@czap/core 0.1.0

package/dist/brands.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Branded type factories for `@czap/core`.
+ *
+ * All custom brands use unique symbols for nominal typing safety.
+ * Brand helpers produce branded wrappers at zero runtime cost.
+ *
+ * Types are re-anchored from `@czap/_spine` (the canonical source) via local
+ * type aliases so the names remain valid value exports (runtime constructors)
+ * in the same module without triggering `isolatedModules` conflicts.
+ *
+ * @module
+ */
+import type { SignalInput as _SignalInput, ThresholdValue as _ThresholdValue, StateName as _StateName, ContentAddress as _ContentAddress, IntegrityDigest as _IntegrityDigest, AddressedDigest as _AddressedDigest, TokenRef as _TokenRef, Millis as _Millis } from '@czap/_spine';
+/** Branded input signal name. Dot-notation signal path (e.g. viewport.width, prefers-color-scheme). */
+export type SignalInput<I extends string = string> = _SignalInput<I>;
+/** Branded threshold number on a boundary. Finite number on the signal's continuous range. */
+export type ThresholdValue = _ThresholdValue;
+/** Branded state name -- e.g. 'mobile', 'tablet', 'desktop' */
+export type StateName<S extends string = string> = _StateName<S>;
+/**
+ * Content-addressed hash.
+ * Format: fnv1a:XXXXXXXX (8 hex digits). Computed from CBOR-canonical payload via FNV-1a hash.
+ */
+export type ContentAddress = _ContentAddress;
+/**
+ * Cryptographic content digest brand. Format: `sha256:<64-hex>` or `blake3:<64-hex>`.
+ * The algorithmic complement to ContentAddress for external/release artifacts (ADR-0011).
+ */
+export type IntegrityDigest = _IntegrityDigest;
+/** Pair of identity hash + cryptographic digest over the same canonical bytes (ADR-0011). */
+export type AddressedDigest = _AddressedDigest;
+/** Branded token reference name */
+export type TokenRef<N extends string = string> = _TokenRef<N>;
+/**
+ * Branded millisecond duration -- forces explicit wrapping of raw numbers at temporal API boundaries.
+ * Non-negative millisecond duration. Fractional values allowed. Use Millis(0) for immediate.
+ */
+export type Millis = _Millis;
+/** Hybrid Logical Clock */
+export interface HLC {
+    readonly wall_ms: number;
+    readonly counter: number;
+    readonly node_id: string;
+}
+/** Generic brand factory */
+export declare function brand<T, B extends symbol>(value: T): T & {
+    readonly [K in B]: true;
+};
+/** Wrap a plain string as a {@link SignalInput} — the one sanctioned cast site for this brand. */
+export declare const SignalInput: <I extends string>(value: I) => SignalInput<I>;
+/** Wrap a plain number as a {@link ThresholdValue} — the one sanctioned cast site for this brand. */
+export declare const ThresholdValue: (value: number) => ThresholdValue;
+/** Wrap a plain string as a {@link StateName} — the one sanctioned cast site for this brand. */
+export declare const StateName: <S extends string>(value: S) => StateName<S>;
+/** Wrap a plain string as a {@link ContentAddress} — the one sanctioned cast site for this brand. */
+export declare const ContentAddress: (value: string) => ContentAddress;
+/** Wrap a plain string as an {@link IntegrityDigest} — the one sanctioned cast site for this brand. */
+export declare const IntegrityDigest: (value: string) => IntegrityDigest;
+/** Wrap a plain string as a {@link TokenRef} — the one sanctioned cast site for this brand. */
+export declare const TokenRef: <N extends string>(value: N) => TokenRef<N>;
+/** Wrap a plain number as a {@link Millis} — the one sanctioned cast site for this brand. */
+export declare const Millis: (value: number) => Millis;
+//# sourceMappingURL=brands.d.ts.map

