@aura3d/cli 2.0.2 → 2.0.4

package/dist/meshy/metadata.js

@@ -0,0 +1,176 @@
+import { createHash } from "node:crypto";
+import { readFileSync, statSync } from "node:fs";
+export const MAX_MESHY_METADATA_BYTES = 1024 * 1024;
+const SECRET_KEY = /(?:^|_)(?:api_?key|access_?token|refresh_?token|authorization|bearer|client_?secret|password|credentials?|cookie|private_?key|environment|env)(?:$|_)/i;
+const SIGNED_QUERY_KEY = /^(?:x-amz-|x-goog-|signature$|sig$|token$|expires$|credential$|policy$|key-pair-id$)/i;
+export function readMeshyMetadata(path) {
+    const size = statSync(path).size;
+    if (size > MAX_MESHY_METADATA_BYTES) {
+        throw new Error(`Meshy metadata exceeds ${MAX_MESHY_METADATA_BYTES} bytes: ${path}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        throw new Error(`Meshy metadata is not valid JSON: ${path}`);
+    }
+    const root = record(parsed, "Meshy metadata");
+    rejectCredentialFields(root, "metadata");
+    const task = optionalRecord(root.task, "metadata.task") ?? root;
+    const prompt = optionalString(first(task.prompt, root.prompt), "prompt");
+    const settingsValue = first(task.settings, task.parameters, root.settings, root.parameters);
+    const settings = settingsValue === undefined ? undefined : sanitizeRecord(record(settingsValue, "settings"), 0);
+    return compact({
+        providerCli: optionalString(first(root.providerCli, root.provider_cli, root.cliVersion, root.cli_version), "providerCli"),
+        taskId: optionalString(first(task.taskId, task.task_id, task.id, root.taskId, root.task_id), "taskId"),
+        parentTaskIds: stringList(first(task.parentTaskIds, task.parent_task_ids, task.parentTaskId, task.parent_task_id), "parentTaskIds"),
+        operation: optionalString(first(task.operation, task.type, root.operation, root.type), "operation"),
+        promptHash: prompt ? `sha256-${createHash("sha256").update(prompt).digest("hex")}` : undefined,
+        model: optionalString(first(task.model, task.modelVersion, task.model_version, root.model), "model"),
+        settings,
+        createdAt: isoString(first(task.createdAt, task.created_at, root.createdAt, root.created_at), "createdAt"),
+        finishedAt: isoString(first(task.finishedAt, task.finished_at, task.completedAt, task.completed_at, root.finishedAt, root.finished_at), "finishedAt"),
+        consumedCredits: nonNegativeNumber(first(task.consumedCredits, task.consumed_credits, task.credits, root.consumedCredits, root.consumed_credits), "consumedCredits")
+    });
+}
+export function validateMeshyEvidenceJson(path) {
+    const size = statSync(path).size;
+    if (size > MAX_MESHY_METADATA_BYTES)
+        throw new Error(`Meshy rights evidence exceeds ${MAX_MESHY_METADATA_BYTES} bytes: ${path}`);
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        throw new Error(`Meshy rights evidence is not valid JSON: ${path}`);
+    }
+    const value = record(parsed, "Meshy rights evidence");
+    if (Object.keys(value).length === 0)
+        throw new Error("Meshy rights evidence must be a non-empty JSON object.");
+    rejectCredentialFields(value, "rights evidence");
+    const licenseName = boundedRightsString(value.licenseName, "licenseName", 512);
+    const licenseUrl = rightsHttpsUrl(first(value.termsUrl, value.licenseUrl), "termsUrl/licenseUrl");
+    const licenseRaw = boundedRightsString(first(value.rightsBasis, value.licenseRaw), "rightsBasis/licenseRaw", 4096);
+    return compact({ licenseName, licenseUrl, licenseRaw });
+}
+export function stripSignedUrl(value) {
+    try {
+        const url = new URL(value);
+        if ([...url.searchParams.keys()].some((key) => SIGNED_QUERY_KEY.test(key)))
+            url.search = "";
+        return url.toString();
+    }
+    catch {
+        return value;
+    }
+}
+function rejectCredentialFields(value, path) {
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => rejectCredentialFields(item, `${path}[${index}]`));
+        return;
+    }
+    if (!value || typeof value !== "object")
+        return;
+    for (const [key, child] of Object.entries(value)) {
+        const normalized = key.replace(/([a-z])([A-Z])/g, "$1_$2").replace(/[- ]/g, "_");
+        if (SECRET_KEY.test(normalized))
+            throw new Error(`Meshy input contains forbidden credential field at ${path}.${key}.`);
+        rejectCredentialFields(child, `${path}.${key}`);
+    }
+}
+function sanitizeRecord(value, depth) {
+    if (depth > 4)
+        throw new Error("Meshy settings exceed the maximum nesting depth.");
+    if (Object.keys(value).length > 100)
+        throw new Error("Meshy settings contain too many fields.");
+    return Object.fromEntries(Object.entries(value).map(([key, child]) => [key, sanitizeValue(child, depth + 1)]));
+}
+function sanitizeValue(value, depth) {
+    if (value === null || typeof value === "boolean" || typeof value === "number")
+        return value;
+    if (typeof value === "string") {
+        if (value.length > 4096)
+            throw new Error("Meshy metadata contains an unexpectedly long string.");
+        return stripSignedUrl(value);
+    }
+    if (Array.isArray(value)) {
+        if (value.length > 100)
+            throw new Error("Meshy metadata contains an unexpectedly large array.");
+        return value.map((entry) => sanitizeValue(entry, depth));
+    }
+    return sanitizeRecord(record(value, "settings value"), depth);
+}
+function record(value, label) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error(`${label} must be a JSON object.`);
+    return value;
+}
+function optionalRecord(value, label) { return value === undefined ? undefined : record(value, label); }
+function first(...values) { return values.find((value) => value !== undefined && value !== null); }
+function optionalString(value, label) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "string" || value.trim() === "" || value.length > 4096)
+        throw new Error(`Meshy metadata field ${label} must be a non-empty bounded string.`);
+    return stripSignedUrl(value.trim());
+}
+function boundedRightsString(value, label, maximumLength) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value !== "string" || value.trim() === "" || value.length > maximumLength) {
+        throw new Error(`Meshy rights evidence field ${label} must be a non-empty string of at most ${maximumLength} characters.`);
+    }
+    return value.trim();
+}
+function rightsHttpsUrl(value, label) {
+    const text = boundedRightsString(value, label, 2048);
+    if (!text)
+        return undefined;
+    let url;
+    try {
+        url = new URL(text);
+    }
+    catch {
+        throw new Error(`Meshy rights evidence field ${label} must be an HTTPS URL.`);
+    }
+    if (url.protocol !== "https:" || url.username || url.password) {
+        throw new Error(`Meshy rights evidence field ${label} must be an HTTPS URL without embedded credentials.`);
+    }
+    return stripSignedUrl(url.toString());
+}
+function isoString(value, label) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value === "number") {
+        if (!Number.isFinite(value) || value < 0)
+            throw new Error(`Meshy metadata field ${label} must be an ISO-8601 timestamp or non-negative epoch milliseconds.`);
+        const timestamp = new Date(value);
+        if (Number.isNaN(timestamp.getTime()))
+            throw new Error(`Meshy metadata field ${label} must be an ISO-8601 timestamp or non-negative epoch milliseconds.`);
+        return timestamp.toISOString();
+    }
+    const text = optionalString(value, label);
+    if (!text)
+        return undefined;
+    if (Number.isNaN(Date.parse(text)))
+        throw new Error(`Meshy metadata field ${label} must be an ISO-8601 timestamp or non-negative epoch milliseconds.`);
+    return text;
+}
+function nonNegativeNumber(value, label) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "number" || !Number.isFinite(value) || value < 0)
+        throw new Error(`Meshy metadata field ${label} must be a non-negative number.`);
+    return value;
+}
+function stringList(value, label) {
+    if (value === undefined)
+        return undefined;
+    const values = Array.isArray(value) ? value : [value];
+    if (values.length > 100)
+        throw new Error(`Meshy metadata field ${label} contains too many values.`);
+    return values.map((entry) => optionalString(entry, label));
+}
+function compact(value) { return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined)); }
+//# sourceMappingURL=metadata.js.map

