@quillmark/quiver 0.16.0 → 0.18.1

package/dist/built-loader.js

@@ -1,34 +1,55 @@
 /**
- * Built-quiver loader — browser-safe at module level.
- * Internal; not exported from index.ts.
+ * Built-quiver loader: reads a packed artifact through a transport, validates
+ * its pointer and manifest, and hands back a Quiver whose loader fetches
+ * bundles and fonts on demand, each checked against the digest in its name.
  *
- * Exposes:
- *   - BuiltTransport interface (implemented by HttpTransport)
- *   - loadBuiltQuiver(transport) → Quiver
+ * Package-internal, and browser-safe: no static `node:` imports at any level.
+ */
+import { QuiverError } from './errors.js';
+import { unpackFiles } from './bundle.js';
+import { isCanonicalSemver, compareSemver } from './semver.js';
+import { NAME_DIGEST_LENGTH, sha256Hex } from './digest.js';
+import { POINTER_FORMAT } from './format.js';
+import { createQuiver } from './quiver.js';
+/**
+ * Fetch, then check the bytes against the digest their name carries. That
+ * check is what makes "content-addressed, safe to cache forever" a property
+ * rather than a hope: it catches a corrupted CDN object, a partial sync, and a
+ * name reused across releases. A mismatch is a transport failure (the bytes
+ * that arrived are not the bytes asked for), so the caches that evict on error
+ * let a retry succeed.
  *
- * NO static node: imports — this module is safe to load in browser contexts.
+ * Where no digest primitive exists (a page served over plain http, which is
+ * not a secure context) the fetch passes through unchecked.
  */
-import { QuiverError } from "./errors.js";
-import { unpackFiles } from "./bundle.js";
-import { isCanonicalSemver, compareSemver } from "./semver.js";
-import { Quiver } from "./quiver.js";
-// ─── Path validation ──────────────────────────────────────────────────────────
-const MANIFEST_FILENAME_RE = /^manifest\.[0-9a-f]+\.json$/;
-const BUNDLE_FILENAME_RE = /^[A-Za-z0-9_.-]+@[0-9]+\.[0-9]+\.[0-9]+\.[0-9a-f]+\.zip$/;
-const FONT_HASH_RE = /^[0-9a-f]{32}$/;
-function validateManifestFileName(name) {
-    if (!MANIFEST_FILENAME_RE.test(name)) {
-        throw new QuiverError("quiver_invalid", `Pointer manifest filename is invalid: "${name}"`);
+async function fetchVerified(transport, path, expected) {
+    const bytes = await transport.fetchBytes(path);
+    const actual = await sha256Hex(bytes);
+    if (actual !== undefined && !actual.startsWith(expected)) {
+        throw new QuiverError('transport_error', `Digest mismatch for "${path}": the bytes hash to ${actual.slice(0, expected.length)}, not ${expected}`);
     }
+    return bytes;
 }
-function validateBundleFileName(bundle, context) {
-    if (!BUNDLE_FILENAME_RE.test(bundle)) {
-        throw new QuiverError("quiver_invalid", `${context}: bundle filename is invalid: "${bundle}"`);
+// ─── Path validation ──────────────────────────────────────────────────────────
+// Each name carries the digest of what it names; the capture group is the
+// digest the fetch is checked against, so path validation and verification
+// read the same character span. `build` writes exactly NAME_DIGEST_LENGTH
+// chars for bundles and manifests and the full 64 for store entries.
+const DIGEST = `[0-9a-f]{${NAME_DIGEST_LENGTH},}`;
+const MANIFEST_FILENAME_RE = new RegExp(`^manifest\\.(${DIGEST})\\.json$`);
+const BUNDLE_FILENAME_RE = new RegExp(`^[A-Za-z0-9_.-]+@[0-9]+\\.[0-9]+\\.[0-9]+\\.(${DIGEST})\\.zip$`);
+const FONT_HASH_RE = /^[0-9a-f]{64}$/;
+/** The digest a content-addressed filename carries. Throws `quiver_invalid`. */
+function digestOfName(re, name, what) {
+    const match = re.exec(name);
+    if (match === null) {
+        throw new QuiverError('quiver_invalid', `${what} is invalid: "${name}"`);
     }
+    return match[1];
 }
 function validateFontHash(hash, context) {
     if (!FONT_HASH_RE.test(hash)) {
-        throw new QuiverError("quiver_invalid", `${context}: font hash is invalid: "${hash}"`);
+        throw new QuiverError('quiver_invalid', `${context}: font hash is invalid: "${hash}"`);
     }
 }
 // ─── BuiltLoader implementation ─────────────────────────────────────────────
@@ -44,16 +65,11 @@ class BuiltLoader {
         this.index = index;
     }
     async loadTree(name, version) {
+        // The catalog the outer Quiver resolves against derives from this index,
+        // so every ref reaching here has an entry.
         const entry = this.index.get(`${name}@${version}`);
-        // If entry is missing, the outer Quiver.loadTree gate already validated
