kobako 0.14.0 → 0.16.0

data/lib/kobako/transport/dispatcher.rb

@@ -13,7 +13,7 @@ module Kobako
   module Transport
     # Pure-function dispatcher for guest-initiated transport calls.
     # Decodes a msgpack-encoded Request envelope, resolves the target
-    # object through the Catalog::Namespaces (path lookup) or
+    # object through the Catalog::Services (path lookup) or
     # Catalog::Handles (Handle lookup), invokes the method, and returns
     # a msgpack-encoded Response envelope.
     #
@@ -24,7 +24,7 @@ module Kobako
     #
     # Entry point:
     #
-    #   Kobako::Transport::Dispatcher.dispatch(request_bytes, namespaces, handler, yield_to_guest)
+    #   Kobako::Transport::Dispatcher.dispatch(request_bytes, services, handler, yield_to_guest)
     #   # => msgpack-encoded Response bytes (never raises)
     module Dispatcher
       # Throw tag for the Yielder's break unwind back to the
@@ -67,7 +67,7 @@ module Kobako
 
       # Dispatch a single transport request and return the encoded
       # Response bytes. Invoked from the +Runtime#on_dispatch+ Proc that
-      # +Kobako::Sandbox#initialize+ installs on the ext side; +namespaces+,
+      # +Kobako::Sandbox#initialize+ installs on the ext side; +services+,
       # +handler+, and +yield_to_guest+ are captured in that Proc's
       # closure so the Dispatcher stays stateless and the registry doesn't
       # need to publish accessors for the Sandbox-owned +Catalog::Handles+
@@ -77,24 +77,31 @@ module Kobako
       # returns a binary String — every failure path is reified as a
       # Response.error envelope so the guest sees a transport error rather
       # than a wasm trap.
-      def dispatch(request_bytes, namespaces, handler, yield_to_guest)
-        request = Kobako::Transport::Request.decode(request_bytes)
-        target = resolve_target(request.target, namespaces, handler)
-        args, kwargs = resolve_call_args(request, handler)
+      #
+      # The decode runs inside +Codec.track_handles+ so #resolve_call_args
+      # can skip the argument walk when no Capability Handle crossed the
+      # wire.
+      def dispatch(request_bytes, services, handler, yield_to_guest)
+        request, carried_handle = Kobako::Codec.track_handles { Kobako::Transport::Request.decode(request_bytes) }
+        target = resolve_target(request.target, services, handler)
+        args, kwargs = resolve_call_args(request, handler, carried_handle)
         yielder = Yielder.new(yield_to_guest, BREAK_THROW, handler) if request.block_given
-        value = catch(BREAK_THROW) { invoke(target, request.method_name, args, kwargs, yielder) }
-        encode_ok(value, handler)
+        encode_ok(catch(BREAK_THROW) { invoke(target, request.method_name, args, kwargs, yielder) }, handler)
       rescue StandardError => e
         encode_caught_error(e)
       ensure
         yielder&.invalidate!
       end
 
-      # Resolve positional and keyword arguments off +request+ in one
-      # step. Both pass through #resolve_arg so Capability Handles
-      # round-trip back to the host-side Ruby object before the call
-      # reaches +public_send+.
-      def resolve_call_args(request, handler)
+      # Resolve positional and keyword arguments off +request+ in one step.
+      # +carried_handle+ reports whether the decode carried any Capability
+      # Handle; when it did not, every argument resolves to itself, so the
+      # decoded values pass straight through and the walk is skipped entirely.
+      # Otherwise both go through #resolve_arg so Handles round-trip back to
+      # the host-side Ruby object before the call reaches +public_send+.
+      def resolve_call_args(request, handler, carried_handle)
+        return [request.args, request.kwargs] unless carried_handle
+
         [request.args.map { |v| resolve_arg(v, handler) },
          request.kwargs.transform_values { |v| resolve_arg(v, handler) }]
       end
@@ -187,17 +194,17 @@ module Kobako
       # Target type is already validated by +Transport::Request.decode+
       # before this method is reached, so no else-branch is needed here —
       # the wire layer is the system boundary that enforces the invariant.
-      def resolve_target(target, namespaces, handler)
+      def resolve_target(target, services, handler)
         case target
         when String
-          resolve_path(target, namespaces)
+          resolve_path(target, services)
         when Kobako::Handle
           require_live_object!(target.id, handler)
         end
       end
 
