@crowdedkingdoms/ckx-kit 0.0.0-stage → 0.1.1-dev.1

package/dist/checks/src/build/client-capabilities.js

@@ -0,0 +1,123 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseHostCatalog = parseHostCatalog;
+exports.readHostCatalog = readHostCatalog;
+exports.deriveClientCapabilities = deriveClientCapabilities;
+exports.aggregateClientCapabilities = aggregateClientCapabilities;
+exports.canonicalJson = canonicalJson;
+exports.capabilityHash = capabilityHash;
+exports.capabilitySummaryWidens = capabilitySummaryWidens;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+/** The host catalog, checked: known groups, valid targets, no name twice. */
+function parseHostCatalog(json) {
+    const raw = JSON.parse(json);
+    const groups = raw.groups ?? {};
+    if (!Array.isArray(raw.functions) || raw.functions.length === 0) {
+        throw new Error('host catalog lists no functions');
+    }
+    const functions = [];
+    const seen = new Set();
+    for (const entry of raw.functions) {
+        const fn = (entry ?? {});
+        const name = fn.name;
+        if (typeof name !== 'string' || seen.has(name)) {
+            throw new Error(`host catalog names ${String(name)} badly or twice`);
+        }
+        seen.add(name);
+        if (typeof fn.group !== 'string' || !(fn.group in groups)) {
+            throw new Error(`host catalog: ${name} is in unknown group ${String(fn.group)}`);
+        }
+        const targets = fn.targets;
+        if (!Array.isArray(targets) ||
+            targets.length === 0 ||
+            targets.some((t) => t !== 'server' && t !== 'client')) {
+            throw new Error(`host catalog: ${name} has invalid targets`);
+        }
+        functions.push({
+            name,
+            group: fn.group,
+            targets: targets,
+        });
+    }
+    return { catalogVersion: Number(raw.catalogVersion), groups, functions };
+}
+async function readHostCatalog(file) {
+    return parseHostCatalog(await node_fs_1.promises.readFile(file, 'utf8'));
+}
+const sorted = (values) => [...new Set(values)].sort();
+/**
+ * A built CLIENT half's summary. Reads the module's import and export sections through
+ * `WebAssembly.Module`, which compiles it and runs nothing.
+ */
+function deriveClientCapabilities(bytes, catalog) {
+    const module = new WebAssembly.Module(bytes);
+    const imports = WebAssembly.Module.imports(module).map((i) => `${i.module}.${i.name}`);
+    const exportedFunctions = WebAssembly.Module.exports(module)
+        .filter((e) => e.kind === 'function')
+        .map((e) => e.name);
+    const haystack = Buffer.from(bytes.buffer, bytes.byteOffset, bytes.length);
+    const reachable = catalog.functions.filter((fn) => fn.targets.includes('client') &&
+        (imports.includes(`ck.${fn.name}`) ||
+            haystack.includes(Buffer.from(fn.name, 'utf8'))));
+    return {
+        version: 1,
+        target: 'client',
+        imports: sorted(imports),
+        hostFunctions: sorted(reachable.map((fn) => fn.name)),
+        capabilityGroups: sorted(reachable.map((fn) => fn.group)),
+        presentationHooks: sorted(reachable.filter((fn) => fn.group === 'present').map((fn) => fn.name)),
+        exportedFunctions: sorted(exportedFunctions),
+    };
+}
+/** The union of several summaries: one author's CLIENT halves in a grid. */
+function aggregateClientCapabilities(summaries) {
+    const union = (key) => sorted(summaries.flatMap((s) => {
+        const values = s[key];
+        return Array.isArray(values) ? values : [];
+    }));
+    return {
+        version: 1,
+        target: 'client',
+        imports: union('imports'),
+        hostFunctions: union('hostFunctions'),
+        capabilityGroups: union('capabilityGroups'),
+        presentationHooks: union('presentationHooks'),
+        exportedFunctions: union('exportedFunctions'),
+    };
+}
+/** JSON with every object's keys sorted, so equal summaries hash equally. */
+function canonicalJson(value) {
+    return JSON.stringify(sortKeys(value));
+}
+function sortKeys(value) {
+    if (Array.isArray(value))
+        return value.map(sortKeys);
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.keys(value)
+            .sort()
+            .map((k) => [k, sortKeys(value[k])]));
+    }
+    return value;
+}
+/** What consent binds to: the SHA-256 of the canonical summary, hex. */
+function capabilityHash(summary) {
+    return (0, node_crypto_1.createHash)('sha256').update(canonicalJson(summary)).digest('hex');
+}
+/**
+ * Whether `next` asks for anything `prev` did not: an import, a host call, a capability group,
+ * a presentation hook or an exported entry point (an export such as `on_event` is a channel the
+ * page feeds). Trust in an author stops covering their CLIENT halves in a grid once their union
+ * widens; narrowing keeps it.
