codex-chatgpt-control 0.5.1-alpha.2 → 0.5.1-alpha.4

package/dist/src/operations/artifact-stream.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Internal source-to-file streaming boundary.
+ *
+ * A provider owns the bytes it yields.  The local output sink must therefore
+ * copy a chunk before its first asynchronous effect.  The transfer wrapper
+ * already crosses that ownership boundary before it hands a source to the
+ * output sink; the weak set lets the sink use that defensive copy directly
+ * instead of allocating a second full-sized copy.
+ *
+ * This module is intentionally not re-exported from the public operations
+ * barrel.  Its marker is an implementation detail, not a wire/API contract.
+ */
+/**
+ * Keep one hostile provider allocation well below the 512 MiB artifact cap.
+ * Built-in download adapters yield 64 KiB chunks and are unaffected.
+ */
+export declare const MAX_PROVIDER_CHUNK_BYTES: number;
+export declare function copyProviderChunk(value: unknown, maxBytes?: number): Uint8Array;
+export declare function isOwnedProviderChunk(value: unknown): value is Uint8Array;

package/dist/src/operations/artifact-stream.js

@@ -0,0 +1,35 @@
+import { isByteArrayView } from "../runtime/value-boundaries.js";
+/**
+ * Internal source-to-file streaming boundary.
+ *
+ * A provider owns the bytes it yields.  The local output sink must therefore
+ * copy a chunk before its first asynchronous effect.  The transfer wrapper
+ * already crosses that ownership boundary before it hands a source to the
+ * output sink; the weak set lets the sink use that defensive copy directly
+ * instead of allocating a second full-sized copy.
+ *
+ * This module is intentionally not re-exported from the public operations
+ * barrel.  Its marker is an implementation detail, not a wire/API contract.
+ */
+/**
+ * Keep one hostile provider allocation well below the 512 MiB artifact cap.
+ * Built-in download adapters yield 64 KiB chunks and are unaffected.
+ */
+export const MAX_PROVIDER_CHUNK_BYTES = 8 * 1024 * 1024;
+const ownedChunks = new WeakSet();
+export function copyProviderChunk(value, maxBytes = MAX_PROVIDER_CHUNK_BYTES) {
+    const allowedBytes = Number.isSafeInteger(maxBytes) && maxBytes >= 0
+        ? Math.min(maxBytes, MAX_PROVIDER_CHUNK_BYTES)
+        : -1;
+    if (!isByteArrayView(value)
+        || allowedBytes < 0
+        || value.byteLength > allowedBytes) {
+        throw new Error("provider chunk is invalid or oversized");
+    }
+    const copy = new Uint8Array(value);
+    ownedChunks.add(copy);
+    return copy;
+}
+export function isOwnedProviderChunk(value) {
+    return isByteArrayView(value) && ownedChunks.has(value);
+}

