@lapxo/bound 0.1.8 → 0.2.0

package/dist/host/native/jobs.js

@@ -0,0 +1,148 @@
+import { encodeUTF8 } from "../io.js";
+const fail = (why) => { throw Error('REFUSE·job ' + why); };
+const utf8 = encodeUTF8;
+const by = (a, b) => { const x = utf8(a), y = utf8(b); for (let i = 0; i < Math.min(x.length, y.length); i++)
+    if (x[i] !== y[i])
+        return x[i] - y[i]; return x.length - y.length; };
+const text = (x) => typeof x === 'string' && x.length > 0;
+const positive = (x) => Number.isSafeInteger(x) && Number(x) > 0;
+function coordinate(s) { if (!text(s) || s.startsWith('/') || s.includes('\\') || s.split('/').some(p => p === '' || p === '.' || p === '..'))
+    fail('unknown member coordinate ' + String(s)); }
+function capped(s, max) { if (s.length > max || utf8(s).byteLength > max)
+    fail('byte budget'); }
+/** digest is selected by the instrument; it is a pure naming implementation,
+ * not a callback that answers whether untrusted bytes/authority are "verified". */
+export function planJobs(host, framed, digest) {
+    if (!host || !host.budget)
+        fail('missing admitted host handoff');
+    for (const key of ['jobs', 'members', 'edges', 'bytes', 'payloadBytes', 'env'])
+        if (!positive(host.budget[key]))
+            fail('missing resource ' + key);
+    const budget = host.budget;
+    if (!(framed instanceof Uint8Array) || framed.byteLength > budget.bytes)
+        fail('request byte budget');
+    if (typeof digest !== 'function')
+        fail('missing instrument digest');
+    if (!text(host.place) || !text(host.instrument) || !text(host.policy) || !text(host.authoritySnapshot))
+        fail('missing authority context');
+    for (const s of [host.place, host.instrument, host.policy, host.authoritySnapshot])
+        capped(s, budget.bytes);
+    if (!Array.isArray(host.members) || !Array.isArray(host.loads) || !Array.isArray(host.bindings) || host.members.length > budget.members || host.loads.length > budget.edges || host.bindings.length > budget.jobs)
+        fail('handoff count budget');
+    let total = framed.byteLength;
+    const charge = (s) => { capped(s, budget.bytes); total += Math.max(1, utf8(s).byteLength); if (total > budget.bytes)
+        fail('handoff byte budget'); };
+    for (const s of [host.place, host.instrument, host.policy, host.authoritySnapshot])
+        charge(s);
+    const members = new Map();
+    for (const m of host.members) {
+        if (!m || !(m.bytes instanceof Uint8Array))
+            fail('missing handed member');
+        coordinate(m.coordinate);
+        if (!text(m.digest))
+            fail('missing member digest ' + m.coordinate);
+        charge(m.coordinate);
+        charge(m.digest);
+        total += m.bytes.byteLength;
+        if (total > budget.bytes)
+            fail('member byte budget');
+        if (members.has(m.coordinate))
+            fail('duplicate handed member ' + m.coordinate);
+        members.set(m.coordinate, m);
+    }
+    const edges = new Map();
+    for (const e of host.loads) {
+        if (!e || !['module', 'worker', 'program'].includes(e.kind))
+            fail('unknown load kind');
+        coordinate(e.from);
+        if (typeof e.target !== 'string')
+            fail('unknown computed target ' + e.from);
+        coordinate(e.target);
+        charge(e.from);
+        charge(e.target);
+        if (!members.has(e.from) || !members.has(e.target))
+            fail('unhanded load ' + e.from + ' -> ' + e.target);
+        const key = e.from + '\u0000' + e.kind + '\u0000' + e.target;
+        if ((edges.get(e.from) ?? []).some(x => x.kind === e.kind && x.target === e.target))
+            fail('duplicate load ' + key);
+        edges.set(e.from, [...(edges.get(e.from) ?? []), e]);
+    }
+    let launchEdges = host.loads.length;
+    const bindings = new Map();
+    for (const b of host.bindings) {
