@opengeni/core 0.21.2 → 0.24.1

package/dist/chunk-JJU6I5XD.js

@@ -0,0 +1,2713 @@
+// src/domain/editable-artifacts/types.ts
+import { EDITABLE_ARTIFACT_KERNEL_VERSION_MAX_BYTES } from "@opengeni/contracts/editable-artifacts";
+var STABLE_ID_PATTERN = /^[0-9a-f]{32}$/;
+var REPLICA_ID_PATTERN = /^[0-9a-f]{16}$/;
+var SHA256_PATTERN = /^sha256:[0-9a-f]{64}$/;
+function assertNonzeroHex(value, pattern, label) {
+  if (!pattern.test(value) || /^0+$/.test(value)) {
+    throw new TypeError(`${label} must be fixed-width lowercase nonzero hexadecimal text`);
+  }
+}
+function editableArtifactId(value) {
+  assertNonzeroHex(value, STABLE_ID_PATTERN, "artifact id");
+  return value;
+}
+function editableArtifactTransactionId(value) {
+  assertNonzeroHex(value, STABLE_ID_PATTERN, "server transaction id");
+  return value;
+}
+function editableArtifactReceiptId(value) {
+  assertNonzeroHex(value, STABLE_ID_PATTERN, "receipt id");
+  return value;
+}
+function editableArtifactSnapshotId(value) {
+  assertNonzeroHex(value, STABLE_ID_PATTERN, "snapshot id");
+  return value;
+}
+function editableArtifactOutboxId(value) {
+  assertNonzeroHex(value, STABLE_ID_PATTERN, "outbox id");
+  return value;
+}
+function editableArtifactOperationId(value) {
+  assertNonzeroHex(value, STABLE_ID_PATTERN, "operation id");
+  return value;
+}
+function editableArtifactReplicaId(value) {
+  assertNonzeroHex(value, REPLICA_ID_PATTERN, "replica id");
+  return value;
+}
+function editableArtifactClientTransactionId(value) {
+  if (value.length < 1 || value.length > 200 || !/^[A-Za-z0-9._:-]+$/.test(value)) {
+    throw new TypeError("client transaction id must contain 1-200 portable identifier characters");
+  }
+  return value;
+}
+function editableArtifactRequestHash(value) {
+  if (!SHA256_PATTERN.test(value)) {
+    throw new TypeError("request hash must be sha256 followed by 64 lowercase hexadecimal digits");
+  }
+  return value;
+}
+function editableArtifactStateHash(value) {
+  if (!SHA256_PATTERN.test(value)) {
+    throw new TypeError("state hash must be sha256 followed by 64 lowercase hexadecimal digits");
+  }
+  return value;
+}
+function editableArtifactContentHash(value) {
+  if (!SHA256_PATTERN.test(value)) {
+    throw new TypeError("content hash must be sha256 followed by 64 lowercase hexadecimal digits");
+  }
+  return value;
+}
+function editableArtifactScope(input) {
+  return Object.freeze({
+    accountId: boundedIdentity(input.accountId, "account id"),
+    workspaceId: boundedIdentity(input.workspaceId, "workspace id")
+  });
+}
+function boundedIdentity(value, label) {
+  if (value.length < 1 || value.length > 256 || value.trim() !== value || !isWellFormedPersistedText(value)) {
+    throw new TypeError(`${label} must contain 1-256 non-padding characters`);
+  }
+  return value;
+}
+function boundedActorIdentity(value, label) {
+  const byteLength = new TextEncoder().encode(value).byteLength;
+  if (value.length < 1 || value.length > 256 || byteLength > 1024 || value.trim() !== value || !isWellFormedPersistedText(value)) {
+    throw new TypeError(
+      `${label} must contain 1-256 well-formed non-padding characters and at most 1024 UTF-8 bytes`
+    );
+  }
+  return value;
+}
+function isWellFormedPersistedText(value) {
+  if (value.includes("\0")) return false;
+  for (let index = 0; index < value.length; index += 1) {
+    const codeUnit = value.charCodeAt(index);
+    if (codeUnit >= 55296 && codeUnit <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (!Number.isFinite(next) || next < 56320 || next > 57343) return false;
+      index += 1;
+    } else if (codeUnit >= 56320 && codeUnit <= 57343) {
+      return false;
+    }
+  }
+  return true;
+}
+function validateEditableArtifactActor(actor) {
+  const record = exactPlainDataRecord(actor, "editable artifact actor");
+  const kind = ownDataValue(record, "kind", "editable artifact actor");
+  const allowed = kind === "human" ? ["kind", "subjectId", "replicaId"] : kind === "agent" ? ["kind", "subjectId", "replicaId", "sessionId", "turnId", "attemptId", "generation"] : kind === "service" ? ["kind", "subjectId", "replicaId", "service"] : null;
+  if (!allowed) throw new TypeError("editable artifact actor kind is invalid");
+  const names = Object.getOwnPropertyNames(record);
+  if (names.length !== allowed.length || names.some((name) => !allowed.includes(name))) {
+    throw new TypeError("editable artifact actor contains missing or unknown properties");
+  }
+  const subjectId = ownDataValue(record, "subjectId", "editable artifact actor");
+  const replicaId = ownDataValue(record, "replicaId", "editable artifact actor");
+  if (typeof subjectId !== "string" || typeof replicaId !== "string") {
+    throw new TypeError("editable artifact actor identity is malformed");
+  }
+  boundedActorIdentity(subjectId, "actor subject id");
+  editableArtifactReplicaId(replicaId);
+  if (kind === "agent") {
+    const sessionId = ownDataValue(record, "sessionId", "agent actor");
+    const turnId = ownDataValue(record, "turnId", "agent actor");
+    const attemptId = ownDataValue(record, "attemptId", "agent actor");
+    const generation = ownDataValue(record, "generation", "agent actor");
+    if (typeof sessionId !== "string" || typeof turnId !== "string" || typeof attemptId !== "string" || typeof generation !== "number") {
+      throw new TypeError("editable artifact agent actor is malformed");
+    }
+    boundedActorIdentity(sessionId, "agent session id");
+    boundedActorIdentity(turnId, "agent turn id");
+    boundedActorIdentity(attemptId, "agent attempt id");
+    assertNonnegativeSafeInteger(generation, "agent generation");
+  } else if (kind === "service") {
+    const service = ownDataValue(record, "service", "service actor");
+    if (typeof service !== "string") {
+      throw new TypeError("editable artifact service actor is malformed");
+    }
+    boundedActorIdentity(service, "service name");
+  }
+}
+function exactPlainDataRecord(value, label) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new TypeError(`${label} must be a plain data object`);
+  }
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) {
+    throw new TypeError(`${label} must be a plain data object`);
+  }
+  if (Object.getOwnPropertySymbols(value).length > 0) {
+    throw new TypeError(`${label} must not contain symbol properties`);
+  }
+  return value;
+}
+function ownDataValue(record, key, label) {
+  const descriptor = Object.getOwnPropertyDescriptor(record, key);
+  if (!descriptor || !("value" in descriptor) || descriptor.enumerable !== true || descriptor.value === void 0) {
+    throw new TypeError(`${label} property ${key} must be own data`);
+  }
+  return descriptor.value;
+}
+function editableArtifactActorKey(actor) {
+  validateEditableArtifactActor(actor);
+  let actorKey;
+  switch (actor.kind) {
+    case "human":
+      actorKey = JSON.stringify([actor.kind, actor.subjectId]);
+      break;
+    case "agent":
+      actorKey = JSON.stringify([
+        actor.kind,
+        actor.subjectId,
+        actor.sessionId,
+        actor.turnId,
+        actor.attemptId,
+        actor.generation
+      ]);
+      break;
+    case "service":
+      actorKey = JSON.stringify([actor.kind, actor.subjectId, actor.service]);
+      break;
+    default:
+      throw new TypeError("editable artifact actor kind is invalid");
+  }
+  if (new TextEncoder().encode(actorKey).byteLength > 8192) {
+    throw new TypeError("editable artifact actor key exceeds 8192 UTF-8 bytes");
+  }
+  return actorKey;
+}
+function editableArtifactCausalFrontier(entries) {
+  const seen = /* @__PURE__ */ new Set();
+  const normalized = [...entries].map((entry) => {
+    const replicaId = editableArtifactReplicaId(entry.replicaId);
+    assertPositiveSafeInteger(entry.counter, `causal counter for ${replicaId}`);
+    if (seen.has(replicaId)) throw new TypeError(`duplicate causal replica: ${replicaId}`);
+    seen.add(replicaId);
+    return Object.freeze({ replicaId, counter: entry.counter });
+  });
+  normalized.sort((left, right) => compareCodeUnits(left.replicaId, right.replicaId));
+  return Object.freeze(normalized);
+}
+function causalCounter(frontier, replicaId) {
+  return frontier.find((entry) => entry.replicaId === replicaId)?.counter ?? 0;
+}
+function causalFrontierDominates(candidate, required) {
+  return required.every((entry) => causalCounter(candidate, entry.replicaId) >= entry.counter);
+}
+function causalFrontiersEqual(left, right) {
+  return left.length === right.length && left.every(
+    (entry, index) => entry.replicaId === right[index]?.replicaId && entry.counter === right[index]?.counter
+  );
+}
+function mergeCausalFrontiers(...frontiers) {
+  const counters = /* @__PURE__ */ new Map();
+  for (const frontier of frontiers) {
+    for (const entry of frontier) {
+      counters.set(entry.replicaId, Math.max(counters.get(entry.replicaId) ?? 0, entry.counter));
+    }
+  }
+  return editableArtifactCausalFrontier(
+    [...counters].map(([replicaId, counter]) => ({ replicaId, counter }))
+  );
+}
+var EDITABLE_ARTIFACT_ORIGINAL_IMPORT_MAX_BYTES = 64 * 1024 * 1024;
+function assertNonnegativeSafeInteger(value, label) {
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new TypeError(`${label} must be a nonnegative safe integer`);
+  }
+}
+function assertPositiveSafeInteger(value, label) {
+  if (!Number.isSafeInteger(value) || value < 1) {
+    throw new TypeError(`${label} must be a positive safe integer`);
+  }
+}
+function assertIsoTimestamp(value, label) {
+  if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value) || !Number.isFinite(Date.parse(value)) || new Date(value).toISOString() !== value) {
+    throw new TypeError(`${label} must be a canonical UTC ISO timestamp`);
+  }
+}
+function assertBoundedArtifactTitle(value) {
+  const bytes = new TextEncoder().encode(value).byteLength;
+  if (bytes < 1 || bytes > 512 || value.trim() !== value || !isWellFormedPersistedText(value)) {
+    throw new TypeError("artifact title must contain 1-512 UTF-8 bytes without padding");
+  }
+}
+function assertBoundedOpaqueReference(value, label) {
+  const bytes = new TextEncoder().encode(value).byteLength;
+  if (bytes < 1 || bytes > 1024 || value.trim() !== value || !isWellFormedPersistedText(value)) {
+    throw new TypeError(`${label} must contain 1-1024 UTF-8 bytes without padding`);
+  }
+}
+function assertBoundedKernelVersion(value) {
+  if (typeof value !== "string") {
+    throw new TypeError("kernel version must be a string");
+  }
+  const bytes = new TextEncoder().encode(value).byteLength;
+  if (bytes < 1 || bytes > EDITABLE_ARTIFACT_KERNEL_VERSION_MAX_BYTES || value.trim() !== value || !isWellFormedPersistedText(value)) {
+    throw new TypeError(
+      `kernel version must contain 1-${EDITABLE_ARTIFACT_KERNEL_VERSION_MAX_BYTES} well-formed UTF-8 bytes without padding`
+    );
+  }
+}
+function compareCodeUnits(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+
+// src/domain/editable-artifacts/errors.ts
+var EditableArtifactDomainError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "EditableArtifactDomainError";
+  }
+};
+var EditableArtifactNotFoundError = class extends EditableArtifactDomainError {
+  constructor() {
+    super("not_found", "Editable artifact was not found in the requested tenant scope");
+  }
+};
+var EditableArtifactInvalidRequestError = class extends EditableArtifactDomainError {
+  constructor(message) {
+    super("invalid_request", message);
+  }
+};
+var EditableArtifactForbiddenError = class extends EditableArtifactDomainError {
+  constructor(permission) {
+    super("forbidden", `Editable artifact permission denied: ${permission}`);
+  }
+};
+var EditableArtifactNotEditableError = class extends EditableArtifactDomainError {
+  constructor(state) {
+    super("not_editable", `Editable artifact cannot be changed while ${state}`);
+  }
+};
+var EditableArtifactIdempotencyConflictError = class extends EditableArtifactDomainError {
+  constructor() {
+    super(
+      "idempotency_conflict",
+      "Client transaction id was already committed with a different request hash"
+    );
+  }
+};
+var EditableArtifactRequestHashMismatchError = class extends EditableArtifactDomainError {
+  constructor() {
+    super("request_hash_mismatch", "Request hash does not match the canonical transaction body");
+  }
+};
+var EditableArtifactCausalFutureError = class extends EditableArtifactDomainError {
+  constructor() {
+    super("causal_future", "Causal base references state beyond the authoritative frontier");
+  }
+};
+var EditableArtifactCausalChainError = class extends EditableArtifactDomainError {
+  constructor(message) {
+    super("causal_chain_conflict", message);
+  }
+};
+var EditableArtifactStaleBaseError = class extends EditableArtifactDomainError {
+  constructor() {
+    super("stale_base", "Editable artifact changed after this transaction observed its base");
+  }
+};
+var EditableArtifactKernelContractError = class extends EditableArtifactDomainError {
+  constructor(message) {
+    super("kernel_contract_violation", message);
+  }
+};
+var EditableArtifactRetryableConflictError = class extends EditableArtifactDomainError {
+  constructor() {
+    super(
+      "retryable_conflict",
+      "Editable artifact changed repeatedly while applying the transaction; retry the same client transaction"
+    );
+  }
+};
+var EditableArtifactUndoTargetError = class extends EditableArtifactDomainError {
+  constructor(message) {
+    super("invalid_undo_target", message);
+  }
+};
+var EditableArtifactSnapshotConflictError = class extends EditableArtifactDomainError {
+  constructor(message) {
+    super("snapshot_conflict", message);
+  }
+};
+var EditableArtifactOutboxLeaseConflictError = class extends EditableArtifactDomainError {
+  constructor() {
+    super("outbox_lease_conflict", "Live outbox record is not leased by this publisher");
+  }
+};
+
+// src/domain/editable-artifacts/hash.ts
+import { createHash } from "crypto";
+import {
+  assertEditableArtifactRequestHash,
+  decodeEditableArtifactMutationIntent,
+  hashEditableArtifactMutationIntentBytes
+} from "@opengeni/contracts/editable-artifacts";
+var CREATE_HASH_DOMAIN = new TextEncoder().encode("OpenGeni editable artifact create\0v1\0");
+var IMPORT_HASH_DOMAIN = new TextEncoder().encode("OpenGeni editable artifact import\0v1\0");
