@hraness/sponge 0.5.3 → 0.6.1

package/dist/src/acquisition/capture.d.ts

@@ -1,13 +1,12 @@
-import type { CaptureResult, ErrorEnvelope } from '../../contracts/index.js';
-import { runOwned } from './process.js';
-import { type CaptureRuntime } from './runtime.js';
+import type { runOwned } from './process.js';
+import { type CaptureOutcome } from './child.js';
+export type { CaptureOutcome } from './child.js';
 /** A signed-in browser the user attached over CDP on loopback. */
 export type CaptureConnection = {
     kind: 'cdp';
     endpoint: string;
 };
 export interface CaptureRequest {
-    runtime: CaptureRuntime;
     stagingRoot: string;
     sourceUrl: string;
     requestId: string;
@@ -17,10 +16,4 @@ export interface CaptureRequest {
     allowPrivateNetwork?: boolean;
     runProcess?: typeof runOwned;
 }
-export type CaptureOutcome = {
-    ok: true;
-    capture: CaptureResult;
-    bundleRoot: string;
-    dispose: () => Promise<void>;
-} | ErrorEnvelope;
 export declare function captureArticle(request: CaptureRequest): Promise<CaptureOutcome>;

package/dist/src/acquisition/capture.js

@@ -1,208 +1,34 @@
-import { mkdir, mkdtemp, writeFile, statfs, realpath } from 'node:fs/promises';
-import { join } from 'node:path';
-import { fileURLToPath } from 'node:url';
 import { limits } from '../../contracts/index.js';
-import { privateRoot, physicalBytes } from './files.js';
-import { runOwned, isolatedEnvironment } from './process.js';
-import { inspectCaptureRuntime } from './runtime.js';
-import { settleCaptureRoot } from './cleanup.js';
-import { failure, clipFailure } from './errors.js';
-import { normalizeBundle, object } from './normalize.js';
-import { SpongeError, publicCode, codeOf } from '../errors.js';
-export async function captureArticle(request) {
-    const { requestId, signal } = request;
-    if (!/^[a-zA-Z0-9_-]{1,128}$/.test(requestId))
-        return failure('invalid-request', 'invalid-input');
-    let url;
+import { superviseChild } from './child.js';
+import { normalizeBundle } from './normalize.js';
+const loopbackEndpoint = /^(?:[1-9][0-9]{0,4}|(?:http|ws):\/\/127\.0\.0\.1:[1-9][0-9]{0,4}(?:\/[^\s]*)?)$/;
+function validSource(sourceUrl) {
     try {
-        url = new URL(request.sourceUrl);
-        if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || request.sourceUrl.length > 16384)
-            throw Error();
+        const url = new URL(sourceUrl);
+        return ['http:', 'https:'].includes(url.protocol) && !url.username && !url.password && sourceUrl.length <= 16384;
     }
     catch {
-        return failure(requestId, 'invalid-input');
-    }
-    if (signal?.aborted)
-        return failure(requestId, 'cancelled');
-    let runtime;
-    try {
-        runtime = await inspectCaptureRuntime(request.runtime.root, request.runtime.pins);
-    }
-    catch (error) {
-        return failure(requestId, publicCode(error, 'runtime-missing'), 'setup');
-    }
-    let base;
-    try {
-        base = await privateRoot(request.stagingRoot);
-        const disk = await statfs(base);
-        if (disk.bavail * disk.bsize < limits.stagingBytes + limits.freeReserveBytes)
-            return failure(requestId, 'limit-exceeded');
-    }
-    catch {
-        return failure(requestId, 'invalid-input');
-    }
-    const deadline = request.deadlineMs ?? limits.captureDeadlineMs;
-    if (!Number.isSafeInteger(deadline) || deadline < 100 || deadline > limits.captureDeadlineMs)
-        return failure(requestId, 'invalid-input');
-    const clipHelper = fileURLToPath(new URL(import.meta.url.endsWith('.ts') ? './clip-helper.ts' : './clip-helper.js', import.meta.url));
-    const args = [
-        clipHelper,
-        runtime.root,
-        request.sourceUrl,
-        'article',
