@lapxo/bound 0.1.9 → 0.2.1

package/dist/host/native/generated.d.ts

@@ -1,217 +0,0 @@
-import { type RootStanding } from './reading.ts';
-export interface ProducerLimits {
-    members: number;
-    bytes: number;
-    work: number;
-    argvBytes: number;
-    argvItems: number;
-}
-export interface ProducerProfile {
-    profile: 'host-generated-executable@3';
-    coordinate: string;
-    implementation: string;
-    interpretations: readonly string[];
-    environmentNames: readonly string[];
-    selector: {
-        port: string;
-        binding: string;
-        implementation: string;
-    };
-    limits: ProducerLimits;
-}
-export interface ParentExecution {
-    identity: string;
-    port: string;
-    binding: string;
-    implementation: string;
-    instrument: string;
-    policy: string;
-    authority: string;
-    inputs: readonly (readonly [string, string])[];
-    environment: readonly (readonly [string, string])[];
-    argv: readonly string[];
-    cwd: string;
-    runtime: string;
-    timeoutMs: number;
-    responseBytes: number;
-}
-export interface DescendantInvocation {
-    cwd: string;
-    argv: readonly string[];
-    environment: readonly (readonly [string, string])[];
-    runtime: string;
-    timeoutMs: number;
-    responseBytes: number;
-}
-export interface GeneratedProducer {
-    readonly identity: string;
-}
-export interface DerivedExecutable {
-    kind: 'derived-executable/1';
-    parent: string;
-    producer: string;
-    identity: string;
-    digest: string;
-    mode: 'module' | 'commonjs';
-    interpretation?: string;
-    invocation: DescendantInvocation;
-    target: {
-        kind: 'file';
-        path: string;
-    } | {
-        kind: 'eval';
-        cwd: string;
-        argv: readonly string[];
-        text: string;
-    };
-    byteLength: number;
-}
-export interface DerivedInterpretation {
-    kind: 'derived-interpretation/1';
-    parent: string;
-    producer: string;
-    identity: string;
-    path: string;
-    digest: string;
-    interpretation: string;
-    invocation: DescendantInvocation;
-    byteLength: number;
-}
-export interface ProducerEmission {
-    kind: 'producer-emission/1';
-    parent: string;
-    producer: string;
-    identity: string;
-    path: string;
-    digest: string;
-    invocation: DescendantInvocation;
-    invocationIdentity: string;
-    byteLength: number;
-}
-export interface RootMember {
-    path: string;
-    digest: string;
-}
-export interface LiteralSnapshot {
-    budget: {
-        members: number;
-        bytes: number;
-    };
-    members: readonly RootMember[];
-    libraries: readonly {
-        name: string;
-        manifest: string;
-    }[];
-    builtins: readonly string[];
-    platform: string;
-}
-export interface ProducerCandidates {
-    readonly invocation: DescendantInvocation;
-    readonly outputs: readonly {
-        path: string;
-        digest?: string;
-        reason?: string;
-    }[];
-}
-/** Call inside the parent's real authority guard BEFORE emission/work. Signature
- * and current eligibility are shared with the Root port constructor, unchanged. */
-export declare function createGeneratedProducer(root: RootStanding, coordinate: string, parent: ParentExecution, implementationBytes: Uint8Array): GeneratedProducer;
-export declare function validateDescendantInvocation(handle: GeneratedProducer, input: DescendantInvocation): DescendantInvocation;
-export declare function producerTransport(handle: GeneratedProducer): Readonly<{
-    coordinate: string;
-    implementation: string;
-    identity: string;
-    parent: string;
-    timeoutMs: number;
-    responseBytes: number;
-    limits: {
-        members: number;
-        bytes: number;
-        work: number;
-        argvBytes: number;
-        argvItems: number;
-    };
-    interpretations: string[];
