@almadar/shell-runtime 0.1.0 → 1.1.0

package/dist/chunk-2WCVOMZ2.js

@@ -0,0 +1,112 @@
+import { base64Standard } from './chunk-ZUSM4VW4.js';
+
+// src/kernel/os-fetch-port.ts
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var fail = (kind, message) => ({ error: { kind, message: `os/fetch: ${message}` } });
+function bytesOf(base64) {
+  const text = atob(base64);
+  const bytes = new Uint8Array(text.length);
+  for (let i = 0; i < text.length; i += 1) bytes[i] = text.charCodeAt(i);
+  return bytes;
+}
+function headersOf(value) {
+  const headers = new Headers();
+  if (value === void 0) return headers;
+  if (!Array.isArray(value)) return "headers must be a list of { name, value }";
+  for (const header of value) {
+    if (!isRecord(header) || typeof header.name !== "string" || typeof header.value !== "string") return "headers must be a list of { name, value }";
+    headers.append(header.name, header.value);
+  }
+  return headers;
+}
+var failed = (kind, op, message) => ({ error: { kind, message: `${op}: ${message}` } });
+var isGpuOp = (op) => op.startsWith("gpu/");
+var noGpu = (op) => failed("unsupported", op, "this host installed no gpu answerer");
+var fetchOnly = (op) => failed("unsupported", op, "a browser host answers only os/fetch, and os/recv and os/close on the handle of a streamed one");
+function createFetchOsHost(performFetch) {
+  const pending = /* @__PURE__ */ new Set();
+  const bodies = /* @__PURE__ */ new Map();
+  let nextHandle = 1;
+  const openOf = (op, handle) => {
+    const open = typeof handle === "number" ? bodies.get(handle) : void 0;
+    return open ?? failed("closed", op, "the handle is not an open streamed response");
+  };
+  async function receive(args) {
+    const open = openOf("os/recv", args[0]);
+    if (!("reader" in open)) return open;
+    const count = args[1];
+    if (typeof count !== "number" || !Number.isInteger(count) || count < 1) return failed("invalid", "os/recv", "the count must be a positive integer");
+    try {
+      if (open.held.length === 0) {
+        const next = await open.reader.read();
+        if (next.done) return { ok: { data: base64Standard(new Uint8Array(0)), eof: true } };
+        open.held = next.value;
+      }
+      const data = open.held.subarray(0, count);
+      open.held = open.held.subarray(count);
+      return { ok: { data: base64Standard(data), eof: false } };
+    } catch (raised) {
+      return failed("io", "os/recv", raised instanceof Error ? raised.message : "the response body failed");
+    }
+  }
+  async function release(args) {
+    const open = openOf("os/close", args[0]);
+    if (!("reader" in open)) return open;
+    if (typeof args[0] === "number") bodies.delete(args[0]);
+    pending.delete(open.control);
+    open.control.abort();
+    await open.reader.cancel().catch(() => void 0);
+    return { ok: {} };
+  }
+  return {
+    async answer(op, args) {
+      if (isGpuOp(op)) return noGpu(op);
+      if (op === "os/recv") return receive(args);
+      if (op === "os/close") return release(args);
+      if (op !== "os/fetch") return fetchOnly(op);
+      const [method, url, request] = args;
+      if (typeof method !== "string" || typeof url !== "string") return fail("invalid", "the method and the url must be text");
+      if (request !== void 0 && !isRecord(request)) return fail("invalid", "the request must be { headers?, body?, timeoutMs?, stream? }");
+      const headers = headersOf(request?.headers);
+      if (typeof headers === "string") return fail("invalid", headers);
+      const body = request?.body;
+      if (body !== void 0 && typeof body !== "string") return fail("invalid", "the body must be bytes");
+      const timeoutMs = request?.timeoutMs;
+      if (timeoutMs !== void 0 && (typeof timeoutMs !== "number" || !(timeoutMs > 0))) return fail("invalid", "timeoutMs must be a positive number");
+      const stream = request?.stream;
+      if (stream !== void 0 && typeof stream !== "boolean") return fail("invalid", "stream must be a boolean");
+      const control = new AbortController();
+      pending.add(control);
+      const timer = typeof timeoutMs === "number" ? setTimeout(() => control.abort(), timeoutMs) : void 0;
+      let kept = false;
+      try {
+        const response = await performFetch(url, { method, headers, signal: control.signal, ...body !== void 0 ? { body: bytesOf(body) } : {} });
+        const received = [];
+        response.headers.forEach((value, name) => received.push({ name, value }));
+        if (stream === true) {
+          const handle = nextHandle;
+          nextHandle += 1;
+          const reader = (response.body ?? new ReadableStream({ start: (sink) => sink.close() })).getReader();
+          bodies.set(handle, { reader, control, held: new Uint8Array(0) });
+          kept = true;
+          return { ok: { status: response.status, headers: received, body: base64Standard(new Uint8Array(0)), handle } };
+        }
+        return { ok: { status: response.status, headers: received, body: base64Standard(new Uint8Array(await response.arrayBuffer())) } };
+      } catch (raised) {
+        if (control.signal.aborted) return fail("timeout", `no answer within ${String(timeoutMs)} ms`);
+        return fail("io", raised instanceof Error ? raised.message : "the fetch failed");
+      } finally {
+        if (timer !== void 0) clearTimeout(timer);
+        if (!kept) pending.delete(control);
+      }
+    },
+    close() {
+      for (const control of pending) control.abort();
+      pending.clear();
+      for (const open of bodies.values()) void open.reader.cancel().catch(() => void 0);
+      bodies.clear();
+    }
+  };
+}
+
+export { createFetchOsHost };

