@jinn-network/core 0.1.1 → 0.1.2-canary.15837edd

package/dist/captured-task.d.ts

@@ -2,7 +2,7 @@
  * Captured-task schema — the raw, pre-scrub input to the harness capture path.
  *
  * Extracted from the former client harness layer in C2 (#1833):
- * the parse half of capture.ts has no scrub / `client/src` dependency (only
+ * the parse half of capture.ts has no scrub / `operator/src` dependency (only
  * zod + the two envelope enums), so it moved into `@jinn-network/core`.
  * C5 subsequently moved the scrub implementation alongside it while leaving
  * capture orchestration in the layer.

package/dist/captured-task.js

@@ -2,7 +2,7 @@
  * Captured-task schema — the raw, pre-scrub input to the harness capture path.
  *
  * Extracted from the former client harness layer in C2 (#1833):
- * the parse half of capture.ts has no scrub / `client/src` dependency (only
+ * the parse half of capture.ts has no scrub / `operator/src` dependency (only
  * zod + the two envelope enums), so it moved into `@jinn-network/core`.
  * C5 subsequently moved the scrub implementation alongside it while leaving
  * capture orchestration in the layer.

package/dist/corpus-read/fetch-artifact.d.ts

@@ -8,14 +8,59 @@
  *
  * Keys artifacts by sha256 (not IPFS CID) — artifacts no longer have IPFS
  * CIDs (post jinn-mono-vy37.1.2).
+ *
+ * The endpoint is manifest-supplied and therefore attacker-controlled (#1901),
+ * so this fetch is both destination-restricted and resource-bounded *before*
+ * the hash check in `acquire.ts` ever runs:
+ *
+ * - every destination — the origin and each redirect hop — must pass
+ *   `resolvePublicHttpDestination` (see `origin-guard.ts`), and the socket is
+ *   pinned to the exact address that check approved, so a name whose DNS
+ *   answer flips between validation and connect cannot escape the policy;
+ * - redirects are followed manually and capped;
+ * - one deadline bounds the whole chain, including the body read, so a
+ *   stalled peer cannot hold a worker;
+ * - the body is streamed through a byte counter and abandoned the moment it
+ *   exceeds the cap, so an oversized response is never fully buffered.
  */
+import { type HostnameResolver } from './origin-guard.js';
+import { type PinnedFetch } from './pinned-fetch.js';
 export type AcquireResult = {
     ok: true;
     content: Buffer;
 } | {
     ok: false;
-    reason: 'not_found' | 'network_error';
+    /**
+     * `blocked` — destination policy refused the origin or a redirect hop.
+     * `too_large` — the response exceeded the byte cap.
+     * `timeout` — the response stalled past the deadline.
+     */
+    reason: 'not_found' | 'network_error' | 'blocked' | 'too_large' | 'timeout';
     message?: string;
 };
+export interface FetchArtifactOptions {
+    /**
+     * Injection seam for tests. The default connects over `node:http(s)` with
+     * the socket pinned to the guard-approved address; a plain `fetch` fake is
+     * accepted here but does not pin, so production must not supply one.
+     */
+    fetchImpl?: PinnedFetch;
+    /** Injection seam for tests; defaults to `dns.lookup(..., { all: true })`. */
+    resolveHostname?: HostnameResolver;
+    /**
+     * Permit loopback/private destinations, and skip address pinning with them.
+     * Off by default and set nowhere in-repo; it exists for an operator running
+     * against a local origin, because `operator.publicEndpoint` falls back to
+     * `http://localhost:<apiPort>` when unset. Scheme and credential checks
+     * still apply. Env: `JINN_CORPUS_ALLOW_PRIVATE_ORIGINS`.
+     */
+    allowPrivateDestinations?: boolean;
+    /** Byte cap. Env: `JINN_CORPUS_ARTIFACT_MAX_BYTES`. */
+    maxBytes?: number;
+    /** Whole-operation deadline in ms; `0` disables. Env: `JINN_CORPUS_ARTIFACT_FETCH_TIMEOUT_MS`. */
+    timeoutMs?: number;
+    /** Redirect hop cap. Env: `JINN_CORPUS_ARTIFACT_MAX_REDIRECTS`. */
+    maxRedirects?: number;
+}
 export declare function buildArtifactUrl(endpoint: string, sha256: string): string;
-export declare function fetchArtifactContent(endpoint: string, sha256: string): Promise<AcquireResult>;
+export declare function fetchArtifactContent(endpoint: string, sha256: string, options?: FetchArtifactOptions): Promise<AcquireResult>;

