-rpc/src/arg-observe.test.ts
@@ -0,0 +1,143 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import { describe, it, expect } from "vitest";
+import { Observe } from "@adobe/data/observe";
+import type { Schema } from "@adobe/data/schema";
+import { type Service } from "@adobe/data/service";
+import { createRpcEndpoint } from "./create-endpoint.js";
+import { createRpcLoopbackTransport } from "./transports/loopback-transport.js";
+import { createMessagePortTransport } from "./transports/message-port-transport.js";
+
+// The user's example: a member whose named object argument carries Observe
+// values, returning an Observe. The arg observes live on the CALLER; the callee
+// subscribes back to them over the reverse channel — only Data crosses the wire.
+interface DisplayService extends Service {
+    display: (foo: { alpha: Observe<number>; beta: Observe<string> }) => Observe<string>;
+}
+
+namespace DisplayService {
+    export const schema = {
+        type: "object",
+        properties: {
+            display: {
+                type: "function",
+                signature: {
+                    parameters: [
+                        {
+                            type: "object",
+                            properties: {
+                                alpha: { type: "observe", value: { type: "number" } },
+                                beta: { type: "observe", value: { type: "string" } },
+                            },
+                            required: ["alpha", "beta"],
+                            additionalProperties: false,
+                        },
+                    ],
+                    returns: { type: "observe", value: { type: "string" } },
+                },
+            },
+        },
+        required: ["display"],
+        additionalProperties: false,
+    } as const satisfies Schema;
+}
+
+// The callee combines the two caller-side observes into a derived string observe.
+function makeDisplay(): DisplayService {
+    return {
+        serviceName: "display",
+        schema: Observe.fromConstant(DisplayService.schema),
+        display: (foo) =>
+            Observe.withMap(
+                Observe.fromProperties({ a: foo.alpha, b: foo.beta }),
+                ({ a, b }) => `${b}=${a}`,
+            ),
+    };
+}
+
+const flush = async (times = 10) => {
+    for (let i = 0; i < times; i++) await new Promise((r) => setTimeout(r, 0));
+};
+
+/** A value observe that also counts how many active subscriptions it has. */
+function tracked<T>(initial: T): { observe: Observe<T>; set: (v: T) => void; active: () => number } {
+    const [raw, set] = Observe.createState(initial);
+    let active = 0;
+    const observe: Observe<T> = (notify) => {
+        active++;
+        const un = raw(notify);
+        return () => {
+            active--;
+            un();
+        };
+    };
+    return { observe, set, active: () => active };
+}
+
+describe("observe values as named object arguments", () => {
+    it("streams caller-side arg observes to the callee and reacts to updates", async () => {
+        const { a, b } = createRpcLoopbackTransport();
+        const ea = createRpcEndpoint(a);
+        const eb = createRpcEndpoint(b);
+        ea.expose("display", makeDisplay(), DisplayService.schema);
+        const svc = eb.consume("display", DisplayService.schema);
+
+        const alpha = tracked(1);
+        const beta = tracked("x");
+
+        const seen: string[] = [];
+        const un = svc.display({ alpha: alpha.observe, beta: beta.observe })((v) => seen.push(v));
+
+        await flush();
+        expect(seen.at(-1)).toBe("x=1");
+        expect(alpha.active()).toBe(1); // callee subscribed back to the caller's arg observe
+        expect(beta.active()).toBe(1);
+
+        alpha.set(2);
+        await flush();
+        expect(seen.at(-1)).toBe("x=2");
+
+        beta.set("y");
+        await flush();
+        expect(seen.at(-1)).toBe("y=2");
+
+        // Unsubscribing the returned observe tears down the reverse subscriptions too.
+        un();
+        await flush();
+        expect(alpha.active()).toBe(0);
+        expect(beta.active()).toBe(0);
+
+        const count = seen.length;
+        alpha.set(99);
+        await flush();
+        expect(seen.length).toBe(count); // no further values after teardown
+
+        ea.close();
+        eb.close();
+    });
+
+    it("works over a real MessageChannel and releases providers on channel close", async () => {
+        const { port1, port2 } = new MessageChannel();
+        const ea = createRpcEndpoint(createMessagePortTransport(port1));
+        const eb = createRpcEndpoint(createMessagePortTransport(port2));
+        ea.expose("display", makeDisplay(), DisplayService.schema);
+        const svc = eb.consume("display", DisplayService.schema);
+
+        const alpha = tracked(10);
+        const beta = tracked("v");
+        const seen: string[] = [];
+        svc.display({ alpha: alpha.observe, beta: beta.observe })((v) => seen.push(v));
+
+        await flush();
+        expect(seen.at(-1)).toBe("v=10");
+        expect(alpha.active()).toBe(1);
+
+        // Closing the consuming endpoint releases the callee's reverse subscriptions.
+        eb.close();
+        await flush();
+        expect(alpha.active()).toBe(0);
+        expect(beta.active()).toBe(0);
+
+        ea.close();
+    });
+});
diff --git a/packages/data-rpc/src/arg-observe.ts b/packages/data-rpc/src/arg-observe.ts
new file mode 100644
index 00000000..3bc96edf
--- /dev/null
+++ b/packages/data-rpc/src/arg-observe.ts
@@ -0,0 +1,97 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import type { Data } from "@adobe/data";
+import type { Observe } from "@adobe/data/observe";
+import type { Schema } from "@adobe/data/schema";
+
+/**
+ * Argument observes flow the "wrong" way: an `Observe` passed as (or nested
+ * inside) a call argument is a stream from the CALLER to the CALLEE. It can't be
+ * cloned onto the wire, so the caller replaces each one with a numeric ref and
+ * streams its values back on demand; the host reconstructs a local `Observe`
+ * from the ref that, when subscribed, pulls from the caller. These pure walkers
+ * find the observe positions in an argument value using its parameter schema.
+ *
+ * Only `observe` positions are transformed (the case the wire supports for
+ * arguments); `promise`/`generator`/`function` arguments are not shimmed and
+ * would fail to clone — describe arguments with `Data` and `observe` only.
+ */
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/** Replace every `observe`-typed position in `value` (guided by `schema`) with a ref. */
+export function marshalObserveValue(value: unknown, schema: Schema, onObserve: (obs: Observe<Data>) => number): Data {
+    if (schema.type === "observe") {
+        // A nullable observe arg may legitimately be absent; only shim a real function.
+        return typeof value === "function" ? onObserve(value as Observe<Data>) : (value as Data);
+    }
+    if ((schema.type === "object" || schema.properties !== undefined) && isPlainObject(value)) {
+        const props = schema.properties ?? {};
+        const out: Record<string, Data> = { ...(value as Record<string, Data>) };
+        for (const [key, childSchema] of Object.entries(props)) {
+            if (key in value) out[key] = marshalObserveValue(value[key], childSchema, onObserve);
+        }
+        return out;
+    }
+    if ((schema.type === "array" || schema.items !== undefined) && Array.isArray(value) && schema.items !== undefined) {
+        const items = schema.items;
+        return value.map((v) => marshalObserveValue(v, items, onObserve));
+    }
+    return value as Data;
+}
+
+/** Reconstruct every `observe`-typed position (a ref) in `value` into a local `Observe`. */
+export function unmarshalObserveValue(value: unknown, schema: Schema, onRef: (ref: number) => Observe<Data>): unknown {
+    if (schema.type === "observe") {
+        return typeof value === "number" ? onRef(value) : value;
+    }
+    if ((schema.type === "object" || schema.properties !== undefined) && isPlainObject(value)) {
+        const props = schema.properties ?? {};
+        const out: Record<string, unknown> = { ...value };
+        for (const [key, childSchema] of Object.entries(props)) {
+            if (key in value) out[key] = unmarshalObserveValue(value[key], childSchema, onRef);
+        }
+        return out;
+    }
+    if ((schema.type === "array" || schema.items !== undefined) && Array.isArray(value) && schema.items !== undefined) {
+        const items = schema.items;
+        return value.map((v) => unmarshalObserveValue(v, items, onRef));
+    }
+    return value;
+}
+
+/** Map each argument through the observe marshaller using its parameter schema. */
+export function marshalArgsWith(
+    args: readonly unknown[],
+    params: readonly Schema[] | undefined,
+    onObserve: (obs: Observe<Data>) => number,
+): Data[] {
+    if (params === undefined) return args as Data[];
+    return args.map((arg, i) => (params[i] === undefined ? (arg as Data) : marshalObserveValue(arg, params[i], onObserve)));
+}
+
+/** Map each argument through the observe unmarshaller using its parameter schema. */
+export function unmarshalArgsWith(
+    args: readonly Data[],
+    params: readonly Schema[] | undefined,
+    onRef: (ref: number) => Observe<Data>,
+): unknown[] {
+    if (params === undefined) return args as unknown[];
+    return args.map((arg, i) => (params[i] === undefined ? arg : unmarshalObserveValue(arg, params[i], onRef)));
+}
+
+/** True if the schema tree contains no type-constructor (observe/promise/generator/function). */
+export function isPureDataSchema(schema: Schema): boolean {
+    if (schema.type === "observe" || schema.type === "promise" || schema.type === "generator" || schema.type === "function") {
+        return false;
+    }
+    if (schema.properties !== undefined) {
+        for (const child of Object.values(schema.properties)) {
+            if (!isPureDataSchema(child)) return false;
+        }
+    }
+    if (schema.items !== undefined && !isPureDataSchema(schema.items)) return false;
+    return true;
+}
diff --git a/packages/data-rpc/src/consume/caller-context.ts b/packages/data-rpc/src/consume/caller-context.ts
index 327fe7f3..14071878 100644
--- a/packages/data-rpc/src/consume/caller-context.ts
+++ b/packages/data-rpc/src/consume/caller-context.ts
@@ -2,6 +2,7 @@
 
 import type { Data } from "@adobe/data";
 import type { Notify } from "@adobe/data/observe";
+import type { Schema } from "@adobe/data/schema";
 import type { RpcMessage } from "../protocol.js";
 
 /** One in-flight promise call, awaiting a `resolve`/`reject` for its id. */
@@ -36,4 +37,12 @@ export interface CallerContext {
     readonly callerGens: Map<number, CallerGenSlot>;
     readonly defaultTimeoutMs?: number;
     readonly isClosed: () => boolean;
+    /**
+     * Transform outgoing args: replace any `Observe` (guided by `params`) with a
+     * ref the caller streams back on demand, tracked under `opId` for cleanup.
+     * Returns wire-safe `Data` args.
+     */
+    readonly marshalArgs: (args: readonly unknown[], params: readonly Schema[] | undefined, opId: number) => Data[];
+    /** Release the arg-observe providers registered for `opId` (call/subscription done). */
+    readonly releaseArgRefs: (opId: number) => void;
 }
diff --git a/packages/data-rpc/src/consume/make-generator.ts b/packages/data-rpc/src/consume/make-generator.ts
index f5c4a529..64be7d1e 100644
--- a/packages/data-rpc/src/consume/make-generator.ts
+++ b/packages/data-rpc/src/consume/make-generator.ts
@@ -1,6 +1,7 @@
 // © 2026 Adobe. MIT License. See /LICENSE for details.
 
 import type { Data } from "@adobe/data";
+import type { Schema } from "@adobe/data/schema";
 import { marshalError } from "../host/marshal-error.js";
 import type { CallerContext, CallerGenSlot, PullResult } from "./caller-context.js";
 
@@ -20,7 +21,8 @@ export function makeGenerator(
     ctx: CallerContext,
     service: string,
     path: readonly string[],
-    args: readonly Data[],
+    args: readonly unknown[],
+    params?: readonly Schema[],
 ): AsyncGenerator<Data> {
     const id = ctx.nextId();
     const slot: CallerGenSlot = { pulls: [] };
@@ -32,6 +34,7 @@ export function makeGenerator(
     const finish = () => {
         finished = true;
         ctx.callerGens.delete(id);
+        ctx.releaseArgRefs(id);
     };
 
     const gen: AsyncGenerator<Data> = {
@@ -42,7 +45,7 @@ export function makeGenerator(
             }
             if (!started) {
                 started = true;
-                ctx.send({ kind: "iterate", id, service, path, args });
+                ctx.send({ kind: "iterate", id, service, path, args: ctx.marshalArgs(args, params, id) });
             }
             ctx.send({ kind: "pull", id });
             const result = await new Promise<PullResult>((res) => slot.pulls.push(res));
diff --git a/packages/data-rpc/src/consume/make-observe.ts b/packages/data-rpc/src/consume/make-observe.ts
index ea73fd28..73284fc3 100644
--- a/packages/data-rpc/src/consume/make-observe.ts
+++ b/packages/data-rpc/src/consume/make-observe.ts
@@ -2,14 +2,15 @@
 
 import type { Data } from "@adobe/data";
 import type { Observe } from "@adobe/data/observe";
+import type { Schema } from "@adobe/data/schema";
 import type { CallerContext } from "./caller-context.js";
 