-        // that this name/version is in the catalog; trust that gate and fall
-        // through. The transport will surface a transport_error naturally.
-        // (Defensive: this should not be reachable in normal operation.)
-        if (!entry) {
-            throw new QuiverError("transport_error", `Quill "${name}@${version}" not found in built-quiver manifest`, { version, ref: `${name}@${version}` });
-        }
         // 1. Fetch + unpack bundle zip.
-        const zipBytes = await this.transport.fetchBytes(entry.bundle);
+        const zipBytes = await fetchVerified(this.transport, entry.bundle, digestOfName(BUNDLE_FILENAME_RE, entry.bundle, 'bundle filename'));
         const files = unpackFiles(zipBytes);
         // 2. Rehydrate fonts from store (coalesced).
         const fontEntries = Object.entries(entry.fonts);
@@ -71,9 +87,7 @@ class BuiltLoader {
     fetchFont(hash) {
         let promise = this.fontCache.get(hash);
         if (!promise) {
-            promise = this.transport
-                .fetchBytes(`store/${hash}`)
-                .catch((err) => {
+            promise = fetchVerified(this.transport, `store/${hash}`, hash).catch((err) => {
                 this.fontCache.delete(hash);
                 throw err;
             });
@@ -86,7 +100,7 @@ class BuiltLoader {
 function assertNoUnknownKeys(obj, allowed, context) {
     for (const key of Object.keys(obj)) {
         if (!allowed.includes(key)) {
-            throw new QuiverError("quiver_invalid", `${context}: unknown field "${key}"`);
+            throw new QuiverError('quiver_invalid', `${context}: unknown field "${key}"`);
         }
     }
 }
@@ -96,17 +110,28 @@ function parsePointer(raw) {
         parsed = JSON.parse(raw);
     }
     catch {
-        throw new QuiverError("quiver_invalid", "latest.json contains invalid JSON");
+        throw new QuiverError('quiver_invalid', 'latest.json contains invalid JSON');
     }
-    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-        throw new QuiverError("quiver_invalid", "latest.json must be a JSON object");
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw new QuiverError('quiver_invalid', 'latest.json must be a JSON object');
     }
     const obj = parsed;
-    assertNoUnknownKeys(obj, ["manifest"], "latest.json");
-    if (typeof obj["manifest"] !== "string" || obj["manifest"].length === 0) {
-        throw new QuiverError("quiver_invalid", 'latest.json must have a non-empty string "manifest" field');
+    // The format, read before anything is believed about the rest. An unknown key is NOT
+    // a failure here: this is the document a newer format announces itself on, and a
+    // reader rejecting what it does not recognise refuses the announcement too. Absent
+    // means a build from before the marker (`format.ts`).
+    const format = obj['format'] ?? POINTER_FORMAT;
+    if (typeof format !== 'number' || !Number.isInteger(format) || format < 1) {
+        throw new QuiverError('quiver_invalid', `latest.json: "format" must be a positive integer, got ${JSON.stringify(obj['format'])}`);
+    }
+    if (format > POINTER_FORMAT) {
+        throw new QuiverError('quiver_invalid', `This quiver is built in format ${format} and this loader reads ${POINTER_FORMAT}. ` +
+            `Upgrade @quillmark/quiver, or for a served client the client itself, which carries the copy that reads this.`);
+    }
+    if (typeof obj['manifest'] !== 'string' || obj['manifest'].length === 0) {
+        throw new QuiverError('quiver_invalid', 'latest.json must have a non-empty string "manifest" field');
     }
-    return obj["manifest"];
+    return obj['manifest'];
 }
 function parseManifest(raw) {
     let parsed;
@@ -114,95 +139,82 @@ function parseManifest(raw) {
         parsed = JSON.parse(raw);
     }
     catch {
-        throw new QuiverError("quiver_invalid", "Manifest file contains invalid JSON");
+        throw new QuiverError('quiver_invalid', 'Manifest file contains invalid JSON');
     }
-    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-        throw new QuiverError("quiver_invalid", "Manifest must be a JSON object");
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw new QuiverError('quiver_invalid', 'Manifest must be a JSON object');
     }
     const obj = parsed;
-    assertNoUnknownKeys(obj, ["version", "name", "quills"], "manifest");
-    if (obj["version"] !== 1) {
-        throw new QuiverError("quiver_invalid", `Manifest version must be 1, got ${String(obj["version"])}`);
