@almadar/shell-node 1.2.1 → 1.3.1

package/dist/OrbitalServerRuntime.js

@@ -1,3 +1,3 @@
-export { OrbitalServerRuntime, UnresolvedProgramError } from './chunk-U2YFXKUN.js';
-import './chunk-YEC2UPB4.js';
+export { OrbitalServerRuntime, UnresolvedProgramError } from './chunk-7G76O2WN.js';
+import './chunk-J7DCQOQW.js';
 import './chunk-EEYGL7AB.js';

package/dist/{chunk-CB2RKJKB.js → chunk-2ZDUXJRK.js}

@@ -1,4 +1,4 @@
-import { workspacesRoot, kernelWorkspaceHost, workspaceBucketFromEnv } from './chunk-WIL5CHP5.js';
+import { workspacesRoot, kernelWorkspaceHost, workspaceBucketFromEnv } from './chunk-D4MHWNNC.js';
 import { runProgramEffect } from './chunk-7QE32QQR.js';
 import { installedWorkspaceHost, installWorkspaceHost } from './chunk-BWMLDDCL.js';
 

package/dist/{chunk-U2YFXKUN.js → chunk-7G76O2WN.js}

@@ -1,4 +1,4 @@
-import { installNodeHostPorts, createNodeTokenPost, nativeOsHost } from './chunk-YEC2UPB4.js';
+import { installNodeHostPorts, createNodeTokenPost, nativeOsHost } from './chunk-J7DCQOQW.js';
 import { nativeMemoryOf } from './chunk-EEYGL7AB.js';
 import { EventBus, bindDeclaredCollections, createSecretPorts, defaultCallService, kernelEventRequestParser, kernelOsTls, kernelOsCompletions, stampEmitSource, eventRouteKey, kernelOsGrants, KernelEngine, dispatchDeclaredInput, dispatchInbound, createSecretStore, evaluateOnKernel, InFlightCalls } from '@almadar/shell-runtime';
 import { installKernelEvaluator, orbitalInlineEntities, asEventId, asTraitId, inlineTraitRefs, tickEventKey, toPayloadValue } from '@almadar/core';
@@ -496,7 +496,10 @@ var OrbitalServerRuntime = class {
   /** Run a follow-on step's call outcome as its own dispatch, and hand its result to the host-dispatch sink. */
   runDeferredOutcome(orbitalName, request) {
     void this.processOrbitalEvent(orbitalName, request).then(
-      (response) => this.hostDispatchSink?.(this.browserDispatchItem(orbitalName, request, response)),
+      (response) => {
+        if (request.targetTrait !== void 0 && !this.requireKernelEngine().browserRuns(request.targetTrait)) return;
+        this.hostDispatchSink?.(this.browserDispatchItem(orbitalName, request, response));
+      },
       (error) => effectLog.error("deferred-outcome:failed", { orbitalName, event: request.event, trait: request.targetTrait, error: error.message })
     );
   }

package/dist/{chunk-WIL5CHP5.js → chunk-D4MHWNNC.js}

@@ -1,4 +1,4 @@
-import { installNodeHostPorts, createNodeTokenPost, nativeOsHost } from './chunk-YEC2UPB4.js';
+import { installNodeHostPorts, createNodeTokenPost, nativeOsHost } from './chunk-J7DCQOQW.js';
 import { loadNativeKernelModule, resolveNativeAddon, loadKernelModule } from './chunk-EEYGL7AB.js';
 import { workspaceOwnerSegment } from './chunk-BWMLDDCL.js';
 import { mkdirSync, realpathSync, mkdtempSync, writeFileSync, rmSync } from 'fs';

package/dist/{chunk-YEC2UPB4.js → chunk-J7DCQOQW.js}

@@ -5,6 +5,7 @@ import { AsyncLocalStorage } from 'async_hooks';
 import { installCredentialScopeStorage, CREDENTIAL_MASTER_KEY_ENV, CREDENTIAL_PREVIOUS_MASTER_KEY_ENV, CredentialVault, installCredentialStore, createNativeOsPort } from '@almadar/shell-runtime';
 import { lookup } from 'dns/promises';
 import { request } from 'https';
+import { request as request$1 } from 'http';
 import { isIP } from 'net';
 import { homedir } from 'os';
 
