@sequenceholdings/artifact-studio 0.1.5 → 0.1.9

package/dist/api.js

@@ -1,5 +1,40 @@
 const MAX_503_RETRIES = 5;
 const DEFAULT_RETRY_AFTER_SECONDS = 2;
+/**
+ * Extra request headers, supplied by an embedder (e.g. `seq-studio artifact`)
+ * via the `ARTIFACT_STUDIO_EXTRA_HEADERS` env var (a JSON object). This is the
+ * minimal env-var-driven hook that lets the delegate thread the Cloudflare WAF
+ * bypass header (`x-preview-access: <PREVIEW_ACCESS_HEADER>`) when targeting a
+ * per-PR preview env. Built-in caller-supplied headers (Authorization,
+ * Content-Type) always win over anything here. Malformed JSON is ignored — a
+ * bad bypass header should never crash a deploy before the request is even made.
+ */
+function extraHeaders() {
+    const raw = process.env.ARTIFACT_STUDIO_EXTRA_HEADERS?.trim();
+    if (!raw)
+        return {};
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+            return {};
+        const headers = {};
+        for (const [key, value] of Object.entries(parsed)) {
+            const lower = key.toLowerCase();
+            // Prevent case-variant duplicates from being merged by Headers/fetch
+            // (e.g. `authorization` + `Authorization` => "a, b"). The client always
+            // sets these explicitly below, so ignore any env-supplied variants.
+            if (lower === 'authorization' || lower === 'content-type')
+                continue;
+            if (typeof value === 'string')
+                headers[key] = value;
+        }
+        return headers;
+    }
+    catch {
+        console.warn('[seq-studio] ignoring malformed ARTIFACT_STUDIO_EXTRA_HEADERS (expected a JSON object)');
+        return {};
+    }
+}
 async function fetchWith503Retry(input, init) {
     let attempt = 0;
     while (true) {
@@ -8,42 +43,64 @@ async function fetchWith503Retry(input, init) {
             return response;
         const retryAfter = Number(response.headers.get('Retry-After')) || DEFAULT_RETRY_AFTER_SECONDS;
         attempt += 1;
-        console.warn(`[artifact-studio] backend warming up (503); retrying in ${retryAfter}s (attempt ${attempt}/${MAX_503_RETRIES})`);
+        console.warn(`[seq-studio] backend warming up (503); retrying in ${retryAfter}s (attempt ${attempt}/${MAX_503_RETRIES})`);
         await new Promise((resolve) => setTimeout(resolve, retryAfter * 1000));
     }
 }
 export async function getJson({ baseUrl, token, path }) {
     const response = await fetchWith503Retry(`${baseUrl}${path}`, {
-        headers: { Authorization: `Bearer ${token}` },
+        headers: { ...extraHeaders(), Authorization: `Bearer ${token}` },
     });
     if (!response.ok)
-        throw new Error(await responseError(response));
+        throw new Error(await responseError('GET', path, response));
     return response.json();
 }
 export async function getJsonOr404({ baseUrl, token, path }) {
     const response = await fetchWith503Retry(`${baseUrl}${path}`, {
-        headers: { Authorization: `Bearer ${token}` },
+        headers: { ...extraHeaders(), Authorization: `Bearer ${token}` },
     });
     if (response.status === 404)
         return null;
     if (!response.ok)
-        throw new Error(await responseError(response));
+        throw new Error(await responseError('GET', path, response));
     return response.json();
 }
 export async function postJson({ baseUrl, token, path, body, }) {
     const response = await fetchWith503Retry(`${baseUrl}${path}`, {
         method: 'POST',
         headers: {
+            ...extraHeaders(),
             Authorization: `Bearer ${token}`,
             'Content-Type': 'application/json',
         },
         body: body === undefined ? undefined : JSON.stringify(body),
     });
     if (!response.ok)
-        throw new Error(await responseError(response));
+        throw new Error(await responseError('POST', path, response));
     return response.json();
 }
-async function responseError(response) {
-    const body = await response.json().catch(() => ({ detail: `HTTP ${response.status}` }));
-    return body.detail ?? body.error ?? `HTTP ${response.status}`;
+/**
+ * Build an actionable error message from a failed response: which request
+ * failed, with what status, and what the server said. A deploy runs several
+ * requests (project lookup, relink by slug, deployment upload), so a bare
+ * body like "Internal server error" with no request context is undebuggable.
+ * Prefers structured `{detail}`/`{error}` bodies; falls back to the raw body
+ * text (truncated — error pages can be huge) so an unexpected shape is never
+ * swallowed.
+ */
+async function responseError(method, path, response) {
+    const text = await response.text().catch(() => '');
+    let serverMessage = null;
+    try {
+        const body = JSON.parse(text);
+        if (typeof body.detail === 'string' && body.detail)
+            serverMessage = body.detail;
+        else if (typeof body.error === 'string' && body.error)
+            serverMessage = body.error;
+    }
+    catch {
+        // Non-JSON body (HTML error page, plain text) — fall back to raw text.
+    }
+    const summary = serverMessage ?? (text.trim() ? text.trim().slice(0, 300) : '(empty response body)');
+    return `${method} ${path} failed (HTTP ${response.status}): ${summary}`;
 }

