@datafog/node 0.5.0-beta.2 → 1.0.0

package/index.d.ts

@@ -122,6 +122,11 @@ export interface ScanAndTransformConfig {
 }
 
 export type DataFogErrorCode =
+  | "closed_workspace" | "invalid_operation" | "operation_reused"
+  | "invalid_conversation" | "conversation_unknown" | "conversation_pending" | "invalid_send_intent"
+  | "inactive_plan" | "workspace_conflict" | "invalid_batch"
+  | "invalid_encoding" | "inactive_stream"
+  | "invalid_marker" | "invalid_snapshot" | "invalid_operation_id" | "invalid_policy" | "resource_limit"
   | "invalid_configuration"
   | "invalid_finding"
   | "review_conflict"
@@ -147,7 +152,12 @@ export declare class DataFogError extends Error {
   readonly code: DataFogErrorCode;
   readonly reason?: string;
   readonly path?: string;
-  readonly findingIndex?: number;
+  readonly findingIndex?: number | null;
+  readonly inputIndex?: number | null;
+  readonly markerIssues?: readonly WorkspaceMarkerIssue[];
+  readonly reviewConflicts?: readonly WorkspaceReviewConflict[];
+  readonly delivered?: WorkspaceRestoreProgress;
+  readonly complete?: false;
 }
 
 export interface KeyProviderRequest {
@@ -245,6 +255,251 @@ export declare function scanAndTransformStructured(data: JsonDocument, config: S
 