+function hashEditableArtifactCreateRequest(request) {
+  if (request.modality !== "spreadsheet" && request.modality !== "presentation" && request.modality !== "document") {
+    throw new TypeError("Unknown editable artifact modality");
+  }
+  assertBoundedArtifactTitle(request.title);
+  const digest = createHash("sha256");
+  digest.update(CREATE_HASH_DOMAIN);
+  updateLengthFramedUtf8(digest, request.modality);
+  updateLengthFramedUtf8(digest, request.title);
+  return editableArtifactRequestHash(`sha256:${digest.digest("hex")}`);
+}
+function hashEditableArtifactImportRequest(request) {
+  assertImportRequestShape(request);
+  const digest = createHash("sha256");
+  digest.update(IMPORT_HASH_DOMAIN);
+  updateLengthFramedUtf8(digest, request.modality);
+  updateLengthFramedUtf8(digest, request.title);
+  updateLengthFramedUtf8(digest, request.originalImport.fileId);
+  updateLengthFramedUtf8(digest, String(request.originalImport.byteSize));
+  updateLengthFramedUtf8(digest, request.originalImport.contentHash);
+  updateLengthFramedUtf8(digest, request.originalImport.mimeType);
+  updateLengthFramedUtf8(digest, String(request.snapshot.byteSize));
+  updateLengthFramedUtf8(digest, request.snapshot.contentHash);
+  updateLengthFramedUtf8(digest, request.snapshot.stateHash);
+  updateLengthFramedUtf8(digest, String(request.snapshot.modelSchemaVersion));
+  updateLengthFramedUtf8(digest, request.snapshot.kernelVersion);
+  if (request.snapshot.modality === "spreadsheet") {
+    updateLengthFramedUtf8(digest, String(request.snapshot.operationProtocolVersion));
+    updateLengthFramedUtf8(digest, String(request.snapshot.crdtStateVersion));
+    updateLengthFramedUtf8(digest, String(request.snapshot.coveredCausalFrontier.length));
+    for (const entry of request.snapshot.coveredCausalFrontier) {
+      updateLengthFramedUtf8(digest, entry.replicaId);
+      updateLengthFramedUtf8(digest, String(entry.counter));
+    }
+  } else {
+    updateLengthFramedUtf8(digest, String(request.snapshot.nativeRevision));
+  }
+  return editableArtifactRequestHash(`sha256:${digest.digest("hex")}`);
+}
+function assertImportRequestShape(request) {
+  if (request.modality !== "spreadsheet" && request.modality !== "presentation" && request.modality !== "document") {
+    throw new TypeError("Unknown editable artifact modality");
+  }
+  assertBoundedArtifactTitle(request.title);
+  if (request.snapshot.modality !== request.modality) {
+    throw new TypeError("Imported snapshot modality does not match the Office source");
+  }
+  const expectedMimeType = request.modality === "spreadsheet" ? "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" : request.modality === "document" ? "application/vnd.openxmlformats-officedocument.wordprocessingml.document" : "application/vnd.openxmlformats-officedocument.presentationml.presentation";
+  if (request.originalImport.mimeType !== expectedMimeType || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u.test(
+    request.originalImport.fileId
+  ) || !Number.isSafeInteger(request.originalImport.byteSize) || request.originalImport.byteSize <= 0) {
+    throw new TypeError("Imported Office source facts are malformed");
+  }
+}
+function updateLengthFramedUtf8(digest, value) {
+  const bytes = Buffer.from(value, "utf8");
+  const length = Buffer.allocUnsafe(4);
+  length.writeUInt32BE(bytes.byteLength);
+  digest.update(length);
+  digest.update(bytes);
+}
+var OgatxEditableArtifactMutationIntentCodec = class {
+  async decodeAndVerify(input) {
+    const intentBytes = input.intentBytes.slice();
+    const requestHash = assertEditableArtifactRequestHash(input.requestHash);
+    const actualHash = hashEditableArtifactMutationIntentBytes(intentBytes);
+    if (actualHash !== requestHash) {
+      throw new EditableArtifactRequestHashMismatchError();
+    }
+    return decodeEditableArtifactMutationIntent(intentBytes);
+  }
+};
+var ogatxEditableArtifactMutationIntentCodec = new OgatxEditableArtifactMutationIntentCodec();
+
+// src/domain/editable-artifacts/snapshot-verifier.ts
+import { createHash as createHash2 } from "crypto";
+import {
+  BoundedObjectReadError,
+  MAX_BOUNDED_OBJECT_CHUNK_BYTES
+} from "@opengeni/storage";
+import { decodeEditableArtifactSerializedCommit } from "@opengeni/contracts/editable-artifact-serialized-commit";
+import { EDITABLE_ARTIFACT_PRODUCT_MAX_SNAPSHOT_BYTES } from "@opengeni/contracts/editable-artifacts";
+var MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES = EDITABLE_ARTIFACT_PRODUCT_MAX_SNAPSHOT_BYTES;
+var MAX_EDITABLE_ARTIFACT_SNAPSHOT_TAIL_BYTES = 256 * 1024 * 1024;
+var MAX_EDITABLE_ARTIFACT_SNAPSHOT_TAIL_SEGMENTS = 1e5;
+var MAX_EDITABLE_ARTIFACT_SNAPSHOT_TAIL_SEGMENT_BYTES = 8 * 1024 * 1024;
+var EditableArtifactSnapshotVerificationError = class extends Error {
+  code;
+  constructor(code) {
+    super(snapshotErrorMessage(code));
+    this.name = "EditableArtifactSnapshotVerificationError";
+    this.code = code;
+  }
+};
+var ProductionEditableArtifactSnapshotVerifier = class {
+  #dependencies;
+  constructor(dependencies) {
+    const maxSnapshotBytes = dependencies.maxSnapshotBytes ?? MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES;
+    const maxReplayBytes = dependencies.maxReplayBytes ?? MAX_EDITABLE_ARTIFACT_SNAPSHOT_TAIL_BYTES;
+    const maxReplaySegments = dependencies.maxReplaySegments ?? MAX_EDITABLE_ARTIFACT_SNAPSHOT_TAIL_SEGMENTS;
+    const snapshotChunkBytes = dependencies.snapshotChunkBytes ?? 1024 * 1024;
+    for (const value of [maxSnapshotBytes, maxReplayBytes, maxReplaySegments, snapshotChunkBytes]) {
+      if (!Number.isSafeInteger(value) || value <= 0) {
+        throw new TypeError("Snapshot verifier limits must be positive safe integers");
+      }
+    }
+    if (maxSnapshotBytes > MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES || maxReplayBytes > MAX_EDITABLE_ARTIFACT_SNAPSHOT_TAIL_BYTES || maxReplaySegments > MAX_EDITABLE_ARTIFACT_SNAPSHOT_TAIL_SEGMENTS || snapshotChunkBytes > MAX_BOUNDED_OBJECT_CHUNK_BYTES) {
+      throw new TypeError("Snapshot verifier limits exceed absolute safety bounds");
+    }
+    this.#dependencies = Object.freeze({
+      objects: dependencies.objects,
+      kernel: dependencies.kernel,
+      replayPlans: dependencies.replayPlans,
+      maxSnapshotBytes,
+      maxReplayBytes,
+      maxReplaySegments,
+      snapshotChunkBytes
+    });
+  }
+  async verify(input) {
+    throwIfCancelled(input.signal);
+    const scope = validateScope(input.scope);
+    const artifactId = editableArtifactId(input.artifactId);
+    const snapshot = input.snapshot;
+    if (snapshot.byteSize > this.#dependencies.maxSnapshotBytes) {
+      throw new EditableArtifactSnapshotVerificationError("limit_exceeded");
+    }
+    let object;
+    try {
+      object = await this.#dependencies.objects.open({
+        opaqueReference: snapshot.blobReference,
+        maxBytes: this.#dependencies.maxSnapshotBytes,
+        expectedByteSize: snapshot.byteSize,
+        ...input.signal ? { signal: input.signal } : {}
+      });
+      if (object.contentType !== void 0 && object.contentType !== snapshot.mimeType) {
+        throw new EditableArtifactSnapshotVerificationError("content_type_mismatch");
+      }
+      const sourceDigest = createHash2("sha256");
+      let sourceBytes = 0;
+      let sourceFinished = false;
+      const sourceChunks = meterSnapshotChunks(
+        object.chunks({
+          chunkBytes: this.#dependencies.snapshotChunkBytes,
+          ...input.signal ? { signal: input.signal } : {}
+        }),
+        snapshot.byteSize,
+        (chunk) => {
+          sourceBytes += chunk.byteLength;
+          sourceDigest.update(chunk);
+        },
+        () => {
+          sourceFinished = true;
+        }
+      );
+      const replayPlan = this.#dependencies.replayPlans ? await this.#dependencies.replayPlans.resolve({
+        scope,
+        artifactId,
+        snapshot,
+        ...input.signal ? { signal: input.signal } : {}
+      }) : null;
+      const normalizedReplay = replayPlan ? validateReplayPlan(
+        replayPlan,
+        snapshot,
+        this.#dependencies.maxReplayBytes,
+        this.#dependencies.maxReplaySegments,
+        input.signal
+      ) : void 0;
+      const result = await this.#dependencies.kernel.verifyAndReconstruct({
+        scope,
+        artifactId,
+        modality: snapshot.modality,
+        expectedSnapshot: snapshot,
+        snapshotChunks: sourceChunks,
+        expectedSnapshotByteSize: snapshot.byteSize,
+        ...normalizedReplay ? { replayPlan: normalizedReplay.replayPlan } : {},
+        ...input.signal ? { signal: input.signal } : {}
+      });
+      throwIfCancelled(input.signal);
+      if (!sourceFinished || sourceBytes !== snapshot.byteSize) {
+        throw new EditableArtifactSnapshotVerificationError("truncated");
+      }
+      const sourceHash = editableArtifactContentHash(`sha256:${sourceDigest.digest("hex")}`);
+      if (sourceHash !== snapshot.contentHash) {
+        throw new EditableArtifactSnapshotVerificationError("content_hash_mismatch");
+      }
+      normalizedReplay?.assertConsumed();
+      validateKernelResult(result, scope, artifactId, snapshot, normalizedReplay?.replayPlan);
+      await object.assertUnchanged(input.signal);
+    } catch (error) {
+      throw mapVerificationFailure(error, input.signal);
+    } finally {
+      await object?.close();
+    }
+  }
+};
+function meterSnapshotChunks(chunks, expectedBytes, onChunk, onFinished) {
+  return {
+    async *[Symbol.asyncIterator]() {
+      let bytes = 0;
+      for await (const chunk of chunks) {
+        if (!(chunk instanceof Uint8Array) || chunk.byteLength === 0) {
+          throw new EditableArtifactSnapshotVerificationError("truncated");
+        }
+        bytes += chunk.byteLength;
+        if (bytes > expectedBytes) {
+          throw new EditableArtifactSnapshotVerificationError("limit_exceeded");
+        }
+        onChunk(chunk);
+        yield chunk;
+      }
+      if (bytes !== expectedBytes) {
+        throw new EditableArtifactSnapshotVerificationError("truncated");
+      }
+      onFinished();
+    }
+  };
+}
+function validateReplayPlan(plan, snapshot, maxBytes, maxSegments, signal) {
+  if (plan.modality !== snapshot.modality || !Number.isSafeInteger(plan.baseHeadSequence) || !Number.isSafeInteger(plan.targetHeadSequence) || plan.baseHeadSequence !== snapshot.coveredHeadSequence || plan.targetHeadSequence < plan.baseHeadSequence) {
+    throw new EditableArtifactSnapshotVerificationError("replay_invalid");
+  }
+  const targetStateHash = editableArtifactStateHash(plan.targetStateHash);
+  if (plan.modality !== "spreadsheet" && (!Number.isSafeInteger(plan.targetNativeRevision) || plan.targetNativeRevision < 0)) {
+    throw new EditableArtifactSnapshotVerificationError("replay_invalid");
+  }
+  let consumed = false;
+  const segments = meterReplaySegments(
+    plan.segments,
+    snapshot,
+    plan,
+    maxBytes,
+    maxSegments,
+    signal,
+    () => {
+      consumed = true;
+    }
+  );
+  const replayPlan = plan.modality === "spreadsheet" ? Object.freeze({
+    modality: "spreadsheet",
+    baseHeadSequence: plan.baseHeadSequence,
+    targetHeadSequence: plan.targetHeadSequence,
+    targetCausalFrontier: editableArtifactCausalFrontier(plan.targetCausalFrontier),
+    targetStateHash,
+    segments
+  }) : Object.freeze({
+    modality: plan.modality,
+    baseHeadSequence: plan.baseHeadSequence,
+    targetHeadSequence: plan.targetHeadSequence,
+    targetNativeRevision: plan.targetNativeRevision,
+    targetStateHash,
+    segments
+  });
+  return Object.freeze({
+    replayPlan,
+    assertConsumed() {
+      if (!consumed) {
+        throw new EditableArtifactSnapshotVerificationError("replay_invalid");
+      }
+    }
+  });
+}
+function meterReplaySegments(segments, snapshot, plan, maxBytes, maxSegments, signal, onFinished) {
+  return {
+    async *[Symbol.asyncIterator]() {
+      let expectedSequence = plan.baseHeadSequence + 1;
+      let nativeRevision = snapshot.modality === "spreadsheet" ? null : snapshot.nativeRevision;
+      let priorStateHash = snapshot.stateHash;
+      let totalBytes = 0;
+      let count = 0;
+      for await (const segment of segments) {
+        throwIfCancelled(signal);
+        count += 1;
+        if (count > maxSegments) {
+          throw new EditableArtifactSnapshotVerificationError("limit_exceeded");
+        }
+        if (!Number.isSafeInteger(segment.sequenceStart) || !Number.isSafeInteger(segment.sequenceEnd) || segment.sequenceStart !== expectedSequence || segment.sequenceEnd < segment.sequenceStart || segment.sequenceEnd > plan.targetHeadSequence || segment.modality !== snapshot.modality || !(segment.bytes instanceof Uint8Array) || segment.bytes.byteLength < 1 || segment.bytes.byteLength > MAX_EDITABLE_ARTIFACT_SNAPSHOT_TAIL_SEGMENT_BYTES) {
+          throw new EditableArtifactSnapshotVerificationError("replay_invalid");
+        }
+        totalBytes += segment.bytes.byteLength;
+        if (totalBytes > maxBytes) {
+          throw new EditableArtifactSnapshotVerificationError("limit_exceeded");
+        }
+        const hash = editableArtifactContentHash(
+          `sha256:${createHash2("sha256").update(segment.bytes).digest("hex")}`
+        );
+        if (hash !== segment.contentHash) {
+          throw new EditableArtifactSnapshotVerificationError("replay_invalid");
+        }
+        if (snapshot.modality === "spreadsheet") {
+          if (segment.modality !== "spreadsheet" || segment.operationProtocolVersion !== snapshot.operationProtocolVersion) {
+            throw new EditableArtifactSnapshotVerificationError("replay_invalid");
+          }
+        } else {
+          if (segment.modality !== snapshot.modality || segment.sequenceEnd !== segment.sequenceStart) {
+            throw new EditableArtifactSnapshotVerificationError("replay_invalid");
+          }
+          try {
+            const summary = decodeEditableArtifactSerializedCommit(
+              segment.bytes,
+              snapshot.modality
+            );
+            if (summary.parentHeadSequence !== segment.sequenceStart - 1 || summary.resultHeadSequence !== segment.sequenceEnd || summary.priorNativeRevision !== nativeRevision || summary.priorStateHash !== priorStateHash) {