-      def resolve_path(path, namespaces)
-        namespaces.lookup(path)
+      def resolve_path(path, services)
+        services.lookup(path)
       rescue KeyError => e
         raise UndefinedTargetError, e.message
       end

data/lib/kobako/transport/request.rb

@@ -12,7 +12,7 @@ module Kobako
     #
     # 5-element msgpack array:
     # +[target, method_name, args, kwargs, block_given]+. +target+ is
-    # either a +String+ (+"<Namespace>::<Member>"+, e.g. +"MyService::KV"+)
+    # either a +String+ (+"MyService::KV"+, e.g. +"MyService::KV"+)
     # or a Handle. SPEC pins +kwargs+ map keys to ext 0x00 Symbol;
     # enforced at construction so the Value Object is the single source of
     # truth. +block_given+ is a Boolean signalling whether the guest call
@@ -44,16 +44,21 @@ module Kobako
       end
 
       # Decode +bytes+ into a Request. Raises +Codec::InvalidType+ when the
-      # envelope is not the expected 5-element msgpack array, or when the
-      # Value Object's construction invariants reject the decoded fields.
+      # envelope is not the expected 5-element msgpack array, when any
+      # position carries an ext 0x02 Fault envelope (a Request is a payload
+      # position; the Response fault field is the envelope's only home), or
+      # when the Value Object's construction invariants reject the decoded
+      # fields.
       def self.decode(bytes)
-        Codec::Decoder.decode(bytes) do |arr|
-          unless arr.is_a?(Array) && arr.length == 5
-            raise Codec::InvalidType, "Request envelope is malformed (expected a 5-element array)"
-          end
+        Codec.forbid_faults do
+          Codec::Decoder.decode(bytes) do |arr|
+            unless arr.is_a?(Array) && arr.length == 5
+              raise Codec::InvalidType, "Request envelope is malformed (expected a 5-element array)"
+            end
 
-          target, method_name, args, kwargs, block_given = arr
-          new(target: target, method_name: method_name, args: args, kwargs: kwargs, block_given: block_given)
+            target, method_name, args, kwargs, block_given = arr
+            new(target: target, method_name: method_name, args: args, kwargs: kwargs, block_given: block_given)
+          end
         end
       end
 

data/lib/kobako/transport/response.rb

@@ -53,9 +53,16 @@ module Kobako
       def error? = status == STATUS_ERROR
 
       # Encode this Response to msgpack bytes as the 2-element
-      # +[status, payload]+ array.
+      # +[status, payload]+ array. The ok variant's value is a payload
+      # position, so a +Kobako::Fault+ inside it has no wire
+      # representation and surfaces as +UnsupportedType+ — the
+      # Dispatcher's auto-wrap rescue turns it into a Capability Handle.
+      # The error variant carries the Fault envelope in its one legal
+      # position and encodes it plainly.
       def encode
-        Codec::Encoder.encode([status, payload])
+        return Codec::Encoder.encode([status, payload]) if error?
+
+        Codec.forbid_faults { Codec::Encoder.encode([status, payload]) }
       end
 
       # Decode +bytes+ into a Response. Raises +Codec::InvalidType+ when the

data/lib/kobako/transport/yield.rb

@@ -70,7 +70,10 @@ module Kobako
         body = bytes.byteslice(1, bytes.bytesize - 1) # : String
 
         reject_dead_tag!(tag)
-        new(tag: tag, value: Codec::Decoder.decode(body))
+        # A YieldResponse is a payload position: an ext 0x02 Fault in its
+        # value is a wire violation (the Response fault field is the
+        # envelope's only home).
+        new(tag: tag, value: Codec.forbid_faults { Codec::Decoder.decode(body) })
       end
 
       def self.reject_dead_tag!(tag)

data/lib/kobako/transport/yielder.rb

@@ -52,8 +52,14 @@ module Kobako
       def yield(*args)
         raise LocalJumpError, "guest block invoked after host dispatch frame returned" unless @active
 
-        response = Kobako::Transport::Yield.decode(@yield_to_guest.call(Kobako::Codec::Encoder.encode(args)))
-        return restore(response.value) if response.ok?
+        # Yield arguments are a payload position: a +Kobako::Fault+ among
+        # them has no wire representation, so the encode refuses it at
+        # this call site. The tracking bracket below opens only around the
+        # decode: the guest re-entry may run nested dispatches whose own
+        # brackets would otherwise pollute the signal.
+        bytes = @yield_to_guest.call(Kobako::Codec.forbid_faults { Kobako::Codec::Encoder.encode(args) })
+        response, carried_handle = Kobako::Codec.track_handles { Kobako::Transport::Yield.decode(bytes) }
+        return restore(response.value, carried_handle) if response.ok?
 
         throw @break_tag, response.value if response.break?
 
