@nexart/codemode-sdk 1.5.1 → 1.7.0

package/dist/execute.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../execute.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EAMtB,MAAM,SAAS,CAAC;AAsNjB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,qBAAqB,CAAC,CAmChC;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAuCpH"}
+{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../execute.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EAMtB,MAAM,SAAS,CAAC;AAuNjB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,qBAAqB,CAAC,CAmChC;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAuCpH"}

package/dist/execute.js

@@ -143,7 +143,8 @@ async function executeStatic(input, vars) {
             vars: vars,
             onComplete: (result) => {
                 resolve({
-                    image: result.blob,
+                    image: 'blob' in result ? result.blob : undefined,
+                    frames: 'imageData' in result ? [result.imageData] : undefined,
                     metadata: createMetadata(input, vars),
                 });
             },
@@ -174,7 +175,7 @@ async function executeLoop(input, vars) {
             vars: vars,
             onComplete: (result) => {
                 resolve({
-                    video: result.blob,
+                    video: 'blob' in result && result.type === 'video' ? result.blob : undefined,
                     metadata: createMetadata(input, vars),
                 });
             },
@@ -214,7 +215,7 @@ export async function executeCodeMode(input) {
     // Normalize VAR values
     const vars = normalizeVars(input.vars);
     // ╔═══════════════════════════════════════════════════════════════════════╗
-    // ║  BUILDER MANIFEST CONTEXT (v1.5.1)                                    ║
+    // ║  BUILDER MANIFEST CONTEXT (v1.6.0)                                    ║
     // ║                                                                       ║
     // ║  Internal context for builder attribution.                            ║
     // ║  This is NOT exposed to sketch code, NOT serialized, NOT logged.      ║

package/dist/execution-sandbox.d.ts

@@ -0,0 +1,107 @@
+/**
+ * NexArt Code Mode SDK - Execution Sandbox
+ * Version: 1.6.0 (Protocol v1.2.0)
+ *
+ * ╔══════════════════════════════════════════════════════════════════════════╗
+ * ║  EXECUTION BOUNDARY — HARD ENFORCEMENT                                   ║
+ * ║                                                                          ║
+ * ║  This module enforces determinism by blocking all external entropy       ║
+ * ║  sources at RUNTIME, not just via static pattern scanning.               ║
+ * ║                                                                          ║
+ * ║  Blocked APIs (throw [Code Mode Protocol Error]):                        ║
+ * ║  - Date, Date.now, Date.parse, new Date()                                ║
+ * ║  - performance, performance.now                                          ║
+ * ║  - process (Node.js)                                                     ║
+ * ║  - navigator                                                             ║
+ * ║  - globalThis                                                            ║
+ * ║  - crypto.getRandomValues                                                ║
+ * ║  - Math.random (use seeded random() instead)                             ║
+ * ║  - setTimeout, setInterval, requestAnimationFrame                        ║
+ * ║  - fetch, XMLHttpRequest                                                 ║
+ * ║  - document, window                                                      ║
+ * ║  - import, require                                                       ║
+ * ║                                                                          ║
+ * ║  All blocked symbols throw immediately on access — no silent undefined.  ║
+ * ╚══════════════════════════════════════════════════════════════════════════╝
+ */
+/**
+ * Forbidden APIs - these are injected into the execution scope to override globals
+ */
+export declare const FORBIDDEN_APIS: {
+    readonly Date: (...args: any[]) => never;
+    readonly performance: object;
+    readonly process: object;
+    readonly navigator: object;
+    readonly globalThis: object;
+    readonly crypto: object;
+    readonly setTimeout: (...args: any[]) => never;
+    readonly setInterval: (...args: any[]) => never;
+    readonly clearTimeout: (...args: any[]) => never;
+    readonly clearInterval: (...args: any[]) => never;
+    readonly requestAnimationFrame: (...args: any[]) => never;
+    readonly cancelAnimationFrame: (...args: any[]) => never;
+    readonly fetch: (...args: any[]) => never;
+    readonly XMLHttpRequest: (...args: any[]) => never;
+    readonly WebSocket: (...args: any[]) => never;
+    readonly document: object;
+    readonly window: object;
+    readonly self: object;
+    readonly top: object;
+    readonly parent: object;
+    readonly frames: object;
+    readonly location: object;
+    readonly history: object;
+    readonly localStorage: object;
+    readonly sessionStorage: object;
+    readonly indexedDB: object;
+    readonly caches: object;
+    readonly Notification: (...args: any[]) => never;
+    readonly Worker: (...args: any[]) => never;
+    readonly SharedWorker: (...args: any[]) => never;
+    readonly ServiceWorker: object;
+    readonly Blob: (...args: any[]) => never;
+    readonly File: (...args: any[]) => never;
+    readonly FileReader: (...args: any[]) => never;
+    readonly URL: (...args: any[]) => never;
+    readonly URLSearchParams: (...args: any[]) => never;
+    readonly Headers: (...args: any[]) => never;
+    readonly Request: (...args: any[]) => never;
+    readonly Response: (...args: any[]) => never;
+    readonly EventSource: (...args: any[]) => never;
+    readonly Image: (...args: any[]) => never;
+    readonly Audio: (...args: any[]) => never;
+    readonly Video: (...args: any[]) => never;
+    readonly eval: (...args: any[]) => never;
+    readonly Function: (...args: any[]) => never;
+};
+/**
+ * Create a safe Math object with random() blocked
+ */
+export declare function createSafeMath(): typeof Math;
+/**
+ * List of all forbidden API names for documentation
+ */
+export declare const FORBIDDEN_API_NAMES: string[];
+/**
+ * Build the complete sandbox context for sketch execution.
+ * This includes the p5 runtime plus all forbidden API stubs.
+ */
+export declare function buildSandboxContext(p5Runtime: Record<string, any>): Record<string, any>;
+/**
+ * Create a sandboxed function that executes user code with blocked globals.
+ *
+ * The function is constructed with:
+ * 1. All forbidden APIs as explicit parameters (override globals)
+ * 2. The p5 runtime as explicit parameters
+ * 3. A `with(context)` wrapper for additional safety
+ */
+export declare function createSandboxedExecutor(code: string, additionalParams?: string[]): Function;
+/**
+ * Execute user code in a sandboxed environment.
+ *
+ * @param code - The user sketch code to execute
+ * @param p5Runtime - The p5-like runtime object
+ * @param additionalContext - Additional context variables (frameCount, t, etc.)
+ */
+export declare function executeSandboxed(code: string, p5Runtime: Record<string, any>, additionalContext?: Record<string, any>): void;
+//# sourceMappingURL=execution-sandbox.d.ts.map

