@lapxo/bound 0.1.3 → 0.1.5

package/dist/host/capsule-process.d.ts

@@ -1,3 +1,4 @@
+import type { ReaderLifetime } from '@lapxo/topos/wire';
 import type { SpawnSyncOptionsWithStringEncoding } from 'node:child_process';
 import type { Request, Response } from '@lapxo/topos/contract';
 /** Operational process failure, distinct from a valid contract refusal or abstention. */
@@ -17,4 +18,4 @@ export declare class CapsuleProcessError extends Error {
 }
 export declare function validResponse(value: unknown, request: Request): value is Response;
 /** Last-line JSON is the wire framing. No partial batch, failed exit or synthetic missing response is accepted. */
-export declare function executeCapsule(command: string, args: readonly string[], requests: readonly Request[], limits?: Pick<SpawnSyncOptionsWithStringEncoding, 'timeout' | 'maxBuffer'>): readonly Response[];
+export declare function executeCapsule(command: string, args: readonly string[], requests: readonly Request[], limits?: Pick<SpawnSyncOptionsWithStringEncoding, 'timeout' | 'maxBuffer'>, lifetime?: ReaderLifetime): readonly Response[];

package/dist/host/capsule-process.js

@@ -1,3 +1,5 @@
+import { actCosts } from "./act-cost.js";
+import { boundedProcess } from "./process-lifetime.js";
 import { spawnSync } from 'node:child_process';
 import { PROTOCOL } from '@lapxo/topos/wire';
 /** Operational process failure, distinct from a valid contract refusal or abstention. */
@@ -31,24 +33,26 @@ export function validResponse(value, request) {
     return true;
 }
 /** Last-line JSON is the wire framing. No partial batch, failed exit or synthetic missing response is accepted. */
-export function executeCapsule(command, args, requests, limits = {}) {
-    const run = spawnSync(command, args, { input: JSON.stringify(requests), encoding: 'utf8', maxBuffer: 1 << 26, ...limits });
-    if (run.error)
-        throw new CapsuleProcessError(`failed: ${run.error.message}`, run);
-    if (run.signal !== null || run.status !== 0)
-        throw new CapsuleProcessError(`exited ${run.status ?? `with signal ${run.signal}`}`, run);
-    const last = /(?:^|\n)([^\n]*)$/.exec(run.stdout.trimEnd())?.[1] ?? '';
-    let values;
-    try {
-        values = JSON.parse(last);
-    }
-    catch (error) {
-        throw new CapsuleProcessError('returned malformed or absent JSON', { ...run, error });
-    }
-    if (!Array.isArray(values) || values.length !== requests.length || !values.every((value, i) => validResponse(value, requests[i]))) {
-        throw new CapsuleProcessError(`returned an invalid batch; expected ${requests.length} responses`, run);
-    }
-    if (run.stderr)
-        process.stderr.write(run.stderr);
-    return values;
+export function executeCapsule(command, args, requests, limits = {}, lifetime) {
+    return actCosts.measure(() => {
+        const run = lifetime === undefined ? spawnSync(command, args, { input: JSON.stringify(requests), encoding: 'utf8', maxBuffer: 1 << 26, ...limits }) : boundedProcess(command, args, JSON.stringify(requests), lifetime);
+        if ('error' in run && run.error)
+            throw new CapsuleProcessError(`failed: ${run.error.message}`, run);
+        if (run.signal !== null || run.status !== 0)
+            throw new CapsuleProcessError(`exited ${run.status ?? `with signal ${run.signal}`}`, run);
+        const last = /(?:^|\n)([^\n]*)$/.exec(run.stdout.trimEnd())?.[1] ?? '';
+        let values;
+        try {
+            values = JSON.parse(last);
+        }
+        catch (error) {
+            throw new CapsuleProcessError('returned malformed or absent JSON', { ...run, error });
+        }
+        if (!Array.isArray(values) || values.length !== requests.length || !values.every((value, i) => validResponse(value, requests[i]))) {
+            throw new CapsuleProcessError(`returned an invalid batch; expected ${requests.length} responses`, run);
+        }
+        if (run.stderr)
+            process.stderr.write(run.stderr);
+        return values;
+    });
 }

