@sentropic/artifacts 0.2.7 → 0.2.8

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 0.2.8
+
+- Content hosts use a single UUID label: `https://<id>.<base>/` resolves server-side,
+  either an artifact id (serves its current release) or a release id (serves that
+  frozen version). `parseContentHost` now returns `{ kind: 'id', id }` for exactly one
+  UUID label and nothing else; the former `<id>.pinned.<base>` form, two-label hosts and
+  foreign bases do not route.
+- Unknown ids return a uniform 404: the artifact and release lookups always both run,
+  and "no such artifact" and "no such release" share the same response body and timing
+  class, without revealing which kind exists. Digest verification and the deny rules
+  (service workers, traversal) are unchanged.
+- One wildcard per base at the edge: the `*.pinned.<base>` TLS host and ingress rule are
+  removed from the prod and preprod artifact-content overlays. No legacy fallback; immo
+  handles 301 redirects for its old hosts on its side.
+- Rename decision (recorded): the `pinnedUrl` field is renamed to `versionUrl` in the
+  `publicationUrls` hook, the summary, versions and source-read outputs and the result
+  schema, now holding `https://<releaseId>.<base>/`. The converged contract allows the
+  rename: no consumer outside `packages/artifacts` references `pinnedUrl`/`stableUrl`
+  (verified by grep over ui/contracts/e2e/api/cluster-mesh), and every in-package
+  consumer is updated atomically in this release.
+
 ## 0.2.7
 
 - Fix the `artifacts_get_source` wire payload that broke page editing in claude.ai:

package/README.md

@@ -386,8 +386,10 @@ a registrable domain. Assets within the same artifact origin remain loadable.
 - `src/content/grants.ts` — 55s HMAC content grants (60s cutoff budget) and
   single-use activation tickets bound to subject, artifact, exact release
   and channel (`stable` or `pinned`); secrets and clocks are injected.
-- `src/content/routing.ts` — stable (`<artifactId>.<base>`) and pinned
-  (`<releaseId>.pinned.<base>`) single-UUID origins; safe path resolution.
+- `src/content/routing.ts` — one wildcard per base with a single UUID label
+  `<id>.<base>`, resolved server-side as an artifact (current release) or a
+  release (frozen version); the former `<id>.pinned.<base>` form no longer
+  routes; safe path resolution.
 - `src/content/headers.ts` — no-store/nosniff/frame-denial/CSP headers and
   the host-only `__Host-artifacts_grant` cookie.
 - `src/content/handler.ts` — transport-free content serving: per-version
@@ -403,12 +405,14 @@ a registrable domain. Assets within the same artifact origin remain loadable.
   definition wrapper (the optional peer is required here and by the root barrel).
 
 Ticket issuance and redemption both require `subjectId`, `artifactId`,
-`releaseId` and `channel`. The handler checks the release resolved from the
-requested origin and its channel before minting a grant. A stable ticket
-issued for r1 cannot activate r2 after republish, and a stable ticket cannot
-activate a pinned origin (or vice versa). Mismatches return 401 without a
-grant cookie and preserve the ticket for a matching request. Tickets expire
-at `expiresAt` (120 seconds by default) and can be redeemed only once.
+`releaseId` and `channel`. The handler resolves the single UUID label
+server-side — an artifact id serves its current release, a release id serves
+that frozen version — and checks the resolved release and its channel before
+minting a grant. A stable ticket issued for r1 cannot activate r2 after
+republish, and a stable ticket cannot activate a release id (or vice versa).
+Mismatches return 401 without a grant cookie and preserve the ticket for a
+matching request. Tickets expire at `expiresAt` (120 seconds by default) and
+can be redeemed only once.
 
