@lapxo/bound 0.2.4 → 0.2.6

package/dist/public-types.d.ts

@@ -0,0 +1,2019 @@
+/** Stable code assigned at the cause. Details are diagnostic, never parsed as policy. */
+declare class BoundRefusal extends Error {
+	readonly code: string;
+	constructor(code: string, diagnostic: string);
+}
+declare const PLACE_ACT_CONTEXT = "place-act-context@1";
+declare const nativeAuthorityRequestIdentity: (action: NativeAuthorityAction) => string;
+declare const profileDigest: (bytes: string) => string;
+/** Snapshot identity, not a new wire, authority algorithm or current permit. */
+declare const rootLotSnapshot: (root: string) => string;
+/** The verifier is the actual rerun above, never a callback from card bytes. */
+declare function answerNativeAuthorityCard(card: AuthorityCard, request: string, context: NativeAuthorityCardContext): Promise<{
+	kind: "refuse";
+	code: string;
+	diagnostic: string;
+} | {
+	status: "refused";
+	code: "not-in-card";
+	next: "request-card-entry";
+	needs?: undefined;
+	decision?: undefined;
+	source?: undefined;
+} | {
+	status: "open";
+	needs: readonly [
+		"authority-card/verified-judgment"
+	];
+	code?: undefined;
+	next?: undefined;
+	decision?: undefined;
+	source?: undefined;
+} | {
+	status: "observed";
+	decision: "allow" | "ask" | "deny";
+	source: "consumer-verified-judgment";
+	code?: undefined;
+	next?: undefined;
+	needs?: undefined;
+} | {
+	status: "refused";
+	code: "card-stale";
+	next: "refresh-card";
+}>;
+/** Exact result bindings, declared producer authorization, and proof verification are independent checks. */
+declare function authenticatePhysicalLinesWitness(reading: PhysicalLinesReading, line: string, authority: PhysicalLinesWitnessAuthority): string;
+declare function authorityOf(fields: Readonly<Record<string, string>>, signers: readonly Signer[], verify: Verify, published?: Published): SignerVerdict;
+/** Resolve pinned declarations, then reuse the consumer's current signature,
+ * window, region coverage and widening judge. This prepares a lot; it never lands it. */
+declare function composeProfile(request: ProfileCompositionRequest): {
+	status: "prepared";
+	digest: string;
+	inspection: {
+		status: "declared";
+		fields: {
+			coordinate: string;
+			composition: "compatible" | "incompatible" | "unread";
+			transition: string;
+			witness: boolean;
+		}[];
+		pins: CategoryPin[];
+		needs: string[];
+		authority: "not established";
+	};
+	lines: string[];
+	pins: CategoryPin[];
+	releases: readonly string[];
+};
+declare function decodeReference(fragment: string): StandingReference;
+/** The host selects already authenticated snapshots and resolution, never the
+ * offered program. This prepares unchanged ESM files, not a JS sandbox, signer,
+ * browser host or symbol-pruning bundler. Native loading boundaries remain separately declared.
+ */
+declare function deliverModuleClosure(needs: readonly string[], entries: ReadonlyMap<string, ModuleClosureSnapshot>, library: Library, limits: ClosureDeliveryLimits, notices?: readonly ClosureNotice[]): ClosureDelivery;
+declare function describeRefusal(error: BoundRefusal, catalog: readonly RefusalEntry[]): RefusalEntry;
+declare function digest(bytes: Uint8Array): Promise<string>;
+declare function encodeReference(reference: StandingReference): string;
+declare function evaluateWasm(request: WasmRequest, { workerFactory, signal, lifetimeMs }: {
+	readonly workerFactory?: () => WorkerPort;
+	readonly signal?: AbortSignal;
+	readonly lifetimeMs: number;
+}): Promise<WasmResult>;
+/** Receiver-owned ports only. No private key, clock, filesystem or transport is
+ * available to this operation. Each port is separately bounded and cancellable. */
+declare function executeComputation(context: ComputationContext, input: Uint8Array, ports: {
+	readonly digest: DigestPort;
+	readonly evaluate: ByteComputationPort;
+	readonly sign: SigningPort;
+	readonly verify: SignatureVerificationPort;
+}, limits: PortLimits, signal?: AbortSignal): Promise<{
+	readonly statement: ComputationStatement;
+	readonly output: Uint8Array;
+}>;
+/** Signs a public snapshot proof; never lands, refreshes evidence or changes the Root. */
+declare function exportAuthenticatedReference(root: string, source: string, options?: {
+	readonly key?: string;
+	readonly keyFile?: string;
+	readonly signer?: string;
+	readonly hostSigner?: {
+		readonly name: string;
+		readonly sign: SigningPort;
+	};
+}): Promise<{
+	profile: string;
+	reference: string;
+	carrier: string;
+	context: {
+		snapshot: string;
+		profile: string;
+		semanticIdentity: string;
+		epoch: number;
+		proofScope: string;
+		policy: string;
+		formImplementation: string;
+		signers: readonly Signer[];
+		algorithms: readonly string[];
+		contracts: {
+			refusals: string;
+			standing: string;
+		};
+		maxBytes: number;
+		maxRecords: number;
+	};
+}>;
+/** Prospective authenticated-standing@1 host composition; no effects and no authority from transport. */
+declare function inspectAuthenticatedReference(fragment: string, trust: ReferenceTrust): Promise<{
+	contracts?: {
+		refusals: string;
+		standing: string;
+	} | undefined;
+	reference: StandingReference;
+	records: readonly ObjectRecord[];
+	semanticIdentity: string;
+	authorityContextIdentity: string;
+	semanticStanding: string;
+	originalRecords: readonly string[];
+}>;
+declare function inspectReference(fragment: string, policy: readonly string[], options?: HTTPOptions): Promise<{
+	reference: StandingReference;
+	lines: readonly string[];
+	standing: string;
+	authentication: string;
+} | {
+	kind: "needs";
+	reference: LocatedReference;
+	identity: string;
+	needs: string;
+	authentication: "not demonstrated; inspect only";
+} | {
+	reference: LocatedReference;
+	authentication: "not demonstrated; inspect only";
+	kind: "present";
+	identity: string;
+	standing: string;
+	lines: readonly string[];
+}>;
+/** A declared preview is inspected independently of content and authority; never fetched or substituted. */
+declare function inspectReferencePreview(line: string, budget: RecordBudget, maxInlineBytes: number): {
+	status: "declared";
+	referenceIdentity: string;
+	projection: {
+		readonly profile: string;
+		readonly text: string;
+		readonly digest: string;
+	} | null;
+	relations: readonly {
+		readonly relation: string;
+		readonly target: string;
+	}[];
+	needs: string[];
+	projectionCompleteness: "not demonstrated";
+	authentication: "not verified";
+	fragmentPrivacy: "not promised";
+};
+/** Receiver-selected complete installed bytes; the physical root never enters this digest. */
+declare function installedHostInstrument(request: InstalledPackageRequest, entry: string): NativeHostInstrument & {
+	readonly digest: string;
+};
+/** Identity of a complete installed byte snapshot and its selected consumed module
+ * closure. Reuses the package export proof, file closure and verified inventory;
+ * no compiler, execution, archive reconstruction or package discovery. */
+declare function installedPackageIdentity(request: InstalledPackageRequest): {
+	format: "bound-installed-package/1";
+	digest: string;
+	lines: string;
+	snapshot: string;
+	manifest: string;
+	members: number;
+	bytes: number;
+	exportInventory: readonly string[];
+	modules: ModuleInventory;
+	delivery: ClosureDelivery;
+	consumedPins: {
+		specifier: string;
+		parent: string;
+		snapshot: string;
+		source: string;
+		version: string;
+	}[];
+};
+/** Acquire canonical line signatures only. The line protocol is not widened
+ * for contextual receipt frames. Both operations share bounds and response checks. */
+declare function invokeSigningPort(lot: SigningLot, sign: SigningPort, limits: PortLimits, signal?: AbortSignal): Promise<readonly SignatureRecord[]>;
+/** This adapter delegates all threshold and widening decisions to the existing Bound judges. */
+declare function judgePhysicalLines(input: {
+	readonly reading: PhysicalLinesReading;
+	readonly standing: readonly string[];
+	readonly proposed: readonly string[];
+	readonly witness?: string;
+	readonly authority?: PhysicalLinesWitnessAuthority;
+}): {
+	status: "BLOCK" | "UNMEASURED" | "READY";
+	rejected: string[];
+	unmeasured: {
+		scope: string;
+		cause: string;
+		selectors: readonly string[];
+	}[];
+	stray: any[];
+	observations: {
+		scope: string;
+		file?: string;
+		value: string;
+	}[];
+	thresholds: CeilingFold[];
+	reading: string;
+};
+/** Signs receiver receipts through the bounded existing signer protocol. Exact
+ * original declarations/proofs remain unchanged. Replay is historical recovery,
+ * never a new permission. A refusal after visibility is not a rollback claim. */
+declare function landPlaceActInProcess(context: PlaceActHostContext, ports: PlaceActHostPorts): Promise<{
+	kind: "fact";
+	value: {
+		place: string;
+		act: PlaceActBundle & {
+			readonly kind: "landed" | "once";
+			readonly identity: string;
+		};
+		reading: string;
+		result: string;
+		commitment: string;
+	};
+	identity?: undefined;
+	code?: undefined;
+	diagnostic?: undefined;
+} | {
+	kind: "uncertain";
+	identity: string;
+	code: string;
+	diagnostic: string;
+	value?: undefined;
+} | {
+	kind: "refuse";
+	code: string;
+	diagnostic: string;
+	value?: undefined;
+	identity?: undefined;
+}>;
+declare function landRootLotInProcess(context: RootLotContext, ports: RootLotPorts): Promise<{
+	kind: "refuse";
+	code: string;
+	diagnostics: {
+		stream: "out" | "error";
+		text: string;
+	}[];
+	value?: undefined;
+	identity?: undefined;
+	diagnostic?: undefined;
+} | {
+	kind: "fact";
+	value: {
+		result: string;
+		commitment: string;
+		conformance: "refused" | "complete";
+		reading: string;
+		identity?: string | undefined;
+		act?: ActResult | undefined;
+		place: string;
+		status: "once" | "landed" | "already-held";
+	};
+	diagnostics: {
+		stream: "out" | "error";
+		text: string;
+	}[];
+	code?: undefined;
+	identity?: undefined;
+	diagnostic?: undefined;
+} | {
+	kind: "uncertain";
+	identity: string;
+	code: string;
+	diagnostic: string;
+	diagnostics: {
+		stream: "out" | "error";
+		text: string;
+	}[];
+	value?: undefined;
+} | {
+	kind: "fact";
+	value: {
+		place: string;
+		status: "once" | "landed";
+		identity: string;
+		conformance: "incomplete";
+	};
+	diagnostic: string;
+	diagnostics: {
+		stream: "out" | "error";
+		text: string;
+	}[];
+	code?: undefined;
+	identity?: undefined;
+} | {
+	kind: "refuse";
+	code: string;
+	diagnostic: string;
+	diagnostics: {
+		stream: "out" | "error";
+		text: string;
+	}[];
+	value?: undefined;
+	identity?: undefined;
+}>;
+/** Project a verified delivery without a second traversal, I/O, compilation,
+ * source transformation or execution. Notices remain in the delivery, separate
+ * from executable module units. Extra source declarations cannot add modules.
