@lapxo/bound 0.1.2 → 0.1.4

package/dist/fold/readers.d.ts

@@ -1,3 +1,4 @@
+import type { Capsule } from '../host/capsule.ts';
 import type { CoordinateRole } from './wire.ts';
 import { capsulesFor } from './reach.ts';
 import type { Kind } from '../observe/run.ts';
@@ -8,6 +9,7 @@ export interface ReaderClaim {
     readonly module: string;
     readonly kind: Kind;
     readonly capsule?: {
+        readonly selected?: Capsule;
         readonly digest: string;
         readonly entry: string;
         readonly region: string;

package/dist/fold/readers.js

@@ -62,13 +62,13 @@ export function capsuleReadersOf(root, store, standing, lines, resolve = capsule
             const pkg = fieldOf(by?.offer ?? '', 'scope').split('/')[1] ?? '';
             if (by === undefined || reaching.has(`${pkg} ${region} ${where || '/'}`))
                 continue;
-            const key = `${by.capsule.digest} ${region}`;
-            const group = groups.get(key) ?? groups.set(key, { module: `${pkg}/${region}`, digest: by.capsule.digest, entry: fieldOf(by.offer, 'shape'), region, reads: by.capsule.declaration.regions[region] ?? [], globs: new Map() }).get(key);
+            const key = `${by.capsule.selection ?? by.capsule.digest} ${region}`;
+            const group = groups.get(key) ?? groups.set(key, { module: `${pkg}/${region}`, digest: by.capsule.digest, entry: fieldOf(by.offer, 'shape'), selected: by.capsule, region, reads: by.capsule.declaration.regions[region] ?? [], globs: new Map() }).get(key);
             group.globs.set(where, fieldOf(line, 'value').split('|').filter(Boolean));
         }
     }
     return [...groups.values()].map((group) => ({ id: group.module, shape: ['run'], where: [...group.globs.keys()], module: group.module, kind: 'process',
-        capsule: { digest: group.digest, entry: group.entry, region: group.region, reads: group.reads, globs: group.globs } }));
+        capsule: { selected: group.selected, digest: group.digest, entry: group.entry, region: group.region, reads: group.reads, globs: group.globs } }));
 }
 export function handedAt(root, reader, roleOf, look, place) {
     const { reads, globs } = reader.capsule;

package/dist/fold/region-declarations.d.ts

@@ -0,0 +1,2 @@
+/** Region input selectors consumed by the host, rather than measured ceilings. */
+export declare function isRegionDeclaration(line: string, wire: readonly string[]): boolean;

package/dist/fold/region-declarations.js

@@ -0,0 +1,13 @@
+import { fieldOf, isConfig } from "./claims.js";
+import { wordsOf } from "./wire.js";
+/** Region input selectors consumed by the host, rather than measured ceilings. */
+export function isRegionDeclaration(line, wire) {
+    if (!isConfig(line) || !fieldOf(line, 'scope').startsWith('region/') || fieldOf(line, 'value') === 'withdraw')
+        return false;
+    const named = ['region-coordinate', 'region-leaf'].flatMap(name => {
+        const words = wordsOf(wire, name);
+        return words.length === 1 ? words : [];
+    });
+    const measures = ['lines', 'receipts', 'reads', ...named];
+    return measures.includes(fieldOf(line, 'measure'));
+}

package/dist/fold/resolved.js

@@ -1,3 +1,4 @@
+import { readOnly } from "../host/read-only.js";
 import { createHash, dirname, existsSync, join, linkSync, mkdirSync, readdirSync, renameSync, writeFileSync } from "../host/io.js";
 import { canonical, parse } from '@lapxo/topos/wire';
 import { RECEIPTS, fieldOf, isWire } from "./claims.js";
@@ -11,6 +12,10 @@ import { sourced } from "../land/vouched.js";
 import { entriesIn, observeFile, observeText } from "../observe/files.js";
 export const bytesOnly = (line) => {
     const got = parse(line);
+    // Authenticated evidence is delivered verbatim. A shortened observation is
+    // a different signed message, even when it describes the same input.
+    if (got.kind === 'fact' && got.value.fields.sig)
+        return line;
     return got.kind === 'fact' && fieldOf(line, 'measure') === 'observed' ? canonical({ ...got.value.fields, value: fieldOf(line, 'at').replace(/^.*:/, '').slice(0, 16) }) : line;
 };
 const held = new WeakMap();
@@ -45,7 +50,8 @@ export function receiptsOf(fold) {
         return canonical({ scope: `${sourced(fold.standing)}/${place}${shape}`, role: 'writes', form: 'alphabet', measure: 'digest', value: digest, by: writerFor(fold.standing, 'fold') ?? '', at: `place:${digest}` });
     });
     const place = under.replace(/\/$/, '');
-    const lines = [...named, ...[...cones].sort(), ...[...ran].sort(), ...paid].map((line) => (place ? zoomed(line, place) : line));
+    const lines = [...named, ...[...cones].sort(), ...[...ran].sort(), ...paid]
+        .map((line) => (place && !fieldOf(line, 'sig') ? zoomed(line, place) : line));
     if (!lines.length) {
         const shipped = (observeText(join(fold.root, under, RECEIPTS)) ?? '').split('\n').filter(isWire);
         const carried = carriedFrom(fold.store, shipped);
@@ -64,6 +70,8 @@ export function keepCarried(store, lines, from) {
         verifiedCarried(at, digest);
     }
     else {
+        if (readOnly())
+            return `sha256:${digest}`;
         mkdirSync(dirname(at), { recursive: true });
         const src = from === undefined ? '' : storeAt(from, 'cas', 'carried', digest);
         if (src && existsSync(src)) {

