@almadar/shell-runtime 0.1.0 → 1.0.0

package/dist/client/client-kernel.d.ts

@@ -1,4 +1,4 @@
-import { OrbitalEventResponse, OrbitalEventRequest, DispatchMode, MountSeed, TransitionRejection } from '@almadar/core';
+import { EventResponse, EventRequest, DispatchMode, EmittedEvent, MountSeed, TransitionRejection } from '@almadar/core';
 import { CircuitStore } from './circuit-store.js';
 import './awaiting.js';
 import './state-book.js';
@@ -12,7 +12,7 @@ import '@almadar/core/kernel-wire';
 
 /** One `ClientKernel.dispatch()` call's settled outcome. */
 interface ClientKernelOutcome {
-    response: OrbitalEventResponse;
+    response: EventResponse;
     mode: DispatchMode;
     /**
      * True when `onLocal` already received the local arm's response (the leg
@@ -20,21 +20,25 @@ interface ClientKernelOutcome {
      * added — the local ones were painted before the round trip.
      */
     localPainted?: boolean;
-    serverEffects?: Pick<OrbitalEventResponse, 'clientEffects' | 'clientEffectsByTrait'>;
+    serverEffects?: Pick<EventResponse, 'clientEffectsByTrait'>;
     /**
      * A tick-lane dispatch: what its post's fold added on top of the local run,
      * once the post settles (undefined when a newer firing superseded it). The
      * drain never waits on it; the caller paints it when it lands.
      */
-    tickSettled?: Promise<Pick<OrbitalEventResponse, 'clientEffects' | 'clientEffectsByTrait'> | undefined>;
+    tickSettled?: Promise<Pick<EventResponse, 'clientEffectsByTrait'> | undefined>;
 }
 /** Per-dispatch hooks: `onLocal` sees the locally-evaluated response before its server leg is sent. */
 interface ClientDispatchHooks {
-    onLocal?: (local: OrbitalEventResponse) => void;
+    onLocal?: (local: EventResponse) => void;
 }
 /** Mount hooks: `onLocal` sees each seed's local response before the mount leg is sent. */
 interface ClientMountHooks {
-    onLocal?: (trait: string, local: OrbitalEventResponse) => void;
+    onLocal?: (trait: string, local: EventResponse) => void;
+}
+/** What the kernel answered to an emit that entered from outside it: the cascade it ran, with its paint and its emits. */
+interface ClientEmitOutcome {
+    response: EventResponse;
 }
 /** One `ClientKernel.dispatchMount()` call's settled outcome. */
 interface ClientMountOutcome {
@@ -43,7 +47,7 @@ interface ClientMountOutcome {
         trait: string;
         event: string;
         mode: DispatchMode;
-        local: OrbitalEventResponse;
+        local: EventResponse;
     }>;
     /** Whether any mount leg was posted. */
     posted: boolean;
@@ -52,8 +56,8 @@ interface ClientMountOutcome {
     /** Per-trait effect failures the posted legs reported (`effect-failed`). */
     rejections: TransitionRejection[];
     /** What the posted legs added: the server's effects and the emits the client had not run. */
-    serverEffects: Pick<OrbitalEventResponse, 'clientEffects' | 'clientEffectsByTrait'>;
-    emittedEvents: OrbitalEventResponse['emittedEvents'];
+    serverEffects: Pick<EventResponse, 'clientEffectsByTrait'>;
+    emittedEvents: EventResponse['emittedEvents'];
 }
 interface ClientKernel {
     /**
@@ -78,25 +82,42 @@ interface ClientKernel {
      * out on a per-(event, trait) newest-wins lane outside the FIFO, with no
      * rollback, so a tick round trip never delays a command.
      */
-    dispatch(request: OrbitalEventRequest, hooks?: ClientDispatchHooks): Promise<ClientKernelOutcome>;
+    dispatch(request: EventRequest, hooks?: ClientDispatchHooks): Promise<ClientKernelOutcome>;
     /**
      * Dispatch a server-pushed live message of THIS client's own running
      * request (`PushTarget` `origin`). Outside the FIFO, because the request
      * producing it is the entry the FIFO is waiting on; progress dispatches run
      * one at a time, in push order, and never mark traits awaiting.
      */
