@deepstrike/core 0.1.5 → 0.1.7

package/README.md

@@ -0,0 +1,16 @@
+# `@deepstrike/core`
+
+Native DeepStrike kernel loader for Node.js.
+
+This package contains the JavaScript loader and TypeScript definitions. The native
+`.node` binary is shipped in a platform-specific optional dependency such as
+`@deepstrike/core-linux-x64-gnu` or `@deepstrike/core-darwin-arm64`.
+
+Install `@deepstrike/sdk` for normal use:
+
+```bash
+npm install @deepstrike/sdk
+```
+
+The install does not run a postinstall downloader. npm selects the matching
+platform package through `optionalDependencies`.

package/index.d.ts

@@ -107,7 +107,7 @@ export interface LoopObservation {
   rhoAfter?: number
 }
 /** JS-friendly governance verdict returned by `Governance.evaluate`. */
-export interface GovernanceVerdictObj {
+export interface GovernanceVerdict {
   /** `"allow"` | `"deny"` | `"rate_limited"` | `"ask_user"` */
   kind: string
   reason?: string
@@ -286,13 +286,21 @@ export declare class Governance {
   addPermissionRule(pattern: string, action: string): void
   /** Hard-block a tool name (veto stage — cannot be overridden by permission rules). */
   blockTool(name: string): void
+  /** Configure a per-tool sliding-window rate limit. */
+  setRateLimit(toolName: string, maxCalls: number, windowMs: bigint): void
+  /** Require a parameter path such as `"path"` or `"payload.mode"` to be present. */
+  requireParam(toolName: string, paramPath: string): void
+  /** Restrict a string parameter path to one of the allowed values. */
+  allowParamValues(toolName: string, paramPath: string, allowedValues: Array<string>): void
+  /** Restrict a numeric parameter path to an inclusive range. */
+  limitParamRange(toolName: string, paramPath: string, min?: number | undefined | null, max?: number | undefined | null): void
   /** Advance the internal clock used by rate limiting and audit. */
   setTime(nowMs: bigint): void
   /**
    * Evaluate a tool call through the full pipeline (Permission → Veto → RateLimit → Constraint → Audit).
    * `argsJson`: JSON-encoded tool arguments string.
    */
-  evaluate(toolName: string, argsJson: string): GovernanceVerdictObj
+  evaluate(toolName: string, argsJson: string): GovernanceVerdict
 }
 /**
  * Kernel state machine for the evaluation cycle.

package/index.js

@@ -1,320 +1,101 @@
-/* tslint:disable */
-/* eslint-disable */
-/* prettier-ignore */
-
-/* auto-generated by NAPI-RS */
+'use strict'
 
 const { existsSync, readFileSync } = require('fs')
 const { join } = require('path')
 
 const { platform, arch } = process
 
-let nativeBinding = null
-let localFileExisted = false
-let loadError = null
+const supportedTriples = [
+  'darwin-arm64',
+  'darwin-x64',
+  'linux-arm64-gnu',
+  'linux-arm64-musl',
+  'linux-x64-gnu',
+  'linux-x64-musl',
+  'win32-x64-msvc',
+]
 
-function isMusl() {
-  // For Node 10
-  if (!process.report || typeof process.report.getReport !== 'function') {
-    try {
-      const lddPath = require('child_process').execSync('which ldd').toString().trim()
-      return readFileSync(lddPath, 'utf8').includes('musl')
-    } catch (e) {
-      return true
-    }
-  } else {
-    const { glibcVersionRuntime } = process.report.getReport().header
-    return !glibcVersionRuntime
+function readIfExists(path) {
+  try {
+    if (existsSync(path)) return readFileSync(path, 'utf8')
+  } catch {
+    return ''
   }
+  return ''
 }
 
