@almadar/shell-runtime 0.1.0 → 1.1.0

package/dist/credentials/vault.d.ts

@@ -0,0 +1,142 @@
+import { EntityRow } from '@almadar/core';
+import { CredentialGrantWire, CredentialStanding, ConnectFailure, ConnectFailureKind } from '@almadar/core/kernel-wire';
+
+/**
+ * The credential rows a host keeps over its medium (`chrome.storage`, files, Firestore). It answers four raw asks and
+ * decides nothing: encryption, row shape, identity and every failure rule are the kernel's (`CredentialVault`, wasm).
+ * `create` carries the id the kernel gave the row; `update` merges `data` over the row; `delete` answers whether this call
+ * removed the row, and must do so atomically against other takers of the same medium: it is the conditional delete a
+ * one-use value is taken with.
+ */
+interface CredentialRowsPort {
+    list(): Promise<EntityRow[]>;
+    create(row: EntityRow & {
+        id: string;
+    }): Promise<void>;
+    update(id: string, data: EntityRow): Promise<void>;
+    delete(id: string): Promise<boolean>;
+}
+/** The slice of the wasm `CredentialVault` class (`@almadar/kernel`) this handle uses; each result is JSON text. */
+interface CredentialVaultKernel {
+    readonly enabled: boolean;
+    load(rowsJson: string): number;
+    resolve(name: string, principal?: string): string | undefined;
+    label(name: string, principal?: string): string | undefined;
+    snapshotEnv(): string;
+    entries(principal?: string): string;
+    listing(): string;
+    set(service: string, name: string, value: string, principal?: string, label?: string): string;
+    replace(name: string, value: string, principal?: string): string;
+    persist(name: string, value: string, principal?: string, label?: string): string;
+    remove(name: string, principal?: string): boolean;
+    rotate(): string;
+    takeWrites(): string;
+    connectBegin(grantJson: string): string;
+    refreshBegin(name: string, principal?: string): string;
+    connectFinish(ticket: number, status: number, body: string): string;
+    connectAbandon(ticket: number): boolean;
+}
+/** What the kernel asks a host to POST to a token endpoint. The host decides nothing about it. */
+interface TokenRequest {
+    endpoint: string;
+    headers: Array<[string, string]>;
+    body: string;
+}
+interface TokenReply {
+    status: number;
+    body: string;
+}
+/** The host's one network capability the credential exchange needs: a form POST to an https token endpoint, no redirects followed. */
+type TokenEndpointPost = (request: TokenRequest) => Promise<TokenReply>;
+/** A token exchange the kernel's store refused or the host could not carry; `kind` is the kernel's `ConnectFailureKind`. */
+declare class CredentialExchangeError extends Error {
+    readonly kind: ConnectFailureKind;
+    constructor(kind: ConnectFailureKind, message: string);
+}
+/** A kernel module that carries the vault class: `import * as kernel from '@almadar/kernel/client'`. */
+interface CredentialVaultModule {
+    CredentialVault: new (masterKey?: string, previousKey?: string) => CredentialVaultKernel;
+}
+/** Masked view of one stored credential, safe to return to a settings page. */
+interface CredentialEntry {
+    service: string;
+    envVar: string;
+    last4: string;
+    updatedAt: number;
+    principal?: string;
+}
+interface CredentialRotation {
+    rotated: number;
+    alreadyCurrent: number;
+    unreadable: number;
+}
+interface CredentialListing {
+    enabled: boolean;
+    entries: Array<{
+        service: string;
+        name: string;
+        last4?: string;
+    }>;
+}
+/**
+ * The host's handle on the kernel's encrypted credential store. The kernel keeps the rows the host last listed, runs every
+ * operation (set, remove, rotate, resolution, masking) and records what changed; this handle lists the rows into
+ * it and applies the recorded writes to the host's medium, one operation at a time. A row the kernel cannot read fails
+ * `open` and every operation after it: nothing here reads a broken store as an empty one.
+ */
+declare class CredentialVault {
+    private readonly kernel;
+    private readonly rows;
+    private readonly listeners;
+    private queue;
+    private broken;
+    private constructor();
+    /** List the host's rows into the kernel and read them; rejects naming the rows it cannot read. */
+    static open(kernel: CredentialVaultKernel, rows: CredentialRowsPort): Promise<CredentialVault>;
+    /** True when a valid master key is present (writes and decryption enabled). */
+    get enabled(): boolean;
+    /** Subscribe to credential changes; returns an unsubscribe function. */
+    subscribe(listener: (principal?: string) => void): () => void;
+    private notify;
+    private reload;
+    private current;
+    private apply;
+    /** One operation at a time: the kernel runs it, then its writes reach the medium before the next begins. */
+    private serial;
+    private exclusive;
+    /** Resolve one credential by name (warmed values only). */
+    resolve(envVar: string, principal?: string): string | undefined;
+    /** The non-secret account label stored in the clear beside a credential's ciphertext; undefined when its row carries none. */
+    label(envVar: string, principal?: string): string | undefined;
+    /** All app-wide values as an env-shaped map, for merging over the process env. */
+    snapshotEnv(): Record<string, string>;
+    /** Masked entries for display — never includes plaintext. */
+    entries(principal?: string): CredentialEntry[];
+    /** Whether the store can encrypt and the service and name of every app-wide row. */
+    listing(): CredentialListing;
+    /** Upsert one credential; `label` is a non-secret account name kept in the clear beside it, left out it stays as it is. */
+    set(service: string, envVar: string, value: string, principal?: string, label?: string): Promise<CredentialEntry>;
+    /** Replace the value of a credential already stored, keeping its service (a rotated refresh token). */
+    replace(envVar: string, value: string, principal?: string): Promise<CredentialEntry>;
+    /** Keep `value` as the credential until it is forgotten, creating it when absent. */
+    persist(envVar: string, value: string, principal?: string, label?: string): Promise<CredentialEntry>;
+    /** Delete one credential row; whether one existed. */
+    remove(envVar: string, principal?: string): Promise<boolean>;
+    private readonly flights;
+    private readonly turns;
+    private post;
+    private finish;
+    /** Exchange `grant` at its token endpoint through `post` and keep the result as the credential: the kernel builds the request and settles the reply, the host only sends. */
+    connect(grant: CredentialGrantWire, post: TokenEndpointPost): Promise<{
+        ok: CredentialStanding;
+    } | {
+        error: ConnectFailure;
+    }>;
+    /** The credential `envVar` for `principal`, refreshed first through `post` when it is past its expiry; concurrent resolves share one refresh. Undefined when nothing is held, nothing can renew it, or the provider refused (which drops the row). */
+    resolveFresh(envVar: string, principal: string | undefined, post: TokenEndpointPost): Promise<string | undefined>;
+    /** Re-encrypt every row under the current master key; a row the kernel cannot read fails it before any row changes. */
+    rotate(): Promise<CredentialRotation>;
+}
+
+export { CredentialExchangeError, CredentialVault };
+export type { CredentialEntry, CredentialListing, CredentialRotation, CredentialRowsPort, CredentialVaultKernel, CredentialVaultModule, TokenEndpointPost, TokenReply, TokenRequest };

