@almadar/shell-node 0.1.0 → 1.1.0

package/dist/{chunk-BJA6GYC5.js → chunk-HXA6OB35.js}

@@ -1,12 +1,12 @@
-import { installNodeHostPorts } from './chunk-23YAOI6P.js';
-import { loadNativeKernelModule, resolveNativeAddon, loadKernelModule, loadHttpKernel } from './chunk-UBZT5LDW.js';
+import { installNodeHostPorts, createNodeTokenPost } from './chunk-VQVAHUAX.js';
+import { loadNativeKernelModule, resolveNativeAddon, loadKernelModule } from './chunk-EEYGL7AB.js';
 import { workspaceOwnerSegment } from './chunk-BWMLDDCL.js';
 import { mkdirSync, realpathSync, mkdtempSync, writeFileSync, rmSync, constants as constants$1 } from 'fs';
 import { constants, homedir, tmpdir, loadavg, uptime, machine, version, release, hostname, type, userInfo } from 'os';
-import { dirname, join, resolve } from 'path';
+import { dirname, resolve, join } from 'path';
 import { spawn } from 'child_process';
 import { createRequire } from 'module';
-import { createHttpPorts, NativeMemoryPersistenceAdapter, kernelOsGrants, InFlightCalls, KernelEngine, dispatchInbound, anchoredGrants, expandAnchor } from '@almadar/shell-runtime';
+import { createSecretPorts, NativeMemoryPersistenceAdapter, kernelOsGrants, InFlightCalls, KernelEngine, dispatchInbound, anchoredGrants, expandAnchor } from '@almadar/shell-runtime';
 import { resolveOrbBinary } from '@almadar/core/behavior-package';
 import { tickEventKey } from '@almadar/core';
 import { lstat, chmod, stat, readlink, symlink, link, unlink, rename, copyFile, open, mkdir, readdir, rm, rmdir, access, chown } from 'fs/promises';
@@ -1140,6 +1140,7 @@ var SOCKET_HIGH_WATER = 1024 * 1024;
 var NET_OPS = /* @__PURE__ */ new Set([
   "os/tcp-connect",
   "os/tcp-listen",
+  "os/tls-upgrade",
   "os/send",
   "os/recv",
   "os/udp-bind",
@@ -1147,7 +1148,8 @@ var NET_OPS = /* @__PURE__ */ new Set([
   "os/recvfrom",
   "os/dns-resolve",
   "os/shutdown",
-  "os/watch-port"
+  "os/watch-port",
+  "os/fetch"
 ]);
 function isNetOp(op) {
   return NET_OPS.has(op);
@@ -1231,6 +1233,8 @@ var NetOps = class {
         throw invalid(op, "a stream needs a key and a call site");
       case "os/tcp-connect":
         return this.tcpConnect(op, args);
+      case "os/tls-upgrade":
+        throw osFailure("unsupported", op, "a kernel op: the kernel owns TLS and a host implements none");
       case "os/send":
         return this.send(op, args);
       case "os/recv":
@@ -1245,6 +1249,8 @@ var NetOps = class {
         return this.dnsResolve(op, args);
       case "os/shutdown":
         return this.shutdown(op, args);
+      case "os/fetch":
+        throw osFailure("unsupported", op, "a browser host performs a fetch; this host speaks the protocol over os/tcp-connect and os/tls-upgrade");
       default:
         throw osFailure("unsupported", op, "streaming host not implemented");
     }
@@ -1569,7 +1575,8 @@ var ProcessOps = class {
       case "os/getenv": {
         const name = argStr(args, 0, op);
         this.envGranted(op, name);
-        return { value: this.lookupEnv(name) };
+        const value = this.lookupEnv(name);
+        return value === null ? {} : { value };
       }
       case "os/setenv":
       case "os/unsetenv":
@@ -1722,9 +1729,8 @@ var ProcessOps = class {
     const op = "os/kill";
     let found;
     if (typeof value === "string") found = SIGNAL_SET.find(([name]) => name === value)?.[1];
-    else if (typeof value === "number" && Number.isInteger(value)) found = SIGNAL_SET.find(([, number]) => number === value)?.[1];
     if (found === void 0) {
-      throw invalid(op, "signal must be one of TERM, KILL, INT, HUP, QUIT, USR1, USR2, STOP, CONT (or its number)");
+      throw invalid(op, "signal must be one of TERM, KILL, INT, HUP, QUIT, USR1, USR2, STOP, CONT");
     }
     return found;
   }
@@ -1873,6 +1879,8 @@ var SysOps = class {
 };
 var log = createLogger("almadar:host:os");
