@agimon-ai/po-artifact 0.0.0-alpha.7 → 0.0.0-alpha.71

package/LICENSE

@@ -1,21 +1,149 @@
-MIT License
-
-Copyright (c) 2026 Vuong Ngo
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+License text copyright © 2017 MariaDB Corporation Ab, All Rights Reserved.
+"Business Source License" is a trademark of MariaDB Corporation Ab.
+
+Parameters
+
+Licensor:             Agimon Pty Ltd
+Licensed Work:        Po, the software in the Po source repository and the
+                      packages released from it, in each version released by
+                      the Licensor.
+                      The Licensed Work is (c) 2026 Agimon Pty Ltd.
+                      Material identified as third-party in the "Third-party
+                      components" section at the end of this file or in a
+                      NOTICE file, and any package or directory whose own
+                      license file grants a different license, is not part of
+                      the Licensed Work and remains under its own license.
+Additional Use Grant: You may make production use of the Licensed Work if
+  your use is Eligible Use. "Eligible Use" is production use that falls
+  within at least one of the following:
+
+  (a) Personal Use. Use by an individual for their own personal purposes,
+      and not on behalf of, or for the benefit of, an employer, client, or
+      other Organization. Use by an individual in the course of employment
+      or engagement by an Organization is use by that Organization.
+
+  (b) Small Organization Use. Use by or on behalf of an Organization whose
+      Annual Revenue is less than USD 1,000,000.
+
+  (c) Non-profit, Education and Research Use. Use, regardless of Annual
+      Revenue, by (i) an Organization registered or recognized as a
+      non-profit or charitable organization under the laws of its
+      jurisdiction, for its non-profit purposes; (ii) an accredited school,
+      college, or university, for teaching, learning, or academic research;
+      or (iii) a publicly funded research institution, for its research.
+
+  (d) Service Provider Use. Use by a consultant, contractor, agency, or other
+      service provider, regardless of its own Annual Revenue, solely to
+      build, deploy, host, operate, or support the Licensed Work for a client
+      whose own use would be Eligible Use under (a), (b), or (c). A service
+      provider's use for its own purposes is Eligible Use only if the service
+      provider itself qualifies under (b) or (c).
+
+
+  Hosted services. Offering the Licensed Work to third parties as a hosted
+  or managed service whose primary value is the Licensed Work is Eligible
+  Use only if each such third party's own use would be Eligible Use.
+
+  Definitions. "Organization" means any company, partnership, sole
+  proprietorship, trust, association, government body, or other entity, and
+  includes an individual acting in a business or professional capacity.
+  "Affiliate" means any entity that directly or indirectly controls, is
+  controlled by, or is under common control with an Organization, where
+  "control" means ownership of more than 50% of the voting interests of an
+  entity or the power to direct its management and policies by contract or
+  otherwise. "Annual Revenue" means the total gross revenue of an
+  Organization and all of its Affiliates combined, from all sources and
+  whether or not related to the Licensed Work, for its most recently
+  completed fiscal year, or, if it has not completed a fiscal year, for the
+  twelve months before the use (or since its formation, if shorter),
+  converted into US dollars at the average exchange rate for that period.
+  Proceeds of equity or debt financing are not revenue.
+
+  Threshold. If an Organization stops qualifying under (b), its existing
+  production use remains Eligible Use for 90 days after it stops
+  qualifying, after which it must obtain a commercial license or stop
+  production use. Use that was Eligible Use when it occurred never requires
+  a commercial license after the fact.
+Change Date:          Four years from the date a version of the Licensed Work
+                      is first publicly released by the Licensor.
+Change License:       Apache License, Version 2.0
+
+For information about alternative licensing arrangements for the Licensed
+Work, please visit: https://agimon.ai/licensing
+
+Notice
+
+The Business Source License (this document, or the "License") is not an Open
+Source license. However, the Licensed Work will eventually be made available
+under an Open Source License, as stated in this License.
+
+-----------------------------------------------------------------------------
+
+Business Source License 1.1
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited
+production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under
+the terms of the Change License, and the rights granted in the paragraph
+above terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or authorized
+resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works
+of the Licensed Work, are subject to this License. This License applies
+separately for each version of the Licensed Work and the Change Date may vary
+for each version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy
+of the Licensed Work. If you receive the Licensed Work in original or
+modified form from a third party, the terms and conditions set forth in this
+License apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other
+versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of
+Licensor or its affiliates (provided that you may use a trademark or logo of
+Licensor as expressly required by this License).
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
+AN “AS IS” BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
+EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
+TITLE.
+
+MariaDB hereby grants you permission to use this License’s text to license
+your works, and to refer to it using the trademark “Business Source License”,
+as long as you comply with the Covenants of Licensor below.
+
+Covenants of Licensor
+
+In consideration of the right to use this License’s text and the “Business
+Source License” name and trademark, Licensor covenants to MariaDB, and to all
+other recipients of the licensed work to be provided by Licensor:
+
+1. To specify as the Change License the GPL Version 2.0 or any later version,
+   or a license that is compatible with GPL Version 2.0 or a later version,
+   where “compatible” means that software provided under the Change License can
+   be included in a program with software provided under GPL Version 2.0 or a
+   later version. Licensor may specify additional Change Licenses without
+   limitation.
+
+2. To either: (a) specify an additional grant of rights to use that does not
+   impose any additional restriction on the right granted in this License, as
+   the Additional Use Grant; or (b) insert the text “None”.
+
+3. To specify a Change Date.
+
+4. Not to modify this License in any other way.

