@lapxo/bound 0.1.9 → 0.2.1

package/dist/host/native/node-launch.d.ts

@@ -1,72 +0,0 @@
-/** Parse the actual Node launch without rewriting argv or evaluating text.
- * Selection/authority and generated-member sealing belong to the Root host.
- * This is a deliberately finite native profile, not a JS sandbox. */
-export type NodeLaunch = {
-    kind: 'eval';
-    mode: 'commonjs' | 'module';
-    text: string;
-    args: readonly string[];
-    imports: readonly string[];
-} | {
-    kind: 'file';
-    entry: string;
-    args: readonly string[];
-    imports: readonly string[];
-    test: boolean;
-};
-export declare function nodeLaunch(args: readonly string[]): NodeLaunch;
-import type { NativeProgramProjection } from './native-program.ts';
-export interface SelectedInterpreter {
-    readonly path: string;
-    readonly digest: string;
-}
-export interface NativeProgramLaunch {
-    readonly interpreter: string;
-    readonly interpreterDigest: string;
-    readonly entry: string;
-    readonly args: readonly string[];
-}
-/** Only an exact, unique declared alias selects a native program. No PATH,
- * filename heuristics, option rewriting or consumer-specific names occur here. */
-export declare function projectNativeProgramLaunch(programs: readonly NativeProgramProjection[], program: string, args: readonly string[], runtime: SelectedInterpreter): NativeProgramLaunch;
-export interface NativeProgramParent {
-    readonly parent: string;
-    readonly root: string;
-    readonly members: readonly {
-        readonly path: string;
-        readonly digest: string;
-    }[];
-}
-/** Select a package-resolution context only for the exact reached parent member.
- * Root must validate the supplied parent digest against actual bytes first.
- * Node still performs actual resolution; Root checks the returned target digest
- * before handing it back. Merely sharing a path prefix grants no membership. */
-export declare function selectNativeProgramParent(programs: readonly NativeProgramProjection[], parent: {
-    readonly path: string;
-    readonly digest: string;
-}): NativeProgramParent;
-/** The fixed host receives this record only from the actual Root custodian's
- * retained before-fork evidence. This projection grants no new executable. */
-export interface NativeEvalActual {
-    readonly argv: readonly string[];
-    readonly rootPrefix: readonly string[];
-    readonly cwd: string;
-    readonly environment: readonly (readonly [string, string])[];
-    readonly runtime: string;
-}
-export interface NativeEvalParent {
-    readonly url: string;
-    readonly context: string;
-    readonly digest: string;
-    readonly mode: 'module' | 'commonjs';
-}
-import type { DerivedExecutable } from './generated.ts';
-export declare function retainedNativeEvalMatches(record: DerivedExecutable, actual: NativeEvalActual): boolean;
-/** Exact Node CLI eval origin, not a file-pattern exception. A different URL
- * continues through ordinary physical-parent verification and refuses if absent.
- * Node's module and CommonJS CLI forms have distinct observed synthetic names. */
-export declare function nativeEvalParent(record: DerivedExecutable, actual: NativeEvalActual): NativeEvalParent;
-/** Non-authoritative discovery from Node's actual runtime options only. A false
- * result confers no permission: physical-parent/load checks remain unchanged.
- * Before-fork argv validation and exact retained-record matching are separate. */
-export declare function actualNodeEvalOptions(execArgv: readonly string[]): boolean;

package/dist/host/native/preload.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/host/native/reading.d.ts

