@sixb/core 0.1.20 → 0.1.22

package/dist/chunk-qhqgp4jf.js.map

@@ -0,0 +1,22 @@
+{
+  "version": 3,
+  "sources": ["../src/agents/thread-access.ts", "../src/artifacts/access.ts", "../src/artifacts/run-query.ts", "../src/artifacts/publish/queries.ts", "../src/artifacts/publish/references.ts", "../src/artifacts/publish/validate/canvas.ts", "../src/artifacts/publish/validate/document.ts", "../src/artifacts/publish/validate/file.ts", "../src/artifacts/publish/validate/page.ts", "../src/artifacts/publish/validate/sheet.ts", "../src/artifacts/publish/validate/slides.ts", "../src/artifacts/publish/publish.ts", "../src/artifacts/execution.ts"],
+  "sourcesContent": [
+    "import { type Principal, principalsEqual, SYSTEM_PRINCIPAL, type UserPrincipal } from \"../auth\"\nimport { isRuntimeAllowed } from \"../authorization\"\nimport type { resolveRuntimeAuthorizationForProject } from \"../execution/authorization\"\nimport type { SixbRuntimeContext } from \"../runtime/types\"\nimport type { AgentStorage, AgentThreadRecord } from \"../storage/agents\"\nimport { AgentRequestError } from \"./errors\"\n\n/** How the caller takes part in a conversation: its owner, or a user its owner added. */\nexport type AgentThreadAccess = \"owner\" | \"participant\"\n\n/** A user the thread's owner added, who reads the conversation and talks in it. */\nexport interface AgentThreadParticipant {\n  readonly principal: UserPrincipal\n  readonly addedAt: Date\n  readonly addedBy: Principal\n}\n\n/** A thread as the runtime returns it: the stored record with the users taking part in it. */\nexport interface AgentThreadView extends AgentThreadRecord {\n  readonly participants: readonly AgentThreadParticipant[]\n}\n\n/** A thread the caller can read, and how it takes part in it. */\nexport interface ReadableAgentThread {\n  readonly thread: AgentThreadView\n  readonly access: AgentThreadAccess\n}\n\ntype RuntimeAuthority = ReturnType<typeof resolveRuntimeAuthorizationForProject>\n\n/**\n * The one rule for who reads a conversation through `sixb.agent`.\n *\n * The caller needs `can.run(agent)`, then must own the thread or take part in it. Code without a\n * caller (authorization disabled, or system code) reads every thread as its owner. A shared link,\n * a delegated execution or a denied caller reads none. An observer reads every thread through\n * `sixb.agent.observed` instead, without ever being its owner or a participant.\n *\n * A sub-agent's thread is read exactly when its conversation is, with the caller's access there:\n * whoever stops reading the conversation stops reading its children with it.\n */\nexport interface AgentThreadAccessRule {\n  /** Who acts: the signed-in principal, or the system principal for code without a caller. */\n  readonly caller: Principal\n  /** The thread and how the caller takes part in it; `null` when it cannot read it. */\n  read(threadId: string): Promise<ReadableAgentThread | null>\n}\n\nexport function createAgentThreadAccessRule(\n  runtime: SixbRuntimeContext,\n  authority: RuntimeAuthority,\n  /** Where threads are read, the project's storage when omitted: a transaction's decides in it. */\n  agents?: AgentStorage\n): AgentThreadAccessRule {\n  const caller = authority.type === \"principal\" ? authority.context.principal : SYSTEM_PRINCIPAL\n  const blocked = authority.type === \"denied\" || authority.type === \"delegated\"\n\n  const accessIn = (thread: AgentThreadView): AgentThreadAccess | null => {\n    if (blocked || !isRuntimeAllowed(runtime, { kind: \"agent.run\" })) return null\n    if (authority.type !== \"principal\") return \"owner\"\n    if (principalsEqual(caller, thread.ownerPrincipal)) return \"owner\"\n\n    return thread.participants.some((participant) => principalsEqual(participant.principal, caller))\n      ? \"participant\"\n      : null\n  }\n\n  const read = async (threadId: string): Promise<ReadableAgentThread | null> => {\n    if (blocked) return null\n\n    const storage = agents ?? runtime.storage.agents\n    const getById = (id: string) => storage?.threads.getById({ projectId: runtime.projectId, id })\n    const stored = await getById(threadId)\n    if (!stored) return null\n\n    // One level only: a child's parent is always a conversation, as storage admits no other.\n    const conversation = stored.parent ? await getById(stored.parent.threadId) : stored\n    if (conversation?.kind !== \"conversation\") return null\n\n    const [thread, readThrough = thread] = await agentThreadViews(\n      runtime,\n      conversation === stored ? [stored] : [stored, conversation],\n      storage\n    )\n    const access = readThrough ? accessIn(readThrough) : null\n    return thread && access ? { thread, access } : null\n  }\n\n  return { caller, read }\n}\n\n/** Refuse what only a conversation takes: a message, a fork, a participant, a mode, a sandbox. */\nexport function assertConversationThread(thread: Pick<AgentThreadRecord, \"id\" | \"kind\">): void {\n  if (thread.kind === \"conversation\") return\n  throw new AgentRequestError(\n    \"thread_not_conversation\",\n    `[Sixb] Agent thread '${thread.id}' is a sub-agent's: it is read through its conversation and takes no change of its own.`\n  )\n}\n\n/**\n * The conversation a thread belongs to: the thread itself, or a sub-agent's parent. What a child\n * publishes, and the thread its sandbox names, are its conversation's.\n */\nexport function conversationThreadId(thread: Pick<AgentThreadRecord, \"id\" | \"parent\">): string {\n  return thread.parent?.threadId ?? thread.id\n}\n\n/** Stored threads as the runtime returns them, with their participants and no execution tokens. */\nexport async function agentThreadViews(\n  runtime: SixbRuntimeContext,\n  threads: readonly AgentThreadRecord[],\n  agents: AgentStorage | undefined = runtime.storage.agents\n): Promise<readonly AgentThreadView[]> {\n  const participants =\n    threads.length === 0\n      ? []\n      : ((await agents?.threads.listParticipants({\n          projectId: runtime.projectId,\n          threadIds: threads.map((thread) => thread.id),\n        })) ?? [])\n\n  return threads.map((thread) => ({\n    ...publicThread(thread),\n    participants: participants\n      .filter((participant) => participant.threadId === thread.id)\n      .map(({ principal, addedAt, addedBy }) => ({ principal, addedAt, addedBy })),\n  }))\n}\n\n/** Execution ownership tokens never leave the storage/worker boundary. */\nfunction publicThread(thread: AgentThreadRecord): AgentThreadRecord {\n  if (!thread.sandboxState) return thread\n\n  const { name, status, initialized } = thread.sandboxState\n  return { ...thread, sandboxState: { name, status, initialized } }\n}\n",
+    "import { type Principal, principalsEqual } from \"../auth\"\nimport type { ArtifactRecord, ArtifactStorage } from \"../storage/artifacts/types\"\nimport { ArtifactRequestError } from \"./errors\"\n\n/**\n * What the caller may do with an artifact.\n *\n * - `owner`: everything, deleting it included.\n * - `update`: read every version and publish the next one, as the owner or a participant of a\n *   conversation that shares it.\n * - `read`: read every version, as someone who observes a conversation that shares it.\n * - `none`: nothing; the artifact exists but is not shared with the caller.\n */\nexport type ArtifactAccess = \"owner\" | \"update\" | \"read\" | \"none\"\n\n/** How the caller reads a conversation: talking in it, only observing it, or not at all. */\nexport type ConversationAccess = \"update\" | \"read\" | null\n\n/**\n * The one rule for who reaches an artifact.\n *\n * Its owner reaches it, and code without a caller reaches every artifact. Anyone else reaches an\n * artifact shared in a conversation they read: one the Agent published a version in, or a fork\n * of it copied. Whoever owns or takes part in that conversation may update the artifact; an\n * observer of it only reads. The artifact is shared whole, at every version, whatever published\n * each one. Only a signed-in session reaches what is shared: an access token, or a principal\n * without a credential, reaches only its own artifacts.\n *\n * A rule reads how the caller reads each conversation once, so it lives for one operation.\n */\nexport interface ArtifactAccessRule {\n  accessTo(artifact: ArtifactRecord): Promise<ArtifactAccess>\n  /**\n   * What the caller may do when publishing the artifact's next version from a conversation, or\n   * outside any without `threadId`. Its owner publishes from anywhere, and a version published in\n   * a conversation shares the artifact there: that is how sharing starts. Anyone else publishes\n   * from a conversation only when it already shares the artifact, with the access they have there,\n   * so a version never shares someone else's artifact in another conversation.\n   */\n  publishAccess(artifact: ArtifactRecord, threadId?: string): Promise<ArtifactAccess>\n  /** How the caller reads the artifacts a conversation shares. */\n  conversation(threadId: string): Promise<ConversationAccess>\n}\n\nexport function createArtifactAccessRule(input: {\n  readonly storage: ArtifactStorage\n  readonly projectId: string\n  /** `system` for code without a caller, `null` for a caller that reaches no artifact. */\n  readonly caller: Principal | \"system\" | null\n  /** `false` unless the caller signed in with a session: anything else reaches only its own. */\n  readonly sharing: boolean\n  /** How the caller reads a conversation, by the thread-access rule. */\n  readonly conversation: (threadId: string) => Promise<ConversationAccess>\n}): ArtifactAccessRule {\n  const { caller } = input\n  const conversations = new Map<string, Promise<ConversationAccess>>()\n\n  const conversation = (threadId: string): Promise<ConversationAccess> => {\n    if (caller === null || !input.sharing) return Promise.resolve(null)\n\n    let reads = conversations.get(threadId)\n    if (!reads) {\n      reads = input.conversation(threadId)\n      conversations.set(threadId, reads)\n    }\n    return reads\n  }\n\n  /** `owner` or `none` when the answer needs no conversation; `undefined` when it does. */\n  const ownAccess = (artifact: ArtifactRecord): ArtifactAccess | undefined => {\n    if (caller === null) return \"none\"\n    if (caller === \"system\" || principalsEqual(caller, artifact.owner)) return \"owner\"\n    return input.sharing ? undefined : \"none\"\n  }\n\n  const threadIdsOf = (artifact: ArtifactRecord) =>\n    input.storage.listThreadIds({ projectId: input.projectId, id: artifact.id })\n\n  const accessTo = async (artifact: ArtifactRecord): Promise<ArtifactAccess> => {\n    const own = ownAccess(artifact)\n    if (own) return own\n\n    let access: ArtifactAccess = \"none\"\n    for (const threadId of await threadIdsOf(artifact)) {\n      const reads = await conversation(threadId)\n      if (reads === \"update\") return \"update\"\n      if (reads === \"read\") access = \"read\"\n    }\n    return access\n  }\n\n  const publishAccess = async (\n    artifact: ArtifactRecord,\n    threadId?: string\n  ): Promise<ArtifactAccess> => {\n    if (threadId === undefined) return accessTo(artifact)\n\n    const own = ownAccess(artifact)\n    if (own) return own\n\n    if (!(await threadIdsOf(artifact)).includes(threadId)) return \"none\"\n\n    const reads = await conversation(threadId)\n    return reads === null ? \"none\" : reads\n  }\n\n  return { accessTo, publishAccess, conversation }\n}\n\n/** Refuses an artifact the caller may not update: `not_shared`, or `read_only` for an observer. */\nexport function assertUpdatable(artifactId: string, access: ArtifactAccess): void {\n  if (access === \"none\") {\n    throw new ArtifactRequestError(\n      \"not_shared\",\n      `[Sixb] Artifact '${artifactId}' is not shared in a conversation you read.`\n    )\n  }\n\n  if (access === \"read\") {\n    throw new ArtifactRequestError(\n      \"read_only\",\n      `[Sixb] You read artifact '${artifactId}' as an observer: you cannot change it or keep page data in it.`\n    )\n  }\n}\n",
+    "import { getAuthorizedOntologyView } from \"../execution/authorized-object-reader\"\nimport type { AuthorizedOntologyView } from \"../objects/authorized-ontology-view\"\nimport { ObjectQueryPlanningError, ObjectQueryValidationError } from \"../objects/query/errors\"\nimport type { ObjectExpansion } from \"../objects/query/ir\"\nimport { type ValidatedObjectQuery, validateObjectQuery } from \"../objects/query/validate\"\nimport type { Schema, ValueType } from \"../ontology/types\"\nimport type { SixbRuntimeContext } from \"../runtime/types\"\nimport type { ObjectRow } from \"../storage/objects/types\"\nimport { ArtifactRequestError } from \"./errors\"\nimport { ARTIFACT_LIMITS } from \"./limits\"\nimport type {\n  ArtifactQuery,\n  ArtifactQueryProperty,\n  ArtifactQueryResult,\n  ArtifactQuerySchema,\n  ArtifactQueryShape,\n} from \"./queries\"\n\n/** Rows read per call to the reader, so a large result never comes back in one response. */\nconst PAGE_SIZE = 1_000\n\n/**\n * Runs one of a version's queries as the runtime's caller, through their object reader: what they\n * cannot view refuses the query, and what they are not cleared for is left out of each row.\n *\n * The query was valid when it was published, but the ontology may have changed since: a query\n * that no longer validates, or no longer plans, is `query_invalid`. Rows are read a page at a\n * time, up to `ARTIFACT_LIMITS.maxQueryRows`, within any `limit` the query declares.\n */\nexport async function runArtifactQuery(\n  runtime: Pick<SixbRuntimeContext, \"ontology\" | \"objectReader\">,\n  name: string,\n  query: ArtifactQuery\n): Promise<ArtifactQueryResult> {\n  try {\n    const shape = describeArtifactQuery(runtime, query)\n\n    if (query.kind === \"facets\") {\n      const { total, facets } = await runtime.objectReader.facet({\n        query: query.query,\n        facets: query.facets,\n      })\n      return { kind: \"facets\", total, facets, ...shape }\n    }\n\n    return { kind: \"objects\", ...(await readRows(runtime, query.query)), ...shape }\n  } catch (error) {\n    throw queryInvalid(name, error)\n  }\n}\n\n/**\n * What a query returns and reads, and what its rows hold as the runtime's caller may view them. It\n * throws what validating the query throws.\n */\nexport function describeArtifactQuery(\n  runtime: Pick<SixbRuntimeContext, \"ontology\" | \"objectReader\">,\n  query: ArtifactQuery\n): ArtifactQueryShape {\n  const validated = validateObjectQuery(query.query, { ontology: runtime.ontology })\n\n  return {\n    resultObjectTypeIds: [...validated.result.objectTypeIds],\n    readObjectTypeIds: [...validated.touchedObjectTypeIds],\n    schema: artifactQuerySchema(getAuthorizedOntologyView(runtime.objectReader), validated),\n  }\n}\n\n/**\n * The properties of the types a validated query returns, and of those each link it expands on its\n * rows reaches, read from `view`: a reader is never told of a property their view leaves out. A\n * type the view leaves out adds none. Only the outermost expansions are read, where normalization\n * puts every expansion of the rows; one nested in another is not.\n */\nexport function artifactQuerySchema(\n  view: AuthorizedOntologyView,\n  validated: ValidatedObjectQuery\n): ArtifactQuerySchema {\n  const valueTypes = view.getValueTypesById()\n  const results = validated.result.objectTypeIds\n  const root = validated.query\n\n  const links: Record<string, { properties: Record<string, ArtifactQueryProperty> }> = {}\n  for (const expansion of root.kind === \"expand\" ? root.expansions : []) {\n    links[expansion.linkId] = {\n      properties: propertiesOf(view, expansionTargets(view, results, expansion), valueTypes),\n    }\n  }\n\n  return { properties: propertiesOf(view, results, valueTypes), links }\n}\n\nfunction propertiesOf(\n  view: AuthorizedOntologyView,\n  objectTypeIds: readonly string[],\n  valueTypes: ReadonlyMap<string, ValueType>\n): Record<string, ArtifactQueryProperty> {\n  const properties: Record<string, ArtifactQueryProperty> = {}\n\n  for (const objectTypeId of objectTypeIds) {\n    for (const property of view.getObjectTypeById(objectTypeId)?.properties ?? []) {\n      properties[property.id] ??= queryProperty(property.schema, valueTypes)\n    }\n  }\n\n  return properties\n}\n\n/** What an expansion reaches from the rows, as the validator resolves it, within the view. */\nfunction expansionTargets(\n  view: AuthorizedOntologyView,\n  results: readonly string[],\n  expansion: ObjectExpansion\n): string[] {\n  const targets = new Set<string>()\n\n  if (expansion.direction === \"outgoing\") {\n    for (const objectTypeId of results) {\n      const link = view\n        .getObjectTypeById(objectTypeId)\n        ?.links.find((candidate) => candidate.id === expansion.linkId)\n      if (!link || link.targetObjectTypeId === \"*\") continue\n\n      for (const target of [link.targetObjectTypeId].flat()) targets.add(target)\n    }\n    return [...targets]\n  }\n\n  const sources =\n    expansion.sourceObjectTypeId === undefined\n      ? view.listObjectTypes()\n      : [view.getObjectTypeById(expansion.sourceObjectTypeId)].filter((type) => type !== null)\n\n  for (const source of sources) {\n    const link = source.links.find((candidate) => candidate.id === expansion.linkId)\n    if (!link) continue\n\n    const reaches =\n      link.targetObjectTypeId === \"*\" ||\n      results.some((result) => view.isValidLinkTarget(link.targetObjectTypeId, result))\n    if (reaches) targets.add(source.id)\n  }\n  return [...targets]\n}\n\n/** A property's schema as a value of a row holds it: a value type's resolved to its own. */\nfunction queryProperty(\n  schema: Schema,\n  valueTypes: ReadonlyMap<string, ValueType>,\n  depth = 0\n): ArtifactQueryProperty {\n  if (typeof schema === \"string\") return { type: schema }\n\n  switch (schema.type) {\n    case \"valueTypeRef\": {\n      const named = valueTypes.get(schema.valueTypeId)?.schema ?? schema._resolved\n      // A value type naming itself, through others or not, holds what nothing else says.\n      return named && depth < 8 ? queryProperty(named, valueTypes, depth + 1) : { type: \"object\" }\n    }\n    case \"enum\":\n      return { type: \"enum\", valueType: schema.valueType }\n    default:\n      return { type: schema.type }\n  }\n}\n\nasync function readRows(\n  runtime: Pick<SixbRuntimeContext, \"objectReader\">,\n  query: ArtifactQuery[\"query\"]\n): Promise<{ objects: ObjectRow[]; total: number; truncated: boolean }> {\n  const objects: ObjectRow[] = []\n  let total = 0\n  let pageToken: string | undefined\n\n  for (;;) {\n    // The last page asks only for what fits under the cap, and says whether more remain.\n    const pageSize = Math.min(PAGE_SIZE, ARTIFACT_LIMITS.maxQueryRows - objects.length)\n    const first = pageToken === undefined\n\n    const page = await runtime.objectReader.executeQuery({\n      query: { kind: \"page\", input: query, pageSize, ...(pageToken ? { pageToken } : {}) },\n      ...(first ? { includeTotal: true } : {}),\n    })\n\n    if (first) total = page.total ?? page.objects.length\n    objects.push(...page.objects)\n\n    if (!page.hasMore || page.nextPageToken === undefined) {\n      return { objects, total, truncated: false }\n    }\n    if (objects.length >= ARTIFACT_LIMITS.maxQueryRows) {\n      return { objects, total, truncated: true }\n    }\n\n    pageToken = page.nextPageToken\n  }\n}\n\n/** A query the ontology no longer admits, in the words validation gives; anything else as is. */\nfunction queryInvalid(name: string, error: unknown): unknown {\n  if (!(error instanceof ObjectQueryValidationError || error instanceof ObjectQueryPlanningError)) {\n    return error\n  }\n\n  const issues = error.issues.map((issue) => `${issue.path}: ${issue.message}`).join(\"; \")\n  const problem =\n    error instanceof ObjectQueryValidationError\n      ? \"no longer matches the ontology\"\n      : \"can no longer run\"\n\n  return new ArtifactRequestError(\"query_invalid\", `[Sixb] Query '${name}' ${problem}: ${issues}`)\n}\n",