-    dispatchProgress(request: OrbitalEventRequest): Promise<ClientKernelOutcome>;
+    dispatchProgress(request: EventRequest): Promise<ClientKernelOutcome>;
     /**
      * Show the result of a dispatch the host ran on its own (`EventTransport.subscribeHostDispatches`):
      * the host's states, rows and render land in this view. Nothing runs here and nothing is posted,
      * so the dispatch's effects happen once, on the host. Host dispatches fold one at a time, in order.
      */
-    foldHostDispatch(request: OrbitalEventRequest, response: OrbitalEventResponse): Promise<ClientKernelOutcome>;
+    foldHostDispatch(request: EventRequest, response: EventResponse): Promise<ClientKernelOutcome>;
+    /**
+     * Hand the kernel an emit that happened outside it (a bus emit with no dispatch behind it, a server push). The kernel
+     * decides who hears it: the emitter's own arm and every declared `listens` route (EXEC-DISP). Nothing is routed here.
+     */
+    deliverEmit(emitted: EmittedEvent): Promise<ClientEmitOutcome>;
+    /**
+     * Hand the kernel an emit another client made (a server push): it reaches its declared `listens` routes only, guards and
+     * payload mapping included. The emitter's own arm does not run here, and neither the emit's `dispatched` stamp nor the
+     * host's fan-out narrows who hears it.
+     */
+    deliverToListeners(emitted: EmittedEvent): Promise<ClientEmitOutcome>;
+    /**
+     * Hand the kernel the live message of this client's own running call, whose emitter already ran its own arm as that call's
+     * progress dispatch: it reaches its declared `listens` routes like `deliverToListeners`, except that a route back to the
+     * emitter under the emitted name is that arm again and does not run twice.
+     */
+    deliverOriginEmit(emitted: EmittedEvent): Promise<ClientEmitOutcome>;
     /**
      * Mount several traits in ONE FIFO entry: every seed's local arm runs and
      * paints, then one `mount` leg per owning orbital is posted and folded.
      */
-    dispatchMount(seeds: readonly MountSeed[], hooks?: ClientMountHooks, base?: Pick<OrbitalEventRequest, 'payload' | 'entityId' | 'clientId' | 'locale'>): Promise<ClientMountOutcome>;
+    dispatchMount(seeds: readonly MountSeed[], hooks?: ClientMountHooks, base?: Pick<EventRequest, 'payload' | 'entityId' | 'clientId' | 'locale' | 'route'>): Promise<ClientMountOutcome>;
     readonly store: CircuitStore;
 }
 /**
@@ -107,7 +128,7 @@ interface ClientKernel {
  * observer; a frame's aggregate response carries tick hops the kernel's tick observer already reported. `notify` wakes the store's subscribers after the fold; a frame folds several responses and notifies on the last only.
  */
 interface LocalFoldKernel {
-    foldLocalResponse(response: OrbitalEventResponse, traceHops: boolean, notify: boolean): Promise<void>;
+    foldLocalResponse(response: EventResponse, traceHops: boolean, notify: boolean): Promise<void>;
 }
 
-export type { ClientDispatchHooks, ClientKernel, ClientKernelOutcome, ClientMountHooks, ClientMountOutcome, LocalFoldKernel };
+export type { ClientDispatchHooks, ClientEmitOutcome, ClientKernel, ClientKernelOutcome, ClientMountHooks, ClientMountOutcome, LocalFoldKernel };

package/dist/client/declared-input-dispatch.d.ts

@@ -1,5 +1,22 @@
-import { OrbitalSchema, ExternalInputRequest, OrbitalEventRequest, OrbitalEventResponse } from '@almadar/core';
+import { ExternalInputRequest, EventRequest, EventResponse } from '@almadar/core';
+import { KernelEngine } from '../kernel/engine.js';
+import '@almadar/core/kernel-wire';
+import '../kernel/host.js';
+import '../effects/in-flight-calls.js';
+import '../service/service-provider.js';
+import '../kernel/program-effects.js';
+import '../kernel/secret-ports.js';
+import '../credentials/vault.js';
+import '../kernel/wire.js';
+import '../kernel/os-port.js';
 
