@plasius/asset-contracts 0.5.0 → 0.7.0

package/CHANGELOG.md

@@ -14,6 +14,41 @@
 - **Security**
   - (placeholder)
 
+## [0.7.0] - 2026-10-24
+
+- **Added**
+  - Opt-in reloadable canonical texture/material resource qualification, exact
+    storage role/MIME mapping and separate GPU upload/atlas source bindings.
+    Preserves authored metadata and original resource identity through JSON reload.
+  - (placeholder)
+
+- **Changed**
+  - (placeholder)
+
+- **Fixed**
+  - (placeholder)
+
+- **Security**
+  - (placeholder)
+
+## [0.6.0] - 2026-10-24
+
+- **Added**
+  - Opt-in public-safe canonical conversion diagnostics with fixed codes/text,
+    resource/source identity, explicit loss/fallback evidence and legacy converter
+    projections. Reuses lazy model-core evaluation; independent approval and
+    promotion gates remain required.
+  - (placeholder)
+
+- **Changed**
+  - (placeholder)
+
+- **Fixed**
+  - (placeholder)
+
+- **Security**
+  - (placeholder)
+
 ## [0.5.0] - 2026-10-24
 
 - **Added**
@@ -330,3 +365,5 @@
 [0.4.5]: https://github.com/Plasius-LTD/asset-contracts/releases/tag/v0.4.5
 [0.4.6]: https://github.com/Plasius-LTD/asset-contracts/releases/tag/v0.4.6
 [0.5.0]: https://github.com/Plasius-LTD/asset-contracts/releases/tag/v0.5.0
+[0.6.0]: https://github.com/Plasius-LTD/asset-contracts/releases/tag/v0.6.0
+[0.7.0]: https://github.com/Plasius-LTD/asset-contracts/releases/tag/v0.7.0

package/README.md

@@ -28,6 +28,8 @@ The exported surface covers:
 - asset job metadata contracts
 - manifest and file descriptor contracts
 - opt-in canonical model package inventory and exact-byte qualification
+- reloadable canonical texture/material metadata and explicit upload/atlas roles
+- opt-in public-safe canonical conversion diagnostics and resource/source binding
 - screenshot plan definitions
 - review findings and review report contracts
 - immutable promotion record contracts
@@ -90,7 +92,7 @@ Embedded resources remain inside their owning entrypoint; list only actual
 exported files. This helper checks bytes and declarations, not internal format
 references, MIME sniffing, malware, rendering, storage or promotion authority.
 Keep source provenance in the canonical document and do not substitute derived
-hashes for original source hashes. Detailed role mapping, animation/source
+hashes for original source hashes. Role qualification is available through the additive helper below; animation/source
 relationships and promotion closure remain separately tracked work. The result
 is qualification at call time; callers must preserve the exact bytes in their
 own immutable storage boundary.
@@ -104,6 +106,133 @@ runtime parser or renderer loading. Downstream adoption must use a released
 package. See [ADR 0009](./docs/adrs/adr-0009-model-resource-manifest-qualification.md)
 and [TDR 0004](./docs/tdrs/tdr-0004-model-resource-manifest-qualification.md).
 
+## Reloadable Texture and Resource Roles
+
+`qualifyModelTextureResources` composes exact byte/inventory qualification with
+published model-core's verified material/texture graph. It keeps authored
+metadata and source image identity separate from derived GPU uploads/atlases.
+
+```ts
+import { qualifyModelTextureResources } from "@plasius/asset-contracts";
+
+const reload = await qualifyModelTextureResources({
+  manifest, packageManifest, files: exportedFiles,
+  graph: verifiedCanonicalGraph,
+  resources: [
+    { resourceId: "source-image", filePath: "textures/source.png" },
+    { resourceId: "embedded-buffer", filePath: "model.gltf" },
+  ], // Exactly one binding per graph resource.
+  derived: [
+    { role: "gpu-upload", filePath: "derived/upload.bin", sourceResourceIds: ["source-image"] },
+    { role: "texture-atlas", filePath: "derived/atlas.png", sourceResourceIds: ["source-image"] },
+  ], // Or [] when no derivative is exported.
+}, { signal: abortController.signal, timeoutMs: 10_000 });
+// Persist JSON.stringify(reload) alongside the qualified immutable bytes.
+```
+
+Use existing storage roles: canonical texture → texture with PNG/JPEG/WebP/KTX2
+MIME; material/animation → metadata with application/json; mesh → model or
+binary; auxiliary → binary or JSON metadata. Uploads require auxiliary/binary
+buffer files, atlases texture/image files. See TDR 0006 for the exact MIME table.