 /**
  * A local `Observe<Data>` that projects a remote observe member. On subscribe it
- * allocates an id, registers the `notify`, and sends `subscribe`; each remote
- * `next` for that id is routed back to `notify` by the endpoint. Unsubscribing
- * deletes the id (so any `next` still in flight is dropped) and sends
- * `unsubscribe`.
+ * allocates an id, marshals any observe-bearing args, registers the `notify`, and
+ * sends `subscribe`; each remote `next` for that id is routed back to `notify` by
+ * the endpoint. Unsubscribing deletes the id (so any `next` still in flight is
+ * dropped), sends `unsubscribe`, and releases any arg-observe providers.
  *
  * Unlike a local `Observe` (e.g. `Observe.fromConstant`, which notifies
  * synchronously on subscribe), the FIRST value here necessarily arrives
@@ -19,17 +20,20 @@ export function makeObserve(
     ctx: CallerContext,
     service: string,
     path: readonly string[],
-    args: readonly Data[],
+    args: readonly unknown[],
+    params?: readonly Schema[],
 ): Observe<Data> {
     return (notify) => {
         if (ctx.isClosed()) return () => undefined;
         const id = ctx.nextId();
+        const wireArgs = ctx.marshalArgs(args, params, id);
         ctx.callerSubs.set(id, notify);
-        ctx.send({ kind: "subscribe", id, service, path, args });
+        ctx.send({ kind: "subscribe", id, service, path, args: wireArgs });
         return () => {
             if (ctx.callerSubs.delete(id)) {
                 ctx.send({ kind: "unsubscribe", id });
             }
+            ctx.releaseArgRefs(id);
         };
     };
 }
diff --git a/packages/data-rpc/src/consume/make-promise.ts b/packages/data-rpc/src/consume/make-promise.ts
index 022be319..c644975d 100644
--- a/packages/data-rpc/src/consume/make-promise.ts
+++ b/packages/data-rpc/src/consume/make-promise.ts
@@ -1,20 +1,23 @@
 // © 2026 Adobe. MIT License. See /LICENSE for details.
 
 import type { Data } from "@adobe/data";
+import type { Schema } from "@adobe/data/schema";
 import type { CallerContext, CallSlot } from "./caller-context.js";
 
 /**
- * Projects a remote promise member: allocates an id, registers a pending slot,
- * and sends `call`; the endpoint settles the slot from the matching
- * `resolve`/`reject`. When `defaultTimeoutMs` is set, a timer rejects the call
- * (and drops the slot, so a late `resolve` is ignored) if no reply arrives — the
- * host still runs to completion, but a wedged transport no longer hangs forever.
+ * Projects a remote promise member: allocates an id, marshals any observe-bearing
+ * args, registers a pending slot, and sends `call`; the endpoint settles the slot
+ * from the matching `resolve`/`reject` and releases the arg-observe providers.
+ * When `defaultTimeoutMs` is set, a timer rejects the call (and releases providers)
+ * if no reply arrives — the host still runs to completion, but a wedged transport
+ * no longer hangs forever.
  */
 export function makePromise(
     ctx: CallerContext,
     service: string,
     path: readonly string[],
-    args: readonly Data[],
+    args: readonly unknown[],
+    params?: readonly Schema[],
 ): Promise<Data> {
     const label = `${service}.${path.join(".")}`;
     return new Promise<Data>((resolve, reject) => {
@@ -23,17 +26,19 @@ export function makePromise(
             return;
         }
         const id = ctx.nextId();
+        const wireArgs = ctx.marshalArgs(args, params, id);
         const slot: CallSlot = { resolve, reject };
         const deadline =
             ctx.defaultTimeoutMs !== undefined ? Date.now() + ctx.defaultTimeoutMs : undefined;
         if (ctx.defaultTimeoutMs !== undefined) {
             slot.timer = setTimeout(() => {
                 if (ctx.callPending.delete(id)) {
+                    ctx.releaseArgRefs(id);
                     reject(new Error(`rpc call ${label} timed out after ${ctx.defaultTimeoutMs}ms`));
                 }
             }, ctx.defaultTimeoutMs);
         }
         ctx.callPending.set(id, slot);
-        ctx.send({ kind: "call", id, service, path, args, deadline });
+        ctx.send({ kind: "call", id, service, path, args: wireArgs, deadline });
     });
 }
diff --git a/packages/data-rpc/src/consume/make-void.ts b/packages/data-rpc/src/consume/make-void.ts
index b5c4307e..2f439c00 100644
--- a/packages/data-rpc/src/consume/make-void.ts
+++ b/packages/data-rpc/src/consume/make-void.ts
@@ -1,21 +1,25 @@
 // © 2026 Adobe. MIT License. See /LICENSE for details.
 
-import type { Data } from "@adobe/data";
+import type { Schema } from "@adobe/data/schema";
 import type { CallerContext } from "./caller-context.js";
 
 /**
- * Projects a remote void member: fire-and-forget `send`, no reply, no id table.
- * A throw inside the host handler has no wire channel back here — it is routed to
- * the host endpoint's `onError` and otherwise invisible to the caller (matching
- * the local `void`-member contract).
+ * Projects a remote void member: fire-and-forget `send`, no reply. A throw inside
+ * the host handler has no wire channel back here — it is routed to the host
+ * endpoint's `onError`.
+ *
+ * NOTE: observe-bearing arguments to a void member cannot be released (there is
+ * no completion signal), so their providers live until the endpoint closes.
+ * Prefer a promise/observe/generator member when passing observe arguments.
  */
 export function makeVoid(
     ctx: CallerContext,
     service: string,
     path: readonly string[],
-    args: readonly Data[],
+    args: readonly unknown[],
+    params?: readonly Schema[],
 ): void {
     if (ctx.isClosed()) return;
     const id = ctx.nextId();
-    ctx.send({ kind: "send", id, service, path, args });
+    ctx.send({ kind: "send", id, service, path, args: ctx.marshalArgs(args, params, id) });
 }
diff --git a/packages/data-rpc/src/consume/synthesize-service.ts b/packages/data-rpc/src/consume/synthesize-service.ts
index cd711391..12d54bbe 100644
--- a/packages/data-rpc/src/consume/synthesize-service.ts
+++ b/packages/data-rpc/src/consume/synthesize-service.ts
@@ -1,6 +1,5 @@
 // © 2026 Adobe. MIT License. See /LICENSE for details.
 
-import type { Data } from "@adobe/data";
 import { Observe } from "@adobe/data/observe";
 import type { Schema } from "@adobe/data/schema";
 import { AsyncDataService, type Service } from "@adobe/data/service";
@@ -29,21 +28,22 @@ function buildMembers(
         const memberPath = [...path, key];
         if (member.type === "observe" || member.type === "function") {
             const kind = AsyncDataService.memberKind(member);
+            const params = member.signature?.parameters;
             switch (kind) {
                 case "observe":
                     out[key] = makeObserve(ctx, service, memberPath, []);
                     break;
                 case "fn:observe":
-                    out[key] = (...args: Data[]) => makeObserve(ctx, service, memberPath, args);
+                    out[key] = (...args: unknown[]) => makeObserve(ctx, service, memberPath, args, params);
                     break;
                 case "fn:promise":
-                    out[key] = (...args: Data[]) => makePromise(ctx, service, memberPath, args);
+                    out[key] = (...args: unknown[]) => makePromise(ctx, service, memberPath, args, params);
                     break;
                 case "fn:generator":
-                    out[key] = (...args: Data[]) => makeGenerator(ctx, service, memberPath, args);
+                    out[key] = (...args: unknown[]) => makeGenerator(ctx, service, memberPath, args, params);
                     break;
                 case "fn:void":
-                    out[key] = (...args: Data[]) => makeVoid(ctx, service, memberPath, args);
+                    out[key] = (...args: unknown[]) => makeVoid(ctx, service, memberPath, args, params);
                     break;
             }
         } else if (member.type === "object" || member.properties !== undefined) {
diff --git a/packages/data-rpc/src/create-endpoint.ts b/packages/data-rpc/src/create-endpoint.ts
index e59e5cdf..9cc5be9b 100644
--- a/packages/data-rpc/src/create-endpoint.ts
+++ b/packages/data-rpc/src/create-endpoint.ts
@@ -1,9 +1,10 @@
 // © 2026 Adobe. MIT License. See /LICENSE for details.
 
 import type { Data } from "@adobe/data";
-import type { Notify, Unobserve } from "@adobe/data/observe";
+import type { Notify, Observe, Unobserve } from "@adobe/data/observe";
 import type { Schema } from "@adobe/data/schema";
 import type { Service } from "@adobe/data/service";
+import { marshalArgsWith, unmarshalArgsWith } from "./arg-observe.js";
 import type { CallerContext, CallSlot, CallerGenSlot } from "./consume/caller-context.js";
 import { reconstructError } from "./consume/reconstruct-error.js";
 import { synthesizeService } from "./consume/synthesize-service.js";
@@ -29,11 +30,56 @@ export function createRpcEndpoint(transport: RpcTransport, options: RpcEndpointO
         if (!closed) transport.send(msg);
     };
 
+    // ---- argument-observe state (REVERSE channel: an Observe passed as/inside a
+    //      call argument streams from THIS side, as caller, back to the callee) ----
+    const argProviders = new Map<number, Observe<Data>>(); // ref → our local arg observe
+    const argProviderSubs = new Map<number, { unobserve: Unobserve; ref: number }>(); // sub → the callee's live subscription to it
+    const callArgRefs = new Map<number, Set<number>>(); // opId → arg refs to release when the op ends
+    const hostArgSubs = new Map<number, Notify<Data>>(); // sub → our (as callee) notify for a remote arg observe
+
+    const marshalArgs = (args: readonly unknown[], params: readonly Schema[] | undefined, opId: number): Data[] =>
+        marshalArgsWith(args, params, (obs) => {
+            const ref = nextId();
+            argProviders.set(ref, obs);
+            let refs = callArgRefs.get(opId);
+            if (refs === undefined) {
+                refs = new Set();
+                callArgRefs.set(opId, refs);
+            }
+            refs.add(ref);
+            return ref;
+        });
+
+    const releaseArgRefs = (opId: number): void => {
+        const refs = callArgRefs.get(opId);
+        if (refs === undefined) return;
+        callArgRefs.delete(opId);
+        for (const ref of refs) {
+            argProviders.delete(ref);
+            for (const [sub, entry] of argProviderSubs) {
+                if (entry.ref === ref) {
+                    entry.unobserve();
+                    argProviderSubs.delete(sub);
+                }
+            }
+        }
+    };
+
+    const unmarshalArgs = (args: readonly Data[], params: readonly Schema[] | undefined): unknown[] =>
+        unmarshalArgsWith(args, params, (ref) => (notify) => {
+            const sub = nextId();
+            hostArgSubs.set(sub, notify);
+            send({ kind: "arg-subscribe", ref, sub });
+            return () => {
+                if (hostArgSubs.delete(sub)) send({ kind: "arg-unsubscribe", sub });
+            };
+        });
+
     // ---- host-side state (keyed by the REMOTE caller's id) ----
     const exposed = new Map<string, ExposedService>();
     const hostSubs = new Map<number, Unobserve>();
     const hostGens = new Map<number, AsyncGenerator<Data>>();
-    const hostCtx: HostContext = { send, exposed, hostSubs, hostGens, canInvoke, onError };
+    const hostCtx: HostContext = { send, exposed, hostSubs, hostGens, canInvoke, onError, unmarshalArgs };
 