 ## First publish (bootstrap)
 

package/dist/content/handler.js

@@ -1,13 +1,17 @@
 /**
- * L-5d — transport-free content handler (spec-v8 §9 5d). Serves raw
- * release bytes on the separate content domain (never HTML on the
- * control origin). Per-version activation: a single-use ticket redeemed
- * by the host-authenticated subject mints a short subject+artifact+
- * release grant as a host-only cookie. Every request re-verifies the
- * grant AND live ACL/lifecycle state, so withdrawal cuts readers at the
- * next request (inside the 60s budget, no cache reliance). Republish
- * demands fresh consent on the stable origin (401); pinned origins keep
- * their release. Unknown/unreadable → same 404; bad grants → 401.
+ * L-5d — transport-free content handler (owner decision relayed by immo).
+ * Serves raw release bytes on the separate content domain (never HTML on
+ * the control origin). One wildcard per base: the single UUID label
+ * `<id>.<base>` is resolved server-side — an artifact id serves its
+ * current release, a release id serves that frozen version; an unknown id
+ * gets the same 404 response and timing class whatever kind it would be.
+ * Per-version activation: a single-use ticket redeemed by the
+ * host-authenticated subject mints a short subject+artifact+release grant
+ * as a host-only cookie. Every request re-verifies the grant AND live
+ * ACL/lifecycle state, so withdrawal cuts readers at the next request
+ * (inside the 60s budget, no cache reliance). Republish demands fresh
+ * consent on an artifact id (401); a release id keeps its release.
+ * Unknown/unreadable → same 404; bad grants → 401.
  */
 import { errorBody } from '../http.js';
 import { CONTENT_GRANT_TTL_SECONDS } from './grants.js';
@@ -65,29 +69,36 @@ export function createContentHandler(deps) {
         const origin = parseContentHost(request.host, deps.baseDomain);
         if (origin === undefined)
             return fail(404);
+        // One label, resolved server-side: an artifact id serves its current
+        // release, a release id serves that frozen version. Both lookups
+        // always run, so an unknown id gets the same 404 and timing class
+        // whether it is a missing artifact or a missing release.
+        const [current, byRelease] = await Promise.all([
+            deps.publication.getCurrent(origin.id),
+            deps.publication.getRelease(origin.id),
+        ]);
         let artifactId;
         let release;
-        if (origin.kind === 'stable') {
-            artifactId = origin.artifactId;
-            release = await deps.publication.getCurrent(artifactId);
+        let channel;
+        if (current !== undefined) {
+            artifactId = origin.id;
+            release = current;
+            channel = 'stable';
         }
-        else {
-            release = await deps.publication.getRelease(origin.releaseId);
-            if (release === undefined)
-                return fail(404);
-            const owner = JSON.parse(release.manifest).artifactId;
-            if (typeof owner !== 'string')
-                return fail(404);
-            artifactId = owner;
+        else if (byRelease !== undefined) {
+            artifactId = byRelease.artifactId;
+            release = byRelease;
+            channel = 'pinned';
         }
-        if (release === undefined)
+        else {
             return fail(404);
+        }
         if (request.ticket !== undefined) {
             if (request.actorId === undefined || request.actorId.length === 0)
                 return fail(401);
             try {
                 await deps.tickets.redeem(request.ticket, {
-                    subjectId: request.actorId, artifactId, releaseId: release.releaseId, channel: origin.kind,
+                    subjectId: request.actorId, artifactId, releaseId: release.releaseId, channel,
                 });
             }
             catch {

package/dist/content/routing.d.ts

@@ -1,9 +1,6 @@
 export type ContentOrigin = {
-    kind: 'stable';
-    artifactId: string;
-} | {
-    kind: 'pinned';
-    releaseId: string;
+    kind: 'id';
+    id: string;
 };
 /** Parse a content Host header against the configured base domain. */
 export declare function parseContentHost(host: string, baseDomain: string): ContentOrigin | undefined;

package/dist/content/routing.js

@@ -1,11 +1,10 @@
 /**
- * L-5d — content routing (spec-v8 §9 5d).
- *
- * Two origins per artifact, each with a single UUID label: the stable
- * origin `<artifactId>.<base>` follows the current release; the pinned
- * origin `<releaseId>.pinned.<base>` serves one immutable release. Two
- * concatenated UUIDs, extra labels, foreign bases and non-UUID labels
- * never route. Paths normalize to manifest file paths with an
+ * L-5d — content routing (owner decision relayed by immo): one wildcard
+ * per base with a single UUID label `<id>.<base>`. The label is resolved
+ * server-side by the handler — an artifact id serves its current release,
+ * a release id serves that frozen version. The former `<id>.pinned.<base>`
+ * form, two labels, foreign bases and non-UUID labels never route (no
+ * legacy fallback). Paths normalize to manifest file paths with an
  * `index.html` default; traversal, empty segments, backslashes and
  * encoded traversal never resolve (no history fallback hiding missing
  * assets). Service workers are detectable so the handler can deny them.
@@ -21,10 +20,7 @@ export function parseContentHost(host, baseDomain) {
         return undefined;
     const labels = normalized.slice(0, normalized.length - base.length - 1).split('.');
     if (labels.length === 1 && isArtifactId(labels[0])) {
-        return { kind: 'stable', artifactId: labels[0] };
-    }
-    if (labels.length === 2 && labels[1] === 'pinned' && isArtifactId(labels[0])) {
-        return { kind: 'pinned', releaseId: labels[0] };
+        return { kind: 'id', id: labels[0] };
     }
     return undefined;
 }