+    assertNoUnknownKeys(obj, ['version', 'name', 'quills'], 'manifest');
+    if (obj['version'] !== 1) {
+        throw new QuiverError('quiver_invalid', `Manifest version must be 1, got ${String(obj['version'])}`);
     }
-    if (typeof obj["name"] !== "string" || obj["name"].length === 0) {
-        throw new QuiverError("quiver_invalid", 'Manifest must have a non-empty string "name" field');
+    if (typeof obj['name'] !== 'string' || obj['name'].length === 0) {
+        throw new QuiverError('quiver_invalid', 'Manifest must have a non-empty string "name" field');
     }
-    if (!Array.isArray(obj["quills"])) {
-        throw new QuiverError("quiver_invalid", 'Manifest must have a "quills" array');
+    if (!Array.isArray(obj['quills'])) {
+        throw new QuiverError('quiver_invalid', 'Manifest must have a "quills" array');
     }
     const quills = [];
-    for (let i = 0; i < obj["quills"].length; i++) {
-        const entry = obj["quills"][i];
-        if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
-            throw new QuiverError("quiver_invalid", `manifest.quills[${i}] must be an object`);
+    for (let i = 0; i < obj['quills'].length; i++) {
+        const entry = obj['quills'][i];
+        if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
+            throw new QuiverError('quiver_invalid', `manifest.quills[${i}] must be an object`);
         }
         const e = entry;
-        assertNoUnknownKeys(e, ["name", "version", "bundle", "fonts"], `manifest.quills[${i}]`);
-        if (typeof e["name"] !== "string" || e["name"].length === 0) {
-            throw new QuiverError("quiver_invalid", `manifest.quills[${i}].name must be a non-empty string`);
+        assertNoUnknownKeys(e, ['name', 'version', 'bundle', 'fonts'], `manifest.quills[${i}]`);
+        if (typeof e['name'] !== 'string' || e['name'].length === 0) {
+            throw new QuiverError('quiver_invalid', `manifest.quills[${i}].name must be a non-empty string`);
         }
-        if (typeof e["version"] !== "string" ||
-            !isCanonicalSemver(e["version"])) {
-            throw new QuiverError("quiver_invalid", `manifest.quills[${i}].version must be canonical semver (x.y.z), got "${String(e["version"])}"`);
+        if (typeof e['version'] !== 'string' || !isCanonicalSemver(e['version'])) {
+            throw new QuiverError('quiver_invalid', `manifest.quills[${i}].version must be canonical semver (x.y.z), got "${String(e['version'])}"`);
         }
-        if (typeof e["bundle"] !== "string" ||
-            e["bundle"].length === 0) {
-            throw new QuiverError("quiver_invalid", `manifest.quills[${i}].bundle must be a non-empty string`);
+        if (typeof e['bundle'] !== 'string' || e['bundle'].length === 0) {
+            throw new QuiverError('quiver_invalid', `manifest.quills[${i}].bundle must be a non-empty string`);
         }
-        validateBundleFileName(e["bundle"], `manifest.quills[${i}].bundle`);
-        if (typeof e["fonts"] !== "object" ||
-            e["fonts"] === null ||
-            Array.isArray(e["fonts"])) {
-            throw new QuiverError("quiver_invalid", `manifest.quills[${i}].fonts must be an object`);
+        digestOfName(BUNDLE_FILENAME_RE, e['bundle'], `manifest.quills[${i}].bundle filename`);
+        if (typeof e['fonts'] !== 'object' || e['fonts'] === null || Array.isArray(e['fonts'])) {
+            throw new QuiverError('quiver_invalid', `manifest.quills[${i}].fonts must be an object`);
         }
-        const fonts = e["fonts"];
+        const fonts = e['fonts'];
         for (const [k, v] of Object.entries(fonts)) {
-            if (typeof v !== "string") {
-                throw new QuiverError("quiver_invalid", `manifest.quills[${i}].fonts["${k}"] must be a string`);
+            if (typeof v !== 'string') {
+                throw new QuiverError('quiver_invalid', `manifest.quills[${i}].fonts["${k}"] must be a string`);
             }
             validateFontHash(v, `manifest.quills[${i}].fonts["${k}"]`);
         }
         quills.push({
-            name: e["name"],
-            version: e["version"],
-            bundle: e["bundle"],
-            fonts: fonts,
+            name: e['name'],
+            version: e['version'],
+            bundle: e['bundle'],
+            fonts: fonts
         });
     }
     return {
         version: 1,
-        name: obj["name"],
-        quills,
+        name: obj['name'],
+        quills
     };
 }
 // ─── Catalog assembly ─────────────────────────────────────────────────────────
 /**
