Lispex Package Part { name: string, bytes: Bytes }- Module
- std.
lispex - Receiver
- Not applicable
- Minimum arity
- 0
- Maximum arity
- 0
Declaration and parameters
LinkAvailability
Included by default: no
Import std.lispex from an application package with a verified lock. Packages with [lispex] require --locked. Application profile topaz/ uses evaluator profile lispex/. Application profile topaz/ uses evaluator profile lispex/.
The generated-module resolver gate starts at language mode 5.18. Compatibility of this API with earlier released editions remains Pending. Target deployment conditions are native (native-only), web (web-isolated-workers), web- (web-isolated-workers). Runtime payload follows checker-reached rules. An empty reached-rule set includes no runtime payload. Application quotas are required. Lock-only packages do not receive these application modules.
Source evidence
- compiler/crates/topaz_lispex_product/src/lib.rs at
b48527d0a174· 202 - compiler/crates/topaz_lispex_product/src/lib.rs at
b48527d0a174· 202 - compiler/crates/topaz_resolve/src/lib.rs at
b48527d0a174· 801 - compiler/crates/topaz_cli/src/package/target.rs at
b48527d0a174· 71 - compiler/crates/topaz_value/src/lispex_application.rs at
b48527d0a174· 11 - compiler/crates/topaz_lispex_product/src/lib.rs at
b48527d0a174· 739 - compiler/crates/topaz_lispex_product/src/full_product.rs at
b48527d0a174· 44 - compiler/crates/topaz_lispex_product/src/lib.rs at
b48527d0a174· 634 - compiler/crates/topaz_lispex_product/src/lib.rs at
b48527d0a174· 496 - compiler/crates/topaz_lispex_product/src/full_product.rs at
b48527d0a174· 356
Receiver
Parameter constraints
std.lispex is the Topaz 6.0 host module. Importing it does not start a guest or grant guest capabilities. std.lispex.rules additionally requires the verified application lock that determines its generated names.
LispexPackageInput contains the manifest, evaluator artifact, standard library artifact and every declared dependency as immutable bytes. Each LispexPackagePart pairs dependency bytes with an exact logical name declared by the manifest. Admission computes and verifies the identity promised for that name. Arrays and records at call entry follow collection value semantics.
admitPackage requires complete finite LispexHostLimits. Validate the limit record before parsing artifacts. Reject negative or unrepresentable fields without beginning admission. No package handle is returned on refusal.
Check manifest structure and declared identities before using a component. Verify evaluator interface and exports, standard library, ABI, codec, language semantics, Unicode semantics, selected profile and resource model. Every required component must be supplied exactly once and match its declared identity.
Dependencies resolve from the supplied package closure. Reject missing or duplicate components, identity collisions and incompatible contracts. Do not consult the working directory, environment, network, host registry or another installed evaluator as a substitute.
Evaluator artifacts must expose the selected data only interface. Reject host function imports and any dependency that obtains ambient authority. A callback advertised as pure is still a callback and is rejected. No import can turn a guest value into a host object reference.
The host checks the physical envelope needed to honor the selected semantic limits and supported package contracts. Refuse an unsupported target or insufficient envelope before guest entry. Do not silently lower limits or retry another engine.
Return Ok of an immutable LispexPackage after all checks succeed. The handle records the exact verified contract identities and closure. Refusal returns Err of LispexBoundaryReport. The checks may fail deterministically on supplied data or operationally on the physical host, but neither case is a canonical evaluation outcome.
applicationPackage reads an already admitted handle associated with the current verified application lock. It performs no parsing, preparation, guest execution or discovery. Without such a handle it returns a no-application-package report. Startup admission has its own recorded finite host limits.
The same package bytes, supported contract and finite budget produce the same validation decision unless the physical host cannot supply the declared envelope. Admission success alone proves neither issuer trust nor application permission to act.
The package container, ABI bytes and identity encodings remain Lispex versioned contracts. A supported admitted version is required. This API does not assign 1.21 artifact formats to Lispex 2.0.
Related rule: Admit complete packages without ambient authorityResult
Effects
Failures
Result and effects
LinkSupply dependency bytes under a logical manifest name. Admission computes and verifies its declared identity.
