@dynamicalsystems/idl 0.6.1

package/dist/index.cjs

@@ -0,0 +1,692 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let _sinclair_typebox = require("@sinclair/typebox");
+let _dynamicalsystems_orn_schemas = require("@dynamicalsystems/orn-schemas");
+//#region src/primitives.ts
+/** Closed object: an extra field is a different protocol. */
+const closed = (properties) => _sinclair_typebox.Type.Object(properties, { additionalProperties: false });
+/** Lowercase sha256 hex. Every digest on the wire. */
+const Hex64 = _sinclair_typebox.Type.String({ pattern: "^[0-9a-f]{64}$" });
+/** Exact UTC second, Z suffix, no fractional part. */
+const UtcSecond = _sinclair_typebox.Type.String({ pattern: "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$" });
+const NonEmptyString = _sinclair_typebox.Type.String({ minLength: 1 });
+const SafeInt = _sinclair_typebox.Type.Integer({
+	minimum: 0,
+	maximum: Number.MAX_SAFE_INTEGER
+});
+/** An ORN, validated by the grammar dsg-orn owns. Built from the exported
+* pattern, not the exported schema object: the upstream schemas carry
+* JSON Schema $id metadata, and embedding the same $id in several route
+* schemas makes validators refuse the duplicate. The pattern is the wire
+* truth; the metadata is not. */
+const Orn = _sinclair_typebox.Type.String({ pattern: _dynamicalsystems_orn_schemas.ORN_PATTERN });
+/** The pair of an ORN and the sha256 pinning a version (dsg-orn Reference). */
+const Reference = closed({
+	orn: Orn,
+	sha256: _sinclair_typebox.Type.String({ pattern: _dynamicalsystems_orn_schemas.SHA256_PATTERN })
+});
+//#endregion
+//#region src/kernel/dispatch-consume.v1.ts
+const DISPATCH_CONSUME_PROFILE = "dsg.kernel.dispatch-consume/1";
+/** The bounded clock skew a lease check must tolerate, in seconds. */
+const DISPATCH_MAX_SKEW_SECONDS = 300;
+const DispatchConsumeRequestSchema = closed({
+	profile: _sinclair_typebox.Type.Literal(DISPATCH_CONSUME_PROFILE),
+	/** The kernel operation identity from the accepted OperationRequest. */
+	operationId: NonEmptyString,
+	/** The workspace generation the plane admitted the operation at. */
+	generation: _sinclair_typebox.Type.Integer({ minimum: 0 }),
+	/** The Case the operation belongs to - the stream the consume event
+	*  lands on and the stream the reservation was recorded on. */
+	caseOrn: Orn,
+	/** SHA256(JCS(complete OperationRequest)) - the M010 envelope digest. */
+	envelopeSha256: Hex64,
+	/** The exact retained signed-law bytes the Case pins. */
+	lawSha256: Hex64,
+	/** The K04 reservation the authorization is bound to: sha256 is the
+	*  reservation event's record id. */
+	reservation: Reference,
+	requestedAt: UtcSecond,
+	/** False: first consumption or idempotent replay of it. True: an explicit
+	*  renewal - a new recorded authorization decision for the same operation
+	*  and reservation after lease expiry with the work known unsubmitted. A
+	*  replay never renews; only this flag does, and it re-runs every
+	*  revocation check at the current record state. */
+	renewal: _sinclair_typebox.Type.Boolean()
+});
+const DispatchLeaseSchema = closed({
+	profile: _sinclair_typebox.Type.Literal(DISPATCH_CONSUME_PROFILE),
+	/** The consume event's record id: the committed ordering point. */
+	leaseId: Hex64,
+	operationId: NonEmptyString,
+	generation: _sinclair_typebox.Type.Integer({ minimum: 0 }),
+	caseOrn: Orn,
+	envelopeSha256: Hex64,
+	lawSha256: Hex64,
+	reservation: Reference,
+	consumedAt: UtcSecond,
+	/** Fixed maximum duration from consumedAt; the plane checks validity
+	*  before each new non-cleanup call, Batch submission included. */
+	expiresAt: UtcSecond,
+	/** The bounded clock skew a lease check must tolerate, in seconds. */
+	maxSkewSeconds: _sinclair_typebox.Type.Integer({
+		minimum: 0,
+		maximum: 300
+	}),
+	renewal: _sinclair_typebox.Type.Literal("new-authorization-required"),
+	/** False when this response replays an earlier committed consumption:
+	*  the lease bytes, expiry included, are the original's. */
