@lumenkey/cli 0.3.0 → 0.4.0-rc.1

package/dist/studio/canvas-store.js

@@ -0,0 +1,205 @@
+import { randomUUID } from 'node:crypto';
+import { link, open, readdir, rename, unlink } from 'node:fs/promises';
+import path from 'node:path';
+import { z } from 'zod';
+import { assertRegularFile, assertStudioRoot } from './paths.js';
+import { prepareDocumentAuthority } from './document-authority.js';
+import { hasFsCode, StudioError } from './errors.js';
+import { isSafeJson, isoDate } from './run-journal.js';
+import { referenceIds } from './director-relations.js';
+const MAX_FILE_BYTES = 8 * 1024 * 1024;
+const MAX_SNAPSHOT_BYTES = 512 * 1024;
+const revision = z.number().int().nonnegative().safe();
+const uuid = z.string().uuid();
+const name = z.string().trim().min(1).max(120).refine(v => !/[\u0000-\u001f]/.test(v));
+const identifier = z.string().min(1).max(160).regex(/^[a-zA-Z0-9_-]+$/);
+const coordinate = z.number().finite().min(-1e7).max(1e7);
+const status = z.enum(['idle', 'editing', 'queued', 'running', 'success', 'error', 'disabled', 'locked']);
+const record = z.record(z.unknown());
+const config = z.object({
+    provider: z.string().max(200), model: z.string().max(200), input: z.string().max(200), output: z.string().max(200), status,
+    options: z.array(z.string().max(1000)).max(100), params: record.optional(),
+    uploads: z.array(z.object({ assetId: uuid, name: z.string().max(200), mimeType: z.string().max(100), size: revision,
+        role: z.enum(['reference', 'mask', 'firstFrame', 'lastFrame', 'audio', 'document', 'source']) }).strict()).max(100).optional(),
+}).strict();
+const node = z.object({
+    id: identifier, type: z.enum(['text', 'image', 'video', 'asset']), title: z.string().max(200), subtitle: z.string().max(2000).optional(),
+    position: z.object({ x: coordinate, y: coordinate }).strict(), width: z.number().finite().positive().max(10000), height: z.number().finite().positive().max(10000),
+    status, metadata: record.refine(v => v.studioAssetId === undefined || uuid.safeParse(v.studioAssetId).success),
+    config: config.optional(), allowedModels: z.array(z.string().max(200)).max(500).optional(),
+}).strict();
+const connection = z.object({ id: identifier, fromNodeId: identifier, toNodeId: identifier,
+    fromHandle: z.string().max(100).optional(), toHandle: z.string().max(100).optional(),
+    status: z.enum(['idle', 'queued', 'running', 'success', 'error', 'skipped']).optional(),
+}).strict();
+const customStyle = z.object({
+    id: z.string().min(1).max(40).regex(/^[a-zA-Z0-9_-]+$/),
+    name: z.string().trim().min(1).max(40).refine(v => !/[\u0000-\u001f]/.test(v) && !/^(https?:|file:)/i.test(v)),
+    prompt: z.string().trim().min(1).max(500).refine(v => !/[\u0000-\u001f]/.test(v) && !/^(https?:|file:)/i.test(v)),
+}).strict();
+const safeLine = (max) => z.string().trim().min(1).max(max).refine(v => !/[\u0000-\u001f]/.test(v) && !/^(https?:|file:)/i.test(v));
+const characterCard = z.object({
+    id: z.string().min(1).max(40).regex(/^[a-zA-Z0-9_-]+$/),
+    name: safeLine(40),
+    hair: safeLine(120).optional(),
+    face: safeLine(120).optional(),
+    clothing: safeLine(120).optional(),
+    marks: safeLine(120).optional(),
+    change: safeLine(200).optional(),
+    sourceAssetId: uuid.optional(),
+    skillId: z.enum(['character-view', 'character-sheet']).optional(),
+}).strict();
+const snapshotSchema = z.object({
+    version: z.literal('lumenkey-canvas-v1'), schemaVersion: z.literal(1), nodes: z.array(node).max(200), connections: z.array(connection).max(400),
+    viewport: z.object({ x: coordinate, y: coordinate, k: z.number().finite().min(0.05).max(10) }).strict(),
+    appearance: z.object({
+        grid: z.enum(['dot', 'line', 'blank']).optional(),
+        edge: z.enum(['curve', 'straight', 'ortho']).optional(),
+        hiddenEdges: z.boolean().optional(),
+        styles: z.array(customStyle).max(24).optional(),
+        characters: z.array(characterCard).max(24).optional(),
+    }).strict().optional(),
+}).strict().refine(v => {
+    const ids = new Set(v.nodes.map(n => n.id));
+    return ids.size === v.nodes.length && new Set(v.connections.map(c => c.id)).size === v.connections.length &&
+        v.connections.every(c => ids.has(c.fromNodeId) && ids.has(c.toNodeId)) && Buffer.byteLength(JSON.stringify(v)) <= MAX_SNAPSHOT_BYTES;
+});
+const document = z.object({ id: uuid, name, revision, createdAt: isoDate, updatedAt: isoDate, snapshot: snapshotSchema }).strict();
+const collection = z.object({ schemaVersion: z.literal(1), revision, documents: z.array(document).max(100) }).strict()
+    .refine(v => new Set(v.documents.map(d => d.id)).size === v.documents.length);
