@pulse-compute/provider-node 0.0.0 → 1.0.0-beta.1

package/src/compiler/node-compiled-wasm-assets-lifecycle-proof.js

@@ -0,0 +1,435 @@
+'use strict';
+
+function loadAssetsContracts() {
+  try {
+    return require('@pulse-compute/wasm-contracts/assets/contracts');
+  } catch (error) {
+    if (error && error.code === 'MODULE_NOT_FOUND' && String(error.message).includes('@pulse-compute/wasm-contracts')) {
+      return require('../../../../wasm/packages/contracts/src/assets/contracts.js');
+    }
+    throw error;
+  }
+}
+
+function loadDiagnostics() {
+  try {
+    return require('@pulse-compute/wasm-contracts/diagnostics');
+  } catch (error) {
+    if (error && error.code === 'MODULE_NOT_FOUND' && String(error.message).includes('@pulse-compute/wasm-contracts')) {
+      return require('../../../../wasm/packages/contracts/src/diagnostics.js');
+    }
+    throw error;
+  }
+}
+
+const assetsContracts = loadAssetsContracts();
+const { PACKAGE_VERSION, normalizeArtifact, normalizeDiagnostic, stableFileName } = loadDiagnostics();
+const {
+  createNodeCompiledWasmAssetsLifecycleRuntime,
+  normalizeHeaders
+} = require('../runtime/assets-provider.js');
+
+const phaseName = 'node-compiled-wasm-assets-lifecycle-proof';
+
+function clone(value) {
+  if (Array.isArray(value)) return value.map(clone);
+  if (value && typeof value === 'object') return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, clone(entry)]));
+  return value;
+}
+
+function normalizePlan(input) {
+  const plan = input && input.artifact ? input.artifact : input;
+  if (!plan || typeof plan !== 'object') return undefined;
+  return {
+    ...plan,
+    entries: Array.isArray(plan.entries) ? plan.entries.map(clone) : []
+  };
+}
+
+function normalizeSidecarPlan(input) {
+  const plan = input && input.artifact ? input.artifact : input;
+  if (!plan || typeof plan !== 'object') return undefined;
+  return {
+    ...plan,
+    terminalAssetResponseEffects: Array.isArray(plan.terminalAssetResponseEffects) ? plan.terminalAssetResponseEffects.map(clone) : []
+  };
+}
+
+function makeDiagnostic(code, message, severity, details, hint) {
+  return normalizeDiagnostic({
+    phase: phaseName,
+    severity: severity || 'error',
+    code,
+    message,
+    hint: hint || (details && details.hint),
+    details,
+    loc: { file: '<node-compiled-wasm-assets-lifecycle-proof>' }
+  });
+}
+
+function check(name, passed, details, failures, diagnostics) {
+  const entry = { name, status: passed ? 'ok' : 'error', details: details || {} };
+  if (!passed) {
+    failures.push(entry);
+    diagnostics.push(makeDiagnostic(
+      assetsContracts.ASSETS_DIAGNOSTIC_CODES.NODE_COMPILED_LIFECYCLE_SMOKE_FAILED,
+      `Node compiled-Wasm assets lifecycle check failed: ${name}.`,
+      'error',
+      { check: name, details: entry.details }
+    ));
+  }
+  return entry;
+}
+
+function headerValue(headers, name) {
+  const lower = String(name).toLowerCase();
+  const found = normalizeHeaders(headers).find(([key]) => String(key).toLowerCase() === lower);
+  return found ? found[1] : undefined;
+}
+
+function resultBody(result) {
+  if (!result) return undefined;
+  if (result.body !== undefined) return String(result.body);
+  if (result.kind === 'stream' && result.bodyStream && Array.isArray(result.bodyStream.chunks)) {
+    return result.bodyStream.chunks.map((chunk) => Buffer.isBuffer(chunk) ? chunk.toString('utf8') : String(chunk)).join('');
+  }
+  return undefined;
+}
+
+function sanitizeResult(result) {
+  if (!result) return undefined;
+  return {
+    status: result.status,
+    kind: result.kind,
+    body: resultBody(result),
+    bodyLength: resultBody(result) ? resultBody(result).length : 0,
+    headers: normalizeHeaders(result.headers),
+    diagnostics: (result.diagnostics || []).map((entry) => ({ code: entry.code, severity: entry.severity, message: entry.message }))
+  };
+}
+
+function findEffect(effects, method) {
