@aura3d/cli 2.0.3 → 3.0.0

package/dist/meshy/metadata.js

@@ -0,0 +1,176 @@
+import { createHash } from "node:crypto";
+import { readFileSync, statSync } from "node:fs";
+export const MAX_MESHY_METADATA_BYTES = 1024 * 1024;
+const SECRET_KEY = /(?:^|_)(?:api_?key|access_?token|refresh_?token|authorization|bearer|client_?secret|password|credentials?|cookie|private_?key|environment|env)(?:$|_)/i;
+const SIGNED_QUERY_KEY = /^(?:x-amz-|x-goog-|signature$|sig$|token$|expires$|credential$|policy$|key-pair-id$)/i;
+export function readMeshyMetadata(path) {
+    const size = statSync(path).size;
+    if (size > MAX_MESHY_METADATA_BYTES) {
+        throw new Error(`Meshy metadata exceeds ${MAX_MESHY_METADATA_BYTES} bytes: ${path}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        throw new Error(`Meshy metadata is not valid JSON: ${path}`);
+    }
+    const root = record(parsed, "Meshy metadata");
+    rejectCredentialFields(root, "metadata");
+    const task = optionalRecord(root.task, "metadata.task") ?? root;
+    const prompt = optionalString(first(task.prompt, root.prompt), "prompt");
+    const settingsValue = first(task.settings, task.parameters, root.settings, root.parameters);
+    const settings = settingsValue === undefined ? undefined : sanitizeRecord(record(settingsValue, "settings"), 0);
+    return compact({
+        providerCli: optionalString(first(root.providerCli, root.provider_cli, root.cliVersion, root.cli_version), "providerCli"),
+        taskId: optionalString(first(task.taskId, task.task_id, task.id, root.taskId, root.task_id), "taskId"),
+        parentTaskIds: stringList(first(task.parentTaskIds, task.parent_task_ids, task.parentTaskId, task.parent_task_id), "parentTaskIds"),
+        operation: optionalString(first(task.operation, task.type, root.operation, root.type), "operation"),
+        promptHash: prompt ? `sha256-${createHash("sha256").update(prompt).digest("hex")}` : undefined,
+        model: optionalString(first(task.model, task.modelVersion, task.model_version, root.model), "model"),
+        settings,
+        createdAt: isoString(first(task.createdAt, task.created_at, root.createdAt, root.created_at), "createdAt"),
+        finishedAt: isoString(first(task.finishedAt, task.finished_at, task.completedAt, task.completed_at, root.finishedAt, root.finished_at), "finishedAt"),
+        consumedCredits: nonNegativeNumber(first(task.consumedCredits, task.consumed_credits, task.credits, root.consumedCredits, root.consumed_credits), "consumedCredits")
+    });
+}
+export function validateMeshyEvidenceJson(path) {
+    const size = statSync(path).size;
+    if (size > MAX_MESHY_METADATA_BYTES)
+        throw new Error(`Meshy rights evidence exceeds ${MAX_MESHY_METADATA_BYTES} bytes: ${path}`);
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        throw new Error(`Meshy rights evidence is not valid JSON: ${path}`);
+    }
+    const value = record(parsed, "Meshy rights evidence");
+    if (Object.keys(value).length === 0)
+        throw new Error("Meshy rights evidence must be a non-empty JSON object.");
+    rejectCredentialFields(value, "rights evidence");
+    const licenseName = boundedRightsString(value.licenseName, "licenseName", 512);
+    const licenseUrl = rightsHttpsUrl(first(value.termsUrl, value.licenseUrl), "termsUrl/licenseUrl");
+    const licenseRaw = boundedRightsString(first(value.rightsBasis, value.licenseRaw), "rightsBasis/licenseRaw", 4096);
+    return compact({ licenseName, licenseUrl, licenseRaw });
+}
+export function stripSignedUrl(value) {
+    try {
+        const url = new URL(value);
+        if ([...url.searchParams.keys()].some((key) => SIGNED_QUERY_KEY.test(key)))
+            url.search = "";
+        return url.toString();
+    }
+    catch {
+        return value;
+    }
+}
+function rejectCredentialFields(value, path) {
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => rejectCredentialFields(item, `${path}[${index}]`));
+        return;
+    }
+    if (!value || typeof value !== "object")
+        return;
+    for (const [key, child] of Object.entries(value)) {
+        const normalized = key.replace(/([a-z])([A-Z])/g, "$1_$2").replace(/[- ]/g, "_");
+        if (SECRET_KEY.test(normalized))
+            throw new Error(`Meshy input contains forbidden credential field at ${path}.${key}.`);
+        rejectCredentialFields(child, `${path}.${key}`);
+    }
+}
+function sanitizeRecord(value, depth) {
+    if (depth > 4)
+        throw new Error("Meshy settings exceed the maximum nesting depth.");
+    if (Object.keys(value).length > 100)
+        throw new Error("Meshy settings contain too many fields.");
+    return Object.fromEntries(Object.entries(value).map(([key, child]) => [key, sanitizeValue(child, depth + 1)]));
+}
+function sanitizeValue(value, depth) {
+    if (value === null || typeof value === "boolean" || typeof value === "number")
+        return value;
+    if (typeof value === "string") {
+        if (value.length > 4096)
+            throw new Error("Meshy metadata contains an unexpectedly long string.");
+        return stripSignedUrl(value);
+    }
+    if (Array.isArray(value)) {
+        if (value.length > 100)
+            throw new Error("Meshy metadata contains an unexpectedly large array.");
+        return value.map((entry) => sanitizeValue(entry, depth));
+    }
+    return sanitizeRecord(record(value, "settings value"), depth);
+}
+function record(value, label) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error(`${label} must be a JSON object.`);
+    return value;
+}
+function optionalRecord(value, label) { return value === undefined ? undefined : record(value, label); }
+function first(...values) { return values.find((value) => value !== undefined && value !== null); }
+function optionalString(value, label) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "string" || value.trim() === "" || value.length > 4096)
+        throw new Error(`Meshy metadata field ${label} must be a non-empty bounded string.`);
+    return stripSignedUrl(value.trim());
+}
+function boundedRightsString(value, label, maximumLength) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value !== "string" || value.trim() === "" || value.length > maximumLength) {
+        throw new Error(`Meshy rights evidence field ${label} must be a non-empty string of at most ${maximumLength} characters.`);
+    }
+    return value.trim();
+}
+function rightsHttpsUrl(value, label) {
+    const text = boundedRightsString(value, label, 2048);
+    if (!text)
+        return undefined;
+    let url;
+    try {
+        url = new URL(text);
+    }
+    catch {
+        throw new Error(`Meshy rights evidence field ${label} must be an HTTPS URL.`);
+    }
+    if (url.protocol !== "https:" || url.username || url.password) {
+        throw new Error(`Meshy rights evidence field ${label} must be an HTTPS URL without embedded credentials.`);
+    }
+    return stripSignedUrl(url.toString());
+}
+function isoString(value, label) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value === "number") {
+        if (!Number.isFinite(value) || value < 0)
+            throw new Error(`Meshy metadata field ${label} must be an ISO-8601 timestamp or non-negative epoch milliseconds.`);
+        const timestamp = new Date(value);
+        if (Number.isNaN(timestamp.getTime()))
+            throw new Error(`Meshy metadata field ${label} must be an ISO-8601 timestamp or non-negative epoch milliseconds.`);
+        return timestamp.toISOString();
+    }
+    const text = optionalString(value, label);
+    if (!text)
+        return undefined;
+    if (Number.isNaN(Date.parse(text)))
+        throw new Error(`Meshy metadata field ${label} must be an ISO-8601 timestamp or non-negative epoch milliseconds.`);
+    return text;
+}
+function nonNegativeNumber(value, label) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "number" || !Number.isFinite(value) || value < 0)
+        throw new Error(`Meshy metadata field ${label} must be a non-negative number.`);
+    return value;
+}
+function stringList(value, label) {
+    if (value === undefined)
+        return undefined;
+    const values = Array.isArray(value) ? value : [value];
+    if (values.length > 100)
+        throw new Error(`Meshy metadata field ${label} contains too many values.`);
+    return values.map((entry) => optionalString(entry, label));
+}
+function compact(value) { return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined)); }
+//# sourceMappingURL=metadata.js.map

