@deepstrike/wasm-kernel 0.2.50 → 0.2.52

package/deepstrike_wasm.d.ts

@@ -1,5 +1,9 @@
 /* tslint:disable */
 /* eslint-disable */
+
+export type CanonicalRecordBytes = Uint8Array[];
+
+
 /**
  * Structured context for a provider call — emitted with `kind === \"call_llm\"`.
  */
@@ -27,6 +31,28 @@ export interface Verdict {
     skillCandidate?: SkillCandidate;
 }
 
+export interface CanonicalCheckpoint {
+    checkpointBytes: Uint8Array;
+    throughStepSeq: string;
+    coveredHead: string;
+    stateDigest: string;
+    ackToken: string;
+}
+
+export interface CanonicalCommit {
+    stepSeq: string;
+    recordDigest: string;
+    plannedStepJson: string;
+    checkpointAdviceJson?: string;
+}
+
+export interface CanonicalRestoreCost {
+    recordsBeforeCheckpoint: string;
+    tailInputsReplayed: string;
+    recordsAfterCheckpoint: string;
+    bytesRead: string;
+}
+
 export interface ContentPartObj {
     type: string;
     text?: string;
@@ -210,6 +236,41 @@ export interface ToolSchema {
     parameters: string;
 }
 
+export type CanonicalLifecycle = "created" | "configured" | "running" | "suspended" | "completed" | "cancelled" | "failed";
+
+export type CanonicalPreparation = { status: "prepared"; prepareToken: string; stepSeq: string; expectedHead?: string; recordDigest: string; recordBytes: Uint8Array; plannedStepJson: string } | { status: "replayed"; stepSeq: string; expectedHead?: string; recordDigest: string; recordBytes?: Uint8Array; plannedStepJson?: string } | { status: "rejected"; faultJson: string };
+
+
+/**
+ * Durable canonical operation handle. It exposes no direct `step` method.
+ */
+export class CanonicalKernel {
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * Abort a candidate that did not reach the journal.
+     */
+    abort(prepare_token: string): void;
+    ackCheckpoint(through_step_seq: string, covered_head: string): void;
+    checkpointCandidate(): CanonicalCheckpoint;
+    checkpointRebase(checkpoint_bytes: Uint8Array): CanonicalCheckpoint;
+    /**
+     * Commit only after the journal appended the prepared record.
+     */
+    commit(prepare_token: string, appended_head: string): CanonicalCommit;
+    lifecycle(): CanonicalLifecycle;
+    constructor();
+    pendingEffectsJson(): string;
+    /**
+     * Strictly decode and prepare one canonical envelope.
+     */
+    prepare(input_json: string): CanonicalPreparation;
+    /**
+     * Replace this handle in place from checkpoint bytes plus post-checkpoint record bytes.
+     */
+    restore(checkpoint_bytes: Uint8Array | null | undefined, record_bytes: any): CanonicalRestoreCost;
+    terminalJson(): string | undefined;
+}
 
 export class Governance {
     free(): void;
@@ -226,31 +287,6 @@ export class Governance {
     setTime(now_ms: number): void;
 }
 
-export class KernelRuntime {
-    free(): void;
-    [Symbol.dispose](): void;
-    abortPrepared(prepare_token: string): void;
-    commitPrepared(prepare_token: string): string;
-    /**
-     * Return a read-only JSON resource projection without mutating kernel state.
-     */
-    diagnostics(): string;
-    drainNewMessages(): Message[];
-    isTerminal(): boolean;
-    constructor(policy: LoopPolicy);
-    prepareStep(input_json: string): string;
-    preservedRefs(): string[];
-    recoveryContentBytes(): number;
-    render(): RenderedContext;
-    restore(snapshot_json: string): void;
-    snapshot(): string;
-    /**
-     * Feed a JSON-encoded KernelInput and return a JSON-encoded KernelStep.
-     */
-    step(input_json: string): string;
-    turn(): number;
-}
-
 export class SignalRouter {
     free(): void;
     [Symbol.dispose](): void;
@@ -273,6 +309,11 @@ export class SignalRouter {
  */
 export function buildEvalMessages(goal: string, criteria: Criterion[], result: string, attempt: number, extract_skill_on_pass: boolean): Message[];
 
