@zackbart/connecta 0.28.1 → 0.30.0

package/dist/artifacts/document.js

@@ -1,86 +0,0 @@
-// The one document a page becomes: its source (or rendered Markdown) with the
-// read-only `window.artifact` global injected, and the CSP it runs under.
-//
-// Built server-side, so a render check and the viewer see byte-for-byte the
-// same page. The global goes in right after the doctype token — found by the
-// tokenizer, never by a regex — so injecting it can never knock a page into
-// quirks mode, and it runs before any script the author wrote.
-import { scanHtml } from "./html-scan.js";
-import { scriptSafeJson } from "./json.js";
-import { markdownPage, MarkdownNestingError } from "./markdown.js";
-/**
- * Reserve for the injected global and Markdown theme beyond source and data.
- * Sixteen 64-character document names appear twice, alongside timestamps and
- * versions, and a 160-character title can expand sixfold when script-escaped.
- */
-export const FRAME_OVERHEAD_BYTES = 8192;
-/**
- * The frame's Content-Security-Policy. `sandbox allow-scripts` without
- * `allow-same-origin` gives the page an opaque origin — no cookies, no
- * storage, nothing of the deployment's — and `connect-src 'none'` with every
- * other fetch directive shut leaves it no network beyond the allowlisted
- * script, style, and font origins. No `'unsafe-eval'`.
- */
-export function frameCsp(allowlist) {
-    const sources = (list) => (list.length ? ` ${list.join(" ")}` : "");
-    return [
-        "sandbox allow-scripts",
-        "default-src 'none'",
-        `script-src 'unsafe-inline'${sources(allowlist.scripts)}`,
-        `style-src 'unsafe-inline'${sources(allowlist.styles)}`,
-        `font-src data:${sources(allowlist.fonts)}`,
-        "img-src data: blob:",
-        "media-src data: blob:",
-        "connect-src 'none'",
-        "frame-src 'none'",
-        "worker-src 'none'",
-        "manifest-src 'none'",
-        "object-src 'none'",
-        "base-uri 'none'",
-        "form-action 'none'",
-        "frame-ancestors 'self'",
-    ].join("; ");
-}
-// Deep-frozen and non-configurable: the page reads its data and cannot
-// replace it for a script that runs later.
-const DEFINE_GLOBAL = '(()=>{const f=(o)=>{if(o!==null&&typeof o==="object"){for(const k of Object.keys(o))f(o[k]);Object.freeze(o)}return o};' +
-    'Object.defineProperty(window,"artifact",{value:f(%VALUE%),writable:false,configurable:false,enumerable:false})})()';
-/**
- * The complete document a viewer or render check loads. `data` maps document
- * names to their stored, script-safe JSON text, which is spliced in as-is.
- *
- * `theme` reaches a Markdown page only, whose styling is connecta's own. An
- * HTML page is the author's, down to its colors, and is never restyled; the
- * frame around it is what follows the deployment's scheme.
- */
-export function buildFrameDocument(input) {
-    let page = input.source;
-    if (input.kind === "markdown") {
-        try {
-            page = markdownPage(input.source, input.global.title, input.theme);
-        }
-        catch (error) {
-            if (!(error instanceof MarkdownNestingError))
-                throw error;
-            // Old or externally populated stores may hold a page that today's
-            // validator would reject. Render fixed text instead of throwing here.
-            page = markdownPage("This page has too many nested block quotes or lists to display.", input.global.title, input.theme);
-        }
-    }
-    const meta = scriptSafeJson(input.global);
-    const data = Object.entries(input.data)
-        .map(([name, text]) => `${JSON.stringify(name)}:${text}`)
-        .join(",");
-    const value = `${meta.slice(0, -1)},"data":{${data}}}`;
-    const script = `<script>${DEFINE_GLOBAL.replace("%VALUE%", () => value)}</script>`;
-    let at = 0;
-    for (const token of scanHtml(page)) {
-        if (token.type === "doctype") {
-            at = token.end;
-            break;
-        }
-        if (token.type === "start")
-            break;
-    }
-    return `${page.slice(0, at)}${script}${page.slice(at)}`;
-}

package/dist/artifacts/guide.js

@@ -1,140 +0,0 @@
-// The artifacts connector's usage guide: what an agent must know before its
-// first write. Built once at construction with this deployment's allowlist
-// and limits, so the numbers and origins it states are the ones enforced.
