@pulse-compute/wasm-host-runtime 0.0.0 → 1.0.0-beta.1

package/src/runtime/compiled-wasm-host-runtime-kv.js

@@ -0,0 +1,32 @@
+
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const { createKvProvider, createKvError } = require('./kv-provider.js');
+const RESULT_NONE = 0; const RESULT_TEXT = 1; const RESULT_JSON = 2; const RESULT_BINARY = 3; const RESULT_EMPTY = 4; const RESULT_STREAM = 5;
+function createSetupError(code, message, details) { const err = new Error(message); err.code = code; err.details = details || null; return err; }
+function normalizeHeaders(headers) { if (!headers) return []; if (Array.isArray(headers)) return headers.map((pair) => [String(pair[0]), String(pair[1])]); if (typeof headers[Symbol.iterator] === 'function') return Array.from(headers, ([name, value]) => [String(name), String(value)]); return Object.entries(headers).map(([name, value]) => [String(name), String(value)]); }
+function methodNameToCode(exports, method) { const upper = String(method || '').toUpperCase(); if (upper === 'GET') return exports.pulse_bridge_method_get(); if (upper === 'POST') return exports.pulse_bridge_method_post(); return 0; }
+function createPulseWasmCompiledHostRuntimeWithKv(options = {}) {
+  const wasmBytes = options.wasmBytes || (options.wasmPath ? fs.readFileSync(path.resolve(options.wasmPath)) : undefined);
+  if (!wasmBytes) throw createSetupError('PULSEWASM_COMPILED_RUNTIME_WASM_REQUIRED', 'createPulseWasmCompiledHostRuntimeWithKv requires wasmBytes or wasmPath.');
+  const deploymentPosture = options.deploymentPosture || { engine: 'wasm' };
+  if ((deploymentPosture.engine || 'wasm') === 'js' && !options.allowJsEngine) throw createSetupError('PULSEWASM_COMPILED_RUNTIME_ENGINE_MISMATCH', 'compiled-wasm host runtime refuses JS engine posture.', { engine: deploymentPosture.engine });
+  const encoder = new TextEncoder(); const decoder = new TextDecoder();
+  const module = new WebAssembly.Module(wasmBytes);
+  const imports = { env: { abort() { throw new Error('AssemblyScript abort'); } } };
+  const instance = new WebAssembly.Instance(module, imports); const exports = instance.exports;
+  const hostResponses = new Map();
+  for (const [key, value] of Object.entries(options.hostResponses || {})) hostResponses.set(Number(key), value);
+  if (!hostResponses.has(77)) hostResponses.set(77, { status: 206, headers: [['Content-Type', 'application/octet-stream'], ['Grip-Channel', 'backend:stream']], bodyStream: { chunks: ['asset:42'] } });
+  const kvProvider = options.kvProvider || createKvProvider({ provider: options.runtimeProvider || { kind: 'local', kv: {} } });
+  function memory() { return exports.memory; }
+  function allocText(text) { const bytes = encoder.encode(String(text ?? '')); const ptr = exports.pulse_alloc(bytes.length || 1); new Uint8Array(memory().buffer, ptr, bytes.length).set(bytes); return { ptr, len: bytes.length }; }
+  function readBytes(ptr, len) { if (!ptr || !len) return ''; return decoder.decode(new Uint8Array(memory().buffer, ptr, len)); }
+  function readResultHeaders() { const headers = []; const count = exports.pulse_result_header_count ? exports.pulse_result_header_count() : 0; for (let i = 0; i < count; i += 1) headers.push([readBytes(exports.pulse_result_header_name_ptr(i), exports.pulse_result_header_name_len(i)), readBytes(exports.pulse_result_header_value_ptr(i), exports.pulse_result_header_value_len(i)), exports.pulse_result_header_mode ? exports.pulse_result_header_mode(i) : 2]); return headers; }
+  function mergeHeaders(base, resultHeaders) { const merged = normalizeHeaders(base); for (const item of resultHeaders || []) { const name = item[0]; const value = item[1]; const mode = Number(item[2] || 2); const lower = String(name).toLowerCase(); if (mode === 1) { for (let i = merged.length - 1; i >= 0; i -= 1) if (String(merged[i][0]).toLowerCase() === lower) merged.splice(i, 1); } merged.push([String(name), String(value)]); } return merged; }
