@flaxia/node 0.3.7 → 0.5.0

package/dist/consent/notice.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Version of the consent disclosure text below.
+ *
+ * Consent records are bound to this value: a record only counts as granted
+ * while it carries the *current* version, so bumping the version invalidates
+ * every existing grant and forces the visitor to see (and accept) the new
+ * wording. Increment it whenever `CONSENT_DISCLOSURE` changes in any way that
+ * a visitor would care about.
+ *
+ * - v1: legacy copy ("サイトのパフォーマンス向上にご協力ください。"), which never
+ *   disclosed what actually runs on the device.
+ * - v2: the informed-consent copy below (third-party workloads, orchestrator
+ *   registration, persistent connection, resource usage).
+ */
+export declare const CONSENT_NOTICE_VERSION = 2;
+/**
+ * The disclosure shown in the built-in banner. Deliberately static: hosts may
+ * style the banner but must not be able to weaken the wording, otherwise the
+ * recorded notice version would no longer describe what the visitor saw.
+ */
+export declare const CONSENT_DISCLOSURE: {
+    readonly summary: "同意すると、このブラウザは第三者から依頼された処理をバックグラウンドで実行します。";
+    readonly items: readonly ["実行する処理: 顧客（第三者）が依頼したワークロード。任意の WebAssembly コンテナの実行や、画像の NSFW（成人向け）判定などを含みます。", "接続と登録: オーケストレーターへ WebSocket で常時接続し、端末の性能や対応ワークロードを登録します。", "資源の使用: 待機中も接続を維持し、処理の実行中は CPU・GPU・通信・バッテリーを消費します。", "タスクの出所: 処理はこのサイトの運営者ではなく、第三者（顧客）から割り当てられます。"];
+    /** Shown while the accept button is inside its minimum-visible window. */
+    readonly acceptGateHint: "開示内容を確認できるよう、「同意して開始」はしばらくの間押せません。";
+    readonly acceptLabel: "同意して開始";
+    readonly rejectLabel: "拒否";
+};
+//# sourceMappingURL=notice.d.ts.map

package/dist/consent/notice.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notice.d.ts","sourceRoot":"","sources":["../../src/consent/notice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;IAS7B,0EAA0E;;;;CAKlE,CAAC"}