package/dist/meshy/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../../../../packages/aura3d-cli/src/meshy/metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEjD,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,GAAG,IAAI,CAAC;AACpD,MAAM,UAAU,GAAG,wJAAwJ,CAAC;AAC5K,MAAM,gBAAgB,GAAG,uFAAuF,CAAC;AAqBjH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IACjC,IAAI,IAAI,GAAG,wBAAwB,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,0BAA0B,wBAAwB,WAAW,IAAI,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C,sBAAsB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,IAAI,IAAI,CAAC;IAChE,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;IACzE,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5F,MAAM,QAAQ,GAAG,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,aAAa,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAChH,OAAO,OAAO,CAAC;QACb,WAAW,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC;QACzH,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC;QACtG,aAAa,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,eAAe,CAAC;QACnI,SAAS,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC;QACnG,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;QAC9F,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QACpG,QAAQ;QACR,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC;QAC1G,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC;QACrJ,eAAe,EAAE,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;KACrK,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IACjC,IAAI,IAAI,GAAG,wBAAwB;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,wBAAwB,WAAW,IAAI,EAAE,CAAC,CAAC;IACjI,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IACvI,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC/G,sBAAsB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,mBAAmB,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAClG,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,wBAAwB,EAAE,IAAI,CAAC,CAAC;IACnH,OAAO,OAAO,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAE,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;QAC5F,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC3B,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc,EAAE,IAAY;IAC1D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IACxH,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO;IAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACjF,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC;QACvH,sBAAsB,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAA8B,EAAE,KAAa;IACnE,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACnF,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAChG,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,aAAa,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjH,CAAC;AACD,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5F,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACjG,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAChG,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAC;AAChE,CAAC;AACD,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa;IAC3C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yBAAyB,CAAC,CAAC;IACpH,OAAO,KAAgC,CAAC;AAC1C,CAAC;AACD,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa,IAAyC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAC9J,SAAS,KAAK,CAAC,GAAG,MAAiB,IAAa,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC;AACvH,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,sCAAsC,CAAC,CAAC;IAClK,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AACtC,CAAC;AACD,SAAS,mBAAmB,CAAC,KAAc,EAAE,KAAa,EAAE,aAAqB;IAC/E,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,0CAA0C,aAAa,cAAc,CAAC,CAAC;IAC7H,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AACD,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,wBAAwB,CAAC,CAAC;IAAC,CAAC;IACrH,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,qDAAqD,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AACxC,CAAC;AACD,SAAS,SAAS,CAAC,KAAc,EAAE,KAAa;IAC9C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,oEAAoE,CAAC,CAAC;QAC7J,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,oEAAoE,CAAC,CAAC;QAC1J,OAAO,SAAS,CAAC,WAAW,EAAE,CAAC;IACjC,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAAC,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IACvE,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,oEAAoE,CAAC,CAAC;IACvJ,OAAO,IAAI,CAAC;AACd,CAAC;AACD,SAAS,iBAAiB,CAAC,KAAc,EAAE,KAAa;IACtD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,iCAAiC,CAAC,CAAC;IACvJ,OAAO,KAAK,CAAC;AACf,CAAC;AACD,SAAS,UAAU,CAAC,KAAc,EAAE,KAAa;IAC/C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,4BAA4B,CAAC,CAAC;IACpG,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAE,CAAC,CAAC;AAC9D,CAAC;AACD,SAAS,OAAO,CAAoC,KAAQ,IAAO,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAM,CAAC,CAAC,CAAC"}

