@vizejs/plugin-sdk 0.429.0

package/index.d.ts

@@ -0,0 +1,75 @@
+import type { FactGroups } from "./facts.js";
+
+export declare const BATCH_SCHEMA: 1;
+export interface PluginNode {
+  readonly id: number;
+  readonly parent?: number;
+  readonly kind: string;
+  readonly name?: string;
+  readonly value?: string;
+  readonly attrs?: readonly (readonly [string, string | null])[];
+  readonly alias?: {
+    readonly value: string;
+    readonly key: string | null;
+    readonly index: string | null;
+  };
+}
+export interface ScopeEntry {
+  readonly name: string;
+  readonly position: "value" | "key" | "index" | "slot";
+}
+export interface RuleContext {
+  readonly nodes: readonly PluginNode[];
+  facts(name: "templateScopes"): ReadonlyMap<number, readonly ScopeEntry[]>;
+  facts<K extends keyof FactGroups>(name: K): FactGroups[K];
+  facts<T = unknown>(name: string): ReadonlyMap<string | number, T>;
+  ancestors(node: PluginNode, kind: string): IterableIterator<PluginNode>;
+  /** Replace the whole reported node span; ranges are assigned by the host. */
+  report(node: PluginNode, message: string, fix?: string): void;
+}
+export interface PluginDefinition {
+  name: string;
+  version: string;
+  visit?: readonly string[];
+  demands?: readonly string[];
+  /** Explicit list of all captured configuration and ambient inputs. */
+  cacheInputs?: readonly { name: string; value: string }[];
+  rules: Readonly<Record<string, (context: RuleContext) => void>>;
+}
+/** Frozen at runtime. Array declarations interoperate with generated native descriptors. */
+export interface Plugin extends Omit<PluginDefinition, "visit" | "demands" | "cacheInputs"> {
+  readonly visit?: string[];
+  readonly demands: string[];
+  readonly cacheInputs?: { name: string; value: string }[];
+  readonly fingerprint: string;
+  run(batchJson: string): string;
+}
+export interface VisitBatch {
+  schema: 1;
+  plugin?: string;
+  file?: string;
+  parents: number[];
+  nodes: PluginNode[];
+  facts: Record<string, Array<[string | number, unknown]>>;
+}
+export declare function definePlugin(definition: PluginDefinition): Plugin;
+export declare function runBatch(
+  plugin: Plugin,
+  batch: VisitBatch,
+): Array<{ rule: string; node: number; message: string; fix?: string }>;
+
+export declare function runRules(
+  plugin: Plugin,
+  source: {
+    nodes: readonly PluginNode[];
+    byId: ReadonlyMap<number, PluginNode>;
+    facts(name: string): ReadonlyMap<string | number, unknown>;
+    parent(id: number): number;
+  },
+): Array<{ rule: string; node: number; message: string; fix?: string }>;
+
+export { defineFactProvider, defineOutputPlugin, defineTransformPlugin } from "./stages.js";
+export { applyFixes } from "./fixes.js";
+
+export type * from "./facts.js";
+export type * from "./stages.js";