@@ -123,10 +124,43 @@ function urlOf(endpoint) {
     throw new TokenPostRefusal("the token endpoint is not a url");
   }
 }
+function collect(req, response, settle, reject) {
+  const status = response.statusCode ?? 0;
+  if (status >= 300 && status < 400) {
+    response.resume();
+    reject(new TokenPostRefusal(`the token endpoint answered a redirect (${status}); redirects are not followed`));
+    req.destroy();
+    return;
+  }
+  const chunks = [];
+  response.on("data", (chunk) => chunks.push(chunk));
+  response.on("end", () => settle({ status, body: Buffer.concat(chunks).toString("utf8") }));
+  response.on("error", () => reject(new TokenPostRefusal("the token endpoint response failed")));
+}
+function metadataGet(send, endpoint, headers) {
+  const url = urlOf(endpoint);
+  const requestHeaders = {};
+  for (const [name, value] of headers) requestHeaders[name] = value;
+  requestHeaders["Connection"] = "close";
+  return new Promise((settle, reject) => {
+    const req = send(
+      { method: "GET", protocol: "http:", host: url.hostname, port: url.port === "" ? 80 : Number(url.port), path: `${url.pathname}${url.search}`, headers: requestHeaders, timeout: IO_TIMEOUT_MS },
+      (response) => collect(req, response, settle, reject)
+    );
+    req.on("timeout", () => {
+      reject(new TokenPostRefusal("the metadata server timed out"));
+      req.destroy();
+    });
+    req.on("error", (error) => reject(new TokenPostRefusal(`could not reach the metadata server${error.code !== void 0 ? ` (${error.code})` : ""}`)));
+    req.end();
+  });
+}
 function createNodeTokenPost(options) {
   const send = options.request ?? request;
+  const sendMetadata = options.metadataRequest ?? request$1;
   const resolve = options.resolve ?? systemResolve;
-  return async ({ endpoint, headers, body }) => {
+  return async ({ kind, endpoint, headers, body }) => {
+    if (kind === "metadata") return metadataGet(sendMetadata, endpoint, headers);
     const url = urlOf(endpoint);
     if (url.protocol !== "https:") throw new TokenPostRefusal("the token endpoint must be https");
     if (!options.egressAllows(endpoint)) throw new TokenPostRefusal(`${url.host} is not an origin the program declares in egress`);
@@ -157,19 +191,7 @@ function createNodeTokenPost(options) {
             else callback(null, checked.address, checked.family);
           }
         },
-        (response) => {
-          const status = response.statusCode ?? 0;
-          if (status >= 300 && status < 400) {
-            response.resume();
-            reject(new TokenPostRefusal(`the token endpoint answered a redirect (${status}); redirects are not followed`));
-            req.destroy();
-            return;
-          }
-          const chunks = [];
-          response.on("data", (chunk) => chunks.push(chunk));
-          response.on("end", () => settle({ status, body: Buffer.concat(chunks).toString("utf8") }));
-          response.on("error", () => reject(new TokenPostRefusal("the token endpoint response failed")));
-        }
+        (response) => collect(req, response, settle, reject)
       );
       req.on("timeout", () => {
         reject(new TokenPostRefusal("the token endpoint timed out"));

package/dist/createProgramHandlers.js

@@ -1,6 +1,6 @@
-export { createProgramHandlers } from './chunk-CB2RKJKB.js';
-import './chunk-WIL5CHP5.js';
-import './chunk-YEC2UPB4.js';
+export { createProgramHandlers } from './chunk-2ZDUXJRK.js';
+import './chunk-D4MHWNNC.js';
+import './chunk-J7DCQOQW.js';
 import './chunk-EEYGL7AB.js';
 import './chunk-7QE32QQR.js';
 import './chunk-BWMLDDCL.js';