package/dist/auth.js

@@ -87,7 +87,7 @@ export async function getAccessToken() {
         }),
     });
     if (!response.ok) {
-        throw new Error('Stored refresh token is no longer valid. Run artifact-studio login again.');
+        throw new Error('Stored refresh token is no longer valid. Run seqapi login again.');
     }
     const refreshed = await response.json();
     await writeTokenConfig({

package/dist/build-subprocess.d.ts

@@ -0,0 +1,15 @@
+import type { ArtifactStudioBuildResult } from './build.js';
+export interface IsolatedBuildOptions {
+    /** Override the worker entry script. Primarily for tests. */
+    workerPath?: string;
+    /** Abort to kill the in-flight build child (e.g. on watcher shutdown). */
+    signal?: AbortSignal;
+}
+/**
+ * Run a single artifact build in a short-lived child process and return its
+ * result. The child exits as soon as the build finishes, so the OS reclaims
+ * the memory that repeated in-process Vite builds otherwise leak. Use this in
+ * long-running watch loops; one-shot commands can call
+ * `buildArtifactStudioProject` directly.
+ */
+export declare function buildArtifactStudioProjectIsolated(dir: string, { workerPath, signal }?: IsolatedBuildOptions): Promise<ArtifactStudioBuildResult>;

package/dist/build-subprocess.js

@@ -0,0 +1,65 @@
+import { spawn } from 'node:child_process';
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+const DEFAULT_WORKER_PATH = join(dirname(fileURLToPath(import.meta.url)), 'build-worker.js');
+/**
+ * Run a single artifact build in a short-lived child process and return its
+ * result. The child exits as soon as the build finishes, so the OS reclaims
+ * the memory that repeated in-process Vite builds otherwise leak. Use this in
+ * long-running watch loops; one-shot commands can call
+ * `buildArtifactStudioProject` directly.
+ */
+export async function buildArtifactStudioProjectIsolated(dir, { workerPath = DEFAULT_WORKER_PATH, signal } = {}) {
+    const scratch = await mkdtemp(join(tmpdir(), 'artifact-build-'));
+    const outFile = join(scratch, 'result.json');
+    try {
+        await runWorker({ workerPath, dir, outFile, signal });
+        return JSON.parse(await readFile(outFile, 'utf8'));
+    }
+    finally {
+        await rm(scratch, { recursive: true, force: true });
+    }
+}
+function runWorker({ workerPath, dir, outFile, signal, }) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted) {
+            reject(new Error('build aborted'));
+            return;
+        }
+        const child = spawn(process.execPath, [workerPath, dir, outFile], {
+            stdio: ['ignore', 'inherit', 'pipe'],
+        });
+        const onAbort = () => {
+            child.kill('SIGTERM');
+        };
+        signal?.addEventListener('abort', onAbort, { once: true });
+        let stderr = '';
+        child.stderr.on('data', (chunk) => {
+            stderr += chunk.toString();
+        });
+        child.on('error', (error) => {
+            signal?.removeEventListener('abort', onAbort);
+            reject(error);
+        });
+        // Use 'close', not 'exit': 'exit' can fire before the stderr pipe has
+        // flushed all its 'data' events, which truncates (or drops) a multi-line
+        // build-error stack. 'close' is guaranteed to fire only after the stdio
+        // streams have fully drained, so `stderr` is complete here.
+        child.on('close', (code) => {
+            signal?.removeEventListener('abort', onAbort);
+            if (signal?.aborted) {
+                reject(new Error('build aborted'));
+                return;
+            }
+            if (code === 0) {
+                if (stderr.trim())
+                    process.stderr.write(stderr);
+                resolve();
+                return;
+            }
+            reject(new Error(stderr.trim() || `build worker exited with code ${code ?? 'null'}`));
+        });
+    });
+}

package/dist/build-worker.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/build-worker.js