-        '--media',
-        'images',
-        '--timeout-ms',
-        String(deadline),
-        '--max-html-bytes',
-        String(limits.markdownBytes),
-        '--max-asset-bytes',
-        String(limits.imageBytes),
-        '--max-total-asset-bytes',
-        String(500 * 1024 ** 2),
-        '--quiet',
-        '--json',
-    ];
-    if (request.allowPrivateNetwork)
-        args.push('--allow-private-network');
-    if (request.connection) {
-        if (!/^(?:[1-9][0-9]{0,4}|(?:http|ws):\/\/127\.0\.0\.1:[1-9][0-9]{0,4}(?:\/[^\s]*)?)$/.test(request.connection.endpoint))
-            return failure(requestId, 'invalid-input');
-        // Wordcell takes the loopback DevTools port alone.
-        const endpoint = request.connection.endpoint;
-        args.push('--cdp', /^[0-9]+$/.test(endpoint) ? endpoint : new URL(endpoint).port);
-    }
-    else
-        args.push('--mode', 'http');
-    const root = await realpath(await mkdtemp(join(base, 'capture-'))), home = join(root, 'home'), output = join(root, 'bundles');
-    args.push('--output', output);
-    const env = isolatedEnvironment(home, home);
-    const controller = new AbortController();
-    const abort = () => controller.abort();
-    signal?.addEventListener('abort', abort, { once: true });
-    if (signal?.aborted)
-        abort();
-    let cleanup = 'settled', keep = false, quota = false, checking = false;
-    const monitor = setInterval(async () => {
-        if (checking)
-            return;
-        checking = true;
-        try {
-            if ((await physicalBytes(root)) > limits.stagingBytes) {
-                quota = true;
-                controller.abort();
-            }
-        }
-        catch {
-            quota = true;
-            controller.abort();
-        }
-        finally {
-            checking = false;
-        }
-    }, 100);
-    const started = Date.now();
-    try {
-        await mkdir(home, { mode: 0o700 });
-        await mkdir(output, { mode: 0o700 });
-        await writeFile(join(root, 'ownership.json'), JSON.stringify({ schemaVersion: 1, requestId, state: 'acquiring' }), {
-            mode: 0o600,
-        });
-        cleanup = 'pending';
-        const result = await (request.runProcess ?? runOwned)(runtime.bun, args, {
-            cwd: root,
-            env,
-            signal: controller.signal,
-            deadlineMs: deadline,
-            maxOutputBytes: limits.metadataBytes,
-            graceMs: 5000,
-        });
-        cleanup = result.cleanup;
-        // An attached browser can start helpers outside the owned process group.
-        let summary;
-        try {
-            summary = JSON.parse(result.stdout);
-        }
-        catch {
-            summary = null;
-        }
-        const upstream = clipFailure(summary, requestId);
-        if (cleanup === 'settled' && request.connection) {
-            cleanup = 'pending';
-            const census = await (request.runProcess ?? runOwned)('/bin/ps', ['-axo', 'command'], {
-                env,
-                deadlineMs: 3000,
-                maxOutputBytes: 4 * 1024 ** 2,
-            });
-            cleanup = census.cleanup;
-            if (census.code !== 0 || census.stopped || census.stdout.split('\n').some((line) => line.includes(root)))
-                cleanup = 'pending';
-        }
-        if (cleanup !== 'settled')
-            return failure(requestId, 'cleanup-required', 'cleanup');
-        if (quota)
-            return failure(requestId, 'limit-exceeded');
-        if (result.stopped)
-            return failure(requestId, result.stopped);
-        if (result.code !== 0 || object(summary).ok !== true)
-            return upstream;
-        const outputDirectory = object(summary).outputDirectory;
