graphlin 0.1.2 → 0.2.0

package/runtime/discovery/structure.mjs

@@ -0,0 +1,232 @@
+import path from 'node:path';
+import { freeze, hash as contentHash, isHash, isId, opaque, plain } from '../core/common.mjs';
+import { excluded, safeLabel, privateText, safeText } from '../core/privacy.mjs';
+import { loadParser } from './parser.mjs';
+
+export const IDENTITY_VERSION = 'source-scope-v1';
+export const EXTRACTOR_VERSION = 'structure-v1';
+export const STRUCTURE_LIMITS = Object.freeze({
+  fileBytes: 256 * 1024, entities: 2048, imports: 512, bindings: 128, nodes: 50000, depth: 128, milliseconds: 100,
+});
+const LANGUAGES = { '.js': 'javascript', '.mjs': 'javascript', '.cjs': 'javascript', '.jsx': 'javascript',
+  '.ts': 'typescript', '.mts': 'typescript', '.cts': 'typescript', '.tsx': 'tsx', '.py': 'python', '.pyi': 'python' };
+const DECLARATIONS = {
+  class_declaration: 'class', abstract_class_declaration: 'class', class_definition: 'class',
+  function_declaration: 'function', generator_function_declaration: 'function',
+  function_definition: 'function', function_signature: 'function',
+  method_definition: 'method', method_signature: 'method', abstract_method_signature: 'method',
+  interface_declaration: 'interface', internal_module: 'namespace', module: 'namespace',
+  enum_declaration: 'enum', type_alias_declaration: 'type_alias',
+};
+const FUNCTIONS = new Set(['arrow_function', 'function_expression', 'generator_function', 'function']);
+const field = (node, name) => node.childForFieldName(name);
+const lines = node => ({ startLine: node.startPosition.row + 1, endLine: Math.max(node.startPosition.row + 1,
+  node.endPosition.row + (node.endPosition.column === 0 ? 0 : 1)) });
+const simpleName = node => node && ['identifier', 'property_identifier', 'private_property_identifier',
+  'type_identifier', 'dotted_name', 'nested_identifier'].includes(node.type) ? node.text : null;
+
+function budget(options = {}) {
+  options = plain(options) ? options : {};
+  return Object.fromEntries(Object.entries(STRUCTURE_LIMITS).map(([key, max]) =>
+    [key, Number.isSafeInteger(options[key]) && options[key] > 0 ? Math.min(max, options[key]) : max]));
+}
+function literal(node) {
+  if (!node || node.type !== 'string' || node.hasError) return null;
+  const text = node.text;
+  // Escaped/interpolated/dynamic module specifiers require a resolver. Do not
+  // turn their source spelling into a claimed literal target.
+  return text.length > 2 && text[0] === text.at(-1) && !/[\\\r\n]/.test(text.slice(1, -1)) ? text.slice(1, -1) : null;
+}
+
+/**
+ * Extract local structure from an already-authorized immutable capture.
+ * No source I/O, transmission, classification, or runtime claims occur here.
+ * `complete:false` is mandatory for caller-truncated captures/windows.
+ */
+export async function extractStructure({
+  artifactId, relativePath, text, hash, generation, complete = true, limits: options, signal,
+} = {}) {
+  if (!isId(artifactId) || typeof relativePath !== 'string' || !relativePath || path.posix.isAbsolute(relativePath) ||
+      relativePath.split('/').some(part => !part || part === '..' || part === '.') || /[\\\0\r\n]/.test(relativePath) ||
+      !Number.isSafeInteger(generation) || generation < 1 || !isHash(hash)) throw new TypeError('INVALID_STRUCTURE_INPUT');
+  const limits = budget(options);
+  const language = LANGUAGES[path.posix.extname(relativePath).toLowerCase()] ?? null;
+  const scopeId = opaque('entity', IDENTITY_VERSION, artifactId, language, 'module');
+  const omissions = [];
+  const omit = reason => { if (!omissions.includes(reason)) omissions.push(reason); };
+  const entities = [], relations = [], imports = [];
+  const enumeration = {
+    complete: false, extractor: 'file-level', version: '1', scopeId, omissions, artifactId, hash, generation,
+    identityVersion: IDENTITY_VERSION, capability: language ? 'lexical' : 'unsupported', coveredRanges: [],
+  };
+  const result = () => freeze({ entities, relations, imports, enumeration });
+  if (excluded(relativePath) || !safeText(relativePath, 4096)) { omit('excluded_path'); return result(); }
+  const label = path.posix.basename(relativePath);
+  if (!safeLabel(label)) { omit('unsafe_label'); return result(); }
+  // File identity is metadata; without usable source there are no declaration
+  // spans or ownership edges. The host still owns the display/persistence grant.