+  function decodeResult(status) { const kindCode = exports.pulse_result_kind ? exports.pulse_result_kind() : RESULT_NONE; const resultStatus = exports.pulse_result_status ? exports.pulse_result_status() : status; const resultHeaders = readResultHeaders(); if (kindCode === RESULT_STREAM) { const responseRef = exports.pulse_result_response_ref ? exports.pulse_result_response_ref() : 0; const streamRef = exports.pulse_result_stream_ref ? exports.pulse_result_stream_ref() : 0; const response = hostResponses.get(responseRef) || (streamRef ? { status: resultStatus || status, headers: [], bodyStream: hostResponses.get(streamRef) } : undefined); return { status: resultStatus || (response && response.status) || status, kind: 'stream', kindCode, headers: mergeHeaders(response && response.headers, resultHeaders), bodyStream: response && response.bodyStream, responseRef, streamRef, response, diagnostics: [] }; } const body = exports.pulse_result_body_ptr ? readBytes(exports.pulse_result_body_ptr(), exports.pulse_result_body_len()) : ''; const kind = kindCode === RESULT_JSON ? 'json' : kindCode === RESULT_TEXT ? 'text' : kindCode === RESULT_EMPTY ? 'empty' : 'none'; return { status: resultStatus || status, kind, kindCode, headers: resultHeaders.map(([name, value]) => [name, value]), body: body || undefined, diagnostics: [] }; }
+  function executeRequest(input = {}) { const body = allocText(input.bodyText || ''); if (exports.pulse_bridge_set_body_text) exports.pulse_bridge_set_body_text(body.ptr, body.len); const path = allocText(input.path || '/'); const status = exports.pulse_execute_request(methodNameToCode(exports, input.method), path.ptr, path.len); return decodeResult(status); }
+  return { version: 'pulsewasm.compiled-wasm-host-runtime-kv.v1', handlerExecutionMode: 'compiled-wasm', provider: kvProvider, kv(name){ return kvProvider.kv(name); }, executeRequest, executeConnect(){ return { event: 'connect', invoked: 0, status: 200 }; }, executeDisconnect(){ return { event: 'disconnect', invoked: 0, status: 200 }; }, close(){}, exports, imports: WebAssembly.Module.imports(module), hostResponses };
+}
+module.exports = { createPulseWasmCompiledHostRuntimeWithKv, RESULT_NONE, RESULT_TEXT, RESULT_JSON, RESULT_BINARY, RESULT_EMPTY, RESULT_STREAM, createKvError };

package/src/runtime/continuation-registry.js

@@ -0,0 +1,181 @@
+'use strict';
+
+const CONTINUATION_REGISTRY_VERSION = 'pulse.continuation-registry.v1';
+const CONTINUATION_STATES = Object.freeze(['created', 'waiting', 'resumed', 'completed', 'failed', 'expired', 'cancelled']);
+const TERMINAL_STATES = new Set(['completed', 'failed', 'expired', 'cancelled']);
+
+class ContinuationRegistryError extends Error {
+  constructor(name, code, message, detail = {}) {
+    super(message);
+    this.name = name;
+    this.code = code;
+    this.detail = Object.freeze({ ...detail });
+  }
+}
+
+function stateError(record, operation, expected) {
+  const detail = { id: record.id, state: record.state, operation, expected };
+  if (record.state === 'expired') return new ContinuationRegistryError('ContinuationExpiredError', 'PULSE_CONTINUATION_EXPIRED', `Continuation ${record.id} expired before ${operation}.`, detail);
+  if (['resumed', 'completed', 'failed'].includes(record.state) && operation === 'resume') return new ContinuationRegistryError('ContinuationDoubleResumeError', 'PULSE_CONTINUATION_DOUBLE_RESUME', `Continuation ${record.id} cannot be resumed from ${record.state}.`, detail);
+  return new ContinuationRegistryError('ContinuationStateError', 'PULSE_CONTINUATION_STATE', `Continuation ${record.id} cannot ${operation} from ${record.state}.`, detail);
