@world-engines/scenario-review-snapshot 0.0.0 → 0.1.4

package/dist/artifact-digest.d.ts

@@ -1,5 +1,5 @@
 import type { JsonValue } from "./types.js";
-import { type ArtifactV5, type FrozenPublishInput, type FrozenArtifactBundle, type LegacyArtifactV5Package2Read, type PublishedArtifactHead, type PublishedArtifactHeadCore } from "./artifact.js";
+import { type ArtifactV5, type FrozenPublishInput, type FrozenArtifactBundle, type FrozenRuntimeIdentity, type LegacyArtifactV5Package2Read, type PublishedArtifactHead, type PublishedArtifactHeadCore } from "./artifact.js";
 export declare function canonicalBytes(value: JsonValue): Uint8Array;
 export declare function canonicalSha256(value: JsonValue): string;
 export declare function buildArtifactV5(input: FrozenPublishInput): ArtifactV5;
@@ -13,3 +13,4 @@ export declare function buildPublishedArtifactHead(core: PublishedArtifactHeadCo
 export declare function canonicalPublishedArtifactHeadCoreBytes(core: PublishedArtifactHeadCore): Uint8Array;
 export declare function digestPublishedArtifactHeadCore(core: PublishedArtifactHeadCore): string;
 export declare function parsePublishedArtifactHead(value: unknown): PublishedArtifactHead;
+export declare function parseFrozenRuntimeIdentity(value: unknown): FrozenRuntimeIdentity;

package/dist/artifact-digest.js

@@ -1,7 +1,8 @@
 import { canonicalJson, compareUtf8, sha256Hex, toJsonValue } from "./canonical.js";
+import { parsePublishedDeviceViewReceipt, assertDeviceViewsMatchArtifact } from "./device-view-receipt.js";
 import { parseViewInteractionManifestV3, } from "@world-engines/tmw/view-interaction-manifest-v3";
 import { parseMusicCandidateSourceV3, } from "@world-engines/tmw/music-candidate-set";
-import { ARTIFACT_COMPILER_WITNESS_OBJECTS, ARTIFACT_COMPILER_WITNESS_PATHS, ARTIFACT_COMPILER_WITNESS_RESERVED_PREFIX, ARTIFACT_MANIFEST_VERSION_V5, ARTIFACT_PACKAGE_FORMAT_VERSION_V5, CAPTURED_REVISION_SCHEMA_VERSION, FROZEN_PUBLISH_INPUT_SCHEMA_VERSION, FROZEN_ARTIFACT_OBJECT_COUNT, FROZEN_DATABASE_DELIVERY_CODEC, FROZEN_DATABASE_DELIVERY_MEDIA_TYPE, FROZEN_DATABASE_DELIVERY_MAGIC, FROZEN_DATABASE_DELIVERY_RELATIVE_PATH, LEGACY_ARTIFACT_PACKAGE_FORMAT_VERSION_V5, PUBLISHED_ARTIFACT_HEAD_SCHEMA_VERSION, } from "./artifact.js";
+import { ARTIFACT_COMPILER_WITNESS_OBJECTS, ARTIFACT_COMPILER_WITNESS_PATHS, ARTIFACT_COMPILER_WITNESS_RESERVED_PREFIX, ARTIFACT_MANIFEST_VERSION_V5, ARTIFACT_PACKAGE_FORMAT_VERSION_V5, CAPTURED_REVISION_SCHEMA_VERSION, FROZEN_PUBLISH_INPUT_SCHEMA_VERSION, FROZEN_ARTIFACT_OBJECT_COUNT, FROZEN_DATABASE_DELIVERY_CODEC, FROZEN_DATABASE_DELIVERY_MEDIA_TYPE, FROZEN_DATABASE_DELIVERY_MAGIC, FROZEN_DATABASE_DELIVERY_RELATIVE_PATH, EARLIER_LEGACY_ARTIFACT_PACKAGE_FORMAT_VERSION_V5, LEGACY_ARTIFACT_PACKAGE_FORMAT_VERSION_V5, PUBLISHED_ARTIFACT_HEAD_SCHEMA_VERSION, } from "./artifact.js";
 const encoder = new TextEncoder();
 const strictDecoder = new TextDecoder("utf-8", { fatal: true });
 const SHA256_PATTERN = /^[0-9a-f]{64}$/u;
@@ -60,11 +61,13 @@ export function buildArtifactV5(input) {
         retrieval,
         resources: { manifest: resourceManifest, entries: resourceEntries },
         runtime: { identity: normalized.runtime_identity, canonical: runtimeCanonical },
+        published_view: normalized.published_view ?? null,
+        ...(normalized.published_device_views ? { published_device_views: normalized.published_device_views } : {}),
         archive,
     });
     const core = {
         manifest_version: ARTIFACT_MANIFEST_VERSION_V5,
-        package_format_version: ARTIFACT_PACKAGE_FORMAT_VERSION_V5,
+        package_format_version: normalized.published_device_views ? 5 : ARTIFACT_PACKAGE_FORMAT_VERSION_V5,
         scenario_id: normalized.captured_revision.scenario_id,
         epoch: normalized.captured_revision.epoch,
         runtime_contract_hash: normalized.runtime_contract_hash,
@@ -83,8 +86,12 @@ export function buildArtifactV5(input) {
         retrieval,
         resources: { manifest: resourceManifest, entries: resourceEntries },
         runtime: { identity: normalized.runtime_identity, canonical: runtimeCanonical },
+        published_view: normalized.published_view ?? null,
+        ...(normalized.published_device_views ? { published_device_views: normalized.published_device_views } : {}),
         archive,
     };
+    if (core.published_device_views)
+        assertDeviceViewsMatchArtifact(core.published_device_views, core);
     return deepFreeze({ ...core, canonical_digest: digestArtifactV5Core(core) });
 }
 export function buildFrozenArtifactBundle(input) {
@@ -119,6 +126,10 @@ export function parseFrozenArtifactBundle(value) {
     return Object.freeze({ artifact, objects: Object.freeze(objects) });