 export interface StructuredTransformResult { readonly data: JsonDocument; readonly transformations: StructuredTransformation[]; }
 export interface StructuredRestoreResult { readonly data: JsonDocument; readonly restorations: StructuredRestoration[]; }
+
+/** Caller-declared review origin, not an authorization or authenticity claim. */
+export type WorkspaceFindingSource = "scanner" | "recall" | "user";
+
+/** Provisional workspace input; exact values and type codes are never normalized. */
+export interface WorkspaceFinding {
+  readonly entityType: string;
+  readonly matchedText: string;
+  readonly range: TextRange & { readonly unit: "utf8_bytes" };
+  readonly confidence?: number | null;
+  readonly detectorName?: string | null;
+  readonly detectorVersion?: string | null;
+  /** Defaults to scanner for existing callers; not inferred from detectorName. */
+  readonly source?: WorkspaceFindingSource;
+  /** Defaults to true. False does not waive host approval/save/activation. */
+  readonly needsReview?: boolean;
+}
+/** One batch input; finding offsets are relative to this text only. */
+export interface WorkspaceInput {
+  readonly text: string;
+  readonly findings: readonly WorkspaceFinding[];
+}
+export interface WorkspaceHead { readonly revision: string; readonly commitId: readonly number[]; }
+export interface WorkspaceRecalledFinding {
+  readonly finding: WorkspaceFinding & {readonly source: "recall"; readonly needsReview: true};
+  readonly byteRange: TextRange;
+  readonly codepointRange: TextRange;
+  readonly utf16Range: TextRange;
+}
+export interface WorkspaceRecallResult {
+  readonly head: WorkspaceHead;
+  /** All matches or an explicit failure. Empty is not a clean-text verdict. */
+  readonly complete: true;
+  readonly findings: readonly WorkspaceRecalledFinding[];
+}
+export interface WorkspacePreview {
+  readonly text: string;
+  readonly transformations: readonly {
+    readonly source: WorkspaceFindingSource;
+    readonly needsReview: boolean;
+    readonly sourceByteRange: TextRange;
+    readonly sourceCodepointRange: TextRange;
+    readonly sourceUtf16Range: TextRange;
+    readonly outputByteRange: TextRange;
+    readonly outputCodepointRange: TextRange;
+    readonly outputUtf16Range: TextRange;
+  }[];
+}
+export type WorkspaceTypeRule = "hide" | "keep";
+export type WorkspaceChoiceDisposition = "keep" | "not_sensitive";
+export interface WorkspacePolicyEdits {
+  readonly rules: readonly {readonly entityType: string; readonly rule: WorkspaceTypeRule | null}[];
+  readonly choices: readonly {readonly entityType: string; readonly value: string; readonly disposition: WorkspaceChoiceDisposition | null}[];
+}
+export interface WorkspacePolicy {
+  readonly snapshotVersion: 1 | 2 | 3;
+  readonly defaultRule: "hide";
+  readonly protectedTypes: readonly string[];
+  readonly rules: readonly {readonly entityType: string; readonly rule: WorkspaceTypeRule}[];
+  readonly choices: readonly {readonly entityType: string; readonly value: string; readonly disposition: WorkspaceChoiceDisposition}[];
+}
+export interface WorkspacePolicyPreview {
+  readonly rules: readonly {readonly entityType: string; readonly before: WorkspaceTypeRule | null; readonly after: WorkspaceTypeRule | null}[];
+  readonly choices: readonly {readonly entityType: string; readonly value: string; readonly before: WorkspaceChoiceDisposition | null; readonly after: WorkspaceChoiceDisposition | null}[];
+}
+export interface PreparedWorkspaceChange {
+  /** Intent IDs are owned metadata, never proof of a send. */
+  sendIntents(): readonly WorkspaceSendIntent[];
+  /** Warn before a saved format upgrade: beta.1 cannot open v2, and beta.1/beta.2 cannot open v3. */
+  snapshotFormat(): {readonly currentVersion: 1 | 2 | 3; readonly candidateVersion: 1 | 2 | 3};
+  /** Present only for settings edits; values are sensitive and remain local. */
+  policyPreview(): WorkspacePolicyPreview | null;
+  /** Requires a single-input plan. */
+  preview(): WorkspacePreview;
+  previews(): readonly WorkspacePreview[];
+  heads(): { readonly expectedHead: WorkspaceHead; readonly candidateHead: WorkspaceHead };
+  /** Sensitive plaintext for the trusted encrypting host only. */
+  exportCandidateBundle(): Uint8Array;
+  discard(): void;
+}
+/** Content-free source or output issue ranges; never contains a source or restored value. */
+export interface WorkspaceMarkerIssue {
+  /** unknown: well formed but never committed here; damaged: unparseable marker; unbracketed: committed code without brackets. */
+  readonly kind: "unknown" | "damaged" | "unbracketed" | "not_issued_in_conversation";
+  readonly byteRange: TextRange;
+  readonly codepointRange: TextRange;
+  readonly utf16Range: TextRange;
+}
+export interface WorkspaceRestoreReport {
+  /** Present only when every marker resolved and `issues` is empty. */
+  readonly text: string | null;
+  readonly restoredMarkers: number;
+  readonly issues: readonly WorkspaceMarkerIssue[];
+}
+export interface WorkspaceReviewInput {
+  readonly text: string;
+  /** Model/rule findings; caller source flags are ignored for channel attribution. */
+  readonly scannerFindings: readonly WorkspaceFinding[];
+  readonly userSelections: readonly WorkspaceFinding[];
+  readonly corrections?: readonly { readonly candidateKey: string; readonly replacement: WorkspaceFinding }[];
+}
+export interface WorkspaceReviewConflict {
+  readonly kind: "protected_coverage" | "type_conflict";
+  readonly findingIndex: number;
+  readonly byteRange: TextRange;
+  readonly codepointRange: TextRange;
+  readonly utf16Range: TextRange;
+}
+export interface WorkspaceReviewCandidate {
+  /** Binds exact source/head/type/range; changes on source edits or saved-head changes. */
+  readonly key: string;
+  readonly finding: WorkspaceFinding;
+  readonly sources: readonly ("scanner" | "recall" | "user")[];
+  readonly byteRange: TextRange;
+  readonly codepointRange: TextRange;
+  readonly utf16Range: TextRange;
+  /** Committed policy requires this candidate to be hidden. */
+  readonly eligible: boolean;
+  /** Conflict-free selection only; false for every candidate while conflicts remain. Never handoff permission. */
+  readonly selected: boolean;
+}
+export interface WorkspaceReviewResult {
+  readonly head: WorkspaceHead;
+  readonly candidates: readonly WorkspaceReviewCandidate[];
+  readonly conflicts: readonly WorkspaceReviewConflict[];
+}
+export interface WorkspaceOperation { readonly id: Uint8Array; readonly occurredAtMs: number; }
+export interface WorkspaceConversation {
+  /** Private immutable host-generated ID, independent of the site's ID. */
+  readonly id: Uint8Array | readonly number[];
+  readonly surface: string;
+  /** Required null for an initially unbound first chat. Bind once after observed send. */
+  readonly siteId: string | null;
+  /** Immutable pre-send maximum UTF-8 bytes; the host must substantiate this bound. */
+  readonly siteIdByteBudget: number;
+}
+export interface WorkspaceConversationInput { readonly input: WorkspaceReviewInput; readonly conversation: WorkspaceConversation; }
+export interface WorkspaceSendIntent { readonly preparationId: Uint8Array | readonly number[]; readonly inputIndex: number; }