package/dist/chunk-57SBCUSM.js

@@ -0,0 +1,62 @@
+// src/loader/fetch-loader.ts
+var FetchSchemaLoader = class {
+  /** `base`: the URL relative imports resolve against when no importer is named (the page's own URL by default). */
+  constructor(base) {
+    this.base = base;
+  }
+  base;
+  cache = /* @__PURE__ */ new Map();
+  resolvePath(importPath, fromPath) {
+    try {
+      return { success: true, data: new URL(importPath, new URL(fromPath ?? this.base, this.base)).href };
+    } catch (error) {
+      return { success: false, error: `Cannot resolve ${importPath}${fromPath !== void 0 ? ` from ${fromPath}` : ""}: ${error instanceof Error ? error.message : String(error)}` };
+    }
+  }
+  load(importPath, fromPath) {
+    const resolved = this.resolvePath(importPath, fromPath);
+    if (!resolved.success) return Promise.resolve(resolved);
+    const url = resolved.data;
+    const held = this.cache.get(url);
+    if (held !== void 0) return held;
+    const loading = fetchSchema(url, importPath);
+    loading.then((result) => {
+      if (!result.success) this.cache.delete(url);
+    }, () => this.cache.delete(url));
+    this.cache.set(url, loading);
+    return loading;
+  }
+  async loadOrbital(importPath, orbitalName, fromPath) {
+    const loaded = await this.load(importPath, fromPath);
+    if (!loaded.success) return loaded;
+    const { schema, sourcePath } = loaded.data;
+    const orbital = orbitalName === void 0 ? schema.orbitals[0] : schema.orbitals.find((o) => o.name === orbitalName);
+    if (orbital === void 0) {
+      return { success: false, error: `${sourcePath} has no orbital ${orbitalName ?? "(none)"}; found: ${schema.orbitals.map((o) => o.name).join(", ")}` };
+    }
+    return { success: true, data: { orbital, orbitals: schema.orbitals, sourcePath, importPath } };
+  }
+  clearCache() {
+    this.cache.clear();
+  }
+  getCacheStats() {
+    return { size: this.cache.size };
+  }
+};
+async function fetchSchema(url, importPath) {
+  let response;
+  try {
+    response = await fetch(url);
+  } catch (error) {
+    return { success: false, error: `${url}: ${error instanceof Error ? error.message : String(error)}` };
+  }
+  if (!response.ok) return { success: false, error: `${url}: ${response.status} ${response.statusText}` };
+  try {
+    const schema = await response.json();
+    return { success: true, data: { schema, sourcePath: url, importPath } };
+  } catch (error) {
+    return { success: false, error: `${url} is not a program: ${error instanceof Error ? error.message : String(error)}` };
+  }
+}
+
+export { FetchSchemaLoader };