@@ -78,10 +84,12 @@ module Kobako
       # Restore any Capability Handle in a block's ok value to its host
       # object via the injected +Catalog::Handles+. Only the
       # ok path calls this — host code consumes the ok value, whereas a
-      # break value returns to the guest and stays a Handle. Walks nested
-      # Array / Hash one level at a time; a plain value passes through
-      # unchanged.
-      def restore(value)
+      # break value returns to the guest and stays a Handle. A response
+      # whose decode carried no Handle resolves to itself, so the walk is
+      # skipped entirely.
+      def restore(value, carried_handle)
+        return value unless carried_handle
+
         Kobako::Codec::HandleWalk.deep_restore(value, @handler)
       end
 

data/lib/kobako/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Kobako
-  VERSION = "0.14.0"
+  VERSION = "0.16.0"
 end

data/lib/kobako.rb

@@ -10,6 +10,7 @@ rescue LoadError
 end
 
 require_relative "kobako/errors"
+require_relative "kobako/extension"
 require_relative "kobako/transport"
 require_relative "kobako/catalog"
 require_relative "kobako/runtime"

data/sig/kobako/catalog/extensions.rbs

@@ -0,0 +1,25 @@
+module Kobako
+  module Catalog
+    class Extensions
+      def initialize: () -> void
+
+      def install: (untyped extension, snippets: Kobako::Catalog::Snippets, services: Kobako::Catalog::Services) -> self
+
+      def seal!: () -> self
+
+      def refresh_backends!: (Kobako::Catalog::Services services) -> self
+
+      private
+
+      def refresh_backend: (untyped extension, Kobako::Catalog::Services services, Hash[untyped, untyped] resolved) -> void
+
+      def validate!: (untyped extension) -> void
+
+      def assert_dependencies!: () -> void
+
+      def callable?: (untyped provider) -> bool
+
+      def initial_object: (untyped provider) -> untyped
+    end
+  end
+end

data/sig/kobako/catalog/services.rbs

@@ -0,0 +1,27 @@
+module Kobako
+  module Catalog
+    class Services
+      NAME_PATTERN: Regexp
+
+      def initialize: (?handler: Kobako::Catalog::Handles) -> void
+
+      def bind: (Symbol | String path, untyped object) -> self
+
+      def lookup: (Symbol | String target) -> untyped
+
+      def refresh: (Symbol | String path, untyped object) -> self
+
+      def encode: () -> String
+
+      def seal!: () -> self
+
+      def sealed?: () -> bool
+
+      private
+
+      def validate_path!: (Symbol | String path) -> String
+
+      def collision?: (String path) -> bool
+    end
+  end
+end

data/sig/kobako/codec/ext_types.rbs

@@ -0,0 +1,31 @@
+module Kobako
+  module Codec
+    module ExtTypes
+      EXT_SYMBOL: Integer
+      EXT_HANDLE: Integer
+      EXT_ERRENV: Integer
+
+      def self?.build_factory: () -> MessagePack::Factory
+
+      def self?.pack_symbol: (Symbol symbol) -> String
+
+      def self?.unpack_symbol: (String payload) -> Symbol
+
+      def self?.pack_handle: (Kobako::Handle handle) -> String
+
+      def self?.unpack_handle: (String payload, State state) -> Kobako::Handle
+
+      def self?.pack_fault: (Kobako::Fault fault, State state) -> String
+
+      def self?.unpack_fault: (String payload, State state) -> Kobako::Fault
+
+      def self?.register_symbol: (MessagePack::Factory factory) -> void
+
+      def self?.register_handle: (MessagePack::Factory factory) -> void
+
+      def self?.register_fault: (MessagePack::Factory factory) -> void
+    end
+
+    FACTORY: MessagePack::Factory
+  end
+end

