@almadar/core 11.3.0 → 11.5.0

package/dist/{bus-CRxTnebm.d.ts → bus-__zVNcsp.d.ts}

@@ -1,9 +1,107 @@
 import { z } from 'zod';
-import { E as EventPayloadValue, c as EventPayload, L as LogMeta, R as RuntimeValue, a as JsonObject, J as JsonValue } from './expression-DirYKz-f.js';
-import { c as EntityRow, i as FieldValue, j as ServiceParams, O as OrbitalId, T as TraitId, b as EventId } from './effect-C2VKm6kk.js';
-import { V as Viewer, H as HostAskCompletion, a as EventResponse, E as EventRequest } from './effect-result-BFNANDJ-.js';
-import { P as PayloadField } from './trait-Cv3HTGFL.js';
-import { J as JsonSchema } from './types-wWEqi7vj.js';
+import { b as EventPayloadValue, c as EventPayload, L as LogMeta, J as JsonValue, a as JsonObject } from './expression-DxY6ct3t.js';
+import { V as Viewer, R as RowQuery, Q as QueryCapabilities, c as RowIdPage, d as RowWriteOp, e as RowWriteOutcome, f as RowWriteBatch, W as WriteCapabilities, g as RowCommitWrite, B as BusEventSource, C as ClientEffect, H as HostAskCompletion, D as DeliveryRecord, h as DispatchLog, a as EventResponse, b as EmittedEvent, E as EventRequest, i as RowSetRef } from './effect-result-BvBwmspK.js';
+import { i as FieldValue, c as EntityRow, S as ServiceParams } from './effect-gddySYLX.js';
+import { P as PayloadField } from './trait-Oun4JgeZ.js';
+import { J as JsonSchema } from './types-B-r7Z7Lf.js';
+
+/**
+ * Authenticated user context — what `@user.x` resolves against.
+ *
+ * The canonical shape for the `user` binding root, shared by both execution
+ * paths: the JS interpreter resolves `@user.id` through
+ * `EvaluationContext.user`, and the compiled shell emits `user?.id` against the
+ * `UserContext` its `@app/shared` re-exports from here.
+ *
+ * `id` is the field the behavior library reads for ownership scoping and `role`
+ * the field it reads for capability gating. Auth providers that name the subject
+ * `uid` must normalize at their boundary — {@link normalizeUserContext} does that.
+ *
+ * @packageDocumentation
+ */
+
+/**
+ * What a host's auth provider has resolved the viewer to be — from session
+ * resolution only, never from an interactive sign-in action: `pending` until
+ * the session is known; `anonymous` / `authenticated` once it is; `failed`
+ * when connecting or resolving the session failed; `unavailable` when the host
+ * has no sign-in configured. An `access: authenticated` page mounts only on
+ * `authenticated`.
+ */
+type ViewerAuthority = 'pending' | 'anonymous' | 'authenticated' | 'failed' | 'unavailable';
+/**
+ * The `@user` binding: a {@link Viewer} held flat. Its named fields are the viewer's; each claim is a key holding its
+ * JSON value, readable as `@user.<claim>`. The Rust twin of the conversion is `orbital_core_base::viewer`
+ * (`Viewer::from_user` / `Viewer::to_user`).
+ */
+type UserContext = Omit<Viewer, 'claims'> & {
+    [key: string]: FieldValue;
+};
+/** Zod twin of the generated {@link Viewer}: the record a `.lolo` program names as `Viewer`. */
+declare const ViewerSchema: z.ZodType<Viewer>;
+/**
+ * The identity of an unauthenticated viewer. A resolvable object rather than
+ * `undefined` so a role predicate evaluates to a definite `false` instead of
+ * comparing against nothing.
+ */
+declare const ANONYMOUS_USER: UserContext;
+/** Provider-shaped identity claims, before normalization. */
+type RawUserClaims = {
+    id?: string;
+    uid?: string;
+    email?: string | null;
+    name?: string | null;
+    displayName?: string | null;
+    /** Absent or `null` when the token carries none, as the kernel's `Viewer.role` (`Option`). */
+    role?: string | null;
+    permissions?: string[] | null;
+} & {
+    [key: string]: FieldValue;
+};
+/** Zod twin of `RawUserClaims` — the wire shape of `EventRequest.user`. */
+declare const RawUserClaimsSchema: z.ZodType<RawUserClaims>;
+/**
+ * Normalize provider claims into a {@link UserContext}.
+ *
+ * Firebase (and most OIDC providers) name the subject `uid` and the display name
+ * `displayName`, while every `.lolo` behavior reads `@user.id` / `@user.name`.