package/dist/apiContracts.cjs

@@ -14,14 +14,21 @@ const ArtifactsPayloadSchema = typebox.Type.Object({
 		size: N,
 		modifiedAt: N
 	})),
+	temporaryRoot: typebox.Type.Optional(S),
 	error: typebox.Type.Optional(S)
 });
+const scopeQuery = {
+	name: "scope",
+	in: "query",
+	required: false,
+	schema: typebox.Type.Union([typebox.Type.Literal("artifacts"), typebox.Type.Literal("temporary")])
+};
 const query = [{
 	name: "path",
 	in: "query",
 	required: true,
 	schema: typebox.Type.String({ minLength: 1 })
-}];
+}, scopeQuery];
 const apiContracts = (0, _agimon_ai_po_core_apiContracts.defineApiContract)({
 	version: 1,
 	dynamic: [],
@@ -33,7 +40,8 @@ const apiContracts = (0, _agimon_ai_po_core_apiContracts.defineApiContract)({
 			path: "/",
 			method: "GET",
 			authentication: "owner",
-			description: "List regular artifacts in the current session folder by modification time.",
+			description: "List regular artifacts or temporary files in the current session folder by modification time.",
+			parameters: [scopeQuery],
 			responses: (0, _agimon_ai_po_core_apiContracts.jsonApiResponses)(ArtifactsPayloadSchema)
 		},
 		{

package/dist/apiContracts.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"apiContracts.cjs","names":["Type","defineApiContract","jsonApiResponses"],"sources":["../src/schemas/apiContracts.ts"],"sourcesContent":["import { defineApiContract, jsonApiResponses } from '@agimon-ai/po-core/apiContracts';\nimport { Type } from 'typebox';\n\nconst S = Type.String();\nconst N = Type.Number();\nexport const ArtifactsPayloadSchema = Type.Object({\n  items: Type.Array(Type.Object({ path: S, name: S, size: N, modifiedAt: N })),\n  error: Type.Optional(S),\n});\nconst query = [{ name: 'path', in: 'query' as const, required: true, schema: Type.String({ minLength: 1 }) }];\nexport const apiContracts = defineApiContract({\n  version: 1,\n  dynamic: [],\n  http: [\n    {\n      id: 'artifacts.list',\n      scope: 'session',\n      basePath: 'artifacts',\n      path: '/',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'List regular artifacts in the current session folder by modification time.',\n      responses: jsonApiResponses(ArtifactsPayloadSchema),\n    },\n    {\n      id: 'artifacts.preview',\n      scope: 'session',\n      basePath: 'artifacts',\n      path: '/preview',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'Read bounded text preview from the current session artifact folder.',\n      parameters: query,\n      responses: jsonApiResponses(\n        Type.Object({\n          path: S,\n          content: S,\n          mimeType: S,\n          unavailable: Type.Optional(Type.Boolean()),\n          reason: Type.Optional(S),\n        }),\n      ),\n    },\n    {\n      id: 'artifacts.content',\n      scope: 'session',\n      basePath: 'artifacts',\n      path: '/content',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'Read bounded artifact bytes, with range and version checks.',\n      parameters: [\n        ...query,\n        { name: 'Range', in: 'header', required: false, schema: S },\n        { name: 'If-Match', in: 'header', required: false, schema: S },\n      ],\n      responses: {\n        '200': { description: 'Artifact bytes.', contentType: 'application/octet-stream' },\n        '206': { description: 'Artifact byte range.', contentType: 'application/octet-stream' },\n        '400': { description: 'Invalid artifact path.' },\n        '403': { description: 'Artifact access rejected.' },\n        '404': { description: 'Artifact missing.' },\n        '412': { description: 'Artifact changed.' },\n        '413': { description: 'Artifact too large.' },\n        '416': { description: 'Invalid byte range.' },\n      },\n    },\n  ],\n  sockets: (['global', 'workspace'] as const).map((scope) => ({\n    id: 'artifacts.channel',\n    scope,\n    service: 'po.hub',\n    member: 'artifacts',\n    kind: 'channel',\n    direction: 'server-to-client',\n    description: 'Current-session artifact metadata in the hub frame payload.',\n    input: ArtifactsPayloadSchema,\n  })),\n});\nexport default apiContracts;\n"],"mappings":";;;;;;;AAGA,MAAM,IAAIA,QAAAA,KAAK,OAAO;AACtB,MAAM,IAAIA,QAAAA,KAAK,OAAO;AACtB,MAAa,yBAAyBA,QAAAA,KAAK,OAAO;CAChD,OAAOA,QAAAA,KAAK,MAAMA,QAAAA,KAAK,OAAO;EAAE,MAAM;EAAG,MAAM;EAAG,MAAM;EAAG,YAAY;CAAE,CAAC,CAAC;CAC3E,OAAOA,QAAAA,KAAK,SAAS,CAAC;AACxB,CAAC;AACD,MAAM,QAAQ,CAAC;CAAE,MAAM;CAAQ,IAAI;CAAkB,UAAU;CAAM,QAAQA,QAAAA,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;AAAE,CAAC;AAC5G,MAAa,gBAAA,GAAeC,gCAAAA,kBAAAA,CAAkB;CAC5C,SAAS;CACT,SAAS,CAAC;CACV,MAAM;EACJ;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAA,GAAWC,gCAAAA,iBAAAA,CAAiB,sBAAsB;EACpD;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAY;GACZ,YAAA,GAAWA,gCAAAA,iBAAAA,CACTF,QAAAA,KAAK,OAAO;IACV,MAAM;IACN,SAAS;IACT,UAAU;IACV,aAAaA,QAAAA,KAAK,SAASA,QAAAA,KAAK,QAAQ,CAAC;IACzC,QAAQA,QAAAA,KAAK,SAAS,CAAC;GACzB,CAAC,CACH;EACF;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAY;IACV,GAAG;IACH;KAAE,MAAM;KAAS,IAAI;KAAU,UAAU;KAAO,QAAQ;IAAE;IAC1D;KAAE,MAAM;KAAY,IAAI;KAAU,UAAU;KAAO,QAAQ;IAAE;GAC/D;GACA,WAAW;IACT,OAAO;KAAE,aAAa;KAAmB,aAAa;IAA2B;IACjF,OAAO;KAAE,aAAa;KAAwB,aAAa;IAA2B;IACtF,OAAO,EAAE,aAAa,yBAAyB;IAC/C,OAAO,EAAE,aAAa,4BAA4B;IAClD,OAAO,EAAE,aAAa,oBAAoB;IAC1C,OAAO,EAAE,aAAa,oBAAoB;IAC1C,OAAO,EAAE,aAAa,sBAAsB;IAC5C,OAAO,EAAE,aAAa,sBAAsB;GAC9C;EACF;CACF;CACA,SAAU,CAAC,UAAU,WAAW,CAAC,CAAW,KAAK,WAAW;EAC1D,IAAI;EACJ;EACA,SAAS;EACT,QAAQ;EACR,MAAM;EACN,WAAW;EACX,aAAa;EACb,OAAO;CACT,EAAE;AACJ,CAAC"}
