@almadar/shell-node 0.1.0 → 1.0.0

package/dist/{chunk-QYAPNUBH.js → chunk-7QE32QQR.js}

@@ -6,9 +6,9 @@ import { tmpdir } from 'os';
 import { relative, resolve, isAbsolute, sep, join } from 'path';
 import { z } from 'zod';
 import { createLogger } from '@almadar/logger';
+import { decodeProveReport, decodeOsGrantsReport, decodeValidationJsonOutput, isStepRefusal, decodeStepRefusal, decodePlayedStep } from '@almadar/core/kernel-wire';
 import { resolveOrbBinary, discoverBehaviorPackages } from '@almadar/core/behavior-package';
-import { EventPayloadSchema, SExprSchema, CatalogEntrySchema, formatTraitValueLiteral, BehaviorDescriptionSchema, mergeCallSiteConfigOverrides, isRoutePage, defaultPage, importsOf, dependencyGraphOf, DescribeTargetSchema, CatalogScopeSchema, parseProgram, ProgramInspectionSchema, TraitDescriptionSchema } from '@almadar/core';
-import { composeAppFromFiles, orbitalImportResolver, atomTraitResolver, organismOrderResolver } from '@almadar/core/builders';
+import { EventPayloadSchema, CatalogEntrySchema, formatTraitValueLiteral, BehaviorDescriptionSchema, importsOf, dependencyGraphOf, DescribeTargetSchema, CatalogScopeSchema, parseProgram, ProgramInspectionSchema, TraitDescriptionSchema } from '@almadar/core';
 
 var log = createLogger("almadar:integrations:program");
 function runOrb(args, opts) {
@@ -44,6 +44,17 @@ function parseJson(schema, run, what) {
   if (!parsed.success) throw new Error(`${what}: unexpected orb output: ${parsed.error.message}`);
   return parsed.data;
 }
+function decodeJson(decode, run, what) {
+  if (run.code !== 0) throw new Error(`${what}: orb exited ${run.code}: ${run.stderr.trim()}`);
+  try {
+    return decode(JSON.parse(run.stdout));
+  } catch (error) {
+    throw new Error(`${what}: unexpected orb output: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+function issueOf(finding) {
+  return { code: finding.code, message: finding.message, path: finding.path, ...finding.line !== void 0 ? { line: finding.line } : {}, ...finding.column !== void 0 ? { column: finding.column } : {} };
+}
 function withTempFile(name, content, use) {
   const dir = mkdtempSync(join(tmpdir(), "almadar-program-"));
   const path = join(dir, name);
@@ -57,33 +68,33 @@ function withProjectFile(cwd, name, content, use) {
 }
 async function behaviorCatalog(scope, opts, options = {}) {
   const exposure = (scope.exposure ?? []).flatMap((e) => ["--exposure", e]);
-  const noVectors = options.vectors === false ? ["--no-vectors"] : [];
-  const run = await runOrb(["behaviors", "catalog", "--json", ...noVectors, ...scope.paths, ...exposure], opts);
+  const noTraits = options.traits === false ? ["--no-traits"] : [];
+  const run = await runOrb(["behaviors", "catalog", "--json", ...noTraits, ...scope.paths, ...exposure], opts);
   return parseJson(CatalogEntrySchema.array(), run, "behavior/catalog");
 }
 function behaviorCatalogSync(scope, opts) {
   const exposure = (scope.exposure ?? []).flatMap((e) => ["--exposure", e]);
   return parseJson(CatalogEntrySchema.array(), runOrbSync(["behaviors", "catalog", "--json", ...scope.paths, ...exposure], opts), "behavior/catalog");
 }
-async function behaviorDescribe(value, opts, options = {}) {
-  const knobVectors = options.knobVectors === true ? ["--knob-vectors"] : [];
+async function behaviorDescribe(value, opts) {
   if ("trait" in value) {
-    const run = await runOrb(["behaviors", "describe", "--json", ...knobVectors, formatTraitValueLiteral(value)], opts);
+    const run = await runOrb(["behaviors", "describe", "--json", formatTraitValueLiteral(value)], opts);
     return parseJson(TraitDescriptionSchema, run, "behavior/describe");
   }
   const spec = "orbital" in value ? `${value.behavior}.orbitals.${value.orbital}` : value.behavior;
-  return parseJson(BehaviorDescriptionSchema, await runOrb(["behaviors", "describe", "--json", ...knobVectors, spec], opts), "behavior/describe");
+  return parseJson(BehaviorDescriptionSchema, await runOrb(["behaviors", "describe", "--json", spec], opts), "behavior/describe");
 }
-function booleanOption(op, raw, key) {
+function booleanOptions(op, raw, keys) {
   const options = raw ?? {};
   if (options === null || typeof options !== "object" || Array.isArray(options)) return `${op}: options must be an object`;
-  let value;
+  const out = {};
   for (const [k, v] of Object.entries(options)) {
