@plasius/asset-contracts 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -14,6 +14,24 @@
 - **Security**
   - (placeholder)
 
+## [0.6.0] - 2026-10-24
+
+- **Added**
+  - Opt-in public-safe canonical conversion diagnostics with fixed codes/text,
+    resource/source identity, explicit loss/fallback evidence and legacy converter
+    projections. Reuses lazy model-core evaluation; independent approval and
+    promotion gates remain required.
+  - (placeholder)
+
+- **Changed**
+  - (placeholder)
+
+- **Fixed**
+  - (placeholder)
+
+- **Security**
+  - (placeholder)
+
 ## [0.5.0] - 2026-10-24
 
 - **Added**
@@ -330,3 +348,4 @@
 [0.4.5]: https://github.com/Plasius-LTD/asset-contracts/releases/tag/v0.4.5
 [0.4.6]: https://github.com/Plasius-LTD/asset-contracts/releases/tag/v0.4.6
 [0.5.0]: https://github.com/Plasius-LTD/asset-contracts/releases/tag/v0.5.0
+[0.6.0]: https://github.com/Plasius-LTD/asset-contracts/releases/tag/v0.6.0

package/README.md

@@ -28,6 +28,7 @@ The exported surface covers:
 - asset job metadata contracts
 - manifest and file descriptor contracts
 - opt-in canonical model package inventory and exact-byte qualification
+- opt-in public-safe canonical conversion diagnostics and resource/source binding
 - screenshot plan definitions
 - review findings and review report contracts
 - immutable promotion record contracts
@@ -104,6 +105,68 @@ runtime parser or renderer loading. Downstream adoption must use a released
 package. See [ADR 0009](./docs/adrs/adr-0009-model-resource-manifest-qualification.md)
 and [TDR 0004](./docs/tdrs/tdr-0004-model-resource-manifest-qualification.md).
 
+## Public Conversion Diagnostics
+
+`qualifyModelConversionDiagnostics` adds an opt-in, version-1 JSON boundary over
+published model-core diagnostics. It reuses the canonical evaluator, loading it
+only when this async helper is called. Existing factories remain compatible.
+
+```ts
+import { qualifyModelConversionDiagnostics } from "@plasius/asset-contracts";
+
+const result = await qualifyModelConversionDiagnostics({
+  outcome: "completed", // or "unsupported" / "failed" from your trusted adapter
+  source: publicSourceProvenance, // existing ModelProvenance; original source hash
+  report: canonicalDiagnosticInput, // model-core GpuModelDiagnosticInput
+  resources: [{ path: "/meshes/0", resource: publicModelResourceRef }],
+}, { signal: abortController.signal, timeoutMs: 10_000 });
+// Only these existing diagnostic/loss fields belong in ModelConverterEvidence:
+const converterEvidence = { ...trustedConverterIdentity, ...result.converter };
+```
+
+Every non-root diagnostic path must match exactly one supplied resource binding.
+The root path `/` refers to `result.source`; no resource is fabricated. Resource
+references use existing credential-free `mcp://models/...` contracts and include
+hash, length and MIME identity. Conflicting references for one URI reject. These
+bindings and provenance are caller assertions, not proof that bytes were read.
+Use manifest qualification and independent promotion checks at their boundaries.
+
+Statuses are derived deterministically: explicit failure wins, then unsupported
+data/outcome, then canonical rejection, then warning or clean success. Loss
+requires canonical explicit consent; denied loss produces blocking legacy loss
+evidence. Only canonical accepted repairs receive a fallback rule id. Unknown
+repair rules remain blocking. Arbitrary adapter codes, messages, private paths,
+provider exceptions, original repair values and forensic rawSource are never
+serialized; unknown adapter codes map to fixed category codes. Public codes are
+`conversion.warning`, `conversion.repair`, `conversion.loss.dropped`,
+`conversion.loss.approximated`, `conversion.unsupported`, `conversion.blocked`
+and `conversion.failed`, with fixed bounded messages. Malformed input rejects
+with value-free `ModelConversionDiagnosticsError.code`.
+
+This projection is technical evidence only. `technicalAccepted` never replaces
+human approval, malware/security, rights, fidelity, confirmation or promotion
+receipts. `result.converter` contains the exact existing diagnostics/losses
+shape; the detailed `result.diagnostics` additionally binds resources and
+loss/fallback metadata. Preserve all independent evidence when composing it.
+
+Inputs must be inert JSON records; getters, exotic prototypes, sparse arrays,
+cycles, symbols and extra contract keys reject. Metadata is snapshotted before
+awaiting. Fixed ceilings are 100 issues/resources, depth 12, 16,384 values,
+2,048 characters per string and 262,144 total string characters. Non-completed
+outcomes reserve one issue slot for a terminal diagnostic, so accept at most
+99 issues. Arrays never exceed legacy 100-entry limits. Default deadline is
+10 seconds, configurable from 1–60,000 ms; cancellation/deadlines bound the
+lazy import wait and are checked around bounded synchronous evaluation. They
+cannot preempt JavaScript evaluation or cancel the platform module loader.
+No network, filesystem, logs, retries or persistent state are introduced.
+
+Use the backend-evaluated `gpu.model.conversion.enabled` adoption decision;
+disabled/rollback paths retain existing factories and diagnostics. No live flag
+lookup/mutation or UI capability is added. The already-published exact
+model-core0.7.0 dependency supplies evaluation without adding a parser or
+renderer. No dependency version changes are needed. See [ADR 0010](./docs/adrs/adr-0010-public-conversion-diagnostics.md)
+and [TDR 0005](./docs/tdrs/tdr-0005-public-conversion-diagnostics.md).
+
 ## Private Artifact Prevention
 
