@opengeni/api-router 0.22.2 → 0.26.1

package/dist/index.js

@@ -1,7 +1,10 @@
 import {
+  SlackBotProviderError,
   createAppComposition,
-  startSlackInteractionPump
-} from "./chunk-HWXJW5C7.js";
+  createOpenGeniSlackBotInteractionClient,
+  startSlackInteractionPump,
+  startTemporalScheduleCleanupPump
+} from "./chunk-JIKNR5YL.js";
 
 // src/index.ts
 import {
@@ -21,6 +24,8 @@ import {
 } from "@opengeni/db";
 import { createNatsEventBus } from "@opengeni/events";
 import { createObservability, logStartupDependencyRetry } from "@opengeni/observability";
+import { createObjectStorage } from "@opengeni/storage";
+import { isArtifactRuntimeConfigured } from "@opengeni/artifact-tool/runtime/development";
 import { SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID } from "@opengeni/core";
 import {
   Connection,
@@ -41,11 +46,11 @@ function eventAttributes(attributes) {
   if (!attributes) {
     return void 0;
   }
-  const sanitized = {};
+  const projected = {};
   for (const [key, value] of Object.entries(attributes)) {
-    sanitized[key] = eventAttributeValue(value);
+    projected[key] = eventAttributeValue(value);
   }
-  return sanitized;
+  return projected;
 }
 function eventAttributeValue(value) {
   if (value === null || value === void 0 || typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
@@ -72,6 +77,7 @@ import {
   workspaceAgentPermissions
 } from "@opengeni/events";
 var AUTH_CALLOUT_SUBJECT = "$SYS.REQ.USER.AUTH";
+var NATS_USER_JWT_TTL_SECONDS = 5 * 60;
 async function handleAuthorizationRequest(deps, requestBytes) {
   const requestJwt = Buffer.from(requestBytes).toString("utf8");
   const decoded = decodeAuthRequest(requestJwt);
@@ -109,10 +115,14 @@ async function handleAuthorizationRequest(deps, requestBytes) {
     });
     return deny("enrollment is not active");
   }
-  if (enrollment.id !== claims.enrollmentId) {
+  if (enrollment.workspaceId !== claims.workspaceId || enrollment.id !== claims.enrollmentId || enrollment.id !== claims.agentId || claims.agentId !== claims.enrollmentId || claims.subjectPrefix !== `agent.${claims.workspaceId}.${claims.agentId}`) {
     return deny("enrollment identity mismatch");
   }
+  if (enrollment.credentialGeneration !== claims.credentialGeneration) {
+    return deny("enrollment credential generation mismatch");
+  }
   const permissions = workspaceAgentPermissions(claims.workspaceId);
+  const nowSeconds = Math.floor(Date.now() / 1e3);
   const userJwt = mintUserJwt({
     userPublicKey: decoded.userNkey,
     accountSeed: deps.callout.accountSeed,
@@ -125,7 +135,7 @@ async function handleAuthorizationRequest(deps, requestBytes) {
     audienceAccount: deps.callout.accountName,
     // Tie the credential's life to the bearer's remaining life: a revoked/expired
     // enrollment cannot outlive its bearer at the NATS layer either.
-    expiresAtSeconds: claims.exp
+    expiresAtSeconds: Math.min(claims.exp, nowSeconds + NATS_USER_JWT_TTL_SECONDS)
   });
   const response = mintAuthResponse({
     userPublicKey: decoded.userNkey,
@@ -159,19 +169,26 @@ async function startAuthCalloutResponder(deps, natsUrl) {
 // src/sandbox/metrics-ingestion.ts
 import {
   clearEnrollmentWentOffline,
+  disconnectAttachedBrowserDevices,
   getEnrollment as getEnrollment2,
   ingestMachineMetricsSample,
+  reconcileAttachedBrowserInventory,
   sessionsWithActiveOpOnEnrollment,
   setEnrollmentDisplayState,
   setEnrollmentOpStreamState,
   setEnrollmentWentOffline,
   touchEnrollmentLastSeen
 } from "@opengeni/db";
+import {
+  AttachedBrowserInventorySnapshot as AttachedBrowserInventoryContract
+} from "@opengeni/contracts";
 import { appendAndPublishEvents } from "@opengeni/events";
 import {
   AgentEvent,
+  Arch,
   GoingOfflineReason,
   Hello,
+  Os,
   goingOfflineReasonToJSON
 } from "@opengeni/agent-proto";
 var AGENT_EVENTS_SUBJECT = "agent.*.*.events";
@@ -210,6 +227,73 @@ function wireSampleToDbSample(wire) {
     sampledAt: wire.sampledAtMs && Number(wire.sampledAtMs) > 0 ? new Date(Number(wire.sampledAtMs)) : /* @__PURE__ */ new Date()
   };
 }
+function wireAttachedBrowserInventoryToContract(wire) {
+  return AttachedBrowserInventoryContract.parse({
+    bridgeGeneration: wire.bridgeGeneration,
+    revision: safeWireInteger(wire.revision, "browser inventory revision"),
+    devices: wire.devices.map((device) => ({
+      id: device.id,
+      name: device.name,
+      profileLabel: device.profileLabel.trim() || null,
+      browserName: device.browserName,
+      browserVersion: device.browserVersion,
+      extensionVersion: device.extensionVersion,
+      platform: wireBrowserPlatform(device.platform),
+      architecture: wireBrowserArchitecture(device.arch),
+      connectionGeneration: device.connectionGeneration,
+      inventoryRevision: safeWireInteger(
+        device.inventoryRevision,
+        "attached browser inventory revision"
+      ),
+      tabCount: safeWireInteger(device.tabCount, "attached browser tab count"),
+      capabilities: device.capabilities
+    }))
+  });
+}
+function safeWireInteger(value, label) {
+  let parsed;
+  try {
+    parsed = BigInt(value);
+  } catch {
+    throw new Error(`${label} is not an integer`);
+  }
+  if (parsed < 0n || parsed > BigInt(Number.MAX_SAFE_INTEGER)) {
+    throw new Error(`${label} is outside the safe integer range`);
+  }
+  return Number(parsed);
+}
+function wireBrowserPlatform(platform) {
+  switch (platform) {
+    case Os.OS_LINUX:
+      return "linux";
+    case Os.OS_MACOS:
+      return "macos";
+    case Os.OS_WINDOWS:
+      return "windows";
+    default:
+      throw new Error("attached browser platform is unspecified or unsupported");
+  }
+}
+function wireBrowserArchitecture(architecture) {
+  switch (architecture) {
+    case Arch.ARCH_X86_64:
+      return "x64";
+    case Arch.ARCH_AARCH64:
+      return "arm64";
+    default:
+      throw new Error("attached browser architecture is unspecified or unsupported");
+  }
+}
+async function ingestAttachedBrowserInventory(db, input) {
+  const enrollment = await getEnrollment2(db, input.workspaceId, input.agentId);
+  if (!enrollment) return;
+  await reconcileAttachedBrowserInventory(db, {
+    accountId: enrollment.accountId,
+    workspaceId: input.workspaceId,
+    enrollmentId: input.agentId,
+    snapshot: wireAttachedBrowserInventoryToContract(input.inventory)
+  });
+}
 async function ingestHeartbeat(db, input) {
   const enrollment = await getEnrollment2(db, input.workspaceId, input.agentId);
   if (!enrollment) {
@@ -280,6 +364,18 @@ async function handleAgentEventPayload(db, observability, payload, subject, bus)
           enrollmentId: ids.agentId,
           reason
         });
+        try {
+          await disconnectAttachedBrowserDevices(db, {
+            accountId: enrollment.accountId,
+            workspaceId: ids.workspaceId,
+            enrollmentId: ids.agentId
+          });
+        } catch (error) {
+          observability?.warn?.("Failed to disconnect attached browsers with their machine", {
+            subject,
+            error: error instanceof Error ? error.message : String(error)
+          });
+        }
         if (bus) {
           const isSelfUpdate = event.event.goingOffline.reason === GoingOfflineReason.GOING_OFFLINE_REASON_UPDATE;
           await fanOutMachineLinkEvents(
@@ -315,10 +411,23 @@ async function handleAgentEventPayload(db, observability, payload, subject, bus)
   if (event.event?.$case !== "heartbeat") {
     return;
   }
-  const metrics = event.event.heartbeat.metrics;
-  if (!metrics) {
-    return;
+  const heartbeat = event.event.heartbeat;
+  if (heartbeat.attachedBrowserInventory) {
+    try {
+      await ingestAttachedBrowserInventory(db, {
+        workspaceId: ids.workspaceId,
+        agentId: ids.agentId,
+        inventory: heartbeat.attachedBrowserInventory
+      });
+    } catch (error) {
+      observability?.warn?.("Failed to ingest an attached-browser inventory", {
+        subject,
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
   }
+  const metrics = heartbeat.metrics;
+  if (!metrics) return;
   try {
     await ingestHeartbeat(db, {
       workspaceId: ids.workspaceId,
@@ -453,6 +562,1592 @@ function startHelloIngestion(deps) {
   );
 }
 
+// src/memory-slack-delivery.ts
+import {
+  claimMemorySlackPublication,
+  completeMemorySlackPublication,
+  currentMemorySlackConfigurationMatches,
+  deferMemorySlackPublication,
+  failMemorySlackPublication
+} from "@opengeni/db";
+import { sanitizeSlackPublicationText } from "@opengeni/core";
+var DELIVERY_LEASE_MS = 3e4;
+var MAX_DELIVERY_ATTEMPTS = 8;
+var MAX_DELIVERY_RETRY_MS = 5 * 6e4;
+var MAX_SLACK_MESSAGE_CHARS = 3500;
+async function drainMemorySlackPublicationsOnce(deps) {
+  const claimHolderId = crypto.randomUUID();
+  const publication = await claimMemorySlackPublication(deps.db, claimHolderId, DELIVERY_LEASE_MS);
+  if (!publication) return false;
+  try {
+    if (!await currentMemorySlackConfigurationMatches(deps.db, publication)) {
+      await failMemorySlackPublication(deps.db, {
+        publication,
+        claimHolderId,
+        errorCode: "configuration_changed",
+        cancelled: true
+      });
+      return true;
+    }
+    const client = await createOpenGeniSlackBotInteractionClient(deps, {
+      accountId: publication.accountId,
+      workspaceId: publication.workspaceId,
+      connectionId: publication.connectionId,
+      subjectId: publication.initiatorSubjectId,
+      sessionId: publication.sessionId
+    });
+    const result = await client.postMessage({
+      operationId: publication.operationId,
+      channelId: publication.slackChannelId,
+      text: formatMemorySlackPublicationMessage(deps, publication),
+      requireActiveNonSharedChannel: true
+    });
+    const completed = await completeMemorySlackPublication(deps.db, {
+      publication,
+      claimHolderId,
+      slackChannelId: result.channelId,
+      slackMessageTimestamp: result.timestamp
+    });
+    if (!completed) throw new Error("Memory Slack publication lost its durable claim");
+  } catch (error) {
+    const errorCode = deliveryErrorCode(error);
+    if (memorySlackDestinationDrift(error)) {
+      await failMemorySlackPublication(deps.db, {
+        publication,
