@try-works/dsh-model-as-tool 0.1.3 → 0.4.0

package/lib/ptc-authority.d.ts

@@ -0,0 +1,140 @@
+/**
+ * The authorized tool bindings a PTC program may call (CODE-03, ARCH-01, SEC-03).
+ *
+ * The directive is specific about this, and about what NOT to do:
+ *
+ *   "ONE authorized-tool-pipeline function feeding both native PTC and external
+ *    `tool_mode_run` — intersect requested names with the grant and the visible tool set,
+ *    REJECT unknown/forbidden rather than omit."
+ *
+ * **Reject rather than omit** is the whole design. A program that asks for a tool it may
+ * not have must fail loudly: silently handing it a smaller namespace produces a program
+ * that runs, quietly does something other than what it says, and reports success. That is
+ * worse than a refusal, because the caller cannot tell the difference.
+ *
+ * The bindings themselves are built with a **null prototype**, so a program cannot reach
+ * `Object.prototype` through a binding name — `toString`, `constructor` and `__proto__`
+ * stop being reachable as if they were tools.
+ *
+ * @module @try-works/dsh-model-as-tool/ptc-authority
+ */
+/**
+ * One binding a program may call.
+ *
+ * The shape is what a PTC runtime expects: a function that takes already-validated
+ * arguments and returns the tool's canonical value.
+ */
+export type ToolBinding = (args: Record<string, unknown>) => Promise<unknown>;
+/** What a program asked for. */
+export interface ProgramRequest {
+    /** The tool names the generated program declares it will call. */
+    readonly requested: readonly string[];
+}
+/** What the caller is permitted to reach. */
+export interface ProgramAuthority {
+    /**
+     * The tool names the caller's grant admits.
+     *
+     * This is the AUTHORIZATION half. A tool absent here is forbidden regardless of whether
+     * it is registered.
+     */
+    readonly granted: readonly string[];
+    /**
+     * The tool names actually registered right now.
+     *
+     * This is the AVAILABILITY half, and it is separate: a granted tool whose owning
+     * extension is deactivated is not available, while a registered tool the caller has no
+     * grant for is not permitted. Only the INTERSECTION is bindable.
+     */
+    readonly visible: readonly string[];
+}
+/** Why one requested name was refused. */
+export interface BindingRejection {
+    readonly name: string;
+    readonly reason: 
+    /** No such tool is registered. */
+    'unknown'
+    /** Registered, but the caller's grant does not admit it. */
+     | 'forbidden'
+    /** Requested more than once, which makes the program ambiguous. */
+     | 'duplicate'
+    /** Not a usable identifier as a binding name. */
+     | 'invalid-name'
+    /** CODE-07: never bindable inside a program, regardless of grant. */
+     | 'excluded';
+    /** What the caller can do about it, when anything. */
+    readonly remedy: string;
+}
+/** The outcome of authorizing a program's requested tools. */
+export type AuthorityDecision = {
+    readonly ok: true;
+    /** The bindings, with a null prototype. */
+    readonly bindings: Record<string, ToolBinding>;
+    /** The names that were bound, in request order. */
+    readonly bound: readonly string[];
+} | {
+    readonly ok: false;
+    /**
+     * EVERY rejection, not the first.
+     *
+     * A program asking for three tools it cannot have should learn all three in one
+     * round rather than being handed the next one each time.
+     */
+    readonly rejections: readonly BindingRejection[];
+};
+/**
+ * Whether a name is usable as a binding.
+ *
+ * A generated program references bindings as identifiers, so a name that is not a plain
+ * identifier cannot be bound — and `__proto__` in particular must never become a key on
+ * the map, since assigning it would change the object's prototype rather than add a field.
+ * @param name - the candidate name.
+ * @returns whether it is usable.
+ */
+export declare function isBindableName(name: string): boolean;
+/**
+ * Tool names a program binding must NEVER expose, regardless of grant (CODE-07).
+ *
+ * `tool_mode_run` is the recursive composition door: a program could nest programs, which
+ * the requirement forbids in v1. The management surface (`model_tools` and the extension
+ * install/activation controls) is operator territory: EXT-32 excludes installer and
+ * administration bindings from Code Mode, and SEC-09 keeps installation approval separate
+ * from tool-use permission, so a program that could reach them would hold the management
+ * grant by proxy.