+	fresh: _sinclair_typebox.Type.Boolean()
+});
+const DispatchRefusalCodeSchema = _sinclair_typebox.Type.Union([
+	_sinclair_typebox.Type.Literal("unknown_operation"),
+	_sinclair_typebox.Type.Literal("no_reservation"),
+	_sinclair_typebox.Type.Literal("binding_mismatch"),
+	_sinclair_typebox.Type.Literal("revoked"),
+	_sinclair_typebox.Type.Literal("authority_refused"),
+	_sinclair_typebox.Type.Literal("renewal_requires_existing_consumption"),
+	_sinclair_typebox.Type.Literal("unavailable")
+]);
+const DispatchRefusalSchema = closed({
+	profile: _sinclair_typebox.Type.Literal(DISPATCH_CONSUME_PROFILE),
+	code: DispatchRefusalCodeSchema,
+	issues: _sinclair_typebox.Type.Array(NonEmptyString, { minItems: 1 })
+});
+const dispatchConsumeV1 = {
+	literal: DISPATCH_CONSUME_PROFILE,
+	shapes: {
+		request: DispatchConsumeRequestSchema,
+		lease: DispatchLeaseSchema,
+		refusal: DispatchRefusalSchema
+	}
+};
+//#endregion
+//#region src/run/operation.v1.ts
+const OPERATION_PROFILE = "dsg.run.operation/1";
+const ExecutionResourcesSchema = closed({
+	maxGpuSeconds: SafeInt,
+	maxRunSeconds: SafeInt,
+	maxParallelism: SafeInt
+});
+const ExecutionLawSchema = closed({
+	bundle: Reference,
+	registryRelease: Reference
+});
+const ExecutionDocumentSchema = closed({
+	schemaVersion: _sinclair_typebox.Type.Literal(1),
+	classContract: Reference,
+	law: ExecutionLawSchema,
+	workload: Reference,
+	inputs: _sinclair_typebox.Type.Array(Reference),
+	resources: ExecutionResourcesSchema,
+	costBound: Reference,
+	placement: Reference,
+	results: Reference,
+	secrets: _sinclair_typebox.Type.Array(Reference)
+});
+const OperationBeforeSchema = closed({
+	operationId: _sinclair_typebox.Type.Union([NonEmptyString, _sinclair_typebox.Type.Null()]),
+	planDigest: _sinclair_typebox.Type.Union([Hex64, _sinclair_typebox.Type.Null()])
+});
+const OperationRequestSchema = closed({
+	profile: _sinclair_typebox.Type.Literal(OPERATION_PROFILE),
+	operationId: NonEmptyString,
+	case: Reference,
+	workspace: NonEmptyString,
+	expectedGeneration: SafeInt,
+	before: OperationBeforeSchema,
+	planDigest: Hex64,
+	document: ExecutionDocumentSchema,
+	authority: Reference,
+	reservation: Reference
+});
+const AcceptedSchema = closed({
+	profile: _sinclair_typebox.Type.Literal(OPERATION_PROFILE),
+	operationId: NonEmptyString,
+	actionId: NonEmptyString,
+	generation: SafeInt,
+	planDigest: Hex64,
+	acceptedAt: NonEmptyString
+});
+const OperationExecutionSchema = _sinclair_typebox.Type.Union([
+	_sinclair_typebox.Type.Literal("queued"),
+	_sinclair_typebox.Type.Literal("running"),
+	_sinclair_typebox.Type.Literal("succeeded"),
+	_sinclair_typebox.Type.Literal("failed"),
+	_sinclair_typebox.Type.Literal("canceled"),
+	_sinclair_typebox.Type.Literal("unknown")
+]);
+const OperationCleanupSchema = _sinclair_typebox.Type.Union([
+	_sinclair_typebox.Type.Literal("pending"),
+	_sinclair_typebox.Type.Literal("present"),
+	_sinclair_typebox.Type.Literal("absent"),
+	_sinclair_typebox.Type.Literal("unknown")
+]);
+const OperationEvidenceSchema = _sinclair_typebox.Type.Union([_sinclair_typebox.Type.Literal("pending"), _sinclair_typebox.Type.Literal("ready")]);
+const OperationCostSchema = _sinclair_typebox.Type.Union([
+	_sinclair_typebox.Type.Literal("reserved"),
+	_sinclair_typebox.Type.Literal("provisional"),
+	_sinclair_typebox.Type.Literal("reconciled")
+]);
+const ReadbackSchema = closed({
+	operationId: NonEmptyString,
+	generation: SafeInt,
+	planDigest: Hex64,
+	execution: OperationExecutionSchema,
+	cleanup: OperationCleanupSchema,
+	evidence: OperationEvidenceSchema,
+	evidenceRef: _sinclair_typebox.Type.Union([Reference, _sinclair_typebox.Type.Null()]),
+	cost: OperationCostSchema
+});
+const OperationStatusSchema = ReadbackSchema;
+const operationV1 = {
+	literal: OPERATION_PROFILE,
+	shapes: {
+		request: OperationRequestSchema,
+		accepted: AcceptedSchema,
+		readback: ReadbackSchema
+	}
+};
+//#endregion
+//#region src/infra/resource-descriptor.v1.ts
+const RESOURCE_DESCRIPTOR_PROFILE = "dsg.infra.resource-descriptor/1";