+              throw new EditableArtifactSnapshotVerificationError("replay_invalid");
+            }
+            nativeRevision = summary.nativeReceipt.revision;
+            priorStateHash = editableArtifactStateHash(summary.stateHash);
+          } catch (error) {
+            if (error instanceof EditableArtifactSnapshotVerificationError) throw error;
+            throw new EditableArtifactSnapshotVerificationError("replay_invalid");
+          }
+        }
+        expectedSequence = segment.sequenceEnd + 1;
+        yield segment.modality === "spreadsheet" ? Object.freeze({
+          ...segment,
+          modality: "spreadsheet",
+          bytes: segment.bytes.slice()
+        }) : Object.freeze({
+          ...segment,
+          modality: segment.modality,
+          bytes: segment.bytes.slice()
+        });
+      }
+      if (expectedSequence !== plan.targetHeadSequence + 1) {
+        throw new EditableArtifactSnapshotVerificationError("replay_invalid");
+      }
+      if (plan.modality !== "spreadsheet" && (nativeRevision !== plan.targetNativeRevision || priorStateHash !== plan.targetStateHash)) {
+        throw new EditableArtifactSnapshotVerificationError("replay_invalid");
+      }
+      onFinished();
+    }
+  };
+}
+function validateKernelResult(result, scope, artifactId, snapshot, replayPlan) {
+  if (result.canonicalReencodeVerified !== true || result.modality !== snapshot.modality || result.canonicalByteSize !== snapshot.byteSize || result.canonicalContentHash !== snapshot.contentHash) {
+    throw new EditableArtifactSnapshotVerificationError("canonical_mismatch");
+  }
+  if (result.scope.accountId !== scope.accountId || result.scope.workspaceId !== scope.workspaceId || result.artifactId !== artifactId) {
+    throw new EditableArtifactSnapshotVerificationError("identity_mismatch");
+  }
+  if (result.coveredHeadSequence !== snapshot.coveredHeadSequence) {
+    throw new EditableArtifactSnapshotVerificationError("coverage_mismatch");
+  }
+  if (editableArtifactStateHash(result.stateHash) !== snapshot.stateHash) {
+    throw new EditableArtifactSnapshotVerificationError("state_hash_mismatch");
+  }
+  if (result.modelSchemaVersion !== snapshot.modelSchemaVersion || result.kernelVersion !== snapshot.kernelVersion) {
+    throw new EditableArtifactSnapshotVerificationError("version_mismatch");
+  }
+  if (snapshot.modality === "spreadsheet") {
+    if (result.modality !== "spreadsheet" || result.fullCrdtStateVerified !== true || !causalFrontiersEqual(
+      editableArtifactCausalFrontier(result.coveredCausalFrontier),
+      snapshot.coveredCausalFrontier
+    )) {
+      throw new EditableArtifactSnapshotVerificationError("frontier_mismatch");
+    }
+    if (result.operationProtocolVersion !== snapshot.operationProtocolVersion || result.crdtStateVersion !== snapshot.crdtStateVersion) {
+      throw new EditableArtifactSnapshotVerificationError("version_mismatch");
+    }
+    if (replayPlan) {
+      if (replayPlan.modality !== "spreadsheet" || !result.replayedTarget || result.replayedTarget.headSequence !== replayPlan.targetHeadSequence || editableArtifactStateHash(result.replayedTarget.stateHash) !== replayPlan.targetStateHash || !causalFrontiersEqual(
+        editableArtifactCausalFrontier(result.replayedTarget.causalFrontier),
+        replayPlan.targetCausalFrontier
+      )) {
+        throw new EditableArtifactSnapshotVerificationError("replay_invalid");
+      }
+    } else if (result.replayedTarget !== void 0) {
+      throw new EditableArtifactSnapshotVerificationError("replay_invalid");
+    }
+    return;
+  }
+  if (result.modality !== snapshot.modality || result.nativeRevision !== snapshot.nativeRevision) {
+    throw new EditableArtifactSnapshotVerificationError("version_mismatch");
+  }
+  if (replayPlan) {
+    if (replayPlan.modality !== snapshot.modality || !result.replayedTarget || result.replayedTarget.headSequence !== replayPlan.targetHeadSequence || result.replayedTarget.nativeRevision !== replayPlan.targetNativeRevision || editableArtifactStateHash(result.replayedTarget.stateHash) !== replayPlan.targetStateHash) {
+      throw new EditableArtifactSnapshotVerificationError("replay_invalid");
+    }
+  } else if (result.replayedTarget !== void 0) {
+    throw new EditableArtifactSnapshotVerificationError("replay_invalid");
+  }
+}
+function validateScope(scope) {
+  if (typeof scope.accountId !== "string" || scope.accountId.length < 1 || typeof scope.workspaceId !== "string" || scope.workspaceId.length < 1) {
+    throw new EditableArtifactSnapshotVerificationError("identity_mismatch");
+  }
+  return Object.freeze({
+    accountId: scope.accountId,
+    workspaceId: scope.workspaceId
+  });
+}
+function throwIfCancelled(signal) {
+  if (signal?.aborted) {
+    throw new EditableArtifactSnapshotVerificationError("cancelled");
+  }
+}
+function mapVerificationFailure(error, signal) {
+  if (error instanceof EditableArtifactSnapshotVerificationError) return error;
+  if (signal?.aborted) {
+    return new EditableArtifactSnapshotVerificationError("cancelled");
+  }
+  if (error instanceof BoundedObjectReadError) {
+    switch (error.code) {
+      case "aborted":
+        return new EditableArtifactSnapshotVerificationError("cancelled");
+      case "object_changed":
+        return new EditableArtifactSnapshotVerificationError("object_changed");
+      case "object_missing":
+        return new EditableArtifactSnapshotVerificationError("object_missing");
+      case "size_limit":
+        return new EditableArtifactSnapshotVerificationError("limit_exceeded");
+      case "truncated":
+        return new EditableArtifactSnapshotVerificationError("truncated");
+      case "backend_failure":
+      case "invalid_request":
+        return new EditableArtifactSnapshotVerificationError("storage_failure");
+    }
+  }
+  return new EditableArtifactSnapshotVerificationError("kernel_rejected");
+}
+function snapshotErrorMessage(code) {
+  switch (code) {
+    case "cancelled":
+      return "Snapshot verification was cancelled";
+    case "canonical_mismatch":
+      return "Snapshot is not the canonical kernel encoding";
+    case "content_hash_mismatch":
+      return "Snapshot content digest does not match immutable metadata";
+    case "content_type_mismatch":
+      return "Snapshot content type does not match immutable metadata";
+    case "coverage_mismatch":
+      return "Snapshot coverage does not match embedded state";
+    case "frontier_mismatch":
+      return "Snapshot causal frontier does not match embedded state";
+    case "identity_mismatch":
+      return "Snapshot authority identity does not match embedded state";
+    case "kernel_rejected":
+      return "Authoritative kernel rejected the snapshot";
+    case "limit_exceeded":
+      return "Snapshot exceeds a verification limit";
+    case "object_changed":
+      return "Snapshot object changed during verification";
+    case "object_missing":
+      return "Snapshot object is unavailable";
+    case "replay_invalid":
+      return "Snapshot operation-tail reconstruction is invalid";
+    case "state_hash_mismatch":
+      return "Snapshot state hash does not match reconstructed state";
+    case "storage_failure":
+      return "Snapshot object could not be read safely";
+    case "truncated":
+      return "Snapshot object is truncated";
+    case "version_mismatch":
+      return "Snapshot kernel or schema versions are incompatible";
+  }
+}
+
+// src/domain/editable-artifacts/service.ts
+import {
+  EDITABLE_ARTIFACT_COMMAND_MAX_BYTES,
+  EDITABLE_ARTIFACT_INTENT_MAX_BYTES,
+  EDITABLE_ARTIFACT_INTENT_MAX_UNDO_TARGETS,
+  EDITABLE_ARTIFACT_INTENT_VERSION,
+  EDITABLE_ARTIFACT_KERNEL_VERSION_MAX_BYTES as EDITABLE_ARTIFACT_KERNEL_VERSION_MAX_BYTES2
+} from "@opengeni/contracts/editable-artifacts";
+import {
+  COMMITTED_TRANSACTION_PROTOCOL_VERSION,
+  MAX_COMMITTED_TRANSACTION_BYTES,
+  MAX_COMMITTED_TRANSACTION_OPERATIONS,
+  decodeCommittedTransactionSummary
+} from "@opengeni/contracts/editable-artifact-committed-transaction";
+import {
+  EDITABLE_ARTIFACT_SERIALIZED_COMMIT_VERSION,
+  decodeEditableArtifactSerializedCommit as decodeEditableArtifactSerializedCommit2,
+  encodeEditableArtifactSerializedCommit
+} from "@opengeni/contracts/editable-artifact-serialized-commit";
+import { editableArtifactCodecFor } from "@opengeni/contracts/editable-artifact-codec-registry";
+var EDITABLE_ARTIFACT_MAX_OPERATIONS_PER_TRANSACTION = MAX_COMMITTED_TRANSACTION_OPERATIONS;
+var EDITABLE_ARTIFACT_MAX_UNDO_TARGETS_PER_TRANSACTION = Math.min(
+  EDITABLE_ARTIFACT_INTENT_MAX_UNDO_TARGETS,
+  MAX_COMMITTED_TRANSACTION_OPERATIONS
+);
+var EDITABLE_ARTIFACT_MAX_COMMAND_BYTES_PER_TRANSACTION = EDITABLE_ARTIFACT_COMMAND_MAX_BYTES;
+var EDITABLE_ARTIFACT_MAX_INTENT_BYTES_PER_TRANSACTION = EDITABLE_ARTIFACT_INTENT_MAX_BYTES;
+var EDITABLE_ARTIFACT_INTENT_PROTOCOL_VERSION = 1;
+var EDITABLE_ARTIFACT_MAX_OPERATION_BYTES_PER_TRANSACTION = MAX_COMMITTED_TRANSACTION_BYTES;
+var EDITABLE_ARTIFACT_MAX_COMMITTED_TRANSACTION_BYTES = EDITABLE_ARTIFACT_MAX_OPERATION_BYTES_PER_TRANSACTION;
+var EDITABLE_ARTIFACT_OPERATION_PROTOCOL_VERSION = COMMITTED_TRANSACTION_PROTOCOL_VERSION;
+var EDITABLE_ARTIFACT_MAX_COMMIT_ATTEMPTS = 4;
+var EDITABLE_ARTIFACT_COMPACTION_TRANSACTION_THRESHOLD = 1024;
+var EDITABLE_ARTIFACT_COMPACTION_BYTE_THRESHOLD = 16 * 1024 * 1024;
+var EditableArtifactService = class {
+  constructor(dependencies) {
+    this.dependencies = dependencies;
+  }
+  inFlightCreations = /* @__PURE__ */ new Map();
+  inFlightTransactions = /* @__PURE__ */ new Map();
+  inFlightImports = /* @__PURE__ */ new Map();
+  inFlightCompactions = /* @__PURE__ */ new Map();
+  async createArtifact(input) {
+    const scope = editableArtifactScope(input.scope);
+    validateEditableArtifactActor(input.actor);
+    const actor = Object.freeze({ ...input.actor });
+    const request = normalizeCreateRequest(input.request);
+    const requestHash = hashEditableArtifactCreateRequest(request);
+    const authorityKey = editableArtifactActorKey(actor);
+    const inFlightKey = creationInFlightKey(scope, "create", authorityKey, request.idempotencyKey);
+    for (; ; ) {
+      const inFlight = this.inFlightCreations.get(inFlightKey);
+      if (inFlight) {
+        if (inFlight.requestHash === requestHash) {
+          const result = await inFlight.promise;
+          return copyCreateResult(result, true);
+        }
+        try {
+          await inFlight.promise;
+        } catch {
+          continue;
+        }
+        throw new EditableArtifactIdempotencyConflictError();
+      }
+      const promise = this.createArtifactOptimistically({
+        scope,
+        actor,
+        authorityKey,
+        request,
+        requestHash,
+        ...input.signal ? { signal: input.signal } : {}
+      });
+      this.inFlightCreations.set(inFlightKey, { requestHash, promise });
+      try {
+        return await promise;
+      } finally {
+        if (this.inFlightCreations.get(inFlightKey)?.promise === promise) {
+          this.inFlightCreations.delete(inFlightKey);
+        }
+      }
+    }
+  }
+  async createArtifactOptimistically(input) {
+    const { scope, actor, authorityKey, request, requestHash } = input;
+    const artifactId = editableArtifactId(this.dependencies.ids.next("artifact"));
+    let authorizationRevision = await this.requirePermission({
+      scope,
+      artifactId,
+      actor,
+      permission: "create"
+    });
+    const existing = await this.dependencies.store.findArtifactCreation(
+      scope,
+      "create",
+      authorityKey,
+      request.idempotencyKey
+    );
+    if (existing) {
+      if (existing.creationReceipt.requestHash !== requestHash) {
+        throw new EditableArtifactIdempotencyConflictError();
+      }
+      return copyCreateResult(existing, true);
+    }
+    const snapshotId = editableArtifactSnapshotId(this.dependencies.ids.next("snapshot"));
+    const candidate = validateSnapshotRequest(
+      await this.dependencies.genesis.prepare({
+        scope,
+        artifactId,
+        snapshotId,
+        modality: request.modality,
+        ...input.signal ? { signal: input.signal } : {}
+      })
+    );
+    if (candidate.snapshotId !== snapshotId || candidate.modality !== request.modality || candidate.coveredHeadSequence !== 0 || candidate.modality === "spreadsheet" && candidate.coveredCausalFrontier.length !== 0) {
+      throw new EditableArtifactKernelContractError(
+        "Genesis snapshot must use its assigned identity and empty modality boundary"
+      );
+    }
+    await this.dependencies.snapshotVerifier.verify({
+      scope,
+      artifactId,
+      actor,
+      snapshot: candidate
+    });
+    const publishedAt = canonicalNow(this.dependencies.clock);
+    if (Date.parse(candidate.verifiedAt) > Date.parse(publishedAt)) {
+      throw new EditableArtifactSnapshotConflictError(
+        "Snapshot verification time cannot be after publication"
+      );
+    }
+    const genesisSnapshot = Object.freeze({
+      ...candidate,
+      scope,
+      artifactId,
+      publishedAt
+    });
+    const receiptId = editableArtifactReceiptId(this.dependencies.ids.next("receipt"));
+    const outbox = snapshotOutboxRecord(
+      editableArtifactOutboxId(this.dependencies.ids.next("outbox")),
+      genesisSnapshot
+    );
+    for (let attempt = 1; attempt <= EDITABLE_ARTIFACT_MAX_COMMIT_ATTEMPTS; attempt += 1) {
+      const outcome = await this.dependencies.store.createArtifact({
+        scope,
+        artifactId,
+        authorizationActor: actor,
+        receiptId,
+        authorityKey,
+        idempotencyKey: request.idempotencyKey,
+        requestHash,
+        operationKind: "create",
+        expectedScopeAuthorizationRevision: authorizationRevision,
+        initialArtifactAuthorizationRevision: authorizationRevision,
+        modality: request.modality,
+        title: request.title,
+        createdBySubjectId: actor.subjectId,
+        genesisSnapshot,
+        outbox
+      });
+      if (outcome.kind === "result") return outcome.value;
+      authorizationRevision = await this.requirePermission({
+        scope,
+        artifactId,
+        actor,
+        permission: "create"
+      });
+    }
+    throw new EditableArtifactRetryableConflictError();
+  }
+  /**
+   * Publishes one verified Office import as the sequence-zero durable state.