+ * Without this normalization `@user.id` is `undefined` against a fully
+ * authenticated request and every ownership filter silently matches no rows.
+ * `uid` is preserved so `@user.uid` keeps working.
+ *
+ * Returns `undefined` for absent or subject-less claims so callers can
+ * distinguish "no auth ran" from "anonymous"; use {@link ANONYMOUS_USER} where a
+ * definite identity is required.
+ */
+declare function normalizeUserContext(claims: RawUserClaims | null | undefined): UserContext | undefined;
+/**
+ * Turn a row of an app's `[identity]` entity into a viewer.
+ *
+ * There is no separate persona shape: an identity row IS the persona
+ * (`Almadar_LOLO_Identity.md` §4.3), so this only guards the one field the
+ * behavior library requires — a non-empty string `id` — and passes every other
+ * declared field through as a `@user.<field>` claim. Rows without a usable id
+ * yield `undefined` rather than a persona nobody can own rows as.
+ */
+declare function personaFromIdentityRow(row: Record<string, FieldValue | undefined>): UserContext | undefined;
+/** Look a persona up in a roster by id, or by role when no id matches. */
+declare function findPersonaInRoster(roster: readonly UserContext[], idOrRole: string): UserContext | undefined;
+/**
+ * Resolve a persona spec — a bare id/role (`Person Id 3`, `moderator`) or a full
+ * JSON `UserContext` — into a viewer. This is the `ALMADAR_PERSONA` contract,
+ * shared by every host that presents an app as somebody.
+ *
+ * The roster is the app's OWN declared personas — the seeded rows of its
+ * `[identity]` entity (`Almadar_LOLO_Identity.md` §4.3) — supplied by the host
+ * that has them in hand (the runtime's live store on the interpreter path, the
+ * schema-derived seed rows on the compiled path). There is no global roster:
+ * an app without an `[identity]` entity resolves only JSON-form specs.
+ *
+ * Throws on anything unresolvable rather than returning `undefined`: "no persona"
+ * and "persona silently ignored" look identical on screen, so a bad spec must
+ * fail at boot instead of rendering as nobody.
+ */
+declare function resolvePersonaSpec(spec: string, roster: readonly UserContext[]): UserContext;
 
 /**
  * Service Contract Types
@@ -155,216 +253,8 @@ type RowPage<T> = {
     /** Rows matching the filters and search, across all pages. */
     total: number;
 };
-/** The comparison members of `StoreFilterOp`. */
-type RowCompareOp = Extract<StoreFilterOp, "==" | "!=" | "<" | "<=" | ">" | ">=">;
-/**
- * A row predicate with two-valued logic: a missing or null field satisfies only `!=` against a
- * non-null value and `isNull: true`, and fails every other leaf, so `not` of a failing leaf holds.
- * Leaves reuse the `StoreFilterOp` meanings: `member` is `in`, `hasElement` is `array-contains`,
- * `contains` is a substring test.
- */
-type RowPredicate = {
-    kind: "compare";
-    field: string;
-    op: RowCompareOp;
-    value: FieldValue;
-} | {
-    kind: "member";
-    field: string;
-    values: FieldValue[];
-} | {
-    kind: "hasElement";
-    field: string;
-    value: FieldValue;
-} | {
-    kind: "contains";
-    field: string;
-    text: string;
-    caseSensitive: boolean;
-} | {
-    kind: "isNull";
-    field: string;
-    isNull: boolean;
-} | {
-    kind: "all";
-    of: RowPredicate[];
-} | {
-    kind: "any";
-    of: RowPredicate[];
-} | {
-    kind: "not";
-    of: RowPredicate;
-} | {
-    kind: "const";
-    value: boolean;
-};
-/** One sort key. Missing and null values sort last in both directions; ties break by `id` ascending. A query with no `order` is ordered by `createdAt` ascending, then `id` (EXEC-FETCH-1). */
-type RowOrder = {
-    field: string;
-    direction: "asc" | "desc";
-};
-/**
- * A vector-similarity query: up to `k` rows ordered by descending cosine similarity of `field` to `vector`
- * (EXEC-FETCH-2). A row whose field is absent, null or of zero norm is skipped; a stored vector that is not a
- * `[number]` of the query's length, a zero-norm query or a non-positive `k` fails.
- */
-type RowNearest = {
-    field: string;
-    vector: number[];
-    k: number;
-};
-/**
- * A pushed-down query: rows matching `policy` AND `filter`, ordered, then windowed. `policy` is the
- * entity's `@read` predicate already specialised to the viewer; `filter` is the call-site filter.