package/dist/consent/storage.d.ts

@@ -1,20 +1,89 @@
 import type { ConsentState } from '@flaxia/sdk';
+/**
+ * Maximum lifetime of a stored consent grant: 180 days.
+ *
+ * The lifetime is bounded on purpose — consent is not permanent, and the
+ * disclosure shown to the visitor describes what the node does *today*, so a
+ * grant must be renewed periodically. Records that claim a longer lifetime are
+ * rejected (see `isRecordFresh`).
+ */
+export declare const CONSENT_MAX_TTL_MS: number;
 declare function safeGet(key: string): string | null;
 declare function safeSet(key: string, value: string): void;
 declare function safeRemove(key: string): void;
+/**
+ * Persistent store for the non-extractable HMAC key. The key is a `CryptoKey`,
+ * so it cannot be exported as raw bytes; persisting it in IndexedDB (which
+ * structured-clones `CryptoKey` objects) keeps forgery out of reach of scripts
+ * that can only write strings into `localStorage`.
+ */
+export interface ConsentKeyStore {
+    load(): Promise<CryptoKey | null>;
+    save(key: CryptoKey): Promise<void>;
+    clear(): Promise<void>;
+}
 export declare const hasConsent: () => boolean;
-/** Persist consent. Clears any previous denial so the two never co-exist. */
-export declare const saveConsent: () => void;
 export declare const hasDenial: () => boolean;
+/**
+ * Resolve the persisted consent state.
+ *
+ * Synchronous and fail-closed: until {@link initConsentIntegrity} has verified
+ * the stored record (or a grant is made in this document) the answer is not
+ * `'granted'`. A stored grant still wins over a stored denial, but the two are
+ * kept mutually exclusive by the save helpers.
+ */
+export declare const getConsentState: () => ConsentState;
+/**
+ * Load (or create) the non-extractable HMAC key and verify the stored consent
+ * record. Idempotent and never rejects. Hosts should await this before relying
+ * on {@link getConsentState}; callers that cannot wait still fail closed.
+ */
+export declare const initConsentIntegrity: () => Promise<ConsentState>;
+/**
+ * Persist consent (clears any previous denial). Synchronous, as required by the
+ * controller and by host consent callbacks.
+ *
+ * The grant is only accepted when it is authorized:
+ * - `ConsentUI` minted a one-shot gesture token from a click on the accept
+ *   button (the visitor saw the banner and acted), or
+ * - the host explicitly opted in via {@link setHostManagedConsentAllowed}.
+ *
+ * Otherwise the call is refused with a warning and the state stays not-granted,
+ * so a host that calls `accept()` without rendering a banner cannot silently
+ * consent. When WebCrypto is unavailable the grant is limited to the current
+ * document (nothing unverifiable is written to storage).
+ */
+export declare const saveConsent: () => void;
+/**
+ * Async variant of {@link saveConsent} that resolves once the record is sealed
+ * and readable again. Same authorization requirements.
+ */
+export declare const grantConsent: (options?: {
+    ttlMs?: number;
+}) => Promise<ConsentState>;
+/**
+ * Mint the one-shot authorization consumed by the next {@link saveConsent} /
+ * {@link grantConsent} call. Only the built-in `ConsentUI` accept button calls
+ * this, from a click handler that runs after the minimum-visible duration.
+ */
+export declare const markUserGestureConsent: (noticeVersion?: number) => void;
+/**
+ * Opt in to host-managed consent (default: disabled).
+ *
+ * Disabled by default so a host-supplied `onConsentRequired` callback cannot
+ * grant consent headlessly. Hosts that render their own disclosure UI must call
+ * this before granting, and remain responsible for showing the current
+ * disclosure text to the visitor.
+ */
+export declare const setHostManagedConsentAllowed: (allowed: boolean) => void;
+export declare const isHostManagedConsentAllowed: () => boolean;
 /** Persist denial. Clears any previous consent/expiry so the two never co-exist. */
 export declare const saveDenial: () => void;
-/** Forget the consent decision entirely (granted + expiry + denial). */
-export declare const clearConsent: () => void;
 /**
- * Resolve the persisted consent state. A stored grant wins over a stored
- * denial, but the two are kept mutually exclusive by the save helpers.
+ * Revoke consent: forget the decision entirely (granted + expiry + denial) and
+ * drop the HMAC key so copies of the old record can no longer verify.
  */
-export declare const getConsentState: () => ConsentState;
+export declare const clearConsent: () => void;
 export declare const safeLocalStorageGet: typeof safeGet;
 export declare const safeLocalStorageSet: typeof safeSet;
 export declare const safeLocalStorageRemove: typeof safeRemove;
@@ -24,5 +93,20 @@ export declare const safeLocalStorageRemove: typeof safeRemove;
  * is undefined on mobile Chrome). Never throws.
  */
 export declare const safeRandomUUID: () => string;
+/** @internal Drop every in-memory grant/key so the next read re-verifies. */
+declare function resetIntegrityCache(): void;
+/**
+ * @internal Test-only seams. Production code never calls these; they exist so
+ * unit tests can simulate a reload (key store), a foreign origin, or an
+ * integrity-cache reset without weakening any production default.
+ */
+export declare const __consentTestHooks: {
+    setKeyStore(store: ConsentKeyStore | null): void;
+    setOrigin(origin: string | null): void;
+    resetIntegrityCache: typeof resetIntegrityCache;
+    reset(): void;
+    /** Seed a valid grant as if the visitor had accepted the banner. */
+    seedGrantedConsent(noticeVersion?: number): void;
+};
 export {};
 //# sourceMappingURL=storage.d.ts.map

package/dist/consent/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/consent/storage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAahD,iBAAS,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM3C;AAED,iBAAS,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAMjD;AAED,iBAAS,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAMrC;AAED,eAAO,MAAM,UAAU,QAAO,OAgB7B,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,WAAW,QAAO,IAI9B,CAAC;AAEF,eAAO,MAAM,SAAS,QAAO,OAE5B,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,UAAU,QAAO,IAI7B,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,YAAY,QAAO,IAI/B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,eAAe,QAAO,YAIlC,CAAC;AAEF,eAAO,MAAM,mBAAmB,gBAAU,CAAC;AAC3C,eAAO,MAAM,mBAAmB,gBAAU,CAAC;AAC3C,eAAO,MAAM,sBAAsB,mBAAa,CAAC;AAEjD;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAO,MAajC,CAAC"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/consent/storage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGhD;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,QAA4B,CAAC;AAoC5D,iBAAS,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM3C;AAED,iBAAS,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAMjD;AAED,iBAAS,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAMrC;AA2BD;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAwTD,eAAO,MAAM,UAAU,QAAO,OAI7B,CAAC;AAEF,eAAO,MAAM,SAAS,QAAO,OAE5B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,QAAO,YAIlC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,QAAO,OAAO,CAAC,YAAY,CAG3D,CAAC;AAoHF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,WAAW,QAAO,IAU9B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,YAAY,GAAU,UAAU;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,KAAG,OAAO,CAAC,YAAY,CAWrF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,GACjC,gBAAe,MAA+B,KAC7C,IAEF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,GAAI,SAAS,OAAO,KAAG,IAE/D,CAAC;AAEF,eAAO,MAAM,2BAA2B,QAAO,OAAoC,CAAC;AAEpF,oFAAoF;AACpF,eAAO,MAAM,UAAU,QAAO,IAQ7B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,YAAY,QAAO,IAa/B,CAAC;AAEF,eAAO,MAAM,mBAAmB,gBAAU,CAAC;AAC3C,eAAO,MAAM,mBAAmB,gBAAU,CAAC;AAC3C,eAAO,MAAM,sBAAsB,mBAAa,CAAC;AA6CjD;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAO,MAajC,CAAC;AAEF,6EAA6E;AAC7E,iBAAS,mBAAmB,IAAI,IAAI,CASnC;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;uBACV,eAAe,GAAG,IAAI,GAAG,IAAI;sBAG9B,MAAM,GAAG,IAAI,GAAG,IAAI;;aAI7B,IAAI;IAMb,oEAAoE;uCAClC,MAAM,GAA4B,IAAI;CAIzE,CAAC"}

