@sequenceholdings/artifact-studio 0.1.0

package/dist/cli.js

@@ -0,0 +1,475 @@
+#!/usr/bin/env node
+import { cp, mkdir, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join, relative, resolve } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { getJson, getJsonOr404, postJson } from './api.js';
+import { readLocalConfig, resolveEnvironment, writeLocalConfig, writeTokenConfig, } from './config.js';
+import { buildArtifactStudioProject, writeBuildArtifact } from './build.js';
+import { hasArtifactStudioManifest, readArtifactStudioSource } from './project.js';
+import { getAccessToken, loginWithPkce } from './auth.js';
+const COMMANDS = [
+    'init', 'login', 'logout', 'whoami', 'link', 'env', 'status',
+    'validate', 'build', 'plan', 'deploy', 'dev', 'promote', 'pull', 'rollback',
+];
+const USAGE = `usage:
+  artifact-studio init <dir>
+  artifact-studio login [--token <token>]
+  artifact-studio logout
+  artifact-studio whoami --env <env>
+  artifact-studio link --env <env> [--project <id>]
+  artifact-studio env list|use <env>
+  artifact-studio status [--env <env>]
+  artifact-studio validate [dir]
+  artifact-studio build [dir] [--out dist/artifact-bundle.json]
+  artifact-studio plan [dir] --env <env>
+  artifact-studio deploy [dir] --env <env>
+  artifact-studio dev [dir] --env <env> [--once] [--key default]
+  artifact-studio promote <deployment-id> --env <env>
+  artifact-studio pull <project-id> --env <env> --out <dir>
+  artifact-studio rollback <deployment-id> --env <env>`;
+export async function runCli(argv = process.argv.slice(2)) {
+    const parsed = parseArgs(argv);
+    if ('error' in parsed) {
+        console.error(parsed.error);
+        return 1;
+    }
+    switch (parsed.command) {
+        case 'init': return initCommand(parsed);
+        case 'login': return loginCommand(parsed);
+        case 'logout': return logoutCommand();
+        case 'whoami': return whoamiCommand(parsed);
+        case 'link': return linkCommand(parsed);
+        case 'env': return envCommand(parsed);
+        case 'status': return statusCommand(parsed);
+        case 'validate': return validateCommand(parsed);
+        case 'build': return buildCommand(parsed);
+        case 'plan': return planCommand(parsed);
+        case 'deploy': return deployCommand(parsed);
+        case 'dev': return devCommand(parsed);
+        case 'promote': return promoteCommand(parsed);
+        case 'pull': return pullCommand(parsed);
+        case 'rollback': return rollbackCommand(parsed);
+    }
+}
+function parseArgs(argv) {
+    if (argv[0] === '--')
+        argv = argv.slice(1);
+    const [rawCommand, ...rest] = argv;
+    if (!rawCommand || !COMMANDS.includes(rawCommand))
+        return { error: USAGE };
+    const positional = [];
+    const flags = {};
+    for (let i = 0; i < rest.length; i++) {
+        const arg = rest[i];
+        if (arg.startsWith('--')) {
+            const key = arg.slice(2);
+            const next = rest[i + 1];
+            if (next && !next.startsWith('--')) {
+                flags[key] = next;
+                i += 1;
+            }
+            else {
+                flags[key] = true;
+            }
+        }
+        else {
+            positional.push(arg);
+        }
+    }
+    return { command: rawCommand, positional, flags };
+}
+async function initCommand(args) {
+    const dir = resolve(args.positional[0] ?? '.');
+    const name = dir.split('/').filter(Boolean).at(-1) ?? 'my-artifact';
+    const slug = slugify(name);
+    const moduleDir = dirname(fileURLToPath(import.meta.url));
+    const templateRoot = existsSync(resolve(moduleDir, 'templates', 'react-vite'))
+        ? resolve(moduleDir, 'templates', 'react-vite')
+        : resolve(moduleDir, '..', 'templates', 'react-vite');
+    await mkdir(dir, { recursive: true });
+    await cp(templateRoot, dir, { recursive: true, force: false, errorOnExist: false });
+    await replaceInFile(join(dir, 'artifact.bundle.yml'), /\{\{slug\}\}/g, slug);
+    await replaceInFile(join(dir, 'artifact.bundle.yml'), /\{\{title\}\}/g, titleize(slug));
