@almadar/shell-runtime 0.1.0 → 1.1.0

package/dist/kernel/os-port.d.ts

@@ -39,8 +39,8 @@ type OsRequirement = {
 };
 /** The grant decisions the wasm kernel owns (`OsGrants::allows`, the one-grant glob matcher, `is_public_address`). */
 interface OsGrantPort {
-    /** `OsGrants::allows` over the grants every registered program declares. */
-    allows(need: OsRequirement): boolean;
+    /** `OsGrants::allows` over the grants of `orbital` (its own plus the app level); with no orbital, the app level alone. */
+    allows(need: OsRequirement, orbital?: string): boolean;
     /** Whether the absolute `glob` (`**`, `*`, `?`) matches `path`, as a one-grant `fs_allows` for read. */
     globMatches(glob: string, path: string): boolean;
     /** `is_public_address`: the rule an outbound host name must pass. */
@@ -57,19 +57,20 @@ interface OsAnchorProblem {
 }
 /** What a host answers an `os` ask with; `close` drops every handle it holds, as the native `OsHandles::close_all`. */
 interface OsHostPort {
-    answer(op: OsOp, args: JsonValue[]): Promise<Settled<JsonValue, OsError>>;
+    /** `orbital` is the orbital whose trait made the ask: its grants (plus the app's) answer it. */
+    answer(op: OsOp, args: JsonValue[], orbital?: string): Promise<Settled<JsonValue, OsError>>;
     /**
      * `Completions::run_later`: a keyed ask of a completion-deferring op. A failed check (or a key already pending) is the
      * in-place `error`; `ok` means the work runs in the background and its outcome reaches `deliver` once, unless
      * the key is cancelled first. A host with no `defer` answers every ask in place.
      */
-    defer?(op: OsOp, args: JsonValue[], key: string, deliver: (outcome: Settled<JsonValue, OsError>) => void): Settled<null, OsError>;
+    defer?(op: OsOp, args: JsonValue[], key: string, deliver: (outcome: Settled<JsonValue, OsError>) => void, orbital?: string): Settled<null, OsError>;
     /**
      * A keyed stream (`OsOp::is_stream`, EXEC-QUEUE-12): the host binds and answers once in place, then hands each message
      * to `message` until it ends; `message` answers `false` when no one takes it any more. A failure after the answer
      * reaches `fail` once. A host with no `stream` answers every stream ask in place, as unsupported.
      */
-    stream?(op: OsOp, args: JsonValue[], key: string, message: (value: JsonValue) => boolean, fail: (error: OsError) => void): Promise<Settled<JsonValue, OsError>>;
+    stream?(op: OsOp, args: JsonValue[], key: string, message: (value: JsonValue) => boolean, fail: (error: OsError) => void, orbital?: string): Promise<Settled<JsonValue, OsError>>;
     /** `OsHandles::cancel_completion`: drop the pending completion of `key`, or stop its stream; `false` when none is open. */
     cancel?(key: string): boolean;
     close(): void;
@@ -85,6 +86,26 @@ interface OsCompletionPort {
     streams(op: OsOp): boolean;
     event(site: CallSiteWire, key: string, outcome: Settled<JsonValue, OsError>): OsCompletionEvent | null;
 }
+/** The next step of a TLS operation the kernel parked on a deferred raw ask. */
+type OsTlsStep = {
+    ask: {
+        op: OsOp;
+        args: JsonValue[];
+    };
+} | {
+    done: Settled<JsonValue, OsError>;
+};
+/** The kernel's TLS sockets (EXEC-HTTP-7): the host's raw outcome of a deferred ask goes in, the next raw ask or the program's outcome comes out. */
+interface OsTlsPort {
+    /** `null` when `key` parks no TLS operation. */
+    complete(key: string, outcome: Settled<JsonValue, OsError>): OsTlsStep | null;
+}
+/** The server handle's TLS export. */
+interface OsTlsKernel {
+    tlsComplete(key: string, outcomeJson: string): string;
+}
+/** The TLS port over the kernel `Server` handle: every decision is `RuntimeKernel::tls_complete`. */
+declare function kernelOsTls(server: () => OsTlsKernel): OsTlsPort;
 /** The kernel exports the completion port is built from. */
 interface OsCompletionMatchers {
     osDeferringOps(): string;
@@ -95,7 +116,7 @@ interface OsCompletionMatchers {
 declare function kernelOsCompletions(kernel: OsCompletionMatchers): OsCompletionPort;
 /** The kernel pieces a grant port is built from: the `Server` handle holding the program's grants and the module-level matchers. */
 interface OsGrantKernel {
-    osAllows(requirementJson: string): boolean;
+    osAllows(requirementJson: string, orbital?: string): boolean;
     setOsAnchors(anchorsJson: string): string;
     osResolveArgs(op: string, argsJson: string): string;
 }
@@ -113,6 +134,7 @@ interface OsAnchors {
     readonly home?: string;
     readonly start?: string;
     readonly exeDir?: string;
+    readonly exe?: string;
     readonly env?: Readonly<Record<string, string>>;
 }
 /** What a written path names under the host's anchors (`OsAnchors::expand`). */
@@ -129,5 +151,5 @@ declare function expandAnchor(anchors: OsAnchors, text: string): AnchoredPath;
 /** The grant port a host checks absolute paths through: an fs need also matches the program's `~/` and `./` grants (`OsGrants::fs_allows_at`). */
 declare function anchoredGrants(grants: OsGrantPort, anchors: OsAnchors): OsGrantPort;
 