-}>;
-export declare function readBounded(path: string, limit: number): Uint8Array;
-export declare function assertProducerInterpretation(handle: GeneratedProducer, name: string): void;
-export declare function sealGeneratedFile(handle: GeneratedProducer, path: string, mode: 'module' | 'commonjs', invocation: DescendantInvocation, interpretation?: string): DerivedExecutable;
-/** Preserve the four consumed native eval forms exactly; no rewriting/default
- * flags/option blacklist. Prefix is the exact Root-selected inherited preload. */
-export declare function sealNativeEval(handle: GeneratedProducer, actualArgv: readonly string[], rootPrefix: readonly string[], invocation: DescendantInvocation): DerivedExecutable;
-/** Interpretive data is provenance, never an executable or an authority grant.
- * The finite interpretation is Root-signed before bounded IO/JSON work. */
-export declare function sealInterpretation(handle: GeneratedProducer, path: string, interpretation: string, invocation: DescendantInvocation): DerivedInterpretation;
-/** Metadata from the fixed observer is only a candidate. No file is opened,
- * no emission accepted, and no execution permission follows from registration. */
-export declare function registerProducerCandidates(handle: GeneratedProducer, groups: readonly ProducerCandidates[]): void;
-export declare function recordProducerEmission(handle: GeneratedProducer, path: string, invocation: DescendantInvocation): ProducerEmission;
-/** All observed outputs must match before any provenance is accepted. One
- * invocation context is committed once, with no code grant or quota widening. */
-export declare function recordProducerEmissions(handle: GeneratedProducer, outputs: readonly {
-    path: string;
-    digest: string;
-}[], invocation: DescendantInvocation): {
-    identity: string;
-    kind: string;
-    parent: string;
-    producer: string;
-    invocation: DescendantInvocation;
-    invocationIdentity: string;
-    outputs: {
-        path: string;
-        digest: string;
-        identity: string;
-        byteLength: number;
-    }[];
-};
-/** Verify the ACTUAL body/argv again before execution. A record's existence
- * alone authorizes nothing and cannot be moved to another parent context. */
-export declare function verifyDerived(handle: GeneratedProducer, record: DerivedExecutable, actual: {
-    path?: string;
-    argv?: readonly string[];
-}): Uint8Array;
-export declare function gateDerived(handle: GeneratedProducer, record: DerivedExecutable, actual: {
-    path?: string;
-    argv?: readonly string[];
-}, snapshot: LiteralSnapshot, nativeImplementations?: ReadonlySet<string>): readonly {
-    target: string;
-    digest?: string;
-    platform?: string;
-}[];
-export declare function chargeProducerRequest(handle: GeneratedProducer): void;
-export declare function producerUsage(handle: GeneratedProducer): Readonly<{
-    members: number;
-    bytes: number;
-    work: number;
-    retainedContents: number;
-    codeBytes: number;
-    limits: {
-        members: number;
-        bytes: number;
-        work: number;
-        argvBytes: number;
-        argvItems: number;
-    };
-}>;
-/** Shared host traversal. The reader callback supplies verification; traversal
- * itself introduces no provenance or execution authority. */
-export declare function traverseGeneratedClosure(input: {
-    source: Uint8Array;
-    path: string;
-    mode: 'module' | 'commonjs';
-    libs: ReadonlyMap<string, string>;
-    native: ReadonlySet<string>;
-    platform: string;
-    nativeImplementations: ReadonlySet<string>;
-    verify: (path: string) => {
-        real: string;
-        bytes: Uint8Array;
-        digest: string;
-    };
-    step: () => void;
-}): readonly {
-    target: string;
-    digest?: string;
-    platform?: string;
-}[];