 var DEVICE_OPS = /* @__PURE__ */ new Set(["os/mmio-read", "os/mmio-write", "os/irq-wait", "os/irq-ack"]);
+var isGpuOp = (op) => op.startsWith("gpu/");
+var noGpu = (op) => osFailure("unsupported", op, "this host has no gpu");
 function failureOf(op, raised) {
   if (raised instanceof OsFailure) return raised.error;
   return { kind: "io", message: `${op}: ${raised instanceof Error ? raised.message : String(raised)}` };
@@ -1882,22 +1890,23 @@ var NodeOsHost = class {
     this.given = given;
     this.anchors = anchors;
     this.state = new OsState(anchors);
-    const grants = anchoredGrants(given, anchors);
-    this.fs = new FsOps(this.state, grants);
-    this.process = new ProcessOps(this.state, grants);
-    this.net = new NetOps(this.state, grants);
-    this.sys = new SysOps(grants);
   }
   given;
   anchors;
   state;
-  fs;
-  process;
-  net;
-  sys;
+  ops = /* @__PURE__ */ new Map();
   placed = false;
   /** The listener handle of each open stream, by its key. */
   streams = /* @__PURE__ */ new Map();
+  /** The ops that check `orbital`'s grants (the app level alone with none): every grant decision is the kernel's, asked with the orbital. */
+  opsFor(orbital) {
+    const held = this.ops.get(orbital);
+    if (held !== void 0) return held;
+    const grants = anchoredGrants({ ...this.given, allows: (need) => this.given.allows(need, orbital) }, this.anchors);
+    const made = { fs: new FsOps(this.state, grants), process: new ProcessOps(this.state, grants), net: new NetOps(this.state, grants), sys: new SysOps(grants) };
+    this.ops.set(orbital, made);
+    return made;
+  }
   /** The call's arguments with every anchored part resolved by the kernel, the program's anchors placed on the first call. */
   resolved(op, args) {
     if (!this.placed) {
@@ -1908,47 +1917,51 @@ var NodeOsHost = class {
     if ("error" in resolved) throw new OsFailure(resolved.error);
     return resolved.ok;
   }
-  async dispatch(op, given) {
+  async dispatch(op, given, orbital) {
+    if (isGpuOp(op)) throw noGpu(op);
     const args = this.resolved(op, given);
+    const { fs, process: process2, net, sys } = this.opsFor(orbital);
     if (op === "os/close") {
-      if (this.fs.closeOwned(args) || this.net.closeOwned(args)) return {};
+      if (fs.closeOwned(args) || net.closeOwned(args)) return {};
       throw osFailure("closed", op, "not an open handle");
     }
-    if (isFsOp(op)) return this.fs.run(op, args);
-    if (isProcessOp(op)) return this.process.run(op, args);
-    if (isNetOp(op)) return this.net.run(op, args);
-    if (isSysOp(op)) return this.sys.run(op);
+    if (isFsOp(op)) return fs.run(op, args);
+    if (isProcessOp(op)) return process2.run(op, args);
+    if (isNetOp(op)) return net.run(op, args);
+    if (isSysOp(op)) return sys.run(op);
     if (DEVICE_OPS.has(op)) throw osFailure("unsupported", op, "this host has no devices");
     throw osFailure("unsupported", op, "this host does not implement the operation yet");
   }
-  async answer(op, args) {
+  async answer(op, args, orbital) {
     try {
-      return { ok: await this.dispatch(op, args) };
+      return { ok: await this.dispatch(op, args, orbital) };
     } catch (raised) {
       return { error: failureOf(op, raised) };
     }
   }
-  deferral(op, args) {
+  deferral(op, args, orbital) {
+    const { fs, process: process2, net } = this.opsFor(orbital);
     switch (op) {
       case "os/wait":
-        return this.process.waitLater(args);
+        return process2.waitLater(args);
       case "os/read":
-        return this.fs.readLater(op, args);
+        return fs.readLater(op, args);
       case "os/send":
-        return this.net.sendLater(op, args);
+        return net.sendLater(op, args);
       case "os/recv":
-        return this.net.recvLater(op, args);
+        return net.recvLater(op, args);