package/dist/corpus-read/fetch-artifact.js

@@ -8,25 +8,206 @@
  *
  * Keys artifacts by sha256 (not IPFS CID) — artifacts no longer have IPFS
  * CIDs (post jinn-mono-vy37.1.2).
+ *
+ * The endpoint is manifest-supplied and therefore attacker-controlled (#1901),
+ * so this fetch is both destination-restricted and resource-bounded *before*
+ * the hash check in `acquire.ts` ever runs:
+ *
+ * - every destination — the origin and each redirect hop — must pass
+ *   `resolvePublicHttpDestination` (see `origin-guard.ts`), and the socket is
+ *   pinned to the exact address that check approved, so a name whose DNS
+ *   answer flips between validation and connect cannot escape the policy;
+ * - redirects are followed manually and capped;
+ * - one deadline bounds the whole chain, including the body read, so a
+ *   stalled peer cannot hold a worker;
+ * - the body is streamed through a byte counter and abandoned the moment it
+ *   exceeds the cap, so an oversized response is never fully buffered.
+ */
+import { resolvePublicHttpDestination, ProhibitedDestinationError, } from './origin-guard.js';
+import { pinnedFetch } from './pinned-fetch.js';
+/** 32 MiB. Artifacts are solution/evidence payloads, not disk images. */
+const DEFAULT_MAX_BYTES = 32 * 1024 * 1024;
+const DEFAULT_TIMEOUT_MS = 30_000;
+const DEFAULT_MAX_REDIRECTS = 3;
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+class TimeoutError extends Error {
+}
+class TooLargeError extends Error {
+}
+/**
+ * `minimum` is 0 where the bound reads `0` as "disabled" (the timeout, and a
+ * redirect cap of zero meaning "follow none"), and 1 for the byte cap, where
+ * zero would not disable anything — it would reject every artifact as
+ * `too_large`. A foot-gun that silently stops all acquisition is worse than
+ * ignoring the value, so an out-of-range setting falls back to the default.
  */
+function envInteger(name, fallback, minimum = 0) {
+    const raw = process.env[name];
+    if (raw === undefined || raw.trim() === '')
+        return fallback;
+    const parsed = Number(raw);
+    return Number.isInteger(parsed) && parsed >= minimum ? parsed : fallback;
+}
+function envFlag(name) {
+    const raw = process.env[name];
+    if (raw === undefined)
+        return false;
+    return ['1', 'true', 'yes', 'on'].includes(raw.trim().toLowerCase());
+}
 export function buildArtifactUrl(endpoint, sha256) {
     return `${endpoint.replace(/\/$/, '')}/v1/artifacts/${sha256}/content`;
 }
-export async function fetchArtifactContent(endpoint, sha256) {
-    const url = buildArtifactUrl(endpoint, sha256);
+/** Stream `response` into a Buffer, abandoning it the moment it exceeds `maxBytes`. */
+async function readBounded(response, maxBytes) {
+    const declared = response.headers.get('content-length');
+    if (declared !== null && Number(declared) > maxBytes) {
+        await response.body?.cancel().catch(() => { });
+        throw new TooLargeError(`content-length ${declared} exceeds the ${maxBytes}-byte cap`);
+    }
+    // A null body carries no bytes. We deliberately do not fall back to
+    // `arrayBuffer()` here: that materializes the whole response before any
+    // size check, which is the exact behavior the byte cap exists to prevent.
+    if (!response.body)
+        return Buffer.alloc(0);
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (!value)
+                continue;
+            total += value.byteLength;
+            if (total > maxBytes) {
+                throw new TooLargeError(`response exceeds the ${maxBytes}-byte cap`);
+            }
+            chunks.push(value);
+        }
+    }
+    catch (err) {
+        await reader.cancel().catch(() => { });
+        throw err;
+    }
+    return Buffer.concat(chunks, total);
+}
+export async function fetchArtifactContent(endpoint, sha256, options = {}) {
+    const fetchImpl = options.fetchImpl ?? pinnedFetch;
+    const maxBytes = options.maxBytes
+        ?? envInteger('JINN_CORPUS_ARTIFACT_MAX_BYTES', DEFAULT_MAX_BYTES, 1);
+    const timeoutMs = options.timeoutMs
+        ?? envInteger('JINN_CORPUS_ARTIFACT_FETCH_TIMEOUT_MS', DEFAULT_TIMEOUT_MS);
+    const maxRedirects = options.maxRedirects
+        ?? envInteger('JINN_CORPUS_ARTIFACT_MAX_REDIRECTS', DEFAULT_MAX_REDIRECTS);
+    const guard = {
+        resolveHostname: options.resolveHostname,
+        allowPrivateDestinations: options.allowPrivateDestinations ?? envFlag('JINN_CORPUS_ALLOW_PRIVATE_ORIGINS'),
+    };
+    const raw = buildArtifactUrl(endpoint, sha256);
+    let target;
     try {
-        const response = await globalThis.fetch(url);
-        if (!response.ok) {
-            if (response.status === 404) {
-                return { ok: false, reason: 'not_found', message: `HTTP 404 for ${url}` };
+        target = new URL(raw);
+    }
+    catch {
+        return { ok: false, reason: 'blocked', message: `artifact endpoint is not a valid URL: ${raw}` };
+    }
+    // One controller and one timer bound the whole chain — connect, every
+    // redirect hop, and the body read. The timeout both aborts the transport
+    // and loses the race, so a transport that ignores the signal still cannot
+    // leave the caller waiting past the deadline.
+    const controller = new AbortController();
+    let timer;
+    const expiry = timeoutMs > 0
+        ? new Promise((_resolve, reject) => {
+            timer = setTimeout(() => {
+                controller.abort();
+                reject(new TimeoutError(`artifact fetch timed out after ${timeoutMs}ms`));
+            }, timeoutMs);
+        })
+        : undefined;
+    // Attach a sink so the rejection is never unhandled — under Node's default
+    // `--unhandled-rejections=throw`, a timer firing before the first `bounded()`
+    // call would otherwise kill the process outright.
+    expiry?.catch(() => { });
+    const bounded = (work) => expiry === undefined ? work : Promise.race([work, expiry]);
+    const chain = async () => {
+        for (let hop = 0;; hop += 1) {
+            // Bounded like every other await: the guard resolves DNS for an
+            // attacker-supplied name, so a nameserver that simply never answers
+            // must not be able to hold the caller past the deadline.
+            const pin = await bounded(resolvePublicHttpDestination(target, guard));
+            const response = await bounded(fetchImpl(target, {
+                signal: controller.signal,
+                ...(pin === null ? {} : { pinnedAddresses: pin.addresses }),
+            }));
+            if (REDIRECT_STATUSES.has(response.status)) {
+                const location = response.headers.get('location');
+                if (location === null) {
+                    await response.body?.cancel().catch(() => { });
+                    return {
+                        ok: false,
+                        reason: 'network_error',
+                        message: `HTTP ${response.status} without a Location header for ${target.href}`,
+                    };
+                }
+                if (hop >= maxRedirects) {
+                    await response.body?.cancel().catch(() => { });
+                    return {
+                        ok: false,
+                        reason: 'blocked',
+                        message: `artifact fetch exceeded ${maxRedirects} redirects at ${target.href}`,
+                    };
+                }
+                let next;
+                try {
+                    next = new URL(location, target);
+                }
+                catch {
+                    await response.body?.cancel().catch(() => { });
+                    return {
+                        ok: false,
+                        reason: 'blocked',
+                        message: `redirect Location is not a valid URL: ${location}`,
+                    };
+                }
+                await response.body?.cancel().catch(() => { });
+                target = next;
+                continue;
             }
-            return { ok: false, reason: 'network_error', message: `HTTP ${response.status} for ${url}` };
+            if (!response.ok) {
+                await response.body?.cancel().catch(() => { });
+                if (response.status === 404) {
+                    return { ok: false, reason: 'not_found', message: `HTTP 404 for ${target.href}` };
+                }
+                return {
+                    ok: false,
+                    reason: 'network_error',
+                    message: `HTTP ${response.status} for ${target.href}`,
+                };
+            }
+            return { ok: true, content: await bounded(readBounded(response, maxBytes)) };
         }
-        const buf = Buffer.from(await response.arrayBuffer());
-        return { ok: true, content: buf };
+    };
+    try {
+        return await chain();
     }
     catch (err) {
+        if (err instanceof ProhibitedDestinationError) {
+            return { ok: false, reason: 'blocked', message: err.message };
+        }
+        if (err instanceof TimeoutError) {
+            return { ok: false, reason: 'timeout', message: err.message };
+        }
+        if (err instanceof TooLargeError) {
+            return { ok: false, reason: 'too_large', message: err.message };
+        }
         const message = err instanceof Error ? err.message : String(err);
         return { ok: false, reason: 'network_error', message };
     }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+        controller.abort();
+    }
 }

package/dist/corpus-read/index.d.ts

@@ -6,5 +6,7 @@ export * from './fetch-artifact.js';
 export * from './fetch.js';
 export * from './http-discovery.js';
 export * from './ipfs.js';
+export * from './origin-guard.js';
+export * from './pinned-fetch.js';
 export * from './route-resolver.js';
 export * from './types.js';

package/dist/corpus-read/index.js

@@ -6,5 +6,7 @@ export * from './fetch-artifact.js';
 export * from './fetch.js';
 export * from './http-discovery.js';
 export * from './ipfs.js';
+export * from './origin-guard.js';
+export * from './pinned-fetch.js';
 export * from './route-resolver.js';
 export * from './types.js';