- * Validate manifest bytes (`quiver_invalid` on format errors) and assemble a
- * Quiver backed by a BuiltLoader over `transport`. Shared by `loadBuiltQuiver`
- * (pointer-following) and `seedBuiltQuiver` (seed).
+ * Name → versions (descending), derived from the index. One structure backs
+ * both the loader's lookups and the Quiver's catalog, so the two cannot
+ * disagree about what the manifest holds.
  */
-function buildQuiverFromManifestBytes(transport, manifestBytes) {
-    const manifest = parseManifest(new TextDecoder().decode(manifestBytes));
-    // catalog: name → versions (desc); index: "name@version" → entry (dedup).
-    const catalogRaw = new Map();
-    const index = new Map();
-    for (const entry of manifest.quills) {
-        const key = `${entry.name}@${entry.version}`;
-        if (index.has(key)) {
-            throw new QuiverError("quiver_invalid", `Duplicate quill entry in manifest: "${key}"`);
-        }
-        index.set(key, entry);
-        const versions = catalogRaw.get(entry.name) ?? [];
+function catalogOf(index) {
+    const catalog = new Map();
+    for (const entry of index.values()) {
+        const versions = catalog.get(entry.name) ?? [];
         versions.push(entry.version);
-        catalogRaw.set(entry.name, versions);
+        catalog.set(entry.name, versions);
     }
-    for (const [, versions] of catalogRaw) {
+    for (const versions of catalog.values()) {
         versions.sort((a, b) => compareSemver(b, a));
     }
-    const loader = new BuiltLoader(transport, index);
-    return Quiver._fromLoader(manifest.name, catalogRaw, loader);
+    return catalog;
 }
-// ─── Main entry points ────────────────────────────────────────────────────────
+// ─── Main entry point ─────────────────────────────────────────────────────────
 /**
  * Load a build-output quiver via the given transport.
  *
@@ -212,36 +224,38 @@ function buildQuiverFromManifestBytes(transport, manifestBytes) {
  * 4. Returns a Quiver instance backed by a BuiltLoader.
  */
 export async function loadBuiltQuiver(transport) {
-    // 1. Fetch and parse pointer.
+    // 1. Fetch and parse pointer. It is the one name that is not
+    //    content-addressed, so it is also the one fetch that must revalidate.
     let pointerBytes;
     try {
-        pointerBytes = await transport.fetchBytes("latest.json");
+        pointerBytes = await transport.fetchBytes('latest.json', { revalidate: true });
     }
     catch (err) {
         if (err instanceof QuiverError)
             throw err;
-        throw new QuiverError("transport_error", `Failed to fetch latest.json: ${err.message}`, { cause: err });
+        throw new QuiverError('transport_error', `Failed to fetch latest.json: ${err.message}`, { cause: err });
     }
     const manifestFileName = parsePointer(new TextDecoder().decode(pointerBytes));
-    validateManifestFileName(manifestFileName);
+    const manifestDigest = digestOfName(MANIFEST_FILENAME_RE, manifestFileName, 'Pointer manifest filename');
     // 2. Fetch and parse manifest.
     let manifestBytes;
     try {
-        manifestBytes = await transport.fetchBytes(manifestFileName);
+        manifestBytes = await fetchVerified(transport, manifestFileName, manifestDigest);
     }
     catch (err) {
         if (err instanceof QuiverError)
             throw err;
-        throw new QuiverError("transport_error", `Failed to fetch manifest "${manifestFileName}": ${err.message}`, { cause: err });
+        throw new QuiverError('transport_error', `Failed to fetch manifest "${manifestFileName}": ${err.message}`, { cause: err });
     }
     // 3–4. Validate manifest + assemble catalog/loader.
-    return buildQuiverFromManifestBytes(transport, manifestBytes);
-}
-/**
- * Seed a quiver from caller-provided manifest bytes, skipping the latest.json
- * pointer fetch. `transport` is used only for lazy bundle/font fetches.
- * Throws `quiver_invalid` on malformed bytes.
- */
-export function seedBuiltQuiver(transport, manifestBytes) {
-    return buildQuiverFromManifestBytes(transport, manifestBytes);
+    const manifest = parseManifest(new TextDecoder().decode(manifestBytes));
+    const index = new Map();
+    for (const entry of manifest.quills) {
+        const key = `${entry.name}@${entry.version}`;
+        if (index.has(key)) {
+            throw new QuiverError('quiver_invalid', `Duplicate quill entry in manifest: "${key}"`);
+        }
+        index.set(key, entry);
+    }
+    return createQuiver(manifest.name, catalogOf(index), new BuiltLoader(transport, index));
 }

