@lapxo/bound 0.2.4 → 0.2.6

package/dist/host/native/jobs.js

@@ -1,148 +1,2 @@
-import { encodeUTF8 } from "../io.js";
-const fail = (why) => { throw Error('REFUSE·job ' + why); };
-const utf8 = encodeUTF8;
-const by = (a, b) => { const x = utf8(a), y = utf8(b); for (let i = 0; i < Math.min(x.length, y.length); i++)
-    if (x[i] !== y[i])
-        return x[i] - y[i]; return x.length - y.length; };
-const text = (x) => typeof x === 'string' && x.length > 0;
-const positive = (x) => Number.isSafeInteger(x) && Number(x) > 0;
-function coordinate(s) { if (!text(s) || s.startsWith('/') || s.includes('\\') || s.split('/').some(p => p === '' || p === '.' || p === '..'))
-    fail('unknown member coordinate ' + String(s)); }
-function capped(s, max) { if (s.length > max || utf8(s).byteLength > max)
-    fail('byte budget'); }
-/** digest is selected by the instrument; it is a pure naming implementation,
- * not a callback that answers whether untrusted bytes/authority are "verified". */
-export function planJobs(host, framed, digest) {
-    if (!host || !host.budget)
-        fail('missing admitted host handoff');
-    for (const key of ['jobs', 'members', 'edges', 'bytes', 'payloadBytes', 'env'])
-        if (!positive(host.budget[key]))
-            fail('missing resource ' + key);
-    const budget = host.budget;
-    if (!(framed instanceof Uint8Array) || framed.byteLength > budget.bytes)
-        fail('request byte budget');
-    if (typeof digest !== 'function')
-        fail('missing instrument digest');
-    if (!text(host.place) || !text(host.instrument) || !text(host.policy) || !text(host.authoritySnapshot))
-        fail('missing authority context');
-    for (const s of [host.place, host.instrument, host.policy, host.authoritySnapshot])
-        capped(s, budget.bytes);
-    if (!Array.isArray(host.members) || !Array.isArray(host.loads) || !Array.isArray(host.bindings) || host.members.length > budget.members || host.loads.length > budget.edges || host.bindings.length > budget.jobs)
-        fail('handoff count budget');
-    let total = framed.byteLength;
-    const charge = (s) => { capped(s, budget.bytes); total += Math.max(1, utf8(s).byteLength); if (total > budget.bytes)
-        fail('handoff byte budget'); };
-    for (const s of [host.place, host.instrument, host.policy, host.authoritySnapshot])
-        charge(s);
-    const members = new Map();
-    for (const m of host.members) {
-        if (!m || !(m.bytes instanceof Uint8Array))
-            fail('missing handed member');
-        coordinate(m.coordinate);
-        if (!text(m.digest))
-            fail('missing member digest ' + m.coordinate);
-        charge(m.coordinate);
-        charge(m.digest);
-        total += m.bytes.byteLength;
-        if (total > budget.bytes)
-            fail('member byte budget');
-        if (members.has(m.coordinate))
-            fail('duplicate handed member ' + m.coordinate);
-        members.set(m.coordinate, m);
-    }
-    const edges = new Map();
-    for (const e of host.loads) {
-        if (!e || !['module', 'worker', 'program'].includes(e.kind))
-            fail('unknown load kind');
-        coordinate(e.from);
-        if (typeof e.target !== 'string')
-            fail('unknown computed target ' + e.from);
-        coordinate(e.target);
-        charge(e.from);
-        charge(e.target);
-        if (!members.has(e.from) || !members.has(e.target))
-            fail('unhanded load ' + e.from + ' -> ' + e.target);
-        const key = e.from + '\u0000' + e.kind + '\u0000' + e.target;
-        if ((edges.get(e.from) ?? []).some(x => x.kind === e.kind && x.target === e.target))
-            fail('duplicate load ' + key);
-        edges.set(e.from, [...(edges.get(e.from) ?? []), e]);
-    }
-    let launchEdges = host.loads.length;
-    const bindings = new Map();
-    for (const b of host.bindings) {
-        if (!b || !text(b.id) || bindings.has(b.id))
-            fail('duplicate or missing job binding');
-        charge(b.id);
-        if (!['process', 'worker'].includes(b.kind) || (b.kind === 'worker' && !b.entry))
-            fail('unknown or incomplete execution kind ' + b.id);
-        if (!Array.isArray(b.places) || !Array.isArray(b.args) || !Array.isArray(b.inputs) || !Array.isArray(b.environment) || b.environment.length > budget.env || [b.places, b.args, b.inputs].some(x => Array.isArray(x) && x.length > budget.bytes))
-            fail('incomplete job binding ' + b.id);
-        if (new Set(b.places).size !== b.places.length || new Set(b.inputs).size !== b.inputs.length)
-            fail('duplicate binding coordinate ' + b.id);
-        for (const s of [...b.places, ...b.args, ...b.inputs]) {
-            if (typeof s !== 'string')
-                fail('nonliteral host argument ' + b.id);
-            charge(s);
-        }
-        for (const field of ['timeMs', 'responseBytes', 'slots'])
-            if (!b.limits || !positive(b.limits[field]))
-                fail('missing launch resource ' + b.id + '/' + field);
-        if (b.limits.slots > budget.jobs)
-            fail('launch slots exceed admitted jobs ' + b.id);
-        const env = new Set();
-        for (const pair of b.environment) {
-            if (!Array.isArray(pair) || pair.length !== 2 || !text(pair[0]) || typeof pair[1] !== 'string' || env.has(pair[0]))
-                fail('ambiguous environment ' + b.id);
-            env.add(pair[0]);
-            charge(pair[0]);
-            charge(pair[1]);
-        }
-        for (const c of [b.program, b.interpreter, b.entry, ...b.inputs].filter(x => x !== undefined)) {
-            coordinate(c);
-            if (!members.has(c))
-                fail('unhanded launch member ' + c);
-        }
-        launchEdges += [b.program, b.interpreter, b.entry, ...b.inputs].filter(x => x !== undefined).length;
-        if (launchEdges > budget.edges)
-            fail('launch edge budget');
-        bindings.set(b.id, b);
-    }
-    // All byte/count/declaration checks precede hashing or parsing world data.
