@pixel-point/toolcraft 0.0.15 → 0.0.17

package/templates/runtime/model-import/worker/model-import-worker-protocol.ts

@@ -0,0 +1,192 @@
+import type {
+  ToolcraftModelFormat,
+  ToolcraftModelImportLimits,
+  ToolcraftModelTopologyProfile,
+} from "../../schema/types";
+import type { ToolcraftSourceAssetFeedback } from "../../source-assets/source-asset-types";
+import type {
+  ToolcraftModelAppearanceResource,
+  ToolcraftModelDiagnostic,
+  ToolcraftModelSourceBundleTransfer,
+  ToolcraftModelWorkerAnalysisSummary,
+} from "../model-import-types";
+import type { ToolcraftExtractedModelPackageEntry } from "../model-package-types";
+import { TOOLCRAFT_MODEL_REPAIR_ALGORITHM_VERSION } from "../topology/model-repair-plan";
+import { TOOLCRAFT_MODEL_TOPOLOGY_ANALYZER_VERSION } from "../topology/model-topology-analysis";
+
+export const TOOLCRAFT_MODEL_CANONICAL_SCHEMA_VERSION = 2;
+export const TOOLCRAFT_MODEL_WORKER_DIAGNOSTIC_CODE_MAX_LENGTH = 80;
+export const TOOLCRAFT_MODEL_WORKER_DIAGNOSTIC_EXPLANATION_MAX_LENGTH = 512;
+export const TOOLCRAFT_MODEL_WORKER_DIAGNOSTIC_ID_MAX_LENGTH = 1_024;
+export const TOOLCRAFT_MODEL_WORKER_FEEDBACK_MAX_LENGTH = 240;
+export const TOOLCRAFT_MODEL_WORKER_MAX_DIAGNOSTICS = 512;
+
+export type ToolcraftModelImportWorkerPayload = Readonly<{
+  adapterVersion: string;
+  bundle: ToolcraftModelSourceBundleTransfer;
+  format: ToolcraftModelFormat;
+  geometryDecoderVersion: string;
+  limits: ToolcraftModelImportLimits;
+  topologyProfile: ToolcraftModelTopologyProfile;
+}>;
+
+export type ToolcraftModelRepairWorkerPayload = Readonly<{
+  canonicalDocument: ArrayBuffer;
+  canonicalDocumentDigest: string;
+  limits: ToolcraftModelImportLimits;
+  repairPlanEnvelope: ToolcraftModelRepairPlanEnvelope;
+}>;
+
+export type ToolcraftModelPackageExtractWorkerPayload = Readonly<{
+  archive: ArrayBuffer;
+  archiveDigest: string;
+  limits: ToolcraftModelImportLimits;
+}>;
+
+export type ToolcraftModelRepairPlanEnvelope = Readonly<{
+  bytes: ArrayBuffer;
+  envelopeDigest: string;
+  planDigest: string;
+  version: 1;
+}>;
+
+type WorkerMessageIdentity = Readonly<{
+  generation: number;
+  jobId: string;
+}>;
+
+export type ToolcraftModelWorkerRequest = WorkerMessageIdentity & (
+  | Readonly<{ kind: "cancel" }>
+  | Readonly<{
+      kind: "decode-and-analyze";
+      payload: ToolcraftModelImportWorkerPayload;
+    }>
+  | Readonly<{
+      kind: "extract-model-package";
+      payload: ToolcraftModelPackageExtractWorkerPayload;
+    }>
+  | Readonly<{ kind: "repair"; payload: ToolcraftModelRepairWorkerPayload }>
+);
+
+export type ToolcraftModelDecodeAnalyzeWorkerResult = Readonly<{
+  analysis: ToolcraftModelWorkerAnalysisSummary;
+  appearanceResources: readonly ToolcraftModelAppearanceResource[];
+  canonicalDocument: ArrayBuffer;