package/dist/executor/WorkerPool.d.ts

@@ -1,4 +1,9 @@
 import type { WorkloadType } from "@flaxia/sdk";
+/** Swarm tasks exchange control messages and binary frames mid-task. */
+export interface SwarmCallbacks {
+    onFrame?: (frame: ArrayBuffer) => void;
+    onMessage?: (message: unknown) => void;
+}
 /**
  * Executes tasks against a single Web Worker.
  *
@@ -16,13 +21,42 @@ export declare class WorkerPool {
     private workerUrl;
     private queue;
     private active;
+    /** Control messages that arrived for a task that has not started yet. */
+    private pendingControls;
+    private static readonly MAX_PENDING_CONTROLS;
     private _lastCpuLoad;
     constructor(workerUrl?: string, timeoutMs?: number);
     private initWorker;
     run(id: string, workload: WorkloadType, payload: unknown, timeoutMs?: number, onToken?: (token: string) => void, config?: {
         maxCpuLoad?: number;
-    }): Promise<unknown>;
+        fileSourceOrigins?: string[];
+        containerImageOrigins?: string[];
+    }, swarm?: SwarmCallbacks): Promise<unknown>;
     private execute;
+    /** Hand over the control messages that were waiting for this task to start. */
+    private flushControls;
+    /**
+     * Post a message to the active task's worker. Used by the signaling client to
+     * push swarm control messages and hidden-state frames into a running session.
+     */
+    private postToActive;
+    /**
+     * Deliver a swarm control message to the task it names. A message that
+     * arrives while that task is still queued is held until it starts; posting it
+     * into whichever task happens to be running would hand it to the wrong
+     * session (and drop the intended one).
+     */
+    sendControl(message: unknown, executionId?: string): boolean;
+    sendFrame(frame: ArrayBuffer): boolean;
+    /**
+     * The coordinator settled this task elsewhere (timeout, a peer failed, the
+     * plan was rejected): stop it.
+     *
+     * A queued task is dropped before it ever starts. A running task is asked to
+     * stop and the slot is released only when the worker itself reports done or
+     * error, so two tasks can never end up in the same worker.
+     */
+    abort(id: string, reason: string): boolean;
     private handleWorkerError;
     private dequeue;
     private cleanupWorker;

package/dist/executor/WorkerPool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WorkerPool.d.ts","sourceRoot":"","sources":["../../src/executor/WorkerPool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAahD;;;;;;;;;;GAUG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,KAAK,CAAyB;IACtC,OAAO,CAAC,MAAM,CAA2B;IACzC,OAAO,CAAC,YAAY,CAAK;gBAEb,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,SAAS;IAMlD,OAAO,CAAC,UAAU;IAYlB,GAAG,CACD,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,OAAO,EAChB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,EACjC,MAAM,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/B,OAAO,CAAC,OAAO,CAAC;IAgBnB,OAAO,CAAC,OAAO;IAiFf,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,OAAO;IAKf,OAAO,CAAC,aAAa;IAQrB,SAAS;IAaT,MAAM;IAMN,IAAI,WAAW,IAAI,MAAM,CAExB;CACF"}
+{"version":3,"file":"WorkerPool.d.ts","sourceRoot":"","sources":["../../src/executor/WorkerPool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAoBhD,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;IACvC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;CACxC;AAED;;;;;;;;;;GAUG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,KAAK,CAAoB;IACjC,OAAO,CAAC,MAAM,CAA2B;IACzC,yEAAyE;IACzE,OAAO,CAAC,eAAe,CAAmD;IAC1E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAM;IAClD,OAAO,CAAC,YAAY,CAAK;gBAEb,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,SAAS;IAMlD,OAAO,CAAC,UAAU;IAYlB,GAAG,CACD,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,OAAO,EAChB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,EACjC,MAAM,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,EAChG,KAAK,CAAC,EAAE,cAAc,GACrB,OAAO,CAAC,OAAO,CAAC;IAgBnB,OAAO,CAAC,OAAO;IA6Ff,+EAA+E;IAC/E,OAAO,CAAC,aAAa;IAOrB;;;OAGG;IACH,OAAO,CAAC,YAAY;IAUpB;;;;;OAKG;IACH,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO;IAW5D,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO;IAItC;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAmB1C,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,OAAO;IAKf,OAAO,CAAC,aAAa;IAQrB,SAAS;IAkBT,MAAM;IAMN,IAAI,WAAW,IAAI,MAAM,CAExB;CACF"}