+}
+
+function cloneRecord(record) {
+  return Object.freeze({
+    id: record.id,
+    branchPoint: record.branchPoint,
+    effectIds: Object.freeze([...record.effectIds]),
+    state: record.state,
+    states: Object.freeze([...record.states]),
+    createdAt: record.createdAt,
+    expiresAt: record.expiresAt,
+    resumedAt: record.resumedAt,
+    completedAt: record.completedAt,
+    failedAt: record.failedAt,
+    expiredAt: record.expiredAt,
+    cancelledAt: record.cancelledAt,
+    resumeCount: record.resumeCount,
+    error: record.error
+  });
+}
+
+function createContinuationRegistry(options = {}) {
+  const clock = typeof options.clock === 'function' ? options.clock : () => Date.now();
+  const defaultTtlMs = Number.isFinite(Number(options.ttlMs)) ? Math.max(1, Number(options.ttlMs)) : 30000;
+  const records = new Map();
+  const trace = [];
+  let sequence = 0;
+
+  function event(record, type, detail = {}) {
+    trace.push(Object.freeze({
+      sequence: trace.length + 1,
+      type,
+      id: record.id,
+      branchPoint: record.branchPoint,
+      state: record.state,
+      at: clock(),
+      detail: Object.freeze({ ...detail })
+    }));
+  }
+
+  function requireRecord(id) {
+    const record = records.get(String(id));
+    if (!record) throw new ContinuationRegistryError('ContinuationNotFoundError', 'PULSE_CONTINUATION_NOT_FOUND', `Unknown continuation ${id}.`, { id: String(id) });
+    return record;
+  }
+
+  function transition(record, state, at, extra = {}) {
+    record.state = state;
+    record.states.push(state);
+    Object.assign(record, extra);
+    event(record, state, extra);
+    return cloneRecord(record);
+  }
+
+  function create(input = {}) {
+    sequence += 1;
+    const now = clock();
+    const id = String(input.id || `continuation-${sequence}`);
+    if (records.has(id)) throw new ContinuationRegistryError('ContinuationDuplicateError', 'PULSE_CONTINUATION_DUPLICATE', `Continuation ${id} already exists.`, { id });
+    const ttlMs = Number.isFinite(Number(input.ttlMs)) ? Math.max(1, Number(input.ttlMs)) : defaultTtlMs;
+    const record = {
+      id,
+      branchPoint: String(input.branchPoint || id),
+      effectIds: Array.isArray(input.effectIds) ? input.effectIds.map(String) : [],
+      state: 'created',
+      states: ['created'],
+      createdAt: now,
+      expiresAt: now + ttlMs,
+      resumeCount: 0,
+      error: undefined
+    };
+    records.set(id, record);
+    event(record, 'created');
+    return cloneRecord(record);
+  }
+
+  function wait(id) {
+    const record = requireRecord(id);
+    if (record.state !== 'created') throw stateError(record, 'wait', 'created');
+    return transition(record, 'waiting', clock());
+  }
+
+  function resume(id) {
+    const record = requireRecord(id);
+    const now = clock();
+    if (record.state === 'waiting' && now >= record.expiresAt) {
+      transition(record, 'expired', now, { expiredAt: now });
+      throw stateError(record, 'resume', 'waiting');
+    }
+    if (record.state !== 'waiting') throw stateError(record, 'resume', 'waiting');
+    record.resumeCount += 1;
+    return transition(record, 'resumed', now, { resumedAt: now });
+  }
+
+  function complete(id) {
+    const record = requireRecord(id);
+    if (record.state !== 'resumed') throw stateError(record, 'complete', 'resumed');
+    const now = clock();
+    return transition(record, 'completed', now, { completedAt: now });
+  }
+
+  function fail(id, error) {
+    const record = requireRecord(id);
+    if (!['created', 'waiting', 'resumed'].includes(record.state)) throw stateError(record, 'fail', 'created|waiting|resumed');
+    const now = clock();
