@mnstry/atelier 0.2.0-alpha.5 → 0.2.0-alpha.8

package/src/vault/hosts.mjs

@@ -0,0 +1,21 @@
+import { createVaultService } from './service.mjs'
+import { vaultIdentity } from './identity.mjs'
+import { r2PrivateStorage, vercelPrivateStorage } from './storage.mjs'
+import { d1VaultMetadata, postgresVaultMetadata } from './metadata.mjs'
+
+/** Vercel host passes its established session verifier, credential store and SDKs. */
+export function createVercelVault({ blob, postgres, verifySession, lookupCredential, privacy, deployment }) {
+  return createVaultService({ privacy, deployment, storage: vercelPrivateStorage(blob), metadata: postgresVaultMetadata(postgres), identity: vaultIdentity({ verifySession, lookupCredential, privacy, deployment }) })
+}
+/** Create a handler per request so D1 sessions cannot carry stale bookmarks. */
+export function createCloudflareVault({ verifySession, lookupCredential, privacy, deployment }) {
+  vaultIdentity({ verifySession, lookupCredential })
+  async function handle(request, env) {
+    try {
+    const db = env.VAULT_DB.withSession('first-primary')
+    const identity = vaultIdentity({ verifySession: req => verifySession(req, env), lookupCredential: hash => lookupCredential(hash, env, db) })
+    return await createVaultService({ privacy, deployment, storage: r2PrivateStorage(env.VAULT_OBJECTS), metadata: d1VaultMetadata(db), identity })(request)
+    } catch { return new Response(null, { status: 503, headers: { "Cache-Control": "private, no-store", "X-Content-Type-Options": "nosniff" } }) }
+  }
+  return { fetch: handle }
+}

package/src/vault/identity.mjs

@@ -0,0 +1,19 @@
+/**
+ * The host verifies browser sessions using its established identity provider.
+ * Machine credentials are high-entropy secrets whose SHA-256 hashes are stored
+ * by the host. Lookup must read authoritative, current expiry/revocation state.
+ */
+import { digest } from './service.mjs'
+export function vaultIdentity({ verifySession, lookupCredential, now = () => Date.now() }) {
+  if (typeof verifySession !== 'function' || typeof lookupCredential !== 'function') throw new TypeError('Identity bindings required')
+  return {
+    read: request => verifySession(request),
+    async publish(request, vault) {
+      const value = request.headers.get('authorization')
+      if (!value || !/^Bearer [A-Za-z0-9_-]{43,128}$/.test(value)) return null
+      const record = await lookupCredential(await digest(new TextEncoder().encode(value.slice(7))))
+      if (!record || record.vault !== vault || record.revoked !== false || !Number.isFinite(record.expiresAt) || record.expiresAt <= now()) return null
+      return record.owner
+    },
+  }
+}

package/src/vault/index.mjs

@@ -0,0 +1,7 @@
+export { createVaultService, preparePublication } from './service.mjs'
+export { vaultIdentity } from './identity.mjs'
+export { r2PrivateStorage, vercelPrivateStorage } from './storage.mjs'
+export { VAULT_TABLE_SQL, d1VaultMetadata, postgresVaultMetadata } from './metadata.mjs'
+export { createVercelVault, createCloudflareVault } from './hosts.mjs'
+export { assessVaultPrivacy, createVaultPrivacyState, createVaultContext, VaultAlarmPersistenceError } from './privacy.mjs'
+export { createVaultPrivacyProbe } from './probe.mjs'

package/src/vault/interface.mjs

@@ -0,0 +1,11 @@
+const escape = value => String(value).replace(/[&<>"']/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]))
+export function renderVaultHome({ vault, revision, manifest, privacy, query = '' }) {
+  const files = manifest.filter(file => /\.(html|pdf|txt)$/.test(file.path))
+  const matches = files.filter(file => file.path.toLowerCase().includes(query.toLowerCase()))
+  const verified = privacy.status === 'verified'
+  const label = verified ? 'Unauthorized-access checks passed' : privacy.status === 'exposed' ? 'Privacy failure — external routes may remain exposed' : 'Privacy not verified — access blocked'
+  const list = verified ? matches.map(file => `<li><a href="/${escape(vault)}/${file.path.split('/').map(encodeURIComponent).join('/')}">${escape(file.path)}</a><span>${escape(file.type.split(';')[0])}</span></li>`).join('') : ''
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${escape(vault)} · Atelier</title><style>
+  *{box-sizing:border-box}body{margin:0;background:#f6f5ef;color:#20382d;font:17px/1.6 system-ui,sans-serif}main{max-width:960px;margin:auto;padding:clamp(20px,5vw,64px)}header{border-bottom:1px solid #cad3c7;padding-bottom:24px}h1{font-size:clamp(30px,6vw,52px);line-height:1.15;overflow-wrap:anywhere}a{color:inherit;text-underline-offset:4px}a:focus-visible,input:focus-visible,button:focus-visible{outline:3px solid #28734e;outline-offset:4px}.status{padding:16px;border:1px solid #738975;border-radius:8px;margin:24px 0}.blocked{background:#fff0dc;border-color:#936125}label{display:block;font-weight:600}form{display:flex;gap:12px;flex-wrap:wrap}input{flex:1;min-width:0;font:inherit;padding:12px;border:1px solid #738975;border-radius:6px}button{font:inherit;padding:12px 20px;background:#20382d;color:white;border:0;border-radius:6px}ul{list-style:none;padding:0}li{padding:20px 0;border-bottom:1px solid #cad3c7}li a{display:block;overflow-wrap:anywhere}li span,footer{font-size:14px;color:#506354}footer{margin-top:40px}.skip{position:absolute;left:-10000px}.skip:focus{left:16px;top:8px}</style></head><body><a class="skip" href="#artifacts">Skip to artifacts</a><main><header><p>ATELIER · PRIVATE VAULT</p><h1>${escape(vault)}</h1><p>Published revision ${escape(revision)} · ${files.length} artifact${files.length === 1 ? '' : 's'}</p></header><section class="status ${verified ? '' : 'blocked'}" aria-label="Privacy status"><strong>${label}</strong><p>${escape(privacy.reason)}</p>${verified ? `<small>Checked ${escape(new Date(privacy.checkedAt).toISOString())}. Authorization and evidence freshness are checked when you open an artifact.</small>` : '<p>Ask the workspace operator to verify destination protection, then reload. Artifacts are unavailable until the checks pass.</p>'}</section><label for="search">Find an artifact</label><form role="search" method="get" action="/${escape(vault)}/"><input id="search" name="q" type="search" value="${escape(query)}" maxlength="200"><button type="submit">Search</button></form>${verified ? `<ul id="artifacts" tabindex="-1" aria-label="Artifacts">${list}</ul>${matches.length ? '' : `<p>${files.length ? 'No artifacts match your search.' : 'No artifacts have been published yet.'}</p>`}` : ''}<footer>This website displays published artifacts. Saving or reviewing source material does not publish it. Generated artifacts run without script privileges.</footer></main></body></html>`
+}
+export const vaultHomePolicy = "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'"