package/dist/host/capsule.d.ts

@@ -1,6 +1,7 @@
 import type { Declaration } from '@lapxo/topos/capsule';
 import type { Request, Response } from '@lapxo/topos/contract';
 export interface Capsule {
+    readonly selection?: string;
     readonly digest: string;
     readonly declaration: Declaration;
     readonly lines: readonly string[];

package/dist/host/capsule.js

@@ -1,4 +1,5 @@
-import { ContentNeeded } from "./content-needed.js";
+import { readerLifetime, parse } from '@lapxo/topos/wire';
+import { contentStore, verifiedContent, contentPolicy } from "./content-store.js";
 import { readOnly } from "./read-only.js";
 import { sha } from "./hash.js";
 import { wireLinesOf as linesOf } from "../fold/claims.js";
@@ -10,7 +11,7 @@ import { CAPSULE } from '@lapxo/topos/wire';
 import { declarationOf } from '@lapxo/topos/capsule';
 import { unpack } from "./archive.js";
 import { executeCapsule, validResponse } from "./capsule-process.js";
-import { blobAt, holdStore, replaceWhole, storeAt } from "../land/ledger.js";
+import { holdStore, replaceWhole, storeAt } from "../land/ledger.js";
 import { coordinatesUnder, observeFile, observeText } from "../observe/files.js";
 import { hostOf } from "../observe/run.js";
 import { ownLock, ownRoot, ownStore, processOf } from "../observe/runner.js";
@@ -37,22 +38,19 @@ function unpacked(digest, bytes) {
 }
 /**
  * A capsule is the bytes a digest names in the instrument's own store, and only when they hash to it: its own lock is
- * read from them, and the coordinate a lock names runs as a process of its own, like a reader. Each answer is kept in one
- * slot of the capsule, the place and the region; the body of the request is the hit, so a file that moved misses and
- * overwrites the slot, and a request asked again for the same bytes is read back and never run twice. Operational failures never enter the cache; refusals and abstentions are asked again.
+ * read from them, and the coordinate a lock names runs as a process of its own, like a reader. Each answer is kept by the
+ * digest of its complete declared request and implementation; distinct views retain distinct answers, and the same
+ * request reads its verified answer without running again. Operational failures never enter the cache; refusals and abstentions are asked again.
  */
 const capsules = new Map();
 /** A blob is loaded once in an act. A later ask for the same digest reads that capsule, and does not hash or unpack it again. */
 export function capsuleAt(digest, entry, store) {
-    const identity = `${store ?? ownStore()}\0${digest}\0${entry}`;
+    const cacheStore = store ?? contentStore();
+    const { bytes } = verifiedContent(digest, cacheStore);
+    const identity = `${cacheStore}\0${digest}\0${entry}`;
     const held = capsules.get(identity);
     if (held !== undefined)
         return held;
-    const bytes = observeFile(blobAt(store ?? ownStore(), digest));
-    if (bytes === undefined)
-        throw new ContentNeeded(digest, `REFUSE·pin ${digest} offered capsule unavailable · not laid`);
-    if (`sha256:${createHash('sha256').update(bytes).digest('hex')}` !== digest)