- */
-type RowQuery = {
-    policy?: RowPredicate;
-    filter?: RowPredicate;
-    /** Absent = `createdAt` ascending, then `id` ascending (EXEC-FETCH-1). */
-    order?: RowOrder;
-    offset?: number;
-    /** Absent = no limit. */
-    limit?: number;
-    /** Absent = `exact`. With `none` the store need not count; `total` is then only the window's size. */
-    total?: RowTotalMode;
-    /** The nearest `k` rows among those `policy` and `filter` admit. Excludes `order`, `offset` and `limit`; `total` is the count returned. */
-    nearest?: RowNearest;
-};
 /** The answer to a `RowQuery`: the window, and `total` = every match before the window. */
 type RowQueryPage = RowPage<EntityRow>;
-/** Value kinds a store can compare, in `compare`/`member`/`hasElement` operands. */
-type RowValueKind = "string" | "number" | "boolean" | "date" | "null";
-/** Every operator a `RowPredicate` leaf can carry. */
-type RowOperator = RowCompareOp | "member" | "hasElement" | "contains";
-/** The value kinds one operator accepts on a store; an operator not listed accepts every kind. */
-type OperatorValueKinds = {
-    operator: RowOperator;
-    valueKinds: RowValueKind[];
-};
-/** Whether `total` counts every match (`exact`, the default) or the store may skip the count (`none`). */
-type RowTotalMode = "exact" | "none";
-/** What an adapter's `queryPage` honours for one entity type. */
-type QueryCapabilities = {
-    leaves: ("compare" | "member" | "hasElement" | "contains" | "isNull")[];
-    combinators: ("all" | "any" | "not")[];
-    compareOps: RowCompareOp[];
-    /** Per operator x value kind restrictions; absent = every kind for every declared operator. */
-    operatorValueKinds?: OperatorValueKinds[];
-    orderableFields: {
-        kind: "every-field";
-    } | {
-        kind: "listed";
-        fields: string[];
-    };
-    /** offset and limit. */
-    window: boolean;
-    /** `total` counts every match, not the window. Needed only for `total: exact` queries. */
-    exactTotal: boolean;
-    /** `queryIds` is implemented. */
-    idsOnly?: boolean;
-    /** `nearest` is pushed down: the store ranks by cosine similarity itself (EXEC-FETCH-2). */
-    nearest?: boolean;
-};
-/** The answer to a `queryIds`: the window's ids in order, and `total` as in `RowQueryPage`. */
-type RowIdPage = {
-    ids: string[];
-    total: number;
-};
-/**
- * One write. `create` fails (`duplicate-id`) when its id is taken. `upsert` creates the row or replaces it
- * whole by id (`created` / `updated`), keeping the existing `createdAt`. `update` changes an existing row only
- * (never an upsert) and merges `data` over it with `id` stamped last; `guard` is tested against the pre-image.
- * `delete` likewise. Native `rekey` moves an existing id with insertion-order collision semantics; support is explicit.
- */
-type RowWriteOp = {
-    kind: "create";
-    entityType: string;
-    data: EntityRow;
-} | {
-    kind: "upsert";
-    entityType: string;
-    data: EntityRow;
-} | {
-    kind: "update";
-    entityType: string;
-    id: string;
-    data: EntityRow;
-    guard?: RowPredicate;
-} | {
-    kind: "delete";
-    entityType: string;
-    id: string;
-    guard?: RowPredicate;
-} | {
-    kind: "rekey";
-    entityType: string;
-    id: string;
-    newId: string;
-    guard?: RowPredicate;
-};
-/**
- * What one write did. `before` (the pre-image) is present exactly when the op carried a guard.
- * `rolled-back` is only produced inside an `atomic` batch that failed: the op had succeeded and was undone.
- */
-type RowWriteOutcome = {
-    kind: "created";
-    row: EntityRow;
-} | {
-    kind: "updated";
-    row: EntityRow;
-    before?: EntityRow;
-} | {
-    kind: "deleted";
-    before?: EntityRow;
-} | {
-    kind: "not-found";
-} | {
-    kind: "duplicate-id";
-} | {
-    kind: "refused";
-} | {
-    kind: "failed";
-    message: string;
-} | {
-    kind: "rolled-back";
-};
-/**
- * `atomic`: all ops apply or none do (a `persist batch`); on failure the outcomes are `rolled-back` for
- * every earlier op, then the failing outcome, and nothing is written.
- * `stop`: ops apply in order and stop at the first failure; earlier ops stay applied, later ones are
- * not attempted and have no outcome (a run of plain `persist` effects).
