feat(ts): publish local untrusted JS Podman runtime

.changeset/bright-local-code-runtime.md

@@ -0,0 +1,21 @@
+---
+"@graphrefly/ts": minor
+---
+
+Add the focused D667 local untrusted-JavaScript compute contract and Node
+rootless-Podman Libpod API v0 broker subpaths. The contract binds immutable
+bundle, runner image, compiler, fixed GraphReFly API, admitted input, sandbox,
+network, filesystem, resource and output coordinates; accepts only current
+independently certified readiness; and returns bounded answer, actual runtime
+topology/describe/provenance and verified cleanup. Its Graph-visible runtime
+projects admitted runs, lifecycle, status, outcome, usage, issues, audit and
+exact-attempt cancellation while keeping bundle/input bytes and Podman handles
+host-private.
+
+The Node broker uses one fixed runner entrypoint in a fresh digest-pinned
+non-root container with a read-only root filesystem, all capabilities dropped,
+no-new-privileges, no host bind or engine-socket mount, one bounded noexec
+tmpfs, no network, bounded resources, exact stop/kill/remove and stable absence
+verification. It is distinct
+from the hosted E2B managed-compute backend and the fixed PostgreSQL Podman
+recipe. The package root and aggregate executor surfaces remain unchanged.

.changeset/closed-wave-directions.md

@@ -0,0 +1,14 @@
+---
+"@graphrefly/ts": patch
+---
+
+Reject unknown, START, value, and terminal messages on the upward path and reject
+unknown messages on the downward path so generated fixed-runner artifacts retain
+the package's closed wave-message direction guards. Pin runner bundle generation
+to the repository root so package-scoped and root builds produce the same artifact.
+
+Expose the package-owned fixed runner assets through focused package subpaths,
+bind runtime provenance to the package version injected into both the broker and
+runner, and align v0 result/topology admission with the fixed profile. Start
+readiness freshness after certification, retry cleanup verification through its
+window, and make the locked Node 24 declaration build heap self-contained.

.changeset/quiet-local-runner.md

@@ -0,0 +1,5 @@
+---
+"@graphrefly/ts": minor
+---
+
+Add the fixed distroless D667 local untrusted-JavaScript runner artifact and independent rootless-Podman live certifier.

AGENTS.md

@@ -47,12 +47,14 @@ Sibling implementations (each self-contained, cross-language = wire bridge, not
 - **8 verbs, closed set (D4):** `node` `graph` `batch` `state` + `producer` `derived` `effect` `mount`.
   Operators are `node` sugar, not verbs — per-language, never in parity (D6).
 - **`ctx.up` / `ctx.down(msgs)` (D8):** one `msgs` array = one wave; may mix tiers. `ctx.up` is
-  **control-tier only** (DIRTY/PAUSE/RESUME/INVALIDATE/TEARDOWN); DATA/RESOLVED/COMPLETE/ERROR are
-  down-only (R-ctx-up). Handle = pure data `(pool_id, handle_id)`, no methods (D7).
-- **7-tier const table + 10-message closed set (D9/D34, R-tier/R-msg-closed-set):** adding a tier
+  **control/demand only** (DIRTY/PAUSE/RESUME/PULL/INVALIDATE/TEARDOWN);
+  START/DATA/RESOLVED/COMPLETE/ERROR are not up-going (R-ctx-up). Handle = pure data
+  `(pool_id, handle_id)`, no methods (D7).
+- **7-tier const table + 11-message closed set (D9/D34/D269, R-tier/R-msg-closed-set):** adding a tier
   or message type is a constitutional change.
-- **graph = single-thread causal/concurrency domain (D22):** parallelism via pool callback or
-  multi-graph + wire bridge; rewire intra-graph only.
+- **graph = single-thread concurrency domain (D22):** causal influence may cross graphs through
+  delayed-consistency wire bridges; parallelism via pool callback or multi-graph + wire bridge;
+  rewire intra-graph only.
 - **parity = behavioral conformance (D24):** structural `Impl` + cross-track-ledger retired.
 - **config dissolved (D26):** clock is graph-local (no global singleton); `messageTier` is a
   compile-time const table; `onMessage`/`onSubscribe` are substrate-fixed, not user-replaceable (D19).

CLAUDE.md

@@ -47,12 +47,14 @@ Sibling implementations (each self-contained, cross-language = wire bridge, not
 - **8 verbs, closed set (D4):** `node` `graph` `batch` `state` + `producer` `derived` `effect` `mount`.
   Operators are `node` sugar, not verbs — per-language, never in parity (D6).
 - **`ctx.up` / `ctx.down(msgs)` (D8):** one `msgs` array = one wave; may mix tiers. `ctx.up` is
-  **control-tier only** (DIRTY/PAUSE/RESUME/INVALIDATE/TEARDOWN); DATA/RESOLVED/COMPLETE/ERROR are
-  down-only (R-ctx-up). Handle = pure data `(pool_id, handle_id)`, no methods (D7).
-- **7-tier const table + 10-message closed set (D9/D34, R-tier/R-msg-closed-set):** adding a tier
+  **control/demand only** (DIRTY/PAUSE/RESUME/PULL/INVALIDATE/TEARDOWN);
+  START/DATA/RESOLVED/COMPLETE/ERROR are not up-going (R-ctx-up). Handle = pure data
+  `(pool_id, handle_id)`, no methods (D7).
+- **7-tier const table + 11-message closed set (D9/D34/D269, R-tier/R-msg-closed-set):** adding a tier
   or message type is a constitutional change.
-- **graph = single-thread causal/concurrency domain (D22):** parallelism via pool callback or
-  multi-graph + wire bridge; rewire intra-graph only.
+- **graph = single-thread concurrency domain (D22):** causal influence may cross graphs through
+  delayed-consistency wire bridges; parallelism via pool callback or multi-graph + wire bridge;
+  rewire intra-graph only.
 - **parity = behavioral conformance (D24):** structural `Impl` + cross-track-ledger retired.
 - **config dissolved (D26):** clock is graph-local (no global singleton); `messageTier` is a
   compile-time const table; `onMessage`/`onSubscribe` are substrate-fixed, not user-replaceable (D19).

