@sequenceholdings/artifact-studio 0.1.9 → 0.1.11

package/dist/auth.js

@@ -87,7 +87,7 @@ export async function getAccessToken() {
         }),
     });
     if (!response.ok) {
-        throw new Error('Stored refresh token is no longer valid. Run seqapi login again.');
+        throw new Error('Stored refresh token is no longer valid. Run seq-studio login again.');
     }
     const refreshed = await response.json();
     await writeTokenConfig({

package/dist/cli.js

@@ -3,7 +3,7 @@ import { existsSync } from 'node:fs';
 import { dirname, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { getJson, getJsonOr404, postJson } from './api.js';
-import { readLocalConfig, resolveEnvironment, writeLocalConfig, writeTokenConfig, } from './config.js';
+import { ENV_URLS, readLocalConfig, resolveEnvironment, writeLocalConfig, writeTokenConfig, } from './config.js';
 import { buildArtifactStudioProject, writeBuildArtifact } from './build.js';
 import { buildArtifactStudioProjectIsolated } from './build-subprocess.js';
 import { prepareArtifactBuildRoot } from './prepare-build.js';
@@ -45,10 +45,10 @@ const USAGE = `usage:
   --repo clones over smart-HTTP and REQUIRES a git PAT in ATLAS_GIT_PAT
   (repo:read scope) — create one with \`seq-studio auth pat create --scopes
   repo:read\` or in Atlas → Settings → Tokens. It's the same token you clone the
-  repo with. (--env + seqapi login are still needed to resolve the repo and
+  repo with. (--env + seq-studio login are still needed to resolve the repo and
   upload the deployment.)
 
-  Authenticate with: seqapi login`;
+  Authenticate with: seq-studio login`;
 export async function runCli(argv = process.argv.slice(2)) {
     const parsed = parseArgs(argv);
     if ('error' in parsed) {
@@ -116,7 +116,7 @@ async function initCommand(args) {
     await replaceInFile(join(dir, 'artifact.bundle.yml'), /\{\{title\}\}/g, titleize(slug));
     await replaceInFile(join(dir, 'package.json'), /\{\{slug\}\}/g, slug);
     console.log(`[seq-studio] initialized ${dir}`);
-    console.log('Next: seqapi login && seq-studio artifact dev --env staging');
+    console.log('Next: seq-studio login && seq-studio artifact dev --env <env>  (see: seq-studio envs list)');
     return 0;
 }
 async function loginCommand(args) {
@@ -204,7 +204,9 @@ async function linkCommand(args) {
 async function envCommand(args) {
     const [subcommand, value] = args.positional;
     if (subcommand === 'list') {
-        console.log('local\nstaging\nproduction\nbanksouth');
+        for (const name of Object.keys(ENV_URLS))
+            console.log(name);
+        console.log('(deployed environments are discovered per-identity — run: seq-studio envs list)');
         return 0;
     }
     if (subcommand === 'use') {
@@ -229,7 +231,7 @@ async function statusCommand(args) {
     if (env.name === 'local') {
         await fetch(`${env.url}/api/health`)
             .then((response) => console.log(`local Atlas: ${response.ok ? 'ready' : `HTTP ${response.status}`}`))
-            .catch(() => console.log('local Atlas: not reachable (start Atlas on port 5001 or pass --env staging)'));
+            .catch(() => console.log('local Atlas: not reachable (start Atlas on port 5001 or pass --env <env>)'));
     }
     return 0;
 }
@@ -382,7 +384,7 @@ async function planCommand(args) {
         console.log(`  source: ${result.sourceHash}`);
         console.log(`  bundle: ${result.bundleHash}`);
         if (!token) {
-            console.log('  remote: skipped (run seqapi login)');
+            console.log('  remote: skipped (run seq-studio login)');
             return 0;
         }
         const remote = await fetchRemoteProject({ env: env.url, token, slug: result.manifest.artifact.project_id });
@@ -709,7 +711,7 @@ async function ensureRemoteProject({ env, token, result, linkConfigDir, allowCre
     if (!allowCreate) {
         throw new Error(`project "${result.manifest.artifact.project_id}" does not exist on ${env} and --no-create is set. ` +
             `First-time provisioning is a human step: run \`seq-studio artifact deploy . -e <env>\` once with your ` +
-            `own login (seqapi login) to create the project, then the CI sweep keeps it updated.`);
+            `own login (\`seq-studio login\`) to create the project, then the CI sweep keeps it updated.`);
     }
     const created = await postJson({
         baseUrl: env,
@@ -787,7 +789,7 @@ export function setTokenProvider(provider) {
 async function getRequiredToken(args) {
     const token = await getOptionalToken(args);
     if (!token)
-        throw new Error('Missing token. Run seqapi login or pass --token.');
+        throw new Error('Missing token. Run seq-studio login or pass --token.');
     return token;
 }
 async function getOptionalToken(args) {

