@lumenkey/cli 0.3.1 → 0.4.0-rc.1

package/dist/core/params.js

@@ -1,48 +1,49 @@
+import { zhText } from '../core/chinese-messages.js';
 import { z } from 'zod';
 import { LumenKeyError } from './client.js';
 import { parseCreditCap } from './credit-cap.js';
 import { asPairs, modelParameterError } from './set-values.js';
 import { isBlankPrompt, promptRequiredSentence, ui } from './locale.js';
 const text = (en, zh) => ({ en, zh });
-const modelId = { name: 'modelId', kind: 'string', required: true, flag: '--model', aliases: ['-m'], placeholder: '<modelId>', describe: text('Model ID', '模型 ID') };
-const prompt = { name: 'prompt', kind: 'string', required: true, flag: '--prompt', aliases: ['-p'], placeholder: '<prompt>', describe: text('Prompt for the model', '发给模型的提示词') };
-const confirm = { name: 'confirm', kind: 'boolean', flag: '--confirm', describe: text('Explicitly submit this billable generation; otherwise quote only', '确认提交这次计费生成；否则只报价') };
-const dryRun = { name: 'dryRun', kind: 'boolean', flag: '--dry-run', only: 'cli', describe: text('Print the projected input and do not quote', '只打印将提交的输入，不报价') };
-const idempotencyKey = { name: 'idempotencyKey', kind: 'string', flag: '--idempotency-key', placeholder: '<key>', describe: text('Optional. Generated when omitted. Reuse it only to recover a submission whose outcome was unknown; the recorded body is re-sent unchanged', '可选，省略时自动生成。只在提交结果未知时复用，记录的请求体会原样重发') };
-const maxCredits = { name: 'maxCredits', kind: 'number', constraint: 'integer-nonnegative', flag: '--max-credits', placeholder: '<credits>', describe: text('Reject quotes above this spending cap (non-negative integer)', '报价超过该花费上限时拒绝（非负整数）') };
-const projectId = { name: 'projectId', kind: 'string', only: 'mcp', describe: text('Leave empty. The client fills this.', '请留空，由客户端填入。') };
-const downloadPath = { name: 'downloadPath', kind: 'string', flag: '--output', aliases: ['-o'], placeholder: '<path>', describe: text('Save the first result to this file path (absolute or ~/...). Omit it to receive the URLs only', '把第一个结果保存到该文件路径（绝对路径或 ~/ 开头）；省略则只返回地址') };
-const set = { name: 'set', kind: 'string[]', flag: '--set', aliases: ['-s'], placeholder: '<pair>', describe: text('Extra key=value declared by the model schema. Repeatable', '模型参数结构声明的额外 key=value，可重复') };
-const intervalMs = { name: 'intervalMs', kind: 'number', constraint: 'positive', flag: '--interval', placeholder: '<seconds>', default: 5000, describe: text('Polling interval; defaults to 5 seconds', '轮询间隔；默认 5 秒') };
-const timeoutMs = { name: 'timeoutMs', kind: 'number', constraint: 'nonnegative', flag: '--timeout', placeholder: '<seconds>', default: 1_800_000, describe: text('Wait timeout; defaults to 1800 seconds. Does not cancel the task', '等待超时；默认 1800 秒，超时不取消任务') };
-const resolution = { name: 'resolution', kind: 'string', flag: '--resolution', aliases: ['-r'], placeholder: '<res>', describe: text('Resolution, only if the catalog declares it', '分辨率，仅当目录声明了该字段') };
-const ratio = { name: 'ratio', kind: 'string', flag: '--aspect-ratio', aliases: ['--ratio'], placeholder: '<ratio>', describe: text('Aspect ratio, only if the catalog declares aspect_ratio or ratio', '宽高比，仅当目录声明了 aspect_ratio 或 ratio') };
-const count = { name: 'count', kind: 'numeric', flag: '--count', placeholder: '<count>', describe: text('Count, only if the catalog declares it; validated against the catalog type', '数量，仅当目录声明了该字段；按目录类型校验') };
+const modelId = { name: 'modelId', kind: 'string', required: true, flag: '--model', aliases: ['-m'], placeholder: '<modelId>', describe: text('Model ID', zhText("m238")) };
+const prompt = { name: 'prompt', kind: 'string', required: true, flag: '--prompt', aliases: ['-p'], placeholder: '<prompt>', describe: text('Prompt for the model', zhText("m237")) };
+const confirm = { name: 'confirm', kind: 'boolean', flag: '--confirm', describe: text('Explicitly submit this billable generation; otherwise quote only', zhText("m236")) };
+const dryRun = { name: 'dryRun', kind: 'boolean', flag: '--dry-run', only: 'cli', describe: text('Print the projected input and do not quote', zhText("m235")) };
+const idempotencyKey = { name: 'idempotencyKey', kind: 'string', flag: '--idempotency-key', placeholder: '<key>', describe: text('Optional. Generated when omitted. Reuse it only to recover a submission whose outcome was unknown; the recorded body is re-sent unchanged', zhText("m234")) };
+const maxCredits = { name: 'maxCredits', kind: 'number', constraint: 'integer-nonnegative', flag: '--max-credits', placeholder: '<credits>', describe: text('Reject quotes above this spending cap (non-negative integer)', zhText("m233")) };
+const projectId = { name: 'projectId', kind: 'string', only: 'mcp', describe: text('Leave empty. The client fills this.', zhText("m232")) };
+const downloadPath = { name: 'downloadPath', kind: 'string', flag: '--output', aliases: ['-o'], placeholder: '<path>', describe: text('Save the first result to this file path (absolute or ~/...). Omit it to receive the URLs only', zhText("m231")) };
+const set = { name: 'set', kind: 'string[]', flag: '--set', aliases: ['-s'], placeholder: '<pair>', describe: text('Extra key=value declared by the model schema. Repeatable', zhText("m230")) };
+const intervalMs = { name: 'intervalMs', kind: 'number', constraint: 'positive', flag: '--interval', placeholder: '<seconds>', default: 5000, describe: text('Polling interval; defaults to 5 seconds', zhText("m229")) };
+const timeoutMs = { name: 'timeoutMs', kind: 'number', constraint: 'nonnegative', flag: '--timeout', placeholder: '<seconds>', default: 1_800_000, describe: text('Wait timeout; defaults to 1800 seconds. Does not cancel the task', zhText("m228")) };
+const resolution = { name: 'resolution', kind: 'string', flag: '--resolution', aliases: ['-r'], placeholder: '<res>', describe: text('Resolution, only if the catalog declares it', zhText("m227")) };
+const ratio = { name: 'ratio', kind: 'string', flag: '--aspect-ratio', aliases: ['--ratio'], placeholder: '<ratio>', describe: text('Aspect ratio, only if the catalog declares aspect_ratio or ratio', zhText("m226")) };
+const count = { name: 'count', kind: 'numeric', flag: '--count', placeholder: '<count>', describe: text('Count, only if the catalog declares it; validated against the catalog type', zhText("m225")) };
 export const videoParams = [
     modelId, prompt,
-    { name: 'imageUrl', kind: 'string', flag: '--image', aliases: ['-i'], placeholder: '<imageUrl>', describe: text('Source image URL for image-to-video, only if the catalog declares it', '图生视频的源图地址，仅当目录声明了该字段') },
+    { name: 'imageUrl', kind: 'string', flag: '--image', aliases: ['-i'], placeholder: '<imageUrl>', describe: text('Source image URL for image-to-video, only if the catalog declares it', zhText("m224")) },
     // No numeric constraint on duration: the catalog decides what a valid duration is (an explicit 0 is passed through, as in 0.2.3).
-    { name: 'duration', kind: 'number', flag: '--duration', aliases: ['-d'], placeholder: '<seconds>', describe: text('Video duration in seconds; omitted scalar catalog defaults are explicitly sent', '视频时长（秒）；省略时会显式发送目录中的标量默认值') },
+    { name: 'duration', kind: 'number', flag: '--duration', aliases: ['-d'], placeholder: '<seconds>', describe: text('Video duration in seconds; omitted scalar catalog defaults are explicitly sent', zhText("m223")) },
     resolution, ratio, count, set, dryRun, confirm, idempotencyKey, maxCredits, projectId, downloadPath, intervalMs, timeoutMs,
 ];
 export const imageParams = [
     modelId, prompt,
-    { name: 'imageUrl', kind: 'string', flag: '--image', placeholder: '<imageUrl>', describe: text('Reference image URL, only if the catalog declares it', '参考图地址，仅当目录声明了该字段') },
+    { name: 'imageUrl', kind: 'string', flag: '--image', placeholder: '<imageUrl>', describe: text('Reference image URL, only if the catalog declares it', zhText("m222")) },
     { ...resolution, aliases: undefined }, ratio,
-    { name: 'size', kind: 'string', flag: '--size', placeholder: '<size>', describe: text('Legacy size, only for models whose catalog schema declares size', '旧版尺寸参数，仅用于目录声明了 size 的模型') },
+    { name: 'size', kind: 'string', flag: '--size', placeholder: '<size>', describe: text('Legacy size, only for models whose catalog schema declares size', zhText("m221")) },
     count, set, dryRun, confirm, idempotencyKey, maxCredits, projectId, downloadPath, intervalMs, timeoutMs,
 ];
 export const chatParams = [
-    { ...modelId, required: false, default: 'qwen3.7-flash', describe: text('Model ID (e.g. qwen3.7-flash, qwen3.8-max, grok-4.6)', '模型 ID（例如 qwen3.7-flash、qwen3.8-max、grok-4.6）') },
-    { ...prompt, describe: text('User message to send to the model', '发送给模型的用户消息') },
-    { name: 'systemPrompt', kind: 'string', flag: '--system-prompt', placeholder: '<prompt>', describe: text('Optional system instruction; a blank one is not sent', '可选的系统指令；空白时不发送') },
-    { ...maxCredits, describe: text('Reject before inference if the required reservation exceeds this spending cap (non-negative integer)', '所需预授权超过该花费上限时在推理前拒绝（非负整数）') },
-    { ...idempotencyKey, describe: text('Reuse only for an identical request; after a timeout, retry the identical request with the key that was reported', '仅为同一次相同请求复用；超时后用结果里报告的键原样重试') },
+    { ...modelId, required: false, default: 'qwen3.7-flash', describe: text('Model ID (e.g. qwen3.7-flash, qwen3.8-max, grok-4.6)', zhText("m220")) },
+    { ...prompt, describe: text('User message to send to the model', zhText("m219")) },
+    { name: 'systemPrompt', kind: 'string', flag: '--system-prompt', placeholder: '<prompt>', describe: text('Optional system instruction; a blank one is not sent', zhText("m218")) },
+    { ...maxCredits, describe: text('Reject before inference if the required reservation exceeds this spending cap (non-negative integer)', zhText("m217")) },
+    { ...idempotencyKey, describe: text('Reuse only for an identical request; after a timeout, retry the identical request with the key that was reported', zhText("m216")) },
 ];
 export const waitParams = [intervalMs, timeoutMs];
 /** `tasks resume <key>` / `lumenkey_resume_submission`: the key plus wait and output options; no generation argument. */
 export const resumeParams = [
-    { ...idempotencyKey, required: true, only: 'mcp', describe: text('The idempotency key of the recorded submission to re-send verbatim', '要原样重发的已记录提交的幂等键') },
+    { ...idempotencyKey, required: true, only: 'mcp', describe: text('The idempotency key of the recorded submission to re-send verbatim', zhText("m215")) },
     downloadPath, intervalMs, timeoutMs,
 ];
 export function forSurface(spec, surface) {
@@ -126,7 +127,7 @@ export function waitMs(value, surface, fallbackMs) {
 }
 function shortIntervalWarning(intervalMs, surface) {
     if (surface === 'cli' && intervalMs > 0 && intervalMs < 1000) {
-        process.stderr.write(ui('Warning [POLL_INTERVAL_SHORT]: --interval uses seconds. Values below 1 second may cause excessive polling; consider --interval 5.\n', '警告 [POLL_INTERVAL_SHORT]：--interval 单位为秒。小于 1 秒可能导致过于频繁的查询；建议使用 --interval 5。\n'));
+        process.stderr.write(ui('Warning [POLL_INTERVAL_SHORT]: --interval uses seconds. Values below 1 second may cause excessive polling; consider --interval 5.\n', zhText("m214")));
     }
 }
 function countValue(value) {