+export interface WorkspaceConversationState { readonly conversation: WorkspaceConversation; readonly pendingIntents: number; readonly issuedMarkers: number; }
+export type WorkspaceSendStatus = "pending" | "observed_sent" | "definitely_not_sent";
+export type WorkspaceOutcomeKind = "copy_confirmed" | "user_cancelled" | "blocked_input" | "restore_blocked";
+export interface WorkspaceOutcome { readonly kind: WorkspaceOutcomeKind; readonly issueCount: number; }
+export interface WorkspaceOperationRecord {
+  readonly id: readonly number[];
+  readonly kind: "create" | "prepare" | "recovery" | "policy_change" | "conversation_prepare" | "send_confirmed" | "send_not_sent" | WorkspaceOutcomeKind;
+  readonly occurredAtMs: number | null;
+  readonly preparedInputs: number;
+  readonly transformedSpans: number;
+}
+export interface WorkspaceOperationPage {
+  readonly records: readonly WorkspaceOperationRecord[];
+  readonly total: number;
+  readonly offset: number;
+  readonly nextOffset: number | null;
+}
+export interface WorkspaceHistoryCoverage {
+  readonly recordedHistoryOnly: true;
+  readonly preUpgradeHistory: "unknown" | "not_applicable";
+}
+export interface WorkspaceCounts {
+  readonly operations: number; readonly preparedInputs: number; readonly transformedSpans: number;
+  readonly confirmedHandoffs: number; readonly reportedBlockedAttempts: number;
+}
+export type WorkspaceRestoreEncoding = "utf8" | "utf16";
+export interface WorkspaceRestoreProgress {
+  readonly bytes: number;
+  readonly codepoints: number;
+  readonly utf16: number;
+  readonly restoredMarkers: number;
+}
+export interface WorkspaceRestoreChunk {
+  readonly text: string;
+  readonly delivered: WorkspaceRestoreProgress;
+  /** Only successful finalization is complete; prior chunks cannot be retracted. */
+  readonly complete: boolean;
+}
+export interface WorkspaceBufferedRestore {
+  feed(bytes: Uint8Array): void;
+  feedUtf16(units: Uint16Array): void;
+  finalize(): WorkspaceRestoreReport;
+  reset(): void;
+  close(): void;
+}
+export interface WorkspaceProgressiveRestore {
+  feed(bytes: Uint8Array): WorkspaceRestoreChunk;
+  feedUtf16(units: Uint16Array): WorkspaceRestoreChunk;
+  finalize(): WorkspaceRestoreChunk;
+  reset(): void;
+  close(): void;
+}
+export class Workspace {
+  private constructor();
+  static createWithOperation(namespace: Uint8Array, operation: WorkspaceOperation): Workspace;
+  static create(namespace: Uint8Array, operationId: Uint8Array): Workspace;
+  static openBundle(bytes: Uint8Array): Workspace;
+  head(): WorkspaceHead;
+  namespace(): Uint8Array;
+  exportBundle(): Uint8Array;
+  /** Read committed values only, returning all overlaps in original coordinates. No aliases, plans or state changes. */
+  recall(text: string): WorkspaceRecallResult;
+  /** Combine supplied scanner/manual findings with committed recall, without plans or state mutation. */
+  review(input: WorkspaceReviewInput): WorkspaceReviewResult;
+  /** Recompute review for every input. Any unresolved overlap rejects the whole batch before a plan exists. Approval and durable save remain required. */
+  prepareReview(inputs: readonly WorkspaceReviewInput[], operationId: Uint8Array): PreparedWorkspaceChange;
+  operations(): readonly WorkspaceOperationRecord[];
+  operationsPage(offset: number, limit: number): WorkspaceOperationPage;
+  counts(): WorkspaceCounts;
+  historyCoverage(): WorkspaceHistoryCoverage;
+  prepareWithOperation(text: string, findings: readonly WorkspaceFinding[], operation: WorkspaceOperation): PreparedWorkspaceChange;
+  prepareBatchWithOperation(inputs: readonly WorkspaceInput[], operation: WorkspaceOperation): PreparedWorkspaceChange;
+  prepareRecoveryWithOperation(operation: WorkspaceOperation): PreparedWorkspaceChange;
+  prepareOutcome(outcome: WorkspaceOutcome, operation: WorkspaceOperation): PreparedWorkspaceChange;
+  /** Funds the later resolution before any external handoff; save/activate explicitly. */
+  prepareConversationSend(inputs: readonly WorkspaceConversationInput[], operation: WorkspaceOperation): PreparedWorkspaceChange;
+  conversation(logicalId: Uint8Array): WorkspaceConversationState;
+  conversationForSite(surface: string, siteId: string): Uint8Array;
+  sendIntentStatus(intent: WorkspaceSendIntent): WorkspaceSendStatus;
+  /** Trusted actual-send observation only; binding and issuance save atomically. */
+  prepareObservedSend(intent: WorkspaceSendIntent, logicalId: Uint8Array, surface: string, siteId: string, operation: WorkspaceOperation): PreparedWorkspaceChange;
+  /** Trusted definite non-delivery, never a generic timeout or manual send assertion. */
+  prepareDefinitelyNotSent(intent: WorkspaceSendIntent, logicalId: Uint8Array, operation: WorkspaceOperation): PreparedWorkspaceChange;
+  restoreInConversation(text: string, logicalId: Uint8Array): string;
+  restoreReportInConversation(text: string, logicalId: Uint8Array): WorkspaceRestoreReport;
+  bufferedRestoreInConversation(logicalId: Uint8Array, encoding?: WorkspaceRestoreEncoding): WorkspaceBufferedRestore;
+  progressiveRestoreInConversation(logicalId: Uint8Array, encoding?: WorkspaceRestoreEncoding): WorkspaceProgressiveRestore;
+  policy(): WorkspacePolicy;
+  /** Explicit exact-value corrections can override real PII; source flags cannot. Null removes an override. */
+  preparePolicyChanges(edits: WorkspacePolicyEdits, operationId: Uint8Array): PreparedWorkspaceChange;
+  /** Stage a fresh recovery head without changing saved markers. No text previews or handoff permission. */
+  prepareRecovery(operationId: Uint8Array): PreparedWorkspaceChange;
+  /** Supplied findings only: omissions are never proof of PII-free input; use prepareReview for combined recall. Committed full markers pass through; damaged/unknown markers and bare committed codes reject with markerIssues before a plan is created. Findings must not overlap markers. */
+  prepare(text: string, findings: readonly WorkspaceFinding[], operationId: Uint8Array): PreparedWorkspaceChange;
+  /** Atomic batch: preserves order, validates committed markers, and applies aggregate limits. */
+  prepareBatch(inputs: readonly WorkspaceInput[], operationId: Uint8Array): PreparedWorkspaceChange;
+  /** The trusted host must confirm atomic persistence first. Success consumes this plan and drops retained plans based on older heads; failure preserves current plans. */
+  activateSaved(change: PreparedWorkspaceChange, expectedHead: WorkspaceHead, savedHead: WorkspaceHead): void;
+  /** All-or-nothing; throws `invalid_marker` when `restoreReport` would list an issue. */
+  bufferedRestore(encoding?: WorkspaceRestoreEncoding): WorkspaceBufferedRestore;
+  progressiveRestore(encoding?: WorkspaceRestoreEncoding): WorkspaceProgressiveRestore;
+  restore(text: string): string;
+  /** All-or-nothing restoration that locates every unknown, damaged or unbracketed marker. */
+  restoreReport(text: string): WorkspaceRestoreReport;
+  close(): void;
+}
+export function workspaceByteRangeFromUtf16(text: string, start: number, end: number): TextRange & { readonly unit: "utf8_bytes" };
 export declare class ModelCancellation {
   constructor()
   cancel(): void
@@ -258,6 +513,10 @@ export declare class ModelSessionNative {
   close(): Promise<void>
 }
 
