@hypit/hypit 0.1.12 → 0.1.14

package/packages/hyperframes/src/document.ts

@@ -229,23 +229,22 @@ function exactFontStyle(element: VisualElement, stableId: StableDomId): string[]
   ];
 }
 
-function renderElement(
-  element: VisualElement,
-  children: ReadonlyMap<string, readonly VisualElement[]>,
-  context: {
-    readonly trackId: string;
-    readonly presentId: string;
-    readonly presentStart: string;
-    readonly presentDuration: string;
-    readonly presentDurationFrames: number;
-    readonly presentStartFrame: number;
-    readonly programNumerator: number;
-    readonly programDenominator: number;
-    readonly stackIndex: number;
-    readonly emittedFilterIds: Set<string>;
-    readonly stableId: StableDomId;
-  },
-): string {
+type ElementContext = {
+  readonly trackId: string;
+  readonly presentId: string;
+  readonly presentStart: string;
+  readonly presentDuration: string;
+  readonly presentDurationFrames: number;
+  readonly presentStartFrame: number;
+  readonly programNumerator: number;
+  readonly programDenominator: number;
+  readonly stackIndex: number;
+  readonly emittedFilterIds: Set<string>;
+  readonly stableId: StableDomId;
+};
+
+/** Every emitted element, including SVG mask sources, keeps the same authored frame clock. */
+function elementPresentation(element: VisualElement, context: ElementContext) {
   const id = context.stableId([context.trackId, context.presentId, element.id]);
   const animationName = element.animation === undefined
     ? undefined
@@ -277,6 +276,16 @@ function renderElement(
     ? ""
     : ` data-hypit-frame-animation data-hypit-animation-start-frame="${context.presentStartFrame}" data-hypit-animation-duration-frames="${animationDurationFrames}" data-hypit-animation-sample-frames="${context.presentDurationFrames}" data-hypit-animation-properties="${animationProperties.join(",")}"`;
   const common = `${commonAttributes}${animationAttributes} style="${escapeHtml(inlineStyle)}"`;
+  return { inlineStyle, commonAttributes: `${commonAttributes}${animationAttributes}`, common };
+}
+
+function renderElement(
+  element: VisualElement,
+  children: ReadonlyMap<string, readonly VisualElement[]>,
+  context: ElementContext,
+): string {
+  const { inlineStyle, commonAttributes, common } = elementPresentation(element, context);
+  const id = context.stableId([context.trackId, context.presentId, element.id]);
   if (element.kind === "mask") {
     const direct = children.get(element.id) ?? [];
     const maskRoot = direct.find((child) => child.id === element.maskElement);
@@ -295,6 +304,7 @@ function renderElement(
       throw new Error(`Local mask ${element.id} mask source must be one terminal owned element.`);
     }
     const maskSource = (() => {
+      const sourcePresentation = elementPresentation(maskRoot, context);
       if (maskRoot.kind === "text") {
         const alignment = maskRoot.style.find((declaration) => declaration.name === "text-align")?.value;
         const anchor = alignment === "right" || alignment === "end" ? "end" : alignment === "left" || alignment === "start" ? "start" : "middle";
@@ -310,17 +320,17 @@ function renderElement(
           ? blockAlignment === "flex-start" ? "0" : blockAlignment === "flex-end" ? "100%" : "50%"
           : String(blockAlignment === "flex-start" ? paddingTop : blockAlignment === "flex-end" ? maskHeight - paddingBottom : (paddingTop + maskHeight - paddingBottom) / 2);
         const baseline = blockAlignment === "flex-start" ? "text-before-edge" : blockAlignment === "flex-end" ? "text-after-edge" : "central";
-        const textStyle = [css(maskRoot.style), ...exactFontStyle(maskRoot, context.stableId), "fill:currentColor"].filter(Boolean).join(";");
-        return `<text${attributes(maskRoot.attributes)} x="${x}" y="${y}" text-anchor="${anchor}" dominant-baseline="${baseline}" style="${escapeHtml(textStyle)}">${escapeHtml(maskRoot.text)}</text>`;
+        const textStyle = `${sourcePresentation.inlineStyle};fill:currentColor`;
+        return `<text ${sourcePresentation.commonAttributes} x="${x}" y="${y}" text-anchor="${anchor}" dominant-baseline="${baseline}" style="${escapeHtml(textStyle)}">${escapeHtml(maskRoot.text)}</text>`;
       }
       if (maskRoot.kind === "text-flow" || maskRoot.kind === "path-text") {
         return `<foreignObject x="0" y="0" width="100%" height="100%"><div xmlns="http://www.w3.org/1999/xhtml" style="position:relative;width:100%;height:100%">${renderOwned(maskRoot)}</div></foreignObject>`;
       }
       if (maskRoot.kind === "image") {
-        return `<image x="0" y="0" width="100%" height="100%" preserveAspectRatio="none" href="${escapeHtml(hyperframesResourceUri(maskRoot.artifact.resource))}" style="${escapeHtml(css(maskRoot.style))}"/>`;
+        return `<image ${sourcePresentation.common} x="0" y="0" width="100%" height="100%" preserveAspectRatio="none" href="${escapeHtml(hyperframesResourceUri(maskRoot.artifact.resource))}"/>`;
       }
       if (maskRoot.kind === "surface" && maskRoot.surface.timing.kind === "still") {
-        return `<image data-hypit-surface-resource="${maskRoot.surface.artifact.resource}" x="0" y="0" width="100%" height="100%" preserveAspectRatio="none" href="${escapeHtml(hyperframesResourceUri(maskRoot.surface.artifact.resource))}" style="${escapeHtml(css(maskRoot.style))}"/>`;
+        return `<image ${sourcePresentation.common} data-hypit-surface-resource="${maskRoot.surface.artifact.resource}" x="0" y="0" width="100%" height="100%" preserveAspectRatio="none" href="${escapeHtml(hyperframesResourceUri(maskRoot.surface.artifact.resource))}"/>`;
       }
       throw new Error(`Local mask ${element.id} requires a terminal owned text, image or still Surface mask source.`);
     })();