+ */
+function capabilitySummaryWidens(prev, next) {
+    const widens = (a, b) => {
+        const have = new Set(a ?? []);
+        return (b ?? []).some((v) => !have.has(v));
+    };
+    return (widens(prev.imports, next.imports) ||
+        widens(prev.hostFunctions, next.hostFunctions) ||
+        widens(prev.capabilityGroups, next.capabilityGroups) ||
+        widens(prev.presentationHooks, next.presentationHooks) ||
+        widens(prev.exportedFunctions, next.exportedFunctions));
+}

package/dist/checks/src/build/exec-source.js

@@ -0,0 +1,343 @@
+"use strict";
+/**
+ * What a ck-exec build may contain, and how its manifest is rewritten for the toolchain.
+ *
+ * A build is one or more crates, each a `ckx-sdk` library built as a `cdylib` for
+ * `wasm32-unknown-unknown`: one module per crate, which the app's manifest names by digest.
+ * A CLIENT build is the browser half of a player's mod instead: one `crowdy-client-sdk` crate.
+ * Cargo runs build scripts and proc-macros at compile time, so every dependency is one the
+ * platform vendored and reviewed, and nothing may add another.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EXEC_ARTIFACT_MAX_BYTES = exports.EXEC_ABI_EXPORTS = exports.EXEC_ABI_IMPORTS = exports.EXEC_MAX_SOURCE_BYTES = exports.EXEC_MAX_FILES_PER_CRATE = exports.EXEC_MAX_CRATES = exports.EXEC_ALLOWED_SECTIONS = exports.CLIENT_TICK_INTERVAL_MS = exports.BUILD_SDK = exports.CLIENT_ALLOWED_CRATES = exports.EXEC_ALLOWED_CRATES = void 0;
+exports.validateExecPath = validateExecPath;
+exports.validateExecManifest = validateExecManifest;
+exports.validateExecCrates = validateExecCrates;
+exports.rewriteExecManifest = rewriteExecManifest;
+exports.clientTickIntervalMs = clientTickIntervalMs;
+exports.validateExecArtifact = validateExecArtifact;
+const rust_source_guard_1 = require("./rust-source-guard");
+/** Dependencies a ck-exec crate may declare (the toolchain vendors them and their deps). */
+exports.EXEC_ALLOWED_CRATES = new Set([
+    'ckx-sdk',
+    'serde',
+    'serde_json',
+]);
+/** Dependencies a CLIENT crate may declare: the client SDK and the same serde crates. */
+exports.CLIENT_ALLOWED_CRATES = new Set([
+    'crowdy-client-sdk',
+    'serde',
+    'serde_json',
+]);
+/** The SDK each kind builds against; its dependency line is pointed at the toolchain's copy. */
+exports.BUILD_SDK = {
+    exec: 'ckx-sdk',
+    client: 'crowdy-client-sdk',
+};
+const ALLOWED_CRATES = {
+    exec: exports.EXEC_ALLOWED_CRATES,
+    client: exports.CLIENT_ALLOWED_CRATES,
+};
+/**
+ * The browser tick Crowdy Studio reads from a CLIENT crate, `[package.metadata.crowdy]
+ * tick_interval_ms`: 1000 ms when absent, clamped to 16-1000 ms.