       case "os/recvfrom":
-        return this.net.recvfromLater(op, args);
+        return net.recvfromLater(op, args);
       default:
         throw osFailure("unsupported", op, "this operation does not defer its completion");
     }
   }
   /** `Completions::run_later`: the checks fail in place, the wait runs in the background and its outcome goes to `deliver` unless the key is cancelled first. */
-  defer(op, args, key, deliver) {
+  defer(op, args, key, deliver, orbital) {
     let blocking;
     try {
-      blocking = this.deferral(op, this.resolved(op, args));
+      if (isGpuOp(op)) throw noGpu(op);
+      blocking = this.deferral(op, this.resolved(op, args), orbital);
     } catch (raised) {
       return { error: failureOf(op, raised) };
     }
@@ -1967,11 +1980,11 @@ var NodeOsHost = class {
     return { ok: null };
   }
   /** A keyed stream (EXEC-QUEUE-12): `os/tcp-listen` binds and answers in place, then each connection reaches `message`. */
-  async stream(op, args, key, message, fail2) {
+  async stream(op, args, key, message, fail2, orbital) {
     try {
       if (op !== "os/tcp-listen") throw osFailure("unsupported", op, "this host streams only os/tcp-listen");
       if (this.streams.has(key)) throw invalid(op, `key ${key} already has a stream open`);
-      const answer = await this.net.listen(op, this.resolved(op, args), message, (error) => {
+      const answer = await this.opsFor(orbital).net.listen(op, this.resolved(op, args), message, (error) => {
         this.streams.delete(key);
         fail2(error);
       });
@@ -1985,7 +1998,7 @@ var NodeOsHost = class {
     const listener = this.streams.get(key);
     if (listener !== void 0) {
       this.streams.delete(key);
-      this.net.stopListening(listener);
+      this.opsFor(void 0).net.stopListening(listener);
       return true;
     }
     return this.state.completions.cancel(key);
@@ -1997,7 +2010,7 @@ var NodeOsHost = class {
 function processAnchors() {
   const env = {};
   for (const [name, value] of Object.entries(process.env)) if (value !== void 0) env[name] = value;
-  return { home: homedir(), start: process.cwd(), exeDir: dirname(process.execPath), env };
+  return { home: homedir(), start: process.cwd(), exeDir: dirname(process.execPath), exe: process.execPath, env };
 }
 function createNodeOsHost(grants, options = {}) {
   return new NodeOsHost(grants, options.anchors ?? processAnchors());
@@ -2034,17 +2047,17 @@ async function resolveProgramFile(path, cwd = dirname(resolve(path)), orb = reso
   });
 }
 var KernelProgram = class _KernelProgram {
-  constructor(engine, os, schema, http, persistence) {
+  constructor(engine, os, schema, secretPorts, persistence) {
     this.engine = engine;
     this.os = os;
     this.schema = schema;
-    this.http = http;
+    this.secretPorts = secretPorts;
     this.persistence = persistence;
   }
   engine;
   os;
   schema;
-  http;
+  secretPorts;
   persistence;
   static async open(schema, options) {
     const languageFrom = { languageFrom: options.languageFrom };
@@ -2053,20 +2066,17 @@ var KernelProgram = class _KernelProgram {
     const kernelDir = addon === void 0 ? options.kernelDir ?? resolveKernelDir() : "";
     const kernel = addon ?? await loadKernelModule(kernelDir, languageFrom);
     installNodeHostPorts();
-    const http = createHttpPorts({
-      kernel: addon !== void 0 ? async () => addon : () => loadHttpKernel(kernelDir, languageFrom),
-      ...options.http,
-      egress: schema.egress ?? []
-    });
-    const persistence = new NativeMemoryPersistenceAdapter(new kernel.MemoryStore());
-    for (const [entityType, rows] of Object.entries(options.seed ?? {})) {
-      for (const row of rows) await persistence.writeWhere({ kind: "upsert", entityType, data: row });
-    }
     let engine;
     const requireEngine = () => {