package/dist/executor/__tests__/WorkerPool.swarm.test.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Regression test for swarm control-message routing, written from the
+ * feature/swarm-inference quality review and kept after the fix landed.
+ *
+ * Do not weaken it to make the suite green — if it starts failing, the defect
+ * it documents has come back.
+ *
+ *   M3  `sendControl` must post to the task the message names, never to
+ *       whichever task happens to be running; a queued swarm session has to
+ *       receive its control message when it starts.
+ */
+export {};
+//# sourceMappingURL=WorkerPool.swarm.test.d.ts.map

package/dist/executor/__tests__/WorkerPool.swarm.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorkerPool.swarm.test.d.ts","sourceRoot":"","sources":["../../../src/executor/__tests__/WorkerPool.swarm.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/executor/__tests__/container-executor.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=container-executor.test.d.ts.map

package/dist/executor/__tests__/container-executor.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-executor.test.d.ts","sourceRoot":"","sources":["../../../src/executor/__tests__/container-executor.test.ts"],"names":[],"mappings":""}

package/dist/executor/__tests__/egress-guard.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=egress-guard.test.d.ts.map

package/dist/executor/__tests__/egress-guard.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress-guard.test.d.ts","sourceRoot":"","sources":["../../../src/executor/__tests__/egress-guard.test.ts"],"names":[],"mappings":""}

package/dist/executor/__tests__/webgpuProbe.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=webgpuProbe.test.d.ts.map

package/dist/executor/__tests__/webgpuProbe.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webgpuProbe.test.d.ts","sourceRoot":"","sources":["../../../src/executor/__tests__/webgpuProbe.test.ts"],"names":[],"mappings":""}

package/dist/executor/container-executor.d.ts

@@ -1,3 +1,51 @@
 import type { ContainerPayload, ContainerResult } from "@flaxia/sdk";
-export declare const runContainer: (payload: ContainerPayload) => Promise<ContainerResult>;
+/** Maximum size of a container WASM image (128 MiB). */
+export declare const MAX_CONTAINER_IMAGE_BYTES: number;
+/** Aggregate decoded input-file ceiling; keeps reference downloads bounded. */
+export declare const MAX_CONTAINER_INPUT_BYTES: number;
+/** Memory bounds for `memoryLimitMb` (clamped): 32 MiB .. 4 GiB. */
+export declare const MIN_CONTAINER_MEMORY_MB = 32;
+export declare const MAX_CONTAINER_MEMORY_MB = 4096;
+/** Default memory cap when the payload omits `memoryLimitMb`. */
+export declare const DEFAULT_CONTAINER_MEMORY_MB = 512;
+/**
+ * Replace the container image origin allowlist. Hosts/operators call this once
+ * at start-up; entries must be exact origins (`https://cdn.example.com`).
+ */
+export declare function configureContainerImageOrigins(origins: readonly string[]): void;
+/** Origins currently allowed to serve container images (empty = disabled). */
+export declare function getAllowedContainerImageOrigins(): readonly string[];
+/**
+ * Validate a container image URL. The origin allowlist is the primary control;
+ * the shared egress guard additionally rejects loopback/private hosts,
+ * non-default ports, credentials, non-HTTPS schemes and non-`.wasm` paths.
+ */
+export declare function validateImageUrl(urlStr: string, origins?: readonly string[]): URL;
+export interface WasmMemoryLimits {
+    /** Declared minimum memory in bytes (0 when the module does not declare any). */
+    initialBytes: number;
+    /** Declared maximum memory in bytes, or null when the module declares none. */
+    maximumBytes: number | null;
+}
+/**
+ * Read the memory section of a WASM binary.
+ *
+ * A WASI module exports its own `WebAssembly.Memory`, so the shim cannot inject
+ * a capped memory: the only pre-execution guarantee available in the browser is
+ * to inspect what the module *declares* and refuse to instantiate when it is
+ * allowed to exceed `memoryLimitMb`. See `docs/04-workloads.md` for the exact
+ * guarantee this does (and does not) provide.
+ */
+export declare function parseWasmMemoryLimits(binary: Uint8Array): WasmMemoryLimits;
+/** Clamp `memoryLimitMb` into the supported range. */
+export declare function resolveMemoryLimitMb(requested?: number): number;
+/**
+ * Enforce the payload's memory cap against the module's declared memory limits.
+ * Rejects a module without an explicit maximum, one that could grow past the
+ * cap, or one that needs more than the cap just to start.
+ */
+export declare function assertWasmMemoryWithinLimit(binary: Uint8Array, limitMb: number): WasmMemoryLimits;
+/** Decode inline files and download scoped references before mounting either. */
+export declare function resolveContainerFiles(payload: Pick<ContainerPayload, 'files' | 'fileSources'>, allowedFileSourceOrigins?: readonly string[]): Promise<Map<string, Uint8Array>>;
+export declare const runContainer: (payload: ContainerPayload, allowedFileSourceOrigins?: readonly string[], containerImageOrigins?: readonly string[]) => Promise<ContainerResult>;
 //# sourceMappingURL=container-executor.d.ts.map