package/index.js

@@ -0,0 +1,101 @@
+// Authoring API for serialized L2 visits and native compiler hooks.
+// See README.md for the runtime and trust boundaries.
+import { createHash } from "node:crypto";
+import { SDK_FINGERPRINT } from "./identity.js";
+
+/** Every batch this SDK reads is at this wire version. */
+export const BATCH_SCHEMA = 1;
+
+/**
+ * A plugin: static manifest (`visit` kinds, `demands` fact groups) plus
+ * rules `(ctx) => void`. `run` is what the native host calls, once per
+ * document: batch JSON in, report JSON out.
+ */
+export function definePlugin({ name, version, visit, demands = [], cacheInputs, rules }) {
+  if (
+    !name ||
+    !version ||
+    !rules ||
+    Object.values(rules).some((rule) => typeof rule !== "function")
+  ) {
+    throw new TypeError("a plugin needs name, version and synchronous rule functions");
+  }
+  const code = Object.entries(rules).map(([id, rule]) => [id, String(rule)]);
+  const fingerprint = createHash("sha256")
+    .update(JSON.stringify([SDK_FINGERPRINT, name, version, visit ?? null, demands, code]))
+    .digest("hex");
+  const plugin = {
+    name,
+    version,
+    fingerprint,
+    visit: visit && Object.freeze([...visit]),
+    demands: Object.freeze([...demands]),
+    cacheInputs:
+      cacheInputs && Object.freeze(cacheInputs.map((input) => Object.freeze({ ...input }))),
+    rules: Object.freeze({ ...rules }),
+  };
+  plugin.run = (batchJson) => JSON.stringify(runBatch(plugin, JSON.parse(batchJson)));
+  return Object.freeze(plugin);
+}
+
+/** Run every rule over one parsed batch; returns the report array. */
+export function runBatch(plugin, batch) {
+  if (batch.schema !== BATCH_SCHEMA) {
+    throw new Error(`${plugin.name}: batch schema ${batch.schema}, SDK reads ${BATCH_SCHEMA}`);
+  }
+  freeze(batch);
+  const byId = new Map(batch.nodes.map((node) => [node.id, node]));
+  const facts = (name) => new Map(batch.facts[name]);
+  const parent = (id) => batch.parents[id];
+  return runRules(plugin, { nodes: batch.nodes, byId, facts, parent });
+}
+
+export function runRules(plugin, source) {
+  const reports = [];
+  for (const [rule, check] of Object.entries(plugin.rules)) {
+    const returned = check(context(plugin, rule, source, reports));
+    if (returned?.then)
+      throw new TypeError(`${plugin.name}/${rule}: asynchronous rules are unsupported`);
+  }
+  return reports;
+}
+
+function context(plugin, rule, { nodes, byId, facts, parent }, reports) {
+  const where = `${plugin.name}/${rule}`;
+  const visits = (kind) => !plugin.visit || plugin.visit.includes(kind);
+  return Object.freeze({
+    nodes,
+    facts(name) {
+      if (!plugin.demands.includes(name)) {
+        throw new Error(`${where}: fact group \`${name}\` was not declared in demands`);
+      }
+      return facts(name);
+    },
+    *ancestors(node, kind) {
+      if (!visits(kind)) {
+        throw new Error(`${where}: ancestors of kind ${kind} need ${kind} in visit`);
+      }
+      for (let id = parent(node.id); id !== -1; id = parent(id)) {
+        const found = byId.get(id);
+        if (found && found.kind === kind) yield found;
+      }
+    },
+    report(node, message, fix) {
+      if (!byId.has(node.id)) throw new Error(`${where}: report needs a visited node`);
+      if (typeof message !== "string" || (fix !== undefined && typeof fix !== "string")) {
+        throw new TypeError(`${where}: message and optional fix must be strings`);
+      }
+      reports.push({ rule, node: node.id, message, ...(fix === undefined ? {} : { fix }) });
+    },
+  });
+}
+
+function freeze(value) {
+  if (value && typeof value === "object" && !Object.isFrozen(value)) {
+    for (const child of Object.values(value)) freeze(child);
+    Object.freeze(value);
+  }
+}
+
+export { defineFactProvider, defineOutputPlugin, defineTransformPlugin } from "./stages.js";
+export { applyFixes } from "./fixes.js";

package/package.json

@@ -0,0 +1,69 @@
+{
+  "bugs": {
+    "url": "https://github.com/ubugeeei-prod/vize/issues"
+  },
+  "description": "Deterministic authoring and isolated execution for Vize JavaScript plugins",
+  "devDependencies": {
+    "@vizejs/native": "0.429.0"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "exports": {
+    ".": {
+      "default": "./index.js",
+      "types": "./index.d.ts"
+    },
+    "./fixes": {
+      "default": "./fixes.js",
+      "types": "./fixes.d.ts"
+    },
+    "./sandbox": {
+      "default": "./sandbox.js",
+      "types": "./sandbox.d.ts"
+    }
+  },
+  "files": [
+    "index.js",
+    "identity.js",
+    "index.d.ts",
+    "facts.d.ts",
+    "stages.js",
+    "stages.d.ts",
+    "fixes.js",
+    "fixes.d.ts",
+    "README.md",
+    "sandbox.js",
+    "sandbox-worker.js",
+    "sandbox.d.ts"
+  ],
+  "homepage": "https://github.com/ubugeeei-prod/vize",
+  "license": "MIT",
+  "metadata": {
+    "vize": {
+      "stability": "alpha-supported",
+      "stabilityDocs": "https://github.com/ubugeeei-prod/vize/blob/main/docs/content/stability.md#package-support-tiers"
+    }
+  },
+  "name": "@vizejs/plugin-sdk",
+  "peerDependencies": {
+    "@vizejs/native": ">=0.429.0"
+  },
+  "peerDependenciesMeta": {
+    "@vizejs/native": {
+      "optional": true
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "directory": "npm/plugin-sdk",
+    "type": "git",
+    "url": "https://github.com/ubugeeei-prod/vize.git"
+  },
+  "sideEffects": false,
+  "type": "module",
+  "types": "./index.d.ts",
+  "version": "0.429.0"
+}