+        if (!b || !text(b.id) || bindings.has(b.id))
+            fail('duplicate or missing job binding');
+        charge(b.id);
+        if (!['process', 'worker'].includes(b.kind) || (b.kind === 'worker' && !b.entry))
+            fail('unknown or incomplete execution kind ' + b.id);
+        if (!Array.isArray(b.places) || !Array.isArray(b.args) || !Array.isArray(b.inputs) || !Array.isArray(b.environment) || b.environment.length > budget.env || [b.places, b.args, b.inputs].some(x => Array.isArray(x) && x.length > budget.bytes))
+            fail('incomplete job binding ' + b.id);
+        if (new Set(b.places).size !== b.places.length || new Set(b.inputs).size !== b.inputs.length)
+            fail('duplicate binding coordinate ' + b.id);
+        for (const s of [...b.places, ...b.args, ...b.inputs]) {
+            if (typeof s !== 'string')
+                fail('nonliteral host argument ' + b.id);
+            charge(s);
+        }
+        for (const field of ['timeMs', 'responseBytes', 'slots'])
+            if (!b.limits || !positive(b.limits[field]))
+                fail('missing launch resource ' + b.id + '/' + field);
+        if (b.limits.slots > budget.jobs)
+            fail('launch slots exceed admitted jobs ' + b.id);
+        const env = new Set();
+        for (const pair of b.environment) {
+            if (!Array.isArray(pair) || pair.length !== 2 || !text(pair[0]) || typeof pair[1] !== 'string' || env.has(pair[0]))
+                fail('ambiguous environment ' + b.id);
+            env.add(pair[0]);
+            charge(pair[0]);
+            charge(pair[1]);
+        }
+        for (const c of [b.program, b.interpreter, b.entry, ...b.inputs].filter(x => x !== undefined)) {
+            coordinate(c);
+            if (!members.has(c))
+                fail('unhanded launch member ' + c);
+        }
+        launchEdges += [b.program, b.interpreter, b.entry, ...b.inputs].filter(x => x !== undefined).length;
+        if (launchEdges > budget.edges)
+            fail('launch edge budget');
+        bindings.set(b.id, b);
+    }
+    // All byte/count/declaration checks precede hashing or parsing world data.
+    let proposals;
+    try {
+        proposals = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(framed));
+    }
+    catch {
+        fail('malformed proposal frame');
+    }
+    if (!Array.isArray(proposals) || proposals.length > budget.jobs)
+        return fail('proposal count budget');
+    const ids = new Set(), jobs = [];
+    for (const p of proposals) {
+        if (!p || typeof p !== 'object' || Array.isArray(p) || Object.keys(p).some(k => k !== 'id' && k !== 'payload') || !text(p.id) || typeof p.payload !== 'string')
+            fail('world may propose only job id and data');
+        if (ids.has(p.id))
+            fail('duplicate proposed job ' + p.id);
+        ids.add(p.id);
+        capped(p.id, budget.bytes);
+        capped(p.payload, budget.payloadBytes);
+        const b = bindings.get(p.id);
+        if (!b)
+            return fail('unknown computed job target ' + p.id);
+        if (!b.places.includes(host.place))
+            fail('job not covered at place ' + host.place + ' ' + p.id);
+        jobs.push(p);
+    }
+    for (const m of members.values())
+        if (digest(m.bytes) !== m.digest)
+            fail('member digest differs ' + m.coordinate);
+    return jobs.map(p => { const b = bindings.get(p.id); const ref = (c) => [c, members.get(c).digest]; const seen = new Set(), closed = []; const visit = (c) => { if (seen.has(c))
+        return; seen.add(c); for (const e of edges.get(c) ?? []) {
+        const target = e.target;
+        closed.push({ from: c, kind: e.kind, target, digest: members.get(target).digest });
+        visit(target);
+    } }; for (const c of [b.program, b.interpreter, b.entry, ...b.inputs].filter(x => x !== undefined))