package/src/vault/metadata.mjs

@@ -0,0 +1,31 @@
+/** SQL adapters require pre-provisioned vaults; neither endpoint creates owners. */
+export const VAULT_TABLE_SQL = `CREATE TABLE atelier_vaults (
+  id TEXT PRIMARY KEY,
+  owner_issuer TEXT NOT NULL,
+  owner_subject TEXT NOT NULL,
+  revision INTEGER NOT NULL DEFAULT 0,
+  manifest TEXT NOT NULL DEFAULT '[]',
+  publication TEXT
+)`
+function record(row) {
+  return row ? { owner: { issuer: row.owner_issuer, subject: row.owner_subject }, revision: Number(row.revision), manifest: JSON.parse(row.manifest), publication: row.publication } : null
+}
+export function d1VaultMetadata(db) {
+  return {
+    async get(vault) { return record(await db.prepare('SELECT * FROM atelier_vaults WHERE id = ?').bind(vault).first()) },
+    async commit(vault, update) {
+      const result = await db.prepare('UPDATE atelier_vaults SET revision = revision + 1, manifest = ?, publication = ? WHERE id = ? AND revision = ? AND owner_issuer = ? AND owner_subject = ?')
+        .bind(JSON.stringify(update.manifest), update.publication, vault, update.expectedRevision, update.owner.issuer, update.owner.subject).run()
+      return result.success === true && result.meta.changes === 1
+    },
+  }
+}
+export function postgresVaultMetadata(db) {
+  return {
+    async get(vault) { return record((await db.query('SELECT * FROM atelier_vaults WHERE id = $1', [vault])).rows[0]) },
+    async commit(vault, update) {
+      const result = await db.query('UPDATE atelier_vaults SET revision = revision + 1, manifest = $1, publication = $2 WHERE id = $3 AND revision = $4 AND owner_issuer = $5 AND owner_subject = $6', [JSON.stringify(update.manifest), update.publication, vault, update.expectedRevision, update.owner.issuer, update.owner.subject])
+      return result.rowCount === 1
+    },
+  }
+}

