@almadar/shell-runtime 0.1.0 → 1.1.0

package/dist/chunk-VKQA2DJX.js

@@ -0,0 +1,409 @@
+import { LaneHeldByParkedDispatch } from './chunk-NU6LVKGS.js';
+import { decodeAnswer, decodeHeldCompletion, decodeDueTicks, decodeResolveProgress, decodeProgress, decodeNext } from './chunk-XZGVOBY6.js';
+import { declareCapabilities, answerRequest } from './chunk-JVSREWQO.js';
+import { installKernelEvaluator, LiveBroadcastItemSchema, MountSeedSchema, ExternalInputSchema, NameListSchema, PayloadJsonSchemaSchema, PayloadIssueSchema, InboundOnlySchema, OptionalNameSchema, EntityRowSchema, isEntityReferenceAny, InboundAnswerSchema, EventPayloadSchema, InboundFoundSchema } from '@almadar/core';
+
+var PROGRAM_SURFACE = {
+  parse(input) {
+    return input;
+  }
+};
+function declaredEntityTypes(schema) {
+  return schema.orbitals.flatMap((orbital) => [orbital.entity, ...orbital.auxiliaryEntities ?? []].flatMap((entity) => isEntityReferenceAny(entity) ? [] : [entity.name]));
+}
+function contractAnswers(ask) {
+  return {
+    findExternalInput(orbital, trait, event) {
+      return ask(ExternalInputSchema.nullable(), { kind: "findExternalInput", orbital, trait, event }) ?? void 0;
+    },
+    findInbound(name) {
+      return ask(InboundFoundSchema, { kind: "findInbound", name });
+    },
+    inboundPayload(route, delivery, credential) {
+      const headers = Object.fromEntries(Object.entries(delivery.headers).flatMap(([name, value]) => value === void 0 ? [] : [[name, value]]));
+      return ask(EventPayloadSchema, { kind: "inboundPayload", route, headers, rawBody: delivery.rawBody, ...typeof credential === "string" ? { credential } : {} });
+    },
+    inboundAnswer(route, emitted, error) {
+      return ask(InboundAnswerSchema, { kind: "inboundAnswer", route, emitted, ...error !== void 0 ? { error } : {} });
+    },
+    credentialUnset(credential) {
+      return ask(InboundAnswerSchema, { kind: "credentialUnset", credential });
+    },
+    dispatchFailed(message) {
+      return ask(InboundAnswerSchema, { kind: "dispatchFailed", message });
+    }
+  };
+}
+var KernelEngine = class _KernelEngine {
+  constructor(kernel, schemaJson, ports, entityTypes = [], forkedFrom, providedHandle, preserveProgramContext = false, lazyDir) {
+    this.kernel = kernel;
+    this.schemaJson = schemaJson;
+    this.ports = ports;
+    this.entityTypes = entityTypes;
+    this.preserveProgramContext = preserveProgramContext;
+    this.lazyDir = lazyDir;
+    installKernelEvaluator(kernel);
+    this.ports = {
+      ...ports,
+      substrateMessage: (site, key, value) => JSON.parse(kernel.osCompletionEvent(JSON.stringify({ ...site, emit: { success: site.emit.onMessage } }), key, JSON.stringify({ ok: value }))),
+      substrateCompletion: (site, key, op, args, outcome) => JSON.parse(kernel.substrateCompletionEvent(JSON.stringify(site), key, op, JSON.stringify(args), JSON.stringify(outcome))),
+      ...ports.gpu !== void 0 ? {
+        heldGpu: {
+          answer: async (ticket, completed) => decodeAnswer(await this.handle.answerGpu(ticket, (json) => completed(decodeHeldCompletion(json)))),
+          drop: (heldPayload) => {
+            this.handle.dropHeldPayload(heldPayload);
+          }
+        }
+      } : {}
+    };
+    this.handle = providedHandle ?? forkedFrom?.fork() ?? this.openServer();
+    this.declare();
+  }
+  kernel;
+  schemaJson;
+  ports;
+  entityTypes;
+  preserveProgramContext;
+  lazyDir;
+  handle;
+  turns = /* @__PURE__ */ new Map();
+  tickRelayIntervalMs;
+  stateful = false;
+  /**
+   * A kernel on the same program, registered once, holding none of this one's session: every trait at its initial
+   * state, no rows the kernel held, its mounted ticks kept. A stateless host serves each request a
+   * fork (EXEC-DIST-5), `ports` answering it.
