@sentropic/artifacts 0.0.0-stage → 0.1.1

package/dist/server/object-intents.js

@@ -0,0 +1,62 @@
+/** In-memory IntentStore double for unit tests. */
+export function createMemoryIntentStore(clock = () => new Date().toISOString(), ids = () => crypto.randomUUID()) {
+    const intents = new Map();
+    return {
+        async record(kind, payload) {
+            const now = clock();
+            const intent = {
+                intentId: ids(),
+                kind,
+                state: 'pending',
+                payload: { ...payload },
+                createdAt: now,
+                updatedAt: now,
+            };
+            intents.set(intent.intentId, intent);
+            return intent;
+        },
+        async complete(intentId) {
+            const intent = intents.get(intentId);
+            if (intent === undefined)
+                throw new Error(`unknown intent: ${intentId}`);
+            intent.state = 'done';
+            intent.updatedAt = clock();
+        },
+        async markFailed(intentId, error) {
+            const intent = intents.get(intentId);
+            if (intent === undefined)
+                throw new Error(`unknown intent: ${intentId}`);
+            intent.state = 'failed';
+            intent.error = error;
+            intent.updatedAt = clock();
+        },
+        async get(intentId) {
+            return intents.get(intentId);
+        },
+        async listPending() {
+            return [...intents.values()]
+                .filter((intent) => intent.state === 'pending')
+                .sort((a, b) => (a.createdAt < b.createdAt ? -1 : 1));
+        },
+    };
+}
+/**
+ * Reconcile pending intents after a crash: the resolver inspects each
+ * pending intent (effect present → done, effect missing → failed for
+ * explicit retry) and the store records the outcome. Returns the report.
+ */
+export async function reconcileIntents(store, resolve) {
+    const report = { done: [], failed: [] };
+    for (const intent of await store.listPending()) {
+        const resolution = await resolve(intent);
+        if (resolution === 'done') {
+            await store.complete(intent.intentId);
+            report.done.push(intent.intentId);
+        }
+        else {
+            await store.markFailed(intent.intentId, 'reconcile: effect missing, explicit retry required');
+            report.failed.push(intent.intentId);
+        }
+    }
+    return report;
+}

package/dist/server/ports.d.ts

@@ -0,0 +1,34 @@
+/**
+ * L-5a — server ports (spec-v8 §9).
+ *
+ * Injected host resources for the artifact service: key/value persistence
+ * and UUID allocation. The service depends only on these ports — never on a
+ * driver, ORM row or network client — so hosts supply Postgres/S3-backed
+ * implementations (L-5b) while unit tests inject memory doubles. No eager
+ * connections or DDL on import.
+ */
+export interface KvPort {
+    get(key: string): Promise<string | undefined>;
+    /** Set only if absent; returns true when this caller won the creation. */
+    putIfAbsent(key: string, value: string): Promise<boolean>;
+}
+export interface UuidPort {
+    randomUUID(): string;
+}
+export interface ServerPorts {
+    kv: KvPort;
+    uuid: UuidPort;
+}
+/** In-memory KvPort double for unit tests (single process). */
+export declare function createMemoryKv(): KvPort;
+/** Crypto-backed UuidPort (Node runtime). */
+export declare function createCryptoUuid(): UuidPort;
+export interface KeyMutex {
+    runSerialized<T>(key: string, fn: () => Promise<T>): Promise<T>;
+}
+/**
+ * In-process per-key mutex: concurrent callers for one key serialize so
+ * exactly one creator wins (single-process scope; multi-process fencing
+ * belongs to the L-5b Postgres port).
+ */
+export declare function createKeyMutex(): KeyMutex;

package/dist/server/ports.js

@@ -0,0 +1,50 @@
+/** In-memory KvPort double for unit tests (single process). */
+export function createMemoryKv() {
+    const store = new Map();
+    return {
+        get(key) {
+            return Promise.resolve(store.get(key));
+        },
+        putIfAbsent(key, value) {
+            if (store.has(key))
+                return Promise.resolve(false);
+            store.set(key, value);
+            return Promise.resolve(true);
+        },
+    };
+}
+/** Crypto-backed UuidPort (Node runtime). */
+export function createCryptoUuid() {
+    return {
+        randomUUID() {
+            return crypto.randomUUID();
+        },
+    };
+}
+/**
+ * In-process per-key mutex: concurrent callers for one key serialize so
+ * exactly one creator wins (single-process scope; multi-process fencing
+ * belongs to the L-5b Postgres port).
+ */
+export function createKeyMutex() {
+    const locks = new Map();
+    return {
+        async runSerialized(key, fn) {
+            const previous = locks.get(key) ?? Promise.resolve();
+            let release;
+            const current = new Promise((res) => {
+                release = res;
+            });
+            locks.set(key, current);
+            await previous;
+            try {
+                return await fn();
+            }
+            finally {
+                release();
+                if (locks.get(key) === current)
+                    locks.delete(key);
+            }
+        },
+    };
+}