+    const errorName = error && (error.name || error.code || error.message) ? String(error.name || error.code || error.message) : String(error || 'ContinuationFailure');
+    return transition(record, 'failed', now, { failedAt: now, error: errorName });
+  }
+
+  function expire(id) {
+    const record = requireRecord(id);
+    if (TERMINAL_STATES.has(record.state) || record.state === 'resumed') throw stateError(record, 'expire', 'created|waiting');
+    const now = clock();
+    return transition(record, 'expired', now, { expiredAt: now });
+  }
+
+  function cancel(id) {
+    const record = requireRecord(id);
+    if (TERMINAL_STATES.has(record.state)) throw stateError(record, 'cancel', 'created|waiting|resumed');
+    const now = clock();
+    return transition(record, 'cancelled', now, { cancelledAt: now });
+  }
+
+  function sweepExpired(now = clock()) {
+    const expired = [];
+    for (const record of records.values()) {
+      if (['created', 'waiting'].includes(record.state) && now >= record.expiresAt) {
+        transition(record, 'expired', now, { expiredAt: now });
+        expired.push(record.id);
+      }
+    }
+    return Object.freeze(expired);
+  }
+
+  function get(id) { return cloneRecord(requireRecord(id)); }
+  function list() { return Object.freeze([...records.values()].map(cloneRecord)); }
+  function traceSnapshot() { return Object.freeze([...trace]); }
+
+  return Object.freeze({
+    version: CONTINUATION_REGISTRY_VERSION,
+    states: CONTINUATION_STATES,
+    create,
+    wait,
+    resume,
+    complete,
+    fail,
+    expire,
+    cancel,
+    sweepExpired,
+    get,
+    list,
+    trace: traceSnapshot
+  });
+}
+
+module.exports = {
+  CONTINUATION_REGISTRY_VERSION,
+  CONTINUATION_STATES,
+  ContinuationRegistryError,
+  createContinuationRegistry
+};

package/src/runtime/index.js

@@ -0,0 +1,22 @@
+'use strict';
+
+const compiledWasmHostRuntimeKv = require('./compiled-wasm-host-runtime-kv.js');
+const kvProvider = require('./kv-provider.js');
+const continuationRegistry = require('./continuation-registry.js');
+const canonicalApiRuntime = require('./canonical-api-runtime.js');
+const canonicalNativeHost = require('./canonical-native-host.js');
+
+module.exports = {
+  compiledWasmHostRuntimeKv,
+  kvProvider,
+  continuationRegistry,
+  canonicalApiRuntime,
+  canonicalNativeHost,
+  ...canonicalApiRuntime,
+  ...canonicalNativeHost,
+  ...continuationRegistry,
+  createPulseWasmCompiledHostRuntimeWithKv: compiledWasmHostRuntimeKv.createPulseWasmCompiledHostRuntimeWithKv,
+  createKvProvider: kvProvider.createKvProvider,
+  createKvError: kvProvider.createKvError,
+  createNamespaceStore: kvProvider.createNamespaceStore
+};

package/src/runtime/kv-provider.js

@@ -0,0 +1,56 @@
+'use strict';
+
+function createKvError(code, message, details) {
+  const err = new Error(message);
+  err.code = code;
+  err.details = details || null;
+  return err;
+}
+
+function createNamespaceStore(namespace, map) {
+  return {
+    namespace,
+    getText(key) {
+      const normalized = String(key);
+      return map.has(normalized) ? String(map.get(normalized)) : null;
+    },
+    setText(key, value) {
+      map.set(String(key), String(value));
+      return { ok: true };
+    },
+    delete(key) {
+      const existed = map.delete(String(key));
+      return { ok: true, existed };
+    },
+    has(key) {
+      return map.has(String(key));
+    },
+    entries() {
+      return Array.from(map.entries());
+    }
+  };
+}
+
+function createKvProvider(options = {}) {
+  const provider = options.provider || options.runtimeProvider || { kind: 'local', kv: {} };
+  const stores = new Map();
+  const configured = provider && provider.kv ? provider.kv : {};
+  const seed = options.seed || {};
