super-dsh 0.1.3 → 0.1.4

package/{agent-hub → superd-hub}/dist/world-mount.d.ts

@@ -18,18 +18,23 @@
  * overrides (`vendor/include/src/index.ts:77-121`).
  */
 /** Id of the inserted world-mount row. */
-export declare const WORLD_MOUNT_ROW_ID = "aw-world-mount";
+export declare const WORLD_MOUNT_ROW_ID = "superd-world-mount";
 /** Plugin name providing the world's virtual webServer. */
-export declare const WORLD_MOUNT_PLUGIN = "@pgmi-builds/agent-hub/world";
+export declare const WORLD_MOUNT_PLUGIN = "@pgmi-builds/superd-hub/world";
 /** Id of the inserted hub row (the same plugin ctx0 itself composes). */
-export declare const WORLD_HUB_ROW_ID = "aw-agent-hub";
+export declare const WORLD_HUB_ROW_ID = "superd-hub";
 /** Plugin name of the hub itself — one UI, one roster, every runtime. */
-export declare const WORLD_HUB_PLUGIN = "@pgmi-builds/agent-hub";
+export declare const WORLD_HUB_PLUGIN = "@pgmi-builds/superd-hub";
+/** Id of the inserted page-trust row (world trees; ctx0 composes its own). */
+export declare const WORLD_WEB_TRUST_ROW_ID = "superd-web-trust";
+/** Page-trust component subpath — world pages emit index-inject on their own root. */
+export declare const WORLD_WEB_TRUST_PLUGIN = "@pgmi-builds/superd-hub/web-trust";
 /** One patch layer understood by the loader (structural; no app-boot import). */
 export type WorldPatchLayer = {
     id: string;
     disabled?: boolean;
     inject?: readonly string[];
+    config?: Record<string, unknown>;
 } | {
     insert: ReadonlyArray<{
         id: string;
@@ -43,9 +48,12 @@ export type WorldPatchLayer = {
  *   1. `webserver` off — the world owns no socket (the hub serves its face);
  *   2. `modules` waits for the virtual `webServer` the entry row provides;
  *   3. the entry row itself (the world's mount identity);
- *   4. the HUB ROW — the same `@pgmi-builds/agent-hub` native ctx0 composes, so
+ *   4. the HUB ROW — the same `@pgmi-builds/superd-hub` native ctx0 composes, so
  *      the foreign agent gets the *identical* selector UI, and the roster it
- *      renders is read from the hub over the world's own `/api` channel.
+ *      renders is read from the hub over the world's own `/api` channel;
+ *   5. the PAGE-TRUST row — the same component ctx0 composes through the
+ *      composite bundle, so a trusted non-loopback page (Caddy domain / LAN
+ *      IP) keeps its loopback-equivalent verdict in the WORLD's UI too.
  * @param key - runtime key (`omp`, `codex`, …) — the mount label.
  * @returns patch layers to append to the world's composition.
  */

package/{agent-hub → superd-hub}/dist/world-mount.js

@@ -18,22 +18,29 @@
  * overrides (`vendor/include/src/index.ts:77-121`).
  */
 /** Id of the inserted world-mount row. */
-export const WORLD_MOUNT_ROW_ID = 'aw-world-mount';
+export const WORLD_MOUNT_ROW_ID = 'superd-world-mount';
 /** Plugin name providing the world's virtual webServer. */
-export const WORLD_MOUNT_PLUGIN = '@pgmi-builds/agent-hub/world';
+export const WORLD_MOUNT_PLUGIN = '@pgmi-builds/superd-hub/world';
 /** Id of the inserted hub row (the same plugin ctx0 itself composes). */
-export const WORLD_HUB_ROW_ID = 'aw-agent-hub';
+export const WORLD_HUB_ROW_ID = 'superd-hub';
 /** Plugin name of the hub itself — one UI, one roster, every runtime. */
-export const WORLD_HUB_PLUGIN = '@pgmi-builds/agent-hub';
+export const WORLD_HUB_PLUGIN = '@pgmi-builds/superd-hub';
+/** Id of the inserted page-trust row (world trees; ctx0 composes its own). */
+export const WORLD_WEB_TRUST_ROW_ID = 'superd-web-trust';
+/** Page-trust component subpath — world pages emit index-inject on their own root. */
+export const WORLD_WEB_TRUST_PLUGIN = '@pgmi-builds/superd-hub/web-trust';
 /**
  * The layers that turn a listener-owning world into a mounted one:
  *
  *   1. `webserver` off — the world owns no socket (the hub serves its face);
  *   2. `modules` waits for the virtual `webServer` the entry row provides;
  *   3. the entry row itself (the world's mount identity);
- *   4. the HUB ROW — the same `@pgmi-builds/agent-hub` native ctx0 composes, so
+ *   4. the HUB ROW — the same `@pgmi-builds/superd-hub` native ctx0 composes, so
  *      the foreign agent gets the *identical* selector UI, and the roster it
- *      renders is read from the hub over the world's own `/api` channel.
