@almadar/shell-node 0.0.0-stage → 1.0.0

package/dist/createProgramHandlers.d.ts

@@ -0,0 +1,28 @@
+import { EffectHandlers } from '@almadar/shell-runtime';
+
+/**
+ * Program host handlers — server-side only.
+ *
+ * Backs the language trio's effects (behavior/catalog|describe|source,
+ * program/read|print|eval) with the one host implementation in
+ * `host/program`, which runs the installed `orb` from the
+ * project directory. Its workspaces are `std-workspace` run by the kernel
+ * (`kernelWorkspaceHost`). Wired by OrbitalServerRuntime
+ * (lazy import, merged under user handlers).
+ *
+ * NOT exported from the main index.ts because it spawns processes.
+ *
+ * @packageDocumentation
+ */
+
+interface ProgramHostConfig {
+    /** Project root `orb` resolves behavior packages from. */
+    cwd: string;
+    /** Explicit `orb` binary; defaults to the host's resolution order. */
+    orbBin?: string;
+}
+type ProgramHandlers = Pick<EffectHandlers, 'programEffect'>;
+declare function createProgramHandlers(host: ProgramHostConfig): ProgramHandlers;
+
+export { createProgramHandlers };
+export type { ProgramHandlers, ProgramHostConfig };

package/dist/createProgramHandlers.js

@@ -0,0 +1,6 @@
+export { createProgramHandlers } from './chunk-7QG7JGKQ.js';
+import './chunk-YLFK5OJN.js';
+import './chunk-VQVAHUAX.js';
+import './chunk-EEYGL7AB.js';
+import './chunk-7QE32QQR.js';
+import './chunk-BWMLDDCL.js';

package/dist/index.d.ts

@@ -0,0 +1,301 @@
+import { CredentialVaultModule, CredentialVault, CredentialRowsPort, OsAnchors, OsGrantPort, OsHostPort, TokenEndpointPost, KernelModule, NativeMemoryPersistenceAdapter, ServiceCallContext, StepRequest, PlayedStep, ProgramValidationReport, ProgramEffectName, ProgramEffectOutcome } from '@almadar/shell-runtime';
+import { JsonValue, KernelMemoryStoreExports, OrbitalSchema, EvaluatedProgram, ProgramValidationIssue, CatalogScope, CatalogEntry, DependencyGraph, TraitValue, TraitDescription, DescribeTarget, BehaviorDescription } from '@almadar/core';
+export { ClientEffectTuple, ClientNavigateBackTuple, ClientNavigateTuple, ClientRenderUITuple, EventRequest, EventResponse, TransitionRejection } from '@almadar/core';
+import { RequestOptions } from 'node:https';
+import { IncomingMessage, ClientRequest } from 'node:http';
+import { OsGrantsReport, ProveReport, StepRefusal } from '@almadar/core/kernel-wire';
+import { LayoutStrategy } from '@almadar/core/builders';
+export { K as KernelProgram, a as KernelProgramOptions, b as KernelWorkspaceBucket, c as KernelWorkspaceHostOptions, P as ProgramRun, W as WorkspaceHost, d as WorkspacePort, e as emitPayload, i as installWorkspaceHost, f as installedWorkspaceHost, k as kernelWorkspaceHost, r as resolveProgramFile, u as uninstallWorkspaceHost, w as workspaceBucketFromEnv, g as workspaceOwnerSegment, h as workspacesRoot } from './kernel-workspace-host-cT9JGJur.js';
+export { HostDispatchItem, LiveBroadcastItem, LoaderConfig, OrbitalServerRuntime, OrbitalServerRuntimeConfig, PushItem, RegisterOptions, RegisteredOrbital, RuntimeOrbital, RuntimeOrbitalSchema, UnresolvedProgramError } from './OrbitalServerRuntime.js';
+export { ProgramHandlers, ProgramHostConfig, createProgramHandlers } from './createProgramHandlers.js';
+
+/** Install the Node ports `@almadar/shell-runtime` leaves open: per-tenant credential scopes. Idempotent. */
+declare function installNodeHostPorts(): void;
+interface NodeCredentialVaultOptions {
+    /** The kernel module that carries the vault class (`@almadar/kernel`, initialised). */
+    kernel: CredentialVaultModule;
+    /** Defaults to the process env, which the native host reads the same keys and file from. */
+    env?: Record<string, string | undefined>;
+    /** Defaults to the working directory, where the native host looks for `.almadar/dev-credentials.json`. */
+    cwd?: string;
+}
+/**
+ * The durable credential vault of a Node host, as the native host opens it: the key in `ALMADAR_CREDENTIAL_MASTER_KEY`
+ * (and `..._PREVIOUS` in a rotation window), the rows in the encrypted file `ALMADAR_CREDENTIALS_FILE` names, else
+ * `.almadar/dev-credentials.json`, so one file serves both hosts. With no master key set the host has no store and this
+ * answers `null`; a key that is not 64 hex digits, or a row the kernel cannot read, rejects. The vault is installed as the
+ * process-wide credential store.
