@sequenceholdings/artifact-studio 0.1.9 → 0.1.10

package/dist/auth.js

@@ -87,7 +87,7 @@ export async function getAccessToken() {
         }),
     });
     if (!response.ok) {
-        throw new Error('Stored refresh token is no longer valid. Run seqapi login again.');
+        throw new Error('Stored refresh token is no longer valid. Run seq-studio login again.');
     }
     const refreshed = await response.json();
     await writeTokenConfig({

package/dist/cli.js

@@ -45,10 +45,10 @@ const USAGE = `usage:
   --repo clones over smart-HTTP and REQUIRES a git PAT in ATLAS_GIT_PAT
   (repo:read scope) — create one with \`seq-studio auth pat create --scopes
   repo:read\` or in Atlas → Settings → Tokens. It's the same token you clone the
-  repo with. (--env + seqapi login are still needed to resolve the repo and
+  repo with. (--env + seq-studio login are still needed to resolve the repo and
   upload the deployment.)
 
-  Authenticate with: seqapi login`;
+  Authenticate with: seq-studio login`;
 export async function runCli(argv = process.argv.slice(2)) {
     const parsed = parseArgs(argv);
     if ('error' in parsed) {
@@ -116,7 +116,7 @@ async function initCommand(args) {
     await replaceInFile(join(dir, 'artifact.bundle.yml'), /\{\{title\}\}/g, titleize(slug));
     await replaceInFile(join(dir, 'package.json'), /\{\{slug\}\}/g, slug);
     console.log(`[seq-studio] initialized ${dir}`);
-    console.log('Next: seqapi login && seq-studio artifact dev --env staging');
+    console.log('Next: seq-studio login && seq-studio artifact dev --env staging');
     return 0;
 }
 async function loginCommand(args) {
@@ -382,7 +382,7 @@ async function planCommand(args) {
         console.log(`  source: ${result.sourceHash}`);
         console.log(`  bundle: ${result.bundleHash}`);
         if (!token) {
-            console.log('  remote: skipped (run seqapi login)');
+            console.log('  remote: skipped (run seq-studio login)');
             return 0;
         }
         const remote = await fetchRemoteProject({ env: env.url, token, slug: result.manifest.artifact.project_id });
@@ -709,7 +709,7 @@ async function ensureRemoteProject({ env, token, result, linkConfigDir, allowCre
     if (!allowCreate) {
         throw new Error(`project "${result.manifest.artifact.project_id}" does not exist on ${env} and --no-create is set. ` +
             `First-time provisioning is a human step: run \`seq-studio artifact deploy . -e <env>\` once with your ` +
-            `own login (seqapi login) to create the project, then the CI sweep keeps it updated.`);
+            `own login (\`seq-studio login\`) to create the project, then the CI sweep keeps it updated.`);
     }
     const created = await postJson({
         baseUrl: env,
@@ -787,7 +787,7 @@ export function setTokenProvider(provider) {
 async function getRequiredToken(args) {
     const token = await getOptionalToken(args);
     if (!token)
-        throw new Error('Missing token. Run seqapi login or pass --token.');
+        throw new Error('Missing token. Run seq-studio login or pass --token.');
     return token;
 }
 async function getOptionalToken(args) {