package/dist/fold/second.js

@@ -1,3 +1,4 @@
+import { readOnly } from "../host/read-only.js";
 import { snapshotVerdict } from "./evidence.js";
 import { dirname, resolve, spawnSync } from "../host/io.js";
 import { ledgerLines } from "../land/ledger.js";
@@ -9,6 +10,8 @@ import { said } from "./wire.js";
 import { sha } from "../host/hash.js";
 const asked = new Map();
 function askedNow(store, rests) {
+    if (readOnly())
+        return undefined;
     const root = dirname(store);
     const key = `${root} ${rests}`;
     if (asked.has(key))

package/dist/host/adapters/transport/http.d.ts

@@ -0,0 +1,5 @@
+/** Reference HTTP adapter. Location and budgets are already selected by admitted host policy. */
+export declare function fetchBytes(location: string, limits: {
+    readonly timeoutMs: number;
+    readonly responseBytes: number;
+}): Promise<Uint8Array>;

package/dist/host/adapters/transport/http.js

@@ -0,0 +1,28 @@
+/** Reference HTTP adapter. Location and budgets are already selected by admitted host policy. */
+export async function fetchBytes(location, limits) {
+    const signal = AbortSignal.timeout(limits.timeoutMs), response = await fetch(location, { signal });
+    if (!response.ok)
+        throw Error(`HTTP ${response.status}`);
+    const reader = response.body?.getReader();
+    if (!reader)
+        return new Uint8Array();
+    const chunks = [];
+    let size = 0;
+    try {
+        for (;;) {
+            const part = await reader.read();
+            if (part.done)
+                break;
+            size += part.value.length;
+            if (size > limits.responseBytes) {
+                await reader.cancel();
+                throw Error('response exceeds declared byte bound');
+            }
+            chunks.push(part.value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    return Buffer.concat(chunks);
+}

package/dist/host/capsule-process.d.ts

@@ -1,3 +1,4 @@
+import type { ReaderLifetime } from '@lapxo/topos/wire';
 import type { SpawnSyncOptionsWithStringEncoding } from 'node:child_process';
 import type { Request, Response } from '@lapxo/topos/contract';
 /** Operational process failure, distinct from a valid contract refusal or abstention. */
@@ -17,4 +18,4 @@ export declare class CapsuleProcessError extends Error {
 }
 export declare function validResponse(value: unknown, request: Request): value is Response;
 /** Last-line JSON is the wire framing. No partial batch, failed exit or synthetic missing response is accepted. */
-export declare function executeCapsule(command: string, args: readonly string[], requests: readonly Request[], limits?: Pick<SpawnSyncOptionsWithStringEncoding, 'timeout' | 'maxBuffer'>): readonly Response[];
+export declare function executeCapsule(command: string, args: readonly string[], requests: readonly Request[], limits?: Pick<SpawnSyncOptionsWithStringEncoding, 'timeout' | 'maxBuffer'>, lifetime?: ReaderLifetime): readonly Response[];