     // ---- caller-side state (keyed by a LOCAL id) ----
     const callPending = new Map<number, CallSlot>();
@@ -50,6 +96,8 @@ export function createRpcEndpoint(transport: RpcTransport, options: RpcEndpointO
         callerGens,
         defaultTimeoutMs: options.defaultTimeoutMs,
         isClosed: () => closed,
+        marshalArgs,
+        releaseArgRefs,
     };
 
     const flushAwaiting = (name: string, schema: Schema) => {
@@ -96,6 +144,7 @@ export function createRpcEndpoint(transport: RpcTransport, options: RpcEndpointO
                 if (slot !== undefined) {
                     if (slot.timer !== undefined) clearTimeout(slot.timer);
                     callPending.delete(msg.id);
+                    releaseArgRefs(msg.id);
                     slot.resolve(msg.value);
                 }
                 return;
@@ -105,6 +154,7 @@ export function createRpcEndpoint(transport: RpcTransport, options: RpcEndpointO
                 if (slot !== undefined) {
                     if (slot.timer !== undefined) clearTimeout(slot.timer);
                     callPending.delete(msg.id);
+                    releaseArgRefs(msg.id);
                     slot.reject(reconstructError(msg.error));
                 }
                 return;
@@ -124,6 +174,29 @@ export function createRpcEndpoint(transport: RpcTransport, options: RpcEndpointO
                 else resolvePull({ error: reconstructError(msg.error) });
                 return;
             }
+            // ---- reverse channel: argument observes ----
+            case "arg-subscribe": {
+                // We are the CALLER: the callee wants to observe an arg we sent.
+                const provider = argProviders.get(msg.ref);
+                if (provider === undefined) return; // ref already released / unknown
+                const unobserve = provider((value) => send({ kind: "arg-next", sub: msg.sub, value }));
+                argProviderSubs.set(msg.sub, { unobserve, ref: msg.ref });
+                return;
+            }
+            case "arg-next": {
+                // We are the CALLEE: a value arrived for a remote arg observe we subscribed to.
+                hostArgSubs.get(msg.sub)?.(msg.value);
+                return;
+            }
+            case "arg-unsubscribe": {
+                // We are the CALLER: the callee unsubscribed from an arg observe.
+                const entry = argProviderSubs.get(msg.sub);
+                if (entry !== undefined) {
+                    entry.unobserve();
+                    argProviderSubs.delete(msg.sub);
+                }
+                return;
+            }
             default:
                 // A request kind — route to the host side.
                 handleHostRequest(hostCtx, msg);
@@ -154,6 +227,12 @@ export function createRpcEndpoint(transport: RpcTransport, options: RpcEndpointO
         hostSubs.clear();
         for (const [, gen] of hostGens) void gen.return(undefined).catch(() => undefined);
         hostGens.clear();
+        // Reverse channel: release every arg-observe provider and subscription.
+        for (const [, entry] of argProviderSubs) entry.unobserve();
+        argProviderSubs.clear();
+        argProviders.clear();
+        callArgRefs.clear();
+        hostArgSubs.clear();
         unMessage();
     };
     transport.onClose(teardown);
diff --git a/packages/data-rpc/src/endpoint.ts b/packages/data-rpc/src/endpoint.ts
index fcbc0339..e454e959 100644
--- a/packages/data-rpc/src/endpoint.ts
+++ b/packages/data-rpc/src/endpoint.ts
@@ -1,7 +1,20 @@
 // © 2026 Adobe. MIT License. See /LICENSE for details.
 
 import { Schema } from "@adobe/data/schema";
-import { AsyncDataService, type Service } from "@adobe/data/service";
+import { type Service } from "@adobe/data/service";
+import type { EquivalentTypes } from "@adobe/data/types";
+
+/**
+ * The `expose` gate: the schema must describe the service's members EXACTLY
+ * (same shape as `createLazy`'s check). This is what keeps the wire `Data`-only —
+ * describe members with `Data` leaves plus the `observe`/`promise`/`generator`/
+ * `function` constructors (an `Observe` argument is shimmed via the reverse
+ * channel; a genuinely non-`Data` leaf like `Response` would throw when marshaled).
+ */
+type SchemaDescribesService<T extends Service, S extends Schema> = EquivalentTypes<
+    Schema.ToType<S>,
+    Omit<T, keyof Service>
+>;
 
 /** Options for {@link createRpcEndpoint}. */
 export interface RpcEndpointOptions {
@@ -42,10 +55,10 @@ export interface RpcEndpoint {
         name: string,
         service: T,
         schema: S &
-            (AsyncDataService.IsValidWithCompleteSchema<T, S> extends true
+            (SchemaDescribesService<T, S> extends true
                 ? unknown
                 : {
-                      readonly __rpcError: "data-rpc: service must be a valid AsyncDataService fully described by this schema";
+                      readonly __rpcError: "data-rpc: schema must describe the service exactly (Data leaves + observe/promise/generator/function constructors)";
                   }),
     ): () => void;
 
diff --git a/packages/data-rpc/src/host/host-context.ts b/packages/data-rpc/src/host/host-context.ts
index f6079a55..49ec0aef 100644
--- a/packages/data-rpc/src/host/host-context.ts
+++ b/packages/data-rpc/src/host/host-context.ts
@@ -24,4 +24,9 @@ export interface HostContext {
     readonly hostGens: Map<number, AsyncGenerator<Data>>;
     readonly canInvoke: (service: string, member: string) => boolean;
     readonly onError: (error: unknown) => void;
+    /**
+     * Transform incoming args: reconstruct any arg-observe ref (guided by
+     * `params`) into a local `Observe` that pulls values back from the caller.
+     */
+    readonly unmarshalArgs: (args: readonly Data[], params: readonly Schema[] | undefined) => unknown[];
 }
diff --git a/packages/data-rpc/src/host/register-service.ts b/packages/data-rpc/src/host/register-service.ts
index 069b5c4f..791a9ea1 100644
--- a/packages/data-rpc/src/host/register-service.ts
+++ b/packages/data-rpc/src/host/register-service.ts
@@ -3,6 +3,7 @@
 import type { Data } from "@adobe/data";
 import type { Observe } from "@adobe/data/observe";
 import { validate, type Schema } from "@adobe/data/schema";
+import { isPureDataSchema } from "../arg-observe.js";
 import { reconstructError } from "../consume/reconstruct-error.js";
 import type { RpcError, RpcMessage } from "../protocol.js";
 import type { HostContext } from "./host-context.js";
@@ -28,7 +29,7 @@ function resolve(
     service: string,
     path: readonly string[],
     args: readonly Data[],
-): { readonly memberSchema: Schema; readonly target: Member } | { readonly error: RpcError } {
+): { readonly memberSchema: Schema; readonly target: Member; readonly args: readonly unknown[] } | { readonly error: RpcError } {
     const label = `${service}.${path.join(".")}`;
     const exposed = ctx.exposed.get(service);
     if (exposed === undefined) {
@@ -54,7 +55,9 @@ function resolve(
         const errors: string[] = [];
         params.forEach((p, i) => {
             if (i >= args.length) errors.push(`missing required argument ${i} for "${label}"`);
-            else errors.push(...validate(p, args[i]));
+            // Only pure-Data params are validated; a param that carries an observe
+            // (an arg-observe ref on the wire) is not a validatable Data value.
+            else if (isPureDataSchema(p)) errors.push(...validate(p, args[i]));
         });
         if (errors.length > 0) {
             return { error: { name: "RpcError", message: `invalid arguments for "${label}": ${errors.join("; ")}` } };
@@ -66,7 +69,9 @@ function resolve(
     for (const key of path) {
         target = (target as Record<string, unknown>)[key];
     }
-    return { memberSchema, target: target as Member };
+    // Reconstruct any arg-observes into local Observes that pull from the caller.
+    const realArgs = ctx.unmarshalArgs(args, params);
+    return { memberSchema, target: target as Member, args: realArgs };
 }
 
 /**
@@ -90,9 +95,9 @@ export function handleHostRequest(ctx: HostContext, msg: RpcMessage): boolean {
                 ctx.send({ kind: "reject", id: msg.id, error: r.error });
                 return true;
             }
-            const fn = r.target as (...args: Data[]) => Promise<Data | void>;
+            const fn = r.target as (...args: unknown[]) => Promise<Data | void>;
             Promise.resolve()
-                .then(() => fn(...msg.args))
+                .then(() => fn(...r.args))
                 .then(
                     (value) => ctx.send({ kind: "resolve", id: msg.id, value: value === undefined ? null : value }),
                     (error) => ctx.send({ kind: "reject", id: msg.id, error: marshalError(error) }),
@@ -108,7 +113,7 @@ export function handleHostRequest(ctx: HostContext, msg: RpcMessage): boolean {
             }
             // A void member's throw has no wire channel — surface it via onError.
             try {
-                (r.target as (...args: Data[]) => void)(...msg.args);
+                (r.target as (...args: unknown[]) => void)(...r.args);
             } catch (error) {
                 ctx.onError(error);
             }
@@ -125,7 +130,7 @@ export function handleHostRequest(ctx: HostContext, msg: RpcMessage): boolean {
             const observe: Observe<Data> =
                 r.memberSchema.type === "observe"
                     ? (r.target as Observe<Data>)
-                    : (r.target as (...args: Data[]) => Observe<Data>)(...msg.args);
+                    : (r.target as (...args: unknown[]) => Observe<Data>)(...r.args);
             const unobserve = observe((value) => ctx.send({ kind: "next", id: msg.id, value }));
             ctx.hostSubs.set(msg.id, unobserve);
             return true;
@@ -143,7 +148,7 @@ export function handleHostRequest(ctx: HostContext, msg: RpcMessage): boolean {
                 ctx.send({ kind: "throw", id: msg.id, error: r.error });
                 return true;
             }
-            const gen = (r.target as (...args: Data[]) => AsyncGenerator<Data>)(...msg.args);
+            const gen = (r.target as (...args: unknown[]) => AsyncGenerator<Data>)(...r.args);
             ctx.hostGens.set(msg.id, gen);
             return true;
         }
diff --git a/packages/data-rpc/src/protocol.ts b/packages/data-rpc/src/protocol.ts
index 788a049e..20be0b08 100644
--- a/packages/data-rpc/src/protocol.ts
+++ b/packages/data-rpc/src/protocol.ts
@@ -79,4 +79,12 @@ export type RpcMessage =
     | { readonly kind: "done"; readonly id: number; readonly value?: Data }
     | { readonly kind: "throw"; readonly id: number; readonly error: RpcError }
     | { readonly kind: "return"; readonly id: number }
-    | { readonly kind: "raise"; readonly id: number; readonly error: RpcError };
+    | { readonly kind: "raise"; readonly id: number; readonly error: RpcError }
+
+    // ---- argument observes (REVERSE channel: an Observe passed as/inside a call
+    //      argument streams callee → back to the caller). `ref` is the caller's
+    //      arg-observe id; `sub` is the callee's subscription id. `arg-subscribe`
+    //      / `arg-unsubscribe` flow callee → caller; `arg-next` flows caller → callee. ----
+    | { readonly kind: "arg-subscribe"; readonly ref: number; readonly sub: number }
+    | { readonly kind: "arg-next"; readonly sub: number; readonly value: Data }
+    | { readonly kind: "arg-unsubscribe"; readonly sub: number };

From 7ace4f61e523c072e911489d141dc59bad9a7a98 Mon Sep 17 00:00:00 2001
From: Kris Nye <krisnye@gmail.com>
Date: Fri, 4 Sep 2026 12:57:44 -0700
Subject: [PATCH 3/4] feat(data-rpc): generalize reverse-channel args to
 Promise and AsyncGenerator

Extends the argument reverse channel beyond Observe: a Promise or AsyncGenerator
passed as/inside a call argument is serviced from the caller. Unified arg-marshal
walker dispatches per constructor kind; promise=arg-resolve/arg-reject,
generator=arg-pull/arg-yield/arg-done/arg-throw/arg-return/arg-raise (pull-based).
Only Data crosses; providers released on op-teardown and endpoint close.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 packages/data-rpc/README.md                   |  24 +-
 packages/data-rpc/src/arg-async.test.ts       | 164 +++++++++++++
 packages/data-rpc/src/arg-marshal.ts          | 107 +++++++++
 packages/data-rpc/src/arg-observe.ts          |  97 --------
 packages/data-rpc/src/create-endpoint.ts      | 222 +++++++++++++++---
 .../data-rpc/src/host/register-service.ts     |   2 +-
 packages/data-rpc/src/protocol.ts             |  25 +-
 7 files changed, 494 insertions(+), 147 deletions(-)
 create mode 100644 packages/data-rpc/src/arg-async.test.ts
 create mode 100644 packages/data-rpc/src/arg-marshal.ts
 delete mode 100644 packages/data-rpc/src/arg-observe.ts

diff --git a/packages/data-rpc/README.md b/packages/data-rpc/README.md
index bd17c77f..90d6f7b6 100644
--- a/packages/data-rpc/README.md
+++ b/packages/data-rpc/README.md
@@ -30,13 +30,23 @@ own member `properties` is shimmed recursively on both sides (to any depth), and
 each leaf is addressed by its full path from the service root — so
 `remote.child.deep.greet(name)` round-trips exactly like a top-level member.
 
