@1aboveio/skills 0.10.0

package/skills/engineering/resolve-release/scripts/candidate-traffic.mjs

@@ -0,0 +1,81 @@
+// Shared Cloud Run traffic capture parser for candidate discovery and hygiene.
+
+// Cloud Run omits percent for zero-traffic tagged targets. Absence remains null unless the
+// complete observation proves every omitted target has the only remaining share: zero.
+export function parseTraffic(text) {
+  const trimmed = String(text ?? '').trim()
+  if (trimmed.startsWith('[') || trimmed.startsWith('{')) {
+    let parsed
+    try {
+      parsed = JSON.parse(trimmed)
+    } catch {
+      return { error: 'traffic read is not parseable as JSON' }
+    }
+    // Accept either a bare traffic array or a full service describe whose status.traffic is
+    // the array — the JSON recipe pipes either shape without a second jq pass.
+    if (parsed && !Array.isArray(parsed) && typeof parsed === 'object') {
+      const traffic = parsed.status && parsed.status.traffic
+      if (Array.isArray(traffic)) parsed = traffic
+      else return { error: 'traffic JSON object has no status.traffic array' }
+    }
+    if (!Array.isArray(parsed)) return { error: 'traffic JSON is not an array of traffic targets' }
+    const rows = parsed.map((r) => ({
+      tag: str(r && r.tag),
+      url: str(r && r.url),
+      revision: str(r && (r.revisionName ?? r.revision)),
+      percent: r && Object.hasOwn(r, 'percent') ? explicitPercent(r.percent) : null,
+    }))
+    return { rows: normalizeTrafficPercents(rows) }
+  }
+  const rows = trimmed
+    .split('\n')
+    .map((l) => l.replace(/\r$/, ''))
+    .filter((l) => l.trim().length > 0)
+    .map((l) => {
+      // gcloud separates value() columns with TABs; tolerate a multi-space separator too,
+      // which is what a human pasting a terminal capture into a file produces.
+      const cells = l.includes('\t') ? l.split('\t') : l.split(/\s{2,}/)
+      const [tag, url, revision, percent] = cells
+      return { tag: str(tag), url: str(url), revision: str(revision), percent: num(percent) }
+    })
+  return { rows: normalizeTrafficPercents(rows) }
+}
+
+// A conservation proof is valid only when every explicit target is a finite percentage in
+// [0, 100] and those explicit targets already account for the full 100%. The remaining
+// omitted rows must then each be zero; any partial, overfull, negative, or invalid observation
+// remains ambiguous.
+export function normalizeTrafficPercents(rows) {
+  if (!Array.isArray(rows) || rows.length === 0) return rows
+  const omitted = []
+  let explicitSum = 0
+  for (let i = 0; i < rows.length; i++) {
+    const percent = rows[i].percent
+    if (percent === null) {
+      omitted.push(i)
+      continue
+    }
+    if (!Number.isFinite(percent) || percent < 0 || percent > 100) return rows
+    explicitSum += percent
+  }
+  if (omitted.length === 0 || explicitSum !== 100) return rows
+  const normalized = rows.map((row) => ({ ...row }))
+  for (const index of omitted) normalized[index].percent = 0
+  return normalized
+}
+
+const explicitPercent = (value) => {
+  const parsed = num(value)
+  return parsed === null ? Number.NaN : parsed
+}
+
+export const str = (v) => (typeof v === 'string' ? v.trim() : v === undefined || v === null ? '' : String(v).trim())
+// An ABSENT percent is null, not 0. `Number('')` is 0, so the obvious form reads a column the
+// platform never supplied as the one value that means "no users are reaching this" — absent
+// evidence rendered as the passing answer, which is the failure this whole script exists to stop.
