@dynamicalsystems/idl 0.6.1

package/dist/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/primitives.ts","../src/kernel/dispatch-consume.v1.ts","../src/run/operation.v1.ts","../src/infra/signed-law.v1.ts","../src/infra/resource-descriptor.v1.ts","../src/infra/adoption-fact.v1.ts","../src/registry/revocations.v1.ts","../src/kernel/bootstrap.v1.ts","../src/kernel/ordinary-authority.v1.ts","../src/run/contract-versions.ts","../src/index.ts"],"mappings":";;;cAOa,SAAU,UAAU,aAAW,YAAc,MAAI,QAAQ;;cAIzD,mCAAK;;cAGL,uCAAS;cAIT,4CAAc;cAEd,qCAAO;;;;;;cAOP,iCAAG;;cAGH,WAAS;;;;;;;KAQV;WACD;WACA,QAAQ,SAAS,eAAe;;;WAGhC;;;;WAIA;;;;cCnBE;;cAGA;cAEP,+DAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;cAwB1B,qCAAqC;KAEtC,yBAAyB,cAAc;cAE7C,sDAAwB;;;;;;;;;;;;;;;;;;;;;;;;cAqBjB,4BAA4B;KAC7B,gBAAgB,cAAc;cAEpC,4DAA8B,oCAAA,2DAAA,wDAAA,0DAAA,iDAAA,2DAAA,+EAAA;cASvB,kCAAkC;KAEnC,sBAAsB,cAAc;cAE1C,wDAA0B;;;;;cAKnB,8BAA8B;KAC/B,kBAAkB,cAAc;;;cC3E/B;cAEP,2DAA6B;;;;;cAKtB,iCAAiC;KAElC,qBAAqB,cAAc;cAEzC,qDAAuB;;;;;;;;;;cAIhB,2BAA2B;KAC5B,eAAe,cAAc;cAEnC,0DAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAYrB,gCAAgC;KAEjC,oBAAoB,cAAc;cAExC,wDAA0B;;;;cAInB,8BAA8B;KAC/B,kBAAkB,cAAc;cAEtC,yDAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAYpB,+BAA+B;KAEhC,mBAAmB,cAAc;cAEvC,iDAAmB;;;;;;;;cAQZ,uBAAuB;KACxB,WAAW,cAAc;cAE/B,2DAA6B,oCAAA,gDAAA,iDAAA,mDAAA,gDAAA,kDAAA;cAQtB,iCAAiC;KAElC,qBAAqB,cAAc;cAEzC,yDAA2B,oCAAA,iDAAA,iDAAA,gDAAA;cAMpB,+BAA+B;KAEhC,mBAAmB,cAAc;cAEvC,0DAA4B,oCAAA,iDAAA;cACrB,gCAAgC;KAEjC,oBAAoB,cAAc;cAExC,sDAAwB,oCAAA,kDAAA,qDAAA;cAKjB,4BAA4B;KAC7B,gBAAgB,cAAc;cAEpC,iDAAmB;;;;;;;;;;;;;cAUZ,uBAAuB;KACxB,WAAW,cAAc;cAIxB,mDAAqB;;;;;;;;;;;;;KACtB,kBAAkB;;;cCrIjB;;cAEA;;;;;cAMA;;;cAIA;cAiPA,mDAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KACtB,kBAAkB,cAAc;;;cC3P/B;;;cAGA;cAIP,2DAA6B;;;;;;;;;;;;;;;;;;;;;;cAsBtB,iCAAiC;KAElC,qBAAqB,cAAc;;;cCjClC;cAEP,qDAAuB;;;;;;;;;;;;;;;;;;cAqBhB,2BAA2B;KAC5B,eAAe,cAAc;;;cC9B5B;cAOP,mDAAqB;;;;;;;;;;;;;;;;;;;;;;;;cAmDd,yBAAyB;KAC1B,qBAAqB,cAAc;cAEzC,0DAA4B;;;;;cAQrB,gCAAgC;KAEjC,oBAAoB,cAAc;;;cClEjC;cAEP,wDAA0B,oCAAA,kEAAA,+DAAA,+DAAA;cAMnB,8BAA8B;KAC/B,kBAAkB,cAAc;cAEtC,wDAA0B;;;;;;;;;;;;;;;;;;;;;;;;cA2BnB,8BAA8B;KAC/B,kBAAkB,cAAc;cAEtC,8DAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;cAIzB,oCAAoC;KAErC,wBAAwB,cAAc;;;cC/CrC;cAKP,0DAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;cAwBrB,gCAAgC;KAEjC,oBAAoB,cAAc;;;cCtCjC;KACD,iCAAiC;cAEhC;KACD,iCAAiC;;;;;;;cCwFhC,UAAU,SAAS,eAAe"}

package/dist/index.mjs

@@ -0,0 +1,646 @@
+import { Type } from "@sinclair/typebox";
+import { ORN_PATTERN, SHA256_PATTERN } from "@dynamicalsystems/orn-schemas";
+//#region src/primitives.ts
+/** Closed object: an extra field is a different protocol. */
+const closed = (properties) => Type.Object(properties, { additionalProperties: false });
+/** Lowercase sha256 hex. Every digest on the wire. */
+const Hex64 = Type.String({ pattern: "^[0-9a-f]{64}$" });
+/** Exact UTC second, Z suffix, no fractional part. */
+const UtcSecond = Type.String({ pattern: "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$" });
+const NonEmptyString = Type.String({ minLength: 1 });
+const SafeInt = Type.Integer({
+	minimum: 0,
+	maximum: Number.MAX_SAFE_INTEGER
+});
+/** An ORN, validated by the grammar dsg-orn owns. Built from the exported
+* pattern, not the exported schema object: the upstream schemas carry