package/dist/http.d.ts

@@ -51,10 +51,10 @@ export interface HttpAppDeps {
     acls: AclStore;
     lifecycle: Pick<LifecycleService, 'stateOf' | 'canRead' | 'getReleaseState'>;
     isApprovedAccount?: (principalId: string) => boolean;
-    /** One trusted URL policy shared by HTTP and MCP receipts. */
+    /** One trusted URL policy shared by HTTP and MCP receipts: the artifact page and the exact version page. */
     publicationUrls?: (artifactId: string, releaseId: string) => {
         stableUrl: string;
-        pinnedUrl: string;
+        versionUrl: string;
     };
 }
 export interface ArtifactApp {

package/dist/mcp-core.d.ts

@@ -10,7 +10,7 @@ export { createRadarKeyDerivation } from './server/command-identity.js';
 export type { ArtifactKeyDerivationBinding } from './server/command-identity.js';
 export declare const ARTIFACTS_PROVIDER_ID = "sentropic.artifacts";
 export declare const ARTIFACTS_APP_ID = "sentropic-artifacts";
-export declare const ARTIFACTS_PROVIDER_VERSION = "0.2.7";
+export declare const ARTIFACTS_PROVIDER_VERSION = "0.2.8";
 export declare const ARTIFACTS_TOOL_NAMES: readonly ["artifacts_get_template", "artifacts_get_api_guide", "artifacts_ensure", "artifacts_publish", "artifacts_create_upload", "artifacts_commit_upload", "artifacts_list", "artifacts_get", "artifacts_get_source", "artifacts_fork", "artifacts_set_access", "artifacts_promote", "artifacts_renew", "artifacts_delete", "artifacts_restore", "artifacts_list_versions", "artifacts_revert"];
 export type ArtifactsToolName = (typeof ARTIFACTS_TOOL_NAMES)[number];
 export declare const ARTIFACTS_TOOL_SPECS: {

package/dist/mcp-core.js

@@ -7,7 +7,7 @@ export * from './profile/index.js';
 export { createRadarKeyDerivation } from './server/command-identity.js';
 export const ARTIFACTS_PROVIDER_ID = 'sentropic.artifacts';
 export const ARTIFACTS_APP_ID = 'sentropic-artifacts';
-export const ARTIFACTS_PROVIDER_VERSION = '0.2.7';
+export const ARTIFACTS_PROVIDER_VERSION = '0.2.8';
 export const ARTIFACTS_TOOL_NAMES = ARTIFACT_CAPABILITY_NAMES;
 export const ARTIFACTS_TOOL_SPECS = ARTIFACTS_TOOL_NAMES.map((name) => ({ name,
     description: name === 'artifacts_get_source'

package/dist/server/result-schema.js

@@ -19,7 +19,7 @@ const pointer = object({ variant: { enum: ['pointer_conflict'] }, artifactId: st
     expectedCurrentReleaseId: nullable, currentReleaseId: nullable, currentDigest: nullable,
     currentSource: object({ artifactId: string, releaseId: string, digest: nullable,
         manifest: string, files: { type: 'array', items: sourceFile }, sourceRef: { type: ['object', 'null'] },
-        guideRef, stableUrl: string, pinnedUrl: string }, ['artifactId', 'releaseId', 'digest', 'manifest', 'files', 'sourceRef', 'guideRef']),
+        guideRef, stableUrl: string, versionUrl: string }, ['artifactId', 'releaseId', 'digest', 'manifest', 'files', 'sourceRef', 'guideRef']),
 }, ['variant', 'artifactId', 'expectedCurrentReleaseId', 'currentReleaseId', 'currentDigest']);
 const common = { invocationId: string,
     commitState: { enum: ['not_committed', 'committed', 'unknown'] } };