package/dist/{chunk-Q2H75UYT.js → chunk-A2JJT4GA.js}

@@ -1,5 +1,3 @@
-import { normalizeEventKey, LIFECYCLE_EVENTS } from '@almadar/core';
-
 // src/client/state-book.ts
 function findInitialState(trait) {
   const markedInitial = trait.states?.find((s) => s.isInitial)?.name;
@@ -14,17 +12,6 @@ function createInitialTraitState(trait) {
     context: {}
   };
 }
-function findMatchingTransitions(trait, currentState, eventKey, eventId) {
-  return (trait.transitions ?? []).filter((t) => {
-    const fromMatches = Array.isArray(t.from) ? t.from.includes(currentState) : t.from === currentState;
-    if (!fromMatches) return false;
-    if (eventId && t.eventId) return t.eventId === eventId;
-    return t.event === eventKey;
-  });
-}
-function findTransition(trait, currentState, eventKey, eventId) {
-  return findMatchingTransitions(trait, currentState, eventKey, eventId)[0];
-}
 var SINGLETON_SCOPE = "__singleton__";
 var key = (traitName, entityId) => `${traitName}::${entityId ?? SINGLETON_SCOPE}`;
 var StateBook = class {
@@ -51,29 +38,6 @@ var StateBook = class {
     }
     return out;
   }
-  /** Whether the trait has an arm on the event from its current state. */
-  canHandleEvent(traitName, eventKey, entityId, eventId) {
-    const trait = this.traits.get(traitName);
-    const state = this.getState(traitName, entityId);
-    if (trait === void 0 || state === void 0) return false;
-    return findTransition(trait, state.currentState, normalizeEventKey(eventKey), eventId) !== void 0;
-  }
-  /**
-   * The lifecycle event an embedded child can be repainted with: the one it handles from its current state,
-   * provided every matching arm stays in that state and only renders.
-   */
-  repaintLifecycleEvent(traitName, entityId) {
-    const trait = this.traits.get(traitName);
-    const state = this.getState(traitName, entityId);
-    if (trait === void 0 || state === void 0) return void 0;
-    for (const event of LIFECYCLE_EVENTS) {
-      const arms = findMatchingTransitions(trait, state.currentState, event);
-      if (arms.length === 0) continue;
-      const repaints = arms.every((t) => t.to === state.currentState && (t.effects ?? []).every((effect) => Array.isArray(effect) && effect[0] === "render-ui"));
-      return repaints ? event : void 0;
-    }
-    return void 0;
-  }
   /** Record the state the kernel reports. No-op for a trait not on the page. */
   seedState(traitName, currentState, entityId) {
     const trait = this.traits.get(traitName);
@@ -89,4 +53,4 @@ var StateBook = class {
   }
 };
 
-export { StateBook, createInitialTraitState, findInitialState, findMatchingTransitions, findTransition };
+export { StateBook, createInitialTraitState, findInitialState };

package/dist/chunk-BAS26HBN.js

@@ -0,0 +1,10 @@
+// src/runtime/entities/declaredCollections.ts
+function bindDeclaredCollections(store, entities) {
+  for (const entity of entities) {
+    if (entity.name && entity.collection && entity.browser !== true && entity.persistence !== "runtime") {
+      store.bindCollection?.(entity.name, entity.collection);
+    }
+  }
+}
+
+export { bindDeclaredCollections };

package/dist/{chunk-REPX5QPI.js → chunk-BOVU4TCQ.js}

@@ -1,4 +1,12 @@
 // src/kernel/os-port.ts
+function kernelOsTls(server) {
+  return {
+    complete: (key, outcome) => {
+      const step = JSON.parse(server().tlsComplete(key, JSON.stringify(outcome)));
+      return step;
+    }
+  };
+}
 function kernelOsCompletions(kernel) {
   const deferring = JSON.parse(kernel.osDeferringOps());
   const streaming = JSON.parse(kernel.osStreamOps());
@@ -13,7 +21,7 @@ function kernelOsCompletions(kernel) {
 }
 function kernelOsGrants(matchers, server) {
   return {
-    allows: (need) => server().osAllows(JSON.stringify(need)),
+    allows: (need, orbital) => server().osAllows(JSON.stringify(need), orbital),
     globMatches: (glob, path) => matchers.osGlobMatches(glob, path),
     isPublicAddress: (ip) => matchers.isPublicAddress(ip),
     anchor: (anchors) => {
@@ -50,8 +58,8 @@ function anchoredForms(anchors, path) {
 function anchoredGrants(grants, anchors) {
   return {
     ...grants,
-    allows: (need) => need.need === "fs" ? anchoredForms(anchors, need.path).some((path) => grants.allows({ ...need, path })) : grants.allows(need)
+    allows: (need, orbital) => need.need === "fs" ? anchoredForms(anchors, need.path).some((path) => grants.allows({ ...need, path }, orbital)) : grants.allows(need, orbital)
   };
 }
 