-export { anchoredGrants, expandAnchor, kernelOsCompletions, kernelOsGrants };
-export type { AnchoredPath, OsAnchorProblem, OsAnchors, OsCompletionEvent, OsCompletionMatchers, OsCompletionPort, OsDesktopKind, OsFsMode, OsGrantKernel, OsGrantMatchers, OsGrantPort, OsHostPort, OsNetKind, OsRequirement, OsStdioKind, OsSysKind };
+export { anchoredGrants, expandAnchor, kernelOsCompletions, kernelOsGrants, kernelOsTls };
+export type { AnchoredPath, OsAnchorProblem, OsAnchors, OsCompletionEvent, OsCompletionMatchers, OsCompletionPort, OsDesktopKind, OsFsMode, OsGrantKernel, OsGrantMatchers, OsGrantPort, OsHostPort, OsNetKind, OsRequirement, OsStdioKind, OsSysKind, OsTlsKernel, OsTlsPort, OsTlsStep };

package/dist/kernel/os-port.js

@@ -1,2 +1 @@
-export { anchoredGrants, expandAnchor, kernelOsCompletions, kernelOsGrants } from '../chunk-REPX5QPI.js';
-import '../chunk-MLKGABMK.js';
+export { anchoredGrants, expandAnchor, kernelOsCompletions, kernelOsGrants, kernelOsTls } from '../chunk-BOVU4TCQ.js';

package/dist/kernel/program-effects.d.ts

@@ -1,7 +1,9 @@
-import { ProgramInspection, CatalogEntry, TraitDescription, BehaviorDescription, OrbitalSchema, EvaluatedProgram, ProgramValidationIssue, DependencyGraph, EventPayload, CircuitStepResult } from '@almadar/core';
+import { ProgramInspection, CatalogEntry, TraitDescription, BehaviorDescription, OrbitalSchema, EvaluatedProgram, ProgramValidationIssue, DependencyGraph, EventPayload } from '@almadar/core';
+import { ProveReport, OsGrantsReport, PlayedStep } from '@almadar/core/kernel-wire';
+export { PlayedStep } from '@almadar/core/kernel-wire';
 
 /** The effects the language trio routes to this host. */
-declare const PROGRAM_EFFECTS: readonly ["behavior/catalog", "behavior/describe", "behavior/source", "behavior/resolve", "behavior/dependencies", "program/read", "program/print", "program/eval", "program/validate", "program/compose", "program/step"];
+declare const PROGRAM_EFFECTS: readonly ["behavior/catalog", "behavior/describe", "behavior/source", "behavior/resolve", "behavior/dependencies", "program/read", "program/print", "program/eval", "program/validate", "program/prove", "program/os-grants", "program/compose", "program/step"];
 type ProgramEffectName = (typeof PROGRAM_EFFECTS)[number];
 /** Narrow an effect head to one this host runs. */
 declare function isProgramEffect(name: string): name is ProgramEffectName;
@@ -26,35 +28,16 @@ interface StepRequest {
     now?: number;
     /** A live call's cutoff: an open call still running after this many ms is cancelled. */
     settleMs?: number;
-    /** The user the request dispatches as (`@user`); null or absent is nobody. */
-    viewer?: EventPayload | null;
-}
-/** One trait the step's dispatch cascade moved, in dispatch order. */
-interface CascadeOutcome {
-    orbital: string;
-    trait: string;
-    /** The event this trait handled (a listener's own triggered event). */
-    event: string;
-    from: string;
-    to: string;
-    /** The arm that fired; null when none did. */
-    arm: number | null;
-    fired: boolean;
-    /** The effects of the arm this trait fired, as the top-level `effects` report them. */
-    effects: CircuitStepResult['effects'];
-    emitted: CircuitStepResult['emitted'];
-}
-/** A played request: the request as asked, and the circuit it ran, with every trait its cascade moved. */
-type PlayedStep = StepRequest & {
-    result: CircuitStepResult & {
-        outcomes: CascadeOutcome[];
-        entityAfter: EventPayload | null;
+    /** Test-only: the verified identity the replay kernel binds for this step (`@user`); absent is the anonymous viewer. */
+    identity?: {
+        subject: string;
+        claims: EventPayload;
     };
-};
+}
 /** The outcome of one program effect: the value for `{ result }`, or the failure (`errors` for eval's validator issues). */
 type ProgramEffectOutcome = {
     readonly ok: true;
-    readonly result: ProgramInspection | CatalogEntry[] | TraitDescription | BehaviorDescription | OrbitalSchema | string | EvaluatedProgram | ProgramValidationReport | DependencyGraph | PlayedStep[];
+    readonly result: ProgramInspection | CatalogEntry[] | TraitDescription | BehaviorDescription | OrbitalSchema | string | EvaluatedProgram | ProgramValidationReport | ProveReport | OsGrantsReport | DependencyGraph | PlayedStep[];
 } | {
     readonly ok: false;
     readonly error: string;
@@ -62,4 +45,4 @@ type ProgramEffectOutcome = {
 };
 