-        if (typeof outputDirectory !== 'string' ||
-            !outputDirectory.startsWith(output + '/') ||
-            (await realpath(outputDirectory)) !== outputDirectory)
-            return failure(requestId, 'integrity', 'verification');
-        const helper = fileURLToPath(new URL(import.meta.url.endsWith('.ts') ? './verify-helper.ts' : './verify-helper.js', import.meta.url));
-        cleanup = 'pending';
-        const checked = await (request.runProcess ?? runOwned)(runtime.bun, [helper, runtime.root, outputDirectory], {
-            cwd: root,
-            env,
-            signal: controller.signal,
-            deadlineMs: Math.max(1, deadline - (Date.now() - started)),
-            maxOutputBytes: limits.helperFrameBytes,
-        });
-        cleanup = checked.cleanup;
-        if (cleanup !== 'settled')
-            return failure(requestId, 'cleanup-required', 'cleanup');
-        if (checked.stopped)
-            return failure(requestId, checked.stopped);
-        if (checked.code !== 0)
-            return failure(requestId, 'integrity', 'verification');
-        const capture = await normalizeBundle({
-            bundleRoot: outputDirectory,
-            inspection: JSON.parse(checked.stdout),
-            summary,
-            requestId,
-            sourceUrl: request.sourceUrl,
-            wordcellVersion: runtime.pins.wordcell.version,
-        });
-        if (controller.signal.aborted)
-            return failure(requestId, quota ? 'limit-exceeded' : 'cancelled');
-        await writeFile(join(root, 'ownership.json'), JSON.stringify({ schemaVersion: 1, requestId, state: 'verified' }), {
-            mode: 0o600,
-        });
-        keep = true;
-        return {
-            ok: true,
-            capture,
-            bundleRoot: outputDirectory,
-            dispose: async () => {
-                if ((await settleCaptureRoot(root, requestId)) === 'pending')
-                    throw new SpongeError('cleanup-required');
-            },
-        };
-    }
-    catch (error) {
-        if (cleanup !== 'settled')
-            return failure(requestId, 'cleanup-required', 'cleanup');
-        const raw = codeOf(error), code = raw === 'integrity' || raw === 'limit-exceeded' || raw === 'schema-newer' ? raw : 'unclassified';
-        return failure(requestId, code, 'verification');
-    }
-    finally {
-        clearInterval(monitor);
-        while (checking)
-            await new Promise((r) => setTimeout(r, 5));
-        signal?.removeEventListener('abort', abort);
-        if (!keep && cleanup === 'settled' && (await settleCaptureRoot(root, requestId)) === 'pending')
-            return failure(requestId, 'cleanup-required', 'cleanup');
+        return false;
     }
 }
+export function captureArticle(request) {
+    const endpoint = request.connection?.endpoint;
+    return superviseChild({
+        ...request,
+        valid: validSource(request.sourceUrl) && (endpoint === undefined || loopbackEndpoint.test(endpoint)),
+        prepare: async ({ output, deadline }) => ({
+            schemaVersion: 1,
+            kind: 'article',
+            url: request.sourceUrl,
+            outputDirectory: output,
+            // Each acquisition attempt gets half the budget so a slow one cannot starve its fallback.
+            timeoutMs: Math.floor(deadline / 2),
+            maxHtmlBytes: limits.markdownBytes,
+            maxAssetBytes: limits.imageBytes,
+            maxTotalAssetBytes: 500 * 1024 ** 2,
+            allowPrivateNetwork: request.allowPrivateNetwork === true,
+            ...(endpoint === undefined ? {} : { cdp: endpoint }),
+        }),
+        verify: (bundleRoot) => normalizeBundle({ bundleRoot, requestId: request.requestId, sourceUrl: request.sourceUrl }),
+    });
+}