package/dist/corpus-read/ipfs.d.ts

@@ -12,3 +12,9 @@ export type FetchFromIpfsOptions = {
 };
 /** Read-only multi-codec, primary-plus-fallback IPFS JSON fetch. */
 export declare function fetchFromIpfs(gatewayUrl: string, cid: string, opts?: FetchFromIpfsOptions): Promise<unknown>;
+/**
+ * Read-only multi-codec, primary-plus-fallback IPFS fetch returning the exact
+ * bytes stored at the CID — no JSON parse/re-encode roundtrip. Use this
+ * whenever the bytes will be hashed, or whenever the content is not JSON.
+ */
+export declare function fetchBytesFromIpfs(gatewayUrl: string, cid: string, opts?: FetchFromIpfsOptions): Promise<Uint8Array>;

package/dist/corpus-read/ipfs.js

@@ -1,9 +1,44 @@
 const IPFS_FETCH_TIMEOUT_MS = 15_000;
+/**
+ * Bound on one whole `fetchFromIpfs` / `fetchBytesFromIpfs` call. The
+ * per-attempt timer above is re-armed for every gateway x CID candidate, so
+ * without this a single call could legitimately run for the product of the
+ * two. Every candidate is still attempted: the per-attempt timer is clamped
+ * to an equal share of whatever budget remains.
+ */
+const IPFS_TOTAL_FETCH_TIMEOUT_MS = 45_000;
+/**
+ * Cap on any single gateway response, JSON or raw. Corpus manifests and
+ * donation artifacts are JSON envelopes orders of magnitude smaller than this
+ * (#3410); the raw-bytes path added in #3438 also carries source-bundle files
+ * and sealed documents, which are larger but nowhere near this. A response
+ * above it is hostile or broken, and buffering it would exhaust memory — so
+ * size this against the largest legitimate *source file*, not against the
+ * JSON envelopes alone.
+ */
+const MAX_IPFS_RESPONSE_BYTES = 8 * 1024 * 1024;
+const MAX_IPFS_REDIRECT_HOPS = 3;
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
 const FALLBACK_IPFS_GATEWAY_BASE = 'https://ipfs.io/ipfs/';
 export function normalizeIpfsGatewayBase(gatewayUrl) {
     let normalized = gatewayUrl.trim();
     if (normalized === '')
         normalized = 'https://gateway.autonolas.tech';
+    // Drop any userinfo at the source. `fetch` rejects a credentialed URL
+    // outright, and its own error message quotes the URL back — so a gateway
+    // configured Infura-style would otherwise put its secret into every
+    // aggregated fetch error, which callers log.
+    try {
+        const parsed = new URL(normalized);
+        if (parsed.username !== '' || parsed.password !== '') {
+            parsed.username = '';
+            parsed.password = '';
+            normalized = parsed.toString();
+        }
+    }
+    catch {
+        // Not an absolute URL; leave it to the caller's own failure path.
+    }
     normalized = normalized.replace(/\/+$/, '');
     if (!normalized.toLowerCase().endsWith('/ipfs'))
         normalized = `${normalized}/ipfs`;
@@ -29,15 +64,145 @@ export function buildIpfsFetchCidPathCandidates(cidOrPath) {
     }
     return [value];
 }
-async function fetchJson(url, signal) {
-    const response = await fetch(url, { method: 'GET', signal });
-    if (!response.ok) {
-        throw new Error(`IPFS fetch failed: ${response.status} ${response.statusText} (${url.slice(0, 80)}…)`);
+function isHostInGatewayFamily(host, gatewayHost) {
+    const candidate = host.toLowerCase();
+    const gateway = gatewayHost.toLowerCase();
+    return candidate === gateway || candidate.endsWith(`.${gateway}`);
+}
+/**
+ * A gateway may legitimately redirect the path form of a CID to its subdomain
+ * form, so hops are allowed inside the configured gateway's host family. They
+ * are never allowed to leave it, to reach a different port on it, to downgrade
+ * the transport, or to smuggle credentials.
+ */
+function assertRedirectAllowed(next, current, gateway) {
+    if (next.protocol !== 'http:' && next.protocol !== 'https:') {
+        throw new Error(`IPFS redirect uses an unsupported scheme (${next.protocol})`);
+    }
+    if (current.protocol === 'https:' && next.protocol === 'http:') {
+        throw new Error('IPFS redirect downgrades https to http');
+    }
+    if (next.username !== '' || next.password !== '') {
+        throw new Error('IPFS redirect carries embedded credentials');
+    }
+    if (!isHostInGatewayFamily(next.hostname, gateway.hostname)) {
+        throw new Error(`IPFS redirect leaves the configured gateway (${next.hostname})`);
+    }
+    // Host family alone would let a self-hosted gateway (`http://127.0.0.1:8080/ipfs/`)
+    // pivot onto any other service on the same host. `URL.port` is '' for the
+    // scheme default, so the comparison is already normalized.
+    if (next.port !== gateway.port) {
+        throw new Error(`IPFS redirect changes the gateway port (${next.port === '' ? 'default' : next.port})`);
+    }
+}
+/** Location for an error message, with any configured gateway credentials dropped. */
+function displayUrl(url) {
+    return `${url.origin}${url.pathname}`.slice(0, 100);
+}
+async function discardBody(response) {
+    try {
+        await response.body?.cancel();
+    }
+    catch {
+        // A body that refuses to cancel is not worth failing the request over.
+    }
+}
+/** Read a response body as bytes, refusing anything past the byte cap. */
+async function readBoundedBytes(response) {
+    const declared = Number(response.headers.get('content-length'));
+    if (Number.isFinite(declared) && declared > MAX_IPFS_RESPONSE_BYTES) {
+        await discardBody(response);
+        throw new Error(`IPFS response exceeds the ${MAX_IPFS_RESPONSE_BYTES}-byte cap ` +
+            `(content-length ${declared})`);
+    }
+    const body = response.body;
+    if (!body)
+        return new Uint8Array(0);
+    const reader = body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (!value)
+                continue;
+            total += value.byteLength;
+            if (total > MAX_IPFS_RESPONSE_BYTES) {
+                throw new Error(`IPFS response exceeds the ${MAX_IPFS_RESPONSE_BYTES}-byte cap`);
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        try {
+            await reader.cancel();
+        }
+        catch {
+            // Already terminal; the read result (or throw) above is what matters.
+        }
+    }
+    const joined = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        joined.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return joined;
+}
+/** Read a response body as text, refusing anything past the byte cap. */
+async function readBoundedText(response) {
+    const joined = await readBoundedBytes(response);
+    try {
+        return new TextDecoder('utf-8', { fatal: true }).decode(joined);