-    if (k !== key) return `${op}: unsupported option "${k}"`;
-    if (typeof v !== "boolean") return `${op}: ${key} must be a boolean`;
-    value = v;
+    const key = keys.find((known) => known === k);
+    if (key === void 0) return `${op}: unsupported option "${k}"`;
+    if (typeof v !== "boolean") return `${op}: ${k} must be a boolean`;
+    out[key] = v;
   }
-  return value === void 0 ? {} : { value };
+  return out;
 }
 async function behaviorSource(value, opts) {
   const run = await runOrb(["behaviors", "source", "--json", value.behavior], opts);
@@ -102,8 +113,8 @@ async function programReadOutcome(text, opts) {
     if (run.code !== 0) return fail(`program/read: orb exited ${run.code}: ${run.stderr.trim()}`);
     const parsed = ProgramParser.safeParse(JSON.parse(run.stdout));
     if (parsed.success) return { ok: true, result: parsed.data };
-    const report = parseJson(ValidateReportSchema, await runOrb(["validate", "--json", "--deny-warnings", path], opts), "program/read");
-    const issues = [...report.errors ?? [], ...report.warnings ?? []];
+    const report = decodeJson(decodeValidationJsonOutput, await runOrb(["validate", "--json", "--deny-warnings", path], opts), "program/read");
+    const issues = [...report.errors ?? [], ...report.warnings ?? []].map(issueOf);
     if (issues.length === 0) return fail(`program/read: not a program: ${parsed.error.message}`);
     return { ok: false, error: `program/read: ${issues.length} validation issue(s): ${issues.map((e) => e.message).join("; ")}`, errors: issues };
   });
@@ -129,18 +140,6 @@ function programPrint(program, opts) {
     return run.stdout;
   });
 }
-var IssueSchema = z.object({
-  code: z.string(),
-  message: z.string(),
-  path: z.string().optional(),
-  line: z.number().optional(),
-  column: z.number().optional()
-});
-var ValidateReportSchema = z.object({
-  valid: z.boolean(),
-  errors: z.array(IssueSchema).optional(),
-  warnings: z.array(IssueSchema).optional()
-});
 function workspaceAccessError(behavior, opts, context) {
   const host = installedWorkspaceHost();
   if (host === null || !behavior.startsWith("./")) return void 0;
@@ -169,9 +168,9 @@ async function stampAndValidate(program, opts, dir, caller) {
     return { ok: false, errors: [{ code: "PROGRAM_STAMP_FAILED", message: stamp.stderr.trim() }] };
   }
   const validateArgs = ["validate", "--json", "--deny-warnings", ...opts.final === true ? ["--final"] : [], stamped];
-  const report = parseJson(ValidateReportSchema, await runOrb(validateArgs, opts), caller);
-  const errors = report.errors ?? [];
-  const warnings = report.warnings ?? [];
+  const report = decodeJson(decodeValidationJsonOutput, await runOrb(validateArgs, opts), caller);
+  const errors = (report.errors ?? []).map(issueOf);
+  const warnings = (report.warnings ?? []).map(issueOf);
   return { ok: true, stamped, errors, warnings, valid: report.valid && errors.length === 0 && warnings.length === 0 };
 }
 async function programValidate(program, opts) {
@@ -183,6 +182,17 @@ async function programValidate(program, opts) {
     rmSync(dir, { recursive: true, force: true });
   }
 }
+async function programProve(target, opts) {
+  if ("path" in target) return decodeJson(decodeProveReport, await runOrb(["prove", target.path], opts), "program/prove");
+  if (!PROGRAM_NAME.test(target.program.name)) throw new Error(`program/prove: program name "${target.program.name}" is not a file name`);
+  return withTempFile(`${target.program.name}.orb`, JSON.stringify(target.program), async (file) => decodeJson(decodeProveReport, await runOrb(["prove", file], opts), "program/prove"));
+}
+async function programOsGrants(target, opts) {
+  const flags = opts.final === true ? ["--final"] : [];
+  if ("path" in target) return decodeJson(decodeOsGrantsReport, await runOrb(["os-grants", target.path, ...flags], opts), "program/os-grants");
+  if (!PROGRAM_NAME.test(target.program.name)) throw new Error(`program/os-grants: program name "${target.program.name}" is not a file name`);
+  return withTempFile(`${target.program.name}.orb`, JSON.stringify(target.program), async (file) => decodeJson(decodeOsGrantsReport, await runOrb(["os-grants", file, ...flags], opts), "program/os-grants"));
+}
 async function programEval(program, opts) {
   const dir = mkdtempSync(join(tmpdir(), "almadar-eval-"));
   try {