- */
-type RowWriteFailureMode = "atomic" | "stop";
-type RowWriteBatch = {
-    ops: RowWriteOp[];
-    onFailure: RowWriteFailureMode;
-};
-/** What an adapter's `writeWhere`/`writeBatch` honours for one entity type. */
-type WriteCapabilities = {
-    /** The guard predicates the store can test; a `Pick` of the query capabilities. */
-    guards: Pick<QueryCapabilities, "leaves" | "combinators" | "compareOps">;
-    /** `writeWhere` tests the guard and the existence of the row in one step. */
-    conditional: boolean;
-    /** Outcomes carry the written row. */
-    returnsRow: boolean;
-    /** `writeBatch` with `onFailure: "stop"`. */
-    stopRuns: boolean;
-    /** `writeBatch` with `onFailure: "atomic"`; needs transactions. */
-    atomicBatch: boolean;
-    /** Native id moves; absent means unsupported. */
-    rekey?: boolean;
-    /** The store commits rows the kernel decided (`commitRows`) and holds no write semantics (EXEC-STORE-5). */
-    commitRows?: boolean;
-};
-/** What a compare-and-commit does to one row the kernel read. */
-type RowCommitWrite = {
-    kind: "keep";
-} | {
-    kind: "put";
-    row: EntityRow;
-} | {
-    kind: "delete";
-};
 /** One row of a compare-and-commit: the version the kernel read (`null` when absent) and what it writes (EXEC-STORE-5). */
 type RowCommit = {
     entityType: string;
@@ -470,125 +360,6 @@ interface LazyService<T> {
  */
 declare function createLazyService<T>(factory: () => T): LazyService<T>;
 
-/**
- * A fetched page by reference: `ids` = the window in order, `total` = matches before the window at
- * dispatch time, `query` = what produced it (its predicates, incl. the @read policy, re-count `total`; order and window are ignored).
- */
-type RowSetRef = {
-    entityType: string;
-    ids: string[];
-    total: number;
-    query: RowQuery;
-};
-declare const RowSetRefSchema: z.ZodType<RowSetRef>;
-/** Tag property of a `RowSetMarker`; `$`-prefixed so it never collides with a pattern prop key. */
-declare const ROW_SET_MARKER: "$rowSet";
-/** A render prop leaf resolved to rows at paint time by the kernel (`@read` applied there). */
-type RowSetMarker = {
-    readonly [ROW_SET_MARKER]: true;
-    readonly ref: RowSetRef;
-};
-declare function rowSetMarker(ref: RowSetRef): RowSetMarker;
-declare function isRowSetMarker(value: RuntimeValue): value is RowSetMarker;
-
-/**
- * Authenticated user context — what `@user.x` resolves against.
- *
- * The canonical shape for the `user` binding root, shared by both execution
- * paths: the JS interpreter resolves `@user.id` through
- * `EvaluationContext.user`, and the compiled shell emits `user?.id` against the
- * `UserContext` its `@app/shared` re-exports from here.
- *
- * `id` is the field the behavior library reads for ownership scoping and `role`
- * the field it reads for capability gating. Auth providers that name the subject
- * `uid` must normalize at their boundary — {@link normalizeUserContext} does that.
- *
- * @packageDocumentation
- */
-
-/**
- * What a host's auth provider has resolved the viewer to be — from session
- * resolution only, never from an interactive sign-in action: `pending` until
- * the session is known; `anonymous` / `authenticated` once it is; `failed`
- * when connecting or resolving the session failed; `unavailable` when the host
- * has no sign-in configured. An `access: authenticated` page mounts only on
- * `authenticated`.
- */
-type ViewerAuthority = 'pending' | 'anonymous' | 'authenticated' | 'failed' | 'unavailable';
-/**
- * The `@user` binding: a {@link Viewer} held flat. Its named fields are the viewer's; each claim is a key holding its
- * JSON value, readable as `@user.<claim>`. The Rust twin of the conversion is `orbital_core_base::viewer`
- * (`Viewer::from_user` / `Viewer::to_user`).
- */
-type UserContext = Omit<Viewer, 'claims'> & {
-    [key: string]: FieldValue;
-};
-/** Zod twin of the generated {@link Viewer}: the record a `.lolo` program names as `Viewer`. */
-declare const ViewerSchema: z.ZodType<Viewer>;
-/**
- * The identity of an unauthenticated viewer. A resolvable object rather than
- * `undefined` so a role predicate evaluates to a definite `false` instead of
- * comparing against nothing.