+ *      renders is read from the hub over the world's own `/api` channel;
+ *   5. the PAGE-TRUST row — the same component ctx0 composes through the
+ *      composite bundle, so a trusted non-loopback page (Caddy domain / LAN
+ *      IP) keeps its loopback-equivalent verdict in the WORLD's UI too.
  * @param key - runtime key (`omp`, `codex`, …) — the mount label.
  * @returns patch layers to append to the world's composition.
  */
@@ -42,11 +49,25 @@ export function worldMountPatches(key) {
         throw new Error(`world-mount: invalid key ${JSON.stringify(key)}`);
     }
     return [
-        { id: 'webserver', disabled: true },
+        // 0.1.7 belt-and-braces: the composition provably carries `disabled: true`
+        // (SUPERD_TRACE dump), yet the live world audit still saw the row activate
+        // and bind the default 3080 — so pin the config to an EPHEMERAL loopback
+        // port too (the audited AW fixture shape: loopback-only, never
+        // user-facing). Honored disables bind nothing; ignored disables bind a
+        // throwaway socket instead of colliding with a real deployment port.
+        { id: 'webserver', disabled: true, config: { host: '127.0.0.1', port: 0 } },
+        // 0.1.7: with a profileContext provided (settings requires it), the base
+        // hmr row ENABLES itself in world trees (`disabled: !!js
+        // !ctx.get('profileContext')`) and its config reload then recomposes the
+        // tree from the profile layers alone — DROPPING the spawn-time
+        // worldMountPatches (webserver re-enabled on 3080, world rows gone).
+        // Worlds must stay hmr-less: their composition is a spawn-time fact.
+        { id: 'hmr', disabled: true },
         { id: 'modules', inject: ['webServer'] },
         { insert: [
                 { id: WORLD_MOUNT_ROW_ID, name: WORLD_MOUNT_PLUGIN, config: { key } },
                 { id: WORLD_HUB_ROW_ID, name: WORLD_HUB_PLUGIN },
+                { id: WORLD_WEB_TRUST_ROW_ID, name: WORLD_WEB_TRUST_PLUGIN },
             ] },
     ];
 }

package/{agent-hub → superd-hub}/dist/world-mux.d.ts

@@ -4,20 +4,26 @@
  * Upstream's `RemoteStreamMuxServer` owns `/api/remote.mux` for the native
  * gateway and is NOT reachable from outside its package (root exports omit it;
  * `./src/*` cannot be imported at runtime). So this is our own wire-compatible
- * implementation of the same protocol, bound to the ADDRESSED world's
- * `openWireStream`:
+ * implementation of the same protocol (dsh 0.1.7 `stream-protocol.ts`), bound
+ * to the ADDRESSED world's `openWireStream`:
  *
  *   browser → server   { type:'open', streamId, endpoint, payload }
+ *                      { type:'item', streamId, value? }   (uplink)
+ *                      { type:'end', streamId }            (uplink half-close)
  *                      { type:'cancel', streamId }
  *   server → browser   { type:'item', streamId, value }
  *                      { type:'end', streamId }
  *                      { type:'error', streamId, error:{code,message,details} }
  *
- * Heartbeat: ping every interval, terminate after two missed pongs (same
- * policy as upstream).
+ * Dispatch semantics mirror upstream `RemoteStreamMuxConnection`: `item`,
+ * `end`, and `cancel` for a stream this connection no longer owns are dropped;
+ * a duplicate `open` is the one violation that closes the socket. Uplink items
+ * wait in a bounded inbox created before the opener resolves, so items sent
+ * right after `open` are never lost. Heartbeat: ping every interval, terminate
+ * after two missed pongs.