package/dist/execution-sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-sandbox.d.ts","sourceRoot":"","sources":["../execution-sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAyDH;;GAEG;AACH,eAAO,MAAM,cAAc;6BAvD2B,GAAG,EAAE,KAAK,KAAK;;;;;;mCAAf,GAAG,EAAE,KAAK,KAAK;oCAAf,GAAG,EAAE,KAAK,KAAK;qCAAf,GAAG,EAAE,KAAK,KAAK;sCAAf,GAAG,EAAE,KAAK,KAAK;8CAAf,GAAG,EAAE,KAAK,KAAK;6CAAf,GAAG,EAAE,KAAK,KAAK;8BAAf,GAAG,EAAE,KAAK,KAAK;uCAAf,GAAG,EAAE,KAAK,KAAK;kCAAf,GAAG,EAAE,KAAK,KAAK;;;;;;;;;;;;;qCAAf,GAAG,EAAE,KAAK,KAAK;+BAAf,GAAG,EAAE,KAAK,KAAK;qCAAf,GAAG,EAAE,KAAK,KAAK;;6BAAf,GAAG,EAAE,KAAK,KAAK;6BAAf,GAAG,EAAE,KAAK,KAAK;mCAAf,GAAG,EAAE,KAAK,KAAK;4BAAf,GAAG,EAAE,KAAK,KAAK;wCAAf,GAAG,EAAE,KAAK,KAAK;gCAAf,GAAG,EAAE,KAAK,KAAK;gCAAf,GAAG,EAAE,KAAK,KAAK;iCAAf,GAAG,EAAE,KAAK,KAAK;oCAAf,GAAG,EAAE,KAAK,KAAK;8BAAf,GAAG,EAAE,KAAK,KAAK;8BAAf,GAAG,EAAE,KAAK,KAAK;8BAAf,GAAG,EAAE,KAAK,KAAK;6BAAf,GAAG,EAAE,KAAK,KAAK;iCAAf,GAAG,EAAE,KAAK,KAAK;CAqG3D,CAAC;AAEX;;GAEG;AACH,wBAAgB,cAAc,IAAI,OAAO,IAAI,CAU5C;AAED;;GAEG;AACH,eAAO,MAAM,mBAAmB,UAA8B,CAAC;AAE/D;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAavF;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,gBAAgB,GAAE,MAAM,EAAO,GAC9B,QAAQ,CAiBV;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC9B,iBAAiB,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,GAC1C,IAAI,CAsBN"}