+   */
+  fork(ports = this.ports) {
+    return new _KernelEngine(this.kernel, this.schemaJson, ports, this.entityTypes, this.handle, void 0, this.preserveProgramContext, this.lazyDir);
+  }
+  forkProgram(program, ports = this.ports) {
+    const schemaJson = JSON.stringify(program);
+    const entityTypes = [.../* @__PURE__ */ new Set([
+      ...this.entityTypes,
+      ...declaredEntityTypes(program)
+    ])];
+    return new _KernelEngine(this.kernel, schemaJson, ports, entityTypes, void 0, this.handle.forkProgram(schemaJson), true);
+  }
+  /** A server over the host's ports. */
+  /** A server over the host's ports; the host's GPU answerer is installed in it, so it holds every `gpu/` ask. */
+  openServer() {
+    const server = new this.kernel.Server(this.schemaJson, this.lazyDir);
+    if (this.ports.gpu !== void 0) server.installGpu(this.ports.gpu);
+    return server;
+  }
+  declare() {
+    const handle = this.handle;
+    declareCapabilities(this.ports.persistence, (entityType, queryJson, writeJson) => handle.setCapabilities(entityType, queryJson, writeJson), this.entityTypes);
+  }
+  /** The contract answers for a host with no program registered yet: the kernel's, asked with no program. */
+  static withoutProgram(kernel) {
+    return contractAnswers((schema, query) => schema.parse(JSON.parse(kernel.contractQueryWithoutProgram(JSON.stringify(query)))));
+  }
+  static open(kernel, schema, ports, lazyDir) {
+    return new _KernelEngine(kernel, JSON.stringify(schema), ports, declaredEntityTypes(schema), void 0, void 0, false, lazyDir);
+  }
+  /** A fresh kernel on the same program: every trait back at its initial state. */
+  reset() {
+    const contextualHandle = this.preserveProgramContext ? this.handle.fork() : void 0;
+    this.handle.free();
+    this.handle = contextualHandle ?? this.openServer();
+    this.declare();
+    if (this.tickRelayIntervalMs !== void 0) this.handle.setTickRelayInterval(this.tickRelayIntervalMs);
+    if (this.stateful) this.handle.setStateful(true);
+    if (this.managedProgram !== void 0) this.handle.setManagedProgram(this.managedProgram);
+  }
+  managedProgram;
+  /** The program whose declared credentials this kernel's credential effects manage beside its own (a console's app). */
+  setManagedProgram(program) {
+    this.managedProgram = JSON.stringify(program);
+    this.handle.setManagedProgram(this.managedProgram);
+  }
+  /** `client` mounted `traits` of `orbital`: their mount-scoped ticks fire while any client holds them. A request derives this itself; this is for a mount made outside a request. */
+  mountClient(client, orbital, traits) {
+    this.handle.mountClient(client, orbital, JSON.stringify(traits));
+  }
+  unmountClient(client, orbital, traits) {
+    this.handle.unmountClient(client, orbital, JSON.stringify(traits));
+  }
+  /** `client` is gone: everything it mounted is released. */
+  releaseClient(client) {
+    this.handle.releaseClient(client);
+  }
+  /** This host holds the circuit state: the kernel takes a client's copy of it only on a delegated leg and refuses any other request carrying one. */
+  setStateful() {
+    this.stateful = true;
+    this.handle.setStateful(true);
+  }
+  /** Whether the program declares any tick: the host runs its timer only then. */
+  declaresTicks() {
+    return this.handle.declaresTicks();
+  }
+  /** Queue a tick-stamped dispatch for the coalesced peer relay; the ms after which to flush when it opened a window. */
+  relayTick(orbital, request) {
+    const window = JSON.parse(this.handle.relayTick(orbital, JSON.stringify(request)));