+/**
+ * The single ABI revision accepted by core. Hosts must read this export instead of copying it.
+ */
+export function kernelAbiVersion(): number;
+
 /**
  * Parse the evaluator LLM's JSON response into a structured `Verdict`.
  */

package/deepstrike_wasm.js

@@ -5,5 +5,5 @@ import { __wbg_set_wasm } from "./deepstrike_wasm_bg.js";
 __wbg_set_wasm(wasm);
 
 export {
-    Governance, KernelRuntime, SignalRouter, buildEvalMessages, parseVerdict, verdictOutputSchema
+    CanonicalKernel, Governance, SignalRouter, buildEvalMessages, kernelAbiVersion, parseVerdict, verdictOutputSchema
 } from "./deepstrike_wasm_bg.js";

package/deepstrike_wasm_bg.js

@@ -1,145 +1,27 @@
-export class Governance {
-    __destroy_into_raw() {
-        const ptr = this.__wbg_ptr;
-        this.__wbg_ptr = 0;
-        GovernanceFinalization.unregister(this);
-        return ptr;
-    }
-    free() {
-        const ptr = this.__destroy_into_raw();
-        wasm.__wbg_governance_free(ptr, 0);
-    }
-    /**
-     * @param {string} pattern
-     * @param {string} action
-     */
-    addPermissionRule(pattern, action) {
-        const ptr0 = passStringToWasm0(pattern, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-        const len0 = WASM_VECTOR_LEN;
-        const ptr1 = passStringToWasm0(action, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-        const len1 = WASM_VECTOR_LEN;
-        wasm.governance_addPermissionRule(this.__wbg_ptr, ptr0, len0, ptr1, len1);
-    }
-    /**
-     * @param {string} tool_name
-     * @param {string} param_path
-     * @param {string[]} allowed_values
-     */
-    allowParamValues(tool_name, param_path, allowed_values) {
-        const ptr0 = passStringToWasm0(tool_name, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-        const len0 = WASM_VECTOR_LEN;
-        const ptr1 = passStringToWasm0(param_path, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-        const len1 = WASM_VECTOR_LEN;
-        const ptr2 = passArrayJsValueToWasm0(allowed_values, wasm.__wbindgen_export);
-        const len2 = WASM_VECTOR_LEN;
-        wasm.governance_allowParamValues(this.__wbg_ptr, ptr0, len0, ptr1, len1, ptr2, len2);
-    }
-    /**
-     * @param {string} name
-     */
-    blockTool(name) {
-        const ptr0 = passStringToWasm0(name, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-        const len0 = WASM_VECTOR_LEN;
-        wasm.governance_blockTool(this.__wbg_ptr, ptr0, len0);
-    }
-    /**
-     * @param {string} tool_name
-     * @param {string} args_json
-     * @returns {GovernanceVerdict}
-     */
-    evaluate(tool_name, args_json) {
-        const ptr0 = passStringToWasm0(tool_name, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-        const len0 = WASM_VECTOR_LEN;
-        const ptr1 = passStringToWasm0(args_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-        const len1 = WASM_VECTOR_LEN;
-        const ret = wasm.governance_evaluate(this.__wbg_ptr, ptr0, len0, ptr1, len1);
-        return takeObject(ret);
-    }
-    /**
-     * @param {string} tool_name
-     * @param {string} param_path
-     * @param {number | null} [min]
-     * @param {number | null} [max]
-     */
-    limitParamRange(tool_name, param_path, min, max) {
-        const ptr0 = passStringToWasm0(tool_name, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-        const len0 = WASM_VECTOR_LEN;
-        const ptr1 = passStringToWasm0(param_path, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-        const len1 = WASM_VECTOR_LEN;
-        wasm.governance_limitParamRange(this.__wbg_ptr, ptr0, len0, ptr1, len1, !isLikeNone(min), isLikeNone(min) ? 0 : min, !isLikeNone(max), isLikeNone(max) ? 0 : max);
-    }
-    /**
-     * @param {string | null} [default_action]
-     */
-    constructor(default_action) {
-        var ptr0 = isLikeNone(default_action) ? 0 : passStringToWasm0(default_action, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-        var len0 = WASM_VECTOR_LEN;
-        const ret = wasm.governance_new(ptr0, len0);
-        this.__wbg_ptr = ret;