package/dist/core/profiles.js

@@ -1,3 +1,4 @@
+import { zhText } from '../core/chinese-messages.js';
 import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
@@ -25,7 +26,7 @@ export class ProfileError extends LumenKeyError {
 }
 export class ProfileMissingError extends ProfileError {
     constructor(name) {
-        super('PROFILE_MISSING', ui(`Profile ${name} does not exist.`, `档案 ${name} 不存在。`));
+        super('PROFILE_MISSING', ui(`Profile ${name} does not exist.`, (zhText("m242") + (name) + zhText("m243"))));
     }
 }
 function filePath(home = os.homedir()) {
@@ -52,18 +53,18 @@ function object(value) {
 }
 function validName(name) {
     if (!name.trim() || Object.prototype.hasOwnProperty.call(Object.prototype, name)) {
-        throw new ProfileError('PROFILE_INVALID', ui('Invalid profile name.', '档案名称无效。'));
+        throw new ProfileError('PROFILE_INVALID', ui('Invalid profile name.', zhText("m241")));
     }
 }
 function validate(value) {
     if (!object(value) || !object(value.profiles) || (value.current !== undefined && typeof value.current !== 'string')) {
-        throw new ProfileError('PROFILE_INVALID', ui('profiles.json must contain a profiles object.', 'profiles.json 必须包含 profiles 对象。'));
+        throw new ProfileError('PROFILE_INVALID', ui('profiles.json must contain a profiles object.', zhText("m240")));
     }
     const profiles = Object.create(null);
     for (const [name, record] of Object.entries(value.profiles)) {
         validName(name);
         if (!object(record) || ['key', 'host', 'projectId'].some(key => record[key] !== undefined && typeof record[key] !== 'string')) {
-            throw new ProfileError('PROFILE_INVALID', ui('Profile records must be objects with string fields.', '档案记录必须是包含字符串字段的对象。'));
+            throw new ProfileError('PROFILE_INVALID', ui('Profile records must be objects with string fields.', zhText("m239")));
         }
         profiles[name] = Object.fromEntries(['key', 'host', 'projectId'].filter(key => record[key] !== undefined).map(key => [key, record[key]]));
     }

package/dist/core/set-values.d.ts

@@ -1,4 +1,3 @@
-/** Pixmax `_parse_value` plus fal's first `=` / `:=` split and `[index]` / `[]` paths. */
 import { LumenKeyError } from './client.js';
 /** Identify a parameter without echoing its value, a whole pair, or a payload. */
 export declare function modelParameterError(code: 'MODEL_PARAM_INVALID' | 'MODEL_PARAM_UNKNOWN', key: string): LumenKeyError;

package/dist/core/set-values.js

@@ -1,19 +1,19 @@
-/** Pixmax `_parse_value` plus fal's first `=` / `:=` split and `[index]` / `[]` paths. */
+import { zhText } from '../core/chinese-messages.js';
 import { LumenKeyError } from './client.js';
 import { ui } from './locale.js';
 /** Identify a parameter without echoing its value, a whole pair, or a payload. */
 export function modelParameterError(code, key) {
     if (!/^[a-zA-Z][a-zA-Z0-9_]{0,63}$/.test(key)) {
         return new LumenKeyError(code, undefined, undefined, code === 'MODEL_PARAM_UNKNOWN'
-            ? ui('This model does not support the supplied parameter.', '该模型不支持所提供的参数。')
-            : ui('The supplied parameter is invalid. Check lumenkey model explain.', '所提供的参数值无效。请运行 lumenkey model explain 查看允许的参数。'));
+            ? ui('This model does not support the supplied parameter.', zhText("m250"))
+            : ui('The supplied parameter is invalid. Check lumenkey model explain.', zhText("m249")));
     }
     const label = key === 'aspect_ratio' || key === 'ratio'
-        ? ui('aspect ratio', '宽高比')
+        ? ui('aspect ratio', zhText("m248"))
         : key;
     const detail = code === 'MODEL_PARAM_UNKNOWN'
-        ? ui(`This model has no ${label} parameter.`, `该模型不支持 ${label} 参数。`)
-        : ui(`Invalid value for ${label}. Check this model's allowed parameters with lumenkey model explain.`, `${label} 参数值无效。请运行 lumenkey model explain 查看该模型允许的参数。`);
+        ? ui(`This model has no ${label} parameter.`, (zhText("m246") + (label) + zhText("m247")))
+        : ui(`Invalid value for ${label}. Check this model's allowed parameters with lumenkey model explain.`, ("" + (label) + zhText("m245")));
     return new LumenKeyError(code, undefined, undefined, detail);
 }
 export function parseValue(value) {
@@ -49,7 +49,7 @@ export function parsePath(key) {
         if (!name)
             throw new LumenKeyError('MODEL_PARAM_SYNTAX_INVALID');
         if (name === '__proto__' || name === 'constructor' || name === 'prototype')
-            throw new LumenKeyError('MODEL_PARAM_SYNTAX_INVALID', undefined, undefined, ui('Unsafe key in key=value option.', 'key=value 参数不能使用不安全的字段名。'));
+            throw new LumenKeyError('MODEL_PARAM_SYNTAX_INVALID', undefined, undefined, ui('Unsafe key in key=value option.', zhText("m244")));
         steps.push({ kind: 'key', name });
     };
     while (i < key.length) {