-**`Observe` arguments** work too, in reverse: an `Observe` passed as (or nested
-inside) a call argument — e.g. `display(foo: { a: Observe<number>, b: Observe<string> }): Observe<string>` —
-is a stream from the *caller* to the *callee*. The caller sends a ref instead of
-the function and streams its values back on demand; the callee reconstructs a
-local `Observe`. Describe such an argument with an `observe` schema at that
-position. (Supported for arguments to promise/observe/generator members; a void
-member can't release them, so avoid observe args there.)
+**Constructor-typed arguments** (`Observe`, `Promise`, `AsyncGenerator`) work too,
+in reverse: one passed as — or nested inside — a call argument is a channel from
+the *caller* to the *callee*. The caller sends a ref instead of the value and
+services it over a reverse channel (an `Observe` streams on subscribe; a `Promise`
+settles once; an `AsyncGenerator` is pulled by the callee); the callee reconstructs
+a local value. For example, all of these round-trip:
+
+```ts
+display(foo: { alpha: Observe<number>; beta: Observe<string> }): Observe<string>
+awaitAndDouble(p: Promise<number>): Promise<number>
+sumStream(nums: AsyncGenerator<number>): Promise<number>
+```
+
+Describe such an argument with the matching `observe`/`promise`/`generator` schema
+at that position. Providers are released when the owning call/subscription ends and
+on endpoint close. (Function/callback arguments are not supported; and a `void`
+member can't release constructor args, so avoid them there.)
 
 ## Define a service
 
diff --git a/packages/data-rpc/src/arg-async.test.ts b/packages/data-rpc/src/arg-async.test.ts
new file mode 100644
index 00000000..848a3e27
--- /dev/null
+++ b/packages/data-rpc/src/arg-async.test.ts
@@ -0,0 +1,164 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import { describe, it, expect } from "vitest";
+import { Observe } from "@adobe/data/observe";
+import type { Schema } from "@adobe/data/schema";
+import { type Service } from "@adobe/data/service";
+import { createRpcEndpoint } from "./create-endpoint.js";
+import { createRpcLoopbackTransport } from "./transports/loopback-transport.js";
+import { createMessagePortTransport } from "./transports/message-port-transport.js";
+
+// Promise and AsyncGenerator values passed as (and nested inside) arguments —
+// serviced from the caller over the reverse channel; only Data crosses.
+interface AsyncArgService extends Service {
+    awaitAndDouble: (p: Promise<number>) => Promise<number>;
+    sumStream: (g: AsyncGenerator<number>) => Promise<number>;
+    first: (g: AsyncGenerator<number>) => Promise<number>;
+    combine: (foo: { label: Promise<string>; nums: AsyncGenerator<number> }) => Promise<string>;
+}
+
+namespace AsyncArgService {
+    const promiseNum = { type: "promise", value: { type: "number" } } as const;
+    const genNum = { type: "generator", value: { type: "number" } } as const;
+    export const schema = {
+        type: "object",
+        properties: {
+            awaitAndDouble: { type: "function", signature: { parameters: [promiseNum], returns: promiseNum } },
+            sumStream: { type: "function", signature: { parameters: [genNum], returns: promiseNum } },
+            first: { type: "function", signature: { parameters: [genNum], returns: promiseNum } },
+            combine: {
+                type: "function",
+                signature: {
+                    parameters: [
+                        {
+                            type: "object",
+                            properties: { label: { type: "promise", value: { type: "string" } }, nums: genNum },
+                            required: ["label", "nums"],
+                            additionalProperties: false,
+                        },
+                    ],
+                    returns: { type: "promise", value: { type: "string" } },
+                },
+            },
+        },
+        required: ["awaitAndDouble", "sumStream", "first", "combine"],
+        additionalProperties: false,
+    } as const satisfies Schema;
+}
+
+function makeAsyncArg(): AsyncArgService {
+    return {
+        serviceName: "async-arg",
+        schema: Observe.fromConstant(AsyncArgService.schema),
+        awaitAndDouble: async (p) => (await p) * 2,
+        sumStream: async (g) => {
+            let sum = 0;
+            for await (const n of g) sum += n;
+            return sum;
+        },
+        first: async (g) => {
+            for await (const n of g) return n; // early exit → the arg generator's return() runs
+            return -1;
+        },
+        combine: async (foo) => {
+            const label = await foo.label;
+            let sum = 0;
+            for await (const n of foo.nums) sum += n;
+            return `${label}:${sum}`;
+        },
+    };
+}
+
+const flush = async (times = 10) => {
+    for (let i = 0; i < times; i++) await new Promise((r) => setTimeout(r, 0));
+};
+
+function setup() {
+    const { a, b } = createRpcLoopbackTransport();
+    const ea = createRpcEndpoint(a);
+    const eb = createRpcEndpoint(b);
+    ea.expose("async", makeAsyncArg(), AsyncArgService.schema);
+    const svc = eb.consume("async", AsyncArgService.schema);
+    return { ea, eb, svc };
+}
+
+describe("Promise arguments", () => {
+    it("resolves a promise argument from the caller", async () => {
+        const { ea, eb, svc } = setup();
+        expect(await svc.awaitAndDouble(Promise.resolve(21))).toBe(42);
+        ea.close();
+        eb.close();
+    });
+
+    it("propagates a rejected promise argument", async () => {
+        const { ea, eb, svc } = setup();
+        await expect(svc.awaitAndDouble(Promise.reject(new Error("bad input")))).rejects.toThrowError("bad input");
+        ea.close();
+        eb.close();
+    });
+});
+
+describe("AsyncGenerator arguments", () => {
+    it("streams a generator argument from the caller (host consumes fully)", async () => {
+        const { ea, eb, svc } = setup();
+        async function* nums() {
+            yield 1;
+            yield 2;
+            yield 3;
+        }
+        expect(await svc.sumStream(nums())).toBe(6);
+        ea.close();
+        eb.close();
+    });
+
+    it("runs the caller generator's finally when the host ends it early", async () => {
+        const { ea, eb, svc } = setup();
+        let ranFinally = false;
+        async function* provider() {
+            try {
+                yield 10;
+                yield 20;
+                yield 30;
+            } finally {
+                ranFinally = true;
+            }
+        }
+        expect(await svc.first(provider())).toBe(10);
+        await flush();
+        expect(ranFinally).toBe(true); // host's early return propagated back to the caller
+        ea.close();
+        eb.close();
+    });
+});
+
+describe("mixed constructor arguments in a nested object", () => {
+    it("services a Promise and an AsyncGenerator inside one object argument", async () => {
+        const { ea, eb, svc } = setup();
+        async function* nums() {
+            yield 4;
+            yield 5;
+        }
+        const result = await svc.combine({ label: Promise.resolve("total"), nums: nums() });
+        expect(result).toBe("total:9");
+        ea.close();
+        eb.close();
+    });
+
+    it("works over a real MessageChannel", async () => {
+        const { port1, port2 } = new MessageChannel();
+        const ea = createRpcEndpoint(createMessagePortTransport(port1));
+        const eb = createRpcEndpoint(createMessagePortTransport(port2));
+        ea.expose("async", makeAsyncArg(), AsyncArgService.schema);
+        const svc = eb.consume("async", AsyncArgService.schema);
+
+        async function* nums() {
+            yield 7;
+            yield 8;
+        }
+        expect(await svc.awaitAndDouble(Promise.resolve(5))).toBe(10);
+        expect(await svc.sumStream(nums())).toBe(15);
+
+        ea.close();
+        eb.close();
+    });
+});
diff --git a/packages/data-rpc/src/arg-marshal.ts b/packages/data-rpc/src/arg-marshal.ts
new file mode 100644
index 00000000..6f54ead5
--- /dev/null
+++ b/packages/data-rpc/src/arg-marshal.ts
@@ -0,0 +1,107 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+import type { Data } from "@adobe/data";
+import type { Observe } from "@adobe/data/observe";
+import type { Schema } from "@adobe/data/schema";
+
+/**
+ * Constructor-typed values (`Observe`/`Promise`/`AsyncGenerator`) passed as — or
+ * nested inside — a call argument flow the "wrong" way: from the CALLER to the
+ * CALLEE. They can't be cloned onto the wire, so the caller replaces each with a
+ * numeric ref and services it over a reverse channel; the callee reconstructs a
+ * local value from the ref. These pure walkers find the constructor positions in
+ * an argument using its parameter schema and delegate to the caller's handlers.
+ *
+ * Only `Data` ever crosses; the constructor's payload values are themselves
+ * `Data`. Function (callback) arguments are not supported.
+ */
+
+export interface MarshalHandlers {
+    readonly observe: (obs: Observe<Data>) => number;
+    readonly promise: (promise: Promise<Data>) => number;
+    readonly generator: (generator: AsyncGenerator<Data>) => number;
+}
+
+export interface UnmarshalHandlers {
+    readonly observe: (ref: number) => Observe<Data>;
+    readonly promise: (ref: number) => Promise<Data>;
+    readonly generator: (ref: number) => AsyncGenerator<Data>;
+}
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function isThenable(value: unknown): value is Promise<Data> {
+    return (typeof value === "object" || typeof value === "function") && value !== null && typeof (value as { then?: unknown }).then === "function";
+}
+
+function isAsyncIterable(value: unknown): value is AsyncGenerator<Data> {
+    return value !== null && typeof value === "object" && typeof (value as { [Symbol.asyncIterator]?: unknown })[Symbol.asyncIterator] === "function";
+}
+
+/** Replace every constructor-typed position in `value` (guided by `schema`) with a ref. */
+export function marshalArgValue(value: unknown, schema: Schema, h: MarshalHandlers): Data {
+    if (schema.type === "observe") return typeof value === "function" ? h.observe(value as Observe<Data>) : (value as Data);
+    if (schema.type === "promise") return isThenable(value) ? h.promise(value) : (value as Data);
+    if (schema.type === "generator") return isAsyncIterable(value) ? h.generator(value) : (value as Data);
+    if ((schema.type === "object" || schema.properties !== undefined) && isPlainObject(value)) {
+        const props = schema.properties ?? {};
+        const out: Record<string, Data> = { ...(value as Record<string, Data>) };
+        for (const [key, childSchema] of Object.entries(props)) {
+            if (key in value) out[key] = marshalArgValue(value[key], childSchema, h);
+        }
+        return out;
+    }
+    if ((schema.type === "array" || schema.items !== undefined) && Array.isArray(value) && schema.items !== undefined) {
+        const items = schema.items;
+        return value.map((v) => marshalArgValue(v, items, h));
+    }
+    return value as Data;
+}
+
+/** Reconstruct every constructor-typed position (a ref) in `value` into a local value. */
+export function unmarshalArgValue(value: unknown, schema: Schema, h: UnmarshalHandlers): unknown {
+    if (schema.type === "observe") return typeof value === "number" ? h.observe(value) : value;
+    if (schema.type === "promise") return typeof value === "number" ? h.promise(value) : value;
+    if (schema.type === "generator") return typeof value === "number" ? h.generator(value) : value;
+    if ((schema.type === "object" || schema.properties !== undefined) && isPlainObject(value)) {
+        const props = schema.properties ?? {};
+        const out: Record<string, unknown> = { ...value };
+        for (const [key, childSchema] of Object.entries(props)) {
+            if (key in value) out[key] = unmarshalArgValue(value[key], childSchema, h);
+        }
+        return out;
+    }
+    if ((schema.type === "array" || schema.items !== undefined) && Array.isArray(value) && schema.items !== undefined) {
+        const items = schema.items;
+        return value.map((v) => unmarshalArgValue(v, items, h));
+    }
+    return value;
+}
+
+/** Map each argument through the marshaller using its parameter schema. */
+export function marshalArgsWith(args: readonly unknown[], params: readonly Schema[] | undefined, h: MarshalHandlers): Data[] {
+    if (params === undefined) return args as Data[];
+    return args.map((arg, i) => (params[i] === undefined ? (arg as Data) : marshalArgValue(arg, params[i], h)));
+}
+
+/** Map each argument through the unmarshaller using its parameter schema. */
+export function unmarshalArgsWith(args: readonly Data[], params: readonly Schema[] | undefined, h: UnmarshalHandlers): unknown[] {
+    if (params === undefined) return args as unknown[];
+    return args.map((arg, i) => (params[i] === undefined ? arg : unmarshalArgValue(arg, params[i], h)));
+}
+
+/** True if the schema tree contains no type-constructor (observe/promise/generator/function). */
+export function isPureDataSchema(schema: Schema): boolean {
+    if (schema.type === "observe" || schema.type === "promise" || schema.type === "generator" || schema.type === "function") {
+        return false;
+    }
+    if (schema.properties !== undefined) {
+        for (const child of Object.values(schema.properties)) {
+            if (!isPureDataSchema(child)) return false;
+        }
+    }
+    if (schema.items !== undefined && !isPureDataSchema(schema.items)) return false;
+    return true;
+}
diff --git a/packages/data-rpc/src/arg-observe.ts b/packages/data-rpc/src/arg-observe.ts
deleted file mode 100644
index 3bc96edf..00000000
--- a/packages/data-rpc/src/arg-observe.ts
+++ /dev/null
@@ -1,97 +0,0 @@
-// © 2026 Adobe. MIT License. See /LICENSE for details.
-
-import type { Data } from "@adobe/data";
-import type { Observe } from "@adobe/data/observe";
-import type { Schema } from "@adobe/data/schema";
-
-/**
- * Argument observes flow the "wrong" way: an `Observe` passed as (or nested
- * inside) a call argument is a stream from the CALLER to the CALLEE. It can't be
- * cloned onto the wire, so the caller replaces each one with a numeric ref and
- * streams its values back on demand; the host reconstructs a local `Observe`
- * from the ref that, when subscribed, pulls from the caller. These pure walkers
- * find the observe positions in an argument value using its parameter schema.
- *
- * Only `observe` positions are transformed (the case the wire supports for
- * arguments); `promise`/`generator`/`function` arguments are not shimmed and
- * would fail to clone — describe arguments with `Data` and `observe` only.
- */
-
-function isPlainObject(value: unknown): value is Record<string, unknown> {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-/** Replace every `observe`-typed position in `value` (guided by `schema`) with a ref. */
-export function marshalObserveValue(value: unknown, schema: Schema, onObserve: (obs: Observe<Data>) => number): Data {
-    if (schema.type === "observe") {
-        // A nullable observe arg may legitimately be absent; only shim a real function.
-        return typeof value === "function" ? onObserve(value as Observe<Data>) : (value as Data);
-    }
-    if ((schema.type === "object" || schema.properties !== undefined) && isPlainObject(value)) {
-        const props = schema.properties ?? {};
-        const out: Record<string, Data> = { ...(value as Record<string, Data>) };
-        for (const [key, childSchema] of Object.entries(props)) {
-            if (key in value) out[key] = marshalObserveValue(value[key], childSchema, onObserve);
-        }
-        return out;
-    }
-    if ((schema.type === "array" || schema.items !== undefined) && Array.isArray(value) && schema.items !== undefined) {
-        const items = schema.items;
-        return value.map((v) => marshalObserveValue(v, items, onObserve));
-    }
-    return value as Data;
-}
-
-/** Reconstruct every `observe`-typed position (a ref) in `value` into a local `Observe`. */
-export function unmarshalObserveValue(value: unknown, schema: Schema, onRef: (ref: number) => Observe<Data>): unknown {
-    if (schema.type === "observe") {
-        return typeof value === "number" ? onRef(value) : value;
-    }
-    if ((schema.type === "object" || schema.properties !== undefined) && isPlainObject(value)) {
-        const props = schema.properties ?? {};
-        const out: Record<string, unknown> = { ...value };
-        for (const [key, childSchema] of Object.entries(props)) {
-            if (key in value) out[key] = unmarshalObserveValue(value[key], childSchema, onRef);
-        }
-        return out;
-    }
-    if ((schema.type === "array" || schema.items !== undefined) && Array.isArray(value) && schema.items !== undefined) {
-        const items = schema.items;
-        return value.map((v) => unmarshalObserveValue(v, items, onRef));
-    }
-    return value;
-}
-
-/** Map each argument through the observe marshaller using its parameter schema. */
-export function marshalArgsWith(
-    args: readonly unknown[],
-    params: readonly Schema[] | undefined,
-    onObserve: (obs: Observe<Data>) => number,
-): Data[] {
-    if (params === undefined) return args as Data[];
-    return args.map((arg, i) => (params[i] === undefined ? (arg as Data) : marshalObserveValue(arg, params[i], onObserve)));
-}
-
-/** Map each argument through the observe unmarshaller using its parameter schema. */
-export function unmarshalArgsWith(
-    args: readonly Data[],
-    params: readonly Schema[] | undefined,
-    onRef: (ref: number) => Observe<Data>,
-): unknown[] {
-    if (params === undefined) return args as unknown[];
-    return args.map((arg, i) => (params[i] === undefined ? arg : unmarshalObserveValue(arg, params[i], onRef)));
-}
-
-/** True if the schema tree contains no type-constructor (observe/promise/generator/function). */
-export function isPureDataSchema(schema: Schema): boolean {
-    if (schema.type === "observe" || schema.type === "promise" || schema.type === "generator" || schema.type === "function") {
-        return false;
-    }
-    if (schema.properties !== undefined) {
-        for (const child of Object.values(schema.properties)) {
-            if (!isPureDataSchema(child)) return false;
-        }
-    }
-    if (schema.items !== undefined && !isPureDataSchema(schema.items)) return false;
-    return true;
-}
diff --git a/packages/data-rpc/src/create-endpoint.ts b/packages/data-rpc/src/create-endpoint.ts
index 9cc5be9b..f1acbf66 100644
--- a/packages/data-rpc/src/create-endpoint.ts
+++ b/packages/data-rpc/src/create-endpoint.ts
@@ -4,9 +4,10 @@ import type { Data } from "@adobe/data";
 import type { Notify, Observe, Unobserve } from "@adobe/data/observe";
 import type { Schema } from "@adobe/data/schema";
 import type { Service } from "@adobe/data/service";
-import { marshalArgsWith, unmarshalArgsWith } from "./arg-observe.js";
-import type { CallerContext, CallSlot, CallerGenSlot } from "./consume/caller-context.js";
+import { marshalArgsWith, unmarshalArgsWith } from "./arg-marshal.js";
+import type { CallerContext, CallSlot, CallerGenSlot, PullResult } from "./consume/caller-context.js";
 import { reconstructError } from "./consume/reconstruct-error.js";
+import { marshalError } from "./host/marshal-error.js";
 import { synthesizeService } from "./consume/synthesize-service.js";
 import type { RpcEndpoint, RpcEndpointOptions } from "./endpoint.js";
 import type { ExposedService, HostContext } from "./host/host-context.js";
@@ -30,24 +31,53 @@ export function createRpcEndpoint(transport: RpcTransport, options: RpcEndpointO
         if (!closed) transport.send(msg);
     };
 