package/dist/bundle.js

@@ -1,7 +1,7 @@
 /**
  * Zip utilities — browser-safe (uses fflate only).
  */
-import { zipSync, unzipSync } from "fflate";
+import { zipSync, unzipSync } from 'fflate';
 /**
  * Fixed epoch mtime for deterministic zip output.
  *

package/dist/digest.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Content addressing. Browser-safe.
+ *
+ * `crypto.subtle` is the one digest primitive a browser and Node both expose,
+ * and it exists only in a secure context: a page served over plain `http://`
+ * to something other than localhost has no digest at all. Verification
+ * degrades to a no-op there rather than failing every fetch, so `undefined`
+ * means "cannot check", never "check failed". Node and any https page always
+ * have one.
+ */
+/**
+ * Digest width in the names `build` writes, in hex chars: 48 bits of SHA-256.
+ * Wide enough that a manifest name colliding with a prior release's, which
+ * under immutable CDN caching serves the old catalog forever, is not a birthday
+ * problem within any release count a quiver will see.
+ */
+export declare const NAME_DIGEST_LENGTH = 12;
+/** SHA-256 over `bytes` as lowercase hex, or undefined where no digest exists. */
+export declare function sha256Hex(bytes: Uint8Array): Promise<string | undefined>;

package/dist/digest.js

@@ -0,0 +1,25 @@
+/**
+ * Content addressing. Browser-safe.
+ *
+ * `crypto.subtle` is the one digest primitive a browser and Node both expose,
+ * and it exists only in a secure context: a page served over plain `http://`
+ * to something other than localhost has no digest at all. Verification
+ * degrades to a no-op there rather than failing every fetch, so `undefined`
+ * means "cannot check", never "check failed". Node and any https page always
+ * have one.
+ */
+/**
+ * Digest width in the names `build` writes, in hex chars: 48 bits of SHA-256.
+ * Wide enough that a manifest name colliding with a prior release's, which
+ * under immutable CDN caching serves the old catalog forever, is not a birthday
+ * problem within any release count a quiver will see.
+ */
+export const NAME_DIGEST_LENGTH = 12;
+/** SHA-256 over `bytes` as lowercase hex, or undefined where no digest exists. */
+export async function sha256Hex(bytes) {
+    const subtle = globalThis.crypto?.subtle;
+    if (subtle === undefined)
+        return undefined;
+    const digest = await subtle.digest('SHA-256', bytes);
+    return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, '0')).join('');
+}

package/dist/errors.d.ts

@@ -1,4 +1,4 @@
-export type QuiverErrorCode = "invalid_ref" | "quill_not_found" | "quiver_invalid" | "transport_error";
+export type QuiverErrorCode = 'invalid_ref' | 'quill_not_found' | 'quiver_invalid' | 'transport_error';
 export declare class QuiverError extends Error {
     readonly code: QuiverErrorCode;
     /** Offending ref string, when available. */

package/dist/errors.js

@@ -8,7 +8,7 @@ export class QuiverError extends Error {
     quiverName;
     constructor(code, message, options) {
         super(message, { cause: options?.cause });
-        this.name = "QuiverError";
+        this.name = 'QuiverError';
         this.code = code;
         this.ref = options?.ref;
         this.version = options?.version;