package/dist/src/operations/artifact-transfer.d.ts

@@ -0,0 +1,149 @@
+/**
+ * The transfer coordinator is deliberately provider agnostic.  A provider
+ * supplies one already-authorized, exact artifact stream; this module owns
+ * the local effect, its durable intent, and its collision/recovery rules.
+ *
+ * The absolute destination is kept in the active call only.  It is included
+ * in the keyed destination evidence supplied by the caller, but is never
+ * copied into an intent, receipt, lookup, or error.
+ */
+export declare const ARTIFACT_TRANSFER_SCHEMA_VERSION: "chatgpt.browser_control.artifact_transfer.v1";
+export declare const ARTIFACT_TRANSFER_INTENT_SCHEMA_VERSION: "chatgpt.browser_control.artifact_transfer_intent.v1";
+export declare const ARTIFACT_TRANSFER_RECEIPT_SCHEMA_VERSION: "chatgpt.browser_control.artifact_transfer_receipt.v1";
+declare const SCHEMA_VERSION: "chatgpt.browser_control.artifact_transfer.v1";
+declare const INTENT_SCHEMA_VERSION: "chatgpt.browser_control.artifact_transfer_intent.v1";
+declare const RECEIPT_SCHEMA_VERSION: "chatgpt.browser_control.artifact_transfer_receipt.v1";
+export type ArtifactTransferKind = "file" | "image" | "other";
+export type ArtifactTransferOutcome = "satisfied" | "not_satisfied" | "uncertain";
+export type ArtifactTransferStatus = "transferred" | "partial" | "blocked";
+export type ArtifactTransferPersistence = "not_attempted" | "durable" | "indeterminate";
+export type ArtifactTransferLimits = Readonly<{
+    maxBytes?: number;
+    maxStringBytes?: number;
+    maxCount?: number;
+    maxDepth?: number;
+}>;
+/**
+ * No provider labels, filenames, bytes, URLs, or paths cross this callback.
+ * The callback must return the one exact source selected by the operation's
+ * assistant-turn/artifact identity.
+ */
+export type ArtifactTransferSourceRequest = Readonly<{
+    operationId: string;
+    requestDigest: string;
+    targetBindingDigest: string;
+    assistantTurnId: string;
+    sourceIdentityDigest: string;
+    kind: ArtifactTransferKind;
+    ordinal: number;
+    transferActionId: string;
+    destinationIdentityDigest: string;
+}>;
+export type ArtifactTransferOpenSource = (request: ArtifactTransferSourceRequest) => Promise<AsyncIterable<Uint8Array>>;
+export type ArtifactTransferLookup = Readonly<{
+    operationId: string;
+    requestDigest: string;
+    targetBindingDigest: string;
+    assistantTurnId: string;
+    sourceIdentityDigest: string;
+    kind: ArtifactTransferKind;
+    ordinal: number;
+    transferActionId: string;
+    destinationIdentityDigest: string;
+}>;
+export type ArtifactTransferIntentV1 = Readonly<{
+    schemaVersion: typeof INTENT_SCHEMA_VERSION;
+    operationId: string;
+    requestDigest: string;
+    targetBindingDigest: string;
+    assistantTurnId: string;
+    sourceIdentityDigest: string;
+    kind: ArtifactTransferKind;
+    ordinal: number;
+    transferActionId: string;
+    destinationIdentityDigest: string;
+    actionKind: "local_output_commit";
+    repeatPolicy: "reconcile_local_effect";
+    intentAt: string;
+}>;
+export type ArtifactTransferReceiptV1 = Readonly<{
+    schemaVersion: typeof RECEIPT_SCHEMA_VERSION;
+    operationId: string;
+    requestDigest: string;
+    targetBindingDigest: string;
+    assistantTurnId: string;
+    sourceIdentityDigest: string;
+    kind: ArtifactTransferKind;
+    ordinal: number;
+    transferActionId: string;
+    destinationIdentityDigest: string;
+    outputKey?: string;
+    bytes?: number;
+    sha256?: string;
+    status: ArtifactTransferStatus;
+    blockerCode?: string;
+    observedAt: string;
+}>;
+export type ArtifactTransferDurableState = Readonly<{
+    intent?: ArtifactTransferIntentV1;
+    receipt?: ArtifactTransferReceiptV1;
+}>;
+/**
+ * Journal-like ports are intentionally narrower than OperationJournal.  An
+ * adapter can translate these records into action_intent/action_receipt
+ * events while retaining the journal's expected-revision/CAS semantics.
+ * Every port argument is path-free and already identity-bound.
+ */
+export type ArtifactTransferJournalPort = Readonly<{
+    readActionState: (lookup: ArtifactTransferLookup) => Promise<unknown>;
+    persistIntent: (intent: ArtifactTransferIntentV1) => Promise<void>;
+    persistReceipt: (receipt: ArtifactTransferReceiptV1) => Promise<void>;
+}>;
+export type ArtifactTransferEvidenceDigest = (domain: string, material: unknown) => string | Promise<string>;
+export type ArtifactTransferOptions = Readonly<{
+    operationId: string;
+    requestDigest: string;
+    targetBindingDigest: string;
+    assistantTurnId: string;
+    sourceIdentityDigest: string;
+    kind: ArtifactTransferKind;
+    ordinal: number;
+    transferActionId: string;
+    /** Request-only absolute destination. Never retained by durable records. */
+    outputDirectory: string;
+    evidenceDigest: ArtifactTransferEvidenceDigest;
+    openSource: ArtifactTransferOpenSource;
+    journal: ArtifactTransferJournalPort;
+    signal?: AbortSignal;
+    deadlineAt?: number;
+    /** Testable clock; its output is used only for deadline/timestamp checks. */
+    now?: () => number;
+    limits?: ArtifactTransferLimits;
+    extensionHint?: string;
+    mimeTypeHint?: string;
+}>;
+export type ArtifactTransferResult = Readonly<{
+    schemaVersion: typeof SCHEMA_VERSION;
+    outcome: ArtifactTransferOutcome;
+    replayed: boolean;
+    /** Whether the intent write is known to have reached durable journal state. */
+    intentPersistence: ArtifactTransferPersistence;
+    /** Whether the receipt write is known to have reached durable journal state. */
+    receiptPersistence: ArtifactTransferPersistence;
+    receipt?: ArtifactTransferReceiptV1;
+    blockerCode?: string;
+}>;
+export declare class ArtifactTransferError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+/**
+ * Transfer one exact operation-owned artifact.  This function is safe to
+ * invoke repeatedly with the same action identity: completed receipts are
+ * replayed without provider access, and concurrent identical calls share one
+ * source/commit attempt.
+ */
+export declare function transferOperationArtifact(options: ArtifactTransferOptions): Promise<ArtifactTransferResult>;
+/** Short additive alias for callers that prefer the noun-first operation name. */
+export declare const transferArtifact: typeof transferOperationArtifact;
+export {};