-    // ---- argument-observe state (REVERSE channel: an Observe passed as/inside a
-    //      call argument streams from THIS side, as caller, back to the callee) ----
-    const argProviders = new Map<number, Observe<Data>>(); // ref → our local arg observe
-    const argProviderSubs = new Map<number, { unobserve: Unobserve; ref: number }>(); // sub → the callee's live subscription to it
+    // ---- argument-constructor state (REVERSE channel: an Observe/Promise/
+    //      AsyncGenerator passed as/inside a call argument is serviced from THIS
+    //      side, as caller, and reconstructed on THIS side, as callee) ----
+    // Caller role — providers we service on the peer's demand, keyed by our ref:
+    const argObserveProviders = new Map<number, Observe<Data>>();
+    const argObserveSubs = new Map<number, { unobserve: Unobserve; ref: number }>(); // sub → callee's live subscription
+    const argPromiseProviders = new Set<number>(); // refs whose promise is still pending
+    const argGenProviders = new Map<number, AsyncGenerator<Data>>();
     const callArgRefs = new Map<number, Set<number>>(); // opId → arg refs to release when the op ends
-    const hostArgSubs = new Map<number, Notify<Data>>(); // sub → our (as callee) notify for a remote arg observe
+    // Callee role — local reconstructions of the peer's arg constructors, keyed by ref:
+    const hostArgObserveSubs = new Map<number, Notify<Data>>(); // sub → our notify for a remote arg observe
+    const argPromiseWaiters = new Map<number, { resolve: (value: Data) => void; reject: (error: unknown) => void }>();
+    const argGenSlots = new Map<number, CallerGenSlot>();
+
+    const trackRef = (opId: number, ref: number) => {
+        let refs = callArgRefs.get(opId);
+        if (refs === undefined) {
+            refs = new Set();
+            callArgRefs.set(opId, refs);
+        }
+        refs.add(ref);
+    };
 
     const marshalArgs = (args: readonly unknown[], params: readonly Schema[] | undefined, opId: number): Data[] =>
-        marshalArgsWith(args, params, (obs) => {
-            const ref = nextId();
-            argProviders.set(ref, obs);
-            let refs = callArgRefs.get(opId);
-            if (refs === undefined) {
-                refs = new Set();
-                callArgRefs.set(opId, refs);
-            }
-            refs.add(ref);
-            return ref;
+        marshalArgsWith(args, params, {
+            observe: (obs) => {
+                const ref = nextId();
+                argObserveProviders.set(ref, obs);
+                trackRef(opId, ref);
+                return ref;
+            },
+            promise: (promise) => {
+                const ref = nextId();
+                argPromiseProviders.add(ref);
+                trackRef(opId, ref);
+                void promise.then(
+                    (value) => { if (argPromiseProviders.delete(ref)) send({ kind: "arg-resolve", ref, value: value === undefined ? null : value }); },
+                    (error) => { if (argPromiseProviders.delete(ref)) send({ kind: "arg-reject", ref, error: marshalError(error) }); },
+                );
+                return ref;
+            },
+            generator: (generator) => {
+                const ref = nextId();
+                argGenProviders.set(ref, generator);
+                trackRef(opId, ref);
+                return ref;
+            },
         });
 
     const releaseArgRefs = (opId: number): void => {
@@ -55,24 +85,69 @@ export function createRpcEndpoint(transport: RpcTransport, options: RpcEndpointO
         if (refs === undefined) return;
         callArgRefs.delete(opId);
         for (const ref of refs) {
-            argProviders.delete(ref);
-            for (const [sub, entry] of argProviderSubs) {
+            argObserveProviders.delete(ref);
+            for (const [sub, entry] of argObserveSubs) {
                 if (entry.ref === ref) {
                     entry.unobserve();
-                    argProviderSubs.delete(sub);
+                    argObserveSubs.delete(sub);
                 }
             }
+            argPromiseProviders.delete(ref);
+            const gen = argGenProviders.get(ref);
+            if (gen !== undefined) {
+                argGenProviders.delete(ref);
+                void gen.return(undefined).catch(() => undefined);
+            }
         }
     };
 
+    // Callee-role reconstruction of a remote arg-generator: pull-based, keyed by ref.
+    const makeArgGenerator = (ref: number): AsyncGenerator<Data> => {
+        const slot: CallerGenSlot = { pulls: [] };
+        argGenSlots.set(ref, slot);
+        let finished = false;
+        const finish = () => {
+            finished = true;
+            argGenSlots.delete(ref);
+        };
+        const gen: AsyncGenerator<Data> = {
+            async next(): Promise<IteratorResult<Data>> {
+                if (finished || closed) {
+                    finish();
+                    return { done: true, value: undefined };
+                }
+                send({ kind: "arg-pull", ref });
+                const result = await new Promise<PullResult>((res) => slot.pulls.push(res));
+                if ("error" in result) { finish(); throw result.error; }
+                if (result.done) { finish(); return { done: true, value: result.value }; }
+                return { done: false, value: result.value };
+            },
+            async return(value?: Data): Promise<IteratorResult<Data>> {
+                if (!finished) { finish(); send({ kind: "arg-return", ref }); }
+                return { done: true, value: value as Data };
+            },
+            async throw(error?: unknown): Promise<IteratorResult<Data>> {
+                if (!finished) { finish(); send({ kind: "arg-raise", ref, error: marshalError(error) }); }
+                throw error;
+            },
+            [Symbol.asyncIterator]() { return this; },
+            async [Symbol.asyncDispose](): Promise<void> { await gen.return(undefined); },
+        };
+        return gen;
+    };
+
     const unmarshalArgs = (args: readonly Data[], params: readonly Schema[] | undefined): unknown[] =>
-        unmarshalArgsWith(args, params, (ref) => (notify) => {
-            const sub = nextId();
-            hostArgSubs.set(sub, notify);
-            send({ kind: "arg-subscribe", ref, sub });
-            return () => {
-                if (hostArgSubs.delete(sub)) send({ kind: "arg-unsubscribe", sub });
-            };
+        unmarshalArgsWith(args, params, {
+            observe: (ref) => (notify) => {
+                const sub = nextId();
+                hostArgObserveSubs.set(sub, notify);
+                send({ kind: "arg-subscribe", ref, sub });
+                return () => {
+                    if (hostArgObserveSubs.delete(sub)) send({ kind: "arg-unsubscribe", sub });
+                };
+            },
+            promise: (ref) => new Promise<Data>((resolve, reject) => argPromiseWaiters.set(ref, { resolve, reject })),
+            generator: (ref) => makeArgGenerator(ref),
         });
 