+Missing/duplicate resources, incompatible roles/MIME, unknown roles, graph
+clones and source/output collisions reject. External files match graph path,
+hash, byte length and MIME; embedded resources name the owning model entrypoint
+and retain their independent resource hash. List only actual exported files.
+
+The frozen version-1 result contains manifest, original source provenance,
+resources, canonical materials/textures and derived records. Authored usage,
+color space, sampler, binding transform, embedding policy and sourceMetadata
+survive JSON reload. Original image IDs and bytes are never replaced by atlas
+hashes or upload paths. No Blob payload or renderer allocation is serialized.
+Adapters own model-internal references, derivation algorithms and image content
+inspection; qualification does not attest those operations or grant promotion.
+Task 12 animation schemas, Task 23 shader ABI and Task 51 promotion closure
+remain separate.
+
+This is **trusted package metadata**, including names, extensions, original
+paths and authored sourceMetadata. Minimize/sanitize that data before public
+distribution; use the separate public diagnostics API for technical responses.
+Serialized graphs lose their private brand: verify reloaded canonical resources
+and reconstruct a graph through core before qualifying again. Produce graphs
+with the same installed model-core instance and matching module format (ESM
+import with ESM, require with CJS). The normal named guard import preserves that
+identity; unused exports remain tree-shakeable through sideEffects=false.
+
+Inputs/bytes are snapshotted before awaiting. Fixed ceilings are 16,384 resource
+bindings, 4,096 derivatives, 65,536 graph nodes, shared 262,144 metadata values,
+2,097,152 UTF-16 characters, depth 16 and 2,048 characters/string. Existing file
+limits also apply. Default deadline 10 seconds, allowed range 1–60,000 ms;
+cancellation/deadline reject without a partial result. In-flight Web Crypto
+cannot be cancelled. ModelTextureResourceError.code is value-free.
+
+The backend evaluator gpu.model.conversion.enabled controls caller adoption;
+disabled/rollback paths retain legacy factories. No lookup/mutation or UI
+capability is introduced. Dependencies and legacy factories are unchanged.
+See [ADR 0011](./docs/adrs/adr-0011-reloadable-texture-resource-roles.md) and
+[TDR 0006](./docs/tdrs/tdr-0006-reloadable-texture-resource-roles.md).
+
+## Public Conversion Diagnostics
+
+`qualifyModelConversionDiagnostics` adds an opt-in, version-1 JSON boundary over
+published model-core diagnostics. It reuses the canonical evaluator, loading it
+only when this async helper is called. Existing factories remain compatible.
+
+```ts
+import { qualifyModelConversionDiagnostics } from "@plasius/asset-contracts";
+
+const result = await qualifyModelConversionDiagnostics({
+  outcome: "completed", // or "unsupported" / "failed" from your trusted adapter
+  source: publicSourceProvenance, // existing ModelProvenance; original source hash
+  report: canonicalDiagnosticInput, // model-core GpuModelDiagnosticInput
+  resources: [{ path: "/meshes/0", resource: publicModelResourceRef }],
+}, { signal: abortController.signal, timeoutMs: 10_000 });
+// Only these existing diagnostic/loss fields belong in ModelConverterEvidence:
+const converterEvidence = { ...trustedConverterIdentity, ...result.converter };
+```
+
+Every non-root diagnostic path must match exactly one supplied resource binding.
+The root path `/` refers to `result.source`; no resource is fabricated. Resource
+references use existing credential-free `mcp://models/...` contracts and include
+hash, length and MIME identity. Conflicting references for one URI reject. These
+bindings and provenance are caller assertions, not proof that bytes were read.
+Use manifest qualification and independent promotion checks at their boundaries.
+
+Statuses are derived deterministically: explicit failure wins, then unsupported
+data/outcome, then canonical rejection, then warning or clean success. Loss
+requires canonical explicit consent; denied loss produces blocking legacy loss
+evidence. Only canonical accepted repairs receive a fallback rule id. Unknown
+repair rules remain blocking. Arbitrary adapter codes, messages, private paths,
+provider exceptions, original repair values and forensic rawSource are never
+serialized; unknown adapter codes map to fixed category codes. Public codes are
+`conversion.warning`, `conversion.repair`, `conversion.loss.dropped`,
+`conversion.loss.approximated`, `conversion.unsupported`, `conversion.blocked`
+and `conversion.failed`, with fixed bounded messages. Malformed input rejects
+with value-free `ModelConversionDiagnosticsError.code`.
