@lapxo/bound 0.1.8 → 0.2.0

package/dist/host/native/generated.js

@@ -0,0 +1,379 @@
+import { isSha256 } from "../hash.js";
+import { sha256 as sha } from "../hash.js";
+import { nodeLaunch } from "./node-launch.js";
+/** Content producer for a separately Root-authorized finite native program.
+ * Outputs are provenance, not grants. No arbitrary-JS confinement is claimed. */
+import { openSync, fstatSync, readSync, closeSync, realpathSync } from 'node:fs';
+import { resolve, dirname, isAbsolute } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { builtinModules, createRequire } from 'node:module';
+import { moduleImportSyntax } from "./module-syntax.js";
+import { authenticateSignedPort, canonicalJson } from "./reading.js";
+const fail = (why) => { throw Error('REFUSE·producer ' + why); };
+const digest = isSha256;
+const contexts = new WeakMap();
+function state(handle) { const s = contexts.get(handle); if (!s)
+    return fail('unknown Root context'); return s; }
+function charge(s, work, bytes = 0, members = 0) { if (s.work + work > s.profile.limits.work)
+    fail('work exhausted'); if (s.bytes + bytes > s.profile.limits.bytes)
+    fail('derived bytes exhausted'); if (s.members + members > s.profile.limits.members)
+    fail('derived members exhausted'); s.work += work; s.bytes += bytes; s.members += members; }
+/** Call inside the parent's real authority guard BEFORE emission/work. Signature
+ * and current eligibility are shared with the Root port constructor, unchanged. */
+export function createGeneratedProducer(root, coordinate, parent, implementationBytes) {
+    const auth = authenticateSignedPort(root, coordinate), profile = auth.profile;
+    if (!profile || Object.keys(profile).sort().join(',') !== 'coordinate,environmentNames,implementation,interpretations,limits,profile,selector' || profile.profile !== 'host-generated-executable@3' || profile.coordinate !== coordinate || Object.keys(profile.limits ?? {}).sort().join(',') !== 'argvBytes,argvItems,bytes,members,work' || Object.values(profile.limits).some(v => !Number.isSafeInteger(v) || v < 0))
+        fail('capability/budget absent or unknown');
+    if (!Array.isArray(profile.interpretations) || profile.interpretations.length > 3 || profile.interpretations.some(p => !['node-package-json@1', 'node-ambiguous-javascript@1', 'host-file-emission@1'].includes(p)) || new Set(profile.interpretations).size !== profile.interpretations.length)
+        fail('interpretation declaration absent/ambiguous');
+    if (!Array.isArray(profile.environmentNames) || profile.environmentNames.length > profile.limits.argvItems || profile.environmentNames.some(n => typeof n !== 'string' || !n.length || n.length > profile.limits.argvBytes || /[=*\0]/.test(n)) || new Set(profile.environmentNames).size !== profile.environmentNames.length || Buffer.byteLength(canonicalJson(profile.environmentNames)) > profile.limits.argvBytes)
+        fail('derived environment declaration absent/ambiguous/over budget');
+    if (Object.keys(profile.selector ?? {}).sort().join(',') !== 'binding,implementation,port' || canonicalJson(profile.selector) !== canonicalJson({ port: parent.port, binding: parent.binding, implementation: parent.implementation }))
+        fail('producer selector differs from parent');
+    if (!digest(parent.identity) || !digest(parent.instrument) || !digest(parent.policy) || !digest(parent.authority) || !digest(parent.implementation) || !isAbsolute(parent.cwd) || !isAbsolute(parent.runtime) || !Number.isSafeInteger(parent.timeoutMs) || parent.timeoutMs < 1 || !Number.isSafeInteger(parent.responseBytes) || parent.responseBytes < 1)
+        fail('parent context unknown');
+    if (!Array.isArray(parent.argv) || !Array.isArray(parent.inputs) || !Array.isArray(parent.environment) || [parent.argv, parent.inputs, parent.environment].some(a => a.length > root.budget.bytes))
+        fail('parent metadata budget');
+    if (profile.limits.bytes > parent.responseBytes || profile.limits.argvBytes > parent.responseBytes || implementationBytes.byteLength > root.budget.bytes)
+        fail('producer exceeds parent byte resource');
+    if (sha(implementationBytes) !== profile.implementation)
+        fail('producer implementation bytes differ');
+    if (parent.argv.length > profile.limits.argvItems || parent.argv.some(x => typeof x !== 'string' || x.length > profile.limits.argvBytes) || Buffer.byteLength(canonicalJson(parent.argv)) > profile.limits.argvBytes || parent.inputs.some(p => p.length !== 2 || typeof p[0] !== 'string' || !digest(p[1])) || new Set(parent.inputs.map(p => p[0])).size !== parent.inputs.length || parent.environment.some(p => p.length !== 2 || typeof p[0] !== 'string' || typeof p[1] !== 'string') || new Set(parent.environment.map(p => p[0])).size !== parent.environment.length)
+        fail('parent inputs/argv/environment differ');
+    const copy = JSON.parse(canonicalJson(parent)), handle = Object.freeze({ identity: sha(canonicalJson([auth.line, copy])) });
