@lapxo/bound 0.2.4 → 0.2.6

package/dist/host/native/descendants.js

@@ -1,528 +1 @@
-import { sha256 } from "../hash.js";
-/** Fixed Root native preload. One parent custodian holds generated provenance
- * and counters. Original child APIs execute actual programs; nothing synthesizes
- * their results. This privileged native profile is not an adversarial sandbox. */
-import nativeChildProcess from 'node:child_process';
-import fs from 'node:fs';
-import { traverseGeneratedClosure } from "./generated.js";
-import nativeWorkerThreads from 'node:worker_threads';
-import { realpathSync, existsSync, statSync } from 'node:fs';
-import { resolve, dirname, extname } from 'node:path';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import * as nativeModule from "node:module";
-import { syncBuiltinESMExports, builtinModules } from 'node:module';
-import { nodeLaunch, projectNativeProgramLaunch, selectNativeProgramParent, nativeEvalParent, actualNodeEvalOptions } from "./node-launch.js";
-import { readBoundedFile } from "./bounded-file.js";
-import { createFixedControlBridge } from "./control-bridge.js";
-import { installNativeResolutionReuse } from "./loader.js";
-const childProcess = nativeChildProcess, workerThreads = nativeWorkerThreads;
-const registerHooks = nativeModule.registerHooks;
-export function installDescendantBoundary(config) {
-    const sha = sha256, originalSync = childProcess.spawnSync;
-    let red, transport, reporting = false;
-    const fail = (why) => {
-        red ?? (red = 'REFUSE·native descendant ' + why);
-        if (transport && !reporting) {
-            reporting = true;
-            try {
-                transport({ operation: 'violation', token: endpoint.token, why: red });
-            }
-            catch { }
-            finally {
-                reporting = false;
-            }
-        }
-        throw Error(red);
-    };
-    const { contextFile, client, runtime, preload, runtimeDigest, clientDigest } = config.custodian ?? {};
-    let execution;
-    try {
-        execution = JSON.parse(readBoundedFile(contextFile, config.contextBytes, contextFile).toString('utf8'));
-    }
-    catch {
-        fail('Root execution custody absent');
-    }
-    const { endpoint, parentExecution } = execution;
-    const programs = execution.programs ?? [];
-    if (!parentExecution?.identity || endpoint?.parent !== parentExecution.identity)
-        fail('Root custody parent differs');
-    if (!endpoint || !runtime || !preload || !client || sha(readBoundedFile(runtime, config.runtimeBytes, runtime)) !== runtimeDigest || sha(readBoundedFile(client, config.clientBytes, client)) !== clientDigest)
-        fail('Root custodian binding absent/different');
-    // File validity is checked only at an actual disk-execution boundary, never cached.
-    const runtimeForExecution = (path, why) => {
-        let valid = false;
-        try {
-            valid = realpathSync(path) === realpathSync(runtime) && sha(readBoundedFile(path, config.runtimeBytes, path)) === runtimeDigest;
-        }
-        catch {
-            return fail(why);
-        }
-        if (!valid)
-            fail(why);
-    };
-    const known = new Map(config.members.map((m) => [realpathSync(m.path), m.digest])), executableDigests = new Set(config.executableDigests ?? []), metadataDigests = new Set(config.metadataDigests ?? config.members.filter((m) => m.path.endsWith('.json')).map((m) => m.digest)), native = new Set(config.builtins.map((n) => n.startsWith('node:') ? n : 'node:' + n)), library = new Map(config.libraries.map((l) => [l.name, l]));
-    // Reuse this fixed resolver only after comparing every required library
-    // member with the instrument's pins. The inherited input resource also
-    // bounds metadata prepared for that comparison; no world supplies a checker.
-    let resolutionBytes = 0;
-    const resolutionMembers = config.members.map((member) => { const path = realpathSync(member.path), stat = statSync(path); if (!stat.isFile() || !Number.isSafeInteger(config.inputBytes) || config.inputBytes < 1 || (resolutionBytes += stat.size) > config.inputBytes)
-        fail('fixed library resolution resource exceeded'); return { path, digest: member.digest, bytes: stat.size }; });
-    installNativeResolutionReuse({ members: resolutionMembers, libraries: config.libraries, builtins: config.builtins, entry: resolutionMembers[0]?.path ?? '', platform: config.platform });
-    let controlBridge;
-    if (config.control && config.control.realm !== 'main-thread')
-        fail('unknown Root control realm');
-    // The signed host profile selects retention only in the actual main realm.
-    // WorldWorker realms keep the same bounded fixed-client/checks, not a SAB verifier.
-    if (config.control && nativeWorkerThreads.isMainThread) {
-        const c = config.control;
-        controlBridge = createFixedControlBridge({ endpoint, workerBytes: readBoundedFile(c.worker.path, c.worker.bytes, c.worker.coordinate), worker: c.worker, runtime: { path: runtime, digest: runtimeDigest, bytes: config.runtimeBytes }, resources: c.resources, deadlineMs: endpoint.deadlineMs });
-        process.once('exit', () => { void controlBridge?.close(); });
-        process.once('beforeExit', () => { void controlBridge?.close(); });
-    }
-    const exchange = (body) => {
-        const frame = JSON.stringify({ protocol: 'command-lot/1', coordinate: endpoint.coordinate, implementation: endpoint.implementation, identity: endpoint.identity, requests: [JSON.stringify(body)] });
-        if (Buffer.byteLength(frame) > endpoint.responseBytes)
-            fail('custodian request bytes');
-        let stdout;
-        if (controlBridge) {
-            try {
-                stdout = controlBridge.exchange(frame);
-            }
-            catch (error) {
-                void controlBridge.close();
-                return fail(error instanceof Error ? error.message : String(error));
-            }
-        }
-        else {
-            // This branch executes disk bytes now; retention never stands in for this check.