@@ -1,91 +0,0 @@
-import type { Signer } from '@lapxo/topos/wire';
-import type { Request, Response } from '@lapxo/topos/contract';
-import type { Asked } from '@lapxo/topos/capsule';
-import type { CommandPort } from '@lapxo/topos/contract';
-import { type NodeImage, type RootJobCustody } from './node-jobs.ts';
-import type { Handoff, Proposal } from './jobs.ts';
-export declare const canonicalJson: (value: unknown) => string;
-export interface RootStanding {
-    readonly history: readonly string[];
-    readonly live: readonly string[];
-    readonly signer: Signer;
-    readonly eras: readonly string[];
-    readonly epoch: number;
-    readonly budget: {
-        readonly lines: number;
-        readonly bytes: number;
-    };
-}
-export interface PortProfile {
-    readonly profile: 'host-native-reading@1';
-    readonly port: CommandPort;
-    readonly selection: {
-        readonly archive: string;
-        readonly entry: string;
-        readonly reader: string;
-        readonly loaderConfig: string;
-        readonly runtime: string;
-        readonly preload: string | null;
-        readonly nativePreloadMembers: readonly string[];
-        readonly condition: string;
-        readonly budget: Handoff['budget'];
-        readonly members: readonly {
-            coordinate: string;
-            digest: string;
-        }[];
-        readonly bindings: Handoff['bindings'];
-        readonly loads: Handoff['loads'];
-    };
-}
-export interface NativeReadingModule {
-    readonly commands?: (asked: Asked) => readonly Proposal[];
-    readonly receipt?: (asked: Asked) => readonly unknown[];
-    readonly render?: (asked: Asked) => readonly string[];
-}
-export interface NativeReadingHandle {
-    readonly identity: string;
-}
-export declare function authenticateSignedPort(root: RootStanding, coordinate: string): {
-    line: string;
-    profile: unknown;
-};
-export interface AuthenticatedNativeSelection {
-    readonly identity: string;
-}
-/** One synchronous authentication supplies both the opaque boundary and its
- * immutable signed profile. Fresh Root checks still run at load and answer. */
-export declare function authenticateNativeProfile(root: RootStanding, coordinate: string): {
-    readonly selection: AuthenticatedNativeSelection;
-    readonly line: string;
-    readonly profile: PortProfile;
-};
-export declare function validateSignedNativeProfile(root: RootStanding, coordinate: string, expected: PortProfile): AuthenticatedNativeSelection;
-/** Root must hold its real authority protection across the callback. A guard
- * method is instrument code, never supplied by a command or its JSON profile. */
-export interface RootAuthorityGuard {
-    withCurrent<T>(body: (root: RootStanding) => Promise<T>): Promise<T>;
-}
-/** Fixed instrument loader, never a callback supplied by module/request/profile.
- * Root's REAL await-safe lease must cover verification, load and completion.
- * The handoff image is verified before the fixed loader receives an entry. */
-export declare function loadSignedNativeReading(selection: AuthenticatedNativeSelection, resolved: {
-    profile: PortProfile;
-    handoff: Handoff;
-    image: NodeImage;
-    archive: Uint8Array;
-    custody?: RootJobCustody;
-}, guard: RootAuthorityGuard): Promise<NativeReadingHandle>;
-export declare function answerNativeReading(handle: NativeReadingHandle, requests: readonly Request[], self: string, options: {
-    phase: 'act' | 'selection' | 'help' | 'check' | 'preview' | 'sign';
-    signal?: AbortSignal;
-    guard: RootAuthorityGuard;
-}): Promise<readonly Response[]>;
-/** Executable resources belong to the currently authenticated parent command
- * declaration, not to the separate authority-history/clock parsing budget. */
-export declare function nativeParentInputBytes(root: RootStanding, parent: {
-    port: string;
-}): number;
-/** Exact schema field names, shared by the host's selected native formats. */
-export declare function fieldNames(value: object): string;
-/** Retain each verifier's private map and return a fresh canonical projection. */
-export declare function retainedProjection<H extends object, T>(verified: WeakMap<H, T>, fail: (why: string) => never): (handle: H) => T;

package/dist/host/native/receipt-environment.d.ts

@@ -1,3 +0,0 @@
-import type { ReadingIdentityContext } from '@lapxo/topos/contract';
-import { type ReadingReference } from '../reading-context.ts';
-export declare function currentReadingEnvironment(store: string, root: string, hash: (text: string) => string, flags: readonly string[]): (context: ReadingIdentityContext) => readonly ReadingReference[] | undefined;