 export { PROGRAM_EFFECTS, isProgramEffect };
-export type { CascadeOutcome, PlayedStep, ProgramEffectName, ProgramEffectOutcome, ProgramValidationReport, StepRequest };
+export type { ProgramEffectName, ProgramEffectOutcome, ProgramValidationReport, StepRequest };

package/dist/kernel/program-effects.js

@@ -1,2 +1 @@
-export { PROGRAM_EFFECTS, isProgramEffect } from '../chunk-HNOAZWFH.js';
-import '../chunk-MLKGABMK.js';
+export { PROGRAM_EFFECTS, isProgramEffect } from '../chunk-WGCWJOT2.js';

package/dist/kernel/secret-ports.d.ts

@@ -0,0 +1,139 @@
+import { RuntimeValue, CredentialPayload } from '@almadar/core';
+import { TokenEndpointPost, CredentialVault } from '../credentials/vault.js';
+import { CredentialGrantWire, CredentialStanding, ConnectFailure } from '@almadar/core/kernel-wire';
+
+/**
+ * The host ports of the kernel's secret, random and credential asks: the secret store, the CSPRNG and the credential
+ * administration port. The `http` effect is retired (HTTP/1.1 is `.lolo` over `os/*`), so nothing here moves HTTP bytes.
+ */
+
+/**
+ * The host's secret store: a credential NAME in, its value out; `set` keeps a minted value for `ttlMs`.
+ * `principal` is the signed-in user's id for a user-scoped credential (the kernel sets it from the dispatch's `@user`,
+ * never the program); absent, the credential is app-wide.
+ */
+interface SecretStore {
+    get(name: string, principal?: string): Promise<string | undefined>;
+    /** `ttlMs` of 0 forgets the value. */
+    set(name: string, value: string, ttlMs: number, principal?: string): Promise<void>;
+    /** Replace the stored credential with `value`, durably (a rotated refresh token). A host without one cannot rotate. */
+    rotate?(name: string, value: string, principal?: string): Promise<void>;
+    /** Drop the credential, the minted value and the stored one. */
+    forget(name: string, principal?: string): Promise<void>;
+    /** Keep `value` as the credential until it is forgotten, creating it when absent: unlike `rotate` it needs no existing entry. `label` is a non-secret account name stored beside it, never the value. */
+    persist?(name: string, value: string, principal?: string, label?: string): Promise<void>;
+    /** The non-secret account label stored beside the credential; absent when its row carries none. */
+    label?(name: string, principal?: string): Promise<string | undefined>;
+    /** Whether `persist` keeps a value on this host. */
+    durable?(): Promise<boolean>;
+}
+/** The credential-store key of one user's credential. */
+declare function userCredentialKey(principal: string, name: string): string;
+/** CSPRNG output: `bytes` random bytes. */
+type RandomSource = (bytes: number) => Uint8Array;
+/**
+ * The host's raw credential store and mode flag, answered to the kernel's `credentialStore*` and `credentialMode*`
+ * asks. It decides nothing: the role gate, the declared-name check, the masking and the mode check are the kernel's.
+ */
+interface CredentialAdminPort {
+    /** Whether the store can encrypt and the service and name of every stored row; `null` when the host holds no store. */
+    list(): Promise<{
+        enabled: boolean;
+        entries: Array<{
+            service: string;
+            name: string;
+        }>;
+    } | null>;
+    /** The stored value of credential `name`, from the store only. */
+    read(name: string): Promise<string | null>;
+    write(service: string, name: string, value: string): Promise<void>;
+    /** Whether a stored row existed. */
+    remove(name: string): Promise<boolean>;
+    rotate(): Promise<{
+        rotated: number;
+        alreadyCurrent: number;
+        unreadable: number;
+    }>;
+    /** The mode flag; `null` when the host keeps none. */
+    mode(): Promise<string | null>;
+    /** Switch the flag; the host may refuse. The mode in force afterwards. */
+    setMode(mode: string): Promise<string>;
+}
+/** The tails of the named variables this host's own environment holds: `last4` only from eight characters up, never a value. */
+type EnvTailsPort = (names: readonly string[]) => Array<{
+    name: string;
+    last4?: string;
+}>;
+/** The environment tails of `env`: a name it holds non-empty, with the last four characters of a value of eight or more. */
+declare function envTailsOf(env: Readonly<Record<string, string | undefined>>): EnvTailsPort;
