// ---------------------------------------------------------------------------// Artifacts HTTP API — saved generative-UI components.//// An artifact is the JSX source a model produced plus the title/description an// agent matches against. Owner-scoped: every endpoint reads and writes only// what the bound owner scope may see, so no owner travels on the wire.// --------------------------------------------------------------------------- import { HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";import { Schema } from "effect";import {  ArtifactBindings,  ArtifactId,  ArtifactNotFoundError,  InternalError,  Owner,} from "@executor-js/sdk/shared"; // ---------------------------------------------------------------------------// Params// --------------------------------------------------------------------------- const ArtifactParams = { artifactId: ArtifactId }; // ---------------------------------------------------------------------------// Response / payload schemas// --------------------------------------------------------------------------- /** * What the gallery draws for an artifact: sanitized markup of a real render, * either its create-time loading state or a settled one captured on open. */const ArtifactPreviewResponse = Schema.Struct({  kind: Schema.Literal("layout"),  markup: Schema.String,}); /** What a list returns — no `code`, so a long list stays cheap. The preview is *  the exception, because the list is the surface that draws it. */const ArtifactSummaryResponse = Schema.Struct({  id: ArtifactId,  owner: Owner,  title: Schema.String,  description: Schema.NullOr(Schema.String),  preview: Schema.NullOr(ArtifactPreviewResponse),  createdAt: Schema.Number,  updatedAt: Schema.Number,}); const ArtifactResponse = Schema.Struct({  ...ArtifactSummaryResponse.fields,  code: Schema.String,  /** Null for artifacts saved before the binding contract, whose code still   *  carries full connection addresses. */  bindings: Schema.NullOr(ArtifactBindings),}); /** Omit `id` to create; pass one to overwrite that artifact in place. */const SaveArtifactPayload = Schema.Struct({  id: Schema.optional(ArtifactId),  title: Schema.String,  description: Schema.optional(Schema.NullOr(Schema.String)),  code: Schema.String,  bindings: Schema.optional(Schema.NullOr(ArtifactBindings)),}); const RenameArtifactPayload = Schema.Struct({  title: Schema.String,}); /** * The cap on an uploaded preview image, in characters of data URL. * * A 320x200 PNG of a dashboard is tens of kilobytes; base64 costs a third on * top. 512 KiB is generous for that and small enough that the column stays * cheap to project into every list. */export const ARTIFACT_PREVIEW_IMAGE_LIMIT = 512 * 1024; /** * A snapshot of the artifact as the viewer just saw it, WITH its data. * * ## Data safety — read before widening who may call this * * Unlike the layout preview, this is captured after the artifact's queries * resolved, so it contains whatever the capturing viewer was allowed to see. * That makes it per-viewer state that happens to be stored on a shared-shaped * row. * * It is correct today only because of a property that holds by circumstance and * not by construction: artifacts are viewer-owned, so the only person who can * read the row is the person whose data is in the snapshot. When org-tier * sharing lands — the `owner` column already anticipates it — that stops being * true, and this preview would leak one member's numbers into another member's * gallery. * * At that point it must either move to per-viewer storage keyed by (artifact, * viewer), or be excluded from any view its capturer does not own. The LAYOUT * preview, written at create time from a render with no data in it, is the one * that stays shareable — which is why the column carries both kinds rather than * being replaced by this one. */const SetArtifactPreviewPayload = Schema.Struct({  /** Markup from the settled render. Sanitized by the handler through the same   *  allowlist as the create-time preview before it is ever stored. */  preview: Schema.String.check(Schema.isMaxLength(ARTIFACT_PREVIEW_IMAGE_LIMIT)),}); // ---------------------------------------------------------------------------// Error schemas with HTTP status annotations// --------------------------------------------------------------------------- const ArtifactNotFound = ArtifactNotFoundError.annotate({ httpApiStatus: 404 }); // ---------------------------------------------------------------------------// Group// --------------------------------------------------------------------------- export const ArtifactsApi = HttpApiGroup.make("artifacts")  .add(    HttpApiEndpoint.get("list", "/artifacts", {      success: Schema.Array(ArtifactSummaryResponse),      error: InternalError,    }),  )  .add(    HttpApiEndpoint.get("get", "/artifacts/:artifactId", {      params: ArtifactParams,      success: ArtifactResponse,      error: [InternalError, ArtifactNotFound],    }),  )  .add(    HttpApiEndpoint.post("save", "/artifacts", {      payload: SaveArtifactPayload,      success: ArtifactResponse,      error: [InternalError, ArtifactNotFound],    }),  )  .add(    HttpApiEndpoint.patch("rename", "/artifacts/:artifactId", {      params: ArtifactParams,      payload: RenameArtifactPayload,      success: ArtifactResponse,      error: [InternalError, ArtifactNotFound],    }),  )  .add(    HttpApiEndpoint.delete("remove", "/artifacts/:artifactId", {      params: ArtifactParams,      success: Schema.Struct({ removed: Schema.Boolean }),      error: InternalError,    }),  )  .add(    // Owner-scoped like every other endpoint here: the handler resolves the    // artifact through the same owner policy, so a viewer can only ever upgrade    // the preview of an artifact they can already read.    HttpApiEndpoint.put("setPreview", "/artifacts/:artifactId/preview", {      params: ArtifactParams,      payload: SetArtifactPreviewPayload,      success: Schema.Struct({ stored: Schema.Boolean }),      error: [InternalError, ArtifactNotFound],    }),  );