package/dist/host/native/references.d.ts

@@ -1,5 +0,0 @@
-import type { ReadingReference } from '../reading-context.ts';
-/** Existing leaf folds wrap parent names in the context namespace. Resolve that
- * namespace without dropping any inherited identity, and never pick a duplicate.
- */
-export declare function nativeReferenceInputs(inputs: readonly ReadingReference[], required: readonly ReadingReference[]): void;

package/dist/host/native/root.d.ts

@@ -1,17 +0,0 @@
-import { type RootAuthorityProtection } from '../../land/act.ts';
-import type { RootStanding, RootAuthorityGuard } from './reading.ts';
-import type { RootContext } from '@lapxo/topos/core';
-/** Values come from the fixed parent argv chain while it retains actual Root
- * protection. No world packet supplies the store, parent, cursor or verifier.
- */
-export interface NativeRootInheritance {
-    readonly store: string;
-    readonly parent: number;
-    readonly expected: RootContext;
-}
-export declare function currentNativeRoot(store: string, parent: number, proof: RootAuthorityProtection): {
-    readonly context: RootContext;
-    readonly root: RootStanding;
-};
-export declare function inheritedNativeRoot(inherited: NativeRootInheritance, proof: RootAuthorityProtection): RootStanding;
-export declare function inheritedNativeGuard(inherited: NativeRootInheritance, proof: RootAuthorityProtection): RootAuthorityGuard;

package/dist/host/native/route.d.ts

@@ -1,66 +0,0 @@
-import { type NativeBinaryOrigin } from './native-binary.ts';
-import { type HostControlSelection } from './control-selection.ts';
-export { materializeNativeRoute } from './materialize.ts';
-import { type PortProfile, type RootStanding } from './reading.ts';
-import type { ReadingExecution, ReadingReference } from '../reading-context.ts';
-import type { Request, Response } from '@lapxo/topos/contract';
-import type { ReaderLifetime } from '@lapxo/topos/wire';
-export interface NativeBinaryBinding {
-    readonly line: string;
-    readonly coordinate: string;
-    readonly profile: import('./native-binary.ts').NativeBinaryProfile;
-    readonly origin?: NativeBinaryOrigin;
-}
-export interface NativeRoute {
-    readonly identity: string;
-    readonly profile: PortProfile;
-    readonly binaries: readonly NativeBinaryBinding[];
-    readonly control?: HostControlSelection;
-    readonly inputs: readonly ReadingReference[];
-}
-/** Shared origins are one exact input; individual signed selectors remain separate. */
-export declare function nativeBinaryOriginInputs(binaries: readonly NativeBinaryBinding[]): readonly ReadingReference[];
-/** Inputs are semantic logical references. Fixed instrument/host graph and
- * runtime-supervisor chain must also be supplied by the calling identity builder.
- * Locations and lock-token/PID are operational custody, never these inputs.
- */
-export declare function prepareNativeRoute(store: string, coordinate: string, readerMapping?: string): NativeRoute;
-/** Recheck authority before both a current retained answer and fresh execution.
- * Historical public --check uses the existing receipt-inspection path, not this
- * command authorization route.
- */
-export declare function assertNativeRouteCurrent(route: NativeRoute): void;
-export declare function invokeNativeRoute(route: NativeRoute, input: {
-    archive: string;
-    locations: readonly {
-        member: string;
-        path: string;
-        kind: 'module' | 'data' | 'binary';
-    }[];
-    requests: readonly Request[];
-    execution: ReadingExecution;
-    limits: ReaderLifetime;
-}): readonly Response[];
-/** This predicate only schedules an outer lease. It grants no command. */
-export declare function declaredNativeReaderPorts(lines: readonly string[]): boolean;
-export declare function prepareNativeReaderRoute(store: string, reader: {
-    id: string;
-    module: string;
-}): NativeRoute | undefined;
-export declare function nativeRouteStore(route: NativeRoute): string;
-/** Quiet-pass gate: authenticate grants/cursor only, no image/materialization or
- * program execution. Historical --check remains its separate receipt path. */
-export declare function assertNativeReaderGrantsCurrent(store: string): void;
-/** Executable kinds come only from current authenticated Root declarations. A
- * matching JSON hint identifies a candidate, but is never permission to execute. */
-export declare function authenticatedNativeBinaries(root: RootStanding, profile: PortProfile): readonly NativeBinaryBinding[];
-/** Same semantic image identity for preparation, retained mount and quiet checks. */
-export declare function nativeMountIdentity(profile: PortProfile, binaries: readonly NativeBinaryBinding[], control?: HostControlSelection): string;
-export interface CurrentNativeReaderSelection {
-    readonly profile: PortProfile;
-    readonly binaries: readonly NativeBinaryBinding[];
-    readonly control?: HostControlSelection;
-}
-/** Current eligibility only: no executor graph, image load or materialization. */
-export declare function currentNativeReaderSelections(store: string): readonly CurrentNativeReaderSelection[];
-export declare function currentNativeReaderProfiles(store: string): readonly PortProfile[];

