@wenathlan/saddle 2.0.162 → 2.0.163

package/Dockerfile

@@ -61,20 +61,23 @@
 # is the sandbox spec surface the console answers, never a host
 # distribution this container installs.
 #
-# THE ELEVEN-ARCHITECTURE PLATFORM STANDARD (the pr15b law): every
-# profile answers the eleven architectures the container standard names —
-# the CONTAINERARCHIDS of saddle/containerarch.ts: x64, arm64, armv7,
-# riscv64, ppc64le, s390x, 386, mips64le, loong64, wasm32, wasip1 (the
-# wasm pair rides the oci artifact shapes wasm32/wasip1 and wasip1/wasm
-# the wasm runtimes consume). The build legs follow the pinned node
-# base's honest manifest list — the four linux seats it carries
-# (linux/amd64 the native x64 leg; linux/arm64, linux/ppc64le and
-# linux/s390x ride qemu emulation in the publish workflow). The seven
-# seats the node base does not ship (armv7, riscv64, 386, mips64le,
-# loong64 and the wasm pair) answer the standard's honest coded absence
-# (ARCH_IMAGE_ABSENT), never a pretended build leg — the same honesty
-# law the containerarch table keeps for its own pinned base: a leg
-# never claims a manifest the base does not carry. The base stage
+# THE ELEVEN-ARCHITECTURE PLATFORM STANDARD (the pr15 law): every
+# profile answers the eleven architecture seats the container standard
+# names — the CONTAINERARCHIDS of saddle/containerarch.ts (linux-x64,
+# darwin-arm64, windows-x64, linux-arm64, darwin-x64, windows-arm64,
+# linux-x64-musl, linux-riscv64, wasm32, darwin-arm64-v8,
+# windows-x64-gnu). The build legs follow the container-carried seats
+# the pinned node base honestly answers: the amd64 leg serves linux-x64
+# and linux-x64-musl, the arm64 leg serves linux-arm64, and the arm64/v8
+# leg serves the darwin-arm64-v8 abi seat (the arm64 legs ride qemu
+# emulation in the publish workflow). The linux-riscv64 seat the
+# containerarch standard carries on the bash:5 driver base answers the
+# honest coded absence on this node engine base (the pinned base ships
+# no riscv64 manifest), and the six target seats (the darwin and
+# windows seats and wasm32) answer the standard's honest coded absence
+# (ARCH_TARGET_NOT_CONTAINER), never a pretended build leg — the same
+# honesty law the containerarch table keeps for its own pinned base: a
+# leg never claims a manifest the base does not carry. The base stage
 # declares the TARGETPLATFORM/TARGETARCH automatic build-args (the
 # devthink container's standard arch interface) and stamps the honesty
 # law into the build log with its arch guard: a leg the base carries
@@ -191,19 +194,21 @@ ENV NODE_ENV=production \
 
 # the arch-leg guard of the eleven-architecture standard: the pinned
 # node base resolves the platform of every leg buildx names, and this
-# echo layer stamps the honesty law into the build log — the four seats
-# the base carries answer their leg line, the legacy builder (no
-# platform axis) answers its documented note, and any other seat answers
-# the coded refusal before the heavy steps below could run (buildx
-# itself fails such a leg at base resolution first; the guard keeps the
-# law loud on every builder).
+# echo layer stamps the honesty law into the build log — the two arches
+# the base carries answer their leg line (the amd64 leg serves the
+# linux-x64 and linux-x64-musl seats, the arm64 leg serves the
+# linux-arm64 seat and the darwin-arm64-v8 abi seat through its v8
+# variant), the legacy builder (no platform axis) answers its documented
+# note, and any other arch answers the coded refusal before the heavy
+# steps below could run (buildx itself fails such a leg at base
+# resolution first; the guard keeps the law loud on every builder).
 RUN case "${TARGETARCH:-}" in \
-      amd64|arm64|ppc64le|s390x) \
-        echo "arch leg ${TARGETARCH} of ${TARGETPLATFORM:-<unresolved>}: one of the four seats the pinned node base carries of the eleven-architecture standard" ;; \
+      amd64|arm64) \
+        echo "arch leg ${TARGETARCH} of ${TARGETPLATFORM:-<unresolved>}: one of the two arches the pinned node base carries — the legs of the container-carried seats of the eleven-architecture standard (linux-x64 and linux-x64-musl on amd64, linux-arm64 and the darwin-arm64-v8 abi seat on arm64)" ;; \
       "") \
         echo "arch leg unresolved: the legacy builder carries no platform axis; buildkit answers TARGETARCH per leg" ;; \
       *) \
-        echo "the eleven-architecture standard answers the ${TARGETARCH} seat with the honest coded absence (ARCH_IMAGE_ABSENT): the pinned node base carries no such manifest" >&2; \
+        echo "the eleven-architecture standard answers the ${TARGETARCH} arch with the honest coded absence (ARCH_TARGET_NOT_CONTAINER for the target seats, ARCH_IMAGE_ABSENT for the riscv64 seat the node engine base does not ship): the pinned node base carries no such manifest" >&2; \
         exit 1 ;; \
     esac
 