package/sandbox-worker.js

@@ -0,0 +1,64 @@
+// This program executes only inside the isolated container. Its VM is not a
+// security boundary: the container supplies filesystem/network/process limits.
+import { readFileSync, writeSync } from "node:fs";
+import { runInThisContext } from "node:vm";
+
+const request = JSON.parse(readFileSync(0, "utf8"));
+const sdk = await import(request.sdk);
+const { definition, batchJson } = request;
+const configuration = freeze(definition.configuration ?? null);
+const callback = (source) => {
+  // Evaluation happens only in the container; the VM supplies no isolation.
+  const fn = runInThisContext(`"use strict"; (${source})`);
+  if (typeof fn !== "function") throw new TypeError("callback source must be a function");
+  return (batch) => fn(batch, configuration);
+};
+const common = {
+  name: definition.name,
+  version: definition.version,
+  visit: definition.visit,
+  demands: definition.demands,
+  cacheInputs: definition.cacheInputs,
+};
+let plugin;
+switch (definition.family) {
+  case "rule":
+    plugin = sdk.definePlugin({
+      ...common,
+      rules: Object.fromEntries(
+        Object.entries(definition.rules).map(([name, source]) => [name, callback(source)]),
+      ),
+    });
+    break;
+  case "transform":
+    plugin = sdk.defineTransformPlugin({ ...common, transform: callback(definition.callback) });
+    break;
+  case "provider":
+    plugin = sdk.defineFactProvider({
+      ...common,
+      provides: definition.provides,
+      provide: callback(definition.callback),
+    });
+    break;
+  case "formatter":
+  case "output":
+    plugin = sdk.defineOutputPlugin({
+      ...common,
+      family: definition.family,
+      output: callback(definition.callback),
+    });
+    break;
+  default:
+    throw new TypeError("unsupported sandbox family");
+}
+const output = plugin.run(batchJson);
+// The parent bounds every stdout/stderr byte, including unsolicited writes.
+writeSync(1, output);
+
+function freeze(value) {
+  if (value && typeof value === "object") {
+    for (const child of Object.values(value)) freeze(child);
+    Object.freeze(value);
+  }
+  return value;
+}

package/sandbox.d.ts

@@ -0,0 +1,55 @@
+import type { NativeHook, JsonValue, HookIdentity } from "./stages.js";
+
+/** A standalone function expression. It receives (contextOrBatch, configuration).
+ * Closures and host imports are unavailable; process access stays in the container.
+ */
+export type CallbackSource = string;
+export interface SandboxIdentity extends HookIdentity {
+  visit?: readonly string[];
+  demands?: readonly string[];
+  configuration?: JsonValue;
+}
+export type SandboxDefinition = SandboxIdentity &
+  (
+    | { family?: "rule"; rules: Readonly<Record<string, CallbackSource>> }
+    | { family: "provider"; provides: readonly string[]; callback: CallbackSource }
+    | { family: "transform" | "formatter" | "output"; callback: CallbackSource }
+  );
+export interface SandboxLimits {
+  /** 100..60000 ms; default 5000. Runtime check and cleanup each add at most 5000 ms. */
+  timeoutMs?: number;
+  /** 1024..4194304 bytes for serialized request and each output stream; default 1 MiB. */
+  maxBytes?: number;
+}
+/** Requires Docker and a pre-pulled SANDBOX_IMAGE. There are no host mounts or
+ * host environment variables, network is disabled, root is read-only, and each
+ * invocation has fixed memory/CPU/PID limits and confirmed container cleanup.
+ * Runtime filesystem contents remain readable. Native callbacks are trusted.
+ */
+export type SandboxHook = NativeHook & { readonly visit?: string[]; readonly demands?: string[] };
+export declare function createSandboxRunner(
+  definition: SandboxIdentity & {
+    family: "provider";
+    provides: readonly string[];
+    callback: CallbackSource;
+  },
+  limits?: SandboxLimits,
+): SandboxHook & { readonly provides: string[] };
+export declare function createSandboxRunner(
+  definition: SandboxIdentity & { family: "formatter" | "output"; callback: CallbackSource },
+  limits?: SandboxLimits,
+): SandboxHook & { readonly family: "formatter" | "output" };
+export declare function createSandboxRunner(
+  definition: SandboxDefinition,
+  limits?: SandboxLimits,
+): SandboxHook;
+export type SandboxErrorCode =
+  | "runtime_unavailable"
+  | "execution_stopped"
+  | "execution_failed"
+  | "cleanup_failed";
+export declare class SandboxRuntimeError extends Error {
+  readonly code: SandboxErrorCode;
+  constructor(code: SandboxErrorCode, message: string, options?: ErrorOptions);
+}
+export declare const SANDBOX_IMAGE: string;