+ */
+declare function installNodeCredentialVault(options: NodeCredentialVaultOptions): Promise<CredentialVault | null>;
+
+declare const DEFAULT_CREDENTIALS_FILE = ".almadar/dev-credentials.json";
+/** `ALMADAR_CREDENTIALS_FILE`, else `.almadar/dev-credentials.json` under the working directory, as the native host resolves it. */
+declare function credentialsFilePath(env?: Record<string, string | undefined>, cwd?: string): string;
+/**
+ * The kernel's credential rows kept in a JSON file, the layout the native host writes: an array of rows each carrying an
+ * `id`, written whole through a temporary file and a rename. A missing file is no rows; a file that cannot be read, is not
+ * JSON, is not an array of rows or holds a row without an id is a failure. Operations here run one after another, so the
+ * conditional delete is atomic against every other port over the same file in this process; a second process is not
+ * covered, as with the native host.
+ */
+declare function fileCredentialRows(path: string): CredentialRowsPort;
+
+/**
+ * A development host's credential-store master key: read from `<dir>/dev-credential-master-key`,
+ * generated there (owner-only) on first use. Production must hold its key in the platform secret
+ * store, so this refuses under NODE_ENV=production.
+ */
+declare function loadOrCreateDevMasterKey(dir: string): string;
+
+/** One program instance's `os` host: its own handle tables, closed by `close`. */
+interface NodeOsHostOptions {
+    /** Where `~/` and `./` and the declared grant anchors are placed; absent, the process's own (`OsAnchors::of_process`). */
+    anchors?: OsAnchors;
+}
+/** The process's home, working directory, executable directory and environment, read once (`OsAnchors::of_process`). */
+declare function processAnchors(): OsAnchors;
+declare function createNodeOsHost(grants: OsGrantPort, options?: NodeOsHostOptions): OsHostPort;
+
+type KvErrorKind = 'denied' | 'invalid' | 'io' | 'timeout' | 'unsupported' | 'closed';
+type KvResult<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    error: string;
+    kind: KvErrorKind;
+};
+interface KvNamespace {
+    app: string;
+    locale: string;
+    store: string;
+}
+interface KvScanEntry {
+    key: string;
+    value: JsonValue;
+}
+type KvBatchOp = {
+    kind: 'put';
+    key: string;
+    value: JsonValue;
+} | {
+    kind: 'delete';
+    key: string;
+};
+declare class KvFailure extends Error {
+    readonly kind: KvErrorKind;
+    constructor(kind: KvErrorKind, message: string);
+}
+/** A namespace's whole content, key order = UTF-8 byte order. Backends load and commit it whole. */
+type KvTable = Map<string, JsonValue>;
+interface KvBackend {
+    load(ns: KvNamespace): Promise<KvTable>;
+    /** Replace the namespace content atomically: a failure leaves the previous content. */
+    commit(ns: KvNamespace, table: KvTable): Promise<void>;
+}
+declare function memoryKvBackend(): KvBackend;
+declare function directoryKvBackend(stateDir: string): KvBackend;
+interface KvHost {
+    get(ns: KvNamespace, key: string): Promise<KvResult<{
+        found: boolean;
+        value?: JsonValue;
+    }>>;
+    put(ns: KvNamespace, key: string, value: JsonValue): Promise<KvResult<{
+        storedKey: string;
+    }>>;
+    delete(ns: KvNamespace, key: string): Promise<KvResult<{
+        existed: boolean;
+    }>>;