+ *
+ * EXPORTED so the planning surface (NDL-02) reuses the SAME names: a `tools_plan`
+ * proposal must never target the composition door or the management surface either, and a
+ * second, independently maintained copy of this list would drift the first time one of
+ * them was edited. One set, two consumers, both refused by name.
+ *
+ * SEALED AS A FROZEN ARRAY, deliberately not a frozen `Set`: freezing a `Set` does NOT
+ * prevent `add`/`delete` (those methods mutate internal slots without consulting
+ * extensibility), so a frozen Set would only LOOK immutable. A frozen array throws on
+ * every mutation in strict mode, so neither consumer — nor any code holding a
+ * reference — can add or remove a name at runtime and silently desynchronize the two
+ * surfaces that depend on it.
+ */
+export declare const EXCLUDED_BINDINGS: readonly string[];
+/**
+ * Build the bindings a program may call (CODE-03, SEC-03).
+ *
+ * Intersects the requested names with BOTH the grant and the visible set, and refuses the
+ * whole request if anything is unattainable — so a program never runs against a smaller
+ * namespace than it declared.
+ *
+ * @param request - what the program asked for.
+ * @param authority - what is granted and what is available.
+ * @param resolve - resolves one bound name to its implementation.
+ * @returns the bindings, or every rejection.
+ */
+export declare function authorizeProgramTools(request: ProgramRequest, authority: ProgramAuthority, resolve: (name: string) => ToolBinding | undefined): AuthorityDecision;
+/**
+ * Describe a refusal for a caller (CODE-03).
+ *
+ * Names every rejection and why, because a program author who is told only that the
+ * request failed cannot fix it.
+ * @param rejections - the refusals.
+ * @returns a readable summary.
+ */
+export declare function describeRejections(rejections: readonly BindingRejection[]): string;
+//# sourceMappingURL=ptc-authority.d.ts.map

package/lib/ptc-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ptc-authority.d.ts","sourceRoot":"","sources":["../src/ptc-authority.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;AAE7E,gCAAgC;AAChC,MAAM,WAAW,cAAc;IAC7B,kEAAkE;IAClE,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;CACtC;AAED,6CAA6C;AAC7C,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM;IACb,kCAAkC;IAChC,SAAS;IACX,4DAA4D;OAC1D,WAAW;IACb,mEAAmE;OACjE,WAAW;IACb,iDAAiD;OAC/C,cAAc;IAChB,qEAAqE;OACnE,UAAU,CAAA;IACd,sDAAsD;IACtD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,8DAA8D;AAC9D,MAAM,MAAM,iBAAiB,GACzB;IACA,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;IACjB,2CAA2C;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAC9C,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC,GACC;IACA,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAA;IAClB;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,gBAAgB,EAAE,CAAA;CACjD,CAAA;AAEH;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQpD;AAgCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAAqG,CAAA;AAEpJ;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,WAAW,GAAG,SAAS,GACjD,iBAAiB,CAsGnB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,SAAS,gBAAgB,EAAE,GAAG,MAAM,CAGlF"}

package/lib/ptc-authority.js

@@ -0,0 +1,216 @@
+/**
+ * The authorized tool bindings a PTC program may call (CODE-03, ARCH-01, SEC-03).
+ *
+ * The directive is specific about this, and about what NOT to do:
+ *
+ *   "ONE authorized-tool-pipeline function feeding both native PTC and external
+ *    `tool_mode_run` — intersect requested names with the grant and the visible tool set,
+ *    REJECT unknown/forbidden rather than omit."
+ *
+ * **Reject rather than omit** is the whole design. A program that asks for a tool it may
+ * not have must fail loudly: silently handing it a smaller namespace produces a program
+ * that runs, quietly does something other than what it says, and reports success. That is
+ * worse than a refusal, because the caller cannot tell the difference.
+ *
+ * The bindings themselves are built with a **null prototype**, so a program cannot reach
+ * `Object.prototype` through a binding name — `toString`, `constructor` and `__proto__`
+ * stop being reachable as if they were tools.
+ *
+ * @module @try-works/dsh-model-as-tool/ptc-authority
+ */
+/**
+ * Whether a name is usable as a binding.