       if (engine === void 0) throw new Error("KernelProgram: an os ask arrived before the program opened");
       return engine;
     };
+    const tokenPost = createNodeTokenPost({ egressAllows: (url) => requireEngine().egressAllows(url), isPublicAddress: (ip) => kernel.isPublicAddress(ip) });
+    const secretPorts = createSecretPorts({ tokenPost, ...options.secretPorts });
+    const persistence = new NativeMemoryPersistenceAdapter(new kernel.MemoryStore());
+    for (const [entityType, rows] of Object.entries(options.seed ?? {})) {
+      for (const row of rows) await persistence.writeWhere({ kind: "upsert", entityType, data: row });
+    }
     const os = options.os === true ? createNodeOsHost(kernelOsGrants(kernel, requireEngine)) : void 0;
     const ports = {
       persistence,
@@ -2078,18 +2088,18 @@ var KernelProgram = class _KernelProgram {
       }, read: async () => [] }),
       deliverLive: () => void 0,
       deferCallOutcome: () => void 0,
-      http,
+      secretPorts,
       ...os !== void 0 ? { os } : {}
     };
     engine = KernelEngine.open(kernel, schema, ports);
-    return new _KernelProgram(engine, os, schema, http, persistence);
+    return new _KernelProgram(engine, os, schema, secretPorts, persistence);
   }
-  /** Fire `event` at the orbital as `user` (the program's `@user`), wait for its whole cascade (every `http` ask included), and return what it emitted. */
+  /** Fire `event` at the orbital as `user` (the program's `@user`), wait for its whole cascade (every secret ask included), and return what it emitted. */
   async dispatch(orbital, event, payload = {}, targetTrait, user) {
     const response = await this.engine.evaluate(
       orbital,
       { event, payload, ...targetTrait !== void 0 ? { targetTrait } : {}, ...user !== void 0 ? { user } : {} },
-      { orbital, ...user !== void 0 ? { user } : {} }
+      { orbital }
     );
     return {
       success: response.success,
@@ -2110,7 +2120,7 @@ var KernelProgram = class _KernelProgram {
   }
   /** Deliver an `/api/hooks/<name>` request to the program and return the answer it gave (EXEC-INBOUND-1). */
   async deliverInbound(name, delivery) {
-    return dispatchInbound(this.schema, name, delivery, (orbital, request) => this.engine.evaluate(orbital, request, { orbital }), (credential) => this.http.secrets.get(credential, void 0));
+    return dispatchInbound(this.engine, name, delivery, (orbital, request) => this.engine.evaluate(orbital, request, { orbital }), (credential) => this.secretPorts.secrets.get(credential, void 0));
   }
   /** The rows the host's in-memory store holds for `entity` (empty when the native kernel keeps its own `store`). */
   async rows(entity) {
@@ -2216,4 +2226,4 @@ function kernelWorkspaceHost(options) {
   };
 }
 
-export { GCS_ENDPOINT, KernelProgram, WORKSPACE_HMAC_KEY_ID, WORKSPACE_HMAC_SECRET, createNodeOsHost, emitPayload, kernelWorkspaceHost, processAnchors, resolveKernelDir, resolveProgramFile, workspaceBucketFromEnv, workspacesRoot };
+export { KernelProgram, createNodeOsHost, emitPayload, kernelWorkspaceHost, processAnchors, resolveProgramFile, workspaceBucketFromEnv, workspacesRoot };

package/dist/{chunk-WZFQ7T7V.js → chunk-LNEOE5TD.js}

@@ -1,5 +1,5 @@
-import { workspacesRoot, kernelWorkspaceHost, workspaceBucketFromEnv } from './chunk-BJA6GYC5.js';
-import { runProgramEffect } from './chunk-QYAPNUBH.js';
+import { workspacesRoot, kernelWorkspaceHost, workspaceBucketFromEnv } from './chunk-HXA6OB35.js';
+import { runProgramEffect } from './chunk-7QE32QQR.js';
 import { installedWorkspaceHost, installWorkspaceHost } from './chunk-BWMLDDCL.js';
 
 // src/program/createProgramHandlers.ts

package/dist/chunk-VQVAHUAX.js

@@ -0,0 +1,183 @@
+import { readFile, mkdir, writeFile, rename } from 'fs/promises';
+import { join, dirname } from 'path';
+import { EntityRowSchema, runRowWrite } from '@almadar/core';
