@deepwatch/dsh-contracts 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 oxbshw
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,77 @@
+# @deepwatch/dsh-contracts
+
+Watch Bridge wire contracts shared by the Host plugins and the browser halves
+
+Part of **DeepWatch** — the agent workspace built on the official
+[DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)
+and powered by [Watch Skill](https://github.com/oxbshw/watch-skill) for perception, evidence, memory and
+independent verification.
+
+> **Shared contract — depended on by both halves.**
+> Anyone implementing either side of the Bridge — a host plugin, a browser half, or a client of your own.
+
+## Exports
+
+- `@deepwatch/dsh-contracts`
+- `@deepwatch/dsh-contracts/identity`
+- `@deepwatch/dsh-contracts/query`
+- `@deepwatch/dsh-contracts/query/validate`
+- `@deepwatch/dsh-contracts/query/wire`
+
+## Install
+
+> **Not on npm yet.** Nothing exists under the `@deepwatch` scope. This
+> package is published for the first time by the `deepwatch-v0.1.0`
+> release; until then the command below resolves nothing, and
+> [the workspace README](https://github.com/oxbshw/watch-skill/tree/main/workspace#readme) has the path
+> that works from a checkout.
+
+```sh
+npm install @deepwatch/dsh-contracts
+```
+
+Rarely on its own. [`@deepwatch/dsh-bundle`](https://github.com/oxbshw/watch-skill/tree/main/workspace/packages/watch/bundle#readme)
+composes this package with the rest of DeepWatch and is what a profile
+normally depends on; installing this one directly is for embedding a
+single piece in a composition you control.
+
+## Requirements
+
+- Node `^22.19.0 || >=24.0.0`
+
+None. Types and schemas only; it pulls in nothing at runtime.
+
+## Stability
+
+`0.1.0` — a stable release.
+
+Stable means tested, documented and supported — not 1.0. This is a
+pre-1.0 line, and semantic versioning gives `0.x` no compatibility
+guarantee across minor versions: **a `0.MINOR` bump may change or remove
+surface, and a patch will not.** Depend on it with a tilde range
+(`~0.1.0`) if you want that difference enforced by your lockfile
+rather than by a changelog. The usual major-version promise starts at 1.0.
+
+## Side effects
+
+Importing a module from this package evaluates no side effects, so a
+bundler may drop what a build does not use. Mounting it in a host is a
+separate matter: what it then reads or writes is governed by the
+workspace boundary and the host's permissions, not by this flag.
+
+## Where this fits
+
+The wire shapes both halves agree on. Changing a shape here changes both sides at once, which is the reason it is a package rather than two copies.
+
+The twenty packages and how they compose:
+[the package map](https://github.com/oxbshw/watch-skill/blob/main/workspace/docs/packages.md).
+Running DeepWatch, and the gates a change has to pass:
+[the workspace README](https://github.com/oxbshw/watch-skill/tree/main/workspace#readme).
+
+## Attribution
+
+Built on DeepSeek Harness · Powered by Watch Skill
+
+DeepWatch and Watch Skill are independent projects and are not affiliated
+with or endorsed by DeepSeek. MIT licensed; third-party notices are in
+[THIRD_PARTY_NOTICES.md](https://github.com/oxbshw/watch-skill/blob/main/workspace/THIRD_PARTY_NOTICES.md).

package/lib/approval.d.ts

@@ -0,0 +1,114 @@
+/**
+ * An approval covers one action, and only the action it was shown.
+ *
+ * The failure this module exists to prevent is subtle and completely silent
+ * when it happens. A person is shown "click Confirm on the payment page" and
+ * approves it. Between the approval and the dispatch, something changes the
+ * action — a different target, a different page, an extra field — and the
+ * approval, which was for a description rather than for a value, still
+ * applies. The receipt then records a properly approved action nobody agreed
+ * to, and it looks correct in every audit.
+ *
+ * So an approval binds to a digest of the exact action, and
+ * {@link checkApproval} refuses when the action's digest is not the one that
+ * was approved. Not warns, not re-prompts silently — refuses, and says which
+ * field moved, because "your approval no longer matches" is a sentence a
+ * person can act on and "permission denied" is not.