+const num = (v) => {
+  const s = str(v)
+  if (s.length === 0) return null
+  const n = Number(s)
+  return Number.isFinite(n) ? n : Number.NaN
+}

package/skills/engineering/resolve-release/scripts/checked-adapter-loader.mjs

@@ -0,0 +1,612 @@
+import crypto from 'node:crypto'
+import fs from 'node:fs'
+import path from 'node:path'
+import { TextDecoder } from 'node:util'
+import { parse, version as acornVersion } from '../vendor/acorn.mjs'
+import { inspectIsolatedAdapter } from './isolated-adapter-evaluator.mjs'
+
+// Adapters are deliberately small policy modules. The bound prevents an approved path
+// from becoming an unbounded memory/input surface before JavaScript parsing.
+export const CHECKED_ADAPTER_MAX_BYTES = 256 * 1024
+export const CHECKED_ADAPTER_PARSER = Object.freeze({
+  name: 'acorn',
+  version: acornVersion,
+})
+
+const FORBIDDEN_DEPENDENCY = 'e:adapter-dependency-forbidden'
+const FORBIDDEN_CAPABILITY = 'e:adapter-capability-forbidden'
+export const CHECKED_ADAPTER_ALLOWED_GLOBALS = Object.freeze([
+  'AggregateError', 'Array', 'BigInt', 'Boolean', 'Date', 'Error', 'EvalError',
+  'Infinity', 'JSON', 'Math', 'NaN', 'Number', 'Object', 'RangeError',
+  'ReferenceError', 'RegExp', 'String', 'SyntaxError', 'TypeError', 'URIError',
+  'console', 'undefined',
+])
+const ALLOWED_GLOBALS = new Set(CHECKED_ADAPTER_ALLOWED_GLOBALS)
+const FORBIDDEN_PROPERTIES = new Set([
+  '__proto__',
+  '_linkedBinding',
+  '__defineGetter__',
+  '__defineSetter__',
+  '__lookupGetter__',
+  '__lookupSetter__',
+  'AsyncFunction',
+  'AsyncGeneratorFunction',
+  'apply',
+  'bind',
+  'binding',
+  'call',
+  'compile',
+  'compileFunction',
+  'compileStreaming',
+  'constructor',
+  'createRequire',
+  'dlopen',
+  'eval',
+  'Function',
+  'GeneratorFunction',
+  'getBuiltinModule',
+  'getOwnPropertyDescriptor',
+  'getOwnPropertyDescriptors',
+  'getOwnPropertyNames',
+  'getOwnPropertySymbols',
+  'getPrototypeOf',
+  'global',
+  'globalThis',
+  'instantiate',
+  'instantiateStreaming',
+  'module',
+  'Module',
+  '_load',
+  '_resolveFilename',
+  'register',
+  'registerHooks',
+  'runInContext',
+  'runInNewContext',
+  'runInThisContext',
+  'SourceTextModule',
+  'SyntheticModule',
+  'process',
+  'prototype',
+  'require',
+  'setPrototypeOf',
+  'WebAssembly',
+])
+const UTF8_DECODER = new TextDecoder('utf-8', { fatal: true })
+const MODULE_CACHE = new Map()
+
+export class CheckedAdapterError extends Error {
+  constructor(code) {
+    super(code)
+    this.name = 'CheckedAdapterError'
+    this.code = code
+  }
+}
+
+function fail(code) {
+  throw new CheckedAdapterError(code)
+}
+
+function contained(root, candidate) {
+  const relative = path.relative(root, candidate)
+  return relative !== '..'