+    contexts.set(handle, { candidates: new Map(), emissionInvocations: new Map(), emissions: new Map(), emissionDigests: new Map(), profile, parent: copy, members: 0, bytes: 0, work: 0, recordBytes: 0, retained: new Map(), executableDigests: new Set(), paths: new Map(), records: new Map(), interpretations: new Map() });
+    return handle;
+}
+function checkedInvocation(s, input) { if (input && Array.isArray(input.environment)) {
+    const unknown = input.environment.filter(p => Array.isArray(p) && typeof p[0] === 'string' && !s.parent.environment.some(q => q[0] === p[0]) && !s.profile.environmentNames.includes(p[0])).map(p => p[0]);
+    if (unknown.length)
+        fail('descendant environment undeclared ' + unknown.slice(0, 16).join(','));
+} if (input?.runtime !== s.parent.runtime)
+    fail('descendant runtime differs'); if (!Number.isSafeInteger(input?.timeoutMs) || input.timeoutMs < 1 || input.timeoutMs > s.parent.timeoutMs)
+    fail('descendant time outside parent'); if (!Number.isSafeInteger(input?.responseBytes) || input.responseBytes < 1 || input.responseBytes > s.parent.responseBytes)
+    fail('descendant response bytes outside parent'); if (!input || typeof input.cwd !== 'string' || !Array.isArray(input.argv) || !Array.isArray(input.environment) || input.environment.length > s.profile.limits.argvItems || input.argv.some(x => typeof x !== 'string' || x.length > s.profile.limits.argvBytes) || input.environment.some(p => !Array.isArray(p) || p.length !== 2 || p.some(x => typeof x !== 'string' || x.length > s.profile.limits.argvBytes)) || !isAbsolute(input.cwd) || input.runtime !== s.parent.runtime || !Number.isSafeInteger(input.timeoutMs) || input.timeoutMs < 1 || input.timeoutMs > s.parent.timeoutMs || !Number.isSafeInteger(input.responseBytes) || input.responseBytes < 1 || input.responseBytes > s.parent.responseBytes || input.argv.length > s.profile.limits.argvItems || Buffer.byteLength(canonicalJson([input.argv, input.environment])) > s.profile.limits.argvBytes || input.argv.some(x => typeof x !== 'string') || input.environment.some(p => p.length !== 2 || typeof p[0] !== 'string' || typeof p[1] !== 'string') || new Set(input.environment.map(p => p[0])).size !== input.environment.length || input.environment.some(p => !s.parent.environment.some(q => q[0] === p[0]) && !s.profile.environmentNames.includes(p[0])))
+    fail('descendant invocation context missing/over budget'); return JSON.parse(canonicalJson(input)); }
+export function validateDescendantInvocation(handle, input) { return checkedInvocation(state(handle), input); }
+export function producerTransport(handle) { const s = state(handle); return Object.freeze({ coordinate: s.profile.coordinate, implementation: s.profile.implementation, identity: handle.identity, parent: s.parent.identity, timeoutMs: s.parent.timeoutMs, responseBytes: Math.min(s.parent.responseBytes, s.profile.limits.argvBytes), limits: { ...s.profile.limits }, interpretations: [...s.profile.interpretations] }); }
+function physical(path) { try {
+    return realpathSync(path);
+}
+catch {
+    return fail('member path absent ' + path);
+} }
+export function readBounded(path, limit) { let fd; try {
+    fd = openSync(path, 'r');
+}
+catch {
+    return fail('executable member absent ' + path);
+} try {
+    const stat = fstatSync(fd);
+    if (!stat.isFile() || stat.size > limit)
+        fail('member exceeds remaining bytes ' + path);
+    const bytes = Buffer.alloc(stat.size), tail = Buffer.alloc(1);
+    let got = 0;
+    while (got < bytes.length) {
+        const n = readSync(fd, bytes, got, bytes.length - got, got);
+        if (!n)
+            break;
+        got += n;
+    }
+    if (got !== bytes.length || readSync(fd, tail, 0, 1, bytes.length) !== 0)
+        fail('member changed during bounded read ' + path);
+    return bytes;
+}
+finally {
+    closeSync(fd);
+} }
+function remember(s, handle, body) { const serialized = canonicalJson([s.parent.identity, handle.identity, body]), identity = sha(serialized), held = s.records.get(identity); if (held)
+    return held; const size = Buffer.byteLength(serialized); if (size > s.parent.responseBytes - s.recordBytes)
+    fail('retained context bytes exhausted'); const record = { kind: 'derived-executable/1', parent: s.parent.identity, producer: handle.identity, ...body, identity: sha(serialized) }; s.recordBytes += size; s.records.set(record.identity, record); return Object.freeze(record); }
+export function assertProducerInterpretation(handle, name) { if (!state(handle).profile.interpretations.includes(name))
+    fail('interpretation not declared ' + name); }
+/** Read work is paid each time; retained code bytes and member count are paid
+ * once by digest. An alias earns no new origin and still needs actual rehash. */
+function retainedFile(s, path, executable) {
+    if (executable && s.members >= s.profile.limits.members && !s.executableDigests.size)
+        fail('derived members exhausted');
+    charge(s, 1);
+    const actual = physical(path), held = s.paths.get(actual), remaining = s.profile.limits.bytes - s.bytes;
+    // Before allocation, bound verification by an existing retained length or
+    // the remaining new-content allowance. No unknown-size/read fallback.