+const createInput = z.object({ name }).strict();
+const saveInput = z.object({ revision, name, snapshot: snapshotSchema }).strict();
+function parseInput(schema, value) {
+    if (!isSafeJson(value))
+        throw new StudioError('STUDIO_INPUT_INVALID');
+    const parsed = schema.safeParse(value);
+    if (!parsed.success)
+        throw new StudioError('STUDIO_INPUT_INVALID');
+    return parsed.data;
+}
+export function createCanvasAuthority(root, assertAssets, validateDirectors) {
+    const file = path.join(root.managedDir, 'canvases.json');
+    let current;
+    async function disk() {
+        await assertStudioRoot(root);
+        try {
+            await assertRegularFile(file);
+            const handle = await open(file, 'r');
+            try {
+                if ((await handle.stat()).size > MAX_FILE_BYTES)
+                    throw new Error();
+                const value = JSON.parse(await handle.readFile('utf8'));
+                if (!isSafeJson(value))
+                    throw new Error();
+                return collection.parse(value);
+            }
+            finally {
+                await handle.close();
+            }
+        }
+        catch (error) {
+            if (hasFsCode(error, 'ENOENT'))
+                return undefined;
+            throw new StudioError('STUDIO_CANVAS_INVALID', 409);
+        }
+    }
+    function serializedCollection(next) {
+        const valid = collection.safeParse(next);
+        if (!valid.success)
+            throw new StudioError('STUDIO_CANVAS_INVALID', 409);
+        const text = JSON.stringify(valid.data);
+        if (Buffer.byteLength(text) > MAX_FILE_BYTES)
+            throw new StudioError('STUDIO_CANVAS_CAPACITY_EXCEEDED', 409);
+        return text;
+    }
+    async function commit(next, initial = false) {
+        await assertStudioRoot(root);
+        const text = serializedCollection(next);
+        const temp = path.join(root.managedDir, `canvases.${randomUUID()}.tmp`);
+        const handle = await open(temp, 'wx', 0o600);
+        try {
+            await handle.writeFile(text);
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        await assertStudioRoot(root);
+        if (initial) {
+            await link(temp, file);
+            await unlink(temp);
+        }
+        else {
+            await assertRegularFile(file);
+            await rename(temp, file);
+        }
+    }
+    async function authority() {
+        const loaded = await disk();
+        if (loaded)
+            await prepareDocumentAuthority(root, 'canvases', true, 'STUDIO_CANVAS_INVALID');
+        if (current) {
+            if (!loaded || JSON.stringify(loaded) !== JSON.stringify(current))
+                throw new StudioError('STUDIO_CANVAS_INVALID', 409);
+        }
+        else if (loaded)
+            current = loaded;
+        else {
+            if ((await readdir(root.managedDir)).some(n => /^canvases\..+\.tmp$/.test(n)))
+                throw new StudioError('STUDIO_CANVAS_INVALID', 409);
+            await prepareDocumentAuthority(root, 'canvases', false, 'STUDIO_CANVAS_INVALID');
+            const empty = { schemaVersion: 1, revision: 0, documents: [] };
+            await commit(empty, true);
+            current = empty;
+        }
+        return current;
+    }
+    function find(before, id) {
+        if (!uuid.safeParse(id).success)
+            throw new StudioError('STUDIO_INPUT_INVALID');
+        const found = before.documents.find(d => d.id === id);
+        if (!found)
+            throw new StudioError('STUDIO_CANVAS_NOT_FOUND', 404);
+        return found;
+    }
+    async function prepareSave(id, value, pendingAssets = []) {
+        const input = parseInput(saveInput, value), before = await authority(), previous = find(before, id);
+        if (input.revision !== previous.revision)
+            throw new StudioError('STUDIO_CANVAS_CONFLICT', 409);
+        const assetIds = input.snapshot.nodes.flatMap(n => [
+            ...(typeof n.metadata.studioAssetId === 'string' ? [n.metadata.studioAssetId] : []), ...(n.config?.uploads?.map(u => u.assetId) ?? []), ...referenceIds(n.metadata),
+        ]);
+        await assertAssets([...new Set(assetIds)], pendingAssets);
+        const saved = { ...previous, ...input, revision: previous.revision + 1, updatedAt: new Date().toISOString() };
+        await validateDirectors(saved, previous, before.documents, pendingAssets);
+        const next = { ...before, revision: before.revision + 1, documents: before.documents.map(d => d.id === id ? saved : d) };
+        // Both capture preview and the actual write validate the complete file before any asset is registered.
