@lapxo/bound 0.2.3 → 0.2.5

package/dist/public-types.d.ts

@@ -0,0 +1,1114 @@
+/** Stable code assigned at the cause. Details are diagnostic, never parsed as policy. */
+declare class BoundRefusal extends Error {
+	readonly code: string;
+	constructor(code: string, diagnostic: string);
+}
+declare const PLACE_ACT_CONTEXT = "place-act-context@1";
+/** Snapshot identity, not a new wire, authority algorithm or current permit. */
+declare const rootLotSnapshot: (root: string) => string;
+declare function authorityOf(fields: Readonly<Record<string, string>>, signers: readonly Signer[], verify: Verify, published?: Published): SignerVerdict;
+declare function decodeReference(fragment: string): StandingReference;
+/** The host selects already authenticated snapshots and resolution, never the
+ * offered program. This prepares unchanged ESM files, not a JS sandbox, signer,
+ * browser host or symbol-pruning bundler. Native loading boundaries remain separately declared.
+ */
+declare function deliverModuleClosure(needs: readonly string[], entries: ReadonlyMap<string, ModuleClosureSnapshot>, library: Library, limits: ClosureDeliveryLimits, notices?: readonly ClosureNotice[]): ClosureDelivery;
+declare function describeRefusal(error: BoundRefusal, catalog: readonly RefusalEntry[]): RefusalEntry;
+declare function digest(bytes: Uint8Array): Promise<string>;
+declare function encodeReference(reference: StandingReference): string;
+declare function evaluateWasm(request: WasmRequest, { workerFactory, signal, lifetimeMs }: {
+	readonly workerFactory?: () => WorkerPort;
+	readonly signal?: AbortSignal;
+	readonly lifetimeMs: number;
+}): Promise<WasmResult>;
+/** Receiver-owned ports only. No private key, clock, filesystem or transport is
+ * available to this operation. Each port is separately bounded and cancellable. */
+declare function executeComputation(context: ComputationContext, input: Uint8Array, ports: {
+	readonly digest: DigestPort;
+	readonly evaluate: ByteComputationPort;
+	readonly sign: SigningPort;
+	readonly verify: SignatureVerificationPort;
+}, limits: PortLimits, signal?: AbortSignal): Promise<{
+	readonly statement: ComputationStatement;
+	readonly output: Uint8Array;
+}>;
+/** Signs a public snapshot proof; never lands, refreshes evidence or changes the Root. */
+declare function exportAuthenticatedReference(root: string, source: string, options?: {
+	readonly key?: string;
+	readonly keyFile?: string;
+	readonly signer?: string;
+	readonly hostSigner?: {
+		readonly name: string;
+		readonly sign: SigningPort;
+	};
+}): Promise<{
+	profile: string;
+	reference: string;
+	carrier: string;
+	context: {
+		snapshot: string;
+		profile: string;
+		semanticIdentity: string;
+		epoch: number;
+		proofScope: string;
+		policy: string;
+		formImplementation: string;
+		signers: readonly Signer[];
+		algorithms: readonly string[];
+		contracts: {
+			refusals: string;
+			standing: string;
+		};
+		maxBytes: number;
+		maxRecords: number;
+	};
+}>;
+/** Prospective authenticated-standing@1 host composition; no effects and no authority from transport. */
+declare function inspectAuthenticatedReference(fragment: string, trust: ReferenceTrust): Promise<{
+	contracts?: {
+		refusals: string;
+		standing: string;
+	} | undefined;
+	reference: StandingReference;
+	records: readonly ObjectRecord[];
+	semanticIdentity: string;
+	authorityContextIdentity: string;
+	semanticStanding: string;
+	originalRecords: readonly string[];
+}>;
+declare function inspectReference(fragment: string, policy: readonly string[]): Promise<{
+	reference: StandingReference;
+	lines: readonly string[];
+	standing: string;
+	authentication: string;
+}>;
+/** Acquire canonical line signatures only. The line protocol is not widened
+ * for contextual receipt frames. Both operations share bounds and response checks. */
+declare function invokeSigningPort(lot: SigningLot, sign: SigningPort, limits: PortLimits, signal?: AbortSignal): Promise<readonly SignatureRecord[]>;
+/** Signs receiver receipts through the bounded existing signer protocol. Exact
+ * original declarations/proofs remain unchanged. Replay is historical recovery,
+ * never a new permission. A refusal after visibility is not a rollback claim. */
+declare function landPlaceActInProcess(context: PlaceActHostContext, ports: PlaceActHostPorts): Promise<{
+	kind: "fact";
+	value: {
+		place: string;
+		act: PlaceActBundle & {
+			readonly kind: "landed" | "once";
+			readonly identity: string;
+		};
+		reading: string;
+		result: string;
+		commitment: string;
+	};
+	identity?: undefined;
+	code?: undefined;
+	diagnostic?: undefined;
+} | {
+	kind: "uncertain";
+	identity: string;
+	code: string;
+	diagnostic: string;
+	value?: undefined;
+} | {
+	kind: "refuse";
+	code: string;
+	diagnostic: string;
+	value?: undefined;
+	identity?: undefined;
+}>;
+declare function landRootLotInProcess(context: RootLotContext, ports: RootLotPorts): Promise<{
+	kind: "refuse";
+	code: string;
+	diagnostics: {
+		stream: "out" | "error";
+		text: string;
+	}[];
+	value?: undefined;
+	identity?: undefined;
+	diagnostic?: undefined;
+} | {
+	kind: "fact";
+	value: {
+		result: string;
+		commitment: string;
+		conformance: "refused" | "complete";
+		reading: string;
+		identity?: string | undefined;
+		act?: ActResult | undefined;
+		place: string;
+		status: "once" | "landed" | "already-held";
+	};
+	diagnostics: {
+		stream: "out" | "error";
+		text: string;
+	}[];
+	code?: undefined;
+	identity?: undefined;
+	diagnostic?: undefined;
+} | {
+	kind: "uncertain";
+	identity: string;
+	code: string;
+	diagnostic: string;
+	diagnostics: {
+		stream: "out" | "error";
+		text: string;
+	}[];
+	value?: undefined;
+} | {
+	kind: "fact";
+	value: {
+		place: string;
+		status: "once" | "landed";
+		identity: string;
+		conformance: "incomplete";
+	};
+	diagnostic: string;
+	diagnostics: {
+		stream: "out" | "error";
+		text: string;
+	}[];
+	code?: undefined;
+	identity?: undefined;
+} | {
+	kind: "refuse";
+	code: string;
+	diagnostic: string;
+	diagnostics: {
+		stream: "out" | "error";
+		text: string;
+	}[];
+	value?: undefined;
+	identity?: undefined;
+}>;
+/** Host-selected archive and entry, never a verifier assertion from the program.