-declare function dispatchDeclaredInput(schema: OrbitalSchema | null | undefined, orbitalName: string, request: ExternalInputRequest, send: (orbitalName: string, request: OrbitalEventRequest) => Promise<OrbitalEventResponse>): Promise<OrbitalEventResponse>;
+/**
+ * The dispatcher for declared external inputs. The server runtime and the in-process host (a
+ * browser extension's worker) both route outside-client inputs through it: the kernel says whether the
+ * input is declared, an undeclared one is refused identically everywhere and a declared one is an ordinary
+ * event addressed to its trait.
+ */
+
+declare function dispatchDeclaredInput(contract: Pick<KernelEngine, 'findExternalInput'>, orbitalName: string, request: ExternalInputRequest, send: (orbitalName: string, request: EventRequest) => Promise<EventResponse>): Promise<EventResponse>;
 
 export { dispatchDeclaredInput };

package/dist/client/declared-input-dispatch.js

@@ -1,2 +1 @@
-export { dispatchDeclaredInput } from '../chunk-DYOJGLIX.js';
-import '../chunk-MLKGABMK.js';
+export { dispatchDeclaredInput } from '../chunk-LKWYCYX5.js';

package/dist/client/inbound-dispatch.d.ts

@@ -1,5 +1,24 @@
-import { OrbitalSchema, InboundDelivery, OrbitalEventRequest, OrbitalEventResponse, InboundAnswer } from '@almadar/core';
+import { InboundDelivery, EventRequest, EventResponse, InboundAnswer } from '@almadar/core';
+import { KernelEngine } from '../kernel/engine.js';
+import '@almadar/core/kernel-wire';
+import '../kernel/host.js';
+import '../effects/in-flight-calls.js';
+import '../service/service-provider.js';
+import '../kernel/program-effects.js';
+import '../kernel/secret-ports.js';
+import '../credentials/vault.js';
+import '../kernel/wire.js';
+import '../kernel/os-port.js';
 
-declare function dispatchInbound(schema: OrbitalSchema | null | undefined, name: string, delivery: InboundDelivery, send: (orbitalName: string, request: OrbitalEventRequest) => Promise<OrbitalEventResponse>, credential: (name: string) => Promise<string | null | undefined>): Promise<InboundAnswer>;
+/**
+ * The dispatcher for inbound deliveries (EXEC-INBOUND-1). A host carries `{name, headers,
+ * rawBody}` from `/api/hooks/<name>`; the kernel decides whether the name is served, what payload the
+ * handler event is delivered with and what answer the handler's emit of its `answers` event is; this
+ * delivers the event through the host's own dispatch and writes what the kernel said.
+ */
+
+type InboundContract = Pick<KernelEngine, 'findInbound' | 'inboundPayload' | 'inboundAnswer' | 'credentialUnset' | 'dispatchFailed'>;
+declare function dispatchInbound(contract: InboundContract, name: string, delivery: InboundDelivery, send: (orbitalName: string, request: EventRequest) => Promise<EventResponse>, credential: (name: string) => Promise<string | null | undefined>): Promise<InboundAnswer>;
 
 export { dispatchInbound };
+export type { InboundContract };

package/dist/client/inbound-dispatch.js

@@ -1,2 +1 @@
-export { dispatchInbound } from '../chunk-2JU7Y4KU.js';
-import '../chunk-MLKGABMK.js';
+export { dispatchInbound } from '../chunk-P2N6K2IV.js';

package/dist/client/local-fold.d.ts

@@ -1,26 +1,33 @@
-import { OrbitalEventResponse } from '@almadar/core';
+import { EventResponse } from '@almadar/core';
+import { FrameDelta } from '@almadar/core/kernel-wire';
 import { LocalFoldKernel } from './client-kernel.js';
 import { CircuitStore } from './circuit-store.js';
 import { TransitionObserver } from './trait-types.js';
 import './awaiting.js';
 import './state-book.js';
-import '@almadar/core/kernel-wire';
 