+ *
+ * A generated program references bindings as identifiers, so a name that is not a plain
+ * identifier cannot be bound — and `__proto__` in particular must never become a key on
+ * the map, since assigning it would change the object's prototype rather than add a field.
+ * @param name - the candidate name.
+ * @returns whether it is usable.
+ */
+export function isBindableName(name) {
+    if (name.length === 0 || name.length > 64)
+        return false;
+    if (!/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name))
+        return false;
+    // Reserved words would produce a program that cannot be generated.
+    if (RESERVED_WORDS.has(name))
+        return false;
+    // Globals a binding must never shadow, because the runtime supplies them.
+    if (RESERVED_BINDING_GLOBALS.has(name))
+        return false;
+    return true;
+}
+/** Words that cannot appear as bindings in the generated language. */
+const RESERVED_WORDS = new Set([
+    'await', 'break', 'case', 'catch', 'class', 'const', 'continue', 'debugger', 'default',
+    'delete', 'do', 'else', 'enum', 'export', 'extends', 'false', 'finally', 'for',
+    'function', 'if', 'import', 'in', 'instanceof', 'new', 'null', 'return', 'super',
+    'switch', 'this', 'throw', 'true', 'try', 'typeof', 'var', 'void', 'while', 'with',
+    'yield', 'let', 'static', 'implements', 'interface', 'package', 'private', 'protected',
+    'public',
+]);
+/** Globals the runtime supplies, which a binding must not replace. */
+const RESERVED_BINDING_GLOBALS = new Set([
+    'console', 'globalThis', 'process', 'require', 'module', 'exports', 'JSON', 'Math',
+    'Promise', 'Object', 'Array', 'String', 'Number', 'Boolean', 'Date', 'RegExp', 'Error',
+    'Map', 'Set', 'Symbol', 'BigInt', 'Reflect', 'Proxy', 'undefined', 'NaN', 'Infinity',
+    'eval', 'Function', 'arguments', 'prototype', 'constructor', '__proto__',
+    /**
+     * EVERY `Object.prototype` member, named explicitly.
+     *
+     * These are not globals and not reserved words, so a check for those two categories
+     * alone lets them through — and they are exactly the names a program probes for. Even
+     * with a null-prototype map, refusing them BY NAME means a name that resolves to
+     * inherited behaviour can never be bound, rather than depending on the map's prototype
+     * staying null forever.
+     */
+    'toString', 'toLocaleString', 'valueOf', 'hasOwnProperty', 'isPrototypeOf',
+    'propertyIsEnumerable', '__defineGetter__', '__defineSetter__', '__lookupGetter__',
+    '__lookupSetter__',
+]);
+/**
+ * Tool names a program binding must NEVER expose, regardless of grant (CODE-07).
+ *
+ * `tool_mode_run` is the recursive composition door: a program could nest programs, which
+ * the requirement forbids in v1. The management surface (`model_tools` and the extension
+ * install/activation controls) is operator territory: EXT-32 excludes installer and
+ * administration bindings from Code Mode, and SEC-09 keeps installation approval separate
+ * from tool-use permission, so a program that could reach them would hold the management
+ * grant by proxy.
+ *
+ * EXPORTED so the planning surface (NDL-02) reuses the SAME names: a `tools_plan`
+ * proposal must never target the composition door or the management surface either, and a
+ * second, independently maintained copy of this list would drift the first time one of
+ * them was edited. One set, two consumers, both refused by name.
+ *
+ * SEALED AS A FROZEN ARRAY, deliberately not a frozen `Set`: freezing a `Set` does NOT
+ * prevent `add`/`delete` (those methods mutate internal slots without consulting
+ * extensibility), so a frozen Set would only LOOK immutable. A frozen array throws on
+ * every mutation in strict mode, so neither consumer — nor any code holding a
+ * reference — can add or remove a name at runtime and silently desynchronize the two
+ * surfaces that depend on it.
+ */
+export const EXCLUDED_BINDINGS = Object.freeze(['tool_mode_run', 'model_tools', 'tool_mode_list', 'tool_mode_describe']);
+/**
+ * Build the bindings a program may call (CODE-03, SEC-03).
+ *
+ * Intersects the requested names with BOTH the grant and the visible set, and refuses the
+ * whole request if anything is unattainable — so a program never runs against a smaller
+ * namespace than it declared.
