knitting 0.1.56 → 0.1.61

package/src/memory/payloadCodec.js

@@ -1,4 +1,4 @@
-import { attachPayloadTransportFinalizer, beginPromisePayload, finishPromisePayload, getTaskSlotIndex, HEADER_BYTE_LENGTH, HEADER_SLOT_STRIDE_U32, HEADER_STATIC_PAYLOAD_U32, LockBound, PayloadBuffer, PayloadSignal, TaskIndex, } from "./lock.js";
+import { attachPayloadTransportFinalizer, beginPromisePayload, finishPromisePayload, getTaskSlotIndex, HEADER_BYTE_LENGTH, HEADER_SLOT_STRIDE_U32, HEADER_STATIC_PAYLOAD_U32, LockBound, PayloadBuffer, payloadBufferName, PayloadSignal, registerLockPayloadCodec, TaskIndex, } from "./lock.js";
 import { register } from "./regionRegistry.js";
 import { createSharedDynamicBufferIO, createSharedStaticBufferIO, } from "./shared-buffer-io.js";
 import { getStridedRegionSpanBytes } from "./byte-carpet.js";
@@ -6,8 +6,9 @@ import { encoderError, ErrorKnitting } from "../error.js";
 import { Envelope } from "../common/envelope.js";
 import { resolvePayloadBufferOptions, } from "./payload-config.js";
 import { getSharedArrayBufferPayload, SHARED_ARRAY_BUFFER_CODEC_ID, SHARED_ARRAY_BUFFER_NUMERIC_TRANSFER, SHARED_ARRAY_BUFFER_NUMERIC_WORDS, } from "../connections/shared-array-buffer-payload.js";
+import { BUFFER_REFERENCE_NUMERIC_TRANSFER, BufferReference, isBufferReferenceValue, } from "../connections/buffer-reference.js";
+import { isProcessSharedBufferValue, ProcessSharedBuffer, } from "../connections/process-shared-buffer.js";
 import { isNumericArray, numericArrayFromFloat64, } from "../connections/numeric-array.js";
-const BUFFER_REFERENCE_NUMERIC_TRANSFER = Symbol.for("knitting.bufferReference.numericTransfer");
 const memory = new ArrayBuffer(8);
 const Float64View = new Float64Array(memory);
 const BigInt64View = new BigInt64Array(memory);
@@ -45,6 +46,13 @@ const ENVELOPE_HEADER_DETAIL = "Envelope header must be a JSON-like value or str
 const ENVELOPE_PROMISE_DETAIL = "Envelope header cannot contain Promise values.";
 const DYNAMIC_PAYLOAD_LIMIT_DETAIL = "Dynamic payload exceeds maxPayloadBytes.";
 const DYNAMIC_PAYLOAD_CAPACITY_DETAIL = "Dynamic payload buffer capacity exceeded.";
+const PROCESS_BOUNDARY_POINTER_PAYLOAD_DETAIL = "SharedArrayBuffer and BufferReference are process-local pointer payloads " +
+    "and cannot cross a process-worker boundary; use ProcessSharedBuffer instead.";
+const RESERVED_EXTERNAL_PAYLOAD_DETAIL = "Reserved Knitting external payload codec cannot be forged.";
+const isProcessLocalPointerCodec = (codecId) => codecId === SHARED_ARRAY_BUFFER_CODEC_ID ||
+    codecId === BUFFER_REFERENCE_CODEC_ID;
+const isReservedExternalPayloadCodec = (codecId) => isProcessLocalPointerCodec(codecId) ||
+    codecId === PROCESS_SHARED_BUFFER_CODEC_ID;
 const isPlainJsonObject = (value) => {
     const proto = objectGetPrototypeOf(value);
     return proto === objectPrototype || proto === null;
@@ -82,7 +90,16 @@ const isU32 = (value) => typeof value === "number" &&
 const isExternalPayloadLike = (value) => typeof value.toMetadata === "function" &&
     typeof value[EXTERNAL_PAYLOAD_BRAND] ===
         "string";
-const decodeExternalPayload = (raw) => {
+const readTrustedExternalPayloadMetadata = (value) => {
+    if (isBufferReferenceValue(value)) {
+        return BufferReference.prototype.toMetadata.call(value);
+    }
+    if (isProcessSharedBufferValue(value)) {
+        return ProcessSharedBuffer.prototype.toMetadata.call(value);
+    }
+    return value.toMetadata();
+};
+const decodeExternalPayload = (raw, processBoundary) => {
     const payload = parseJSON(raw);
     if (!arrayIsArray(payload) || payload.length !== 2)
         return payload;
@@ -91,6 +108,9 @@ const decodeExternalPayload = (raw) => {
     if (typeof codecId !== "string") {
         return { codec: codecId, metadata };
     }
+    if (processBoundary && isProcessLocalPointerCodec(codecId)) {
+        throw new TypeError(PROCESS_BOUNDARY_POINTER_PAYLOAD_DETAIL);
+    }
     const codec = externalPayloadGlobal.__KNITTING_PAYLOAD_CODECS__?.[codecId];
     return typeof codec?.decode === "function"
         ? codec.decode(metadata)
@@ -284,16 +304,14 @@ const requireStaticIO = (headersBuffer, headerSlotStrideU32, textCompat) => {
  * Returns `true` when the payload is encoded successfully.