package/dist/index.d.ts

@@ -116,6 +116,8 @@ interface NodeTokenPostOptions {
     /** The kernel's public-address rule. */
     isPublicAddress(ip: string): boolean;
     request?: (options: RequestOptions, onResponse: (response: IncomingMessage) => void) => ClientRequest;
+    /** The plain-http request of a `metadata` exchange. */
+    metadataRequest?: (options: RequestOptions, onResponse: (response: IncomingMessage) => void) => ClientRequest;
     resolve?: (host: string) => Promise<ResolvedAddress[]>;
 }
 declare class TokenPostRefusal extends Error {

package/dist/index.js

@@ -1,7 +1,7 @@
-export { OrbitalServerRuntime, UnresolvedProgramError } from './chunk-U2YFXKUN.js';
-export { createProgramHandlers } from './chunk-CB2RKJKB.js';
-export { KernelProgram, emitPayload, kernelWorkspaceHost, resolveProgramFile, workspaceBucketFromEnv, workspacesRoot } from './chunk-WIL5CHP5.js';
-export { DEFAULT_CREDENTIALS_FILE, TokenPostRefusal, createNodeTokenPost, credentialsFilePath, fileCredentialRows, installNodeCredentialVault, installNodeHostPorts } from './chunk-YEC2UPB4.js';
+export { OrbitalServerRuntime, UnresolvedProgramError } from './chunk-7G76O2WN.js';
+export { createProgramHandlers } from './chunk-2ZDUXJRK.js';
+export { KernelProgram, emitPayload, kernelWorkspaceHost, resolveProgramFile, workspaceBucketFromEnv, workspacesRoot } from './chunk-D4MHWNNC.js';
+export { DEFAULT_CREDENTIALS_FILE, TokenPostRefusal, createNodeTokenPost, credentialsFilePath, fileCredentialRows, installNodeCredentialVault, installNodeHostPorts } from './chunk-J7DCQOQW.js';
 export { loadInstalledKernel, loadKernelModule, loadNativeKernelModule, nativeMemoryOf, resolveNativeAddon } from './chunk-EEYGL7AB.js';
 export { behaviorCatalog, behaviorCatalogSync, behaviorDependencies, behaviorDescribe, behaviorResolve, behaviorSource, programCompose, programEval, programOsGrants, programPrint, programProve, programRead, programResolve, programResolveSchema, programStep, programValidate, runProgramEffect, workspaceAccessError } from './chunk-7QE32QQR.js';
 export { installWorkspaceHost, installedWorkspaceHost, uninstallWorkspaceHost, workspaceOwnerSegment } from './chunk-BWMLDDCL.js';

package/dist/kernelWorkspace.js

@@ -1,4 +1,4 @@
-export { kernelWorkspaceHost, workspaceBucketFromEnv, workspacesRoot } from './chunk-WIL5CHP5.js';
-import './chunk-YEC2UPB4.js';
+export { kernelWorkspaceHost, workspaceBucketFromEnv, workspacesRoot } from './chunk-D4MHWNNC.js';
+import './chunk-J7DCQOQW.js';
 import './chunk-EEYGL7AB.js';
 import './chunk-BWMLDDCL.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@almadar/shell-node",
-  "version": "1.2.1",
+  "version": "1.3.1",
   "orbRelease": {
     "severity": "normal"
   },
@@ -37,12 +37,12 @@
     "access": "public"
   },
   "dependencies": {
-    "@almadar/core": "^11.4.0",
-    "@almadar/kernel": "^19.2.0",
-    "@almadar/logger": "^2.4.0",
+    "@almadar/core": "^11.5.1",
+    "@almadar/kernel": "^19.3.0",
+    "@almadar/logger": "^2.5.1",
     "zod": "^4.6.7",
-    "@almadar/std": "^17.2.1",
-    "@almadar/shell-runtime": "^1.2.1"
+    "@almadar/std": "^17.3.1",
+    "@almadar/shell-runtime": "^1.3.1"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",