+
+This projection is technical evidence only. `technicalAccepted` never replaces
+human approval, malware/security, rights, fidelity, confirmation or promotion
+receipts. `result.converter` contains the exact existing diagnostics/losses
+shape; the detailed `result.diagnostics` additionally binds resources and
+loss/fallback metadata. Preserve all independent evidence when composing it.
+
+Inputs must be inert JSON records; getters, exotic prototypes, sparse arrays,
+cycles, symbols and extra contract keys reject. Metadata is snapshotted before
+awaiting. Fixed ceilings are 100 issues/resources, depth 12, 16,384 values,
+2,048 characters per string and 262,144 total string characters. Non-completed
+outcomes reserve one issue slot for a terminal diagnostic, so accept at most
+99 issues. Arrays never exceed legacy 100-entry limits. Default deadline is
+10 seconds, configurable from 1–60,000 ms; cancellation/deadlines bound the
+lazy import wait and are checked around bounded synchronous evaluation. They
+cannot preempt JavaScript evaluation or cancel the platform module loader.
+No network, filesystem, logs, retries or persistent state are introduced.
+
+Use the backend-evaluated `gpu.model.conversion.enabled` adoption decision;
+disabled/rollback paths retain existing factories and diagnostics. No live flag
+lookup/mutation or UI capability is added. The already-published exact
+model-core0.7.0 dependency supplies evaluation without adding a parser or
+renderer. No dependency version changes are needed. See [ADR 0010](./docs/adrs/adr-0010-public-conversion-diagnostics.md)
+and [TDR 0005](./docs/tdrs/tdr-0005-public-conversion-diagnostics.md).
+
 ## Private Artifact Prevention
 
 Signed contributor agreements and contributor acceptance records are retained

package/dist/index.cjs

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,6 +17,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
@@ -39,6 +49,7 @@ __export(index_exports, {
   MODEL_CANDIDATE_HARD_GATE_KINDS: () => MODEL_CANDIDATE_HARD_GATE_KINDS,
   MODEL_CONFIRMATION_VIEW_KINDS: () => MODEL_CONFIRMATION_VIEW_KINDS,
   MODEL_CONFIRMATION_VIEW_SIZE_PX: () => MODEL_CONFIRMATION_VIEW_SIZE_PX,
+  MODEL_CONVERSION_DIAGNOSTIC_LIMITS: () => MODEL_CONVERSION_DIAGNOSTIC_LIMITS,
   MODEL_GENERATOR_DISABLED_REASON_CODE: () => MODEL_GENERATOR_DISABLED_REASON_CODE,
   MODEL_MATCH_ASSURANCE_BANDS: () => MODEL_MATCH_ASSURANCE_BANDS,
   MODEL_MATCH_ASSURANCE_THRESHOLDS: () => MODEL_MATCH_ASSURANCE_THRESHOLDS,
@@ -54,8 +65,11 @@ __export(index_exports, {
   MODEL_RESOLUTION_V2_STATES: () => MODEL_RESOLUTION_V2_STATES,
   MODEL_RESOURCE_MANIFEST_LIMITS: () => MODEL_RESOURCE_MANIFEST_LIMITS,
   MODEL_RIGHTS_STATUSES: () => MODEL_RIGHTS_STATUSES,
+  MODEL_TEXTURE_RESOURCE_LIMITS: () => MODEL_TEXTURE_RESOURCE_LIMITS,
   MODEL_TEXT_ONLY_ASSURANCE_CEILING_REASON_CODE: () => MODEL_TEXT_ONLY_ASSURANCE_CEILING_REASON_CODE,
+  ModelConversionDiagnosticsError: () => ModelConversionDiagnosticsError,
   ModelResourceManifestError: () => ModelResourceManifestError,
+  ModelTextureResourceError: () => ModelTextureResourceError,
   PVOX_ASSEMBLY_CLOSURE_HASH_DOMAIN: () => PVOX_ASSEMBLY_CLOSURE_HASH_DOMAIN,
   PVOX_ASSET_MANIFEST_VERSION: () => PVOX_ASSET_MANIFEST_VERSION,
   PVOX_BINARY_CLOSURE_HASH_DOMAIN: () => PVOX_BINARY_CLOSURE_HASH_DOMAIN,
@@ -246,7 +260,9 @@ __export(index_exports, {
   normalizeAssetId: () => normalizeAssetId,
   normalizePvoxRootHeaderForHashV1: () => normalizePvoxRootHeaderForHashV1,
   projectPvoxNamedJsonClosureV1: () => projectPvoxNamedJsonClosureV1,
+  qualifyModelConversionDiagnostics: () => qualifyModelConversionDiagnostics,
   qualifyModelResourceManifest: () => qualifyModelResourceManifest,
+  qualifyModelTextureResources: () => qualifyModelTextureResources,
   toLegacyModelResolutionState: () => toLegacyModelResolutionState,
   validateGpuAssetFiles: () => validateGpuAssetFiles
 });
@@ -435,11 +451,11 @@ function assertNoDirectUrl(value, fieldName) {
   }
 }
 function requiredToken(value, fieldName) {
-  const token2 = requiredString(value, fieldName, 128);
-  if (!TOKEN_PATTERN.test(token2)) {
+  const token3 = requiredString(value, fieldName, 128);
+  if (!TOKEN_PATTERN.test(token3)) {