-        throw Error(`REFUSE·pin ${digest} content hash mismatch · not laid`);
     const known = declared.get(digest) ?? ((lines) => ({ lines, declaration: declarationOf(lines) }))(linesOf(observeText(join(unpacked(digest, bytes), CAPSULE))));
     declared.set(digest, known);
     const names = Object.keys(known.declaration.regions);
@@ -65,7 +63,7 @@ export function capsuleAt(digest, entry, store) {
     const capsule = { digest, ...known, ask: (requests) => {
             if (!statSync(module, { throwIfNoEntry: false })?.isFile())
                 throw new Error(`REFUSE·capsule ${digest} declared entry ${entry} unavailable`);
-            return answered(digest, bytes, requests, names, root, store ?? ownStore(), module);
+            return answered(digest, bytes, requests, names, root, cacheStore, module);
         } };
     capsules.set(identity, capsule);
     return capsule;
@@ -95,10 +93,9 @@ function answered(digest, bytes, requests, names, tree, cacheStore = ownStore(),
         return requests.map(() => undefined);
     }
     const loader = entry !== undefined ? `${createHash('sha256').update(`${relative(tree, entry)}\n`).digest('hex')}\n` : child.length > 1 ? `${createHash('sha256').update(observeFile(child[0]) ?? new Uint8Array()).digest('hex')}\n` : '';
-    const slotOf = (request) => sha(`${digest}\n${loader}${request.verb}\n${request.rootScope}\n${request.region ?? ''}`);
     const hitOf = (request) => sha(`${digest}\n${loader}${JSON.stringify(request)}`);
-    const kept = requests.map((request) => storeAt(cacheStore, 'cas', 'answers', slotOf(request)));
     const hits = requests.map(hitOf);
+    const kept = hits.map(hit => storeAt(cacheStore, 'cas', 'answers', hit));
     const held = kept.map((at, i) => {
         const text = observeText(at);
         if (text === undefined)
@@ -117,7 +114,7 @@ function answered(digest, bytes, requests, names, tree, cacheStore = ownStore(),
     if (missing.length)
         process.stderr.write(`CAPSULE  ${digest.slice(7, 19)} · ${requests.length} asked · ${missing.length} run · ${missing.map((one) => `${one.rootScope}${one.region}`).join(' ')}\n`);
     // Execute and validate the entire batch before committing any answer to the cache.
-    const ran = !missing.length ? [] : executeCapsule(process.execPath, [...childFlags(), hostOf(), ...child], missing);
+    const ran = !missing.length ? [] : executeCapsule(process.execPath, [...childFlags(), hostOf(), ...child], missing, {}, readerLifetime(contentPolicy().flatMap(line => { const p = parse(line); return p.kind === 'fact' ? [p.value.fields] : []; }), digest));
     return requests.map((request, i) => {
         if (held[i] !== undefined)
             return held[i];
@@ -125,7 +122,7 @@ function answered(digest, bytes, requests, names, tree, cacheStore = ownStore(),
         if (said?.kind === 'fact') {
             const text = JSON.stringify({ format: 'capsule-answer/2', hit: hits[i], said });
             replaceWhole(kept[i], text);
-            holdStore(cacheStore, 'answers', slotOf(request), Buffer.byteLength(text));
+            holdStore(cacheStore, 'answers', hits[i], Buffer.byteLength(text));
         }
         return said;
     });