+  const upper = String(method || 'GET').toUpperCase();
+  return effects.find((entry) => String(entry.method || 'GET').toUpperCase() === upper) || effects[0];
+}
+
+function codeSet(result) {
+  return new Set((result && result.diagnostics || []).map((entry) => entry.code));
+}
+
+function negativeCaseFlag(negativeCases, name, fallback) {
+  if (negativeCases && Object.prototype.hasOwnProperty.call(negativeCases, name)) return negativeCases[name] === true;
+  return Boolean(fallback);
+}
+
+function buildNodeCompiledWasmAssetsLifecycleProof(inputs = {}) {
+  const cwd = inputs.cwd || process.cwd();
+  const generatedBy = inputs.generatedBy || PACKAGE_VERSION;
+  const plan = normalizePlan(inputs.assetsLoweringPlan || inputs.plan);
+  const sidecarPlan = normalizeSidecarPlan(inputs.assetsCompiledWasmSidecarPlan || inputs.sidecarPlan);
+  const diagnostics = [];
+  const checks = [];
+  const failures = [];
+  const negativeCases = inputs.negativeCases || {};
+
+  if (!plan) {
+    diagnostics.push(makeDiagnostic(
+      assetsContracts.ASSETS_DIAGNOSTIC_CODES.NODE_PROVIDER_PLAN_REQUIRED,
+      'Node compiled-Wasm assets lifecycle proof requires an assets-lowering-plan artifact.',
+      'error',
+      { sourceArtifact: assetsContracts.ASSETS_LOWERING_PLAN_VERSION }
+    ));
+  }
+  if (!sidecarPlan) {
+    diagnostics.push(makeDiagnostic(
+      assetsContracts.ASSETS_DIAGNOSTIC_CODES.SIDECAR_FILE_MISSING,
+      'Node compiled-Wasm assets lifecycle proof requires an assets-compiled-wasm-sidecar-plan artifact.',
+      'error',
+      { sourceArtifact: assetsContracts.ASSETS_COMPILED_WASM_SIDECAR_PLAN_ARTIFACT }
+    ));
+  }
+
+  const terminalEffects = sidecarPlan && sidecarPlan.terminalAssetResponseEffects || [];
+  const getEffect = findEffect(terminalEffects, 'GET');
+  const headEffect = findEffect(terminalEffects, 'HEAD');
+  const missingEffect = getEffect ? {
+    ...clone(getEffect),
+    id: `${getEffect.id || 'asset'}-missing`,
+    key: '/__pulsewasm-missing-asset__',
+    method: 'GET'
+  } : undefined;
+
+  let runtime;
+  let executions = [];
+  let storeConfigProbeCodes = new Set();
+  try {
+    if (plan && sidecarPlan) {
+      runtime = createNodeCompiledWasmAssetsLifecycleRuntime({
+        cwd,
+        configRoot: inputs.configRoot,
+        assetConfig: inputs.assetConfig,
+        resolvedConfig: inputs.resolvedConfig,
+        assetsLoweringPlan: plan,
+        assetsCompiledWasmSidecarPlan: sidecarPlan,
+        extraTerminalEffects: missingEffect ? [missingEffect] : [],
+        mode: inputs.mode || 'compiled-wasm-assets-lifecycle'
+      });
+      diagnostics.push(...(runtime.diagnostics || []));
+      executions = runtime.executeAll();
+    }
+  } catch (error) {
+    diagnostics.push(makeDiagnostic(
+      assetsContracts.ASSETS_DIAGNOSTIC_CODES.NODE_COMPILED_LIFECYCLE_SMOKE_FAILED,
+      'Node compiled-Wasm assets lifecycle smoke execution failed.',
+      'error',
+      { message: error && error.message ? error.message : String(error), stack: error && error.stack ? error.stack : undefined }
+    ));
+  }
+
+  if (plan && sidecarPlan) {
+    try {
+      const probe = createNodeCompiledWasmAssetsLifecycleRuntime({
+        cwd,
+        configRoot: inputs.configRoot,
+        assetsLoweringPlan: plan,
+        assetsCompiledWasmSidecarPlan: sidecarPlan,
+        mode: 'compiled-wasm-assets-lifecycle-missing-store-config-probe'
+      });
+      storeConfigProbeCodes = codeSet(probe);
+    } catch (error) {
+      if (error && Array.isArray(error.diagnostics)) storeConfigProbeCodes = new Set(error.diagnostics.map((entry) => entry.code));
+    }
+  }
+
+  const byId = new Map(executions.map((entry) => [entry.effect && entry.effect.id, entry]));
+  const getExecution = getEffect ? byId.get(getEffect.id) : undefined;
+  const headExecution = headEffect ? byId.get(headEffect.id) : undefined;
+  const missingExecution = missingEffect ? byId.get(missingEffect.id) : undefined;