-switch (platform) {
-  case 'android':
-    switch (arch) {
-      case 'arm64':
-        localFileExisted = existsSync(join(__dirname, 'index.android-arm64.node'))
-        try {
-          if (localFileExisted) {
-            nativeBinding = require('./index.android-arm64.node')
-          } else {
-            nativeBinding = require('@deepstrike/core-android-arm64')
-          }
-        } catch (e) {
-          loadError = e
-        }
-        break
-      case 'arm':
-        localFileExisted = existsSync(join(__dirname, 'index.android-arm-eabi.node'))
-        try {
-          if (localFileExisted) {
-            nativeBinding = require('./index.android-arm-eabi.node')
-          } else {
-            nativeBinding = require('@deepstrike/core-android-arm-eabi')
-          }
-        } catch (e) {
-          loadError = e
-        }
-        break
-      default:
-        throw new Error(`Unsupported architecture on Android ${arch}`)
-    }
-    break
-  case 'win32':
-    switch (arch) {
-      case 'x64':
-        localFileExisted = existsSync(
-          join(__dirname, 'index.win32-x64-msvc.node')
-        )
-        try {
-          if (localFileExisted) {
-            nativeBinding = require('./index.win32-x64-msvc.node')
-          } else {
-            nativeBinding = require('@deepstrike/core-win32-x64-msvc')
-          }
-        } catch (e) {
-          loadError = e
-        }
-        break
-      case 'ia32':
-        localFileExisted = existsSync(
-          join(__dirname, 'index.win32-ia32-msvc.node')
-        )
-        try {
-          if (localFileExisted) {
-            nativeBinding = require('./index.win32-ia32-msvc.node')
-          } else {
-            nativeBinding = require('@deepstrike/core-win32-ia32-msvc')
-          }
-        } catch (e) {
-          loadError = e
-        }
-        break
-      case 'arm64':
-        localFileExisted = existsSync(
-          join(__dirname, 'index.win32-arm64-msvc.node')
-        )
-        try {
-          if (localFileExisted) {
-            nativeBinding = require('./index.win32-arm64-msvc.node')
-          } else {
-            nativeBinding = require('@deepstrike/core-win32-arm64-msvc')
-          }
-        } catch (e) {
-          loadError = e
-        }
-        break
-      default:
-        throw new Error(`Unsupported architecture on Windows: ${arch}`)
-    }
-    break
-  case 'darwin':
-    localFileExisted = existsSync(join(__dirname, 'index.darwin-universal.node'))
-    try {
-      if (localFileExisted) {
-        nativeBinding = require('./index.darwin-universal.node')
-      } else {
-        nativeBinding = require('@deepstrike/core-darwin-universal')
-      }
-      break
-    } catch {}
-    switch (arch) {
-      case 'x64':
-        localFileExisted = existsSync(join(__dirname, 'index.darwin-x64.node'))
-        try {
-          if (localFileExisted) {
-            nativeBinding = require('./index.darwin-x64.node')
-          } else {
-            nativeBinding = require('@deepstrike/core-darwin-x64')
-          }
-        } catch (e) {
-          loadError = e
-        }
-        break
-      case 'arm64':
-        localFileExisted = existsSync(
-          join(__dirname, 'index.darwin-arm64.node')
-        )
-        try {
-          if (localFileExisted) {
-            nativeBinding = require('./index.darwin-arm64.node')
-          } else {
-            nativeBinding = require('@deepstrike/core-darwin-arm64')
-          }
-        } catch (e) {
-          loadError = e
-        }
-        break
-      default:
-        throw new Error(`Unsupported architecture on macOS: ${arch}`)
-    }
-    break
-  case 'freebsd':
-    if (arch !== 'x64') {
-      throw new Error(`Unsupported architecture on FreeBSD: ${arch}`)
-    }
-    localFileExisted = existsSync(join(__dirname, 'index.freebsd-x64.node'))
-    try {
-      if (localFileExisted) {
-        nativeBinding = require('./index.freebsd-x64.node')
-      } else {
-        nativeBinding = require('@deepstrike/core-freebsd-x64')
-      }
-    } catch (e) {
-      loadError = e
-    }
-    break
-  case 'linux':
-    switch (arch) {
-      case 'x64':
-        if (isMusl()) {
-          localFileExisted = existsSync(
-            join(__dirname, 'index.linux-x64-musl.node')
-          )
-          try {
-            if (localFileExisted) {
-              nativeBinding = require('./index.linux-x64-musl.node')
-            } else {
-              nativeBinding = require('@deepstrike/core-linux-x64-musl')
-            }
-          } catch (e) {
-            loadError = e
-          }
-        } else {
-          localFileExisted = existsSync(
