@playcraft/cli 0.1.67 → 0.1.69

package/dist/workspace-runtime/server/http.js

@@ -44,6 +44,7 @@ import { acceptOperationCore, observeLevelEditorTransaction } from './accept-ope
 import { workspaceArtifactContentQuerySchema } from '@playcraft/common/cloud-workspace/runtime';
 import { searchWorkspaceFiles } from '../workspaces/files-search.js';
 import { serveWorkspaceArchive } from '../workspaces/archive.js';
+import { verifyRuntimeAssetProvenance } from '../workspaces/asset-provenance-verifier.js';
 import { handleWorkspaceTransfer } from './workspace-transfer.js';
 import { handleWorkspaceStorage } from './workspace-storage.js';
 import { serveSessionImage } from '../workspaces/session-image.js';
@@ -199,6 +200,7 @@ async function dispatchRuntimeRequest(state, request, response) {
                 levelEditorRetryVersion: 1,
                 remixReferencesVersion: 1,
                 batchSourceFreezeRevision: 2,
+                batchSourcePublicationVersion: 1,
                 ...(state.native?.workspaceUi ? { workspaceUiVersion: 1 } : {}),
                 ...(state.native?.startReview && state.native?.steer ? { turnControlVersion: 1 } : {}),
                 ...(state.native?.startCompact ? { compactionVersion: 1 } : {}),
@@ -685,8 +687,16 @@ async function dispatchRuntimeRequest(state, request, response) {
         if (['GET', 'HEAD'].includes(request.method ?? '') && url.pathname === '/runtime/archive') {
             if (writeDestroyed(state, response))
                 return;
-            const root = await sessionWorkspaceRoot(state, url.searchParams.get('workspaceId') ?? undefined, directoryName);
-            await serveWorkspaceArchive(root, request, response, { excludedRoots: [state.config.stateDir] });
+            const archiveWorkspaceId = url.searchParams.get('workspaceId') ?? undefined;
+            const root = await sessionWorkspaceRoot(state, archiveWorkspaceId, directoryName);
+            const expectedModelPaths = state.journal.listOperations().map(({ operation }) => operation).filter(operation => operation.kind === 'asset.library.import'
+                && (state.config.workspaceMode !== 'multi' || operation.workspaceId === archiveWorkspaceId)
+                && (operation.directoryName ?? 'basic') === directoryName)
+                .flatMap(operation => operation.result && 'bundleReceipt' in operation.result ? operation.result.bundleReceipt?.files ?? [] : [])
+                .map(file => file.path).filter(path => path.toLowerCase().endsWith('.glb'));
+            await serveWorkspaceArchive(root, request, response, { excludedRoots: [state.config.stateDir],
+                expectedModelPaths: [...new Set(expectedModelPaths)],
+                verifyProvenance: provenance => verifyRuntimeAssetProvenance(state, provenance) });
             return;
         }
         if (['GET', 'HEAD'].includes(request.method ?? '') && url.pathname === '/runtime/file-content') {

package/dist/workspace-runtime/verify-artifact.js

@@ -47,6 +47,7 @@ export async function verifyRuntimeArtifact(expectedVersion) {
         const identity = await response.json();
         assert.equal(identity.runtimeId, config.runtimeId);
         assert.equal(identity.batchSourceFreezeRevision, 2, 'built runtime lacks the required batch source freeze implementation');
+        assert.equal(identity.batchSourcePublicationVersion, 1, 'built runtime lacks trusted batch source publication');
     }
     finally {
         await runtime?.close();
@@ -55,5 +56,5 @@ export async function verifyRuntimeArtifact(expectedVersion) {
 }
 if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
     await verifyRuntimeArtifact(process.argv[2] ?? '');
-    console.log('Runtime artifact verified: batchSourceFreezeRevision=2');
+    console.log('Runtime artifact verified: batchSourceFreezeRevision=2, batchSourcePublicationVersion=1');
 }