-export { anchoredGrants, expandAnchor, kernelOsCompletions, kernelOsGrants };
+export { anchoredGrants, expandAnchor, kernelOsCompletions, kernelOsGrants, kernelOsTls };

package/dist/chunk-BY5G4225.js

@@ -0,0 +1,6 @@
+// src/runtime/events/identity/routing.ts
+function eventRouteKey(eventName, eventId) {
+  return eventId ? `@evt:${eventId}` : eventName;
+}
+
+export { eventRouteKey };

package/dist/chunk-DFDNHVDW.js

@@ -0,0 +1,284 @@
+import { isJsonObject, credentialStorageKey, EntityRowSchema } from '@almadar/core';
+
+// src/credentials/vault.ts
+var CredentialExchangeError = class extends Error {
+  constructor(kind, message) {
+    super(message);
+    this.kind = kind;
+    this.name = "CredentialExchangeError";
+  }
+  kind;
+};
+var FAILURE_KINDS = ["unavailable", "unsigned", "denied", "invalid_grant", "invalid_client", "transport", "malformed", "refused"];
+function failureOf(value) {
+  if (value === void 0 || !isJsonObject(value)) throw new Error("the kernel connect failure is not an object");
+  const kind = FAILURE_KINDS.find((known) => known === value.kind);
+  if (kind === void 0) throw new Error("the kernel connect failure has an unknown kind");
+  return { kind, message: textOf(value.message, "failure message") };
+}
+function standingOf(value) {
+  if (value === void 0 || !isJsonObject(value) || typeof value.connected !== "boolean") throw new Error("the kernel credential standing is malformed");
+  return { connected: value.connected, ...typeof value.label === "string" ? { label: value.label } : {} };
+}
+function requestOf(value) {
+  if (value === void 0 || !isJsonObject(value) || !Array.isArray(value.headers)) throw new Error("the kernel token request is malformed");
+  const headers = value.headers.map((pair) => {
+    if (!Array.isArray(pair) || pair.length !== 2) throw new Error("the kernel token request header is malformed");
+    return [textOf(pair[0], "header name"), textOf(pair[1], "header value")];
+  });
+  return { request: { endpoint: textOf(value.endpoint, "token endpoint"), headers, body: textOf(value.body, "token body") }, ticket: numberOf(value.ticket, "exchange ticket") };
+}
+function parsed(json) {
+  return JSON.parse(json);
+}
+function objectOf(json, what) {
+  const value = parsed(json);
+  if (!isJsonObject(value)) throw new Error(`the kernel ${what} is not an object`);
+  return value;
+}
+function textOf(value, what) {
+  if (typeof value !== "string") throw new Error(`the kernel ${what} is not text`);
+  return value;
+}
+function numberOf(value, what) {
+  if (typeof value !== "number") throw new Error(`the kernel ${what} is not a number`);
+  return value;
+}
+function entryOf(value) {
+  if (!isJsonObject(value)) throw new Error("the kernel credential entry is not an object");
+  return {
+    service: textOf(value.service, "entry service"),
+    envVar: textOf(value.envVar, "entry name"),
+    last4: textOf(value.last4, "entry last4"),
+    updatedAt: numberOf(value.updatedAt, "entry updatedAt"),
+    ...value.principal !== void 0 ? { principal: textOf(value.principal, "entry principal") } : {}
+  };
+}
+function writeOf(item) {
+  if (!isJsonObject(item)) throw new Error("the kernel credential write is not an object");
+  const id = textOf(item.id, "write id");
+  if (item.write === "delete") return { write: "delete", id };
+  const data = EntityRowSchema.parse(item.data);
+  if (item.write === "update") return { write: "update", id, data };
+  if (item.write === "create") return { write: "create", id, data: { ...data, id } };
+  throw new Error("the kernel credential write is neither create, update nor delete");
+}
+var CredentialVault = class _CredentialVault {
+  constructor(kernel, rows) {
+    this.kernel = kernel;
+    this.rows = rows;
+  }
+  kernel;
+  rows;
+  listeners = /* @__PURE__ */ new Set();
+  queue = Promise.resolve();
+  broken = false;
+  /** List the host's rows into the kernel and read them; rejects naming the rows it cannot read. */
+  static async open(kernel, rows) {
+    const vault = new _CredentialVault(kernel, rows);
+    await vault.reload();
+    return vault;
+  }
+  /** True when a valid master key is present (writes and decryption enabled). */
+  get enabled() {
+    return this.kernel.enabled;
+  }
+  /** Subscribe to credential changes; returns an unsubscribe function. */