+        serializedCollection(next);
+        return { before, saved, next };
+    }
+    return {
+        list: async () => ({ items: (await authority()).documents.map(({ snapshot: _snapshot, ...summary }) => structuredClone(summary)) }),
+        create: async (value) => {
+            const input = parseInput(createInput, value), before = await authority();
+            const now = new Date().toISOString();
+            const created = { id: randomUUID(), name: input.name, revision: 0, createdAt: now, updatedAt: now,
+                snapshot: { version: 'lumenkey-canvas-v1', schemaVersion: 1, nodes: [], connections: [], viewport: { x: 0, y: 0, k: 1 } } };
+            const next = { ...before, revision: before.revision + 1, documents: [...before.documents, created] };
+            await commit(next);
+            current = next;
+            return structuredClone(created);
+        },
+        read: async (id) => structuredClone(find(await authority(), id)),
+        previewSave: async (id, value, pendingAssets) => structuredClone((await prepareSave(id, value, pendingAssets)).saved),
+        save: async (id, value) => {
+            const { saved, next } = await prepareSave(id, value);
+            await commit(next);
+            current = next;
+            return structuredClone(saved);
+        },
+    };
+}
+export function serializeCanvasAuthority(authority, serial) {
+    return { list: () => serial(() => authority.list()), create: value => serial(() => authority.create(value)), read: id => serial(() => authority.read(id)), save: (id, value) => serial(() => authority.save(id, value)) };
+}
+//# sourceMappingURL=canvas-store.js.map

package/dist/studio/capture-placement.d.ts

@@ -0,0 +1,11 @@
+import type { StudioCanvasSnapshot } from './canvas-store.js';
+export declare const CAPTURE_NODE_SIZE: {
+    readonly width: 300;
+    readonly height: 240;
+};
+type Node = StudioCanvasSnapshot['nodes'][number];
+type Position = Node['position'];
+/** Only chooses the new node's position; persisted/replayed nodes never enter here. */
+export declare function capturePosition(nodes: readonly Node[], source: Node): Position;
+export {};
+//# sourceMappingURL=capture-placement.d.ts.map

package/dist/studio/capture-placement.js

@@ -0,0 +1,85 @@
+import { StudioError } from './errors.js';
+export const CAPTURE_NODE_SIZE = { width: 300, height: 240 };
+const GAP = 60;
+const MIN = -1e7;
+const MAX = 1e7;
+// NodeCard uses center coordinates and border-box sizing. Legacy positive sizes
+// can be smaller than its padding: full cards use 26px (video24), selected
+// borders1.5px per side; compact cards are smaller. Reserve that render maximum
+// across selection/LOD without rewriting stored dimensions or moving old nodes.
+const rectangle = (n) => {
+    const minimum = 2 * (n.type === 'video' ? 24 : 26) + 2 * 1.5;
+    const width = Math.max(n.width, minimum), height = Math.max(n.height, minimum);
+    return { left: n.position.x - width / 2, right: n.position.x + width / 2,
+        top: n.position.y - height / 2, bottom: n.position.y + height / 2 };
+};
+// A fallback candidate, not a rounded obstacle: preserve exact touching slots.
+const roundingMargin = (value) => Number.EPSILON * Math.max(1, Math.abs(value), 1000) * 8;
+/** Only chooses the new node's position; persisted/replayed nodes never enter here. */
+export function capturePosition(nodes, source) {
+    const { width, height } = CAPTURE_NODE_SIZE;
+    const halfWidth = width / 2, halfHeight = height / 2, obstacles = nodes.map(rectangle);
+    const preferred = { x: rectangle(source).left - GAP - halfWidth, y: source.position.y };
+    const minX = MIN + halfWidth, minY = MIN + halfHeight, maxX = MAX - halfWidth, maxY = MAX - halfHeight;
+    const preferredX = Math.max(minX, Math.min(maxX, preferred.x));
+    const rows = new Set([Math.max(minY, Math.min(maxY, preferred.y)), minY, maxY]);
+    for (const b of obstacles) {
+        const top = b.top - GAP - halfHeight, bottom = b.bottom + GAP + halfHeight;
+        const boundaries = [top, bottom];
+        if (top + halfHeight + GAP > b.top)
+            boundaries.push(top - roundingMargin(top));
+        if (bottom - halfHeight < b.bottom + GAP)
+            boundaries.push(bottom + roundingMargin(bottom));
+        for (const y of boundaries) {
+            if (y >= minY && y <= maxY)
+                rows.add(y);
+        }
+    }
+    let best, bestDistance = Infinity;
+    for (const y of rows) {
+        // A canvas has at most 200 nodes: <=803 rows, each O(n log n), no grid search.