package/dist/brands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brands.d.ts","sourceRoot":"","sources":["../src/brands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EACV,WAAW,IAAI,YAAY,EAC3B,cAAc,IAAI,eAAe,EACjC,SAAS,IAAI,UAAU,EACvB,cAAc,IAAI,eAAe,EACjC,eAAe,IAAI,gBAAgB,EACnC,eAAe,IAAI,gBAAgB,EACnC,QAAQ,IAAI,SAAS,EACrB,MAAM,IAAI,OAAO,EAClB,MAAM,cAAc,CAAC;AAKtB,uGAAuG;AACvG,MAAM,MAAM,WAAW,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC;AAErE,8FAA8F;AAC9F,MAAM,MAAM,cAAc,GAAG,eAAe,CAAC;AAE7C,+DAA+D;AAC/D,MAAM,MAAM,SAAS,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;AAEjE;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,eAAe,CAAC;AAE7C;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAE/C,6FAA6F;AAC7F,MAAM,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAE/C,mCAAmC;AACnC,MAAM,MAAM,QAAQ,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC;AAE/D;;;GAGG;AACH,MAAM,MAAM,MAAM,GAAG,OAAO,CAAC;AAE7B,2BAA2B;AAC3B,MAAM,WAAW,GAAG;IAClB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,4BAA4B;AAC5B,wBAAgB,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG;IAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,GAAG,IAAI;CAAE,CAEpF;AAED,kGAAkG;AAClG,eAAO,MAAM,WAAW,GAAI,CAAC,SAAS,MAAM,EAAE,OAAO,CAAC,KAAG,WAAW,CAAC,CAAC,CAA4B,CAAC;AACnG,qGAAqG;AACrG,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,KAAG,cAAyC,CAAC;AACzF,gGAAgG;AAChG,eAAO,MAAM,SAAS,GAAI,CAAC,SAAS,MAAM,EAAE,OAAO,CAAC,KAAG,SAAS,CAAC,CAAC,CAA0B,CAAC;AAC7F,qGAAqG;AACrG,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,KAAG,cAAyC,CAAC;AACzF,uGAAuG;AACvG,eAAO,MAAM,eAAe,GAAI,OAAO,MAAM,KAAG,eAA2C,CAAC;AAC5F,+FAA+F;AAC/F,eAAO,MAAM,QAAQ,GAAI,CAAC,SAAS,MAAM,EAAE,OAAO,CAAC,KAAG,QAAQ,CAAC,CAAC,CAAyB,CAAC;AAC1F,6FAA6F;AAC7F,eAAO,MAAM,MAAM,GAAI,OAAO,MAAM,KAAG,MAAyB,CAAC"}

package/dist/brands.js

@@ -0,0 +1,31 @@
+/**
+ * Branded type factories for `@czap/core`.
+ *
+ * All custom brands use unique symbols for nominal typing safety.
+ * Brand helpers produce branded wrappers at zero runtime cost.
+ *
+ * Types are re-anchored from `@czap/_spine` (the canonical source) via local
+ * type aliases so the names remain valid value exports (runtime constructors)
+ * in the same module without triggering `isolatedModules` conflicts.
+ *
+ * @module
+ */
+/** Generic brand factory */
+export function brand(value) {
+    return value;
+}
+/** Wrap a plain string as a {@link SignalInput} — the one sanctioned cast site for this brand. */
+export const SignalInput = (value) => value;
+/** Wrap a plain number as a {@link ThresholdValue} — the one sanctioned cast site for this brand. */
+export const ThresholdValue = (value) => value;
+/** Wrap a plain string as a {@link StateName} — the one sanctioned cast site for this brand. */
+export const StateName = (value) => value;
+/** Wrap a plain string as a {@link ContentAddress} — the one sanctioned cast site for this brand. */
+export const ContentAddress = (value) => value;
+/** Wrap a plain string as an {@link IntegrityDigest} — the one sanctioned cast site for this brand. */
+export const IntegrityDigest = (value) => value;
+/** Wrap a plain string as a {@link TokenRef} — the one sanctioned cast site for this brand. */
+export const TokenRef = (value) => value;
+/** Wrap a plain number as a {@link Millis} — the one sanctioned cast site for this brand. */
+export const Millis = (value) => value;
+//# sourceMappingURL=brands.js.map

package/dist/brands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"brands.js","sourceRoot":"","sources":["../src/brands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAwDH,4BAA4B;AAC5B,MAAM,UAAU,KAAK,CAAsB,KAAQ;IACjD,OAAO,KAAwC,CAAC;AAClD,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,WAAW,GAAG,CAAmB,KAAQ,EAAkB,EAAE,CAAC,KAAuB,CAAC;AACnG,qGAAqG;AACrG,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAkB,EAAE,CAAC,KAAuB,CAAC;AACzF,gGAAgG;AAChG,MAAM,CAAC,MAAM,SAAS,GAAG,CAAmB,KAAQ,EAAgB,EAAE,CAAC,KAAqB,CAAC;AAC7F,qGAAqG;AACrG,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAkB,EAAE,CAAC,KAAuB,CAAC;AACzF,uGAAuG;AACvG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAa,EAAmB,EAAE,CAAC,KAAwB,CAAC;AAC5F,+FAA+F;AAC/F,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAmB,KAAQ,EAAe,EAAE,CAAC,KAAoB,CAAC;AAC1F,6FAA6F;AAC7F,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAe,CAAC"}