+    await replaceInFile(join(dir, 'package.json'), /\{\{slug\}\}/g, slug);
+    // TODO(npm-publish): switch back to ^semver from the registry once both
+    // @sequenceholdings/atlas-ui and @sequenceholdings/artifact-studio are published to npm.
+    const pkgJson = join(dir, 'package.json');
+    await replaceInFile(pkgJson, /"@sequenceholdings\/atlas-ui": "workspace:\*"/, `"@sequenceholdings/atlas-ui": ${JSON.stringify(`link:${resolveAtlasUiLocalPath()}`)}`);
+    await replaceInFile(pkgJson, /"@sequenceholdings\/artifact-studio": "workspace:\*"/, `"@sequenceholdings/artifact-studio": ${JSON.stringify(`link:${resolveArtifactStudioLocalPath()}`)}`);
+    console.log(`[artifact-studio] initialized ${dir}`);
+    const relativeDir = relative(process.cwd(), dir) || '.';
+    console.log(`Next: cd ${relativeDir} && pnpm install && artifact-studio login && artifact-studio dev --env staging`);
+    return 0;
+}
+function resolveAtlasUiLocalPath() {
+    const req = createRequire(import.meta.url);
+    return dirname(req.resolve('@sequenceholdings/atlas-ui/package.json'));
+}
+function resolveArtifactStudioLocalPath() {
+    return resolve(dirname(fileURLToPath(import.meta.url)), '..');
+}
+async function loginCommand(args) {
+    const token = typeof args.flags.token === 'string' ? args.flags.token : undefined;
+    if (token) {
+        await writeTokenConfig({ accessToken: token });
+        console.log('[artifact-studio] saved access token');
+        return 0;
+    }
+    await loginWithPkce();
+    console.log('[artifact-studio] logged in');
+    return 0;
+}
+async function logoutCommand() {
+    await writeTokenConfig({});
+    console.log('[artifact-studio] logged out');
+    return 0;
+}
+async function whoamiCommand(args) {
+    const env = await envFromArgs(args);
+    const token = await getRequiredToken(args);
+    const data = await getJson({
+        baseUrl: env.url,
+        token,
+        path: '/api/auth/me',
+    }).catch(async () => {
+        const projects = await getJson({ baseUrl: env.url, token, path: '/api/artifact-studio/projects' });
+        return { subject: `authenticated (${projects.projects.length} visible project(s))` };
+    });
+    console.log('user' in data ? (data.user?.email ?? data.user?.sub ?? 'authenticated') : data.subject);
+    return 0;
+}
+async function linkCommand(args) {
+    const dir = resolve(args.positional[0] ?? '.');
+    const env = await envFromArgs(args);
+    const token = await getRequiredToken(args);
+    const source = await readArtifactStudioSource(dir);
+    const requestedProjectId = typeof args.flags.project === 'string' ? args.flags.project : undefined;
+    let project = null;
+    if (requestedProjectId) {
+        const data = await getJson({ baseUrl: env.url, token, path: `/api/artifact-studio/projects/${requestedProjectId}` });
+        project = data.project;
+    }
+    else {
+        project = await fetchRemoteProject({ env: env.url, token, slug: source.manifest.artifact.project_id });
+    }
+    if (!project) {
+        const created = await postJson({
+            baseUrl: env.url,
+            token,
+            path: '/api/artifact-studio/projects',
+            body: {
+                title: source.manifest.artifact.title,
+                slug: source.manifest.artifact.project_id,
+                description: source.manifest.artifact.description ?? null,
+            },
+        });
+        project = created.project;
+    }
+    await writeLocalConfig({
+        projectId: project.id,
+        projectSlug: project.slug,
+        defaultEnv: env.name,
+        previewKey: 'default',
+    }, dir);
+    console.log(`[artifact-studio] linked ${project.title} (${project.id})`);
+    return 0;
+}
+async function envCommand(args) {
+    const [subcommand, value] = args.positional;
+    if (subcommand === 'list') {
+        console.log('local\nstaging\nproduction\nbanksouth');
+        return 0;
+    }
+    if (subcommand === 'use') {
+        const env = resolveEnvironment(value);
+        const config = await readLocalConfig();