     // ---- host-side state (keyed by the REMOTE caller's id) ----
@@ -177,26 +252,90 @@ export function createRpcEndpoint(transport: RpcTransport, options: RpcEndpointO
             // ---- reverse channel: argument observes ----
             case "arg-subscribe": {
                 // We are the CALLER: the callee wants to observe an arg we sent.
-                const provider = argProviders.get(msg.ref);
+                const provider = argObserveProviders.get(msg.ref);
                 if (provider === undefined) return; // ref already released / unknown
                 const unobserve = provider((value) => send({ kind: "arg-next", sub: msg.sub, value }));
-                argProviderSubs.set(msg.sub, { unobserve, ref: msg.ref });
+                argObserveSubs.set(msg.sub, { unobserve, ref: msg.ref });
                 return;
             }
             case "arg-next": {
                 // We are the CALLEE: a value arrived for a remote arg observe we subscribed to.
-                hostArgSubs.get(msg.sub)?.(msg.value);
+                hostArgObserveSubs.get(msg.sub)?.(msg.value);
                 return;
             }
             case "arg-unsubscribe": {
                 // We are the CALLER: the callee unsubscribed from an arg observe.
-                const entry = argProviderSubs.get(msg.sub);
+                const entry = argObserveSubs.get(msg.sub);
                 if (entry !== undefined) {
                     entry.unobserve();
-                    argProviderSubs.delete(msg.sub);
+                    argObserveSubs.delete(msg.sub);
+                }
+                return;
+            }
+            // ---- reverse channel: argument promises ----
+            case "arg-resolve": {
+                // We are the CALLEE: a remote arg promise settled.
+                const waiter = argPromiseWaiters.get(msg.ref);
+                if (waiter !== undefined) {
+                    argPromiseWaiters.delete(msg.ref);
+                    waiter.resolve(msg.value);
                 }
                 return;
             }
+            case "arg-reject": {
+                const waiter = argPromiseWaiters.get(msg.ref);
+                if (waiter !== undefined) {
+                    argPromiseWaiters.delete(msg.ref);
+                    waiter.reject(reconstructError(msg.error));
+                }
+                return;
+            }
+            // ---- reverse channel: argument generators ----
+            case "arg-pull": {
+                // We are the CALLER: the callee pulled the next value from an arg generator.
+                const gen = argGenProviders.get(msg.ref);
+                if (gen === undefined) return;
+                gen.next().then(
+                    (result) => {
+                        if (result.done) {
+                            argGenProviders.delete(msg.ref);
+                            send({ kind: "arg-done", ref: msg.ref, value: result.value ?? undefined });
+                        } else {
+                            send({ kind: "arg-yield", ref: msg.ref, value: result.value });
+                        }
+                    },
+                    (error) => {
+                        argGenProviders.delete(msg.ref);
+                        send({ kind: "arg-throw", ref: msg.ref, error: marshalError(error) });
+                    },
+                );
+                return;
+            }
+            case "arg-yield":
+            case "arg-done":
+            case "arg-throw": {
+                // We are the CALLEE: a pull on a remote arg generator was answered.
+                const slot = argGenSlots.get(msg.ref);
+                const resolvePull = slot?.pulls.shift();
+                if (resolvePull === undefined) return;
+                if (msg.kind === "arg-yield") resolvePull({ done: false, value: msg.value });
+                else if (msg.kind === "arg-done") resolvePull({ done: true, value: msg.value });
+                else resolvePull({ error: reconstructError(msg.error) });
+                return;
+            }
+            case "arg-return": {
+                // We are the CALLER: the callee ended an arg generator early.
+                const gen = argGenProviders.get(msg.ref);
+                argGenProviders.delete(msg.ref);
+                void gen?.return(undefined).catch((error) => onError(error));
+                return;
+            }
+            case "arg-raise": {
+                const gen = argGenProviders.get(msg.ref);
+                argGenProviders.delete(msg.ref);
+                void gen?.throw(reconstructError(msg.error)).catch(() => undefined);
+                return;
+            }
             default:
                 // A request kind — route to the host side.
                 handleHostRequest(hostCtx, msg);
@@ -227,12 +366,21 @@ export function createRpcEndpoint(transport: RpcTransport, options: RpcEndpointO
         hostSubs.clear();
         for (const [, gen] of hostGens) void gen.return(undefined).catch(() => undefined);
         hostGens.clear();
-        // Reverse channel: release every arg-observe provider and subscription.
-        for (const [, entry] of argProviderSubs) entry.unobserve();
-        argProviderSubs.clear();
-        argProviders.clear();
+        // Reverse channel: release every arg-constructor provider and reconstruction.
+        for (const [, entry] of argObserveSubs) entry.unobserve();
+        argObserveSubs.clear();
+        argObserveProviders.clear();
+        argPromiseProviders.clear();
+        for (const [, gen] of argGenProviders) void gen.return(undefined).catch(() => undefined);
+        argGenProviders.clear();
         callArgRefs.clear();
-        hostArgSubs.clear();
+        hostArgObserveSubs.clear();
+        for (const [, waiter] of argPromiseWaiters) waiter.reject(new Error("data-rpc endpoint closed"));
+        argPromiseWaiters.clear();
+        for (const [, slot] of argGenSlots) {
+            for (const resolvePull of slot.pulls.splice(0)) resolvePull({ done: true, value: undefined });
+        }
+        argGenSlots.clear();
         unMessage();
     };
     transport.onClose(teardown);
diff --git a/packages/data-rpc/src/host/register-service.ts b/packages/data-rpc/src/host/register-service.ts
index 791a9ea1..c3f624c3 100644
--- a/packages/data-rpc/src/host/register-service.ts
+++ b/packages/data-rpc/src/host/register-service.ts
@@ -3,7 +3,7 @@
 import type { Data } from "@adobe/data";
 import type { Observe } from "@adobe/data/observe";
 import { validate, type Schema } from "@adobe/data/schema";
-import { isPureDataSchema } from "../arg-observe.js";
+import { isPureDataSchema } from "../arg-marshal.js";
 import { reconstructError } from "../consume/reconstruct-error.js";
 import type { RpcError, RpcMessage } from "../protocol.js";
 import type { HostContext } from "./host-context.js";
diff --git a/packages/data-rpc/src/protocol.ts b/packages/data-rpc/src/protocol.ts
index 20be0b08..95f83810 100644
--- a/packages/data-rpc/src/protocol.ts
+++ b/packages/data-rpc/src/protocol.ts
@@ -81,10 +81,25 @@ export type RpcMessage =
     | { readonly kind: "return"; readonly id: number }
     | { readonly kind: "raise"; readonly id: number; readonly error: RpcError }
 
-    // ---- argument observes (REVERSE channel: an Observe passed as/inside a call
-    //      argument streams callee → back to the caller). `ref` is the caller's
-    //      arg-observe id; `sub` is the callee's subscription id. `arg-subscribe`
-    //      / `arg-unsubscribe` flow callee → caller; `arg-next` flows caller → callee. ----
+    // ---- argument constructors (REVERSE channel: an Observe/Promise/AsyncGenerator
+    //      passed as/inside a call argument is serviced from the caller). `ref` is
+    //      the caller's arg id. ----
+
+    // observe arg: `arg-subscribe`/`arg-unsubscribe` flow callee → caller (`sub` is
+    // the callee's per-subscription id); `arg-next` flows caller → callee.
     | { readonly kind: "arg-subscribe"; readonly ref: number; readonly sub: number }
     | { readonly kind: "arg-next"; readonly sub: number; readonly value: Data }
-    | { readonly kind: "arg-unsubscribe"; readonly sub: number };
+    | { readonly kind: "arg-unsubscribe"; readonly sub: number }
+
+    // promise arg (caller → callee, one-shot, keyed by ref)
+    | { readonly kind: "arg-resolve"; readonly ref: number; readonly value: Data }
+    | { readonly kind: "arg-reject"; readonly ref: number; readonly error: RpcError }
+
+    // generator arg (pull-based, keyed by ref): `arg-pull`/`arg-return`/`arg-raise`
+    // flow callee → caller; `arg-yield`/`arg-done`/`arg-throw` flow caller → callee.
+    | { readonly kind: "arg-pull"; readonly ref: number }
+    | { readonly kind: "arg-yield"; readonly ref: number; readonly value: Data }
+    | { readonly kind: "arg-done"; readonly ref: number; readonly value?: Data }
+    | { readonly kind: "arg-throw"; readonly ref: number; readonly error: RpcError }
+    | { readonly kind: "arg-return"; readonly ref: number }
+    | { readonly kind: "arg-raise"; readonly ref: number; readonly error: RpcError };

From f4aae06f8e7a3e1b090a08acf03206a94a5c7a03 Mon Sep 17 00:00:00 2001
From: Kris Nye <krisnye@gmail.com>
Date: Fri, 4 Sep 2026 13:27:21 -0700
Subject: [PATCH 4/4] =?UTF-8?q?fix(data-rpc):=20address=20PR=20review=20?=
 =?UTF-8?q?=E2=80=94=20arg-constructor=20lifecycle,=20prototype-path=20gua?=
 =?UTF-8?q?rd,=20safer=20transports?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- B1: suppress unhandled rejection when a member ignores a rejecting promise arg
- S1: cancel a promise/generator arg on release so the callee can't hang after the call completes
- S2: own-property guards in host path resolution (reject constructor/__proto__ paths)
- S4: void members reject constructor-typed arguments (no completion signal to release them)
- N1: createWindowTransport requires an explicit targetOrigin when origins are ambiguous (never "*")
- N2: arg refs travel as a tagged envelope so a literal value can't be mistaken for a ref
- N3: remove dead `deadline` field
Adds red-then-green pin tests for each (48 tests total).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 packages/data-rpc/README.md                   |  12 +-
 packages/data-rpc/src/arg-marshal.ts          |  21 +-
 packages/data-rpc/src/consume/make-promise.ts |   4 +-
 .../src/consume/synthesize-service.ts         |  12 +-
 packages/data-rpc/src/create-endpoint.ts      |  22 +-
 .../data-rpc/src/host/register-service.ts     |  14 +-
 packages/data-rpc/src/protocol.ts             |   2 +-
 packages/data-rpc/src/review-fixes.test.ts    | 263 ++++++++++++++++++
 .../src/transports/window-transport.test.ts   |   9 +
 .../src/transports/window-transport.ts        |   9 +-
 10 files changed, 343 insertions(+), 25 deletions(-)
 create mode 100644 packages/data-rpc/src/review-fixes.test.ts

diff --git a/packages/data-rpc/README.md b/packages/data-rpc/README.md
index 90d6f7b6..0b342ce1 100644
--- a/packages/data-rpc/README.md
+++ b/packages/data-rpc/README.md
@@ -45,8 +45,10 @@ sumStream(nums: AsyncGenerator<number>): Promise<number>
 
 Describe such an argument with the matching `observe`/`promise`/`generator` schema
 at that position. Providers are released when the owning call/subscription ends and
-on endpoint close. (Function/callback arguments are not supported; and a `void`
-member can't release constructor args, so avoid them there.)
+on endpoint close (a promise/generator arg consumed after its call has returned is
+cancelled). Function/callback arguments are not supported, and a `void` member
+cannot take constructor-typed arguments (it has no completion signal to release
+them) — doing so throws.
 