+    scan(ns: KvNamespace, prefix: string, limit?: number): Promise<KvResult<{
+        entries: KvScanEntry[];
+    }>>;
+    batch(ns: KvNamespace, ops: readonly KvBatchOp[]): Promise<KvResult<{
+        applied: number;
+    }>>;
+}
+declare function createKvHost(backend: KvBackend): KvHost;
+
+interface ResolvedAddress {
+    address: string;
+    family: number;
+}
+interface NodeTokenPostOptions {
+    /** The kernel's egress rule over the program's declared origins. */
+    egressAllows(url: string): boolean;
+    /** The kernel's public-address rule. */
+    isPublicAddress(ip: string): boolean;
+    request?: (options: RequestOptions, onResponse: (response: IncomingMessage) => void) => ClientRequest;
+    resolve?: (host: string) => Promise<ResolvedAddress[]>;
+}
+declare class TokenPostRefusal extends Error {
+    constructor(message: string);
+}
+declare function createNodeTokenPost(options: NodeTokenPostOptions): TokenEndpointPost;
+
+/** The whole server kernel as Node loads it: the shared module plus the server-only exports the client build omits. */
+interface LoadedKernel extends KernelModule, KernelMemoryStoreExports {
+    initSync(input: {
+        module: Uint8Array;
+    }): object;
+}
+/** A row store the kernel itself holds (its `MemoryStore`), as a host keeps rows with no database. */
+declare function nativeMemoryOf(kernel: KernelModule): NativeMemoryPersistenceAdapter;
+interface LoadKernelOptions {
+    /** Where the installed `@almadar/core` and `@almadar/std` are found, node-style. Required: the caller names its own root. */
+    languageFrom: string;
+}
+/**
+ * The kernel of the `@almadar/kernel` package this host installs, loaded once per process with the language data
+ * the packages under `languageFrom` declare. A host with no package installed rejects, never falls back.
+ */
+declare function loadInstalledKernel(languageFrom: string): Promise<LoadedKernel>;
+/**
+ * Loads the kernel from `kernelDir` (the one with `pkg/`) and installs the language data the installed packages declare
+ * (the operator table that routes `program/*` and the other host effects), as `orb` reads it. The first install in a
+ * process wins.
+ */
+declare function loadKernelModule(kernelDir: string, options: LoadKernelOptions): Promise<LoadedKernel>;
+/**
+ * Where the native kernel add-on is: `ALMADAR_KERNEL_NODE`, else `kernel.node` in the `@almadar/orb-<platform>-<arch>`
+ * package this platform installs. Rejects when neither exists, so a host can fall back to the wasm kernel by choice.
+ */
+declare function resolveNativeAddon(from: string): string;
+/**
+ * Loads the native kernel add-on (the same API as the wasm module, run as machine code) and installs the language data
+ * the installed packages declare. The first install in a process wins.
+ */
+declare function loadNativeKernelModule(addonPath: string, options: LoadKernelOptions): Promise<LoadedKernel>;
+
+/**
+ * The host side of the language trio's server effects (`behavior/catalog`,
+ * `behavior/describe`, `behavior/source`, `behavior/resolve`, `behavior/dependencies`, `program/read|print|eval`): a thin
+ * caller that runs the installed `orb` from the project directory and parses its
+ * JSON. All behavior resolution, reflection, printing and validation is `orb`'s;
+ * nothing here re-implements it. Both execution paths (the interpreter's effect
+ * executor and the compiled server host) call this module.
