@lapxo/bound 0.2.2 → 0.2.4

package/dist/host/in-process-root.d.ts

@@ -0,0 +1,117 @@
+import { type ReadingIdentityContext } from '@lapxo/topos/contract';
+import { type ContentReadPort, type SigningPort, type PortLimits } from '../engine/ports.ts';
+import { type HostInstrumentRuntime } from './call-context.ts';
+import type { LocalActBundle } from './ports/local-act.ts';
+import type { PublicationStorage } from './ports/publication.ts';
+export interface RootLotContext {
+    readonly place: string;
+    readonly snapshot: string;
+    readonly source: string;
+    readonly digest: string;
+    readonly reading: ReadingIdentityContext;
+    readonly limits: PortLimits & {
+        readonly records: number;
+    };
+    readonly signal?: AbortSignal;
+}
+/** The receiver selects the actual native place, instrument and signer. The lot
+ * supplies only canonical unsigned Root configuration, never host capabilities. */
+export interface RootLotPorts {
+    readonly root: string;
+    readonly instrumentName: string;
+    readonly runtime: HostInstrumentRuntime;
+    readonly read: ContentReadPort;
+    readonly signer: {
+        readonly keyId: string;
+        readonly name: string;
+        readonly sign: SigningPort;
+    };
+    readonly storage?: PublicationStorage;
+    readonly prepared?: (identity: string) => void;
+    readonly limits: RootLotContext['limits'] & {
+        readonly diagnostics: number;
+    };
+}
+/** Snapshot identity, not a new wire, authority algorithm or current permit. */
+export declare const rootLotSnapshot: (root: string) => string;
+export declare function landRootLotInProcess(context: RootLotContext, ports: RootLotPorts): Promise<{
+    kind: "refuse";
+    code: string;
+    diagnostics: {
+        stream: "out" | "error";
+        text: string;
+    }[];
+    value?: undefined;
+    identity?: undefined;
+    diagnostic?: undefined;
+} | {
+    kind: "fact";
+    value: {
+        result: string;
+        commitment: string;
+        conformance: "refused" | "complete";
+        reading: string;
+        identity?: string | undefined;
+        act?: import("@lapxo/topos/wire").ActResult | undefined;
+        place: string;
+        status: "once" | "landed" | "already-held";
+    };
+    diagnostics: {
+        stream: "out" | "error";
+        text: string;
+    }[];
+    code?: undefined;
+    identity?: undefined;
+    diagnostic?: undefined;
+} | {
+    kind: "uncertain";
+    identity: string;
+    code: string;
+    diagnostic: string;
+    diagnostics: {
+        stream: "out" | "error";
+        text: string;
+    }[];
+    value?: undefined;
+} | {
+    kind: "fact";
+    value: {
+        place: string;
+        status: "once" | "landed";
+        identity: string;
+        conformance: "incomplete";
+    };
+    diagnostic: string;
+    diagnostics: {
+        stream: "out" | "error";
+        text: string;
+    }[];
+    code?: undefined;
+    identity?: undefined;
+} | {
+    kind: "refuse";
+    code: string;
+    diagnostic: string;
+    diagnostics: {
+        stream: "out" | "error";
+        text: string;
+    }[];
+    value?: undefined;
+    identity?: undefined;
+}>;
+/** Authenticated historical query only; never revives authority or signs. */
+export declare function recoverRootActInProcess(identity: string, ports: Pick<RootLotPorts, 'root' | 'instrumentName' | 'runtime'>): {
+    kind: "fact";
+    value: {
+        historical: true;
+        act: import("@lapxo/topos/wire").ActResult;
+        bundle: LocalActBundle;
+    };
+    code?: undefined;
+    diagnostic?: undefined;
+} | {
+    kind: "refuse";
+    code: string;
+    diagnostic: string;
+    value?: undefined;
+};