+{"version":3,"file":"apiContracts.cjs","names":["Type","defineApiContract","jsonApiResponses"],"sources":["../src/schemas/apiContracts.ts"],"sourcesContent":["import { defineApiContract, jsonApiResponses } from '@agimon-ai/po-core/apiContracts';\nimport { Type } from 'typebox';\n\nconst S = Type.String();\nconst N = Type.Number();\nexport const ArtifactsPayloadSchema = Type.Object({\n  items: Type.Array(Type.Object({ path: S, name: S, size: N, modifiedAt: N })),\n  temporaryRoot: Type.Optional(S),\n  error: Type.Optional(S),\n});\nconst scopeQuery = {\n  name: 'scope',\n  in: 'query' as const,\n  required: false,\n  schema: Type.Union([Type.Literal('artifacts'), Type.Literal('temporary')]),\n};\nconst query = [\n  { name: 'path', in: 'query' as const, required: true, schema: Type.String({ minLength: 1 }) },\n  scopeQuery,\n];\nexport const apiContracts = defineApiContract({\n  version: 1,\n  dynamic: [],\n  http: [\n    {\n      id: 'artifacts.list',\n      scope: 'session',\n      basePath: 'artifacts',\n      path: '/',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'List regular artifacts or temporary files in the current session folder by modification time.',\n      parameters: [scopeQuery],\n      responses: jsonApiResponses(ArtifactsPayloadSchema),\n    },\n    {\n      id: 'artifacts.preview',\n      scope: 'session',\n      basePath: 'artifacts',\n      path: '/preview',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'Read bounded text preview from the current session artifact folder.',\n      parameters: query,\n      responses: jsonApiResponses(\n        Type.Object({\n          path: S,\n          content: S,\n          mimeType: S,\n          unavailable: Type.Optional(Type.Boolean()),\n          reason: Type.Optional(S),\n        }),\n      ),\n    },\n    {\n      id: 'artifacts.content',\n      scope: 'session',\n      basePath: 'artifacts',\n      path: '/content',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'Read bounded artifact bytes, with range and version checks.',\n      parameters: [\n        ...query,\n        { name: 'Range', in: 'header', required: false, schema: S },\n        { name: 'If-Match', in: 'header', required: false, schema: S },\n      ],\n      responses: {\n        '200': { description: 'Artifact bytes.', contentType: 'application/octet-stream' },\n        '206': { description: 'Artifact byte range.', contentType: 'application/octet-stream' },\n        '400': { description: 'Invalid artifact path.' },\n        '403': { description: 'Artifact access rejected.' },\n        '404': { description: 'Artifact missing.' },\n        '412': { description: 'Artifact changed.' },\n        '413': { description: 'Artifact too large.' },\n        '416': { description: 'Invalid byte range.' },\n      },\n    },\n  ],\n  sockets: (['global', 'workspace'] as const).map((scope) => ({\n    id: 'artifacts.channel',\n    scope,\n    service: 'po.hub',\n    member: 'artifacts',\n    kind: 'channel',\n    direction: 'server-to-client',\n    description: 'Current-session artifact metadata in the hub frame payload.',\n    input: ArtifactsPayloadSchema,\n  })),\n});\nexport default apiContracts;\n"],"mappings":";;;;;;;AAGA,MAAM,IAAIA,QAAAA,KAAK,OAAO;AACtB,MAAM,IAAIA,QAAAA,KAAK,OAAO;AACtB,MAAa,yBAAyBA,QAAAA,KAAK,OAAO;CAChD,OAAOA,QAAAA,KAAK,MAAMA,QAAAA,KAAK,OAAO;EAAE,MAAM;EAAG,MAAM;EAAG,MAAM;EAAG,YAAY;CAAE,CAAC,CAAC;CAC3E,eAAeA,QAAAA,KAAK,SAAS,CAAC;CAC9B,OAAOA,QAAAA,KAAK,SAAS,CAAC;AACxB,CAAC;AACD,MAAM,aAAa;CACjB,MAAM;CACN,IAAI;CACJ,UAAU;CACV,QAAQA,QAAAA,KAAK,MAAM,CAACA,QAAAA,KAAK,QAAQ,WAAW,GAAGA,QAAAA,KAAK,QAAQ,WAAW,CAAC,CAAC;AAC3E;AACA,MAAM,QAAQ,CACZ;CAAE,MAAM;CAAQ,IAAI;CAAkB,UAAU;CAAM,QAAQA,QAAAA,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;AAAE,GAC5F,UACF;AACA,MAAa,gBAAA,GAAeC,gCAAAA,kBAAAA,CAAkB;CAC5C,SAAS;CACT,SAAS,CAAC;CACV,MAAM;EACJ;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAY,CAAC,UAAU;GACvB,YAAA,GAAWC,gCAAAA,iBAAAA,CAAiB,sBAAsB;EACpD;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAY;GACZ,YAAA,GAAWA,gCAAAA,iBAAAA,CACTF,QAAAA,KAAK,OAAO;IACV,MAAM;IACN,SAAS;IACT,UAAU;IACV,aAAaA,QAAAA,KAAK,SAASA,QAAAA,KAAK,QAAQ,CAAC;IACzC,QAAQA,QAAAA,KAAK,SAAS,CAAC;GACzB,CAAC,CACH;EACF;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAY;IACV,GAAG;IACH;KAAE,MAAM;KAAS,IAAI;KAAU,UAAU;KAAO,QAAQ;IAAE;IAC1D;KAAE,MAAM;KAAY,IAAI;KAAU,UAAU;KAAO,QAAQ;IAAE;GAC/D;GACA,WAAW;IACT,OAAO;KAAE,aAAa;KAAmB,aAAa;IAA2B;IACjF,OAAO;KAAE,aAAa;KAAwB,aAAa;IAA2B;IACtF,OAAO,EAAE,aAAa,yBAAyB;IAC/C,OAAO,EAAE,aAAa,4BAA4B;IAClD,OAAO,EAAE,aAAa,oBAAoB;IAC1C,OAAO,EAAE,aAAa,oBAAoB;IAC1C,OAAO,EAAE,aAAa,sBAAsB;IAC5C,OAAO,EAAE,aAAa,sBAAsB;GAC9C;EACF;CACF;CACA,SAAU,CAAC,UAAU,WAAW,CAAC,CAAW,KAAK,WAAW;EAC1D,IAAI;EACJ;EACA,SAAS;EACT,QAAQ;EACR,MAAM;EACN,WAAW;EACX,aAAa;EACb,OAAO;CACT,EAAE;AACJ,CAAC"}