+* JSON Schema $id metadata, and embedding the same $id in several route
+* schemas makes validators refuse the duplicate. The pattern is the wire
+* truth; the metadata is not. */
+const Orn = Type.String({ pattern: ORN_PATTERN });
+/** The pair of an ORN and the sha256 pinning a version (dsg-orn Reference). */
+const Reference = closed({
+	orn: Orn,
+	sha256: Type.String({ pattern: SHA256_PATTERN })
+});
+//#endregion
+//#region src/kernel/dispatch-consume.v1.ts
+const DISPATCH_CONSUME_PROFILE = "dsg.kernel.dispatch-consume/1";
+/** The bounded clock skew a lease check must tolerate, in seconds. */
+const DISPATCH_MAX_SKEW_SECONDS = 300;
+const DispatchConsumeRequestSchema = closed({
+	profile: Type.Literal(DISPATCH_CONSUME_PROFILE),
+	/** The kernel operation identity from the accepted OperationRequest. */
+	operationId: NonEmptyString,
+	/** The workspace generation the plane admitted the operation at. */
+	generation: Type.Integer({ minimum: 0 }),
+	/** The Case the operation belongs to - the stream the consume event
+	*  lands on and the stream the reservation was recorded on. */
+	caseOrn: Orn,
+	/** SHA256(JCS(complete OperationRequest)) - the M010 envelope digest. */
+	envelopeSha256: Hex64,
+	/** The exact retained signed-law bytes the Case pins. */
+	lawSha256: Hex64,
+	/** The K04 reservation the authorization is bound to: sha256 is the
+	*  reservation event's record id. */
+	reservation: Reference,
+	requestedAt: UtcSecond,
+	/** False: first consumption or idempotent replay of it. True: an explicit
+	*  renewal - a new recorded authorization decision for the same operation
+	*  and reservation after lease expiry with the work known unsubmitted. A
+	*  replay never renews; only this flag does, and it re-runs every
+	*  revocation check at the current record state. */
+	renewal: Type.Boolean()
+});
+const DispatchLeaseSchema = closed({
+	profile: Type.Literal(DISPATCH_CONSUME_PROFILE),
+	/** The consume event's record id: the committed ordering point. */
+	leaseId: Hex64,
+	operationId: NonEmptyString,
+	generation: Type.Integer({ minimum: 0 }),
+	caseOrn: Orn,
+	envelopeSha256: Hex64,
+	lawSha256: Hex64,
+	reservation: Reference,
+	consumedAt: UtcSecond,
+	/** Fixed maximum duration from consumedAt; the plane checks validity
+	*  before each new non-cleanup call, Batch submission included. */
+	expiresAt: UtcSecond,
+	/** The bounded clock skew a lease check must tolerate, in seconds. */
+	maxSkewSeconds: Type.Integer({
+		minimum: 0,
+		maximum: 300
+	}),
+	renewal: Type.Literal("new-authorization-required"),
+	/** False when this response replays an earlier committed consumption:
+	*  the lease bytes, expiry included, are the original's. */
+	fresh: Type.Boolean()
+});
+const DispatchRefusalCodeSchema = Type.Union([
+	Type.Literal("unknown_operation"),
+	Type.Literal("no_reservation"),
+	Type.Literal("binding_mismatch"),
+	Type.Literal("revoked"),
+	Type.Literal("authority_refused"),
+	Type.Literal("renewal_requires_existing_consumption"),
+	Type.Literal("unavailable")
+]);
+const DispatchRefusalSchema = closed({
+	profile: Type.Literal(DISPATCH_CONSUME_PROFILE),
+	code: DispatchRefusalCodeSchema,
+	issues: Type.Array(NonEmptyString, { minItems: 1 })
+});
+const dispatchConsumeV1 = {
+	literal: DISPATCH_CONSUME_PROFILE,
+	shapes: {
+		request: DispatchConsumeRequestSchema,