     throw new Error(`${fieldName} must be a token up to 128 characters.`);
   }
-  return token2;
+  return token3;
 }
 function requiredModelPathSegment(value, fieldName) {
   const segment = requiredString(value, fieldName, 128);
@@ -6940,9 +6956,9 @@ function snapshot(value, budget, depth = 0) {
     return value;
   }
   if (Array.isArray(value)) return Object.freeze(list(value).map((item) => snapshot(item, budget, depth + 1)));
-  const fields = record(value);
-  for (const key of Object.keys(fields)) fields[key] = snapshot(fields[key], budget, depth + 1);
-  return Object.freeze(fields);
+  const fields3 = record(value);
+  for (const key of Object.keys(fields3)) fields3[key] = snapshot(fields3[key], budget, depth + 1);
+  return Object.freeze(fields3);
 }
 function path(value) {
   if (typeof value !== "string" || value.length > 1024 || !value.length) fail();
@@ -7051,6 +7067,323 @@ async function qualify(input) {
   return Object.freeze({ ...manifest, files: Object.freeze([...manifest.files].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0)) });
 }
 
+// src/model-texture-resources.ts
+var import_gpu_model_core = require("@plasius/gpu-model-core");
+var MODEL_TEXTURE_RESOURCE_LIMITS = Object.freeze({ resources: 16384, derived: 4096, nodes: 65536, values: 262144, characters: 2097152, depth: 16, timeoutMs: 6e4 });
+var ModelTextureResourceError = class extends TypeError {
+  constructor(code) {
+    super(`Invalid model texture resources: ${code}`);
+    this.code = code;
+    this.name = "ModelTextureResourceError";
+  }
+  code;
+};
+function fail2(code = "invalid-input") {
+  throw new ModelTextureResourceError(code);
+}
+function fields(value, allowed) {
+  if (!value || typeof value !== "object" || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) fail2();
+  const keys = Reflect.ownKeys(value);
+  if (keys.length > 1024) fail2("limit-exceeded");
+  const result = /* @__PURE__ */ Object.create(null);
+  for (const key of keys) {
+    if (typeof key !== "string" || key.length > 128 || ["__proto__", "prototype", "constructor"].includes(key) || allowed && !allowed.includes(key)) fail2();
+    const property = Object.getOwnPropertyDescriptor(value, key);
+    if (!("value" in property) || !property.enumerable) fail2();
+    result[key] = property.value;
+  }
+  return result;
+}
+function array(value, maximum) {
+  if (!Array.isArray(value) || Object.getPrototypeOf(value) !== Array.prototype) fail2();
+  if (value.length > maximum) fail2("limit-exceeded");
+  if (Reflect.ownKeys(value).length !== value.length + 1) fail2();
+  const result = [];
+  for (let i = 0; i < value.length; i++) {
+    const property = Object.getOwnPropertyDescriptor(value, String(i));
+    if (!property || !("value" in property) || !property.enumerable) fail2();
+    result.push(property.value);
+  }
+  return result;
+}
+function snapshot2(value, budget, depth = 0) {
+  if (--budget.values < 0 || depth > MODEL_TEXTURE_RESOURCE_LIMITS.depth) fail2("limit-exceeded");
+  if (value === null || value === void 0 || typeof value === "boolean") return value;
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  if (typeof value === "string") {
+    budget.characters -= value.length;
+    if (value.length > 2048 || budget.characters < 0) fail2("limit-exceeded");
+    return value;
+  }
+  if (Array.isArray(value)) return Object.freeze(array(value, MODEL_TEXTURE_RESOURCE_LIMITS.resources).map((v) => snapshot2(v, budget, depth + 1)));
+  const result = fields(value);
+  for (const key of Object.keys(result)) {
+    budget.characters -= key.length;
+    if (budget.characters < 0) fail2("limit-exceeded");
+    result[key] = snapshot2(result[key], budget, depth + 1);
+  }
+  return Object.freeze(result);
+}
+function token2(value) {
+  if (typeof value !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u.test(value)) fail2();
+  return value;
+}
+var compare = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+var imageMime = (value) => ["image/png", "image/jpeg", "image/webp", "image/ktx2"].includes(value);
+var bufferMime = (value) => ["application/octet-stream", "application/vnd.plasius.gpu-buffer"].includes(value);
+function storageRole(role, file) {