data/sig/kobako/codec/state.rbs

@@ -0,0 +1,20 @@
+module Kobako
+  module Codec
+    class State
+      MAX_EXT_DEPTH: Integer
+      STATE_KEY: Symbol
+
+      def self.current: () -> State
+
+      def track_handles: [T] { () -> T } -> [T, bool]
+      def record_handle!: () -> void
+      def forbid_faults: [T] { () -> T } -> T
+      def faults_forbidden?: () -> bool
+      def within_ext_frame: [T] (singleton(Kobako::Codec::Error) over_limit) { () -> T } -> T
+
+      private
+
+      def initialize: () -> void
+    end
+  end
+end

data/sig/kobako/codec.rbs

@@ -1,5 +1,8 @@
 module Kobako
   module Codec
+    def self.track_handles: [T] { () -> T } -> [T, bool]
+    def self.forbid_faults: [T] { () -> T } -> T
+
     # The Handle allocator/resolver a wire walk works against: alloc
     # registers a non-wire-representable object and returns its Handle,
     # fetch resolves a wire Handle id back to the live object. The

data/sig/kobako/extension.rbs

@@ -0,0 +1,20 @@
+module Kobako
+  class Extension < Data
+    attr_reader name: Symbol
+    attr_reader source: String
+    attr_reader backend: Kobako::Extension::Backend?
+    attr_reader depends_on: Array[Symbol]
+
+    def self.new: (name: Symbol, source: String, ?backend: Kobako::Extension::Backend?, ?depends_on: Array[Symbol]) -> Kobako::Extension
+
+    def initialize: (name: Symbol, source: String, ?backend: Kobako::Extension::Backend?, ?depends_on: Array[Symbol]) -> void
+
+    class Backend < Data
+      attr_reader path: String
+      attr_reader provider: untyped
+
+      def self.new: (path: String, provider: untyped) -> Kobako::Extension::Backend
+                  | (String path, untyped provider) -> Kobako::Extension::Backend
+    end
+  end
+end

data/sig/kobako/sandbox.rbs

@@ -29,7 +29,9 @@ module Kobako
 
     attr_reader usage: Kobako::Usage
 
-    def define: (Symbol | String name) -> Kobako::Namespace
+    def bind: (Symbol | String path, untyped object) -> Kobako::Sandbox
+
+    def install: (*untyped extensions) -> Kobako::Sandbox
 
     def preload: (code: String, name: Symbol | String) -> Kobako::Sandbox
                | (binary: String) -> Kobako::Sandbox

data/sig/kobako/transport/dispatcher.rbs

@@ -12,9 +12,9 @@ module Kobako
 
       CALLABLE_ALLOW: Array[Symbol]
 
-      def self?.dispatch: (String request_bytes, Kobako::Transport::_NamespaceRegistry namespaces, Kobako::Codec::_HandleTable handler, Kobako::Transport::_GuestYielder yield_to_guest) -> String
+      def self?.dispatch: (String request_bytes, Kobako::Transport::_ServiceRegistry services, Kobako::Codec::_HandleTable handler, Kobako::Transport::_GuestYielder yield_to_guest) -> String
 
-      def self?.resolve_call_args: (Kobako::Transport::Request request, Kobako::Codec::_HandleTable handler) -> [Array[untyped], Hash[Symbol, untyped]]
+      def self?.resolve_call_args: (Kobako::Transport::Request request, Kobako::Codec::_HandleTable handler, bool carried_handle) -> [Array[untyped], Hash[Symbol, untyped]]
 
       def self?.encode_caught_error: (StandardError error) -> String
 
@@ -26,9 +26,9 @@ module Kobako
 
       def self?.resolve_arg: (untyped value, Kobako::Codec::_HandleTable handler) -> untyped
 
-      def self?.resolve_target: (String | Kobako::Handle target, Kobako::Transport::_NamespaceRegistry namespaces, Kobako::Codec::_HandleTable handler) -> untyped
+      def self?.resolve_target: (String | Kobako::Handle target, Kobako::Transport::_ServiceRegistry services, Kobako::Codec::_HandleTable handler) -> untyped
 
