@almadar/shell-runtime 0.1.0 → 1.1.0

package/dist/kernel/engine.d.ts

@@ -1,14 +1,12 @@
-import { OrbitalSchema, MessageCatalogs, MountSeed, RowSetRef, RowQueryPage, OrbitalEventRequest, OrbitalEventResponse, EventStreamItem, UserContext } from '@almadar/core';
+import { OrbitalSchema, ExternalInput, InboundRoute, InboundAnswer, InboundDelivery, EventPayload, EventRequest, LiveBroadcastItem, MountSeed, PayloadField, JsonSchema, PayloadIssue, EntityRow, UserContext, RowSetRef, RowQueryPage, EventResponse, EventStreamItem, JsonValue } from '@almadar/core';
+import { ProgramSurface } from '@almadar/core/kernel-wire';
 import { KernelHostPorts, KernelAnswerScope } from './host.js';
-import { KernelModule, KernelServerHandle } from './wire.js';
+import { KernelModule, KernelServerHandle, FiredByOrbital } from './wire.js';
 import '../effects/in-flight-calls.js';
 import '../service/service-provider.js';
 import './program-effects.js';
-import './http.js';
-import './beacon.js';
-import '../credentials/store.js';
-import './decode.js';
-import '@almadar/core/kernel-wire';
+import './secret-ports.js';
+import '../credentials/vault.js';
 import './os-port.js';
 
 /**
@@ -17,78 +15,182 @@ import './os-port.js';
  * and nothing else. The continuation of a stopped dispatch never leaves the wasm instance.
  */
 