+  for (const [logicalName, physicalName] of Object.entries(configured)) {
+    const initial = new Map(Object.entries(seed[logicalName] || {}));
+    stores.set(String(logicalName), createNamespaceStore(String(physicalName), initial));
+  }
+  return {
+    kind: provider.kind || 'unknown',
+    configuredNamespaces: Array.from(stores.keys()),
+    kv(name) {
+      const key = String(name);
+      if (!stores.has(key)) {
+        throw createKvError('PULSEWASM_KV_NAMESPACE_UNKNOWN', `Unknown KV namespace: ${key}`, { namespace: key, configured: Array.from(stores.keys()) });
+      }
+      return stores.get(key);
+    }
+  };
+}
+
+module.exports = { createKvProvider, createKvError, createNamespaceStore };

package/src/runtime/native-crypto-verifier.js

@@ -0,0 +1,330 @@
+'use strict';
+
+const {
+  CRYPTO_ES256_GUEST_LINKED_IMPLEMENTATION,
+  CRYPTO_ES256_GUEST_LINKED_REALIZATION,
+  CRYPTO_GUEST_SOURCE_IMPLEMENTATION,
+  CRYPTO_REALIZATION_PLAN_VERSION
+} = require('@pulse-compute/wasm-contracts/crypto/contracts');
+
+const NATIVE_CRYPTO_VERIFIER_VERSION = 'pulse.native-crypto-verifier.v1';
+const HS256_REALIZATION = 'guest-source:pulse-hmac-as';
+const HS256_EXPORT = 'pulse_crypto_hs256_verify';
+const ES256_EXPORT = 'pulse_crypto_es256_verify';
+const ES256_REALIZATION = CRYPTO_ES256_GUEST_LINKED_REALIZATION;
+const PAGE_BYTES = 64 * 1024;
+const GUARD_BYTES = PAGE_BYTES;
+const KEY_BYTES_MINIMUM = 32;
+const KEY_BYTES_MAXIMUM = 4 * 1024;
+const DATA_BYTES_MAXIMUM = 1024 * 1024;
+const TAG_BYTES = 32;
+const MAX_SIGNED_POINTER = 0x7fffffff;
+const ES256_MEMORY_BYTES = 32 * PAGE_BYTES;
+const ES256_FRAME_POINTER = 8 * PAGE_BYTES;
+const ES256_FRAME_CAPACITY = 16_640;
+const ES256_FRAME_MAGIC = 0x3253_4550;
+const ES256_FRAME_HEADER_BYTES = 64;
+const ES256_KEY_BYTES = 64;
+const ES256_SIGNATURE_BYTES = 64;
+const ES256_DATA_BYTES_MAXIMUM = 16_340;
+
+const RESULT_BY_CODE = Object.freeze({
+  1: 'valid',
+  0: 'invalid-authenticator',
+  '-1': 'invalid-key',
+  '-2': 'invalid-input',
+  '-3': 'realization-failure'
+});
+
+function result(status) {
+  return Object.freeze({ status });
+}
+
+function ownData(value, name) {
+  if (!value || typeof value !== 'object') return undefined;
+  const descriptor = Object.getOwnPropertyDescriptor(value, name);
+  return descriptor && Object.prototype.hasOwnProperty.call(descriptor, 'value')
+    ? descriptor.value
+    : undefined;
+}
+
+function bytes(value) {
+  return value instanceof Uint8Array ? value : undefined;
+}
+
+function selectedAlgorithm(plan, algorithm, realization, kind, implementation) {
+  if (
+    !plan
+    || typeof plan !== 'object'
+    || !plan.crypto
+    || plan.crypto.version !== CRYPTO_REALIZATION_PLAN_VERSION
+    || plan.crypto.target !== 'native'
+    || plan.crypto.automaticFallback !== false
+    || !Array.isArray(plan.crypto.algorithms)
+  ) return undefined;
+  const matches = plan.crypto.algorithms.filter((entry) => (
+    entry
+    && entry.algorithm === algorithm
+    && entry.realization === realization
+    && entry.kind === kind
+    && entry.implementation === implementation
+    && entry.automaticFallback === false
+    && entry.targetImplemented === true
+  ));
+  return matches.length === 1 ? matches[0] : undefined;
+}
+
+function selectedHs256(plan) {
+  return selectedAlgorithm(
+    plan,
+    'HS256',
+    HS256_REALIZATION,
+    'guest-source',
+    CRYPTO_GUEST_SOURCE_IMPLEMENTATION
+  );
+}
+
+function selectedEs256(plan) {
+  return selectedAlgorithm(
+    plan,
+    'ES256',
+    ES256_REALIZATION,
+    'guest-linked',
+    CRYPTO_ES256_GUEST_LINKED_IMPLEMENTATION
+  );
+}
+
+function normalizeRequest(request) {
+  const algorithm = ownData(request, 'algorithm');
+  const key = ownData(request, 'key');