+  entities.push({ id: scopeId, label, kind: 'module', parentId: null, artifactId,
+    startLine: 1, endLine: 1, qualifiedName: relativePath });
+  if (!language) { omit('unsupported_language'); return result(); }
+  if (typeof text !== 'string') { omit('source_unavailable'); return result(); }
+  if (text.length > limits.fileBytes || Buffer.byteLength(text, 'utf8') > limits.fileBytes) {
+    omit('file_bytes'); return result();
+  }
+  if (text.includes('\0') || privateText(text)) { omit('source_filtered'); return result(); }
+  if (contentHash(text) !== hash) { omit('hash_mismatch'); return result(); }
+  if (complete !== true) omit('partial_capture');
+  if (signal?.aborted) { omit('aborted'); return result(); }
+  entities[0].endLine = Math.max(1, text.split('\n').length - (text.endsWith('\n') ? 1 : 0));
+
+  let parser, tree, loaded;
+  try {
+    loaded = await loadParser(language);
+    if (signal?.aborted) { omit('aborted'); return result(); }
+    parser = new loaded.Parser();
+    parser.setLanguage(loaded.grammar);
+    const deadline = performance.now() + limits.milliseconds;
+    tree = parser.parse(text, null, { progressCallback: () => signal?.aborted || performance.now() >= deadline });
+    if (!tree) { omit(signal?.aborted ? 'aborted' : 'parse_timeout'); return result(); }
+    enumeration.extractor = 'tree-sitter';
+    enumeration.version = `${EXTRACTOR_VERSION}/${loaded.version}`;
+    enumeration.capability = 'parsed';
+    if (tree.rootNode.hasError) omit('parse_error');
+    const counts = new Map();
+    const add = (name, kind, node, owner) => {
+      if (!safeLabel(name)) { omit('unsafe_label'); return null; }
+      if (entities.length >= limits.entities) { omit('entity_limit'); return null; }
+      const key = JSON.stringify([owner.id, kind, name]);
+      const ordinal = counts.get(key) ?? 0;
+      counts.set(key, ordinal + 1);
+      const id = opaque('entity', IDENTITY_VERSION, artifactId, language, owner.id, kind, name, ordinal);
+      const entity = { id, label: name, kind, parentId: owner.id, artifactId, ...lines(node),
+        qualifiedName: `${owner.qualifiedName}::${name}${ordinal ? `#${ordinal + 1}` : ''}` };
+      entities.push(entity);
+      relations.push({ id: opaque('relation', 'contains', owner.id, id), source: owner.id, target: id, kind: 'contains' });
+      return entity;
+    };
+    const importCounts = new Map();
+    const addImport = (specifier, bindings, node, owner, kind = 'import') => {
+      if (!specifier || !safeText(specifier, 512) || /[\r\n]/.test(specifier)) { omit('unresolved_import'); return; }
+      if (imports.length >= limits.imports) { omit('import_limit'); return; }
+      if (bindings.length > limits.bindings) omit('binding_limit');
+      const boundedBindings = bindings.slice(0, limits.bindings);
+      const valid = boundedBindings
+        .filter(binding => safeLabel(binding.local) && (binding.imported === '*' || safeLabel(binding.imported)));
+      if (valid.length !== boundedBindings.length) omit('unsafe_import_binding');
+      const key = JSON.stringify([owner.id, kind, specifier, valid]);
+      const ordinal = importCounts.get(key) ?? 0;
+      importCounts.set(key, ordinal + 1);
+      imports.push({ id: opaque('import', IDENTITY_VERSION, artifactId, language, key, ordinal),
+        artifactId, ownerId: owner.id, specifier, bindings: valid, ...lines(node), kind, resolved: false });
+    };
+    const stack = [{ node: tree.rootNode, owner: entities[0], depth: 0, skipDeclaration: false }];
+    let visited = 0;
+    while (stack.length) {
+      if (++visited > limits.nodes) { omit('node_limit'); break; }
+      if (signal?.aborted || performance.now() >= deadline) { omit(signal?.aborted ? 'aborted' : 'extraction_timeout'); break; }
+      const { node, owner, depth, skipDeclaration } = stack.pop();
+      if (depth > limits.depth) { omit('depth_limit'); continue; }
+      // Error recovery can preserve valid siblings, but never establishes the
+      // lexical parent of a declaration hidden inside an error subtree.