@@ -224,92 +234,24 @@ async function programEval(program, opts) {
   }
 }
 var LAYOUT_STRATEGIES = ["sidebar", "tabs", "dashboard", "wizard-flow", "single"];
-function importSource(orbital) {
-  const ref = orbital.reference?.ref;
-  if (ref === void 0) return void 0;
-  const [alias, kind, name] = ref.split(".");
-  if (kind !== "orbitals" || name === void 0) return void 0;
-  const use = (orbital.uses ?? []).find((u) => u.as === alias);
-  return use === void 0 ? void 0 : { from: use.from, orbital: name };
-}
-var behaviorName = (from) => from.split("/").pop() ?? from;
 async function programCompose(programs, options, opts) {
-  const sources = /* @__PURE__ */ new Set();
-  for (const program of programs) {
-    for (const orbital of program.orbitals) for (const use of orbital.uses ?? []) sources.add(use.from);
-  }
-  const loaded = /* @__PURE__ */ new Map();
-  for (const from of sources) loaded.set(behaviorName(from), await behaviorSource({ behavior: from }, opts));
-  const load = (name) => loaded.get(name) ?? null;
-  const byName = /* @__PURE__ */ new Map();
-  for (const program of programs) for (const orbital of program.orbitals) byName.set(orbital.name, orbital);
-  const catalogOrbitalOf = (name) => {
-    const orbital = byName.get(name);
-    const source = orbital === void 0 ? void 0 : importSource(orbital);
-    return source === void 0 ? void 0 : { organism: behaviorName(source.from), orbital: source.orbital };
-  };
-  const composed = composeAppFromFiles(programs, {
-    appName: options.appName,
-    ...options.layout !== void 0 ? { layoutStrategy: options.layout } : {},
-    organismOf: (name) => catalogOrbitalOf(name)?.organism,
-    organismOrderOf: organismOrderResolver(catalogOrbitalOf, load),
-    atomTraitOf: atomTraitResolver(load),
-    importedOrbitalOf: orbitalImportResolver(load),
-    importedProgramOf: (orbital) => {
-      const source = importSource(orbital);
-      return source === void 0 ? void 0 : load(behaviorName(source.from)) ?? void 0;
-    }
-  });
-  return options.theme !== void 0 ? { ...composed.schema, theme: options.theme } : composed.schema;
-}
-async function mountTraitValue(value, opts, context) {
-  const denied = workspaceAccessError(value.behavior, opts, context);
-  if (denied !== void 0) return { ok: false, error: denied };
-  let source;
+  const dir = mkdtempSync(join(tmpdir(), "almadar-compose-"));
   try {
-    source = await behaviorSource(value, opts);
-  } catch (error) {
-    return { ok: false, error: error instanceof Error ? error.message : String(error) };
-  }
-  const owner = source.orbitals.find(
-    (o) => o.traits.some((t) => typeof t === "object" && !("ref" in t) && t.name === value.trait)
-  );
-  if (owner === void 0) {
-    return { ok: false, error: `behavior "${value.behavior}" declares no inline trait "${value.trait}"` };
+    const files = programs.map((program, index) => {
+      const file = join(dir, `${index}.orb`);
+      writeFileSync(file, JSON.stringify(program));
+      return file;
+    });
+    const flags = [
+      "--app-name",
+      options.appName,
+      ...options.layout !== void 0 ? ["--layout", options.layout] : [],
+      ...options.theme !== void 0 ? ["--theme", options.theme] : []
+    ];
+    return parseJson(ProgramParser, await runOrb(["compose", ...flags, ...files], opts), "program/compose");
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
   }
-  const { behavior, trait, config, ...rest } = value;
-  const overrides = config !== void 0 ? { ...rest, config: mergeCallSiteConfigOverrides({}, config) } : rest;
-  const projectRelative = behavior.startsWith("./");
-  const page = (owner.pages ?? []).find((p) => typeof p === "object" && "path" in p && isRoutePage(p) && (p.traits ?? []).some((t) => (typeof t === "string" ? t : "ref" in t ? t.ref : t.name) === trait));
-  const wrapper = {
-    name: `Mount${trait}`,
-    orbitals: [
-      {
-        name: "Mounted",
-        entity: `Bound.orbitals.${owner.name}.entity`,
-        reference: {
-          ref: `Bound.orbitals.${owner.name}`,
-          only: [trait],
-          ...Object.keys(overrides).length > 0 ? { traits: { [trait]: overrides } } : {}
-        },
-        traits: [],
-        pages: [],
-        uses: [{ as: "Bound", from: behavior }]
-      }
-    ]
-  };
-  const check = async (path) => {
-    const report = parseJson(ValidateReportSchema, await runOrb(["validate", "--json", "--deny-warnings", path], opts), "mount");