+  const keyType = ownData(key, 'type');
+  const keyBytes = bytes(ownData(key, 'bytes'));
+  const data = bytes(ownData(request, 'data'));
+  const tag = bytes(ownData(request, 'tag'));
+  if (
+    algorithm !== 'HS256'
+    || keyType !== 'hmac-key-bytes'
+    || !keyBytes
+    || !data
+    || !tag
+  ) return Object.freeze({ result: result('invalid-input') });
+  if (
+    keyBytes.byteLength < KEY_BYTES_MINIMUM
+    || keyBytes.byteLength > KEY_BYTES_MAXIMUM
+  ) return Object.freeze({ result: result('invalid-key') });
+  if (
+    data.byteLength > DATA_BYTES_MAXIMUM
+    || tag.byteLength !== TAG_BYTES
+  ) return Object.freeze({ result: result('invalid-input') });
+  return Object.freeze({ keyBytes, data, tag });
+}
+
+function normalizeSignatureRequest(request) {
+  const algorithm = ownData(request, 'algorithm');
+  const key = ownData(request, 'key');
+  const keyType = ownData(key, 'type');
+  const keyBytes = bytes(ownData(key, 'bytes'));
+  const data = bytes(ownData(request, 'data'));
+  const signature = bytes(ownData(request, 'signature'));
+  if (
+    algorithm !== 'ES256'
+    || keyType !== 'p256-public-key-bytes'
+    || !keyBytes
+    || !data
+    || !signature
+  ) return Object.freeze({ result: result('invalid-input') });
+  if (keyBytes.byteLength !== ES256_KEY_BYTES) {
+    return Object.freeze({ result: result('invalid-key') });
+  }
+  if (
+    data.byteLength > ES256_DATA_BYTES_MAXIMUM
+    || signature.byteLength !== ES256_SIGNATURE_BYTES
+  ) return Object.freeze({ result: result('invalid-input') });
+  return Object.freeze({ keyBytes, data, signature });
+}
+
+function stage(memory, inputs) {
+  const payloadBytes = inputs.reduce((total, input) => total + input.byteLength, 0);
+  const oldEnd = memory.buffer.byteLength;
+  const required = GUARD_BYTES + payloadBytes + 48;
+  const pages = Math.ceil(required / PAGE_BYTES);
+  const newEnd = oldEnd + pages * PAGE_BYTES;
+  if (
+    !Number.isSafeInteger(newEnd)
+    || newEnd > MAX_SIGNED_POINTER
+    || memory.grow(pages) < 0
+  ) return undefined;
+
+  const view = new Uint8Array(memory.buffer);
+  const pointers = [];
+  let cursor = oldEnd + GUARD_BYTES;
+  for (const input of inputs) {
+    cursor = (cursor + 15) & ~15;
+    pointers.push(cursor);
+    view.set(input, cursor);
+    cursor += input.byteLength;
+  }
+  return Object.freeze({
+    pointers: Object.freeze(pointers),
+    wipe() {
+      new Uint8Array(memory.buffer).fill(0, oldEnd + GUARD_BYTES, cursor);
+    }
+  });
+}
+
+function align16(value) {
+  return (value + 15) & ~15;
+}
+
+function stageEs256Frame(memory, normalized) {
+  if (
+    !(memory instanceof WebAssembly.Memory)
+    || memory.buffer.byteLength !== ES256_MEMORY_BYTES
+  ) return undefined;
+  const totalLength = align16(192 + normalized.data.byteLength);
+  if (totalLength > ES256_FRAME_CAPACITY) return undefined;
+  const frame = new Uint8Array(
+    memory.buffer,
+    ES256_FRAME_POINTER,
+    ES256_FRAME_CAPACITY
+  );
+  frame.fill(0);
+  const words = new DataView(
+    memory.buffer,
+    ES256_FRAME_POINTER,
+    ES256_FRAME_HEADER_BYTES
+  );
+  const fields = [
+    [0, ES256_FRAME_MAGIC],
+    [4, 2],
+    [8, ES256_FRAME_HEADER_BYTES],
+    [12, totalLength],
+    [16, 1],
+    [20, 0],
+    [24, 192],
+    [28, normalized.data.byteLength],
+    [32, 64],
+    [36, ES256_KEY_BYTES],
+    [40, 128],
+    [44, ES256_SIGNATURE_BYTES]
+  ];
+  for (const [offset, value] of fields) words.setUint32(offset, value, true);
+  frame.set(normalized.keyBytes, 64);
+  frame.set(normalized.signature, 128);
+  frame.set(normalized.data, 192);
+  return Object.freeze({
+    pointer: ES256_FRAME_POINTER,
+    capacity: ES256_FRAME_CAPACITY,
+    wipe() {
+      new Uint8Array(
+        memory.buffer,