+  subscribe(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  notify(principal) {
+    for (const listener of this.listeners) listener(principal);
+  }
+  async reload() {
+    try {
+      this.kernel.load(JSON.stringify(await this.rows.list()));
+      this.broken = false;
+    } catch (error) {
+      this.broken = true;
+      throw error;
+    }
+  }
+  current() {
+    if (this.broken) throw new Error("the credential store could not be read or written; reload it");
+    return this.kernel;
+  }
+  async apply() {
+    const writes = parsed(this.kernel.takeWrites());
+    if (!Array.isArray(writes)) throw new Error("the kernel credential writes are not a list");
+    try {
+      for (const item of writes) {
+        const write = writeOf(item);
+        if (write.write === "create") await this.rows.create(write.data);
+        else if (write.write === "update") await this.rows.update(write.id, write.data);
+        else await this.rows.delete(write.id);
+      }
+    } catch (error) {
+      this.broken = true;
+      throw error;
+    }
+  }
+  /** One operation at a time: the kernel runs it, then its writes reach the medium before the next begins. */
+  serial(run) {
+    const next = this.queue.then(run);
+    this.queue = next.then(
+      () => void 0,
+      () => void 0
+    );
+    return next;
+  }
+  exclusive(fresh, work, principal) {
+    return this.serial(async () => {
+      if (fresh || this.broken) await this.reload();
+      let result;
+      try {
+        result = work();
+      } catch (error) {
+        if (this.kernel.takeWrites() !== "[]") this.broken = true;
+        throw error;
+      }
+      await this.apply();
+      this.notify(principal);
+      return result;
+    });
+  }
+  /** Resolve one credential by name (warmed values only). */
+  resolve(envVar, principal) {
+    return this.current().resolve(envVar, principal);
+  }
+  /** The non-secret account label stored in the clear beside a credential's ciphertext; undefined when its row carries none. */
+  label(envVar, principal) {
+    return this.current().label(envVar, principal);
+  }
+  /** All app-wide values as an env-shaped map, for merging over the process env. */
+  snapshotEnv() {
+    const env = {};
+    for (const [name, value] of Object.entries(objectOf(this.current().snapshotEnv(), "environment"))) env[name] = textOf(value, "environment value");
+    return env;
+  }
+  /** Masked entries for display — never includes plaintext. */
+  entries(principal) {
+    const entries = parsed(this.current().entries(principal));
+    if (!Array.isArray(entries)) throw new Error("the kernel credential entries are not a list");
+    return entries.map(entryOf);
+  }
+  /** Whether the store can encrypt and the service and name of every app-wide row. */
+  listing() {
+    const listing = objectOf(this.current().listing(), "listing");
+    const entries = listing.entries;
+    if (!Array.isArray(entries) || typeof listing.enabled !== "boolean") throw new Error("the kernel credential listing is malformed");
+    return {
+      enabled: listing.enabled,
+      entries: entries.map((entry) => {
+        if (!isJsonObject(entry)) throw new Error("the kernel credential listing holds a row that is not an object");
+        const row = { service: textOf(entry.service, "listing service"), name: textOf(entry.name, "listing name") };
+        return entry.last4 === void 0 ? row : { ...row, last4: textOf(entry.last4, "listing last4") };
+      })
+    };
+  }
+  /** Upsert one credential; `label` is a non-secret account name kept in the clear beside it, left out it stays as it is. */
+  async set(service, envVar, value, principal, label) {
+    return entryOf(parsed(await this.exclusive(false, () => this.kernel.set(service, envVar, value, principal, label), principal)));
+  }
+  /** Replace the value of a credential already stored, keeping its service (a rotated refresh token). */
+  async replace(envVar, value, principal) {
+    return entryOf(parsed(await this.exclusive(false, () => this.kernel.replace(envVar, value, principal), principal)));
+  }
+  /** Keep `value` as the credential until it is forgotten, creating it when absent. */
+  async persist(envVar, value, principal, label) {
+    return entryOf(parsed(await this.exclusive(false, () => this.kernel.persist(envVar, value, principal, label), principal)));
+  }