+    }
+    catch {
+        throw new Error('IPFS response is not valid UTF-8');
+    }
+}
+/**
+ * Request `url`, resolving redirects here rather than in `fetch`, so every hop
+ * is revalidated against the configured gateway before it is requested.
+ * Returns the first non-redirect, ok response; its body is still unread.
+ */
+async function fetchThroughGateway(url, signal) {
+    const gateway = url;
+    let current = new URL(url);
+    for (let hop = 0;; hop += 1) {
+        const response = await fetch(current, { method: 'GET', redirect: 'manual', signal });
+        if (REDIRECT_STATUSES.has(response.status)) {
+            await discardBody(response);
+            if (hop >= MAX_IPFS_REDIRECT_HOPS) {
+                throw new Error(`IPFS fetch exceeded ${MAX_IPFS_REDIRECT_HOPS} redirects`);
+            }
+            const location = response.headers.get('location');
+            if (location === null || location.trim() === '') {
+                throw new Error(`IPFS gateway returned ${response.status} without a Location header`);
+            }
+            let next;
+            try {
+                next = new URL(location, current);
+            }
+            catch {
+                throw new Error('IPFS redirect Location is not a valid URL');
+            }
+            assertRedirectAllowed(next, current, gateway);
+            current = next;
+            continue;
+        }
+        if (!response.ok) {
+            await discardBody(response);
+            throw new Error(`IPFS fetch failed: ${response.status} ${response.statusText} ` +
+                `(${displayUrl(current)}…)`);
+        }
+        return response;
     }
+}
+async function fetchJson(url, signal) {
+    const response = await fetchThroughGateway(url, signal);
     const contentType = response.headers.get('content-type') ?? '';
-    if (contentType.includes('application/json'))
-        return response.json();
-    const text = await response.text();
+    const text = await readBoundedText(response);
     try {
         return JSON.parse(text);
     }
@@ -45,6 +210,9 @@ async function fetchJson(url, signal) {
         throw new Error(`IPFS response is not JSON (content-type: ${contentType || 'none'})`);
     }
 }
+async function fetchBytes(url, signal) {
+    return readBoundedBytes(await fetchThroughGateway(url, signal));
+}
 function resolveFallbackGatewayBases(opts) {
     if (opts?.fallbackGatewayBase === false)
         return [];
@@ -53,29 +221,72 @@ function resolveFallbackGatewayBases(opts) {
     }
     return [['fallback', FALLBACK_IPFS_GATEWAY_BASE]];
 }
-/** Read-only multi-codec, primary-plus-fallback IPFS JSON fetch. */
-export async function fetchFromIpfs(gatewayUrl, cid, opts) {
+/**
+ * Run every gateway x CID candidate through `read`, under one whole-operation
+ * deadline. Shared by the JSON and raw-bytes entry points so both inherit the
+ * same redirect revalidation, byte cap, and deadline (#3438).
+ */
+async function fetchCandidatesFromIpfs(gatewayUrl, cid, opts, read, failureLabel) {
     const primary = normalizeIpfsGatewayBase(gatewayUrl);
     const gateways = [
         ['primary', primary],
         ...resolveFallbackGatewayBases(opts),
     ];
-    const errors = [];
+    const attempts = [];
     for (const cidPath of buildIpfsFetchCidPathCandidates(cid)) {
-        for (const [name, baseUrl] of gateways) {
-            const url = `${baseUrl}${cidPath}`;
-            const controller = new AbortController();
-            const timer = setTimeout(() => controller.abort(), IPFS_FETCH_TIMEOUT_MS);
-            try {
-                return await fetchJson(url, controller.signal);
-            }
-            catch (error) {
-                errors.push(`${name}:${url.slice(0, 100)}: ${error instanceof Error ? error.message : String(error)}`);
-            }
-            finally {
-                clearTimeout(timer);
-            }
+        for (const [name, baseUrl] of gateways)
+            attempts.push([name, `${baseUrl}${cidPath}`]);
+    }
+    const errors = [];
+    const deadline = Date.now() + IPFS_TOTAL_FETCH_TIMEOUT_MS;
+    for (let index = 0; index < attempts.length; index += 1) {
+        const [name, url] = attempts[index];
+        const remainingMs = deadline - Date.now();
+        if (remainingMs <= 0) {
+            errors.push(`whole-operation timeout after ${IPFS_TOTAL_FETCH_TIMEOUT_MS}ms`);
+            break;
+        }
+        // Share what is left of the budget across the candidates still to try, so a
+        // run of slow early candidates cannot starve a later one that would have
+        // succeeded. Without this the whole-operation bound would silently narrow
+        // the candidate matrix instead of only bounding it.
+        const attemptMs = Math.min(IPFS_FETCH_TIMEOUT_MS, Math.ceil(remainingMs / (attempts.length - index)));
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), attemptMs);
+        // Parsed once here rather than inside the catch, so a URL this candidate
+        // cannot even parse is reported as a candidate failure instead of escaping
+        // as a bare TypeError that discards the other candidates' errors.
+        let target;
+        try {
+            target = new URL(url);
+        }
+        catch {
+            errors.push(`${name}: candidate URL could not be parsed`);
+            clearTimeout(timer);
+            continue;
+        }
+        try {
+            return await read(target, controller.signal);
+        }
+        catch (error) {
+            errors.push(`${name}:${displayUrl(target)}: ` +
+                `${error instanceof Error ? error.message : String(error)}`);
+        }
+        finally {
+            clearTimeout(timer);
         }
     }
-    throw new Error(`IPFS JSON fetch failed after all candidates: ${errors.join(' | ')}`);
+    throw new Error(`${failureLabel}: ${errors.join(' | ')}`);
+}
+/** Read-only multi-codec, primary-plus-fallback IPFS JSON fetch. */
+export async function fetchFromIpfs(gatewayUrl, cid, opts) {
+    return fetchCandidatesFromIpfs(gatewayUrl, cid, opts, fetchJson, 'IPFS JSON fetch failed after all candidates');
+}
+/**
+ * Read-only multi-codec, primary-plus-fallback IPFS fetch returning the exact
+ * bytes stored at the CID — no JSON parse/re-encode roundtrip. Use this
+ * whenever the bytes will be hashed, or whenever the content is not JSON.
+ */
+export async function fetchBytesFromIpfs(gatewayUrl, cid, opts) {
+    return fetchCandidatesFromIpfs(gatewayUrl, cid, opts, fetchBytes, 'IPFS raw bytes fetch failed after all candidates');
 }