-            runtimeForExecution(runtime, 'Root sync bridge runtime bytes differ');
-            let clientValid = false;
-            try {
-                clientValid = sha(readBoundedFile(client, config.clientBytes, client)) === clientDigest;
-            }
-            catch { /* A missing or oversized executable is a refusal too. */ }
-            if (!clientValid)
-                fail('Root sync bridge bytes differ');
-            const got = Reflect.apply(originalSync, childProcess, [runtime, [client, String(config.contextBytes)], { input: JSON.stringify({ endpoint, frame }), encoding: 'utf8', timeout: endpoint.timeoutMs, maxBuffer: endpoint.responseBytes, env: { ...process.env }, shell: false }]);
-            if (got.error || got.signal || got.status !== 0 || got.stderr)
-                fail('custodian client interrupted/refused ' + (got.error?.message ?? got.stderr ?? got.signal ?? got.status));
-            stdout = got.stdout;
-        }
-        let reply;
-        try {
-            reply = JSON.parse(stdout);
-        }
-        catch {
-            return fail('custodian response malformed');
-        }
-        if (reply.protocol !== 'command-lot/1' || reply.coordinate !== endpoint.coordinate || reply.implementation !== endpoint.implementation || reply.identity !== endpoint.identity || !Array.isArray(reply.responses) || reply.responses.length !== 1)
-            fail('custodian response identity/count');
-        return reply.responses[0];
-    };
-    transport = exchange;
-    const verifiedEdges = new Map();
-    let candidateHandoff = () => [], candidateHanded = ignoreEmission;
-    const request = (entry, operation = 'entry') => {
-        if (red)
-            throw Error(red);
-        const candidates = operation === 'entry' ? candidateHandoff() : [];
-        const one = exchange({ operation, token: endpoint.token, request: candidates.length ? { ...entry, candidates } : entry });
-        if (one.kind === 'refuse')
-            fail(one.why);
-        if (one.kind !== 'entry-context' || !one.context?.identity)
-            fail('custodian context absent');
-        if (one.context.parent !== parentExecution.identity || one.context.producer !== endpoint.identity)
-            fail('custodian context parent differs');
-        candidateHanded(candidates);
-        if (operation === 'entry' && Array.isArray(one.context.edges)) {
-            for (const edge of one.context.edges) {
-                if (typeof edge.target === 'string' && edge.target.startsWith('/') && /^sha256:[0-9a-f]{64}$/.test(edge.digest ?? '')) {
-                    const prior = verifiedEdges.get(edge.target);
-                    if (prior && prior !== edge.digest)
-                        fail('verified edge bytes changed ' + edge.target);
-                    verifiedEdges.set(edge.target, edge.digest);
-                }
-            }
-        }
-        return one.context;
-    };
-    const invocation = (args, cwd, env, options = {}) => ({ cwd: realpathSync(resolve(cwd ?? process.cwd())), argv: [...args], environment: Object.entries(env ?? process.env).sort(), runtime, timeoutMs: Math.min(options.timeout ?? endpoint.timeoutMs, endpoint.timeoutMs), responseBytes: Math.min(options.maxBuffer ?? endpoint.responseBytes, endpoint.responseBytes) });
-    let evalParent;
-    const actualEval = nativeWorkerThreads.isMainThread && actualNodeEvalOptions(process.execArgv);
-    if (actualEval) {
-        if (realpathSync(process.execPath) !== realpathSync(runtime))
-            fail('actual eval runtime differs from Root selection');
-        const actual = { argv: [...process.execArgv, ...process.argv.slice(1)], rootPrefix: ['--import', preload], cwd: process.cwd(), environment: Object.entries(process.env).sort(), runtime };
-        const retained = request(actual, 'eval-context');
-        evalParent = nativeEvalParent(retained, actual);
-    }
-    let flushEmissions = ignoreEmission;
-    let flushExecutable = ignoreEmission;
-    const interpretedMetadata = new Map();
-    const modeOf = (path, call) => {
-        const ext = extname(path);
-        if (ext === '.mjs' || ext === '.mts')
-            return 'module';
-        if (ext === '.cjs' || ext === '.cts')
-            return 'commonjs';
-        if (ext !== '' && ext !== '.js' && ext !== '.ts')
-            fail('executable extension unsupported ' + ext);
-        let directory = dirname(path);
-        for (;;) {
-            const manifest = resolve(directory, 'package.json');
-            if (existsSync(manifest)) {
-                flushEmissions([realpathSync(manifest)]);
-                if (statSync(manifest).size > (config.inputBytes ?? endpoint.responseBytes))
-                    fail('package interpretation bytes');
-                const raw = readBoundedFile(manifest, config.inputBytes, manifest);
-                const digest = sha(raw);
-                if (!metadataDigests.has(digest)) {
-                    const key = JSON.stringify([manifest, digest, call]);
-                    if (!interpretedMetadata.has(key)) {
-                        const held = request({ path: manifest, interpretation: 'node-package-json@1', invocation: call }, 'interpretation');
-                        if (held.kind !== 'derived-interpretation/1' || held.path !== realpathSync(manifest) || held.digest !== digest || held.interpretation !== 'node-package-json@1' || sha(readBoundedFile(manifest, config.inputBytes, manifest)) !== digest)
-                            fail('package interpretation changed after custody');
-                        interpretedMetadata.set(key, held.identity);
-                    }
-                }
-                let pkg;
-                try {
-                    pkg = JSON.parse(raw.toString('utf8'));
-                }
-                catch {
-                    fail('package interpretation invalid');
-                }
-                if (pkg.type === undefined || pkg.type === 'commonjs')
-                    return 'commonjs';
-                if (pkg.type === 'module')
-                    return 'module';
-                fail('package interpretation type unknown');
-            }
-            const parent = dirname(directory);
-            if (parent === directory)
-                return 'commonjs';
-            directory = parent;
-        }
-    };
-    const sealFile = (path, call, forceCustody = false, loaded = undefined) => {
-        let actual;
-        try {
-            actual = realpathSync(path);
-        }
-        catch {
-            return fail('executable target absent ' + path);
-        }
-        flushEmissions([actual]);
-        const expected = known.get(actual);
-        if (statSync(actual).size > (config.inputBytes ?? endpoint.responseBytes))
-            fail('input bytes before hash');
-        const bytes = readBoundedFile(actual, config.inputBytes, actual), digest = sha(bytes);
-        if (actual.endsWith('.json')) {
-            if (forceCustody)
-                fail('JSON executable entry unsupported');
