@saulwade/swl-ses 2.6.1 → 2.8.0

package/scripts/lib/policy-contract.js

@@ -0,0 +1,479 @@
+'use strict';
+
+/** Contratos opacos de operación y bootstrap del kernel W2. */
+
+const crypto = require('node:crypto');
+const path = require('node:path');
+const util = require('node:util');
+
+const POLICY_SCHEMA = require('../../schemas/policy-bundle.schema.json');
+const {
+  canonicalizarIJson,
+  esEnvelopeVerificado,
+  parsearIJson,
+  validarTimestampIso,
+} = require('./signed-envelope');
+const SCHEMA_VERSION = '1.0.0';
+const SHA256 = /^[a-f0-9]{64}$/u;
+const IDENTIFICADOR = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
+const DNS_LABEL = '[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?';
+const ASCII_HOST = new RegExp(`^(?:${DNS_LABEL})(?:\\.(?:${DNS_LABEL}))*$`, 'u');
+const CAPABILITIES = new Set(POLICY_SCHEMA.$defs.capability.enum);
+const EFFECT_KINDS = new Set(['access', 'delegate', 'execute', 'invoke', 'mutate', 'read']);
+const OPERATION_KEYS = [
+  'schemaVersion', 'operationId', 'capability', 'effectKind', 'payloadDigest', 'scope',
+  'cwd', 'fsmVersion', 'timestamp',
+];
+const OPERATION_KEYS_V11 = [...OPERATION_KEYS, 'phaseId', 'taskId', 'effect'];
+const EFFECT_KINDS_CANONICAL = new Set([
+  'filesystem', 'process', 'network', 'memory', 'delegation', 'skill',
+]);
+const UNSAFE_TEXT = /[\u0000-\u001F\u007F\u001B\u200B-\u200F\u202A-\u202E\u2060-\u206F]/u;
+const BOOTSTRAP_KEYS = [
+  'kind', 'schemaVersion', 'trustEpoch', 'trustDigest', 'providers', 'trustPath',
+  'signerPath', 'anchorPath', 'issuedAt', 'expiresAt', 'nonce',
+];
+const PROVIDERS = Object.freeze({
+  clock: 'builtin:clock-v1',
+  randomSource: 'builtin:random-source-v1',
+  processInspector: 'builtin:process-inspector-v1',
+  integrityProvider: 'builtin:integrity-provider-v1',
+  stateAnchorProvider: 'builtin:state-anchor-provider-v1',
+});
+const VERIFIED_OPERATIONS = new WeakSet();
+const VERIFIED_BOOTSTRAPS = new WeakSet();
+const BOOTSTRAP_METADATA = new WeakMap();
+const KERNEL_DEPENDENCIES = new WeakSet();
+
+function crearError(codigo, mensaje) {
+  const error = new Error(mensaje);
+  error.codigo = codigo;
+  return error;
+}
+
+function fallar(codigo, mensaje) {
+  throw crearError(codigo, mensaje);
+}
+
+function validarObjeto(valor, etiqueta) {
+  if (!valor || typeof valor !== 'object' || Array.isArray(valor) || util.types.isProxy(valor)) {
+    fallar('CONTRACT_INVALID', `${etiqueta} inválido`);
+  }
+  const proto = Object.getPrototypeOf(valor);
+  if (proto !== Object.prototype && proto !== null) {
+    fallar('CONTRACT_INVALID', `${etiqueta} inválido`);
+  }
+  if (Object.getOwnPropertySymbols(valor).length > 0) {
+    fallar('CONTRACT_INVALID', `${etiqueta} inválido`);
+  }
+  const descriptores = Object.values(Object.getOwnPropertyDescriptors(valor));
+  if (descriptores.some((item) => !item.enumerable || !('value' in item))) {
+    fallar('CONTRACT_INVALID', `${etiqueta} inválido`);
+  }
+}
+
+function validarClaves(valor, esperadas, etiqueta) {
+  const actuales = Object.keys(valor).sort();
+  const objetivo = [...esperadas].sort();
+  if (JSON.stringify(actuales) !== JSON.stringify(objetivo)) {
+    fallar('CONTRACT_INVALID', `${etiqueta} inválida`);
+  }
+}
+
+function validarIdentificador(valor, etiqueta) {
+  if (typeof valor !== 'string' || !IDENTIFICADOR.test(valor)) {
+    fallar('CONTRACT_INVALID', `${etiqueta} inválido`);
+  }
+}
+
+function congelarProfundo(valor) {
+  if (!valor || typeof valor !== 'object' || Object.isFrozen(valor)) return valor;