+/** Factory-only private stream capability; dropping the owner clears retained children. */
+
+/** Raw binding; the package wrapper owns opaque plan objects and safe error conversion. */
+
 export declare function discoverFields(dataJson: JsonDocument, config?: StructuredScanConfig | undefined): Array<FieldMapping>
 
 export interface FieldMapping {
@@ -324,15 +583,10 @@ export interface PreparedStructuredScan {
   selectors: Array<KeySelector>
 }
 
-export declare function prepareScanAndTransform(text: string, config: ScanAndTransformConfig): PreparedScanAndTransform
 
-export declare function prepareStructuredScanAndTransform(text: string, config: unknown): PreparedStructuredScan
 
-export declare function requiredKeySelectors(text: string, findings: FindingInput[], config: TransformationConfig): Array<KeySelector>
 
-export declare function requiredRestoreItems(text: string, context: PrivacyContext): Array<RestoreItem>
 
-export declare function requiredTokenizationItems(text: string, findings: FindingInput[], config: TransformationConfig, context?: PrivacyContext | undefined): Array<TokenizeItem>
 
 export interface ResolvedKeyInput {
   selectorIndex: number
@@ -368,7 +622,6 @@ export interface RestoreResult {
   readonly restorations: Array<Restoration>
 }
 
-export declare function restoreWithResults(text: string, context: PrivacyContext, results: Array<RestoredValueInput>): RestoreResult
 
 /** Scan text for supported PII findings. */
 export declare function scan(text: string, config?: ScanConfig | undefined): Array<Finding>
@@ -389,34 +642,27 @@ export interface StructuredFindingInput {
 }
 
 /** Scan text and transform the detected findings. */
-export declare function structuredRequiredKeySelectors(text: JsonDocument, findings: StructuredFindingInput[], config: TransformationConfig): Array<KeySelector>
 
-export declare function structuredRequiredRestoreItems(text: JsonDocument, context: PrivacyContext): Array<RestoreItem>
 
-export declare function structuredRequiredTokenizationItems(text: JsonDocument, findings: StructuredFindingInput[], config: TransformationConfig, context?: PrivacyContext | undefined): Array<TokenizeItem>
 
 export interface StructuredRestoration {
   path: string
   restoration: Restoration
 }
 
-export declare function structuredRestoreWithResults(text: JsonDocument, context: PrivacyContext, results: Array<RestoredValueInput>): NativeStructuredRestoreResult
 
-export declare function structuredScanAndTransform(text: JsonDocument, config: StructuredScanAndTransformConfig): NativeStructuredTransformResult
 
 export interface StructuredScanResult {
   mappings: Array<FieldMapping>
   findings: Array<StructuredFinding>
 }
 
-export declare function structuredTransform(text: JsonDocument, findings: StructuredFindingInput[], config: TransformationConfig): NativeStructuredTransformResult
 
 export interface StructuredTransformation {
   path: string
   transformation: Transformation
 }
 
-export declare function structuredTransformWithProviderResults(text: JsonDocument, findings: StructuredFindingInput[], config: TransformationConfig, context: PrivacyContext | undefined, resolvedKeys: Array<ResolvedKeyInput>, tokenResults: Array<TokenizeResultInput>): NativeStructuredTransformResult
 
 export interface TextRange {
   readonly start: number
@@ -462,6 +708,7 @@ export interface TransformResult {
   readonly transformations: Array<Transformation>
 }
 
-export declare function transformWithProviderResults(text: string, findings: FindingInput[], config: TransformationConfig, context: PrivacyContext | undefined, resolvedKeys: Array<ResolvedKeyInput>, tokenResults: Array<TokenizeResultInput>): TransformResult
 
-export declare function transformWithResolvedKeys(text: string, findings: FindingInput[], config: TransformationConfig, resolvedKeys: Array<ResolvedKeyInput>): TransformResult
+
+/** Workspace API contract implemented by this compiled Core. */
+export declare function workspaceContractVersion(): number

package/index.js

@@ -1,5 +1,7 @@
 import { Buffer } from "node:buffer";
 import {
+  NativeWorkspace,
+  workspaceContractVersion as nativeWorkspaceContractVersion,
   openModelSession as nativeOpenModelSession,
   structuredTransform as nativeStructuredTransform,
   structuredScanAndTransform as nativeStructuredScanAndTransform,
@@ -24,6 +26,9 @@ import {
 
 export { ModelCancellation, ModelSessionNative, openModelSession } from "./native.js";
 
+/** Workspace behavior contract of the loaded native Core, independent of package version. */
+export function workspaceContractVersion() { return nativeWorkspaceContractVersion(); }
+
 // An unknown option, such as a misspelled `config`, would otherwise be ignored.
 function modelScanOptions(options, allowed) {
   if (options === null || typeof options !== "object" || Array.isArray(options)) {
@@ -66,13 +71,18 @@ export class ModelSession {
 }
 
 export class DataFogError extends Error {
-  constructor({ code, reason, message, path, findingIndex }) {
+  constructor({ code, reason, message, path, findingIndex, inputIndex, markerIssues, reviewConflicts, delivered, complete }) {
     super(message);
     this.name = "DataFogError";
     this.code = code;
     this.reason = reason;
     this.path = path;
     this.findingIndex = findingIndex;
+    this.inputIndex = inputIndex;
+    this.markerIssues = markerIssues;
+    this.reviewConflicts = reviewConflicts;
+    this.delivered = delivered;
+    this.complete = complete;
   }
 }
 
