@kodax-ai/kodax 0.7.97-alpha.7 → 0.7.97-alpha.8

package/CHANGELOG.md

@@ -8,6 +8,22 @@ All notable changes to this project will be documented in this file.
 
 ---
 
+## [0.7.97-alpha.8] - 2026-10-18
+
+Eighth alpha of the v0.7.97 line: the Artifact SDK ships inside the single
+main package — `@kodax-ai/kodax` gains `/artifacts`, `/artifacts/client`,
+`/artifacts/runtime` and `/artifacts/kodax` subpath exports while the
+workspace module turns private, its pinned dependencies declare in the root
+package, and the declared Node floor advances to 20.16. Every v0.7.96
+stable and v0.7.97-alpha.1 through alpha.7 contract is retained. npm
+publication remains a manual maintainer action.
+
+### Changed
+
+- Single-package Artifact distribution: the main tarball stages the existing module/worker/resource layout under `dist/artifacts/`, the tarball audit validates every export/entry/dependency, the Release workflow runs an installed-package Artifact gate, and `release.mjs` rejects a separate `--artifacts` publication. There is no separate `@kodax-ai/artifacts` npm package. Core startup stays free of renderer loading and probes.
+
+---
+
 ## [0.7.97-alpha.7] - 2026-10-16
 
 Seventh alpha of the v0.7.97 line: shared-Session Host ownership resolves
@@ -103,7 +119,7 @@ Validation: 16,589 tests passed, with package/bundle/native/type checks recorded
 in the [regression guide](docs/test-guides/FEATURE_301_v0.7.97_TEST_GUIDE.md).
 Natural-task GLM/DeepSeek smoke observed automatic image review, but full
 repair/re-review/delivery has not passed all checks. Native DOCX fidelity and
-model-facing schema gaps remain open; see [E2E evidence](docs/research/automatic-visual-review-e2e-2026-10-13.md).
+model-facing schema gaps remain open; see [E2E evidence](docs/test-guides/FEATURE_301_v0.7.97_TEST_GUIDE.md#natural-task-observations-2026-10-13).
 
 ---
 

package/README.md

@@ -778,8 +778,8 @@ provider's model, REPL `/compact` clears the UI only after a durable save, and
 successful reports carry bounded `summaryRequests` plus `commitMs` per
 physical summary call.
 
-**v0.7.97-alpha.4 release:** Adds the independent `@kodax-ai/artifacts`
-package — PPTX authoring, bounded editing, and current-file visual
+**v0.7.97-alpha.4 source release:** Adds the optional Artifact SDK workspace
+— PPTX authoring, bounded editing, and current-file visual
 evidence through lightweight rendering (optional LibreOffice/PDF conversion) — with an optional managed
 KodaX adapter (FEATURE_301), and retires the out-of-band Sidecar
 Verifier: the main agent now verifies requested requirements with actual
@@ -794,6 +794,17 @@ starts, upgrades, or waits. See
 Every v0.7.96 stable and v0.7.97-alpha.1/alpha.2/alpha.3 contract is
 retained.
 
+**v0.7.97-alpha.8 release:** Ships the Artifact SDK inside the single main
+package — `@kodax-ai/kodax` gains `/artifacts`, `/artifacts/client`,
+`/artifacts/runtime` and `/artifacts/kodax` subpath exports; the workspace
+module turns private (no separate artifacts npm package), its pinned
+dependencies declare in the root package, and the declared Node floor
+advances to 20.16, with tarball-audit and installed-package Release gates.
+See the
+[v0.7.97-alpha.8 release notes](docs/release.md#v0797-alpha8-release-preparation).
+Every v0.7.96 stable and v0.7.97-alpha.1 through alpha.7 contract is
+retained.
+
 **v0.7.97-alpha.7 release:** Resolves shared-Session Host ownership across
 daemon profiles (Space #222) — launchers wait for a starting owner's verified
 descriptor within the original startup deadline, reuse compatible Hosts
@@ -1405,12 +1416,12 @@ kodax --repo-intelligence full --repo-intelligence-trace
 