@@ -0,0 +1,28 @@
+// Child-process entry for a single isolated artifact build.
+//
+// Repeatedly invoking Vite/rolldown's `build()` in one long-lived process
+// leaks retained native + module-graph state that GC cannot reclaim, so a
+// watch loop that builds in-process eventually OOMs. Running each build in a
+// short-lived child that exits afterward hands the leak to the OS: every
+// cycle starts from a clean process and memory stays flat.
+//
+// Usage (invoked by build-subprocess.ts, not by humans):
+//   node build-worker.js <projectDir> <outFile>
+// The build result is written as JSON to <outFile>; build errors go to stderr
+// with a non-zero exit code.
+import { writeFile } from 'node:fs/promises';
+import { buildArtifactStudioProject } from './build.js';
+async function main() {
+    const [dir, outFile] = process.argv.slice(2);
+    if (!dir || !outFile) {
+        process.stderr.write('usage: build-worker <projectDir> <outFile>\n');
+        process.exitCode = 2;
+        return;
+    }
+    const result = await buildArtifactStudioProject(dir);
+    await writeFile(outFile, JSON.stringify(result), 'utf8');
+}
+main().catch((error) => {
+    process.stderr.write((error instanceof Error ? (error.stack ?? error.message) : String(error)) + '\n');
+    process.exitCode = 1;
+});

package/dist/build.d.ts

@@ -1,5 +1,16 @@
 import { type ArtifactStudioSourceFile } from './project.js';
 import type { ArtifactStudioManifest } from './manifest.js';
+/**
+ * Import aliases for the Vite build. Artifacts are built against their own
+ * source tree, which usually has no installed node_modules, so every bare
+ * import the scaffold relies on is aliased to this package's pinned copy.
+ * This also pins a single instance of each library — one React, one
+ * react-query QueryClient context — so a duplicate copy can't silently break
+ * hooks or the provider/consumer link. Exported so it can be regression-tested
+ * (a missing/unresolvable peer must fail loudly).
+ */
+/** Platform + common artifact runtime peers — always aliased over node_modules. */
+export declare const PEER_RESOLVE_ALIAS: Record<string, string>;
 export interface ArtifactStudioBuildResult {
     manifest: ArtifactStudioManifest;
     files: ArtifactStudioSourceFile[];

