@almadar/shell-node 0.1.0 → 1.0.0

package/dist/{chunk-BJA6GYC5.js → chunk-YLFK5OJN.js}

@@ -1,12 +1,12 @@
-import { installNodeHostPorts } from './chunk-23YAOI6P.js';
-import { loadNativeKernelModule, resolveNativeAddon, loadKernelModule, loadHttpKernel } from './chunk-UBZT5LDW.js';
+import { installNodeHostPorts, createNodeTokenPost } from './chunk-VQVAHUAX.js';
+import { loadNativeKernelModule, resolveNativeAddon, loadKernelModule } from './chunk-EEYGL7AB.js';
 import { workspaceOwnerSegment } from './chunk-BWMLDDCL.js';
 import { mkdirSync, realpathSync, mkdtempSync, writeFileSync, rmSync, constants as constants$1 } from 'fs';
 import { constants, homedir, tmpdir, loadavg, uptime, machine, version, release, hostname, type, userInfo } from 'os';
-import { dirname, join, resolve } from 'path';
+import { dirname, resolve, join } from 'path';
 import { spawn } from 'child_process';
 import { createRequire } from 'module';
-import { createHttpPorts, NativeMemoryPersistenceAdapter, kernelOsGrants, InFlightCalls, KernelEngine, dispatchInbound, anchoredGrants, expandAnchor } from '@almadar/shell-runtime';
+import { createSecretPorts, NativeMemoryPersistenceAdapter, kernelOsGrants, InFlightCalls, KernelEngine, dispatchInbound, anchoredGrants, expandAnchor } from '@almadar/shell-runtime';
 import { resolveOrbBinary } from '@almadar/core/behavior-package';
 import { tickEventKey } from '@almadar/core';
 import { lstat, chmod, stat, readlink, symlink, link, unlink, rename, copyFile, open, mkdir, readdir, rm, rmdir, access, chown } from 'fs/promises';
@@ -1140,6 +1140,7 @@ var SOCKET_HIGH_WATER = 1024 * 1024;
 var NET_OPS = /* @__PURE__ */ new Set([
   "os/tcp-connect",
   "os/tcp-listen",
+  "os/tls-upgrade",
   "os/send",
   "os/recv",
   "os/udp-bind",
@@ -1147,7 +1148,8 @@ var NET_OPS = /* @__PURE__ */ new Set([
   "os/recvfrom",
   "os/dns-resolve",
   "os/shutdown",
-  "os/watch-port"
+  "os/watch-port",
+  "os/fetch"
 ]);
 function isNetOp(op) {
   return NET_OPS.has(op);
@@ -1231,6 +1233,8 @@ var NetOps = class {
         throw invalid(op, "a stream needs a key and a call site");
       case "os/tcp-connect":
         return this.tcpConnect(op, args);
+      case "os/tls-upgrade":
+        throw osFailure("unsupported", op, "a kernel op: the kernel owns TLS and a host implements none");
       case "os/send":
         return this.send(op, args);
       case "os/recv":
@@ -1245,6 +1249,8 @@ var NetOps = class {
         return this.dnsResolve(op, args);
       case "os/shutdown":
         return this.shutdown(op, args);
+      case "os/fetch":
+        throw osFailure("unsupported", op, "a browser host performs a fetch; this host speaks the protocol over os/tcp-connect and os/tls-upgrade");
       default:
         throw osFailure("unsupported", op, "streaming host not implemented");
     }
@@ -1569,7 +1575,8 @@ var ProcessOps = class {
       case "os/getenv": {
         const name = argStr(args, 0, op);
         this.envGranted(op, name);
-        return { value: this.lookupEnv(name) };
+        const value = this.lookupEnv(name);
+        return value === null ? {} : { value };
       }
       case "os/setenv":
       case "os/unsetenv":
@@ -1722,9 +1729,8 @@ var ProcessOps = class {
     const op = "os/kill";
     let found;
     if (typeof value === "string") found = SIGNAL_SET.find(([name]) => name === value)?.[1];
-    else if (typeof value === "number" && Number.isInteger(value)) found = SIGNAL_SET.find(([, number]) => number === value)?.[1];
     if (found === void 0) {
-      throw invalid(op, "signal must be one of TERM, KILL, INT, HUP, QUIT, USR1, USR2, STOP, CONT (or its number)");
+      throw invalid(op, "signal must be one of TERM, KILL, INT, HUP, QUIT, USR1, USR2, STOP, CONT");
     }
     return found;
   }
@@ -1882,22 +1888,23 @@ var NodeOsHost = class {
     this.given = given;
     this.anchors = anchors;
     this.state = new OsState(anchors);
-    const grants = anchoredGrants(given, anchors);
-    this.fs = new FsOps(this.state, grants);
-    this.process = new ProcessOps(this.state, grants);
-    this.net = new NetOps(this.state, grants);
-    this.sys = new SysOps(grants);
   }
   given;
   anchors;
   state;
-  fs;
-  process;
-  net;
-  sys;
+  ops = /* @__PURE__ */ new Map();
   placed = false;
   /** The listener handle of each open stream, by its key. */
   streams = /* @__PURE__ */ new Map();
+  /** The ops that check `orbital`'s grants (the app level alone with none): every grant decision is the kernel's, asked with the orbital. */
+  opsFor(orbital) {
+    const held = this.ops.get(orbital);