+ *
+ * Three other properties come along with it, and each closes a way an approval
+ * gets stretched past what it covered:
+ *
+ * - **It expires.** An approval held open across a long session is an approval
+ *   whose context the person no longer remembers.
+ * - **It is single-use by default.** A "yes" to one click is not a yes to
+ *   every click of that shape.
+ * - **It names who gave it.** An approval with no subject cannot be audited,
+ *   and an unauditable approval is indistinguishable from an assumed one.
+ *
+ * @module @deepwatch/dsh-contracts/approval
+ */
+/** What the person actually agreed to. */
+export interface Approval {
+    readonly approvalId: string;
+    /**
+     * Digest of the exact action that was shown.
+     *
+     * The load-bearing field. Everything else is metadata about the agreement;
+     * this is the agreement.
+     */
+    readonly inputDigest: string;
+    /** A short description of what was shown, for the audit trail and the UI. */
+    readonly summary: string;
+    readonly grantedByUserId: string;
+    readonly grantedAtMs: number;
+    readonly expiresAtMs: number;
+    /**
+     * How many times it may be used.
+     *
+     * One, unless somebody deliberately granted more. A standing approval is a
+     * real thing people sometimes want and never the default.
+     */
+    readonly maxUses: number;
+    readonly uses: number;
+    /** Set when the approval was withdrawn before it was used. */
+    readonly revokedAtMs: number | null;
+}
+/** An action asking to be dispatched. */
+export interface PendingAction {
+    readonly operationId: string;
+    readonly inputDigest: string;
+    readonly summary: string;
+    /** Whether this could change something outside Watch. */
+    readonly consequential: boolean;
+}
+/** Why an approval did not cover an action. */
+export type ApprovalRefusalCode = 'no_approval' | 'digest_mismatch' | 'expired' | 'revoked' | 'exhausted' | 'wrong_person';
+/** The outcome of checking an approval against an action. */
+export type ApprovalDecision = {
+    readonly ok: true;
+    readonly approval: Approval;
+} | {
+    readonly ok: false;
+    readonly code: ApprovalRefusalCode;
+    readonly message: string;
+    readonly fix: string;
+};
+/**
+ * Whether an approval covers an action.
+ *
+ * The digest comparison is first and is the whole point. Note that it happens
+ * before the expiry check: an action that does not match should say so rather
+ * than say "expired", because those two suggest completely different next
+ * steps, and telling somebody to approve again when the action changed
+ * underneath them is how the change gets approved.
+ */
+export declare function checkApproval(approval: Approval | null, action: PendingAction, context: {
+    readonly nowMs: number;
+    readonly actorUserId: string;
+}): ApprovalDecision;
+/** Record that an approval was spent. */
+export declare function consume(approval: Approval): Approval;
+/** Withdraw an approval before it is used. */
+export declare function revoke(approval: Approval, atMs: number): Approval;
+/**
+ * How long an approval lasts by default.
+ *
+ * Two minutes: long enough for a page to load and an action to dispatch, short
+ * enough that it cannot survive somebody walking away from the machine.
+ */
+export declare const DEFAULT_APPROVAL_TTL_MS = 120000;
+/**
+ * Grant an approval for exactly one action.
+ *
+ * Takes the action rather than a description, so an approval cannot be minted
+ * for something vaguer than what will be dispatched — which is the other half
+ * of the digest rule, and the half that is easy to leave out.
+ */
+export declare function grantFor(action: PendingAction, context: {
+    readonly approvalId: string;
+    readonly grantedByUserId: string;
+    readonly nowMs: number;
+    readonly ttlMs?: number;
+    readonly maxUses?: number;
+}): Approval;
+//# sourceMappingURL=approval.d.ts.map

package/lib/approval.js

@@ -0,0 +1,108 @@
+/**
+ * An approval covers one action, and only the action it was shown.