+    return window ?? void 0;
+  }
+  /** The relay window's length in ms; the kernel's default is 50. */
+  setTickRelayInterval(intervalMs) {
+    this.tickRelayIntervalMs = intervalMs;
+    this.handle.setTickRelayInterval(intervalMs);
+  }
+  /** Every item queued since the window opened, in first-arrival order; the window closes. */
+  flushTickRelay() {
+    return LiveBroadcastItemSchema.array().parse(JSON.parse(this.handle.flushTickRelay()));
+  }
+  /** One pass of the kernel's tick clock: the ticks due at monotonic `nowMs` that this server runs (`[background]` ticks, and those of a mounted trait), keyed by the orbital each `runTick` request is addressed to. */
+  tickPass(nowMs) {
+    return decodeDueTicks(this.handle.tickPass(nowMs));
+  }
+  /** Stop the kernel's tick clock; its phase is kept. */
+  tickPause() {
+    this.handle.tickPause();
+  }
+  /** Restart the kernel's tick clock; the paused span is never counted. */
+  tickResume() {
+    this.handle.tickResume();
+  }
+  tickPaused() {
+    return this.handle.tickPaused();
+  }
+  /** What this host mounts when it starts: the kernel's boot mounts for the side it serves (EXEC-ENDPOINT-3). */
+  bootMounts(side) {
+    return MountSeedSchema.array().parse(JSON.parse(this.handle.bootMounts(side)));
+  }
+  /** What mounts when a client opens `routePath` (EXEC-ENDPOINT-3). */
+  routeMounts(routePath) {
+    return MountSeedSchema.array().parse(JSON.parse(this.handle.routeMounts(routePath)));
+  }
+  dispose() {
+    this.handle.free();
+  }
+  answers = contractAnswers((schema, query) => this.contract(schema, query));
+  contract(schema, query) {
+    return schema.parse(JSON.parse(this.handle.contractQuery(JSON.stringify(query))));
+  }
+  /** Every external input the program declares: what an outside client may send which trait. */
+  externalInputs() {
+    return this.contract(ExternalInputSchema.array(), { kind: "externalInputs" });
+  }
+  /** What the kernel holds of every trait of the program, in name order, and the browser-stored entities. */
+  programSurface() {
+    return this.contract(PROGRAM_SURFACE, { kind: "programSurface" });
+  }
+  /** The entities a provider acting as the caller may read. */
+  readableEntities() {
+    return this.contract(NameListSchema, { kind: "readableEntities" });
+  }
+  /** The declared input of `trait.event` in `orbital`, when there is one. */
+  findExternalInput(orbital, trait, event) {
+    return this.answers.findExternalInput(orbital, trait, event);
+  }
+  /** The declared input a `listens`-addressed event names from `caller`'s position (`EVENT`, `Trait.EVENT`, `Orbital.Trait.EVENT`), when there is one. */
+  findInputByAddress(address, caller) {
+    return this.contract(ExternalInputSchema.nullable(), { kind: "findInputByAddress", address, caller }) ?? void 0;
+  }
+  /** A declared payload as the JSON Schema of one object: what a tool-calling model fills. */
+  payloadJsonSchema(fields) {
+    return this.contract(PayloadJsonSchemaSchema, { kind: "payloadSchemaToJsonSchema", fields });
+  }
+  /** The ways `value` misses the declared payload `fields`. */
+  payloadIssues(fields, value) {
+    return this.contract(PayloadIssueSchema.array(), { kind: "payloadIssues", fields, value });
+  }
+  /** The route a hook name is delivered to, or the answer to write for a hook the program does not serve. */
+  findInbound(name) {
+    return this.answers.findInbound(name);
+  }
+  /** The trait that handles `event` as an inbound hook in `orbital`, with the refusal message, when a client-facing request names it. */