+      if (node.isError || node.isMissing) { omit('parse_error'); continue; }
+      let childOwner = owner, skipValue = null;
+      let kind = DECLARATIONS[node.type], name = simpleName(field(node, 'name'));
+      if (node.type === 'module' && language === 'python') kind = null;
+      if (node.type === 'function_definition' && owner.kind === 'class') kind = 'method';
+      if (node.type === 'variable_declarator') {
+        name = simpleName(field(node, 'name'));
+        const value = field(node, 'value');
+        kind = value && FUNCTIONS.has(value.type) ? 'function' : value?.type === 'class' ? 'class' : 'variable';
+        if (value && (FUNCTIONS.has(value.type) || ['class', 'object'].includes(value.type))) skipValue = value.id;
+      } else if (['pair', 'public_field_definition', 'field_definition'].includes(node.type)) {
+        const value = field(node, 'value');
+        if (value && (FUNCTIONS.has(value.type) || value.type === 'object' || value.type === 'class')) {
+          name = simpleName(field(node, 'key') ?? field(node, 'property') ?? field(node, 'name'));
+          kind = FUNCTIONS.has(value.type) ? 'method' : value.type === 'class' ? 'class' : 'variable';
+          skipValue = value.id;
+        }
+      }
+      if (!skipDeclaration && kind) {
+        if (!name) {
+          // Binding patterns, computed names, and anonymous declarations cannot
+          // be assigned an invented stable owner.
+          omit('unsupported_declaration'); continue;
+        }
+        if (node.hasError) { omit('parse_error'); continue; }
+        childOwner = add(name, kind, node, owner);
+        if (!childOwner) continue;
+      } else if (!skipDeclaration && (FUNCTIONS.has(node.type) || ['class', 'lambda', 'object'].includes(node.type))) {
+        omit('anonymous_scope'); continue;
+      }
+      if (language === 'python' && ['import_statement', 'import_from_statement'].includes(node.type) && !node.hasError) {
+        const module = field(node, 'module_name')?.text;
+        const names = node.namedChildren.filter(child => child.id !== field(node, 'module_name')?.id);
+        if (node.type === 'import_from_statement') {
+          const bindings = names.map(child => child.type === 'aliased_import'
+            ? { imported: field(child, 'name').text, local: field(child, 'alias').text }
+            : { imported: child.text, local: child.text });
+          addImport(module, bindings, node, owner);
+        } else {
+          for (const child of names) {
+            const specifier = child.type === 'aliased_import' ? field(child, 'name').text : child.text;
+            addImport(specifier, [{ imported: '*', local: field(child, 'alias')?.text ?? specifier.split('.')[0] }], node, owner);
+          }
+        }
+      } else if (language !== 'python' && ['import_statement', 'export_statement'].includes(node.type) && !node.hasError) {
+        const requireClause = node.namedChildren.find(child => child.type === 'import_require_clause');
+        const source = field(node, 'source') ?? (requireClause && field(requireClause, 'source'));
+        if (source) {
+          const bindings = [];
+          const clause = node.namedChildren.find(child => child.type === 'import_clause');
+          for (const child of clause?.namedChildren ?? []) {
+            if (child.type === 'identifier') bindings.push({ imported: 'default', local: child.text });
+            else if (child.type === 'namespace_import') bindings.push({ imported: '*', local: child.namedChildren[0].text });
+            else if (child.type === 'named_imports') for (const specifier of child.namedChildren) {
+              bindings.push({ imported: field(specifier, 'name')?.text, local: (field(specifier, 'alias') ?? field(specifier, 'name'))?.text });
+            }
+          }
+          if (requireClause) bindings.push({ imported: '*', local: requireClause.namedChildren[0].text });
+          const exports = node.namedChildren.find(child => child.type === 'export_clause');
+          for (const specifier of exports?.namedChildren ?? []) {
+            bindings.push({ imported: field(specifier, 'name')?.text, local: (field(specifier, 'alias') ?? field(specifier, 'name'))?.text });
+          }
+          const namespace = node.namedChildren.find(child => child.type === 'namespace_export');
+          if (namespace) bindings.push({ imported: '*', local: namespace.namedChildren[0].text });
+          addImport(literal(source), bindings, node, owner, node.type === 'export_statement' ? 'reexport' : 'import');
+        } else if (node.type === 'import_statement') omit('unresolved_import');
+      } else if (node.type === 'call_expression' && field(node, 'function')?.type === 'import') {
+        const source = field(node, 'arguments')?.namedChildren[0];
+        addImport(literal(source), [], node, owner, 'dynamic_import');
+      } else if (node.type === 'call_expression' && field(node, 'function')?.text === 'require') {
+        // A call spelled `require` can be shadowed. Preserve only the syntactic
+        // reference; a binding resolver must establish that it loads a module.