package/dist/host/capsule-process.js

@@ -1,3 +1,4 @@
+import { boundedProcess } from "./process-lifetime.js";
 import { spawnSync } from 'node:child_process';
 import { PROTOCOL } from '@lapxo/topos/wire';
 /** Operational process failure, distinct from a valid contract refusal or abstention. */
@@ -31,9 +32,9 @@ export function validResponse(value, request) {
     return true;
 }
 /** Last-line JSON is the wire framing. No partial batch, failed exit or synthetic missing response is accepted. */
-export function executeCapsule(command, args, requests, limits = {}) {
-    const run = spawnSync(command, args, { input: JSON.stringify(requests), encoding: 'utf8', maxBuffer: 1 << 26, ...limits });
-    if (run.error)
+export function executeCapsule(command, args, requests, limits = {}, lifetime) {
+    const run = lifetime === undefined ? spawnSync(command, args, { input: JSON.stringify(requests), encoding: 'utf8', maxBuffer: 1 << 26, ...limits }) : boundedProcess(command, args, JSON.stringify(requests), lifetime);
+    if ('error' in run && run.error)
         throw new CapsuleProcessError(`failed: ${run.error.message}`, run);
     if (run.signal !== null || run.status !== 0)
         throw new CapsuleProcessError(`exited ${run.status ?? `with signal ${run.signal}`}`, run);

package/dist/host/capsule.d.ts

@@ -1,6 +1,7 @@
 import type { Declaration } from '@lapxo/topos/capsule';
 import type { Request, Response } from '@lapxo/topos/contract';
 export interface Capsule {
+    readonly selection?: string;
     readonly digest: string;
     readonly declaration: Declaration;
     readonly lines: readonly string[];

package/dist/host/capsule.js

@@ -1,3 +1,6 @@
+import { readerLifetime, parse } from '@lapxo/topos/wire';
+import { contentStore, verifiedContent, contentPolicy } from "./content-store.js";
+import { readOnly } from "./read-only.js";
 import { sha } from "./hash.js";
 import { wireLinesOf as linesOf } from "../fold/claims.js";
 import { createHash } from 'node:crypto';
@@ -8,7 +11,7 @@ import { CAPSULE } from '@lapxo/topos/wire';
 import { declarationOf } from '@lapxo/topos/capsule';
 import { unpack } from "./archive.js";
 import { executeCapsule, validResponse } from "./capsule-process.js";
-import { blobAt, holdStore, replaceWhole, storeAt } from "../land/ledger.js";
+import { holdStore, replaceWhole, storeAt } from "../land/ledger.js";
 import { coordinatesUnder, observeFile, observeText } from "../observe/files.js";
 import { hostOf } from "../observe/run.js";
 import { ownLock, ownRoot, ownStore, processOf } from "../observe/runner.js";
@@ -42,13 +45,12 @@ function unpacked(digest, bytes) {
 const capsules = new Map();
 /** A blob is loaded once in an act. A later ask for the same digest reads that capsule, and does not hash or unpack it again. */
 export function capsuleAt(digest, entry, store) {
-    const identity = `${store ?? ownStore()}\0${digest}\0${entry}`;
+    const cacheStore = store ?? contentStore();
+    const { bytes } = verifiedContent(digest, cacheStore);
+    const identity = `${cacheStore}\0${digest}\0${entry}`;
     const held = capsules.get(identity);
     if (held !== undefined)
         return held;
-    const bytes = observeFile(blobAt(store ?? ownStore(), digest));
-    if (bytes === undefined || `sha256:${createHash('sha256').update(bytes).digest('hex')}` !== digest)
-        return undefined;
     const known = declared.get(digest) ?? ((lines) => ({ lines, declaration: declarationOf(lines) }))(linesOf(observeText(join(unpacked(digest, bytes), CAPSULE))));
     declared.set(digest, known);
     const names = Object.keys(known.declaration.regions);
@@ -61,7 +63,7 @@ export function capsuleAt(digest, entry, store) {
     const capsule = { digest, ...known, ask: (requests) => {
             if (!statSync(module, { throwIfNoEntry: false })?.isFile())
                 throw new Error(`REFUSE·capsule ${digest} declared entry ${entry} unavailable`);
-            return answered(digest, bytes, requests, names, root, store ?? ownStore(), module);
+            return answered(digest, bytes, requests, names, root, cacheStore, module);
         } };
     capsules.set(identity, capsule);
     return capsule;
@@ -108,10 +110,12 @@ function answered(digest, bytes, requests, names, tree, cacheStore = ownStore(),
         }
     });
     const missing = requests.filter((_, i) => held[i] === undefined);
+    if (missing.length && readOnly())
+        throw Error(`REFUSE·preview capsule ${digest} has no verified answer for the proposed inputs; fold the declared inputs first`);
     if (missing.length)
         process.stderr.write(`CAPSULE  ${digest.slice(7, 19)} · ${requests.length} asked · ${missing.length} run · ${missing.map((one) => `${one.rootScope}${one.region}`).join(' ')}\n`);
     // Execute and validate the entire batch before committing any answer to the cache.
-    const ran = !missing.length ? [] : executeCapsule(process.execPath, [...childFlags(), hostOf(), ...child], missing);
+    const ran = !missing.length ? [] : executeCapsule(process.execPath, [...childFlags(), hostOf(), ...child], missing, {}, readerLifetime(contentPolicy().flatMap(line => { const p = parse(line); return p.kind === 'fact' ? [p.value.fields] : []; }), digest));
     return requests.map((request, i) => {
         if (held[i] !== undefined)
             return held[i];