package/dist/src/acquisition/child-request.d.ts

@@ -0,0 +1,40 @@
+interface ChildRequestBase {
+    schemaVersion: 1;
+    /** The bundle directory the child creates; the parent re-verifies everything inside it. */
+    outputDirectory: string;
+    /** The budget of each network acquisition attempt. */
+    timeoutMs: number;
+    maxAssetBytes: number;
+    maxTotalAssetBytes: number;
+    allowPrivateNetwork: boolean;
+}
+export interface ArticleChildRequest extends ChildRequestBase {
+    kind: 'article';
+    url: string;
+    maxHtmlBytes: number;
+    /** A loopback DevTools endpoint of the user's attached signed-in browser. */
+    cdp?: string;
+}
+export interface PdfChildRequest extends ChildRequestBase {
+    kind: 'pdf';
+    /** A remote PDF, or the parent's private copy of a local one. */
+    source: {
+        url: string;
+    } | {
+        path: string;
+    };
+    maxPdfBytes: number;
+    maxPages: number;
+    maxImages: number;
+}
+/** Reads an existing bundle for import; the answer carries hashes and paths, never document text. */
+export interface VerifyChildRequest {
+    schemaVersion: 1;
+    kind: 'verify';
+    format: 'article' | 'pdf';
+    bundle: string;
+}
+export type ChildRequest = ArticleChildRequest | PdfChildRequest | VerifyChildRequest;
+/** Categories the child may report; the parent passes only some of them through. */
+export type ChildFailureCode = 'invalid-input' | 'rate-limited' | 'unavailable' | 'unsupported' | 'limit-exceeded' | 'runtime-missing' | 'integrity' | 'schema-newer' | 'unclassified';
+export {};

package/dist/src/acquisition/child.d.ts

@@ -0,0 +1,31 @@
+import type { CaptureResult, ErrorEnvelope } from '../../contracts/index.js';
+import type { ChildRequest } from './child-request.js';
+import { runOwned } from './process.js';
+export type CaptureOutcome = {
+    ok: true;
+    capture: CaptureResult;
+    bundleRoot: string;
+    dispose: () => Promise<void>;
+} | ErrorEnvelope;
+export interface ChildRun {
+    requestId: string;
+    stagingRoot: string;
+    /** The caller's own validation of its source; checked after the request id. */
+    valid: boolean;
+    signal?: AbortSignal;
+    deadlineMs?: number;
+    runProcess?: typeof runOwned;
+    /** Stages any input under the private root and returns the request the child reads. */
+    prepare: (staged: {
+        root: string;
+        output: string;
+        deadline: number;
+        signal: AbortSignal;
+    }) => Promise<ChildRequest>;
+    /** Re-verifies every file the child wrote; the child's own claims are never trusted. */
+    verify: (bundleRoot: string) => Promise<CaptureResult>;
+}
+/** The owned child: the bundled worker when installed, the TypeScript source under tsx in a checkout. */
+export declare function workerArguments(): string[];
+/** One capture in the owned Node child, under a private staging root with a disk quota, deadline and cleanup. */
+export declare function superviseChild(run: ChildRun): Promise<CaptureOutcome>;