 }
 function canonicalArtifactV5CoreBytes(core) {
+    if (core.package_format_version === LEGACY_ARTIFACT_PACKAGE_FORMAT_VERSION_V5) {
+        const { published_view: _publishedView, ...legacyCore } = core;
+        return canonicalBytes(toJsonValue(legacyCore));
+    }
     return canonicalBytes(toJsonValue(core));
 }
 export function canonicalArtifactV5Bytes(artifact) {
@@ -137,10 +148,12 @@ export function parseArtifactV5(value) {
     if (manifestVersion !== ARTIFACT_MANIFEST_VERSION_V5) {
         throw new Error("artifact_v5_required");
     }
-    if (root.package_format_version === LEGACY_ARTIFACT_PACKAGE_FORMAT_VERSION_V5) {
-        throw new Error("artifact_v5_legacy_package_reader_required");
+    const packageFormat = root.package_format_version;
+    if (packageFormat !== LEGACY_ARTIFACT_PACKAGE_FORMAT_VERSION_V5
+        && packageFormat !== ARTIFACT_PACKAGE_FORMAT_VERSION_V5 && packageFormat !== 5) {
+        throw new Error("artifact_v5_package_format_version_invalid");
     }
-    exactKeys(root, [
+    const commonKeys = [
         "manifest_version", "package_format_version", "scenario_id", "captured_revision",
         "frozen_input_sha256", "metadata", "protagonist", "system_prompts", "database",
         "database_delivery",
@@ -148,7 +161,10 @@ export function parseArtifactV5(value) {
         "retrieval", "resources", "runtime", "archive",
         "epoch", "runtime_contract_hash",
         "canonical_digest",
-    ], "artifact_v5");
+    ];
+    exactKeys(root, packageFormat === 5 ? [...commonKeys, "published_view", "published_device_views"] : packageFormat === ARTIFACT_PACKAGE_FORMAT_VERSION_V5
+        ? [...commonKeys, "published_view"]
+        : commonKeys, "artifact_v5");
     const capturedRevision = parseCapturedRevision(root.captured_revision);
     const resources = plainObject(root.resources, "artifact_v5_resources_object_required");
     exactKeys(resources, ["manifest", "entries"], "artifact_v5.resources");
@@ -164,7 +180,7 @@ export function parseArtifactV5(value) {
     exactKeys(runtime, ["identity", "canonical"], "artifact_v5.runtime");
     const artifact = {
         manifest_version: ARTIFACT_MANIFEST_VERSION_V5,
-        package_format_version: requireExactInteger(root.package_format_version, ARTIFACT_PACKAGE_FORMAT_VERSION_V5, "artifact_v5_package_format_version_invalid"),
+        package_format_version: packageFormat,
         scenario_id: requireIdentifier(root.scenario_id, "artifact_v5_scenario_id_invalid"),
         epoch: requirePositiveInteger(root.epoch, "artifact_v5_epoch_invalid"),
         runtime_contract_hash: requireSha256(root.runtime_contract_hash, "artifact_v5_runtime_contract_hash_invalid"),
@@ -196,6 +212,10 @@ export function parseArtifactV5(value) {
             identity: parseRuntimeIdentity(runtime.identity),
             canonical: parseJsonIdentity(runtime.canonical),
         },
+        published_view: packageFormat >= ARTIFACT_PACKAGE_FORMAT_VERSION_V5
+            ? parsePublishedViewBuildReceipt(root.published_view)
+            : null,
+        ...(packageFormat === 5 ? { published_device_views: parsePublishedDeviceViewReceipt(root.published_device_views) } : {}),
         archive: parseBinaryIdentity(root.archive),
         canonical_digest: requireSha256(root.canonical_digest, "artifact_v5_canonical_digest_invalid"),
     };
@@ -225,12 +245,18 @@ export function parseArtifactV5(value) {
         || runtimeBytes.byteLength !== artifact.runtime.canonical.size_bytes) {
         throw new Error("artifact_v5_runtime_identity_mismatch");
     }
+    if (artifact.package_format_version === ARTIFACT_PACKAGE_FORMAT_VERSION_V5
+        && artifact.published_view !== null) {
+        assertPublishedViewBuildReceiptMatchesArtifact(artifact.published_view, artifact);
+    }
+    if (artifact.published_device_views)
+        assertDeviceViewsMatchArtifact(artifact.published_device_views, artifact);
     return deepFreeze(artifact);
 }
 export function parseLegacyArtifactV5Package2(value) {
     const root = plainObject(value, "artifact_v5_legacy_object_required");
     if (root.manifest_version !== ARTIFACT_MANIFEST_VERSION_V5
-        || root.package_format_version !== LEGACY_ARTIFACT_PACKAGE_FORMAT_VERSION_V5) {
+        || root.package_format_version !== EARLIER_LEGACY_ARTIFACT_PACKAGE_FORMAT_VERSION_V5) {
         throw new Error("artifact_v5_legacy_package2_required");
     }
     exactKeys(root, [
@@ -251,7 +277,7 @@ export function parseLegacyArtifactV5Package2(value) {
     return deepFreeze({
         verification: "legacy_unverified",
         manifest_version: ARTIFACT_MANIFEST_VERSION_V5,
-        package_format_version: LEGACY_ARTIFACT_PACKAGE_FORMAT_VERSION_V5,