-export const GUIDE_SUMMARY = "Publish team pages: validate first, keep data in documents, patch small edits, pass baseVersion, share the url.";
-const size = (bytes) => bytes % (1024 * 1024) === 0
-    ? `${bytes / (1024 * 1024)} MiB`
-    : bytes % 1024 === 0
-        ? `${bytes / 1024} KiB`
-        : `${bytes.toLocaleString("en-US")} bytes`;
-export function buildGuide(options) {
-    const { allowlist, limits } = options;
-    const origins = (list) => list.length ? list.map((origin) => `\`${origin}\``).join(", ") : "none";
-    return `# Artifacts
-
-Artifacts are team pages that outlive a chat: dashboards, reports, plans. A page
-is self-contained HTML or Markdown; the numbers it shows live in named JSON
-**documents** that the page reads from a read-only global. Every write makes a
-new immutable version, attributed to you, and any version can be rolled back.
-Only people who can read this connector can open a page.
-
-## Writing a page
-
-- **HTML** (\`kind: "html"\`): a complete document starting \`<!doctype html>\`,
-  with exactly one element \`id="artifact-root"\` (usually
-  \`<main id="artifact-root">\`) holding the content.
-- **Markdown** (\`kind: "markdown"\`): headings, lists, tables, code, links, and
-  \`data:\` images. Raw HTML shows as text. Markdown pages cannot read data.
-- **Data**: a script reads \`window.artifact.data.<name>\` — each document by
-  name, already parsed and frozen. \`window.artifact\` also has \`id\`, \`title\`,
-  \`view.version\`, \`documents.<name>.{version, updatedAt}\`, and \`snapshot\`.
-  Document names are identifiers: letters, digits, \`_\`.
-- **Keep data out of the HTML.** Put every figure in a document and render it
-  from script; then fixing a number is \`set_documents\`, not a page rewrite,
-  and a refresh can replace the data without touching the view.
-
-Pages run sandboxed in their own origin, so some things cannot work there:
-
-- **No network.** \`fetch\`, XHR, WebSocket, and beacons fail. Read
-  \`window.artifact.data\` instead.
-- **External scripts** load only from ${origins(allowlist.scripts)}. None are
-  allowed by default; an operator must opt in to each trusted origin. A script
-  can read this page's data. When allowed, use https and pin an exact version
-  (\`https://cdn.jsdelivr.net/npm/chart.js@4.4.1/dist/chart.umd.min.js\`).
-  Libraries that need \`eval\` or \`new Function\` do not run. Inline
-  \`<script>\` is fine.
-- **External stylesheets** load only from ${origins(allowlist.styles)}; fonts
-  from ${origins(allowlist.fonts)} or \`data:\`. Both origin lists default to
-  empty. Trusted script, style, and font origins may receive page data in
-  request URLs. Inline \`<style>\` is fine.
-- **Images** are \`data:\` URLs or inline SVG. Nothing relative: a page has no
-  files beside it.
-- No \`<iframe>\`, \`<form>\`, \`<object>\`, \`<embed>\`, \`<base>\`, or
-  \`<meta http-equiv>\`. A link navigates the page's own frame and cannot open a
-  new window, so show URLs as text when readers need them elsewhere.
-
-## Tools
-
-Reads run anywhere, including inside \`execute_code\`:
-
-- \`list_artifacts { query?, includeArchived?, limit?, cursor? }\` — check for an
-  existing page before creating one.