package/dist/meshy/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../../../../packages/aura3d-cli/src/meshy/metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEjD,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,GAAG,IAAI,CAAC;AACpD,MAAM,UAAU,GAAG,wJAAwJ,CAAC;AAC5K,MAAM,gBAAgB,GAAG,uFAAuF,CAAC;AAqBjH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IACjC,IAAI,IAAI,GAAG,wBAAwB,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,0BAA0B,wBAAwB,WAAW,IAAI,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C,sBAAsB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,IAAI,IAAI,CAAC;IAChE,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;IACzE,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5F,MAAM,QAAQ,GAAG,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,aAAa,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAChH,OAAO,OAAO,CAAC;QACb,WAAW,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC;QACzH,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC;QACtG,aAAa,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,eAAe,CAAC;QACnI,SAAS,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC;QACnG,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;QAC9F,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QACpG,QAAQ;QACR,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC;QAC1G,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC;QACrJ,eAAe,EAAE,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;KACrK,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IACjC,IAAI,IAAI,GAAG,wBAAwB;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,wBAAwB,WAAW,IAAI,EAAE,CAAC,CAAC;IACjI,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IACvI,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC/G,sBAAsB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,mBAAmB,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAClG,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,wBAAwB,EAAE,IAAI,CAAC,CAAC;IACnH,OAAO,OAAO,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAE,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;QAC5F,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC3B,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc,EAAE,IAAY;IAC1D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IACxH,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO;IAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACjF,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC;QACvH,sBAAsB,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAA8B,EAAE,KAAa;IACnE,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACnF,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAChG,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,aAAa,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjH,CAAC;AACD,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5F,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACjG,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAChG,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAC;AAChE,CAAC;AACD,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa;IAC3C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yBAAyB,CAAC,CAAC;IACpH,OAAO,KAAgC,CAAC;AAC1C,CAAC;AACD,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa,IAAyC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAC9J,SAAS,KAAK,CAAC,GAAG,MAAiB,IAAa,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC;AACvH,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,sCAAsC,CAAC,CAAC;IAClK,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AACtC,CAAC;AACD,SAAS,mBAAmB,CAAC,KAAc,EAAE,KAAa,EAAE,aAAqB;IAC/E,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,0CAA0C,aAAa,cAAc,CAAC,CAAC;IAC7H,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AACD,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,wBAAwB,CAAC,CAAC;IAAC,CAAC;IACrH,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,qDAAqD,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AACxC,CAAC;AACD,SAAS,SAAS,CAAC,KAAc,EAAE,KAAa;IAC9C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,oEAAoE,CAAC,CAAC;QAC7J,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,oEAAoE,CAAC,CAAC;QAC1J,OAAO,SAAS,CAAC,WAAW,EAAE,CAAC;IACjC,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAAC,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IACvE,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,oEAAoE,CAAC,CAAC;IACvJ,OAAO,IAAI,CAAC;AACd,CAAC;AACD,SAAS,iBAAiB,CAAC,KAAc,EAAE,KAAa;IACtD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,iCAAiC,CAAC,CAAC;IACvJ,OAAO,KAAK,CAAC;AACf,CAAC;AACD,SAAS,UAAU,CAAC,KAAc,EAAE,KAAa;IAC/C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,4BAA4B,CAAC,CAAC;IACpG,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAE,CAAC,CAAC;AAC9D,CAAC;AACD,SAAS,OAAO,CAAoC,KAAQ,IAAO,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAM,CAAC,CAAC,CAAC"}