package/dist/host/native/image.d.ts

@@ -1,36 +0,0 @@
-import type { Declaration } from './loader.ts';
-export interface LogicalMember {
-    readonly coordinate: string;
-    readonly digest: string;
-    readonly bytes: number;
-}
-export interface LogicalLoader {
-    readonly members: readonly LogicalMember[];
-    readonly libraries: readonly {
-        name: string;
-        manifest: string;
-    }[];
-    readonly builtins: readonly string[];
-    readonly entries: readonly string[];
-    readonly platform: string;
-}
-export interface ImageMount {
-    readonly coordinate: string;
-    readonly path: string;
-}
-export interface ImageBudget {
-    readonly members: number;
-    readonly bytes: number;
-}
-/** Identifies the admitted Node/OS ABI condition, not a seal of backing libraries
- * or portability proof. The signed image must explicitly name this condition.
- */
-export declare const nodePlatformIdentity: () => string;
-/** Mount only signed logical references at exact bytes. Physical locations are
- * an execution envelope and never a source of implementation identity.
- */
-export declare function mountNativeImage(loader: LogicalLoader, mounts: readonly ImageMount[], entry: string, budget: ImageBudget): {
-    identity: string;
-    declaration: Declaration;
-    entries: readonly string[];
-};

package/dist/host/native/jobs.d.ts

@@ -1,75 +0,0 @@
-/** Pure prospective host handoff planner; no execution or authority discovery. */
-export interface Budget {
-    jobs: number;
-    members: number;
-    edges: number;
-    bytes: number;
-    payloadBytes: number;
-    env: number;
-}
-export interface Member {
-    coordinate: string;
-    digest: string;
-    bytes: Uint8Array;
-}
-export interface Load {
-    from: string;
-    kind: 'module' | 'worker' | 'program';
-    target: string | {
-        computed: string;
-    };
-}
-export interface Binding {
-    id: string;
-    kind: 'process' | 'worker';
-    places: readonly string[];
-    program: string;
-    interpreter?: string;
-    entry?: string;
-    args: readonly string[];
-    inputs: readonly string[];
-    environment: readonly (readonly [string, string])[];
-    limits: {
-        timeMs: number;
-        responseBytes: number;
-        slots: number;
-    };
-}
-/** Constructed by the instrument from admitted configuration and verified bytes,
- * never accepted as a world packet or accompanied by a packet-selected verifier. */
-export interface Handoff {
-    place: string;
-    instrument: string;
-    policy: string;
-    authoritySnapshot: string;
-    budget: Budget;
-    members: readonly Member[];
-    loads: readonly Load[];
-    bindings: readonly Binding[];
-}
-export interface Proposal {
-    id: string;
-    payload: string;
-}
-export interface Launch {
-    id: string;
-    kind: Binding['kind'];
-    identity: string;
-    place: string;
-    program: readonly [string, string];
-    interpreter?: readonly [string, string];
-    entry?: readonly [string, string];
-    args: readonly string[];
-    payload: Uint8Array;
-    environment: readonly (readonly [string, string])[];
-    limits: Binding['limits'];
-    edges: readonly {
-        from: string;
-        kind: string;
-        target: string;
-        digest: string;
-    }[];
-}
-/** digest is selected by the instrument; it is a pure naming implementation,
- * not a callback that answers whether untrusted bytes/authority are "verified". */
-export declare function planJobs(host: Handoff, framed: Uint8Array, digest: (bytes: Uint8Array) => string): readonly Launch[];