 Signed contributor agreements and contributor acceptance records are retained

package/dist/index.cjs

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,6 +17,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
@@ -39,6 +49,7 @@ __export(index_exports, {
   MODEL_CANDIDATE_HARD_GATE_KINDS: () => MODEL_CANDIDATE_HARD_GATE_KINDS,
   MODEL_CONFIRMATION_VIEW_KINDS: () => MODEL_CONFIRMATION_VIEW_KINDS,
   MODEL_CONFIRMATION_VIEW_SIZE_PX: () => MODEL_CONFIRMATION_VIEW_SIZE_PX,
+  MODEL_CONVERSION_DIAGNOSTIC_LIMITS: () => MODEL_CONVERSION_DIAGNOSTIC_LIMITS,
   MODEL_GENERATOR_DISABLED_REASON_CODE: () => MODEL_GENERATOR_DISABLED_REASON_CODE,
   MODEL_MATCH_ASSURANCE_BANDS: () => MODEL_MATCH_ASSURANCE_BANDS,
   MODEL_MATCH_ASSURANCE_THRESHOLDS: () => MODEL_MATCH_ASSURANCE_THRESHOLDS,
@@ -55,6 +66,7 @@ __export(index_exports, {
   MODEL_RESOURCE_MANIFEST_LIMITS: () => MODEL_RESOURCE_MANIFEST_LIMITS,
   MODEL_RIGHTS_STATUSES: () => MODEL_RIGHTS_STATUSES,
   MODEL_TEXT_ONLY_ASSURANCE_CEILING_REASON_CODE: () => MODEL_TEXT_ONLY_ASSURANCE_CEILING_REASON_CODE,
+  ModelConversionDiagnosticsError: () => ModelConversionDiagnosticsError,
   ModelResourceManifestError: () => ModelResourceManifestError,
   PVOX_ASSEMBLY_CLOSURE_HASH_DOMAIN: () => PVOX_ASSEMBLY_CLOSURE_HASH_DOMAIN,
   PVOX_ASSET_MANIFEST_VERSION: () => PVOX_ASSET_MANIFEST_VERSION,
@@ -246,6 +258,7 @@ __export(index_exports, {
   normalizeAssetId: () => normalizeAssetId,
   normalizePvoxRootHeaderForHashV1: () => normalizePvoxRootHeaderForHashV1,
   projectPvoxNamedJsonClosureV1: () => projectPvoxNamedJsonClosureV1,
+  qualifyModelConversionDiagnostics: () => qualifyModelConversionDiagnostics,
   qualifyModelResourceManifest: () => qualifyModelResourceManifest,
   toLegacyModelResolutionState: () => toLegacyModelResolutionState,
   validateGpuAssetFiles: () => validateGpuAssetFiles
@@ -6940,9 +6953,9 @@ function snapshot(value, budget, depth = 0) {
     return value;
   }
   if (Array.isArray(value)) return Object.freeze(list(value).map((item) => snapshot(item, budget, depth + 1)));
-  const fields = record(value);
-  for (const key of Object.keys(fields)) fields[key] = snapshot(fields[key], budget, depth + 1);
-  return Object.freeze(fields);
+  const fields2 = record(value);
+  for (const key of Object.keys(fields2)) fields2[key] = snapshot(fields2[key], budget, depth + 1);
+  return Object.freeze(fields2);
 }
 function path(value) {
   if (typeof value !== "string" || value.length > 1024 || !value.length) fail();
@@ -7051,6 +7064,153 @@ async function qualify(input) {
   return Object.freeze({ ...manifest, files: Object.freeze([...manifest.files].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0)) });
 }
 