+    "import { isRuntimeAllowed } from \"../../authorization\"\nimport { AuthorizationError } from \"../../authorization/errors\"\nimport { readerClearance } from \"../../execution/authorized-object-reader\"\nimport type { PropertyClearance } from \"../../objects/property-clearance\"\nimport {\n  ObjectQueryExecutionError,\n  ObjectQueryPlanningError,\n  ObjectQueryValidationError,\n} from \"../../objects/query/errors\"\nimport type { ObjectExpansion, ObjectQuery } from \"../../objects/query/ir\"\nimport { normalizeObjectQuery } from \"../../objects/query/normalize\"\nimport {\n  type ObjectQuerySemanticAdmission,\n  validateObjectQueryWithAdmission,\n} from \"../../objects/query/validate\"\nimport type { OntologyRegistry } from \"../../ontology\"\nimport type { SixbRuntimeContext } from \"../../runtime/types\"\nimport type { ArtifactFile } from \"../../storage/artifacts/types\"\nimport type { ArtifactKind } from \"../kinds\"\nimport { ARTIFACT_LIMITS } from \"../limits\"\nimport {\n  ARTIFACT_QUERIES_DIRECTORY,\n  ARTIFACT_QUERY_KINDS,\n  type ArtifactQuery,\n  artifactQueryName,\n  type CheckedArtifactQuery,\n  parseArtifactQuery,\n} from \"../queries\"\nimport { describeArtifactQuery } from \"../run-query\"\nimport { type ArtifactBlobStorage, invalidArtifact, readArtifactText } from \"./files\"\n\n/**\n * Admits a query as the version's author: it throws what running it as them would throw, and\n * refuses one that would return what they cannot read; it returns what the query returns and what\n * its rows hold as they see them. A version is refused when its author could not run one of its\n * queries, so a query never reads what whoever wrote it cannot. Each reader still runs it with\n * their own rights.\n */\nexport type ArtifactQueryChecker = (query: ArtifactQuery) => Promise<CheckedArtifactQuery>\n\n/**\n * The checker for the runtime's caller. Running the query once, as cheaply as its kind allows,\n * is the check: validation against the ontology, `can.view` on every type it reads, clearance for\n * every marked property it filters, sorts or facets on, and the caller's share scope all apply\n * there, as they do when it is read.\n *\n * What the rows carry is checked after: a read leaves out a marked property its reader is not\n * cleared for, and the member profiles of a reader who may not view them, so running the query\n * admits one that returns them. A reader's rows reach the page's code, which its author wrote, so\n * the query may return only what the author can read. Facets return counts, never a property.\n */\nexport function createArtifactQueryChecker(\n  runtime: Pick<\n    SixbRuntimeContext,\n    \"objectReader\" | \"ontology\" | \"projectId\" | \"runtimeAuthorization\" | \"authorization\"\n  >\n): ArtifactQueryChecker {\n  return async (query) => {\n    const shape = describeArtifactQuery(runtime, query)\n\n    if (query.kind === \"facets\") {\n      await runtime.objectReader.facet({ query: query.query, facets: query.facets })\n      return { kind: query.kind, ...shape }\n    }\n\n    await runtime.objectReader.exists({ query: query.query })\n\n    const clearance = await readerClearance(runtime.objectReader)\n    if (clearance) assertReturnsReadable(query.query, runtime.ontology, clearance)\n\n    // The reader attaches profiles only for an authority that may view the directory.\n    if (!isRuntimeAllowed(runtime, { kind: \"users.view\" })) assertExpandsNoUsers(query.query)\n\n    return { kind: query.kind, ...shape }\n  }\n}\n\n/** A query that would return what its author cannot read, at `at` in the query. */\nclass UnreadableReturnError extends AuthorizationError {\n  constructor(\n    grantKey: string,\n    readonly at: string,\n    message: string\n  ) {\n    super(grantKey, message)\n  }\n}\n\n/**\n * Refuses a query whose rows would carry a property its author cannot read: one of the result's,\n * those the outermost `project` lists or every one without it, or one of an object an `expand`\n * attaches, which no projection narrows.\n *\n * A `project` counts only under nothing but expansions, sorts and limits. Under a filter, a\n * traversal or a set operand it may not shape the rows, so the query then returns every property.\n */\nfunction assertReturnsReadable(\n  query: ObjectQuery,\n  ontology: OntologyRegistry,\n  clearance: PropertyClearance\n): void {\n  const { normalized, resultObjectTypeIds, expansions } = returnedShape(query, ontology)\n  const project = outermostProject(normalized)\n\n  for (const objectTypeId of resultObjectTypeIds) {\n    const propertyIds = project?.properties ?? propertiesOf(ontology, objectTypeId)\n    const unreadable = firstUnreadable(clearance, objectTypeId, propertyIds)\n    if (!unreadable) continue\n\n    const returns = `returns '${unreadable.propertyId}' on '${objectTypeId}', which you are not cleared to read`\n    throw project\n      ? new UnreadableReturnError(\n          `clearance:marking:${unreadable.marking}`,\n          `${project.at}.properties[${unreadable.index}]`,\n          `[Sixb] ${returns}: list only the properties you can read.`\n        )\n      : new UnreadableReturnError(\n          `clearance:marking:${unreadable.marking}`,\n          \"$\",\n          `[Sixb] ${returns}: add a \"project\" node that lists only the properties you can read.`\n        )\n  }\n\n  for (const expansion of expansions) {\n    for (const objectTypeId of expansion.objectTypeIds) {\n      const unreadable = firstUnreadable(\n        clearance,\n        objectTypeId,\n        propertiesOf(ontology, objectTypeId)\n      )\n      if (!unreadable) continue\n\n      throw new UnreadableReturnError(\n        `clearance:marking:${unreadable.marking}`,\n        expansion.at,\n        `[Sixb] expands '${expansion.linkId}' to '${objectTypeId}', whose '${unreadable.propertyId}' you are not cleared to read: an expansion returns every property, so leave it out, or read '${objectTypeId}' in a query of its own with a \"project\" node.`\n      )\n    }\n  }\n}\n\n/**\n * Refuses a query that expands member profiles, for an author who may not view them. Only the\n * outermost expand names them, at its rows or under its expansions, once normalized.\n */\nfunction assertExpandsNoUsers(query: ObjectQuery): void {\n  const normalized = normalizeObjectQuery(query)\n  if (normalized.kind !== \"expand\") return\n\n  const expanded = firstUserExpansion(normalized.users, normalized.expansions, \"$\")\n  if (!expanded) return\n\n  throw new UnreadableReturnError(\n    \"view:users\",\n    expanded.at,\n    `[Sixb] returns the member profiles '${expanded.propertyId}' refers to, which you are not allowed to view: leave '${expanded.propertyId}' out of \"users\".`\n  )\n}\n\nfunction firstUserExpansion(\n  users: readonly string[] | undefined,\n  expansions: readonly ObjectExpansion[],\n  at: string\n): { readonly propertyId: string; readonly at: string } | undefined {\n  const [propertyId] = users ?? []\n  if (propertyId !== undefined) return { propertyId, at: `${at}.users[0]` }\n\n  for (const [index, expansion] of expansions.entries()) {\n    const path = at === \"$\" ? `$.expansions[${index}]` : `${at}.expand[${index}]`\n    const found = firstUserExpansion(expansion.users, expansion.expand ?? [], path)\n    if (found) return found\n  }\n\n  return undefined\n}\n\nfunction propertiesOf(ontology: OntologyRegistry, objectTypeId: string): readonly string[] {\n  return ontology.resolveObjectType(objectTypeId).properties.map((property) => property.id)\n}\n\nfunction firstUnreadable(\n  clearance: PropertyClearance,\n  objectTypeId: string,\n  propertyIds: readonly string[]\n): { readonly propertyId: string; readonly index: number; readonly marking: string } | undefined {\n  for (const [index, propertyId] of propertyIds.entries()) {\n    const marking = clearance.missingMarking(objectTypeId, propertyId)\n    if (marking !== undefined) return { propertyId, index, marking }\n  }\n\n  return undefined\n}\n\n/**\n * The query as it runs, the object types it returns, and those each expansion attaches, at any\n * depth. Validation resolves an expansion's targets, so a recording admission reads them there:\n * a set operand's expansions are among them too.\n */\nfunction returnedShape(query: ObjectQuery, ontology: OntologyRegistry) {\n  const expansions: { readonly at: string; readonly linkId: string; objectTypeIds: string[] }[] = []\n\n  const state = Object.freeze({})\n  const recorder: ObjectQuerySemanticAdmission = {\n    empty: () => state,\n    source: () => ({ state }),\n    property: () => undefined,\n    edge: (input) => {\n      if (input.use === \"expand\") {\n        expansions.push({\n          at: input.path,\n          linkId: input.linkId,\n          objectTypeIds: [...input.result.objectTypeIds],\n        })\n      }\n      return { state }\n    },\n    set: () => state,\n  }\n\n  const validated = validateObjectQueryWithAdmission(query, { ontology }, recorder)\n  return {\n    normalized: validated.query,\n    resultObjectTypeIds: validated.result.objectTypeIds,\n    expansions,\n  }\n}\n\n/** The `project` that shapes the rows, through the nodes that keep them as they are. */\nfunction outermostProject(\n  query: ObjectQuery,\n  at = \"$\"\n): { readonly properties: readonly string[]; readonly at: string } | undefined {\n  switch (query.kind) {\n    case \"project\":\n      return query.properties ? { properties: query.properties, at } : undefined\n    case \"expand\":\n    case \"limit\":\n    case \"sort\":\n      return outermostProject(query.input, `${at}.input`)\n    default:\n      return undefined\n  }\n}\n\n/**\n * Checks the `queries/` files of a version: their names and number, their shape, then each one as\n * its author through `checker`, and returns what each check learned by query name, for the kind's\n * own check. Fails closed: a version that holds a query is refused without one. A file artifact is\n * delivered as it is, so its one file is never read as a query.\n */\nexport async function checkArtifactQueries(\n  blobStorage: ArtifactBlobStorage,\n  kind: ArtifactKind,\n  files: readonly ArtifactFile[],\n  checker: ArtifactQueryChecker | undefined\n): Promise<ReadonlyMap<string, CheckedArtifactQuery>> {\n  const checked = new Map<string, CheckedArtifactQuery>()\n  if (kind === \"file\") return checked\n\n  const queries = files.filter((file) => file.path.startsWith(ARTIFACT_QUERIES_DIRECTORY))\n  const [first] = queries\n  if (!first) return checked\n\n  if (!ARTIFACT_QUERY_KINDS.includes(kind)) {\n    throw invalidArtifact(\n      `'${first.path}': a ${kind} runs no query. A document shows a live sheet instead.`\n    )\n  }\n\n  if (queries.length > ARTIFACT_LIMITS.maxQueries) {\n    throw invalidArtifact(\n      `A version holds at most ${ARTIFACT_LIMITS.maxQueries} queries; this one has ${queries.length}.`\n    )\n  }\n\n  if (!checker) {\n    throw invalidArtifact(\n      `'${first.path}' is a query, and this publish has no way to check it as its author.`\n    )\n  }\n\n  // One at a time, so the same version is always refused for the same query.\n  for (const file of queries) {\n    const name = artifactQueryName(file.path)\n    if (!name) {\n      throw invalidArtifact(\n        `'${file.path}' is not a query: name it queries/<name>.json, with lowercase letters, digits and hyphens, at most 64 characters.`\n      )\n    }\n\n    const text = await readArtifactText(blobStorage, file, ARTIFACT_LIMITS.maxQueryBytes)\n    const parsed = parseArtifactQuery(file.path, text)\n    if (\"error\" in parsed) throw invalidArtifact(parsed.error)\n\n    try {\n      checked.set(name, await checker(parsed.query))\n    } catch (error) {\n      throw refusal(file.path, parsed, error)\n    }\n  }\n\n  return checked\n}\n\n/**\n * Why the author cannot run the query, naming the file and, for a problem in the query, where it\n * is in the file. A query's own paths start at the query, which a request holds under `query`;\n * a facet's paths are the file's already.\n */\nfunction refusal(\n  path: string,\n  parsed: { readonly query: ArtifactQuery; readonly at: \"$\" | \"$.query\" },\n  error: unknown\n): unknown {\n  const inFile = (issuePath: string) =>\n    parsed.query.kind === \"facets\" && issuePath.startsWith(\"$.facets\")\n      ? issuePath\n      : `${parsed.at}${issuePath.slice(1)}`\n\n  if (error instanceof UnreadableReturnError) {\n    return invalidArtifact(\n      `${path}: ${inFile(error.at)}: ${error.message.replace(/^\\[Sixb\\]\\s*/, \"\")}`\n    )\n  }\n\n  if (error instanceof ObjectQueryValidationError || error instanceof ObjectQueryPlanningError) {\n    const issues = error.issues.map((issue) => `${inFile(issue.path)}: ${issue.message}`)\n    return invalidArtifact(`${path}: ${issues.join(\"; \")}`)\n  }\n\n  if (error instanceof AuthorizationError || error instanceof ObjectQueryExecutionError) {\n    return invalidArtifact(`${path}: ${error.message.replace(/^\\[Sixb\\]\\s*/, \"\")}`)\n  }\n\n  return error\n}\n",
+    "import { type Principal, principalsEqual } from \"../../auth\"\nimport type {\n  ArtifactRecord,\n  ArtifactStorage,\n  ArtifactVersionRecord,\n} from \"../../storage/artifacts/types\"\nimport { parseArtifactAddress } from \"../address\"\nimport { ARTIFACT_LIMITS } from \"../limits\"\nimport type { ArtifactReference } from \"../references\"\nimport { resolveArtifactAddress } from \"../resolve\"\nimport type { ArtifactWarning } from \"../warnings\"\nimport { invalidArtifact } from \"./files\"\n\n/** An address a validator found in a version, before it is resolved. */\nexport type FoundReference = Omit<ArtifactReference, \"resolvedVersion\">\n\ninterface ReferenceContext {\n  readonly projectId: string\n  readonly storage: ArtifactStorage\n  /** Whether an address may name this artifact: one whoever publishes can read. */\n  readonly readable: (artifact: ArtifactRecord) => Promise<boolean>\n  /** The artifact being published, which an address may not name. */\n  readonly artifactId?: string\n}\n\n/**\n * Resolves every address a version uses against what its author can read, recording the version\n * each one resolved to. An address that resolves to nothing refuses the version, saying where it\n * is and what the target has instead.\n */\nexport async function resolveReferences(\n  context: ReferenceContext,\n  found: readonly FoundReference[]\n): Promise<ArtifactReference[]> {\n  if (found.length > ARTIFACT_LIMITS.maxReferences) {\n    throw invalidArtifact(\n      `A version may refer to at most ${ARTIFACT_LIMITS.maxReferences} artifacts; this one has ${found.length} addresses.`\n    )\n  }\n  const artifacts = new Map<string, Promise<ArtifactRecord | null>>()\n  const versions = new Map<string, Promise<ArtifactVersionRecord | null>>()\n  const resolved: ArtifactReference[] = []\n  for (const reference of found) {\n    const where = reference.at\n      ? `In '${reference.at}', '${reference.address}'`\n      : `'${reference.address}'`\n    const address = parseArtifactAddress(reference.address)\n    if (!address) {\n      throw invalidArtifact(\n        `${where} is not an artifact address: write artifact:<id>[@<version>][/<file>][#<part>], such as artifact:art_k3m9q2x7tp#chart=revenue.`\n      )\n    }\n    if (address.artifactId === context.artifactId) {\n      throw invalidArtifact(\n        `${where} names the artifact being published. Link to one of its sections with #<slug> instead.`\n      )\n    }\n    let artifact = artifacts.get(address.artifactId)\n    if (!artifact) {\n      artifact = context.storage\n        .get({ projectId: context.projectId, id: address.artifactId })\n        .then(async (record) => (record && (await context.readable(record)) ? record : null))\n      artifacts.set(address.artifactId, artifact)\n    }\n    const record = await artifact\n    if (!record) {\n      throw invalidArtifact(`${where} names no artifact you can read.`)\n    }\n    const number = address.version ?? record.latestVersion\n    const key = `${record.id}@${number}`\n    let version = versions.get(key)\n    if (!version) {\n      version = context.storage.getVersion({\n        projectId: context.projectId,\n        artifactId: record.id,\n        version: number,\n      })\n      versions.set(key, version)\n    }\n    const target = await version\n    if (!target) throw invalidArtifact(`${where}: “${record.title}” has no version ${number}.`)\n    const result = resolveArtifactAddress(address, { kind: record.kind, ...target })\n    if (\"problem\" in result) {\n      throw invalidArtifact(`${where}: “${target.title}” ${result.problem}.`)\n    }\n    resolved.push({ ...reference, resolvedVersion: target.version })\n  }\n  return resolved\n}\n\n/**\n * The artifacts a new version breaks: each one whose latest version follows this artifact's latest\n * and names something this version no longer has. Only artifacts the author can read are named,\n * and only those the version breaks are checked: most dependents cost no read.\n */\nexport async function brokenDependents(\n  context: ReferenceContext,\n  artifact: ArtifactRecord,\n  version: ArtifactVersionRecord\n): Promise<ArtifactWarning[]> {\n  const dependents = await context.storage.listReferencingVersions({\n    projectId: context.projectId,\n    artifactId: artifact.id,\n  })\n  const warnings: ArtifactWarning[] = []\n  for (const dependent of dependents) {\n    if (dependent.artifactId === artifact.id) continue\n\n    const broken: ArtifactWarning[] = []\n    for (const reference of dependent.references) {\n      const address = parseArtifactAddress(reference.address)\n      // A pinned address keeps showing the version it names.\n      if (address?.artifactId !== artifact.id || address.version !== undefined) continue\n      const result = resolveArtifactAddress(address, { kind: artifact.kind, ...version })\n      if (!(\"problem\" in result)) continue\n      broken.push({\n        code: \"reference_broken\",\n        message: `“${dependent.title}” (${dependent.artifactId}) ${reference.as === \"embed\" ? \"shows\" : \"links to\"} ${reference.address}, but version ${version.version} ${result.problem}. Publish its next version with an address that resolves, or restore what it names.`,\n      })\n    }\n    if (broken.length === 0) continue\n\n    const owner = await context.storage.get({\n      projectId: context.projectId,\n      id: dependent.artifactId,\n    })\n    if (owner && (await context.readable(owner))) warnings.push(...broken)\n  }\n  return warnings\n}\n\n/** What its author reads when nothing else is said: their own artifacts, or all for system code. */\nexport function ownArtifacts(author: Principal): (artifact: ArtifactRecord) => Promise<boolean> {\n  return async (artifact) => author.type === \"system\" || principalsEqual(author, artifact.owner)\n}\n",