-- \`get_artifact { id, version?, includeSource? }\` — the view, its history, its
-  documents' versions, \`revision\`, \`url\`, and \`snapshotUrl\`.
-- \`get_document { id, name, version? }\` — one document's value and history.
-- \`get_refresh { id }\` — the configured program, schedule, freshness, and the
-  latest 20 run records. Logs and failure messages are for agents, not readers.
-- \`validate_artifact { kind, source, documents? }\` — every check a save runs${options.renderCheck ? ", including this deployment's render check," : ""} without saving. **Validate before you save**; each error names a line and
-  the fix.
-
-Writes make new versions and never ask for approval inside \`execute_code\`
-(unless this deployment turned that off); each one spends the program's write
-budget. At the top level, \`call_tool\` refuses them — use
-\`call_destructive_tool\`.
-
-- \`create_artifact { id, title, kind, source, documents? }\` — \`id\` is the
-  page's URL slug (lowercase letters, digits, hyphens). \`documents\` maps each
-  name straight to its value, \`{ "data": { "rows": [...] } }\`; supply
-  everything the first render needs in the same call.
-- \`patch_artifact { id, baseVersion, edits: [{ find, replace }] }\` — **prefer
-  this for small edits** such as a title or a label. Each \`find\` must occur
-  exactly once in the current source (include surrounding text if it would
-  match twice); every edit applies at once, and if any fails nothing changes.
-- \`update_artifact { id, baseVersion, source, title? }\` — replace the whole
-  source.
-- \`set_documents { id, documents: { <name>: { baseVersion, value } } }\` — set
-  several documents atomically; \`baseVersion: 0\` creates one, \`value: null\`
-  removes one.
-- \`set_refresh { id, document, program, schedule, baseVersion }\` — version a
-  complete \`execute_code\` async-arrow program returning the document's JSON
-  value. \`schedule\` is \`manual\`, \`daily\`, or \`weekly\`; use \`baseVersion: 0\`
-  for the first program, then the version from \`get_refresh\`. It can call
-  only explicitly read-only tools on shared connectors. Personal connectors
-  and writes fail the run even if the program catches the refusal. A failed
-  run keeps the last good document and marks the page stale. Each run rechecks
-  your current connector grants and pool access; removing permission to
-  configure refresh also stops your scheduled program.
-- \`run_refresh { id }\` — trigger one run now through
-  \`call_destructive_tool\`. It cannot run inside \`execute_code\` because that
-  would hold an executor permit while asking for another.
-- \`rollback_artifact { id, target: "view" | "document", name?, version, baseVersion }\`
-  — a new version with an old body; history is never rewritten.
-- \`archive_artifact\` / \`restore_artifact { id, baseRevision }\` — hide a page
-  from the library, or bring it back. Archived pages refuse writes.
-
-## Versions and conflicts
-
-Every write names what it expects to replace: \`baseVersion\` is the current
-view version (or the document's version), \`baseRevision\` the artifact's
-revision, all from \`get_artifact\`/\`get_document\`. If someone changed it
-first, the write fails with code \`conflict\` and nothing is saved; the error's
-\`current\` (\`err.details.current\` in a program) says where things stand.
-Re-read, reapply your change, and retry with the new base. Never retry the
-same call unchanged.
-
-## Sharing
-
-\`url\` is the page as it is now; share that. \`snapshotUrl\` pins the view and
-every document to their current versions, for "as of" links. Both are for the
-team only.