+  Object.values(valor).forEach(congelarProfundo);
+  return Object.freeze(valor);
+}
+
+function validarScope(scope) {
+  validarObjeto(scope, 'scope');
+  validarClaves(scope, ['digest'], 'scope');
+  if (!SHA256.test(scope.digest)) fallar('CONTRACT_INVALID', 'operación con scope inválido');
+}
+
+function validarTextoCanonico(valor, etiqueta, maximo = 4096, permitirVacio = false) {
+  if (typeof valor !== 'string' || (!permitirVacio && valor.length === 0)
+      || valor.length > maximo
+      || valor.normalize('NFKC') !== valor || UNSAFE_TEXT.test(valor)) {
+    fallar('CONTRACT_INVALID', `${etiqueta} inválido`);
+  }
+}
+
+function validarSegmentosPosix(resto) {
+  const segmentos = resto.split('/');
+  if (segmentos.some((item) => !item || item === '.' || item === '..')) {
+    fallar('CONTRACT_INVALID', 'path canónico inválido');
+  }
+}
+
+function validarSegmentosWindows(resto) {
+  const segmentos = resto.split('\\');
+  if (segmentos.some((item) => !item || item === '.' || item === '..'
+      || item.includes(':') || /[. ]$/u.test(item) || /~\d+/u.test(item)
+      || /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/iu.test(item))) {
+    fallar('CONTRACT_INVALID', 'path canónico inválido');
+  }
+}
+
+function validarPathCanonico(style, absolutePath) {
+  validarTextoCanonico(absolutePath, 'path');
+  if (style === 'posix') {
+    if (!absolutePath.startsWith('/') || absolutePath.startsWith('//')
+        || absolutePath.includes('\\')) fallar('CONTRACT_INVALID', 'path POSIX inválido');
+    validarSegmentosPosix(absolutePath.slice(1));
+    return;
+  }
+  if (style !== 'win32' || !/^[A-Z]:\\/u.test(absolutePath)
+      || /^[A-Z]:\\[\\?.]/u.test(absolutePath) || absolutePath.includes('/')) {
+    fallar('CONTRACT_INVALID', 'path Windows inválido');
+  }
+  validarSegmentosWindows(absolutePath.slice(3));
+}
+
+function validarCwdV11(effect, cwd) {
+  const style = ['filesystem', 'process'].includes(effect.kind)
+    ? effect.pathStyle
+    : (cwd.startsWith('/') ? 'posix' : 'win32');
+  validarPathCanonico(style, cwd);
+}
+
+function validarFilesystemEffect(effect) {
+  validarClaves(effect, ['kind', 'pathStyle', 'absolutePath', 'access'], 'effect');
+  if (!['posix', 'win32'].includes(effect.pathStyle)
+      || !['read', 'mutate', 'delete'].includes(effect.access)) {
+    fallar('CONTRACT_INVALID', 'effect filesystem inválido');
+  }
+  validarPathCanonico(effect.pathStyle, effect.absolutePath);
+}
+
+function validarProcessEffect(effect) {
+  validarClaves(effect, ['kind', 'mode', 'pathStyle', 'executablePath', 'argv'], 'effect');
+  if (effect.mode !== 'direct' || !['posix', 'win32'].includes(effect.pathStyle)
+      || !Array.isArray(effect.argv) || effect.argv.length > 256) {
+    fallar('CONTRACT_INVALID', 'effect process inválido');
+  }
+  validarPathCanonico(effect.pathStyle, effect.executablePath);
+  effect.argv.forEach((item) => validarTextoCanonico(item, 'argv', 8192, true));
+}
+
+function validarNetworkEffect(effect) {
+  validarClaves(effect, ['kind', 'scheme', 'asciiHost', 'port'], 'effect');
+  if (!['http', 'https'].includes(effect.scheme)
+      || typeof effect.asciiHost !== 'string'
+      || !ASCII_HOST.test(effect.asciiHost)
+      || !Number.isInteger(effect.port) || effect.port < 1 || effect.port > 65535) {
+    fallar('CONTRACT_INVALID', 'effect network inválido');
+  }
+}
+
+function validarMemoryEffect(effect) {
+  validarClaves(effect, ['kind', 'namespace', 'resourceId', 'access'], 'effect');
+  validarIdentificador(effect.namespace, 'namespace');
