@lapxo/bound 0.1.8 → 0.1.9

package/dist/host/native/materialize.js

@@ -0,0 +1,175 @@
+import { sha256 as sha } from "../hash.js";
+/** Fixed host materialization from admitted logical references. Physical locations
+ * never arrive from a reader packet and never become semantic source identity.
+ */
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, existsSync, realpathSync, renameSync, chmodSync } from 'node:fs';
+import { join, dirname, relative, sep, extname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { gunzipSync } from 'node:zlib';
+import { members as archiveMembers, archiveCoordinate } from "../archive.js";
+import { blobAt, storeAt, holdStore } from "../../land/ledger.js";
+import { ContentNeeded } from "../content-needed.js";
+import { processOf, ownRoot } from "../../observe/runner.js";
+import { instrumentCoordinates } from "../../fold/digests.js";
+import { readBoundedFile } from "./bounded-file.js";
+import { assertNativeRouteCurrent, nativeRouteStore, nativeMountIdentity } from "./route.js";
+const fail = (why) => { throw Error('REFUSE·native materialize ' + why); };
+const mounted = new Map();
+function laid(store, digest, remaining) { const path = blobAt(store, digest); if (!existsSync(path))
+    throw new ContentNeeded(digest); const bytes = readBoundedFile(path, remaining, digest); if (sha(bytes) !== digest)
+    fail('laid bytes differ ' + digest); return { path, bytes }; }
+/** Called under the actual Root lease before identity/cache preparation. Missing
+ * laid content is a named content demand, never a publisher authority fallback.
+ * One retained mount per immutable selection avoids copying it on each ask.
+ */
+export function materializeNativeRoute(route) {
+    assertNativeRouteCurrent(route);
+    const store = nativeRouteStore(route), mountIdentity = nativeMountIdentity(route.profile, route.binaries, route.control), key = store + '\0' + mountIdentity, old = mounted.get(key);
+    if (old) {
+        const members = new Map();
+        for (const member of route.profile.selection.members) {
+            if (members.has(member.coordinate))
+                fail('ambiguous image coordinate');
+            members.set(member.coordinate, member);
+        }
+        let bytes = 0;
+        for (const location of old.locations) {
+            const member = members.get(location.member) ?? fail('retained image member not selected ' + location.member);
+            const raw = readBoundedFile(location.path, route.profile.selection.budget.bytes - bytes, location.member);
+            bytes += raw.length;
+            if (sha(raw) !== member.digest)
+                fail('retained image member differs ' + member.coordinate);
+            if (location.kind === 'binary' && location.member !== route.profile.selection.runtime && !route.binaries.some(b => b.profile.entry.path === location.member && b.origin))
+                chmodSync(location.path, 0o555);
+        }
+        return old;
+    }
+    const selection = route.profile.selection, budget = selection.budget;
+    if (!Number.isSafeInteger(budget.bytes) || budget.bytes < 1 || !Number.isSafeInteger(budget.members) || budget.members < 1 || selection.members.length > budget.members)
+        fail('missing image resources');
+    const archive = laid(store, selection.archive, budget.bytes);
+    gunzipSync(archive.bytes, { maxOutputLength: budget.bytes });
+    const files = new Map(archiveMembers(archive.bytes).map(member => [member.name, member.bytes]));
+    let charged = archive.bytes.length, retainedBytes = 0;
+    const root = storeAt(store, 'cas', 'laid', mountIdentity.slice(7)), present = existsSync(root);
+    mkdirSync(dirname(root), { recursive: true });
+    const building = present ? root : mkdtempSync(root + '.part-'), seen = new Set();
+    try {
+        const locations = selection.members.map(member => {
+            const coordinate = archiveCoordinate(member.coordinate);
+            if (coordinate !== member.coordinate || seen.has(coordinate))
+                return fail('ambiguous image coordinate');
+            seen.add(coordinate);
+            const binary = route.binaries.filter(b => b.profile.entry.path === coordinate), origins = binary.flatMap(b => b.origin ? [b.origin] : []);
+            if (new Set(origins.map(o => o.path)).size > 1)
+                fail('conflicting binary origins');
+            const origin = origins[0];
+            if (origin && binary.some(b => !b.origin))
+                fail('conflicting relocation/origin meaning');
+            let bytes, path;
+            if (coordinate === selection.runtime) {
+                path = realpathSync(process.execPath);
+                bytes = readBoundedFile(path, budget.bytes - charged, coordinate);
+            }
+            else if (origin) {
+                path = origin.path;
+                bytes = readBoundedFile(path, budget.bytes - charged, coordinate);
+            }
+            else {
+                const packed = files.get(coordinate);