+    if (held !== void 0) return held;
+    const grants = anchoredGrants({ ...this.given, allows: (need) => this.given.allows(need, orbital) }, this.anchors);
+    const made = { fs: new FsOps(this.state, grants), process: new ProcessOps(this.state, grants), net: new NetOps(this.state, grants), sys: new SysOps(grants) };
+    this.ops.set(orbital, made);
+    return made;
+  }
   /** The call's arguments with every anchored part resolved by the kernel, the program's anchors placed on the first call. */
   resolved(op, args) {
     if (!this.placed) {
@@ -1908,47 +1915,49 @@ var NodeOsHost = class {
     if ("error" in resolved) throw new OsFailure(resolved.error);
     return resolved.ok;
   }
-  async dispatch(op, given) {
+  async dispatch(op, given, orbital) {
     const args = this.resolved(op, given);
+    const { fs, process: process2, net, sys } = this.opsFor(orbital);
     if (op === "os/close") {
-      if (this.fs.closeOwned(args) || this.net.closeOwned(args)) return {};
+      if (fs.closeOwned(args) || net.closeOwned(args)) return {};
       throw osFailure("closed", op, "not an open handle");
     }
-    if (isFsOp(op)) return this.fs.run(op, args);
-    if (isProcessOp(op)) return this.process.run(op, args);
-    if (isNetOp(op)) return this.net.run(op, args);
-    if (isSysOp(op)) return this.sys.run(op);
+    if (isFsOp(op)) return fs.run(op, args);
+    if (isProcessOp(op)) return process2.run(op, args);
+    if (isNetOp(op)) return net.run(op, args);
+    if (isSysOp(op)) return sys.run(op);
     if (DEVICE_OPS.has(op)) throw osFailure("unsupported", op, "this host has no devices");
     throw osFailure("unsupported", op, "this host does not implement the operation yet");
   }
-  async answer(op, args) {
+  async answer(op, args, orbital) {
     try {
-      return { ok: await this.dispatch(op, args) };
+      return { ok: await this.dispatch(op, args, orbital) };
     } catch (raised) {
       return { error: failureOf(op, raised) };
     }
   }
-  deferral(op, args) {
+  deferral(op, args, orbital) {
+    const { fs, process: process2, net } = this.opsFor(orbital);
     switch (op) {
       case "os/wait":
-        return this.process.waitLater(args);
+        return process2.waitLater(args);
       case "os/read":
-        return this.fs.readLater(op, args);
+        return fs.readLater(op, args);
       case "os/send":
-        return this.net.sendLater(op, args);
+        return net.sendLater(op, args);
       case "os/recv":
-        return this.net.recvLater(op, args);
+        return net.recvLater(op, args);
       case "os/recvfrom":
-        return this.net.recvfromLater(op, args);
+        return net.recvfromLater(op, args);
       default:
         throw osFailure("unsupported", op, "this operation does not defer its completion");
     }
   }
   /** `Completions::run_later`: the checks fail in place, the wait runs in the background and its outcome goes to `deliver` unless the key is cancelled first. */
-  defer(op, args, key, deliver) {
+  defer(op, args, key, deliver, orbital) {
     let blocking;
     try {
-      blocking = this.deferral(op, this.resolved(op, args));
+      blocking = this.deferral(op, this.resolved(op, args), orbital);
     } catch (raised) {
       return { error: failureOf(op, raised) };
     }
@@ -1967,11 +1976,11 @@ var NodeOsHost = class {
     return { ok: null };
   }
   /** A keyed stream (EXEC-QUEUE-12): `os/tcp-listen` binds and answers in place, then each connection reaches `message`. */
-  async stream(op, args, key, message, fail2) {
+  async stream(op, args, key, message, fail2, orbital) {
     try {
       if (op !== "os/tcp-listen") throw osFailure("unsupported", op, "this host streams only os/tcp-listen");
       if (this.streams.has(key)) throw invalid(op, `key ${key} already has a stream open`);
-      const answer = await this.net.listen(op, this.resolved(op, args), message, (error) => {
+      const answer = await this.opsFor(orbital).net.listen(op, this.resolved(op, args), message, (error) => {
         this.streams.delete(key);
         fail2(error);
       });
@@ -1985,7 +1994,7 @@ var NodeOsHost = class {
     const listener = this.streams.get(key);
     if (listener !== void 0) {
       this.streams.delete(key);
-      this.net.stopListening(listener);
+      this.opsFor(void 0).net.stopListening(listener);
       return true;
     }
     return this.state.completions.cancel(key);
@@ -1997,7 +2006,7 @@ var NodeOsHost = class {
 function processAnchors() {
   const env = {};
   for (const [name, value] of Object.entries(process.env)) if (value !== void 0) env[name] = value;