  */
 /** Open one world stream (the world gateway's `openWireStream`). */
-export type MuxOpen = (endpoint: string, payload: unknown, signal: AbortSignal) => Promise<AsyncIterable<unknown>>;
+export type MuxOpen = (endpoint: string, payload: unknown, uplink: AsyncIterable<unknown>, control: AbortController) => Promise<AsyncIterable<unknown>> | AsyncIterable<unknown>;
 /** Wire failure body (upstream `RemoteStreamFailure`). */
 export interface MuxFailure {
     code: string;
@@ -26,8 +32,10 @@ export interface MuxFailure {
 }
 /** Options. */
 export interface WorldMuxOptions {
-    /** Ping interval; upstream default is 30s. */
+    /** Ping interval; upstream default is 2s. */
     heartbeatIntervalMs?: number;
+    /** Buffered uplink frame bytes one logical stream may hold before it fails; upstream default 256KiB. */
+    streamInboxBytes?: number;
     /** Error → wire failure mapper. */
     failure?: (error: unknown) => MuxFailure;
 }
@@ -37,6 +45,13 @@ type ClientMessage = {
     streamId: string;
     endpoint: string;
     payload: unknown;
+} | {
+    type: 'item';
+    streamId: string;
+    value?: unknown;
+} | {
+    type: 'end';
+    streamId: string;
 } | {
     type: 'cancel';
     streamId: string;

package/superd-hub/dist/world-mux.js

@@ -0,0 +1,392 @@
+/**
+ * Per-world Remote stream mux server (AW-B DL6).
+ *
+ * Upstream's `RemoteStreamMuxServer` owns `/api/remote.mux` for the native
+ * gateway and is NOT reachable from outside its package (root exports omit it;
+ * `./src/*` cannot be imported at runtime). So this is our own wire-compatible
+ * implementation of the same protocol (dsh 0.1.7 `stream-protocol.ts`), bound
+ * to the ADDRESSED world's `openWireStream`:
+ *
+ *   browser → server   { type:'open', streamId, endpoint, payload }
+ *                      { type:'item', streamId, value? }   (uplink)
+ *                      { type:'end', streamId }            (uplink half-close)
+ *                      { type:'cancel', streamId }
+ *   server → browser   { type:'item', streamId, value }
+ *                      { type:'end', streamId }
+ *                      { type:'error', streamId, error:{code,message,details} }
+ *
+ * Dispatch semantics mirror upstream `RemoteStreamMuxConnection`: `item`,
+ * `end`, and `cancel` for a stream this connection no longer owns are dropped;
+ * a duplicate `open` is the one violation that closes the socket. Uplink items
+ * wait in a bounded inbox created before the opener resolves, so items sent
+ * right after `open` are never lost. Heartbeat: ping every interval, terminate
+ * after two missed pongs.
+ */
+/** Specifier is widened on purpose: `ws` is a runtime peer, not a typed dep. */
+const WS_MODULE = 'ws';
+const MAX_MISSED_HEARTBEATS = 2;
+const DEFAULT_HEARTBEAT_MS = 2_000;
+const DEFAULT_STREAM_INBOX_BYTES = 262_144;
+const UPLINK_DONE = { value: undefined, done: true };
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function exactKeys(value, keys) {
+    const own = Object.keys(value);
+    return own.length === keys.length && keys.every(key => Object.hasOwn(value, key));
+}
+function validId(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+/** An abort reason carrying wire failure fields (upstream `remoteErrorOf`). */
+function isRemoteFailure(reason) {
+    return isRecord(reason) && typeof reason['code'] === 'string';
+}
+/**
+ * Parse one browser text frame.
+ * @param text - complete WebSocket text message.
+ * @returns the validated request.
+ * @throws {Error} on a malformed frame.