+/** The document kind: the profile literal without its version suffix; the
+* version rides in schemaVersion. Frozen /1 wire choice. */
+const RESOURCE_DESCRIPTOR_KIND = "dsg.infra.resource-descriptor";
+const prefixedDigest = _sinclair_typebox.Type.String({ pattern: "^sha256:[0-9a-f]{64}$" });
+const ResourceDescriptorSchema = closed({
+	schemaVersion: _sinclair_typebox.Type.Literal(1),
+	kind: _sinclair_typebox.Type.Literal(RESOURCE_DESCRIPTOR_KIND),
+	workloadClass: NonEmptyString,
+	lifecycle: _sinclair_typebox.Type.Union([_sinclair_typebox.Type.Literal("ephemeral"), _sinclair_typebox.Type.Literal("durable")]),
+	machineType: _sinclair_typebox.Type.String({ pattern: "^[a-z][a-z0-9]*-[a-z0-9]+-[0-9]+$" }),
+	accelerator: _sinclair_typebox.Type.Union([_sinclair_typebox.Type.String({ minLength: 1 }), _sinclair_typebox.Type.Null()]),
+	acceleratorCount: _sinclair_typebox.Type.Integer({ minimum: 0 }),
+	vcpuCount: _sinclair_typebox.Type.Integer({ minimum: 1 }),
+	memoryGiB: _sinclair_typebox.Type.Integer({ minimum: 1 }),
+	maxRunSeconds: _sinclair_typebox.Type.Integer({ minimum: 1 }),
+	maxParallelism: _sinclair_typebox.Type.Integer({ minimum: 1 }),
+	region: NonEmptyString,
+	imageDigest: prefixedDigest,
+	moduleDigest: prefixedDigest,
+	externalIp: _sinclair_typebox.Type.Literal(false),
+	network: _sinclair_typebox.Type.Literal("private"),
+	reservation: closed({
+		gpuSeconds: _sinclair_typebox.Type.Integer({ minimum: 0 }),
+		usdMicroUnits: _sinclair_typebox.Type.Integer({ minimum: 0 })
+	})
+});
+const resourceDescriptorV1 = {
+	literal: RESOURCE_DESCRIPTOR_PROFILE,
+	literalNote: "carried as kind (unversioned) plus schemaVersion on the document; the /1 literal is the version marker signed-law pins",
+	rootShape: "descriptor",
+	shapes: { descriptor: ResourceDescriptorSchema }
+};
+//#endregion
+//#region src/infra/signed-law.v1.ts
+const SIGNED_LAW_PROFILE = "dsg.infra.signed-law/1";
+/** The signature-input domain member is exactly the profile literal. */
+const SIGNED_LAW_DOMAIN = SIGNED_LAW_PROFILE;
+/** The scope vocabulary version today's laws cite in
+* standingOrder.scopeReference. The FIELD stays an open nonempty string on
+* purpose (a law may cite a future scope); this constant is the value in
+* force, exported so no consumer hand-types it. */
+const SCOPE_REFERENCE = "dsg.infra.scope/1";
+/** The price-profile version today's laws cite in priceProfile.reference.
+* Same rule: the field stays open; this is the value in force. */
+const PRICE_PROFILE_REFERENCE = "dsg.infra.price-profile/1";
+const nullableString = _sinclair_typebox.Type.Union([_sinclair_typebox.Type.String({ minLength: 1 }), _sinclair_typebox.Type.Null()]);
+const authority = _sinclair_typebox.Type.Object({
+	issuerType: _sinclair_typebox.Type.Literal("human"),
+	issuerReference: nullableString,
+	designationReference: nullableString,
+	signatureReference: nullableString,
+	humanSignatureRequired: _sinclair_typebox.Type.Literal(true),
+	releaseAutomationMayIssue: _sinclair_typebox.Type.Literal(false)
+}, { additionalProperties: false });
+const utcSecond = _sinclair_typebox.Type.String({ pattern: "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$" });
+const standingOrder = _sinclair_typebox.Type.Object({
+	reference: nullableString,
+	designationReference: nullableString,
+	scopeReference: _sinclair_typebox.Type.String({ minLength: 1 }),
+	issuedAt: _sinclair_typebox.Type.Union([utcSecond, _sinclair_typebox.Type.Null()]),
+	expiresAt: _sinclair_typebox.Type.Union([utcSecond, _sinclair_typebox.Type.Null()])
+}, { additionalProperties: false });
+const scope = _sinclair_typebox.Type.Object({
+	actions: _sinclair_typebox.Type.Array(_sinclair_typebox.Type.String({ minLength: 1 }), {
+		minItems: 1,
+		uniqueItems: true
+	}),
+	workloadClasses: _sinclair_typebox.Type.Array(_sinclair_typebox.Type.String({ minLength: 1 }), {
+		minItems: 1,
+		uniqueItems: true
+	}),
+	providers: _sinclair_typebox.Type.Array(_sinclair_typebox.Type.Literal("provider-neutral"), {