-        GovernanceFinalization.register(this, this.__wbg_ptr, this);
-        return this;
-    }
-    /**
-     * @param {string} tool_name
-     * @param {string} param_path
-     */
-    requireParam(tool_name, param_path) {
-        const ptr0 = passStringToWasm0(tool_name, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-        const len0 = WASM_VECTOR_LEN;
-        const ptr1 = passStringToWasm0(param_path, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-        const len1 = WASM_VECTOR_LEN;
-        wasm.governance_requireParam(this.__wbg_ptr, ptr0, len0, ptr1, len1);
-    }
-    /**
-     * @param {string} agent_id
-     * @param {string} session_id
-     */
-    setIdentity(agent_id, session_id) {
-        const ptr0 = passStringToWasm0(agent_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-        const len0 = WASM_VECTOR_LEN;
-        const ptr1 = passStringToWasm0(session_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-        const len1 = WASM_VECTOR_LEN;
-        wasm.governance_setIdentity(this.__wbg_ptr, ptr0, len0, ptr1, len1);
-    }
-    /**
-     * @param {string} tool_name
-     * @param {number} max_calls
-     * @param {number} window_ms
-     */
-    setRateLimit(tool_name, max_calls, window_ms) {
-        const ptr0 = passStringToWasm0(tool_name, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-        const len0 = WASM_VECTOR_LEN;
-        wasm.governance_setRateLimit(this.__wbg_ptr, ptr0, len0, max_calls, window_ms);
-    }
-    /**
-     * @param {number} now_ms
-     */
-    setTime(now_ms) {
-        wasm.governance_setTime(this.__wbg_ptr, now_ms);
-    }
-}
-if (Symbol.dispose) Governance.prototype[Symbol.dispose] = Governance.prototype.free;
-
-export class KernelRuntime {
+/**
+ * Durable canonical operation handle. It exposes no direct `step` method.
+ */
+export class CanonicalKernel {
     __destroy_into_raw() {
         const ptr = this.__wbg_ptr;
         this.__wbg_ptr = 0;
-        KernelRuntimeFinalization.unregister(this);
+        CanonicalKernelFinalization.unregister(this);
         return ptr;
     }
     free() {
         const ptr = this.__destroy_into_raw();
-        wasm.__wbg_kernelruntime_free(ptr, 0);
+        wasm.__wbg_canonicalkernel_free(ptr, 0);
     }
     /**
+     * Abort a candidate that did not reach the journal.
      * @param {string} prepare_token
      */
-    abortPrepared(prepare_token) {
+    abort(prepare_token) {
         try {
             const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
             const ptr0 = passStringToWasm0(prepare_token, wasm.__wbindgen_export, wasm.__wbindgen_export2);
             const len0 = WASM_VECTOR_LEN;
-            wasm.kernelruntime_abortPrepared(retptr, this.__wbg_ptr, ptr0, len0);
+            wasm.canonicalkernel_abort(retptr, this.__wbg_ptr, ptr0, len0);
             var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
             var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
             if (r1) {
@@ -150,240 +32,319 @@ export class KernelRuntime {
         }
     }
     /**
-     * @param {string} prepare_token
-     * @returns {string}
+     * @param {string} through_step_seq
+     * @param {string} covered_head
      */
-    commitPrepared(prepare_token) {
-        let deferred3_0;
-        let deferred3_1;
+    ackCheckpoint(through_step_seq, covered_head) {
         try {
             const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-            const ptr0 = passStringToWasm0(prepare_token, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+            const ptr0 = passStringToWasm0(through_step_seq, wasm.__wbindgen_export, wasm.__wbindgen_export2);
             const len0 = WASM_VECTOR_LEN;
-            wasm.kernelruntime_commitPrepared(retptr, this.__wbg_ptr, ptr0, len0);
+            const ptr1 = passStringToWasm0(covered_head, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+            const len1 = WASM_VECTOR_LEN;
+            wasm.canonicalkernel_ackCheckpoint(retptr, this.__wbg_ptr, ptr0, len0, ptr1, len1);