-            if (!metadataDigests.has(digest))
-                fail('JSON interpretation not Root-selected ' + actual);
-            return actual;
-        }
-        if (expected && digest !== expected)
-            fail('retained target bytes differ ' + actual);
-        const priorEdge = verifiedEdges.get(actual);
-        if (priorEdge && digest !== priorEdge)
-            fail('verified edge bytes differ ' + actual);
-        if (!forceCustody && priorEdge === digest && !(extname(actual) === '' && !loaded))
-            return actual;
-        if (extname(actual) === '' && !loaded)
-            return actual;
-        if (!forceCustody && !loaded && (executableDigests.has(digest) || (expected && extname(actual) === '.json')))
-            return actual;
-        const selectedMode = loaded?.format ?? modeOf(actual, call);
-        flushExecutable(actual, selectedMode, bytes);
-        const context = request({ kind: 'file', path: actual, mode: selectedMode, ...(loaded ? { interpretation: 'node-ambiguous-javascript@1' } : {}), invocation: call });
-        if (context.path !== actual && context.target?.path !== actual)
-            fail('custodian target changed');
-        if (context.digest !== sha(readBoundedFile(actual, config.inputBytes, actual)))
-            fail('derived target changed after seal');
-        return actual;
-    };
-    const prepare = (program, args, options = {}) => {
-        if (red)
-            throw Error(red);
-        if (options.shell)
-            fail('shell target undeclared');
-        let command = program;
-        const native = programs.filter((p) => p.alias === program && p.kind === 'native-binary');
-        if (native.length) {
-            if (native.length !== 1)
-                fail('native binary alias ambiguous');
-            const selected = native[0], call = invocation(args, options.cwd, options.env, options), held = request({ alias: program, path: selected.entry, invocation: call }, 'native-program');
-            if (held.kind !== 'native-program-transaction/1' || held.target !== selected.entry || held.digest !== selected.entryDigest || sha(readBoundedFile(selected.entry, selected.entryBytes, selected.entry)) !== held.digest)
-                fail('native binary changed before entry');
-            return { command: selected.entry, args: [...args], options: { ...options, timeout: call.timeoutMs, maxBuffer: call.responseBytes, shell: false } };
-        }
-        if (programs.some((p) => p.alias === program)) {
-            let declared;
-            try {
-                declared = projectNativeProgramLaunch(programs, program, args, { path: realpathSync(runtime), digest: runtimeDigest });
-            }
-            catch (error) {
-                return fail(error instanceof Error ? error.message : String(error));
-            }
-            command = declared.interpreter;
-            args = [declared.entry, ...declared.args];
-        }
-        let selected;
-        try {
-            selected = realpathSync(command);
-        }
-        catch {
-            return fail('native program undeclared ' + program);
-        }
-        runtimeForExecution(selected, 'native runtime target undeclared ' + program);
-        const launch = nodeLaunch(args), call = invocation(args, options.cwd, options.env, options);
-        // Root bootstrap prefix is instrumentation; the original argv/text stays exact.
-        if (launch.kind === 'eval') {
-            flushExecutable(resolve(call.cwd, launch.mode === 'module' ? '[eval1].js' : '[eval].cjs'), launch.mode, Buffer.from(launch.text));
-            request({ kind: 'eval', argv: ['--import', preload, ...args], rootPrefix: ['--import', preload], mode: launch.mode, invocation: call });
-        }
-        else
-            sealFile(resolve(call.cwd, launch.entry), call, true);
-        for (const input of launch.imports)
-            sealFile(input.startsWith('file:') ? fileURLToPath(input) : resolve(call.cwd, input), call);
-        return { command, args: ['--import', preload, ...args], options: { ...options, timeout: call.timeoutMs, maxBuffer: call.responseBytes, shell: false } };
-    };
-    for (const name of ['spawn', 'spawnSync', 'execFile', 'execFileSync']) {
-        const original = childProcess[name];
-        childProcess[name] = function (program, args, options, ...tail) {
-            if (!Array.isArray(args) || typeof options === 'function')
-                fail('native call shape unsupported ' + name);
-            const checked = prepare(program, args, options);
-            return Reflect.apply(original, this, [checked.command, checked.args, checked.options, ...tail]);
-        };
-    }
-    childProcess.exec = childProcess.execSync = () => fail('shell native profile absent');
-    const originalFork = childProcess.fork;
-    childProcess.fork = function (module, args = [], options = {}) {
-        if (!Array.isArray(args))
-            fail('fork argv shape');
-        if (options.execPath && realpathSync(options.execPath) !== realpathSync(runtime))
-            fail('fork runtime undeclared');
-        const originalArgv = options.execArgv ?? process.execArgv, withoutRoot = originalArgv[0] === '--import' && originalArgv[1] === preload ? originalArgv.slice(2) : originalArgv;
-        const launch = nodeLaunch([...withoutRoot, module, ...args]);
-        if (launch.kind !== 'file' || launch.entry !== module)
-            fail('fork executable mode unsupported');
-        for (const input of launch.imports)
-            sealFile(input.startsWith('file:') ? fileURLToPath(input) : resolve(options.cwd ?? process.cwd(), input), invocation([module, ...args], options.cwd, options.env, options));
-        sealFile(resolve(options.cwd ?? process.cwd(), module), invocation([module, ...args], options.cwd, options.env, options), true);
-        // Fork executes a runtime from disk, unlike a retained control message.
-        const forkRuntime = options.execPath ?? process.execPath;
-        runtimeForExecution(forkRuntime, 'fork runtime bytes differ from Root selection');
-        return Reflect.apply(originalFork, this, [module, args, { ...options, execArgv: ['--import', preload, ...withoutRoot] }]);
-    };
-    const OriginalWorker = workerThreads.Worker;
-    workerThreads.Worker = class extends OriginalWorker {
-        constructor(target, options = {}) {
-            const args = options.execArgv ?? process.execArgv, withoutRoot = args[0] === '--import' && args[1] === preload ? args.slice(2) : args;
-            if (options.eval)
-                fail('Worker string-eval profile absent');
-            sealFile(target instanceof URL ? fileURLToPath(target) : resolve(target), invocation([String(target), ...withoutRoot], process.cwd(), options.env), true);
-            super(target, { ...options, execArgv: ['--import', preload, ...withoutRoot] });
-        }
-    };
-    // This fixed host observer is enabled only by the actual Root producer grant.
-    // The original write completes first; failed writes produce no output evidence.
