@sixb/core 0.1.20 → 0.1.22

package/dist/chunk-qhqgp4jf.js

@@ -0,0 +1,1418 @@
+// @bun
+import {
+  validateObjectQuery2,
+  validateObjectQueryWithAdmission,
+  SYSTEM_PRINCIPAL2,
+  principalsEqual2
+} from "./chunk-h3pbv7n8.js";
+import {
+  resolveRuntimeAuthorizationForProject,
+  AuthorizationError2,
+  isRuntimeAllowed2
+} from "./chunk-yc9ners4.js";
+import {
+  inferFileMediaType2
+} from "./chunk-wkv3h3q7.js";
+import {
+  createArtifactId,
+  isArtifactAddress2,
+  parseArtifactAddress2
+} from "./chunk-3fqxbn31.js";
+import {
+  ARTIFACT_LIMITS2,
+  ARTIFACT_STATE_LIMITS2
+} from "./chunk-hz5d43gn.js";
+import {
+  ARTIFACT_THEME_FILE2,
+  parseArtifactTheme2,
+  ARTIFACT_QUERIES_DIRECTORY,
+  ARTIFACT_QUERY_KINDS,
+  isArtifactQueryName,
+  artifactQueryPath,
+  artifactQueryName2,
+  parseArtifactQuery,
+  resolveArtifactAddress2,
+  CANVAS_FILE2,
+  parseCanvas2,
+  createHeadingSlugger2,
+  CsvParseError2,
+  parseCsv2,
+  WORKBOOK_FILE2,
+  sheetFilePath2,
+  parseWorkbook2,
+  parseSheetNumber2,
+  parseSheetDate2,
+  evaluateComputedColumns2,
+  liveSheetColumns2,
+  sheetColumnsProblem,
+  sheetFormulasProblem,
+  sheetChartsProblem
+} from "./chunk-waqk73p1.js";
+import {
+  ArtifactStorageError
+} from "./chunk-fe8zwt8b.js";
+import {
+  getAuthorizedOntologyView,
+  readerClearance
+} from "./chunk-7z5p905k.js";
+import {
+  ArtifactRequestError2,
+  checkArtifactFiles,
+  readArtifactText,
+  invalidArtifact,
+  decodeHtmlEntities,
+  HTML_ENTRY2,
+  refuseFrameAssetPaths,
+  readHtmlReferences
+} from "./chunk-qx00vjrj.js";
+import {
+  ObjectQueryValidationError2,
+  ObjectQueryPlanningError2,
+  ObjectQueryExecutionError2,
+  normalizeObjectQuery2
+} from "./chunk-j936th07.js";
+import {
+  AgentRequestError2
+} from "./chunk-9wr3yajk.js";
+
+// src/agents/thread-access.ts
+function createAgentThreadAccessRule(runtime, authority, agents) {
+  const caller = authority.type === "principal" ? authority.context.principal : SYSTEM_PRINCIPAL2;
+  const blocked = authority.type === "denied" || authority.type === "delegated";
+  const accessIn = (thread) => {
+    if (blocked || !isRuntimeAllowed2(runtime, { kind: "agent.run" }))
+      return null;
+    if (authority.type !== "principal")
+      return "owner";
+    if (principalsEqual2(caller, thread.ownerPrincipal))
+      return "owner";
+    return thread.participants.some((participant) => principalsEqual2(participant.principal, caller)) ? "participant" : null;
+  };
+  const read = async (threadId) => {
+    if (blocked)
+      return null;
+    const storage = agents ?? runtime.storage.agents;
+    const getById = (id) => storage?.threads.getById({ projectId: runtime.projectId, id });
+    const stored = await getById(threadId);
+    if (!stored)
+      return null;
+    const conversation = stored.parent ? await getById(stored.parent.threadId) : stored;
+    if (conversation?.kind !== "conversation")
+      return null;
+    const [thread, readThrough = thread] = await agentThreadViews(runtime, conversation === stored ? [stored] : [stored, conversation], storage);
+    const access = readThrough ? accessIn(readThrough) : null;
+    return thread && access ? { thread, access } : null;
+  };
+  return { caller, read };
+}
+function assertConversationThread2(thread) {
+  if (thread.kind === "conversation")
+    return;
+  throw new AgentRequestError2("thread_not_conversation", `[Sixb] Agent thread '${thread.id}' is a sub-agent's: it is read through its conversation and takes no change of its own.`);
+}
+function conversationThreadId2(thread) {
+  return thread.parent?.threadId ?? thread.id;
+}
+async function agentThreadViews(runtime, threads, agents = runtime.storage.agents) {
+  const participants = threads.length === 0 ? [] : await agents?.threads.listParticipants({
+    projectId: runtime.projectId,
+    threadIds: threads.map((thread) => thread.id)
+  }) ?? [];
+  return threads.map((thread) => ({
+    ...publicThread(thread),
+    participants: participants.filter((participant) => participant.threadId === thread.id).map(({ principal, addedAt, addedBy }) => ({ principal, addedAt, addedBy }))
+  }));
+}
+function publicThread(thread) {
+  if (!thread.sandboxState)
+    return thread;
+  const { name, status, initialized } = thread.sandboxState;
+  return { ...thread, sandboxState: { name, status, initialized } };
+}
+
+// src/artifacts/access.ts
+function createArtifactAccessRule(input) {
+  const { caller } = input;
+  const conversations = new Map;
+  const conversation = (threadId) => {
+    if (caller === null || !input.sharing)
+      return Promise.resolve(null);
+    let reads = conversations.get(threadId);
+    if (!reads) {
+      reads = input.conversation(threadId);
+      conversations.set(threadId, reads);
+    }
+    return reads;
+  };
+  const ownAccess = (artifact) => {
+    if (caller === null)
+      return "none";
+    if (caller === "system" || principalsEqual2(caller, artifact.owner))
+      return "owner";
+    return input.sharing ? undefined : "none";
+  };
+  const threadIdsOf = (artifact) => input.storage.listThreadIds({ projectId: input.projectId, id: artifact.id });
+  const accessTo = async (artifact) => {
+    const own = ownAccess(artifact);
+    if (own)
+      return own;
+    let access = "none";
+    for (const threadId of await threadIdsOf(artifact)) {
+      const reads = await conversation(threadId);
+      if (reads === "update")
+        return "update";
+      if (reads === "read")
+        access = "read";
+    }
+    return access;
+  };
+  const publishAccess = async (artifact, threadId) => {
+    if (threadId === undefined)
+      return accessTo(artifact);
+    const own = ownAccess(artifact);
+    if (own)
+      return own;
+    if (!(await threadIdsOf(artifact)).includes(threadId))
+      return "none";
+    const reads = await conversation(threadId);
+    return reads === null ? "none" : reads;
+  };
+  return { accessTo, publishAccess, conversation };
+}
+function assertUpdatable(artifactId, access) {
+  if (access === "none") {
+    throw new ArtifactRequestError2("not_shared", `[Sixb] Artifact '${artifactId}' is not shared in a conversation you read.`);
+  }
+  if (access === "read") {
+    throw new ArtifactRequestError2("read_only", `[Sixb] You read artifact '${artifactId}' as an observer: you cannot change it or keep page data in it.`);
+  }
+}
+
+// src/artifacts/run-query.ts
+var PAGE_SIZE = 1000;
+async function runArtifactQuery(runtime, name, query) {
+  try {
+    const shape = describeArtifactQuery(runtime, query);
+    if (query.kind === "facets") {
+      const { total, facets } = await runtime.objectReader.facet({
+        query: query.query,
+        facets: query.facets
+      });
+      return { kind: "facets", total, facets, ...shape };
+    }
+    return { kind: "objects", ...await readRows(runtime, query.query), ...shape };
+  } catch (error) {
+    throw queryInvalid(name, error);
+  }
+}
+function describeArtifactQuery(runtime, query) {
+  const validated = validateObjectQuery2(query.query, { ontology: runtime.ontology });