package/README.md

@@ -31,7 +31,7 @@ domain modules land beside the saddle domains:
 | `media.ts`, `render.ts`, `quantum.ts`, `tiers.ts` | media pipeline, GPU registry, quantum simulation, tier policy |
 | `security.ts`, `alternatives.ts` | hardening gates and the alternative-stack catalog |
 | `index.html`, `App.tsx`, `sol/` | the single SPA shell and the Sol theme (one tsx app with one stylesheet per theme) |
-| `server.ts`, `sandbox.ts` | the zero-dependency self-hosted API of the 2.0.162 grand-merge envelope (`node server.ts`; the api answers its version at `/api/v1/health`) and the browser-pure engine port |
+| `server.ts`, `sandbox.ts` | the zero-dependency self-hosted API of the 2.0.163 grand-merge envelope (`node server.ts`; the api answers its version at `/api/v1/health`) and the browser-pure engine port |
 | `vercel.json`, `netlify.toml` | the platform deploy adapters beside the surface they publish (the caddy ghost stays out of the tree) |
 | `specs/*` package exports | processors, gpus, cores, boards and the qemu/mttg/passage/docker envelopes |
 

package/distribution.ts

@@ -366,7 +366,20 @@ export async function writeTargetPlan(target: string, format = target, output =
   return filename;
 }
 
-if (process.argv[1]?.endsWith("targetcli.js") || process.argv[1]?.endsWith("targetcli.ts")) {
+/** The cli entry seat: argv[1] only exists under the node runtime — the
+ * family browser bridges import this module through the modes ladder for
+ * the publish contracts, and the raw process.argv[1] read throws at
+ * import time in the browser (the blank-window era of the forge and
+ * foundry seats). the guard answers undefined everywhere but node. */
+const cliseat =
+  typeof process === "object" &&
+  process !== null &&
+  Array.isArray(process.argv) &&
+  typeof process.argv[1] === "string"
+    ? process.argv[1]
+    : undefined;
+
+if (cliseat?.endsWith("targetcli.js") || cliseat?.endsWith("targetcli.ts")) {
   const [, , target = "library", format = target, output = "build/targets"] = process.argv;
   writeTargetPlan(target, format, output).then((filename) => console.log(`target plan: ${filename}`)).catch((error) => { console.error(error.message); process.exitCode = 1; });
 }
@@ -511,7 +524,7 @@ function normalizeupdatedat(value) { const normalized = Number(value ?? 0); if (
 
 function comparefreshness(left, right) { return right.updatedat - left.updatedat || right.bytes - left.bytes || left.name.localeCompare(right.name); }
 
-if (process.argv[1] === fileURLToPath(import.meta.url)) createassets(parsearguments(process.argv.slice(2))).then(({ output }) => { console.log(`release assets: ${output}`); }).catch((error) => { console.error(error.message); process.exitCode = 1; });
+if (cliseat !== undefined && cliseat === fileURLToPath(import.meta.url)) createassets(parsearguments(process.argv.slice(2))).then(({ output }) => { console.log(`release assets: ${output}`); }).catch((error) => { console.error(error.message); process.exitCode = 1; });
 
 /* ════════════════════════════════════════════════════════════════════ */
 /* Section 9: release/verify.ts — Release verification checks artifact digests, manifest consistency and */
@@ -613,7 +626,7 @@ function verifyparsearguments(argumentslist) {
   return options;
 }
 
-if (process.argv[1] === fileURLToPath(import.meta.url)) verifyassets(verifyparsearguments(process.argv.slice(2))).then((result) => { console.log(JSON.stringify(result)); }).catch((error) => { console.error(error.message); process.exitCode = 1; });
+if (cliseat !== undefined && cliseat === fileURLToPath(import.meta.url)) verifyassets(verifyparsearguments(process.argv.slice(2))).then((result) => { console.log(JSON.stringify(result)); }).catch((error) => { console.error(error.message); process.exitCode = 1; });
 