 ## Architecture
 
-KodaX uses a **monorepo architecture** with npm workspaces. Four core packages ship in `@kodax-ai/kodax` with 13 SDK subpath exports (`/agent`, `/llm`, `/coding`, `/media`, `/repl`, `/skills`, `/mcp`, `/session`, `/client`, `/runtime`, `/sandbox`, `/a2a`, `/experimental-memory`; ADR-024 + ADR-032 + ADR-038, with ADR-036 consolidation). The independent optional `@kodax-ai/artifacts` package adds PPTX authoring/limited edits, PDF/image/SVG evidence, candidate DOCX preview, local HTML/SMIL capture, preparation and binary evidence reading. Core startup does not load renderers; the KodaX bridge uses managed permissions, sandbox and cancellation. [SDK support and limits](docs/ARTIFACT_SDK.md).
+KodaX uses a **monorepo architecture** with npm workspaces. Four core packages ship in `@kodax-ai/kodax` with 17 SDK subpath exports (`/agent`, `/llm`, `/coding`, `/media`, `/repl`, `/skills`, `/mcp`, `/session`, `/client`, `/runtime`, `/sandbox`, `/a2a`, `/experimental-memory`, `/artifacts`, `/artifacts/client`, `/artifacts/runtime`, `/artifacts/kodax`; ADR-024 + ADR-032 + ADR-038, with ADR-036 consolidation). The private `artifacts` source workspace adds optional APIs through the same main npm package: PPTX authoring/limited edits, PDF/image/SVG evidence, candidate DOCX preview, local HTML/SMIL capture, preparation and binary evidence reading. Core startup does not load renderers; the KodaX bridge uses managed permissions, sandbox and cancellation. [SDK support and limits](docs/ARTIFACT_SDK.md).
 
 ```
 KodaX/
 ├── packages/                # 4 core packages + optional artifacts
-│   ├── artifacts/           # Independent Artifact SDK + optional managed KodaX adapter
+│   ├── artifacts/           # Private Artifact SDK workspace; main-package subpaths
 │   ├── llm/                 # @kodax-ai/llm - LLM abstraction (16 built-in provider aliases)
 │   │   └── providers/       # Anthropic, OpenAI, DeepSeek, Kimi, MiMo, MiniMax, Zhipu, Ark, …
 │   │
@@ -1480,10 +1491,10 @@ Source-side workspace package names (`@kodax-ai/*`). npm consumers install the s
 
 KodaX has two layers that consumers should understand separately:
 
-- **Source-side**: 4 workspace packages above (what developers see when reading the repo).
-- **Current packaged exports** (not a claim of npm availability): a single bundled package `@kodax-ai/kodax` with 13 SDK subpaths (what SDK consumers `import` from). The subpaths are split into two roles:
+- **Source-side**: 4 core workspace packages plus the private Artifact workspace (what developers see when reading the repo).
+- **Current packaged exports** (not a claim of npm availability): a single bundled package `@kodax-ai/kodax` with 17 SDK subpaths (what SDK consumers `import` from). The subpaths are split into two roles:
   - **Full-package subpaths** (`/agent`, `/llm`, `/coding`, `/repl`) — each one maps 1:1 to a source workspace and exposes its complete public API.
-  - **Integration and narrow subpaths** (`/media`, `/skills`, `/mcp`, `/session`, `/client`, `/runtime`, `/sandbox`, `/a2a`, `/experimental-memory`) — focused host surfaces. `/a2a` composes the neutral F258 plane with the Runtime facade; it does not add A2A wire types to `/agent`.
+  - **Integration and narrow subpaths** (`/media`, `/skills`, `/mcp`, `/session`, `/client`, `/runtime`, `/sandbox`, `/a2a`, `/experimental-memory`, `/artifacts`, `/artifacts/client`, `/artifacts/runtime`, `/artifacts/kodax`) — focused host surfaces. `/a2a` composes the neutral F258 plane with the Runtime facade; it does not add A2A wire types to `/agent`.
 
 | Source package | npm subpath | Type | What you get | Example consumer |
 |---|---|---|---|---|
@@ -2090,11 +2101,11 @@ await runKodaX({
 
 ## SDK Usage
 
-This development tree exposes 13 SDK subpaths plus the root. Shared product
+This development tree exposes 17 SDK subpaths plus the root. Shared product
 applications use `@kodax-ai/kodax/client`; independent libraries and trusted Host
 APIs remain available through the other subpaths. See the [Client contract](docs/CLIENT_CONTRACT.md)
 and [SDK migration guide](docs/SDK_MIGRATION.md). This documentation was checked
-against package version `0.7.97-alpha.7`; npm publication is separate from
+against package version `0.7.97-alpha.8`; npm publication is separate from
 the current development-tree contract.
 