-
-## Limits
-
-| What | Limit |
-| --- | --- |
-| Page source | ${size(limits.sourceBytes)} |
-| One document, serialized | ${size(limits.documentBytes)} |
-| Documents per artifact | ${limits.documents} |
-| Distinct document names over its lifetime | 64 (removed names keep their versions) |
-| All documents together | ${size(limits.totalDocumentBytes)} |
-| Page plus documents | ${size(limits.renderedBytes)} |
-| Title | ${limits.titleChars} characters |
-| Edits per patch | ${limits.patchEdits}, each \`find\` up to ${size(limits.findBytes)} |
-| Document nesting | ${limits.jsonDepth} levels; numbers finite; no \`__proto__\` keys |
-
-A program's host call returns at most 256 KiB on some executors: read a large
-source with \`includeSource: false\` inside a program, or with \`call_tool\`.
-Versions are kept forever, and a body written by a write that lost a conflict
-stays stored unreferenced.
-`;
-}

package/dist/artifacts/html-scan.js

@@ -1,329 +0,0 @@
-// A small HTML tokenizer: exactly the HTML5 tokenizer states validation and
-// the viewer need, and none of tree construction.
-//
-// It is a lint's tokenizer, not a sanitizer's. The viewer's CSP and sandbox are
-// the security boundary; this finds the tags, attributes, and raw text a page
-// author most plausibly got wrong, with a line and column for each, so an
-// agent can fix a page from the message alone. Where it approximates the
-// standard — foreign content, the rarer script escapes — the failure mode is a
-// finding that is missing or extra, never a page that escapes its frame.
-const RAW_TEXT = new Set([
-    "script",
-    "style",
-    "xmp",
-    "iframe",
-    "noembed",
-    "noframes",
-    "noscript",
-    "title",
-    "textarea",
-]);
-const isSpace = (c) => c === " " || c === "\t" || c === "\n" || c === "\f" || c === "\r";
-const isAlpha = (c) => c !== undefined && ((c >= "a" && c <= "z") || (c >= "A" && c <= "Z"));
-const NAMED = {
-    amp: "&",
-    lt: "<",
-    gt: ">",
-    quot: '"',
-    apos: "'",
-    nbsp: " ",
-    Tab: "\t",
-    NewLine: "\n",
-    colon: ":",
-    sol: "/",
-    lpar: "(",
-    rpar: ")",
-    period: ".",
-    comma: ",",
-};
-/**
- * Decode the character references a URL check has to see through: numeric
- * ones, and the named ones that spell a scheme (`&colon;`, `&Tab;`, …).
- */
-export function decodeEntities(value) {
-    if (!value.includes("&"))
-        return value;
-    return value.replace(/&(?:#(\d{1,8})|#[xX]([0-9a-fA-F]{1,7})|([A-Za-z]+));?/g, (match, dec, hex, name) => {
-        if (name !== undefined)
-            return NAMED[name] ?? match;
-        const code = dec !== undefined ? Number(dec) : Number.parseInt(hex ?? "", 16);
-        if (!Number.isFinite(code) || code === 0 || code > 0x10ffff)
-            return "�";
-        if (code >= 0xd800 && code <= 0xdfff)
-            return "�";
-        return String.fromCodePoint(code);
-    });
-}
-/** Tokenize `source`. Never throws; malformed markup tokenizes the way a browser would, approximately. */
-export function scanHtml(source) {
-    const tokens = [];
-    // ASCII-only lowercasing keeps every offset valid; `toLowerCase` can change
-    // a string's length.