+		lease: DispatchLeaseSchema,
+		refusal: DispatchRefusalSchema
+	}
+};
+//#endregion
+//#region src/run/operation.v1.ts
+const OPERATION_PROFILE = "dsg.run.operation/1";
+const ExecutionResourcesSchema = closed({
+	maxGpuSeconds: SafeInt,
+	maxRunSeconds: SafeInt,
+	maxParallelism: SafeInt
+});
+const ExecutionLawSchema = closed({
+	bundle: Reference,
+	registryRelease: Reference
+});
+const ExecutionDocumentSchema = closed({
+	schemaVersion: Type.Literal(1),
+	classContract: Reference,
+	law: ExecutionLawSchema,
+	workload: Reference,
+	inputs: Type.Array(Reference),
+	resources: ExecutionResourcesSchema,
+	costBound: Reference,
+	placement: Reference,
+	results: Reference,
+	secrets: Type.Array(Reference)
+});
+const OperationBeforeSchema = closed({
+	operationId: Type.Union([NonEmptyString, Type.Null()]),
+	planDigest: Type.Union([Hex64, Type.Null()])
+});
+const OperationRequestSchema = closed({
+	profile: Type.Literal(OPERATION_PROFILE),
+	operationId: NonEmptyString,
+	case: Reference,
+	workspace: NonEmptyString,
+	expectedGeneration: SafeInt,
+	before: OperationBeforeSchema,
+	planDigest: Hex64,
+	document: ExecutionDocumentSchema,
+	authority: Reference,
+	reservation: Reference
+});
+const AcceptedSchema = closed({
+	profile: Type.Literal(OPERATION_PROFILE),
+	operationId: NonEmptyString,
+	actionId: NonEmptyString,
+	generation: SafeInt,
+	planDigest: Hex64,
+	acceptedAt: NonEmptyString
+});
+const OperationExecutionSchema = Type.Union([
+	Type.Literal("queued"),
+	Type.Literal("running"),
+	Type.Literal("succeeded"),
+	Type.Literal("failed"),
+	Type.Literal("canceled"),
+	Type.Literal("unknown")
+]);
+const OperationCleanupSchema = Type.Union([
+	Type.Literal("pending"),
+	Type.Literal("present"),
+	Type.Literal("absent"),
+	Type.Literal("unknown")
+]);
+const OperationEvidenceSchema = Type.Union([Type.Literal("pending"), Type.Literal("ready")]);
+const OperationCostSchema = Type.Union([
+	Type.Literal("reserved"),
+	Type.Literal("provisional"),
+	Type.Literal("reconciled")
+]);
+const ReadbackSchema = closed({
+	operationId: NonEmptyString,
+	generation: SafeInt,
+	planDigest: Hex64,
+	execution: OperationExecutionSchema,
+	cleanup: OperationCleanupSchema,
+	evidence: OperationEvidenceSchema,
+	evidenceRef: Type.Union([Reference, Type.Null()]),
+	cost: OperationCostSchema
+});
+const OperationStatusSchema = ReadbackSchema;
+const operationV1 = {
+	literal: OPERATION_PROFILE,
+	shapes: {
+		request: OperationRequestSchema,
+		accepted: AcceptedSchema,
+		readback: ReadbackSchema
+	}
+};
+//#endregion
+//#region src/infra/resource-descriptor.v1.ts
+const RESOURCE_DESCRIPTOR_PROFILE = "dsg.infra.resource-descriptor/1";
+/** The document kind: the profile literal without its version suffix; the
+* version rides in schemaVersion. Frozen /1 wire choice. */
+const RESOURCE_DESCRIPTOR_KIND = "dsg.infra.resource-descriptor";
+const prefixedDigest = Type.String({ pattern: "^sha256:[0-9a-f]{64}$" });
+const ResourceDescriptorSchema = closed({
+	schemaVersion: Type.Literal(1),
+	kind: Type.Literal(RESOURCE_DESCRIPTOR_KIND),
+	workloadClass: NonEmptyString,
+	lifecycle: Type.Union([Type.Literal("ephemeral"), Type.Literal("durable")]),
+	machineType: Type.String({ pattern: "^[a-z][a-z0-9]*-[a-z0-9]+-[0-9]+$" }),
+	accelerator: Type.Union([Type.String({ minLength: 1 }), Type.Null()]),
