@wenathlan/saddle 2.0.154 → 2.0.155

package/dist/scripts.buildengine.js

@@ -1,39 +0,0 @@
-/**
- * Cleans and builds the root TypeScript engine into ignored dist output.
- */
-import { rm, mkdir, writeFile } from "node:fs/promises";
-import { execFileSync } from "node:child_process";
-import { existsSync } from "node:fs";
-import { createRequire } from "node:module";
-await rm("dist", { recursive: true, force: true });
-/* the compiler rides node directly: windows refuses spawning a bare
- * tsc.cmd shell (spawnSync EINVAL on the .cmd shim) and the house law keeps
- * the toolchain in the global node modules, so the tsc entry is resolved
- * through require paths instead of a shell command */
-function compilerentry() {
-    const require = createRequire(import.meta.url);
-    for (const base of ["typescript/bin/tsc", "../typescript/bin/tsc", "../../../typescript/bin/tsc"]) {
-        try {
-            const entry = require.resolve(base);
-            if (existsSync(entry))
-                return entry;
-        }
-        catch {
-            /* not here: walk the next candidate */
-        }
-    }
-    return "tsc";
-}
-const entry = compilerentry();
-const args = entry.endsWith(".js") ? [entry, "--project", "tsconfig.json"] : ["--project", "tsconfig.json"];
-execFileSync(entry.endsWith(".js") ? process.execPath : entry, args, {
-    stdio: "inherit",
-    env: { ...process.env, NODE_PATH: [process.env.NODE_PATH, "C:/Users/nathalan/node_modules"].filter(Boolean).join(";") },
-});
-// the target manifest CLI: the grand merge folded packager/targetcli.ts
-// into distribution.ts (Section 7) whose CLI main only activates when
-// argv[1] ends with targetcli.js - the historical entry point that the
-// targets workflow invokes. The build regenerates the thin wrapper so
-// the contract dist/packager/targetcli.js keeps working (nothing lost).
-await mkdir("dist/packager", { recursive: true });
-await writeFile("dist/packager/targetcli.js", '// generated by scripts.buildengine.ts - the thin CLI wrapper that\n// activates the target manifest CLI absorbed into distribution.ts\n// (Section 7); its CLI main runs when argv[1] ends with targetcli.js.\nimport "../distribution.js";\n');

package/dist/scripts.securitygate.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/scripts.securitygate.js

@@ -1,68 +0,0 @@
-import { mkdir, readFile, writeFile } from "node:fs/promises";
-const reportPath = process.argv[2];
-const summaryPath = process.env.SECURITY_SUMMARY_PATH ?? "build/security/cargo-audit-summary.md";
-const acceptedAdvisory = "RUSTSEC-2024-0429";
-if (!reportPath) {
-    throw new TypeError("cargo audit report path is required");
-}
-/** Returns the advisory identifiers attached to one cargo audit finding. */
-function advisoryids(finding) {
-    const advisory = finding?.advisory ?? {};
-    return [advisory.id, finding?.id, ...(advisory.aliases ?? [])]
-        .filter(Boolean)
-        .map(String);
-}
-/** Returns a stable package label for a cargo audit finding. */
-function packagelabel(finding) {
-    const packageinfo = finding?.package ?? {};
-    return `${packageinfo.name ?? "unknown"}@${packageinfo.version ?? "unknown"}`;
-}
-const raw = await readFile(reportPath, "utf8");
-let report;
-try {
-    report = JSON.parse(raw);
-}
-catch (error) {
-    throw new Error(`cargo audit produced invalid JSON: ${error.message}`);
-}
-const findings = Array.isArray(report?.vulnerabilities?.list)
-    ? report.vulnerabilities.list
-    : [];
-const accepted = findings.filter((finding) => advisoryids(finding).includes(acceptedAdvisory) &&
-    packagelabel(finding).startsWith("glib@"));
-const unexpected = findings.filter((finding) => !accepted.includes(finding));
-const warnings = Object.values(report?.warnings ?? {}).flatMap((value) => Array.isArray(value) ? value : []);
-const status = unexpected.length > 0
