@sequenceholdings/artifact-studio 0.1.12 → 0.2.0

package/dist/cli.js

@@ -3,21 +3,22 @@ import { existsSync } from 'node:fs';
 import { dirname, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { getJson, getJsonOr404, postJson } from './api.js';
-import { ENV_URLS, readLocalConfig, resolveEnvironment, writeLocalConfig, writeTokenConfig, } from './config.js';
-import { buildArtifactStudioProject, writeBuildArtifact } from './build.js';
+import { ENV_URLS, readLocalConfig, resolveEnvironment, writeLocalConfig, } from './config.js';
+import { writeBuildArtifact } from './build.js';
 import { buildArtifactStudioProjectIsolated } from './build-subprocess.js';
+import { resolveArtifactStudioPeerVersions, } from './peer-versions.js';
 import { prepareArtifactBuildRoot } from './prepare-build.js';
 import { parseArtifactStudioManifest } from './manifest.js';
 import { hasArtifactStudioManifest, readArtifactStudioSource } from './project.js';
 import { localGitMetadata, parseSourceSpec, resolveArtifactSource, } from './source-resolver.js';
-import { getAccessToken, loginWithPkce } from './auth.js';
 import { acquireDevLock } from './dev-lock.js';
 import { runWatchLoop } from './watch-loop.js';
 import { hashLinkedSources, parseLinks, rebuildLinkedDep, resolveLinkedDeps, syncLinkedDist, } from './dev-link.js';
 import { lintArtifactSandbox, reportSandboxWarnings } from './sandbox-lint.js';
+import { assertActiveDeployProvenance } from './active-deploy-policy.js';
 import yaml from 'js-yaml';
 const COMMANDS = [
-    'init', 'login', 'logout', 'whoami', 'link', 'env', 'status', 'list', 'show',
+    'init', 'whoami', 'link', 'env', 'status', 'list', 'show',
     'validate', 'build', 'plan', 'deploy', 'dev', 'promote', 'pull', 'rollback',
 ];
 const USAGE = `usage:
@@ -38,18 +39,29 @@ const USAGE = `usage:
   seq-studio artifact rollback <deployment-id> --env <env>
 
   Source: a local [dir] (default), a platform git-service repo (--repo <ns>/<name>),
-  or any git URL (--git-url <url>). --ref picks a branch/tag/commit (default: the
+  or a public HTTPS git URL (--git-url <url>). --ref picks a branch/tag/commit (default: the
   repo's default branch). The target project comes from the source's
   artifact.bundle.yml project_id.
 
-  --repo clones over smart-HTTP and REQUIRES a git PAT in ATLAS_GIT_PAT
-  (repo:read scope) — create one with \`seq-studio auth pat create --scopes
-  repo:read\` or in Atlas → Settings → Tokens. It's the same token you clone the
-  repo with. (--env + seq-studio login are still needed to resolve the repo and
-  upload the deployment.)
+  Official (active) deploys require a clean \`main\` checkout with a resolved
+  git commit — merge first, then \`deploy --repo …\` (or a clean local \`main\`
+  checkout). Feature branches and dirty trees are preview-only
+  (\`artifact dev\` / preview channel).
+
+  Interactive --repo builds clone over smart-HTTP and require a repo:read git
+  PAT in ATLAS_GIT_PAT — create one with \`seq-studio auth pat create --scopes
+  repo:read\` or in Atlas → Settings → Tokens. Headless M2M builds use JSON
+  materialize and accept only platform-managed --repo sources. (--env +
+  seq-studio login are still needed to resolve the repo and upload the
+  deployment.)
 