+ */
+export function parseClientMessage(text) {
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch {
+        throw new Error('world-mux: invalid client message');
+    }
+    if (!isRecord(raw))
+        throw new Error('world-mux: invalid client message');
+    if ((raw['type'] === 'cancel' || raw['type'] === 'end')
+        && exactKeys(raw, ['type', 'streamId']) && validId(raw['streamId'])) {
+        return { type: raw['type'], streamId: raw['streamId'] };
+    }
+    if (raw['type'] === 'item'
+        && (exactKeys(raw, ['type', 'streamId']) || exactKeys(raw, ['type', 'streamId', 'value']))
+        && validId(raw['streamId'])) {
+        return Object.hasOwn(raw, 'value')
+            ? { type: 'item', streamId: raw['streamId'], value: raw['value'] }
+            : { type: 'item', streamId: raw['streamId'] };
+    }
+    if (raw['type'] === 'open'
+        && exactKeys(raw, ['type', 'streamId', 'endpoint', 'payload'])
+        && validId(raw['streamId'])
+        && typeof raw['endpoint'] === 'string'
+        && raw['endpoint'].length > 0) {
+        return { type: 'open', streamId: raw['streamId'], endpoint: raw['endpoint'], payload: raw['payload'] };
+    }
+    throw new Error('world-mux: invalid client message');
+}
+/** Default failure mapper: keep the error code when it looks like one. */
+export function defaultFailure(error) {
+    if (isRecord(error)) {
+        const code = typeof error['code'] === 'string' ? error['code'] : undefined;
+        const message = typeof error['message'] === 'string' ? error['message'] : undefined;
+        if (code !== undefined) {
+            const details = isRecord(error['details']) ? error['details'] : {};
+            return { code, message: message ?? code, details };
+        }
+    }
+    return { code: 'gateway/stream-error', message: error instanceof Error ? error.message : String(error), details: {} };
+}
+/** One uplink violation: an abort reason that must reach the client as a failure frame. */
+function uplinkViolation(code, message, endpoint) {
+    return Object.assign(new Error(message), { code, details: { endpoint } });
+}
+/**
+ * Bounded single-consumer uplink queue of one logical stream, the source the
+ * world method reads as its uplink iterable. Mirrors upstream `UplinkInbox`:
+ * overflow, and an item after the client's `end`, fail the queue and abort the
+ * logical stream with a wire failure.
+ */
+class UplinkInbox {
+    maxBytes;
+    endpoint;
+    onViolation;
+    queue = [];
+    bytes = 0;
+    ended = false;
+    closed = false;
+    taken = false;
+    failure;
+    wake;
+    constructor(maxBytes, endpoint, onViolation) {
+        this.maxBytes = maxBytes;
+        this.endpoint = endpoint;
+        this.onViolation = onViolation;
+    }
+    push(value, frameBytes) {
+        if (this.failure !== undefined || this.closed)
+            return;
+        if (this.ended) {
+            this.violate(uplinkViolation('gateway/protocol', 'world-mux: Remote stream uplink item after end', this.endpoint));
+            return;
+        }
+        if (this.bytes + frameBytes > this.maxBytes) {
+            this.violate(uplinkViolation('gateway/uplink-overflow', `world-mux: Remote stream uplink exceeded ${String(this.maxBytes)} buffered bytes`, this.endpoint));
+            return;
+        }
+        this.queue.push({ value, bytes: frameBytes });
+        this.bytes += frameBytes;
+        this.signal();
+    }
+    /** Client half-close; idempotent. */
+    end() {
+        if (this.ended)
+            return;
+        this.ended = true;
+        this.signal();
+    }
+    /** End the consumer's next read with `error`; idempotent, drops buffered items. */
+    fail(error) {
+        if (this.failure !== undefined)
+            return;
+        this.failure = error;
+        this.queue.length = 0;
+        this.bytes = 0;
+        this.signal();
+    }
+    [Symbol.asyncIterator]() {
+        if (this.taken)
+            throw new Error('world-mux: Remote stream uplink inbox already has a consumer');
+        this.taken = true;
+        return this;
+    }
+    async next() {
+        while (true) {
+            if (this.closed)
+                return UPLINK_DONE;
+            const entry = this.queue.shift();
+            if (entry !== undefined) {
+                this.bytes -= entry.bytes;
+                return { value: entry.value, done: false };
+            }
+            if (this.failure !== undefined)
+                throw this.failure;
+            if (this.ended)
+                return UPLINK_DONE;
+            if (this.wake !== undefined)
+                throw new Error('world-mux: Remote stream uplink inbox has one pending read');
+            await new Promise((resolve) => { this.wake = resolve; });
+        }
+    }
+    /** Consumer stopped reading: later items are dropped, a pending read ends. */
+    return() {
+        this.closed = true;
+        this.queue.length = 0;
+        this.bytes = 0;
+        this.signal();
+        return Promise.resolve(UPLINK_DONE);
+    }
+    violate(error) {
+        this.fail(error);
+        this.onViolation(error);
+    }
+    signal() {
+        const wake = this.wake;
+        this.wake = undefined;
+        wake?.();
+    }
+}
+/** One world's mux endpoint. */
+export class WorldMuxServer {
+    open;
+    options;
+    server;
+    ws;
+    heartbeat;
+    connections = new Set();
+    missed = new WeakMap();
+    closed = false;
+    constructor(open, options = {}) {
+        this.open = open;
+        this.options = options;
+    }