+ */
+declare function moduleInventory(bytes: Uint8Array, expected: string, limits: ClosureDeliveryLimits, sources: readonly ModuleInventorySource[], context: ModuleInventoryContext): ModuleInventory;
+/** Host-selected archive and entry, never a verifier assertion from the program.
+ * This proves content identity only; standing admission and runtime capabilities
+ * are separate prerequisites. Binary resources are not executable text members.
+ */
+declare function moduleSnapshot(archive: Uint8Array, expected: string, entry: string): ModuleClosureSnapshot;
+/** The receiver supplies Root and implementation. Only authenticated selection
+ * chooses a bounded local request; document bytes supply neither authority. */
+declare function nativeAuthorityCardView(root: string, instrument: NativeHostInstrument, scope: string): Promise<{
+	kind: "fact";
+	value: NativeAuthorityCardValue;
+} | {
+	kind: "refuse";
+	code: string;
+	diagnostic: string;
+}>;
+/** The consumer supplies the environment. Ambient preload/loader and libuv
+ * controls cannot cross the fixed host boundary. Values are never logged. */
+declare function nativeHostEnvironment(input: Readonly<Record<string, string | undefined>>): Record<string, string>;
+/** Explicit installed/source ESM selection, never consumer argv or packet data.
+ * Identity and public configuration do not certify implementation correctness. */
+declare function nativeHostInstrument(root: string, entry: string): NativeHostInstrument;
+/** Context, exact original bytes and complete signed receipts have one visibility
+ * point. Real Root guard exclusion spans final authority/head comparison and
+ * publication; this does not activate a CLI profile or reinterpret local-act@1. */
+/** Native persistence adapter. The transaction below is also the CLI path. */
+declare function nativePlaceActPersistence(store: string, storage?: PublicationStorage): PlaceActPersistence;
+/** Bind existing native authority construction to an explicit instrument for
+ * every later current/historical observation, not only the constructor call. */
+declare function nativePlaceActReceiver(root: string, instrument: NativeHostInstrument): {
+	selection: HostClockSelection;
+	trust: {
+		current: () => PlaceActSnapshot;
+		historical: (encoded: string) => TrustedClockContract;
+		contract: TrustedClockContract;
+		initialHeads: readonly PlaceActHead[];
+	};
+};
+declare function objectFold(records: readonly ObjectRecord[], context: ObjectContext): readonly ObjectReading[];
+/** Portable byte profile. Context and admission callbacks belong to the
+ * receiver, never to a requested vector or downloaded place. */
+declare function objectFoldBytes(input: Uint8Array, context: ObjectContext): Uint8Array;
+declare function openAuthenticatedReference(root: string, fragment: string, options?: {
+	readonly signal?: AbortSignal;
+	readonly content?: {
+		readonly name: string;
+		readonly read: ContentReadPort;
+	};
+}): Promise<{
+	backend: string;
+	readings: readonly ObjectReading[];
+	contracts?: {
+		refusals: string;
+		standing: string;
+	} | undefined;
+	reference: StandingReference;
+	records: readonly ObjectRecord[];
+	semanticIdentity: string;
+	authorityContextIdentity: string;
+	semanticStanding: string;
+	originalRecords: readonly string[];
+}>;
+declare function parseNativeAuthorityCardRequest(text: string, expectedDigest: string, limits: RecordBudget): NativeAuthorityCardRequest;
+/** Projects region selectors from already admitted standing; parsing grants no authority. */
+declare function physicalLinesRegions(standing: readonly string[]): readonly PhysicalLinesRegion[];
+declare function preflight(request: WasmRequest): void;
+/** Read-only, freshly authenticated native preflight. This does not grant an act. */
+declare function prepareNativeAuthorityCard(context: NativeAuthorityCardContext, issuedAt?: number): Promise<{
+	kind: "fact";
+	value: NativeAuthorityCardValue;
+} | {
+	kind: "refuse";
+	code: string;
+	diagnostic: string;
+}>;
+/** A recognized public reading of the existing captured native projection.
+ * No fold, evaluator, retained-result cache or persistent receipt is entered.
+ * A charged attempt stays charged even if the selected projection refuses. */
+declare function prepareNativeProbe(context: NativeProbeContext): NativeProbeResult;
+/** Receiver-selected instrument and admitted Root; no consumer-owned verifier or directory fingerprint. */
+declare function prepareNativeReadingIdentity(context: NativeReadingIdentityContext): Promise<NativeReadingIdentityResult>;
+/** Each view retains its own input identity. A batch shares one fresh observation,
+ * never a persistent cache, and returns nothing if any selection or check fails. */
+declare function prepareNativeViewIdentities(context: NativeViewIdentitiesContext): NativeViewIdentitiesResult;
+/** Prepare only native configuration projections. No foldPlace, observation,
+ * executable reader, resolver, persistence, lease or Root exclusion is entered.