   Authenticate with: seq-studio login`;
 export async function runCli(argv = process.argv.slice(2)) {
+    if (argv.some((arg) => arg === '--token' || arg.startsWith('--token='))) {
+        console.error('Artifact Studio does not accept --token bearer injection. ' +
+            'Authenticate with seq-studio login.');
+        return 1;
+    }
     const parsed = parseArgs(argv);
     if ('error' in parsed) {
         console.error(parsed.error);
@@ -57,8 +69,6 @@ export async function runCli(argv = process.argv.slice(2)) {
     }
     switch (parsed.command) {
         case 'init': return initCommand(parsed);
-        case 'login': return loginCommand(parsed);
-        case 'logout': return logoutCommand();
         case 'whoami': return whoamiCommand(parsed);
         case 'link': return linkCommand(parsed);
         case 'env': return envCommand(parsed);
@@ -119,22 +129,6 @@ async function initCommand(args) {
     console.log('Next: seq-studio login && seq-studio artifact dev --env <env>  (see: seq-studio envs list)');
     return 0;
 }
-async function loginCommand(args) {
-    const token = typeof args.flags.token === 'string' ? args.flags.token : undefined;
-    if (token) {
-        await writeTokenConfig({ accessToken: token });
-        console.log('[seq-studio] saved access token');
-        return 0;
-    }
-    await loginWithPkce();
-    console.log('[seq-studio] logged in');
-    return 0;
-}
-async function logoutCommand() {
-    await writeTokenConfig({});
-    console.log('[seq-studio] logged out');
-    return 0;
-}
 async function whoamiCommand(args) {
     const env = await envFromArgs(args);
     const token = await getRequiredToken(args);
@@ -315,25 +309,31 @@ async function showCommand(args) {
     const deployment = project.activeDeployment;
     if (deployment) {
         console.log(`  active deployment:`);
-        console.log(`    version:    ${deployment.version}`);
-        console.log(`    sourceHash: ${deployment.sourceHash}`);
-        if (deployment.gitCommit) {
-            const dirty = deployment.gitDirty ? ' (dirty)' : '';
-            const branch = deployment.gitBranch ? ` on ${deployment.gitBranch}` : '';
-            console.log(`    git:        ${deployment.gitCommit.slice(0, 12)}${branch}${dirty}`);
-        }
-        if (deployment.deployMessage)
-            console.log(`    message:    ${deployment.deployMessage}`);
-        if (deployment.createdAt)
-            console.log(`    deployedAt: ${deployment.createdAt}`);
-        if (deployment.createdBy)
-            console.log(`    deployedBy: ${deployment.createdBy}`);
+        logActiveDeploymentDetails(deployment);
     }
     else {
         console.log(`  active deployment: none`);
     }
     return 0;
 }
+function logActiveDeploymentDetails(deployment) {
+    console.log(`    version:    ${deployment.version}`);
+    console.log(`    sourceHash: ${deployment.sourceHash}`);
+    if (deployment.gitCommit) {
+        const dirty = deployment.gitDirty ? ' (dirty)' : '';
+        const branch = deployment.gitBranch ? ` on ${deployment.gitBranch}` : '';
+        console.log(`    git:        ${deployment.gitCommit.slice(0, 12)}${branch}${dirty}`);
+    }
+    if (deployment.cliVersion || deployment.atlasUiVersion) {
+        console.log(`    peers:      artifact-studio@${deployment.cliVersion ?? '?'} atlas-ui@${deployment.atlasUiVersion ?? '?'}`);
+    }
+    if (deployment.deployMessage)
+        console.log(`    message:    ${deployment.deployMessage}`);
+    if (deployment.createdAt)
+        console.log(`    deployedAt: ${deployment.createdAt}`);
+    if (deployment.createdBy)
+        console.log(`    deployedBy: ${deployment.createdBy}`);
+}
 async function validateCommand(args) {
     const dir = resolve(args.positional[0] ?? '.');
     const source = await readArtifactStudioSource(dir);
@@ -345,15 +345,23 @@ async function validateCommand(args) {
 }
 async function buildPreparedArtifactSource(source) {
     await prepareArtifactBuildRoot(source.dir, { remote: source.remote });