+type ContractAsk = <T>(schema: {
+    parse(input: ReturnType<typeof JSON.parse>): T;
+}, query: object) => T;
+declare function contractAnswers(ask: ContractAsk): {
+    findExternalInput(orbital: string, trait: string, event: string): ExternalInput | undefined;
+    findInbound(name: string): {
+        route: InboundRoute;
+    } | {
+        answer: InboundAnswer;
+    };
+    inboundPayload(route: InboundRoute, delivery: InboundDelivery, credential: string | null | undefined): EventPayload;
+    inboundAnswer(route: InboundRoute, emitted: readonly {
+        event: string;
+        payload?: EventPayload;
+    }[], error: string | undefined): InboundAnswer;
+    credentialUnset(credential: string): InboundAnswer;
+    dispatchFailed(message: string): InboundAnswer;
+};
+/** The declared-contract answers of a host holding no program: the kernel's own answers on an empty kernel. */
+type ProgramlessContract = ReturnType<typeof contractAnswers>;
 declare class KernelEngine {
     private readonly kernel;
     private readonly schemaJson;
     private readonly ports;
     private readonly entityTypes;
     private readonly preserveProgramContext;
+    private readonly lazyDir?;
     private handle;
-    private readonly lane;
-    private tickMount;
-    private messages;
-    constructor(kernel: KernelModule, schemaJson: string, ports: KernelHostPorts, entityTypes?: readonly string[], forkedFrom?: KernelServerHandle, providedHandle?: KernelServerHandle, preserveProgramContext?: boolean);
+    private readonly turns;
+    private tickRelayIntervalMs;
+    private stateful;
+    constructor(kernel: KernelModule, schemaJson: string, ports: KernelHostPorts, entityTypes?: readonly string[], forkedFrom?: KernelServerHandle, providedHandle?: KernelServerHandle, preserveProgramContext?: boolean, lazyDir?: string | undefined);
     /**
      * A kernel on the same program, registered once, holding none of this one's session: every trait at its initial
-     * state, no rows the kernel held, its locales and mounted ticks kept. A stateless host serves each request a
+     * state, no rows the kernel held, its mounted ticks kept. A stateless host serves each request a
      * fork (EXEC-DIST-5), `ports` answering it.
      */
     fork(ports?: KernelHostPorts): KernelEngine;
     forkProgram(program: OrbitalSchema, ports?: KernelHostPorts): KernelEngine;
     /** A server over the host's ports. */
+    /** A server over the host's ports; the host's GPU answerer is installed in it, so it holds every `gpu/` ask. */
     private openServer;
     private declare;
-    static open(kernel: KernelModule, schema: OrbitalSchema, ports: KernelHostPorts): KernelEngine;
+    /** The contract answers for a host with no program registered yet: the kernel's, asked with no program. */
+    static withoutProgram(kernel: KernelModule): ProgramlessContract;
+    static open(kernel: KernelModule, schema: OrbitalSchema, ports: KernelHostPorts, lazyDir?: string): KernelEngine;
     /** A fresh kernel on the same program: every trait back at its initial state. */
     reset(): void;
     private managedProgram;
     /** The program whose declared credentials this kernel's credential effects manage beside its own (a console's app). */
     setManagedProgram(program: OrbitalSchema): void;
-    /** The program's declared locales and merged catalogs (a lazy page's behavior contributes its namespaced keys). */
-    setMessages(locales: readonly string[], catalogs: MessageCatalogs): void;
-    /** The traits some client has mounted: a tick that is not `[background]` fires only for these. */
-    setTickMount(traits: string[]): void;
+    /** `client` mounted `traits` of `orbital`: their mount-scoped ticks fire while any client holds them. A request derives this itself; this is for a mount made outside a request. */
+    mountClient(client: string, orbital: string, traits: readonly string[]): void;
+    unmountClient(client: string, orbital: string, traits: readonly string[]): void;
+    /** `client` is gone: everything it mounted is released. */
+    releaseClient(client: string): void;
+    /** This host holds the circuit state: the kernel takes a client's copy of it only on a delegated leg and refuses any other request carrying one. */
+    setStateful(): void;
+    /** Whether the program declares any tick: the host runs its timer only then. */
+    declaresTicks(): boolean;
+    /** Queue a tick-stamped dispatch for the coalesced peer relay; the ms after which to flush when it opened a window. */
+    relayTick(orbital: string, request: EventRequest): number | undefined;
+    /** The relay window's length in ms; the kernel's default is 50. */
+    setTickRelayInterval(intervalMs: number): void;
+    /** Every item queued since the window opened, in first-arrival order; the window closes. */
+    flushTickRelay(): LiveBroadcastItem[];
+    /** One pass of the kernel's tick clock: the ticks due at monotonic `nowMs` that this server runs (`[background]` ticks, and those of a mounted trait), keyed by the orbital each `runTick` request is addressed to. */
+    tickPass(nowMs: number): FiredByOrbital;
+    /** Stop the kernel's tick clock; its phase is kept. */
+    tickPause(): void;
+    /** Restart the kernel's tick clock; the paused span is never counted. */
+    tickResume(): void;
+    tickPaused(): boolean;
     /** What this host mounts when it starts: the kernel's boot mounts for the side it serves (EXEC-ENDPOINT-3). */
     bootMounts(side: 'server' | 'process'): MountSeed[];
     /** What mounts when a client opens `routePath` (EXEC-ENDPOINT-3). */
     routeMounts(routePath: string): MountSeed[];
-    /** Mock-seed the `[runtime]` entities the kernel holds itself, owner columns stamped with `viewerId`. */
-    seedRuntimeMock(viewerId: string | undefined): void;
     dispose(): void;
-    liveItemDelivered(item: object, viewer: object | null, clientId?: string): boolean;
-    /** `OsGrants::allows` over the grants of the program this kernel runs. */
-    osAllows(requirementJson: string): boolean;
+    private readonly answers;
+    private contract;
+    /** Every external input the program declares: what an outside client may send which trait. */
+    externalInputs(): ExternalInput[];
+    /** What the kernel holds of every trait of the program, in name order, and the browser-stored entities. */
+    programSurface(): ProgramSurface;
+    /** The entities a provider acting as the caller may read. */
+    readableEntities(): string[];
+    /** The declared input of `trait.event` in `orbital`, when there is one. */