+        package_format_version: EARLIER_LEGACY_ARTIFACT_PACKAGE_FORMAT_VERSION_V5,
         scenario_id: scenarioId,
         canonical_digest: canonicalDigest,
         raw_manifest: rawManifest,
@@ -341,6 +367,25 @@ function normalizeFrozenPublishInput(input) {
         || databaseDeliveryBytes[0] !== FROZEN_DATABASE_DELIVERY_MAGIC) {
         throw new Error("frozen_publish_database_delivery_bytes_invalid");
     }
+    const publishedView = input.published_view == null
+        ? null
+        : parsePublishedViewBuildReceipt(input.published_view);
+    if (publishedView !== null) {
+        if (publishedView.epoch !== captured_revision.epoch
+            || publishedView.runtime_contract_hash !== runtimeContractHash
+            || publishedView.source_revision !== captured_revision.revision_number
+            || publishedView.source_digest !== captured_revision.source_sha256
+            || publishedView.source_revision_digest !== captured_revision.revision_digest
+            || publishedView.source_head_digest !== captured_revision.revision_id) {
+            throw new Error("frozen_publish_published_view_capture_mismatch");
+        }
+        if ((publishedView.mobile?.html_sha256 ?? sha256Hex(new Uint8Array())) !== sha256Hex(viewPublishMobileBytes)
+            || (publishedView.mobile?.html_size_bytes ?? 0) !== viewPublishMobileBytes.byteLength
+            || (publishedView.pc?.html_sha256 ?? sha256Hex(new Uint8Array())) !== sha256Hex(viewPublishPcBytes)
+            || (publishedView.pc?.html_size_bytes ?? 0) !== viewPublishPcBytes.byteLength) {
+            throw new Error("frozen_publish_published_view_html_identity_mismatch");
+        }
+    }
     return {
         input_schema_version: FROZEN_PUBLISH_INPUT_SCHEMA_VERSION,
         captured_revision,
@@ -364,9 +409,75 @@ function normalizeFrozenPublishInput(input) {
         retrieval: toJsonValue(input.retrieval),
         resources,
         runtime_identity: runtimeIdentity,
+        published_view: publishedView,
+        ...(input.published_device_views ? { published_device_views: parsePublishedDeviceViewReceipt(input.published_device_views) } : {}),
         archive_bytes: requireBytes(input.archive_bytes, "frozen_publish_archive_bytes_invalid"),
     };
 }
+function parsePublishedViewBuildReceipt(value) {
+    if (value === null)
+        return null;
+    const root = plainObject(value, "published_view_build_receipt_object_required");
+    exactKeys(root, [
+        "target_view_id", "target_version", "binding_revision", "copy_operation_id",
+        "copy_receipt_sha256", "target_svp_sha256", "source_head_digest", "source_revision",
+        "source_digest", "source_revision_digest", "epoch", "runtime_contract_hash", "mobile", "pc",
+    ], "published_view_build_receipt");
+    const parseHtml = (entry, target) => {
+        if (entry === null)
+            return null;
+        const html = plainObject(entry, `published_view_build_${target}_object_required`);
+        exactKeys(html, ["build_id", "encoding", "size_bytes", "sha256", "html_sha256", "html_size_bytes"], `published_view_build_${target}`);
+        const identity = parseBinaryIdentity({ encoding: html.encoding, size_bytes: html.size_bytes, sha256: html.sha256 });
+        const htmlSha = requireSha256(html.html_sha256, `published_view_build_${target}_sha_invalid`);
+        const htmlSize = requirePositiveInteger(html.html_size_bytes, `published_view_build_${target}_size_invalid`);
+        if (identity.sha256 !== htmlSha || identity.size_bytes !== htmlSize) {
+            throw new Error(`published_view_build_${target}_identity_mismatch`);
+        }
+        return Object.freeze({
+            ...identity,
+            build_id: requireIdentifier(html.build_id, `published_view_build_${target}_id_invalid`),
+            html_sha256: htmlSha,
+            html_size_bytes: htmlSize,
+        });
+    };
+    const mobile = parseHtml(root.mobile, "mobile");
+    const pc = parseHtml(root.pc, "pc");
+    if (mobile === null && pc === null)
+        throw new Error("published_view_build_device_required");
+    if (mobile !== null && pc !== null && mobile.build_id === pc.build_id)
+        throw new Error("published_view_build_id_duplicate");
+    return Object.freeze({
+        target_view_id: requireIdentifier(root.target_view_id, "published_view_target_id_invalid"),
+        target_version: requirePositiveInteger(root.target_version, "published_view_target_version_invalid"),
+        binding_revision: requirePositiveInteger(root.binding_revision, "published_view_binding_revision_invalid"),
+        copy_operation_id: requireIdentifier(root.copy_operation_id, "published_view_copy_operation_invalid"),