+ *
+ * @param request - what the program asked for.
+ * @param authority - what is granted and what is available.
+ * @param resolve - resolves one bound name to its implementation.
+ * @returns the bindings, or every rejection.
+ */
+export function authorizeProgramTools(request, authority, resolve) {
+    const granted = new Set(authority.granted);
+    const visible = new Set(authority.visible);
+    const rejections = [];
+    const seen = new Set();
+    const bound = [];
+    for (const name of request.requested) {
+        if (!isBindableName(name)) {
+            rejections.push({
+                name,
+                reason: 'invalid-name',
+                remedy: 'A binding name must be a plain identifier that is not a reserved word, a runtime global or __proto__.',
+            });
+            continue;
+        }
+        if (seen.has(name)) {
+            rejections.push({
+                name,
+                reason: 'duplicate',
+                remedy: 'Request each tool once; a repeated name makes the generated bindings ambiguous.',
+            });
+            continue;
+        }
+        seen.add(name);
+        /**
+         * CODE-07 EXCLUSIONS ARE CHECKED FIRST.
+         *
+         * These names are un-bindable by policy, not by grant state: whether the caller's
+         * grant admits them is irrelevant, because a program must never hold the composition
+         * door or the management surface regardless of who authorizes it.
+         */
+        if (EXCLUDED_BINDINGS.includes(name)) {
+            rejections.push({
+                name,
+                reason: 'excluded',
+                remedy: `"${name}" cannot be called from a program: recursive composition and management bindings are excluded from Code Mode (CODE-07).`,
+            });
+            continue;
+        }
+        /**
+         * FORBIDDEN IS CHECKED BEFORE UNKNOWN, deliberately.
+         *
+         * A caller probing for names it has no grant for must be told "forbidden" rather than
+         * "unknown": telling it a tool does not exist would let it infer the difference
+         * between a name that is absent and a name it may not use, and the second is
+         * information the caller has not earned.
+         */
+        if (!granted.has(name)) {
+            rejections.push({
+                name,
+                reason: 'forbidden',
+                remedy: 'Request only tools this invocation is authorized for; the grant is not widened by asking.',
+            });
+            continue;
+        }
+        if (!visible.has(name)) {
+            rejections.push({
+                name,
+                reason: 'unknown',
+                remedy: 'The tool is authorized but not currently registered; its owning extension may be deactivated.',
+            });
+            continue;
+        }
+        if (resolve(name) === undefined) {
+            rejections.push({
+                name,
+                reason: 'unknown',
+                remedy: 'No implementation is bound for this name.',
+            });
+            continue;
+        }
+        bound.push(name);
+    }
+    if (rejections.length > 0) {
+        // ALL OR NOTHING. Binding the reachable subset would run a program that does not do
+        // what it declares, which is the failure mode this refusal exists to prevent.
+        return { ok: false, rejections };
+    }
+    /**
+     * A NULL-PROTOTYPE map, built with `defineProperty`.
+     *
+     * A plain object literal would inherit `toString`, `constructor` and friends, so a
+     * program referencing `toString()` would reach `Object.prototype` instead of failing.
+     * A null prototype removes that path entirely rather than filtering the names that use
+     * it.
+     */
+    const bindings = Object.create(null);
+    for (const name of bound) {
+        const binding = resolve(name);
+        Object.defineProperty(bindings, name, {
+            value: binding,
+            enumerable: true,
+            writable: false,
+            configurable: false,
+        });
+    }
+    return { ok: true, bindings, bound };
+}
+/**
+ * Describe a refusal for a caller (CODE-03).
+ *
+ * Names every rejection and why, because a program author who is told only that the
+ * request failed cannot fix it.
+ * @param rejections - the refusals.
+ * @returns a readable summary.
+ */
+export function describeRejections(rejections) {
+    const lines = rejections.map(entry => `  ${entry.name}: ${entry.reason} — ${entry.remedy}`);
+    return `the program requested tools it may not use:\n${lines.join('\n')}`;
+}
+//# sourceMappingURL=ptc-authority.js.map

package/lib/ptc-runtime.d.ts

@@ -0,0 +1,156 @@
+/**
+ * PTC runtime integration: a guarded mount and the ONE authorized tool pipeline.