package/dist/server/publication.d.ts

@@ -0,0 +1,67 @@
+import type { JsonValue } from '../contracts.js';
+import type { IntentStore } from './object-intents.js';
+import type { IdempotencyStore } from './idempotency.js';
+export interface ReleaseRecord {
+    releaseId: string;
+    artifactId: string;
+    manifestDigest: string;
+    manifest: string;
+    state: 'ready';
+    createdAt: string;
+}
+export interface PublicationStateStore {
+    putRelease(release: ReleaseRecord): Promise<void>;
+    getRelease(releaseId: string): Promise<ReleaseRecord | undefined>;
+    getCurrentReleaseId(artifactId: string): Promise<string | undefined>;
+    compareAndSwapCurrent(artifactId: string, expected: string | null, next: string): Promise<boolean>;
+}
+export interface PublicationBlobStore {
+    putBlob(key: string, bytes: Uint8Array): Promise<void>;
+    getBlob(key: string): Promise<Uint8Array | undefined>;
+    /** List keys under a prefix (orphan enumeration for crash recovery/GC). */
+    listKeys(prefix: string): Promise<string[]>;
+    /** Delete a key (strict: unknown keys fail so callers notice). */
+    deleteBlob(key: string): Promise<void>;
+}
+/** Derive the `sha256:<hex>` digest from a digest-addressed blob key. */
+export declare function blobDigestOfKey(key: string): string;
+/** In-memory state-store double for unit tests (synchronous CAS). */
+export declare function createMemoryStateStore(): PublicationStateStore;
+/** In-memory blob-store double for unit tests. */
+export declare function createMemoryBlobStore(): PublicationBlobStore;
+export interface PublicationFileInput {
+    path: string;
+    mimeType: string;
+    bytes: Uint8Array;
+}
+export interface PublishInput {
+    ownerId: string;
+    storageScopeId: string;
+    artifactId: string;
+    profile: Record<string, JsonValue | undefined>;
+    files: PublicationFileInput[];
+    idempotencyKey?: string;
+    paramsHash?: string;
+}
+export interface PublishResult {
+    releaseId: string;
+    manifest: string;
+}
+export interface PublicationService {
+    publish(input: PublishInput): Promise<PublishResult>;
+    getCurrent(artifactId: string): Promise<{
+        releaseId: string;
+        manifest: string;
+    } | undefined>;
+    getRelease(releaseId: string): Promise<{
+        releaseId: string;
+        manifest: string;
+    } | undefined>;
+}
+/** Create a publication service over injected stores (no driver imports). */
+export declare function createPublicationService(deps: {
+    state: PublicationStateStore;
+    blobs: PublicationBlobStore;
+    intents: IntentStore;
+    idempotency?: IdempotencyStore;
+}): PublicationService;