+        claimHolderId,
+        errorCode,
+        cancelled: true
+      }).catch(() => void 0);
+    } else if (publication.attemptCount >= MAX_DELIVERY_ATTEMPTS || permanentDeliveryError(error)) {
+      await failMemorySlackPublication(deps.db, {
+        publication,
+        claimHolderId,
+        errorCode
+      }).catch(() => void 0);
+    } else {
+      await deferMemorySlackPublication(deps.db, {
+        publication,
+        claimHolderId,
+        errorCode,
+        retryAt: new Date(Date.now() + deliveryRetryMs(error, publication.attemptCount))
+      }).catch(() => void 0);
+    }
+  }
+  return true;
+}
+function startMemorySlackPublicationPump(deps, options = {}) {
+  let stopped = false;
+  let running;
+  const intervalMs = Math.max(250, options.intervalMs ?? 1e3);
+  const maxPerTick = Math.max(1, Math.min(50, options.maxPerTick ?? 10));
+  const tick = () => {
+    if (stopped || running) return;
+    running = (async () => {
+      for (let index = 0; index < maxPerTick; index += 1) {
+        if (!await drainMemorySlackPublicationsOnce(deps)) break;
+      }
+    })().catch((error) => {
+      deps.observability?.error("Memory Slack publication claim failed", {
+        errorClass: error instanceof Error ? error.name : "MemorySlackPublicationPumpError",
+        errorCode: deliveryErrorCode(error),
+        origin: "api"
+      });
+    }).finally(() => {
+      running = void 0;
+    });
+  };
+  const timer = setInterval(tick, intervalMs);
+  queueMicrotask(tick);
+  return async () => {
+    stopped = true;
+    clearInterval(timer);
+    await running;
+  };
+}
+function formatMemorySlackPublicationMessage(deps, publication) {
+  const projection = publication.projection;
+  const summary = boundedProjectionString(projection["summary"], 512) || "Important change";
+  const owner = boundedProjectionString(projection["ownerLabel"], 96);
+  const occurredAt = boundedProjectionString(projection["occurredAt"], 64);
+  const changeKind = boundedProjectionString(projection["changeKind"], 32);
+  const destination = boundedProjectionString(projection["destination"], 64);
+  const outcome = boundedProjectionString(projection["outcome"], 64);
+  const heading = publication.sourceType === "workspace_memory" ? `Workspace Memory ${changeKind || "change"}` : `Governed learning ${outcome || "change"}`;
+  const details = [
+    `Importance: ${publication.importance}`,
+    ...destination ? [`Surface: ${destination}`] : [],
+    ...owner ? [`Owner: ${owner}`] : [],
+    ...occurredAt ? [`Recorded: ${occurredAt}`] : []
+  ];
+  const path = publication.sourceType === "workspace_memory" ? `/workspaces/${publication.workspaceId}/memory?memoryId=${encodeURIComponent(publication.sourceId)}` : `/workspaces/${publication.workspaceId}/workspace-state`;
+  const base = deps.settings.webBaseUrl ?? deps.settings.publicBaseUrl;
+  const link = base ? new URL(path, base).toString() : null;
+  const text = `*${heading}*
+${summary}
+
+${details.join(" \xB7 ")}${link ? `
+${link}` : ""}`;
+  return text.length <= MAX_SLACK_MESSAGE_CHARS ? text : `${text.slice(0, MAX_SLACK_MESSAGE_CHARS - 20)}
+\u2026 message truncated`;
+}
+var PERMANENT_DELIVERY_CODES = /* @__PURE__ */ new Set([
+  "account_inactive",
+  "channel_not_found",
+  "invalid_auth",
+  "is_archived",
+  "not_authed",
+  "not_in_channel",
+  "token_expired",
+  "token_revoked"
+]);
+var MEMORY_SLACK_DESTINATION_DRIFT_CODES = /* @__PURE__ */ new Set([
+  "channel_not_found",
+  "is_archived",
+  "not_in_channel",
+  "slack_connect_unsupported"
+]);
+function memorySlackDestinationDrift(error) {
+  return error instanceof SlackBotProviderError && MEMORY_SLACK_DESTINATION_DRIFT_CODES.has(error.code);
+}
+function permanentDeliveryError(error) {
+  if (!(error instanceof SlackBotProviderError)) return false;
+  if (PERMANENT_DELIVERY_CODES.has(error.code)) return true;
+  const status = /^http_(\d{3})$/.exec(error.code)?.[1];
+  return status ? Number(status) >= 400 && Number(status) < 500 && status !== "408" && status !== "429" : false;
+}
+function deliveryRetryMs(error, attemptCount) {
+  if (error instanceof SlackBotProviderError && error.retryAfterMs) {
+    return Math.min(Math.max(error.retryAfterMs, 1e3), MAX_DELIVERY_RETRY_MS);
+  }
+  return Math.min(1e3 * 2 ** Math.max(0, attemptCount - 1), MAX_DELIVERY_RETRY_MS);
+}
+function deliveryErrorCode(error) {
+  if (error instanceof SlackBotProviderError) return error.code.slice(0, 128);
+  const raw = error instanceof Error ? error.name : "memory_slack_delivery_error";
+  return raw.toLowerCase().replace(/[^a-z0-9_-]/g, "_").slice(0, 128) || "error";
+}
+function boundedProjectionString(value, maxChars) {
+  return typeof value === "string" ? escapeSlackText(sanitizeSlackPublicationText(value).slice(0, maxChars)) : "";
+}
+function escapeSlackText(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+}
+
+// src/editable-artifact-websocket.ts
+import {
+  EditableArtifactDomainError,
+  EditableArtifactLiveError,
+  decodeEditableArtifactLiveClientWireFrame,
+  encodeEditableArtifactLiveServerWireFrame
+} from "@opengeni/core";
+var EDITABLE_ARTIFACT_LIVE_WEBSOCKET_PATH = "/v1/editable-artifacts/live";
+var EDITABLE_ARTIFACT_LIVE_WEBSOCKET_PROTOCOL = "opengeni-artifact-v1";
+var EDITABLE_ARTIFACT_LIVE_WEBSOCKET_MAX_MESSAGE_BYTES = 8 * 1024 * 1024 + 64 * 1024;
+var MAX_QUEUED_MESSAGES = 64;
+var MAX_QUEUED_BYTES = 12 * 1024 * 1024;
+var EditableArtifactWebSocketTransport = class {
+  constructor(application) {
+    this.application = application;
+    this.websocket = Object.freeze({
+      open: (socket) => socket.data.attach(socket),
+      message: (socket, message) => socket.data.receive(message),
+      close: (socket) => socket.data.transportClosed()
+    });
+  }
+  websocket;
+  handles(request) {
+    return new URL(request.url).pathname === EDITABLE_ARTIFACT_LIVE_WEBSOCKET_PATH;
+  }
+  upgrade(request, server) {
+    const url = new URL(request.url);
+    if (url.pathname !== EDITABLE_ARTIFACT_LIVE_WEBSOCKET_PATH) return void 0;
+    if (request.method !== "GET") {
+      return new Response("Method Not Allowed", {
+        status: 405,
+        headers: { allow: "GET" }
+      });
+    }
+    if (!this.application) return new Response("Service Unavailable", { status: 503 });
+    if (!offeredProtocol(request.headers.get("sec-websocket-protocol"))) {
+      return new Response("WebSocket protocol required", { status: 426 });
+    }
+    const connection = new EditableArtifactWebSocketConnection(this.application);
+    const upgraded = server.upgrade(request, {
+      data: connection,
+      headers: {
+        "sec-websocket-protocol": EDITABLE_ARTIFACT_LIVE_WEBSOCKET_PROTOCOL
+      }
+    });
+    return upgraded ? void 0 : new Response("Bad Request", { status: 400 });
+  }
+};
+var EditableArtifactWebSocketConnection = class {
+  constructor(application) {
+    this.application = application;
+  }
+  socket = null;
+  session = null;
+  work = Promise.resolve();
+  queuedMessages = 0;
+  queuedBytes = 0;
+  terminal = false;
+  attach(socket) {
+    if (this.socket || this.terminal) {
+      socket.close(4400, "invalid connection state");
+      return;
+    }
+    this.socket = socket;
+  }
+  receive(message) {
+    if (this.terminal) return;
+    if (typeof message === "string") {
+      void this.fail("invalid_frame");
+      return;
+    }
+    const byteLength = message.byteLength;
+    if (byteLength === 0 || byteLength > EDITABLE_ARTIFACT_LIVE_WEBSOCKET_MAX_MESSAGE_BYTES || this.queuedMessages + 1 > MAX_QUEUED_MESSAGES || this.queuedBytes + byteLength > MAX_QUEUED_BYTES) {
+      void this.fail(
+        byteLength > EDITABLE_ARTIFACT_LIVE_WEBSOCKET_MAX_MESSAGE_BYTES ? "oversized_frame" : "slow_client"
+      );
+      return;
+    }
+    const bytes = message instanceof Uint8Array ? Uint8Array.from(message) : new Uint8Array(message).slice();
+    this.queuedMessages += 1;
+    this.queuedBytes += bytes.byteLength;
+    const run = this.work.then(async () => {
+      try {
+        await this.process(bytes);
+      } finally {
+        this.queuedMessages -= 1;
+        this.queuedBytes -= bytes.byteLength;
+      }
+    });
+    this.work = run.catch(async (error) => {
+      await this.handleFailure(error);
+    });
+  }
+  async send(frame) {
+    if (this.terminal || !this.socket) {
+      throw new EditableArtifactLiveError("closed", "Editable artifact socket is closed");
+    }
+    const bytes = encodeEditableArtifactLiveServerWireFrame(frame);
+    if (bytes.byteLength > EDITABLE_ARTIFACT_LIVE_WEBSOCKET_MAX_MESSAGE_BYTES) {
+      throw new EditableArtifactLiveError(
+        "oversized_frame",
+        "Editable artifact server frame exceeds socket limit",
+        { requiresSnapshot: true }
+      );
+    }
+    const accepted = this.socket.send(bytes, false);
+    if (!Number.isSafeInteger(accepted) || accepted <= 0) {
+      throw new EditableArtifactLiveError("closed", "Editable artifact socket rejected frame");
+    }
+  }
+  bufferedBytes() {
+    const buffered = this.socket?.getBufferedAmount?.() ?? this.socket?.bufferedAmount ?? 0;
+    return Number.isSafeInteger(buffered) && buffered >= 0 ? buffered : Number.MAX_SAFE_INTEGER;
+  }
+  close(close) {
+    if (this.terminal) return;
+    this.terminal = true;
+    this.socket?.close(closeCode(close.reason), close.reason);
+  }
+  transportClosed() {
+    if (this.terminal) return;
+    this.terminal = true;
+    void this.session?.close("transport_error");
+  }
+  async process(bytes) {
+    if (this.terminal) return;
+    const frame = decodeEditableArtifactLiveClientWireFrame(bytes);
+    if (!this.session) {
+      if (frame.type !== "open") {
+        throw new EditableArtifactLiveError("invalid_frame", "First socket frame must be open");
+      }
+      const session = await this.application.openLive({
+        token: frame.token,
+        artifactId: frame.artifactId,
+        protocolVersion: frame.protocolVersion,
+        resume: frame.resume,
+        sink: this
+      });
+      if (this.terminal) {
+        await session.close("transport_error");
+        return;
+      }
+      this.session = session;
+      void session.closed.then(() => {
+        if (!this.terminal)
+          this.close({