+// src/model-conversion-diagnostics.ts
+var MODEL_CONVERSION_DIAGNOSTIC_LIMITS = Object.freeze({ issues: 100, resources: 100, values: 16384, depth: 12, string: 2048, characters: 262144, timeoutMs: 6e4 });
+var ModelConversionDiagnosticsError = class extends TypeError {
+  constructor(code) {
+    super(`Invalid model conversion diagnostics: ${code}`);
+    this.code = code;
+    this.name = "ModelConversionDiagnosticsError";
+  }
+  code;
+};
+function fail2(code = "invalid-input") {
+  throw new ModelConversionDiagnosticsError(code);
+}
+function fields(value) {
+  if (!value || typeof value !== "object" || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) fail2();
+  const result = /* @__PURE__ */ Object.create(null);
+  const keys = Reflect.ownKeys(value);
+  if (keys.length > 1024) fail2("limit-exceeded");
+  for (const key of keys) {
+    if (typeof key !== "string" || key.length > 128 || ["__proto__", "prototype", "constructor"].includes(key)) fail2();
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!("value" in descriptor) || !descriptor.enumerable) fail2();
+    result[key] = descriptor.value;
+  }
+  return result;
+}
+function only(record2, keys) {
+  if (Object.keys(record2).some((key) => !keys.includes(key))) fail2();
+}
+function snapshot2(value, budget, depth = 0) {
+  if (--budget.values < 0 || depth > MODEL_CONVERSION_DIAGNOSTIC_LIMITS.depth) fail2("limit-exceeded");
+  if (value === null || typeof value === "boolean") return value;
+  if (typeof value === "string") {
+    budget.characters -= value.length;
+    if (value.length > MODEL_CONVERSION_DIAGNOSTIC_LIMITS.string || budget.characters < 0) fail2("limit-exceeded");
+    return value;
+  }
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  if (Array.isArray(value)) {
+    if (Object.getPrototypeOf(value) !== Array.prototype || value.length > 1024) fail2("limit-exceeded");
+    if (Reflect.ownKeys(value).length !== value.length + 1) fail2();
+    const result = [];
+    for (let i = 0; i < value.length; i++) {
+      const descriptor = Object.getOwnPropertyDescriptor(value, String(i));
+      if (!descriptor || !("value" in descriptor) || !descriptor.enumerable) fail2();
+      result.push(snapshot2(descriptor.value, budget, depth + 1));
+    }
+    return Object.freeze(result);
+  }
+  const record2 = fields(value);
+  for (const key of Object.keys(record2)) {
+    budget.characters -= key.length;
+    if (budget.characters < 0) fail2("limit-exceeded");
+    record2[key] = snapshot2(record2[key], budget, depth + 1);
+  }
+  return Object.freeze(record2);
+}
+function legacy(value) {
+  return Object.freeze({ severity: value.severity, code: value.code, message: value.message });
+}
+async function qualifyModelConversionDiagnostics(input, options = {}) {
+  let timer;
+  let signal;
+  let onAbort;
+  try {
+    const start = performance.now();
+    const controls = fields(options);
+    only(controls, ["signal", "timeoutMs"]);
+    const timeoutMs = controls.timeoutMs === void 0 ? 1e4 : controls.timeoutMs;
+    if (typeof timeoutMs !== "number" || !Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > MODEL_CONVERSION_DIAGNOSTIC_LIMITS.timeoutMs) fail2();