 /* ════════════════════════════════════════════════════════════════════ */
 /* Section 10: release/evidence.ts — Release evidence evaluates caller-supplied metadata without fetching, signing, */

package/docs/acceptableusepolicy.md

@@ -0,0 +1,9 @@
+# Saddle acceptable use policy
+
+Copyright (C) 2026 devthink, nathlan, iakadion, nathu filho, allan neris, andraneris, and contributors.
+
+The Saddle source code is licensed under the GNU General Public License version 3.0 only. This policy governs hosted services, credentials, runners and integrations operated with Saddle; it does not reduce rights granted by the GPL.
+
+Operators must use Saddle lawfully, respect the terms of each connected provider, protect credentials, and obtain authorization before accessing systems or data. Operators must not use Saddle to distribute malware, evade access controls, attack third-party systems, violate privacy, infringe intellectual property, or exceed provider quotas.
+
+The project may suspend a hosted integration or reject an unsafe request when necessary to protect users, providers or the public. These operational controls do not restrict lawful use, modification or redistribution of the GPL-licensed software itself.

package/docs/authors.md

@@ -0,0 +1,16 @@
+# Saddle authors
+
+Copyright (C) 2026 devthink, nathlan, iakadion, nathu filho, allan neris, andraneris, and contributors.
+
+The project authors and historical copyright holders are:
+
+| Contributor | Role |
+|---|---|
+| devthink | Historical author and project contributor |
+| nathlan | Project owner and maintainer |
+| iakadion | Historical author and project contributor |
+| nathu filho | Historical author and project contributor |
+| allan neris | Historical author and project contributor |
+| andraneris | Historical author and project contributor |
+
+Saddle is maintained at https://github.com/wenathlan/saddle and distributed under GPL-3.0-only. Contributors retain copyright in their original contributions unless a separate written agreement states otherwise.

package/docs/bugreport.md

@@ -0,0 +1,16 @@
+---
+name: Bug Report
+about: Report a reproducible issue in Saddle
+title: "[BUG]"
+labels: bug
+---
+
+# Saddle is licensed under GPL-3.0-only. Please do not include secrets or private data.
+
+**Describe the issue:**
+
+**File / Line:**
+
+**Expected behavior:**
+
+**Additional context:**

package/docs/cla.md

@@ -0,0 +1,9 @@
+# Saddle contributor terms
+
+Copyright (C) 2026 devthink, nathlan, iakadion, nathu filho, allan neris, andraneris, and contributors.
+
+Saddle does not require an exclusive proprietary assignment of contributions. A contributor submitting a change represents that the contributor has the right to submit it and grants the project the permissions necessary to review, merge, reproduce, distribute and maintain the contribution under GPL-3.0-only.
+
+The contributor keeps copyright in the contribution. The project may include the contribution in source and binary releases under GPL-3.0-only and may preserve attribution and required notices.
+
+If a separate contributor agreement is required for a particular institutional or commercial arrangement, it must be reviewed and accepted in writing before the contribution is merged. This file is not a replacement for legal advice or a bespoke agreement.

package/docs/codeofconduct.md

@@ -0,0 +1,9 @@
+# Saddle code of conduct
+
+Copyright (C) 2026 devthink, nathlan, iakadion, nathu filho, allan neris, andraneris, and contributors.
+
+The Saddle community follows a respectful, inclusive and technically constructive standard. Participants communicate in good faith, explain technical concerns with evidence, respect different backgrounds and experience levels, and protect private information.
+
+Unacceptable conduct includes harassment, discrimination, threats, deliberate disclosure of private information, malicious interference, impersonation, spam, and behavior that violates applicable law or the project policies.
+
+Project maintainers may moderate discussions, remove harmful content, or restrict participation when necessary. Reports should be sent through the repository security or support channels, with private disclosure used for security-sensitive matters.

package/docs/contributing.md

@@ -0,0 +1,9 @@
+# Contributing to Saddle
+
+Copyright (C) 2026 devthink, nathlan, iakadion, nathu filho, allan neris, andraneris, and contributors.
+
+Saddle welcomes contributions that improve the library, its adapters, target builds, documentation, tests and security posture. Contributions are licensed under GPL-3.0-only unless a different compatible arrangement is agreed in writing before acceptance.
+
+A pull request should explain the change, include focused verification, preserve the root-first architecture and avoid credentials, private data or generated artifacts. Security vulnerabilities must use the private process in `SECURITY.md` rather than a public issue.
+
+Maintainers may review, request changes, decline or merge a contribution. No contributor is required to transfer exclusive ownership of their work merely to submit a pull request.