package/dist/caps.d.ts

@@ -0,0 +1,49 @@
+/**
+ * CapSet -- capability lattice.
+ *
+ * Re-parameterized from `@kit`: `pure < read < ... < system` becomes `static < styled < reactive < animated < gpu`.
+ *
+ * @module
+ */
+/**
+ * Rung on the rendering-capability ladder. Higher levels imply lower ones:
+ * `gpu > animated > reactive > styled > static`.
+ */
+export type CapLevel = 'static' | 'styled' | 'reactive' | 'animated' | 'gpu';
+/** Immutable set of {@link CapLevel}s — the tagged value returned by {@link Cap} combinators. */
+export interface CapSet {
+    readonly _tag: 'CapSet';
+    readonly levels: ReadonlySet<CapLevel>;
+}
+/**
+ * Cap — algebra over {@link CapSet}.
+ * Pure, immutable helpers for building, combining, and comparing capability
+ * sets; the underlying `CapLevel` lattice is totally ordered via {@link Cap.ordinal}.
+ */
+export declare const Cap: {
+    /** The empty {@link CapSet}. */
+    empty: () => CapSet;
+    /** Build a {@link CapSet} from an array of {@link CapLevel}s. */
+    from: (levels: ReadonlyArray<CapLevel>) => CapSet;
+    /** Return a new {@link CapSet} with the given level added. */
+    grant: (caps: CapSet, level: CapLevel) => CapSet;
+    /** Return a new {@link CapSet} with the given level removed. */
+    revoke: (caps: CapSet, level: CapLevel) => CapSet;
+    /** Whether a {@link CapSet} contains the given level. */
+    has: (caps: CapSet, level: CapLevel) => boolean;
+    /** Whether `a` contains every level of `b` (i.e. `a ⊇ b`). */
+    superset: (a: CapSet, b: CapSet) => boolean;
+    /** Set union of two {@link CapSet}s. */
+    union: (a: CapSet, b: CapSet) => CapSet;
+    /** Set intersection of two {@link CapSet}s. */
+    intersection: (a: CapSet, b: CapSet) => CapSet;
+    /** Whether `a` ranks `>=` `b` on the underlying ordered ladder. */
+    atLeast: (a: CapLevel, b: CapLevel) => boolean;
+    /** Integer ordinal for a {@link CapLevel} — useful for sorting / comparison. */
+    ordinal: (level: CapLevel) => number;
+};
+export declare namespace Cap {
+    /** Alias for {@link CapSet}. */
+    type Shape = CapSet;
+}
+//# sourceMappingURL=caps.d.ts.map

package/dist/caps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caps.d.ts","sourceRoot":"","sources":["../src/caps.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,KAAK,CAAC;AAU7E,iGAAiG;AACjG,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;CACxC;AA0CD;;;;GAIG;AACH,eAAO,MAAM,GAAG;IACd,gCAAgC;iBA9Cf,MAAM;IAgDvB,iEAAiE;mBA9C5C,aAAa,CAAC,QAAQ,CAAC,KAAG,MAAM;IAgDrD,8DAA8D;kBA3C1C,MAAM,SAAS,QAAQ,KAAG,MAAM;IA6CpD,gEAAgE;mBAxC3C,MAAM,SAAS,QAAQ,KAAG,MAAM;IA0CrD,yDAAyD;gBArCvC,MAAM,SAAS,QAAQ,KAAG,OAAO;IAuCnD,8DAA8D;kBArC1C,MAAM,KAAK,MAAM,KAAG,OAAO;IAuC/C,wCAAwC;eAhCvB,MAAM,KAAK,MAAM,KAAG,MAAM;IAkC3C,+CAA+C;sBA7BvB,MAAM,KAAK,MAAM,KAAG,MAAM;IA+BlD,mEAAmE;iBA1BhD,QAAQ,KAAK,QAAQ,KAAG,OAAO;IA4BlD,gFAAgF;qBA1BzD,QAAQ,KAAG,MAAM;CA4BzC,CAAC;AAEF,MAAM,CAAC,OAAO,WAAW,GAAG,CAAC;IAC3B,gCAAgC;IAChC,KAAY,KAAK,GAAG,MAAM,CAAC;CAC5B"}