package/dist/execution-sandbox.js

@@ -0,0 +1,207 @@
+/**
+ * NexArt Code Mode SDK - Execution Sandbox
+ * Version: 1.6.0 (Protocol v1.2.0)
+ *
+ * ╔══════════════════════════════════════════════════════════════════════════╗
+ * ║  EXECUTION BOUNDARY — HARD ENFORCEMENT                                   ║
+ * ║                                                                          ║
+ * ║  This module enforces determinism by blocking all external entropy       ║
+ * ║  sources at RUNTIME, not just via static pattern scanning.               ║
+ * ║                                                                          ║
+ * ║  Blocked APIs (throw [Code Mode Protocol Error]):                        ║
+ * ║  - Date, Date.now, Date.parse, new Date()                                ║
+ * ║  - performance, performance.now                                          ║
+ * ║  - process (Node.js)                                                     ║
+ * ║  - navigator                                                             ║
+ * ║  - globalThis                                                            ║
+ * ║  - crypto.getRandomValues                                                ║
+ * ║  - Math.random (use seeded random() instead)                             ║
+ * ║  - setTimeout, setInterval, requestAnimationFrame                        ║
+ * ║  - fetch, XMLHttpRequest                                                 ║
+ * ║  - document, window                                                      ║
+ * ║  - import, require                                                       ║
+ * ║                                                                          ║
+ * ║  All blocked symbols throw immediately on access — no silent undefined.  ║
+ * ╚══════════════════════════════════════════════════════════════════════════╝
+ */
+/**
+ * Create a throwing stub for a forbidden API
+ */
+function createForbiddenStub(name) {
+    const stub = function () {
+        throw new Error(`[Code Mode Protocol Error] Forbidden API: ${name}`);
+    };
+    return new Proxy(stub, {
+        get(_target, prop) {
+            if (prop === Symbol.toPrimitive || prop === 'toString' || prop === 'valueOf') {
+                return () => { throw new Error(`[Code Mode Protocol Error] Forbidden API: ${name}`); };
+            }
+            throw new Error(`[Code Mode Protocol Error] Forbidden API: ${name}.${String(prop)}`);
+        },
+        apply() {
+            throw new Error(`[Code Mode Protocol Error] Forbidden API: ${name}()`);
+        },
+        construct() {
+            throw new Error(`[Code Mode Protocol Error] Forbidden API: new ${name}()`);
+        },
+        set() {
+            throw new Error(`[Code Mode Protocol Error] Forbidden API: ${name} (assignment blocked)`);
+        },
+        has() {
+            return true;
+        }
+    });
+}
+/**
+ * Create a frozen object that throws on any property access
+ */
+function createForbiddenObject(name) {
+    return new Proxy({}, {
+        get(_target, prop) {
+            if (prop === Symbol.toPrimitive || prop === 'toString' || prop === 'valueOf') {
+                return () => { throw new Error(`[Code Mode Protocol Error] Forbidden API: ${name}`); };
+            }
+            throw new Error(`[Code Mode Protocol Error] Forbidden API: ${name}.${String(prop)}`);
+        },
+        set() {
+            throw new Error(`[Code Mode Protocol Error] Forbidden API: ${name} (assignment blocked)`);
+        },
+        has() {
+            return true;
+        },
+        apply() {
+            throw new Error(`[Code Mode Protocol Error] Forbidden API: ${name}()`);
+        },
+        construct() {
+            throw new Error(`[Code Mode Protocol Error] Forbidden API: new ${name}()`);
+        }
+    });
+}
+/**
+ * Forbidden APIs - these are injected into the execution scope to override globals
+ */
+export const FORBIDDEN_APIS = {
+    Date: createForbiddenStub('Date'),
+    performance: createForbiddenObject('performance'),
+    process: createForbiddenObject('process'),
+    navigator: createForbiddenObject('navigator'),
+    globalThis: createForbiddenObject('globalThis'),
+    crypto: createForbiddenObject('crypto'),
+    setTimeout: createForbiddenStub('setTimeout'),
+    setInterval: createForbiddenStub('setInterval'),
+    clearTimeout: createForbiddenStub('clearTimeout'),