+  validarIdentificador(effect.resourceId, 'resourceId');
+  if (!['read', 'write'].includes(effect.access)) {
+    fallar('CONTRACT_INVALID', 'effect memory inválido');
+  }
+}
+
+function validarDelegationEffect(effect) {
+  validarClaves(effect, ['kind', 'targetAgentNodeId', 'capabilities'], 'effect');
+  if (!/^agent:[a-f0-9]{64}$/u.test(effect.targetAgentNodeId)
+      || !Array.isArray(effect.capabilities) || effect.capabilities.length === 0
+      || effect.capabilities.some((item) => !CAPABILITIES.has(item))
+      || effect.capabilities.some((item, index) => (
+        index > 0 && effect.capabilities[index - 1] >= item
+      ))) {
+    fallar('CONTRACT_INVALID', 'effect delegation inválido');
+  }
+}
+
+function validarSkillEffect(effect) {
+  validarClaves(effect, ['kind', 'skillNodeId'], 'effect');
+  if (!/^skill:[a-f0-9]{64}$/u.test(effect.skillNodeId)) {
+    fallar('CONTRACT_INVALID', 'effect skill inválido');
+  }
+}
+
+function validarEffectShape(effect) {
+  validarObjeto(effect, 'effect');
+  validarTextoCanonico(effect.kind, 'effect kind', 32);
+  if (!EFFECT_KINDS_CANONICAL.has(effect.kind)) {
+    fallar('CONTRACT_INVALID', 'effect desconocido');
+  }
+  if (effect.kind === 'filesystem') validarFilesystemEffect(effect);
+  else if (effect.kind === 'process') validarProcessEffect(effect);
+  else if (effect.kind === 'network') validarNetworkEffect(effect);
+  else if (effect.kind === 'memory') validarMemoryEffect(effect);
+  else if (effect.kind === 'delegation') validarDelegationEffect(effect);
+  else validarSkillEffect(effect);
+}
+
+function validarEffectBinding(valor) {
+  const effect = valor.effect;
+  const expected = {
+    filesystem: {
+      capability: effect.access === 'read' ? 'filesystem.read' : 'filesystem.mutate',
+      effectKind: effect.access === 'read' ? 'read' : 'mutate',
+    },
+    process: { capability: 'shell.exec', effectKind: 'execute' },
+    network: { capability: 'network.access', effectKind: 'access' },
+    memory: {
+      capability: effect.access === 'read' ? 'memory.read' : 'memory.write',
+      effectKind: effect.access === 'read' ? 'read' : 'mutate',
+    },
+    delegation: { capability: 'delegate', effectKind: 'delegate' },
+    skill: { capability: 'skill.invoke', effectKind: 'invoke' },
+  }[effect.kind];
+  if (valor.capability !== expected.capability || valor.effectKind !== expected.effectKind) {
+    fallar('CONTRACT_INVALID', 'binding de effect inválido');
+  }
+}
+
+function validarOperationV11(valor) {
+  validarEffectShape(valor.effect);
+  validarCwdV11(valor.effect, valor.cwd);
+  validarEffectBinding(valor);
+  const digest = crypto.createHash('sha256')
+    .update(canonicalizarIJson(valor.effect), 'utf8').digest('hex');
+  if (digest !== valor.scope.digest) fallar('CONTRACT_INVALID', 'preimagen scope inválida');
+}
+
+function validarOperacion(valor) {
+  validarObjeto(valor, 'operación');
+  const esV11 = valor.schemaVersion === '1.1.0';
+  validarClaves(valor, esV11 ? OPERATION_KEYS_V11 : OPERATION_KEYS, 'operación');
+  if (![SCHEMA_VERSION, '1.1.0'].includes(valor.schemaVersion)) {
+    fallar('CONTRACT_INVALID', 'operación futura');
+  }
+  validarIdentificador(valor.operationId, 'operationId');
+  if (!CAPABILITIES.has(valor.capability)) {
+    fallar('CONTRACT_INVALID', 'operación capability inválida');
+  }
+  if (!EFFECT_KINDS.has(valor.effectKind)) fallar('CONTRACT_INVALID', 'operación effect inválido');
+  if (!SHA256.test(valor.payloadDigest)) fallar('CONTRACT_INVALID', 'operación digest inválido');