+    const maxRetained = Math.max(0, ...s.retained.values()), bytes = readBounded(actual, held?.bytes ?? Math.max(remaining, maxRetained)), digest = sha(bytes);
+    charge(s, 1);
+    if (held && (held.digest !== digest || held.bytes !== bytes.length))
+        fail('retained executable bytes differ ' + actual);
+    retainContent(s, digest, bytes.length, executable);
+    s.paths.set(actual, { digest, bytes: bytes.length });
+    return { actual, bytes, digest };
+}
+function retainContent(s, digest, bytes, executable) { const newBytes = s.retained.has(digest) ? 0 : bytes, newMember = executable && !s.executableDigests.has(digest) ? 1 : 0; charge(s, 0, newBytes, newMember); if (!s.retained.has(digest))
+    s.retained.set(digest, bytes); if (executable)
+    s.executableDigests.add(digest); }
+export function sealGeneratedFile(handle, path, mode, invocation, interpretation) { const s = state(handle); if (interpretation !== undefined) {
+    if (interpretation !== 'node-ambiguous-javascript@1')
+        fail('executable interpretation unknown');
+    assertProducerInterpretation(handle, interpretation);
+} if (!isAbsolute(path) || !['module', 'commonjs'].includes(mode))
+    fail('unknown executable file/mode'); const checked = checkedInvocation(s, invocation), held = retainedFile(s, path, true); return remember(s, handle, { target: { kind: 'file', path: held.actual }, mode, ...(interpretation ? { interpretation } : {}), invocation: checked, digest: held.digest, byteLength: held.bytes.byteLength }); }
+/** Preserve the four consumed native eval forms exactly; no rewriting/default
+ * flags/option blacklist. Prefix is the exact Root-selected inherited preload. */
+export function sealNativeEval(handle, actualArgv, rootPrefix, invocation) { const s = state(handle); const checked = checkedInvocation(s, invocation); charge(s, 1); if (actualArgv.length > s.profile.limits.argvItems || Buffer.byteLength(canonicalJson(actualArgv)) > s.profile.limits.argvBytes || actualArgv.some(x => typeof x !== 'string') || rootPrefix.some((x, i) => actualArgv[i] !== x))
+    fail('eval argv exceeds/changes Root binding'); const argv = actualArgv.slice(rootPrefix.length); const launch = nodeLaunch(argv); if (launch.kind !== 'eval' || launch.imports.length)
+    return fail('unsupported native eval argv/preload'); const mode = launch.mode, text = launch.text; if (Buffer.from(text, 'utf8').toString('utf8') !== text)
+    fail('eval text is not scalar UTF-8'); const bytes = Buffer.from(text, 'utf8'); charge(s, 1); retainContent(s, sha(bytes), bytes.length, true); return remember(s, handle, { target: { kind: 'eval', cwd: checked.cwd, argv: [...actualArgv], text }, mode, invocation: checked, digest: sha(bytes), byteLength: bytes.length }); }
+/** Interpretive data is provenance, never an executable or an authority grant.