@@ -429,3 +439,443 @@ function structuredOptions(value) {
     throw new DataFogError({code:"invalid_configuration", reason:"invalid_type", path:"", message:"structured request options must be JSON-compatible"});
   }
 }
+
+const workspacePlans = new WeakMap();
+const workspaceFinalizer = new FinalizationRegistry(({state, handle}) => {
+  if (!state.closed) state.native.release(handle);
+});
+const workspaceToken = Symbol("workspace");
+function workspacePlan(change) {
+  const plan = workspacePlans.get(change);
+  if (!plan) throw workspaceFailure("inactive_plan");
+  return plan;
+}
+function workspaceFailure(code) {
+  return new DataFogError({ code, message: code });
+}
+function workspaceText(text, limit) {
+  if (typeof text !== "string" || !text.isWellFormed()) throw workspaceFailure("invalid_finding");
+  if (text.length > limit || new TextEncoder().encode(text).length > limit) throw workspaceFailure("resource_limit");
+}
+function workspaceBytes(bytes, limit, exact = false) {
+  if (!(bytes instanceof Uint8Array)) throw workspaceFailure(exact ? "invalid_operation_id" : "invalid_snapshot");
+  if (exact ? bytes.length !== limit : bytes.length > limit) throw workspaceFailure(exact ? "invalid_operation_id" : "resource_limit");
+}
+function workspaceCall(state, method, ...args) {
+  if (state.closed) throw workspaceFailure("closed_workspace");
+  try {
+    const value = state.native[method](...args.map(value => value instanceof Uint8Array ? Buffer.from(value) : value));
+    if (value instanceof Uint8Array) {
+      try { return new Uint8Array(value); } finally { value.fill(0); }
+    }
+    return value;
+  }
+  catch (error) { throw normalizeError(error, "internal_error"); }
+}
+
+// Bound the fixed finding transport before JSON.stringify can expand repeated
+// references or large nested values. Core still owns span/type/selection semantics.
+function workspaceFindingsJson(findings) {
+  const maximum = 16 * 1024 * 1024;
+  let budget = 2;
+  function object(value, allowed) {
+    if (!value || typeof value !== "object" || Array.isArray(value) || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) throw workspaceFailure("invalid_finding");
+    const properties = Object.getOwnPropertyDescriptors(value);
+    for (const key of Reflect.ownKeys(properties)) {
+      const property = properties[key];
+      if (typeof key !== "string" || !allowed.includes(key) || !property.enumerable || !("value" in property)) throw workspaceFailure("invalid_finding");
+    }
+    return Object.fromEntries(Object.entries(properties).map(([key, property]) => [key, property.value]));
+  }
+  function string(value) {
+    if (typeof value !== "string" || !value.isWellFormed()) throw workspaceFailure("invalid_finding");
+    if (value.length > maximum) throw workspaceFailure("resource_limit");
+    budget += 2;
+    for (const character of value) {
+      const point = character.codePointAt(0);
+      budget += point < 32 ? 6 : point === 34 || point === 92 ? 2 : point < 128 ? 1 : point < 2048 ? 2 : point < 65536 ? 3 : 4;
+      if (budget > maximum) throw workspaceFailure("resource_limit");
+    }
+  }
+  for (let i = 0; i < findings.length; i++) {
+    const item = Object.getOwnPropertyDescriptor(findings, String(i));
+    if (!item?.enumerable || !("value" in item)) throw workspaceFailure("invalid_finding");
+    const value = item.value;
+    const f = object(value, ["entityType", "matchedText", "range", "confidence", "detectorName", "detectorVersion", "source", "needsReview"]);
+    const range = object(f.range, ["unit", "start", "end"]);
+    budget += 256; // A conservative bound for keys, punctuation and scalar numbers.
+    string(f.entityType); string(f.matchedText); string(range.unit);
+    for (const field of ["detectorName", "detectorVersion"]) if (f[field] !== undefined && f[field] !== null) string(f[field]);
+    if (f.source !== undefined) string(f.source);
+    if (f.needsReview !== undefined && typeof f.needsReview !== "boolean") throw workspaceFailure("invalid_finding");
+    if (!Number.isSafeInteger(range.start) || !Number.isSafeInteger(range.end) || (f.confidence !== undefined && f.confidence !== null && (typeof f.confidence !== "number" || !Number.isFinite(f.confidence)))) throw workspaceFailure("invalid_finding");
+    if (budget > maximum) throw workspaceFailure("resource_limit");
+  }
+  try { return structuredJson(findings, true); }
+  catch { throw workspaceFailure("invalid_finding"); }
+}
+function workspacePolicyJson(edits) {
+  const maximum = 16 * 1024 * 1024;
+  let budget = 2;
+  function object(value, fields) {
+    if (!value || typeof value !== "object" || Array.isArray(value) || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) throw workspaceFailure("invalid_policy");
+    const properties = Object.getOwnPropertyDescriptors(value);
+    if (Reflect.ownKeys(properties).length !== fields.length) throw workspaceFailure("invalid_policy");
+    for (const field of fields) if (!properties[field]?.enumerable || !("value" in properties[field])) throw workspaceFailure("invalid_policy");
+    return Object.fromEntries(fields.map(field => [field,properties[field].value]));
+  }
+  function string(value) {
+    if (typeof value !== "string" || !value.isWellFormed()) throw workspaceFailure("invalid_policy");
+    if (value.length > 1024 * 1024) throw workspaceFailure("resource_limit");
+    budget += new TextEncoder().encode(value).length * 6 + 128;
+    if (budget > maximum) throw workspaceFailure("resource_limit");
+  }
+  const request = object(edits,["rules","choices"]);
+  if (!Array.isArray(request.rules) || !Array.isArray(request.choices)) throw workspaceFailure("invalid_policy");
+  if (request.rules.length + request.choices.length > 10000) throw workspaceFailure("resource_limit");
+  for (const [name,fields] of [["rules",["entityType","rule"]],["choices",["entityType","value","disposition"]]]) {
+    const values=request[name];
+    if (Reflect.ownKeys(values).length !== values.length+1) throw workspaceFailure("invalid_policy");
+    for (let i=0;i<values.length;i++) {
+      const property=Object.getOwnPropertyDescriptor(values,String(i));
+      if (!property?.enumerable || !("value" in property)) throw workspaceFailure("invalid_policy");
+      const row=object(property.value,fields);
+      string(row.entityType);
+      if (name === "choices") string(row.value);
+      const action = name === "rules" ? row.rule : row.disposition;
+      if (action !== null) string(action);
+    }
+  }
+  try { return structuredJson(edits,true); } catch { throw workspaceFailure("invalid_policy"); }
+}
+function workspaceReviewJson(input) {
+  function object(value, fields, required) {
+    if (!value || typeof value !== "object" || Array.isArray(value) || ![Object.prototype,null].includes(Object.getPrototypeOf(value))) throw workspaceFailure("invalid_finding");
+    const props=Object.getOwnPropertyDescriptors(value);
+    for (const name of Reflect.ownKeys(props)) if (typeof name !== "string" || !fields.includes(name) || !props[name].enumerable || !("value" in props[name])) throw workspaceFailure("invalid_finding");
+    for (const name of required) if (!props[name]) throw workspaceFailure("invalid_finding");
+    return Object.fromEntries(Object.entries(props).map(([name,property])=>[name,property.value]));
+  }
+  function array(value) {
+    if (!Array.isArray(value)) throw workspaceFailure("invalid_finding");
+    if (value.length>10000) throw workspaceFailure("resource_limit");
+    if (Reflect.ownKeys(value).length !== value.length+1) throw workspaceFailure("invalid_finding");
+    return value;
+  }
+  const fields=object(input,["text","scannerFindings","userSelections","corrections"],["text","scannerFindings","userSelections"]);
+  workspaceText(fields.text,1024*1024);
+  const scanner=array(fields.scannerFindings), user=array(fields.userSelections), corrections=array(fields.corrections === undefined ? [] : fields.corrections);
+  if (scanner.length+user.length+corrections.length>10000) throw workspaceFailure("resource_limit");
+  const scannerJson=workspaceFindingsJson(scanner), userJson=workspaceFindingsJson(user);
+  let budget=new TextEncoder().encode(scannerJson).length+new TextEncoder().encode(userJson).length+new TextEncoder().encode(JSON.stringify(fields.text)).length+128;
+  const corrected=[];
+  for(let index=0;index<corrections.length;index++) {
+    const item=Object.getOwnPropertyDescriptor(corrections,String(index));
+    if(!item?.enumerable || !("value" in item)) throw workspaceFailure("invalid_finding");
+    const correction=object(item.value,["candidateKey","replacement"],["candidateKey","replacement"]);
+    if(typeof correction.candidateKey !== "string" || !/^[a-f0-9]{64}$/.test(correction.candidateKey)) throw workspaceFailure("workspace_conflict");
+    const replacement=workspaceFindingsJson([correction.replacement]).slice(1,-1);
+    const part=`{"candidateKey":${JSON.stringify(correction.candidateKey)},"replacement":${replacement}}`;
+    budget+=new TextEncoder().encode(part).length+2;
+    if(budget>16*1024*1024) throw workspaceFailure("resource_limit");
+    corrected.push(part);
+  }
+  if(budget>16*1024*1024) throw workspaceFailure("resource_limit");
+  return `{"text":${JSON.stringify(fields.text)},"scannerFindings":${scannerJson},"userSelections":${userJson},"corrections":[${corrected.join(",")}]}`;
+}
+
+function workspaceOperation(operation) {
+  if (!operation || typeof operation !== "object" || ![Object.prototype, null].includes(Object.getPrototypeOf(operation))) throw workspaceFailure("invalid_operation");