package/dist/apiContracts.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"apiContracts.d.mts","names":[],"sources":["../src/schemas/apiContracts.ts"],"mappings":";;qBAUa"}
+{"version":3,"file":"apiContracts.d.mts","names":[],"sources":["../src/schemas/apiContracts.ts"],"mappings":";;qBAoBa"}

package/dist/apiContracts.mjs

@@ -10,14 +10,21 @@ const ArtifactsPayloadSchema = Type.Object({
 		size: N,
 		modifiedAt: N
 	})),
+	temporaryRoot: Type.Optional(S),
 	error: Type.Optional(S)
 });
+const scopeQuery = {
+	name: "scope",
+	in: "query",
+	required: false,
+	schema: Type.Union([Type.Literal("artifacts"), Type.Literal("temporary")])
+};
 const query = [{
 	name: "path",
 	in: "query",
 	required: true,
 	schema: Type.String({ minLength: 1 })
-}];
+}, scopeQuery];
 const apiContracts = defineApiContract({
 	version: 1,
 	dynamic: [],
@@ -29,7 +36,8 @@ const apiContracts = defineApiContract({
 			path: "/",
 			method: "GET",
 			authentication: "owner",
-			description: "List regular artifacts in the current session folder by modification time.",
+			description: "List regular artifacts or temporary files in the current session folder by modification time.",
+			parameters: [scopeQuery],
 			responses: jsonApiResponses(ArtifactsPayloadSchema)
 		},
 		{

package/dist/apiContracts.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"apiContracts.mjs","names":[],"sources":["../src/schemas/apiContracts.ts"],"sourcesContent":["import { defineApiContract, jsonApiResponses } from '@agimon-ai/po-core/apiContracts';\nimport { Type } from 'typebox';\n\nconst S = Type.String();\nconst N = Type.Number();\nexport const ArtifactsPayloadSchema = Type.Object({\n  items: Type.Array(Type.Object({ path: S, name: S, size: N, modifiedAt: N })),\n  error: Type.Optional(S),\n});\nconst query = [{ name: 'path', in: 'query' as const, required: true, schema: Type.String({ minLength: 1 }) }];\nexport const apiContracts = defineApiContract({\n  version: 1,\n  dynamic: [],\n  http: [\n    {\n      id: 'artifacts.list',\n      scope: 'session',\n      basePath: 'artifacts',\n      path: '/',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'List regular artifacts in the current session folder by modification time.',\n      responses: jsonApiResponses(ArtifactsPayloadSchema),\n    },\n    {\n      id: 'artifacts.preview',\n      scope: 'session',\n      basePath: 'artifacts',\n      path: '/preview',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'Read bounded text preview from the current session artifact folder.',\n      parameters: query,\n      responses: jsonApiResponses(\n        Type.Object({\n          path: S,\n          content: S,\n          mimeType: S,\n          unavailable: Type.Optional(Type.Boolean()),\n          reason: Type.Optional(S),\n        }),\n      ),\n    },\n    {\n      id: 'artifacts.content',\n      scope: 'session',\n      basePath: 'artifacts',\n      path: '/content',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'Read bounded artifact bytes, with range and version checks.',\n      parameters: [\n        ...query,\n        { name: 'Range', in: 'header', required: false, schema: S },\n        { name: 'If-Match', in: 'header', required: false, schema: S },\n      ],\n      responses: {\n        '200': { description: 'Artifact bytes.', contentType: 'application/octet-stream' },\n        '206': { description: 'Artifact byte range.', contentType: 'application/octet-stream' },\n        '400': { description: 'Invalid artifact path.' },\n        '403': { description: 'Artifact access rejected.' },\n        '404': { description: 'Artifact missing.' },\n        '412': { description: 'Artifact changed.' },\n        '413': { description: 'Artifact too large.' },\n        '416': { description: 'Invalid byte range.' },\n      },\n    },\n  ],\n  sockets: (['global', 'workspace'] as const).map((scope) => ({\n    id: 'artifacts.channel',\n    scope,\n    service: 'po.hub',\n    member: 'artifacts',\n    kind: 'channel',\n    direction: 'server-to-client',\n    description: 'Current-session artifact metadata in the hub frame payload.',\n    input: ArtifactsPayloadSchema,\n  })),\n});\nexport default