-  return { home: homedir(), start: process.cwd(), exeDir: dirname(process.execPath), env };
+  return { home: homedir(), start: process.cwd(), exeDir: dirname(process.execPath), exe: process.execPath, env };
 }
 function createNodeOsHost(grants, options = {}) {
   return new NodeOsHost(grants, options.anchors ?? processAnchors());
@@ -2034,17 +2043,17 @@ async function resolveProgramFile(path, cwd = dirname(resolve(path)), orb = reso
   });
 }
 var KernelProgram = class _KernelProgram {
-  constructor(engine, os, schema, http, persistence) {
+  constructor(engine, os, schema, secretPorts, persistence) {
     this.engine = engine;
     this.os = os;
     this.schema = schema;
-    this.http = http;
+    this.secretPorts = secretPorts;
     this.persistence = persistence;
   }
   engine;
   os;
   schema;
-  http;
+  secretPorts;
   persistence;
   static async open(schema, options) {
     const languageFrom = { languageFrom: options.languageFrom };
@@ -2053,20 +2062,17 @@ var KernelProgram = class _KernelProgram {
     const kernelDir = addon === void 0 ? options.kernelDir ?? resolveKernelDir() : "";
     const kernel = addon ?? await loadKernelModule(kernelDir, languageFrom);
     installNodeHostPorts();
-    const http = createHttpPorts({
-      kernel: addon !== void 0 ? async () => addon : () => loadHttpKernel(kernelDir, languageFrom),
-      ...options.http,
-      egress: schema.egress ?? []
-    });
-    const persistence = new NativeMemoryPersistenceAdapter(new kernel.MemoryStore());
-    for (const [entityType, rows] of Object.entries(options.seed ?? {})) {
-      for (const row of rows) await persistence.writeWhere({ kind: "upsert", entityType, data: row });
-    }
     let engine;
     const requireEngine = () => {
       if (engine === void 0) throw new Error("KernelProgram: an os ask arrived before the program opened");
       return engine;
     };
+    const tokenPost = createNodeTokenPost({ egressAllows: (url) => requireEngine().egressAllows(url), isPublicAddress: (ip) => kernel.isPublicAddress(ip) });
+    const secretPorts = createSecretPorts({ tokenPost, ...options.secretPorts });
+    const persistence = new NativeMemoryPersistenceAdapter(new kernel.MemoryStore());
+    for (const [entityType, rows] of Object.entries(options.seed ?? {})) {
+      for (const row of rows) await persistence.writeWhere({ kind: "upsert", entityType, data: row });
+    }
     const os = options.os === true ? createNodeOsHost(kernelOsGrants(kernel, requireEngine)) : void 0;
     const ports = {
       persistence,
@@ -2078,18 +2084,18 @@ var KernelProgram = class _KernelProgram {
       }, read: async () => [] }),
       deliverLive: () => void 0,
       deferCallOutcome: () => void 0,
-      http,
+      secretPorts,
       ...os !== void 0 ? { os } : {}
     };
     engine = KernelEngine.open(kernel, schema, ports);
-    return new _KernelProgram(engine, os, schema, http, persistence);
+    return new _KernelProgram(engine, os, schema, secretPorts, persistence);
   }
-  /** Fire `event` at the orbital as `user` (the program's `@user`), wait for its whole cascade (every `http` ask included), and return what it emitted. */
+  /** Fire `event` at the orbital as `user` (the program's `@user`), wait for its whole cascade (every secret ask included), and return what it emitted. */
   async dispatch(orbital, event, payload = {}, targetTrait, user) {
     const response = await this.engine.evaluate(
       orbital,
       { event, payload, ...targetTrait !== void 0 ? { targetTrait } : {}, ...user !== void 0 ? { user } : {} },
-      { orbital, ...user !== void 0 ? { user } : {} }
+      { orbital }
     );
     return {
       success: response.success,
@@ -2110,7 +2116,7 @@ var KernelProgram = class _KernelProgram {
   }
   /** Deliver an `/api/hooks/<name>` request to the program and return the answer it gave (EXEC-INBOUND-1). */
   async deliverInbound(name, delivery) {
-    return dispatchInbound(this.schema, name, delivery, (orbital, request) => this.engine.evaluate(orbital, request, { orbital }), (credential) => this.http.secrets.get(credential, void 0));
+    return dispatchInbound(this.engine, name, delivery, (orbital, request) => this.engine.evaluate(orbital, request, { orbital }), (credential) => this.secretPorts.secrets.get(credential, void 0));
   }
   /** The rows the host's in-memory store holds for `entity` (empty when the native kernel keeps its own `store`). */
   async rows(entity) {
@@ -2216,4 +2222,4 @@ function kernelWorkspaceHost(options) {
   };
 }
 