-            join(__dirname, 'index.linux-x64-gnu.node')
-          )
-          try {
-            if (localFileExisted) {
-              nativeBinding = require('./index.linux-x64-gnu.node')
-            } else {
-              nativeBinding = require('@deepstrike/core-linux-x64-gnu')
-            }
-          } catch (e) {
-            loadError = e
-          }
-        }
-        break
-      case 'arm64':
-        if (isMusl()) {
-          localFileExisted = existsSync(
-            join(__dirname, 'index.linux-arm64-musl.node')
-          )
-          try {
-            if (localFileExisted) {
-              nativeBinding = require('./index.linux-arm64-musl.node')
-            } else {
-              nativeBinding = require('@deepstrike/core-linux-arm64-musl')
-            }
-          } catch (e) {
-            loadError = e
-          }
-        } else {
-          localFileExisted = existsSync(
-            join(__dirname, 'index.linux-arm64-gnu.node')
-          )
-          try {
-            if (localFileExisted) {
-              nativeBinding = require('./index.linux-arm64-gnu.node')
-            } else {
-              nativeBinding = require('@deepstrike/core-linux-arm64-gnu')
-            }
-          } catch (e) {
-            loadError = e
-          }
-        }
-        break
-      case 'arm':
-        if (isMusl()) {
-          localFileExisted = existsSync(
-            join(__dirname, 'index.linux-arm-musleabihf.node')
-          )
-          try {
-            if (localFileExisted) {
-              nativeBinding = require('./index.linux-arm-musleabihf.node')
-            } else {
-              nativeBinding = require('@deepstrike/core-linux-arm-musleabihf')
-            }
-          } catch (e) {
-            loadError = e
-          }
-        } else {
-          localFileExisted = existsSync(
-            join(__dirname, 'index.linux-arm-gnueabihf.node')
-          )
-          try {
-            if (localFileExisted) {
-              nativeBinding = require('./index.linux-arm-gnueabihf.node')
-            } else {
-              nativeBinding = require('@deepstrike/core-linux-arm-gnueabihf')
-            }
-          } catch (e) {
-            loadError = e
-          }
-        }
-        break
-      case 'riscv64':
-        if (isMusl()) {
-          localFileExisted = existsSync(
-            join(__dirname, 'index.linux-riscv64-musl.node')
-          )
-          try {
-            if (localFileExisted) {
-              nativeBinding = require('./index.linux-riscv64-musl.node')
-            } else {
-              nativeBinding = require('@deepstrike/core-linux-riscv64-musl')
-            }
-          } catch (e) {
-            loadError = e
-          }
-        } else {
-          localFileExisted = existsSync(
-            join(__dirname, 'index.linux-riscv64-gnu.node')
-          )
-          try {
-            if (localFileExisted) {
-              nativeBinding = require('./index.linux-riscv64-gnu.node')
-            } else {
-              nativeBinding = require('@deepstrike/core-linux-riscv64-gnu')
-            }
-          } catch (e) {
-            loadError = e
-          }
-        }
-        break
-      case 's390x':
-        localFileExisted = existsSync(
-          join(__dirname, 'index.linux-s390x-gnu.node')
-        )
-        try {
-          if (localFileExisted) {
-            nativeBinding = require('./index.linux-s390x-gnu.node')
-          } else {
-            nativeBinding = require('@deepstrike/core-linux-s390x-gnu')
-          }
-        } catch (e) {
-          loadError = e
-        }
-        break
-      default:
-        throw new Error(`Unsupported architecture on Linux: ${arch}`)
+function isMusl() {
+  if (platform !== 'linux') return false
+
+  const report = typeof process.report?.getReport === 'function'
+    ? process.report.getReport()
+    : null
+  if (report?.header?.glibcVersionRuntime) return false
+
+  const ldd = readIfExists('/usr/bin/ldd') || readIfExists('/bin/ldd')
+  if (ldd.includes('musl')) return true
+  if (ldd.includes('GNU libc') || ldd.includes('glibc')) return false
+
+  return false
+}
+
+function packageTriple() {
+  if (platform === 'darwin') {
+    if (arch === 'arm64' || arch === 'x64') return `darwin-${arch}`
+  }
+
+  if (platform === 'win32') {
+    if (arch === 'x64') return 'win32-x64-msvc'
+  }
+
+  if (platform === 'linux') {
+    if (arch === 'arm64' || arch === 'x64') {
+      return `linux-${arch}-${isMusl() ? 'musl' : 'gnu'}`
     }
-    break
-  default:
-    throw new Error(`Unsupported OS: ${platform}, architecture: ${arch}`)
+  }
+
+  return null
 }
 