package/dist/host/in-process-root.js

@@ -0,0 +1,84 @@
+import { canonical, parse } from '@lapxo/topos/wire';
+import { readingIdentity, readingReceiptIdentity } from '@lapxo/topos/contract';
+import { readContent } from "../engine/ports.js";
+import { acceptRootRecords } from "../cli/accept.js";
+import { verifiedLegacyActResult } from "../cli/act-result.js";
+import { admissionHistoryAt, admissionAnchor } from "../fold/admission-history.js";
+import { isConfig } from "../fold/claims.js";
+import { sha256, isSha256 } from "./hash.js";
+import { BoundRefusal } from "./refusals.js";
+import { refuseHost as fail } from "./host-controls.js";
+import { ActCommitUnknown } from "./commit-result.js";
+import { requireEffects } from "./read-only.js";
+import { withHostCall } from "./call-context.js";
+import { withActHost } from "../land/act.js";
+/** Snapshot identity, not a new wire, authority algorithm or current permit. */
+export const rootLotSnapshot = (root) => sha256(admissionHistoryAt(root, Number.MAX_SAFE_INTEGER).join('\n') + '\n');
+export async function landRootLotInProcess(context, ports) {
+    const diagnostics = [];
+    let size = 0;
+    let committed;
+    const runtime = structuredClone(ports.runtime), limits = { ...context.limits };
+    return withHostCall({ instrumentName: ports.instrumentName, runtime, output: (stream, text) => { size += new TextEncoder().encode(text).length; if (size > ports.limits.diagnostics)
+            fail('budget'); diagnostics.push({ stream, text }); } }, () => withActHost({ name: ports.instrumentName, report: text => { size += new TextEncoder().encode(text).length; if (size > ports.limits.diagnostics)
+            fail('budget'); diagnostics.push({ stream: 'error', text }); }, signal: context.signal }, async () => {
+        try {
+            requireEffects('Root lot admission');
+            if (!context.place || !ports.root || !ports.instrumentName || !runtime.root || !runtime.entry || !runtime.directory || !['.ts', '.js'].includes(runtime.extension) || !Array.isArray(runtime.lock) || !runtime.lock.length)
+                fail('context');
+            if (limits.records > ports.limits.records || limits.maxBytes > ports.limits.maxBytes || limits.timeoutMs > ports.limits.timeoutMs || !Number.isSafeInteger(limits.records) || limits.records < 1 || !Number.isSafeInteger(ports.limits.diagnostics) || ports.limits.diagnostics < 1)
+                fail('budget');
+            const { place, snapshot, source, digest, signal } = context, reading = structuredClone(context.reading);
+            if (!isSha256(snapshot) || rootLotSnapshot(ports.root) !== snapshot)
+                fail('stale');
+            const anchor = admissionAnchor(ports.root);
+            const identity = readingIdentity({ ...reading, inputs: [...reading.inputs, ['host/place', sha256(place)], ['host/snapshot', snapshot], ['host/anchor', sha256(JSON.stringify(anchor))], ['host/draft', digest], ['host/principal', sha256(ports.signer.keyId)], ['host/operation', sha256(JSON.stringify(['root-lot', limits]))]] }, sha256);
+            const bytes = await readContent(source, digest, { read: ports.read, digestBytes: sha256 }, limits, signal);
+            let text;
+            try {
+                text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+            }
+            catch {
+                return fail('snapshot-format');
+            }
+            const records = text.endsWith('\n') ? text.slice(0, -1).split('\n') : [];
+            if (!records.length || records.length > limits.records)
+                fail('budget');
+            for (const line of records) {
+                const parsed = parse(line);
+                if (parsed.kind !== 'fact' || canonical(parsed.value.fields, parsed.value.version) !== line || !isConfig(line) || parsed.value.fields.by !== 'target' || parsed.value.fields.epoch !== undefined || parsed.value.fields.sig !== undefined)
+                    fail('root-lot-format');
+            }
+            if (rootLotSnapshot(ports.root) !== snapshot)
+                fail('stale');
+            const code = await acceptRootRecords(ports.root, { records, keyId: ports.signer.keyId, signer: { name: ports.signer.name, sign: ports.signer.sign, signal }, signal, storage: ports.storage, prepared: ports.prepared, committed: (identity, bundle, status) => { committed = { identity, bundle, status }; } });
+            if (code !== 0 && !committed)
+                return { kind: 'refuse', code: 'host/act', diagnostics };
+            const value = { place, status: committed?.status ?? 'already-held', ...(committed ? { identity: committed.identity, act: verifiedLegacyActResult(ports.root, committed.identity).result } : {}), conformance: code === 0 ? 'complete' : 'refused', reading: identity };
+            const result = sha256(JSON.stringify(value) + '\n');
+            return { kind: 'fact', value: { ...value, result, commitment: readingReceiptIdentity(identity, result, sha256) }, diagnostics };
+        }
+        catch (error) {
+            if (error instanceof ActCommitUnknown)
+                return { kind: 'uncertain', identity: error.identity, code: error.code, diagnostic: error.message, diagnostics };
+            if (committed)
+                return { kind: 'fact', value: { place: context.place, status: committed.status, identity: committed.identity, conformance: 'incomplete' }, diagnostic: error instanceof Error ? error.message : 'post-commit failure', diagnostics };
+            return { kind: 'refuse', code: error instanceof BoundRefusal ? error.code : 'host/failed', diagnostic: error instanceof Error ? error.message : 'REFUSE·host/failed', diagnostics };
+        }
+    }));
+}
+/** Authenticated historical query only; never revives authority or signs. */
+export function recoverRootActInProcess(identity, ports) {
+    return withHostCall({ instrumentName: ports.instrumentName, runtime: structuredClone(ports.runtime), output: () => { } }, () => {
+        try {
+            if (!isSha256(identity))
+                fail('context');
+            const recovered = verifiedLegacyActResult(ports.root, identity);
+            return { kind: 'fact', value: { historical: true, act: recovered.result, bundle: recovered.bundle } };
+        }
+        catch (error) {
+            return { kind: 'refuse', code: error instanceof BoundRefusal ? error.code : 'host/failed', diagnostic: error instanceof Error ? error.message : 'REFUSE·host/failed' };
+        }
+        ;
+    });
+}