-    const lower = source.replace(/[A-Z]+/g, (run) => run.toLowerCase());
-    const n = source.length;
-    let i = 0;
-    let textStart = 0;
-    const flush = (end) => {
-        if (end > textStart)
-            tokens.push({ type: "text", start: textStart, end });
-    };
-    const until = (from, needle) => {
-        const at = source.indexOf(needle, from);
-        return at < 0 ? n : at + needle.length;
-    };
-    while (i < n) {
-        if (source[i] !== "<") {
-            i++;
-            continue;
-        }
-        const next = source[i + 1];
-        if (next === "!") {
-            flush(i);
-            const start = i;
-            if (source.startsWith("<!--", i)) {
-                if (source.startsWith("<!-->", i))
-                    i += 5;
-                else if (source.startsWith("<!--->", i))
-                    i += 6;
-                else
-                    i = until(i + 4, "-->");
-                tokens.push({ type: "comment", start, end: i });
-            }
-            else if (source.slice(i + 2, i + 9).toLowerCase() === "doctype") {
-                i = until(i, ">");
-                tokens.push({ type: "doctype", start, end: i });
-            }
-            else if (source.startsWith("<![CDATA[", i)) {
-                i = until(i + 9, "]]>");
-                tokens.push({ type: "comment", start, end: i });
-            }
-            else {
-                i = until(i, ">");
-                tokens.push({ type: "comment", start, end: i });
-            }
-            textStart = i;
-            continue;
-        }
-        if (next === "?") {
-            flush(i);
-            const start = i;
-            i = until(i, ">");
-            tokens.push({ type: "comment", start, end: i });
-            textStart = i;
-            continue;
-        }
-        if (next === "/") {
-            const after = source[i + 2];
-            if (after === ">") {
-                // `</>` is dropped entirely.
-                flush(i);
-                i += 3;
-                textStart = i;
-                continue;
-            }
-            if (!isAlpha(after)) {
-                flush(i);
-                const start = i;
-                i = until(i, ">");
-                tokens.push({ type: "comment", start, end: i });
-                textStart = i;
-                continue;
-            }
-            const tag = readTag(source, i + 2);
-            if (!tag) {
-                // End of input inside a tag: the tag is never emitted.
-                flush(i);
-                i = n;
-                textStart = n;
-                break;
-            }
-            flush(i);
-            tokens.push({ type: "end", name: tag.name, start: i, end: tag.end });
-            i = tag.end;
-            textStart = i;
-            continue;
-        }
-        if (!isAlpha(next)) {
-            i++;
-            continue;
-        }
-        const tag = readTag(source, i + 1);
-        if (!tag) {
-            flush(i);
-            i = n;
-            textStart = n;
-            break;
-        }
-        flush(i);
-        tokens.push({
-            type: "start",
-            name: tag.name,
-            attrs: tag.attrs,
-            selfClosing: tag.selfClosing,
-            start: i,
-            end: tag.end,
-        });
-        i = tag.end;
-        textStart = i;
-        if (tag.name === "plaintext") {
-            if (n > i)
-                tokens.push({ type: "text", start: i, end: n, rawOf: "plaintext" });
-            i = n;
-            textStart = n;
-            break;
-        }
-        if (RAW_TEXT.has(tag.name)) {
-            const close = tag.name === "script"
-                ? scriptEnd(source, lower, i)
-                : rawTextEnd(source, lower, i, tag.name);
-            if (close > i) {
-                tokens.push({ type: "text", start: i, end: close, rawOf: tag.name });
-            }
-            i = close;
-            textStart = i;
-        }
-    }
-    flush(n);
-    return tokens;
-}
-/** Where `</name` followed by whitespace, `/`, or `>` starts, from `from`; the end of input when absent. */
-function rawTextEnd(source, lower, from, name) {
-    let at = from;
-    for (;;) {
-        at = lower.indexOf(`</${name}`, at);
-        if (at < 0)
-            return source.length;
-        const c = source[at + 2 + name.length];
-        if (c === undefined || c === "/" || c === ">" || isSpace(c))
-            return at;
-        at += 2;
-    }
-}
-/**
- * Script data, with its escaped and double-escaped states: inside `<!--`, a
- * `<script` means the next `</script>` does not end the element.