+    findExternalInput(orbital: string, trait: string, event: string): ExternalInput | undefined;
+    /** The declared input a `listens`-addressed event names from `caller`'s position (`EVENT`, `Trait.EVENT`, `Orbital.Trait.EVENT`), when there is one. */
+    findInputByAddress(address: string, caller: {
+        orbital: string;
+        trait: string;
+    }): ExternalInput | undefined;
+    /** A declared payload as the JSON Schema of one object: what a tool-calling model fills. */
+    payloadJsonSchema(fields: readonly PayloadField[]): JsonSchema;
+    /** The ways `value` misses the declared payload `fields`. */
+    payloadIssues(fields: readonly PayloadField[], value: EventPayload): PayloadIssue[];
+    /** The route a hook name is delivered to, or the answer to write for a hook the program does not serve. */
+    findInbound(name: string): {
+        route: InboundRoute;
+    } | {
+        answer: InboundAnswer;
+    };
+    /** The trait that handles `event` as an inbound hook in `orbital`, with the refusal message, when a client-facing request names it. */
+    inboundOnly(orbital: string, trait: string | undefined, event: string): {
+        trait: string;
+        message: string;
+    } | undefined;
+    /** The payload an inbound event is delivered with. */
+    inboundPayload(route: InboundRoute, delivery: InboundDelivery, credential: string | null | undefined): EventPayload;
+    /** The HTTP answer a finished dispatch produced for `route`. */
+    inboundAnswer(route: InboundRoute, emitted: readonly {
+        event: string;
+        payload?: EventPayload;
+    }[], error: string | undefined): InboundAnswer;
+    /** The answer for a route whose credential the host holds no value for. */
+    credentialUnset(credential: string): InboundAnswer;
+    /** The answer for a delivery whose dispatch failed. */
+    dispatchFailed(message: string): InboundAnswer;
+    /** The name of the program's `[identity]` entity, when it declares one. */
+    identityEntity(): string | undefined;
+    /** The orbital that declares `entity` inline. */
+    entityOwnerOrbital(entity: string): string | undefined;
+    /** `rows` of `entity` as `user` reads them: narrowed by the entity's declared `@read`, which the kernel evaluates with `@user` bound to the viewer. */
+    readRows(entity: string, rows: readonly EntityRow[], user: UserContext | undefined): EntityRow[];
+    liveItemDelivered(item: object, clientId?: string): boolean;
+    /** `OsGrants::allows` over the grants of `orbital` in the program this kernel runs (the app level alone with no orbital). */
+    osAllows(requirementJson: string, orbital?: string): boolean;
+    /** Whether `url`'s origin is declared in the program's `egress` (the kernel's rule). */
+    egressAllows(url: string): boolean;
     /** Place the program's anchored grants and arguments under the host's anchors. */
     setOsAnchors(anchorsJson: string): string;
     /** An `os/` call's arguments with its anchored parts resolved under the host's anchors. */
     osResolveArgs(op: string, argsJson: string): string;
+    tlsComplete(key: string, outcomeJson: string): string;
+    /** A live stream of `client`'s session opened (EXEC-DIST-9); the id closes it. */
+    openSessionStream(client: string): number;
+    /** The live stream `id` dropped: the kernel frees the session once its streams have all dropped and it is quiet. */
+    closeSessionStream(id: number): boolean;
     /** The current state of a trait instance, `''` when it has none. */
     stateOf(traitName: string, entityId?: string): string;
     /**
-     * `reference` resolved for `scope.user` against the host-answered store (EXEC-RENDER-3): the rows that still
-     * match its query and the viewer's `@read` in the reference's order, a missing or hidden row omitted, and `total`
+     * `reference` resolved for the identity `scope.originClientId`'s session bound (the anonymous viewer with none) against the host-answered store (EXEC-RENDER-3): the rows that still
+     * match its query and that identity's `@read` in the reference's order, a missing or hidden row omitted, and `total`
      * re-counted (a `total: none` reference is not re-counted: the total is the resolved window). Each read the
      * kernel makes is answered here, as in `evaluate`.
      */
     resolveRows(reference: RowSetRef, scope: KernelAnswerScope): Promise<RowQueryPage>;
-    /** Run `request` against `orbital`: start it, answer every request the kernel asks for, resume until done. */
-    evaluate(orbital: string, request: OrbitalEventRequest, scope: KernelAnswerScope): Promise<OrbitalEventResponse>;
+    /**
+     * Run `request` against `orbital`. The kernel orders every start and every resumption (EXEC-CONC-2): while another
+     * dispatch holds the lane it answers `queued` and runs the work itself once the lane frees; this host only answers
+     * what each dispatch asks.
+     */
+    evaluate(orbital: string, request: EventRequest, scope: KernelAnswerScope): Promise<EventResponse>;
+    /** The kernel's answer to a start or resume, once it has run: at once, or when the kernel takes it from its queue. */
+    private ran;
+    private running;
+    /** Run each piece of queued work that can run now, in the kernel's order, handing each to the dispatch it continues. */
+    private runQueued;
 }
 /** What `evaluateOrbitalEvent` needs to run a request on the kernel instead of the JS composition. */
 interface KernelEvaluation {
     engine: KernelEngine;
     /** The orbital the request is addressed to. */
     orbital: string;
-    outsideEventQueue?: <T>(work: () => Promise<T>) => Promise<T>;
     onStream?: (item: EventStreamItem) => void;
 }
 /**
- * The request as the kernel takes it: the viewer and locale the host resolved, the `_targetTrait` sidecar
+ * The request as the kernel takes it: the locale the host resolved, the `_targetTrait` sidecar
  * promoted to `targetTrait`, and the `_activeTraits` sidecar dropped (the kernel's mounted set is explicit,
  * not carried per request).
  */
-declare function kernelRequest(request: OrbitalEventRequest, user: UserContext | undefined, locale: string | undefined): OrbitalEventRequest;
-declare function evaluateOnKernel(kernel: KernelEvaluation, request: OrbitalEventRequest, user: UserContext | undefined, locale: string | undefined): Promise<OrbitalEventResponse>;
+declare function kernelRequest(request: EventRequest & {
+    user?: JsonValue;
+}, locale: string | undefined): EventRequest;
+declare function evaluateOnKernel(kernel: KernelEvaluation, request: EventRequest, locale: string | undefined): Promise<EventResponse>;
 