+ */
+exports.CLIENT_TICK_INTERVAL_MS = { default: 1_000, min: 16, max: 1_000 };
+const CLIENT_METADATA_SECTION = 'package.metadata.crowdy';
+/** Manifest sections a crate may contain; everything else (build scripts, patches) is refused. */
+exports.EXEC_ALLOWED_SECTIONS = new Set([
+    'package',
+    'lib',
+    'dependencies',
+]);
+exports.EXEC_MAX_CRATES = 16;
+exports.EXEC_MAX_FILES_PER_CRATE = 64;
+exports.EXEC_MAX_SOURCE_BYTES = 2 * 1024 * 1024;
+const CRATE_NAME = /^[a-z][a-z0-9_-]{0,63}$/;
+const SOURCE_PATH = /^[A-Za-z0-9_\-./]+$/;
+const TOP_FILES = new Set(['Cargo.toml', 'README.md']);
+function fail(message) {
+    throw new Error(message);
+}
+/** A crate file path: `Cargo.toml`, `README.md`, or a Rust file under `src/`. */
+function validateExecPath(path) {
+    if (!SOURCE_PATH.test(path) || path.length > 200)
+        fail(`bad source path '${path}'`);
+    const parts = path.split('/');
+    if (parts.some((p) => p === '' || p === '.' || p === '..'))
+        fail(`bad source path '${path}'`);
+    if (TOP_FILES.has(path))
+        return;
+    if (parts[0] !== 'src' || !path.endsWith('.rs')) {
+        fail(`'${path}' is not Cargo.toml, README.md or a .rs file under src/`);
+    }
+}
+function stripComment(line) {
+    let inString = false;
+    for (let i = 0; i < line.length; i++) {
+        const c = line[i];
+        if (c === '"' && line[i - 1] !== '\\')
+            inString = !inString;
+        if (c === '#' && !inString)
+            return line.slice(0, i);
+    }
+    return line;
+}
+/**
+ * Keys each section may hold. Anything else is refused: several Cargo keys name a file on
+ * the build host (`[lib] path`, `[package] workspace`, `readme`, `build`).
+ */
+const PACKAGE_KEYS = new Set([
+    'name',
+    'version',
+    'edition',
+    'description',
+    'publish',
+    'license',
+    'authors',
+    'rust-version',
+]);
+const LIB_KEYS = new Set(['name', 'crate-type']);
+const DEPENDENCY_KEYS = new Set([
+    'version',
+    'features',
+    'default-features',
+]);
+/**
+ * The keys of a one-line inline table's body, split at its top-level commas; null unless every
+ * entry is a BARE key and a value. A quoted key (`"path" = …`) is the same key to cargo, so a
+ * check that reads only bare words before `=` would let it through.
+ */
+function inlineTableKeys(body) {
+    const entries = [];
+    let depth = 0;
+    let quote = null;
+    let start = 0;
+    for (let i = 0; i < body.length; i++) {
+        const c = body[i];
+        if (quote) {
+            if (c === '\\' && quote === '"')
+                i++;
+            else if (c === quote)
+                quote = null;
+            continue;
+        }
+        if (c === '"' || c === "'")
+            quote = c;
+        else if (c === '[' || c === '{')
+            depth++;
+        else if (c === ']' || c === '}')
+            depth--;
+        else if (c === ',' && depth === 0) {
+            entries.push(body.slice(start, i));
+            start = i + 1;
+        }
+        if (depth < 0)
+            return null;
+    }
+    if (quote || depth !== 0)
+        return null;
+    entries.push(body.slice(start));
+    if (entries.length === 1 && entries[0].trim() === '')
+        return [];
+    const keys = [];
+    for (const entry of entries) {
+        const kv = entry.match(/^\s*([A-Za-z0-9_-]+)\s*=\s*(.*?)\s*$/);
+        if (!kv || !DEPENDENCY_VALUE.test(kv[2]))
+            return null;
+        keys.push(kv[1]);
+    }
+    return keys;
+}
+const TOML_STRING = `(?:"(?:[^"\\\\]|\\\\.)*"|'[^']*')`;
+/** One value of a dependency table: a string, a boolean, or an array of strings. */
+const DEPENDENCY_VALUE = new RegExp(`^(?:${TOML_STRING}|true|false|\\[\\s*(?:${TOML_STRING}\\s*(?:,\\s*${TOML_STRING}\\s*)*,?)?\\s*\\])$`);
+/**
+ * The crate's Cargo.toml: only [package], [lib] as a cdylib, and [dependencies] from the
+ * allowlist, one key per line. The SDK's line is replaced by the toolchain's copy, so its
+ * value does not matter; the others are a version or `{ version, features,
+ * default-features }` from the vendored registry. A CLIENT crate may also carry
+ * `[package.metadata.crowdy]` with `tick_interval_ms`, which cargo ignores.