+ * The returned text and identity share one immutable committed observation. */
+declare function prepareNativeViewIdentity(context: NativeViewIdentityContext): NativeViewIdentityResult;
+declare function readContent(source: string, digest: string, ports: {
+	readonly read: ContentReadPort;
+	readonly digestBytes: DigestPort;
+}, limits: PortLimits, signal?: AbortSignal): Promise<Uint8Array>;
+/** Full contextual carrier, authenticated against receiver inputs only. It is a
+ * data projection, not a current admission permit or a signed receipt. */
+declare function readContextualStandingInProcess(context: RootStandingHostContext, ports: {
+	readonly read: ContentReadPort;
+}): Promise<{
+	kind: "fact";
+	value: {
+		place: string;
+		standing: {
+			profile: string;
+			root: readonly string[];
+			legacyPlaces: {
+				namespace: string;
+				place: string;
+				standing: string[];
+				history: readonly string[];
+			}[];
+			contexts: readonly PortablePlaceContext[];
+			places: {
+				namespace: string;
+				place: string;
+				standing: string[];
+				retracted: readonly string[];
+				superseded: readonly string[];
+				forks: readonly Fork[];
+				contexts: {
+					identity: string;
+					context: string;
+					receipts: readonly PlaceReceipt[];
+				}[];
+			}[];
+		};
+		reading: string;
+		result: string;
+		commitment: string;
+	};
+	code?: undefined;
+	diagnostic?: undefined;
+} | {
+	kind: "refuse";
+	code: string;
+	diagnostic: string;
+	value?: undefined;
+}>;
+/** Reads an actual finite inventory. Links and special files are named rather than silently omitted. */
+declare function readPlacePhysicalLines(input: PhysicalLinesPlaceInput): {
+	status: "unmeasured";
+	cause: "region-measure/budget";
+	required: string;
+	workUnit: "declared-input-rows";
+	model?: undefined;
+	unit?: undefined;
+	arithmetic?: undefined;
+	readings?: undefined;
+	union?: undefined;
+	sumOfRegions?: undefined;
+	overlapExcess?: undefined;
+	disjointBySupport?: undefined;
+	overlaps?: undefined;
+	unassigned?: undefined;
+	work?: undefined;
+} | {
+	status: "unmeasured";
+	cause: "physical-lines/byte-budget";
+	required: string;
+	workUnit: "input-bytes";
+	profile?: undefined;
+	snapshot?: undefined;
+	model?: undefined;
+	policy?: undefined;
+	textDomain?: undefined;
+	inputFiles?: undefined;
+	regions?: undefined;
+	valuation?: undefined;
+	work?: undefined;
+	verification?: undefined;
+} | {
+	status: "unmeasured";
+	cause: "physical-lines/selection-budget";
+	required: string;
+	workUnit: "selector-code-units-times-candidates";
+	profile?: undefined;
+	snapshot?: undefined;
+	model?: undefined;
+	policy?: undefined;
+	textDomain?: undefined;
+	inputFiles?: undefined;
+	regions?: undefined;
+	valuation?: undefined;
+	work?: undefined;
+	verification?: undefined;
+} | {
+	status: "read";
+	identity: string;
+	bindings: {
+		contract: "sha256:636ace16eeaa46eafb7b07c28d1d57916bc9108b188e96b5a8bf7bed6dc15707";
+		model: string;
+		params: string;
+		inputs: string;
+		selection: string;
+		unit: string;
+		scale: string;
+		resolution: string;
+		reader: string;
+		implementation: string;
+		context: string;
+		run: string;
+		result: string;
+		reading: string;
+	};
+	reading: {
+		status: "read";
+		profile: "topos-physical-lines/1";
+		snapshot: string;
+		model: {
+			readonly name: "finite-nonnegative-atomic-valuation@1";
+			readonly contract: "sha256:636ace16eeaa46eafb7b07c28d1d57916bc9108b188e96b5a8bf7bed6dc15707";
+			readonly implementation: "sha256:ef7e39d0ac44b0dd3d4b68220d3c381f737eb2729d0017ed3271ce119d408b13";
+		};
+		policy: {
+			byteBudget: string;
+			rowBudget: string;
+		};
+		textDomain: "utf8-lf-crlf-reject-isolated-cr@1";
+		inputFiles: {
+			name: any;
+			digest: any;
+		}[];
+		regions: ({
+			status: "measured";
+			value: Readonly<{
+				numerator: string;
+				denominator: string;
+			}>;
+			scope: string;
+			selectors: string[];
+			selections: ({
+				selector: string;
+				members: any[];
+				status: "selected";
+				cause?: undefined;
+			} | {
+				selector: string;
+				members: any[];
+				status: "unmeasured";
+				cause: "selector-no-match";
+			})[];
+			members: any[];
+		} | {
+			status: "unmeasured";
+			cause: "selector-no-match";
+			scope: string;
+			selectors: string[];
+			selections: ({
+				selector: string;
+				members: any[];
+				status: "selected";
+				cause?: undefined;
+			} | {
+				selector: string;
+				members: any[];
+				status: "unmeasured";
+				cause: "selector-no-match";
+			})[];
+			members: any[];
+		})[];
+		valuation: {
+			status: "measured";
+			model: "finite-nonnegative-atomic-valuation@1";
+			unit: string;
+			arithmetic: "exact-rational";
+			readings: {
+				region: any;
+				members: string[];
+				value: Readonly<{
+					numerator: string;
+					denominator: string;
+				}>;
+			}[];
+			union: {
+				members: string[];
+				value: Readonly<{
+					numerator: string;
+					denominator: string;
+				}>;
+			};
+			sumOfRegions: Readonly<{
+				numerator: string;
+				denominator: string;
+			}>;
+			overlapExcess: Readonly<{
+				numerator: string;
+				denominator: string;
+			}>;
+			disjointBySupport: boolean;
+			overlaps: {
+				atom: string;
+				regions: string[];
+			}[];
+			unassigned: string[];
+			work: {
+				unit: "declared-input-rows";
+				required: string;
+			};
+			cause?: undefined;
+			required?: undefined;
+			workUnit?: undefined;
+		};
+		work: {
+			inputBytes: string;
+			selectionUnits: string;
+		};
+		verification: "supplied inventory and snapshot; authority and completeness are consumer obligations";
+		cause?: undefined;
+		required?: undefined;
+		workUnit?: undefined;
+	};
+	perFile: {
+		status: "read";
+		profile: "topos-physical-lines/1";
+		snapshot: string;
+		model: {
+			readonly name: "finite-nonnegative-atomic-valuation@1";
+			readonly contract: "sha256:636ace16eeaa46eafb7b07c28d1d57916bc9108b188e96b5a8bf7bed6dc15707";
+			readonly implementation: "sha256:ef7e39d0ac44b0dd3d4b68220d3c381f737eb2729d0017ed3271ce119d408b13";
+		};
+		policy: {
+			byteBudget: string;
+			rowBudget: string;
+		};
+		textDomain: "utf8-lf-crlf-reject-isolated-cr@1";
+		inputFiles: {
+			name: any;
+			digest: any;
+		}[];
+		regions: ({
+			status: "measured";
+			value: Readonly<{
+				numerator: string;
+				denominator: string;
+			}>;
+			scope: string;
+			selectors: string[];
+			selections: ({
+				selector: string;
+				members: any[];
+				status: "selected";
+				cause?: undefined;
+			} | {
+				selector: string;
+				members: any[];
+				status: "unmeasured";
+				cause: "selector-no-match";
+			})[];
+			members: any[];
+		} | {
+			status: "unmeasured";
+			cause: "selector-no-match";
+			scope: string;
+			selectors: string[];
+			selections: ({
+				selector: string;
+				members: any[];
+				status: "selected";
+				cause?: undefined;
+			} | {
+				selector: string;
+				members: any[];
+				status: "unmeasured";
+				cause: "selector-no-match";
+			})[];
+			members: any[];
+		})[];
+		valuation: {
+			status: "measured";
+			model: "finite-nonnegative-atomic-valuation@1";
+			unit: string;
+			arithmetic: "exact-rational";
+			readings: {
+				region: any;
+				members: string[];
+				value: Readonly<{
+					numerator: string;
+					denominator: string;
+				}>;
+			}[];
+			union: {
+				members: string[];
+				value: Readonly<{
+					numerator: string;
+					denominator: string;
+				}>;
+			};
+			sumOfRegions: Readonly<{
+				numerator: string;
+				denominator: string;
+			}>;
+			overlapExcess: Readonly<{
+				numerator: string;
+				denominator: string;
+			}>;
+			disjointBySupport: boolean;
+			overlaps: {
+				atom: string;
+				regions: string[];
+			}[];
+			unassigned: string[];
+			work: {
+				unit: "declared-input-rows";
+				required: string;
+			};
+			cause?: undefined;
+			required?: undefined;
+			workUnit?: undefined;
+		};
+		work: {
+			inputBytes: string;
+			selectionUnits: string;
+		};
+		verification: "supplied inventory and snapshot; authority and completeness are consumer obligations";
+		cause?: undefined;
+		required?: undefined;
+		workUnit?: undefined;
+	};
+	stray: any[];
+} | {
+	status: "unmeasured";
+	cause: string;
+	unavailable: {
+		name: string;
+		cause: string;
+	}[];
+};
+declare function readRefusalCatalog(text: string): readonly RefusalEntry[];
+/** Uses the existing bounded content port, authority evaluator and projection.
+ * It projects the Root component of a complete signed Root wire snapshot; it has no persistence callback,
+ * current-root global, console output, process entry point or CLI subprocess.
+ * Contextual places and their carriers are not this Root-only projection.
+ * The returned commitment is unsigned and is not a paid native receipt.
+ */
+declare function readRootStandingInProcess(context: RootStandingHostContext, ports: {
+	readonly read: ContentReadPort;
+}): Promise<RootStandingHostResult>;
+/** Historical recovery after a lost response. No signer, current authorization
+ * or publication callback is invoked and the result grants no new act. */
+declare function recoverPlaceActInProcess(context: Pick<PlaceActHostContext, "place" | "identity" | "reading" | "storageLimits" | "signal">, ports: Pick<PlaceActHostPorts, "instrumentName" | "trust" | "persistence" | "limits">): {
+	kind: "fact";
+	value: {
+		place: string;
+		identity: string;
+		act: PlaceActBundle;
+		historical: true;
+		reading: string;
+		result: string;
+		commitment: string;
+	};
+	code?: undefined;
+	diagnostic?: undefined;
+} | {
+	kind: "refuse";
+	code: string;
+	diagnostic: string;
+	value?: undefined;
+};
+/** Authenticated historical query only; never revives authority or signs. */
+declare function recoverRootActInProcess(identity: string, ports: Pick<RootLotPorts, "root" | "instrumentName" | "runtime">): {
+	kind: "fact";
+	value: {
+		historical: true;
+		act: ActResult;
+		bundle: LocalActBundle;
+	};
+	code?: undefined;
+	diagnostic?: undefined;
+} | {
+	kind: "refuse";
+	code: string;
+	diagnostic: string;
+	value?: undefined;
+};
+/** Exact declared category selection, with no code-family or scope-prefix rule. */
+declare function releaseCategoryPins(pins: readonly CategoryPin[], categories: readonly ReleaseCategory[], standing: readonly string[]): readonly string[];
+/** Verify before invoking retention; no operation automatically writes the projected result. */
+declare function retainContent(digest: string, bytes: Uint8Array, ports: {
+	readonly retain: PersistencePort;
+	readonly digestBytes: DigestPort;
+}, limits: PortLimits, signal?: AbortSignal): Promise<{
+	readonly digest: string;
+	readonly bytes: number;
+}>;
+/** A pinned suite is data. Only the receiver chooses its contract, required
+ * coverage and candidate; a candidate's own list cannot certify completeness. */
+declare function runConformance(bytes: Uint8Array, receiver: ConformanceReceiver, ports: {
+	readonly digest: DigestPort;
+	readonly evaluate: ByteComputationPort;
+}, limits: PortLimits & {
+	readonly maxCases: number;
+}, signal?: AbortSignal): Promise<ConformanceReport>;
+declare function runWasmRequest(request: WasmRequest): Promise<WasmResult>;
+/** One consumer-owned native dispatcher, not a daemon or a second interpreter.
