style: format with oxfmt

Author: TheGreatAxios

ARCHITECTURE.md

@@ -17,7 +17,7 @@ opens no pool unless asked. A host calls two functions:
 ## Where the routes are served
 
 The core registers root-relative paths (`/artifacts*`,
-`/instances/:id/mail-attachments`) and takes no base path, so the *mount point*
+`/instances/:id/mail-attachments`) and takes no base path, so the _mount point_
 is the host's decision. The convention every `@corbits/*-core` package
 documents, and every example here demonstrates, is **`/api`** — the same prefix
 Interchange serves its own routes under (`app.route("/api/me", …)`,
@@ -47,7 +47,7 @@ context; this package reads them natively and never invents a second principal
 resolution path.
 
 Three options have no sensible default — `db`, `contentStore`, `requireGrant` —
-and the rest degrade a *feature*, never safety, when omitted. The README's table
+and the rest degrade a _feature_, never safety, when omitted. The README's table
 of what a minimal host passes is the reference; what matters architecturally is
 that optional seams **fail closed**: no `decorate` means no decoration.
 
@@ -95,16 +95,16 @@ only handing it the row and the scope that made it.
 options. Who the request runs as is read from `TenantEnv`, not passed as a
 callback.
 
-| Option | What it is for | Default |
-| --- | --- | --- |
-| `requireGrant` | Host-owned Interchange grant middleware factory. Single-artifact mutations (revise, archive/unarchive, …) run `requireGrant(idResource("artifact", "id"), <action>)`. | none — required |
-| `contentStore` | Where an artifact's file bytes live (`ContentStore`). | none — required |
-| `decorate` | A **display-only** decorator over serialized rows (provenance labels, host joins). | no-op |
-| `onArtifactCreated` | Host hook run inside the same transaction as artifact creation — where a host mints grants for the row it just made. | no-op |
+| Option              | What it is for                                                                                                                                                        | Default         |
+| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------- |
+| `requireGrant`      | Host-owned Interchange grant middleware factory. Single-artifact mutations (revise, archive/unarchive, …) run `requireGrant(idResource("artifact", "id"), <action>)`. | none — required |
+| `contentStore`      | Where an artifact's file bytes live (`ContentStore`).                                                                                                                 | none — required |
+| `decorate`          | A **display-only** decorator over serialized rows (provenance labels, host joins).                                                                                    | no-op           |
+| `onArtifactCreated` | Host hook run inside the same transaction as artifact creation — where a host mints grants for the row it just made.                                                  | no-op           |
 
 `decorate`'s display-only status is a contract, not a convention: it may add
-fields to rows on their way out and must never affect *what* is returned or
-*who* may see it. Joining a host's workflow tables inside this package would
+fields to rows on their way out and must never affect _what_ is returned or
+_who_ may see it. Joining a host's workflow tables inside this package would
 couple it to a schema it must not know, so the host supplies the decorator.
 Clients that need an owner display name resolve `ownerPrincipalId` themselves;
 this package never ships directory names on the wire.
@@ -151,18 +151,18 @@ which store is installed.
 
 ## Modules
 
-| File | Role |
-| --- | --- |
-| `mount.ts` | HTTP surface: parsing, validation, status codes; reads `TenantEnv` principal; wires host `requireGrant`. |
-| `artifacts.ts` | The core domain — create, revise, find-or-version, list, get, archive, serialize. |
-| `uploads.ts` | `createFileArtifact`, the MIME policies, and the size caps. |
-| `download.ts` | One download path over the three storage conventions. |
-| `content-store.ts` | The two shipped `ContentStore` implementations. |
-| `tools.ts` | Agent-facing tool definitions and windowed artifact reads (caller tenant only). |
-| `web-site.ts` | The `web-site` kind's content encoding and validation. |
-| `mail-attachments.ts` | Artifact↔message associations. |
-| `ports.ts` | The `ContentStore` type and the shared `ResolvedPrincipal` shape. |
-| `schema.ts` / `migrations.ts` | The four tables, and the DDL that creates them. |
+| File                          | Role                                                                                                     |
+| ----------------------------- | -------------------------------------------------------------------------------------------------------- |
+| `mount.ts`                    | HTTP surface: parsing, validation, status codes; reads `TenantEnv` principal; wires host `requireGrant`. |
+| `artifacts.ts`                | The core domain — create, revise, find-or-version, list, get, archive, serialize.                        |
+| `uploads.ts`                  | `createFileArtifact`, the MIME policies, and the size caps.                                              |
+| `download.ts`                 | One download path over the three storage conventions.                                                    |
+| `content-store.ts`            | The two shipped `ContentStore` implementations.                                                          |
+| `tools.ts`                    | Agent-facing tool definitions and windowed artifact reads (caller tenant only).                          |
+| `web-site.ts`                 | The `web-site` kind's content encoding and validation.                                                   |
+| `mail-attachments.ts`         | Artifact↔message associations.                                                                           |
+| `ports.ts`                    | The `ContentStore` type and the shared `ResolvedPrincipal` shape.                                        |
+| `schema.ts` / `migrations.ts` | The four tables, and the DDL that creates them.                                                          |
 