+  canonicalDocumentDigest: string;
+  operation: "decode-and-analyze";
+  repairPlanEnvelope?: ToolcraftModelRepairPlanEnvelope;
+  receiptDigest: string;
+}>;
+
+export type ToolcraftModelRepairWorkerResult = Readonly<{
+  analysis: ToolcraftModelWorkerAnalysisSummary;
+  canonicalDocument: ArrayBuffer;
+  canonicalDocumentDigest: string;
+  operation: "repair";
+  repairPlanDigest: string;
+  receiptDigest: string;
+}>;
+
+export type ToolcraftModelPackageExtractWorkerResult = Readonly<{
+  archiveDigest: string;
+  entries: readonly ToolcraftExtractedModelPackageEntry[];
+  operation: "extract-model-package";
+  receiptDigest: string;
+}>;
+
+export type ToolcraftModelWorkerResult =
+  | ToolcraftModelDecodeAnalyzeWorkerResult
+  | ToolcraftModelRepairWorkerResult;
+
+export type ToolcraftModelWorkerOperation =
+  | ToolcraftModelWorkerResult["operation"]
+  | ToolcraftModelPackageExtractWorkerResult["operation"];
+
+export type ToolcraftModelWorkerDraft = Readonly<{
+  appearanceResources: readonly ToolcraftModelAppearanceResource[];
+  canonicalDocument: ArrayBuffer;
+  canonicalDocumentDigest: string;
+  receiptDigest: string;
+}>;
+
+export type ToolcraftModelWorkerResponse = WorkerMessageIdentity & (
+  | Readonly<{ kind: "cancelled" }>
+  | Readonly<{
+      draft: ToolcraftModelWorkerDraft;
+      kind: "draft";
+    }>
+  | Readonly<{
+      diagnostic: ToolcraftModelDiagnostic;
+      kind: "diagnostic";
+    }>
+  | Readonly<{
+      kind: "error";
+      feedback: ToolcraftSourceAssetFeedback;
+    }>
+  | Readonly<{
+      kind: "progress";
+      phase: "analyzing" | "decoding" | "extracting" | "repairing";
+      progress: number;
+  }>
+  | Readonly<{
+      kind: "package-result";
+      result: ToolcraftModelPackageExtractWorkerResult;
+    }>
+  | Readonly<{ kind: "result"; result: ToolcraftModelWorkerResult }>
+);
+
+export type ToolcraftModelWorkerTerminalResponse = Extract<
+  ToolcraftModelWorkerResponse,
+  { kind: "cancelled" | "error" | "package-result" | "result" }
+>;
+
+export type ToolcraftModelWorkerGeometryTerminalResponse = Extract<
+  ToolcraftModelWorkerResponse,
+  { kind: "cancelled" | "error" | "result" }
+>;
+
+export type ToolcraftModelWorkerPackageTerminalResponse = Extract<
+  ToolcraftModelWorkerResponse,
+  { kind: "cancelled" | "error" | "package-result" }
+>;
+
+function stageKey(stage: string, fields: readonly (number | string)[]): string {
+  return JSON.stringify([`toolcraft-model-worker-${stage}@1`, ...fields]);
+}
+
+export function createToolcraftModelDecodeCacheKey(input: Readonly<{
+  adapterVersion: string;
+  format: ToolcraftModelFormat;
+  geometryDecoderVersion: string;
+  verifiedSourceTransferDigest: string;
+}>): string {
+  return stageKey("decode", [
+    input.verifiedSourceTransferDigest,