+  const getResult = getExecution && getExecution.response;
+  const headResult = headExecution && headExecution.response;
+  const missingResult = missingExecution && missingExecution.response;
+
+  checks.push(check(
+    'compiled_wasm_module_imports_assets_hostcalls',
+    Boolean(runtime && runtime.wasm.imports.some((entry) => entry.module === 'pulse_assets' && entry.name === 'pulse_assets_lookup') && runtime.wasm.imports.some((entry) => entry.module === 'pulse_assets' && entry.name === 'pulse_assets_respond')),
+    { imports: runtime && runtime.wasm.imports },
+    failures,
+    diagnostics
+  ));
+  checks.push(check(
+    'terminal_asset_response_effect_validated',
+    executions.length >= terminalEffects.length && executions.every((entry) => entry.resultHandle > 0 && entry.lookup && entry.response),
+    { executions: executions.map((entry) => ({ id: entry.effect && entry.effect.id, resultHandle: entry.resultHandle, lookup: entry.lookup && { store: entry.lookup.store, key: entry.lookup.key, method: entry.lookup.method }, response: sanitizeResult(entry.response) })) },
+    failures,
+    diagnostics
+  ));
+  checks.push(check(
+    'get_text_asset_validated',
+    Boolean(getResult && getResult.status === 200 && getResult.kind === 'text' && resultBody(getResult) && resultBody(getResult).length > 0),
+    { response: sanitizeResult(getResult) },
+    failures,
+    diagnostics
+  ));
+  checks.push(check(
+    'head_asset_bodyless_validated',
+    Boolean(headResult && headResult.status === 200 && headResult.kind === 'empty' && headResult.body === undefined),
+    { response: sanitizeResult(headResult) },
+    failures,
+    diagnostics
+  ));
+  checks.push(check(
+    'headers_validated',
+    Boolean(getResult && headerValue(getResult.headers, 'content-type') && headerValue(getResult.headers, 'x-pulsewasm-asset-key') === (getEffect && getEffect.key)),
+    { contentType: getResult && headerValue(getResult.headers, 'content-type'), assetKey: getResult && headerValue(getResult.headers, 'x-pulsewasm-asset-key') },
+    failures,
+    diagnostics
+  ));
+  checks.push(check(
+    'cache_control_validated',
+    Boolean(getResult && headerValue(getResult.headers, 'cache-control') === (getEffect && getEffect.cacheControl || 'public, max-age=60')),
+    { expected: getEffect && getEffect.cacheControl || 'public, max-age=60', actual: getResult && headerValue(getResult.headers, 'cache-control') },
+    failures,
+    diagnostics
+  ));
+  checks.push(check(
+    'missing_asset_validated',
+    Boolean(missingResult && missingResult.status === 404 && missingResult.kind === 'empty'),
+    { response: sanitizeResult(missingResult) },
+    failures,
+    diagnostics
+  ));
+  checks.push(check(
+    'explicit_store_config_required',
+    storeConfigProbeCodes.has(assetsContracts.ASSETS_DIAGNOSTIC_CODES.STORE_CONFIG_REQUIRED),
+    { diagnosticCodes: Array.from(storeConfigProbeCodes).sort() },
+    failures,
+    diagnostics
+  ));
+
+  const sidecarRestrictions = sidecarPlan && sidecarPlan.restrictions || {};
+  const dynamicKeysRejected = negativeCaseFlag(negativeCases, 'dynamicKeysRejected', sidecarRestrictions.dynamicKeysSupported === false);
+  const handleEscapeRejected = negativeCaseFlag(negativeCases, 'handleEscapeRejected', sidecarRestrictions.handleEscapeSupported === false);
+  const binaryBodyReserved = negativeCaseFlag(negativeCases, 'binaryBodyReserved', sidecarRestrictions.binaryBodySupported === false);
+  const streamPlanOnly = negativeCaseFlag(negativeCases, 'streamBodyPlanOnly', sidecarRestrictions.streamBodyCompiledWasmReadiness === 'plan-only');
+
+  checks.push(check('dynamic_keys_rejected', dynamicKeysRejected, { diagnostic: assetsContracts.ASSETS_DIAGNOSTIC_CODES.DYNAMIC_KEY_UNSUPPORTED }, failures, diagnostics));
+  checks.push(check('asset_handle_escape_rejected', handleEscapeRejected, { diagnostic: assetsContracts.ASSETS_DIAGNOSTIC_CODES.HANDLE_ESCAPE_UNSUPPORTED }, failures, diagnostics));