-    const issues = [...report.errors ?? [], ...report.warnings ?? []];
-    if (!report.valid || issues.length > 0) {
-      return { ok: false, error: `trait value ${formatTraitValueLiteral(value)} does not validate where it is bound`, errors: issues };
-    }
-    const schema = parseJson(ProgramParser, await runOrb(["resolve", path], opts), "mount");
-    const pagePath = page !== void 0 && typeof page === "object" && "path" in page ? page.path : void 0;
-    return { ok: true, mounted: { schema, orbital: "Mounted", trait: `Mounted${trait}`, ...pagePath !== void 0 ? { pagePath } : {} } };
-  };
-  const text = JSON.stringify(wrapper);
-  return projectRelative ? withProjectFile(opts.cwd, "mount.orb", text, check) : withTempFile("mount.orb", text, check);
 }
 var WHICH_LINE = /^(\/\S+\.(?:orb|lolo)) \((.+)\)$/;
 async function behaviorFile(behavior, opts) {
@@ -323,21 +265,6 @@ async function behaviorFile(behavior, opts) {
   if (run.code !== 0 || match === null) return { error: `behavior "${behavior}" is not installed${run.stderr.trim() ? `: ${run.stderr.trim()}` : ""}` };
   return match[1];
 }
-async function mountBehaviorValue(value, opts, context) {
-  const denied = workspaceAccessError(value.behavior, opts, context);
-  if (denied !== void 0) return { ok: false, error: denied };
-  const file = await behaviorFile(value.behavior, opts);
-  if (typeof file !== "string") return { ok: false, error: file.error };
-  const report = parseJson(ValidateReportSchema, await runOrb(["validate", "--json", "--deny-warnings", file], opts), "mount");
-  const issues = [...report.errors ?? [], ...report.warnings ?? []];
-  if (!report.valid || issues.length > 0) {
-    return { ok: false, error: `behavior ${value.behavior} does not validate`, errors: issues };
-  }
-  const schema = parseJson(ProgramParser, await runOrb(["resolve", file], opts), "mount");
-  const firstPage = defaultPage(schema)?.page.path;
-  if (firstPage === void 0) return { ok: false, error: `behavior ${value.behavior} has no page to open` };
-  return { ok: true, mounted: { schema, firstPage } };
-}
 async function programResolve(path, opts) {
   return parseJson(ProgramParser, await runOrb(["resolve", path], opts), "program/resolve");
 }
@@ -395,57 +322,26 @@ var StepRequestSchema = z.object({
   config: EventPayloadSchema.optional(),
   now: z.number().optional(),
   settleMs: z.number().optional(),
-  viewer: EventPayloadSchema.nullable().optional()
+  identity: z.object({ subject: z.string(), claims: EventPayloadSchema }).optional()
 });
-var StepOutcomeSchema = z.object({
-  orbital: z.string(),
-  trait: z.string(),
-  event: z.string(),
-  executed: z.boolean(),
-  previousState: z.string(),
-  newState: z.string(),
-  emits: z.array(z.object({ event: z.string(), payload: EventPayloadSchema.nullable() })),
-  firedArm: z.number().int().nullable(),
-  guards: z.array(z.object({ arm: z.number().int(), guard: SExprSchema, passed: z.boolean(), error: z.string().optional() })),
-  effects: z.array(z.object({ type: z.string(), args: z.array(SExprSchema), status: z.enum(["executed", "failed", "skipped"]), error: z.string().optional() }))
-});
-var StepReportSchema = z.union([
-  z.object({ success: z.literal(true), steps: z.array(z.object({ outcomes: z.array(StepOutcomeSchema), entityAfter: EventPayloadSchema.nullable() })) }),
-  z.object({ success: z.literal(false), error: z.string() })
-]);
-function effectsOf(effects) {
-  return effects.map((e) => ({ type: e.type, args: e.args, status: e.status, ...e.error !== void 0 ? { error: e.error } : {} }));
+function decodePlayedSteps(printed) {
+  if (!Array.isArray(printed)) throw new Error("program/step: expected an array of played steps");
+  return printed.map((step) => decodePlayedStep(step));
 }
-function emittedOf(emits, step) {
-  return emits.map((e) => ({ type: e.event, ...e.payload !== null ? { payload: e.payload } : {}, timestamp: step }));
+function decodePlayedOutput(run) {
+  if (run.code !== 0) throw new Error(`program/step: orb exited ${run.code}: ${run.stderr.trim()}`);
+  try {
+    const printed = JSON.parse(run.stdout);
+    return isStepRefusal(printed) ? decodeStepRefusal(printed) : decodePlayedSteps(printed);
+  } catch (error) {
+    throw new Error(`program/step: unexpected orb output: ${error instanceof Error ? error.message : String(error)}`);