+    "import { posix } from \"node:path\"\nimport type { ArtifactFile } from \"../../../storage/artifacts/types\"\nimport { CANVAS_FILE, type Canvas, parseCanvas } from \"../../canvas\"\nimport { ARTIFACT_LIMITS } from \"../../limits\"\nimport type { CanvasOutline, CanvasOutlineItem } from \"../../outline\"\nimport type { ArtifactWarning } from \"../../warnings\"\nimport { type ArtifactBlobStorage, invalidArtifact, readArtifactText } from \"../files\"\nimport type { FoundReference } from \"../references\"\nimport { readHtmlReferences, refuseFrameAssetPaths } from \"./html\"\n\n/**\n * Reads a canvas: `canvas.json`, then each board's HTML, which must be one of the version's files.\n * The addresses its embeds show and its boards use are returned to resolve, each at its item's id.\n * Boards that overlap, and notes or text drawn over a board, are warnings: the reader sees a page\n * covered.\n */\nexport async function validateCanvas(\n  blobStorage: ArtifactBlobStorage,\n  files: readonly ArtifactFile[]\n): Promise<{\n  readonly entry: string\n  readonly outline: CanvasOutline\n  readonly references: readonly FoundReference[]\n  readonly warnings: readonly ArtifactWarning[]\n}> {\n  const byPath = new Map(files.map((file) => [file.path, file]))\n  const canvasFile = byPath.get(CANVAS_FILE)\n  if (!canvasFile) {\n    throw invalidArtifact(\n      `A canvas is '${CANVAS_FILE}', listing its items, with the HTML files its boards show beside it.`\n    )\n  }\n  refuseFrameAssetPaths(files, \"the canvas\")\n  const parsed = parseCanvas(\n    await readArtifactText(blobStorage, canvasFile, ARTIFACT_LIMITS.maxCanvasBytes)\n  )\n  if (\"error\" in parsed) throw invalidArtifact(parsed.error)\n  const { canvas } = parsed\n\n  const references: FoundReference[] = []\n  for (const item of canvas.items) {\n    if (item.type === \"embed\") references.push({ address: item.src, as: \"embed\", at: item.id })\n    if (item.type !== \"board\") continue\n    const file = byPath.get(posix.normalize(item.file))\n    if (!file) {\n      throw invalidArtifact(\n        `${CANVAS_FILE} board '${item.id}' shows '${item.file}', which is not one of the canvas's files.`\n      )\n    }\n    const rewriter = new HTMLRewriter()\n    const { references: found, refusal } = readHtmlReferences(rewriter, () => item.id, item.file)\n    rewriter.transform(await readArtifactText(blobStorage, file, ARTIFACT_LIMITS.maxBoardBytes))\n    const refused = refusal()\n    if (refused) throw invalidArtifact(`Board '${item.id}': ${refused}`)\n    references.push(...found)\n  }\n\n  return {\n    entry: CANVAS_FILE,\n    outline: {\n      kind: \"canvas\",\n      items: canvas.items.flatMap((item): CanvasOutlineItem[] => {\n        const title = item.type === \"board\" || item.type === \"section\" ? item.title : undefined\n        const named = { id: item.id, ...(title ? { title } : {}) }\n        if (item.type === \"board\") {\n          return [\n            { ...named, type: \"board\", file: posix.normalize(item.file), w: item.w, h: item.h },\n          ]\n        }\n        return item.type === \"section\" ? [{ ...named, type: \"section\" }] : []\n      }),\n    },\n    references,\n    warnings: layoutWarnings(canvas),\n  }\n}\n\ninterface Box {\n  readonly x: number\n  readonly y: number\n  readonly w: number\n  readonly h: number\n}\n\nconst overlaps = (a: Box, b: Box) =>\n  a.x < b.x + b.w && b.x < a.x + a.w && a.y < b.y + b.h && b.y < a.y + a.h\n\n/**\n * What covers a board on the canvas: another board over it, or a note or a text whose top left\n * corner lands on it. A note's height follows its text, so only its corner is sure; a section\n * holds boards on purpose.\n */\nfunction layoutWarnings(canvas: Canvas): ArtifactWarning[] {\n  const boards = canvas.items.flatMap((item) => (item.type === \"board\" ? [item] : []))\n  const warnings: ArtifactWarning[] = []\n  boards.forEach((board, index) => {\n    for (const other of boards.slice(index + 1)) {\n      if (!overlaps(board, other)) continue\n      warnings.push({\n        code: \"canvas_overlap\",\n        part: board.id,\n        message: `Boards '${board.id}' and '${other.id}' overlap, so one covers the other's page: leave 80 pixels between boards in a row and 160 between rows.`,\n      })\n    }\n  })\n  for (const item of canvas.items) {\n    if (item.type !== \"note\" && item.type !== \"text\") continue\n    const corner = { x: item.x, y: item.y, w: 1, h: 1 }\n    const board = boards.find((candidate) => overlaps(candidate, corner))\n    if (!board) continue\n    warnings.push({\n      code: \"canvas_covers_board\",\n      part: item.id,\n      message: `${item.type === \"note\" ? \"Note\" : \"Text\"} '${item.id}' sits on board '${board.id}' and covers its page: put it beside the board, and an arrow to it when it is about the board.`,\n    })\n  }\n  return warnings\n}\n",
+    "import { posix } from \"node:path\"\nimport type { ArtifactFile } from \"../../../storage/artifacts/types\"\nimport { isArtifactAddress } from \"../../address\"\nimport { decodeHtmlEntities } from \"../../html\"\nimport { ARTIFACT_LIMITS } from \"../../limits\"\nimport { createHeadingSlugger, type DocumentHeading, type DocumentOutline } from \"../../outline\"\nimport { type ArtifactBlobStorage, invalidArtifact, readArtifactText } from \"../files\"\nimport type { FoundReference } from \"../references\"\n\n/** The file a document renders from. */\nexport const DOCUMENT_ENTRY = \"document.md\"\n\n/**\n * Reads a document's Markdown: its headings become the outline, and every image must be a file in\n * the version or an `artifact:` address, so the document renders the same wherever it is opened.\n * The addresses it shows and links to are returned with the section each sits in, to resolve.\n */\nexport async function validateDocument(\n  blobStorage: ArtifactBlobStorage,\n  files: readonly ArtifactFile[]\n): Promise<{\n  readonly entry: string\n  readonly outline: DocumentOutline\n  readonly references: readonly FoundReference[]\n}> {\n  const entry = files.find((file) => file.path === DOCUMENT_ENTRY)\n  if (!entry) throw invalidArtifact(`A document needs its Markdown in '${DOCUMENT_ENTRY}'.`)\n  const markdown = await readArtifactText(blobStorage, entry, ARTIFACT_LIMITS.maxDocumentBytes)\n\n  // The same options the docs site renders with, so headings and images read the same way.\n  const html = Bun.markdown.html(markdown, {\n    tables: true,\n    strikethrough: true,\n    tasklists: true,\n    autolinks: true,\n  })\n  const headings: { depth: number; text: string }[] = []\n  const images: string[] = []\n  // Each address with the index of the heading it follows, -1 before the first.\n  const addresses: { address: string; as: \"embed\" | \"link\"; heading: number }[] = []\n  let heading: { depth: number; text: string } | null = null\n  new HTMLRewriter()\n    .on(\"h1, h2, h3, h4, h5, h6\", {\n      element(element) {\n        heading = { depth: Number(element.tagName.slice(1)), text: \"\" }\n        headings.push(heading)\n        element.onEndTag(() => {\n          heading = null\n        })\n      },\n      text(chunk) {\n        if (heading) heading.text += chunk.text\n      },\n    })\n    .on(\"img\", {\n      element(element) {\n        const source = decodeHtmlEntities(element.getAttribute(\"src\") ?? \"\")\n        if (isArtifactAddress(source)) {\n          addresses.push({ address: source.trim(), as: \"embed\", heading: headings.length - 1 })\n        } else {\n          images.push(source)\n        }\n      },\n    })\n    .on(\"a\", {\n      element(element) {\n        const href = decodeHtmlEntities(element.getAttribute(\"href\") ?? \"\")\n        if (isArtifactAddress(href)) {\n          addresses.push({ address: href.trim(), as: \"link\", heading: headings.length - 1 })\n        }\n      },\n    })\n    .transform(html)\n\n  const paths = new Set(files.map((file) => file.path))\n  for (const source of images) checkImage(source, paths)\n\n  const slug = createHeadingSlugger()\n  const outlined = headings.map(({ depth, text }): DocumentHeading => {\n    const plain = decodeHtmlEntities(text).replace(/\\s+/g, \" \").trim()\n    return { depth, text: plain, slug: slug(plain) }\n  })\n  return {\n    entry: DOCUMENT_ENTRY,\n    outline: { kind: \"document\", headings: outlined },\n    references: addresses.map(({ address, as, heading: index }) => ({\n      address,\n      as,\n      at: outlined[index]?.slug ?? \"\",\n    })),\n  }\n}\n\nfunction checkImage(source: string, paths: ReadonlySet<string>): void {\n  if (source === \"\" || source.startsWith(\"//\") || /^[a-z][a-z\\d+.-]*:/i.test(source)) {\n    throw invalidArtifact(\n      `${DOCUMENT_ENTRY} shows the image '${source}'. Images must be files in the artifact, by their relative path, or another artifact's address, such as artifact:art_k3m9q2x7tp#chart=revenue.`\n    )\n  }\n  const path = posix.normalize(safeDecodeUri(source.split(/[?#]/)[0] ?? \"\"))\n  if (!paths.has(path)) {\n    throw invalidArtifact(\n      `${DOCUMENT_ENTRY} shows the image '${source}', which is not one of the artifact's files.`\n    )\n  }\n}\n\nfunction safeDecodeUri(value: string): string {\n  try {\n    return decodeURI(value)\n  } catch {\n    return value\n  }\n}\n",
+    "import { inferFileMediaType } from \"../../../blob-storage/media-type\"\nimport type { ArtifactFile } from \"../../../storage/artifacts/types\"\nimport type { FileOutline } from \"../../outline\"\nimport { invalidArtifact } from \"../files\"\n\n/** A file artifact is one file of any type, delivered as it is. */\nexport function validateFileArtifact(files: readonly ArtifactFile[]): {\n  readonly entry: string\n  readonly outline: FileOutline\n} {\n  const [file] = files\n  if (!file || files.length > 1) {\n    throw invalidArtifact(`A file artifact holds exactly one file; this one has ${files.length}.`)\n  }\n  return {\n    entry: file.path,\n    outline: { kind: \"file\", mediaType: file.file.mediaType ?? inferFileMediaType(file.path) },\n  }\n}\n",
+    "import type { ArtifactFile } from \"../../../storage/artifacts/types\"\nimport { decodeHtmlEntities } from \"../../html\"\nimport { ARTIFACT_LIMITS } from \"../../limits\"\nimport type { PageOutline } from \"../../outline\"\nimport { type ArtifactBlobStorage, invalidArtifact, readArtifactText } from \"../files\"\nimport type { FoundReference } from \"../references\"\nimport { HTML_ENTRY, readHtmlReferences, refuseFrameAssetPaths } from \"./html\"\n\n/**\n * Reads a page: `index.html` and the files it loads beside it, its scripts, styles, images, and\n * data. Its `<title>`, else its first `<h1>`, becomes its title in the outline. The `artifact:`\n * addresses it uses are returned to resolve, as a deck's are.\n */\nexport async function validatePage(\n  blobStorage: ArtifactBlobStorage,\n  files: readonly ArtifactFile[]\n): Promise<{\n  readonly entry: string\n  readonly outline: PageOutline\n  readonly references: readonly FoundReference[]\n}> {\n  const entry = files.find((file) => file.path === HTML_ENTRY)\n  if (!entry) {\n    throw invalidArtifact(\n      `A page needs '${HTML_ENTRY}', the page itself; put its scripts, styles, and data beside it.`\n    )\n  }\n  refuseFrameAssetPaths(files, \"the page\")\n  const html = await readArtifactText(blobStorage, entry, ARTIFACT_LIMITS.maxPageBytes)\n\n  let title = \"\"\n  let heading = \"\"\n  let readingHeading = false\n  const rewriter = new HTMLRewriter()\n    .on(\"title\", {\n      text(chunk) {\n        title += chunk.text\n      },\n    })\n    .on(\"h1\", {\n      element(element) {\n        if (heading || readingHeading) return\n        readingHeading = true\n        element.onEndTag(() => {\n          readingHeading = false\n          heading ||= \" \"\n        })\n      },\n      text(chunk) {\n        if (readingHeading) heading += chunk.text\n      },\n    })\n  const { references, refusal } = readHtmlReferences(rewriter, () => \"\")\n  rewriter.transform(html)\n\n  const refused = refusal()\n  if (refused) throw invalidArtifact(refused)\n  const plain = (text: string) => decodeHtmlEntities(text).replace(/\\s+/g, \" \").trim()\n  const named = plain(title) || plain(heading)\n  return {\n    entry: HTML_ENTRY,\n    outline: { kind: \"page\", ...(named ? { title: named.slice(0, 200) } : {}) },\n    references,\n  }\n}\n",
+    "import { posix } from \"node:path\"\nimport type { ArtifactFile } from \"../../../storage/artifacts/types\"\nimport { isArtifactAddress } from \"../../address\"\nimport { CsvParseError, type CsvTable, parseCsv } from \"../../csv\"\nimport { evaluateComputedColumns } from \"../../formula\"\nimport { ARTIFACT_LIMITS } from \"../../limits\"\nimport { liveSheetColumns } from \"../../live-sheet\"\nimport type { SheetOutline } from \"../../outline\"\nimport { artifactQueryPath, type CheckedArtifactQuery } from \"../../queries\"\nimport { sheetChartsProblem, sheetColumnsProblem, sheetFormulasProblem } from \"../../sheet-rules\"\nimport type { ArtifactWarning } from \"../../warnings\"\nimport {\n  parseSheetDate,\n  parseSheetNumber,\n  parseWorkbook,\n  type SheetColumnFormat,\n  sheetFilePath,\n  WORKBOOK_FILE,\n  type Workbook,\n  type WorkbookSheet,\n} from \"../../workbook\"\nimport { type ArtifactBlobStorage, invalidArtifact, readArtifactText } from \"../files\"\nimport type { FoundReference } from \"../references\"\n\n/**\n * Reads a sheet: `workbook.json`, then each sheet's CSV against it. Every cell of a typed column\n * must read as its type, every formula must compute its column, and every chart must name columns\n * its sheet has, so the grid formats and the charts draw the same wherever the sheet is opened.\n * Rows a formula computes to an error are warnings: the version publishes, and the grid shows them.\n *\n * A live sheet is checked against `queries`, what checking the version's queries as its author\n * learned: its query returns rows, and its columns show properties those rows hold, so its rules\n * hold as a CSV sheet's do. Its rows are each reader's, so no cell is checked.\n */\nexport async function validateSheet(\n  blobStorage: ArtifactBlobStorage,\n  files: readonly ArtifactFile[],\n  queries: ReadonlyMap<string, CheckedArtifactQuery>\n): Promise<{\n  readonly entry: string\n  readonly outline: SheetOutline\n  readonly references: readonly FoundReference[]\n  readonly warnings: readonly ArtifactWarning[]\n}> {\n  const byPath = new Map(files.map((file) => [file.path, file]))\n  const workbookFile = byPath.get(WORKBOOK_FILE)\n  if (!workbookFile) {\n    throw invalidArtifact(\n      `A sheet is a directory: '${WORKBOOK_FILE}' listing its sheets, and one CSV per sheet under sheets/. A single CSV publishes as a file.`\n    )\n  }\n  const parsed = parseWorkbook(\n    await readArtifactText(blobStorage, workbookFile, ARTIFACT_LIMITS.maxWorkbookBytes)\n  )\n  if (\"error\" in parsed) throw invalidArtifact(parsed.error)\n  const { workbook } = parsed\n\n  const declared = new Set(workbook.sheets.map((sheet) => sheetFilePath(sheet.name)))\n  const stray = files.find((file) => file.path.startsWith(\"sheets/\") && !declared.has(file.path))\n  if (stray) {\n    throw invalidArtifact(\n      `'${stray.path}' is not a sheet in ${WORKBOOK_FILE}: list it in \"sheets\", or move it out of sheets/.`\n    )\n  }\n\n  const tables = new Map<string, CsvTable>()\n  const references: FoundReference[] = []\n  const warnings: ArtifactWarning[] = []\n  const sheets: WorkbookSheet[] = []\n  for (const sheet of workbook.sheets) {\n    if (sheet.live) {\n      const live = liveSheet(byPath, sheet, queries.get(sheet.live.query))\n      sheets.push(live.sheet)\n      tables.set(sheet.name, live.table)\n      continue\n    }\n\n    const table = await readSheet(blobStorage, byPath, sheet, references)\n    sheets.push(sheet)\n    tables.set(sheet.name, table)\n    warnings.push(...computeSheet(sheet, table))\n  }\n\n  // A live sheet's charts plot the columns it lays out, typed as its query's rows are.\n  const laidOut: Workbook = { ...workbook, sheets }\n  const charts = sheetChartsProblem(laidOut, tables)\n  if (charts) throw invalidArtifact(charts)\n\n  return {\n    entry: WORKBOOK_FILE,\n    outline: {\n      kind: \"sheet\",\n      sheets: workbook.sheets.map((sheet) => {\n        const table = tables.get(sheet.name)\n        return {\n          name: sheet.name,\n          rows: table?.rows.length ?? 0,\n          columns: [...(table?.header ?? [])],\n          ...(sheet.live ? { query: sheet.live.query } : {}),\n        }\n      }),\n      charts: workbook.charts.map((chart) => chart.name),\n    },\n    references,\n    warnings,\n  }\n}\n\n/**\n * A live sheet laid out against its query as the author reads it, and its header as the table a\n * CSV would hold, with no rows: the rules a CSV sheet keeps are checked on it.\n */\nfunction liveSheet(\n  byPath: ReadonlyMap<string, ArtifactFile>,\n  sheet: WorkbookSheet,\n  checked: CheckedArtifactQuery | undefined\n): { readonly sheet: WorkbookSheet; readonly table: CsvTable } {\n  const query = sheet.live?.query\n  const csv = sheetFilePath(sheet.name)\n  if (byPath.has(csv)) {\n    throw invalidArtifact(\n      `Sheet '${sheet.name}' reads its rows from query '${query}', so it has no '${csv}': remove the CSV, or \"query\" to show it.`\n    )\n  }\n\n  if (!checked || query === undefined) {\n    throw invalidArtifact(\n      `Sheet '${sheet.name}' reads query '${query}', which the version does not have: add '${artifactQueryPath(query ?? \"\")}'.`\n    )\n  }\n  if (checked.kind === \"facets\") {\n    throw invalidArtifact(\n      `Sheet '${sheet.name}' reads query '${query}', which counts facets: a sheet shows rows. A page shows facets; give the sheet a query of rows.`\n    )\n  }\n\n  const layout = liveSheetColumns(sheet, checked.schema)\n  if (layout.problem) throw invalidArtifact(layout.problem)\n\n  const table = { header: layout.columns.map((column) => column.name), rows: [] }\n  const problem =\n    sheetColumnsProblem(layout.sheet, table) ?? sheetFormulasProblem(layout.sheet, table)\n  if (problem) throw invalidArtifact(problem)\n\n  return { sheet: layout.sheet, table }\n}\n\nasync function readSheet(\n  blobStorage: ArtifactBlobStorage,\n  byPath: ReadonlyMap<string, ArtifactFile>,\n  sheet: WorkbookSheet,\n  references: FoundReference[]\n): Promise<CsvTable> {\n  const path = sheetFilePath(sheet.name)\n  const file = byPath.get(path)\n  if (!file) throw invalidArtifact(`Sheet '${sheet.name}' needs its values in '${path}'.`)\n\n  if (file.file.sizeBytes > ARTIFACT_LIMITS.maxSheetFileBytes) {\n    throw invalidArtifact(\n      `'${path}' is ${megabytes(file.file.sizeBytes)} MB; a sheet's values may be at most ${megabytes(ARTIFACT_LIMITS.maxSheetFileBytes)} MB, which is what the viewer reads. Split it into several sheets, or publish the CSV as a file.`\n    )\n  }\n  let table: CsvTable\n  try {\n    table = parseCsv(await readArtifactText(blobStorage, file, ARTIFACT_LIMITS.maxSheetFileBytes))\n  } catch (error) {\n    if (error instanceof CsvParseError) throw invalidArtifact(`'${path}': ${error.message}`)\n    throw error\n  }\n\n  const columns = sheetColumnsProblem(sheet, table)\n  if (columns) throw invalidArtifact(columns)\n\n  const { header } = table\n  for (const [column, format] of Object.entries(sheet.columns)) {\n    const index = header.indexOf(column)\n    if (format.type === \"link\" || format.type === \"image\") {\n      // A link or image may be another artifact's address, resolved with the rest.\n      for (const [rowIndex, row] of table.rows.entries()) {\n        const value = row[index]?.trim() ?? \"\"\n        if (!isArtifactAddress(value)) continue\n        references.push({\n          address: value,\n          as: format.type === \"image\" ? \"embed\" : \"link\",\n          at: `${sheet.name}!