+                if (packed !== undefined)
+                    bytes = packed;
+                else
+                    bytes = laid(store, member.digest, budget.bytes - charged).bytes;
+                path = join(building, coordinate);
+            }
+            if (binary.some(b => b.profile.entry.bytes !== bytes.length))
+                fail('binary entry byte count differs ' + coordinate);
+            if (bytes.length > budget.bytes - charged || (charged += bytes.length) > budget.bytes)
+                fail('aggregate image and archive bytes exceeded');
+            if (sha(bytes) !== member.digest)
+                fail('image member differs ' + coordinate);
+            if (coordinate !== selection.runtime && !origin) {
+                retainedBytes += bytes.length;
+                if (present) {
+                    const actual = readBoundedFile(path, bytes.length, coordinate);
+                    if (sha(actual) !== member.digest)
+                        fail('retained image member differs ' + coordinate);
+                }
+                else {
+                    mkdirSync(dirname(path), { recursive: true });
+                    writeFileSync(path, bytes, { flag: 'wx', mode: binary.length ? 0o555 : 0o444 });
+                }
+                if (binary.length)
+                    chmodSync(path, 0o555);
+            }
+            return { member: coordinate, path, kind: coordinate === selection.runtime || binary.length ? 'binary' : /\.(?:[mc]?js|ts)$/.test(coordinate) ? 'module' : 'data' };
+        });
+        if (!present) {
+            renameSync(building, root);
+            for (const location of locations)
+                if (location.member !== selection.runtime && !route.binaries.some(b => b.profile.entry.path === location.member && b.origin))
+                    location.path = join(root, location.member);
+            holdStore(store, 'laid', mountIdentity, retainedBytes);
+        }
+        const result = { archive: archive.path, locations, cwd: root, mountIdentity };
+        mounted.set(key, result);
+        return result;
+    }
+    catch (error) {
+        if (!present)
+            rmSync(building, { recursive: true, force: true });
+        throw error;
+    }
+}
+/** Fixed child, lifetime supervisor and transitive host modules enter identity
+ * before the cache key. Existing instrument closure resolves actual dependencies;
+ * this descriptor never executes a module and never accepts a world verifier.
+ */
+export function nativeExecutorInputs(route) {
+    const store = nativeRouteStore(route), all = new Map();
+    for (const entry of [...(route.control ? [fileURLToPath(new URL('./control-bridge-worker' + extname(new URL(import.meta.url).pathname), import.meta.url))] : []), processOf('native'), processOf('lifetime', 'host'), processOf('custodian'), processOf('native-descendant'), processOf('preload', 'host/native')])
+        for (const [path, digest] of instrumentCoordinates(store, entry, [], ownRoot(), [], true))
+            all.set(path, digest);
+    const refs = [];
+    let bytes = 0;
+    for (const [path, digest] of all) {
+        const held = readBoundedFile(path, route.profile.selection.budget.bytes - bytes, path);
+        bytes += held.length;
+        if (sha(held) !== digest)
+            fail('fixed executor changed during descriptor');
+        const local = relative(ownRoot(), path);
+        let name;
+        if (!local.startsWith('..' + sep) && local !== '..')
+            name = local.split(sep).join('/');
+        else {
+            let cursor = dirname(path);
+            for (;;) {
+                const manifest = join(cursor, 'package.json');
+                if (existsSync(manifest)) {
+                    let pkg;
+                    try {
+                        const raw = readBoundedFile(manifest, route.profile.selection.budget.bytes - bytes, manifest);
+                        bytes += raw.length;
+                        pkg = JSON.parse(raw.toString('utf8'));
+                        if (typeof pkg.name === 'string')
+                            refs.push([['native/executor/library', pkg.name, 'package.json'].join('/'), sha(raw)]);
+                    }
+                    catch {
+                        return fail('fixed dependency manifest invalid');
+                    }
+                    if (typeof pkg.name !== 'string')
+                        return fail('fixed dependency has no declared name');
+                    name = 'library/' + pkg.name + '/' + relative(cursor, path).split(sep).join('/');
+                    break;
+                }
+                const parent = dirname(cursor);
+                if (parent === cursor)
+                    return fail('fixed dependency logical coordinates absent');
+                cursor = parent;
+            }
+        }
+        refs.push(['native/executor/' + name, digest]);
+    }
+    return [...new Map(refs).entries()];
+}