package/dist/host/native/loader.d.ts

@@ -1,80 +0,0 @@
-/** Node loader registration is an executable capability, not merely a builtin
- * name. The fixed host retains its captured registration API; imported programs
- * cannot insert a loader returning invented bytes ahead of its load boundary.
- * This does not establish confinement against arbitrary privileged JavaScript.
- */
-export declare function protectNativeLoaderRegistration(): void;
-export interface Member {
-    readonly path: string;
-    readonly digest: string;
-    readonly bytes: number;
-}
-export interface Library {
-    readonly name: string;
-    readonly manifest: string;
-    readonly coordinate?: string;
-}
-export interface Declaration {
-    readonly members: readonly Member[];
-    readonly libraries: readonly Library[];
-    readonly builtins: readonly string[];
-    readonly entry: string;
-    readonly platform: string;
-}
-/** Fixed preload only: expose comparison with the installed resolution, never
- * hook registration or a verifier supplied by a reader. A different module's
- * marker cannot replace this host's closed capability before entry. */
-export declare function installNativeResolutionReuse(declaration: Declaration): () => void;
-interface Context {
-    parentURL?: string;
-}
-interface Resolution {
-    url: string;
-}
-/** Resolution boundary for an instrument-selected native command. It checks
- * actual target bytes before Node executes that target. Native commands remain
- * privileged host implementations: this is not an arbitrary-JS sandbox and
- * cannot prevent trusted code from replacing Node's hooks. That trust condition
- * must be admitted separately; a world cannot claim it in a payload.
- * Native ABI edges refer to the declared platform context, never a fictitious
- * file digest. Completeness of the platform's backing images is not proved here.
- */
-export declare function loadBoundary(declaration: Declaration): {
-    entry: string;
-    resolve(specifier: string, context: Context, next: (specifier: string, context: Context) => Resolution): Resolution;
-    load(url: string, context: {
-        format?: string;
-    }, next: (url: string, context: {
-        format?: string;
-    }) => {
-        format: string;
-        source?: string | Uint8Array | null;
-    }): {
-        format: string;
-        source?: string | Uint8Array | null;
-    };
-    assertClosed(): void;
-    edges: () => {
-        parent: string;
-        target: string;
-        digest?: string;
-        platform?: string;
-    }[];
-};
-/** Install before the entry of an instrument-selected privileged Node command.
- * The bootstrap exception is restricted to this host function's exact selected
- * entry. It is not a permission for a world to choose a verifier or a program.
- * Hooks mediate imports; they do not establish a non-bypass JS sandbox.
- */
-export declare function installBoundary(declaration: Declaration): {
-    loadEntry: () => Promise<any>;
-    assertClosed: () => void;
-    edges: () => {
-        parent: string;
-        target: string;
-        digest?: string;
-        platform?: string;
-    }[];
-    close: () => void;
-};
-export {};

package/dist/host/native/materialize.d.ts

@@ -1,22 +0,0 @@
-import { type NativeRoute } from './route.ts';
-import type { ReadingReference } from '../reading-context.ts';
-export interface NativeMaterialization {
-    readonly archive: string;
-    readonly cwd: string;
-    readonly mountIdentity: string;
-    readonly locations: readonly {
-        member: string;
-        path: string;
-        kind: 'module' | 'data' | 'binary';
-    }[];
-}
-/** Called under the actual Root lease before identity/cache preparation. Missing
- * laid content is a named content demand, never a publisher authority fallback.
- * One retained mount per immutable selection avoids copying it on each ask.
- */
-export declare function materializeNativeRoute(route: NativeRoute): NativeMaterialization;
-/** Fixed child, lifetime supervisor and transitive host modules enter identity
- * before the cache key. Existing instrument closure resolves actual dependencies;
- * this descriptor never executes a module and never accepts a world verifier.
- */
-export declare function nativeExecutorInputs(route: NativeRoute): readonly ReadingReference[];

package/dist/host/native/module-closure.d.ts

@@ -1,27 +0,0 @@
-export interface ModuleClosureMember {
-    readonly digest: string;
-    readonly source: string;
-}
-export interface ModuleClosureSnapshot {
-    readonly identity: string;
-    readonly entry: string;
-    readonly members: ReadonlyMap<string, ModuleClosureMember>;
-}
-export interface ModuleClosureReading {
-    readonly snapshot: string;
-    readonly coordinate: string;
-    readonly digest: string;
-}
-/** Host-selected archive and entry, never a verifier assertion from the program.
- * This proves content identity only; standing admission and runtime capabilities
- * are separate prerequisites. Binary resources are not executable text members.
- */
-export declare function moduleSnapshot(archive: Uint8Array, expected: string, entry: string): ModuleClosureSnapshot;
-/** The host supplies authenticated snapshot identities and its library resolver.
- * Each reached text member is verified here against its exact UTF-8 bytes.
- * Authentication of the snapshot envelope remains a separate host prerequisite.
- * A capsule cannot select either verifier or resolver.
- * This reads declared module edges, not arbitrary I/O or a JavaScript sandbox. Computed edges are unpaid, never absent.
- * Activation requires an admitted host policy; existing inventory callers are not silently changed.
- */
-export declare function moduleClosure(snapshot: ModuleClosureSnapshot, library: (specifier: string, parent: ModuleClosureSnapshot) => ModuleClosureSnapshot | undefined): readonly ModuleClosureReading[];