+ * The finite interpretation is Root-signed before bounded IO/JSON work. */
+export function sealInterpretation(handle, path, interpretation, invocation) { const s = state(handle); if (!isAbsolute(path) || !s.profile.interpretations.includes(interpretation) || interpretation !== 'node-package-json@1')
+    fail('interpretation not declared'); const checked = checkedInvocation(s, invocation); charge(s, 1); const actual = physical(path), bytes = readBounded(actual, Math.max(s.profile.limits.bytes - s.bytes, ...s.retained.values(), 0)); charge(s, 1); const candidate = s.candidates.get(actual); if (candidate?.reason)
+    fail('required emission unmeasured ' + actual + ' ' + candidate.reason); if (candidate) {
+    if (candidate.digest !== sha(bytes))
+        fail('observed emission bytes differ ' + actual);
+    if (!s.emissionDigests.has(candidate.digest))
+        recordProducerEmissions(handle, [{ path: actual, digest: candidate.digest }], candidate.invocation);
+} let json; try {
+    json = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+}
+catch {
+    return fail('package interpretation JSON invalid');
+} if (!json || typeof json !== 'object' || Array.isArray(json) || ('type' in json && json.type !== 'module' && json.type !== 'commonjs'))
+    fail('package interpretation type invalid'); retainContent(s, sha(bytes), bytes.byteLength, false); const body = { path: actual, digest: sha(bytes), interpretation, invocation: checked, byteLength: bytes.byteLength }, serialized = canonicalJson([s.parent.identity, handle.identity, body]), identity = sha(serialized), held = s.interpretations.get(identity); if (held)
+    return held; const size = Buffer.byteLength(serialized); if (size > s.parent.responseBytes - s.recordBytes)
+    fail('retained context bytes exhausted'); const record = { kind: 'derived-interpretation/1', parent: s.parent.identity, producer: handle.identity, ...body, identity: sha(serialized) }; s.recordBytes += size; s.interpretations.set(record.identity, record); return Object.freeze(record); }
+/** Metadata from the fixed observer is only a candidate. No file is opened,
+ * no emission accepted, and no execution permission follows from registration. */
+export function registerProducerCandidates(handle, groups) {
+    const s = state(handle);
+    assertProducerInterpretation(handle, 'host-file-emission@1');
+    if (!Array.isArray(groups))
+        fail('candidate inventory absent');
+    const updates = new Map(), invocations = new Map();
+    let bytes = s.recordBytes, work = 0;
+    for (const group of groups) {
+        const call = checkedInvocation(s, group.invocation), text = canonicalJson(call), id = sha(text);
+        if (!Array.isArray(group.outputs))
+            fail('candidate outputs absent');
+        const existing = s.emissionInvocations.get(id) ?? invocations.get(id), invocation = existing ?? Object.freeze(call);
+        if (!existing) {
+            bytes += Buffer.byteLength(text);
+            invocations.set(id, invocation);
+        }
+        for (const o of group.outputs) {
+            if (!o || typeof o.path !== 'string' || !isAbsolute(o.path) || updates.has(o.path) || !((digest(o.digest) && o.reason === undefined) || (o.digest === undefined && typeof o.reason === 'string' && o.reason.length > 0)))
+                fail('candidate output absent/ambiguous');
+            const size = Buffer.byteLength(canonicalJson([o.path, o.digest ?? null, o.reason ?? null, id])), prior = s.candidates.get(o.path);
+            bytes += size - (prior?.size ?? 0);
+            updates.set(o.path, { path: o.path, ...(o.digest === undefined ? { reason: o.reason } : { digest: o.digest }), invocation, size });
+            work++;
+        }
+    }
+    if (bytes > s.parent.responseBytes)
+        fail('retained candidate bytes exhausted');
+    charge(s, work);
+    s.recordBytes = bytes;
+    for (const [id, call] of invocations)
+        s.emissionInvocations.set(id, call);
+    for (const [path, row] of updates)
+        s.candidates.set(path, row);
+}
+/** Root-selected write observer records output provenance, not execution
+ * authority. Bytes are bounded/rechecked by the same actual producer custody. */
+function emissionRecord(s, handle, actual, digest, byteLength, checked) {
+    const invocationText = canonicalJson(checked), invocationIdentity = sha(invocationText), existing = s.emissionInvocations.get(invocationIdentity), invocation = existing ?? Object.freeze(checked);
+    const body = { path: actual, digest, invocationIdentity, byteLength }, serialized = canonicalJson([s.parent.identity, handle.identity, body]), identity = sha(serialized), held = s.emissions.get(actual);
+    if (held?.identity === identity)
+        return held;
+    const size = Buffer.byteLength(serialized) + (existing ? 0 : Buffer.byteLength(invocationText));
+    if (size > s.parent.responseBytes - s.recordBytes)
+        fail('retained context bytes exhausted');
+    const record = Object.freeze({ kind: 'producer-emission/1', parent: s.parent.identity, producer: handle.identity, ...body, invocation, identity });
+    s.recordBytes += size;
+    if (!existing)
+        s.emissionInvocations.set(invocationIdentity, invocation);
+    s.emissions.set(actual, record);
+    s.emissionDigests.set(digest, record);
+    return record;
+}
+export function recordProducerEmission(handle, path, invocation) {