+ *
+ * @packageDocumentation
+ */
+
+/** Where the host runs `orb`: the project (workspace) root, so installed behavior packages resolve. */
+interface ProgramHostOptions {
+    readonly cwd: string;
+    /** Explicit `orb` binary; defaults to {@link resolveOrbBinary}. */
+    readonly orbBin?: string;
+}
+/** `behavior/catalog`: installed behaviors under registry folders; `traits: false` omits each entry's traits (`--no-traits`). */
+declare function behaviorCatalog(scope: CatalogScope, opts: ProgramHostOptions, options?: {
+    readonly traits?: boolean;
+}): Promise<CatalogEntry[]>;
+/** {@link behaviorCatalog} for a caller that cannot await. */
+declare function behaviorCatalogSync(scope: CatalogScope, opts: ProgramHostOptions): CatalogEntry[];
+/** `behavior/describe`: a trait value's knobs and events; an orbital value's or a whole behavior's orbitals. */
+declare function behaviorDescribe(value: TraitValue, opts: ProgramHostOptions): Promise<TraitDescription>;
+declare function behaviorDescribe(value: DescribeTarget, opts: ProgramHostOptions): Promise<TraitDescription | BehaviorDescription>;
+/** `behavior/source`: the behavior a value belongs to, as a program (`.orb` IR). */
+declare function behaviorSource(value: Pick<TraitValue, 'behavior'>, opts: ProgramHostOptions): Promise<OrbitalSchema>;
+/** `program/read`: `.lolo` text → a program (`.orb` IR). */
+declare function programRead(text: string, opts: ProgramHostOptions): Promise<OrbitalSchema>;
+/** `program/print`: a program (`.orb` IR) → `.lolo` text. */
+declare function programPrint(program: OrbitalSchema, opts: ProgramHostOptions): Promise<string>;
+/** What `program/os-grants` returns: the static `os/` grant check's typed findings. */
+type ProgramOsGrantsReport = OsGrantsReport;
+/** What `program/prove` returns: every spec proposition the program cannot be shown to keep. */
+type ProgramProveReport = ProveReport;
+/** Who runs a program effect: the signed-in caller, as `call-service` receives it. */
+type ProgramCallContext = Pick<ServiceCallContext, 'principal' | 'role'>;
+/**
+ * A workspace-backed specifier (`./<workspaces root>/<owner>/…`) is readable
+ * only by its owner; every other specifier is unaffected. Returns the refusal,
+ * or undefined when the caller may read it.
+ */
+declare function workspaceAccessError(behavior: string, opts: ProgramHostOptions, context: ProgramCallContext | undefined): string | undefined;
+/** Options for {@link programEval}. */
+interface ProgramEvalOptions extends ProgramHostOptions {
+    /** Write into this workspace (opened as `context`'s caller) and snapshot it; without one, into `<cwd>/orbitals`. */
+    readonly workspace?: {
+        readonly id: string;
+        readonly context: ProgramCallContext;
+    };
+    /** A prior version of the program whose ids the re-evaluation keeps. */
+    readonly prior?: OrbitalSchema;
+    /** The program is a finished app (a generation concludes here): `orb validate --final`. */
+    readonly final?: boolean;
+}
+type ProgramEvalResult = {
+    readonly ok: true;
+    readonly result: EvaluatedProgram;
+} | {
+    readonly ok: false;
+    readonly errors: readonly ProgramValidationIssue[];
+};
+/**
+ * `program/validate`: the same stamp-and-validate call as `program/eval`, at the same
+ * 0-error / 0-warning bar, in a temp directory that is removed after. Nothing is written
+ * to the workspace or the project.