+		minItems: 1,
+		uniqueItems: true
+	}),
+	regions: _sinclair_typebox.Type.Array(_sinclair_typebox.Type.String({ minLength: 1 }), { uniqueItems: true }),
+	resourceDescriptorVersion: _sinclair_typebox.Type.Literal(RESOURCE_DESCRIPTOR_PROFILE)
+}, { additionalProperties: false });
+const validity = _sinclair_typebox.Type.Object({
+	clock: _sinclair_typebox.Type.Literal("UTC"),
+	notBefore: _sinclair_typebox.Type.Union([utcSecond, _sinclair_typebox.Type.Null()]),
+	notAfter: _sinclair_typebox.Type.Union([utcSecond, _sinclair_typebox.Type.Null()])
+}, { additionalProperties: false });
+const revocation = _sinclair_typebox.Type.Object({
+	snapshotReference: nullableString,
+	failClosed: _sinclair_typebox.Type.Literal(true),
+	checks: _sinclair_typebox.Type.Array(_sinclair_typebox.Type.String({ minLength: 1 }), {
+		minItems: 1,
+		uniqueItems: true
+	})
+}, { additionalProperties: false });
+const ceiling = _sinclair_typebox.Type.Object({
+	unit: _sinclair_typebox.Type.String({ minLength: 1 }),
+	period: _sinclair_typebox.Type.String({ minLength: 1 }),
+	scope: _sinclair_typebox.Type.Union([_sinclair_typebox.Type.Literal("person"), _sinclair_typebox.Type.Literal("organization")]),
+	value: _sinclair_typebox.Type.Union([_sinclair_typebox.Type.Integer({ minimum: 0 }), _sinclair_typebox.Type.Null()])
+}, { additionalProperties: false });
+const capabilityProfile = _sinclair_typebox.Type.Object({
+	lifecycle: _sinclair_typebox.Type.Union([_sinclair_typebox.Type.Literal("ephemeral"), _sinclair_typebox.Type.Literal("durable")]),
+	machinePrefixes: _sinclair_typebox.Type.Array(_sinclair_typebox.Type.String({ minLength: 1 }), {
+		minItems: 1,
+		uniqueItems: true
+	}),
+	accelerators: _sinclair_typebox.Type.Array(_sinclair_typebox.Type.String({ minLength: 1 }), { uniqueItems: true }),
+	maxRunSeconds: _sinclair_typebox.Type.Union([_sinclair_typebox.Type.Integer({ minimum: 0 }), _sinclair_typebox.Type.Null()]),
+	maxParallelism: _sinclair_typebox.Type.Union([_sinclair_typebox.Type.Integer({ minimum: 1 }), _sinclair_typebox.Type.Null()]),
+	maxGpuInstances: _sinclair_typebox.Type.Union([_sinclair_typebox.Type.Integer({ minimum: 0 }), _sinclair_typebox.Type.Null()]),
+	maxVcpus: _sinclair_typebox.Type.Union([_sinclair_typebox.Type.Integer({ minimum: 1 }), _sinclair_typebox.Type.Null()]),
+	network: _sinclair_typebox.Type.Literal("private"),
+	externalIpAllowed: _sinclair_typebox.Type.Literal(false)
+}, { additionalProperties: false });
+const capabilities = _sinclair_typebox.Type.Object({
+	providerNeutral: _sinclair_typebox.Type.Literal(true),
+	descriptorVersion: _sinclair_typebox.Type.Literal(RESOURCE_DESCRIPTOR_PROFILE),
+	profiles: _sinclair_typebox.Type.Record(_sinclair_typebox.Type.String(), capabilityProfile, { minProperties: 1 })
+}, { additionalProperties: false });
+const priceProfile = _sinclair_typebox.Type.Object({
+	reference: _sinclair_typebox.Type.String({ minLength: 1 }),
+	status: _sinclair_typebox.Type.Union([_sinclair_typebox.Type.Literal("unassigned"), _sinclair_typebox.Type.Literal("retained")]),
+	currency: _sinclair_typebox.Type.Literal("USD"),
+	unit: _sinclair_typebox.Type.Literal("micro_usd"),
+	basis: _sinclair_typebox.Type.Literal("retained-conservative-on-demand"),
+	rates: _sinclair_typebox.Type.Object({
+		vcpuSecond: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.Integer({ minimum: 0 })),
+		memoryGiBSecond: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.Integer({ minimum: 0 })),
+		gpuSecond: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.Integer({ minimum: 0 })),
+		startup: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.Integer({ minimum: 0 }))
+	}, { additionalProperties: false }),
+	safetyFactorBps: _sinclair_typebox.Type.Union([_sinclair_typebox.Type.Integer({ minimum: 1e4 }), _sinclair_typebox.Type.Null()]),
+	validFrom: _sinclair_typebox.Type.Union([utcSecond, _sinclair_typebox.Type.Null()]),
+	validUntil: _sinclair_typebox.Type.Union([utcSecond, _sinclair_typebox.Type.Null()])
+}, { additionalProperties: false });