+  const valid = role === "texture" ? file.role === "texture" && imageMime(file.contentType) : role === "material" || role === "animation" ? file.role === "metadata" && file.contentType === "application/json" : role === "mesh" ? file.role === "binary" && bufferMime(file.contentType) || file.role === "model" && (file.contentType.startsWith("model/") || ["application/json", "application/octet-stream", "text/plain"].includes(file.contentType)) : role === "auxiliary" && (file.role === "binary" && bufferMime(file.contentType) || file.role === "metadata" && file.contentType === "application/json");
+  if (!valid) fail2("role-mismatch");
+}
+async function qualifyModelTextureResources(input, options = {}) {
+  let timer;
+  let signal;
+  let onAbort;
+  try {
+    const started = performance.now();
+    const controls = fields(options, ["signal", "timeoutMs"]);
+    const timeoutMs = controls.timeoutMs === void 0 ? 1e4 : controls.timeoutMs;
+    if (typeof timeoutMs !== "number" || !Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > MODEL_TEXTURE_RESOURCE_LIMITS.timeoutMs) fail2();
+    signal = controls.signal;
+    const aborted = Object.getOwnPropertyDescriptor(AbortSignal.prototype, "aborted").get;
+    const check = () => {
+      if (signal !== void 0 && aborted.call(signal)) fail2("aborted");
+      if (performance.now() - started >= timeoutMs) fail2("deadline-exceeded");
+    };
+    check();
+    const root = fields(input, ["manifest", "packageManifest", "files", "graph", "resources", "derived"]);
+    const graph = root.graph;
+    if (!(0, import_gpu_model_core.isGpuModelResourceGraph)(graph)) fail2("unverified-graph");
+    if (graph.nodes.length > MODEL_TEXTURE_RESOURCE_LIMITS.nodes) fail2("limit-exceeded");
+    const budget = { values: MODEL_TEXTURE_RESOURCE_LIMITS.values, characters: MODEL_TEXTURE_RESOURCE_LIMITS.characters };
+    const inventory = snapshot2(root.packageManifest, budget);
+    const bindings = array(snapshot2(root.resources, budget), MODEL_TEXTURE_RESOURCE_LIMITS.resources).map((value) => {
+      const binding = fields(value, ["resourceId", "filePath"]);
+      return Object.freeze({ resourceId: token2(binding.resourceId), filePath: tokenPath(binding.filePath) });
+    });
+    const derived = array(snapshot2(root.derived, budget), MODEL_TEXTURE_RESOURCE_LIMITS.derived).map((value) => {
+      const record2 = fields(value, ["role", "filePath", "sourceResourceIds"]);
+      if (record2.role !== "gpu-upload" && record2.role !== "texture-atlas") fail2("role-mismatch");
+      const ids = array(record2.sourceResourceIds, MODEL_TEXTURE_RESOURCE_LIMITS.resources).map(token2);
+      if (!ids.length || new Set(ids).size !== ids.length) fail2("resource-mismatch");
+      return Object.freeze({ role: record2.role, filePath: tokenPath(record2.filePath), sourceResourceIds: Object.freeze(ids.sort(compare)) });
+    });
+    check();
+    const interrupted = new Promise((_resolve, reject) => {
+      timer = setTimeout(() => reject(new ModelTextureResourceError("deadline-exceeded")), Math.max(1, timeoutMs - (performance.now() - started)));
+      onAbort = () => reject(new ModelTextureResourceError("aborted"));
+      if (signal) AbortSignal.prototype.addEventListener.call(signal, "abort", onAbort, { once: true });
+    });
+    const manifest = await Promise.race([
+      qualifyModelResourceManifest({ manifest: root.manifest, files: root.files, packageManifest: inventory, signal, timeoutMs }),
+      interrupted
+    ]);
+    check();
+    const files = new Map(manifest.files.map((file) => [file.path, file]));
+    const roles = new Map(inventory.entries.map((entry) => [entry.path, entry.role]));
+    for (const entry of inventory.entries) storageRole(entry.role, files.get(entry.path));
+    const resources = new Map(graph.nodes.filter((node) => node.kind === "resource").map((node) => [node.id, node.value]));
+    if (bindings.length !== resources.size || new Set(bindings.map((b) => b.resourceId)).size !== bindings.length) fail2("resource-mismatch");
+    const resourceFiles = /* @__PURE__ */ new Set();
+    const qualified = bindings.map((binding) => {
+      const value = resources.get(binding.resourceId);
+      const file = files.get(binding.filePath);