-    let proposals;
-    try {
-        proposals = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(framed));
-    }
-    catch {
-        fail('malformed proposal frame');
-    }
-    if (!Array.isArray(proposals) || proposals.length > budget.jobs)
-        return fail('proposal count budget');
-    const ids = new Set(), jobs = [];
-    for (const p of proposals) {
-        if (!p || typeof p !== 'object' || Array.isArray(p) || Object.keys(p).some(k => k !== 'id' && k !== 'payload') || !text(p.id) || typeof p.payload !== 'string')
-            fail('world may propose only job id and data');
-        if (ids.has(p.id))
-            fail('duplicate proposed job ' + p.id);
-        ids.add(p.id);
-        capped(p.id, budget.bytes);
-        capped(p.payload, budget.payloadBytes);
-        const b = bindings.get(p.id);
-        if (!b)
-            return fail('unknown computed job target ' + p.id);
-        if (!b.places.includes(host.place))
-            fail('job not covered at place ' + host.place + ' ' + p.id);
-        jobs.push(p);
-    }
-    for (const m of members.values())
-        if (digest(m.bytes) !== m.digest)
-            fail('member digest differs ' + m.coordinate);
-    return jobs.map(p => { const b = bindings.get(p.id); const ref = (c) => [c, members.get(c).digest]; const seen = new Set(), closed = []; const visit = (c) => { if (seen.has(c))
-        return; seen.add(c); for (const e of edges.get(c) ?? []) {
-        const target = e.target;
-        closed.push({ from: c, kind: e.kind, target, digest: members.get(target).digest });
-        visit(target);
-    } }; for (const c of [b.program, b.interpreter, b.entry, ...b.inputs].filter(x => x !== undefined))
-        visit(c); closed.sort((a, b) => by(JSON.stringify(a), JSON.stringify(b))); for (const [kind, c] of [['launch', b.program], ['interpreter', b.interpreter], ['worker-entry', b.entry], ...b.inputs.map(c => ['input', c])])
-        if (c !== undefined)
-            closed.push({ from: 'job:' + p.id, kind: kind, target: c, digest: members.get(c).digest }); closed.sort((a, b) => by(JSON.stringify(a), JSON.stringify(b))); const environment = b.environment.map(p => [...p]).sort((a, b) => by(a[0], b[0])); const payload = utf8(p.payload), tuple = ['host-job-proposal', host.place, host.instrument, host.policy, host.authoritySnapshot, p.id, b.kind, ref(b.program), b.interpreter ? ref(b.interpreter) : null, b.entry ? ref(b.entry) : null, b.args, b.inputs.map(ref), environment, [b.limits.timeMs, b.limits.responseBytes, b.limits.slots], closed, digest(payload)]; return { id: p.id, kind: b.kind, identity: digest(utf8(JSON.stringify(tuple) + '\n')), place: host.place, program: ref(b.program), ...(b.interpreter ? { interpreter: ref(b.interpreter) } : {}), ...(b.entry ? { entry: ref(b.entry) } : {}), args: [...b.args], payload, environment, limits: { ...b.limits }, edges: closed }; });
-}
+var x=Object.defineProperty;var g=(t,a)=>x(t,"name",{value:a,configurable:!0});import{encodeUTF8 as z}from"../io.js";const i=g(t=>{throw Error("REFUSE\xB7job "+t)},"fail"),u=z,v=g((t,a)=>{const c=u(t),o=u(a);for(let f=0;f<Math.min(c.length,o.length);f++)if(c[f]!==o[f])return c[f]-o[f];return c.length-o.length},"by"),m=g(t=>typeof t=="string"&&t.length>0,"text"),E=g(t=>Number.isSafeInteger(t)&&Number(t)>0,"positive");function S(t){(!m(t)||t.startsWith("/")||t.includes("\\")||t.split("/").some(a=>a===""||a==="."||a===".."))&&i("unknown member coordinate "+String(t))}g(S,"coordinate");function j(t,a){(t.length>a||u(t).byteLength>a)&&i("byte budget")}g(j,"capped");function q(t,a,c){(!t||!t.budget)&&i("missing admitted host handoff");for(const e of["jobs","members","edges","bytes","payloadBytes","env"])E(t.budget[e])||i("missing resource "+e);const o=t.budget;(!(a instanceof Uint8Array)||a.byteLength>o.bytes)&&i("request byte budget"),typeof c!="function"&&i("missing instrument digest"),(!m(t.place)||!m(t.instrument)||!m(t.policy)||!m(t.authoritySnapshot))&&i("missing authority context");for(const e of[t.place,t.instrument,t.policy,t.authoritySnapshot])j(e,o.bytes);(!Array.isArray(t.members)||!Array.isArray(t.loads)||!Array.isArray(t.bindings)||t.members.length>o.members||t.loads.length>o.edges||t.bindings.length>o.jobs)&&i("handoff count budget");let f=a.byteLength;const l=g(e=>{j(e,o.bytes),f+=Math.max(1,u(e).byteLength),f>o.bytes&&i("handoff byte budget")},"charge");for(const e of[t.place,t.instrument,t.policy,t.authoritySnapshot])l(e);const p=new Map;for(const e of t.members)(!e||!(e.bytes instanceof Uint8Array))&&i("missing handed member"),S(e.coordinate),m(e.digest)||i("missing member digest "+e.coordinate),l(e.coordinate),l(e.digest),f+=e.bytes.byteLength,f>o.bytes&&i("member byte budget"),p.has(e.coordinate)&&i("duplicate handed member "+e.coordinate),p.set(e.coordinate,e);const h=new Map;for(const e of t.loads){(!e||!["module","worker","program"].includes(e.kind))&&i("unknown load kind"),S(e.from),typeof e.target!="string"&&i("unknown computed target "+e.from),S(e.target),l(e.from),l(e.target),(!p.has(e.from)||!p.has(e.target))&&i("unhanded load "+e.from+" -> "+e.target);const r=e.from+"\0"+e.kind+"\0"+e.target;(h.get(e.from)??[]).some(n=>n.kind===e.kind&&n.target===e.target)&&i("duplicate load "+r),h.set(e.from,[...h.get(e.from)??[],e])}let N=t.loads.length;const k=new Map;for(const e of t.bindings){(!e||!m(e.id)||k.has(e.id))&&i("duplicate or missing job binding"),l(e.id),(!["process","worker"].includes(e.kind)||e.kind==="worker"&&!e.entry)&&i("unknown or incomplete execution kind "+e.id),(!Array.isArray(e.places)||!Array.isArray(e.args)||!Array.isArray(e.inputs)||!Array.isArray(e.environment)||e.environment.length>o.env||[e.places,e.args,e.inputs].some(n=>Array.isArray(n)&&n.length>o.bytes))&&i("incomplete job binding "+e.id),(new Set(e.places).size!==e.places.length||new Set(e.inputs).size!==e.inputs.length)&&i("duplicate binding coordinate "+e.id);for(const n of[...e.places,...e.args,...e.inputs])typeof n!="string"&&i("nonliteral host argument "+e.id),l(n);for(const n of["timeMs","responseBytes","slots"])(!e.limits||!E(e.limits[n]))&&i("missing launch resource "+e.id+"/"+n);e.limits.slots>o.jobs&&i("launch slots exceed admitted jobs "+e.id);const r=new Set;for(const n of e.environment)(!Array.isArray(n)||n.length!==2||!m(n[0])||typeof n[1]!="string"||r.has(n[0]))&&i("ambiguous environment "+e.id),r.add(n[0]),l(n[0]),l(n[1]);for(const n of[e.program,e.interpreter,e.entry,...e.inputs].filter(w=>w!==void 0))S(n),p.has(n)||i("unhanded launch member "+n);N+=[e.program,e.interpreter,e.entry,...e.inputs].filter(n=>n!==void 0).length,N>o.edges&&i("launch edge budget"),k.set(e.id,e)}let A;try{A=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(a))}catch{i("malformed proposal frame")}if(!Array.isArray(A)||A.length>o.jobs)return i("proposal count budget");const J=new Set,M=[];for(const e of A){(!e||typeof e!="object"||Array.isArray(e)||Object.keys(e).some(n=>n!=="id"&&n!=="payload")||!m(e.id)||typeof e.payload!