+    && !relative.startsWith(`..${path.sep}`)
+    && !path.isAbsolute(relative)
+}
+
+function canonical(file, code) {
+  try {
+    return fs.realpathSync(file)
+  } catch {
+    fail(code)
+  }
+}
+
+function stat(file, code) {
+  try {
+    return fs.statSync(file, { bigint: true })
+  } catch {
+    fail(code)
+  }
+}
+
+function sameIdentity(left, right) {
+  return left.dev === right.dev
+    && left.ino === right.ino
+    && left.mode === right.mode
+    && left.size === right.size
+    && left.mtimeNs === right.mtimeNs
+    && left.ctimeNs === right.ctimeNs
+}
+
+function notifyFilesystemBoundary(hook, phase) {
+  if (hook == null) return
+  if (typeof hook !== 'function') fail('e:adapter-loader-seam-invalid')
+  hook(Object.freeze({ phase }))
+}
+
+function openChecked(file) {
+  const noFollow = Number.isInteger(fs.constants.O_NOFOLLOW) ? fs.constants.O_NOFOLLOW : 0
+  const nonblock = Number.isInteger(fs.constants.O_NONBLOCK) ? fs.constants.O_NONBLOCK : 0
+  try {
+    return fs.openSync(file, fs.constants.O_RDONLY | noFollow | nonblock)
+  } catch {
+    fail('e:adapter-unloadable')
+  }
+}
+
+function readBounded(fd, expectedSize) {
+  const size = Number(expectedSize)
+  const bytes = Buffer.alloc(size)
+  let offset = 0
+  while (offset < size) {
+    const count = fs.readSync(fd, bytes, offset, size - offset, offset)
+    if (count === 0) fail('e:adapter-changed-during-acquisition')
+    offset += count
+  }
+  const extra = Buffer.alloc(1)
+  if (fs.readSync(fd, extra, 0, 1, offset) !== 0) fail('e:adapter-changed-during-acquisition')
+  return bytes
+}
+
+function acquireSource(repositoryRoot, adapterPath, hook) {
+  if (typeof repositoryRoot !== 'string' || repositoryRoot.trim() === '') {
+    fail('e:repository-root-unreadable')
+  }
+  if (typeof adapterPath !== 'string' || adapterPath.trim() === '') fail('e:adapter-undeclared')
+  if (path.isAbsolute(adapterPath)) fail('e:adapter-outside-repository')
+
+  const lexicalRoot = path.resolve(repositoryRoot)
+  const lexicalAdapter = path.resolve(lexicalRoot, adapterPath)
+  if (!contained(lexicalRoot, lexicalAdapter)) fail('e:adapter-outside-repository')
+
+  const canonicalRoot = canonical(lexicalRoot, 'e:repository-root-unreadable')
+  const canonicalAdapter = canonical(lexicalAdapter, 'e:adapter-unloadable')
+  if (!contained(canonicalRoot, canonicalAdapter)) fail('e:adapter-outside-repository')
+  if (path.extname(canonicalAdapter) !== '.mjs') fail('e:adapter-not-module')
+
+  const approved = stat(canonicalAdapter, 'e:adapter-unloadable')
+  if (!approved.isFile()) fail('e:adapter-not-regular-file')
+  if (approved.size > BigInt(CHECKED_ADAPTER_MAX_BYTES)) fail('e:adapter-too-large')
+
+  notifyFilesystemBoundary(hook, 'before-open')
+  const fd = openChecked(canonicalAdapter)
+  let bytes
+  let opened
+  let acquisitionError
+  try {
+    opened = fs.fstatSync(fd, { bigint: true })
+    if (!opened.isFile()) fail('e:adapter-not-regular-file')
+    if (opened.size > BigInt(CHECKED_ADAPTER_MAX_BYTES)) fail('e:adapter-too-large')
+    if (!sameIdentity(approved, opened)) fail('e:adapter-replaced-before-open')
+    notifyFilesystemBoundary(hook, 'after-open')
+    const afterOpenPath = stat(canonicalAdapter, 'e:adapter-replaced-after-open')
+    if (!sameIdentity(opened, afterOpenPath)) {
+      fail('e:adapter-replaced-after-open')
+    }
+    notifyFilesystemBoundary(hook, 'before-read')
+    bytes = readBounded(fd, opened.size)
+    const afterRead = fs.fstatSync(fd, { bigint: true })
+    if (!sameIdentity(opened, afterRead)) fail('e:adapter-changed-during-acquisition')
+  } catch (error) {
+    acquisitionError = error instanceof CheckedAdapterError
+      ? error
+      : new CheckedAdapterError('e:adapter-unloadable')
+  } finally {
+    try {
+      fs.closeSync(fd)
+    } catch {