package/packages/hyperframes/src/project.ts

@@ -12,9 +12,10 @@ export type HyperframesArtifactReader = (
   artifact: BlobRef,
   signal?: AbortSignal,
 ) => Promise<Uint8Array | AsyncIterable<Uint8Array>>;
+/** Inspect the completed staged file; its lifetime belongs to the staging caller. */
 export type HyperframesSurfaceValidator = (
   surface: CompositableSurfaceRef,
-  bytes: Uint8Array,
+  path: string,
   signal?: AbortSignal,
 ) => Promise<void>;
 
@@ -39,9 +40,7 @@ function extension(mediaType: string): string {
 /**
  * Lay one document out as a directory HyperFrames can render.
  *
- * The same layout serves a local render and a distributed one: the local
- * Provider serves it to the capture engine, and the AWS Provider tars it into a site. If
- * the two laid it out differently, one Need would name two different projects.
+ * A local or hosted Provider can serve the same staged document to its capture engine.
  * Resource names are local to this staged project and carry no content claim.
  */
 export async function stageHyperframesProject(options: {
@@ -63,25 +62,25 @@ export async function stageHyperframesProject(options: {
   await mkdir(artifactDirectory, { recursive: true });
   const paths = new Map<string, string>();
   const surfaces = new Map(document.surfaces.map((surface) => [surface.artifact.resource, surface]));
-  await Promise.allSettled(document.artifacts.map(async (artifact) => {
+  await Promise.allSettled(document.artifacts.map(async (artifact, index) => {
     try {
       signal.throwIfAborted();
-      const name = `${artifact.resource}${extension(artifact.mediaType)}`;
+      // Resource identities are portable protocol values, not filesystem names.
+      const name = `asset-${index}${extension(artifact.mediaType)}`;
       const opened = await read(artifact, signal);
       signal.throwIfAborted();
       const chunks = opened instanceof Uint8Array
         ? (async function* () { yield opened; })()
         : opened;
       const surface = surfaces.get(artifact.resource);
-      const retained: Uint8Array[] = [];
       let size = 0;
-      const target = await open(join(artifactDirectory, name), "w");
+      const path = join(artifactDirectory, name);
+      const target = await open(path, "w");
       try {
         for await (const chunk of chunks) {
           signal.throwIfAborted();
-          await target.write(chunk);
+          await target.writeFile(chunk);
           size += chunk.byteLength;
-          if (surface !== undefined) retained.push(Uint8Array.from(chunk));
         }
       } finally {
         await target.close();
@@ -89,17 +88,9 @@ export async function stageHyperframesProject(options: {
       if (size !== artifact.size) {
         throw new Error(`HyperFrames Artifact ${artifact.resource} size differs`);
       }
-      const bytes = surface === undefined ? undefined : (() => {
-        const value = new Uint8Array(size);
-        let offset = 0;
-        for (const chunk of retained) {
-          value.set(chunk, offset);
-          offset += chunk.byteLength;
-        }
-        return value;
-      })();
       if (surface !== undefined) {
-        await options.validateSurface!(structuredClone(surface), bytes!.slice(), signal);
+        // The validator borrows the completed staged file for this call only.
+        await options.validateSurface!(structuredClone(surface), path, signal);
       }
       paths.set(artifact.resource, `./artifacts/${name}`);
     } catch (error) {