+/** The host's answer to a `credentialConnect` ask: the kernel's store builds the exchange and settles it, the host only sends it. */
+type CredentialConnectPort = (grant: CredentialGrantWire) => Promise<{
+    ok: CredentialStanding;
+} | {
+    error: ConnectFailure;
+}>;
+interface SecretPorts {
+    /** The host CSPRNG `random-bytes` and the driver's `Random` ask draw from. */
+    random: RandomSource;
+    secrets: SecretStore;
+    /** The credential store and mode flag the credential administration effects ask; absent, those asks fail unavailable. */
+    credentials?: CredentialAdminPort;
+    /** The host's own environment, for `credential-list`; absent, the host answers `unsupported` (a browser reads none). */
+    env?: EnvTailsPort;
+    /** Carries a `credentialConnect`; absent, the ask answers `unavailable`. */
+    connect?: CredentialConnectPort;
+}
+interface SecretPortsOptions {
+    random?: RandomSource;
+    secrets?: SecretStore;
+    /** Defaults to the installed credential store and mode flag. */
+    credentials?: CredentialAdminPort;
+    /** Defaults to the process environment. */
+    env?: EnvTailsPort;
+    /** The host's POST to a token endpoint; with it the credential store connects and refreshes OAuth credentials, without it neither is attempted. */
+    tokenPost?: TokenEndpointPost;
+}
+/** Where the secrets' durable credentials live: the store a host installed, and how a name resolves through it. */
+interface SecretStoreHost {
+    store(): Promise<CredentialVault | null>;
+    resolve(name: string, principal: string | undefined): Promise<string | undefined>;
+}
+/**
+ * The secrets of a host: minted values with an expiry (a memory tier that never reaches the rows), then the credential vault
+ * the host holds (by default the one the host installed). Everything durable is the kernel's: `rotate`, `persist`, `label`,
+ * and `forget`.
+ */
+declare function createSecretStore(now?: () => number, host?: SecretStoreHost, tokenPost?: TokenEndpointPost): SecretStore;
+/** `credentialConnect` over the installed credential store and the host's token POST. */
+declare function createCredentialConnectPort(post: TokenEndpointPost): CredentialConnectPort;
+/** The credential store and mode flag the host installed, as the kernel's raw asks. */
+declare function createCredentialAdminPort(): CredentialAdminPort;
+/** Bytes from the platform CSPRNG. */
+declare const systemRandom: RandomSource;
+/** The most bytes one `random-bytes` may ask for (the kernel's `RANDOM_BYTES_MAX`). */
+declare const RANDOM_BYTES_MAX = 1024;
+/** Standard padded base64 (the wire form of a `Random` answer). */
+declare function base64Standard(bytes: Uint8Array): string;
+/** URL-safe base64 without padding (the `random-bytes` value; the kernel's `codec::base64url_encode`). */
+declare function base64Url(bytes: Uint8Array): string;
+/**
+ * `random-bytes`: the success payload for `bytes` drawn from the host CSPRNG; a bad count or key is the effect's
+ * failure. A keyed call echoes its `key` beside the `value`.
+ */
+declare function randomBytesPayload(ports: Pick<SecretPorts, 'random'>, bytes: RuntimeValue | undefined, key?: RuntimeValue): {
+    value: string;
+    key?: string;
+};
+/** `credential-status`: a bare name selects the viewer; an explicit slot selects its declared scope. */
+declare function credentialStatusPayload(ports: Pick<SecretPorts, 'secrets'>, credential: RuntimeValue | undefined, principal: string | undefined): Promise<CredentialPayload>;
+/** `credential-forget`: drops the signed-in viewer's credential; `{ connected: false }`. */
+declare function credentialForgetPayload(ports: Pick<SecretPorts, 'secrets'>, credential: RuntimeValue | undefined, principal: string | undefined): Promise<{
+    connected: false;
+    label: string;
+}>;
+declare function createSecretPorts(options?: SecretPortsOptions): SecretPorts;
+/** Ports of a browser: it holds no credential, so a secret ask fails and the CSPRNG is the page's. */
+declare function createBrowserSecretPorts(): SecretPorts;
+
+export { RANDOM_BYTES_MAX, base64Standard, base64Url, createBrowserSecretPorts, createCredentialAdminPort, createCredentialConnectPort, createSecretPorts, createSecretStore, credentialForgetPayload, credentialStatusPayload, envTailsOf, randomBytesPayload, systemRandom, userCredentialKey };
+export type { CredentialAdminPort, CredentialConnectPort, EnvTailsPort, RandomSource, SecretPorts, SecretPortsOptions, SecretStore, SecretStoreHost };