+ */
+declare function programValidate(program: OrbitalSchema, opts: Pick<ProgramEvalOptions, 'cwd' | 'prior' | 'final'> & ProgramHostOptions): Promise<ProgramValidationReport>;
+/**
+ * `program/prove`: the kernel prover's findings on a program, asked of `orb prove` (the prover is the kernel's, so the
+ * node host carries no copy of it). A program value is written to a temp file and resolved like any file; `path` names
+ * the file directly.
+ */
+declare function programProve(target: {
+    readonly program: OrbitalSchema;
+} | {
+    readonly path: string;
+}, opts: ProgramHostOptions): Promise<ProgramProveReport>;
+/**
+ * `program/os-grants`: the kernel's static `os/` grant findings on a program, asked of `orb os-grants` (the check is the
+ * kernel's, so the node host carries no copy of it). `final` checks the finished program, where a config-fed target is a
+ * literal. A program value is written to a temp file and resolved like any file; `path` names the file directly.
+ */
+declare function programOsGrants(target: {
+    readonly program: OrbitalSchema;
+} | {
+    readonly path: string;
+}, opts: ProgramHostOptions & {
+    readonly final?: boolean;
+}): Promise<ProgramOsGrantsReport>;
+/**
+ * `program/eval`: validate through {@link stampAndValidate}, and on success write the program to `orbitals/<name>.orb` in its workspace (or `cwd`)
+ * and return its traits as values. Failures come back as data.
+ */
+declare function programEval(program: OrbitalSchema, opts: ProgramEvalOptions): Promise<ProgramEvalResult>;
+/** Options for {@link programCompose}. */
+interface ProgramComposeOptions {
+    readonly appName: string;
+    readonly layout?: LayoutStrategy;
+    /** The app's theme (a built-in theme name), set on the composed program. */
+    readonly theme?: string;
+}
+/**
+ * `program/compose`: assemble programs, in the order given, into one app
+ * program. The composer is `orb compose` (the Rust composer, `program/compose`
+ * of the kernel's program host): the programs are written to a scratch folder
+ * and handed to it, and its JSON is the answer. Pages, layout, wiring, the app
+ * nav and every registry read are `orb`'s.
+ */
+declare function programCompose(programs: readonly OrbitalSchema[], options: ProgramComposeOptions, opts: ProgramHostOptions): Promise<OrbitalSchema>;
+/** A program file resolved by `orb` (every import flattened, every composed trait inlined): what a host registers. */
+declare function programResolve(path: string, opts: ProgramHostOptions): Promise<OrbitalSchema>;
+/** An unresolved program resolved by `orb` from the project root `opts.cwd`, so its relative imports resolve there. */
+declare function programResolveSchema(program: OrbitalSchema, opts: ProgramHostOptions): Promise<OrbitalSchema>;
+/** `behavior/resolve`: the behavior a value belongs to, resolved by `orb` — every import and composed trait inlined, as the runtime runs it. */
+declare function behaviorResolve(value: Pick<TraitValue, 'behavior'>, opts: ProgramHostOptions): Promise<OrbitalSchema | {
+    error: string;
+}>;
+/** `behavior/dependencies`: a program's dependency graph — each orbital's imports, then every installed behavior they reach, with its layer and its own imports. */
+declare function behaviorDependencies(program: OrbitalSchema, opts: ProgramHostOptions): Promise<DependencyGraph>;
+declare function programStep(program: OrbitalSchema, requests: readonly StepRequest[], opts: ProgramHostOptions, live?: boolean): Promise<PlayedStep[] | StepRefusal>;
+type EffectArg = JsonValue;
+/**
+ * Parse one program effect's positional arguments (the trailing emit config
+ * already removed) and run it. Both execution paths call this — the
+ * interpreter's effect executor and the compiled server handlers — so argument
+ * validation has one owner. Failures come back as data, never thrown.