+ * This proves content identity only; standing admission and runtime capabilities
+ * are separate prerequisites. Binary resources are not executable text members.
+ */
+declare function moduleSnapshot(archive: Uint8Array, expected: string, entry: string): ModuleClosureSnapshot;
+/** Explicit installed/source ESM selection, never consumer argv or packet data.
+ * Identity and public configuration do not certify implementation correctness. */
+declare function nativeHostInstrument(root: string, entry: string): NativeHostInstrument;
+/** Context, exact original bytes and complete signed receipts have one visibility
+ * point. Real Root guard exclusion spans final authority/head comparison and
+ * publication; this does not activate a CLI profile or reinterpret local-act@1. */
+/** Native persistence adapter. The transaction below is also the CLI path. */
+declare function nativePlaceActPersistence(store: string, storage?: PublicationStorage): PlaceActPersistence;
+/** Bind existing native authority construction to an explicit instrument for
+ * every later current/historical observation, not only the constructor call. */
+declare function nativePlaceActReceiver(root: string, instrument: NativeHostInstrument): {
+	selection: HostClockSelection;
+	trust: {
+		current: () => PlaceActSnapshot;
+		historical: (encoded: string) => TrustedClockContract;
+		contract: TrustedClockContract;
+		initialHeads: readonly PlaceActHead[];
+	};
+};
+declare function objectFold(records: readonly ObjectRecord[], context: ObjectContext): readonly ObjectReading[];
+/** Portable byte profile. Context and admission callbacks belong to the
+ * receiver, never to a requested vector or downloaded place. */
+declare function objectFoldBytes(input: Uint8Array, context: ObjectContext): Uint8Array;
+declare function openAuthenticatedReference(root: string, fragment: string, options?: {
+	readonly signal?: AbortSignal;
+	readonly content?: {
+		readonly name: string;
+		readonly read: ContentReadPort;
+	};
+}): Promise<{
+	backend: string;
+	readings: readonly ObjectReading[];
+	contracts?: {
+		refusals: string;
+		standing: string;
+	} | undefined;
+	reference: StandingReference;
+	records: readonly ObjectRecord[];
+	semanticIdentity: string;
+	authorityContextIdentity: string;
+	semanticStanding: string;
+	originalRecords: readonly string[];
+}>;
+declare function preflight(request: WasmRequest): void;
+/** Receiver-selected instrument and admitted Root; no consumer-owned verifier or directory fingerprint. */
+declare function prepareNativeReadingIdentity(context: NativeReadingIdentityContext): Promise<NativeReadingIdentityResult>;
+/** Prepare only native configuration projections. No foldPlace, observation,
+ * executable reader, resolver, persistence, lease or Root exclusion is entered.
+ * The returned text and identity share one immutable committed observation. */
+declare function prepareNativeViewIdentity(context: NativeViewIdentityContext): NativeViewIdentityResult;
+declare function readContent(source: string, digest: string, ports: {
+	readonly read: ContentReadPort;
+	readonly digestBytes: DigestPort;
+}, limits: PortLimits, signal?: AbortSignal): Promise<Uint8Array>;
+/** Full contextual carrier, authenticated against receiver inputs only. It is a
+ * data projection, not a current admission permit or a signed receipt. */
+declare function readContextualStandingInProcess(context: RootStandingHostContext, ports: {
+	readonly read: ContentReadPort;
+}): Promise<{
+	kind: "fact";
+	value: {
+		place: string;
+		standing: {
+			profile: string;
+			root: readonly string[];
+			legacyPlaces: {
+				namespace: string;
+				place: string;
+				standing: string[];
+				history: readonly string[];
+			}[];
+			contexts: readonly PortablePlaceContext[];
+			places: {
+				namespace: string;
+				place: string;
+				standing: string[];
+				retracted: readonly string[];
+				superseded: readonly string[];
+				forks: readonly Fork[];
+				contexts: {
+					identity: string;
+					context: string;
+					receipts: readonly PlaceReceipt[];
+				}[];
+			}[];
+		};
+		reading: string;
+		result: string;
+		commitment: string;
+	};
+	code?: undefined;
+	diagnostic?: undefined;
+} | {
+	kind: "refuse";
+	code: string;
+	diagnostic: string;
+	value?: undefined;
+}>;
+/** Pure machine contract reader. A catalog is data, never an authority grant. */
+declare function readRefusalCatalog(text: string): readonly RefusalEntry[];
+/** Uses the existing bounded content port, authority evaluator and projection.
