@kodax-ai/kodax 0.7.97-alpha.6 → 0.7.97-alpha.8

package/CHANGELOG.md

@@ -8,6 +8,51 @@ All notable changes to this project will be documented in this file.
 
 ---
 
+## [0.7.97-alpha.8] - 2026-10-18
+
+Eighth alpha of the v0.7.97 line: the Artifact SDK ships inside the single
+main package — `@kodax-ai/kodax` gains `/artifacts`, `/artifacts/client`,
+`/artifacts/runtime` and `/artifacts/kodax` subpath exports while the
+workspace module turns private, its pinned dependencies declare in the root
+package, and the declared Node floor advances to 20.16. Every v0.7.96
+stable and v0.7.97-alpha.1 through alpha.7 contract is retained. npm
+publication remains a manual maintainer action.
+
+### Changed
+
+- Single-package Artifact distribution: the main tarball stages the existing module/worker/resource layout under `dist/artifacts/`, the tarball audit validates every export/entry/dependency, the Release workflow runs an installed-package Artifact gate, and `release.mjs` rejects a separate `--artifacts` publication. There is no separate `@kodax-ai/artifacts` npm package. Core startup stays free of renderer loading and probes.
+
+---
+
+## [0.7.97-alpha.7] - 2026-10-16
+
+Seventh alpha of the v0.7.97 line: shared-Session Host ownership resolves
+across daemon profiles — launchers wait for a starting owner's verified
+descriptor within the original startup deadline, reuse compatible Hosts
+without restarting work, and permit only a guarded same-build orphan-exit
+policy refresh — daemon startup and connection timeouts surface as
+structured, retryable failures, idle interactive Hosts retire after a
+bounded 30-second lifetime while explicit daemon/A2A service owners are
+retained, and Windows SDK attachment reads targeted exact identities within
+the original startup controls (Space #222). Every v0.7.96 stable and
+v0.7.97-alpha.1 through alpha.6 contract is retained. npm publication
+remains a manual maintainer action.
+
+### Fixed
+
+- Space Issue 222 CI regression: use one conservative process-liveness check for shared storage discovery, daemon health and verified exit, recognizing unreaped Linux zombies while retaining PID generation checks. Release temporary attachments and rediscover current ownership on bounded startup-only retries within the original deadline and cancellation signal; never replay accepted input or tool work. Gate the original crash cases and deterministic zombie/owner-handoff regressions on Linux Node 20/22 before release.
+- Bound Windows startup cleanup of unverifiable historical child records: the automatic historical sweep keeps incomplete Run trees `unknown` instead of launching a PowerShell termination helper per unverified record — a helper storm that invalidated the shared process snapshot and made startup cost grow with history (24-record fixture: 11,069ms and 48 helpers before, 10ms and none after). Exact-handle Run recovery and verified live-descendant cleanup are preserved.
+- Bound Windows SDK attachment work: fresh PID identity checks read targeted exact FILETIME identities instead of repeatedly scanning the full process table, initial Job ownership evidence is collected together, and the original startup deadline passes through readiness and attachment — expired startup stays an expired failure instead of misclassifying the launcher's own new Host as a competitor (nine isolated same-CPU callers reproduced the timeout and now pass without budget increases). Readiness keeps verified-owner status fresh after authenticated OS inspection, checks deadline/cancellation after final owner/build validation, and aborts pending socket/supervisor readiness through existing cleanup paths; discovery that has crossed its boundary no longer opens attachment leases, and the idle inspection cancels when clients attach.
+- Recognize a starting daemon as an existing owner: a concurrent CLI start while initial A2A reconciliation holds the fence before `daemon.json` exists now reports `already_running` against the actual PID/runtimeId instead of claiming a second `started: true` Host.
+- Retire idle interactive Hosts after the accepted 30-second CLI idle lifetime while retaining explicit services: daemon `start` and A2A-serving owners stay in place, explicit/service retention is authenticated separately from default SDK persistence, conflicting orphan-exit requirements are rejected before shutdown, persistent intent survives rebuild refresh, and configured services are re-evaluated in the replacement Host. Idle exit is fenced on pending memory/managed-task maintenance and unknown legacy startup intent; tracked background work blocks automatic idle exit (including the final draining check) without breaking cancellable explicit shutdown, review or compaction contracts; startup admission uses authenticated read-only checks off idle preflight scans without scanning Session history before any real client.
+- Drain a Run queued after its predecessor finishes: admission can retain its queued decision across asynchronous journal binding while the active predecessor completes and drains an empty queue; the existing guarded drain now wakes after queue publication so the queued Run starts exactly once instead of stranding.
+- Keep the preceding turn visible when submitting a new query in a restored Session with legacy display checkpoints. The Host retains its bounded 150-item tail instead of advancing to the next query and collapsing the entire view to the new input; canonical history, full-item reads and input/tool identities are preserved.
+- Keep saved history readable when its final tool call has no result yet: reaching the end of a valid cached revision no longer reports a history-change conflict. Preserve canonical tool timestamps across observed and paged history, and show the session banner only at the beginning of saved history while browsing ordinary chat, avoiding banner flashes at intermediate page boundaries.
+- Space Issue 222: resolve the daemon that owns the canonical Session directory across profiles before startup, and recheck ownership if a peer wins during bootstrap. Wait for a starting owner's descriptor within the original startup deadline and cancellation signal. Reuse compatible Hosts without restarting work. Permit guarded same-build orphan-exit policy refresh, retaining active-work preflight, exact owner identity and process-exit verification. Publish structured owner/profile and upgrade blocker diagnostics; mark transient blockers retryable.