+ *
+ * The failure this module exists to prevent is subtle and completely silent
+ * when it happens. A person is shown "click Confirm on the payment page" and
+ * approves it. Between the approval and the dispatch, something changes the
+ * action — a different target, a different page, an extra field — and the
+ * approval, which was for a description rather than for a value, still
+ * applies. The receipt then records a properly approved action nobody agreed
+ * to, and it looks correct in every audit.
+ *
+ * So an approval binds to a digest of the exact action, and
+ * {@link checkApproval} refuses when the action's digest is not the one that
+ * was approved. Not warns, not re-prompts silently — refuses, and says which
+ * field moved, because "your approval no longer matches" is a sentence a
+ * person can act on and "permission denied" is not.
+ *
+ * Three other properties come along with it, and each closes a way an approval
+ * gets stretched past what it covered:
+ *
+ * - **It expires.** An approval held open across a long session is an approval
+ *   whose context the person no longer remembers.
+ * - **It is single-use by default.** A "yes" to one click is not a yes to
+ *   every click of that shape.
+ * - **It names who gave it.** An approval with no subject cannot be audited,
+ *   and an unauditable approval is indistinguishable from an assumed one.
+ *
+ * @module @deepwatch/dsh-contracts/approval
+ */
+/** Refuse, with something the person can do about it. */
+function refuse(code, message, fix) {
+    return { ok: false, code, message, fix };
+}
+/**
+ * Whether an approval covers an action.
+ *
+ * The digest comparison is first and is the whole point. Note that it happens
+ * before the expiry check: an action that does not match should say so rather
+ * than say "expired", because those two suggest completely different next
+ * steps, and telling somebody to approve again when the action changed
+ * underneath them is how the change gets approved.
+ */
+export function checkApproval(approval, action, context) {
+    if (!action.consequential) {
+        // Reading something needs no approval, and requiring one would train
+        // people to click through the ones that matter.
+        return approval === null
+            ? refuse('no_approval', 'No approval was supplied.', 'This action needs none; dispatch it directly.')
+            : { ok: true, approval };
+    }
+    if (approval === null) {
+        return refuse('no_approval', `"${action.summary}" could change something outside Watch and has no approval.`, 'Ask the person to approve this specific action.');
+    }
+    if (approval.inputDigest !== action.inputDigest) {
+        return refuse('digest_mismatch', `The approval was granted for "${approval.summary}", and this action is `
+            + `"${action.summary}". The approval does not cover it.`, 'Show the person the action as it is now and ask again.');
+    }
+    if (approval.revokedAtMs !== null) {
+        return refuse('revoked', 'That approval was withdrawn.', 'Ask again if it is still wanted.');
+    }
+    if (approval.expiresAtMs <= context.nowMs) {
+        return refuse('expired', 'That approval has expired.', 'Ask again, so the person is deciding with the current context.');
+    }
+    if (approval.uses >= approval.maxUses) {
+        return refuse('exhausted', `That approval was for ${String(approval.maxUses)} use(s) and has been used `
+            + `${String(approval.uses)} time(s).`, 'Ask again for this action.');
+    }
+    if (approval.grantedByUserId !== context.actorUserId) {
+        return refuse('wrong_person', 'That approval was granted by somebody else.', 'Approvals are not transferable. Ask the person acting to approve it themselves.');
+    }
+    return { ok: true, approval };
+}
+/** Record that an approval was spent. */
+export function consume(approval) {
+    return { ...approval, uses: approval.uses + 1 };
+}
+/** Withdraw an approval before it is used. */
+export function revoke(approval, atMs) {
+    return { ...approval, revokedAtMs: atMs };
+}
+/**
+ * How long an approval lasts by default.
+ *
+ * Two minutes: long enough for a page to load and an action to dispatch, short
+ * enough that it cannot survive somebody walking away from the machine.
+ */
+export const DEFAULT_APPROVAL_TTL_MS = 120_000;
+/**
+ * Grant an approval for exactly one action.
+ *
+ * Takes the action rather than a description, so an approval cannot be minted
+ * for something vaguer than what will be dispatched — which is the other half
+ * of the digest rule, and the half that is easy to leave out.