+    clearInterval: createForbiddenStub('clearInterval'),
+    requestAnimationFrame: createForbiddenStub('requestAnimationFrame'),
+    cancelAnimationFrame: createForbiddenStub('cancelAnimationFrame'),
+    fetch: createForbiddenStub('fetch'),
+    XMLHttpRequest: createForbiddenStub('XMLHttpRequest'),
+    WebSocket: createForbiddenStub('WebSocket'),
+    document: createForbiddenObject('document'),
+    window: createForbiddenObject('window'),
+    self: createForbiddenObject('self'),
+    top: createForbiddenObject('top'),
+    parent: createForbiddenObject('parent'),
+    frames: createForbiddenObject('frames'),
+    location: createForbiddenObject('location'),
+    history: createForbiddenObject('history'),
+    localStorage: createForbiddenObject('localStorage'),
+    sessionStorage: createForbiddenObject('sessionStorage'),
+    indexedDB: createForbiddenObject('indexedDB'),
+    caches: createForbiddenObject('caches'),
+    Notification: createForbiddenStub('Notification'),
+    Worker: createForbiddenStub('Worker'),
+    SharedWorker: createForbiddenStub('SharedWorker'),
+    ServiceWorker: createForbiddenObject('ServiceWorker'),
+    Blob: createForbiddenStub('Blob'),
+    File: createForbiddenStub('File'),
+    FileReader: createForbiddenStub('FileReader'),
+    URL: createForbiddenStub('URL'),
+    URLSearchParams: createForbiddenStub('URLSearchParams'),
+    Headers: createForbiddenStub('Headers'),
+    Request: createForbiddenStub('Request'),
+    Response: createForbiddenStub('Response'),
+    EventSource: createForbiddenStub('EventSource'),
+    Image: createForbiddenStub('Image'),
+    Audio: createForbiddenStub('Audio'),
+    Video: createForbiddenStub('Video'),
+    eval: createForbiddenStub('eval'),
+    Function: createForbiddenStub('Function'),
+};
+/**
+ * Create a safe Math object with random() blocked
+ */
+export function createSafeMath() {
+    const safeMath = Object.create(Math);
+    Object.defineProperty(safeMath, 'random', {
+        get() {
+            throw new Error('[Code Mode Protocol Error] Forbidden API: Math.random() — use random() instead (seeded)');
+        },
+        configurable: false,
+        enumerable: true
+    });
+    return Object.freeze(safeMath);
+}
+/**
+ * List of all forbidden API names for documentation
+ */
+export const FORBIDDEN_API_NAMES = Object.keys(FORBIDDEN_APIS);
+/**
+ * Build the complete sandbox context for sketch execution.
+ * This includes the p5 runtime plus all forbidden API stubs.
+ */
+export function buildSandboxContext(p5Runtime) {
+    const safeMath = createSafeMath();
+    const context = {
+        ...FORBIDDEN_APIS,
+        Math: safeMath,
+    };
+    for (const key of Object.keys(p5Runtime)) {
+        context[key] = p5Runtime[key];
+    }
+    return context;
+}
+/**
+ * Create a sandboxed function that executes user code with blocked globals.
+ *
+ * The function is constructed with:
+ * 1. All forbidden APIs as explicit parameters (override globals)
+ * 2. The p5 runtime as explicit parameters
+ * 3. A `with(context)` wrapper for additional safety
+ */
+export function createSandboxedExecutor(code, additionalParams = []) {
+    const forbiddenParamNames = Object.keys(FORBIDDEN_APIS);
+    const allParams = [
+        'context',
+        'Math',
+        ...forbiddenParamNames,
+        ...additionalParams
+    ];
+    const wrappedCode = `
+    "use strict";
+    with(context) {
+      ${code}
+    }
+  `;
+    return new Function(...allParams, wrappedCode);
+}
+/**
+ * Execute user code in a sandboxed environment.
+ *
+ * @param code - The user sketch code to execute
+ * @param p5Runtime - The p5-like runtime object
+ * @param additionalContext - Additional context variables (frameCount, t, etc.)
+ */
+export function executeSandboxed(code, p5Runtime, additionalContext = {}) {
+    const safeMath = createSafeMath();
+    const fullContext = {
+        ...p5Runtime,
+        ...additionalContext,
+        Math: safeMath,
+        ...FORBIDDEN_APIS,
+    };
+    const forbiddenValues = Object.keys(FORBIDDEN_APIS).map(key => FORBIDDEN_APIS[key]);
+    const additionalParamNames = Object.keys(additionalContext);
+    const additionalValues = Object.values(additionalContext);
+    const executor = createSandboxedExecutor(code, additionalParamNames);
+    executor(fullContext, safeMath, ...forbiddenValues, ...additionalValues);
+}