+        visit(c); closed.sort((a, b) => by(JSON.stringify(a), JSON.stringify(b))); for (const [kind, c] of [['launch', b.program], ['interpreter', b.interpreter], ['worker-entry', b.entry], ...b.inputs.map(c => ['input', c])])
+        if (c !== undefined)
+            closed.push({ from: 'job:' + p.id, kind: kind, target: c, digest: members.get(c).digest }); closed.sort((a, b) => by(JSON.stringify(a), JSON.stringify(b))); const environment = b.environment.map(p => [...p]).sort((a, b) => by(a[0], b[0])); const payload = utf8(p.payload), tuple = ['host-job-proposal', host.place, host.instrument, host.policy, host.authoritySnapshot, p.id, b.kind, ref(b.program), b.interpreter ? ref(b.interpreter) : null, b.entry ? ref(b.entry) : null, b.args, b.inputs.map(ref), environment, [b.limits.timeMs, b.limits.responseBytes, b.limits.slots], closed, digest(payload)]; return { id: p.id, kind: b.kind, identity: digest(utf8(JSON.stringify(tuple) + '\n')), place: host.place, program: ref(b.program), ...(b.interpreter ? { interpreter: ref(b.interpreter) } : {}), ...(b.entry ? { entry: ref(b.entry) } : {}), args: [...b.args], payload, environment, limits: { ...b.limits }, edges: closed }; });
+}

package/dist/host/native/loader.d.ts

@@ -0,0 +1,80 @@
+/** Node loader registration is an executable capability, not merely a builtin
+ * name. The fixed host retains its captured registration API; imported programs
+ * cannot insert a loader returning invented bytes ahead of its load boundary.
+ * This does not establish confinement against arbitrary privileged JavaScript.
+ */
+export declare function protectNativeLoaderRegistration(): void;
+export interface Member {
+    readonly path: string;
+    readonly digest: string;
+    readonly bytes: number;
+}
+export interface Library {
+    readonly name: string;
+    readonly manifest: string;
+    readonly coordinate?: string;
+}
+export interface Declaration {
+    readonly members: readonly Member[];
+    readonly libraries: readonly Library[];
+    readonly builtins: readonly string[];
+    readonly entry: string;
+    readonly platform: string;
+}
+/** Fixed preload only: expose comparison with the installed resolution, never
+ * hook registration or a verifier supplied by a reader. A different module's
+ * marker cannot replace this host's closed capability before entry. */
+export declare function installNativeResolutionReuse(declaration: Declaration): () => void;
+interface Context {
+    parentURL?: string;
+}
+interface Resolution {
+    url: string;
+}
+/** Resolution boundary for an instrument-selected native command. It checks
+ * actual target bytes before Node executes that target. Native commands remain
+ * privileged host implementations: this is not an arbitrary-JS sandbox and
+ * cannot prevent trusted code from replacing Node's hooks. That trust condition
+ * must be admitted separately; a world cannot claim it in a payload.
+ * Native ABI edges refer to the declared platform context, never a fictitious
+ * file digest. Completeness of the platform's backing images is not proved here.
+ */
+export declare function loadBoundary(declaration: Declaration): {
+    entry: string;
+    resolve(specifier: string, context: Context, next: (specifier: string, context: Context) => Resolution): Resolution;
+    load(url: string, context: {
+        format?: string;
+    }, next: (url: string, context: {
+        format?: string;
+    }) => {
+        format: string;
+        source?: string | Uint8Array | null;
+    }): {
+        format: string;
+        source?: string | Uint8Array | null;
+    };
+    assertClosed(): void;
+    edges: () => {
+        parent: string;
+        target: string;
+        digest?: string;
+        platform?: string;
+    }[];
+};
+/** Install before the entry of an instrument-selected privileged Node command.