+   * The caller may name immutable source/snapshot objects, but neither becomes
+   * authority until the native snapshot verifier and atomic store commit pass.
+   */
+  async importArtifact(input) {
+    const scope = editableArtifactScope(input.scope);
+    validateEditableArtifactActor(input.actor);
+    const actor = Object.freeze({ ...input.actor });
+    const request = normalizeImportRequest(input.request);
+    const requestHash = hashEditableArtifactImportRequest(request);
+    const authorityKey = editableArtifactActorKey(actor);
+    const inFlightKey = creationInFlightKey(scope, "import", authorityKey, request.idempotencyKey);
+    for (; ; ) {
+      const inFlight = this.inFlightImports.get(inFlightKey);
+      if (inFlight) {
+        if (inFlight.requestHash === requestHash) {
+          return copyCreateResult(await inFlight.promise, true);
+        }
+        try {
+          await inFlight.promise;
+        } catch {
+          continue;
+        }
+        throw new EditableArtifactIdempotencyConflictError();
+      }
+      const promise = this.importArtifactOptimistically({
+        scope,
+        actor,
+        authorityKey,
+        request,
+        requestHash,
+        ...input.signal ? { signal: input.signal } : {}
+      });
+      this.inFlightImports.set(inFlightKey, { requestHash, promise });
+      try {
+        return await promise;
+      } finally {
+        if (this.inFlightImports.get(inFlightKey)?.promise === promise) {
+          this.inFlightImports.delete(inFlightKey);
+        }
+      }
+    }
+  }
+  async importArtifactOptimistically(input) {
+    const { scope, actor, authorityKey, request, requestHash } = input;
+    const artifactId = editableArtifactId(this.dependencies.ids.next("artifact"));
+    let authorizationRevision = await this.requirePermission({
+      scope,
+      artifactId,
+      actor,
+      permission: "import"
+    });
+    const existing = await this.dependencies.store.findArtifactCreation(
+      scope,
+      "import",
+      authorityKey,
+      request.idempotencyKey
+    );
+    if (existing) {
+      if (existing.creationReceipt.requestHash !== requestHash) {
+        throw new EditableArtifactIdempotencyConflictError();
+      }
+      return copyCreateResult(existing, true);
+    }
+    const snapshotId = editableArtifactSnapshotId(this.dependencies.ids.next("snapshot"));
+    const verifiedAt = canonicalNow(this.dependencies.clock);
+    const candidate = validateSnapshotRequest({
+      ...request.snapshot,
+      snapshotId,
+      verifiedAt
+    });
+    if (candidate.modality !== request.modality || candidate.coveredHeadSequence !== 0) {
+      throw new EditableArtifactKernelContractError(
+        "Imported snapshot must use its assigned modality and sequence-zero boundary"
+      );
+    }
+    await this.dependencies.snapshotVerifier.verify({
+      scope,
+      artifactId,
+      actor,
+      snapshot: candidate
+    });
+    const publishedAt = canonicalNow(this.dependencies.clock);
+    if (Date.parse(candidate.verifiedAt) > Date.parse(publishedAt)) {
+      throw new EditableArtifactSnapshotConflictError(
+        "Snapshot verification time cannot be after publication"
+      );
+    }
+    const genesisSnapshot = Object.freeze({
+      ...candidate,
+      scope,
+      artifactId,
+      publishedAt
+    });
+    const receiptId = editableArtifactReceiptId(this.dependencies.ids.next("receipt"));
+    const originalImport = Object.freeze({
+      ...request.originalImport,
+      blobRefId: this.dependencies.ids.next("blob")
+    });
+    const outbox = snapshotOutboxRecord(
+      editableArtifactOutboxId(this.dependencies.ids.next("outbox")),
+      genesisSnapshot
+    );
+    for (let attempt = 1; attempt <= EDITABLE_ARTIFACT_MAX_COMMIT_ATTEMPTS; attempt += 1) {
+      const outcome = await this.dependencies.store.createArtifact({
+        scope,
+        artifactId,
+        authorizationActor: actor,
+        receiptId,
+        authorityKey,
+        idempotencyKey: request.idempotencyKey,
+        requestHash,
+        operationKind: "import",
+        expectedScopeAuthorizationRevision: authorizationRevision,
+        initialArtifactAuthorizationRevision: authorizationRevision,
+        modality: request.modality,
+        title: request.title,
+        createdBySubjectId: actor.subjectId,
+        genesisSnapshot,
+        originalImport,
+        outbox
+      });
+      if (outcome.kind === "result") return outcome.value;
+      authorizationRevision = await this.requirePermission({
+        scope,
+        artifactId,
+        actor,
+        permission: "import"
+      });
+    }
+    throw new EditableArtifactRetryableConflictError();
+  }
+  async getArtifact(input) {
+    const context = normalizeBoundaryContext(input);
+    let authorizationRevision = await this.requirePermission({
+      ...context,
+      permission: "read"
+    });
+    for (let attempt = 1; attempt <= EDITABLE_ARTIFACT_MAX_COMMIT_ATTEMPTS; attempt += 1) {
+      const outcome = await this.dependencies.store.readArtifactAtAuthorizationRevision(
+        context.scope,
+        context.artifactId,
+        authorizationRevision
+      );
+      if (outcome.kind === "result") {
+        if (!outcome.artifact) throw new EditableArtifactNotFoundError();
+        return outcome.artifact;
+      }
+      authorizationRevision = await this.requirePermission({
+        ...context,
+        permission: "read"
+      });
+    }
+    throw new EditableArtifactRetryableConflictError();
+  }
+  /**
+   * Resolve one actor-scoped durable mutation identity after an idempotency
+   * collision. Normal edits do not pay this read; agent transports use it to
+   * recover a committed receipt after a lost response without process state.
+   */
+  async findTransactionReceipt(input) {
+    const context = normalizeBoundaryContext(input);
+    await this.requirePermission({ ...context, permission: "edit" });
+    const result = await this.dependencies.store.readTransactionBasis(
+      context.scope,
+      context.artifactId,
+      {
+        actorKey: editableArtifactActorKey(context.actor),
+        clientTransactionId: editableArtifactClientTransactionId(input.clientTransactionId),
+        previousLocalTransactionId: null,
+        selectiveUndoOperationIds: Object.freeze([])
+      }
+    );
+    return result.kind === "existing" ? copyReceipt(result.receipt) : null;
+  }
+  /**
+   * Returns one detached, internally consistent reconstruction basis for an
+   * authorized current-head read. Inspection and compaction deliberately share
+   * this store primitive so neither can observe a metadata/snapshot/tail mix.
+   */
+  async readCurrentKernelState(input) {
+    const context = normalizeBoundaryContext(input);
+    let authorizationRevision = await this.requirePermission({
+      ...context,
+      permission: "read"
+    });
+    for (let attempt = 1; attempt <= EDITABLE_ARTIFACT_MAX_COMMIT_ATTEMPTS; attempt += 1) {
+      const outcome = await this.dependencies.store.readCurrentKernelState(
+        context.scope,
+        context.artifactId,
+        authorizationRevision
+      );
+      if (outcome.kind === "basis") return outcome.state;
+      authorizationRevision = await this.requirePermission({
+        ...context,
+        permission: "read"
+      });
+    }
+    throw new EditableArtifactRetryableConflictError();
+  }
+  async applyTransaction(input) {
+    const context = normalizeBoundaryContext(input);
+    const request = normalizeTransactionEnvelope(input.request);
+    const authorizationRevision = await this.requirePermission({
+      ...context,
+      permission: "edit"
+    });
+    const intent = normalizeMutationIntent(
+      await this.dependencies.intentCodec.decodeAndVerify({
+        intentBytes: request.intentBytes.slice(),
+        requestHash: request.requestHash
+      })
+    );
+    if (intent.artifactId !== context.artifactId) {
+      throw new EditableArtifactInvalidRequestError("Mutation intent is bound to another artifact");
+    }
+    if (intent.replicaId !== context.actor.replicaId) {
+      throw new EditableArtifactInvalidRequestError(
+        "Mutation intent is bound to another actor replica"
+      );
+    }
+    const intentBytes = request.intentBytes.slice();
+    const actorKey = editableArtifactActorKey(context.actor);
+    const inFlightKey = transactionInFlightKey(
+      context.scope,
+      context.artifactId,
+      actorKey,
+      intent.clientTransactionId
+    );
+    for (; ; ) {
+      const inFlight = this.inFlightTransactions.get(inFlightKey);
+      if (inFlight) {
+        if (inFlight.requestHash === request.requestHash) {
+          const result = await inFlight.promise;
+          return Object.freeze({
+            receipt: copyReceipt(result.receipt),
+            replayed: true
+          });
+        }
+        try {
+          await inFlight.promise;
+        } catch {
+        }
+        continue;
+      }
+      const promise = this.applyTransactionOptimistically({
+        context,
+        actorKey,
+        request,
+        intent,
+        intentBytes,
+        authorizationRevision
+      });
+      this.inFlightTransactions.set(inFlightKey, {
+        requestHash: request.requestHash,
+        promise
+      });
+      try {
+        return await promise;
+      } finally {
+        if (this.inFlightTransactions.get(inFlightKey)?.promise === promise) {
+          this.inFlightTransactions.delete(inFlightKey);
+        }
+      }
+    }
+  }
+  async applyTransactionOptimistically(input) {
+    const { context, actorKey, request, intent, intentBytes } = input;
+    let authorizationRevision = input.authorizationRevision;
+    for (let attempt = 1; attempt <= EDITABLE_ARTIFACT_MAX_COMMIT_ATTEMPTS; attempt += 1) {
+      const basisRead = await this.dependencies.store.readTransactionBasis(
+        context.scope,
+        context.artifactId,
+        {
+          actorKey,
+          clientTransactionId: intent.clientTransactionId,
+          previousLocalTransactionId: intent.previousLocalTransactionId,
+          selectiveUndoOperationIds: intent.selectiveUndoOperationIds
+        }
+      );
+      if (basisRead.kind === "existing") {
+        if (basisRead.receipt.requestHash !== request.requestHash) {
+          throw new EditableArtifactIdempotencyConflictError();
+        }
+        return Object.freeze({
+          receipt: copyReceipt(basisRead.receipt),
+          replayed: true
+        });
+      }
+      const basis = basisRead;
+      const artifact = basis.artifact;
+      if (artifact.authorizationRevision !== authorizationRevision) {
+        authorizationRevision = await this.requirePermission({
+          ...context,
+          permission: "edit"
+        });
+        continue;
+      }
+      if (request.expectedHead && (artifact.headSequence !== request.expectedHead.sequence || artifact.stateHash !== request.expectedHead.stateHash)) {
+        throw new EditableArtifactStaleBaseError();
+      }
+      if (artifact.lifecycle !== "active") {
+        throw new EditableArtifactNotEditableError(artifact.lifecycle);
+      }
+      if (this.dependencies.compaction && shouldCompactKernelState(basis.kernelState)) {
+        await this.compactCurrentHeadWithPermission(context, "edit");
+        continue;
+      }
+      validateIntentCommands(artifact, intent);
+      if (artifact.modality !== "spreadsheet") {
+        if (intent.observedHeadSequence !== artifact.headSequence) {
+          throw new EditableArtifactStaleBaseError();
+        }
+        if (intent.causalBase.length !== 0 || intent.selectiveUndoOperationIds.length !== 0) {
+          throw new EditableArtifactInvalidRequestError(
+            "Serialized artifacts do not accept CRDT causality or selective undo"
+          );
+        }
+        validateSerializedPredecessor(
+          basis.predecessor,
+          context.actor.replicaId,
+          intent,
+          artifact.modality
+        );
+        if (basis.undoTargets.length !== 0 || basis.kernelState.modality !== artifact.modality || basis.kernelState.artifact.modality !== artifact.modality) {
+          throw new Error("Editable artifact store returned a cross-modality serialized basis");
+        }
+        const priorNativeRevision = serializedBasisNativeRevision(basis.kernelState, artifact);
+        const kernelResult2 = await this.dependencies.kernel.applyTransaction({
+          modality: artifact.modality,
+          state: basis.kernelState,
+          actor: context.actor,
+          intent,
+          requestHash: request.requestHash,
+          intentBytes: intentBytes.slice()
+        });
+        const serverTransactionId2 = editableArtifactTransactionId(
+          this.dependencies.ids.next("transaction")
+        );
+        let normalizedKernel2;
+        try {
+          normalizedKernel2 = validateSerializedKernelResult({
+            artifact,
+            intent,
+            intentBytes,
+            requestHash: request.requestHash,
+            serverTransactionId: serverTransactionId2,
+            priorNativeRevision,
+            result: kernelResult2
+          });
+        } catch (error) {
+          if (error instanceof EditableArtifactKernelContractError) throw error;
+          throw new EditableArtifactKernelContractError(
+            `Authoritative kernel returned malformed serialized data: ${error instanceof Error ? error.message : "unknown contract error"}`
+          );
+        }
+        const committedAt2 = canonicalNow(this.dependencies.clock);
+        const sequence = artifact.headSequence + 1;
+        assertPositiveSafeInteger(sequence, "serialized resulting head sequence");
+        const committedTransaction2 = Object.freeze({
+          scope: artifact.scope,
+          artifactId: artifact.id,
+          modality: artifact.modality,
+          serverTransactionId: serverTransactionId2,
+          requestHash: request.requestHash,
+          sequenceStart: sequence,
+          sequenceEnd: sequence,
+          priorStateHash: artifact.stateHash,
+          stateHash: normalizedKernel2.stateHash,
+          commitProtocolVersion: EDITABLE_ARTIFACT_SERIALIZED_COMMIT_VERSION,
+          priorNativeRevision,
+          nativeRevision: normalizedKernel2.nativeRevision,
+          commandCount: normalizedKernel2.commandCount,
+          nativeReceiptBytes: normalizedKernel2.nativeReceiptBytes.slice(),
+          modelSchemaVersion: normalizedKernel2.modelSchemaVersion,
+          kernelVersion: normalizedKernel2.kernelVersion,
+          committedTransactionBytes: normalizedKernel2.committedTransactionBytes.slice(),
+          committedAt: committedAt2
+        });
+        const receipt2 = Object.freeze({