+  }
 }
 async function programStep(program, requests, opts, live = false) {
-  const steps = requests.map((r) => ({ trait: r.trait, event: r.event, payload: r.payload, from: r.from, ...r.entity !== void 0 ? { entity: r.entity } : {}, ...r.config !== void 0 ? { config: r.config } : {}, ...r.now !== void 0 ? { now: r.now } : {}, ...r.settleMs !== void 0 ? { settleMs: r.settleMs } : {}, ...r.viewer !== void 0 ? { viewer: r.viewer } : {} }));
+  const steps = requests.map((r) => ({ orbital: r.orbital, trait: r.trait, event: r.event, payload: r.payload, from: r.from, ...r.entity !== void 0 ? { entity: r.entity } : {}, ...r.config !== void 0 ? { config: r.config } : {}, ...r.now !== void 0 ? { now: r.now } : {}, ...r.settleMs !== void 0 ? { settleMs: r.settleMs } : {}, ...r.identity !== void 0 ? { identity: r.identity } : {} }));
   return withTempFile("program.orb", JSON.stringify(program), async (path) => {
-    const run = await runOrb(["execute", path, "--steps", JSON.stringify(steps), ...live ? ["--live"] : []], opts);
-    const report = parseJson(StepReportSchema, run, "program/step");
-    if (!report.success) return { error: report.error };
-    const results = [];
-    for (const [i, request] of requests.entries()) {
-      const moved = report.steps[i]?.outcomes ?? [];
-      const outcome = moved.find((o) => o.trait === request.trait);
-      if (outcome === void 0) return { error: `trait "${request.trait}" did not run` };
-      const firedGuarded = outcome.firedArm !== null && outcome.guards.some((g) => g.arm === outcome.firedArm);
-      results.push({ ...request, result: {
-        trait: outcome.trait,
-        event: request.event,
-        transitionFired: outcome.executed,
-        guard: firedGuarded ? "pass" : outcome.firedArm === null && outcome.guards.length > 0 ? "fail" : "none",
-        ...outcome.firedArm !== null ? { firedArm: outcome.firedArm } : {},
-        state: { before: outcome.previousState, after: outcome.newState },
-        effects: effectsOf(outcome.effects),
-        emitted: emittedOf(outcome.emits, i),
-        guards: outcome.guards.map((g) => ({ arm: g.arm, guard: g.guard, passed: g.passed, trace: [], ...g.error !== void 0 ? { error: g.error } : {} })),
-        entityAfter: report.steps[i]?.entityAfter ?? null,
-        outcomes: moved.map((o) => ({ orbital: o.orbital, trait: o.trait, event: o.event, from: o.previousState, to: o.newState, arm: o.firedArm, fired: o.executed, effects: effectsOf(o.effects), emitted: emittedOf(o.emits, i) }))
-      } });
-    }
-    return results;
+    const run = await runOrb(["execute", path, "--steps", JSON.stringify(steps), "--played", ...live ? ["--live"] : []], opts);
+    return decodePlayedOutput(run);
   });
 }
 function fail(error) {
@@ -465,18 +361,18 @@ async function runProgramEffect(op, args, opts, context) {
       case "behavior/catalog": {
         const scope = CatalogScopeSchema.safeParse(args[0]);
         if (!scope.success) return fail(`behavior/catalog: ${issuesOf(scope.error)}`);
-        const vectors = booleanOption(op, args[1], "vectors");
-        if (typeof vectors === "string") return fail(vectors);
-        return { ok: true, result: await behaviorCatalog(scope.data, opts, vectors.value === void 0 ? {} : { vectors: vectors.value }) };
+        const options = booleanOptions(op, args[1], ["traits"]);
+        if (typeof options === "string") return fail(options);
+        return { ok: true, result: await behaviorCatalog(scope.data, opts, options.traits === void 0 ? {} : { traits: options.traits }) };
       }
       case "behavior/describe": {
         const value = DescribeTargetSchema.safeParse(args[0]);
         if (!value.success) return fail(`${op}: ${issuesOf(value.error)}`);
-        const knobVectors = booleanOption(op, args[1], "knobVectors");
-        if (typeof knobVectors === "string") return fail(knobVectors);
+        const none = booleanOptions(op, args[1], []);
+        if (typeof none === "string") return fail(none);
         const denied = workspaceAccessError(value.data.behavior, opts, context);
         if (denied !== void 0) return fail(`${op}: ${denied}`);
-        return { ok: true, result: await behaviorDescribe(value.data, opts, knobVectors.value === void 0 ? {} : { knobVectors: knobVectors.value }) };
+        return { ok: true, result: await behaviorDescribe(value.data, opts) };