+ * The bootstrap exception is restricted to this host function's exact selected
+ * entry. It is not a permission for a world to choose a verifier or a program.
+ * Hooks mediate imports; they do not establish a non-bypass JS sandbox.
+ */
+export declare function installBoundary(declaration: Declaration): {
+    loadEntry: () => Promise<any>;
+    assertClosed: () => void;
+    edges: () => {
+        parent: string;
+        target: string;
+        digest?: string;
+        platform?: string;
+    }[];
+    close: () => void;
+};
+export {};

package/dist/host/native/loader.js

@@ -0,0 +1,269 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { sha256 as digest } from "../hash.js";
+import { realpathSync } from 'node:fs';
+import { dirname, join, relative, isAbsolute, sep } from 'node:path';
+import { readBoundedFile } from "./bounded-file.js";
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import * as nodeModule from 'node:module';
+const { builtinModules } = nodeModule;
+const moduleApi = nodeModule.createRequire(import.meta.url)('node:module');
+const fixedRegisterHooks = moduleApi.registerHooks;
+let registrationProtected = false;
+/** Node loader registration is an executable capability, not merely a builtin
+ * name. The fixed host retains its captured registration API; imported programs
+ * cannot insert a loader returning invented bytes ahead of its load boundary.
+ * This does not establish confinement against arbitrary privileged JavaScript.
+ */
+export function protectNativeLoaderRegistration() {
+    if (registrationProtected)
+        return;
+    registrationProtected = true;
+    for (const name of ['registerHooks', 'register'])
+        if (typeof moduleApi[name] === 'function')
+            Object.defineProperty(moduleApi, name, { value: () => { throw Error('REFUSE·load runtime loader registration is not a fixed host capability'); }, writable: false, configurable: false });
+    nodeModule.syncBuiltinESMExports();
+}
+const resolutionKey = Symbol.for('bound.native.resolution@1');
+let resolutionCheck;
+let resolutionIdentity;
+let resolutionLibraryNames = Object.freeze([]);
+let resolutionLibraries = Object.freeze([]);
+const resolutionCapability = Object.freeze({ profile: 'fixed-native-resolution@1', get libraryNames() { return resolutionLibraryNames; }, get libraries() { return resolutionLibraries; }, assertPins(pins) {
+        if (!Array.isArray(pins))
+            throw Error('REFUSE·load pinned library request invalid');
+        if (!resolutionCheck)
+            throw Error('REFUSE·load no current fixed library resolution');
+        resolutionCheck(pins);
+    } });
+/** Fixed preload only: expose comparison with the installed resolution, never
+ * hook registration or a verifier supplied by a reader. A different module's
+ * marker cannot replace this host's closed capability before entry. */
+export function installNativeResolutionReuse(declaration) {
+    const prior = Object.getOwnPropertyDescriptor(globalThis, resolutionKey);
+    if (prior && prior.value !== resolutionCapability)
+        throw Error('REFUSE·load fixed resolution capability collision');
+    if (!prior)
+        Object.defineProperty(globalThis, resolutionKey, { value: resolutionCapability, writable: false, configurable: false });
+    const fail = (why) => { throw Error('REFUSE·load pinned library ' + why); };
+    const actual = (path, why) => { try {
+        return realpathSync(path);
+    }
+    catch {
+        return fail(why);
+    } };
+    const files = declaration.members.map(member => ({ ...member, path: realpathSync(member.path) }));
+    const libraries = new Map(declaration.libraries.map(library => [library.name, realpathSync(library.manifest)]));
+    const coordinates = new Map(declaration.libraries.map(library => [library.name, library.coordinate]));
+    if (libraries.size !== declaration.libraries.length)
+        fail('ambiguous declaration');
+    const namedCoordinates = new Set();
+    for (const coordinate of coordinates.values())
+        if (coordinate !== undefined) {