package/dist/credentials/vault.js

@@ -0,0 +1 @@
+export { CredentialExchangeError, CredentialVault } from '../chunk-DFDNHVDW.js';

package/dist/effects/in-flight-calls.js

@@ -1,2 +1 @@
 export { InFlightCalls, untilAborted } from '../chunk-MZKIL5IN.js';
-import '../chunk-MLKGABMK.js';

package/dist/effects/on-device-model.js

@@ -1,2 +1 @@
 export { NO_ON_DEVICE_EMBEDDER, NO_ON_DEVICE_MODEL, OnDeviceModelFailure, embedOnDevice, promptOnDevice } from '../chunk-FWA5K7Q2.js';
-import '../chunk-MLKGABMK.js';

package/dist/events/EventBus.d.ts

@@ -3,10 +3,7 @@ import { EventPayload } from '@almadar/core';
 import '../service/default-call-service.js';
 import '../service/service-provider.js';
 import '../kernel/program-effects.js';
-import '../runtime/effects/composition/compose-behaviors.js';
-import '../runtime/effects/composition/event-wiring.js';
-import '../runtime/effects/composition/layout-strategy.js';
-import '../runtime/effects/composition/pipe.js';
+import '@almadar/core/kernel-wire';
 
 /**
  * EventBus - Platform-Agnostic Pub/Sub Implementation

package/dist/events/EventBus.js

@@ -1,2 +1 @@
 export { EventBus, createEventBus } from '../chunk-SOQDEPME.js';
-import '../chunk-MLKGABMK.js';

package/dist/events/emit-stamp.js

@@ -1,2 +1 @@
 export { stampEmitSource } from '../chunk-64IH2SMY.js';
-import '../chunk-MLKGABMK.js';