package/sandbox.js

@@ -0,0 +1,328 @@
+import { spawnSync } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { Script } from "node:vm";
+
+/** Official Node 24.14.0 multi-platform index; changing this changes cache keys. */
+export const SANDBOX_IMAGE =
+  "node:24.14.0-bookworm-slim@sha256:d8e448a56fc63242f70026718378bd4b00f8c82e78d20eefb199224a4d8e33d8";
+
+/** Typed refusal; unavailable isolation never falls back to a trusted callback. */
+export class SandboxRuntimeError extends Error {
+  constructor(code, message, options) {
+    super(message, options);
+    this.name = "SandboxRuntimeError";
+    this.code = code;
+  }
+}
+
+/** Run serialized callback source in a restricted container with no host mounts. */
+export function createSandboxRunner(input, limits = {}) {
+  const definition = validate(input);
+  const timeoutMs = integer(limits.timeoutMs ?? 5000, 100, 60000, "timeoutMs");
+  const maxBytes = integer(limits.maxBytes ?? 1048576, 1024, 4194304, "maxBytes");
+  if (Object.keys(limits).some((key) => !["timeoutMs", "maxBytes"].includes(key))) {
+    throw new TypeError("unsupported sandbox limit");
+  }
+  const worker = readFileSync(new URL("./sandbox-worker.js", import.meta.url), "utf8");
+  const sdk = bundledSdk();
+  const fingerprint = createHash("sha256")
+    .update(JSON.stringify([definition, SANDBOX_IMAGE, worker, sdk, timeoutMs, maxBytes]))
+    .digest("hex");
+  return Object.freeze({
+    name: definition.name,
+    version: definition.version,
+    visit: definition.visit,
+    demands: definition.demands,
+    provides: definition.provides,
+    family: ["formatter", "output"].includes(definition.family) ? definition.family : undefined,
+    cacheInputs: definition.cacheInputs,
+    fingerprint,
+    run(batchJson) {
+      if (typeof batchJson !== "string") throw new TypeError("sandbox batch must be JSON text");
+      JSON.parse(batchJson);
+      const request = JSON.stringify({ definition, batchJson, sdk });
+      if (Buffer.byteLength(request) > maxBytes)
+        throw new RangeError("sandbox input limit exceeded");
+      const prerequisite = spawnSync(
+        "docker",
+        ["image", "inspect", "--format={{.Id}}", SANDBOX_IMAGE],
+        {
+          encoding: "utf8",
+          timeout: 5000,
+          maxBuffer: 16384,
+        },
+      );
+      if (prerequisite.error || prerequisite.status !== 0) {
+        throw new SandboxRuntimeError(
+          "runtime_unavailable",
+          `Docker and the pre-pulled SANDBOX_IMAGE are required: ${prerequisite.error?.code ?? prerequisite.stderr.trim()}`,
+          { cause: prerequisite.error },
+        );
+      }
+      const name = `vize-plugin-${randomUUID()}`;
+      let failure;
+      let output;
+      try {
+        const result = spawnSync(
+          "docker",
+          [
+            "run",
+            "--rm",
+            "--pull=never",
+            "--name",
+            name,
+            "--label",
+            "vize.plugin-sandbox=1",
+            "--label",
+            `vize.plugin-sandbox.host=${process.pid}`,
+            "--network=none",
+            "--read-only",
+            "--user=65534:65534",
+            "--cap-drop=ALL",
+            "--security-opt=no-new-privileges:true",
+            "--pids-limit=32",
+            "--memory=128m",
+            "--memory-swap=128m",
+            "--cpus=1",
+            "--ulimit=nofile=64:64",
+            "--ipc=none",
+            "--log-driver=none",
+            "--workdir=/",
+            "--entrypoint=node",
+            "-i",
+            SANDBOX_IMAGE,
+            "--max-old-space-size=64",
+            "--input-type=module",
+            "--eval",
+            worker,
+          ],
+          {
+            input: request,
+            encoding: "utf8",
+            timeout: timeoutMs,
+            maxBuffer: maxBytes,