+  checks.push(check('compiled_binary_body_reserved', binaryBodyReserved, { diagnostic: assetsContracts.ASSETS_DIAGNOSTIC_CODES.COMPILED_BINARY_RESERVED }, failures, diagnostics));
+  checks.push(check('compiled_stream_body_plan_only', streamPlanOnly, { diagnostic: assetsContracts.ASSETS_DIAGNOSTIC_CODES.COMPILED_STREAM_PLAN_ONLY }, failures, diagnostics));
+
+  const errorDiagnostics = diagnostics.filter((entry) => (entry.severity || 'error') === 'error');
+  const artifact = normalizeArtifact({
+    version: assetsContracts.ASSETS_NODE_COMPILED_WASM_LIFECYCLE_PROOF_VERSION,
+    generatedBy,
+    phase: phaseName,
+    artifact: assetsContracts.ASSETS_NODE_COMPILED_WASM_LIFECYCLE_PROOF_ARTIFACT,
+    provider: 'node',
+    providerPackage: '@pulse-compute/provider-node',
+    contractId: assetsContracts.ASSETS_CONTRACT_ID,
+    status: errorDiagnostics.length === 0 ? 'ok' : 'error',
+    sourceAssetsLoweringPlanVersion: plan && plan.version,
+    sourceAssetsCompiledWasmSidecarPlanVersion: sidecarPlan && sidecarPlan.version,
+    loweringPlanConnected: Boolean(plan),
+    sidecarPlanConnected: Boolean(sidecarPlan),
+    compiledWasmLowering: true,
+    compiledWasmRuntimeBehaviorImplemented: errorDiagnostics.length === 0,
+    terminalAssetResponseEffectValidated: checks.some((entry) => entry.name === 'terminal_asset_response_effect_validated' && entry.status === 'ok'),
+    getTextAssetValidated: checks.some((entry) => entry.name === 'get_text_asset_validated' && entry.status === 'ok'),
+    headAssetValidated: checks.some((entry) => entry.name === 'head_asset_bodyless_validated' && entry.status === 'ok'),
+    headersValidated: checks.some((entry) => entry.name === 'headers_validated' && entry.status === 'ok'),
+    cacheControlValidated: checks.some((entry) => entry.name === 'cache_control_validated' && entry.status === 'ok'),
+    missingAssetValidated: checks.some((entry) => entry.name === 'missing_asset_validated' && entry.status === 'ok'),
+    storeConfigRequired: checks.some((entry) => entry.name === 'explicit_store_config_required' && entry.status === 'ok'),
+    dynamicKeysRejected,
+    handleEscapeRejected,
+    binaryBodyReserved,
+    streamBodyReadiness: 'plan-only',
+    userAuthoredAsync: false,
+    promises: false,
+    asyncAwait: false,
+    asyncify: false,
+    runtime: {
+      version: assetsContracts.ASSETS_NODE_COMPILED_WASM_LIFECYCLE_RUNTIME_VERSION,
+      package: '@pulse-compute/provider-node/runtime/assets-provider',
+      mode: inputs.mode || 'compiled-wasm-assets-lifecycle',
+      actualAssemblyScriptCompilerRequired: false,
+      generatedInMemoryWasmModule: true
+    },
+    wasmModule: runtime ? {
+      byteLength: runtime.wasm.byteLength,
+      imports: runtime.wasm.imports,
+      exports: runtime.wasm.exports,
+      routeExports: runtime.wasm.exports.filter((entry) => entry.kind === 'function' && String(entry.name).startsWith('pulse_assets_route_')).map((entry) => entry.name)
+    } : undefined,
+    storeConfig: runtime ? {
+      explicit: true,
+      stores: runtime.storeConfig.configuredStores.map((entry) => ({
+        store: entry.store,
+        mode: entry.mode,
+        methods: entry.methods,
+        responseBody: entry.responseBody,
+        cacheControl: entry.cacheControl,
+        dir: stableFileName(entry.dir, cwd)
+      }))
+    } : undefined,
+    entriesConsumed: terminalEffects.map(clone),
+    syntheticEffects: missingEffect ? [{ id: missingEffect.id, key: missingEffect.key, method: missingEffect.method, purpose: 'missing asset deterministic 404 proof' }] : [],
+    smoke: {
+      checks,
+      failedChecks: failures,
+      executions: executions.map((entry) => ({
+        index: entry.index,
+        exportName: entry.exportName,
+        resultHandle: entry.resultHandle,
+        effect: entry.effect,
+        lookup: entry.lookup,
+        response: sanitizeResult(entry.response)