+ */
+function validateExecManifest(manifest, kind = 'exec') {
+    const allowed = ALLOWED_CRATES[kind];
+    const sdk = exports.BUILD_SDK[kind];
+    let section = '';
+    let cdylib = false;
+    for (const raw of manifest.split(/\r?\n/)) {
+        const line = stripComment(raw).trim();
+        if (!line)
+            continue;
+        const header = line.match(/^\[([^\]]+)\]$/);
+        if (header) {
+            section = header[1].trim();
+            const metadata = kind === 'client' && section === CLIENT_METADATA_SECTION;
+            if (!exports.EXEC_ALLOWED_SECTIONS.has(section) && !metadata) {
+                fail(`Cargo.toml section [${section}] is not allowed (only ${[...exports.EXEC_ALLOWED_SECTIONS].join(', ')}${kind === 'client' ? `, ${CLIENT_METADATA_SECTION}` : ''})`);
+            }
+            continue;
+        }
+        const kv = line.match(/^([A-Za-z0-9_-]+)\s*=\s*(.+)$/);
+        if (!kv)
+            fail(`Cargo.toml line '${line}' is not a single-line key = value`);
+        const [, key, value] = kv;
+        if (section === '')
+            fail(`Cargo.toml key '${key}' must be inside a section`);
+        if (section === 'package' && !PACKAGE_KEYS.has(key)) {
+            fail(`Cargo.toml [package] ${key} is not allowed (only ${[...PACKAGE_KEYS].join(', ')})`);
+        }
+        if (section === 'lib') {
+            if (!LIB_KEYS.has(key)) {
+                fail(`Cargo.toml [lib] ${key} is not allowed (only ${[...LIB_KEYS].join(', ')})`);
+            }
+            if (key === 'crate-type') {
+                if (!/^\[\s*"cdylib"\s*(,\s*"rlib"\s*)?\]$/.test(value))
+                    fail('[lib] crate-type must be ["cdylib"]');
+                cdylib = true;
+            }
+        }
+        if (section === CLIENT_METADATA_SECTION) {
+            if (key !== 'tick_interval_ms') {
+                fail(`Cargo.toml [${CLIENT_METADATA_SECTION}] ${key} is not allowed (only tick_interval_ms)`);
+            }
+            if (!/^\d{1,6}$/.test(value)) {
+                fail('tick_interval_ms must be a whole number of milliseconds');
+            }
+        }
+        if (section === 'dependencies') {
+            if (!allowed.has(key)) {
+                fail(`Cargo.toml dependency '${key}' is not in the allowlist (${[...allowed].join(', ')})`);
+            }
+            if (key !== sdk && !/^"[^"]*"$/.test(value)) {
+                const table = value.match(/^\{(.*)\}$/);
+                const keys = table ? inlineTableKeys(table[1]) : null;
+                if (!keys) {
+                    fail(`dependency '${key}' must be a version or a one-line { version, features } table with bare keys`);
+                }
+                for (const k of keys) {
+                    if (!DEPENDENCY_KEYS.has(k)) {
+                        fail(`dependency '${key}' may not set '${k}': only a version from the vendored registry, features and default-features`);
+                    }
+                }
+            }
+        }
+    }
+    if (!cdylib)
+        fail('Cargo.toml needs [lib] crate-type = ["cdylib"]');
+}
+/** Every crate of a build: names, paths, sizes, manifests. */
+function validateExecCrates(crates, kind = 'exec') {
+    if (crates.length === 0)
+        fail('a build names at least one crate');
+    if (kind === 'client' && crates.length !== 1)
+        fail('a CLIENT half is built from exactly one crate');
+    if (crates.length > exports.EXEC_MAX_CRATES)