package/dist/host/cell-receipts.js

@@ -43,7 +43,7 @@ export async function cellsWithReceipts(root, history, emit) {
     for (const record of parsed.value.objects.filter(r => r.record === 'cell')) {
         const pin = record.fields.topos;
         if (!pins.has(pin)) {
-            const top = toposAt(pin);
+            const top = toposAt(pin, store);
             pins.set(pin, [pin, ...top.dependencies]);
         }
         const scope = `receipts/cells/${record.fields.scope}`;

package/dist/host/content-store.d.ts

@@ -0,0 +1,8 @@
+export declare const withContentStore: <T>(store: string, run: () => T, policy?: () => readonly string[]) => T;
+export declare const contentPolicy: () => readonly string[];
+export declare const contentStore: () => string;
+/** Only immutable verified bytes may be shared with the instrument. Local corruption is never hidden by fallback. */
+export declare function verifiedContent(digest: string, store?: string, instrument?: string): {
+    readonly bytes: Uint8Array;
+    readonly path: string;
+};

package/dist/host/content-store.js

@@ -0,0 +1,31 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { createHash } from 'node:crypto';
+import { blobAt } from "../land/ledger.js";
+import { observeFile } from "../observe/files.js";
+import { ownLock, ownStore } from "../observe/runner.js";
+import { parse, wireAt } from '@lapxo/topos/wire';
+import { ContentNeeded } from "./content-needed.js";
+// Each invocation carries its place explicitly; asynchronous requests cannot share a mutable current root.
+const requested = new AsyncLocalStorage();
+export const withContentStore = (store, run, policy = () => []) => requested.run({ store, policy }, run);
+export const contentPolicy = () => requested.getStore()?.policy() ?? [];
+export const contentStore = () => requested.getStore()?.store ?? ownStore();
+/** Only immutable verified bytes may be shared with the instrument. Local corruption is never hidden by fallback. */
+export function verifiedContent(digest, store = contentStore(), instrument = ownStore()) {
+    const fields = ownLock().flatMap(line => { const p = parse(line); return p.kind === 'fact' ? [p.value.fields] : []; });
+    const wire = wireAt(fields, Number.MAX_SAFE_INTEGER);
+    if (!wire)
+        throw Error('REFUSE·pin instrument has no admitted wire');
+    const split = digest.indexOf(':'), algorithm = digest.slice(0, split), hex = digest.slice(split + 1);
+    if (split < 1 || !wire.digests.has(algorithm) || !/^[a-f0-9]+$/.test(hex))
+        throw Error(`REFUSE·pin ${digest} digest is not admitted`);
+    for (const at of new Set([store, instrument])) {
+        const path = blobAt(at, digest), bytes = observeFile(path);
+        if (bytes === undefined)
+            continue;
+        if (createHash(algorithm).update(bytes).digest('hex') !== hex)
+            throw Error(`REFUSE·pin ${digest} content hash mismatch · store ${at} · not laid`);
+        return { bytes, path };
+    }
+    throw new ContentNeeded(digest);
+}

package/dist/host/lifetime.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/host/lifetime.js

@@ -0,0 +1,40 @@
+import { spawn } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+// This is a host mechanism, not a wire reader or a provider. The parent supplies its already selected policy.
+const request = JSON.parse(readFileSync(0, 'utf8'));
+if (!Number.isSafeInteger(request.limits.timeoutMs) || request.limits.timeoutMs <= 0 || !Number.isSafeInteger(request.limits.responseBytes) || request.limits.responseBytes <= 0)
+    throw Error('REFUSE·reader invalid process limits');
+const grouped = process.platform !== 'win32';
+const child = spawn(request.command, [...request.args], { cwd: request.cwd, env: request.env, detached: grouped, stdio: ['pipe', 'pipe', 'pipe'] });
+const stdout = [], stderr = [];
+let size = 0, failure, finished = false;
+const cancel = () => { if (child.pid === undefined)
+    return; try {
+    if (grouped)
+        process.kill(-child.pid, 'SIGKILL');
+    else
+        child.kill('SIGKILL');
+}
+catch { } };
+const refuse = (why) => { failure ?? (failure = why); cancel(); };
+const receive = (chunks, bytes) => { size += bytes.length; if (size > request.limits.responseBytes) {
+    refuse('response exceeds declared byte bound');
+    return;
+} chunks.push(bytes); };
+child.stdout.on('data', (bytes) => receive(stdout, bytes));
+child.stderr.on('data', (bytes) => receive(stderr, bytes));
+child.stdin.on('error', error => { if (!finished)
+    refuse(`input failed: ${error.message}`); });
+const timer = setTimeout(() => refuse('declared timeout exhausted'), request.limits.timeoutMs);
+const finish = (status, signal) => {
+    if (finished)
+        return;
+    finished = true;
+    clearTimeout(timer);
+    cancel();
+    const result = { stdout: failure ? '' : Buffer.concat(stdout).toString('utf8'), stdoutBytes: failure ? '' : Buffer.concat(stdout).toString('base64'), stderr: failure ? '' : Buffer.concat(stderr).toString('utf8'), status, signal, ...(failure ? { failure } : {}) };
+    process.stdout.write(JSON.stringify(result));
+};
+child.on('error', error => { failure = error.message; finish(null, null); });
+child.on('close', finish);
+child.stdin.end(request.input);