+    input.format,
+    input.adapterVersion,
+    TOOLCRAFT_MODEL_CANONICAL_SCHEMA_VERSION,
+    input.geometryDecoderVersion,
+  ]);
+}
+
+export function createToolcraftModelAnalysisCacheKey(input: Readonly<{
+  canonicalDocumentDigest: string;
+  topologyProfile: ToolcraftModelTopologyProfile;
+}>): string {
+  return stageKey("analysis", [
+    input.canonicalDocumentDigest,
+    input.topologyProfile,
+    TOOLCRAFT_MODEL_TOPOLOGY_ANALYZER_VERSION,
+  ]);
+}
+
+export function createToolcraftModelRepairCacheKey(input: Readonly<{
+  canonicalDocumentDigest: string;
+  repairPlanDigest: string;
+}>): string {
+  return stageKey("repair", [
+    input.canonicalDocumentDigest,
+    input.repairPlanDigest,
+    TOOLCRAFT_MODEL_REPAIR_ALGORITHM_VERSION,
+  ]);
+}

package/templates/runtime/model-import/worker/model-import-worker-receipt.ts

@@ -0,0 +1,221 @@
+import { createToolcraftModelAppearanceResourceManifest } from "../canonical/model-appearance-resource";
+import { bytesToHex, sha256 } from "../canonical/sha256";
+import { TOOLCRAFT_MODEL_IMPORT_LIMIT_NAMES } from "../model-import-limit-values";
+import type { ToolcraftModelWorkerAnalysisSummary } from "../model-import-types";
+import type {
+  ToolcraftModelDecodeAnalyzeWorkerResult,
+  ToolcraftModelPackageExtractWorkerResult,
+  ToolcraftModelRepairWorkerResult,
+  ToolcraftModelWorkerDraft,
+} from "./model-import-worker-protocol";
+
+const RECEIPT_VERSION = 2;
+const RECEIPT_PREFIX = "toolcraft-model-worker-result-receipt@2";
+const DRAFT_RECEIPT_PREFIX = "toolcraft-model-worker-draft-receipt@2";
+export const TOOLCRAFT_MODEL_WORKER_RECEIPT_MAX_BYTES = 8 * 1024 * 1024;
+const encoder = new TextEncoder();
+
+type DecodeResultWithoutReceipt = Omit<
+  ToolcraftModelDecodeAnalyzeWorkerResult,
+  "receiptDigest"
+>;
+type RepairResultWithoutReceipt = Omit<
+  ToolcraftModelRepairWorkerResult,
+  "receiptDigest"
+>;
+type PackageResultWithoutReceipt = Omit<
+  ToolcraftModelPackageExtractWorkerResult,
+  "receiptDigest"
+>;
+
+export type ToolcraftModelWorkerReceiptInput = Readonly<{
+  generation: number;
+  jobId: string;
+  repairPlanEnvelope?: Readonly<{
+    byteLength: number;
+    envelopeDigest: string;
+    planDigest: string;
+    version: 1;
+  }>;
+  result:
+    | DecodeResultWithoutReceipt
+    | PackageResultWithoutReceipt
+    | RepairResultWithoutReceipt;
+}>;
+
+export type ToolcraftModelWorkerDraftReceiptInput = Readonly<{
+  draft: Omit<ToolcraftModelWorkerDraft, "receiptDigest">;
+  generation: number;
+  jobId: string;
+}>;
+
+function normalizedAnalysis(analysis: ToolcraftModelWorkerAnalysisSummary) {
+  // Trust boundary: this fixed projection is intentionally the only metadata
+  // admitted to a receipt. It never enumerates or stringifies a repair plan.