-    return buildArtifactStudioProject(source.dir);
+    return buildArtifactStudioProjectIsolated(source.dir);
 }
 async function buildCommand(args) {
     const spec = parseSourceSpec(args);
-    // build is offline for a local/git-url source; only a git-service source
-    // needs an env + token to fetch the tree.
-    const remote = spec.kind === 'git-service'
-        ? { baseUrl: (await envFromArgs(args)).url, token: await getRequiredToken(args) }
-        : {};
+    // Local builds stay offline. Public git URLs need no bearer token, but an
+    // optional auth lookup still identifies a selected M2M principal so the
+    // source policy can reject arbitrary CI input before cloning.
+    const auth = spec.kind === 'git-service'
+        ? await getRequiredAuth(args)
+        : spec.kind === 'git-url'
+            ? await getOptionalAuth(args)
+            : null;
+    const remote = spec.kind === 'git-service' && auth
+        ? { authMode: auth.authMode, baseUrl: (await envFromArgs(args)).url, token: auth.token }
+        : auth
+            ? { authMode: auth.authMode }
+            : {};
     const source = await resolveArtifactSource(spec, remote);
     try {
         const result = await buildPreparedArtifactSource(source);
@@ -364,7 +372,8 @@ async function buildCommand(args) {
         await writeBuildArtifact(result, out);
         console.log(`[seq-studio] built ${result.manifest.bundle.name}`);
         console.log(`[seq-studio] source: ${result.sourceHash}`);
-        console.log(`[seq-studio] bundle: ${result.bundleHash}`);
+        console.log(`[seq-studio] bundle: ${result.bundleHash} (${result.bundleFormat}, ${result.chunks.length} chunks)`);
+        console.log(`[seq-studio] peers: artifact-studio@${result.peerVersions.cliVersion} atlas-ui@${result.peerVersions.atlasUiVersion}`);
         console.log(`[seq-studio] wrote ${out}`);
         reportSandboxWarnings(lintArtifactSandbox(result.files));
         return 0;
@@ -375,9 +384,14 @@ async function buildCommand(args) {
 }
 async function planCommand(args) {
     const env = await envFromArgs(args);
-    const token = await getOptionalToken(args);
+    const auth = await getOptionalAuth(args);
+    const token = auth?.token ?? null;
     const spec = parseSourceSpec(args);
-    const source = await resolveArtifactSource(spec, { baseUrl: env.url, token });
+    const source = await resolveArtifactSource(spec, {
+        ...(auth ? { authMode: auth.authMode } : {}),
+        baseUrl: env.url,
+        token,
+    });
     try {
         const result = await buildPreparedArtifactSource(source);
         console.log(`[seq-studio] plan ${result.manifest.artifact.project_id} -> ${env.name}`);
@@ -388,12 +402,29 @@ async function planCommand(args) {
             return 0;
         }
         const remote = await fetchRemoteProject({ env: env.url, token, slug: result.manifest.artifact.project_id });
-        if (!remote)
+        if (!remote) {
             console.log('  action: create project and deploy');
-        else if (remote.activeDeployment?.sourceHash === result.sourceHash)
+            return 0;
+        }
+        // Mirror the deploy --skip-unchanged decision exactly: identical source
+        // with a different (or unrecorded) CLI/atlas-ui pin still redeploys, so
+        // plan must not report no-op there.
+        const active = remote.activeDeployment;
+        if (activeDeploymentMatchesSkipPin({
+            active,
+            sourceHash: result.sourceHash,
+            peerVersions: result.peerVersions,
+        })) {
             console.log('  action: no-op');
-        else
-            console.log(`  action: deploy over ${remote.activeDeployment?.version ?? 'no active deployment'}`);
+        }
+        else if (active && active.sourceHash === result.sourceHash) {
+            console.log(`  action: deploy over ${active.version} ` +
+                `(source unchanged; pin moves ${active.cliVersion ?? 'unrecorded'}/${active.atlasUiVersion ?? 'unrecorded'} ` +