+            reason: "closed",
+            retryable: false,
+            requiresSnapshot: false
+          });
+      });
+      return;
+    }
+    if (frame.type === "open") {
+      throw new EditableArtifactLiveError("invalid_frame", "Socket is already open");
+    }
+    if (frame.artifactId !== this.session.artifactId || frame.streamEpoch !== this.session.streamEpoch) {
+      throw new EditableArtifactLiveError("stale_epoch", "Socket frame belongs to another stream");
+    }
+    if (frame.type === "applied") {
+      await this.session.acknowledge(frame);
+      return;
+    }
+    let receipt;
+    try {
+      receipt = await this.session.submitIntent(frame);
+    } catch (error) {
+      await this.send({
+        type: "mutationRejected",
+        protocolVersion: frame.protocolVersion,
+        artifactId: frame.artifactId,
+        streamEpoch: frame.streamEpoch,
+        requestHash: frame.requestHash,
+        ...mutationFailure(error)
+      });
+      return;
+    }
+    await this.send({
+      type: "transaction",
+      protocolVersion: frame.protocolVersion,
+      artifactId: frame.artifactId,
+      streamEpoch: frame.streamEpoch,
+      transaction: receipt.transaction
+    });
+    await this.send({
+      type: "mutationAccepted",
+      protocolVersion: frame.protocolVersion,
+      artifactId: frame.artifactId,
+      streamEpoch: frame.streamEpoch,
+      requestHash: receipt.requestHash,
+      clientTransactionId: receipt.clientTransactionId,
+      transactionId: receipt.transaction.transactionId,
+      startSequence: receipt.transaction.startSequence,
+      endSequence: receipt.transaction.endSequence,
+      stateHash: receipt.transaction.stateHash
+    });
+  }
+  async handleFailure(error) {
+    if (this.terminal) return;
+    if (error instanceof EditableArtifactLiveError) {
+      await this.fail(error.code === "invalid_ticket" ? "transport_error" : error.code);
+      return;
+    }
+    await this.fail("transport_error");
+  }
+  async fail(reason) {
+    if (this.terminal) return;
+    this.terminal = true;
+    await this.session?.close(reason).catch(() => void 0);
+    this.socket?.close(closeCode(reason ?? "transport_error"), reason ?? "transport_error");
+  }
+};
+function mutationFailure(error) {
+  if (error instanceof EditableArtifactDomainError) {
+    if (error.code === "forbidden") return { code: "forbidden", retryable: false };
+    if (["invalid_request", "request_hash_mismatch", "invalid_undo_target"].includes(error.code)) {
+      return { code: "invalid_request", retryable: false };
+    }
+    if (error.code === "kernel_contract_violation") {
+      return { code: "unsupported", retryable: false };
+    }
+    if (["retryable_conflict", "outbox_lease_conflict"].includes(error.code)) {
+      return { code: "conflict", retryable: true };
+    }
+    return { code: "conflict", retryable: false };
+  }
+  if (error instanceof EditableArtifactLiveError && error.code === "permission_changed") {
+    return { code: "forbidden", retryable: false };
+  }
+  return { code: "unavailable", retryable: true };
+}
+function offeredProtocol(value) {
+  return value?.split(",").map((part) => part.trim()).includes(EDITABLE_ARTIFACT_LIVE_WEBSOCKET_PROTOCOL) ?? false;
+}
+function closeCode(reason) {
+  if (reason === "permission_changed") return 4403;
+  if (reason === "ticket_expired" || reason === "ticket_replayed") return 4401;
+  if (reason === "protocol_mismatch") return 4406;
+  if (reason === "slow_client" || reason === "oversized_frame") return 4409;
+  if (reason === "closed") return 1e3;
+  return 4400;
+}
+
+// src/editable-artifact-production.ts
+import { createHash as createHash4, randomUUID } from "crypto";
+import {
+  editableArtifactMaterializerCapabilitiesForRuntime
+} from "@opengeni/artifact-tool/runtime/materializer";
+import {
+  EditableArtifactDurableExportService,
+  EditableArtifactAgentApplication,
+  EDITABLE_ARTIFACT_EXPORT_MAX_DOWNLOAD_BYTES,
+  EditableArtifactCompactionPipeline,
+  EditableArtifactGenesisPipeline,
+  EditableArtifactService,
+  MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES as MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES3,
+  ProductionEditableArtifactSnapshotVerifier,
+  SystemEditableArtifactClock,
+  editableArtifactLiveReadPortFromPostgres,
+  editableArtifactLiveTicketStorePortFromPostgres,
+  editableArtifactStorePortFromPostgres,
+  editableArtifactDurableExportStorePortFromPostgres,
+  ogatxEditableArtifactMutationIntentCodec,
+  editableArtifactId
+} from "@opengeni/core/editable-artifacts";
+import {
+  EDITABLE_ARTIFACT_LIVE_PROTOCOL_VERSION,
+  EditableArtifactApplication,
+  EditableArtifactCompatibilityError,
+  EditableArtifactLiveServer,
+  SystemEditableArtifactLiveClock,
+  SystemEditableArtifactLiveScheduler,
+  WebCryptoEditableArtifactLiveTokens
+} from "@opengeni/core/editable-artifact-live";
+import {
+  PostgresEditableArtifactLiveReadStore,
+  PostgresEditableArtifactLiveTicketStore,
+  PostgresEditableArtifactStore,
+  listEditableArtifactIdsForSession,
+  touchEditableArtifactSessionLink,
+  dbSql,
+  withRlsContext
+} from "@opengeni/db";
+import { PostgresEditableArtifactDurableExportStore } from "@opengeni/db/editable-artifact-durable-export";
+import {
+  MAX_BOUNDED_OBJECT_CHUNK_BYTES as MAX_BOUNDED_OBJECT_CHUNK_BYTES2,
+  createObjectStorageBoundedPorts
+} from "@opengeni/storage";
+
+// src/editable-artifact-live-hints.ts
+import {
+  decodeEditableArtifactBrokerHint,
+  editableArtifactLiveHintSubject
+} from "@opengeni/core";
+var EventBusEditableArtifactLiveHints = class {
+  constructor(bus) {
+    this.bus = bus;
+  }
+  async subscribe(input) {
+    const connection = this.bus.getOpStreamConnection?.();
+    if (!connection) throw new Error("Event bus has no artifact hint subscription transport");
+    const subject = editableArtifactLiveHintSubject(input.scope, input.artifactId);
+    const subscription = connection.subscribe(subject);
+    let active = true;
+    try {
+      await requireFlushBarrier(connection);
+    } catch (error) {
+      subscription.unsubscribe();
+      throw error;
+    }
+    void (async () => {
+      try {
+        for await (const message of subscription) {
+          if (!active) return;
+          try {
+            const hint = decodeEditableArtifactBrokerHint(message.data, {
+              scope: input.scope,
+              artifactId: input.artifactId
+            });
+            input.onHint({
+              artifactId: input.artifactId,
+              headSequence: hint.headSequence
+            });
+          } catch {
+          }
+        }
+      } catch {
+        if (active) input.onReconnect();
+      }
+    })();
+    return () => {
+      if (!active) return;
+      active = false;
+      subscription.unsubscribe();
+    };
+  }
+};
+async function requireFlushBarrier(connection) {
+  if (!connection.flush) {
+    throw new Error("Artifact hint subscription transport lacks a flush barrier");
+  }
+  await connection.flush();
+}
+
+// src/editable-artifact-native-kernel.ts
+import { createHash } from "crypto";
+import { pathToFileURL } from "url";
+import {
+  createNativeArtifactSession,
+  openNativeArtifactSession
+} from "@opengeni/artifact-tool/native";
+import {
+  doctorConfiguredArtifactRuntime
+} from "@opengeni/artifact-tool/runtime/development";
+import {
+  decodeEditableArtifactCausalFrontier,
+  encodeEditableArtifactCausalFrontier
+} from "@opengeni/contracts/editable-artifact-causal-frontier";
+import { decodeEditableArtifactSerializedCommit } from "@opengeni/contracts/editable-artifact-serialized-commit";
+import { decodeEditableArtifactMutationIntent } from "@opengeni/contracts/editable-artifacts";
+import {
+  MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES,
+  causalFrontiersEqual,
+  editableArtifactCausalFrontier,
+  editableArtifactContentHash,
+  editableArtifactReplicaId,
+  editableArtifactStateHash
+} from "@opengeni/core";
+var MODEL_SCHEMA_VERSION = 1;
+var OPERATION_PROTOCOL_VERSION = 1;
+var CRDT_STATE_VERSION = 1;
+var SNAPSHOT_CHUNK_BYTES = 1024 * 1024;
+async function loadVerifiedNativeArtifactRuntimeBinding() {
+  const location = await doctorConfiguredArtifactRuntime();
+  const module = await import(
+    /* @vite-ignore */
+    pathToFileURL(location.skillFacadeEntrypoint).href
+  );
+  const candidate = module.getConfiguredArtifactRuntime?.();
+  assertRuntime(candidate, location);
+  return Object.freeze({ runtime: candidate, location, facade: module });
+}
+var NativeEditableArtifactKernelAdapter = class {
+  constructor(runtime, objects) {
+    this.runtime = runtime;
+    this.objects = objects;
+    if (runtime.kind !== "native" || runtime.target === "wasm-web") {
+      throw new Error("Editable artifact authority requires a native kernel");
+    }
+  }
+  async applyTransaction(request) {
+    const session = await this.openCurrentState(request.state);
+    try {
+      if (request.modality === "spreadsheet") {
+        if (session.modality !== "spreadsheet") throw new Error("Native modality mismatch");
+        const committedTransactionBytes = session.authorTransaction(
+          request.intentBytes,
+          encodeEditableArtifactCausalFrontier(request.resolvedCausalBase)
+        );
+        return Object.freeze({
+          modality: "spreadsheet",
+          committedTransactionBytes,
+          kernelVersion: this.runtime.buildIdentity,
+          modelSchemaVersion: MODEL_SCHEMA_VERSION
+        });
+      }
+      if (session.modality !== request.modality) {
+        throw new Error("Native modality mismatch");
+      }
+      const nativeReceiptBytes = session.applyCommands(request.intent.commandBytes);
+      return Object.freeze({
+        modality: request.modality,
+        nativeReceiptBytes,
+        resultingStateHash: editableArtifactStateHash(session.stateHash()),
+        kernelVersion: this.runtime.buildIdentity,
+        modelSchemaVersion: MODEL_SCHEMA_VERSION
+      });
+    } finally {
+      session.dispose();
+    }
+  }
+  async query(input) {
+    const session = await this.openCurrentState(input.state);
+    try {
+      return Uint8Array.from(session.query(input.queryBytes));
+    } finally {
+      session.dispose();
+    }
+  }