package/dist/git-clone.js

@@ -42,14 +42,18 @@ export function redactCloneUrl(url) {
     }
 }
 /**
- * Abort an HTTP transfer that drops below ~1 KB/s for 30s — the primary stall
- * guard, so a wedged smart-HTTP fetch fails cleanly in ~30s instead of hanging
- * a deploy/CI. Passed as `git -c` so it applies to the clone's fetch.
+ * Abort a smart-HTTP transfer that drops below ~1 KB/s for a sustained window,
+ * so a wedged fetch fails cleanly instead of hanging a deploy/CI. The window
+ * must clear the git-service's *server-side pack generation* pause: upload-pack
+ * enumerates + compresses objects before streaming a single byte, and for a
+ * real repo that silent gap is tens of seconds (observed ~55s for a 145-file
+ * artifact). A 30s threshold false-killed those legitimate clones, so allow a
+ * generous 180s of silence — the hard timeout below is the real backstop.
  */
 const GIT_LOW_SPEED_LIMIT_BYTES = 1000;
-const GIT_LOW_SPEED_TIME_SEC = 30;
-/** Backstop hard deadline: kill the child even if it trickles just above the low-speed floor. */
-const GIT_CLONE_TIMEOUT_MS = 5 * 60_000;
+const GIT_LOW_SPEED_TIME_SEC = 180;
+/** Backstop hard deadline: SIGKILL the child even if it trickles above the low-speed floor. */
+const GIT_CLONE_TIMEOUT_MS = 6 * 60_000;
 /** First non-flag arg (the git subcommand), skipping `-c <value>` config pairs. */
 function gitVerb(args) {
     for (let i = 0; i < args.length; i++) {

package/dist/prepare-build.d.ts

@@ -1,3 +1,12 @@
+/**
+ * Pinned pnpm for remote artifact installs, run via `npx`. Kept in lockstep
+ * with the repo's root `packageManager`. Do not float to latest: pnpm 11+ adds
+ * an UNCONDITIONAL tarball-URL verification policy (no opt-out) that rejects
+ * Chainguard's upstream-proxied tarballs at install time
+ * (ERR_PNPM_TARBALL_URL_MISMATCH). We run it via npx — which ships with npm on
+ * every Node release — rather than corepack, which Node 25+ no longer bundles.
+ */
+export declare const ARTIFACT_BUILD_PNPM = "pnpm@10.28.2";
 /** Chainguard registry routing for ephemeral remote builds. */
 export declare const ARTIFACT_BUILD_NPMRC = "; Ephemeral install config for seq-studio artifact builds.\nregistry=https://libraries.cgr.dev/javascript/\n//libraries.cgr.dev/javascript/:always-auth=true\n//libraries.cgr.dev/javascript-upstream/:always-auth=true\nignore-scripts=true\nmanage-package-manager-versions=false\n";
 /** Pull only Chainguard registry auth lines from the developer ~/.npmrc. */