+                `→ ${result.peerVersions.cliVersion}/${result.peerVersions.atlasUiVersion})`);
+        }
+        else {
+            console.log(`  action: deploy over ${active?.version ?? 'no active deployment'}`);
+        }
         return 0;
     }
     finally {
@@ -402,25 +433,41 @@ async function planCommand(args) {
 }
 async function deployCommand(args) {
     const env = await envFromArgs(args);
-    const token = await getRequiredToken(args);
+    const auth = await getRequiredAuth(args);
+    const { token } = auth;
     const spec = parseSourceSpec(args);
     const explicitProjectId = typeof args.flags.project === 'string' ? args.flags.project : null;
-    const source = await resolveArtifactSource(spec, { baseUrl: env.url, token });
+    const source = await resolveArtifactSource(spec, {
+        authMode: auth.authMode,
+        baseUrl: env.url,
+        token,
+    });
     try {
+        // Fail closed before build / project create — active deploys must already
+        // look like a clean `main` checkout. Preview (`dev`) never hits this path.
+        assertActiveDeployProvenance(source.provenance);
         // --skip-unchanged: hash the raw source (no build needed) and no-op when
-        // the remote active deployment already matches. Lets CI redeploy every
-        // artifact on every release without paying a vite build + upload for the
-        // unchanged ones. sourceHash covers manifest + all source files, so any
-        // real change falls through to a full deploy.
+        // the remote active deployment already matches *and* was built with the
+        // same CLI/atlas-ui pin. Lets CI redeploy every artifact on every release
+        // without paying a vite build + upload for the unchanged ones. sourceHash
+        // covers manifest + all source files; peer versions cover the force-alias
+        // inputs (DES-254) so a newer CLI still rebuilds identical source.
         if (args.flags['skip-unchanged'] === true) {
             const unbuilt = await readArtifactStudioSource(source.dir);
             const slug = unbuilt.manifest.artifact.project_id;
             const remote = explicitProjectId
                 ? (await getJsonOr404({ baseUrl: env.url, token, path: `/api/artifact-studio/projects/${explicitProjectId}` }))?.project ?? null
                 : await fetchRemoteProject({ env: env.url, token, slug });
-            if (remote?.activeDeployment?.sourceHash === unbuilt.sourceHash) {
+            const peerVersions = resolveArtifactStudioPeerVersions();
+            const active = remote?.activeDeployment;
+            if (activeDeploymentMatchesSkipPin({
+                active,
+                sourceHash: unbuilt.sourceHash,
+                peerVersions,
+            }) && active) {
                 console.log(`[seq-studio] ${slug} unchanged on ${env.name} ` +
-                    `(active ${remote.activeDeployment.version} matches source ${unbuilt.sourceHash.slice(0, 12)}) — skipping deploy`);
+                    `(active ${active.version} matches source ${unbuilt.sourceHash.slice(0, 12)} ` +
+                    `+ peers artifact-studio@${peerVersions.cliVersion} atlas-ui@${peerVersions.atlasUiVersion}) — skipping deploy`);
                 return 0;
             }
         }
@@ -436,6 +483,7 @@ async function deployCommand(args) {
             linkConfigDir: spec.kind === 'local' ? source.dir : null,
             allowCreate: args.flags['no-create'] !== true,
             explicitProjectId,
+            envName: env.name,
         });
         const deployment = await uploadDeployment({ env: env.url, token, projectId: project.id, result, channel: 'active', provenance: source.provenance });
         console.log(`[seq-studio] deployed ${project.title} ${deployment.version}`);
@@ -520,7 +568,9 @@ async function devCommand(args) {
         // Resolve per push so the token refreshes across a long watch session.
         const token = await getRequiredToken(args);