package/dist/config.d.ts

@@ -1,3 +1,9 @@
+/**
+ * Only `local` ships in the published package. Deployed-environment URLs
+ * are resolved by the embedding CLI (seq-studio), which discovers the
+ * environments visible to the caller's identity and injects the resolved
+ * URL via ARTIFACT_STUDIO_BASE_URL (see resolveEnvironment below).
+ */
 export declare const ENV_URLS: Record<string, string>;
 export interface LocalProjectConfig {
     projectId?: string;
@@ -18,6 +24,7 @@ export declare function readLocalConfig(cwd?: string): Promise<LocalProjectConfi
 export declare function writeLocalConfig(config: LocalProjectConfig, cwd?: string): Promise<void>;
 export declare function readTokenConfig(): Promise<TokenConfig>;
 export declare function writeTokenConfig(config: TokenConfig): Promise<void>;
+export declare function knownEnvUrls(): Record<string, string>;
 export declare function resolveEnvironment(name: string | undefined, fallback?: string): {
     name: string;
     url: string;

package/dist/config.js

@@ -2,11 +2,14 @@ import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { homedir } from 'node:os';
+/**
+ * Only `local` ships in the published package. Deployed-environment URLs
+ * are resolved by the embedding CLI (seq-studio), which discovers the
+ * environments visible to the caller's identity and injects the resolved
+ * URL via ARTIFACT_STUDIO_BASE_URL (see resolveEnvironment below).
+ */
 export const ENV_URLS = {
     local: 'http://localhost:5001',
-    staging: 'https://staging.atlas.seqholdings.com',
-    production: 'https://atlas.seqholdings.com',
-    banksouth: 'https://banksouth.seqholdings.com',
 };
 export function globalConfigDir() {
     return join(homedir(), '.config', 'sequence-artifact-studio');
@@ -42,6 +45,35 @@ export async function writeTokenConfig(config) {
     await mkdir(dirname(path), { recursive: true });
     await writeFile(path, JSON.stringify(config, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
 }
+/**
+ * Environment map injected by the embedding CLI (seq-studio sets
+ * ARTIFACT_STUDIO_ENV_URLS to the JSON name→url map of environments visible
+ * to the caller's identity). Lets commands that resolve an env *name* without
+ * an explicit --env flag — the stored `defaultEnv`, `artifact env set` —
+ * reach deployed environments, not just the built-in `local`.
+ */
+function embedderEnvUrls() {
+    const raw = process.env['ARTIFACT_STUDIO_ENV_URLS']?.trim();
+    if (!raw)
+        return {};
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== 'object' || parsed === null)
+            return {};
+        const out = {};
+        for (const [name, url] of Object.entries(parsed)) {
+            if (typeof url === 'string' && url)
+                out[name] = url;
+        }
+        return out;
+    }
+    catch {
+        return {};
+    }
+}
+export function knownEnvUrls() {
+    return { ...ENV_URLS, ...embedderEnvUrls() };
+}
 export function resolveEnvironment(name, fallback) {
     const envName = name ?? fallback;
     // Allow `seq-studio artifact` (and any other embedder that wants to
@@ -52,11 +84,18 @@ export function resolveEnvironment(name, fallback) {
     const overrideUrl = process.env['ARTIFACT_STUDIO_BASE_URL']?.trim() || undefined;
     if (overrideUrl) {
         if (!envName)
-            throw new Error('--env must be one of: local, staging, production, banksouth');
+            throw new Error(unknownEnvMessage(envName));
         return { name: envName, url: overrideUrl };
     }
-    const url = envName ? ENV_URLS[envName] : undefined;
+    const envUrls = knownEnvUrls();
+    const url = envName ? envUrls[envName] : undefined;
     if (!envName || !url)
-        throw new Error('--env must be one of: local, staging, production, banksouth');
+        throw new Error(unknownEnvMessage(envName));
     return { name: envName, url };
 }
+function unknownEnvMessage(envName) {
+    const known = Object.keys(knownEnvUrls()).join(', ');
+    return (`--env ${envName ? `"${envName}" is not available here` : 'is required'} ` +
+        `(known: ${known}). Deployed environments are resolved through ` +
+        `seq-studio (run: seq-studio envs list), or set ARTIFACT_STUDIO_BASE_URL.`);
+}

