@markii/lua 0.2.0 → 0.3.0

package/dist/capabilities.d.ts

@@ -95,7 +95,7 @@ export declare function luaStringToBytes(s: string): Uint8Array;
 /**
  * Builds the raw, host-facing async functions to inject as flat globals,
  * and the trusted Lua prelude that wraps them into the ergonomic `net` /
- * `cache` / `bundle` tables the DESIGN.md host API documents (`net.fetch_json(url)`,
+ * `cache` / `bundle` tables the docs/spec.md host API documents (`net.fetch_json(url)`,
  * `cache.get(key, ttl, fn)`, `bundle.read/write/exists(path)`).
  *
  * ## Why "raw flat globals + a Lua prelude" instead of `global.set('net', {...})`
@@ -126,7 +126,7 @@ export declare function luaStringToBytes(s: string): Uint8Array;
  * `js_promise` userdata with `:await()`/`:next()`/`:catch()` methods; the
  * CALLER must explicitly invoke `:await()` to get the resolved value
  * (verified empirically: without it, a script sees the raw promise
- * userdata, not the awaited result). Since `DESIGN.md`'s example script
+ * userdata, not the awaited result). Since `docs/spec.md`'s example script
  * (`local repo = net.fetch_json(url)`) is written as if this were
  * synchronous, the awaiting is done for the author, once, HERE — inside
  * the prelude's Lua wrapper — never exposed to the untrusted script.

package/dist/capabilities.js

@@ -50,7 +50,7 @@ export function luaStringToBytes(s) {
 /**
  * Builds the raw, host-facing async functions to inject as flat globals,
  * and the trusted Lua prelude that wraps them into the ergonomic `net` /
- * `cache` / `bundle` tables the DESIGN.md host API documents (`net.fetch_json(url)`,
+ * `cache` / `bundle` tables the docs/spec.md host API documents (`net.fetch_json(url)`,
  * `cache.get(key, ttl, fn)`, `bundle.read/write/exists(path)`).
  *
  * ## Why "raw flat globals + a Lua prelude" instead of `global.set('net', {...})`
@@ -81,7 +81,7 @@ export function luaStringToBytes(s) {
  * `js_promise` userdata with `:await()`/`:next()`/`:catch()` methods; the
  * CALLER must explicitly invoke `:await()` to get the resolved value
  * (verified empirically: without it, a script sees the raw promise
- * userdata, not the awaited result). Since `DESIGN.md`'s example script
+ * userdata, not the awaited result). Since `docs/spec.md`'s example script
  * (`local repo = net.fetch_json(url)`) is written as if this were
  * synchronous, the awaiting is done for the author, once, HERE — inside
  * the prelude's Lua wrapper — never exposed to the untrusted script.

package/dist/executor.d.ts

@@ -1,7 +1,7 @@
 import type { ScriptExecutor } from '@markii/runtime';
 import { type RunScriptOptions } from './sandbox.js';
 /**
- * Slice 2 of the scripting-usability layer (DESIGN.md §8): the reusable
+ * Slice 2 of the scripting-usability layer (docs/scripting.md): the reusable
  * adapter from this package's `runScript` to `@markii/runtime`'s
  * language-agnostic `ScriptExecutor` shape, so `runDocumentScripts` can run
  * a document's script blocks through the real Lua sandbox without

package/dist/index.js

@@ -1,6 +1,6 @@
 // @markii/lua: the sandboxed Lua 5.4 (wasmoon) execution primitive backing
 // spec §8 (scripting), §10 (capability security), and §11 (bundle-scoped
-// filesystem). No React, no @markii/core, no @markii/react — see CLAUDE.md's
+// filesystem). No React, no @markii/core, no @markii/react — see AGENTS.md's
 // import rule and the ESLint guard in the root config. May depend on
 // @markii/bundle for the `ScriptView` capability type only.
 export { CAPABILITY_ERROR_TAG, MARSHAL_ERROR_TAG, ScriptLimitError, } from './errors.js';

package/dist/limits.d.ts

@@ -112,7 +112,7 @@ export interface LimitHandle {
  * AUTHORITATIVE kill for that class of failure is not this hook at all —
  * it's the host's EXTERNAL, terminatable-isolate watchdog (dedicated Web
  * Worker/`worker_thread` + an outside wall-clock timer calling
- * `terminate()`), now normative in DESIGN.md §10 ("In-process limits are
+ * `terminate()`), now normative in docs/security.md ("In-process limits are
  * best-effort; the terminatable isolate is the real guarantee"). This
  * module's hook reduces how often that external kill is needed and gives
  * fast, precise, in-band error classification for the common compute-bound

package/dist/limits.js

@@ -93,7 +93,7 @@ export const DEFAULT_LIMITS = {
  * AUTHORITATIVE kill for that class of failure is not this hook at all —
  * it's the host's EXTERNAL, terminatable-isolate watchdog (dedicated Web
  * Worker/`worker_thread` + an outside wall-clock timer calling
- * `terminate()`), now normative in DESIGN.md §10 ("In-process limits are
+ * `terminate()`), now normative in docs/security.md ("In-process limits are
  * best-effort; the terminatable isolate is the real guarantee"). This
  * module's hook reduces how often that external kill is needed and gives
  * fast, precise, in-band error classification for the common compute-bound

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@markii/lua",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Sandboxed Lua 5.4 (wasmoon) execution runtime for Mark's document scripting: an empty-env global whitelist, two-tier capability-gated net/cache/bundle access, instruction-count/wall-clock/memory limits, and depth/size-capped Lua<->JS marshaling.",
   "keywords": [
     "markdown",
@@ -44,8 +44,8 @@
     "lint": "eslint ."
   },
   "dependencies": {
-    "@markii/bundle": "0.2.0",
-    "@markii/runtime": "0.2.0",
+    "@markii/bundle": "0.3.0",
+    "@markii/runtime": "0.3.0",
     "wasmoon": "^1.16.0"
   }
 }