+- Add bundled real-process shared-Host recovery to the continuous `test:bundle` gate.
+
+---
+
 ## [0.7.97-alpha.6] - 2026-10-15
 
 Sixth alpha of the v0.7.97 line: shared-Host startup runs historical child
@@ -74,7 +119,7 @@ Validation: 16,589 tests passed, with package/bundle/native/type checks recorded
 in the [regression guide](docs/test-guides/FEATURE_301_v0.7.97_TEST_GUIDE.md).
 Natural-task GLM/DeepSeek smoke observed automatic image review, but full
 repair/re-review/delivery has not passed all checks. Native DOCX fidelity and
-model-facing schema gaps remain open; see [E2E evidence](docs/research/automatic-visual-review-e2e-2026-10-13.md).
+model-facing schema gaps remain open; see [E2E evidence](docs/test-guides/FEATURE_301_v0.7.97_TEST_GUIDE.md#natural-task-observations-2026-10-13).
 
 ---
 

package/README.md

@@ -494,6 +494,11 @@ kodax -p "Review this repository"
 kodax daemon stop --profile default
 ```
 
+An ordinary CLI-started Host exits after its last client disconnects and governed
+work has remained idle for 30 seconds. Reconnecting cancels that idle exit.
+`kodax daemon start` retains the current Host (including an existing temporary
+Host); a Host serving configured A2A also stays available without CLI clients.
+
 Tests that start an isolated Host must close that exact Host after its work has
 settled, before removing its temporary home. Never stop arbitrary Node processes.
 With no explicit home, CLI and SDK use the resolved `KODAX_HOME`; explicit
@@ -773,8 +778,8 @@ provider's model, REPL `/compact` clears the UI only after a durable save, and
 successful reports carry bounded `summaryRequests` plus `commitMs` per
 physical summary call.
 
-**v0.7.97-alpha.4 release:** Adds the independent `@kodax-ai/artifacts`
-package — PPTX authoring, bounded editing, and current-file visual
+**v0.7.97-alpha.4 source release:** Adds the optional Artifact SDK workspace
+— PPTX authoring, bounded editing, and current-file visual
 evidence through lightweight rendering (optional LibreOffice/PDF conversion) — with an optional managed
 KodaX adapter (FEATURE_301), and retires the out-of-band Sidecar
 Verifier: the main agent now verifies requested requirements with actual
@@ -789,6 +794,32 @@ starts, upgrades, or waits. See
 Every v0.7.96 stable and v0.7.97-alpha.1/alpha.2/alpha.3 contract is
 retained.
 
+**v0.7.97-alpha.8 release:** Ships the Artifact SDK inside the single main
+package — `@kodax-ai/kodax` gains `/artifacts`, `/artifacts/client`,
+`/artifacts/runtime` and `/artifacts/kodax` subpath exports; the workspace
+module turns private (no separate artifacts npm package), its pinned
+dependencies declare in the root package, and the declared Node floor
+advances to 20.16, with tarball-audit and installed-package Release gates.
+See the
+[v0.7.97-alpha.8 release notes](docs/release.md#v0797-alpha8-release-preparation).
+Every v0.7.96 stable and v0.7.97-alpha.1 through alpha.7 contract is
+retained.
+
+**v0.7.97-alpha.7 release:** Resolves shared-Session Host ownership across
+daemon profiles (Space #222) — launchers wait for a starting owner's verified
+descriptor within the original startup deadline, reuse compatible Hosts
+without restarting work, and permit only a guarded same-build orphan-exit
+policy refresh. Structured owner/profile and upgrade-blocker diagnostics
+publish, and daemon startup and connection timeouts surface as retryable
+`daemon_startup_failed` and `ETIMEDOUT` failures. Idle interactive Hosts
+retire after a bounded 30-second lifetime while explicit daemon/A2A service
+owners are retained, concurrent CLI starts recognize a starting daemon as
+the existing owner, and Windows SDK attachment reads targeted exact process
+identities within the original startup controls. See the
+[v0.7.97-alpha.7 release notes](docs/release.md#v0797-alpha7-release-preparation).
+Every v0.7.96 stable and v0.7.97-alpha.1 through alpha.6 contract is
+retained.
+
 **v0.7.97-alpha.6 release:** Streamlines shared-Host startup — historical
 child recovery runs once under the owner fences and preflight projects
 canonical Actor metadata without loading transcripts — and orders `kodax -r`,
@@ -1385,12 +1416,12 @@ kodax --repo-intelligence full --repo-intelligence-trace
 
 ## Architecture
 
-KodaX uses a **monorepo architecture** with npm workspaces. Four core packages ship in `@kodax-ai/kodax` with 13 SDK subpath exports (`/agent`, `/llm`, `/coding`, `/media`, `/repl`, `/skills`, `/mcp`, `/session`, `/client`, `/runtime`, `/sandbox`, `/a2a`, `/experimental-memory`; ADR-024 + ADR-032 + ADR-038, with ADR-036 consolidation). The independent optional `@kodax-ai/artifacts` package adds PPTX authoring/limited edits, PDF/image/SVG evidence, candidate DOCX preview, local HTML/SMIL capture, preparation and binary evidence reading. Core startup does not load renderers; the KodaX bridge uses managed permissions, sandbox and cancellation. [SDK support and limits](docs/ARTIFACT_SDK.md).