+            killSignal: "SIGKILL",
+            windowsHide: true,
+          },
+        );
+        if (result.error)
+          throw new SandboxRuntimeError(
+            "execution_stopped",
+            `sandbox execution stopped: ${result.error.code}`,
+            { cause: result.error },
+          );
+        if (result.status !== 0) {
+          throw new SandboxRuntimeError(
+            "execution_failed",
+            `sandbox execution failed (${result.status}): ${result.stderr.trim()}`,
+          );
+        }
+        if (Buffer.byteLength(result.stdout) > maxBytes)
+          throw new SandboxRuntimeError("execution_stopped", "sandbox output limit exceeded");
+        JSON.parse(result.stdout);
+        output = result.stdout;
+      } catch (error) {
+        failure = error;
+      }
+      // Execution errors are captured above, so cleanup also runs after failure.
+      // Killing the attached CLI does not kill its container.
+      try {
+        confirmRemoval(name);
+      } catch (cleanup) {
+        failure = new SandboxRuntimeError(
+          "cleanup_failed",
+          `sandbox container cleanup was not confirmed: ${cleanup.message}`,
+          { cause: new AggregateError([failure, cleanup].filter(Boolean)) },
+        );
+      }
+      if (failure) throw failure;
+      return output;
+    },
+  });
+}
+
+function confirmRemoval(name) {
+  const deadline = performance.now() + 5000;
+  const run = (args) =>
+    spawnSync("docker", args, {
+      encoding: "utf8",
+      timeout: Math.max(1, Math.ceil(deadline - performance.now())),
+      maxBuffer: 16384,
+      killSignal: "SIGKILL",
+    });
+  const detail = (result) =>
+    `${result.error?.code ?? `status ${result.status}`}: ${result.stderr?.trim() ?? ""}`;
+  let last = "cleanup deadline expired";
+  while (performance.now() < deadline) {
+    const removed = run(["rm", "--force", name]);
+    if (!removed.error && removed.status === 0) return;
+    last = `rm: ${detail(removed)}`;
+    if (performance.now() >= deadline) break;
+    // --rm may already be deleting the container. An rm error is not proof of
+    // absence: inspect this exact unique name before returning or retrying.
+    const inspected = run(["container", "inspect", "--format={{.Id}}", name]);
+    last += `; inspect: ${detail(inspected)}`;
+    if (
+      !inspected.error &&
+      inspected.status !== 0 &&
+      new RegExp(
+        `^(?:Error response from daemon: |Error: )No such (?:object|container): ${name}$`,
+      ).test(inspected.stderr.trim())
+    )
+      return;
+    if (
+      inspected.error ||
+      inspected.status !== 0 ||
+      !/^[a-f0-9]{64}$/.test(inspected.stdout.trim())
+    ) {
+      throw new Error(last);
+    }
+    // It still exists, including removal-in-progress. All retries share the
+    // original deadline; daemon errors and timeout never count as success.
+  }
+  throw new Error(last);
+}
+
+function validate(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input))
+    throw new TypeError("sandbox manifest required");
+  const allowed = [
+    "name",
+    "version",
+    "family",
+    "visit",
+    "demands",
+    "provides",
+    "cacheInputs",
+    "rules",
+    "callback",
+    "configuration",
+  ];
+  if (Object.keys(input).some((key) => !allowed.includes(key)))
+    throw new TypeError("unsupported sandbox manifest field");
+  if (
+    typeof input.name !== "string" ||
+    !input.name ||
+    typeof input.version !== "string" ||
+    !input.version
+  ) {
+    throw new TypeError("sandbox name and version must be nonempty strings");
+  }
+  const family = input.family ?? "rule";
+  if (!["rule", "transform", "provider", "formatter", "output"].includes(family))
+    throw new TypeError("unsupported sandbox family");
+  for (const key of ["visit", "demands", "provides"]) {
+    if (
+      input[key] !== undefined &&