${columnLetter(index)}${rowIndex + 2}`,\n        })\n      }\n    }\n    if (format.formula) {\n      checkComputedValues(path, table, index, column)\n      continue\n    }\n    checkColumn(path, table, index, column, format, byPath)\n  }\n  return table\n}\n\n/** A computed column's values come from its formula: the CSV leaves them empty. */\nfunction checkComputedValues(path: string, table: CsvTable, index: number, column: string): void {\n  for (const [rowIndex, row] of table.rows.entries()) {\n    const value = row[index] ?? \"\"\n    if (value.trim()) {\n      throw invalidArtifact(\n        `'${path}' row ${rowIndex + 2}, column '${column}': ${JSON.stringify(value)} is in a computed column; leave its values empty, and its formula fills them.`\n      )\n    }\n  }\n}\n\n/**\n * Checks each computed column's formula against the sheet's columns and computes them all, so a\n * formula that can't compute refuses the version and one that computes to an error in some rows\n * warns.\n */\nfunction computeSheet(sheet: WorkbookSheet, table: CsvTable): ArtifactWarning[] {\n  const formulas = sheetFormulasProblem(sheet, table)\n  if (formulas) throw invalidArtifact(formulas)\n\n  const computed = evaluateComputedColumns(sheet, table)\n  return [...computed.errors].map(([column, errors]) => ({\n    code: \"sheet_formula_error\",\n    part: sheet.name,\n    message: `Sheet '${sheet.name}' column '${column}' computes to ${errors.code} in ${errors.count === 1 ? \"1 row\" : `${errors.count} rows`}, the first row ${errors.firstRow + 2}. IFERROR gives those rows a value.`,\n  }))\n}\n\nfunction checkColumn(\n  path: string,\n  table: CsvTable,\n  index: number,\n  column: string,\n  format: SheetColumnFormat,\n  byPath: ReadonlyMap<string, ArtifactFile>\n): void {\n  for (const [rowIndex, row] of table.rows.entries()) {\n    const value = row[index] ?? \"\"\n    if (!value.trim() || isArtifactAddress(value)) continue\n    const problem = cellProblem(value, format, byPath)\n    if (problem) {\n      throw invalidArtifact(\n        `'${path}' row ${rowIndex + 2}, column '${column}': ${JSON.stringify(value)} ${problem}`\n      )\n    }\n  }\n}\n\nfunction cellProblem(\n  value: string,\n  format: SheetColumnFormat,\n  byPath: ReadonlyMap<string, ArtifactFile>\n): string | undefined {\n  switch (format.type) {\n    case \"number\":\n    case \"currency\":\n      return parseSheetNumber(value) === undefined\n        ? \"is not a number: write plain digits, such as 4120000 or -3.5, with no symbols or separators.\"\n        : undefined\n    case \"percent\":\n      return parseSheetNumber(value) === undefined\n        ? \"is not a number: write a percent as a fraction, such as 0.351 for 35.1%.\"\n        : undefined\n    case \"date\":\n      return parseSheetDate(value) === undefined\n        ? \"is not a date: write YYYY-MM-DD, or an ISO 8601 date and time.\"\n        : undefined\n    case \"link\":\n      return /^https?:\\/\\/[^\\s]+$/i.test(value.trim())\n        ? undefined\n        : \"is not a link: write a full https:// address, or another artifact's address.\"\n    case \"image\": {\n      const imagePath = posix.normalize(value.trim())\n      return byPath.has(imagePath)\n        ? undefined\n        : \"is not one of the artifact's files: add the image to the artifact and give its relative path, or give another artifact's address.\"\n    }\n    case \"boolean\":\n      return /^(true|false)$/i.test(value.trim())\n        ? undefined\n        : \"is not true or false: write true or false, or leave the cell empty.\"\n    case \"text\":\n    case \"tag\":\n      return undefined\n  }\n}\n\n/** A column's letter as a spreadsheet shows it: A, Z, AA. */\nfunction columnLetter(index: number): string {\n  let letters = \"\"\n  for (let rest = index + 1; rest > 0; rest = Math.floor((rest - 1) / 26)) {\n    letters = String.fromCharCode(65 + ((rest - 1) % 26)) + letters\n  }\n  return letters\n}\n\nfunction megabytes(bytes: number): string {\n  return (bytes / (1024 * 1024)).toFixed(1).replace(/\\.0$/, \"\")\n}\n",
+    "import type { ArtifactFile } from \"../../../storage/artifacts/types\"\nimport { decodeHtmlEntities } from \"../../html\"\nimport { ARTIFACT_LIMITS } from \"../../limits\"\nimport type { SlidesOutline } from \"../../outline\"\nimport { type ArtifactBlobStorage, invalidArtifact, readArtifactText } from \"../files\"\nimport type { FoundReference } from \"../references\"\nimport { HTML_ENTRY, readHtmlReferences, refuseFrameAssetPaths } from \"./html\"\n\n/**\n * Reads a deck: `index.html` with one `<section class=\"slide\">` per 1280×720 slide, and the files\n * it loads beside it. Each slide's first heading becomes its title in the outline. The `artifact:`\n * addresses it uses are returned with the slide each is on, to resolve.\n */\nexport async function validateSlides(\n  blobStorage: ArtifactBlobStorage,\n  files: readonly ArtifactFile[]\n): Promise<{\n  readonly entry: string\n  readonly outline: SlidesOutline\n  readonly references: readonly FoundReference[]\n}> {\n  const entry = files.find((file) => file.path === HTML_ENTRY)\n  if (!entry) {\n    throw invalidArtifact(\n      `A deck needs '${HTML_ENTRY}' with one <section class=\"slide\"> per slide.`\n    )\n  }\n  refuseFrameAssetPaths(files, \"the deck\")\n  const html = await readArtifactText(blobStorage, entry, ARTIFACT_LIMITS.maxDeckBytes)\n\n  const slides: { title: string; heading: boolean }[] = []\n  const at = () => String(Math.max(1, slides.length))\n  // The heading being read, if it is the first of the current slide.\n  let reading: { title: string; heading: boolean } | null = null\n  const rewriter = new HTMLRewriter()\n    .on(\"section\", {\n      element(element) {\n        const classes = (element.getAttribute(\"class\") ?? \"\").split(/\\s+/)\n        if (classes.includes(\"slide\")) slides.push({ title: \"\", heading: false })\n      },\n    })\n    .on(\"h1, h2, h3\", {\n      element(element) {\n        const slide = slides.at(-1)\n        if (!slide || slide.heading) return\n        slide.heading = true\n        reading = slide\n        element.onEndTag(() => {\n          reading = null\n        })\n      },\n      text(chunk) {\n        if (reading) reading.title += chunk.text\n      },\n    })\n  const { references, refusal } = readHtmlReferences(rewriter, at)\n  rewriter.transform(html)\n\n  const refused = refusal()\n  if (refused) throw invalidArtifact(refused)\n  if (slides.length === 0) {\n    throw invalidArtifact(\n      `${HTML_ENTRY} has no slides: put each slide in a <section class=\"slide\">.`\n    )\n  }\n  if (slides.length > ARTIFACT_LIMITS.maxSlides) {\n    throw invalidArtifact(\n      `A deck holds at most ${ARTIFACT_LIMITS.maxSlides} slides; this one has ${slides.length}.`\n    )\n  }\n  return {\n    entry: HTML_ENTRY,\n    outline: {\n      kind: \"slides\",\n      slides: slides.map(({ title }) => {\n        const plain = decodeHtmlEntities(title).replace(/\\s+/g, \" \").trim()\n        return plain ? { title: plain } : {}\n      }),\n    },\n    references,\n  }\n}\n",
+    "import type { Principal } from \"../../auth\"\nimport { ArtifactStorageError } from \"../../storage/artifacts/errors\"\nimport type {\n  ArtifactFile,\n  ArtifactOrigin,\n  ArtifactRecord,\n  ArtifactStorage,\n  ArtifactVersionInput,\n  ArtifactVersionRecord,\n  PublishedArtifactVersion,\n} from \"../../storage/artifacts/types\"\nimport { type ArtifactAccess, assertUpdatable } from \"../access\"\nimport { ArtifactRequestError } from \"../errors\"\nimport { createArtifactId } from \"../ids\"\nimport type { ArtifactKind } from \"../kinds\"\nimport { ARTIFACT_LIMITS } from \"../limits\"\nimport type { ArtifactOutline } from \"../outline\"\nimport type { CheckedArtifactQuery } from \"../queries\"\nimport { ARTIFACT_THEME_FILE, parseArtifactTheme } from \"../theme\"\nimport type { ArtifactWarning } from \"../warnings\"\nimport {\n  type ArtifactBlobStorage,\n  checkArtifactFiles,\n  invalidArtifact,\n  readArtifactText,\n} from \"./files\"\nimport { type ArtifactQueryChecker, checkArtifactQueries } from \"./queries\"\nimport {\n  brokenDependents,\n  type FoundReference,\n  ownArtifacts,\n  resolveReferences,\n} from \"./references\"\nimport { validateCanvas } from \"./validate/canvas\"\nimport { validateDocument } from \"./validate/document\"\nimport { validateFileArtifact } from \"./validate/file\"\nimport { validatePage } from \"./validate/page\"\nimport { validateSheet } from \"./validate/sheet\"\nimport { validateSlides } from \"./validate/slides\"\n\nexport interface PublishArtifactContext {\n  readonly projectId: string\n  readonly storage: ArtifactStorage\n  readonly blobStorage: ArtifactBlobStorage\n}\n\nexport interface PublishArtifactInput {\n  /** Publishes the next version of this artifact; without it, a new artifact is created. */\n  readonly artifactId?: string\n  readonly kind: ArtifactKind\n  readonly title: string\n  readonly files: readonly ArtifactFile[]\n  /** Publishes the version, and owns the artifact when this creates it unless `owner` says. */\n  readonly author: Principal\n  /** Owns the artifact when this creates it: a conversation's owner, for an Agent turn in it. */\n  readonly owner?: Principal\n  /**\n   * Whether an address in the version may name this artifact: one the author can read. Defaults to\n   * the author's own artifacts.\n   */\n  readonly readable?: (artifact: ArtifactRecord) => Promise<boolean>\n  /**\n   * Checks each of the version's queries as the author, so none reads what they cannot. Without\n   * it, a version that holds a query is refused.\n   */\n  readonly checkQuery?: ArtifactQueryChecker\n  readonly origin?: ArtifactOrigin\n  /** The version this one was made from: publishing fails with `artifact_moved` past it. */\n  readonly baseVersion?: number\n}\n\n/**\n * What the author may do with the artifact a version is published to, as the access rule's\n * `publishAccess` answers it from where the version is stored: a transaction's storage, for a\n * caller that stores in one. Storing refuses `none` with `not_shared` and `read` with `read_only`.\n */\nexport type PublishAccess = (artifact: ArtifactRecord) => Promise<ArtifactAccess>\n\nexport interface PublishedArtifact {\n  readonly artifact: ArtifactRecord\n  readonly version: ArtifactVersionRecord\n  readonly warnings: readonly ArtifactWarning[]\n}\n\nconst CREATE_ATTEMPTS = 3\n\n/** A version checked against its kind and with its addresses resolved, ready to store. */\nexport interface PreparedArtifactVersion {\n  readonly artifactId?: string\n  readonly baseVersion?: number\n  readonly kind: ArtifactKind\n  /** Owns the artifact when this version creates it. */\n  readonly owner: Principal\n  readonly readable: (artifact: ArtifactRecord) => Promise<boolean>\n  readonly version: ArtifactVersionInput\n  /** What its kind's check found worth fixing in a version it accepts. */\n  readonly warnings: readonly ArtifactWarning[]\n}\n\n/**\n * Validates a version against its kind and stores it. Who may publish is the caller's decision:\n * this checks only what the version holds.\n */\nexport async function publishArtifact(\n  context: PublishArtifactContext,\n  input: PublishArtifactInput,\n  access: PublishAccess\n): Promise<PublishedArtifact> {\n  const prepared = await prepareArtifactVersion(context, input)\n  const stored = await storeArtifactVersion(context, prepared, access)\n  return { ...stored, warnings: await artifactVersionWarnings(context, prepared, stored) }\n}\n\n/**\n * Everything publishing checks before it stores: the title, the files, the theme, every query, run\n * once as the author, the kind's own format, and every address, resolved against what the author\n * can read. It reads the files back and parses them, so a caller that stores inside a\n * transaction prepares outside it.\n */\nexport async function prepareArtifactVersion(\n  context: PublishArtifactContext,\n  input: PublishArtifactInput\n): Promise<PreparedArtifactVersion> {\n  const title = checkTitle(input.title)\n  await checkArtifactFiles(context.blobStorage, input.files)\n  if (input.kind !== \"file\") await checkTheme(context.blobStorage, input.files)\n\n  // The queries first: a live sheet's columns are checked against what its query returns.\n  const queries = await checkArtifactQueries(\n    context.blobStorage,\n    input.kind,\n    input.files,\n    input.checkQuery\n  )\n  const validated = await validateKind(context.blobStorage, input.kind, input.files, queries)\n\n  const readable = input.readable ?? ownArtifacts(input.author)\n  const references = await resolveReferences(\n    referenceContext(context, { readable, artifactId: input.artifactId }),\n    validated.references ?? []\n  )\n\n  return {\n    ...(input.artifactId ? { artifactId: input.artifactId } : {}),\n    ...(input.baseVersion === undefined ? {} : { baseVersion: input.baseVersion }),\n    kind: input.kind,\n    owner: input.owner ?? input.author,\n    readable,\n    warnings: validated.warnings ?? [],\n    version: {\n      title,\n      entry: validated.entry,\n      files: input.files.map(({ path, file }) => ({ path, file: { ...file } })),\n      outline: validated.outline,\n      references,\n      author: input.author,\n      ...(input.origin ? { origin: input.origin } : {}),\n      createdAt: new Date(),\n    },\n  }\n}\n\n/**\n * Stores a prepared version: the next one of its artifact, or the first of a new one. The next\n * version is refused unless `access` says its author may update the artifact: a caller that stores\n * inside a transaction answers it from there, so the check and the write see the same artifact.\n */\nexport async function storeArtifactVersion(\n  context: PublishArtifactContext,\n  prepared: PreparedArtifactVersion,\n  access: PublishAccess\n): Promise<PublishedArtifactVersion> {\n  const { artifactId } = prepared\n  if (!artifactId) {\n    return createArtifact(context, prepared.kind, prepared.owner, prepared.version)\n  }\n\n  const artifact = await context.storage.get({ projectId: context.projectId, id: artifactId })\n  if (!artifact) throw notFound(artifactId)\n  assertUpdatable(artifactId, await access(artifact))\n\n  return publishVersion(context, artifactId, prepared)\n}\n\n/**\n * What is worth fixing in a stored version: what its kind's check found, then what it breaks in\n * other artifacts that show it. A first version breaks nothing: no other artifact could name it\n * yet. The version is stored by now, so a failed check only loses those warnings.\n */\nexport async function artifactVersionWarnings(\n  context: PublishArtifactContext,\n  prepared: PreparedArtifactVersion,\n  stored: PublishedArtifactVersion\n): Promise<readonly ArtifactWarning[]> {\n  if (!prepared.artifactId) return prepared.warnings\n  try {\n    return [\n      ...prepared.warnings,\n      ...(await brokenDependents(\n        referenceContext(context, prepared),\n        stored.artifact,\n        stored.version\n      )),\n    ]\n  } catch (error) {\n    console.warn(\n      `[Sixb] Could not check which artifacts version ${stored.version.version} of '${stored.artifact.id}' breaks:`,\n      error\n    )\n    return prepared.warnings\n  }\n}\n\nfunction referenceContext(\n  context: PublishArtifactContext,\n  input: {\n    readonly readable: (artifact: ArtifactRecord) => Promise<boolean>\n    readonly artifactId?: string\n  }\n) {\n  return {\n    projectId: context.projectId,\n    storage: context.storage,\n    readable: input.readable,\n    ...(input.artifactId ? { artifactId: input.artifactId } : {}),\n  }\n}\n\nasync function validateKind(\n  blobStorage: ArtifactBlobStorage,\n  kind: ArtifactKind,\n  files: readonly ArtifactFile[],\n  queries: ReadonlyMap<string, CheckedArtifactQuery>\n): Promise<{\n  readonly entry: string\n  readonly outline: ArtifactOutline\n  readonly references?: readonly FoundReference[]\n  readonly warnings?: readonly ArtifactWarning[]\n}> {\n  switch (kind) {\n    case \"document\":\n      return validateDocument(blobStorage, files)\n    case \"file\":\n      return validateFileArtifact(files)\n    case \"sheet\":\n      return validateSheet(blobStorage, files, queries)\n    case \"slides\":\n      return validateSlides(blobStorage, files)\n    case \"page\":\n      return validatePage(blobStorage, files)\n    case \"canvas\":\n      return validateCanvas(blobStorage, files)\n    default:\n      // A caller past the API's schema, such as a script on the SDK, can name any kind.\n      throw invalidArtifact(`'${kind satisfies never}' is not a kind of artifact.`)\n  }\n}\n\nasync function checkTheme(\n  blobStorage: ArtifactBlobStorage,\n  files: readonly ArtifactFile[]\n): Promise<void> {\n  const themeFile = files.find((file) => file.path === ARTIFACT_THEME_FILE)\n  if (!themeFile) return\n  const parsed = parseArtifactTheme(\n    await readArtifactText(blobStorage, themeFile, ARTIFACT_LIMITS.maxThemeBytes)\n  )\n  if (\"error\" in parsed) throw invalidArtifact(parsed.error)\n}\n\nfunction checkTitle(value: string): string {\n  const title = typeof value === \"string\" ? value.trim() : \"\"\n  if (title.length === 0 || /[\\u0000-\\u001f\\u007f]/.test(title)) {\n    throw invalidArtifact(\"An artifact needs a title of plain text.\")\n  }\n  if (title.length > ARTIFACT_LIMITS.maxTitleLength) {\n    throw invalidArtifact(`A title may be at most ${ARTIFACT_LIMITS.maxTitleLength} characters.`)\n  }\n  return title\n}\n\nasync function publishVersion(\n  context: PublishArtifactContext,\n  artifactId: string,\n  prepared: PreparedArtifactVersion\n): Promise<PublishedArtifactVersion> {\n  try {\n    return await context.storage.publish({\n      projectId: context.projectId,\n      artifactId,\n      kind: prepared.kind,\n      version: prepared.version,\n      ...(prepared.baseVersion === undefined ? {} : { baseVersion: prepared.baseVersion }),\n    })\n  } catch (error) {\n    if (error instanceof ArtifactStorageError && error.code === \"artifact_not_found\") {\n      throw new ArtifactRequestError(\"artifact_not_found\", error.message)\n    }\n    if (error instanceof ArtifactStorageError && error.code === \"artifact_kind_mismatch\") {\n      throw new ArtifactRequestError(\"artifact_kind_mismatch\", error.message)\n    }\n    if (error instanceof ArtifactStorageError && error.code === \"artifact_moved\") {\n      throw new ArtifactRequestError(\"artifact_moved\", error.message, error.latest)\n    }\n    throw error\n  }\n}\n\nfunction notFound(artifactId: string): ArtifactRequestError {\n  return new ArtifactRequestError(\n    \"artifact_not_found\",\n    `[Sixb] Artifact '${artifactId}' was not found.`\n  )\n}\n\nasync function createArtifact(\n  context: PublishArtifactContext,\n  kind: ArtifactKind,\n  owner: Principal,\n  version: ArtifactVersionInput\n): Promise<PublishedArtifactVersion> {\n  for (let attempt = 1; ; attempt += 1) {\n    try {\n      return await context.storage.create({\n        projectId: context.projectId,\n        id: createArtifactId(),\n        kind,\n        owner,\n        version,\n      })\n    } catch (error) {\n      const collided = error instanceof ArtifactStorageError && error.code === \"artifact_exists\"\n      if (!collided || attempt === CREATE_ATTEMPTS) throw error\n    }\n  }\n}\n",