+ *
+ * The directive is explicit that this is repository work, not a missing upstream product:
+ *
+ *   "Use the existing `@deepseek-ai/dsh-ptc-runtime` interface and a compatible
+ *    `@deepseek-ai/dsh-ptc-runtime-node` backend. Compose its filesystem, subprocess,
+ *    sandbox, and policy dependencies. **Do not call `ctx.ptcRuntime` without mounting a
+ *    provider and then report the missing service as an unavailable upstream product.**"
+ *
+ *   "Native DSH PTC and external `tool_mode_run` must use the SAME authorized tool
+ *    pipeline."
+ *
+ * Two facts shape the mount, both discovered by reading the DSH source rather than guessed:
+ *
+ * 1. **The base bundle already mounts a provider.** `packages/bundle/base/cordis.patch.yml`
+ *    registers `@deepseek-ai/dsh-ptc-runtime-node`, so an UNGUARDED `ctx.plugin(...)`
+ *    throws `service "ptcRuntime" has been registered at <...>`. The guard is mandatory in
+ *    both outcomes, so it is not conditional on which host this finds.
+ * 2. **The composed services are the inject list**, not something the plugin supplies:
+ *    `static inject = ['fs','subprocess','sandbox','sandboxPolicy']`. Mounting them here
+ *    would hit the same duplicate-service throw.
+ *
+ * Everything that touches Cordis or DSH is INJECTED, so the guard logic and the authorized
+ * pipeline are testable without a live runtime.
+ *
+ * @module @try-works/dsh-model-as-tool/ptc-runtime
+ */
+import { type ProgramAuthority, type ToolBinding } from './ptc-authority.ts';
+/** The service key the abstract runtime registers itself under. */
+export declare const PTC_SERVICE = "ptcRuntime";
+/** A Cordis-like context, narrowed to what this module needs. */
+export interface PtcHostContext {
+    /** Resolve a service, or `undefined` when nothing provides it. */
+    get(service: string): unknown;
+    /** Mount a plugin. */
+    plugin(plugin: unknown, config?: Record<string, unknown>): Promise<unknown> | unknown;
+}
+/** What a mount attempt did. */
+export interface MountOutcome {
+    /**
+     * Whether this call performed the mount.
+     *
+     * `false` means the host ALREADY had a provider, which is the expected case inside a
+     * full DSH deployment and is a SUCCESS rather than a skip — the distinction is what
+     * stops "already present" being reported as "unavailable".
+     */
+    readonly mounted: boolean;
+    /** Why it did not mount, when it did not. */
+    readonly reason?: 'already-provided' | 'backend-unavailable';
+    /** The service that is now usable, whichever path produced it. */
+    readonly service: string;
+}
+/**
+ * Mount the Node PTC backend, but only when nothing already provides the service.
+ *
+ * @param ctx - the host context.
+ * @param backend - the backend plugin, or `undefined` when it could not be resolved.
+ * @param config - backend configuration.
+ * @returns what happened.
+ */
+export declare function mountPtcRuntimeIfAbsent(ctx: PtcHostContext, backend: unknown, config?: Record<string, unknown>): Promise<MountOutcome>;
+/** The default budgets, mirroring the backend's own documented defaults. */
+export declare const PTC_DEFAULT_BUDGETS: {
+    readonly timeoutMs: 120000;
+    readonly maxTimeoutMs: 600000;
+    readonly maxOutputBytes: number;
+    readonly maxOldGenerationSizeMb: 512;
+};
+/** One authorized binding, ready to expose to a program. */
+export interface BindingNamespace {
+    /** The global the program sees, e.g. `tools`. */
+    readonly global: string;
+    readonly functions: Record<string, ToolBinding>;
+}
+/** A request to build the program-visible bindings. */
+export interface BindingRequest {
+    /** The tool names the program declares it will call. */
+    readonly requested: readonly string[];
+    /** What is granted and what is visible. */
+    readonly authority: ProgramAuthority;
+    /** The global identifier the program sees. */
+    readonly global?: string;
+    /**
+     * Resolves one tool name to a binding.
+     *
+     * The CALLER supplies this so that native PTC and external `tool_mode_run` reach tools
+     * through the same execution function rather than through two implementations of it.