biome.json

@@ -22,6 +22,7 @@
 			"!archive/packages",
 			"!archive/website-prototypes",
 			"!benchmarks",
+			"!packages/ts/runners/local-untrusted-js/local-untrusted-js-runner.mjs",
 			"!website",
 			"!examples/nestjs"
 		]

package.json

@@ -27,12 +27,14 @@
 		"dashboard": "node ../graphrefly/dashboard/build.mjs",
 		"dashboard:check": "node ../graphrefly/dashboard/build.mjs --check",
 		"build": "pnpm --filter @graphrefly/ts build",
+		"build:local-untrusted-js-runner": "node scripts/build-local-untrusted-js-runner.mjs",
+		"build:local-untrusted-js-runner-image": "node scripts/build-local-untrusted-js-runner-image.mjs",
 		"test": "pnpm --filter @graphrefly/ts test",
 		"test:ts": "pnpm --filter @graphrefly/ts test",
 		"probe:b49:ts": "tsx packages/ts/src/__bench__/b49-probe.ts",
 		"bench": "pnpm run probe:b49:ts",
 		"changeset": "changeset",
-		"version-packages": "changeset version",
+		"version-packages": "changeset version && pnpm run build:local-untrusted-js-runner",
 		"release": "pnpm run build && changeset publish",
 		"lint": "biome check . && tsx scripts/check-no-raw-async.ts && tsx scripts/check-typecheck.ts && pnpm --filter @graphrefly/ts test:typecheck",
 		"lint:no-raw-async": "tsx scripts/check-no-raw-async.ts",

packages/ts/package.json

@@ -226,6 +226,38 @@
 				"default": "./dist/executors/local-container-postgresql-podman-libpod-api-v0-rootless/node.cjs"
 			}
 		},
+		"./executors/local-untrusted-js-compute": {
+			"import": {
+				"types": "./dist/executors/local-untrusted-js-compute.d.ts",
+				"default": "./dist/executors/local-untrusted-js-compute.js"
+			},
+			"require": {
+				"types": "./dist/executors/local-untrusted-js-compute.d.cts",
+				"default": "./dist/executors/local-untrusted-js-compute.cjs"
+			}
+		},
+		"./executors/local-untrusted-js-compute/node": {
+			"node": {
+				"import": {
+					"types": "./dist/executors/local-untrusted-js-compute/node.d.ts",
+					"default": "./dist/executors/local-untrusted-js-compute/node.js"
+				},
+				"require": {
+					"types": "./dist/executors/local-untrusted-js-compute/node.d.cts",
+					"default": "./dist/executors/local-untrusted-js-compute/node.cjs"
+				}
+			},
+			"import": {
+				"types": "./dist/executors/local-untrusted-js-compute/node.d.ts",
+				"default": "./dist/executors/local-untrusted-js-compute/node.js"
+			},
+			"require": {
+				"types": "./dist/executors/local-untrusted-js-compute/node.d.cts",
+				"default": "./dist/executors/local-untrusted-js-compute/node.cjs"
+			}
+		},
+		"./executors/local-untrusted-js-compute/runner/Containerfile": "./runners/local-untrusted-js/Containerfile",
+		"./executors/local-untrusted-js-compute/runner/local-untrusted-js-runner.mjs": "./runners/local-untrusted-js/local-untrusted-js-runner.mjs",
 		"./executors/managed-cloud-postgresql": {
 			"import": {
 				"types": "./dist/executors/managed-cloud-postgresql.d.ts",
@@ -769,13 +801,15 @@
 	},
 	"files": [
 		"dist",
+		"runners/local-untrusted-js/Containerfile",
+		"runners/local-untrusted-js/local-untrusted-js-runner.mjs",
 		"LICENSE"
 	],
 	"publishConfig": {
 		"access": "public"
 	},
 	"scripts": {
-		"build": "tsup && node ../../scripts/check-ts-package-exports.mjs",
+		"build": "node ../../scripts/build-local-untrusted-js-runner.mjs && node --max-old-space-size=6144 ../../node_modules/tsup/dist/cli-default.js && node ../../scripts/check-ts-package-exports.mjs",
 		"test": "vitest run",
 		"test:typecheck": "tsc --noEmit -p tsconfig.tests.json",
 		"test:browser:agentic-memory": "node ../../scripts/run-agentic-memory-indexeddb-smoke.mjs",

packages/ts/runners/local-untrusted-js/Containerfile

@@ -0,0 +1,6 @@
+FROM gcr.io/distroless/nodejs22-debian12@sha256:13593b7570658e8477de39e2f4a1dd25db2f836d68a0ba771251572d23bb4f8e
+
+COPY --chown=65532:65532 local-untrusted-js-runner.mjs /opt/graphrefly/local-untrusted-js-runner.mjs
+
+USER 65532:65532
+ENTRYPOINT ["/nodejs/bin/node", "--experimental-vm-modules", "--no-addons", "--disable-proto=throw", "/opt/graphrefly/local-untrusted-js-runner.mjs"]