 export { KernelEngine, evaluateOnKernel, kernelRequest };
-export type { KernelEvaluation };
+export type { KernelEvaluation, ProgramlessContract };

package/dist/kernel/engine.js

@@ -1,11 +1,9 @@
-export { KernelEngine, evaluateOnKernel, kernelRequest } from '../chunk-D4XJTBLB.js';
-import '../chunk-NATGCIVM.js';
-import '../chunk-HNOAZWFH.js';
-import '../chunk-53IPZXDP.js';
-import '../chunk-YO4LWS3I.js';
-import '../chunk-MZKIL5IN.js';
+export { KernelEngine, evaluateOnKernel, kernelRequest } from '../chunk-VKQA2DJX.js';
+import '../chunk-NU6LVKGS.js';
+import '../chunk-XZGVOBY6.js';
+import '../chunk-JVSREWQO.js';
+import '../chunk-WGCWJOT2.js';
+import '../chunk-ZUSM4VW4.js';
 import '../chunk-FWA5K7Q2.js';
-import '../chunk-VMOBW7RK.js';
-import '../chunk-RBUMDYFS.js';
 import '../chunk-HLOUDLPI.js';
-import '../chunk-MLKGABMK.js';
+import '../chunk-MZKIL5IN.js';

package/dist/kernel/frame-applier.d.ts

@@ -1,5 +1,5 @@
-import { FiredTick, FrameWire, RoutedLeg } from '@almadar/core/kernel-wire';
-import { OrbitalEventResponse, JsonValue } from '@almadar/core';
+import { FrameWire, RoutedLeg } from '@almadar/core/kernel-wire';
+import { EventResponse } from '@almadar/core';
 import { ClientKernelOutcome, LocalFoldKernel } from '../client/client-kernel.js';
 import '../client/circuit-store.js';
 import '../client/awaiting.js';
@@ -16,20 +16,21 @@ import '../client/trait-types.js';
  * never delays the next frame.
  */
 
-declare function isFrameWire(value: JsonValue): value is JsonValue & FrameWire;
 /** `frame()`'s JSON; `undefined` (no tick due) decodes to `undefined`. */
 declare function decodeFrame(json: string | undefined): FrameWire | undefined;
-type TickEffects = Pick<OrbitalEventResponse, 'clientEffects' | 'clientEffectsByTrait'>;
+type TickEffects = Pick<EventResponse, 'clientEffectsByTrait'>;
 type FrameDispatch = FrameWire['dispatches'][number];
 /** The host transport's side of a frame: posts what a fired tick owes and folds the answer back through the kernel. */
 interface FramePostPort {
     /** Posts one dispatch's server legs (or stateful leg); resolves to what the server's fold added. */
     postDispatch(dispatch: FrameDispatch): Promise<TickEffects>;
     /** Sends a leg the kernel routed to the browser store; `frameResponse` is the frame's aggregate response. */
-    sendBrowserLeg(leg: RoutedLeg, frameResponse: OrbitalEventResponse): Promise<TickEffects>;
+    sendBrowserLeg(leg: RoutedLeg, frameResponse: EventResponse): Promise<TickEffects>;
 }
 interface FrameApplied {
-    fired: FiredTick[];
+    fired: FrameWire['fired'];
+    /** How many ticks fired, across every orbital. */
+    firedCount: number;
     folded: number;
     browserLegs: number;
     droppedServerEffects: number;
@@ -39,5 +40,5 @@ interface FrameApplied {
 }
 declare function applyFrame(json: string | undefined, kernel: LocalFoldKernel, post: FramePostPort | undefined): Promise<FrameApplied>;
 