+ * The child exits on IPC disconnect, including an ungraceful client exit. */
+declare function startNativeHost(options: NativeHostOptions): Promise<NativeCommandHost>;
+declare function validateObjectContext(records: readonly ObjectRecord[], context: ObjectContext): Outcome<readonly ObjectRecord[]>;
+/** The receiver supplies the expected implementation, question, policy,
+ * environment and verification port. The carrier cannot choose any of them. */
+declare function verifyComputation(context: ComputationContext, input: Uint8Array, output: Uint8Array, claim: ComputationStatement, ports: {
+	readonly digest: DigestPort;
+	readonly verify: SignatureVerificationPort;
+}, limits: PortLimits, signal?: AbortSignal): Promise<ComputationStatement>;
+/** Verify exact pinned delivery bytes and run the same pre-execution closure
+ * verifier again over the delivered set. No callbacks, install paths or verifier
+ * chosen by the payload. The returned import map is derived, never trusted input.
+ */
+declare function verifyModuleDelivery(bytes: Uint8Array, expected: string, limits: ClosureDeliveryLimits): ClosureDelivery;
+interface ActResult {
+	readonly identity: string;
+	readonly epoch: number;
+	readonly records: readonly string[];
+	readonly receipt: string;
+}
+interface AuthorityCard {
+	readonly place: string;
+	readonly snapshot: string;
+	readonly key: string;
+	readonly authority: string;
+	readonly coverage: string;
+	readonly policy: string;
+	readonly budget: string;
+	readonly catalog: string;
+	readonly standingContract: string;
+	readonly grants: readonly string[];
+	readonly retirements: readonly string[];
+	readonly demands: readonly string[];
+	readonly horizon: RegistryHorizon;
+	readonly issuedAt: number;
+	readonly actions: readonly {
+		readonly request: string;
+		readonly decision: "allow" | "ask" | "deny";
+	}[];
+	readonly evidence: string;
+}
+interface CategoryPin {
+	readonly category: string;
+	readonly class: string;
+	readonly algorithm: "sha256";
+	readonly digest: string;
+}
+interface CeilingFold {
+	readonly read: readonly string[];
+	readonly over: readonly {
+		readonly ceiling: string;
+		readonly question: string;
+		readonly got: string;
+		readonly side: Side;
+	}[];
+	readonly unread: readonly string[];
+	readonly vacuous: readonly string[];
+	readonly readings: ReadonlyMap<string, readonly string[]>;
+}
+interface Cell<T> {
+	readonly floor: T;
+	readonly ceiling: T;
+	readonly origins: readonly Claim<T>[];
+	readonly rest: readonly string[];
+	readonly required: T;
+	readonly signed: T;
+}
+interface Claim<T> {
+	readonly origin: string;
+	readonly span: T;
+	readonly id?: string;
+	readonly at?: number;
+	readonly sign?: Act;
+	readonly takes?: string;
+	readonly phase?: number;
+}
+interface ClockBudget {
+	readonly bytes: number;
+	readonly records: number;
+	readonly placements: number;
+	readonly policies: number;
+	readonly proofs: number;
+	readonly signers: number;
+}
+interface ClosureDelivery {
+	readonly closure: string;
+	readonly digest: string;
+	readonly bytes: Uint8Array;
+	readonly manifest: ClosureDeliveryManifest;
+	readonly files: readonly {
+		path: string;
+		source: string;
+	}[];
+	readonly importMap: {
+		imports: Record<string, string>;
+		scopes: Record<string, Record<string, string>>;
+	};
+}
+interface ClosureDeliveryLimits extends Omit<ModuleClosureLimits, "portableESM"> {
+	readonly responseBytes: number;
+}
+interface ClosureDeliveryManifest {
+	readonly format: "esm-file-closure/1";
+	readonly needs: readonly {
+		name: string;
+		snapshot: string;
+		entry: string;
+	}[];
+	readonly modules: readonly {
+		snapshot: string;
+		coordinate: string;
+		digest: string;
+		path: string;
+	}[];
+	readonly libraries: readonly {
+		parent: string;
+		specifier: string;
+		snapshot: string;
+		entry: string;
+	}[];
+	readonly notices: readonly {
+		snapshot: string;
+		coordinate: string;
+		digest: string;
+		path: string;
+	}[];
+}
+interface ClosureNotice {
+	readonly snapshot: string;
+	readonly coordinate: string;
+	readonly digest: string;
+	readonly source: string;
+}
+interface ComputationContext {
+	readonly contract: string;
+	readonly numericPolicy: string;
+	readonly reading: ReadingIdentityContext;
+	readonly keyId: string;
+	readonly algorithm: string;
+}
+interface ComputationStatement {
+	readonly profile: "bound-computation@1";
+	readonly question: string;
+	readonly reading: string;
+	readonly origin: string;
+	readonly result: string;
+	readonly commitment: string;
+	readonly keyId: string;
+	readonly algorithm: string;
+	readonly signature: string;
+}
+interface ConformanceCase {
+	readonly id: string;
+	readonly covers: readonly string[];
+	readonly request: string;
+	readonly expected: string;
+}
+interface ConformanceReceiver {
+	readonly suite: string;
+	readonly implementation: string;
+	readonly contract: string;
+	readonly rules: readonly string[];
+	readonly refusals: readonly string[];
+}
+interface ConformanceReport {
+	readonly profile: "bound-conformance-report@1";
+	readonly suite: string;
+	readonly implementation: string;
+	readonly contract: string;
+	readonly met: boolean;
+	readonly cases: readonly {
+		readonly id: string;
+		readonly met: boolean;
+		readonly response: string;
+	}[];
+	readonly commitment: string;
+}
+interface ConformanceSuite {
+	readonly profile: "bound-conformance@1";
+	readonly contract: string;
+	readonly cases: readonly ConformanceCase[];
+}
+interface Fork {
+	readonly key: string;
+	readonly lines: readonly string[];
+	readonly state?: string;
+}
+interface HTTPOptions {
+	readonly signal?: AbortSignal;
+	readonly allowedOrigins?: readonly string[];
+}
+interface HostClockSelection {
+	readonly profile: typeof PLACE_ACT_CONTEXT;
+	readonly namespace: string;
+	readonly regionFamily: string;
+	readonly receiptSigner: string;
+	readonly receiptScope: string;
+	readonly digestAlgorithm: "sha256";
+	readonly budget: ClockBudget;
+	readonly storageBudget: PlaceActBudget;
+	readonly initial: readonly {
+		place: string;
+		receiver: {
+			identity: string;
+			epoch: string;
+		};
+		origin: {
+			prefix: string;
+			epoch: string;
+		};
+	}[];
+}
+/** Native operational selection from the receiver, never the offered content. */
+interface HostInstrumentRuntime {
+	readonly root: string;
+	readonly entry: string;
+	readonly directory: string;
+	readonly extension: ".ts" | ".js";
+	readonly lock: readonly string[];
+}
+interface InstalledPackageMember {
+	readonly coordinate: string;
+	readonly digest: string;
+}
+interface InstalledPackagePin extends ModuleInventorySource {
+	readonly specifier: string;
+	readonly parent: string;
+	readonly snapshot: string;
+	readonly module: ModuleClosureSnapshot;
+}
+interface InstalledPackageRequest {
+	readonly directory: string;
+	/** Shape selected by the receiving instrument's admitted pin-shape contract. */
+	readonly shape: string;
+	/** Complete authenticated file inventory, relative to the selected package root. */
+	readonly members: readonly InstalledPackageMember[];
+	/** Explicit package export selectors; symbols are never pruning units. */
+	readonly exports: readonly (readonly string[])[];
+	/** Already authenticated snapshots and resolution selected by the host. */
+	readonly pins: readonly InstalledPackagePin[];
+	readonly limits: ClosureDeliveryLimits;
+}
+interface JoinSemilattice<T> extends Poset<T> {
+	readonly bottom: T;
+	join(a: T, b: T): T;
+}
+interface Lattice<T> extends MeetSemilattice<T>, JoinSemilattice<T> {
+}
+interface LocalActBundle {
+	readonly records: string;
+	readonly receipt: string;
+	readonly placements?: readonly {
+		place: string;
+		records: string;
+	}[];
+}
+interface LocatedReference {
+	readonly class: "standing";
+	readonly algorithm: "sha256";
+	readonly digest: string;
+	readonly blob: string;
+	readonly location?: string;
+	readonly "location-class"?: "viewer" | "holder";
+}
+interface Mark<T> {
+	readonly pole: "floor" | "ceiling";
+	readonly reach: "local" | "travels";
+	readonly span: T;
+	readonly widens?: string;
+	readonly id?: string;
+	readonly at?: number;
+	readonly sign?: Act;
+	readonly takes?: string;
+}
+interface MeetSemilattice<T> extends Poset<T> {
+	readonly top: T;
+	meet(a: T, b: T): T;
+	inhabited(x: T): boolean;
+}
+interface ModuleClosureLimits {
+	readonly members: number;
+	readonly bytes: number;
+	readonly portableESM?: boolean;
+	readonly signal?: AbortSignal;
+}
+interface ModuleClosureMember {
+	readonly digest: string;
+	readonly source: string;
+}
+interface ModuleClosureSnapshot {
+	readonly identity: string;
+	readonly entry: string;
+	readonly members: ReadonlyMap<string, ModuleClosureMember>;
+}
+interface ModuleInventory {
+	readonly format: "verified-module-inventory/1";
+	readonly delivery: string;
+	readonly closure: string;
+	readonly modules: readonly ModuleInventoryLine[];
+	/** Existing canonical wire; descriptive module metadata stays in about. */
+	readonly lines: string;
+}
+interface ModuleInventoryContext {
+	readonly scope: string;
+	readonly by: string;
+	readonly at: string;
+}
+interface ModuleInventoryLine extends ModuleInventorySource {
+	readonly unit: "module";
+	readonly module: string;
+	readonly digest: string;
+	/** The verified closure which reached this module, not an immediate importer. */
+	readonly reachedFrom: string;
+}
+/** Source names and versions are declarations supplied by the receiving host.