+const bootstrap = _sinclair_typebox.Type.Object({
+	mode: _sinclair_typebox.Type.Literal("finite-human-root"),
+	rootReferences: _sinclair_typebox.Type.Array(_sinclair_typebox.Type.String({ minLength: 1 }), { uniqueItems: true }),
+	allowedActions: _sinclair_typebox.Type.Array(_sinclair_typebox.Type.Union([
+		_sinclair_typebox.Type.Literal("enroll_human_root"),
+		_sinclair_typebox.Type.Literal("initialize_kernel_record"),
+		_sinclair_typebox.Type.Literal("restore_kernel_record"),
+		_sinclair_typebox.Type.Literal("cutover_single_writer")
+	]), {
+		minItems: 1,
+		uniqueItems: true
+	}),
+	maxUses: _sinclair_typebox.Type.Integer({
+		minimum: 1,
+		maximum: 1
+	}),
+	expiresAt: _sinclair_typebox.Type.Union([utcSecond, _sinclair_typebox.Type.Null()]),
+	projectCreationAllowed: _sinclair_typebox.Type.Literal(false),
+	requiresHumanSignature: _sinclair_typebox.Type.Literal(true),
+	automationCanSatisfy: _sinclair_typebox.Type.Literal(false)
+}, { additionalProperties: false });
+const digest$1 = _sinclair_typebox.Type.String({ pattern: "^sha256:[0-9a-f]{64}$" });
+const policyBundle = _sinclair_typebox.Type.Object({
+	digest: digest$1,
+	manifest: _sinclair_typebox.Type.Record(_sinclair_typebox.Type.String({ pattern: "^policy/[A-Za-z0-9._-]+\\.rego$" }), _sinclair_typebox.Type.String({ pattern: "^[0-9a-f]{64}$" }), {
+		additionalProperties: false,
+		minProperties: 1
+	})
+}, { additionalProperties: false });
+const lawInputProfile = _sinclair_typebox.Type.Object({
+	requiresRunCeiling: _sinclair_typebox.Type.Boolean(),
+	requiresExpirationLabel: _sinclair_typebox.Type.Boolean(),
+	maxRunSeconds: _sinclair_typebox.Type.Integer({ minimum: 1 }),
+	allowExternalIp: _sinclair_typebox.Type.Literal(false),
+	machinePrefixes: _sinclair_typebox.Type.Array(_sinclair_typebox.Type.String({ minLength: 1 }), {
+		minItems: 1,
+		uniqueItems: true
+	}),
+	accelerators: _sinclair_typebox.Type.Array(_sinclair_typebox.Type.String({ minLength: 1 }), { uniqueItems: true }),
+	maxGpuInstances: _sinclair_typebox.Type.Integer({ minimum: 0 }),
+	maxTotalVcpus: _sinclair_typebox.Type.Integer({ minimum: 1 }),
+	maxParallelism: _sinclair_typebox.Type.Integer({ minimum: 1 }),
+	network: _sinclair_typebox.Type.Literal("private")
+}, { additionalProperties: false });
+const lawInputs = _sinclair_typebox.Type.Object({
+	cloudflare: _sinclair_typebox.Type.Object({
+		approvedZoneId: _sinclair_typebox.Type.String({ minLength: 1 }),
+		approvedAccountId: _sinclair_typebox.Type.String({ minLength: 1 })
+	}, { additionalProperties: false }),
+	planLimits: _sinclair_typebox.Type.Object({
+		maxGpuInstances: _sinclair_typebox.Type.Integer({ minimum: 0 }),
+		maxTotalVcpus: _sinclair_typebox.Type.Integer({ minimum: 1 }),
+		approvedLocations: _sinclair_typebox.Type.Array(_sinclair_typebox.Type.String({ minLength: 1 }), {
+			minItems: 1,
+			uniqueItems: true
+		})
+	}, { additionalProperties: false }),
+	profiles: _sinclair_typebox.Type.Object({
+		compute: lawInputProfile,
+		plane: lawInputProfile
+	}, { additionalProperties: false })
+}, { additionalProperties: false });
+const evaluationInputs = _sinclair_typebox.Type.Object({
+	policyBundle,
+	lawInputs
+}, { additionalProperties: false });
+const lawDocument = _sinclair_typebox.Type.Object({
+	schemaVersion: _sinclair_typebox.Type.Literal(1),
+	kind: _sinclair_typebox.Type.Literal("dsg.infra.law"),
+	lawId: _sinclair_typebox.Type.String({ minLength: 1 }),
+	status: _sinclair_typebox.Type.Union([_sinclair_typebox.Type.Literal("unissued"), _sinclair_typebox.Type.Literal("issued")]),
+	authority,
+	standingOrder,
+	scope,
+	validity,
+	revocation,
+	ceilings: _sinclair_typebox.Type.Object({
+		gpuSecondsPerPersonUtcWeek: ceiling,
+		usdMicroUnitsPerPersonUtcMonth: ceiling,
+		usdMicroUnitsPerOrganizationUtcMonth: ceiling
+	}, { additionalProperties: false }),
+	capabilities,
+	priceProfile,
+	bootstrap,
+	evaluationInputs
+}, { additionalProperties: false });
+const signature = _sinclair_typebox.Type.Object({