+      if (acquisitionError == null) acquisitionError = new CheckedAdapterError('e:adapter-close-failed')
+    }
+  }
+  if (acquisitionError != null) throw acquisitionError
+
+  const finalCanonical = canonical(lexicalAdapter, 'e:adapter-replaced-after-open')
+  if (finalCanonical !== canonicalAdapter || !contained(canonicalRoot, finalCanonical)) {
+    fail('e:adapter-replaced-after-open')
+  }
+  const finalStat = stat(finalCanonical, 'e:adapter-replaced-after-open')
+  if (!sameIdentity(opened, finalStat)) fail('e:adapter-replaced-after-open')
+
+  return Object.freeze({ bytes, canonicalPath: canonicalAdapter })
+}
+
+function decodeStrictUtf8(bytes) {
+  try {
+    return UTF8_DECODER.decode(bytes)
+  } catch {
+    fail('e:adapter-invalid-utf8')
+  }
+}
+
+function children(node) {
+  const values = []
+  for (const [key, value] of Object.entries(node)) {
+    if (key === 'start' || key === 'end' || key === 'loc') continue
+    if (Array.isArray(value)) values.push(...value)
+    else values.push(value)
+  }
+  return values.filter((value) => value != null && typeof value === 'object')
+}
+
+function staticPropertyName(node) {
+  if (node == null) return null
+  if (node.type === 'Identifier' || node.type === 'PrivateIdentifier') return node.name
+  if (node.type === 'Literal' && (typeof node.value === 'string' || typeof node.value === 'number')) {
+    return String(node.value)
+  }
+  return null
+}
+
+function childEntries(node) {
+  const entries = []
+  for (const [key, value] of Object.entries(node)) {
+    if (key === 'start' || key === 'end' || key === 'loc') continue
+    if (Array.isArray(value)) {
+      for (const child of value) {
+        if (child != null && typeof child === 'object') entries.push([key, child])
+      }
+    } else if (value != null && typeof value === 'object') {
+      entries.push([key, value])
+    }
+  }
+  return entries
+}
+
+function newScope(parent, varScope = false) {
+  const scope = { parent, bindings: new Set(), varScope: null }
+  scope.varScope = varScope ? scope : parent?.varScope
+  return scope
+}
+
+function declarePattern(pattern, scope) {
+  if (pattern == null) return
+  if (pattern.type === 'Identifier') {
+    scope.bindings.add(pattern.name)
+    return
+  }
+  if (pattern.type === 'RestElement') {
+    declarePattern(pattern.argument, scope)
+    return
+  }
+  if (pattern.type === 'AssignmentPattern') {
+    declarePattern(pattern.left, scope)
+    return
+  }
+  if (pattern.type === 'ArrayPattern') {
+    for (const element of pattern.elements) declarePattern(element, scope)
+    return
+  }
+  if (pattern.type === 'ObjectPattern') {
+    for (const property of pattern.properties) {
+      if (property.type === 'RestElement') declarePattern(property.argument, scope)
+      else declarePattern(property.value, scope)
+    }
+  }
+}
+
+function buildScopeModel(ast) {
+  const scopeAt = new WeakMap()
+  const root = newScope(null, true)
+
+  function scanPatternExpressions(pattern, scope) {
+    if (pattern == null) return
+    if (pattern.type === 'AssignmentPattern') {
+      scanPatternExpressions(pattern.left, scope)
+      scan(pattern.right, scope)
+    } else if (pattern.type === 'RestElement') {
+      scanPatternExpressions(pattern.argument, scope)
+    } else if (pattern.type === 'ArrayPattern') {
+      for (const element of pattern.elements) scanPatternExpressions(element, scope)
+    } else if (pattern.type === 'ObjectPattern') {
+      for (const property of pattern.properties) {
+        if (property.type === 'RestElement') scanPatternExpressions(property.argument, scope)
+        else {
+          if (property.computed) scan(property.key, scope)
+          scanPatternExpressions(property.value, scope)
+        }
+      }
+    }
+  }
+
+  function scanFunction(node, outerScope) {