+        fail(`a build has at most ${exports.EXEC_MAX_CRATES} crates`);
+    const names = new Set();
+    let total = 0;
+    for (const c of crates) {
+        if (!CRATE_NAME.test(c.name))
+            fail(`crate name '${c.name}' must be lowercase letters, digits, '-' or '_'`);
+        if (names.has(c.name))
+            fail(`crate '${c.name}' appears twice`);
+        names.add(c.name);
+        const paths = Object.keys(c.files);
+        if (paths.length > exports.EXEC_MAX_FILES_PER_CRATE)
+            fail(`crate '${c.name}' has more than ${exports.EXEC_MAX_FILES_PER_CRATE} files`);
+        for (const p of paths) {
+            validateExecPath(p);
+            if (p.endsWith('.rs'))
+                (0, rust_source_guard_1.assertNoHostReads)(`${c.name}/${p}`, c.files[p]);
+            total += Buffer.byteLength(c.files[p], 'utf8');
+        }
+        if (!('Cargo.toml' in c.files))
+            fail(`crate '${c.name}' has no Cargo.toml`);
+        if (!('src/lib.rs' in c.files))
+            fail(`crate '${c.name}' has no src/lib.rs`);
+        validateExecManifest(c.files['Cargo.toml'], kind);
+    }
+    if (total > exports.EXEC_MAX_SOURCE_BYTES)
+        fail(`a build's sources are at most ${exports.EXEC_MAX_SOURCE_BYTES} bytes`);
+}
+/**
+ * Points the kind's SDK at the toolchain's pinned copy and appends the platform release
+ * profile (a crate may not declare its own; the validator refuses [profile]).
+ */
+function rewriteExecManifest(manifest, sdkPath, kind = 'exec') {
+    const sdk = exports.BUILD_SDK[kind];
+    const line = new RegExp(`^\\s*${sdk}\\s*=`);
+    const lines = manifest
+        .split(/\r?\n/)
+        .map((l) => (line.test(l) ? `${sdk} = { path = "${sdkPath}" }` : l));
+    return `${lines.join('\n')}\n\n[profile.release]\nopt-level = 3\nlto = true\ncodegen-units = 1\npanic = "abort"\nstrip = "symbols"\n`;
+}
+/** A validated CLIENT manifest's `tick_interval_ms`, clamped as Crowdy Studio clamps it. */
+function clientTickIntervalMs(manifest) {
+    let section = '';
+    for (const raw of manifest.split(/\r?\n/)) {
+        const line = stripComment(raw).trim();
+        const header = line.match(/^\[([^\]]+)\]$/);
+        if (header) {
+            section = header[1].trim();
+            continue;
+        }
+        const kv = line.match(/^tick_interval_ms\s*=\s*(\d+)$/);
+        if (section === CLIENT_METADATA_SECTION && kv && Number(kv[1]) > 0) {
+            return Math.min(exports.CLIENT_TICK_INTERVAL_MS.max, Math.max(exports.CLIENT_TICK_INTERVAL_MS.min, Number(kv[1])));
+        }
+    }
+    return exports.CLIENT_TICK_INTERVAL_MS.default;
+}
+/** The guest ABI's imports (`ckx` module), from ck-exec's docs/GUEST-ABI.md. */
+exports.EXEC_ABI_IMPORTS = new Set([
+    'log',
+    'now_ms',
+    'call',
+    'send',
+    'publish',
+    'node',
+    'wake_at',
+    'subscribe',
+    'unsubscribe',
+    'persist_now',
+    'emit',
+]);
+/** Exports every ck-exec module has. */
+exports.EXEC_ABI_EXPORTS = [
+    ['memory', 'memory'],
+    ['ckx_abi', 'function'],
+    ['ckx_alloc', 'function'],
+    ['ckx_init', 'function'],
+    ['ckx_handle', 'function'],
+    ['ckx_persist', 'function'],
+    ['ckx_evict', 'function'],
+];
+/** The largest module the execution manager accepts (ck-exec `bounds::ARTIFACT_MAX_BYTES`). */
+exports.EXEC_ARTIFACT_MAX_BYTES = 16 * 1024 * 1024;
+/**
+ * A built module fit for ck-exec: compiles, imports nothing but the guest ABI, exports its
+ * entry points, and fits the manager's limit.