-      def self?.resolve_path: (String path, Kobako::Transport::_NamespaceRegistry namespaces) -> untyped
+      def self?.resolve_path: (String path, Kobako::Transport::_ServiceRegistry services) -> untyped
 
       def self?.require_live_object!: (Integer id, Kobako::Codec::_HandleTable handler) -> untyped
 

data/sig/kobako/transport/yielder.rbs

@@ -16,7 +16,7 @@ module Kobako
 
       private
 
-      def restore: (untyped value) -> untyped
+      def restore: (untyped value, bool carried_handle) -> untyped
 
       def yield_failure: (untyped payload, default: String) -> RuntimeError
     end

data/sig/kobako/transport.rbs

@@ -10,10 +10,10 @@ module Kobako
     end
 
     # The Service registry a dispatch resolves constant-path targets
-    # against. The Sandbox's Kobako::Catalog::Namespaces is the
+    # against. The Sandbox's Kobako::Catalog::Services is the
     # production conformer; modelled structurally so the Transport
     # layer needs no upward dependency on Catalog.
-    interface _NamespaceRegistry
+    interface _ServiceRegistry
       def lookup: (String target) -> untyped
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kobako
 version: !ruby/object:Gem::Version
-  version: 0.14.0
+  version: 0.16.0
 platform: ruby
 authors:
 - Aotokitsuruya
@@ -91,20 +91,22 @@ files:
 - lib/kobako.rb
 - lib/kobako/capture.rb
 - lib/kobako/catalog.rb
+- lib/kobako/catalog/extensions.rb
 - lib/kobako/catalog/handles.rb
-- lib/kobako/catalog/namespaces.rb
+- lib/kobako/catalog/services.rb
 - lib/kobako/catalog/snippets.rb
 - lib/kobako/codec.rb
 - lib/kobako/codec/decoder.rb
 - lib/kobako/codec/encoder.rb
 - lib/kobako/codec/error.rb
-- lib/kobako/codec/factory.rb
+- lib/kobako/codec/ext_types.rb
 - lib/kobako/codec/handle_walk.rb
+- lib/kobako/codec/state.rb
 - lib/kobako/codec/utils.rb
 - lib/kobako/errors.rb
+- lib/kobako/extension.rb
 - lib/kobako/fault.rb
 - lib/kobako/handle.rb
-- lib/kobako/namespace.rb
 - lib/kobako/outcome.rb
 - lib/kobako/outcome/panic.rb
 - lib/kobako/pool.rb
@@ -129,20 +131,22 @@ files:
 - sig/kobako.rbs
 - sig/kobako/capture.rbs
 - sig/kobako/catalog.rbs
+- sig/kobako/catalog/extensions.rbs
 - sig/kobako/catalog/handles.rbs
-- sig/kobako/catalog/namespaces.rbs
+- sig/kobako/catalog/services.rbs
 - sig/kobako/catalog/snippets.rbs
 - sig/kobako/codec.rbs
 - sig/kobako/codec/decoder.rbs
 - sig/kobako/codec/encoder.rbs
 - sig/kobako/codec/error.rbs
-- sig/kobako/codec/factory.rbs
+- sig/kobako/codec/ext_types.rbs
 - sig/kobako/codec/handle_walk.rbs
+- sig/kobako/codec/state.rbs
 - sig/kobako/codec/utils.rbs
 - sig/kobako/errors.rbs
+- sig/kobako/extension.rbs
 - sig/kobako/fault.rbs
 - sig/kobako/handle.rbs
-- sig/kobako/namespace.rbs
 - sig/kobako/outcome.rbs
 - sig/kobako/outcome/panic.rbs
 - sig/kobako/pool.rbs