package/dist/caps.js

@@ -0,0 +1,73 @@
+/**
+ * CapSet -- capability lattice.
+ *
+ * Re-parameterized from `@kit`: `pure < read < ... < system` becomes `static < styled < reactive < animated < gpu`.
+ *
+ * @module
+ */
+const LEVEL_ORD = {
+    static: 0,
+    styled: 1,
+    reactive: 2,
+    animated: 3,
+    gpu: 4,
+};
+const _empty = () => ({ _tag: 'CapSet', levels: new Set() });
+const _from = (levels) => ({
+    _tag: 'CapSet',
+    levels: new Set(levels),
+});
+const _grant = (caps, level) => ({
+    _tag: 'CapSet',
+    levels: new Set([...caps.levels, level]),
+});
+const _revoke = (caps, level) => ({
+    _tag: 'CapSet',
+    levels: new Set([...caps.levels].filter((l) => l !== level)),
+});
+const _has = (caps, level) => caps.levels.has(level);
+const _superset = (a, b) => {
+    for (const level of b.levels) {
+        if (!a.levels.has(level))
+            return false;
+    }
+    return true;
+};
+const _union = (a, b) => ({
+    _tag: 'CapSet',
+    levels: new Set([...a.levels, ...b.levels]),
+});
+const _intersection = (a, b) => ({
+    _tag: 'CapSet',
+    levels: new Set([...a.levels].filter((l) => b.levels.has(l))),
+});
+const _atLeast = (a, b) => LEVEL_ORD[a] >= LEVEL_ORD[b];
+const _ordinal = (level) => LEVEL_ORD[level];
+/**
+ * Cap — algebra over {@link CapSet}.
+ * Pure, immutable helpers for building, combining, and comparing capability
+ * sets; the underlying `CapLevel` lattice is totally ordered via {@link Cap.ordinal}.
+ */
+export const Cap = {
+    /** The empty {@link CapSet}. */
+    empty: _empty,
+    /** Build a {@link CapSet} from an array of {@link CapLevel}s. */
+    from: _from,
+    /** Return a new {@link CapSet} with the given level added. */
+    grant: _grant,
+    /** Return a new {@link CapSet} with the given level removed. */
+    revoke: _revoke,
+    /** Whether a {@link CapSet} contains the given level. */
+    has: _has,
+    /** Whether `a` contains every level of `b` (i.e. `a ⊇ b`). */
+    superset: _superset,
+    /** Set union of two {@link CapSet}s. */
+    union: _union,
+    /** Set intersection of two {@link CapSet}s. */
+    intersection: _intersection,
+    /** Whether `a` ranks `>=` `b` on the underlying ordered ladder. */
+    atLeast: _atLeast,
+    /** Integer ordinal for a {@link CapLevel} — useful for sorting / comparison. */
+    ordinal: _ordinal,
+};
+//# sourceMappingURL=caps.js.map

package/dist/caps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caps.js","sourceRoot":"","sources":["../src/caps.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,MAAM,SAAS,GAA6B;IAC1C,MAAM,EAAE,CAAC;IACT,MAAM,EAAE,CAAC;IACT,QAAQ,EAAE,CAAC;IACX,QAAQ,EAAE,CAAC;IACX,GAAG,EAAE,CAAC;CACP,CAAC;AAQF,MAAM,MAAM,GAAG,GAAW,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;AAErE,MAAM,KAAK,GAAG,CAAC,MAA+B,EAAU,EAAE,CAAC,CAAC;IAC1D,IAAI,EAAE,QAAQ;IACd,MAAM,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC;CACxB,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,KAAe,EAAU,EAAE,CAAC,CAAC;IACzD,IAAI,EAAE,QAAQ;IACd,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CACzC,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,KAAe,EAAU,EAAE,CAAC,CAAC;IAC1D,IAAI,EAAE,QAAQ;IACd,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;CAC7D,CAAC,CAAC;AAEH,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,KAAe,EAAW,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAEhF,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE;IAClD,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE,CAAC,CAAC;IAChD,IAAI,EAAE,QAAQ;IACd,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;CAC5C,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE,CAAC,CAAC;IACvD,IAAI,EAAE,QAAQ;IACd,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;CAC9D,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,CAAC,CAAW,EAAE,CAAW,EAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC;AAErF,MAAM,QAAQ,GAAG,CAAC,KAAe,EAAU,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAE/D;;;;GAIG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG;IACjB,gCAAgC;IAChC,KAAK,EAAE,MAAM;IACb,iEAAiE;IACjE,IAAI,EAAE,KAAK;IACX,8DAA8D;IAC9D,KAAK,EAAE,MAAM;IACb,gEAAgE;IAChE,MAAM,EAAE,OAAO;IACf,yDAAyD;IACzD,GAAG,EAAE,IAAI;IACT,8DAA8D;IAC9D,QAAQ,EAAE,SAAS;IACnB,wCAAwC;IACxC,KAAK,EAAE,MAAM;IACb,+CAA+C;IAC/C,YAAY,EAAE,aAAa;IAC3B,mEAAmE;IACnE,OAAO,EAAE,QAAQ;IACjB,gFAAgF;IAChF,OAAO,EAAE,QAAQ;CAClB,CAAC"}

