@almadar/shell-runtime 0.1.0 → 1.0.0

package/dist/{chunk-Q2H75UYT.js → chunk-A2JJT4GA.js}

@@ -1,5 +1,3 @@
-import { normalizeEventKey, LIFECYCLE_EVENTS } from '@almadar/core';
-
 // src/client/state-book.ts
 function findInitialState(trait) {
   const markedInitial = trait.states?.find((s) => s.isInitial)?.name;
@@ -14,17 +12,6 @@ function createInitialTraitState(trait) {
     context: {}
   };
 }
-function findMatchingTransitions(trait, currentState, eventKey, eventId) {
-  return (trait.transitions ?? []).filter((t) => {
-    const fromMatches = Array.isArray(t.from) ? t.from.includes(currentState) : t.from === currentState;
-    if (!fromMatches) return false;
-    if (eventId && t.eventId) return t.eventId === eventId;
-    return t.event === eventKey;
-  });
-}
-function findTransition(trait, currentState, eventKey, eventId) {
-  return findMatchingTransitions(trait, currentState, eventKey, eventId)[0];
-}
 var SINGLETON_SCOPE = "__singleton__";
 var key = (traitName, entityId) => `${traitName}::${entityId ?? SINGLETON_SCOPE}`;
 var StateBook = class {
@@ -51,29 +38,6 @@ var StateBook = class {
     }
     return out;
   }
-  /** Whether the trait has an arm on the event from its current state. */
-  canHandleEvent(traitName, eventKey, entityId, eventId) {
-    const trait = this.traits.get(traitName);
-    const state = this.getState(traitName, entityId);
-    if (trait === void 0 || state === void 0) return false;
-    return findTransition(trait, state.currentState, normalizeEventKey(eventKey), eventId) !== void 0;
-  }
-  /**
-   * The lifecycle event an embedded child can be repainted with: the one it handles from its current state,
-   * provided every matching arm stays in that state and only renders.
-   */
-  repaintLifecycleEvent(traitName, entityId) {
-    const trait = this.traits.get(traitName);
-    const state = this.getState(traitName, entityId);
-    if (trait === void 0 || state === void 0) return void 0;
-    for (const event of LIFECYCLE_EVENTS) {
-      const arms = findMatchingTransitions(trait, state.currentState, event);
-      if (arms.length === 0) continue;
-      const repaints = arms.every((t) => t.to === state.currentState && (t.effects ?? []).every((effect) => Array.isArray(effect) && effect[0] === "render-ui"));
-      return repaints ? event : void 0;
-    }
-    return void 0;
-  }
   /** Record the state the kernel reports. No-op for a trait not on the page. */
   seedState(traitName, currentState, entityId) {
     const trait = this.traits.get(traitName);
@@ -89,4 +53,4 @@ var StateBook = class {
   }
 };
 
-export { StateBook, createInitialTraitState, findInitialState, findMatchingTransitions, findTransition };
+export { StateBook, createInitialTraitState, findInitialState };

package/dist/chunk-BAS26HBN.js

@@ -0,0 +1,10 @@
+// src/runtime/entities/declaredCollections.ts
+function bindDeclaredCollections(store, entities) {
+  for (const entity of entities) {
+    if (entity.name && entity.collection && entity.browser !== true && entity.persistence !== "runtime") {
+      store.bindCollection?.(entity.name, entity.collection);
+    }
+  }
+}
+
+export { bindDeclaredCollections };

package/dist/{chunk-REPX5QPI.js → chunk-BOVU4TCQ.js}

@@ -1,4 +1,12 @@
 // src/kernel/os-port.ts
+function kernelOsTls(server) {
+  return {
+    complete: (key, outcome) => {
+      const step = JSON.parse(server().tlsComplete(key, JSON.stringify(outcome)));
+      return step;
+    }
+  };
+}
 function kernelOsCompletions(kernel) {
   const deferring = JSON.parse(kernel.osDeferringOps());
   const streaming = JSON.parse(kernel.osStreamOps());
@@ -13,7 +21,7 @@ function kernelOsCompletions(kernel) {
 }
 function kernelOsGrants(matchers, server) {
   return {
-    allows: (need) => server().osAllows(JSON.stringify(need)),
+    allows: (need, orbital) => server().osAllows(JSON.stringify(need), orbital),
     globMatches: (glob, path) => matchers.osGlobMatches(glob, path),
     isPublicAddress: (ip) => matchers.isPublicAddress(ip),
     anchor: (anchors) => {
@@ -50,8 +58,8 @@ function anchoredForms(anchors, path) {
 function anchoredGrants(grants, anchors) {
   return {
     ...grants,
-    allows: (need) => need.need === "fs" ? anchoredForms(anchors, need.path).some((path) => grants.allows({ ...need, path })) : grants.allows(need)
+    allows: (need, orbital) => need.need === "fs" ? anchoredForms(anchors, need.path).some((path) => grants.allows({ ...need, path }, orbital)) : grants.allows(need, orbital)
   };
 }
 