package/dist/workspace-runtime/workspaces/archive.js

@@ -1,13 +1,21 @@
 import { constants } from 'node:fs';
+import { createHash } from 'node:crypto';
 import { lstat, open, opendir, realpath } from 'node:fs/promises';
 import { join, relative, sep } from 'node:path';
 import { Readable, Transform } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
 import { createDeflateRaw } from 'node:zlib';
 import { isCredentialFile } from './git.js';
-const EXCLUDED_NAMES = new Set(['.git', 'node_modules', '.playcraft.json', '.playcraft-workspace.json']);
+import { verifyWorkspaceAssetProvenance, WORKSPACE_ASSET_PROVENANCE_PATH } from '../../asset-library/provenance.js';
+import { workspaceAssetProvenanceDocumentSchema } from '@playcraft/common/cloud-workspace/runtime';
+const EXCLUDED_NAMES = new Set(['.git', 'node_modules', '.playcraft-temp', '.playcraft.json', '.playcraft-workspace.json']);
 const MAX_SOURCE_BYTES = 2 * 1024 * 1024 * 1024;
 const MAX_ENTRIES = 50_000;
+const PUBLIC_ARCHIVE_ERRORS = new Set(['workspace_archive_changed', 'workspace_archive_too_large', 'workspace_archive_invalid_path',
+    'workspace_archive_failed', 'asset_provenance_authority_required', 'asset_provenance_authority_unavailable',
+    'asset_provenance_authority_mismatch', 'asset_provenance_authority_response_bound', 'asset_provenance_model_changed',
+    'asset_provenance_license_changed', 'asset_provenance_record_missing', 'asset_provenance_license_path_mismatch',
+    'asset_provenance_too_large', 'asset_provenance_changed', 'asset_provenance_notice_conflict', 'asset_provenance_expected_path_invalid']);
 const UTF8_DESCRIPTOR_FLAGS = 0x0808;
 const CRC_TABLE = Uint32Array.from({ length: 256 }, (_, value) => {
     let crc = value;
@@ -18,6 +26,13 @@ const CRC_TABLE = Uint32Array.from({ length: 256 }, (_, value) => {
 /** Exports working files, including ignored deliverables, without following symbolic links. */
 export async function createWorkspaceArchive(root, options = {}) {
     const rootReal = await realpath(root);
+    const provenance = await verifyWorkspaceAssetProvenance(rootReal, { verify: options.verifyProvenance,
+        expectedModelPaths: options.expectedModelPaths });
+    const expectedHashes = new Map();
+    for (const asset of provenance?.assets ?? []) {
+        expectedHashes.set(asset.path, asset.provenance.modelSha256);
+        expectedHashes.set(asset.licensePath, createHash('sha256').update(asset.provenance.licenseText).digest('hex'));
+    }
     const excludedRoots = await Promise.all((options.excludedRoots ?? []).map(path => realpath(path).catch(() => path)));
     const entries = [];
     let bytes = 0;
@@ -52,7 +67,8 @@ export async function createWorkspaceArchive(root, options = {}) {
             bytes += info.size;
             if (bytes > (options.maxSourceBytes ?? MAX_SOURCE_BYTES) || entries.length >= (options.maxEntries ?? MAX_ENTRIES))
                 throw new Error('workspace_archive_too_large');
-            entries.push({ path, target, info });
+            entries.push({ path, target, info, expectedHash: expectedHashes.get(path),
+                ...(path === WORKSPACE_ASSET_PROVENANCE_PATH && provenance ? { expectedProvenance: JSON.stringify(provenance) } : {}) });
         }
     };
     await walk(rootReal);
@@ -89,6 +105,8 @@ async function* zipFiles(root, entries, signal) {
             let crc = 0xffffffff;
             let size = 0;
             let compressedSize = 0;
+            const hash = entry.expectedHash ? createHash('sha256') : undefined;
+            const sourceChunks = [];
             const checksum = new Transform({ transform(chunk, _encoding, done) {
                     size += chunk.length;
                     if (size > info.size) {
@@ -97,6 +115,9 @@ async function* zipFiles(root, entries, signal) {
                     }
                     for (const byte of chunk)
                         crc = CRC_TABLE[(crc ^ byte) & 0xff] ^ (crc >>> 8);
+                    hash?.update(chunk);
+                    if (entry.expectedProvenance)
+                        sourceChunks.push(chunk);
                     done(null, chunk);
                 } });
             const compressed = createDeflateRaw();
@@ -118,6 +139,10 @@ async function* zipFiles(root, entries, signal) {
             }
             if (size !== info.size)
                 throw new Error('workspace_archive_changed');
+            if (hash && hash.digest('hex') !== entry.expectedHash)
+                throw new Error('asset_provenance_model_changed');
+            if (entry.expectedProvenance && JSON.stringify(workspaceAssetProvenanceDocumentSchema.parse(JSON.parse(Buffer.concat(sourceChunks).toString('utf8')))) !== entry.expectedProvenance)
+                throw new Error('asset_provenance_changed');
             const after = await handle.stat();
             if (after.size !== info.size || after.mtimeMs !== info.mtimeMs || after.ctimeMs !== info.ctimeMs)
                 throw new Error('workspace_archive_changed');
@@ -188,7 +213,7 @@ export async function serveWorkspaceArchive(root, request, response, options = {
         else if (!controller.signal.aborted) {
             const reason = error instanceof Error ? error.message : 'workspace_archive_failed';
             response.writeHead(reason === 'workspace_archive_too_large' ? 413 : 409, { 'content-type': 'application/json', 'cache-control': 'private, no-store' });
-            response.end(JSON.stringify({ error: reason.startsWith('workspace_archive_') ? reason : 'workspace_archive_failed' }));
+            response.end(JSON.stringify({ error: PUBLIC_ARCHIVE_ERRORS.has(reason) ? reason : 'workspace_archive_failed' }));
         }
     }
     finally {