package/dist/corpus-read/origin-guard.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Destination policy for manifest-supplied artifact origins (#1901).
+ *
+ * A corpus manifest is attacker-controlled input: `artifact.access.endpoint`
+ * arrives from whoever published the envelope. Fetching it unguarded turns
+ * every daemon into an SSRF proxy for loopback, RFC1918, link-local, and
+ * cloud metadata services. This module is the single place that decides
+ * whether a destination is allowed to be contacted at all.
+ *
+ * The policy is deny-by-default: a destination is public only if we can
+ * positively classify every address behind it as public.
+ *
+ * Validation alone is not enough. Revalidating a hostname and then handing
+ * the *name* to the transport lets an attacker who controls its DNS answer
+ * one address to us and a different one to the socket (rebinding), which
+ * bypasses the check entirely. So this module does not merely approve a
+ * destination — it returns the exact address it approved, and the transport
+ * pins the connection to that address. The value we classify is the value we
+ * connect to.
+ */
+/** Why a destination was refused, or `'public'` when it is allowed. */
+export type AddressClass = 'public' | ProhibitedReason;
+export type ProhibitedReason = 'loopback' | 'private' | 'link-local' | 'multicast' | 'unspecified' | 'broadcast' | 'reserved' | 'carrier-nat' | 'unique-local' | 'documentation' | 'unparsable';
+export declare class ProhibitedDestinationError extends Error {
+    readonly detail: string;
+    readonly reason: ProhibitedReason | 'scheme' | 'credentials' | 'malformed-url' | 'redirect-cap';
+    constructor(detail: string, reason: ProhibitedReason | 'scheme' | 'credentials' | 'malformed-url' | 'redirect-cap');
+}
+/** Classify a dotted-quad IPv4 address against the prohibited-range table. */
+export declare function classifyIpv4(ip: string): AddressClass;
+/**
+ * Classify an IPv6 address. Embedded-IPv4 forms (IPv4-mapped, NAT64, 6to4)
+ * are unwrapped and classified as IPv4 so `::ffff:127.0.0.1` cannot smuggle
+ * loopback past the IPv4 table.
+ */
+export declare function classifyIpv6(ip: string): AddressClass;
+/** Classify any IP literal. Anything we cannot parse is refused. */
+export declare function classifyIpAddress(ip: string): AddressClass;
+/** Resolve a hostname to every A/AAAA address the resolver knows. */
+export type HostnameResolver = (hostname: string) => Promise<string[]>;
+export interface OriginGuardOptions {
+    /** Injection seam for tests; defaults to `dns.lookup(..., { all: true })`. */
+    resolveHostname?: HostnameResolver;
+    /**
+     * Escape hatch for an operator pointing at a local origin, where
+     * `publicEndpoint` legitimately defaults to `http://localhost:<apiPort>`.
+     * Off unless explicitly enabled — the default is fail-closed. It waives
+     * only the address policy; scheme and credential checks still run.
+     */
+    allowPrivateDestinations?: boolean;
+}
+/** The exact destinations the guard approved, for the transport to pin to. */
+export interface PinnedDestination {
+    /**
+     * Every address the connection may use, in resolver order. All of them
+     * passed the policy, so the transport is free to fail over between them —
+     * pinning to just the first would break dual-stack and multi-A origins.
+     */
+    readonly addresses: ReadonlyArray<{
+        readonly address: string;
+        readonly family: 4 | 6;
+    }>;
+}
+/**
+ * Validate one destination and return the address it is allowed to reach.
+ *
+ * Throws `ProhibitedDestinationError` unless the URL is a credential-free
+ * public `http:`/`https:` destination. On success the caller MUST connect to
+ * the returned address rather than re-resolving the hostname — re-resolving
+ * reopens the rebinding window this function exists to close.
+ *
+ * Returns `null` only when `allowPrivateDestinations` is set, where there is
+ * no policy to pin to.
+ */
+export declare function resolvePublicHttpDestination(url: URL, options?: OriginGuardOptions): Promise<PinnedDestination | null>;