+        addImport(literal(field(node, 'arguments')?.namedChildren[0]), [], node, owner, 'require_reference');
+        omit('require_resolution');
+      }
+      // Limit traversal width as well as the total number of nodes. Iterating
+      // children in reverse preserves source order without recursive JS calls.
+      if (node.namedChildCount + stack.length > limits.nodes) { omit('node_limit'); break; }
+      for (let i = node.namedChildCount - 1; i >= 0; i--) {
+        const child = node.namedChild(i);
+        stack.push({ node: child, owner: childOwner, depth: depth + 1, skipDeclaration: child.id === skipValue });
+      }
+    }
+    enumeration.complete = omissions.length === 0;
+    if (enumeration.complete) enumeration.coveredRanges = [{ startLine: 1, endLine: entities[0].endLine }];
+    return result();
+  } catch {
+    // Dependency/grammar failures leave a visibly limited file-level fallback.
+    // Fixed diagnostics avoid retaining source text or local filesystem paths.
+    entities.splice(1); relations.length = 0; imports.length = 0;
+    enumeration.capability = 'lexical';
+    enumeration.extractor = 'file-level';
+    enumeration.version = '1';
+    enumeration.coveredRanges = [];
+    omit('parser_unavailable');
+    return result();
+  } finally {
+    tree?.delete();
+    parser?.delete();
+  }
+}

package/runtime/extensions/contracts.mjs

@@ -0,0 +1,59 @@
+// Browser-safe API constants and small validators shared by the host and SDK.
+export const API_VERSION = 1;
+export const MODEL_SCHEMA = 2;
+export const SCENE_VERSION = 1;
+export const MANIFEST_FILE = 'graphlin.extension.json';
+export const FEATURES = Object.freeze([
+  'containment', 'canonical-mappings', 'scene-groups', 'activity', 'checkpoints',
+]);
+export const CAPABILITIES = Object.freeze([
+  'model.read', 'activity.read', 'selection.request', 'inspection.request', 'history.read',
+  'analysis.request',
+]);
+export const DATA_FIELDS = Object.freeze([
+  'entities', 'relations', 'interpretations', 'activity', 'coverage', 'sessions', 'checkpoints',
+]);
+export const EXTENSION_LIMITS = Object.freeze({
+  manifestBytes: 64 * 1024, assetBytes: 2 * 1024 * 1024, packageBytes: 8 * 1024 * 1024,
+  archiveBytes: 12 * 1024 * 1024, assets: 32, files: 128, depth: 8,
+  nodes: 256, groups: 64, edges: 768, sceneBytes: 1024 * 1024,
+  coordinate: 100_000, dimension: 20_000, members: 256, text: 240,
+  projectionBytes: 8 * 1024 * 1024, entities: 20_000, relations: 40_000,
+});
+export function extensionError(code) {
+  return Object.assign(new Error(code), { code });
+}
+export function check(condition, code = 'invalid_extension') {
+  if (!condition) throw extensionError(code);
+}
+export const plain = value => value !== null && typeof value === 'object' &&
+  !Array.isArray(value) && [Object.prototype, null].includes(Object.getPrototypeOf(value));
+export const exact = (value, required, optional = []) => plain(value) &&
+  required.every(key => Object.hasOwn(value, key)) &&
+  Reflect.ownKeys(value).every(key => typeof key === 'string' &&
+    (required.includes(key) || optional.includes(key)) &&