package/dist/host/native/module-syntax.d.ts

@@ -1,8 +0,0 @@
-export interface ModuleImportSyntax {
-    readonly imports: readonly string[];
-    readonly unresolved: readonly string[];
-}
-/** Syntax inventory is not an execution-closure certificate: unresolved expressions stay explicit. */
-export declare function moduleImportSyntax(source: string, coordinate: string): ModuleImportSyntax;
-/** Existing inventory keeps its meaning; callers requiring closure must inspect unresolved edges. */
-export declare function moduleImports(source: string, coordinate: string): readonly string[];

package/dist/host/native/native-binary.d.ts

@@ -1,54 +0,0 @@
-import { type RootStanding } from './reading.ts';
-import { type ParentExecution } from './generated.ts';
-interface NativeBinaryFields {
-    coordinate: string;
-    alias: string;
-    selector: {
-        port: string;
-        binding: string;
-        implementation: string;
-    };
-    entry: {
-        path: string;
-        digest: string;
-        bytes: number;
-    };
-    limits: {
-        bytes: number;
-    };
-    condition: string;
-}
-export type NativeBinaryProfile = NativeBinaryFields & ({
-    profile: 'host-native-binary@1';
-} | {
-    profile: 'host-native-binary-origin@1';
-    origin: string;
-});
-export interface NativeBinaryOrigin {
-    readonly coordinate: string;
-    readonly line: string;
-    readonly path: string;
-}
-/** A Root-selected local origin is a location constraint, not a World hint. */
-export declare function hostOriginPath(root: RootStanding, coordinate: string): NativeBinaryOrigin;
-export declare function nativeBinaryOrigin(root: RootStanding, p: NativeBinaryProfile, portLine: string): NativeBinaryOrigin | undefined;
-export interface VerifiedNativeBinary {
-    readonly identity: string;
-}
-export interface NativeBinaryProjection {
-    kind: 'native-binary';
-    alias: string;
-    entry: string;
-    entryDigest: string;
-    entryBytes: number;
-    condition: string;
-}
-/** Call under the existing Root guard; privateBinding is from the already
- * prepared host image, never the candidate profile's own expected digest. */
-export declare function verifyNativeBinary(root: RootStanding, coordinate: string, parent: ParentExecution, privateBinding: {
-    coordinate: string;
-    path: string;
-    digest: string;
-}): VerifiedNativeBinary;
-export declare const nativeBinaryProjection: (handle: VerifiedNativeBinary) => NativeBinaryProjection;
-export {};

package/dist/host/native/native-program.d.ts

@@ -1,56 +0,0 @@
-import { type RootStanding } from './reading.ts';
-import { type ParentExecution } from './generated.ts';
-export interface NativeProgramProfile {
-    profile: 'host-native-program@1';
-    coordinate: string;
-    alias: string;
-    selector: {
-        port: string;
-        binding: string;
-        implementation: string;
-    };
-    interpreter: {
-        path: string;
-        digest: string;
-        bytes: number;
-    };
-    root: string;
-    entry: string;
-    members: readonly {
-        coordinate: string;
-        digest: string;
-        bytes: number;
-    }[];
-    limits: {
-        members: number;
-        bytes: number;
-    };
-    condition: string;
-}
-export interface VerifiedNativeProgram {
-    readonly identity: string;
-}
-export interface NativeProgramProjection {
-    alias: string;
-    interpreter: string;
-    interpreterDigest: string;
-    entry: string;
-    root: string;
-    members: readonly {
-        path: string;
-        digest: string;
-    }[];
-    condition: string;
-}
-export declare function verifyNativeProgram(root: RootStanding, coordinate: string, parent: ParentExecution, runtimeBinding: {
-    coordinate: string;
-    path: string;
-    digest: string;
-    members: readonly {
-        coordinate: string;
-        path: string;
-    }[];
-}): VerifiedNativeProgram;
-/** Only the guarded instrument can obtain this from a verified opaque handle.
- * Put it in the signed native image; never accept it from a world proposal. */
-export declare const nativeProgramProjection: (handle: VerifiedNativeProgram) => NativeProgramProjection;