+  async openCurrentState(state) {
+    const snapshot = state.snapshot;
+    if (!snapshot) throw new Error("Editable artifact has no verified replay snapshot");
+    const snapshotBytes = await readVerifiedSnapshot(this.objects, snapshot);
+    const session = openNativeArtifactSession(this.runtime, {
+      modality: state.modality,
+      snapshot: snapshotBytes
+    });
+    try {
+      verifySnapshotBoundary(session, state);
+      replayKernelTail(session, state);
+      verifyDurableHead(session, state);
+      return session;
+    } catch (error) {
+      session.dispose();
+      throw error;
+    }
+  }
+  async createCanonicalEmptySnapshot(input) {
+    throwIfAborted(input.signal);
+    const session = createNativeArtifactSession(this.runtime, {
+      modality: input.modality,
+      replicaNamespace: namespaceForArtifact(input.artifactId)
+    });
+    try {
+      const snapshot = session.snapshot();
+      throwIfAborted(input.signal);
+      const revision = safeRevision(session.revision());
+      if (revision !== 0) throw new Error("Native genesis revision is not zero");
+      const common = {
+        scope: input.scope,
+        artifactId: input.artifactId,
+        modality: input.modality,
+        canonicalChunks: fixedChunks(snapshot, input.signal),
+        canonicalByteSize: snapshot.byteLength,
+        canonicalContentHash: editableArtifactContentHash(
+          `sha256:${createHash("sha256").update(snapshot).digest("hex")}`
+        ),
+        stateHash: editableArtifactStateHash(session.stateHash()),
+        coveredHeadSequence: 0,
+        modelSchemaVersion: MODEL_SCHEMA_VERSION,
+        kernelVersion: this.runtime.buildIdentity
+      };
+      if (session.modality === "spreadsheet") {
+        return Object.freeze({
+          ...common,
+          modality: "spreadsheet",
+          coveredCausalFrontier: domainFrontier(session.frontier()),
+          operationProtocolVersion: OPERATION_PROTOCOL_VERSION,
+          crdtStateVersion: CRDT_STATE_VERSION
+        });
+      }
+      return Object.freeze({
+        ...common,
+        modality: session.modality,
+        nativeRevision: 0
+      });
+    } finally {
+      session.dispose();
+    }
+  }
+  async createCanonicalSnapshot(input) {
+    throwIfAborted(input.signal);
+    const snapshot = input.state.snapshot;
+    if (!snapshot) throw new Error("Editable artifact has no verified replay snapshot");
+    const snapshotBytes = await readVerifiedSnapshot(this.objects, snapshot, input.signal);
+    const session = openNativeArtifactSession(this.runtime, {
+      modality: input.state.modality,
+      snapshot: snapshotBytes
+    });
+    try {
+      verifySnapshotBoundary(session, input.state);
+      replayKernelTail(session, input.state);
+      verifyDurableHead(session, input.state);
+      throwIfAborted(input.signal);
+      const canonical = session.snapshot();
+      const common = {
+        scope: input.state.artifact.scope,
+        artifactId: input.state.artifact.id,
+        modality: input.state.modality,
+        canonicalChunks: fixedChunks(canonical, input.signal),
+        canonicalByteSize: canonical.byteLength,
+        canonicalContentHash: editableArtifactContentHash(
+          `sha256:${createHash("sha256").update(canonical).digest("hex")}`
+        ),
+        stateHash: editableArtifactStateHash(session.stateHash()),
+        coveredHeadSequence: input.state.artifact.headSequence,
+        modelSchemaVersion: MODEL_SCHEMA_VERSION,
+        kernelVersion: this.runtime.buildIdentity
+      };
+      if (session.modality === "spreadsheet") {
+        if (input.state.modality !== "spreadsheet") throw new Error("Native modality mismatch");
+        return Object.freeze({
+          ...common,
+          modality: session.modality,
+          coveredCausalFrontier: domainFrontier(session.frontier()),
+          operationProtocolVersion: OPERATION_PROTOCOL_VERSION,
+          crdtStateVersion: CRDT_STATE_VERSION
+        });
+      }
+      if (session.modality !== input.state.modality) throw new Error("Native modality mismatch");
+      return Object.freeze({
+        ...common,
+        modality: session.modality,
+        nativeRevision: safeRevision(session.revision())
+      });
+    } finally {
+      session.dispose();
+    }
+  }
+  async verifyAndReconstruct(input) {
+    throwIfAborted(input.signal);
+    const bytes = await collectExact(
+      input.snapshotChunks,
+      input.expectedSnapshotByteSize,
+      input.signal
+    );
+    const session = openNativeArtifactSession(this.runtime, {
+      modality: input.modality,
+      snapshot: bytes
+    });
+    try {
+      const canonical = session.snapshot();
+      if (!equalBytes(canonical, bytes)) throw new Error("Native snapshot is not canonical");
+      const expected = input.expectedSnapshot;
+      if (expected.modality !== session.modality) throw new Error("Snapshot modality mismatch");
+      const coveredHeadSequence = expected.coveredHeadSequence;
+      const stateHash = editableArtifactStateHash(session.stateHash());
+      if (stateHash !== expected.stateHash) throw new Error("Snapshot state hash mismatch");
+      const canonicalContentHash = editableArtifactContentHash(
+        `sha256:${createHash("sha256").update(canonical).digest("hex")}`
+      );
+      if (session.modality === "spreadsheet") {
+        const coveredCausalFrontier = domainFrontier(session.frontier());
+        if (expected.modality !== "spreadsheet" || !causalFrontiersEqual(coveredCausalFrontier, expected.coveredCausalFrontier)) {
+          throw new Error("Snapshot causal coverage mismatch");
+        }
+        if (input.replayPlan && input.replayPlan.modality !== "spreadsheet") {
+          throw new Error("Replay modality mismatch");
+        }
+        const replayedTarget2 = input.replayPlan ? await replaySpreadsheetPlan(session, input.replayPlan, input.signal) : void 0;
+        return Object.freeze({
+          modality: "spreadsheet",
+          canonicalReencodeVerified: true,
+          scope: input.scope,
+          artifactId: input.artifactId,
+          canonicalByteSize: canonical.byteLength,
+          canonicalContentHash,
+          coveredHeadSequence,
+          stateHash,
+          modelSchemaVersion: MODEL_SCHEMA_VERSION,
+          kernelVersion: this.runtime.buildIdentity,
+          fullCrdtStateVerified: true,
+          coveredCausalFrontier,
+          operationProtocolVersion: OPERATION_PROTOCOL_VERSION,
+          crdtStateVersion: CRDT_STATE_VERSION,
+          ...replayedTarget2 ? { replayedTarget: replayedTarget2 } : {}
+        });
+      }
+      if (expected.modality === "spreadsheet") throw new Error("Snapshot modality mismatch");
+      const nativeRevision = safeRevision(session.revision());
+      if (nativeRevision !== expected.nativeRevision) {
+        throw new Error("Snapshot native revision mismatch");
+      }
+      if (input.replayPlan && input.replayPlan.modality === "spreadsheet") {
+        throw new Error("Replay modality mismatch");
+      }
+      const replayedTarget = input.replayPlan ? await replaySerializedPlan(session, input.replayPlan, input.signal) : void 0;
+      return Object.freeze({
+        modality: session.modality,
+        canonicalReencodeVerified: true,
+        scope: input.scope,
+        artifactId: input.artifactId,
+        canonicalByteSize: canonical.byteLength,
+        canonicalContentHash,
+        coveredHeadSequence,
+        stateHash,
+        modelSchemaVersion: MODEL_SCHEMA_VERSION,
+        kernelVersion: this.runtime.buildIdentity,
+        nativeRevision,
+        ...replayedTarget ? { replayedTarget } : {}
+      });
+    } finally {
+      session.dispose();
+    }
+  }
+};
+function assertRuntime(candidate, location) {
+  if (typeof candidate !== "object" || candidate === null) {
+    throw new Error("Verified artifact facade returned no runtime");
+  }
+  const runtime = candidate;
+  if (runtime.kind !== "native" || runtime.target === "wasm-web" || runtime.target !== location.target || runtime.buildIdentity !== location.kernel.buildIdentity || typeof runtime.createCollaborationSession !== "function" || typeof runtime.openCollaborationSession !== "function" || typeof runtime.createDocumentSession !== "function" || typeof runtime.openDocumentSession !== "function" || typeof runtime.createPresentationSession !== "function" || typeof runtime.openPresentationSession !== "function") {
+    throw new Error("Verified artifact facade returned an incompatible runtime");
+  }
+}
+function verifySnapshotBoundary(session, state) {
+  const snapshot = state.snapshot;
+  if (!snapshot || session.modality !== state.modality)
+    throw new Error("Snapshot modality mismatch");
+  if (session.stateHash() !== snapshot.stateHash) {
+    throw new Error("Native snapshot boundary does not match durable metadata");
+  }
+  if (state.modality === "spreadsheet") {
+    if (session.modality !== "spreadsheet" || snapshot.modality !== "spreadsheet" || !causalFrontiersEqual(domainFrontier(session.frontier()), snapshot.coveredCausalFrontier)) {
+      throw new Error("Native snapshot frontier does not match durable metadata");
+    }
+  } else if (session.modality === "spreadsheet" || snapshot.modality === "spreadsheet" || safeRevision(session.revision()) !== snapshot.nativeRevision || state.baseNativeRevision !== snapshot.nativeRevision) {
+    throw new Error("Native snapshot revision does not match durable metadata");
+  }
+}
+function replayKernelTail(session, state) {
+  if (state.modality === "spreadsheet") {
+    if (session.modality !== "spreadsheet") throw new Error("Native modality mismatch");
+    for (const transaction of state.committedTransactionTail) {
+      const priorNativeRevision = safeRevision(session.revision());
+      if (session.stateHash() !== transaction.priorStateHash) {
+        throw new Error("Spreadsheet replay prior state mismatch");
+      }
+      session.applyCommitted(transaction.committedTransactionBytes);
+      if (safeRevision(session.revision()) !== priorNativeRevision + 1 || session.stateHash() !== transaction.stateHash || !causalFrontiersEqual(
+        domainFrontier(session.frontier()),
+        transaction.resultingCausalFrontier
+      )) {