  * Returns `false` when dynamic payload space could not be reserved.
  */
-export const encodePayload = ({ lockSector, payload, sab, payloadConfig, headersBuffer, headerSlotStrideU32, textCompat, onPromise, }) => {
+export const encodePayload = ({ lockSector, payload, sab, payloadConfig, headersBuffer, headerSlotStrideU32, textCompat, onPromise, processBoundary = false, }) => {
     const payloadSab = payload?.sab ?? sab;
     const resolvedPayloadConfig = resolvePayloadBufferOptions({
         sab: payloadSab,
         options: payload?.config ?? payloadConfig,
     });
     const maxPayloadBytes = resolvedPayloadConfig.maxPayloadBytes;
-    const { allocTask, setSlotLength, free } = register({
-        lockSector,
-    });
+    const { allocTask, setSlotLength, free } = register({ lockSector });
     const { writeBinary: writeDynamicBinary, writeBuffer: writeDynamicBuffer, writeArrayBuffer: writeDynamicArrayBuffer, write8Binary: writeDynamic8Binary, writeUtf8: writeDynamicUtf8, } = createSharedDynamicBufferIO({
         sab: payloadSab,
         payloadConfig: resolvedPayloadConfig,
@@ -421,7 +439,7 @@ export const encodePayload = ({ lockSector, payload, sab, payloadConfig, headers
             }
         }
         task[TaskIndex.Type] = dynamicType;
-        if (!ensureWithinDynamicLimit(task, bytes, PayloadBuffer[dynamicType])) {
+        if (!ensureWithinDynamicLimit(task, bytes, payloadBufferName(dynamicType))) {
             return false;
         }
         const reservedSlot = reserveDynamicObject(task, bytes);
@@ -590,7 +608,9 @@ export const encodePayload = ({ lockSector, payload, sab, payloadConfig, headers
         return true;
     };
     const tryEncodeBufferReferenceNumeric = (task, slotIndex, value) => {
-        const words = value[BUFFER_REFERENCE_NUMERIC_TRANSFER]?.();
+        const words = isBufferReferenceValue(value)
+            ? BufferReference.prototype[BUFFER_REFERENCE_NUMERIC_TRANSFER].call(value)
+            : value[BUFFER_REFERENCE_NUMERIC_TRANSFER]?.();
         if (words === undefined)
             return false;
         task[TaskIndex.Type] = PayloadBuffer.BufferReference;
@@ -616,7 +636,7 @@ export const encodePayload = ({ lockSector, payload, sab, payloadConfig, headers
         task.value = null;
         return true;
     };
-    const encodeObjectExternalPayload = (task, slotIndex, externalPayload) => {
+    const encodeObjectExternalPayload = (task, slotIndex, externalPayload, trustedReservedCodec = false) => {
         const codecId = readExternalPayloadCodecId(externalPayload);
         if (codecId === undefined) {
             return encoderError({
@@ -626,21 +646,46 @@ export const encodePayload = ({ lockSector, payload, sab, payloadConfig, headers
                 detail: UNSUPPORTED_OBJECT_DETAIL,
             });
         }
-        if (codecId === SHARED_ARRAY_BUFFER_CODEC_ID &&
-            tryEncodeSharedArrayBufferNumeric(task, slotIndex, externalPayload)) {
-            return true;
-        }
-        if (codecId === BUFFER_REFERENCE_CODEC_ID &&
-            tryEncodeBufferReferenceNumeric(task, slotIndex, externalPayload)) {
-            return true;
+        if (trustedReservedCodec) {
+            if (processBoundary && isProcessLocalPointerCodec(codecId)) {
+                return encoderError({
+                    task,
+                    type: ErrorKnitting.Serializable,
+                    onPromise,
+                    detail: PROCESS_BOUNDARY_POINTER_PAYLOAD_DETAIL,
+                });
+            }
+            if (codecId === SHARED_ARRAY_BUFFER_CODEC_ID &&
+                tryEncodeSharedArrayBufferNumeric(task, slotIndex, externalPayload)) {
+                return true;
+            }
+            if (codecId === BUFFER_REFERENCE_CODEC_ID &&
+                tryEncodeBufferReferenceNumeric(task, slotIndex, externalPayload)) {