package/src/vault/privacy.mjs

@@ -0,0 +1,148 @@
+/** Trusted host evidence only: never accept evidence from a publisher. */
+const unknown = reason => ({ status: 'unknown', reason })
+export function vaultObjects(vault, manifest) {
+  return [...new Map(manifest.map(file => [`${vault}/${file.sha256}`, { key: `${vault}/${file.sha256}`, sha256: file.sha256, size: file.size }])).values()]
+}
+export function validDeployment(deployment) {
+  if (!deployment || typeof deployment.id !== 'string' || !deployment.id || !Array.isArray(deployment.origins) || !deployment.origins.length || deployment.origins.length > 16) return false
+  return new Set(deployment.origins).size === deployment.origins.length && deployment.origins.every(origin => {
+    try { const u = new URL(origin); return u.protocol === 'https:' && u.origin === origin && !u.username && !u.password } catch { return false }
+  })
+}
+export function assessVaultPrivacy(evidence, context) {
+  const { vault, publication, revision, phase, owner, deployment, manifest = [], objects = [], request, now = Date.now() } = context
+  // Exposure is a sticky alarm, not authorization. Even stale/mismatched trusted
+  // evidence must not turn a known exposure into an ordinary availability error.
+  if (evidence?.targets?.some?.(t => t?.anonymous === 'content' || t?.otherUser === 'content')) return { status: 'exposed', reason: 'Unauthorized content observed. This handler refuses delivery; external routes may remain exposed.' }
+  if (!evidence || evidence.vault !== vault || evidence.publication !== publication) return unknown('Protection evidence does not match this publication.')
+  if (!Number.isSafeInteger(revision) || revision < 0 || evidence.revision !== revision) return unknown('Protection evidence does not match the metadata revision.')
+  if (evidence.phase !== phase || !['before-upload', 'before-activation', 'read'].includes(phase) || !owner?.issuer || !owner?.subject || evidence.owner?.issuer !== owner.issuer || evidence.owner?.subject !== owner.subject) return unknown('Protection evidence does not match the owner and operation.')
+  if (!validDeployment(deployment) || evidence.deployment?.id !== deployment.id || JSON.stringify(evidence.deployment?.origins) !== JSON.stringify(deployment.origins)) return unknown('Protection evidence does not match this deployment.')
+  if (request && (!deployment.origins.includes(request.origin) || (phase === 'read' && request.path !== `/${vault}` && request.path !== `/${vault}/` && !manifest.some(f => request.path === `/${vault}/${f.path}`)))) return unknown('Request is outside the verified inventory.')
+  if (!Number.isFinite(evidence.checkedAt) || !Number.isFinite(evidence.validUntil) || evidence.checkedAt > now || evidence.validUntil <= now || evidence.validUntil <= evidence.checkedAt || evidence.validUntil - evidence.checkedAt > 300000) return unknown('Protection evidence is missing or expired.')
+  if (typeof evidence.policyRevision !== 'string' || !evidence.policyRevision) return unknown('Provider policy identity is missing.')
+  const config = evidence.configuration
+  if (config?.ownerOnly !== true || config?.privateStorage !== true || config?.completeInventory !== true) return unknown('Provider protection or route inventory is unverified.')
+  if (!Array.isArray(evidence.targets) || !evidence.targets.length || evidence.targets.length > 2000) return unknown('Access checks are missing or oversized.')
+  const urls = new Set(), routes = new Set(), keys = new Set()
+  for (const target of evidence.targets) {
+    let url
+    try { url = new URL(target.url) } catch { return unknown('Access check URL is invalid.') }
+    if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash || urls.has(url.href)) return unknown('Access check inventory is invalid.')
+    urls.add(url.href)
+    if (target.anonymous !== 'denied' || target.otherUser !== 'denied') return unknown('Required access checks did not complete successfully.')
+    if (target.kind === 'storage') {
+      if (!objects.some(o => o.key === target.key && o.sha256 === target.sha256 && o.size === target.size)) return unknown('Storage check does not match a staged object.')
+      keys.add(target.key)
+    } else if (target.kind === 'route') {
+      if (!deployment.origins.includes(url.origin)) return unknown('Access check uses an unconfigured origin.')
+      const file = manifest.find(f => url.pathname === `/${vault}/${f.path}`)
+      const home = url.pathname === `/${vault}` || url.pathname === `/${vault}/`
+      if (!home && (!file || file.sha256 !== target.sha256)) return unknown('Access check does not match a manifest path and digest.')
+      routes.add(url.href)
+    } else return unknown('Access check target is invalid.')
+  }
+  for (const origin of deployment.origins) {
+    for (const path of [`/${vault}`, `/${vault}/`, ...manifest.map(f => `/${vault}/${f.path}`)]) if (!routes.has(origin + path)) return unknown('A configured route is missing from access checks.')
+  }
+  for (const object of objects) if (!keys.has(object.key)) return unknown('A staged storage object is missing from access checks.')
+  return { status: 'verified', reason: 'Configured routes refused unauthorized access at the recorded check time. Owner rendering is qualified separately.', checkedAt: evidence.checkedAt, validUntil: evidence.validUntil, policyRevision: evidence.policyRevision }
+}
