idem-potent-resolve.js

class ResolvedRef {
  #href;
  #signature;
  
  static get protocol() {
    return 'resolved-ref:';
  }

  constructor(href, signature) {
    this.#href = href;
    this.#signature = signature;
  }

  get href() {
    return this.#href;
  }

  toString() {
    return `${ResolvedRef.protocol}:${this.#signature}/${this.#href}`;
  }
}

import.meta.resolve = async (specifier) => {
  const href = await loader.resolveImportURL(specifier, import.meta.url);
  return new ResolvedRef(href, signHref(href));
};

loader.resolveImportURL = (specifier) => {
  if (specifier.startsWith(ResolvedRef.protocol) {
    return validateSignature(specifier);
  }
  // [actual resolution]
};