+ * The snapshot pins their bytes; this projection does not authenticate a
+ * publisher's version claim or infer symbol reachability.
+ */
+interface ModuleInventorySource {
+	readonly snapshot: string;
+	readonly source: string;
+	readonly version: string;
+}
+interface NativeAuthorityAction {
+	readonly kind: "record-coverage" | "admission";
+	readonly records: readonly string[];
+}
+interface NativeAuthorityCardContext {
+	readonly root: string;
+	readonly place: string;
+	readonly key: string;
+	readonly instrument: NativeHostInstrument;
+	readonly authorityEpoch: number;
+	readonly clock: {
+		readonly name: string;
+		readonly unit: string;
+		readonly now: number;
+	};
+	readonly horizon: RegistryHorizon;
+	readonly limits: RecordBudget;
+	readonly actions: readonly NativeAuthorityAction[];
+}
+interface NativeAuthorityCardValue {
+	readonly card: AuthorityCard;
+	readonly line: string;
+	readonly identity: string;
+	readonly judgments: readonly NativeAuthorityJudgment[];
+	readonly needs: readonly string[];
+}
+interface NativeAuthorityJudgment {
+	readonly request: string;
+	readonly decision: "allow" | "ask" | "deny" | "open";
+	readonly evidence: readonly unknown[];
+	readonly needs: readonly string[];
+}
+interface NativeCommand {
+	readonly verb: "fold" | "sign" | "land";
+	readonly args: readonly string[];
+	readonly signer?: string;
+	readonly inputs?: readonly {
+		readonly name: string;
+		readonly text: string;
+	}[];
+}
+interface NativeCommandHost {
+	readonly pid: number;
+	readonly environment: Readonly<Record<string, string>>;
+	readonly flags: readonly string[];
+	request(command: NativeCommand, signal?: AbortSignal): Promise<NativeCommandResult>;
+	close(): Promise<void>;
+}
+interface NativeCommandResult {
+	readonly status: number;
+	readonly stdout: string;
+	readonly stderr: string;
+}
+interface NativeHostInstrument {
+	readonly name: string;
+	readonly runtime: HostInstrumentRuntime;
+	readonly installed?: {
+		readonly digest: string;
+		readonly request: InstalledPackageRequest;
+	};
+}
+interface NativeHostLimits {
+	readonly requestBytes: number;
+	readonly responseBytes: number;
+	readonly timeoutMs: number;
+	readonly heapMiB: number;
+	readonly queuedRequests: number;
+}
+interface NativeHostOptions {
+	readonly place: string;
+	readonly instrument: NativeHostInstrument;
+	readonly expectedInstrument: string;
+	readonly limits: NativeHostLimits;
+	readonly environment: Readonly<Record<string, string | undefined>>;
+	readonly scratchParent?: string;
+	readonly signer?: {
+		readonly keyId: string;
+		readonly name: string;
+		readonly sign: SigningPort;
+	};
+	readonly signers?: ReadonlyMap<string, {
+		readonly name: string;
+		readonly sign: SigningPort;
+	}>;
+}
+interface NativeProbeContext extends NativeViewIdentityContext {
+	readonly port: NativeProbePort;
+	readonly counter: NativeProbeCounter;
+	readonly signal?: AbortSignal;
+}
+/** This meter belongs to the consumer's operation. Keep it across calls and
+ * share it between requests using the same port. It is never persisted by Bound. */
+interface NativeProbeCounter {
+	readonly used: Map<string, number>;
+}
+interface NativeProbePort {
+	readonly coordinate: string;
+	readonly probes: number;
+	readonly responseBytes: number;
+}
+interface NativeReadingIdentityContext {
+	readonly place: string;
+	readonly instrument: NativeHostInstrument;
+	readonly limits: ReadingPreparationLimits;
+	readonly reader?: string;
+}
+interface NativeViewIdentitiesContext {
+	readonly place: string;
+	readonly instrument: NativeHostInstrument;
+	readonly views: readonly string[];
+	readonly expectedIdentities?: Readonly<Record<string, string>>;
+}
+interface NativeViewIdentityContext {
+	readonly place: string;
+	readonly instrument: NativeHostInstrument;
+	readonly view: string;
+	readonly expectedIdentity?: string;
+}
+/** Providers answer declared admission/selection questions; no domain parser lives here. */
+interface ObjectContext {
+	admit(record: ObjectRecord): boolean;
+	resolve(cell: ObjectRecord): SelectedObjectForm;
+	origin(origin: string, authority: string, scope: string): boolean;
+	witness(reference: string, authority: string, scope: string): boolean;
+}
+/** Projection dispatches admitted acts into Obligatory; it defines no meet or propagation. */
+interface ObjectReading {
+	cell: string;
+	state: string;
+	parts: Cell<unknown>;
+	rest: readonly string[];
+	ownMarks: readonly (string | undefined)[];
+	ownClaims: readonly {
+		id: string | undefined;
+		origin: string;
+	}[];
+	marks: readonly Mark<unknown>[];
+	claims: readonly unknown[];
+}
+interface ObjectRecord {
+	readonly record: "cell" | "claim" | "mark";
+	readonly fields: Readonly<Record<string, string>>;
+}
+interface PhysicalLinesPlaceInput {
+	readonly root: string;
+	/** Explicit inventory boundaries, also bound into the reading identity. No implicit exclusions. */
+	readonly inventory: readonly string[];
+	readonly regions: readonly PhysicalLinesRegion[];
+	readonly policy: PhysicalLinesPolicy;
+	readonly context: string;
+	readonly reader: string;
+	readonly implementation: string;
+	readonly run: string;
+}
+interface PhysicalLinesPolicy {
+	readonly byteBudget: string;
+	readonly rowBudget: string;
+	readonly entryBudget: number;
+}
+interface PhysicalLinesRegion {
+	readonly scope: string;
+	readonly selectors: readonly string[];
+}
+interface PhysicalLinesWitnessAuthority {
+	/** Supplied by the host from its admitted, current producer policy, never from the witness. */
+	readonly producers: readonly ReadingProducerPolicy[];
+	/** Must verify actual signature/coverage or CI evidence bytes over this exact statement. URL presence is insufficient. */
+	readonly verify: (input: {
+		readonly witness: ReadingWitness;
+		readonly statementBytes: string;
+		readonly producer: ReadingProducerPolicy;
+	}) => boolean;
+}
+interface PlaceActBudget {
+	readonly acts: number;
+	readonly bytes: number;
+}
+interface PlaceActBundle {
+	readonly context: string;
+	readonly receipts: readonly PlaceReceipt[];
+	readonly originals: readonly (readonly string[])[];
+}
+interface PlaceActHead {
+	readonly place: string;
+	readonly identity: string;
+	readonly epoch: string;
+}
+interface PlaceActHostContext {
+	readonly place: string;
+	readonly source: string;
+	readonly identity: string;
+	readonly rootSnapshot: string;
+	readonly reading: ReadingIdentityContext;
+	readonly algorithm: string;
+	readonly contentLimits: PortLimits;
+	readonly signingLimits: PortLimits;
+	readonly storageLimits: PlaceActBudget;
+	readonly signal?: AbortSignal;
+}
+/** These are receiver-selected host ports, not carrier fields or an offered
+ * verifier. Trust must be constructed from the authenticated receiver snapshot. */
+interface PlaceActHostPorts {
+	readonly instrumentName: string;
+	readonly read: ContentReadPort;
+	readonly sign: SigningPort;
+	readonly trust: () => PlaceActTrust;
+	readonly persistence: PlaceActPersistence;
+	readonly limits: {
+		readonly storage: PlaceActBudget;
+		readonly signing: PortLimits;
+		readonly content: PortLimits;
+	};
+}