+          receiptId: editableArtifactReceiptId(this.dependencies.ids.next("receipt")),
+          scope: artifact.scope,
+          artifactId: artifact.id,
+          modality: artifact.modality,
+          serverTransactionId: serverTransactionId2,
+          clientTransactionId: intent.clientTransactionId,
+          replicaId: context.actor.replicaId,
+          replicaCounter: intent.replicaCounter,
+          previousLocalTransactionId: intent.previousLocalTransactionId,
+          requestHash: request.requestHash,
+          intentBytes: intentBytes.slice(),
+          actorKey,
+          sequenceStart: sequence,
+          sequenceEnd: sequence,
+          priorStateHash: artifact.stateHash,
+          stateHash: normalizedKernel2.stateHash,
+          intentEnvelopeVersion: intent.envelopeVersion,
+          intentProtocolVersion: intent.protocolVersion,
+          commandProtocolVersion: intent.commandProtocolVersion,
+          kernelVersion: normalizedKernel2.kernelVersion,
+          modelSchemaVersion: normalizedKernel2.modelSchemaVersion,
+          commitProtocolVersion: EDITABLE_ARTIFACT_SERIALIZED_COMMIT_VERSION,
+          priorNativeRevision,
+          nativeRevision: normalizedKernel2.nativeRevision,
+          commandCount: normalizedKernel2.commandCount,
+          committedAt: committedAt2
+        });
+        const outbox2 = transactionOutboxRecord(
+          editableArtifactOutboxId(this.dependencies.ids.next("outbox")),
+          receipt2
+        );
+        const commit2 = await this.dependencies.store.tryCommitAppliedTransaction({
+          scope: context.scope,
+          artifactId: context.artifactId,
+          expectedLifecycle: "active",
+          expectedAuthorizationRevision: authorizationRevision,
+          authorizationActor: context.actor,
+          expectedHeadSequence: artifact.headSequence,
+          actorKey,
+          clientTransactionId: intent.clientTransactionId,
+          requestHash: request.requestHash,
+          expectedPredecessor: basis.predecessor ? {
+            receiptId: basis.predecessor.receiptId,
+            serverTransactionId: basis.predecessor.serverTransactionId,
+            actorKey: basis.predecessor.actorKey,
+            clientTransactionId: basis.predecessor.clientTransactionId,
+            replicaId: basis.predecessor.replicaId,
+            replicaCounter: basis.predecessor.replicaCounter
+          } : null,
+          expectedUnclaimedUndoTargets: Object.freeze([]),
+          serverTransactionId: serverTransactionId2,
+          receipt: receipt2,
+          committedTransaction: committedTransaction2,
+          operations: Object.freeze([]),
+          outbox: outbox2
+        });
+        if (commit2.kind === "committed") {
+          return Object.freeze({
+            receipt: copyReceipt(commit2.receipt),
+            replayed: false
+          });
+        }
+        if (commit2.kind === "replayed") {
+          if (commit2.receipt.requestHash !== request.requestHash) {
+            throw new EditableArtifactIdempotencyConflictError();
+          }
+          return Object.freeze({
+            receipt: copyReceipt(commit2.receipt),
+            replayed: true
+          });
+        }
+        continue;
+      }
+      if (basis.kernelState.modality !== "spreadsheet" || basis.kernelState.artifact.modality !== "spreadsheet") {
+        throw new Error("Editable artifact store returned a cross-modality spreadsheet basis");
+      }
+      if (intent.observedHeadSequence > artifact.headSequence) {
+        throw new EditableArtifactCausalFutureError();
+      }
+      if (!causalFrontierDominates(artifact.causalFrontier, intent.causalBase)) {
+        throw new EditableArtifactCausalFutureError();
+      }
+      let resolvedCausalBase = intent.causalBase;
+      if (intent.previousLocalTransactionId === null) {
+        if (intent.replicaCounter !== 1) {
+          throw new EditableArtifactCausalChainError(
+            "Only a replica's first transaction may omit its local predecessor"
+          );
+        }
+      } else {
+        const predecessor = basis.predecessor;
+        if (!predecessor) {
+          throw new EditableArtifactCausalChainError(
+            "Previous local transaction is not committed yet"
+          );
+        }
+        if (predecessor.modality !== "spreadsheet" || predecessor.replicaId !== context.actor.replicaId || predecessor.replicaCounter + 1 !== intent.replicaCounter) {
+          throw new EditableArtifactCausalChainError(
+            "Previous local transaction does not match this replica counter chain"
+          );
+        }
+        resolvedCausalBase = mergeCausalFrontiers(
+          intent.causalBase,
+          predecessor.resolvedCausalBase,
+          editableArtifactCausalFrontier([
+            {
+              replicaId: predecessor.replicaId,
+              counter: predecessor.replicaCounter
+            }
+          ])
+        );
+      }
+      if (intent.replicaCounter !== causalCounter(artifact.causalFrontier, context.actor.replicaId) + 1) {
+        throw new EditableArtifactCausalChainError(
+          "Replica counter does not immediately advance the authoritative frontier"
+        );
+      }
+      if (!causalFrontierDominates(artifact.causalFrontier, resolvedCausalBase)) {
+        throw new EditableArtifactCausalFutureError();
+      }
+      if (basis.undoTargets.length !== intent.selectiveUndoOperationIds.length) {
+        throw new Error("Editable artifact store returned a malformed transaction undo basis");
+      }
+      const resolvedUndoTargets = [];
+      for (const [index, operationId] of intent.selectiveUndoOperationIds.entries()) {
+        const undoBasis = basis.undoTargets[index];
+        if (!undoBasis || undoBasis.operationId !== operationId) {
+          throw new Error("Editable artifact store returned a malformed transaction undo basis");
+        }
+        const operation = undoBasis.operation;
+        if (!operation) {
+          throw new EditableArtifactUndoTargetError(`Unknown undo target: ${operationId}`);
+        }
+        if (operation.actorKey !== actorKey) {
+          throw new EditableArtifactUndoTargetError(
+            `Selective undo may target only operations authored by the same authority: ${operationId}`
+          );
+        }
+        if (undoBasis.claimedBy) {
+          throw new EditableArtifactUndoTargetError(
+            `Operation was already selectively undone: ${operationId}`
+          );
+        }
+        if (causalCounter(resolvedCausalBase, operation.dot.replicaId) < operation.dot.counter) {
+          throw new EditableArtifactUndoTargetError(
+            `Selective undo target is not present in the transaction's causal base: ${operationId}`
+          );
+        }
+        resolvedUndoTargets.push(operation);
+      }
+      Object.freeze(resolvedUndoTargets);
+      const kernelResult = await this.dependencies.kernel.applyTransaction({
+        modality: "spreadsheet",
+        state: basis.kernelState,
+        actor: context.actor,
+        intent,
+        requestHash: request.requestHash,
+        intentBytes: intentBytes.slice(),
+        resolvedCausalBase,
+        resolvedUndoTargets
+      });
+      let normalizedKernel;
+      try {
+        normalizedKernel = validateKernelResult2(
+          artifact,
+          context.actor,
+          intent,
+          resolvedCausalBase,
+          kernelResult
+        );
+      } catch (error) {
+        if (error instanceof EditableArtifactKernelContractError) throw error;
+        throw new EditableArtifactKernelContractError(
+          `Authoritative kernel returned malformed data: ${error instanceof Error ? error.message : "unknown contract error"}`
+        );
+      }
+      const committedAt = canonicalNow(this.dependencies.clock);
+      const serverTransactionId = normalizedKernel.serverTransactionId;
+      const sequenceStart = artifact.headSequence + 1;
+      const sequenceEnd = artifact.headSequence + normalizedKernel.operationIds.length;
+      assertNonnegativeSafeInteger(sequenceEnd, "resulting head sequence");
+      const operations = normalizedKernel.operationIds.map(
+        (operationId, index) => Object.freeze({
+          scope: artifact.scope,
+          artifactId: artifact.id,
+          serverTransactionId,
+          sequence: sequenceStart + index,
+          actorKey,
+          createdAt: committedAt,
+          operationId,
+          dot: normalizedKernel.dot
+        })
+      );
+      const committedTransaction = Object.freeze({
+        scope: artifact.scope,
+        artifactId: artifact.id,
+        modality: "spreadsheet",
+        serverTransactionId,
+        requestHash: request.requestHash,
+        sequenceStart,
+        sequenceEnd,
+        priorStateHash: normalizedKernel.priorStateHash,
+        stateHash: normalizedKernel.stateHash,
+        dot: normalizedKernel.dot,
+        resolvedCausalBase,
+        resultingCausalFrontier: normalizedKernel.resultingCausalFrontier,
+        operationIds: normalizedKernel.operationIds,
+        operationProtocolVersion: normalizedKernel.operationProtocolVersion,
+        modelSchemaVersion: normalizedKernel.modelSchemaVersion,
+        kernelVersion: normalizedKernel.kernelVersion,
+        committedTransactionBytes: normalizedKernel.committedTransactionBytes.slice(),
+        committedAt
+      });
+      const receipt = Object.freeze({
+        receiptId: editableArtifactReceiptId(this.dependencies.ids.next("receipt")),
+        scope: artifact.scope,
+        artifactId: artifact.id,
+        modality: "spreadsheet",
+        serverTransactionId,
+        clientTransactionId: intent.clientTransactionId,
+        replicaId: context.actor.replicaId,
+        replicaCounter: intent.replicaCounter,
+        previousLocalTransactionId: intent.previousLocalTransactionId,
+        requestHash: request.requestHash,
+        intentBytes: intentBytes.slice(),
+        actorKey,
+        sequenceStart,
+        sequenceEnd,
+        priorStateHash: normalizedKernel.priorStateHash,
+        causalBase: intent.causalBase,
+        resolvedCausalBase,
+        resultingCausalFrontier: normalizedKernel.resultingCausalFrontier,
+        stateHash: normalizedKernel.stateHash,
+        operationCount: operations.length,
+        selectiveUndoOperationIds: intent.selectiveUndoOperationIds,
+        intentEnvelopeVersion: intent.envelopeVersion,
+        intentProtocolVersion: intent.protocolVersion,
+        commandProtocolVersion: intent.commandProtocolVersion,
+        kernelVersion: normalizedKernel.kernelVersion,
+        modelSchemaVersion: normalizedKernel.modelSchemaVersion,
+        operationProtocolVersion: normalizedKernel.operationProtocolVersion,
+        committedAt
+      });
+      const outbox = transactionOutboxRecord(
+        editableArtifactOutboxId(this.dependencies.ids.next("outbox")),
+        receipt
+      );
+      const commit = await this.dependencies.store.tryCommitAppliedTransaction({
+        scope: context.scope,
+        artifactId: context.artifactId,
+        expectedLifecycle: "active",
+        expectedAuthorizationRevision: authorizationRevision,
+        authorizationActor: context.actor,
+        expectedHeadSequence: artifact.headSequence,
+        actorKey,
+        clientTransactionId: intent.clientTransactionId,
+        requestHash: request.requestHash,
+        expectedPredecessor: basis.predecessor ? {
+          receiptId: basis.predecessor.receiptId,
+          serverTransactionId: basis.predecessor.serverTransactionId,
+          actorKey: basis.predecessor.actorKey,
+          clientTransactionId: basis.predecessor.clientTransactionId,
+          replicaId: basis.predecessor.replicaId,
+          replicaCounter: basis.predecessor.replicaCounter
+        } : null,
+        expectedUnclaimedUndoTargets: intent.selectiveUndoOperationIds,
+        serverTransactionId,
+        receipt,
+        committedTransaction,
+        operations,
+        outbox
+      });
+      if (commit.kind === "committed") {
+        return Object.freeze({
+          receipt: copyReceipt(commit.receipt),
+          replayed: false
+        });
+      }
+      if (commit.kind === "replayed") {
+        if (commit.receipt.requestHash !== request.requestHash) {
+          throw new EditableArtifactIdempotencyConflictError();
+        }
+        return Object.freeze({
+          receipt: copyReceipt(commit.receipt),
+          replayed: true
+        });
+      }
+    }
+    throw new EditableArtifactRetryableConflictError();
+  }
+  async compactCurrentHead(input) {
+    return await this.compactCurrentHeadWithPermission(input, "read");
+  }
+  async compactCurrentHeadWithPermission(input, authorizationPermission) {
+    if (!this.dependencies.compaction) {
+      throw new Error("Editable artifact snapshot compaction is not configured");
+    }
+    const context = normalizeBoundaryContext(input);
+    const authorizationRevision = await this.requirePermission({
+      ...context,
+      permission: authorizationPermission
+    });
+    const key = compactionInFlightKey(
+      context.scope,
+      context.artifactId,
+      context.actor,
+      authorizationPermission
+    );
+    const existing = this.inFlightCompactions.get(key);
+    if (existing) return await existing;
+    const promise = this.compactCurrentHeadOnce({
+      ...context,
+      authorizationRevision,
+      authorizationPermission,
+      ...input.signal ? { signal: input.signal } : {}
+    });
+    this.inFlightCompactions.set(key, promise);
+    try {
+      return await promise;
+    } finally {
+      if (this.inFlightCompactions.get(key) === promise) this.inFlightCompactions.delete(key);
+    }
+  }
+  async compactCurrentHeadOnce(input) {
+    const compaction = this.dependencies.compaction;
+    if (!compaction) throw new Error("Editable artifact snapshot compaction is not configured");
+    let authorizationRevision = input.authorizationRevision;
+    for (let attempt = 1; attempt <= EDITABLE_ARTIFACT_MAX_COMMIT_ATTEMPTS; attempt += 1) {
+      if (input.signal?.aborted) {
+        throw new EditableArtifactSnapshotVerificationError("cancelled");
+      }
+      const basis = await this.dependencies.store.readCurrentKernelState(
+        input.scope,
+        input.artifactId,
+        authorizationRevision
+      );
+      if (basis.kind === "authorization_stale") {
+        authorizationRevision = await this.requirePermission({
+          ...input,
+          permission: input.authorizationPermission
+        });
+        continue;
+      }
+      const current = basis.state.snapshot;
+      if (current && current.coveredHeadSequence === basis.state.artifact.headSequence) {