-export { applyFrame, decodeFrame, isFrameWire };
+export { applyFrame, decodeFrame };
 export type { FrameApplied, FrameDispatch, FramePostPort, TickEffects };

package/dist/kernel/frame-applier.js

@@ -1,2 +1 @@
-export { applyFrame, decodeFrame, isFrameWire } from '../chunk-4J2QEIUV.js';
-import '../chunk-MLKGABMK.js';
+export { applyFrame, decodeFrame } from '../chunk-NTFQ36UN.js';

package/dist/kernel/host.d.ts

@@ -1,13 +1,12 @@
-import { PageFactField, BrowserPageFacts, PersistenceAdapter, ServiceParams, EventPayload, JsonValue, UserContext, ServiceHostPorts, OnDeviceModelPorts, BrowserTabPort, EventStreamItem } from '@almadar/core';
+import { PageFactField, BrowserPageFacts, PersistenceAdapter, ServiceParams, EventPayload, JsonValue, UserContext, ServiceHostPorts, OnDeviceModelPorts, BrowserTabPort, JsonObject, EventStreamItem, HostAskCompletion } from '@almadar/core';
 import { InFlightCalls } from '../effects/in-flight-calls.js';
 import { ServiceCallContext } from '../service/service-provider.js';
 import { ProgramEffectName, ProgramEffectOutcome } from './program-effects.js';
-import { HttpPorts } from './http.js';
-import { CallSiteWire, Settled, SubstrateFailureWire, IoRequestWire, IoAnswerWire } from '@almadar/core/kernel-wire';
-import { OsHostPort, OsCompletionPort, OsCompletionEvent } from './os-port.js';
-import './beacon.js';
-import '../credentials/store.js';
-import './decode.js';
+import { SecretPorts } from './secret-ports.js';
+import { Settled, EventRequest, CallSiteWire, SubstrateFailureWire, IoAnswerWire, IoRequestWire, OsError } from '@almadar/core/kernel-wire';
+import { KernelGpuHost, KernelModule } from './wire.js';
+import { OsHostPort, OsCompletionPort, OsTlsPort, OsCompletionEvent } from './os-port.js';
+import '../credentials/vault.js';
 