-    ? "fail"
-    : accepted.length > 0
-        ? "accepted-risk"
-        : "pass";
-const lines = [
-    "# Cargo audit security gate",
-    "",
-    `Status: **${status}**`,
-    `Findings: ${findings.length}`,
-    `Accepted transitive glib findings: ${accepted.length}`,
-    `Unexpected findings: ${unexpected.length}`,
-    `Warnings: ${warnings.length}`,
-    "",
-    "## Findings",
-    "",
-];
-if (findings.length === 0)
-    lines.push("No RustSec vulnerability findings were returned.", "");
-for (const finding of findings) {
-    const ids = advisoryids(finding).join(", ") || "unknown-advisory";
-    const classification = accepted.includes(finding)
-        ? "accepted transitive glib risk"
-        : "release blocking";
-    lines.push(`- ${classification}: ${ids} (${packagelabel(finding)})`);
-}
-lines.push("", "The accepted glib entry is limited to the Tauri GTK3 transitive dependency documented in `docs/tauri-glib-risk-1.8.11.md`; any other advisory fails this gate.", "");
-await mkdir(new URL(".", `file://${process.cwd()}/${summaryPath}`).pathname, {
-    recursive: true,
-}).catch(() => { });
-await writeFile(summaryPath, `${lines.join("\n")}\n`);
-console.log(lines.join("\n"));
-if (unexpected.length > 0)
-    process.exitCode = 1;

package/dist/scripts.validateflatnative.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/scripts.validateflatnative.js

@@ -1,72 +0,0 @@
-import { access } from "node:fs/promises";
-import { fileURLToPath } from "node:url";
-import { join } from "node:path";
-/** Returns whether a path exists without turning a missing generated path into a failure. */
-async function exists(path) {
-    try {
-        await access(path);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Verifies the 2.1.0 tree contract: the native wrappers (android, ios,
- * desktop, extension) are generated on the runners into build/native/*
- * and never tracked, the interface is one flat tsx tree (page folders +
- * loose modules, no nested support folders, no legacy window-global
- * localauth.ts), and the static e2ugh console pages stay absorbed in the
- * tsx pages. the tree never goes back to tracked wrappers.
- */
-async function validateFlatNative() {
-    const repositoryRoot = fileURLToPath(new URL(".", import.meta.url));
-    const webRoot = join(repositoryRoot, "web");
-    const forbiddenDirectories = [
-        "android",
-        "ios",
-        "desktop",
-        "extension",
-        "pages",
-        "components",
-        "hooks",
-        "lib",
-        "contexts",
-    ];
-    const forbiddenFiles = [
-        "const.ts",
-        "localauth.js",
-        "login.html",
-        "register.html",
-        "console.html",
-        "dashboard.html",
-        "login.js",
-        "register.js",
-        "console.js",
-        "dashboard.js",
-    ];
-    for (const directory of forbiddenDirectories) {
-        const path = join(webRoot, directory);
-        if (await exists(path)) {
-            throw new Error(`Forbidden native wrapper directory exists: ${path}`);
-        }
-    }
-    for (const file of forbiddenFiles) {
-        const path = join(webRoot, file);
-        if (await exists(path)) {
-            throw new Error(`Forbidden flat-interface file exists: ${path}`);
-        }
-    }
-    const canonicalTodo = join(repositoryRoot, "docs", "todo.md");
-    if (!(await exists(canonicalTodo))) {
-        throw new Error(`Canonical operational checklist is missing: ${canonicalTodo}`);
-    }
-}
-try {
-    await validateFlatNative();
-    console.log("Flat native surface validation passed.");
-}
-catch (error) {
-    console.error("Flat native surface validation failed.", error);
-    process.exitCode = 1;
-}

package/dist/security.d.ts

@@ -1,500 +0,0 @@
-/**
- * security.ts — layered sandbox security for the virtual hardware engine.