+	algorithm: _sinclair_typebox.Type.Literal("Ed25519"),
+	keyClass: _sinclair_typebox.Type.Union([
+		_sinclair_typebox.Type.Literal("synthetic-test-only"),
+		_sinclair_typebox.Type.Literal("human-authority"),
+		_sinclair_typebox.Type.Literal("release-automation")
+	]),
+	publicKeyHex: _sinclair_typebox.Type.String({ pattern: "^[0-9a-f]{64}$" }),
+	signatureHex: _sinclair_typebox.Type.String({ pattern: "^[0-9a-f]{128}$" })
+}, { additionalProperties: false });
+const SignedLawBundleSchema = _sinclair_typebox.Type.Object({
+	schemaVersion: _sinclair_typebox.Type.Literal(1),
+	kind: _sinclair_typebox.Type.Union([_sinclair_typebox.Type.Literal("dsg.infra.signed-law"), _sinclair_typebox.Type.Literal("dsg.infra.signed-law-fixture")]),
+	testOnly: _sinclair_typebox.Type.Boolean(),
+	deployedAuthority: _sinclair_typebox.Type.Boolean(),
+	payload: lawDocument,
+	canonicalPayload: _sinclair_typebox.Type.String({ minLength: 1 }),
+	payloadSha256: _sinclair_typebox.Type.String({ pattern: "^[0-9a-f]{64}$" }),
+	canonicalSignatureInput: _sinclair_typebox.Type.String({ minLength: 1 }),
+	signature
+}, { additionalProperties: false });
+const signedLawV1 = {
+	literal: SIGNED_LAW_PROFILE,
+	literalNote: "carried as the domain member of the canonical signature input, not as a bundle field",
+	shapes: { bundle: SignedLawBundleSchema }
+};
+//#endregion
+//#region src/infra/adoption-fact.v1.ts
+const ADOPTION_FACT_PROFILE = "dsg.infra.adoption-fact/1";
+const AdoptionFactSchema = closed({
+	profile: _sinclair_typebox.Type.Literal(ADOPTION_FACT_PROFILE),
+	/** The root the record names as active baseline owner. */
+	root: NonEmptyString,
+	lineage: NonEmptyString,
+	/** The accepted root-authorizing operation. */
+	operation: NonEmptyString,
+	/** Count of accepted root operations; ownership needs at least one. */
+	generation: _sinclair_typebox.Type.Integer({
+		minimum: 1,
+		maximum: Number.MAX_SAFE_INTEGER
+	}),
+	/** Canonical digest of the verified record snapshot. */
+	snapshotSha256: Hex64,
+	/** initialize establishes the first owner; cutover transfers it. restore
+	*  and enrollment move custody and human roots, never root ownership. */
+	action: _sinclair_typebox.Type.Union([_sinclair_typebox.Type.Literal("initialize_kernel_record"), _sinclair_typebox.Type.Literal("cutover_single_writer")]),
+	signer: Orn,
+	humanRoot: NonEmptyString,
+	testOnly: _sinclair_typebox.Type.Boolean()
+});
+const adoptionFactV1 = {
+	literal: ADOPTION_FACT_PROFILE,
+	rootShape: "fact",
+	shapes: { fact: AdoptionFactSchema }
+};
+//#endregion
+//#region src/registry/revocations.v1.ts
+const REVOCATIONS_PROFILE = "dsg.registry.revocations/1";
+const closed$1 = { additionalProperties: false };
+const text = _sinclair_typebox.Type.String({ minLength: 1 });
+const digest = _sinclair_typebox.Type.String({ pattern: "^[0-9a-f]{64}$" });
+const time = _sinclair_typebox.Type.Integer({
+	minimum: 0,
+	maximum: Number.MAX_SAFE_INTEGER
+});
+const RevocationSchema = _sinclair_typebox.Type.Object({
+	domain: _sinclair_typebox.Type.Literal(REVOCATIONS_PROFILE),
+	version: _sinclair_typebox.Type.Integer({
+		minimum: 1,
+		maximum: Number.MAX_SAFE_INTEGER
+	}),
+	issuedAt: time,
+	expiresAt: time,
+	previousSha256: _sinclair_typebox.Type.Union([digest, _sinclair_typebox.Type.Null()]),
+	testOnly: _sinclair_typebox.Type.Literal(true),
+	signerKey: digest,
+	revoked: _sinclair_typebox.Type.Array(_sinclair_typebox.Type.Object({
+		kind: _sinclair_typebox.Type.Union([
+			_sinclair_typebox.Type.Literal("principal"),
+			_sinclair_typebox.Type.Literal("standing-order"),
+			_sinclair_typebox.Type.Literal("law"),
+			_sinclair_typebox.Type.Literal("class"),
+			_sinclair_typebox.Type.Literal("key")
+		]),
+		id: text,
+		effectiveAt: time,
+		reason: text
+	}, closed$1)),
+	trustHistory: _sinclair_typebox.Type.Array(_sinclair_typebox.Type.Object({
+		principal: text,
+		publicKey: digest,
+		role: _sinclair_typebox.Type.Union([
+			_sinclair_typebox.Type.Literal("human"),
+			_sinclair_typebox.Type.Literal("release"),