package/dist/corpus-read/origin-guard.js

@@ -0,0 +1,265 @@
+/**
+ * Destination policy for manifest-supplied artifact origins (#1901).
+ *
+ * A corpus manifest is attacker-controlled input: `artifact.access.endpoint`
+ * arrives from whoever published the envelope. Fetching it unguarded turns
+ * every daemon into an SSRF proxy for loopback, RFC1918, link-local, and
+ * cloud metadata services. This module is the single place that decides
+ * whether a destination is allowed to be contacted at all.
+ *
+ * The policy is deny-by-default: a destination is public only if we can
+ * positively classify every address behind it as public.
+ *
+ * Validation alone is not enough. Revalidating a hostname and then handing
+ * the *name* to the transport lets an attacker who controls its DNS answer
+ * one address to us and a different one to the socket (rebinding), which
+ * bypasses the check entirely. So this module does not merely approve a
+ * destination — it returns the exact address it approved, and the transport
+ * pins the connection to that address. The value we classify is the value we
+ * connect to.
+ */
+import { isIPv4, isIPv6 } from 'node:net';
+import { lookup } from 'node:dns/promises';
+export class ProhibitedDestinationError extends Error {
+    detail;
+    reason;
+    constructor(detail, reason) {
+        super(detail);
+        this.detail = detail;
+        this.reason = reason;
+        this.name = 'ProhibitedDestinationError';
+    }
+}
+function parseIpv4(ip) {
+    const parts = ip.split('.');
+    if (parts.length !== 4)
+        return null;
+    const octets = [];
+    for (const part of parts) {
+        if (!/^\d{1,3}$/u.test(part))
+            return null;
+        const value = Number(part);
+        if (value > 255)
+            return null;
+        octets.push(value);
+    }
+    return octets;
+}
+/** Classify a dotted-quad IPv4 address against the prohibited-range table. */
+export function classifyIpv4(ip) {
+    const octets = parseIpv4(ip);
+    if (!octets)
+        return 'unparsable';
+    const [a, b, c] = octets;
+    if (a === 0)
+        return 'unspecified'; // 0.0.0.0/8 "this network"
+    if (a === 10)
+        return 'private'; // RFC1918
+    if (a === 127)
+        return 'loopback'; // RFC1122
+    if (a === 100 && b >= 64 && b <= 127)
+        return 'carrier-nat'; // RFC6598 100.64/10
+    if (a === 169 && b === 254)
+        return 'link-local'; // incl. 169.254.169.254 metadata
+    if (a === 172 && b >= 16 && b <= 31)
+        return 'private'; // RFC1918
+    if (a === 192 && b === 0 && c === 0)
+        return 'reserved'; // IETF protocol assignments
+    if (a === 192 && b === 0 && c === 2)
+        return 'documentation'; // TEST-NET-1
+    if (a === 192 && b === 88 && c === 99)
+        return 'reserved'; // 6to4 relay anycast
+    if (a === 192 && b === 168)
+        return 'private'; // RFC1918
+    if (a === 198 && (b === 18 || b === 19))
+        return 'reserved'; // benchmarking
+    if (a === 198 && b === 51 && c === 100)
+        return 'documentation'; // TEST-NET-2
+    if (a === 203 && b === 0 && c === 113)
+        return 'documentation'; // TEST-NET-3
+    if (a >= 224 && a <= 239)
+        return 'multicast';
+    if (ip === '255.255.255.255')
+        return 'broadcast';
+    if (a >= 240)
+        return 'reserved'; // 240/4 future use
+    return 'public';
+}
+/** Expand an IPv6 literal (with optional `::` and trailing IPv4) to 16 bytes. */
+function parseIpv6(ip) {
+    const zoneless = ip.split('%')[0];
+    const halves = zoneless.split('::');
+    if (halves.length > 2)
+        return null;
+    const expand = (segment) => {
+        if (segment === '')
+            return [];
+        const bytes = [];
+        const groups = segment.split(':');
+        for (let i = 0; i < groups.length; i += 1) {
+            const group = groups[i];
+            if (group.includes('.')) {
+                // Trailing dotted-quad form is only legal in the last position.
+                if (i !== groups.length - 1)
+                    return null;
+                const octets = parseIpv4(group);
+                if (!octets)
+                    return null;
+                bytes.push(...octets);
+                continue;
+            }
+            if (!/^[0-9a-fA-F]{1,4}$/u.test(group))
+                return null;
+            const value = Number.parseInt(group, 16);
+            bytes.push((value >> 8) & 0xff, value & 0xff);
+        }
+        return bytes;
+    };
+    const head = expand(halves[0]);
+    const tail = halves.length === 2 ? expand(halves[1]) : [];
+    if (head === null || tail === null)
+        return null;
+    if (halves.length === 1)
+        return head.length === 16 ? head : null;
+    const gap = 16 - head.length - tail.length;
+    if (gap < 0)
+        return null;
+    return [...head, ...new Array(gap).fill(0), ...tail];
+}
+/**
+ * Classify an IPv6 address. Embedded-IPv4 forms (IPv4-mapped, NAT64, 6to4)
+ * are unwrapped and classified as IPv4 so `::ffff:127.0.0.1` cannot smuggle
+ * loopback past the IPv4 table.
+ */
+export function classifyIpv6(ip) {
+    const bytes = parseIpv6(ip);
+    if (!bytes)
+        return 'unparsable';
+    const dotted = (offset) => bytes.slice(offset, offset + 4).join('.');
+    if (bytes.every((byte) => byte === 0))
+        return 'unspecified';
+    if (bytes.slice(0, 15).every((byte) => byte === 0) && bytes[15] === 1)
+        return 'loopback';
+    // ::ffff:0:0/96 — IPv4-mapped.
+    if (bytes.slice(0, 10).every((byte) => byte === 0) && bytes[10] === 0xff && bytes[11] === 0xff) {
+        return classifyIpv4(dotted(12));
+    }
+    // 64:ff9b::/96 — NAT64 well-known prefix.
+    if (bytes[0] === 0x00 && bytes[1] === 0x64 && bytes[2] === 0xff && bytes[3] === 0x9b
+        && bytes.slice(4, 12).every((byte) => byte === 0)) {
+        return classifyIpv4(dotted(12));
+    }
+    // 2002::/16 — 6to4, embeds the IPv4 relay address.
+    if (bytes[0] === 0x20 && bytes[1] === 0x02) {
+        const embedded = classifyIpv4(dotted(2));
+        return embedded === 'public' ? 'reserved' : embedded;
+    }
+    // 64:ff9b:1::/48 — RFC 8215 local-use NAT64, any embedding.
+    if (bytes[0] === 0x00 && bytes[1] === 0x64 && bytes[2] === 0xff && bytes[3] === 0x9b
+        && bytes[4] === 0x00 && bytes[5] === 0x01) {
+        return 'reserved';
+    }
+    // ::/8 — everything else in the all-zero high byte, which is where the
+    // IPv4-compatible (`::127.0.0.1`) and IPv4-translated (`::ffff:0:7f00:1`)
+    // forms live. The genuinely useful embeddings are unwrapped above; the
+    // rest is refused rather than left to fall through as public.
+    if (bytes[0] === 0x00)
+        return 'reserved';
+    // 100::/64 — discard-only.
+    if (bytes[0] === 0x01 && bytes[1] === 0x00 && bytes.slice(2, 8).every((byte) => byte === 0)) {
+        return 'reserved';
+    }
+    if ((bytes[0] & 0xfe) === 0xfc)
+        return 'unique-local'; // fc00::/7
+    if (bytes[0] === 0xfe && (bytes[1] & 0xc0) === 0x80)
+        return 'link-local'; // fe80::/10
+    if (bytes[0] === 0xfe && (bytes[1] & 0xc0) === 0xc0)
+        return 'private'; // fec0::/10 site-local
+    if (bytes[0] === 0xff)
+        return 'multicast'; // ff00::/8
+    if (bytes[0] === 0x20 && bytes[1] === 0x01 && bytes[2] === 0x0d && bytes[3] === 0xb8) {
+        return 'documentation'; // 2001:db8::/32
+    }
+    if (bytes[0] === 0x20 && bytes[1] === 0x01 && bytes[2] === 0x00 && bytes[3] === 0x00) {
+        return 'reserved'; // 2001::/32 Teredo
+    }
+    // Deny-by-default: only global unicast (2000::/3) can be public, and only
+    // after the special-purpose prefixes carved out of it above.
+    if ((bytes[0] & 0xe0) !== 0x20)
+        return 'reserved';
+    return 'public';
+}
+/** Classify any IP literal. Anything we cannot parse is refused. */
+export function classifyIpAddress(ip) {
+    if (isIPv4(ip))
+        return classifyIpv4(ip);
+    if (isIPv6(ip))
+        return classifyIpv6(ip);
+    return 'unparsable';
+}
+const defaultResolver = async (hostname) => {
+    const records = await lookup(hostname, { all: true, verbatim: true });
+    return records.map((record) => record.address);
+};
+/** `[::1]` → `::1`; other hostnames are returned unchanged. */
+function unbracket(hostname) {
+    return hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
+}
+/**
+ * Validate one destination and return the address it is allowed to reach.
+ *
+ * Throws `ProhibitedDestinationError` unless the URL is a credential-free
+ * public `http:`/`https:` destination. On success the caller MUST connect to
+ * the returned address rather than re-resolving the hostname — re-resolving
+ * reopens the rebinding window this function exists to close.
+ *
+ * Returns `null` only when `allowPrivateDestinations` is set, where there is
+ * no policy to pin to.
+ */
+export async function resolvePublicHttpDestination(url, options = {}) {
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new ProhibitedDestinationError(`artifact origin scheme ${url.protocol} is not http(s): ${url.href}`, 'scheme');
+    }
+    // Credentials are refused regardless of the private-destination hatch:
+    // leaking them to a peer is orthogonal to whether the peer is public.
+    if (url.username !== '' || url.password !== '') {
+        throw new ProhibitedDestinationError(`artifact origin must not carry credentials: ${url.host}`, 'credentials');
+    }
+    if (options.allowPrivateDestinations === true)
+        return null;
+    const host = unbracket(url.hostname);
+    if (host === '') {
+        throw new ProhibitedDestinationError('artifact origin has no host', 'malformed-url');
+    }
+    if (isIPv4(host) || isIPv6(host)) {
+        const verdict = classifyIpAddress(host);
+        if (verdict !== 'public') {
+            throw new ProhibitedDestinationError(`artifact origin address ${host} is ${verdict}, not a public destination`, verdict);
+        }
+        return { addresses: [{ address: host, family: isIPv4(host) ? 4 : 6 }] };
+    }
+    let addresses;
+    try {
+        addresses = await (options.resolveHostname ?? defaultResolver)(host);
+    }
+    catch (err) {
+        throw new ProhibitedDestinationError(`artifact origin ${host} did not resolve: ${err instanceof Error ? err.message : String(err)}`, 'unparsable');
+    }
+    if (addresses.length === 0) {
+        throw new ProhibitedDestinationError(`artifact origin ${host} resolved to no addresses`, 'unparsable');
+    }
+    // Every answer must be public — a name that mixes a public address with a
+    // private one is refused outright rather than cherry-picked.
+    for (const address of addresses) {
+        const verdict = classifyIpAddress(address);
+        if (verdict !== 'public') {
+            throw new ProhibitedDestinationError(`artifact origin ${host} resolves to ${address} (${verdict}), not a public destination`, verdict);
+        }
+    }
+    return {
+        addresses: addresses.map((address) => ({
+            address,
+            family: isIPv4(address) ? 4 : 6,
+        })),
+    };
+}