package/dist/core/submission-journal.js

@@ -1,3 +1,4 @@
+import { zhText } from '../core/chinese-messages.js';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -68,13 +69,27 @@ function pastRetention(entry, now = Date.now()) {
 }
 export function ageText(entry) {
     const hours = Math.floor(ageMs(entry) / 3600000);
-    return hours >= 1 ? ui(`${hours} hours ago`, `${hours} 小时前`) : ui(`${Math.max(1, Math.floor(ageMs(entry) / 60000))} minutes ago`, `${Math.max(1, Math.floor(ageMs(entry) / 60000))} 分钟前`);
+    return hours >= 1 ? ui(`${hours} hours ago`, ("" + (hours) + zhText("m270"))) : ui(`${Math.max(1, Math.floor(ageMs(entry) / 60000))} minutes ago`, ("" + (Math.max(1, Math.floor(ageMs(entry) / 60000))) + zhText("m269")));
 }
 function journalError(code, file, error, detail) {
-    return Object.assign(new LumenKeyError(code, undefined, undefined, detail), { path: file, cause: error });
+    return Object.assign(new LumenKeyError(code, undefined, undefined, detail), { recordId: recordIdentifier(file), cause: error });
+}
+function recordIdentifier(file) {
+    return `record:${crypto.createHash('sha256').update(path.basename(file)).digest('hex').slice(0, 12)}`;
 }
 function reasonOf(error) {
-    return error?.code ?? (error instanceof Error ? error.message : String(error));
+    const code = error?.code;
+    return typeof code === 'string' && /^[A-Z][A-Z0-9_]{0,79}$/.test(code) ? code : 'FILESYSTEM_ERROR';
+}
+function assertJournalReadable(file) {
+    try {
+        assertConfigDirReadable(file);
+    }
+    catch (error) {
+        if (error instanceof LumenKeyError)
+            throw Object.assign(new LumenKeyError(error.code, error.status, error.retryAfterMs, error.publicMessage), { recordId: recordIdentifier(file) });
+        throw journalError('SUBMISSION_JOURNAL_INVALID', file, error, errorSentence('SUBMISSION_JOURNAL_INVALID'));
+    }
 }
 /**
  * Prove the journal can be written before anything billable happens, so a refused submission
@@ -91,7 +106,7 @@ export function assertJournalWritable(home) {
         fs.unlinkSync(probe);
     }
     catch (error) {
-        throw journalError('SUBMISSION_JOURNAL_UNWRITABLE', dir, error, `${errorSentence('SUBMISSION_JOURNAL_UNWRITABLE')} ${ui(`No job was submitted. Directory: ${dir} (${reasonOf(error)}). Set LUMENKEY_JOURNAL_DIR to a writable directory to keep pending records elsewhere.`, `没有提交任务。目录：${dir}（${reasonOf(error)}）。可设置 LUMENKEY_JOURNAL_DIR 把待确认记录放到可写目录。`)}`);
+        throw journalError('SUBMISSION_JOURNAL_UNWRITABLE', dir, error, `${errorSentence('SUBMISSION_JOURNAL_UNWRITABLE')} ${ui(`No job was submitted. The pending-submissions journal directory is unavailable (${reasonOf(error)}). Set LUMENKEY_JOURNAL_DIR to a writable directory to keep pending records elsewhere.`, (zhText("m267") + (reasonOf(error)) + zhText("m268")))}`);
     }
 }
 function write(entry, home) {
@@ -101,7 +116,7 @@ function write(entry, home) {
         writeAtomicConfigFile(file, entry);
     }
     catch (error) {
-        throw journalError('SUBMISSION_JOURNAL_UNWRITABLE', file, error, `${errorSentence('SUBMISSION_JOURNAL_UNWRITABLE')} ${ui(`Directory: ${path.dirname(file)} (${reasonOf(error)}).`, `目录：${path.dirname(file)}（${reasonOf(error)}）。`)}`);
+        throw journalError('SUBMISSION_JOURNAL_UNWRITABLE', file, error, `${errorSentence('SUBMISSION_JOURNAL_UNWRITABLE')} ${ui(`Record ${recordIdentifier(file)} (${reasonOf(error)}).`, (zhText("m266") + (recordIdentifier(file)) + "（" + (reasonOf(error)) + "）。"))}`);
     }
 }
 /** Write before the POST. Any failure here must stop the submission: a job without a record cannot be recovered. */
@@ -111,7 +126,7 @@ export function rememberPendingSubmission(entry, home) {
     }
     catch (error) {
         if (error instanceof LumenKeyError)
-            error.publicMessage = `${error.publicMessage} ${ui('No job was submitted.', '没有提交任务。')}`;
+            error.publicMessage = `${error.publicMessage} ${ui('No job was submitted.', zhText("m265"))}`;
         throw error;
     }
     sweep(home);
@@ -119,9 +134,9 @@ export function rememberPendingSubmission(entry, home) {
 /** Read a record by key without any expiry side effect. */
 function readRaw(idempotencyKey, home) {
     const file = entryPath(idempotencyKey, home);
-    assertConfigDirReadable(file);
     let entry;
     try {
+        assertConfigDirReadable(file);
         assertSafeConfigFile(file);
         if (!fs.existsSync(file))
             return undefined;
@@ -129,7 +144,7 @@ function readRaw(idempotencyKey, home) {
     }
     catch (error) {
         if (error instanceof LumenKeyError)
-            throw Object.assign(error, { path: file });
+            throw Object.assign(new LumenKeyError(error.code, error.status, error.retryAfterMs, error.publicMessage), { recordId: recordIdentifier(file) });
         throw journalError('SUBMISSION_JOURNAL_INVALID', file, error, errorSentence('SUBMISSION_JOURNAL_INVALID'));
     }
     if (entry.idempotencyKey !== idempotencyKey)
@@ -165,7 +180,7 @@ export function forgetPendingSubmission(idempotencyKey, quoteId, home) {
     catch (error) {
         if (error.code === 'ENOENT')
             return false;
-        throw journalError('SUBMISSION_JOURNAL_UNWRITABLE', file, error, ui(`The pending record ${file} could not be removed (${reasonOf(error)}); it will be swept after 48 hours.`, `待确认记录 ${file} 无法删除（${reasonOf(error)}），将在 48 小时后清理。`));
+        throw journalError('SUBMISSION_JOURNAL_UNWRITABLE', file, error, ui(`The pending record ${recordIdentifier(file)} could not be removed (${reasonOf(error)}); it will be swept after 48 hours.`, (zhText("m262") + (recordIdentifier(file)) + zhText("m263") + (reasonOf(error)) + zhText("m264"))));
     }