+    signal = controls.signal;
+    const aborted = Object.getOwnPropertyDescriptor(AbortSignal.prototype, "aborted").get;
+    const check = () => {
+      if (signal !== void 0 && aborted.call(signal)) fail2("aborted");
+      if (performance.now() - start >= timeoutMs) fail2("deadline-exceeded");
+    };
+    check();
+    const args = fields(snapshot2(input, { values: MODEL_CONVERSION_DIAGNOSTIC_LIMITS.values, characters: MODEL_CONVERSION_DIAGNOSTIC_LIMITS.characters }));
+    only(args, ["outcome", "source", "report", "resources"]);
+    if (!["completed", "unsupported", "failed"].includes(args.outcome)) fail2();
+    const source = createModelProvenance(args.source);
+    const reportInput = fields(args.report);
+    const maximumIssues = MODEL_CONVERSION_DIAGNOSTIC_LIMITS.issues - (args.outcome === "completed" ? 0 : 1);
+    if (!Array.isArray(reportInput.issues) || reportInput.issues.length > maximumIssues) fail2("limit-exceeded");
+    if (!Array.isArray(args.resources) || args.resources.length > MODEL_CONVERSION_DIAGNOSTIC_LIMITS.resources) fail2("limit-exceeded");
+    const resources = /* @__PURE__ */ new Map();
+    const identities = /* @__PURE__ */ new Map();
+    for (const value of args.resources) {
+      const binding = fields(value);
+      only(binding, ["path", "resource"]);
+      if (typeof binding.path !== "string" || !binding.path.startsWith("/") || binding.path === "/" || resources.has(binding.path)) fail2();
+      const resource = createModelResourceRef(binding.resource);
+      const identity = JSON.stringify(resource);
+      if (identities.has(resource.uri) && identities.get(resource.uri) !== identity) fail2();
+      identities.set(resource.uri, identity);
+      resources.set(binding.path, resource);
+    }
+    check();
+    const interrupted = new Promise((_resolve, reject) => {
+      timer = setTimeout(() => reject(new ModelConversionDiagnosticsError("deadline-exceeded")), Math.max(1, timeoutMs - (performance.now() - start)));
+      onAbort = () => reject(new ModelConversionDiagnosticsError("aborted"));
+      if (signal) AbortSignal.prototype.addEventListener.call(signal, "abort", onAbort, { once: true });
+    });
+    const core = await Promise.race([import("@plasius/gpu-model-core"), interrupted]);
+    check();
+    const report = core.evaluateGpuModelDiagnostics(reportInput);
+    const diagnostics = report.diagnostics.map((diagnostic) => {
+      const resource = resources.get(diagnostic.path);
+      if (diagnostic.path !== "/" && !resource) fail2("unbound-resource");
+      const base = resource ? { resource } : {};
+      switch (diagnostic.kind) {
+        case "warning":
+          return Object.freeze({ ...base, severity: "warning", code: "conversion.warning", message: "Conversion completed with an advisory." });
+        case "repair":
+          return Object.freeze({ ...base, severity: "warning", code: "conversion.repair", message: "Conversion applied a canonical repair fallback.", fallback: diagnostic.ruleId });
+        case "loss":