+        copy_receipt_sha256: requireSha256(root.copy_receipt_sha256, "published_view_copy_receipt_invalid"),
+        target_svp_sha256: requireSha256(root.target_svp_sha256, "published_view_target_svp_invalid"),
+        source_head_digest: requireSha256(root.source_head_digest, "published_view_source_head_invalid"),
+        source_revision: requirePositiveInteger(root.source_revision, "published_view_source_revision_invalid"),
+        source_digest: requireSha256(root.source_digest, "published_view_source_digest_invalid"),
+        source_revision_digest: requireSha256(root.source_revision_digest, "published_view_source_revision_digest_invalid"),
+        epoch: requirePositiveInteger(root.epoch, "published_view_epoch_invalid"),
+        runtime_contract_hash: requireSha256(root.runtime_contract_hash, "published_view_runtime_contract_invalid"),
+        mobile,
+        pc,
+    });
+}
+function assertPublishedViewBuildReceiptMatchesArtifact(receipt, artifact) {
+    if (receipt.epoch !== artifact.epoch
+        || receipt.runtime_contract_hash !== artifact.runtime_contract_hash
+        || receipt.source_head_digest !== artifact.captured_revision.revision_id
+        || receipt.source_revision !== artifact.captured_revision.revision_number
+        || receipt.source_digest !== artifact.captured_revision.source_sha256
+        || receipt.source_revision_digest !== artifact.captured_revision.revision_digest
+        || (receipt.mobile?.html_sha256 ?? sha256Hex(new Uint8Array())) !== artifact.views.publish_mobile.sha256
+        || (receipt.mobile?.html_size_bytes ?? 0) !== artifact.views.publish_mobile.size_bytes
+        || (receipt.pc?.html_sha256 ?? sha256Hex(new Uint8Array())) !== artifact.views.publish_pc.sha256
+        || (receipt.pc?.html_size_bytes ?? 0) !== artifact.views.publish_pc.size_bytes) {
+        throw new Error("artifact_v5_published_view_binding_mismatch");
+    }
+}
 function normalizeViewInteractionManifest(value, expectedEpoch, expectedRuntimeContractHash, expectedViewArtifactHash, target) {
     if (value === null)
         return null;
@@ -423,6 +534,9 @@ function parseRuntimeIdentity(value) {
         sdk_schema_version: requirePositiveInteger(object.sdk_schema_version, "frozen_runtime_sdk_schema_version_invalid"),
     });
 }
+export function parseFrozenRuntimeIdentity(value) {
+    return parseRuntimeIdentity(value);
+}
 function parseJsonIdentity(value) {
     const object = plainObject(value, "artifact_v5_json_identity_invalid");
     exactKeys(object, ["encoding", "size_bytes", "sha256"], "artifact_v5_json_identity");
@@ -521,7 +635,7 @@ function jsonIdentity(value) {
     });
 }
 function digestFrozenInputIdentity(artifact) {
-    return canonicalSha256(toJsonValue({
+    const identity = {
         input_schema_version: FROZEN_PUBLISH_INPUT_SCHEMA_VERSION,
         captured_revision: artifact.captured_revision,
         runtime_contract_hash: artifact.runtime_contract_hash,
@@ -539,7 +653,10 @@ function digestFrozenInputIdentity(artifact) {
         resources: artifact.resources,
         runtime: artifact.runtime,
         archive: artifact.archive,
-    }));
+    };
+    return canonicalSha256(toJsonValue(artifact.package_format_version >= ARTIFACT_PACKAGE_FORMAT_VERSION_V5
+        ? { ...identity, published_view: artifact.published_view, ...(artifact.published_device_views ? { published_device_views: artifact.published_device_views } : {}) }
+        : identity));
 }
 function binaryIdentity(value) {
     return Object.freeze({ encoding: "bytes", size_bytes: value.byteLength, sha256: sha256Hex(value) });

package/dist/artifact.d.ts

@@ -1,11 +1,15 @@
 import type { JsonValue } from "./types.js";
 import type { ViewInteractionManifestV3 } from "@world-engines/tmw/view-interaction-manifest-v3";
 import type { MusicCandidateSourceV3 } from "@world-engines/tmw/music-candidate-set";
+import type { PublishedDeviceViewReceipt } from "./device-view-receipt.js";
 export declare const FROZEN_PUBLISH_INPUT_SCHEMA_VERSION: 1;
 export declare const CAPTURED_REVISION_SCHEMA_VERSION: 3;
 export declare const ARTIFACT_MANIFEST_VERSION_V5: 5;
-export declare const ARTIFACT_PACKAGE_FORMAT_VERSION_V5: 3;
-export declare const LEGACY_ARTIFACT_PACKAGE_FORMAT_VERSION_V5: 2;
+export declare const ARTIFACT_PACKAGE_FORMAT_VERSION_V5: 4;
+export declare const DEVICE_VIEW_ARTIFACT_PACKAGE_FORMAT_VERSION: 5;
+/** V3 使用既有完整 ArtifactV5 合同；仅缺少 V4 的 Published View Build receipt。 */
+export declare const LEGACY_ARTIFACT_PACKAGE_FORMAT_VERSION_V5: 3;
+export declare const EARLIER_LEGACY_ARTIFACT_PACKAGE_FORMAT_VERSION_V5: 2;
 export declare const PUBLISHED_ARTIFACT_HEAD_SCHEMA_VERSION: 1;