 ## Data model
 
@@ -194,7 +194,7 @@ never plants a cross-tenant principal. Operators cleaning legacy rows before the
 the migration fails with an explicit message if null `tenant_id` rows remain.
 
 **`kind` is free-form text, not a pg enum,** validated at the application edge.
-New kinds cost no migration. What is *not* free-form is the import allowlist:
+New kinds cost no migration. What is _not_ free-form is the import allowlist:
 `POST /api/artifacts` may only mint `link` or `document`, so an untrusted caller
 cannot stamp a file-shaped, downloadable kind onto a row whose content is a URL
 or a pasted body.
@@ -226,8 +226,8 @@ every one of those paths — a coworker uploading `report.pdf` twice, or two
 agents each linking a file named `notes.md`, are not bugs. A hard
 `UNIQUE(tenant_id, title, kind)` constraint would reject those ordinary
 inserts outright, not just gate on a one-time backfill of legacy
-duplicates. Uniqueness on that triple is a property of the *find-or-version
-pattern specifically*, not an invariant of the table, so it does not belong
+duplicates. Uniqueness on that triple is a property of the _find-or-version
+pattern specifically_, not an invariant of the table, so it does not belong
 in the schema — it belongs exactly where it now lives, inside the one code
 path that promises it.
 
@@ -251,18 +251,18 @@ callers for a different tenant, kind, or title never contend with each
 other. This guarantee holds only for callers that go through
 `findOrVersionArtifact`; a caller that instead calls `createArtifact`
 directly is unconstrained by design, as above, and a caller that hand-rolls
-its own find-then-create against a *different* lock is not serialized
+its own find-then-create against a _different_ lock is not serialized
 against this one — the primitive closes the race for its own call path, not
 for every possible way to write an artifact.
 
 **`upload` is never a standalone resource.** There is no `POST /uploads`; every
 upload eagerly mints its artifact, and the row is reachable only through
 `source.upload.id`. `mail_attachment_ref` carries no bytes at all — the file
-already *is* an artifact, and the ref only records which artifacts rode with
+already _is_ an artifact, and the ref only records which artifacts rode with
 which message.
 
 The list index is `(tenant_id, updated_at, id)`. The `id` is the list's
-tie-break and must be *in* the index, or the keyset cursor's row-value
+tie-break and must be _in_ the index, or the keyset cursor's row-value
 comparison falls out of the index condition into a filter and drags a sort
 behind it.
 
@@ -334,7 +334,7 @@ authenticated `tenant`/`principal` on the request context; the host's
 
 - **No file parsing, ever.** No PDF parser, no spreadsheet parser, no text
   extractor, and none is planned. An extractor is a heavyweight, fast-moving
-  native dependency, and what the extracted text is *for* is the host's product.
+  native dependency, and what the extracted text is _for_ is the host's product.
   The contract the package offers a parsing host instead is **parse before you
   store**: `createFileArtifact` is the only way a file becomes an artifact, so a
   host that parses first and fails leaves nothing orphaned.