+                return true;
+            }
+            if (codecId === PROCESS_SHARED_BUFFER_CODEC_ID &&
+                tryEncodeProcessSharedBufferNumeric(task, slotIndex, externalPayload)) {
+                return true;
+            }
         }
-        if (codecId === PROCESS_SHARED_BUFFER_CODEC_ID &&
-            tryEncodeProcessSharedBufferNumeric(task, slotIndex, externalPayload)) {
-            return true;
+        else if (isReservedExternalPayloadCodec(codecId)) {
+            return encoderError({
+                task,
+                type: ErrorKnitting.Serializable,
+                onPromise,
+                detail: processBoundary && isProcessLocalPointerCodec(codecId)
+                    ? PROCESS_BOUNDARY_POINTER_PAYLOAD_DETAIL
+                    : RESERVED_EXTERNAL_PAYLOAD_DETAIL,
+            });
         }
         let text;
         try {
-            text = stringifyJSON([codecId, externalPayload.toMetadata()]);
+            text = stringifyJSON([
+                codecId,
+                trustedReservedCodec
+                    ? readTrustedExternalPayloadMetadata(externalPayload)
+                    : externalPayload.toMetadata(),
+            ]);
         }
         catch (error) {
             const detail = error instanceof Error ? error.message : String(error);
@@ -727,10 +772,21 @@ export const encodePayload = ({ lockSector, payload, sab, payloadConfig, headers
         if (body === null || typeof body !== "object")
             return undefined;
         const sharedArrayBuffer = getSharedArrayBufferPayload(body);
-        if (sharedArrayBuffer !== undefined)
-            return sharedArrayBuffer;
+        if (sharedArrayBuffer !== undefined) {
+            return { payload: sharedArrayBuffer, trustedReservedCodec: true };
+        }
+        if (isBufferReferenceValue(body) ||
+            isProcessSharedBufferValue(body)) {
+            return {
+                payload: body,
+                trustedReservedCodec: true,
+            };
+        }
         if (isExternalPayloadLike(body)) {
-            return body;
+            return {
+                payload: body,
+                trustedReservedCodec: false,
+            };
         }
         return undefined;
     };
@@ -782,7 +838,7 @@ export const encodePayload = ({ lockSector, payload, sab, payloadConfig, headers
         task.value = null;
         return true;
     };
-    const encodeEnvelopeExternalBody = (task, slotIndex, headerText, headerIsString, externalBody) => {
+    const encodeEnvelopeExternalBody = (task, slotIndex, headerText, headerIsString, externalBody, trustedReservedCodec) => {
         const codecId = readExternalPayloadCodecId(externalBody);
         if (codecId === undefined) {
             return encoderError({
@@ -792,9 +848,34 @@ export const encodePayload = ({ lockSector, payload, sab, payloadConfig, headers
                 detail: ENVELOPE_PAYLOAD_DETAIL,
             });
         }
+        if (trustedReservedCodec) {
+            if (processBoundary && isProcessLocalPointerCodec(codecId)) {
+                return encoderError({
+                    task,
+                    type: ErrorKnitting.Serializable,
+                    onPromise,
+                    detail: PROCESS_BOUNDARY_POINTER_PAYLOAD_DETAIL,
+                });
+            }
+        }
+        else if (isReservedExternalPayloadCodec(codecId)) {
+            return encoderError({
+                task,
+                type: ErrorKnitting.Serializable,
+                onPromise,
+                detail: processBoundary && isProcessLocalPointerCodec(codecId)
+                    ? PROCESS_BOUNDARY_POINTER_PAYLOAD_DETAIL
+                    : RESERVED_EXTERNAL_PAYLOAD_DETAIL,
+            });
+        }
         let bodyText;
         try {
-            bodyText = stringifyJSON([codecId, externalBody.toMetadata()]);