         if (!projectId) {
-            const project = await ensureRemoteProject({ env: env.url, token, result, linkConfigDir: dir });
+            // envName so a first-time `artifact dev` creation honors the manifest
+            // visibility too (and notes drift, once, when the project pre-exists).
+            const project = await ensureRemoteProject({ env: env.url, token, result, linkConfigDir: dir, envName: env.name });
             projectId = project.id;
         }
         const deployment = await uploadDeployment({
@@ -684,7 +734,36 @@ async function rollbackCommand(args) {
     console.log(`[seq-studio] rolled back to ${deploymentId}`);
     return 0;
 }
-async function ensureRemoteProject({ env, token, result, linkConfigDir, allowCreate = true, explicitProjectId = null }) {
+/**
+ * Whether `--skip-unchanged` may no-op: same source *and* same CLI/atlas-ui
+ * pin. Missing peer fields on older rows force a rebuild so the pin becomes
+ * observable (DES-254).
+ */
+export function activeDeploymentMatchesSkipPin({ active, sourceHash, peerVersions, }) {
+    if (!active)
+        return false;
+    if (active.sourceHash !== sourceHash)
+        return false;
+    if (!active.cliVersion || !active.atlasUiVersion)
+        return false;
+    return (active.cliVersion === peerVersions.cliVersion &&
+        active.atlasUiVersion === peerVersions.atlasUiVersion);
+}
+/**
+ * Deploys never change a live project's visibility — the Studio sharing UI /
+ * PATCH own that. The manifest's targets.<env>.visibility is honored at
+ * project CREATION only; on drift, say so instead of silently ignoring the
+ * field (which is how it read as decorative for a year).
+ */
+function warnOnVisibilityDrift({ project, declared, envName }) {
+    if (!declared || !envName || !project.visibility || declared === project.visibility)
+        return;
+    console.warn(`[seq-studio] note: artifact.bundle.yml targets.${envName}.visibility is "${declared}" but the project is ` +
+        `"${project.visibility}" on this environment — deploys never change visibility. Update it in Studio sharing ` +
+        `(or PATCH /api/artifact-studio/projects/${project.id}) if the manifest is what you intend.`);
+}
+async function ensureRemoteProject({ env, token, result, linkConfigDir, allowCreate = true, explicitProjectId = null, envName = null }) {
+    const declaredVisibility = envName ? result.manifest.targets?.[envName]?.visibility : undefined;
     if (explicitProjectId) {
         const data = await getJsonOr404({ baseUrl: env, token, path: `/api/artifact-studio/projects/${explicitProjectId}` });
         if (!data)
@@ -693,19 +772,23 @@ async function ensureRemoteProject({ env, token, result, linkConfigDir, allowCre
             throw new Error(`--project ${explicitProjectId} resolves to slug "${data.project.slug}" but this source's ` +
                 `artifact.bundle.yml declares project_id "${result.manifest.artifact.project_id}" — refusing to deploy over a different project`);
         }
+        warnOnVisibilityDrift({ project: data.project, declared: declaredVisibility, envName });
         return data.project;
     }
     const config = linkConfigDir ? await readLocalConfig(linkConfigDir) : {};
     if (config.projectId) {
         const data = await getJsonOr404({ baseUrl: env, token, path: `/api/artifact-studio/projects/${config.projectId}` });
-        if (data)
+        if (data) {
+            warnOnVisibilityDrift({ project: data.project, declared: declaredVisibility, envName });
             return data.project;
+        }
         console.warn(`[seq-studio] cached projectId ${config.projectId} not found on ${env} — relinking by slug`);
     }
     const existing = await fetchRemoteProject({ env, token, slug: result.manifest.artifact.project_id });
     if (existing) {
         if (linkConfigDir)
             await writeLocalConfig({ ...config, projectId: existing.id, projectSlug: existing.slug }, linkConfigDir);