+    Object.hasOwn(Object.getOwnPropertyDescriptor(value, key), 'value'));
+export const id = value => typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,159}$/.test(value);
+export const extensionId = value => typeof value === 'string' &&
+  /^[a-z][a-z0-9-]*(?:\.[a-z0-9][a-z0-9-]*)+$/.test(value) && value.length <= 100;
+export const version = value => typeof value === 'string' && value.length <= 80 &&
+  /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[a-zA-Z0-9]+(?:[.-][a-zA-Z0-9]+)*)?$/.test(value);
+export const digest = value => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
+export const integer = (value, max = Number.MAX_SAFE_INTEGER) => Number.isSafeInteger(value) && value >= 0 && value <= max;
+export const text = (value, max = EXTENSION_LIMITS.text) => typeof value === 'string' &&
+  value.length > 0 && value.length <= max && !/[\u0000-\u001f\u007f<>]/.test(value) &&
+  !/(?:[a-z][a-z0-9+.-]*:\/\/|(?:javascript|data|file):|url\s*\()/i.test(value);
+export const uniqueStrings = (value, predicate, max = 64) => Array.isArray(value) &&
+  value.length <= max && value.every(predicate) && new Set(value).size === value.length;
+export function assetPath(value) {
+  return typeof value === 'string' && value.length <= 200 &&
+    value.split('/').length <= EXTENSION_LIMITS.depth &&
+    value.split('/').every(part => /^[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(part) &&
+      !['node_modules', '__proto__', 'constructor', 'prototype'].includes(part));
+}
+export function jsonBytes(value, limit, code = 'extension_payload_limit') {
+  let result;
+  try { result = JSON.stringify(value); } catch { throw extensionError(code); }
+  check(typeof result === 'string' && new TextEncoder().encode(result).length <= limit, code);
+  return result;
+}

package/runtime/extensions/frame.mjs

@@ -0,0 +1,64 @@
+import { createHash } from 'node:crypto';
+import { check } from './contracts.mjs';
+import { validateManifest, validateAssets } from './manifest.mjs';
+
+const scriptHash = value => `'sha256-${createHash('sha256').update(value).digest('base64')}'`;
+const scriptJSON = value => JSON.stringify(value).replaceAll('<', '\\u003c')
+  .replaceAll('\u2028', '\\u2028').replaceAll('\u2029', '\\u2029');
+
+/** Creates a response body AND mandatory response headers. Never serve body
+ * alone or as srcdoc: response sandboxing must survive opening the URL directly.
+ */
+export function createFrameDocument({ manifest: input, assets: inputAssets, nonce } = {}) {
+  const manifest = validateManifest(input);
+  const assets = validateAssets(manifest, inputAssets);
+  check(typeof nonce === 'string' && /^[A-Za-z0-9_-]{24,128}$/.test(nonce), 'invalid_frame_nonce');
+  const source = assets[manifest.entry].toString('utf8');
+  const data = Object.fromEntries(Object.entries(assets).filter(([name]) => name.endsWith('.json'))
+    .map(([name, bytes]) => [name, JSON.parse(bytes.toString('utf8'))]));
+  // The trusted prelude is installed before third-party code executes. Source is
+  // embedded as escaped JSON, not HTML. Appending a script preserves exact bytes
+  // for CSP hashing even if an author has a literal closing script tag.