package/dist/host/cell-receipts.js

@@ -43,7 +43,7 @@ export async function cellsWithReceipts(root, history, emit) {
     for (const record of parsed.value.objects.filter(r => r.record === 'cell')) {
         const pin = record.fields.topos;
         if (!pins.has(pin)) {
-            const top = toposAt(pin);
+            const top = toposAt(pin, store);
             pins.set(pin, [pin, ...top.dependencies]);
         }
         const scope = `receipts/cells/${record.fields.scope}`;

package/dist/host/content-needed.d.ts

@@ -0,0 +1,5 @@
+/** The synchronous host names unavailable content; the enclosing fold resolves exactly that request. */
+export declare class ContentNeeded extends Error {
+    readonly digest: string;
+    constructor(digest: string, why?: string);
+}

package/dist/host/content-needed.js

@@ -0,0 +1,8 @@
+/** The synchronous host names unavailable content; the enclosing fold resolves exactly that request. */
+export class ContentNeeded extends Error {
+    constructor(digest, why = `REFUSE·pin ${digest} content unavailable · not laid`) {
+        super(why);
+        this.digest = digest;
+        this.name = 'ContentNeeded';
+    }
+}

package/dist/host/content-store.d.ts

@@ -0,0 +1,8 @@
+export declare const withContentStore: <T>(store: string, run: () => T, policy?: () => readonly string[]) => T;
+export declare const contentPolicy: () => readonly string[];
+export declare const contentStore: () => string;
+/** Only immutable verified bytes may be shared with the instrument. Local corruption is never hidden by fallback. */
+export declare function verifiedContent(digest: string, store?: string, instrument?: string): {
+    readonly bytes: Uint8Array;
+    readonly path: string;
+};

package/dist/host/content-store.js

@@ -0,0 +1,31 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { createHash } from 'node:crypto';
+import { blobAt } from "../land/ledger.js";
+import { observeFile } from "../observe/files.js";
+import { ownLock, ownStore } from "../observe/runner.js";
+import { parse, wireAt } from '@lapxo/topos/wire';
+import { ContentNeeded } from "./content-needed.js";
+// Each invocation carries its place explicitly; asynchronous requests cannot share a mutable current root.
+const requested = new AsyncLocalStorage();
+export const withContentStore = (store, run, policy = () => []) => requested.run({ store, policy }, run);
+export const contentPolicy = () => requested.getStore()?.policy() ?? [];
+export const contentStore = () => requested.getStore()?.store ?? ownStore();
+/** Only immutable verified bytes may be shared with the instrument. Local corruption is never hidden by fallback. */
+export function verifiedContent(digest, store = contentStore(), instrument = ownStore()) {
+    const fields = ownLock().flatMap(line => { const p = parse(line); return p.kind === 'fact' ? [p.value.fields] : []; });
+    const wire = wireAt(fields, Number.MAX_SAFE_INTEGER);
+    if (!wire)
+        throw Error('REFUSE·pin instrument has no admitted wire');
+    const split = digest.indexOf(':'), algorithm = digest.slice(0, split), hex = digest.slice(split + 1);
+    if (split < 1 || !wire.digests.has(algorithm) || !/^[a-f0-9]+$/.test(hex))
+        throw Error(`REFUSE·pin ${digest} digest is not admitted`);
+    for (const at of new Set([store, instrument])) {
+        const path = blobAt(at, digest), bytes = observeFile(path);
+        if (bytes === undefined)
+            continue;
+        if (createHash(algorithm).update(bytes).digest('hex') !== hex)
+            throw Error(`REFUSE·pin ${digest} content hash mismatch · store ${at} · not laid`);
+        return { bytes, path };
+    }
+    throw new ContentNeeded(digest);
+}

package/dist/host/lifetime.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/host/lifetime.js