+  return {
+    resultObjectTypeIds: [...validated.result.objectTypeIds],
+    readObjectTypeIds: [...validated.touchedObjectTypeIds],
+    schema: artifactQuerySchema(getAuthorizedOntologyView(runtime.objectReader), validated)
+  };
+}
+function artifactQuerySchema(view, validated) {
+  const valueTypes = view.getValueTypesById();
+  const results = validated.result.objectTypeIds;
+  const root = validated.query;
+  const links = {};
+  for (const expansion of root.kind === "expand" ? root.expansions : []) {
+    links[expansion.linkId] = {
+      properties: propertiesOf(view, expansionTargets(view, results, expansion), valueTypes)
+    };
+  }
+  return { properties: propertiesOf(view, results, valueTypes), links };
+}
+function propertiesOf(view, objectTypeIds, valueTypes) {
+  const properties = {};
+  for (const objectTypeId of objectTypeIds) {
+    for (const property of view.getObjectTypeById(objectTypeId)?.properties ?? []) {
+      properties[property.id] ??= queryProperty(property.schema, valueTypes);
+    }
+  }
+  return properties;
+}
+function expansionTargets(view, results, expansion) {
+  const targets = new Set;
+  if (expansion.direction === "outgoing") {
+    for (const objectTypeId of results) {
+      const link = view.getObjectTypeById(objectTypeId)?.links.find((candidate) => candidate.id === expansion.linkId);
+      if (!link || link.targetObjectTypeId === "*")
+        continue;
+      for (const target of [link.targetObjectTypeId].flat())
+        targets.add(target);
+    }
+    return [...targets];
+  }
+  const sources = expansion.sourceObjectTypeId === undefined ? view.listObjectTypes() : [view.getObjectTypeById(expansion.sourceObjectTypeId)].filter((type) => type !== null);
+  for (const source of sources) {
+    const link = source.links.find((candidate) => candidate.id === expansion.linkId);
+    if (!link)
+      continue;
+    const reaches = link.targetObjectTypeId === "*" || results.some((result) => view.isValidLinkTarget(link.targetObjectTypeId, result));
+    if (reaches)
+      targets.add(source.id);
+  }
+  return [...targets];
+}
+function queryProperty(schema, valueTypes, depth = 0) {
+  if (typeof schema === "string")
+    return { type: schema };
+  switch (schema.type) {
+    case "valueTypeRef": {
+      const named = valueTypes.get(schema.valueTypeId)?.schema ?? schema._resolved;
+      return named && depth < 8 ? queryProperty(named, valueTypes, depth + 1) : { type: "object" };
+    }
+    case "enum":
+      return { type: "enum", valueType: schema.valueType };
+    default:
+      return { type: schema.type };
+  }
+}
+async function readRows(runtime, query) {
+  const objects = [];
+  let total = 0;
+  let pageToken;
+  for (;; ) {
+    const pageSize = Math.min(PAGE_SIZE, ARTIFACT_LIMITS2.maxQueryRows - objects.length);
+    const first = pageToken === undefined;
+    const page = await runtime.objectReader.executeQuery({
+      query: { kind: "page", input: query, pageSize, ...pageToken ? { pageToken } : {} },
+      ...first ? { includeTotal: true } : {}
+    });
+    if (first)
+      total = page.total ?? page.objects.length;
+    objects.push(...page.objects);
+    if (!page.hasMore || page.nextPageToken === undefined) {
+      return { objects, total, truncated: false };
+    }
+    if (objects.length >= ARTIFACT_LIMITS2.maxQueryRows) {
+      return { objects, total, truncated: true };
+    }
+    pageToken = page.nextPageToken;
+  }
+}
+function queryInvalid(name, error) {
+  if (!(error instanceof ObjectQueryValidationError2 || error instanceof ObjectQueryPlanningError2)) {
+    return error;
+  }
+  const issues = error.issues.map((issue) => `${issue.path}: ${issue.message}`).join("; ");
+  const problem = error instanceof ObjectQueryValidationError2 ? "no longer matches the ontology" : "can no longer run";
+  return new ArtifactRequestError2("query_invalid", `[Sixb] Query '${name}' ${problem}: ${issues}`);
+}
+
+// src/artifacts/publish/queries.ts
+function createArtifactQueryChecker(runtime) {
+  return async (query) => {
+    const shape = describeArtifactQuery(runtime, query);
+    if (query.kind === "facets") {
+      await runtime.objectReader.facet({ query: query.query, facets: query.facets });
+      return { kind: query.kind, ...shape };
+    }
+    await runtime.objectReader.exists({ query: query.query });
+    const clearance = await readerClearance(runtime.objectReader);
+    if (clearance)
+      assertReturnsReadable(query.query, runtime.ontology, clearance);
+    if (!isRuntimeAllowed2(runtime, { kind: "users.view" }))
+      assertExpandsNoUsers(query.query);
+    return { kind: query.kind, ...shape };
+  };
+}
+
+class UnreadableReturnError extends AuthorizationError2 {
+  at;
+  constructor(grantKey, at, message) {
+    super(grantKey, message);
+    this.at = at;
+  }
+}
+function assertReturnsReadable(query, ontology, clearance) {
+  const { normalized, resultObjectTypeIds, expansions } = returnedShape(query, ontology);
+  const project = outermostProject(normalized);
+  for (const objectTypeId of resultObjectTypeIds) {
+    const propertyIds = project?.properties ?? propertiesOf2(ontology, objectTypeId);
+    const unreadable = firstUnreadable(clearance, objectTypeId, propertyIds);
+    if (!unreadable)
+      continue;
+    const returns = `returns '${unreadable.propertyId}' on '${objectTypeId}', which you are not cleared to read`;
+    throw project ? new UnreadableReturnError(`clearance:marking:${unreadable.marking}`, `${project.at}.properties[${unreadable.index}]`, `[Sixb] ${returns}: list only the properties you can read.`) : new UnreadableReturnError(`clearance:marking:${unreadable.marking}`, "$", `[Sixb] ${returns}: add a "project" node that lists only the properties you can read.`);
+  }
+  for (const expansion of expansions) {
+    for (const objectTypeId of expansion.objectTypeIds) {
+      const unreadable = firstUnreadable(clearance, objectTypeId, propertiesOf2(ontology, objectTypeId));
+      if (!unreadable)
+        continue;
+      throw new UnreadableReturnError(`clearance:marking:${unreadable.marking}`, expansion.at, `[Sixb] expands '${expansion.linkId}' to '${objectTypeId}', whose '${unreadable.propertyId}' you are not cleared to read: an expansion returns every property, so leave it out, or read '${objectTypeId}' in a query of its own with a "project" node.`);
+    }
+  }
+}
+function assertExpandsNoUsers(query) {
+  const normalized = normalizeObjectQuery2(query);
+  if (normalized.kind !== "expand")
+    return;
+  const expanded = firstUserExpansion(normalized.users, normalized.expansions, "$");
+  if (!expanded)
+    return;
+  throw new UnreadableReturnError("view:users", expanded.at, `[Sixb] returns the member profiles '${expanded.propertyId}' refers to, which you are not allowed to view: leave '${expanded.propertyId}' out of "users".`);
+}
+function firstUserExpansion(users, expansions, at) {
+  const [propertyId] = users ?? [];
+  if (propertyId !== undefined)
+    return { propertyId, at: `${at}.users[0]` };
+  for (const [index, expansion] of expansions.entries()) {