package/packages/media-execution/README.md

@@ -26,6 +26,13 @@ deployments can reuse the same functions to preserve stream selection, timing, c
 This is not an author package, Provider, queue or Core extension. It performs no endpoint selection,
 credential lookup or SVML parsing.
 
+`verifyCompositableSurfaceFile({ surface, path, ... })` inspects a file already staged by an execution
+owner. That owner must keep it unchanged until the call settles, including cancellation; inspection
+neither copies nor removes it. `verifyCompositableSurfaceBytes({ surface, bytes, ... })` remains a
+convenience wrapper for callers that have bytes, creates its own temporary file, and removes that
+file only after probing has settled. Both use the same decoded Surface checks and return no extra
+result facts. Filesystem paths belong to this Node execution boundary, not to Surface or Blob refs.
+
 Audio gain envelopes and audible subranges are evaluated per sample after tempo/looping and Clip
 fades, before the requested range is cropped. Original source and envelope progress therefore survive
 local silence and range rendering. This is generic AudioProgramPlan execution, independent of author

package/packages/media-execution/src/execute.ts

@@ -33,6 +33,7 @@ import {
   } from "@hypit/protocol";
 import type { BlobRef, CanonicalValue, StoredValue } from "@hypit/protocol";
 
+import { mediaProcessEnv } from "./process-env.js";
 import { parseMediaInspection } from "./probe.js";
 import {
   compositeAnimatedWebpFrame,
@@ -98,10 +99,7 @@ async function runProcess(args: {
       shell: false,
       windowsHide: true,
       stdio: ["ignore", "pipe", "pipe"],
-      env: {
-        PATH: process.env.PATH ?? "",
-        ...(args.sharedLibraryPath === undefined ? {} : { LD_LIBRARY_PATH: args.sharedLibraryPath }),
-      },
+      env: mediaProcessEnv(args.sharedLibraryPath === undefined ? undefined : { LD_LIBRARY_PATH: args.sharedLibraryPath }),
     });
     const stdout: Buffer[] = [];
     let stdoutBytes = 0;
@@ -678,8 +676,10 @@ export async function executeNormalizeMedia(
         "scale=trunc(iw*max(sar\\,1)/2)*2:trunc(ih*max(1/sar\\,1)/2)*2",
         "setsar=1",
       ].join(",");
+      // FFmpeg enables autorotation by default. Its positive boolean option changed
+      // syntax across releases; no override is needed to materialize source rotation.
       const visualInput = animation === undefined
-        ? [...encoding.inputArgs, "-autorotate", "-i", input, "-map", `0:${plan.video.index}`]
+        ? [...encoding.inputArgs, "-i", input, "-map", `0:${plan.video.index}`]
         : ["-f", "concat", "-safe", "0", "-i", await animatedWebpConcat(env, animation, work), "-map", "0:v:0"];
       // The execution format must retain the source's alpha while materializing
       // the program clock. Both encodings publish the same SynchronizedMedia type.