+        return current;
+      }
+      const candidate = await compaction.prepare({
+        scope: input.scope,
+        artifactId: input.artifactId,
+        snapshotId: editableArtifactSnapshotId(this.dependencies.ids.next("snapshot")),
+        state: basis.state,
+        ...input.signal ? { signal: input.signal } : {}
+      });
+      await this.dependencies.snapshotVerifier.verify({ ...input, snapshot: candidate });
+      try {
+        const published = await this.commitVerifiedSnapshotCandidate({
+          context: input,
+          candidate,
+          authorizationRevision,
+          authorizationPermission: input.authorizationPermission,
+          requireCurrentHead: true
+        });
+        return published.snapshot;
+      } catch (error) {
+        if (error instanceof EditableArtifactCompactionRaceError) continue;
+        throw error;
+      }
+    }
+    throw new EditableArtifactRetryableConflictError();
+  }
+  async publishVerifiedSnapshot(input) {
+    const context = normalizeBoundaryContext(input);
+    const candidate = validateSnapshotRequest(input.snapshot);
+    const authorizationRevision = await this.requirePermission({
+      ...context,
+      permission: "manage"
+    });
+    await this.dependencies.snapshotVerifier.verify({
+      ...context,
+      snapshot: candidate
+    });
+    return await this.commitVerifiedSnapshotCandidate({
+      context,
+      candidate,
+      authorizationRevision,
+      authorizationPermission: "manage",
+      requireCurrentHead: false
+    });
+  }
+  async commitVerifiedSnapshotCandidate(input) {
+    const { context, candidate, authorizationPermission } = input;
+    let authorizationRevision = input.authorizationRevision;
+    for (let attempt = 1; attempt <= EDITABLE_ARTIFACT_MAX_COMMIT_ATTEMPTS; attempt += 1) {
+      const outcome = await this.dependencies.store.withSnapshotPublicationLock(
+        context.scope,
+        context.artifactId,
+        async (unitOfWork) => {
+          const artifact = unitOfWork.artifact();
+          if (artifact.modality !== candidate.modality) {
+            throw new EditableArtifactSnapshotConflictError(
+              "Snapshot modality does not match the durable artifact"
+            );
+          }
+          if (input.requireCurrentHead && candidate.coveredHeadSequence !== artifact.headSequence) {
+            throw new EditableArtifactCompactionRaceError(
+              "Compaction candidate no longer covers the current durable head"
+            );
+          }
+          if (artifact.authorizationRevision !== authorizationRevision) {
+            return Object.freeze({ kind: "authorization_stale" });
+          }
+          const existing = await unitOfWork.findSnapshot(candidate.snapshotId);
+          if (existing) {
+            if (!sameSnapshotRequest(existing, candidate)) {
+              throw new EditableArtifactSnapshotConflictError(
+                "Snapshot id was already published with different immutable metadata"
+              );
+            }
+            return Object.freeze({
+              kind: "result",
+              value: Object.freeze({ snapshot: existing, replayed: true })
+            });
+          }
+          const checkpoint = await unitOfWork.checkpoint(candidate.coveredHeadSequence);
+          if (!checkpoint || checkpoint.modality !== candidate.modality || checkpoint.stateHash !== candidate.stateHash || candidate.modality === "spreadsheet" && (checkpoint.modality !== "spreadsheet" || !causalFrontiersEqual(
+            checkpoint.causalFrontier,
+            candidate.coveredCausalFrontier
+          )) || candidate.modality !== "spreadsheet" && (checkpoint.modality === "spreadsheet" || checkpoint.nativeRevision !== candidate.nativeRevision)) {
+            throw new EditableArtifactSnapshotConflictError(
+              "Snapshot coverage does not match an authoritative transaction boundary"
+            );
+          }
+          if (artifact.currentSnapshotId) {
+            const current = await unitOfWork.findSnapshot(artifact.currentSnapshotId);
+            if (!current) {
+              throw new EditableArtifactSnapshotConflictError(
+                "Current snapshot metadata is missing"
+              );
+            }
+            if (candidate.coveredHeadSequence <= current.coveredHeadSequence) {
+              if (input.requireCurrentHead && current.coveredHeadSequence === artifact.headSequence) {
+                return Object.freeze({
+                  kind: "result",
+                  value: Object.freeze({ snapshot: current, replayed: true })
+                });
+              }
+              throw new EditableArtifactSnapshotConflictError(
+                "Snapshot publication must advance coverage"
+              );
+            }
+          }
+          const publishedAt = canonicalNow(this.dependencies.clock);
+          const snapshot = Object.freeze({
+            ...candidate,
+            scope: artifact.scope,
+            artifactId: artifact.id,
+            publishedAt
+          });
+          const outbox = snapshotOutboxRecord(
+            editableArtifactOutboxId(this.dependencies.ids.next("outbox")),
+            snapshot
+          );
+          const publication = await unitOfWork.commitSnapshot({
+            expectedCurrentSnapshotId: artifact.currentSnapshotId,
+            expectedAuthorizationRevision: authorizationRevision,
+            authorizationActor: context.actor,
+            authorizationPermission,
+            snapshot,
+            outbox
+          });
+          if (publication.kind === "authorization_stale") {
+            return Object.freeze({ kind: "authorization_stale" });
+          }
+          return Object.freeze({
+            kind: "result",
+            value: Object.freeze({ snapshot, replayed: false })
+          });
+        }
+      );
+      if (outcome.kind === "result") return outcome.value;
+      authorizationRevision = await this.requirePermission({
+        ...context,
+        permission: authorizationPermission
+      });
+    }
+    throw new EditableArtifactRetryableConflictError();
+  }
+  async requirePermission(input) {
+    const decision = await this.dependencies.authorization.authorize({
+      scope: input.scope,
+      artifactId: input.artifactId,
+      actor: input.actor,
+      permission: input.permission
+    });
+    if (typeof decision.allowed !== "boolean") {
+      throw new TypeError("Artifact authorization decision is malformed");
+    }
+    assertPositiveSafeInteger(decision.revision, "artifact authorization revision");
+    if (!decision.allowed) {
+      throw new EditableArtifactForbiddenError(input.permission);
+    }
+    return decision.revision;
+  }
+};
+function creationInFlightKey(scope, operationKind, actorKey, idempotencyKey) {
+  return JSON.stringify([
+    scope.accountId,
+    scope.workspaceId,
+    operationKind,
+    actorKey,
+    idempotencyKey
+  ]);
+}
+function transactionInFlightKey(scope, artifactId, actorKey, clientTransactionId) {
+  return JSON.stringify([
+    scope.accountId,
+    scope.workspaceId,
+    artifactId,
+    actorKey,
+    clientTransactionId
+  ]);
+}
+function compactionInFlightKey(scope, artifactId, actor, permission) {
+  return JSON.stringify([
+    scope.accountId,
+    scope.workspaceId,
+    artifactId,
+    editableArtifactActorKey(actor),
+    permission
+  ]);
+}
+function shouldCompactKernelState(state) {
+  return state.tailTransactionCount >= EDITABLE_ARTIFACT_COMPACTION_TRANSACTION_THRESHOLD || state.tailByteSize >= EDITABLE_ARTIFACT_COMPACTION_BYTE_THRESHOLD;
+}
+var EditableArtifactCompactionRaceError = class extends EditableArtifactSnapshotConflictError {
+};
+function normalizeCreateRequest(input) {
+  const record = plainDataRecord(input, "artifact create request");
+  rejectUnknownKeys(record, ["idempotencyKey", "modality", "title"], "artifact create request");
+  const rawIdempotencyKey = dataProperty(record, "idempotencyKey", true);
+  const modality = dataProperty(record, "modality", true);
+  const title = dataProperty(record, "title", true);
+  if (typeof rawIdempotencyKey !== "string" || typeof title !== "string" || modality !== "spreadsheet" && modality !== "presentation" && modality !== "document") {
+    throw new TypeError("Artifact create request fields are malformed");
+  }
+  assertBoundedArtifactTitle(title);
+  return Object.freeze({
+    idempotencyKey: editableArtifactClientTransactionId(rawIdempotencyKey),
+    modality,
+    title
+  });
+}
+function normalizeImportRequest(input) {
+  const record = plainDataRecord(input, "artifact import request");
+  rejectUnknownKeys(
+    record,
+    ["idempotencyKey", "modality", "title", "originalImport", "snapshot"],
+    "artifact import request"
+  );
+  const rawIdempotencyKey = dataProperty(record, "idempotencyKey", true);
+  const modality = dataProperty(record, "modality", true);
+  const title = dataProperty(record, "title", true);
+  const rawOriginalImport = dataProperty(record, "originalImport", true);
+  const rawSnapshot = dataProperty(record, "snapshot", true);
+  if (typeof rawIdempotencyKey !== "string" || typeof title !== "string" || modality !== "spreadsheet" && modality !== "presentation" && modality !== "document") {
+    throw new TypeError("Artifact import request fields are malformed");
+  }
+  assertBoundedArtifactTitle(title);
+  const originalImport = normalizeOriginalImport(rawOriginalImport, modality);
+  const snapshotRecord = plainDataRecord(rawSnapshot, "artifact import snapshot");
+  if (Reflect.ownKeys(snapshotRecord).includes("snapshotId") || Reflect.ownKeys(snapshotRecord).includes("verifiedAt")) {
+    throw new TypeError("Artifact import snapshot identity and timestamps are server-assigned");
+  }
+  const candidate = Object.fromEntries(
+    Reflect.ownKeys(snapshotRecord).map((key) => {
+      if (typeof key !== "string") throw new TypeError("Artifact import snapshot has symbols");
+      return [key, dataProperty(snapshotRecord, key, true)];
+    })
+  );
+  const normalized = validateSnapshotRequest({
+    ...candidate,
+    snapshotId: "00000000000000000000000000000001",
+    verifiedAt: "1970-01-01T00:00:00.000Z"
+  });
+  if (normalized.modality !== modality || normalized.coveredHeadSequence !== 0) {
+    throw new TypeError("Artifact import snapshot boundary is malformed");
+  }
+  const {
+    snapshotId: _serverAssignedSnapshotId,
+    verifiedAt: _serverAssignedVerifiedAt,
+    ...snapshot
+  } = normalized;
+  return Object.freeze({
+    idempotencyKey: editableArtifactClientTransactionId(rawIdempotencyKey),
+    modality,
+    title,
+    originalImport,
+    snapshot: Object.freeze(snapshot)
+  });
+}
+function normalizeOriginalImport(input, modality) {
+  const record = plainDataRecord(input, "artifact original import");
+  rejectUnknownKeys(
+    record,
+    ["fileId", "blobReference", "byteSize", "contentHash", "mimeType"],
+    "artifact original import"
+  );
+  const fileId = dataProperty(record, "fileId", true);
+  const blobReference = dataProperty(record, "blobReference", true);
+  const byteSize = dataProperty(record, "byteSize", true);
+  const contentHash = dataProperty(record, "contentHash", true);
+  const mimeType = dataProperty(record, "mimeType", true);
+  const expectedMimeType = modality === "spreadsheet" ? "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" : modality === "document" ? "application/vnd.openxmlformats-officedocument.wordprocessingml.document" : "application/vnd.openxmlformats-officedocument.presentationml.presentation";
+  if (typeof fileId !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u.test(fileId) || typeof blobReference !== "string" || typeof byteSize !== "number" || typeof contentHash !== "string" || mimeType !== expectedMimeType) {
+    throw new TypeError("Artifact original import fields are malformed");
+  }
+  assertBoundedOpaqueReference(blobReference, "original import blob reference");
+  assertPositiveSafeInteger(byteSize, "original import byte size");
+  if (byteSize > EDITABLE_ARTIFACT_ORIGINAL_IMPORT_MAX_BYTES) {
+    throw new TypeError("Artifact original import exceeds its byte limit");
+  }
+  return Object.freeze({
+    fileId,
+    blobReference,
+    byteSize,
+    contentHash: editableArtifactContentHash(contentHash),
+    mimeType: expectedMimeType
+  });
+}
+function copyReceipt(receipt) {
+  if (receipt.modality !== "spreadsheet") {
+    return Object.freeze({
+      ...receipt,
+      scope: Object.freeze({ ...receipt.scope }),
+      intentBytes: receipt.intentBytes.slice()
+    });
+  }
+  return Object.freeze({
+    ...receipt,
+    scope: Object.freeze({ ...receipt.scope }),
+    intentBytes: receipt.intentBytes.slice(),
+    causalBase: editableArtifactCausalFrontier(receipt.causalBase),
+    resolvedCausalBase: editableArtifactCausalFrontier(receipt.resolvedCausalBase),
+    resultingCausalFrontier: editableArtifactCausalFrontier(receipt.resultingCausalFrontier),
+    selectiveUndoOperationIds: Object.freeze([...receipt.selectiveUndoOperationIds])
+  });
+}
+function copyCreateResult(result, replayed = result.replayed) {
+  const artifact = result.artifact.modality === "spreadsheet" ? Object.freeze({
+    ...result.artifact,
+    scope: Object.freeze({ ...result.artifact.scope }),
+    causalFrontier: editableArtifactCausalFrontier(result.artifact.causalFrontier)
+  }) : Object.freeze({
+    ...result.artifact,
+    scope: Object.freeze({ ...result.artifact.scope })
+  });
+  const genesisSnapshot = result.genesisSnapshot.modality === "spreadsheet" ? Object.freeze({
+    ...result.genesisSnapshot,
+    scope: Object.freeze({ ...result.genesisSnapshot.scope }),
+    coveredCausalFrontier: editableArtifactCausalFrontier(
+      result.genesisSnapshot.coveredCausalFrontier
+    )
+  }) : Object.freeze({
+    ...result.genesisSnapshot,
+    scope: Object.freeze({ ...result.genesisSnapshot.scope })
+  });
+  return Object.freeze({
+    artifact,
+    genesisSnapshot,
+    creationReceipt: Object.freeze({
+      ...result.creationReceipt,
+      scope: Object.freeze({ ...result.creationReceipt.scope })
+    }),
+    replayed
+  });
+}
+function normalizeBoundaryContext(input) {
+  const scope = editableArtifactScope(input.scope);
+  const artifactId = editableArtifactId(input.artifactId);
+  validateEditableArtifactActor(input.actor);
+  const actor = Object.freeze({ ...input.actor });
+  return Object.freeze({ scope, artifactId, actor });
+}
+function normalizeTransactionEnvelope(request) {
+  const record = plainDataRecord(request, "mutation envelope");
+  rejectUnknownKeys(record, ["intentBytes", "requestHash", "expectedHead"], "mutation envelope");