 ```bash

package/README_CN.md

@@ -303,7 +303,7 @@ SDK 系统代码契约更新，但没有放宽 shell/sandbox 的 fail-closed 边
 `handleRuntimePermissionRequest()` 管理 SDK 权限 UI，并在 prepared Session 尾部遇到
 `data_changed` 时通过权威 delta 合并恢复；后台持久化失败会显示为诊断，不再静默丢失。
 
-**v0.7.97-alpha.4 发布**：新增独立的 `@kodax-ai/artifacts` 包——PPTX 创作、
+**v0.7.97-alpha.4 发布**：新增可独立使用的 Artifact SDK 源码模块——PPTX 创作、
 有界编辑与当前文件视觉证据（轻量渲染，可选 LibreOffice/PDF 转换），并带可选的受管 KodaX
 适配器（FEATURE_301）；同时退役旁路 Sidecar Verifier：主 Agent 在交付前用
 真实工具与渲染证据核验每条需求，由内置 `visual-review` 技能覆盖静态、分页、
@@ -314,6 +314,13 @@ SDK 系统代码契约更新，但没有放宽 shell/sandbox 的 fail-closed 边
 [v0.7.97-alpha.4 发布清单](docs/release.md#v0797-alpha4-release-preparation)。
 所有 v0.7.96 稳定与 v0.7.97-alpha.1/alpha.2/alpha.3 契约全部保留。
 
+**v0.7.97-alpha.8 发布**：Artifact SDK 并入单一主包发布——`@kodax-ai/kodax` 新增
+`/artifacts`、`/artifacts/client`、`/artifacts/runtime`、`/artifacts/kodax` 四个
+子路径导出;工作区模块转为私有(不再独立发布 npm),固定依赖上移到根包声明,
+Node 最低版本提升到 20.16,tarball 审计与已安装包 Release 门同步就位。
+详见 [v0.7.97-alpha.8 发布清单](docs/release.md#v0797-alpha8-release-preparation)。
+所有 v0.7.96 稳定与 v0.7.97-alpha.1 至 alpha.7 契约全部保留。
+
 **v0.7.97-alpha.7 发布**：跨 daemon profile 解析共享 Session 存储的 Host
 归属（Space #222）——启动器在原启动期限内等待启动中 owner 的已验证描述符，
 兼容 Host 直接复用而不重启工作，仅允许受控的同构建 orphan-exit 策略刷新。
@@ -1272,7 +1279,7 @@ kodax --repo-intelligence full --repo-intelligence-trace
 
 ## 仓库结构
 
-KodaX 是基于 npm workspaces 的 TypeScript monorepo，**4 个核心 workspace 包与独立可选 Artifact SDK**（FEATURE_194 v0.7.43 包合并 — 9 → 4，ADR-036），npm 上以单 bundle 包 `@kodax-ai/kodax` 发布 + 13 个 SDK subpath exports（`/agent`、`/llm`、`/coding`、`/media`、`/repl`、`/skills`、`/mcp`、`/session`、`/client`、`/runtime`、`/sandbox`、`/a2a`、`/experimental-memory`；ADR-024 + ADR-032 + ADR-038）。核心包：
+KodaX 是基于 npm workspaces 的 TypeScript monorepo，**4 个核心 workspace 包与私有 Artifact 源码模块**（FEATURE_194 v0.7.43 包合并 — 9 → 4，ADR-036），npm 上以单 bundle 包 `@kodax-ai/kodax` 发布 + 17 个 SDK subpath exports（`/agent`、`/llm`、`/coding`、`/media`、`/repl`、`/skills`、`/mcp`、`/session`、`/client`、`/runtime`、`/sandbox`、`/a2a`、`/experimental-memory`、`/artifacts`、`/artifacts/client`、`/artifacts/runtime`、`/artifacts/kodax`；ADR-024 + ADR-032 + ADR-038）。核心包：
 
 | Workspace 包 | 作用 | 主要依赖 |
 |----|------|---------|
@@ -1287,10 +1294,10 @@ KodaX 是基于 npm workspaces 的 TypeScript monorepo，**4 个核心 workspace
 