- *
- * the module models the 2026 defense stack verified on 2026-08-22:
- * - landlock abi v10 on the kernel mainline (docs.kernel.org): v1 5.13
- *   filesystem rights, v2 5.19 refer, v3 6.2 truncate, v4 6.7 tcp
- *   bind/connect, v5 6.10 ioctl_dev, v6 6.12 scopes (abstract unix
- *   socket + signal), v7 6.15 audit, v8 restrict_self tsync, v9
- *   resolve_unix, v10 udp bind/connect + send (merged around 6.20/6.21);
- *   unprivileged, no root needed, layers on top of seccomp
- * - seccomp: deny-by-default bpf filters; SECCOMP_RET_TRAP (SIGSYS) is
- *   the base of the gvisor systrap platform; io_uring stays blocked in
- *   every sandbox profile (docker default profile blocks it since
- *   moby#47532 and gvisor disables it; CVE-2026-46315 disclosed an
- *   information leak through io_uring in june 2026)
- * - ebpf lsm: hooks since kernel 5.7 execute at the kernel decision
- *   point, which grants toctou immunity compared with tracepoints and
- *   syscall tracing; hornet lsm v6 (april 2026) verifies eBPF program
- *   signatures in-kernel
- * - cgroups v2: unified hierarchy on every modern distro; cpu, memory,
- *   io and pids controllers; subtree delegation enables rootless
- *   operation (podman, docker rootless) and sustains the orchestrator
- *   memory/shm limits
- * - post-quantum: ML-KEM (FIPS 203) and ML-DSA (FIPS 204) native in
- *   OpenSSL 3.5; X25519MLKEM768 hybrid is the default TLS 1.3 group and
- *   node 24+ bundles OpenSSL 3.5.5, so the engine inherits PQ/TLS
- *   without extra code; RFC 10024 (2026-08-10) standardizes the PQ/T
- *   hybrid mechanisms; ChaCha20-Poly1305 (RFC 8439) remains the AEAD
- *   fallback for hosts without AES-NI
- * - criu v4.2.1: checkpoint/restore with selinux relabel support so
- *   restored processes keep their labels
- *
- * contexts (23): landlockabitable, landlockaccess, landlockscopes,
- * landlockrulebuilder, landlockapplier, hostprobe, seccompactions,
- * syscallnumbers, defaultallowed, seccompbuilder, defaultseccomp,
- * ebpflsmfacts, ebpfattachplan, cgroupv2layout, cgroupbuilder, pqstack
- * (pqcatalog, pqkeyfactory, pqsecurecontext, rfc10024, pqcaudit — the
- * v3-B1 append), chachapoly, sandboxprofile, profilebuilder,
- * policyregistry, policyevents, policyproxy, criurelabel
- *
- * patterns: builder (landlockrulebuilder, seccompbuilder, cgroupbuilder,
- * profilebuilder), registry (policyregistry), proxy (policyproxy),
- * observer (policyevents). rules: lowercase identifiers, english jsdoc,
- * third person, no emoji, try/catch catcher on every fallible path,
- * node:* built-ins only, no hardcoded localhost address anywhere.
- */
-import type { KeyObject } from 'node:crypto';
-import type { SecureContext } from 'node:tls';
-/** one landlock abi release. */
-interface landlockabientry {
-    readonly abi: number;
-    readonly kernel: string;
-    readonly feature: string;
-}
-/** landlock abi timeline; v8-v10 landed across 6.16-6.21 per the
- * landlock.io timeline (v10 patches v3 in december 2025). */
-declare const landlockabitable: readonly [{
-    readonly abi: 1;
-    readonly kernel: '5.13';
-    readonly feature: 'filesystem access rights';
-}, {
-    readonly abi: 2;
-    readonly kernel: '5.19';
-    readonly feature: 'path refer and directory changes';
-}, {
-    readonly abi: 3;
-    readonly kernel: '6.2';
-    readonly feature: 'file truncate';
-}, {
-    readonly abi: 4;
-    readonly kernel: '6.7';
-    readonly feature: 'network tcp bind/connect';
-}, {
-    readonly abi: 5;
-    readonly kernel: '6.10';
-    readonly feature: 'fs ioctl_dev access right';
-}, {
-    readonly abi: 6;
-    readonly kernel: '6.12';
-    readonly feature: 'scopes: abstract unix socket + signal';
-}, {
-    readonly abi: 7;
-    readonly kernel: '6.15';
-    readonly feature: 'audit logging';
-}, {
-    readonly abi: 8;
-    readonly kernel: '6.16';
-    readonly feature: 'restrict_self tsync for multi-threaded processes';
-}, {
-    readonly abi: 9;
-    readonly kernel: '6.17';
-    readonly feature: 'resolve_unix scope';
-}, {
-    readonly abi: 10;
-    readonly kernel: '6.20';
-    readonly feature: 'network udp bind/connect + send';
-}];
-/** filesystem access rights across the abi levels. */