-export { anchoredGrants, expandAnchor, kernelOsCompletions, kernelOsGrants };
+export { anchoredGrants, expandAnchor, kernelOsCompletions, kernelOsGrants, kernelOsTls };

package/dist/chunk-BY5G4225.js

@@ -0,0 +1,6 @@
+// src/runtime/events/identity/routing.ts
+function eventRouteKey(eventName, eventId) {
+  return eventId ? `@evt:${eventId}` : eventName;
+}
+
+export { eventRouteKey };

package/dist/chunk-DFDNHVDW.js

@@ -0,0 +1,284 @@
+import { isJsonObject, credentialStorageKey, EntityRowSchema } from '@almadar/core';
+
+// src/credentials/vault.ts
+var CredentialExchangeError = class extends Error {
+  constructor(kind, message) {
+    super(message);
+    this.kind = kind;
+    this.name = "CredentialExchangeError";
+  }
+  kind;
+};
+var FAILURE_KINDS = ["unavailable", "unsigned", "denied", "invalid_grant", "invalid_client", "transport", "malformed", "refused"];
+function failureOf(value) {
+  if (value === void 0 || !isJsonObject(value)) throw new Error("the kernel connect failure is not an object");
+  const kind = FAILURE_KINDS.find((known) => known === value.kind);
+  if (kind === void 0) throw new Error("the kernel connect failure has an unknown kind");
+  return { kind, message: textOf(value.message, "failure message") };
+}
+function standingOf(value) {
+  if (value === void 0 || !isJsonObject(value) || typeof value.connected !== "boolean") throw new Error("the kernel credential standing is malformed");
+  return { connected: value.connected, ...typeof value.label === "string" ? { label: value.label } : {} };
+}
+function requestOf(value) {
+  if (value === void 0 || !isJsonObject(value) || !Array.isArray(value.headers)) throw new Error("the kernel token request is malformed");
+  const headers = value.headers.map((pair) => {
+    if (!Array.isArray(pair) || pair.length !== 2) throw new Error("the kernel token request header is malformed");
+    return [textOf(pair[0], "header name"), textOf(pair[1], "header value")];
+  });
+  return { request: { endpoint: textOf(value.endpoint, "token endpoint"), headers, body: textOf(value.body, "token body") }, ticket: numberOf(value.ticket, "exchange ticket") };
+}
+function parsed(json) {
+  return JSON.parse(json);
+}
+function objectOf(json, what) {
+  const value = parsed(json);
+  if (!isJsonObject(value)) throw new Error(`the kernel ${what} is not an object`);
+  return value;
+}
+function textOf(value, what) {
+  if (typeof value !== "string") throw new Error(`the kernel ${what} is not text`);
+  return value;
+}
+function numberOf(value, what) {
+  if (typeof value !== "number") throw new Error(`the kernel ${what} is not a number`);
+  return value;
+}
+function entryOf(value) {
+  if (!isJsonObject(value)) throw new Error("the kernel credential entry is not an object");
+  return {
+    service: textOf(value.service, "entry service"),
+    envVar: textOf(value.envVar, "entry name"),
+    last4: textOf(value.last4, "entry last4"),
+    updatedAt: numberOf(value.updatedAt, "entry updatedAt"),
+    ...value.principal !== void 0 ? { principal: textOf(value.principal, "entry principal") } : {}
+  };
+}
+function writeOf(item) {
+  if (!isJsonObject(item)) throw new Error("the kernel credential write is not an object");
+  const id = textOf(item.id, "write id");
+  if (item.write === "delete") return { write: "delete", id };
+  const data = EntityRowSchema.parse(item.data);
+  if (item.write === "update") return { write: "update", id, data };
+  if (item.write === "create") return { write: "create", id, data: { ...data, id } };
+  throw new Error("the kernel credential write is neither create, update nor delete");
+}
+var CredentialVault = class _CredentialVault {
+  constructor(kernel, rows) {
+    this.kernel = kernel;
+    this.rows = rows;
+  }
+  kernel;
+  rows;
+  listeners = /* @__PURE__ */ new Set();
+  queue = Promise.resolve();
+  broken = false;
+  /** List the host's rows into the kernel and read them; rejects naming the rows it cannot read. */
+  static async open(kernel, rows) {
+    const vault = new _CredentialVault(kernel, rows);
+    await vault.reload();
+    return vault;
+  }
+  /** True when a valid master key is present (writes and decryption enabled). */
+  get enabled() {
+    return this.kernel.enabled;
+  }
+  /** Subscribe to credential changes; returns an unsubscribe function. */