 /**
  * The view's side of a dispatch the in-process kernel already ran: report its executed hops to the observer,
- * mirror its states, rows and sticky callsite payloads into the `CircuitStore`, then notify subscribers.
+ * paint its states, frame delta and sticky callsite payloads into the `CircuitStore`, then notify subscribers.
  * One implementation for every response the kernel produces (a dispatch, a mount seed, a posted leg's fold,
  * a tick frame).
  */
 
-declare function mirrorResponse(store: CircuitStore, frameKeyOf: (trait: string) => string | undefined, response: OrbitalEventResponse): void;
-declare function traceResponse(observer: TransitionObserver | undefined, response: OrbitalEventResponse): void;
+/** A snapshot of the kernel's frames for a painter at `since` (the kernel's `framesSince`). */
+type FramesSince = (since: number) => FrameDelta;
+/** Paint a response's states. Rows are the kernel's frame delta, painted by [`paintFrames`]. */
+declare function paintStates(store: CircuitStore, response: EventResponse): void;
+/** Paint the kernel's frame delta; on a version gap, ask the kernel for the snapshot and paint that. */
+declare function paintFrames(store: CircuitStore, delta: FrameDelta | undefined, framesSince: FramesSince): void;
+/** Paint a response the in-process kernel produced: its states, payloads and frames. */
+declare function paintResponse(store: CircuitStore, framesSince: FramesSince, response: EventResponse): void;
+declare function traceResponse(observer: TransitionObserver | undefined, response: EventResponse): void;
 interface LocalFoldOptions {
     store: CircuitStore;
-    frameKeyOf(trait: string): string | undefined;
+    framesSince: FramesSince;
     observer?: TransitionObserver;
 }
 declare function createLocalFold(opts: LocalFoldOptions): LocalFoldKernel;
 
-export { createLocalFold, mirrorResponse, traceResponse };
-export type { LocalFoldOptions };
+export { createLocalFold, paintFrames, paintResponse, paintStates, traceResponse };
+export type { FramesSince, LocalFoldOptions };

package/dist/client/local-fold.js

@@ -1,2 +1 @@
-export { createLocalFold, mirrorResponse, traceResponse } from '../chunk-QQRDUMB2.js';
-import '../chunk-MLKGABMK.js';
+export { createLocalFold, paintFrames, paintResponse, paintStates, traceResponse } from '../chunk-QCJWPXLH.js';

package/dist/client/render-sigils.js

@@ -1,2 +1 @@
 export { DEFAULT_THEME_KEY, appNavItems, inlineNavItems, sigilThemeKey } from '../chunk-UP6GGGAN.js';
-import '../chunk-MLKGABMK.js';

package/dist/client/state-book.d.ts

@@ -1,17 +1,17 @@
-import { TraitDefinition, EventId } from '@almadar/core';
+import { TraitDefinition } from '@almadar/core';
 import { TransitionObserver, TraitState, RollbackCause } from './trait-types.js';
 import '@almadar/core/kernel-wire';
 