package/dist/host/native/runtime.d.ts

@@ -1,4 +0,0 @@
-/** Environment identity is not permission to bootstrap arbitrary executable
- * preloads. The fixed native entry currently has no ambient loader contract.
- */
-export declare function assertNativeRuntime(environment: Readonly<Record<string, string | undefined>>, flags: readonly string[]): void;

package/dist/host/native-reader-context.d.ts

@@ -1,3 +0,0 @@
-import type { NativeRoute } from './native/route.ts';
-export declare const nativeReaderRoute: () => NativeRoute | undefined;
-export declare function withNativeReaderRoute<T>(route: NativeRoute | undefined, run: () => T): T;

package/dist/host/objects.d.ts

@@ -1,5 +0,0 @@
-/** Bound supplies host authority and I/O; topos owns grammar, selection and context validation. */
-export declare function admittedObjects(root: string, lines: readonly string[], emit?: (text: string) => void): Promise<{
-    records: readonly import("@lapxo/topos/wire").ObjectRecord[];
-    context: import("@lapxo/topos/wire").ObjectContext;
-}>;

package/dist/host/place-clock-selection.d.ts

@@ -1,55 +0,0 @@
-import { PLACE_ACT_CONTEXT, type ClockBudget, type TrustedClockContract } from '@lapxo/topos/core';
-import { type Signer } from '@lapxo/topos/wire';
-import { type PlaceActTrust, type PlaceActBudget, type PlaceActHead } from './ports/place-act.ts';
-export interface HostClockSelection {
-    readonly profile: typeof PLACE_ACT_CONTEXT;
-    readonly namespace: string;
-    readonly regionFamily: string;
-    readonly receiptSigner: string;
-    readonly receiptScope: string;
-    readonly digestAlgorithm: 'sha256';
-    readonly budget: ClockBudget;
-    readonly storageBudget: PlaceActBudget;
-    readonly initial: readonly {
-        place: string;
-        receiver: {
-            identity: string;
-            epoch: string;
-        };
-        origin: {
-            prefix: string;
-            epoch: string;
-        };
-    }[];
-}
-export interface HostClockInput {
-    readonly store: string;
-    readonly selector: string;
-    readonly profileSelector: string;
-    readonly history: readonly string[];
-    readonly anchor: Signer;
-    readonly algorithms: readonly string[];
-    readonly legacyOriginals: readonly string[];
-    /** Actual protected Root authority cursor: an authenticated signed Root config
-     * checkpoint, never a sibling receipt/evidence max epoch. */
-    readonly authorityCheckpoint: string;
-    /** Fixed host historical predecessor proof, never taken from a packet. */
-    readonly authenticatedReceiverHeads?: readonly PlaceActHead[];
-    readonly readCurrent: () => Pick<HostClockInput, 'history' | 'anchor' | 'algorithms' | 'legacyOriginals' | 'authorityCheckpoint'>;
-    readonly resources: {
-        bytes: number;
-        lines: number;
-        places: number;
-    };
-    readonly inherited: {
-        clock: ClockBudget;
-        storage: PlaceActBudget;
-    };
-    readonly historical: (encoded: string) => TrustedClockContract;
-}
-/** Root chooses selector and anchors/resources from its authenticated standing.
- * Selection must be ROOT signed; a world's signature grants no host capability. */
-export declare function hostClockSelection(input: HostClockInput): {
-    selection: HostClockSelection;
-    trust: PlaceActTrust;
-};