+        throw new Error("Spreadsheet replay result mismatch");
+      }
+    }
+    return;
+  }
+  if (session.modality !== state.modality) {
+    throw new Error("Native modality mismatch");
+  }
+  for (const transaction of state.committedTransactionTail) {
+    if (session.stateHash() !== transaction.priorStateHash || safeRevision(session.revision()) !== transaction.priorNativeRevision) {
+      throw new Error("Serialized replay prior state mismatch");
+    }
+    const commit = decodeEditableArtifactSerializedCommit(
+      transaction.committedTransactionBytes,
+      state.modality
+    );
+    const intent = decodeEditableArtifactMutationIntent(commit.intentBytes);
+    const receipt = session.applyCommands(intent.commandBytes);
+    if (!equalBytes(receipt, commit.nativeReceiptBytes) || !equalBytes(receipt, transaction.nativeReceiptBytes) || safeRevision(session.revision()) !== transaction.nativeRevision || session.stateHash() !== transaction.stateHash) {
+      throw new Error("Serialized replay result mismatch");
+    }
+  }
+}
+function verifyDurableHead(session, state) {
+  const snapshot = state.snapshot;
+  if (!snapshot) throw new Error("Editable artifact has no replay snapshot");
+  let durableSequence = snapshot.coveredHeadSequence;
+  for (const transaction of state.committedTransactionTail) {
+    if (transaction.sequenceStart !== durableSequence + 1) {
+      throw new Error("Durable transaction tail contains a sequence gap");
+    }
+    durableSequence = transaction.sequenceEnd;
+  }
+  if (session.modality !== state.modality || durableSequence !== state.artifact.headSequence || session.stateHash() !== state.artifact.stateHash) {
+    throw new Error("Reconstructed native state does not match the durable head");
+  }
+  if (state.modality === "spreadsheet" && (session.modality !== "spreadsheet" || !causalFrontiersEqual(domainFrontier(session.frontier()), state.artifact.causalFrontier))) {
+    throw new Error("Reconstructed native frontier does not match the durable head");
+  }
+  if (state.modality !== "spreadsheet") {
+    const expectedNativeRevision = state.committedTransactionTail.at(-1)?.nativeRevision ?? state.baseNativeRevision;
+    if (safeRevision(session.revision()) !== expectedNativeRevision) {
+      throw new Error("Reconstructed native revision does not match the serialized tail");
+    }
+  }
+}
+async function replaySpreadsheetPlan(session, plan, signal) {
+  let sequence = plan.baseHeadSequence;
+  for await (const segment of plan.segments) {
+    throwIfAborted(signal);
+    if (segment.sequenceStart !== sequence + 1) throw new Error("Replay sequence gap");
+    if (segment.modality !== "spreadsheet") throw new Error("Replay segment modality mismatch");
+    session.applyCommitted(segment.bytes);
+    sequence = segment.sequenceEnd;
+  }
+  if (sequence !== plan.targetHeadSequence || session.stateHash() !== plan.targetStateHash) {
+    throw new Error("Replay target mismatch");
+  }
+  const causalFrontier = domainFrontier(session.frontier());
+  if (!causalFrontiersEqual(causalFrontier, plan.targetCausalFrontier)) {
+    throw new Error("Replay frontier mismatch");
+  }
+  return Object.freeze({
+    headSequence: sequence,
+    causalFrontier,
+    stateHash: editableArtifactStateHash(session.stateHash())
+  });
+}
+async function replaySerializedPlan(session, plan, signal) {
+  if (session.modality !== plan.modality) throw new Error("Replay modality mismatch");
+  let sequence = plan.baseHeadSequence;
+  for await (const segment of plan.segments) {
+    throwIfAborted(signal);
+    if (segment.sequenceStart !== sequence + 1 || segment.modality !== session.modality) {
+      throw new Error("Replay sequence or modality mismatch");
+    }
+    const commit = decodeEditableArtifactSerializedCommit(segment.bytes, session.modality);
+    const intent = decodeEditableArtifactMutationIntent(commit.intentBytes);
+    const receipt = session.applyCommands(intent.commandBytes);
+    if (!equalBytes(receipt, commit.nativeReceiptBytes)) throw new Error("Replay receipt mismatch");
+    sequence = segment.sequenceEnd;
+  }
+  if (sequence !== plan.targetHeadSequence || session.stateHash() !== plan.targetStateHash) {
+    throw new Error("Replay target mismatch");
+  }
+  if (safeRevision(session.revision()) !== plan.targetNativeRevision) {
+    throw new Error("Replay native revision mismatch");
+  }
+  return Object.freeze({
+    headSequence: sequence,
+    nativeRevision: plan.targetNativeRevision,
+    stateHash: editableArtifactStateHash(session.stateHash())
+  });
+}
+function domainFrontier(bytes) {
+  return editableArtifactCausalFrontier(
+    decodeEditableArtifactCausalFrontier(bytes).map((entry) => ({
+      replicaId: editableArtifactReplicaId(entry.replicaId),
+      counter: entry.counter
+    }))
+  );
+}
+async function readVerifiedSnapshot(objects, snapshot, signal) {
+  const object = await objects.open({
+    opaqueReference: snapshot.blobReference,
+    maxBytes: MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES,
+    expectedByteSize: snapshot.byteSize,
+    ...signal ? { signal } : {}
+  });
+  try {
+    if (object.contentType !== void 0 && object.contentType !== snapshot.mimeType) {
+      throw new Error("Snapshot content type mismatch");
+    }
+    const bytes = await collectExact(
+      object.chunks(signal ? { signal } : {}),
+      snapshot.byteSize,
+      signal
+    );
+    const contentHash = `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+    if (contentHash !== snapshot.contentHash) throw new Error("Snapshot content hash mismatch");
+    await object.assertUnchanged(signal);
+    return bytes;
+  } finally {
+    await object.close();
+  }
+}
+async function collectExact(chunks, expectedBytes, signal) {
+  if (!Number.isSafeInteger(expectedBytes) || expectedBytes <= 0) {
+    throw new Error("Snapshot byte size is invalid");
+  }
+  const result = new Uint8Array(expectedBytes);
+  let offset = 0;
+  for await (const chunk of chunks) {
+    throwIfAborted(signal);
+    if (!(chunk instanceof Uint8Array) || chunk.byteLength === 0) {
+      throw new Error("Snapshot stream is truncated");
+    }
+    if (offset + chunk.byteLength > result.byteLength) {
+      throw new Error("Snapshot stream exceeds its declared size");
+    }
+    result.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  throwIfAborted(signal);
+  if (offset !== result.byteLength) throw new Error("Snapshot stream is truncated");
+  return result;
+}
+async function* fixedChunks(bytes, signal) {
+  for (let offset = 0; offset < bytes.byteLength; offset += SNAPSHOT_CHUNK_BYTES) {
+    throwIfAborted(signal);
+    yield bytes.subarray(offset, Math.min(bytes.byteLength, offset + SNAPSHOT_CHUNK_BYTES));
+  }
+}
+function namespaceForArtifact(artifactId) {
+  const digest = createHash("sha256").update(artifactId).digest();
+  let value = 0n;
+  for (let index = 0; index < 8; index += 1) value = value << 8n | BigInt(digest[index]);
+  return value === 0n ? 1n : value;
+}
+function safeRevision(value) {
+  if (value < 0n || value > BigInt(Number.MAX_SAFE_INTEGER)) {
+    throw new Error("Native revision exceeds the safe integer range");
+  }
+  return Number(value);
+}
+function equalBytes(left, right) {
+  if (left.byteLength !== right.byteLength) return false;
+  let difference = 0;
+  for (let index = 0; index < left.byteLength; index += 1) {
+    difference |= left[index] ^ right[index];
+  }
+  return difference === 0;
+}
+function throwIfAborted(signal) {
+  if (signal?.aborted) throw new Error("Editable artifact native operation was cancelled");
+}
+
+// src/editable-artifact-office-import.ts
+import { createHash as createHash2 } from "crypto";
+import {
+  ArtifactOfficeSourceUnsupportedError,
+  prepareArtifactOfficeImport
+} from "@opengeni/artifact-tool/office-import";
+import {
+  MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES as MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES2,
+  EDITABLE_ARTIFACT_ORIGINAL_IMPORT_MAX_BYTES,
+  editableArtifactCausalFrontier as editableArtifactCausalFrontier2,
+  editableArtifactContentHash as editableArtifactContentHash2,
+  editableArtifactReplicaId as editableArtifactReplicaId2,
+  editableArtifactStateHash as editableArtifactStateHash2,
+  EditableArtifactOfficeImportError
+} from "@opengeni/core/editable-artifacts";
+import { getFile } from "@opengeni/db";
+import {
+  MAX_BOUNDED_OBJECT_CHUNK_BYTES
+} from "@opengeni/storage";
+var SNAPSHOT_MIME = "application/vnd.opengeni.editable-artifact-snapshot";
+var EditableArtifactOfficeImportAdapter = class {
+  constructor(dependencies) {
+    this.dependencies = dependencies;
+    this.readFile = dependencies.readFile ?? getFile;
+  }
+  readFile;
+  async prepare(input) {
+    throwIfAborted2(input.signal);
+    const file = await this.readFile(this.dependencies.db, input.scope.workspaceId, input.fileId);
+    if (!file || file.status !== "ready") {
+      throw new EditableArtifactOfficeImportError("invalid_source");
+    }
+    const expectedMimeType = officeMimeType(input.modality);
+    if (file.contentType !== expectedMimeType || !officeFilenameMatches(file.filename, input.modality) || !Number.isSafeInteger(file.sizeBytes) || file.sizeBytes < 1 || file.sizeBytes > EDITABLE_ARTIFACT_ORIGINAL_IMPORT_MAX_BYTES || typeof file.sha256 !== "string" || !/^[0-9a-f]{64}$/u.test(file.sha256)) {
+      throw new EditableArtifactOfficeImportError("invalid_source");
+    }
+    const sourceBytes = await readVerifiedWorkspaceFile(
+      this.dependencies.objectStorage,
+      file,
+      input.signal
+    );
+    const prepared = await prepareOfficeImport({
+      runtime: this.dependencies.runtime,
+      modality: input.modality,
+      filename: file.filename,
+      mimeType: expectedMimeType,
+      bytes: sourceBytes,
+      prepare: this.dependencies.prepareOffice ?? prepareArtifactOfficeImport
+    });
+    const retainedSource = await this.dependencies.sourceObjects.write({
+      chunks: byteChunks(sourceBytes),
+      contentType: expectedMimeType,
+      maxBytes: EDITABLE_ARTIFACT_ORIGINAL_IMPORT_MAX_BYTES,
+      expectedByteSize: prepared.source.byteSize,
+      expectedContentHash: prepared.source.contentHash,
+      ...input.signal ? { signal: input.signal } : {}