       }
       case "behavior/source": {
         const value = DescribeTargetSchema.safeParse(args[0]);
@@ -564,6 +460,35 @@ async function runProgramEffect(op, args, opts, context) {
         }
         return { ok: true, result: await programValidate(program, { ...opts, ...prior !== void 0 ? { prior } : {}, ...final !== void 0 ? { final } : {} }) };
       }
+      case "program/prove": {
+        const options = args[1] ?? {};
+        if (options === null || typeof options !== "object" || Array.isArray(options)) return fail("program/prove: options must be an object");
+        for (const key of Object.keys(options)) if (key !== "path") return fail(`program/prove: unsupported option "${key}"`);
+        const path = options["path"];
+        if (path !== void 0) {
+          if (typeof path !== "string" || !isAbsolute(path)) return fail("program/prove: path must be an absolute path");
+          return { ok: true, result: await programProve({ path }, opts) };
+        }
+        const program = programArg(op, args[0]);
+        if (typeof program === "string") return fail(program);
+        return { ok: true, result: await programProve({ program }, opts) };
+      }
+      case "program/os-grants": {
+        const options = args[1] ?? {};
+        if (options === null || typeof options !== "object" || Array.isArray(options)) return fail("program/os-grants: options must be an object");
+        for (const key of Object.keys(options)) if (key !== "path" && key !== "final") return fail(`program/os-grants: unsupported option "${key}"`);
+        const final = options["final"];
+        if (final !== void 0 && typeof final !== "boolean") return fail("program/os-grants: final must be a boolean");
+        const pass = final === true ? { final } : {};
+        const path = options["path"];
+        if (path !== void 0) {
+          if (typeof path !== "string" || !isAbsolute(path)) return fail("program/os-grants: path must be an absolute path");
+          return { ok: true, result: await programOsGrants({ path }, { ...opts, ...pass }) };
+        }
+        const program = programArg(op, args[0]);
+        if (typeof program === "string") return fail(program);
+        return { ok: true, result: await programOsGrants({ program }, { ...opts, ...pass }) };
+      }
       case "program/eval": {
         const program = programArg(op, args[0]);
         if (typeof program === "string") return fail(program);
@@ -595,4 +520,4 @@ async function runProgramEffect(op, args, opts, context) {
   }
 }
 
-export { behaviorCatalog, behaviorCatalogSync, behaviorDependencies, behaviorDescribe, behaviorResolve, behaviorSource, mountBehaviorValue, mountTraitValue, programCompose, programEval, programPrint, programRead, programResolve, programResolveSchema, programStep, programValidate, runProgramEffect, workspaceAccessError };
+export { behaviorCatalog, behaviorCatalogSync, behaviorDependencies, behaviorDescribe, behaviorResolve, behaviorSource, programCompose, programEval, programOsGrants, programPrint, programProve, programRead, programResolve, programResolveSchema, programStep, programValidate, runProgramEffect, workspaceAccessError };

package/dist/{chunk-WZFQ7T7V.js → chunk-7QG7JGKQ.js}

@@ -1,5 +1,5 @@
-import { workspacesRoot, kernelWorkspaceHost, workspaceBucketFromEnv } from './chunk-BJA6GYC5.js';
-import { runProgramEffect } from './chunk-QYAPNUBH.js';
+import { workspacesRoot, kernelWorkspaceHost, workspaceBucketFromEnv } from './chunk-YLFK5OJN.js';
+import { runProgramEffect } from './chunk-7QE32QQR.js';
 import { installedWorkspaceHost, installWorkspaceHost } from './chunk-BWMLDDCL.js';
 
 // src/program/createProgramHandlers.ts

package/dist/{chunk-UBZT5LDW.js → chunk-EEYGL7AB.js}

@@ -15,9 +15,6 @@ function nativeMemoryOf(kernel) {
   if (!hasMemoryStore(kernel)) throw new Error("this kernel module exports no MemoryStore; install a kernel build that carries it");
   return new NativeMemoryPersistenceAdapter(new kernel.MemoryStore());
 }
-async function loadKernelModule(kernelDir, options) {
-  return loadKernel(kernelDir, options);
-}
 var initialised = /* @__PURE__ */ new WeakSet();
 function initOnce(loaded, wasm, languageFrom) {
   if (initialised.has(loaded)) return loaded;
@@ -27,17 +24,10 @@ function initOnce(loaded, wasm, languageFrom) {
   initialised.add(loaded);
   return loaded;
 }