 }
 /**
@@ -240,7 +255,7 @@ export function isInputPolicyConflict(entry, input, callerInput, defaults, legac
 }
 /** Before lookup: retain the replay guard for 23h, then report expiry; sweep after 48h. */
 export function findInputPolicyConflict(identity, modelId, input, callerInput, defaults, home, legacyCallerInput) {
-    assertConfigDirReadable(path.join(journalDir(home), 'probe'));
+    assertJournalReadable(path.join(journalDir(home), 'probe'));
     sweep(home);
     return readAll(home).entries
         .filter(entry => sameSender(entry, identity) && entry.modelId === modelId && !isExpired(entry) && isInputPolicyConflict(entry, input, callerInput, defaults, legacyCallerInput))
@@ -265,21 +280,21 @@ export function processAlive(pid) {
  * are invisible here.
  */
 export function findResumablePendingSubmission(identity, modelId, canonicalInput, home) {
-    assertConfigDirReadable(path.join(journalDir(home), 'probe'));
+    assertJournalReadable(path.join(journalDir(home), 'probe'));
     const { entries, damaged } = readAll(home);
-    const notices = damaged.map(file => ui(`${errorSentence('SUBMISSION_JOURNAL_INVALID')} (SUBMISSION_JOURNAL_INVALID) ${file}`, `${errorSentence('SUBMISSION_JOURNAL_INVALID')}（SUBMISSION_JOURNAL_INVALID）${file}`));
+    const notices = damaged.map(file => ui(`${errorSentence('SUBMISSION_JOURNAL_INVALID')} (SUBMISSION_JOURNAL_INVALID) ${recordIdentifier(file)}`, `${errorSentence('SUBMISSION_JOURNAL_INVALID')}（SUBMISSION_JOURNAL_INVALID）${recordIdentifier(file)}`));
     const candidates = [];
     for (const entry of entries) {
         if (!sameSender(entry, identity) || entry.modelId !== modelId || pastRetention(entry))
             continue;
         if (isExpired(entry)) {
-            notices.push(ui(`An unconfirmed submission recorded ${ageText(entry)} (idempotency key ${entry.idempotencyKey}, quote ${entry.quoteId}) has expired past its replay window; check job history before continuing. It was not re-sent.`, `有一条未确认的旧请求已过可续传时限，请先查任务历史（幂等键 ${entry.idempotencyKey}，报价 ${entry.quoteId}，记录于${ageText(entry)}）。没有重发旧请求。`));
+            notices.push(ui(`An unconfirmed submission recorded ${ageText(entry)} (idempotency key ${entry.idempotencyKey}, quote ${entry.quoteId}) has expired past its replay window; check job history before continuing. It was not re-sent.`, (zhText("m260") + (entry.idempotencyKey) + zhText("m34") + (entry.quoteId) + zhText("m29") + (ageText(entry)) + zhText("m261"))));
             continue;
         }
         const sameInput = canonical(entry.input) === canonicalInput;
         if (!sameInput) {
             if (entry.state === 'unknown' || (entry.hostname === os.hostname() && !processAlive(entry.pid)))
-                notices.push(ui(`A submission for this model with a different input was recorded ${ageText(entry)} (idempotency key ${entry.idempotencyKey}, quote ${entry.quoteId}) and is still unconfirmed; it was not resumed because the input differs. If it is the one you meant (for example after a catalog change), run lumenkey tasks resume ${entry.idempotencyKey} (MCP: lumenkey_resume_submission).`, `有一次同模型但输入不同的提交记录于${ageText(entry)}（幂等键 ${entry.idempotencyKey}，报价 ${entry.quoteId}），结果仍未确认；因输入不同没有接续。若那正是你要的（例如目录变更后），请运行 lumenkey tasks resume ${entry.idempotencyKey}（MCP：lumenkey_resume_submission）。`));
+                notices.push(ui(`A submission for this model with a different input was recorded ${ageText(entry)} (idempotency key ${entry.idempotencyKey}, quote ${entry.quoteId}) and is still unconfirmed; it was not resumed because the input differs. If it is the one you meant (for example after a catalog change), run lumenkey tasks resume ${entry.idempotencyKey} (MCP: lumenkey_resume_submission).`, (zhText("m257") + (ageText(entry)) + zhText("m258") + (entry.idempotencyKey) + zhText("m34") + (entry.quoteId) + zhText("m259") + (entry.idempotencyKey) + "（MCP：lumenkey_resume_submission）。")));
             continue;
         }
         if (entry.state === 'unknown') {
@@ -287,11 +302,11 @@ export function findResumablePendingSubmission(identity, modelId, canonicalInput
             continue;
         }
         if (entry.hostname !== os.hostname()) {
-            notices.push(ui(`An identical submission is still in flight from host ${entry.hostname} (idempotency key ${entry.idempotencyKey}); it was not resumed from here.`, `主机 ${entry.hostname} 上有一次相同的提交仍在进行（幂等键 ${entry.idempotencyKey}），没有从这里接续。`));
+            notices.push(ui(`An identical submission is still in flight from host ${entry.hostname} (idempotency key ${entry.idempotencyKey}); it was not resumed from here.`, (zhText("m254") + (entry.hostname) + zhText("m255") + (entry.idempotencyKey) + zhText("m256"))));
             continue;
         }
         if (processAlive(entry.pid)) {
-            notices.push(ui(`An identical submission is still in flight in process ${entry.pid} on this host (idempotency key ${entry.idempotencyKey}); it was not resumed. If that process is gone, run lumenkey tasks resume ${entry.idempotencyKey} (MCP: lumenkey_resume_submission).`, `本机进程 ${entry.pid} 中有一次相同的提交仍在进行（幂等键 ${entry.idempotencyKey}），没有接续。若该进程已不存在，请运行 lumenkey tasks resume ${entry.idempotencyKey}（MCP：lumenkey_resume_submission）。`));
+            notices.push(ui(`An identical submission is still in flight in process ${entry.pid} on this host (idempotency key ${entry.idempotencyKey}); it was not resumed. If that process is gone, run lumenkey tasks resume ${entry.idempotencyKey} (MCP: lumenkey_resume_submission).`, (zhText("m251") + (entry.pid) + zhText("m252") + (entry.idempotencyKey) + zhText("m253") + (entry.idempotencyKey) + "（MCP：lumenkey_resume_submission）。")));
             continue;
         }
         candidates.push(entry);