+			_sinclair_typebox.Type.Literal("collector")
+		]),
+		action: _sinclair_typebox.Type.Union([
+			_sinclair_typebox.Type.Literal("enroll"),
+			_sinclair_typebox.Type.Literal("rotate"),
+			_sinclair_typebox.Type.Literal("compromise")
+		]),
+		effectiveAt: time,
+		authoritySha256: digest,
+		replacesKey: _sinclair_typebox.Type.Union([digest, _sinclair_typebox.Type.Null()])
+	}, closed$1))
+}, closed$1);
+const RevocationPointerSchema = _sinclair_typebox.Type.Object({
+	version: _sinclair_typebox.Type.Integer({
+		minimum: 1,
+		maximum: Number.MAX_SAFE_INTEGER
+	}),
+	sha256: digest,
+	url: _sinclair_typebox.Type.String({ pattern: "^/revocations/v/[1-9][0-9]*/snapshot\\.json$" })
+}, closed$1);
+const revocationsV1 = {
+	literal: REVOCATIONS_PROFILE,
+	shapes: {
+		snapshot: RevocationSchema,
+		pointer: RevocationPointerSchema
+	}
+};
+//#endregion
+//#region src/kernel/bootstrap.v1.ts
+const BOOTSTRAP_PROFILE = "dsg.kernel.bootstrap/1";
+const BootstrapActionSchema = _sinclair_typebox.Type.Union([
+	_sinclair_typebox.Type.Literal("initialize_kernel_record"),
+	_sinclair_typebox.Type.Literal("restore_kernel_record"),
+	_sinclair_typebox.Type.Literal("cutover_single_writer"),
+	_sinclair_typebox.Type.Literal("enroll_human_root")
+]);
+const BootstrapIntentSchema = closed({
+	version: _sinclair_typebox.Type.Literal(BOOTSTRAP_PROFILE),
+	operation: NonEmptyString,
+	action: BootstrapActionSchema,
+	lineage: NonEmptyString,
+	humanRoot: NonEmptyString,
+	signer: Orn,
+	scope: NonEmptyString,
+	resources: _sinclair_typebox.Type.Array(closed({
+		identity: NonEmptyString,
+		specSha256: Hex64
+	}), {
+		minItems: 1,
+		uniqueItems: true
+	}),
+	planSha256: Hex64,
+	preconditionsSha256: Hex64,
+	createdAt: NonEmptyString,
+	expiresAt: NonEmptyString,
+	maxUses: _sinclair_typebox.Type.Literal(1),
+	cost: closed({
+		currency: _sinclair_typebox.Type.Literal("USD"),
+		maxMicroUsd: _sinclair_typebox.Type.Integer({
+			minimum: 0,
+			maximum: Number.MAX_SAFE_INTEGER
+		}),
+		assumptionsSha256: Hex64
+	}),
+	testOnly: _sinclair_typebox.Type.Boolean()
+});
+const SignedBootstrapIntentSchema = closed({
+	body: BootstrapIntentSchema,
+	signature: _sinclair_typebox.Type.String({ pattern: "^[0-9a-f]{128}$" })
+});
+const bootstrapV1 = {
+	literal: BOOTSTRAP_PROFILE,
+	shapes: {
+		intent: BootstrapIntentSchema,
+		signed: SignedBootstrapIntentSchema
+	}
+};
+//#endregion
+//#region src/kernel/ordinary-authority.v1.ts
+const ORDINARY_AUTHORITY_PROFILE = "dsg.kernel.ordinary-authority/1";
+const names = _sinclair_typebox.Type.Array(NonEmptyString, {
+	minItems: 1,
+	uniqueItems: true
+});
+const ceilingValue = _sinclair_typebox.Type.Integer({
+	minimum: 0,
+	maximum: Number.MAX_SAFE_INTEGER
+});
+const OrdinaryAuthoritySchema = closed({
+	version: _sinclair_typebox.Type.Literal(ORDINARY_AUTHORITY_PROFILE),
+	reference: NonEmptyString,
+	actor: Orn,
+	publicKeyHex: Hex64,
+	keyClass: _sinclair_typebox.Type.Union([_sinclair_typebox.Type.Literal("synthetic-test-only"), _sinclair_typebox.Type.Literal("human-authority")]),
+	designation: closed({
+		role: _sinclair_typebox.Type.Literal("law-issuer"),
+		designationReference: NonEmptyString
+	}),
+	scope: closed({
+		scopeReference: NonEmptyString,
+		actions: names,
+		workloadClasses: names,
+		regions: names
+	}),
+	validity: closed({
+		notBefore: UtcSecond,
+		notAfter: UtcSecond
+	}),
+	ceilings: closed({
+		gpuSecondsPerPersonUtcWeek: ceilingValue,
+		usdMicroUnitsPerPersonUtcMonth: ceilingValue,
+		usdMicroUnitsPerOrganizationUtcMonth: ceilingValue
+	}),
+	revoked: _sinclair_typebox.Type.Boolean()
+});
+const ordinaryAuthorityV1 = {
+	literal: ORDINARY_AUTHORITY_PROFILE,
+	rootShape: "authority",
+	shapes: { authority: OrdinaryAuthoritySchema }
+};
+//#endregion
+//#region src/run/contract-versions.ts
+const EXECUTOR_PROTOCOL_VERSION = "dsg.run.executor/1";
+const PROVIDER_PROTOCOL_VERSION = "dsg.run.provider/1";
+//#endregion
+//#region src/index.ts
+/** Every profile this version of the package defines, keyed by literal.