+      (!Array.isArray(input[key]) || input[key].some((v) => typeof v !== "string"))
+    ) {
+      throw new TypeError(`sandbox ${key} must contain strings`);
+    }
+  }
+  if (family === "provider" && !input.provides?.length)
+    throw new TypeError("provider must declare provides");
+  if (
+    input.cacheInputs !== undefined &&
+    (!Array.isArray(input.cacheInputs) ||
+      input.cacheInputs.some(
+        (v) =>
+          !v ||
+          typeof v.name !== "string" ||
+          typeof v.value !== "string" ||
+          Object.keys(v).length !== 2,
+      ))
+  )
+    throw new TypeError("sandbox cache inputs need name and value strings");
+  if (family === "rule") {
+    if (
+      !input.rules ||
+      Array.isArray(input.rules) ||
+      typeof input.rules !== "object" ||
+      input.callback !== undefined
+    ) {
+      throw new TypeError("rule sandbox needs callback sources in rules");
+    }
+    for (const [id, source] of Object.entries(input.rules)) {
+      if (!id) throw new TypeError("rule id must be nonempty");
+      parseCallback(source);
+    }
+  } else {
+    if (input.rules !== undefined) throw new TypeError("stage sandbox uses callback, not rules");
+    parseCallback(input.callback);
+  }
+  assertJson(input.configuration ?? null);
+  return freeze(JSON.parse(JSON.stringify({ ...input, family })));
+}
+
+function parseCallback(source) {
+  if (
+    typeof source !== "string" ||
+    source.length > 65536 ||
+    !/^(?:async\s+)?(?:function\b|\([^]*?\)\s*=>|[\w$]+\s*=>)/.test(source.trim())
+  ) {
+    throw new TypeError("sandbox callback must be standalone function source");
+  }
+  // Parsing only: this never evaluates guest code in the host process.
+  new Script(`(${source})`, { filename: "sandbox-callback.js" });
+}
+
+function assertJson(value) {
+  if (
+    value === null ||
+    typeof value === "string" ||
+    typeof value === "boolean" ||
+    (typeof value === "number" && Number.isFinite(value))
+  )
+    return;
+  if (
+    value &&
+    typeof value === "object" &&
+    (Array.isArray(value) || Object.getPrototypeOf(value) === Object.prototype)
+  ) {
+    for (const child of Object.values(value)) assertJson(child);
+    return;
+  }
+  throw new TypeError("sandbox configuration must be JSON data");
+}
+
+function bundledSdk() {
+  const data = (source) => `data:text/javascript;base64,${Buffer.from(source).toString("base64")}`;
+  const files = Object.fromEntries(
+    ["index.js", "stages.js", "identity.js", "package.json"].map((file) => [
+      file,
+      readFileSync(new URL(file, import.meta.url)),
+    ]),
+  );
+  // Match the actual package identity's byte-level hash. Its filesystem reader
+  // cannot run from a data URL, so transport the resulting identity as a module.
+  const hash = createHash("sha256");
+  for (const [file, bytes] of Object.entries(files)) {
+    hash.update(file).update(String(bytes.length)).update(bytes);
+  }
+  const identity = data(`export const SDK_FINGERPRINT = ${JSON.stringify(hash.digest("hex"))};`);
+  const stage = data(
+    files["stages.js"].toString("utf8").replace('from "./identity.js"', `from "${identity}"`),
+  );
+  const fixes = data(readFileSync(new URL("./fixes.js", import.meta.url), "utf8"));
+  const index = files["index.js"]
+    .toString("utf8")
+    .replace('from "./identity.js"', `from "${identity}"`)
+    .replace('from "./stages.js"', `from "${stage}"`)
+    .replace('from "./fixes.js"', `from "${fixes}"`);
+  return data(index);
+}
+
+function integer(value, min, max, name) {
+  if (!Number.isInteger(value) || value < min || value > max)
+    throw new RangeError(`invalid sandbox ${name}`);
+  return value;
+}
+
+function freeze(value) {
+  if (value && typeof value === "object") {
+    for (const child of Object.values(value)) freeze(child);
+    Object.freeze(value);
+  }
+  return value;
+}