@@ -0,0 +1,40 @@
+import { spawn } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+// This is a host mechanism, not a wire reader or a provider. The parent supplies its already selected policy.
+const request = JSON.parse(readFileSync(0, 'utf8'));
+if (!Number.isSafeInteger(request.limits.timeoutMs) || request.limits.timeoutMs <= 0 || !Number.isSafeInteger(request.limits.responseBytes) || request.limits.responseBytes <= 0)
+    throw Error('REFUSE·reader invalid process limits');
+const grouped = process.platform !== 'win32';
+const child = spawn(request.command, [...request.args], { cwd: request.cwd, env: request.env, detached: grouped, stdio: ['pipe', 'pipe', 'pipe'] });
+const stdout = [], stderr = [];
+let size = 0, failure, finished = false;
+const cancel = () => { if (child.pid === undefined)
+    return; try {
+    if (grouped)
+        process.kill(-child.pid, 'SIGKILL');
+    else
+        child.kill('SIGKILL');
+}
+catch { } };
+const refuse = (why) => { failure ?? (failure = why); cancel(); };
+const receive = (chunks, bytes) => { size += bytes.length; if (size > request.limits.responseBytes) {
+    refuse('response exceeds declared byte bound');
+    return;
+} chunks.push(bytes); };
+child.stdout.on('data', (bytes) => receive(stdout, bytes));
+child.stderr.on('data', (bytes) => receive(stderr, bytes));
+child.stdin.on('error', error => { if (!finished)
+    refuse(`input failed: ${error.message}`); });
+const timer = setTimeout(() => refuse('declared timeout exhausted'), request.limits.timeoutMs);
+const finish = (status, signal) => {
+    if (finished)
+        return;
+    finished = true;
+    clearTimeout(timer);
+    cancel();
+    const result = { stdout: failure ? '' : Buffer.concat(stdout).toString('utf8'), stdoutBytes: failure ? '' : Buffer.concat(stdout).toString('base64'), stderr: failure ? '' : Buffer.concat(stderr).toString('utf8'), status, signal, ...(failure ? { failure } : {}) };
+    process.stdout.write(JSON.stringify(result));
+};
+child.on('error', error => { failure = error.message; finish(null, null); });
+child.on('close', finish);
+child.stdin.end(request.input);

package/dist/host/objects.js

@@ -10,7 +10,7 @@ export async function admittedObjects(root, lines, emit = () => { }) {
     if (history.kind !== 'fact')
         throw Error(`REFUSE·wire ${history.why}`);
     const authority = authorityFor(lines, rootSigner(root), signaturesOf(storeOf(root)).admitted);
-    const context = await objectProvider(history.value.objects, history.value.configuration, { admit: fields => authority.of(canonical(fields)).kind === 'admitted', emit, topos: toposAt, module: contextModuleAt });
+    const context = await objectProvider(history.value.objects, history.value.configuration, { admit: fields => authority.of(canonical(fields)).kind === 'admitted', emit, topos: digest => toposAt(digest, storeOf(root)), module: digest => contextModuleAt(digest, storeOf(root)) });
     const checked = validateObjectContext(history.value.objects, context);
     if (checked.kind !== 'fact')
         throw Error(`REFUSE·context ${checked.why}`);

package/dist/host/ports/transport.d.ts

@@ -0,0 +1 @@
+export declare function transportBytes(location: string, digest: string, lines: readonly string[]): Promise<Uint8Array>;