package/dist/src/acquisition/child.js

@@ -0,0 +1,130 @@
+import { mkdir, mkdtemp, writeFile, statfs, realpath } from 'node:fs/promises';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { limits } from '../../contracts/index.js';
+import { privateRoot, physicalBytes } from './files.js';
+import { runOwned, isolatedEnvironment } from './process.js';
+import { settleCaptureRoot } from './cleanup.js';
+import { failure, childFailure } from './errors.js';
+import { object } from './normalize.js';
+import { SpongeError, codeOf } from '../errors.js';
+/** The owned child: the bundled worker when installed, the TypeScript source under tsx in a checkout. */
+export function workerArguments() {
+    if (!import.meta.url.endsWith('.ts'))
+        return [fileURLToPath(new URL('../../capture/worker.js', import.meta.url))];
+    return ['--import', import.meta.resolve('tsx'), fileURLToPath(new URL('../capture/worker.ts', import.meta.url))];
+}
+/** One capture in the owned Node child, under a private staging root with a disk quota, deadline and cleanup. */
+export async function superviseChild(run) {
+    const { requestId, signal } = run;
+    if (!/^[a-zA-Z0-9_-]{1,128}$/.test(requestId))
+        return failure('invalid-request', 'invalid-input');
+    if (!run.valid)
+        return failure(requestId, 'invalid-input');
+    if (signal?.aborted)
+        return failure(requestId, 'cancelled');
+    let base;
+    try {
+        base = await privateRoot(run.stagingRoot);
+        const disk = await statfs(base);
+        if (disk.bavail * disk.bsize < limits.stagingBytes + limits.freeReserveBytes)
+            return failure(requestId, 'limit-exceeded');
+    }
+    catch {
+        return failure(requestId, 'invalid-input');
+    }
+    const deadline = run.deadlineMs ?? limits.captureDeadlineMs;
+    if (!Number.isSafeInteger(deadline) || deadline < 100 || deadline > limits.captureDeadlineMs)
+        return failure(requestId, 'invalid-input');
+    const root = await realpath(await mkdtemp(join(base, 'capture-'))), home = join(root, 'home'), output = join(root, 'bundle'), requestFile = join(root, 'request.json');
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    signal?.addEventListener('abort', abort, { once: true });
+    if (signal?.aborted)
+        abort();
+    let cleanup = 'settled', keep = false, quota = false, checking = false;
+    const monitor = setInterval(async () => {
+        if (checking)
+            return;
+        checking = true;
+        try {
+            if ((await physicalBytes(root)) > limits.stagingBytes) {
+                quota = true;
+                controller.abort();
+            }
+        }
+        catch {
+            quota = true;
+            controller.abort();
+        }
+        finally {
+            checking = false;
+        }
+    }, 100);
+    const started = Date.now();
+    try {
+        await mkdir(home, { mode: 0o700 });
+        await writeFile(join(root, 'ownership.json'), JSON.stringify({ schemaVersion: 1, requestId, state: 'acquiring' }), {
+            mode: 0o600,
+        });
+        const childRequest = await run.prepare({ root, output, deadline, signal: controller.signal });
+        await writeFile(requestFile, JSON.stringify(childRequest), { mode: 0o600 });
+        cleanup = 'pending';
+        const result = await (run.runProcess ?? runOwned)(process.execPath, [...workerArguments(), requestFile], {
+            cwd: root,
+            env: isolatedEnvironment(home, home),
+            signal: controller.signal,
+            deadlineMs: Math.max(1, deadline - (Date.now() - started)),
+            maxOutputBytes: limits.metadataBytes,
+            graceMs: 5000,
+        });
+        cleanup = result.cleanup;
+        let summary;
+        try {
+            summary = JSON.parse(result.stdout);
+        }
+        catch {
+            summary = null;
+        }
+        if (cleanup !== 'settled')
+            return failure(requestId, 'cleanup-required', 'cleanup');
+        if (quota)
+            return failure(requestId, 'limit-exceeded');
+        if (result.stopped)
+            return failure(requestId, result.stopped);
+        if (result.code !== 0 || object(summary).ok !== true)
+            return childFailure(summary, requestId);
+        if ((await realpath(output)) !== output)
+            return failure(requestId, 'integrity', 'verification');
+        const capture = await run.verify(output);
+        if (controller.signal.aborted)
+            return failure(requestId, quota ? 'limit-exceeded' : 'cancelled');
+        await writeFile(join(root, 'ownership.json'), JSON.stringify({ schemaVersion: 1, requestId, state: 'verified' }), {
+            mode: 0o600,
+        });
+        keep = true;
+        return {
+            ok: true,
+            capture,
+            bundleRoot: output,
+            dispose: async () => {
+                if ((await settleCaptureRoot(root, requestId)) === 'pending')
+                    throw new SpongeError('cleanup-required');
+            },
+        };
+    }
+    catch (error) {
+        if (cleanup !== 'settled')
+            return failure(requestId, 'cleanup-required', 'cleanup');
+        const raw = codeOf(error), code = ['integrity', 'limit-exceeded', 'schema-newer', 'invalid-input', 'cancelled'].find((known) => known === raw) ?? 'unclassified';
+        return failure(requestId, code, 'verification');
+    }
+    finally {
+        clearInterval(monitor);
+        while (checking)
+            await new Promise((r) => setTimeout(r, 5));
+        signal?.removeEventListener('abort', abort);
+        if (!keep && cleanup === 'settled' && (await settleCaptureRoot(root, requestId)) === 'pending')
+            return failure(requestId, 'cleanup-required', 'cleanup');
+    }
+}