package/dist/index.d.ts

@@ -1,60 +1,43 @@
-export { AccessTokenProvider, COMPRESSED_BODY_MIN_BYTES, EventTransport, EventTransportRegisterResult, HostDispatchListener, HttpTransportOptions, InProcessTransportOptions, OrbitalEvaluator, PushTarget, createHttpTransport, createInProcessTransport, deriveCarriesCircuitState, encodeJsonBody } from './client/EventTransport.js';
-export { ServerBridge, ServerBridgeConfig, ServerBridgeState, createServerBridge } from './client/ServerBridge.js';
+export { AccessTokenProvider, COMPRESSED_BODY_MIN_BYTES, EventTransport, EventTransportRegisterResult, HostDispatchListener, HttpTransportOptions, InProcessTransportOptions, OrbitalEvaluator, PushTarget, SessionEndedError, TransportStatusError, createHttpTransport, createInProcessTransport, deriveCarriesCircuitState, encodeJsonBody } from './client/EventTransport.js';
 export { AwaitingRegistry } from './client/awaiting.js';
 export { ChannelMessage, ChannelTransportOptions, ServedChannel, TransportChannel, createChannelTransport, holdUntilServed, serveChannel } from './client/channel-transport.js';
-export { CircuitStore, TraitSnapshot, createMemoryCircuitStore } from './client/circuit-store.js';
-export { ClientDispatchHooks, ClientKernel, ClientKernelOutcome, ClientMountHooks, ClientMountOutcome, LocalFoldKernel } from './client/client-kernel.js';
+export { CircuitStore, FrameOutcome, TraitSnapshot, createMemoryCircuitStore } from './client/circuit-store.js';
+export { ClientDispatchHooks, ClientEmitOutcome, ClientKernel, ClientKernelOutcome, ClientMountHooks, ClientMountOutcome, LocalFoldKernel } from './client/client-kernel.js';
 export { dispatchDeclaredInput } from './client/declared-input-dispatch.js';
-export { dispatchInbound } from './client/inbound-dispatch.js';
-export { LocalFoldOptions, createLocalFold, mirrorResponse, traceResponse } from './client/local-fold.js';
+export { InboundContract, dispatchInbound } from './client/inbound-dispatch.js';
+export { FramesSince, LocalFoldOptions, createLocalFold, paintFrames, paintResponse, paintStates, traceResponse } from './client/local-fold.js';
 export { DEFAULT_THEME_KEY, appNavItems, inlineNavItems, sigilThemeKey } from './client/render-sigils.js';
-export { StateBook, createInitialTraitState, findInitialState, findMatchingTransitions, findTransition } from './client/state-book.js';
+export { StateBook, createInitialTraitState, findInitialState } from './client/state-book.js';
 export { TraitMountError } from './client/trait-mount-error.js';
 export { RollbackCause, TraitState, TransitionObserver } from './client/trait-types.js';
-export { STORE_BOOTSTRAP_ENV_VARS, allCredentialEnvVars } from './credentials/env-vars.js';
+export { CREDENTIAL_MASTER_KEY_ENV, CREDENTIAL_PREVIOUS_MASTER_KEY_ENV, STORE_BOOTSTRAP_ENV_VARS, allCredentialEnvVars } from './credentials/env-vars.js';
 export { CREDENTIALS_SOURCE_ENV, CredentialMode, CredentialModeControl, CredentialScopeStorage, credentialModeFromEnv, credentialsFromStoreOnly, getEffectiveCredentialStore, getInstalledCredentialStore, getModeControl, installCredentialScopeStorage, installCredentialStore, installModeControl, resolveCredentialRef, runWithCredentialScope, uninstallCredentialStore } from './credentials/scope.js';
-export { CredentialSeedKernel, DeclaredCredential, seedCredentialStore } from './credentials/seed.js';
-export { CREDENTIAL_ENTITY_TYPE, CREDENTIAL_MASTER_KEY_ENV, CREDENTIAL_PREVIOUS_MASTER_KEY_ENV, CredentialEntry, CredentialPersistence, CredentialStore, DERIVED_ENTITY_TYPE, DerivedPersistence } from './credentials/store.js';
+export { CredentialEntry, CredentialExchangeError, CredentialListing, CredentialRotation, CredentialRowsPort, CredentialVault, CredentialVaultKernel, CredentialVaultModule, TokenEndpointPost, TokenReply, TokenRequest } from './credentials/vault.js';
 export { InFlightCalls, KeyedCallLease, KeyedCallOutcome, untilAborted } from './effects/in-flight-calls.js';
 export { NO_ON_DEVICE_EMBEDDER, NO_ON_DEVICE_MODEL, OnDeviceModelFailure, embedOnDevice, promptOnDevice } from './effects/on-device-model.js';
 export { EventBus, createEventBus } from './events/EventBus.js';
 export { StampEmitIdentity, stampEmitSource } from './events/emit-stamp.js';
-export { BeaconDelivery, BeaconDeliveryPorts, BeaconFetchInit, deliverBeacon } from './kernel/beacon.js';
-export { decodeHttpBody, decodeHttpRequest, decodeHttpResponse, decodeOAuthAsk, decodeProgress, decodeRequest, decodeResolveProgress } from './kernel/decode.js';