 export declare const FROZEN_ARTIFACT_OBJECT_COUNT: 9;
 export declare const FROZEN_DATABASE_DELIVERY_CODEC: "scnb-v2";
@@ -72,6 +76,32 @@ export interface FrozenRuntimeIdentity {
     readonly protocol_version: number;
     readonly sdk_schema_version: number;
 }
+/**
+ * `bundle_only` target 的服务端 build 证明。`target_svp_sha256` 只标识私有
+ * SVP 输入，绝不能替代或推导任何 HTML identity；HTML 仅由各自 exact bytes
+ * 的 `html_sha256`/`html_size_bytes` 证明。
+ */
+export interface PublishedViewBuildReceipt {
+    readonly target_view_id: string;
+    readonly target_version: number;
+    readonly binding_revision: number;
+    readonly copy_operation_id: string;
+    readonly copy_receipt_sha256: Sha256Hex;
+    readonly target_svp_sha256: Sha256Hex;
+    readonly source_head_digest: Sha256Hex;
+    readonly source_revision: number;
+    readonly source_digest: Sha256Hex;
+    readonly source_revision_digest: Sha256Hex;
+    readonly epoch: number;
+    readonly runtime_contract_hash: Sha256Hex;
+    readonly mobile: PublishedViewBuildHtmlReceipt | null;
+    readonly pc: PublishedViewBuildHtmlReceipt | null;
+}
+export interface PublishedViewBuildHtmlReceipt extends BinaryIdentity {
+    readonly build_id: string;
+    readonly html_sha256: Sha256Hex;
+    readonly html_size_bytes: number;
+}
 /**
  * 一次性 capture 的完整输入。生产 assembler 只能消费该值，不得再次读取 live store。
  */
@@ -96,6 +126,9 @@ export interface FrozenPublishInput {
     readonly retrieval: JsonValue;
     readonly resources: readonly FrozenPublishResource[];
     readonly runtime_identity: FrozenRuntimeIdentity;
+    /** 仅 server-bound bundle-only pipeline 可提供；普通自有 View 明确为 null。 */
+    readonly published_view?: PublishedViewBuildReceipt | null;
+    readonly published_device_views?: PublishedDeviceViewReceipt;
     readonly archive_bytes: Uint8Array;
 }
 export interface CanonicalJsonIdentity {
@@ -122,7 +155,7 @@ export interface FrozenResourceIdentity extends BinaryIdentity {
 }
 export interface ArtifactV5Core {
     readonly manifest_version: typeof ARTIFACT_MANIFEST_VERSION_V5;
-    readonly package_format_version: typeof ARTIFACT_PACKAGE_FORMAT_VERSION_V5;
+    readonly package_format_version: typeof LEGACY_ARTIFACT_PACKAGE_FORMAT_VERSION_V5 | typeof ARTIFACT_PACKAGE_FORMAT_VERSION_V5 | typeof DEVICE_VIEW_ARTIFACT_PACKAGE_FORMAT_VERSION;
     readonly scenario_id: string;
     readonly epoch: number;
     readonly runtime_contract_hash: Sha256Hex;
@@ -154,6 +187,8 @@ export interface ArtifactV5Core {
         readonly identity: FrozenRuntimeIdentity;
         readonly canonical: CanonicalJsonIdentity;
     };
+    readonly published_view: PublishedViewBuildReceipt | null;
+    readonly published_device_views?: PublishedDeviceViewReceipt;
     readonly archive: BinaryIdentity;
 }
 export interface ArtifactV5 extends ArtifactV5Core {
@@ -166,7 +201,7 @@ export interface ArtifactV5 extends ArtifactV5Core {
 export interface LegacyArtifactV5Package2Read {
     readonly verification: "legacy_unverified";
     readonly manifest_version: typeof ARTIFACT_MANIFEST_VERSION_V5;
-    readonly package_format_version: typeof LEGACY_ARTIFACT_PACKAGE_FORMAT_VERSION_V5;
+    readonly package_format_version: typeof EARLIER_LEGACY_ARTIFACT_PACKAGE_FORMAT_VERSION_V5;
     readonly scenario_id: string;
     readonly canonical_digest: Sha256Hex;
     readonly raw_manifest: JsonValue;

package/dist/artifact.js

@@ -1,8 +1,11 @@
 export const FROZEN_PUBLISH_INPUT_SCHEMA_VERSION = 1;
 export const CAPTURED_REVISION_SCHEMA_VERSION = 3;
 export const ARTIFACT_MANIFEST_VERSION_V5 = 5;
-export const ARTIFACT_PACKAGE_FORMAT_VERSION_V5 = 3;
-export const LEGACY_ARTIFACT_PACKAGE_FORMAT_VERSION_V5 = 2;
+export const ARTIFACT_PACKAGE_FORMAT_VERSION_V5 = 4;
+export const DEVICE_VIEW_ARTIFACT_PACKAGE_FORMAT_VERSION = 5;
+/** V3 使用既有完整 ArtifactV5 合同；仅缺少 V4 的 Published View Build receipt。 */
+export const LEGACY_ARTIFACT_PACKAGE_FORMAT_VERSION_V5 = 3;
+export const EARLIER_LEGACY_ARTIFACT_PACKAGE_FORMAT_VERSION_V5 = 2;
 export const PUBLISHED_ARTIFACT_HEAD_SCHEMA_VERSION = 1;
 export const FROZEN_ARTIFACT_OBJECT_COUNT = 9;
 export const FROZEN_DATABASE_DELIVERY_CODEC = "scnb-v2";

package/dist/bound-view-freeze.d.ts

@@ -1,5 +1,7 @@
+import { type PreparedBoundViewSource } from "./bound-view-source-core.js";
 import { type NeutralSourceCaptureWitness, type NeutralSourceCompileInput } from "@world-engines/scenario-author-source";
-import type { FrozenArtifactBundle, FrozenRuntimeIdentity } from "./artifact.js";
+import type { FrozenArtifactBundle, FrozenRuntimeIdentity, PublishedViewBuildReceipt } from "./artifact.js";
+import type { FrozenPublishInput } from "./artifact.js";