+    const path = at === "$" ? `$.expansions[${index}]` : `${at}.expand[${index}]`;
+    const found = firstUserExpansion(expansion.users, expansion.expand ?? [], path);
+    if (found)
+      return found;
+  }
+  return;
+}
+function propertiesOf2(ontology, objectTypeId) {
+  return ontology.resolveObjectType(objectTypeId).properties.map((property) => property.id);
+}
+function firstUnreadable(clearance, objectTypeId, propertyIds) {
+  for (const [index, propertyId] of propertyIds.entries()) {
+    const marking = clearance.missingMarking(objectTypeId, propertyId);
+    if (marking !== undefined)
+      return { propertyId, index, marking };
+  }
+  return;
+}
+function returnedShape(query, ontology) {
+  const expansions = [];
+  const state = Object.freeze({});
+  const recorder = {
+    empty: () => state,
+    source: () => ({ state }),
+    property: () => {
+      return;
+    },
+    edge: (input) => {
+      if (input.use === "expand") {
+        expansions.push({
+          at: input.path,
+          linkId: input.linkId,
+          objectTypeIds: [...input.result.objectTypeIds]
+        });
+      }
+      return { state };
+    },
+    set: () => state
+  };
+  const validated = validateObjectQueryWithAdmission(query, { ontology }, recorder);
+  return {
+    normalized: validated.query,
+    resultObjectTypeIds: validated.result.objectTypeIds,
+    expansions
+  };
+}
+function outermostProject(query, at = "$") {
+  switch (query.kind) {
+    case "project":
+      return query.properties ? { properties: query.properties, at } : undefined;
+    case "expand":
+    case "limit":
+    case "sort":
+      return outermostProject(query.input, `${at}.input`);
+    default:
+      return;
+  }
+}
+async function checkArtifactQueries(blobStorage, kind, files, checker) {
+  const checked = new Map;
+  if (kind === "file")
+    return checked;
+  const queries = files.filter((file) => file.path.startsWith(ARTIFACT_QUERIES_DIRECTORY));
+  const [first] = queries;
+  if (!first)
+    return checked;
+  if (!ARTIFACT_QUERY_KINDS.includes(kind)) {
+    throw invalidArtifact(`'${first.path}': a ${kind} runs no query. A document shows a live sheet instead.`);
+  }
+  if (queries.length > ARTIFACT_LIMITS2.maxQueries) {
+    throw invalidArtifact(`A version holds at most ${ARTIFACT_LIMITS2.maxQueries} queries; this one has ${queries.length}.`);
+  }
+  if (!checker) {
+    throw invalidArtifact(`'${first.path}' is a query, and this publish has no way to check it as its author.`);
+  }
+  for (const file of queries) {
+    const name = artifactQueryName2(file.path);
+    if (!name) {
+      throw invalidArtifact(`'${file.path}' is not a query: name it queries/<name>.json, with lowercase letters, digits and hyphens, at most 64 characters.`);
+    }
+    const text = await readArtifactText(blobStorage, file, ARTIFACT_LIMITS2.maxQueryBytes);
+    const parsed = parseArtifactQuery(file.path, text);
+    if ("error" in parsed)
+      throw invalidArtifact(parsed.error);
+    try {
+      checked.set(name, await checker(parsed.query));
+    } catch (error) {
+      throw refusal(file.path, parsed, error);
+    }
+  }
+  return checked;
+}
+function refusal(path, parsed, error) {
+  const inFile = (issuePath) => parsed.query.kind === "facets" && issuePath.startsWith("$.facets") ? issuePath : `${parsed.at}${issuePath.slice(1)}`;
+  if (error instanceof UnreadableReturnError) {
+    return invalidArtifact(`${path}: ${inFile(error.at)}: ${error.message.replace(/^\[Sixb\]\s*/, "")}`);
+  }
+  if (error instanceof ObjectQueryValidationError2 || error instanceof ObjectQueryPlanningError2) {
+    const issues = error.issues.map((issue) => `${inFile(issue.path)}: ${issue.message}`);
+    return invalidArtifact(`${path}: ${issues.join("; ")}`);
+  }
+  if (error instanceof AuthorizationError2 || error instanceof ObjectQueryExecutionError2) {
+    return invalidArtifact(`${path}: ${error.message.replace(/^\[Sixb\]\s*/, "")}`);
+  }
+  return error;
+}
+
+// src/artifacts/publish/references.ts
+async function resolveReferences(context, found) {
+  if (found.length > ARTIFACT_LIMITS2.maxReferences) {
+    throw invalidArtifact(`A version may refer to at most ${ARTIFACT_LIMITS2.maxReferences} artifacts; this one has ${found.length} addresses.`);
+  }
+  const artifacts = new Map;
+  const versions = new Map;
+  const resolved = [];
+  for (const reference of found) {
+    const where = reference.at ? `In '${reference.at}', '${reference.address}'` : `'${reference.address}'`;
+    const address = parseArtifactAddress2(reference.address);
+    if (!address) {
+      throw invalidArtifact(`${where} is not an artifact address: write artifact:<id>[@<version>][/<file>][#<part>], such as artifact:art_k3m9q2x7tp#chart=revenue.`);
+    }
+    if (address.artifactId === context.artifactId) {
+      throw invalidArtifact(`${where} names the artifact being published. Link to one of its sections with #<slug> instead.`);
+    }
+    let artifact = artifacts.get(address.artifactId);
+    if (!artifact) {
+      artifact = context.storage.get({ projectId: context.projectId, id: address.artifactId }).then(async (record) => record && await context.readable(record) ? record : null);
+      artifacts.set(address.artifactId, artifact);
+    }
+    const record = await artifact;
+    if (!record) {
+      throw invalidArtifact(`${where} names no artifact you can read.`);
+    }
+    const number = address.version ?? record.latestVersion;
+    const key = `${record.id}@${number}`;
+    let version = versions.get(key);
+    if (!version) {
+      version = context.storage.getVersion({
+        projectId: context.projectId,
+        artifactId: record.id,
+        version: number
+      });
+      versions.set(key, version);
+    }
+    const target = await version;
+    if (!target)
+      throw invalidArtifact(`${where}: \u201C${record.title}\u201D has no version ${number}.`);
+    const result = resolveArtifactAddress2(address, { kind: record.kind, ...target });
+    if ("problem" in result) {
+      throw invalidArtifact(`${where}: \u201C${target.title}\u201D ${result.problem}.`);
+    }
+    resolved.push({ ...reference, resolvedVersion: target.version });
+  }
+  return resolved;
+}
+async function brokenDependents(context, artifact, version) {
+  const dependents = await context.storage.listReferencingVersions({
+    projectId: context.projectId,
+    artifactId: artifact.id
+  });
+  const warnings = [];
+  for (const dependent of dependents) {
+    if (dependent.artifactId === artifact.id)
+      continue;
+    const broken = [];
+    for (const reference of dependent.references) {
+      const address = parseArtifactAddress2(reference.address);
+      if (address?.artifactId !== artifact.id || address.version !== undefined)
+        continue;
+      const result = resolveArtifactAddress2(address, { kind: artifact.kind, ...version });
+      if (!("problem" in result))
+        continue;
+      broken.push({
+        code: "reference_broken",