package/dist/prepare-build.js

@@ -5,6 +5,15 @@ import { homedir, tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { stripInstallControlFiles } from './sanitize-remote-tree.js';
 import { assertTrustedArtifactInstallTree } from './trusted-install.js';
+/**
+ * Pinned pnpm for remote artifact installs, run via `npx`. Kept in lockstep
+ * with the repo's root `packageManager`. Do not float to latest: pnpm 11+ adds
+ * an UNCONDITIONAL tarball-URL verification policy (no opt-out) that rejects
+ * Chainguard's upstream-proxied tarballs at install time
+ * (ERR_PNPM_TARBALL_URL_MISMATCH). We run it via npx — which ships with npm on
+ * every Node release — rather than corepack, which Node 25+ no longer bundles.
+ */
+export const ARTIFACT_BUILD_PNPM = 'pnpm@10.28.2';
 /** Chainguard registry routing for ephemeral remote builds. */
 export const ARTIFACT_BUILD_NPMRC = `; Ephemeral install config for seq-studio artifact builds.
 registry=https://libraries.cgr.dev/javascript/
@@ -65,28 +74,44 @@ export async function prepareArtifactBuildRoot(dir, opts = {}) {
         console.warn(`[seq-studio] stripped install-control files from remote tree (not committed): ${stripped.join(', ')}`);
     }
     assertTrustedArtifactInstallTree(dir);
+    // Defense-in-depth: never trust a node_modules committed into the checkout.
+    // The trust walk skips node_modules, so a crafted tree could smuggle a
+    // malicious `node_modules/pnpm` bin. We both (a) remove any pre-existing
+    // node_modules and (b) run npx from a trusted cwd below so npx can't resolve
+    // the pinned CLI out of the untrusted tree.
+    await rm(join(dir, 'node_modules'), { recursive: true, force: true });
     const configDir = await mkdtemp(join(tmpdir(), 'artifact-pnpm-'));
     const controlledNpmrc = join(configDir, '.npmrc');
     const args = ['install', '--frozen-lockfile', '--ignore-scripts', '--prod'];
     const userNpmrcPath = process.env.npm_config_userconfig ?? join(homedir(), '.npmrc');
-    console.log('[seq-studio] installing dependencies (frozen lockfile, prod only)…');
+    console.log(`[seq-studio] installing dependencies (frozen lockfile, prod only) via ${ARTIFACT_BUILD_PNPM}…`);
     try {
         await writeFile(controlledNpmrc, buildControlledArtifactNpmrc(userNpmrcPath), { mode: 0o600 });
-        execFileSync('pnpm', args, {
-            cwd: dir,
+        // Run a PINNED pnpm via `npx`, not the operator's ambient `pnpm`. The
+        // install must be reproducible across laptops and CI: in a bare temp clone
+        // dir the ambient pnpm resolves to latest (11.x), whose unconditional
+        // tarball-URL policy rejects Chainguard's upstream-proxied tarballs with
+        // ERR_PNPM_TARBALL_URL_MISMATCH. `npx` ships with npm on every Node release
+        // (including Node 25+, which dropped corepack), fetches the pinned pnpm, and
+        // caches it. `--yes` skips the install-confirmation prompt.
+        //
+        // SECURITY: run npx from the trusted `configDir` (not `dir`) so it can't
+        // resolve/execute a pnpm bin planted in the checkout's node_modules; pnpm
+        // still operates on the checkout via `--dir`.
+        execFileSync('npx', ['--yes', ARTIFACT_BUILD_PNPM, '--dir', dir, ...args], {
+            cwd: configDir,
             stdio: 'inherit',
             env: {
                 ...process.env,
                 npm_config_userconfig: controlledNpmrc,
-                COREPACK_ENABLE_AUTO_PIN: '0',
-                COREPACK_ENABLE_DOWNLOAD_PROMPT: '0',
             },
         });
     }
     catch (error) {
-        const hint = 'Lockfile out of sync or registry auth missing — run `pnpm install` locally and commit pnpm-lock.yaml.';
+        const hint = 'Lockfile out of sync, registry auth missing, or npx unavailable — ' +
+            'run `pnpm install` locally and commit pnpm-lock.yaml, and ensure Node ships npm/npx.';
         const detail = error instanceof Error ? error.message : String(error);
-        throw new Error(`pnpm install failed for artifact build. ${hint} (${detail})`);
+        throw new Error(`artifact dependency install failed (${ARTIFACT_BUILD_PNPM}). ${hint} (${detail})`);
     }
     finally {
         await rm(configDir, { recursive: true, force: true });

package/dist/source-resolver.js

@@ -82,7 +82,8 @@ export async function resolveArtifactSource(spec, opts = {}) {
     try {
         if (spec.kind === 'git-service') {
             if (!opts.baseUrl || !opts.token) {
-                throw new Error('Deploying from --repo needs a target environment and auth. Pass --env and run `seqapi login`.');
+                throw new Error('Deploying from --repo needs a target environment and auth. ' +
+                    'Pass --env and run `seq-studio login`.');
             }
             // resolveRepo + resolveCommitSha use the Auth0/M2M token: the clone URL
             // is id-addressed (no by-path endpoint), and we pin the build to the

package/package.json

@@ -9,7 +9,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "SDK types and CLI library for building Artifact Studio apps. Driven via `seq-studio artifact <sub>` (@sequenceholdings/studio-cli), which runs the `./cli` runCli export.",
   "type": "module",
   "exports": {
@@ -51,8 +51,8 @@
     "tw-animate-css": "^1.4.0",
     "vite": "8.0.16",
     "zod": "^4.1.13",
-    "@sequenceholdings/atlas-ui": "0.1.3",
-    "@sequenceholdings/lattice-form-renderer": "0.1.0"
+    "@sequenceholdings/lattice-form-renderer": "0.1.0",
+    "@sequenceholdings/atlas-ui": "0.1.3"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",