 ## Define a service
 
@@ -125,8 +127,10 @@ all four kinds in both directions.
 ## Transports
 
 - `createMessagePortTransport(port)` — the primary iframe/worker transport.
-- `createWindowTransport(target, { allowedOrigins })` — `window.postMessage`, for
-  the initial port handoff, with origin allowlisting.
+- `createWindowTransport(target, { allowedOrigins, targetOrigin? })` — `window.postMessage`,
+  for the initial port handoff, with origin allowlisting. `targetOrigin` is inferred
+  when there is exactly one allowed origin; otherwise it must be given explicitly
+  (outbound never defaults to `"*"`).
 - `createRpcLoopbackTransport()` — in-process pair for tests and single-process demos.
 
 `RpcTransport` is a small `send`/`onMessage`/`onClose`/`close` interface; bring
diff --git a/packages/data-rpc/src/arg-marshal.ts b/packages/data-rpc/src/arg-marshal.ts
index 6f54ead5..6a41cbf0 100644
--- a/packages/data-rpc/src/arg-marshal.ts
+++ b/packages/data-rpc/src/arg-marshal.ts
@@ -28,10 +28,19 @@ export interface UnmarshalHandlers {
     readonly generator: (ref: number) => AsyncGenerator<Data>;
 }
 
+// Refs travel as a one-key tagged envelope so a literal value at a constructor
+// position (a caller type violation) can never be mistaken for a ref.
+const REF_KEY = "$rpcRef";
+type RefEnvelope = { readonly [REF_KEY]: number };
+
 function isPlainObject(value: unknown): value is Record<string, unknown> {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+function isRefEnvelope(value: unknown): value is RefEnvelope {
+    return isPlainObject(value) && typeof value[REF_KEY] === "number";
+}
+
 function isThenable(value: unknown): value is Promise<Data> {
     return (typeof value === "object" || typeof value === "function") && value !== null && typeof (value as { then?: unknown }).then === "function";
 }
@@ -42,9 +51,9 @@ function isAsyncIterable(value: unknown): value is AsyncGenerator<Data> {
 
 /** Replace every constructor-typed position in `value` (guided by `schema`) with a ref. */
 export function marshalArgValue(value: unknown, schema: Schema, h: MarshalHandlers): Data {
-    if (schema.type === "observe") return typeof value === "function" ? h.observe(value as Observe<Data>) : (value as Data);
-    if (schema.type === "promise") return isThenable(value) ? h.promise(value) : (value as Data);
-    if (schema.type === "generator") return isAsyncIterable(value) ? h.generator(value) : (value as Data);
+    if (schema.type === "observe") return typeof value === "function" ? { [REF_KEY]: h.observe(value as Observe<Data>) } : (value as Data);
+    if (schema.type === "promise") return isThenable(value) ? { [REF_KEY]: h.promise(value) } : (value as Data);
+    if (schema.type === "generator") return isAsyncIterable(value) ? { [REF_KEY]: h.generator(value) } : (value as Data);
     if ((schema.type === "object" || schema.properties !== undefined) && isPlainObject(value)) {
         const props = schema.properties ?? {};
         const out: Record<string, Data> = { ...(value as Record<string, Data>) };
@@ -62,9 +71,9 @@ export function marshalArgValue(value: unknown, schema: Schema, h: MarshalHandle
 
 /** Reconstruct every constructor-typed position (a ref) in `value` into a local value. */
 export function unmarshalArgValue(value: unknown, schema: Schema, h: UnmarshalHandlers): unknown {
-    if (schema.type === "observe") return typeof value === "number" ? h.observe(value) : value;
-    if (schema.type === "promise") return typeof value === "number" ? h.promise(value) : value;
-    if (schema.type === "generator") return typeof value === "number" ? h.generator(value) : value;
+    if (schema.type === "observe") return isRefEnvelope(value) ? h.observe(value[REF_KEY]) : value;
+    if (schema.type === "promise") return isRefEnvelope(value) ? h.promise(value[REF_KEY]) : value;
+    if (schema.type === "generator") return isRefEnvelope(value) ? h.generator(value[REF_KEY]) : value;
     if ((schema.type === "object" || schema.properties !== undefined) && isPlainObject(value)) {
         const props = schema.properties ?? {};
         const out: Record<string, unknown> = { ...value };
diff --git a/packages/data-rpc/src/consume/make-promise.ts b/packages/data-rpc/src/consume/make-promise.ts
index c644975d..f8a96011 100644
--- a/packages/data-rpc/src/consume/make-promise.ts
+++ b/packages/data-rpc/src/consume/make-promise.ts
@@ -28,8 +28,6 @@ export function makePromise(
         const id = ctx.nextId();
         const wireArgs = ctx.marshalArgs(args, params, id);
         const slot: CallSlot = { resolve, reject };
-        const deadline =
-            ctx.defaultTimeoutMs !== undefined ? Date.now() + ctx.defaultTimeoutMs : undefined;
         if (ctx.defaultTimeoutMs !== undefined) {
             slot.timer = setTimeout(() => {
                 if (ctx.callPending.delete(id)) {
@@ -39,6 +37,6 @@ export function makePromise(
             }, ctx.defaultTimeoutMs);
         }
         ctx.callPending.set(id, slot);
-        ctx.send({ kind: "call", id, service, path, args: wireArgs, deadline });
+        ctx.send({ kind: "call", id, service, path, args: wireArgs });
     });
 }
diff --git a/packages/data-rpc/src/consume/synthesize-service.ts b/packages/data-rpc/src/consume/synthesize-service.ts
index 12d54bbe..8d8ef6fe 100644
--- a/packages/data-rpc/src/consume/synthesize-service.ts
+++ b/packages/data-rpc/src/consume/synthesize-service.ts
@@ -3,6 +3,7 @@
 import { Observe } from "@adobe/data/observe";
 import type { Schema } from "@adobe/data/schema";
 import { AsyncDataService, type Service } from "@adobe/data/service";
+import { isPureDataSchema } from "../arg-marshal.js";
 import type { CallerContext } from "./caller-context.js";
 import { makeObserve } from "./make-observe.js";
 import { makePromise } from "./make-promise.js";
@@ -43,7 +44,16 @@ function buildMembers(
                     out[key] = (...args: unknown[]) => makeGenerator(ctx, service, memberPath, args, params);
                     break;
                 case "fn:void":
-                    out[key] = (...args: unknown[]) => makeVoid(ctx, service, memberPath, args, params);
+                    // A void member has no completion signal, so it can't release
+                    // arg-constructor providers — reject them rather than leak.
+                    if ((params ?? []).some((p) => !isPureDataSchema(p))) {
+                        const label = memberPath.join(".");
+                        out[key] = () => {
+                            throw new Error(`data-rpc: void member "${label}" cannot take Observe/Promise/AsyncGenerator arguments — use a promise/observe/generator member`);
+                        };
+                    } else {
+                        out[key] = (...args: unknown[]) => makeVoid(ctx, service, memberPath, args, params);
+                    }
                     break;
             }
         } else if (member.type === "object" || member.properties !== undefined) {
diff --git a/packages/data-rpc/src/create-endpoint.ts b/packages/data-rpc/src/create-endpoint.ts
index f1acbf66..b0acb1e5 100644
--- a/packages/data-rpc/src/create-endpoint.ts
+++ b/packages/data-rpc/src/create-endpoint.ts
@@ -92,11 +92,16 @@ export function createRpcEndpoint(transport: RpcTransport, options: RpcEndpointO
                     argObserveSubs.delete(sub);
                 }
             }
-            argPromiseProviders.delete(ref);
+            // A still-pending promise arg is cancelled on the callee so its `await`
+            // can't hang after we stop servicing the ref.
+            if (argPromiseProviders.delete(ref)) {
+                send({ kind: "arg-reject", ref, error: { name: "RpcError", message: "data-rpc: argument cancelled — call completed" } });
+            }
             const gen = argGenProviders.get(ref);
             if (gen !== undefined) {
                 argGenProviders.delete(ref);
                 void gen.return(undefined).catch(() => undefined);
+                // Any later `arg-pull` for this ref is answered `arg-done` (below).
             }
         }
     };
@@ -146,7 +151,13 @@ export function createRpcEndpoint(transport: RpcTransport, options: RpcEndpointO
                     if (hostArgObserveSubs.delete(sub)) send({ kind: "arg-unsubscribe", sub });
                 };
             },
-            promise: (ref) => new Promise<Data>((resolve, reject) => argPromiseWaiters.set(ref, { resolve, reject })),
+            promise: (ref) => {
+                const promise = new Promise<Data>((resolve, reject) => argPromiseWaiters.set(ref, { resolve, reject }));
+                // Suppress an unhandledRejection if the member never awaits this arg
+                // (a rejection/cancellation still surfaces to any real `await`).
+                promise.catch(() => undefined);
+                return promise;
+            },
             generator: (ref) => makeArgGenerator(ref),
         });
 
@@ -294,7 +305,12 @@ export function createRpcEndpoint(transport: RpcTransport, options: RpcEndpointO
             case "arg-pull": {
                 // We are the CALLER: the callee pulled the next value from an arg generator.
                 const gen = argGenProviders.get(msg.ref);
-                if (gen === undefined) return;
+                if (gen === undefined) {
+                    // Provider released (op completed) or unknown — tell the callee it's done
+                    // so its `for await` terminates instead of hanging.
+                    send({ kind: "arg-done", ref: msg.ref });
+                    return;
+                }
                 gen.next().then(
                     (result) => {
                         if (result.done) {
diff --git a/packages/data-rpc/src/host/register-service.ts b/packages/data-rpc/src/host/register-service.ts
index c3f624c3..108e5998 100644
--- a/packages/data-rpc/src/host/register-service.ts
+++ b/packages/data-rpc/src/host/register-service.ts
@@ -42,13 +42,15 @@ function resolve(
         return { error: { name: "RpcError", message: `"${label}" is not permitted` } };
     }
     // Walk the schema tree to the leaf member schema (through nested services).
+    // Own-property checks only, so a wire path can never reach an inherited member
+    // (e.g. `constructor`, `__proto__`) on the schema or the service object.
     let memberSchema: Schema = exposed.schema;
     for (const key of path) {
-        const next = memberSchema.properties?.[key];
-        if (next === undefined) {
+        const props = memberSchema.properties;
+        if (props === undefined || !Object.prototype.hasOwnProperty.call(props, key)) {
             return { error: { name: "RpcError", message: `service "${service}" has no member "${label}"` } };
         }
-        memberSchema = next;
+        memberSchema = props[key];
     }
     const params = memberSchema.signature?.parameters;
     if (params !== undefined) {
@@ -63,10 +65,12 @@ function resolve(
             return { error: { name: "RpcError", message: `invalid arguments for "${label}": ${errors.join("; ")}` } };
         }
     }
-    // Walk the service object tree to the leaf member (exists and matches its
-    // schema kind — guaranteed at expose()).
+    // Walk the service object tree to the leaf member (own properties only).
     let target: unknown = exposed.service;
     for (const key of path) {
+        if (target === null || typeof target !== "object" || !Object.prototype.hasOwnProperty.call(target, key)) {
+            return { error: { name: "RpcError", message: `service "${service}" has no member "${label}"` } };
+        }
         target = (target as Record<string, unknown>)[key];
     }
     // Reconstruct any arg-observes into local Observes that pull from the caller.
diff --git a/packages/data-rpc/src/protocol.ts b/packages/data-rpc/src/protocol.ts
index 95f83810..594d1de9 100644
--- a/packages/data-rpc/src/protocol.ts
+++ b/packages/data-rpc/src/protocol.ts
@@ -60,7 +60,7 @@ export type RpcMessage =
     | { readonly kind: "schema"; readonly id: number; readonly service: string; readonly schema: Schema | null }
 