+  validarScope(valor.scope);
+  if (!esV11 && (typeof valor.cwd !== 'string'
+      || valor.cwd.length === 0 || valor.cwd.length > 4096)) {
+    fallar('CONTRACT_INVALID', 'operación cwd inválido');
+  }
+  if (!Number.isInteger(valor.fsmVersion) || valor.fsmVersion < 0) {
+    fallar('CONTRACT_INVALID', 'operación FSM inválida');
+  }
+  validarTimestampIso(valor.timestamp, 'operación timestamp');
+  if (esV11) {
+    validarIdentificador(valor.phaseId, 'phaseId');
+    if (!/^T-[0-9]{2}$/u.test(valor.taskId)) fallar('CONTRACT_INVALID', 'taskId inválido');
+    validarOperationV11(valor);
+  }
+}
+
+function verificarOperacionInterna(rawBytes) {
+  let valor;
+  try {
+    valor = parsearIJson(rawBytes);
+    validarOperacion(valor);
+  } catch (error) {
+    if (error.codigo === 'RAW_BYTES_INVALID') {
+      throw crearError('OPERATION_INVALID', 'raw bytes inválidos');
+    }
+    if (error.codigo === 'IJSON_DUPLICATE') {
+      throw crearError('OPERATION_INVALID', 'operación con clave duplicada');
+    }
+    throw crearError('OPERATION_INVALID', 'operación inválida');
+  }
+  return valor;
+}
+
+function verifyOperation(rawBytes) {
+  const valor = verificarOperacionInterna(rawBytes);
+  const operationDigest = crypto.createHash('sha256')
+    .update(canonicalizarIJson(valor), 'utf8')
+    .digest('hex');
+  congelarProfundo(valor);
+  const operation = Object.freeze({ ...valor, operationDigest });
+  VERIFIED_OPERATIONS.add(operation);
+  return operation;
+}
+
+function isVerifiedOperation(valor) {
+  return VERIFIED_OPERATIONS.has(valor);
+}
+
+function isKernelDependencies(valor) {
+  return KERNEL_DEPENDENCIES.has(valor);
+}
+
+function validarOpcionesBootstrap(opciones) {
+  try {
+    validarObjeto(opciones, 'opciones bootstrap');
+    validarClaves(opciones, ['workspaceRoot', 'now'], 'opciones bootstrap');
+  } catch {
+    fallar('BOOTSTRAP_INVALID', 'opciones bootstrap inválidas');
+  }
+  if (!esRutaLocalAbsoluta(opciones.workspaceRoot)) {
+    fallar('BOOTSTRAP_INVALID', 'workspace bootstrap inválido');
+  }
+  validarTimestampIso(opciones.now, 'bootstrap now');
+}
+
+function validarProvider(nombre, valor) {
+  validarObjeto(valor, 'provider bootstrap');
+  validarClaves(valor, ['implementation', 'fingerprint'], 'provider bootstrap');
+  if (valor.implementation !== PROVIDERS[nombre] || !SHA256.test(valor.fingerprint)) {
+    fallar('BOOTSTRAP_INVALID', 'provider bootstrap inválido');
+  }
+}
+
+function validarProviders(providers) {
+  validarObjeto(providers, 'providers bootstrap');
+  validarClaves(providers, Object.keys(PROVIDERS), 'providers bootstrap');
+  for (const nombre of Object.keys(PROVIDERS)) validarProvider(nombre, providers[nombre]);
+}
+
+function esRutaInterna(ruta, workspaceRoot) {
+  const workspace = path.resolve(workspaceRoot);
+  const destino = path.resolve(ruta);
+  const relativa = path.relative(workspace, destino);
+  return relativa === '' || (!relativa.startsWith('..') && !path.isAbsolute(relativa));
+}
+
+function esRutaLocalAbsoluta(ruta) {
+  if (typeof ruta !== 'string' || !path.isAbsolute(ruta) || ruta.includes('\0')) return false;
+  if (/^[\\/]{2}|^[A-Za-z]:[^\\/]/u.test(ruta)) return false;
+  if (ruta.normalize('NFKC') !== ruta) return false;
+  if (/[\u200B-\u200F\u202A-\u202E\u2060-\u206F]/u.test(ruta)) return false;
+  const resto = ruta.slice(path.parse(ruta).root.length);
+  if (resto.includes(':')) return false;
+  return resto.split(/[\\/]/u).every((segmento) => {
+    if (!segmento || /[. ]$/u.test(segmento) || /~\d+/u.test(segmento)) return false;