package/dist/server/source-read.d.ts

@@ -9,7 +9,7 @@ export interface SourceReadPorts {
     getBlob(key: string): Promise<Uint8Array | undefined>;
     urls?: (artifactId: string, releaseId: string) => {
         stableUrl: string;
-        pinnedUrl: string;
+        versionUrl: string;
     };
     /** Guide reference returned instead of embedding the guide body. */
     guideRef?: {
@@ -27,7 +27,7 @@ export interface SourceReadInput {
 /** Read author bytes only. Provenance never substitutes for a stored snapshot. */
 export declare function readArtifactSource(ports: SourceReadPorts, input: SourceReadInput): Promise<{
     stableUrl?: string | undefined;
-    pinnedUrl?: string | undefined;
+    versionUrl?: string | undefined;
     artifactId: string;
     releaseId: string;
     digest: string;

package/dist/server/summary.d.ts

@@ -10,7 +10,7 @@ export declare function artifactSummary(input: {
     };
     urls?: (artifactId: string, releaseId: string) => {
         stableUrl: string;
-        pinnedUrl: string;
+        versionUrl: string;
     };
     approved?: (principalId: string) => boolean;
 }): {
@@ -33,7 +33,7 @@ export declare function artifactSummary(input: {
     currentReleaseId: string | null;
     digest: string | null;
     stableUrl: string | null;
-    pinnedUrl: string | null;
+    versionUrl: string | null;
     title: string;
     description: string;
     icon: string | null;

package/dist/server/summary.js

@@ -8,7 +8,7 @@ export function artifactSummary(input) {
         storageScopeId: acl.storageScopeId, state, isPublic: acl.isPublic, withdrawn: state === 'withdrawn',
         createdAt: acl.createdAt ?? null, updatedAt: acl.updatedAt ?? null,
         currentReleaseId: current?.releaseId ?? null, digest: current ? parseManifest(current.manifest).digest ?? null : null,
-        stableUrl: urls?.stableUrl ?? null, pinnedUrl: current ? urls?.pinnedUrl ?? null : null,
+        stableUrl: urls?.stableUrl ?? null, versionUrl: current ? urls?.versionUrl ?? null : null,
         title: acl.metadata?.title ?? acl.title ?? acl.bindingName ?? artifactId,
         description: acl.metadata?.description ?? acl.description ?? '',
         icon: acl.metadata?.icon !== undefined ? acl.metadata.icon : acl.icon ?? null,

package/dist/server/versions.d.ts

@@ -9,7 +9,7 @@ export declare function artifactVersions(input: {
     cursor?: string;
     state(releaseId: string): Promise<string>;
     urls?: (artifactId: string, releaseId: string) => {
-        pinnedUrl: string;
+        versionUrl: string;
     };
 }): Promise<{
     artifactId: string;
@@ -23,7 +23,7 @@ export declare function artifactVersions(input: {
         revertedFromReleaseId: string | null;
         digest: string;
         isCurrent: boolean;
-        pinnedUrl: string | null;
+        versionUrl: string | null;
     }[];
     nextCursor: string | null;
 }>;

package/dist/server/versions.js

@@ -29,7 +29,7 @@ export async function artifactVersions(input) {
             authorPrincipalId: release.authorPrincipalId ?? null, parentReleaseId: release.parentReleaseId ?? null,
             revertedFromReleaseId: release.revertedFromReleaseId ?? null, digest: release.manifestDigest,
             isCurrent: release.releaseId === input.currentReleaseId,
-            pinnedUrl: state === 'purged' ? null : input.urls?.(input.artifactId, release.releaseId).pinnedUrl ?? null };
+            versionUrl: state === 'purged' ? null : input.urls?.(input.artifactId, release.releaseId).versionUrl ?? null };
     }));
     const last = page.at(-1);
     const position = (value) => ({ createdAt: value.createdAt, releaseId: value.releaseId });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentropic/artifacts",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "description": "Generic configurable artifacts MCP and artifact service: StorageScope/Artifact/Binding/Release model, canonical manifests, object authorization, idempotent intents (spec-v8 §9).",
   "type": "module",
   "license": "MIT",