+          return Object.freeze({ ...base, severity: reportInput.allowLoss === true ? "warning" : "blocking", code: `conversion.loss.${diagnostic.effect}`, message: diagnostic.effect === "dropped" ? "Conversion dropped source data." : "Conversion approximated source data.", effect: diagnostic.effect });
+        case "unsupported":
+          return Object.freeze({ ...base, severity: "blocking", code: "conversion.unsupported", message: "Conversion encountered unsupported data." });
+        case "blocking-error":
+          return Object.freeze({ ...base, severity: "blocking", code: "conversion.blocked", message: "Conversion did not satisfy canonical validation policy." });
+      }
+    });
+    if (args.outcome !== "completed") diagnostics.push(Object.freeze({ severity: "blocking", code: args.outcome === "failed" ? "conversion.failed" : "conversion.unsupported", message: args.outcome === "failed" ? "Conversion failed." : "Conversion encountered unsupported data." }));
+    const technicalAccepted = args.outcome === "completed" && report.accepted;
+    const status = args.outcome === "failed" ? "failed" : args.outcome === "unsupported" || report.diagnostics.some((item) => item.kind === "unsupported") ? "unsupported" : !technicalAccepted ? "failed" : diagnostics.length ? "warning" : "succeeded";
+    const losses = diagnostics.filter((item) => item.effect !== void 0).map(legacy);
+    check();
+    return Object.freeze({
+      contractVersion: 1,
+      status,
+      technicalAccepted,
+      standard: report.standard,
+      mode: report.mode,
+      source,
+      diagnostics: Object.freeze(diagnostics),
+      converter: Object.freeze({ diagnostics: Object.freeze(diagnostics.filter((item) => item.effect === void 0).map(legacy)), losses: Object.freeze(losses) })
+    });
+  } catch (error) {
+    if (error instanceof ModelConversionDiagnosticsError) throw error;
+    return fail2();
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+    if (signal && onAbort) AbortSignal.prototype.removeEventListener.call(signal, "abort", onAbort);
+  }
+}
+
 // src/index.ts
 var ASSET_CONTRACTS_PACKAGE = "@plasius/asset-contracts";
 var UNIFIED_ASSET_PIPELINE_FEATURE_FLAG_ID = "asset.pipeline.unified-ai-assets.enabled";
@@ -7839,6 +7999,7 @@ function assertRequiredString(value, fieldName) {
   MODEL_CANDIDATE_HARD_GATE_KINDS,
   MODEL_CONFIRMATION_VIEW_KINDS,
   MODEL_CONFIRMATION_VIEW_SIZE_PX,
+  MODEL_CONVERSION_DIAGNOSTIC_LIMITS,
   MODEL_GENERATOR_DISABLED_REASON_CODE,
   MODEL_MATCH_ASSURANCE_BANDS,
   MODEL_MATCH_ASSURANCE_THRESHOLDS,
@@ -7855,6 +8016,7 @@ function assertRequiredString(value, fieldName) {
   MODEL_RESOURCE_MANIFEST_LIMITS,
   MODEL_RIGHTS_STATUSES,
   MODEL_TEXT_ONLY_ASSURANCE_CEILING_REASON_CODE,
+  ModelConversionDiagnosticsError,
   ModelResourceManifestError,
   PVOX_ASSEMBLY_CLOSURE_HASH_DOMAIN,
   PVOX_ASSET_MANIFEST_VERSION,
@@ -8046,6 +8208,7 @@ function assertRequiredString(value, fieldName) {
   normalizeAssetId,
   normalizePvoxRootHeaderForHashV1,
   projectPvoxNamedJsonClosureV1,
+  qualifyModelConversionDiagnostics,
   qualifyModelResourceManifest,
   toLegacyModelResolutionState,
   validateGpuAssetFiles