package/dist/workspace-runtime/workspaces/asset-library-import.js

@@ -6,6 +6,9 @@ import { BINARY_WORKSPACE_FILE_MAX_BYTES, WORKSPACE_LIBRARY_ATTACHMENT_MAX_BYTES
 import { observeWorkspaceBinaryFile, writeWorkspaceBinaryFile } from './binary-write.js';
 import { shareWorkspaceAssetDirectory } from './asset-publication-access.js';
 import { ensureSharedDirectory } from './shared-write.js';
+import { publishLibraryModels } from '../../asset-library/provenance.js';
+import { isEditableAudioLibraryAsset, prepareAudioLibraryImport } from './audio-assets/library-import.js';
+import { readAudioArtifactPackage } from './audio-assets/artifact-package.js';
 const RESERVED = new Set(['.git', 'node_modules', '.playcraft-temp', '.tmp']);
 const digest = (value) => createHash('sha256').update(value).digest('hex');
 const missing = (error) => error?.code === 'ENOENT';
@@ -158,6 +161,9 @@ async function readTransaction(root, transaction) {
             || !/^[a-f0-9]{64}$/.test(value.incomingHash))
             throw new AssetLibraryImportError('invalid_library_import');
         validPath(value.target);
+        if (value.audioPackagePaths && (value.audioPackagePaths.length !== 5 || new Set(value.audioPackagePaths).size !== 5
+            || value.audioPackagePaths.some(path => !/^dist\/audio\/[a-f0-9]{64}\/[a-f0-9]{64}\/[a-f0-9]{64}\/(?:sound\.(?:pcaudio|pcscore)\.json|audition\.wav|runtime\.mjs|sound\.mjs|manifest\.json)$/.test(path))))
+            throw new AssetLibraryImportError('invalid_library_import');
         if ((value.operationId !== undefined || value.assetId !== undefined || value.paths !== undefined)
             && (typeof value.operationId !== 'string' || !value.operationId || value.operationId.length > 128
                 || typeof value.assetId !== 'string' || !value.assetId || value.assetId.length > 128
@@ -203,8 +209,17 @@ export async function recoverInterruptedLibraryImports(root) {
                 throw new AssetLibraryImportError('invalid_library_import_path');
             if (current?.isDirectory() && !current.isSymbolicLink() && !incoming
                 && await directorySnapshot(target) === manifest.incomingHash) {
+                if (manifest.audioPackagePaths) {
+                    const primary = manifest.audioPackagePaths.find(path => /\/sound\.(?:pcaudio|pcscore)\.json$/.test(path));
+                    if (!primary)
+                        throw new AssetLibraryImportError('invalid_library_import');
+                    const packaged = await readAudioArtifactPackage(rootReal, primary);
+                    if (!packaged.sourcePath.startsWith(`${manifest.target}/`) || packaged.files.size !== 5
+                        || [...packaged.files.keys()].some(path => !manifest.audioPackagePaths.includes(path)))
+                        throw new AssetLibraryImportError('invalid_library_import');
+                }
                 if (manifest.operationId && manifest.assetId && manifest.paths)
-                    result.published.push({ operationId: manifest.operationId, assetId: manifest.assetId, paths: manifest.paths });
+                    result.published.push({ operationId: manifest.operationId, assetId: manifest.assetId, paths: [...manifest.paths, ...(manifest.audioPackagePaths ?? [])] });
                 await removeTransaction(rootReal, transaction);
                 result.recovered.push(manifest.target);
                 continue;
@@ -236,7 +251,7 @@ export async function recoverInterruptedLibraryImports(root) {
     }
     return result;
 }
-async function publishBundle(root, target, asset, replace, assertCurrent, operationId) {
+async function publishBundle(root, target, asset, replace, assertCurrent, operationId, audioPackagePaths) {
     const parent = dirname(target) === '.' ? '' : dirname(target);
     await createPublicDirectory(root, parent);
     const previous = await statTarget(root, target);
@@ -256,6 +271,7 @@ async function publishBundle(root, target, asset, replace, assertCurrent, operat
             await writeWorkspaceBinaryFile(staged, { path: file.path, contentBase64: file.content, expectedContentHash: null });
         }
         const manifest = { version: 1, target, phase: 'prepared', originalHash: originalHash ?? null,
+            ...(audioPackagePaths ? { audioPackagePaths } : {}),
             incomingHash: await directorySnapshot(staged), ...(operationId ? { operationId, assetId: asset.assetId,
                 paths: asset.files.map(file => `${target}/${file.path}`) } : {}) };
         await saveTransaction(root, transaction, manifest);
@@ -326,6 +342,8 @@ export async function importWorkspaceLibraryAssets(root, selection, snapshot, as
     await createPublicDirectory(rootReal, payload.targetDirectory);
     const result = { paths: [], skippedPaths: [], failures: [...transport.failures] };
     const processed = new Set(transport.failures.map(failure => failure.assetId));
+    const curated = [];
+    const plannedTargets = new Set();
     const progress = () => options.onProgress?.({ ...result, failures: [...result.failures,
             ...payload.assetIds.filter(id => !processed.has(id)).map(assetId => ({ assetId, error: 'asset_library_import_interrupted' }))] });
     await progress();
@@ -346,7 +364,7 @@ export async function importWorkspaceLibraryAssets(root, selection, snapshot, as
             let name = originalName;
             let target = validPath([payload.targetDirectory, name].filter(Boolean).join('/'));
             let existing = await statTarget(rootReal, target);
-            if (existing && payload.collision === 'skip') {
+            if ((existing || plannedTargets.has(target)) && payload.collision === 'skip') {
                 result.skippedPaths.push(target);
                 processed.add(assetId);
                 await progress();
@@ -355,7 +373,7 @@ export async function importWorkspaceLibraryAssets(root, selection, snapshot, as
             if (payload.collision === 'rename') {
                 const extension = asset.kind === 'bundle' ? '' : extname(originalName);
                 const stem = originalName.slice(0, originalName.length - extension.length);
-                for (let suffix = 1; existing; suffix++) {
+                for (let suffix = 1; existing || plannedTargets.has(target); suffix++) {
                     if (suffix > 10_000)
                         throw new AssetLibraryImportError('content_conflict');
                     name = `${stem} (${suffix})${extension}`;
@@ -363,10 +381,22 @@ export async function importWorkspaceLibraryAssets(root, selection, snapshot, as
                     existing = await statTarget(rootReal, target);
                 }
             }
+            if (asset.provenance) {
+                const observed = existing ? await observeWorkspaceBinaryFile(rootReal, target) : undefined;
+                curated.push({ assetId, path: target, bytes: Buffer.from(asset.files[0].content, 'base64'),
+                    provenance: asset.provenance, expectedContentHash: observed?.contentHash ?? null });
+                plannedTargets.add(target);
+                await progress();
+                continue;
+            }
             if (asset.kind === 'bundle') {
-                const paths = asset.files.map(file => validPath(`${target}/${file.path}`));
-                publishedTransaction = await publishBundle(rootReal, target, asset, payload.collision === 'replace', assertCurrent, options.operationId);
+                const audio = isEditableAudioLibraryAsset(asset) ? await prepareAudioLibraryImport(rootReal, target, asset, assertCurrent) : undefined;
+                const incoming = audio?.asset ?? asset;
+                const paths = incoming.files.map(file => validPath(`${target}/${file.path}`));
+                publishedTransaction = await publishBundle(rootReal, target, incoming, payload.collision === 'replace', assertCurrent, options.operationId, audio?.packagePaths);
                 result.paths.push(...paths);
+                if (audio)
+                    result.paths.push(...audio.packagePaths);
             }
             else {
                 const observed = existing ? await observeWorkspaceBinaryFile(rootReal, target) : undefined;
@@ -377,10 +407,13 @@ export async function importWorkspaceLibraryAssets(root, selection, snapshot, as
             }
         }
         catch (error) {
+            if (error instanceof Error && ['stale_lease', 'batch_workspace_readonly'].includes(error.message))
+                throw error;
             const code = error instanceof AssetLibraryImportError ? error.message
-                : error?.code === 'content_conflict' ? 'content_conflict'
-                    : ['EACCES', 'EPERM'].includes(String(error?.code)) ? 'workspace_permission_denied'
-                        : 'asset_library_import_failed';
+                : error instanceof Error && ['invalid_audio_library_package', 'audio_library_engine_unavailable', 'audio_library_source_unverified', 'audio_representation_conflict'].includes(error.message) ? error.message
+                    : error?.code === 'content_conflict' ? 'content_conflict'
+                        : ['EACCES', 'EPERM'].includes(String(error?.code)) ? 'workspace_permission_denied'
+                            : 'asset_library_import_failed';
             result.failures.push({ assetId, error: code });
         }
         processed.add(assetId);
@@ -388,5 +421,23 @@ export async function importWorkspaceLibraryAssets(root, selection, snapshot, as
         if (publishedTransaction)
             await removeTransaction(rootReal, publishedTransaction).catch(() => undefined);
     }
+    if (curated.length) {
+        try {
+            const receipt = await publishLibraryModels(rootReal, curated, { operationId: options.operationId,
+                scope: options.scope, assertCurrent });
+            result.bundleReceipt = receipt;
+            result.paths.push(...receipt.files.map(file => file.path));
+        }
+        catch (error) {
+            if (error instanceof Error && ['stale_lease', 'batch_workspace_readonly'].includes(error.message))
+                throw error;
+            const code = error.code ?? (error instanceof Error ? error.message : 'asset_library_import_failed');
+            for (const model of curated)
+                result.failures.push({ assetId: model.assetId, error: code.slice(0, 256) });
+        }
+        for (const model of curated)
+            processed.add(model.assetId);
+        await progress();
+    }
     return workspaceAssetLibraryImportResultSchema.parse(result);
 }

