@sequenceholdings/artifact-studio 0.2.5 → 0.3.0

package/dist/gateway/session.js

@@ -0,0 +1,143 @@
+import { createHmac, createPrivateKey, randomUUID, sign, timingSafeEqual } from 'node:crypto';
+import { z } from 'zod';
+import { artifactRequestContextSchema } from '../server/request-context.js';
+import { normalizePublicOrigin } from '../tunnel/protocol.js';
+import { artifactNextFrameworkBuildIdSchema } from '../runtime-contracts.js';
+export const GATEWAY_SESSION_COOKIE = '__Host-atlas-artifact-session';
+export function gatewayReleaseCookieName(deploymentId) {
+    if (!/^[a-zA-Z0-9_-]{1,128}$/.test(deploymentId))
+        throw new Error('Invalid deployment identifier');
+    return `${GATEWAY_SESSION_COOKIE}-${deploymentId}`;
+}
+const origin = z.string().refine(value => { try {
+    return normalizePublicOrigin(value) === value;
+}
+catch {
+    return false;
+} });
+const id = z.string().min(1).max(255);
+const sessionSchema = z.object({
+    version: z.literal(1), kind: z.enum(['development', 'hosted']),
+    sessionId: id.nullable(), deploymentId: id.nullable(),
+    frameworkBuildId: artifactNextFrameworkBuildIdSchema.nullable(), projectId: id, ownerId: id,
+    environment: id, publicOrigin: origin, expiresAt: z.number().int().positive(), maxExpiresAt: z.number().int().positive().optional(), published: z.boolean(),
+    bridge: artifactRequestContextSchema.shape.bridge,
+    lattice: artifactRequestContextSchema.shape.lattice.optional(),
+    taskRoutes: artifactRequestContextSchema.shape.taskRoutes,
+}).strict().refine(value => value.kind === 'development'
+    ? value.sessionId !== null && value.deploymentId === null && value.frameworkBuildId === null && !value.published
+    : value.sessionId === null && value.deploymentId !== null && value.frameworkBuildId !== null);
+function sameSessionScope(left, right) {
+    return left.ownerId === right.ownerId && left.projectId === right.projectId &&
+        left.environment === right.environment && left.publicOrigin === right.publicOrigin &&
+        left.kind === right.kind && left.published === right.published;
+}
+/** Active use renews the idle window, but never extends the original admission's eight-hour bound. */
+export function renewGatewaySession({ session, authorizedExpiresAt, now = Date.now() }) {
+    if (session.expiresAt <= now || session.expiresAt - now > 15 * 60_000)
+        return null;
+    const expiresAt = Math.min(authorizedExpiresAt, session.maxExpiresAt ?? session.expiresAt);
+    return expiresAt > session.expiresAt ? { ...session, expiresAt } : null;
+}
+export function gatewaySessionCookies({ session, key, cookie, renewal = false, now = Date.now() }) {
+    const maxAge = Math.max(0, Math.floor((session.expiresAt - now) / 1000));
+    const value = `${encodeGatewaySession({ session, key })}; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=${maxAge}`;
+    const current = renewal ? decodeGatewaySession({ cookie, key, origin: session.publicOrigin, now }) : session;
+    if (!current || !sameSessionScope(current, session))
+        return [];
+    const sameTarget = current.deploymentId === session.deploymentId && current.sessionId === session.sessionId;
+    const cookies = sameTarget ? [`${GATEWAY_SESSION_COOKIE}=${value}`] : [];
+    if (session.deploymentId)
+        cookies.push(`${gatewayReleaseCookieName(session.deploymentId)}=${value}`);
+    if (!renewal) {
+        const selected = session.deploymentId ? gatewayReleaseCookieName(session.deploymentId) : '';
+        const retained = [...new Set((cookie ?? '').split(';').map(item => item.trim().split('=', 1)[0])
+                .filter(name => name.startsWith(`${GATEWAY_SESSION_COOKIE}-`) && name !== selected && /^[a-zA-Z0-9_-]+$/.test(name)))];
+        const sameScope = [], revoked = [];
+        for (const name of retained) {
+            const release = decodeSignedCookie({ cookie, key, origin: session.publicOrigin, now,
+                deploymentId: name.slice(GATEWAY_SESSION_COOKIE.length + 1) });
+            if (release && sameSessionScope(release, session))
+                sameScope.push(name);
+            else
+                revoked.push(name);
+        }
+        for (const name of [...revoked, ...sameScope.slice(0, Math.max(0, sameScope.length - 5))]) {
+            cookies.push(`${name}=; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=0`);
+        }
+    }
+    return cookies;
+}
+function mac(value, key) {
+    if (Buffer.byteLength(key) < 32)
+        throw new Error('Gateway session key requires at least 32 bytes');