-export { KernelEngine, KernelEvaluation, evaluateOnKernel, kernelRequest } from './kernel/engine.js';
-export { FrameApplied, FrameDispatch, FramePostPort, TickEffects, applyFrame, decodeFrame, isFrameWire } from './kernel/frame-applier.js';
-export { DeferredCallOutcome, KernelAnswerScope, KernelCallService, KernelHostPorts, SubstrateStreamSource, answerRequest, declareCapabilities, writeRows } from './kernel/host.js';
-export { BeaconSettled, BrowserHttpPortsOptions, CredentialAdminPort, Exchange, HttpEffectFailure, HttpKernel, HttpOutcome, HttpPorts, HttpPortsOptions, HttpRunOptions, HttpSecrets, HttpSecretsHost, HttpUnavailableError, NetPort, OAuthAuthorizeKernel, OAuthPort, PinnedFetch, PinnedInit, PinnedResponse, RANDOM_BYTES_MAX, RandomSource, ResolvedHost, StreamFrame, StreamFramingWire, base64Standard, base64Url, checkOAuthReply, createBrowserHttpPorts, createCredentialAdminPort, createHttpPorts, createHttpSecrets, credentialForgetPayload, credentialStatusPayload, installNetPort, isOAuthCode, isOAuthReason, randomBytesPayload, runHttpCall, sendBeaconRequest, sendHttp, streamHttp, systemRandom, unavailableFailure, userCredentialKey } from './kernel/http.js';
-export { DispatchLane, LaneGuard, LaneHeldByParkedDispatch, LaneTurn } from './kernel/lane.js';
-export { OAuthEffectFailure, oauthAuthorizePayload, oauthConnectionPayload } from './kernel/oauth-effects.js';
-export { OAuthConsentRequest, OAuthPortOptions, PENDING_GRACE_MS, createOAuthPort } from './kernel/oauth-port.js';
-export { AnchoredPath, OsAnchorProblem, OsAnchors, OsCompletionEvent, OsCompletionMatchers, OsCompletionPort, OsDesktopKind, OsFsMode, OsGrantKernel, OsGrantMatchers, OsGrantPort, OsHostPort, OsNetKind, OsRequirement, OsStdioKind, OsSysKind, anchoredGrants, expandAnchor, kernelOsCompletions, kernelOsGrants } from './kernel/os-port.js';
-export { CascadeOutcome, PROGRAM_EFFECTS, PlayedStep, ProgramEffectName, ProgramEffectOutcome, ProgramValidationReport, StepRequest, isProgramEffect } from './kernel/program-effects.js';
-export { KernelModule, KernelServerClass, KernelServerHandle } from './kernel/wire.js';
-export { HttpImportChain, HttpLoader, createHttpLoader } from './loader/http-loader.js';
+export { decodeAnswer, decodeDueTicks, decodeHeldCompletion, decodeNext, decodeProgress, decodeResolveProgress } from './kernel/decode.js';
+export { KernelEngine, KernelEvaluation, ProgramlessContract, evaluateOnKernel, kernelRequest } from './kernel/engine.js';
+export { FrameApplied, FrameDispatch, FramePostPort, TickEffects, applyFrame, decodeFrame } from './kernel/frame-applier.js';
+export { DeferredCallOutcome, EventRequestParser, HeldGpuCompletion, HeldGpuPort, HostAskError, HostAskFailureKind, HostAskOutcome, HostAskReturn, HostAudioAsk, HostConsentAnswer, HostConsentRequest, HostSignInAnswer, HostSignInRequest, KernelAnswerScope, KernelCallService, KernelHostActions, KernelHostPorts, SubstrateStreamSource, answerRequest, completeTls, consentFromRedirect, declareCapabilities, finishTls, hostAskReturn, kernelEventRequestParser, parseConsentRequest, parseSignInRequest, performHostAnswer, performHostAsk, writeRows } from './kernel/host.js';
+export { CredentialAdminPort, CredentialConnectPort, EnvTailsPort, RANDOM_BYTES_MAX, RandomSource, SecretPorts, SecretPortsOptions, SecretStore, SecretStoreHost, base64Standard, base64Url, createBrowserSecretPorts, createCredentialAdminPort, createCredentialConnectPort, createSecretPorts, createSecretStore, credentialForgetPayload, credentialStatusPayload, envTailsOf, randomBytesPayload, systemRandom, userCredentialKey } from './kernel/secret-ports.js';
+export { LaneHeldByParkedDispatch } from './kernel/lane.js';
+export { AnchoredPath, OsAnchorProblem, OsAnchors, OsCompletionEvent, OsCompletionMatchers, OsCompletionPort, OsDesktopKind, OsFsMode, OsGrantKernel, OsGrantMatchers, OsGrantPort, OsHostPort, OsNetKind, OsRequirement, OsStdioKind, OsSysKind, OsTlsKernel, OsTlsPort, OsTlsStep, anchoredGrants, expandAnchor, kernelOsCompletions, kernelOsGrants, kernelOsTls } from './kernel/os-port.js';
+export { createFetchOsHost } from './kernel/os-fetch-port.js';
+export { PROGRAM_EFFECTS, ProgramEffectName, ProgramEffectOutcome, ProgramValidationReport, StepRequest, isProgramEffect } from './kernel/program-effects.js';
+export { FiredByOrbital, KernelCanvas3D, KernelCanvas3DFactory, KernelGpuHost, KernelModule, KernelSceneCanvas, KernelSceneCanvasFactory, KernelServerClass, KernelServerHandle } from './kernel/wire.js';