 KodaX 有两层结构，SDK 用户需要分开理解：
 
-- **源码层**：4 个核心 workspace 包，另有独立可选 `@kodax-ai/artifacts`：PPTX 创作/限定编辑，PDF/图片/SVG 取证、DOCX 轻量预览、本地网页与 SMIL 捕获，公共准备和真实图片读取。核心启动不加载渲染依赖；桥接沿用受管权限、沙箱和取消。[SDK 支持与限制](docs/ARTIFACT_SDK.md)。
-- **当前源码打包导出**（不表示已发布到 npm）：单个 bundled 包 `@kodax-ai/kodax`，对外暴露 13 个 SDK subpath（SDK 消费者 `import` 时看到的接口）。subpath 分两种角色：
+- **源码层**：4 个核心 workspace 包，另有私有可选 Artifact 源码 workspace，经同一主包 `/artifacts` 子路径交付：PPTX 创作/限定编辑，PDF/图片/SVG 取证、DOCX 轻量预览、本地网页与 SMIL 捕获，公共准备和真实图片读取。核心启动不加载渲染依赖；桥接沿用受管权限、沙箱和取消。[SDK 支持与限制](docs/ARTIFACT_SDK.md)。
+- **当前源码打包导出**（不表示已发布到 npm）：单个 bundled 包 `@kodax-ai/kodax`，对外暴露 17 个 SDK subpath（SDK 消费者 `import` 时看到的接口）。subpath 分两种角色：
   - **完整包 subpath**（`/agent`、`/llm`、`/coding`、`/repl`）—— 每个 1:1 对应一个源码包，暴露完整公开 API。
-  - **集成与窄子集 subpath**（`/media`、`/skills`、`/mcp`、`/session`、`/client`、`/runtime`、`/sandbox`、`/a2a`、`/experimental-memory`）—— 聚焦能力或宿主集成边界；`/experimental-memory` 明确为 opt-in 不稳定接口。
+  - **集成与窄子集 subpath**（`/media`、`/skills`、`/mcp`、`/session`、`/client`、`/runtime`、`/sandbox`、`/a2a`、`/experimental-memory`、`/artifacts`、`/artifacts/client`、`/artifacts/runtime`、`/artifacts/kodax`）—— 聚焦能力或宿主集成边界；`/experimental-memory` 明确为 opt-in 不稳定接口。
 
 | 源码包 | npm subpath | 类型 | 内容 | 典型消费者 |
 |---|---|---|---|---|
@@ -1462,7 +1469,7 @@ KodaX/                       # 4 workspace packages(FEATURE_194 v0.7.43)
 │   ├── kodax_cli.ts         # CLI 主入口（bin: `kodax`）
 │   └── sdk-*.ts             # SDK subpath 入口 → @kodax-ai/kodax/{agent,llm,coding,media,repl,skills,mcp,session,runtime,sandbox,a2a,experimental-memory}
 ├── scripts/
-│   ├── build-bundle.mjs     # esbuild 单 bundle 多 entry 打包（CLI + root + 13 SDK subpath + chunks）
+│   ├── build-bundle.mjs     # esbuild 单 bundle 多 entry 打包（CLI + root + 13 核心 SDK subpath + Artifact 资源 + chunks）
 │   ├── build-binary.mjs     # Bun --compile 单文件二进制打包
 │   └── release.mjs          # 发布 CI 构建的通用 tarball；本地 --pack-only 保持 private:true
 └── .github/workflows/