+            bodyText = stringifyJSON([
+                codecId,
+                trustedReservedCodec
+                    ? readTrustedExternalPayloadMetadata(externalBody)
+                    : externalBody.toMetadata(),
+            ]);
         }
         catch (error) {
             const detail = error instanceof Error ? error.message : String(error);
@@ -874,7 +955,7 @@ export const encodePayload = ({ lockSector, payload, sab, payloadConfig, headers
             const headerText = encodeEnvelopeHeaderText(task, header, headerIsString);
             if (headerText === undefined)
                 return false;
-            return encodeEnvelopeExternalBody(task, slotIndex, headerText, headerIsString, externalBody);
+            return encodeEnvelopeExternalBody(task, slotIndex, headerText, headerIsString, externalBody.payload, externalBody.trustedReservedCodec);
         }
         return encoderError({
             task,
@@ -947,7 +1028,7 @@ export const encodePayload = ({ lockSector, payload, sab, payloadConfig, headers
                     const objectValue = args;
                     const sharedArrayBufferPayload = getSharedArrayBufferPayload(objectValue);
                     if (sharedArrayBufferPayload !== undefined) {
-                        return encodeObjectExternalPayload(task, slotIndex, sharedArrayBufferPayload);
+                        return encodeObjectExternalPayload(task, slotIndex, sharedArrayBufferPayload, true);
                     }
                     const objectProto = objectGetPrototypeOf(objectValue);
                     if (isRuntimeUint8Array(objectValue)) {
@@ -997,6 +1078,10 @@ export const encodePayload = ({ lockSector, payload, sab, payloadConfig, headers
                         task.value = null;
                         return true;
                     }
+                    if (isBufferReferenceValue(objectValue) ||
+                        isProcessSharedBufferValue(objectValue)) {
+                        return encodeObjectExternalPayload(task, slotIndex, objectValue, true);
+                    }
                     const objectCtor = objectValue
                         .constructor;
                     if (isRuntimeBuffer(objectValue)) {
@@ -1126,15 +1211,13 @@ export const encodePayload = ({ lockSector, payload, sab, payloadConfig, headers
     };
     return encodeDispatch;
 };
-export const decodePayload = ({ lockSector, payload, sab, payloadConfig, headersBuffer, headerSlotStrideU32, textCompat, host, }) => {
+export const decodePayload = ({ lockSector, payload, sab, payloadConfig, headersBuffer, headerSlotStrideU32, textCompat, host, processBoundary = false, }) => {
     const payloadSab = payload?.sab ?? sab;
     const resolvedPayloadConfig = resolvePayloadBufferOptions({
         sab: payloadSab,
         options: payload?.config ?? payloadConfig,
     });
-    const { free } = register({
-        lockSector,
-    });
+    const { free } = register({ lockSector });
     const freeTaskSlot = (task) => free(getTaskSlotIndex(task));
     const { readUtf8: readDynamicUtf8, readBytesCopy: readDynamicBytesCopy, readBytesBufferCopy: readDynamicBufferCopy, readBufferCopy: readDynamicBuffer, readBytesArrayBufferCopy: readDynamicArrayBufferCopy, readArrayBufferCopy: readDynamicArrayBuffer, read8BytesFloatCopy: readDynamic8BytesFloatCopy, read8BytesFloatView: readDynamic8BytesFloatView, } = createSharedDynamicBufferIO({
         sab: payloadSab,
@@ -1152,7 +1235,13 @@ export const decodePayload = ({ lockSector, payload, sab, payloadConfig, headers
     // store the slot in their Task, to just get it when it comes
     // to the static versions of decoding
     return (task, slotIndex, specialFlags) => {
-        switch (task[TaskIndex.Type]) {
+        const payloadType = task[TaskIndex.Type];
+        if (processBoundary &&
+            (payloadType === PayloadBuffer.SharedArrayBuffer ||