+    const s = state(handle);
+    assertProducerInterpretation(handle, 'host-file-emission@1');
+    if (!isAbsolute(path))
+        fail('emission path absent');
+    const checked = checkedInvocation(s, invocation);
+    charge(s, 1);
+    const actual = physical(path), bytes = readBounded(actual, s.parent.responseBytes), digest = sha(bytes);
+    charge(s, 1);
+    return emissionRecord(s, handle, actual, digest, bytes.length, checked);
+}
+/** All observed outputs must match before any provenance is accepted. One
+ * invocation context is committed once, with no code grant or quota widening. */
+export function recordProducerEmissions(handle, outputs, invocation) {
+    const s = state(handle);
+    assertProducerInterpretation(handle, 'host-file-emission@1');
+    const checked = checkedInvocation(s, invocation);
+    if (!Array.isArray(outputs) || !outputs.length || outputs.some(o => !o || typeof o.path !== 'string' || !isAbsolute(o.path) || !digest(o.digest)) || new Set(outputs.map(o => o.path)).size !== outputs.length)
+        fail('emission batch absent/ambiguous');
+    charge(s, 1 + outputs.length * 2);
+    const verified = outputs.map(o => { const path = physical(o.path), bytes = readBounded(path, s.parent.responseBytes); if (sha(bytes) !== o.digest)
+        fail('observed emission bytes differ ' + path); return { path, digest: o.digest, bytes: bytes.length }; });
+    if (new Set(verified.map(o => o.path)).size !== verified.length)
+        fail('emission batch physical coordinates ambiguous');
+    // Preflight total retained context resource; transaction has no partial green.
+    const invocationText = canonicalJson(checked), invocationIdentity = sha(invocationText);
+    let size = s.emissionInvocations.has(invocationIdentity) ? 0 : Buffer.byteLength(invocationText);
+    for (const o of verified) {
+        const body = { path: o.path, digest: o.digest, invocationIdentity, byteLength: o.bytes }, serialized = canonicalJson([s.parent.identity, handle.identity, body]);
+        if (s.emissions.get(o.path)?.identity !== sha(serialized))
+            size += Buffer.byteLength(serialized);
+    }
+    if (size > s.parent.responseBytes - s.recordBytes)
+        fail('retained context bytes exhausted');
+    const records = verified.map(o => emissionRecord(s, handle, o.path, o.digest, o.bytes, checked)), rows = records.map(({ path, digest, identity, byteLength }) => ({ path, digest, identity, byteLength })), body = { kind: 'producer-emission-batch/1', parent: s.parent.identity, producer: handle.identity, invocation: checked, invocationIdentity, outputs: rows };
+    return { ...body, identity: sha(canonicalJson(body)) };
+}
+/** Verify the ACTUAL body/argv again before execution. A record's existence
+ * alone authorizes nothing and cannot be moved to another parent context. */
+export function verifyDerived(handle, record, actual) { const s = state(handle); charge(s, 1); const held = s.records.get(record.identity); if (!held || canonicalJson(held) !== canonicalJson(record) || record.parent !== s.parent.identity || record.producer !== handle.identity)
+    fail('unknown/substituted derived context'); let bytes; if (record.target.kind === 'file') {
+    if (!actual.path || physical(actual.path) !== record.target.path)
+        fail('derived target route differs');
+    bytes = readBounded(record.target.path, record.byteLength);
+}
+else {
+    if (!actual.argv || canonicalJson(actual.argv) !== canonicalJson(record.target.argv))
+        fail('actual eval argv differs');
+    bytes = Buffer.from(record.target.text, 'utf8');
+} if (sha(bytes) !== record.digest || bytes.byteLength !== record.byteLength)
+    fail('derived executable bytes differ'); return bytes; }
+/** Literal closure against Root-sealed targets/libraries BEFORE entry. No
+ * resolver or verifier is selected by generated code. Unknown computed imports
+ * or escaped require remain named refusals, not an empty graph. Root's actual
+ * runtime hook must still verify its resolved target before handing it back. */
+/** The descriptor is fixed once per actual producer. Frozen descriptor metadata
+ * cannot silently change between entries; actual target bytes are never cached. */
+function snapshotIndex(s, snapshot, nativeImplementations) {
+    if (s.index) {
+        if (s.index.snapshot !== snapshot || nativeImplementations.size !== s.index.nativeImplementations.size || [...nativeImplementations].some(d => !s.index.nativeImplementations.has(d)))
+            fail('Root snapshot changed within producer');
+        return s.index;
+    }
+    if (!digest(snapshot.platform) || !Number.isSafeInteger(snapshot.budget?.members) || snapshot.budget.members < 1 || !Number.isSafeInteger(snapshot.budget.bytes) || snapshot.budget.bytes < 1 || snapshot.members.length > snapshot.budget.members || snapshot.libraries.length > snapshot.budget.members)
+        fail('literal snapshot budget/context absent');
+    const files = new Map(), digests = new Set();
+    for (const m of snapshot.members) {
+        charge(s, 1);
+        if (!digest(m.digest))
+            fail('Root member digest absent');
+        const path = physical(m.path);
+        if (files.has(path))
+            fail('ambiguous Root member');
+        files.set(path, m.digest);
+        digests.add(m.digest);
+        Object.freeze(m);
+    }
+    if ([...nativeImplementations].some(d => !digests.has(d)))