package/dist/artifacts/LICENSE

@@ -0,0 +1,158 @@
+KodaX-AI Fair Core License (KAI-FCL) 1.0
+
+Copyright (c) 2026 icetomoyo <icetomoyo@gmail.com> <icetomoyo@163.com>
+
+All rights reserved except as expressly granted in this License.
+
+This License applies to KodaX releases and files that include this LICENSE file
+or otherwise identify KAI-FCL as their governing license. Earlier KodaX
+releases or files that were distributed under the Apache License, Version 2.0
+remain licensed under Apache-2.0 for those released copies. Third-party
+components remain governed by their own license terms.
+
+Effective Version Notice
+
+KodaX-AI intends KAI-FCL to govern official KodaX distributions for version
+0.7.70 and later when those distributions are provided by KodaX-AI with this
+LICENSE file, a KAI-FCL notice, or accompanying customer terms.
+
+Historical Git tags, source archives, binaries, npm packages, or other copies
+of KodaX that were already distributed with Apache-2.0 license text remain
+licensed under Apache-2.0 for those specific copies. This notice does not
+retroactively revoke rights that were already granted under Apache-2.0.
+
+For avoidance of doubt, current and future official enterprise/customer
+packages for KodaX 0.7.70 and later should be delivered with KAI-FCL or
+separate KodaX-AI customer terms.
+
+1. Definitions
+
+"Software" means KodaX, including its source code, object code, documentation,
+configuration, examples, official npm packages, binaries, and other materials
+distributed by KodaX-AI under this License.
+
+"KodaX-AI" means the copyright owner, licensor, or license steward for the
+Software.
+
+"You" means the individual or legal entity exercising permissions under this
+License.
+
+"Community Use" means use by an individual for personal learning, individual
+non-commercial work, classroom instruction, non-production research, or
+developing and testing changes for contribution to public open-source
+projects.
+
+"Commercial or Managed Use" means any use by or for a company, school, lab,
+institution, government agency, or other organization for administration, IT
+operations, team research and development, production work, intranet hosting,
+managed-device deployment, paid service delivery, customer redistribution,
+hosted or managed services, or other business purposes.
+
+"Customer Agreement" means a written agreement with KodaX-AI, including
+evaluation terms, an order form, an enterprise agreement, partner terms, or
+another commercial authorization document.
+
+"License Entitlement" means a signed offline entitlement file, commonly using
+the `.kodax-license` extension, that identifies product, edition, license
+kind, customer, expiry, enabled features, binding claims, and signature. A
+License Entitlement proves technical authorization; it is not by itself the
+complete legal contract.
+
+2. Community Grant
+
+Subject to this License, KodaX-AI grants You a limited, non-exclusive,
+non-transferable, no-charge license to download, install, run, inspect, and
+modify the Software solely for Community Use.
+
+You may make copies of the Software as reasonably necessary for Your own
+Community Use, backup, testing, and contribution preparation. You may submit
+changes, patches, issues, and documentation improvements to KodaX-AI. Unless a
+separate written contribution agreement says otherwise, You grant KodaX-AI a
+perpetual, worldwide, irrevocable, royalty-free license to use, reproduce,
+modify, distribute, sublicense, and otherwise exploit contributions You submit
+for inclusion in the Software.
+
+3. Commercial and Managed Use
+
+Commercial or Managed Use is not permitted under the Community Grant.
+
+Enterprise evaluation, enterprise production, intranet deployment,
+managed-device deployment, commercial redistribution, partner distribution,
+paid service delivery, or any other Commercial or Managed Use requires a
+Customer Agreement with KodaX-AI and, where the Software requires it, a valid
+License Entitlement.
+
+All production customer License Entitlements must include an expiry date unless
+a Customer Agreement expressly says otherwise. Longer commercial terms are
+renewals or replacements, not perpetual local secrets.
+
+4. Restrictions
+
+Except as expressly allowed by this License or a Customer Agreement, You must
+not:
+
+- use the Software for Commercial or Managed Use;
+- sell, rent, lease, sublicense, host, provide, or redistribute the Software to
+  third parties;
+- remove, disable, bypass, tamper with, or misrepresent license enforcement,
+  entitlement checks, signatures, expiry checks, binding checks, or related
+  technical controls;
+- remove or alter copyright, license, attribution, trademark, or third-party
+  notices;
+- use KodaX-AI names, logos, product names, or trademarks except to describe
+  the origin of the Software accurately;
+- violate applicable law or use the Software to infringe third-party rights.
+
+5. Separate Agreements
+
+If You have a Customer Agreement with KodaX-AI, that Customer Agreement
+controls for the Software, edition, term, users, sites, features, and use cases
+it covers. This License controls only where the Customer Agreement does not
+grant additional rights or impose different obligations.
+
+6. Ownership
+
+KodaX-AI and its licensors retain all right, title, and interest in and to the
+Software. No rights are granted except those expressly stated in this License
+or a Customer Agreement.
+
+7. Third-Party Software
+
+The Software may include or depend on third-party software, packages, models,
+fonts, assets, or tools. Those materials are licensed by their respective
+owners under their own terms. This License does not change third-party license
+obligations.
+
+8. Termination
+
+Your rights under this License terminate automatically if You violate this
+License and do not cure the violation within 30 days after receiving notice
+from KodaX-AI. Rights also terminate immediately for intentional license
+enforcement bypass, unauthorized Commercial or Managed Use, or unauthorized
+redistribution. After termination, You must stop using and distributing the
+Software, and You must delete copies not otherwise authorized by a Customer
+Agreement or by another license that independently applies to a specific
+released copy.
+
+9. Disclaimer of Warranty
+
+THE SOFTWARE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OR
+CONDITIONS OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT,
+SECURITY, ACCURACY, OR AVAILABILITY.
+
+10. Limitation of Liability
+
+TO THE MAXIMUM EXTENT PERMITTED BY LAW, KODAX-AI AND ITS CONTRIBUTORS WILL NOT
+BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR
+PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOST DATA, BUSINESS
+INTERRUPTION, GOODWILL LOSS, OR PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES,
+ARISING OUT OF OR RELATING TO THE SOFTWARE OR THIS LICENSE, EVEN IF ADVISED OF
+THE POSSIBILITY OF SUCH DAMAGES.
+
+11. Contact
+
+For enterprise evaluation, production licensing, redistribution permission, or
+questions about this License, contact:
+
+icetomoyo <icetomoyo@gmail.com> <icetomoyo@163.com>