apiContracts;\n"],"mappings":";;;AAGA,MAAM,IAAI,KAAK,OAAO;AACtB,MAAM,IAAI,KAAK,OAAO;AACtB,MAAa,yBAAyB,KAAK,OAAO;CAChD,OAAO,KAAK,MAAM,KAAK,OAAO;EAAE,MAAM;EAAG,MAAM;EAAG,MAAM;EAAG,YAAY;CAAE,CAAC,CAAC;CAC3E,OAAO,KAAK,SAAS,CAAC;AACxB,CAAC;AACD,MAAM,QAAQ,CAAC;CAAE,MAAM;CAAQ,IAAI;CAAkB,UAAU;CAAM,QAAQ,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;AAAE,CAAC;AAC5G,MAAa,eAAe,kBAAkB;CAC5C,SAAS;CACT,SAAS,CAAC;CACV,MAAM;EACJ;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,WAAW,iBAAiB,sBAAsB;EACpD;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAY;GACZ,WAAW,iBACT,KAAK,OAAO;IACV,MAAM;IACN,SAAS;IACT,UAAU;IACV,aAAa,KAAK,SAAS,KAAK,QAAQ,CAAC;IACzC,QAAQ,KAAK,SAAS,CAAC;GACzB,CAAC,CACH;EACF;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAY;IACV,GAAG;IACH;KAAE,MAAM;KAAS,IAAI;KAAU,UAAU;KAAO,QAAQ;IAAE;IAC1D;KAAE,MAAM;KAAY,IAAI;KAAU,UAAU;KAAO,QAAQ;IAAE;GAC/D;GACA,WAAW;IACT,OAAO;KAAE,aAAa;KAAmB,aAAa;IAA2B;IACjF,OAAO;KAAE,aAAa;KAAwB,aAAa;IAA2B;IACtF,OAAO,EAAE,aAAa,yBAAyB;IAC/C,OAAO,EAAE,aAAa,4BAA4B;IAClD,OAAO,EAAE,aAAa,oBAAoB;IAC1C,OAAO,EAAE,aAAa,oBAAoB;IAC1C,OAAO,EAAE,aAAa,sBAAsB;IAC5C,OAAO,EAAE,aAAa,sBAAsB;GAC9C;EACF;CACF;CACA,SAAU,CAAC,UAAU,WAAW,CAAC,CAAW,KAAK,WAAW;EAC1D,IAAI;EACJ;EACA,SAAS;EACT,QAAQ;EACR,MAAM;EACN,WAAW;EACX,aAAa;EACb,OAAO;CACT,EAAE;AACJ,CAAC"}
+{"version":3,"file":"apiContracts.mjs","names":[],"sources":["../src/schemas/apiContracts.ts"],"sourcesContent":["import { defineApiContract, jsonApiResponses } from '@agimon-ai/po-core/apiContracts';\nimport { Type } from 'typebox';\n\nconst S = Type.String();\nconst N = Type.Number();\nexport const ArtifactsPayloadSchema = Type.Object({\n  items: Type.Array(Type.Object({ path: S, name: S, size: N, modifiedAt: N })),\n  temporaryRoot: Type.Optional(S),\n  error: Type.Optional(S),\n});\nconst scopeQuery = {\n  name: 'scope',\n  in: 'query' as const,\n  required: false,\n  schema: Type.Union([Type.Literal('artifacts'), Type.Literal('temporary')]),\n};\nconst query = [\n  { name: 'path', in: 'query' as const, required: true, schema: Type.String({ minLength: 1 }) },\n  scopeQuery,\n];\nexport const apiContracts = defineApiContract({\n  version: 1,\n  dynamic: [],\n  http: [\n    {\n      id: 'artifacts.list',\n      scope: 'session',\n      basePath: 'artifacts',\n      path: '/',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'List regular artifacts or temporary files in the current session folder by modification time.',\n      parameters: [scopeQuery],\n      responses: jsonApiResponses(ArtifactsPayloadSchema),\n    },\n    {\n      id: 'artifacts.preview',\n      scope: 'session',\n      basePath: 'artifacts',\n      path: '/preview',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'Read bounded text preview from the current session artifact folder.',\n      parameters: query,\n      responses: jsonApiResponses(\n        Type.Object({\n          path: S,\n          content: S,\n          mimeType: S,\n          unavailable: Type.Optional(Type.Boolean()),\n          reason: Type.Optional(S),\n        }),\n      ),\n    },\n    {\n      id: 'artifacts.content',\n      scope: 'session',\n      basePath: 'artifacts',\n      path: '/content',\n      method: 'GET',\n      authentication: 'owner',\n      description: 'Read bounded artifact bytes, with range and version checks.',\n      parameters: [\n        ...query,\n        { name: 'Range', in: 'header', required: false, schema: S },\n        { name: 'If-Match', in: 'header', required: false, schema: S },\n      ],\n      responses: {\n        '200': { description: 'Artifact bytes.', contentType: 'application/octet-stream' },\n        '206': { description: 'Artifact byte range.', contentType: 'application/octet-stream' },\n        '400': { description: 'Invalid artifact path.' },\n        '403': { description: 'Artifact access rejected.' },\n        '404': { description: 'Artifact missing.' },\n        '412': { description: 'Artifact changed.' },\n        '413': { description: 'Artifact too large.' },\n        '416': { description: 'Invalid byte range.' },\n      },\n    },\n  ],\n  sockets: (['global', 'workspace'] as const).map((scope) => ({\n    id: 'artifacts.channel',\n    scope,\n    service: 'po.hub',\n    member: 'artifacts',\n    kind: 'channel',\n    direction: 'server-to-client',\n    description: 'Current-session artifact metadata in the hub frame payload.',\n    input: ArtifactsPayloadSchema,\n  })),\n});\nexport default apiContracts;\n"],"mappings":";;;AAGA,MAAM,IAAI,KAAK,OAAO;AACtB,MAAM,IAAI,KAAK,OAAO;AACtB,MAAa,yBAAyB,KAAK,OAAO;CAChD,OAAO,KAAK,MAAM,KAAK,OAAO;EAAE,MAAM;EAAG,MAAM;EAAG,MAAM;EAAG,YAAY;CAAE,CAAC,CAAC;CAC3E,eAAe,KAAK,SAAS,CAAC;CAC9B,OAAO,KAAK,SAAS,CAAC;AACxB,CAAC;AACD,MAAM,aAAa;CACjB,MAAM;CACN,IAAI;CACJ,UAAU;CACV,QAAQ,KAAK,MAAM,CAAC,KAAK,QAAQ,WAAW,GAAG,KAAK,QAAQ,WAAW,CAAC,CAAC;AAC3E;AACA,MAAM,QAAQ,CACZ;CAAE,MAAM;CAAQ,IAAI;CAAkB,UAAU;CAAM,QAAQ,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;AAAE,GAC5F,UACF;AACA,MAAa,eAAe,kBAAkB;CAC5C,SAAS;CACT,SAAS,CAAC;CACV,MAAM;EACJ;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAY,CAAC,UAAU;GACvB,WAAW,iBAAiB,sBAAsB;EACpD;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAY;GACZ,WAAW,iBACT,KAAK,OAAO;IACV,MAAM;IACN,SAAS;IACT,UAAU;IACV,aAAa,KAAK,SAAS,KAAK,QAAQ,CAAC;IACzC,QAAQ,KAAK,SAAS,CAAC;GACzB,CAAC,CACH;EACF;EACA;GACE,IAAI;GACJ,OAAO;GACP,UAAU;GACV,MAAM;GACN,QAAQ;GACR,gBAAgB;GAChB,aAAa;GACb,YAAY;IACV,GAAG;IACH;KAAE,MAAM;KAAS,IAAI;KAAU,UAAU;KAAO,QAAQ;IAAE;IAC1D;KAAE,MAAM;KAAY,IAAI;KAAU,UAAU;KAAO,QAAQ;IAAE;GAC/D;GACA,WAAW;IACT,OAAO;KAAE,aAAa;KAAmB,aAAa;IAA2B;IACjF,OAAO;KAAE,aAAa;KAAwB,aAAa;IAA2B;IACtF,OAAO,EAAE,aAAa,yBAAyB;IAC/C,OAAO,EAAE,aAAa,4BAA4B;IAClD,OAAO,EAAE,aAAa,oBAAoB;IAC1C,OAAO,EAAE,aAAa,oBAAoB;IAC1C,OAAO,EAAE,aAAa,sBAAsB;IAC5C,OAAO,EAAE,aAAa,sBAAsB;GAC9C;EACF;CACF;CACA,SAAU,CAAC,UAAU,WAAW,CAAC,CAAW,KAAK,WAAW;EAC1D,IAAI;EACJ;EACA,SAAS;EACT,QAAQ;EACR,MAAM;EACN,WAAW;EACX,aAAa;EACb,OAAO;CACT,EAAE;AACJ,CAAC"}