-export { GCS_ENDPOINT, KernelProgram, WORKSPACE_HMAC_KEY_ID, WORKSPACE_HMAC_SECRET, createNodeOsHost, emitPayload, kernelWorkspaceHost, processAnchors, resolveKernelDir, resolveProgramFile, workspaceBucketFromEnv, workspacesRoot };
+export { KernelProgram, createNodeOsHost, emitPayload, kernelWorkspaceHost, processAnchors, resolveProgramFile, workspaceBucketFromEnv, workspacesRoot };

package/dist/createProgramHandlers.js

@@ -1,6 +1,6 @@
-export { createProgramHandlers } from './chunk-WZFQ7T7V.js';
-import './chunk-BJA6GYC5.js';
-import './chunk-23YAOI6P.js';
-import './chunk-UBZT5LDW.js';
-import './chunk-QYAPNUBH.js';
+export { createProgramHandlers } from './chunk-7QG7JGKQ.js';
+import './chunk-YLFK5OJN.js';
+import './chunk-VQVAHUAX.js';
+import './chunk-EEYGL7AB.js';
+import './chunk-7QE32QQR.js';
 import './chunk-BWMLDDCL.js';

package/dist/index.d.ts

@@ -1,19 +1,44 @@
-import { PinnedFetch, CredentialScopeStorage, NetPort, ResolvedHost, OsAnchors, OsGrantPort, OsHostPort, KernelModule, HttpKernel, CredentialSeedKernel, NativeMemoryPersistenceAdapter, ServiceCallContext, StepRequest, PlayedStep, ProgramValidationReport, ProgramEffectName, ProgramEffectOutcome } from '@almadar/shell-runtime';
-import { JsonValue, KernelMemoryStoreExports, OrbitalSchema, EvaluatedProgram, ProgramValidationIssue, CatalogScope, CatalogEntry, DependencyGraph, TraitValue, TraitDescription, DescribeTarget, BehaviorDescription, BehaviorRef, BehaviorValueMountResult, TraitValueMountResult } from '@almadar/core';
-export { ClientEffectTuple, ClientNavigateBackTuple, ClientNavigateTuple, ClientRenderUITuple, OrbitalEventRequest, OrbitalEventResponse, TransitionRejection } from '@almadar/core';
-import * as installedModule from '@almadar/kernel';
+import { CredentialVaultModule, CredentialVault, CredentialRowsPort, OsAnchors, OsGrantPort, OsHostPort, TokenEndpointPost, KernelModule, NativeMemoryPersistenceAdapter, ServiceCallContext, StepRequest, PlayedStep, ProgramValidationReport, ProgramEffectName, ProgramEffectOutcome } from '@almadar/shell-runtime';
+import { JsonValue, KernelMemoryStoreExports, OrbitalSchema, EvaluatedProgram, ProgramValidationIssue, CatalogScope, CatalogEntry, DependencyGraph, TraitValue, TraitDescription, DescribeTarget, BehaviorDescription } from '@almadar/core';
+export { ClientEffectTuple, ClientNavigateBackTuple, ClientNavigateTuple, ClientRenderUITuple, EventRequest, EventResponse, TransitionRejection } from '@almadar/core';
+import { RequestOptions } from 'node:https';
+import { IncomingMessage, ClientRequest } from 'node:http';
+import { OsGrantsReport, ProveReport, StepRefusal } from '@almadar/core/kernel-wire';
 import { LayoutStrategy } from '@almadar/core/builders';
-export { G as GCS_ENDPOINT, K as KernelProgram, a as KernelProgramOptions, b as KernelWorkspaceBucket, c as KernelWorkspaceHostOptions, P as ProgramRun, W as WORKSPACE_HMAC_KEY_ID, d as WORKSPACE_HMAC_SECRET, e as WorkspaceHost, f as WorkspacePort, g as emitPayload, i as installWorkspaceHost, h as installedWorkspaceHost, k as kernelWorkspaceHost, r as resolveKernelDir, j as resolveProgramFile, u as uninstallWorkspaceHost, w as workspaceBucketFromEnv, l as workspaceOwnerSegment, m as workspacesRoot } from './kernel-workspace-host-CU56iOlt.js';
-export { HostDispatchItem, LiveBroadcastItem, LoaderConfig, OrbitalInfo, OrbitalServerRuntime, OrbitalServerRuntimeConfig, OrbitalSummary, PushItem, RegisterOptions, RegisteredOrbital, RuntimeOrbital, RuntimeOrbitalSchema, RuntimeTrait, RuntimeTraitTick, UnresolvedProgramError, createOrbitalServerRuntime } from './OrbitalServerRuntime.js';
+export { K as KernelProgram, a as KernelProgramOptions, b as KernelWorkspaceBucket, c as KernelWorkspaceHostOptions, P as ProgramRun, W as WorkspaceHost, d as WorkspacePort, e as emitPayload, i as installWorkspaceHost, f as installedWorkspaceHost, k as kernelWorkspaceHost, r as resolveProgramFile, u as uninstallWorkspaceHost, w as workspaceBucketFromEnv, g as workspaceOwnerSegment, h as workspacesRoot } from './kernel-workspace-host-cT9JGJur.js';
+export { HostDispatchItem, LiveBroadcastItem, LoaderConfig, OrbitalServerRuntime, OrbitalServerRuntimeConfig, PushItem, RegisterOptions, RegisteredOrbital, RuntimeOrbital, RuntimeOrbitalSchema, UnresolvedProgramError } from './OrbitalServerRuntime.js';
 export { ProgramHandlers, ProgramHostConfig, createProgramHandlers } from './createProgramHandlers.js';
 
-declare const pinnedFetchNode: PinnedFetch;
-
-declare function resolveHostNode(host: string): Promise<ResolvedHost>;
-declare const nodeNetPort: NetPort;
-declare function nodeCredentialScope(): CredentialScopeStorage;
-/** Install the Node ports `@almadar/shell-runtime` leaves open: the pinned `http` fetch + resolver and per-tenant credential scopes. Idempotent. */
+/** Install the Node ports `@almadar/shell-runtime` leaves open: per-tenant credential scopes. Idempotent. */
 declare function installNodeHostPorts(): void;
+interface NodeCredentialVaultOptions {
+    /** The kernel module that carries the vault class (`@almadar/kernel`, initialised). */
+    kernel: CredentialVaultModule;
+    /** Defaults to the process env, which the native host reads the same keys and file from. */
+    env?: Record<string, string | undefined>;
+    /** Defaults to the working directory, where the native host looks for `.almadar/dev-credentials.json`. */
+    cwd?: string;
+}
+/**
+ * The durable credential vault of a Node host, as the native host opens it: the key in `ALMADAR_CREDENTIAL_MASTER_KEY`
+ * (and `..._PREVIOUS` in a rotation window), the rows in the encrypted file `ALMADAR_CREDENTIALS_FILE` names, else
+ * `.almadar/dev-credentials.json`, so one file serves both hosts. With no master key set the host has no store and this
+ * answers `null`; a key that is not 64 hex digits, or a row the kernel cannot read, rejects. The vault is installed as the
+ * process-wide credential store.
+ */
+declare function installNodeCredentialVault(options: NodeCredentialVaultOptions): Promise<CredentialVault | null>;
+
+declare const DEFAULT_CREDENTIALS_FILE = ".almadar/dev-credentials.json";
+/** `ALMADAR_CREDENTIALS_FILE`, else `.almadar/dev-credentials.json` under the working directory, as the native host resolves it. */
+declare function credentialsFilePath(env?: Record<string, string | undefined>, cwd?: string): string;
+/**
+ * The kernel's credential rows kept in a JSON file, the layout the native host writes: an array of rows each carrying an
+ * `id`, written whole through a temporary file and a rename. A missing file is no rows; a file that cannot be read, is not
+ * JSON, is not an array of rows or holds a row without an id is a failure. Operations here run one after another, so the
+ * conditional delete is atomic against every other port over the same file in this process; a second process is not
+ * covered, as with the native host.
+ */
+declare function fileCredentialRows(path: string): CredentialRowsPort;
 