-if (!nativeBinding) {
-  if (loadError) {
-    throw loadError
+function requireLocal(triple) {
+  const candidates = [
+    `deepstrike-core.${triple}.node`,
+    'deepstrike-core.node',
+  ]
+
+  for (const candidate of candidates) {
+    const path = join(__dirname, candidate)
+    if (existsSync(path)) return require(path)
   }
-  throw new Error(`Failed to load native binding`)
+
+  return null
 }
 
-const { ContextEngine, LoopStateMachine, SignalRouter, Governance, EvalPipeline, IdlePipeline } = nativeBinding
+function loadNativeBinding() {
+  const triple = packageTriple()
+  if (!triple || !supportedTriples.includes(triple)) {
+    throw new Error(
+      `Unsupported DeepStrike native platform: ${platform}/${arch}. ` +
+      `Supported targets: ${supportedTriples.join(', ')}.`,
+    )
+  }
+
+  const local = requireLocal(triple)
+  if (local) return local
+
+  const packageName = `@deepstrike/core-${triple}`
+  try {
+    return require(packageName)
+  } catch (error) {
+    const cause = error && typeof error === 'object' && 'message' in error
+      ? `\nCause: ${error.message}`
+      : ''
+    throw new Error(
+      `Failed to load ${packageName}. ` +
+      `Install @deepstrike/sdk or @deepstrike/core normally so npm can install ` +
+      `the matching optional native package for ${platform}/${arch}.${cause}`,
+    )
+  }
+}
 
-module.exports.ContextEngine = ContextEngine
-module.exports.LoopStateMachine = LoopStateMachine
-module.exports.SignalRouter = SignalRouter
-module.exports.Governance = Governance
-module.exports.EvalPipeline = EvalPipeline
-module.exports.IdlePipeline = IdlePipeline
+module.exports = loadNativeBinding()