+  const prelude = `(() => {
+  "use strict";
+  const expected = ${scriptJSON(nonce)};
+  const parentWindow = window.parent;
+  const dispatch = window.dispatchEvent.bind(window);
+  const Event = window.CustomEvent;
+  let used = false;
+  const receive = event => {
+    if (used || parentWindow === window || event.source !== parentWindow) return;
+    const message = event.data;
+    if (!message || message.type !== "graphlin:bootstrap" || message.apiVersion !== 1 ||
+        message.nonce !== expected || event.ports.length !== 1) return;
+    used = true;
+    window.removeEventListener("message", receive);
+    const port = event.ports[0];
+    const send = port.postMessage.bind(port);
+    port.start();
+    dispatch(new Event("graphlin:connect", {detail: {port, nonce: expected, apiVersion: 1,
+      assets: ${scriptJSON(data)}}}));
+    send({type: "graphlin:ready", apiVersion: 1, nonce: expected});
+  };
+  window.addEventListener("message", receive);
+  const script = document.createElement("script");
+  script.textContent = ${scriptJSON(source)};
+  document.body.appendChild(script);
+})();`;
+  const csp = [
+    "default-src 'none'", `script-src ${scriptHash(prelude)} ${scriptHash(source)}`,
+    "script-src-attr 'none'", "connect-src 'none'", "img-src 'none'", "style-src 'none'",
+    "font-src 'none'", "media-src 'none'", "object-src 'none'", "frame-src 'none'",
+    "worker-src 'none'", "child-src 'none'", "base-uri 'none'", "form-action 'none'",
+    "frame-ancestors 'self'", 'sandbox allow-scripts',
+  ].join('; ');
+  const body = `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="referrer" content="no-referrer"><title>Graphlin extension</title></head><body><main id="graphlin-extension"></main><script>${prelude}</script></body></html>`;
+  return { body, csp, headers: {
+    'Content-Type': 'text/html; charset=utf-8',
+    'Content-Security-Policy': csp,
+    'Cache-Control': 'no-store',
+    'X-Content-Type-Options': 'nosniff',
+    'Referrer-Policy': 'no-referrer',
+    'Permissions-Policy': 'camera=(), microphone=(), geolocation=(), payment=(), usb=(), clipboard-read=(), clipboard-write=()',
+  } };
+}

package/runtime/extensions/index.mjs

@@ -0,0 +1,9 @@
+export * from './contracts.mjs';
+export { validateManifest, validateAssets, bundleDigest, sha256, decisionProfiles } from './manifest.mjs';
+export { validateDecisionProfile } from './profiles.mjs';
+export { validateScene, SCENE_KINDS, SCENE_SHAPES, EDGE_KINDS } from './scene.mjs';
+export { validateGrant, getExtensionDataProjection } from './projection.mjs';
+export { createExtensionRegistry } from './registry.mjs';
+export { createFrameDocument } from './frame.mjs';
+export { validateMessage } from './sdk.mjs';
+export { parsePackageSpec, readPackageArchive, npmPackTransport } from './packages.mjs';

package/runtime/extensions/manifest.mjs

@@ -0,0 +1,95 @@
+import { createHash } from 'node:crypto';
+import {
+  API_VERSION, MODEL_SCHEMA, SCENE_VERSION, MANIFEST_FILE, FEATURES, CAPABILITIES,
+  EXTENSION_LIMITS as L, check, plain, exact, extensionId, version, text,
+  uniqueStrings, assetPath, jsonBytes,
+} from './contracts.mjs';
+import { validateDecisionProfile } from './profiles.mjs';
+
+export const sha256 = bytes => createHash('sha256').update(bytes).digest('hex');
+
+export function validateManifest(input) {
+  jsonBytes(input, L.manifestBytes, 'manifest_too_large');
+  check(exact(input, ['manifestVersion', 'graphlinApi', 'modelSchema', 'id', 'version',
+    'requiredFeatures', 'entry', 'assets', 'views', 'renderer', 'capabilities'], ['name', 'decisionProfiles']), 'invalid_manifest');
+  check(input.manifestVersion === 1 && input.graphlinApi === String(API_VERSION) &&
+    input.modelSchema === String(MODEL_SCHEMA), 'incompatible_extension');
+  check(extensionId(input.id) && version(input.version) &&
+    (input.name === undefined || text(input.name, 80)), 'invalid_manifest');
+  check(uniqueStrings(input.requiredFeatures, value => FEATURES.includes(value)), 'unknown_required_feature');