package/dist/meshy/provenance.d.ts

@@ -0,0 +1,4 @@
+import type { AuraCliGeneratedAssetProvenance } from "../asset-core-types.js";
+import type { SanitizedMeshyMetadata } from "./metadata.js";
+export declare function createMeshyProvenance(projectDir: string, metadataPath: string, rightsPath: string, metadata: SanitizedMeshyMetadata): AuraCliGeneratedAssetProvenance;
+//# sourceMappingURL=provenance.d.ts.map

package/dist/meshy/provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../../../../../packages/aura3d-cli/src/meshy/provenance.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAE5D,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,GAAG,+BAA+B,CAgBrK"}

package/dist/meshy/provenance.js

@@ -0,0 +1,21 @@
+import { realpathSync } from "node:fs";
+import { relative } from "node:path";
+export function createMeshyProvenance(projectDir, metadataPath, rightsPath, metadata) {
+    return {
+        provider: "meshy",
+        providerCli: metadata.providerCli ?? "@meshy-ai/cli@0.2.0",
+        ...(metadata.taskId ? { taskId: metadata.taskId } : {}),
+        ...(metadata.parentTaskIds?.length ? { parentTaskIds: metadata.parentTaskIds } : {}),
+        ...(metadata.operation ? { operation: metadata.operation } : {}),
+        ...(metadata.promptHash ? { promptHash: metadata.promptHash } : {}),
+        ...(metadata.model ? { model: metadata.model } : {}),
+        ...(metadata.settings ? { settings: metadata.settings } : {}),
+        ...(metadata.createdAt ? { createdAt: metadata.createdAt } : {}),
+        ...(metadata.finishedAt ? { finishedAt: metadata.finishedAt } : {}),
+        ...(metadata.consumedCredits !== undefined ? { consumedCredits: metadata.consumedCredits } : {}),
+        localMetadata: normalized(relative(realpathSync(projectDir), metadataPath)),
+        rightsEvidence: normalized(relative(realpathSync(projectDir), rightsPath))
+    };
+}
+function normalized(path) { return path.replaceAll("\\", "/"); }
+//# sourceMappingURL=provenance.js.map

package/dist/meshy/provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../../../../../packages/aura3d-cli/src/meshy/provenance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAIrC,MAAM,UAAU,qBAAqB,CAAC,UAAkB,EAAE,YAAoB,EAAE,UAAkB,EAAE,QAAgC;IAClI,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,qBAAqB;QAC1D,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,QAAQ,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,aAAa,EAAE,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC;QAC3E,cAAc,EAAE,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;KAC3E,CAAC;AACJ,CAAC;AACD,SAAS,UAAU,CAAC,IAAY,IAAY,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC"}

package/dist/meshy/thumbnail.d.ts

@@ -0,0 +1,19 @@
+import type { AuraCliRenderedProbe } from "../asset-core-types.js";
+export declare const MAX_MESHY_THUMBNAIL_BYTES: number;
+export interface RetainedMeshyThumbnail {
+    readonly sourceFile: string;
+    readonly outputPath: string;
+    readonly url: string;
+    readonly sha256: string;
+    readonly renderedProbe: AuraCliRenderedProbe;
+}
+export declare function findMeshyThumbnail(inputDir: string, requested: string | undefined): string | undefined;
+export declare function retainMeshyThumbnail(options: {
+    readonly projectDir: string;
+    readonly inputDir: string;
+    readonly requested?: string;
+    readonly assetName: string;
+    readonly outputDir: string;
+    readonly publicPath: string;
+}): RetainedMeshyThumbnail | undefined;
+//# sourceMappingURL=thumbnail.d.ts.map

package/dist/meshy/thumbnail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"thumbnail.d.ts","sourceRoot":"","sources":["../../../../../packages/aura3d-cli/src/meshy/thumbnail.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAKnE,eAAO,MAAM,yBAAyB,QAAmB,CAAC;AAE1D,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAC;CAC9C;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOtG;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,GAAG,sBAAsB,GAAG,SAAS,CA4BrC"}

package/dist/meshy/thumbnail.js

@@ -0,0 +1,59 @@
+import { createHash } from "node:crypto";
+import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { extname, join, resolve } from "node:path";
+import { resolveConfinedPath } from "./validation.js";
+const THUMBNAIL_NAMES = ["thumbnail", "thumb", "preview", "render"];
+const THUMBNAIL_EXTENSIONS = new Set([".png", ".jpg", ".jpeg", ".webp"]);
+export const MAX_MESHY_THUMBNAIL_BYTES = 20 * 1024 * 1024;
+export function findMeshyThumbnail(inputDir, requested) {
+    if (requested)
+        return resolveConfinedPath(inputDir, requested, "thumbnail");
+    const matches = readdirSync(inputDir, { withFileTypes: true })
+        .filter((entry) => entry.isFile() && THUMBNAIL_EXTENSIONS.has(extname(entry.name).toLowerCase()) && THUMBNAIL_NAMES.includes(entry.name.replace(/\.[^.]+$/, "").toLowerCase()))
+        .map((entry) => resolve(inputDir, entry.name));
+    if (matches.length > 1)
+        throw new Error("Meshy output contains multiple candidate thumbnails. Select exactly one with --thumbnail <relative-image>.");
+    return matches[0];
+}
+export function retainMeshyThumbnail(options) {
+    const source = findMeshyThumbnail(options.inputDir, options.requested);
+    if (!source)
+        return undefined;
+    const stat = statSync(source);
+    const extension = extname(source).toLowerCase();
+    if (!stat.isFile() || !THUMBNAIL_EXTENSIONS.has(extension))
+        throw new Error("Meshy thumbnail must be a PNG, JPEG, or WebP regular file.");
+    if (stat.size === 0 || stat.size > MAX_MESHY_THUMBNAIL_BYTES)
+        throw new Error("Meshy thumbnail must be non-empty and no larger than " + MAX_MESHY_THUMBNAIL_BYTES + " bytes.");
+    const bytes = readFileSync(source);
+    validateImageSignature(bytes, extension);
+    const hash = createHash("sha256").update(bytes).digest("hex");
+    const fileName = options.assetName + ".meshy-candidate." + hash.slice(0, 8) + extension;
+    const outputPath = join(options.outputDir, fileName).replaceAll("\\", "/");
+    const destination = resolve(options.projectDir, outputPath);
+    mkdirSync(resolve(options.projectDir, options.outputDir), { recursive: true });
+    if (!existsSync(destination))
+        copyFileSync(source, destination);
+    const url = options.publicPath.replace(/\/?$/, "/") + fileName;
+    return {
+        sourceFile: source,
+        outputPath,
+        url,
+        sha256: "sha256-" + hash,
+        renderedProbe: {
+            url,
+            kind: "manual-inspection",
+            sha256: "sha256-" + hash,
+            checkedAt: new Date().toISOString()
+        }
+    };
+}
+function validateImageSignature(bytes, extension) {
+    const png = bytes.length >= 8 && bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]));
+    const jpeg = bytes.length >= 3 && bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff;
+    const webp = bytes.length >= 12 && bytes.toString("ascii", 0, 4) === "RIFF" && bytes.toString("ascii", 8, 12) === "WEBP";
+    const valid = extension === ".png" ? png : extension === ".webp" ? webp : jpeg;
+    if (!valid)
+        throw new Error("Meshy thumbnail content does not match its image extension.");
+}
+//# sourceMappingURL=thumbnail.js.map