-function initKernelSync(languageFrom) {
-  initOnce(installedModule, readFileSync(createRequire(import.meta.url).resolve("@almadar/kernel/kernel.wasm")), languageFrom);
-  return installedModule;
-}
 async function loadInstalledKernel(languageFrom) {
-  return initKernelSync(languageFrom);
+  return initOnce(installedModule, readFileSync(createRequire(import.meta.url).resolve("@almadar/kernel/kernel.wasm")), languageFrom);
 }
-async function loadHttpKernel(kernelDir, options) {
-  return loadKernel(kernelDir, options);
-}
-async function loadKernel(kernelDir, options) {
+async function loadKernelModule(kernelDir, options) {
   const loaded = await import(pathToFileURL(join(kernelDir, "pkg/orbital_wasm.js")).href);
   return initOnce(loaded, initialised.has(loaded) ? void 0 : readFileSync(join(kernelDir, "pkg/orbital_wasm_bg.wasm")), options.languageFrom);
 }
@@ -60,4 +50,4 @@ async function loadNativeKernelModule(addonPath, options) {
   return initOnce(loaded, void 0, options.languageFrom);
 }
 
-export { initKernelSync, loadHttpKernel, loadInstalledKernel, loadKernelModule, loadNativeKernelModule, nativeMemoryOf, resolveNativeAddon };
+export { loadInstalledKernel, loadKernelModule, loadNativeKernelModule, nativeMemoryOf, resolveNativeAddon };

package/dist/chunk-VQVAHUAX.js

@@ -0,0 +1,183 @@
+import { readFile, mkdir, writeFile, rename } from 'fs/promises';
+import { join, dirname } from 'path';
+import { EntityRowSchema, runRowWrite } from '@almadar/core';
+import { AsyncLocalStorage } from 'async_hooks';
+import { installCredentialScopeStorage, CREDENTIAL_MASTER_KEY_ENV, CREDENTIAL_PREVIOUS_MASTER_KEY_ENV, CredentialVault, installCredentialStore } from '@almadar/shell-runtime';
+import { lookup } from 'dns/promises';
+import { request } from 'https';
+import { isIP } from 'net';
+
+// src/credential-rows.ts
+var CREDENTIALS_FILE_ENV = "ALMADAR_CREDENTIALS_FILE";
+var DEFAULT_CREDENTIALS_FILE = ".almadar/dev-credentials.json";
+var CREDENTIAL_ROWS_ENTITY = "AlmadarIntegrationCredential";
+function credentialsFilePath(env = process.env, cwd = process.cwd()) {
+  const named = env[CREDENTIALS_FILE_ENV];
+  return named !== void 0 && named !== "" ? named : join(cwd, DEFAULT_CREDENTIALS_FILE);
+}
+var gates = /* @__PURE__ */ new Map();
+function gateOf(path) {
+  const held = gates.get(path);
+  if (held !== void 0) return held;
+  const gate = { tail: Promise.resolve() };
+  gates.set(path, gate);
+  return gate;
+}
+function isMissing(error) {
+  return "code" in error && error.code === "ENOENT";
+}
+function fileCredentialRows(path) {
+  const gate = gateOf(path);
+  const read = async () => {
+    let text;
+    try {
+      text = await readFile(path, "utf8");
+    } catch (error) {
+      if (error instanceof Error && isMissing(error)) return [];
+      throw error;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(text);
+    } catch (error) {
+      throw new Error(`credential file ${path} is not JSON: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const rows = EntityRowSchema.array().safeParse(parsed);
+    if (!rows.success) throw new Error(`credential file ${path} is not an array of rows: ${rows.error.message}`);
+    const at = rows.data.findIndex((row) => typeof row.id !== "string");
+    if (at >= 0) throw new Error(`credential file ${path}: row ${at} carries no id`);
+    return rows.data;
+  };
+  const write = async (rows) => {
+    await mkdir(dirname(path), { recursive: true });
+    const temporary = `${path}.tmp`;
+    await writeFile(temporary, JSON.stringify(rows, null, 2));
+    await rename(temporary, path);
+  };
+  const change = (work) => {
+    const next = gate.tail.then(async () => {
+      const { rows, result, changed } = work(await read());
+      if (changed) await write(rows);
+      return result;
+    });
+    gate.tail = next.then(
+      () => void 0,
+      () => void 0
+    );
+    return next;
+  };
+  return {
+    async list() {
+      await gate.tail;
+      return read();
+    },
+    create: (row) => change((rows) => ({ rows: [...rows, row], result: void 0, changed: true })),
+    update: (id, data) => change((rows) => ({
+      rows: rows.map((row) => row.id === id ? { ...row, ...data, id } : row),
+      result: void 0,
+      changed: rows.some((row) => row.id === id)
+    })),
+    delete: (id) => change((rows) => {
