| """Explicit local module compatibility candidate; no target code execution.""" |
| import base64 |
| import hashlib |
| import json |
| import posixpath |
| import subprocess |
| import sys |
| from pathlib import Path |
|
|
| ROOT = Path(__file__).resolve().parents[1] |
| sys.path[:0] = [str(ROOT / "packages/core")] |
| from chameleon_core.module_resolution import POLICY, resolve_relative_import |
| from chameleon_core.repository_capture import verify_package |
| from derived_overlay import validate_overlay |
|
|
|
|
| def parse_module_source(original): |
| if len(original) > 262144: |
| raise ValueError("MODULE_SOURCE_BUDGET") |
| parsed = subprocess.run(["node", str(ROOT / "scripts/module_references.mjs")], |
| input=original, capture_output=True, timeout=10, check=False, cwd=ROOT) |
| if parsed.returncode or len(parsed.stdout) > 100000: |
| raise ValueError("MODULE_SYNTAX_UNSUPPORTED") |
| evidence = json.loads(parsed.stdout) |
| if evidence["source_sha256"] != hashlib.sha256(original).hexdigest() or evidence["dynamic_imports"]: |
| raise ValueError("MODULE_DYNAMIC_OR_SOURCE_MISMATCH") |
| return evidence |
|
|
|
|
| def build_module_overlay(package, importer, *, policy): |
| if policy != POLICY: |
| raise ValueError("EXPLICIT_MODULE_POLICY_REQUIRED") |
| files = verify_package(package) |
| if importer not in files or not importer.endswith((".js", ".mjs")): |
| raise ValueError("CAPTURED_IMPORTER_REQUIRED") |
| original = files[importer] |
| if len(original) > 12000: |
| raise ValueError("MODULE_OVERLAY_BUDGET") |
| evidence = parse_module_source(original) |
| inventory = {name: {"sha": record["git_blob_sha"], "size": record["bytes"]} |
| for name, record in package["repository"]["files"].items()} |
| edits, plans = [], [] |
| for reference in evidence["references"]: |
| plan = resolve_relative_import(importer, reference["specifier"], inventory) |
| if plan["status"] != "RESOLVED": |
| raise ValueError("MODULE_" + plan["status"]) |
| target = plan["matches"][0]["path"] |
| relative = posixpath.relpath(target, posixpath.dirname(importer) or ".") |
| if not relative.startswith("."): |
| relative = "./" + relative |
| start, end = reference["start_byte"], reference["end_byte"] |
| if hashlib.sha256(original[start:end]).hexdigest() != reference["literal_sha256"]: |
| raise ValueError("MODULE_LITERAL_BINDING") |
| plans.append(plan) |
| if relative != reference["specifier"]: |
| edits.append((start, end, json.dumps(relative).encode())) |
| if not edits: |
| raise ValueError("MODULE_NO_REWRITE_NEEDED") |
| after = original |
| for start, end, replacement in reversed(edits): |
| after = after[:start] + replacement + after[end:] |
| overlay = {"version": "derived-file-v1", "source_digest": package["digest"], "path": importer, |
| "before_sha256": hashlib.sha256(original).hexdigest(), |
| "after_base64": base64.b64encode(after).decode(), |
| "after_sha256": hashlib.sha256(after).hexdigest(), "operator": POLICY} |
| validate_overlay(overlay, package) |
| return {"overlay": overlay, "syntax": evidence, "resolutions": plans, |
| "scope": "One-file explicit module policy; all behavior and delivery checks still required"} |
|
|