+  check(uniqueStrings(input.capabilities, value => CAPABILITIES.includes(value)), 'unknown_capability');
+  check(uniqueStrings(input.views, value => /^[a-z][a-z0-9-]{0,39}$/.test(value), 16) &&
+    input.views.length > 0, 'invalid_views');
+  const renderer = input.renderer;
+  check((exact(renderer, ['kind', 'sceneVersion']) && renderer.kind === 'graphlin-scene' &&
+      renderer.sceneVersion === String(SCENE_VERSION)) ||
+    (exact(renderer, ['kind']) && renderer.kind === 'custom'), 'unsupported_renderer');
+  check(plain(input.assets) && Object.keys(input.assets).length > 0 &&
+    Object.keys(input.assets).length <= L.assets, 'invalid_assets');
+  for (const [name, hash] of Object.entries(input.assets)) {
+    check(assetPath(name) && name !== MANIFEST_FILE && /\.(?:js|json)$/.test(name) &&
+      typeof hash === 'string' && /^sha256-[a-f0-9]{64}$/.test(hash), 'invalid_asset');
+  }
+  const names = Object.keys(input.assets);
+  check(new Set(names.map(name => name.toLowerCase())).size === names.length, 'duplicate_asset');
+  check(assetPath(input.entry) && input.entry.endsWith('.js') &&
+    Object.hasOwn(input.assets, input.entry), 'invalid_entry');
+  // The single executable bundle contains its dependencies. Other declared
+  // assets are inert JSON supplied by the frame prelude; no runtime imports.
+  check(names.filter(name => name.endsWith('.js')).length === 1, 'unbundled_scripts');
+  if (input.decisionProfiles !== undefined) {
+    check(uniqueStrings(input.decisionProfiles, name => assetPath(name) && name.endsWith('.json') &&
+      Object.hasOwn(input.assets, name), 8), 'invalid_decision_profiles');
+    check(!input.decisionProfiles.length || input.capabilities.includes('analysis.request'), 'missing_analysis_capability');
+  }
+  return JSON.parse(JSON.stringify(input));
+}
+
+export function validateAssets(manifestInput, input) {
+  const manifest = validateManifest(manifestInput);
+  check(plain(input) && Object.keys(input).length === Object.keys(manifest.assets).length, 'asset_set_mismatch');
+  let total = 0;
+  const assets = {};
+  for (const [name, hash] of Object.entries(manifest.assets)) {
+    check(Object.hasOwn(input, name) && (typeof input[name] === 'string' || input[name] instanceof Uint8Array),
+      'missing_asset');
+    const bytes = Buffer.from(input[name]);
+    total += bytes.length;
+    check(bytes.length <= L.assetBytes && total <= L.packageBytes, 'asset_too_large');
+    check(`sha256-${sha256(bytes)}` === hash, 'asset_integrity_mismatch');
+    // Reject non-UTF8 bytes rather than silently changing executable content.
+    let source;
+    try { source = new TextDecoder('utf-8', { fatal: true }).decode(bytes); }
+    catch { check(false, 'asset_encoding'); }
+    if (name.endsWith('.json')) {
+      try { JSON.parse(source); } catch { check(false, 'invalid_json_asset'); }
+    } else {
+      // This is packaging validation, not a JavaScript security sandbox. CSP
+      // remains authoritative if a bundle constructs a URL dynamically.
+      check(!/\bimport\s*(?:[('"*{]|[A-Za-z_$].*\bfrom\b)|\bexport\s|\/\/[#@]\s*sourceMappingURL\s*=/.test(source),
+        'unbundled_scripts');
+    }
+    assets[name] = bytes;
+  }
+  return assets;
+}
+
+function canonical(value) {
+  if (Array.isArray(value)) return value.map(canonical);
+  if (plain(value)) return Object.fromEntries(Object.keys(value).sort().map(key => [key, canonical(value[key])]));
+  return value;
+}
+
+export function bundleDigest(manifest) {
+  return sha256(JSON.stringify(canonical(validateManifest(manifest))));
+}
+
+export function decisionProfiles(manifest, assets) {
+  const seen = new Set();
+  return (manifest.decisionProfiles ?? []).map(name => {
+    const profile = validateDecisionProfile(JSON.parse(Buffer.from(assets[name]).toString('utf8')));
+    check(!seen.has(profile.id), 'duplicate_decision_profile');
+    seen.add(profile.id);
+    return { ...profile, namespace: `${manifest.id}.${profile.id}` };
+  });
+}