+            if (typeof coordinate !== 'string' || !coordinate || isAbsolute(coordinate) || coordinate.includes('\\') || coordinate.split('/').some(step => !step || step === '.' || step === '..') || namedCoordinates.has(coordinate))
+                fail('invalid/ambiguous logical library coordinate');
+            namedCoordinates.add(coordinate);
+        }
+    const order = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+    const identity = digest(Buffer.from(JSON.stringify([declaration.platform, files.map(member => [member.path, member.digest, member.bytes]).sort((a, b) => order(String(a[0]), String(b[0]))), [...libraries].sort(([a], [b]) => order(a, b)).map(([name, manifest]) => [name, manifest, coordinates.get(name) ?? null])])));
+    if (resolutionIdentity !== undefined) {
+        if (identity !== resolutionIdentity)
+            fail('late resolution replacement');
+        if (!resolutionCheck)
+            fail('fixed resolution already closed');
+        return () => { };
+    }
+    resolutionIdentity = identity;
+    resolutionLibraryNames = Object.freeze([...libraries.keys()].sort(order));
+    resolutionLibraries = Object.freeze([...libraries].sort(([a], [b]) => order(a, b)).map(([name, manifest]) => Object.freeze({ name, manifest, ...(coordinates.get(name) === undefined ? {} : { coordinate: coordinates.get(name) }) })));
+    const inside = (base, path) => { const step = relative(base, path); return step !== '' && !isAbsolute(step) && step !== '..' && !step.startsWith('..' + sep); };
+    const check = (pins) => {
+        const names = new Set();
+        for (const pin of pins) {
+            if (!pin || typeof pin.name !== 'string' || typeof pin.at !== 'string' || !pin.at || names.has(pin.name))
+                fail('invalid/duplicate selection');
+            names.add(pin.name);
+            const manifest = libraries.get(pin.name) ?? fail('not declared ' + pin.name);
+            const root = dirname(manifest), pinned = actual(pin.at, 'tree absent ' + pin.name), nested = [...libraries.values()].map(dirname).filter(other => inside(root, other));
+            const members = files.filter(member => inside(root, member.path) && !nested.some(other => inside(other, member.path)));
+            if (!members.some(member => member.path === manifest))
+                fail('manifest not sealed ' + pin.name);
+            const manifestMember = members.find(member => member.path === manifest);
+            let pkg;
+            try {
+                pkg = JSON.parse(readBoundedFile(manifest, manifestMember.bytes, manifest).toString('utf8'));
+            }
+            catch {
+                return fail('manifest unreadable ' + pin.name);
+            }
+            if (pkg?.name !== pin.name)
+                fail('manifest name differs ' + pin.name);
+            for (const member of members) {
+                if (!Number.isSafeInteger(member.bytes) || member.bytes < 0 || !/^sha256:[a-f0-9]{64}$/.test(member.digest))
+                    fail('member resource invalid ' + pin.name);
+                const target = actual(join(pinned, relative(root, member.path)), 'member absent ' + pin.name + '/' + relative(root, member.path));
+                if (!inside(pinned, target))
+                    fail('target leaves pinned tree ' + pin.name);
+                if (digest(readBoundedFile(member.path, member.bytes, member.path)) !== member.digest || digest(readBoundedFile(target, member.bytes, target)) !== member.digest)
+                    fail('member differs ' + pin.name + '/' + relative(root, member.path));
+            }
+        }
+    };
+    resolutionCheck = check;
+    return () => { resolutionCheck = undefined; };
+}
+/** Resolution boundary for an instrument-selected native command. It checks
+ * actual target bytes before Node executes that target. Native commands remain
+ * privileged host implementations: this is not an arbitrary-JS sandbox and
+ * cannot prevent trusted code from replacing Node's hooks. That trust condition
+ * must be admitted separately; a world cannot claim it in a payload.
+ * Native ABI edges refer to the declared platform context, never a fictitious
+ * file digest. Completeness of the platform's backing images is not proved here.