 /**
  * A development host's credential-store master key: read from `<dir>/dev-credential-master-key`,
@@ -68,7 +93,6 @@ interface KvBackend {
     /** Replace the namespace content atomically: a failure leaves the previous content. */
     commit(ns: KvNamespace, table: KvTable): Promise<void>;
 }
-declare function namespaceId(ns: KvNamespace): string;
 declare function memoryKvBackend(): KvBackend;
 declare function directoryKvBackend(stateDir: string): KvBackend;
 interface KvHost {
@@ -91,8 +115,25 @@ interface KvHost {
 }
 declare function createKvHost(backend: KvBackend): KvHost;
 
+interface ResolvedAddress {
+    address: string;
+    family: number;
+}
+interface NodeTokenPostOptions {
+    /** The kernel's egress rule over the program's declared origins. */
+    egressAllows(url: string): boolean;
+    /** The kernel's public-address rule. */
+    isPublicAddress(ip: string): boolean;
+    request?: (options: RequestOptions, onResponse: (response: IncomingMessage) => void) => ClientRequest;
+    resolve?: (host: string) => Promise<ResolvedAddress[]>;
+}
+declare class TokenPostRefusal extends Error {
+    constructor(message: string);
+}
+declare function createNodeTokenPost(options: NodeTokenPostOptions): TokenEndpointPost;
+
 /** The whole server kernel as Node loads it: the shared module plus the server-only exports the client build omits. */
-interface LoadedKernel extends KernelModule, HttpKernel, CredentialSeedKernel, KernelMemoryStoreExports {
+interface LoadedKernel extends KernelModule, KernelMemoryStoreExports {
     initSync(input: {
         module: Uint8Array;
     }): object;
@@ -103,26 +144,17 @@ interface LoadKernelOptions {
     /** Where the installed `@almadar/core` and `@almadar/std` are found, node-style. Required: the caller names its own root. */
     languageFrom: string;
 }
-/**
- * Loads the kernel and installs the language data the installed packages declare (the operator table that
- * routes `program/*` and the other host effects), as `orb` reads it. The first install in a process wins.
- */
-declare function loadKernelModule(kernelDir: string, options: LoadKernelOptions): Promise<LoadedKernel>;
-/**
- * The kernel of the `@almadar/kernel` package this host installs, initialised synchronously with the language data
- * the packages under `languageFrom` declare. `languageFrom` is required; the first call in a process wins.
- */
-declare function initKernelSync(languageFrom: string): typeof installedModule;
 /**
  * The kernel of the `@almadar/kernel` package this host installs, loaded once per process with the language data
  * the packages under `languageFrom` declare. A host with no package installed rejects, never falls back.
  */
 declare function loadInstalledKernel(languageFrom: string): Promise<LoadedKernel>;
 /**
- * The `http` effect's builder exports of the same package (`buildHttpRequest`, `isPublicAddress`, …): the
- * interpreter's only way to build a request. A directory that does not hold a built kernel rejects, never falls back.
+ * Loads the kernel from `kernelDir` (the one with `pkg/`) and installs the language data the installed packages declare
+ * (the operator table that routes `program/*` and the other host effects), as `orb` reads it. The first install in a
+ * process wins.
  */
-declare function loadHttpKernel(kernelDir: string, options: LoadKernelOptions): Promise<HttpKernel>;
+declare function loadKernelModule(kernelDir: string, options: LoadKernelOptions): Promise<LoadedKernel>;
 /**
  * Where the native kernel add-on is: `ALMADAR_KERNEL_NODE`, else `kernel.node` in the `@almadar/orb-<platform>-<arch>`
  * package this platform installs. Rejects when neither exists, so a host can fall back to the wasm kernel by choice.
@@ -151,26 +183,25 @@ interface ProgramHostOptions {
     /** Explicit `orb` binary; defaults to {@link resolveOrbBinary}. */
     readonly orbBin?: string;
 }
-/** `behavior/catalog`: installed behaviors under registry folders; `vectors: false` omits the vectors (`--no-vectors`). */
+/** `behavior/catalog`: installed behaviors under registry folders; `traits: false` omits each entry's traits (`--no-traits`). */
 declare function behaviorCatalog(scope: CatalogScope, opts: ProgramHostOptions, options?: {
-    readonly vectors?: boolean;
+    readonly traits?: boolean;
 }): Promise<CatalogEntry[]>;
 /** {@link behaviorCatalog} for a caller that cannot await. */
 declare function behaviorCatalogSync(scope: CatalogScope, opts: ProgramHostOptions): CatalogEntry[];
-/** `behavior/describe`: a trait value's knobs and events; an orbital value's or a whole behavior's orbitals.
- * `knobVectors: true` attaches a trait's knob vectors (`--knob-vectors`). */
-declare function behaviorDescribe(value: TraitValue, opts: ProgramHostOptions, options?: {
-    readonly knobVectors?: boolean;
-}): Promise<TraitDescription>;
-declare function behaviorDescribe(value: DescribeTarget, opts: ProgramHostOptions, options?: {
-    readonly knobVectors?: boolean;
-}): Promise<TraitDescription | BehaviorDescription>;
+/** `behavior/describe`: a trait value's knobs and events; an orbital value's or a whole behavior's orbitals. */
+declare function behaviorDescribe(value: TraitValue, opts: ProgramHostOptions): Promise<TraitDescription>;
+declare function behaviorDescribe(value: DescribeTarget, opts: ProgramHostOptions): Promise<TraitDescription | BehaviorDescription>;
 /** `behavior/source`: the behavior a value belongs to, as a program (`.orb` IR). */
 declare function behaviorSource(value: Pick<TraitValue, 'behavior'>, opts: ProgramHostOptions): Promise<OrbitalSchema>;