package/dist/host/ports/transport.js

@@ -0,0 +1,48 @@
+import { readFileSync } from 'node:fs';
+import { contentRequest, transportSelection, parse } from '@lapxo/topos/wire';
+import { boundedProcess } from "../process-lifetime.js";
+import { fetchBytes } from "../adapters/transport/http.js";
+export async function transportBytes(location, digest, lines) {
+    const scheme = new URL(location).protocol.slice(0, -1);
+    const fields = lines.flatMap(line => { const p = parse(line); return p.kind === 'fact' ? [p.value.fields] : []; });
+    const selected = transportSelection(fields, scheme);
+    if (selected === undefined)
+        throw Error(`REFUSE·transport ${scheme} no admitted content-request/1 policy`);
+    if (selected.name === 'fetch') {
+        if (!['http', 'https'].includes(scheme))
+            throw Error(`REFUSE·transport ${scheme} is not supported by this host adapter`);
+        return fetchBytes(location, selected);
+    }
+    const registryPath = process.env['BOUND_TRANSPORTS'];
+    if (!registryPath)
+        throw Error(`REFUSE·transport ${scheme} no host binding for ${selected.name}`);
+    let record;
+    try {
+        const registry = JSON.parse(readFileSync(registryPath, 'utf8'));
+        if (!registry || typeof registry !== 'object' || !Object.prototype.hasOwnProperty.call(registry, selected.name))
+            throw Error();
+        const value = registry[selected.name];
+        if (!value || typeof value !== 'object')
+            throw Error();
+        const f = value;
+        if (f.kind !== 'command' || typeof f.executable !== 'string' || !f.executable || !Array.isArray(f.args) || !f.args.every(x => typeof x === 'string'))
+            throw Error();
+        if (f.environment !== undefined && (!Array.isArray(f.environment) || !f.environment.every(x => typeof x === 'string')))
+            throw Error();
+        const names = (f.environment ?? []);
+        const env = {};
+        if (process.env.PATH !== undefined)
+            env.PATH = process.env.PATH;
+        for (const name of names)
+            if (process.env[name] !== undefined)
+                env[name] = process.env[name];
+        record = { executable: f.executable, args: f.args, env };
+    }
+    catch {
+        throw Error(`REFUSE·transport ${scheme} host binding unavailable or invalid`);
+    }
+    const result = boundedProcess(record.executable, record.args, contentRequest(location, digest, selected), selected, undefined, record.env);
+    if (result.status !== 0 || result.signal !== null)
+        throw Error(`REFUSE·transport ${scheme} failed · status ${result.status ?? result.signal}`);
+    return Buffer.from(result.stdoutBytes ?? '', 'base64');
+}

package/dist/host/process-lifetime.d.ts

@@ -0,0 +1,11 @@
+import type { ReaderLifetime } from '@lapxo/topos/wire';
+export interface ProcessResult {
+    readonly stdout: string;
+    readonly stdoutBytes?: string;
+    readonly stderr: string;
+    readonly status: number | null;
+    readonly signal: NodeJS.Signals | null;
+    readonly failure?: string;
+}
+/** A synchronous fold waits on a supervising host process; the supervisor owns cancellation of its child group. */
+export declare function boundedProcess(command: string, args: readonly string[], input: string, limits: ReaderLifetime, cwd?: string, env?: Readonly<Record<string, string>>): ProcessResult;

package/dist/host/process-lifetime.js

@@ -0,0 +1,12 @@
+import { spawnSync } from 'node:child_process';
+import { processOf } from "../observe/runner.js";
+/** A synchronous fold waits on a supervising host process; the supervisor owns cancellation of its child group. */
+export function boundedProcess(command, args, input, limits, cwd, env) {
+    const run = spawnSync(process.execPath, [processOf('lifetime', 'host')], { input: JSON.stringify({ command, args, input, limits, cwd, env }), encoding: 'utf8', maxBuffer: limits.responseBytes * 12 + 4096 });
+    if (run.error || run.status !== 0)
+        throw Error(`REFUSE·reader lifetime supervisor ${run.error?.message ?? run.status}`);
+    const result = JSON.parse(run.stdout);
+    if (result.failure)
+        throw Error(`REFUSE·reader ${result.failure} · status ${result.status ?? result.signal ?? 'cancelled'}`);
+    return result;
+}

package/dist/host/read-only.d.ts

@@ -0,0 +1,3 @@
+export declare const readOnly: () => boolean;
+export declare const withoutEffects: <T>(evaluate: () => T) => T;
+export declare function requireEffects(operation: string): void;

package/dist/host/read-only.js

@@ -0,0 +1,9 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+/** Prospective evaluation may read existing evidence and calculate values, but cannot acquire evidence or persist caches. */
+const mode = new AsyncLocalStorage();
+export const readOnly = () => mode.getStore() === true;
+export const withoutEffects = (evaluate) => mode.run(true, evaluate);
+export function requireEffects(operation) {
+    if (readOnly())
+        throw Error(`REFUSE·preview ${operation} requires an act; fold the declared inputs first`);
+}

package/dist/host/release.js

@@ -1,3 +1,4 @@
+import { ContentNeeded } from "./content-needed.js";
 import { createHash } from 'node:crypto';
 import { existsSync, lstatSync, mkdirSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join, sep } from 'node:path';
@@ -143,7 +144,7 @@ export function layReleases(store, own, lock, contentStore = own) {
         if (bytes !== undefined && current !== undefined && !dir && !sameSnapshot(snapshotOf(current), members(bytes).map((one) => [one.name, digestOf(one.bytes)])))
             throw new Error(`REFUSE·release snapshot for ${digest} omits or changes archive members; explicit rebuild required`);
         if (bytes === undefined && !dir && current === undefined)
-            throw new Error(`REFUSE·release ${fieldOf(line, 'scope')} has no available archive or snapshot`);
+            throw new ContentNeeded(digest, `REFUSE·release ${fieldOf(line, 'scope')} has no available archive or snapshot`);
         const root = fieldOf(line, 'shape');
         const place = join(own, archiveCoordinate(needs));
         const link = lstatSync(place, { throwIfNoEntry: false });