+	acceleratorCount: Type.Integer({ minimum: 0 }),
+	vcpuCount: Type.Integer({ minimum: 1 }),
+	memoryGiB: Type.Integer({ minimum: 1 }),
+	maxRunSeconds: Type.Integer({ minimum: 1 }),
+	maxParallelism: Type.Integer({ minimum: 1 }),
+	region: NonEmptyString,
+	imageDigest: prefixedDigest,
+	moduleDigest: prefixedDigest,
+	externalIp: Type.Literal(false),
+	network: Type.Literal("private"),
+	reservation: closed({
+		gpuSeconds: Type.Integer({ minimum: 0 }),
+		usdMicroUnits: Type.Integer({ minimum: 0 })
+	})
+});
+const resourceDescriptorV1 = {
+	literal: RESOURCE_DESCRIPTOR_PROFILE,
+	literalNote: "carried as kind (unversioned) plus schemaVersion on the document; the /1 literal is the version marker signed-law pins",
+	rootShape: "descriptor",
+	shapes: { descriptor: ResourceDescriptorSchema }
+};
+//#endregion
+//#region src/infra/signed-law.v1.ts
+const SIGNED_LAW_PROFILE = "dsg.infra.signed-law/1";
+/** The signature-input domain member is exactly the profile literal. */
+const SIGNED_LAW_DOMAIN = SIGNED_LAW_PROFILE;
+/** The scope vocabulary version today's laws cite in
+* standingOrder.scopeReference. The FIELD stays an open nonempty string on
+* purpose (a law may cite a future scope); this constant is the value in
+* force, exported so no consumer hand-types it. */
+const SCOPE_REFERENCE = "dsg.infra.scope/1";
+/** The price-profile version today's laws cite in priceProfile.reference.
+* Same rule: the field stays open; this is the value in force. */
+const PRICE_PROFILE_REFERENCE = "dsg.infra.price-profile/1";
+const nullableString = Type.Union([Type.String({ minLength: 1 }), Type.Null()]);
+const authority = Type.Object({
+	issuerType: Type.Literal("human"),
+	issuerReference: nullableString,
+	designationReference: nullableString,
+	signatureReference: nullableString,
+	humanSignatureRequired: Type.Literal(true),
+	releaseAutomationMayIssue: Type.Literal(false)
+}, { additionalProperties: false });
+const utcSecond = Type.String({ pattern: "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$" });
+const standingOrder = Type.Object({
+	reference: nullableString,
+	designationReference: nullableString,
+	scopeReference: Type.String({ minLength: 1 }),
+	issuedAt: Type.Union([utcSecond, Type.Null()]),
+	expiresAt: Type.Union([utcSecond, Type.Null()])
+}, { additionalProperties: false });
+const scope = Type.Object({
+	actions: Type.Array(Type.String({ minLength: 1 }), {
+		minItems: 1,
+		uniqueItems: true
+	}),
+	workloadClasses: Type.Array(Type.String({ minLength: 1 }), {
+		minItems: 1,
+		uniqueItems: true
+	}),
+	providers: Type.Array(Type.Literal("provider-neutral"), {
+		minItems: 1,
+		uniqueItems: true
+	}),
+	regions: Type.Array(Type.String({ minLength: 1 }), { uniqueItems: true }),
+	resourceDescriptorVersion: Type.Literal(RESOURCE_DESCRIPTOR_PROFILE)
+}, { additionalProperties: false });
+const validity = Type.Object({
+	clock: Type.Literal("UTC"),
+	notBefore: Type.Union([utcSecond, Type.Null()]),
+	notAfter: Type.Union([utcSecond, Type.Null()])
+}, { additionalProperties: false });
+const revocation = Type.Object({
+	snapshotReference: nullableString,
+	failClosed: Type.Literal(true),
+	checks: Type.Array(Type.String({ minLength: 1 }), {
+		minItems: 1,
+		uniqueItems: true
+	})
+}, { additionalProperties: false });
+const ceiling = Type.Object({