 /** `program/read`: `.lolo` text → a program (`.orb` IR). */
 declare function programRead(text: string, opts: ProgramHostOptions): Promise<OrbitalSchema>;
 /** `program/print`: a program (`.orb` IR) → `.lolo` text. */
 declare function programPrint(program: OrbitalSchema, opts: ProgramHostOptions): Promise<string>;
+/** What `program/os-grants` returns: the static `os/` grant check's typed findings. */
+type ProgramOsGrantsReport = OsGrantsReport;
+/** What `program/prove` returns: every spec proposition the program cannot be shown to keep. */
+type ProgramProveReport = ProveReport;
 /** Who runs a program effect: the signed-in caller, as `call-service` receives it. */
 type ProgramCallContext = Pick<ServiceCallContext, 'principal' | 'role'>;
 /**
@@ -204,6 +235,28 @@ type ProgramEvalResult = {
  * to the workspace or the project.
  */
 declare function programValidate(program: OrbitalSchema, opts: Pick<ProgramEvalOptions, 'cwd' | 'prior' | 'final'> & ProgramHostOptions): Promise<ProgramValidationReport>;
+/**
+ * `program/prove`: the kernel prover's findings on a program, asked of `orb prove` (the prover is the kernel's, so the
+ * node host carries no copy of it). A program value is written to a temp file and resolved like any file; `path` names
+ * the file directly.
+ */
+declare function programProve(target: {
+    readonly program: OrbitalSchema;
+} | {
+    readonly path: string;
+}, opts: ProgramHostOptions): Promise<ProgramProveReport>;
+/**
+ * `program/os-grants`: the kernel's static `os/` grant findings on a program, asked of `orb os-grants` (the check is the
+ * kernel's, so the node host carries no copy of it). `final` checks the finished program, where a config-fed target is a
+ * literal. A program value is written to a temp file and resolved like any file; `path` names the file directly.
+ */
+declare function programOsGrants(target: {
+    readonly program: OrbitalSchema;
+} | {
+    readonly path: string;
+}, opts: ProgramHostOptions & {
+    readonly final?: boolean;
+}): Promise<ProgramOsGrantsReport>;
 /**
  * `program/eval`: validate through {@link stampAndValidate}, and on success write the program to `orbitals/<name>.orb` in its workspace (or `cwd`)
  * and return its traits as values. Failures come back as data.
@@ -218,27 +271,12 @@ interface ProgramComposeOptions {
 }
 /**
  * `program/compose`: assemble programs, in the order given, into one app
- * program — core `composeAppFromFiles` (pages, layout, wiring, the app nav).
- * The composer's registry lookups (an import's source orbital, an atom's trait,
- * an organism's orbital order) are served from `orb behaviors source` for every
- * behavior the programs import, loaded once up front.
+ * program. The composer is `orb compose` (the Rust composer, `program/compose`
+ * of the kernel's program host): the programs are written to a scratch folder
+ * and handed to it, and its JSON is the answer. Pages, layout, wiring, the app
+ * nav and every registry read are `orb`'s.
  */
 declare function programCompose(programs: readonly OrbitalSchema[], options: ProgramComposeOptions, opts: ProgramHostOptions): Promise<OrbitalSchema>;
-/**
- * Turn a trait value into a program a host can run: a one-orbital wrapper that
- * imports the value's owning orbital with `only { T }` and the value's overrides
- * as `traits { T { … } }` (LOLO §8b), validated at the 0/0 bar (the binding's
- * admission check) and resolved by `orb`. A project-relative behavior
- * (`./orbitals/X`) is imported relatively from a wrapper written at `cwd`, since
- * `orb`'s loader refuses an absolute import.
- */
-declare function mountTraitValue(value: TraitValue, opts: ProgramHostOptions, context?: ProgramCallContext): Promise<TraitValueMountResult>;
-/**
- * Make a behavior value runnable: the program as written is validated at the
- * 0/0 bar (the embed's admission check) and resolved by `orb`; the frame opens
- * it on its default page (the one marked `initial`, else the first).
- */
-declare function mountBehaviorValue(value: BehaviorRef, opts: ProgramHostOptions, context?: ProgramCallContext): Promise<BehaviorValueMountResult>;
 /** A program file resolved by `orb` (every import flattened, every composed trait inlined): what a host registers. */
 declare function programResolve(path: string, opts: ProgramHostOptions): Promise<OrbitalSchema>;
 /** An unresolved program resolved by `orb` from the project root `opts.cwd`, so its relative imports resolve there. */
@@ -249,9 +287,7 @@ declare function behaviorResolve(value: Pick<TraitValue, 'behavior'>, opts: Prog
 }>;
 /** `behavior/dependencies`: a program's dependency graph — each orbital's imports, then every installed behavior they reach, with its layer and its own imports. */
 declare function behaviorDependencies(program: OrbitalSchema, opts: ProgramHostOptions): Promise<DependencyGraph>;
-declare function programStep(program: OrbitalSchema, requests: readonly StepRequest[], opts: ProgramHostOptions, live?: boolean): Promise<PlayedStep[] | {
-    error: string;
-}>;
+declare function programStep(program: OrbitalSchema, requests: readonly StepRequest[], opts: ProgramHostOptions, live?: boolean): Promise<PlayedStep[] | StepRefusal>;
 type EffectArg = JsonValue;
 /**
  * Parse one program effect's positional arguments (the trailing emit config
@@ -261,5 +297,5 @@ type EffectArg = JsonValue;
  */
 declare function runProgramEffect(op: ProgramEffectName, args: readonly EffectArg[], opts: ProgramHostOptions, context?: ProgramCallContext): Promise<ProgramEffectOutcome>;
 
