@mindees/updates 0.12.0 → 0.14.0

package/README.md

@@ -5,9 +5,10 @@ installed apps without an app-store release, safely.
 
 > Status: 🧪 **Experimental** — Phase 9 (Pulse) is complete in its current scope.
 > Implemented and tested: signed OTA core, differential bundle diffing, the reference
-> update server, and server-driven UI (SDUI). The WASM module runtime is a 🔬 research
-> track (`createWasmModuleRuntime()` throws `NotImplementedError`). See the repository
-> [STATUS.md](../../STATUS.md).
+> update server, server-driven UI (SDUI), and a real **sandboxed WASM module runtime**
+> (`createWasmModuleRuntime()` — capability-secure, core WebAssembly; the full WASM
+> Component Model / WASI 0.2/0.3 is a labeled follow-up behind the same seam). See the
+> repository [STATUS.md](../../STATUS.md).
 
 ## What works today
 
@@ -70,6 +71,29 @@ Incremental updates use a pure-TS RFC 7396 merge-patch (`applyMergePatch`) and a
 RFC 6902 subset (`applyJsonPatch` — `add`/`remove`/`replace`); a patched tree must be
 re-run through `compileSdui` before render. Design: [ADR-0011](../../docs/adr/0011-pulse-sdui.md).
 