package/dist/{artifactFiles-Cr2X2lhY.cjs → artifactFiles-BeaE-Ixw.cjs}

@@ -20,43 +20,15 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
+const require_artifacts = require("./artifacts-PC2mWroh.cjs");
+let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = __toESM(node_fs_promises, 1);
 let node_path = require("node:path");
 node_path = __toESM(node_path, 1);
+let node_stream = require("node:stream");
 let _agimon_ai_po_core_piSettings = require("@agimon-ai/po-core/piSettings");
-//#region src/constants/artifacts.ts
-const ARTIFACT_DIRECTORY = "po-artifacts";
-const MAX_PREVIEW_BYTES = 1048576;
-const MAX_CONTENT_BYTES = 26214400;
-const ARTIFACT_REFRESH_MS = 2e3;
-const ARTIFACT_CONTENT_TYPES = {
-	".avif": "image/avif",
-	".bmp": "image/bmp",
-	".gif": "image/gif",
-	".jpeg": "image/jpeg",
-	".jpg": "image/jpeg",
-	".png": "image/png",
-	".svg": "image/svg+xml",
-	".webp": "image/webp",
-	".ico": "image/vnd.microsoft.icon",
-	".mp3": "audio/mpeg",
-	".wav": "audio/wav",
-	".m4a": "audio/mp4",
-	".ogg": "audio/ogg",
-	".m4v": "video/mp4",
-	".mov": "video/quicktime",
-	".mp4": "video/mp4",
-	".webm": "video/webm",
-	".pdf": "application/pdf",
-	".md": "text/markdown; charset=utf-8",
-	".markdown": "text/markdown; charset=utf-8",
-	".txt": "text/plain; charset=utf-8",
-	".html": "text/html; charset=utf-8",
-	".htm": "text/html; charset=utf-8"
-};
-//#endregion
 //#region src/services/artifactFiles/artifactPaths.ts
 var ArtifactAccessError = class extends Error {
 	status;
@@ -67,13 +39,15 @@ var ArtifactAccessError = class extends Error {
 };
 function artifactRoot(sessionId, environment) {
 	if (!/^[a-zA-Z0-9_-]+$/u.test(sessionId)) throw new ArtifactAccessError("Invalid artifact session identity.", 400);
-	return node_path.default.join((0, _agimon_ai_po_core_piSettings.piAgentDirectory)(environment, environment.HOME), ARTIFACT_DIRECTORY, sessionId);
+	return node_path.default.join((0, _agimon_ai_po_core_piSettings.piAgentDirectory)(environment, environment.HOME), require_artifacts.ARTIFACT_DIRECTORY, sessionId);
 }
 function artifactMimeType(relativePath) {
-	return ARTIFACT_CONTENT_TYPES[node_path.default.extname(relativePath).toLowerCase()] ?? "application/octet-stream";
+	return require_artifacts.ARTIFACT_CONTENT_TYPES[node_path.default.extname(relativePath).toLowerCase()] ?? "application/octet-stream";
 }
 //#endregion
 //#region src/services/artifactFiles/index.ts
+/** A copy still being written: promoters write `.<name>.tmp` and rename it into place. */
+const IN_FLIGHT_COPY = /^\..+\.tmp$/u;
 function inside(root, candidate) {
 	const relative = node_path.default.relative(root, candidate);
 	return relative !== ".." && !relative.startsWith(`..${node_path.default.sep}`) && !node_path.default.isAbsolute(relative);
@@ -121,15 +95,25 @@ async function openContained(root, segments) {
 		await directory.close();
 	}
 }
-/** One guarded open shared by metadata, text and byte reads. The caller closes the handle. */
-async function openArtifact(root, requested) {
+function artifactSegments(requested) {
 	if (!requested || requested.includes("\0") || requested.includes("\\") || node_path.default.isAbsolute(requested) || requested.split("/").some((part) => part === ".." || part === "." || part === "")) throw new ArtifactAccessError("Invalid artifact path.", 400);
+	return requested.split("/");
+}
+function accessError(error, action) {
+	if (error instanceof ArtifactAccessError) return error;
+	if (codeOf(error) === "ENOENT" || codeOf(error) === "ENOTDIR") return new ArtifactAccessError("The artifact no longer exists.", 404);
+	if (codeOf(error) === "EACCES" || codeOf(error) === "EPERM" || codeOf(error) === "ELOOP") return new ArtifactAccessError(`The artifact cannot be ${action}.`, 403);
+	return error;
+}
+/** One guarded open shared by metadata, text and byte reads. The caller closes the handle. */
+async function openArtifact(root, requested, workflowVisible) {
+	const segments = artifactSegments(requested);
+	if (segments[0] === "workflow" && !workflowVisible?.(segments.slice(1).join("/"), "file")) throw new ArtifactAccessError("This workflow file is private.", 403);
 	try {
 		const realRoot = await checkedRoot(root);
 		const candidate = node_path.default.resolve(realRoot, requested);
 		if (!inside(realRoot, candidate)) throw new ArtifactAccessError("The artifact is outside this session folder.", 403);
 		let current = realRoot;
-		const segments = requested.split("/");
 		for (let index = 0; index < segments.length; index += 1) {