package/dist/meshy/thumbnail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"thumbnail.js","sourceRoot":"","sources":["../../../../../packages/aura3d-cli/src/meshy/thumbnail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,MAAM,eAAe,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AACpE,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AACzE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAU1D,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,SAA6B;IAChF,IAAI,SAAS;QAAE,OAAO,mBAAmB,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SAC3D,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;SAC9K,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4GAA4G,CAAC,CAAC;IACtJ,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAOpC;IACC,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC1I,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,yBAAyB;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,GAAG,yBAAyB,GAAG,SAAS,CAAC,CAAC;IAC/K,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACnC,sBAAsB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,GAAG,mBAAmB,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC;IACxF,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3E,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC5D,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,QAAQ,CAAC;IAC/D,OAAO;QACL,UAAU,EAAE,MAAM;QAClB,UAAU;QACV,GAAG;QACH,MAAM,EAAE,SAAS,GAAG,IAAI;QACxB,aAAa,EAAE;YACb,GAAG;YACH,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,SAAS,GAAG,IAAI;YACxB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa,EAAE,SAAiB;IAC9D,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7G,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;IAC9F,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC;IACzH,MAAM,KAAK,GAAG,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;AAC7F,CAAC"}

package/dist/meshy/validation.d.ts

@@ -0,0 +1,5 @@
+export declare const MAX_MESHY_GLB_BYTES: number;
+export declare function resolveConfinedPath(allowedRoot: string, candidate: string, label: string): string;
+export declare function selectMeshyGlb(inputDir: string, file: string | undefined): string;
+export declare function validateMeshyGlb(path: string): void;
+//# sourceMappingURL=validation.d.ts.map

package/dist/meshy/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../../../packages/aura3d-cli/src/meshy/validation.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,mBAAmB,QAAoB,CAAC;AAErD,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAgBjG;AACD,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAcjF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAWnD"}

package/dist/meshy/validation.js

@@ -0,0 +1,64 @@
+import { closeSync, existsSync, openSync, readSync, realpathSync, readdirSync, statSync } from "node:fs";
+import { extname, isAbsolute, relative, resolve } from "node:path";
+export const MAX_MESHY_GLB_BYTES = 100 * 1024 * 1024;
+export function resolveConfinedPath(allowedRoot, candidate, label) {
+    if (!existsSync(allowedRoot))
+        throw new Error(`Meshy allowed root does not exist: ${allowedRoot}`);
+    const lexicalRoot = resolve(allowedRoot);
+    const target = resolve(isAbsolute(candidate) ? candidate : resolve(lexicalRoot, candidate));
+    const lexicalRelative = relative(lexicalRoot, target);
+    if (lexicalRelative === ".." || lexicalRelative.startsWith("../") || isAbsolute(lexicalRelative)) {
+        throw new Error(`Meshy ${label} escapes the allowed root: ${candidate}`);
+    }
+    if (!existsSync(target))
+        throw new Error(`Meshy ${label} does not exist: ${candidate}`);
+    const root = realpathSync(lexicalRoot);
+    const realTarget = realpathSync(target);
+    const realRelative = relative(root, realTarget);
+    if (realRelative === ".." || realRelative.startsWith("../") || isAbsolute(realRelative)) {
+        throw new Error(`Meshy ${label} escapes the allowed root through a symbolic link: ${candidate}`);
+    }
+    return realTarget;
+}
+export function selectMeshyGlb(inputDir, file) {
+    if (!statSync(inputDir).isDirectory())
+        throw new Error(`Meshy input must be a directory: ${inputDir}`);
+    if (file) {
+        const selected = resolveConfinedPath(inputDir, file, "selected GLB");
+        validateMeshyGlb(selected);
+        return selected;
+    }
+    const glbs = readdirSync(inputDir, { withFileTypes: true })
+        .filter((entry) => entry.isFile() && extname(entry.name).toLowerCase() === ".glb")
+        .map((entry) => resolve(inputDir, entry.name));
+    if (glbs.length === 0)
+        throw new Error("Meshy output contains no GLB. Supply a completed local output directory.");
+    if (glbs.length > 1)
+        throw new Error("Meshy output contains multiple GLBs. Select exactly one with --file <relative.glb>.");
+    validateMeshyGlb(glbs[0]);
+    return glbs[0];
+}
+export function validateMeshyGlb(path) {
+    const stat = statSync(path);
+    if (!stat.isFile())
+        throw new Error(`Meshy GLB is not a regular file: ${path}`);
+    if (extname(path).toLowerCase() !== ".glb")
+        throw new Error(`Meshy selected file must use the .glb extension: ${path}`);
+    if (stat.size < 20)
+        throw new Error(`Meshy GLB is too small to be valid: ${path}`);
+    if (stat.size > MAX_MESHY_GLB_BYTES)
+        throw new Error(`Meshy GLB exceeds ${MAX_MESHY_GLB_BYTES} bytes: ${path}`);
+    const bytes = Buffer.alloc(12);
+    const handle = openSync(path, "r");
+    try {
+        readSync(handle, bytes, 0, 12, 0);
+    }
+    finally {
+        closeSync(handle);
+    }
+    if (bytes.toString("utf8", 0, 4) !== "glTF")
+        throw new Error(`Meshy GLB has invalid magic bytes: ${path}`);
+    if (bytes.readUInt32LE(8) !== stat.size)
+        throw new Error(`Meshy GLB declared length does not match its file size: ${path}`);
+}
+//# sourceMappingURL=validation.js.map