+        message: `\u201C${dependent.title}\u201D (${dependent.artifactId}) ${reference.as === "embed" ? "shows" : "links to"} ${reference.address}, but version ${version.version} ${result.problem}. Publish its next version with an address that resolves, or restore what it names.`
+      });
+    }
+    if (broken.length === 0)
+      continue;
+    const owner = await context.storage.get({
+      projectId: context.projectId,
+      id: dependent.artifactId
+    });
+    if (owner && await context.readable(owner))
+      warnings.push(...broken);
+  }
+  return warnings;
+}
+function ownArtifacts(author) {
+  return async (artifact) => author.type === "system" || principalsEqual2(author, artifact.owner);
+}
+
+// src/artifacts/publish/validate/canvas.ts
+import { posix } from "path";
+async function validateCanvas(blobStorage, files) {
+  const byPath = new Map(files.map((file) => [file.path, file]));
+  const canvasFile = byPath.get(CANVAS_FILE2);
+  if (!canvasFile) {
+    throw invalidArtifact(`A canvas is '${CANVAS_FILE2}', listing its items, with the HTML files its boards show beside it.`);
+  }
+  refuseFrameAssetPaths(files, "the canvas");
+  const parsed = parseCanvas2(await readArtifactText(blobStorage, canvasFile, ARTIFACT_LIMITS2.maxCanvasBytes));
+  if ("error" in parsed)
+    throw invalidArtifact(parsed.error);
+  const { canvas } = parsed;
+  const references = [];
+  for (const item of canvas.items) {
+    if (item.type === "embed")
+      references.push({ address: item.src, as: "embed", at: item.id });
+    if (item.type !== "board")
+      continue;
+    const file = byPath.get(posix.normalize(item.file));
+    if (!file) {
+      throw invalidArtifact(`${CANVAS_FILE2} board '${item.id}' shows '${item.file}', which is not one of the canvas's files.`);
+    }
+    const rewriter = new HTMLRewriter;
+    const { references: found, refusal } = readHtmlReferences(rewriter, () => item.id, item.file);
+    rewriter.transform(await readArtifactText(blobStorage, file, ARTIFACT_LIMITS2.maxBoardBytes));
+    const refused = refusal();
+    if (refused)
+      throw invalidArtifact(`Board '${item.id}': ${refused}`);
+    references.push(...found);
+  }
+  return {
+    entry: CANVAS_FILE2,
+    outline: {
+      kind: "canvas",
+      items: canvas.items.flatMap((item) => {
+        const title = item.type === "board" || item.type === "section" ? item.title : undefined;
+        const named = { id: item.id, ...title ? { title } : {} };
+        if (item.type === "board") {
+          return [
+            { ...named, type: "board", file: posix.normalize(item.file), w: item.w, h: item.h }
+          ];
+        }
+        return item.type === "section" ? [{ ...named, type: "section" }] : [];
+      })
+    },
+    references,
+    warnings: layoutWarnings(canvas)
+  };
+}
+var overlaps = (a, b) => a.x < b.x + b.w && b.x < a.x + a.w && a.y < b.y + b.h && b.y < a.y + a.h;
+function layoutWarnings(canvas) {
+  const boards = canvas.items.flatMap((item) => item.type === "board" ? [item] : []);
+  const warnings = [];
+  boards.forEach((board, index) => {
+    for (const other of boards.slice(index + 1)) {
+      if (!overlaps(board, other))
+        continue;
+      warnings.push({
+        code: "canvas_overlap",
+        part: board.id,
+        message: `Boards '${board.id}' and '${other.id}' overlap, so one covers the other's page: leave 80 pixels between boards in a row and 160 between rows.`
+      });
+    }
+  });
+  for (const item of canvas.items) {
+    if (item.type !== "note" && item.type !== "text")
+      continue;
+    const corner = { x: item.x, y: item.y, w: 1, h: 1 };
+    const board = boards.find((candidate) => overlaps(candidate, corner));
+    if (!board)
+      continue;
+    warnings.push({
+      code: "canvas_covers_board",
+      part: item.id,
+      message: `${item.type === "note" ? "Note" : "Text"} '${item.id}' sits on board '${board.id}' and covers its page: put it beside the board, and an arrow to it when it is about the board.`
+    });
+  }
+  return warnings;
+}
+
+// src/artifacts/publish/validate/document.ts
+import { posix as posix2 } from "path";
+var DOCUMENT_ENTRY = "document.md";
+async function validateDocument(blobStorage, files) {
+  const entry = files.find((file) => file.path === DOCUMENT_ENTRY);
+  if (!entry)
+    throw invalidArtifact(`A document needs its Markdown in '${DOCUMENT_ENTRY}'.`);
+  const markdown = await readArtifactText(blobStorage, entry, ARTIFACT_LIMITS2.maxDocumentBytes);
+  const html = Bun.markdown.html(markdown, {
+    tables: true,
+    strikethrough: true,
+    tasklists: true,
+    autolinks: true
+  });
+  const headings = [];
+  const images = [];
+  const addresses = [];
+  let heading = null;
+  new HTMLRewriter().on("h1, h2, h3, h4, h5, h6", {
+    element(element) {
+      heading = { depth: Number(element.tagName.slice(1)), text: "" };
+      headings.push(heading);
+      element.onEndTag(() => {
+        heading = null;
+      });
+    },
+    text(chunk) {
+      if (heading)
+        heading.text += chunk.text;
+    }
+  }).on("img", {
+    element(element) {
+      const source = decodeHtmlEntities(element.getAttribute("src") ?? "");
+      if (isArtifactAddress2(source)) {
+        addresses.push({ address: source.trim(), as: "embed", heading: headings.length - 1 });
+      } else {
+        images.push(source);
+      }
+    }
+  }).on("a", {
+    element(element) {
+      const href = decodeHtmlEntities(element.getAttribute("href") ?? "");
+      if (isArtifactAddress2(href)) {
+        addresses.push({ address: href.trim(), as: "link", heading: headings.length - 1 });
+      }
+    }
+  }).transform(html);
+  const paths = new Set(files.map((file) => file.path));
+  for (const source of images)
+    checkImage(source, paths);
+  const slug = createHeadingSlugger2();
+  const outlined = headings.map(({ depth, text }) => {
+    const plain = decodeHtmlEntities(text).replace(/\s+/g, " ").trim();
+    return { depth, text: plain, slug: slug(plain) };
+  });
+  return {
+    entry: DOCUMENT_ENTRY,
+    outline: { kind: "document", headings: outlined },
+    references: addresses.map(({ address, as, heading: index }) => ({
+      address,
+      as,
+      at: outlined[index]?.slug ?? ""
+    }))
+  };
+}
+function checkImage(source, paths) {
+  if (source === "" || source.startsWith("//") || /^[a-z][a-z\d+.-]*:/i.test(source)) {
+    throw invalidArtifact(`${DOCUMENT_ENTRY} shows the image '${source}'. Images must be files in the artifact, by their relative path, or another artifact's address, such as artifact:art_k3m9q2x7tp#chart=revenue.`);
+  }
+  const path = posix2.normalize(safeDecodeUri(source.split(/[?#]/)[0] ?? ""));
+  if (!paths.has(path)) {
+    throw invalidArtifact(`${DOCUMENT_ENTRY} shows the image '${source}', which is not one of the artifact's files.`);
+  }
+}
+function safeDecodeUri(value) {
+  try {
+    return decodeURI(value);
+  } catch {
+    return value;
+  }
+}
+
+// src/artifacts/publish/validate/file.ts
+function validateFileArtifact(files) {
+  const [file] = files;
+  if (!file || files.length > 1) {