package/dist/host/in-process.d.ts

@@ -0,0 +1,41 @@
+import type { Signer } from '@lapxo/topos/wire';
+import type { ReadingIdentityContext } from '@lapxo/topos/contract';
+import type { ContentReadPort, PortLimits } from '../engine/ports.ts';
+/** Initial read-only host slice. The receiver supplies the original anchor and
+ * verified implementation/policy references; the offered bytes choose none of them.
+ * Context references commit identity, not authority or conformance certification.
+ */
+export interface RootStandingHostContext {
+    readonly place: string;
+    readonly source: string;
+    readonly snapshot: string;
+    readonly anchor: Signer;
+    readonly reading: ReadingIdentityContext;
+    readonly limits: PortLimits & {
+        readonly records: number;
+    };
+    readonly signal?: AbortSignal;
+}
+export type RootStandingHostResult = {
+    readonly kind: 'fact';
+    readonly value: {
+        readonly place: string;
+        readonly rootStanding: readonly string[];
+        readonly reading: string;
+        readonly result: string;
+        readonly commitment: string;
+    };
+} | {
+    readonly kind: 'refuse';
+    readonly code: string;
+    readonly diagnostic: string;
+};
+/** Uses the existing bounded content port, authority evaluator and projection.
+ * It projects the Root component of a complete signed Root wire snapshot; it has no persistence callback,
+ * current-root global, console output, process entry point or CLI subprocess.
+ * Contextual places and their carriers are not this Root-only projection.
+ * The returned commitment is unsigned and is not a paid native receipt.
+ */
+export declare function readRootStandingInProcess(context: RootStandingHostContext, ports: {
+    readonly read: ContentReadPort;
+}): Promise<RootStandingHostResult>;