package/dist/host/ports/ingress.d.ts

@@ -1,24 +0,0 @@
-/** Prepared by the admitted Topos contract and receiver signer. The host does not infer origins, coverage or epochs. */
-export interface IngressBundle {
-    readonly evidence: string;
-    readonly receipt: string;
-}
-export interface IngressResult extends IngressBundle {
-    readonly kind: 'landed' | 'once';
-    readonly evidenceBytes: number;
-    readonly receiptBytes: number;
-}
-export interface IngressStorage {
-    publish(staged: string, committed: string): void;
-}
-/** Directory publication makes the pair visible together; there is no later ledger append that can expose half. */
-export declare const nativeIngressStorage: IngressStorage;
-/** Native signed receipt lines only. Foreign bytes are never added to the local ledger or epoch allocator. */
-export declare function ingressReceipts(store: string): readonly string[];
-/** Private staging directories are invisible to readers and may be discarded after host recovery. */
-export declare function ingressEvidence(store: string, identity: string): IngressBundle | undefined;
-export declare function ingressBundles(store: string): readonly IngressBundle[];
-/** Verification and signing complete before staging. Replay performs no signer invocation or persistent write. */
-export declare function commitIngress(store: string, identity: string, prepare: (localImportReceipts: readonly string[]) => Promise<IngressBundle>, verify: (bundle: IngressBundle) => boolean, storage?: IngressStorage): Promise<IngressResult>;
-/** Costs distinguish delivered bytes from newly committed bytes; no count is called information or freedom. */
-export declare function ingressCost(result: IngressResult, deliveredBytes: number, protocolBytes: number): string;

package/dist/host/ports/local-act.d.ts

@@ -1,44 +0,0 @@
-import type { PublicationStorage } from './publication.ts';
-/** Prepared and verified by the selected Topos admission/result contract. */
-export interface LocalActBundle {
-    readonly records: string;
-    readonly receipt: string;
-    readonly placements?: readonly {
-        place: string;
-        records: string;
-    }[];
-}
-export type LocalActVerification = (identity: string, bundle: LocalActBundle) => boolean;
-export declare const actLines: (bytes: string) => readonly string[];
-/** Journal integrity is not authority. Signature/coverage checks remain the
- * same admission boundary; the hash algorithm here is the stored seal's named
- * algorithm, not a new selection of the place's wire.
- */
-export declare function intactLocalAct(identity: string, bundle: LocalActBundle): boolean;
-/** Internal integrity key only, not an act identity or a wire profile. */
-export declare function committedInventoryFingerprint(rows: readonly {
-    identity: string;
-    bundle: LocalActBundle;
-}[]): string;
-/** Committed segments are part of this ledger, not a second authority source. */
-export declare function committedLocalActs(store: string): readonly {
-    identity: string;
-    bundle: LocalActBundle;
-}[];
-/** Fixed host observation only: one synchronous, coherent committed inventory.
- * It supplies no authority, verifier or async lifetime. Each outer invocation
- * rereads exact bodies before entering; current authorization still runs inside.
- */
-export declare function withCommittedLocalActObservation<T>(store: string, body: () => T): T;
-/** A public result is available only as a verified committed pair.
- * No writer-tail guess, newest-result selection or implicit authority.
- */
-export declare function localActResult(store: string, identity: string, verify: LocalActVerification): LocalActBundle | undefined;
-/** One publication point for records and their native result. Re-delivery
- * reads the original pair without preparation, signing or a new local epoch.
- * The caller must also integrate this boundary into admission-history readers;
- * this storage port alone does not activate a grammar or land authority.
- */
-export declare function commitLocalAct(store: string, identity: string, regions: readonly string[], prepare: () => Promise<LocalActBundle>, verify: LocalActVerification, storage?: PublicationStorage): Promise<LocalActBundle & {
-    readonly kind: 'landed' | 'once';
-}>;