+  inboundOnly(orbital, trait, event) {
+    return this.contract(InboundOnlySchema, { kind: "inboundOnly", orbital, ...trait !== void 0 ? { trait } : {}, event }) ?? void 0;
+  }
+  /** The payload an inbound event is delivered with. */
+  inboundPayload(route, delivery, credential) {
+    return this.answers.inboundPayload(route, delivery, credential);
+  }
+  /** The HTTP answer a finished dispatch produced for `route`. */
+  inboundAnswer(route, emitted, error) {
+    return this.answers.inboundAnswer(route, emitted, error);
+  }
+  /** The answer for a route whose credential the host holds no value for. */
+  credentialUnset(credential) {
+    return this.answers.credentialUnset(credential);
+  }
+  /** The answer for a delivery whose dispatch failed. */
+  dispatchFailed(message) {
+    return this.answers.dispatchFailed(message);
+  }
+  /** The name of the program's `[identity]` entity, when it declares one. */
+  identityEntity() {
+    return this.contract(OptionalNameSchema, { kind: "identityEntity" }) ?? void 0;
+  }
+  /** The orbital that declares `entity` inline. */
+  entityOwnerOrbital(entity) {
+    return this.contract(OptionalNameSchema, { kind: "entityOwner", entity }) ?? void 0;
+  }
+  /** `rows` of `entity` as `user` reads them: narrowed by the entity's declared `@read`, which the kernel evaluates with `@user` bound to the viewer. */
+  readRows(entity, rows, user) {
+    return this.contract(EntityRowSchema.array(), { kind: "readRows", entity, rows, viewer: user ?? null });
+  }
+  liveItemDelivered(item, clientId) {
+    return this.handle.liveItemDelivered(JSON.stringify(item), clientId);
+  }
+  /** `OsGrants::allows` over the grants of `orbital` in the program this kernel runs (the app level alone with no orbital). */
+  osAllows(requirementJson, orbital) {
+    return this.handle.osAllows(requirementJson, orbital);
+  }
+  /** Whether `url`'s origin is declared in the program's `egress` (the kernel's rule). */
+  egressAllows(url) {
+    return this.handle.egressAllows(url);
+  }
+  /** Place the program's anchored grants and arguments under the host's anchors. */
+  setOsAnchors(anchorsJson) {
+    return this.handle.setOsAnchors(anchorsJson);
+  }
+  /** An `os/` call's arguments with its anchored parts resolved under the host's anchors. */
+  osResolveArgs(op, argsJson) {
+    return this.handle.osResolveArgs(op, argsJson);
+  }
+  tlsComplete(key, outcomeJson) {
+    return this.handle.tlsComplete(key, outcomeJson);
+  }
+  /** A live stream of `client`'s session opened (EXEC-DIST-9); the id closes it. */
+  openSessionStream(client) {
+    return this.handle.openSessionStream(client);
+  }
+  /** The live stream `id` dropped: the kernel frees the session once its streams have all dropped and it is quiet. */
+  closeSessionStream(id) {
+    return this.handle.closeSessionStream(id);
+  }
+  /** The current state of a trait instance, `''` when it has none. */
+  stateOf(traitName, entityId) {
+    return this.handle.getState(traitName, entityId);
+  }
+  /**
+   * `reference` resolved for the identity `scope.originClientId`'s session bound (the anonymous viewer with none) against the host-answered store (EXEC-RENDER-3): the rows that still
+   * match its query and that identity's `@read` in the reference's order, a missing or hidden row omitted, and `total`
+   * re-counted (a `total: none` reference is not re-counted: the total is the resolved window). Each read the
+   * kernel makes is answered here, as in `evaluate`.