 import { type NeutralArtifactCompilation, type NeutralArtifactEmbeddingMaterialization } from "./neutral-artifact-assembler.js";
 /**
  * Bound-copy authority 的 server readback。`bound_source` 必须是替换目标 SVP
@@ -7,29 +9,32 @@ import { type NeutralArtifactCompilation, type NeutralArtifactEmbeddingMateriali
  */
 export interface BoundCopyPublishReceipt {
     readonly copy_operation_id: string;
+    readonly target_view_id: string;
+    readonly target_version: number;
+    readonly binding_revision: number;
+    readonly copy_receipt_sha256: string;
     readonly base_source_revision_digest: string;
     readonly target_svp_sha256: string;
     readonly bound_source: NeutralSourceCaptureWitness;
 }
-/** server-only codec seam；生产实现使用 SVP decoder 与 canonical gzip-tar packer。 */
-export interface ServerBoundViewProjectCodec<TViewProject> {
-    decode_svp(bytes: Uint8Array): TViewProject;
-    pack_gzip_tar(project: TViewProject): Promise<Uint8Array>;
-}
 /** compiler 只消费本模块重建并 capture 的 source，不能接收调用方拼出的 model。 */
 export interface ServerBoundViewCompiler<TViewProject> {
     compile(source: NeutralSourceCompileInput): Promise<NeutralArtifactCompilation<TViewProject>>;
 }
 export interface BoundViewFreezeInput {
     readonly bound_copy_receipt: BoundCopyPublishReceipt;
-    /** bound-copy 前的冻结 scenario input；adapter 只替换 view_project section。 */
+    /** bound-copy 前的冻结 scenario input；仅用于证明 receipt base identity。 */
     readonly current_compile_input: NeutralSourceCompileInput;
-    /** server-only store 读出的 SVP1 bytes；任何 digest 都不能替代它。 */
-    readonly target_svp_bytes: Uint8Array;
+    /** 私有 writer 持久化前由 server-bound-view-source 生成的 exact bytes。 */
+    readonly prepared_source: PreparedBoundViewSource;
+    /** 同一 prepare response 的 SVP input digest；不允许用 gzip-tar digest 冒充。 */
+    readonly prepared_target_svp_sha256: string;
     readonly platform_html: Readonly<{
         readonly mobile: Uint8Array;
         readonly pc: Uint8Array;
     }>;
+    /** 仅服务端完成 build 的 receipt；禁止把 SVP hash 当 HTML hash 传入。 */
+    readonly published_view: PublishedViewBuildReceipt;
     readonly content_epoch: number;
     readonly embedding: NeutralArtifactEmbeddingMaterialization;
     readonly database_bytes: Uint8Array;
@@ -40,4 +45,5 @@ export interface BoundViewFreezeInput {
 export interface BoundViewFreezeAdapter {
     freeze(input: BoundViewFreezeInput): Promise<FrozenArtifactBundle>;
 }
-export declare function createBoundViewFreezeAdapter<TViewProject>(codec: ServerBoundViewProjectCodec<TViewProject>, compiler: ServerBoundViewCompiler<TViewProject>): BoundViewFreezeAdapter;
+export declare function createBoundViewFreezeAdapter<TViewProject>(compiler: ServerBoundViewCompiler<TViewProject>): BoundViewFreezeAdapter;
+export declare function assembleBoundViewFrozenPublishInput<TViewProject>(input: BoundViewFreezeInput, compiler: ServerBoundViewCompiler<TViewProject>): Promise<FrozenPublishInput>;

package/dist/bound-view-freeze.js

@@ -1,98 +1,87 @@
-import { canonicalScenarioSourceManifestDigestInputBytes, captureNeutralSourceCompileInput, createNeutralScenarioSource, encodeNeutralScenarioSource, } from "@world-engines/scenario-author-source";
-import { sha256Hex } from "./canonical.js";
+import { capturePreparedBoundViewSource, } from "./bound-view-source-core.js";
 import { buildFrozenArtifactBundle } from "./artifact-digest.js";
+import { sha256Hex } from "./canonical.js";
 import { assembleNeutralFrozenPublishInput, } from "./neutral-artifact-assembler.js";
 const SHA256 = /^[0-9a-f]{64}$/u;
-export function createBoundViewFreezeAdapter(codec, compiler) {
+export function createBoundViewFreezeAdapter(compiler) {
     return Object.freeze({
         async freeze(input) {
-            assertInputReceiptBinding(input);
-            const targetProject = codec.decode_svp(input.target_svp_bytes.slice());
-            const targetGzipTar = await codec.pack_gzip_tar(targetProject);
-            if (!(targetGzipTar instanceof Uint8Array) || targetGzipTar.byteLength === 0) {
-                throw new Error("bound_view_freeze_target_project_bytes_invalid");
-            }
-            const source = await rebuildBoundCompileInput(input, targetGzipTar);
-            const compilation = await compiler.compile(source);
-            assertTrustedCompilationMatchesBoundSource(input, source, targetGzipTar, compilation);
-            const frozen = await assembleNeutralFrozenPublishInput({
-                source,
-                content_epoch: input.content_epoch,
-                compilation,
-                embedding: input.embedding,
-                database_bytes: input.database_bytes,
-                database_delivery_bytes: input.database_delivery_bytes,