+  const rawIntentBytes = dataProperty(record, "intentBytes", true);
+  const rawRequestHash = dataProperty(record, "requestHash", true);
+  const rawExpectedHead = dataProperty(record, "expectedHead", false);
+  if (!(rawIntentBytes instanceof Uint8Array)) {
+    throw new TypeError("Mutation intent bytes must be a Uint8Array");
+  }
+  if (rawIntentBytes.byteLength < 1 || rawIntentBytes.byteLength > EDITABLE_ARTIFACT_MAX_INTENT_BYTES_PER_TRANSACTION) {
+    throw new TypeError("Mutation intent bytes exceed the bounded envelope size");
+  }
+  if (typeof rawRequestHash !== "string") {
+    throw new TypeError("Mutation request hash must be a string");
+  }
+  let expectedHead;
+  if (rawExpectedHead !== void 0) {
+    const expected = plainDataRecord(rawExpectedHead, "mutation expected head");
+    rejectUnknownKeys(expected, ["sequence", "stateHash"], "mutation expected head");
+    const sequence = dataProperty(expected, "sequence", true);
+    const stateHash = dataProperty(expected, "stateHash", true);
+    if (typeof sequence !== "number" || typeof stateHash !== "string") {
+      throw new TypeError("Mutation expected head fields are malformed");
+    }
+    assertNonnegativeSafeInteger(sequence, "mutation expected head sequence");
+    expectedHead = Object.freeze({
+      sequence,
+      stateHash: editableArtifactStateHash(stateHash)
+    });
+  }
+  return Object.freeze({
+    intentBytes: rawIntentBytes.slice(),
+    requestHash: editableArtifactRequestHash(rawRequestHash),
+    ...expectedHead ? { expectedHead } : {}
+  });
+}
+function normalizeMutationIntent(input) {
+  const record = plainDataRecord(input, "decoded mutation intent");
+  rejectUnknownKeys(
+    record,
+    [
+      "envelopeVersion",
+      "protocolVersion",
+      "modelSchemaVersion",
+      "commandProtocolVersion",
+      "artifactId",
+      "clientTransactionId",
+      "replicaId",
+      "replicaCounter",
+      "previousLocalTransactionId",
+      "observedHeadSequence",
+      "causalBase",
+      "selectiveUndoOperationIds",
+      "commandBytes"
+    ],
+    "decoded mutation intent"
+  );
+  const envelopeVersion = dataProperty(record, "envelopeVersion", true);
+  const protocolVersion = dataProperty(record, "protocolVersion", true);
+  const modelSchemaVersion = dataProperty(record, "modelSchemaVersion", true);
+  const commandProtocolVersion = dataProperty(record, "commandProtocolVersion", true);
+  const rawArtifactId = dataProperty(record, "artifactId", true);
+  const rawClientTransactionId = dataProperty(record, "clientTransactionId", true);
+  const rawReplicaId = dataProperty(record, "replicaId", true);
+  const replicaCounter = dataProperty(record, "replicaCounter", true);
+  const rawPreviousLocalTransactionId = dataProperty(record, "previousLocalTransactionId", true);
+  const observedHeadSequence = dataProperty(record, "observedHeadSequence", true);
+  const rawCausalBase = dataProperty(record, "causalBase", true);
+  const rawUndoTargets = dataProperty(record, "selectiveUndoOperationIds", true);
+  const rawCommandBytes = dataProperty(record, "commandBytes", true);
+  if (typeof envelopeVersion !== "number" || typeof protocolVersion !== "number" || typeof modelSchemaVersion !== "number" || typeof commandProtocolVersion !== "number" || typeof rawArtifactId !== "string" || typeof rawClientTransactionId !== "string" || typeof rawReplicaId !== "string" || typeof replicaCounter !== "number" || rawPreviousLocalTransactionId !== null && typeof rawPreviousLocalTransactionId !== "string" || typeof observedHeadSequence !== "number" || !Array.isArray(rawCausalBase) || !Array.isArray(rawUndoTargets) || !(rawCommandBytes instanceof Uint8Array)) {
+    throw new TypeError("Decoded mutation intent fields are malformed");
+  }
+  if (envelopeVersion !== EDITABLE_ARTIFACT_INTENT_VERSION) {
+    throw new TypeError("Mutation intent envelope version is unsupported");
+  }
+  assertPositiveSafeInteger(protocolVersion, "intent protocol version");
+  if (protocolVersion !== EDITABLE_ARTIFACT_INTENT_PROTOCOL_VERSION) {
+    throw new TypeError("Mutation intent protocol version is unsupported");
+  }
+  assertPositiveSafeInteger(modelSchemaVersion, "intent model schema version");
+  assertPositiveSafeInteger(commandProtocolVersion, "intent command protocol version");
+  const artifactId = editableArtifactId(rawArtifactId);
+  const clientTransactionId = editableArtifactClientTransactionId(rawClientTransactionId);
+  const replicaId = editableArtifactReplicaId(rawReplicaId);
+  assertPositiveSafeInteger(replicaCounter, "replica counter");
+  const previousLocalTransactionId = rawPreviousLocalTransactionId === null ? null : editableArtifactClientTransactionId(rawPreviousLocalTransactionId);
+  if (previousLocalTransactionId === clientTransactionId) {
+    throw new TypeError("A transaction cannot name itself as its local predecessor");
+  }
+  assertNonnegativeSafeInteger(observedHeadSequence, "observed head sequence");
+  const causalBase = editableArtifactCausalFrontier(
+    rawCausalBase
+  );
+  if (rawUndoTargets.length > EDITABLE_ARTIFACT_MAX_UNDO_TARGETS_PER_TRANSACTION) {
+    throw new TypeError("Editable artifact transaction has too many undo targets");
+  }
+  const selectiveUndoOperationIds = rawUndoTargets.map((target) => {
+    if (typeof target !== "string") {
+      throw new TypeError("Selective undo target must be a string");
+    }
+    return editableArtifactOperationId(target);
+  });
+  if (new Set(selectiveUndoOperationIds).size !== selectiveUndoOperationIds.length) {
+    throw new TypeError("Selective undo targets must be unique");
+  }
+  const sortedUndoTargets = [...selectiveUndoOperationIds].sort(compareCodeUnits);
+  if (sortedUndoTargets.some((target, index) => target !== selectiveUndoOperationIds[index])) {
+    throw new TypeError("Selective undo targets must be canonically sorted");
+  }
+  if (rawCommandBytes.byteLength < 1 || rawCommandBytes.byteLength > EDITABLE_ARTIFACT_MAX_COMMAND_BYTES_PER_TRANSACTION) {
+    throw new TypeError("Mutation command bytes exceed the transaction limit");
+  }
+  return Object.freeze({
+    envelopeVersion,
+    protocolVersion,
+    modelSchemaVersion,
+    commandProtocolVersion,
+    artifactId,
+    clientTransactionId,
+    replicaId,
+    replicaCounter,
+    previousLocalTransactionId,
+    observedHeadSequence,
+    causalBase,
+    selectiveUndoOperationIds: Object.freeze(selectiveUndoOperationIds),
+    commandBytes: rawCommandBytes.slice()
+  });
+}
+function plainDataRecord(value, label) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new TypeError(`${label} must be a plain object`);
+  }
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) {
+    throw new TypeError(`${label} must be a plain object`);
+  }
+  if (Object.getOwnPropertySymbols(value).length > 0) {
+    throw new TypeError(`${label} must not contain symbol properties`);
+  }
+  return value;
+}
+function rejectUnknownKeys(record, allowed, label) {
+  const allowedSet = new Set(allowed);
+  const unknown = Object.keys(record).find((key) => !allowedSet.has(key));
+  if (unknown) throw new TypeError(`${label} contains unknown property: ${unknown}`);
+}
+function dataProperty(record, key, required) {
+  const descriptor = Object.getOwnPropertyDescriptor(record, key);
+  if (!descriptor) {
+    if (required) throw new TypeError(`Missing required property: ${key}`);
+    return void 0;
+  }
+  if (!("value" in descriptor)) throw new TypeError(`Accessor property is not allowed: ${key}`);
+  if (descriptor.value === void 0) {
+    throw new TypeError(`Undefined property is not allowed: ${key}`);
+  }
+  return descriptor.value;
+}
+function validateIntentCommands(artifact, intent) {
+  try {
+    const descriptor = editableArtifactCodecFor({
+      durableModality: artifact.modality,
+      modelSchemaVersion: intent.modelSchemaVersion,
+      commandProtocolVersion: intent.commandProtocolVersion
+    });
+    descriptor.command.assertCanonical(intent.commandBytes);
+    const decoded = descriptor.command.decode(intent.commandBytes);
+    if (artifact.modality !== "spreadsheet" && commandCount(decoded) < 1) {
+      throw new TypeError("serialized command batch must not be empty");
+    }
+  } catch (error) {
+    throw new EditableArtifactInvalidRequestError(
+      `Mutation commands are incompatible with the durable ${artifact.modality} artifact: ${error instanceof Error ? error.message : "invalid command envelope"}`
+    );
+  }
+}
+function commandCount(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new TypeError("command decoder returned an invalid batch");
+  }
+  const descriptor = Object.getOwnPropertyDescriptor(value, "commands");
+  if (!descriptor || !("value" in descriptor) || !Array.isArray(descriptor.value)) {
+    throw new TypeError("command decoder returned an invalid batch");
+  }
+  return descriptor.value.length;
+}
+function validateSerializedPredecessor(predecessor, replicaId, intent, modality) {
+  if (intent.previousLocalTransactionId === null) {
+    if (intent.replicaCounter !== 1) {
+      throw new EditableArtifactCausalChainError(
+        "Only a replica's first transaction may omit its local predecessor"
+      );
+    }
+    return;
+  }
+  if (!predecessor) {
+    throw new EditableArtifactCausalChainError("Previous local transaction is not committed yet");
+  }
+  if (predecessor.modality !== modality || predecessor.replicaId !== replicaId || predecessor.replicaCounter + 1 !== intent.replicaCounter) {
+    throw new EditableArtifactCausalChainError(
+      "Previous local transaction does not match this serialized replica chain"
+    );
+  }
+}
+function serializedBasisNativeRevision(state, artifact) {
+  if (state.modality !== artifact.modality || state.artifact.id !== artifact.id || state.artifact.stateHash !== artifact.stateHash || state.artifact.headSequence !== artifact.headSequence) {
+    throw new Error("Serialized kernel basis disagrees with its artifact head");
+  }
+  let headSequence = 0;
+  assertNonnegativeSafeInteger(state.baseNativeRevision, "serialized kernel base native revision");
+  let nativeRevision = state.baseNativeRevision;
+  let stateHash;
+  if (state.snapshot) {
+    if (state.snapshot.modality !== artifact.modality || state.snapshot.artifactId !== artifact.id) {
+      throw new Error("Serialized snapshot basis has the wrong modality or identity");
+    }
+    if (state.snapshot.nativeRevision !== state.baseNativeRevision) {
+      throw new Error("Serialized snapshot disagrees with its native revision checkpoint");
+    }
+    headSequence = state.snapshot.coveredHeadSequence;
+    stateHash = state.snapshot.stateHash;
+  } else {
+    stateHash = state.committedTransactionTail[0]?.priorStateHash ?? artifact.stateHash;
+  }
+  for (const committed of state.committedTransactionTail) {
+    if (committed.modality !== artifact.modality || committed.sequenceStart !== headSequence + 1 || committed.sequenceEnd !== committed.sequenceStart || committed.priorNativeRevision !== nativeRevision || committed.priorStateHash !== stateHash) {
+      throw new Error("Serialized transaction tail is not contiguous with its snapshot");
+    }
+    headSequence = committed.sequenceEnd;
+    nativeRevision = committed.nativeRevision;
+    stateHash = committed.stateHash;
+  }
+  if (headSequence !== artifact.headSequence || stateHash !== artifact.stateHash) {
+    throw new Error("Serialized kernel basis does not reconstruct its artifact head");
+  }
+  return nativeRevision;
+}
+function validateSerializedKernelResult(input) {
+  const { artifact, intent, result } = input;
+  if (result.modality !== artifact.modality) {
+    throw new EditableArtifactKernelContractError(
+      "Kernel result modality does not match the durable artifact"
+    );
+  }
+  if (!(result.nativeReceiptBytes instanceof Uint8Array)) {
+    throw new EditableArtifactKernelContractError(
+      "Kernel returned an invalid native serialized receipt"
+    );
+  }
+  assertPositiveSafeInteger(result.modelSchemaVersion, "kernel model schema version");
+  if (result.modelSchemaVersion !== intent.modelSchemaVersion) {
+    throw new EditableArtifactKernelContractError(
+      "Kernel result model schema does not match the canonical intent"
+    );
+  }
+  try {
+    assertBoundedKernelVersion(result.kernelVersion);
+  } catch {
+    throw new EditableArtifactKernelContractError(
+      `Kernel version must contain 1-${EDITABLE_ARTIFACT_KERNEL_VERSION_MAX_BYTES2} well-formed UTF-8 bytes`
+    );
+  }
+  const stateHash = editableArtifactStateHash(result.resultingStateHash);
+  const committedTransactionBytes = encodeEditableArtifactSerializedCommit({
+    modality: artifact.modality,
+    transactionId: input.serverTransactionId,
+    parentHeadSequence: artifact.headSequence,
+    resultHeadSequence: artifact.headSequence + 1,
+    priorNativeRevision: input.priorNativeRevision,
+    priorStateHash: artifact.stateHash,
+    stateHash,
+    intentBytes: input.intentBytes,
+    nativeReceiptBytes: result.nativeReceiptBytes
+  });
+  const summary = decodeEditableArtifactSerializedCommit2(
+    committedTransactionBytes,
+    artifact.modality
+  );
+  if (summary.requestHash !== input.requestHash) {
+    throw new EditableArtifactKernelContractError(
+      "Serialized commit does not bind the exact verified request hash"
+    );
+  }
+  return Object.freeze({
+    committedTransactionBytes,
+    nativeReceiptBytes: summary.nativeReceiptBytes.slice(),
+    nativeRevision: summary.nativeReceipt.revision,
+    commandCount: summary.nativeReceipt.commandCount,
+    stateHash,
+    kernelVersion: result.kernelVersion,
+    modelSchemaVersion: result.modelSchemaVersion
+  });
+}
+function validateKernelResult2(artifact, actor, intent, resolvedCausalBase, result) {
+  if (result.modality !== "spreadsheet") {
+    throw new EditableArtifactKernelContractError(
+      "Kernel result modality does not match the durable spreadsheet"
+    );
+  }
+  if (!(result.committedTransactionBytes instanceof Uint8Array) || result.committedTransactionBytes.byteLength < 1 || result.committedTransactionBytes.byteLength > EDITABLE_ARTIFACT_MAX_COMMITTED_TRANSACTION_BYTES) {
+    throw new EditableArtifactKernelContractError(
+      "Authoritative kernel returned an invalid canonical OGACO envelope"
+    );
+  }
+  const summary = decodeCommittedTransactionSummary(result.committedTransactionBytes);
+  if (summary.operationIds.length < 1 || summary.operationIds.length > EDITABLE_ARTIFACT_MAX_OPERATIONS_PER_TRANSACTION) {
+    throw new EditableArtifactKernelContractError(
+      "Authoritative kernel returned an invalid operation count"
+    );
+  }
+  if (summary.operationProtocolVersion !== EDITABLE_ARTIFACT_OPERATION_PROTOCOL_VERSION) {