package/packages/media-execution/src/index.ts

@@ -10,7 +10,7 @@ export {
   executeTransformMedia,
 } from "./execute.js";
 export { parseMediaInspection } from "./probe.js";
-export { verifyCompositableSurfaceBytes } from "./surface.js";
+export { verifyCompositableSurfaceBytes, verifyCompositableSurfaceFile } from "./surface.js";
 export { probeMediaToolchain } from "./toolchain.js";
 export type { MediaToolchainState } from "./toolchain.js";
 export type * from "./execute.js";

package/packages/media-execution/src/process-env.ts

@@ -0,0 +1,20 @@
+const windowsProcessCreation = ["PATHEXT", "SYSTEMROOT", "WINDIR", "ComSpec"] as const;
+
+/**
+ * ffmpeg and ffprobe are started as PATH executables. The Host environment is
+ * not forwarded, so credential values stay out of those processes. Windows still
+ * needs the process-creation variables CreateProcess uses to resolve `.exe`.
+ */
+export function mediaProcessEnv(
+  extra?: Readonly<Record<string, string>>,
+): NodeJS.ProcessEnv {
+  const env: NodeJS.ProcessEnv = { PATH: process.env.PATH ?? "" };
+  if (process.platform === "win32") {
+    for (const name of windowsProcessCreation) {
+      const value = process.env[name];
+      if (value !== undefined && value.length > 0) env[name] = value;
+    }
+  }
+  if (extra !== undefined) Object.assign(env, extra);
+  return env;
+}

package/packages/media-execution/src/surface.ts

@@ -1,9 +1,10 @@
 import { spawn } from "node:child_process";
-import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { mkdtemp, rm, stat, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
 import { assertCompositableSurfaceRef } from "@hypit/media";
+import { mediaProcessEnv } from "./process-env.js";
 import type { CompositableSurfaceRef } from "@hypit/media";
 
 type JsonObject = Record<string, unknown>;
@@ -57,7 +58,7 @@ async function runProcess(args: {
       shell: false,
       windowsHide: true,
       stdio: ["ignore", "pipe", "pipe"],
-      env: { PATH: process.env.PATH ?? "" },
+      env: mediaProcessEnv(),
     });
     const stdout: Buffer[] = [];
     let bytes = 0;
@@ -192,95 +193,101 @@ async function pixelFormatAlpha(
   return result;
 }
 