+ */
+export function grantFor(action, context) {
+    return {
+        approvalId: context.approvalId,
+        inputDigest: action.inputDigest,
+        summary: action.summary,
+        grantedByUserId: context.grantedByUserId,
+        grantedAtMs: context.nowMs,
+        expiresAtMs: context.nowMs + (context.ttlMs ?? DEFAULT_APPROVAL_TTL_MS),
+        maxUses: context.maxUses ?? 1,
+        uses: 0,
+        revokedAtMs: null,
+    };
+}
+//# sourceMappingURL=approval.js.map

package/lib/bindings.d.ts

@@ -0,0 +1,248 @@
+/**
+ * What a person actually chose: which provider, which model, for which role.
+ *
+ * {@link module:@deepwatch/dsh-contracts/readiness} answers "can this run?"
+ * from four separate facts. This module is where three of those facts are
+ * *kept* — a durable document recording the decisions, so that reopening the
+ * product finds the same bindings rather than an empty screen and a composer
+ * pointed at somebody else's default.
+ *
+ * **A binding is a reference, never a credential.** The document below can be
+ * read by anything: it is written to the Harness's own settings file, it rides
+ * the settings RPC, it appears in Diagnostics, and it is included in a session
+ * export. None of that is safe unless the rule is absolute, so it is: the only
+ * credential-shaped field here is {@link RoleBindingRecord.credentialRef}, an
+ * opaque handle the Host resolves against its own store. No value, no prefix,
+ * no suffix, no length, no hash. {@link assertNoSecretMaterial} is the test
+ * this file is held to.
+ *
+ * **Nothing is bound implicitly.** There is no "default role", no inheritance
+ * from one role to another, and no provider that becomes bound because it was
+ * the only one configured. A role with no entry in {@link WatchBindings.roles}
+ * is unbound, and unbound means the composer refuses. That is the whole point
+ * of the module: the failure it exists to prevent was a product that treated a
+ * saved credential as a decision the person never made.
+ *
+ * @module @deepwatch/dsh-contracts/bindings
+ */
+import type { Modality, RoleBinding } from './readiness.js';
+/**
+ * The settings namespace this document lives in.
+ *
+ * A DeepWatch-owned section of the Harness's own user-settings document, which
+ * is what makes the binding durable, hot-reloaded and editable by hand without
+ * DeepWatch inventing a second configuration store beside the one the product
+ * already has.
+ */
+export declare const BINDINGS_NAMESPACE = "watch-bindings";
+/**
+ * The document revision this build writes.
+ *
+ * Read forward, never rewritten in place: an older document is migrated on
+ * read and a newer one is refused rather than silently reinterpreted, because
+ * misreading a binding routes somebody's prompt somewhere they did not choose.
+ */
+export declare const BINDINGS_VERSION = 1;
+/**
+ * The roles a person can bind to a provider, in the order setup presents them.
+ *
+ * These ids are `RoleId`s from `@deepwatch/dsh-technology`, spelled here rather
+ * than imported because `contracts` is the package everything else depends on
+ * and must not depend on anything. `tests/bindings-store.test.mjs` asserts the
+ * two lists agree, so the duplication is checked rather than trusted -- one
+ * role vocabulary with a gate on it, instead of two that drift.
+ *
+ * It is a *subset*. `verifier`, `ocr_layout`, `reranking` and
+ * `speaker_diarization` are served by local engines rather than chosen from a
+ * provider catalogue, so offering them here would offer a choice that is not
+ * there.
+ *
+ * `agent_model` is first and is the only one the first conversation needs. The
+ * rest are progressive: a product that demanded five bindings before the first
+ * message would be a product nobody finished configuring.
+ */
+export declare const BINDABLE_ROLES: readonly ["agent_model", "visual_perception", "asr", "audio_understanding", "embeddings"];
+/** One of the roles this product knows how to bind. */
+export type BindableRole = (typeof BINDABLE_ROLES)[number];
+/** The role the first conversation needs, named once so nothing spells it twice. */
+export declare const PRIMARY_ROLE: BindableRole;
+/**
+ * What each role is called on screen.