package/dist/git-clone.js

@@ -42,14 +42,18 @@ export function redactCloneUrl(url) {
     }
 }
 /**
- * Abort an HTTP transfer that drops below ~1 KB/s for 30s — the primary stall
- * guard, so a wedged smart-HTTP fetch fails cleanly in ~30s instead of hanging
- * a deploy/CI. Passed as `git -c` so it applies to the clone's fetch.
+ * Abort a smart-HTTP transfer that drops below ~1 KB/s for a sustained window,
+ * so a wedged fetch fails cleanly instead of hanging a deploy/CI. The window
+ * must clear the git-service's *server-side pack generation* pause: upload-pack
+ * enumerates + compresses objects before streaming a single byte, and for a
+ * real repo that silent gap is tens of seconds (observed ~55s for a 145-file
+ * artifact). A 30s threshold false-killed those legitimate clones, so allow a
+ * generous 180s of silence — the hard timeout below is the real backstop.
  */
 const GIT_LOW_SPEED_LIMIT_BYTES = 1000;
-const GIT_LOW_SPEED_TIME_SEC = 30;
-/** Backstop hard deadline: kill the child even if it trickles just above the low-speed floor. */
-const GIT_CLONE_TIMEOUT_MS = 5 * 60_000;
+const GIT_LOW_SPEED_TIME_SEC = 180;
+/** Backstop hard deadline: SIGKILL the child even if it trickles above the low-speed floor. */
+const GIT_CLONE_TIMEOUT_MS = 6 * 60_000;
 /** First non-flag arg (the git subcommand), skipping `-c <value>` config pairs. */
 function gitVerb(args) {
     for (let i = 0; i < args.length; i++) {

package/dist/prepare-build.d.ts

@@ -1,3 +1,12 @@
+/**
+ * Pinned pnpm for remote artifact installs, run via `npx`. Kept in lockstep
+ * with the repo's root `packageManager`. Do not float to latest: pnpm 11+ adds
+ * an UNCONDITIONAL tarball-URL verification policy (no opt-out) that rejects
+ * Chainguard's upstream-proxied tarballs at install time
+ * (ERR_PNPM_TARBALL_URL_MISMATCH). We run it via npx — which ships with npm on
+ * every Node release — rather than corepack, which Node 25+ no longer bundles.
+ */
+export declare const ARTIFACT_BUILD_PNPM = "pnpm@10.28.2";
 /** Chainguard registry routing for ephemeral remote builds. */
 export declare const ARTIFACT_BUILD_NPMRC = "; Ephemeral install config for seq-studio artifact builds.\nregistry=https://libraries.cgr.dev/javascript/\n//libraries.cgr.dev/javascript/:always-auth=true\n//libraries.cgr.dev/javascript-upstream/:always-auth=true\nignore-scripts=true\nmanage-package-manager-versions=false\n";
 /** Pull only Chainguard registry auth lines from the developer ~/.npmrc. */