+  /** Delete one credential row; whether one existed. */
+  remove(envVar, principal) {
+    return this.exclusive(false, () => this.kernel.remove(envVar, principal), principal);
+  }
+  flights = /* @__PURE__ */ new Map();
+  turns = /* @__PURE__ */ new Map();
+  async post(post, begun) {
+    try {
+      return await post(begun.request);
+    } catch (error) {
+      this.kernel.connectAbandon(begun.ticket);
+      throw new CredentialExchangeError("transport", error instanceof Error ? error.message : "the token endpoint could not be reached");
+    }
+  }
+  async finish(ticket, reply) {
+    const settled = objectOf(await this.exclusive(false, () => this.kernel.connectFinish(ticket, reply.status, reply.body)), "connect outcome");
+    if (settled.error !== void 0) {
+      const failure = failureOf(settled.error);
+      throw new CredentialExchangeError(failure.kind, failure.message);
+    }
+    return standingOf(settled.ok);
+  }
+  /** Exchange `grant` at its token endpoint through `post` and keep the result as the credential: the kernel builds the request and settles the reply, the host only sends. */
+  async connect(grant, post) {
+    try {
+      const run = async () => {
+        const begun = objectOf(this.current().connectBegin(JSON.stringify(grant)), "connect request");
+        if (begun.error !== void 0) {
+          const failure = failureOf(begun.error);
+          throw new CredentialExchangeError(failure.kind, failure.message);
+        }
+        const request = requestOf(begun.ok);
+        return this.finish(request.ticket, await this.post(post, request));
+      };
+      if (grant.grant !== "refresh_token") return { ok: await run() };
+      const key = credentialStorageKey({ name: grant.name, ...grant.principal !== void 0 ? { principal: grant.principal } : {} });
+      const previous = this.turns.get(key);
+      const mine = (async () => {
+        await previous?.catch(() => void 0);
+        return run();
+      })();
+      this.turns.set(key, mine);
+      try {
+        return { ok: await mine };
+      } finally {
+        if (this.turns.get(key) === mine) this.turns.delete(key);
+      }
+    } catch (error) {
+      if (error instanceof CredentialExchangeError) return { error: { kind: error.kind, message: error.message } };
+      throw error;
+    }
+  }
+  /** The credential `envVar` for `principal`, refreshed first through `post` when it is past its expiry; concurrent resolves share one refresh. Undefined when nothing is held, nothing can renew it, or the provider refused (which drops the row). */
+  async resolveFresh(envVar, principal, post) {
+    const begun = objectOf(this.current().refreshBegin(envVar, principal), "refresh outcome");
+    if (begun.error !== void 0) {
+      const failure = failureOf(begun.error);
+      throw new CredentialExchangeError(failure.kind, failure.message);
+    }
+    const ok = begun.ok;
+    if (!isJsonObject(ok)) throw new Error("the kernel refresh outcome is malformed");
+    if (ok.exchange === void 0) return typeof ok.resolved === "string" ? ok.resolved : void 0;
+    const key = credentialStorageKey({ name: envVar, ...principal !== void 0 ? { principal } : {} });
+    const running = this.flights.get(key);
+    if (running !== void 0) {
+      this.current().connectAbandon(requestOf(ok.exchange).ticket);
+      return running;
+    }
+    const request = requestOf(ok.exchange);
+    const flight = (async () => {
+      try {
+        await this.finish(request.ticket, await this.post(post, request));
+      } catch (error) {
+        if (error instanceof CredentialExchangeError && error.kind === "invalid_grant") return void 0;
+        throw error;
+      }
+      return this.resolve(envVar, principal);
+    })();
+    this.flights.set(key, flight);
+    try {
+      return await flight;
+    } finally {
+      this.flights.delete(key);
+    }
+  }
+  /** Re-encrypt every row under the current master key; a row the kernel cannot read fails it before any row changes. */
+  async rotate() {
+    const counts = objectOf(await this.exclusive(true, () => this.kernel.rotate()), "rotation");
+    return { rotated: numberOf(counts.rotated, "rotated"), alreadyCurrent: numberOf(counts.alreadyCurrent, "alreadyCurrent"), unreadable: numberOf(counts.unreadable, "unreadable") };
+  }
+};
+
+export { CredentialExchangeError, CredentialVault };