package/dist/meshy/provenance.d.ts

@@ -0,0 +1,4 @@
+import type { AuraCliGeneratedAssetProvenance } from "../asset-core-types.js";
+import type { SanitizedMeshyMetadata } from "./metadata.js";
+export declare function createMeshyProvenance(projectDir: string, metadataPath: string, rightsPath: string, metadata: SanitizedMeshyMetadata): AuraCliGeneratedAssetProvenance;
+//# sourceMappingURL=provenance.d.ts.map

package/dist/meshy/provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../../../../../packages/aura3d-cli/src/meshy/provenance.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAE5D,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,GAAG,+BAA+B,CAgBrK"}

package/dist/meshy/provenance.js

@@ -0,0 +1,21 @@
+import { realpathSync } from "node:fs";
+import { relative } from "node:path";
+export function createMeshyProvenance(projectDir, metadataPath, rightsPath, metadata) {
+    return {
+        provider: "meshy",
+        providerCli: metadata.providerCli ?? "@meshy-ai/cli@0.2.0",
+        ...(metadata.taskId ? { taskId: metadata.taskId } : {}),
+        ...(metadata.parentTaskIds?.length ? { parentTaskIds: metadata.parentTaskIds } : {}),
+        ...(metadata.operation ? { operation: metadata.operation } : {}),
+        ...(metadata.promptHash ? { promptHash: metadata.promptHash } : {}),
+        ...(metadata.model ? { model: metadata.model } : {}),
+        ...(metadata.settings ? { settings: metadata.settings } : {}),
+        ...(metadata.createdAt ? { createdAt: metadata.createdAt } : {}),
+        ...(metadata.finishedAt ? { finishedAt: metadata.finishedAt } : {}),
+        ...(metadata.consumedCredits !== undefined ? { consumedCredits: metadata.consumedCredits } : {}),
+        localMetadata: normalized(relative(realpathSync(projectDir), metadataPath)),
+        rightsEvidence: normalized(relative(realpathSync(projectDir), rightsPath))
+    };
+}
+function normalized(path) { return path.replaceAll("\\", "/"); }
+//# sourceMappingURL=provenance.js.map