-    if (endpoint.interpretations?.includes('host-file-emission@1')) {
-        const write = fs.writeFileSync, append = fs.appendFileSync, acknowledged = new Set(), pending = new Map();
-        const sentCandidates = new Map();
-        candidateHandoff = () => { const groups = new Map(); for (const row of pending.values()) {
-            const identity = JSON.stringify(row);
-            if (sentCandidates.get(row.path) === identity)
-                continue;
-            const key = JSON.stringify(row.call), group = groups.get(key) ?? { invocation: row.call, outputs: [] };
-            group.outputs.push({ path: row.path, ...(row.digest ? { digest: row.digest } : { reason: row.reason }) });
-            groups.set(key, group);
-        } return [...groups.values()]; };
-        candidateHanded = groups => { for (const group of groups)
-            for (const output of group.outputs) {
-                const row = pending.get(output.path);
-                if (row && JSON.stringify(row.call) === JSON.stringify(group.invocation) && row.digest === output.digest && row.reason === output.reason)
-                    sentCandidates.set(output.path, JSON.stringify(row));
-            } };
-        const limits = endpoint.limits;
-        if (!limits || !['members', 'bytes', 'work', 'argvBytes', 'argvItems'].every(name => Number.isSafeInteger(limits[name]) && limits[name] >= 0))
-            fail('producer selection limits absent');
-        flushEmissions = (paths = []) => {
-            const required = [...new Set(paths)].flatMap(path => { const row = pending.get(path); if (!row)
-                return []; if (row.reason)
-                fail('required emission unmeasured ' + path + ' ' + row.reason); return [row]; });
-            const groups = new Map();
-            for (const row of required) {
-                const key = JSON.stringify(row.call), group = groups.get(key) ?? [];
-                group.push(row);
-                groups.set(key, group);
-            }
-            for (const rows of groups.values()) {
-                const outputs = rows.map(({ path, digest }) => ({ path, digest })), held = request({ outputs, invocation: rows[0].call }, 'emission-batch');
-                if (held.kind !== 'producer-emission-batch/1' || held.parent !== parentExecution.identity || held.producer !== endpoint.identity || !Array.isArray(held.outputs) || held.outputs.length !== outputs.length)
-                    fail('emission batch provenance differs');
-                for (let i = 0; i < outputs.length; i++) {
-                    if (held.outputs[i].path !== outputs[i].path || held.outputs[i].digest !== outputs[i].digest || !held.outputs[i].identity)
-                        fail('emission batch output differs');
-                    acknowledged.add(outputs[i].digest);
-                    pending.delete(outputs[i].path);
-                }
-            }
-        };
-        flushExecutable = (path, mode, source) => {
-            if (!pending.size || (source && executableDigests.has(sha(source))))
-                return;
-            const required = new Set(), readPaths = new Set(), derivedPaths = new Set();
-            let bytes = 0, derivedBytes = 0, work = 0;
-            const step = () => { if (++work > limits.work)
-                fail('emission selection work exhausted ' + path); };
-            const verify = (target) => { step(); const real = realpathSync(target), candidate = pending.get(real); if (candidate?.reason)
-                fail('required emission unmeasured ' + real + ' ' + candidate.reason); const raw = readBoundedFile(real, config.inputBytes, real), digest = sha(raw); if (!readPaths.has(real)) {
-                readPaths.add(real);
-                bytes += raw.length;
-                if (bytes > config.inputBytes)
-                    fail('emission selection input bytes ' + real);
-                if (!known.has(real) && !executableDigests.has(digest) && !metadataDigests.has(digest)) {
-                    derivedPaths.add(real);
-                    derivedBytes += raw.length;
-                    if (derivedPaths.size > limits.members || derivedBytes > limits.bytes)
-                        fail('emission selection derived resources ' + real);
-                }
-            } if (candidate) {
-                if (candidate.digest !== digest)
-                    fail('observed emission bytes differ ' + real);
-                required.add(real);
-            } return { real, bytes: raw, digest }; };
-            const entry = source ? { real: path, bytes: source, digest: sha(source) } : verify(path);
-            // The hint stops at sealed executable content. Root's custodian
-            // still independently verifies the complete selected closure.
-            if (!executableDigests.has(entry.digest))
-                traverseGeneratedClosure({ source: entry.bytes, path: entry.real, mode, libs: new Map(config.libraries.map((l) => [l.name, l.manifest])), native: new Set(config.builtins.map((n) => n.startsWith('node:') ? n : 'node:' + n)), platform: config.platform, nativeImplementations: executableDigests, verify, step });
-            flushEmissions([...required]);
-        };
-        const writtenDigest = (path) => {
-            const fd = fs.openSync(path, 'r');
-            try {
-                const stat = fs.fstatSync(fd), size = stat.size, limit = Math.min(config.inputBytes ?? parentExecution.responseBytes, parentExecution.responseBytes);
-                if (!stat.isFile() || !Number.isSafeInteger(size) || size < 0 || size > limit)
-                    throw Error('emission bytes before hash ' + path);
-                const bytes = Buffer.alloc(size), tail = Buffer.alloc(1);
-                let got = 0;
-                while (got < size) {
-                    const n = fs.readSync(fd, bytes, got, size - got, got);
-                    if (!n)
-                        break;
-                    got += n;
-                }
-                if (got !== size || fs.readSync(fd, tail, 0, 1, size) !== 0)
-                    throw Error('emission changed during bounded read ' + path);
-                return sha(bytes);
-            }
-            finally {
-                fs.closeSync(fd);
-            }
-        };
-        const observeWrite = (operation) => function (file, ...args) {
-            const call = invocation([...process.execArgv, ...process.argv.slice(1)], process.cwd(), process.env);
-            if (typeof file !== 'string' && !(file instanceof URL))
-                fail('emission write route unsupported');
-            const named = file instanceof URL ? fileURLToPath(file) : resolve(file);
-            const result = Reflect.apply(operation, this, [file, ...args]);
-            const actual = realpathSync(named);
-            let digest, reason;
-            try {
-                digest = writtenDigest(actual);
-            }
-            catch (error) {
-                reason = error instanceof Error ? error.message : String(error);
-            }
-            // Unstable operational data is an unmeasured candidate, never a
-            // successful emission. Actual executable use must close it first.