+  subscribe(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  notify(principal) {
+    for (const listener of this.listeners) listener(principal);
+  }
+  async reload() {
+    try {
+      this.kernel.load(JSON.stringify(await this.rows.list()));
+      this.broken = false;
+    } catch (error) {
+      this.broken = true;
+      throw error;
+    }
+  }
+  current() {
+    if (this.broken) throw new Error("the credential store could not be read or written; reload it");
+    return this.kernel;
+  }
+  async apply() {
+    const writes = parsed(this.kernel.takeWrites());
+    if (!Array.isArray(writes)) throw new Error("the kernel credential writes are not a list");
+    try {
+      for (const item of writes) {
+        const write = writeOf(item);
+        if (write.write === "create") await this.rows.create(write.data);
+        else if (write.write === "update") await this.rows.update(write.id, write.data);
+        else await this.rows.delete(write.id);
+      }
+    } catch (error) {
+      this.broken = true;
+      throw error;
+    }
+  }
+  /** One operation at a time: the kernel runs it, then its writes reach the medium before the next begins. */
+  serial(run) {
+    const next = this.queue.then(run);
+    this.queue = next.then(
+      () => void 0,
+      () => void 0
+    );
+    return next;
+  }
+  exclusive(fresh, work, principal) {
+    return this.serial(async () => {
+      if (fresh || this.broken) await this.reload();
+      let result;
+      try {
+        result = work();
+      } catch (error) {
+        if (this.kernel.takeWrites() !== "[]") this.broken = true;
+        throw error;
+      }
+      await this.apply();
+      this.notify(principal);
+      return result;
+    });
+  }
+  /** Resolve one credential by name (warmed values only). */
+  resolve(envVar, principal) {
+    return this.current().resolve(envVar, principal);
+  }
+  /** The non-secret account label stored in the clear beside a credential's ciphertext; undefined when its row carries none. */
+  label(envVar, principal) {
+    return this.current().label(envVar, principal);
+  }
+  /** All app-wide values as an env-shaped map, for merging over the process env. */
+  snapshotEnv() {
+    const env = {};
+    for (const [name, value] of Object.entries(objectOf(this.current().snapshotEnv(), "environment"))) env[name] = textOf(value, "environment value");
+    return env;
+  }
+  /** Masked entries for display — never includes plaintext. */
+  entries(principal) {
+    const entries = parsed(this.current().entries(principal));
+    if (!Array.isArray(entries)) throw new Error("the kernel credential entries are not a list");
+    return entries.map(entryOf);
+  }
+  /** Whether the store can encrypt and the service and name of every app-wide row. */
+  listing() {
+    const listing = objectOf(this.current().listing(), "listing");
+    const entries = listing.entries;
+    if (!Array.isArray(entries) || typeof listing.enabled !== "boolean") throw new Error("the kernel credential listing is malformed");
+    return {
+      enabled: listing.enabled,
+      entries: entries.map((entry) => {
+        if (!isJsonObject(entry)) throw new Error("the kernel credential listing holds a row that is not an object");
+        const row = { service: textOf(entry.service, "listing service"), name: textOf(entry.name, "listing name") };
+        return entry.last4 === void 0 ? row : { ...row, last4: textOf(entry.last4, "listing last4") };
+      })
+    };
+  }
+  /** Upsert one credential; `label` is a non-secret account name kept in the clear beside it, left out it stays as it is. */
+  async set(service, envVar, value, principal, label) {
+    return entryOf(parsed(await this.exclusive(false, () => this.kernel.set(service, envVar, value, principal, label), principal)));
+  }
+  /** Replace the value of a credential already stored, keeping its service (a rotated refresh token). */
+  async replace(envVar, value, principal) {
+    return entryOf(parsed(await this.exclusive(false, () => this.kernel.replace(envVar, value, principal), principal)));
+  }
+  /** Keep `value` as the credential until it is forgotten, creating it when absent. */
+  async persist(envVar, value, principal, label) {
+    return entryOf(parsed(await this.exclusive(false, () => this.kernel.persist(envVar, value, principal, label), principal)));
+  }