+/**
+ * The client's record of each trait's state, as the kernel reports it. The kernel decides every transition;
+ * this book only holds the states its responses carry, so a render can read them synchronously.
+ *
+ * @packageDocumentation
+ */
+
 /** The state a trait starts in: the one marked initial, else the first declared. */
 declare function findInitialState(trait: TraitDefinition): string;
 declare function createInitialTraitState(trait: TraitDefinition): TraitState;
-/**
- * Every transition out of `currentState` on the event, in declaration order. An event id is compared with a
- * transition's own id when both carry one, so an arm still matches after its event was renamed.
- */
-declare function findMatchingTransitions(trait: TraitDefinition, currentState: string, eventKey: string, eventId?: EventId): TraitDefinition['transitions'];
-/** The first transition out of `currentState` on the event, ignoring guards. */
-declare function findTransition(trait: TraitDefinition, currentState: string, eventKey: string, eventId?: EventId): TraitDefinition['transitions'][0] | undefined;
 declare class StateBook {
     private readonly observer?;
     private readonly traits;
@@ -21,17 +21,10 @@ declare class StateBook {
     getState(traitName: string, entityId?: string): TraitState | undefined;
     /** Each trait's singleton-scope state. */
     getAllStates(): Map<string, TraitState>;
-    /** Whether the trait has an arm on the event from its current state. */
-    canHandleEvent(traitName: string, eventKey: string, entityId?: string, eventId?: EventId): boolean;
-    /**
-     * The lifecycle event an embedded child can be repainted with: the one it handles from its current state,
-     * provided every matching arm stays in that state and only renders.
-     */
-    repaintLifecycleEvent(traitName: string, entityId?: string): string | undefined;
     /** Record the state the kernel reports. No-op for a trait not on the page. */
     seedState(traitName: string, currentState: string, entityId?: string): void;
     /** Undo an optimistic commit, reporting the hop back to the observer. */
     rollbackState(traitName: string, toState: string, entityId: string | undefined, cause: RollbackCause): void;
 }
 
-export { StateBook, createInitialTraitState, findInitialState, findMatchingTransitions, findTransition };
+export { StateBook, createInitialTraitState, findInitialState };

package/dist/client/state-book.js

@@ -1,2 +1 @@
-export { StateBook, createInitialTraitState, findInitialState, findMatchingTransitions, findTransition } from '../chunk-Q2H75UYT.js';
-import '../chunk-MLKGABMK.js';
+export { StateBook, createInitialTraitState, findInitialState } from '../chunk-A2JJT4GA.js';

package/dist/client/trait-mount-error.js

@@ -1,2 +1 @@
 export { TraitMountError } from '../chunk-IOPUS6Q5.js';
-import '../chunk-MLKGABMK.js';

package/dist/credentials/env-vars.d.ts

@@ -1,3 +1,7 @@
+/** Env var holding the 64-char-hex AES-256 master key (Secret Manager in production). */
+declare const CREDENTIAL_MASTER_KEY_ENV = "ALMADAR_CREDENTIAL_MASTER_KEY";
+/** Env var holding the PREVIOUS master key during a rotation window: `rotate` re-encrypts every row under the current key, then the previous key is retired. */
+declare const CREDENTIAL_PREVIOUS_MASTER_KEY_ENV = "ALMADAR_CREDENTIAL_MASTER_KEY_PREVIOUS";
 /**
  * Bootstrap secrets that must NEVER enter store custody: the master key(s)
  * decrypt the store itself, so seeding them as rows (encrypted under
@@ -11,4 +15,4 @@ declare const STORE_BOOTSTRAP_ENV_VARS: ReadonlySet<string>;
  */
 declare function allCredentialEnvVars(): Set<string>;
 
-export { STORE_BOOTSTRAP_ENV_VARS, allCredentialEnvVars };
+export { CREDENTIAL_MASTER_KEY_ENV, CREDENTIAL_PREVIOUS_MASTER_KEY_ENV, STORE_BOOTSTRAP_ENV_VARS, allCredentialEnvVars };

package/dist/credentials/env-vars.js

@@ -1,3 +1 @@
-export { STORE_BOOTSTRAP_ENV_VARS, allCredentialEnvVars } from '../chunk-Q7JK4KY7.js';
-import '../chunk-NAECVIAR.js';
-import '../chunk-MLKGABMK.js';
+export { CREDENTIAL_MASTER_KEY_ENV, CREDENTIAL_PREVIOUS_MASTER_KEY_ENV, STORE_BOOTSTRAP_ENV_VARS, allCredentialEnvVars } from '../chunk-VNGXRYFF.js';

package/dist/credentials/scope.d.ts

@@ -1,5 +1,6 @@
-import { CredentialStore } from './store.js';
+import { CredentialVault } from './vault.js';
 import '@almadar/core';
+import '@almadar/core/kernel-wire';
 