package/dist/workspace-runtime/workspaces/asset-provenance-verifier.js

@@ -0,0 +1,36 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { assetLibraryModelProvenanceSchema, canonicalAssetLibraryModelProvenance } from '@playcraft/common/cloud-workspace/runtime';
+import { businessEndpoint } from '../../utils/environment-endpoints.js';
+import { ensureCliCredentials } from './cli-credentials.js';
+/** Compare the portable source record with the current user's immutable server revision. */
+export async function verifyRuntimeAssetProvenance(state, provenance) {
+    await ensureCliCredentials(state);
+    const credential = JSON.parse(await readFile(join(state.config.workspaceRoot, '.playcraft.json'), 'utf8'));
+    if (typeof credential.apiUrl !== 'string' || typeof credential.token !== 'string' || !credential.token)
+        throw new Error('asset_provenance_authority_unavailable');
+    const url = businessEndpoint(credential.apiUrl, `/api/agent/tools/asset-library/${encodeURIComponent(provenance.assetId)}`);
+    url.searchParams.set('revisionId', provenance.revisionId);
+    const response = await fetch(url, { redirect: 'error', signal: AbortSignal.timeout(15_000),
+        headers: { 'X-Sandbox-Token': credential.token, 'playcraft-env': state.config.environment } });
+    if (!response.ok) {
+        await response.body?.cancel();
+        throw new Error('asset_provenance_authority_unavailable');
+    }
+    const maximum = 256 * 1024, chunks = [];
+    let length = 0;
+    if (!response.body)
+        throw new Error('asset_provenance_authority_unavailable');
+    for await (const chunk of response.body) {
+        length += chunk.byteLength;
+        if (length > maximum) {
+            await response.body.cancel().catch(() => undefined);
+            throw new Error('asset_provenance_authority_response_bound');
+        }
+        chunks.push(chunk);
+    }
+    const result = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    const authoritative = assetLibraryModelProvenanceSchema.parse(result.provenance);
+    if (canonicalAssetLibraryModelProvenance(authoritative) !== canonicalAssetLibraryModelProvenance(provenance))
+        throw new Error('asset_provenance_authority_mismatch');
+}