+  /** Delete one credential row; whether one existed. */
+  remove(envVar, principal) {
+    return this.exclusive(false, () => this.kernel.remove(envVar, principal), principal);
+  }
+  flights = /* @__PURE__ */ new Map();
+  turns = /* @__PURE__ */ new Map();
+  async post(post, begun) {
+    try {
+      return await post(begun.request);
+    } catch (error) {
+      this.kernel.connectAbandon(begun.ticket);
+      throw new CredentialExchangeError("transport", error instanceof Error ? error.message : "the token endpoint could not be reached");
+    }
+  }
+  async finish(ticket, reply) {
+    const settled = objectOf(await this.exclusive(false, () => this.kernel.connectFinish(ticket, reply.status, reply.body)), "connect outcome");
+    if (settled.error !== void 0) {
+      const failure = failureOf(settled.error);
+      throw new CredentialExchangeError(failure.kind, failure.message);
+    }
+    return standingOf(settled.ok);
+  }
+  /** Exchange `grant` at its token endpoint through `post` and keep the result as the credential: the kernel builds the request and settles the reply, the host only sends. */
+  async connect(grant, post) {
+    try {
+      const run = async () => {
+        const begun = objectOf(this.current().connectBegin(JSON.stringify(grant)), "connect request");
+        if (begun.error !== void 0) {
+          const failure = failureOf(begun.error);
+          throw new CredentialExchangeError(failure.kind, failure.message);
+        }
+        const request = requestOf(begun.ok);
+        return this.finish(request.ticket, await this.post(post, request));
+      };
+      if (grant.grant !== "refresh_token") return { ok: await run() };
+      const key = credentialStorageKey({ name: grant.name, ...grant.principal !== void 0 ? { principal: grant.principal } : {} });
+      const previous = this.turns.get(key);
+      const mine = (async () => {
+        await previous?.catch(() => void 0);
+        return run();
+      })();
+      this.turns.set(key, mine);
+      try {
+        return { ok: await mine };
+      } finally {
+        if (this.turns.get(key) === mine) this.turns.delete(key);
+      }
+    } catch (error) {
+      if (error instanceof CredentialExchangeError) return { error: { kind: error.kind, message: error.message } };
+      throw error;
+    }
+  }
+  /** The credential `envVar` for `principal`, refreshed first through `post` when it is past its expiry; concurrent resolves share one refresh. Undefined when nothing is held, nothing can renew it, or the provider refused (which drops the row). */
+  async resolveFresh(envVar, principal, post) {
+    const begun = objectOf(this.current().refreshBegin(envVar, principal), "refresh outcome");
+    if (begun.error !== void 0) {
+      const failure = failureOf(begun.error);
+      throw new CredentialExchangeError(failure.kind, failure.message);
+    }
+    const ok = begun.ok;
+    if (!isJsonObject(ok)) throw new Error("the kernel refresh outcome is malformed");
+    if (ok.exchange === void 0) return typeof ok.resolved === "string" ? ok.resolved : void 0;
+    const key = credentialStorageKey({ name: envVar, ...principal !== void 0 ? { principal } : {} });
+    const running = this.flights.get(key);
+    if (running !== void 0) {
+      this.current().connectAbandon(requestOf(ok.exchange).ticket);
+      return running;
+    }
+    const request = requestOf(ok.exchange);
+    const flight = (async () => {
+      try {
+        await this.finish(request.ticket, await this.post(post, request));
+      } catch (error) {
+        if (error instanceof CredentialExchangeError && error.kind === "invalid_grant") return void 0;
+        throw error;
+      }
+      return this.resolve(envVar, principal);
+    })();
+    this.flights.set(key, flight);
+    try {
+      return await flight;
+    } finally {
+      this.flights.delete(key);
+    }
+  }
+  /** Re-encrypt every row under the current master key; a row the kernel cannot read fails it before any row changes. */
+  async rotate() {
+    const counts = objectOf(await this.exclusive(true, () => this.kernel.rotate()), "rotation");
+    return { rotated: numberOf(counts.rotated, "rotated"), alreadyCurrent: numberOf(counts.alreadyCurrent, "alreadyCurrent"), unreadable: numberOf(counts.unreadable, "unreadable") };
+  }
+};
+
+export { CredentialExchangeError, CredentialVault };