package/dist/kernel/secret-ports.js

@@ -0,0 +1,2 @@
+export { RANDOM_BYTES_MAX, base64Standard, base64Url, createBrowserSecretPorts, createCredentialAdminPort, createCredentialConnectPort, createSecretPorts, createSecretStore, credentialForgetPayload, credentialStatusPayload, envTailsOf, randomBytesPayload, systemRandom, userCredentialKey } from '../chunk-ZUSM4VW4.js';
+import '../chunk-HLOUDLPI.js';

package/dist/kernel/wire.d.ts

@@ -1,36 +1,132 @@
 import { KernelEvaluatorExports } from '@almadar/core';
-export { CallRoutesWire, CallSiteWire, CallerWire, HttpBody, HttpFailureWire, HttpRequestWire, HttpResponseWire, IoAnswerWire, IoReplyWire, IoRequestWire, PendingRequestWire, ResolveProgressWire, ServerProgressWire, Settled, SubstrateFailureWire } from '@almadar/core/kernel-wire';
+import { EventRequest, FrameWire } from '@almadar/core/kernel-wire';
+export { CallRoutesWire, CallSiteWire, CallerWire, IoAnswerWire, IoReplyWire, IoRequestWire, NextWire, PendingRequestWire, ResolveProgressWire, ServerProgressWire, Settled, SubstrateFailureWire } from '@almadar/core/kernel-wire';
 