+        const blocked = obstacles
+            .filter(b => y - halfHeight < b.bottom + GAP && y + halfHeight + GAP > b.top)
+            .map(b => ({ left: b.left - GAP - halfWidth, right: b.right + GAP + halfWidth }))
+            .sort((a, b) => a.left - b.left || a.right - b.right);
+        const merged = [];
+        for (const range of blocked) {
+            const last = merged.at(-1);
+            // Open intervals: touching endpoints remain a usable exact-clearance slot.
+            if (last && range.left < last.right)
+                last.right = Math.max(last.right, range.right);
+            else
+                merged.push({ ...range });
+        }
+        const obstructed = merged.find(range => preferredX > range.left && preferredX < range.right);
+        const clear = (x) => obstacles.every(b => x + halfWidth + GAP <= b.left || b.right + GAP <= x - halfWidth ||
+            y + halfHeight + GAP <= b.top || b.bottom + GAP <= y - halfHeight);
+        const columns = obstructed ? [obstructed.left, obstructed.right] : [preferredX];
+        // Only add fallback positions when exact boundary arithmetic is unsafe.
+        // Otherwise a sub-ULP distance tie could prefer an unnecessary tiny shift.
+        for (const x of [...columns])
+            if (!clear(x)) {
+                if (!obstructed || x === obstructed.left)
+                    columns.push(x - roundingMargin(x));
+                if (!obstructed || x === obstructed.right)
+                    columns.push(x + roundingMargin(x));
+            }
+        for (const x of columns) {
+            if (x < minX || x > maxX)
+                continue;
+            // Verify the actual arithmetic used by rectangles, including cancellation
+            // at fractional boundaries. A near-boundary candidate must never collide.
+            if (!clear(x))
+                continue;
+            const distance = (x - preferred.x) ** 2 + (y - preferred.y) ** 2;
+            if (!best || distance < bestDistance || (distance === bestDistance && (y < best.y || (y === best.y && x < best.x)))) {
+                best = { x, y };
+                bestDistance = distance;
+            }
+        }
+    }
+    if (!best)
+        throw new StudioError('STUDIO_CAPTURE_CAPACITY_EXCEEDED', 409);
+    return best;
+}
+//# sourceMappingURL=capture-placement.js.map

package/dist/studio/cloud-contract.d.ts

@@ -0,0 +1,128 @@
+import { z } from 'zod';
+import { LumenKeyError } from '../core/client.js';
+import { type FailureContext } from '../core/outcome.js';
+import type { ModelItem } from '../core/types.js';
+import { StudioError } from './errors.js';
+import { type StudioJob, type StudioRun } from './run-journal.js';
+export declare const quoteRequest: z.ZodObject<{
+    requestId: z.ZodString;
+    modelId: z.ZodString;
+    input: z.ZodPipeline<z.ZodEffects<z.ZodUnknown, unknown, unknown>, z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strict", z.ZodTypeAny, {
+    modelId: string;
+    input: Record<string, unknown>;
+    requestId: string;
+}, {
+    modelId: string;
+    requestId: string;
+    input?: unknown;
+}>;
+export declare function studioKeepsModel(model: {
+    type?: string;
+    capabilities?: string[];
+    inputSchema?: {
+        properties?: unknown;
+    };
+}): boolean;
+export declare function projectModels(models: ModelItem[], secret: string): ModelItem[];
+export declare function assertNoCredential(value: unknown, secret: string): void;
+export declare function validateInput(model: ModelItem, input: Record<string, unknown>): void;
+export declare function safeCloudCode(error: unknown, secret?: string): string;
+export declare function cloudDiagnostic(error: unknown, secret?: string, ctx?: FailureContext): {
+    resumeDeadline?: string | undefined;
+    recovery?: import("../core/locale.js").UnknownRecovery | undefined;
+    submission?: import("../core/outcome.js").Submission | undefined;
+    httpStatus?: number | undefined;
+    code: string;
+    message: string;
+    type: string;
+};
+export declare function safeCloudFailure(error: unknown, secret?: string, ctx?: FailureContext): StudioError | LumenKeyError;
+export declare function cloudHttpError(error: unknown): {
+    status: number;
+    body: {
+        error: {