-declare const landlockfsaccess: readonly ['execute', 'write_file', 'read_file', 'read_dir', 'remove_dir', 'remove_file', 'make_char', 'make_dir', 'make_reg', 'make_sock', 'make_fifo', 'make_block', 'make_sym', 'refer', 'truncate', 'ioctl_dev'];
-/** network access rights (tcp since abi v4, udp since abi v10). */
-declare const landlocknetaccess: readonly ['bind_tcp', 'connect_tcp', 'bind_udp', 'connect_udp'];
-/** landlock scopes introduced with abi v6 (kernel 6.12). */
-declare const landlockscopes: readonly ['abstract_unix_socket', 'signal'];
-type landlockscope = (typeof landlockscopes)[number];
-/** one path rule with the rights granted on it. */
-interface landlockrule {
-    readonly path: string;
-    readonly rights: readonly string[];
-}
-/** assembled ruleset consumed by the native restrict helper. */
-interface landlockruleset {
-    readonly handledfs: readonly string[];
-    readonly handlednet: readonly string[];
-    readonly scopes: readonly landlockscope[];
-    readonly rules: readonly landlockrule[];
-}
-/** fluent builder for a landlock ruleset; the default grants read and
- * execute on the whole filesystem tree and nothing else (deny by
- * default at the handled-rights level). */
-declare class landlockrulebuilder {
-    #private;
-    /** grants read + execute on a tree (system roots, runtimes). */
-    readonlytree(target: string): this;
-    /** grants full filesystem access on a tree (workspace roots). */
-    writetree(target: string): this;
-    /** grants ioctls on device nodes (abi v5, kernel 6.10+). */
-    devioctl(target: string): this;
-    /** adds one explicit rule. */
-    rule(target: string, rights: readonly string[]): this;
-    /** widens the handled fs rights set. */
-    handle(right: string): this;
-    /** allows tcp networking (abi v4+): bind, connect or both. */
-    nettcp(bind: boolean, connect: boolean): this;
-    /** allows udp networking (abi v10, kernel ~6.20). */
-    netudp(bind: boolean, connect: boolean): this;
-    /** restricts abstract unix sockets or signals (abi v6, kernel 6.12). */
-    scope(name: landlockscope): this;
-    /** freezes the ruleset. */
-    build(): landlockruleset;
-}
-/** parses a kernel release such as "6.12.0-arch1-1". */
-declare function kernelversion(kernel?: string): {
-    readonly major: number;
-    readonly minor: number;
-};
-/** derives the expected landlock abi from the running kernel release;
- * the native helper confirms it at runtime through
- * landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION). */
-declare function detectlandlockabi(kernel?: string): number;
-/** reads the lsm list from sysfs; empty when unavailable. */
-declare function lsmlist(): readonly string[];
-/** renders the restriction plan handed to the native helper binary
- * (the c preload library performs the actual syscalls; node has no
- * direct syscall binding). */
-declare function landlockplan(ruleset: landlockruleset): {
-    readonly env: Record<string, string>;
-    readonly argv: readonly string[];
-};
-/** seccomp filter actions; RET_TRAP (SIGSYS) is the gvisor systrap base
- * and ERRNO is the deny action used by the engine profiles. */
-declare const seccompactions: {
-    killprocess: string;
-    killthread: string;
-    trap: string;
-    errno: string;
-    trace: string;
-    log: string;
-    notify: string;
-};
-/** x86_64 syscall numbers of the deny list; io_uring is blocked in
- * every sandbox (docker default profile moby#47532, gvisor default,
- * CVE-2026-46315 information disclosure, june 2026). the host side of
- * the same story is liburing 2.8 (pool viabilityreport context 09):
- * SQPOLL plus the IORING_SETUP_COOP_TASKRUN and
- * IORING_SETUP_SINGLE_ISSUER setup flags — cooperative task running
- * without IPI storms and a single-issuer fast path; those flags are
- * host-only optimizations and NEVER relax the guest deny list: the
- * three io_uring syscalls stay blocked inside sandboxes. */
-declare const syscallnumbers: {
-    io_uring_setup: number;
-    io_uring_enter: number;
-    io_uring_register: number;
-    bpf: number;
-    perf_event_open: number;
-    kexec_load: number;
-    kexec_file_load: number;
-    userfaultfd: number;
-    ptrace: number;
-    open_by_handle_at: number;
-    mount: number;
-    umount2: number;
-    pivot_root: number;