package/package.json

@@ -1,9 +1,14 @@
 {
   "name": "@deepstrike/core",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "DeepStrike kernel — pre-built native addon",
   "main": "index.js",
   "types": "index.d.ts",
+  "files": [
+    "index.js",
+    "index.d.ts",
+    "README.md"
+  ],
   "license": "Apache-2.0 OR MIT",
   "napi": {
     "binaryName": "deepstrike-core",
@@ -12,14 +17,18 @@
       "aarch64-apple-darwin",
       "x86_64-unknown-linux-gnu",
       "aarch64-unknown-linux-gnu",
+      "x86_64-unknown-linux-musl",
+      "aarch64-unknown-linux-musl",
       "x86_64-pc-windows-msvc"
     ]
   },
   "optionalDependencies": {
-    "@deepstrike/core-linux-x64-gnu": "0.1.5",
-    "@deepstrike/core-linux-arm64-gnu": "0.1.5",
-    "@deepstrike/core-darwin-x64": "0.1.5",
-    "@deepstrike/core-darwin-arm64": "0.1.5",
-    "@deepstrike/core-win32-x64-msvc": "0.1.5"
+    "@deepstrike/core-darwin-arm64": "0.1.7",
+    "@deepstrike/core-darwin-x64": "0.1.7",
+    "@deepstrike/core-linux-arm64-gnu": "0.1.7",
+    "@deepstrike/core-linux-arm64-musl": "0.1.7",
+    "@deepstrike/core-linux-x64-gnu": "0.1.7",
+    "@deepstrike/core-linux-x64-musl": "0.1.7",
+    "@deepstrike/core-win32-x64-msvc": "0.1.7"
   }
 }

package/Cargo.toml

@@ -1,22 +0,0 @@
-[package]
-name = "deepstrike-node"
-description = "Node.js bindings for DeepStrike runtime kernel"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-
-[lib]
-crate-type = ["cdylib"]
-
-[dependencies]
-# napi6 is required for BigInt support (we use it for u64 token counts and timestamps)
-napi = { version = "2", default-features = false, features = ["napi6"] }
-napi-derive = "2"
-deepstrike-core = { workspace = true }
-deepstrike-tokenizer = { workspace = true }
-compact_str = { workspace = true }
-serde_json = { workspace = true }
-
-[build-dependencies]
-napi-build = "2"
-

package/build.rs

@@ -1,3 +0,0 @@
-fn main() {
-    napi_build::setup();
-}

package/npm/darwin-arm64/README.md

@@ -1,22 +0,0 @@
-# `@deepstrike/core-darwin-arm64`
-
-Platform-specific native addon for [`@deepstrike/core`](https://www.npmjs.com/package/@deepstrike/core).
-
-- **Platform:** macOS ARM64 (Apple Silicon)
-- **Target triple:** `aarch64-apple-darwin`
-
-## Do not install directly
-
-This package is an internal binary dependency. Install [`@deepstrike/sdk`](https://www.npmjs.com/package/@deepstrike/sdk) instead — the correct platform package is selected and installed automatically via `optionalDependencies`.
-
-```bash
-npm install @deepstrike/sdk
-```
-
-## How it works
-
-`@deepstrike/core` loads this package at runtime when running on macOS with Apple Silicon. The `.node` file is a compiled Rust extension built with [napi-rs](https://napi.rs) that exposes the DeepStrike kernel (loop control, context compression, governance, signal routing) to Node.js.
-
-## License
-
-Apache-2.0 OR MIT

package/npm/darwin-arm64/package.json

@@ -1,16 +0,0 @@
-{
-  "name": "@deepstrike/core-darwin-arm64",
-  "version": "0.1.5",
-  "cpu": [
-    "arm64"
-  ],
-  "main": "deepstrike-core.darwin-arm64.node",
-  "files": [
-    "deepstrike-core.darwin-arm64.node"
-  ],
-  "description": "DeepStrike kernel — pre-built native addon",
-  "license": "Apache-2.0 OR MIT",
-  "os": [
-    "darwin"
-  ]
-}

package/npm/darwin-x64/README.md

@@ -1,22 +0,0 @@
-# `@deepstrike/core-darwin-x64`
-
-Platform-specific native addon for [`@deepstrike/core`](https://www.npmjs.com/package/@deepstrike/core).
-
-- **Platform:** macOS x64 (Intel)
-- **Target triple:** `x86_64-apple-darwin`
-
-## Do not install directly
-
-This package is an internal binary dependency. Install [`@deepstrike/sdk`](https://www.npmjs.com/package/@deepstrike/sdk) instead — the correct platform package is selected and installed automatically via `optionalDependencies`.
-
-```bash
-npm install @deepstrike/sdk
-```
-
-## How it works
-
-`@deepstrike/core` loads this package at runtime when running on macOS with an Intel processor. The `.node` file is a compiled Rust extension built with [napi-rs](https://napi.rs) that exposes the DeepStrike kernel (loop control, context compression, governance, signal routing) to Node.js.
-
-## License
-
-Apache-2.0 OR MIT