 			current = node_path.default.join(current, segments[index]);
 			const stat = await node_fs_promises.default.lstat(current);
@@ -154,10 +138,7 @@ async function openArtifact(root, requested) {
 			throw error;
 		}
 	} catch (error) {
-		if (error instanceof ArtifactAccessError) throw error;
-		if (codeOf(error) === "ENOENT" || codeOf(error) === "ENOTDIR") throw new ArtifactAccessError("The artifact no longer exists.", 404);
-		if (codeOf(error) === "EACCES" || codeOf(error) === "EPERM" || codeOf(error) === "ELOOP") throw new ArtifactAccessError("The artifact cannot be read.", 403);
-		throw error;
+		throw accessError(error, "read");
 	}
 }
 /** Bound allocation and read length even when the file grows after its metadata was read. */
@@ -171,43 +152,131 @@ async function readArtifactBytes(handle, size, offset = 0) {
 	}
 	return bytes.subarray(0, read);
 }
-async function listArtifacts(root) {
+/** Walk to the parent folder without following symlinks, creating missing folders on request. */
+async function containedParent(realRoot, segments, create) {
+	let directory = realRoot;
+	for (const segment of segments.slice(0, -1)) {
+		directory = node_path.default.join(directory, segment);
+		if (create) await node_fs_promises.default.mkdir(directory, { mode: 448 }).catch((error) => {
+			if (codeOf(error) !== "EEXIST") throw error;
+		});
+		const stat = await node_fs_promises.default.lstat(directory);
+		if (stat.isSymbolicLink() || !stat.isDirectory()) throw new ArtifactAccessError("The artifact folder is not a directory.", 403);
+	}
+	return directory;
+}
+async function sameText(root, requested, bytes) {
+	try {
+		const file = await openArtifact(root, requested);
+		try {
+			if (file.stat.size !== bytes.length) return false;
+			return bytes.equals(await readArtifactBytes(file.handle, file.stat.size));
+		} finally {
+			await file.handle.close();
+		}
+	} catch (error) {
+		if (error instanceof ArtifactAccessError) return false;
+		throw error;
+	}
+}
+/**
+* Publish text through a same-folder temp file and rename, skipping identical content so mtimes stay stable.
+* ponytail: best-effort same-user guards, not race-resistant. Linux checks ancestors with lstat only;
+* walk with openat-style /proc/self/fd handles like openContained if artifacts cross a trust boundary.
+*/
+async function writeArtifactText(root, requested, text) {
+	const segments = artifactSegments(requested);
+	if (process.platform !== "darwin" && process.platform !== "linux") throw new ArtifactAccessError("Secure artifact writes require macOS or Linux.", 403);
+	const bytes = Buffer.from(text, "utf8");
+	try {
+		await ensureArtifactRoot(root);
+		const directory = await containedParent(await checkedRoot(root), segments, true);
+		if (await sameText(root, requested, bytes)) return;
+		const temp = node_path.default.join(directory, `.${segments.at(-1)}.${(0, node_crypto.randomUUID)()}.tmp`);
+		const flags = node_fs.constants.O_WRONLY | node_fs.constants.O_CREAT | node_fs.constants.O_EXCL | (process.platform === "darwin" ? 536870912 : 0);
+		const handle = await node_fs_promises.default.open(temp, flags, 384);
+		try {
+			await handle.writeFile(bytes);
+			await handle.close();
+			await node_fs_promises.default.rename(temp, node_path.default.join(directory, segments.at(-1)));
+		} catch (error) {
+			await handle.close().catch(() => void 0);
+			await node_fs_promises.default.unlink(temp).catch(() => void 0);
+			throw error;
+		}
+	} catch (error) {
+		throw accessError(error, "written");
+	}
+}
+/** Remove one file or one empty folder. A missing target is already removed; nothing is deleted recursively. */
+async function removeArtifact(root, requested) {
+	const segments = artifactSegments(requested);
+	try {
+		const target = node_path.default.join(await containedParent(await checkedRoot(root), segments, false), segments.at(-1));
+		const stat = await node_fs_promises.default.lstat(target);
+		if (stat.isFile()) await node_fs_promises.default.unlink(target);
+		else if (!stat.isDirectory()) throw new ArtifactAccessError("The artifact is not a file or folder.", 403);
+		else await node_fs_promises.default.rmdir(target).catch((error) => {
+			if (codeOf(error) !== "ENOTEMPTY" && codeOf(error) !== "EEXIST") throw error;
+		});
+	} catch (error) {
+		if (codeOf(error) === "ENOENT") return;
+		throw accessError(error, "removed");
+	}
+}
+/** Discover persisted session roots without admitting symlinked or malformed owners. */
+async function listArtifactSessions(environment) {
+	const parent = node_path.default.dirname(artifactRoot("discovery", environment));
+	try {
+		const stat = await node_fs_promises.default.lstat(parent);
+		if (!stat.isDirectory() || stat.isSymbolicLink()) throw new ArtifactAccessError("The artifact storage directory is unavailable.", 403);
+		return (await node_fs_promises.default.readdir(parent, { withFileTypes: true })).filter((entry) => entry.isDirectory() && /^[a-zA-Z0-9_-]+$/u.test(entry.name)).map((entry) => entry.name);