+    "import { createAgentThreadAccessRule } from \"../agents/thread-access\"\nimport { type Principal, SYSTEM_PRINCIPAL } from \"../auth\"\nimport { isRuntimeAllowed } from \"../authorization\"\nimport type { BlobStorage } from \"../blob-storage/types\"\nimport { resolveRuntimeAuthorizationForProject } from \"../execution/authorization\"\nimport type { ObjectQuery } from \"../objects/query/ir\"\nimport type { PropertyToken } from \"../ontology/tokens\"\nimport type { SixbRuntimeContext } from \"../runtime/types\"\nimport { ArtifactStorageError } from \"../storage/artifacts/errors\"\nimport type {\n  ArtifactFile,\n  ArtifactRecord,\n  ArtifactStorage,\n  ArtifactVersionRecord,\n  ListArtifactsResult,\n  ListArtifactVersionsResult,\n} from \"../storage/artifacts/types\"\nimport type { Storage } from \"../storage/types\"\nimport {\n  type ArtifactAccess,\n  type ArtifactAccessRule,\n  assertUpdatable,\n  createArtifactAccessRule,\n} from \"./access\"\nimport { ArtifactRequestError } from \"./errors\"\nimport type { ArtifactKind } from \"./kinds\"\nimport { ARTIFACT_LIMITS, ARTIFACT_STATE_LIMITS } from \"./limits\"\nimport { invalidArtifact, readArtifactText } from \"./publish/files\"\nimport {\n  artifactVersionWarnings,\n  type PreparedArtifactVersion,\n  type PublishedArtifact,\n  prepareArtifactVersion,\n  publishArtifact,\n  storeArtifactVersion,\n} from \"./publish/publish\"\nimport { type ArtifactQueryChecker, createArtifactQueryChecker } from \"./publish/queries\"\nimport {\n  ARTIFACT_QUERY_KINDS,\n  type ArtifactQueryResult,\n  artifactQueryPath,\n  isArtifactQueryName,\n  parseArtifactQuery,\n} from \"./queries\"\nimport { runArtifactQuery } from \"./run-query\"\n\n/** A version's content: what its kind renders from, and what it is called. */\nexport interface ArtifactContentInput {\n  readonly kind: ArtifactKind\n  readonly title: string\n  /** Files stored with `sixb.blobs.put()` or `POST /api/files`, at their paths in the artifact. */\n  readonly files: readonly ArtifactFile[]\n  /**\n   * Queries the version holds, by name, each stored as `queries/<name>.json` beside `files` and\n   * checked as those files are. Each reader runs them with their own rights.\n   */\n  readonly queries?: Readonly<Record<string, ArtifactQueryInput>>\n}\n\n/**\n * A query a version holds, from the query builders: `sixb.objects(Invoice).where(...)` for rows,\n * or such a query with the properties to facet its rows by. Any builder fits: its `ir` is what\n * the version keeps.\n */\nexport type ArtifactQueryInput =\n  | { readonly ir: ObjectQuery }\n  | {\n      readonly query: { readonly ir: ObjectQuery }\n      readonly facets: readonly { readonly property: PropertyToken; readonly limit: number }[]\n    }\n\nexport interface PublishArtifactRuntimeInput extends ArtifactContentInput {\n  /**\n   * The version this one was made from, such as the one a person edited. When another version was\n   * published since, publishing fails with `artifact_moved`, naming the latest and its author.\n   */\n  readonly baseVersion?: number\n}\n\nexport interface ListArtifactsRuntimeInput {\n  /**\n   * Only the artifacts a conversation shares: every one of them, whoever owns it, for whoever reads\n   * the conversation; otherwise the caller's own among them.\n   */\n  readonly threadId?: string\n  /** Only artifacts of this kind. */\n  readonly kind?: ArtifactKind\n  readonly limit?: number\n  readonly offset?: number\n}\n\n/**\n * The artifacts the caller reaches: its own, and those shared in a conversation it reads, as\n * {@link ArtifactAccess} says. System code reaches every artifact in the project, and an access\n * token only its own.\n */\nexport interface ArtifactsRuntime {\n  /** Creates an artifact owned by the caller, with its first version. */\n  create(input: ArtifactContentInput): Promise<PublishedArtifact>\n  /**\n   * Publishes the next version, authored by the caller; the artifact keeps its owner. The kind must\n   * be the artifact's. Throws `not_shared` or `read_only` when the caller may not update it.\n   */\n  publish(artifactId: string, input: PublishArtifactRuntimeInput): Promise<PublishedArtifact>\n  /** What the caller may do with the artifact; `null` when there is no such artifact. */\n  access(artifactId: string): Promise<ArtifactAccess | null>\n  /** `null` when the caller cannot read it. */\n  get(artifactId: string): Promise<ArtifactRecord | null>\n  /** Most recently updated first. */\n  list(input?: ListArtifactsRuntimeInput): Promise<ListArtifactsResult>\n  getVersion(artifactId: string, version: number | \"latest\"): Promise<ArtifactVersionRecord | null>\n  /**\n   * Runs the version's query `queries/<name>.json` as the caller, with their rights: a type they\n   * cannot view refuses it, and a marked property they are not cleared for is left out of each\n   * row. Whoever reads the artifact runs its queries, an observer too. `null` when the caller\n   * cannot read the artifact or it has no such version. Throws `query_not_found`, and\n   * `query_invalid` for a query the ontology no longer admits.\n   */\n  query(\n    artifactId: string,\n    name: string,\n    options?: { readonly version?: number | \"latest\" }\n  ): Promise<ArtifactQueryResult | null>\n  /** Newest first; `null` when the caller cannot read the artifact. */\n  listVersions(\n    artifactId: string,\n    input?: { readonly limit?: number; readonly offset?: number }\n  ): Promise<ListArtifactVersionsResult | null>\n  /**\n   * Deletes the artifact with every version, from every conversation that shares it; only its\n   * owner can. `false` when the caller does not own it.\n   */\n  delete(artifactId: string): Promise<boolean>\n  /**\n   * What the artifact keeps for the caller as its reader, as a page keeps it with `sixb.state`:\n   * JSON values by key, across its versions. Each reader who may update the artifact keeps their\n   * own. Each call throws `artifact_not_found`, `not_shared`, or `read_only` for an observer.\n   */\n  state(artifactId: string): ArtifactStateRuntime\n}\n\n/** One reader's values, kept by one artifact. */\nexport interface ArtifactStateRuntime {\n  /** The value under the key, or undefined when there is none. */\n  get(key: string): Promise<unknown>\n  /**\n   * Keeps a JSON value under the key, replacing one there. Throws `invalid_state` for a key or a\n   * value that is not one, and `state_full` past `ARTIFACT_STATE_LIMITS`. Returns what it kept.\n   */\n  set(key: string, value: unknown): Promise<ArtifactStateValue>\n  /** `false` when there was no value under the key. */\n  delete(key: string): Promise<boolean>\n  /** Every value, by key in order. */\n  entries(): Promise<ArtifactStateValue[]>\n  /** Deletes every value, and returns how many. */\n  clear(): Promise<number>\n}\n\nexport interface ArtifactStateValue {\n  readonly key: string\n  readonly value: unknown\n  readonly updatedAt: Date\n}\n\n/** Where an access rule reads: the project's storage, or a transaction's to decide inside it. */\nexport type ArtifactAccessStorage = Pick<Storage, \"artifacts\" | \"agents\">\n\n/**\n * What each runtime's caller publishes by, for this repo's packages: an Agent turn publishes with\n * the access rule and the query checker of whoever asked for it.\n */\nconst publishers = new WeakMap<\n  object,\n  {\n    readonly rule: (storage?: ArtifactAccessStorage) => ArtifactAccessRule\n    readonly checkQuery: ArtifactQueryChecker\n  }\n>()\n\nfunction publisherOf(artifacts: Partial<ArtifactsRuntime>) {\n  const publisher = publishers.get(artifacts)\n  if (!publisher) throw new Error(\"[Sixb] These artifacts are not a Sixb runtime's.\")\n  return publisher\n}\n\n/**\n * The access rule of the caller `artifacts` acts for, reading from `storage`: a transaction's, to\n * check inside it. Each call returns a rule of its own.\n */\nexport function artifactAccessRule(\n  artifacts: Partial<ArtifactsRuntime>,\n  storage: ArtifactAccessStorage\n): ArtifactAccessRule {\n  return publisherOf(artifacts).rule(storage)\n}\n\n/** What checks a version's queries as the caller `artifacts` acts for. */\nexport function artifactQueryChecker(artifacts: Partial<ArtifactsRuntime>): ArtifactQueryChecker {\n  return publisherOf(artifacts).checkQuery\n}\n\n/** The access rule for the runtime's caller, reading from `storage`. */\nexport function createRuntimeArtifactAccessRule(\n  runtime: SixbRuntimeContext,\n  storage: ArtifactAccessStorage = runtime.storage\n): ArtifactAccessRule {\n  const artifacts = storage.artifacts\n  if (!artifacts) {\n    throw new ArtifactRequestError(\n      \"storage_unavailable\",\n      \"[Sixb] Artifacts need storage that supports them.\"\n    )\n  }\n\n  const authority = resolveRuntimeAuthorizationForProject(runtime)\n  const threads = createAgentThreadAccessRule(runtime, authority, storage.agents)\n\n  return createArtifactAccessRule({\n    storage: artifacts,\n    projectId: runtime.projectId,\n    // Shared-link sessions and unresolved authority reach no artifact.\n    caller:\n      authority.type === \"unrestricted\"\n        ? \"system\"\n        : authority.type === \"principal\"\n          ? authority.context.principal\n          : null,\n    sharing: authority.type === \"principal\" && authority.ref.credential?.type === \"session\",\n    conversation: async (threadId) => {\n      if (await threads.read(threadId)) return \"update\"\n      return isRuntimeAllowed(runtime, { kind: \"agentThreads.observe\" }) ? \"read\" : null\n    },\n  })\n}\n\nexport function createArtifactsRuntime(\n  runtime: SixbRuntimeContext,\n  blobStorage: BlobStorage\n): ArtifactsRuntime {\n  const authority = resolveRuntimeAuthorizationForProject(runtime)\n  // Shared-link sessions and unresolved authority reach no artifact.\n  const caller: Principal | null =\n    authority.type === \"principal\"\n      ? authority.context.principal\n      : authority.type === \"unrestricted\"\n        ? SYSTEM_PRINCIPAL\n        : null\n\n  const requireStorage = (): ArtifactStorage => {\n    const storage = runtime.storage.artifacts\n    if (!storage) {\n      throw new ArtifactRequestError(\n        \"storage_unavailable\",\n        \"[Sixb] Artifacts need storage that supports them.\"\n      )\n    }\n    return storage\n  }\n  const requireCaller = (): Principal => {\n    if (!caller) {\n      throw new ArtifactRequestError(\"not_allowed\", \"[Sixb] This caller cannot publish artifacts.\")\n    }\n    return caller\n  }\n\n  const rule = (storage?: ArtifactAccessStorage): ArtifactAccessRule =>\n    createRuntimeArtifactAccessRule(runtime, storage)\n  const checkQuery = createArtifactQueryChecker(runtime)\n\n  /** The artifact with what the caller may do with it; `null` when there is none. */\n  const reach = async (\n    artifactId: string\n  ): Promise<{ readonly artifact: ArtifactRecord; readonly access: ArtifactAccess } | null> => {\n    const artifact = await requireStorage().get({ projectId: runtime.projectId, id: artifactId })\n    return artifact ? { artifact, access: await rule().accessTo(artifact) } : null\n  }\n  const getReadable = async (artifactId: string): Promise<ArtifactRecord | null> => {\n    const reached = await reach(artifactId)\n    return reached && reached.access !== \"none\" ? reached.artifact : null\n  }\n\n  /** The version with its artifact; `null` when the caller cannot read it or there is none. */\n  const readVersion = async (artifactId: string, number: number | \"latest\") => {\n    const artifact = await getReadable(artifactId)\n    if (!artifact) return null\n\n    const version = await requireStorage().getVersion({\n      projectId: runtime.projectId,\n      artifactId,\n      version: number === \"latest\" ? artifact.latestVersion : number,\n    })\n    return version ? { artifact, version } : null\n  }\n\n  /** What an address in a version may name: one artifact the caller reads, by one rule. */\n  const readableBy = (access: ArtifactAccessRule) => async (artifact: ArtifactRecord) =>\n    (await access.accessTo(artifact)) !== \"none\"\n\n  /** The artifact, refused unless the caller may update it. */\n  const requireUpdatable = async (artifactId: string): Promise<ArtifactRecord> => {\n    const reached = await reach(artifactId)\n    if (!reached) throw notFound(artifactId)\n    assertUpdatable(artifactId, reached.access)\n    return reached.artifact\n  }\n\n  /**\n   * Stores in one transaction, which checks again what the caller may do: a participant removed\n   * while the files were checked publishes nothing.\n   */\n  const store = (prepared: PreparedArtifactVersion) =>\n    runtime.storage.transaction(async (tx) => {\n      const storage = tx.artifacts\n      if (!storage) throw new Error(\"[Sixb] Storage transactions hold no artifacts.\")\n\n      return storeArtifactVersion(\n        { projectId: runtime.projectId, storage, blobStorage },\n        prepared,\n        (artifact) => rule(tx).publishAccess(artifact)\n      )\n    })\n\n  /**\n   * The version's files with its `queries` stored among them. Publishing then checks each one as\n   * it checks a query file.\n   */\n  const contentFiles = async (input: ArtifactContentInput): Promise<readonly ArtifactFile[]> => {\n    if (!input.queries) return input.files\n\n    const files = [...input.files]\n    for (const [name, query] of Object.entries(input.queries)) {\n      const path = artifactQueryPath(name)\n      if (input.files.some((file) => file.path === path)) {\n        throw invalidArtifact(`'${path}' is both a file and a query; give it once.`)\n      }\n\n      const body = new TextEncoder().encode(JSON.stringify(queryFile(query)))\n      const file = await blobStorage.put({\n        body,\n        expectedSizeBytes: body.byteLength,\n        fileName: `${name}.json`,\n        mediaType: \"application/json\",\n      })\n      files.push({ path, file })\n    }\n    return files\n  }\n\n  const artifacts: ArtifactsRuntime = {\n    async create(input) {\n      const author = requireCaller()\n\n      return publishArtifact(\n        { projectId: runtime.projectId, storage: requireStorage(), blobStorage },\n        {\n          kind: input.kind,\n          title: input.title,\n          files: await contentFiles(input),\n          author,\n          readable: readableBy(rule()),\n          checkQuery,\n        },\n        (artifact) => rule().publishAccess(artifact)\n      )\n    },\n\n    async publish(artifactId, input) {\n      const author = requireCaller()\n      await requireUpdatable(artifactId)\n\n      const context = { projectId: runtime.projectId, storage: requireStorage(), blobStorage }\n      const prepared = await prepareArtifactVersion(context, {\n        artifactId,\n        kind: input.kind,\n        title: input.title,\n        files: await contentFiles(input),\n        ...(input.baseVersion === undefined ? {} : { baseVersion: input.baseVersion }),\n        author,\n        readable: readableBy(rule()),\n        checkQuery,\n      })\n      const stored = await store(prepared)\n\n      return { ...stored, warnings: await artifactVersionWarnings(context, prepared, stored) }\n    },\n\n    async access(artifactId) {\n      return (await reach(artifactId))?.access ?? null\n    },\n\n    get: getReadable,\n\n    async list(input = {}) {\n      if (!caller) return { artifacts: [], hasMore: false, total: 0 }\n\n      // Whoever reads a conversation reads every artifact it shares; anyone else, their own in it.\n      const everyShared =\n        input.threadId !== undefined && (await rule().conversation(input.threadId)) !== null\n      const ownerFilter = authority.type === \"principal\" && !everyShared ? caller : null\n\n      return requireStorage().list({\n        projectId: runtime.projectId,\n        ...(ownerFilter ? { owner: ownerFilter } : {}),\n        ...(input.threadId === undefined ? {} : { threadId: input.threadId }),\n        ...(input.kind === undefined ? {} : { kind: input.kind }),\n        ...(input.limit === undefined ? {} : { limit: input.limit }),\n        ...(input.offset === undefined ? {} : { offset: input.offset }),\n      })\n    },\n\n    async getVersion(artifactId, version) {\n      return (await readVersion(artifactId, version))?.version ?? null\n    },\n\n    async query(artifactId, name, options = {}) {\n      const read = await readVersion(artifactId, options.version ?? \"latest\")\n      if (!read) return null\n\n      // A file artifact is delivered as it is: its one file is never run.\n      const { artifact, version } = read\n      const file =\n        ARTIFACT_QUERY_KINDS.includes(artifact.kind) && isArtifactQueryName(name)\n          ? version.files.find((candidate) => candidate.path === artifactQueryPath(name))\n          : undefined\n      if (!file) {\n        throw new ArtifactRequestError(\n          \"query_not_found\",\n          `[Sixb] Version ${version.version} of artifact '${artifactId}' has no query '${name}'.`\n        )\n      }\n\n      const text = await readArtifactText(blobStorage, file, ARTIFACT_LIMITS.maxQueryBytes)\n      const parsed = parseArtifactQuery(file.path, text)\n      if (\"error\" in parsed) {\n        throw new ArtifactRequestError(\"query_invalid\", `[Sixb] ${parsed.error}`)\n      }\n\n      return runArtifactQuery(runtime, name, parsed.query)\n    },\n\n    async listVersions(artifactId, input = {}) {\n      if (!(await getReadable(artifactId))) return null\n      return requireStorage().listVersions({ projectId: runtime.projectId, artifactId, ...input })\n    },\n\n    async delete(artifactId) {\n      if ((await reach(artifactId))?.access !== \"owner\") return false\n      return requireStorage().delete({ projectId: runtime.projectId, id: artifactId })\n    },\n\n    state(artifactId) {\n      // The reader is the caller; an observer reads the page but keeps nothing in it.\n      const scope = async () => {\n        const principal = requireCaller()\n        await requireUpdatable(artifactId)\n        return { projectId: runtime.projectId, artifactId, principal }\n      }\n      return {\n        async get(key) {\n          const entry = await requireStorage().getState({ ...(await scope()), key: stateKey(key) })\n          return entry ? JSON.parse(entry.value) : undefined\n        },\n        async set(key, value) {\n          const at = { ...(await scope()), key: stateKey(key) }\n          const text = stateValue(value)\n          const updatedAt = new Date()\n          try {\n            await requireStorage().setState({ ...at, value: text, updatedAt })\n          } catch (error) {\n            if (error instanceof ArtifactStorageError && error.code === \"artifact_state_full\") {\n              throw new ArtifactRequestError(\"state_full\", error.message)\n            }\n            throw error\n          }\n          // As read back: what JSON keeps of it.\n          return { key: at.key, value: JSON.parse(text), updatedAt }\n        },\n        async delete(key) {\n          return requireStorage().deleteState({ ...(await scope()), key: stateKey(key) })\n        },\n        async entries() {\n          const entries = await requireStorage().listState(await scope())\n          return entries.map((entry) => ({\n            key: entry.key,\n            value: JSON.parse(entry.value),\n            updatedAt: entry.updatedAt,\n          }))\n        },\n        async clear() {\n          return requireStorage().clearState(await scope())\n        },\n      }\n    },\n  }\n\n  publishers.set(artifacts, { rule, checkQuery })\n  return artifacts\n}\n\n/**\n * A key a page names a value by: a short line of text. Not `.` or `..`, which a page could never\n * reach: the API takes the key in its path, where those name another route.\n */\nfunction stateKey(key: string): string {\n  if (\n    typeof key !== \"string\" ||\n    key.length === 0 ||\n    key.length > ARTIFACT_STATE_LIMITS.maxKeyLength ||\n    /\\p{Cc}/u.test(key) ||\n    key === \".\" ||\n    key === \"..\"\n  ) {\n    throw new ArtifactRequestError(\n      \"invalid_state\",\n      `[Sixb] A key is 1 to ${ARTIFACT_STATE_LIMITS.maxKeyLength} characters on one line, such as \"filters\".