- */
-declare const ANONYMOUS_USER: UserContext;
-/** Provider-shaped identity claims, before normalization. */
-type RawUserClaims = {
-    id?: string;
-    uid?: string;
-    email?: string | null;
-    name?: string | null;
-    displayName?: string | null;
-    /** Absent or `null` when the token carries none, as the kernel's `Viewer.role` (`Option`). */
-    role?: string | null;
-    permissions?: string[] | null;
-} & {
-    [key: string]: FieldValue;
-};
-/** Zod twin of `RawUserClaims` — the wire shape of `EventRequest.user`. */
-declare const RawUserClaimsSchema: z.ZodType<RawUserClaims>;
-/**
- * Normalize provider claims into a {@link UserContext}.
- *
- * Firebase (and most OIDC providers) name the subject `uid` and the display name
- * `displayName`, while every `.lolo` behavior reads `@user.id` / `@user.name`.
- * Without this normalization `@user.id` is `undefined` against a fully
- * authenticated request and every ownership filter silently matches no rows.
- * `uid` is preserved so `@user.uid` keeps working.
- *
- * Returns `undefined` for absent or subject-less claims so callers can
- * distinguish "no auth ran" from "anonymous"; use {@link ANONYMOUS_USER} where a
- * definite identity is required.
- */
-declare function normalizeUserContext(claims: RawUserClaims | null | undefined): UserContext | undefined;
-/**
- * Turn a row of an app's `[identity]` entity into a viewer.
- *
- * There is no separate persona shape: an identity row IS the persona
- * (`Almadar_LOLO_Identity.md` §4.3), so this only guards the one field the
- * behavior library requires — a non-empty string `id` — and passes every other
- * declared field through as a `@user.<field>` claim. Rows without a usable id
- * yield `undefined` rather than a persona nobody can own rows as.
- */
-declare function personaFromIdentityRow(row: Record<string, FieldValue | undefined>): UserContext | undefined;
-/** Look a persona up in a roster by id, or by role when no id matches. */
-declare function findPersonaInRoster(roster: readonly UserContext[], idOrRole: string): UserContext | undefined;
-/**
- * Resolve a persona spec — a bare id/role (`Person Id 3`, `moderator`) or a full
- * JSON `UserContext` — into a viewer. This is the `ALMADAR_PERSONA` contract,
- * shared by every host that presents an app as somebody.
- *
- * The roster is the app's OWN declared personas — the seeded rows of its
- * `[identity]` entity (`Almadar_LOLO_Identity.md` §4.3) — supplied by the host
- * that has them in hand (the runtime's live store on the interpreter path, the
- * schema-derived seed rows on the compiled path). There is no global roster:
- * an app without an `[identity]` entity resolves only JSON-form specs.
- *
- * Throws on anything unresolvable rather than returning `undefined`: "no persona"
- * and "persona silently ignored" look identical on screen, so a bad spec must
- * fail at boot instead of rendering as nobody.
- */
-declare function resolvePersonaSpec(spec: string, roster: readonly UserContext[]): UserContext;
-
 declare const ExternalInputSchema: z.ZodObject<{
     orbital: z.ZodString;
     trait: z.ZodString;
@@ -703,6 +474,26 @@ declare const PayloadJsonSchemaSchema: z.ZodType<JsonSchema>;
  * `getSymbolAtLocation`.
  */
 type EventKey = string;
+/**
+ * Name of a field of the entity a component is bound to. A marker for a prop
+ * or item property whose value is a field name (not arbitrary text), such as
+ * the field a grid groups by or a filter applies to.
+ *
+ * Plain alias over `string`, not branded, for the same reason as `EventKey`:
+ * field names come from user data at runtime, so cast friction would buy
+ * nothing. The pattern-sync tool finds it by type identity and writes
+ * `kind: "field-ref"` into the patterns registry.
+ */
+type EntityFieldName = string;
+/** The name of a field of the rows held by the sibling prop `P` (`RowFieldName<'lineItems'>`). */
+type RowFieldName<P extends string> = string;
+/**
+ * User-visible text a component paints (a label, title or message), as
+ * opposed to an identifier, key or class name. A marker alias over `string`,
+ * found by type identity; the pattern-sync tool writes `kind: "text"` into
+ * the patterns registry.
+ */
+type VisibleText = string;
 /**
  * Phantom-typed brand for declarative bus-emit props on UI components.
  *
@@ -763,90 +554,7 @@ type EventEmit<P> = string & {
 type EventListen<P> = string & {
     readonly __listenPayload?: P;
 };
-/**
- * Identifies the origin of a bus event. Used by cross-trait listeners to
- * filter emits from specific orbitals, traits, transitions, or ticks.
- *
- * `transition` and `tick` are optional runtime-internal details; most
- * consumers only care about `orbital` and `trait`.