+    /** Take over one accepted upgrade request. */
+    async handleUpgrade(req, socket, head) {
+        const { server, ws } = await this.load();
+        server.handleUpgrade(req, socket, head, (client) => {
+            this.missed.set(client, 0);
+            client.on('pong', () => { this.missed.set(client, 0); });
+            this.startHeartbeat();
+            const done = this.runConnection(client, ws);
+            this.connections.add(done);
+            void done.then(() => { this.connections.delete(done); });
+        });
+    }
+    /** Terminate every socket and wait for the active streams to unwind. */
+    async close() {
+        this.closed = true;
+        clearInterval(this.heartbeat);
+        this.heartbeat = undefined;
+        const server = this.server;
+        if (server !== undefined) {
+            for (const client of server.clients)
+                client.terminate();
+            await new Promise((resolve) => { server.close(() => resolve()); });
+        }
+        await Promise.all([...this.connections]);
+    }
+    async load() {
+        if (this.server !== undefined && this.ws !== undefined)
+            return { server: this.server, ws: this.ws };
+        const mod = (await import(WS_MODULE));
+        const ws = typeof mod.WebSocketServer === 'function' ? mod : mod.default;
+        const server = new ws.WebSocketServer({ noServer: true });
+        this.server = server;
+        this.ws = ws;
+        return { server, ws };
+    }
+    async runConnection(client, ws) {
+        const streams = new Map();
+        let writes = Promise.resolve();
+        const send = (message) => {
+            let text;
+            try {
+                text = JSON.stringify(message);
+            }
+            catch (cause) {
+                return Promise.reject(new Error('world-mux: item is not JSON serializable', { cause }));
+            }
+            const delivery = writes.then(() => new Promise((resolve, reject) => {
+                if (client.readyState !== ws.WebSocket.OPEN) {
+                    reject(new Error('world-mux: socket is closed'));
+                    return;
+                }
+                client.send(text, (error) => { if (error)
+                    reject(error);
+                else
+                    resolve(); });
+            }));
+            writes = delivery.catch(() => undefined);
+            return delivery;
+        };
+        const failureOf = this.options.failure ?? defaultFailure;
+        const sendFailure = async (streamId, error) => {
+            if (client.readyState !== ws.WebSocket.OPEN)
+                return;
+            try {
+                await send({ type: 'error', streamId, error: failureOf(error) });
+            }
+            catch {
+                client.close(1011, 'Remote stream failure could not be delivered');
+            }
+        };
+        const pump = async (streamId, endpoint, payload, active) => {
+            let failed;
+            try {
+                const source = await this.open(endpoint, payload, active.inbox, active.abort);
+                for await (const value of source) {
+                    await send({ type: 'item', streamId, value });
+                }
+            }
+            catch (error) {
+                failed = { error };
+            }
+            // The downlink has settled; later uplink frames cannot change the outcome.
+            active.inbox.fail(new Error('world-mux: Remote stream ended'));
+            if (active.abort.signal.aborted) {
+                // A wire failure as the abort reason is this mux failing the stream (a
+                // rejected or overflowing uplink item, or an item after end); the client
+                // is still waiting for that terminal frame. Any other abort is a
+                // cancellation and stays silent.
+                const reason = active.abort.signal.reason;
+                if (isRemoteFailure(reason))
+                    await sendFailure(streamId, reason);
+                return;
+            }
+            if (failed !== undefined) {
+                await sendFailure(streamId, failed.error);
+                return;
+            }
+            try {
+                await send({ type: 'end', streamId });
+            }
+            catch (error) {
+                await sendFailure(streamId, error);
+            }
+        };
+        await new Promise((resolve) => {
+            client.once('close', () => { resolve(); });
+            client.on('error', () => { client.terminate(); });
+            client.on('message', (data, isBinary) => {
+                if (isBinary === true) {
+                    client.close(1003, 'text messages required');
+                    return;
+                }
+                const text = String(data);
+                let message;
+                try {
+                    message = parseClientMessage(text);
+                }
+                catch {
+                    client.close(1008, 'invalid Remote stream request');
+                    return;
+                }
+                if (message.type === 'open') {
+                    if (streams.has(message.streamId)) {
+                        client.close(1008, 'duplicate Remote stream id');
+                        return;
+                    }
+                    const abort = new AbortController();
+                    // Created before the opener resolves so items the client sends right
+                    // after `open` wait in the inbox instead of being lost.