+KodaX uses a **monorepo architecture** with npm workspaces. Four core packages ship in `@kodax-ai/kodax` with 17 SDK subpath exports (`/agent`, `/llm`, `/coding`, `/media`, `/repl`, `/skills`, `/mcp`, `/session`, `/client`, `/runtime`, `/sandbox`, `/a2a`, `/experimental-memory`, `/artifacts`, `/artifacts/client`, `/artifacts/runtime`, `/artifacts/kodax`; ADR-024 + ADR-032 + ADR-038, with ADR-036 consolidation). The private `artifacts` source workspace adds optional APIs through the same main npm package: PPTX authoring/limited edits, PDF/image/SVG evidence, candidate DOCX preview, local HTML/SMIL capture, preparation and binary evidence reading. Core startup does not load renderers; the KodaX bridge uses managed permissions, sandbox and cancellation. [SDK support and limits](docs/ARTIFACT_SDK.md).
 
 ```
 KodaX/
 ├── packages/                # 4 core packages + optional artifacts
-│   ├── artifacts/           # Independent Artifact SDK + optional managed KodaX adapter
+│   ├── artifacts/           # Private Artifact SDK workspace; main-package subpaths
 │   ├── llm/                 # @kodax-ai/llm - LLM abstraction (16 built-in provider aliases)
 │   │   └── providers/       # Anthropic, OpenAI, DeepSeek, Kimi, MiMo, MiniMax, Zhipu, Ark, …
 │   │
@@ -1460,10 +1491,10 @@ Source-side workspace package names (`@kodax-ai/*`). npm consumers install the s
 
 KodaX has two layers that consumers should understand separately:
 
-- **Source-side**: 4 workspace packages above (what developers see when reading the repo).
-- **Current packaged exports** (not a claim of npm availability): a single bundled package `@kodax-ai/kodax` with 13 SDK subpaths (what SDK consumers `import` from). The subpaths are split into two roles:
+- **Source-side**: 4 core workspace packages plus the private Artifact workspace (what developers see when reading the repo).
+- **Current packaged exports** (not a claim of npm availability): a single bundled package `@kodax-ai/kodax` with 17 SDK subpaths (what SDK consumers `import` from). The subpaths are split into two roles:
   - **Full-package subpaths** (`/agent`, `/llm`, `/coding`, `/repl`) — each one maps 1:1 to a source workspace and exposes its complete public API.
-  - **Integration and narrow subpaths** (`/media`, `/skills`, `/mcp`, `/session`, `/client`, `/runtime`, `/sandbox`, `/a2a`, `/experimental-memory`) — focused host surfaces. `/a2a` composes the neutral F258 plane with the Runtime facade; it does not add A2A wire types to `/agent`.
+  - **Integration and narrow subpaths** (`/media`, `/skills`, `/mcp`, `/session`, `/client`, `/runtime`, `/sandbox`, `/a2a`, `/experimental-memory`, `/artifacts`, `/artifacts/client`, `/artifacts/runtime`, `/artifacts/kodax`) — focused host surfaces. `/a2a` composes the neutral F258 plane with the Runtime facade; it does not add A2A wire types to `/agent`.
 
 | Source package | npm subpath | Type | What you get | Example consumer |
 |---|---|---|---|---|
@@ -2070,11 +2101,11 @@ await runKodaX({
 
 ## SDK Usage
 
-This development tree exposes 13 SDK subpaths plus the root. Shared product
+This development tree exposes 17 SDK subpaths plus the root. Shared product
 applications use `@kodax-ai/kodax/client`; independent libraries and trusted Host
 APIs remain available through the other subpaths. See the [Client contract](docs/CLIENT_CONTRACT.md)
 and [SDK migration guide](docs/SDK_MIGRATION.md). This documentation was checked
-against package version `0.7.97-alpha.6`; npm publication is separate from
+against package version `0.7.97-alpha.8`; npm publication is separate from
 the current development-tree contract.
 
 ```bash

package/README_CN.md

@@ -303,7 +303,7 @@ SDK 系统代码契约更新，但没有放宽 shell/sandbox 的 fail-closed 边
 `handleRuntimePermissionRequest()` 管理 SDK 权限 UI，并在 prepared Session 尾部遇到
 `data_changed` 时通过权威 delta 合并恢复；后台持久化失败会显示为诊断，不再静默丢失。
 
-**v0.7.97-alpha.4 发布**：新增独立的 `@kodax-ai/artifacts` 包——PPTX 创作、
+**v0.7.97-alpha.4 发布**：新增可独立使用的 Artifact SDK 源码模块——PPTX 创作、
 有界编辑与当前文件视觉证据（轻量渲染，可选 LibreOffice/PDF 转换），并带可选的受管 KodaX
 适配器（FEATURE_301）；同时退役旁路 Sidecar Verifier：主 Agent 在交付前用
 真实工具与渲染证据核验每条需求，由内置 `visual-review` 技能覆盖静态、分页、
@@ -314,6 +314,23 @@ SDK 系统代码契约更新，但没有放宽 shell/sandbox 的 fail-closed 边