- */
-type BusEventSource = {
-    orbital?: string;
-    /** V4 dual-carry id sibling of `orbital` — stable across an orbital rename. */
-    orbitalId?: OrbitalId;
-    trait?: string;
-    /** V4 dual-carry id sibling of `trait` — stable across a trait rename. */
-    traitId?: TraitId;
-    /** V4 dual-carry id of the emitted event — stable across an event rename. */
-    eventId?: EventId;
-    transition?: string;
-    tick?: string;
-    /**
-     * True when the orbital bridge re-broadcasts an event onto the bus
-     * (any source — both echoes of the dispatched event and server-side
-     * cascade emits via `(emit X)` / `fetch.emit.success`). Cross-trait
-     * listeners filter on this flag so the click-time qualified emit
-     * (which has no `fromBridge`) doesn't double-fire alongside the
-     * post-server bridge confirmation. See `dispatched` for the narrower
-     * "echo of the just-dispatched event" signal.
-     */
-    fromBridge?: boolean;
-    /**
-     * True ONLY for bridge echoes the receiving tab already processed, so
-     * the originating trait's self-subscription skips them instead of
-     * re-dispatching its own echo (infinite loop / double execution).
-     * Set by path 1 of useOrbitalBridge (compiled shell — echo of the
-     * just-dispatched event; server-side cascade emits there carry
-     * `fromBridge: true` but NOT `dispatched`, so they still reach the
-     * source trait's transition handler, e.g. `loading -> browsing` on a
-     * fetch's `emit.success`) and by ServerBridge (runtime path — stamped
-     * on exactly one response-cascade echo per event the dispatch delivered
-     * locally on the bare key, `stampLocallyDeliveredEchoes`; server-only
-     * results stay unstamped). Cross-trait `listens` never filter on this
-     * flag, so their delivery is unaffected. Push-leg events from OTHER
-     * tabs (multiplayer) are never stamped.
-     */
-    dispatched?: boolean;
-    /**
-     * The client that originated the dispatch whose effects emitted this
-     * event (from `EventRequest.clientId`); absent for headless
-     * dispatches (ticks, circuit-router probes, walkers). The server-side
-     * listens fan-out skips client-originated cascade emits — under dual
-     * execution the originating client relays every cascade hop through the
-     * bridge itself, so the server dispatching the same hop double-ran it
-     * (one Send persisted two rows). Headless topology keeps the fan-out:
-     * there is no client to drive the circuit.
-     */
-    originClientId?: string;
-    /**
-     * Per-activation key a UI control stamps on the event it emits, so it can
-     * show its own busy state for exactly as long as the dispatches that event
-     * started are in flight (`@almadar/ui` lib/pendingDispatch). Never set by
-     * the bridge or the server.
-     */
-    pendingKey?: string;
-    /**
-     * Set by a server-role kernel on a `persist` effect's `emit.success` envelope: the one emit a live-push
-     * host (`setLiveBroadcastSink`) also fans out to every other connected client.
-     */
-    persistSuccess?: boolean;
-    /**
-     * The row of the emitting trait's entity that made the emit, when the trait's rows are addressed by a `per`
-     * listener. A listener with a `per` clause evaluates its own key; one without ignores this.
-     */
-    instanceKey?: string;
-};
-/** The delivery a transition is processing: `@event`, and one element of `@prevEvents` (Runtime Spec Clause 5.5). */
-type DeliveryRecord = {
-    event: string;
-    payload?: EventPayload;
-    source: BusEventSource;
-};
-/** A trait's log so far in a dispatch that began elsewhere (`@prevEvents` / `@prevStates`), carried on the request. */
-type DispatchLog = {
-    prevEvents: DeliveryRecord[];
-    prevStates: string[];
-};
+
 /** Zod twin of `BusEventSource`. */
 declare const BusEventSourceSchema: z.ZodType<BusEventSource, object>;
 /** Zod twin of `DeliveryRecord`. */
@@ -874,18 +582,7 @@ type BusEvent = {
 type BusEventListener = (event: BusEvent) => void;
 /** Returned by `on()` / `once()` to detach a listener. */
 type Unsubscribe = () => void;
-/**
- * One event a transition's effects emitted, carried back to the client to
- * re-dispatch (in order) so the state machine advances through the
- * cascade without server-side recursion. Named/shaped to match the
- * generated compiled-path `EmittedEvent` (orbital-shell-typescript's
- * `shared/types.ts`) so the two execution paths agree on one shape.