package/dist/prepare-build.js

@@ -5,6 +5,15 @@ import { homedir, tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { stripInstallControlFiles } from './sanitize-remote-tree.js';
 import { assertTrustedArtifactInstallTree } from './trusted-install.js';
+/**
+ * Pinned pnpm for remote artifact installs, run via `npx`. Kept in lockstep
+ * with the repo's root `packageManager`. Do not float to latest: pnpm 11+ adds
+ * an UNCONDITIONAL tarball-URL verification policy (no opt-out) that rejects
+ * Chainguard's upstream-proxied tarballs at install time
+ * (ERR_PNPM_TARBALL_URL_MISMATCH). We run it via npx — which ships with npm on
+ * every Node release — rather than corepack, which Node 25+ no longer bundles.
+ */
+export const ARTIFACT_BUILD_PNPM = 'pnpm@10.28.2';
 /** Chainguard registry routing for ephemeral remote builds. */
 export const ARTIFACT_BUILD_NPMRC = `; Ephemeral install config for seq-studio artifact builds.
 registry=https://libraries.cgr.dev/javascript/
@@ -65,28 +74,44 @@ export async function prepareArtifactBuildRoot(dir, opts = {}) {
         console.warn(`[seq-studio] stripped install-control files from remote tree (not committed): ${stripped.join(', ')}`);
     }
     assertTrustedArtifactInstallTree(dir);
+    // Defense-in-depth: never trust a node_modules committed into the checkout.
+    // The trust walk skips node_modules, so a crafted tree could smuggle a
+    // malicious `node_modules/pnpm` bin. We both (a) remove any pre-existing
+    // node_modules and (b) run npx from a trusted cwd below so npx can't resolve
+    // the pinned CLI out of the untrusted tree.
+    await rm(join(dir, 'node_modules'), { recursive: true, force: true });
     const configDir = await mkdtemp(join(tmpdir(), 'artifact-pnpm-'));
     const controlledNpmrc = join(configDir, '.npmrc');
     const args = ['install', '--frozen-lockfile', '--ignore-scripts', '--prod'];
     const userNpmrcPath = process.env.npm_config_userconfig ?? join(homedir(), '.npmrc');
-    console.log('[seq-studio] installing dependencies (frozen lockfile, prod only)…');
+    console.log(`[seq-studio] installing dependencies (frozen lockfile, prod only) via ${ARTIFACT_BUILD_PNPM}…`);
     try {
         await writeFile(controlledNpmrc, buildControlledArtifactNpmrc(userNpmrcPath), { mode: 0o600 });
-        execFileSync('pnpm', args, {
-            cwd: dir,
+        // Run a PINNED pnpm via `npx`, not the operator's ambient `pnpm`. The
+        // install must be reproducible across laptops and CI: in a bare temp clone
+        // dir the ambient pnpm resolves to latest (11.x), whose unconditional
+        // tarball-URL policy rejects Chainguard's upstream-proxied tarballs with
+        // ERR_PNPM_TARBALL_URL_MISMATCH. `npx` ships with npm on every Node release
+        // (including Node 25+, which dropped corepack), fetches the pinned pnpm, and
+        // caches it. `--yes` skips the install-confirmation prompt.
+        //
+        // SECURITY: run npx from the trusted `configDir` (not `dir`) so it can't
+        // resolve/execute a pnpm bin planted in the checkout's node_modules; pnpm
+        // still operates on the checkout via `--dir`.
+        execFileSync('npx', ['--yes', ARTIFACT_BUILD_PNPM, '--dir', dir, ...args], {
+            cwd: configDir,
             stdio: 'inherit',
             env: {
                 ...process.env,
                 npm_config_userconfig: controlledNpmrc,
-                COREPACK_ENABLE_AUTO_PIN: '0',
-                COREPACK_ENABLE_DOWNLOAD_PROMPT: '0',
             },
         });
     }
     catch (error) {
-        const hint = 'Lockfile out of sync or registry auth missing — run `pnpm install` locally and commit pnpm-lock.yaml.';
+        const hint = 'Lockfile out of sync, registry auth missing, or npx unavailable — ' +
+            'run `pnpm install` locally and commit pnpm-lock.yaml, and ensure Node ships npm/npx.';
         const detail = error instanceof Error ? error.message : String(error);
-        throw new Error(`pnpm install failed for artifact build. ${hint} (${detail})`);
+        throw new Error(`artifact dependency install failed (${ARTIFACT_BUILD_PNPM}). ${hint} (${detail})`);
     }
     finally {
         await rm(configDir, { recursive: true, force: true });

package/dist/source-resolver.js

@@ -82,7 +82,8 @@ export async function resolveArtifactSource(spec, opts = {}) {
     try {
         if (spec.kind === 'git-service') {
             if (!opts.baseUrl || !opts.token) {
-                throw new Error('Deploying from --repo needs a target environment and auth. Pass --env and run `seqapi login`.');
+                throw new Error('Deploying from --repo needs a target environment and auth. ' +
+                    'Pass --env and run `seq-studio login`.');
             }
             // resolveRepo + resolveCommitSha use the Auth0/M2M token: the clone URL
             // is id-addressed (no by-path endpoint), and we pin the build to the

package/dist/templates/react-vite/artifact.bundle.yml

@@ -24,7 +24,9 @@ capabilities:
   functions:
     invoke: []
 
+# Point each target at an Atlas deployment you can access.
+# Run `seq-studio envs list` to see the environments visible to your identity.
 targets:
-  staging:
-    url: https://staging.atlas.seqholdings.com
+  local:
+    url: http://localhost:5001
     visibility: private

package/package.json

@@ -9,7 +9,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.1.9",
+  "version": "0.1.11",
   "description": "SDK types and CLI library for building Artifact Studio apps. Driven via `seq-studio artifact <sub>` (@sequenceholdings/studio-cli), which runs the `./cli` runCli export.",
   "type": "module",
   "exports": {
@@ -51,8 +51,8 @@
     "tw-animate-css": "^1.4.0",
     "vite": "8.0.16",
     "zod": "^4.1.13",
-    "@sequenceholdings/atlas-ui": "0.1.3",
-    "@sequenceholdings/lattice-form-renderer": "0.1.0"
+    "@sequenceholdings/lattice-form-renderer": "0.1.0",
+    "@sequenceholdings/atlas-ui": "0.1.3"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",

package/templates/react-vite/artifact.bundle.yml

@@ -24,7 +24,9 @@ capabilities:
   functions:
     invoke: []
 
+# Point each target at an Atlas deployment you can access.
+# Run `seq-studio envs list` to see the environments visible to your identity.
 targets:
-  staging:
-    url: https://staging.atlas.seqholdings.com
+  local:
+    url: http://localhost:5001
     visibility: private