 [v0.7.97-alpha.4 发布清单](docs/release.md#v0797-alpha4-release-preparation)。
 所有 v0.7.96 稳定与 v0.7.97-alpha.1/alpha.2/alpha.3 契约全部保留。
 
+**v0.7.97-alpha.8 发布**：Artifact SDK 并入单一主包发布——`@kodax-ai/kodax` 新增
+`/artifacts`、`/artifacts/client`、`/artifacts/runtime`、`/artifacts/kodax` 四个
+子路径导出;工作区模块转为私有(不再独立发布 npm),固定依赖上移到根包声明,
+Node 最低版本提升到 20.16,tarball 审计与已安装包 Release 门同步就位。
+详见 [v0.7.97-alpha.8 发布清单](docs/release.md#v0797-alpha8-release-preparation)。
+所有 v0.7.96 稳定与 v0.7.97-alpha.1 至 alpha.7 契约全部保留。
+
+**v0.7.97-alpha.7 发布**：跨 daemon profile 解析共享 Session 存储的 Host
+归属（Space #222）——启动器在原启动期限内等待启动中 owner 的已验证描述符，
+兼容 Host 直接复用而不重启工作，仅允许受控的同构建 orphan-exit 策略刷新。
+结构化 owner/profile 与升级阻塞诊断对外发布，daemon 启动与连接超时以可重试的
+`daemon_startup_failed` 与 `ETIMEDOUT` 呈现。空闲的交互式 Host 在 30 秒生命周期后
+退隐而显式 daemon/A2A 服务 owner 保留;并发 CLI 启动识别启动中的 daemon 为既有
+owner;Windows SDK attach 在原启动控制内读取精确进程身份。
+详见 [v0.7.97-alpha.7 发布清单](docs/release.md#v0797-alpha7-release-preparation)。
+所有 v0.7.96 稳定与 v0.7.97-alpha.1 至 alpha.6 契约全部保留。
+
 **v0.7.97-alpha.6 发布**：精简共享 Host 启动——历史子进程恢复在 owner fence
 下只运行一次，预检投影规范 Actor 元数据而不加载 transcript；`kodax -r`、Host
 与 SDK 的 Session 列表按真实最近消息活动排序并暴露可选 `lastMessageAt`。
@@ -1125,6 +1142,8 @@ daemon 可承载多个 Session；不同 Session 可以并发，同一 Session
 
 显式独立库嵌入仍可使用 `/runtime` 的 `createKodaXRuntime({mode:'embedded'})`，其 owner 和退出责任属于调用者。这不是 CLI 的可选运行模式，也不是产品客户端的连接失败回退。当前包版本与发布状态见[SDK 迁移指南](docs/SDK_MIGRATION.md)。
 
+普通 CLI 自动拉起的 Host 在最后一个客户端断开、后台工作持续空闲 30 秒后退出；重新连接会取消空闲退出。显式 `kodax daemon start` 会保留当前 Host，即使它原先是临时 Host；承载已配置 A2A 服务的 Host 也会在没有 CLI 客户端时继续常驻。
+
 ### 7. 打包成单文件二进制（无需 Node）
 
 KodaX 可以用 `bun --compile` 打包成单可执行文件 + 一个 `builtin/` sidecar 目录，目标机器**不需要安装 Node.js 或任何运行时**。
@@ -1260,7 +1279,7 @@ kodax --repo-intelligence full --repo-intelligence-trace
 
 ## 仓库结构
 
-KodaX 是基于 npm workspaces 的 TypeScript monorepo，**4 个核心 workspace 包与独立可选 Artifact SDK**（FEATURE_194 v0.7.43 包合并 — 9 → 4，ADR-036），npm 上以单 bundle 包 `@kodax-ai/kodax` 发布 + 13 个 SDK subpath exports（`/agent`、`/llm`、`/coding`、`/media`、`/repl`、`/skills`、`/mcp`、`/session`、`/client`、`/runtime`、`/sandbox`、`/a2a`、`/experimental-memory`；ADR-024 + ADR-032 + ADR-038）。核心包：
+KodaX 是基于 npm workspaces 的 TypeScript monorepo，**4 个核心 workspace 包与私有 Artifact 源码模块**（FEATURE_194 v0.7.43 包合并 — 9 → 4，ADR-036），npm 上以单 bundle 包 `@kodax-ai/kodax` 发布 + 17 个 SDK subpath exports（`/agent`、`/llm`、`/coding`、`/media`、`/repl`、`/skills`、`/mcp`、`/session`、`/client`、`/runtime`、`/sandbox`、`/a2a`、`/experimental-memory`、`/artifacts`、`/artifacts/client`、`/artifacts/runtime`、`/artifacts/kodax`；ADR-024 + ADR-032 + ADR-038）。核心包：
 
 | Workspace 包 | 作用 | 主要依赖 |
 |----|------|---------|
@@ -1275,10 +1294,10 @@ KodaX 是基于 npm workspaces 的 TypeScript monorepo，**4 个核心 workspace
 
 KodaX 有两层结构，SDK 用户需要分开理解：
 
-- **源码层**：4 个核心 workspace 包，另有独立可选 `@kodax-ai/artifacts`：PPTX 创作/限定编辑，PDF/图片/SVG 取证、DOCX 轻量预览、本地网页与 SMIL 捕获，公共准备和真实图片读取。核心启动不加载渲染依赖；桥接沿用受管权限、沙箱和取消。[SDK 支持与限制](docs/ARTIFACT_SDK.md)。
-- **当前源码打包导出**（不表示已发布到 npm）：单个 bundled 包 `@kodax-ai/kodax`，对外暴露 13 个 SDK subpath（SDK 消费者 `import` 时看到的接口）。subpath 分两种角色：
+- **源码层**：4 个核心 workspace 包，另有私有可选 Artifact 源码 workspace，经同一主包 `/artifacts` 子路径交付：PPTX 创作/限定编辑，PDF/图片/SVG 取证、DOCX 轻量预览、本地网页与 SMIL 捕获，公共准备和真实图片读取。核心启动不加载渲染依赖；桥接沿用受管权限、沙箱和取消。[SDK 支持与限制](docs/ARTIFACT_SDK.md)。
+- **当前源码打包导出**（不表示已发布到 npm）：单个 bundled 包 `@kodax-ai/kodax`，对外暴露 17 个 SDK subpath（SDK 消费者 `import` 时看到的接口）。subpath 分两种角色：
   - **完整包 subpath**（`/agent`、`/llm`、`/coding`、`/repl`）—— 每个 1:1 对应一个源码包，暴露完整公开 API。
-  - **集成与窄子集 subpath**（`/media`、`/skills`、`/mcp`、`/session`、`/client`、`/runtime`、`/sandbox`、`/a2a`、`/experimental-memory`）—— 聚焦能力或宿主集成边界；`/experimental-memory` 明确为 opt-in 不稳定接口。
+  - **集成与窄子集 subpath**（`/media`、`/skills`、`/mcp`、`/session`、`/client`、`/runtime`、`/sandbox`、`/a2a`、`/experimental-memory`、`/artifacts`、`/artifacts/client`、`/artifacts/runtime`、`/artifacts/kodax`）—— 聚焦能力或宿主集成边界；`/experimental-memory` 明确为 opt-in 不稳定接口。
 
 | 源码包 | npm subpath | 类型 | 内容 | 典型消费者 |
 |---|---|---|---|---|
@@ -1450,7 +1469,7 @@ KodaX/                       # 4 workspace packages(FEATURE_194 v0.7.43)
 │   ├── kodax_cli.ts         # CLI 主入口（bin: `kodax`）