+        await writeLocalConfig({ ...config, defaultEnv: env.name });
+        console.log(`[artifact-studio] default env set to ${env.name}`);
+        return 0;
+    }
+    console.error('artifact-studio env list|use <env>');
+    return 1;
+}
+async function statusCommand(args) {
+    const env = await envFromArgs(args);
+    const config = await readLocalConfig();
+    const source = hasArtifactStudioManifest('.') ? await readArtifactStudioSource('.') : null;
+    console.log(`env: ${env.name}`);
+    console.log(`url: ${env.url}`);
+    console.log(`projectId: ${config.projectId ?? '(not linked)'}`);
+    if (source)
+        console.log(`source: ${source.sourceHash}`);
+    if (env.name === 'local') {
+        await fetch(`${env.url}/api/health`)
+            .then((response) => console.log(`local Atlas: ${response.ok ? 'ready' : `HTTP ${response.status}`}`))
+            .catch(() => console.log('local Atlas: not reachable (start Atlas on port 5001 or pass --env staging)'));
+    }
+    return 0;
+}
+async function validateCommand(args) {
+    const dir = resolve(args.positional[0] ?? '.');
+    const source = await readArtifactStudioSource(dir);
+    console.log(`[artifact-studio] valid ${source.manifest.bundle.name}`);
+    console.log(`[artifact-studio] files: ${source.files.length}`);
+    console.log(`[artifact-studio] source: ${source.sourceHash}`);
+    return 0;
+}
+async function buildCommand(args) {
+    const dir = resolve(args.positional[0] ?? '.');
+    const result = await buildArtifactStudioProject(dir);
+    const out = typeof args.flags.out === 'string' ? resolve(args.flags.out) : resolve(dir, 'dist', 'artifact-bundle.json');
+    await writeBuildArtifact(result, out);
+    console.log(`[artifact-studio] built ${result.manifest.bundle.name}`);
+    console.log(`[artifact-studio] source: ${result.sourceHash}`);
+    console.log(`[artifact-studio] bundle: ${result.bundleHash}`);
+    console.log(`[artifact-studio] wrote ${out}`);
+    return 0;
+}
+async function planCommand(args) {
+    const dir = resolve(args.positional[0] ?? '.');
+    const env = await envFromArgs(args);
+    const token = await getOptionalToken(args);
+    const result = await buildArtifactStudioProject(dir);
+    console.log(`[artifact-studio] plan ${result.manifest.artifact.project_id} -> ${env.name}`);
+    console.log(`  source: ${result.sourceHash}`);
+    console.log(`  bundle: ${result.bundleHash}`);
+    if (!token) {
+        console.log('  remote: skipped (run artifact-studio login)');
+        return 0;
+    }
+    const remote = await fetchRemoteProject({ env: env.url, token, slug: result.manifest.artifact.project_id });
+    if (!remote)
+        console.log('  action: create project and deploy');
+    else if (remote.activeDeployment?.sourceHash === result.sourceHash)
+        console.log('  action: no-op');
+    else
+        console.log(`  action: deploy over ${remote.activeDeployment?.version ?? 'no active deployment'}`);
+    return 0;
+}
+async function deployCommand(args) {
+    const dir = resolve(args.positional[0] ?? '.');
+    const env = await envFromArgs(args);
+    const token = await getRequiredToken(args);
+    const result = await buildArtifactStudioProject(dir);
+    const project = await ensureRemoteProject({ env: env.url, token, result, dir });
+    const deployment = await uploadDeployment({ env: env.url, token, projectId: project.id, result, channel: 'active', dir });
+    console.log(`[artifact-studio] deployed ${project.title} ${deployment.version}`);
+    console.log(`${env.url}/artifact-studio/projects/${project.id}/deployments/${deployment.id}`);
+    return 0;
+}
+async function devCommand(args) {
+    const dir = resolve(args.positional[0] ?? '.');
+    const env = await envFromArgs(args);
+    const token = await getRequiredToken(args);
+    const config = await readLocalConfig(dir);
+    const previewKey = typeof args.flags.key === 'string' ? args.flags.key : config.previewKey ?? 'default';
+    const once = args.flags.once === true;
+    let projectId = null;
+    let lastSourceHash = null;