package/dist/host/native/module-closure.d.ts

@@ -0,0 +1,27 @@
+export interface ModuleClosureMember {
+    readonly digest: string;
+    readonly source: string;
+}
+export interface ModuleClosureSnapshot {
+    readonly identity: string;
+    readonly entry: string;
+    readonly members: ReadonlyMap<string, ModuleClosureMember>;
+}
+export interface ModuleClosureReading {
+    readonly snapshot: string;
+    readonly coordinate: string;
+    readonly digest: string;
+}
+/** Host-selected archive and entry, never a verifier assertion from the program.
+ * This proves content identity only; standing admission and runtime capabilities
+ * are separate prerequisites. Binary resources are not executable text members.
+ */
+export declare function moduleSnapshot(archive: Uint8Array, expected: string, entry: string): ModuleClosureSnapshot;
+/** The host supplies authenticated snapshot identities and its library resolver.
+ * Each reached text member is verified here against its exact UTF-8 bytes.
+ * Authentication of the snapshot envelope remains a separate host prerequisite.
+ * A capsule cannot select either verifier or resolver.
+ * This reads declared module edges, not arbitrary I/O or a JavaScript sandbox. Computed edges are unpaid, never absent.
+ * Activation requires an admitted host policy; existing inventory callers are not silently changed.
+ */
+export declare function moduleClosure(snapshot: ModuleClosureSnapshot, library: (specifier: string, parent: ModuleClosureSnapshot) => ModuleClosureSnapshot | undefined): readonly ModuleClosureReading[];