package/dist/capsule.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Capsule — typed declaration of a business-logic unit that emits
+ * runtime behavior plus generated tests, benches, docs, and audit
+ * receipts through the czap factory.
+ *
+ * @module
+ */
+import { type Effect, Schema } from 'effect';
+import type { ContentAddress } from '@czap/_spine';
+/** Closed seven-arm catalog of capsule kinds. Adding an eighth requires ADR amendment. */
+export type AssemblyKind = 'pureTransform' | 'receiptedMutation' | 'stateMachine' | 'siteAdapter' | 'policyGate' | 'cachedProjection' | 'sceneComposition';
+/** Where a capsule may run. */
+export type Site = 'node' | 'browser' | 'worker' | 'edge';
+/** What services a capsule reads / writes. `_R` parameter carried for type-level inference. */
+export interface CapabilityDecl<_R> {
+    readonly reads: readonly string[];
+    readonly writes: readonly string[];
+    readonly effects?: readonly string[];
+}
+/** Performance + memory budgets a capsule promises to honor. */
+export interface BudgetDecl {
+    readonly p95Ms?: number;
+    readonly memoryMb?: number;
+    readonly allocClass?: 'zero' | 'bounded' | 'unbounded';
+}
+/** A typed invariant over input and output that the harness will check. */
+export interface Invariant<In, Out> {
+    readonly name: string;
+    readonly check: (input: In, output: Out) => boolean;
+    readonly message: string;
+}
+/** License and authorship metadata carried for audit receipts. */
+export interface AttributionDecl {
+    readonly license: string;
+    readonly author: string;
+    readonly url?: string;
+}
+/**
+ * The contract shape a capsule declaration must satisfy. The factory
+ * uses this to generate tests, benches, docs, and audit receipts.
+ *
+ * `run` is optional: when present, the harness invokes it inside generated
+ * property tests so each declared {@link Invariant} is checked against
+ * real (input, output) pairs sampled from the input schema. Without `run`
+ * the harness emits an `it.skip` honest-placeholder so vacuous tests can't
+ * masquerade as proof.
+ */
+export interface CapsuleContract<K extends AssemblyKind, In, Out, R> {
+    readonly _kind: K;
+    readonly id: ContentAddress;
+    readonly name: string;
+    readonly input: Schema.Schema<In>;
+    readonly output: Schema.Schema<Out>;
+    readonly capabilities: CapabilityDecl<R>;
+    readonly invariants: readonly Invariant<In, Out>[];
+    readonly budgets: BudgetDecl;
+    readonly site: readonly Site[];
+    readonly attribution?: AttributionDecl;
+    /**
+     * Optional pure-transform handler: takes a decoded input and returns a
+     * decoded output. Used by the harness to drive generated property tests
+     * end-to-end. Only meaningful for `pureTransform` arms today.
+     */
+    readonly run?: (input: In) => Out;
+}
+/**
+ * Runtime validator that verifies values against _spine-derived schemas.
+ * Used by capsule dispatchers to check inputs before invoking handlers.
+ */
+export declare const TypeValidator: {
+    readonly validate: <T>(schema: Schema.Codec<T, T, never>, value: unknown) => Effect.Effect<T, Schema.SchemaError>;
+};
+export declare namespace TypeValidator {
+    /** Effect returned by {@link TypeValidator.validate} on a successful decode. */
+    type Result<T> = Effect.Effect<T, Schema.SchemaError>;
+}
+//# sourceMappingURL=capsule.d.ts.map

package/dist/capsule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capsule.d.ts","sourceRoot":"","sources":["../src/capsule.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD,0FAA0F;AAC1F,MAAM,MAAM,YAAY,GACpB,eAAe,GACf,mBAAmB,GACnB,cAAc,GACd,aAAa,GACb,YAAY,GACZ,kBAAkB,GAClB,kBAAkB,CAAC;AAEvB,+BAA+B;AAC/B,MAAM,MAAM,IAAI,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE1D,+FAA+F;AAC/F,MAAM,WAAW,cAAc,CAAC,EAAE;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,gEAAgE;AAChE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAAC;CACxD;AAED,2EAA2E;AAC3E,MAAM,WAAW,SAAS,CAAC,EAAE,EAAE,GAAG;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,KAAK,OAAO,CAAC;IACpD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,kEAAkE;AAClE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe,CAAC,CAAC,SAAS,YAAY,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;IACjE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IAClB,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,SAAS,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;IACnD,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,GAAG,CAAC;CACnC;AAED;;;GAGG;AACH,eAAO,MAAM,aAAa;wBACf,CAAC,UAAU,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,SAAS,OAAO,KAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC;CAG5F,CAAC;AAEX,MAAM,CAAC,OAAO,WAAW,aAAa,CAAC;IACrC,gFAAgF;IAChF,KAAY,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;CAC9D"}

package/dist/capsule.js

@@ -0,0 +1,18 @@
+/**
+ * Capsule — typed declaration of a business-logic unit that emits
+ * runtime behavior plus generated tests, benches, docs, and audit
+ * receipts through the czap factory.
+ *
+ * @module
+ */
+import { Schema } from 'effect';
+/**
+ * Runtime validator that verifies values against _spine-derived schemas.
+ * Used by capsule dispatchers to check inputs before invoking handlers.
+ */
+export const TypeValidator = {
+    validate(schema, value) {
+        return Schema.decodeUnknownEffect(schema)(value);
+    },
+};
+//# sourceMappingURL=capsule.js.map

package/dist/capsule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capsule.js","sourceRoot":"","sources":["../src/capsule.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAe,MAAM,EAAE,MAAM,QAAQ,CAAC;AAyE7C;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,QAAQ,CAAI,MAAiC,EAAE,KAAc;QAC3D,OAAO,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;CACO,CAAC"}