+    const parameterScope = newScope(outerScope, true)
+    scopeAt.set(node, parameterScope)
+    if (node.type !== 'ArrowFunctionExpression') parameterScope.bindings.add('arguments')
+    if (node.type === 'FunctionExpression' && node.id != null) parameterScope.bindings.add(node.id.name)
+    for (const parameter of node.params) declarePattern(parameter, parameterScope)
+    for (const parameter of node.params) scanPatternExpressions(parameter, parameterScope)
+    if (node.body.type === 'BlockStatement') {
+      const bodyScope = newScope(parameterScope, true)
+      scopeAt.set(node.body, bodyScope)
+      for (const statement of node.body.body) scan(statement, bodyScope)
+    } else {
+      scan(node.body, parameterScope)
+    }
+  }
+
+  function scanClass(node, outerScope) {
+    if (node.type === 'ClassDeclaration' && node.id != null) outerScope.bindings.add(node.id.name)
+    if (node.superClass != null) scan(node.superClass, outerScope)
+    const scope = newScope(outerScope)
+    scopeAt.set(node, scope)
+    scopeAt.set(node.body, scope)
+    if (node.id != null) scope.bindings.add(node.id.name)
+    for (const element of node.body.body) scan(element, scope)
+  }
+
+  function scan(node, scope) {
+    if (node == null) return
+    scopeAt.set(node, scope)
+    if (node.type === 'Program') {
+      scopeAt.set(node, root)
+      for (const statement of node.body) scan(statement, root)
+      return
+    }
+    if (node.type === 'BlockStatement') {
+      const block = newScope(scope)
+      scopeAt.set(node, block)
+      for (const statement of node.body) scan(statement, block)
+      return
+    }
+    if (node.type === 'StaticBlock') {
+      const block = newScope(scope, true)
+      scopeAt.set(node, block)
+      for (const statement of node.body) scan(statement, block)
+      return
+    }
+    if (node.type === 'FunctionDeclaration') {
+      if (node.id != null) scope.bindings.add(node.id.name)
+      scanFunction(node, scope)
+      return
+    }
+    if (node.type === 'FunctionExpression' || node.type === 'ArrowFunctionExpression') {
+      scanFunction(node, scope)
+      return
+    }
+    if (node.type === 'VariableDeclaration') {
+      for (const declaration of node.declarations) {
+        const bindingScope = node.kind === 'var' ? scope.varScope : scope
+        declarePattern(declaration.id, bindingScope)
+        scanPatternExpressions(declaration.id, scope)
+        if (declaration.init != null) scan(declaration.init, scope)
+      }
+      return
+    }
+    if (node.type === 'CatchClause') {
+      const catchScope = newScope(scope)
+      scopeAt.set(node, catchScope)
+      declarePattern(node.param, catchScope)
+      scanPatternExpressions(node.param, catchScope)
+      scopeAt.set(node.body, catchScope)
+      for (const statement of node.body.body) scan(statement, catchScope)
+      return
+    }
+    if (node.type === 'ClassDeclaration' || node.type === 'ClassExpression') {
+      scanClass(node, scope)
+      return
+    }
+    if (node.type === 'ForStatement' || node.type === 'ForInStatement' || node.type === 'ForOfStatement') {
+      const loopScope = newScope(scope)
+      scopeAt.set(node, loopScope)
+      for (const [, child] of childEntries(node)) scan(child, loopScope)
+      return
+    }
+    if (node.type === 'SwitchStatement') {
+      const switchScope = newScope(scope)
+      scopeAt.set(node, switchScope)
+      scan(node.discriminant, switchScope)
+      for (const switchCase of node.cases) scan(switchCase, switchScope)
+      return
+    }
+    for (const [, child] of childEntries(node)) scan(child, scope)
+  }
+
+  scan(ast, root)
+  return scopeAt
+}
+
+function isBound(scope, name) {
+  for (let current = scope; current != null; current = current.parent) {
+    if (current.bindings.has(name)) return true
+  }
+  return false