package/dist/server/publication.js

@@ -0,0 +1,154 @@
+/**
+ * L-5b — publication with intents-first commit (spec-v8 §9).
+ *
+ * Every commit records a `commit-release` intent before any external object
+ * operation, writes blobs under digest-addressed keys, verifies final bytes
+ * by read-back (digest first, then size) before the release is marked ready,
+ * and CAS-promotes the current pointer. A failed step leaves the intent
+ * pending and nothing visible; a lost CAS race is an explicit conflict (the
+ * loser's blobs stay addressable orphans for L-5c GC, never a visible
+ * release). Repeating a request with the same idempotency key returns the
+ * one stored release. State and blob stores are ports; the memory doubles
+ * serve unit tests and the Postgres/S3 adapters serve integration.
+ */
+import { createHash } from 'node:crypto';
+import { canonicalManifest, manifestDigest } from '../codecs.js';
+/** Derive the `sha256:<hex>` digest from a digest-addressed blob key. */
+export function blobDigestOfKey(key) {
+    const hex = key.split('/').pop() ?? '';
+    if (!/^[0-9a-f]{64}$/.test(hex))
+        throw new Error(`invalid blob key: ${key}`);
+    return `sha256:${hex}`;
+}
+/** In-memory state-store double for unit tests (synchronous CAS). */
+export function createMemoryStateStore() {
+    const releases = new Map();
+    const current = new Map();
+    return {
+        putRelease(release) {
+            releases.set(release.releaseId, release);
+            return Promise.resolve();
+        },
+        getRelease(releaseId) {
+            return Promise.resolve(releases.get(releaseId));
+        },
+        getCurrentReleaseId(artifactId) {
+            return Promise.resolve(current.get(artifactId));
+        },
+        compareAndSwapCurrent(artifactId, expected, next) {
+            const actual = current.get(artifactId) ?? null;
+            if (actual !== expected)
+                return Promise.resolve(false);
+            current.set(artifactId, next);
+            return Promise.resolve(true);
+        },
+    };
+}
+/** In-memory blob-store double for unit tests. */
+export function createMemoryBlobStore() {
+    const blobs = new Map();
+    const store = {
+        putBlob(key, bytes) {
+            blobs.set(key, bytes);
+            return Promise.resolve();
+        },
+        getBlob(key) {
+            return Promise.resolve(blobs.get(key));
+        },
+        listKeys(prefix) {
+            return Promise.resolve([...blobs.keys()].filter((key) => key.startsWith(prefix)).sort());
+        },
+        deleteBlob(key) {
+            if (!blobs.has(key))
+                throw new Error(`unknown blob: ${key}`);
+            blobs.delete(key);
+            return Promise.resolve();
+        },
+    };
+    return store;
+}
+function shaHex(bytes) {
+    return createHash('sha256').update(bytes).digest('hex');
+}
+/** Create a publication service over injected stores (no driver imports). */
+export function createPublicationService(deps) {
+    async function commitOnce(input) {
+        const releaseId = crypto.randomUUID();
+        const entries = input.files.map((file) => {
+            const hex = shaHex(file.bytes);
+            return {
+                entry: { path: file.path, digest: `sha256:${hex}`, size: file.bytes.length, mimeType: file.mimeType },
+                key: `artifacts/${input.storageScopeId}/blobs/sha256/${hex}`,
+                bytes: file.bytes,
+            };
+        });
+        const body = {
+            schemaVersion: 'artifacts/v1',
+            artifactId: input.artifactId,
+            storageScopeId: input.storageScopeId,
+            ownerId: input.ownerId,
+            profile: input.profile,
+            files: entries.map((e) => e.entry),
+        };
+        const digest = manifestDigest(body);
+        const manifest = canonicalManifest({ ...body, digest });
+        const intent = await deps.intents.record('commit-release', {
+            artifactId: input.artifactId,
+            releaseId,
+            manifestDigest: digest,
+            blobKeys: entries.map((e) => e.key),
+        });
+        for (const { key, bytes } of entries) {
+            await deps.blobs.putBlob(key, bytes);
+        }
+        for (const { key, bytes } of entries) {
+            const stored = await deps.blobs.getBlob(key);
+            if (stored === undefined || shaHex(stored) !== shaHex(bytes)) {
+                throw new Error(`publication digest mismatch for ${key}: read-back failed`);
+            }
+            if (stored.length !== bytes.length) {
+                throw new Error(`publication size mismatch for ${key}: read-back failed`);
+            }
+        }
+        await deps.state.putRelease({
+            releaseId,
+            artifactId: input.artifactId,
+            manifestDigest: digest,
+            manifest,
+            state: 'ready',
+            createdAt: new Date().toISOString(),
+        });
+        const expected = (await deps.state.getCurrentReleaseId(input.artifactId)) ?? null;
+        const won = await deps.state.compareAndSwapCurrent(input.artifactId, expected, releaseId);
+        if (!won) {
+            await deps.intents.markFailed(intent.intentId, 'commit race lost: explicit conflict');
+            throw new Error(`publication conflict for ${input.artifactId}: concurrent commit won`);
+        }
+        await deps.intents.complete(intent.intentId);
+        return { releaseId, manifest };
+    }
+    return {
+        async publish(input) {
+            if (input.idempotencyKey !== undefined && deps.idempotency !== undefined) {
+                const { result } = await deps.idempotency.execute(input.idempotencyKey, input.paramsHash ?? '', () => commitOnce(input));
+                return result;
+            }
+            return commitOnce(input);
+        },
+        async getCurrent(artifactId) {
+            const releaseId = await deps.state.getCurrentReleaseId(artifactId);
+            if (releaseId === undefined)
+                return undefined;
+            const release = await deps.state.getRelease(releaseId);
+            if (release === undefined)
+                return undefined;
+            return { releaseId: release.releaseId, manifest: release.manifest };
+        },
+        async getRelease(releaseId) {
+            const release = await deps.state.getRelease(releaseId);
+            if (release === undefined)
+                return undefined;
+            return { releaseId: release.releaseId, manifest: release.manifest };
+        },
+    };
+}