package/dist/host/selected-capsules.js

@@ -1,5 +1,7 @@
 import { capsuleAt } from "./capsule.js";
-import { capsuleOffers } from '@lapxo/topos/standing';
+import { capsuleOffers, providerInputs, providerInputRegions, capsuleDescriptor, assertCapsuleDescriptor } from '@lapxo/topos/standing';
+import { fullDigest } from "./digest.js";
+import { wireAt, parse } from '@lapxo/topos/wire';
 import { selectedTopoi, toposAt } from "./selected-topos.js";
 import { canonical } from '@lapxo/topos/wire';
 import { fieldOf } from "../fold/claims.js";
@@ -8,16 +10,40 @@ import { archiveCoordinate } from "./archive.js";
 /** Only explicit capsule offers request execution. Forms/classes/views do not need an executable alias. */
 export function selectedCapsules(pins, resolve = capsuleAt, select = toposAt, host = ownLock()) {
     return selectedTopoi(pins, select).flatMap(({ digest, topos }) => capsuleOffers(topos).map(offer => {
-        const projections = host.filter(line => fieldOf(line, 'scope').startsWith('dep/') && fieldOf(line, 'role') === 'writes' && fieldOf(line, 'value') === offer.value);
-        if (!projections.length || projections.some(line => !fieldOf(line, 'shape')))
-            throw Error(`REFUSE·pin ${digest} capsule ${offer.value} needs one host projection`);
-        const entries = [...new Set(projections.map(line => archiveCoordinate(fieldOf(line, 'shape'))))];
-        if (entries.length !== 1)
-            throw Error(`REFUSE·pin ${digest} capsule ${offer.value} has conflicting host projections`);
-        const projected = { ...offer, shape: entries[0] };
-        const capsule = resolve(offer.value, projected.shape);
-        if (capsule === undefined)
-            throw Error(`REFUSE·pin ${digest} · ${offer.scope} · offered capsule ${offer.value} unavailable`);
-        return { capsule, offer: canonical(projected) };
+        const load = () => {
+            const projections = host.filter(line => fieldOf(line, 'scope').startsWith('dep/') && fieldOf(line, 'role') === 'writes' && fieldOf(line, 'value') === offer.value);
+            if (!projections.length || projections.some(line => !fieldOf(line, 'shape')))
+                throw Error(`REFUSE·pin ${digest} capsule ${offer.value} needs one host projection`);
+            const entries = [...new Set(projections.map(line => archiveCoordinate(fieldOf(line, 'shape'))))];
+            if (entries.length !== 1)
+                throw Error(`REFUSE·pin ${digest} capsule ${offer.value} has conflicting host projections`);
+            const loaded = resolve(offer.value, entries[0]);
+            if (loaded === undefined)
+                throw Error(`REFUSE·pin ${digest} · ${offer.scope} · offered capsule ${offer.value} unavailable`);
+            return { capsule: loaded, offer: canonical({ ...offer, shape: entries[0] }) };
+        };
+        const descriptor = capsuleDescriptor(topos, offer.scope ?? '');
+        const loaded = descriptor === undefined ? load() : undefined;
+        const capsule = loaded?.capsule ?? {
+            digest: offer.value, selection: `${digest} ${offer.scope}`, ...descriptor, ask: requests => {
+                if (!requests.length)
+                    return [];
+                const actual = load();
+                assertCapsuleDescriptor(descriptor.lines, actual.capsule.lines);
+                return actual.capsule.ask(requests);
+            },
+        };
+        const projected = loaded?.offer ?? canonical(offer);
+        if (!providerInputRegions(topos, offer.scope ?? '').length)
+            return { capsule, offer: projected };
+        const fields = ownLock().flatMap(line => { const p = parse(line); return p.kind === 'fact' ? [p.value.fields] : []; });
+        const wire = wireAt(fields, Number.MAX_SAFE_INTEGER), algorithm = wire && [...wire.digests][0];
+        if (!algorithm)
+            throw Error('REFUSE·input instrument has no admitted digest algorithm');
+        const selected = { ...capsule, selection: `${digest} ${offer.scope}`, ask: requests => capsule.ask(requests.map(request => {
+                const provider = providerInputs(topos, digest, offer.scope ?? '', offer.value, request.region ?? '', bytes => fullDigest(bytes, algorithm));
+                return provider === undefined ? request : { ...request, provider };
+            })) };
+        return { capsule: selected, offer: projected };
     }));
 }