package/dist/index.d.ts

@@ -1,50 +1,31 @@
 /**
- * NexArt Code Mode Runtime SDK
- * Version: 1.1.0 (Protocol v1.0.0)
+ * NexArt Code Mode Runtime SDK - App Integration Layer
  *
  * ╔══════════════════════════════════════════════════════════════════════════╗
- * ║  @nexart/codemode-sdk — Canonical Code Mode Authority                    ║
+ * ║  LOCAL SDK WRAPPER                                                       ║
  * ║                                                                          ║
- * ║  This SDK defines the official Code Mode execution surface.              ║
- * ║  All implementations (NexArt, ByX, external) MUST use this SDK.          ║
+ * ║  This file re-exports the core runtime from @nexart/codemode-sdk (npm)   ║
+ * ║  and adds app-specific integrations (SoundArt, Noise, etc.)              ║
  * ║                                                                          ║
- * ║  Protocol: nexart                                                        ║
- * ║  Engine: codemode                                                        ║
- * ║  SDK Version: 1.1.0                                                      ║
- * ║  Protocol Version: 1.0.0                                                 ║
- * ║  Phase: 1                                                                ║
- * ║  Enforcement: HARD                                                       ║
+ * ║  For core Code Mode: import from '@nexart/codemode-sdk'                  ║
+ * ║  For app integrations: import from 'sdk/codemode'                        ║
  * ╚══════════════════════════════════════════════════════════════════════════╝
- *
- * @example
- * ```typescript
- * import { executeCodeMode } from '@nexart/codemode-sdk';
- *
- * const result = await executeCodeMode({
- *   source: `function setup() { background(255); ellipse(width/2, height/2, 100); }`,
- *   width: 1950,
- *   height: 2400,
- *   seed: 12345,
- *   vars: [50, 0, 0, 0, 0, 0, 0, 0, 0, 0],
- *   mode: 'static'
- * });
- *
- * console.log(result.metadata.protocolVersion); // '1.0.0'
- * ```
  */
-export { executeCodeMode, validateCodeModeSource } from './execute';
-export type { ExecuteCodeModeInput, ExecuteCodeModeResult, ProtocolMetadata, } from './types';
-export { PROTOCOL_IDENTITY } from './types';
+export { executeCodeMode, validateCodeModeSource, DEFAULT_CONFIG, PROTOCOL_IDENTITY, } from '@nexart/codemode-sdk';
+export type { ExecuteCodeModeInput, ExecuteCodeModeResult, ProtocolMetadata, RenderResult, TimeVariables, } from '@nexart/codemode-sdk';
+export { createP5Runtime, injectTimeVariables, injectProtocolVariables, createProtocolVAR } from './p5-runtime';
+export type { P5Runtime, P5RuntimeConfig } from './p5-runtime';
 export { createEngine } from './engine';
-export type { Engine, EngineConfig, RunOptions, RenderResult, ProgressInfo, RenderMode, TimeVariables, } from './types';
-export { DEFAULT_CONFIG } from './types';
+export type { Engine, EngineConfig, RunOptions, ProgressInfo, RenderMode, } from './types';
+export { DEFAULT_CONFIG as LOCAL_DEFAULT_CONFIG } from './types';
 export { renderSoundArtViaCodeMode, canRenderViaCodeMode, getCodeModeAvailableStyles, type SoundArtEngineConfig, type SoundArtRenderOptions, type SoundArtRenderResult, type SoundArtMetadata, } from './soundart-engine';
 export { type SoundSnapshot, type SoundFeatures, createSoundSnapshot, createEmptySoundSnapshot, freezeSoundSnapshot, } from '../../shared/soundSnapshot';
 export { injectSoundGlobals, createSoundGlobals, createEmptySoundGlobals, generateSoundPalette, inferGenreProfile, createSoundHelpers, type SoundGlobals, type GenreProfile, } from './sound-bridge';
 export { getSoundArtSketch, getAvailableSoundArtSketches, isSoundArtSketchAvailable, type SoundArtSketchName, } from './soundart-sketches';
-export { createP5Runtime, type P5Runtime, type P5RuntimeConfig } from './p5-runtime';
 export { renderNoiseViaCodeMode, compileNoiseSystem, canRenderNoiseViaCodeMode, type NoiseEngineConfig, type NoiseRenderOptions, type NoiseRenderResult, type NoiseMetadata, } from './noise-engine';
 export { type NoiseSnapshot, type NoiseParams, type NoiseBlendMode, createNoiseSnapshot, validateNoiseSnapshot, } from '../../shared/noiseSnapshot';
 export { createNoiseGlobals, injectNoiseGlobals, type NoiseGlobals, } from './noise-bridge';
 export { getNoiseSketch, getAvailableNoiseSketchNames, isValidNoiseSketch, type NoiseSketchName, } from './noise-sketches';
+export { registerBuilderManifest } from './builder-manifest';
+export type { NexArtBuilderManifest } from './types';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAKH,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACpE,YAAY,EACV,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAK5C,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,YAAY,EACV,MAAM,EACN,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAGzC,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,GACtB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,YAAY,GAClB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,yBAAyB,EACzB,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,KAAK,SAAS,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAGrF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,aAAa,GACnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,YAAY,GAClB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,cAAc,EACd,4BAA4B,EAC5B,kBAAkB,EAClB,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,cAAc,EACd,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EACV,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAChB,YAAY,EACZ,aAAa,GACd,MAAM,sBAAsB,CAAC;AAO9B,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAChH,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAK/D,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,YAAY,EACV,MAAM,EACN,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,UAAU,GACX,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,cAAc,IAAI,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAGjE,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,GACtB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,YAAY,GAClB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,yBAAyB,EACzB,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,aAAa,GACnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,YAAY,GAClB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,cAAc,EACd,4BAA4B,EAC5B,kBAAkB,EAClB,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAC;AAkB1B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,YAAY,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -1,55 +1,63 @@