+}
+
+function visitBindingPatternExpressions(pattern, scope, visit) {
+  if (pattern == null) return
+  if (pattern.type === 'AssignmentPattern') {
+    visitBindingPatternExpressions(pattern.left, scope, visit)
+    visit(pattern.right, scope)
+  } else if (pattern.type === 'RestElement') {
+    visitBindingPatternExpressions(pattern.argument, scope, visit)
+  } else if (pattern.type === 'ArrayPattern') {
+    for (const element of pattern.elements) visitBindingPatternExpressions(element, scope, visit)
+  } else if (pattern.type === 'ObjectPattern') {
+    for (const property of pattern.properties) {
+      if (property.type === 'RestElement') visitBindingPatternExpressions(property.argument, scope, visit)
+      else {
+        if (property.computed) visit(property.key, scope)
+        visitBindingPatternExpressions(property.value, scope, visit)
+      }
+    }
+  }
+}
+
+function validateUnresolvedReferences(ast) {
+  const scopeAt = buildScopeModel(ast)
+
+  function validateIdentifier(node, scope) {
+    if (isBound(scope, node.name) || ALLOWED_GLOBALS.has(node.name)) return
+    fail(FORBIDDEN_CAPABILITY)
+  }
+
+  function visitAssignmentTarget(node, scope) {
+    if (node.type === 'Identifier') {
+      validateIdentifier(node, scope)
+    } else if (node.type === 'MemberExpression') {
+      visit(node.object, scope)
+      if (node.computed) visit(node.property, scope)
+    } else if (node.type === 'RestElement') {
+      visitAssignmentTarget(node.argument, scope)
+    } else if (node.type === 'AssignmentPattern') {
+      visitAssignmentTarget(node.left, scope)
+      visit(node.right, scope)
+    } else if (node.type === 'ArrayPattern') {
+      for (const element of node.elements) if (element != null) visitAssignmentTarget(element, scope)
+    } else if (node.type === 'ObjectPattern') {
+      for (const property of node.properties) {
+        if (property.type === 'RestElement') visitAssignmentTarget(property.argument, scope)
+        else {
+          if (property.computed) visit(property.key, scope)
+          visitAssignmentTarget(property.value, scope)
+        }
+      }
+    }
+  }
+
+  function visitFunction(node) {
+    const scope = scopeAt.get(node)
+    for (const parameter of node.params) visitBindingPatternExpressions(parameter, scope, visit)
+    visit(node.body, scope)
+  }
+
+  function visitClass(node, outerScope) {
+    if (node.superClass != null) visit(node.superClass, outerScope)
+    visit(node.body, scopeAt.get(node))
+  }
+
+  function visit(node, inheritedScope, parent = null) {
+    if (node == null) return
+    const scope = scopeAt.get(node) ?? inheritedScope
+    if (node.type === 'Identifier') {
+      validateIdentifier(node, scope)
+      return
+    }
+    if (node.type === 'VariableDeclaration') {
+      for (const declaration of node.declarations) {
+        visitBindingPatternExpressions(declaration.id, scope, visit)
+        if (declaration.init != null) visit(declaration.init, scope, declaration)
+      }
+      return
+    }
+    if (node.type === 'FunctionDeclaration' || node.type === 'FunctionExpression'
+        || node.type === 'ArrowFunctionExpression') {
+      visitFunction(node)
+      return
+    }
+    if (node.type === 'ClassDeclaration' || node.type === 'ClassExpression') {
+      visitClass(node, inheritedScope)
+      return
+    }
+    if (node.type === 'CatchClause') {
+      visitBindingPatternExpressions(node.param, scope, visit)
+      visit(node.body, scope, node)
+      return
+    }
+    if (node.type === 'MemberExpression') {
+      visit(node.object, scope, node)
+      if (node.computed) visit(node.property, scope, node)
+      return
+    }
+    if (node.type === 'Property') {
+      if (node.computed) visit(node.key, scope, node)
+      visit(node.value, scope, node)
+      return