+                payloadType === PayloadBuffer.BufferReference)) {
+            throw new TypeError(PROCESS_BOUNDARY_POINTER_PAYLOAD_DETAIL);
+        }
+        switch (payloadType) {
             case PayloadSignal.BigInt:
                 Uint32View[0] = task[TaskIndex.Start];
                 Uint32View[1] = task[TaskIndex.End];
@@ -1230,7 +1319,7 @@ export const decodePayload = ({ lockSector, payload, sab, payloadConfig, headers
                     ? rawHeader
                     : parseJSON(rawHeader);
                 const bodyStart = task[TaskIndex.Start];
-                const body = decodeExternalPayload(readDynamicUtf8(bodyStart, bodyStart + task[TaskIndex.End]));
+                const body = decodeExternalPayload(readDynamicUtf8(bodyStart, bodyStart + task[TaskIndex.End]), processBoundary);
                 task.value = new Envelope(header, body);
                 freeTaskSlot(task);
                 return;
@@ -1244,7 +1333,7 @@ export const decodePayload = ({ lockSector, payload, sab, payloadConfig, headers
                     PayloadBuffer.EnvelopeDynamicHeaderStringExternal
                     ? rawHeader
                     : parseJSON(rawHeader);
-                const body = decodeExternalPayload(readDynamicUtf8(bodyStart, bodyStart + task[TaskIndex.End]));
+                const body = decodeExternalPayload(readDynamicUtf8(bodyStart, bodyStart + task[TaskIndex.End]), processBoundary);
                 task.value = new Envelope(header, body);
                 freeTaskSlot(task);
                 return;
@@ -1324,11 +1413,11 @@ export const decodePayload = ({ lockSector, payload, sab, payloadConfig, headers
                 return;
             }
             case PayloadBuffer.ExternalPayload:
-                task.value = decodeExternalPayload(readDynamicUtf8(task[TaskIndex.Start], task[TaskIndex.Start] + task[TaskIndex.PayloadLen]));
+                task.value = decodeExternalPayload(readDynamicUtf8(task[TaskIndex.Start], task[TaskIndex.Start] + task[TaskIndex.PayloadLen]), processBoundary);
                 freeTaskSlot(task);
                 return;
             case PayloadBuffer.StaticExternalPayload:
-                task.value = decodeExternalPayload(readStaticUtf8(0, task[TaskIndex.PayloadLen], slotIndex));
+                task.value = decodeExternalPayload(readStaticUtf8(0, task[TaskIndex.PayloadLen], slotIndex), processBoundary);
                 return;
             case PayloadBuffer.ProcessSharedBuffer:
                 task.value = decodeProcessSharedBufferNumericWords(readStaticU32Words(processSharedBufferWords, PROCESS_SHARED_BUFFER_NUMERIC_WORDS, slotIndex));
@@ -1375,3 +1464,6 @@ export const decodePayload = ({ lockSector, payload, sab, payloadConfig, headers
         }
     };
 };
+// Break the lock.ts <-> payloadCodec.ts cycle (see lock.ts): register the codec
+// factories on load instead of having lock.ts import them.
+registerLockPayloadCodec(encodePayload, decodePayload);

package/src/memory/regionRegistry.d.ts

@@ -1,10 +1,8 @@
 import type { Task } from "./lock.js";
 import { type SharedBufferSource } from "../common/shared-buffer-region.js";
 export type RegisterMalloc = ReturnType<typeof register>;
-export type RegionRegistryPublishMode = "plain" | "atomic";
-export declare const register: ({ lockSector, publishMode, }: {
+export declare const register: ({ lockSector, }: {
     lockSector?: SharedBufferSource;
-    publishMode?: RegionRegistryPublishMode;
 }) => {
     allocTask: (task: Task) => number;
     setSlotLength: (slotIndex: number, payloadLen: number) => boolean;

package/src/memory/regionRegistry.js

@@ -4,7 +4,7 @@ import { toSharedBufferRegion, } from "../common/shared-buffer-region.js";
 // Low 5 bits = slot index, high 27 bits = caller meta.
 // Inlined from setTaskSlotIndex to avoid cross-closure call on hot path.