`\n    )\n  }\n  return key\n}\n\n/** A value as JSON text, refused when JSON has no way to write it. */\nfunction stateValue(value: unknown): string {\n  let text: string | undefined\n  try {\n    text = JSON.stringify(value)\n  } catch {\n    text = undefined\n  }\n  if (text === undefined) {\n    throw new ArtifactRequestError(\n      \"invalid_state\",\n      \"[Sixb] A page keeps JSON values: text, numbers, true and false, null, lists, and objects of them.\"\n    )\n  }\n  return text\n}\n\n/** What a query file holds for a query from the builders: its IR, with any facets by id. */\nfunction queryFile(query: ArtifactQueryInput): unknown {\n  if (\"ir\" in query) return query.ir\n\n  return {\n    query: query.query.ir,\n    facets: query.facets.map((facet) => ({ propertyId: facet.property.id, limit: facet.limit })),\n  }\n}\n\nfunction notFound(artifactId: string): ArtifactRequestError {\n  return new ArtifactRequestError(\n    \"artifact_not_found\",\n    `[Sixb] Artifact '${artifactId}' was not found.`\n  )\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDO,SAAS,2BAA2B,CACzC,SACA,WAEA,QACuB;AAAA,EACvB,MAAM,SAAS,UAAU,SAAS,cAAc,UAAU,QAAQ,YAAY;AAAA,EAC9E,MAAM,UAAU,UAAU,SAAS,YAAY,UAAU,SAAS;AAAA,EAElE,MAAM,WAAW,CAAC,WAAsD;AAAA,IACtE,IAAI,WAAW,CAAC,kBAAiB,SAAS,EAAE,MAAM,YAAY,CAAC;AAAA,MAAG,OAAO;AAAA,IACzE,IAAI,UAAU,SAAS;AAAA,MAAa,OAAO;AAAA,IAC3C,IAAI,iBAAgB,QAAQ,OAAO,cAAc;AAAA,MAAG,OAAO;AAAA,IAE3D,OAAO,OAAO,aAAa,KAAK,CAAC,gBAAgB,iBAAgB,YAAY,WAAW,MAAM,CAAC,IAC3F,gBACA;AAAA;AAAA,EAGN,MAAM,OAAO,OAAO,aAA0D;AAAA,IAC5E,IAAI;AAAA,MAAS,OAAO;AAAA,IAEpB,MAAM,UAAU,UAAU,QAAQ,QAAQ;AAAA,IAC1C,MAAM,UAAU,CAAC,OAAe,SAAS,QAAQ,QAAQ,EAAE,WAAW,QAAQ,WAAW,GAAG,CAAC;AAAA,IAC7F,MAAM,SAAS,MAAM,QAAQ,QAAQ;AAAA,IACrC,IAAI,CAAC;AAAA,MAAQ,OAAO;AAAA,IAGpB,MAAM,eAAe,OAAO,SAAS,MAAM,QAAQ,OAAO,OAAO,QAAQ,IAAI;AAAA,IAC7E,IAAI,cAAc,SAAS;AAAA,MAAgB,OAAO;AAAA,IAElD,OAAO,QAAQ,cAAc,UAAU,MAAM,iBAC3C,SACA,iBAAiB,SAAS,CAAC,MAAM,IAAI,CAAC,QAAQ,YAAY,GAC1D,OACF;AAAA,IACA,MAAM,SAAS,cAAc,SAAS,WAAW,IAAI;AAAA,IACrD,OAAO,UAAU,SAAS,EAAE,QAAQ,OAAO,IAAI;AAAA;AAAA,EAGjD,OAAO,EAAE,QAAQ,KAAK;AAAA;AAIjB,SAAS,yBAAwB,CAAC,QAAsD;AAAA,EAC7F,IAAI,OAAO,SAAS;AAAA,IAAgB;AAAA,EACpC,MAAM,IAAI,mBACR,2BACA,wBAAwB,OAAO,2FACjC;AAAA;AAOK,SAAS,qBAAoB,CAAC,QAA0D;AAAA,EAC7F,OAAO,OAAO,QAAQ,YAAY,OAAO;AAAA;AAI3C,eAAsB,gBAAgB,CACpC,SACA,SACA,SAAmC,QAAQ,QAAQ,QACd;AAAA,EACrC,MAAM,eACJ,QAAQ,WAAW,IACf,CAAC,IACC,MAAM,QAAQ,QAAQ,iBAAiB;AAAA,IACvC,WAAW,QAAQ;AAAA,IACnB,WAAW,QAAQ,IAAI,CAAC,WAAW,OAAO,EAAE;AAAA,EAC9C,CAAC,KAAM,CAAC;AAAA,EAEd,OAAO,QAAQ,IAAI,CAAC,YAAY;AAAA,OAC3B,aAAa,MAAM;AAAA,IACtB,cAAc,aACX,OAAO,CAAC,gBAAgB,YAAY,aAAa,OAAO,EAAE,EAC1D,IAAI,GAAG,WAAW,SAAS,eAAe,EAAE,WAAW,SAAS,QAAQ,EAAE;AAAA,EAC/E,EAAE;AAAA;AAIJ,SAAS,YAAY,CAAC,QAA8C;AAAA,EAClE,IAAI,CAAC,OAAO;AAAA,IAAc,OAAO;AAAA,EAEjC,QAAQ,MAAM,QAAQ,gBAAgB,OAAO;AAAA,EAC7C,OAAO,KAAK,QAAQ,cAAc,EAAE,MAAM,QAAQ,YAAY,EAAE;AAAA;;;AC3F3D,SAAS,wBAAwB,CAAC,OASlB;AAAA,EACrB,QAAQ,WAAW;AAAA,EACnB,MAAM,gBAAgB,IAAI;AAAA,EAE1B,MAAM,eAAe,CAAC,aAAkD;AAAA,IACtE,IAAI,WAAW,QAAQ,CAAC,MAAM;AAAA,MAAS,OAAO,QAAQ,QAAQ,IAAI;AAAA,IAElE,IAAI,QAAQ,cAAc,IAAI,QAAQ;AAAA,IACtC,IAAI,CAAC,OAAO;AAAA,MACV,QAAQ,MAAM,aAAa,QAAQ;AAAA,MACnC,cAAc,IAAI,UAAU,KAAK;AAAA,IACnC;AAAA,IACA,OAAO;AAAA;AAAA,EAIT,MAAM,YAAY,CAAC,aAAyD;AAAA,IAC1E,IAAI,WAAW;AAAA,MAAM,OAAO;AAAA,IAC5B,IAAI,WAAW,YAAY,iBAAgB,QAAQ,SAAS,KAAK;AAAA,MAAG,OAAO;AAAA,IAC3E,OAAO,MAAM,UAAU,YAAY;AAAA;AAAA,EAGrC,MAAM,cAAc,CAAC,aACnB,MAAM,QAAQ,cAAc,EAAE,WAAW,MAAM,WAAW,IAAI,SAAS,GAAG,CAAC;AAAA,EAE7E,MAAM,WAAW,OAAO,aAAsD;AAAA,IAC5E,MAAM,MAAM,UAAU,QAAQ;AAAA,IAC9B,IAAI;AAAA,MAAK,OAAO;AAAA,IAEhB,IAAI,SAAyB;AAAA,IAC7B,WAAW,YAAY,MAAM,YAAY,QAAQ,GAAG;AAAA,MAClD,MAAM,QAAQ,MAAM,aAAa,QAAQ;AAAA,MACzC,IAAI,UAAU;AAAA,QAAU,OAAO;AAAA,MAC/B,IAAI,UAAU;AAAA,QAAQ,SAAS;AAAA,IACjC;AAAA,IACA,OAAO;AAAA;AAAA,EAGT,MAAM,gBAAgB,OACpB,UACA,aAC4B;AAAA,IAC5B,IAAI,aAAa;AAAA,MAAW,OAAO,SAAS,QAAQ;AAAA,IAEpD,MAAM,MAAM,UAAU,QAAQ;AAAA,IAC9B,IAAI;AAAA,MAAK,OAAO;AAAA,IAEhB,IAAI,EAAE,MAAM,YAAY,QAAQ,GAAG,SAAS,QAAQ;AAAA,MAAG,OAAO;AAAA,IAE9D,MAAM,QAAQ,MAAM,aAAa,QAAQ;AAAA,IACzC,OAAO,UAAU,OAAO,SAAS;AAAA;AAAA,EAGnC,OAAO,EAAE,UAAU,eAAe,aAAa;AAAA;AAI1C,SAAS,eAAe,CAAC,YAAoB,QAA8B;AAAA,EAChF,IAAI,WAAW,QAAQ;AAAA,IACrB,MAAM,IAAI,sBACR,cACA,oBAAoB,uDACtB;AAAA,EACF;AAAA,EAEA,IAAI,WAAW,QAAQ;AAAA,IACrB,MAAM,IAAI,sBACR,aACA,6BAA6B,2EAC/B;AAAA,EACF;AAAA;;;ACxGF,IAAM,YAAY;AAUlB,eAAsB,gBAAgB,CACpC,SACA,MACA,OAC8B;AAAA,EAC9B,IAAI;AAAA,IACF,MAAM,QAAQ,sBAAsB,SAAS,KAAK;AAAA,IAElD,IAAI,MAAM,SAAS,UAAU;AAAA,MAC3B,QAAQ,OAAO,WAAW,MAAM,QAAQ,aAAa,MAAM;AAAA,QACzD,OAAO,MAAM;AAAA,QACb,QAAQ,MAAM;AAAA,MAChB,CAAC;AAAA,MACD,OAAO,EAAE,MAAM,UAAU,OAAO,WAAW,MAAM;AAAA,IACnD;AAAA,IAEA,OAAO,EAAE,MAAM,cAAe,MAAM,SAAS,SAAS,MAAM,KAAK,MAAO,MAAM;AAAA,IAC9E,OAAO,OAAO;AAAA,IACd,MAAM,aAAa,MAAM,KAAK;AAAA;AAAA;AAQ3B,SAAS,qBAAqB,CACnC,SACA,OACoB;AAAA,EACpB,MAAM,YAAY,qBAAoB,MAAM,OAAO,EAAE,UAAU,QAAQ,SAAS,CAAC;AAAA,EAEjF,OAAO;AAAA,IACL,qBAAqB,CAAC,GAAG,UAAU,OAAO,aAAa;AAAA,IACvD,mBAAmB,CAAC,GAAG,UAAU,oBAAoB;AAAA,IACrD,QAAQ,oBAAoB,0BAA0B,QAAQ,YAAY,GAAG,SAAS;AAAA,EACxF;AAAA;AASK,SAAS,mBAAmB,CACjC,MACA,WACqB;AAAA,EACrB,MAAM,aAAa,KAAK,kBAAkB;AAAA,EAC1C,MAAM,UAAU,UAAU,OAAO;AAAA,EACjC,MAAM,OAAO,UAAU;AAAA,EAEvB,MAAM,QAA+E,CAAC;AAAA,EACtF,WAAW,aAAa,KAAK,SAAS,WAAW,KAAK,aAAa,CAAC,GAAG;AAAA,IACrE,MAAM,UAAU,UAAU;AAAA,MACxB,YAAY,aAAa,MAAM,iBAAiB,MAAM,SAAS,SAAS,GAAG,UAAU;AAAA,IACvF;AAAA,EACF;AAAA,EAEA,OAAO,EAAE,YAAY,aAAa,MAAM,SAAS,UAAU,GAAG,MAAM;AAAA;AAGtE,SAAS,YAAY,CACnB,MACA,eACA,YACuC;AAAA,EACvC,MAAM,aAAoD,CAAC;AAAA,EAE3D,WAAW,gBAAgB,eAAe;AAAA,IACxC,WAAW,YAAY,KAAK,kBAAkB,YAAY,GAAG,cAAc,CAAC,GAAG;AAAA,MAC7E,WAAW,SAAS,QAAQ,cAAc,SAAS,QAAQ,UAAU;AAAA,IACvE;AAAA,EACF;AAAA,EAEA,OAAO;AAAA;AAIT,SAAS,gBAAgB,CACvB,MACA,SACA,WACU;AAAA,EACV,MAAM,UAAU,IAAI;AAAA,EAEpB,IAAI,UAAU,cAAc,YAAY;AAAA,IACtC,WAAW,gBAAgB,SAAS;AAAA,MAClC,MAAM,OAAO,KACV,kBAAkB,YAAY,GAC7B,MAAM,KAAK,CAAC,cAAc,UAAU,OAAO,UAAU,MAAM;AAAA,MAC/D,IAAI,CAAC,QAAQ,KAAK,uBAAuB;AAAA,QAAK;AAAA,MAE9C,WAAW,UAAU,CAAC,KAAK,kBAAkB,EAAE,KAAK;AAAA,QAAG,QAAQ,IAAI,MAAM;AAAA,IAC3E;AAAA,IACA,OAAO,CAAC,GAAG,OAAO;AAAA,EACpB;AAAA,EAEA,MAAM,UACJ,UAAU,uBAAuB,YAC7B,KAAK,gBAAgB,IACrB,CAAC,KAAK,kBAAkB,UAAU,kBAAkB,CAAC,EAAE,OAAO,CAAC,SAAS,SAAS,IAAI;AAAA,EAE3F,WAAW,UAAU,SAAS;AAAA,IAC5B,MAAM,OAAO,OAAO,MAAM,KAAK,CAAC,cAAc,UAAU,OAAO,UAAU,MAAM;AAAA,IAC/E,IAAI,CAAC;AAAA,MAAM;AAAA,IAEX,MAAM,UACJ,KAAK,uBAAuB,OAC5B,QAAQ,KAAK,CAAC,WAAW,KAAK,kBAAkB,KAAK,oBAAoB,MAAM,CAAC;AAAA,IAClF,IAAI;AAAA,MAAS,QAAQ,IAAI,OAAO,EAAE;AAAA,EACpC;AAAA,EACA,OAAO,CAAC,GAAG,OAAO;AAAA;AAIpB,SAAS,aAAa,CACpB,QACA,YACA,QAAQ,GACe;AAAA,EACvB,IAAI,OAAO,WAAW;AAAA,IAAU,OAAO,EAAE,MAAM,OAAO;AAAA,EAEtD,QAAQ,OAAO;AAAA,SACR,gBAAgB;AAAA,MACnB,MAAM,QAAQ,WAAW,IAAI,OAAO,WAAW,GAAG,UAAU,OAAO;AAAA,MAEnE,OAAO,SAAS,QAAQ,IAAI,cAAc,OAAO,YAAY,QAAQ,CAAC,IAAI,EAAE,MAAM,SAAS;AAAA,IAC7F;AAAA,SACK;AAAA,MACH,OAAO,EAAE,MAAM,QAAQ,WAAW,OAAO,UAAU;AAAA;AAAA,MAEnD,OAAO,EAAE,MAAM,OAAO,KAAK;AAAA;AAAA;AAIjC,eAAe,QAAQ,CACrB,SACA,OACsE;AAAA,EACtE,MAAM,UAAuB,CAAC;AAAA,EAC9B,IAAI,QAAQ;AAAA,EACZ,IAAI;AAAA,EAEJ,UAAS;AAAA,IAEP,MAAM,WAAW,KAAK,IAAI,WAAW,iBAAgB,eAAe,QAAQ,MAAM;AAAA,IAClF,MAAM,QAAQ,cAAc;AAAA,IAE5B,MAAM,OAAO,MAAM,QAAQ,aAAa,aAAa;AAAA,MACnD,OAAO,EAAE,MAAM,QAAQ,OAAO,OAAO,aAAc,YAAY,EAAE,UAAU,IAAI,CAAC,EAAG;AAAA,SAC/E,QAAQ,EAAE,cAAc,KAAK,IAAI,CAAC;AAAA,IACxC,CAAC;AAAA,IAED,IAAI;AAAA,MAAO,QAAQ,KAAK,SAAS,KAAK,QAAQ;AAAA,IAC9C,QAAQ,KAAK,GAAG,KAAK,OAAO;AAAA,IAE5B,IAAI,CAAC,KAAK,WAAW,KAAK,kBAAkB,WAAW;AAAA,MACrD,OAAO,EAAE,SAAS,OAAO,WAAW,MAAM;AAAA,IAC5C;AAAA,IACA,IAAI,QAAQ,UAAU,iBAAgB,cAAc;AAAA,MAClD,OAAO,EAAE,SAAS,OAAO,WAAW,KAAK;AAAA,IAC3C;AAAA,IAEA,YAAY,KAAK;AAAA,EACnB;AAAA;AAIF,SAAS,YAAY,CAAC,MAAc,OAAyB;AAAA,EAC3D,IAAI,EAAE,iBAAiB,+BAA8B,iBAAiB,4BAA2B;AAAA,IAC/F,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,SAAS,MAAM,OAAO,IAAI,CAAC,UAAU,GAAG,MAAM,SAAS,MAAM,SAAS,EAAE,KAAK,IAAI;AAAA,EACvF,MAAM,UACJ,iBAAiB,8BACb,mCACA;AAAA,EAEN,OAAO,IAAI,sBAAqB,iBAAiB,iBAAiB,SAAS,YAAY,QAAQ;AAAA;;;AC/J1F,SAAS,0BAA0B,CACxC,SAIsB;AAAA,EACtB,OAAO,OAAO,UAAU;AAAA,IACtB,MAAM,QAAQ,sBAAsB,SAAS,KAAK;AAAA,IAElD,IAAI,MAAM,SAAS,UAAU;AAAA,MAC3B,MAAM,QAAQ,aAAa,MAAM,EAAE,OAAO,MAAM,OAAO,QAAQ,MAAM,OAAO,CAAC;AAAA,MAC7E,OAAO,EAAE,MAAM,MAAM,SAAS,MAAM;AAAA,IACtC;AAAA,IAEA,MAAM,QAAQ,aAAa,OAAO,EAAE,OAAO,MAAM,MAAM,CAAC;AAAA,IAExD,MAAM,YAAY,MAAM,gBAAgB,QAAQ,YAAY;AAAA,IAC5D,IAAI;AAAA,MAAW,sBAAsB,MAAM,OAAO,QAAQ,UAAU,SAAS;AAAA,IAG7E,IAAI,CAAC,kBAAiB,SAAS,EAAE,MAAM,aAAa,CAAC;AAAA,MAAG,qBAAqB,MAAM,KAAK;AAAA,IAExF,OAAO,EAAE,MAAM,MAAM,SAAS,MAAM;AAAA;AAAA;AAAA;AAKxC,MAAM,8BAA8B,oBAAmB;AAAA,EAG1C;AAAA,EAFX,WAAW,CACT,UACS,IACT,SACA;AAAA,IACA,MAAM,UAAU,OAAO;AAAA,IAHd;AAAA;AAKb;AAUA,SAAS,qBAAqB,CAC5B,OACA,UACA,WACM;AAAA,EACN,QAAQ,YAAY,qBAAqB,eAAe,cAAc,OAAO,QAAQ;AAAA,EACrF,MAAM,UAAU,iBAAiB,UAAU;AAAA,EAE3C,WAAW,gBAAgB,qBAAqB;AAAA,IAC9C,MAAM,cAAc,SAAS,cAAc,cAAa,UAAU,YAAY;AAAA,IAC9E,MAAM,aAAa,gBAAgB,WAAW,cAAc,WAAW;AAAA,IACvE,IAAI,CAAC;AAAA,MAAY;AAAA,IAEjB,MAAM,UAAU,YAAY,WAAW,mBAAmB;AAAA,IAC1D,MAAM,UACF,IAAI,sBACF,qBAAqB,WAAW,WAChC,GAAG,QAAQ,iBAAiB,WAAW,UACvC,UAAU,iDACZ,IACA,IAAI,sBACF,qBAAqB,WAAW,WAChC,KACA,UAAU,4EACZ;AAAA,EACN;AAAA,EAEA,WAAW,aAAa,YAAY;AAAA,IAClC,WAAW,gBAAgB,UAAU,eAAe;AAAA,MAClD,MAAM,aAAa,gBACjB,WACA,cACA,cAAa,UAAU,YAAY,CACrC;AAAA,MACA,IAAI,CAAC;AAAA,QAAY;AAAA,MAEjB,MAAM,IAAI,sBACR,qBAAqB,WAAW,WAChC,UAAU,IACV,mBAAmB,UAAU,eAAe,yBAAyB,WAAW,2GAA2G,4DAC7L;AAAA,IACF;AAAA,EACF;AAAA;AAOF,SAAS,oBAAoB,CAAC,OAA0B;AAAA,EACtD,MAAM,aAAa,sBAAqB,KAAK;AAAA,EAC7C,IAAI,WAAW,SAAS;AAAA,IAAU;AAAA,EAElC,MAAM,WAAW,mBAAmB,WAAW,OAAO,WAAW,YAAY,GAAG;AAAA,EAChF,IAAI,CAAC;AAAA,IAAU;AAAA,EAEf,MAAM,IAAI,sBACR,cACA,SAAS,IACT,uCAAuC,SAAS,oEAAoE,SAAS,6BAC/H;AAAA;AAGF,SAAS,kBAAkB,CACzB,OACA,YACA,IACkE;AAAA,EAClE,OAAO,cAAc,SAAS,CAAC;AAAA,EAC/B,IAAI,eAAe;AAAA,IAAW,OAAO,EAAE,YAAY,IAAI,GAAG,cAAc;AAAA,EAExE,YAAY,OAAO,cAAc,WAAW,QAAQ,GAAG;AAAA,IACrD,MAAM,OAAO,OAAO,MAAM,gBAAgB,WAAW,GAAG,aAAa;AAAA,IACrE,MAAM,QAAQ,mBAAmB,UAAU,OAAO,UAAU,UAAU,CAAC,GAAG,IAAI;AAAA,IAC9E,IAAI;AAAA,MAAO,OAAO;AAAA,EACpB;AAAA,EAEA;AAAA;AAGF,SAAS,aAAY,CAAC,UAA4B,cAAyC;AAAA,EACzF,OAAO,SAAS,kBAAkB,YAAY,EAAE,WAAW,IAAI,CAAC,aAAa,SAAS,EAAE;AAAA;AAG1F,SAAS,eAAe,CACtB,WACA,cACA,aAC+F;AAAA,EAC/F,YAAY,OAAO,eAAe,YAAY,QAAQ,GAAG;AAAA,IACvD,MAAM,UAAU,UAAU,eAAe,cAAc,UAAU;AAAA,IACjE,IAAI,YAAY;AAAA,MAAW,OAAO,EAAE,YAAY,OAAO,QAAQ;AAAA,EACjE;AAAA,EAEA;AAAA;AAQF,SAAS,aAAa,CAAC,OAAoB,UAA4B;AAAA,EACrE,MAAM,aAA0F,CAAC;AAAA,EAEjG,MAAM,QAAQ,OAAO,OAAO,CAAC,CAAC;AAAA,EAC9B,MAAM,WAAyC;AAAA,IAC7C,OAAO,MAAM;AAAA,IACb,QAAQ,OAAO,EAAE,MAAM;AAAA,IACvB,UAAU,MAAG;AAAA,MAAG;AAAA;AAAA,IAChB,MAAM,CAAC,UAAU;AAAA,MACf,IAAI,MAAM,QAAQ,UAAU;AAAA,QAC1B,WAAW,KAAK;AAAA,UACd,IAAI,MAAM;AAAA,UACV,QAAQ,MAAM;AAAA,UACd,eAAe,CAAC,GAAG,MAAM,OAAO,aAAa;AAAA,QAC/C,CAAC;AAAA,MACH;AAAA,MACA,OAAO,EAAE,MAAM;AAAA;AAAA,IAEjB,KAAK,MAAM;AAAA,EACb;AAAA,EAEA,MAAM,YAAY,iCAAiC,OAAO,EAAE,SAAS,GAAG,QAAQ;AAAA,EAChF,OAAO;AAAA,IACL,YAAY,UAAU;AAAA,IACtB,qBAAqB,UAAU,OAAO;AAAA,IACtC;AAAA,EACF;AAAA;AAIF,SAAS,gBAAgB,CACvB,OACA,KAAK,KACwE;AAAA,EAC7E,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO,MAAM,aAAa,EAAE,YAAY,MAAM,YAAY,GAAG,IAAI;AAAA,SAC9D;AAAA,SACA;AAAA,SACA;AAAA,MACH,OAAO,iBAAiB,MAAM,OAAO,GAAG,UAAU;AAAA;AAAA,MAElD;AAAA;AAAA;AAUN,eAAsB,oBAAoB,CACxC,aACA,MACA,OACA,SACoD;AAAA,EACpD,MAAM,UAAU,IAAI;AAAA,EACpB,IAAI,SAAS;AAAA,IAAQ,OAAO;AAAA,EAE5B,MAAM,UAAU,MAAM,OAAO,CAAC,SAAS,KAAK,KAAK,WAAW,0BAA0B,CAAC;AAAA,EACvF,OAAO,SAAS;AAAA,EAChB,IAAI,CAAC;AAAA,IAAO,OAAO;AAAA,EAEnB,IAAI,CAAC,qBAAqB,SAAS,IAAI,GAAG;AAAA,IACxC,MAAM,gBACJ,IAAI,MAAM,YAAY,4DACxB;AAAA,EACF;AAAA,EAEA,IAAI,QAAQ,SAAS,iBAAgB,YAAY;AAAA,IAC/C,MAAM,gBACJ,2BAA2B,iBAAgB,oCAAoC,QAAQ,SACzF;AAAA,EACF;AAAA,EAEA,IAAI,CAAC,SAAS;AAAA,IACZ,MAAM,gBACJ,IAAI,MAAM,0EACZ;AAAA,EACF;AAAA,EAGA,WAAW,QAAQ,SAAS;AAAA,IAC1B,MAAM,OAAO,mBAAkB,KAAK,IAAI;AAAA,IACxC,IAAI,CAAC,MAAM;AAAA,MACT,MAAM,gBACJ,IAAI,KAAK,uHACX;AAAA,IACF;AAAA,IAEA,MAAM,OAAO,MAAM,iBAAiB,aAAa,MAAM,iBAAgB,aAAa;AAAA,IACpF,MAAM,SAAS,mBAAmB,KAAK,MAAM,IAAI;AAAA,IACjD,IAAI,WAAW;AAAA,MAAQ,MAAM,gBAAgB,OAAO,KAAK;AAAA,IAEzD,IAAI;AAAA,MACF,QAAQ,IAAI,MAAM,MAAM,QAAQ,OAAO,KAAK,CAAC;AAAA,MAC7C,OAAO,OAAO;AAAA,MACd,MAAM,QAAQ,KAAK,MAAM,QAAQ,KAAK;AAAA;AAAA,EAE1C;AAAA,EAEA,OAAO;AAAA;AAQT,SAAS,OAAO,CACd,MACA,QACA,OACS;AAAA,EACT,MAAM,SAAS,CAAC,cACd,OAAO,MAAM,SAAS,YAAY,UAAU,WAAW,UAAU,IAC7D,YACA,GAAG,OAAO,KAAK,UAAU,MAAM,CAAC;AAAA,EAEtC,IAAI,iBAAiB,uBAAuB;AAAA,IAC1C,OAAO,gBACL,GAAG,SAAS,OAAO,MAAM,EAAE,MAAM,MAAM,QAAQ,QAAQ,gBAAgB,EAAE,GAC3E;AAAA,EACF;AAAA,EAEA,IAAI,iBAAiB,+BAA8B,iBAAiB,2BAA0B;AAAA,IAC5F,MAAM,SAAS,MAAM,OAAO,IAAI,CAAC,UAAU,GAAG,OAAO,MAAM,IAAI,MAAM,MAAM,SAAS;AAAA,IACpF,OAAO,gBAAgB,GAAG,SAAS,OAAO,KAAK,IAAI,GAAG;AAAA,EACxD;AAAA,EAEA,IAAI,iBAAiB,uBAAsB,iBAAiB,4BAA2B;AAAA,IACrF,OAAO,gBAAgB,GAAG,SAAS,MAAM,QAAQ,QAAQ,gBAAgB,EAAE,GAAG;AAAA,EAChF;AAAA,EAEA,OAAO;AAAA;;;AChTT,eAAsB,iBAAiB,CACrC,SACA,OAC8B;AAAA,EAC9B,IAAI,MAAM,SAAS,iBAAgB,eAAe;AAAA,IAChD,MAAM,gBACJ,kCAAkC,iBAAgB,yCAAyC,MAAM,mBACnG;AAAA,EACF;AAAA,EACA,MAAM,YAAY,IAAI;AAAA,EACtB,MAAM,WAAW,IAAI;AAAA,EACrB,MAAM,WAAgC,CAAC;AAAA,EACvC,WAAW,aAAa,OAAO;AAAA,IAC7B,MAAM,QAAQ,UAAU,KACpB,OAAO,UAAU,SAAS,UAAU,aACpC,IAAI,UAAU;AAAA,IAClB,MAAM,UAAU,sBAAqB,UAAU,OAAO;AAAA,IACtD,IAAI,CAAC,SAAS;AAAA,MACZ,MAAM,gBACJ,GAAG,qIACL;AAAA,IACF;AAAA,IACA,IAAI,QAAQ,eAAe,QAAQ,YAAY;AAAA,MAC7C,MAAM,gBACJ,GAAG,6FACL;AAAA,IACF;AAAA,IACA,IAAI,WAAW,UAAU,IAAI,QAAQ,UAAU;AAAA,IAC/C,IAAI,CAAC,UAAU;AAAA,MACb,WAAW,QAAQ,QAChB,IAAI,EAAE,WAAW,QAAQ,WAAW,IAAI,QAAQ,WAAW,CAAC,EAC5D,KAAK,OAAO,WAAY,UAAW,MAAM,QAAQ,SAAS,MAAM,IAAK,SAAS,IAAK;AAAA,MACtF,UAAU,IAAI,QAAQ,YAAY,QAAQ;AAAA,IAC5C;AAAA,IACA,MAAM,SAAS,MAAM;AAAA,IACrB,IAAI,CAAC,QAAQ;AAAA,MACX,MAAM,gBAAgB,GAAG,uCAAuC;AAAA,IAClE;AAAA,IACA,MAAM,SAAS,QAAQ,WAAW,OAAO;AAAA,IACzC,MAAM,MAAM,GAAG,OAAO,MAAM;AAAA,IAC5B,IAAI,UAAU,SAAS,IAAI,GAAG;AAAA,IAC9B,IAAI,CAAC,SAAS;AAAA,MACZ,UAAU,QAAQ,QAAQ,WAAW;AAAA,QACnC,WAAW,QAAQ;AAAA,QACnB,YAAY,OAAO;AAAA,QACnB,SAAS;AAAA,MACX,CAAC;AAAA,MACD,SAAS,IAAI,KAAK,OAAO;AAAA,IAC3B;AAAA,IACA,MAAM,SAAS,MAAM;AAAA,IACrB,IAAI,CAAC;AAAA,MAAQ,MAAM,gBAAgB,GAAG,gBAAW,OAAO,8BAAyB,SAAS;AAAA,IAC1F,MAAM,SAAS,wBAAuB,SAAS,EAAE,MAAM,OAAO,SAAS,OAAO,CAAC;AAAA,IAC/E,IAAI,aAAa,QAAQ;AAAA,MACvB,MAAM,gBAAgB,GAAG,gBAAW,OAAO,eAAU,OAAO,UAAU;AAAA,IACxE;AAAA,IACA,SAAS,KAAK,KAAK,WAAW,iBAAiB,OAAO,QAAQ,CAAC;AAAA,EACjE;AAAA,EACA,OAAO;AAAA;AAQT,eAAsB,gBAAgB,CACpC,SACA,UACA,SAC4B;AAAA,EAC5B,MAAM,aAAa,MAAM,QAAQ,QAAQ,wBAAwB;AAAA,IAC/D,WAAW,QAAQ;AAAA,IACnB,YAAY,SAAS;AAAA,EACvB,CAAC;AAAA,EACD,MAAM,WAA8B,CAAC;AAAA,EACrC,WAAW,aAAa,YAAY;AAAA,IAClC,IAAI,UAAU,eAAe,SAAS;AAAA,MAAI;AAAA,IAE1C,MAAM,SAA4B,CAAC;AAAA,IACnC,WAAW,aAAa,UAAU,YAAY;AAAA,MAC5C,MAAM,UAAU,sBAAqB,UAAU,OAAO;AAAA,MAEtD,IAAI,SAAS,eAAe,SAAS,MAAM,QAAQ,YAAY;AAAA,QAAW;AAAA,MAC1E,MAAM,SAAS,wBAAuB,SAAS,EAAE,MAAM,SAAS,SAAS,QAAQ,CAAC;AAAA,MAClF,IAAI,EAAE,aAAa;AAAA,QAAS;AAAA,MAC5B,OAAO,KAAK;AAAA,QACV,MAAM;AAAA,QACN,SAAS,SAAI,UAAU,gBAAW,UAAU,eAAe,UAAU,OAAO,UAAU,UAAU,cAAc,UAAU,wBAAwB,QAAQ,WAAW,OAAO;AAAA,MAC5K,CAAC;AAAA,IACH;AAAA,IACA,IAAI,OAAO,WAAW;AAAA,MAAG;AAAA,IAEzB,MAAM,QAAQ,MAAM,QAAQ,QAAQ,IAAI;AAAA,MACtC,WAAW,QAAQ;AAAA,MACnB,IAAI,UAAU;AAAA,IAChB,CAAC;AAAA,IACD,IAAI,SAAU,MAAM,QAAQ,SAAS,KAAK;AAAA,MAAI,SAAS,KAAK,GAAG,MAAM;AAAA,EACvE;AAAA,EACA,OAAO;AAAA;AAIF,SAAS,YAAY,CAAC,QAAmE;AAAA,EAC9F,OAAO,OAAO,aAAa,OAAO,SAAS,YAAY,iBAAgB,QAAQ,SAAS,KAAK;AAAA;;;ACrI/F;AAgBA,eAAsB,cAAc,CAClC,aACA,OAMC;AAAA,EACD,MAAM,SAAS,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC;AAAA,EAC7D,MAAM,aAAa,OAAO,IAAI,YAAW;AAAA,EACzC,IAAI,CAAC,YAAY;AAAA,IACf,MAAM,gBACJ,gBAAgB,kFAClB;AAAA,EACF;AAAA,EACA,sBAAsB,OAAO,YAAY;AAAA,EACzC,MAAM,SAAS,aACb,MAAM,iBAAiB,aAAa,YAAY,iBAAgB,cAAc,CAChF;AAAA,EACA,IAAI,WAAW;AAAA,IAAQ,MAAM,gBAAgB,OAAO,KAAK;AAAA,EACzD,QAAQ,WAAW;AAAA,EAEnB,MAAM,aAA+B,CAAC;AAAA,EACtC,WAAW,QAAQ,OAAO,OAAO;AAAA,IAC/B,IAAI,KAAK,SAAS;AAAA,MAAS,WAAW,KAAK,EAAE,SAAS,KAAK,KAAK,IAAI,SAAS,IAAI,KAAK,GAAG,CAAC;AAAA,IAC1F,IAAI,KAAK,SAAS;AAAA,MAAS;AAAA,IAC3B,MAAM,OAAO,OAAO,IAAI,MAAM,UAAU,KAAK,IAAI,CAAC;AAAA,IAClD,IAAI,CAAC,MAAM;AAAA,MACT,MAAM,gBACJ,GAAG,uBAAsB,KAAK,cAAc,KAAK,gDACnD;AAAA,IACF;AAAA,IACA,MAAM,WAAW,IAAI;AAAA,IACrB,QAAQ,YAAY,OAAO,YAAY,mBAAmB,UAAU,MAAM,KAAK,IAAI,KAAK,IAAI;AAAA,IAC5F,SAAS,UAAU,MAAM,iBAAiB,aAAa,MAAM,iBAAgB,aAAa,CAAC;AAAA,IAC3F,MAAM,UAAU,QAAQ;AAAA,IACxB,IAAI;AAAA,MAAS,MAAM,gBAAgB,UAAU,KAAK,QAAQ,SAAS;AAAA,IACnE,WAAW,KAAK,GAAG,KAAK;AAAA,EAC1B;AAAA,EAEA,OAAO;AAAA,IACL,OAAO;AAAA,IACP,SAAS;AAAA,MACP,MAAM;AAAA,MACN,OAAO,OAAO,MAAM,QAAQ,CAAC,SAA8B;AAAA,QACzD,MAAM,QAAQ,KAAK,SAAS,WAAW,KAAK,SAAS,YAAY,KAAK,QAAQ;AAAA,QAC9E,MAAM,QAAQ,EAAE,IAAI,KAAK,OAAQ,QAAQ,EAAE,MAAM,IAAI,CAAC,EAAG;AAAA,QACzD,IAAI,KAAK,SAAS,SAAS;AAAA,UACzB,OAAO;AAAA,YACL,KAAK,OAAO,MAAM,SAAS,MAAM,MAAM,UAAU,KAAK,IAAI,GAAG,GAAG,KAAK,GAAG,GAAG,KAAK,EAAE;AAAA,UACpF;AAAA,QACF;AAAA,QACA,OAAO,KAAK,SAAS,YAAY,CAAC,KAAK,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC;AAAA,OACrE;AAAA,IACH;AAAA,IACA;AAAA,IACA,UAAU,eAAe,MAAM;AAAA,EACjC;AAAA;AAUF,IAAM,WAAW,CAAC,GAAQ,MACxB,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE;AAOzE,SAAS,cAAc,CAAC,QAAmC;AAAA,EACzD,MAAM,SAAS,OAAO,MAAM,QAAQ,CAAC,SAAU,KAAK,SAAS,UAAU,CAAC,IAAI,IAAI,CAAC,CAAE;AAAA,EACnF,MAAM,WAA8B,CAAC;AAAA,EACrC,OAAO,QAAQ,CAAC,OAAO,UAAU;AAAA,IAC/B,WAAW,SAAS,OAAO,MAAM,QAAQ,CAAC,GAAG;AAAA,MAC3C,IAAI,CAAC,SAAS,OAAO,KAAK;AAAA,QAAG;AAAA,MAC7B,SAAS,KAAK;AAAA,QACZ,MAAM;AAAA,QACN,MAAM,MAAM;AAAA,QACZ,SAAS,WAAW,MAAM,YAAY,MAAM;AAAA,MAC9C,CAAC;AAAA,IACH;AAAA,GACD;AAAA,EACD,WAAW,QAAQ,OAAO,OAAO;AAAA,IAC/B,IAAI,KAAK,SAAS,UAAU,KAAK,SAAS;AAAA,MAAQ;AAAA,IAClD,MAAM,SAAS,EAAE,GAAG,KAAK,GAAG,GAAG,KAAK,GAAG,GAAG,GAAG,GAAG,EAAE;AAAA,IAClD,MAAM,QAAQ,OAAO,KAAK,CAAC,cAAc,SAAS,WAAW,MAAM,CAAC;AAAA,IACpE,IAAI,CAAC;AAAA,MAAO;AAAA,IACZ,SAAS,KAAK;AAAA,MACZ,MAAM;AAAA,MACN,MAAM,KAAK;AAAA,MACX,SAAS,GAAG,KAAK,SAAS,SAAS,SAAS,WAAW,KAAK,sBAAsB,MAAM;AAAA,IAC1F,CAAC;AAAA,EACH;AAAA,EACA,OAAO;AAAA;;;ACpHT,kBAAS;AAUF,IAAM,iBAAiB;AAO9B,eAAsB,gBAAgB,CACpC,aACA,OAKC;AAAA,EACD,MAAM,QAAQ,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,cAAc;AAAA,EAC/D,IAAI,CAAC;AAAA,IAAO,MAAM,gBAAgB,qCAAqC,kBAAkB;AAAA,EACzF,MAAM,WAAW,MAAM,iBAAiB,aAAa,OAAO,iBAAgB,gBAAgB;AAAA,EAG5F,MAAM,OAAO,IAAI,SAAS,KAAK,UAAU;AAAA,IACvC,QAAQ;AAAA,IACR,eAAe;AAAA,IACf,WAAW;AAAA,IACX,WAAW;AAAA,EACb,CAAC;AAAA,EACD,MAAM,WAA8C,CAAC;AAAA,EACrD,MAAM,SAAmB,CAAC;AAAA,EAE1B,MAAM,YAA0E,CAAC;AAAA,EACjF,IAAI,UAAkD;AAAA,EACtD,IAAI,aAAa,EACd,GAAG,0BAA0B;AAAA,IAC5B,OAAO,CAAC,SAAS;AAAA,MACf,UAAU,EAAE,OAAO,OAAO,QAAQ,QAAQ,MAAM,CAAC,CAAC,GAAG,MAAM,GAAG;AAAA,MAC9D,SAAS,KAAK,OAAO;AAAA,MACrB,QAAQ,SAAS,MAAM;AAAA,QACrB,UAAU;AAAA,OACX;AAAA;AAAA,IAEH,IAAI,CAAC,OAAO;AAAA,MACV,IAAI;AAAA,QAAS,QAAQ,QAAQ,MAAM;AAAA;AAAA,EAEvC,CAAC,EACA,GAAG,OAAO;AAAA,IACT,OAAO,CAAC,SAAS;AAAA,MACf,MAAM,SAAS,mBAAmB,QAAQ,aAAa,KAAK,KAAK,EAAE;AAAA,MACnE,IAAI,mBAAkB,MAAM,GAAG;AAAA,QAC7B,UAAU,KAAK,EAAE,SAAS,OAAO,KAAK,GAAG,IAAI,SAAS,SAAS,SAAS,SAAS,EAAE,CAAC;AAAA,MACtF,EAAO;AAAA,QACL,OAAO,KAAK,MAAM;AAAA;AAAA;AAAA,EAGxB,CAAC,EACA,GAAG,KAAK;AAAA,IACP,OAAO,CAAC,SAAS;AAAA,MACf,MAAM,OAAO,mBAAmB,QAAQ,aAAa,MAAM,KAAK,EAAE;AAAA,MAClE,IAAI,mBAAkB,IAAI,GAAG;AAAA,QAC3B,UAAU,KAAK,EAAE,SAAS,KAAK,KAAK,GAAG,IAAI,QAAQ,SAAS,SAAS,SAAS,EAAE,CAAC;AAAA,MACnF;AAAA;AAAA,EAEJ,CAAC,EACA,UAAU,IAAI;AAAA,EAEjB,MAAM,QAAQ,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC;AAAA,EACpD,WAAW,UAAU;AAAA,IAAQ,WAAW,QAAQ,KAAK;AAAA,EAErD,MAAM,OAAO,sBAAqB;AAAA,EAClC,MAAM,WAAW,SAAS,IAAI,GAAG,OAAO,WAA4B;AAAA,IAClE,MAAM,QAAQ,mBAAmB,IAAI,EAAE,QAAQ,QAAQ,GAAG,EAAE,KAAK;AAAA,IACjE,OAAO,EAAE,OAAO,MAAM,OAAO,MAAM,KAAK,KAAK,EAAE;AAAA,GAChD;AAAA,EACD,OAAO;AAAA,IACL,OAAO;AAAA,IACP,SAAS,EAAE,MAAM,YAAY,UAAU,SAAS;AAAA,IAChD,YAAY,UAAU,IAAI,GAAG,SAAS,IAAI,SAAS,aAAa;AAAA,MAC9D;AAAA,MACA;AAAA,MACA,IAAI,SAAS,QAAQ,QAAQ;AAAA,IAC/B,EAAE;AAAA,EACJ;AAAA;AAGF,SAAS,UAAU,CAAC,QAAgB,OAAkC;AAAA,EACpE,IAAI,WAAW,MAAM,OAAO,WAAW,IAAI,KAAK,sBAAsB,KAAK,MAAM,GAAG;AAAA,IAClF,MAAM,gBACJ,GAAG,mCAAmC,sJACxC;AAAA,EACF;AAAA,EACA,MAAM,OAAO,OAAM,UAAU,cAAc,OAAO,MAAM,MAAM,EAAE,MAAM,EAAE,CAAC;AAAA,EACzE,IAAI,CAAC,MAAM,IAAI,IAAI,GAAG;AAAA,IACpB,MAAM,gBACJ,GAAG,mCAAmC,oDACxC;AAAA,EACF;AAAA;AAGF,SAAS,aAAa,CAAC,OAAuB;AAAA,EAC5C,IAAI;AAAA,IACF,OAAO,UAAU,KAAK;AAAA,IACtB,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;;;ACzGJ,SAAS,oBAAoB,CAAC,OAGnC;AAAA,EACA,OAAO,QAAQ;AAAA,EACf,IAAI,CAAC,QAAQ,MAAM,SAAS,GAAG;AAAA,IAC7B,MAAM,gBAAgB,wDAAwD,MAAM,SAAS;AAAA,EAC/F;AAAA,EACA,OAAO;AAAA,IACL,OAAO,KAAK;AAAA,IACZ,SAAS,EAAE,MAAM,QAAQ,WAAW,KAAK,KAAK,aAAa,oBAAmB,KAAK,IAAI,EAAE;AAAA,EAC3F;AAAA;;;ACJF,eAAsB,YAAY,CAChC,aACA,OAKC;AAAA,EACD,MAAM,QAAQ,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,WAAU;AAAA,EAC3D,IAAI,CAAC,OAAO;AAAA,IACV,MAAM,gBACJ,iBAAiB,6EACnB;AAAA,EACF;AAAA,EACA,sBAAsB,OAAO,UAAU;AAAA,EACvC,MAAM,OAAO,MAAM,iBAAiB,aAAa,OAAO,iBAAgB,YAAY;AAAA,EAEpF,IAAI,QAAQ;AAAA,EACZ,IAAI,UAAU;AAAA,EACd,IAAI,iBAAiB;AAAA,EACrB,MAAM,WAAW,IAAI,aAAa,EAC/B,GAAG,SAAS;AAAA,IACX,IAAI,CAAC,OAAO;AAAA,MACV,SAAS,MAAM;AAAA;AAAA,EAEnB,CAAC,EACA,GAAG,MAAM;AAAA,IACR,OAAO,CAAC,SAAS;AAAA,MACf,IAAI,WAAW;AAAA,QAAgB;AAAA,MAC/B,iBAAiB;AAAA,MACjB,QAAQ,SAAS,MAAM;AAAA,QACrB,iBAAiB;AAAA,QACjB,YAAY;AAAA,OACb;AAAA;AAAA,IAEH,IAAI,CAAC,OAAO;AAAA,MACV,IAAI;AAAA,QAAgB,WAAW,MAAM;AAAA;AAAA,EAEzC,CAAC;AAAA,EACH,QAAQ,YAAY,YAAY,mBAAmB,UAAU,MAAM,EAAE;AAAA,EACrE,SAAS,UAAU,IAAI;AAAA,EAEvB,MAAM,UAAU,QAAQ;AAAA,EACxB,IAAI;AAAA,IAAS,MAAM,gBAAgB,OAAO;AAAA,EAC1C,MAAM,QAAQ,CAAC,SAAiB,mBAAmB,IAAI,EAAE,QAAQ,QAAQ,GAAG,EAAE,KAAK;AAAA,EACnF,MAAM,QAAQ,MAAM,KAAK,KAAK,MAAM,OAAO;AAAA,EAC3C,OAAO;AAAA,IACL,OAAO;AAAA,IACP,SAAS,EAAE,MAAM,WAAY,QAAQ,EAAE,OAAO,MAAM,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,EAAG;AAAA,IAC1E;AAAA,EACF;AAAA;;;AC/DF,kBAAS;AAkCT,eAAsB,aAAa,CACjC,aACA,OACA,SAMC;AAAA,EACD,MAAM,SAAS,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC;AAAA,EAC7D,MAAM,eAAe,OAAO,IAAI,cAAa;AAAA,EAC7C,IAAI,CAAC,cAAc;AAAA,IACjB,MAAM,gBACJ,4BAA4B,4GAC9B;AAAA,EACF;AAAA,EACA,MAAM,SAAS,eACb,MAAM,iBAAiB,aAAa,cAAc,iBAAgB,gBAAgB,CACpF;AAAA,EACA,IAAI,WAAW;AAAA,IAAQ,MAAM,gBAAgB,OAAO,KAAK;AAAA,EACzD,QAAQ,aAAa;AAAA,EAErB,MAAM,WAAW,IAAI,IAAI,SAAS,OAAO,IAAI,CAAC,UAAU,eAAc,MAAM,IAAI,CAAC,CAAC;AAAA,EAClF,MAAM,QAAQ,MAAM,KAAK,CAAC,SAAS,KAAK,KAAK,WAAW,SAAS,KAAK,CAAC,SAAS,IAAI,KAAK,IAAI,CAAC;AAAA,EAC9F,IAAI,OAAO;AAAA,IACT,MAAM,gBACJ,IAAI,MAAM,2BAA2B,iEACvC;AAAA,EACF;AAAA,EAEA,MAAM,SAAS,IAAI;AAAA,EACnB,MAAM,aAA+B,CAAC;AAAA,EACtC,MAAM,WAA8B,CAAC;AAAA,EACrC,MAAM,SAA0B,CAAC;AAAA,EACjC,WAAW,SAAS,SAAS,QAAQ;AAAA,IACnC,IAAI,MAAM,MAAM;AAAA,MACd,MAAM,OAAO,UAAU,QAAQ,OAAO,QAAQ,IAAI,MAAM,KAAK,KAAK,CAAC;AAAA,MACnE,OAAO,KAAK,KAAK,KAAK;AAAA,MACtB,OAAO,IAAI,MAAM,MAAM,KAAK,KAAK;AAAA,MACjC;AAAA,IACF;AAAA,IAEA,MAAM,QAAQ,MAAM,UAAU,aAAa,QAAQ,OAAO,UAAU;AAAA,IACpE,OAAO,KAAK,KAAK;AAAA,IACjB,OAAO,IAAI,MAAM,MAAM,KAAK;AAAA,IAC5B,SAAS,KAAK,GAAG,aAAa,OAAO,KAAK,CAAC;AAAA,EAC7C;AAAA,EAGA,MAAM,UAAoB,KAAK,UAAU,OAAO;AAAA,EAChD,MAAM,SAAS,mBAAmB,SAAS,MAAM;AAAA,EACjD,IAAI;AAAA,IAAQ,MAAM,gBAAgB,MAAM;AAAA,EAExC,OAAO;AAAA,IACL,OAAO;AAAA,IACP,SAAS;AAAA,MACP,MAAM;AAAA,MACN,QAAQ,SAAS,OAAO,IAAI,CAAC,UAAU;AAAA,QACrC,MAAM,QAAQ,OAAO,IAAI,MAAM,IAAI;AAAA,QACnC,OAAO;AAAA,UACL,MAAM,MAAM;AAAA,UACZ,MAAM,OAAO,KAAK,UAAU;AAAA,UAC5B,SAAS,CAAC,GAAI,OAAO,UAAU,CAAC,CAAE;AAAA,aAC9B,MAAM,OAAO,EAAE,OAAO,MAAM,KAAK,MAAM,IAAI,CAAC;AAAA,QAClD;AAAA,OACD;AAAA,MACD,QAAQ,SAAS,OAAO,IAAI,CAAC,UAAU,MAAM,IAAI;AAAA,IACnD;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA;AAOF,SAAS,SAAS,CAChB,QACA,OACA,SAC6D;AAAA,EAC7D,MAAM,QAAQ,MAAM,MAAM;AAAA,EAC1B,MAAM,MAAM,eAAc,MAAM,IAAI;AAAA,EACpC,IAAI,OAAO,IAAI,GAAG,GAAG;AAAA,IACnB,MAAM,gBACJ,UAAU,MAAM,oCAAoC,yBAAyB,8CAC/E;AAAA,EACF;AAAA,EAEA,IAAI,CAAC,WAAW,UAAU,WAAW;AAAA,IACnC,MAAM,gBACJ,UAAU,MAAM,sBAAsB,iDAAiD,kBAAkB,SAAS,EAAE,KACtH;AAAA,EACF;AAAA,EACA,IAAI,QAAQ,SAAS,UAAU;AAAA,IAC7B,MAAM,gBACJ,UAAU,MAAM,sBAAsB,uGACxC;AAAA,EACF;AAAA,EAEA,MAAM,SAAS,kBAAiB,OAAO,QAAQ,MAAM;AAAA,EACrD,IAAI,OAAO;AAAA,IAAS,MAAM,gBAAgB,OAAO,OAAO;AAAA,EAExD,MAAM,QAAQ,EAAE,QAAQ,OAAO,QAAQ,IAAI,CAAC,WAAW,OAAO,IAAI,GAAG,MAAM,CAAC,EAAE;AAAA,EAC9E,MAAM,UACJ,oBAAoB,OAAO,OAAO,KAAK,KAAK,qBAAqB,OAAO,OAAO,KAAK;AAAA,EACtF,IAAI;AAAA,IAAS,MAAM,gBAAgB,OAAO;AAAA,EAE1C,OAAO,EAAE,OAAO,OAAO,OAAO,MAAM;AAAA;AAGtC,eAAe,SAAS,CACtB,aACA,QACA,OACA,YACmB;AAAA,EACnB,MAAM,OAAO,eAAc,MAAM,IAAI;AAAA,EACrC,MAAM,OAAO,OAAO,IAAI,IAAI;AAAA,EAC5B,IAAI,CAAC;AAAA,IAAM,MAAM,gBAAgB,UAAU,MAAM,8BAA8B,QAAQ;AAAA,EAEvF,IAAI,KAAK,KAAK,YAAY,iBAAgB,mBAAmB;AAAA,IAC3D,MAAM,gBACJ,IAAI,YAAY,UAAU,KAAK,KAAK,SAAS,yCAAyC,UAAU,iBAAgB,iBAAiB,mGACnI;AAAA,EACF;AAAA,EACA,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,QAAQ,UAAS,MAAM,iBAAiB,aAAa,MAAM,iBAAgB,iBAAiB,CAAC;AAAA,IAC7F,OAAO,OAAO;AAAA,IACd,IAAI,iBAAiB;AAAA,MAAe,MAAM,gBAAgB,IAAI,UAAU,MAAM,SAAS;AAAA,IACvF,MAAM;AAAA;AAAA,EAGR,MAAM,UAAU,oBAAoB,OAAO,KAAK;AAAA,EAChD,IAAI;AAAA,IAAS,MAAM,gBAAgB,OAAO;AAAA,EAE1C,QAAQ,WAAW;AAAA,EACnB,YAAY,QAAQ,WAAW,OAAO,QAAQ,MAAM,OAAO,GAAG;AAAA,IAC5D,MAAM,QAAQ,OAAO,QAAQ,MAAM;AAAA,IACnC,IAAI,OAAO,SAAS,UAAU,OAAO,SAAS,SAAS;AAAA,MAErD,YAAY,UAAU,QAAQ,MAAM,KAAK,QAAQ,GAAG;AAAA,QAClD,MAAM,QAAQ,IAAI,QAAQ,KAAK,KAAK;AAAA,QACpC,IAAI,CAAC,mBAAkB,KAAK;AAAA,UAAG;AAAA,QAC/B,WAAW,KAAK;AAAA,UACd,SAAS;AAAA,UACT,IAAI,OAAO,SAAS,UAAU,UAAU;AAAA,UACxC,IAAI,GAAG,MAAM,QAAQ,aAAa,KAAK,IAAI,WAAW;AAAA,QACxD,CAAC;AAAA,MACH;AAAA,IACF;AAAA,IACA,IAAI,OAAO,SAAS;AAAA,MAClB,oBAAoB,MAAM,OAAO,OAAO,MAAM;AAAA,MAC9C;AAAA,IACF;AAAA,IACA,YAAY,MAAM,OAAO,OAAO,QAAQ,QAAQ,MAAM;AAAA,EACxD;AAAA,EACA,OAAO;AAAA;AAIT,SAAS,mBAAmB,CAAC,MAAc,OAAiB,OAAe,QAAsB;AAAA,EAC/F,YAAY,UAAU,QAAQ,MAAM,KAAK,QAAQ,GAAG;AAAA,IAClD,MAAM,QAAQ,IAAI,UAAU;AAAA,IAC5B,IAAI,MAAM,KAAK,GAAG;AAAA,MAChB,MAAM,gBACJ,IAAI,aAAa,WAAW,cAAc,YAAY,KAAK,UAAU,KAAK,gFAC5E;AAAA,IACF;AAAA,EACF;AAAA;AAQF,SAAS,YAAY,CAAC,OAAsB,OAAoC;AAAA,EAC9E,MAAM,WAAW,qBAAqB,OAAO,KAAK;AAAA,EAClD,IAAI;AAAA,IAAU,MAAM,gBAAgB,QAAQ;AAAA,EAE5C,MAAM,WAAW,yBAAwB,OAAO,KAAK;AAAA,EACrD,OAAO,CAAC,GAAG,SAAS,MAAM,EAAE,IAAI,EAAE,QAAQ,aAAa;AAAA,IACrD,MAAM;AAAA,IACN,MAAM,MAAM;AAAA,IACZ,SAAS,UAAU,MAAM,iBAAiB,uBAAuB,OAAO,WAAW,OAAO,UAAU,IAAI,UAAU,GAAG,OAAO,+BAA+B,OAAO,WAAW;AAAA,EAC/K,EAAE;AAAA;AAGJ,SAAS,WAAW,CAClB,MACA,OACA,OACA,QACA,QACA,QACM;AAAA,EACN,YAAY,UAAU,QAAQ,MAAM,KAAK,QAAQ,GAAG;AAAA,IAClD,MAAM,QAAQ,IAAI,UAAU;AAAA,IAC5B,IAAI,CAAC,MAAM,KAAK,KAAK,mBAAkB,KAAK;AAAA,MAAG;AAAA,IAC/C,MAAM,UAAU,YAAY,OAAO,QAAQ,MAAM;AAAA,IACjD,IAAI,SAAS;AAAA,MACX,MAAM,gBACJ,IAAI,aAAa,WAAW,cAAc,YAAY,KAAK,UAAU,KAAK,KAAK,SACjF;AAAA,IACF;AAAA,EACF;AAAA;AAGF,SAAS,WAAW,CAClB,OACA,QACA,QACoB;AAAA,EACpB,QAAQ,OAAO;AAAA,SACR;AAAA,SACA;AAAA,MACH,OAAO,kBAAiB,KAAK,MAAM,YAC/B,iGACA;AAAA,SACD;AAAA,MACH,OAAO,kBAAiB,KAAK,MAAM,YAC/B,6EACA;AAAA,SACD;AAAA,MACH,OAAO,gBAAe,KAAK,MAAM,YAC7B,mEACA;AAAA,SACD;AAAA,MACH,OAAO,uBAAuB,KAAK,MAAM,KAAK,CAAC,IAC3C,YACA;AAAA,SACD,SAAS;AAAA,MACZ,MAAM,YAAY,OAAM,UAAU,MAAM,KAAK,CAAC;AAAA,MAC9C,OAAO,OAAO,IAAI,SAAS,IACvB,YACA;AAAA,IACN;AAAA,SACK;AAAA,MACH,OAAO,kBAAkB,KAAK,MAAM,KAAK,CAAC,IACtC,YACA;AAAA,SACD;AAAA,SACA;AAAA,MACH;AAAA;AAAA;AAKN,SAAS,YAAY,CAAC,OAAuB;AAAA,EAC3C,IAAI,UAAU;AAAA,EACd,SAAS,OAAO,QAAQ,EAAG,OAAO,GAAG,OAAO,KAAK,OAAO,OAAO,KAAK,EAAE,GAAG;AAAA,IACvE,UAAU,OAAO,aAAa,MAAO,OAAO,KAAK,EAAG,IAAI;AAAA,EAC1D;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,SAAS,CAAC,OAAuB;AAAA,EACxC,QAAQ,SAAS,OAAO,OAAO,QAAQ,CAAC,EAAE,QAAQ,QAAQ,EAAE;AAAA;;;AC1R9D,eAAsB,cAAc,CAClC,aACA,OAKC;AAAA,EACD,MAAM,QAAQ,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,WAAU;AAAA,EAC3D,IAAI,CAAC,OAAO;AAAA,IACV,MAAM,gBACJ,iBAAiB,0DACnB;AAAA,EACF;AAAA,EACA,sBAAsB,OAAO,UAAU;AAAA,EACvC,MAAM,OAAO,MAAM,iBAAiB,aAAa,OAAO,iBAAgB,YAAY;AAAA,EAEpF,MAAM,SAAgD,CAAC;AAAA,EACvD,MAAM,KAAK,MAAM,OAAO,KAAK,IAAI,GAAG,OAAO,MAAM,CAAC;AAAA,EAElD,IAAI,UAAsD;AAAA,EAC1D,MAAM,WAAW,IAAI,aAAa,EAC/B,GAAG,WAAW;AAAA,IACb,OAAO,CAAC,SAAS;AAAA,MACf,MAAM,WAAW,QAAQ,aAAa,OAAO,KAAK,IAAI,MAAM,KAAK;AAAA,MACjE,IAAI,QAAQ,SAAS,OAAO;AAAA,QAAG,OAAO,KAAK,EAAE,OAAO,IAAI,SAAS,MAAM,CAAC;AAAA;AAAA,EAE5E,CAAC,EACA,GAAG,cAAc;AAAA,IAChB,OAAO,CAAC,SAAS;AAAA,MACf,MAAM,QAAQ,OAAO,GAAG,EAAE;AAAA,MAC1B,IAAI,CAAC,SAAS,MAAM;AAAA,QAAS;AAAA,MAC7B,MAAM,UAAU;AAAA,MAChB,UAAU;AAAA,MACV,QAAQ,SAAS,MAAM;AAAA,QACrB,UAAU;AAAA,OACX;AAAA;AAAA,IAEH,IAAI,CAAC,OAAO;AAAA,MACV,IAAI;AAAA,QAAS,QAAQ,SAAS,MAAM;AAAA;AAAA,EAExC,CAAC;AAAA,EACH,QAAQ,YAAY,YAAY,mBAAmB,UAAU,EAAE;AAAA,EAC/D,SAAS,UAAU,IAAI;AAAA,EAEvB,MAAM,UAAU,QAAQ;AAAA,EACxB,IAAI;AAAA,IAAS,MAAM,gBAAgB,OAAO;AAAA,EAC1C,IAAI,OAAO,WAAW,GAAG;AAAA,IACvB,MAAM,gBACJ,GAAG,yEACL;AAAA,EACF;AAAA,EACA,IAAI,OAAO,SAAS,iBAAgB,WAAW;AAAA,IAC7C,MAAM,gBACJ,wBAAwB,iBAAgB,kCAAkC,OAAO,SACnF;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL,OAAO;AAAA,IACP,SAAS;AAAA,MACP,MAAM;AAAA,MACN,QAAQ,OAAO,IAAI,GAAG,YAAY;AAAA,QAChC,MAAM,QAAQ,mBAAmB,KAAK,EAAE,QAAQ,QAAQ,GAAG,EAAE,KAAK;AAAA,QAClE,OAAO,QAAQ,EAAE,OAAO,MAAM,IAAI,CAAC;AAAA,OACpC;AAAA,IACH;AAAA,IACA;AAAA,EACF;AAAA;;;ACIF,IAAM,kBAAkB;AAmBxB,eAAsB,gBAAe,CACnC,SACA,OACA,QAC4B;AAAA,EAC5B,MAAM,WAAW,MAAM,wBAAuB,SAAS,KAAK;AAAA,EAC5D,MAAM,SAAS,MAAM,sBAAqB,SAAS,UAAU,MAAM;AAAA,EACnE,OAAO,KAAK,QAAQ,UAAU,MAAM,yBAAwB,SAAS,UAAU,MAAM,EAAE;AAAA;AASzF,eAAsB,uBAAsB,CAC1C,SACA,OACkC;AAAA,EAClC,MAAM,QAAQ,WAAW,MAAM,KAAK;AAAA,EACpC,MAAM,mBAAmB,QAAQ,aAAa,MAAM,KAAK;AAAA,EACzD,IAAI,MAAM,SAAS;AAAA,IAAQ,MAAM,WAAW,QAAQ,aAAa,MAAM,KAAK;AAAA,EAG5E,MAAM,UAAU,MAAM,qBACpB,QAAQ,aACR,MAAM,MACN,MAAM,OACN,MAAM,UACR;AAAA,EACA,MAAM,YAAY,MAAM,aAAa,QAAQ,aAAa,MAAM,MAAM,MAAM,OAAO,OAAO;AAAA,EAE1F,MAAM,WAAW,MAAM,YAAY,aAAa,MAAM,MAAM;AAAA,EAC5D,MAAM,aAAa,MAAM,kBACvB,iBAAiB,SAAS,EAAE,UAAU,YAAY,MAAM,WAAW,CAAC,GACpE,UAAU,cAAc,CAAC,CAC3B;AAAA,EAEA,OAAO;AAAA,OACD,MAAM,aAAa,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,OACvD,MAAM,gBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;AAAA,IAC5E,MAAM,MAAM;AAAA,IACZ,OAAO,MAAM,SAAS,MAAM;AAAA,IAC5B;AAAA,IACA,UAAU,UAAU,YAAY,CAAC;AAAA,IACjC,SAAS;AAAA,MACP;AAAA,MACA,OAAO,UAAU;AAAA,MACjB,OAAO,MAAM,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,MAAM,MAAM,KAAK,KAAK,EAAE,EAAE;AAAA,MACxE,SAAS,UAAU;AAAA,MACnB;AAAA,MACA,QAAQ,MAAM;AAAA,SACV,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,MAC/C,WAAW,IAAI;AAAA,IACjB;AAAA,EACF;AAAA;AAQF,eAAsB,qBAAoB,CACxC,SACA,UACA,QACmC;AAAA,EACnC,QAAQ,eAAe;AAAA,EACvB,IAAI,CAAC,YAAY;AAAA,IACf,OAAO,eAAe,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,OAAO;AAAA,EAChF;AAAA,EAEA,MAAM,WAAW,MAAM,QAAQ,QAAQ,IAAI,EAAE,WAAW,QAAQ,WAAW,IAAI,WAAW,CAAC;AAAA,EAC3F,IAAI,CAAC;AAAA,IAAU,MAAM,SAAS,UAAU;AAAA,EACxC,gBAAgB,YAAY,MAAM,OAAO,QAAQ,CAAC;AAAA,EAElD,OAAO,eAAe,SAAS,YAAY,QAAQ;AAAA;AAQrD,eAAsB,wBAAuB,CAC3C,SACA,UACA,QACqC;AAAA,EACrC,IAAI,CAAC,SAAS;AAAA,IAAY,OAAO,SAAS;AAAA,EAC1C,IAAI;AAAA,IACF,OAAO;AAAA,MACL,GAAG,SAAS;AAAA,MACZ,GAAI,MAAM,iBACR,iBAAiB,SAAS,QAAQ,GAClC,OAAO,UACP,OAAO,OACT;AAAA,IACF;AAAA,IACA,OAAO,OAAO;AAAA,IACd,QAAQ,KACN,kDAAkD,OAAO,QAAQ,eAAe,OAAO,SAAS,eAChG,KACF;AAAA,IACA,OAAO,SAAS;AAAA;AAAA;AAIpB,SAAS,gBAAgB,CACvB,SACA,OAIA;AAAA,EACA,OAAO;AAAA,IACL,WAAW,QAAQ;AAAA,IACnB,SAAS,QAAQ;AAAA,IACjB,UAAU,MAAM;AAAA,OACZ,MAAM,aAAa,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,EAC7D;AAAA;AAGF,eAAe,YAAY,CACzB,aACA,MACA,OACA,SAMC;AAAA,EACD,QAAQ;AAAA,SACD;AAAA,MACH,OAAO,iBAAiB,aAAa,KAAK;AAAA,SACvC;AAAA,MACH,OAAO,qBAAqB,KAAK;AAAA,SAC9B;AAAA,MACH,OAAO,cAAc,aAAa,OAAO,OAAO;AAAA,SAC7C;AAAA,MACH,OAAO,eAAe,aAAa,KAAK;AAAA,SACrC;AAAA,MACH,OAAO,aAAa,aAAa,KAAK;AAAA,SACnC;AAAA,MACH,OAAO,eAAe,aAAa,KAAK;AAAA;AAAA,MAGxC,MAAM,gBAAgB,IAAI,kCAAkD;AAAA;AAAA;AAIlF,eAAe,UAAU,CACvB,aACA,OACe;AAAA,EACf,MAAM,YAAY,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,oBAAmB;AAAA,EACxE,IAAI,CAAC;AAAA,IAAW;AAAA,EAChB,MAAM,SAAS,oBACb,MAAM,iBAAiB,aAAa,WAAW,iBAAgB,aAAa,CAC9E;AAAA,EACA,IAAI,WAAW;AAAA,IAAQ,MAAM,gBAAgB,OAAO,KAAK;AAAA;AAG3D,SAAS,UAAU,CAAC,OAAuB;AAAA,EACzC,MAAM,QAAQ,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AAAA,EACzD,IAAI,MAAM,WAAW,KAAK,wBAAwB,KAAK,KAAK,GAAG;AAAA,IAC7D,MAAM,gBAAgB,0CAA0C;AAAA,EAClE;AAAA,EACA,IAAI,MAAM,SAAS,iBAAgB,gBAAgB;AAAA,IACjD,MAAM,gBAAgB,0BAA0B,iBAAgB,4BAA4B;AAAA,EAC9F;AAAA,EACA,OAAO;AAAA;AAGT,eAAe,cAAc,CAC3B,SACA,YACA,UACmC;AAAA,EACnC,IAAI;AAAA,IACF,OAAO,MAAM,QAAQ,QAAQ,QAAQ;AAAA,MACnC,WAAW,QAAQ;AAAA,MACnB;AAAA,MACA,MAAM,SAAS;AAAA,MACf,SAAS,SAAS;AAAA,SACd,SAAS,gBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,SAAS,YAAY;AAAA,IACpF,CAAC;AAAA,IACD,OAAO,OAAO;AAAA,IACd,IAAI,iBAAiB,wBAAwB,MAAM,SAAS,sBAAsB;AAAA,MAChF,MAAM,IAAI,sBAAqB,sBAAsB,MAAM,OAAO;AAAA,IACpE;AAAA,IACA,IAAI,iBAAiB,wBAAwB,MAAM,SAAS,0BAA0B;AAAA,MACpF,MAAM,IAAI,sBAAqB,0BAA0B,MAAM,OAAO;AAAA,IACxE;AAAA,IACA,IAAI,iBAAiB,wBAAwB,MAAM,SAAS,kBAAkB;AAAA,MAC5E,MAAM,IAAI,sBAAqB,kBAAkB,MAAM,SAAS,MAAM,MAAM;AAAA,IAC9E;AAAA,IACA,MAAM;AAAA;AAAA;AAIV,SAAS,QAAQ,CAAC,YAA0C;AAAA,EAC1D,OAAO,IAAI,sBACT,sBACA,oBAAoB,4BACtB;AAAA;AAGF,eAAe,cAAc,CAC3B,SACA,MACA,OACA,SACmC;AAAA,EACnC,SAAS,UAAU,IAAK,WAAW,GAAG;AAAA,IACpC,IAAI;AAAA,MACF,OAAO,MAAM,QAAQ,QAAQ,OAAO;AAAA,QAClC,WAAW,QAAQ;AAAA,QACnB,IAAI,iBAAiB;AAAA,QACrB;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,MACD,OAAO,OAAO;AAAA,MACd,MAAM,WAAW,iBAAiB,wBAAwB,MAAM,SAAS;AAAA,MACzE,IAAI,CAAC,YAAY,YAAY;AAAA,QAAiB,MAAM;AAAA;AAAA,EAExD;AAAA;;;ACnKF,IAAM,aAAa,IAAI;AAQvB,SAAS,WAAW,CAAC,WAAsC;AAAA,EACzD,MAAM,YAAY,WAAW,IAAI,SAAS;AAAA,EAC1C,IAAI,CAAC;AAAA,IAAW,MAAM,IAAI,MAAM,kDAAkD;AAAA,EAClF,OAAO;AAAA;AAOF,SAAS,mBAAkB,CAChC,WACA,SACoB;AAAA,EACpB,OAAO,YAAY,SAAS,EAAE,KAAK,OAAO;AAAA;AAIrC,SAAS,qBAAoB,CAAC,WAA4D;AAAA,EAC/F,OAAO,YAAY,SAAS,EAAE;AAAA;AAIzB,SAAS,+BAA+B,CAC7C,SACA,UAAiC,QAAQ,SACrB;AAAA,EACpB,MAAM,YAAY,QAAQ;AAAA,EAC1B,IAAI,CAAC,WAAW;AAAA,IACd,MAAM,IAAI,sBACR,uBACA,mDACF;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,sCAAsC,OAAO;AAAA,EAC/D,MAAM,UAAU,4BAA4B,SAAS,WAAW,QAAQ,MAAM;AAAA,EAE9E,OAAO,yBAAyB;AAAA,IAC9B,SAAS;AAAA,IACT,WAAW,QAAQ;AAAA,IAEnB,QACE,UAAU,SAAS,iBACf,WACA,UAAU,SAAS,cACjB,UAAU,QAAQ,YAClB;AAAA,IACR,SAAS,UAAU,SAAS,eAAe,UAAU,IAAI,YAAY,SAAS;AAAA,IAC9E,cAAc,OAAO,aAAa;AAAA,MAChC,IAAI,MAAM,QAAQ,KAAK,QAAQ;AAAA,QAAG,OAAO;AAAA,MACzC,OAAO,kBAAiB,SAAS,EAAE,MAAM,uBAAuB,CAAC,IAAI,SAAS;AAAA;AAAA,EAElF,CAAC;AAAA;AAGI,SAAS,sBAAsB,CACpC,SACA,aACkB;AAAA,EAClB,MAAM,YAAY,sCAAsC,OAAO;AAAA,EAE/D,MAAM,SACJ,UAAU,SAAS,cACf,UAAU,QAAQ,YAClB,UAAU,SAAS,iBACjB,oBACA;AAAA,EAER,MAAM,iBAAiB,MAAuB;AAAA,IAC5C,MAAM,UAAU,QAAQ,QAAQ;AAAA,IAChC,IAAI,CAAC,SAAS;AAAA,MACZ,MAAM,IAAI,sBACR,uBACA,mDACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA;AAAA,EAET,MAAM,gBAAgB,MAAiB;AAAA,IACrC,IAAI,CAAC,QAAQ;AAAA,MACX,MAAM,IAAI,sBAAqB,eAAe,8CAA8C;AAAA,IAC9F;AAAA,IACA,OAAO;AAAA;AAAA,EAGT,MAAM,OAAO,CAAC,YACZ,gCAAgC,SAAS,OAAO;AAAA,EAClD,MAAM,aAAa,2BAA2B,OAAO;AAAA,EAGrD,MAAM,QAAQ,OACZ,eAC2F;AAAA,IAC3F,MAAM,WAAW,MAAM,eAAe,EAAE,IAAI,EAAE,WAAW,QAAQ,WAAW,IAAI,WAAW,CAAC;AAAA,IAC5F,OAAO,WAAW,EAAE,UAAU,QAAQ,MAAM,KAAK,EAAE,SAAS,QAAQ,EAAE,IAAI;AAAA;AAAA,EAE5E,MAAM,cAAc,OAAO,eAAuD;AAAA,IAChF,MAAM,UAAU,MAAM,MAAM,UAAU;AAAA,IACtC,OAAO,WAAW,QAAQ,WAAW,SAAS,QAAQ,WAAW;AAAA;AAAA,EAInE,MAAM,cAAc,OAAO,YAAoB,WAA8B;AAAA,IAC3E,MAAM,WAAW,MAAM,YAAY,UAAU;AAAA,IAC7C,IAAI,CAAC;AAAA,MAAU,OAAO;AAAA,IAEtB,MAAM,UAAU,MAAM,eAAe,EAAE,WAAW;AAAA,MAChD,WAAW,QAAQ;AAAA,MACnB;AAAA,MACA,SAAS,WAAW,WAAW,SAAS,gBAAgB;AAAA,IAC1D,CAAC;AAAA,IACD,OAAO,UAAU,EAAE,UAAU,QAAQ,IAAI;AAAA;AAAA,EAI3C,MAAM,aAAa,CAAC,WAA+B,OAAO,aACvD,MAAM,OAAO,SAAS,QAAQ,MAAO;AAAA,EAGxC,MAAM,mBAAmB,OAAO,eAAgD;AAAA,IAC9E,MAAM,UAAU,MAAM,MAAM,UAAU;AAAA,IACtC,IAAI,CAAC;AAAA,MAAS,MAAM,UAAS,UAAU;AAAA,IACvC,gBAAgB,YAAY,QAAQ,MAAM;AAAA,IAC1C,OAAO,QAAQ;AAAA;AAAA,EAOjB,MAAM,QAAQ,CAAC,aACb,QAAQ,QAAQ,YAAY,OAAO,OAAO;AAAA,IACxC,MAAM,UAAU,GAAG;AAAA,IACnB,IAAI,CAAC;AAAA,MAAS,MAAM,IAAI,MAAM,gDAAgD;AAAA,IAE9E,OAAO,sBACL,EAAE,WAAW,QAAQ,WAAW,SAAS,YAAY,GACrD,UACA,CAAC,aAAa,KAAK,EAAE,EAAE,cAAc,QAAQ,CAC/C;AAAA,GACD;AAAA,EAMH,MAAM,eAAe,OAAO,UAAkE;AAAA,IAC5F,IAAI,CAAC,MAAM;AAAA,MAAS,OAAO,MAAM;AAAA,IAEjC,MAAM,QAAQ,CAAC,GAAG,MAAM,KAAK;AAAA,IAC7B,YAAY,MAAM,UAAU,OAAO,QAAQ,MAAM,OAAO,GAAG;AAAA,MACzD,MAAM,OAAO,kBAAkB,IAAI;AAAA,MACnC,IAAI,MAAM,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG;AAAA,QAClD,MAAM,gBAAgB,IAAI,iDAAiD;AAAA,MAC7E;AAAA,MAEA,MAAM,OAAO,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,UAAU,KAAK,CAAC,CAAC;AAAA,MACtE,MAAM,OAAO,MAAM,YAAY,IAAI;AAAA,QACjC;AAAA,QACA,mBAAmB,KAAK;AAAA,QACxB,UAAU,GAAG;AAAA,QACb,WAAW;AAAA,MACb,CAAC;AAAA,MACD,MAAM,KAAK,EAAE,MAAM,KAAK,CAAC;AAAA,IAC3B;AAAA,IACA,OAAO;AAAA;AAAA,EAGT,MAAM,YAA8B;AAAA,SAC5B,OAAM,CAAC,OAAO;AAAA,MAClB,MAAM,SAAS,cAAc;AAAA,MAE7B,OAAO,iBACL,EAAE,WAAW,QAAQ,WAAW,SAAS,eAAe,GAAG,YAAY,GACvE;AAAA,QACE,MAAM,MAAM;AAAA,QACZ,OAAO,MAAM;AAAA,QACb,OAAO,MAAM,aAAa,KAAK;AAAA,QAC/B;AAAA,QACA,UAAU,WAAW,KAAK,CAAC;AAAA,QAC3B;AAAA,MACF,GACA,CAAC,aAAa,KAAK,EAAE,cAAc,QAAQ,CAC7C;AAAA;AAAA,SAGI,QAAO,CAAC,YAAY,OAAO;AAAA,MAC/B,MAAM,SAAS,cAAc;AAAA,MAC7B,MAAM,iBAAiB,UAAU;AAAA,MAEjC,MAAM,UAAU,EAAE,WAAW,QAAQ,WAAW,SAAS,eAAe,GAAG,YAAY;AAAA,MACvF,MAAM,WAAW,MAAM,wBAAuB,SAAS;AAAA,QACrD;AAAA,QACA,MAAM,MAAM;AAAA,QACZ,OAAO,MAAM;AAAA,QACb,OAAO,MAAM,aAAa,KAAK;AAAA,WAC3B,MAAM,gBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;AAAA,QAC5E;AAAA,QACA,UAAU,WAAW,KAAK,CAAC;AAAA,QAC3B;AAAA,MACF,CAAC;AAAA,MACD,MAAM,SAAS,MAAM,MAAM,QAAQ;AAAA,MAEnC,OAAO,KAAK,QAAQ,UAAU,MAAM,yBAAwB,SAAS,UAAU,MAAM,EAAE;AAAA;AAAA,SAGnF,OAAM,CAAC,YAAY;AAAA,MACvB,QAAQ,MAAM,MAAM,UAAU,IAAI,UAAU;AAAA;AAAA,IAG9C,KAAK;AAAA,SAEC,KAAI,CAAC,QAAQ,CAAC,GAAG;AAAA,MACrB,IAAI,CAAC;AAAA,QAAQ,OAAO,EAAE,WAAW,CAAC,GAAG,SAAS,OAAO,OAAO,EAAE;AAAA,MAG9D,MAAM,cACJ,MAAM,aAAa,aAAc,MAAM,KAAK,EAAE,aAAa,MAAM,QAAQ,MAAO;AAAA,MAClF,MAAM,cAAc,UAAU,SAAS,eAAe,CAAC,cAAc,SAAS;AAAA,MAE9E,OAAO,eAAe,EAAE,KAAK;AAAA,QAC3B,WAAW,QAAQ;AAAA,WACf,cAAc,EAAE,OAAO,YAAY,IAAI,CAAC;AAAA,WACxC,MAAM,aAAa,YAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;AAAA,WAC/D,MAAM,SAAS,YAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;AAAA,WACnD,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,WACtD,MAAM,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;AAAA,MAC/D,CAAC;AAAA;AAAA,SAGG,WAAU,CAAC,YAAY,SAAS;AAAA,MACpC,QAAQ,MAAM,YAAY,YAAY,OAAO,IAAI,WAAW;AAAA;AAAA,SAGxD,MAAK,CAAC,YAAY,MAAM,UAAU,CAAC,GAAG;AAAA,MAC1C,MAAM,OAAO,MAAM,YAAY,YAAY,QAAQ,WAAW,QAAQ;AAAA,MACtE,IAAI,CAAC;AAAA,QAAM,OAAO;AAAA,MAGlB,QAAQ,UAAU,YAAY;AAAA,MAC9B,MAAM,OACJ,qBAAqB,SAAS,SAAS,IAAI,KAAK,oBAAoB,IAAI,IACpE,QAAQ,MAAM,KAAK,CAAC,cAAc,UAAU,SAAS,kBAAkB,IAAI,CAAC,IAC5E;AAAA,MACN,IAAI,CAAC,MAAM;AAAA,QACT,MAAM,IAAI,sBACR,mBACA,kBAAkB,QAAQ,wBAAwB,6BAA6B,QACjF;AAAA,MACF;AAAA,MAEA,MAAM,OAAO,MAAM,iBAAiB,aAAa,MAAM,iBAAgB,aAAa;AAAA,MACpF,MAAM,SAAS,mBAAmB,KAAK,MAAM,IAAI;AAAA,MACjD,IAAI,WAAW,QAAQ;AAAA,QACrB,MAAM,IAAI,sBAAqB,iBAAiB,UAAU,OAAO,OAAO;AAAA,MAC1E;AAAA,MAEA,OAAO,iBAAiB,SAAS,MAAM,OAAO,KAAK;AAAA;AAAA,SAG/C,aAAY,CAAC,YAAY,QAAQ,CAAC,GAAG;AAAA,MACzC,IAAI,CAAE,MAAM,YAAY,UAAU;AAAA,QAAI,OAAO;AAAA,MAC7C,OAAO,eAAe,EAAE,aAAa,EAAE,WAAW,QAAQ,WAAW,eAAe,MAAM,CAAC;AAAA;AAAA,SAGvF,OAAM,CAAC,YAAY;AAAA,MACvB,KAAK,MAAM,MAAM,UAAU,IAAI,WAAW;AAAA,QAAS,OAAO;AAAA,MAC1D,OAAO,eAAe,EAAE,OAAO,EAAE,WAAW,QAAQ,WAAW,IAAI,WAAW,CAAC;AAAA;AAAA,IAGjF,KAAK,CAAC,YAAY;AAAA,MAEhB,MAAM,QAAQ,YAAY;AAAA,QACxB,MAAM,YAAY,cAAc;AAAA,QAChC,MAAM,iBAAiB,UAAU;AAAA,QACjC,OAAO,EAAE,WAAW,QAAQ,WAAW,YAAY,UAAU;AAAA;AAAA,MAE/D,OAAO;AAAA,aACC,IAAG,CAAC,KAAK;AAAA,UACb,MAAM,QAAQ,MAAM,eAAe,EAAE,SAAS,KAAM,MAAM,MAAM,GAAI,KAAK,SAAS,GAAG,EAAE,CAAC;AAAA,UACxF,OAAO,QAAQ,KAAK,MAAM,MAAM,KAAK,IAAI;AAAA;AAAA,aAErC,IAAG,CAAC,KAAK,OAAO;AAAA,UACpB,MAAM,KAAK,KAAM,MAAM,MAAM,GAAI,KAAK,SAAS,GAAG,EAAE;AAAA,UACpD,MAAM,OAAO,WAAW,KAAK;AAAA,UAC7B,MAAM,YAAY,IAAI;AAAA,UACtB,IAAI;AAAA,YACF,MAAM,eAAe,EAAE,SAAS,KAAK,IAAI,OAAO,MAAM,UAAU,CAAC;AAAA,YACjE,OAAO,OAAO;AAAA,YACd,IAAI,iBAAiB,wBAAwB,MAAM,SAAS,uBAAuB;AAAA,cACjF,MAAM,IAAI,sBAAqB,cAAc,MAAM,OAAO;AAAA,YAC5D;AAAA,YACA,MAAM;AAAA;AAAA,UAGR,OAAO,EAAE,KAAK,GAAG,KAAK,OAAO,KAAK,MAAM,IAAI,GAAG,UAAU;AAAA;AAAA,aAErD,OAAM,CAAC,KAAK;AAAA,UAChB,OAAO,eAAe,EAAE,YAAY,KAAM,MAAM,MAAM,GAAI,KAAK,SAAS,GAAG,EAAE,CAAC;AAAA;AAAA,aAE1E,QAAO,GAAG;AAAA,UACd,MAAM,UAAU,MAAM,eAAe,EAAE,UAAU,MAAM,MAAM,CAAC;AAAA,UAC9D,OAAO,QAAQ,IAAI,CAAC,WAAW;AAAA,YAC7B,KAAK,MAAM;AAAA,YACX,OAAO,KAAK,MAAM,MAAM,KAAK;AAAA,YAC7B,WAAW,MAAM;AAAA,UACnB,EAAE;AAAA;AAAA,aAEE,MAAK,GAAG;AAAA,UACZ,OAAO,eAAe,EAAE,WAAW,MAAM,MAAM,CAAC;AAAA;AAAA,MAEpD;AAAA;AAAA,EAEJ;AAAA,EAEA,WAAW,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAAA,EAC9C,OAAO;AAAA;AAOT,SAAS,QAAQ,CAAC,KAAqB;AAAA,EACrC,IACE,OAAO,QAAQ,YACf,IAAI,WAAW,KACf,IAAI,SAAS,uBAAsB,gBACnC,UAAU,KAAK,GAAG,KAClB,QAAQ,OACR,QAAQ,MACR;AAAA,IACA,MAAM,IAAI,sBACR,iBACA,wBAAwB,uBAAsB,yDAChD;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIT,SAAS,UAAU,CAAC,OAAwB;AAAA,EAC1C,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,OAAO,KAAK,UAAU,KAAK;AAAA,IAC3B,MAAM;AAAA,IACN,OAAO;AAAA;AAAA,EAET,IAAI,SAAS,WAAW;AAAA,IACtB,MAAM,IAAI,sBACR,iBACA,mGACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIT,SAAS,SAAS,CAAC,OAAoC;AAAA,EACrD,IAAI,QAAQ;AAAA,IAAO,OAAO,MAAM;AAAA,EAEhC,OAAO;AAAA,IACL,OAAO,MAAM,MAAM;AAAA,IACnB,QAAQ,MAAM,OAAO,IAAI,CAAC,WAAW,EAAE,YAAY,MAAM,SAAS,IAAI,OAAO,MAAM,MAAM,EAAE;AAAA,EAC7F;AAAA;AAGF,SAAS,SAAQ,CAAC,YAA0C;AAAA,EAC1D,OAAO,IAAI,sBACT,sBACA,oBAAoB,4BACtB;AAAA;",