 export { loadLazyPage } from './loader/lazy-page.js';
-export { BaseLoaderOptions, HttpLoaderOptions, ImportChainLike, LoadResult, LoadedOrbital, LoadedSchema, SchemaLoader } from './loader/schema-loader.js';
-export { ComposeBehaviorsInput, ComposeBehaviorsResult, composeBehaviors } from './runtime/effects/composition/compose-behaviors.js';
-export { EventWiringEntry, applyEventWiring } from './runtime/effects/composition/event-wiring.js';
-export { i as composition } from './index-hT1xCdTq.js';
-export { LayoutStrategy, detectLayoutStrategy } from './runtime/effects/composition/layout-strategy.js';
-export { PipeStep, pipeBehaviors } from './runtime/effects/composition/pipe.js';
-export { MockSeedHost, MockSeedViewer, MockSeeded, bindDeclaredCollections, restampMockOwner, seedMockStore } from './runtime/entities/mockStoreSeed.js';
-export { MockSeedEngine, MockSeedRun, SeedConfig, SeedOwnerCell, SeedOwnerChange, SeedOwnerJournal, SeedRestamp, SeededDataset, StdMockSeed, declaredSeedConfig, readSeededStores } from './runtime/entities/std-mock-seed.js';
-export { BrowserSeedHost, seedBrowserStore } from './runtime/entities/seedBrowserStore.js';
+export { FetchSchemaLoader } from './loader/fetch-loader.js';
+export { BaseLoaderOptions, ImportChainLike, LoadResult, LoadedOrbital, LoadedSchema, SchemaLoader } from './loader/schema-loader.js';
+export { bindDeclaredCollections } from './runtime/entities/declaredCollections.js';
 export { LocalKernelOptions, LocalStoreTransportOptions, createLocalStoreTransport, localStorePersistence, openLocalKernel, resolveLocalRows } from './runtime/evaluation/local-store-transport.js';
 export { ResidenceTransportOptions, createResidenceTransport } from './runtime/evaluation/residence-transport.js';
 export { routeByEntity } from './runtime/evaluation/routed-persistence.js';
-export { ListenSourceDescriptor, RouteSourceMeta, buildSourceMatcher, eventRouteKey, parseListenSource } from './runtime/events/identity/routing.js';
-export { TickHandle, TickScheduler, createTickScheduler } from './runtime/time/TickScheduler.js';
-export { CronFields, cronMatches, cronMinuteKey, isValidCronExpression, parseCron, parseCronField } from './runtime/time/cron.js';
-export { isValidDurationString, parseDurationString } from './runtime/time/duration.js';
-export { ParsedOrbitalTraits, parseOrbitalTraits } from './runtime/traits/OrbitalTraitParsing.js';
-export { CollectedListenerTarget, collectListenerTargets } from './runtime/traits/listen-targets.js';
-export { buildTraitIndex } from './runtime/traits/trait-index.js';
-export { BindingContext, BrowserFileMeta, BrowserFilePickerOptions, BrowserGeolocationOptions, BrowserGeolocationPosition, ConfigContext, Effect, EffectContext, EffectHandlers, EffectResult, EvaluationContextExtensions, EventListener, ExecutionEnvironment, HANDLER_MANIFEST, HttpEffectReport, IEventBus, PatternProps, PersistBatchSummary, RuntimeConfig, RuntimeEvent, RuntimePatternValue, RuntimeRenderPattern, TransitionResult, Unsubscribe, isEffectTuple } from './runtime/types.js';
+export { eventRouteKey } from './runtime/events/identity/routing.js';
+export { BindingContext, Effect, EffectHandlers, EffectResult, EvaluationContextExtensions, EventListener, IEventBus, PatternProps, RuntimeEvent, Unsubscribe } from './runtime/types.js';
 export { CallServiceHandler, ServiceMessageRoute, defaultCallService } from './service/default-call-service.js';
 export { ServiceCallContext, ServiceCallError, ServiceCallErrorCode, ServiceProvider, callRegisteredService, registerServiceProvider, registeredServices, unregisterServiceProvider } from './service/service-provider.js';
 export { NativeMemoryPersistenceAdapter, NativeMemoryWriteError } from './persistence/native-memory.js';
-export { CallRoutesWire, CallSiteWire, CallerWire, HttpBody, HttpFailureWire, HttpRequestWire, HttpResponseWire, IoAnswerWire, IoReplyWire, IoRequestWire, PendingRequestWire, ResolveProgressWire, ServerProgressWire, Settled, SubstrateFailureWire } from '@almadar/core/kernel-wire';
-export { EntityRow, EventPayload, FetchResult, HttpCall, ServiceParams } from '@almadar/core';
+export { CallRoutesWire, CallSiteWire, CallerWire, IoAnswerWire, IoReplyWire, IoRequestWire, NextWire, PendingRequestWire, PlayedStep, ResolveProgressWire, ServerProgressWire, Settled, SubstrateFailureWire, decodeIoRequestWire as decodeRequest } from '@almadar/core/kernel-wire';
+export { EntityRow, EventPayload, FetchResult, ServiceParams } from '@almadar/core';