+   */
+  async resolveRows(reference, scope) {
+    const handle = this.handle;
+    let progress = decodeResolveProgress(handle.resolveRows(JSON.stringify(reference), scope.originClientId));
+    while (progress.status === "await") {
+      const { flight, requests } = progress;
+      let replies;
+      try {
+        replies = await Promise.all(
+          requests.map(async (pending) => ({ id: pending.id, answer: await answerRequest(this.ports, pending.request, scope) }))
+        );
+      } catch (error) {
+        handle.abandon(flight);
+        throw error;
+      }
+      progress = decodeResolveProgress(handle.resumeResolve(flight, JSON.stringify(replies)));
+    }
+    return { rows: progress.rows, total: progress.total };
+  }
+  /**
+   * Run `request` against `orbital`. The kernel orders every start and every resumption (EXEC-CONC-2): while another
+   * dispatch holds the lane it answers `queued` and runs the work itself once the lane frees; this host only answers
+   * what each dispatch asks.
+   */
+  async evaluate(orbital, request, scope) {
+    const handle = this.handle;
+    const streams = scope.onStream !== void 0;
+    let running = await this.ran(handle.start(orbital, JSON.stringify(request)), streams);
+    try {
+      while (running.progress.status === "await") {
+        const { flight, requests } = running.progress;
+        const assertReentry = () => {
+          if (handle.holdsLane(flight)) throw new LaneHeldByParkedDispatch(flight, request.event);
+        };
+        let replies;
+        try {
+          replies = await Promise.all(
+            requests.map(async (pending) => ({ id: pending.id, answer: await answerRequest(this.ports, pending.request, { ...scope, assertReentry }) }))
+          );
+        } catch (error) {
+          handle.abandon(flight);
+          throw error;
+        }
+        running = await this.ran(handle.resume(flight, JSON.stringify(replies)), streams);
+      }
+    } finally {
+      this.runQueued();
+    }
+    if (scope.onStream !== void 0 && running.stream !== void 0) {
+      const items = JSON.parse(running.stream);
+      for (const item of items) scope.onStream(item);
+      scope.onStream({ type: "complete", data: running.progress.response, timestamp: Date.now() });
+    }
+    return running.progress.response;
+  }
+  /** The kernel's answer to a start or resume, once it has run: at once, or when the kernel takes it from its queue. */
+  ran(json, streams) {
+    const progress = decodeProgress(json);
+    if (progress.status !== "queued") return this.running(progress, streams);
+    const turn = new Promise((ran, failed) => {
+      this.turns.set(progress.ticket, { streams, ran, failed });
+    });
+    queueMicrotask(() => this.runQueued());
+    return turn;
+  }
+  running(progress, streams) {
+    return { progress, stream: streams && progress.status === "done" ? this.handle.dispatchStream() : void 0 };
+  }
+  /** Run each piece of queued work that can run now, in the kernel's order, handing each to the dispatch it continues. */
+  runQueued() {
+    for (; ; ) {
+      const next = decodeNext(this.handle.next());
+      if (next === null) return;
+      const turn = this.turns.get(next.ticket);
+      if (turn === void 0) throw new Error(`kernel wire: the kernel ran ticket ${next.ticket}, which nothing waits on`);
+      this.turns.delete(next.ticket);
+      if (next.outcome === "failed") {
+        turn.failed(new Error(next.error));
+        continue;
+      }
+      if (next.progress.status === "queued") throw new Error("kernel wire: the kernel queued work it was running");
+      turn.ran(this.running(next.progress, turn.streams));
+    }
+  }
+};
+function kernelRequest(request, locale) {
+  const { _activeTraits: _dropped, _targetTrait: sidecarTarget, ...rest } = request.payload ?? {};
+  const payload = rest;
+  const target = request.targetTrait ?? (typeof sidecarTarget === "string" ? sidecarTarget : void 0);