+export async function verifyVaultPrivacy(privacy, context) {
+  const method = context.phase === 'read' ? 'current' : 'verify'
+  if (typeof privacy?.[method] !== 'function') return unknown('No provider privacy evidence is configured.')
+  try { return assessVaultPrivacy(await privacy[method](context), context) }
+  catch (error) {
+    if (error instanceof VaultAlarmPersistenceError) return { ...assessVaultPrivacy(error.evidence, context), persistence: 'unconfirmed' }
+    return unknown('Provider privacy verification is unavailable.')
+  }
+}
+
+/** The host must alert/retry this failure; the local read latch remains set. */
+export class VaultAlarmPersistenceError extends Error {
+  constructor(evidence, cause) {
+    super('Vault exposure is latched locally but durable persistence is unconfirmed.', { cause })
+    this.name = 'VaultAlarmPersistenceError'
+    this.code = 'VAULT_ALARM_NOT_PERSISTED'
+    this.evidence = evidence
+  }
+}
+
+/** Public builder keeps refresh contexts aligned with service storage keys. */
+export function createVaultContext({ vault, record, deployment, request, phase = 'read' }) {
+  if (!record || !Number.isSafeInteger(record.revision) || record.revision < 0 || !Array.isArray(record.manifest)) throw new TypeError('Authoritative revision and manifest required')
+  return { vault, owner: record.owner, publication: record.publication ?? null, revision: record.revision, manifest: record.manifest, objects: vaultObjects(vault, record.manifest), deployment, ...(request ? { request } : {}), phase }
+}
+
+/** Host-owned versioned evidence store. Refresh is explicit; reads never probe. */
+export function createVaultPrivacyState({ probe, load, compareAndSet }) {
+  if (typeof probe?.verify !== 'function' || typeof load !== 'function' || typeof compareAndSet !== 'function') throw new TypeError('Probe and versioned evidence store required')
+  const alarms = new Map()
+  const key = context => {
+    if (!Number.isSafeInteger(context?.revision) || context.revision < 0) throw new TypeError('Authoritative nonnegative metadata revision required')
+    return JSON.stringify([context.deployment?.id, context.vault])
+  }
+  const exposed = (evidence, context) => assessVaultPrivacy(evidence, context).status === 'exposed'
+  async function snapshot(id, context) {
+    const record = await load(id)
+    if (!record || !Number.isSafeInteger(record.version) || record.version < 0 || !Object.hasOwn(record, 'evidence')) throw new TypeError('Invalid evidence store snapshot')
+    if (exposed(record.evidence, context)) alarms.set(id, { evidence: record.evidence, persisted: true })
+    return record
+  }
+  async function persistAlarm(id, context) {
+    // Alarm writes may replace newer green evidence regardless of revision.
+    // Reload on conflict, never reuse a stale version or retry green evidence.
+    for (let attempt = 0; attempt < 3; attempt++) {
+      if (alarms.get(id).persisted) return alarms.get(id).evidence
+      try {
+        const record = await snapshot(id, context)
+        if (alarms.get(id).persisted) return alarms.get(id).evidence
+        const evidence = alarms.get(id).evidence
+        if (await compareAndSet(id, evidence, { expectedVersion: record.version }) === true) {
+          alarms.set(id, { evidence, persisted: true })
+          return evidence
+        }
+      } catch (cause) { throw new VaultAlarmPersistenceError(alarms.get(id).evidence, cause) }
+    }
+    throw new VaultAlarmPersistenceError(alarms.get(id).evidence, new Error('Alarm write conflict limit reached'))
+  }
+  async function collect(context) {
+    const id = key(context)
+    // Pending latches retry persistence without re-probing a possibly vanished
+    // or staged-only exposure. Confirmed durable alarms need no rewrite.
+    if (alarms.has(id)) return persistAlarm(id, context)
+    const previous = await snapshot(id, context)
+    if (alarms.has(id)) return persistAlarm(id, context)
+    if (previous.evidence?.revision > context.revision) return null
+    const evidence = await probe.verify(context)
+    if (exposed(evidence, context)) {
+      if (!alarms.has(id)) alarms.set(id, { evidence, persisted: false })
+      return persistAlarm(id, context)
+    }
+    if (alarms.has(id)) return persistAlarm(id, context)
+    if (context.phase !== 'read') {
+      // Another instance may have latched an incident during the slow probe.
+      // This is still a check, not a transaction with metadata activation.
+      const latest = await snapshot(id, context)
+      if (alarms.has(id)) return persistAlarm(id, context)
+      return latest.evidence?.revision > context.revision ? null : evidence
+    }
+    // Green writes retain their original version. Conflicts and store failures
+    // must never be interpreted as a successful refresh.
+    if (await compareAndSet(id, evidence, { expectedVersion: previous.version }) !== true) {
+      await snapshot(id, context)
+      return alarms.has(id) ? persistAlarm(id, context) : null
+    }
+    return alarms.has(id) ? persistAlarm(id, context) : evidence
+  }
+  return {
+    verify: collect,
+    async current(context) {
+      const id = key(context)
+      if (alarms.has(id)) return alarms.get(id).evidence
+      const record = await snapshot(id, context)
+      return alarms.get(id)?.evidence ?? record.evidence
+    },
+    async refresh(context) { return collect({ ...context, phase: 'read' }) },
+  }
+}