 /**
  * The host half of the kernel path: the I/O the kernel asks for, answered with the runtime's own
@@ -24,15 +23,94 @@ interface DeferredCallOutcome {
     traitName: string;
     event: string;
     payload: EventPayload | undefined;
+    /** The payload is held in the kernel under this ticket (a `gpu/` completion): the request names it instead of carrying it. */
+    heldPayload?: number;
     entityId: string | undefined;
     originClientId: string | undefined;
-    user: UserContext | undefined;
     locale: string | undefined;
 }
 interface SubstrateStreamSource {
     subscribe(message: (value: JsonValue) => void, ended: () => void): () => void;
 }
+/** The `audio/*` asks: a sound or music key, absent where the op names none (stop every sound, stop the music). */
+type HostAudioAsk = {
+    op: 'audio/play-sound';
+    key: string;
+} | {
+    op: 'audio/stop-sound';
+    key: string | undefined;
+} | {
+    op: 'audio/change-music';
+    key: string | undefined;
+} | {
+    op: 'audio/stop-music';
+};
+/** The one object `auth/sign-in` takes: the method and the credentials it needs. */
+type HostSignInRequest = {
+    method: 'google';
+} | {
+    method: 'email';
+    email: string;
+    password: string;
+} | {
+    method: 'emailLink';
+    email: string;
+    continueUrl: string;
+} | {
+    method: 'emailLink';
+    email: string;
+    link: string;
+} | {
+    method: 'customToken';
+    token: string;
+};
+/** What a sign-in answers: the viewer, or `{ sent: true }` for an email link that was only sent. */
+type HostSignInAnswer = {
+    uid: string;
+    email?: string;
+    displayName?: string;
+} | {
+    sent: true;
+};
+/** The one object `auth/consent` takes: the authorize URL the viewer is sent to. */
+interface HostConsentRequest {
+    authorizeUrl: string;
+}
+/** What a consent answers: the `code` and `state` query params of the final redirect URL, read as they are. */
+interface HostConsentAnswer {
+    code: string;
+    state: string;
+}
+/** Why a host ask failed: the viewer closed it, the provider denied it, the request was malformed, or the host has no such action. */
+type HostAskFailureKind = 'cancelled' | 'denied' | 'invalid' | 'unavailable';
+/** A host action's own failure, carrying the kind the completion reports. */
+declare class HostAskError extends Error {
+    readonly kind: HostAskFailureKind;
+    constructor(kind: HostAskFailureKind, message: string);
+}
+/** What the client host does for the `audio/*`, `auth/sign-out`, `auth/sign-in` and `auth/consent` asks; a host that has none refuses them by name. */
+interface KernelHostActions {
+    audio?: (ask: HostAudioAsk) => void;
+    signOut?: () => void | Promise<void>;
+    signIn?: (request: HostSignInRequest) => Promise<HostSignInAnswer>;
+    consent?: (request: HostConsentRequest) => Promise<HostConsentAnswer>;
+}
+/** A host ask's answer: the payload of its success route, or the error and kind of its failure route. */
+type HostAskOutcome = {
+    ok: JsonObject;
+} | {
+    error: string;
+    kind: HostAskFailureKind;
+};
+/** The event a host's answer dispatches: to `trait` (on `entityId` when the frame is a row), carrying `payload`. */
+interface HostAskReturn {
+    trait: string;
+    entityId?: string;
+    event: string;
+    payload: JsonObject;
+}
 interface KernelHostPorts {
+    hostActions?: KernelHostActions;
     pageFacts?: (fields: readonly PageFactField[]) => BrowserPageFacts;
     persistence: PersistenceAdapter;
     callService: KernelCallService;
@@ -52,8 +130,8 @@ interface KernelHostPorts {
     }, payload: EventPayload, originClientId: string | undefined) => void;
     /** Read per call: the sink a follow-on call's outcome runs through, absent when the host cannot deliver it to the tab. */
     deferCallOutcome: () => ((call: DeferredCallOutcome) => void) | undefined;
-    /** The `http` effect's ports (kernel builder, secrets, egress); absent, an `http` ask fails as unavailable. */
-    http?: HttpPorts;
+    /** The secret store, CSPRNG and credential administration ports the kernel's secret, random and credential asks use. */
+    secretPorts?: SecretPorts;
     /** The on-device model and embedder; absent, a `browser/prompt` or `browser/embed` ask fails `unconfigured`. */
     onDevice?: OnDeviceModelPorts;
     /** The browser's tabs for the `browser/tab-*` effects; absent, a tab ask fails `unavailable`. */
@@ -62,27 +140,81 @@ interface KernelHostPorts {
     os?: OsHostPort;
     /** What the kernel decides about a deferred `os` call (which ops defer, the event an outcome fires); absent, every `os` ask is answered in place. */
     osCompletions?: OsCompletionPort;
+    /** The kernel's TLS state for sockets it owns (EXEC-HTTP-7); absent, a deferred outcome reaches its route as the host gave it. */
+    osTls?: OsTlsPort;
+    /** The kernel's typed parse of a `program/dispatch` event request; absent, that ask is refused. */
+    parseEventRequest?: EventRequestParser;
     substrateStream?: (op: string, args: readonly JsonValue[], scope: KernelAnswerScope) => SubstrateStreamSource | undefined;
     substrateMessage?: (site: CallSiteWire, key: string, value: JsonValue) => OsCompletionEvent | null;