package/dist/host/objects.js

@@ -10,7 +10,7 @@ export async function admittedObjects(root, lines, emit = () => { }) {
     if (history.kind !== 'fact')
         throw Error(`REFUSE·wire ${history.why}`);
     const authority = authorityFor(lines, rootSigner(root), signaturesOf(storeOf(root)).admitted);
-    const context = await objectProvider(history.value.objects, history.value.configuration, { admit: fields => authority.of(canonical(fields)).kind === 'admitted', emit, topos: toposAt, module: contextModuleAt });
+    const context = await objectProvider(history.value.objects, history.value.configuration, { admit: fields => authority.of(canonical(fields)).kind === 'admitted', emit, topos: digest => toposAt(digest, storeOf(root)), module: digest => contextModuleAt(digest, storeOf(root)) });
     const checked = validateObjectContext(history.value.objects, context);
     if (checked.kind !== 'fact')
         throw Error(`REFUSE·context ${checked.why}`);

package/dist/host/ports/ingress.d.ts

@@ -0,0 +1,24 @@
+/** Prepared by the admitted Topos contract and receiver signer. The host does not infer origins, coverage or epochs. */
+export interface IngressBundle {
+    readonly evidence: string;
+    readonly receipt: string;
+}
+export interface IngressResult extends IngressBundle {
+    readonly kind: 'landed' | 'once';
+    readonly evidenceBytes: number;
+    readonly receiptBytes: number;
+}
+export interface IngressStorage {
+    publish(staged: string, committed: string): void;
+}
+/** Directory publication makes the pair visible together; there is no later ledger append that can expose half. */
+export declare const nativeIngressStorage: IngressStorage;
+/** Native signed receipt lines only. Foreign bytes are never added to the local ledger or epoch allocator. */
+export declare function ingressReceipts(store: string): readonly string[];
+/** Private staging directories are invisible to readers and may be discarded after host recovery. */
+export declare function ingressEvidence(store: string, identity: string): IngressBundle | undefined;
+export declare function ingressBundles(store: string): readonly IngressBundle[];
+/** Verification and signing complete before staging. Replay performs no signer invocation or persistent write. */
+export declare function commitIngress(store: string, identity: string, prepare: (localImportReceipts: readonly string[]) => Promise<IngressBundle>, verify: (bundle: IngressBundle) => boolean, storage?: IngressStorage): Promise<IngressResult>;
+/** Costs distinguish delivered bytes from newly committed bytes; no count is called information or freedom. */
+export declare function ingressCost(result: IngressResult, deliveredBytes: number, protocolBytes: number): string;