+	unit: Type.String({ minLength: 1 }),
+	period: Type.String({ minLength: 1 }),
+	scope: Type.Union([Type.Literal("person"), Type.Literal("organization")]),
+	value: Type.Union([Type.Integer({ minimum: 0 }), Type.Null()])
+}, { additionalProperties: false });
+const capabilityProfile = Type.Object({
+	lifecycle: Type.Union([Type.Literal("ephemeral"), Type.Literal("durable")]),
+	machinePrefixes: Type.Array(Type.String({ minLength: 1 }), {
+		minItems: 1,
+		uniqueItems: true
+	}),
+	accelerators: Type.Array(Type.String({ minLength: 1 }), { uniqueItems: true }),
+	maxRunSeconds: Type.Union([Type.Integer({ minimum: 0 }), Type.Null()]),
+	maxParallelism: Type.Union([Type.Integer({ minimum: 1 }), Type.Null()]),
+	maxGpuInstances: Type.Union([Type.Integer({ minimum: 0 }), Type.Null()]),
+	maxVcpus: Type.Union([Type.Integer({ minimum: 1 }), Type.Null()]),
+	network: Type.Literal("private"),
+	externalIpAllowed: Type.Literal(false)
+}, { additionalProperties: false });
+const capabilities = Type.Object({
+	providerNeutral: Type.Literal(true),
+	descriptorVersion: Type.Literal(RESOURCE_DESCRIPTOR_PROFILE),
+	profiles: Type.Record(Type.String(), capabilityProfile, { minProperties: 1 })
+}, { additionalProperties: false });
+const priceProfile = Type.Object({
+	reference: Type.String({ minLength: 1 }),
+	status: Type.Union([Type.Literal("unassigned"), Type.Literal("retained")]),
+	currency: Type.Literal("USD"),
+	unit: Type.Literal("micro_usd"),
+	basis: Type.Literal("retained-conservative-on-demand"),
+	rates: Type.Object({
+		vcpuSecond: Type.Optional(Type.Integer({ minimum: 0 })),
+		memoryGiBSecond: Type.Optional(Type.Integer({ minimum: 0 })),
+		gpuSecond: Type.Optional(Type.Integer({ minimum: 0 })),
+		startup: Type.Optional(Type.Integer({ minimum: 0 }))
+	}, { additionalProperties: false }),
+	safetyFactorBps: Type.Union([Type.Integer({ minimum: 1e4 }), Type.Null()]),
+	validFrom: Type.Union([utcSecond, Type.Null()]),
+	validUntil: Type.Union([utcSecond, Type.Null()])
+}, { additionalProperties: false });
+const bootstrap = Type.Object({
+	mode: Type.Literal("finite-human-root"),
+	rootReferences: Type.Array(Type.String({ minLength: 1 }), { uniqueItems: true }),
+	allowedActions: Type.Array(Type.Union([
+		Type.Literal("enroll_human_root"),
+		Type.Literal("initialize_kernel_record"),
+		Type.Literal("restore_kernel_record"),
+		Type.Literal("cutover_single_writer")
+	]), {
+		minItems: 1,
+		uniqueItems: true
+	}),
+	maxUses: Type.Integer({
+		minimum: 1,
+		maximum: 1
+	}),
+	expiresAt: Type.Union([utcSecond, Type.Null()]),
+	projectCreationAllowed: Type.Literal(false),
+	requiresHumanSignature: Type.Literal(true),
+	automationCanSatisfy: Type.Literal(false)
+}, { additionalProperties: false });
+const digest$1 = Type.String({ pattern: "^sha256:[0-9a-f]{64}$" });
+const policyBundle = Type.Object({
+	digest: digest$1,
+	manifest: Type.Record(Type.String({ pattern: "^policy/[A-Za-z0-9._-]+\\.rego$" }), Type.String({ pattern: "^[0-9a-f]{64}$" }), {
+		additionalProperties: false,
+		minProperties: 1
+	})
+}, { additionalProperties: false });
+const lawInputProfile = Type.Object({
+	requiresRunCeiling: Type.Boolean(),
+	requiresExpirationLabel: Type.Boolean(),
+	maxRunSeconds: Type.Integer({ minimum: 1 }),
+	allowExternalIp: Type.Literal(false),
+	machinePrefixes: Type.Array(Type.String({ minLength: 1 }), {