+ * It projects the Root component of a complete signed Root wire snapshot; it has no persistence callback,
+ * current-root global, console output, process entry point or CLI subprocess.
+ * Contextual places and their carriers are not this Root-only projection.
+ * The returned commitment is unsigned and is not a paid native receipt.
+ */
+declare function readRootStandingInProcess(context: RootStandingHostContext, ports: {
+	readonly read: ContentReadPort;
+}): Promise<RootStandingHostResult>;
+/** Historical recovery after a lost response. No signer, current authorization
+ * or publication callback is invoked and the result grants no new act. */
+declare function recoverPlaceActInProcess(context: Pick<PlaceActHostContext, "place" | "identity" | "reading" | "storageLimits" | "signal">, ports: Pick<PlaceActHostPorts, "instrumentName" | "trust" | "persistence" | "limits">): {
+	kind: "fact";
+	value: {
+		place: string;
+		identity: string;
+		act: PlaceActBundle;
+		historical: true;
+		reading: string;
+		result: string;
+		commitment: string;
+	};
+	code?: undefined;
+	diagnostic?: undefined;
+} | {
+	kind: "refuse";
+	code: string;
+	diagnostic: string;
+	value?: undefined;
+};
+/** Authenticated historical query only; never revives authority or signs. */
+declare function recoverRootActInProcess(identity: string, ports: Pick<RootLotPorts, "root" | "instrumentName" | "runtime">): {
+	kind: "fact";
+	value: {
+		historical: true;
+		act: ActResult;
+		bundle: LocalActBundle;
+	};
+	code?: undefined;
+	diagnostic?: undefined;
+} | {
+	kind: "refuse";
+	code: string;
+	diagnostic: string;
+	value?: undefined;
+};
+/** Verify before invoking retention; no operation automatically writes the projected result. */
+declare function retainContent(digest: string, bytes: Uint8Array, ports: {
+	readonly retain: PersistencePort;
+	readonly digestBytes: DigestPort;
+}, limits: PortLimits, signal?: AbortSignal): Promise<{
+	readonly digest: string;
+	readonly bytes: number;
+}>;
+/** A pinned suite is data. Only the receiver chooses its contract, required
+ * coverage and candidate; a candidate's own list cannot certify completeness. */
+declare function runConformance(bytes: Uint8Array, receiver: ConformanceReceiver, ports: {
+	readonly digest: DigestPort;
+	readonly evaluate: ByteComputationPort;
+}, limits: PortLimits & {
+	readonly maxCases: number;
+}, signal?: AbortSignal): Promise<ConformanceReport>;
+declare function runWasmRequest(request: WasmRequest): Promise<WasmResult>;
+declare function validateObjectContext(records: readonly ObjectRecord[], context: ObjectContext): Outcome<readonly ObjectRecord[]>;
+/** The receiver supplies the expected implementation, question, policy,
+ * environment and verification port. The carrier cannot choose any of them. */
+declare function verifyComputation(context: ComputationContext, input: Uint8Array, output: Uint8Array, claim: ComputationStatement, ports: {
+	readonly digest: DigestPort;
+	readonly verify: SignatureVerificationPort;
+}, limits: PortLimits, signal?: AbortSignal): Promise<ComputationStatement>;
+/** Verify exact pinned delivery bytes and run the same pre-execution closure
+ * verifier again over the delivered set. No callbacks, install paths or verifier
+ * chosen by the payload. The returned import map is derived, never trusted input.