="string")&&i("world may propose only job id and data"),J.has(e.id)&&i("duplicate proposed job "+e.id),J.add(e.id),j(e.id,o.bytes),j(e.payload,o.payloadBytes);const r=k.get(e.id);if(!r)return i("unknown computed job target "+e.id);r.places.includes(t.place)||i("job not covered at place "+t.place+" "+e.id),M.push(e)}for(const e of p.values())c(e.bytes)!==e.digest&&i("member digest differs "+e.coordinate);return M.map(e=>{const r=k.get(e.id),n=g(s=>[s,p.get(s).digest],"ref"),w=new Set,y=[],O=g(s=>{if(!w.has(s)){w.add(s);for(const d of h.get(s)??[]){const b=d.target;y.push({from:s,kind:d.kind,target:b,digest:p.get(b).digest}),O(b)}}},"visit");for(const s of[r.program,r.interpreter,r.entry,...r.inputs].filter(d=>d!==void 0))O(s);y.sort((s,d)=>v(JSON.stringify(s),JSON.stringify(d)));for(const[s,d]of[["launch",r.program],["interpreter",r.interpreter],["worker-entry",r.entry],...r.inputs.map(b=>["input",b])])d!==void 0&&y.push({from:"job:"+e.id,kind:s,target:d,digest:p.get(d).digest});y.sort((s,d)=>v(JSON.stringify(s),JSON.stringify(d)));const L=r.environment.map(s=>[...s]).sort((s,d)=>v(s[0],d[0])),B=u(e.payload),U=["host-job-proposal",t.place,t.instrument,t.policy,t.authoritySnapshot,e.id,r.kind,n(r.program),r.interpreter?n(r.interpreter):null,r.entry?n(r.entry):null,r.args,r.inputs.map(n),L,[r.limits.timeMs,r.limits.responseBytes,r.limits.slots],y,c(B)];return{id:e.id,kind:r.kind,identity:c(u(JSON.stringify(U)+`
+`)),place:t.place,program:n(r.program),...r.interpreter?{interpreter:n(r.interpreter)}:{},...r.entry?{entry:n(r.entry)}:{},args:[...r.args],payload:B,environment:L,limits:{...r.limits},edges:y}})}g(q,"planJobs");export{q as planJobs};

package/dist/host/native/loader.js

@@ -1,269 +1 @@
-var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
-    if (typeof path === "string" && /^\.\.?\//.test(path)) {
-        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
-            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
-        });
-    }
-    return path;
-};
-import { sha256 as digest } from "../hash.js";
-import { compareStrings as order } from "../order.js";
-import { realpathSync } from 'node:fs';
-import { dirname, join, relative, isAbsolute, sep } from 'node:path';
-import { readBoundedFile } from "./bounded-file.js";
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import * as nodeModule from 'node:module';
-const { builtinModules } = nodeModule;
-const moduleApi = nodeModule.createRequire(import.meta.url)('node:module');
-const fixedRegisterHooks = moduleApi.registerHooks;
-let registrationProtected = false;
-/** Node loader registration is an executable capability, not merely a builtin
- * name. The fixed host retains its captured registration API; imported programs
- * cannot insert a loader returning invented bytes ahead of its load boundary.
- * This does not establish confinement against arbitrary privileged JavaScript.
- */
-export function protectNativeLoaderRegistration() {
-    if (registrationProtected)
-        return;
-    registrationProtected = true;
-    for (const name of ['registerHooks', 'register'])
-        if (typeof moduleApi[name] === 'function')
-            Object.defineProperty(moduleApi, name, { value: () => { throw Error('REFUSE·load runtime loader registration is not a fixed host capability'); }, writable: false, configurable: false });
-    nodeModule.syncBuiltinESMExports();
-}
-const resolutionKey = Symbol.for('bound.native.resolution@1');
-let resolutionCheck;
-let resolutionIdentity;
-let resolutionLibraryNames = Object.freeze([]);
-let resolutionLibraries = Object.freeze([]);
-const resolutionCapability = Object.freeze({ profile: 'fixed-native-resolution@1', get libraryNames() { return resolutionLibraryNames; }, get libraries() { return resolutionLibraries; }, assertPins(pins) {
-        if (!Array.isArray(pins))
-            throw Error('REFUSE·load pinned library request invalid');
-        if (!resolutionCheck)
-            throw Error('REFUSE·load no current fixed library resolution');
-        resolutionCheck(pins);
-    } });
-/** Fixed preload only: expose comparison with the installed resolution, never
- * hook registration or a verifier supplied by a reader. A different module's
- * marker cannot replace this host's closed capability before entry. */
-export function installNativeResolutionReuse(declaration) {
-    const prior = Object.getOwnPropertyDescriptor(globalThis, resolutionKey);
-    if (prior && prior.value !== resolutionCapability)
-        throw Error('REFUSE·load fixed resolution capability collision');
-    if (!prior)
-        Object.defineProperty(globalThis, resolutionKey, { value: resolutionCapability, writable: false, configurable: false });
-    const fail = (why) => { throw Error('REFUSE·load pinned library ' + why); };
-    const actual = (path, why) => { try {
-        return realpathSync(path);
-    }
-    catch {
-        return fail(why);
-    } };
-    const files = declaration.members.map(member => ({ ...member, path: realpathSync(member.path) }));
-    const libraries = new Map(declaration.libraries.map(library => [library.name, realpathSync(library.manifest)]));
-    const coordinates = new Map(declaration.libraries.map(library => [library.name, library.coordinate]));
-    if (libraries.size !== declaration.libraries.length)
-        fail('ambiguous declaration');
-    const namedCoordinates = new Set();
-    for (const coordinate of coordinates.values())
-        if (coordinate !== undefined) {
-            if (typeof coordinate !== 'string' || !coordinate || isAbsolute(coordinate) || coordinate.includes('\\') || coordinate.split('/').some(step => !step || step === '.' || step === '..') || namedCoordinates.has(coordinate))
-                fail('invalid/ambiguous logical library coordinate');
-            namedCoordinates.add(coordinate);
-        }
-    const identity = digest(Buffer.from(JSON.stringify([declaration.platform, files.map(member => [member.path, member.digest, member.bytes]).sort((a, b) => order(String(a[0]), String(b[0]))), [...libraries].sort(([a], [b]) => order(a, b)).map(([name, manifest]) => [name, manifest, coordinates.get(name) ?? null])])));
-    if (resolutionIdentity !== undefined) {
-        if (identity !== resolutionIdentity)
-            fail('late resolution replacement');
-        if (!resolutionCheck)
-            fail('fixed resolution already closed');
-        return () => { };
-    }
-    resolutionIdentity = identity;
-    resolutionLibraryNames = Object.freeze([...libraries.keys()].sort(order));
-    resolutionLibraries = Object.freeze([...libraries].sort(([a], [b]) => order(a, b)).map(([name, manifest]) => Object.freeze({ name, manifest, ...(coordinates.get(name) === undefined ? {} : { coordinate: coordinates.get(name) }) })));
-    const inside = (base, path) => { const step = relative(base, path); return step !== '' && !isAbsolute(step) && step !== '..' && !step.startsWith('..' + sep); };
-    const check = (pins) => {
-        const names = new Set();
-        for (const pin of pins) {