 │   └── sdk-*.ts             # SDK subpath 入口 → @kodax-ai/kodax/{agent,llm,coding,media,repl,skills,mcp,session,runtime,sandbox,a2a,experimental-memory}
 ├── scripts/
-│   ├── build-bundle.mjs     # esbuild 单 bundle 多 entry 打包（CLI + root + 13 SDK subpath + chunks）
+│   ├── build-bundle.mjs     # esbuild 单 bundle 多 entry 打包（CLI + root + 13 核心 SDK subpath + Artifact 资源 + chunks）
 │   ├── build-binary.mjs     # Bun --compile 单文件二进制打包
 │   └── release.mjs          # 发布 CI 构建的通用 tarball；本地 --pack-only 保持 private:true
 └── .github/workflows/

package/dist/artifacts/LICENSE

@@ -0,0 +1,158 @@
+KodaX-AI Fair Core License (KAI-FCL) 1.0
+
+Copyright (c) 2026 icetomoyo <icetomoyo@gmail.com> <icetomoyo@163.com>
+
+All rights reserved except as expressly granted in this License.
+
+This License applies to KodaX releases and files that include this LICENSE file
+or otherwise identify KAI-FCL as their governing license. Earlier KodaX
+releases or files that were distributed under the Apache License, Version 2.0
+remain licensed under Apache-2.0 for those released copies. Third-party
+components remain governed by their own license terms.
+
+Effective Version Notice
+
+KodaX-AI intends KAI-FCL to govern official KodaX distributions for version
+0.7.70 and later when those distributions are provided by KodaX-AI with this
+LICENSE file, a KAI-FCL notice, or accompanying customer terms.
+
+Historical Git tags, source archives, binaries, npm packages, or other copies
+of KodaX that were already distributed with Apache-2.0 license text remain
+licensed under Apache-2.0 for those specific copies. This notice does not
+retroactively revoke rights that were already granted under Apache-2.0.
+
+For avoidance of doubt, current and future official enterprise/customer
+packages for KodaX 0.7.70 and later should be delivered with KAI-FCL or
+separate KodaX-AI customer terms.
+
+1. Definitions
+
+"Software" means KodaX, including its source code, object code, documentation,
+configuration, examples, official npm packages, binaries, and other materials
+distributed by KodaX-AI under this License.
+
+"KodaX-AI" means the copyright owner, licensor, or license steward for the
+Software.
+
+"You" means the individual or legal entity exercising permissions under this
+License.
+
+"Community Use" means use by an individual for personal learning, individual
+non-commercial work, classroom instruction, non-production research, or
+developing and testing changes for contribution to public open-source
+projects.
+
+"Commercial or Managed Use" means any use by or for a company, school, lab,
+institution, government agency, or other organization for administration, IT
+operations, team research and development, production work, intranet hosting,
+managed-device deployment, paid service delivery, customer redistribution,
+hosted or managed services, or other business purposes.
+
+"Customer Agreement" means a written agreement with KodaX-AI, including
+evaluation terms, an order form, an enterprise agreement, partner terms, or
+another commercial authorization document.
+
+"License Entitlement" means a signed offline entitlement file, commonly using
+the `.kodax-license` extension, that identifies product, edition, license
+kind, customer, expiry, enabled features, binding claims, and signature. A
+License Entitlement proves technical authorization; it is not by itself the
+complete legal contract.
+
+2. Community Grant
+
+Subject to this License, KodaX-AI grants You a limited, non-exclusive,
+non-transferable, no-charge license to download, install, run, inspect, and
+modify the Software solely for Community Use.
+
+You may make copies of the Software as reasonably necessary for Your own
+Community Use, backup, testing, and contribution preparation. You may submit
+changes, patches, issues, and documentation improvements to KodaX-AI. Unless a
+separate written contribution agreement says otherwise, You grant KodaX-AI a
+perpetual, worldwide, irrevocable, royalty-free license to use, reproduce,
+modify, distribute, sublicense, and otherwise exploit contributions You submit
+for inclusion in the Software.
+
+3. Commercial and Managed Use
+
+Commercial or Managed Use is not permitted under the Community Grant.