+ */
+export function loadBoundary(declaration) {
+    const files = new Map(), libraries = new Map(), native = new Set(), edges = [];
+    let refused;
+    const fail = (why) => { refused ?? (refused = 'REFUSE·load ' + why); throw Error(refused); };
+    const verify = (url) => { let path; try {
+        path = realpathSync(fileURLToPath(url));
+    }
+    catch {
+        return fail('target absent ' + url);
+    } const expected = files.get(path); if (!expected)
+        return fail('target undeclared ' + url); if (digest(readBoundedFile(path, expected.bytes, path)) !== expected.digest)
+        return fail('target bytes differ ' + url); return expected.digest; };
+    for (const member of declaration.members) {
+        let path;
+        try {
+            path = realpathSync(member.path);
+        }
+        catch {
+            return fail('member absent ' + member.path);
+        }
+        if (files.has(path) || !Number.isSafeInteger(member.bytes) || member.bytes < 0 || !/^sha256:[0-9a-f]{64}$/.test(member.digest))
+            return fail('member ambiguous ' + member.path);
+        files.set(path, { ...member, path });
+    }
+    for (const member of declaration.members)
+        verify(pathToFileURL(member.path).href);
+    for (const lib of declaration.libraries) {
+        if (!/^(?:@[A-Za-z0-9_.-]+\/)?[A-Za-z0-9_.-]+$/.test(lib.name) || libraries.has(lib.name))
+            return fail('library ambiguous ' + lib.name);
+        const url = pathToFileURL(lib.manifest).href;
+        verify(url);
+        let pkg;
+        try {
+            pkg = JSON.parse(readBoundedFile(lib.manifest, files.get(realpathSync(lib.manifest)).bytes, lib.name).toString('utf8'));
+        }
+        catch {
+            return fail('library manifest invalid ' + lib.name);
+        }
+        if (!pkg || Array.isArray(pkg) || pkg.name !== lib.name)
+            return fail('library name differs ' + lib.name);
+        libraries.set(lib.name, { url, pkg });
+    }
+    for (const name of declaration.builtins) {
+        const normalized = name.startsWith('node:') ? name : 'node:' + name;
+        if (native.has(normalized) || (!builtinModules.includes(normalized) && !builtinModules.includes(normalized.slice(5))))
+            return fail('native ABI ambiguous ' + name);
+        native.add(normalized);
+    }
+    if (!/^sha256:[0-9a-f]{64}$/.test(declaration.platform))
+        return fail('declared platform identity absent');
+    const entry = pathToFileURL(declaration.entry).href;
+    verify(entry);
+    return {
+        entry,
+        resolve(specifier, context, next) {
+            if (refused)
+                throw Error(refused);
+            if (context.parentURL)
+                verify(context.parentURL);
+            const builtin = specifier.startsWith('node:') ? specifier : 'node:' + specifier;
+            if (builtinModules.includes(specifier) || specifier.startsWith('node:')) {
+                if (!native.has(builtin))
+                    return fail('native ABI undeclared ' + specifier);
+                edges.push({ parent: context.parentURL ?? entry, target: builtin, platform: declaration.platform });
+                let resolved;
+                try {
+                    resolved = next(builtin, context);
+                }
+                catch {
+                    return fail('native target unresolved ' + builtin);
+                }
+                if (resolved.url !== builtin)
+                    return fail('native target differs ' + builtin);
+                return resolved;
+            }
+            let selected = context, target = specifier;
+            if (!specifier.startsWith('.') && !specifier.startsWith('/') && !specifier.includes(':')) {
+                const name = specifier.startsWith('@') ? specifier.split('/').slice(0, 2).join('/') : specifier.split('/')[0];
+                const library = libraries.get(name);
+                if (!library)
+                    return fail('library undeclared ' + name);
+                selected = { ...context, parentURL: library.url };
+                if (library.pkg.exports === undefined) {
+                    const subpath = specifier.slice(name.length);
+                    const main = subpath ? subpath.slice(1) : library.pkg.main;
+                    if (typeof main !== 'string' || !main || main.startsWith('/') || main.includes('\\') || main.split('/').includes('..'))