+    let buildCount = 0;
+    async function pushPreview() {
+        const result = await buildArtifactStudioProject(dir);
+        if (result.sourceHash === lastSourceHash)
+            return;
+        lastSourceHash = result.sourceHash;
+        buildCount += 1;
+        if (!projectId) {
+            const project = await ensureRemoteProject({ env: env.url, token, result, dir });
+            projectId = project.id;
+        }
+        const deployment = await uploadDeployment({
+            env: env.url,
+            token,
+            projectId,
+            result,
+            channel: 'preview',
+            previewKey,
+            dir,
+            message: `Preview push ${buildCount}`,
+        });
+        console.log(`[artifact-studio] preview ${deployment.version}`);
+        console.log(`${env.url}/artifact-studio/projects/${projectId}/preview?key=${encodeURIComponent(previewKey)}`);
+    }
+    await pushPreview();
+    if (once)
+        return 0;
+    console.log('[artifact-studio] watching for changes. Press Ctrl+C to stop.');
+    await new Promise((resolvePromise) => {
+        const interval = setInterval(() => {
+            pushPreview().catch((error) => console.error(error instanceof Error ? error.message : error));
+        }, 1500);
+        process.on('SIGINT', () => {
+            clearInterval(interval);
+            resolvePromise();
+        });
+    });
+    return 0;
+}
+async function promoteCommand(args) {
+    const [deploymentId] = args.positional;
+    if (!deploymentId)
+        throw new Error('promote requires <deployment-id>');
+    const env = await envFromArgs(args);
+    const token = await getRequiredToken(args);
+    const config = await readLocalConfig();
+    if (!config.projectId)
+        throw new Error('Project is not linked. Run artifact-studio link.');
+    await postJson({
+        baseUrl: env.url,
+        token,
+        path: `/api/artifact-studio/projects/${config.projectId}/deployments/${deploymentId}/promote`,
+        body: {},
+    });
+    console.log(`[artifact-studio] promoted ${deploymentId}`);
+    return 0;
+}
+async function pullCommand(args) {
+    const [projectId] = args.positional;
+    if (!projectId)
+        throw new Error('pull requires <project-id>');
+    const env = await envFromArgs(args);
+    const token = await getRequiredToken(args);
+    const out = typeof args.flags.out === 'string' ? resolve(args.flags.out) : resolve(projectId);
+    const projectData = await getJson({
+        baseUrl: env.url,
+        token,
+        path: `/api/artifact-studio/projects/${projectId}`,
+    });
+    if (!projectData.project.activeDeploymentId) {
+        throw new Error('Project has no active deployment to pull.');
+    }
+    const deploymentData = await getJson({
+        baseUrl: env.url,
+        token,
+        path: `/api/artifact-studio/projects/${projectId}/deployments/${projectData.project.activeDeploymentId}`,
+    });
+    for (const file of deploymentData.deployment.files) {
+        const target = join(out, file.path);
+        await mkdir(dirname(target), { recursive: true });
+        await writeFile(target, file.content, 'utf8');
+    }
+    console.log(`[artifact-studio] pulled ${projectId} to ${out}`);
+    return 0;
+}
+async function rollbackCommand(args) {
+    const [deploymentId] = args.positional;
+    if (!deploymentId)
+        throw new Error('rollback requires <deployment-id>');
+    const env = await envFromArgs(args);
+    const token = await getRequiredToken(args);
+    const config = await readLocalConfig();
+    if (!config.projectId)
+        throw new Error('Project is not linked. Run artifact-studio link.');
+    await postJson({
+        baseUrl: env.url,
+        token,
+        path: `/api/artifact-studio/projects/${config.projectId}/deployments/${deploymentId}/rollback`,
+        body: {},
+    });
+    console.log(`[artifact-studio] rolled back to ${deploymentId}`);
+    return 0;
+}
+async function ensureRemoteProject({ env, token, result, dir }) {
+    const config = await readLocalConfig(dir);