+    throw invalidArtifact(`A file artifact holds exactly one file; this one has ${files.length}.`);
+  }
+  return {
+    entry: file.path,
+    outline: { kind: "file", mediaType: file.file.mediaType ?? inferFileMediaType2(file.path) }
+  };
+}
+
+// src/artifacts/publish/validate/page.ts
+async function validatePage(blobStorage, files) {
+  const entry = files.find((file) => file.path === HTML_ENTRY2);
+  if (!entry) {
+    throw invalidArtifact(`A page needs '${HTML_ENTRY2}', the page itself; put its scripts, styles, and data beside it.`);
+  }
+  refuseFrameAssetPaths(files, "the page");
+  const html = await readArtifactText(blobStorage, entry, ARTIFACT_LIMITS2.maxPageBytes);
+  let title = "";
+  let heading = "";
+  let readingHeading = false;
+  const rewriter = new HTMLRewriter().on("title", {
+    text(chunk) {
+      title += chunk.text;
+    }
+  }).on("h1", {
+    element(element) {
+      if (heading || readingHeading)
+        return;
+      readingHeading = true;
+      element.onEndTag(() => {
+        readingHeading = false;
+        heading ||= " ";
+      });
+    },
+    text(chunk) {
+      if (readingHeading)
+        heading += chunk.text;
+    }
+  });
+  const { references, refusal } = readHtmlReferences(rewriter, () => "");
+  rewriter.transform(html);
+  const refused = refusal();
+  if (refused)
+    throw invalidArtifact(refused);
+  const plain = (text) => decodeHtmlEntities(text).replace(/\s+/g, " ").trim();
+  const named = plain(title) || plain(heading);
+  return {
+    entry: HTML_ENTRY2,
+    outline: { kind: "page", ...named ? { title: named.slice(0, 200) } : {} },
+    references
+  };
+}
+
+// src/artifacts/publish/validate/sheet.ts
+import { posix as posix3 } from "path";
+async function validateSheet(blobStorage, files, queries) {
+  const byPath = new Map(files.map((file) => [file.path, file]));
+  const workbookFile = byPath.get(WORKBOOK_FILE2);
+  if (!workbookFile) {
+    throw invalidArtifact(`A sheet is a directory: '${WORKBOOK_FILE2}' listing its sheets, and one CSV per sheet under sheets/. A single CSV publishes as a file.`);
+  }
+  const parsed = parseWorkbook2(await readArtifactText(blobStorage, workbookFile, ARTIFACT_LIMITS2.maxWorkbookBytes));
+  if ("error" in parsed)
+    throw invalidArtifact(parsed.error);
+  const { workbook } = parsed;
+  const declared = new Set(workbook.sheets.map((sheet) => sheetFilePath2(sheet.name)));
+  const stray = files.find((file) => file.path.startsWith("sheets/") && !declared.has(file.path));
+  if (stray) {
+    throw invalidArtifact(`'${stray.path}' is not a sheet in ${WORKBOOK_FILE2}: list it in "sheets", or move it out of sheets/.`);
+  }
+  const tables = new Map;
+  const references = [];
+  const warnings = [];
+  const sheets = [];
+  for (const sheet of workbook.sheets) {
+    if (sheet.live) {
+      const live = liveSheet(byPath, sheet, queries.get(sheet.live.query));
+      sheets.push(live.sheet);
+      tables.set(sheet.name, live.table);
+      continue;
+    }
+    const table = await readSheet(blobStorage, byPath, sheet, references);
+    sheets.push(sheet);
+    tables.set(sheet.name, table);
+    warnings.push(...computeSheet(sheet, table));
+  }
+  const laidOut = { ...workbook, sheets };
+  const charts = sheetChartsProblem(laidOut, tables);
+  if (charts)
+    throw invalidArtifact(charts);
+  return {
+    entry: WORKBOOK_FILE2,
+    outline: {
+      kind: "sheet",
+      sheets: workbook.sheets.map((sheet) => {
+        const table = tables.get(sheet.name);
+        return {
+          name: sheet.name,
+          rows: table?.rows.length ?? 0,
+          columns: [...table?.header ?? []],
+          ...sheet.live ? { query: sheet.live.query } : {}
+        };
+      }),
+      charts: workbook.charts.map((chart) => chart.name)
+    },
+    references,
+    warnings
+  };
+}
+function liveSheet(byPath, sheet, checked) {
+  const query = sheet.live?.query;
+  const csv = sheetFilePath2(sheet.name);
+  if (byPath.has(csv)) {
+    throw invalidArtifact(`Sheet '${sheet.name}' reads its rows from query '${query}', so it has no '${csv}': remove the CSV, or "query" to show it.`);
+  }
+  if (!checked || query === undefined) {
+    throw invalidArtifact(`Sheet '${sheet.name}' reads query '${query}', which the version does not have: add '${artifactQueryPath(query ?? "")}'.`);
+  }
+  if (checked.kind === "facets") {
+    throw invalidArtifact(`Sheet '${sheet.name}' reads query '${query}', which counts facets: a sheet shows rows. A page shows facets; give the sheet a query of rows.`);
+  }
+  const layout = liveSheetColumns2(sheet, checked.schema);
+  if (layout.problem)
+    throw invalidArtifact(layout.problem);
+  const table = { header: layout.columns.map((column) => column.name), rows: [] };
+  const problem = sheetColumnsProblem(layout.sheet, table) ?? sheetFormulasProblem(layout.sheet, table);
+  if (problem)
+    throw invalidArtifact(problem);
+  return { sheet: layout.sheet, table };
+}
+async function readSheet(blobStorage, byPath, sheet, references) {
+  const path = sheetFilePath2(sheet.name);
+  const file = byPath.get(path);
+  if (!file)
+    throw invalidArtifact(`Sheet '${sheet.name}' needs its values in '${path}'.`);
+  if (file.file.sizeBytes > ARTIFACT_LIMITS2.maxSheetFileBytes) {
+    throw invalidArtifact(`'${path}' is ${megabytes(file.file.sizeBytes)} MB; a sheet's values may be at most ${megabytes(ARTIFACT_LIMITS2.maxSheetFileBytes)} MB, which is what the viewer reads. Split it into several sheets, or publish the CSV as a file.`);
+  }
+  let table;
+  try {
+    table = parseCsv2(await readArtifactText(blobStorage, file, ARTIFACT_LIMITS2.maxSheetFileBytes));
+  } catch (error) {
+    if (error instanceof CsvParseError2)
+      throw invalidArtifact(`'${path}': ${error.message}`);
+    throw error;
+  }
+  const columns = sheetColumnsProblem(sheet, table);
+  if (columns)
+    throw invalidArtifact(columns);
+  const { header } = table;
+  for (const [column, format] of Object.entries(sheet.columns)) {
+    const index = header.indexOf(column);
+    if (format.type === "link" || format.type === "image") {
+      for (const [rowIndex, row] of table.rows.entries()) {
+        const value = row[index]?.trim() ?? "";
+        if (!isArtifactAddress2(value))
+          continue;
+        references.push({
+          address: value,
+          as: format.type === "image" ? "embed" : "link",
+          at: `${sheet.name}!${columnLetter(index)}${rowIndex + 2}`
+        });
+      }
+    }
+    if (format.formula) {
+      checkComputedValues(path, table, index, column);
+      continue;
+    }
+    checkColumn(path, table, index, column, format, byPath);
+  }
+  return table;
+}
+function checkComputedValues(path, table, index, column) {
+  for (const [rowIndex, row] of table.rows.entries()) {
+    const value = row[index] ?? "";
+    if (value.trim()) {
+      throw invalidArtifact(`'${path}' row ${rowIndex + 2}, column '${column}': ${JSON.stringify(value)} is in a computed column; leave its values empty, and its formula fills them.`);
+    }
+  }
+}
+function computeSheet(sheet, table) {