package/dist/workspace-runtime/workspaces/audio-assets/build-inputs.js

@@ -4,6 +4,7 @@ import { canonicalAudioJson } from '@playcraft/common/cloud-workspace/runtime';
 import { readAudioArtifactPackage } from './artifact-package.js';
 import { audioError, audioProjectPath, digest, readAudioSource } from './storage.js';
 import { ensureSharedDirectory, writeSharedFile } from '../shared-write.js';
+import { readAudioProgramBuildInputs } from './program-build-inputs.js';
 const hashPart = /^[a-f0-9]{64}$/;
 const MAX_PACKAGES = 256;
 const MAX_PACKAGE_BYTES = 64 * 1024 * 1024;
@@ -65,12 +66,15 @@ export async function readAudioBuildInputs(root, destination) {
         }
         packages.push({ primaryPath, sourcePath: bundle.sourcePath, sourceContentHash: sourceText === undefined ? null : digest(sourceText), files });
     }
-    return { version: 1, inputHash: digest(canonicalAudioJson(packages)), packages };
+    const programs = await readAudioProgramBuildInputs(root, destination);
+    // Existing projects retain their original snapshot identity when no state programs are present.
+    return { version: 1, inputHash: digest(canonicalAudioJson(programs.packages.length ? { packages, programs } : packages)), packages,
+        ...(programs.packages.length ? { programs } : {}) };
 }
 export async function verifyAudioBuildInputs(root, snapshot) {
     if ((await readAudioBuildInputs(root)).inputHash !== snapshot.inputHash)
         throw audioError('audio_build_input_changed');
 }
 export function markAudioBuildInputs(bytes, snapshot) {
-    return snapshot.packages.length ? Buffer.concat([Buffer.from(`<!--playcraft-audio-inputs:v1:${snapshot.inputHash}-->\n`), bytes]) : bytes;
+    return snapshot.packages.length || snapshot.programs?.packages.length ? Buffer.concat([Buffer.from(`<!--playcraft-audio-inputs:v1:${snapshot.inputHash}-->\n`), bytes]) : bytes;
 }