+            resumeDeadline?: string | undefined;
+            recovery?: import("../core/locale.js").UnknownRecovery | undefined;
+            submission?: import("../core/outcome.js").Submission | undefined;
+            httpStatus?: number | undefined;
+            code: string;
+            message: string;
+            type: string;
+        };
+    };
+};
+export declare function outputIdentity(job: StudioJob): {
+    status: "UNVERIFIED";
+    reason: "LEGACY_AWAITING_FRESH_GET" | "JOB_UNAVAILABLE" | "NO_VERIFIABLE_OUTPUTS" | "IDENTITY_CONFLICT";
+} | {
+    status: "VERIFIED";
+    reason: null;
+};
+/** Phase-1 read projection; the caller must obtain one authorized authority snapshot. */
+export declare function projectOutputViews(run: Pick<StudioRun, 'runId' | 'job'>, options: {
+    rootReady: boolean;
+    authorityHealthy: boolean;
+    rootNotAllowed?: boolean;
+}): {
+    localOutputId: string | null;
+    runId: string;
+    jobId: string;
+    gatewayAssetId: string | null;
+    outputIndex: number | null;
+    displayOrdinal: number;
+    outputType: string | null;
+    mediaType: null;
+    identity: {
+        status: "UNVERIFIED";
+        reason: "LEGACY_AWAITING_FRESH_GET" | "JOB_UNAVAILABLE" | "NO_VERIFIABLE_OUTPUTS" | "IDENTITY_CONFLICT";
+    } | {
+        status: "VERIFIED";
+        reason: null;
+    };
+    acceptance: "UNKNOWN" | "NEVER_ACCEPTED";
+    saveAllowed: boolean;
+    saveBlockedCode: string | null;
+    saveOperationId: null;
+    save: null;
+}[];
+export declare function projectJob(value: unknown, secret: string, previous?: StudioJob, freshGet?: boolean): StudioJob;
+export declare function publicRun(run: StudioRun): {
+    createdAt: string;
+    updatedAt: string;
+    failure?: {
+        code: string;
+        message: string;
+        type: string;
+        httpStatus?: number | undefined;
+        submission?: "created" | "none" | "unknown" | undefined;
+        recovery?: "expired" | "rerun" | "resume-command" | "ledger" | undefined;
+        resumeDeadline?: string | undefined;
+    } | undefined;
+    lastErrorCode?: string | undefined;
+    job?: {
+        status: "accepted" | "policy_checking" | "queued" | "submitting" | "provider_running" | "output_checking" | "succeeded" | "rejected" | "failed" | "cancelled" | "expired";
+        jobId: string;
+        outputs: {
+            url: string;
+            type?: string | undefined;
+            assetId?: string | undefined;
+            outputIndex?: number | undefined;
+        }[];
+        error?: {
+            code: string;
+            message: string;
+        } | undefined;
+        identityReason?: "LEGACY_AWAITING_FRESH_GET" | "JOB_UNAVAILABLE" | "NO_VERIFIABLE_OUTPUTS" | "IDENTITY_CONFLICT" | undefined;
+    } | undefined;
+    runId: string;
+    modelId: string;
+    state: "QUOTED" | "SUBMISSION_UNKNOWN" | "SUBMISSION_REJECTED" | "ACCEPTED" | "TERMINAL";
+    quote: {
+        credits: number;
+        quoteId: string;
+        modelId: string;
+        expiresAt: string;
+    };
+};
+//# sourceMappingURL=cloud-contract.d.ts.map

package/dist/studio/cloud-contract.js

@@ -0,0 +1,229 @@
+import { z } from 'zod';
+import { createHash } from 'node:crypto';
+import { LumenKeyError, redactPublicDetail } from '../core/client.js';
+import { failure } from '../core/outcome.js';
+import { StudioError } from './errors.js';
+import { errorCode, inputSchema, isSafeJson, jobSchema, uuid } from './run-journal.js';
+export const quoteRequest = z.object({ requestId: uuid, modelId: z.string().min(1).max(200), input: inputSchema }).strict();
+const modelSchema = z.object({
+    id: z.string().min(1).max(200), displayName: z.string().max(300).optional(), name: z.string().max(300).optional(),
+    type: z.string().max(40).optional(), capabilities: z.array(z.string().max(80)).max(50).optional(),
+    inputSchema: z.record(z.unknown()).refine(isSafeJson),
+    pricing: z.array(z.object({ unit: z.string().max(100), credits: z.number().nonnegative().finite() })).max(200).optional(),
+});
+const IMAGE_INPUT = /^(image|image_url|imageUrl|reference_image|referenceImage|first_frame|firstFrame|images|reference_images)$/;
+export function studioKeepsModel(model) {
+    const caps = Array.isArray(model?.capabilities) ? model.capabilities : [];