- */
-type EmittedEvent = {
-    event: string;
-    payload?: EventPayload;
-    source?: BusEventSource;
-};
+
 /** Zod twin of `EmittedEvent`. Third type param `object`, see `BusEventSourceSchema`. */
 declare const EmittedEventSchema: z.ZodType<EmittedEvent, object>;
 /**
@@ -914,7 +611,8 @@ type ClientNavigateBackTuple = ['navigate-back'];
 /** A `runsOn: client` host-port effect (`auth/sign-out`, `audio/*`) the client host answers; its arguments are resolved. */
 type ClientHostAskTuple = ['host-ask', string, JsonValue[]] | ['host-ask', string, JsonValue[], HostAskCompletion];
 
-type ClientEffectTuple = ClientRenderUITuple | ClientNavigateTuple | ClientNavigateBackTuple | ClientHostAskTuple;
+/** The effect tuple shipped in `EventResponse.clientEffectsByTrait`: the generated kernel wire `ClientEffect`, one copy. */
+type ClientEffectTuple = ClientEffect;
 /** Zod twin of `ClientRenderUITuple`. */
 declare const ClientRenderUITupleSchema: z.ZodTuple<[z.ZodLiteral<"render-ui">, z.ZodString, z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>>], null>;
 /** Zod twin of `ClientNavigateTuple` — one variant per fixed arity (2/3/4), unioned. */
@@ -951,11 +649,7 @@ declare function normalizeEventKey(eventKey: string): string;
 /** The event a tick firing carries on the wire (`EventRequest.event` of a `runTick` leg). */
 declare function tickEventKey(tickName: string): string;
 type LifecycleEvent = (typeof LIFECYCLE_EVENTS)[number];
-/** One trait of a mount batch and the lifecycle event it runs. */
-type MountSeed = {
-    trait: string;
-    event: LifecycleEvent;
-};
+
 declare const MountSeedSchema: z.ZodObject<{
     trait: z.ZodString;
     event: z.ZodEnum<{
@@ -1002,7 +696,7 @@ declare const EventStreamItemSchema: z.ZodUnion<readonly [z.ZodObject<{
     timestamp: z.ZodNumber;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"effect">;
-    data: z.ZodType<ClientEffectTuple, unknown, z.core.$ZodTypeInternals<ClientEffectTuple, unknown>>;
+    data: z.ZodType<ClientEffect, unknown, z.core.$ZodTypeInternals<ClientEffect, unknown>>;
     timestamp: z.ZodNumber;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"complete">;
@@ -1049,10 +743,11 @@ interface ServiceHostPorts {
      * A `program/dispatch` event request (owner, 2026-10-21): dispatch `request` on `orbital` as the HTTP events
      * route does (`input: true` admits only a declared external input, as the inputs route). `request` is what the kernel
      * parsed (`EventRequest::from_dispatch`); its `user` is the dispatch's viewer when the call names one.
+     * `wire` answers a browser: the response is the kernel's client view (EXEC-DIST-8).
      * A host that does not serve event requests leaves it out.
      */
     supportsDispatchStream?: true;
-    dispatchRequest?(orbital: string, request: EventRequest, input: boolean, stream?: boolean): Promise<DispatchRequestOutcome>;
+    dispatchRequest?(orbital: string, request: EventRequest, input: boolean, stream?: boolean, wire?: boolean): Promise<DispatchRequestOutcome>;
     /** A `program/dispatch { inbound }` delivery through the inbound route, credential check and answer path. */
     deliverInbound?(name: string, delivery: {
         headers: Readonly<Record<string, string>>;
@@ -1110,5 +805,5 @@ interface LiveBroadcastItem {
 /** Zod twin of `LiveBroadcastItem`. Third type param `object`, see `BusEventSourceSchema`. */
 declare const LiveBroadcastItemSchema: z.ZodType<LiveBroadcastItem, object>;
 