+
+Enterprise evaluation, enterprise production, intranet deployment,
+managed-device deployment, commercial redistribution, partner distribution,
+paid service delivery, or any other Commercial or Managed Use requires a
+Customer Agreement with KodaX-AI and, where the Software requires it, a valid
+License Entitlement.
+
+All production customer License Entitlements must include an expiry date unless
+a Customer Agreement expressly says otherwise. Longer commercial terms are
+renewals or replacements, not perpetual local secrets.
+
+4. Restrictions
+
+Except as expressly allowed by this License or a Customer Agreement, You must
+not:
+
+- use the Software for Commercial or Managed Use;
+- sell, rent, lease, sublicense, host, provide, or redistribute the Software to
+  third parties;
+- remove, disable, bypass, tamper with, or misrepresent license enforcement,
+  entitlement checks, signatures, expiry checks, binding checks, or related
+  technical controls;
+- remove or alter copyright, license, attribution, trademark, or third-party
+  notices;
+- use KodaX-AI names, logos, product names, or trademarks except to describe
+  the origin of the Software accurately;
+- violate applicable law or use the Software to infringe third-party rights.
+
+5. Separate Agreements
+
+If You have a Customer Agreement with KodaX-AI, that Customer Agreement
+controls for the Software, edition, term, users, sites, features, and use cases
+it covers. This License controls only where the Customer Agreement does not
+grant additional rights or impose different obligations.
+
+6. Ownership
+
+KodaX-AI and its licensors retain all right, title, and interest in and to the
+Software. No rights are granted except those expressly stated in this License
+or a Customer Agreement.
+
+7. Third-Party Software
+
+The Software may include or depend on third-party software, packages, models,
+fonts, assets, or tools. Those materials are licensed by their respective
+owners under their own terms. This License does not change third-party license
+obligations.
+
+8. Termination
+
+Your rights under this License terminate automatically if You violate this
+License and do not cure the violation within 30 days after receiving notice
+from KodaX-AI. Rights also terminate immediately for intentional license
+enforcement bypass, unauthorized Commercial or Managed Use, or unauthorized
+redistribution. After termination, You must stop using and distributing the
+Software, and You must delete copies not otherwise authorized by a Customer
+Agreement or by another license that independently applies to a specific
+released copy.
+
+9. Disclaimer of Warranty
+
+THE SOFTWARE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OR
+CONDITIONS OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT,
+SECURITY, ACCURACY, OR AVAILABILITY.
+
+10. Limitation of Liability
+
+TO THE MAXIMUM EXTENT PERMITTED BY LAW, KODAX-AI AND ITS CONTRIBUTORS WILL NOT
+BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR
+PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOST DATA, BUSINESS
+INTERRUPTION, GOODWILL LOSS, OR PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES,
+ARISING OUT OF OR RELATING TO THE SOFTWARE OR THIS LICENSE, EVEN IF ADVISED OF
+THE POSSIBILITY OF SUCH DAMAGES.
+
+11. Contact
+
+For enterprise evaluation, production licensing, redistribution permission, or
+questions about this License, contact:
+
+icetomoyo <icetomoyo@gmail.com> <icetomoyo@163.com>

package/dist/artifacts/dist/browser.d.ts

@@ -0,0 +1,3 @@
+import { type Page } from 'playwright-core';
+import type { ArtifactRuntimeOptions } from './runtime.js';
+export declare function withArtifactPage<T>(options: ArtifactRuntimeOptions, use: (page: Page) => Promise<T>): Promise<T>;

package/dist/artifacts/dist/browser.js

@@ -0,0 +1,33 @@
+import { chromium } from 'playwright-core';
+import { defaultBrowserExecutable } from './render.js';
+export async function withArtifactPage(options, use) {
+    options.signal?.throwIfAborted();
+    const browser = await chromium.launch({ executablePath: options.browserExecutable ?? defaultBrowserExecutable(), headless: true });
+    let closing, closeError, timedOut = false;
+    const close = () => { closing ??= browser.close(); void closing.catch(error => { closeError = error; }); };
+    const timeout = setTimeout(() => { timedOut = true; close(); }, 90_000);
+    options.signal?.addEventListener('abort', close, { once: true });
+    try {
+        options.signal?.throwIfAborted();
+        const context = await browser.newContext({ deviceScaleFactor: 1, serviceWorkers: 'block', acceptDownloads: false });
+        await context.routeWebSocket('**/*', socket => socket.close());
+        const page = await context.newPage();
+        page.setDefaultTimeout(20_000);
+        page.setDefaultNavigationTimeout(20_000);
+        return await use(page);
+    }
+    catch (error) {
+        options.signal?.throwIfAborted();
+        if (timedOut)
+            throw new Error('Artifact browser operation timed out.', { cause: error });
+        throw error;
+    }
+    finally {
+        clearTimeout(timeout);
+        options.signal?.removeEventListener('abort', close);
+        await (closing ?? browser.close());
+        if (closeError)
+            throw closeError;
+    }
+}
+//# sourceMappingURL=browser.js.map

package/dist/artifacts/dist/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAa,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAEvD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAI,OAA+B,EAAE,GAA+B;IACzG,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,iBAAiB,IAAI,wBAAwB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACnI,IAAI,OAAkC,EAAE,UAAmB,EAAE,QAAQ,GAAG,KAAK,CAAC;IAC9E,MAAM,KAAK,GAAG,GAAG,EAAE,GAAG,OAAO,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3G,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACxE,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC;QACJ,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;QACpH,MAAM,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;QAC/G,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QAAC,IAAI,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;YACpJ,CAAC;QAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAAC,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAAC,IAAI,UAAU;YAAE,MAAM,UAAU,CAAC;IAAC,CAAC;AAC9J,CAAC"}

