What the node hands every run — Req, JSON, the notebook, secrets, the throttles it declares, the node's time zone, the files directory and the Typst renders — provided by the node rather than declared by the script.

A script's code carries logic, not plumbing. It never opens a connection pool, never reads a config file and never learns where the node keeps anything: it calls the functions here and the node decides what they reach. That is what makes a script small enough to read before accepting it, and it is why the boundary is which scripts are accepted rather than what a running one can touch — see YmerNode's Scripts section.

HTTP

request/2 is Req with the node's own options merged underneath the script's, so the node can set a policy the script does not have to remember and a test can stub every outbound call at one seam. Two of the policy's options matter: retry: false, because a run is already bounded by a timeout and Req's default retry would spend most of it sleeping; and a receive timeout well inside the run's own. A script that wants retries asks for them.

Secrets

secret/2 resolves a name through YmerNode.Secrets — but only a name the script declared. An undeclared name is refused rather than resolved, so declarations/0 is a real list of what a script can reach and not a comment: a reader accepting the code sees every secret it can ask for. The value is read from disk at the call, so a secret set while the node runs is seen by the next run.

Every refusal carries the name that could not be resolved, which is what lets a run that propagates it name the secret and the verb that sets it rather than answering a bare atom nobody can act on. A machine with no secrets file at all reads the same way as a file that does not set the name: for a resolution both mean "not set here", and the caller needs the name either way.

Throttles

A system that punishes bursts or repeated failures — an account that locks after a run of failed logins, an API with a budget of requests — is protected by a throttle. Declare it under throttles in declarations/0, where YmerNode.Script.throttle/0 lists the parameters, and name it on every request that should pass through it with the throttle: option of request/2. The node keeps one throttle per name, shared by every script that declares the name and by every run of them, which is why two accepted scripts may declare one name only with the same parameters.

A request waits for a token from the throttle's bucket at most until the run's deadline, and is refused at once when the requests already waiting and the rate say it would not get one in time. Every attempt pays a token, a retry included, and every response's status reaches the breaker. A refused request is never sent: request/2 answers {:error, exception}, and the exception's message names the throttle, what stopped the request and — for an open breaker — the verb a person runs on this machine to reset it. The context offers no reset: a script that reaches past it into the node's own modules is outside the promise, and acceptance is where a reader sees it.

A throttle guards request/2 and nothing else: a script calling Req itself goes around it. A node that restarts forgets every throttle, so its bucket is full and its breaker closed again.

Files

The files directory, files_dir/1, is where a file crosses between the person and the script: what a person or their client drops there a script reads, and what a script writes there a person opens — a spreadsheet a colleague dropped in, an export another person opens. Nothing confines a script to it, because acceptance is the boundary rather than what a running script can touch (YmerNode's Scripts section): it is where files are expected, not a wall. The node creates it at boot and never backs it up; the files in it are the user's, not the node's store.

Typst

render_to_pdf/4, render_to_png/4 and render_to_svg/4 render Typst markup with the node's policy merged underneath the script's own options: the files directory is the document's root, and the font store is built afresh for every render, so a font installed since the node started is seen by the next one. A script passes nothing and may override anything — a loop of many renders asks for cache_fonts: true itself, in the options after its bindings, and shares the node's one font store with every render asking for the same fonts: it is built by whichever asked first and rebuilt whenever a render asks for a different set.

A render sees every font installed on the machine the node runs on, put there the way any application's font is, beside the four families inside the package's native library; a node running in a container sees what the container has, not what the host machine has.

A script calling Typst itself goes around the policy, as one calling Req goes around the throttles: its root is the release's own directory and its font store is built at the first render and kept until the node restarts.

The notebook

The four functions mirror YmerNode.Notebook's own surface — execute/1, query/1, tables/0, table_schema/1 — and cross no boundary the LLM has not already crossed: it writes the notebook directly through the notebook tool. There is nothing here to declare, which is why YmerNode.Script.declarations/0 has no notebook key.