+    });
+    const retainedSnapshot = await this.dependencies.snapshotObjects.write({
+      chunks: byteChunks(prepared.snapshot.bytes),
+      contentType: SNAPSHOT_MIME,
+      maxBytes: MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES2,
+      expectedByteSize: prepared.snapshot.byteSize,
+      expectedContentHash: prepared.snapshot.contentHash,
+      ...input.signal ? { signal: input.signal } : {}
+    });
+    const common = {
+      modality: prepared.snapshot.modality,
+      blobReference: retainedSnapshot.opaqueReference,
+      byteSize: prepared.snapshot.byteSize,
+      contentHash: editableArtifactContentHash2(prepared.snapshot.contentHash),
+      mimeType: SNAPSHOT_MIME,
+      coveredHeadSequence: 0,
+      stateHash: editableArtifactStateHash2(prepared.snapshot.stateHash),
+      modelSchemaVersion: prepared.snapshot.modelSchemaVersion,
+      kernelVersion: prepared.snapshot.kernelVersion
+    };
+    return Object.freeze({
+      originalImport: Object.freeze({
+        fileId: file.id,
+        blobReference: retainedSource.opaqueReference,
+        byteSize: prepared.source.byteSize,
+        contentHash: editableArtifactContentHash2(prepared.source.contentHash),
+        mimeType: expectedMimeType
+      }),
+      snapshot: prepared.snapshot.modality === "spreadsheet" ? Object.freeze({
+        ...common,
+        modality: "spreadsheet",
+        coveredCausalFrontier: editableArtifactCausalFrontier2(
+          prepared.snapshot.coveredCausalFrontier.map((entry) => ({
+            replicaId: editableArtifactReplicaId2(entry.replicaId),
+            counter: entry.counter
+          }))
+        ),
+        operationProtocolVersion: prepared.snapshot.operationProtocolVersion,
+        crdtStateVersion: prepared.snapshot.crdtStateVersion
+      }) : Object.freeze({
+        ...common,
+        modality: prepared.snapshot.modality,
+        nativeRevision: prepared.snapshot.nativeRevision
+      })
+    });
+  }
+};
+async function prepareOfficeImport(input) {
+  try {
+    return await input.prepare({
+      facade: input.runtime.facade,
+      modality: input.modality,
+      filename: input.filename,
+      mimeType: input.mimeType,
+      bytes: input.bytes,
+      expectedRuntimeTarget: input.runtime.location.target,
+      expectedKernelVersion: input.runtime.runtime.buildIdentity
+    });
+  } catch (error) {
+    if (error instanceof ArtifactOfficeSourceUnsupportedError) {
+      throw new EditableArtifactOfficeImportError("unsupported_content");
+    }
+    throw error;
+  }
+}
+function officeMimeType(modality) {
+  if (modality === "spreadsheet") {
+    return "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet";
+  }
+  if (modality === "document") {
+    return "application/vnd.openxmlformats-officedocument.wordprocessingml.document";
+  }
+  return "application/vnd.openxmlformats-officedocument.presentationml.presentation";
+}
+function officeFilenameMatches(filename, modality) {
+  const extension = modality === "spreadsheet" ? ".xlsx" : modality === "document" ? ".docx" : ".pptx";
+  return filename.toLowerCase().endsWith(extension);
+}
+async function readVerifiedWorkspaceFile(storage, file, signal) {
+  throwIfAborted2(signal);
+  const before = await storage.headFile(file);
+  if (before.ContentLength !== file.sizeBytes || before.ContentType !== file.contentType || before.Metadata?.sha256 !== file.sha256 || typeof before.VersionToken !== "string" || before.VersionToken.length < 1) {
+    throw new EditableArtifactOfficeImportError("source_changed");
+  }
+  const bytes = new Uint8Array(file.sizeBytes);
+  const digest = createHash2("sha256");
+  for (let start = 0; start < file.sizeBytes; start += MAX_BOUNDED_OBJECT_CHUNK_BYTES) {
+    throwIfAborted2(signal);
+    const end = Math.min(file.sizeBytes, start + MAX_BOUNDED_OBJECT_CHUNK_BYTES) - 1;
+    const chunk = await storage.getFileRange(file, { start, end });
+    if (!chunk || chunk.byteLength !== end - start + 1) {
+      throw new EditableArtifactOfficeImportError("source_changed");
+    }
+    bytes.set(chunk, start);
+    digest.update(chunk);
+  }
+  const after = await storage.headFile(file);
+  const sha256 = digest.digest("hex");
+  if (after.ContentLength !== before.ContentLength || after.ContentType !== before.ContentType || after.Metadata?.sha256 !== before.Metadata?.sha256 || after.VersionToken !== before.VersionToken || sha256 !== file.sha256) {
+    throw new EditableArtifactOfficeImportError("source_changed");
+  }
+  return bytes;
+}
+async function* byteChunks(bytes) {
+  for (let offset = 0; offset < bytes.byteLength; offset += MAX_BOUNDED_OBJECT_CHUNK_BYTES) {
+    yield bytes.subarray(offset, offset + MAX_BOUNDED_OBJECT_CHUNK_BYTES);
+  }
+}
+function throwIfAborted2(signal) {
+  if (signal?.aborted) throw signal.reason ?? new Error("Artifact import aborted");
+}
+
+// src/editable-artifact-workspace-files.ts
+import { createHash as createHash3 } from "crypto";
+import { completeFileUpload, prepareGeneratedWorkspaceFile } from "@opengeni/db";
+var UPLOAD_INTENT_TTL_MS = 60 * 6e4;
+var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
+var EditableArtifactWorkspaceFileAdapter = class {
+  constructor(dependencies) {
+    this.dependencies = dependencies;
+    this.now = dependencies.now ?? (() => /* @__PURE__ */ new Date());
+    this.prepareFile = dependencies.prepareFile ?? prepareGeneratedWorkspaceFile;
+    this.completeFile = dependencies.completeFile ?? completeFileUpload;
+  }
+  now;
+  prepareFile;
+  completeFile;
+  async ensureMaterializationFile(input) {
+    throwIfAborted3(input.signal);
+    const storage = this.dependencies.objectStorage;
+    if (!storage.headObject || !storage.putObjectStreamIfAbsent) {
+      throw new Error("Object storage lacks immutable streaming upload support");
+    }
+    const download = await this.dependencies.durableExports.openMaterializationDownload({
+      scope: input.scope,
+      actor: input.actor,
+      artifactId: input.artifact.id,
+      jobId: input.jobId,
+      ...input.signal ? { signal: input.signal } : {}
+    });
+    try {
+      const sha256 = plainSha256(download.contentHash);
+      const filename = exportFilename(input.filename, download.format);
+      const fileId = deterministicUuid(
+        `editable-artifact-export:file:${input.scope.workspaceId}:${input.artifact.id}:${input.versionId}:${input.jobId}`
+      );
+      const uploadId = deterministicUuid(
+        `editable-artifact-export:upload:${input.scope.workspaceId}:${input.artifact.id}:${input.versionId}:${input.jobId}`
+      );
+      const safeFilename = `artifact-${input.artifact.id}-${input.jobId}.${download.format}`;
+      const objectKey = `workspaces/${input.scope.workspaceId}/files/${fileId}/artifact-exports/${safeFilename}`;
+      const prepared = await this.prepareFile(this.dependencies.db, {
+        accountId: input.scope.accountId,
+        workspaceId: input.scope.workspaceId,
+        fileId,
+        uploadId,
+        filename,
+        safeFilename,
+        contentType: download.mimeType,
+        sizeBytes: download.byteSize,
+        sha256,
+        bucket: storage.bucket,
+        objectKey,
+        expiresAt: new Date(this.now().getTime() + UPLOAD_INTENT_TTL_MS)
+      });
+      let file = prepared.file;
+      if (file.status !== "ready") {
+        const existing = await storage.headObject(objectKey);
+        if (existing) {
+          assertStoredExport(existing, download.byteSize, download.mimeType, sha256);
+        } else {
+          await storage.putObjectStreamIfAbsent({
+            key: objectKey,
+            contentType: download.mimeType,
+            chunks: download.chunks(input.signal ? { signal: input.signal } : {}),
+            byteSize: download.byteSize,
+            sha256,
+            ...input.signal ? { signal: input.signal } : {}
+          });
+          const stored = await storage.headObject(objectKey);
+          assertStoredExport(stored, download.byteSize, download.mimeType, sha256);
+        }
+        await download.assertUnchanged(input.signal);
+        throwIfAborted3(input.signal);
+        file = await this.completeFile(this.dependencies.db, input.scope.workspaceId, uploadId);
+      } else {
+        assertStoredExport(
+          await storage.headObject(objectKey),
+          download.byteSize,
+          download.mimeType,
+          sha256
+        );
+        await download.assertUnchanged(input.signal);
+      }
+      if (file.id !== fileId || file.status !== "ready" || file.filename !== filename || file.contentType !== download.mimeType || file.sizeBytes !== download.byteSize || file.sha256 !== sha256) {
+        throw new Error("Generated workspace file differs from its immutable export");
+      }
+      return Object.freeze({
+        fileId: file.id,
+        filename: file.filename,
+        contentType: file.contentType,
+        sizeBytes: file.sizeBytes,
+        sha256,
+        artifactId: input.artifact.id,
+        versionId: input.versionId,
+        materializationJobId: input.jobId,
+        sourceHeadSequence: input.sourceHeadSequence,
+        sourceStateHash: input.sourceStateHash
+      });
+    } finally {
+      await download.close();
+    }
+  }
+};
+function assertStoredExport(head, byteSize, contentType, sha256) {
+  if (!head || head.ContentLength !== byteSize || head.ContentType !== contentType || head.Metadata?.sha256 !== sha256 || typeof head.VersionToken !== "string" || head.VersionToken.length < 1) {
+    throw new Error("Workspace export object differs from its durable materialization");
+  }
+}
+function exportFilename(value, format) {
+  const expectedExtension = `.${format}`;
+  const normalized = value.normalize("NFKC").replace(/[\\/:*?"<>|\u0000-\u001f\u007f]+/gu, "-").replace(/\s+/gu, " ").trim().slice(0, 200);
+  const stem = normalized.toLowerCase().endsWith(expectedExtension) ? normalized.slice(0, -expectedExtension.length) : normalized;
+  return `${stem.replace(/[. ]+$/u, "").slice(0, 190) || "artifact"}${expectedExtension}`;
+}
+function plainSha256(value) {
+  const match = /^sha256:([0-9a-f]{64})$/u.exec(value);
+  if (!match) throw new Error("Materialized artifact content hash is invalid");
+  return match[1];
+}