 /** Whether integrations answer with mock data or call their real backends. */
 type CredentialMode = 'mock' | 'real';
@@ -12,15 +13,15 @@ interface CredentialModeControl {
 }
 /** The per-tenant credential scope: a Node host installs AsyncLocalStorage (`@almadar/shell-node`); a browser has none. */
 interface CredentialScopeStorage {
-    run<T>(store: CredentialStore, fn: () => T): T;
-    getStore(): CredentialStore | undefined;
+    run<T>(store: CredentialVault, fn: () => T): T;
+    getStore(): CredentialVault | undefined;
 }
 declare function installCredentialScopeStorage(storage: CredentialScopeStorage): void;
 /**
  * Run `fn` as one tenant of a multi-tenant host: every credential reference resolved inside it
  * (across awaits) comes from `store` alone, never from the host's env or installed store.
  */
-declare function runWithCredentialScope<T>(store: CredentialStore, fn: () => T): T;
+declare function runWithCredentialScope<T>(store: CredentialVault, fn: () => T): T;
 /** The host's mode switch, installed beside its credential store. */
 declare function installModeControl(control: CredentialModeControl): void;
 declare function getModeControl(): CredentialModeControl | null;
@@ -29,10 +30,10 @@ declare function getModeControl(): CredentialModeControl | null;
  * Called once at boot (playground / generated server) after the store is
  * constructed over the host's persistence adapter.
  */
-declare function installCredentialStore(store: CredentialStore): void;
+declare function installCredentialStore(store: CredentialVault): void;
 /** The installed store, for the credentials admin service. */
-declare function getInstalledCredentialStore(): CredentialStore | null;
-declare function getEffectiveCredentialStore(): CredentialStore | null;
+declare function getInstalledCredentialStore(): CredentialVault | null;
+declare function getEffectiveCredentialStore(): CredentialVault | null;
 /** Testing/reset hook. */
 declare function uninstallCredentialStore(): void;
 /** The env var selecting store-only resolution (the kernel rule `credential_admin::SOURCE_VAR`). */

package/dist/credentials/scope.js

@@ -1,2 +1 @@
 export { CREDENTIALS_SOURCE_ENV, credentialModeFromEnv, credentialsFromStoreOnly, getEffectiveCredentialStore, getInstalledCredentialStore, getModeControl, installCredentialScopeStorage, installCredentialStore, installModeControl, resolveCredentialRef, runWithCredentialScope, uninstallCredentialStore } from '../chunk-HLOUDLPI.js';
-import '../chunk-MLKGABMK.js';