+  const { payload: _payload, user: _hostViewer, ...others } = request;
+  return {
+    ...others,
+    ...request.payload !== void 0 ? { payload } : {},
+    ...target !== void 0 ? { targetTrait: target } : {},
+    ...locale !== void 0 ? { locale } : {}
+  };
+}
+function withOriginClient(response, clientId) {
+  if (clientId === void 0) return response;
+  return {
+    ...response,
+    emittedEvents: response.emittedEvents.map((emitted) => emitted.source === void 0 ? emitted : { ...emitted, source: { ...emitted.source, originClientId: emitted.source.originClientId ?? clientId } })
+  };
+}
+async function evaluateOnKernel(kernel, request, locale) {
+  return withOriginClient(await kernel.engine.evaluate(kernel.orbital, kernelRequest(request, locale), {
+    orbital: kernel.orbital,
+    ...request.clientId !== void 0 ? { originClientId: request.clientId } : {},
+    ...locale !== void 0 ? { locale } : {},
+    ...request.entityId !== void 0 ? { entityId: request.entityId } : {},
+    ...kernel.onStream !== void 0 ? { onStream: (item) => {
+      if (item.type === "event" && item.data.source !== void 0 && request.clientId !== void 0) {
+        kernel.onStream?.({ ...item, data: { ...item.data, source: { ...item.data.source, originClientId: item.data.source.originClientId ?? request.clientId } } });
+      } else if (item.type === "complete") {
+        kernel.onStream?.({ ...item, data: withOriginClient(item.data, request.clientId) });
+      } else kernel.onStream?.(item);
+    } } : {}
+  }), request.clientId);
+}
+
+export { KernelEngine, evaluateOnKernel, kernelRequest };

package/dist/chunk-VNGXRYFF.js

@@ -0,0 +1,9 @@
+// src/credentials/env-vars.ts
+var CREDENTIAL_MASTER_KEY_ENV = "ALMADAR_CREDENTIAL_MASTER_KEY";
+var CREDENTIAL_PREVIOUS_MASTER_KEY_ENV = "ALMADAR_CREDENTIAL_MASTER_KEY_PREVIOUS";
+var STORE_BOOTSTRAP_ENV_VARS = /* @__PURE__ */ new Set([CREDENTIAL_MASTER_KEY_ENV, CREDENTIAL_PREVIOUS_MASTER_KEY_ENV]);
+function allCredentialEnvVars() {
+  return new Set(STORE_BOOTSTRAP_ENV_VARS);
+}
+
+export { CREDENTIAL_MASTER_KEY_ENV, CREDENTIAL_PREVIOUS_MASTER_KEY_ENV, STORE_BOOTSTRAP_ENV_VARS, allCredentialEnvVars };

package/dist/{chunk-HNOAZWFH.js → chunk-WGCWJOT2.js}

@@ -9,6 +9,8 @@ var PROGRAM_EFFECTS = [
   "program/print",
   "program/eval",
   "program/validate",
+  "program/prove",
+  "program/os-grants",
   "program/compose",
   "program/step"
 ];

package/dist/chunk-XZGVOBY6.js

@@ -0,0 +1,33 @@
+import { decodeServerProgressWire, decodeIoAnswerWire, decodeHeldGpuCompletion, decodeNextWire, decodeResolveProgressWire, decodeFiredTick } from '@almadar/core/kernel-wire';
+export { decodeIoRequestWire } from '@almadar/core/kernel-wire';
+
+// src/kernel/decode.ts
+function decodeProgress(json) {
+  return decodeServerProgressWire(JSON.parse(json));
+}
+function decodeAnswer(json) {
+  return decodeIoAnswerWire(JSON.parse(json));
+}
+function decodeHeldCompletion(json) {
+  const value = JSON.parse(json);
+  return value === null ? null : decodeHeldGpuCompletion(value);
+}
+function decodeNext(json) {
+  const value = JSON.parse(json);
+  return value === null ? null : decodeNextWire(value);
+}
+function decodeResolveProgress(json) {
+  return decodeResolveProgressWire(JSON.parse(json));
+}
+function decodeDueTicks(json) {
+  const value = JSON.parse(json);
+  if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error("tickPass: the kernel answered a non-object");
+  const byOrbital = {};
+  for (const [orbital, ticks] of Object.entries(value)) {
+    if (!Array.isArray(ticks)) throw new Error(`tickPass: the kernel answered a non-list for orbital ${orbital}`);
+    byOrbital[orbital] = ticks.map(decodeFiredTick);
+  }
+  return byOrbital;
+}
+
+export { decodeAnswer, decodeDueTicks, decodeHeldCompletion, decodeNext, decodeProgress, decodeResolveProgress };

package/dist/chunk-ZUSM4VW4.js

@@ -0,0 +1,197 @@
+import { resolveCredentialRef, getEffectiveCredentialStore, getModeControl } from './chunk-HLOUDLPI.js';