package/dist/core/version.js

@@ -1,3 +1,2 @@
-import fs from 'node:fs';
-export const packageVersion = JSON.parse(fs.readFileSync(new URL('../../package.json', import.meta.url), 'utf8')).version;
-//# sourceMappingURL=version.js.map
+// Generated from package.json by stamp-build-version.mjs.
+export const packageVersion = "0.4.0-rc.1";

package/dist/mcp/server.js

@@ -1,3 +1,4 @@
+import { zhText } from '../core/chinese-messages.js';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { z } from 'zod';
@@ -16,18 +17,18 @@ function log(line) {
 }
 /** MCP view of generation progress; the same core events the CLI renders, on stderr. */
 function mcpGenerationEvents() {
-    const nounOf = (kind) => kind === 'video' ? ui('video', '视频') : ui('image', '图片');
+    const nounOf = (kind) => kind === 'video' ? ui('video', zhText("m442")) : ui('image', zhText("m441"));
     return event => {
         switch (event.type) {
-            case 'quoting': return log(ui(`Quoting ${nounOf(event.kind)} generation for ${event.modelId}...`, `正在获取 ${event.modelId} 的${nounOf(event.kind)}生成报价...`));
+            case 'quoting': return log(ui(`Quoting ${nounOf(event.kind)} generation for ${event.modelId}...`, (zhText("m438") + (event.modelId) + zhText("m439") + (nounOf(event.kind)) + zhText("m440"))));
             case 'submitting': return log(event.resubmit
-                ? ui(`Re-sending an earlier unconfirmed submission (idempotency key ${event.idempotencyKey}, quote ${event.quoteId}, ${event.credits} credits) instead of creating a new job...`, `正在重发一次之前结果未确认的提交（幂等键 ${event.idempotencyKey}，报价编号 ${event.quoteId}，${event.credits} 算力点），不会新建任务...`)
-                : ui(`Submitting job with quote ${event.quoteId} (${event.credits} credits)...`, `正在提交任务，报价编号：${event.quoteId}（${event.credits} 算力点）...`));
-            case 'job_created': return log(ui(`Job created: ${event.jobId} (idempotency key ${event.idempotencyKey}, quote ${event.quoteId})`, `任务已创建：${event.jobId}（幂等键 ${event.idempotencyKey}，报价编号 ${event.quoteId}）`));
-            case 'polling': return log(ui(`Polling job ${event.jobId}...`, `正在查询任务 ${event.jobId} 的进度...`));
-            case 'progress': return log(ui(`Job ${event.detail.jobId} status: ${event.detail.status}`, `任务 ${event.detail.jobId} 状态：${jobStatusText(event.detail.status)}`));
-            case 'downloading': return log(ui(`Downloading ${nounOf(event.kind)}...`, `正在下载${nounOf(event.kind)}...`));
-            case 'notice': return log(ui(`Note: ${event.text}`, `注意：${event.text}`));
+                ? ui(`Re-sending an earlier unconfirmed submission (idempotency key ${event.idempotencyKey}, quote ${event.quoteId}, ${event.credits} credits) instead of creating a new job...`, (zhText("m354") + (event.idempotencyKey) + zhText("m434") + (event.quoteId) + "，" + (event.credits) + zhText("m437")))
+                : ui(`Submitting job with quote ${event.quoteId} (${event.credits} credits)...`, (zhText("m435") + (event.quoteId) + "（" + (event.credits) + zhText("m436"))));
+            case 'job_created': return log(ui(`Job created: ${event.jobId} (idempotency key ${event.idempotencyKey}, quote ${event.quoteId})`, (zhText("m351") + (event.jobId) + zhText("m258") + (event.idempotencyKey) + zhText("m434") + (event.quoteId) + "）")));
+            case 'polling': return log(ui(`Polling job ${event.jobId}...`, (zhText("m432") + (event.jobId) + zhText("m433"))));
+            case 'progress': return log(ui(`Job ${event.detail.jobId} status: ${event.detail.status}`, (zhText("m430") + (event.detail.jobId) + zhText("m431") + (jobStatusText(event.detail.status)) + "")));
+            case 'downloading': return log(ui(`Downloading ${nounOf(event.kind)}...`, (zhText("m429") + (nounOf(event.kind)) + "...")));
+            case 'notice': return log(ui(`Note: ${event.text}`, (zhText("m350") + (event.text) + "")));
             default: return;
         }
     };
@@ -54,7 +55,7 @@ function inputError(toolName, issues, args) {
         if (field === 'duration')
             return new LumenKeyError('VIDEO_DURATION_INVALID');
         if (issue.code === 'unrecognized_keys') {
-            return new LumenKeyError('INPUT_INVALID', undefined, undefined, ui(`Unknown argument: ${issue.keys.join(', ')}.`, `未知参数：${issue.keys.join('、')}。`));
+            return new LumenKeyError('INPUT_INVALID', undefined, undefined, ui(`Unknown argument: ${issue.keys.join(', ')}.`, (zhText("m428") + (issue.keys.join('、')) + "。")));
         }
     }
     return new LumenKeyError('INPUT_INVALID', undefined, undefined, issues.map(issue => `${issue.path.join('.') || 'arguments'}: ${issue.message}`).join(' '));
@@ -91,42 +92,42 @@ export function createMcpServer() {
             }
         });
     }
-    tool('lumenkey_list_models', ui('List all available AI models (video, image, text, audio) from LumenKey catalog with schemas and pricing', '读取光钥模型目录，包含视频、图片、文本、音频的参数结构与价格。'), {
-        type: z.enum(['video', 'image', 'text', 'audio']).optional().describe(ui('Filter models by type', '按模型类型筛选')),
+    tool('lumenkey_list_models', ui('List all available AI models (video, image, text, audio) from LumenKey catalog with schemas and pricing', zhText("m427")), {
+        type: z.enum(['video', 'image', 'text', 'audio']).optional().describe(ui('Filter models by type', zhText("m426"))),
     }, async ({ type }) => {
         const models = await api().listModels(type);
         return dataResult({ count: models.length, models });
     });
-    tool('lumenkey_generate_video', ui('Quote a LumenKey video. Omitted scalar catalog defaults are explicitly sent in input. Nothing is submitted until confirm is true. Conflicting parameter aliases are rejected locally.', '获取光钥视频报价；未提供的目录标量默认值会显式写入 input；只有 confirm 为 true 时才提交计费生成。参数别名冲突在本地拒绝。'), zodShape(videoParams), async (args) => toolResult(await runGeneration(api(), { ...generationArgs('video', args, 'mcp'), onEvent: mcpGenerationEvents() })));
-    tool('lumenkey_generate_image', ui('Quote a LumenKey image. Omitted scalar catalog defaults are explicitly sent in input. Nothing is submitted until confirm is true. Conflicting parameter aliases are rejected locally.', '获取光钥图片报价；未提供的目录标量默认值会显式写入 input；只有 confirm 为 true 时才提交计费生成。参数别名冲突在本地拒绝。'), zodShape(imageParams), async (args) => toolResult(await runGeneration(api(), { ...generationArgs('image', args, 'mcp'), onEvent: mcpGenerationEvents() })));
-    tool('lumenkey_query_job', ui('Query the status of an asynchronous generation task by its jobId', '按任务 ID 查询已有异步生成任务的状态。'), { jobId: z.string().describe(ui('The task ID to query', '要查询的任务 ID')) }, async ({ jobId }) => toolResult(await readJob(api(), jobId)));