CHANGELOG.md

@@ -19,7 +19,7 @@ always called out under their own heading.
   `400`. `artifact_create` and `artifact_write` in `ARTIFACT_TOOL_DEFINITIONS`
   gain a matching optional `metadata` object parameter, and the sidecar
   bundle forwards it to the route unchanged. `source` (`{ origin: "workflow",
-  runId }`) and `generatedBy` stay server-stamped from the resolved run
+runId }`) and `generatedBy` stay server-stamped from the resolved run
   scope — never read from `metadata` or any other body field.
 - `artifact_version.content_sha256` (text, nullable), added by the new
   `0005_version_content_digest` migration and mirrored onto
@@ -35,29 +35,28 @@ always called out under their own heading.
   digests existed, and never backfilled.
 - `expectedVersion` (positive integer, optional) on
   `POST /api/artifacts/:id/versions`. Checked under the same `SELECT ... FOR
-  UPDATE` that guards the version bump: a mismatch answers `409
-  {"error":"Version conflict","currentVersion":N}` and writes nothing.
+UPDATE` that guards the version bump: a mismatch answers `409
+{"error":"Version conflict","currentVersion":N}` and writes nothing.
   Omitting it is today's unconditional-write behavior. Lets a caller bind a
   revise to the exact version it last read — for example, a human approval on
   specific content — instead of silently overwriting a change it never saw.
 - `ARTIFACT_UPLOAD_POLICY` accepts packaged archives — `application/gzip` /
   `application/x-gzip` (`.tar.gz`, `.tgz`, `.gz`) and `application/x-tar`
-  (`.tar`) — so consumers storing packaged builds are no longer refused with
-  415. An archive mints kind `file`, is never inline-previewable (the
+  (`.tar`) — so consumers storing packaged builds are no longer refused with 415. An archive mints kind `file`, is never inline-previewable (the
   download path's inline allow-list is `application/pdf` only), and is still
   subject to the existing `MAX_UPLOAD_BYTES` per-file ceiling.
 - `GET /api/artifacts/:id/versions/:version` — one version including its
   content, reusing `getArtifactVersion`, the same read authorization as
   `GET /api/artifacts/:id`, and the same response shape. A malformed or
   sub-1 version is `400`; an unknown version collapses into the same `404
-  Artifact not found` every other single-artifact failure mode does.
+Artifact not found` every other single-artifact failure mode does.
 - `GET /api/artifacts/:id/download?version=N` — pins the download to that
   version's content for the data-URL and downloadable-text conventions,
   where content really is per-version; omitting `version` is unchanged. Same
   `400`/`404` rules as the new versions route, plus one more: a blob-backed
   upload's `ContentStore` reference lives on the artifact row's own
   `source`, never per-version, so `?version=N` for one is `400 "Uploaded
-  file content is not versioned"` unless `N` names the current version —
+file content is not versioned"` unless `N` names the current version —
   rather than silently answering with today's blob under an older version's
   name.
 - `artifact_version.metadata` (jsonb, nullable) and

CONTRIBUTING.md

@@ -65,7 +65,7 @@ declares, no more and no less. Change one, change the other, in the same commit.
 ## Pull requests
 
 - Keep commits focused, and keep the diff to the change you are describing.
-- Explain *why* in the commit message; the code already says what.
+- Explain _why_ in the commit message; the code already says what.
 - CI must be green: dependency check, typecheck, unit + integration, build, reference-host
   acceptance, and a Node consumer smoke test that installs the packed tarball.
 - Contributions are accepted under the repository's LGPL-2.1-only licence.

README.md

@@ -21,13 +21,13 @@ There are three surfaces a host wires up, in the order a hub typically mounts th
 
 Mounted under the hub's tenant prefix, alongside a host's other session-authenticated routes. It reads `principal`/`tenant` off the Hono context (placed there by the host's own auth + tenant middleware) and authorizes mutations through the host's `requireGrant` — built from Interchange's `createRequireGrant` over the host's own `GrantStore` and `ConditionRegistry`.
 