+  "debugId": "C63B97B0B7216B2664756E2164756E21",
+  "names": []
+}

package/dist/chunk-qx00vjrj.js

@@ -0,0 +1,144 @@
+// @bun
+import {
+  isArtifactAddress2,
+  parseArtifactAddress2
+} from "./chunk-3fqxbn31.js";
+import {
+  isValidFileRef
+} from "./chunk-wkv3h3q7.js";
+import {
+  ARTIFACT_LIMITS2
+} from "./chunk-hz5d43gn.js";
+import {
+  statFileRef2
+} from "./chunk-a3faa34j.js";
+
+// src/artifacts/errors.ts
+class ArtifactRequestError2 extends Error {
+  code;
+  latest;
+  name = "ArtifactRequestError";
+  constructor(code, message, latest) {
+    super(message);
+    this.code = code;
+    this.latest = latest;
+  }
+}
+
+// src/artifacts/html.ts
+var NAMED_ENTITIES = {
+  amp: "&",
+  lt: "<",
+  gt: ">",
+  quot: '"',
+  apos: "'",
+  nbsp: String.fromCharCode(160)
+};
+function decodeHtmlEntities(value) {
+  return value.replace(/&(#x[\da-f]+|#\d+|[a-z]+);/gi, (match, entity) => {
+    if (entity[0] !== "#")
+      return NAMED_ENTITIES[entity.toLowerCase()] ?? match;
+    const codePoint = entity[1]?.toLowerCase() === "x" ? Number.parseInt(entity.slice(2), 16) : Number(entity.slice(1));
+    return Number.isInteger(codePoint) && codePoint >= 0 && codePoint <= 1114111 ? String.fromCodePoint(codePoint) : match;
+  });
+}
+
+// src/artifacts/publish/files.ts
+async function checkArtifactFiles(blobStorage, files) {
+  if (files.length === 0)
+    throw invalidArtifact("A version needs at least one file.");
+  if (files.length > ARTIFACT_LIMITS2.maxFiles) {
+    throw invalidArtifact(`A version holds at most ${ARTIFACT_LIMITS2.maxFiles} files; this one has ${files.length}.`);
+  }
+  const paths = new Set;
+  let totalBytes = 0;
+  for (const entry of files) {
+    if (!isArtifactPath(entry.path)) {
+      throw invalidArtifact(`'${entry.path}' is not a usable file path: use a relative path with / separators, no . or .. segments, and at most ${ARTIFACT_LIMITS2.maxPathLength} characters.`);
+    }
+    if (paths.has(entry.path))
+      throw invalidArtifact(`'${entry.path}' appears twice.`);
+    paths.add(entry.path);
+    if (!isValidFileRef(entry.file)) {
+      throw invalidArtifact(`'${entry.path}' does not have a valid file reference.`);
+    }
+    if (entry.file.sizeBytes > ARTIFACT_LIMITS2.maxFileBytes) {
+      throw invalidArtifact(`'${entry.path}' is ${entry.file.sizeBytes} bytes; a file may be at most ${ARTIFACT_LIMITS2.maxFileBytes}.`);
+    }
+    totalBytes += entry.file.sizeBytes;
+  }
+  if (totalBytes > ARTIFACT_LIMITS2.maxVersionBytes) {
+    throw invalidArtifact(`The files total ${totalBytes} bytes; a version may hold at most ${ARTIFACT_LIMITS2.maxVersionBytes}.`);
+  }
+  const stored = await Promise.all(files.map((entry) => statFileRef2(blobStorage, entry.file)));
+  const missing = files.find((_, index) => !stored[index]);
+  if (missing)
+    throw invalidArtifact(`'${missing.path}' refers to a file that is not stored.`);
+}
+async function readArtifactText(blobStorage, file, maxBytes) {
+  if (file.file.sizeBytes > maxBytes) {
+    throw invalidArtifact(`'${file.path}' is ${file.file.sizeBytes} bytes; it may be at most ${maxBytes}.`);
+  }
+  const text = await new Response(await blobStorage.open(file.file.blobId)).text();
+  return text.charCodeAt(0) === 65279 ? text.slice(1) : text;
+}
+function isArtifactPath(path) {
+  return typeof path === "string" && path.length > 0 && path.length <= ARTIFACT_LIMITS2.maxPathLength && !path.startsWith("/") && !path.includes("\\") && !/[\u0000-\u001f\u007f]/.test(path) && path.split("/").every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
+}
+function invalidArtifact(message) {
+  return new ArtifactRequestError2("invalid_artifact", `[Sixb] ${message}`);
+}
+
+// src/artifacts/publish/validate/html.ts
+var HTML_ENTRY2 = "index.html";
+var FRAME_ASSET_PREFIX = "__sixb/";
+function refuseFrameAssetPaths(files, what) {
+  const reserved = files.find((file) => file.path.startsWith(FRAME_ASSET_PREFIX));
+  if (reserved) {
+    throw invalidArtifact(`'${reserved.path}' is under ${FRAME_ASSET_PREFIX}, where Sixb serves ${what}'s kit and runtime: move it.`);
+  }
+}
+function readHtmlReferences(rewriter, at, file = HTML_ENTRY2) {
+  const references = [];
+  let refused;
+  rewriter.on("a[href]", {
+    element(element) {
+      const href = decodeHtmlEntities(element.getAttribute("href") ?? "");
+      if (isArtifactAddress2(href)) {
+        references.push({ address: href.trim(), as: "link", at: at() });
+      }
+    }
+  }).on("img[src]", {
+    element(element) {
+      const source = decodeHtmlEntities(element.getAttribute("src") ?? "").trim();
+      if (!isArtifactAddress2(source))
+        return;
+      if (!parseArtifactAddress2(source)?.path) {
+        refused ??= `An <img> shows a file from another artifact, and '${source}' names none: show a chart, a range, a section, or a slide with <sixb-embed src="${source}"></sixb-embed>.`;
+        return;
+      }
+      references.push({ address: source, as: "embed", at: at() });
+    }
+  }).on("sixb-embed", {
+    element(element) {
+      const source = decodeHtmlEntities(element.getAttribute("src") ?? "").trim();
+      if (!isArtifactAddress2(source)) {
+        refused ??= `<sixb-embed> shows another artifact: give it src="artifact:\u2026", such as artifact:art_k3m9q2x7tp#chart=revenue.`;
+        return;
+      }
+      references.push({ address: source, as: "embed", at: at() });
+    }
+  }).on("iframe[src], object[data], embed[src]", {
+    element(element) {
+      const source = decodeHtmlEntities(element.getAttribute("src") ?? element.getAttribute("data") ?? "").trim();
+      if (isArtifactAddress2(source)) {
+        refused ??= `${file} frames '${source}': show another artifact with <sixb-embed src="${source}"></sixb-embed>, or a file of one with <img>.`;
+      }
+    }
+  });
+  return { references, refusal: () => refused };
+}
+
+export { ArtifactRequestError2, checkArtifactFiles, readArtifactText, invalidArtifact, decodeHtmlEntities, HTML_ENTRY2, FRAME_ASSET_PREFIX, refuseFrameAssetPaths, readHtmlReferences };
+
+//# debugId=65309FA91A751C6A64756E2164756E21

package/dist/chunk-qx00vjrj.js.map

@@ -0,0 +1,13 @@
+{
+  "version": 3,
+  "sources": ["../src/artifacts/errors.ts", "../src/artifacts/html.ts", "../src/artifacts/publish/files.ts", "../src/artifacts/publish/validate/html.ts"],
+  "sourcesContent": [
+    "import type { ArtifactLatestVersion } from \"../storage/artifacts/errors\"\n\nexport type ArtifactRequestErrorCode =\n  | \"artifact_not_found\"\n  | \"artifact_kind_mismatch\"\n  | \"artifact_moved\"\n  | \"invalid_artifact\"\n  | \"invalid_state\"\n  | \"state_full\"\n  | \"not_allowed\"\n  | \"not_shared\"\n  | \"query_invalid\"\n  | \"query_not_found\"\n  | \"read_only\"\n  | \"storage_unavailable\"\n\n/**\n * Error for an artifact request the caller can correct or must be told about. Callers branch on\n * `code`; the message says what to change.\n */\nexport class ArtifactRequestError extends Error {\n  readonly name = \"ArtifactRequestError\"\n\n  constructor(\n    readonly code: ArtifactRequestErrorCode,\n    message: string,\n    /** With `artifact_moved`: the latest version, which the publish was not based on. */\n    readonly latest?: ArtifactLatestVersion\n  ) {\n    super(message)\n  }\n}\n",
+    "const NAMED_ENTITIES: Readonly<Record<string, string>> = {\n  amp: \"&\",\n  lt: \"<\",\n  gt: \">\",\n  quot: '\"',\n  apos: \"'\",\n  nbsp: String.fromCharCode(0xa0),\n}\n\n/**\n * Text or an attribute as the browser reads it. HTMLRewriter hands both over as written in the\n * HTML, entities included, so `artifact:…#Q3%20&amp;%20Q4` must read `&` before it is resolved.\n */\nexport function decodeHtmlEntities(value: string): string {\n  return value.replace(/&(#x[\\da-f]+|#\\d+|[a-z]+);/gi, (match, entity: string) => {\n    if (entity[0] !== \"#\") return NAMED_ENTITIES[entity.toLowerCase()] ?? match\n    const codePoint =\n      entity[1]?.toLowerCase() === \"x\"\n        ? Number.parseInt(entity.slice(2), 16)\n        : Number(entity.slice(1))\n    return Number.isInteger(codePoint) && codePoint >= 0 && codePoint <= 0x10ffff\n      ? String.fromCodePoint(codePoint)\n      : match\n  })\n}\n",
+    "import { statFileRef } from \"../../blob-storage/file-content\"\nimport type { BlobStorage } from \"../../blob-storage/types\"\nimport { isValidFileRef } from \"../../blob-storage/validation\"\nimport type { ArtifactFile } from \"../../storage/artifacts/types\"\nimport { ArtifactRequestError } from \"../errors\"\nimport { ARTIFACT_LIMITS } from \"../limits\"\n\nexport type ArtifactBlobStorage = Pick<BlobStorage, \"stat\" | \"open\">\n\n/**\n * Checks a version's files before anything reads them: safe unique paths, the per-version limits,\n * and stored bytes that match each reference.\n */\nexport async function checkArtifactFiles(\n  blobStorage: ArtifactBlobStorage,\n  files: readonly ArtifactFile[]\n): Promise<void> {\n  if (files.length === 0) throw invalidArtifact(\"A version needs at least one file.\")\n  if (files.length > ARTIFACT_LIMITS.maxFiles) {\n    throw invalidArtifact(\n      `A version holds at most ${ARTIFACT_LIMITS.maxFiles} files; this one has ${files.length}.`\n    )\n  }\n\n  const paths = new Set<string>()\n  let totalBytes = 0\n  for (const entry of files) {\n    if (!isArtifactPath(entry.path)) {\n      throw invalidArtifact(\n        `'${entry.path}' is not a usable file path: use a relative path with / separators, no . or .. segments, and at most ${ARTIFACT_LIMITS.maxPathLength} characters.`\n      )\n    }\n    if (paths.has(entry.path)) throw invalidArtifact(`'${entry.path}' appears twice.`)\n    paths.add(entry.path)\n    if (!isValidFileRef(entry.file)) {\n      throw invalidArtifact(`'${entry.path}' does not have a valid file reference.`)\n    }\n    if (entry.file.sizeBytes > ARTIFACT_LIMITS.maxFileBytes) {\n      throw invalidArtifact(\n        `'${entry.path}' is ${entry.file.sizeBytes} bytes; a file may be at most ${ARTIFACT_LIMITS.maxFileBytes}.`\n      )\n    }\n    totalBytes += entry.file.sizeBytes\n  }\n  if (totalBytes > ARTIFACT_LIMITS.maxVersionBytes) {\n    throw invalidArtifact(\n      `The files total ${totalBytes} bytes; a version may hold at most ${ARTIFACT_LIMITS.maxVersionBytes}.`\n    )\n  }\n\n  const stored = await Promise.all(files.map((entry) => statFileRef(blobStorage, entry.file)))\n  const missing = files.find((_, index) => !stored[index])\n  if (missing) throw invalidArtifact(`'${missing.path}' refers to a file that is not stored.`)\n}\n\n/** The file at `path`, read as UTF-8 text when it is no larger than `maxBytes`. */\nexport async function readArtifactText(\n  blobStorage: ArtifactBlobStorage,\n  file: ArtifactFile,\n  maxBytes: number\n): Promise<string> {\n  if (file.file.sizeBytes > maxBytes) {\n    throw invalidArtifact(\n      `'${file.path}' is ${file.file.sizeBytes} bytes; it may be at most ${maxBytes}.`\n    )\n  }\n  const text = await new Response(await blobStorage.open(file.file.blobId)).text()\n  // A byte-order mark is not part of the text.\n  return text.charCodeAt(0) === 0xfeff ? text.slice(1) : text\n}\n\n/** Relative, `/`-separated, no empty, `.`, or `..` segment, no backslash or control character. */\nexport function isArtifactPath(path: string): boolean {\n  return (\n    typeof path === \"string\" &&\n    path.length > 0 &&\n    path.length <= ARTIFACT_LIMITS.maxPathLength &&\n    !path.startsWith(\"/\") &&\n    !path.includes(\"\\\\\") &&\n    !/[\\u0000-\\u001f\\u007f]/.test(path) &&\n    path.split(\"/\").every((segment) => segment.length > 0 && segment !== \".\" && segment !== \"..\")\n  )\n}\n\nexport function invalidArtifact(message: string): ArtifactRequestError {\n  return new ArtifactRequestError(\"invalid_artifact\", `[Sixb] ${message}`)\n}\n",
+    "import type { ArtifactFile } from \"../../../storage/artifacts/types\"\nimport { isArtifactAddress, parseArtifactAddress } from \"../../address\"\nimport { decodeHtmlEntities } from \"../../html\"\nimport { invalidArtifact } from \"../files\"\nimport type { FoundReference } from \"../references\"\n\n/** The file a web artifact, a deck or a page, renders from. */\nexport const HTML_ENTRY = \"index.html\"\n\n/** Where the frame serves the kit and the runtime, beside a web artifact's own files. */\nexport const FRAME_ASSET_PREFIX = \"__sixb/\"\n\n/** Refuses a file under `__sixb/`, where the frame serves its own: it would never be served. */\nexport function refuseFrameAssetPaths(files: readonly ArtifactFile[], what: string): void {\n  const reserved = files.find((file) => file.path.startsWith(FRAME_ASSET_PREFIX))\n  if (reserved) {\n    throw invalidArtifact(\n      `'${reserved.path}' is under ${FRAME_ASSET_PREFIX}, where Sixb serves ${what}'s kit and runtime: move it.`\n    )\n  }\n}\n\n/**\n * Reads the `artifact:` addresses a web artifact's HTML uses, to resolve: links (`<a href>`),\n * files it shows from other artifacts (`<img src>`), and anything else it shows (`<sixb-embed\n * src>`), a chart, a range, a section, or a slide, which the app draws over the frame. `at` names\n * where each sits, such as a deck's slide, and `file` the HTML file it reads. The first thing that\n * would not render is the refusal.\n */\nexport function readHtmlReferences(\n  rewriter: HTMLRewriter,\n  at: () => string,\n  file: string = HTML_ENTRY\n): { readonly references: FoundReference[]; readonly refusal: () => string | undefined } {\n  const references: FoundReference[] = []\n  let refused: string | undefined\n  rewriter\n    .on(\"a[href]\", {\n      element(element) {\n        const href = decodeHtmlEntities(element.getAttribute(\"href\") ?? \"\")\n        if (isArtifactAddress(href)) {\n          references.push({ address: href.trim(), as: \"link\", at: at() })\n        }\n      },\n    })\n    .on(\"img[src]\", {\n      element(element) {\n        const source = decodeHtmlEntities(element.getAttribute(\"src\") ?? \"\").trim()\n        if (!isArtifactAddress(source)) return\n        if (!parseArtifactAddress(source)?.path) {\n          refused ??= `An <img> shows a file from another artifact, and '${source}' names none: show a chart, a range, a section, or a slide with <sixb-embed src=\"${source}\"></sixb-embed>.`\n          return\n        }\n        references.push({ address: source, as: \"embed\", at: at() })\n      },\n    })\n    .on(\"sixb-embed\", {\n      element(element) {\n        const source = decodeHtmlEntities(element.getAttribute(\"src\") ?? \"\").trim()\n        if (!isArtifactAddress(source)) {\n          refused ??= `<sixb-embed> shows another artifact: give it src=\"artifact:…\", such as artifact:art_k3m9q2x7tp#chart=revenue.`\n          return\n        }\n        references.push({ address: source, as: \"embed\", at: at() })\n      },\n    })\n    .on(\"iframe[src], object[data], embed[src]\", {\n      element(element) {\n        const source = decodeHtmlEntities(\n          element.getAttribute(\"src\") ?? element.getAttribute(\"data\") ?? \"\"\n        ).trim()\n        if (isArtifactAddress(source)) {\n          refused ??= `${file} frames '${source}': show another artifact with <sixb-embed src=\"${source}\"></sixb-embed>, or a file of one with <img>.`\n        }\n      },\n    })\n  return { references, refusal: () => refused }\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;AAoBO,MAAM,8BAA6B,MAAM;AAAA,EAInC;AAAA,EAGA;AAAA,EANF,OAAO;AAAA,EAEhB,WAAW,CACA,MACT,SAES,QACT;AAAA,IACA,MAAM,OAAO;AAAA,IALJ;AAAA,IAGA;AAAA;AAIb;;;AC/BA,IAAM,iBAAmD;AAAA,EACvD,KAAK;AAAA,EACL,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,MAAM;AAAA,EACN,MAAM;AAAA,EACN,MAAM,OAAO,aAAa,GAAI;AAChC;AAMO,SAAS,kBAAkB,CAAC,OAAuB;AAAA,EACxD,OAAO,MAAM,QAAQ,gCAAgC,CAAC,OAAO,WAAmB;AAAA,IAC9E,IAAI,OAAO,OAAO;AAAA,MAAK,OAAO,eAAe,OAAO,YAAY,MAAM;AAAA,IACtE,MAAM,YACJ,OAAO,IAAI,YAAY,MAAM,MACzB,OAAO,SAAS,OAAO,MAAM,CAAC,GAAG,EAAE,IACnC,OAAO,OAAO,MAAM,CAAC,CAAC;AAAA,IAC5B,OAAO,OAAO,UAAU,SAAS,KAAK,aAAa,KAAK,aAAa,UACjE,OAAO,cAAc,SAAS,IAC9B;AAAA,GACL;AAAA;;;ACVH,eAAsB,kBAAkB,CACtC,aACA,OACe;AAAA,EACf,IAAI,MAAM,WAAW;AAAA,IAAG,MAAM,gBAAgB,oCAAoC;AAAA,EAClF,IAAI,MAAM,SAAS,iBAAgB,UAAU;AAAA,IAC3C,MAAM,gBACJ,2BAA2B,iBAAgB,gCAAgC,MAAM,SACnF;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,IAAI;AAAA,EAClB,IAAI,aAAa;AAAA,EACjB,WAAW,SAAS,OAAO;AAAA,IACzB,IAAI,CAAC,eAAe,MAAM,IAAI,GAAG;AAAA,MAC/B,MAAM,gBACJ,IAAI,MAAM,4GAA4G,iBAAgB,2BACxI;AAAA,IACF;AAAA,IACA,IAAI,MAAM,IAAI,MAAM,IAAI;AAAA,MAAG,MAAM,gBAAgB,IAAI,MAAM,sBAAsB;AAAA,IACjF,MAAM,IAAI,MAAM,IAAI;AAAA,IACpB,IAAI,CAAC,eAAe,MAAM,IAAI,GAAG;AAAA,MAC/B,MAAM,gBAAgB,IAAI,MAAM,6CAA6C;AAAA,IAC/E;AAAA,IACA,IAAI,MAAM,KAAK,YAAY,iBAAgB,cAAc;AAAA,MACvD,MAAM,gBACJ,IAAI,MAAM,YAAY,MAAM,KAAK,0CAA0C,iBAAgB,eAC7F;AAAA,IACF;AAAA,IACA,cAAc,MAAM,KAAK;AAAA,EAC3B;AAAA,EACA,IAAI,aAAa,iBAAgB,iBAAiB;AAAA,IAChD,MAAM,gBACJ,mBAAmB,gDAAgD,iBAAgB,kBACrF;AAAA,EACF;AAAA,EAEA,MAAM,SAAS,MAAM,QAAQ,IAAI,MAAM,IAAI,CAAC,UAAU,aAAY,aAAa,MAAM,IAAI,CAAC,CAAC;AAAA,EAC3F,MAAM,UAAU,MAAM,KAAK,CAAC,GAAG,UAAU,CAAC,OAAO,MAAM;AAAA,EACvD,IAAI;AAAA,IAAS,MAAM,gBAAgB,IAAI,QAAQ,4CAA4C;AAAA;AAI7F,eAAsB,gBAAgB,CACpC,aACA,MACA,UACiB;AAAA,EACjB,IAAI,KAAK,KAAK,YAAY,UAAU;AAAA,IAClC,MAAM,gBACJ,IAAI,KAAK,YAAY,KAAK,KAAK,sCAAsC,WACvE;AAAA,EACF;AAAA,EACA,MAAM,OAAO,MAAM,IAAI,SAAS,MAAM,YAAY,KAAK,KAAK,KAAK,MAAM,CAAC,EAAE,KAAK;AAAA,EAE/E,OAAO,KAAK,WAAW,CAAC,MAAM,QAAS,KAAK,MAAM,CAAC,IAAI;AAAA;AAIlD,SAAS,cAAc,CAAC,MAAuB;AAAA,EACpD,OACE,OAAO,SAAS,YAChB,KAAK,SAAS,KACd,KAAK,UAAU,iBAAgB,iBAC/B,CAAC,KAAK,WAAW,GAAG,KACpB,CAAC,KAAK,SAAS,IAAI,KACnB,CAAC,wBAAwB,KAAK,IAAI,KAClC,KAAK,MAAM,GAAG,EAAE,MAAM,CAAC,YAAY,QAAQ,SAAS,KAAK,YAAY,OAAO,YAAY,IAAI;AAAA;AAIzF,SAAS,eAAe,CAAC,SAAuC;AAAA,EACrE,OAAO,IAAI,sBAAqB,oBAAoB,UAAU,SAAS;AAAA;;;AC9ElE,IAAM,cAAa;AAGnB,IAAM,qBAAqB;AAG3B,SAAS,qBAAqB,CAAC,OAAgC,MAAoB;AAAA,EACxF,MAAM,WAAW,MAAM,KAAK,CAAC,SAAS,KAAK,KAAK,WAAW,kBAAkB,CAAC;AAAA,EAC9E,IAAI,UAAU;AAAA,IACZ,MAAM,gBACJ,IAAI,SAAS,kBAAkB,yCAAyC,kCAC1E;AAAA,EACF;AAAA;AAUK,SAAS,kBAAkB,CAChC,UACA,IACA,OAAe,aACwE;AAAA,EACvF,MAAM,aAA+B,CAAC;AAAA,EACtC,IAAI;AAAA,EACJ,SACG,GAAG,WAAW;AAAA,IACb,OAAO,CAAC,SAAS;AAAA,MACf,MAAM,OAAO,mBAAmB,QAAQ,aAAa,MAAM,KAAK,EAAE;AAAA,MAClE,IAAI,mBAAkB,IAAI,GAAG;AAAA,QAC3B,WAAW,KAAK,EAAE,SAAS,KAAK,KAAK,GAAG,IAAI,QAAQ,IAAI,GAAG,EAAE,CAAC;AAAA,MAChE;AAAA;AAAA,EAEJ,CAAC,EACA,GAAG,YAAY;AAAA,IACd,OAAO,CAAC,SAAS;AAAA,MACf,MAAM,SAAS,mBAAmB,QAAQ,aAAa,KAAK,KAAK,EAAE,EAAE,KAAK;AAAA,MAC1E,IAAI,CAAC,mBAAkB,MAAM;AAAA,QAAG;AAAA,MAChC,IAAI,CAAC,sBAAqB,MAAM,GAAG,MAAM;AAAA,QACvC,YAAY,qDAAqD,0FAA0F;AAAA,QAC3J;AAAA,MACF;AAAA,MACA,WAAW,KAAK,EAAE,SAAS,QAAQ,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;AAAA;AAAA,EAE9D,CAAC,EACA,GAAG,cAAc;AAAA,IAChB,OAAO,CAAC,SAAS;AAAA,MACf,MAAM,SAAS,mBAAmB,QAAQ,aAAa,KAAK,KAAK,EAAE,EAAE,KAAK;AAAA,MAC1E,IAAI,CAAC,mBAAkB,MAAM,GAAG;AAAA,QAC9B,YAAY;AAAA,QACZ;AAAA,MACF;AAAA,MACA,WAAW,KAAK,EAAE,SAAS,QAAQ,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;AAAA;AAAA,EAE9D,CAAC,EACA,GAAG,yCAAyC;AAAA,IAC3C,OAAO,CAAC,SAAS;AAAA,MACf,MAAM,SAAS,mBACb,QAAQ,aAAa,KAAK,KAAK,QAAQ,aAAa,MAAM,KAAK,EACjE,EAAE,KAAK;AAAA,MACP,IAAI,mBAAkB,MAAM,GAAG;AAAA,QAC7B,YAAY,GAAG,gBAAgB,wDAAwD;AAAA,MACzF;AAAA;AAAA,EAEJ,CAAC;AAAA,EACH,OAAO,EAAE,YAAY,SAAS,MAAM,QAAQ;AAAA;",
+  "debugId": "65309FA91A751C6A64756E2164756E21",
+  "names": []
+}