+  return {
+    analyzerVersion: analysis.analyzerVersion,
+    diagnostics: analysis.diagnostics.map((diagnostic) => ({
+      affectedCount: diagnostic.affectedCount,
+      code: diagnostic.code,
+      explanation: diagnostic.explanation,
+      primitiveId: diagnostic.primitiveId ?? null,
+      primitiveIndex: diagnostic.primitiveIndex ?? null,
+      severity: diagnostic.severity,
+    })),
+    limits: Object.fromEntries(
+      TOOLCRAFT_MODEL_IMPORT_LIMIT_NAMES.map((name) => [
+        name,
+        analysis.limits[name],
+      ]),
+    ),
+    outcome: analysis.outcome,
+    profile: analysis.profile,
+    statistics: {
+      boundaryEdgeCount: analysis.statistics.boundaryEdgeCount,
+      componentCount: analysis.statistics.componentCount,
+      decodedBytes: analysis.statistics.decodedBytes,
+      edgeCount: analysis.statistics.edgeCount,
+      estimatedPeakWorkerBytes: analysis.statistics.estimatedPeakWorkerBytes,
+      estimatedRepairBytes: analysis.statistics.estimatedRepairBytes,
+      nodeCount: analysis.statistics.nodeCount,
+      nonManifoldEdgeCount: analysis.statistics.nonManifoldEdgeCount,
+      nonManifoldVertexCount: analysis.statistics.nonManifoldVertexCount,
+      primitiveCount: analysis.statistics.primitiveCount,
+      triangleCount: analysis.statistics.triangleCount,
+      unusedVertexCount: analysis.statistics.unusedVertexCount,
+      vertexCount: analysis.statistics.vertexCount,
+    },
+  };
+}
+
+function envelopeFor(
+  input: ToolcraftModelWorkerReceiptInput,
+): ToolcraftModelWorkerReceiptInput["repairPlanEnvelope"] {
+  if (input.result.operation === "extract-model-package") {
+    return undefined;
+  }
+  const envelope = input.result.operation === "decode-and-analyze"
+    ? input.result.repairPlanEnvelope
+    : undefined;
+  return envelope === undefined ? input.repairPlanEnvelope : {
+    byteLength: envelope.bytes.byteLength,
+    envelopeDigest: envelope.envelopeDigest,
+    planDigest: envelope.planDigest,
+    version: envelope.version,
+  };
+}
+
+function encodeReceiptFrame(
+  prefixValue: string,
+  metadataValue: unknown,
+): Uint8Array<ArrayBuffer> {
+  const metadata = encoder.encode(JSON.stringify(metadataValue));
+  const prefix = encoder.encode(prefixValue);
+  if (8 + prefix.byteLength + metadata.byteLength >
+      TOOLCRAFT_MODEL_WORKER_RECEIPT_MAX_BYTES) {
+    throw new Error("Model worker receipt metadata exceeds its protected limit.");
+  }
+  const frame = new Uint8Array(8 + prefix.byteLength + metadata.byteLength);
+  const header = new DataView(frame.buffer);
+  header.setUint32(0, prefix.byteLength, true);
+  header.setUint32(4, metadata.byteLength, true);
+  frame.set(prefix, 8);
+  frame.set(metadata, 8 + prefix.byteLength);
+  return frame;
+}
+
+export function createToolcraftModelWorkerReceiptFrame(
+  input: ToolcraftModelWorkerReceiptInput,
+): Uint8Array<ArrayBuffer> {
+  if (input.result.operation === "extract-model-package") {
+    return encodeReceiptFrame(RECEIPT_PREFIX, {
+      archiveDigest: input.result.archiveDigest,
+      entries: input.result.entries.map((entry) => ({
+        byteLength: entry.bytes.byteLength,
+        compressedBytes: entry.compressedBytes,
+        contentDigest: entry.contentDigest,
+        mimeType: entry.mimeType,
+        path: entry.path,
+        uncompressedBytes: entry.uncompressedBytes,
+      })),
+      generation: input.generation,
+      jobId: input.jobId,
+      operation: input.result.operation,
+      version: RECEIPT_VERSION,
+    });
+  }
+
+  const envelope = envelopeFor(input);
+  const planDigest = input.result.operation === "repair"
+    ? input.result.repairPlanDigest
+    : envelope?.planDigest ?? null;
+  return encodeReceiptFrame(RECEIPT_PREFIX, {
+    analysis: normalizedAnalysis(input.result.analysis),
+    ...(input.result.operation === "decode-and-analyze"