             var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
             var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-            var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
-            var r3 = getDataViewMemory0().getInt32(retptr + 4 * 3, true);
-            var ptr2 = r0;
-            var len2 = r1;
-            if (r3) {
-                ptr2 = 0; len2 = 0;
-                throw takeObject(r2);
+            if (r1) {
+                throw takeObject(r0);
             }
-            deferred3_0 = ptr2;
-            deferred3_1 = len2;
-            return getStringFromWasm0(ptr2, len2);
         } finally {
             wasm.__wbindgen_add_to_stack_pointer(16);
-            wasm.__wbindgen_export4(deferred3_0, deferred3_1, 1);
         }
     }
     /**
-     * Return a read-only JSON resource projection without mutating kernel state.
-     * @returns {string}
+     * @returns {CanonicalCheckpoint}
      */
-    diagnostics() {
-        let deferred2_0;
-        let deferred2_1;
+    checkpointCandidate() {
         try {
             const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-            wasm.kernelruntime_diagnostics(retptr, this.__wbg_ptr);
+            wasm.canonicalkernel_checkpointCandidate(retptr, this.__wbg_ptr);
             var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
             var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
             var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
-            var r3 = getDataViewMemory0().getInt32(retptr + 4 * 3, true);
-            var ptr1 = r0;
-            var len1 = r1;
-            if (r3) {
-                ptr1 = 0; len1 = 0;
-                throw takeObject(r2);
+            if (r2) {
+                throw takeObject(r1);
             }
-            deferred2_0 = ptr1;
-            deferred2_1 = len1;
-            return getStringFromWasm0(ptr1, len1);
+            return takeObject(r0);
         } finally {
             wasm.__wbindgen_add_to_stack_pointer(16);
-            wasm.__wbindgen_export4(deferred2_0, deferred2_1, 1);
         }
     }
     /**
-     * @returns {Message[]}
+     * @param {Uint8Array} checkpoint_bytes
+     * @returns {CanonicalCheckpoint}
      */
-    drainNewMessages() {
+    checkpointRebase(checkpoint_bytes) {
         try {
             const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-            wasm.kernelruntime_drainNewMessages(retptr, this.__wbg_ptr);
+            wasm.canonicalkernel_checkpointRebase(retptr, this.__wbg_ptr, addHeapObject(checkpoint_bytes));
             var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
             var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-            var v1 = getArrayJsValueFromWasm0(r0, r1).slice();
-            wasm.__wbindgen_export4(r0, r1 * 4, 4);
-            return v1;
+            var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+            if (r2) {
+                throw takeObject(r1);
+            }
+            return takeObject(r0);
         } finally {
             wasm.__wbindgen_add_to_stack_pointer(16);
         }
     }
     /**
-     * @returns {boolean}
+     * Commit only after the journal appended the prepared record.
+     * @param {string} prepare_token
+     * @param {string} appended_head
+     * @returns {CanonicalCommit}
      */
-    isTerminal() {
-        const ret = wasm.kernelruntime_isTerminal(this.__wbg_ptr);
-        return ret !== 0;
+    commit(prepare_token, appended_head) {
+        try {
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            const ptr0 = passStringToWasm0(prepare_token, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+            const len0 = WASM_VECTOR_LEN;
+            const ptr1 = passStringToWasm0(appended_head, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+            const len1 = WASM_VECTOR_LEN;
+            wasm.canonicalkernel_commit(retptr, this.__wbg_ptr, ptr0, len0, ptr1, len1);
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+            if (r2) {