package/dist/server/reader-profile.d.ts

@@ -0,0 +1,27 @@
+/**
+ * L-5d — reader-profile contract (spec-v8 §9 5d).
+ *
+ * Pure evaluation of who may read what, where: exact method/route matches
+ * (never prefixes), optional artifact/release bindings, owner bypass, then
+ * listed subjects, then approved accounts only when the profile allows
+ * them. Deny by default; approval comes from the host via an injected
+ * predicate (memory double in tests).
+ */
+export interface ReaderRequest {
+    subject: string;
+    method: string;
+    route: string;
+    artifactId?: string;
+    releaseId?: string;
+}
+export interface ReaderProfile {
+    ownerId?: string;
+    subjects: string[];
+    allowApprovedAccounts: boolean;
+    methods: string[];
+    routes: string[];
+    artifactId?: string;
+    releaseId?: string;
+}
+/** Evaluate a reader request against a profile (deny by default). */
+export declare function evaluateReaderProfile(profile: ReaderProfile, request: ReaderRequest, isApprovedAccount?: (principalId: string) => boolean): boolean;

package/dist/server/reader-profile.js

@@ -0,0 +1,18 @@
+/** Evaluate a reader request against a profile (deny by default). */
+export function evaluateReaderProfile(profile, request, isApprovedAccount = () => false) {
+    if (request.subject.length === 0)
+        return false;
+    if (!profile.methods.includes(request.method))
+        return false;
+    if (!profile.routes.includes(request.route))
+        return false;
+    if (profile.artifactId !== undefined && request.artifactId !== profile.artifactId)
+        return false;
+    if (profile.releaseId !== undefined && request.releaseId !== profile.releaseId)
+        return false;
+    if (profile.ownerId !== undefined && request.subject === profile.ownerId)
+        return true;
+    if (profile.subjects.includes(request.subject))
+        return true;
+    return profile.allowApprovedAccounts && isApprovedAccount(request.subject);
+}

package/dist/server/runtime.d.ts

@@ -0,0 +1,33 @@
+/**
+ * L-5d — generic content runtime (spec-v8 §9 5d).
+ *
+ * Serve current release bytes to authorized readers over injected host
+ * ports (no driver imports). Terminal states report instead of serving;
+ * digests outside the current manifest never oracle (404); stored bytes
+ * are checked against the manifest size before serving.
+ */
+import type { AclStore } from './access.js';
+import type { LifecycleService } from './lifecycle.js';
+import type { PublicationBlobStore, PublicationService } from './publication.js';
+export interface ContentDeps {
+    acls: AclStore;
+    lifecycle: LifecycleService;
+    publication: PublicationService;
+    blobs: PublicationBlobStore;
+}
+export interface ServeFileInput {
+    artifactId: string;
+    digest: string;
+    actorId: string;
+    isApproved?: (principalId: string) => boolean;
+}
+export interface ServedFile {
+    digest: string;
+    mimeType: string;
+    size: number;
+    bytes: Uint8Array;
+}
+/** Create the content runtime over injected host ports. */
+export declare function createContentRuntime(deps: ContentDeps): {
+    serveFile(input: ServeFileInput): Promise<ServedFile>;
+};