package/dist/index.js

@@ -1,59 +1,41 @@
-export { HANDLER_MANIFEST, isEffectTuple } from './chunk-WNPNNYXY.js';
-export { TickScheduler, createTickScheduler } from './chunk-CQP5XAX6.js';
-export { cronMatches, cronMinuteKey, isValidCronExpression, parseCron, parseCronField } from './chunk-CROS2GEX.js';
-export { isValidDurationString, parseDurationString } from './chunk-46RWK2B5.js';
-export { collectListenerTargets } from './chunk-XB5GYODW.js';
-export { buildSourceMatcher, eventRouteKey, parseListenSource } from './chunk-IHQLE5M7.js';
-export { composition_exports as composition } from './chunk-5D63EMO5.js';
-export { pipeBehaviors } from './chunk-FQ6IZMIU.js';
-export { bindDeclaredCollections, restampMockOwner, seedMockStore } from './chunk-JFWFDUTR.js';
-export { seedBrowserStore } from './chunk-T775TUCD.js';
-export { StdMockSeed, declaredSeedConfig, readSeededStores } from './chunk-HMK6YMQS.js';
-export { createLocalStoreTransport, localStorePersistence, openLocalKernel, resolveLocalRows } from './chunk-VNMG7NKY.js';
+import './chunk-ELBLT2HZ.js';
+export { NativeMemoryPersistenceAdapter, NativeMemoryWriteError } from './chunk-7SDV3QWR.js';
+export { bindDeclaredCollections } from './chunk-BAS26HBN.js';
+export { createLocalStoreTransport, localStorePersistence, openLocalKernel, resolveLocalRows } from './chunk-OQVSN7DP.js';
 export { defaultCallService } from './chunk-4SEK5ER2.js';
 export { ServiceCallError, callRegisteredService, registerServiceProvider, registeredServices, unregisterServiceProvider } from './chunk-UBN5JJKZ.js';
+export { createResidenceTransport } from './chunk-V4EMDPCO.js';
 export { routeByEntity } from './chunk-O57GKTYU.js';
-export { buildTraitIndex } from './chunk-CPSQXEJ6.js';
-export { parseOrbitalTraits } from './chunk-SAS5KKCR.js';
-export { createResidenceTransport } from './chunk-UJHOUZAL.js';
+export { eventRouteKey } from './chunk-BY5G4225.js';
+import './chunk-LYFIQPXX.js';
+export { createFetchOsHost } from './chunk-2WCVOMZ2.js';
+export { anchoredGrants, expandAnchor, kernelOsCompletions, kernelOsGrants, kernelOsTls } from './chunk-BOVU4TCQ.js';
 import './chunk-EZZYLTWY.js';
-export { HttpImportChain, HttpLoader, createHttpLoader } from './chunk-YL2SO5TP.js';
+export { FetchSchemaLoader } from './chunk-57SBCUSM.js';
 export { loadLazyPage } from './chunk-XXWNMJI6.js';
-import './chunk-ELBLT2HZ.js';
-export { NativeMemoryPersistenceAdapter, NativeMemoryWriteError } from './chunk-7SDV3QWR.js';
-export { composeBehaviors } from './chunk-ZCQUUJIF.js';
-export { detectLayoutStrategy } from './chunk-EV56K4GB.js';
-export { applyEventWiring } from './chunk-MHYSHSRG.js';
-export { KernelEngine, evaluateOnKernel, kernelRequest } from './chunk-D4XJTBLB.js';
-export { applyFrame, decodeFrame, isFrameWire } from './chunk-4J2QEIUV.js';
-export { answerRequest, declareCapabilities, writeRows } from './chunk-NATGCIVM.js';
-export { PROGRAM_EFFECTS, isProgramEffect } from './chunk-HNOAZWFH.js';
-export { DispatchLane, LaneHeldByParkedDispatch } from './chunk-53IPZXDP.js';
-export { OAuthEffectFailure, oauthAuthorizePayload, oauthConnectionPayload } from './chunk-ZAQSS47X.js';
-export { HttpEffectFailure, HttpUnavailableError, RANDOM_BYTES_MAX, base64Standard, base64Url, checkOAuthReply, createBrowserHttpPorts, createCredentialAdminPort, createHttpPorts, createHttpSecrets, credentialForgetPayload, credentialStatusPayload, installNetPort, isOAuthCode, isOAuthReason, randomBytesPayload, runHttpCall, sendBeaconRequest, sendHttp, streamHttp, systemRandom, unavailableFailure, userCredentialKey } from './chunk-YO4LWS3I.js';
-export { PENDING_GRACE_MS, createOAuthPort } from './chunk-4ZICQ5PM.js';
-export { anchoredGrants, expandAnchor, kernelOsCompletions, kernelOsGrants } from './chunk-REPX5QPI.js';
-export { InFlightCalls, untilAborted } from './chunk-MZKIL5IN.js';
-export { NO_ON_DEVICE_EMBEDDER, NO_ON_DEVICE_MODEL, OnDeviceModelFailure, embedOnDevice, promptOnDevice } from './chunk-FWA5K7Q2.js';
 export { EventBus, createEventBus } from './chunk-SOQDEPME.js';