package/dist/executor/container-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"container-executor.d.ts","sourceRoot":"","sources":["../../src/executor/container-executor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAqCrE,eAAO,MAAM,YAAY,GAAU,SAAS,gBAAgB,KAAG,OAAO,CAAC,eAAe,CA8ErF,CAAC"}
+{"version":3,"file":"container-executor.d.ts","sourceRoot":"","sources":["../../src/executor/container-executor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAuB,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAc1F,wDAAwD;AACxD,eAAO,MAAM,yBAAyB,QAAoB,CAAC;AAK3D,+EAA+E;AAC/E,eAAO,MAAM,yBAAyB,QAAmB,CAAC;AAG1D,oEAAoE;AACpE,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAC5C,iEAAiE;AACjE,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAa/C;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAa/E;AAED,8EAA8E;AAC9E,wBAAgB,+BAA+B,IAAI,SAAS,MAAM,EAAE,CAEnE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,SAAS,MAAM,EAAwB,GAAG,GAAG,CAyBtG;AAED,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,GAAG,gBAAgB,CAmD1E;AAgBD,sDAAsD;AACtD,wBAAgB,oBAAoB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAM/D;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,gBAAgB,CAiBjG;AA+CD,iFAAiF;AACjF,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,OAAO,GAAG,aAAa,CAAC,EACxD,wBAAwB,GAAE,SAAS,MAAM,EAAO,GAC/C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAgElC;AAED,eAAO,MAAM,YAAY,GACvB,SAAS,gBAAgB,EACzB,2BAA0B,SAAS,MAAM,EAAO,EAChD,wBAAuB,SAAS,MAAM,EAAwB,KAC7D,OAAO,CAAC,eAAe,CA8FzB,CAAC"}