-    tool('lumenkey_check_balance', ui('Query current LumenKey account credits balance (available credits, reserved credits, and updatedAt timestamp)', '查询光钥账户的可用算力点、冻结算力点和更新时间。'), {}, async () => dataResult(await api().getBalance()));
-    tool('lumenkey_chat', ui('Run billable LLM inference. Every successful call may incur credits; reuse idempotencyKey only for an identical request.', '发起计费文本推理；成功调用可能消耗算力点，仅为同一次相同请求复用幂等键。'), zodShape(chatParams), async (args) => {
+    tool('lumenkey_generate_video', ui('Quote a LumenKey video. Omitted scalar catalog defaults are explicitly sent in input. Nothing is submitted until confirm is true. Conflicting parameter aliases are rejected locally.', zhText("m425")), zodShape(videoParams), async (args) => toolResult(await runGeneration(api(), { ...generationArgs('video', args, 'mcp'), onEvent: mcpGenerationEvents() })));
+    tool('lumenkey_generate_image', ui('Quote a LumenKey image. Omitted scalar catalog defaults are explicitly sent in input. Nothing is submitted until confirm is true. Conflicting parameter aliases are rejected locally.', zhText("m424")), zodShape(imageParams), async (args) => toolResult(await runGeneration(api(), { ...generationArgs('image', args, 'mcp'), onEvent: mcpGenerationEvents() })));
+    tool('lumenkey_query_job', ui('Query the status of an asynchronous generation task by its jobId', zhText("m423")), { jobId: z.string().describe(ui('The task ID to query', zhText("m417"))) }, async ({ jobId }) => toolResult(await readJob(api(), jobId)));
+    tool('lumenkey_check_balance', ui('Query current LumenKey account credits balance (available credits, reserved credits, and updatedAt timestamp)', zhText("m422")), {}, async () => dataResult(await api().getBalance()));
+    tool('lumenkey_chat', ui('Run billable LLM inference. Every successful call may incur credits; reuse idempotencyKey only for an identical request.', zhText("m421")), zodShape(chatParams), async (args) => {
         const outcome = await runChat(api(), chatArgs(args, 'mcp'));
         return toolResult(outcome, outcome.ok ? outcome.text : undefined);
     });
-    tool('lumenkey_explain_model', ui('Explain one model: its parameters, which are required, and which values are allowed.', '说明指定模型的参数、必填字段与允许的值。'), {
-        modelId: z.string().describe(ui('The model ID to explain', '要解释的模型 ID')),
+    tool('lumenkey_explain_model', ui('Explain one model: its parameters, which are required, and which values are allowed.', zhText("m420")), {
+        modelId: z.string().describe(ui('The model ID to explain', zhText("m419"))),
     }, async ({ modelId }) => {
         const model = (await api().listModels()).find((item) => item.id === modelId);
         if (!model)
             throw new LumenKeyError('MODEL_NOT_IN_CATALOG', undefined, undefined, missingModelSentence(modelId));
         return dataResult(explainModel(model));
     });
-    tool('lumenkey_tasks_progress', ui('Read one existing generation job', '读取一条已有生成任务的进度。'), {
-        jobId: z.string().describe(ui('The task ID to query', '要查询的任务 ID')),
+    tool('lumenkey_tasks_progress', ui('Read one existing generation job', zhText("m418")), {
+        jobId: z.string().describe(ui('The task ID to query', zhText("m417"))),
     }, async ({ jobId }) => toolResult(await readJob(api(), jobId)));
-    tool('lumenkey_tasks_wait', ui('Wait for an existing job without creating one', '等待已有生成任务，不创建新任务。'), {
-        jobId: z.string().describe(ui('The existing task ID to wait for', '要等待的已有任务 ID')),
+    tool('lumenkey_tasks_wait', ui('Wait for an existing job without creating one', zhText("m416")), {
+        jobId: z.string().describe(ui('The existing task ID to wait for', zhText("m415"))),
         ...zodShape(waitParams),
     }, async ({ jobId, ...rest }) => toolResult(await waitJob(api(), jobId, waitArgs(rest, 'mcp'))));
-    tool('lumenkey_resume_submission', ui('Re-send a recorded submission verbatim by its idempotency key (recovery after an unknown outcome). The gateway replays the earlier job or creates it once; nothing is quoted anew and no generation argument is accepted.', '按幂等键原样重发一次已记录的提交（结果未知后的恢复）。网关会回放之前的任务或只创建一次；不会重新报价，也不接受任何生成参数。'), zodShape(resumeParams), async (args) => toolResult(await resumeSubmission(api(), { ...resumeArgs(args, 'mcp'), onEvent: mcpGenerationEvents() })));
-    tool('lumenkey_tasks_cancel', ui('Request cancellation with yes: true. Cancellation is not a refund; held credits are released or charged only when gateway settlement completes.', '取消已有任务必须传 yes: true。取消不等于退款；冻结算力点是否释放或扣除由网关最终结算决定。'), {
-        jobId: z.string().describe(ui('The existing task ID to cancel', '要取消的任务 ID')),
-        yes: z.boolean({ invalid_type_error: ui('Cancellation requires yes: true.', '取消任务必须传入 yes: true。') }).optional().describe(ui('Must be true to authorize cancellation; cancellation is not a refund', '必须为 true 才授权取消；取消不等于退款')),
+    tool('lumenkey_resume_submission', ui('Re-send a recorded submission verbatim by its idempotency key (recovery after an unknown outcome). The gateway replays the earlier job or creates it once; nothing is quoted anew and no generation argument is accepted.', zhText("m414")), zodShape(resumeParams), async (args) => toolResult(await resumeSubmission(api(), { ...resumeArgs(args, 'mcp'), onEvent: mcpGenerationEvents() })));
+    tool('lumenkey_tasks_cancel', ui('Request cancellation with yes: true. Cancellation is not a refund; held credits are released or charged only when gateway settlement completes.', zhText("m413")), {
+        jobId: z.string().describe(ui('The existing task ID to cancel', zhText("m412"))),
+        yes: z.boolean({ invalid_type_error: ui('Cancellation requires yes: true.', zhText("m410")) }).optional().describe(ui('Must be true to authorize cancellation; cancellation is not a refund', zhText("m411"))),
     }, async ({ jobId, yes }) => {
         if (yes !== true)
-            throw new LumenKeyError('CANCEL_CONFIRMATION_REQUIRED', undefined, undefined, ui('Cancellation requires yes: true.', '取消任务必须传入 yes: true。'));
+            throw new LumenKeyError('CANCEL_CONFIRMATION_REQUIRED', undefined, undefined, ui('Cancellation requires yes: true.', zhText("m410")));
         return dataResult(await api().cancelJob(jobId));
     });
     return server;
@@ -135,6 +136,6 @@ export async function runMcpStdio() {
     const server = createMcpServer();
     const transport = new StdioServerTransport();
     await server.connect(transport);
-    log(ui('Server running on stdio transport', '服务已启动，使用 stdio 传输'));
+    log(ui('Server running on stdio transport', zhText("m409")));
 }
 //# sourceMappingURL=server.js.map