+  const formulas = sheetFormulasProblem(sheet, table);
+  if (formulas)
+    throw invalidArtifact(formulas);
+  const computed = evaluateComputedColumns2(sheet, table);
+  return [...computed.errors].map(([column, errors]) => ({
+    code: "sheet_formula_error",
+    part: sheet.name,
+    message: `Sheet '${sheet.name}' column '${column}' computes to ${errors.code} in ${errors.count === 1 ? "1 row" : `${errors.count} rows`}, the first row ${errors.firstRow + 2}. IFERROR gives those rows a value.`
+  }));
+}
+function checkColumn(path, table, index, column, format, byPath) {
+  for (const [rowIndex, row] of table.rows.entries()) {
+    const value = row[index] ?? "";
+    if (!value.trim() || isArtifactAddress2(value))
+      continue;
+    const problem = cellProblem(value, format, byPath);
+    if (problem) {
+      throw invalidArtifact(`'${path}' row ${rowIndex + 2}, column '${column}': ${JSON.stringify(value)} ${problem}`);
+    }
+  }
+}
+function cellProblem(value, format, byPath) {
+  switch (format.type) {
+    case "number":
+    case "currency":
+      return parseSheetNumber2(value) === undefined ? "is not a number: write plain digits, such as 4120000 or -3.5, with no symbols or separators." : undefined;
+    case "percent":
+      return parseSheetNumber2(value) === undefined ? "is not a number: write a percent as a fraction, such as 0.351 for 35.1%." : undefined;
+    case "date":
+      return parseSheetDate2(value) === undefined ? "is not a date: write YYYY-MM-DD, or an ISO 8601 date and time." : undefined;
+    case "link":
+      return /^https?:\/\/[^\s]+$/i.test(value.trim()) ? undefined : "is not a link: write a full https:// address, or another artifact's address.";
+    case "image": {
+      const imagePath = posix3.normalize(value.trim());
+      return byPath.has(imagePath) ? undefined : "is not one of the artifact's files: add the image to the artifact and give its relative path, or give another artifact's address.";
+    }
+    case "boolean":
+      return /^(true|false)$/i.test(value.trim()) ? undefined : "is not true or false: write true or false, or leave the cell empty.";
+    case "text":
+    case "tag":
+      return;
+  }
+}
+function columnLetter(index) {
+  let letters = "";
+  for (let rest = index + 1;rest > 0; rest = Math.floor((rest - 1) / 26)) {
+    letters = String.fromCharCode(65 + (rest - 1) % 26) + letters;
+  }
+  return letters;
+}
+function megabytes(bytes) {
+  return (bytes / (1024 * 1024)).toFixed(1).replace(/\.0$/, "");
+}
+
+// src/artifacts/publish/validate/slides.ts
+async function validateSlides(blobStorage, files) {
+  const entry = files.find((file) => file.path === HTML_ENTRY2);
+  if (!entry) {
+    throw invalidArtifact(`A deck needs '${HTML_ENTRY2}' with one <section class="slide"> per slide.`);
+  }
+  refuseFrameAssetPaths(files, "the deck");
+  const html = await readArtifactText(blobStorage, entry, ARTIFACT_LIMITS2.maxDeckBytes);
+  const slides = [];
+  const at = () => String(Math.max(1, slides.length));
+  let reading = null;
+  const rewriter = new HTMLRewriter().on("section", {
+    element(element) {
+      const classes = (element.getAttribute("class") ?? "").split(/\s+/);
+      if (classes.includes("slide"))
+        slides.push({ title: "", heading: false });
+    }
+  }).on("h1, h2, h3", {
+    element(element) {
+      const slide = slides.at(-1);
+      if (!slide || slide.heading)
+        return;
+      slide.heading = true;
+      reading = slide;
+      element.onEndTag(() => {
+        reading = null;
+      });
+    },
+    text(chunk) {
+      if (reading)
+        reading.title += chunk.text;
+    }
+  });
+  const { references, refusal } = readHtmlReferences(rewriter, at);
+  rewriter.transform(html);
+  const refused = refusal();
+  if (refused)
+    throw invalidArtifact(refused);
+  if (slides.length === 0) {
+    throw invalidArtifact(`${HTML_ENTRY2} has no slides: put each slide in a <section class="slide">.`);
+  }
+  if (slides.length > ARTIFACT_LIMITS2.maxSlides) {
+    throw invalidArtifact(`A deck holds at most ${ARTIFACT_LIMITS2.maxSlides} slides; this one has ${slides.length}.`);
+  }
+  return {
+    entry: HTML_ENTRY2,
+    outline: {
+      kind: "slides",
+      slides: slides.map(({ title }) => {
+        const plain = decodeHtmlEntities(title).replace(/\s+/g, " ").trim();
+        return plain ? { title: plain } : {};
+      })
+    },
+    references
+  };
+}
+
+// src/artifacts/publish/publish.ts
+var CREATE_ATTEMPTS = 3;
+async function publishArtifact2(context, input, access) {
+  const prepared = await prepareArtifactVersion2(context, input);
+  const stored = await storeArtifactVersion2(context, prepared, access);
+  return { ...stored, warnings: await artifactVersionWarnings2(context, prepared, stored) };
+}
+async function prepareArtifactVersion2(context, input) {
+  const title = checkTitle(input.title);
+  await checkArtifactFiles(context.blobStorage, input.files);
+  if (input.kind !== "file")
+    await checkTheme(context.blobStorage, input.files);
+  const queries = await checkArtifactQueries(context.blobStorage, input.kind, input.files, input.checkQuery);
+  const validated = await validateKind(context.blobStorage, input.kind, input.files, queries);
+  const readable = input.readable ?? ownArtifacts(input.author);
+  const references = await resolveReferences(referenceContext(context, { readable, artifactId: input.artifactId }), validated.references ?? []);
+  return {
+    ...input.artifactId ? { artifactId: input.artifactId } : {},
+    ...input.baseVersion === undefined ? {} : { baseVersion: input.baseVersion },
+    kind: input.kind,
+    owner: input.owner ?? input.author,
+    readable,
+    warnings: validated.warnings ?? [],
+    version: {
+      title,
+      entry: validated.entry,
+      files: input.files.map(({ path, file }) => ({ path, file: { ...file } })),
+      outline: validated.outline,
+      references,
+      author: input.author,
+      ...input.origin ? { origin: input.origin } : {},
+      createdAt: new Date
+    }
+  };
+}
+async function storeArtifactVersion2(context, prepared, access) {
+  const { artifactId } = prepared;
+  if (!artifactId) {
+    return createArtifact(context, prepared.kind, prepared.owner, prepared.version);
+  }
+  const artifact = await context.storage.get({ projectId: context.projectId, id: artifactId });
+  if (!artifact)
+    throw notFound(artifactId);
+  assertUpdatable(artifactId, await access(artifact));
+  return publishVersion(context, artifactId, prepared);
+}
+async function artifactVersionWarnings2(context, prepared, stored) {
+  if (!prepared.artifactId)
+    return prepared.warnings;
+  try {
+    return [
+      ...prepared.warnings,
+      ...await brokenDependents(referenceContext(context, prepared), stored.artifact, stored.version)
+    ];
+  } catch (error) {
+    console.warn(`[Sixb] Could not check which artifacts version ${stored.version.version} of '${stored.artifact.id}' breaks:`, error);
+    return prepared.warnings;
+  }
+}
+function referenceContext(context, input) {
+  return {