-export { KvFailure, behaviorCatalog, behaviorCatalogSync, behaviorDependencies, behaviorDescribe, behaviorResolve, behaviorSource, createKvHost, createNodeOsHost, directoryKvBackend, initKernelSync, installNodeHostPorts, loadHttpKernel, loadInstalledKernel, loadKernelModule, loadNativeKernelModule, loadOrCreateDevMasterKey, memoryKvBackend, mountBehaviorValue, mountTraitValue, namespaceId, nativeMemoryOf, nodeCredentialScope, nodeNetPort, pinnedFetchNode, processAnchors, programCompose, programEval, programPrint, programRead, programResolve, programResolveSchema, programStep, programValidate, resolveHostNode, resolveNativeAddon, runProgramEffect, workspaceAccessError };
-export type { KvBackend, KvBatchOp, KvErrorKind, KvHost, KvNamespace, KvResult, KvScanEntry, KvTable, LoadKernelOptions, LoadedKernel, NodeOsHostOptions, ProgramCallContext, ProgramComposeOptions, ProgramEvalOptions, ProgramEvalResult, ProgramHostOptions };
+export { DEFAULT_CREDENTIALS_FILE, KvFailure, TokenPostRefusal, behaviorCatalog, behaviorCatalogSync, behaviorDependencies, behaviorDescribe, behaviorResolve, behaviorSource, createKvHost, createNodeOsHost, createNodeTokenPost, credentialsFilePath, directoryKvBackend, fileCredentialRows, installNodeCredentialVault, installNodeHostPorts, loadInstalledKernel, loadKernelModule, loadNativeKernelModule, loadOrCreateDevMasterKey, memoryKvBackend, nativeMemoryOf, processAnchors, programCompose, programEval, programOsGrants, programPrint, programProve, programRead, programResolve, programResolveSchema, programStep, programValidate, resolveNativeAddon, runProgramEffect, workspaceAccessError };
+export type { KvBackend, KvBatchOp, KvErrorKind, KvHost, KvNamespace, KvResult, LoadKernelOptions, LoadedKernel, NodeCredentialVaultOptions, NodeOsHostOptions, NodeTokenPostOptions, ProgramCallContext, ProgramComposeOptions, ProgramEvalOptions, ProgramEvalResult, ProgramHostOptions, ProgramOsGrantsReport, ProgramProveReport, ResolvedAddress };

package/dist/index.js

@@ -1,9 +1,9 @@
-export { OrbitalServerRuntime, UnresolvedProgramError, createOrbitalServerRuntime } from './chunk-A2TIXOLJ.js';
-export { createProgramHandlers } from './chunk-WZFQ7T7V.js';
-export { GCS_ENDPOINT, KernelProgram, WORKSPACE_HMAC_KEY_ID, WORKSPACE_HMAC_SECRET, createNodeOsHost, emitPayload, kernelWorkspaceHost, processAnchors, resolveKernelDir, resolveProgramFile, workspaceBucketFromEnv, workspacesRoot } from './chunk-BJA6GYC5.js';
-export { installNodeHostPorts, nodeCredentialScope, nodeNetPort, pinnedFetchNode, resolveHostNode } from './chunk-23YAOI6P.js';
-export { initKernelSync, loadHttpKernel, loadInstalledKernel, loadKernelModule, loadNativeKernelModule, nativeMemoryOf, resolveNativeAddon } from './chunk-UBZT5LDW.js';
-export { behaviorCatalog, behaviorCatalogSync, behaviorDependencies, behaviorDescribe, behaviorResolve, behaviorSource, mountBehaviorValue, mountTraitValue, programCompose, programEval, programPrint, programRead, programResolve, programResolveSchema, programStep, programValidate, runProgramEffect, workspaceAccessError } from './chunk-QYAPNUBH.js';
+export { OrbitalServerRuntime, UnresolvedProgramError } from './chunk-3PNZYEZQ.js';
+export { createProgramHandlers } from './chunk-7QG7JGKQ.js';
+export { KernelProgram, createNodeOsHost, emitPayload, kernelWorkspaceHost, processAnchors, resolveProgramFile, workspaceBucketFromEnv, workspacesRoot } from './chunk-YLFK5OJN.js';
+export { DEFAULT_CREDENTIALS_FILE, TokenPostRefusal, createNodeTokenPost, credentialsFilePath, fileCredentialRows, installNodeCredentialVault, installNodeHostPorts } from './chunk-VQVAHUAX.js';
+export { loadInstalledKernel, loadKernelModule, loadNativeKernelModule, nativeMemoryOf, resolveNativeAddon } from './chunk-EEYGL7AB.js';
+export { behaviorCatalog, behaviorCatalogSync, behaviorDependencies, behaviorDescribe, behaviorResolve, behaviorSource, programCompose, programEval, programOsGrants, programPrint, programProve, programRead, programResolve, programResolveSchema, programStep, programValidate, runProgramEffect, workspaceAccessError } from './chunk-7QE32QQR.js';
 export { installWorkspaceHost, installedWorkspaceHost, uninstallWorkspaceHost, workspaceOwnerSegment } from './chunk-BWMLDDCL.js';
 import { randomBytes } from 'crypto';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
@@ -214,4 +214,4 @@ function createKvHost(backend) {
   };
 }
 
-export { KvFailure, createKvHost, directoryKvBackend, loadOrCreateDevMasterKey, memoryKvBackend, namespaceId };
+export { KvFailure, createKvHost, directoryKvBackend, loadOrCreateDevMasterKey, memoryKvBackend };

package/dist/kernel-loader-3JR6LJV5.js

@@ -0,0 +1 @@
+export { loadInstalledKernel, loadKernelModule, loadNativeKernelModule, nativeMemoryOf, resolveNativeAddon } from './chunk-EEYGL7AB.js';

package/dist/{kernel-workspace-host-CU56iOlt.d.ts → kernel-workspace-host-cT9JGJur.d.ts}