 /**
- * NexArt Code Mode Runtime SDK
- * Version: 1.1.0 (Protocol v1.0.0)
+ * NexArt Code Mode Runtime SDK - App Integration Layer
  *
  * ╔══════════════════════════════════════════════════════════════════════════╗
- * ║  @nexart/codemode-sdk — Canonical Code Mode Authority                    ║
+ * ║  LOCAL SDK WRAPPER                                                       ║
  * ║                                                                          ║
- * ║  This SDK defines the official Code Mode execution surface.              ║
- * ║  All implementations (NexArt, ByX, external) MUST use this SDK.          ║
+ * ║  This file re-exports the core runtime from @nexart/codemode-sdk (npm)   ║
+ * ║  and adds app-specific integrations (SoundArt, Noise, etc.)              ║
  * ║                                                                          ║
- * ║  Protocol: nexart                                                        ║
- * ║  Engine: codemode                                                        ║
- * ║  SDK Version: 1.1.0                                                      ║
- * ║  Protocol Version: 1.0.0                                                 ║
- * ║  Phase: 1                                                                ║
- * ║  Enforcement: HARD                                                       ║
+ * ║  For core Code Mode: import from '@nexart/codemode-sdk'                  ║
+ * ║  For app integrations: import from 'sdk/codemode'                        ║
  * ╚══════════════════════════════════════════════════════════════════════════╝
- *
- * @example
- * ```typescript
- * import { executeCodeMode } from '@nexart/codemode-sdk';
- *
- * const result = await executeCodeMode({
- *   source: `function setup() { background(255); ellipse(width/2, height/2, 100); }`,
- *   width: 1950,
- *   height: 2400,
- *   seed: 12345,
- *   vars: [50, 0, 0, 0, 0, 0, 0, 0, 0, 0],
- *   mode: 'static'
- * });
- *
- * console.log(result.metadata.protocolVersion); // '1.0.0'
- * ```
  */
 // ═══════════════════════════════════════════════════════════════════════════
-// CANONICAL EXECUTION ENTRY POINT
+// CORE RUNTIME - Re-exported from @nexart/codemode-sdk (npm package)
+// ═══════════════════════════════════════════════════════════════════════════
+export { executeCodeMode, validateCodeModeSource, DEFAULT_CONFIG, PROTOCOL_IDENTITY, } from '@nexart/codemode-sdk';
+// ═══════════════════════════════════════════════════════════════════════════
+// LOCAL P5 RUNTIME - Used by app integrations (SoundArt, Noise)
+// The npm package also exports createP5Runtime, but we keep local for 
+// app-specific extensions that need tighter integration
 // ═══════════════════════════════════════════════════════════════════════════
-export { executeCodeMode, validateCodeModeSource } from './execute';
-export { PROTOCOL_IDENTITY } from './types';
+export { createP5Runtime, injectTimeVariables, injectProtocolVariables, createProtocolVAR } from './p5-runtime';
 // ═══════════════════════════════════════════════════════════════════════════
-// LEGACY ENGINE API (use executeCodeMode for new implementations)
+// LEGACY ENGINE API (kept for backwards compatibility)
 // ═══════════════════════════════════════════════════════════════════════════
 export { createEngine } from './engine';
-export { DEFAULT_CONFIG } from './types';
+export { DEFAULT_CONFIG as LOCAL_DEFAULT_CONFIG } from './types';
 // SoundArt → Code Mode integration
 export { renderSoundArtViaCodeMode, canRenderViaCodeMode, getCodeModeAvailableStyles, } from './soundart-engine';
 export { createSoundSnapshot, createEmptySoundSnapshot, freezeSoundSnapshot, } from '../../shared/soundSnapshot';
 export { injectSoundGlobals, createSoundGlobals, createEmptySoundGlobals, generateSoundPalette, inferGenreProfile, createSoundHelpers, } from './sound-bridge';
 export { getSoundArtSketch, getAvailableSoundArtSketches, isSoundArtSketchAvailable, } from './soundart-sketches';
-export { createP5Runtime } from './p5-runtime';
 // Noise → Code Mode integration
 export { renderNoiseViaCodeMode, compileNoiseSystem, canRenderNoiseViaCodeMode, } from './noise-engine';
 export { createNoiseSnapshot, validateNoiseSnapshot, } from '../../shared/noiseSnapshot';
 export { createNoiseGlobals, injectNoiseGlobals, } from './noise-bridge';
 export { getNoiseSketch, getAvailableNoiseSketchNames, isValidNoiseSketch, } from './noise-sketches';
+// ═══════════════════════════════════════════════════════════════════════════
+// BUILDER MANIFEST (v1.6.0) — Passive Attribution
+// 
+// The Builder Manifest is a declaration of intent, not a capability.
+// The SDK does not expose any API to read or inspect manifests.
+// 
+// This is:
+//   - Declarative (write-only)
+//   - Optional (no errors if missing)
+//   - Non-enforced (no validation)
+//   - Non-rewarding (no incentives)
+// 
+// There is NO SDK API to read manifests, NO validation, NO attribution
+// logic, and NO tracking. Execution behavior is identical with or without
+// a manifest registered.
+// ═══════════════════════════════════════════════════════════════════════════
+export { registerBuilderManifest } from './builder-manifest';
+// ═══════════════════════════════════════════════════════════════════════════
+// EXECUTION BOUNDARY (Internal — Not Exported)
+// 
+// The execution sandbox blocks all external entropy sources at runtime.
+// See EXECUTION_BOUNDARY.md for details.
+// ═══════════════════════════════════════════════════════════════════════════
+// Note: FORBIDDEN_APIS and createSafeMath are NOT exported.
+// They are internal implementation details used by the engines.