     // ---- promise call ----
-    | { readonly kind: "call"; readonly id: number; readonly service: string; readonly path: readonly string[]; readonly args: readonly Data[]; readonly deadline?: number }
+    | { readonly kind: "call"; readonly id: number; readonly service: string; readonly path: readonly string[]; readonly args: readonly Data[] }
     | { readonly kind: "resolve"; readonly id: number; readonly value: Data }
     | { readonly kind: "reject"; readonly id: number; readonly error: RpcError }
 
diff --git a/packages/data-rpc/src/review-fixes.test.ts b/packages/data-rpc/src/review-fixes.test.ts
new file mode 100644
index 00000000..a5e9d17f
--- /dev/null
+++ b/packages/data-rpc/src/review-fixes.test.ts
@@ -0,0 +1,263 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+
+// Red tests pinning the PR #197 review findings. Each fails before its fix.
+
+import { describe, it, expect } from "vitest";
+import { Observe } from "@adobe/data/observe";
+import type { Schema } from "@adobe/data/schema";
+import { type Service } from "@adobe/data/service";
+import { createRpcEndpoint } from "./create-endpoint.js";
+import type { RpcMessage } from "./protocol.js";
+import { createRpcLoopbackTransport } from "./transports/loopback-transport.js";
+
+const flush = async (times = 12) => {
+    for (let i = 0; i < times; i++) await new Promise((r) => setTimeout(r, 0));
+};
+
+// ---------------------------------------------------------------------------
+// B1: a rejecting promise argument the member ignores must not surface as an
+// unhandled rejection on the callee.
+// ---------------------------------------------------------------------------
+interface IgnoreService extends Service {
+    ignoreArg: (p: Promise<number>) => Promise<void>;
+}
+const ignoreSchema = {
+    type: "object",
+    properties: {
+        ignoreArg: { type: "function", signature: { parameters: [{ type: "promise", value: { type: "number" } }], returns: { type: "promise" } } },
+    },
+    required: ["ignoreArg"],
+    additionalProperties: false,
+} as const satisfies Schema;
+
+describe("B1 — rejecting promise arg ignored by the member", () => {
+    it("does not raise an unhandled rejection", async () => {
+        const rejections: unknown[] = [];
+        const onUnhandled = (r: unknown) => rejections.push(r);
+        process.on("unhandledRejection", onUnhandled);
+        try {
+            const { a, b } = createRpcLoopbackTransport();
+            const ea = createRpcEndpoint(a);
+            const eb = createRpcEndpoint(b);
+            const service: IgnoreService = {
+                serviceName: "ignore",
+                schema: Observe.fromConstant(ignoreSchema),
+                ignoreArg: async () => undefined, // never touches the promise arg
+            };
+            ea.expose("ignore", service, ignoreSchema);
+            const svc = eb.consume("ignore", ignoreSchema);
+
+            await svc.ignoreArg(Promise.reject(new Error("boom")));
+            await flush();
+            await new Promise((r) => setTimeout(r, 30)); // let any unhandledRejection fire
+
+            expect(rejections).toEqual([]);
+            ea.close();
+            eb.close();
+        } finally {
+            process.off("unhandledRejection", onUnhandled);
+        }
+    });
+});
+
+// ---------------------------------------------------------------------------
+// S1: a promise/generator arg must be settled on the callee when the call
+// completes before the member consumes it (no hang).
+// ---------------------------------------------------------------------------
+interface LateService extends Service {
+    lateAwait: (p: Promise<number>) => Promise<void>;
+    result: Observe<string>;
+    lateDrain: (g: AsyncGenerator<number>) => Promise<void>;
+    drained: Observe<string>;
+}
+const lateSchema = {
+    type: "object",
+    properties: {
+        lateAwait: { type: "function", signature: { parameters: [{ type: "promise", value: { type: "number" } }], returns: { type: "promise" } } },
+        result: { type: "observe", value: { type: "string" } },
+        lateDrain: { type: "function", signature: { parameters: [{ type: "generator", value: { type: "number" } }], returns: { type: "promise" } } },
+        drained: { type: "observe", value: { type: "string" } },
+    },
+    required: ["lateAwait", "result", "lateDrain", "drained"],
+    additionalProperties: false,
+} as const satisfies Schema;
+
+function makeLate(): LateService {
+    const [result, setResult] = Observe.createState("pending");
+    const [drained, setDrained] = Observe.createState("pending");
+    return {
+        serviceName: "late",
+        schema: Observe.fromConstant(lateSchema),
+        result,
+        drained,
+        lateAwait: async (p) => {
+            // Return immediately; consume the arg later, in the background.
+            void p.then(
+                (v) => setResult(`resolved:${v}`),
+                (e) => setResult(`rejected:${(e as Error).message}`),
+            );
+        },
+        lateDrain: async (g) => {
+            void (async () => {
+                let sum = 0;
+                try {
+                    for await (const n of g) sum += n;
+                    setDrained(`done:${sum}`);
+                } catch (e) {
+                    setDrained(`err:${(e as Error).message}`);
+                }
+            })();
+        },
+    };
+}
+
+describe("S1 — arg consumed after the call completes", () => {
+    it("settles a promise arg instead of hanging the callee", async () => {
+        const { a, b } = createRpcLoopbackTransport();
+        const ea = createRpcEndpoint(a);
+        const eb = createRpcEndpoint(b);
+        ea.expose("late", makeLate(), lateSchema);
+        const svc = eb.consume("late", lateSchema);
+
+        const seen: string[] = [];
+        svc.result((v) => seen.push(v));
+
+        let resolveArg!: (n: number) => void;
+        const arg = new Promise<number>((r) => (resolveArg = r));
+        await svc.lateAwait(arg); // call resolves before the arg is consumed
+        resolveArg(42);
+        await flush();
+
+        expect(seen.at(-1)).not.toBe("pending"); // callee's arg promise must settle
+        ea.close();
+        eb.close();
+    });
+
+    it("terminates a generator arg instead of hanging the callee", async () => {
+        const { a, b } = createRpcLoopbackTransport();
+        const ea = createRpcEndpoint(a);
+        const eb = createRpcEndpoint(b);
+        ea.expose("late", makeLate(), lateSchema);
+        const svc = eb.consume("late", lateSchema);
+
+        const seen: string[] = [];
+        svc.drained((v) => seen.push(v));
+
+        async function* nums() {
+            yield 1;
+            yield 2;
+            yield 3;
+        }
+        await svc.lateDrain(nums());
+        await flush();
+
+        expect(seen.at(-1)).not.toBe("pending"); // callee's for-await must terminate
+        ea.close();
+        eb.close();
+    });
+});
+
+// ---------------------------------------------------------------------------
+// S2: a wire-supplied member path must not reach inherited/prototype members.
+// ---------------------------------------------------------------------------
+interface GreetService extends Service {
+    greet: () => Promise<string>;
+}
+const greetSchema = {
+    type: "object",
+    properties: { greet: { type: "function", signature: { returns: { type: "promise", value: { type: "string" } } } } },
+    required: ["greet"],
+    additionalProperties: false,
+} as const satisfies Schema;
+
+describe("S2 — prototype-chain path traversal", () => {
+    it("rejects path ['constructor'] rather than invoking Object", async () => {
+        const { a, b } = createRpcLoopbackTransport();
+        const ea = createRpcEndpoint(a);
+        const service: GreetService = {
+            serviceName: "greet",
+            schema: Observe.fromConstant(greetSchema),
+            greet: async () => "hi",
+        };
+        ea.expose("greet", service, greetSchema);
+
+        const responses: RpcMessage[] = [];
+        b.onMessage((m) => responses.push(m));
+        b.send({ kind: "call", id: 999, service: "greet", path: ["constructor"], args: [] });
+        await flush();
+
+        const resp = responses.find((m) => "id" in m && m.id === 999);
+        expect(resp?.kind).toBe("reject"); // not a resolve from calling Object()
+        ea.close();
+    });
+});
+
+// ---------------------------------------------------------------------------
+// S4: constructor-typed arguments on a void member are unsupported.
+// ---------------------------------------------------------------------------
+interface VoidArgService extends Service {
+    logObs: (o: Observe<number>) => void;
+}
+const voidArgSchema = {
+    type: "object",
+    properties: {
+        logObs: { type: "function", signature: { parameters: [{ type: "observe", value: { type: "number" } }] } },
+    },
+    required: ["logObs"],
+    additionalProperties: false,
+} as const satisfies Schema;
+
+describe("S4 — constructor arg on a void member", () => {
+    it("throws rather than silently leaking a provider", async () => {
+        const { a, b } = createRpcLoopbackTransport();
+        const ea = createRpcEndpoint(a);
+        const eb = createRpcEndpoint(b);
+        const service: VoidArgService = {
+            serviceName: "voidarg",
+            schema: Observe.fromConstant(voidArgSchema),
+            logObs: () => undefined,
+        };
+        ea.expose("voidarg", service, voidArgSchema);
+        const svc = eb.consume("voidarg", voidArgSchema);
+
+        expect(() => svc.logObs(Observe.fromConstant(1))).toThrowError(/void member/i);
+        ea.close();
+        eb.close();
+    });
+});
+
+// ---------------------------------------------------------------------------
+// N2: a raw value at a constructor position must not be mistaken for a ref.
+// ---------------------------------------------------------------------------
+interface AwaitService extends Service {
+    awaitIt: (p: Promise<number>) => Promise<number>;
+}
+const awaitSchema = {
+    type: "object",
+    properties: {
+        awaitIt: { type: "function", signature: { parameters: [{ type: "promise", value: { type: "number" } }], returns: { type: "promise", value: { type: "number" } } } },
+    },
+    required: ["awaitIt"],
+    additionalProperties: false,
+} as const satisfies Schema;
+
+describe("N2 — raw value at a constructor position", () => {
+    it("passes a bare number through instead of treating it as a ref", async () => {
+        const { a, b } = createRpcLoopbackTransport();
+        const ea = createRpcEndpoint(a);
+        const eb = createRpcEndpoint(b, { defaultTimeoutMs: 250 });
+        const service: AwaitService = {
+            serviceName: "await",
+            schema: Observe.fromConstant(awaitSchema),
+            awaitIt: async (p) => await p,
+        };
+        ea.expose("await", service, awaitSchema);
+        const svc = eb.consume("await", awaitSchema);
+
+        // Caller misuse: a raw number where the schema says `promise`.
+        const untyped = svc as unknown as { awaitIt: (p: unknown) => Promise<number> };
+        expect(await untyped.awaitIt(5)).toBe(5);
+        ea.close();
+        eb.close();
+    });
+});
diff --git a/packages/data-rpc/src/transports/window-transport.test.ts b/packages/data-rpc/src/transports/window-transport.test.ts
index 3a6af560..c4191aba 100644
--- a/packages/data-rpc/src/transports/window-transport.test.ts
+++ b/packages/data-rpc/src/transports/window-transport.test.ts
@@ -40,6 +40,15 @@ describe("createWindowTransport", () => {
         transport.close();
     });
 
+    it("requires an explicit targetOrigin when allowedOrigins is ambiguous (N1)", () => {
+        expect(() => createWindowTransport(window, { allowedOrigins: ["https://a.example", "https://b.example"] })).toThrow();
+        // A single allowed origin (or an explicit targetOrigin) is fine.
+        expect(() => createWindowTransport(window, { allowedOrigins: ["https://a.example"] })).not.toThrow();
+        expect(() =>
+            createWindowTransport(window, { allowedOrigins: ["https://a.example", "https://b.example"], targetOrigin: "https://a.example" }),
+        ).not.toThrow();
+    });
+
     it("stops delivering after close", async () => {
         const transport = createWindowTransport(window, { allowedOrigins: ["https://trusted.example"] });
         const received: RpcMessage[] = [];
diff --git a/packages/data-rpc/src/transports/window-transport.ts b/packages/data-rpc/src/transports/window-transport.ts
index b3d112dd..ae9ed94b 100644
--- a/packages/data-rpc/src/transports/window-transport.ts
+++ b/packages/data-rpc/src/transports/window-transport.ts
@@ -28,8 +28,13 @@ export function createWindowTransport(target: Window, options: WindowTransportOp
     const pending: RpcMessage[] = [];
     let closed = false;
 
-    const targetOrigin =
-        options.targetOrigin ?? (options.allowedOrigins.length === 1 ? options.allowedOrigins[0] : "*");
+    // Never default outbound to "*" — that would post (possibly sensitive) replies
+    // to whatever origin currently occupies the target frame. Require an explicit
+    // targetOrigin unless there is exactly one allowed origin to infer it from.
+    const targetOrigin = options.targetOrigin ?? (options.allowedOrigins.length === 1 ? options.allowedOrigins[0] : undefined);
+    if (targetOrigin === undefined) {
+        throw new Error("createWindowTransport: specify `targetOrigin` when `allowedOrigins` is not exactly one origin");
+    }
 
     const handler = (event: MessageEvent) => {
         if (!options.allowedOrigins.includes(event.origin)) return; // untrusted origin