+function deterministicUuid(seed) {
+  const bytes = createHash3("sha256").update(seed, "utf8").digest().subarray(0, 16);
+  bytes[6] = (bytes[6] ?? 0) & 15 | 80;
+  bytes[8] = (bytes[8] ?? 0) & 63 | 128;
+  const hex = bytes.toString("hex");
+  const value = `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+  if (!UUID_PATTERN.test(value)) throw new Error("Generated workspace file identity is invalid");
+  return value;
+}
+function throwIfAborted3(signal) {
+  if (signal?.aborted) throw signal.reason ?? new Error("Artifact export aborted");
+}
+
+// src/editable-artifact-production.ts
+var INVALIDATION_POLL_MS = 1e3;
+var TICKET_CLEANUP_MS = 3e4;
+async function createStandaloneEditableArtifactApplication(input) {
+  const boundedObjects = createObjectStorageBoundedPorts(input.objectStorage);
+  const materializationObjects = createObjectStorageBoundedPorts(input.objectStorage, {
+    keyPrefix: "editable-artifacts/materializations/v1/sha256/"
+  });
+  const importSourceObjects = createObjectStorageBoundedPorts(input.objectStorage, {
+    keyPrefix: "editable-artifacts/imports/v1/sha256/"
+  });
+  const runtimeBinding = await loadVerifiedNativeArtifactRuntimeBinding();
+  const runtime = runtimeBinding.runtime;
+  const kernel = new NativeEditableArtifactKernelAdapter(runtime, boundedObjects.read);
+  const persistedStore = new PostgresEditableArtifactStore(input.db);
+  const store = editableArtifactStorePortFromPostgres(persistedStore);
+  const authorization = new PostgresEditableArtifactAuthorization(input.db);
+  const ids = new RandomEditableArtifactStableIds();
+  const clock = new SystemEditableArtifactClock();
+  const snapshotVerifier = new ProductionEditableArtifactSnapshotVerifier({
+    objects: boundedObjects.read,
+    kernel
+  });
+  const genesis = new EditableArtifactGenesisPipeline({
+    kernel,
+    objects: boundedObjects.write,
+    now: () => clock.now()
+  });
+  const compaction = new EditableArtifactCompactionPipeline({
+    kernel,
+    objects: boundedObjects.write,
+    now: () => clock.now()
+  });
+  const domain = new EditableArtifactService({
+    authorization,
+    kernel,
+    store,
+    intentCodec: ogatxEditableArtifactMutationIntentCodec,
+    clock,
+    ids,
+    snapshotVerifier,
+    genesis,
+    compaction
+  });
+  const materializerCapabilities = editableArtifactMaterializerCapabilitiesForRuntime(
+    runtime,
+    runtimeBinding.location.artifactTool.packageVersion
+  );
+  const durableExports = new EditableArtifactDurableExportService({
+    authorization,
+    exactSnapshots: Object.freeze({
+      ensure: async (request) => await domain.compactCurrentHead(request)
+    }),
+    store: editableArtifactDurableExportStorePortFromPostgres(
+      new PostgresEditableArtifactDurableExportStore(input.db)
+    ),
+    ids: new RandomEditableArtifactDurableExportIds(),
+    profiles: materializationProfiles(materializerCapabilities),
+    materializationObjects: materializationObjects.read
+  });
+  const officeImports = new EditableArtifactOfficeImportAdapter({
+    db: input.db,
+    objectStorage: input.objectStorage,
+    runtime: runtimeBinding,
+    sourceObjects: importSourceObjects.write,
+    snapshotObjects: boundedObjects.write
+  });
+  const agent = new EditableArtifactAgentApplication({
+    domain,
+    exports: durableExports,
+    associations: Object.freeze({
+      listArtifactIds: async ({ scope, sessionId, limit }) => (await listEditableArtifactIdsForSession(input.db, scope, sessionId, limit)).map(
+        editableArtifactId
+      ),
+      touch: async ({ scope, sessionId, artifactId }) => await touchEditableArtifactSessionLink(input.db, scope, sessionId, artifactId)
+    }),
+    inspector: kernel,
+    officeImports,
+    workspaceFiles: new EditableArtifactWorkspaceFileAdapter({
+      db: input.db,
+      objectStorage: input.objectStorage,
+      durableExports
+    })
+  });
+  const ticketStore = new PostgresEditableArtifactLiveTicketStore(input.db);
+  const liveRead = new PostgresEditableArtifactLiveReadStore(input.db, {
+    snapshotBytes: snapshotBytesPort(boundedObjects.read)
+  });
+  const invalidations = new PollingEditableArtifactAuthorizationInvalidations(authorization);
+  const live = new EditableArtifactLiveServer({
+    authorization,
+    domain,
+    tickets: editableArtifactLiveTicketStorePortFromPostgres(ticketStore),
+    tokens: new WebCryptoEditableArtifactLiveTokens(),
+    clock: new SystemEditableArtifactLiveClock(),
+    scheduler: new SystemEditableArtifactLiveScheduler(),
+    read: editableArtifactLiveReadPortFromPostgres(liveRead),
+    hints: new EventBusEditableArtifactLiveHints(input.bus),
+    invalidations
+  });
+  const compatibility = Object.freeze({
+    assertCompatible(request) {
+      if (request.protocolVersion !== EDITABLE_ARTIFACT_LIVE_PROTOCOL_VERSION || request.modelSchemaVersion !== 1 || request.kernelVersion !== runtime.buildIdentity) {
+        throw new EditableArtifactCompatibilityError();
+      }
+    }
+  });
+  const application = new EditableArtifactApplication({
+    domain,
+    live,
+    compatibility
+  });
+  const cleanup = setInterval(() => {
+    void ticketStore.cleanupExpired().catch(() => void 0);
+  }, TICKET_CLEANUP_MS);
+  cleanup.unref?.();
+  return Object.freeze({
+    application,
+    durableExports,
+    agent,
+    officeImports,
+    kernelVersion: runtime.buildIdentity,
+    close() {
+      clearInterval(cleanup);
+      invalidations.close();
+    }
+  });
+}
+var PostgresEditableArtifactAuthorization = class {
+  constructor(db) {
+    this.db = db;
+  }
+  async authorize(request) {
+    const actor = request.actor;
+    const rows = await withRlsContext(
+      this.db,
+      request.scope,
+      async (tx) => rawRows(
+        await tx.execute(dbSql`select *
+          from opengeni_private.authorize_editable_artifact_actor(
+            ${request.scope.accountId}::uuid,
+            ${request.scope.workspaceId}::uuid,
+            ${request.artifactId},
+            ${actor.kind},
+            ${actor.subjectId},
+            ${actor.kind === "agent" ? actor.sessionId : null},
+            ${actor.kind === "agent" ? actor.turnId : null},
+            ${actor.kind === "agent" ? actor.attemptId : null},
+            ${actor.kind === "agent" ? actor.generation : null},
+            ${actor.kind === "service" ? actor.service : null},
+            ${request.permission},
+            current_schema()
+          )`)
+      )
+    );
+    if (rows.length !== 1) throw new Error("Editable artifact authorization returned no decision");
+    const revision = Number(rows[0].authorization_revision);
+    if (!Number.isSafeInteger(revision) || revision < 1) {
+      throw new Error("Editable artifact authorization returned an invalid revision");
+    }
+    return Object.freeze({ allowed: rows[0].allowed === true, revision });
+  }
+};
+var PollingEditableArtifactAuthorizationInvalidations = class {
+  constructor(authorization) {
+    this.authorization = authorization;
+  }
+  stops = /* @__PURE__ */ new Set();
+  async subscribe(input) {
+    let active = true;
+    let polling = false;
+    let baseline = await this.read(input);
+    const timer = setInterval(() => {
+      if (!active || polling) return;
+      polling = true;
+      void this.read(input).then((next) => {
+        if (!active) return;
+        if (next !== baseline) {
+          baseline = next;
+          input.onInvalidated();
+        }
+      }).catch(() => {
+        if (active) input.onInvalidated();
+      }).finally(() => {
+        polling = false;
+      });
+    }, INVALIDATION_POLL_MS);
+    timer.unref?.();
+    const stop = () => {
+      if (!active) return;
+      active = false;
+      clearInterval(timer);
+      this.stops.delete(stop);
+    };
+    this.stops.add(stop);
+    return stop;
+  }
+  close() {
+    for (const stop of [...this.stops]) stop();
+  }
+  async read(input) {
+    const decision = await this.authorization.authorize({
+      scope: input.scope,
+      artifactId: input.artifactId,
+      actor: input.actor,
+      permission: "read"
+    });
+    return `${decision.allowed ? 1 : 0}:${decision.revision}`;
+  }
+};
+var RandomEditableArtifactStableIds = class {
+  next(_kind) {
+    return randomUUID().replaceAll("-", "");
+  }
+};
+var RandomEditableArtifactDurableExportIds = class {
+  next(_kind) {
+    return randomUUID().replaceAll("-", "");
+  }
+};
+function materializationProfiles(capabilities) {
+  if (capabilities.protocol !== "OGAMC001" || capabilities.runtimeKind !== "native" || capabilities.maxOutputBytes !== EDITABLE_ARTIFACT_EXPORT_MAX_DOWNLOAD_BYTES || capabilities.codecVersions["opengeni.xlsx"] === void 0 || !capabilities.supportedModelSchemaVersions.includes(1) || !capabilities.supportedOperationProtocolVersions.includes(1) || !capabilities.supportedSnapshotProtocolVersions.includes(1)) {
+    throw new Error("Verified artifact materializer profile is incompatible");
+  }
+  const codecVersion = capabilities.codecVersions["opengeni.xlsx"];
+  return Object.freeze({
+    async resolve(input) {
+      if (input.modality !== "spreadsheet" || input.format !== "xlsx" || Object.keys(input.options).length !== 0) {
+        return null;
+      }
+      return Object.freeze({
+        modality: "spreadsheet",
+        format: "xlsx",
+        codecId: "opengeni.xlsx",
+        codecVersion,
+        kernelVersion: capabilities.kernelVersion,
+        fontRegistryHash: capabilities.fontRegistryHash,
+        policyHash: capabilities.policyHash,
+        normalizedOptions: "{}"
+      });
+    }
+  });
+}
+function snapshotBytesPort(objects) {
+  return Object.freeze({
+    async readSnapshotBytes(snapshot) {
+      const object = await objects.open({
+        opaqueReference: snapshot.blobReference,
+        maxBytes: MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES3,
+        expectedByteSize: snapshot.byteSize
+      });
+      try {
+        if (object.contentType !== void 0 && object.contentType !== snapshot.mimeType) {
+          throw new Error("Editable artifact snapshot content type mismatch");
+        }
+        const bytes = new Uint8Array(snapshot.byteSize);
+        const digest = createHash4("sha256");
+        let offset = 0;