-            if (digest && (executableDigests.has(digest) || acknowledged.has(digest))) {
-                pending.delete(actual);
-                return result;
-            }
-            pending.set(actual, { path: actual, digest, reason, call });
-            if (Buffer.byteLength(JSON.stringify([...pending.values()].map(({ path, digest, reason }) => ({ path, digest, reason })))) > parentExecution.responseBytes)
-                fail('pending emission provenance bytes');
-            return result;
-        };
-        fs.writeFileSync = observeWrite(write);
-        fs.appendFileSync = observeWrite(append);
-    }
-    syncBuiltinESMExports();
-    // Exact libraries are already verified by Root. Node supplies resolution, then
-    // the actual target is checked BEFORE it executes. Computed ordinary code is
-    // still screened by the custodian's strict generated-code gate.
-    if (typeof registerHooks !== 'function')
-        fail('runtime hooks absent');
-    registerHooks({ resolve(specifier, context, next) {
-            if (red)
-                throw Error(red);
-            const builtin = specifier.startsWith('node:') ? specifier : 'node:' + specifier;
-            if (builtinModules.includes(specifier) || specifier.startsWith('node:')) {
-                if (!native.has(builtin))
-                    fail('native ABI undeclared ' + specifier);
-                return next(builtin, context);
-            }
-            let selected = context, programParent;
-            if (context.parentURL?.startsWith('file:') && context.parentURL !== evalParent?.url) {
-                const parent = realpathSync(fileURLToPath(context.parentURL)), expected = known.get(parent);
-                if (programs.some((p) => p.kind !== 'native-binary' && p.members.some((m) => m.path === parent))) {
-                    if (!expected || sha(readBoundedFile(parent, config.inputBytes, parent)) !== expected)
-                        fail('program parent bytes differ');
-                    try {
-                        programParent = selectNativeProgramParent(programs.filter((p) => p.kind !== 'native-binary'), { path: parent, digest: expected });
-                    }
-                    catch (error) {
-                        fail(error instanceof Error ? error.message : String(error));
-                    }
-                }
-            }
-            if (!programParent && !specifier.startsWith('.') && !specifier.startsWith('/') && !specifier.includes(':')) {
-                const name = specifier.startsWith('@') ? specifier.split('/').slice(0, 2).join('/') : specifier.split('/')[0], lib = library.get(name);
-                if (!lib)
-                    fail('library undeclared ' + name);
-                selected = { ...context, parentURL: pathToFileURL(lib.manifest).href };
-            }
-            const got = next(specifier, selected);
-            if (!got.url.startsWith('file:'))
-                fail('module scheme undeclared ' + got.url);
-            sealFile(fileURLToPath(got.url), invocation([...process.execArgv, ...process.argv.slice(1)], process.cwd(), process.env));
-            return got;
-        }, load(url, context, nextLoad) {
-            if (!url.startsWith('file:'))
-                return nextLoad(url, context);
-            const actual = realpathSync(fileURLToPath(url));
-            if (statSync(actual).size > (config.inputBytes ?? endpoint.responseBytes))
-                fail('ambiguous input bytes before load');
-            const call = invocation([...process.execArgv, ...process.argv.slice(1)], process.cwd(), process.env);
-            // Seal controlling package interpretation before Node reads it. Its returned
-            // default is deliberately ignored: only Node's actual load result supplies mode.
-            const ambiguous = extname(actual) === '';
-            if (ambiguous)
-                modeOf(actual, call);
-            const before = readBoundedFile(actual, config.inputBytes, actual), digest = sha(before), loaded = nextLoad(url, context);
-            if (ambiguous && !['module', 'commonjs'].includes(loaded.format))
-                fail('ambiguous Node interpretation unsupported ' + loaded.format);
-            if (loaded.source === null || loaded.source === undefined)
-                fail('ambiguous Node source absent before execution');
-            const source = typeof loaded.source === 'string' ? Buffer.from(loaded.source, 'utf8') : loaded.source instanceof ArrayBuffer ? Buffer.from(loaded.source) : Buffer.from(loaded.source.buffer, loaded.source.byteOffset, loaded.source.byteLength);
-            if (sha(source) !== digest || sha(readBoundedFile(actual, config.inputBytes, actual)) !== digest)
-                fail('ambiguous Node source differs before execution');
-            const processEntry = process.argv[1] && realpathSync(resolve(process.argv[1])) === actual;
-            sealFile(actual, call, Boolean(processEntry) && ambiguous, ambiguous ? loaded : undefined);
-            return loaded;
-        } });
-    if (process.argv[1])
-        sealFile(resolve(process.argv[1]), invocation([...process.execArgv, ...process.argv.slice(1)], process.cwd(), process.env), true);