+ *
+ * `agent_model` is labelled **Chat**, and the difference is not cosmetic. A
+ * person configuring this product is not choosing an "agent model" -- they are
+ * choosing what answers them in the surface the Harness calls Chat, and every
+ * blocked-composer message and setup step has to name the thing they are
+ * looking at. The id stays `agent_model` because that is the vocabulary the
+ * descriptors and the routing rules already use.
+ */
+export declare const ROLE_LABEL: Readonly<Record<BindableRole, string>>;
+/** Whether a string is a role this product binds. */
+export declare function isBindableRole(value: string): value is BindableRole;
+/**
+ * What each role is for, in a person's words.
+ *
+ * Here rather than in a component because the setup flow, the Role Bindings
+ * screen and the blocked-composer card all name the same role, and three
+ * copies of this sentence would eventually be three different sentences.
+ */
+export declare const ROLE_PURPOSE: Readonly<Record<BindableRole, string>>;
+/** The modalities each role's work actually needs a route to support. */
+export declare const ROLE_MODALITIES: Readonly<Record<BindableRole, readonly Modality[]>>;
+/**
+ * One stored decision.
+ *
+ * `boundAt` exists so Role Bindings can say when a choice was made rather than
+ * presenting every binding as timeless; it is a decision timestamp, not a
+ * verification one. Whether the binding *works* is never stored — that is
+ * derived at read time from the live credential and route facts, because a
+ * stored "verified" would go stale the moment a key was revoked and would be
+ * the same lie about readiness this whole subsystem exists to stop telling.
+ */
+export interface RoleBindingRecord {
+    /** The provider route id, as the Harness's catalogue names it. */
+    readonly provider: string;
+    /** The provider-owned model id. */
+    readonly model: string;
+    /**
+     * Opaque handle the Host resolves against its own credential store.
+     *
+     * Null when the route needs no credential (a local endpoint). Never a value.
+     */
+    readonly credentialRef: string | null;
+    /** ISO-8601 instant the person made this choice. */
+    readonly boundAt: string;
+    /**
+     * What kind of actor wrote this binding.
+     *
+     * A binding decides where a person's credential gets sent, and a record that
+     * cannot say who decided cannot be audited. A document written by somebody
+     * clicking Save in Role Bindings and one written by a script are the same
+     * bytes, and only one of them is a decision the person made.
+     *
+     * A *kind*, never an identity. No user name, no account, no machine: those
+     * are personal identifiers, this document is exported, rides the settings
+     * RPC and appears in Diagnostics, and the question worth answering is "did a
+     * person choose this" rather than "which person".
+     */
+    readonly boundBy: BindingActor;
+}
+/**
+ * Who wrote a binding.
+ *
+ * `unknown` is the honest reading of a document written before this field
+ * existed, or by a hand edit, or by any writer that did not say. It is not a
+ * defect and it is not `person`: presenting an unattributed binding as a
+ * deliberate choice is exactly the substitution this field exists to prevent.
+ */
+export type BindingActor = 'person' | 'setup' | 'unknown';
+/** The actors a stored document may name. */
+export declare const BINDING_ACTORS: readonly BindingActor[];
+/** Whether a stored value is an actor this build understands. */
+export declare function isBindingActor(value: unknown): value is BindingActor;
+/** The whole document, as stored. */
+export interface WatchBindings {
+    readonly version: number;
+    /** One entry per bound role. An absent role is unbound; there is no default. */
+    readonly roles: Readonly<Partial<Record<BindableRole, RoleBindingRecord>>>;
+}
+/** The document a profile that has never been configured has. */
+export declare const EMPTY_BINDINGS: WatchBindings;
+/**
+ * A model id worth storing.
+ *
+ * Deliberately permissive about shape — provider model ids are provider-owned
+ * and this product does not get to decide that `openai/gpt-4o` is malformed —
+ * and deliberately strict about the things that make a stored value dangerous:
+ * control characters, newlines and absurd length, all of which arrive from a
+ * hand-edited settings file rather than from the picker.
+ */
+export declare function isStorableId(value: unknown): value is string;
+/**
+ * Read a stored document, keeping only what is well-formed.