package/dist/host/in-process.js

@@ -0,0 +1,55 @@
+import { parse } from '@lapxo/topos/wire';
+import { readingIdentity, readingReceiptIdentity } from '@lapxo/topos/contract';
+import { readContent } from "../engine/ports.js";
+import { sha256, isSha256 } from "./hash.js";
+import { BoundRefusal } from "./refusals.js";
+import { refuseHost as refuse } from "./host-controls.js";
+import { assertStandingView, publicStandingProjection } from "./standing-projection.js";
+/** Uses the existing bounded content port, authority evaluator and projection.
+ * It projects the Root component of a complete signed Root wire snapshot; it has no persistence callback,
+ * current-root global, console output, process entry point or CLI subprocess.
+ * Contextual places and their carriers are not this Root-only projection.
+ * The returned commitment is unsigned and is not a paid native receipt.
+ */
+export async function readRootStandingInProcess(context, ports) {
+    try {
+        if (!context || typeof context.place !== 'string' || !context.place || typeof context.source !== 'string' || !context.source || !isSha256(context.snapshot))
+            refuse('context');
+        if (context.signal?.aborted)
+            refuse('cancelled');
+        const { place, source, snapshot, signal } = context, limits = { ...context.limits };
+        if (!Number.isSafeInteger(limits.records) || limits.records < 1)
+            refuse('budget');
+        const anchor = structuredClone(context.anchor), reading = structuredClone(context.reading);
+        if (!anchor || anchor.keyClass !== 'authorize' || !anchor.id || !anchor.publicKey || !Array.isArray(anchor.coverage) || !anchor.coverage.length)
+            refuse('context');
+        // Validate the complete declared environment before invoking a host port.
+        readingIdentity(reading, sha256);
+        const identity = readingIdentity({ ...reading, inputs: [...reading.inputs, ['host/place', sha256(place)], ['host/anchor', sha256(JSON.stringify(anchor))], ['host/snapshot', snapshot]] }, sha256);
+        const bytes = await readContent(source, snapshot, { read: ports.read, digestBytes: sha256 }, limits, signal);
+        let text;
+        try {
+            text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+        }
+        catch {
+            return refuse('snapshot-format');
+        }
+        const history = text.split('\n').filter(line => line.length > 0);
+        if (history.length > limits.records)
+            refuse('budget');
+        if (!history.length || history.some(line => parse(line).kind !== 'fact'))
+            refuse('snapshot-format');
+        if (signal?.aborted)
+            refuse('cancelled');
+        const standing = publicStandingProjection(history, anchor);
+        assertStandingView(standing);
+        if (signal?.aborted)
+            refuse('cancelled');
+        const result = sha256(standing.join('\n') + (standing.length ? '\n' : ''));
+        return { kind: 'fact', value: { place, rootStanding: standing, reading: identity, result, commitment: readingReceiptIdentity(identity, result, sha256) } };
+    }
+    catch (error) {
+        return { kind: 'refuse', code: error instanceof BoundRefusal ? error.code : 'host/failed', diagnostic: error instanceof Error ? error.message : 'REFUSE·host/failed' };
+    }
+    ;
+}