+                throw takeObject(r1);
+            }
+            return takeObject(r0);
+        } finally {
+            wasm.__wbindgen_add_to_stack_pointer(16);
+        }
     }
     /**
-     * @param {LoopPolicy} policy
+     * @returns {CanonicalLifecycle}
      */
-    constructor(policy) {
-        const ret = wasm.kernelruntime_new(addHeapObject(policy));
+    lifecycle() {
+        const ret = wasm.canonicalkernel_lifecycle(this.__wbg_ptr);
+        return takeObject(ret);
+    }
+    constructor() {
+        const ret = wasm.canonicalkernel_new();
         this.__wbg_ptr = ret;
-        KernelRuntimeFinalization.register(this, this.__wbg_ptr, this);
+        CanonicalKernelFinalization.register(this, this.__wbg_ptr, this);
         return this;
     }
     /**
-     * @param {string} input_json
      * @returns {string}
      */
-    prepareStep(input_json) {
-        let deferred3_0;
-        let deferred3_1;
+    pendingEffectsJson() {
+        let deferred2_0;
+        let deferred2_1;
         try {
             const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-            const ptr0 = passStringToWasm0(input_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-            const len0 = WASM_VECTOR_LEN;
-            wasm.kernelruntime_prepareStep(retptr, this.__wbg_ptr, ptr0, len0);
+            wasm.canonicalkernel_pendingEffectsJson(retptr, this.__wbg_ptr);
             var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
             var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
             var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
             var r3 = getDataViewMemory0().getInt32(retptr + 4 * 3, true);
-            var ptr2 = r0;
-            var len2 = r1;
+            var ptr1 = r0;
+            var len1 = r1;
             if (r3) {
-                ptr2 = 0; len2 = 0;
+                ptr1 = 0; len1 = 0;
                 throw takeObject(r2);
             }
-            deferred3_0 = ptr2;
-            deferred3_1 = len2;
-            return getStringFromWasm0(ptr2, len2);
-        } finally {
-            wasm.__wbindgen_add_to_stack_pointer(16);
-            wasm.__wbindgen_export4(deferred3_0, deferred3_1, 1);
-        }
-    }
-    /**
-     * @returns {string[]}
-     */
-    preservedRefs() {
-        try {
-            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-            wasm.kernelruntime_preservedRefs(retptr, this.__wbg_ptr);
-            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-            var v1 = getArrayJsValueFromWasm0(r0, r1).slice();
-            wasm.__wbindgen_export4(r0, r1 * 4, 4);
-            return v1;
+            deferred2_0 = ptr1;
+            deferred2_1 = len1;
+            return getStringFromWasm0(ptr1, len1);
         } finally {
             wasm.__wbindgen_add_to_stack_pointer(16);
+            wasm.__wbindgen_export4(deferred2_0, deferred2_1, 1);
         }
     }
     /**
-     * @returns {number}
-     */
-    recoveryContentBytes() {
-        const ret = wasm.kernelruntime_recoveryContentBytes(this.__wbg_ptr);
-        return ret >>> 0;
-    }
-    /**
-     * @returns {RenderedContext}
-     */
-    render() {
-        const ret = wasm.kernelruntime_render(this.__wbg_ptr);
-        return takeObject(ret);
-    }
-    /**
-     * @param {string} snapshot_json
+     * Strictly decode and prepare one canonical envelope.
+     * @param {string} input_json
+     * @returns {CanonicalPreparation}
      */
-    restore(snapshot_json) {
+    prepare(input_json) {
         try {
             const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-            const ptr0 = passStringToWasm0(snapshot_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+            const ptr0 = passStringToWasm0(input_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
             const len0 = WASM_VECTOR_LEN;
-            wasm.kernelruntime_restore(retptr, this.__wbg_ptr, ptr0, len0);
+            wasm.canonicalkernel_prepare(retptr, this.__wbg_ptr, ptr0, len0);