+    return createHmac('sha256', key).update(value).digest();
+}
+export function encodeGatewaySession({ session, key }) {
+    const payload = Buffer.from(JSON.stringify(sessionSchema.parse(session))).toString('base64url');
+    return `${payload}.${mac(payload, key).toString('base64url')}`;
+}
+function decodeSignedCookie({ cookie, key, origin: expectedOrigin, now = Date.now(), deploymentId }) {
+    try {
+        if (!cookie || cookie.length > 32768)
+            return null;
+        const name = deploymentId ? gatewayReleaseCookieName(deploymentId) : GATEWAY_SESSION_COOKIE;
+        const values = cookie.split(';').map(value => value.trim()).filter(value => value.startsWith(`${name}=`));
+        if (values.length !== 1)
+            return null;
+        const [payload, signature, extra] = values[0].slice(name.length + 1).split('.');
+        if (!payload || !signature || extra || !/^[A-Za-z0-9_-]+$/.test(payload) || !/^[A-Za-z0-9_-]+$/.test(signature))
+            return null;
+        const expected = mac(payload, key), actual = Buffer.from(signature, 'base64url');
+        if (actual.length !== expected.length || !timingSafeEqual(expected, actual))
+            return null;
+        const session = sessionSchema.parse(JSON.parse(Buffer.from(payload, 'base64url').toString('utf8')));
+        return session.expiresAt > now && session.publicOrigin === expectedOrigin &&
+            (!deploymentId || session.deploymentId === deploymentId) ? session : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Retained releases preserve tabs, never a different login or runtime scope. */
+export function decodeGatewaySession(input) {
+    const current = decodeSignedCookie({ ...input, deploymentId: undefined });
+    if (!current)
+        return null;
+    const matchesBuild = (candidate) => !input.frameworkBuildId || candidate.frameworkBuildId === input.frameworkBuildId;
+    if (input.deploymentId) {
+        const selected = current.deploymentId === input.deploymentId ? current : decodeSignedCookie(input);
+        return selected && sameSessionScope(current, selected) && matchesBuild(selected) ? selected : null;
+    }
+    // Next's build id identifies immutable assets, not an activation. A rollback
+    // can reuse that build: prefer the current activation when it matches.
+    if (matchesBuild(current))
+        return current;
+    const names = [...new Set((input.cookie ?? '').split(';').map(item => item.trim().split('=', 1)[0])
+            .filter(name => name.startsWith(`${GATEWAY_SESSION_COOKIE}-`) && /^[a-zA-Z0-9_-]+$/.test(name)))];
+    const matches = names.map(name => decodeSignedCookie({ ...input,
+        deploymentId: name.slice(GATEWAY_SESSION_COOKIE.length + 1),
+    })).filter((candidate) => candidate !== null && sameSessionScope(current, candidate) && matchesBuild(candidate));
+    // Several retained activations may share identical output. Prefer the latest
+    // admitted session deterministically; every candidate is reauthorized below.
+    return matches.sort((left, right) => right.expiresAt - left.expiresAt || (left.deploymentId ?? '').localeCompare(right.deploymentId ?? ''))[0] ?? null;
+}
+export function signGatewayContext({ session, method, path, privateKey, keyId, now = Math.floor(Date.now() / 1000), capabilities = [], serviceAccountId = null, requestId = randomUUID() }) {
+    const context = artifactRequestContextSchema.parse({
+        v: 1, iss: 'atlas-artifact-gateway', aud: `artifact:${session.projectId}`,
+        sub: session.ownerId, projectId: session.projectId, environment: session.environment,
+        mode: session.kind === 'development' ? 'development' : session.published ? 'published' : 'preview',
+        deploymentId: session.deploymentId, devSessionId: session.sessionId, requestId,
+        method, path, iat: now, exp: now + 60, capabilities, serviceAccountId,
+        bridge: session.bridge, theme: 'system',
+        lattice: session.lattice ?? { runId: null, nodeId: null, stepId: null, processId: null },
+        ...(session.taskRoutes ? { taskRoutes: session.taskRoutes } : {}),
+    });
+    const header = Buffer.from(JSON.stringify({ alg: 'EdDSA', typ: 'JWT', kid: keyId })).toString('base64url');
+    const payload = Buffer.from(JSON.stringify(context)).toString('base64url');
+    const key = createPrivateKey(privateKey);
+    if (key.asymmetricKeyType !== 'ed25519')
+        throw new Error('Gateway context key must be Ed25519');
+    const signed = `${header}.${payload}`;
+    return `${signed}.${sign(null, Buffer.from(signed), key).toString('base64url')}`;
+}