+    }
+    if (node.type === 'MethodDefinition' || node.type === 'PropertyDefinition') {
+      if (node.computed) visit(node.key, scope, node)
+      if (node.value != null) visit(node.value, scope, node)
+      return
+    }
+    if (node.type === 'AssignmentExpression') {
+      visitAssignmentTarget(node.left, scope)
+      visit(node.right, scope, node)
+      return
+    }
+    if (node.type === 'UpdateExpression') {
+      visitAssignmentTarget(node.argument, scope)
+      return
+    }
+    if (node.type === 'LabeledStatement') {
+      visit(node.body, scope, node)
+      return
+    }
+    if (node.type === 'BreakStatement' || node.type === 'ContinueStatement'
+        || node.type === 'PrivateIdentifier' || node.type === 'MetaProperty') return
+    if (node.type === 'ExportSpecifier') {
+      visit(node.local, scope, node)
+      return
+    }
+    if (node.type === 'ImportSpecifier' || node.type === 'ImportDefaultSpecifier'
+        || node.type === 'ImportNamespaceSpecifier') return
+    for (const [, child] of childEntries(node)) visit(child, scope, node)
+  }
+
+  visit(ast, scopeAt.get(ast))
+}
+
+function validateCapabilityNode(node, parent) {
+  if ((node.type === 'MemberExpression' || node.type === 'Property'
+      || node.type === 'MethodDefinition' || node.type === 'PropertyDefinition') && node.computed) {
+    fail(FORBIDDEN_CAPABILITY)
+  }
+  if ((node.type === 'MemberExpression' || node.type === 'Property'
+      || node.type === 'MethodDefinition' || node.type === 'PropertyDefinition')
+      && FORBIDDEN_PROPERTIES.has(staticPropertyName(node.type === 'MemberExpression' ? node.property : node.key))) {
+    fail(FORBIDDEN_CAPABILITY)
+  }
+}
+
+function validateAdapterPolicy(source) {
+  let ast
+  try {
+    ast = parse(source, { ecmaVersion: 'latest', sourceType: 'module' })
+  } catch {
+    fail('e:adapter-invalid-syntax')
+  }
+  const pending = [{ node: ast, parent: null }]
+  while (pending.length > 0) {
+    const { node, parent } = pending.pop()
+    if (node.type === 'ImportDeclaration'
+      || node.type === 'ImportExpression'
+      || node.type === 'ExportAllDeclaration'
+      || (node.type === 'ExportNamedDeclaration' && node.source != null)
+      || (node.type === 'MetaProperty' && node.meta?.name === 'import')) {
+      fail(FORBIDDEN_DEPENDENCY)
+    }
+    validateCapabilityNode(node, parent)
+    pending.push(...children(node).map((child) => ({ node: child, parent: node })))
+  }
+  validateUnresolvedReferences(ast)
+}
+
+async function executeBytes(bytes, source, contentHash) {
+  let cached = MODULE_CACHE.get(contentHash)
+  if (cached == null) {
+    const boundBytes = Buffer.from(bytes)
+    cached = inspectIsolatedAdapter({ source, bytes: boundBytes, contentHash })
+      .then(({ module }) => module)
+      .catch((error) => {
+        MODULE_CACHE.delete(contentHash)
+        if (typeof error?.code === 'string' && error.code.startsWith('e:adapter-')) fail(error.code)
+        fail('e:adapter-execution-failed')
+      })
+    MODULE_CACHE.set(contentHash, cached)
+  }
+  try {
+    return await cached
+  } catch (error) {
+    if (error instanceof CheckedAdapterError) throw error
+    fail('e:adapter-execution-failed')
+  }
+}
+
+export async function loadCheckedAdapter({ repositoryRoot, adapterPath, onFilesystemBoundary } = {}) {
+  const acquired = acquireSource(repositoryRoot, adapterPath, onFilesystemBoundary)
+  const source = decodeStrictUtf8(acquired.bytes)
+  validateAdapterPolicy(source)
+  const contentHash = crypto.createHash('sha256').update(acquired.bytes).digest('hex')
+  notifyFilesystemBoundary(onFilesystemBoundary, 'after-acquire')
+  const module = await executeBytes(acquired.bytes, source, contentHash)
+  return Object.freeze({ module, canonicalPath: acquired.canonicalPath, contentHash })
+}