package/dist/host/ports/ingress.js

@@ -0,0 +1,81 @@
+import { randomUUID } from 'node:crypto';
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { requireEffects } from "../read-only.js";
+import { underTheLock } from "../../land/act.js";
+const syncDirectory = (path) => { const fd = openSync(path, 'r'); try {
+    fsyncSync(fd);
+}
+finally {
+    closeSync(fd);
+} };
+const durableFile = (path, text) => { const fd = openSync(path, 'wx', 0o600); try {
+    writeFileSync(fd, text);
+    fsyncSync(fd);
+}
+finally {
+    closeSync(fd);
+} };
+/** Directory publication makes the pair visible together; there is no later ledger append that can expose half. */
+export const nativeIngressStorage = { publish(staged, committed) { renameSync(staged, committed); syncDirectory(join(committed, '..')); } };
+const directory = (store) => join(store, 'ingress');
+const nameOf = (identity) => {
+    if (!identity || identity.includes('\0'))
+        throw Error('REFUSE·ingress missing import identity');
+    return 'committed-' + encodeURIComponent(identity);
+};
+const read = (at) => ({ evidence: readFileSync(join(at, 'evidence.bound'), 'utf8'), receipt: readFileSync(join(at, 'receipt.bound'), 'utf8') });
+const measured = (kind, bundle) => ({ kind, ...bundle, evidenceBytes: Buffer.byteLength(bundle.evidence), receiptBytes: Buffer.byteLength(bundle.receipt) });
+/** Native signed receipt lines only. Foreign bytes are never added to the local ledger or epoch allocator. */
+export function ingressReceipts(store) {
+    const root = directory(store);
+    if (!existsSync(root))
+        return [];
+    return readdirSync(root).filter(name => name.startsWith('committed-')).sort().flatMap(name => read(join(root, name)).receipt.split('\n').filter(Boolean));
+}
+/** Private staging directories are invisible to readers and may be discarded after host recovery. */
+export function ingressEvidence(store, identity) {
+    const at = join(directory(store), nameOf(identity));
+    return existsSync(at) ? read(at) : undefined;
+}
+export function ingressBundles(store) {
+    const root = directory(store);
+    if (!existsSync(root))
+        return [];
+    return readdirSync(root).filter(name => name.startsWith('committed-')).sort().map(name => read(join(root, name)));
+}
+/** Verification and signing complete before staging. Replay performs no signer invocation or persistent write. */
+export async function commitIngress(store, identity, prepare, verify, storage = nativeIngressStorage) {
+    requireEffects('foreign evidence ingress');
+    return underTheLock(store, 'ingress', async () => {
+        const root = directory(store), at = join(root, nameOf(identity));
+        if (existsSync(at)) {
+            const prior = read(at);
+            if (verify(prior) !== true)
+                throw Error('REFUSE·ingress committed bytes do not verify');
+            return measured('once', prior);
+        }
+        const bundle = await prepare(ingressReceipts(store));
+        if (!bundle.evidence || !bundle.receipt || verify(bundle) !== true)
+            throw Error('REFUSE·ingress evidence and receipt do not verify');
+        mkdirSync(root, { recursive: true });
+        const staged = join(root, '.stage-' + randomUUID());
+        mkdirSync(staged, { mode: 0o700 });
+        try {
+            durableFile(join(staged, 'evidence.bound'), bundle.evidence);
+            durableFile(join(staged, 'receipt.bound'), bundle.receipt);
+            syncDirectory(staged);
+            storage.publish(staged, at);
+        }
+        finally {
+            rmSync(staged, { recursive: true, force: true });
+        }
+        return measured('landed', bundle);
+    });
+}
+/** Costs distinguish delivered bytes from newly committed bytes; no count is called information or freedom. */
+export function ingressCost(result, deliveredBytes, protocolBytes) {
+    if (!Number.isSafeInteger(deliveredBytes) || deliveredBytes < 0 || !Number.isSafeInteger(protocolBytes) || protocolBytes < 0)
+        throw Error('REFUSE·ingress invalid exchange byte measurement');
+    return `EXCHANGE ${deliveredBytes} payload bytes · ${protocolBytes} protocol bytes · ${result.kind === 'once' ? 0 : result.evidenceBytes} new evidence bytes · ${result.kind === 'once' ? 0 : result.receiptBytes} new receipt bytes`;
+}

package/dist/host/ports/transport.d.ts

@@ -0,0 +1 @@
+export declare function transportBytes(location: string, digest: string, lines: readonly string[]): Promise<Uint8Array>;