-            if (!pin || typeof pin.name !== 'string' || typeof pin.at !== 'string' || !pin.at || names.has(pin.name))
-                fail('invalid/duplicate selection');
-            names.add(pin.name);
-            const manifest = libraries.get(pin.name) ?? fail('not declared ' + pin.name);
-            const root = dirname(manifest), pinned = actual(pin.at, 'tree absent ' + pin.name), nested = [...libraries.values()].map(dirname).filter(other => inside(root, other));
-            const members = files.filter(member => inside(root, member.path) && !nested.some(other => inside(other, member.path)));
-            if (!members.some(member => member.path === manifest))
-                fail('manifest not sealed ' + pin.name);
-            const manifestMember = members.find(member => member.path === manifest);
-            let pkg;
-            try {
-                pkg = JSON.parse(readBoundedFile(manifest, manifestMember.bytes, manifest).toString('utf8'));
-            }
-            catch {
-                return fail('manifest unreadable ' + pin.name);
-            }
-            if (pkg?.name !== pin.name)
-                fail('manifest name differs ' + pin.name);
-            for (const member of members) {
-                if (!Number.isSafeInteger(member.bytes) || member.bytes < 0 || !/^sha256:[a-f0-9]{64}$/.test(member.digest))
-                    fail('member resource invalid ' + pin.name);
-                const target = actual(join(pinned, relative(root, member.path)), 'member absent ' + pin.name + '/' + relative(root, member.path));
-                if (!inside(pinned, target))
-                    fail('target leaves pinned tree ' + pin.name);
-                if (digest(readBoundedFile(member.path, member.bytes, member.path)) !== member.digest || digest(readBoundedFile(target, member.bytes, target)) !== member.digest)
-                    fail('member differs ' + pin.name + '/' + relative(root, member.path));
-            }
-        }
-    };
-    resolutionCheck = check;
-    return () => { resolutionCheck = undefined; };
-}
-/** Resolution boundary for an instrument-selected native command. It checks
- * actual target bytes before Node executes that target. Native commands remain
- * privileged host implementations: this is not an arbitrary-JS sandbox and
- * cannot prevent trusted code from replacing Node's hooks. That trust condition
- * must be admitted separately; a world cannot claim it in a payload.
- * Native ABI edges refer to the declared platform context, never a fictitious
- * file digest. Completeness of the platform's backing images is not proved here.
- */
-export function loadBoundary(declaration) {
-    const files = new Map(), libraries = new Map(), native = new Set(), edges = [];
-    let refused;
-    const fail = (why) => { refused ?? (refused = 'REFUSE·load ' + why); throw Error(refused); };
-    const verify = (url) => { let path; try {
-        path = realpathSync(fileURLToPath(url));
-    }
-    catch {
-        return fail('target absent ' + url);
-    } const expected = files.get(path); if (!expected)
-        return fail('target undeclared ' + url); if (digest(readBoundedFile(path, expected.bytes, path)) !== expected.digest)
-        return fail('target bytes differ ' + url); return expected.digest; };
-    for (const member of declaration.members) {
-        let path;
-        try {
-            path = realpathSync(member.path);
-        }
-        catch {
-            return fail('member absent ' + member.path);
-        }
-        if (files.has(path) || !Number.isSafeInteger(member.bytes) || member.bytes < 0 || !/^sha256:[0-9a-f]{64}$/.test(member.digest))
-            return fail('member ambiguous ' + member.path);
-        files.set(path, { ...member, path });
-    }
-    for (const member of declaration.members)
-        verify(pathToFileURL(member.path).href);
-    for (const lib of declaration.libraries) {
-        if (!/^(?:@[A-Za-z0-9_.-]+\/)?[A-Za-z0-9_.-]+$/.test(lib.name) || libraries.has(lib.name))
-            return fail('library ambiguous ' + lib.name);
-        const url = pathToFileURL(lib.manifest).href;
-        verify(url);
-        let pkg;
-        try {
-            pkg = JSON.parse(readBoundedFile(lib.manifest, files.get(realpathSync(lib.manifest)).bytes, lib.name).toString('utf8'));
-        }
-        catch {
-            return fail('library manifest invalid ' + lib.name);
-        }
-        if (!pkg || Array.isArray(pkg) || pkg.name !== lib.name)
-            return fail('library name differs ' + lib.name);
-        libraries.set(lib.name, { url, pkg });
-    }
-    for (const name of declaration.builtins) {
-        const normalized = name.startsWith('node:') ? name : 'node:' + name;
-        if (native.has(normalized) || (!builtinModules.includes(normalized) && !builtinModules.includes(normalized.slice(5))))
-            return fail('native ABI ambiguous ' + name);
-        native.add(normalized);
-    }
-    if (!/^sha256:[0-9a-f]{64}$/.test(declaration.platform))
-        return fail('declared platform identity absent');
-    const entry = pathToFileURL(declaration.entry).href;
-    verify(entry);
-    return {
-        entry,
-        resolve(specifier, context, next) {
-            if (refused)
-                throw Error(refused);
-            if (context.parentURL)
-                verify(context.parentURL);
-            const builtin = specifier.startsWith('node:') ? specifier : 'node:' + specifier;
-            if (builtinModules.includes(specifier) || specifier.startsWith('node:')) {
-                if (!native.has(builtin))
-                    return fail('native ABI undeclared ' + specifier);
-                edges.push({ parent: context.parentURL ?? entry, target: builtin, platform: declaration.platform });
-                let resolved;
-                try {
-                    resolved = next(builtin, context);
-                }
-                catch {
-                    return fail('native target unresolved ' + builtin);
-                }
-                if (resolved.url !== builtin)
-                    return fail('native target differs ' + builtin);
-                return resolved;
-            }
-            let selected = context, target = specifier;
-            if (!specifier.startsWith('.') && !specifier.startsWith('/') && !specifier.includes(':')) {
-                const name = specifier.startsWith('@') ? specifier.split('/').slice(0, 2).join('/') : specifier.split('/')[0];
-                const library = libraries.get(name);
-                if (!library)
-                    return fail('library undeclared ' + name);
-                selected = { ...context, parentURL: library.url };
-                if (library.pkg.exports === undefined) {
-                    const subpath = specifier.slice(name.length);
-                    const main = subpath ? subpath.slice(1) : library.pkg.main;
-                    if (typeof main !== 'string' || !main || main.startsWith('/') || main.includes('\\') || main.split('/').includes('..'))