+      ? {
+          appearanceResources: createToolcraftModelAppearanceResourceManifest(
+            input.result.appearanceResources,
+          ),
+        }
+      : {}),
+    canonicalDocument: {
+      byteLength: input.result.canonicalDocument.byteLength,
+      digest: input.result.canonicalDocumentDigest,
+    },
+    generation: input.generation,
+    jobId: input.jobId,
+    operation: input.result.operation,
+    repairPlan: envelope === undefined
+      ? { envelopeByteLength: 0, envelopeDigest: null, planDigest, version: null }
+      : {
+          envelopeByteLength: envelope.byteLength,
+          envelopeDigest: envelope.envelopeDigest,
+          planDigest,
+          version: envelope.version,
+        },
+    version: RECEIPT_VERSION,
+  });
+}
+
+export function createToolcraftModelWorkerDraftReceiptFrame(
+  input: ToolcraftModelWorkerDraftReceiptInput,
+): Uint8Array<ArrayBuffer> {
+  return encodeReceiptFrame(DRAFT_RECEIPT_PREFIX, {
+    appearanceResources: createToolcraftModelAppearanceResourceManifest(
+      input.draft.appearanceResources,
+    ),
+    canonicalDocument: {
+      byteLength: input.draft.canonicalDocument.byteLength,
+      digest: input.draft.canonicalDocumentDigest,
+    },
+    generation: input.generation,
+    jobId: input.jobId,
+    operation: "decode-draft",
+    version: RECEIPT_VERSION,
+  });
+}
+
+export function digestToolcraftModelWorkerBytes(
+  value: ArrayBuffer | Uint8Array,
+): string {
+  const bytes = value instanceof Uint8Array
+    ? new Uint8Array(value.buffer, value.byteOffset, value.byteLength)
+    : new Uint8Array(value);
+  return `sha256:${bytesToHex(sha256(bytes))}`;
+}
+
+export function createToolcraftModelWorkerReceiptDigest(
+  input: ToolcraftModelWorkerReceiptInput,
+): string {
+  return digestToolcraftModelWorkerBytes(
+    createToolcraftModelWorkerReceiptFrame(input),
+  );
+}
+
+export function createToolcraftModelWorkerDraftReceiptDigest(
+  input: ToolcraftModelWorkerDraftReceiptInput,
+): string {
+  return digestToolcraftModelWorkerBytes(
+    createToolcraftModelWorkerDraftReceiptFrame(input),
+  );
+}

package/templates/runtime/model-import/worker/model-import-worker-result-verification.ts

@@ -0,0 +1,22 @@
+export type ToolcraftModelWorkerAsyncSha256 = (
+  value: ArrayBuffer | Uint8Array<ArrayBuffer>,
+) => Promise<string>;
+
+function digestHex(bytes: ArrayBuffer): string {
+  let result = "";
+  for (const value of new Uint8Array(bytes)) {
+    result += value.toString(16).padStart(2, "0");
+  }
+  return result;
+}
+
+/** Browser WebCrypto performs all geometry/plan-sized hashing off the event turn. */
+export const sha256ToolcraftModelWorkerBytes:
+ToolcraftModelWorkerAsyncSha256 = async (value) => {
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle) {
+    throw new Error("WebCrypto SHA-256 is unavailable for model worker verification.");
+  }
+  const digest = await subtle.digest("SHA-256", value);
+  return `sha256:${digestHex(digest)}`;
+};

package/templates/runtime/model-import/worker/model-import-worker-runtime-appearance.test.ts

@@ -0,0 +1,81 @@
+import { describe, expect, it, vi } from "vitest";
+
+import { createToolcraftModelAppearanceResourceRef } from "../canonical/model-appearance-resource";
+import {
+  createModelTexture,
+  createValidModelDocumentV2,
+} from "../canonical/model-document-test-support";
+import type { ToolcraftModelWorkerResponse } from "./model-import-worker-protocol";
+import { digestToolcraftModelWorkerBytes } from "./model-import-worker-receipt";
+import { createToolcraftModelWorkerRuntime } from "./model-import-worker-runtime";
+import { decodeRequest } from "./model-import-worker-runtime-test-support";
+
+describe("model import worker appearance resources", () => {