+      if (!value || !file) fail2("resource-mismatch");
+      const { resource, location, exportEmbeddingPolicy } = value;
+      if (location.kind === "external") {
+        if (binding.filePath !== location.relativePath || file.sha256 !== resource.contentHash || file.byteLength !== resource.byteLength || file.contentType !== resource.mimeType) fail2("resource-mismatch");
+        if (resource.kind === "image" ? roles.get(file.path) !== "texture" : file.role !== "binary") fail2("role-mismatch");
+      } else if (binding.filePath !== manifest.entrypoint || file.role !== "model") fail2("resource-mismatch");
+      resourceFiles.add(binding.filePath);
+      return Object.freeze({ ...binding, kind: resource.kind, contentHash: resource.contentHash, byteLength: resource.byteLength, mimeType: resource.mimeType, location, exportEmbeddingPolicy });
+    });
+    const outputFiles = /* @__PURE__ */ new Set();
+    for (const output of derived) {
+      const file = files.get(output.filePath);
+      if (!file || outputFiles.has(output.filePath) || resourceFiles.has(output.filePath)) fail2("resource-mismatch");
+      outputFiles.add(output.filePath);
+      for (const id of output.sourceResourceIds) {
+        const source2 = resources.get(id);
+        if (!source2 || output.role === "texture-atlas" && source2.resource.kind !== "image") fail2("resource-mismatch");
+      }
+      if (output.role === "gpu-upload" ? file.role !== "binary" || !bufferMime(file.contentType) || roles.get(file.path) !== "auxiliary" : file.role !== "texture" || !imageMime(file.contentType) || roles.get(file.path) !== "texture") fail2("role-mismatch");
+    }
+    const materials = graph.nodes.filter((node) => node.kind === "material").map((node) => node.value);
+    const textures = graph.nodes.filter((node) => node.kind === "texture").map((node) => node.value);
+    const source = graph.nodes.find((node) => node.kind === "provenance");
+    if (source.kind !== "provenance") fail2();
+    snapshot2({ materials, textures, source: source.value }, budget);
+    check();
+    return Object.freeze({
+      contractVersion: 1,
+      manifest,
+      source: source.value,
+      resources: Object.freeze(qualified.sort((a, b) => compare(a.resourceId, b.resourceId))),
+      materials: Object.freeze(materials),
+      textures: Object.freeze(textures),
+      derived: Object.freeze(derived.sort((a, b) => compare(a.filePath, b.filePath)))
+    });
+  } catch (error) {
+    if (error instanceof ModelTextureResourceError) throw error;
+    if (error instanceof ModelResourceManifestError) return fail2(error.code === "aborted" || error.code === "deadline-exceeded" || error.code === "limit-exceeded" ? error.code : "package-mismatch");
+    return fail2();
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+    if (signal && onAbort) AbortSignal.prototype.removeEventListener.call(signal, "abort", onAbort);
+  }
+}
+function tokenPath(value) {
+  if (typeof value !== "string" || !value.length || value.length > 1024) fail2();
+  return value;
+}
+
+// src/model-conversion-diagnostics.ts
+var MODEL_CONVERSION_DIAGNOSTIC_LIMITS = Object.freeze({ issues: 100, resources: 100, values: 16384, depth: 12, string: 2048, characters: 262144, timeoutMs: 6e4 });
+var ModelConversionDiagnosticsError = class extends TypeError {
+  constructor(code) {
+    super(`Invalid model conversion diagnostics: ${code}`);
+    this.code = code;
+    this.name = "ModelConversionDiagnosticsError";
+  }
+  code;
+};
+function fail3(code = "invalid-input") {
+  throw new ModelConversionDiagnosticsError(code);
+}
+function fields2(value) {
+  if (!value || typeof value !== "object" || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) fail3();
+  const result = /* @__PURE__ */ Object.create(null);
+  const keys = Reflect.ownKeys(value);
+  if (keys.length > 1024) fail3("limit-exceeded");
+  for (const key of keys) {
+    if (typeof key !== "string" || key.length > 128 || ["__proto__", "prototype", "constructor"].includes(key)) fail3();
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!("value" in descriptor) || !descriptor.enumerable) fail3();
+    result[key] = descriptor.value;
+  }
+  return result;