+                    const inbox = new UplinkInbox(this.options.streamInboxBytes ?? DEFAULT_STREAM_INBOX_BYTES, message.endpoint, (error) => { abort.abort(error); });
+                    const active = {
+                        abort,
+                        inbox,
+                        stop: (reason) => {
+                            abort.abort(reason);
+                            inbox.fail(reason);
+                        },
+                        done: Promise.resolve(),
+                    };
+                    streams.set(message.streamId, active);
+                    const done = pump(message.streamId, message.endpoint, message.payload, active);
+                    active.done = done;
+                    void done.then(() => streams.delete(message.streamId), () => streams.delete(message.streamId));
+                    return;
+                }
+                // `item`, `end`, and `cancel` for a stream this connection no longer
+                // owns are dropped: a finished stream leaves the table while the
+                // client's in-flight frames are still arriving.
+                if (message.type === 'item') {
+                    streams.get(message.streamId)?.inbox.push(message.value, Buffer.byteLength(text, 'utf8'));
+                    return;
+                }
+                if (message.type === 'end') {
+                    streams.get(message.streamId)?.inbox.end();
+                    return;
+                }
+                streams.get(message.streamId)?.stop(new Error('world-mux: Remote stream cancelled'));
+            });
+        });
+        const active = [...streams.values()];
+        for (const stream of active)
+            stream.stop(new Error('world-mux: Remote stream socket closed'));
+        await Promise.all(active.map(stream => stream.done));
+    }
+    startHeartbeat() {
+        if (this.heartbeat !== undefined || this.closed)
+            return;
+        const interval = this.options.heartbeatIntervalMs ?? DEFAULT_HEARTBEAT_MS;
+        this.heartbeat = setInterval(() => {
+            const server = this.server;
+            if (server === undefined)
+                return;
+            for (const client of server.clients) {
+                if (client.readyState !== (this.ws?.WebSocket.OPEN ?? 1))
+                    continue;
+                const missed = this.missed.get(client) ?? 0;
+                if (missed >= MAX_MISSED_HEARTBEATS) {
+                    client.terminate();
+                    continue;
+                }
+                this.missed.set(client, missed + 1);
+                client.ping();
+            }
+        }, interval);
+        this.heartbeat.unref();
+    }
+}

package/{agent-hub → superd-hub}/dist/world-provision.d.ts

@@ -1,3 +1,19 @@
+/**
+ * Resolve the running dsh installation's package.json — the anchor worlds
+ * resolve `@deepseek-ai` bundles and the fallback closure from.
+ *
+ * Precedence: `$SUPERD_DSH_ANCHOR` (the repo dev lines' contract — the
+ * launcher pins the checkout build), then a walk UP from the
+ * `@deepseek-ai/dsh-app-boot` this module resolved (the host always provides
+ * it) to the nearest ancestor package named `@deepseek-ai/dsh` — the
+ * packaged-install layout (`<install>/@deepseek-ai/dsh/node_modules/
+ * @deepseek-ai/dsh-app-boot`) lands on the install root in two hops. No
+ * machine-specific path ships in code.
+ * @throws when neither yields an installation (mis-launched composition).
+ */
+export declare function resolveInstallAnchor(host?: {
+    get(name: string): unknown;
+}): string;
 export interface ProvisionWorldOptions {
     /** Runtime key — also the mount label and the `agents/<key>` home segment. */
     key: string;
@@ -10,11 +26,11 @@ export interface ProvisionWorldOptions {
 }
 /**
  * Provision one world's nested profile (idempotent: rewrites profile files,
- * re-links packages — lstat-safe against dangling links). Returns the
- * `bareModuleBaseUrl` for {@link spawnWorld}, or null when unresolvable.
+ * re-links packages — lstat-safe against dangling links). Returns whether
+ * the layout landed.
  *
- * Never throws: any provisioning failure is logged and returns null so the
+ * Never throws: any provisioning failure is logged and returns false so the
  * calling world plugin degrades to a not-ready roster row instead of failing
  * the loader entry — a failed apply would take down the whole host boot.
  */
-export declare function provisionWorldProfile(opts: ProvisionWorldOptions): string | null;
+export declare function provisionWorldProfile(opts: ProvisionWorldOptions): boolean;