             var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
             var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-            if (r1) {
-                throw takeObject(r0);
+            var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+            if (r2) {
+                throw takeObject(r1);
             }
+            return takeObject(r0);
         } finally {
             wasm.__wbindgen_add_to_stack_pointer(16);
         }
     }
     /**
-     * @returns {string}
+     * Replace this handle in place from checkpoint bytes plus post-checkpoint record bytes.
+     * @param {Uint8Array | null | undefined} checkpoint_bytes
+     * @param {any} record_bytes
+     * @returns {CanonicalRestoreCost}
      */
-    snapshot() {
-        let deferred2_0;
-        let deferred2_1;
+    restore(checkpoint_bytes, record_bytes) {
         try {
             const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-            wasm.kernelruntime_snapshot(retptr, this.__wbg_ptr);
+            wasm.canonicalkernel_restore(retptr, this.__wbg_ptr, isLikeNone(checkpoint_bytes) ? 0 : addHeapObject(checkpoint_bytes), addHeapObject(record_bytes));
             var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
             var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
             var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
-            var r3 = getDataViewMemory0().getInt32(retptr + 4 * 3, true);
-            var ptr1 = r0;
-            var len1 = r1;
-            if (r3) {
-                ptr1 = 0; len1 = 0;
-                throw takeObject(r2);
+            if (r2) {
+                throw takeObject(r1);
             }
-            deferred2_0 = ptr1;
-            deferred2_1 = len1;
-            return getStringFromWasm0(ptr1, len1);
+            return takeObject(r0);
         } finally {
             wasm.__wbindgen_add_to_stack_pointer(16);
-            wasm.__wbindgen_export4(deferred2_0, deferred2_1, 1);
         }
     }
     /**
-     * Feed a JSON-encoded KernelInput and return a JSON-encoded KernelStep.
-     * @param {string} input_json
-     * @returns {string}
+     * @returns {string | undefined}
      */
-    step(input_json) {
-        let deferred3_0;
-        let deferred3_1;
+    terminalJson() {
         try {
             const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-            const ptr0 = passStringToWasm0(input_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
-            const len0 = WASM_VECTOR_LEN;
-            wasm.kernelruntime_step(retptr, this.__wbg_ptr, ptr0, len0);
+            wasm.canonicalkernel_terminalJson(retptr, this.__wbg_ptr);
             var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
             var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
             var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
             var r3 = getDataViewMemory0().getInt32(retptr + 4 * 3, true);
-            var ptr2 = r0;
-            var len2 = r1;
             if (r3) {
-                ptr2 = 0; len2 = 0;
                 throw takeObject(r2);
             }
-            deferred3_0 = ptr2;
-            deferred3_1 = len2;
-            return getStringFromWasm0(ptr2, len2);
+            let v1;
+            if (r0 !== 0) {
+                v1 = getStringFromWasm0(r0, r1).slice();
+                wasm.__wbindgen_export4(r0, r1 * 1, 1);
+            }
+            return v1;
         } finally {
             wasm.__wbindgen_add_to_stack_pointer(16);
-            wasm.__wbindgen_export4(deferred3_0, deferred3_1, 1);
         }
     }
+}
+if (Symbol.dispose) CanonicalKernel.prototype[Symbol.dispose] = CanonicalKernel.prototype.free;
+
+export class Governance {
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        GovernanceFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_governance_free(ptr, 0);
+    }
     /**
-     * @returns {number}
+     * @param {string} pattern
+     * @param {string} action
      */
-    turn() {
-        const ret = wasm.kernelruntime_turn(this.__wbg_ptr);