package/dist/credentials/vault.d.ts

@@ -0,0 +1,142 @@
+import { EntityRow } from '@almadar/core';
+import { CredentialGrantWire, CredentialStanding, ConnectFailure, ConnectFailureKind } from '@almadar/core/kernel-wire';
+
+/**
+ * The credential rows a host keeps over its medium (`chrome.storage`, files, Firestore). It answers four raw asks and
+ * decides nothing: encryption, row shape, identity and every failure rule are the kernel's (`CredentialVault`, wasm).
+ * `create` carries the id the kernel gave the row; `update` merges `data` over the row; `delete` answers whether this call
+ * removed the row, and must do so atomically against other takers of the same medium: it is the conditional delete a
+ * one-use value is taken with.
+ */
+interface CredentialRowsPort {
+    list(): Promise<EntityRow[]>;
+    create(row: EntityRow & {
+        id: string;
+    }): Promise<void>;
+    update(id: string, data: EntityRow): Promise<void>;
+    delete(id: string): Promise<boolean>;
+}
+/** The slice of the wasm `CredentialVault` class (`@almadar/kernel`) this handle uses; each result is JSON text. */
+interface CredentialVaultKernel {
+    readonly enabled: boolean;
+    load(rowsJson: string): number;
+    resolve(name: string, principal?: string): string | undefined;
+    label(name: string, principal?: string): string | undefined;
+    snapshotEnv(): string;
+    entries(principal?: string): string;
+    listing(): string;
+    set(service: string, name: string, value: string, principal?: string, label?: string): string;
+    replace(name: string, value: string, principal?: string): string;
+    persist(name: string, value: string, principal?: string, label?: string): string;
+    remove(name: string, principal?: string): boolean;
+    rotate(): string;
+    takeWrites(): string;
+    connectBegin(grantJson: string): string;
+    refreshBegin(name: string, principal?: string): string;
+    connectFinish(ticket: number, status: number, body: string): string;
+    connectAbandon(ticket: number): boolean;
+}
+/** What the kernel asks a host to POST to a token endpoint. The host decides nothing about it. */
+interface TokenRequest {
+    endpoint: string;
+    headers: Array<[string, string]>;
+    body: string;
+}
+interface TokenReply {
+    status: number;
+    body: string;
+}
+/** The host's one network capability the credential exchange needs: a form POST to an https token endpoint, no redirects followed. */
+type TokenEndpointPost = (request: TokenRequest) => Promise<TokenReply>;
+/** A token exchange the kernel's store refused or the host could not carry; `kind` is the kernel's `ConnectFailureKind`. */
+declare class CredentialExchangeError extends Error {
+    readonly kind: ConnectFailureKind;
+    constructor(kind: ConnectFailureKind, message: string);
+}
+/** A kernel module that carries the vault class: `import * as kernel from '@almadar/kernel/client'`. */
+interface CredentialVaultModule {
+    CredentialVault: new (masterKey?: string, previousKey?: string) => CredentialVaultKernel;
+}
+/** Masked view of one stored credential, safe to return to a settings page. */
+interface CredentialEntry {
+    service: string;
+    envVar: string;
+    last4: string;
+    updatedAt: number;
+    principal?: string;
+}
+interface CredentialRotation {
+    rotated: number;
+    alreadyCurrent: number;
+    unreadable: number;
+}
+interface CredentialListing {
+    enabled: boolean;
+    entries: Array<{
+        service: string;
+        name: string;
+        last4?: string;
+    }>;
+}
+/**
+ * The host's handle on the kernel's encrypted credential store. The kernel keeps the rows the host last listed, runs every
+ * operation (set, remove, rotate, resolution, masking) and records what changed; this handle lists the rows into
+ * it and applies the recorded writes to the host's medium, one operation at a time. A row the kernel cannot read fails
+ * `open` and every operation after it: nothing here reads a broken store as an empty one.
+ */
+declare class CredentialVault {
+    private readonly kernel;
+    private readonly rows;
+    private readonly listeners;
+    private queue;
+    private broken;
+    private constructor();
+    /** List the host's rows into the kernel and read them; rejects naming the rows it cannot read. */
+    static open(kernel: CredentialVaultKernel, rows: CredentialRowsPort): Promise<CredentialVault>;
+    /** True when a valid master key is present (writes and decryption enabled). */
+    get enabled(): boolean;
+    /** Subscribe to credential changes; returns an unsubscribe function. */
+    subscribe(listener: (principal?: string) => void): () => void;
+    private notify;
+    private reload;
+    private current;
+    private apply;
+    /** One operation at a time: the kernel runs it, then its writes reach the medium before the next begins. */
+    private serial;
+    private exclusive;
+    /** Resolve one credential by name (warmed values only). */
+    resolve(envVar: string, principal?: string): string | undefined;
+    /** The non-secret account label stored in the clear beside a credential's ciphertext; undefined when its row carries none. */
+    label(envVar: string, principal?: string): string | undefined;
+    /** All app-wide values as an env-shaped map, for merging over the process env. */
+    snapshotEnv(): Record<string, string>;
+    /** Masked entries for display — never includes plaintext. */
+    entries(principal?: string): CredentialEntry[];
+    /** Whether the store can encrypt and the service and name of every app-wide row. */
+    listing(): CredentialListing;
+    /** Upsert one credential; `label` is a non-secret account name kept in the clear beside it, left out it stays as it is. */
+    set(service: string, envVar: string, value: string, principal?: string, label?: string): Promise<CredentialEntry>;
+    /** Replace the value of a credential already stored, keeping its service (a rotated refresh token). */
+    replace(envVar: string, value: string, principal?: string): Promise<CredentialEntry>;
+    /** Keep `value` as the credential until it is forgotten, creating it when absent. */
+    persist(envVar: string, value: string, principal?: string, label?: string): Promise<CredentialEntry>;
+    /** Delete one credential row; whether one existed. */
+    remove(envVar: string, principal?: string): Promise<boolean>;
+    private readonly flights;
+    private readonly turns;
+    private post;
+    private finish;
+    /** Exchange `grant` at its token endpoint through `post` and keep the result as the credential: the kernel builds the request and settles the reply, the host only sends. */
+    connect(grant: CredentialGrantWire, post: TokenEndpointPost): Promise<{
+        ok: CredentialStanding;
+    } | {
+        error: ConnectFailure;
+    }>;
+    /** The credential `envVar` for `principal`, refreshed first through `post` when it is past its expiry; concurrent resolves share one refresh. Undefined when nothing is held, nothing can renew it, or the provider refused (which drops the row). */
+    resolveFresh(envVar: string, principal: string | undefined, post: TokenEndpointPost): Promise<string | undefined>;
+    /** Re-encrypt every row under the current master key; a row the kernel cannot read fails it before any row changes. */
+    rotate(): Promise<CredentialRotation>;
+}
+
+export { CredentialExchangeError, CredentialVault };
+export type { CredentialEntry, CredentialListing, CredentialRotation, CredentialRowsPort, CredentialVaultKernel, CredentialVaultModule, TokenEndpointPost, TokenReply, TokenRequest };