+    if (config.projectId) {
+        const data = await getJsonOr404({ baseUrl: env, token, path: `/api/artifact-studio/projects/${config.projectId}` });
+        if (data)
+            return data.project;
+        console.warn(`[artifact-studio] cached projectId ${config.projectId} not found on ${env} — relinking by slug`);
+    }
+    const existing = await fetchRemoteProject({ env, token, slug: result.manifest.artifact.project_id });
+    if (existing) {
+        await writeLocalConfig({ ...config, projectId: existing.id, projectSlug: existing.slug }, dir);
+        return existing;
+    }
+    const created = await postJson({
+        baseUrl: env,
+        token,
+        path: '/api/artifact-studio/projects',
+        body: {
+            title: result.manifest.artifact.title,
+            slug: result.manifest.artifact.project_id,
+            description: result.manifest.artifact.description ?? null,
+        },
+    });
+    await writeLocalConfig({ ...config, projectId: created.project.id, projectSlug: created.project.slug }, dir);
+    return created.project;
+}
+async function uploadDeployment({ env, token, projectId, result, channel, previewKey, dir, message, }) {
+    const version = channel === 'preview'
+        ? `preview-${Date.now().toString(36)}-${result.sourceHash.slice(0, 8)}`
+        : result.sourceHash.slice(0, 12);
+    const data = await postJson({
+        baseUrl: env,
+        token,
+        path: `/api/artifact-studio/projects/${projectId}/deployments`,
+        body: {
+            manifest: result.manifest,
+            files: result.files,
+            bundle: result.bundle,
+            sourceMap: result.sourceMap,
+            version,
+            channel,
+            previewKey,
+            deployMessage: message ?? null,
+            ...gitMetadata(dir),
+        },
+    });
+    return data.deployment;
+}
+async function fetchRemoteProject({ env, token, slug }) {
+    const data = await getJson({ baseUrl: env, token, path: '/api/artifact-studio/projects' });
+    return data.projects.find((project) => project.slug === slug) ?? null;
+}
+async function envFromArgs(args) {
+    const config = await readLocalConfig().catch(() => ({ defaultEnv: undefined }));
+    return resolveEnvironment(typeof args.flags.env === 'string' ? args.flags.env : undefined, config.defaultEnv);
+}
+async function getRequiredToken(args) {
+    const token = await getOptionalToken(args);
+    if (!token)
+        throw new Error('Missing token. Run artifact-studio login or pass --token.');
+    return token;
+}
+async function getOptionalToken(args) {
+    if (typeof args.flags.token === 'string')
+        return args.flags.token;
+    if (process.env.ARTIFACT_STUDIO_TOKEN)
+        return process.env.ARTIFACT_STUDIO_TOKEN;
+    return getAccessToken();
+}
+async function replaceInFile(path, pattern, value) {
+    const content = await import('node:fs/promises').then((fs) => fs.readFile(path, 'utf8'));
+    await writeFile(path, content.replace(pattern, value), 'utf8');
+}
+function gitMetadata(dir) {
+    const gitOpts = {
+        cwd: dir,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'ignore'],
+    };
+    try {
+        const gitCommit = String(execFileSync('git', ['rev-parse', 'HEAD'], gitOpts)).trim();
+        const gitBranch = String(execFileSync('git', ['branch', '--show-current'], gitOpts)).trim();
+        const gitDirty = String(execFileSync('git', ['status', '--porcelain'], gitOpts)).trim().length > 0;
+        return { gitCommit, gitBranch, gitDirty };
+    }
+    catch {
+        return { gitCommit: null, gitBranch: null, gitDirty: null };
+    }
+}
+function slugify(value) {
+    return value.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '') || 'my-artifact';
+}
+function titleize(slug) {
+    return slug.split('-').map((part) => part ? part[0].toUpperCase() + part.slice(1) : '').join(' ');
+}
+runCli()
+    .then((code) => process.exit(code))
+    .catch((error) => {
+    console.error(error instanceof Error ? error.message : error);
+    process.exit(1);
+});