+     */
+    readonly resolve: (name: string) => ToolBinding | undefined;
+}
+/** The outcome of building bindings. */
+export type BindingOutcome = {
+    readonly ok: true;
+    readonly namespace: BindingNamespace;
+} | {
+    readonly ok: false;
+    readonly message: string;
+};
+/**
+ * Build the namespace a program may call (CODE-03, SEC-03).
+ *
+ * Refuses the WHOLE request when any name is unattainable, so a program never runs against
+ * a smaller namespace than it declares.
+ *
+ * @param request - what to bind.
+ * @returns the namespace, or the refusal message.
+ */
+export declare function buildToolBindings(request: BindingRequest): BindingOutcome;
+/**
+ * The budgets a run is admitted with (RES-10).
+ *
+ * A requested budget is clamped to the ceiling rather than refused: a caller asking for
+ * longer than policy allows gets policy's figure, which is the direction that cannot be
+ * widened by asking.
+ * @param requestedMs - what the caller asked for, if anything.
+ * @returns the admitted budget.
+ */
+export declare function admitTimeout(requestedMs: number | null | undefined): number;
+/** The current confinement evidence (CODE-09). */
+export declare function confinementDemonstrated(): boolean;
+/**
+ * Set the confinement evidence (TEST SEAM, CODE-09).
+ *
+ * The setter is the seam the acceptance test uses. It is inert — throws without
+ * moving anything — unless the process carries the explicit environment marker,
+ * so the built artifact cannot have the gate opened by code that merely imports
+ * it. A production build never sets the marker.
+ * @param value - the evidence state to adopt.
+ */
+export declare function setConfinementDemonstratedForTest(value: boolean): void;
+/**
+ * Whether generated-code execution may be exposed to callers (CODE-08, CODE-10).
+ *
+ * Exposure is the CONJUNCTION of two independent facts, and neither can stand in
+ * for the other:
+ *
+ * - CODE-09: the specification's confinement tests must have passed. They have
+ *   not run here, so this half is false — no configuration can open it.
+ * - CODE-10: the OPERATOR must have granted hosted code execution, which is a
+ *   separate consent from ordinary model-tool access. The caller passes the
+ *   operator's grant in, so the gate has a real input rather than being a literal.
+ *
+ * A host with the grant flipped but no confinement evidence stays closed; a host
+ * with confinement evidence but no operator grant stays closed too.
+ * @param operatorGranted - whether the operator granted hosted code execution.
+ * @returns whether a caller may be served.
+ */
+export declare function mayExposeToClients(operatorGranted: boolean): boolean;
+/**
+ * Describe why generated-code execution is withheld, naming WHICH fact is unmet.
+ * @param operatorGranted - whether the operator granted hosted code execution.
+ * @returns the reason callers are given.
+ */
+export declare function exposureWithheldReason(operatorGranted: boolean): string;
+//# sourceMappingURL=ptc-runtime.d.ts.map

package/lib/ptc-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ptc-runtime.d.ts","sourceRoot":"","sources":["../src/ptc-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,WAAW,EACjB,MAAM,oBAAoB,CAAA;AAE3B,mEAAmE;AACnE,eAAO,MAAM,WAAW,eAAe,CAAA;AAEvC,iEAAiE;AACjE,MAAM,WAAW,cAAc;IAC7B,kEAAkE;IAClE,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAA;IAC7B,sBAAsB;IACtB,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;CACtF;AAED,gCAAgC;AAChC,MAAM,WAAW,YAAY;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,6CAA6C;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,qBAAqB,CAAA;IAC5D,kEAAkE;IAClE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,EAChB,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACnC,OAAO,CAAC,YAAY,CAAC,CAkBvB;AAED,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB;;;;;CAKtB,CAAA;AAEV,4DAA4D;AAC5D,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;CAChD;AAED,uDAAuD;AACvD,MAAM,WAAW,cAAc;IAC7B,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,2CAA2C;IAC3C,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;IACpC,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,WAAW,GAAG,SAAS,CAAA;CAC5D;AAED,wCAAwC;AACxC,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,cAAc,CAkBzE;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAS3E;AAcD,kDAAkD;AAClD,wBAAgB,uBAAuB,IAAI,OAAO,CAEjD;AAeD;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAQtE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,eAAe,EAAE,OAAO,GAAG,OAAO,CAEpE;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,eAAe,EAAE,OAAO,GAAG,MAAM,CAOvE"}