- */
-function scriptEnd(source, lower, from) {
-    const tagAt = (at, prefix) => {
-        if (!lower.startsWith(prefix, at))
-            return false;
-        const c = source[at + prefix.length];
-        return c === undefined || c === "/" || c === ">" || isSpace(c);
-    };
-    let state = "data";
-    for (let i = from; i < source.length; i++) {
-        if (state === "data") {
-            if (tagAt(i, "</script"))
-                return i;
-            if (lower.startsWith("<!--", i)) {
-                state = "escaped";
-                i += 3;
-            }
-        }
-        else if (state === "escaped") {
-            if (tagAt(i, "</script"))
-                return i;
-            if (lower.startsWith("-->", i)) {
-                state = "data";
-                i += 2;
-            }
-            else if (tagAt(i, "<script")) {
-                state = "double";
-                i += 6;
-            }
-        }
-        else {
-            if (tagAt(i, "</script")) {
-                state = "escaped";
-                i += 7;
-            }
-            else if (lower.startsWith("-->", i)) {
-                state = "data";
-                i += 2;
-            }
-        }
-    }
-    return source.length;
-}
-/** Read a tag name and its attributes, from just after `<` or `</`. Null at end of input. */
-function readTag(source, from) {
-    const n = source.length;
-    let i = from;
-    while (i < n && !isSpace(source[i]) && source[i] !== "/" && source[i] !== ">")
-        i++;
-    const name = source.slice(from, i).toLowerCase();
-    const attrs = [];
-    const seen = new Set();
-    let selfClosing = false;
-    for (;;) {
-        while (i < n && (isSpace(source[i]) || (source[i] === "/" && source[i + 1] !== ">")))
-            i++;
-        if (i >= n)
-            return null;
-        if (source[i] === ">")
-            return { name, attrs, selfClosing, end: i + 1 };
-        if (source[i] === "/") {
-            // "/>"
-            selfClosing = true;
-            return { name, attrs, selfClosing, end: i + 2 };
-        }
-        const nameStart = i;
-        // A leading "=" belongs to the name.
-        i++;
-        while (i < n &&
-            !isSpace(source[i]) &&
-            source[i] !== "/" &&
-            source[i] !== ">" &&
-            source[i] !== "=")
-            i++;
-        const attrName = source.slice(nameStart, i).toLowerCase();
-        let value = "";
-        let j = i;
-        while (j < n && isSpace(source[j]))
-            j++;
-        if (source[j] === "=") {
-            i = j + 1;
-            while (i < n && isSpace(source[i]))
-                i++;
-            const quote = source[i];
-            if (quote === '"' || quote === "'") {
-                const close = source.indexOf(quote, i + 1);
-                if (close < 0)
-                    return null;
-                value = source.slice(i + 1, close);
-                i = close + 1;
-            }
-            else {
-                const valueStart = i;
-                while (i < n && !isSpace(source[i]) && source[i] !== ">")
-                    i++;
-                value = source.slice(valueStart, i);
-            }
-        }
-        // A repeated attribute is dropped; the first one wins.
-        if (!seen.has(attrName)) {
-            seen.add(attrName);
-            attrs.push({ name: attrName, value: decodeEntities(value), offset: nameStart });
-        }
-    }
-}
-/** Map a source offset to a 1-based line and column. */
-export function lineLocator(source) {
-    const starts = [0];
-    for (let i = 0; i < source.length; i++) {
-        if (source[i] === "\n")
-            starts.push(i + 1);
-    }
-    return (offset) => {
-        let lo = 0;
-        let hi = starts.length - 1;
-        while (lo < hi) {
-            const mid = (lo + hi + 1) >> 1;
-            if ((starts[mid] ?? 0) <= offset)
-                lo = mid;
-            else
-                hi = mid - 1;
-        }
-        return { line: lo + 1, column: offset - (starts[lo] ?? 0) + 1 };
-    };
-}

package/dist/artifacts/json.js

@@ -1,78 +0,0 @@
-// JSON as the artifacts module stores and injects it.
-/**
- * `JSON.stringify`, with `<`, U+2028, and U+2029 escaped. The result is the
- * same JSON value, and it can sit inside a `<script>` element as a literal:
- * no `</script>` or `<!--` can end or bend the element it lives in. Documents
- * are stored in this form, so the bytes a limit counts are the bytes a page
- * receives.