-    init_module: number;
-    finit_module: number;
-    delete_module: number;
-    acct: number;
-    swapon: number;
-    swapoff: number;
-    reboot: number;
-    setns: number;
-    unshare: number;
-    clone3: number;
-};
-/** one syscall group entry of a docker seccomp profile. */
-interface seccompgroup {
-    readonly names: readonly string[];
-    readonly action: string;
-    readonly errnoRet?: number;
-}
-/** docker-compatible seccomp profile (deny by default). */
-interface seccompprofile {
-    readonly defaultAction: string;
-    readonly defaultErrnoRet: number;
-    readonly architectures: readonly string[];
-    readonly syscalls: readonly seccompgroup[];
-}
-/** builder for a deny-by-default seccomp profile; the blocked entries
- * return ENOSYS (38) so denied syscalls look absent, matching the docker
- * default profile semantics. */
-declare class seccompbuilder {
-    #private;
-    constructor();
-    /** allows additional syscalls. */
-    allow(...names: readonly string[]): this;
-    /** blocks a syscall with an errno (38 = ENOSYS, 1 = EPERM). */
-    deny(name: string, errno?: number): this;
-    /** true when a syscall is currently denied. */
-    denied(name: string): boolean;
-    /** freezes the profile; denied syscalls are grouped per errno. */
-    build(): seccompprofile;
-}
-/** the engine default profile: allow the plain workload surface and
- * deny the privileged set including the io_uring family. */
-declare function defaultseccompprofile(): seccompprofile;
-/** verified ebpf lsm facts (kernel docs, cloudflare and lwn sources). */
-declare const ebpflsmfacts: {
-    sincemajor: string;
-    toctou: string;
-    tracepoints: string;
-    verification: string;
-    hornet: string;
-};
-/** one ebpf lsm attach point planned for the engine. */
-interface ebpfattach {
-    readonly hook: string;
-    readonly program: string;
-    readonly purpose: string;
-}
-/** attach plan: lsm hooks for enforcement, one tracepoint for counters. */
-declare const ebpfattachplan: readonly [{
-    readonly hook: 'lsm/file_open';
-    readonly program: 'vhe_file_open';
-    readonly purpose: 'audit opens outside the sandbox roots';
-}, {
-    readonly hook: 'lsm/bprm_check_security';
-    readonly program: 'vhe_bprm';
-    readonly purpose: 'deny undeclared binaries at exec';
-}, {
-    readonly hook: 'lsm/socket_connect';
-    readonly program: 'vhe_socket_connect';
-    readonly purpose: 'pin egress to the engine proxy';
-}, {
-    readonly hook: 'tracepoint/syscalls/sys_enter_io_uring_setup';
-    readonly program: 'vhe_io_uring_counter';
-    readonly purpose: 'count denied async io attempts';
-}];
-/** cgroups v2 facts: unified hierarchy everywhere, delegation for
- * rootless operation (podman, docker rootless, systemd Delegate=yes). */
-declare const cgroupv2layout: {
-    mountpoint: string;
-    hierarchy: string;
-    controllers: string[];
-    delegation: string;
-    note: string;
-};
-/** a cgroup plan: directory plus the files to write into it. */
-interface cgroupplan {
-    readonly name: string;
-    readonly files: Record<string, string>;
-}
-/** builder for one sandbox cgroup; values are written verbatim into the
- * unified hierarchy files. */
-declare class cgroupbuilder {
-    #private;
-    constructor(name?: string);
-    /** cpu.max as "quota period" (100000 100000 = 1 cpu). */
-    cpu(quota?: number, period?: number): this;
-    /** cpu.weight (1-10000, default 100). */
-    cpuweight(weight: number): this;
-    /** memory.max hard limit in bytes. */
-    memorymax(bytes: number): this;
-    /** memory.high throttle point in bytes. */
-    memoryhigh(bytes: number): this;
-    /** memory.swap.max; "max" means unlimited, mirrors MemorySwap -1. */
-    memoryswapmax(limit: number | 'max'): this;
-    /** pids.max process ceiling. */
-    pidsmax(count: number): this;
-    /** io.max line for one device ("8:0" style major:minor). */
-    iomax(device: string, rbps?: string, wbps?: string, riops?: string, wiops?: string): this;
-    /** freezes the plan. */
-    build(): cgroupplan;
-}
-/** verified post-quantum facts (openssl.org, ietf, node release notes). */
-declare const pqcatalog: {
-    mlkem: string;
-    mldsa: string;
-    slhdsa: string;
-    tlsdefault: string;