package/dist/meshy/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../../../packages/aura3d-cli/src/meshy/validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACzG,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAErD,MAAM,UAAU,mBAAmB,CAAC,WAAmB,EAAE,SAAiB,EAAE,KAAa;IACvF,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,WAAW,EAAE,CAAC,CAAC;IACnG,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;IAC5F,MAAM,eAAe,GAAG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACtD,IAAI,eAAe,KAAK,IAAI,IAAI,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,8BAA8B,SAAS,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,oBAAoB,SAAS,EAAE,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAChD,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,sDAAsD,SAAS,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,IAAwB;IACvE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,EAAE,CAAC,CAAC;IACvG,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QACrE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SACxD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;SACjF,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IACnH,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IAC5H,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;IAC3B,OAAO,IAAI,CAAC,CAAC,CAAE,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,EAAE,CAAC,CAAC;IAChF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,IAAI,EAAE,CAAC,CAAC;IACxH,IAAI,IAAI,CAAC,IAAI,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAC;IACnF,IAAI,IAAI,CAAC,IAAI,GAAG,mBAAmB;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,mBAAmB,WAAW,IAAI,EAAE,CAAC,CAAC;IAChH,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IACzE,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC;IAC3G,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,IAAI,EAAE,CAAC,CAAC;AAC9H,CAAC"}

package/dist/pull-bridge/profiles.d.ts

@@ -1,7 +1,17 @@
 import type { AnimationAssetProfile, AuraCanonicalAsset, ResolveCandidate, ResolveConstraints } from "@aura3d/asset-index";
 import type { CliAssetSearchProfile, CliResolveConstraints } from "./types.js";
-export declare function toResolveConstraints(cli: CliResolveConstraints, redistributableOnly: boolean): ResolveConstraints;
-export declare function rankForProfile(candidates: readonly ResolveCandidate[], profile: CliAssetSearchProfile): readonly ResolveCandidate[];
+/**
+ * Triangle budgets applied to inferred character/vehicle queries.
+ *
+ * These mirror the Meshy admission maxima (humanoid 150k, vehicle 250k): a
+ * general-profile query that reads as a character or vehicle stops defaulting
+ * to an unbounded `general` fetch and resolves under the same budget the
+ * quality gates enforce downstream. Explicit caller values always win.
+ */
+export declare const INFERRED_CHARACTER_MAX_TRIANGLES = 150000;
+export declare const INFERRED_VEHICLE_MAX_TRIANGLES = 250000;
+export declare function toResolveConstraints(cli: CliResolveConstraints, redistributableOnly: boolean, query?: string): ResolveConstraints;
+export declare function rankForProfile(candidates: readonly ResolveCandidate[], profile: CliAssetSearchProfile, query?: string): readonly ResolveCandidate[];
 export declare function isAnimationCliProfile(profile: CliAssetSearchProfile | undefined): profile is AnimationAssetProfile;
 export declare function evaluateAssetProfile(asset: AuraCanonicalAsset, profile: Exclude<CliAssetSearchProfile, "general">): {
     readonly suitable: boolean;

package/dist/pull-bridge/profiles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../../../../packages/aura3d-cli/src/pull-bridge/profiles.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EACV,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAQpB,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,qBAAqB,EAC1B,mBAAmB,EAAE,OAAO,GAC3B,kBAAkB,CA0BpB;AAED,wBAAgB,cAAc,CAC5B,UAAU,EAAE,SAAS,gBAAgB,EAAE,EACvC,OAAO,EAAE,qBAAqB,GAC7B,SAAS,gBAAgB,EAAE,CAW7B;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,qBAAqB,GAAG,SAAS,GAAG,OAAO,IAAI,qBAAqB,CAElH;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,kBAAkB,EACzB,OAAO,EAAE,OAAO,CAAC,qBAAqB,EAAE,SAAS,CAAC,GACjD;IAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAI/L;AAED,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,CAWnF"}
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../../../../packages/aura3d-cli/src/pull-bridge/profiles.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EACV,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AASpB;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC,SAAU,CAAC;AACxD,eAAO,MAAM,8BAA8B,SAAU,CAAC;AAEtD,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,qBAAqB,EAC1B,mBAAmB,EAAE,OAAO,EAC5B,KAAK,CAAC,EAAE,MAAM,GACb,kBAAkB,CAgCpB;AAED,wBAAgB,cAAc,CAC5B,UAAU,EAAE,SAAS,gBAAgB,EAAE,EACvC,OAAO,EAAE,qBAAqB,EAC9B,KAAK,CAAC,EAAE,MAAM,GACb,SAAS,gBAAgB,EAAE,CA2B7B;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,qBAAqB,GAAG,SAAS,GAAG,OAAO,IAAI,qBAAqB,CAElH;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,kBAAkB,EACzB,OAAO,EAAE,OAAO,CAAC,qBAAqB,EAAE,SAAS,CAAC,GACjD;IAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAI/L;AAED,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,CAWnF"}