+      const written = runRowWrite(rows, { kind: "delete", entityType: CREDENTIAL_ROWS_ENTITY, id });
+      const removed = written.outcome.kind === "deleted";
+      return { rows: written.rows, result: removed, changed: removed };
+    })
+  };
+}
+function nodeCredentialScope() {
+  return new AsyncLocalStorage();
+}
+var installed = false;
+function installNodeHostPorts() {
+  if (installed) return;
+  installed = true;
+  installCredentialScopeStorage(nodeCredentialScope());
+}
+async function installNodeCredentialVault(options) {
+  const env = options.env ?? process.env;
+  const master = env[CREDENTIAL_MASTER_KEY_ENV];
+  if (master === void 0) return null;
+  const previous = env[CREDENTIAL_PREVIOUS_MASTER_KEY_ENV];
+  const vault = await CredentialVault.open(
+    new options.kernel.CredentialVault(master, previous === void 0 || previous === "" ? void 0 : previous),
+    fileCredentialRows(credentialsFilePath(env, options.cwd))
+  );
+  installCredentialStore(vault);
+  return vault;
+}
+var IO_TIMEOUT_MS = 5e3;
+async function systemResolve(host) {
+  return lookup(host, { all: true });
+}
+var TokenPostRefusal = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TokenPostRefusal";
+  }
+};
+function urlOf(endpoint) {
+  try {
+    return new URL(endpoint);
+  } catch {
+    throw new TokenPostRefusal("the token endpoint is not a url");
+  }
+}
+function createNodeTokenPost(options) {
+  const send = options.request ?? request;
+  const resolve = options.resolve ?? systemResolve;
+  return async ({ endpoint, headers, body }) => {
+    const url = urlOf(endpoint);
+    if (url.protocol !== "https:") throw new TokenPostRefusal("the token endpoint must be https");
+    if (!options.egressAllows(endpoint)) throw new TokenPostRefusal(`${url.host} is not an origin the program declares in egress`);
+    const host = url.hostname.replace(/^\[/, "").replace(/\]$/, "");
+    const addresses = isIP(host) !== 0 ? [{ address: host, family: isIP(host) }] : await resolve(host);
+    if (addresses.length === 0) throw new TokenPostRefusal(`${host} has no addresses`);
+    const private_ = addresses.find((entry) => !options.isPublicAddress(entry.address));
+    if (private_ !== void 0) throw new TokenPostRefusal(`${host} resolves to ${private_.address}, not a public address`);
+    const checked = addresses[0];
+    const payload = Buffer.from(body, "utf8");
+    const requestHeaders = {};
+    for (const [name, value] of headers) requestHeaders[name] = value;
+    requestHeaders["Content-Length"] = payload.length;
+    requestHeaders["Connection"] = "close";
+    return new Promise((settle, reject) => {
+      const req = send(
+        {
+          method: "POST",
+          protocol: "https:",
+          host,
+          port: url.port === "" ? 443 : Number(url.port),
+          path: `${url.pathname}${url.search}`,
+          headers: requestHeaders,
+          timeout: IO_TIMEOUT_MS,
+          servername: isIP(host) === 0 ? host : void 0,
+          lookup: (_name, lookupOptions, callback) => {
+            if (lookupOptions.all === true) callback(null, [{ address: checked.address, family: checked.family }]);
+            else callback(null, checked.address, checked.family);
+          }
+        },
+        (response) => {
+          const status = response.statusCode ?? 0;
+          if (status >= 300 && status < 400) {
+            response.resume();
+            reject(new TokenPostRefusal(`the token endpoint answered a redirect (${status}); redirects are not followed`));
+            req.destroy();
+            return;
+          }
+          const chunks = [];
+          response.on("data", (chunk) => chunks.push(chunk));
+          response.on("end", () => settle({ status, body: Buffer.concat(chunks).toString("utf8") }));
+          response.on("error", () => reject(new TokenPostRefusal("the token endpoint response failed")));
+        }
+      );
+      req.on("timeout", () => {
+        reject(new TokenPostRefusal("the token endpoint timed out"));
+        req.destroy();
+      });
+      req.on("error", (error) => reject(new TokenPostRefusal(`could not reach the token endpoint${error.code !== void 0 ? ` (${error.code})` : ""}`)));
+      req.end(payload);
+    });
+  };
+}
+
+export { DEFAULT_CREDENTIALS_FILE, TokenPostRefusal, createNodeTokenPost, credentialsFilePath, fileCredentialRows, installNodeCredentialVault, installNodeHostPorts };