package/dist/executor/egress-guard.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Node-side egress guard for every workload that fetches a customer-supplied
+ * URL (container WASM images, nudenet image URLs, ...).
+ *
+ * A volunteer node runs inside the visitor's browser, so a customer-supplied
+ * URL turns that visitor's residential IP into a request proxy (SSRF): the
+ * browser will happily reach loopback, the visitor's LAN, CGNAT/Tailscale
+ * addresses, cloud metadata endpoints and `.local`/`.internal` names. The guard
+ * below is the single place that decides whether a URL may be fetched at all.
+ *
+ * What it enforces:
+ *  - `https:` only, no embedded credentials (`user:pass@host`);
+ *  - the host may not be, or resolve syntactically to, loopback / private /
+ *    link-local / CGNAT / ULA / IPv4-mapped-IPv6 / unspecified / `0.0.0.0/8` /
+ *    multicast / reserved space, and may not end in `.local` or `.internal`;
+ *  - only the default HTTPS port is allowed;
+ *  - redirects are followed manually and every hop is re-validated (an
+ *    environment that hides `Location` on a manual redirect gets the request
+ *    rejected instead — fail closed);
+ *  - `Content-Type` must be on the caller's allowlist;
+ *  - the body is streamed and aborted once it passes the byte cap (the
+ *    `Content-Length` header is never trusted);
+ *  - an `AbortSignal` timeout bounds the whole exchange.
+ *
+ * Residual risk (documented, not silently ignored): the browser resolves the
+ * hostname, so a DNS name that only *later* resolves to a private address
+ * cannot be detected from JavaScript without a DNS API. IP literals and
+ * private-looking names are rejected here; public names are additionally
+ * protected by the browser's Private Network Access checks.
+ */
+/** Hard default response-size cap (8 MiB) when a caller does not set one. */
+export declare const DEFAULT_MAX_EGRESS_BYTES: number;
+/** Hard ceiling for any caller-provided cap (256 MiB). */
+export declare const MAX_EGRESS_BYTES: number;
+/** Default whole-exchange timeout. */
+export declare const DEFAULT_EGRESS_TIMEOUT_MS = 30000;
+/** Redirect hops we are willing to re-validate. */
+export declare const MAX_EGRESS_REDIRECTS = 3;
+/** Only the default HTTPS port is allowed: odd ports are a common SSRF pivot. */
+export declare const ALLOWED_EGRESS_PORTS: number[];
+export interface EgressRequest {
+    /** Absolute URL to fetch. */
+    url: string | URL;
+    /** `Content-Type` prefixes (or exact media types) accepted for the body. */
+    allowContentTypes: readonly string[];
+    /** Maximum response body size in bytes (clamped to `MAX_EGRESS_BYTES`). */
+    maxBytes?: number;
+    /** Whole-exchange timeout in ms (applied with `AbortSignal.timeout`). */
+    timeoutMs?: number;
+    /** Extra request headers (validated: hop-by-hop headers are not allowed). */
+    headers?: Record<string, string>;
+    /** HTTP method; only GET/HEAD are meaningful for these workloads. */
+    method?: 'GET' | 'HEAD';
+}
+export interface EgressResult {
+    /** Final URL after the (manually validated) redirect chain. */
+    url: string;
+    status: number;
+    ok: boolean;
+    /** `Content-Type` of the final response, lowercased without parameters. */
+    contentType: string;
+    /** Full body bytes; empty for HEAD or an error status. */
+    bytes: Uint8Array<ArrayBuffer>;
+    byteLength: number;
+}
+export interface EgressGuardOptions {
+    /** Override the accepted ports (tests / non-default deployments). */
+    allowedPorts?: readonly number[];
+    /** Allow `http:` as well as `https:`. Never enable in production. */
+    allowInsecure?: boolean;
+}
+/**
+ * True when a dotted-decimal IPv4 literal belongs to a range a volunteer node
+ * must never reach.
+ */
+export declare function isBlockedIPv4(host: string): boolean;
+/**
+ * Expand an IPv6 literal to its eight 16-bit groups, or return null when the
+ * text is not a valid IPv6 address. Handles `::` compression, a trailing
+ * embedded IPv4 (`::ffff:10.0.0.5`) and IPv4-compatible forms.
+ */
+export declare function parseIPv6(host: string): number[] | null;
+/**
+ * True when an IPv6 literal is an address a volunteer node must never reach:
+ * unspecified (`::`), loopback (`::1`), IPv4-mapped/compatible IPv6 (the
+ * browser connects to the embedded IPv4), ULA (`fc00::/7`), link-local
+ * (`fe80::/10`), multicast (`ff00::/8`) and reserved space.
+ */
+export declare function isBlockedIPv6(host: string): boolean;
+/**
+ * Validate a hostname (or IP literal) independently of the URL parser. Exported
+ * so workloads can pre-check a host and so the rules are unit-testable.
+ */
+export declare function assertPublicHostname(hostname: string, options?: EgressGuardOptions): void;
+/**
+ * Validate an egress URL: protocol, credentials, port and host. Returns the
+ * parsed `URL` so callers can reuse it (and so redirect hops share one path).
+ */
+export declare function assertPublicUrl(input: string | URL, options?: EgressGuardOptions): URL;
+/**
+ * Fetch a customer-supplied URL through the guard. Redirects are resolved
+ * manually so each hop is re-validated; the body is capped while streaming.
+ */
+export declare function fetchGuarded(request: EgressRequest, options?: EgressGuardOptions): Promise<EgressResult>;
+//# sourceMappingURL=egress-guard.d.ts.map

package/dist/executor/egress-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress-guard.d.ts","sourceRoot":"","sources":["../../src/executor/egress-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,wBAAwB,QAAkB,CAAC;AACxD,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB,QAAoB,CAAC;AAClD,sCAAsC;AACtC,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAChD,mDAAmD;AACnD,eAAO,MAAM,oBAAoB,IAAI,CAAC;AACtC,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,UAAQ,CAAC;AAM1C,MAAM,WAAW,aAAa;IAC5B,6BAA6B;IAC7B,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;IAClB,4EAA4E;IAC5E,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,qEAAqE;IACrE,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,OAAO,CAAC;IACZ,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,qEAAqE;IACrE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAaD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAyBnD;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAqDvD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAgBnD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,IAAI,CAoB7F;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,EAAE,OAAO,GAAE,kBAAuB,GAAG,GAAG,CAyB1F;AAmFD;;;GAGG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,aAAa,EACtB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,YAAY,CAAC,CAqEvB"}