+    projectId: context.projectId,
+    storage: context.storage,
+    readable: input.readable,
+    ...input.artifactId ? { artifactId: input.artifactId } : {}
+  };
+}
+async function validateKind(blobStorage, kind, files, queries) {
+  switch (kind) {
+    case "document":
+      return validateDocument(blobStorage, files);
+    case "file":
+      return validateFileArtifact(files);
+    case "sheet":
+      return validateSheet(blobStorage, files, queries);
+    case "slides":
+      return validateSlides(blobStorage, files);
+    case "page":
+      return validatePage(blobStorage, files);
+    case "canvas":
+      return validateCanvas(blobStorage, files);
+    default:
+      throw invalidArtifact(`'${kind}' is not a kind of artifact.`);
+  }
+}
+async function checkTheme(blobStorage, files) {
+  const themeFile = files.find((file) => file.path === ARTIFACT_THEME_FILE2);
+  if (!themeFile)
+    return;
+  const parsed = parseArtifactTheme2(await readArtifactText(blobStorage, themeFile, ARTIFACT_LIMITS2.maxThemeBytes));
+  if ("error" in parsed)
+    throw invalidArtifact(parsed.error);
+}
+function checkTitle(value) {
+  const title = typeof value === "string" ? value.trim() : "";
+  if (title.length === 0 || /[\u0000-\u001f\u007f]/.test(title)) {
+    throw invalidArtifact("An artifact needs a title of plain text.");
+  }
+  if (title.length > ARTIFACT_LIMITS2.maxTitleLength) {
+    throw invalidArtifact(`A title may be at most ${ARTIFACT_LIMITS2.maxTitleLength} characters.`);
+  }
+  return title;
+}
+async function publishVersion(context, artifactId, prepared) {
+  try {
+    return await context.storage.publish({
+      projectId: context.projectId,
+      artifactId,
+      kind: prepared.kind,
+      version: prepared.version,
+      ...prepared.baseVersion === undefined ? {} : { baseVersion: prepared.baseVersion }
+    });
+  } catch (error) {
+    if (error instanceof ArtifactStorageError && error.code === "artifact_not_found") {
+      throw new ArtifactRequestError2("artifact_not_found", error.message);
+    }
+    if (error instanceof ArtifactStorageError && error.code === "artifact_kind_mismatch") {
+      throw new ArtifactRequestError2("artifact_kind_mismatch", error.message);
+    }
+    if (error instanceof ArtifactStorageError && error.code === "artifact_moved") {
+      throw new ArtifactRequestError2("artifact_moved", error.message, error.latest);
+    }
+    throw error;
+  }
+}
+function notFound(artifactId) {
+  return new ArtifactRequestError2("artifact_not_found", `[Sixb] Artifact '${artifactId}' was not found.`);
+}
+async function createArtifact(context, kind, owner, version) {
+  for (let attempt = 1;; attempt += 1) {
+    try {
+      return await context.storage.create({
+        projectId: context.projectId,
+        id: createArtifactId(),
+        kind,
+        owner,
+        version
+      });
+    } catch (error) {
+      const collided = error instanceof ArtifactStorageError && error.code === "artifact_exists";
+      if (!collided || attempt === CREATE_ATTEMPTS)
+        throw error;
+    }
+  }
+}
+
+// src/artifacts/execution.ts
+var publishers = new WeakMap;
+function publisherOf(artifacts) {
+  const publisher = publishers.get(artifacts);
+  if (!publisher)
+    throw new Error("[Sixb] These artifacts are not a Sixb runtime's.");
+  return publisher;
+}
+function artifactAccessRule2(artifacts, storage) {
+  return publisherOf(artifacts).rule(storage);
+}
+function artifactQueryChecker2(artifacts) {
+  return publisherOf(artifacts).checkQuery;
+}
+function createRuntimeArtifactAccessRule(runtime, storage = runtime.storage) {
+  const artifacts = storage.artifacts;
+  if (!artifacts) {
+    throw new ArtifactRequestError2("storage_unavailable", "[Sixb] Artifacts need storage that supports them.");
+  }
+  const authority = resolveRuntimeAuthorizationForProject(runtime);
+  const threads = createAgentThreadAccessRule(runtime, authority, storage.agents);
+  return createArtifactAccessRule({
+    storage: artifacts,
+    projectId: runtime.projectId,
+    caller: authority.type === "unrestricted" ? "system" : authority.type === "principal" ? authority.context.principal : null,
+    sharing: authority.type === "principal" && authority.ref.credential?.type === "session",
+    conversation: async (threadId) => {
+      if (await threads.read(threadId))
+        return "update";
+      return isRuntimeAllowed2(runtime, { kind: "agentThreads.observe" }) ? "read" : null;
+    }
+  });
+}
+function createArtifactsRuntime(runtime, blobStorage) {
+  const authority = resolveRuntimeAuthorizationForProject(runtime);
+  const caller = authority.type === "principal" ? authority.context.principal : authority.type === "unrestricted" ? SYSTEM_PRINCIPAL2 : null;
+  const requireStorage = () => {
+    const storage = runtime.storage.artifacts;
+    if (!storage) {
+      throw new ArtifactRequestError2("storage_unavailable", "[Sixb] Artifacts need storage that supports them.");
+    }
+    return storage;
+  };
+  const requireCaller = () => {
+    if (!caller) {
+      throw new ArtifactRequestError2("not_allowed", "[Sixb] This caller cannot publish artifacts.");
+    }
+    return caller;
+  };
+  const rule = (storage) => createRuntimeArtifactAccessRule(runtime, storage);
+  const checkQuery = createArtifactQueryChecker(runtime);
+  const reach = async (artifactId) => {
+    const artifact = await requireStorage().get({ projectId: runtime.projectId, id: artifactId });
+    return artifact ? { artifact, access: await rule().accessTo(artifact) } : null;
+  };
+  const getReadable = async (artifactId) => {
+    const reached = await reach(artifactId);
+    return reached && reached.access !== "none" ? reached.artifact : null;
+  };
+  const readVersion = async (artifactId, number) => {
+    const artifact = await getReadable(artifactId);
+    if (!artifact)
+      return null;
+    const version = await requireStorage().getVersion({
+      projectId: runtime.projectId,
+      artifactId,
+      version: number === "latest" ? artifact.latestVersion : number
+    });
+    return version ? { artifact, version } : null;
+  };
+  const readableBy = (access) => async (artifact) => await access.accessTo(artifact) !== "none";
+  const requireUpdatable = async (artifactId) => {
+    const reached = await reach(artifactId);
+    if (!reached)
+      throw notFound2(artifactId);
+    assertUpdatable(artifactId, reached.access);
+    return reached.artifact;
+  };
+  const store = (prepared) => runtime.storage.transaction(async (tx) => {
+    const storage = tx.artifacts;
+    if (!storage)
+      throw new Error("[Sixb] Storage transactions hold no artifacts.");
+    return storeArtifactVersion2({ projectId: runtime.projectId, storage, blobStorage }, prepared, (artifact) => rule(tx).publishAccess(artifact));
+  });
+  const contentFiles = async (input) => {
+    if (!input.queries)
+      return input.files;
+    const files = [...input.files];
+    for (const [name, query] of Object.entries(input.queries)) {
+      const path = artifactQueryPath(name);