+    return !/^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/iu.test(segmento);
+  });
+}
+
+function validarRutaExterna(ruta, workspaceRoot) {
+  if (!esRutaLocalAbsoluta(ruta) || esRutaInterna(ruta, workspaceRoot)) {
+    fallar('BOOTSTRAP_INVALID', 'path bootstrap inválido');
+  }
+}
+
+function validarBootstrapClaims(claims, envelope, opciones) {
+  validarObjeto(claims, 'bootstrap claims');
+  validarClaves(claims, BOOTSTRAP_KEYS, 'bootstrap claims');
+  if (claims.kind !== 'kernel-bootstrap' || claims.schemaVersion !== SCHEMA_VERSION) {
+    fallar('BOOTSTRAP_INVALID', 'bootstrap futuro o inválido');
+  }
+  if (claims.trustEpoch !== envelope.trustEpoch || claims.trustDigest !== envelope.trustDigest) {
+    fallar('BOOTSTRAP_INVALID', 'bootstrap trust binding inválido');
+  }
+  validarProviders(claims.providers);
+  for (const campo of ['trustPath', 'signerPath', 'anchorPath']) {
+    validarRutaExterna(claims[campo], opciones.workspaceRoot);
+  }
+  validarTimestampIso(claims.issuedAt, 'bootstrap issuedAt');
+  validarTimestampIso(claims.expiresAt, 'bootstrap expiresAt');
+  validarIdentificador(claims.nonce, 'bootstrap nonce');
+  if (opciones.now < claims.issuedAt || opciones.now > claims.expiresAt) {
+    fallar('BOOTSTRAP_INVALID', 'bootstrap fuera de vigencia');
+  }
+}
+
+function validarEnvelopeBootstrap(envelope) {
+  if (
+    !esEnvelopeVerificado(envelope)
+    || envelope.type !== 'integrity'
+    || envelope.verifiedScope !== 'kernel:bootstrap'
+  ) {
+    fallar('BOOTSTRAP_INVALID', 'bootstrap no verificado');
+  }
+}
+
+function crearBootstrapReceipt(envelope, opciones) {
+  const receipt = Object.freeze({
+    kind: 'verified-kernel-bootstrap-receipt',
+    trustEpoch: envelope.trustEpoch, trustDigest: envelope.trustDigest,
+    rootKeyDigest: envelope.rootKeyDigest, providers: envelope.claims.providers,
+    trustPath: envelope.claims.trustPath, signerPath: envelope.claims.signerPath,
+    anchorPath: envelope.claims.anchorPath, issuedAt: envelope.claims.issuedAt,
+    expiresAt: envelope.claims.expiresAt, nonce: envelope.claims.nonce,
+  });
+  congelarProfundo(receipt);
+  VERIFIED_BOOTSTRAPS.add(receipt);
+  BOOTSTRAP_METADATA.set(receipt, Object.freeze({
+    workspaceRoot: opciones.workspaceRoot, signerKeyId: envelope.keyId,
+    signerPublicKeyDigest: envelope.signerPublicKeyDigest,
+  }));
+  return receipt;
+}
+
+function verifyKernelBootstrapReceipt(envelope, opciones) {
+  validarEnvelopeBootstrap(envelope);
+  validarOpcionesBootstrap(opciones);
+  try {
+    validarBootstrapClaims(envelope.claims, envelope, opciones);
+  } catch (error) {
+    if (error.codigo === 'BOOTSTRAP_INVALID') throw error;
+    throw crearError('BOOTSTRAP_INVALID', 'bootstrap inválido');
+  }
+  return crearBootstrapReceipt(envelope, opciones);
+}
+
+function isVerifiedKernelBootstrapReceipt(valor) {
+  return VERIFIED_BOOTSTRAPS.has(valor);
+}
+
+const { bindContractValidators } = require('./policy-verifier-utils');
+bindContractValidators({ isKernelDependencies, isVerifiedOperation });
+
+const runtimeModule = require('./integrity-ledger');
+const createBuiltInKernelRuntime = runtimeModule.createBuiltInKernelRuntime;
+delete runtimeModule.createBuiltInKernelRuntime;
+Object.freeze(runtimeModule);
+
+function componerRuntime(receipt, metadata) {
+  try {
+    return createBuiltInKernelRuntime({
+      receipt, workspaceRoot: metadata.workspaceRoot,
+      signerKeyId: metadata.signerKeyId,
+      signerPublicKeyDigest: metadata.signerPublicKeyDigest,