package/docs/copyright.md

@@ -0,0 +1,7 @@
+# Saddle copyright notice
+
+Copyright (C) 2026 devthink, nathlan, iakadion, nathu filho, allan neris, andraneris, and contributors.
+
+The Saddle source code and original documentation are distributed under the GNU General Public License version 3.0 only. The complete license text is kept in the root `LICENSE` file and must be distributed with covered copies.
+
+Copyright ownership remains with the respective authors and contributors. Copyright ownership does not remove the rights granted by GPL-3.0-only. The Saddle name, logos and other marks are covered separately by `trademarkpolicy.md`.

package/docs/disclaimer.md

@@ -0,0 +1,7 @@
+# Saddle disclaimer
+
+Copyright (C) 2026 devthink, nathlan, iakadion, nathu filho, allan neris, andraneris, and contributors.
+
+Saddle is provided under GPL-3.0-only and without warranty to the maximum extent permitted by law. The project does not guarantee availability, correctness, security, compatibility, performance or fitness for a particular purpose.
+
+Operators remain responsible for reviewing source code, configuring integrations, protecting credentials, validating outputs and complying with the terms of connected services. Nothing in this disclaimer removes rights or obligations established by GPL-3.0-only.

package/docs/eula.md

@@ -0,0 +1,7 @@
+# Saddle end user license notice
+
+Copyright (C) 2026 devthink, nathlan, iakadion, nathu filho, allan neris, and contributors.
+
+Saddle source code, scripts and covered binaries are licensed under the GNU General Public License version 3.0 only. The root `LICENSE` file controls the copyright license and grants the permissions described there.
+
+This notice does not add a proprietary restriction to GPL-licensed code. Separate terms may apply to a hosted service, a third-party provider, a trademark, or data supplied by an operator. Those terms cannot remove rights granted by the GPL for the covered source code.

package/docs/exportcontrol.md

@@ -0,0 +1,17 @@
+                         SADDLE - EXPORT CONTROL NOTICE
+                       Version 1.0, August 2026
+
+ Copyright (C) 2026 devthink, nathlan, iakadion, nathu filho, allan neris, andraneris, and contributors. Licensed under GPL-3.0-only.
+ Project: saddle
+
+  Project Saddle is open-source software under GPL-3.0-only. Export,
+  re-export and sanctions laws may still apply to a particular operator,
+  destination, service or use case.
+
+  You agree not to export, re-export, or transfer Project saddle to any
+  prohibited destination, entity, or person, or for any prohibited end-use.
+
+  Operators are responsible for checking applicable rules before
+  transferring source, binaries, credentials or data across borders.
+
+                         END OF EXPORT CONTROL NOTICE

package/docs/governance.md

@@ -0,0 +1,9 @@
+# Saddle governance
+
+Copyright (C) 2026 devthink, nathlan, iakadion, nathu filho, allan neris, and contributors.
+
+Saddle is maintained as a library-first open-source project under GPL-3.0-only. The repository owner coordinates releases, security response, release approvals and provider integrations. Contributors retain copyright in their contributions unless a separate written agreement states otherwise.
+
+Changes should include focused reasoning, tests where practical, documentation for public behavior, and review of security-sensitive workflows. Release artifacts must be traceable to repository source and generated by the documented automation.
+
+Technical governance is recorded in the repository plans and workflow files. This document describes project responsibility and does not override the GPL or a contributor's applicable rights.

package/docs/notice.md

@@ -0,0 +1,7 @@
+# Saddle notice
+
+Copyright (C) 2026 devthink, nathlan, iakadion, nathu filho, allan neris, and contributors.
+
+Saddle is open-source software licensed under the GNU General Public License version 3.0 only. The source code, generated artifacts and documentation may include work from third-party projects; each third-party component remains subject to its own license.
+
+The project name and logos are trademarks of their respective owner. The trademark policy does not restrict rights granted by GPL-3.0-only to the source code.

package/docs/privacypolicy.md

@@ -0,0 +1,9 @@
+# Saddle privacy policy
+
+Copyright (C) 2026 devthink, nathlan, iakadion, nathu filho, allan neris, and contributors.
+
+The core Saddle library does not intentionally collect telemetry or transmit data without an operator-requested integration. Browser, scraper, storage and runner features can access data only when the operator configures and invokes them. Operators must review the configuration and the privacy policy of every connected provider.
+
+The repository itself is hosted by third-party services such as GitHub. Those services process requests, account data, logs and cookies under their own policies. A deployment that adds analytics, account data, logs or external storage must document that behavior and provide the controls required by applicable law.
+
+Privacy questions and reports should use the repository support channel. Security-sensitive reports must follow `SECURITY.md`.