-                        return fail('library target undeclared ' + specifier);
-                    target = main.startsWith('./') ? main : './' + main;
-                }
-            }
-            // Node supplies package/relative resolution semantics. There is no fallback
-            // permission: its result still has to be an exact host-sealed member.
-            let resolved;
-            try {
-                resolved = next(target, selected);
-            }
-            catch {
-                return fail('target unresolved ' + specifier);
-            }
-            if (!resolved.url.startsWith('file:'))
-                return fail('target scheme undeclared ' + resolved.url);
-            const seal = verify(resolved.url);
-            edges.push({ parent: context.parentURL ?? entry, target: resolved.url, digest: seal });
-            return resolved;
-        },
-        load(url, context, next) {
-            if (url.startsWith('node:'))
-                return next(url, context);
-            verify(url);
-            const path = realpathSync(fileURLToPath(url)), member = files.get(path);
-            const loaded = next(url, context);
-            if (loaded.source === undefined || loaded.source === null)
-                return fail('file loader did not expose executable bytes ' + url);
-            const bytes = typeof loaded.source === 'string' ? Buffer.from(loaded.source, 'utf8') : loaded.source;
-            if (bytes.byteLength > member.bytes || digest(bytes) !== member.digest)
-                return fail('actual loaded source differs ' + url);
-            return loaded;
-        },
-        assertClosed() { if (refused)
-            throw Error(refused); for (const member of declaration.members)
-            verify(pathToFileURL(member.path).href); },
-        edges: () => edges.map(edge => ({ ...edge })),
-    };
-}
-/** Install before the entry of an instrument-selected privileged Node command.
- * The bootstrap exception is restricted to this host function's exact selected
- * entry. It is not a permission for a world to choose a verifier or a program.
- * Hooks mediate imports; they do not establish a non-bypass JS sandbox.
- */
-export function installBoundary(declaration) {
-    const boundary = loadBoundary(declaration);
-    const register = fixedRegisterHooks;
-    if (typeof register !== 'function')
-        throw Error('REFUSE·load native hook profile unsupported by runtime');
-    protectNativeLoaderRegistration();
-    const hooks = register({ resolve(specifier, context, next) {
-            const boot = context.parentURL === import.meta.url && specifier === boundary.entry;
-            return boundary.resolve(specifier, boot ? { ...context, parentURL: undefined } : context, next);
-        }, load: boundary.load });
-    return { loadEntry: () => import(__rewriteRelativeImportExtension(boundary.entry)), assertClosed: boundary.assertClosed, edges: boundary.edges, close: () => hooks.deregister() };
-}
+var H=Object.defineProperty;var c=(r,u)=>H(r,"name",{value:u,configurable:!0});var J=function(r,u){return typeof r=="string"&&/^\.\.?\//.test(r)?r.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i,function(i,h,p,l,n){return h?u?".jsx":".js":p&&(!l||!n)?i:p+l+"."+n.toLowerCase()+"js"}):r};import{sha256 as w}from"../hash.js";import{compareStrings as O}from"../order.js";import{realpathSync as R}from"node:fs";import{dirname as M,join as q,relative as W,isAbsolute as x,sep as Z}from"node:path";import{readBoundedFile as U}from"./bounded-file.js";import{fileURLToPath as C,pathToFileURL as z}from"node:url";import*as A from"node:module";const{builtinModules:F}=A,N=A.createRequire(import.meta.url)("node:module"),D=N.registerHooks;let I=!1;function K(){if(!I){I=!0;for(const r of["registerHooks","register"])typeof N[r]=="function"&&Object.defineProperty(N,r,{value:c(()=>{throw Error("REFUSE\xB7load runtime loader registration is not a fixed host capability")},"value"),writable:!1,configurable:!1});A.syncBuiltinESMExports()}}c(K,"protectNativeLoaderRegistration");const P=Symbol.for("bound.native.resolution@1");let j,B,_=Object.freeze([]),$=Object.freeze([]);const T=Object.freeze({profile:"fixed-native-resolution@1",get libraryNames(){return _},get libraries(){return $},assertPins(r){if(!Array.isArray(r))throw Error("REFUSE\xB7load pinned library request invalid");if(!j)throw Error("REFUSE\xB7load no current fixed library resolution");j(r)}});function ne(r){const u=Object.getOwnPropertyDescriptor(globalThis,P);if(u&&u.value!==T)throw Error("REFUSE\xB7load fixed resolution capability collision");u||Object.defineProperty(globalThis,P,{value:T,writable:!1,configurable:!1});const i=c(t=>{throw Error("REFUSE\xB7load pinned library "+t)},"fail"),h=c((t,o)=>{try{return R(t)}catch{return i(o)}},"actual"),p=r.members.map(t=>({...t,path:R(t.path)})),l=new Map(r.libraries.map(t=>[t.name,R(t.manifest)])),n=new Map(r.libraries.map(t=>[t.name,t.coordinate]));l.size!==r.libraries.length&&i("ambiguous declaration");const b=new Set;for(const t of n.values())t!==void 0&&((typeof t!="string"||!t||x(t)||t.includes("\\")||t.split("/").some(o=>!o||o==="."||o==="..")||b.has(t))&&i("invalid/ambiguous logical library coordinate"),b.add(t));const E=w(Buffer.from(JSON.stringify([r.platform,p.map(t=>[t.path,t.digest,t.bytes]).sort((t,o)=>O(String(t[0]),String(o[0]))),[...l].sort(([t],[o])=>O(t,o)).map(([t,o])=>[t,o,n.get(t)??null])])));if(B!==void 0)return E!==B&&i("late resolution replacement"),j||i("fixed resolution already closed"),()=>{};B=E,_=Object.freeze([...l.keys()].sort(O)),$=Object.freeze([...l].sort(([t],[o])=>O(t,o)).map(([t,o])=>Object.freeze({name:t,manifest:o,...n.get(t)===void 0?{}:{coordinate:n.get(t)}})));const e=c((t,o)=>{const a=W(t,o);return a!==""&&!x(a)&&a!==".."&&!a.startsWith(".."+Z)},"inside");return j=c(t=>{const o=new Set;for(const a of t){(!a||typeof a.name!="string"||typeof a.at!