+      }))
+    },
+    negativeCases: {
+      storeConfigRequired: {
+        rejected: storeConfigProbeCodes.has(assetsContracts.ASSETS_DIAGNOSTIC_CODES.STORE_CONFIG_REQUIRED),
+        diagnostic: assetsContracts.ASSETS_DIAGNOSTIC_CODES.STORE_CONFIG_REQUIRED
+      },
+      dynamicKey: {
+        rejected: dynamicKeysRejected,
+        diagnostic: assetsContracts.ASSETS_DIAGNOSTIC_CODES.DYNAMIC_KEY_UNSUPPORTED,
+        loweringDiagnostic: assetsContracts.ASSETS_DIAGNOSTIC_CODES.NON_LITERAL_LOOKUP
+      },
+      handleEscape: {
+        rejected: handleEscapeRejected,
+        diagnostic: assetsContracts.ASSETS_DIAGNOSTIC_CODES.HANDLE_ESCAPE_UNSUPPORTED
+      },
+      binaryBody: {
+        reserved: binaryBodyReserved,
+        diagnostic: assetsContracts.ASSETS_DIAGNOSTIC_CODES.COMPILED_BINARY_RESERVED,
+        loweringDiagnostic: assetsContracts.ASSETS_DIAGNOSTIC_CODES.BINARY_BODY_RESERVED
+      },
+      streamBody: {
+        readiness: 'plan-only',
+        diagnostic: assetsContracts.ASSETS_DIAGNOSTIC_CODES.COMPILED_STREAM_PLAN_ONLY,
+        loweringDiagnostic: assetsContracts.ASSETS_DIAGNOSTIC_CODES.STREAM_PROVIDER_NOT_WIRED
+      }
+    },
+    policy: {
+      providerOwnsRuntimeBehavior: true,
+      compilerOrchestratesOnly: true,
+      packageOwnsSidecarAndLowerer: true,
+      sidecarPlanRequired: true,
+      storeConfigRequired: true,
+      continuationRequired: false,
+      directProviderProofFallback: false,
+      compiledWasmModuleExecuted: Boolean(runtime && executions.length > 0),
+      assemblyScriptInstallRequiredForProof: false
+    },
+    scope: {
+      methods: clone(assetsContracts.ASSETS_ALLOWED_METHODS),
+      payloadModes: ['text-response-body'],
+      localStoreMode: true,
+      uploads: false,
+      mutationApis: false,
+      binaryBody: false,
+      streamBodyReadiness: 'plan-only',
+      dynamicKeys: false,
+      handleEscape: false
+    },
+    summary: {
+      compiledWasmLowering: true,
+      compiledWasmRuntimeBehaviorImplemented: errorDiagnostics.length === 0,
+      terminalAssetResponseEffectValidated: checks.some((entry) => entry.name === 'terminal_asset_response_effect_validated' && entry.status === 'ok'),
+      getTextAssetValidated: checks.some((entry) => entry.name === 'get_text_asset_validated' && entry.status === 'ok'),
+      headAssetValidated: checks.some((entry) => entry.name === 'head_asset_bodyless_validated' && entry.status === 'ok'),
+      headersValidated: checks.some((entry) => entry.name === 'headers_validated' && entry.status === 'ok'),
+      cacheControlValidated: checks.some((entry) => entry.name === 'cache_control_validated' && entry.status === 'ok'),
+      missingAssetValidated: checks.some((entry) => entry.name === 'missing_asset_validated' && entry.status === 'ok'),
+      storeConfigRequired: checks.some((entry) => entry.name === 'explicit_store_config_required' && entry.status === 'ok'),
+      dynamicKeysRejected,
+      handleEscapeRejected,
+      binaryBodyReserved,
+      streamBodyReadiness: 'plan-only',
+      userAuthoredAsync: false,
+      promises: false,
+      asyncAwait: false,
+      asyncify: false,
+      checks: checks.length,
+      failedChecks: failures.length,
+      diagnostics: diagnostics.length,
+      errorDiagnostics: errorDiagnostics.length,
+      errors: errorDiagnostics.length
+    },
+    diagnostics
+  }, cwd);
+
+  return {
+    artifact,
+    diagnostics,
+    runtime,
+    smoke: artifact.smoke,
+    hasErrors: errorDiagnostics.length > 0
+  };
+}
+
+module.exports = {
+  phaseName,
+  buildNodeCompiledWasmAssetsLifecycleProof
+};

package/src/compiler/request-json-body-proof.js

@@ -0,0 +1,181 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+function loadRequestJsonContracts() {
+  const local = path.resolve(__dirname, '../../../../wasm/packages/contracts/src/handler/request-json-body.js');
+  if (fs.existsSync(local)) return require(local);