+/** Fired ticks keyed by the orbital that declares them: the one a `runTick` request is addressed to. */
+type FiredByOrbital = FrameWire['fired'];
+
+/** The wasm `GpuHost` (orbital-wasm): the browser's GPU answerer, installed into a kernel `Server` with `installGpu`. */
+interface KernelGpuHost {
+    closeAll(): void;
+}
+/**
+ * The wasm `Canvas3D` (orbital-wasm): orbital-canvas drawing a `canvas mode:"3d"` render node into a page canvas, on
+ * the device the page's `GpuHost` shares. JSON crosses as text; `pointerUp` answers the click it made.
+ */
+interface KernelCanvas3D {
+    /** `themeJson`: the page's resolved canvas theme, or `null`; orbital-canvas reads its scene axis, ground and tones. */
+    setScene(nodeJson: string, themeJson: string): void;
+    resize(cssWidth: number, cssHeight: number, pixelRatio: number): void;
+    setReducedMotion(reduced: boolean): void;
+    render(): void;
+    /** Advances the canvas clock to `nowMs` (`performance.now()`) with the page clock `epochMs` (`performance.timeOrigin + now`), eases a following camera and the orbit damping; true when the frame changed. */
+    frame(nowMs: number, epochMs: number): boolean;
+    /** False on the WebGL2 fallback, where GPU drawables are refused. */
+    webgpu(): boolean;
+    pointerDown(id: number, x: number, y: number, button: number, touch: boolean): void;
+    pointerMove(id: number, x: number, y: number): boolean;
+    pointerLeave(): void;
+    /** `{"unit":{"id","x","z"}}`, `{"tile":{"x","z"}}`, `{"select":{"id"}}`, `{"move":{"id","x","y"}}`, `{"shape":{"id","index"}}` (a learning canvas's click payload) or `null`. */
+    pointerUp(id: number, x: number, y: number, unitEvents: boolean, tileEvents: boolean): string;
+    wheel(deltaY: number): boolean;
+    /** The camera as the user moved it, as JSON, or `null` before a scene. */
+    camera(): string;
+    /** `[x, y, z]` as JSON; true when the camera moved. */
+    setCameraPosition(positionJson: string): boolean;
+    lookAt(targetJson: string): boolean;
+    resetCamera(): boolean;
+    free(): void;
+}
+/**
+ * The wasm `SceneCanvas` (orbital-wasm): orbital-canvas mapping and drawing a canvas-style render node (learning
+ * instruments, diagrams, a 2D game `canvas`) into a page canvas, with its own layout, clock and input.
+ */
+interface KernelSceneCanvas {
+    setScene(nodeJson: string): void;
+    resize(cssWidth: number, cssHeight: number, pixelRatio: number): void;
+    setMotion(enabled: boolean): void;
+    /** Advances the scene clock to `nowMs`; true while the page should keep drawing. */
+    frame(nowMs: number): boolean;
+    render(): void;
+    /** `touch-down`, `touch-move`, `touch-up` or `touch-cancel`, in CSS pixels. */
+    input(kind: string, x: number, y: number, button: number): void;
+    /** Whether the scene took the zoom (a pannable scene); the page scrolls when it did not. */
+    zoom(factor: number, x: number, y: number): boolean;
+    doubleTap(x: number, y: number): void;
+    /** `[{ "event", "payload" }]` queued by input. */
+    takeEvents(): string;
+    webgpu(): boolean;
+    free(): void;
+}
+/** Makes a `SceneCanvas` on a page canvas (`(canvas) => SceneCanvas.create(canvas)` from `@almadar/kernel/client`). */
+type KernelSceneCanvasFactory = (canvas: HTMLCanvasElement) => Promise<KernelSceneCanvas>;
+/** Makes a `Canvas3D` on a page canvas (`(canvas) => Canvas3D.create(canvas)` from `@almadar/kernel/client`). */
+type KernelCanvas3DFactory = (canvas: HTMLCanvasElement) => Promise<KernelCanvas3D>;
 /** The `Server` class of `@almadar/kernel` (wasm-bindgen), as the runtime uses it. */
 interface KernelServerHandle {
+    /** Install the GPU answerer: the server then holds every `gpu/` ask, and the host answers it by ticket. */
+    installGpu(gpu: KernelGpuHost): void;
+    /** Answer the held `gpu` ask `ticket`: the `IoAnswerWire` JSON to reply with. A deferred completion reaches `completed` as `HeldGpuCompletion` JSON, or `null`. */
+    answerGpu(ticket: number, completed: (completionJson: string) => void): Promise<string>;
+    /** Drop a held completion payload no request will start. */
+    dropHeldPayload(ticket: number): boolean;
     start(orbital: string, requestJson: string): string;
     resume(flight: number, repliesJson: string): string;
+    /** The oldest request the kernel queued, started now the lane is free: a `NextWire` as JSON, or `null`. */
+    next(): string;
+    /** Whether `flight` is a dispatch parked holding the lane. */
+    holdsLane(flight: number): boolean;
+    /** A live stream of `client`'s session opened (EXEC-DIST-9); answers the id that closes it. */
+    openSessionStream(client: string): number;
+    /** The live stream `id` dropped; the kernel frees its session once all have dropped and it is quiet. */
+    closeSessionStream(id: number): boolean;
     dispatchStream(): string;
-    liveItemDelivered(itemJson: string, viewerJson: string, clientId?: string): boolean;
-    /** A row-set reference resolved for a viewer through the host-answered store; a `ResolveProgressWire` as JSON. */
-    resolveRows(refJson: string, viewerJson: string): string;
+    /** Whether a live item reaches `clientId`'s session: addressed to it and admitted by `@read` for the identity that session bound. */
+    liveItemDelivered(itemJson: string, clientId?: string): boolean;
+    /** A row-set reference resolved through the host-answered store for the identity `clientId`'s session bound (the anonymous viewer with none); a `ResolveProgressWire` as JSON. */
+    resolveRows(refJson: string, clientId?: string): string;
     resumeResolve(flight: number, repliesJson: string): string;