package/dist/server/runtime.js

@@ -0,0 +1,44 @@
+/** Create the content runtime over injected host ports. */
+export function createContentRuntime(deps) {
+    return {
+        async serveFile(input) {
+            const isApproved = input.isApproved ?? (() => false);
+            const acl = await deps.acls.getArtifactAcl(input.artifactId);
+            if (acl === undefined)
+                throw new Error(`unknown artifact: ${input.artifactId}`);
+            if (acl.storageScopeId === undefined) {
+                throw new Error('invalid request: missing storage scope');
+            }
+            const state = await deps.lifecycle.stateOf(input.artifactId);
+            if (state === 'deleted' || state === 'purged') {
+                throw new Error(`cannot serve ${state} artifact: terminal ${input.artifactId}`);
+            }
+            const readable = deps.lifecycle.canRead({ artifactId: input.artifactId, state }, acl, input.actorId, 'read', isApproved);
+            if (!readable) {
+                throw new Error(`access denied: ${input.actorId} cannot read ${input.artifactId}`);
+            }
+            const current = await deps.publication.getCurrent(input.artifactId);
+            if (current === undefined)
+                throw new Error(`no release to serve for ${input.artifactId}`);
+            const manifest = JSON.parse(current.manifest);
+            const file = (manifest.files ?? []).find((entry) => entry.digest === input.digest);
+            if (file === undefined || typeof file.digest !== 'string') {
+                throw new Error(`unknown blob: ${input.digest} for ${input.artifactId}`);
+            }
+            const hex = file.digest.startsWith('sha256:') ? file.digest.slice('sha256:'.length) : file.digest;
+            const key = `artifacts/${acl.storageScopeId}/blobs/sha256/${hex}`;
+            const bytes = await deps.blobs.getBlob(key);
+            if (bytes === undefined)
+                throw new Error(`unknown blob: ${file.digest} for ${input.artifactId}`);
+            if (typeof file.size === 'number' && bytes.length !== file.size) {
+                throw new Error(`size mismatch for ${file.digest}: manifest ${file.size}, stored ${bytes.length}`);
+            }
+            return {
+                digest: file.digest,
+                mimeType: typeof file.mimeType === 'string' ? file.mimeType : 'application/octet-stream',
+                size: bytes.length,
+                bytes,
+            };
+        },
+    };
+}

package/dist/server/service.d.ts

@@ -0,0 +1,19 @@
+import type { ServerPorts } from './ports.js';
+export interface EnsurePrivateViewInput {
+    actorUserId: string;
+    ownerId: string;
+    storageScopeId: string;
+    bindingName: string;
+    idempotencyKey: string;
+    paramsHash: string;
+}
+export interface EnsurePrivateViewResult {
+    artifactId: string;
+    created: boolean;
+    replayed: boolean;
+}
+export interface ArtifactService {
+    ensurePrivateView(input: EnsurePrivateViewInput): Promise<EnsurePrivateViewResult>;
+}
+/** Create the artifact service over explicit injected ports (no defaults). */
+export declare function createArtifactService(ports: ServerPorts): ArtifactService;

package/dist/server/service.js

@@ -0,0 +1,32 @@
+/**
+ * L-5a — artifact service (spec-v8 §9).
+ *
+ * One service for both HTTP and MCP: it composes authorization, idempotent
+ * execution and stable bindings in a fixed order. Authorization runs first
+ * so a forged actor creates nothing — no binding, no idempotency record.
+ * Storage and UUIDs come from injected ServerPorts only; there is no
+ * implicit default store (fail-closed construction).
+ */
+import { assertArtifactAccess } from './authorization.js';
+import { createBindingService } from './bindings.js';
+import { createIdempotencyStore } from './idempotency.js';
+/** Create the artifact service over explicit injected ports (no defaults). */
+export function createArtifactService(ports) {
+    const bindings = createBindingService(ports.kv, ports.uuid);
+    const idempotent = createIdempotencyStore(ports.kv);
+    return {
+        async ensurePrivateView(input) {
+            assertArtifactAccess({
+                actorUserId: input.actorUserId,
+                artifactOwnerId: input.ownerId,
+                action: 'mutate',
+            });
+            const { result, replayed } = await idempotent.execute(input.idempotencyKey, input.paramsHash, () => bindings.ensure({
+                ownerId: input.ownerId,
+                storageScopeId: input.storageScopeId,
+                bindingName: input.bindingName,
+            }));
+            return { artifactId: result.artifactId, created: result.created, replayed };
+        },
+    };
+}