+  return require('@pulse-compute/wasm-contracts/handler/request-json-body');
+}
+function loadDiagnostics() {
+  const local = path.resolve(__dirname, '../../../../wasm/packages/contracts/src/diagnostics.js');
+  if (fs.existsSync(local)) return require(local);
+  return require('@pulse-compute/wasm-contracts/diagnostics');
+}
+function loadArtifactsDir() {
+  const local = path.resolve(__dirname, '../../../../wasm/packages/build-support/src/artifacts-dir.js');
+  if (fs.existsSync(local)) return require(local);
+  return require('@pulse-compute/wasm-build-support/artifacts-dir');
+}
+const requestJson = loadRequestJsonContracts();
+const { PACKAGE_VERSION, normalizeArtifact, normalizeDiagnostic } = loadDiagnostics();
+const { getDefaultArtifactsDir } = loadArtifactsDir();
+const { createCompiledHandlerBridgeRuntime, findCompiledHandlerWasm } = require('./route-handler-compiled-wasm-bridge.js');
+
+const phaseName = 'node-request-json-body-proof';
+
+function clone(value) {
+  if (Array.isArray(value)) return value.map(clone);
+  if (value && typeof value === 'object') return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, clone(entry)]));
+  return value;
+}
+function normalizePlan(input) {
+  const plan = input && input.artifact && typeof input.artifact === 'object' ? input.artifact : input;
+  if (!plan || typeof plan !== 'object') return undefined;
+  return { ...plan, routes: Array.isArray(plan.routes) ? plan.routes.map(clone) : [] };
+}
+function requestJsonRoutes(plan) {
+  return (Array.isArray(plan && plan.routes) ? plan.routes : []).filter((route) => route && route.required);
+}
+function makeDiagnostic(code, message, severity, details, hint) {
+  return normalizeDiagnostic({ phase: phaseName, severity: severity || 'error', code, message, hint, details, loc: { file: '<node-request-json-body-proof>' } });
+}
+function check(name, ok, details, failures, diagnostics) {
+  const entry = { name, status: ok ? 'ok' : 'error', details: sanitize(details || {}) };
+  if (!ok) {
+    failures.push(entry);
+    diagnostics.push(makeDiagnostic(requestJson.REQUEST_JSON_BODY_DIAGNOSTICS.compiledSmokeFailed, `Node request JSON body proof check failed: ${name}.`, 'error', entry.details));
+  }
+  return entry;
+}
+function sanitize(value) {
+  if (Array.isArray(value)) return value.map(sanitize);
+  if (!value || typeof value !== 'object') return value;
+  const out = {};
+  for (const [key, entry] of Object.entries(value)) {
+    if (key === 'body') { out.body = String(entry || ''); out.bodyPreview = String(entry || '').slice(0, 240); }
+    else out[key] = sanitize(entry);
+  }
+  return out;
+}
+function runRoute(runtime, index, variant) {
+  const fnName = variant === 'invalid' ? `bridge_run_request_json_route_${index}_invalid` : `bridge_run_request_json_route_${index}`;
+  const fn = runtime.exports[fnName];
+  if (typeof fn !== 'function') throw new Error(`Missing request JSON bridge export ${fnName}.`);
+  const status = fn();
+  return { status, result: runtime.readResult(), bodyReadCount: runtime.requestBodyReadCount(), parseCount: runtime.requestJsonParseCount() };
+}
+function runNoBodyEffectRoute(runtime) {
+  const fn = runtime.exports.bridge_run_effect_route_0;
+  if (typeof fn !== 'function') return undefined;
+  const kind = fn();
+  return { kind, bodyReadCount: runtime.requestBodyReadCount(), parseCount: runtime.requestJsonParseCount(), result: runtime.readResult() };
+}
+function buildNodeRequestJsonBodyProof(options = {}) {
+  const cwd = options.cwd || process.cwd();
+  const outDir = options.outDir || getDefaultArtifactsDir(cwd);
+  const generatedBy = options.generatedBy || PACKAGE_VERSION;
+  const diagnostics = [];
+  const failures = [];
+  const checks = [];
+  const plan = normalizePlan(options.requestJsonBodyPlan || options.plan);
+  if (!plan) diagnostics.push(makeDiagnostic(requestJson.REQUEST_JSON_BODY_DIAGNOSTICS.planMissing, 'Node request JSON body proof requires request-json-body-plan.json.', 'error', { hint: 'Enable request-json-body-plan before requesting the Node proof.' }));