+        fail('native implementation outside authenticated snapshot');
+    const libs = new Map();
+    for (const l of snapshot.libraries) {
+        charge(s, 1);
+        if (libs.has(l.name))
+            fail('ambiguous Root library');
+        libs.set(l.name, l.manifest);
+        Object.freeze(l);
+    }
+    const native = new Set();
+    for (const n of snapshot.builtins) {
+        charge(s, 1);
+        native.add(n.startsWith('node:') ? n : 'node:' + n);
+    }
+    Object.freeze(snapshot.budget);
+    Object.freeze(snapshot.members);
+    Object.freeze(snapshot.libraries);
+    Object.freeze(snapshot.builtins);
+    Object.freeze(snapshot);
+    const index = { snapshot, files, digests, libs, native, nativeImplementations: new Set(nativeImplementations), closures: new Map() };
+    s.index = index;
+    return index;
+}
+export function gateDerived(handle, record, actual, snapshot, nativeImplementations = new Set()) {
+    const s = state(handle), bytes = verifyDerived(handle, record, actual), index = snapshotIndex(s, snapshot, nativeImplementations), { files, digests, libs, native } = index, edges = [], targets = new Map();
+    const path = record.target.kind === 'file' ? record.target.path : resolve(record.target.cwd, record.mode === 'module' ? '[eval1].js' : '[eval].cjs'), key = canonicalJson([record.digest, path, record.mode]), held = index.closures.get(key);
+    const readSizes = new Map();
+    let staticReadBytes = 0;
+    const verify = (path) => { const real = physical(path), expected = files.get(real); charge(s, 1); const remaining = snapshot.budget.bytes - staticReadBytes + (readSizes.get(real) ?? 0); const bytes = readBounded(real, remaining); if (!readSizes.has(real)) {
+        staticReadBytes += bytes.length;
+        readSizes.set(real, bytes.length);
+    } const actualDigest = sha(bytes); if (expected && actualDigest !== expected)
+        fail('Root target bytes differ ' + path); if (!expected && !digests.has(actualDigest)) {
+        let emitted = s.emissionDigests.get(actualDigest);
+        if (!emitted) {
+            const candidate = s.candidates.get(real);
+            if (candidate?.reason)
+                fail('required emission unmeasured ' + real + ' ' + candidate.reason);
+            if (candidate) {
+                if (candidate.digest !== actualDigest)
+                    fail('observed emission bytes differ ' + real);
+                recordProducerEmissions(handle, [{ path: real, digest: actualDigest }], candidate.invocation);
+                emitted = s.emissionDigests.get(actualDigest);
+            }
+        }
+        if (!emitted || emitted.parent !== s.parent.identity || emitted.producer !== handle.identity || emitted.byteLength !== bytes.length)
+            fail('literal target outside Root snapshot or producer emissions ' + path);
+        retainContent(s, actualDigest, bytes.length, !real.endsWith('.json'));
+    } targets.set(real, { path: real, digest: actualDigest, bytes: bytes.length }); return { real, bytes, digest: actualDigest }; };
+    if (held) {
+        for (const target of held.targets) {
+            const current = verify(target.path);
+            if (current.digest !== target.digest || current.bytes.length !== target.bytes)
+                fail('literal target bytes differ ' + target.path);
+        }
+        return held.edges.map(e => ({ ...e }));
+    }
+    edges.push(...traverseGeneratedClosure({ source: bytes, path, mode: record.mode, libs, native, platform: snapshot.platform, nativeImplementations, verify, step: () => charge(s, 1) }));
+    index.closures.set(key, { edges: edges.map(e => Object.freeze({ ...e })), targets: [...targets.values()].map(t => Object.freeze({ ...t })) });
+    return edges;
+}
+export function chargeProducerRequest(handle) { charge(state(handle), 1); }
+export function producerUsage(handle) { const s = state(handle); return Object.freeze({ members: s.members, bytes: s.bytes, work: s.work, retainedContents: s.retained.size, codeBytes: [...s.executableDigests].reduce((n, d) => n + (s.retained.get(d) ?? 0), 0), limits: { ...s.profile.limits } }); }
+/** Shared host traversal. The reader callback supplies verification; traversal
+ * itself introduces no provenance or execution authority. */
+export function traverseGeneratedClosure(input) {
+    const { libs, native, verify, nativeImplementations } = input, edges = [], seen = new Set();
+    const walk = (source, path, mode) => { if (seen.has(path))
+        return; seen.add(path); input.step(); const text = new TextDecoder('utf-8', { fatal: true }).decode(source), syntax = moduleImportSyntax(text, path); if (syntax.unresolved.length)
+        fail('literal closure unresolved ' + path + ' ' + syntax.unresolved.join(' · ')); for (const specifier of syntax.imports) {
+        const builtin = specifier.startsWith('node:') ? specifier : 'node:' + specifier;
+        if (builtinModules.includes(specifier) || specifier.startsWith('node:')) {
+            if (!native.has(builtin))
+                fail('native edge undeclared ' + specifier);
+            edges.push({ target: builtin, platform: input.platform });
+            continue;
+        }
+        let target;
+        if (specifier.startsWith('file:'))
+            target = fileURLToPath(specifier);
+        else if (isAbsolute(specifier))
+            target = specifier;
+        else if (specifier.startsWith('.'))