package/dist/server/sources.d.ts

@@ -0,0 +1,27 @@
+/**
+ * L-5c — source references (spec-v8 §9 5c).
+ *
+ * A source is explicit provenance attached to an artifact: the original
+ * inline bytes, a base commit, or a build recipe. Validation is strict at
+ * attach time (known kind, non-empty commit/steps) — sources are declared,
+ * never inferred from content.
+ */
+export type SourceRef = {
+    kind: 'inline-original';
+} | {
+    kind: 'base-commit';
+    commit: string;
+} | {
+    kind: 'recipe';
+    steps: string[];
+};
+/** Parse an untrusted source payload into a validated reference (no casts). */
+export declare function parseSourceRef(value: unknown): SourceRef;
+/** Validate and attach a source reference (fail-closed on unknown kinds). */
+export declare function attachSource(source: SourceRef): SourceRef;
+export interface SourceStore {
+    getSource(artifactId: string): Promise<SourceRef | undefined>;
+    putSource(artifactId: string, source: SourceRef): Promise<void>;
+}
+/** In-memory SourceStore double for unit tests. */
+export declare function createMemorySourceStore(): SourceStore;

package/dist/server/sources.js

@@ -0,0 +1,56 @@
+/** Parse an untrusted source payload into a validated reference (no casts). */
+export function parseSourceRef(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new Error('invalid source: must be an object');
+    }
+    const record = value;
+    switch (record['kind']) {
+        case 'inline-original':
+            return attachSource({ kind: 'inline-original' });
+        case 'base-commit': {
+            const commit = record['commit'];
+            if (typeof commit !== 'string')
+                throw new Error('invalid source: missing commit');
+            return attachSource({ kind: 'base-commit', commit });
+        }
+        case 'recipe': {
+            const steps = record['steps'];
+            if (!Array.isArray(steps) || steps.some((step) => typeof step !== 'string')) {
+                throw new Error('invalid source: steps must be strings');
+            }
+            return attachSource({ kind: 'recipe', steps: steps });
+        }
+        default:
+            throw new Error(`invalid source: unknown kind ${String(record['kind'])}`);
+    }
+}
+/** Validate and attach a source reference (fail-closed on unknown kinds). */
+export function attachSource(source) {
+    switch (source.kind) {
+        case 'inline-original':
+            return { kind: 'inline-original' };
+        case 'base-commit':
+            if (source.commit.length === 0)
+                throw new Error('invalid source: empty commit');
+            return { kind: 'base-commit', commit: source.commit };
+        case 'recipe':
+            if (source.steps.length === 0)
+                throw new Error('invalid source: empty steps');
+            return { kind: 'recipe', steps: [...source.steps] };
+        default:
+            throw new Error(`invalid source: unknown kind ${source.kind}`);
+    }
+}
+/** In-memory SourceStore double for unit tests. */
+export function createMemorySourceStore() {
+    const sources = new Map();
+    return {
+        getSource(artifactId) {
+            return Promise.resolve(sources.get(artifactId));
+        },
+        putSource(artifactId, source) {
+            sources.set(artifactId, source);
+            return Promise.resolve();
+        },
+    };
+}

package/dist/server/templates.d.ts

@@ -0,0 +1,33 @@
+/**
+ * L-5e — template kit + API guide catalog (spec-v8 §9 5e).
+ *
+ * The generic provider ships a minimal static-web kit and a versioned guide
+ * describing the artifacts_* surface. Hosts inject their own catalog port
+ * (approved template/guide assets); the default catalog carries no
+ * credentials, no host data and no external URLs. A template kit contains
+ * approved sources plus a build recipe — never executable server builds.
+ */
+export interface TemplateFile {
+    path: string;
+    content: string;
+}
+export interface ArtifactTemplate {
+    templateId: string;
+    version: string;
+    description: string;
+    files: TemplateFile[];
+    buildRecipe: string[];
+}
+export interface ApiGuide {
+    version: string;
+    markdown: string;
+}
+export interface TemplateCatalogPort {
+    getTemplate(templateId: string): Promise<ArtifactTemplate | undefined>;
+    /** Omit the version for the catalog's current guide. */
+    getApiGuide(version?: string): Promise<ApiGuide | undefined>;
+}
+export declare const DEFAULT_TEMPLATE_ID = "static-html";
+export declare const DEFAULT_API_GUIDE_VERSION = "v1";
+/** Generic in-package catalog; hosts override with approved local assets. */
+export declare function createDefaultTemplateCatalog(): TemplateCatalogPort;