package/dist/artifacts/dist/browser.d.ts

@@ -0,0 +1,3 @@
+import { type Page } from 'playwright-core';
+import type { ArtifactRuntimeOptions } from './runtime.js';
+export declare function withArtifactPage<T>(options: ArtifactRuntimeOptions, use: (page: Page) => Promise<T>): Promise<T>;

package/dist/artifacts/dist/browser.js

@@ -0,0 +1,33 @@
+import { chromium } from 'playwright-core';
+import { defaultBrowserExecutable } from './render.js';
+export async function withArtifactPage(options, use) {
+    options.signal?.throwIfAborted();
+    const browser = await chromium.launch({ executablePath: options.browserExecutable ?? defaultBrowserExecutable(), headless: true });
+    let closing, closeError, timedOut = false;
+    const close = () => { closing ??= browser.close(); void closing.catch(error => { closeError = error; }); };
+    const timeout = setTimeout(() => { timedOut = true; close(); }, 90_000);
+    options.signal?.addEventListener('abort', close, { once: true });
+    try {
+        options.signal?.throwIfAborted();
+        const context = await browser.newContext({ deviceScaleFactor: 1, serviceWorkers: 'block', acceptDownloads: false });
+        await context.routeWebSocket('**/*', socket => socket.close());
+        const page = await context.newPage();
+        page.setDefaultTimeout(20_000);
+        page.setDefaultNavigationTimeout(20_000);
+        return await use(page);
+    }
+    catch (error) {
+        options.signal?.throwIfAborted();
+        if (timedOut)
+            throw new Error('Artifact browser operation timed out.', { cause: error });
+        throw error;
+    }
+    finally {
+        clearTimeout(timeout);
+        options.signal?.removeEventListener('abort', close);
+        await (closing ?? browser.close());
+        if (closeError)
+            throw closeError;
+    }
+}
+//# sourceMappingURL=browser.js.map

package/dist/artifacts/dist/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAa,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAEvD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAI,OAA+B,EAAE,GAA+B;IACzG,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,iBAAiB,IAAI,wBAAwB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACnI,IAAI,OAAkC,EAAE,UAAmB,EAAE,QAAQ,GAAG,KAAK,CAAC;IAC9E,MAAM,KAAK,GAAG,GAAG,EAAE,GAAG,OAAO,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3G,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACxE,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC;QACJ,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;QACpH,MAAM,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;QAC/G,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QAAC,IAAI,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;YACpJ,CAAC;QAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAAC,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAAC,IAAI,UAAU;YAAE,MAAM,UAAU,CAAC;IAAC,CAAC;AAC9J,CAAC"}

package/dist/artifacts/dist/client.d.ts

@@ -0,0 +1,4 @@
+import type { KodaXProductClient } from '@kodax-ai/kodax/client';
+import type { ArtifactExecutionPort } from './types.js';
+/** Uses the connected Host's explicit tool Run. No local execution or automatic replay. */
+export declare function createKodaXArtifactPort(client: Pick<KodaXProductClient, 'runs' | 'sessions'>, sessionId: string): ArtifactExecutionPort;