-    openssl: string;
-    rfc: string;
-    chacha: string;
-    aesnote: string;
-};
-/** keypair holder. */
-interface keypair {
-    readonly publickey: KeyObject;
-    readonly privatekey: KeyObject;
-}
-/** post-quantum key generation through node:crypto; every algorithm
- * falls back to a clear error when the runtime predates OpenSSL 3.5. */
-declare class pqkeyfactory {
-    /** ML-KEM-768 (FIPS 203) encapsulation keypair. */
-    static mlkem768(): keypair;
-    /** ML-DSA-65 (FIPS 204) signing keypair. */
-    static mldsa65(): keypair;
-    /** classic X25519 keypair for the hybrid group. */
-    static x25519(): keypair;
-}
-/** builds a TLS 1.3 secure context with the PQ hybrid group first;
- * node maps ecdhCurve to the OpenSSL groups list, so
- * "X25519MLKEM768:X25519" negotiates the RFC 10024 hybrid before the
- * classic group; ChaCha20-Poly1305 stays in the cipher list for hosts
- * without AES-NI. */
-declare function pqsecurecontext(): SecureContext;
-/** seals plaintext with ChaCha20-Poly1305; the 16-byte tag is appended. */
-declare function chachaseal(key: Buffer, nonce: Buffer, plaintext: Buffer, aad?: Buffer | null): Buffer;
-/** opens a ChaCha20-Poly1305 sealed buffer (tag appended). */
-declare function chachaopen(key: Buffer, nonce: Buffer, sealed: Buffer, aad?: Buffer | null): Buffer;
-/** composite sandbox profile: landlock + seccomp + cgroups + tls + criu
- * relabel; every layer is deny-by-default. */
-interface sandboxprofile {
-    readonly name: string;
-    readonly landlock: landlockruleset | null;
-    readonly seccomp: seccompprofile;
-    readonly cgroup: cgroupplan | null;
-    readonly tls: {
-        readonly groups: string;
-        readonly minversion: string;
-    };
-    readonly criu: {
-        readonly relabel: boolean;
-        readonly label: string;
-    };
-}
-/** builder that composes the four layers into one profile. */
-declare class profilebuilder {
-    #private;
-    named(name: string): this;
-    withlandlock(ruleset: landlockruleset): this;
-    withseccomp(profile: seccompprofile): this;
-    withcgroup(plan: cgroupplan): this;
-    /** disables selinux relabel on criu restore. */
-    withoutrelabel(): this;
-    withlabel(label: string): this;
-    /** freezes the composite profile. */
-    build(): sandboxprofile;
-}
-/** registry of named sandbox profiles. */
-declare class policyregistry {
-    #private;
-    register(profile: sandboxprofile): this;
-    get(name: string): sandboxprofile;
-    names(): readonly string[];
-}
-/** default registry: minimal (workstation-like), compute (gpu workload,
- * no network) and network (egress through the engine proxy). */
-declare const defaultpolicies: policyregistry;
-/** policy event names. */
-type policyeventname = 'applied' | 'released' | 'audit' | 'violation' | 'relabel';
-/** observer bus for policy activity; listener failures never propagate. */
-declare class policyevents {
-    #private;
-    constructor();
-    on(name: policyeventname, listener: (payload: unknown) => void): this;
-    emit(name: policyeventname, payload: unknown): void;
-}
-/** proxy that audits every profile access and reports violations when a
- * profile layer is weaker than the engine baseline. */
-declare class policyproxy {
-    #private;
-    constructor(inner: sandboxprofile, events: policyevents);
-    get name(): string;
-    /** audit trail entries. */
-    get audit(): readonly string[];
-    /** seccomp layer with an audit record. */
-    get seccomp(): seccompprofile;
-    /** landlock layer with an audit record. */
-    get landlock(): landlockruleset | null;
-    /** cgroup layer with an audit record. */
-    get cgroup(): cgroupplan | null;
-    /** true when the io_uring family stays denied; a violation event is
-     * emitted and recorded otherwise. */
-    iouringblocked(): boolean;
-    /** writes the seccomp profile json next to a sandbox runtime dir so
-     * the orchestrator can pass --security-opt seccomp=<path>. */
-    persistseccomp(dir: string): Promise<string>;
-}
-/** criu v4.2.1 selinux relabel support: restored images keep their
- * labels through "criu restore --lsm-profile selinux:<label>" and the
- * chcon fallback relabels the image tree before restore. */
-declare class criurelabel {
-    #private;