+ */
+declare function runProgramEffect(op: ProgramEffectName, args: readonly EffectArg[], opts: ProgramHostOptions, context?: ProgramCallContext): Promise<ProgramEffectOutcome>;
+
+export { DEFAULT_CREDENTIALS_FILE, KvFailure, TokenPostRefusal, behaviorCatalog, behaviorCatalogSync, behaviorDependencies, behaviorDescribe, behaviorResolve, behaviorSource, createKvHost, createNodeOsHost, createNodeTokenPost, credentialsFilePath, directoryKvBackend, fileCredentialRows, installNodeCredentialVault, installNodeHostPorts, loadInstalledKernel, loadKernelModule, loadNativeKernelModule, loadOrCreateDevMasterKey, memoryKvBackend, nativeMemoryOf, processAnchors, programCompose, programEval, programOsGrants, programPrint, programProve, programRead, programResolve, programResolveSchema, programStep, programValidate, resolveNativeAddon, runProgramEffect, workspaceAccessError };
+export type { KvBackend, KvBatchOp, KvErrorKind, KvHost, KvNamespace, KvResult, LoadKernelOptions, LoadedKernel, NodeCredentialVaultOptions, NodeOsHostOptions, NodeTokenPostOptions, ProgramCallContext, ProgramComposeOptions, ProgramEvalOptions, ProgramEvalResult, ProgramHostOptions, ProgramOsGrantsReport, ProgramProveReport, ResolvedAddress };

package/dist/index.js

@@ -0,0 +1,217 @@
+export { OrbitalServerRuntime, UnresolvedProgramError } from './chunk-3PNZYEZQ.js';
+export { createProgramHandlers } from './chunk-7QG7JGKQ.js';
+export { KernelProgram, createNodeOsHost, emitPayload, kernelWorkspaceHost, processAnchors, resolveProgramFile, workspaceBucketFromEnv, workspacesRoot } from './chunk-YLFK5OJN.js';
+export { DEFAULT_CREDENTIALS_FILE, TokenPostRefusal, createNodeTokenPost, credentialsFilePath, fileCredentialRows, installNodeCredentialVault, installNodeHostPorts } from './chunk-VQVAHUAX.js';
+export { loadInstalledKernel, loadKernelModule, loadNativeKernelModule, nativeMemoryOf, resolveNativeAddon } from './chunk-EEYGL7AB.js';
+export { behaviorCatalog, behaviorCatalogSync, behaviorDependencies, behaviorDescribe, behaviorResolve, behaviorSource, programCompose, programEval, programOsGrants, programPrint, programProve, programRead, programResolve, programResolveSchema, programStep, programValidate, runProgramEffect, workspaceAccessError } from './chunk-7QE32QQR.js';
+export { installWorkspaceHost, installedWorkspaceHost, uninstallWorkspaceHost, workspaceOwnerSegment } from './chunk-BWMLDDCL.js';
+import { randomBytes } from 'crypto';
+import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
+import { join } from 'path';
+import { mkdir, open, rename, rm, readFile } from 'fs/promises';
+
+var KEY_FILE = "dev-credential-master-key";
+var HEX_KEY = /^[0-9a-f]{64}$/;
+function loadOrCreateDevMasterKey(dir) {
+  if (process.env.NODE_ENV === "production") {
+    throw new Error("A generated dev master key is not permitted when NODE_ENV=production \u2014 set ALMADAR_CREDENTIAL_MASTER_KEY");
+  }
+  const path = join(dir, KEY_FILE);
+  if (existsSync(path)) {
+    const key2 = readFileSync(path, "utf8").trim();
+    if (!HEX_KEY.test(key2)) throw new Error(`${path} is malformed (expected 64 hex characters)`);
+    return key2;
+  }
+  mkdirSync(dir, { recursive: true });
+  const key = randomBytes(32).toString("hex");
+  writeFileSync(path, `${key}
+`, { mode: 384, flag: "wx" });
+  return key;
+}
+var KvFailure = class extends Error {
+  constructor(kind, message) {
+    super(message);
+    this.kind = kind;
+  }
+  kind;
+};
+var LONE_SURROGATE = /[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/;
+var SEGMENT = /^[A-Za-z0-9._-]+$/;