+	} catch (error) {
+		if (codeOf(error) === "ENOENT") return [];
+		throw error;
+	}
+}
+async function listArtifacts(root, workflowVisible, signal) {
 	const items = [];
 	try {
+		signal?.throwIfAborted();
 		const realRoot = await checkedRoot(root);
 		const visit = async (directory) => {
 			for (const entry of await node_fs_promises.default.readdir(directory, { withFileTypes: true })) {
+				signal?.throwIfAborted();
 				const location = node_path.default.join(directory, entry.name);
+				const relativePath = node_path.default.relative(realRoot, location).split(node_path.default.sep).join("/");
+				const segments = relativePath.split("/");
+				if (segments[0] === "workflow" && !workflowVisible?.(segments.slice(1).join("/"), entry.isDirectory() ? "directory" : "file")) continue;
 				if (entry.isDirectory()) {
 					const stat = await node_fs_promises.default.lstat(location);
 					if (!stat.isDirectory() || stat.isSymbolicLink()) continue;
 					const real = await node_fs_promises.default.realpath(location);
 					if (inside(realRoot, real)) await visit(real);
-				} else if (entry.isFile()) {
-					const relativePath = node_path.default.relative(realRoot, location).split(node_path.default.sep).join("/");
+				} else if (entry.isFile() && !IN_FLIGHT_COPY.test(entry.name)) try {
+					const file = await openArtifact(root, relativePath, workflowVisible);
 					try {
-						const file = await openArtifact(root, relativePath);
-						try {
-							items.push({
-								path: relativePath,
-								name: entry.name,
-								size: file.stat.size,
-								modifiedAt: file.stat.mtimeMs
-							});
-						} finally {
-							await file.handle.close();
-						}
-					} catch (error) {
-						if (error instanceof ArtifactAccessError && (error.status === 404 || error.status === 403)) continue;
-						throw error;
+						items.push({
+							path: relativePath,
+							name: entry.name,
+							size: file.stat.size,
+							modifiedAt: file.stat.mtimeMs
+						});
+					} finally {
+						await file.handle.close();
 					}
+				} catch (error) {
+					if (error instanceof ArtifactAccessError && (error.status === 404 || error.status === 403)) continue;
+					throw error;
 				}
 			}
 		};
 		await visit(realRoot);
+		signal?.throwIfAborted();
 		items.sort((left, right) => right.modifiedAt - left.modifiedAt || (left.path < right.path ? -1 : left.path > right.path ? 1 : 0));
 		return { items };
 	} catch (error) {
+		signal?.throwIfAborted();
 		if (codeOf(error) === "ENOENT") return { items: [] };
 		return {
 			items: [],
@@ -215,31 +284,35 @@ async function listArtifacts(root) {
 		};
 	}
 }
+/** Guarded, bounded download opener for trusted server-side registered artifacts. */
+async function openArtifactDownload(root, requested) {
+	const { handle, stat } = await openArtifact(root, requested);
+	return {
+		identity: [
+			stat.dev,
+			stat.ino,
+			stat.size,
+			stat.mtimeMs,
+			stat.ctimeMs
+		].join(":"),
+		size: stat.size,
+		close: () => handle.close(),
+		stream: () => stat.size === 0 ? new ReadableStream({ async start(controller) {
+			await handle.close();
+			controller.close();
+		} }) : node_stream.Readable.toWeb(handle.createReadStream({
+			start: 0,
+			end: stat.size - 1
+		}))
+	};
+}
 //#endregion
-Object.defineProperty(exports, "ARTIFACT_REFRESH_MS", {
-	enumerable: true,
-	get: function() {
-		return ARTIFACT_REFRESH_MS;
-	}
-});
 Object.defineProperty(exports, "ArtifactAccessError", {
 	enumerable: true,
 	get: function() {
 		return ArtifactAccessError;
 	}
 });
-Object.defineProperty(exports, "MAX_CONTENT_BYTES", {
-	enumerable: true,
-	get: function() {
-		return MAX_CONTENT_BYTES;
-	}
-});
-Object.defineProperty(exports, "MAX_PREVIEW_BYTES", {
-	enumerable: true,
-	get: function() {
-		return MAX_PREVIEW_BYTES;
-	}
-});
 Object.defineProperty(exports, "__toESM", {
 	enumerable: true,
 	get: function() {
@@ -258,6 +331,12 @@ Object.defineProperty(exports, "ensureArtifactRoot", {
 		return ensureArtifactRoot;
 	}
 });
+Object.defineProperty(exports, "listArtifactSessions", {
+	enumerable: true,
+	get: function() {
+		return listArtifactSessions;
+	}
+});
 Object.defineProperty(exports, "listArtifacts", {
 	enumerable: true,
 	get: function() {
@@ -270,11 +349,29 @@ Object.defineProperty(exports, "openArtifact", {
 		return openArtifact;
 	}
 });
+Object.defineProperty(exports, "openArtifactDownload", {
+	enumerable: true,
+	get: function() {
+		return openArtifactDownload;
+	}
+});
 Object.defineProperty(exports, "readArtifactBytes", {
 	enumerable: true,
 	get: function() {
 		return readArtifactBytes;
 	}
 });
+Object.defineProperty(exports, "removeArtifact", {
+	enumerable: true,
+	get: function() {
+		return removeArtifact;
+	}
+});
+Object.defineProperty(exports, "writeArtifactText", {
+	enumerable: true,
+	get: function() {
+		return writeArtifactText;
+	}
+});
 
-//# sourceMappingURL=artifactFiles-Cr2X2lhY.cjs.map
+//# sourceMappingURL=artifactFiles-BeaE-Ixw.cjs.map