+  const routes = requestJsonRoutes(plan || {});
+  if (plan && routes.length === 0) diagnostics.push(makeDiagnostic(requestJson.REQUEST_JSON_BODY_DIAGNOSTICS.planMissing, 'Node request JSON body proof requires at least one route using ctx.req.json/parse.', 'error', { routes: (plan.routes || []).length }));
+  const wasmFile = findCompiledHandlerWasm(options.compiledHandlers, cwd, outDir, options.compiledHandlersCwd || options.sourceCwd);
+  if (!wasmFile) diagnostics.push(makeDiagnostic(requestJson.REQUEST_JSON_BODY_DIAGNOSTICS.wasmMissing, 'Node request JSON body proof requires the compiled-handler Wasm artifact.', 'error', { hint: 'Enable compiled handlers together with the request JSON body proof.' }));
+
+  let runtime;
+  const smoke = { results: {}, checks, failedChecks: failures };
+  if (wasmFile && diagnostics.filter((entry) => (entry.severity || 'error') === 'error').length === 0) {
+    try {
+      runtime = createCompiledHandlerBridgeRuntime(wasmFile);
+      const noBody = runNoBodyEffectRoute(runtime);
+      if (noBody) {
+        smoke.results.noBodyRoute = sanitize(noBody);
+        checks.push(check('request_json_not_read_on_unrelated_effect_route', noBody.bodyReadCount === 0 && noBody.parseCount === 0, noBody, failures, diagnostics));
+      }
+      for (let index = 0; index < routes.length; index += 1) {
+        const route = routes[index];
+        const valid = runRoute(runtime, index, 'valid');
+        smoke.results[`route${index}`] = sanitize({ route: { method: route.method, path: route.path, handlerName: route.handlerName }, valid });
+        const validReturnedResolveBoundary = valid.result && valid.result.kind === 'resolve';
+        checks.push(check(`request_json_route_${index}_valid_status`, (valid.status >= 200 && valid.status < 300) || (validReturnedResolveBoundary && valid.status === 0), valid, failures, diagnostics));
+        checks.push(check(`request_json_route_${index}_lazy_read_once`, valid.bodyReadCount === 1, valid, failures, diagnostics));
+        checks.push(check(`request_json_route_${index}_parse_once`, valid.parseCount === 1, valid, failures, diagnostics));
+        if (validReturnedResolveBoundary) {
+          checks.push(check(`request_json_route_${index}_effect_boundary_returned`, true, valid.result, failures, diagnostics));
+        } else {
+          checks.push(check(`request_json_route_${index}_body_visible`, /body-123/.test(valid.result.body || ''), valid.result, failures, diagnostics));
+        }
+        const invalid = runRoute(runtime, index, 'invalid');
+        smoke.results[`route${index}Invalid`] = sanitize({ route: { method: route.method, path: route.path, handlerName: route.handlerName }, invalid });
+        checks.push(check(`request_json_route_${index}_invalid_json_status`, invalid.status === 400, invalid, failures, diagnostics));
+        checks.push(check(`request_json_route_${index}_invalid_json_error`, /invalid_json/.test(invalid.result.body || ''), invalid.result, failures, diagnostics));
+      }
+      checks.push(check('request_json_module_has_no_js_handler_imports', runtime.imports.filter((entry) => entry.module === 'pulsewasm_handlers').length === 0, { imports: runtime.imports }, failures, diagnostics));
+    } catch (error) {
+      diagnostics.push(makeDiagnostic(requestJson.REQUEST_JSON_BODY_DIAGNOSTICS.compiledSmokeFailed, 'Node request JSON body proof smoke execution failed.', 'error', { message: error && error.message ? error.message : String(error), stack: error && error.stack ? error.stack : undefined }));
+    }
+  }
+  const errorDiagnostics = diagnostics.filter((entry) => (entry.severity || 'error') === 'error');
+  const compiledHandlerFiles = Array.isArray(options.compiledHandlers && options.compiledHandlers.files) ? options.compiledHandlers.files : [];