+    });
+  } catch (error) {
+    if (error.codigo) throw error;
+    throw crearError('KERNEL_DEPENDENCIES_INVALID', 'composición del kernel inválida');
+  }
+}
+
+function crearDependencies(runtime) {
+  const dependencies = congelarProfundo(Object.freeze({
+    kind: 'kernel-dependencies', providers: runtime.providers,
+    gateEngine: runtime.gateEngine,
+    integrityLedger: runtime.integrityLedger,
+    policyBroker: runtime.policyBroker,
+    policyContextProvider: runtime.policyContextProvider,
+    singleUseStore: runtime.singleUseStore,
+  }));
+  KERNEL_DEPENDENCIES.add(dependencies);
+  return dependencies;
+}
+
+function createKernelDependencies(receipt) {
+  const autorizado = arguments.length === 1 && VERIFIED_BOOTSTRAPS.has(receipt);
+  if (!autorizado) fallar('KERNEL_DEPENDENCIES_INVALID', 'bootstrap receipt no autorizado');
+  const metadata = BOOTSTRAP_METADATA.get(receipt);
+  return crearDependencies(componerRuntime(receipt, metadata));
+}
+
+module.exports = {
+  createKernelDependencies,
+  isKernelDependencies,
+  isVerifiedKernelBootstrapReceipt,
+  isVerifiedOperation,
+  verifyKernelBootstrapReceipt,
+  verifyOperation,
+};

package/scripts/lib/policy-verifier-utils.js

@@ -0,0 +1,65 @@
+'use strict';
+
+/** Primitivas puras compartidas por los verificadores de capabilities W2. */
+
+const util = require('node:util');
+
+let contractValidators = null;
+
+function fail(code, message) {
+  const error = new Error(message);
+  error.codigo = code;
+  throw error;
+}
+
+function plainObject(value, code, label) {
+  if (!value || typeof value !== 'object' || Array.isArray(value) || util.types.isProxy(value)) {
+    fail(code, `${label} inválido`);
+  }
+  const proto = Object.getPrototypeOf(value);
+  const descriptors = Object.values(Object.getOwnPropertyDescriptors(value));
+  if ((proto !== Object.prototype && proto !== null)
+      || Object.getOwnPropertySymbols(value).length > 0
+      || descriptors.some((item) => !item.enumerable || !('value' in item))) {
+    fail(code, `${label} inválido`);
+  }
+}
+
+function exactKeys(value, keys, code, label) {
+  if (JSON.stringify(Object.keys(value).sort()) !== JSON.stringify([...keys].sort())) {
+    fail(code, `${label} con propiedades inválidas`);
+  }
+}
+
+function freezeDeep(value) {
+  if (!value || typeof value !== 'object' || Object.isFrozen(value)) return value;
+  Object.values(value).forEach(freezeDeep);
+  return Object.freeze(value);
+}
+
+function bindContractValidators(validators) {
+  plainObject(validators, 'KERNEL_BINDING_INVALID', 'predicados del contrato');
+  exactKeys(
+    validators, ['isKernelDependencies', 'isVerifiedOperation'],
+    'KERNEL_BINDING_INVALID', 'predicados del contrato'
+  );
+  if (Object.values(validators).some((validator) => typeof validator !== 'function')) {
+    fail('KERNEL_BINDING_INVALID', 'predicados del contrato inválidos');
+  }
+  const hasConflict = contractValidators && Object.keys(contractValidators)
+    .some((key) => contractValidators[key] !== validators[key]);
+  if (hasConflict) {
+    fail('KERNEL_BINDING_CONFLICT', 'predicados del contrato ya ligados');
+  }
+  contractValidators ||= Object.freeze({ ...validators });
+  return contractValidators;
+}
+
+function getContractValidators() {
+  if (!contractValidators) fail('KERNEL_BINDING_MISSING', 'predicados del contrato no ligados');
+  return contractValidators;
+}
+
+module.exports = {
+  bindContractValidators, exactKeys, fail, freezeDeep, getContractValidators, plainObject,
+};