-    process.once('beforeExit', () => {
-        if (red)
-            throw Error(red);
-    });
-}
-/** An optional observer does nothing until fixed custody is installed. */
-const ignoreEmission = (..._args) => { };
+var Re=Object.defineProperty;var v=(c,b)=>Re(c,"name",{value:b,configurable:!0});import{sha256 as Ne}from"../hash.js";import Ae from"node:child_process";import A from"node:fs";import{traverseGeneratedClosure as Oe}from"./generated.js";import ie from"node:worker_threads";import{realpathSync as w,existsSync as je,statSync as Q}from"node:fs";import{resolve as M,dirname as he,extname as H}from"node:path";import{fileURLToPath as L,pathToFileURL as We}from"node:url";import*as Pe from"node:module";import{syncBuiltinESMExports as Fe,builtinModules as Je}from"node:module";import{nodeLaunch as ge,projectNativeProgramLaunch as Le,selectNativeProgramParent as Ue,nativeEvalParent as ze,actualNodeEvalOptions as De}from"./node-launch.js";import{readBoundedFile as B}from"./bounded-file.js";import{createFixedControlBridge as qe}from"./control-bridge.js";import{installNativeResolutionReuse as Ie}from"./loader.js";const P=Ae,ve=ie,be=Pe.registerHooks;function st(c){const b=Ne,we=P.spawnSync;let S,X,Y=!1;const i=v(e=>{if(S??(S="REFUSE\xB7native descendant "+e),X&&!Y){Y=!0;try{X({operation:"violation",token:m.token,why:S})}catch{}finally{Y=!1}}throw Error(S)},"fail"),{contextFile:ae,client:U,runtime:E,preload:R,runtimeDigest:C,clientDigest:ce}=c.custodian??{};let Z;try{Z=JSON.parse(B(ae,c.contextBytes,ae).toString("utf8"))}catch{i("Root execution custody absent")}const{endpoint:m,parentExecution:F}=Z,I=Z.programs??[];(!F?.identity||m?.parent!==F.identity)&&i("Root custody parent differs"),(!m||!E||!R||!U||b(B(E,c.runtimeBytes,E))!==C||b(B(U,c.clientBytes,U))!==ce)&&i("Root custodian binding absent/different");const ee=v((e,o)=>{let n=!1;try{n=w(e)===w(E)&&b(B(e,c.runtimeBytes,e))===C}catch{return i(o)}n||i(o)},"runtimeForExecution"),te=new Map(c.members.map(e=>[w(e.path),e.digest])),z=new Set(c.executableDigests??[]),re=new Set(c.metadataDigests??c.members.filter(e=>e.path.endsWith(".json")).map(e=>e.digest)),xe=new Set(c.builtins.map(e=>e.startsWith("node:")?e:"node:"+e)),Be=new Map(c.libraries.map(e=>[e.name,e]));let ke=0;const de=c.members.map(e=>{const o=w(e.path),n=Q(o);return(!n.isFile()||!Number.isSafeInteger(c.inputBytes)||c.inputBytes<1||(ke+=n.size)>c.inputBytes)&&i("fixed library resolution resource exceeded"),{path:o,digest:e.digest,bytes:n.size}});Ie({members:de,libraries:c.libraries,builtins:c.builtins,entry:de[0]?.path??"",platform:c.platform});let D;if(c.control&&c.control.realm!=="main-thread"&&i("unknown Root control realm"),c.control&&ie.isMainThread){const e=c.control;D=qe({endpoint:m,workerBytes:B(e.worker.path,e.worker.bytes,e.worker.coordinate),worker:e.worker,runtime:{path:E,digest:C,bytes:c.runtimeBytes},resources:e.resources,deadlineMs:m.deadlineMs}),process.once("exit",()=>{D?.close()}),process.once("beforeExit",()=>{D?.close()})}const ue=v(e=>{const o=JSON.stringify({protocol:"command-lot/1",coordinate:m.coordinate,implementation:m.implementation,identity:m.identity,requests:[JSON.stringify(e)]});Buffer.byteLength(o)>m.responseBytes&&i("custodian request bytes");let n;if(D)try{n=D.exchange(o)}catch(t){return D.close(),i(t instanceof Error?t.message:String(t))}else{ee(E,"Root sync bridge runtime bytes differ");let t=!1;try{t=b(B(U,c.clientBytes,U))===ce}catch{}t||i("Root sync bridge bytes differ");const d=Reflect.apply(we,P,[E,[U,String(c.contextBytes)],{input:JSON.stringify({endpoint:m,frame:o}),encoding:"utf8",timeout:m.timeoutMs,maxBuffer:m.responseBytes,env:{...process.env},shell:!1}]);(d.error||d.signal||d.status!==0||d.stderr)&&i("custodian client interrupted/refused "+(d.error?.message??d.stderr??d.signal??d.status)),n=d.stdout}let s;try{s=JSON.parse(n)}catch{return i("custodian response malformed")}return(s.protocol!=="command-lot/1"||s.coordinate!==m.coordinate||s.implementation!==m.implementation||s.identity!==m.identity||!Array.isArray(s.responses)||s.responses.length!==1)&&i("custodian response identity/count"),s.responses[0]},"exchange");X=ue;const se=new Map;let le=v(()=>[],"candidateHandoff"),fe=oe;const q=v((e,o="entry")=>{if(S)throw Error(S);const n=o==="entry"?le():[],s=ue({operation:o,token:m.token,request:n.length?{...e,candidates:n}:e});if(s.kind==="refuse"&&i(s.why),(s.kind!=="entry-context"||!s.context?.identity)&&i("custodian context absent"),(s.context.parent!==F.identity||s.context.producer!==m.identity)&&i("custodian context parent differs"),fe(n),o==="entry"&&Array.isArray(s.context.edges)){for(const t of s.context.edges)if(typeof t.target=="string"&&t.target.startsWith("/")&&/^sha256:[0-9a-f]{64}$/.test(t.digest??"")){const d=se.get(t.target);d&&d!==t.digest&&i("verified edge bytes changed "+t.target),se.set(t.target,t.digest)}}return s.context},"request"),N=v((e,o,n,s={})=>({cwd:w(M(o??process.cwd())),argv:[...e],environment:Object.entries(n??process.env).sort(),runtime:E,timeoutMs:Math.min(s.timeout??m.timeoutMs,m.timeoutMs),responseBytes:Math.min(s.maxBuffer??m.responseBytes,m.responseBytes)}),"invocation");let pe;if(ie.isMainThread&&De(process.execArgv)){w(process.execPath)!