+/** Host-selected persistence, never supplied by offered content. exclusive must
+ * share the CLI's region/authority/projection protocol. publish is synchronous
+ * with exactly one atomic visibility point; a thrown reply may follow commit. */
+interface PlaceActPersistence {
+	readonly exclusive: <T>(regions: readonly string[], run: () => Promise<T>) => Promise<T>;
+	readonly result: (identity: string, trust: PlaceActTrust, limits: PlaceActBudget) => PlaceActBundle | undefined;
+	readonly inventory: (limits: PlaceActBudget) => {
+		readonly names: readonly string[];
+		readonly bytes: number;
+	};
+	readonly heads: (trust: PlaceActTrust, limits: PlaceActBudget) => readonly PlaceActHead[];
+	readonly publish: (identity: string, files: Readonly<Record<string, string>>) => void;
+}
+interface PlaceActSnapshot {
+	readonly root: RootContext;
+	readonly heads: readonly PlaceActHead[];
+}
+/** Fixed instrument construction, never supplied by world JSON. Historical
+ * authentication permits inspection only; current() is read under Root guards. */
+interface PlaceActTrust {
+	readonly contract: TrustedClockContract;
+	readonly initialHeads: readonly PlaceActHead[];
+	readonly current: () => PlaceActSnapshot;
+	readonly historical: (encoded: string) => TrustedClockContract;
+}
+interface PlaceReceipt {
+	readonly by: string;
+	readonly place: string;
+	readonly signature: string;
+}
+interface PolicyField<T> {
+	readonly coordinate: string;
+	readonly mode: "meet" | "exact" | "own";
+	/** Values are interpreted by the selected form. Algebra is supplied by
+	 * Obligations, never reconstructed with interval endpoints here. */
+	readonly decode: (value: string) => T;
+	readonly lattice: MeetSemilattice<T>;
+	readonly inhabited: (value: T) => boolean;
+}
+interface PortLimits {
+	readonly timeoutMs: number;
+	readonly maxBytes: number;
+}
+interface PortablePlaceContext {
+	readonly identity: string;
+	readonly context: string;
+	readonly receipts: readonly PlaceReceipt[];
+	readonly authority: {
+		anchor: Signer;
+		history: readonly string[];
+		checkpoint: string;
+	};
+}
+interface Poset<T> {
+	leq(a: T, b: T): boolean;
+	show(x: T): string;
+}
+interface ProfileComposition {
+	readonly name: string;
+	readonly parents: readonly string[];
+	readonly fields: readonly {
+		readonly coordinate: string;
+		readonly contract: string;
+		readonly value: string;
+	}[];
+	readonly pins: readonly CategoryPin[];
+	readonly witnesses: readonly {
+		readonly coordinate: string;
+		readonly reading: ReadingWitness;
+	}[];
+}
+interface ProfileCompositionRequest {
+	readonly root: string;
+	readonly place: string;
+	readonly profile: ProfileComposition;
+	readonly profiles: ReadonlyMap<string, string>;
+	readonly fields: readonly ProfileFieldBinding[];
+	/** Original signed lines; drafts and parent bytes supply no authority. */
+	readonly statements: readonly string[];
+	readonly budget: RecordBudget;
+	readonly categories: readonly ReleaseCategory[];
+}
+interface ProfileFieldBinding {
+	readonly contract: string;
+	readonly field: PolicyField<unknown>;
+	readonly scope: string;
+	readonly role: "reads" | "writes";
+	readonly form: "interval" | "alphabet";
+	readonly measure: string;
+}
+interface PublicationStorage {
+	publish(staged: string, committed: string): void;
+}
+interface Published {
+	readonly digest: string;
+	readonly pins: readonly string[];
+}
+interface ReadingContext {
+	readonly class: "attest";
+	readonly reading: string;
+	readonly contract: string;
+	readonly model: string;
+	readonly params: string;
+	readonly inputs: string;
+	readonly selection: string;
+	readonly unit: string;
+	readonly scale: string;
+	readonly resolution: string;
+	readonly reader: string;
+	readonly implementation: string;
+	readonly context: string;
+	readonly run: string;
+	readonly result: string;
+}
+interface ReadingIdentityContext {
+	readonly instrument: string;
+	readonly implementation: string;
+	readonly policy: string;
+	/** The host supplies the complete verified transitive input closure. */
+	readonly inputs: readonly (readonly [
+		coordinate: string,
+		identity: string
+	])[];
+	/** Explicitly empty means no relevant environment; absence is unknown. */
+	readonly environment: readonly (readonly [
+		coordinate: string,
+		identity: string
+	])[];
+}
+interface ReadingPreparationLimits {
+	readonly bytes: number;
+	readonly files: number;
+	readonly readings: number;
+	readonly probes: number;
+	readonly signal?: AbortSignal;
+}
+interface RecordBudget {
+	readonly bytes: number;
+	readonly items: number;
+}
+interface ReferenceTrust {
+	readonly snapshot: string;
+	readonly epoch: number;
+	readonly proofScope: string;
+	readonly policy: string;
+	readonly formImplementation: string;
+	readonly signers: readonly Signer$1[];
+	readonly algorithms: readonly string[];
+	readonly contracts?: {
+		readonly refusals: string;
+		readonly standing: string;
+	};
+	readonly objects: ObjectContext$1;
+	readonly maxBytes: number;
+	readonly maxRecords: number;
+	readonly digestBytes: (bytes: Uint8Array) => string | Promise<string>;
+	readonly verifyBytes: (bytes: string, key: string, signature: string, algorithms: readonly string[]) => boolean | Promise<boolean>;
+	readonly fetchBytes: (source: string, blob: string) => Promise<Uint8Array>;
+}
+interface RefusalEntry {
+	readonly code: string;
+	readonly category: string;
+	readonly meaning: string;
+	readonly next: string;
+}
+interface RegistryHorizon {
+	readonly clock: string;
+	readonly unit: string;
+	readonly from: number;
+	readonly through: number;
+}
+interface ReleaseCategory {
+	readonly category: string;
+	readonly class: string;
+	readonly scope: string;
+	readonly role: "reads" | "writes";
+	readonly measure: "digest";
+}
+interface RootContext {
+	readonly namespace: string;
+	readonly snapshot: string;
+	readonly epoch: string;
+	readonly prefix: string;
+	readonly head: string;
+	readonly policies: readonly string[];
+}
+interface RootLotContext {
+	readonly place: string;
+	readonly snapshot: string;
+	readonly source: string;
+	readonly digest: string;
+	readonly reading: ReadingIdentityContext;
+	readonly limits: PortLimits & {
+		readonly records: number;
+	};
+	readonly signal?: AbortSignal;
+}
+/** The receiver selects the actual native place, instrument and signer. The lot
+ * supplies only canonical unsigned Root configuration, never host capabilities. */
+interface RootLotPorts {
+	readonly root: string;
+	readonly instrumentName: string;
+	readonly runtime: HostInstrumentRuntime;
+	readonly read: ContentReadPort;
+	readonly signer: {
+		readonly keyId: string;
+		readonly name: string;
+		readonly sign: SigningPort;
+	};
+	readonly storage?: PublicationStorage;
+	readonly prepared?: (identity: string) => void;
+	readonly limits: RootLotContext["limits"] & {
+		readonly diagnostics: number;
+	};
+}
+/** Initial read-only host slice. The receiver supplies the original anchor and
+ * verified implementation/policy references; the offered bytes choose none of them.
+ * Context references commit identity, not authority or conformance certification.