-function suffix(mediaType: string): string {
-  if (mediaType === "image/png") return ".png";
-  if (mediaType === "image/webp") return ".webp";
-  if (mediaType === "video/webm") return ".webm";
-  if (mediaType === "video/mp4") return ".mp4";
-  throw new Error(`Surface media type ${mediaType} is unsupported`);
-}
-
-/**
- * Decode and verify one typed Surface before its bytes enter a renderer.
- *
- * This is an admission gate, not a second media Product. Success returns no
- * side-channel facts; anything a later graph step needs must be an explicit output.
- */
-export async function verifyCompositableSurfaceBytes(options: {
+type SurfaceInspectionOptions = {
   readonly surface: CompositableSurfaceRef;
-  readonly bytes: Uint8Array;
   readonly ffprobePath?: string;
   readonly processTimeoutMs?: number;
   readonly maxProbeOutputBytes?: number;
   readonly signal?: AbortSignal;
+};
+
+/** Inspect bytes supplied by callers that do not already own a staged file. */
+export async function verifyCompositableSurfaceBytes(options: SurfaceInspectionOptions & {
+  readonly bytes: Uint8Array;
+}): Promise<void> {
+  options.signal?.throwIfAborted();
+  assertCompositableSurfaceRef(options.surface);
+  assert(options.bytes.byteLength === options.surface.artifact.size,
+    `Surface ${options.surface.artifact.resource} byte size differs`);
+  const directory = await mkdtemp(join(tmpdir(), "hypit-surface-verify-"));
+  try {
+    // FFprobe detects the encoded media itself; both entry points inspect the same formats.
+    const path = join(directory, "surface");
+    await writeFile(path, options.bytes, { signal: options.signal });
+    await verifyCompositableSurfaceFile({ ...options, path });
+  } finally {
+    await rm(directory, { recursive: true, force: true }).catch(() => {});
+  }
+}
+
+/**
+ * Inspect an existing execution file without copying it. The caller owns the file
+ * and keeps it unchanged until this call settles. Success returns no side-channel facts.
+ */
+export async function verifyCompositableSurfaceFile(options: SurfaceInspectionOptions & {
+  readonly path: string;
 }): Promise<void> {
   const controller = new AbortController();
   const signal = options.signal === undefined ? controller.signal : AbortSignal.any([controller.signal, options.signal]);
   signal.throwIfAborted();
   assertCompositableSurfaceRef(options.surface);
-  assert(options.bytes.byteLength === options.surface.artifact.size,
+  assert((await stat(options.path)).size === options.surface.artifact.size,
     `Surface ${options.surface.artifact.resource} byte size differs`);
+  signal.throwIfAborted();
   const ffprobePath = options.ffprobePath ?? "ffprobe";
   const timeoutMs = options.processTimeoutMs ?? 120_000;
   const maxOutputBytes = options.maxProbeOutputBytes ?? 8 * 1024 * 1024;
-  const directory = await mkdtemp(join(tmpdir(), "hypit-surface-verify-"));
-  try {
-    const path = join(directory, `surface${suffix(options.surface.artifact.mediaType)}`);
-    await writeFile(path, options.bytes, { signal });
-    const pending = [
-      runProcess({
-        executable: ffprobePath,
-        argv: ["-v", "error", "-print_format", "json", "-show_streams", "-count_frames", path],
-        timeoutMs,
-        maxOutputBytes, signal,
-      }),
-      pixelFormatAlpha(ffprobePath, timeoutMs, maxOutputBytes, signal),
-    ] as const;
-    await Promise.allSettled(pending.map(async (job) => {
-      try { return await job; } catch (error) { controller.abort(error); throw error; }
-    }));
-    signal.throwIfAborted();
-    const [probe, formats] = await Promise.all(pending);
-    const root = json(probe, "ffprobe Surface query");
-    assert(Array.isArray(root.streams) && root.streams.length === 1,
-      "Surface must contain exactly one visual stream and no audio or auxiliary streams");
-    const stream = root.streams[0] as ProbeStream;
-    assert(stream.codec_type === "video", "Surface stream is not visual");
-    assert(stream.disposition?.attached_pic !== 1, "Surface cannot be an attached-picture stream");
-    const width = positiveInteger(stream.width, "Surface width");
-    const height = positiveInteger(stream.height, "Surface height");
-    assert(width === options.surface.width && height === options.surface.height,
-      "Surface decoded dimensions differ from its declaration");
-    assert(stream.sample_aspect_ratio === undefined || stream.sample_aspect_ratio === "1:1",
-      "Surface must use square pixels");
-    assert(rotation(stream) === 0, "Surface must not depend on display rotation metadata");
-    assert(stream.field_order === undefined || stream.field_order === "progressive" || stream.field_order === "unknown",
-      "Surface must be progressive");
-    assertSrgb(stream);
+  const pending = [
+    runProcess({
+      executable: ffprobePath,
+      argv: ["-v", "error", "-print_format", "json", "-show_streams", "-count_frames", options.path],
+      timeoutMs,
+      maxOutputBytes, signal,
+    }),
+    pixelFormatAlpha(ffprobePath, timeoutMs, maxOutputBytes, signal),
+  ] as const;
+  await Promise.allSettled(pending.map(async (job) => {
+    try { return await job; } catch (error) { controller.abort(error); throw error; }
+  }));
+  signal.throwIfAborted();
+  const [probe, formats] = await Promise.all(pending);
+  const root = json(probe, "ffprobe Surface query");
+  assert(Array.isArray(root.streams) && root.streams.length === 1,
+    "Surface must contain exactly one visual stream and no audio or auxiliary streams");
+  const stream = root.streams[0] as ProbeStream;
+  assert(stream.codec_type === "video", "Surface stream is not visual");
+  assert(stream.disposition?.attached_pic !== 1, "Surface cannot be an attached-picture stream");
+  const width = positiveInteger(stream.width, "Surface width");
+  const height = positiveInteger(stream.height, "Surface height");
+  assert(width === options.surface.width && height === options.surface.height,
+    "Surface decoded dimensions differ from its declaration");
+  assert(stream.sample_aspect_ratio === undefined || stream.sample_aspect_ratio === "1:1",
+    "Surface must use square pixels");
+  assert(rotation(stream) === 0, "Surface must not depend on display rotation metadata");
+  assert(stream.field_order === undefined || stream.field_order === "progressive" || stream.field_order === "unknown",
+    "Surface must be progressive");
+  assertSrgb(stream);
 