+  it("owns, caches, receipts, and independently transfers v2 appearance bytes", async () => {
+    const textureBytes = new Uint8Array([137, 80, 78, 71]);
+    const contentDigest = digestToolcraftModelWorkerBytes(textureBytes);
+    const resourceRef = createToolcraftModelAppearanceResourceRef(contentDigest);
+    const document = createValidModelDocumentV2({
+      textures: [createModelTexture({ contentDigest, resourceRef })],
+    });
+    const decode = vi.fn(async () => ({
+      appearanceResources: [{
+        bytes: textureBytes.buffer,
+        contentDigest,
+        mimeType: "image/png" as const,
+        resourceRef,
+      }],
+      diagnostics: [],
+      document,
+    }));
+    const posted: Array<{
+      response: ToolcraftModelWorkerResponse;
+      transfer: readonly Transferable[];
+    }> = [];
+    const runtime = createToolcraftModelWorkerRuntime({
+      adapters: [{
+        adapterVersion: "test-adapter@1",
+        decode,
+        format: "glb",
+        rootExtensions: [".glb"],
+        workerCapable: true,
+      }],
+      post: (response, transfer = []) => posted.push({ response, transfer }),
+    });
+
+    await runtime.handleMessage(decodeRequest(1));
+    new Uint8Array(textureBytes.buffer)[0] = 0;
+    await runtime.handleMessage(decodeRequest(2));
+
+    expect(decode).toHaveBeenCalledTimes(1);
+    const drafts = posted.filter(({ response }) => response.kind === "draft");
+    const results = posted.filter(({ response }) => response.kind === "result");
+    expect(drafts).toHaveLength(2);
+    expect(results).toHaveLength(2);
+    for (const published of [...drafts, ...results]) {
+      expect(published.transfer).toHaveLength(2);
+      expect(new Set(published.transfer).size).toBe(2);
+      const resource = published.response.kind === "draft"
+        ? published.response.draft.appearanceResources[0]
+        : published.response.kind === "result" &&
+            published.response.result.operation === "decode-and-analyze"
+        ? published.response.result.appearanceResources[0]
+        : undefined;
+      expect(resource).toMatchObject({ contentDigest, resourceRef });
+      expect(new Uint8Array(resource!.bytes)[0]).toBe(137);
+      expect(published.transfer).toContain(resource!.bytes);
+    }
+    const publishedBuffers = [...drafts, ...results].map((published) => {
+      const response = published.response;
+      if (response.kind === "draft") {
+        return response.draft.appearanceResources[0]!.bytes;
+      }
+      if (response.kind === "result" &&
+          response.result.operation === "decode-and-analyze") {
+        return response.result.appearanceResources[0]!.bytes;
+      }
+      throw new Error("Expected decode appearance resource.");
+    });
+    expect(new Set(publishedBuffers).size).toBe(publishedBuffers.length);
+  });
+});

package/templates/runtime/model-import/worker/model-import-worker-runtime-envelope.test.ts

@@ -0,0 +1,126 @@
+import { describe, expect, it, vi } from "vitest";
+
+import { encodeToolcraftModelDocument } from "../canonical/model-document-codec";
+import { digestToolcraftModelDocument } from "../canonical/model-document-digest";
+import { createModelPrimitive, createValidModelDocument } from "../canonical/model-document-test-support";
+import type { ToolcraftModelFormatAdapter } from "../model-import-types";
+import { digestToolcraftModelWorkerBytes } from "./model-import-worker-receipt";
+import type {
+  ToolcraftModelDecodeAnalyzeWorkerResult,
+  ToolcraftModelWorkerResponse,
+} from "./model-import-worker-protocol";
+import { createToolcraftModelWorkerRuntime } from "./model-import-worker-runtime";
+import { decodeRequest, limits } from "./model-import-worker-runtime-test-support";
+
+function decodeResult(
+  responses: readonly ToolcraftModelWorkerResponse[],
+): ToolcraftModelDecodeAnalyzeWorkerResult {