package/dist/build.js

@@ -1,3 +1,4 @@
+import { existsSync } from 'node:fs';
 import { mkdir, writeFile } from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import { dirname, resolve } from 'node:path';
@@ -5,14 +6,58 @@ import { fileURLToPath } from 'node:url';
 import { build as viteBuild } from 'vite';
 import { sha256Hex } from './hash.js';
 import { readArtifactStudioSource } from './project.js';
+/** Keep in sync with `atlas/src/server/services/artifact-studio/limits.ts`. */
+const MAX_DEPLOY_SOURCEMAP_BYTES = 10 * 1024 * 1024;
 const cliRequire = createRequire(import.meta.url);
 const cliDir = dirname(fileURLToPath(import.meta.url));
 const reactDir = dirname(cliRequire.resolve('react/package.json'));
 const reactDomDir = dirname(cliRequire.resolve('react-dom/package.json'));
+// Artifacts (and the `react-vite` scaffold) import `@tanstack/react-query`
+// directly — they own their QueryClient. The build runs against the artifact's
+// source tree, which usually has no installed node_modules, so alias react-query
+// to this package's pinned copy (same pattern as react/react-dom/atlas-ui). This
+// also guarantees a single react-query instance — one QueryClient context — so a
+// duplicate copy can't silently break the provider/consumer link.
+const reactQueryDir = dirname(cliRequire.resolve('@tanstack/react-query/package.json'));
+const reactRouterDomDir = dirname(cliRequire.resolve('react-router-dom/package.json'));
+const sonnerDir = dirname(cliRequire.resolve('sonner'));
 const atlasUiDir = dirname(cliRequire.resolve('@sequenceholdings/atlas-ui/package.json'));
 const atlasUiDist = resolve(atlasUiDir, 'dist');
+// The shared Lattice form renderer is aliased the same way as atlas-ui (it is
+// an atlas-ui-peer library, prebuilt to dist). Resolved via ./package.json —
+// the package's exports map exposes it precisely so this resolve (and
+// `seq-studio dev --link`) work.
+const formRendererDir = dirname(cliRequire.resolve('@sequenceholdings/lattice-form-renderer/package.json'));
+const formRendererDist = resolve(formRendererDir, 'dist');
 const tailwindCssPath = resolve(dirname(cliRequire.resolve('tailwindcss/package.json')), 'index.css');
-const twAnimateCssPath = resolve(cliDir, '..', 'node_modules', 'tw-animate-css', 'dist', 'tw-animate.css');
+const twAnimateCssPath = resolveTwAnimateCssPath();
+/**
+ * Import aliases for the Vite build. Artifacts are built against their own
+ * source tree, which usually has no installed node_modules, so every bare
+ * import the scaffold relies on is aliased to this package's pinned copy.
+ * This also pins a single instance of each library — one React, one
+ * react-query QueryClient context — so a duplicate copy can't silently break
+ * hooks or the provider/consumer link. Exported so it can be regression-tested
+ * (a missing/unresolvable peer must fail loudly).
+ */
+/** Platform + common artifact runtime peers — always aliased over node_modules. */
+export const PEER_RESOLVE_ALIAS = {
+    'react/jsx-runtime': resolve(reactDir, 'jsx-runtime.js'),
+    'react/jsx-dev-runtime': resolve(reactDir, 'jsx-dev-runtime.js'),
+    react: reactDir,
+    'react-dom/client': resolve(reactDomDir, 'client'),
+    'react-dom': reactDomDir,
+    '@tanstack/react-query': reactQueryDir,
+    'react-router-dom': reactRouterDomDir,
+    sonner: sonnerDir,
+    '@sequenceholdings/atlas-ui/tokens.css': resolve(atlasUiDist, 'tokens.css'),
+    '@sequenceholdings/atlas-ui/charts': resolve(atlasUiDist, 'charts.mjs'),
+    '@sequenceholdings/atlas-ui': resolve(atlasUiDist, 'index.mjs'),
+    // Alias keys prefix-match, so subpath entries MUST precede their bare key
+    // (same ordering as tokens.css/charts above the bare atlas-ui key).
+    '@sequenceholdings/lattice-form-renderer/golden': resolve(formRendererDist, 'golden.mjs'),
+    '@sequenceholdings/lattice-form-renderer': resolve(formRendererDist, 'index.mjs'),
+};
 function isAssetOutput(value) {
     return value.type === 'asset';
 }
@@ -30,16 +75,7 @@ export async function buildArtifactStudioProject(rootDir) {
             (await import('@tailwindcss/vite')).default(),
         ],
         resolve: {
-            alias: {
-                'react/jsx-runtime': resolve(reactDir, 'jsx-runtime.js'),
-                'react/jsx-dev-runtime': resolve(reactDir, 'jsx-dev-runtime.js'),
-                react: reactDir,
-                'react-dom/client': resolve(reactDomDir, 'client'),
-                'react-dom': reactDomDir,
-                '@sequenceholdings/atlas-ui/tokens.css': resolve(atlasUiDist, 'tokens.css'),
-                '@sequenceholdings/atlas-ui/charts': resolve(atlasUiDist, 'charts.mjs'),