+import { credentialStorageKey, resolveCredentialStatusIdentity, credentialStatusConnected } from '@almadar/core';
+
+function userCredentialKey(principal, name) {
+  return credentialStorageKey({ name, principal });
+}
+function envTailsOf(env) {
+  return (names) => {
+    const tails = [];
+    for (const name of names) {
+      const value = env[name];
+      if (value === void 0 || value === "") continue;
+      const chars = Array.from(value);
+      tails.push(chars.length >= 8 ? { name, last4: chars.slice(-4).join("") } : { name });
+    }
+    return tails;
+  };
+}
+var installedSecretsHost = {
+  async store() {
+    return getEffectiveCredentialStore();
+  },
+  async resolve(name, principal) {
+    return resolveCredentialRef(name, void 0, principal);
+  }
+};
+function createSecretStore(now = Date.now, host = installedSecretsHost, tokenPost) {
+  const environmentMinted = /* @__PURE__ */ new Map();
+  const storeMinted = /* @__PURE__ */ new WeakMap();
+  const cacheFor = (store) => {
+    if (store === null) return environmentMinted;
+    const held = storeMinted.get(store);
+    if (held !== void 0) return held;
+    const cache = /* @__PURE__ */ new Map();
+    storeMinted.set(store, cache);
+    return cache;
+  };
+  const slot = (name, principal) => credentialStorageKey({ name, ...principal !== void 0 ? { principal } : {} });
+  return {
+    async get(name, principal) {
+      const store = await host.store();
+      const minted = cacheFor(store);
+      const key = slot(name, principal);
+      const held = minted.get(key);
+      if (held !== void 0) {
+        if (held.expiresAt > now()) return held.value;
+        minted.delete(key);
+      }
+      if (store !== null && store.enabled && tokenPost !== void 0) {
+        const fresh = await store.resolveFresh(name, principal, tokenPost);
+        if (fresh !== void 0) return fresh;
+      }
+      return host.resolve(name, principal);
+    },
+    async set(name, value, ttlMs, principal) {
+      const minted = cacheFor(await host.store());
+      const key = slot(name, principal);
+      if (ttlMs <= 0) minted.delete(key);
+      else minted.set(key, { value, expiresAt: now() + ttlMs });
+    },
+    async rotate(name, value, principal) {
+      const store = await host.store();
+      if (store === null) throw new Error("this host keeps no credential store to rotate into");
+      cacheFor(store).delete(slot(name, principal));
+      await store.replace(name, value, principal);
+    },
+    async persist(name, value, principal, label) {
+      const store = await host.store();
+      if (store === null || !store.enabled) throw new Error("this host keeps no credential store to persist into");
+      cacheFor(store).delete(slot(name, principal));
+      await store.persist(name, value, principal, label);
+    },
+    async label(name, principal) {
+      return (await host.store())?.label(name, principal);
+    },
+    async durable() {
+      const store = await host.store();
+      return store !== null && store.enabled;
+    },
+    async forget(name, principal) {
+      const store = await host.store();
+      const minted = cacheFor(store);
+      const key = slot(name, principal);
+      minted.delete(key);
+      await store?.remove(name, principal);
+    }
+  };
+}
+function createCredentialConnectPort(post) {
+  return async (grant) => {
+    const store = getEffectiveCredentialStore();
+    if (store === null || !store.enabled) return { error: { kind: "unavailable", message: "this host holds no credential store that can connect" } };
+    return store.connect(grant, post);
+  };
+}
+function createCredentialAdminPort() {
+  const installed = () => {
+    const store = getEffectiveCredentialStore();
+    if (store === null) throw new Error("this host keeps no credential store");
+    return store;
+  };
+  return {
+    async list() {
+      return getEffectiveCredentialStore()?.listing() ?? null;