+		minItems: 1,
+		uniqueItems: true
+	}),
+	accelerators: Type.Array(Type.String({ minLength: 1 }), { uniqueItems: true }),
+	maxGpuInstances: Type.Integer({ minimum: 0 }),
+	maxTotalVcpus: Type.Integer({ minimum: 1 }),
+	maxParallelism: Type.Integer({ minimum: 1 }),
+	network: Type.Literal("private")
+}, { additionalProperties: false });
+const lawInputs = Type.Object({
+	cloudflare: Type.Object({
+		approvedZoneId: Type.String({ minLength: 1 }),
+		approvedAccountId: Type.String({ minLength: 1 })
+	}, { additionalProperties: false }),
+	planLimits: Type.Object({
+		maxGpuInstances: Type.Integer({ minimum: 0 }),
+		maxTotalVcpus: Type.Integer({ minimum: 1 }),
+		approvedLocations: Type.Array(Type.String({ minLength: 1 }), {
+			minItems: 1,
+			uniqueItems: true
+		})
+	}, { additionalProperties: false }),
+	profiles: Type.Object({
+		compute: lawInputProfile,
+		plane: lawInputProfile
+	}, { additionalProperties: false })
+}, { additionalProperties: false });
+const evaluationInputs = Type.Object({
+	policyBundle,
+	lawInputs
+}, { additionalProperties: false });
+const lawDocument = Type.Object({
+	schemaVersion: Type.Literal(1),
+	kind: Type.Literal("dsg.infra.law"),
+	lawId: Type.String({ minLength: 1 }),
+	status: Type.Union([Type.Literal("unissued"), Type.Literal("issued")]),
+	authority,
+	standingOrder,
+	scope,
+	validity,
+	revocation,
+	ceilings: Type.Object({
+		gpuSecondsPerPersonUtcWeek: ceiling,
+		usdMicroUnitsPerPersonUtcMonth: ceiling,
+		usdMicroUnitsPerOrganizationUtcMonth: ceiling
+	}, { additionalProperties: false }),
+	capabilities,
+	priceProfile,
+	bootstrap,
+	evaluationInputs
+}, { additionalProperties: false });
+const signature = Type.Object({
+	algorithm: Type.Literal("Ed25519"),
+	keyClass: Type.Union([
+		Type.Literal("synthetic-test-only"),
+		Type.Literal("human-authority"),
+		Type.Literal("release-automation")
+	]),
+	publicKeyHex: Type.String({ pattern: "^[0-9a-f]{64}$" }),
+	signatureHex: Type.String({ pattern: "^[0-9a-f]{128}$" })
+}, { additionalProperties: false });
+const SignedLawBundleSchema = Type.Object({
+	schemaVersion: Type.Literal(1),
+	kind: Type.Union([Type.Literal("dsg.infra.signed-law"), Type.Literal("dsg.infra.signed-law-fixture")]),
+	testOnly: Type.Boolean(),
+	deployedAuthority: Type.Boolean(),
+	payload: lawDocument,
+	canonicalPayload: Type.String({ minLength: 1 }),
+	payloadSha256: Type.String({ pattern: "^[0-9a-f]{64}$" }),
+	canonicalSignatureInput: Type.String({ minLength: 1 }),
+	signature
+}, { additionalProperties: false });
+const signedLawV1 = {
+	literal: SIGNED_LAW_PROFILE,
+	literalNote: "carried as the domain member of the canonical signature input, not as a bundle field",
+	shapes: { bundle: SignedLawBundleSchema }
+};
+//#endregion
+//#region src/infra/adoption-fact.v1.ts
+const ADOPTION_FACT_PROFILE = "dsg.infra.adoption-fact/1";
+const AdoptionFactSchema = closed({
+	profile: Type.Literal(ADOPTION_FACT_PROFILE),
+	/** The root the record names as active baseline owner. */
+	root: NonEmptyString,
+	lineage: NonEmptyString,
+	/** The accepted root-authorizing operation. */
+	operation: NonEmptyString,
+	/** Count of accepted root operations; ownership needs at least one. */
+	generation: Type.Integer({
+		minimum: 1,
+		maximum: Number.MAX_SAFE_INTEGER
+	}),
+	/** Canonical digest of the verified record snapshot. */