package/dist/credentials/vault.js

@@ -0,0 +1 @@
+export { CredentialExchangeError, CredentialVault } from '../chunk-DFDNHVDW.js';

package/dist/effects/in-flight-calls.js

@@ -1,2 +1 @@
 export { InFlightCalls, untilAborted } from '../chunk-MZKIL5IN.js';
-import '../chunk-MLKGABMK.js';

package/dist/effects/on-device-model.js

@@ -1,2 +1 @@
 export { NO_ON_DEVICE_EMBEDDER, NO_ON_DEVICE_MODEL, OnDeviceModelFailure, embedOnDevice, promptOnDevice } from '../chunk-FWA5K7Q2.js';
-import '../chunk-MLKGABMK.js';

package/dist/events/EventBus.d.ts

@@ -3,10 +3,7 @@ import { EventPayload } from '@almadar/core';
 import '../service/default-call-service.js';
 import '../service/service-provider.js';
 import '../kernel/program-effects.js';
-import '../runtime/effects/composition/compose-behaviors.js';
-import '../runtime/effects/composition/event-wiring.js';
-import '../runtime/effects/composition/layout-strategy.js';
-import '../runtime/effects/composition/pipe.js';
+import '@almadar/core/kernel-wire';
 
 /**
  * EventBus - Platform-Agnostic Pub/Sub Implementation

package/dist/events/EventBus.js

@@ -1,2 +1 @@
 export { EventBus, createEventBus } from '../chunk-SOQDEPME.js';
-import '../chunk-MLKGABMK.js';

package/dist/events/emit-stamp.js

@@ -1,2 +1 @@
 export { stampEmitSource } from '../chunk-64IH2SMY.js';
-import '../chunk-MLKGABMK.js';