-    constructor(label?: string);
-    /** the --lsm-profile flag value for criu restore. */
-    lsmflag(): string;
-    /** relabels a checkpoint image tree with chcon. */
-    relabel(imagesdir: string): Promise<void>;
-}
-/** one outcome of the host self check. */
-interface securitycheck {
-    readonly name: string;
-    readonly ok: boolean;
-    readonly detail: string;
-}
-/** random url-safe token for sandbox authentication. */
-declare function randomtoken(bytes?: number): string;
-/** constant-time comparison of two tokens. */
-declare function tokenequals(a: string, b: string): boolean;
-/** verifies the host security surface under a profile scope: landlock
- * abi versus kernel release, lsm list, cgroup v2 mount, io_uring denial,
- * post-quantum keygen and the chacha roundtrip; the `using` guard
- * emits the applied/released events around the whole run. */
-declare function securityselfcheck(profile?: sandboxprofile): Promise<readonly securitycheck[]>;
-export type { cgroupplan, ebpfattach, keypair, landlockabientry, landlockrule, landlockruleset, landlockscope, policyeventname, sandboxprofile, seccompgroup, seccompprofile, securitycheck, };
-export { cgroupbuilder, cgroupv2layout, chachaopen, chachaseal, criurelabel, defaultpolicies, defaultseccompprofile, detectlandlockabi, ebpfattachplan, ebpflsmfacts, kernelversion, landlockabitable, landlockfsaccess, landlocknetaccess, landlockplan, landlockrulebuilder, landlockscopes, lsmlist, policyevents, policyproxy, policyregistry, pqcatalog, pqkeyfactory, pqsecurecontext, profilebuilder, randomtoken, seccompactions, seccompbuilder, securityselfcheck, syscallnumbers, tokenequals, };
-/** one PQ/T hybrid mechanism standardized by RFC 10024 (2026-08-10). */
-export interface pqtmechanism {
-    readonly name: string;
-    readonly classical: string;
-    readonly pq: string;
-    readonly securityBits: number;
-}
-/** the three hybrid mechanisms the RFC registers for TLS 1.3. */
-export declare const rfc10024mechanisms: readonly pqtmechanism[];
-/**
- * negotiates the strongest mutually supported PQ/T hybrid mechanism:
- * server preference order wins, mirroring how OpenSSL 3.5 orders the
- * groups list behind pqsecurecontext above.
- */
-export declare class rfc10024negotiator {
-    #private;
-    setpreference(names: readonly string[]): void;
-    negotiate(clientOffered: readonly string[]): pqtmechanism | null;
-}
-/** one entry of the tamper-evident PQ audit chain. */
-export interface pqcauditentry {
-    readonly ts: string;
-    readonly event: string;
-    readonly algorithm: string;
-    readonly hybrid: boolean;
-    readonly prevHash: string;
-    readonly hash: string;
-}
-/**
- * hash-chained, tamper-evident log recording which sessions negotiated
- * post-quantum protection — the core evidence against
- * harvest-now-decrypt-later attacks. verify() replays the chain and
- * coverage() reports the PQ share of all recorded sessions.
- */
-export declare class pqcaudittrail {
-    #private;
-    record(event: string, algorithm: string, hybrid: boolean): pqcauditentry;
-    verify(): boolean;
-    /** share of sessions protected by a PQ or PQ/T hybrid mechanism. */
-    coverage(): {
-        total: number;
-        pqShare: number;
-    };
-}
-/**
- * blocks inference spill in factory defaults: when a parameter type
- * is constrained by another parameter's type, wrapping it in noinfer
- * stops the checker from inferring the constraint source itself.
- * typescript ships this natively as NoInfer<T> since 5.4 (the pool
- * viabilityreport cites it through the 5.6.3 isolatedDeclarations
- * sheet); the local spelling keeps the pattern working under the
- * engine's erasable-syntax profile and documents the provenance.
- */
-export type noinfer<t> = [t][t extends t ? 0 : never];
-/** a policy factory default that must not widen to the constraint. */
-export interface policydefault<t extends string> {
-    readonly kind: 'policy-default';
-    readonly value: t;
-}
-/**
- * builds one policy default entry whose value never leaks inference
- * back into the caller's generic — the exact factory leak the pool
- * NoInfer demo (FactoryOptionsNoInfer) documented.
- */
-export declare function policypreset<t extends string>(value: noinfer<t>): policydefault<t>;