package/dist/host/selected-topos.d.ts

@@ -6,11 +6,11 @@ export interface SelectedTopos {
 }
 export type ToposResolver = (digest: string) => StandingTopos;
 /** Resolve content using the instrument wire's admitted digest algorithms. No transport interpretation. */
-export declare function toposAt(digest: string): StandingTopos;
-export declare function contentAt(digest: string): Uint8Array;
-/** A declared JS context offer uses this host adapter only after selection; execution is not selection. */
-export declare function contextModuleAt(digest: string): string;
-/** Selection verifies the standing and its directly declared closure. It does not request any capability. */
+export declare function toposAt(digest: string, store?: string): StandingTopos;
+export declare function contentAt(digest: string, store?: string): Uint8Array;
+/** The declared module runs from the store that supplied its verified bytes. No copy or live-checkout fallback. */
+export declare function contextModuleAt(digest: string, store?: string): string;
+/** Selection verifies standing identity. Requested capabilities verify their artifact bytes separately. */
 export declare function selectedTopoi(pins: readonly string[], resolve?: ToposResolver): readonly SelectedTopos[];
 /** Read a declared wire list without copying a world's claims or executing its offers.
  * Independent declarations must agree; selection order cannot choose a contract.

package/dist/host/selected-topos.js

@@ -1,47 +1,20 @@
-import { createHash } from 'node:crypto';
+import { verifiedContent } from "./content-store.js";
 import { readStanding } from '@lapxo/topos/standing';
 import { parse, wireAt } from '@lapxo/topos/wire';
 import { fieldOf } from "../fold/claims.js";
-import { blobAt } from "../land/ledger.js";
-import { observeFile } from "../observe/files.js";
-import { ownStore, ownLock } from "../observe/runner.js";
-import { replaceWhole } from "../land/ledger.js";
-import { join } from 'node:path';
 /** Resolve content using the instrument wire's admitted digest algorithms. No transport interpretation. */
-export function toposAt(digest) {
-    const topos = readStanding(Buffer.from(contentAt(digest)).toString('utf8'));
-    for (const dependency of topos.dependencies)
-        contentAt(dependency);
+export function toposAt(digest, store) {
+    const topos = readStanding(Buffer.from(contentAt(digest, store)).toString('utf8'));
     return topos;
 }
-export function contentAt(digest) {
-    const fields = ownLock().flatMap(line => { const got = parse(line); return got.kind === 'fact' ? [got.value.fields] : []; });
-    const wire = wireAt(fields, Number.MAX_SAFE_INTEGER);
-    if (wire === null)
-        throw Error('REFUSE·pin instrument has no admitted wire');
-    const algorithms = wire.digests;
-    const bytesAt = (name) => {
-        const split = name.indexOf(':');
-        const algorithm = name.slice(0, split), hex = name.slice(split + 1);
-        if (split < 1 || !algorithms.has(algorithm) || !/^[a-f0-9]+$/.test(hex))
-            throw Error(`REFUSE·pin ${name} digest is not admitted`);
-        const bytes = observeFile(blobAt(ownStore(), name));
-        if (bytes === undefined)
-            throw Error(`REFUSE·pin ${name} content unavailable · not laid`);
-        if (createHash(algorithm).update(bytes).digest('hex') !== hex)
-            throw Error(`REFUSE·pin ${name} content hash mismatch · not laid`);
-        return bytes;
-    };
-    return bytesAt(digest);
+export function contentAt(digest, store) {
+    return verifiedContent(digest, store).bytes;
 }
-/** A declared JS context offer uses this host adapter only after selection; execution is not selection. */
-export function contextModuleAt(digest) {
-    const bytes = contentAt(digest);
-    const at = join(ownStore(), 'cas', 'runtime', digest.replace(':', '_') + '.mjs');
-    replaceWhole(at, bytes);
-    return at;
+/** The declared module runs from the store that supplied its verified bytes. No copy or live-checkout fallback. */
+export function contextModuleAt(digest, store) {
+    return verifiedContent(digest, store).path;
 }
-/** Selection verifies the standing and its directly declared closure. It does not request any capability. */
+/** Selection verifies standing identity. Requested capabilities verify their artifact bytes separately. */
 export function selectedTopoi(pins, resolve = toposAt) {
     return [...new Set(pins.map(pin => fieldOf(pin, 'value')))].map(digest => ({ digest, topos: resolve(digest) }));
 }