-                view_publish_mobile_bytes: input.platform_html.mobile,
-                view_publish_pc_bytes: input.platform_html.pc,
-                runtime_identity: input.runtime_identity,
-            });
-            return buildFrozenArtifactBundle(frozen);
+            return buildFrozenArtifactBundle(await assembleBoundViewFrozenPublishInput(input, compiler));
         },
     });
 }
-async function rebuildBoundCompileInput(input, targetGzipTar) {
-    let replaced = false;
-    const sections = input.current_compile_input.sections.map((section) => {
-        if (section.section_key !== "view_project")
-            return cloneSection(section);
-        replaced = true;
-        return {
-            section_key: "view_project",
-            media_type: "application/vnd.chat.view-project+gzip",
-            canonical_encoding: "gzip-tar-v1",
-            payload: targetGzipTar.slice(),
-        };
+export async function assembleBoundViewFrozenPublishInput(input, compiler) {
+    assertInputReceiptBinding(input);
+    const source = await capturePreparedBoundViewSource(input.prepared_source, input.bound_copy_receipt.bound_source);
+    const compilation = await compiler.compile(source);
+    assertTrustedCompilationMatchesBoundSource(input, source, input.prepared_source.target_view_gzip_tar_bytes, compilation);
+    return await assembleNeutralFrozenPublishInput({
+        source,
+        content_epoch: input.content_epoch,
+        compilation,
+        embedding: input.embedding,
+        database_bytes: input.database_bytes,
+        database_delivery_bytes: input.database_delivery_bytes,
+        view_publish_mobile_bytes: input.platform_html.mobile,
+        view_publish_pc_bytes: input.platform_html.pc,
+        runtime_identity: input.runtime_identity,
+        published_view: input.published_view,
     });
-    if (!replaced)
-        throw new Error("bound_view_freeze_current_view_section_missing");
-    const source = await createNeutralScenarioSource(input.current_compile_input.witness.scenario_id, sections);
-    const sourceBytes = await encodeNeutralScenarioSource(source);
-    const witness = input.bound_copy_receipt.bound_source;
-    const manifest = source.manifest;
-    if (manifest === undefined
-        || sha256Hex(sourceBytes) !== witness.source_digest
-        || sha256Hex(canonicalScenarioSourceManifestDigestInputBytes(manifest)) !== witness.manifest_digest) {
-        throw new Error("bound_view_freeze_rebuilt_source_receipt_mismatch");
-    }
-    return await captureNeutralSourceCompileInput({ witness, source_bytes: sourceBytes });
 }
 function assertInputReceiptBinding(input) {
     const receipt = input.bound_copy_receipt;
     const current = input.current_compile_input.witness;
     if (!nonEmptyText(receipt.copy_operation_id)
         || !SHA256.test(receipt.base_source_revision_digest)
+        || !nonEmptyText(receipt.target_view_id)
+        || !Number.isSafeInteger(receipt.target_version) || receipt.target_version <= 0
+        || !Number.isSafeInteger(receipt.binding_revision) || receipt.binding_revision <= 0
+        || !SHA256.test(receipt.copy_receipt_sha256)
         || !SHA256.test(receipt.target_svp_sha256)
         || !validWitness(receipt.bound_source)) {
         throw new Error("bound_view_freeze_receipt_invalid");
     }
-    if (!(input.target_svp_bytes instanceof Uint8Array)
-        || !(input.platform_html.mobile instanceof Uint8Array)
+    if (!(input.platform_html.mobile instanceof Uint8Array)
         || !(input.platform_html.pc instanceof Uint8Array)) {
         throw new Error("bound_view_freeze_actual_bytes_required");
     }
     if (receipt.base_source_revision_digest !== current.revision_digest
         || receipt.bound_source.scenario_id !== current.scenario_id
         || receipt.bound_source.owner_id !== current.owner_id
-        || sha256Hex(input.target_svp_bytes) !== receipt.target_svp_sha256) {
+        || input.prepared_source.base.source_revision_digest !== current.revision_digest
+        || input.prepared_source.base.source_sha256 !== current.source_digest
+        || input.prepared_source.base.manifest_sha256 !== current.manifest_digest
+        || input.prepared_target_svp_sha256 !== receipt.target_svp_sha256) {
         throw new Error("bound_view_freeze_receipt_current_source_mismatch");
     }
+    const published = input.published_view;
+    if (published.target_view_id !== receipt.target_view_id
+        || published.target_version !== receipt.target_version
+        || published.binding_revision !== receipt.binding_revision
+        || published.copy_operation_id !== receipt.copy_operation_id
+        || published.copy_receipt_sha256 !== receipt.copy_receipt_sha256