+	snapshotSha256: Hex64,
+	/** initialize establishes the first owner; cutover transfers it. restore
+	*  and enrollment move custody and human roots, never root ownership. */
+	action: Type.Union([Type.Literal("initialize_kernel_record"), Type.Literal("cutover_single_writer")]),
+	signer: Orn,
+	humanRoot: NonEmptyString,
+	testOnly: Type.Boolean()
+});
+const adoptionFactV1 = {
+	literal: ADOPTION_FACT_PROFILE,
+	rootShape: "fact",
+	shapes: { fact: AdoptionFactSchema }
+};
+//#endregion
+//#region src/registry/revocations.v1.ts
+const REVOCATIONS_PROFILE = "dsg.registry.revocations/1";
+const closed$1 = { additionalProperties: false };
+const text = Type.String({ minLength: 1 });
+const digest = Type.String({ pattern: "^[0-9a-f]{64}$" });
+const time = Type.Integer({
+	minimum: 0,
+	maximum: Number.MAX_SAFE_INTEGER
+});
+const RevocationSchema = Type.Object({
+	domain: Type.Literal(REVOCATIONS_PROFILE),
+	version: Type.Integer({
+		minimum: 1,
+		maximum: Number.MAX_SAFE_INTEGER
+	}),
+	issuedAt: time,
+	expiresAt: time,
+	previousSha256: Type.Union([digest, Type.Null()]),
+	testOnly: Type.Literal(true),
+	signerKey: digest,
+	revoked: Type.Array(Type.Object({
+		kind: Type.Union([
+			Type.Literal("principal"),
+			Type.Literal("standing-order"),
+			Type.Literal("law"),
+			Type.Literal("class"),
+			Type.Literal("key")
+		]),
+		id: text,
+		effectiveAt: time,
+		reason: text
+	}, closed$1)),
+	trustHistory: Type.Array(Type.Object({
+		principal: text,
+		publicKey: digest,
+		role: Type.Union([
+			Type.Literal("human"),
+			Type.Literal("release"),
+			Type.Literal("collector")
+		]),
+		action: Type.Union([
+			Type.Literal("enroll"),
+			Type.Literal("rotate"),
+			Type.Literal("compromise")
+		]),
+		effectiveAt: time,
+		authoritySha256: digest,
+		replacesKey: Type.Union([digest, Type.Null()])
+	}, closed$1))
+}, closed$1);
+const RevocationPointerSchema = Type.Object({
+	version: Type.Integer({
+		minimum: 1,
+		maximum: Number.MAX_SAFE_INTEGER
+	}),
+	sha256: digest,
+	url: Type.String({ pattern: "^/revocations/v/[1-9][0-9]*/snapshot\\.json$" })
+}, closed$1);
+const revocationsV1 = {
+	literal: REVOCATIONS_PROFILE,
+	shapes: {
+		snapshot: RevocationSchema,
+		pointer: RevocationPointerSchema
+	}
+};
+//#endregion
+//#region src/kernel/bootstrap.v1.ts
+const BOOTSTRAP_PROFILE = "dsg.kernel.bootstrap/1";
+const BootstrapActionSchema = Type.Union([
+	Type.Literal("initialize_kernel_record"),
+	Type.Literal("restore_kernel_record"),
+	Type.Literal("cutover_single_writer"),
+	Type.Literal("enroll_human_root")
+]);
+const BootstrapIntentSchema = closed({
+	version: Type.Literal(BOOTSTRAP_PROFILE),
+	operation: NonEmptyString,
+	action: BootstrapActionSchema,
+	lineage: NonEmptyString,
+	humanRoot: NonEmptyString,
+	signer: Orn,
+	scope: NonEmptyString,
+	resources: Type.Array(closed({
+		identity: NonEmptyString,
+		specSha256: Hex64
+	}), {
+		minItems: 1,
+		uniqueItems: true
+	}),
+	planSha256: Hex64,
+	preconditionsSha256: Hex64,
+	createdAt: NonEmptyString,
+	expiresAt: NonEmptyString,
+	maxUses: Type.Literal(1),
+	cost: closed({
+		currency: Type.Literal("USD"),
+		maxMicroUsd: Type.Integer({
+			minimum: 0,
+			maximum: Number.MAX_SAFE_INTEGER
+		}),
+		assumptionsSha256: Hex64
+	}),
+	testOnly: Type.Boolean()
+});
+const SignedBootstrapIntentSchema = closed({
+	body: BootstrapIntentSchema,