     abandon(flight: number): boolean;
     /** `OsGrants::allows` over the grants the registered program declares; `requirementJson` is an `OsRequirement`. */
-    osAllows(requirementJson: string): boolean;
+    osAllows(requirementJson: string, orbital?: string): boolean;
+    /** Whether `url`'s origin is one the program declares in `egress`. */
+    egressAllows(url: string): boolean;
     /** Place the program's anchored grants and arguments under the host's anchors; answers `[{ path, message }]` for what grants nothing. */
     setOsAnchors(anchorsJson: string): string;
+    /** Feed a deferred raw `os` outcome (`Settled`) into the TLS operation parked under `key`: `null`, `{ ask }` or `{ done }`. */
+    tlsComplete(key: string, outcomeJson: string): string;
     /** An `os/` call's arguments with its anchored parts resolved; a `Settled<args, OsError>` as JSON. */
     osResolveArgs(op: string, argsJson: string): string;
     inFlight(): number;
     getState(traitName: string, entityId?: string): string;
-    setDefaultUser(userJson: string): void;
     /** The kernel's mounts for a host start on `side` (`client|server|process|start`): `MountSeed[]` as JSON. */
     bootMounts(side: string): string;
     /** The kernel's mounts for a client opening `routePath`: `MountSeed[]` as JSON. */
     routeMounts(routePath: string): string;
+    /** One question about the registered program (a `ContractQuery`: the declared inputs, inbound hooks, entity owner, scoped rows): its answer as JSON. */
+    contractQuery(queryJson: string): string;
     mount(traitsJson: string): void;
     remount(traitsJson: string): void;
-    setTickMount(traitsJson: string): void;
-    /** Mock-seed the `[runtime]` entities the kernel holds itself, owner columns stamped with `viewerId` (a preview host). */
-    seedRuntimeMock(viewerId?: string): void;
+    /** Whether the kernel holds the circuit state: a client's copy of it is then taken only on a delegated leg, and any other request carrying one is refused. */
+    setStateful(stateful: boolean): void;
+    /** `client` mounted the traits (`string[]` JSON) of `orbital`: their mount-scoped ticks fire while any client holds them. */
+    mountClient(client: string, orbital: string, traitsJson: string): void;
+    unmountClient(client: string, orbital: string, traitsJson: string): void;
+    /** `client` is gone: everything it mounted is released. */
+    releaseClient(client: string): void;
+    /** Queue the tick-stamped request (an `EventRequest` as JSON) of `orbital` for the coalesced peer relay: the window length in ms as JSON when it opened one, else `null`. */
+    relayTick(orbital: string, requestJson: string): string;
+    setTickRelayInterval(intervalMs: number): void;
+    /** Every queued relay item (`LiveBroadcastItem[]` as JSON); the window closes. */
+    flushTickRelay(): string;
+    /** Whether the program declares any tick. */
+    declaresTicks(): boolean;
+    /** One pass of the kernel's tick clock at monotonic `nowMs`: the `(trait, tick)` pairs due that this server runs, keyed by orbital, as `FiredByOrbital` JSON. */
+    tickPass(nowMs: number): string;
+    tickPause(): void;
+    tickResume(): void;
+    tickPaused(): boolean;
     setCapabilities(entityType: string, queryJson: string, writeJson: string): void;
-    setMessages(localesJson: string, catalogsJson: string): void;
     /** The program (as JSON) whose declared credentials this server's credential effects manage beside its own. */
     setManagedProgram(programJson: string): void;
     lastError(): string;
@@ -41,7 +137,8 @@ interface KernelServerHandle {
 }
 /** The `Server` constructor of a kernel module. */
 interface KernelServerClass {
-    new (resolvedSchemaJson: string): KernelServerHandle;
+    /** `lazyDir`: the folder the program's `uses lazy` files sit beside; the kernel loads each on the first dispatch that reaches it (EXEC-LOAD-2). */
+    new (resolvedSchemaJson: string, lazyDir?: string): KernelServerHandle;
 }
 /** An initialised `@almadar/kernel` module: what `OrbitalServerRuntime({ engine: 'kernel' })` is handed. */
 interface KernelModule extends KernelEvaluatorExports {
@@ -50,6 +147,8 @@ interface KernelModule extends KernelEvaluatorExports {
     osGlobMatches(glob: string, path: string): boolean;
     /** `is_public_address`: the rule an outbound host name must pass. */
     isPublicAddress(ip: string): boolean;
+    /** One `ContractQuery` (as JSON) answered for a host with no registered program: the kernel's own answer on an empty kernel, as JSON. */
+    contractQueryWithoutProgram(queryJson: string): string;
     /** The `os/` operations whose keyed call may defer its completion (`OsOp::defers_completion`), as a JSON array of names. */
     osDeferringOps(): string;
     /** The `os/` operations whose keyed call is a stream (`OsOp::is_stream`), as a JSON array of names. */
@@ -59,8 +158,10 @@ interface KernelModule extends KernelEvaluatorExports {
     substrateCompletionEvent(siteJson: string, key: string, op: string, argsJson: string, outcomeJson: string): string;
     /** Whether the Chrome match pattern matches the URL: the one rule a browser-tab host filters tabs with. */
     tabUrlMatches(pattern: string, url: string): boolean;
+    /** The typed event request a `program/dispatch` call names (`EventRequest::from_dispatch`); a record that is no event request throws the reason. */
+    parseEventRequest(payloadJson: string, optionsJson: string): EventRequest;
     /** Installs the language data (`@almadar/core/language-data` `LanguageBundle` as JSON) for a host with no `node_modules`; the first install wins. */
     installLanguage(bundleJson: string): void;
 }
 