package/dist/loop-engine.d.ts

@@ -12,6 +12,9 @@
  *
  * Determinism Guarantee:
  * Same code + same seed + same VARs = identical frame sequence
+ *
+ * Security:
+ * All external entropy sources are blocked at runtime via execution sandbox.
  */
 import type { EngineConfig, RunOptions } from './types';
 export declare function cancelLoopMode(): void;

package/dist/loop-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loop-engine.d.ts","sourceRoot":"","sources":["../loop-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAA+B,MAAM,SAAS,CAAC;AAMrF,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAED,wBAAsB,WAAW,CAC/B,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,IAAI,CAAC,CAuMf"}
+{"version":3,"file":"loop-engine.d.ts","sourceRoot":"","sources":["../loop-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAA+B,MAAM,SAAS,CAAC;AAOrF,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAED,wBAAsB,WAAW,CAC/B,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,IAAI,CAAC,CA+Mf"}

package/dist/loop-engine.js

@@ -12,9 +12,13 @@
  *
  * Determinism Guarantee:
  * Same code + same seed + same VARs = identical frame sequence
+ *
+ * Security:
+ * All external entropy sources are blocked at runtime via execution sandbox.
  */
 import { DEFAULT_CONFIG } from './types';
 import { createP5Runtime, injectProtocolVariables } from './p5-runtime';
+import { FORBIDDEN_APIS, createSafeMath } from './execution-sandbox';
 let isCancelled = false;
 export function cancelLoopMode() {
     isCancelled = true;
@@ -72,16 +76,22 @@ export async function runLoopMode(config, options) {
         }
         // Inject totalFrames into runtime
         p.totalFrames = totalFrames;
-        // Create wrapped functions with p5 context, time variables, VAR, and totalFrames
-        const wrappedSetup = new Function('p', 'frameCount', 't', 'time', 'tGlobal', 'VAR', 'totalFrames', `with(p) { ${setupCode} }`);
-        const wrappedDraw = new Function('p', 'frameCount', 't', 'time', 'tGlobal', 'VAR', 'totalFrames', `with(p) { ${drawCode} }`);
+        // Create sandboxed execution context
+        // All forbidden APIs are injected as parameters to override globals
+        const safeMath = createSafeMath();
+        const forbiddenKeys = Object.keys(FORBIDDEN_APIS);
+        // Create wrapped functions with p5 context, time variables, VAR, totalFrames, and blocked globals
+        const wrappedSetup = new Function('p', 'frameCount', 't', 'time', 'tGlobal', 'VAR', 'totalFrames', 'Math', ...forbiddenKeys, `with(p) { ${setupCode} }`);
+        const wrappedDraw = new Function('p', 'frameCount', 't', 'time', 'tGlobal', 'VAR', 'totalFrames', 'Math', ...forbiddenKeys, `with(p) { ${drawCode} }`);
+        // Get forbidden values array for execution
+        const forbiddenValues = forbiddenKeys.map(k => FORBIDDEN_APIS[k]);
         onProgress?.({
             phase: 'setup',
             percent: 10,
             message: 'Executing setup()...',
         });
-        // Execute setup() once with time = 0, VAR, and totalFrames
-        wrappedSetup(p, 0, 0, 0, 0, p.VAR, totalFrames);
+        // Execute setup() once with time = 0, VAR, totalFrames, and sandboxed context
+        wrappedSetup(p, 0, 0, 0, 0, p.VAR, totalFrames, safeMath, ...forbiddenValues);
         // Capture frames
         const frames = [];
         onProgress?.({
@@ -108,8 +118,8 @@ export async function runLoopMode(config, options) {
             // 2. Reset blend mode to NORMAL (Protocol v1.1 requirement)
             // Prevents blend mode state from persisting across frames
             p.blendMode('NORMAL');
-            // Execute draw() with time variables, VAR, and totalFrames
-            wrappedDraw(p, frame, t, time, t, p.VAR, totalFrames);
+            // Execute draw() with time variables, VAR, totalFrames, and sandboxed context
+            wrappedDraw(p, frame, t, time, t, p.VAR, totalFrames, safeMath, ...forbiddenValues);
             // Capture frame as PNG blob
             const blob = await new Promise((resolve, reject) => {
                 canvas.toBlob((b) => b ? resolve(b) : reject(new Error(`Failed to capture frame ${frame}`)), 'image/png');