-                '@sequenceholdings/atlas-ui': resolve(atlasUiDist, 'index.mjs'),
-            },
+            alias: PEER_RESOLVE_ALIAS,
         },
         build: {
             write: false,
@@ -50,7 +86,6 @@ export async function buildArtifactStudioProject(rootDir) {
                 input: resolve(root, 'index.html'),
                 output: {
                     format: 'iife',
-                    inlineDynamicImports: true,
                     name: 'ArtifactStudioApp',
                 },
             },
@@ -62,15 +97,26 @@ export async function buildArtifactStudioProject(rootDir) {
         throw new Error('Build produced no JavaScript output');
     const css = collectCss(output);
     const bundle = css ? injectCssRuntime(css) + '\n' + js : js;
+    const sourceMap = fitSourceMapForDeploy(collectSourceMap(output));
     return {
         manifest: source.manifest,
         files: source.files,
         sourceHash: source.sourceHash,
         bundle,
-        sourceMap: collectSourceMap(output),
+        sourceMap,
         bundleHash: sha256Hex(bundle),
     };
 }
+function fitSourceMapForDeploy(sourceMap) {
+    if (!sourceMap)
+        return null;
+    const bytes = Buffer.byteLength(sourceMap, 'utf8');
+    if (bytes <= MAX_DEPLOY_SOURCEMAP_BYTES)
+        return sourceMap;
+    const mib = (bytes / (1024 * 1024)).toFixed(1);
+    console.warn(`[artifact-studio] omitting source map (${mib} MiB exceeds ${MAX_DEPLOY_SOURCEMAP_BYTES / (1024 * 1024)} MiB deploy limit)`);
+    return null;
+}
 export async function writeBuildArtifact(result, outPath) {
     const target = resolve(outPath);
     await mkdir(dirname(target), { recursive: true });
@@ -81,6 +127,14 @@ function artifactSdkVirtualModule() {
     const resolved = '\0sequence-artifact-sdk';
     return {
         name: 'sequence-artifact-sdk',
+        // `enforce: 'pre'` so this virtual module wins over an installed copy in the
+        // source tree's node_modules. The deployed bundle always runs against the
+        // host-injected `window.seq`, so a tree that happens to be `pnpm install`ed
+        // must produce the same bundle as a bare tree (e.g. one materialized from a
+        // git repo) — otherwise the same source yields different bytes depending on
+        // whether node_modules exists. The package's sole runtime export is `seq`
+        // (everything else is type-only), so this stub is a complete substitute.
+        enforce: 'pre',
         resolveId(id) {
             return virtualIds.has(id) ? resolved : undefined;
         },
@@ -110,6 +164,20 @@ function nextStubPlugin() {
         },
     };
 }
+function resolveTwAnimateCssPath() {
+    const candidates = [
+        // Workspace layout: shared/services/artifact-studio/node_modules/...
+        resolve(cliDir, '..', 'node_modules', 'tw-animate-css', 'dist', 'tw-animate.css'),
+        // pnpm file-dependency layout: .../node_modules/@sequenceholdings/artifact-studio/dist
+        // with dependencies hoisted beside the scope directory.
+        resolve(cliDir, '..', '..', '..', 'tw-animate-css', 'dist', 'tw-animate.css'),
+    ];
+    const resolved = candidates.find((candidate) => existsSync(candidate));
+    if (!resolved) {
+        throw new Error(`Unable to resolve tw-animate-css dist file. Tried: ${candidates.join(', ')}`);
+    }
+    return resolved;
+}
 function collectEntryJavaScript(output) {
     const entryChunks = output.filter((chunk) => chunk.type === 'chunk' && chunk.isEntry);
     if (entryChunks.length === 0)
@@ -145,7 +213,10 @@ function atlasUiCssResolverPlugin() {
             let result = code;
             if (result.includes('@import "tailwindcss"')) {
                 result = result.replace('@import "tailwindcss"', `@import ${JSON.stringify(tailwindCssPath)}`);
-                result = `@source ${JSON.stringify(atlasUiDist)};\n${result}`;
+                // Prebuilt dists whose class names Tailwind must scan: atlas-ui plus
+                // the form renderer (field-scope.tsx emits Tailwind utility classes
+                // that only appear in the renderer's dist, not the artifact source).
+                result = `@source ${JSON.stringify(atlasUiDist)};\n@source ${JSON.stringify(formRendererDist)};\n${result}`;
             }
             if (result.includes('@import "tw-animate-css"')) {
                 result = result.replace('@import "tw-animate-css"', `@import ${JSON.stringify(twAnimateCssPath)}`);

package/dist/cli.d.ts

@@ -1 +1,2 @@
 export declare function runCli(argv?: string[]): Promise<number>;
+export declare function setTokenProvider(provider: (() => Promise<string | null>) | null): void;