="string"||!a.at||o.has(a.name))&&i("invalid/duplicate selection"),o.add(a.name);const d=l.get(a.name)??i("not declared "+a.name),m=M(d),L=h(a.at,"tree absent "+a.name),y=[...l.values()].map(M).filter(f=>e(m,f)),v=p.filter(f=>e(m,f.path)&&!y.some(S=>e(S,f.path)));v.some(f=>f.path===d)||i("manifest not sealed "+a.name);const k=v.find(f=>f.path===d);let g;try{g=JSON.parse(U(d,k.bytes,d).toString("utf8"))}catch{return i("manifest unreadable "+a.name)}g?.name!==a.name&&i("manifest name differs "+a.name);for(const f of v){(!Number.isSafeInteger(f.bytes)||f.bytes<0||!/^sha256:[a-f0-9]{64}$/.test(f.digest))&&i("member resource invalid "+a.name);const S=h(q(L,W(m,f.path)),"member absent "+a.name+"/"+W(m,f.path));e(L,S)||i("target leaves pinned tree "+a.name),(w(U(f.path,f.bytes,f.path))!==f.digest||w(U(S,f.bytes,S))!==f.digest)&&i("member differs "+a.name+"/"+W(m,f.path))}}},"check"),()=>{j=void 0}}c(ne,"installNativeResolutionReuse");function G(r){const u=new Map,i=new Map,h=new Set,p=[];let l;const n=c(e=>{throw l??(l="REFUSE\xB7load "+e),Error(l)},"fail"),b=c(e=>{let s;try{s=R(C(e))}catch{return n("target absent "+e)}const t=u.get(s);return t?w(U(s,t.bytes,s))!==t.digest?n("target bytes differ "+e):t.digest:n("target undeclared "+e)},"verify");for(const e of r.members){let s;try{s=R(e.path)}catch{return n("member absent "+e.path)}if(u.has(s)||!Number.isSafeInteger(e.bytes)||e.bytes<0||!/^sha256:[0-9a-f]{64}$/.test(e.digest))return n("member ambiguous "+e.path);u.set(s,{...e,path:s})}for(const e of r.members)b(z(e.path).href);for(const e of r.libraries){if(!/^(?:@[A-Za-z0-9_.-]+\/)?[A-Za-z0-9_.-]+$/.test(e.name)||i.has(e.name))return n("library ambiguous "+e.name);const s=z(e.manifest).href;b(s);let t;try{t=JSON.parse(U(e.manifest,u.get(R(e.manifest)).bytes,e.name).toString("utf8"))}catch{return n("library manifest invalid "+e.name)}if(!t||Array.isArray(t)||t.name!==e.name)return n("library name differs "+e.name);i.set(e.name,{url:s,pkg:t})}for(const e of r.builtins){const s=e.startsWith("node:")?e:"node:"+e;if(h.has(s)||!F.includes(s)&&!F.includes(s.slice(5)))return n("native ABI ambiguous "+e);h.add(s)}if(!/^sha256:[0-9a-f]{64}$/.test(r.platform))return n("declared platform identity absent");const E=z(r.entry).href;return b(E),{entry:E,resolve(e,s,t){if(l)throw Error(l);s.parentURL&&b(s.parentURL);const o=e.startsWith("node:")?e:"node:"+e;if(F.includes(e)||e.startsWith("node:")){if(!h.has(o))return n("native ABI undeclared "+e);p.push({parent:s.parentURL??E,target:o,platform:r.platform});let y;try{y=t(o,s)}catch{return n("native target unresolved "+o)}return y.url!==o?n("native target differs "+o):y}let a=s,d=e;if(!e.startsWith(".")&&!e.startsWith("/")&&!e.includes(":")){const y=e.startsWith("@")?e.split("/").slice(0,2).join("/"):e.split("/")[0],v=i.get(y);if(!v)return n("library undeclared "+y);if(a={...s,parentURL:v.url},v.pkg.exports===void 0){const k=e.slice(y.length),g=k?k.slice(1):v.pkg.main;if(typeof g!="string"||!g||g.startsWith("/")||g.includes("\\")||g.split("/").includes(".."))return n("library target undeclared "+e);d=g.startsWith("./")?g:"./"+g}}let m;try{m=t(d,a)}catch{return n("target unresolved "+e)}if(!m.url.startsWith("file:"))return n("target scheme undeclared "+m.url);const L=b(m.url);return p.push({parent:s.parentURL??E,target:m.url,digest:L}),m},load(e,s,t){if(e.startsWith("node:"))return t(e,s);b(e);const o=R(C(e)),a=u.get(o),d=t(e,s);if(d.source===void 0||d.source===null)return n("file loader did not expose executable bytes "+e);const m=typeof d.source=="string"?Buffer.from(d.source,"utf8"):d.source;return m.byteLength>a.bytes||w(m)!==a.digest?n("actual loaded source differs "+e):d},assertClosed(){if(l)throw Error(l);for(const e of r.members)b(z(e.path).href)},edges:c(()=>p.map(e=>({...e})),"edges")}}c(G,"loadBoundary");function se(r){const u=G(r),i=D;if(typeof i!="function")throw Error("REFUSE\xB7load native hook profile unsupported by runtime");K();const h=i({resolve(p,l,n){const b=l.parentURL===import.meta.url&&p===u.entry;return u.resolve(p,b?{...l,parentURL:void 0}:l,n)},load:u.load});return{loadEntry:c(()=>import(J(u.entry)),"loadEntry"),assertClosed:u.assertClosed,edges:u.edges,close:c(()=>h.deregister(),"close")}}c(se,"installBoundary");export{se as installBoundary,ne as installNativeResolutionReuse,G as loadBoundary,K as protectNativeLoaderRegistration};

package/dist/host/native/materialize.js

@@ -1,175 +1 @@
-import { sha256 as sha } from "../hash.js";
-/** Fixed host materialization from admitted logical references. Physical locations
- * never arrive from a reader packet and never become semantic source identity.
- */
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync, existsSync, realpathSync, renameSync, chmodSync } from 'node:fs';
-import { join, dirname, relative, sep, extname } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { gunzipSync } from 'node:zlib';
-import { members as archiveMembers, archiveCoordinate } from "../archive.js";
-import { blobAt, storeAt, holdStore } from "../../land/ledger.js";
-import { ContentNeeded } from "../content-needed.js";
-import { processOf, ownRoot } from "../../observe/runner.js";
-import { instrumentCoordinates } from "../../fold/digests.js";
-import { readBoundedFile } from "./bounded-file.js";
-import { assertNativeRouteCurrent, nativeRouteStore, nativeMountIdentity } from "./route.js";
-const fail = (why) => { throw Error('REFUSE·native materialize ' + why); };
-const mounted = new Map();
-function laid(store, digest, remaining) { const path = blobAt(store, digest); if (!existsSync(path))
-    throw new ContentNeeded(digest); const bytes = readBoundedFile(path, remaining, digest); if (sha(bytes) !== digest)
-    fail('laid bytes differ ' + digest); return { path, bytes }; }
-/** Called under the actual Root lease before identity/cache preparation. Missing
- * laid content is a named content demand, never a publisher authority fallback.