+ */
+declare function verifyModuleDelivery(bytes: Uint8Array, expected: string, limits: ClosureDeliveryLimits): ClosureDelivery;
+interface ActResult {
+	readonly identity: string;
+	readonly epoch: number;
+	readonly records: readonly string[];
+	readonly receipt: string;
+}
+interface Cell<T> {
+	readonly floor: T;
+	readonly ceiling: T;
+	readonly origins: readonly Claim<T>[];
+	readonly rest: readonly string[];
+	readonly required: T;
+	readonly signed: T;
+}
+interface Claim<T> {
+	readonly origin: string;
+	readonly span: T;
+	readonly id?: string;
+	readonly at?: number;
+	readonly sign?: Act;
+	readonly takes?: string;
+	readonly phase?: number;
+}
+interface ClockBudget {
+	readonly bytes: number;
+	readonly records: number;
+	readonly placements: number;
+	readonly policies: number;
+	readonly proofs: number;
+	readonly signers: number;
+}
+interface ClosureDelivery {
+	readonly closure: string;
+	readonly digest: string;
+	readonly bytes: Uint8Array;
+	readonly manifest: ClosureDeliveryManifest;
+	readonly files: readonly {
+		path: string;
+		source: string;
+	}[];
+	readonly importMap: {
+		imports: Record<string, string>;
+		scopes: Record<string, Record<string, string>>;
+	};
+}
+interface ClosureDeliveryLimits extends Omit<ModuleClosureLimits, "portableESM"> {
+	readonly responseBytes: number;
+}
+interface ClosureDeliveryManifest {
+	readonly format: "esm-file-closure/1";
+	readonly needs: readonly {
+		name: string;
+		snapshot: string;
+		entry: string;
+	}[];
+	readonly modules: readonly {
+		snapshot: string;
+		coordinate: string;
+		digest: string;
+		path: string;
+	}[];
+	readonly libraries: readonly {
+		parent: string;
+		specifier: string;
+		snapshot: string;
+		entry: string;
+	}[];
+	readonly notices: readonly {
+		snapshot: string;
+		coordinate: string;
+		digest: string;
+		path: string;
+	}[];
+}
+interface ClosureNotice {
+	readonly snapshot: string;
+	readonly coordinate: string;
+	readonly digest: string;
+	readonly source: string;
+}
+interface ComputationContext {
+	readonly contract: string;
+	readonly numericPolicy: string;
+	readonly reading: ReadingIdentityContext;
+	readonly keyId: string;
+	readonly algorithm: string;
+}
+interface ComputationStatement {
+	readonly profile: "bound-computation@1";
+	readonly question: string;
+	readonly reading: string;
+	readonly origin: string;
+	readonly result: string;
+	readonly commitment: string;
+	readonly keyId: string;
+	readonly algorithm: string;
+	readonly signature: string;
+}
+interface ConformanceCase {
+	readonly id: string;
+	readonly covers: readonly string[];
+	readonly request: string;
+	readonly expected: string;
+}
+interface ConformanceReceiver {
+	readonly suite: string;
+	readonly implementation: string;
+	readonly contract: string;
+	readonly rules: readonly string[];
+	readonly refusals: readonly string[];
+}
+interface ConformanceReport {
+	readonly profile: "bound-conformance-report@1";
+	readonly suite: string;
+	readonly implementation: string;
+	readonly contract: string;
+	readonly met: boolean;
+	readonly cases: readonly {
+		readonly id: string;
+		readonly met: boolean;
+		readonly response: string;
+	}[];
+	readonly commitment: string;
+}
+interface ConformanceSuite {
+	readonly profile: "bound-conformance@1";
+	readonly contract: string;
+	readonly cases: readonly ConformanceCase[];
+}
+interface Fork {
+	readonly key: string;
+	readonly lines: readonly string[];
+	readonly state?: string;
+}
+interface HostClockSelection {
+	readonly profile: typeof PLACE_ACT_CONTEXT;
+	readonly namespace: string;
+	readonly regionFamily: string;
+	readonly receiptSigner: string;
+	readonly receiptScope: string;
+	readonly digestAlgorithm: "sha256";
+	readonly budget: ClockBudget;
+	readonly storageBudget: PlaceActBudget;
+	readonly initial: readonly {
+		place: string;
+		receiver: {
+			identity: string;
+			epoch: string;
+		};
+		origin: {
+			prefix: string;
+			epoch: string;
+		};
+	}[];
+}
+/** Native operational selection from the receiver, never the offered content. */
+interface HostInstrumentRuntime {
+	readonly root: string;
+	readonly entry: string;
+	readonly directory: string;
+	readonly extension: ".ts" | ".js";
+	readonly lock: readonly string[];
+}
+interface JoinSemilattice<T> extends Poset<T> {
+	readonly bottom: T;
+	join(a: T, b: T): T;
+}
+interface Lattice<T> extends MeetSemilattice<T>, JoinSemilattice<T> {
+}
+interface LocalActBundle {
+	readonly records: string;
+	readonly receipt: string;
+	readonly placements?: readonly {
+		place: string;
+		records: string;
+	}[];
+}
+interface Mark<T> {
+	readonly pole: "floor" | "ceiling";
+	readonly reach: "local" | "travels";
+	readonly span: T;
+	readonly widens?: string;
+	readonly id?: string;
+	readonly at?: number;
+	readonly sign?: Act;
+	readonly takes?: string;
+}
+interface MeetSemilattice<T> extends Poset<T> {
+	readonly top: T;
+	meet(a: T, b: T): T;