+function namespaceId(ns) {
+  return `kv:${ns.app}:${ns.locale}:${ns.store}`;
+}
+function checkNamespace(ns) {
+  for (const [what, seg] of [["app", ns.app], ["locale", ns.locale], ["store", ns.store]]) {
+    if (!SEGMENT.test(seg) || seg === "." || seg === "..") throw new KvFailure("invalid", `kv ${what} name ${JSON.stringify(seg)} is not [A-Za-z0-9._-]+`);
+  }
+}
+function checkString(what, s) {
+  if (typeof s !== "string") throw new KvFailure("invalid", `kv ${what} must be a string`);
+  if (LONE_SURROGATE.test(s)) throw new KvFailure("invalid", `kv ${what} is not valid UTF-8`);
+  return s;
+}
+function checkJson(value, path) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new KvFailure("invalid", `kv value at ${path} is not a finite number`);
+    return value;
+  }
+  if (Array.isArray(value)) return value.map((item, i) => checkJson(item, `${path}[${i}]`));
+  if (typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype) {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) Object.defineProperty(out, k, { value: checkJson(v, `${path}.${k}`), enumerable: true, writable: true, configurable: true });
+    return out;
+  }
+  throw new KvFailure("invalid", `kv value at ${path} is not JSON`);
+}
+function byteCompare(a, b) {
+  return Buffer.compare(Buffer.from(a, "utf8"), Buffer.from(b, "utf8"));
+}
+function serialize(table) {
+  const keys = [...table.keys()].sort(byteCompare);
+  return `{${keys.map((k) => `${JSON.stringify(k)}:${JSON.stringify(table.get(k))}`).join(",")}}`;
+}
+function parseTable(text) {
+  const parsed = JSON.parse(text);
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new KvFailure("io", "kv store file is not a JSON object");
+  const table = /* @__PURE__ */ new Map();
+  for (const [k, v] of Object.entries(parsed)) table.set(k, checkJson(v, k));
+  return table;
+}
+function memoryKvBackend() {
+  const tables = /* @__PURE__ */ new Map();
+  return {
+    async load(ns) {
+      return new Map(tables.get(namespaceId(ns)) ?? []);
+    },
+    async commit(ns, table) {
+      tables.set(namespaceId(ns), new Map(table));
+    }
+  };
+}
+function isErrno(e, code) {
+  return typeof e === "object" && e !== null && "code" in e && e.code === code;
+}
+function directoryKvBackend(stateDir) {
+  const fileOf = (ns) => {
+    const dir = join(stateDir, "kv", ns.app, ns.locale);
+    return { dir, file: join(dir, `${ns.store}.json`) };
+  };
+  return {
+    async load(ns) {
+      const { file } = fileOf(ns);
+      let text;
+      try {
+        text = await readFile(file, "utf8");
+      } catch (e) {
+        if (isErrno(e, "ENOENT")) return /* @__PURE__ */ new Map();
+        throw new KvFailure("io", `kv read failed: ${e instanceof Error ? e.message : String(e)}`);
+      }
+      try {
+        return parseTable(text);
+      } catch (e) {
+        if (e instanceof KvFailure) throw e;
+        throw new KvFailure("io", `kv store file is corrupt: ${e instanceof Error ? e.message : String(e)}`);
+      }
+    },
+    async commit(ns, table) {
+      const { dir, file } = fileOf(ns);
+      const tmp = `${file}.tmp-${randomBytes(6).toString("hex")}`;
+      try {
+        await mkdir(dir, { recursive: true });
+        const handle = await open(tmp, "w");
+        try {
+          await handle.writeFile(serialize(table), "utf8");
+          await handle.sync();
+        } finally {
+          await handle.close();
+        }
+        await rename(tmp, file);
+      } catch (e) {
+        await rm(tmp, { force: true }).catch(() => void 0);