-        return ret >>> 0;
+    addPermissionRule(pattern, action) {
+        const ptr0 = passStringToWasm0(pattern, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(action, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        wasm.governance_addPermissionRule(this.__wbg_ptr, ptr0, len0, ptr1, len1);
+    }
+    /**
+     * @param {string} tool_name
+     * @param {string} param_path
+     * @param {string[]} allowed_values
+     */
+    allowParamValues(tool_name, param_path, allowed_values) {
+        const ptr0 = passStringToWasm0(tool_name, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(param_path, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        const ptr2 = passArrayJsValueToWasm0(allowed_values, wasm.__wbindgen_export);
+        const len2 = WASM_VECTOR_LEN;
+        wasm.governance_allowParamValues(this.__wbg_ptr, ptr0, len0, ptr1, len1, ptr2, len2);
+    }
+    /**
+     * @param {string} name
+     */
+    blockTool(name) {
+        const ptr0 = passStringToWasm0(name, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.governance_blockTool(this.__wbg_ptr, ptr0, len0);
+    }
+    /**
+     * @param {string} tool_name
+     * @param {string} args_json
+     * @returns {GovernanceVerdict}
+     */
+    evaluate(tool_name, args_json) {
+        const ptr0 = passStringToWasm0(tool_name, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(args_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        const ret = wasm.governance_evaluate(this.__wbg_ptr, ptr0, len0, ptr1, len1);
+        return takeObject(ret);
+    }
+    /**
+     * @param {string} tool_name
+     * @param {string} param_path
+     * @param {number | null} [min]
+     * @param {number | null} [max]
+     */
+    limitParamRange(tool_name, param_path, min, max) {
+        const ptr0 = passStringToWasm0(tool_name, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(param_path, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        wasm.governance_limitParamRange(this.__wbg_ptr, ptr0, len0, ptr1, len1, !isLikeNone(min), isLikeNone(min) ? 0 : min, !isLikeNone(max), isLikeNone(max) ? 0 : max);
+    }
+    /**
+     * @param {string | null} [default_action]
+     */
+    constructor(default_action) {
+        var ptr0 = isLikeNone(default_action) ? 0 : passStringToWasm0(default_action, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        var len0 = WASM_VECTOR_LEN;
+        const ret = wasm.governance_new(ptr0, len0);
+        this.__wbg_ptr = ret;
+        GovernanceFinalization.register(this, this.__wbg_ptr, this);
+        return this;
+    }
+    /**
+     * @param {string} tool_name
+     * @param {string} param_path
+     */
+    requireParam(tool_name, param_path) {
+        const ptr0 = passStringToWasm0(tool_name, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(param_path, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        wasm.governance_requireParam(this.__wbg_ptr, ptr0, len0, ptr1, len1);
+    }
+    /**
+     * @param {string} agent_id
+     * @param {string} session_id
+     */
+    setIdentity(agent_id, session_id) {
+        const ptr0 = passStringToWasm0(agent_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(session_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        wasm.governance_setIdentity(this.__wbg_ptr, ptr0, len0, ptr1, len1);
+    }
+    /**
+     * @param {string} tool_name
+     * @param {number} max_calls
+     * @param {number} window_ms
+     */
+    setRateLimit(tool_name, max_calls, window_ms) {
+        const ptr0 = passStringToWasm0(tool_name, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.governance_setRateLimit(this.__wbg_ptr, ptr0, len0, max_calls, window_ms);
+    }
+    /**
+     * @param {number} now_ms
+     */
+    setTime(now_ms) {
+        wasm.governance_setTime(this.__wbg_ptr, now_ms);
     }
 }
-if (Symbol.dispose) KernelRuntime.prototype[Symbol.dispose] = KernelRuntime.prototype.free;
+if (Symbol.dispose) Governance.prototype[Symbol.dispose] = Governance.prototype.free;
 