+	inhabited(x: T): boolean;
+}
+interface ModuleClosureLimits {
+	readonly members: number;
+	readonly bytes: number;
+	readonly portableESM?: boolean;
+	readonly signal?: AbortSignal;
+}
+interface ModuleClosureMember {
+	readonly digest: string;
+	readonly source: string;
+}
+interface ModuleClosureSnapshot {
+	readonly identity: string;
+	readonly entry: string;
+	readonly members: ReadonlyMap<string, ModuleClosureMember>;
+}
+interface NativeHostInstrument {
+	readonly name: string;
+	readonly runtime: HostInstrumentRuntime;
+}
+interface NativeReadingIdentityContext {
+	readonly place: string;
+	readonly instrument: NativeHostInstrument;
+	readonly limits: ReadingPreparationLimits;
+	readonly reader?: string;
+}
+interface NativeViewIdentityContext {
+	readonly place: string;
+	readonly instrument: NativeHostInstrument;
+	readonly view: string;
+	readonly expectedIdentity?: string;
+}
+/** Providers answer declared admission/selection questions; no domain parser lives here. */
+interface ObjectContext {
+	admit(record: ObjectRecord): boolean;
+	resolve(cell: ObjectRecord): SelectedObjectForm;
+	origin(origin: string, authority: string, scope: string): boolean;
+	witness(reference: string, authority: string, scope: string): boolean;
+}
+/** Projection dispatches admitted acts into Obligatory; it defines no meet or propagation. */
+interface ObjectReading {
+	cell: string;
+	state: string;
+	parts: Cell<unknown>;
+	rest: readonly string[];
+	ownMarks: readonly (string | undefined)[];
+	ownClaims: readonly {
+		id: string | undefined;
+		origin: string;
+	}[];
+	marks: readonly Mark<unknown>[];
+	claims: readonly unknown[];
+}
+interface ObjectRecord {
+	readonly record: "cell" | "claim" | "mark";
+	readonly fields: Readonly<Record<string, string>>;
+}
+interface PlaceActBudget {
+	readonly acts: number;
+	readonly bytes: number;
+}
+interface PlaceActBundle {
+	readonly context: string;
+	readonly receipts: readonly PlaceReceipt[];
+	readonly originals: readonly (readonly string[])[];
+}
+interface PlaceActHead {
+	readonly place: string;
+	readonly identity: string;
+	readonly epoch: string;
+}
+interface PlaceActHostContext {
+	readonly place: string;
+	readonly source: string;
+	readonly identity: string;
+	readonly rootSnapshot: string;
+	readonly reading: ReadingIdentityContext;
+	readonly algorithm: string;
+	readonly contentLimits: PortLimits;
+	readonly signingLimits: PortLimits;
+	readonly storageLimits: PlaceActBudget;
+	readonly signal?: AbortSignal;
+}
+/** These are receiver-selected host ports, not carrier fields or an offered
+ * verifier. Trust must be constructed from the authenticated receiver snapshot. */
+interface PlaceActHostPorts {
+	readonly instrumentName: string;
+	readonly read: ContentReadPort;
+	readonly sign: SigningPort;
+	readonly trust: () => PlaceActTrust;
+	readonly persistence: PlaceActPersistence;
+	readonly limits: {
+		readonly storage: PlaceActBudget;
+		readonly signing: PortLimits;
+		readonly content: PortLimits;
+	};
+}
+/** Host-selected persistence, never supplied by offered content. exclusive must
+ * share the CLI's region/authority/projection protocol. publish is synchronous
+ * with exactly one atomic visibility point; a thrown reply may follow commit. */
+interface PlaceActPersistence {
+	readonly exclusive: <T>(regions: readonly string[], run: () => Promise<T>) => Promise<T>;
+	readonly result: (identity: string, trust: PlaceActTrust, limits: PlaceActBudget) => PlaceActBundle | undefined;
+	readonly inventory: (limits: PlaceActBudget) => {
+		readonly names: readonly string[];
+		readonly bytes: number;
+	};
+	readonly heads: (trust: PlaceActTrust, limits: PlaceActBudget) => readonly PlaceActHead[];
+	readonly publish: (identity: string, files: Readonly<Record<string, string>>) => void;
+}
+interface PlaceActSnapshot {
+	readonly root: RootContext;
+	readonly heads: readonly PlaceActHead[];
+}
+/** Fixed instrument construction, never supplied by world JSON. Historical
+ * authentication permits inspection only; current() is read under Root guards. */
+interface PlaceActTrust {
+	readonly contract: TrustedClockContract;
+	readonly initialHeads: readonly PlaceActHead[];
+	readonly current: () => PlaceActSnapshot;
+	readonly historical: (encoded: string) => TrustedClockContract;
+}
+interface PlaceReceipt {
+	readonly by: string;
+	readonly place: string;
+	readonly signature: string;
+}
+interface PortLimits {
+	readonly timeoutMs: number;
+	readonly maxBytes: number;
+}
+interface PortablePlaceContext {
+	readonly identity: string;
+	readonly context: string;
+	readonly receipts: readonly PlaceReceipt[];
+	readonly authority: {
+		anchor: Signer;
+		history: readonly string[];
+		checkpoint: string;
+	};
+}
+interface Poset<T> {
+	leq(a: T, b: T): boolean;
+	show(x: T): string;
+}
+interface PublicationStorage {
+	publish(staged: string, committed: string): void;