package/dist/meshy/provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../../../../../packages/aura3d-cli/src/meshy/provenance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAIrC,MAAM,UAAU,qBAAqB,CAAC,UAAkB,EAAE,YAAoB,EAAE,UAAkB,EAAE,QAAgC;IAClI,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,qBAAqB;QAC1D,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,QAAQ,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,aAAa,EAAE,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC;QAC3E,cAAc,EAAE,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;KAC3E,CAAC;AACJ,CAAC;AACD,SAAS,UAAU,CAAC,IAAY,IAAY,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC"}

package/dist/meshy/thumbnail.d.ts

@@ -0,0 +1,19 @@
+import type { AuraCliRenderedProbe } from "../asset-core-types.js";
+export declare const MAX_MESHY_THUMBNAIL_BYTES: number;
+export interface RetainedMeshyThumbnail {
+    readonly sourceFile: string;
+    readonly outputPath: string;
+    readonly url: string;
+    readonly sha256: string;
+    readonly renderedProbe: AuraCliRenderedProbe;
+}
+export declare function findMeshyThumbnail(inputDir: string, requested: string | undefined): string | undefined;
+export declare function retainMeshyThumbnail(options: {
+    readonly projectDir: string;
+    readonly inputDir: string;
+    readonly requested?: string;
+    readonly assetName: string;
+    readonly outputDir: string;
+    readonly publicPath: string;
+}): RetainedMeshyThumbnail | undefined;
+//# sourceMappingURL=thumbnail.d.ts.map

package/dist/meshy/thumbnail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"thumbnail.d.ts","sourceRoot":"","sources":["../../../../../packages/aura3d-cli/src/meshy/thumbnail.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAKnE,eAAO,MAAM,yBAAyB,QAAmB,CAAC;AAE1D,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAC;CAC9C;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOtG;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,GAAG,sBAAsB,GAAG,SAAS,CA4BrC"}

package/dist/meshy/thumbnail.js

@@ -0,0 +1,59 @@
+import { createHash } from "node:crypto";
+import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { extname, join, resolve } from "node:path";
+import { resolveConfinedPath } from "./validation.js";
+const THUMBNAIL_NAMES = ["thumbnail", "thumb", "preview", "render"];
+const THUMBNAIL_EXTENSIONS = new Set([".png", ".jpg", ".jpeg", ".webp"]);
+export const MAX_MESHY_THUMBNAIL_BYTES = 20 * 1024 * 1024;
+export function findMeshyThumbnail(inputDir, requested) {
+    if (requested)
+        return resolveConfinedPath(inputDir, requested, "thumbnail");
+    const matches = readdirSync(inputDir, { withFileTypes: true })
+        .filter((entry) => entry.isFile() && THUMBNAIL_EXTENSIONS.has(extname(entry.name).toLowerCase()) && THUMBNAIL_NAMES.includes(entry.name.replace(/\.[^.]+$/, "").toLowerCase()))
+        .map((entry) => resolve(inputDir, entry.name));
+    if (matches.length > 1)
+        throw new Error("Meshy output contains multiple candidate thumbnails. Select exactly one with --thumbnail <relative-image>.");
+    return matches[0];
+}
+export function retainMeshyThumbnail(options) {
+    const source = findMeshyThumbnail(options.inputDir, options.requested);
+    if (!source)
+        return undefined;
+    const stat = statSync(source);
+    const extension = extname(source).toLowerCase();
+    if (!stat.isFile() || !THUMBNAIL_EXTENSIONS.has(extension))
+        throw new Error("Meshy thumbnail must be a PNG, JPEG, or WebP regular file.");
+    if (stat.size === 0 || stat.size > MAX_MESHY_THUMBNAIL_BYTES)
+        throw new Error("Meshy thumbnail must be non-empty and no larger than " + MAX_MESHY_THUMBNAIL_BYTES + " bytes.");
+    const bytes = readFileSync(source);
+    validateImageSignature(bytes, extension);
+    const hash = createHash("sha256").update(bytes).digest("hex");
+    const fileName = options.assetName + ".meshy-candidate." + hash.slice(0, 8) + extension;
+    const outputPath = join(options.outputDir, fileName).replaceAll("\\", "/");
+    const destination = resolve(options.projectDir, outputPath);
+    mkdirSync(resolve(options.projectDir, options.outputDir), { recursive: true });
+    if (!existsSync(destination))
+        copyFileSync(source, destination);
+    const url = options.publicPath.replace(/\/?$/, "/") + fileName;
+    return {
+        sourceFile: source,
+        outputPath,
+        url,
+        sha256: "sha256-" + hash,
+        renderedProbe: {
+            url,
+            kind: "manual-inspection",
+            sha256: "sha256-" + hash,
+            checkedAt: new Date().toISOString()
+        }
+    };
+}
+function validateImageSignature(bytes, extension) {
+    const png = bytes.length >= 8 && bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]));
+    const jpeg = bytes.length >= 3 && bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff;
+    const webp = bytes.length >= 12 && bytes.toString("ascii", 0, 4) === "RIFF" && bytes.toString("ascii", 8, 12) === "WEBP";
+    const valid = extension === ".png" ? png : extension === ".webp" ? webp : jpeg;
+    if (!valid)
+        throw new Error("Meshy thumbnail content does not match its image extension.");
+}
+//# sourceMappingURL=thumbnail.js.map