-    assert(typeof stream.pix_fmt === "string" && stream.pix_fmt.length > 0,
-      "Surface pixel format is absent");
-    const pixelAlpha = formats.get(stream.pix_fmt);
-    assert(pixelAlpha !== undefined, `Surface pixel format ${stream.pix_fmt} is unknown to ffprobe`);
-    const taggedAlpha = stream.tags?.alpha_mode === "1" || stream.tags?.alpha_mode === "straight";
-    const hasAlpha = pixelAlpha || taggedAlpha;
-    if (options.surface.alphaMode === "straight") {
-      assert(hasAlpha, "Surface declares straight alpha but its bytes carry no alpha channel");
-    } else {
-      assert(!hasAlpha, "Surface declares opaque pixels but its encoded format carries alpha");
-    }
+  assert(typeof stream.pix_fmt === "string" && stream.pix_fmt.length > 0,
+    "Surface pixel format is absent");
+  const pixelAlpha = formats.get(stream.pix_fmt);
+  assert(pixelAlpha !== undefined, `Surface pixel format ${stream.pix_fmt} is unknown to ffprobe`);
+  const taggedAlpha = stream.tags?.alpha_mode === "1" || stream.tags?.alpha_mode === "straight";
+  const hasAlpha = pixelAlpha || taggedAlpha;
+  if (options.surface.alphaMode === "straight") {
+    assert(hasAlpha, "Surface declares straight alpha but its bytes carry no alpha channel");
+  } else {
+    assert(!hasAlpha, "Surface declares opaque pixels but its encoded format carries alpha");
+  }
 
-    const frameCount = positiveInteger(stream.nb_read_frames ?? stream.nb_frames, "Surface frame count");
-    if (options.surface.timing.kind === "still") {
-      assert(frameCount === 1, "Still Surface must decode to exactly one frame");
-    } else {
-      assert(frameCount === options.surface.timing.frameCount,
-        "Surface decoded frame count differs from its declaration");
-      const rate = rational(stream.avg_frame_rate ?? stream.r_frame_rate, "Surface frame rate");
-      assert(sameRational(rate, options.surface.timing.frameRate),
-        "Surface decoded frame rate differs from its declaration");
-    }
-  } finally {
-    await rm(directory, { recursive: true, force: true }).catch(() => {});
+  const frameCount = positiveInteger(stream.nb_read_frames ?? stream.nb_frames, "Surface frame count");
+  if (options.surface.timing.kind === "still") {
+    assert(frameCount === 1, "Still Surface must decode to exactly one frame");
+  } else {
+    assert(frameCount === options.surface.timing.frameCount,
+      "Surface decoded frame count differs from its declaration");
+    const rate = rational(stream.avg_frame_rate ?? stream.r_frame_rate, "Surface frame rate");
+    assert(sameRational(rate, options.surface.timing.frameRate),
+      "Surface decoded frame rate differs from its declaration");
   }
 }

package/packages/model-kit/README.md

@@ -50,3 +50,31 @@ exact fields, constraints, model identity, capability name and validator. The he
 Provider routing, fallback, credentials or Runtime authority.
 
 This is a package-authoring utility, not an author-importable model by itself.
+
+## Model-owned request checks
+
+An endpoint may supply two synchronous, pure functions in addition to its port table:
+
+- `validateInputs(inputs)` checks values already supplied, both in drafts and complete requests.
+  Text and media may still be missing from a draft. Use this for rules such as a reference's media
+  type; do not require a future input to exist.
+- `validateRequest(request)` checks additional relationships that require the complete request.
+  It runs after the port table and `validateInputs`, when every required input is available.
+
+Both return `void` and throw a useful error to reject. They read the supplied values only: no IO,
+Provider selection, request mutation or saved validation result. Existing port rules remain in the
+port table. The helper supplies structural validation before calling either function.
+
+Register each rule once in the endpoint definition. The helper connects these functions to Type
+validators, media/Text bindings, finalization, generation and planning. Planning checks the known
+values and leaves future media on the existing graph edges. A directly supplied request or an
+existing Need receives full validation, just as it does during execution.
+
+For a public request builder, use `model.endpoints.image.sealRequest(ports)`: it canonicalizes the
+request and applies all model rules. `endpoint.validateRequest(value)` checks an existing complete
+request; `endpoint.validateDraft(value)` checks a partially assembled one. Calling the common
+generation port helpers alone applies only the port table, not these model-owned functions.
+
+Keep service-specific limits in the Provider. Its existing `supports` and pre-submission preparation
+should share its own checks, rejecting known unsupported values before resource transfer. This does
+not require the Provider to import the Model implementation or add any fields to the request.