+                        return fail('library target undeclared ' + specifier);
+                    target = main.startsWith('./') ? main : './' + main;
+                }
+            }
+            // Node supplies package/relative resolution semantics. There is no fallback
+            // permission: its result still has to be an exact host-sealed member.
+            let resolved;
+            try {
+                resolved = next(target, selected);
+            }
+            catch {
+                return fail('target unresolved ' + specifier);
+            }
+            if (!resolved.url.startsWith('file:'))
+                return fail('target scheme undeclared ' + resolved.url);
+            const seal = verify(resolved.url);
+            edges.push({ parent: context.parentURL ?? entry, target: resolved.url, digest: seal });
+            return resolved;
+        },
+        load(url, context, next) {
+            if (url.startsWith('node:'))
+                return next(url, context);
+            verify(url);
+            const path = realpathSync(fileURLToPath(url)), member = files.get(path);
+            const loaded = next(url, context);
+            if (loaded.source === undefined || loaded.source === null)
+                return fail('file loader did not expose executable bytes ' + url);
+            const bytes = typeof loaded.source === 'string' ? Buffer.from(loaded.source, 'utf8') : loaded.source;
+            if (bytes.byteLength > member.bytes || digest(bytes) !== member.digest)
+                return fail('actual loaded source differs ' + url);
+            return loaded;
+        },
+        assertClosed() { if (refused)
+            throw Error(refused); for (const member of declaration.members)
+            verify(pathToFileURL(member.path).href); },
+        edges: () => edges.map(edge => ({ ...edge })),
+    };
+}
+/** Install before the entry of an instrument-selected privileged Node command.
+ * The bootstrap exception is restricted to this host function's exact selected
+ * entry. It is not a permission for a world to choose a verifier or a program.
+ * Hooks mediate imports; they do not establish a non-bypass JS sandbox.
+ */
+export function installBoundary(declaration) {
+    const boundary = loadBoundary(declaration);
+    const register = fixedRegisterHooks;
+    if (typeof register !== 'function')
+        throw Error('REFUSE·load native hook profile unsupported by runtime');
+    protectNativeLoaderRegistration();
+    const hooks = register({ resolve(specifier, context, next) {
+            const boot = context.parentURL === import.meta.url && specifier === boundary.entry;
+            return boundary.resolve(specifier, boot ? { ...context, parentURL: undefined } : context, next);
+        }, load: boundary.load });
+    return { loadEntry: () => import(__rewriteRelativeImportExtension(boundary.entry)), assertClosed: boundary.assertClosed, edges: boundary.edges, close: () => hooks.deregister() };
+}

package/dist/host/native/materialize.d.ts

@@ -0,0 +1,22 @@
+import { type NativeRoute } from './route.ts';
+import type { ReadingReference } from '../reading-context.ts';
+export interface NativeMaterialization {
+    readonly archive: string;
+    readonly cwd: string;
+    readonly mountIdentity: string;
+    readonly locations: readonly {
+        member: string;
+        path: string;
+        kind: 'module' | 'data' | 'binary';
+    }[];
+}
+/** Called under the actual Root lease before identity/cache preparation. Missing
+ * laid content is a named content demand, never a publisher authority fallback.
+ * One retained mount per immutable selection avoids copying it on each ask.
+ */
+export declare function materializeNativeRoute(route: NativeRoute): NativeMaterialization;
+/** Fixed child, lifetime supervisor and transitive host modules enter identity
+ * before the cache key. Existing instrument closure resolves actual dependencies;
+ * this descriptor never executes a module and never accepts a world verifier.
+ */
+export declare function nativeExecutorInputs(route: NativeRoute): readonly ReadingReference[];