+    if (['image', 'video'].some(kind => model?.type === kind || caps.includes(kind)))
+        return true;
+    const readsText = model?.type === 'chat' || model?.type === 'text' || caps.includes('chat') || caps.includes('text');
+    const properties = model?.inputSchema?.properties;
+    if (!readsText || !properties || typeof properties !== 'object' || Array.isArray(properties))
+        return false;
+    return Object.keys(properties).some(key => IMAGE_INPUT.test(key));
+}
+export function projectModels(models, secret) {
+    if (models.length > 10000 || new Set(models.map(m => m.id)).size !== models.length)
+        throw new StudioError('STUDIO_CLOUD_RESPONSE_INVALID', 502);
+    const kept = [];
+    for (const model of models) {
+        if (!studioKeepsModel(model))
+            continue;
+        const parsed = modelSchema.safeParse(model);
+        const properties = parsed.success ? parsed.data.inputSchema.properties : undefined;
+        const usable = parsed.success && properties && typeof properties === 'object' && !Array.isArray(properties) && isSafeJson(properties);
+        const generates = ['image', 'video'].some(kind => model.type === kind || model.capabilities?.includes(kind));
+        if (!usable) {
+            if (generates)
+                throw new StudioError('STUDIO_CLOUD_RESPONSE_INVALID', 502);
+            continue;
+        }
+        assertNoCredential(parsed.data, secret);
+        kept.push(parsed.data);
+    }
+    return kept;
+}
+export function assertNoCredential(value, secret) {
+    if (secret && JSON.stringify(value).includes(secret))
+        throw new StudioError('STUDIO_CLOUD_RESPONSE_INVALID', 502);
+}
+export function validateInput(model, input) {
+    const properties = model.inputSchema?.properties;
+    function check(value, spec, depth) {
+        if (!spec || typeof spec !== 'object' || Array.isArray(spec) || depth > 20)
+            throw new StudioError('STUDIO_INPUT_INVALID');
+        const s = spec;
+        if (Array.isArray(s.enum) && !s.enum.some(v => JSON.stringify(v) === JSON.stringify(value)))
+            throw new StudioError('STUDIO_INPUT_INVALID');
+        const type = s.type;
+        if (typeof type === 'string') {
+            const valid = type === 'integer' ? Number.isSafeInteger(value) : type === 'number' ? typeof value === 'number' && Number.isFinite(value) : type === 'array' ? Array.isArray(value) : type === 'object' ? !!value && typeof value === 'object' && !Array.isArray(value) : type === 'null' ? value === null : ['string', 'boolean'].includes(type) ? typeof value === type : false;
+            if (!valid)
+                throw new StudioError('STUDIO_INPUT_INVALID');
+        }
+        if (Array.isArray(value) && s.items)
+            for (const item of value)
+                check(item, s.items, depth + 1);
+        if (value && typeof value === 'object' && !Array.isArray(value) && s.properties && typeof s.properties === 'object') {
+            const p = s.properties;
+            for (const [k, v] of Object.entries(value)) {
+                if (Object.hasOwn(p, k))
+                    check(v, p[k], depth + 1);
+                else if (s.additionalProperties === false)
+                    throw new StudioError('STUDIO_INPUT_INVALID');
+            }
+        }
+    }
+    for (const [key, value] of Object.entries(input)) {
+        if (!Object.hasOwn(properties, key))
+            throw new StudioError('STUDIO_INPUT_INVALID');
+        check(value, properties[key], 0);
+    }
+    // Required fields/default application and full JSON Schema remain gateway authority.
+}
+export function safeCloudCode(error, secret) {
+    const code = error instanceof LumenKeyError && errorCode.safeParse(error.code).success ? error.code : error instanceof StudioError ? error.code : 'STUDIO_CLOUD_FAILED';
+    return secret && code.includes(secret) ? 'STUDIO_CLOUD_FAILED' : code;
+}
+const diagnostics = new WeakMap();
+export function cloudDiagnostic(error, secret, ctx = {}) {
+    const status = error instanceof LumenKeyError || error instanceof StudioError ? error.status : undefined;
+    const safe = error instanceof StudioError ? error : new LumenKeyError(safeCloudCode(error, secret), status);
+    // Never pass keys, paths, raw job bodies or upstream detail to the HTTP projection.