Why
LinkThe admission contract gives this operation one explicit input boundary and preserves the distinct result and failure cases.
Related entries
LinkAdmit complete packages without ambient authority
LinkAdmit complete packages without ambient authority
std.lispex is the Topaz 6.0 host module. Importing it does not start a guest or grant guest capabilities. std.lispex.rules additionally requires the verified application lock that determines its generated names.
LispexPackageInput contains the manifest, evaluator artifact, standard library artifact and every declared dependency as immutable bytes. Each LispexPackagePart pairs dependency bytes with an exact logical name declared by the manifest. Admission computes and verifies the identity promised for that name. Arrays and records at call entry follow collection value semantics.
admitPackage requires complete finite LispexHostLimits. Validate the limit record before parsing artifacts. Reject negative or unrepresentable fields without beginning admission. No package handle is returned on refusal.
Check manifest structure and declared identities before using a component. Verify evaluator interface and exports, standard library, ABI, codec, language semantics, Unicode semantics, selected profile and resource model. Every required component must be supplied exactly once and match its declared identity.
Dependencies resolve from the supplied package closure. Reject missing or duplicate components, identity collisions and incompatible contracts. Do not consult the working directory, environment, network, host registry or another installed evaluator as a substitute.
Evaluator artifacts must expose the selected data only interface. Reject host function imports and any dependency that obtains ambient authority. A callback advertised as pure is still a callback and is rejected. No import can turn a guest value into a host object reference.
The host checks the physical envelope needed to honor the selected semantic limits and supported package contracts. Refuse an unsupported target or insufficient envelope before guest entry. Do not silently lower limits or retry another engine.
Return Ok of an immutable LispexPackage after all checks succeed. The handle records the exact verified contract identities and closure. Refusal returns Err of LispexBoundaryReport. The checks may fail deterministically on supplied data or operationally on the physical host, but neither case is a canonical evaluation outcome.
applicationPackage reads an already admitted handle associated with the current verified application lock. It performs no parsing, preparation, guest execution or discovery. Without such a handle it returns a no-application-package report. Startup admission has its own recorded finite host limits.
The same package bytes, supported contract and finite budget produce the same validation decision unless the physical host cannot supply the declared envelope. Admission success alone proves neither issuer trust nor application permission to act.
The package container, ABI bytes and identity encodings remain Lispex versioned contracts. A supported admitted version is required. This API does not assign 1.21 artifact formats to Lispex 2.0.
Why
Supplying the complete closure makes package admission an explicit host decision. A package handle preserves that decision without reopening discovery at every call. Inspecting a current application binding and admitting new bytes are different intentions.
Source evidence
- docs/content-next/en/embedding.json at
f455ac95ab30· 1 - docs/content-next/en/resources.json at
f455ac95ab30· 1 - docs/content-next/en/receipt-and-replay.json at
f455ac95ab30· 1 -
topaz.stdlib.contract.lispex-admissionatworking-tree - topaz.decision.lispex-v2-admission.1 at
topaz.decisi
Admit supplied package bytes with finite host limits
Linkimport std.bytes { Bytes }import std.lispex {LispexPackageInput,LispexPackage,LispexBoundaryReport,LispexHostLimits,admitPackage,applicationPackage,}function admit(input: LispexPackageInput, limits: LispexHostLimits) -> Result<LispexPackage, LispexBoundaryReport> {return admitPackage(input, limits)}function current() -> Result<LispexPackage, LispexBoundaryReport> {return applicationPackage()}export function main(args: Array<string>, stdin: string) -> Result<int, string> {return Ok(0)}
No stdout.
Expected result
Expected result
Checking accepts the program. Exit code 0.
Use a verified Lispex application package supplied through TOPAZ_LISPEX_APPLICATION. This example specifies the Lispex 2.0 behavior. The product scope remains the public 5.21.3 observation scope.
Source evidence
- docs/content-next/en/embedding.json at
f455ac95ab30· 1 - docs/content-next/en/resources.json at
f455ac95ab30· 1 - docs/content-next/en/receipt-and-replay.json at
f455ac95ab30· 1 -
topaz.stdlib.contract.lispex-admissionatworking-tree - topaz.decision.lispex-v2-admission.1 at
topaz.decisi