package/dist/artifacts/dist/client.js

@@ -0,0 +1,87 @@
+import { artifactToolName, decodeArtifactRequest, decodeArtifactResult, decodeArtifactWireResult, record } from './contract.js';
+import { encodeBase64, verifyImageData } from './image-data.js';
+import { sameJson } from './identity.js';
+/** Uses the connected Host's explicit tool Run. No local execution or automatic replay. */
+export function createKodaXArtifactPort(client, sessionId) {
+    return { execute: async (raw, signal) => {
+            const request = decodeArtifactRequest(raw);
+            signal?.throwIfAborted();
+            const name = artifactToolName(request.operation);
+            const started = await client.runs.startTool({ sessionId, inputId: crypto.randomUUID(), name,
+                input: { ...request.input }, rawInput: JSON.stringify(request.input) });
+            let stop;
+            let operationError;
+            const cancel = () => { stop ??= client.runs.stop(started.runId).then(receipt => ({ receipt }), error => ({ error })); };
+            signal?.addEventListener('abort', cancel, { once: true });
+            if (signal?.aborted)
+                cancel();
+            try {
+                const terminal = await client.runs.await(started.runId);
+                if (terminal.runId !== started.runId || terminal.sessionId !== sessionId || terminal.phase !== 'completed' || !terminal.result?.success)
+                    throw new Error('Artifact Host Run did not complete: ' + terminal.phase + ': ' + (terminal.error ?? terminal.result?.lastText ?? '').slice(0, 2000));
+                signal?.throwIfAborted();
+                const messages = terminal.result.messages, callMessage = messages.at(-2), resultMessage = messages.at(-1);
+                const call = Array.isArray(callMessage?.content) ? callMessage.content.find(block => block.type === 'tool_use' && block.name === name && sameJson(block.input, request.input)) : undefined;
+                if (call?.type !== 'tool_use' || !Array.isArray(resultMessage?.content))
+                    throw new Error('Artifact Host invocation identity is missing.');
+                const block = resultMessage.content.find(block => block.type === 'tool_result' && block.tool_use_id === call.id);
+                if (block?.type !== 'tool_result' || block.is_error)
+                    throw new Error('Artifact Host tool result is unavailable.');
+                const first = typeof block.content === 'string' ? block.content : block.content.find(item => item.type === 'text')?.text;
+                if (!first || first.length > 2 * 1024 * 1024)
+                    throw new Error('Artifact metadata is missing or exceeds its bound.');
+                const payload = record(JSON.parse(first));
+                if (payload.protocol !== 'kodax-artifact/1' || payload.operation !== request.operation)
+                    throw new Error('Artifact tool payload does not match the invocation.');
+                const result = decodeArtifactWireResult(request, payload);
+                if (!result.imageRef)
+                    return decodeArtifactResult(raw.operation, result);
+                let items = [];
+                const observation = await client.sessions.observe(sessionId, view => { items = view.items; });
+                try {
+                    const item = items.find(item => item.tool?.callId === call.id && item.tool.name === name && (!item.sourceRunId || item.sourceRunId === started.runId));
+                    const attachmentIndex = item?.attachments?.findIndex(image => image.path === result.imageRef.path);
+                    if (!item || attachmentIndex === undefined || attachmentIndex < 0)
+                        throw new Error('Artifact PNG is not attached to its Host invocation.');
+                    let offset = 0, bytes;
+                    do {
+                        signal?.throwIfAborted();
+                        const chunk = (await client.sessions.readItem(sessionId, item.id, { part: 'attachment', attachmentIndex, attachmentOffset: offset, expectedImageSha256: result.imageRef.sha256 }))?.image;
+                        if (!chunk || chunk.sha256 !== result.imageRef.sha256 || chunk.width !== result.imageRef.width || chunk.height !== result.imageRef.height || chunk.mediaType !== 'image/png' || chunk.offset !== offset || !Number.isSafeInteger(chunk.totalLength) || chunk.totalLength < 33 || chunk.totalLength > 10 * 1024 * 1024)
+                            throw new Error('Artifact attachment metadata is missing or inconsistent.');
+                        bytes ??= new Uint8Array(chunk.totalLength);
+                        const data = Uint8Array.from(atob(chunk.dataBase64), c => c.charCodeAt(0));
+                        if (!data.length || bytes.length !== chunk.totalLength || offset + data.length > bytes.length || (chunk.nextOffset !== undefined && chunk.nextOffset !== offset + data.length))
+                            throw new Error('Artifact attachment chunk is inconsistent.');
+                        bytes.set(data, offset);
+                        offset += data.length;
+                        if (chunk.nextOffset === undefined && offset !== bytes.length)
+                            throw new Error('Artifact attachment ended early.');
+                    } while (offset < bytes.length);
+                    const image = { mediaType: 'image/png', sha256: result.imageRef.sha256, width: result.imageRef.width, height: result.imageRef.height, dataBase64: encodeBase64(bytes) };
+                    await verifyImageData(image);
+                    signal?.throwIfAborted();
+                    return decodeArtifactResult(raw.operation, { status: result.status, diagnostics: result.diagnostics, image });
+                }
+                finally {
+                    observation.close();
+                }
+            }
+            catch (error) {
+                operationError = error;
+                throw error;
+            }
+            finally {
+                signal?.removeEventListener('abort', cancel);
+                if (stop) {
+                    const outcome = await stop;
+                    if ('error' in outcome) {
+                        if (operationError !== undefined)
+                            throw new AggregateError([operationError, outcome.error], 'Artifact operation and Stop settlement failed.');
+                        throw outcome.error;
+                    }
+                }
+            }
+        } };
+}
+//# sourceMappingURL=client.js.map