+      if (input.files.some((file) => file.path === path)) {
+        throw invalidArtifact(`'${path}' is both a file and a query; give it once.`);
+      }
+      const body = new TextEncoder().encode(JSON.stringify(queryFile(query)));
+      const file = await blobStorage.put({
+        body,
+        expectedSizeBytes: body.byteLength,
+        fileName: `${name}.json`,
+        mediaType: "application/json"
+      });
+      files.push({ path, file });
+    }
+    return files;
+  };
+  const artifacts = {
+    async create(input) {
+      const author = requireCaller();
+      return publishArtifact2({ projectId: runtime.projectId, storage: requireStorage(), blobStorage }, {
+        kind: input.kind,
+        title: input.title,
+        files: await contentFiles(input),
+        author,
+        readable: readableBy(rule()),
+        checkQuery
+      }, (artifact) => rule().publishAccess(artifact));
+    },
+    async publish(artifactId, input) {
+      const author = requireCaller();
+      await requireUpdatable(artifactId);
+      const context = { projectId: runtime.projectId, storage: requireStorage(), blobStorage };
+      const prepared = await prepareArtifactVersion2(context, {
+        artifactId,
+        kind: input.kind,
+        title: input.title,
+        files: await contentFiles(input),
+        ...input.baseVersion === undefined ? {} : { baseVersion: input.baseVersion },
+        author,
+        readable: readableBy(rule()),
+        checkQuery
+      });
+      const stored = await store(prepared);
+      return { ...stored, warnings: await artifactVersionWarnings2(context, prepared, stored) };
+    },
+    async access(artifactId) {
+      return (await reach(artifactId))?.access ?? null;
+    },
+    get: getReadable,
+    async list(input = {}) {
+      if (!caller)
+        return { artifacts: [], hasMore: false, total: 0 };
+      const everyShared = input.threadId !== undefined && await rule().conversation(input.threadId) !== null;
+      const ownerFilter = authority.type === "principal" && !everyShared ? caller : null;
+      return requireStorage().list({
+        projectId: runtime.projectId,
+        ...ownerFilter ? { owner: ownerFilter } : {},
+        ...input.threadId === undefined ? {} : { threadId: input.threadId },
+        ...input.kind === undefined ? {} : { kind: input.kind },
+        ...input.limit === undefined ? {} : { limit: input.limit },
+        ...input.offset === undefined ? {} : { offset: input.offset }
+      });
+    },
+    async getVersion(artifactId, version) {
+      return (await readVersion(artifactId, version))?.version ?? null;
+    },
+    async query(artifactId, name, options = {}) {
+      const read = await readVersion(artifactId, options.version ?? "latest");
+      if (!read)
+        return null;
+      const { artifact, version } = read;
+      const file = ARTIFACT_QUERY_KINDS.includes(artifact.kind) && isArtifactQueryName(name) ? version.files.find((candidate) => candidate.path === artifactQueryPath(name)) : undefined;
+      if (!file) {
+        throw new ArtifactRequestError2("query_not_found", `[Sixb] Version ${version.version} of artifact '${artifactId}' has no query '${name}'.`);
+      }
+      const text = await readArtifactText(blobStorage, file, ARTIFACT_LIMITS2.maxQueryBytes);
+      const parsed = parseArtifactQuery(file.path, text);
+      if ("error" in parsed) {
+        throw new ArtifactRequestError2("query_invalid", `[Sixb] ${parsed.error}`);
+      }
+      return runArtifactQuery(runtime, name, parsed.query);
+    },
+    async listVersions(artifactId, input = {}) {
+      if (!await getReadable(artifactId))
+        return null;
+      return requireStorage().listVersions({ projectId: runtime.projectId, artifactId, ...input });
+    },
+    async delete(artifactId) {
+      if ((await reach(artifactId))?.access !== "owner")
+        return false;
+      return requireStorage().delete({ projectId: runtime.projectId, id: artifactId });
+    },
+    state(artifactId) {
+      const scope = async () => {
+        const principal = requireCaller();
+        await requireUpdatable(artifactId);
+        return { projectId: runtime.projectId, artifactId, principal };
+      };
+      return {
+        async get(key) {
+          const entry = await requireStorage().getState({ ...await scope(), key: stateKey(key) });
+          return entry ? JSON.parse(entry.value) : undefined;
+        },
+        async set(key, value) {
+          const at = { ...await scope(), key: stateKey(key) };
+          const text = stateValue(value);
+          const updatedAt = new Date;
+          try {
+            await requireStorage().setState({ ...at, value: text, updatedAt });
+          } catch (error) {
+            if (error instanceof ArtifactStorageError && error.code === "artifact_state_full") {
+              throw new ArtifactRequestError2("state_full", error.message);
+            }
+            throw error;
+          }
+          return { key: at.key, value: JSON.parse(text), updatedAt };
+        },
+        async delete(key) {
+          return requireStorage().deleteState({ ...await scope(), key: stateKey(key) });
+        },
+        async entries() {
+          const entries = await requireStorage().listState(await scope());
+          return entries.map((entry) => ({
+            key: entry.key,
+            value: JSON.parse(entry.value),
+            updatedAt: entry.updatedAt
+          }));
+        },
+        async clear() {
+          return requireStorage().clearState(await scope());
+        }
+      };
+    }
+  };
+  publishers.set(artifacts, { rule, checkQuery });
+  return artifacts;
+}
+function stateKey(key) {
+  if (typeof key !== "string" || key.length === 0 || key.length > ARTIFACT_STATE_LIMITS2.maxKeyLength || /\p{Cc}/u.test(key) || key === "." || key === "..") {
+    throw new ArtifactRequestError2("invalid_state", `[Sixb] A key is 1 to ${ARTIFACT_STATE_LIMITS2.maxKeyLength} characters on one line, such as "filters".`);
+  }
+  return key;
+}
+function stateValue(value) {
+  let text;
+  try {
+    text = JSON.stringify(value);
+  } catch {
+    text = undefined;
+  }
+  if (text === undefined) {
+    throw new ArtifactRequestError2("invalid_state", "[Sixb] A page keeps JSON values: text, numbers, true and false, null, lists, and objects of them.");
+  }
+  return text;
+}
+function queryFile(query) {
+  if ("ir" in query)
+    return query.ir;
+  return {
+    query: query.query.ir,
+    facets: query.facets.map((facet) => ({ propertyId: facet.property.id, limit: facet.limit }))
+  };
+}
+function notFound2(artifactId) {
+  return new ArtifactRequestError2("artifact_not_found", `[Sixb] Artifact '${artifactId}' was not found.`);
+}
+
+export { createAgentThreadAccessRule, assertConversationThread2, conversationThreadId2, agentThreadViews, publishArtifact2, prepareArtifactVersion2, storeArtifactVersion2, artifactVersionWarnings2, artifactAccessRule2, artifactQueryChecker2, createRuntimeArtifactAccessRule, createArtifactsRuntime };
+
+//# debugId=C63B97B0B7216B2664756E2164756E21