- * One retained mount per immutable selection avoids copying it on each ask.
- */
-export function materializeNativeRoute(route) {
-    assertNativeRouteCurrent(route);
-    const store = nativeRouteStore(route), mountIdentity = nativeMountIdentity(route.profile, route.binaries, route.control), key = store + '\0' + mountIdentity, old = mounted.get(key);
-    if (old) {
-        const members = new Map();
-        for (const member of route.profile.selection.members) {
-            if (members.has(member.coordinate))
-                fail('ambiguous image coordinate');
-            members.set(member.coordinate, member);
-        }
-        let bytes = 0;
-        for (const location of old.locations) {
-            const member = members.get(location.member) ?? fail('retained image member not selected ' + location.member);
-            const raw = readBoundedFile(location.path, route.profile.selection.budget.bytes - bytes, location.member);
-            bytes += raw.length;
-            if (sha(raw) !== member.digest)
-                fail('retained image member differs ' + member.coordinate);
-            if (location.kind === 'binary' && location.member !== route.profile.selection.runtime && !route.binaries.some(b => b.profile.entry.path === location.member && b.origin))
-                chmodSync(location.path, 0o555);
-        }
-        return old;
-    }
-    const selection = route.profile.selection, budget = selection.budget;
-    if (!Number.isSafeInteger(budget.bytes) || budget.bytes < 1 || !Number.isSafeInteger(budget.members) || budget.members < 1 || selection.members.length > budget.members)
-        fail('missing image resources');
-    const archive = laid(store, selection.archive, budget.bytes);
-    gunzipSync(archive.bytes, { maxOutputLength: budget.bytes });
-    const files = new Map(archiveMembers(archive.bytes).map(member => [member.name, member.bytes]));
-    let charged = archive.bytes.length, retainedBytes = 0;
-    const root = storeAt(store, 'cas', 'laid', mountIdentity.slice(7)), present = existsSync(root);
-    mkdirSync(dirname(root), { recursive: true });
-    const building = present ? root : mkdtempSync(root + '.part-'), seen = new Set();
-    try {
-        const locations = selection.members.map(member => {
-            const coordinate = archiveCoordinate(member.coordinate);
-            if (coordinate !== member.coordinate || seen.has(coordinate))
-                return fail('ambiguous image coordinate');
-            seen.add(coordinate);
-            const binary = route.binaries.filter(b => b.profile.entry.path === coordinate), origins = binary.flatMap(b => b.origin ? [b.origin] : []);
-            if (new Set(origins.map(o => o.path)).size > 1)
-                fail('conflicting binary origins');
-            const origin = origins[0];
-            if (origin && binary.some(b => !b.origin))
-                fail('conflicting relocation/origin meaning');
-            let bytes, path;
-            if (coordinate === selection.runtime) {
-                path = realpathSync(process.execPath);
-                bytes = readBoundedFile(path, budget.bytes - charged, coordinate);
-            }
-            else if (origin) {
-                path = origin.path;
-                bytes = readBoundedFile(path, budget.bytes - charged, coordinate);
-            }
-            else {
-                const packed = files.get(coordinate);
-                if (packed !== undefined)
-                    bytes = packed;
-                else
-                    bytes = laid(store, member.digest, budget.bytes - charged).bytes;
-                path = join(building, coordinate);
-            }
-            if (binary.some(b => b.profile.entry.bytes !== bytes.length))
-                fail('binary entry byte count differs ' + coordinate);
-            if (bytes.length > budget.bytes - charged || (charged += bytes.length) > budget.bytes)
-                fail('aggregate image and archive bytes exceeded');
-            if (sha(bytes) !== member.digest)
-                fail('image member differs ' + coordinate);
-            if (coordinate !== selection.runtime && !origin) {
-                retainedBytes += bytes.length;
-                if (present) {
-                    const actual = readBoundedFile(path, bytes.length, coordinate);
-                    if (sha(actual) !== member.digest)
-                        fail('retained image member differs ' + coordinate);
-                }
-                else {
-                    mkdirSync(dirname(path), { recursive: true });
-                    writeFileSync(path, bytes, { flag: 'wx', mode: binary.length ? 0o555 : 0o444 });
-                }
-                if (binary.length)
-                    chmodSync(path, 0o555);
-            }
-            return { member: coordinate, path, kind: coordinate === selection.runtime || binary.length ? 'binary' : /\.(?:[mc]?js|ts)$/.test(coordinate) ? 'module' : 'data' };
-        });
-        if (!present) {
-            renameSync(building, root);
-            for (const location of locations)
-                if (location.member !== selection.runtime && !route.binaries.some(b => b.profile.entry.path === location.member && b.origin))
-                    location.path = join(root, location.member);
-            holdStore(store, 'laid', mountIdentity, retainedBytes);
-        }
-        const result = { archive: archive.path, locations, cwd: root, mountIdentity };
-        mounted.set(key, result);
-        return result;
-    }
-    catch (error) {
-        if (!present)
-            rmSync(building, { recursive: true, force: true });
-        throw error;
-    }
-}
-/** Fixed child, lifetime supervisor and transitive host modules enter identity
- * before the cache key. Existing instrument closure resolves actual dependencies;
- * this descriptor never executes a module and never accepts a world verifier.
- */
-export function nativeExecutorInputs(route) {
-    const store = nativeRouteStore(route), all = new Map();
-    for (const entry of [...(route.control ? [fileURLToPath(new URL('./control-bridge-worker' + extname(new URL(import.meta.url).pathname), import.meta.url))] : []), processOf('native'), processOf('lifetime', 'host'), processOf('custodian'), processOf('native-descendant'), processOf('preload', 'host/native')])
-        for (const [path, digest] of instrumentCoordinates(store, entry, [], ownRoot(), [], true))
-            all.set(path, digest);
-    const refs = [];
-    let bytes = 0;
-    for (const [path, digest] of all) {
-        const held = readBoundedFile(path, route.profile.selection.budget.bytes - bytes, path);
-        bytes += held.length;
-        if (sha(held) !== digest)
-            fail('fixed executor changed during descriptor');
-        const local = relative(ownRoot(), path);
-        let name;
-        if (!local.startsWith('..' + sep) && local !== '..')