package/src/vault/probe.mjs

@@ -0,0 +1,89 @@
+import { digest } from './service.mjs'
+const canonical = value => JSON.stringify(value, (_, item) => item && typeof item === 'object' && !Array.isArray(item) ? Object.fromEntries(Object.keys(item).sort().map(k => [k, item[k]])) : item)
+const MAX_BYTES = 4 * 1024 * 1024
+const cleanUrl = value => {
+  const url = new URL(value)
+  if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash) throw new Error('Unsafe probe URL')
+  return url.href
+}
+async function classify(response, target, loginUrls) {
+  if (!(response instanceof Response)) return 'unknown'
+  const reader = response.body?.getReader()
+  const chunks = []; let length = 0
+  try {
+    for (; reader;) {
+      const { value, done } = await reader.read()
+      if (done) break
+      length += value.byteLength
+      if (length > MAX_BYTES) { await reader.cancel(); return 'unknown' }
+      chunks.push(value)
+    }
+  } finally { reader?.releaseLock() }
+  const bytes = new Uint8Array(length); let offset = 0
+  for (const value of chunks) { bytes.set(value, offset); offset += value.length }
+  // Content exposure wins over misleading error or redirect status codes.
+  if (length > 0 && (await digest(bytes) === target.sha256 || (typeof target.canary === 'string' && target.canary.length >= 32 && new TextDecoder().decode(bytes).includes(target.canary)))) return 'content'
+  if (response.redirected) return 'unknown'
+  if ([401, 403, 404].includes(response.status)) return length === 0 ? 'denied' : 'unknown'
+  if ([302, 303, 307, 308].includes(response.status)) {
+    try {
+      const location = new URL(response.headers.get('location'), target.url)
+      if (location.protocol !== 'https:' || location.username || location.password || location.hash) return 'unknown'
+      const endpoint = loginUrls.find(item => item.url === location.origin + location.pathname)
+      return endpoint && [...location.searchParams.keys()].every(key => endpoint.queryKeys.includes(key)) ? 'denied' : 'unknown'
+    } catch { return 'unknown' }
+  }
+  return 'unknown'
+}
+/**
+ * inspect(context) is a trusted provider configuration/inventory collector.
+ * request({url,identity,redirect,signal}) is host transport; credentials never
+ * cross identities or redirects. No global fetch or ambient credentials here.
+ * Each collection re-inspects policy after probing to refuse changed settings.
+ */
+export function createVaultPrivacyProbe({ inspect, request, now = () => Date.now(), timeoutMs = 60000, onExposure }) {
+  if (typeof inspect !== 'function' || typeof request !== 'function' || !Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 60000) throw new TypeError('Explicit probe bindings required')
+  return {
+    async verify(context) {
+      const controller = new AbortController()
+      let timer
+      const checkedAt = now()
+      const deadline = new Promise((_, reject) => { timer = setTimeout(() => { controller.abort(); reject(new Error('Probe deadline exceeded')) }, timeoutMs) })
+      const collect = async () => {
+        const inventory = structuredClone(await inspect(context, { signal: controller.signal }))
+        if (!inventory || !Array.isArray(inventory.targets) || !inventory.targets.length || inventory.targets.length > 2000) throw new Error('Invalid probe inventory')
+        const targets = inventory.targets.map(target => {
+          if (!target || !/^[a-f0-9]{64}$/.test(target.sha256)) throw new Error('Expected content digest required')
+          return { ...target, url: cleanUrl(target.url) }
+        })
+        const loginUrls = (inventory.loginEndpoints ?? []).map(item => {
+          if (!Array.isArray(item.queryKeys) || item.queryKeys.some(key => !['state', 'redirect_uri', 'redirect_url', 'returnTo', 'next', 'client_id', 'response_type', 'scope', 'nonce', 'code_challenge', 'code_challenge_method'].includes(key))) throw new Error('Unsafe login parameters')
+          return { url: cleanUrl(item.url), queryKeys: item.queryKeys }
+        })
+        const evidence = results => ({ vault: context.vault, publication: context.publication, revision: context.revision, phase: context.phase, owner: context.owner, deployment: context.deployment, checkedAt, validUntil: checkedAt + 60000, policyRevision: inventory.policyRevision, configuration: inventory.configuration, targets: results })
+        const results = []
+        for (const target of targets) {
+          const result = { url: target.url, kind: target.kind, sha256: target.sha256, key: target.key, size: target.size }
+          for (const identity of ['anonymous', 'otherUser']) {
+            if (controller.signal.aborted) throw new Error('Probe aborted')
+            try { result[identity] = await classify(await request({ url: target.url, identity, redirect: 'manual', signal: controller.signal }), target, loginUrls) }
+            catch { result[identity] = 'unknown' }
+            if (result[identity] === 'content') {
+              const alarm = evidence([...results, result])
+              // Notification cannot delay or downgrade the exposure verdict. The
+              // host owns durable incident persistence and provider containment.
+              if (typeof onExposure === 'function') Promise.resolve().then(() => onExposure(alarm)).catch(() => {})
+              return alarm
+            }
+          }
+          results.push(result)
+        }
+        const after = await inspect(context, { signal: controller.signal })
+        if (canonical(after) !== canonical(inventory)) throw new Error('Provider protection changed during verification')
+        return evidence(results)
+      }
+      try { return await Promise.race([collect(), deadline]) }
+      finally { clearTimeout(timer); controller.abort() }
+    },
+  }
+}