package/dist/studio/asset-integrity-hash.d.ts

@@ -0,0 +1,28 @@
+import type { StudioRoot, StudioAsset } from './types.js';
+export type IntegrityFileFact = 'NOT_CHECKED' | 'ABSENT' | 'PARTIAL' | 'VERIFIED' | 'MISSING' | 'MODIFIED' | 'UNSAFE' | 'UNKNOWN';
+export interface AssetIntegrity {
+    file: IntegrityFileFact;
+    checkedAt: string | null;
+    integrityCheck: 'IDLE' | 'PENDING';
+}
+export interface IntegrityResult {
+    file: 'VERIFIED' | 'MISSING' | 'MODIFIED' | 'UNSAFE' | 'UNKNOWN';
+    checkedAt: string | null;
+    signature?: string;
+    errorCode?: 'SAVE_FILE_MISSING' | 'SAVE_FILE_MODIFIED' | 'SAVE_FILE_UNSAFE' | 'SAVE_FILE_READ_FAILED';
+}
+/** Not a serialized flag: only a completed real hash can mint this process-local proof. */
+export declare function isVerifiedHashResult(assetId: string, value: unknown): value is IntegrityResult;
+/** Bounded stat path: no hash, no user file mutation. The identity comes from an opened handle. */
+export declare function inspectStudioAsset(root: StudioRoot, asset: StudioAsset): Promise<IntegrityResult>;
+/** The only producer of VERIFIED. Full chunked bytes and identity are checked on
+ * the SAME open regular-file handle before and after reading. No network/repair. */
+export declare function hashStudioAsset(root: StudioRoot, asset: StudioAsset, options: {
+    maxBytes: number;
+    expectedSignature?: string;
+    signal?: AbortSignal;
+    now?: () => number;
+    beforeRead?(): void | Promise<void>;
+    afterChunk?(): void | Promise<void>;
+}): Promise<IntegrityResult>;
+//# sourceMappingURL=asset-integrity-hash.d.ts.map