package/dist/capsules/boundary-evaluate.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Capsule declaration wrapping `Boundary.evaluate` as a `pureTransform`
+ * instance. Proves the factory kernel against an existing, well-tested
+ * primitive with zero-allocation hot-path discipline.
+ *
+ * Input schema is structural — the run handler aligns the random
+ * thresholds + states arrays into a valid Boundary before evaluating.
+ * This way the harness-driven property tests exercise real boundary
+ * shapes without requiring the schema layer to encode the
+ * (thresholds.length === states.length, ascending, non-empty)
+ * invariants directly.
+ *
+ * @module
+ */
+/**
+ * Declared capsule for `Boundary.evaluate`. Registered in the module-level
+ * catalog at import time; walked by `scripts/capsule-compile.ts` during
+ * the gauntlet's `capsule:compile` phase.
+ */
+export declare const boundaryEvaluateCapsule: import("../assembly.js").CapsuleDef<"pureTransform", {
+    readonly states: readonly string[];
+    readonly thresholds: readonly number[];
+    readonly value: number;
+}, {
+    readonly state: string;
+    readonly matched: boolean;
+}, unknown>;
+//# sourceMappingURL=boundary-evaluate.d.ts.map

package/dist/capsules/boundary-evaluate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundary-evaluate.d.ts","sourceRoot":"","sources":["../../src/capsules/boundary-evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAkFH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;;;WA2BlC,CAAC"}

package/dist/capsules/boundary-evaluate.js

@@ -0,0 +1,117 @@
+/**
+ * Capsule declaration wrapping `Boundary.evaluate` as a `pureTransform`
+ * instance. Proves the factory kernel against an existing, well-tested
+ * primitive with zero-allocation hot-path discipline.
+ *
+ * Input schema is structural — the run handler aligns the random
+ * thresholds + states arrays into a valid Boundary before evaluating.
+ * This way the harness-driven property tests exercise real boundary
+ * shapes without requiring the schema layer to encode the
+ * (thresholds.length === states.length, ascending, non-empty)
+ * invariants directly.
+ *
+ * @module
+ */
+import { Schema } from 'effect';
+import { defineCapsule } from '../assembly.js';
+import { Boundary } from '../boundary.js';
+const EvaluateInputSchema = Schema.Struct({
+    // Random arrays — the run handler dedupes states and aligns lengths.
+    // We use Schema.Array (not NonEmptyArray) for compatibility with the
+    // edge case `length === 0`, which we handle by short-circuiting in run.
+    thresholds: Schema.Array(Schema.Number),
+    states: Schema.Array(Schema.String),
+    value: Schema.Number,
+});
+const EvaluateOutputSchema = Schema.Struct({
+    state: Schema.String,
+    matched: Schema.Boolean,
+});
+/**
+ * Build a valid Boundary from arbitrary input and evaluate it. When the
+ * input cannot form a valid boundary (empty states, too few thresholds
+ * after dedupe), we emit `{state: '', matched: false}` so invariants
+ * downstream can short-circuit on `matched`.
+ */
+function _runBoundary(input) {
+    // Dedupe state names and clamp to a usable count
+    const seenStates = new Set();
+    const uniqueStates = [];
+    for (const s of input.states) {
+        if (!seenStates.has(s)) {
+            seenStates.add(s);
+            uniqueStates.push(s);
+        }
+    }
+    if (uniqueStates.length === 0) {
+        return { state: '', matched: false };
+    }
+    // Build strictly-ascending thresholds. If we don't have enough unique
+    // thresholds for the available states, trim states to fit.
+    const sortedThresholds = [...input.thresholds].sort((a, b) => a - b);
+    const ascending = [];
+    let prev = Number.NEGATIVE_INFINITY;
+    for (const t of sortedThresholds) {
+        if (Number.isFinite(t) && t > prev) {
+            ascending.push(t);
+            prev = t;
+        }
+    }
+    // Boundary.make requires at least one [threshold, state] pair.
+    if (ascending.length === 0) {
+        // Fabricate a single-anchor boundary at 0 with the first state.
+        const onlyState = uniqueStates[0];
+        const b = Boundary.make({
+            input: 'cap.boundary-evaluate',
+            at: [[0, onlyState]],
+        });
+        const state = Boundary.evaluate(b, input.value);
+        return { state, matched: true };
+    }
+    const usableLen = Math.min(ascending.length, uniqueStates.length);
+    const pairs = [];
+    for (let i = 0; i < usableLen; i++) {
+        pairs.push([ascending[i], uniqueStates[i]]);
+    }
+    const b = Boundary.make({
+        input: 'cap.boundary-evaluate',
+        at: pairs,
+    });
+    const state = Boundary.evaluate(b, input.value);
+    return { state, matched: true };
+}
+/**
+ * Declared capsule for `Boundary.evaluate`. Registered in the module-level
+ * catalog at import time; walked by `scripts/capsule-compile.ts` during
+ * the gauntlet's `capsule:compile` phase.
+ */
+export const boundaryEvaluateCapsule = defineCapsule({
+    _kind: 'pureTransform',
+    name: 'core.boundary.evaluate',
+    input: EvaluateInputSchema,
+    output: EvaluateOutputSchema,
+    capabilities: { reads: [], writes: [] },
+    invariants: [
+        {
+            name: 'state-from-input-states-when-matched',
+            check: (input, output) => {
+                // When the run handler reports `matched`, the emitted state
+                // must be one of the input.states (after dedupe). When unmatched,
+                // the invariant trivially holds.
+                if (!output.matched)
+                    return true;
+                return input.states.includes(output.state);
+            },
+            message: 'emitted state must be one of input.states',
+        },
+        {
+            name: 'unmatched-implies-empty-state',
+            check: (_input, output) => output.matched || output.state === '',
+            message: 'unmatched outcomes must use empty-string state',
+        },
+    ],
+    budgets: { p95Ms: 0.1, allocClass: 'zero' },
+    site: ['node', 'browser', 'worker'],
+    run: (input) => _runBoundary(input),
+});
+//# sourceMappingURL=boundary-evaluate.js.map