package/dist/src/acquisition/errors.d.ts

@@ -1,4 +1,4 @@
 import type { ErrorCode, ErrorEnvelope } from '../../contracts/index.js';
 export declare const failure: (requestId: string, code: ErrorCode, phase?: ErrorEnvelope["phase"], retryable?: boolean) => ErrorEnvelope;
-/** Wordcell's clip answers with a JSON summary; prose is never classified. A summary that is not success means the source gave no usable capture. */
-export declare function clipFailure(value: unknown, requestId: string): ErrorEnvelope;
+/** The capture child answers with one JSON line; prose is never classified. Only whitelisted categories pass through. */
+export declare function childFailure(value: unknown, requestId: string): ErrorEnvelope;

package/dist/src/acquisition/errors.js

@@ -1,6 +1,17 @@
 export const failure = (requestId, code, phase = 'acquisition', retryable = false) => ({ schemaVersion: 1, requestId, ok: false, code, phase, retryable });
-/** Wordcell's clip answers with a JSON summary; prose is never classified. A summary that is not success means the source gave no usable capture. */
-export function clipFailure(value, requestId) {
-    const answered = !!value && typeof value === 'object' && !Array.isArray(value) && 'ok' in value;
-    return failure(requestId, answered ? 'unavailable' : 'unclassified');
+// A missing converter or an oversized source is actionable; the child's own integrity claims are not trusted.
+const childCodes = new Set([
+    'invalid-input',
+    'rate-limited',
+    'unavailable',
+    'unsupported',
+    'limit-exceeded',
+    'runtime-missing',
+]);
+/** The capture child answers with one JSON line; prose is never classified. Only whitelisted categories pass through. */
+export function childFailure(value, requestId) {
+    if (!value || typeof value !== 'object' || Array.isArray(value) || !('ok' in value))
+        return failure(requestId, 'unclassified');
+    const code = value.code;
+    return childCodes.has(code) ? failure(requestId, code) : failure(requestId, 'unavailable');
 }

package/dist/src/acquisition/index.d.ts

@@ -1,5 +1,2 @@
 export { captureArticle } from './capture.js';
 export type { CaptureConnection, CaptureRequest, CaptureOutcome } from './capture.js';
-export { provisionCapture, inspectCaptureRuntime, captureSetupPlan } from './runtime.js';
-export type { CaptureRuntime } from './runtime.js';
-export { defaultCapturePins } from './pins.js';

package/dist/src/acquisition/index.js

@@ -1,3 +1 @@
 export { captureArticle } from './capture.js';
-export { provisionCapture, inspectCaptureRuntime, captureSetupPlan } from './runtime.js';
-export { defaultCapturePins } from './pins.js';