+        throw new KvFailure("io", `kv write failed: ${e instanceof Error ? e.message : String(e)}`);
+      }
+    }
+  };
+}
+function createKvHost(backend) {
+  const tails = /* @__PURE__ */ new Map();
+  const serialized = (ns, run) => {
+    const id = namespaceId(ns);
+    const next = (tails.get(id) ?? Promise.resolve()).then(run, run);
+    tails.set(id, next.catch(() => void 0));
+    return next;
+  };
+  const guard = async (run) => {
+    try {
+      return { ok: true, value: await run() };
+    } catch (e) {
+      if (e instanceof KvFailure) return { ok: false, error: e.message, kind: e.kind };
+      return { ok: false, error: e instanceof Error ? e.message : String(e), kind: "io" };
+    }
+  };
+  return {
+    get: (ns, key) => guard(async () => {
+      checkNamespace(ns);
+      checkString("key", key);
+      const table = await backend.load(ns);
+      const value = table.get(key);
+      return value === void 0 ? { found: false } : { found: true, value };
+    }),
+    put: (ns, key, value) => guard(() => {
+      checkNamespace(ns);
+      checkString("key", key);
+      const checked = checkJson(value, "value");
+      return serialized(ns, async () => {
+        const table = await backend.load(ns);
+        table.set(key, checked);
+        await backend.commit(ns, table);
+        return { storedKey: key };
+      });
+    }),
+    delete: (ns, key) => guard(() => {
+      checkNamespace(ns);
+      checkString("key", key);
+      return serialized(ns, async () => {
+        const table = await backend.load(ns);
+        const existed = table.delete(key);
+        if (existed) await backend.commit(ns, table);
+        return { existed };
+      });
+    }),
+    scan: (ns, prefix, limit) => guard(async () => {
+      checkNamespace(ns);
+      checkString("prefix", prefix);
+      if (limit !== void 0 && (!Number.isInteger(limit) || limit < 0)) throw new KvFailure("invalid", "kv scan limit must be a non-negative integer");
+      const table = await backend.load(ns);
+      const wanted = Buffer.from(prefix, "utf8");
+      const hits = [...table.keys()].filter((k) => Buffer.from(k, "utf8").subarray(0, wanted.length).equals(wanted)).sort(byteCompare);
+      const entries = [];
+      for (const key of limit === void 0 ? hits : hits.slice(0, limit)) {
+        const value = table.get(key);
+        if (value !== void 0) entries.push({ key, value });
+      }
+      return { entries };
+    }),
+    batch: (ns, ops) => guard(() => {
+      checkNamespace(ns);
+      const checked = ops.map((op, i) => {
+        const key = checkString(`batch op ${i} key`, op.key);
+        if (op.kind === "put") return { kind: "put", key, value: checkJson(op.value, `ops[${i}].value`) };
+        if (op.kind === "delete") return { kind: "delete", key };
+        throw new KvFailure("invalid", `kv batch op ${i} has unknown kind`);
+      });
+      return serialized(ns, async () => {
+        const table = await backend.load(ns);
+        for (const op of checked) {
+          if (op.kind === "put") table.set(op.key, op.value);
+          else table.delete(op.key);
+        }
+        await backend.commit(ns, table);
+        return { applied: checked.length };
+      });
+    })
+  };
+}
+
+export { KvFailure, createKvHost, directoryKvBackend, loadOrCreateDevMasterKey, memoryKvBackend };

package/dist/kernel-loader-3JR6LJV5.js

@@ -0,0 +1 @@
+export { loadInstalledKernel, loadKernelModule, loadNativeKernelModule, nativeMemoryOf, resolveNativeAddon } from './chunk-EEYGL7AB.js';