@sequenceholdings/artifact-studio 0.1.12 → 0.2.0

package/dist/build.js

@@ -1,15 +1,17 @@
-import { existsSync } from 'node:fs';
 import { mkdir, writeFile } from 'node:fs/promises';
 import { createRequire } from 'node:module';
-import { dirname, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { dirname, relative, resolve } from 'node:path';
 import { build as viteBuild } from 'vite';
+import { atlasUiCssResolverPlugin } from './atlas-ui-css-plugin.js';
 import { sha256Hex } from './hash.js';
+import { isArtifactIgnoredPath } from './artifact-ignore.js';
 import { readArtifactStudioSource } from './project.js';
+import { normalizeArtifactPath } from './paths.js';
+import { resolveArtifactStudioPeerVersions, } from './peer-versions.js';
+import { ARTIFACT_RUNTIME_CHUNK_DIR, assertSafeRuntimeChunkFileName } from './runtime-chunks.js';
 /** Keep in sync with `atlas/src/server/services/artifact-studio/limits.ts`. */
 const MAX_DEPLOY_SOURCEMAP_BYTES = 10 * 1024 * 1024;
 const cliRequire = createRequire(import.meta.url);
-const cliDir = dirname(fileURLToPath(import.meta.url));
 const reactDir = dirname(cliRequire.resolve('react/package.json'));
 const reactDomDir = dirname(cliRequire.resolve('react-dom/package.json'));
 // Artifacts (and the `react-vite` scaffold) import `@tanstack/react-query`
@@ -29,8 +31,6 @@ const atlasUiDist = resolve(atlasUiDir, 'dist');
 // `seq-studio dev --link`) work.
 const formRendererDir = dirname(cliRequire.resolve('@sequenceholdings/lattice-form-renderer/package.json'));
 const formRendererDist = resolve(formRendererDir, 'dist');
-const tailwindCssPath = resolve(dirname(cliRequire.resolve('tailwindcss/package.json')), 'index.css');
-const twAnimateCssPath = resolveTwAnimateCssPath();
 /**
  * Import aliases for the Vite build. Artifacts are built against their own
  * source tree, which usually has no installed node_modules, so every bare
@@ -39,6 +39,10 @@ const twAnimateCssPath = resolveTwAnimateCssPath();
  * react-query QueryClient context — so a duplicate copy can't silently break
  * hooks or the provider/consumer link. Exported so it can be regression-tested
  * (a missing/unresolvable peer must fail loudly).
+ *
+ * **CLI atlas-ui stamp (DES-254):** the atlas-ui a bundle gets is whatever
+ * *this* CLI package resolves — not a semver the artifact declares.
+ * See `VERSION-PIN.md`.
  */
 /** Platform + common artifact runtime peers — always aliased over node_modules. */
 export const PEER_RESOLVE_ALIAS = {
@@ -50,6 +54,13 @@ export const PEER_RESOLVE_ALIAS = {
     '@tanstack/react-query': reactQueryDir,
     'react-router-dom': reactRouterDomDir,
     sonner: sonnerDir,
+    // v2 token entry points live at the PACKAGE ROOT, not in dist (the generator
+    // writes them there and `files` publishes them from there). Without these
+    // keys the imports fall through to the bare `atlas-ui` alias below — which
+    // prefix-matches and rewrites them to `<dist>/index.mjs/tokens.v2.css`, a
+    // path that doesn't exist, so the artifact build fails on a CSS import.
+    '@sequenceholdings/atlas-ui/tokens.v2.css': resolve(atlasUiDir, 'tokens.v2.css'),
+    '@sequenceholdings/atlas-ui/theme.v2.css': resolve(atlasUiDir, 'theme.v2.css'),
     '@sequenceholdings/atlas-ui/tokens.css': resolve(atlasUiDist, 'tokens.css'),
     '@sequenceholdings/atlas-ui/charts': resolve(atlasUiDist, 'charts.mjs'),
     '@sequenceholdings/atlas-ui': resolve(atlasUiDist, 'index.mjs'),
@@ -69,8 +80,13 @@ export async function buildArtifactStudioProject(rootDir) {
         configFile: false,
         logLevel: 'silent',
         plugins: [