package/dist/studio/asset-integrity-hash.js

@@ -0,0 +1,93 @@
+import { createHash } from 'node:crypto';
+import { lstat, open } from 'node:fs/promises';
+import { assertStudioRoot, resolveStudioAssetPath } from './paths.js';
+import { hasFsCode, StudioError } from './errors.js';
+const proofs = new WeakMap();
+/** Not a serialized flag: only a completed real hash can mint this process-local proof. */
+export function isVerifiedHashResult(assetId, value) {
+    return typeof value === 'object' && value !== null && proofs.get(value) === `${assetId}:${JSON.stringify(value)}`;
+}
+function signature(s) {
+    return JSON.stringify([String(s.dev), String(s.ino), s.size, s.mtimeMs, s.ctimeMs, s.birthtimeMs, s.nlink]);
+}
+function regular(s) { return s.isFile() && !s.isSymbolicLink() && s.nlink === 1 && s.ino !== 0; }
+function failed(file) {
+    return { file, checkedAt: null, errorCode: { MISSING: 'SAVE_FILE_MISSING', MODIFIED: 'SAVE_FILE_MODIFIED', UNSAFE: 'SAVE_FILE_UNSAFE', UNKNOWN: 'SAVE_FILE_READ_FAILED' }[file] };
+}
+function failure(error) {
+    return failed(hasFsCode(error, 'ENOENT') ? 'MISSING' : error instanceof StudioError && error.code === 'STUDIO_PATH_UNSAFE' ? 'UNSAFE' : 'UNKNOWN');
+}
+/** Bounded stat path: no hash, no user file mutation. The identity comes from an opened handle. */
+export async function inspectStudioAsset(root, asset) {
+    try {
+        const file = await resolveStudioAssetPath(root, asset);
+        const handle = await open(file, 'r');
+        try {
+            const current = await handle.stat();
+            const named = await lstat(file);
+            await assertStudioRoot(root);
+            if (!regular(current) || !regular(named) || signature(current) !== signature(named))
+                return failed('UNSAFE');
+            if (current.size !== asset.byteLength)
+                return failed('MODIFIED');
+            return { file: 'UNKNOWN', checkedAt: null, signature: signature(current) };
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch (error) {
+        return failure(error);
+    }
+}
+/** The only producer of VERIFIED. Full chunked bytes and identity are checked on
+ * the SAME open regular-file handle before and after reading. No network/repair. */
+export async function hashStudioAsset(root, asset, options) {
+    if (!Number.isSafeInteger(options.maxBytes) || options.maxBytes < 1)
+        throw new StudioError('STUDIO_INPUT_INVALID');
+    try {
+        const file = await resolveStudioAssetPath(root, asset);
+        const handle = await open(file, 'r');
+        try {
+            const before = await handle.stat();
+            const named = await lstat(file);
+            if (!regular(before) || !regular(named) || signature(before) !== signature(named))
+                return failed('UNSAFE');
+            const beforeSignature = signature(before);
+            if (before.size !== asset.byteLength || before.size > options.maxBytes || (options.expectedSignature !== undefined && options.expectedSignature !== beforeSignature))
+                return failed('MODIFIED');
+            const hash = createHash('sha256');
+            const buffer = Buffer.alloc(64 * 1024);
+            let position = 0;
+            for (;;) {
+                options.signal?.throwIfAborted();
+                await options.beforeRead?.();
+                const { bytesRead } = await handle.read(buffer, 0, Math.min(buffer.length, asset.byteLength + 1 - position), position);
+                if (!bytesRead)
+                    break;
+                position += bytesRead;
+                if (position > options.maxBytes || position > asset.byteLength)
+                    return failed('MODIFIED');
+                hash.update(buffer.subarray(0, bytesRead));
+                await options.afterChunk?.();
+            }
+            const after = await handle.stat();
+            const afterNamed = await lstat(file);
+            await assertStudioRoot(root);
+            if (!regular(after) || !regular(afterNamed))
+                return failed('UNSAFE');
+            if (signature(after) !== beforeSignature || signature(afterNamed) !== beforeSignature || position !== asset.byteLength || hash.digest('hex') !== asset.sha256)
+                return failed('MODIFIED');
+            const result = Object.freeze({ file: 'VERIFIED', checkedAt: new Date((options.now ?? Date.now)()).toISOString(), signature: beforeSignature });
+            proofs.set(result, `${asset.assetId}:${JSON.stringify(result)}`);
+            return result;
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch (error) {
+        return failure(error);
+    }
+}
+//# sourceMappingURL=asset-integrity-hash.js.map

package/dist/studio/asset-integrity-queue.d.ts

@@ -0,0 +1,24 @@
+import { type AssetIntegrity } from './asset-integrity-hash.js';
+import type { StudioSaveAuthority } from './output-save-journal.js';
+import type { StudioAsset, StudioRoot } from './types.js';
+export interface AssetIntegrityQueue {
+    cached(assetIds: readonly string[]): Promise<Map<string, AssetIntegrity>>;
+    observe(asset: StudioAsset): Promise<AssetIntegrity>;
+    idle(): Promise<void>;
+    close(): Promise<void>;
+}
+/** Root-owned local observer. No network, repair, HTTP hooks or file mutation.
+ * Hashing runs outside the authority's short commit queue. A failed completion
+ * publication makes later reads fail closed, rather than advertising stale success. */
+export declare function createAssetIntegrityQueue(root: StudioRoot, authority: StudioSaveAuthority, options: {
+    maxBytes: number;
+    now?: () => number;
+    beforeHash?(asset: StudioAsset): void | Promise<void>;
+    afterHash?(asset: StudioAsset): void | Promise<void>;
+    onInspect?(): void;
+    hashOptions?: {
+        beforeRead?(): void | Promise<void>;
+        afterChunk?(): void | Promise<void>;
+    };
+}): AssetIntegrityQueue;
+//# sourceMappingURL=asset-integrity-queue.d.ts.map