package/dist/src/acquisition/normalize.d.ts

@@ -1,11 +1,9 @@
 import type { CaptureResult, MetadataClaim } from '../../contracts/index.js';
 export declare function object(value: unknown): Record<string, unknown>;
 export declare function metadataFromMarkdown(markdown: string, observedAt: string): MetadataClaim[];
+/** Re-verify a Sponge capture manifest v1 bundle written by the owned child. The child's word is never trusted. */
 export declare function normalizeBundle(input: {
     bundleRoot: string;
-    inspection: unknown;
-    summary: unknown;
     requestId: string;
     sourceUrl: string;
-    wordcellVersion: string;
 }): Promise<CaptureResult>;

package/dist/src/acquisition/normalize.js

@@ -27,18 +27,12 @@ export function metadataFromMarkdown(markdown, observedAt) {
     }
     return claims;
 }
+/** Identifies Sponge's own capture representation; bump when the bundle meaning changes. */
+const captureExtractor = { name: 'sponge', version: 'capture-v1' };
+/** Re-verify a Sponge capture manifest v1 bundle written by the owned child. The child's word is never trusted. */
 export async function normalizeBundle(input) {
-    const verified = object(input.inspection), inspection = object(verified.inspection), document = object(inspection.document), summary = object(input.summary);
-    if (verified.ok !== true ||
-        inspection.schemaVersion !== 4 ||
-        document.integrity !== 'verified' ||
-        !Array.isArray(inspection.assets) ||
-        inspection.assets.some((a) => object(a).integrity !== 'verified'))
-        throw new SpongeError('integrity');
     const manifestBytes = await readConfined(input.bundleRoot, 'capture.json', limits.metadataBytes), manifest = object(JSON.parse(manifestBytes.toString()));
-    if (manifest.schemaVersion !== 4 ||
-        manifest.sourceUrl !== input.sourceUrl ||
-        inspection.sourceUrl !== input.sourceUrl)
+    if (manifest.schemaVersion !== 1 || manifest.sourceUrl !== input.sourceUrl)
         throw new SpongeError('integrity');
     const documentRecord = object(manifest.document);
     const markdown = {
@@ -48,12 +42,12 @@ export async function normalizeBundle(input) {
         mediaType: 'text/markdown',
     };
     validateAsset(markdown);
+    if (markdown.relativePath !== 'article.md')
+        throw new SpongeError('integrity');
     const bytes = await readConfined(input.bundleRoot, markdown.relativePath, limits.markdownBytes);
-    if (bytes.length !== markdown.bytes || hash(bytes) !== markdown.sha256 || document.sha256 !== markdown.sha256)
+    if (bytes.length !== markdown.bytes || hash(bytes) !== markdown.sha256)
         throw new SpongeError('integrity');
-    if (!Array.isArray(manifest.assets) ||
-        manifest.assets.length > limits.imagesPerItem ||
-        manifest.assets.length !== inspection.assets.length)
+    if (!Array.isArray(manifest.assets) || manifest.assets.length > limits.imagesPerItem)
         throw new SpongeError('limit-exceeded');
     const assets = [];
     for (const raw of manifest.assets) {
@@ -62,21 +56,25 @@ export async function normalizeBundle(input) {
             relativePath: String(item.path),
             sha256: String(item.sha256),
             bytes: Number(item.bytes),
-            mediaType: String(item.mimeType),
+            mediaType: String(item.mediaType),
         };
         validateAsset(asset);
         if (!asset.mediaType.startsWith('image/') || asset.bytes > limits.imageBytes)
             throw new SpongeError('limit-exceeded');
-        const checked = inspection.assets.find((a) => object(a).path === asset.relativePath);
-        if (!checked || object(checked).expectedSha256 !== asset.sha256 || object(checked).expectedBytes !== asset.bytes)
+        if (!asset.relativePath.startsWith('assets/') || assets.some((a) => a.relativePath === asset.relativePath))
+            throw new SpongeError('integrity');
+        const content = await readConfined(input.bundleRoot, asset.relativePath, limits.imageBytes);
+        if (content.length !== asset.bytes || hash(content) !== asset.sha256)
             throw new SpongeError('integrity');
         assets.push(asset);
     }
-    const images = object(object(manifest.artifacts).images);
-    if (!['captured', 'partial', 'not-requested'].includes(String(images.status)))
+    const images = object(manifest.images);
+    if (images.status !== 'captured' && images.status !== 'partial')
+        throw new SpongeError('integrity');
+    if (manifest.status !== 'complete' && manifest.status !== 'partial')
         throw new SpongeError('integrity');
-    const text = manifest.status === 'complete' && summary.status === 'complete' ? 'complete' : 'partial';
-    const imageStatus = images.status === 'partial' ? 'partial' : images.status === 'not-requested' ? 'not-requested' : 'complete';
+    const text = manifest.status === 'complete' ? 'complete' : 'partial';
+    const imageStatus = images.status === 'partial' ? 'partial' : 'complete';
     const metadataWarnings = manifest.metadata === undefined ? [] : articleMetadataWarnings(manifest.metadata);
     const partial = text === 'partial' || imageStatus === 'partial' || metadataWarnings.length > 0;
     const capture = {
@@ -92,7 +90,7 @@ export async function normalizeBundle(input) {
             ? metadataFromMarkdown(bytes.toString('utf8'), String(manifest.capturedAt))
             : articleMetadata(manifest.metadata, String(manifest.capturedAt)),
         warnings: partial ? ['partial'] : [],
-        extractor: { name: 'wordcell', version: input.wordcellVersion },
+        extractor: { ...captureExtractor },
         manifestSha256: hash(manifestBytes),
         completeness: { text, images: imageStatus },
     };