+  const properties = Object.getOwnPropertyDescriptors(operation);
+  if (Reflect.ownKeys(properties).length !== 2 || !properties.id?.enumerable || !("value" in properties.id) || !properties.occurredAtMs?.enumerable || !("value" in properties.occurredAtMs)) throw workspaceFailure("invalid_operation");
+  const id = properties.id.value, time = properties.occurredAtMs.value;
+  workspaceBytes(id, 16, true);
+  if (!Number.isSafeInteger(time) || time < 0 || time > 253402300799999) throw workspaceFailure("invalid_operation");
+  return {id, json: JSON.stringify({id: Array.from(id), occurredAtMs: time})};
+}
+function conversationRecord(value,fields) {
+  if(!value || typeof value!=="object" || ![Object.prototype,null].includes(Object.getPrototypeOf(value))) throw workspaceFailure("invalid_conversation");
+  const properties=Object.getOwnPropertyDescriptors(value);
+  if(Reflect.ownKeys(properties).length!==fields.length) throw workspaceFailure("invalid_conversation");
+  const result={};
+  for(const field of fields) {
+    if(!properties[field]?.enumerable || !("value" in properties[field])) throw workspaceFailure("invalid_conversation");
+    result[field]=properties[field].value;
+  }
+  return result;
+}
+function conversationId(value) {
+  if(value instanceof Uint8Array) {if(value.length!==16)throw workspaceFailure("invalid_conversation");return Array.from(value);}
+  if(!Array.isArray(value) || value.length!==16 || Reflect.ownKeys(value).length!==17) throw workspaceFailure("invalid_conversation");
+  const bytes=[];
+  for(let i=0;i<16;i++) {
+    const item=Object.getOwnPropertyDescriptor(value,String(i));
+    if(!item?.enumerable || !("value" in item) || !Number.isInteger(item.value) || item.value<0 || item.value>255) throw workspaceFailure("invalid_conversation");
+    bytes.push(item.value);
+  }
+  return bytes;
+}
+function conversationText(value) {
+  if(typeof value!=="string" || !value.isWellFormed())throw workspaceFailure("invalid_conversation");
+  workspaceText(value,16*1024*1024);
+}
+function conversationInput(value) {
+  const fields=conversationRecord(value,["id","surface","siteId","siteIdByteBudget"]);
+  fields.id=conversationId(fields.id);
+  conversationText(fields.surface);
+  if(fields.siteId!==null) conversationText(fields.siteId);
+  if(!Number.isSafeInteger(fields.siteIdByteBudget) || fields.siteIdByteBudget<1 || fields.siteIdByteBudget>16*1024*1024) throw workspaceFailure("invalid_conversation");
+  return fields;
+}
+function sendIntentJson(value) {
+  let fields;
+  try {
+    fields=conversationRecord(value,["preparationId","inputIndex"]);
+    fields.preparationId=conversationId(fields.preparationId);
+    if(!Number.isSafeInteger(fields.inputIndex) || fields.inputIndex<0 || fields.inputIndex>=32) throw workspaceFailure("invalid_send_intent");
+  } catch {throw workspaceFailure("invalid_send_intent");}
+  return JSON.stringify(fields);
+}
+class PreparedWorkspaceChange {
+  constructor(state, handle) { workspacePlans.set(this, { state, handle }); workspaceFinalizer.register(this, {state, handle}, this); Object.freeze(this); }
+  sendIntents() { const {state, handle} = workspacePlan(this); return JSON.parse(workspaceCall(state,"send_intents",handle)); }
+  snapshotFormat() { const {state, handle} = workspacePlan(this); return JSON.parse(workspaceCall(state,"snapshot_format",handle)); }
+  policyPreview() { const {state, handle} = workspacePlan(this); return JSON.parse(workspaceCall(state, "policy_preview", handle)); }
+  previews() { const {state, handle} = workspacePlan(this); return JSON.parse(workspaceCall(state, "previews", handle)); }
+  preview() { const {state, handle} = workspacePlan(this); return JSON.parse(workspaceCall(state, "preview", handle)); }
+  heads() { const {state, handle} = workspacePlan(this); return JSON.parse(workspaceCall(state, "plan_heads", handle)); }
+  exportCandidateBundle() { const {state, handle} = workspacePlan(this); return workspaceCall(state, "export_candidate_bundle", handle); }
+  discard() { const {state, handle} = workspacePlan(this); workspaceCall(state, "discard", handle); workspaceFinalizer.unregister(this); }
+}
+
+// The native child owns parser state. Transport copies cannot mutate caller buffers.
+class WorkspaceRestoreStream {
+  #native;
+  constructor(native) { this.#native = native; Object.freeze(this); }
+  #call(method, ...args) {
+    try { const result = JSON.parse(this.#native[method](...args)); return result === null ? undefined : result; }
+    catch (error) { throw normalizeError(error, "internal_error"); }
+  }
+  feed(bytes) {
+    if (!(bytes instanceof Uint8Array)) return this.#call("reject_encoding");
+    let copied;
+    try { copied = Buffer.from(bytes); } catch { return this.#call("reject_encoding"); }
+    try { return this.#call("feed", copied); } finally { copied.fill(0); }
+  }
+  feedUtf16(units) {
+    if (!(units instanceof Uint16Array)) return this.#call("reject_encoding");
+    let copied;
+    try { copied = new Uint16Array(units); } catch { return this.#call("reject_encoding"); }
+    try { return this.#call("feed_utf16", copied); } finally { copied.fill(0); }
+  }
+  finalize() { return this.#call("finalize"); }
+  reset() { this.#call("reset"); }
+  close() { this.#native.close(); }
+}
+
+/** Provisional reversible-workspace API. Credentials and durable storage remain host-owned. */
+export class Workspace {
+  #state;
+  constructor(token, native) {
+    if (token !== workspaceToken) throw workspaceFailure("invalid_configuration");
+    this.#state = { native, closed: false };
+  }
+  static create(namespace, operationId) {
+    workspaceBytes(namespace, 16, true); workspaceBytes(operationId, 16, true);
+    try { return new Workspace(workspaceToken, NativeWorkspace.create(Buffer.from(namespace), Buffer.from(operationId))); }
+    catch (error) { throw normalizeError(error, "internal_error"); }
+  }
+  static createWithOperation(namespace, context) {
+    workspaceBytes(namespace,16,true);
+    const operation=workspaceOperation(context);
+    try {return new Workspace(workspaceToken,NativeWorkspace.create_with_operation(Buffer.from(namespace),operation.json));}
+    catch(error){throw normalizeError(error,"internal_error");}
+  }
+  static openBundle(bytes) {
+    workspaceBytes(bytes, 16 * 1024 * 1024);
+    try { return new Workspace(workspaceToken, NativeWorkspace.open_bundle(Buffer.from(bytes))); }
+    catch (error) { throw normalizeError(error, "invalid_snapshot"); }
+  }
+  head() { return JSON.parse(workspaceCall(this.#state, "head")); }
+  namespace() { return workspaceCall(this.#state, "namespace"); }
+  exportBundle() { return workspaceCall(this.#state, "export_bundle"); }
+  operations() { return JSON.parse(workspaceCall(this.#state, "operations")); }
+  operationsPage(offset, limit) {
+    if (!Number.isSafeInteger(offset) || offset < 0 || offset > 100000 || !Number.isSafeInteger(limit) || limit < 1 || limit > 100000) throw workspaceFailure("resource_limit");
+    return JSON.parse(workspaceCall(this.#state, "operations_page", offset, limit));
+  }
+  counts() { return JSON.parse(workspaceCall(this.#state, "counts")); }
+  historyCoverage() { return JSON.parse(workspaceCall(this.#state, "history_coverage")); }
+  policy() { return JSON.parse(workspaceCall(this.#state,"policy")); }
+  preparePolicyChanges(edits, operationId) {
+    workspaceBytes(operationId,16,true);
+    let json;
+    try { json=workspacePolicyJson(edits); }
+    catch (error) { if (error instanceof DataFogError) throw error; throw workspaceFailure("invalid_policy"); }
+    return new PreparedWorkspaceChange(this.#state,workspaceCall(this.#state,"prepare_policy_changes",json,operationId));
+  }
+  recall(text) { workspaceText(text, 1024 * 1024); return JSON.parse(workspaceCall(this.#state, "recall", text)); }
+  /** Read-only review; returned candidates are never handoff permission. */
+  review(input) { return JSON.parse(workspaceCall(this.#state,"review",workspaceReviewJson(input))); }
+  prepareReview(inputs, operationId) {
+    workspaceBytes(operationId,16,true);
+    if(!Array.isArray(inputs) || inputs.length===0) throw workspaceFailure("invalid_batch");
+    if(inputs.length>32) throw workspaceFailure("resource_limit");
+    if(Reflect.ownKeys(inputs).length!==inputs.length+1) throw workspaceFailure("invalid_batch");
+    const parts=[];let budget=2;
+    for(let inputIndex=0;inputIndex<inputs.length;inputIndex++) {
+      try {
+        const item=Object.getOwnPropertyDescriptor(inputs,String(inputIndex));
+        if(!item?.enumerable || !("value" in item)) throw workspaceFailure("invalid_batch");
+        const part=workspaceReviewJson(item.value);budget+=new TextEncoder().encode(part).length+1;
+        if(budget>16*1024*1024) throw workspaceFailure("resource_limit");
+        parts.push(part);
+      } catch(error) { const failure=error instanceof DataFogError?error:workspaceFailure("invalid_finding");failure.inputIndex=inputIndex;throw failure; }
+    }
+    return new PreparedWorkspaceChange(this.#state,workspaceCall(this.#state,"prepare_review",`[${parts.join(",")}]`,operationId));
+  }
+  prepareConversationSend(inputs, operation) {
+    const context=workspaceOperation(operation);
+    if(!Array.isArray(inputs) || inputs.length===0 || Reflect.ownKeys(inputs).length!==inputs.length+1) throw workspaceFailure("invalid_batch");
+    if(inputs.length>32) throw workspaceFailure("resource_limit");
+    const parts=[];let budget=2;
+    for(let index=0;index<inputs.length;index++) {
+      try {
+        const item=Object.getOwnPropertyDescriptor(inputs,String(index));