package/dist/host/native/module-closure.js

@@ -0,0 +1,99 @@
+import { builtinModules } from 'node:module';
+import { createHash } from 'node:crypto';
+import { posix } from 'node:path';
+import { moduleImportSyntax } from "./module-syntax.js";
+import { members } from "../archive.js";
+/** Host-selected archive and entry, never a verifier assertion from the program.
+ * This proves content identity only; standing admission and runtime capabilities
+ * are separate prerequisites. Binary resources are not executable text members.
+ */
+export function moduleSnapshot(archive, expected, entry) {
+    const identity = 'sha256:' + createHash('sha256').update(archive).digest('hex');
+    if (!/^sha256:[0-9a-f]{64}$/.test(expected) || identity !== expected)
+        throw Error('REFUSE·module closure archive bytes differ');
+    const textMembers = new Map();
+    for (const member of members(archive)) {
+        // Platform archive metadata remains covered by the archive digest. Its
+        // binary header, rather than a filename convention, identifies data.
+        if (member.bytes.length >= 4 && new DataView(member.bytes.buffer, member.bytes.byteOffset, 4).getUint32(0) === 0x00051607)
+            continue;
+        if (!['.js', '.mjs', '.cjs', '.ts', '.json'].includes(posix.extname(member.name)))
+            continue;
+        let source;
+        try {
+            source = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(member.bytes);
+        }
+        catch {
+            throw Error('REFUSE·module closure invalid UTF-8 bytes ' + member.name);
+        }
+        textMembers.set(member.name, { source, digest: 'sha256:' + createHash('sha256').update(member.bytes).digest('hex') });
+    }
+    return { identity, entry, members: textMembers };
+}
+/** The host supplies authenticated snapshot identities and its library resolver.
+ * Each reached text member is verified here against its exact UTF-8 bytes.
+ * Authentication of the snapshot envelope remains a separate host prerequisite.
+ * A capsule cannot select either verifier or resolver.
+ * This reads declared module edges, not arbitrary I/O or a JavaScript sandbox. Computed edges are unpaid, never absent.
+ * Activation requires an admitted host policy; existing inventory callers are not silently changed.
+ */
+export function moduleClosure(snapshot, library) {
+    const seen = new Map();
+    const coordinate = (name) => {
+        const normalized = posix.normalize(name);
+        if (!name || name.includes('\0') || name.includes('\\') || posix.isAbsolute(name) || normalized === '..' || normalized.startsWith('../'))
+            throw Error('REFUSE·module closure coordinate leaves snapshot ' + name);
+        return normalized;
+    };
+    const walk = (one, name) => {
+        const at = coordinate(name), key = JSON.stringify([one.identity, at]);
+        const member = one.members.get(at);
+        if (member === undefined)
+            throw Error('REFUSE·module closure missing ' + one.identity + ' ' + at);
+        if (typeof member.source !== 'string' || !/^sha256:[0-9a-f]{64}$/.test(member.digest))
+            throw Error('REFUSE·module closure unnamed bytes ' + one.identity + ' ' + at);
+        const bytes = Buffer.from(member.source, 'utf8');
+        if (bytes.toString('utf8') !== member.source)
+            throw Error('REFUSE·module closure invalid UTF-8 text ' + one.identity + ' ' + at);
+        if ('sha256:' + createHash('sha256').update(bytes).digest('hex') !== member.digest)
+            throw Error('REFUSE·module closure bytes differ ' + one.identity + ' ' + at);
+        const kept = seen.get(key);
+        if (kept) {
+            if (kept.digest !== member.digest)
+                throw Error('REFUSE·module closure conflicting member ' + one.identity + ' ' + at);
+            return;
+        }
+        seen.set(key, { snapshot: one.identity, coordinate: at, digest: member.digest });
+        // JSON is data under the loader contract, not module syntax.
+        if (posix.extname(at) === '.json')
+            return;
+        const syntax = moduleImportSyntax(member.source, at);
+        if (syntax.unresolved.length)
+            throw Error('REFUSE·module closure unresolved ' + at + ' ' + syntax.unresolved.join(' · '));
+        for (const specifier of syntax.imports) {
+            // createRequire/registerHooks can select executable edges not present in this graph.
+            // Their runtime closure needs its own host contract; an arbitrary alias is not a literal edge.
+            if (specifier === 'node:module' || specifier === 'module')
+                throw Error('REFUSE·module closure runtime loader requires declared closure ' + specifier + ' from ' + at);
+            if (specifier.startsWith('node:')) {
+                if (!builtinModules.includes(specifier) && !builtinModules.includes(specifier.slice(5)))
+                    throw Error('REFUSE·module closure unknown builtin ' + specifier + ' from ' + at);
+                continue;
+            }
+            if (builtinModules.includes(specifier))
+                continue;
+            if (specifier.startsWith('.')) {
+                walk(one, posix.join(posix.dirname(at), specifier));
+                continue;
+            }
+            if (specifier.includes(':') || posix.isAbsolute(specifier))
+                throw Error('REFUSE·module closure unsupported location ' + specifier + ' from ' + at);
+            const pinned = library(specifier, one);
+            if (pinned === undefined)
+                throw Error('REFUSE·module closure unpinned library ' + specifier + ' from ' + at);
+            walk(pinned, pinned.entry);
+        }
+    };
+    walk(snapshot, snapshot.entry);
+    return [...seen.values()];
+}

package/dist/host/native/module-syntax.d.ts

@@ -0,0 +1,8 @@
+export interface ModuleImportSyntax {
+    readonly imports: readonly string[];
+    readonly unresolved: readonly string[];
+}
+/** Syntax inventory is not an execution-closure certificate: unresolved expressions stay explicit. */
+export declare function moduleImportSyntax(source: string, coordinate: string): ModuleImportSyntax;
+/** Existing inventory keeps its meaning; callers requiring closure must inspect unresolved edges. */
+export declare function moduleImports(source: string, coordinate: string): readonly string[];