package/npm/darwin-x64/package.json

@@ -1,16 +0,0 @@
-{
-  "name": "@deepstrike/core-darwin-x64",
-  "version": "0.1.5",
-  "cpu": [
-    "x64"
-  ],
-  "main": "deepstrike-core.darwin-x64.node",
-  "files": [
-    "deepstrike-core.darwin-x64.node"
-  ],
-  "description": "DeepStrike kernel — pre-built native addon",
-  "license": "Apache-2.0 OR MIT",
-  "os": [
-    "darwin"
-  ]
-}

package/npm/linux-arm64-gnu/README.md

@@ -1,22 +0,0 @@
-# `@deepstrike/core-linux-arm64-gnu`
-
-Platform-specific native addon for [`@deepstrike/core`](https://www.npmjs.com/package/@deepstrike/core).
-
-- **Platform:** Linux ARM64 (glibc)
-- **Target triple:** `aarch64-unknown-linux-gnu`
-
-## Do not install directly
-
-This package is an internal binary dependency. Install [`@deepstrike/sdk`](https://www.npmjs.com/package/@deepstrike/sdk) instead — the correct platform package is selected and installed automatically via `optionalDependencies`.
-
-```bash
-npm install @deepstrike/sdk
-```
-
-## How it works
-
-`@deepstrike/core` loads this package at runtime when running on Linux ARM64 with glibc (e.g. AWS Graviton, Raspberry Pi OS 64-bit). The `.node` file is a compiled Rust extension built with [napi-rs](https://napi.rs) that exposes the DeepStrike kernel (loop control, context compression, governance, signal routing) to Node.js.
-
-## License
-
-Apache-2.0 OR MIT

package/npm/linux-arm64-gnu/package.json

@@ -1,19 +0,0 @@
-{
-  "name": "@deepstrike/core-linux-arm64-gnu",
-  "version": "0.1.5",
-  "cpu": [
-    "arm64"
-  ],
-  "main": "deepstrike-core.linux-arm64-gnu.node",
-  "files": [
-    "deepstrike-core.linux-arm64-gnu.node"
-  ],
-  "description": "DeepStrike kernel — pre-built native addon",
-  "license": "Apache-2.0 OR MIT",
-  "os": [
-    "linux"
-  ],
-  "libc": [
-    "glibc"
-  ]
-}

package/npm/linux-arm64-musl/README.md

@@ -1,22 +0,0 @@
-# `@deepstrike/core-linux-arm64-musl`
-
-Platform-specific native addon for [`@deepstrike/core`](https://www.npmjs.com/package/@deepstrike/core).
-
-- **Platform:** Linux ARM64 (musl / Alpine)
-- **Target triple:** `aarch64-unknown-linux-musl`
-
-## Do not install directly
-
-This package is an internal binary dependency. Install [`@deepstrike/sdk`](https://www.npmjs.com/package/@deepstrike/sdk) instead — the correct platform package is selected and installed automatically via `optionalDependencies`.
-
-```bash
-npm install @deepstrike/sdk
-```
-
-## How it works
-
-`@deepstrike/core` loads this package at runtime when running on Linux ARM64 with musl libc (e.g. Alpine Linux on ARM). The `.node` file is a compiled Rust extension built with [napi-rs](https://napi.rs) that exposes the DeepStrike kernel (loop control, context compression, governance, signal routing) to Node.js.
-
-## License
-
-Apache-2.0 OR MIT