+	signature: Type.String({ pattern: "^[0-9a-f]{128}$" })
+});
+const bootstrapV1 = {
+	literal: BOOTSTRAP_PROFILE,
+	shapes: {
+		intent: BootstrapIntentSchema,
+		signed: SignedBootstrapIntentSchema
+	}
+};
+//#endregion
+//#region src/kernel/ordinary-authority.v1.ts
+const ORDINARY_AUTHORITY_PROFILE = "dsg.kernel.ordinary-authority/1";
+const names = Type.Array(NonEmptyString, {
+	minItems: 1,
+	uniqueItems: true
+});
+const ceilingValue = Type.Integer({
+	minimum: 0,
+	maximum: Number.MAX_SAFE_INTEGER
+});
+const OrdinaryAuthoritySchema = closed({
+	version: Type.Literal(ORDINARY_AUTHORITY_PROFILE),
+	reference: NonEmptyString,
+	actor: Orn,
+	publicKeyHex: Hex64,
+	keyClass: Type.Union([Type.Literal("synthetic-test-only"), Type.Literal("human-authority")]),
+	designation: closed({
+		role: Type.Literal("law-issuer"),
+		designationReference: NonEmptyString
+	}),
+	scope: closed({
+		scopeReference: NonEmptyString,
+		actions: names,
+		workloadClasses: names,
+		regions: names
+	}),
+	validity: closed({
+		notBefore: UtcSecond,
+		notAfter: UtcSecond
+	}),
+	ceilings: closed({
+		gpuSecondsPerPersonUtcWeek: ceilingValue,
+		usdMicroUnitsPerPersonUtcMonth: ceilingValue,
+		usdMicroUnitsPerOrganizationUtcMonth: ceilingValue
+	}),
+	revoked: Type.Boolean()
+});
+const ordinaryAuthorityV1 = {
+	literal: ORDINARY_AUTHORITY_PROFILE,
+	rootShape: "authority",
+	shapes: { authority: OrdinaryAuthoritySchema }
+};
+//#endregion
+//#region src/run/contract-versions.ts
+const EXECUTOR_PROTOCOL_VERSION = "dsg.run.executor/1";
+const PROVIDER_PROTOCOL_VERSION = "dsg.run.provider/1";
+//#endregion
+//#region src/index.ts
+/** Every profile this version of the package defines, keyed by literal.
+* Profile modules are added here as they are extracted; the rules test
+* and the schema emitter walk this registry, so a module that is not
+* registered does not exist. */
+const PROFILES = {
+	[dispatchConsumeV1.literal]: dispatchConsumeV1,
+	[operationV1.literal]: operationV1,
+	[signedLawV1.literal]: signedLawV1,
+	[resourceDescriptorV1.literal]: resourceDescriptorV1,
+	[adoptionFactV1.literal]: adoptionFactV1,
+	[revocationsV1.literal]: revocationsV1,
+	[bootstrapV1.literal]: bootstrapV1,
+	[ordinaryAuthorityV1.literal]: ordinaryAuthorityV1
+};
+//#endregion
+export { ADOPTION_FACT_PROFILE, AcceptedSchema, AdoptionFactSchema, BOOTSTRAP_PROFILE, BootstrapActionSchema, BootstrapIntentSchema, DISPATCH_CONSUME_PROFILE, DISPATCH_MAX_SKEW_SECONDS, DispatchConsumeRequestSchema, DispatchLeaseSchema, DispatchRefusalCodeSchema, DispatchRefusalSchema, EXECUTOR_PROTOCOL_VERSION, ExecutionDocumentSchema, ExecutionLawSchema, ExecutionResourcesSchema, Hex64, NonEmptyString, OPERATION_PROFILE, ORDINARY_AUTHORITY_PROFILE, OperationBeforeSchema, OperationCleanupSchema, OperationCostSchema, OperationEvidenceSchema, OperationExecutionSchema, OperationRequestSchema, OperationStatusSchema, OrdinaryAuthoritySchema, Orn, PRICE_PROFILE_REFERENCE, PROFILES, PROVIDER_PROTOCOL_VERSION, RESOURCE_DESCRIPTOR_KIND, RESOURCE_DESCRIPTOR_PROFILE, REVOCATIONS_PROFILE, ReadbackSchema, Reference, ResourceDescriptorSchema, RevocationPointerSchema, RevocationSchema, SCOPE_REFERENCE, SIGNED_LAW_DOMAIN, SIGNED_LAW_PROFILE, SafeInt, SignedBootstrapIntentSchema, SignedLawBundleSchema, UtcSecond, closed };
+
+//# sourceMappingURL=index.mjs.map