+        if(!item?.enumerable || !("value" in item)) throw workspaceFailure("invalid_batch");
+        const row=conversationRecord(item.value,["input","conversation"]);
+        const part=`{"input":${workspaceReviewJson(row.input)},"conversation":${JSON.stringify(conversationInput(row.conversation))}}`;
+        budget+=new TextEncoder().encode(part).length+1;
+        if(budget>16*1024*1024) throw workspaceFailure("resource_limit");parts.push(part);
+      } catch(error) {const failure=error instanceof DataFogError?error:workspaceFailure("invalid_conversation");failure.inputIndex=index;throw failure;}
+    }
+    return new PreparedWorkspaceChange(this.#state,workspaceCall(this.#state,"prepare_conversation_send",`[${parts.join(",")}]`,context.json));
+  }
+  conversation(logicalId) {workspaceBytes(logicalId,16,true);return JSON.parse(workspaceCall(this.#state,"conversation",logicalId));}
+  conversationForSite(surface,siteId) {
+    conversationText(surface);conversationText(siteId);
+    return workspaceCall(this.#state,"conversation_for_site",surface,siteId);
+  }
+  sendIntentStatus(intent) {return JSON.parse(workspaceCall(this.#state,"send_intent_status",sendIntentJson(intent)));}
+  prepareObservedSend(intent,logicalId,surface,siteId,operation) {
+    workspaceBytes(logicalId,16,true);conversationText(surface);conversationText(siteId);
+    const context=workspaceOperation(operation);
+    return new PreparedWorkspaceChange(this.#state,workspaceCall(this.#state,"prepare_observed_send",sendIntentJson(intent),logicalId,surface,siteId,context.json));
+  }
+  prepareDefinitelyNotSent(intent,logicalId,operation) {
+    workspaceBytes(logicalId,16,true);const context=workspaceOperation(operation);
+    return new PreparedWorkspaceChange(this.#state,workspaceCall(this.#state,"prepare_definitely_not_sent",sendIntentJson(intent),logicalId,context.json));
+  }
+  restoreInConversation(text,logicalId) {workspaceText(text,16*1024*1024);workspaceBytes(logicalId,16,true);return workspaceCall(this.#state,"restore_in_conversation",text,logicalId);}
+  restoreReportInConversation(text,logicalId) {workspaceText(text,16*1024*1024);workspaceBytes(logicalId,16,true);return JSON.parse(workspaceCall(this.#state,"restore_report_in_conversation",text,logicalId));}
+  bufferedRestoreInConversation(logicalId,encoding="utf8") {
+    workspaceBytes(logicalId,16,true);if(encoding!=="utf8" && encoding!=="utf16") throw workspaceFailure("invalid_encoding");
+    return new WorkspaceRestoreStream(workspaceCall(this.#state,"buffered_restore_in_conversation",logicalId,encoding));
+  }
+  progressiveRestoreInConversation(logicalId,encoding="utf8") {
+    workspaceBytes(logicalId,16,true);if(encoding!=="utf8" && encoding!=="utf16") throw workspaceFailure("invalid_encoding");
+    return new WorkspaceRestoreStream(workspaceCall(this.#state,"progressive_restore_in_conversation",logicalId,encoding));
+  }
+  prepareRecovery(operationId) {
+    workspaceBytes(operationId, 16, true);
+    return new PreparedWorkspaceChange(this.#state, workspaceCall(this.#state, "prepare_recovery", operationId));
+  }
+  prepareRecoveryWithOperation(context) {
+    const operation = workspaceOperation(context);
+    return new PreparedWorkspaceChange(this.#state, workspaceCall(this.#state, "prepare_recovery", operation.id, operation.json));
+  }
+  prepareWithOperation(text, findings, context) { return this.prepareBatchWithOperation([{text, findings}], context); }
+  prepareOutcome(outcome, context) {
+    const operation = workspaceOperation(context);
+    if (!outcome || typeof outcome !== "object" || ![Object.prototype, null].includes(Object.getPrototypeOf(outcome))) throw workspaceFailure("invalid_operation");
+    const fields = Object.getOwnPropertyDescriptors(outcome);
+    if (Reflect.ownKeys(fields).length !== 2 || !fields.kind?.enumerable || !("value" in fields.kind) || !fields.issueCount?.enumerable || !("value" in fields.issueCount)) throw workspaceFailure("invalid_operation");
+    const kind = fields.kind.value, issueCount = fields.issueCount.value;
+    if (typeof kind !== "string" || kind.length > 32 || !Number.isSafeInteger(issueCount) || issueCount < 0 || issueCount > 10000) throw workspaceFailure("invalid_operation");
+    const json = JSON.stringify({kind, issueCount});
+    return new PreparedWorkspaceChange(this.#state, workspaceCall(this.#state, "prepare_outcome", json, operation.json));
+  }
+  prepare(text, findings, operationId) {
+    workspaceText(text, 1024 * 1024); workspaceBytes(operationId, 16, true);
+    if (!Array.isArray(findings)) throw workspaceFailure("invalid_finding");
+    if (findings.length > 10000) throw workspaceFailure("resource_limit");
+    let json;
+    try { json = workspaceFindingsJson(findings); }
+    catch (error) { if (error instanceof DataFogError) throw error; throw workspaceFailure("invalid_finding"); }
+    workspaceText(json, 16 * 1024 * 1024);
+    return new PreparedWorkspaceChange(this.#state, workspaceCall(this.#state, "prepare", text, json, operationId));
+  }
+  prepareBatch(inputs,operationId) {return this.#prepareBatch(inputs,operationId);}
+  prepareBatchWithOperation(inputs,context) {
+    const operation=workspaceOperation(context);
+    return this.#prepareBatch(inputs,operation.id,operation.json);
+  }
+  #prepareBatch(inputs, operationId, context) {
+    workspaceBytes(operationId, 16, true);
+    if (!Array.isArray(inputs) || inputs.length === 0) throw workspaceFailure("invalid_batch");
+    if (inputs.length > 32) throw workspaceFailure("resource_limit");
+    if (Reflect.ownKeys(inputs).length !== inputs.length + 1) throw workspaceFailure("invalid_batch");
+    const parts = [];
+    let sourceBytes = 0, findingCount = 0, transportBytes = 2;
+    for (let inputIndex = 0; inputIndex < inputs.length; inputIndex++) {
+      try {
+        const item = Object.getOwnPropertyDescriptor(inputs, String(inputIndex));
+        if (!item?.enumerable || !("value" in item)) throw workspaceFailure("invalid_batch");
+        const input = item.value;
+        if (!input || typeof input !== "object" || ![Object.prototype, null].includes(Object.getPrototypeOf(input))) throw workspaceFailure("invalid_batch");
+        const properties = Object.getOwnPropertyDescriptors(input);
+        if (Reflect.ownKeys(properties).length !== 2 || !properties.text?.enumerable || !("value" in properties.text) || !properties.findings?.enumerable || !("value" in properties.findings)) throw workspaceFailure("invalid_batch");
+        const {value: text} = properties.text, {value: findings} = properties.findings;
+        workspaceText(text, 1024 * 1024);
+        if (!Array.isArray(findings)) throw workspaceFailure("invalid_finding");
+        sourceBytes += new TextEncoder().encode(text).length;
+        findingCount += findings.length;
+        if (sourceBytes > 1024 * 1024 || findingCount > 10000) throw workspaceFailure("resource_limit");
+        const findingsJson = workspaceFindingsJson(findings);
+        const textJson = JSON.stringify(text);
+        transportBytes += 32 + new TextEncoder().encode(textJson).length + new TextEncoder().encode(findingsJson).length;
+        if (transportBytes > 16 * 1024 * 1024) throw workspaceFailure("resource_limit");
+        parts.push(`{"text":${textJson},"findings":${findingsJson}}`);
+      } catch (error) {
+        const failure = error instanceof DataFogError ? error : workspaceFailure("invalid_finding");
+        failure.inputIndex = inputIndex;
+        throw failure;
+      }
+    }
+    return new PreparedWorkspaceChange(this.#state, workspaceCall(this.#state, "prepare_batch", `[${parts.join(",")}]`, operationId, context));
+  }
+  activateSaved(change, expectedHead, savedHead) {
+    const plan = workspacePlans.get(change);
+    if (!plan || plan.state !== this.#state) throw workspaceFailure("workspace_conflict");
+    let expected, saved;
+    try { expected = structuredJson(expectedHead); saved = structuredJson(savedHead); }
+    catch { throw workspaceFailure("workspace_conflict"); }
+    workspaceCall(this.#state, "activate_saved", plan.handle, expected, saved);
+    workspaceFinalizer.unregister(change);
+  }
+  /** Strict buffered default: feeds release no text. */
+  bufferedRestore(encoding = "utf8") {
+    if (encoding !== "utf8" && encoding !== "utf16") throw workspaceFailure("invalid_encoding");
+    return new WorkspaceRestoreStream(workspaceCall(this.#state,"buffered_restore",encoding));
+  }
+  /** Explicit irreversible delivery; terminal failures preserve prior delivered counts. */
+  progressiveRestore(encoding = "utf8") {
+    if (encoding !== "utf8" && encoding !== "utf16") throw workspaceFailure("invalid_encoding");
+    return new WorkspaceRestoreStream(workspaceCall(this.#state,"progressive_restore",encoding));
+  }
+  restore(text) { workspaceText(text, 16 * 1024 * 1024); return workspaceCall(this.#state, "restore", text); }
+  restoreReport(text) { workspaceText(text, 16 * 1024 * 1024); return JSON.parse(workspaceCall(this.#state, "restore_report", text)); }
+  close() {
+    if (!this.#state.closed) {
+      workspaceCall(this.#state, "close");
+      this.#state.closed = true;
+    }
+  }
+}
+
+export function workspaceByteRangeFromUtf16(text, start, end) {
+  workspaceText(text, 1024 * 1024);
+  if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || start < 0 || end < 0 || start > text.length || end > text.length) throw workspaceFailure("invalid_finding");
+  try { return JSON.parse(NativeWorkspace.byte_range_from_utf16(text, start, end)); }
+  catch (error) { throw normalizeError(error, "invalid_finding"); }
+}