 export { stampEmitSource } from './chunk-64IH2SMY.js';
-export { deliverBeacon } from './chunk-VMOBW7RK.js';
-export { decodeHttpBody, decodeHttpRequest, decodeHttpResponse, decodeOAuthAsk, decodeProgress, decodeRequest, decodeResolveProgress } from './chunk-RBUMDYFS.js';
-export { createLocalFold, mirrorResponse, traceResponse } from './chunk-QQRDUMB2.js';
+export { KernelEngine, evaluateOnKernel, kernelRequest } from './chunk-VKQA2DJX.js';
+export { LaneHeldByParkedDispatch } from './chunk-NU6LVKGS.js';
+export { decodeAnswer, decodeDueTicks, decodeHeldCompletion, decodeNext, decodeProgress, decodeIoRequestWire as decodeRequest, decodeResolveProgress } from './chunk-XZGVOBY6.js';
+export { applyFrame, decodeFrame } from './chunk-NTFQ36UN.js';
+export { HostAskError, answerRequest, completeTls, consentFromRedirect, declareCapabilities, finishTls, hostAskReturn, kernelEventRequestParser, parseConsentRequest, parseSignInRequest, performHostAnswer, performHostAsk, writeRows } from './chunk-JVSREWQO.js';
+export { PROGRAM_EFFECTS, isProgramEffect } from './chunk-WGCWJOT2.js';
+export { RANDOM_BYTES_MAX, base64Standard, base64Url, createBrowserSecretPorts, createCredentialAdminPort, createCredentialConnectPort, createSecretPorts, createSecretStore, credentialForgetPayload, credentialStatusPayload, envTailsOf, randomBytesPayload, systemRandom, userCredentialKey } from './chunk-ZUSM4VW4.js';
+export { NO_ON_DEVICE_EMBEDDER, NO_ON_DEVICE_MODEL, OnDeviceModelFailure, embedOnDevice, promptOnDevice } from './chunk-FWA5K7Q2.js';
 export { DEFAULT_THEME_KEY, appNavItems, inlineNavItems, sigilThemeKey } from './chunk-UP6GGGAN.js';
 export { TraitMountError } from './chunk-IOPUS6Q5.js';
 import './chunk-P53CKOME.js';
-export { STORE_BOOTSTRAP_ENV_VARS, allCredentialEnvVars } from './chunk-Q7JK4KY7.js';
-export { CREDENTIAL_ENTITY_TYPE, CREDENTIAL_MASTER_KEY_ENV, CREDENTIAL_PREVIOUS_MASTER_KEY_ENV, CredentialStore, DERIVED_ENTITY_TYPE } from './chunk-NAECVIAR.js';
+export { CREDENTIAL_MASTER_KEY_ENV, CREDENTIAL_PREVIOUS_MASTER_KEY_ENV, STORE_BOOTSTRAP_ENV_VARS, allCredentialEnvVars } from './chunk-VNGXRYFF.js';
 export { CREDENTIALS_SOURCE_ENV, credentialModeFromEnv, credentialsFromStoreOnly, getEffectiveCredentialStore, getInstalledCredentialStore, getModeControl, installCredentialScopeStorage, installCredentialStore, installModeControl, resolveCredentialRef, runWithCredentialScope, uninstallCredentialStore } from './chunk-HLOUDLPI.js';
-export { seedCredentialStore } from './chunk-SWPDU752.js';
-export { ServerBridge, createServerBridge } from './chunk-D5USD2EX.js';
-export { COMPRESSED_BODY_MIN_BYTES, createHttpTransport, createInProcessTransport, deriveCarriesCircuitState, encodeJsonBody } from './chunk-QELZ6TEJ.js';
+export { CredentialExchangeError, CredentialVault } from './chunk-DFDNHVDW.js';
+export { InFlightCalls, untilAborted } from './chunk-MZKIL5IN.js';
+export { COMPRESSED_BODY_MIN_BYTES, SessionEndedError, TransportStatusError, createHttpTransport, createInProcessTransport, deriveCarriesCircuitState, encodeJsonBody } from './chunk-UD2CXYSJ.js';
 export { createChannelTransport, holdUntilServed, serveChannel } from './chunk-SKLMWHQD.js';
-export { createMemoryCircuitStore } from './chunk-ODJCZ27I.js';
-export { StateBook, createInitialTraitState, findInitialState, findMatchingTransitions, findTransition } from './chunk-Q2H75UYT.js';
+export { createMemoryCircuitStore } from './chunk-N7HYNKK6.js';
+export { StateBook, createInitialTraitState, findInitialState } from './chunk-A2JJT4GA.js';
 export { AwaitingRegistry } from './chunk-HC6ERSAH.js';
 import './chunk-LZIOTBFX.js';
-export { dispatchDeclaredInput } from './chunk-DYOJGLIX.js';
-export { dispatchInbound } from './chunk-2JU7Y4KU.js';
-import './chunk-MLKGABMK.js';
+export { dispatchDeclaredInput } from './chunk-LKWYCYX5.js';
+export { dispatchInbound } from './chunk-P2N6K2IV.js';
+export { createLocalFold, paintFrames, paintResponse, paintStates, traceResponse } from './chunk-QCJWPXLH.js';