package/dist/capsules/boundary-evaluate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundary-evaluate.js","sourceRoot":"","sources":["../../src/capsules/boundary-evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC;IACxC,qEAAqE;IACrE,qEAAqE;IACrE,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;IACvC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC,MAAM;CACrB,CAAC,CAAC;AACH,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,MAAM,CAAC,MAAM;IACpB,OAAO,EAAE,MAAM,CAAC,OAAO;CACxB,CAAC,CAAC;AASH;;;;;GAKG;AACH,SAAS,YAAY,CAAC,KAAoB;IACxC,iDAAiD;IACjD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAClB,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;IAED,sEAAsE;IACtE,2DAA2D;IAC3D,MAAM,gBAAgB,GAAG,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,IAAI,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;QACjC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;YACnC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,IAAI,GAAG,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IACD,+DAA+D;IAC/D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,gEAAgE;QAChE,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAE,CAAC;QACnC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC;YACtB,KAAK,EAAE,uBAAuB;YAC9B,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAU;SAC9B,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAChD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,KAAK,GAAqC,EAAE,CAAC;IACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,EAAE,YAAY,CAAC,CAAC,CAAE,CAAU,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC;QACtB,KAAK,EAAE,uBAAuB;QAC9B,EAAE,EAAE,KAAc;KACnB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,aAAa,CAAC;IACnD,KAAK,EAAE,eAAe;IACtB,IAAI,EAAE,wBAAwB;IAC9B,KAAK,EAAE,mBAAmB;IAC1B,MAAM,EAAE,oBAAoB;IAC5B,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;IACvC,UAAU,EAAE;QACV;YACE,IAAI,EAAE,sCAAsC;YAC5C,KAAK,EAAE,CAAC,KAAoB,EAAE,MAAsB,EAAW,EAAE;gBAC/D,4DAA4D;gBAC5D,kEAAkE;gBAClE,iCAAiC;gBACjC,IAAI,CAAC,MAAM,CAAC,OAAO;oBAAE,OAAO,IAAI,CAAC;gBACjC,OAAO,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7C,CAAC;YACD,OAAO,EAAE,2CAA2C;SACrD;QACD;YACE,IAAI,EAAE,+BAA+B;YACrC,KAAK,EAAE,CAAC,MAAqB,EAAE,MAAsB,EAAW,EAAE,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,KAAK,EAAE;YACxG,OAAO,EAAE,gDAAgD;SAC1D;KACF;IACD,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE;IAC3C,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;IACnC,GAAG,EAAE,CAAC,KAAoB,EAAkB,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC;CACnE,CAAC,CAAC"}

package/dist/capsules/canonical-cbor.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Capsule declaration wrapping CanonicalCbor as a `pureTransform`. Anchors
+ * the content-address kernel inside the 7-arm factory so the harness can
+ * audit the encoder alongside boundary evaluation and token buffering.
+ *
+ * @module
+ */
+/**
+ * Declared capsule for `CanonicalCbor.encode`. Registered in the module-level
+ * catalog at import time; walked by the factory compiler.
+ */
+export declare const canonicalCborCapsule: import("../assembly.js").CapsuleDef<"pureTransform", unknown, Uint8Array<ArrayBufferLike>, unknown>;
+//# sourceMappingURL=canonical-cbor.d.ts.map

package/dist/capsules/canonical-cbor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-cbor.d.ts","sourceRoot":"","sources":["../../src/capsules/canonical-cbor.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH;;;GAGG;AACH,eAAO,MAAM,oBAAoB,qGA2C/B,CAAC"}