+            target = mode === 'commonjs' ? createRequire(path).resolve(specifier) : resolve(dirname(path), specifier);
+        else {
+            const name = specifier.startsWith('@') ? specifier.split('/').slice(0, 2).join('/') : specifier.split('/')[0], manifest = libs.get(name);
+            if (!manifest)
+                fail('literal library absent ' + name);
+            const pkg = verify(manifest);
+            const data = JSON.parse(Buffer.from(pkg.bytes).toString('utf8')), key = specifier === name ? '.' : './' + specifier.slice(name.length + 1), exported = typeof data.exports === 'string' && key === '.' ? data.exports : data.exports?.[key];
+            if (mode === 'commonjs')
+                target = createRequire(manifest).resolve(specifier);
+            else if (typeof exported === 'string')
+                target = resolve(dirname(manifest), exported);
+            else
+                return fail('ESM library export needs exact native selection ' + specifier);
+        }
+        const member = verify(target);
+        edges.push({ target: member.real, digest: member.digest });
+        if (!member.real.endsWith('.json') && !nativeImplementations.has(member.digest))
+            walk(member.bytes, member.real, mode);
+    } };
+    walk(input.source, input.path, input.mode);
+    return edges;
+}

package/dist/host/native/image.d.ts

@@ -0,0 +1,36 @@
+import type { Declaration } from './loader.ts';
+export interface LogicalMember {
+    readonly coordinate: string;
+    readonly digest: string;
+    readonly bytes: number;
+}
+export interface LogicalLoader {
+    readonly members: readonly LogicalMember[];
+    readonly libraries: readonly {
+        name: string;
+        manifest: string;
+    }[];
+    readonly builtins: readonly string[];
+    readonly entries: readonly string[];
+    readonly platform: string;
+}
+export interface ImageMount {
+    readonly coordinate: string;
+    readonly path: string;
+}
+export interface ImageBudget {
+    readonly members: number;
+    readonly bytes: number;
+}
+/** Identifies the admitted Node/OS ABI condition, not a seal of backing libraries
+ * or portability proof. The signed image must explicitly name this condition.
+ */
+export declare const nodePlatformIdentity: () => string;
+/** Mount only signed logical references at exact bytes. Physical locations are
+ * an execution envelope and never a source of implementation identity.
+ */
+export declare function mountNativeImage(loader: LogicalLoader, mounts: readonly ImageMount[], entry: string, budget: ImageBudget): {
+    identity: string;
+    declaration: Declaration;
+    entries: readonly string[];
+};

package/dist/host/native/image.js

@@ -0,0 +1,45 @@
+import { sha256 as digest } from "../hash.js";
+import { isAbsolute } from 'node:path';
+import { realpathSync } from 'node:fs';
+import { release } from 'node:os';
+import { readBoundedBatch } from "./bounded-file.js";
+const fail = (why) => { throw Error('REFUSE·native image ' + why); };
+const coordinate = (name) => typeof name === 'string' && name !== '' && !isAbsolute(name) && !name.includes('\0') && !name.includes('\\') && !name.split('/').some(step => !step || step === '.' || step === '..');
+/** Identifies the admitted Node/OS ABI condition, not a seal of backing libraries
+ * or portability proof. The signed image must explicitly name this condition.
+ */
+export const nodePlatformIdentity = () => digest(JSON.stringify(['node-abi/1', process.platform, process.arch, process.versions, release()]));
+/** Mount only signed logical references at exact bytes. Physical locations are
+ * an execution envelope and never a source of implementation identity.