package/dist/artifacts/dist/client.d.ts

@@ -0,0 +1,4 @@
+import type { KodaXProductClient } from '@kodax-ai/kodax/client';
+import type { ArtifactExecutionPort } from './types.js';
+/** Uses the connected Host's explicit tool Run. No local execution or automatic replay. */
+export declare function createKodaXArtifactPort(client: Pick<KodaXProductClient, 'runs' | 'sessions'>, sessionId: string): ArtifactExecutionPort;

package/dist/artifacts/dist/client.js

@@ -0,0 +1,87 @@
+import { artifactToolName, decodeArtifactRequest, decodeArtifactResult, decodeArtifactWireResult, record } from './contract.js';
+import { encodeBase64, verifyImageData } from './image-data.js';
+import { sameJson } from './identity.js';
+/** Uses the connected Host's explicit tool Run. No local execution or automatic replay. */
+export function createKodaXArtifactPort(client, sessionId) {
+    return { execute: async (raw, signal) => {
+            const request = decodeArtifactRequest(raw);
+            signal?.throwIfAborted();
+            const name = artifactToolName(request.operation);
+            const started = await client.runs.startTool({ sessionId, inputId: crypto.randomUUID(), name,
+                input: { ...request.input }, rawInput: JSON.stringify(request.input) });
+            let stop;
+            let operationError;
+            const cancel = () => { stop ??= client.runs.stop(started.runId).then(receipt => ({ receipt }), error => ({ error })); };
+            signal?.addEventListener('abort', cancel, { once: true });
+            if (signal?.aborted)
+                cancel();
+            try {
+                const terminal = await client.runs.await(started.runId);
+                if (terminal.runId !== started.runId || terminal.sessionId !== sessionId || terminal.phase !== 'completed' || !terminal.result?.success)
+                    throw new Error('Artifact Host Run did not complete: ' + terminal.phase + ': ' + (terminal.error ?? terminal.result?.lastText ?? '').slice(0, 2000));
+                signal?.throwIfAborted();
+                const messages = terminal.result.messages, callMessage = messages.at(-2), resultMessage = messages.at(-1);
+                const call = Array.isArray(callMessage?.content) ? callMessage.content.find(block => block.type === 'tool_use' && block.name === name && sameJson(block.input, request.input)) : undefined;
+                if (call?.type !== 'tool_use' || !Array.isArray(resultMessage?.content))
+                    throw new Error('Artifact Host invocation identity is missing.');
+                const block = resultMessage.content.find(block => block.type === 'tool_result' && block.tool_use_id === call.id);
+                if (block?.type !== 'tool_result' || block.is_error)
+                    throw new Error('Artifact Host tool result is unavailable.');
+                const first = typeof block.content === 'string' ? block.content : block.content.find(item => item.type === 'text')?.text;
+                if (!first || first.length > 2 * 1024 * 1024)
+                    throw new Error('Artifact metadata is missing or exceeds its bound.');
+                const payload = record(JSON.parse(first));
+                if (payload.protocol !== 'kodax-artifact/1' || payload.operation !== request.operation)
+                    throw new Error('Artifact tool payload does not match the invocation.');
+                const result = decodeArtifactWireResult(request, payload);
+                if (!result.imageRef)
+                    return decodeArtifactResult(raw.operation, result);
+                let items = [];
+                const observation = await client.sessions.observe(sessionId, view => { items = view.items; });
+                try {
+                    const item = items.find(item => item.tool?.callId === call.id && item.tool.name === name && (!item.sourceRunId || item.sourceRunId === started.runId));
+                    const attachmentIndex = item?.attachments?.findIndex(image => image.path === result.imageRef.path);
+                    if (!item || attachmentIndex === undefined || attachmentIndex < 0)
+                        throw new Error('Artifact PNG is not attached to its Host invocation.');
+                    let offset = 0, bytes;
+                    do {
+                        signal?.throwIfAborted();
+                        const chunk = (await client.sessions.readItem(sessionId, item.id, { part: 'attachment', attachmentIndex, attachmentOffset: offset, expectedImageSha256: result.imageRef.sha256 }))?.image;
+                        if (!chunk || chunk.sha256 !== result.imageRef.sha256 || chunk.width !== result.imageRef.width || chunk.height !== result.imageRef.height || chunk.mediaType !== 'image/png' || chunk.offset !== offset || !Number.isSafeInteger(chunk.totalLength) || chunk.totalLength < 33 || chunk.totalLength > 10 * 1024 * 1024)
+                            throw new Error('Artifact attachment metadata is missing or inconsistent.');
+                        bytes ??= new Uint8Array(chunk.totalLength);
+                        const data = Uint8Array.from(atob(chunk.dataBase64), c => c.charCodeAt(0));
+                        if (!data.length || bytes.length !== chunk.totalLength || offset + data.length > bytes.length || (chunk.nextOffset !== undefined && chunk.nextOffset !== offset + data.length))
+                            throw new Error('Artifact attachment chunk is inconsistent.');
+                        bytes.set(data, offset);
+                        offset += data.length;
+                        if (chunk.nextOffset === undefined && offset !== bytes.length)
+                            throw new Error('Artifact attachment ended early.');
+                    } while (offset < bytes.length);
+                    const image = { mediaType: 'image/png', sha256: result.imageRef.sha256, width: result.imageRef.width, height: result.imageRef.height, dataBase64: encodeBase64(bytes) };
+                    await verifyImageData(image);