+}
+interface Published {
+	readonly digest: string;
+	readonly pins: readonly string[];
+}
+interface ReadingIdentityContext {
+	readonly instrument: string;
+	readonly implementation: string;
+	readonly policy: string;
+	/** The host supplies the complete verified transitive input closure. */
+	readonly inputs: readonly (readonly [
+		coordinate: string,
+		identity: string
+	])[];
+	/** Explicitly empty means no relevant environment; absence is unknown. */
+	readonly environment: readonly (readonly [
+		coordinate: string,
+		identity: string
+	])[];
+}
+interface ReadingPreparationLimits {
+	readonly bytes: number;
+	readonly files: number;
+	readonly readings: number;
+	readonly probes: number;
+	readonly signal?: AbortSignal;
+}
+interface ReferenceTrust {
+	readonly snapshot: string;
+	readonly epoch: number;
+	readonly proofScope: string;
+	readonly policy: string;
+	readonly formImplementation: string;
+	readonly signers: readonly Signer$1[];
+	readonly algorithms: readonly string[];
+	readonly contracts?: {
+		readonly refusals: string;
+		readonly standing: string;
+	};
+	readonly objects: ObjectContext$1;
+	readonly maxBytes: number;
+	readonly maxRecords: number;
+	readonly digestBytes: (bytes: Uint8Array) => string | Promise<string>;
+	readonly verifyBytes: (bytes: string, key: string, signature: string, algorithms: readonly string[]) => boolean | Promise<boolean>;
+	readonly fetchBytes: (source: string, blob: string) => Promise<Uint8Array>;
+}
+interface RefusalEntry {
+	readonly code: string;
+	readonly category: string;
+	readonly meaning: string;
+	readonly next: string;
+}
+interface RootContext {
+	readonly namespace: string;
+	readonly snapshot: string;
+	readonly epoch: string;
+	readonly prefix: string;
+	readonly head: string;
+	readonly policies: readonly string[];
+}
+interface RootLotContext {
+	readonly place: string;
+	readonly snapshot: string;
+	readonly source: string;
+	readonly digest: string;
+	readonly reading: ReadingIdentityContext;
+	readonly limits: PortLimits & {
+		readonly records: number;
+	};
+	readonly signal?: AbortSignal;
+}
+/** The receiver selects the actual native place, instrument and signer. The lot
+ * supplies only canonical unsigned Root configuration, never host capabilities. */
+interface RootLotPorts {
+	readonly root: string;
+	readonly instrumentName: string;
+	readonly runtime: HostInstrumentRuntime;
+	readonly read: ContentReadPort;
+	readonly signer: {
+		readonly keyId: string;
+		readonly name: string;
+		readonly sign: SigningPort;
+	};
+	readonly storage?: PublicationStorage;
+	readonly prepared?: (identity: string) => void;
+	readonly limits: RootLotContext["limits"] & {
+		readonly diagnostics: number;
+	};
+}
+/** Initial read-only host slice. The receiver supplies the original anchor and
+ * verified implementation/policy references; the offered bytes choose none of them.
+ * Context references commit identity, not authority or conformance certification.
+ */
+interface RootStandingHostContext {
+	readonly place: string;
+	readonly source: string;
+	readonly snapshot: string;
+	readonly anchor: Signer;
+	readonly reading: ReadingIdentityContext;
+	readonly limits: PortLimits & {
+		readonly records: number;
+	};
+	readonly signal?: AbortSignal;
+}
+interface SelectedObjectForm {
+	readonly digest: string;
+	readonly form: WireForm;
+	readonly params: unknown;
+}
+interface SignatureRecord {
+	readonly keyId: string;
+	readonly signature: string;
+}
+interface Signer {
+	readonly id: string;
+	readonly keyClass: KeyClass;
+	readonly publicKey: string;
+	readonly coverage: readonly string[];
+	readonly spans?: readonly {
+		readonly globs: readonly string[];
+		readonly from: number;
+		readonly to: number | null;
+	}[];
+	readonly depth: {
+		readonly lo: number;
+		readonly hi: number;
+	};
+	readonly admittedBy: readonly string[];
+	readonly epoch?: {
+		readonly start: number;
+		readonly close: number | null;
+	};
+	readonly windows?: readonly {
+		readonly lo: number;
+		readonly hi: number;
+		readonly from: number;
+		readonly to: number | null;
+	}[];
+}
+interface SigningLot {
+	readonly bytes: readonly string[];
+	readonly keyId: string;
+	readonly algorithm: string;
+}
+interface StandingReference {
+	readonly class: "standing";
+	readonly algorithm: "sha256";
+	readonly digest: string;
+	readonly blob: string;
+	readonly source: string;
+}
+interface TrustedClockContract {
+	readonly budget: ClockBudget;
+	readonly root: RootContext;
+	readonly signers: readonly Signer[];
+	readonly places: readonly string[];
+	readonly regionFamily: string;
+	readonly receiptSigner: string;
+	readonly receiptScope: string;
+	/** These functions are instrument-selected, not packet-selected. Never an
+	 * arbitrary input boolean. They authenticate complete prefixes and namespaces. */
+	readonly verifiesRootContext: (context: RootContext) => boolean;
