@sentropic/artifacts 0.1.0 → 0.1.1

package/README.md

@@ -1,8 +1,8 @@
 # @sentropic/artifacts — generic artifact contracts (L-5a)
 
 Generic, host-independent artifact domain state for the Sentropic artifacts
-provider (`sentropic.artifacts`, spec-v8 §9). Single unreleased `0.1.0`
-candidate covering L-5a–5e; no publication before the final merge.
+provider (`sentropic.artifacts`, spec-v8 §9), covering L-5a–5e. Version
+`0.1.1` fixes activation ticket release and channel binding (FL-ACT).
 
 ## What's here (L-5a)
 
@@ -51,7 +51,8 @@ No Immo defaults, URLs or bindings in generic source.
 ## What's here (L-5d–5e)
 
 - `src/content/grants.ts` — 55s HMAC content grants (60s cutoff budget) and
-  single-use bound activation tickets; secrets and clocks are injected.
+  single-use activation tickets bound to subject, artifact, exact release
+  and channel (`stable` or `pinned`); secrets and clocks are injected.
 - `src/content/routing.ts` — stable (`<artifactId>.<base>`) and pinned
   (`<releaseId>.pinned.<base>`) single-UUID origins; safe path resolution.
 - `src/content/headers.ts` — no-store/nosniff/frame-denial/CSP headers and
@@ -68,11 +69,19 @@ No Immo defaults, URLs or bindings in generic source.
   `@sentropic/mcp-platform` kernel registry definition (the platform is
   an optional peer, required only by the `./mcp` subpath).
 
+Ticket issuance and redemption both require `subjectId`, `artifactId`,
+`releaseId` and `channel`. The handler checks the release resolved from the
+requested origin and its channel before minting a grant. A stable ticket
+issued for r1 cannot activate r2 after republish, and a stable ticket cannot
+activate a pinned origin (or vice versa). Mismatches return 401 without a
+grant cookie and preserve the ticket for a matching request. Tickets expire
+at `expiresAt` (120 seconds by default) and can be redeemed only once.
+
 ## First publish (bootstrap)
 
-`0.1.0` is the single candidate covering L-5a–5e; it is not on npm yet,
-so the steady-state OIDC job cannot publish before an npm trusted
-publisher exists. Bootstrap sequence (owner-run, never automated here):
+The steady-state OIDC job requires an npm trusted publisher. For the first
+publication, use the current package version and this bootstrap sequence
+(owner-run, never automated here):
 
 1. Trigger the `bootstrap-publish` workflow manually with
    `bootstrap_publish_target=artifacts` (runs

package/dist/content/grants.d.ts

@@ -24,11 +24,12 @@ export declare function createHmacGrantSigner(options: {
     clock?: () => number;
     ttlSeconds?: number;
 }): GrantSigner;
-export interface TicketRecord {
+export interface TicketBinding extends GrantIssueInput {
+    releaseId: string;
+    channel: 'stable' | 'pinned';
+}
+export interface TicketRecord extends TicketBinding {
     ticketId: string;
-    subjectId: string;
-    artifactId: string;
-    releaseId?: string;
     expiresAt: number;
 }
 export interface TicketStore {
@@ -41,14 +42,11 @@ export interface TicketStore {
 /** In-memory TicketStore double for unit tests. */
 export declare function createMemoryTicketStore(): TicketStore;
 export interface TicketService {
-    issue(input: GrantIssueInput): Promise<{
+    issue(input: TicketBinding): Promise<{
         ticketId: string;
         expiresAt: number;
     }>;
-    redeem(ticketId: string, expected: {
-        subjectId: string;
-        artifactId: string;
-    }): Promise<TicketRecord>;
+    redeem(ticketId: string, expected: TicketBinding): Promise<TicketRecord>;
 }
 /** Single-use bound tickets; mismatched attempts do not consume the ticket. */
 export declare function createTicketService(options: {

package/dist/content/grants.js

@@ -7,7 +7,7 @@
  * host-injected secret, bound to subject + artifact (+ pinned release),
  * and verified fail-closed (signature, shape, lifetime cap, expiry,
  * future-issued beyond the skew budget). Activation tickets are
- * single-use and bound the same way; ticket IDs come from an injected
+ * single-use and bound to an exact release and channel; ticket IDs come from an injected
  * port and MUST be unguessable (default: crypto UUIDs). A grant never
  * replaces the per-request ACL recheck in the content handler.
  */
@@ -101,15 +101,23 @@ export function createTicketService(options) {
     const clock = options.clock ?? (() => Date.now());
     const ids = options.ids ?? (() => crypto.randomUUID());
     const ttlMs = (options.ttlSeconds ?? CONTENT_TICKET_TTL_SECONDS) * 1000;
+    if (!Number.isFinite(ttlMs) || ttlMs <= 0)
+        throw new Error('invalid ticket: lifetime');
     return {
         async issue(input) {
+            if (typeof input.subjectId !== 'string' || input.subjectId.length === 0 ||
+                typeof input.artifactId !== 'string' || input.artifactId.length === 0 ||
+                typeof input.releaseId !== 'string' || input.releaseId.length === 0 ||
+                (input.channel !== 'stable' && input.channel !== 'pinned'))
+                throw new Error('invalid ticket: binding');
             const ticketId = ids();
             const expiresAt = clock() + ttlMs;
             await options.store.put({
                 ticketId,
                 subjectId: input.subjectId,
                 artifactId: input.artifactId,
-                ...(input.releaseId === undefined ? {} : { releaseId: input.releaseId }),
+                releaseId: input.releaseId,
+                channel: input.channel,
                 expiresAt,
             });
             return { ticketId, expiresAt };
@@ -118,11 +126,12 @@ export function createTicketService(options) {
             const record = await options.store.peek(ticketId);
             if (record === undefined)
                 throw new Error('invalid ticket');
-            if (clock() > record.expiresAt) {
+            if (clock() >= record.expiresAt) {
                 await options.store.remove(ticketId);
                 throw new Error('ticket expired');
             }
-            if (record.subjectId !== expected.subjectId || record.artifactId !== expected.artifactId) {
+            if (record.subjectId !== expected.subjectId || record.artifactId !== expected.artifactId ||
+                record.releaseId !== expected.releaseId || record.channel !== expected.channel) {
                 throw new Error('invalid ticket: binding mismatch');
             }
             const taken = await options.store.take(ticketId);

package/dist/content/handler.js

@@ -80,7 +80,9 @@ export function createContentHandler(deps) {
                 if (request.actorId === undefined || request.actorId.length === 0)
                     return fail(401);
                 try {
-                    await deps.tickets.redeem(request.ticket, { subjectId: request.actorId, artifactId });
+                    await deps.tickets.redeem(request.ticket, {
+                        subjectId: request.actorId, artifactId, releaseId: release.releaseId, channel: origin.kind,
+                    });
                 }
                 catch {
                     return fail(401);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sentropic/artifacts",
-  "version": "0.1.0",
-  "description": "Generic configurable artifacts MCP and artifact service: StorageScope/Artifact/Binding/Release model, canonical manifests, object authorization, idempotent intents (spec-v8 §9). Single 0.1.0 candidate for L-5a–5e; unpublished.",
+  "version": "0.1.1",
+  "description": "Generic configurable artifacts MCP and artifact service: StorageScope/Artifact/Binding/Release model, canonical manifests, object authorization, idempotent intents (spec-v8 §9).",
   "type": "module",
   "license": "MIT",
   "repository": {