package/dist/host/index.d.ts

@@ -0,0 +1,15 @@
+/** Native host boundary. Uses the same admission and projection as the CLI. */
+export { readRootStandingInProcess } from './in-process.ts';
+export type { RootStandingHostContext, RootStandingHostResult } from './in-process.ts';
+export { readContextualStandingInProcess } from './in-process-context.ts';
+export { landPlaceActInProcess, recoverPlaceActInProcess } from './in-process-act.ts';
+export type { PlaceActHostContext, PlaceActHostPorts } from './in-process-act.ts';
+export { landRootLotInProcess, recoverRootActInProcess, rootLotSnapshot } from './in-process-root.ts';
+export type { RootLotContext, RootLotPorts } from './in-process-root.ts';
+export { nativeHostInstrument, nativePlaceActReceiver } from './native-receiver.ts';
+export type { NativeHostInstrument } from './native-receiver.ts';
+export type { HostInstrumentRuntime } from './call-context.ts';
+export { nativePlaceActPersistence } from './ports/place-act.ts';
+export type { PlaceActTrust, PlaceActBudget } from './ports/place-act.ts';
+export type { PlaceActPersistence } from './place-act-transaction.ts';
+export type { PublicationStorage } from './ports/publication.ts';

package/dist/host/index.js

@@ -0,0 +1,7 @@
+/** Native host boundary. Uses the same admission and projection as the CLI. */
+export { readRootStandingInProcess } from "./in-process.js";
+export { readContextualStandingInProcess } from "./in-process-context.js";
+export { landPlaceActInProcess, recoverPlaceActInProcess } from "./in-process-act.js";
+export { landRootLotInProcess, recoverRootActInProcess, rootLotSnapshot } from "./in-process-root.js";
+export { nativeHostInstrument, nativePlaceActReceiver } from "./native-receiver.js";
+export { nativePlaceActPersistence } from "./ports/place-act.js";

package/dist/host/native/loader.js

@@ -7,6 +7,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     return path;
 };
 import { sha256 as digest } from "../hash.js";
+import { compareStrings as order } from "../order.js";
 import { realpathSync } from 'node:fs';
 import { dirname, join, relative, isAbsolute, sep } from 'node:path';
 import { readBoundedFile } from "./bounded-file.js";
@@ -70,7 +71,6 @@ export function installNativeResolutionReuse(declaration) {
                 fail('invalid/ambiguous logical library coordinate');
             namedCoordinates.add(coordinate);
         }
-    const order = (a, b) => a < b ? -1 : a > b ? 1 : 0;
     const identity = digest(Buffer.from(JSON.stringify([declaration.platform, files.map(member => [member.path, member.digest, member.bytes]).sort((a, b) => order(String(a[0]), String(b[0]))), [...libraries].sort(([a], [b]) => order(a, b)).map(([name, manifest]) => [name, manifest, coordinates.get(name) ?? null])])));
     if (resolutionIdentity !== undefined) {
         if (identity !== resolutionIdentity)

package/dist/host/native/module-closure.d.ts

@@ -0,0 +1,35 @@
+export interface ModuleClosureMember {
+    readonly digest: string;
+    readonly source: string;
+}
+export interface ModuleClosureSnapshot {
+    readonly identity: string;
+    readonly entry: string;
+    readonly members: ReadonlyMap<string, ModuleClosureMember>;
+}
+export interface ModuleClosureReading {
+    readonly snapshot: string;
+    readonly coordinate: string;
+    readonly digest: string;
+}
+export interface ModuleClosureLimits {
+    readonly members: number;
+    readonly bytes: number;
+    readonly portableESM?: boolean;
+    readonly signal?: AbortSignal;
+}
+/** Host-selected archive and entry, never a verifier assertion from the program.
+ * This proves content identity only; standing admission and runtime capabilities
+ * are separate prerequisites. Binary resources are not executable text members.
+ */
+export declare function moduleSnapshot(archive: Uint8Array, expected: string, entry: string): ModuleClosureSnapshot;
+/** The host supplies authenticated snapshot identities and its library resolver.
+ * Each reached text member is verified here against its exact UTF-8 bytes.
+ * Authentication of the snapshot envelope remains a separate host prerequisite.
+ * A capsule cannot select either verifier or resolver.
+ * This reads declared module edges, not arbitrary I/O or a JavaScript sandbox. Computed edges are unpaid, never absent.
+ * Activation requires an admitted host policy; existing inventory callers are not silently changed.
+ */
+export declare function moduleClosure(snapshot: ModuleClosureSnapshot, library: (specifier: string, parent: ModuleClosureSnapshot) => ModuleClosureSnapshot | undefined): readonly ModuleClosureReading[];
+/** Multiple needs share the existing traversal and one optional act budget. */
+export declare function moduleClosures(snapshots: readonly ModuleClosureSnapshot[], library: (specifier: string, parent: ModuleClosureSnapshot) => ModuleClosureSnapshot | undefined, limits?: ModuleClosureLimits): readonly ModuleClosureReading[];