package/dist/host/native/module-syntax.js

@@ -0,0 +1,63 @@
+import { stringLiteral } from "../adapters/modules/javascript.js";
+import * as nodeModule from 'node:module';
+import { extname } from 'node:path';
+/** Host module syntax, never wire or domain interpretation. Reading imports executes no module. */
+// The package's minimum Node runtime provides this API; older build-only Node types do not.
+const require = nodeModule.createRequire(import.meta.url);
+const { parse } = require('acorn');
+const stripTypeScriptTypes = nodeModule.stripTypeScriptTypes;
+/** Syntax inventory is not an execution-closure certificate: unresolved expressions stay explicit. */
+export function moduleImportSyntax(source, coordinate) {
+    const code = extname(coordinate) === '.ts' ? stripTypeScriptTypes(source, { mode: 'transform' }) : source;
+    let tree;
+    try {
+        tree = parse(code, { ecmaVersion: 'latest', sourceType: 'module', allowReturnOutsideFunction: true, allowHashBang: true });
+    }
+    catch {
+        throw Error('REFUSE·source module syntax cannot be read: ' + coordinate);
+    }
+    const found = new Set(), unresolved = new Set();
+    const literal = stringLiteral;
+    const visit = (node, parent, key) => {
+        if (!node || typeof node !== 'object')
+            return;
+        if (Array.isArray(node)) {
+            for (const child of node)
+                visit(child, parent, key);
+            return;
+        }
+        const n = node;
+        // Escaped loader references do not become an empty inventory. This is
+        // conservative syntax, not a complete JavaScript alias/data-flow proof.
+        if (n['type'] === 'Identifier' && n['name'] === 'require') {
+            const direct = parent?.['type'] === 'CallExpression' && key === 'callee';
+            const namedProperty = (parent?.['type'] === 'MemberExpression' && key === 'property' && !parent['computed']) || ((parent?.['type'] === 'Property' || parent?.['type'] === 'MethodDefinition') && key === 'key' && !parent['computed'] && !parent['shorthand']);
+            if (!direct && !namedProperty)
+                unresolved.add('require reference at ' + String(n['start']));
+        }
+        let specifier;
+        if (n['type'] === 'ImportDeclaration' || n['type'] === 'ExportNamedDeclaration' || n['type'] === 'ExportAllDeclaration' || n['type'] === 'ImportExpression') {
+            specifier = literal(n['source']);
+            if (n['type'] === 'ImportExpression' && specifier === undefined)
+                unresolved.add('import expression at ' + String(n['start']));
+        }
+        if (n['type'] === 'CallExpression') {
+            const callee = n['callee'];
+            if (callee?.['type'] === 'Identifier' && callee['name'] === 'require') {
+                specifier = literal(n['arguments'][0]);
+                if (specifier === undefined)
+                    unresolved.add('require expression at ' + String(n['start']));
+            }
+        }
+        if (specifier !== undefined)
+            found.add(specifier);
+        for (const [childKey, child] of Object.entries(n))
+            visit(child, n, childKey);
+    };
+    visit(tree);
+    return { imports: [...found], unresolved: [...unresolved] };
+}
+/** Existing inventory keeps its meaning; callers requiring closure must inspect unresolved edges. */
+export function moduleImports(source, coordinate) {
+    return moduleImportSyntax(source, coordinate).imports;
+}

package/dist/host/native/native-binary.d.ts

@@ -0,0 +1,54 @@
+import { type RootStanding } from './reading.ts';
+import { type ParentExecution } from './generated.ts';
+interface NativeBinaryFields {
+    coordinate: string;
+    alias: string;
+    selector: {
+        port: string;
+        binding: string;
+        implementation: string;
+    };
+    entry: {
+        path: string;
+        digest: string;
+        bytes: number;
+    };
+    limits: {
+        bytes: number;
+    };
+    condition: string;
+}
+export type NativeBinaryProfile = NativeBinaryFields & ({
+    profile: 'host-native-binary@1';
+} | {
+    profile: 'host-native-binary-origin@1';
+    origin: string;
+});
+export interface NativeBinaryOrigin {
+    readonly coordinate: string;
+    readonly line: string;
+    readonly path: string;
+}
+/** A Root-selected local origin is a location constraint, not a World hint. */
+export declare function hostOriginPath(root: RootStanding, coordinate: string): NativeBinaryOrigin;
+export declare function nativeBinaryOrigin(root: RootStanding, p: NativeBinaryProfile, portLine: string): NativeBinaryOrigin | undefined;
+export interface VerifiedNativeBinary {
+    readonly identity: string;
+}
+export interface NativeBinaryProjection {
+    kind: 'native-binary';
+    alias: string;
+    entry: string;
+    entryDigest: string;
+    entryBytes: number;
+    condition: string;
+}
+/** Call under the existing Root guard; privateBinding is from the already
+ * prepared host image, never the candidate profile's own expected digest. */
+export declare function verifyNativeBinary(root: RootStanding, coordinate: string, parent: ParentExecution, privateBinding: {
+    coordinate: string;
+    path: string;
+    digest: string;
+}): VerifiedNativeBinary;
+export declare const nativeBinaryProjection: (handle: VerifiedNativeBinary) => NativeBinaryProjection;
+export {};