package/dist/workspace-runtime/workspaces/audio-assets/library-import.js

@@ -0,0 +1,149 @@
+import { randomUUID } from 'node:crypto';
+import { lstat, open, readdir, readFile, rename, rm } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { canonicalAudioJson, audioRepresentationSetHash, inspectAudioLibrarySnapshot, audioLibraryOriginSchema, audioLibraryPayloadHash } from '@playcraft/common/cloud-workspace/runtime';
+import { audioRendererScript } from './renderer.js';
+import { readAudioArtifactPackage } from './artifact-package.js';
+import { audioProjectPath, audioError, digest } from './storage.js';
+import { ensureSharedDirectory, writeSharedFile } from '../shared-write.js';
+export const isEditableAudioLibraryAsset = (asset) => {
+    if (asset.files.some(file => /(?:^|\/)sound\.(?:pcaudio|pcscore)\.json$/.test(file.path)))
+        return true;
+    try {
+        const file = asset.files.find(file => file.path === 'manifest.json');
+        const value = file && JSON.parse(Buffer.from(file.content, 'base64').toString('utf8'));
+        return Boolean(value && (value.sourcePath !== undefined || value.representationSetHash !== undefined));
+    }
+    catch {
+        return false;
+    }
+};
+function inspectAsset(asset, requirePlatformProof = true) {
+    if (requirePlatformProof && !asset.audioSource)
+        throw audioError('audio_library_source_unverified', 409);
+    try {
+        const manifestFile = asset.files.find(file => file.path === 'manifest.json');
+        if (!manifestFile)
+            throw new Error();
+        const manifest = JSON.parse(Buffer.from(manifestFile.content, 'base64').toString('utf8'));
+        const checked = inspectAudioLibrarySnapshot({ version: 1, target: asset.audioSource?.source.target ?? { kind: 'workspace-file', path: manifest.sourcePath },
+            revision: asset.audioSource?.source.revision ?? 1, sourcePath: manifest.sourcePath,
+            files: asset.files.map(file => ({ path: file.path, mimeType: file.mimeType, content: file.content,
+                contentHash: file.sha256, size: Buffer.from(file.content, 'base64').length })) });
+        if (asset.audioSource && audioLibraryPayloadHash(checked.source) !== audioLibraryPayloadHash(asset.audioSource.source))
+            throw new Error();
+        return checked;
+    }
+    catch {
+        throw audioError('invalid_audio_library_package', 400);
+    }
+}
+async function trustedEngine(checked) {
+    const engine = await audioRendererScript(checked.document.format === 'playcraft.score' ? 'score' : 'synth-sfx');
+    const suffix = checked.document.format === 'playcraft.score' ? '\nexport { renderSoundDocument, createStandaloneSoundPlayer };\n'
+        : '\nexport { renderAudioDocument, createStandaloneAudioPlayer };\n';
+    if (checked.source.rendererBuildHash !== engine.rendererBuildHash || Buffer.from(checked.files.get('runtime.mjs')).toString('utf8') !== engine.script + suffix)
+        throw audioError('audio_library_engine_unavailable', 409);
+}
+/** Verify against platform engine bytes before publishing any executable member. */
+export async function prepareAudioLibraryImport(root, target, asset, assertCurrent) {
+    const checked = inspectAsset(asset);
+    await trustedEngine(checked);
+    await assertCurrent();
+    const sourcePath = `${target}/${checked.source.entryPath}`;
+    await audioProjectPath(root, sourcePath);
+    const { representationSetHash: _previous, ...oldPayload } = checked.manifest;
+    const payload = { ...oldPayload, sourcePath }, representationSetHash = audioRepresentationSetHash(payload);
+    const manifest = Buffer.from(`${canonicalAudioJson({ ...payload, representationSetHash })}\n`);
+    const directory = `dist/audio/${digest(sourcePath)}/${checked.source.sourceContentHash}/${representationSetHash}`;
+    const members = new Map([...checked.files].map(([path, bytes]) => [path, Buffer.from(bytes)]));
+    members.set('manifest.json', manifest);
+    const destination = dirname(await audioProjectPath(root, `${directory}/manifest.json`));
+    await ensureSharedDirectory(root, dirname(destination));
+    const staging = `${destination}.${randomUUID()}.tmp`;
+    await ensureSharedDirectory(root, staging);
+    try {
+        for (const [path, bytes] of members)
+            await writeSharedFile(root, join(staging, path), bytes);
+        await assertCurrent();
+        const existing = await lstat(destination).catch(error => { if (error.code === 'ENOENT')
+            return undefined; throw error; });
+        if (existing) {
+            if (!existing.isDirectory() || existing.isSymbolicLink() || (await readdir(destination)).sort().join(',') !== [...members.keys()].sort().join(','))
+                throw audioError('audio_representation_conflict');
+            for (const [path, bytes] of members)
+                if (digest(await readFile(await audioProjectPath(root, `${directory}/${path}`))) !== digest(bytes))
+                    throw audioError('audio_representation_conflict');
+        }
+        else {
+            await rename(staging, destination);
+            const parent = await open(dirname(destination), 'r');
+            try {
+                await parent.sync();
+            }
+            finally {
+                await parent.close();
+            }
+        }
+    }
+    finally {
+        await rm(staging, { recursive: true, force: true });
+    }
+    const origin = { assetId: asset.assetId, contentHash: asset.contentHash, libraryPath: asset.libraryPath,
+        sourcePath: checked.source.sourcePath, sourceContentHash: checked.source.sourceContentHash, representationSetHash: checked.source.representationSetHash };
+    const metadata = Buffer.from(`${canonicalAudioJson({ version: 1, sourcePath, sourceContentHash: checked.source.sourceContentHash,
+        primaryPath: `${directory}/${checked.source.entryPath}`, representationSetHash, origin })}\n`);
+    const files = [{ path: checked.source.entryPath, bytes: members.get(checked.source.entryPath), mimeType: 'application/json' },
+        { path: 'audio-library.json', bytes: metadata, mimeType: 'application/json' }].map(({ bytes, ...file }) => ({ ...file, content: bytes.toString('base64'), sha256: digest(bytes) }));
+    const portable = { ...asset, files,
+        contentHash: digest(JSON.stringify(files.map(file => [file.path, file.sha256]).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0))) };
+    return { asset: portable, packagePaths: [...members.keys()].map(path => `${directory}/${path}`) };
+}
+/** Recover verified import ancestry; reuse its audition only while the current source still matches. */
+export async function readImportedAudioLibrarySource(root, sourcePath, contentHash) {
+    const directory = dirname(sourcePath), sidecar = await audioProjectPath(root, `${directory === '.' ? '' : directory + '/'}audio-library.json`);
+    const stat = await lstat(sidecar).catch(error => { if (error.code === 'ENOENT')
+        return undefined; throw error; });
+    if (!stat)
+        return undefined;
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.size > 65_536)
+        throw audioError('audio_library_dependency_invalid', 409);
+    const metadata = JSON.parse(await readFile(sidecar, 'utf8'));
+    if (metadata.sourcePath !== sourcePath)
+        return undefined;
+    if (metadata.version !== 1 || typeof metadata.primaryPath !== 'string')
+        throw audioError('audio_library_dependency_invalid', 409);
+    try {
+        const packaged = await readAudioArtifactPackage(root, metadata.primaryPath);
+        const files = [...packaged.files].map(([path, bytes]) => ({ path: path.slice(path.lastIndexOf('/') + 1), content: bytes.toString('base64'), sha256: digest(bytes),
+            mimeType: path.endsWith('.mjs') ? 'text/javascript' : path.endsWith('.wav') ? 'audio/wav' : 'application/json' }));
+        const asset = { assetId: 'verified-local', name: 'sound', libraryPath: '', visibility: 'team', kind: 'bundle', contentHash: ''.padStart(64, '0'), files };
+        const checked = inspectAsset(asset, false);
+        await trustedEngine(checked);
+        if (checked.source.sourcePath !== sourcePath || checked.source.sourceContentHash !== metadata.sourceContentHash || checked.source.representationSetHash !== metadata.representationSetHash)
+            throw new Error();
+        const origin = audioLibraryOriginSchema.parse(metadata.origin), { representationSetHash: _relocated, ...payload } = checked.manifest;
+        if (origin.sourceContentHash !== checked.source.sourceContentHash
+            || audioRepresentationSetHash({ ...payload, sourcePath: origin.sourcePath }) !== origin.representationSetHash)
+            throw new Error();
+        const wav = Buffer.from(checked.files.get('audition.wav')), frames = (wav.length - 44) / 2;
+        let peak = 0, sum = 0;
+        for (let frame = 0; frame < frames; frame++) {
+            const value = wav.readInt16LE(44 + frame * 2) / 32768;
+            peak = Math.max(peak, Math.abs(value));
+            sum += value * value;
+        }
+        if (peak > .9801)
+            throw new Error();
+        const current = { wav, audition: { mimeType: 'audio/wav', size: wav.length, contentHash: digest(wav), pcmContentHash: checked.manifest.pcmContentHash,
+                rendererBuildHash: checked.source.rendererBuildHash, chromiumVersion: checked.manifest.chromiumVersion, renderKey: checked.manifest.renderKey,
+                metrics: { peak, rms: Math.sqrt(sum / frames), frames, sampleRate: 44100, channels: 1, silent: peak === 0 } },
+            representation: { sourceContentHash: checked.source.sourceContentHash, rendererBuildHash: checked.source.rendererBuildHash, representationSetHash: checked.source.representationSetHash,
+                modulePath: `${dirname(metadata.primaryPath)}/sound.mjs`, manifestPath: `${dirname(metadata.primaryPath)}/manifest.json`,
+                files: [...packaged.files].map(([path, bytes]) => ({ path, size: bytes.length, contentHash: digest(bytes) })) } };
+        return { origin, current: checked.source.sourceContentHash === contentHash ? current : undefined };
+    }
+    catch (error) {
+        throw audioError(error?.message === 'audio_library_engine_unavailable' ? 'audio_library_engine_unavailable' : 'audio_library_dependency_invalid', 409);
+    }
+}