- */
-export function scriptSafeJson(value) {
-    return (JSON.stringify(value) ?? "null")
-        .replace(/</g, "\\u003c")
-        .replace(/[\u2028\u2029]/g, (c) => (c === "\u2028" ? "\\u2028" : "\\u2029"));
-}
-/**
- * Why `value` cannot be a document, or undefined when it can: plain JSON with
- * finite numbers, nested at most `maxDepth`, and no `__proto__` key — a page
- * reads documents as JavaScript objects, where that key sets a prototype
- * instead of holding data.
- */
-export function jsonProblem(value, maxDepth) {
-    const pointer = (path) => path.length
-        ? `/${path.map((part) => String(part).replace(/~/g, "~0").replace(/\//g, "~1")).join("/")}`
-        : "/";
-    const stack = [
-        { value, path: [], depth: 0 },
-    ];
-    while (stack.length) {
-        const item = stack.pop();
-        if (!item)
-            break;
-        const current = item.value;
-        if (current === null || typeof current === "string" || typeof current === "boolean")
-            continue;
-        if (typeof current === "number") {
-            if (!Number.isFinite(current)) {
-                return `${pointer(item.path)} is ${String(current)}, which has no JSON form; use null or a string`;
-            }
-            continue;
-        }
-        if (typeof current !== "object") {
-            return `${pointer(item.path)} is ${current === undefined ? "undefined" : `a ${typeof current}`}, which has no JSON form`;
-        }
-        if (item.depth >= maxDepth) {
-            return `${pointer(item.path)} nests deeper than ${maxDepth} levels`;
-        }
-        if (Array.isArray(current)) {
-            for (let index = current.length - 1; index >= 0; index--) {
-                stack.push({ value: current[index], path: [...item.path, index], depth: item.depth + 1 });
-            }
-            continue;
-        }
-        const proto = Object.getPrototypeOf(current);
-        if (proto !== Object.prototype && proto !== null) {
-            return `${pointer(item.path)} is not a plain object`;
-        }
-        for (const key of Object.keys(current)) {
-            if (key === "__proto__") {
-                return `${pointer([...item.path, key])} is a "__proto__" key, which a page would read as a prototype; rename it`;
-            }
-            stack.push({
-                value: current[key],
-                path: [...item.path, key],
-                depth: item.depth + 1,
-            });
-        }
-    }
-    return undefined;
-}
-const encoder = new TextEncoder();
-/** A string's size in UTF-8 bytes: what every artifact limit counts. */
-export function utf8Bytes(text) {
-    return encoder.encode(text).byteLength;
-}
-/** SHA-256 as lowercase hex: the content address of a stored body. */
-export async function sha256Hex(text) {
-    const digest = await crypto.subtle.digest("SHA-256", encoder.encode(text));
-    return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
-}

package/dist/artifacts/kv-store.d.ts

@@ -1,20 +0,0 @@
-import type { KVStorage } from "../types.js";
-import { type ArtifactBlobStore, type ArtifactStore } from "./types.js";
-export interface KvArtifactStoreOptions {
-    /**
-     * Keep bodies here instead of in the key-value store — an R2 bucket on
-     * Workers. Heads, versions, and runs stay in the key-value store, which
-     * owns the compare-and-set.
-     */
-    blobs?: ArtifactBlobStore;
-    /** Key prefix for every record. Default `artifact:`. */
-    prefix?: string;
-}
-/**
- * An artifact store over `KVStorage`. The storage must provide `compareAndSet`
- * — a write commits by swapping one head record, and a read followed by a
- * write cannot stand in for that — and `list`, which history and the library
- * page through. Cloudflare Workers KV has neither guarantee and is refused
- * here, at construction, rather than losing a write later.
- */
-export declare function kvArtifactStore(kv: KVStorage, options?: KvArtifactStoreOptions): ArtifactStore;