package/dist/host/ports/place-act.d.ts

@@ -1,46 +0,0 @@
-import { type TrustedClockContract, type PlaceReceipt, type RootContext } from '@lapxo/topos/core';
-import { type PublicationStorage } from './publication.ts';
-export interface PlaceActBudget {
-    readonly acts: number;
-    readonly bytes: number;
-}
-export interface PlaceActHead {
-    readonly place: string;
-    readonly identity: string;
-    readonly epoch: string;
-}
-export interface PlaceActSnapshot {
-    readonly root: RootContext;
-    readonly heads: readonly PlaceActHead[];
-}
-/** Fixed instrument construction, never supplied by world JSON. Historical
- * authentication permits inspection only; current() is read under Root guards. */
-export interface PlaceActTrust {
-    readonly contract: TrustedClockContract;
-    readonly initialHeads: readonly PlaceActHead[];
-    readonly current: () => PlaceActSnapshot;
-    readonly historical: (encoded: string) => TrustedClockContract;
-}
-export interface PlaceActBundle {
-    readonly context: string;
-    readonly receipts: readonly PlaceReceipt[];
-    readonly originals: readonly (readonly string[])[];
-}
-/** Historical result reads never produce a current authorization permit. */
-export declare function placeActResult(store: string, id: string, trust: Pick<PlaceActTrust, 'historical'>, limits: PlaceActBudget): PlaceActBundle | undefined;
-/** Each receiver chain advances independently. Initial heads are explicit,
- * authenticated host inputs, not inferred zero or legacy global epochs. */
-export declare function placeActHeads(store: string, initial: readonly PlaceActHead[], trust: Pick<PlaceActTrust, 'historical' | 'contract'>, limits: PlaceActBudget): readonly PlaceActHead[];
-/** Context, exact original bytes and complete signed receipts have one visibility
- * point. Real Root guard exclusion spans final authority/head comparison and
- * publication; this does not activate a CLI profile or reinterpret local-act@1. */
-export declare function commitPlaceAct(store: string, encoded: string, receipts: readonly PlaceReceipt[], trust: PlaceActTrust, limits: PlaceActBudget, storage?: PublicationStorage): Promise<PlaceActBundle & {
-    readonly kind: 'landed' | 'once';
-    readonly identity: string;
-}>;
-/** Enumerates only committed, historically authenticated carriers. Namespace
- * projection is a caller's separate pure operation, never current permission. */
-export declare function committedPlaceActResults(store: string, trust: Pick<PlaceActTrust, 'historical'>, limits: PlaceActBudget): readonly {
-    identity: string;
-    bundle: PlaceActBundle;
-}[];

package/dist/host/ports/publication.d.ts

@@ -1,10 +0,0 @@
-export interface PublicationStorage {
-    publish(staged: string, committed: string): void;
-}
-export declare const nativePublicationStorage: PublicationStorage;
-/** Publish prepared bytes as one directory. No identity, grammar or authority
- * is inferred here. Readers address the committed name, never staging files.
- * A failure after rename is not evidence of rollback: the caller must retain
- * the uncertainty and allow a verified read of the committed name.
- */
-export declare function publishBundle(committed: string, files: Readonly<Record<string, string>>, storage?: PublicationStorage): void;