package/dist/artifacts/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAChI,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,2FAA2F;AAC3F,MAAM,UAAU,uBAAuB,CAAC,MAAqD,EAAE,SAAiB;IAC/G,OAAO,EAAE,OAAO,EAAE,KAAK,EAA+B,GAAuB,EAAE,MAAoB,EAA+B,EAAE;YACnI,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YACrE,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACjD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI;gBAC1F,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACzE,IAAI,IAAyG,CAAC;YAC9G,IAAI,cAAuB,CAAC;YAC5B,MAAM,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxH,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,IAAI,MAAM,EAAE,OAAO;gBAAE,MAAM,EAAE,CAAC;YACzF,IAAI,CAAC;gBACJ,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACxD,IAAI,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,KAAK,WAAW,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,QAAQ,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC9R,MAAM,EAAE,cAAc,EAAE,CAAC;gBACzB,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1G,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC3L,IAAI,IAAI,EAAE,IAAI,KAAK,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;gBAC1I,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC;gBACjH,IAAI,KAAK,EAAE,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;gBAClH,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC;gBACzH,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;gBACpH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC1C,IAAI,OAAO,CAAC,QAAQ,KAAK,kBAAkB,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;gBAChK,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC1D,IAAI,CAAC,MAAM,CAAC,QAAQ;oBAAE,OAAO,oBAAoB,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;gBACzE,IAAI,KAAK,GAA8B,EAAE,CAAC;gBAC1C,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9F,IAAI,CAAC;oBACJ,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;oBACvJ,MAAM,eAAe,GAAG,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,QAAS,CAAC,IAAI,CAAC,CAAC;oBACpG,IAAI,CAAC,IAAI,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,GAAG,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;oBAC3I,IAAI,MAAM,GAAG,CAAC,EAAE,KAA6B,CAAC;oBAC9C,GAAG,CAAC;wBACH,MAAM,EAAE,cAAc,EAAE,CAAC;wBACzB,MAAM,KAAK,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC;wBAC1L,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,WAAW,GAAG,EAAE,IAAI,KAAK,CAAC,WAAW,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;4BAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;wBACnY,KAAK,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;wBAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;wBAC3E,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,WAAW,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;4BAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;wBAC9O,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;wBAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;wBAC/C,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,CAAC,MAAM;4BAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;oBACpH,CAAC,QAAQ,MAAM,GAAG,KAAM,CAAC,MAAM,EAAE;oBACjC,MAAM,KAAK,GAAG,EAAE,SAAS,EAAE,WAAoB,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC,KAAM,CAAC,EAAE,CAAC;oBAClL,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;oBAAC,MAAM,EAAE,cAAc,EAAE,CAAC;oBAAC,OAAO,oBAAoB,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;gBACvK,CAAC;wBAAS,CAAC;oBAAC,WAAW,CAAC,KAAK,EAAE,CAAC;gBAAC,CAAC;YACnC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,cAAc,GAAG,KAAK,CAAC;gBAAC,MAAM,KAAK,CAAC;YAAC,CAAC;oBAChD,CAAC;gBACR,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC7C,IAAI,IAAI,EAAE,CAAC;oBAAC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC;oBAAC,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;wBAChE,IAAI,cAAc,KAAK,SAAS;4BAAE,MAAM,IAAI,cAAc,CAAC,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,gDAAgD,CAAC,CAAC;wBAC9I,MAAM,OAAO,CAAC,KAAK,CAAC;oBACrB,CAAC;gBAAC,CAAC;YACJ,CAAC;QACF,CAAC,EAAE,CAAC;AACL,CAAC"}

package/dist/artifacts/dist/contract.d.ts

@@ -0,0 +1,14 @@
+import type { ArtifactOperation, ArtifactRequest, ArtifactResults, ArtifactResult, EvidenceLocator, VisualSource, RasterEvidence } from './types.js';
+export declare const artifactToolName: (operation: ArtifactOperation) => string;
+export declare function record(value: unknown): Record<string, unknown>;
+export declare function validateSource(value: unknown): asserts value is VisualSource;
+export declare function validateLocator(value: unknown): asserts value is EvidenceLocator;
+export declare function validateRaster(value: unknown): asserts value is RasterEvidence;
+export declare function decodeArtifactRequest(value: unknown): ArtifactRequest;
+export declare function decodeArtifactResult<O extends ArtifactOperation>(operation: O, value: unknown): ArtifactResults[O];
+/** Managed worker metadata. PNG bytes travel through the existing attachment channel. */
+type ArtifactWireResult = Pick<ArtifactResult, 'status' | 'diagnostics' | 'artifact' | 'evidence'> & {
+    readonly imageRef?: RasterEvidence;
+};
+export declare function decodeArtifactWireResult(request: ArtifactRequest, value: unknown): ArtifactWireResult;
+export {};