-export { PayloadJsonSchemaSchema as $, ANONYMOUS_USER as A, InboundFoundSchema as G, HostAskCompletionSchema as H, InboundOnlySchema as J, InboundRouteSchema as M, LIFECYCLE_EVENTS as N, LiveBroadcastItemSchema as Q, MountSeedSchema as S, NameListSchema as T, OptionalNameSchema as W, OrbitalRegisterResponseSchema as Y, PayloadIssueSchema as _, ROW_SET_MARKER as a3, RawUserClaimsSchema as a5, UNMOUNT_EVENT as aA, ViewerSchema as aD, createLazyService as aF, createTypedEventBus as aG, findPersonaInRoster as aH, isRowSetMarker as aI, normalizeEventKey as aJ, normalizeUserContext as aK, personaFromIdentityRow as aL, resolvePersonaSpec as aM, rowSetMarker as aN, tickEventKey as aO, RowSetRefSchema as aj, ServerTopologySchema as ar, BusEventSourceSchema as d, ClientEffectTupleSchema as e, ClientHostAskTupleSchema as g, ClientNavigateBackTupleSchema as i, ClientNavigateTupleSchema as k, ClientRenderUITupleSchema as m, DeliveryRecordSchema as n, DispatchLogSchema as p, EmittedEventSchema as r, EventStreamItemSchema as v, ExternalInputSchema as y, InboundAnswerSchema as z };
-export type { BusEvent as B, ClientEffectTuple as C, DeliveryRecord as D, EventStreamItem as E, InboundDelivery as F, InboundAnswer as I, InboundRoute as K, LiveBroadcastItem as L, LazyService as O, LifecycleEvent as P, MountSeed as R, UserContext as U, OperatorValueKinds as V, OrbitalRegisterResponse as X, PayloadIssue as Z, EmittedEvent as a, PersistActionName as a0, PersistenceAdapter as a1, QueryCapabilities as a2, RawUserClaims as a4, RowCommit as a6, RowCommitWrite as a7, RowCompareOp as a8, RowIdPage as a9, Unsubscribe as aB, ViewerAuthority as aC, WriteCapabilities as aE, RowOperator as aa, RowOrder as ab, RowPage as ac, RowPageRequest as ad, RowPredicate as ae, RowQuery as af, RowQueryPage as ag, RowSetMarker as ah, RowSetRef as ai, RowTotalMode as ak, RowValueKind as al, RowWriteBatch as am, RowWriteFailureMode as an, RowWriteOp as ao, RowWriteOutcome as ap, ServerTopology as aq, ServiceAction as as, ServiceActionName as at, ServiceContract as au, ServiceEvents as av, ServiceHostPorts as aw, StoreContract as ax, StoreFilter as ay, StoreFilterOp as az, BusEventListener as b, BusEventSource as c, ClientHostAskTuple as f, ClientNavigateBackTuple as h, ClientNavigateTuple as j, ClientRenderUITuple as l, DispatchLog as o, DispatchRequestOutcome as q, EventEmit as s, EventKey as t, EventListen as u, ExternalInput as w, ExternalInputRequest as x };
+export { ANONYMOUS_USER as A, DeliveryRecordSchema as D, InboundRouteSchema as G, HostAskCompletionSchema as H, LIFECYCLE_EVENTS as J, LiveBroadcastItemSchema as N, MountSeedSchema as O, NameListSchema as P, OptionalNameSchema as Q, OrbitalRegisterResponseSchema as S, PayloadIssueSchema as V, PayloadJsonSchemaSchema as W, RawUserClaimsSchema as _, ServerTopologySchema as a5, UNMOUNT_EVENT as ae, ViewerSchema as ah, createLazyService as aj, createTypedEventBus as ak, findPersonaInRoster as al, normalizeEventKey as am, normalizeUserContext as an, personaFromIdentityRow as ao, resolvePersonaSpec as ap, tickEventKey as aq, BusEventSourceSchema as b, ClientEffectTupleSchema as c, ClientHostAskTupleSchema as e, ClientNavigateBackTupleSchema as g, ClientNavigateTupleSchema as i, ClientRenderUITupleSchema as k, DispatchLogSchema as l, EmittedEventSchema as n, EventStreamItemSchema as s, ExternalInputSchema as v, InboundAnswerSchema as w, InboundFoundSchema as y, InboundOnlySchema as z };
+export type { RowCommit as $, BusEvent as B, ClientEffectTuple as C, EventStreamItem as E, InboundRoute as F, InboundAnswer as I, LazyService as K, LiveBroadcastItem as L, LifecycleEvent as M, OrbitalRegisterResponse as R, PayloadIssue as T, UserContext as U, PersistActionName as X, PersistenceAdapter as Y, RawUserClaims as Z, BusEventListener as a, RowFieldName as a0, RowPage as a1, RowPageRequest as a2, RowQueryPage as a3, ServerTopology as a4, ServiceAction as a6, ServiceActionName as a7, ServiceContract as a8, ServiceEvents as a9, ServiceHostPorts as aa, StoreContract as ab, StoreFilter as ac, StoreFilterOp as ad, Unsubscribe as af, ViewerAuthority as ag, VisibleText as ai, ClientHostAskTuple as d, ClientNavigateBackTuple as f, ClientNavigateTuple as h, ClientRenderUITuple as j, DispatchRequestOutcome as m, EntityFieldName as o, EventEmit as p, EventKey as q, EventListen as r, ExternalInput as t, ExternalInputRequest as u, InboundDelivery as x };