package/dist/host/native/native-binary.js

@@ -0,0 +1,115 @@
+import { retainedProjection } from "./reading.js";
+import { isSha256 } from "../hash.js";
+import { fieldNames } from "./reading.js";
+import { sha256 } from "../hash.js";
+/** Host-only native binary selection. No PATH lookup, Node impersonation,
+ * transitive OS-library seal or arbitrary-process sandbox is claimed. */
+import { createHash } from 'node:crypto';
+import { isAbsolute } from 'node:path';
+import { realpathSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { authorityAtEpoch } from '@lapxo/topos/wire';
+import { parsedLine as parse } from "../../fold/claims.js";
+import { authorityFor } from "../../fold/signers.js";
+import { authenticateSignedPort, nativeParentInputBytes, canonicalJson } from "./reading.js";
+import { readBounded } from "./generated.js";
+const sha = sha256, keys = fieldNames, validDigest = isSha256, fail = (why) => { throw Error('REFUSE·native binary ' + why); };
+/** A Root-selected local origin is a location constraint, not a World hint. */
+export function hostOriginPath(root, coordinate) {
+    if (!/^region\/[^\s]+$/.test(coordinate))
+        fail('origin is not a declared region');
+    const rows = root.live.filter(line => { const row = parse(line); return row.kind === 'fact' && row.value.fields.scope === coordinate && row.value.fields.measure === 'origin' && row.value.fields.value !== 'withdraw'; });
+    if (rows.length !== 1)
+        fail('missing/conflicting origin ' + coordinate);
+    const line = rows[0];
+    if (!root.history.includes(line))
+        fail('origin absent from authenticated history');
+    const row = parse(line);
+    if (row.kind !== 'fact')
+        return fail('origin not a wire record');
+    const f = row.value.fields;
+    if (f.role !== 'writes' || f.form !== 'alphabet')
+        fail('origin declaration meaning');
+    const auth = authorityFor(root.history, root.signer, root.eras), signed = auth.of(line);
+    if (signed.kind !== 'admitted' || signed.signer !== root.signer.id)
+        fail('origin must be Root signed');
+    const current = authorityAtEpoch(f, root.signer, root.epoch, coordinate, 'authority');
+    if (current.kind !== 'admitted')
+        fail('current origin authority ' + current.why);
+    let url, path;
+    try {
+        url = new URL(f.value);
+    }
+    catch {
+        return fail('origin URL invalid');
+    }
+    if (url.protocol !== 'file:' || url.username || url.password || url.search || url.hash || (url.hostname && url.hostname !== 'localhost'))
+        fail('unsupported origin transport');
+    try {
+        path = fileURLToPath(url);
+        if (!isAbsolute(path) || path.includes('\0'))
+            return fail('origin path invalid');
+        path = realpathSync(path);
+    }
+    catch {
+        return fail('local origin absent/invalid');
+    }
+    return Object.freeze({ coordinate, line, path });
+}
+export function nativeBinaryOrigin(root, p, portLine) {
+    if (p.profile !== 'host-native-binary-origin@1')
+        return;
+    const signed = authorityFor(root.history, root.signer, root.eras).of(portLine);
+    if (signed.kind !== 'admitted' || signed.signer !== root.signer.id)
+        fail('origin selection must be Root signed');
+    const origin = hostOriginPath(root, p.origin);
+    const bytes = readBounded(origin.path, p.entry.bytes);
+    if (bytes.byteLength !== p.entry.bytes || sha(bytes) !== p.entry.digest)
+        fail('origin bytes differ');
+    return origin;
+}
+const verified = new WeakMap();
+/** Call under the existing Root guard; privateBinding is from the already
+ * prepared host image, never the candidate profile's own expected digest. */
+export function verifyNativeBinary(root, coordinate, parent, privateBinding) {
+    const auth = authenticateSignedPort(root, coordinate), p = auth.profile;
+    if (!p || keys(p) !== (p.profile === 'host-native-binary-origin@1' ? 'alias,condition,coordinate,entry,limits,origin,profile,selector' : 'alias,condition,coordinate,entry,limits,profile,selector') || !['host-native-binary@1', 'host-native-binary-origin@1'].includes(p.profile) || p.coordinate !== coordinate || typeof p.alias !== 'string' || !p.alias.length || p.alias.includes('\0') || typeof p.condition !== 'string' || !p.condition.length)
+        fail('selection absent/unknown');
+    if (keys(p.selector ?? {}) !== 'binding,implementation,port' || canonicalJson(p.selector) !== canonicalJson({ port: parent.port, binding: parent.binding, implementation: parent.implementation }))
+        fail('selection differs from parent');
+    if (!validDigest(parent.identity) || !validDigest(parent.instrument) || !validDigest(parent.policy) || !validDigest(parent.authority) || !validDigest(parent.implementation) || !Array.isArray(parent.inputs))
+        fail('parent identity absent');
+    if (keys(p.entry ?? {}) !== 'bytes,digest,path' || typeof p.entry.path !== 'string' || isAbsolute(p.entry.path) || p.entry.path.split('/').some(s => !s || s === '.' || s === '..') || !validDigest(p.entry.digest) || !Number.isSafeInteger(p.entry.bytes) || p.entry.bytes < 1 || keys(p.limits ?? {}) !== 'bytes' || !Number.isSafeInteger(p.limits.bytes) || p.limits.bytes < 1 || p.entry.bytes > p.limits.bytes || p.limits.bytes > nativeParentInputBytes(root, parent))
+        fail('entry byte resource absent/outside Root');
+    if (!privateBinding || typeof privateBinding.path !== 'string' || !isAbsolute(privateBinding.path) || !validDigest(privateBinding.digest) || p.entry.path !== privateBinding.coordinate || p.entry.digest !== privateBinding.digest || !parent.inputs.some(([_, digest]) => digest === privateBinding.digest))
+        fail('private image binding absent/differs');
+    const origin = nativeBinaryOrigin(root, p, auth.line);
+    let expected, actual;
+    try {
+        expected = realpathSync(privateBinding.path);
+        actual = realpathSync(privateBinding.path);
+    }
+    catch {
+        return fail('entry absent');
+    }
+    if (expected !== actual)
+        fail('entry path differs from private image');
+    let runtimePath;
+    try {
+        runtimePath = realpathSync(parent.runtime);
+    }
+    catch {
+        return fail('runtime binding absent');
+    }
+    if (actual === runtimePath)
+        fail('binary aliases actual runtime');
+    if (origin && actual !== origin.path)
+        fail('entry differs from declared origin');
+    const bytes = readBounded(actual, p.entry.bytes);
+    if (bytes.byteLength !== p.entry.bytes || sha(bytes) !== privateBinding.digest)
+        fail('entry bytes differ');
+    const handle = Object.freeze({ identity: 'sha256:' + createHash('sha256').update(canonicalJson([auth.line, parent.identity, ...(origin ? [origin.line] : [])])).digest('hex') });
+    verified.set(handle, { kind: 'native-binary', alias: p.alias, entry: actual, entryDigest: privateBinding.digest, entryBytes: bytes.byteLength, condition: p.condition });
+    return handle;
+}
+export const nativeBinaryProjection = retainedProjection(verified, fail);