+ */
+export function mountNativeImage(loader, mounts, entry, budget) {
+    if (!budget || !Number.isSafeInteger(budget.members) || budget.members < 1 || !Number.isSafeInteger(budget.bytes) || budget.bytes < 1)
+        fail('missing input resources');
+    if (!loader || !Array.isArray(loader.members) || !Array.isArray(loader.libraries) || !Array.isArray(loader.builtins) || !Array.isArray(loader.entries) || loader.members.length > budget.members || mounts.length !== loader.members.length || loader.libraries.length > budget.members || loader.builtins.length > budget.members || loader.entries.length > budget.members)
+        fail('input member resources');
+    if (loader.platform !== nodePlatformIdentity())
+        fail('declared Node platform differs');
+    const named = new Map();
+    let total = 0;
+    for (const member of loader.members) {
+        if (!member || !coordinate(member.coordinate) || named.has(member.coordinate) || !/^sha256:[0-9a-f]{64}$/.test(member.digest) || !Number.isSafeInteger(member.bytes) || member.bytes < 0 || (total += member.bytes) > budget.bytes)
+            fail('missing/duplicate/oversized member');
+        named.set(member.coordinate, member);
+    }
+    const paths = new Map();
+    for (const mount of mounts) {
+        if (!coordinate(mount.coordinate) || !named.has(mount.coordinate) || paths.has(mount.coordinate) || !isAbsolute(mount.path))
+            fail('unhanded or ambiguous mount');
+        paths.set(mount.coordinate, realpathSync(mount.path));
+    }
+    if (!coordinate(entry) || !loader.entries.includes(entry) || new Set(loader.entries).size !== loader.entries.length || loader.entries.some(e => !named.has(e)))
+        fail('entry outside signed image');
+    const data = readBoundedBatch(loader.members.map(m => ({ path: paths.get(m.coordinate), coordinate: m.coordinate })), budget.bytes);
+    loader.members.forEach((member, index) => { if (data[index].length !== member.bytes || digest(data[index]) !== member.digest)
+        fail('actual bytes differ ' + member.coordinate); });
+    const declarations = new Set();
+    const libraries = loader.libraries.map(lib => { if (!lib || typeof lib.name !== 'string' || declarations.has(lib.name) || !named.has(lib.manifest))
+        return fail('unknown or duplicate library'); declarations.add(lib.name); return { name: lib.name, manifest: paths.get(lib.manifest), coordinate: lib.manifest }; });
+    const identity = digest(JSON.stringify(['logical-native-image/1', loader]));
+    return { identity, declaration: { members: loader.members.map(m => ({ path: paths.get(m.coordinate), digest: m.digest, bytes: m.bytes })), libraries, builtins: [...loader.builtins], entry: paths.get(entry), platform: loader.platform }, entries: loader.entries.map(e => paths.get(e)) };
+}

package/dist/host/native/jobs.d.ts

@@ -0,0 +1,75 @@
+/** Pure prospective host handoff planner; no execution or authority discovery. */
+export interface Budget {
+    jobs: number;
+    members: number;
+    edges: number;
+    bytes: number;
+    payloadBytes: number;
+    env: number;
+}
+export interface Member {
+    coordinate: string;
+    digest: string;
+    bytes: Uint8Array;
+}
+export interface Load {
+    from: string;
+    kind: 'module' | 'worker' | 'program';
+    target: string | {
+        computed: string;
+    };
+}
+export interface Binding {
+    id: string;
+    kind: 'process' | 'worker';
+    places: readonly string[];
+    program: string;
+    interpreter?: string;
+    entry?: string;
+    args: readonly string[];
+    inputs: readonly string[];
+    environment: readonly (readonly [string, string])[];
+    limits: {
+        timeMs: number;
+        responseBytes: number;
+        slots: number;
+    };
+}
+/** Constructed by the instrument from admitted configuration and verified bytes,
+ * never accepted as a world packet or accompanied by a packet-selected verifier. */
+export interface Handoff {
+    place: string;
+    instrument: string;
+    policy: string;
+    authoritySnapshot: string;
+    budget: Budget;
+    members: readonly Member[];
+    loads: readonly Load[];
+    bindings: readonly Binding[];
+}
+export interface Proposal {
+    id: string;
+    payload: string;
+}
+export interface Launch {
+    id: string;
+    kind: Binding['kind'];
+    identity: string;
+    place: string;
+    program: readonly [string, string];
+    interpreter?: readonly [string, string];
+    entry?: readonly [string, string];
+    args: readonly string[];
+    payload: Uint8Array;
+    environment: readonly (readonly [string, string])[];
+    limits: Binding['limits'];
+    edges: readonly {
+        from: string;
+        kind: string;
+        target: string;
+        digest: string;
+    }[];
+}
+/** digest is selected by the instrument; it is a pure naming implementation,
+ * not a callback that answers whether untrusted bytes/authority are "verified". */
+export declare function planJobs(host: Handoff, framed: Uint8Array, digest: (bytes: Uint8Array) => string): readonly Launch[];