package/dist/p5-runtime.d.ts

@@ -49,7 +49,8 @@ export interface P5Runtime {
 export interface P5RuntimeConfig {
     seed?: number;
 }
-export declare function createP5Runtime(canvas: HTMLCanvasElement, width: number, height: number, config?: P5RuntimeConfig): P5Runtime;
+type RuntimeCanvas = HTMLCanvasElement;
+export declare function createP5Runtime(canvas: RuntimeCanvas, width: number, height: number, config?: P5RuntimeConfig): P5Runtime;
 export declare function injectTimeVariables(p: P5Runtime, time: TimeVariables): void;
 /**
  * VAR Protocol Constants (Phase 1 — Protocol v1.0.0)
@@ -70,4 +71,5 @@ export declare const VAR_MAX = 100;
  */
 export declare function createProtocolVAR(vars?: number[]): readonly number[];
 export declare function injectProtocolVariables(p: P5Runtime, vars?: number[]): void;
+export {};
 //# sourceMappingURL=p5-runtime.d.ts.map

package/dist/p5-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"p5-runtime.d.ts","sourceRoot":"","sources":["../p5-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,UAAU,CAAC;AAClD,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAC1C,eAAO,MAAM,qBAAqB,EAAG,MAAe,CAAC;AAErD,MAAM,WAAW,SAAS;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAmED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,eAAe,CAC7B,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,eAAe,GACvB,SAAS,CAq8BX;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,GAAG,IAAI,CAM3E;AAED;;;GAGG;AACH,eAAO,MAAM,SAAS,KAAK,CAAC;AAC5B,eAAO,MAAM,OAAO,IAAI,CAAC;AACzB,eAAO,MAAM,OAAO,MAAM,CAAC;AAE3B;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,CAmCpE;AAED,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAE3E"}
+{"version":3,"file":"p5-runtime.d.ts","sourceRoot":"","sources":["../p5-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,UAAU,CAAC;AAClD,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAC1C,eAAO,MAAM,qBAAqB,EAAG,MAAe,CAAC;AAErD,MAAM,WAAW,SAAS;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAmED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,KAAK,aAAa,GAAG,iBAAiB,CAAC;AAEvC,wBAAgB,eAAe,CAC7B,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,eAAe,GACvB,SAAS,CAs8BX;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,GAAG,IAAI,CAM3E;AAED;;;GAGG;AACH,eAAO,MAAM,SAAS,KAAK,CAAC;AAC5B,eAAO,MAAM,OAAO,IAAI,CAAC;AACzB,eAAO,MAAM,OAAO,MAAM,CAAC;AAE3B;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,CAmCpE;AAED,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAE3E"}

package/dist/p5-runtime.js

@@ -93,6 +93,8 @@ function createSeededNoise(seed = 0) {
 }
 export function createP5Runtime(canvas, width, height, config) {
     const ctx = canvas.getContext('2d', { willReadFrequently: true });
+    if (!ctx)
+        throw new Error('Failed to get 2D context');
     let currentFill = 'rgba(255, 255, 255, 1)';
     let currentStroke = 'rgba(0, 0, 0, 1)';
     let strokeEnabled = true;