+                    signal?.throwIfAborted();
+                    return decodeArtifactResult(raw.operation, { status: result.status, diagnostics: result.diagnostics, image });
+                }
+                finally {
+                    observation.close();
+                }
+            }
+            catch (error) {
+                operationError = error;
+                throw error;
+            }
+            finally {
+                signal?.removeEventListener('abort', cancel);
+                if (stop) {
+                    const outcome = await stop;
+                    if ('error' in outcome) {
+                        if (operationError !== undefined)
+                            throw new AggregateError([operationError, outcome.error], 'Artifact operation and Stop settlement failed.');
+                        throw outcome.error;
+                    }
+                }
+            }
+        } };
+}
+//# sourceMappingURL=client.js.map

package/dist/artifacts/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAChI,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,2FAA2F;AAC3F,MAAM,UAAU,uBAAuB,CAAC,MAAqD,EAAE,SAAiB;IAC/G,OAAO,EAAE,OAAO,EAAE,KAAK,EAA+B,GAAuB,EAAE,MAAoB,EAA+B,EAAE;YACnI,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YACrE,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACjD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI;gBAC1F,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACzE,IAAI,IAAyG,CAAC;YAC9G,IAAI,cAAuB,CAAC;YAC5B,MAAM,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxH,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,IAAI,MAAM,EAAE,OAAO;gBAAE,MAAM,EAAE,CAAC;YACzF,IAAI,CAAC;gBACJ,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACxD,IAAI,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,KAAK,WAAW,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,QAAQ,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC9R,MAAM,EAAE,cAAc,EAAE,CAAC;gBACzB,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1G,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC3L,IAAI,IAAI,EAAE,IAAI,KAAK,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;gBAC1I,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC;gBACjH,IAAI,KAAK,EAAE,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;gBAClH,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC;gBACzH,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;gBACpH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC1C,IAAI,OAAO,CAAC,QAAQ,KAAK,kBAAkB,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;gBAChK,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC1D,IAAI,CAAC,MAAM,CAAC,QAAQ;oBAAE,OAAO,oBAAoB,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;gBACzE,IAAI,KAAK,GAA8B,EAAE,CAAC;gBAC1C,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9F,IAAI,CAAC;oBACJ,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;oBACvJ,MAAM,eAAe,GAAG,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,QAAS,CAAC,IAAI,CAAC,CAAC;oBACpG,IAAI,CAAC,IAAI,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,GAAG,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;oBAC3I,IAAI,MAAM,GAAG,CAAC,EAAE,KAA6B,CAAC;oBAC9C,GAAG,CAAC;wBACH,MAAM,EAAE,cAAc,EAAE,CAAC;wBACzB,MAAM,KAAK,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC;wBAC1L,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,WAAW,GAAG,EAAE,IAAI,KAAK,CAAC,WAAW,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;4BAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;wBACnY,KAAK,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;wBAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;wBAC3E,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,WAAW,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;4BAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;wBAC9O,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;wBAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;wBAC/C,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,CAAC,MAAM;4BAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;oBACpH,CAAC,QAAQ,MAAM,GAAG,KAAM,CAAC,MAAM,EAAE;oBACjC,MAAM,KAAK,GAAG,EAAE,SAAS,EAAE,WAAoB,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC,KAAM,CAAC,EAAE,CAAC;oBAClL,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;oBAAC,MAAM,EAAE,cAAc,EAAE,CAAC;oBAAC,OAAO,oBAAoB,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;gBACvK,CAAC;wBAAS,CAAC;oBAAC,WAAW,CAAC,KAAK,EAAE,CAAC;gBAAC,CAAC;YACnC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,cAAc,GAAG,KAAK,CAAC;gBAAC,MAAM,KAAK,CAAC;YAAC,CAAC;oBAChD,CAAC;gBACR,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC7C,IAAI,IAAI,EAAE,CAAC;oBAAC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC;oBAAC,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;wBAChE,IAAI,cAAc,KAAK,SAAS;4BAAE,MAAM,IAAI,cAAc,CAAC,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,gDAAgD,CAAC,CAAC;wBAC9I,MAAM,OAAO,CAAC,KAAK,CAAC;oBACrB,CAAC;gBAAC,CAAC;YACJ,CAAC;QACF,CAAC,EAAE,CAAC;AACL,CAAC"}

package/dist/artifacts/dist/contract.d.ts

@@ -0,0 +1,14 @@
+import type { ArtifactOperation, ArtifactRequest, ArtifactResults, ArtifactResult, EvidenceLocator, VisualSource, RasterEvidence } from './types.js';
+export declare const artifactToolName: (operation: ArtifactOperation) => string;
+export declare function record(value: unknown): Record<string, unknown>;
+export declare function validateSource(value: unknown): asserts value is VisualSource;
+export declare function validateLocator(value: unknown): asserts value is EvidenceLocator;
+export declare function validateRaster(value: unknown): asserts value is RasterEvidence;
+export declare function decodeArtifactRequest(value: unknown): ArtifactRequest;
+export declare function decodeArtifactResult<O extends ArtifactOperation>(operation: O, value: unknown): ArtifactResults[O];
+/** Managed worker metadata. PNG bytes travel through the existing attachment channel. */
+type ArtifactWireResult = Pick<ArtifactResult, 'status' | 'diagnostics' | 'artifact' | 'evidence'> & {
+    readonly imageRef?: RasterEvidence;
+};
+export declare function decodeArtifactWireResult(request: ArtifactRequest, value: unknown): ArtifactWireResult;
+export {};