+ */
+interface RootStandingHostContext {
+	readonly place: string;
+	readonly source: string;
+	readonly snapshot: string;
+	readonly anchor: Signer;
+	readonly reading: ReadingIdentityContext;
+	readonly limits: PortLimits & {
+		readonly records: number;
+	};
+	readonly signal?: AbortSignal;
+}
+interface SelectedObjectForm {
+	readonly digest: string;
+	readonly form: WireForm;
+	readonly params: unknown;
+}
+interface SignatureRecord {
+	readonly keyId: string;
+	readonly signature: string;
+}
+interface Signer {
+	readonly id: string;
+	readonly keyClass: KeyClass;
+	readonly publicKey: string;
+	readonly coverage: readonly string[];
+	readonly spans?: readonly {
+		readonly globs: readonly string[];
+		readonly from: number;
+		readonly to: number | null;
+	}[];
+	readonly depth: {
+		readonly lo: number;
+		readonly hi: number;
+	};
+	readonly admittedBy: readonly string[];
+	readonly epoch?: {
+		readonly start: number;
+		readonly close: number | null;
+	};
+	readonly windows?: readonly {
+		readonly lo: number;
+		readonly hi: number;
+		readonly from: number;
+		readonly to: number | null;
+	}[];
+}
+interface SigningLot {
+	readonly bytes: readonly string[];
+	readonly keyId: string;
+	readonly algorithm: string;
+}
+interface StandingReference {
+	readonly class: "standing";
+	readonly algorithm: "sha256";
+	readonly digest: string;
+	readonly blob: string;
+	readonly source: string;
+}
+interface TrustedClockContract {
+	readonly budget: ClockBudget;
+	readonly root: RootContext;
+	readonly signers: readonly Signer[];
+	readonly places: readonly string[];
+	readonly regionFamily: string;
+	readonly receiptSigner: string;
+	readonly receiptScope: string;
+	/** These functions are instrument-selected, not packet-selected. Never an
+	 * arbitrary input boolean. They authenticate complete prefixes and namespaces. */
+	readonly verifiesRootContext: (context: RootContext) => boolean;
+	readonly verifiesNamespaceAdmission: (place: string, root: RootContext) => boolean;
+	readonly verifiesNewLocalPrefix: (place: string, prefix: string, epoch: string, originals: readonly string[]) => boolean;
+	readonly verifiesOriginal: (original: string, signer: Signer, root: RootContext) => boolean;
+	readonly verifiesProof: (bytes: string, signature: string, signer: Signer, root: RootContext) => boolean;
+	readonly digest: (bytes: string) => string;
+}
+interface WasmLimits {
+	readonly memoryBytes: number;
+	readonly stackBytes: number;
+	readonly executionMs: number;
+}
+interface WasmRequest {
+	readonly trusted: WasmTrust;
+	readonly assets: {
+		readonly runtime: Uint8Array | ArrayBuffer;
+		readonly wasm: Uint8Array | ArrayBuffer;
+	};
+	readonly modules: Readonly<Record<string, string>>;
+	readonly entry: string;
+	readonly aliases?: Readonly<Record<string, string>>;
+	readonly limits: WasmLimits;
+}
+interface WasmResult {
+	readonly output: string;
+	readonly initializedMs: number;
+	readonly executionMs: number;
+}
+interface WasmTrust {
+	readonly runtime: string;
+	readonly wasm: string;
+	readonly modules: Readonly<Record<string, string>>;
+	readonly entry: string;
+	readonly aliases: Readonly<Record<string, string>>;
+	readonly limits: WasmLimits;
+	readonly byteLengths: {
+		readonly runtime: number;
+		readonly wasm: number;
+		readonly modules: Readonly<Record<string, number>>;
+	};
+}
+interface WireForm<T = unknown> {
+	readonly id: string;
+	lattice(params: unknown): Lattice<T>;
+	parse(params: unknown, text: string): T;
+	emit(params: unknown, value: T): string;
+	show(params: unknown, value: T): string;
+	points(params: unknown, seed: number, n: number): readonly T[];
+}
+interface WorkerPort {
+	postMessage(message: WasmRequest): void;
+	terminate(): unknown;
+	addEventListener?(type: string, listener: (event: {
+		data?: unknown;
+		message?: string;
+	}) => void): void;
+	on?(type: string, listener: (value: unknown) => void): void;
+}
+type Act = 1 | -1;
+type ByteComputationPort = (bytes: Uint8Array, signal: AbortSignal) => Promise<Uint8Array>;
+type ContentReadPort = (source: string, digest: string, signal: AbortSignal) => Promise<Uint8Array>;
+type DigestPort = (bytes: Uint8Array) => string | Promise<string>;
+type KeyClass = "attest" | "authorize";
+type Library = (specifier: string, parent: ModuleClosureSnapshot) => ModuleClosureSnapshot | undefined;
+type NativeAuthorityCardRequest = Omit<NativeAuthorityCardContext, "root" | "instrument"> & {
+	readonly profile: "native-authority-card-request/1";
+};
+type NativeProbeForm = "lines" | "evidence";
+type NativeProbeResult = {
+	readonly kind: "fact";
+	readonly form: NativeProbeForm;
+	readonly port: string;
+	readonly identity: string;
+	readonly text: string;
+	readonly probes: 1;
+} | {
+	readonly kind: "refuse";
+	readonly code: string;
+	readonly diagnostic: string;
+};
+type NativeReadingIdentityResult = {
+	readonly kind: "fact";
+	readonly preparations: readonly ReadingPreparationResult[];
+} | {
+	readonly kind: "refuse";
+	readonly code: string;
+	readonly diagnostic: string;
+};
+type NativeViewIdentitiesResult = {
+	readonly kind: "fact";
+	readonly views: readonly Extract<NativeViewIdentityResult, {
+		kind: "fact";
+	}>[];
+} | Extract<NativeViewIdentityResult, {
+	kind: "refuse";
+}>;
+type NativeViewIdentityResult = {
+	readonly kind: "fact";
+	readonly view: "lines" | "evidence";
+	readonly identity: string;
+	readonly text: string;
+} | {
+	readonly kind: "refuse";
+	readonly code: string;
+	readonly diagnostic: string;
+};
+type ObjectContext$1 = Parameters<typeof validateObjectContext>[1];
+type Outcome<T> = {
+	readonly kind: "fact";
+	readonly value: T;
+} | {
+	readonly kind: "abstain";
+	readonly why: string;
+} | {
+	readonly kind: "refuse";
+	readonly why: string;
+	readonly named?: string;
+};
+/** Atomic byte retention supplied by the host. This is neither admission nor a current-answer cache. */
+type PersistencePort = (digest: string, bytes: Uint8Array, signal: AbortSignal) => Promise<void>;
+type PhysicalLinesReading = Extract<ReturnType<typeof readPlacePhysicalLines>, {
+	status: "read";
+}>;
+type PreparedReading = {
+	readonly scope: string;
+	readonly kind: "ready";
+	readonly identity: string;
+	readonly context: ReadingIdentityContext;
+	readonly receipt?: string;
+} | {
+	readonly scope: string;
+	readonly kind: "needs";
+	readonly needs: readonly string[];
+};
+type ReadingPreparationResult = {
+	readonly kind: "fact";
+	readonly readings: readonly PreparedReading[];
+	readonly probes: number;
+	readonly verifiedBytes: number;
+	readonly retained: number;
+} | {
+	readonly kind: "needs";
+	readonly needs: readonly string[];
+} | {
+	readonly kind: "refuse";
+	readonly code: string;
+	readonly diagnostic: string;
+};
+type ReadingProducerPolicy = {
+	readonly authentication: "key-covered";
+	readonly key: string;
+	readonly coverage: string;
+} | {
+	readonly authentication: "ci-run-unkeyed";
+	readonly repository: string;
+	readonly commit: string;
+	readonly workflow: string;
+	readonly run: string;
+	readonly attempt: string;
+};
+type ReadingWitness = ReadingContext & ({
+	readonly authentication: "key-covered";
+	readonly key: string;
+	readonly coverage: string;
+	readonly evidence: string;
+} | {
+	readonly authentication: "ci-run-unkeyed";
+	readonly repository: string;
+	readonly commit: string;
+	readonly workflow: string;
+	readonly attempt: string;
+	readonly evidence: string;
+});
+type RootStandingHostResult = {
+	readonly kind: "fact";
+	readonly value: {
+		readonly place: string;
+		readonly rootStanding: readonly string[];
+		readonly reading: string;
+		readonly result: string;
+		readonly commitment: string;
+	};
+} | {
+	readonly kind: "refuse";
+	readonly code: string;
+	readonly diagnostic: string;
+};
+type Side = "short" | "over";
+type SignatureVerificationPort = (bytes: string, signature: SignatureRecord, algorithm: string, signal: AbortSignal) => Promise<boolean>;
+type Signer$1 = Parameters<typeof authorityOf>[1][number];
+type SignerVerdict = {
+	readonly kind: "admitted";
+	readonly signer: string;
+} | {
+	readonly kind: "grey";
+	readonly why: string;
+} | {
+	readonly kind: "refuse";
+	readonly why: string;
+	readonly named: string;
+};
+type SigningPort = (lot: SigningLot, signal: AbortSignal) => Promise<readonly SignatureRecord[]>;
+type Verify = (fields: Readonly<Record<string, string>>, publicKey: string) => boolean;
+
+export {
+	BoundRefusal as public7_BoundRefusal,
+	ByteComputationPort as public1_ByteComputationPort,
+	ClosureDelivery as public4_ClosureDelivery,
+	ClosureDeliveryLimits as public4_ClosureDeliveryLimits,
+	ClosureDeliveryManifest as public4_ClosureDeliveryManifest,
+	ClosureNotice as public4_ClosureNotice,