package/dist/host/native/node-jobs.d.ts

@@ -1,84 +0,0 @@
-import type { CommandPort } from '@lapxo/topos/contract';
-import type { Declaration } from './loader.ts';
-import { type Handoff } from './jobs.ts';
-export interface Location {
-    member: string;
-    path: string;
-    kind: 'binary' | 'module' | 'data';
-}
-export interface NodeImage {
-    cwd: string;
-    condition: string;
-    runtime: string;
-    preload?: string;
-    nativePreloadMembers: readonly string[];
-    commandPort?: CommandPort;
-    hostLoader?: {
-        declaration: Declaration;
-        entries: readonly string[];
-        preload: string;
-    };
-    locations: readonly Location[];
-}
-/** Observation of a completed inner command. A nonzero exit is data, never
- * silently converted into effect success; its meaning belongs to the reader. */
-export interface CapturedCommand {
-    exitStatus: number;
-    stdout: string;
-    stderr: string;
-}
-export interface PreparedNodeImage {
-    readonly identity: string;
-}
-/** Image/runtime condition and locations are instrument-admitted inputs, selected
- * before requests. Condition includes trusted Node builtins/platform libraries;
- * a binary's file digest alone does not seal every dynamic platform library. */
-export declare function prepareNodeImage(input: Handoff, inputImage: NodeImage): PreparedNodeImage;
-/** Exact expectations from the same opaque host image used by execution. */
-export declare function plannedJobs(handle: PreparedNodeImage, request: Uint8Array): readonly {
-    id: string;
-    identity: string;
-}[];
-/** Instrument-only producer lineage from the SAME private planned job used by
- * executeJobs. No fixture may invent an identity or reset shared custody. */
-export interface ParentExecution {
-    identity: string;
-    port: string;
-    binding: string;
-    implementation: string;
-    instrument: string;
-    policy: string;
-    authority: string;
-    inputs: readonly (readonly [string, string])[];
-    environment: readonly (readonly [string, string])[];
-    argv: readonly string[];
-    cwd: string;
-    runtime: string;
-    timeoutMs: number;
-    responseBytes: number;
-}
-export declare function plannedParentExecutions(handle: PreparedNodeImage, request: Uint8Array): readonly ParentExecution[];
-/** Root-owned execution resource, constructed from authenticated producer selection
- * under the authority guard. This is not a packet verifier or world callback. */
-export interface RootJobCustody {
-    open(parent: ParentExecution): Promise<{
-        assertClosed(): void;
-        close(): Promise<void>;
-        descendant?: unknown;
-    }>;
-}
-/** No partial member escapes a failed batch. Uses the existing bounded async
- * child-group executor; worker launcher is itself an exact selected module. */
-export declare function executeJobs(handle: PreparedNodeImage, request: Uint8Array, options: {
-    phase: 'act' | 'selection' | 'help' | 'check' | 'preview' | 'sign';
-    signal?: AbortSignal;
-    trace?: (event: {
-        id: string;
-        phase: 'start' | 'end';
-    }) => void;
-    custody?: RootJobCustody;
-}): Promise<readonly {
-    id: string;
-    identity: string;
-    responses: readonly CapturedCommand[];
-}[]>;