package/dist/config.d.ts

@@ -0,0 +1,23 @@
+export declare const ENV_URLS: Record<string, string>;
+export interface LocalProjectConfig {
+    projectId?: string;
+    projectSlug?: string;
+    defaultEnv?: string;
+    previewKey?: string;
+}
+export interface TokenConfig {
+    accessToken?: string;
+    refreshToken?: string;
+    expiresAt?: number;
+}
+export declare function globalConfigDir(): string;
+export declare function tokenConfigPath(): string;
+export declare function localConfigPath(cwd?: string): string;
+export declare function readLocalConfig(cwd?: string): Promise<LocalProjectConfig>;
+export declare function writeLocalConfig(config: LocalProjectConfig, cwd?: string): Promise<void>;
+export declare function readTokenConfig(): Promise<TokenConfig>;
+export declare function writeTokenConfig(config: TokenConfig): Promise<void>;
+export declare function resolveEnvironment(name: string | undefined, fallback?: string): {
+    name: string;
+    url: string;
+};

package/dist/config.js

@@ -0,0 +1,48 @@
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { homedir } from 'node:os';
+export const ENV_URLS = {
+    local: 'http://localhost:5001',
+    staging: 'https://staging.atlas.seqholdings.com',
+    production: 'https://atlas.seqholdings.com',
+    banksouth: 'https://banksouth.seqholdings.com',
+};
+export function globalConfigDir() {
+    return join(homedir(), '.config', 'sequence-artifact-studio');
+}
+export function tokenConfigPath() {
+    return join(globalConfigDir(), 'tokens.json');
+}
+export function localConfigPath(cwd = process.cwd()) {
+    return join(resolve(cwd), '.artifact-studio', 'config.json');
+}
+export async function readLocalConfig(cwd = process.cwd()) {
+    const path = localConfigPath(cwd);
+    if (!existsSync(path))
+        return {};
+    return JSON.parse(await readFile(path, 'utf8'));
+}
+export async function writeLocalConfig(config, cwd = process.cwd()) {
+    const path = localConfigPath(cwd);
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, JSON.stringify(config, null, 2) + '\n', 'utf8');
+}
+export async function readTokenConfig() {
+    const path = tokenConfigPath();
+    if (!existsSync(path))
+        return {};
+    return JSON.parse(await readFile(path, 'utf8'));
+}
+export async function writeTokenConfig(config) {
+    const path = tokenConfigPath();
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, JSON.stringify(config, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
+}
+export function resolveEnvironment(name, fallback) {
+    const envName = name ?? fallback;
+    const url = envName ? ENV_URLS[envName] : undefined;
+    if (!envName || !url)
+        throw new Error('--env must be one of: local, staging, production, banksouth');
+    return { name: envName, url };
+}

package/dist/hash.d.ts

@@ -0,0 +1,10 @@
+export interface HashableArtifactFile {
+    path: string;
+    content: string;
+    encoding?: string;
+}
+export declare function sha256Hex(content: string | Buffer): string;
+export declare function computeSourceHash({ files, manifest, }: {
+    files: readonly HashableArtifactFile[];
+    manifest: unknown;
+}): string;

package/dist/hash.js

@@ -0,0 +1,36 @@
+import { createHash } from 'node:crypto';
+import { normalizeArtifactPath } from './paths.js';
+export function sha256Hex(content) {
+    return createHash('sha256').update(content).digest('hex');
+}
+function stableJson(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(stableJson).join(',')}]`;
+    const obj = value;
+    return `{${Object.keys(obj)
+        .sort()
+        .map((key) => `${JSON.stringify(key)}:${stableJson(obj[key])}`)
+        .join(',')}}`;
+}
+export function computeSourceHash({ files, manifest, }) {
+    const h = createHash('sha256');
+    h.update('artifact-studio-source-v2\0');
+    h.update(stableJson(manifest));
+    h.update('\0');
+    const sorted = [...files].map((file) => ({
+        path: normalizeArtifactPath(file.path),
+        content: file.content,
+        encoding: file.encoding ?? 'utf8',
+    })).sort((a, b) => a.path.localeCompare(b.path));
+    for (const file of sorted) {
+        h.update(file.path);
+        h.update('\0');
+        h.update(file.encoding);
+        h.update('\0');
+        h.update(sha256Hex(file.content));
+        h.update('\0');
+    }
+    return h.digest('hex');
+}