+ *
+ * A hand-edited settings file is a supported way to configure this product, so
+ * a malformed entry must not take the whole document with it: the bad role is
+ * dropped and the rest survive. Dropping is the safe direction — an unbound
+ * role refuses at the composer, where a person is told what to fix, whereas a
+ * half-read binding would route a prompt somewhere nobody chose.
+ *
+ * @param raw - whatever the settings document held.
+ * @returns a document this build can act on.
+ */
+export declare function readBindings(raw: unknown): WatchBindings;
+/**
+ * The document with one role bound, as a new value.
+ *
+ * Never mutates: the caller holds a snapshot it may still be rendering from,
+ * and a document edited underneath a React tree is a stale-render bug that
+ * shows somebody the binding they had a moment ago.
+ */
+export declare function withBinding(current: WatchBindings, role: BindableRole, record: RoleBindingRecord): WatchBindings;
+/** The document with one role unbound. */
+export declare function withoutBinding(current: WatchBindings, role: BindableRole): WatchBindings;
+/**
+ * The readiness-shaped view of one stored role, or null when it is unbound.
+ *
+ * The join between this module and `readiness`: storage keeps records, the
+ * gate takes {@link RoleBinding}s, and this is the only place that converts
+ * one into the other — so the modalities a role is checked against always come
+ * from {@link ROLE_MODALITIES} rather than from whatever a call site guessed.
+ */
+export declare function bindingFor(bindings: WatchBindings, role: BindableRole): RoleBinding | null;
+/** Whether a role has a stored decision at all. Not whether it can run. */
+export declare function isBound(bindings: WatchBindings, role: BindableRole): boolean;
+/**
+ * Every provider a stored binding names, once each.
+ *
+ * What Settings uses to decide which providers to show credential state for:
+ * the ones a person actually pointed something at, rather than all
+ * thirty-seven routes the catalogue carries.
+ */
+export declare function boundProviders(bindings: WatchBindings): readonly string[];
+/**
+ * Whether a provider/model pair is one this profile actually bound.
+ *
+ * The authoritative question, and deliberately the *narrow* one. It does not
+ * ask whether the route exists, whether a credential is stored, or whether the
+ * provider is reachable — those are the Host's to answer at the moment of the
+ * request. It asks the only thing a stored document can answer: did somebody
+ * choose this pair for something.
+ *
+ * That is what makes it usable as a gate at a routing boundary. A request for
+ * a pair nobody bound is a request nobody authorised, whatever the client that
+ * produced it believed — a stale tab holding a selection that has since been
+ * changed, or a caller that set one directly and skipped the screens.
+ *
+ * Any bound role counts, not only the one being served: a person who bound
+ * OpenRouter to Chat has authorised that route, and the title and compaction
+ * calls that ride the same selection are the same authorisation, not new ones.
+ *
+ * @param bindings - the stored document.
+ * @param provider - the route the request names.
+ * @param model - the model the request names.
+ * @returns whether some role in this profile is bound to exactly that pair.
+ */
+export declare function isRoutePermitted(bindings: WatchBindings, provider: string, model: string): boolean;
+/**
+ * Every distinct provider/model pair this profile bound, for a diagnostic.
+ *
+ * A refusal that says "this route is not bound" is not much use without the
+ * ability to say what *is*, and that list is a set of choices rather than
+ * anything sensitive — no credential, no reference, no host path.
+ */
+export declare function permittedRoutes(bindings: WatchBindings): readonly string[];
+/**
+ * Throw when a document about to be stored or shown carries secret material.
+ *
+ * A programming error rather than a runtime condition: every write path builds
+ * this document from a picker, so a value matching one of these means a code
+ * path has started copying a credential into a place that is read back in
+ * plain text. Failing loudly at the write is the only point where that is
+ * still cheap to fix.
+ *
+ * @param where - the surface being guarded, for a message that can be acted on.
+ * @param bindings - the document about to leave a trusted boundary.
+ */
+export declare function assertNoSecretMaterial(where: string, bindings: WatchBindings): void;
+//# sourceMappingURL=bindings.d.ts.map