+	readonly verifiesNamespaceAdmission: (place: string, root: RootContext) => boolean;
+	readonly verifiesNewLocalPrefix: (place: string, prefix: string, epoch: string, originals: readonly string[]) => boolean;
+	readonly verifiesOriginal: (original: string, signer: Signer, root: RootContext) => boolean;
+	readonly verifiesProof: (bytes: string, signature: string, signer: Signer, root: RootContext) => boolean;
+	readonly digest: (bytes: string) => string;
+}
+interface WasmLimits {
+	readonly memoryBytes: number;
+	readonly stackBytes: number;
+	readonly executionMs: number;
+}
+interface WasmRequest {
+	readonly trusted: WasmTrust;
+	readonly assets: {
+		readonly runtime: Uint8Array | ArrayBuffer;
+		readonly wasm: Uint8Array | ArrayBuffer;
+	};
+	readonly modules: Readonly<Record<string, string>>;
+	readonly entry: string;
+	readonly aliases?: Readonly<Record<string, string>>;
+	readonly limits: WasmLimits;
+}
+interface WasmResult {
+	readonly output: string;
+	readonly initializedMs: number;
+	readonly executionMs: number;
+}
+interface WasmTrust {
+	readonly runtime: string;
+	readonly wasm: string;
+	readonly modules: Readonly<Record<string, string>>;
+	readonly entry: string;
+	readonly aliases: Readonly<Record<string, string>>;
+	readonly limits: WasmLimits;
+	readonly byteLengths: {
+		readonly runtime: number;
+		readonly wasm: number;
+		readonly modules: Readonly<Record<string, number>>;
+	};
+}
+interface WireForm<T = unknown> {
+	readonly id: string;
+	lattice(params: unknown): Lattice<T>;
+	parse(params: unknown, text: string): T;
+	emit(params: unknown, value: T): string;
+	show(params: unknown, value: T): string;
+	points(params: unknown, seed: number, n: number): readonly T[];
+}
+interface WorkerPort {
+	postMessage(message: WasmRequest): void;
+	terminate(): unknown;
+	addEventListener?(type: string, listener: (event: {
+		data?: unknown;
+		message?: string;
+	}) => void): void;
+	on?(type: string, listener: (value: unknown) => void): void;
+}
+type Act = 1 | -1;
+type ByteComputationPort = (bytes: Uint8Array, signal: AbortSignal) => Promise<Uint8Array>;
+type ContentReadPort = (source: string, digest: string, signal: AbortSignal) => Promise<Uint8Array>;
+type DigestPort = (bytes: Uint8Array) => string | Promise<string>;
+type KeyClass = "attest" | "authorize";
+type Library = (specifier: string, parent: ModuleClosureSnapshot) => ModuleClosureSnapshot | undefined;
+type NativeReadingIdentityResult = {
+	readonly kind: "fact";
+	readonly preparations: readonly ReadingPreparationResult[];
+} | {
+	readonly kind: "refuse";
+	readonly code: string;
+	readonly diagnostic: string;
+};
+type NativeViewIdentityResult = {
+	readonly kind: "fact";
+	readonly view: "lines" | "evidence";
+	readonly identity: string;
+	readonly text: string;
+} | {
+	readonly kind: "refuse";
+	readonly code: string;
+	readonly diagnostic: string;
+};
+type ObjectContext$1 = Parameters<typeof validateObjectContext>[1];
+type Outcome<T> = {
+	readonly kind: "fact";
+	readonly value: T;
+} | {
+	readonly kind: "abstain";
+	readonly why: string;
+} | {
+	readonly kind: "refuse";
+	readonly why: string;
+	readonly named?: string;
+};
+/** Atomic byte retention supplied by the host. This is neither admission nor a current-answer cache. */
+type PersistencePort = (digest: string, bytes: Uint8Array, signal: AbortSignal) => Promise<void>;
+type PreparedReading = {
+	readonly scope: string;
+	readonly kind: "ready";
+	readonly identity: string;
+	readonly context: ReadingIdentityContext;
+	readonly receipt?: string;
+} | {
+	readonly scope: string;
+	readonly kind: "needs";
+	readonly needs: readonly string[];
+};
+type ReadingPreparationResult = {
+	readonly kind: "fact";
+	readonly readings: readonly PreparedReading[];
+	readonly probes: number;
+	readonly verifiedBytes: number;
+	readonly retained: number;
+} | {
+	readonly kind: "needs";
+	readonly needs: readonly string[];
+} | {
+	readonly kind: "refuse";
+	readonly code: string;
+	readonly diagnostic: string;
+};
+type RootStandingHostResult = {
+	readonly kind: "fact";
+	readonly value: {
+		readonly place: string;
+		readonly rootStanding: readonly string[];
+		readonly reading: string;
+		readonly result: string;
+		readonly commitment: string;
+	};
+} | {
+	readonly kind: "refuse";
+	readonly code: string;
+	readonly diagnostic: string;
+};
+type SignatureVerificationPort = (bytes: string, signature: SignatureRecord, algorithm: string, signal: AbortSignal) => Promise<boolean>;
+type Signer$1 = Parameters<typeof authorityOf>[1][number];
+type SignerVerdict = {
+	readonly kind: "admitted";
+	readonly signer: string;
+} | {
+	readonly kind: "grey";
+	readonly why: string;
+} | {
+	readonly kind: "refuse";
+	readonly why: string;
+	readonly named: string;
+};
+type SigningPort = (lot: SigningLot, signal: AbortSignal) => Promise<readonly SignatureRecord[]>;