+import { AsyncLocalStorage } from 'async_hooks';
+import { installCredentialScopeStorage, CREDENTIAL_MASTER_KEY_ENV, CREDENTIAL_PREVIOUS_MASTER_KEY_ENV, CredentialVault, installCredentialStore } from '@almadar/shell-runtime';
+import { lookup } from 'dns/promises';
+import { request } from 'https';
+import { isIP } from 'net';
+
+// src/credential-rows.ts
+var CREDENTIALS_FILE_ENV = "ALMADAR_CREDENTIALS_FILE";
+var DEFAULT_CREDENTIALS_FILE = ".almadar/dev-credentials.json";
+var CREDENTIAL_ROWS_ENTITY = "AlmadarIntegrationCredential";
+function credentialsFilePath(env = process.env, cwd = process.cwd()) {
+  const named = env[CREDENTIALS_FILE_ENV];
+  return named !== void 0 && named !== "" ? named : join(cwd, DEFAULT_CREDENTIALS_FILE);
+}
+var gates = /* @__PURE__ */ new Map();
+function gateOf(path) {
+  const held = gates.get(path);
+  if (held !== void 0) return held;
+  const gate = { tail: Promise.resolve() };
+  gates.set(path, gate);
+  return gate;
+}
+function isMissing(error) {
+  return "code" in error && error.code === "ENOENT";
+}
+function fileCredentialRows(path) {
+  const gate = gateOf(path);
+  const read = async () => {
+    let text;
+    try {
+      text = await readFile(path, "utf8");
+    } catch (error) {
+      if (error instanceof Error && isMissing(error)) return [];
+      throw error;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(text);
+    } catch (error) {
+      throw new Error(`credential file ${path} is not JSON: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const rows = EntityRowSchema.array().safeParse(parsed);
+    if (!rows.success) throw new Error(`credential file ${path} is not an array of rows: ${rows.error.message}`);
+    const at = rows.data.findIndex((row) => typeof row.id !== "string");
+    if (at >= 0) throw new Error(`credential file ${path}: row ${at} carries no id`);
+    return rows.data;
+  };
+  const write = async (rows) => {
+    await mkdir(dirname(path), { recursive: true });
+    const temporary = `${path}.tmp`;
+    await writeFile(temporary, JSON.stringify(rows, null, 2));
+    await rename(temporary, path);
+  };
+  const change = (work) => {
+    const next = gate.tail.then(async () => {
+      const { rows, result, changed } = work(await read());
+      if (changed) await write(rows);
+      return result;
+    });
+    gate.tail = next.then(
+      () => void 0,
+      () => void 0
+    );
+    return next;
+  };
+  return {
+    async list() {
+      await gate.tail;
+      return read();
+    },
+    create: (row) => change((rows) => ({ rows: [...rows, row], result: void 0, changed: true })),
+    update: (id, data) => change((rows) => ({
+      rows: rows.map((row) => row.id === id ? { ...row, ...data, id } : row),
+      result: void 0,
+      changed: rows.some((row) => row.id === id)
+    })),
+    delete: (id) => change((rows) => {
+      const written = runRowWrite(rows, { kind: "delete", entityType: CREDENTIAL_ROWS_ENTITY, id });
+      const removed = written.outcome.kind === "deleted";
+      return { rows: written.rows, result: removed, changed: removed };
+    })
+  };
+}
+function nodeCredentialScope() {
+  return new AsyncLocalStorage();
+}
+var installed = false;
+function installNodeHostPorts() {
+  if (installed) return;
+  installed = true;
+  installCredentialScopeStorage(nodeCredentialScope());
+}
+async function installNodeCredentialVault(options) {
+  const env = options.env ?? process.env;
+  const master = env[CREDENTIAL_MASTER_KEY_ENV];
+  if (master === void 0) return null;
+  const previous = env[CREDENTIAL_PREVIOUS_MASTER_KEY_ENV];
+  const vault = await CredentialVault.open(
+    new options.kernel.CredentialVault(master, previous === void 0 || previous === "" ? void 0 : previous),
+    fileCredentialRows(credentialsFilePath(env, options.cwd))
+  );
+  installCredentialStore(vault);
+  return vault;
+}