package/dist/host/native/native-program.d.ts

@@ -0,0 +1,56 @@
+import { type RootStanding } from './reading.ts';
+import { type ParentExecution } from './generated.ts';
+export interface NativeProgramProfile {
+    profile: 'host-native-program@1';
+    coordinate: string;
+    alias: string;
+    selector: {
+        port: string;
+        binding: string;
+        implementation: string;
+    };
+    interpreter: {
+        path: string;
+        digest: string;
+        bytes: number;
+    };
+    root: string;
+    entry: string;
+    members: readonly {
+        coordinate: string;
+        digest: string;
+        bytes: number;
+    }[];
+    limits: {
+        members: number;
+        bytes: number;
+    };
+    condition: string;
+}
+export interface VerifiedNativeProgram {
+    readonly identity: string;
+}
+export interface NativeProgramProjection {
+    alias: string;
+    interpreter: string;
+    interpreterDigest: string;
+    entry: string;
+    root: string;
+    members: readonly {
+        path: string;
+        digest: string;
+    }[];
+    condition: string;
+}
+export declare function verifyNativeProgram(root: RootStanding, coordinate: string, parent: ParentExecution, runtimeBinding: {
+    coordinate: string;
+    path: string;
+    digest: string;
+    members: readonly {
+        coordinate: string;
+        path: string;
+    }[];
+}): VerifiedNativeProgram;
+/** Only the guarded instrument can obtain this from a verified opaque handle.
+ * Put it in the signed native image; never accept it from a world proposal. */
+export declare const nativeProgramProjection: (handle: VerifiedNativeProgram) => NativeProgramProjection;