+            rejectIgnoredSourcePlugin(root, source.ignorePatterns),
             artifactSdkVirtualModule(),
-            atlasUiCssResolverPlugin(),
+            atlasUiCssResolverPlugin({
+                atlasUiDir,
+                atlasUiDist,
+                formRendererDist,
+            }),
             nextStubPlugin(),
             (await import('@tailwindcss/vite')).default(),
         ],
@@ -82,29 +98,77 @@ export async function buildArtifactStudioProject(rootDir) {
             sourcemap: true,
             cssCodeSplit: false,
             assetsInlineLimit: Number.MAX_SAFE_INTEGER,
+            modulePreload: false,
             rollupOptions: {
                 input: resolve(root, 'index.html'),
                 output: {
-                    format: 'iife',
-                    name: 'ArtifactStudioApp',
+                    // ESM (not IIFE) so dynamic import() can emit async chunks (REP-87).
+                    format: 'es',
+                    entryFileNames: 'bundle.js',
+                    chunkFileNames: `${ARTIFACT_RUNTIME_CHUNK_DIR}/[name]-[hash].js`,
+                    assetFileNames: 'assets/[name]-[hash][extname]',
                 },
             },
         },
     });
     const output = Array.isArray(result) ? result.flatMap((r) => r.output) : result.output;
-    const js = collectEntryJavaScript(output);
-    if (!js)
+    const entry = collectEntryJavaScript(output);
+    if (!entry)
         throw new Error('Build produced no JavaScript output');
     const css = collectCss(output);
-    const bundle = css ? injectCssRuntime(css) + '\n' + js : js;
+    const bundle = css ? injectCssRuntime(css) + '\n' + entry.code : entry.code;
+    const chunks = collectRuntimeChunks(output);
     const sourceMap = fitSourceMapForDeploy(collectSourceMap(output));
     return {
         manifest: source.manifest,
         files: source.files,
         sourceHash: source.sourceHash,
         bundle,
+        chunks,
+        bundleFormat: 'esm',
         sourceMap,
-        bundleHash: sha256Hex(bundle),
+        bundleHash: hashBundleAndChunks({ bundle, chunks }),
+        peerVersions: resolveArtifactStudioPeerVersions(),
+    };
+}
+/**
+ * `.artifactignore` drops paths from sourceHash / deploy payloads, but Vite
+ * still sees the full tree. Reject any resolved import under an ignored prefix
+ * so `deploy --skip-unchanged` cannot silently keep a stale bundle when an
+ * ignored-but-imported file changes.
+ */
+function rejectIgnoredSourcePlugin(root, patterns) {
+    if (patterns.length === 0) {
+        return { name: 'reject-artifact-ignored-noop' };
+    }
+    const rootResolved = resolve(root);
+    return {
+        name: 'reject-artifact-ignored',
+        enforce: 'pre',
+        async resolveId(source, importer, options) {
+            const resolved = await this.resolve(source, importer, { ...options, skipSelf: true });
+            if (!resolved || resolved.external)
+                return resolved;
+            // Virtual modules (`\0…`) and query suffixes (`?worker`) are not source paths.
+            const filePath = resolved.id.split('\0').pop().split('?')[0];
+            if (!filePath.startsWith(rootResolved))
+                return resolved;
+            let rel;
+            try {
+                rel = normalizeArtifactPath(relative(rootResolved, filePath));
+            }
+            catch {
+                return resolved;
+            }
+            if (!isArtifactIgnoredPath(rel, patterns))
+                return resolved;
+            const from = importer
+                ? ` (imported from ${relative(rootResolved, importer.split('?')[0])})`
