Merge branch 'feat/python-consent-prompt'

Interactive wasi:http consent prompt in the /python demo: top-layer ConsentDialog + requestConsent wiring, relinked to @actcore/web-runtime with re-vendored policy-gated shims.

Author: GamePad64

package-lock.json

@@ -13,7 +13,7 @@
     "astro": "astro"
   },
   "dependencies": {
-    "@actcore/web-runtime": "file:../host-browser",
+    "@actcore/web-runtime": "file:../web-runtime",
     "@astrojs/rss": "^4.0.19",
     "@astrojs/sitemap": "^3.7.3",
     "@astrojs/starlight": "^0.41.2",

package.json

@@ -43,6 +43,10 @@
  * `network.Network` share the identical class the generated glue checks
  * `instanceof` against.
  */
+export interface SocketsPolicyPort {
+    noteSocketsDenied(): void;
+}
+export declare function __setSocketsPolicy(p: SocketsPolicyPort | null): void;
 declare function denyAccess(): never;
 declare class Network {
 }

public/host/shims/sockets.d.ts

@@ -1,5 +1,16 @@
 import { type ErrorCode } from './wasi-http-internal.js';
 import type { Duration, FieldName, FieldValue, Method, Scheme, StatusCode, Result } from '../generated/interfaces/wasi-http-types.js';
+import type { ResourceOp } from '../policy/types.js';
+/**
+ * Minimal port the http PEP calls. Widened in the consent task to resolve
+ * `ask`; `runComponent` installs the real engine before instantiation.
+ * v1 limitation: a single module-level slot ⇒ one governed component per
+ * page realm at a time (see the design spec).
+ */
+export interface HttpPolicyPort {
+    decideHttp(op: ResourceOp): Promise<'allow' | 'deny'>;
+}
+export declare function __setActivePolicy(p: HttpPolicyPort | null): void;
 type Headers = Fields;
 type Trailers = Fields;
 export declare class Fields {