package/dist/gateway/usage.d.ts

@@ -0,0 +1,37 @@
+export interface GatewayUsageEvent {
+    eventId: string;
+    requestId: string;
+    projectId: string;
+    deploymentId?: string;
+    devSessionId?: string;
+    environment: string;
+    startedAt: string;
+    endedAt: string;
+    measurements: {
+        requestCount: 1;
+        durationMs: number;
+    };
+    outcome: 'success' | 'error' | 'cancelled';
+    httpStatus: number;
+}
+/** Bounded delivery of observations; accepted records are deduplicated durably by Atlas.
+ * Process loss can drop pending observations, so these are not provider billing totals.
+ */
+export declare class GatewayUsageReporter {
+    private readonly options;
+    private readonly queue;
+    private readonly pending;
+    constructor(options: {
+        send: (event: GatewayUsageEvent) => Promise<void>;
+        onFailure: (event: {
+            kind: string;
+            requestId: string;
+        }) => void;
+        capacity?: number;
+        concurrency?: number;
+    });
+    record(event: GatewayUsageEvent): void;
+    private pump;
+    private deliver;
+    flush(): Promise<void>;
+}

package/dist/gateway/usage.js

@@ -0,0 +1,46 @@
+/** Bounded delivery of observations; accepted records are deduplicated durably by Atlas.
+ * Process loss can drop pending observations, so these are not provider billing totals.
+ */
+export class GatewayUsageReporter {
+    options;
+    queue = [];
+    pending = new Set();
+    constructor(options) {
+        this.options = options;
+    }
+    record(event) {
+        if (this.queue.length + this.pending.size >= (this.options.capacity ?? 1024)) {
+            this.options.onFailure({ kind: 'usage_queue_full', requestId: event.requestId });
+            return;
+        }
+        this.queue.push(event);
+        this.pump();
+    }
+    pump() {
+        while (this.queue.length && this.pending.size < (this.options.concurrency ?? 8)) {
+            const event = this.queue.shift();
+            const pending = this.deliver(event).finally(() => { this.pending.delete(pending); this.pump(); });
+            this.pending.add(pending);
+        }
+    }
+    async deliver(event) {
+        for (let attempt = 0; attempt < 3; attempt++) {
+            try {
+                await this.options.send(event);
+                return;
+            }
+            catch (error) {
+                const status = typeof error === 'object' && error !== null && 'status' in error ? error.status : undefined;
+                if (typeof status === 'number' && status >= 400 && status < 500 && status !== 429)
+                    break;
+                if (attempt < 2)
+                    await new Promise(resolve => setTimeout(resolve, 100 * 2 ** attempt));
+            }
+        }
+        this.options.onFailure({ kind: 'usage_delivery_failed', requestId: event.requestId });
+    }
+    async flush() {
+        while (this.pending.size)
+            await Promise.all(this.pending);
+    }
+}

package/dist/gateway-main.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gateway-main.js