+* Profile modules are added here as they are extracted; the rules test
+* and the schema emitter walk this registry, so a module that is not
+* registered does not exist. */
+const PROFILES = {
+	[dispatchConsumeV1.literal]: dispatchConsumeV1,
+	[operationV1.literal]: operationV1,
+	[signedLawV1.literal]: signedLawV1,
+	[resourceDescriptorV1.literal]: resourceDescriptorV1,
+	[adoptionFactV1.literal]: adoptionFactV1,
+	[revocationsV1.literal]: revocationsV1,
+	[bootstrapV1.literal]: bootstrapV1,
+	[ordinaryAuthorityV1.literal]: ordinaryAuthorityV1
+};
+//#endregion
+exports.ADOPTION_FACT_PROFILE = ADOPTION_FACT_PROFILE;
+exports.AcceptedSchema = AcceptedSchema;
+exports.AdoptionFactSchema = AdoptionFactSchema;
+exports.BOOTSTRAP_PROFILE = BOOTSTRAP_PROFILE;
+exports.BootstrapActionSchema = BootstrapActionSchema;
+exports.BootstrapIntentSchema = BootstrapIntentSchema;
+exports.DISPATCH_CONSUME_PROFILE = DISPATCH_CONSUME_PROFILE;
+exports.DISPATCH_MAX_SKEW_SECONDS = DISPATCH_MAX_SKEW_SECONDS;
+exports.DispatchConsumeRequestSchema = DispatchConsumeRequestSchema;
+exports.DispatchLeaseSchema = DispatchLeaseSchema;
+exports.DispatchRefusalCodeSchema = DispatchRefusalCodeSchema;
+exports.DispatchRefusalSchema = DispatchRefusalSchema;
+exports.EXECUTOR_PROTOCOL_VERSION = EXECUTOR_PROTOCOL_VERSION;
+exports.ExecutionDocumentSchema = ExecutionDocumentSchema;
+exports.ExecutionLawSchema = ExecutionLawSchema;
+exports.ExecutionResourcesSchema = ExecutionResourcesSchema;
+exports.Hex64 = Hex64;
+exports.NonEmptyString = NonEmptyString;
+exports.OPERATION_PROFILE = OPERATION_PROFILE;
+exports.ORDINARY_AUTHORITY_PROFILE = ORDINARY_AUTHORITY_PROFILE;
+exports.OperationBeforeSchema = OperationBeforeSchema;
+exports.OperationCleanupSchema = OperationCleanupSchema;
+exports.OperationCostSchema = OperationCostSchema;
+exports.OperationEvidenceSchema = OperationEvidenceSchema;
+exports.OperationExecutionSchema = OperationExecutionSchema;
+exports.OperationRequestSchema = OperationRequestSchema;
+exports.OperationStatusSchema = OperationStatusSchema;
+exports.OrdinaryAuthoritySchema = OrdinaryAuthoritySchema;
+exports.Orn = Orn;
+exports.PRICE_PROFILE_REFERENCE = PRICE_PROFILE_REFERENCE;
+exports.PROFILES = PROFILES;
+exports.PROVIDER_PROTOCOL_VERSION = PROVIDER_PROTOCOL_VERSION;
+exports.RESOURCE_DESCRIPTOR_KIND = RESOURCE_DESCRIPTOR_KIND;
+exports.RESOURCE_DESCRIPTOR_PROFILE = RESOURCE_DESCRIPTOR_PROFILE;
+exports.REVOCATIONS_PROFILE = REVOCATIONS_PROFILE;
+exports.ReadbackSchema = ReadbackSchema;
+exports.Reference = Reference;
+exports.ResourceDescriptorSchema = ResourceDescriptorSchema;
+exports.RevocationPointerSchema = RevocationPointerSchema;
+exports.RevocationSchema = RevocationSchema;
+exports.SCOPE_REFERENCE = SCOPE_REFERENCE;
+exports.SIGNED_LAW_DOMAIN = SIGNED_LAW_DOMAIN;
+exports.SIGNED_LAW_PROFILE = SIGNED_LAW_PROFILE;
+exports.SafeInt = SafeInt;
+exports.SignedBootstrapIntentSchema = SignedBootstrapIntentSchema;
+exports.SignedLawBundleSchema = SignedLawBundleSchema;
+exports.UtcSecond = UtcSecond;
+exports.closed = closed;