data/lib/kobako/catalog/namespaces.rb

@@ -1,115 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "handles"
-require_relative "../codec"
-require_relative "../errors"
-require_relative "../namespace"
-
-module Kobako
-  module Catalog
-    # Kobako::Catalog::Namespaces — per-Sandbox registry of
-    # +Kobako::Namespace+ entities. Holds the Namespace / Member bindings
-    # and the preamble emitted on Frame 1.
-    #
-    # Public API:
-    #
-    #   namespaces = Kobako::Catalog::Namespaces.new
-    #   namespace = namespaces.define(:MyService)  # => Kobako::Namespace
-    #   namespace.bind(:KV, kv_object)             # => namespace (chainable)
-    #   namespaces.encode                          # => msgpack bytes for Frame 1
-    #   namespaces.lookup("MyService::KV")         # => kv_object
-    #
-    # Namespaces live at +Kobako::Namespace+. Per-dispatch routing is
-    # +Kobako::Transport::Dispatcher+'s responsibility — the Dispatcher
-    # receives this registry and the +Catalog::Handles+ as arguments from
-    # the +Runtime#on_dispatch+ Proc that +Kobako::Sandbox#initialize+
-    # installs. The registry holds an injected +Catalog::Handles+ reference so
-    # dispatch target resolution and host→guest auto-wrap share the same
-    # Sandbox-owned allocator.
-    class Namespaces
-      # Build a fresh registry. +handler+ is an internal seam that injects
-      # a pre-configured +Catalog::Handles+; tests pass one whose +next_id+
-      # is pinned near +MAX_ID+ to exercise the cap-exhaustion path
-      # without 2³¹ allocations. Production callers leave it at the default.
-      def initialize(handler: Catalog::Handles.new)
-        @namespaces = {} # : Hash[String, Kobako::Namespace]
-        @handler = handler
-        @sealed = false
-        @encoded = nil # : String?
-      end
-
-      # Declare or retrieve the Namespace named +name+ (idempotent).
-      # +name+ is a constant-form name as a +Symbol+ or +String+ (must satisfy
-      # +Namespace::NAME_PATTERN+). Returns the +Kobako::Namespace+ for that
-      # name, creating it if it does not exist. Raises +ArgumentError+ when
-      # +name+ is malformed, or when called after the owning Sandbox has been
-      # sealed by its first invocation.
-      def define(name)
-        raise ArgumentError, "cannot define after first Sandbox invocation" if @sealed
-
-        name_str = name.to_s
-        unless Namespace::NAME_PATTERN.match?(name_str)
-          raise ArgumentError,
-                "Namespace name must match #{Namespace::NAME_PATTERN.inspect} (got #{name.inspect})"
-        end
-
-        @namespaces[name_str] ||= Namespace.new(name_str)
-      end
-
-      # Resolve a +target+ path of the form +"<Namespace>::<Member>"+
-      # (e.g. +"MyService::KV"+) to the bound Host object. +target+ is a
-      # two-level path using the +::+ separator. Returns the bound Host
-      # object. Raises +KeyError+ when the namespace or the member is not
-      # bound.
-      def lookup(target)
-        namespace_name, member_name = target.to_s.split("::", 2)
-        namespace = @namespaces[namespace_name]
-        raise KeyError, "no namespace named #{namespace_name.inspect}" if namespace.nil?
-        raise KeyError, "no member in target #{target.inspect}" unless member_name
-
-        namespace.fetch(member_name)
-      end
-
-      # Encode the preamble as msgpack bytes for stdin Frame 1 delivery.
-      # Routes through Kobako::Codec::Encoder like every other host-side
-      # wire encode so there is a single codec path; the preamble carries
-      # only Strings and Arrays, so none of the kobako ext types actually
-      # fire. Structure: +[["Namespace", ["MemberA", "MemberB"]], ...]+.
-      # Returns a binary +String+ of msgpack bytes.
-      #
-      # Once sealed, the bytes are computed once and reused for every
-      # subsequent invocation: sealing freezes Service registration at the
-      # first invocation, so the preamble is exactly the bindings that
-      # existed at that moment — a bind reaching a +Kobako::Namespace+
-      # after the seal raises +ArgumentError+ and never alters Frame 1.
-      # The memo is gated on the seal rather than dropped per mutation (the
-      # +Catalog::Snippets#encode+ approach) because a +Member+ bind lands
-      # on a child +Kobako::Namespace+, invisible to this collection; only
-      # the seal guarantees nothing further can change.
-      def encode
-        return @encoded if @encoded
-
-        bytes = Codec::Encoder.encode(@namespaces.values.map(&:to_preamble)).freeze
-        @encoded = bytes if @sealed
-        bytes
-      end
-
-      # Mark the registry as sealed and propagate the seal to every
-      # declared +Kobako::Namespace+. Called by +Sandbox+ on the first
-      # invocation. After sealing, both #define and +Namespace#bind+
-      # raise ArgumentError. Idempotent.
-      def seal!
-        return self if @sealed
-
-        @sealed = true
-        @namespaces.each_value(&:seal!)
-        self
-      end
-
-      # Returns +true+ when #seal! has been called, +false+ otherwise.
-      def sealed?
-        @sealed
-      end
-    end
-  end
-end