package/dist/capsules/canonical-cbor.js

@@ -0,0 +1,60 @@
+/**
+ * Capsule declaration wrapping CanonicalCbor as a `pureTransform`. Anchors
+ * the content-address kernel inside the 7-arm factory so the harness can
+ * audit the encoder alongside boundary evaluation and token buffering.
+ *
+ * @module
+ */
+import { Schema } from 'effect';
+import { defineCapsule } from '../assembly.js';
+import { CanonicalCbor } from '../cbor.js';
+/**
+ * Declared capsule for `CanonicalCbor.encode`. Registered in the module-level
+ * catalog at import time; walked by the factory compiler.
+ */
+export const canonicalCborCapsule = defineCapsule({
+    _kind: 'pureTransform',
+    name: 'core.canonical-cbor',
+    input: Schema.Unknown,
+    output: Schema.instanceOf(Uint8Array),
+    capabilities: { reads: [], writes: [] },
+    invariants: [
+        {
+            name: 'output-is-uint8array',
+            check: (_input, output) => output instanceof Uint8Array,
+            message: 'encoder output must be Uint8Array',
+        },
+        {
+            name: 'key-order-stable',
+            check: (input, output) => {
+                // For plain objects, re-encoding a key-permuted shallow copy must
+                // produce identical bytes. Cheap structural check that binds the
+                // capsule's intent (canonical key order) to its observable output.
+                if (input === null || typeof input !== 'object' || Array.isArray(input) || input instanceof Uint8Array) {
+                    return true;
+                }
+                const keys = Object.keys(input);
+                if (keys.length < 2)
+                    return true;
+                // Use Object.fromEntries to build the reversed copy so dangerous keys
+                // like '__proto__' become own properties (not prototype assignments).
+                // Mutating `reversed[k] = ...` would set the prototype for k === '__proto__'
+                // and silently produce a different object shape than the input had.
+                const reversed = Object.fromEntries([...keys].reverse().map((k) => [k, input[k]]));
+                const reencoded = CanonicalCbor.encode(reversed);
+                if (reencoded.length !== output.length)
+                    return false;
+                for (let i = 0; i < output.length; i++) {
+                    if (reencoded[i] !== output[i])
+                        return false;
+                }
+                return true;
+            },
+            message: 'encoded output must be invariant under key permutation',
+        },
+    ],
+    budgets: { p95Ms: 1, allocClass: 'bounded' },
+    site: ['node', 'browser', 'worker', 'edge'],
+    run: (input) => CanonicalCbor.encode(input),
+});
+//# sourceMappingURL=canonical-cbor.js.map

package/dist/capsules/canonical-cbor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-cbor.js","sourceRoot":"","sources":["../../src/capsules/canonical-cbor.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAC;IAChD,KAAK,EAAE,eAAe;IACtB,IAAI,EAAE,qBAAqB;IAC3B,KAAK,EAAE,MAAM,CAAC,OAAO;IACrB,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;IACrC,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;IACvC,UAAU,EAAE;QACV;YACE,IAAI,EAAE,sBAAsB;YAC5B,KAAK,EAAE,CAAC,MAAe,EAAE,MAAkB,EAAW,EAAE,CAAC,MAAM,YAAY,UAAU;YACrF,OAAO,EAAE,mCAAmC;SAC7C;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,CAAC,KAAc,EAAE,MAAkB,EAAW,EAAE;gBACrD,kEAAkE;gBAClE,iEAAiE;gBACjE,mEAAmE;gBACnE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;oBACvG,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC;gBAC3D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACjC,sEAAsE;gBACtE,sEAAsE;gBACtE,6EAA6E;gBAC7E,oEAAoE;gBACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CACjC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAG,KAAiC,CAAC,CAAC,CAAC,CAAU,CAAC,CACpF,CAAC;gBACF,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACjD,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;oBAAE,OAAO,KAAK,CAAC;gBACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACvC,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;wBAAE,OAAO,KAAK,CAAC;gBAC/C,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,EAAE,wDAAwD;SAClE;KACF;IACD,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE;IAC5C,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC;IAC3C,GAAG,EAAE,CAAC,KAAc,EAAc,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;CACjE,CAAC,CAAC"}

package/dist/capsules/token-buffer.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Capsule declaration wrapping TokenBuffer as a stateMachine.
+ * Proves the factory kernel against a stateful LLM-token primitive
+ * with bounded-allocation discipline.
+ *
+ * @module
+ */
+/**
+ * Declared capsule for TokenBuffer. Registered in the module-level
+ * catalog at import time; walked by the factory compiler.
+ */
+export declare const tokenBufferCapsule: import("../assembly.js").CapsuleDef<"stateMachine", {
+    readonly _tag: "push";
+    readonly token: string;
+} | {
+    readonly _tag: "flush";
+} | {
+    readonly _tag: "reset";
+}, {
+    readonly phase: "idle" | "buffering" | "draining";
+    readonly tokens: readonly string[];
+    readonly totalBytes: number;
+}, unknown>;
+//# sourceMappingURL=token-buffer.d.ts.map

package/dist/capsules/token-buffer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-buffer.d.ts","sourceRoot":"","sources":["../../src/capsules/token-buffer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAmBH;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;WA2B7B,CAAC"}