+  const compiledHandlerOutputs = Array.isArray(options.compiledHandlers && options.compiledHandlers.outputFiles) ? options.compiledHandlers.outputFiles : [];
+  const artifact = normalizeArtifact({
+    version: requestJson.NODE_REQUEST_JSON_BODY_PROOF_VERSION,
+    generatedBy,
+    phase: requestJson.NODE_REQUEST_JSON_BODY_PROOF_PHASE,
+    artifact: requestJson.NODE_REQUEST_JSON_BODY_PROOF_ARTIFACT,
+    contractId: requestJson.REQUEST_JSON_BODY_CONTRACT_ID,
+    provider: 'node',
+    status: errorDiagnostics.length === 0 ? 'ok' : 'error',
+    sourcePlanVersion: plan && plan.version,
+    sourcePlanArtifact: plan && plan.artifact,
+    requestJsonBodyPlanConnected: Boolean(plan),
+    compiledHandlersConnected: Boolean(options.compiledHandlers),
+    compiledHandlerPlanVersion: options.compiledHandlers && options.compiledHandlers.artifact && options.compiledHandlers.artifact.version,
+    runtime: { version: requestJson.NODE_REQUEST_JSON_BODY_RUNTIME_VERSION, package: '@pulse-compute/wasm-runtime-core-as/compiler/compiled-handlers', wasm: wasmFile ? path.relative(cwd, wasmFile).replace(/\\/g, '/') : undefined },
+    scope: requestJson.defaultNodeRequestJsonBodyProofPolicy(),
+    lazyEvaluation: JSON.parse(JSON.stringify(requestJson.REQUEST_JSON_BODY_LAZY_POLICY)),
+    surface: JSON.parse(JSON.stringify(requestJson.REQUEST_JSON_BODY_SURFACE)),
+    accessors: [...requestJson.REQUEST_JSON_BODY_ACCESSORS],
+    reservedAccessors: [...requestJson.REQUEST_JSON_BODY_RESERVED_ACCESSORS],
+    compiledWasmRuntimeImplemented: errorDiagnostics.length === 0,
+    nodeCompiledProofImplemented: errorDiagnostics.length === 0,
+    providerNetworkFetchRequired: false,
+    backendJsonRequestBodyImplemented: false,
+    binaryRequestBodyParsing: false,
+    streamRequestBodyParsing: false,
+    asyncAwait: false,
+    promises: false,
+    asyncify: false,
+    routesConsumed: routes.map((route, index) => ({ index, routeId: route.routeId, method: route.method, path: route.path, handlerName: route.handlerName, reads: route.reads, accessors: route.accessors })),
+    smoke,
+    summary: {
+      routesWithJsonBodyReads: routes.length,
+      compiled: Boolean(wasmFile) && errorDiagnostics.length === 0,
+      executed: checks.length > 0 && errorDiagnostics.length === 0,
+      checks: checks.length,
+      failedChecks: failures.length,
+      lazyReadValidated: checks.some((entry) => entry.name.includes('lazy_read_once') && entry.status === 'ok'),
+      parseCacheValidated: checks.some((entry) => entry.name.includes('parse_once') && entry.status === 'ok'),
+      invalidJsonValidated: checks.some((entry) => entry.name.includes('invalid_json_status') && entry.status === 'ok'),
+      noEagerReadValidated: checks.some((entry) => entry.name === 'request_json_not_read_on_unrelated_effect_route' && entry.status === 'ok'),
+      noJsHandlerImports: checks.some((entry) => entry.name === 'request_json_module_has_no_js_handler_imports' && entry.status === 'ok'),
+      providerBehaviorImplemented: false,
+      compiledWasmRuntimeImplemented: errorDiagnostics.length === 0,
+      binaryRequestBodyParsing: false,
+      streamRequestBodyParsing: false,
+      diagnostics: diagnostics.length,
+      errorDiagnostics: errorDiagnostics.length,
+      errors: errorDiagnostics.length
+    },
+    generatedFiles: compiledHandlerFiles.map((file) => ({ file: file.file, bytes: file.bytes, sha256: file.sha256 })),
+    generatedOutputs: compiledHandlerOutputs.map((file) => ({ file: file.file, kind: file.kind, bytes: file.bytes, sha256: file.sha256 })),
+    diagnostics
+  }, cwd);
+  return { artifact, diagnostics, failures, files: compiledHandlerFiles, outputFiles: compiledHandlerOutputs.length ? compiledHandlerOutputs : (wasmFile ? [{ file: path.relative(cwd, wasmFile).replace(/\\/g, '/'), kind: 'compiled-handler-wasm', bytes: fs.statSync(wasmFile).size }] : []), wasmFile };
+}
+
+module.exports = { phaseName, buildNodeRequestJsonBodyProof };