package/dist/corpus-read/pinned-fetch.d.ts

@@ -0,0 +1,42 @@
+/**
+ * A `fetch`-shaped transport that connects to a caller-chosen address (#1901).
+ *
+ * `globalThis.fetch` resolves the hostname itself, at connect time, with no
+ * hook to constrain the result. That is fatal for a destination policy: an
+ * attacker who controls the name's DNS can answer a public address to the
+ * policy's lookup and a private one to the socket's. Validating the name and
+ * then handing the name to `fetch` checks one thing and connects to another.
+ *
+ * So the production path uses `node:http`/`node:https` with the `lookup`
+ * option pinned to the address `origin-guard` already approved. The URL keeps
+ * its hostname, so TLS still does SNI and certificate validation against the
+ * real name; only address selection is taken away from the resolver.
+ *
+ * The result is adapted back to a web `Response` so callers — and the tests
+ * that inject a plain `fetch` fake — see one shape either way. The body is
+ * exposed as a stream, never buffered here, so the caller's byte cap still
+ * governs.
+ *
+ * One deliberate difference from `fetch`: there is no transparent content
+ * decoding. We send no `Accept-Encoding`, so a compliant origin answers with
+ * identity bytes — and the bytes the byte cap counts are then exactly the
+ * bytes the caller hashes. An origin that compresses anyway delivers bytes
+ * that fail the SHA-256 check, which is the safe direction: nothing
+ * unverified is ever admitted.
+ */
+export interface PinnedAddress {
+    readonly address: string;
+    readonly family: 4 | 6;
+}
+export interface PinnedFetchInit {
+    /**
+     * Addresses the socket may connect to, in preference order. Every one has
+     * already passed the destination policy, so Node is free to fail over
+     * between them. Omit to use ordinary DNS.
+     */
+    readonly pinnedAddresses?: readonly PinnedAddress[];
+    readonly signal?: AbortSignal;
+}
+export type PinnedFetch = (url: URL, init?: PinnedFetchInit) => Promise<Response>;
+/** Perform one GET, pinned to `init.pinnedAddress` when supplied. */
+export declare const pinnedFetch: PinnedFetch;

package/dist/corpus-read/pinned-fetch.js

@@ -0,0 +1,121 @@
+/**
+ * A `fetch`-shaped transport that connects to a caller-chosen address (#1901).
+ *
+ * `globalThis.fetch` resolves the hostname itself, at connect time, with no
+ * hook to constrain the result. That is fatal for a destination policy: an
+ * attacker who controls the name's DNS can answer a public address to the
+ * policy's lookup and a private one to the socket's. Validating the name and
+ * then handing the name to `fetch` checks one thing and connects to another.
+ *
+ * So the production path uses `node:http`/`node:https` with the `lookup`
+ * option pinned to the address `origin-guard` already approved. The URL keeps
+ * its hostname, so TLS still does SNI and certificate validation against the
+ * real name; only address selection is taken away from the resolver.
+ *
+ * The result is adapted back to a web `Response` so callers — and the tests
+ * that inject a plain `fetch` fake — see one shape either way. The body is
+ * exposed as a stream, never buffered here, so the caller's byte cap still
+ * governs.
+ *
+ * One deliberate difference from `fetch`: there is no transparent content
+ * decoding. We send no `Accept-Encoding`, so a compliant origin answers with
+ * identity bytes — and the bytes the byte cap counts are then exactly the
+ * bytes the caller hashes. An origin that compresses anyway delivers bytes
+ * that fail the SHA-256 check, which is the safe direction: nothing
+ * unverified is ever admitted.
+ */
+import { request as httpRequest } from 'node:http';
+import { request as httpsRequest } from 'node:https';
+import { Readable } from 'node:stream';
+import { isIPv4, isIPv6 } from 'node:net';
+/** Statuses the `Response` constructor refuses to pair with a body. */
+const NULL_BODY_STATUSES = new Set([101, 103, 204, 205, 304]);
+/** Perform one GET, pinned to `init.pinnedAddress` when supplied. */
+export const pinnedFetch = (url, init = {}) => new Promise((resolve, reject) => {
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        reject(new Error(`pinnedFetch supports http(s) only, got ${url.protocol}`));
+        return;
+    }
+    if (init.signal?.aborted) {
+        reject(new Error('aborted'));
+        return;
+    }
+    // `undefined` means "no pin requested"; an empty list means "pin requested,
+    // nothing permitted". Letting the latter fall through to ordinary DNS would
+    // turn an empty allowlist into no restriction at all — the wrong default
+    // for a security primitive, and invisible at the call site.
+    if (init.pinnedAddresses !== undefined && init.pinnedAddresses.length === 0) {
+        reject(new Error('pinnedAddresses must not be empty; omit it to use ordinary DNS'));
+        return;
+    }
+    for (const entry of init.pinnedAddresses ?? []) {
+        const matches = entry.family === 4 ? isIPv4(entry.address) : isIPv6(entry.address);
+        if (!matches) {
+            reject(new Error(`pinned address ${entry.address} is not a numeric IPv${entry.family} address`));
+            return;
+        }
+    }
+    const send = url.protocol === 'https:' ? httpsRequest : httpRequest;
+    const pinned = init.pinnedAddresses;
+    const outgoing = send(url, {
+        method: 'GET',
+        // A pooled keep-alive socket is keyed on host:port and ignores `lookup`,
+        // so a reused connection would skip the pin entirely. Opting out of the
+        // shared agent keeps "we connect to the address we validated" literally
+        // true, at the cost of a handshake per artifact fetch.
+        ...(pinned === undefined ? {} : { agent: false }),
+        // Redirects are never followed here; the caller revalidates each hop.
+        ...(pinned === undefined ? {} : {
+            // Node calls `lookup` with `{ all: true }` from some connect paths
+            // and expects the array shape back there; answering the wrong shape
+            // throws "Invalid IP address: undefined".
+            lookup: (_hostname, options, callback) => {
+                if (options?.all === true)
+                    callback(null, pinned.map((entry) => ({ ...entry })));
+                else
+                    callback(null, pinned[0].address, pinned[0].family);
+            },
+        }),
+    }, (incoming) => {
+        // Everything here runs inside http.request's response callback, where a
+        // throw is an UNCAUGHT EXCEPTION — no promise rejection, nothing the
+        // caller's try/catch can see, process dead. The response is
+        // attacker-shaped, so the whole callback is guarded and every failure
+        // is converted into a rejection this function's caller can handle.
+        try {
+            const headers = new Headers();
+            for (const [name, value] of Object.entries(incoming.headers)) {
+                if (value === undefined)
+                    continue;
+                headers.set(name, Array.isArray(value) ? value.join(', ') : value);
+            }
+            // Node's parser accepts any status up to 999, but `Response` throws
+            // outside 200-599. Check it explicitly rather than leaning on the
+            // catch below, so a hostile `HTTP/1.1 999 Nope` reads as a bad
+            // response instead of an internal error.
+            const status = incoming.statusCode ?? 502;
+            if (status < 200 || status > 599) {
+                incoming.resume();
+                reject(new Error(`origin returned an out-of-range HTTP status ${status}`));
+                return;
+            }
+            const bodyless = NULL_BODY_STATUSES.has(status);
+            if (bodyless)
+                incoming.resume();
+            resolve(new Response(bodyless ? null : Readable.toWeb(incoming), { status, headers }));
+        }
+        catch (err) {
+            incoming.resume();
+            reject(err instanceof Error ? err : new Error(String(err)));
+        }
+    });
+    outgoing.on('error', reject);
+    if (init.signal) {
+        const abort = () => { outgoing.destroy(new Error('aborted')); };
+        if (init.signal.aborted)
+            abort();
+        else
+            init.signal.addEventListener('abort', abort, { once: true });
+    }
+    outgoing.end();
+});