-| `opts` | Type | What the host provides |
-| --- | --- | --- |
-| `db` | `ArtifactDb` | Artifacts are stored there. `createArtifactDb` opens a handle for a host with none; a hub that already has one passes it through. |
-| `contentStore` | `ContentStore` | Blob storage for file bytes. `InlineContentStore` (exported by this package) fits a minimal host; bring your own store for object storage. |
-| `requireGrant` | `RequireGrant` | The host's grant middleware factory. This package implements no ownership or membership policy of its own — every mutating single-artifact route is gated through it. |
-| `countSegments` | `ArtifactCountSegments` (optional) | Named predicates over `ArtifactListRow` for `GET /artifacts/counts` (e.g. bucket by `kind`). The taxonomy is entirely host-owned; omitted, the route still answers with the tenant-wide `all` total. |
-| `onArtifactCreated`, `decorate`, `uploadPolicy` | — (optional) | See [ARCHITECTURE.md](./ARCHITECTURE.md) for the grant-provisioning hook, the display-only row decorator, and the upload policy. |
+| `opts`                                          | Type                               | What the host provides                                                                                                                                                                               |
+| ----------------------------------------------- | ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `db`                                            | `ArtifactDb`                       | Artifacts are stored there. `createArtifactDb` opens a handle for a host with none; a hub that already has one passes it through.                                                                    |
+| `contentStore`                                  | `ContentStore`                     | Blob storage for file bytes. `InlineContentStore` (exported by this package) fits a minimal host; bring your own store for object storage.                                                           |
+| `requireGrant`                                  | `RequireGrant`                     | The host's grant middleware factory. This package implements no ownership or membership policy of its own — every mutating single-artifact route is gated through it.                                |
+| `countSegments`                                 | `ArtifactCountSegments` (optional) | Named predicates over `ArtifactListRow` for `GET /artifacts/counts` (e.g. bucket by `kind`). The taxonomy is entirely host-owned; omitted, the route still answers with the tenant-wide `all` total. |
+| `onArtifactCreated`, `decorate`, `uploadPolicy` | — (optional)                       | See [ARCHITECTURE.md](./ARCHITECTURE.md) for the grant-provisioning hook, the display-only row decorator, and the upload policy.                                                                     |
 
 ```ts
 import type { Hono } from "hono";
@@ -57,7 +57,9 @@ export function mountArtifactRoutes(
       grantStore: deps.grantStore,
       conditionRegistry: deps.conditionRegistry,
     }),
-    ...(deps.countSegments !== undefined ? { countSegments: deps.countSegments } : {}),
+    ...(deps.countSegments !== undefined
+      ? { countSegments: deps.countSegments }
+      : {}),
   });
 }
 ```
@@ -66,12 +68,12 @@ export function mountArtifactRoutes(
 
 A parallel mount for a workflow run, which has no browser session — only a bearer token and an `x-workflow-run-address` header. Mount it at its own path (`/api/workflow-artifacts` by convention; see the sidecar bundle below) rather than under the tenant prefix. `resolveRunScope` is the host's existing sidecar-token → run lookup; `agentToken` is a second, optional auth path so a deployed agent can present the bearer the hub minted for its own definition instead of the sidecar's token.
 
-| `opts` | Type | What the host provides |
-| --- | --- | --- |
-| `db`, `contentStore` | `ArtifactDb`, `ContentStore` | Same as above. |
-| `resolveRunScope` | `WorkflowRunResolver` | `(bearerToken, runAddress) => ResolvedWorkflowRunScope \| null`. Returning `null` answers 401 — this package makes no assumption about how a host issues or verifies its sidecar tokens. |
-| `agentToken` | `AgentTokenAuth` (optional) | `{ verify(ctx), resolveRun(runAddress) }`. `verify` returns `undefined` for "not an agent token" (the sidecar path is tried instead) and refuses a bearer whose tenant doesn't match the resolved run's. |
-| `uploadPolicy`, `maxBinaryBytes`, `maxContentChars` | — (optional) | Per-run ceilings; see [ARCHITECTURE.md](./ARCHITECTURE.md). |
+| `opts`                                              | Type                         | What the host provides                                                                                                                                                                                   |
+| --------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `db`, `contentStore`                                | `ArtifactDb`, `ContentStore` | Same as above.                                                                                                                                                                                           |
+| `resolveRunScope`                                   | `WorkflowRunResolver`        | `(bearerToken, runAddress) => ResolvedWorkflowRunScope \| null`. Returning `null` answers 401 — this package makes no assumption about how a host issues or verifies its sidecar tokens.                 |
+| `agentToken`                                        | `AgentTokenAuth` (optional)  | `{ verify(ctx), resolveRun(runAddress) }`. `verify` returns `undefined` for "not an agent token" (the sidecar path is tried instead) and refuses a bearer whose tenant doesn't match the resolved run's. |
+| `uploadPolicy`, `maxBinaryBytes`, `maxContentChars` | — (optional)                 | Per-run ceilings; see [ARCHITECTURE.md](./ARCHITECTURE.md).                                                                                                                                              |
 
 ```ts
 import type { Hono } from "hono";