package/dist/workspace-runtime/workspaces/audio-assets/library-package.js

@@ -0,0 +1,26 @@
+import { canonicalAudioJson, audioRepresentationSetHash, audioLibraryModule, inspectAudioLibrarySnapshot } from '@playcraft/common/cloud-workspace/runtime';
+import { audioRendererScript } from './renderer.js';
+import { audioError, digest } from './storage.js';
+/** Package a verified audition and its fixed engine; saving to the library does not adopt the candidate. */
+export async function createAudioLibrarySnapshot(input) {
+    const score = input.document.format === 'playcraft.score', engine = await audioRendererScript(score ? 'score' : 'synth-sfx');
+    if (engine.rendererBuildHash !== input.audition.rendererBuildHash)
+        throw audioError('engine_build_mismatch', 503);
+    const runtime = engine.script + (score ? '\nexport { renderSoundDocument, createStandaloneSoundPlayer };\n'
+        : '\nexport { renderAudioDocument, createStandaloneAudioPlayer };\n');
+    const members = [
+        { path: score ? 'sound.pcscore.json' : 'sound.pcaudio.json', mimeType: 'application/json', role: 'editable', bytes: Buffer.from(input.sourceText) },
+        { path: 'audition.wav', mimeType: 'audio/wav', role: 'audition', bytes: Buffer.from(input.wav) },
+        { path: 'runtime.mjs', mimeType: 'text/javascript', role: 'runtime', bytes: Buffer.from(runtime) },
+        { path: 'sound.mjs', mimeType: 'text/javascript', role: 'delivery', bytes: Buffer.from(audioLibraryModule(input.document, input.contentHash, engine.rendererBuildHash)) },
+    ];
+    const files = members.map(({ bytes, ...file }) => ({ ...file, size: bytes.length, contentHash: digest(bytes) }));
+    const payload = { version: 1, sourcePath: input.sourcePath, sourceContentHash: input.contentHash, sourceRenderHash: input.sourceRenderHash,
+        engine: input.document.engine, rendererBuildHash: engine.rendererBuildHash, chromiumVersion: input.audition.chromiumVersion,
+        renderKey: input.audition.renderKey, pcmContentHash: input.audition.pcmContentHash, files };
+    const manifest = Buffer.from(`${canonicalAudioJson({ ...payload, representationSetHash: audioRepresentationSetHash(payload) })}\n`);
+    const snapshot = { version: 1, target: input.target, revision: input.revision, sourcePath: input.sourcePath,
+        files: [...members.map(({ bytes, role: _role, ...file }) => ({ ...file, size: bytes.length, contentHash: digest(bytes), content: bytes.toString('base64') })),
+            { path: 'manifest.json', mimeType: 'application/json', size: manifest.length, contentHash: digest(manifest), content: manifest.toString('base64') }] };
+    return inspectAudioLibrarySnapshot(snapshot).snapshot;
+}