package/dist/host/ports/signing.d.ts

@@ -1,31 +0,0 @@
-/** Contains only host-controlled diagnostics, never child output. */
-export declare class SigningFailure extends Error {
-}
-export interface SigningLot {
-    readonly bytes: readonly string[];
-    readonly keyId: string;
-    readonly algorithm: string;
-}
-export interface SignatureRecord {
-    readonly keyId: string;
-    readonly signature: string;
-}
-export interface SigningProtocol {
-    readonly request: (lot: SigningLot) => string;
-    readonly response: (records: readonly SignatureRecord[]) => string;
-    readonly reply: (text: string, lot: SigningLot) => readonly SignatureRecord[];
-}
-export type SigningMechanism = {
-    readonly kind: 'file';
-    readonly path: string;
-} | {
-    readonly kind: 'command';
-    readonly executable: string;
-    readonly args: readonly string[];
-};
-export interface SigningLimits {
-    readonly timeoutMs: number;
-    readonly responseBytes: number;
-}
-/** Host-approved mechanism only. Repository declarations do not authorize execution. */
-export declare function invokeSigner(lot: SigningLot, mechanism: SigningMechanism, protocol: SigningProtocol, limits: SigningLimits): Promise<readonly SignatureRecord[]>;

package/dist/host/ports/store.d.ts

@@ -1,2 +0,0 @@
-export declare function storeRoot(from: string): string;
-export declare const storeDirs: (store: string) => number;

package/dist/host/ports/transport.d.ts

@@ -1 +0,0 @@
-export declare function transportBytes(location: string, digest: string, lines: readonly string[]): Promise<Uint8Array>;

package/dist/host/process-lifetime.d.ts

@@ -1,11 +0,0 @@
-import type { ReaderLifetime } from '@lapxo/topos/wire';
-export interface ProcessResult {
-    readonly stdout: string;
-    readonly stdoutBytes?: string;
-    readonly stderr: string;
-    readonly status: number | null;
-    readonly signal: NodeJS.Signals | null;
-    readonly failure?: string;
-}
-/** A synchronous fold waits on a supervising host process; the supervisor owns cancellation of its child group. */
-export declare function boundedProcess(command: string, args: readonly string[], input: string, limits: ReaderLifetime, cwd?: string, env?: Readonly<Record<string, string>>): ProcessResult;

package/dist/host/provide.d.ts

@@ -1,48 +0,0 @@
-interface ResolveContext {
-    parentURL?: string;
-}
-interface ResolveResult {
-    url: string;
-}
-type NextResolve = (specifier: string, context: ResolveContext) => ResolveResult;
-/**
- * Resolve declared library bytes for this host. A library's shape may select an
- * archive coordinate; world selection remains the standing contract.
- */
-export declare function pinPlace(name: string): string;
-export declare function pinExport(name: string, sub: string): string;
-export declare function pinName(name: string): string;
-/** Node package resolution at a digest-laid library; exports remain authoritative. */
-export declare function resolvePinned(specifier: string, context: ResolveContext, nextResolve: NextResolve, pin: {
-    readonly at: string;
-    readonly pkg: string;
-    readonly json: string;
-    readonly exports: boolean;
-}): ResolveResult;
-/** Fixed execution selects libraries by the instrument's explicit local mount,
- * before opening any artifact. An alias or package-name guess grants nothing. */
-export declare function selectNativeDependencies(root: string, dependencies: readonly string[], manifest: string): readonly {
-    line: string;
-    library: {
-        readonly name: string;
-        readonly manifest: string;
-        readonly coordinate?: string;
-    };
-}[] | undefined;
-/** A declared artifact is not automatically an active Node library. This fixed
- * assertion reuses only the packages selected by the actual host boundary. */
-export declare function reuseNativeResolution(pins: readonly {
-    pkg: string;
-    at: string;
-}[]): boolean;
-/** Read one resolved archive's manifest; a selected fixed library cannot vanish
- * into the optional historical provider path when its archive is absent. */
-export declare function readProvidedPin(name: string, at: string, file: string, requiredName?: string): {
-    at: string;
-    pkg: string;
-    exports: boolean;
-    href: string;
-    json: string;
-} | undefined;
-export declare function provide(): void;
-export {};