 export class SignalRouter {
     __destroy_into_raw() {
@@ -488,6 +449,15 @@ export function buildEvalMessages(goal, criteria, result, attempt, extract_skill
     }
 }
 
+/**
+ * The single ABI revision accepted by core. Hosts must read this export instead of copying it.
+ * @returns {number}
+ */
+export function kernelAbiVersion() {
+    const ret = wasm.kernelAbiVersion();
+    return ret >>> 0;
+}
+
 /**
  * Parse the evaluator LLM's JSON response into a structured `Verdict`.
  * @param {string} content
@@ -553,6 +523,10 @@ export function __wbg___wbindgen_in_07056af4f902c445(arg0, arg1) {
     const ret = getObject(arg0) in getObject(arg1);
     return ret;
 }
+export function __wbg___wbindgen_is_null_2042690d351e14f0(arg0) {
+    const ret = getObject(arg0) === null;
+    return ret;
+}
 export function __wbg___wbindgen_is_object_b4593df85baada48(arg0) {
     const val = getObject(arg0);
     const ret = typeof(val) === 'object' && val !== null;
@@ -583,9 +557,17 @@ export function __wbg___wbindgen_string_get_d109740c0d18f4d7(arg0, arg1) {
 export function __wbg___wbindgen_throw_9c31b086c2b26051(arg0, arg1) {
     throw new Error(getStringFromWasm0(arg0, arg1));
 }
+export function __wbg_from_fa561fa561dc8031(arg0) {
+    const ret = Array.from(getObject(arg0));
+    return addHeapObject(ret);
+}
 export function __wbg_getRandomValues_ef12552bf5acd2fe() { return handleError(function (arg0, arg1) {
     globalThis.crypto.getRandomValues(getArrayU8FromWasm0(arg0, arg1));
 }, arguments); }
+export function __wbg_get_98fdf51d029a75eb(arg0, arg1) {
+    const ret = getObject(arg0)[arg1 >>> 0];
+    return addHeapObject(ret);
+}
 export function __wbg_get_with_ref_key_6412cf3094599694(arg0, arg1) {
     const ret = getObject(arg0)[getObject(arg1)];
     return addHeapObject(ret);
@@ -610,10 +592,18 @@ export function __wbg_instanceof_Uint8Array_abd07d4bd221d50b(arg0) {
     const ret = result;
     return ret;
 }
+export function __wbg_isArray_94898ed3aad6947b(arg0) {
+    const ret = Array.isArray(getObject(arg0));
+    return ret;
+}
 export function __wbg_isSafeInteger_01e964d144ad3a55(arg0) {
     const ret = Number.isSafeInteger(getObject(arg0));
     return ret;
 }
+export function __wbg_length_2591a0f4f659a55c(arg0) {
+    const ret = getObject(arg0).length;
+    return ret;
+}
 export function __wbg_length_56fcd3e2b7e0299d(arg0) {
     const ret = getObject(arg0).length;
     return ret;
@@ -645,6 +635,11 @@ export function __wbindgen_cast_0000000000000001(arg0) {
     return addHeapObject(ret);
 }
 export function __wbindgen_cast_0000000000000002(arg0, arg1) {
+    // Cast intrinsic for `Ref(Slice(U8)) -> NamedExternref("Uint8Array")`.
+    const ret = getArrayU8FromWasm0(arg0, arg1);
+    return addHeapObject(ret);
+}
+export function __wbindgen_cast_0000000000000003(arg0, arg1) {
     // Cast intrinsic for `Ref(String) -> Externref`.
     const ret = getStringFromWasm0(arg0, arg1);
     return addHeapObject(ret);
@@ -656,12 +651,12 @@ export function __wbindgen_object_clone_ref(arg0) {
 export function __wbindgen_object_drop_ref(arg0) {
     takeObject(arg0);
 }
+const CanonicalKernelFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_canonicalkernel_free(ptr, 1));
 const GovernanceFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_governance_free(ptr, 1));
-const KernelRuntimeFinalization = (typeof FinalizationRegistry === 'undefined')
-    ? { register: () => {}, unregister: () => {} }
-    : new FinalizationRegistry(ptr => wasm.__wbg_kernelruntime_free(ptr, 1));
 const SignalRouterFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_signalrouter_free(ptr, 1));

package/package.json

@@ -2,7 +2,7 @@
   "name": "@deepstrike/wasm-kernel",
   "type": "module",
   "description": "WebAssembly bindings for DeepStrike runtime kernel",
-  "version": "0.2.50",
+  "version": "0.2.52",
   "license": "MIT",
   "files": [
     "deepstrike_wasm_bg.wasm",