package/dist/executor/memoryProbe.d.ts

@@ -1,4 +1,29 @@
 export declare const HEAVY_WORKLOAD_WASM_MEMORY_BYTES: number;
+/**
+ * Probe a bounded lower bound of memory this runtime can commit. The function
+ * stops at `targetBytes`; it deliberately does not explore the engine maximum.
+ * Only the first call per page allocates/touches memory. If a later caller asks
+ * for a higher target, return the already-proven lower bound instead of
+ * committing more memory during startup.
+ */
 export declare function probeMaxWasmMemoryBytes(targetBytes?: number, chunkBytes?: number): number;
+/**
+ * The device's committed WebAssembly memory, probed at most once per page.
+ * This is the cheap accessor every call site (registration, reconnect,
+ * capability reporting) should use instead of `probeMaxWasmMemoryBytes()`.
+ */
+export declare function getWasmMemoryBytes(): number;
+/**
+ * Whether the device can commit the memory a heavy (multi-GB model) workload
+ * needs. Uses the cached probe, so it never re-allocates.
+ */
 export declare function hasEnoughWasmMemoryForHeavy(): boolean;
+/**
+ * Drop the memoized probe and reset the run counter. Only for tests that
+ * install a fake WebAssembly implementation; production code never needs to
+ * reset the cache.
+ */
+export declare function resetWasmMemoryProbeCache(): void;
+/** How many times the real probe ran (diagnostics / tests). */
+export declare function getWasmMemoryProbeRuns(): number;
 //# sourceMappingURL=memoryProbe.d.ts.map

package/dist/executor/memoryProbe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memoryProbe.d.ts","sourceRoot":"","sources":["../../src/executor/memoryProbe.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,gCAAgC,QAAgB,CAAC;AAI9D,wBAAgB,uBAAuB,CACrC,WAAW,GAAE,MAAyC,EACtD,UAAU,GAAE,MAA0B,GACrC,MAAM,CA4BR;AAED,wBAAgB,2BAA2B,IAAI,OAAO,CAErD"}
+{"version":3,"file":"memoryProbe.d.ts","sourceRoot":"","sources":["../../src/executor/memoryProbe.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,gCAAgC,QAAgB,CAAC;AA4B9D;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,GAAE,MAAyC,EACtD,UAAU,GAAE,MAA0B,GACrC,MAAM,CA4BR;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAG3C;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,IAAI,OAAO,CAErD;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,IAAI,CAGhD;AAED,+DAA+D;AAC/D,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C"}

package/dist/executor/throttle.d.ts

@@ -1,22 +1,80 @@
+/** Rolling window over which the busy ratio is estimated. */
+export declare const THROTTLE_WINDOW_MS = 30000;
+/** How long `waitForSlot()` waits for the rolling load to drop. */
+export declare const DEFAULT_WAIT_SLOT_MS = 30000;
+/** Continuous work allowed between two mid-execution duty-cycle pauses. */
+export declare const DUTY_CYCLE_BUDGET_MS = 200;
+/**
+ * Thrown when `waitForSlot()` cannot find a slot within its budget.
+ *
+ * It replaces the old behaviour of starting the task anyway: a node that is
+ * already over its CPU budget must not force-start a heavy task at 100% CPU.
+ * The worker turns this into a retryable task error so the orchestrator can
+ * move the task to an idle node.
+ */
+export declare class ThrottleBusyError extends Error {
+    readonly load: number;
+    readonly maxLoad: number;
+    readonly waitedMs: number;
+    readonly retryable = true;
+    constructor(load: number, maxLoad: number, waitedMs: number);
+}
+/**
+ * Keeps the Worker's average CPU usage within `maxLoad` without busy-waiting.
+ *
+ * Load is estimated from the work the worker charges over a rolling window
+ * (`markTaskComplete` plus the duty-cycle pauses below) rather than from a
+ * calibrated busy-loop, which itself burned CPU on slow devices.
+ *
+ * Two controls exist:
+ *  - `waitForSlot()` gates the *start* of a task. When the budget is exhausted
+ *    it throws `ThrottleBusyError` instead of starting the task anyway.
+ *  - `yieldIfOverloaded()` limits the *execution* of a long task. Workloads
+ *    call it between streaming tokens/batches; after `DUTY_CYCLE_BUDGET_MS` of
+ *    continuous work it sleeps for the time needed to hold the configured duty
+ *    cycle, so a 10-minute generation cannot pin a core at 100%.
+ */
 export declare class CpuThrottle {
     private readonly maxLoad;
     private windowStart;
     private windowBusyMs;
     private lastLoad;
+    /** Timestamp of the first unpaused work unit of the current duty cycle. */
+    private dutyStartedAt;
     constructor(maxLoad?: number);
     /**
-     * Charge a completed task's wall-clock duration (in ms) against the CPU budget.
-     * Call this from the worker once a workload has finished (incl. errors/timeouts).
+     * Charge a completed task's wall-clock duration (in ms) against the CPU
+     * budget. Call this from the worker once a workload has finished (incl.
+     * errors/timeouts).
      */
     markTaskComplete(durationMs: number): void;
+    /** Start a fresh duty cycle before executing a task. */
+    beginWork(): void;
+    private resetDutyCycle;
+    private rollWindow;
+    /**
+     * Recompute the rolling busy ratio, treating `work` ms as the work charged
+     * into the current window. Returns the ratio (0..1).
+     */
     private estimate;
     shouldPause(): Promise<boolean>;
     /**
      * Waits until the rolling busy ratio is back under `maxLoad`.
-     * Bounded by `maxWaitMs` so a sustained heavy device cannot stall the queue
-     * forever.
+     *
+     * @throws ThrottleBusyError when the budget is exhausted while the device is
+     * still over budget. Starting the task anyway is what made the previous
+     * implementation a no-op, so this is deliberately fail-closed.
      */
     waitForSlot(maxWaitMs?: number): Promise<void>;
+    /**
+     * Cooperative mid-execution limiting: after a continuous burst of
+     * `DUTY_CYCLE_BUDGET_MS`, sleep long enough that the burst's share of wall
+     * time matches `maxLoad`. Call between streaming tokens or batch iterations.
+     *
+     * Returns the number of ms slept (0 when the caller is inside its duty
+     * cycle), which makes the behaviour directly testable.
+     */
+    yieldIfOverloaded(): Promise<number>;
     get lastMeasuredLoad(): number;
     get maxLoadValue(): number;
 }