package/src/vault/service.mjs

@@ -0,0 +1,131 @@
+import { verifyVaultPrivacy, createVaultContext } from './privacy.mjs'
+import { renderVaultHome, vaultHomePolicy } from './interface.mjs'
+/** Optional hosted artifact service. No default network, storage, or identity provider. */
+const TYPES = Object.freeze({ html: 'text/html; charset=utf-8', css: 'text/css; charset=utf-8', txt: 'text/plain; charset=utf-8', png: 'image/png', jpg: 'image/jpeg', jpeg: 'image/jpeg', webp: 'image/webp', pdf: 'application/pdf' })
+const LIMIT = 4 * 1024 * 1024
+const encoder = new TextEncoder()
+const validId = value => typeof value === 'string' && /^[a-z][a-z0-9-]{0,62}$/.test(value)
+const validPath = value => typeof value === 'string' && value.length <= 512 && value.split('/').every(p => /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(p) && p !== '.' && p !== '..')
+const validExt = value => value === undefined || (value !== null && typeof value === 'object' && !Array.isArray(value))
+const sameOwner = (a, b) => a && b && typeof a.issuer === 'string' && a.issuer.length > 0 && typeof a.subject === 'string' && a.subject.length > 0 && a.issuer === b.issuer && a.subject === b.subject
+const headers = {
+  'Cache-Control': 'private, no-store',
+  'Content-Security-Policy': "sandbox; default-src 'none'; img-src 'self'; style-src 'self' 'unsafe-inline'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
+  'X-Content-Type-Options': 'nosniff',
+  'Referrer-Policy': 'no-referrer',
+  'X-Robots-Tag': 'noindex, nofollow',
+}
+export async function digest(bytes) {
+  return Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256', bytes)), b => b.toString(16).padStart(2, '0')).join('')
+}
+function reply(status, text = '', extra = {}) { return new Response(text, { status, headers: { ...headers, 'Content-Type': 'text/plain; charset=utf-8', ...extra } }) }
+async function boundedBody(request) {
+  if (!request.body) throw new Error('invalid')
+  const reader = request.body.getReader()
+  let size = 0
+  const chunks = []
+  try {
+    while (true) {
+      const { done, value } = await reader.read()
+      if (done) break
+      size += value.byteLength
+      if (size > LIMIT) { await reader.cancel(); throw new Error('too-large') }
+      chunks.push(value)
+    }
+  } finally { reader.releaseLock() }
+  const bytes = new Uint8Array(size)
+  let offset = 0
+  for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.length }
+  return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes))
+}
+export async function preparePublication(input) {
+  if (!input || input.schema !== 'atelier-vault-publication/v1' || (input.contractVersion !== undefined && (typeof input.contractVersion !== 'string' || !/^1\.[0-9]+\.[0-9]+$/.test(input.contractVersion))) || !validExt(input.ext) || !Number.isSafeInteger(input.expectedRevision) || input.expectedRevision < 0 || input.expectedRevision >= Number.MAX_SAFE_INTEGER || Object.keys(input).some(key => !['schema', 'contractVersion', 'expectedRevision', 'files', 'ext'].includes(key)) || !Array.isArray(input.files) || !input.files.length || input.files.length > 100) throw new Error('invalid')
+  if (encoder.encode(JSON.stringify(input)).length > LIMIT) throw new Error('too-large')
+  const seen = new Set()
+  const files = []
+  let total = 0
+  for (const file of input.files) {
+    if (!file || !validExt(file.ext) || Object.keys(file).some(key => !['path', 'base64', 'ext'].includes(key)) || !validPath(file.path) || seen.has(file.path) || typeof file.base64 !== 'string' || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(file.base64)) throw new Error('invalid')
+    const type = TYPES[file.path.split('.').at(-1)]
+    if (typeof type !== 'string') throw new Error('invalid')
+    seen.add(file.path)
+    const bytes = Uint8Array.from(atob(file.base64), c => c.charCodeAt(0))
+    total += bytes.length
+    if (total > LIMIT) throw new Error('too-large')
+    files.push({ path: file.path, type, size: bytes.length, sha256: await digest(bytes), bytes })
+  }
+  files.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0)
+  const manifest = files.map(({ bytes, ...record }) => record)
+  return { files, manifest, publication: await digest(encoder.encode(JSON.stringify(manifest))) }
+}
+/**
+ * identity.read(request) -> verified {issuer,subject}, or null (revocation checked).
+ * identity.publish(request,vault) -> verified owner identity, or null; MUST use
+ * a revocable vault-scoped machine credential, never browser cookies.
+ * metadata.get(vault) -> {owner, revision, manifest}, or null.
+ * metadata.commit(vault,{owner,expectedRevision,manifest,publication}) -> boolean;
+ * MUST atomically compare both owner and revision before replacing manifest.
+ * storage.get/put accepts service-generated keys only and uses private storage.
+ */
+export function createVaultService({ identity, metadata, storage, privacy, deployment }) {
+  for (const [object, methods] of [[identity, ['read', 'publish']], [metadata, ['get', 'commit']], [storage, ['get', 'put']]]) {
+    if (!object || methods.some(method => typeof object[method] !== 'function')) throw new TypeError('Incomplete vault adapter')
+  }
+  return async function handle(request) {
+    try {
+      const url = new URL(request.url)
+      if (/%|\\/.test(url.pathname)) return reply(400)
+      const parts = url.pathname.slice(1).split('/')
+      const publishing = parts[0] === '_publish'
+      const vault = publishing ? parts[1] : parts[0]
+      if (!validId(vault)) return reply(404)
+      const home = !publishing && (parts.length === 1 || (parts.length === 2 && parts[1] === ''))
+      if (url.search && (publishing || (home && ( [...url.searchParams.keys()].some(key => key !== 'q') || url.searchParams.getAll('q').length > 1 || (url.searchParams.get('q') || '').length > 200)))) return reply(400)
+      if (publishing) {
+        if (parts.length !== 2 || !['GET', 'POST'].includes(request.method)) return reply(405, '', { Allow: 'GET, POST' })
+        // Browser-originated writes are not a machine publication channel.
+        if (request.headers.has('origin') || request.headers.has('cookie')) return reply(403)
+        const principal = await identity.publish(request, vault)
+        if (!principal) return reply(401, '', { 'WWW-Authenticate': 'Bearer realm="vault-publication"' })
+        const record = await metadata.get(vault)
+        if (!sameOwner(principal, record?.owner)) return reply(404)
+        if (request.method === 'GET') {
+          return new Response(JSON.stringify({ schema: 'atelier-vault-status/v1', vault, revision: record.revision, publication: record.publication ?? null }), { headers: { ...headers, 'Content-Type': 'application/json' } })
+        }
+        if (request.headers.get('content-type')?.split(';')[0].trim().toLowerCase() !== 'application/json') return reply(415)
+        let input, prepared
+        try { input = await boundedBody(request); prepared = await preparePublication(input) }
+        catch (error) { return reply(error.message === 'too-large' ? 413 : 400) }
+        if (input.expectedRevision !== record.revision) return reply(409)
+        const context = createVaultContext({ vault, record: { owner: record.owner, publication: prepared.publication, revision: input.expectedRevision + 1, manifest: prepared.manifest }, deployment, request: { origin: url.origin, path: url.pathname } })
+        const before = await verifyVaultPrivacy(privacy, { ...context, phase: 'before-upload' })
+        if (before.status !== 'verified') return reply(503, before.reason)
+        for (const file of prepared.files) await storage.put(`${vault}/${file.sha256}`, file.bytes)
+        const after = await verifyVaultPrivacy(privacy, { ...context, phase: 'before-activation' })
+        if (after.status !== 'verified' || after.policyRevision !== before.policyRevision) return reply(503, 'Protection changed or could not be verified. Publication was not activated.')
+        // Revalidate the credential after uploads and activation checks, immediately before commit.
+        const current = await identity.publish(request, vault)
+        if (!sameOwner(principal, current)) return reply(401, '', { 'WWW-Authenticate': 'Bearer realm="vault-publication"' })
+        const committed = await metadata.commit(vault, { owner: principal, expectedRevision: input.expectedRevision, manifest: prepared.manifest, publication: prepared.publication })
+        if (!committed) return reply(409)
+        return new Response(JSON.stringify({ schema: 'atelier-vault-receipt/v1', vault, revision: input.expectedRevision + 1, publication: prepared.publication }), { status: 201, headers: { ...headers, 'Content-Type': 'application/json' } })
+      }
+      if (!['GET', 'HEAD'].includes(request.method)) return reply(405, '', { Allow: 'GET, HEAD' })
+      const principal = await identity.read(request)
+      if (!principal) return reply(401)
+      const record = await metadata.get(vault)
+      if (!sameOwner(principal, record?.owner)) return reply(404)
+      if (!home && !record.manifest.some(file => file.path === parts.slice(1).join('/'))) return reply(404)
+      const protection = await verifyVaultPrivacy(privacy, createVaultContext({ vault, record, deployment, request: { origin: url.origin, path: url.pathname } }))
+      if (home) return new Response(request.method === 'HEAD' ? null : renderVaultHome({ vault, revision: record.revision, manifest: record.manifest, privacy: protection, query: url.searchParams.get('q') || '' }), { headers: { ...headers, 'Content-Type': 'text/html; charset=utf-8', 'Content-Security-Policy': vaultHomePolicy } })
+      if (protection.status !== 'verified') return reply(503, protection.reason)
+      const path = parts.slice(1).join('/')
+      if (!validPath(path)) return reply(404)
+      const file = record.manifest.find(entry => entry.path === path)
+      if (!file || !/^[a-f0-9]{64}$/.test(file.sha256) || !Object.values(TYPES).includes(file.type)) return reply(404)
+      const bytes = await storage.get(`${vault}/${file.sha256}`)
+      if (!bytes || bytes.length !== file.size || await digest(bytes) !== file.sha256) return reply(503)
+      return new Response(request.method === 'HEAD' ? null : bytes, { headers: { ...headers, 'Content-Type': file.type, 'Content-Length': String(bytes.length), ...(file.type === 'application/pdf' ? { 'Content-Disposition': 'attachment' } : {}) } })
+    } catch { return reply(503) }
+  }
+}