package/dist/pull-bridge/profiles.js

@@ -1,7 +1,24 @@
 import * as assetIndex from "@aura3d/asset-index";
+import { inferQueryRole } from "./scoring.js";
 const { evaluateAnimationAssetProfile, evaluateGameAssetProfile, isAnimationAssetProfile, } = assetIndex;
-export function toResolveConstraints(cli, redistributableOnly) {
+/**
+ * Triangle budgets applied to inferred character/vehicle queries.
+ *
+ * These mirror the Meshy admission maxima (humanoid 150k, vehicle 250k): a
+ * general-profile query that reads as a character or vehicle stops defaulting
+ * to an unbounded `general` fetch and resolves under the same budget the
+ * quality gates enforce downstream. Explicit caller values always win.
+ */
+export const INFERRED_CHARACTER_MAX_TRIANGLES = 150_000;
+export const INFERRED_VEHICLE_MAX_TRIANGLES = 250_000;
+export function toResolveConstraints(cli, redistributableOnly, query) {
     const constraints = {};
+    if (cli.profile === "general" || cli.profile === undefined) {
+        const inferred = typeof query === "string" && query.trim().length > 0 ? inferQueryRole(query) : undefined;
+        if ((inferred === "character" || inferred === "vehicle") && typeof cli.maxTriangles !== "number") {
+            constraints.maxTriangles = inferred === "character" ? INFERRED_CHARACTER_MAX_TRIANGLES : INFERRED_VEHICLE_MAX_TRIANGLES;
+        }
+    }
     if (cli.profile === "fighting-character") {
         constraints.license = cli.license && cli.license.length > 0 ? cli.license : ["CC0", "CC-BY"];
         constraints.animated = true;
@@ -29,9 +46,23 @@ export function toResolveConstraints(cli, redistributableOnly) {
         constraints.redistributableOnly = true;
     return constraints;
 }
-export function rankForProfile(candidates, profile) {
-    if (profile === "general")
-        return candidates;
+export function rankForProfile(candidates, profile, query) {
+    if (profile === "general") {
+        // A general-profile character/vehicle query stops defaulting to unfiltered
+        // catalog order: candidates whose catalog role matches the inferred query
+        // role rank first (by resolver score, then id), exactly like an explicit
+        // profile's suitability sort. Any other query returns catalog order.
+        const inferred = typeof query === "string" && query.trim().length > 0 ? inferQueryRole(query) : undefined;
+        if (inferred !== "character" && inferred !== "vehicle")
+            return candidates;
+        return [...candidates].sort((a, b) => {
+            const aMatch = a.asset.intendedRole === inferred ? 1 : 0;
+            const bMatch = b.asset.intendedRole === inferred ? 1 : 0;
+            return (bMatch - aMatch ||
+                b.score - a.score ||
+                a.asset.id.localeCompare(b.asset.id));
+        });
+    }
     return [...candidates].sort((a, b) => {
         const aEval = evaluateAssetProfile(a.asset, profile);
         const bEval = evaluateAssetProfile(b.asset, profile);

package/dist/pull-bridge/profiles.js.map

@@ -1 +1 @@
-{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../../../../packages/aura3d-cli/src/pull-bridge/profiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,qBAAqB,CAAC;AAYlD,MAAM,EACJ,6BAA6B,EAC7B,wBAAwB,EACxB,uBAAuB,GACxB,GAAG,UAAU,CAAC;AAEf,MAAM,UAAU,oBAAoB,CAClC,GAA0B,EAC1B,mBAA4B;IAE5B,MAAM,WAAW,GAMb,EAAE,CAAC;IACP,IAAI,GAAG,CAAC,OAAO,KAAK,oBAAoB,EAAE,CAAC;QACzC,WAAW,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC7F,WAAW,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC5B,WAAW,CAAC,MAAM,GAAG,KAAK,CAAC;QAC3B,WAAW,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC;IACzD,CAAC;SAAM,IAAI,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,WAAW,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC7F,WAAW,CAAC,MAAM,GAAG,KAAK,CAAC;QAC3B,WAAW,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzF,IAAI,GAAG,CAAC,OAAO,KAAK,qBAAqB;YAAE,WAAW,CAAC,QAAQ,GAAG,IAAI,CAAC;aAClE,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,SAAS;YAAE,WAAW,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,WAAW,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC7E,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;YAAE,WAAW,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC;QACtF,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,SAAS;YAAE,WAAW,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC7E,CAAC;IACD,IAAI,mBAAmB;QAAE,WAAW,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAChE,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,UAAuC,EACvC,OAA8B;IAE9B,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IAC7C,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACnC,MAAM,KAAK,GAAG,oBAAoB,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,oBAAoB,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACrD,OAAO,CACL,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC/C,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC;YAC3D,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CACrC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAA0C;IAC9E,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,uBAAuB,CAAC,OAAO,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAyB,EACzB,OAAkD;IAElD,OAAO,OAAO,KAAK,oBAAoB;QACrC,CAAC,CAAC,wBAAwB,CAAC,KAAK,EAAE,oBAAoB,CAAC;QACvD,CAAC,CAAC,6BAA6B,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,OAA8B;IACzE,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,qBAAqB;YACxB,OAAO,OAAO,CAAC;QACjB,KAAK,gBAAgB;YACnB,OAAO,OAAO,CAAC;QACjB,KAAK,eAAe;YAClB,OAAO,OAAO,CAAC;QACjB,KAAK,uBAAuB;YAC1B,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC"}
+{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../../../../packages/aura3d-cli/src/pull-bridge/profiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,qBAAqB,CAAC;AAWlD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,EACJ,6BAA6B,EAC7B,wBAAwB,EACxB,uBAAuB,GACxB,GAAG,UAAU,CAAC;AAEf;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,OAAO,CAAC;AACxD,MAAM,CAAC,MAAM,8BAA8B,GAAG,OAAO,CAAC;AAEtD,MAAM,UAAU,oBAAoB,CAClC,GAA0B,EAC1B,mBAA4B,EAC5B,KAAc;IAEd,MAAM,WAAW,GAMb,EAAE,CAAC;IACP,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3D,MAAM,QAAQ,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1G,IAAI,CAAC,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,SAAS,CAAC,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACjG,WAAW,CAAC,YAAY,GAAG,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,8BAA8B,CAAC;QAC1H,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,KAAK,oBAAoB,EAAE,CAAC;QACzC,WAAW,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC7F,WAAW,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC5B,WAAW,CAAC,MAAM,GAAG,KAAK,CAAC;QAC3B,WAAW,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC;IACzD,CAAC;SAAM,IAAI,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,WAAW,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC7F,WAAW,CAAC,MAAM,GAAG,KAAK,CAAC;QAC3B,WAAW,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzF,IAAI,GAAG,CAAC,OAAO,KAAK,qBAAqB;YAAE,WAAW,CAAC,QAAQ,GAAG,IAAI,CAAC;aAClE,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,SAAS;YAAE,WAAW,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,WAAW,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC7E,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;YAAE,WAAW,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC;QACtF,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,SAAS;YAAE,WAAW,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC7E,CAAC;IACD,IAAI,mBAAmB;QAAE,WAAW,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAChE,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,UAAuC,EACvC,OAA8B,EAC9B,KAAc;IAEd,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,qEAAqE;QACrE,MAAM,QAAQ,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1G,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC;QAC1E,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACnC,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,OAAO,CACL,MAAM,GAAG,MAAM;gBACf,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK;gBACjB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CACrC,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACnC,MAAM,KAAK,GAAG,oBAAoB,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,oBAAoB,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACrD,OAAO,CACL,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC/C,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC;YAC3D,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CACrC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAA0C;IAC9E,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,uBAAuB,CAAC,OAAO,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAyB,EACzB,OAAkD;IAElD,OAAO,OAAO,KAAK,oBAAoB;QACrC,CAAC,CAAC,wBAAwB,CAAC,KAAK,EAAE,oBAAoB,CAAC;QACvD,CAAC,CAAC,6BAA6B,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,OAA8B;IACzE,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,qBAAqB;YACxB,OAAO,OAAO,CAAC;QACjB,KAAK,gBAAgB;YACnB,OAAO,OAAO,CAAC;QACjB,KAAK,eAAe;YAClB,OAAO,OAAO,CAAC;QACjB,KAAK,uBAAuB;YAC1B,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/pull-bridge/provenance.d.ts

