@lapxo/bound 0.2.2 → 0.2.3

package/dist/host/native/module-syntax.js

@@ -7,7 +7,7 @@ const require = nodeModule.createRequire(import.meta.url);
 const { parse } = require('acorn');
 const stripTypeScriptTypes = nodeModule.stripTypeScriptTypes;
 /** Syntax inventory is not an execution-closure certificate: unresolved expressions stay explicit. */
-export function moduleImportSyntax(source, coordinate) {
+export function moduleImportSyntax(source, coordinate, options) {
     const code = extname(coordinate) === '.ts' ? stripTypeScriptTypes(source, { mode: 'transform' }) : source;
     let tree;
     try {
@@ -48,6 +48,8 @@ export function moduleImportSyntax(source, coordinate) {
         if (n['type'] === 'CallExpression') {
             const callee = n['callee'];
             if (callee?.['type'] === 'Identifier' && callee['name'] === 'require') {
+                if (options?.esmOnly)
+                    throw Error('REFUSE·module closure CommonJS load in ESM delivery ' + coordinate);
                 specifier = literal(n['arguments'][0]);
                 if (specifier === undefined)
                     unresolved.add('require expression at ' + String(n['start']));

package/dist/host/order.js

@@ -0,0 +1,2 @@
+/** Locale-independent UTF-16 code-unit ordering, shared by host delivery formats. */
+export const compareStrings = (a, b) => a < b ? -1 : a > b ? 1 : 0;

package/docs/contracts/closure-delivery.md

@@ -0,0 +1,23 @@
+# Verified executable closure delivery
+
+Needs are arbitrary declared names, not a kernel profile enumeration.
+
+All requested entries share the existing moduleClosure traversal; no second walker, parser or algebra.
+
+Host requires already authenticated snapshot identities; a bundle digest establishes content identity, not authority or correctness.
+
+Delivery preserves each reached JS/JSON member and explicitly pinned notices byte for byte. Separate digests identify the closure manifest and the exact UTF-8 JSON container.
+
+Canonical delivery sorts needs, reached modules, library bindings and notices; duplicate needs do not duplicate code; unsupported executable forms refuse by name.
+
+Mandatory member, source byte and response byte budgets apply before delivery. Pre-aborted or observed cancellation refuses. Synchronous work is not a preemptible execution sandbox.
+
+Portable ESM delivery refuses host builtins, runtime loader access, CommonJS loads, calculated/escaped loader expressions and unsupported URL spellings before entry execution.
+
+Consumer verifies the expected container digest and repeats the same closure preflight over exactly the delivered members. Derived import maps are never trusted as authority.
+
+The host must verify actual mounted bytes again before execution; the test host demonstrates this but is not a public browser host.
+
+Existing native, program and worker custody remain unchanged. Acorn routes stay explicitly retained under A-F gate.
+
+No external fetch or general demand resolver is introduced. Missing bytes remain outside completed delivery and must be resolved by the existing host contract.

package/docs/contracts/closure-delivery.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/closure-delivery",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/closure-delivery.md",
+      "digest": "sha256:bdadeefcf8042749e642a453adc7d07944ceab3fbd62de46209ea3ed25d05c2e"
+    },
+    {
+      "role": "yes",
+      "path": "samples/module-delivery/inputs/delivery.json",
+      "digest": "sha256:a6df1d11537a0792c9772b1874c7e127e0fda22203f756d6f0eb104d072a9df1"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/module-delivery.vector.json",
+      "digest": "sha256:3de9f160f89764e1153a2719ab04447142fe187bf476b3060d860e81e9c37c02"
+    },
+    {
+      "role": "no",
+      "path": "samples/no/module-delivery/delivery.json",
+      "digest": "sha256:f95b1c3129896baaecb4ae7860afc11dcaaef0a2e47221b73044bc5a4681181f"
+    }
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lapxo/bound",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "type": "module",
   "description": "Read the bounds you already wrote, fold them, and name the contradictions.",
   "main": "dist/cli/verb.js",
@@ -28,6 +28,10 @@
     "./reference/native": {
       "types": "./dist/host/reference-native-api.d.ts",
       "default": "./dist/host/reference-native-api.js"
+    },
+    "./closure/native": {
+      "types": "./dist/host/native/module-delivery.d.ts",
+      "default": "./dist/host/native/module-delivery.js"
     }
   },
   "scripts": {
@@ -163,7 +167,14 @@
     "samples/readme/yes.json",
     "samples/readme/no.json",
     "vectors/native/readme.vector.json",
-    "samples/engine-place/inputs/closure.json"
+    "samples/engine-place/inputs/closure.json",
+    "dist/host/native/module-delivery.d.ts",
+    "dist/host/native/module-closure.d.ts",
+    "docs/contracts/closure-delivery.md",
+    "docs/contracts/closure-delivery.publication.json",
+    "samples/module-delivery/inputs/delivery.json",
+    "samples/no/module-delivery/delivery.json",
+    "vectors/native/module-delivery.vector.json"
   ],
   "author": "Lapxo",
   "license": "MIT",