+                : '';
+            throw new Error(`Cannot import "${rel}"${from}: path is listed in .artifactignore. ` +
+                'Ignored trees are excluded from sourceHash / deploy --skip-unchanged, ' +
+                'so build dependencies must not live under them.');
+        },
     };
 }
 function fitSourceMapForDeploy(sourceMap) {
@@ -164,25 +228,30 @@ function nextStubPlugin() {
         },
     };
 }
-function resolveTwAnimateCssPath() {
-    const candidates = [
-        // Workspace layout: shared/services/artifact-studio/node_modules/...
-        resolve(cliDir, '..', 'node_modules', 'tw-animate-css', 'dist', 'tw-animate.css'),
-        // pnpm file-dependency layout: .../node_modules/@sequenceholdings/artifact-studio/dist
-        // with dependencies hoisted beside the scope directory.
-        resolve(cliDir, '..', '..', '..', 'tw-animate-css', 'dist', 'tw-animate.css'),
-    ];
-    const resolved = candidates.find((candidate) => existsSync(candidate));
-    if (!resolved) {
-        throw new Error(`Unable to resolve tw-animate-css dist file. Tried: ${candidates.join(', ')}`);
-    }
-    return resolved;
-}
 function collectEntryJavaScript(output) {
     const entryChunks = output.filter((chunk) => chunk.type === 'chunk' && chunk.isEntry);
     if (entryChunks.length === 0)
         return null;
-    return entryChunks.map((chunk) => chunk.code).join('\n');
+    // HTML multi-page inputs can emit multiple entries; Artifact Studio has one.
+    const entry = entryChunks[0];
+    return { code: entry.code, fileName: entry.fileName };
+}
+function collectRuntimeChunks(output) {
+    return output
+        .filter((chunk) => chunk.type === 'chunk' && !chunk.isEntry)
+        .map((chunk) => ({
+        fileName: assertSafeRuntimeChunkFileName(chunk.fileName),
+        code: chunk.code,
+    }))
+        .sort((a, b) => a.fileName.localeCompare(b.fileName));
+}
+export function hashBundleAndChunks({ bundle, chunks, }) {
+    const h = sha256Hex([
+        'artifact-studio-bundle-v2',
+        bundle,
+        ...chunks.flatMap((chunk) => [chunk.fileName, chunk.code]),
+    ].join('\0'));
+    return h;
 }
 function collectCss(output) {
     const cssAssets = output.filter((chunk) => isAssetOutput(chunk) && chunk.fileName.endsWith('.css'));
@@ -203,25 +272,3 @@ function collectSourceMap(output) {
         .map((chunk) => ({ fileName: chunk.fileName, map: chunk.map }));
     return maps.length > 0 ? JSON.stringify(maps) : null;
 }
-function atlasUiCssResolverPlugin() {
-    return {
-        name: 'atlas-ui-css-resolver',
-        enforce: 'pre',
-        transform(code, id) {
-            if (!id.endsWith('.css'))
-                return undefined;
-            let result = code;
-            if (result.includes('@import "tailwindcss"')) {
-                result = result.replace('@import "tailwindcss"', `@import ${JSON.stringify(tailwindCssPath)}`);
-                // Prebuilt dists whose class names Tailwind must scan: atlas-ui plus
-                // the form renderer (field-scope.tsx emits Tailwind utility classes
-                // that only appear in the renderer's dist, not the artifact source).
-                result = `@source ${JSON.stringify(atlasUiDist)};\n@source ${JSON.stringify(formRendererDist)};\n${result}`;
-            }
-            if (result.includes('@import "tw-animate-css"')) {
-                result = result.replace('@import "tw-animate-css"', `@import ${JSON.stringify(twAnimateCssPath)}`);
-            }
-            return result !== code ? result : undefined;
-        },
-    };
-}