+        for await (const chunk of object.chunks({
+          chunkBytes: MAX_BOUNDED_OBJECT_CHUNK_BYTES2
+        })) {
+          if (offset + chunk.byteLength > bytes.byteLength) {
+            throw new Error("Editable artifact snapshot exceeds its declared size");
+          }
+          bytes.set(chunk, offset);
+          digest.update(chunk);
+          offset += chunk.byteLength;
+        }
+        if (offset !== bytes.byteLength || `sha256:${digest.digest("hex")}` !== snapshot.contentHash) {
+          throw new Error("Editable artifact snapshot digest or size mismatch");
+        }
+        await object.assertUnchanged();
+        return bytes;
+      } finally {
+        await object.close();
+      }
+    }
+  });
+}
+function rawRows(result) {
+  if (Array.isArray(result)) return result;
+  const rows = result?.rows;
+  if (Array.isArray(rows)) return rows;
+  throw new Error("Unsupported database execute result shape");
+}
+
 // src/index.ts
 function isWorkflowAlreadyStarted(error) {
   return error instanceof WorkflowExecutionAlreadyStartedError;
@@ -557,6 +2252,14 @@ async function createTemporalWorkflowClient(settings, db) {
     },
     syncScheduledTask: async ({ task }) => {
       const schedule = temporal.schedule.getHandle(task.temporalScheduleId);
+      if (task.schedule.type === "manual") {
+        try {
+          await schedule.delete();
+        } catch (error) {
+          if (!(error instanceof ScheduleNotFoundError)) throw error;
+        }
+        return;
+      }
       const options = temporalScheduleOptions(task, settings.temporalTaskQueue);
       try {
         await schedule.update(() => temporalScheduleUpdateOptions(options));
@@ -568,13 +2271,21 @@ async function createTemporalWorkflowClient(settings, db) {
       }
     },
     deleteScheduledTaskSchedule: async ({ temporalScheduleId }) => {
-      await temporal.schedule.getHandle(temporalScheduleId).delete().catch(() => void 0);
+      try {
+        await temporal.withDeadline(Date.now() + 5e3, async () => {
+          await temporal.schedule.getHandle(temporalScheduleId).delete();
+        });
+      } catch (error) {
+        if (error instanceof ScheduleNotFoundError) return;
+        throw error;
+      }
     },
     triggerScheduledTask: async ({
       task,
       agentRunUsageIdempotencyKey,
       triggerWorkflowId,
-      initiator
+      initiator,
+      triggerType = "manual"
     }) => {
       const workflowId = triggerWorkflowId;
       try {
@@ -587,7 +2298,7 @@ async function createTemporalWorkflowClient(settings, db) {
               accountId: task.accountId,
               workspaceId: task.workspaceId,
               taskId: task.id,
-              triggerType: "manual",
+              triggerType,
               agentRunUsageIdempotencyKey,
               initiator
             }
@@ -605,18 +2316,23 @@ async function createTemporalWorkflowClient(settings, db) {
       if (!targetId) {
         throw new Error("rig verification requires changeId or versionId");
       }
-      await temporal.workflow.start("rigVerificationWorkflow", {
-        taskQueue: settings.temporalTaskQueue,
-        workflowId: workflowId ?? `rig-verification-${targetId}-${crypto.randomUUID()}`,
-        workflowIdReusePolicy: "ALLOW_DUPLICATE",
-        args: [
-          {
-            workspaceId,
-            ...changeId ? { changeId } : {},
-            ...versionId ? { versionId } : {}
-          }
-        ]
-      });
+      try {
+        await temporal.workflow.start("rigVerificationWorkflow", {
+          taskQueue: settings.temporalTaskQueue,
+          workflowId: workflowId ?? `rig-verification-${targetId}-${crypto.randomUUID()}`,
+          workflowIdReusePolicy: "REJECT_DUPLICATE",
+          args: [
+            {
+              workspaceId,
+              ...changeId ? { changeId } : {},
+              ...versionId ? { versionId } : {}
+            }
+          ]
+        });
+      } catch (error) {
+        if (isWorkflowAlreadyStarted(error)) return;
+        throw error;
+      }
     },
     check: async () => {
       await connection.workflowService.getSystemInfo({});
@@ -693,24 +2409,73 @@ async function startApi() {
     await dbClient.close();
     throw new Error("OpenGeni API startup dependencies were not initialized");
   }
+  const objectStorage = createObjectStorage(settings);
+  let editableArtifactComposition;
+  if (objectStorage && isArtifactRuntimeConfigured()) {
+    try {
+      editableArtifactComposition = await createStandaloneEditableArtifactApplication({
+        db: dbClient.db,
+        bus,
+        objectStorage
+      });
+    } catch (error) {
+      await Promise.allSettled([bus.close(), workflowClient.close(), dbClient.close()]);
+      throw error;
+    }
+  }
   const { app, routeDeps } = createAppComposition({
     settings,
     db: dbClient.db,
     bus,
     workflowClient: workflowClient.client,
     documentIndexer: workflowClient.documentIndexer,
+    objectStorage,
+    ...editableArtifactComposition ? {
+      editableArtifacts: editableArtifactComposition.application,
+      editableArtifactExports: editableArtifactComposition.durableExports,
+      editableArtifactAgent: editableArtifactComposition.agent,
+      editableArtifactOfficeImports: editableArtifactComposition.officeImports
+    } : {},
     observability,
     readinessChecks: {
       db: runtimeDatabaseReadyCheck(dbClient.db, databasePosture)
     }
   });
+  if (!routeDeps.editableArtifacts) {
+    observability.warn("editable artifact engine is not composed", {
+      subsystem: "editable_artifacts",
+      behavior: "http_and_websocket_fail_closed"
+    });
+  }
+  const artifactWebSockets = new EditableArtifactWebSocketTransport(routeDeps.editableArtifacts);
   const server = Bun.serve({
     hostname: settings.apiHost,
     port: settings.apiPort,
     idleTimeout: 255,
-    fetch: app.fetch
+    fetch: (request, bunServer) => {
+      if (artifactWebSockets.handles(request)) {
+        return artifactWebSockets.upgrade(request, bunServer);
+      }
+      return app.fetch(request);
+    },
+    websocket: {
+      maxPayloadLength: EDITABLE_ARTIFACT_LIVE_WEBSOCKET_MAX_MESSAGE_BYTES,
+      backpressureLimit: 16 * 1024 * 1024,
+      closeOnBackpressureLimit: true,
+      open: (socket) => artifactWebSockets.websocket.open(socket),
+      message: (socket, message) => artifactWebSockets.websocket.message(socket, message),
+      close: (socket) => artifactWebSockets.websocket.close(socket)
+    }
   });
   const stopSlackInteractionPump = settings.slackSigningSecret ? startSlackInteractionPump(routeDeps) : void 0;
+  const stopMemorySlackPublicationPump = startMemorySlackPublicationPump(routeDeps);
+  const stopTemporalScheduleCleanupPump = startTemporalScheduleCleanupPump({
+    db: dbClient.db,
+    deleteSchedule: async (temporalScheduleId) => {
+      await workflowClient.client.deleteScheduledTaskSchedule({ temporalScheduleId });
+    },
+    observability
+  });
   let stopMetricsIngestion;
   let stopHelloIngestion;
   let authCalloutResponder;
@@ -733,9 +2498,11 @@ async function startApi() {
           { db: dbClient.db, settings, callout, observability },
           settings.natsUrl
         );
-      } catch (error) {
+      } catch {
         observability.error("OpenGeni NATS auth-callout responder failed to start", {
-          error: error instanceof Error ? error.message : String(error)
+          errorClass: "NatsAuthCalloutOperationError",
+          errorCode: "nats_auth_callout_start_failed",
+          origin: "api"
         });
       }
     } else {
@@ -754,9 +2521,12 @@ async function startApi() {
     close: async () => {
       server.stop(true);
       stopSlackInteractionPump?.();
+      await stopMemorySlackPublicationPump();
       stopMetricsIngestion?.();
       stopHelloIngestion?.();
+      await stopTemporalScheduleCleanupPump();
       await Promise.allSettled([
+        Promise.resolve(editableArtifactComposition?.close()),
         authCalloutResponder?.close(),
         bus.close(),
         workflowClient.close(),
@@ -781,9 +2551,12 @@ function shouldCreateScheduleAfterUpdateError(error) {
   return error instanceof ScheduleNotFoundError;
 }
 function temporalScheduleSpec(schedule) {
+  if (schedule.type === "manual") {
+    throw new Error("manual scheduled tasks do not have a Temporal Schedule spec");
+  }
   if (schedule.type === "interval") {
     return {
-      intervals: [{ every: `${schedule.everySeconds}s` }],
+      intervals: [temporalIntervalSpec(schedule)],
       ...schedule.startAt ? { startAt: new Date(schedule.startAt) } : {},
       ...schedule.endAt ? { endAt: new Date(schedule.endAt) } : {}
     };
@@ -816,6 +2589,19 @@ function temporalScheduleSpec(schedule) {
     timezone: "UTC"
   };
 }
+function temporalIntervalSpec(schedule) {
+  const every = `${schedule.everySeconds}s`;
+  if (!schedule.startAt) {
+    return { every };
+  }
+  const everyMilliseconds = BigInt(schedule.everySeconds) * 1000n;
+  const startMilliseconds = BigInt(new Date(schedule.startAt).getTime());
+  const offsetMilliseconds = (startMilliseconds % everyMilliseconds + everyMilliseconds) % everyMilliseconds;
+  return {
+    every,
+    ...offsetMilliseconds === 0n ? {} : { offset: `${offsetMilliseconds}ms` }
+  };
+}
 function temporalMonth(monthIndex) {
   return TEMPORAL_MONTHS[monthIndex];
 }
@@ -842,7 +2628,7 @@ function temporalScheduleOptions(task, taskQueue) {
       pauseOnFailure: false
     },
     state: {
-      paused: task.status === "paused",
+      paused: scheduledTaskEffectivelyPaused(task),
       ...task.schedule.type === "once" ? { remainingActions: 1 } : {}
     },
     memo: {
@@ -853,6 +2639,14 @@ function temporalScheduleOptions(task, taskQueue) {
     }
   };
 }
+function scheduledTaskEffectivelyPaused(task) {
+  if (task.status === "paused") return true;
+  if (task.action.kind !== "knowledge_source_sync") return false;
+  const control = task.metadata.knowledgeSourceSync;
+  if (!control || typeof control !== "object") return false;
+  const record = control;
+  return record.sourceEnabled === false || record.connectionPaused === true;
+}
 function temporalScheduleUpdateOptions(options) {
   return {
     spec: options.spec,