package/dist/manifest.d.ts

@@ -0,0 +1,44 @@
+import { z } from 'zod';
+export declare const artifactStudioManifestSchema: z.ZodObject<{
+    bundle: z.ZodObject<{
+        name: z.ZodString;
+        schema_version: z.ZodDefault<z.ZodLiteral<1>>;
+    }, z.core.$strip>;
+    artifact: z.ZodObject<{
+        project_id: z.ZodString;
+        title: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        type: z.ZodDefault<z.ZodEnum<{
+            react: "react";
+            html: "html";
+        }>>;
+        entrypoint: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    }, z.core.$strip>;
+    runtime: z.ZodDefault<z.ZodObject<{
+        sdk: z.ZodDefault<z.ZodLiteral<"sequence">>;
+        react: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<18>, z.ZodLiteral<19>]>>;
+    }, z.core.$strip>>;
+    capabilities: z.ZodDefault<z.ZodObject<{
+        data: z.ZodDefault<z.ZodObject<{
+            read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+        api: z.ZodDefault<z.ZodObject<{
+            read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+        functions: z.ZodDefault<z.ZodObject<{
+            invoke: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    targets: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+        visibility: z.ZodDefault<z.ZodEnum<{
+            private: "private";
+            shared: "shared";
+            published: "published";
+        }>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type ArtifactStudioManifest = z.infer<typeof artifactStudioManifestSchema>;
+export declare function parseArtifactStudioManifest(value: unknown): ArtifactStudioManifest;

package/dist/manifest.js

@@ -0,0 +1,45 @@
+import { z } from 'zod';
+import { normalizeArtifactPath } from './paths.js';
+const apiCapabilityPathSchema = z.string().min(1).refine((path) => path.startsWith('/api/') && path !== '/api/' && path !== '/api/*', 'API capability paths must be scoped below /api/');
+const apiCapabilitiesSchema = z.object({
+    read: z.array(apiCapabilityPathSchema).default([]),
+    write: z.array(apiCapabilityPathSchema).default([]),
+}).default({ read: [], write: [] });
+export const artifactStudioManifestSchema = z.object({
+    bundle: z.object({
+        name: z.string().min(1).max(255),
+        schema_version: z.literal(1).default(1),
+    }),
+    artifact: z.object({
+        project_id: z.string().min(1).max(255).regex(/^[a-z][a-z0-9-]*(?:\/[a-z][a-z0-9-]*)*$/),
+        title: z.string().min(1).max(255),
+        description: z.string().max(2000).optional(),
+        type: z.enum(['react', 'html']).default('react'),
+        entrypoint: z.string().min(1).max(512).transform(normalizeArtifactPath),
+    }),
+    runtime: z.object({
+        sdk: z.literal('sequence').default('sequence'),
+        react: z.union([z.literal(18), z.literal(19)]).default(18),
+    }).default({ sdk: 'sequence', react: 18 }),
+    capabilities: z.object({
+        data: z.object({
+            read: z.array(z.string().min(1)).default([]),
+            write: z.array(z.string().min(1)).default([]),
+        }).default({ read: [], write: [] }),
+        api: apiCapabilitiesSchema,
+        functions: z.object({
+            invoke: z.array(z.string().min(1)).default([]),
+        }).default({ invoke: [] }),
+    }).default({
+        data: { read: [], write: [] },
+        api: { read: [], write: [] },
+        functions: { invoke: [] },
+    }),
+    targets: z.record(z.string().min(1), z.object({
+        url: z.string().url(),
+        visibility: z.enum(['private', 'shared', 'published']).default('private'),
+    })).default({}),
+});
+export function parseArtifactStudioManifest(value) {
+    return artifactStudioManifestSchema.parse(value);
+}