+ */
+async function validateExecArtifact(bytes) {
+    if (bytes.length > exports.EXEC_ARTIFACT_MAX_BYTES)
+        fail(`module is ${bytes.length} bytes; the limit is ${exports.EXEC_ARTIFACT_MAX_BYTES}`);
+    let module;
+    try {
+        module = await WebAssembly.compile(bytes);
+    }
+    catch (err) {
+        fail(`malformed WASM module: ${err.message}`);
+    }
+    for (const imp of WebAssembly.Module.imports(module)) {
+        if (imp.module !== 'ckx' ||
+            imp.kind !== 'function' ||
+            !exports.EXEC_ABI_IMPORTS.has(imp.name)) {
+            fail(`module import ${imp.module}::${imp.name} (${imp.kind}) is not part of the ck-exec guest ABI`);
+        }
+    }
+    const exported = new Map(WebAssembly.Module.exports(module).map((e) => [e.name, e.kind]));
+    for (const [name, kind] of exports.EXEC_ABI_EXPORTS) {
+        if (exported.get(name) !== kind)
+            fail(`module does not export ${kind} '${name}'; build it with ckx-sdk's export macro`);
+    }
+}

package/dist/checks/src/build/rust-source-guard.js

@@ -0,0 +1,165 @@
+"use strict";
+/**
+ * Rust that reads the build host at compile time. Crates are compiled on the API's hosts,
+ * so `include_str!("/etc/…")`, `env!("…")` or `#[path = "/proc/…"] mod x;` would put the
+ * host's files or environment into the module, or into the compiler errors the developer
+ * reads back. Refused:
+ *   - the reading macros by name, anywhere in code (a `use … as` rename, or passing the
+ *     name into a macro, still names them);
+ *   - `#[path]` and `#[link]` attributes, including inside `cfg_attr`;
+ *   - an out-of-line `mod x;` inside a `macro_rules!` body, where a metavariable could
+ *     become a `#[path]` the attribute check never sees.
+ *
+ * Comments and string literals are skipped. Anything the scanner cannot classify counts as
+ * code, so where it and rustc disagree it is only stricter. This is one layer: the build
+ * also runs with a scrubbed environment, and a filesystem sandbox is the backstop.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rustCodeOnly = rustCodeOnly;
+exports.assertNoHostReads = assertNoHostReads;
+const BANNED_IDENTS = [
+    'include',
+    'include_str',
+    'include_bytes',
+    'env',
+    'option_env',
+    'asm',
+    'global_asm',
+    'naked_asm',
+];
+const BANNED_IDENT = new RegExp(`\\b(${BANNED_IDENTS.join('|')})\\b`);
+const ATTR_START = /#\s*!?\s*\[/g;
+const BANNED_ATTR = /\b(path|link|link_args)\b/;
+const MACRO_RULES = /\bmacro_rules\s*!\s*[A-Za-z_]\w*\s*[{([]/g;
+const OUT_OF_LINE_MOD = /\bmod\s+[$A-Za-z_][\w$]*\s*;/;
+const CLOSE = { '{': '}', '(': ')', '[': ']' };
+/** The index of the bracket closing the one at `open`, or the end of `code`. */
+function closing(code, open) {
+    const o = code[open];
+    const c = CLOSE[o];
+    let depth = 0;
+    for (let j = open; j < code.length; j++) {
+        if (code[j] === o)
+            depth++;
+        else if (code[j] === c && --depth === 0)
+            return j;
+    }
+    return code.length - 1;
+}
+function isIdentChar(c) {
+    return c !== undefined && /[A-Za-z0-9_]/.test(c);
+}
+/** `src` with comments and string/char literal contents blanked; newlines are kept. */
+function rustCodeOnly(src) {
+    const out = [];
+    const blank = (from, to) => {
+        for (let k = from; k < to; k++)
+            out.push(src[k] === '\n' ? '\n' : ' ');
+    };
+    let i = 0;
+    const n = src.length;
+    while (i < n) {
+        const c = src[i];
+        const d = src[i + 1];
+        if (c === '/' && d === '/') {