+    throw new EditableArtifactKernelContractError(
+      "Authoritative kernel returned an unsupported operation protocol version"
+    );
+  }
+  assertPositiveSafeInteger(result.modelSchemaVersion, "kernel model schema version");
+  if (result.modelSchemaVersion !== intent.modelSchemaVersion) {
+    throw new EditableArtifactKernelContractError(
+      "Kernel result model schema does not match the canonical intent"
+    );
+  }
+  try {
+    assertBoundedKernelVersion(result.kernelVersion);
+  } catch {
+    throw new EditableArtifactKernelContractError(
+      `Kernel version must contain 1-${EDITABLE_ARTIFACT_KERNEL_VERSION_MAX_BYTES2} well-formed UTF-8 bytes`
+    );
+  }
+  const serverTransactionId = editableArtifactTransactionId(summary.transactionId);
+  const priorStateHash = editableArtifactStateHash(summary.priorStateHash);
+  if (priorStateHash !== artifact.stateHash) {
+    throw new EditableArtifactKernelContractError(
+      "Kernel committed transaction prior state does not match its authoritative basis"
+    );
+  }
+  const stateHash = editableArtifactStateHash(summary.stateHash);
+  const normalizedResolvedBase = editableArtifactCausalFrontier(
+    summary.resolvedCausalBase.map((entry) => ({
+      replicaId: editableArtifactReplicaId(entry.replicaId),
+      counter: entry.counter
+    }))
+  );
+  if (!causalFrontiersEqual(normalizedResolvedBase, resolvedCausalBase)) {
+    throw new EditableArtifactKernelContractError(
+      "Kernel committed transaction resolved base does not match server authority"
+    );
+  }
+  const resultingCausalFrontier = editableArtifactCausalFrontier(
+    summary.resultingCausalFrontier.map((entry) => ({
+      replicaId: editableArtifactReplicaId(entry.replicaId),
+      counter: entry.counter
+    }))
+  );
+  const dotFrontier = editableArtifactCausalFrontier([
+    {
+      replicaId: editableArtifactReplicaId(summary.dot.replicaId),
+      counter: summary.dot.counter
+    }
+  ]);
+  const dot = dotFrontier[0];
+  if (dot.replicaId !== actor.replicaId) {
+    throw new EditableArtifactKernelContractError(
+      "Kernel transaction dot is not owned by the submitting replica"
+    );
+  }
+  if (dot.counter !== intent.replicaCounter) {
+    throw new EditableArtifactKernelContractError(
+      "Kernel transaction dot does not match the authored replica counter"
+    );
+  }
+  const seenOperationIds = /* @__PURE__ */ new Set();
+  const operationIds = summary.operationIds.map((rawOperationId) => {
+    const operationId = editableArtifactOperationId(rawOperationId);
+    if (seenOperationIds.has(operationId)) {
+      throw new EditableArtifactKernelContractError("Kernel returned duplicate operation ids");
+    }
+    seenOperationIds.add(operationId);
+    return operationId;
+  });
+  const expectedFrontier = mergeCausalFrontiers(
+    artifact.causalFrontier,
+    editableArtifactCausalFrontier([
+      { replicaId: actor.replicaId, counter: intent.replicaCounter }
+    ])
+  );
+  if (!causalFrontiersEqual(resultingCausalFrontier, expectedFrontier)) {
+    throw new EditableArtifactKernelContractError(
+      "Kernel resulting frontier does not exactly match committed operation dots"
+    );
+  }
+  return Object.freeze({
+    committedTransactionBytes: result.committedTransactionBytes.slice(),
+    serverTransactionId,
+    dot,
+    operationIds: Object.freeze(operationIds),
+    priorStateHash,
+    resultingCausalFrontier,
+    stateHash,
+    kernelVersion: result.kernelVersion,
+    modelSchemaVersion: result.modelSchemaVersion,
+    operationProtocolVersion: summary.operationProtocolVersion
+  });
+}
+function transactionOutboxRecord(outboxId, receipt) {
+  const event = receipt.modality === "spreadsheet" ? Object.freeze({
+    kind: "transaction_committed",
+    schemaVersion: 1,
+    scope: receipt.scope,
+    artifactId: receipt.artifactId,
+    modality: receipt.modality,
+    serverTransactionId: receipt.serverTransactionId,
+    sequenceStart: receipt.sequenceStart,
+    sequenceEnd: receipt.sequenceEnd,
+    stateHash: receipt.stateHash,
+    operationProtocolVersion: receipt.operationProtocolVersion,
+    committedAt: receipt.committedAt
+  }) : Object.freeze({
+    kind: "transaction_committed",
+    schemaVersion: 1,
+    scope: receipt.scope,
+    artifactId: receipt.artifactId,
+    modality: receipt.modality,
+    serverTransactionId: receipt.serverTransactionId,
+    sequenceStart: receipt.sequenceStart,
+    sequenceEnd: receipt.sequenceEnd,
+    stateHash: receipt.stateHash,
+    commitProtocolVersion: receipt.commitProtocolVersion,
+    committedAt: receipt.committedAt
+  });
+  return Object.freeze({
+    outboxId,
+    event,
+    state: "pending",
+    attemptCount: 0,
+    leaseOwner: null,
+    leaseExpiresAt: null,
+    nextAttemptAt: receipt.committedAt,
+    lastErrorCode: null,
+    publishedAt: null,
+    deadLetteredAt: null,
+    createdAt: receipt.committedAt
+  });
+}
+function validateSnapshotRequest(request) {
+  const record = plainDataRecord(request, "snapshot request");
+  const rawModality = dataProperty(record, "modality", true);
+  if (rawModality !== "spreadsheet" && rawModality !== "document" && rawModality !== "presentation") {
+    throw new TypeError("Snapshot modality is invalid");
+  }
+  rejectUnknownKeys(
+    record,
+    rawModality === "spreadsheet" ? [
+      "modality",
+      "snapshotId",
+      "blobReference",
+      "byteSize",
+      "contentHash",
+      "mimeType",
+      "coveredHeadSequence",
+      "coveredCausalFrontier",
+      "stateHash",
+      "modelSchemaVersion",
+      "operationProtocolVersion",
+      "kernelVersion",
+      "crdtStateVersion",
+      "verifiedAt"
+    ] : [
+      "modality",
+      "snapshotId",
+      "blobReference",
+      "byteSize",
+      "contentHash",
+      "mimeType",
+      "coveredHeadSequence",
+      "stateHash",
+      "modelSchemaVersion",
+      "kernelVersion",
+      "nativeRevision",
+      "verifiedAt"
+    ],
+    "snapshot request"
+  );
+  const rawSnapshotId = dataProperty(record, "snapshotId", true);
+  const rawBlobReference = dataProperty(record, "blobReference", true);
+  const rawByteSize = dataProperty(record, "byteSize", true);
+  const rawContentHash = dataProperty(record, "contentHash", true);
+  const rawMimeType = dataProperty(record, "mimeType", true);
+  const rawCoveredHeadSequence = dataProperty(record, "coveredHeadSequence", true);
+  const rawStateHash = dataProperty(record, "stateHash", true);
+  const rawModelSchemaVersion = dataProperty(record, "modelSchemaVersion", true);
+  const rawKernelVersion = dataProperty(record, "kernelVersion", true);
+  const rawVerifiedAt = dataProperty(record, "verifiedAt", true);
+  if (typeof rawSnapshotId !== "string" || typeof rawBlobReference !== "string" || typeof rawByteSize !== "number" || typeof rawContentHash !== "string" || typeof rawCoveredHeadSequence !== "number" || typeof rawStateHash !== "string" || typeof rawModelSchemaVersion !== "number" || typeof rawKernelVersion !== "string" || typeof rawVerifiedAt !== "string") {
+    throw new TypeError("Snapshot request fields are malformed");
+  }
+  if (rawMimeType !== "application/vnd.opengeni.editable-artifact-snapshot") {
+    throw new TypeError("Snapshot MIME type is unsupported");
+  }
+  const snapshotId = editableArtifactSnapshotId(rawSnapshotId);
+  assertBoundedOpaqueReference(rawBlobReference, "snapshot blob reference");
+  assertPositiveSafeInteger(rawByteSize, "snapshot byte size");
+  const contentHash = editableArtifactContentHash(rawContentHash);
+  assertNonnegativeSafeInteger(rawCoveredHeadSequence, "snapshot covered head sequence");
+  const stateHash = editableArtifactStateHash(rawStateHash);
+  assertPositiveSafeInteger(rawModelSchemaVersion, "snapshot model schema version");
+  assertBoundedKernelVersion(rawKernelVersion);
+  assertIsoTimestamp(rawVerifiedAt, "snapshot verified timestamp");
+  const common = {
+    modality: rawModality,
+    snapshotId,
+    blobReference: rawBlobReference,
+    byteSize: rawByteSize,
+    contentHash,
+    mimeType: "application/vnd.opengeni.editable-artifact-snapshot",
+    coveredHeadSequence: rawCoveredHeadSequence,
+    stateHash,
+    modelSchemaVersion: rawModelSchemaVersion,
+    kernelVersion: rawKernelVersion,
+    verifiedAt: rawVerifiedAt
+  };
+  if (rawModality === "spreadsheet") {
+    const rawCoveredCausalFrontier = dataProperty(record, "coveredCausalFrontier", true);
+    const rawOperationProtocolVersion = dataProperty(record, "operationProtocolVersion", true);
+    const rawCrdtStateVersion = dataProperty(record, "crdtStateVersion", true);
+    if (!Array.isArray(rawCoveredCausalFrontier) || typeof rawOperationProtocolVersion !== "number" || typeof rawCrdtStateVersion !== "number") {
+      throw new TypeError("Spreadsheet snapshot fields are malformed");
+    }
+    assertPositiveSafeInteger(rawOperationProtocolVersion, "snapshot operation protocol version");
+    assertPositiveSafeInteger(rawCrdtStateVersion, "snapshot CRDT state version");
+    return Object.freeze({
+      ...common,
+      modality: "spreadsheet",
+      coveredCausalFrontier: editableArtifactCausalFrontier(
+        rawCoveredCausalFrontier
+      ),
+      operationProtocolVersion: rawOperationProtocolVersion,
+      crdtStateVersion: rawCrdtStateVersion
+    });
+  }
+  const rawNativeRevision = dataProperty(record, "nativeRevision", true);
+  if (typeof rawNativeRevision !== "number") {
+    throw new TypeError("Serialized snapshot native revision is malformed");
+  }
+  assertNonnegativeSafeInteger(rawNativeRevision, "snapshot native revision");
+  return Object.freeze({
+    ...common,
+    modality: rawModality,
+    nativeRevision: rawNativeRevision
+  });
+}
+function sameSnapshotRequest(existing, candidate) {
+  if (existing.modality !== candidate.modality || !(existing.snapshotId === candidate.snapshotId && existing.blobReference === candidate.blobReference && existing.byteSize === candidate.byteSize && existing.contentHash === candidate.contentHash && existing.mimeType === candidate.mimeType && existing.coveredHeadSequence === candidate.coveredHeadSequence && existing.stateHash === candidate.stateHash && existing.modelSchemaVersion === candidate.modelSchemaVersion && existing.kernelVersion === candidate.kernelVersion && existing.verifiedAt === candidate.verifiedAt)) {
+    return false;
+  }
+  if (existing.modality === "spreadsheet" && candidate.modality === "spreadsheet") {
+    return causalFrontiersEqual(existing.coveredCausalFrontier, candidate.coveredCausalFrontier) && existing.operationProtocolVersion === candidate.operationProtocolVersion && existing.crdtStateVersion === candidate.crdtStateVersion;
+  }
+  return existing.modality !== "spreadsheet" && candidate.modality !== "spreadsheet" && existing.nativeRevision === candidate.nativeRevision;
+}
+function snapshotOutboxRecord(outboxId, snapshot) {
+  const event = snapshot.modality === "spreadsheet" ? Object.freeze({
+    kind: "snapshot_published",
+    schemaVersion: 1,
+    scope: snapshot.scope,
+    artifactId: snapshot.artifactId,
+    modality: snapshot.modality,
+    snapshotId: snapshot.snapshotId,
+    coveredHeadSequence: snapshot.coveredHeadSequence,
+    stateHash: snapshot.stateHash,
+    operationProtocolVersion: snapshot.operationProtocolVersion,
+    publishedAt: snapshot.publishedAt
+  }) : Object.freeze({
+    kind: "snapshot_published",
+    schemaVersion: 1,
+    scope: snapshot.scope,
+    artifactId: snapshot.artifactId,
+    modality: snapshot.modality,
+    snapshotId: snapshot.snapshotId,
+    coveredHeadSequence: snapshot.coveredHeadSequence,
+    stateHash: snapshot.stateHash,
+    publishedAt: snapshot.publishedAt
+  });
+  return Object.freeze({
+    outboxId,
+    event,
+    state: "pending",
+    attemptCount: 0,
+    leaseOwner: null,
+    leaseExpiresAt: null,
+    nextAttemptAt: snapshot.publishedAt,
+    lastErrorCode: null,
+    publishedAt: null,
+    deadLetteredAt: null,
+    createdAt: snapshot.publishedAt
+  });
+}
+function canonicalNow(clock) {
+  const now = clock.now();
+  if (Number.isNaN(now.getTime())) throw new TypeError("Artifact clock returned an invalid date");
+  return now.toISOString();
+}
+
+export {
+  editableArtifactId,
+  editableArtifactTransactionId,
+  editableArtifactReceiptId,
+  editableArtifactSnapshotId,
+  editableArtifactOutboxId,
+  editableArtifactOperationId,
+  editableArtifactReplicaId,
+  editableArtifactClientTransactionId,
+  editableArtifactRequestHash,
+  editableArtifactStateHash,
+  editableArtifactContentHash,
+  editableArtifactScope,
+  validateEditableArtifactActor,
+  editableArtifactActorKey,
+  editableArtifactCausalFrontier,
+  causalCounter,
+  causalFrontierDominates,
+  causalFrontiersEqual,
+  mergeCausalFrontiers,
+  EDITABLE_ARTIFACT_ORIGINAL_IMPORT_MAX_BYTES,
+  assertNonnegativeSafeInteger,
+  assertPositiveSafeInteger,
+  assertIsoTimestamp,
+  assertBoundedArtifactTitle,
+  assertBoundedOpaqueReference,
+  assertBoundedKernelVersion,
+  compareCodeUnits,
+  EditableArtifactDomainError,
+  EditableArtifactNotFoundError,
+  EditableArtifactInvalidRequestError,
+  EditableArtifactForbiddenError,
+  EditableArtifactNotEditableError,
+  EditableArtifactIdempotencyConflictError,
+  EditableArtifactRequestHashMismatchError,
+  EditableArtifactCausalFutureError,
+  EditableArtifactCausalChainError,
+  EditableArtifactStaleBaseError,
+  EditableArtifactKernelContractError,
+  EditableArtifactRetryableConflictError,
+  EditableArtifactUndoTargetError,
+  EditableArtifactSnapshotConflictError,
+  EditableArtifactOutboxLeaseConflictError,
+  hashEditableArtifactCreateRequest,
+  hashEditableArtifactImportRequest,
+  OgatxEditableArtifactMutationIntentCodec,
+  ogatxEditableArtifactMutationIntentCodec,
+  MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES,
+  MAX_EDITABLE_ARTIFACT_SNAPSHOT_TAIL_BYTES,
+  MAX_EDITABLE_ARTIFACT_SNAPSHOT_TAIL_SEGMENTS,
+  MAX_EDITABLE_ARTIFACT_SNAPSHOT_TAIL_SEGMENT_BYTES,
+  EditableArtifactSnapshotVerificationError,
+  ProductionEditableArtifactSnapshotVerifier,
+  EDITABLE_ARTIFACT_MAX_OPERATIONS_PER_TRANSACTION,
+  EDITABLE_ARTIFACT_MAX_UNDO_TARGETS_PER_TRANSACTION,
+  EDITABLE_ARTIFACT_MAX_COMMAND_BYTES_PER_TRANSACTION,
+  EDITABLE_ARTIFACT_MAX_INTENT_BYTES_PER_TRANSACTION,
+  EDITABLE_ARTIFACT_INTENT_PROTOCOL_VERSION,
+  EDITABLE_ARTIFACT_MAX_OPERATION_BYTES_PER_TRANSACTION,
+  EDITABLE_ARTIFACT_MAX_COMMITTED_TRANSACTION_BYTES,
+  EDITABLE_ARTIFACT_OPERATION_PROTOCOL_VERSION,
+  EDITABLE_ARTIFACT_MAX_COMMIT_ATTEMPTS,
+  EDITABLE_ARTIFACT_COMPACTION_TRANSACTION_THRESHOLD,
+  EDITABLE_ARTIFACT_COMPACTION_BYTE_THRESHOLD,
+  EditableArtifactService
+};
+//# sourceMappingURL=chunk-JJU6I5XD.js.map