package/dist/kernel/decode.d.ts

@@ -1,15 +1,15 @@
-import { HttpBody, HttpRequestWire, HttpResponseWire, OAuthAsk, ServerProgressWire, IoRequestWire, ResolveProgressWire } from '@almadar/core/kernel-wire';
-import { JsonValue } from '@almadar/core';
+import { IoAnswerWire, HeldGpuCompletion, NextWire, ServerProgressWire, ResolveProgressWire } from '@almadar/core/kernel-wire';
+export { decodeIoRequestWire as decodeRequest } from '@almadar/core/kernel-wire';
+import { FiredByOrbital } from './wire.js';
+import '@almadar/core';
 
-/** Decoders for what the kernel hands back as JSON: narrowed by checks, never cast. */
+/** Decoders for what the kernel hands back as JSON: the generated decoders of `@almadar/core/kernel-wire`, which throw naming the failing path. */
 
-declare function decodeHttpBody(value: JsonValue): HttpBody;
-declare function decodeHttpRequest(value: JsonValue): HttpRequestWire;
-declare function decodeHttpResponse(value: JsonValue): HttpResponseWire;
-declare function decodeRequest(value: JsonValue): IoRequestWire;
 declare function decodeProgress(json: string): ServerProgressWire;
+declare function decodeAnswer(json: string): IoAnswerWire;
+declare function decodeHeldCompletion(json: string): HeldGpuCompletion | null;
+declare function decodeNext(json: string): NextWire | null;
 declare function decodeResolveProgress(json: string): ResolveProgressWire;
-/** The driver's `oauth` ask, decoded against the closed ask set before it reaches the host's store. */
-declare function decodeOAuthAsk(value: JsonValue | undefined): OAuthAsk;
+declare function decodeDueTicks(json: string): FiredByOrbital;
 
-export { decodeHttpBody, decodeHttpRequest, decodeHttpResponse, decodeOAuthAsk, decodeProgress, decodeRequest, decodeResolveProgress };
+export { decodeAnswer, decodeDueTicks, decodeHeldCompletion, decodeNext, decodeProgress, decodeResolveProgress };

package/dist/kernel/decode.js

@@ -1,2 +1 @@
-export { decodeHttpBody, decodeHttpRequest, decodeHttpResponse, decodeOAuthAsk, decodeProgress, decodeRequest, decodeResolveProgress } from '../chunk-RBUMDYFS.js';
-import '../chunk-MLKGABMK.js';
+export { decodeAnswer, decodeDueTicks, decodeHeldCompletion, decodeNext, decodeProgress, decodeIoRequestWire as decodeRequest, decodeResolveProgress } from '../chunk-XZGVOBY6.js';