+    },
+    async read(name) {
+      return getEffectiveCredentialStore()?.resolve(name) ?? null;
+    },
+    async write(service, name, value) {
+      await installed().set(service, name, value);
+    },
+    async remove(name) {
+      return installed().remove(name);
+    },
+    async rotate() {
+      return installed().rotate();
+    },
+    async mode() {
+      return getModeControl()?.mode ?? null;
+    },
+    async setMode(mode) {
+      const control = getModeControl();
+      if (control === null) throw new Error("No integration manager is installed on this host");
+      if (mode !== "mock" && mode !== "real") throw new Error(`mode must be "mock" or "real", got "${mode}"`);
+      control.setMode(mode);
+      return control.mode;
+    }
+  };
+}
+var systemRandom = (bytes) => crypto.getRandomValues(new Uint8Array(bytes));
+var RANDOM_BYTES_MAX = 1024;
+function binary(bytes) {
+  let text = "";
+  for (const byte of bytes) text += String.fromCharCode(byte);
+  return text;
+}
+function base64Standard(bytes) {
+  return btoa(binary(bytes));
+}
+function base64Url(bytes) {
+  return base64Standard(bytes).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+function randomBytesPayload(ports, bytes, key) {
+  if (key !== void 0 && (typeof key !== "string" || key === "")) {
+    throw new Error(`call key must evaluate to a non-empty string, got ${String(key)}`);
+  }
+  if (typeof bytes !== "number" || !Number.isInteger(bytes) || bytes < 1 || bytes > RANDOM_BYTES_MAX) {
+    throw new Error(`random-bytes: the byte count must be an integer from 1 to ${RANDOM_BYTES_MAX}, got ${String(bytes)}`);
+  }
+  const value = base64Url(ports.random(bytes));
+  return key === void 0 ? { value } : { value, key };
+}
+function signedIn(head, principal) {
+  if (principal === void 0) throw new Error(`${head}: nobody is signed in`);
+  return principal;
+}
+function credentialName(head, credential) {
+  if (typeof credential !== "string") throw new Error(`${head}: the credential must be a secret knob's name`);
+  return credential;
+}
+async function credentialStatusPayload(ports, credential, principal) {
+  const identity = resolveCredentialStatusIdentity(credential, principal);
+  const connected = credentialStatusConnected(await ports.secrets.get(identity.name, identity.principal), identity.principal);
+  const label = connected ? await ports.secrets.label?.(identity.name, identity.principal) ?? "" : "";
+  return { connected, label };
+}
+async function credentialForgetPayload(ports, credential, principal) {
+  const who = signedIn("credential-forget", principal);
+  const name = credentialName("credential-forget", credential);
+  await ports.secrets.forget(name, who);
+  return { connected: false, label: "" };
+}
+function createSecretPorts(options = {}) {
+  return {
+    random: options.random ?? systemRandom,
+    secrets: options.secrets ?? createSecretStore(Date.now, installedSecretsHost, options.tokenPost),
+    credentials: options.credentials ?? createCredentialAdminPort(),
+    env: options.env ?? ((names) => envTailsOf(process.env)(names)),
+    ...options.tokenPost !== void 0 ? { connect: createCredentialConnectPort(options.tokenPost) } : {}
+  };
+}
+var browserSecrets = {
+  async get(name) {
+    throw new Error(`credential ${name} is not available in a browser`);
+  },
+  async set(name) {
+    throw new Error(`credential ${name} cannot be stored in a browser`);
+  },
+  async forget(name) {
+    throw new Error(`credential ${name} cannot be forgotten in a browser`);
+  }
+};
+function createBrowserSecretPorts() {
+  return { random: systemRandom, secrets: browserSecrets };
+}
+
+export { RANDOM_BYTES_MAX, base64Standard, base64Url, createBrowserSecretPorts, createCredentialAdminPort, createCredentialConnectPort, createSecretPorts, createSecretStore, credentialForgetPayload, credentialStatusPayload, envTailsOf, randomBytesPayload, systemRandom, userCredentialKey };