+    const result = failure(safe, { submission: ctx.submission, recovery: ctx.recovery, recordedAt: ctx.recordedAt });
+    return { code: result.code, message: result.message, type: result.type,
+        ...(result.httpStatus !== undefined ? { httpStatus: result.httpStatus } : {}),
+        ...(result.submission ? { submission: result.submission } : {}),
+        ...(result.recovery ? { recovery: result.recovery } : {}),
+        ...(result.resumeDeadline ? { resumeDeadline: result.resumeDeadline } : {}) };
+}
+export function safeCloudFailure(error, secret, ctx) {
+    if (error instanceof Error && diagnostics.has(error) && !ctx)
+        return error;
+    const status = error instanceof LumenKeyError && Number.isInteger(error.status) && error.status >= 400 && error.status <= 599 ? error.status : undefined;
+    const safe = error instanceof StudioError ? error : new LumenKeyError(safeCloudCode(error, secret), status);
+    diagnostics.set(safe, cloudDiagnostic(safe, secret, ctx));
+    return safe;
+}
+export function cloudHttpError(error) {
+    const status = error instanceof StudioError ? error.status : error instanceof LumenKeyError && Number.isInteger(error.status) && error.status >= 400 && error.status <= 599 ? error.status : 502;
+    const diagnostic = error instanceof Error ? diagnostics.get(error) : undefined;
+    return { status, body: { error: diagnostic ?? cloudDiagnostic(error) } };
+}
+export function outputIdentity(job) {
+    const withIds = job.outputs.filter(o => o.assetId !== undefined || o.outputIndex !== undefined);
+    if (withIds.some(o => !uuid.safeParse(o.assetId).success || !Number.isSafeInteger(o.outputIndex) || o.outputIndex < 0 || !['image', 'video', 'audio'].includes(o.type ?? '')) ||
+        new Set(withIds.map(o => o.assetId?.toLowerCase())).size !== withIds.length || new Set(withIds.map(o => o.outputIndex)).size !== withIds.length) {
+        return { status: 'UNVERIFIED', reason: 'IDENTITY_CONFLICT' };
+    }
+    const reason = job.identityReason ?? (job.outputs.length && job.outputs.every(o => o.assetId !== undefined && o.outputIndex !== undefined) ? null : 'LEGACY_AWAITING_FRESH_GET');
+    return reason ? { status: 'UNVERIFIED', reason } : { status: 'VERIFIED', reason: null };
+}
+// Fixed Studio output namespace. Names are runId:gatewayAssetId, not URL/ordinal.
+const OUTPUT_NAMESPACE = Buffer.from('a5fd4b08c7a54fe99ba09c1383a484c5', 'hex');
+function localOutputId(runId, assetId) {
+    const bytes = createHash('sha1').update(OUTPUT_NAMESPACE).update(`${runId.toLowerCase()}:${assetId.toLowerCase()}`, 'utf8').digest().subarray(0, 16);
+    bytes[6] = (bytes[6] & 0x0f) | 0x50;
+    bytes[8] = (bytes[8] & 0x3f) | 0x80;
+    const hex = bytes.toString('hex');
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+/** Phase-1 read projection; the caller must obtain one authorized authority snapshot. */
+export function projectOutputViews(run, options) {
+    if (options.rootReady && !options.rootNotAllowed && !options.authorityHealthy)
+        throw new StudioError('SAVE_AUTHORITY_UNAVAILABLE', 503);
+    if (!run.job)
+        return [];
+    const job = run.job;
+    const identity = outputIdentity(job);
+    const terminal = ['succeeded', 'failed', 'rejected', 'cancelled', 'expired'].includes(job.status);
+    return job.outputs.map((output, index) => {
+        const verified = identity.status === 'VERIFIED';
+        let saveBlockedCode = options.rootNotAllowed ? 'SAVE_ROOT_NOT_ALLOWED' : !options.rootReady ? 'SAVE_OUTPUT_ROOT_REQUIRED' : null;
+        saveBlockedCode ??= !verified ? identity.reason === 'IDENTITY_CONFLICT' ? 'SAVE_OUTPUT_IDENTITY_CONFLICT' : 'SAVE_OUTPUT_IDENTITY_UNVERIFIED' : null;
+        saveBlockedCode ??= !terminal ? 'SAVE_JOB_NOT_TERMINAL' : null;
+        saveBlockedCode ??= terminal && (job.status !== 'succeeded' || job.error) ? 'SAVE_SOURCE_UNAVAILABLE' : null;
+        saveBlockedCode ??= !['image', 'video'].includes(output.type ?? '') || !output.url.startsWith('https://') ? 'SAVE_MEDIA_UNSUPPORTED' : null;
+        return { localOutputId: verified ? localOutputId(run.runId, output.assetId) : null,
+            runId: run.runId, jobId: job.jobId, gatewayAssetId: verified ? output.assetId : null,
+            outputIndex: verified ? output.outputIndex : null, displayOrdinal: index + 1,
+            outputType: ['image', 'video', 'audio'].includes(output.type ?? '') ? output.type : null,
+            mediaType: null, identity, acceptance: verified && options.rootReady && options.authorityHealthy ? 'NEVER_ACCEPTED' : 'UNKNOWN',
+            saveAllowed: saveBlockedCode === null, saveBlockedCode, saveOperationId: null, save: null };
+    });
+}
+export function projectJob(value, secret, previous, freshGet = false) {
+    const v = value;
+    const outputs = [];
+    // A known contradiction must not silently heal merely because the same bad
+    // response repeats (or the source temporarily omits all outputs).
+    let conflict = previous?.identityReason === 'IDENTITY_CONFLICT';
+    // Private immutable type evidence outlives an absent/partial locator snapshot.
+    // Legacy jobs seed it from their known valid outputs; never infer it by order.