+        warnOnVisibilityDrift({ project: existing, declared: declaredVisibility, envName });
         return existing;
     }
     if (!allowCreate) {
@@ -721,6 +804,7 @@ async function ensureRemoteProject({ env, token, result, linkConfigDir, allowCre
             title: result.manifest.artifact.title,
             slug: result.manifest.artifact.project_id,
             description: result.manifest.artifact.description ?? null,
+            ...(declaredVisibility ? { visibility: declaredVisibility } : {}),
         },
     });
     if (linkConfigDir)
@@ -746,11 +830,15 @@ async function uploadDeployment({ env, token, projectId, result, channel, previe
             manifest: result.manifest,
             files: result.files,
             bundle: result.bundle,
+            chunks: result.chunks.map((chunk) => ({ fileName: chunk.fileName, content: chunk.code })),
+            bundleFormat: result.bundleFormat,
             sourceMap: result.sourceMap,
             ...(version ? { version } : {}),
             channel,
             previewKey,
             deployMessage: message ?? null,
+            cliVersion: result.peerVersions.cliVersion,
+            atlasUiVersion: result.peerVersions.atlasUiVersion,
             ...provenance,
         },
     });
@@ -771,38 +859,36 @@ async function fetchRemoteProject({ env, token, slug, disambiguator }) {
     }
     return matches[0] ?? null;
 }
-async function envFromArgs(args) {
+export async function getConfiguredDefaultEnv() {
     const config = await readLocalConfig().catch(() => ({ defaultEnv: undefined }));
-    return resolveEnvironment(typeof args.flags.env === 'string' ? args.flags.env : undefined, config.defaultEnv);
+    return config.defaultEnv;
+}
+async function envFromArgs(args) {
+    return resolveEnvironment(typeof args.flags.env === 'string' ? args.flags.env : undefined, await getConfiguredDefaultEnv());
 }
-/**
- * Optional refreshing token provider, injected by an embedder (e.g. seq-studio)
- * that owns the shared seqapi token file and can mint a fresh access token on
- * demand. Consulted before the static ARTIFACT_STUDIO_TOKEN env var so a
- * long-running `dev` watcher keeps deploying past the initial token's TTL —
- * the env var is captured once at process start and never refreshes.
- */
 let tokenProvider = null;
 export function setTokenProvider(provider) {
     tokenProvider = provider;
 }
-async function getRequiredToken(args) {
-    const token = await getOptionalToken(args);
-    if (!token)
-        throw new Error('Missing token. Run seq-studio login or pass --token.');
-    return token;
+async function getRequiredToken(_args) {
+    return (await getRequiredAuth(_args)).token;
+}
+async function getRequiredAuth(_args) {
+    const auth = await resolveAuth({ allowInteractiveLogin: true });
+    if (!auth)
+        throw new Error('Missing token. Authenticate with seq-studio login.');
+    return auth;
+}
+async function getOptionalAuth(_args) {
+    return resolveAuth({ allowInteractiveLogin: false });
 }
-async function getOptionalToken(args) {
-    if (typeof args.flags.token === 'string')
-        return args.flags.token;
+async function resolveAuth(options) {
     if (tokenProvider) {
-        const provided = await tokenProvider();
+        const provided = await tokenProvider(options);
         if (provided)
             return provided;
     }
-    if (process.env.ARTIFACT_STUDIO_TOKEN)
-        return process.env.ARTIFACT_STUDIO_TOKEN;
-    return getAccessToken();
+    return null;
 }
 async function replaceInFile(path, pattern, value) {
     const content = await import('node:fs/promises').then((fs) => fs.readFile(path, 'utf8'));
@@ -831,4 +917,4 @@ function warnIfInlinedManifestDriftsFromBundle(result) {
 // This module is a pure library export. `seq-studio artifact` imports
 // `runCli` from `@sequenceholdings/artifact-studio/cli` (see
 // shared/services/studio-cli/README.md) and invokes it after injecting a
-// shared base URL + Bearer token.
+// shared base URL + internal token provider.