+	ComputationContext as public1_ComputationContext,
+	ComputationStatement as public1_ComputationStatement,
+	ConformanceCase as public1_ConformanceCase,
+	ConformanceReceiver as public1_ConformanceReceiver,
+	ConformanceReport as public1_ConformanceReport,
+	ConformanceSuite as public1_ConformanceSuite,
+	ContentReadPort as public1_ContentReadPort,
+	ContentReadPort as public7_ContentReadPort,
+	DigestPort as public1_DigestPort,
+	DigestPort as public7_DigestPort,
+	HostInstrumentRuntime as public2_HostInstrumentRuntime,
+	InstalledPackageMember as public2_InstalledPackageMember,
+	InstalledPackageMember as public3_InstalledPackageMember,
+	InstalledPackagePin as public2_InstalledPackagePin,
+	InstalledPackagePin as public3_InstalledPackagePin,
+	InstalledPackageRequest as public2_InstalledPackageRequest,
+	InstalledPackageRequest as public3_InstalledPackageRequest,
+	ModuleClosureSnapshot as public4_ModuleClosureSnapshot,
+	ModuleInventory as public4_ModuleInventory,
+	ModuleInventoryContext as public4_ModuleInventoryContext,
+	ModuleInventoryLine as public4_ModuleInventoryLine,
+	ModuleInventorySource as public4_ModuleInventorySource,
+	NativeAuthorityAction as public2_NativeAuthorityAction,
+	NativeAuthorityCardContext as public2_NativeAuthorityCardContext,
+	NativeAuthorityCardRequest as public2_NativeAuthorityCardRequest,
+	NativeAuthorityCardValue as public2_NativeAuthorityCardValue,
+	NativeAuthorityJudgment as public2_NativeAuthorityJudgment,
+	NativeCommand as public2_NativeCommand,
+	NativeCommandHost as public2_NativeCommandHost,
+	NativeCommandResult as public2_NativeCommandResult,
+	NativeHostInstrument as public2_NativeHostInstrument,
+	NativeHostLimits as public2_NativeHostLimits,
+	NativeHostOptions as public2_NativeHostOptions,
+	NativeProbeContext as public2_NativeProbeContext,
+	NativeProbeCounter as public2_NativeProbeCounter,
+	NativeProbeForm as public2_NativeProbeForm,
+	NativeProbePort as public2_NativeProbePort,
+	NativeProbeResult as public2_NativeProbeResult,
+	NativeReadingIdentityContext as public2_NativeReadingIdentityContext,
+	NativeReadingIdentityResult as public2_NativeReadingIdentityResult,
+	NativeViewIdentitiesContext as public2_NativeViewIdentitiesContext,
+	NativeViewIdentitiesResult as public2_NativeViewIdentitiesResult,
+	NativeViewIdentityContext as public2_NativeViewIdentityContext,
+	NativeViewIdentityResult as public2_NativeViewIdentityResult,
+	ObjectContext as public1_ObjectContext,
+	ObjectReading as public1_ObjectReading,
+	ObjectRecord as public1_ObjectRecord,
+	PersistencePort as public1_PersistencePort,
+	PersistencePort as public7_PersistencePort,
+	PhysicalLinesPlaceInput as public2_PhysicalLinesPlaceInput,
+	PhysicalLinesPlaceInput as public5_PhysicalLinesPlaceInput,
+	PhysicalLinesPolicy as public2_PhysicalLinesPolicy,
+	PhysicalLinesPolicy as public5_PhysicalLinesPolicy,
+	PhysicalLinesReading as public2_PhysicalLinesReading,
+	PhysicalLinesReading as public5_PhysicalLinesReading,
+	PhysicalLinesRegion as public2_PhysicalLinesRegion,
+	PhysicalLinesRegion as public5_PhysicalLinesRegion,
+	PhysicalLinesWitnessAuthority as public2_PhysicalLinesWitnessAuthority,
+	PhysicalLinesWitnessAuthority as public5_PhysicalLinesWitnessAuthority,
+	PlaceActBudget as public2_PlaceActBudget,
+	PlaceActHostContext as public2_PlaceActHostContext,
+	PlaceActHostPorts as public2_PlaceActHostPorts,
+	PlaceActPersistence as public2_PlaceActPersistence,
+	PlaceActTrust as public2_PlaceActTrust,
+	PortLimits as public1_PortLimits,
+	PortLimits as public7_PortLimits,
+	PreparedReading as public2_PreparedReading,
+	ProfileCompositionRequest as public2_ProfileCompositionRequest,
+	ProfileCompositionRequest as public6_ProfileCompositionRequest,
+	ProfileFieldBinding as public2_ProfileFieldBinding,
+	ProfileFieldBinding as public6_ProfileFieldBinding,
+	PublicationStorage as public2_PublicationStorage,
+	ReadingPreparationLimits as public2_ReadingPreparationLimits,
+	ReadingPreparationResult as public2_ReadingPreparationResult,
+	ReadingProducerPolicy as public2_ReadingProducerPolicy,
+	ReadingProducerPolicy as public5_ReadingProducerPolicy,
+	ReferenceTrust as public7_ReferenceTrust,
+	RefusalEntry as public1_RefusalEntry,
+	RefusalEntry as public7_RefusalEntry,
+	ReleaseCategory as public2_ReleaseCategory,
+	ReleaseCategory as public6_ReleaseCategory,
+	RootLotContext as public2_RootLotContext,
+	RootLotPorts as public2_RootLotPorts,
+	RootStandingHostContext as public2_RootStandingHostContext,
+	RootStandingHostResult as public2_RootStandingHostResult,
+	SignatureRecord as public1_SignatureRecord,
+	SignatureRecord as public7_SignatureRecord,
+	SignatureVerificationPort as public1_SignatureVerificationPort,
+	SigningLot as public1_SigningLot,
+	SigningLot as public7_SigningLot,
+	SigningPort as public1_SigningPort,
+	SigningPort as public7_SigningPort,
+	WasmLimits as public9_WasmLimits,
+	WasmRequest as public9_WasmRequest,
+	WasmResult as public9_WasmResult,
+	WasmTrust as public9_WasmTrust,
+	WorkerPort as public9_WorkerPort,
+	answerNativeAuthorityCard as public2_answerNativeAuthorityCard,
+	authenticatePhysicalLinesWitness as public2_authenticatePhysicalLinesWitness,
+	authenticatePhysicalLinesWitness as public5_authenticatePhysicalLinesWitness,
+	composeProfile as public2_composeProfile,
+	composeProfile as public6_composeProfile,
+	decodeReference as public7_decodeReference,
+	deliverModuleClosure as public4_deliverModuleClosure,
+	describeRefusal as public7_describeRefusal,
+	digest as public9_digest,
+	encodeReference as public7_encodeReference,
+	evaluateWasm as public9_evaluateWasm,
+	executeComputation as public1_executeComputation,
+	exportAuthenticatedReference as public8_exportAuthenticatedReference,
+	inspectAuthenticatedReference as public7_inspectAuthenticatedReference,
+	inspectReference as public8_inspectReference,
+	inspectReferencePreview as public8_inspectReferencePreview,
+	installedHostInstrument as public2_installedHostInstrument,
+	installedPackageIdentity as public2_installedPackageIdentity,
+	installedPackageIdentity as public3_installedPackageIdentity,
+	invokeSigningPort as public1_invokeSigningPort,
+	invokeSigningPort as public7_invokeSigningPort,
+	judgePhysicalLines as public2_judgePhysicalLines,
+	judgePhysicalLines as public5_judgePhysicalLines,
+	landPlaceActInProcess as public2_landPlaceActInProcess,
+	landRootLotInProcess as public2_landRootLotInProcess,
+	moduleInventory as public4_moduleInventory,
+	moduleSnapshot as public4_moduleSnapshot,
+	nativeAuthorityCardView as public2_nativeAuthorityCardView,
+	nativeAuthorityRequestIdentity as public2_nativeAuthorityRequestIdentity,
+	nativeHostEnvironment as public2_nativeHostEnvironment,
+	nativeHostInstrument as public2_nativeHostInstrument,
+	nativePlaceActPersistence as public2_nativePlaceActPersistence,
+	nativePlaceActReceiver as public2_nativePlaceActReceiver,
+	objectFold as public1_objectFold,
+	objectFoldBytes as public1_objectFoldBytes,
+	openAuthenticatedReference as public8_openAuthenticatedReference,
+	parseNativeAuthorityCardRequest as public2_parseNativeAuthorityCardRequest,
+	physicalLinesRegions as public2_physicalLinesRegions,
+	physicalLinesRegions as public5_physicalLinesRegions,
+	preflight as public9_preflight,
+	prepareNativeAuthorityCard as public2_prepareNativeAuthorityCard,
+	prepareNativeProbe as public2_prepareNativeProbe,
+	prepareNativeReadingIdentity as public2_prepareNativeReadingIdentity,
+	prepareNativeViewIdentities as public2_prepareNativeViewIdentities,
+	prepareNativeViewIdentity as public2_prepareNativeViewIdentity,
+	profileDigest as public2_profileDigest,
+	profileDigest as public6_profileDigest,
+	readContent as public1_readContent,
+	readContent as public7_readContent,
+	readContextualStandingInProcess as public2_readContextualStandingInProcess,
+	readPlacePhysicalLines as public2_readPlacePhysicalLines,
+	readPlacePhysicalLines as public5_readPlacePhysicalLines,
+	readRefusalCatalog as public1_readRefusalCatalog,
+	readRefusalCatalog as public7_readRefusalCatalog,
+	readRootStandingInProcess as public2_readRootStandingInProcess,
+	recoverPlaceActInProcess as public2_recoverPlaceActInProcess,
+	recoverRootActInProcess as public2_recoverRootActInProcess,
+	releaseCategoryPins as public2_releaseCategoryPins,
+	releaseCategoryPins as public6_releaseCategoryPins,
+	retainContent as public1_retainContent,
+	retainContent as public7_retainContent,
+	rootLotSnapshot as public2_rootLotSnapshot,
+	runConformance as public1_runConformance,
+	runWasmRequest as public9_runWasmRequest,
+	startNativeHost as public2_startNativeHost,
+	verifyComputation as public1_verifyComputation,
+	verifyModuleDelivery as public4_verifyModuleDelivery,
+};
+
+export {};