+  const response = [...responses].reverse().find(({ kind }) => kind === "result");
+  if (response?.kind !== "result" || response.result.operation !== "decode-and-analyze") {
+    throw new Error("Expected decode result.");
+  }
+  return response.result;
+}
+
+describe("model worker opaque repair-plan envelope", () => {
+  it("round-trips analysis envelope bytes back through worker repair", async () => {
+    const document = createValidModelDocument({
+      primitives: [createModelPrimitive({ normals: undefined })],
+    });
+    const adapter: ToolcraftModelFormatAdapter = {
+      adapterVersion: "test-adapter@1",
+      decode: vi.fn(async () => ({
+        appearanceResources: [],
+        diagnostics: [],
+        document,
+      })),
+      format: "glb",
+      rootExtensions: [".glb"],
+      workerCapable: true,
+    };
+    const responses: ToolcraftModelWorkerResponse[] = [];
+    const transfers: Array<readonly Transferable[]> = [];
+    const runtime = createToolcraftModelWorkerRuntime({
+      adapters: [adapter],
+      post: (response, transfer = []) => {
+        responses.push(response);
+        transfers.push(transfer);
+      },
+    });
+
+    await runtime.handleMessage(decodeRequest(1));
+    const decoded = decodeResult(responses);
+    expect(decoded.analysis.outcome).toBe("repairable");
+    expect("repairPlan" in decoded.analysis).toBe(false);
+    expect(decoded.repairPlanEnvelope?.bytes).toBeInstanceOf(ArrayBuffer);
+    const decodeResponseIndex = responses.findIndex(
+      (response) => response.kind === "result" &&
+        response.result.operation === "decode-and-analyze",
+    );
+    expect(transfers[decodeResponseIndex]).toEqual([
+      decoded.canonicalDocument,
+      decoded.repairPlanEnvelope?.bytes,
+    ]);
+
+    await runtime.handleMessage({
+      generation: 2,
+      jobId: "repair-round-trip",
+      kind: "repair",
+      payload: {
+        canonicalDocument: decoded.canonicalDocument,
+        canonicalDocumentDigest: decoded.canonicalDocumentDigest,
+        limits,
+        repairPlanEnvelope: decoded.repairPlanEnvelope!,
+      },
+    });
+
+    const repaired = [...responses].reverse().find(
+      (response) => response.kind === "result" && response.result.operation === "repair",
+    );
+    expect(repaired).toMatchObject({
+      kind: "result",
+      result: {
+        analysis: { outcome: "clean" },
+        operation: "repair",
+        repairPlanDigest: decoded.repairPlanEnvelope?.planDigest,
+        receiptDigest: expect.stringMatching(/^sha256:[0-9a-f]{64}$/u),
+      },
+    });
+  });
+
+  it("rejects a malformed envelope even when its byte digest is recomputed", async () => {
+    const repair = vi.fn(() => createValidModelDocument());
+    const responses: ToolcraftModelWorkerResponse[] = [];
+    const runtime = createToolcraftModelWorkerRuntime({
+      adapters: [],
+      post: (response) => responses.push(response),
+      repair,
+    });
+    const malformedBytes = new TextEncoder().encode("not-an-envelope").buffer;
+    const document = createValidModelDocument();
+    const canonicalDocument = encodeToolcraftModelDocument(document).slice().buffer;
+
+    await runtime.handleMessage({
+      generation: 1,
+      jobId: "malformed-envelope",
+      kind: "repair",
+      payload: {
+        canonicalDocument,
+        canonicalDocumentDigest: digestToolcraftModelDocument(document),
+        limits,
+        repairPlanEnvelope: {
+          bytes: malformedBytes,
+          envelopeDigest: digestToolcraftModelWorkerBytes(malformedBytes),
+          planDigest: `sha256:${"1".repeat(64)}`,
+          version: 1,
+        },
+      },
+    });
+
+    expect(repair).not.toHaveBeenCalled();
+    expect(responses.at(-1)).toMatchObject({
+      feedback: { category: "repair" },
+      kind: "error",
+    });
+  });
+});