package/dist/meshy/thumbnail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"thumbnail.js","sourceRoot":"","sources":["../../../../../packages/aura3d-cli/src/meshy/thumbnail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,MAAM,eAAe,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AACpE,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AACzE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAU1D,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,SAA6B;IAChF,IAAI,SAAS;QAAE,OAAO,mBAAmB,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SAC3D,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;SAC9K,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4GAA4G,CAAC,CAAC;IACtJ,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAOpC;IACC,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC1I,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,yBAAyB;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,GAAG,yBAAyB,GAAG,SAAS,CAAC,CAAC;IAC/K,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACnC,sBAAsB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,GAAG,mBAAmB,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC;IACxF,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3E,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC5D,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,QAAQ,CAAC;IAC/D,OAAO;QACL,UAAU,EAAE,MAAM;QAClB,UAAU;QACV,GAAG;QACH,MAAM,EAAE,SAAS,GAAG,IAAI;QACxB,aAAa,EAAE;YACb,GAAG;YACH,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,SAAS,GAAG,IAAI;YACxB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa,EAAE,SAAiB;IAC9D,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7G,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;IAC9F,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC;IACzH,MAAM,KAAK,GAAG,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;AAC7F,CAAC"}

package/dist/meshy/validation.d.ts

@@ -0,0 +1,5 @@
+export declare const MAX_MESHY_GLB_BYTES: number;
+export declare function resolveConfinedPath(allowedRoot: string, candidate: string, label: string): string;
+export declare function selectMeshyGlb(inputDir: string, file: string | undefined): string;
+export declare function validateMeshyGlb(path: string): void;
+//# sourceMappingURL=validation.d.ts.map

package/dist/meshy/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../../../packages/aura3d-cli/src/meshy/validation.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,mBAAmB,QAAoB,CAAC;AAErD,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAgBjG;AACD,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAcjF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAWnD"}