==w(E)&&i("actual eval runtime differs from Root selection");const e={argv:[...process.execArgv,...process.argv.slice(1)],rootPrefix:["--import",R],cwd:process.cwd(),environment:Object.entries(process.env).sort(),runtime:E},o=q(e,"eval-context");pe=ze(o,e)}let G=oe,ne=oe;const me=new Map,ye=v((e,o)=>{const n=H(e);if(n===".mjs"||n===".mts")return"module";if(n===".cjs"||n===".cts")return"commonjs";n!==""&&n!==".js"&&n!==".ts"&&i("executable extension unsupported "+n);let s=he(e);for(;;){const t=M(s,"package.json");if(je(t)){G([w(t)]),Q(t).size>(c.inputBytes??m.responseBytes)&&i("package interpretation bytes");const p=B(t,c.inputBytes,t),l=b(p);if(!re.has(l)){const a=JSON.stringify([t,l,o]);if(!me.has(a)){const u=q({path:t,interpretation:"node-package-json@1",invocation:o},"interpretation");(u.kind!=="derived-interpretation/1"||u.path!==w(t)||u.digest!==l||u.interpretation!=="node-package-json@1"||b(B(t,c.inputBytes,t))!==l)&&i("package interpretation changed after custody"),me.set(a,u.identity)}}let r;try{r=JSON.parse(p.toString("utf8"))}catch{i("package interpretation invalid")}if(r.type===void 0||r.type==="commonjs")return"commonjs";if(r.type==="module")return"module";i("package interpretation type unknown")}const d=he(s);if(d===s)return"commonjs";s=d}},"modeOf"),O=v((e,o,n=!1,s=void 0)=>{let t;try{t=w(e)}catch{return i("executable target absent "+e)}G([t]);const d=te.get(t);Q(t).size>(c.inputBytes??m.responseBytes)&&i("input bytes before hash");const p=B(t,c.inputBytes,t),l=b(p);if(t.endsWith(".json"))return n&&i("JSON executable entry unsupported"),re.has(l)||i("JSON interpretation not Root-selected "+t),t;d&&l!==d&&i("retained target bytes differ "+t);const r=se.get(t);if(r&&l!==r&&i("verified edge bytes differ "+t),!n&&r===l&&!(H(t)===""&&!s)||H(t)===""&&!s||!n&&!s&&(z.has(l)||d&&H(t)===".json"))return t;const a=s?.format??ye(t,o);ne(t,a,p);const u=q({kind:"file",path:t,mode:a,...s?{interpretation:"node-ambiguous-javascript@1"}:{},invocation:o});return u.path!==t&&u.target?.path!==t&&i("custodian target changed"),u.digest!==b(B(t,c.inputBytes,t))&&i("derived target changed after seal"),t},"sealFile"),Se=v((e,o,n={})=>{if(S)throw Error(S);n.shell&&i("shell target undeclared");let s=e;const t=I.filter(r=>r.alias===e&&r.kind==="native-binary");if(t.length){t.length!==1&&i("native binary alias ambiguous");const r=t[0],a=N(o,n.cwd,n.env,n),u=q({alias:e,path:r.entry,invocation:a},"native-program");return(u.kind!=="native-program-transaction/1"||u.target!==r.entry||u.digest!==r.entryDigest||b(B(r.entry,r.entryBytes,r.entry))!==u.digest)&&i("native binary changed before entry"),{command:r.entry,args:[...o],options:{...n,timeout:a.timeoutMs,maxBuffer:a.responseBytes,shell:!1}}}if(I.some(r=>r.alias===e)){let r;try{r=Le(I,e,o,{path:w(E),digest:C})}catch(a){return i(a instanceof Error?a.message:String(a))}s=r.interpreter,o=[r.entry,...r.args]}let d;try{d=w(s)}catch{return i("native program undeclared "+e)}ee(d,"native runtime target undeclared "+e);const p=ge(o),l=N(o,n.cwd,n.env,n);p.kind==="eval"?(ne(M(l.cwd,p.mode==="module"?"[eval1].js":"[eval].cjs"),p.mode,Buffer.from(p.text)),q({kind:"eval",argv:["--import",R,...o],rootPrefix:["--import",R],mode:p.mode,invocation:l})):O(M(l.cwd,p.entry),l,!0);for(const r of p.imports)O(r.startsWith("file:")?L(r):M(l.cwd,r),l);return{command:s,args:["--import",R,...o],options:{...n,timeout:l.timeoutMs,maxBuffer:l.responseBytes,shell:!1}}},"prepare");for(const e of["spawn","spawnSync","execFile","execFileSync"]){const o=P[e];P[e]=function(n,s,t,...d){(!Array.isArray(s)||typeof t=="function")&&i("native call shape unsupported "+e);const p=Se(n,s,t);return Reflect.apply(o,this,[p.command,p.args,p.options,...d])}}P.exec=P.execSync=()=>i("shell native profile absent");const Ee=P.fork;P.fork=function(e,o=[],n={}){Array.isArray(o)||i("fork argv shape"),n.execPath&&w(n.execPath)!==w(E)&&i("fork runtime undeclared");const s=n.execArgv??process.execArgv,t=s[0]==="--import"&&s[1]===R?s.slice(2):s,d=ge([...t,e,...o]);(d.kind!=="file"||d.entry!==e)&&i("fork executable mode unsupported");for(const l of d.imports)O(l.startsWith("file:")?L(l):M(n.cwd??process.cwd(),l),N([e,...o],n.cwd,n.env,n));O(M(n.cwd??process.cwd(),e),N([e,...o],n.cwd,n.env,n),!0);const p=n.execPath??process.execPath;return ee(p,"fork runtime bytes differ from Root selection"),Reflect.apply(Ee,this,[e,o,{...n,execArgv:["--import",R,...t]}])};const Me=ve.Worker;if(ve.Worker=class extends Me{constructor(e,o={}){const n=o.execArgv??process.execArgv,s=n[0]==="--import"&&n[1]===R?n.slice(2):n;o.eval&&i("Worker string-eval profile absent"),O(e instanceof URL?L(e):M(e),N([String(e),...s],process.cwd(),o.env),!0),super(e,{...o,execArgv:["--import",R,...s]})}},m.interpretations?.includes("host-file-emission@1")){const e=A.writeFileSync,o=A.appendFileSync,n=new Set,s=new Map,t=new Map;le=v(()=>{const r=new Map;for(const a of s.values()){const u=JSON.stringify(a);if(t.get(a.path)===u)continue;const f=JSON.stringify(a.call),y=r.get(f)??{invocation:a.call,outputs:[]};y.outputs.push({path:a.path,...a.digest?{digest:a.digest}:{reason:a.reason}}),r.set(f,y)}return[...r.values()]},"candidateHandoff"),fe=v(r=>{for(const a of r)for(const u of a.outputs){const f=s.get(u.path);f&&JSON.stringify(f.call)===JSON.stringify(a.invocation)&&f.digest===u.digest&&f.reason===u.reason&&t.set(u.path,JSON.stringify(f))}},"candidateHanded");const d=m.limits;(!d||!