package/dist/format.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The built artifact's format, stamped into `latest.json` and refused to be read past
+ * (QUIVER §"The pointer" for why the pointer carries it and reads past keys it does not
+ * know).
+ *
+ * It moves when a reader assuming it would MISREAD a tree rather than fail on it: a
+ * renamed pointer field, a second pointer, a store keyed by something other than the
+ * full hash. A change confined to the manifest's own shape moves the manifest's
+ * `version` instead.
+ */
+export declare const POINTER_FORMAT = 1;

package/dist/format.js

@@ -0,0 +1,11 @@
+/**
+ * The built artifact's format, stamped into `latest.json` and refused to be read past
+ * (QUIVER §"The pointer" for why the pointer carries it and reads past keys it does not
+ * know).
+ *
+ * It moves when a reader assuming it would MISREAD a tree rather than fail on it: a
+ * renamed pointer field, a second pointer, a store keyed by something other than the
+ * full hash. A change confined to the manifest's own shape moves the manifest's
+ * `version` instead.
+ */
+export const POINTER_FORMAT = 1;

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-export { QuiverError } from "./errors.js";
-export type { QuiverErrorCode } from "./errors.js";
-export { Quiver } from "./quiver.js";
+export { QuiverError } from './errors.js';
+export type { QuiverErrorCode } from './errors.js';
+export { Quiver } from './quiver.js';

package/dist/index.js

@@ -1,10 +1,9 @@
 // Main browser-safe entrypoint.
 //
-// Exposes only browser-safe surface. Node-only factories
-// (`Quiver.fromDir`, `fromPackage`, `build`) and the `BuildOptions` type
-// live at `@quillmark/quiver/node`.
-export { QuiverError } from "./errors.js";
-export { Quiver } from "./quiver.js";
+// Exposes only browser-safe surface. The Node-only factories (`fromDir`,
+// `fromBuiltDir`, `build`) live at `@quillmark/quiver/node`.
+export { QuiverError } from './errors.js';
+export { Quiver } from './quiver.js';
 // The canonical API (`Quill`, `Document`, `Engine`, `RenderResult`, …) is not
 // re-exported: import it straight from the `@quillmark/wasm` peer dependency,
 // which is the single source of truth. `quiver.getQuill(ref)` returns a core