+## Sandboxed WASM modules
+
+`@mindees/updates` ships a real, **capability-secure** WebAssembly runtime so an OTA
+update can carry signed feature modules that run at runtime, isolated in their own linear
+memory. `createWasmModuleRuntime()` returns a runtime whose `instantiate`:
+
+- **is the sandbox** — a module sees ONLY the `capabilities` you pass as its import object;
+  it has no ambient access to the JS realm, the network, or the DOM,
+- **fails closed** — a module that asks for a capability it wasn't granted (`LinkError`),
+  malformed bytecode, or an over-budget module (default 16 MiB cap) is rejected
+  deterministically with `UpdateError('MODULE_INVALID')`,
+- **runs everywhere** — core WebAssembly, so it works on Hermes/React Native, Node, and the
+  web today without a native module; the full WASM **Component Model** (WASI 0.2/0.3 typed
+  interfaces) is a labeled follow-up that slots in behind the same `instantiate` seam.
+
+```ts
+import { createWasmModuleRuntime } from '@mindees/updates'
+
+const runtime = createWasmModuleRuntime()
+const mod = await runtime.instantiate(wasmBytes, { host: { inc: (n: number) => n + 1 } })
+mod.call<number>('run', 41) // → 42, using only the granted host.inc capability
+```
+
 ## Quick start
 
 ```ts

package/dist/index.d.ts

@@ -13,7 +13,7 @@ import { Maturity, NotImplementedError, PackageInfo, notImplemented } from "@min
 /** The npm package name. */
 declare const name = "@mindees/updates";
 /** The package version. All `@mindees/*` packages share one locked version line. */
-declare const VERSION = "0.12.0";
+declare const VERSION = "0.14.0";
 /** Current maturity. See the repository `STATUS.md`. */
 declare const maturity: Maturity;
 /**

package/dist/index.js

@@ -12,7 +12,7 @@ import { NotImplementedError, notImplemented } from "@mindees/core";
 /** The npm package name. */
 const name = "@mindees/updates";
 /** The package version. All `@mindees/*` packages share one locked version line. */
-const VERSION = "0.12.0";
+const VERSION = "0.14.0";
 /** Current maturity. See the repository `STATUS.md`. */
 const maturity = "experimental";
 /**

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["/**\n * `@mindees/updates` (Pulse) — signed OTA updates.\n *\n * Pulse ships a versioned, hash-addressed {@link UpdateManifest}, Ed25519\n * {@link signManifest signing}/{@link verifySignedManifest verification} (threshold +\n * key rotation), a content-addressed {@link UpdateStorage store}, an\n * {@link createUpdateClient update client} with atomic generations + crash-loop\n * rollback, differential bundle diffing, a reference update server, and SDUI.\n *\n * @module\n */\n\nimport type { Maturity, PackageInfo } from '@mindees/core'\nimport { NotImplementedError, notImplemented } from '@mindees/core'\n\n/** The npm package name. */\nexport const name = '@mindees/updates'\n\n/** The package version. All `@mindees/*` packages share one locked version line. */\nexport const VERSION = '0.12.0'\n\n/** Current maturity. See the repository `STATUS.md`. */\nexport const maturity: Maturity = 'experimental'\n\n/**\n * Static identity + maturity metadata for this package. Frozen so the\n * self-reported identity tooling introspects cannot be mutated at runtime,\n * matching the `readonly` fields of {@link PackageInfo}.\n */\nexport const info: PackageInfo = Object.freeze({ name, version: VERSION, maturity })\n\nexport {\n  type BootResult,\n  createUpdateClient,\n  type UpdateCheck,\n  type UpdateClient,\n  type UpdateClientOptions,\n} from './client'\nexport {\n  fromHex,\n  generateKeypair,\n  getPublicKey,\n  type Keypair,\n  sha256Hex,\n  sign,\n  toHex,\n  utf8,\n  verify,\n} from './crypto'\nexport { type ApplyDeltaOptions, applyDelta, diff } from './delta'\nexport { UpdateError, type UpdateErrorCode } from './errors'\nexport {\n  type AssetEntry,\n  allAssets,\n  canonicalManifestJson,\n  type PatchDescriptor,\n  parseManifest,\n  type UpdateManifest,\n} from './manifest'\n/**\n * Server-Driven UI (Pulse §10): compile an allowlisted, schema-versioned JSON tree into a live\n * MindeesNode tree, and apply incremental updates with JSON Merge Patch (RFC 7396) / JSON Patch\n * (RFC 6902). No `eval` — components + actions are pre-registered.\n */\nexport {\n  applyJsonPatch,\n  applyMergePatch,\n  compileSdui,\n  type JsonPatchOp,\n  type SduiActionHandler,\n  type SduiActionRef,\n  type SduiBindRef,\n  SduiError,\n  type SduiErrorCode,\n  type SduiJson,\n  type SduiLimits,\n  type SduiNode,\n  type SduiPropValue,\n  type SduiRegistry,\n} from './sdui'\nexport {\n  type SignatureEntry,\n  type SignedManifest,\n  type Signer,\n  signManifest,\n  type TrustedKey,\n  type VerifiedManifest,\n  verifySignedManifest,\n} from './signing'\nexport {\n  createMemoryStorage,\n  type GenerationMeta,\n  type GenerationStatus,\n  initialState,\n  type UpdateState,\n  type UpdateStorage,\n} from './store'\n\n/**\n * Pulse sandboxed WASM module runtime (spec §10) — ship signed, capability-secure feature modules\n * that run at runtime in their own linear memory, reachable only through the capabilities you grant.