@@ -2,7 +2,21 @@ import type { AuraAssetIntendedRole, AuraCanonicalAsset, ResolveCandidate } from
 import type { AssetInspectionReport, AuraCliAssetRole, AuraCliResolveCandidateProvenance } from "../index.js";
 import type { AssetResolveCandidateScore } from "./scoring.js";
 import type { CliAssetSearchProfile } from "./types.js";
-export declare function createPreDownloadCandidateBlockingWarnings(asset: AuraCanonicalAsset): readonly string[];
+/**
+ * Structural triangle floors mirrored from the Meshy admission profiles.
+ *
+ * `meshy/admission.ts` enforces a 1,000-triangle floor for vehicles and a
+ * 3,000-triangle floor for humanoids; the role-admission hero floor is 3,000.
+ * The same measured-and-below-floor classes are blocked here pre-download so a
+ * no-key resolve refuses a distant-prop shell (e.g. the 792-triangle body
+ * shell) without spending a download on it. A missing triangle count never
+ * blocks: absent metadata is unproven, not unfit.
+ */
+export declare const PROVENANCE_VEHICLE_MIN_TRIANGLES = 1000;
+export declare const PROVENANCE_HUMANOID_MIN_TRIANGLES = 3000;
+/** Bounds aspect ratio above this is degenerate (mirrors Meshy `bounds-degeneracy`). */
+export declare const PROVENANCE_MAX_BOUNDS_ASPECT_RATIO = 1000;
+export declare function createPreDownloadCandidateBlockingWarnings(asset: AuraCanonicalAsset, profile?: CliAssetSearchProfile): readonly string[];
 export declare function createPostDownloadCandidateBlockingWarnings(asset: AuraCanonicalAsset, inspection: AssetInspectionReport, profile: CliAssetSearchProfile): readonly string[];
 export declare function createResolveCandidateProvenance(candidate: ResolveCandidate, query: string, score: AssetResolveCandidateScore, inspection: AssetInspectionReport): AuraCliResolveCandidateProvenance;
 export declare function mapCanonicalRoleToCli(role: AuraAssetIntendedRole | undefined): AuraCliAssetRole;

package/dist/pull-bridge/provenance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../../../../../packages/aura3d-cli/src/pull-bridge/provenance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EACV,qBAAqB,EACrB,gBAAgB,EAChB,iCAAiC,EAClC,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAGxD,wBAAgB,0CAA0C,CAAC,KAAK,EAAE,kBAAkB,GAAG,SAAS,MAAM,EAAE,CASvG;AAED,wBAAgB,2CAA2C,CACzD,KAAK,EAAE,kBAAkB,EACzB,UAAU,EAAE,qBAAqB,EACjC,OAAO,EAAE,qBAAqB,GAC7B,SAAS,MAAM,EAAE,CA2BnB;AAED,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,gBAAgB,EAC3B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,0BAA0B,EACjC,UAAU,EAAE,qBAAqB,GAChC,iCAAiC,CAuDnC;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,GAAG,SAAS,GAAG,gBAAgB,CAE/F"}
+{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../../../../../packages/aura3d-cli/src/pull-bridge/provenance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EACV,qBAAqB,EACrB,gBAAgB,EAChB,iCAAiC,EAClC,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAGxD;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC,OAAQ,CAAC;AACtD,eAAO,MAAM,iCAAiC,OAAQ,CAAC;AACvD,wFAAwF;AACxF,eAAO,MAAM,kCAAkC,OAAQ,CAAC;AA4BxD,wBAAgB,0CAA0C,CACxD,KAAK,EAAE,kBAAkB,EACzB,OAAO,GAAE,qBAAiC,GACzC,SAAS,MAAM,EAAE,CAkBnB;AAED,wBAAgB,2CAA2C,CACzD,KAAK,EAAE,kBAAkB,EACzB,UAAU,EAAE,qBAAqB,EACjC,OAAO,EAAE,qBAAqB,GAC7B,SAAS,MAAM,EAAE,CA2CnB;AAED,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,gBAAgB,EAC3B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,0BAA0B,EACjC,UAAU,EAAE,qBAAqB,GAChC,iCAAiC,CAuDnC;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,GAAG,SAAS,GAAG,gBAAgB,CAE/F"}