package/dist/node.d.ts

@@ -1,81 +1,52 @@
 /**
- * Node-only entrypoint.
+ * Node-only entrypoint: the factories that read a filesystem, as free
+ * functions. Each returns a `Quiver`; the class itself is the browser-safe one
+ * from the main entry, unmodified. Importing this module installs nothing, so
+ * the import path is the whole contract and a bundler drops what is not called.
  *
- * Importing this module is the consumer's explicit declaration of intent:
- * "I am running in Node and want the Node-only Quiver factories." It exposes
- * the same `Quiver` class as the main entry, augmented with `fromDir`,
- * `fromPackage`, `fromBuiltDir`, `build`, and `buildPackage` static methods.
+ * Bundler note: this entry pulls in `./source-loader.js`, `./build.js`, and
+ * `./transports/fs-built-transport.js`, all of which statically import `node:*`
+ * builtins. Browser bundles must never reach it. The main entry (`./index.js`)
+ * makes no static or dynamic reference to it.
+ */
+import { Quiver } from './quiver.js';
+/**
+ * Reads a Source Quiver from a local directory containing `Quiver.yaml` and
+ * `quills/<name>/<version>/Quill.yaml` entries.
+ *
+ * Also accepts an `import.meta.url`-style `file://` URL; the URL's parent
+ * directory is used as the source root.
+ *
+ * A quiver installed from npm is a directory like any other:
+ * `dirname(createRequire(import.meta.url).resolve('<pkg>/Quiver.yaml'))` is its
+ * root, resolved from the caller, whose dependencies are reachable from the
+ * caller alone under an isolated `node_modules` layout.
+ *
+ * Throws `quiver_invalid` on schema violations, `transport_error` on I/O
+ * failure.
+ */
+export declare function fromDir(pathOrFileUrl: string): Promise<Quiver>;
+/**
+ * Loads a packed (build-output) quiver from a local directory containing
+ * `latest.json` and the manifest/bundle/store files written by `build`.
+ * Symmetric to `Quiver.fromBuiltUrl(url)` but reads from disk instead of HTTP:
+ * no network required.
+ *
+ * Use this for server-side runtime when a packed artifact ships in the
+ * deployment image; consumers can keep source quivers as devDependencies and
+ * avoid self-fetching over their own load balancer.
  *
- * Side effect: at module evaluation time, the Node-only static methods are
- * installed on the shared `Quiver` constructor. Any other module that already
- * imports `Quiver` from the main entry will see the additional methods at
- * runtime — but TypeScript will only expose them on the binding imported from
- * here, so the import path remains the contract.
+ * Throws `quiver_invalid` on format errors, `transport_error` on I/O failure.
+ */
+export declare function fromBuiltDir(dirPath: string): Promise<Quiver>;
+/**
+ * Reads the Source Quiver at sourceDir, validates it, and writes the runtime
+ * build artifact to outDir, which the build clears first and therefore owns.
  *
- * Bundler note: importing this entry pulls in `./source-loader.js`,
- * `./build.js`, and `./transports/fs-built-transport.js`, all of which
- * statically import `node:*` builtins. Browser bundles must never reach this
- * module. The main entry (`./index.js`) makes no static or dynamic reference
- * to it.
+ * Throws `quiver_invalid` on source validation failures, `transport_error` on
+ * I/O failures and on an outDir holding the source quiver or the cwd.
  */
-import { Quiver as Base } from "./quiver.js";
-import { type BuildOptions } from "./build.js";
-type NodeQuiverStatics = {
-    /**
-     * Resolves an npm specifier against `node_modules` and loads the source
-     * layout at the package root. The resolved package must have `Quiver.yaml`
-     * at its root.
-     *
-     * Throws `transport_error` on resolution/I/O failure, `quiver_invalid` on
-     * schema violations.
-     */
-    fromPackage(specifier: string): Promise<Base>;
-    /**
-     * Reads a Source Quiver from a local directory containing `Quiver.yaml`
-     * and `quills/<name>/<version>/Quill.yaml` entries.
-     *
-     * Also accepts `import.meta.url`-style `file://` URLs as a convenience for
-     * tests; the URL's parent directory is used as the source root.
-     *
-     * Throws `quiver_invalid` on schema violations, `transport_error` on I/O
-     * failure.
-     */
-    fromDir(pathOrFileUrl: string): Promise<Base>;
-    /**
-     * Loads a packed (build-output) quiver from a local directory containing
-     * `latest.json` and the manifest/bundle/store files written by
-     * `Quiver.build`. Symmetric to `fromBuiltUrl(url)` but reads from disk
-     * instead of HTTP — no network required.
-     *
-     * Use this for server-side runtime when a packed artifact ships in the
-     * deployment image; consumers can keep source quivers as devDependencies
-     * and avoid self-fetching over their own load balancer.
-     *
-     * Throws `quiver_invalid` on format errors, `transport_error` on I/O
-     * failure.
-     */
-    fromBuiltDir(dirPath: string): Promise<Base>;
-    /**
-     * Reads the Source Quiver at sourceDir, validates it, and writes the
-     * runtime build artifact to outDir.
-     *
-     * Throws `quiver_invalid` on source validation failures, `transport_error`
-     * on I/O failures.
-     */
-    build(sourceDir: string, outDir: string, opts?: BuildOptions): Promise<void>;
-    /**
-     * Resolves an npm specifier against `node_modules` and builds the source
-     * layout at the package root. The resolved package must have `Quiver.yaml`
-     * at its root. Symmetric to `fromPackage` but writes a runtime build
-     * artifact to outDir instead of loading.
-     *
-     * Throws `transport_error` on resolution/I/O failure, `quiver_invalid` on
-     * source validation failures.
-     */
-    buildPackage(specifier: string, outDir: string, opts?: BuildOptions): Promise<void>;
-};
-export type Quiver = Base;
-export declare const Quiver: typeof Base & NodeQuiverStatics;
-export { QuiverError } from "./errors.js";
-export type { QuiverErrorCode } from "./errors.js";
-export type { BuildOptions } from "./build.js";
+export declare function build(sourceDir: string, outDir: string): Promise<void>;
+export { Quiver } from './quiver.js';
+export { QuiverError } from './errors.js';
+export type { QuiverErrorCode } from './errors.js';