package/dist/host/native/module-closure.js

@@ -38,7 +38,14 @@ export function moduleSnapshot(archive, expected, entry) {
  * Activation requires an admitted host policy; existing inventory callers are not silently changed.
  */
 export function moduleClosure(snapshot, library) {
+    return moduleClosures([snapshot], library);
+}
+/** Multiple needs share the existing traversal and one optional act budget. */
+export function moduleClosures(snapshots, library, limits) {
+    if (limits && (!Number.isSafeInteger(limits.members) || limits.members < 1 || !Number.isSafeInteger(limits.bytes) || limits.bytes < 1))
+        throw Error('REFUSE·module closure missing input resources');
     const seen = new Map();
+    let totalBytes = 0;
     const coordinate = (name) => {
         const normalized = posix.normalize(name);
         if (!name || name.includes('\0') || name.includes('\\') || posix.isAbsolute(name) || normalized === '..' || normalized.startsWith('../'))
@@ -46,12 +53,19 @@ export function moduleClosure(snapshot, library) {
         return normalized;
     };
     const walk = (one, name) => {
+        if (limits?.signal?.aborted)
+            throw Error('REFUSE·module closure cancelled');
         const at = coordinate(name), key = JSON.stringify([one.identity, at]);
+        if (limits?.portableESM && /[%?#]/.test(at))
+            throw Error('REFUSE·module closure unsupported URL coordinate ' + at);
         const member = one.members.get(at);
         if (member === undefined)
             throw Error('REFUSE·module closure missing ' + one.identity + ' ' + at);
         if (typeof member.source !== 'string' || !/^sha256:[0-9a-f]{64}$/.test(member.digest))
             throw Error('REFUSE·module closure unnamed bytes ' + one.identity + ' ' + at);
+        const size = Buffer.byteLength(member.source, 'utf8');
+        if (limits && !seen.has(key) && (seen.size >= limits.members || size > limits.bytes - totalBytes))
+            throw Error('REFUSE·module closure input resources');
         const bytes = Buffer.from(member.source, 'utf8');
         if (bytes.toString('utf8') !== member.source)
             throw Error('REFUSE·module closure invalid UTF-8 text ' + one.identity + ' ' + at);
@@ -63,18 +77,34 @@ export function moduleClosure(snapshot, library) {
                 throw Error('REFUSE·module closure conflicting member ' + one.identity + ' ' + at);
             return;
         }
+        totalBytes += size;
         seen.set(key, { snapshot: one.identity, coordinate: at, digest: member.digest });
+        if (limits?.portableESM && !['.js', '.json'].includes(posix.extname(at)))
+            throw Error('REFUSE·module closure unsupported ESM member ' + at);
         // JSON is data under the loader contract, not module syntax.
-        if (posix.extname(at) === '.json')
+        if (posix.extname(at) === '.json') {
+            if (limits?.portableESM) {
+                try {
+                    JSON.parse(member.source);
+                }
+                catch {
+                    throw Error('REFUSE·module closure invalid JSON member ' + at);
+                }
+            }
             return;
-        const syntax = moduleImportSyntax(member.source, at);
+        }
+        const syntax = moduleImportSyntax(member.source, at, limits?.portableESM ? { esmOnly: true } : undefined);
         if (syntax.unresolved.length)
             throw Error('REFUSE·module closure unresolved ' + at + ' ' + syntax.unresolved.join(' · '));
         for (const specifier of syntax.imports) {
+            if (limits?.portableESM && /[%?#\\]/.test(specifier))
+                throw Error('REFUSE·module closure unsupported URL specifier ' + specifier + ' from ' + at);
             // createRequire/registerHooks can select executable edges not present in this graph.
             // Their runtime closure needs its own host contract; an arbitrary alias is not a literal edge.
             if (specifier === 'node:module' || specifier === 'module')
                 throw Error('REFUSE·module closure runtime loader requires declared closure ' + specifier + ' from ' + at);
+            if (limits?.portableESM && (specifier.startsWith('node:') || builtinModules.includes(specifier)))
+                throw Error('REFUSE·module closure host builtin in portable delivery ' + specifier + ' from ' + at);
             if (specifier.startsWith('node:')) {
                 if (!builtinModules.includes(specifier) && !builtinModules.includes(specifier.slice(5)))
                     throw Error('REFUSE·module closure unknown builtin ' + specifier + ' from ' + at);
@@ -94,6 +124,7 @@ export function moduleClosure(snapshot, library) {
             walk(pinned, pinned.entry);
         }
     };
-    walk(snapshot, snapshot.entry);
+    for (const snapshot of snapshots)
+        walk(snapshot, snapshot.entry);
     return [...seen.values()];
 }