+}
+function only(record2, keys) {
+  if (Object.keys(record2).some((key) => !keys.includes(key))) fail3();
+}
+function snapshot3(value, budget, depth = 0) {
+  if (--budget.values < 0 || depth > MODEL_CONVERSION_DIAGNOSTIC_LIMITS.depth) fail3("limit-exceeded");
+  if (value === null || typeof value === "boolean") return value;
+  if (typeof value === "string") {
+    budget.characters -= value.length;
+    if (value.length > MODEL_CONVERSION_DIAGNOSTIC_LIMITS.string || budget.characters < 0) fail3("limit-exceeded");
+    return value;
+  }
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  if (Array.isArray(value)) {
+    if (Object.getPrototypeOf(value) !== Array.prototype || value.length > 1024) fail3("limit-exceeded");
+    if (Reflect.ownKeys(value).length !== value.length + 1) fail3();
+    const result = [];
+    for (let i = 0; i < value.length; i++) {
+      const descriptor = Object.getOwnPropertyDescriptor(value, String(i));
+      if (!descriptor || !("value" in descriptor) || !descriptor.enumerable) fail3();
+      result.push(snapshot3(descriptor.value, budget, depth + 1));
+    }
+    return Object.freeze(result);
+  }
+  const record2 = fields2(value);
+  for (const key of Object.keys(record2)) {
+    budget.characters -= key.length;
+    if (budget.characters < 0) fail3("limit-exceeded");
+    record2[key] = snapshot3(record2[key], budget, depth + 1);
+  }
+  return Object.freeze(record2);
+}
+function legacy(value) {
+  return Object.freeze({ severity: value.severity, code: value.code, message: value.message });
+}
+async function qualifyModelConversionDiagnostics(input, options = {}) {
+  let timer;
+  let signal;
+  let onAbort;
+  try {
+    const start = performance.now();
+    const controls = fields2(options);
+    only(controls, ["signal", "timeoutMs"]);
+    const timeoutMs = controls.timeoutMs === void 0 ? 1e4 : controls.timeoutMs;
+    if (typeof timeoutMs !== "number" || !Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > MODEL_CONVERSION_DIAGNOSTIC_LIMITS.timeoutMs) fail3();
+    signal = controls.signal;
+    const aborted = Object.getOwnPropertyDescriptor(AbortSignal.prototype, "aborted").get;
+    const check = () => {
+      if (signal !== void 0 && aborted.call(signal)) fail3("aborted");
+      if (performance.now() - start >= timeoutMs) fail3("deadline-exceeded");
+    };
+    check();
+    const args = fields2(snapshot3(input, { values: MODEL_CONVERSION_DIAGNOSTIC_LIMITS.values, characters: MODEL_CONVERSION_DIAGNOSTIC_LIMITS.characters }));
+    only(args, ["outcome", "source", "report", "resources"]);
+    if (!["completed", "unsupported", "failed"].includes(args.outcome)) fail3();
+    const source = createModelProvenance(args.source);
+    const reportInput = fields2(args.report);
+    const maximumIssues = MODEL_CONVERSION_DIAGNOSTIC_LIMITS.issues - (args.outcome === "completed" ? 0 : 1);
+    if (!Array.isArray(reportInput.issues) || reportInput.issues.length > maximumIssues) fail3("limit-exceeded");
+    if (!Array.isArray(args.resources) || args.resources.length > MODEL_CONVERSION_DIAGNOSTIC_LIMITS.resources) fail3("limit-exceeded");
+    const resources = /* @__PURE__ */ new Map();
+    const identities = /* @__PURE__ */ new Map();
+    for (const value of args.resources) {
+      const binding = fields2(value);
+      only(binding, ["path", "resource"]);
+      if (typeof binding.path !== "string" || !binding.path.startsWith("/") || binding.path === "/" || resources.has(binding.path)) fail3();
+      const resource = createModelResourceRef(binding.resource);
+      const identity = JSON.stringify(resource);
+      if (identities.has(resource.uri) && identities.get(resource.uri) !== identity) fail3();
+      identities.set(resource.uri, identity);
+      resources.set(binding.path, resource);
+    }
+    check();
+    const interrupted = new Promise((_resolve, reject) => {
+      timer = setTimeout(() => reject(new ModelConversionDiagnosticsError("deadline-exceeded")), Math.max(1, timeoutMs - (performance.now() - start)));
+      onAbort = () => reject(new ModelConversionDiagnosticsError("aborted"));
+      if (signal) AbortSignal.prototype.addEventListener.call(signal, "abort", onAbort, { once: true });