package/dist/config.d.ts

@@ -11,19 +11,10 @@ export interface LocalProjectConfig {
     defaultEnv?: string;
     previewKey?: string;
 }
-export interface TokenConfig {
-    accessToken?: string;
-    refreshToken?: string;
-    expiresAt?: number;
-}
-export declare function globalConfigDir(): string;
-export declare function tokenConfigPath(): string;
 export declare function localConfigPath(cwd?: string): string;
 export declare function devLockPath(cwd?: string): string;
 export declare function readLocalConfig(cwd?: string): Promise<LocalProjectConfig>;
 export declare function writeLocalConfig(config: LocalProjectConfig, cwd?: string): Promise<void>;
-export declare function readTokenConfig(): Promise<TokenConfig>;
-export declare function writeTokenConfig(config: TokenConfig): Promise<void>;
 export declare function knownEnvUrls(): Record<string, string>;
 export declare function resolveEnvironment(name: string | undefined, fallback?: string): {
     name: string;

package/dist/config.js

@@ -1,7 +1,6 @@
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
-import { homedir } from 'node:os';
 /**
  * Only `local` ships in the published package. Deployed-environment URLs
  * are resolved by the embedding CLI (seq-studio), which discovers the
@@ -11,12 +10,6 @@ import { homedir } from 'node:os';
 export const ENV_URLS = {
     local: 'http://localhost:5001',
 };
-export function globalConfigDir() {
-    return join(homedir(), '.config', 'sequence-artifact-studio');
-}
-export function tokenConfigPath() {
-    return join(globalConfigDir(), 'tokens.json');
-}
 export function localConfigPath(cwd = process.cwd()) {
     return join(resolve(cwd), '.artifact-studio', 'config.json');
 }
@@ -34,17 +27,6 @@ export async function writeLocalConfig(config, cwd = process.cwd()) {
     await mkdir(dirname(path), { recursive: true });
     await writeFile(path, JSON.stringify(config, null, 2) + '\n', 'utf8');
 }
-export async function readTokenConfig() {
-    const path = tokenConfigPath();
-    if (!existsSync(path))
-        return {};
-    return JSON.parse(await readFile(path, 'utf8'));
-}
-export async function writeTokenConfig(config) {
-    const path = tokenConfigPath();
-    await mkdir(dirname(path), { recursive: true });
-    await writeFile(path, JSON.stringify(config, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
-}
 /**
  * Environment map injected by the embedding CLI (seq-studio sets
  * ARTIFACT_STUDIO_ENV_URLS to the JSON name→url map of environments visible

package/dist/deployment-validation.d.ts

@@ -0,0 +1,9 @@
+export declare function validateDeploymentBaseUrl(input: string): string;
+export declare function validateDeploymentAudience({ audience, baseUrl, }: {
+    audience: string;
+    baseUrl: string;
+}): string;
+export declare function authenticatedRequestUrl({ baseUrl, path, }: {
+    baseUrl: string;
+    path: string;
+}): string;

package/dist/deployment-validation.js

@@ -0,0 +1,70 @@
+const TRUSTED_DEPLOYMENT_DOMAIN = 'seqholdings.com';
+export function validateDeploymentBaseUrl(input) {
+    if (input !== input.trim()) {
+        throw new Error(`Invalid deployment URL '${input}'.`);
+    }
+    let parsed;
+    try {
+        parsed = new URL(input);
+    }
+    catch {
+        throw new Error(`Invalid deployment URL '${input}'.`);
+    }
+    const hostname = parsed.hostname.toLowerCase();
+    const originOnly = !parsed.username &&
+        !parsed.password &&
+        (parsed.pathname === '' || parsed.pathname === '/') &&
+        !parsed.search &&
+        !parsed.hash;
+    const trustedHttps = parsed.protocol === 'https:' &&
+        (hostname === TRUSTED_DEPLOYMENT_DOMAIN ||
+            hostname.endsWith(`.${TRUSTED_DEPLOYMENT_DOMAIN}`)) &&
+        parsed.port === '';
+    const localHttp = parsed.protocol === 'http:' &&
+        ['localhost', '127.0.0.1', '[::1]'].includes(hostname);
+    if (!originOnly || (!trustedHttps && !localHttp)) {
+        throw new Error(`Untrusted deployment URL '${input}': expected an HTTPS origin under ` +
+            `*.${TRUSTED_DEPLOYMENT_DOMAIN}, or an HTTP localhost/loopback origin.`);
+    }
+    return trustedHttps ? `https://${hostname}` : parsed.origin.toLowerCase();
+}
+export function validateDeploymentAudience({ audience, baseUrl, }) {
+    const expected = `${baseUrl}/api`;
+    if (audience !== expected) {
+        throw new Error(`Untrusted Auth0 audience '${audience}': deployment ${baseUrl} must use '${expected}'.`);
+    }
+    return audience;
+}
+export function authenticatedRequestUrl({ baseUrl, path, }) {
+    const trustedOrigin = validateDeploymentBaseUrl(baseUrl);
+    if (!path.startsWith('/')) {
+        throw new Error(`Invalid authenticated request path '${path}': expected an absolute path.`);
+    }
+    if (path.startsWith('//')) {
+        throw new Error(`Invalid authenticated request path '${path}': scheme-relative paths are not allowed.`);
+    }
+    if ([...path].some((character) => character.charCodeAt(0) < 0x20)) {
+        throw new Error(`Invalid authenticated request path '${path}': control character.`);
+    }
+    const separatorIndex = path.search(/[?#]/);
+    const rawPathname = separatorIndex === -1 ? path : path.slice(0, separatorIndex);
+    const traversalCandidate = rawPathname
+        .replace(/%2e/gi, '.')
+        .replace(/%2f/gi, '/')
+        .replace(/%5c/gi, '\\');
+    if (traversalCandidate.includes('\\') ||
+        traversalCandidate.split('/').some((segment) => segment === '.' || segment === '..')) {
+        throw new Error(`Invalid authenticated request path '${path}': traversal is not allowed.`);
+    }
+    let request;
+    try {
+        request = new URL(path, `${trustedOrigin}/`);
+    }
+    catch {
+        throw new Error(`Invalid authenticated request path '${path}'.`);
+    }
+    if (request.origin.toLowerCase() !== trustedOrigin) {
+        throw new Error(`Untrusted authenticated request origin '${request.origin}': expected '${trustedOrigin}'.`);
+    }
+    return request.href;
+}