package/dist/src/app/article.d.ts

@@ -1,5 +1,5 @@
 import type { ErrorEnvelope, JobCheckpoint } from '../../contracts/index.js';
-import { type CaptureRequest, type CaptureOutcome, type CaptureRuntime, type CaptureConnection } from '../acquisition/index.js';
+import { type CaptureRequest, type CaptureOutcome, type CaptureConnection } from '../acquisition/index.js';
 import type { LibraryStore, AttemptToken } from '../store/index.js';
 interface ArticleResult {
     ok: true;
@@ -13,7 +13,6 @@ export type ArticleOutcome = (ArticleResult | ErrorEnvelope) & {
 export interface ArticleOptions {
     checkpoint?: (stage: JobCheckpoint['stage']) => Promise<void>;
     runProcess?: CaptureRequest['runProcess'];
-    runtime: CaptureRuntime;
     connection?: CaptureConnection;
     signal?: AbortSignal;
     allowPrivateNetwork?: boolean;

package/dist/src/app/article.js

@@ -23,7 +23,6 @@ export function ingestArticle(store, token, options) {
             throw new SpongeError('invalid-input');
         const result = await (options.capture ?? captureArticle)({
             runProcess: options.runProcess,
-            runtime: options.runtime,
             stagingRoot: join(store.root, 'staging'),
             sourceUrl: source.locator,
             requestId: token.attemptId,
@@ -58,7 +57,7 @@ export function ingestArticle(store, token, options) {
         const title = typeof selectedTitle === 'string' ? selectedTitle : undefined;
         const status = localized.missingImages ? 'partial' : capture.status;
         // Representation algorithm participates in identity: later extraction changes cannot reuse an old payload.
-        const bundleHash = sha256(JSON.stringify(['article-local-markdown-v1', capture.manifestSha256]));
+        const bundleHash = sha256(JSON.stringify(['article-local-markdown-v2', capture.manifestSha256]));
         await options.checkpoint?.('promoting');
         const revision = store.revisions.commit({
             ...token,

package/dist/src/cli/commands.d.ts

@@ -16,7 +16,6 @@ export interface Context {
     signal: AbortSignal;
     emit: (data: unknown, text?: string) => void;
     write: (text: string | Uint8Array) => void;
-    captureRoot: string;
     nativeRoot: string;
 }
 export interface Command {