package/src/vault/source.mjs

@@ -0,0 +1,45 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { preparePublication } from './service.mjs'
+const LIMIT = 4 * 1024 * 1024
+/** Node-only bundle preparation. Select paths explicitly; never scan a repo. */
+export async function prepareVaultSource({ root, paths, expectedRevision }) {
+  if (typeof root !== 'string' || !path.isAbsolute(root) || !Array.isArray(paths) || !paths.length || paths.length > 100) throw new TypeError('Absolute artifact root and explicit paths required')
+  if (fs.lstatSync(root).isSymbolicLink()) throw new Error('Artifact root must not be a symlink')
+  const realRoot = fs.realpathSync(root)
+  if (!fs.statSync(realRoot).isDirectory()) throw new Error('Artifact root must be a directory')
+  let total = 0
+  const files = []
+  for (const name of paths) {
+    if (typeof name !== 'string' || name.length > 512 || !name.split('/').every(part => /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(part))) throw new Error('Invalid selected artifact path')
+    let file = realRoot
+    for (const part of name.split('/')) {
+      file = path.join(file, part)
+      if (fs.lstatSync(file).isSymbolicLink()) throw new Error('Selected artifacts must not traverse symlinks')
+    }
+    const before = fs.lstatSync(file)
+    if (!before.isFile() || before.nlink !== 1 || before.size > LIMIT) throw new Error('Selected artifact must be a bounded, unlinked regular file')
+    const fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0))
+    try {
+      const opened = fs.fstatSync(fd)
+      const resolved = fs.realpathSync(file)
+      if ((path.relative(realRoot, resolved).startsWith('..' + path.sep) || path.isAbsolute(path.relative(realRoot, resolved))) || opened.ino !== before.ino || opened.dev !== before.dev || !opened.isFile() || opened.nlink !== 1 || opened.size > LIMIT) throw new Error('Artifact changed during selection')
+      const data = Buffer.alloc(opened.size)
+      let offset = 0
+      while (offset < data.length) {
+        const count = fs.readSync(fd, data, offset, data.length - offset, offset)
+        if (!count) throw new Error('Artifact changed during read')
+        offset += count
+      }
+      const after = fs.fstatSync(fd)
+      const current = fs.lstatSync(file)
+      if (after.nlink !== 1 || current.nlink !== 1 || after.size !== opened.size || after.mtimeMs !== opened.mtimeMs || after.ctimeMs !== opened.ctimeMs || current.ino !== opened.ino || current.dev !== opened.dev || fs.realpathSync(file) !== resolved) throw new Error('Artifact changed during read')
+      total += data.length
+      if (total > LIMIT) throw new Error('Artifact bundle too large')
+      files.push({ path: name, base64: data.toString('base64') })
+    } finally { fs.closeSync(fd) }
+  }
+  const request = { schema: 'atelier-vault-publication/v1', contractVersion: '1.0.0', expectedRevision, files }
+  const prepared = await preparePublication(request)
+  return { request, publication: prepared.publication, manifest: prepared.manifest }
+}