+var IO_TIMEOUT_MS = 5e3;
+async function systemResolve(host) {
+  return lookup(host, { all: true });
+}
+var TokenPostRefusal = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TokenPostRefusal";
+  }
+};
+function urlOf(endpoint) {
+  try {
+    return new URL(endpoint);
+  } catch {
+    throw new TokenPostRefusal("the token endpoint is not a url");
+  }
+}
+function createNodeTokenPost(options) {
+  const send = options.request ?? request;
+  const resolve = options.resolve ?? systemResolve;
+  return async ({ endpoint, headers, body }) => {
+    const url = urlOf(endpoint);
+    if (url.protocol !== "https:") throw new TokenPostRefusal("the token endpoint must be https");
+    if (!options.egressAllows(endpoint)) throw new TokenPostRefusal(`${url.host} is not an origin the program declares in egress`);
+    const host = url.hostname.replace(/^\[/, "").replace(/\]$/, "");
+    const addresses = isIP(host) !== 0 ? [{ address: host, family: isIP(host) }] : await resolve(host);
+    if (addresses.length === 0) throw new TokenPostRefusal(`${host} has no addresses`);
+    const private_ = addresses.find((entry) => !options.isPublicAddress(entry.address));
+    if (private_ !== void 0) throw new TokenPostRefusal(`${host} resolves to ${private_.address}, not a public address`);
+    const checked = addresses[0];
+    const payload = Buffer.from(body, "utf8");
+    const requestHeaders = {};
+    for (const [name, value] of headers) requestHeaders[name] = value;
+    requestHeaders["Content-Length"] = payload.length;
+    requestHeaders["Connection"] = "close";
+    return new Promise((settle, reject) => {
+      const req = send(
+        {
+          method: "POST",
+          protocol: "https:",
+          host,
+          port: url.port === "" ? 443 : Number(url.port),
+          path: `${url.pathname}${url.search}`,
+          headers: requestHeaders,
+          timeout: IO_TIMEOUT_MS,
+          servername: isIP(host) === 0 ? host : void 0,
+          lookup: (_name, lookupOptions, callback) => {
+            if (lookupOptions.all === true) callback(null, [{ address: checked.address, family: checked.family }]);
+            else callback(null, checked.address, checked.family);
+          }
+        },
+        (response) => {
+          const status = response.statusCode ?? 0;
+          if (status >= 300 && status < 400) {
+            response.resume();
+            reject(new TokenPostRefusal(`the token endpoint answered a redirect (${status}); redirects are not followed`));
+            req.destroy();
+            return;
+          }
+          const chunks = [];
+          response.on("data", (chunk) => chunks.push(chunk));
+          response.on("end", () => settle({ status, body: Buffer.concat(chunks).toString("utf8") }));
+          response.on("error", () => reject(new TokenPostRefusal("the token endpoint response failed")));
+        }
+      );
+      req.on("timeout", () => {
+        reject(new TokenPostRefusal("the token endpoint timed out"));
+        req.destroy();
+      });
+      req.on("error", (error) => reject(new TokenPostRefusal(`could not reach the token endpoint${error.code !== void 0 ? ` (${error.code})` : ""}`)));
+      req.end(payload);
+    });
+  };
+}
+
+export { DEFAULT_CREDENTIALS_FILE, TokenPostRefusal, createNodeTokenPost, credentialsFilePath, fileCredentialRows, installNodeCredentialVault, installNodeHostPorts };

package/dist/createProgramHandlers.js

@@ -1,6 +1,6 @@
-export { createProgramHandlers } from './chunk-WZFQ7T7V.js';
-import './chunk-BJA6GYC5.js';
-import './chunk-23YAOI6P.js';
-import './chunk-UBZT5LDW.js';
-import './chunk-QYAPNUBH.js';
+export { createProgramHandlers } from './chunk-LNEOE5TD.js';
+import './chunk-HXA6OB35.js';
+import './chunk-VQVAHUAX.js';
+import './chunk-EEYGL7AB.js';
+import './chunk-7QE32QQR.js';
 import './chunk-BWMLDDCL.js';