     substrateCompletion?: (site: CallSiteWire, key: string, op: string, args: readonly JsonValue[], outcome: Settled<JsonValue, SubstrateFailureWire>) => OsCompletionEvent | null;
     /** The host clock in epoch milliseconds, answering the kernel's `clock` ask; absent, the system clock. */
     now?: () => number;
+    /** The browser's GPU answerer, installed into the kernel: every `gpu/` ask is then held and answered there. */
+    gpu?: KernelGpuHost;
+    /** The GPU answerer installed in the kernel (bound by the engine from `gpu`): it answers a held `gpu` ask by ticket, so its bytes never reach this host. */
+    heldGpu?: HeldGpuPort;
+}
+/** A deferred held `gpu/` ask's completion: the route event and the ticket its payload is held under in the kernel. */
+interface HeldGpuCompletion {
+    orbital?: string;
+    traitName: string;
+    entityId?: string;
+    event: string;
+    heldPayload: number;
+}
+/** The kernel's own GPU answerer (orbital-wasm `Server.answerGpu`), bound to the kernel the host runs. */
+interface HeldGpuPort {
+    /** `completed` runs once for a deferred ask: its completion, or `null` when the outcome takes no declared route. */
+    answer(ticket: number, completed: (completion: HeldGpuCompletion | null) => void): Promise<IoAnswerWire>;
+    /** Drop a held completion payload no request will start. */
+    drop(heldPayload: number): void;
 }
 /** What one dispatch brings to its answers. */
 interface KernelAnswerScope {
     /** The orbital the request is addressed to. */
     orbital: string;
-    /** The viewer the dispatch runs as; a substrate operator is called as them. */
-    user?: UserContext;
     /** The requesting tab. */
     originClientId?: string;
     locale?: string;
     entityId?: string;
-    /** Runs `work` with the host's event queue released (a service call must not hold the next event). */
-    outsideEventQueue?: <T>(work: () => Promise<T>) => Promise<T>;
     onStream?: (item: EventStreamItem) => void;
     assertReentry?: () => void;
 }
+/** The kernel's typed parse of a `program/dispatch` event request: the request, or the reason it is none. */
+type EventRequestParser = (payload: JsonObject, options: JsonObject) => Settled<EventRequest, string>;
+/** The request parser over the kernel module: `EventRequest::from_dispatch`, not copied. */
+declare function kernelEventRequestParser(kernel: Pick<KernelModule, 'parseEventRequest'>): EventRequestParser;
+/** `audio/*` and `auth/sign-out`: one ask each, performed by the host's actions; a host without them refuses by name. */
+declare function performHostAsk(actions: KernelHostActions | undefined, op: string, args: readonly JsonValue[]): Promise<Settled<null, string>>;
+/** The `auth/sign-in` request an ask carries, or why it is refused before the host is asked. */
+declare function parseSignInRequest(args: readonly JsonValue[]): {
+    request: HostSignInRequest;
+} | {
+    error: string;
+};
+/** The `auth/consent` request an ask carries, or why it is refused before the host is asked. */
+declare function parseConsentRequest(args: readonly JsonValue[]): {
+    request: HostConsentRequest;
+} | {
+    error: string;
+};
+/** The `code` and `state` query params of a consent's final redirect URL, read as they are; a redirect without both is a denial. */
+declare function consentFromRedirect(redirectUrl: string): HostConsentAnswer;
+/** The answer of one host ask whose completion the host returns: `auth/sign-in` through the host's sign-in, `auth/consent` through its consent, any other op as it is performed (an empty success). */
+declare function performHostAnswer(actions: KernelHostActions | undefined, op: string, args: readonly JsonValue[]): Promise<HostAskOutcome>;
+/** The event `outcome` fires on the ask's declared route, or undefined when the ask declared none for it (nothing fires). */
+declare function hostAskReturn(completion: HostAskCompletion, outcome: HostAskOutcome): HostAskReturn | undefined;
+/**
+ * A deferred raw `os` outcome that belongs to a TLS operation the kernel parked (EXEC-HTTP-7) is finished in the kernel:
+ * it decrypts or encrypts the raw outcome and, while it needs more raw bytes, asks the host's `os` port for them. Any
+ * other key's outcome is returned as it stands.
+ */
+declare function finishTls(ports: KernelHostPorts, os: OsHostPort, key: string, raw: Settled<JsonValue, OsError>): Promise<Settled<JsonValue, OsError>>;
+/**
+ * The same loop, handing the outcome to `finish` in the calling turn whenever the kernel needs no further raw ask
+ * (nothing parked, or done at once); only a parked operation's follow-up ask makes it wait (EXEC-QUEUE-10/13).
+ */
+declare function completeTls(ports: KernelHostPorts, os: OsHostPort, key: string, raw: Settled<JsonValue, OsError>, finish: (outcome: Settled<JsonValue, OsError>) => void): void;
 declare function writeRows(persistence: PersistenceAdapter, request: Extract<IoRequestWire, {
     kind: 'writeRows';
 }>): Promise<IoAnswerWire>;
@@ -91,5 +223,5 @@ declare function declareCapabilities(persistence: PersistenceAdapter, declare: (
 /** Answer one request of the kernel; a thrown adapter error becomes the request's declared failure. */
 declare function answerRequest(ports: KernelHostPorts, request: IoRequestWire, scope: KernelAnswerScope): Promise<IoAnswerWire>;
 