package/dist/envelope.d.ts

@@ -15,7 +15,7 @@
  * doc are parsed against this schema in `test/envelope.test.ts`).
  *
  * Step shape mirrors the capture-span shape (`SpanRow`,
- * `client/src/store/captures.ts`) minus session/trace IDs, which are hoisted
+ * `operator/src/store/captures.ts`) minus session/trace IDs, which are hoisted
  * to `session`.
  *
  * Plan: docs/superpowers/plans/2026-07-02-jinn-harness-network-v0-plan.md
@@ -56,7 +56,7 @@ export declare const OutcomeStatusSchema: z.ZodEnum<{
 export type OutcomeStatus = z.infer<typeof OutcomeStatusSchema>;
 /**
  * One compressed trace step. Mirrors `SpanRow`
- * (client/src/store/captures.ts): scrubbed `attributes` plus the
+ * (operator/src/store/captures.ts): scrubbed `attributes` plus the
  * `redactedKeys` receipt of what the scrub pipeline removed.
  */
 export declare const TraceStepSchema: z.ZodObject<{

package/dist/envelope.js

@@ -15,7 +15,7 @@
  * doc are parsed against this schema in `test/envelope.test.ts`).
  *
  * Step shape mirrors the capture-span shape (`SpanRow`,
- * `client/src/store/captures.ts`) minus session/trace IDs, which are hoisted
+ * `operator/src/store/captures.ts`) minus session/trace IDs, which are hoisted
  * to `session`.
  *
  * Plan: docs/superpowers/plans/2026-07-02-jinn-harness-network-v0-plan.md
@@ -53,7 +53,7 @@ const UnixNanoSchema = z.string().regex(/^\d+$/, 'unix-nanosecond digit string')
 const TrimmedString = (max) => z.string().min(1).max(max).regex(/^\S(.*\S)?$/s, 'no surrounding whitespace');
 /**
  * One compressed trace step. Mirrors `SpanRow`
- * (client/src/store/captures.ts): scrubbed `attributes` plus the
+ * (operator/src/store/captures.ts): scrubbed `attributes` plus the
  * `redactedKeys` receipt of what the scrub pipeline removed.
  */
 export const TraceStepSchema = z.strictObject({

package/dist/skill-artifact.d.ts

@@ -11,7 +11,7 @@ import { z } from 'zod/v3';
  * so they publish as a skill-only wrapper (`publishSkill()`,
  * packages/layer/src/publish-skill.ts, DR-2026-07-06).
  * Access/pricing come from the enclosing Artifact
- * entry (client/src/types/envelope.ts ArtifactSchema: sha256,
+ * entry (operator/src/types/envelope.ts ArtifactSchema: sha256,
  * access.endpoint, access.priceUsdc, metadata.tags).
  *
  * Frozen-caps review (AC3, additive): this schema is a NEW artifact payload
@@ -22,7 +22,7 @@ import { z } from 'zod/v3';
  * any artifactType string. Companion-file content lives here, free of the
  * trace envelope's 16 KiB step-attribute cap, under its own 1 MiB total cap.
  *
- * Precedent: client/src/trajectory/harness-bundle-schema.ts.
+ * Precedent: operator/src/trajectory/harness-bundle-schema.ts.
  */
 export declare const SKILL_ARTIFACT_TYPE: "jinn.skill.v1";
 /** Max companion files per skill. */

package/dist/skill-artifact.js

@@ -11,7 +11,7 @@ import { z } from 'zod/v3';
  * so they publish as a skill-only wrapper (`publishSkill()`,
  * packages/layer/src/publish-skill.ts, DR-2026-07-06).
  * Access/pricing come from the enclosing Artifact
- * entry (client/src/types/envelope.ts ArtifactSchema: sha256,
+ * entry (operator/src/types/envelope.ts ArtifactSchema: sha256,
  * access.endpoint, access.priceUsdc, metadata.tags).
  *
  * Frozen-caps review (AC3, additive): this schema is a NEW artifact payload
@@ -22,7 +22,7 @@ import { z } from 'zod/v3';
  * any artifactType string. Companion-file content lives here, free of the
  * trace envelope's 16 KiB step-attribute cap, under its own 1 MiB total cap.
  *
- * Precedent: client/src/trajectory/harness-bundle-schema.ts.
+ * Precedent: operator/src/trajectory/harness-bundle-schema.ts.
  */
 export const SKILL_ARTIFACT_TYPE = 'jinn.skill.v1';
 /** Max companion files per skill. */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@jinn-network/core",
-  "version": "0.1.1",
-  "description": "Domain core for Jinn — evidence/contribution stores, scrub, trajectory parsing, and corpus reads. Independent of client/src.",
+  "version": "0.1.2-canary.15837edd",
+  "description": "Domain core for Jinn — evidence/contribution stores, scrub, trajectory parsing, and corpus reads. Independent of operator/src.",
   "type": "module",
   "packageManager": "yarn@4.13.0",
   "license": "MIT",
@@ -43,14 +43,14 @@
   },
   "dependencies": {
     "@huggingface/transformers": "^4.2.0",
-    "@jinn-network/plugin": "0.1.1",
+    "@jinn-network/plugin": "0.1.2-canary.15837edd",
     "@lmoe/gliner-onnx": "0.1.0",
     "@noble/hashes": "^2.2.0",
     "@secretlint/core": "^13.0.2",
     "@secretlint/secretlint-rule-preset-recommend": "^13.0.2",
     "better-sqlite3": "^12.10.0",
     "canonicalize": "^3.0.0",
-    "zod": "^4.4.3"
+    "zod": "4.4.3"
   },
   "peerDependencies": {
     "vitest": "^4.1.8"