+    const evidence = new Map();
+    for (const item of [...previous?.identityEvidence ?? [], ...previous?.outputs ?? []]) {
+        if (uuid.safeParse(item.assetId).success && ['image', 'video', 'audio'].includes(item.type ?? '')) {
+            const id = item.assetId.toLowerCase();
+            const old = evidence.get(id);
+            if (old && old !== item.type)
+                conflict = true;
+            else
+                evidence.set(id, item.type);
+        }
+    }
+    const ids = new Set();
+    const indexes = new Set();
+    if (Array.isArray(v.outputs))
+        for (const item of v.outputs) {
+            if (!item || typeof item.url !== 'string')
+                throw new StudioError('STUDIO_CLOUD_RESPONSE_INVALID', 502);
+            let url;
+            try {
+                url = new URL(item.url);
+            }
+            catch {
+                throw new StudioError('STUDIO_CLOUD_RESPONSE_INVALID', 502);
+            }
+            const imageData = url.protocol === 'data:' && /^data:image\/(?:png|jpeg|webp);base64,[A-Za-z0-9+/]*={0,2}$/.test(item.url);
+            if ((!['https:', 'http:'].includes(url.protocol) && !imageData) || url.username || url.password)
+                throw new StudioError('STUDIO_CLOUD_RESPONSE_INVALID', 502);
+            const projected = { url: item.url, ...(typeof item.type === 'string' ? { type: item.type } : {}) };
+            if (item.assetId !== undefined || item.outputIndex !== undefined) {
+                if (!uuid.safeParse(item.assetId).success || !Number.isSafeInteger(item.outputIndex) || item.outputIndex < 0 || !['image', 'video', 'audio'].includes(item.type))
+                    conflict = true;
+                else {
+                    projected.assetId = item.assetId;
+                    projected.outputIndex = item.outputIndex;
+                    const id = item.assetId.toLowerCase();
+                    const old = evidence.get(id);
+                    if (ids.has(id) || indexes.has(item.outputIndex) || (old && old !== item.type))
+                        conflict = true;
+                    if (freshGet && !old)
+                        evidence.set(id, item.type);
+                    ids.add(id);
+                    indexes.add(item.outputIndex);
+                }
+            }
+            outputs.push(projected);
+        }
+    let error;
+    if (v.error) {
+        const raw = typeof v.error === 'object' ? v.error : {};
+        error = { code: errorCode.safeParse(raw.code).success ? raw.code : 'JOB_TERMINAL_FAILURE', message: redactPublicDetail(raw.message, secret) || '任务返回错误；扣费状态以平台账本为准。' };
+    }
+    else if (v.status === 'succeeded' && outputs.length === 0)
+        error = { code: 'STUDIO_JOB_OUTPUT_MISSING', message: '任务没有可用输出，不能确认生成成功。' };
+    const identityReason = conflict ? 'IDENTITY_CONFLICT' : freshGet && (!outputs.length || outputs.some(o => !o.assetId)) ? 'NO_VERIFIABLE_OUTPUTS' : !freshGet && outputs.some(o => o.assetId) ? 'LEGACY_AWAITING_FRESH_GET' : undefined;
+    const identityEvidence = [...evidence].map(([assetId, type]) => ({ assetId, type }));
+    const parsed = jobSchema.safeParse({ jobId: v.jobId ?? v.id, status: v.status, outputs, ...(identityEvidence.length ? { identityEvidence } : {}), ...(identityReason ? { identityReason } : {}), ...(error ? { error } : {}) });
+    if (!parsed.success)
+        throw new StudioError('STUDIO_CLOUD_RESPONSE_INVALID', 502);
+    assertNoCredential(parsed.data, secret);
+    return parsed.data;
+}
+export function publicRun(run) {
+    const publicJob = run.job ? (({ identityEvidence: _private, ...job }) => job)(run.job) : undefined;
+    const diagnostic = run.lastFailure ?? (['SUBMITTING', 'SUBMISSION_UNKNOWN'].includes(run.state) ? cloudDiagnostic(new LumenKeyError(run.lastErrorCode ?? 'STUDIO_SUBMISSION_UNRESOLVED'), undefined, { submission: run.job ? 'created' : 'unknown', recovery: run.job ? undefined : 'ledger' }) : undefined);
+    return structuredClone({ runId: run.runId, modelId: run.modelId, state: run.state === 'SUBMITTING' ? 'SUBMISSION_UNKNOWN' : run.state, quote: run.quote, ...(publicJob ? { job: publicJob } : {}), ...(run.lastErrorCode ? { lastErrorCode: run.lastErrorCode } : {}), ...(diagnostic ? { failure: diagnostic } : {}), createdAt: run.createdAt, updatedAt: run.updatedAt });
+}
+//# sourceMappingURL=cloud-contract.js.map