-            name = local.split(sep).join('/');
-        else {
-            let cursor = dirname(path);
-            for (;;) {
-                const manifest = join(cursor, 'package.json');
-                if (existsSync(manifest)) {
-                    let pkg;
-                    try {
-                        const raw = readBoundedFile(manifest, route.profile.selection.budget.bytes - bytes, manifest);
-                        bytes += raw.length;
-                        pkg = JSON.parse(raw.toString('utf8'));
-                        if (typeof pkg.name === 'string')
-                            refs.push([['native/executor/library', pkg.name, 'package.json'].join('/'), sha(raw)]);
-                    }
-                    catch {
-                        return fail('fixed dependency manifest invalid');
-                    }
-                    if (typeof pkg.name !== 'string')
-                        return fail('fixed dependency has no declared name');
-                    name = 'library/' + pkg.name + '/' + relative(cursor, path).split(sep).join('/');
-                    break;
-                }
-                const parent = dirname(cursor);
-                if (parent === cursor)
-                    return fail('fixed dependency logical coordinates absent');
-                cursor = parent;
-            }
-        }
-        refs.push(['native/executor/' + name, digest]);
-    }
-    return [...new Map(refs).entries()];
-}
+var W=Object.defineProperty;var N=(e,s)=>W(e,"name",{value:s,configurable:!0});import{sha256 as k}from"../hash.js";import{mkdtempSync as $,mkdirSync as F,writeFileSync as q,rmSync as D,existsSync as E,realpathSync as G,renameSync as H,chmodSync as O}from"node:fs";import{join as L,dirname as C,relative as A,sep as U,extname as K}from"node:path";import{fileURLToPath as Q}from"node:url";import{gunzipSync as V}from"node:zlib";import{members as X,archiveCoordinate as Y}from"../archive.js";import{blobAt as Z,storeAt as _,holdStore as ee}from"../../land/ledger.js";import{ContentNeeded as te}from"../content-needed.js";import{processOf as I,ownRoot as B}from"../../observe/runner.js";import{instrumentCoordinates as ie}from"../../fold/digests.js";import{readBoundedFile as S}from"./bounded-file.js";import{assertNativeRouteCurrent as ne,nativeRouteStore as P,nativeMountIdentity as re}from"./route.js";const o=N(e=>{throw Error("REFUSE\xB7native materialize "+e)},"fail"),J=new Map;function T(e,s,b){const d=Z(e,s);if(!E(d))throw new te(s);const c=S(d,b,s);return k(c)!==s&&o("laid bytes differ "+s),{path:d,bytes:c}}N(T,"laid");function ue(e){ne(e);const s=P(e),b=re(e.profile,e.binaries,e.control),d=s+"\0"+b,c=J.get(d);if(c){const f=new Map;for(const t of e.profile.selection.members)f.has(t.coordinate)&&o("ambiguous image coordinate"),f.set(t.coordinate,t);let R=0;for(const t of c.locations){const i=f.get(t.member)??o("retained image member not selected "+t.member),u=S(t.path,e.profile.selection.budget.bytes-R,t.member);R+=u.length,k(u)!==i.digest&&o("retained image member differs "+i.coordinate),t.kind==="binary"&&t.member!==e.profile.selection.runtime&&!e.binaries.some(j=>j.profile.entry.path===t.member&&j.origin)&&O(t.path,365)}return c}const r=e.profile.selection,n=r.budget;(!Number.isSafeInteger(n.bytes)||n.bytes<1||!Number.isSafeInteger(n.members)||n.members<1||r.members.length>n.members)&&o("missing image resources");const g=T(s,r.archive,n.bytes);V(g.bytes,{maxOutputLength:n.bytes});const M=new Map(X(g.bytes).map(f=>[f.name,f.bytes]));let y=g.bytes.length,v=0;const m=_(s,"cas","laid",b.slice(7)),w=E(m);F(C(m),{recursive:!0});const h=w?m:$(m+".part-"),x=new Set;try{const f=r.members.map(t=>{const i=Y(t.coordinate);if(i!==t.coordinate||x.has(i))return o("ambiguous image coordinate");x.add(i);const u=e.binaries.filter(a=>a.profile.entry.path===i),j=u.flatMap(a=>a.origin?[a.origin]:[]);new Set(j.map(a=>a.path)).size>1&&o("conflicting binary origins");const z=j[0];z&&u.some(a=>!a.origin)&&o("conflicting relocation/origin meaning");let l,p;if(i===r.runtime)p=G(process.execPath),l=S(p,n.bytes-y,i);else if(z)p=z.path,l=S(p,n.bytes-y,i);else{const a=M.get(i);a!==void 0?l=a:l=T(s,t.digest,n.bytes-y).bytes,p=L(h,i)}if(u.some(a=>a.profile.entry.bytes!==l.length)&&o("binary entry byte count differs "+i),(l.length>n.bytes-y||(y+=l.length)>n.bytes)&&o("aggregate image and archive bytes exceeded"),k(l)!==t.digest&&o("image member differs "+i),i!==r.runtime&&!z){if(v+=l.length,w){const a=S(p,l.length,i);k(a)!==t.digest&&o("retained image member differs "+i)}else F(C(p),{recursive:!0}),q(p,l,{flag:"wx",mode:u.length?365:292});u.length&&O(p,365)}return{member:i,path:p,kind:i===r.runtime||u.length?"binary":/\.(?:[mc]?js|ts)$/.test(i)?"module":"data"}});if(!w){H(h,m);for(const t of f)t.member!==r.runtime&&!e.binaries.some(i=>i.profile.entry.path===t.member&&i.origin)&&(t.path=L(m,t.member));ee(s,"laid",b,v)}const R={archive:g.path,locations:f,cwd:m,mountIdentity:b};return J.set(d,R),R}catch(f){throw w||D(h,{recursive:!0,force:!0}),f}}N(ue,"materializeNativeRoute");function ve(e){const s=P(e),b=new Map;for(const r of[...e.control?[Q(new URL("./control-bridge-worker"+K(new URL(import.meta.url).pathname),import.meta.url))]:[],I("native"),I("lifetime","host"),I("custodian"),I("native-descendant"),I("preload","host/native")])for(const[n,g]of ie(s,r,[],B(),[],!0))b.set(n,g);const d=[];let c=0;for(const[r,n]of b){const g=S(r,e.profile.selection.budget.bytes-c,r);c+=g.length,k(g)!==n&&o("fixed executor changed during descriptor");const M=A(B(),r);let y;if(!M.startsWith(".."+U)&&M!=="..")y=M.split(U).join("/");else{let v=C(r);for(;;){const m=L(v,"package.json");if(E(m)){let h;try{const x=S(m,e.profile.selection.budget.bytes-c,m);c+=x.length,h=JSON.parse(x.toString("utf8")),typeof h.name=="string"&&d.push([["native/executor/library",h.name,"package.json"].join("/"),k(x)])}catch{return o("fixed dependency manifest invalid")}if(typeof h.name!="string")return o("fixed dependency has no declared name");y="library/"+h.name+"/"+A(v,r).split(U).join("/");break}const w=C(v);if(w===v)return o("fixed dependency logical coordinates absent");v=w}}d.push(["native/executor/"+y,n])}return[...new Map(d).entries()]}N(ve,"nativeExecutorInputs");export{ue as materializeNativeRoute,ve as nativeExecutorInputs};