+        ES256_FRAME_POINTER,
+        ES256_FRAME_CAPACITY
+      ).fill(0);
+    }
+  });
+}
+
+function createNativeGuestSourceCryptoVerifier(input = {}) {
+  const plan = input.plan;
+  const moduleExports = input.exports;
+  const selected = selectedHs256(plan);
+  const selectedSignature = selectedEs256(plan);
+  const memory = moduleExports && moduleExports.memory;
+  const verifyHs256 = moduleExports && moduleExports[HS256_EXPORT];
+  const verifyEs256 = moduleExports && moduleExports[ES256_EXPORT];
+  const hs256Available = Boolean(
+    selected
+    && memory instanceof WebAssembly.Memory
+    && typeof verifyHs256 === 'function'
+  );
+  const es256Available = Boolean(
+    selectedSignature
+    && memory instanceof WebAssembly.Memory
+    && memory.buffer.byteLength === ES256_MEMORY_BYTES
+    && typeof verifyEs256 === 'function'
+  );
+  const selectedRealizations = Object.freeze([
+    ...(selected ? [Object.freeze({
+      algorithm: 'HS256',
+      realization: HS256_REALIZATION,
+      implementation: CRYPTO_GUEST_SOURCE_IMPLEMENTATION,
+      guestUnitRequired: false,
+      available: hs256Available
+    })] : []),
+    ...(selectedSignature ? [Object.freeze({
+      algorithm: 'ES256',
+      realization: ES256_REALIZATION,
+      implementation: CRYPTO_ES256_GUEST_LINKED_IMPLEMENTATION,
+      guestUnitRequired: true,
+      available: es256Available
+    })] : [])
+  ]);
+  const realization = Object.freeze({
+    version: NATIVE_CRYPTO_VERIFIER_VERSION,
+    semanticOwner: '@pulse-compute/crypto',
+    automaticFallback: false,
+    algorithms: selectedRealizations,
+    available: selectedRealizations.length > 0
+      && selectedRealizations.every((entry) => entry.available),
+    ...(selectedRealizations.length === 1 ? selectedRealizations[0] : {})
+  });
+
+  const verifier = Object.freeze({
+    mac: Object.freeze({
+      verify(request) {
+        const normalized = normalizeRequest(request);
+        if (normalized.result) return normalized.result;
+        if (!hs256Available) return result('realization-failure');
+        let staged;
+        try {
+          staged = stage(memory, [
+            normalized.keyBytes,
+            normalized.data,
+            normalized.tag
+          ]);
+          if (!staged) return result('realization-failure');
+          const [keyPointer, dataPointer, tagPointer] = staged.pointers;
+          const code = verifyHs256(
+            keyPointer,
+            normalized.keyBytes.byteLength,
+            dataPointer,
+            normalized.data.byteLength,
+            tagPointer,
+            normalized.tag.byteLength
+          );
+          return result(RESULT_BY_CODE[String(code)] || 'realization-failure');
+        } catch {
+          return result('realization-failure');
+        } finally {
+          if (staged) staged.wipe();
+        }
+      }
+    }),
+    signature: Object.freeze({
+      verify(request) {
+        const normalized = normalizeSignatureRequest(request);
+        if (normalized.result) return normalized.result;
+        if (!es256Available) return result('realization-failure');
+        let staged;
+        try {
+          staged = stageEs256Frame(memory, normalized);
+          if (!staged) return result('realization-failure');
+          const code = verifyEs256(staged.pointer, staged.capacity);
+          return result(RESULT_BY_CODE[String(code)] || 'realization-failure');
+        } catch {
+          return result('realization-failure');
+        } finally {
+          if (staged) staged.wipe();
+        }
+      }
+    })
+  });
+
+  return Object.freeze({ verifier, realization });
+}
+
+module.exports = Object.freeze({
+  NATIVE_CRYPTO_VERIFIER_VERSION,
+  createNativeGuestSourceCryptoVerifier
+});