-export { answerRequest, declareCapabilities, writeRows };
-export type { DeferredCallOutcome, KernelAnswerScope, KernelCallService, KernelHostPorts, SubstrateStreamSource };
+export { HostAskError, answerRequest, completeTls, consentFromRedirect, declareCapabilities, finishTls, hostAskReturn, kernelEventRequestParser, parseConsentRequest, parseSignInRequest, performHostAnswer, performHostAsk, writeRows };
+export type { DeferredCallOutcome, EventRequestParser, HeldGpuCompletion, HeldGpuPort, HostAskFailureKind, HostAskOutcome, HostAskReturn, HostAudioAsk, HostConsentAnswer, HostConsentRequest, HostSignInAnswer, HostSignInRequest, KernelAnswerScope, KernelCallService, KernelHostActions, KernelHostPorts, SubstrateStreamSource };

package/dist/kernel/host.js

@@ -1,9 +1,6 @@
-export { answerRequest, declareCapabilities, writeRows } from '../chunk-NATGCIVM.js';
-import '../chunk-HNOAZWFH.js';
-import '../chunk-YO4LWS3I.js';
-import '../chunk-MZKIL5IN.js';
+export { HostAskError, answerRequest, completeTls, consentFromRedirect, declareCapabilities, finishTls, hostAskReturn, kernelEventRequestParser, parseConsentRequest, parseSignInRequest, performHostAnswer, performHostAsk, writeRows } from '../chunk-JVSREWQO.js';
+import '../chunk-WGCWJOT2.js';
+import '../chunk-ZUSM4VW4.js';
 import '../chunk-FWA5K7Q2.js';
-import '../chunk-VMOBW7RK.js';
-import '../chunk-RBUMDYFS.js';
 import '../chunk-HLOUDLPI.js';
-import '../chunk-MLKGABMK.js';
+import '../chunk-MZKIL5IN.js';

package/dist/kernel/lane.d.ts

@@ -1,28 +1,7 @@
-interface LaneTurn {
-    readonly ticket: number;
-}
 declare class LaneHeldByParkedDispatch extends Error {
     readonly ticket: number;
     readonly event: string;
     constructor(ticket: number, event: string);
 }
-interface LaneGuard {
-    readonly turn: LaneTurn;
-    park(event: string): void;
-    resume(): void;
-    release(): void;
-}
-declare class DispatchLane {
-    private nextTicket;
-    private holder;
-    private depth;
-    private parkedEvent;
-    private readonly waiters;
-    assertCanReenter(turn: LaneTurn): void;
-    enter(turn?: LaneTurn): Promise<LaneGuard>;
-    private take;
-    private guard;
-}
 
-export { DispatchLane, LaneHeldByParkedDispatch };
-export type { LaneGuard, LaneTurn };
+export { LaneHeldByParkedDispatch };

package/dist/kernel/lane.js

@@ -1,2 +1 @@
-export { DispatchLane, LaneHeldByParkedDispatch } from '../chunk-53IPZXDP.js';
-import '../chunk-MLKGABMK.js';
+export { LaneHeldByParkedDispatch } from '../chunk-NU6LVKGS.js';

package/dist/kernel/os-fetch-port.d.ts

@@ -0,0 +1,7 @@
+import { OsHostPort } from './os-port.js';
+import '@almadar/core';
+import '@almadar/core/kernel-wire';
+
+declare function createFetchOsHost(performFetch: typeof fetch): OsHostPort;
+
+export { createFetchOsHost };

package/dist/kernel/os-fetch-port.js

@@ -0,0 +1,3 @@
+export { createFetchOsHost } from '../chunk-2WCVOMZ2.js';
+import '../chunk-ZUSM4VW4.js';
+import '../chunk-HLOUDLPI.js';