package/dist/host/read-only.d.ts

@@ -1,3 +0,0 @@
-export declare const readOnly: () => boolean;
-export declare const withoutEffects: <T>(evaluate: () => T) => T;
-export declare function requireEffects(operation: string): void;

package/dist/host/reading-closures.d.ts

@@ -1,45 +0,0 @@
-import type { ReaderLifetime, ReaderReference } from '@lapxo/topos/wire';
-import type { Capsule } from './capsule.ts';
-import { snapshotAccess } from '@lapxo/topos/contract';
-import type { ReadingIdentityContext, Snapshot, ResponseContext } from '@lapxo/topos/contract';
-import type { ReadingExecution, ReadingReference } from './reading-context.ts';
-export interface CurrentReading {
-    readonly snapshot: Snapshot;
-    readonly kept: ResponseContext;
-    readonly current: ResponseContext;
-    readonly permission: Parameters<typeof snapshotAccess>[3];
-}
-type File = {
-    readonly place: string;
-    readonly text: string;
-};
-export declare const inputLines: (files: readonly File[]) => readonly string[];
-/** The selected world owns input projection and reading. The host only verifies closures and keeps native count/bytes receipts. */
-export declare function readingClosures(options: {
-    root: string;
-    store: string;
-    reader: string;
-    speaker: string;
-    digest: (text: string) => string;
-    capsule: Capsule;
-    region: string;
-    projection: string;
-    readerReference?: ReaderReference;
-    lifetime?: ReaderLifetime;
-    allowsEmpty?: boolean;
-    context?: ReadingIdentityContext;
-    execution?: ReadingExecution;
-    current?: CurrentReading;
-    files: readonly File[];
-    livePlace?: () => readonly string[];
-    assertCurrent?: () => void;
-    emit?: (line: string) => void;
-}): {
-    lines: readonly string[];
-    read: number;
-    opened: number;
-    executed: number;
-};
-/** Verify the native reading carriers before a file seal may reuse them. These are semantic receipts, not file-region seals. */
-export declare function verifiedReadingReceipts(store: string, lines: readonly string[], digest: (text: string) => string, environment?: readonly ReadingReference[] | ((context: ReadingIdentityContext) => readonly ReadingReference[] | undefined), requireContext?: boolean): number | undefined;
-export {};

package/dist/host/reading-context.d.ts

@@ -1,29 +0,0 @@
-import type { ReadingIdentityContext } from '@lapxo/topos/contract';
-export type ReadingReference = readonly [string, string];
-export interface ReadingExecution {
-    readonly context: ReadingIdentityContext;
-    readonly env: Readonly<Record<string, string>>;
-    readonly cwd: string;
-    readonly flags: readonly string[];
-}
-interface Boundary {
-    readonly identity: string;
-    readonly execution?: ReadingExecution;
-}
-export declare const readingBoundary: () => Boundary | undefined;
-export declare function withReadingBoundary<T>(identity: string, execution: ReadingExecution | undefined, run: () => T): T;
-export declare function readingEnvironment(hash: (text: string) => string, env?: Readonly<Record<string, string | undefined>>, cwd?: string, flags?: readonly string[]): readonly ReadingReference[];
-export declare function readingProfile(lines: readonly string[], field: (line: string, name: string) => string): boolean;
-/** The caller supplies verified implementation and transitive references. This
- * constructor adds the process boundary that the host will actually hand over. */
-export declare function readingExecution(input: {
-    instrument: string;
-    implementation: string;
-    policy: string;
-    inputs: readonly ReadingReference[];
-}, hash: (text: string) => string, boundary?: {
-    env: Readonly<Record<string, string | undefined>>;
-    cwd: string;
-    flags: readonly string[];
-}): ReadingExecution;
-export {};