+type Verify = (fields: Readonly<Record<string, string>>, publicKey: string) => boolean;
+
+export {
+	BoundRefusal as public4_BoundRefusal,
+	ByteComputationPort as public1_ByteComputationPort,
+	ClosureDelivery as public3_ClosureDelivery,
+	ClosureDeliveryLimits as public3_ClosureDeliveryLimits,
+	ClosureDeliveryManifest as public3_ClosureDeliveryManifest,
+	ClosureNotice as public3_ClosureNotice,
+	ComputationContext as public1_ComputationContext,
+	ComputationStatement as public1_ComputationStatement,
+	ConformanceCase as public1_ConformanceCase,
+	ConformanceReceiver as public1_ConformanceReceiver,
+	ConformanceReport as public1_ConformanceReport,
+	ConformanceSuite as public1_ConformanceSuite,
+	ContentReadPort as public1_ContentReadPort,
+	ContentReadPort as public4_ContentReadPort,
+	DigestPort as public1_DigestPort,
+	DigestPort as public4_DigestPort,
+	HostInstrumentRuntime as public2_HostInstrumentRuntime,
+	ModuleClosureSnapshot as public3_ModuleClosureSnapshot,
+	NativeHostInstrument as public2_NativeHostInstrument,
+	NativeReadingIdentityContext as public2_NativeReadingIdentityContext,
+	NativeReadingIdentityResult as public2_NativeReadingIdentityResult,
+	NativeViewIdentityContext as public2_NativeViewIdentityContext,
+	NativeViewIdentityResult as public2_NativeViewIdentityResult,
+	ObjectContext as public1_ObjectContext,
+	ObjectReading as public1_ObjectReading,
+	ObjectRecord as public1_ObjectRecord,
+	PersistencePort as public1_PersistencePort,
+	PersistencePort as public4_PersistencePort,
+	PlaceActBudget as public2_PlaceActBudget,
+	PlaceActHostContext as public2_PlaceActHostContext,
+	PlaceActHostPorts as public2_PlaceActHostPorts,
+	PlaceActPersistence as public2_PlaceActPersistence,
+	PlaceActTrust as public2_PlaceActTrust,
+	PortLimits as public1_PortLimits,
+	PortLimits as public4_PortLimits,
+	PreparedReading as public2_PreparedReading,
+	PublicationStorage as public2_PublicationStorage,
+	ReadingPreparationLimits as public2_ReadingPreparationLimits,
+	ReadingPreparationResult as public2_ReadingPreparationResult,
+	ReferenceTrust as public4_ReferenceTrust,
+	RefusalEntry as public1_RefusalEntry,
+	RefusalEntry as public4_RefusalEntry,
+	RootLotContext as public2_RootLotContext,
+	RootLotPorts as public2_RootLotPorts,
+	RootStandingHostContext as public2_RootStandingHostContext,
+	RootStandingHostResult as public2_RootStandingHostResult,
+	SignatureRecord as public1_SignatureRecord,
+	SignatureRecord as public4_SignatureRecord,
+	SignatureVerificationPort as public1_SignatureVerificationPort,
+	SigningLot as public1_SigningLot,
+	SigningLot as public4_SigningLot,
+	SigningPort as public1_SigningPort,
+	SigningPort as public4_SigningPort,
+	WasmLimits as public6_WasmLimits,
+	WasmRequest as public6_WasmRequest,
+	WasmResult as public6_WasmResult,
+	WasmTrust as public6_WasmTrust,
+	WorkerPort as public6_WorkerPort,
+	decodeReference as public4_decodeReference,
+	deliverModuleClosure as public3_deliverModuleClosure,
+	describeRefusal as public4_describeRefusal,
+	digest as public6_digest,
+	encodeReference as public4_encodeReference,
+	evaluateWasm as public6_evaluateWasm,
+	executeComputation as public1_executeComputation,
+	exportAuthenticatedReference as public5_exportAuthenticatedReference,
+	inspectAuthenticatedReference as public4_inspectAuthenticatedReference,
+	inspectReference as public5_inspectReference,
+	invokeSigningPort as public1_invokeSigningPort,
+	invokeSigningPort as public4_invokeSigningPort,
+	landPlaceActInProcess as public2_landPlaceActInProcess,
+	landRootLotInProcess as public2_landRootLotInProcess,
+	moduleSnapshot as public3_moduleSnapshot,
+	nativeHostInstrument as public2_nativeHostInstrument,
+	nativePlaceActPersistence as public2_nativePlaceActPersistence,
+	nativePlaceActReceiver as public2_nativePlaceActReceiver,
+	objectFold as public1_objectFold,
+	objectFoldBytes as public1_objectFoldBytes,
+	openAuthenticatedReference as public5_openAuthenticatedReference,
+	preflight as public6_preflight,
+	prepareNativeReadingIdentity as public2_prepareNativeReadingIdentity,
+	prepareNativeViewIdentity as public2_prepareNativeViewIdentity,
+	readContent as public1_readContent,
+	readContent as public4_readContent,
+	readContextualStandingInProcess as public2_readContextualStandingInProcess,
+	readRefusalCatalog as public1_readRefusalCatalog,
+	readRefusalCatalog as public4_readRefusalCatalog,
+	readRootStandingInProcess as public2_readRootStandingInProcess,
+	recoverPlaceActInProcess as public2_recoverPlaceActInProcess,
+	recoverRootActInProcess as public2_recoverRootActInProcess,
+	retainContent as public1_retainContent,
+	retainContent as public4_retainContent,
+	rootLotSnapshot as public2_rootLotSnapshot,
+	runConformance as public1_runConformance,
+	runWasmRequest as public6_runWasmRequest,
+	verifyComputation as public1_verifyComputation,
+	verifyModuleDelivery as public3_verifyModuleDelivery,
+};
+
+export {};