+            const end = src.indexOf('\n', i);
+            const stop = end === -1 ? n : end;
+            blank(i, stop);
+            i = stop;
+            continue;
+        }
+        if (c === '/' && d === '*') {
+            let depth = 0;
+            let j = i;
+            while (j < n) {
+                if (src[j] === '/' && src[j + 1] === '*') {
+                    depth++;
+                    j += 2;
+                }
+                else if (src[j] === '*' && src[j + 1] === '/') {
+                    depth--;
+                    j += 2;
+                    if (depth === 0)
+                        break;
+                }
+                else {
+                    j++;
+                }
+            }
+            blank(i, j);
+            i = j;
+            continue;
+        }
+        const prefixed = !isIdentChar(src[i - 1]);
+        if (prefixed && (c === 'r' || ((c === 'b' || c === 'c') && d === 'r'))) {
+            let j = c === 'r' ? i + 1 : i + 2;
+            let hashes = 0;
+            while (src[j] === '#') {
+                hashes++;
+                j++;
+            }
+            if (src[j] === '"') {
+                const close = `"${'#'.repeat(hashes)}`;
+                const end = src.indexOf(close, j + 1);
+                if (end !== -1) {
+                    blank(i, end + close.length);
+                    i = end + close.length;
+                    continue;
+                }
+            }
+        }
+        if (c === '"') {
+            let j = i + 1;
+            while (j < n && src[j] !== '"')
+                j += src[j] === '\\' ? 2 : 1;
+            blank(i, Math.min(n, j + 1));
+            i = j + 1;
+            continue;
+        }
+        if (c === "'") {
+            let j = -1;
+            if (d === '\\') {
+                const e = src[i + 2];
+                const k = e === 'u' ? src.indexOf('}', i + 2) + 1 : e === 'x' ? i + 5 : i + 3;
+                if (k > 0 && src[k] === "'")
+                    j = k;
+            }
+            else if (src[i + 2] === "'") {
+                j = i + 2;
+            }
+            if (j !== -1) {
+                blank(i, j + 1);
+                i = j + 1;
+                continue;
+            }
+        }
+        out.push(c);
+        i++;
+    }
+    return out.join('');
+}
+/** Throws with the file and line of the first construct that could read the build host. */
+function assertNoHostReads(file, src) {
+    const code = rustCodeOnly(src);
+    const lineOf = (at) => code.slice(0, at).split('\n').length;
+    const ident = BANNED_IDENT.exec(code);
+    if (ident) {
+        throw new Error(`${file}:${lineOf(ident.index)}: \`${ident[1]}\` is not allowed in platform builds (it can read the build host at compile time)`);
+    }
+    for (const m of code.matchAll(ATTR_START)) {
+        const open = m.index + m[0].length - 1;
+        const body = code.slice(open, closing(code, open) + 1);
+        const attr = BANNED_ATTR.exec(body);
+        if (attr) {
+            throw new Error(`${file}:${lineOf(m.index)}: the #[${attr[1]}] attribute is not allowed in platform builds`);
+        }
+    }
+    for (const m of code.matchAll(MACRO_RULES)) {
+        const open = m.index + m[0].length - 1;
+        const body = code.slice(open, closing(code, open) + 1);
+        const decl = OUT_OF_LINE_MOD.exec(body);
+        if (decl) {
+            throw new Error(`${file}:${lineOf(open + decl.index)}: a macro may not declare an out-of-line module (\`mod name;\`); declare it outside the macro`);
+        }
+    }
+}