+        || published.target_svp_sha256 !== receipt.target_svp_sha256
+        || published.source_head_digest !== receipt.bound_source.head_digest
+        || published.source_revision !== receipt.bound_source.source_revision
+        || published.source_digest !== receipt.bound_source.source_digest
+        || published.source_revision_digest !== receipt.bound_source.revision_digest
+        || published.epoch !== input.content_epoch
+        || published.runtime_contract_hash !== input.runtime_identity.runtime_contract_hash
+        || (published.mobile?.html_sha256 ?? sha256Hex(new Uint8Array())) !== sha256Hex(input.platform_html.mobile)
+        || (published.mobile?.html_size_bytes ?? 0) !== input.platform_html.mobile.byteLength
+        || (published.pc?.html_sha256 ?? sha256Hex(new Uint8Array())) !== sha256Hex(input.platform_html.pc)
+        || (published.pc?.html_size_bytes ?? 0) !== input.platform_html.pc.byteLength) {
+        throw new Error("bound_view_freeze_published_view_proof_mismatch");
+    }
 }
 function assertTrustedCompilationMatchesBoundSource(input, source, targetGzipTar, compilation) {
     if (compilation.receipt.scenario_id !== source.witness.scenario_id
         || compilation.receipt.source_manifest_sha256 !== source.witness.manifest_digest
         || !sameBytes(compilation.model.view_source_bytes, targetGzipTar)
-        || compilation.model.trigger_document.runtime_contract_hash !== input.runtime_identity.runtime_contract_hash) {
+        || compilation.model.trigger_runtime_contract_hash !== input.runtime_identity.runtime_contract_hash) {
         throw new Error("bound_view_freeze_trusted_compilation_mismatch");
     }
 }
-function cloneSection(section) {
-    return {
-        section_key: section.section_key,
-        media_type: section.media_type,
-        canonical_encoding: section.canonical_encoding,
-        payload: section.payload.slice(),
-    };
-}
 function validWitness(witness) {
     return nonEmptyText(witness.owner_id) && nonEmptyText(witness.scenario_id)
         && Number.isSafeInteger(witness.source_revision) && witness.source_revision > 0

package/dist/bound-view-source-core.d.ts

@@ -0,0 +1,46 @@
+import { type NeutralSourceCaptureWitness, type NeutralSourceCompileInput } from "@world-engines/scenario-author-source";
+export interface V2MaterializedSourceSection {
+    readonly section_key: string;
+    readonly media_type: string;
+    readonly canonical_encoding: string;
+    /** Exact canonical ScenarioSourceSection protobuf wire, including unknown fields. */
+    readonly section_bytes: Uint8Array;
+}
+export interface V2MaterializedBoundSourceInput {
+    readonly witness: NeutralSourceCaptureWitness;
+    /** Exact decrypted ScenarioSourceManifest protobuf bytes, including unknown fields. */
+    readonly manifest_bytes: Uint8Array;
+    readonly sections: readonly V2MaterializedSourceSection[];
+}
+/**
+ * Restore V2 materializer bytes using the same manifest/section protobuf
+ * decode and canonical verification as host source capture. No digest is ever
+ * used to invent a source. Missing outer-source unknown wire fails final hash.
+ */
+export declare function restoreV2BoundViewCompileInput(input: V2MaterializedBoundSourceInput): Promise<NeutralSourceCompileInput>;
+export interface PreparedBoundViewSource {
+    readonly schema_version: 1;
+    readonly base: Readonly<{
+        readonly owner_id: string;
+        readonly scenario_id: string;
+        readonly source_revision: number;
+        readonly source_revision_digest: string;
+        readonly source_sha256: string;
+        readonly manifest_sha256: string;
+    }>;
+    readonly target_view_gzip_tar_bytes: Uint8Array;
+    readonly target_view_gzip_tar_sha256: string;
+    readonly derived_source_bytes: Uint8Array;
+    readonly derived_source_sha256: string;
+    /** Canonical manifest digest-input bytes; private writer persists these with derived source bytes. */
+    readonly derived_manifest_digest_input_bytes: Uint8Array;
+    readonly derived_manifest_sha256: string;
+}
+/**
+ * Pure preparation: validates the captured base source, replaces exactly one
+ * view_project payload, and preserves protobuf unknown fields. It does not
+ * create a witness or write any object.
+ */
+export declare function prepareBoundViewSource(current: NeutralSourceCompileInput, targetViewGzipTarBytes: Uint8Array): Promise<PreparedBoundViewSource>;
+/** After private persistence, bind the authority-issued witness to prepared bytes. */
+export declare function capturePreparedBoundViewSource(prepared: PreparedBoundViewSource, witness: NeutralSourceCaptureWitness): Promise<NeutralSourceCompileInput>;