package/dist/host/native/module-delivery.d.ts

@@ -0,0 +1,62 @@
+import { type ModuleClosureSnapshot, type ModuleClosureLimits } from './module-closure.ts';
+export { moduleSnapshot, type ModuleClosureSnapshot } from './module-closure.ts';
+export interface ClosureDeliveryLimits extends Omit<ModuleClosureLimits, 'portableESM'> {
+    readonly responseBytes: number;
+}
+export interface ClosureNotice {
+    readonly snapshot: string;
+    readonly coordinate: string;
+    readonly digest: string;
+    readonly source: string;
+}
+export interface ClosureDeliveryManifest {
+    readonly format: 'esm-file-closure/1';
+    readonly needs: readonly {
+        name: string;
+        snapshot: string;
+        entry: string;
+    }[];
+    readonly modules: readonly {
+        snapshot: string;
+        coordinate: string;
+        digest: string;
+        path: string;
+    }[];
+    readonly libraries: readonly {
+        parent: string;
+        specifier: string;
+        snapshot: string;
+        entry: string;
+    }[];
+    readonly notices: readonly {
+        snapshot: string;
+        coordinate: string;
+        digest: string;
+        path: string;
+    }[];
+}
+export interface ClosureDelivery {
+    readonly closure: string;
+    readonly digest: string;
+    readonly bytes: Uint8Array;
+    readonly manifest: ClosureDeliveryManifest;
+    readonly files: readonly {
+        path: string;
+        source: string;
+    }[];
+    readonly importMap: {
+        imports: Record<string, string>;
+        scopes: Record<string, Record<string, string>>;
+    };
+}
+type Library = (specifier: string, parent: ModuleClosureSnapshot) => ModuleClosureSnapshot | undefined;
+/** The host selects already authenticated snapshots and resolution, never the
+ * offered program. This prepares unchanged ESM files, not a JS sandbox, signer,
+ * browser host or symbol-pruning bundler. Existing native/Acorn routes remain.
+ */
+export declare function deliverModuleClosure(needs: readonly string[], entries: ReadonlyMap<string, ModuleClosureSnapshot>, library: Library, limits: ClosureDeliveryLimits, notices?: readonly ClosureNotice[]): ClosureDelivery;
+/** Verify exact pinned delivery bytes and run the same pre-execution closure
+ * verifier again over the delivered set. No callbacks, install paths or verifier
+ * chosen by the payload. The returned import map is derived, never trusted input.
+ */
+export declare function verifyModuleDelivery(bytes: Uint8Array, expected: string, limits: ClosureDeliveryLimits): ClosureDelivery;