package/native.js

@@ -81,8 +81,8 @@ function requireNative() {
       try {
         const binding = require('@datafog/node-android-arm64')
         const bindingPackageVersion = require('@datafog/node-android-arm64/package.json').version
-        if (bindingPackageVersion !== '0.5.0-beta.2' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.5.0-beta.2 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -97,8 +97,8 @@ function requireNative() {
       try {
         const binding = require('@datafog/node-android-arm-eabi')
         const bindingPackageVersion = require('@datafog/node-android-arm-eabi/package.json').version
-        if (bindingPackageVersion !== '0.5.0-beta.2' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.5.0-beta.2 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -118,8 +118,8 @@ function requireNative() {
       try {
         const binding = require('@datafog/node-win32-x64-gnu')
         const bindingPackageVersion = require('@datafog/node-win32-x64-gnu/package.json').version
-        if (bindingPackageVersion !== '0.5.0-beta.2' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.5.0-beta.2 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -134,8 +134,8 @@ function requireNative() {
       try {
         const binding = require('@datafog/node-win32-x64-msvc')
         const bindingPackageVersion = require('@datafog/node-win32-x64-msvc/package.json').version
-        if (bindingPackageVersion !== '0.5.0-beta.2' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.5.0-beta.2 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -151,8 +151,8 @@ function requireNative() {
       try {
         const binding = require('@datafog/node-win32-ia32-msvc')
         const bindingPackageVersion = require('@datafog/node-win32-ia32-msvc/package.json').version
-        if (bindingPackageVersion !== '0.5.0-beta.2' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.5.0-beta.2 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -167,8 +167,8 @@ function requireNative() {
       try {
         const binding = require('@datafog/node-win32-arm64-msvc')
         const bindingPackageVersion = require('@datafog/node-win32-arm64-msvc/package.json').version
-        if (bindingPackageVersion !== '0.5.0-beta.2' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.5.0-beta.2 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -186,8 +186,8 @@ function requireNative() {
     try {
       const binding = require('@datafog/node-darwin-universal')
       const bindingPackageVersion = require('@datafog/node-darwin-universal/package.json').version
-      if (bindingPackageVersion !== '0.5.0-beta.2' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-        throw new Error(`Native binding package version mismatch, expected 0.5.0-beta.2 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+      if (bindingPackageVersion !== '1.0.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+        throw new Error(`Native binding package version mismatch, expected 1.0.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
       }
       return binding
     } catch (e) {
@@ -202,8 +202,8 @@ function requireNative() {
       try {
         const binding = require('@datafog/node-darwin-x64')
         const bindingPackageVersion = require('@datafog/node-darwin-x64/package.json').version
-        if (bindingPackageVersion !== '0.5.0-beta.2' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.5.0-beta.2 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -218,8 +218,8 @@ function requireNative() {
       try {
         const binding = require('@datafog/node-darwin-arm64')
         const bindingPackageVersion = require('@datafog/node-darwin-arm64/package.json').version
-        if (bindingPackageVersion !== '0.5.0-beta.2' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.5.0-beta.2 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -238,8 +238,8 @@ function requireNative() {
       try {
         const binding = require('@datafog/node-freebsd-x64')
         const bindingPackageVersion = require('@datafog/node-freebsd-x64/package.json').version
-        if (bindingPackageVersion !== '0.5.0-beta.2' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.5.0-beta.2 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -254,8 +254,8 @@ function requireNative() {
       try {
         const binding = require('@datafog/node-freebsd-arm64')
         const bindingPackageVersion = require('@datafog/node-freebsd-arm64/package.json').version
-        if (bindingPackageVersion !== '0.5.0-beta.2' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.5.0-beta.2 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -275,8 +275,8 @@ function requireNative() {
         try {
           const binding = require('@datafog/node-linux-x64-musl')
           const bindingPackageVersion = require('@datafog/node-linux-x64-musl/package.json').version
-          if (bindingPackageVersion !== '0.5.0-beta.2' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.5.0-beta.2 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '1.0.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 1.0.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -291,8 +291,8 @@ function requireNative() {
         try {
           const binding = require('@datafog/node-linux-x64-gnu')
           const bindingPackageVersion = require('@datafog/node-linux-x64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.5.0-beta.2' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.5.0-beta.2 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '1.0.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 1.0.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -309,8 +309,8 @@ function requireNative() {
         try {
           const binding = require('@datafog/node-linux-arm64-musl')
           const bindingPackageVersion = require('@datafog/node-linux-arm64-musl/package.json').version
-          if (bindingPackageVersion !== '0.5.0-beta.2' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.5.0-beta.2 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '1.0.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 1.0.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -325,8 +325,8 @@ function requireNative() {
         try {
           const binding = require('@datafog/node-linux-arm64-gnu')
           const bindingPackageVersion = require('@datafog/node-linux-arm64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.5.0-beta.2' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.5.0-beta.2 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '1.0.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 1.0.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -343,8 +343,8 @@ function requireNative() {
         try {
           const binding = require('@datafog/node-linux-arm-musleabihf')
           const bindingPackageVersion = require('@datafog/node-linux-arm-musleabihf/package.json').version
-          if (bindingPackageVersion !== '0.5.0-beta.2' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.5.0-beta.2 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '1.0.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 1.0.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -359,8 +359,8 @@ function requireNative() {
         try {
           const binding = require('@datafog/node-linux-arm-gnueabihf')
           const bindingPackageVersion = require('@datafog/node-linux-arm-gnueabihf/package.json').version
-          if (bindingPackageVersion !== '0.5.0-beta.2' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.5.0-beta.2 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '1.0.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 1.0.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -377,8 +377,8 @@ function requireNative() {
         try {
           const binding = require('@datafog/node-linux-loong64-musl')
           const bindingPackageVersion = require('@datafog/node-linux-loong64-musl/package.json').version
-          if (bindingPackageVersion !== '0.5.0-beta.2' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.5.0-beta.2 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '1.0.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 1.0.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -393,8 +393,8 @@ function requireNative() {
         try {
           const binding = require('@datafog/node-linux-loong64-gnu')
           const bindingPackageVersion = require('@datafog/node-linux-loong64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.5.0-beta.2' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.5.0-beta.2 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '1.0.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 1.0.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -411,8 +411,8 @@ function requireNative() {
         try {
           const binding = require('@datafog/node-linux-riscv64-musl')
           const bindingPackageVersion = require('@datafog/node-linux-riscv64-musl/package.json').version
-          if (bindingPackageVersion !== '0.5.0-beta.2' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.5.0-beta.2 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '1.0.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 1.0.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -427,8 +427,8 @@ function requireNative() {
         try {
           const binding = require('@datafog/node-linux-riscv64-gnu')
           const bindingPackageVersion = require('@datafog/node-linux-riscv64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.5.0-beta.2' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.5.0-beta.2 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '1.0.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 1.0.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -444,8 +444,8 @@ function requireNative() {
       try {
         const binding = require('@datafog/node-linux-ppc64-gnu')
         const bindingPackageVersion = require('@datafog/node-linux-ppc64-gnu/package.json').version
-        if (bindingPackageVersion !== '0.5.0-beta.2' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.5.0-beta.2 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -460,8 +460,8 @@ function requireNative() {
       try {
         const binding = require('@datafog/node-linux-s390x-gnu')
         const bindingPackageVersion = require('@datafog/node-linux-s390x-gnu/package.json').version
-        if (bindingPackageVersion !== '0.5.0-beta.2' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.5.0-beta.2 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -480,8 +480,8 @@ function requireNative() {
       try {
         const binding = require('@datafog/node-openharmony-arm64')
         const bindingPackageVersion = require('@datafog/node-openharmony-arm64/package.json').version
-        if (bindingPackageVersion !== '0.5.0-beta.2' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.5.0-beta.2 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -496,8 +496,8 @@ function requireNative() {
       try {
         const binding = require('@datafog/node-openharmony-x64')
         const bindingPackageVersion = require('@datafog/node-openharmony-x64/package.json').version
-        if (bindingPackageVersion !== '0.5.0-beta.2' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.5.0-beta.2 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -512,8 +512,8 @@ function requireNative() {
       try {
         const binding = require('@datafog/node-openharmony-arm')
         const bindingPackageVersion = require('@datafog/node-openharmony-arm/package.json').version
-        if (bindingPackageVersion !== '0.5.0-beta.2' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.5.0-beta.2 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '1.0.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 1.0.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -652,8 +652,8 @@ if (!nativeBinding || forceWasi) {
       if (!candidateFailed) {
         if (process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
           const bindingPackageVersion = require('@datafog/node-wasm32-wasi/package.json').version
-          if (bindingPackageVersion !== '0.5.0-beta.2') {
-            throw new Error(`WASI binding package version mismatch, expected 0.5.0-beta.2 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '1.0.0') {
+            throw new Error(`WASI binding package version mismatch, expected 1.0.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
         }
         wasiBinding = require('@datafog/node-wasm32-wasi')
@@ -703,9 +703,11 @@ if (!nativeBinding) {
   throw new Error(`Failed to load native binding`)
 }
 
-const { ModelCancellation, ModelSessionNative, discoverFields, openModelSession, prepareScanAndTransform, prepareStructuredScanAndTransform, requiredKeySelectors, requiredRestoreItems, requiredTokenizationItems, restoreWithResults, scan, scanAndTransform, scanStructured, structuredRequiredKeySelectors, structuredRequiredRestoreItems, structuredRequiredTokenizationItems, structuredRestoreWithResults, structuredScanAndTransform, structuredTransform, structuredTransformWithProviderResults, transform, transformWithProviderResults, transformWithResolvedKeys } = nativeBinding
+const { ModelCancellation, ModelSessionNative, NativeRestoreStream, NativeWorkspace, discoverFields, openModelSession, prepareScanAndTransform, prepareStructuredScanAndTransform, requiredKeySelectors, requiredRestoreItems, requiredTokenizationItems, restoreWithResults, scan, scanAndTransform, scanStructured, structuredRequiredKeySelectors, structuredRequiredRestoreItems, structuredRequiredTokenizationItems, structuredRestoreWithResults, structuredScanAndTransform, structuredTransform, structuredTransformWithProviderResults, transform, transformWithProviderResults, transformWithResolvedKeys, workspaceContractVersion } = nativeBinding
 export { ModelCancellation }
 export { ModelSessionNative }
+export { NativeRestoreStream }
+export { NativeWorkspace }
 export { discoverFields }
 export { openModelSession }
 export { prepareScanAndTransform }
@@ -727,3 +729,4 @@ export { structuredTransformWithProviderResults }
 export { transform }
 export { transformWithProviderResults }
 export { transformWithResolvedKeys }
+export { workspaceContractVersion }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datafog/node",
-  "version": "0.5.0-beta.2",
+  "version": "1.0.0",
   "description": "Fast structured PII detection for Node.js, powered by Rust",
   "license": "MIT",
   "repository": {
@@ -9,7 +9,7 @@
   },
   "publishConfig": {
     "access": "public",
-    "tag": "beta"
+    "tag": "latest"
   },
   "type": "module",
   "files": [
@@ -26,7 +26,7 @@
   },
   "types": "./index.d.ts",
   "engines": {
-    "node": "24.x"
+    "node": ">=24"
   },
   "napi": {
     "binaryName": "datafog",
@@ -41,6 +41,7 @@
   },
   "scripts": {
     "build": "napi build --manifest-path Cargo.toml --release --platform --esm --js native.js --dts index.d.ts",
+    "postbuild": "node finalize-types.mjs",
     "test:package": "node ../../scripts/test-node-package.mjs",
     "prepublishOnly": "napi prepublish -t npm --no-gh-release"
   },
@@ -49,10 +50,10 @@
     "typescript": "7.0.2"
   },
   "optionalDependencies": {
-    "@datafog/node-darwin-arm64": "0.5.0-beta.2",
-    "@datafog/node-darwin-x64": "0.5.0-beta.2",
-    "@datafog/node-linux-x64-gnu": "0.5.0-beta.2",
-    "@datafog/node-linux-arm64-gnu": "0.5.0-beta.2",
-    "@datafog/node-win32-x64-msvc": "0.5.0-beta.2"
+    "@datafog/node-darwin-arm64": "1.0.0",
+    "@datafog/node-darwin-x64": "1.0.0",
+    "@datafog/node-linux-x64-gnu": "1.0.0",
+    "@datafog/node-linux-arm64-gnu": "1.0.0",
+    "@datafog/node-win32-x64-msvc": "1.0.0"
   }
 }