["members","bytes","work","argvBytes","argvItems"].every(r=>Number.isSafeInteger(d[r])&&d[r]>=0))&&i("producer selection limits absent"),G=v((r=[])=>{const a=[...new Set(r)].flatMap(f=>{const y=s.get(f);return y?(y.reason&&i("required emission unmeasured "+f+" "+y.reason),[y]):[]}),u=new Map;for(const f of a){const y=JSON.stringify(f.call),g=u.get(y)??[];g.push(f),u.set(y,g)}for(const f of u.values()){const y=f.map(({path:h,digest:x})=>({path:h,digest:x})),g=q({outputs:y,invocation:f[0].call},"emission-batch");(g.kind!=="producer-emission-batch/1"||g.parent!==F.identity||g.producer!==m.identity||!Array.isArray(g.outputs)||g.outputs.length!==y.length)&&i("emission batch provenance differs");for(let h=0;h<y.length;h++)(g.outputs[h].path!==y[h].path||g.outputs[h].digest!==y[h].digest||!g.outputs[h].identity)&&i("emission batch output differs"),n.add(y[h].digest),s.delete(y[h].path)}},"flushEmissions"),ne=v((r,a,u)=>{if(!s.size||u&&z.has(b(u)))return;const f=new Set,y=new Set,g=new Set;let h=0,x=0,J=0;const j=v(()=>{++J>d.work&&i("emission selection work exhausted "+r)},"step"),V=v(W=>{j();const k=w(W),_=s.get(k);_?.reason&&i("required emission unmeasured "+k+" "+_.reason);const $=B(k,c.inputBytes,k),K=b($);return y.has(k)||(y.add(k),h+=$.length,h>c.inputBytes&&i("emission selection input bytes "+k),!te.has(k)&&!z.has(K)&&!re.has(K)&&(g.add(k),x+=$.length,(g.size>d.members||x>d.bytes)&&i("emission selection derived resources "+k))),_&&(_.digest!==K&&i("observed emission bytes differ "+k),f.add(k)),{real:k,bytes:$,digest:K}},"verify"),T=u?{real:r,bytes:u,digest:b(u)}:V(r);z.has(T.digest)||Oe({source:T.bytes,path:T.real,mode:a,libs:new Map(c.libraries.map(W=>[W.name,W.manifest])),native:new Set(c.builtins.map(W=>W.startsWith("node:")?W:"node:"+W)),platform:c.platform,nativeImplementations:z,verify:V,step:j}),G([...f])},"flushExecutable");const p=v(r=>{const a=A.openSync(r,"r");try{const u=A.fstatSync(a),f=u.size,y=Math.min(c.inputBytes??F.responseBytes,F.responseBytes);if(!u.isFile()||!Number.isSafeInteger(f)||f<0||f>y)throw Error("emission bytes before hash "+r);const g=Buffer.alloc(f),h=Buffer.alloc(1);let x=0;for(;x<f;){const J=A.readSync(a,g,x,f-x,x);if(!J)break;x+=J}if(x!==f||A.readSync(a,h,0,1,f)!==0)throw Error("emission changed during bounded read "+r);return b(g)}finally{A.closeSync(a)}},"writtenDigest"),l=v(r=>function(a,...u){const f=N([...process.execArgv,...process.argv.slice(1)],process.cwd(),process.env);typeof a!="string"&&!(a instanceof URL)&&i("emission write route unsupported");const y=a instanceof URL?L(a):M(a),g=Reflect.apply(r,this,[a,...u]),h=w(y);let x,J;try{x=p(h)}catch(j){J=j instanceof Error?j.message:String(j)}return x&&(z.has(x)||n.has(x))?(s.delete(h),g):(s.set(h,{path:h,digest:x,reason:J,call:f}),Buffer.byteLength(JSON.stringify([...s.values()].map(({path:j,digest:V,reason:T})=>({path:j,digest:V,reason:T}))))>F.responseBytes&&i("pending emission provenance bytes"),g)},"observeWrite");A.writeFileSync=l(e),A.appendFileSync=l(o)}Fe(),typeof be!="function"&&i("runtime hooks absent"),be({resolve(e,o,n){if(S)throw Error(S);const s=e.startsWith("node:")?e:"node:"+e;if(Je.includes(e)||e.startsWith("node:"))return xe.has(s)||i("native ABI undeclared "+e),n(s,o);let t=o,d;if(o.parentURL?.startsWith("file:")&&o.parentURL!==pe?.url){const l=w(L(o.parentURL)),r=te.get(l);if(I.some(a=>a.kind!=="native-binary"&&a.members.some(u=>u.path===l))){(!r||b(B(l,c.inputBytes,l))!==r)&&i("program parent bytes differ");try{d=Ue(I.filter(a=>a.kind!=="native-binary"),{path:l,digest:r})}catch(a){i(a instanceof Error?a.message:String(a))}}}if(!d&&!e.startsWith(".")&&!e.startsWith("/")&&!e.includes(":")){const l=e.startsWith("@")?e.split("/").slice(0,2).join("/"):e.split("/")[0],r=Be.get(l);r||i("library undeclared "+l),t={...o,parentURL:We(r.manifest).href}}const p=n(e,t);return p.url.startsWith("file:")||i("module scheme undeclared "+p.url),O(L(p.url),N([...process.execArgv,...process.argv.slice(1)],process.cwd(),process.env)),p},load(e,o,n){if(!e.startsWith("file:"))return n(e,o);const s=w(L(e));Q(s).size>(c.inputBytes??m.responseBytes)&&i("ambiguous input bytes before load");const t=N([...process.execArgv,...process.argv.slice(1)],process.cwd(),process.env),d=H(s)==="";d&&ye(s,t);const p=B(s,c.inputBytes,s),l=b(p),r=n(e,o);d&&!["module","commonjs"].includes(r.format)&&i("ambiguous Node interpretation unsupported "+r.format),(r.source===null||r.source===void 0)&&i("ambiguous Node source absent before execution");const a=typeof r.source=="string"?Buffer.from(r.source,"utf8"):r.source instanceof ArrayBuffer?Buffer.from(r.source):Buffer.from(r.source.buffer,r.source.byteOffset,r.source.byteLength);(b(a)!==l||b(B(s,c.inputBytes,s))!==l)&&i("ambiguous Node source differs before execution");const u=process.argv[1]&&w(M(process.argv[1]))===s;return O(s,t,!!u&&d,d?r:void 0),r}}),process.argv[1]&&O(M(process.argv[1]),N([...process.execArgv,...process.argv.slice(1)],process.cwd(),process.env),!0),process.once("beforeExit",()=>{if(S)throw Error(S)})}v(st,"installDescendantBoundary");const oe=v((...c)=>{},"ignoreEmission");export{st as installDescendantBoundary};