package/docs/pullrequesttemplate.md

@@ -0,0 +1,13 @@
+<!-- Saddle pull request template -->
+
+# Description
+
+## Type of change
+
+## Verification
+
+- [ ] The change preserves GPL-3.0-only metadata and required notices.
+- [ ] Tests or a reason for not adding tests are included.
+- [ ] Security-sensitive behavior and workflow changes were reviewed.
+- [ ] No credentials, private data or generated build output was added.
+- [ ] Public documentation was updated when behavior changed.

package/docs/support.md

@@ -0,0 +1,7 @@
+# Saddle support
+
+Copyright (C) 2026 devthink, nathlan, iakadion, nathu filho, allan neris, and contributors.
+
+Saddle is open-source software under GPL-3.0-only. Questions about installation, configuration, usage and reproducible failures should include the version, target, relevant logs and a minimal reproduction without credentials or private data.
+
+Security reports must use the private process in `SECURITY.md`. Requests involving a third-party provider should also include the provider and the operator-controlled configuration. Community support is provided on a best-effort basis and does not create a warranty, service-level agreement or maintenance obligation.

package/docs/termsandconditions.md

@@ -0,0 +1,9 @@
+# Saddle terms and conditions
+
+Copyright (C) 2026 devthink, nathlan, iakadion, nathu filho, allan neris, and contributors.
+
+These terms describe access to the Saddle repository, documentation, releases and project services. The source code license is the GNU General Public License version 3.0 only; the root `LICENSE` file controls permissions to copy, modify, run and redistribute covered works.
+
+Users must comply with applicable law, third-party provider terms, the acceptable use policy, and the security policy. Users must not use a configured integration to access data or systems without authorization, expose credentials, distribute malware, or evade safety controls.
+
+The repository and project services are provided without warranty to the maximum extent permitted by law. Separate provider terms apply to infrastructure, accounts, data and hosted services. These terms do not add restrictions to GPL-licensed source code.

package/docs/termsofuse.md

@@ -0,0 +1,9 @@
+# Saddle terms of use
+
+Copyright (C) 2026 devthink, nathlan, iakadion, nathu filho, allan neris, and contributors.
+
+Saddle may be used, modified and redistributed under GPL-3.0-only. Use of a connected account, runner, storage provider, browser session or hosted service remains subject to the operator's authorization and that provider's terms.
+
+Users must protect secrets, respect privacy, avoid unauthorized access, and validate outputs before relying on them. Feedback may be used by the project under the applicable copyright permissions; submitting feedback does not transfer unrelated rights in the contributor's code.
+
+The project is provided as-is without a warranty or service-level commitment. The GPL and applicable law control where this document conflicts with a covered source license.

package/docs/thirdpartynotices.md

@@ -0,0 +1,19 @@
+# Saddle third-party notices
+
+Copyright (C) 2026 devthink, nathlan, iakadion, nathu filho, allan neris, and contributors.
+
+Saddle includes or builds with third-party components. Their individual licenses remain in force and are not replaced by GPL-3.0-only. Package manifests, lockfiles and generated license inventories are the source of truth for the exact dependency set of each release.
+
+When a component requires a notice, attribution or source offer, the release process must include it. A future dependency should be recorded with its name, version, license identifier, copyright notice and source URL.
+
+## Merged lineage notice — e2ugh (the 2.0.0 grand merge)
+
+The e2ugh virtual-hardware engine (the private repository that merged into
+saddle at 2.0.0) was originally published under the MIT license
+("Copyright (c) 2026 wenathlan"). The merged repository relicenses the
+combined work under GPL-3.0-only; the original MIT grant of the e2ugh
+sources is acknowledged here so the lineage's license history stays
+recorded: every file, feature and document of e2ugh carries into saddle
+(readapted to the saddle product metadata) with the e2ugh release history
+preserved verbatim in the CHANGELOG.md lineage sections and the engine
+reference preserved at docs/e2ughengine.md.

package/docs/trademarkpolicy.md

@@ -0,0 +1,7 @@
+# Saddle trademark policy
+
+Copyright (C) 2026 devthink, nathlan, iakadion, nathu filho, allan neris, and contributors.
+
+The names “Saddle” and “Saddle Browser”, together with associated logos and marks, identify the project and its official releases. GPL-3.0-only grants rights to the source code; it does not grant permission to use project marks in a way that suggests endorsement, affiliation or official distribution.
+
+Forks and modified distributions should use distinct names and branding where necessary to avoid confusion. Descriptive references to compatibility, origin or modification are permitted when they are accurate and do not imply sponsorship.