-export type { KernelModule, KernelServerClass, KernelServerHandle };
+export type { FiredByOrbital, KernelCanvas3D, KernelCanvas3DFactory, KernelGpuHost, KernelModule, KernelSceneCanvas, KernelSceneCanvasFactory, KernelServerClass, KernelServerHandle };

package/dist/loader/fetch-loader.d.ts

@@ -0,0 +1,26 @@
+import { SchemaLoader, LoadResult, LoadedSchema, LoadedOrbital } from './schema-loader.js';
+import '@almadar/core';
+
+/**
+ * A `SchemaLoader` over HTTP: a browser client fetches the `.orb` of a lazy page (`uses lazy`) from beside the program
+ * it booted, at the page's `orbRef` resolved against the importer's URL (EXEC-LOAD-2: a browser client opens lazy pages
+ * through its own loader).
+ *
+ * @packageDocumentation
+ */
+
+declare class FetchSchemaLoader implements SchemaLoader {
+    private readonly base;
+    private readonly cache;
+    /** `base`: the URL relative imports resolve against when no importer is named (the page's own URL by default). */
+    constructor(base: string);
+    resolvePath(importPath: string, fromPath?: string): LoadResult<string>;
+    load(importPath: string, fromPath?: string): Promise<LoadResult<LoadedSchema>>;
+    loadOrbital(importPath: string, orbitalName?: string, fromPath?: string): Promise<LoadResult<LoadedOrbital>>;
+    clearCache(): void;
+    getCacheStats(): {
+        size: number;
+    };
+}
+
+export { FetchSchemaLoader };

package/dist/loader/fetch-loader.js

@@ -0,0 +1 @@
+export { FetchSchemaLoader } from '../chunk-57SBCUSM.js';

package/dist/loader/lazy-page.js

@@ -1,2 +1 @@
 export { loadLazyPage } from '../chunk-XXWNMJI6.js';
-import '../chunk-MLKGABMK.js';

package/dist/loader/schema-loader.d.ts

@@ -6,7 +6,6 @@ import { OrbitalSchema, Orbital, DeclaredTraitConfig } from '@almadar/core';
  * Abstract interface for loading OrbitalSchema files from various sources.
  * Implementations exist for:
  * - FileSystemLoader (Node.js) - uses fs module
- * - HttpLoader (Browser) - uses fetch API
  * - UnifiedLoader (Auto-detect) - routes to appropriate loader
  *
  * @packageDocumentation
@@ -68,17 +67,6 @@ interface BaseLoaderOptions {
     /** Scoped package roots (e.g., { "@game-lib": "/path/to/lib" }) */
     scopedPaths?: Record<string, string>;
 }
-/**
- * Options for HTTP loading.
- */
-interface HttpLoaderOptions extends BaseLoaderOptions {
-    /** Default fetch options */
-    fetchOptions?: RequestInit;
-    /** Request timeout in milliseconds */
-    timeout?: number;
-    /** Whether to use credentials (cookies, auth headers) */
-    credentials?: RequestCredentials;
-}
 /**
  * Abstract interface for schema loaders.
  *
@@ -92,10 +80,6 @@ interface HttpLoaderOptions extends BaseLoaderOptions {
  * const loader: SchemaLoader = new FileSystemLoader({ basePath: "/schemas" });
  * const result = await loader.load("./my-schema.orb");
  *
- * // Using HttpLoader (Browser)
- * const loader: SchemaLoader = new HttpLoader({ basePath: "/api/schemas" });
- * const result = await loader.load("./my-schema.orb");
- *
  * // Using UnifiedLoader (auto-detect)
  * const loader: SchemaLoader = createUnifiedLoader({ basePath: "/schemas" });
  * const result = await loader.load("./my-schema.orb");
@@ -157,4 +141,4 @@ interface ImportChainLike {
     clone(): ImportChainLike;
 }
 
-export type { BaseLoaderOptions, HttpLoaderOptions, ImportChainLike, LoadResult, LoadedOrbital, LoadedSchema, SchemaLoader };
+export type { BaseLoaderOptions, ImportChainLike, LoadResult, LoadedOrbital, LoadedSchema, SchemaLoader };

package/dist/persistence/native-memory.js

@@ -1,2 +1 @@
 export { NativeMemoryPersistenceAdapter, NativeMemoryWriteError } from '../chunk-7SDV3QWR.js';
-import '../chunk-MLKGABMK.js';

package/dist/runtime/entities/declaredCollections.d.ts

@@ -0,0 +1,6 @@
+import { PersistenceAdapter, Entity } from '@almadar/core';
+
+/** Tells the store each server-persisted entity's declared `[persistent: tbl]` collection (EXEC-STORE-1). */
+declare function bindDeclaredCollections(store: PersistenceAdapter, entities: readonly Entity[]): void;
+
+export { bindDeclaredCollections };

package/dist/runtime/entities/declaredCollections.js

@@ -0,0 +1 @@
+export { bindDeclaredCollections } from '../../chunk-BAS26HBN.js';