package/dist/git-clone.js

@@ -10,9 +10,10 @@
  * HTTPS clone URL plus the PAT separately.
  */
 import { spawn } from 'node:child_process';
-import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { createScrubbedChildEnv } from './child-environment.js';
 /** Read the git PAT from the environment (`ATLAS_GIT_PAT`), trimmed. */
 export function resolveGitPatFromEnv() {
     const value = process.env.ATLAS_GIT_PAT?.trim();
@@ -108,6 +109,7 @@ async function spawnGit({ args, env, cwd, timeoutMs = GIT_CLONE_TIMEOUT_MS, }) {
  */
 export async function withGitAskpass({ pat, fn, }) {
     const dir = await mkdtemp(join(tmpdir(), 'artifact-askpass-'));
+    const homeDir = join(dir, 'home');
     const scriptPath = join(dir, 'askpass.sh');
     const script = [
         '#!/bin/sh',
@@ -117,17 +119,21 @@ export async function withGitAskpass({ pat, fn, }) {
         'esac',
         '',
     ].join('\n');
+    await mkdir(homeDir, { recursive: true });
     await writeFile(scriptPath, script, { mode: 0o700 });
     try {
-        return await fn({
-            ...process.env,
-            GIT_ASKPASS: scriptPath,
-            GIT_TERMINAL_PROMPT: '0',
-            SEQ_STUDIO_GIT_ASKPASS_PASSWORD: pat,
-            GIT_CONFIG_COUNT: '1',
-            GIT_CONFIG_KEY_0: 'credential.helper',
-            GIT_CONFIG_VALUE_0: '',
-        });
+        return await fn(createScrubbedChildEnv({
+            homeDir,
+            additionalEnv: {
+                GIT_ASKPASS: scriptPath,
+                GIT_TERMINAL_PROMPT: '0',
+                GIT_CONFIG_NOSYSTEM: '1',
+                SEQ_STUDIO_GIT_ASKPASS_PASSWORD: pat,
+                GIT_CONFIG_COUNT: '1',
+                GIT_CONFIG_KEY_0: 'credential.helper',
+                GIT_CONFIG_VALUE_0: '',
+            },
+        }));
     }
     finally {
         await rm(dir, { recursive: true, force: true });

package/dist/peer-versions.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Versions of the packages that actually land in an artifact bundle under the
+ * CLI atlas-ui stamp (DES-254). See `VERSION-PIN.md`.
+ *
+ * - `cliVersion` — `@sequenceholdings/artifact-studio` (the build package that
+ *   owns `PEER_RESOLVE_ALIAS`).
+ * - `atlasUiVersion` — the `@sequenceholdings/atlas-ui` copy resolved from
+ *   *that* package's dependency tree (not the artifact's package.json).
+ */
+export interface ArtifactStudioPeerVersions {
+    cliVersion: string;
+    atlasUiVersion: string;
+}
+/**
+ * Resolve the building CLI + force-aliased atlas-ui versions from disk.
+ * Throws if either package.json is unreadable — a silent null here would
+ * undermine the observability DES-254 adds for the blast-radius scanner.
+ */
+export declare function resolveArtifactStudioPeerVersions(): ArtifactStudioPeerVersions;