@@ -1,4 +1,4 @@
-import { ServiceCallContext, HttpPortsOptions } from '@almadar/shell-runtime';
+import { ServiceCallContext, SecretPortsOptions } from '@almadar/shell-runtime';
 import { OrbitalSchema, EntityRow, EventPayload, UserContext, EmittedEvent, TransitionRejection, InboundDelivery, InboundAnswer } from '@almadar/core';
 
 /**
@@ -52,8 +52,8 @@ interface KernelProgramOptions {
     kernelDir?: string;
     /** Where the installed `@almadar/core` and `@almadar/std` are found, node-style. */
     languageFrom: string;
-    /** Transport overrides of the `http` effect: pinned fetch, address resolver, secret store. */
-    http?: Pick<HttpPortsOptions, 'fetch' | 'resolve' | 'secrets' | 'random'>;
+    /** Overrides of the secret store and the CSPRNG. */
+    secretPorts?: Pick<SecretPortsOptions, 'secrets' | 'random'>;
     /** Rows the program's in-memory store starts with, by entity name (a catalog the host already holds). */
     seed?: Record<string, EntityRow[]>;
     /** Answer the program's `os` effects with the Node host (its grants are the program's own); absent, every `os` ask is denied. */
@@ -67,8 +67,6 @@ interface ProgramRun {
     rejections: TransitionRejection[];
     error?: string;
 }
-/** `ALMADAR_KERNEL_DIR`, else the `@almadar/kernel` package that `from` (default: the working directory) resolves. */
-declare function resolveKernelDir(from?: string): string;
 /** The payload of the first emit named `event`, read through `read`; `undefined` when the run emitted none. */
 declare function emitPayload<T>(run: ProgramRun, event: string, read: (payload: EventPayload) => T): T | undefined;
 /**
@@ -80,11 +78,11 @@ declare class KernelProgram {
     private readonly engine;
     private readonly os;
     private readonly schema;
-    private readonly http;
+    private readonly secretPorts;
     private readonly persistence;
     private constructor();
     static open(schema: OrbitalSchema, options: KernelProgramOptions): Promise<KernelProgram>;
-    /** Fire `event` at the orbital as `user` (the program's `@user`), wait for its whole cascade (every `http` ask included), and return what it emitted. */
+    /** Fire `event` at the orbital as `user` (the program's `@user`), wait for its whole cascade (every secret ask included), and return what it emitted. */
     dispatch(orbital: string, event: string, payload?: EventPayload, targetTrait?: string, user?: UserContext): Promise<ProgramRun>;
     /** Fire `trait`'s tick `name` once, as a host timer would; the kernel evaluates the tick's guard and effects. */
     tick(orbital: string, trait: string, name: string): Promise<ProgramRun>;
@@ -108,9 +106,6 @@ interface KernelWorkspaceBucket {
     /** The name of the credential (an environment variable) holding the HMAC secret. */
     secretAccessKey: string;
 }
-declare const GCS_ENDPOINT = "https://storage.googleapis.com";
-declare const WORKSPACE_HMAC_KEY_ID = "ALMADAR_WORKSPACE_HMAC_KEY_ID";
-declare const WORKSPACE_HMAC_SECRET = "ALMADAR_WORKSPACE_HMAC_SECRET";
 /** The bucket a host's environment names: `ALMADAR_WORKSPACE_BUCKET` on Google Cloud Storage, keyed by the two HMAC credentials; absent, the project's disk. */
 declare function workspaceBucketFromEnv(env: Record<string, string | undefined>): KernelWorkspaceBucket | undefined;
 interface KernelWorkspaceHostOptions {
@@ -131,5 +126,5 @@ declare function workspacesRoot(projectRoot: string): string;
  */
 declare function kernelWorkspaceHost(options: KernelWorkspaceHostOptions): WorkspaceHost;
 
-export { GCS_ENDPOINT as G, KernelProgram as K, WORKSPACE_HMAC_KEY_ID as W, WORKSPACE_HMAC_SECRET as d, emitPayload as g, installedWorkspaceHost as h, installWorkspaceHost as i, resolveProgramFile as j, kernelWorkspaceHost as k, workspaceOwnerSegment as l, workspacesRoot as m, resolveKernelDir as r, uninstallWorkspaceHost as u, workspaceBucketFromEnv as w };
-export type { ProgramRun as P, KernelProgramOptions as a, KernelWorkspaceBucket as b, KernelWorkspaceHostOptions as c, WorkspaceHost as e, WorkspacePort as f };
+export { KernelProgram as K, emitPayload as e, installedWorkspaceHost as f, workspaceOwnerSegment as g, workspacesRoot as h, installWorkspaceHost as i, kernelWorkspaceHost as k, resolveProgramFile as r, uninstallWorkspaceHost as u, workspaceBucketFromEnv as w };
+export type { ProgramRun as P, WorkspaceHost as W, KernelProgramOptions as a, KernelWorkspaceBucket as b, KernelWorkspaceHostOptions as c, WorkspacePort as d };

package/dist/kernelWorkspace.d.ts

@@ -1,3 +1,3 @@
-export { G as GCS_ENDPOINT, b as KernelWorkspaceBucket, c as KernelWorkspaceHostOptions, W as WORKSPACE_HMAC_KEY_ID, d as WORKSPACE_HMAC_SECRET, k as kernelWorkspaceHost, w as workspaceBucketFromEnv, m as workspacesRoot } from './kernel-workspace-host-CU56iOlt.js';
+export { b as KernelWorkspaceBucket, c as KernelWorkspaceHostOptions, k as kernelWorkspaceHost, w as workspaceBucketFromEnv, h as workspacesRoot } from './kernel-workspace-host-cT9JGJur.js';
 import '@almadar/shell-runtime';
 import '@almadar/core';