package/dist/host/ports/transport.js

@@ -0,0 +1,48 @@
+import { readFileSync } from 'node:fs';
+import { contentRequest, transportSelection, parse } from '@lapxo/topos/wire';
+import { boundedProcess } from "../process-lifetime.js";
+import { fetchBytes } from "../adapters/transport/http.js";
+export async function transportBytes(location, digest, lines) {
+    const scheme = new URL(location).protocol.slice(0, -1);
+    const fields = lines.flatMap(line => { const p = parse(line); return p.kind === 'fact' ? [p.value.fields] : []; });
+    const selected = transportSelection(fields, scheme);
+    if (selected === undefined)
+        throw Error(`REFUSE·transport ${scheme} no admitted content-request/1 policy`);
+    if (selected.name === 'fetch') {
+        if (!['http', 'https'].includes(scheme))
+            throw Error(`REFUSE·transport ${scheme} is not supported by this host adapter`);
+        return fetchBytes(location, selected);
+    }
+    const registryPath = process.env['BOUND_TRANSPORTS'];
+    if (!registryPath)
+        throw Error(`REFUSE·transport ${scheme} no host binding for ${selected.name}`);
+    let record;
+    try {
+        const registry = JSON.parse(readFileSync(registryPath, 'utf8'));
+        if (!registry || typeof registry !== 'object' || !Object.prototype.hasOwnProperty.call(registry, selected.name))
+            throw Error();
+        const value = registry[selected.name];
+        if (!value || typeof value !== 'object')
+            throw Error();
+        const f = value;
+        if (f.kind !== 'command' || typeof f.executable !== 'string' || !f.executable || !Array.isArray(f.args) || !f.args.every(x => typeof x === 'string'))
+            throw Error();
+        if (f.environment !== undefined && (!Array.isArray(f.environment) || !f.environment.every(x => typeof x === 'string')))
+            throw Error();
+        const names = (f.environment ?? []);
+        const env = {};
+        if (process.env.PATH !== undefined)
+            env.PATH = process.env.PATH;
+        for (const name of names)
+            if (process.env[name] !== undefined)
+                env[name] = process.env[name];
+        record = { executable: f.executable, args: f.args, env };
+    }
+    catch {
+        throw Error(`REFUSE·transport ${scheme} host binding unavailable or invalid`);
+    }
+    const result = boundedProcess(record.executable, record.args, contentRequest(location, digest, selected), selected, undefined, record.env);
+    if (result.status !== 0 || result.signal !== null)
+        throw Error(`REFUSE·transport ${scheme} failed · status ${result.status ?? result.signal}`);
+    return Buffer.from(result.stdoutBytes ?? '', 'base64');
+}

package/dist/host/process-lifetime.d.ts

@@ -0,0 +1,11 @@
+import type { ReaderLifetime } from '@lapxo/topos/wire';
+export interface ProcessResult {
+    readonly stdout: string;
+    readonly stdoutBytes?: string;
+    readonly stderr: string;
+    readonly status: number | null;
+    readonly signal: NodeJS.Signals | null;
+    readonly failure?: string;
+}
+/** A synchronous fold waits on a supervising host process; the supervisor owns cancellation of its child group. */
+export declare function boundedProcess(command: string, args: readonly string[], input: string, limits: ReaderLifetime, cwd?: string, env?: Readonly<Record<string, string>>): ProcessResult;

package/dist/host/process-lifetime.js

@@ -0,0 +1,12 @@
+import { spawnSync } from 'node:child_process';
+import { processOf } from "../observe/runner.js";
+/** A synchronous fold waits on a supervising host process; the supervisor owns cancellation of its child group. */
+export function boundedProcess(command, args, input, limits, cwd, env) {
+    const run = spawnSync(process.execPath, [processOf('lifetime', 'host')], { input: JSON.stringify({ command, args, input, limits, cwd, env }), encoding: 'utf8', maxBuffer: limits.responseBytes * 12 + 4096 });
+    if (run.error || run.status !== 0)
+        throw Error(`REFUSE·reader lifetime supervisor ${run.error?.message ?? run.status}`);
+    const result = JSON.parse(run.stdout);
+    if (result.failure)
+        throw Error(`REFUSE·reader ${result.failure} · status ${result.status ?? result.signal ?? 'cancelled'}`);
+    return result;
+}

package/dist/host/reading-closures.d.ts

@@ -0,0 +1,28 @@
+import type { Capsule } from './capsule.ts';
+type File = {
+    readonly place: string;
+    readonly text: string;
+};
+export declare const inputLines: (files: readonly File[]) => readonly string[];
+/** The selected world owns input projection and reading. The host only verifies closures and keeps native count/bytes receipts. */
+export declare function readingClosures(options: {
+    root: string;
+    store: string;
+    reader: string;
+    speaker: string;
+    digest: (text: string) => string;
+    capsule: Capsule;
+    region: string;
+    projection: string;
+    allowsEmpty?: boolean;
+    files: readonly File[];
+    emit?: (line: string) => void;
+}): {
+    lines: readonly string[];
+    read: number;
+    opened: number;
+    executed: number;
+};
+/** Verify the native reading carriers before a file seal may reuse them. These are semantic receipts, not file-region seals. */
+export declare function verifiedReadingReceipts(store: string, lines: readonly string[], digest: (text: string) => string): number | undefined;
+export {};