package/src/vault/storage.mjs

@@ -0,0 +1,23 @@
+/** Provider SDKs/bindings are explicitly supplied by the host, never auto-loaded. */
+export function r2PrivateStorage(bucket) {
+  return {
+    async put(key, bytes) { await bucket.put(key, bytes) },
+    async get(key) {
+      const object = await bucket.get(key)
+      return object ? new Uint8Array(await object.arrayBuffer()) : null
+    },
+  }
+}
+export function vercelPrivateStorage(blob) {
+  return {
+    async put(key, bytes) {
+      await blob.put(key, bytes, { access: 'private', addRandomSuffix: false, allowOverwrite: true, contentType: 'application/octet-stream' })
+    },
+    async get(key) {
+      const object = await blob.get(key, { access: 'private', useCache: false })
+      if (!object) return null
+      if (object.statusCode !== 200 || !object.stream) throw new Error('Private storage unavailable')
+      return new Uint8Array(await new Response(object.stream).arrayBuffer())
+    },
+  }
+}

package/templates/distribution-workspace/.claude/launch.json

@@ -3,8 +3,12 @@
   "configurations": [
     {
       "name": "atelier",
-      "runtimeExecutable": "npx",
-      "runtimeArgs": ["atelier", "server"],
+      "runtimeExecutable": "node",
+      "runtimeArgs": [
+        "--input-type=module",
+        "--eval",
+        "import { runCli } from '@mnstry/atelier/cli'; process.exit(await runCli({ argv: ['server', ...process.argv.slice(1)] }));"
+      ],
       "port": 8137,
       "autoPort": true
     }

package/templates/distribution-workspace/gitignore

@@ -1,4 +1,5 @@
 .atelier-local/
+.atelier-local/obsidian.json
 atelier.local.json
 atelier.workspace.local.json
 atelier-attestation-key.local.json

package/templates/distribution-workspace/project/README.md

@@ -2,10 +2,10 @@
 title: "Shared Project Seed"
 kg:
   id: "project-alpha:seed"
-  type: "project-note"
+  type: "document"
   domain: "project"
   lifecycle: "draft"
-  status: "seed"
+  status: "draft"
   audience: "team"
   relations: []
 ---

package/templates/external-project-workspace/README.md

@@ -0,0 +1,45 @@
+# External-project adapter starter
+
+This invented example uses MNSTRY Atelier. The adapter owns configuration and
+a sample extension pack; the separate source repository owns canonical text.
+Runs, answers and review history remain ignored local state. Public audience
+labels do not grant publication, consent or runtime access.
+
+Create this scaffold with `atelier init --template external-project --target DIR`.
+The target must not exist. No Git repository, hook or remote is created.
+Initialize the adapter and its source directory as separate repositories when
+ready; the adapter ignores `source/`. To connect an existing repository instead,
+pass `--repo-path source=PATH` consistently, or use an ignored local overlay.
+Keep domain vocabulary and methods in your own adapter and source repositories.
+Replace the synthetic actor in the boundary policy with your actual policy.
+
+Using the installed package's CLI, from the adapter directory:
+
+```sh
+atelier lock provenance
+atelier config check --explain
+atelier extension-pack validate
+atelier graph
+atelier project
+atelier readiness
+atelier review packs
+atelier review run sample.readiness:contract-gate --answers answers.example.json
+atelier dev --review
+```
+
+Open `/review` on the displayed local address. Use repository `source` and
+`README.md` to leave a question. Use the returned run ID to review its claims.
+The evaluator measures answer completeness only. Read and judge the evidence;
+acceptance creates a handoff, never a canonical edit. Use `atelier review history`
+and `atelier review handoff REQUEST_ID` to inspect records locally.
+
+Real answers and responses belong in ignored local state, not the tracked
+example answer file. Reopening recovers saved contributions; missing or failed
+saves remain visible. Stop/start the foreground sidecar with the same project
+and reopen the same document. This does not establish cross-computer access.
+
+For CI, compose the root's existing consumer, portability, boundary and
+private-disclosure checks. No new CI run or provider is triggered by this template.
+Before changing the pack, run `atelier upgrade --dry-run`, retain historical
+pack content, update its lifecycle declaration and lock through your reviewed
+migration process, and run the checks again. Never reinterpret old run evidence.