package/dist/meshy/validation.js

@@ -0,0 +1,64 @@
+import { closeSync, existsSync, openSync, readSync, realpathSync, readdirSync, statSync } from "node:fs";
+import { extname, isAbsolute, relative, resolve } from "node:path";
+export const MAX_MESHY_GLB_BYTES = 100 * 1024 * 1024;
+export function resolveConfinedPath(allowedRoot, candidate, label) {
+    if (!existsSync(allowedRoot))
+        throw new Error(`Meshy allowed root does not exist: ${allowedRoot}`);
+    const lexicalRoot = resolve(allowedRoot);
+    const target = resolve(isAbsolute(candidate) ? candidate : resolve(lexicalRoot, candidate));
+    const lexicalRelative = relative(lexicalRoot, target);
+    if (lexicalRelative === ".." || lexicalRelative.startsWith("../") || isAbsolute(lexicalRelative)) {
+        throw new Error(`Meshy ${label} escapes the allowed root: ${candidate}`);
+    }
+    if (!existsSync(target))
+        throw new Error(`Meshy ${label} does not exist: ${candidate}`);
+    const root = realpathSync(lexicalRoot);
+    const realTarget = realpathSync(target);
+    const realRelative = relative(root, realTarget);
+    if (realRelative === ".." || realRelative.startsWith("../") || isAbsolute(realRelative)) {
+        throw new Error(`Meshy ${label} escapes the allowed root through a symbolic link: ${candidate}`);
+    }
+    return realTarget;
+}
+export function selectMeshyGlb(inputDir, file) {
+    if (!statSync(inputDir).isDirectory())
+        throw new Error(`Meshy input must be a directory: ${inputDir}`);
+    if (file) {
+        const selected = resolveConfinedPath(inputDir, file, "selected GLB");
+        validateMeshyGlb(selected);
+        return selected;
+    }
+    const glbs = readdirSync(inputDir, { withFileTypes: true })
+        .filter((entry) => entry.isFile() && extname(entry.name).toLowerCase() === ".glb")
+        .map((entry) => resolve(inputDir, entry.name));
+    if (glbs.length === 0)
+        throw new Error("Meshy output contains no GLB. Supply a completed local output directory.");
+    if (glbs.length > 1)
+        throw new Error("Meshy output contains multiple GLBs. Select exactly one with --file <relative.glb>.");
+    validateMeshyGlb(glbs[0]);
+    return glbs[0];
+}
+export function validateMeshyGlb(path) {
+    const stat = statSync(path);
+    if (!stat.isFile())
+        throw new Error(`Meshy GLB is not a regular file: ${path}`);
+    if (extname(path).toLowerCase() !== ".glb")
+        throw new Error(`Meshy selected file must use the .glb extension: ${path}`);
+    if (stat.size < 20)
+        throw new Error(`Meshy GLB is too small to be valid: ${path}`);
+    if (stat.size > MAX_MESHY_GLB_BYTES)
+        throw new Error(`Meshy GLB exceeds ${MAX_MESHY_GLB_BYTES} bytes: ${path}`);
+    const bytes = Buffer.alloc(12);
+    const handle = openSync(path, "r");
+    try {
+        readSync(handle, bytes, 0, 12, 0);
+    }
+    finally {
+        closeSync(handle);
+    }
+    if (bytes.toString("utf8", 0, 4) !== "glTF")
+        throw new Error(`Meshy GLB has invalid magic bytes: ${path}`);
+    if (bytes.readUInt32LE(8) !== stat.size)
+        throw new Error(`Meshy GLB declared length does not match its file size: ${path}`);
+}
+//# sourceMappingURL=validation.js.map

package/dist/meshy/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../../../packages/aura3d-cli/src/meshy/validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACzG,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAErD,MAAM,UAAU,mBAAmB,CAAC,WAAmB,EAAE,SAAiB,EAAE,KAAa;IACvF,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,WAAW,EAAE,CAAC,CAAC;IACnG,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;IAC5F,MAAM,eAAe,GAAG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACtD,IAAI,eAAe,KAAK,IAAI,IAAI,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,8BAA8B,SAAS,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,oBAAoB,SAAS,EAAE,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAChD,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,sDAAsD,SAAS,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,IAAwB;IACvE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,EAAE,CAAC,CAAC;IACvG,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QACrE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SACxD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;SACjF,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IACnH,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IAC5H,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;IAC3B,OAAO,IAAI,CAAC,CAAC,CAAE,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,EAAE,CAAC,CAAC;IAChF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,IAAI,EAAE,CAAC,CAAC;IACxH,IAAI,IAAI,CAAC,IAAI,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAC;IACnF,IAAI,IAAI,CAAC,IAAI,GAAG,mBAAmB;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,mBAAmB,WAAW,IAAI,EAAE,CAAC,CAAC;IAChH,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IACzE,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC;IAC3G,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,IAAI,EAAE,CAAC,CAAC;AAC9H,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aura3d/cli",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "type": "module",
   "bin": {
     "aura3d": "dist/cli.js",
@@ -9,6 +9,7 @@
   },
   "files": [
     "README.md",
+    "LICENSE",
     "dist"
   ],
   "publishConfig": {
@@ -24,8 +25,8 @@
   "types": "./dist/index.d.ts",
   "dependencies": {
     "typescript": "^5.8.3",
-    "@aura3d/asset-index": "2.0.2",
-    "create-aura3d": "2.0.2"
+    "create-aura3d": "2.0.4",
+    "@aura3d/asset-index": "2.0.4"
   },
   "description": "Bring real GLB/glTF assets into Aura3D browser apps with typed references, provenance, catalog search, validation, screenshots, and deploy checks.",
   "keywords": [