package/dist/child-environment.d.ts

@@ -0,0 +1,5 @@
+export declare function createScrubbedChildEnv({ homeDir, source, additionalEnv, }: {
+    homeDir: string;
+    source?: NodeJS.ProcessEnv;
+    additionalEnv?: NodeJS.ProcessEnv;
+}): NodeJS.ProcessEnv;

package/dist/child-environment.js

@@ -0,0 +1,83 @@
+import { join } from 'node:path';
+// This prevents ambient credential inheritance and conventional HOME/config
+// discovery. It is not an OS sandbox: the child still has the caller's uid and
+// can read explicitly named filesystem paths and, where the OS permits it,
+// inspect other same-uid processes (for example through Linux /proc).
+const SAFE_CHILD_ENV_NAMES = new Set([
+    'PATH',
+    'PATHEXT',
+    'SYSTEMROOT',
+    'WINDIR',
+    'COMSPEC',
+    'TMPDIR',
+    'TMP',
+    'TEMP',
+    'LANG',
+    'LANGUAGE',
+    'LC_ALL',
+    'TERM',
+    'COLORTERM',
+    'NO_COLOR',
+    'FORCE_COLOR',
+    'CI',
+    'TZ',
+    'SOURCE_DATE_EPOCH',
+    'SSL_CERT_FILE',
+    'SSL_CERT_DIR',
+    'NODE_EXTRA_CA_CERTS',
+]);
+const PROXY_ENV_NAMES = new Set(['HTTP_PROXY', 'HTTPS_PROXY', 'ALL_PROXY', 'NO_PROXY']);
+export function createScrubbedChildEnv({ homeDir, source = process.env, additionalEnv = {}, }) {
+    const env = {};
+    for (const [name, value] of Object.entries(source)) {
+        if (value === undefined)
+            continue;
+        const normalized = name.toUpperCase();
+        if (PROXY_ENV_NAMES.has(normalized)) {
+            env[name] = value;
+            continue;
+        }
+        if (SAFE_CHILD_ENV_NAMES.has(normalized) || normalized.startsWith('LC_')) {
+            env[name] = value;
+        }
+    }
+    Object.assign(env, additionalEnv);
+    for (const [name, value] of Object.entries(env)) {
+        if (value !== undefined && PROXY_ENV_NAMES.has(name.toUpperCase())) {
+            assertProxySettingIsSafe({ name, value });
+        }
+    }
+    return {
+        ...env,
+        HOME: homeDir,
+        USERPROFILE: homeDir,
+        XDG_CONFIG_HOME: join(homeDir, '.config'),
+        XDG_CACHE_HOME: join(homeDir, '.cache'),
+        XDG_DATA_HOME: join(homeDir, '.local', 'share'),
+        APPDATA: join(homeDir, 'AppData', 'Roaming'),
+        LOCALAPPDATA: join(homeDir, 'AppData', 'Local'),
+        USER: 'sequence-build',
+        USERNAME: 'sequence-build',
+        LOGNAME: 'sequence-build',
+    };
+}
+function assertProxySettingIsSafe({ name, value, }) {
+    if (name.toUpperCase() === 'NO_PROXY')
+        return;
+    let proxyUrl;
+    try {
+        // git/npm accept the legacy credential-free `host:port` form. Prefix a
+        // scheme for validation only; preserve the caller's exact value below.
+        proxyUrl = new URL(value.includes('://') ? value : `http://${value}`);
+    }
+    catch {
+        throw new Error(`${name} must be a valid proxy endpoint before it can be forwarded to a build worker`);
+    }
+    if (proxyUrl.username ||
+        proxyUrl.password ||
+        proxyUrl.search ||
+        proxyUrl.hash ||
+        (proxyUrl.pathname !== '' && proxyUrl.pathname !== '/')) {
+        throw new Error(`${name} contains credential-bearing URL components and cannot be forwarded to source-controlled build tooling`);
+    }
+}

package/dist/cli.d.ts

@@ -1,2 +1,41 @@
+import { type ArtifactStudioPeerVersions } from './peer-versions.js';
+import { type SourceAuthMode } from './source-resolver.js';
 export declare function runCli(argv?: string[]): Promise<number>;
-export declare function setTokenProvider(provider: (() => Promise<string | null>) | null): void;
+interface RemoteProject {
+    id: string;
+    slug: string;
+    title: string;
+    visibility?: string;
+    activeDeployment?: {
+        version: string;
+        sourceHash: string;
+        cliVersion?: string | null;
+        atlasUiVersion?: string | null;
+    } | null;
+}
+/**
+ * Whether `--skip-unchanged` may no-op: same source *and* same CLI/atlas-ui
+ * pin. Missing peer fields on older rows force a rebuild so the pin becomes
+ * observable (DES-254).
+ */
+export declare function activeDeploymentMatchesSkipPin({ active, sourceHash, peerVersions, }: {
+    active: RemoteProject['activeDeployment'];
+    sourceHash: string;
+    peerVersions: ArtifactStudioPeerVersions;
+}): boolean;
+export declare function getConfiguredDefaultEnv(): Promise<string | undefined>;
+/**
+ * Optional refreshing token provider, injected by an embedder (e.g. seq-studio)
+ * that owns the shared seqapi session and can resolve an access token on
+ * demand. Authentication is owned by the embedding `seq-studio` CLI; this
+ * package deliberately has no bearer-token argv or environment escape hatch.
+ */
+export interface TokenProviderOptions {
+    allowInteractiveLogin: boolean;
+}
+export interface ProvidedToken {
+    authMode: SourceAuthMode;
+    token: string;
+}
+export declare function setTokenProvider(provider: ((options: TokenProviderOptions) => Promise<ProvidedToken | null>) | null): void;
+export {};