package/dist/executor/throttle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"throttle.d.ts","sourceRoot":"","sources":["../../src/executor/throttle.ts"],"names":[],"mappings":"AAmBA,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,WAAW,CAAqB;IACxC,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,QAAQ,CAAK;gBAET,OAAO,SAAO;IAI1B;;;OAGG;IACH,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAU1C,OAAO,CAAC,QAAQ;IAMV,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAIrC;;;;OAIG;IACG,WAAW,CAAC,SAAS,SAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ9D,IAAI,gBAAgB,IAAI,MAAM,CAE7B;IAED,IAAI,YAAY,IAAI,MAAM,CAEzB;CACF"}
+{"version":3,"file":"throttle.d.ts","sourceRoot":"","sources":["../../src/executor/throttle.ts"],"names":[],"mappings":"AAIA,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB,QAAS,CAAC;AACzC,mEAAmE;AACnE,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAG3C,2EAA2E;AAC3E,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC;;;;;;;GAOG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAGxC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAJ3B,QAAQ,CAAC,SAAS,QAAQ;gBAEf,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM;CAO5B;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,WAAW,CAAqB;IACxC,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,QAAQ,CAAK;IACrB,2EAA2E;IAC3E,OAAO,CAAC,aAAa,CAAuB;gBAEhC,OAAO,SAAO;IAI1B;;;;OAIG;IACH,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAK1C,wDAAwD;IACxD,SAAS,IAAI,IAAI;IAIjB,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,UAAU;IAQlB;;;OAGG;IACH,OAAO,CAAC,QAAQ;IAWV,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAKrC;;;;;;OAMG;IACG,WAAW,CAAC,SAAS,SAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAclE;;;;;;;OAOG;IACG,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;IAkB1C,IAAI,gBAAgB,IAAI,MAAM,CAE7B;IAED,IAAI,YAAY,IAAI,MAAM,CAEzB;CACF"}

package/dist/executor/webgpuProbe.d.ts

@@ -0,0 +1,9 @@
+import type { SwarmNodeCapabilities } from '@flaxia/sdk';
+/**
+ * Probe WebGPU support so the orchestrator can decide whether a node may take
+ * part in `swarm-inference`. Never throws: any failure (no `navigator.gpu`,
+ * adapter request rejected, blocked by permissions policy) is reported as
+ * `{ webgpu: false }`.
+ */
+export declare function probeWebGpu(): Promise<SwarmNodeCapabilities>;
+//# sourceMappingURL=webgpuProbe.d.ts.map

package/dist/executor/webgpuProbe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webgpuProbe.d.ts","sourceRoot":"","sources":["../../src/executor/webgpuProbe.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAoBzD;;;;;GAKG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,qBAAqB,CAAC,CA6BlE"}

package/dist/index.d.ts

@@ -1,5 +1,7 @@
 import { initFlaxiaNode } from './client/SignalingClient';
 export { getConsentState as getFlaxiaNodeConsentState } from './consent/storage';
+export { initConsentIntegrity as initFlaxiaNodeConsent } from './consent/storage';
+export { setHostManagedConsentAllowed as setFlaxiaNodeHostManagedConsent } from './consent/storage';
 export { initFlaxiaNode };
 export type { ConsentControls, ConsentState, FlaxiaNodeController } from '@flaxia/sdk';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAK1D,OAAO,EAAE,eAAe,IAAI,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,CAAC;AAC1B,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAO1D,OAAO,EAAE,eAAe,IAAI,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAGjF,OAAO,EAAE,oBAAoB,IAAI,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAIlF,OAAO,EAAE,4BAA4B,IAAI,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,CAAC;AAC1B,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC"}