\n * Core WebAssembly today; the full Component Model (WASI 0.2/0.3) is a follow-up behind the same seam.\n */\nexport {\n  type Capabilities,\n  createWasmModuleRuntime,\n  type WasmModuleInstance,\n  type WasmModuleRuntime,\n  type WasmModuleRuntimeOptions,\n} from './wasm'\n\nexport type { Maturity, PackageInfo }\nexport { NotImplementedError, notImplemented }\n"],"mappings":";;;;;;;;;;;;AAgBA,MAAa,OAAO;;AAGpB,MAAa,UAAU;;AAGvB,MAAa,WAAqB;;;;;;AAOlC,MAAa,OAAoB,OAAO,OAAO;CAAE;CAAM,SAAS;CAAS;AAAS,CAAC"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["/**\n * `@mindees/updates` (Pulse) — signed OTA updates.\n *\n * Pulse ships a versioned, hash-addressed {@link UpdateManifest}, Ed25519\n * {@link signManifest signing}/{@link verifySignedManifest verification} (threshold +\n * key rotation), a content-addressed {@link UpdateStorage store}, an\n * {@link createUpdateClient update client} with atomic generations + crash-loop\n * rollback, differential bundle diffing, a reference update server, and SDUI.\n *\n * @module\n */\n\nimport type { Maturity, PackageInfo } from '@mindees/core'\nimport { NotImplementedError, notImplemented } from '@mindees/core'\n\n/** The npm package name. */\nexport const name = '@mindees/updates'\n\n/** The package version. All `@mindees/*` packages share one locked version line. */\nexport const VERSION = '0.14.0'\n\n/** Current maturity. See the repository `STATUS.md`. */\nexport const maturity: Maturity = 'experimental'\n\n/**\n * Static identity + maturity metadata for this package. Frozen so the\n * self-reported identity tooling introspects cannot be mutated at runtime,\n * matching the `readonly` fields of {@link PackageInfo}.\n */\nexport const info: PackageInfo = Object.freeze({ name, version: VERSION, maturity })\n\nexport {\n  type BootResult,\n  createUpdateClient,\n  type UpdateCheck,\n  type UpdateClient,\n  type UpdateClientOptions,\n} from './client'\nexport {\n  fromHex,\n  generateKeypair,\n  getPublicKey,\n  type Keypair,\n  sha256Hex,\n  sign,\n  toHex,\n  utf8,\n  verify,\n} from './crypto'\nexport { type ApplyDeltaOptions, applyDelta, diff } from './delta'\nexport { UpdateError, type UpdateErrorCode } from './errors'\nexport {\n  type AssetEntry,\n  allAssets,\n  canonicalManifestJson,\n  type PatchDescriptor,\n  parseManifest,\n  type UpdateManifest,\n} from './manifest'\n/**\n * Server-Driven UI (Pulse §10): compile an allowlisted, schema-versioned JSON tree into a live\n * MindeesNode tree, and apply incremental updates with JSON Merge Patch (RFC 7396) / JSON Patch\n * (RFC 6902). No `eval` — components + actions are pre-registered.\n */\nexport {\n  applyJsonPatch,\n  applyMergePatch,\n  compileSdui,\n  type JsonPatchOp,\n  type SduiActionHandler,\n  type SduiActionRef,\n  type SduiBindRef,\n  SduiError,\n  type SduiErrorCode,\n  type SduiJson,\n  type SduiLimits,\n  type SduiNode,\n  type SduiPropValue,\n  type SduiRegistry,\n} from './sdui'\nexport {\n  type SignatureEntry,\n  type SignedManifest,\n  type Signer,\n  signManifest,\n  type TrustedKey,\n  type VerifiedManifest,\n  verifySignedManifest,\n} from './signing'\nexport {\n  createMemoryStorage,\n  type GenerationMeta,\n  type GenerationStatus,\n  initialState,\n  type UpdateState,\n  type UpdateStorage,\n} from './store'\n\n/**\n * Pulse sandboxed WASM module runtime (spec §10) — ship signed, capability-secure feature modules\n * that run at runtime in their own linear memory, reachable only through the capabilities you grant.\n * Core WebAssembly today; the full Component Model (WASI 0.2/0.3) is a follow-up behind the same seam.\n */\nexport {\n  type Capabilities,\n  createWasmModuleRuntime,\n  type WasmModuleInstance,\n  type WasmModuleRuntime,\n  type WasmModuleRuntimeOptions,\n} from './wasm'\n\nexport type { Maturity, PackageInfo }\nexport { NotImplementedError, notImplemented }\n"],"mappings":";;;;;;;;;;;;AAgBA,MAAa,OAAO;;AAGpB,MAAa,UAAU;;AAGvB,MAAa,WAAqB;;;;;;AAOlC,MAAa,OAAoB,OAAO,OAAO;CAAE;CAAM,SAAS;CAAS;AAAS,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindees/updates",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "MindeesNative Pulse - signed over-the-air (OTA) updates: hash-addressed manifests, Ed25519 signing, content-addressed storage, atomic generations with crash-loop rollback.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -33,7 +33,7 @@
   "dependencies": {
     "@noble/curves": "2.2.0",
     "@noble/hashes": "2.2.0",
-    "@mindees/core": "0.12.0"
+    "@mindees/core": "0.14.0"
   },
   "devDependencies": {
     "fast-check": "4.8.0"