 const SLOT_META_PACKED_MASK = 0xFFFFFFE0; // (~0x1F) >>> 0
-export const register = ({ lockSector, publishMode = "plain", }) => {
+export const register = ({ lockSector, }) => {
     const lockRegion = toSharedBufferRegion(lockSector ?? createWasmSharedArrayBuffer(LOCK_SECTOR_BYTE_LENGTH));
     const lockSAB = lockRegion.sab;
     const hostBits = new Int32Array(lockSAB, lockRegion.byteOffset + PAYLOAD_LOCK_HOST_BITS_OFFSET_BYTES, 1);
@@ -14,7 +14,7 @@ export const register = ({ lockSector, publishMode = "plain", }) => {
     const clz32 = Math.clz32;
     const a_load = Atomics.load;
     const a_store = Atomics.store;
-    const useAtomicPublish = publishMode === "atomic";
+    const a_xor = Atomics.xor;
     const EMPTY = 0xFFFFFFFF >>> 0;
     const SLOT_MASK = TASK_SLOT_INDEX_MASK;
     const START_MASK = (~SLOT_MASK) >>> 0;
@@ -23,7 +23,6 @@ export const register = ({ lockSector, publishMode = "plain", }) => {
     let usedBits = 0 | 0;
     // scalar state (faster than Uint32Array(1))
     let hostLast = 0 | 0;
-    let workerLast = 0 | 0;
     const startAndIndexToArray = (length) => startAndIndex.slice(0, length);
     const compactFreeBitsStable = (b, freeBits) => {
         const sai = startAndIndex;
@@ -92,10 +91,14 @@ export const register = ({ lockSector, publishMode = "plain", }) => {
             let freeBits = (~(hostLast ^ w)) >>> 0;
             if (freeBits !== 0)
                 freeBits &= usedBits;
-            if (freeBits === EMPTY) {
+            // Every tracked slot is free, so restart the arena from offset 0. A free
+            // racing after this snapshot can only delay reclamation until the next
+            // allocation; it cannot make a live slot appear free.
+            if (freeBits === (usedBits >>> 0)) {
                 tableLength = 0;
                 usedBits = 0 | 0;
                 tl = 0;
+                freeBits = 0 >>> 0;
             }
             else if (freeBits !== 0) {
                 for (let i = 0; i < tl; i++) {
@@ -247,10 +250,7 @@ export const register = ({ lockSector, publishMode = "plain", }) => {
         const slotIndex = findAndInsert(task, size);
         if (slotIndex === -1)
             return -1;
-        if (useAtomicPublish)
-            a_store(hostBits, 0, hostLast);
-        else
-            hostBits[0] = hostLast;
+        a_store(hostBits, 0, hostLast);
         return slotIndex;
     };
     const setSlotLength = (slotIndex, payloadLen) => {
@@ -264,13 +264,15 @@ export const register = ({ lockSector, publishMode = "plain", }) => {
         size64bit[slotIndex] = aligned >>> 0;
         return true;
     };
+    // Always a read-modify-write. `free()` genuinely has two callers even without
+    // work stealing: the encode-side rollback (`failDynamicWriteAfterReserve`)
+    // and the decode-side release (`freeTaskSlot`). Each held a private
+    // `workerLast` shadow and blind-stored the whole word, so one overwrote the
+    // other's toggles — the allocator then handed out a region that was still
+    // live, aliasing payloads. XOR of distinct bits commutes, so one atomic
+    // toggle per free is correct for any number of writers.
     const free = (index) => {
-        index = index & TASK_SLOT_INDEX_MASK;
-        workerLast ^= 1 << index;
-        if (useAtomicPublish)
-            a_store(workerBits, 0, workerLast);
-        else
-            workerBits[0] = workerLast;
+        a_xor(workerBits, 0, 1 << (index & TASK_SLOT_INDEX_MASK));
     };
     return {
         allocTask,

package/src/permission/compatibility.d.ts

@@ -0,0 +1,28 @@
+import type { PermissionProtocolInput, ResolvedPermissionProtocol } from "./protocol.js";
+type ProcessPermissionRuntime = "bun" | "deno" | "node";
+type PermissionCompatibilityLevel = "exact" | "coarse" | "unsupported";
+type ProcessPermissionTarget = {
+    runtime: ProcessPermissionRuntime;
+    /**
+     * Omitted when a wrapper or another host runtime makes the Node version
+     * impossible to prove synchronously.
+     */
+    nodeMajor?: number;
+};
+type PermissionCompatibilityCheck = {
+    permission: string;
+    level: PermissionCompatibilityLevel;
+    explicit: boolean;
+    reason: string;
+};
+type ProcessPermissionCompatibilityReport = {
+    target: ProcessPermissionTarget;
+    checks: PermissionCompatibilityCheck[];
+};
+export declare const classifyProcessPermissionCompatibility: ({ permission, resolved, target, }: {
+    permission: PermissionProtocolInput | undefined;
+    resolved: ResolvedPermissionProtocol | undefined;
+    target: ProcessPermissionTarget;
+}) => ProcessPermissionCompatibilityReport;
+export declare const enforceProcessPermissionCompatibility: (report: ProcessPermissionCompatibilityReport) => void;
+export type { PermissionCompatibilityCheck, PermissionCompatibilityLevel, ProcessPermissionCompatibilityReport, ProcessPermissionRuntime, ProcessPermissionTarget, };