package/dist/workspace-runtime/workspaces/audio-assets/program-artifact-audit.js

@@ -0,0 +1,90 @@
+import { inflateRawSync } from 'node:zlib';
+import { extname } from 'node:path';
+import { audioError } from './storage.js';
+const MAX_BYTES = 64 * 1024 * 1024, MAX_ENTRIES = 4096;
+const MARKERS = { runtime: 'playcraft.audio-program.runtime.v1', prerender: 'playcraft.audio-program.prerender.v1' };
+const invalid = () => audioError('audio_program_artifact_unverified', 422);
+function crc32(bytes) {
+    let crc = 0xffffffff;
+    for (const byte of bytes) {
+        crc ^= byte;
+        for (let i = 0; i < 8; i++)
+            crc = (crc >>> 1) ^ (0xedb88320 & -(crc & 1));
+    }
+    return (crc ^ 0xffffffff) >>> 0;
+}
+/** Inspect archive members, never compressed binary substrings or evaluated project code. */
+function zipTextEntries(bytes) {
+    let end = -1;
+    for (let i = bytes.length - 22, minimum = Math.max(0, bytes.length - 65557); i >= minimum; i--)
+        if (bytes.readUInt32LE(i) === 0x06054b50 && i + 22 + bytes.readUInt16LE(i + 20) === bytes.length) {
+            end = i;
+            break;
+        }
+    if (end < 0 || bytes.readUInt16LE(end + 4) !== 0 || bytes.readUInt16LE(end + 6) !== 0)
+        throw invalid();
+    const count = bytes.readUInt16LE(end + 10), length = bytes.readUInt32LE(end + 12), offset = bytes.readUInt32LE(end + 16);
+    if (count > MAX_ENTRIES || count !== bytes.readUInt16LE(end + 8) || offset + length !== end)
+        throw invalid();
+    const entries = [];
+    let cursor = offset, inflated = 0;
+    for (let i = 0; i < count; i++) {
+        if (cursor + 46 > end || bytes.readUInt32LE(cursor) !== 0x02014b50)
+            throw invalid();
+        const flags = bytes.readUInt16LE(cursor + 8), method = bytes.readUInt16LE(cursor + 10), checksum = bytes.readUInt32LE(cursor + 16);
+        const packed = bytes.readUInt32LE(cursor + 20), size = bytes.readUInt32LE(cursor + 24), nameLength = bytes.readUInt16LE(cursor + 28);
+        const next = cursor + 46 + nameLength + bytes.readUInt16LE(cursor + 30) + bytes.readUInt16LE(cursor + 32), local = bytes.readUInt32LE(cursor + 42);
+        if (next > end || flags & 1 || ![0, 8].includes(method) || size > MAX_BYTES || local + 30 > offset || bytes.readUInt16LE(cursor + 34))
+            throw invalid();
+        const nameBytes = bytes.subarray(cursor + 46, cursor + 46 + nameLength), name = new TextDecoder('utf-8', { fatal: true }).decode(nameBytes);
+        if (!name || name.includes('\\') || name.startsWith('/') || name.split('/').includes('..') || name.includes('\0'))
+            throw invalid();
+        if (bytes.readUInt32LE(local) !== 0x04034b50 || bytes.readUInt16LE(local + 8) !== method || bytes.readUInt16LE(local + 6) !== flags)
+            throw invalid();
+        const localNameLength = bytes.readUInt16LE(local + 26), start = local + 30 + localNameLength + bytes.readUInt16LE(local + 28);
+        if (!bytes.subarray(local + 30, local + 30 + localNameLength).equals(nameBytes) || start + packed > offset)
+            throw invalid();
+        if (/\.(?:[cm]?js|html?)$/i.test(name)) {
+            if ((inflated += size) > MAX_BYTES)
+                throw invalid();
+            const data = bytes.subarray(start, start + packed), value = method === 0 ? data : inflateRawSync(data, { maxOutputLength: Math.max(1, size) });
+            if (value.length !== size || crc32(value) !== checksum)
+                throw invalid();
+            entries.push({ name, bytes: value });
+        }
+        cursor = next;
+    }
+    if (cursor !== end || !entries.length)
+        throw invalid();
+    return entries;
+}
+export function auditAudioProgramArtifact(bytes, outputPath, variant) {
+    if (!bytes.length || bytes.length > MAX_BYTES || !['runtime', 'prerender'].includes(variant))
+        throw invalid();
+    const extension = extname(outputPath).toLowerCase(), format = extension === '.zip' ? 'zip' : extension === '.html' || extension === '.htm' ? 'html' : undefined;
+    if (!format)
+        throw invalid();
+    const entries = format === 'zip' ? zipTextEntries(bytes) : [{ name: outputPath, bytes }];
+    const result = { format, inspectedFiles: entries.length, inspectedBytes: 0, expectedMarkerCount: 0, forbiddenMarkerCount: 0, coverage: 'html-javascript-and-explicit-base64-data' };
+    const seen = new Set();
+    const inspect = (data, depth) => {
+        if ((result.inspectedBytes += data.length) > MAX_BYTES)
+            throw invalid();
+        const text = new TextDecoder('utf-8', { fatal: true }).decode(data);
+        result.expectedMarkerCount += text.split(MARKERS[variant]).length - 1;
+        result.forbiddenMarkerCount += text.split(MARKERS[variant === 'runtime' ? 'prerender' : 'runtime']).length - 1;
+        for (const match of text.matchAll(/data:(?:text\/(?:javascript|html)|application\/(?:javascript|json));base64,([A-Za-z0-9+/]+={0,2})/g)) {
+            if (depth >= 3 || match[1].length > MAX_BYTES * 4 / 3)
+                throw invalid();
+            if (seen.has(match[1]))
+                continue;
+            seen.add(match[1]);
+            inspect(Buffer.from(match[1], 'base64'), depth + 1);
+        }
+    };
+    for (const entry of entries)
+        inspect(entry.bytes, 0);
+    if (result.forbiddenMarkerCount || !result.expectedMarkerCount)
+        throw Object.assign(invalid(), { details: { variant, ...result } });
+    return result;
+}