package/dist/pull-bridge/provenance.js

@@ -1,5 +1,43 @@
 import { isPositiveVector3 } from "./vector3.js";
-export function createPreDownloadCandidateBlockingWarnings(asset) {
+/**
+ * Structural triangle floors mirrored from the Meshy admission profiles.
+ *
+ * `meshy/admission.ts` enforces a 1,000-triangle floor for vehicles and a
+ * 3,000-triangle floor for humanoids; the role-admission hero floor is 3,000.
+ * The same measured-and-below-floor classes are blocked here pre-download so a
+ * no-key resolve refuses a distant-prop shell (e.g. the 792-triangle body
+ * shell) without spending a download on it. A missing triangle count never
+ * blocks: absent metadata is unproven, not unfit.
+ */
+export const PROVENANCE_VEHICLE_MIN_TRIANGLES = 1_000;
+export const PROVENANCE_HUMANOID_MIN_TRIANGLES = 3_000;
+/** Bounds aspect ratio above this is degenerate (mirrors Meshy `bounds-degeneracy`). */
+export const PROVENANCE_MAX_BOUNDS_ASPECT_RATIO = 1_000;
+function catalogTriangles(asset) {
+    const value = asset.triangleCount ?? asset.triangles;
+    return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : undefined;
+}
+function provenanceMinTriangles(asset, profile) {
+    if (asset.intendedRole === "vehicle")
+        return PROVENANCE_VEHICLE_MIN_TRIANGLES;
+    if (asset.intendedRole === "character")
+        return PROVENANCE_HUMANOID_MIN_TRIANGLES;
+    if (profile === "fighting-character" || profile === "animation-character")
+        return PROVENANCE_HUMANOID_MIN_TRIANGLES;
+    return undefined;
+}
+function boundsAspectWarnings(size, label) {
+    if (!size)
+        return [];
+    if (!(size.length === 3 && size.every((value) => typeof value === "number" && Number.isFinite(value) && value > 0))) {
+        return [`${label} bounds are not positive and finite; inspect export scale and stray geometry`];
+    }
+    const ratio = Math.max(...size) / Math.min(...size);
+    return ratio > PROVENANCE_MAX_BOUNDS_ASPECT_RATIO
+        ? [`${label} bounds aspect ratio ${ratio.toFixed(1)} is degenerate; check export scale and stray geometry`]
+        : [];
+}
+export function createPreDownloadCandidateBlockingWarnings(asset, profile = "general") {
     const warnings = [];
     if (asset.duplicateHash && !asset.duplicateOkReason) {
         warnings.push(`duplicate hash ${asset.duplicateHash} has no allowlist/explanation`);
@@ -7,6 +45,13 @@ export function createPreDownloadCandidateBlockingWarnings(asset) {
     if (asset.access === "direct-download" && !(asset.downloadUrl ?? asset.url)) {
         warnings.push("direct-download candidate is missing a download URL");
     }
+    const triangles = catalogTriangles(asset);
+    const floor = provenanceMinTriangles(asset, profile);
+    if (triangles !== undefined && floor !== undefined && triangles < floor) {
+        const role = asset.intendedRole === "vehicle" ? "vehicle" : "humanoid";
+        warnings.push(`catalog reports ${triangles} triangles, below the ${role} structural floor of ${floor}; this is a distant-prop shell, not a hero subject`);
+    }
+    warnings.push(...boundsAspectWarnings(asset.bounds?.size ?? asset.dimensions, "catalog"));
     return warnings;
 }
 export function createPostDownloadCandidateBlockingWarnings(asset, inspection, profile) {
@@ -35,6 +80,20 @@ export function createPostDownloadCandidateBlockingWarnings(asset, inspection, p
     if (inspection.warnings.some((warning) => warning.includes("invisible or unreadable"))) {
         warnings.push("downloaded file contains invisible or unreadable materials");
     }
+    // Mirror the Meshy triangle floor post-download: a catalog count that looked
+    // fine (or was absent) still refuses when the role needs a hero subject and
+    // the measured catalog count is a shell. Profile-aware so an explicit
+    // character profile enforces the humanoid floor even when the catalog left
+    // `intendedRole` blank.
+    const postTriangles = catalogTriangles(asset);
+    const postFloor = provenanceMinTriangles(asset, profile);
+    if (postTriangles !== undefined && postFloor !== undefined && postTriangles < postFloor) {
+        const role = postFloor === PROVENANCE_VEHICLE_MIN_TRIANGLES && asset.intendedRole === "vehicle" ? "vehicle" : "humanoid";
+        warnings.push(`catalog reports ${postTriangles} triangles, below the ${role} structural floor of ${postFloor}; this is a distant-prop shell, not a hero subject`);
+    }
+    if (inspection.bounds) {
+        warnings.push(...boundsAspectWarnings(inspection.bounds, "downloaded file"));
+    }
     return warnings;
 }
 export function createResolveCandidateProvenance(candidate, query, score, inspection) {