+    });
+    const core = await Promise.race([import("@plasius/gpu-model-core"), interrupted]);
+    check();
+    const report = core.evaluateGpuModelDiagnostics(reportInput);
+    const diagnostics = report.diagnostics.map((diagnostic) => {
+      const resource = resources.get(diagnostic.path);
+      if (diagnostic.path !== "/" && !resource) fail3("unbound-resource");
+      const base = resource ? { resource } : {};
+      switch (diagnostic.kind) {
+        case "warning":
+          return Object.freeze({ ...base, severity: "warning", code: "conversion.warning", message: "Conversion completed with an advisory." });
+        case "repair":
+          return Object.freeze({ ...base, severity: "warning", code: "conversion.repair", message: "Conversion applied a canonical repair fallback.", fallback: diagnostic.ruleId });
+        case "loss":
+          return Object.freeze({ ...base, severity: reportInput.allowLoss === true ? "warning" : "blocking", code: `conversion.loss.${diagnostic.effect}`, message: diagnostic.effect === "dropped" ? "Conversion dropped source data." : "Conversion approximated source data.", effect: diagnostic.effect });
+        case "unsupported":
+          return Object.freeze({ ...base, severity: "blocking", code: "conversion.unsupported", message: "Conversion encountered unsupported data." });
+        case "blocking-error":
+          return Object.freeze({ ...base, severity: "blocking", code: "conversion.blocked", message: "Conversion did not satisfy canonical validation policy." });
+      }
+    });
+    if (args.outcome !== "completed") diagnostics.push(Object.freeze({ severity: "blocking", code: args.outcome === "failed" ? "conversion.failed" : "conversion.unsupported", message: args.outcome === "failed" ? "Conversion failed." : "Conversion encountered unsupported data." }));
+    const technicalAccepted = args.outcome === "completed" && report.accepted;
+    const status = args.outcome === "failed" ? "failed" : args.outcome === "unsupported" || report.diagnostics.some((item) => item.kind === "unsupported") ? "unsupported" : !technicalAccepted ? "failed" : diagnostics.length ? "warning" : "succeeded";
+    const losses = diagnostics.filter((item) => item.effect !== void 0).map(legacy);
+    check();
+    return Object.freeze({
+      contractVersion: 1,
+      status,
+      technicalAccepted,
+      standard: report.standard,
+      mode: report.mode,
+      source,
+      diagnostics: Object.freeze(diagnostics),
+      converter: Object.freeze({ diagnostics: Object.freeze(diagnostics.filter((item) => item.effect === void 0).map(legacy)), losses: Object.freeze(losses) })
+    });
+  } catch (error) {
+    if (error instanceof ModelConversionDiagnosticsError) throw error;
+    return fail3();
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+    if (signal && onAbort) AbortSignal.prototype.removeEventListener.call(signal, "abort", onAbort);
+  }
+}
+
 // src/index.ts
 var ASSET_CONTRACTS_PACKAGE = "@plasius/asset-contracts";
 var UNIFIED_ASSET_PIPELINE_FEATURE_FLAG_ID = "asset.pipeline.unified-ai-assets.enabled";
@@ -7839,6 +8172,7 @@ function assertRequiredString(value, fieldName) {
   MODEL_CANDIDATE_HARD_GATE_KINDS,
   MODEL_CONFIRMATION_VIEW_KINDS,
   MODEL_CONFIRMATION_VIEW_SIZE_PX,
+  MODEL_CONVERSION_DIAGNOSTIC_LIMITS,
   MODEL_GENERATOR_DISABLED_REASON_CODE,
   MODEL_MATCH_ASSURANCE_BANDS,
   MODEL_MATCH_ASSURANCE_THRESHOLDS,
@@ -7854,8 +8188,11 @@ function assertRequiredString(value, fieldName) {
   MODEL_RESOLUTION_V2_STATES,
   MODEL_RESOURCE_MANIFEST_LIMITS,
   MODEL_RIGHTS_STATUSES,
+  MODEL_TEXTURE_RESOURCE_LIMITS,
   MODEL_TEXT_ONLY_ASSURANCE_CEILING_REASON_CODE,
+  ModelConversionDiagnosticsError,
   ModelResourceManifestError,
+  ModelTextureResourceError,
   PVOX_ASSEMBLY_CLOSURE_HASH_DOMAIN,
   PVOX_ASSET_MANIFEST_VERSION,
   PVOX_BINARY_CLOSURE_HASH_DOMAIN,
@@ -8046,7 +8383,9 @@ function assertRequiredString(value, fieldName) {
   normalizeAssetId,
   normalizePvoxRootHeaderForHashV1,
   projectPvoxNamedJsonClosureV1,
+  qualifyModelConversionDiagnostics,
   qualifyModelResourceManifest,
+  qualifyModelTextureResources,
   toLegacyModelResolutionState,
   validateGpuAssetFiles
 });