@@ -0,0 +1,84 @@
+import { randomUUID } from 'node:crypto';
+import { Redis } from 'ioredis';
+import { ArtifactGatewayControl } from './gateway/control.js';
+import { createArtifactGateway } from './gateway/server.js';
+import { RedisTunnelOwnership, RedisTunnelRelay } from './tunnel/redis.js';
+import { ArtifactRequestAdmission } from './gateway/admission.js';
+function required(name) {
+    const value = process.env[name];
+    if (!value)
+        throw new Error(`Missing required gateway configuration: ${name}`);
+    return value;
+}
+/** A separate process/identity from Atlas and all application/build containers. */
+async function main() {
+    if (process.env.ARTIFACT_NEXT_ENABLED !== 'true')
+        throw new Error('Artifact Next gateway is disabled');
+    const redisUrl = required('ARTIFACT_NEXT_REDIS_URL');
+    if (new URL(redisUrl).protocol !== 'rediss:')
+        throw new Error('Artifact tunnel routing requires private Redis with TLS');
+    const namespace = required('APP_ENV'), nodeId = randomUUID();
+    const redisOptions = {
+        enableOfflineQueue: false, autoResendUnfulfilledCommands: false, maxRetriesPerRequest: 0,
+        lazyConnect: true, connectTimeout: 10_000,
+        tls: { rejectUnauthorized: true, ...(process.env.REDIS_CA_CERT ? { ca: process.env.REDIS_CA_CERT } : {}) },
+    };
+    const command = new Redis(redisUrl, redisOptions);
+    const publisher = new Redis(redisUrl, redisOptions);
+    const subscriber = new Redis(redisUrl, { ...redisOptions, autoResubscribe: false });
+    const clients = [command, publisher, subscriber];
+    for (const client of clients)
+        client.on('error', () => {
+            // Provider messages may include connection strings; keep them out of logs.
+            process.stderr.write(`${JSON.stringify({ event: 'artifact_gateway.redis_unavailable', nodeId })}\n`);
+        });
+    await Promise.all(clients.map(client => client.connect()));
+    const ownership = new RedisTunnelOwnership({ command, namespace });
+    const relay = new RedisTunnelRelay({ nodeId, namespace, ownership, publisher, subscriber });
+    await relay.start();
+    let stopping = false;
+    subscriber.on('ready', () => { if (!stopping)
+        void relay.start().catch(() => undefined); });
+    const controlUrl = required('ARTIFACT_NEXT_CONTROL_PLANE_URL');
+    const gateway = createArtifactGateway({
+        control: new ArtifactGatewayControl({ url: controlUrl, token: required('ARTIFACT_NEXT_CONTROL_TOKEN') }),
+        runtimeDomain: required('ARTIFACT_NEXT_RUNTIME_DOMAIN'),
+        parentOrigin: process.env.ARTIFACT_NEXT_PARENT_ORIGIN ?? new URL(controlUrl).origin,
+        gatewayOrigin: required('ARTIFACT_NEXT_GATEWAY_URL'),
+        sessionKey: required('ARTIFACT_NEXT_SESSION_KEY'),
+        contextPrivateKey: required('ARTIFACT_NEXT_CONTEXT_PRIVATE_KEY'),
+        contextKeyId: required('ARTIFACT_NEXT_CONTEXT_KEY_ID'),
+        nodeId, routing: ownership, relay,
+        admission: new ArtifactRequestAdmission({ redis: command, namespace }),
+        resolveLease: sessionId => ownership.resolveLease(sessionId),
+        renewLease: lease => ownership.renew(lease, nodeId),
+        ready: () => clients.every(client => client.status === 'ready') && relay.isReady(),
+        onError: event => process.stderr.write(`${JSON.stringify({ event: 'artifact_gateway.request', ...event, nodeId })}\n`),
+    });
+    const port = Number(process.env.PORT ?? '8080');
+    if (!Number.isSafeInteger(port) || port < 1 || port > 65535)
+        throw new Error('Invalid gateway PORT');
+    await new Promise((resolve, reject) => {
+        gateway.server.once('error', reject);
+        gateway.server.listen(port, '0.0.0.0', resolve);
+    });
+    process.stdout.write(`${JSON.stringify({ event: 'artifact_gateway.ready', nodeId, port })}\n`);
+    const stop = async () => {
+        if (stopping)
+            return;
+        stopping = true;
+        const deadline = setTimeout(() => { gateway.server.closeAllConnections(); process.exit(1); }, 9_000);
+        deadline.unref();
+        await gateway.drain();
+        await relay.close();
+        for (const client of clients)
+            client.disconnect();
+        clearTimeout(deadline);
+    };
+    process.once('SIGTERM', () => { void stop(); });
+    process.once('SIGINT', () => { void stop(); });
+}
+void main().catch(() => {
+    process.stderr.write(`${JSON.stringify({ event: 'artifact_gateway.start_failed' })}\n`);
+    process.exit(1);
+});

package/dist/git-clone.d.ts

@@ -15,11 +15,29 @@ export type RunGitClone = (args: {
     destDir: string;
     /** Optional branch, tag, or commit SHA. */
     ref?: string;
+    /**
+     * `git clone --depth`. Omitted for commit-SHA refs: those clone the
+     * default branch in full, then check the SHA out.
+     */
+    depth?: number;
     /** PAT used as Basic-auth password (username `git`). */
     pat: string;
     /** Hard ceiling before the git child is killed (default 5m). */
     timeoutMs?: number;
 }) => Promise<void>;
+/**
+ * Argv for `git clone`, excluding the askpass environment.
+ * Positive `depth` is a shallow tip clone. Commit SHAs ignore `depth`.
+ */
+export declare function gitCloneArgs({ cloneUrl, destDir, ref, depth, }: {
+    cloneUrl: string;
+    destDir: string;
+    ref?: string;
+    depth?: number;
+}): {
+    args: string[];
+    shaRef?: string;
+};
 /**
  * Run `fn` with GIT_ASKPASS set to a short-lived script that answers username
  * with `git` and password with `pat`. The script is deleted afterward.
@@ -31,11 +49,15 @@ export declare function withGitAskpass<T>({ pat, fn, }: {
 /**
  * Clone with a clean URL + PAT via askpass. Branch/tag refs use `--branch`;
  * commit SHAs clone default HEAD then `git checkout <sha>`.
+ * `depth` (repos clone passes 1) fetches only that many commits — a full
+ * history walk against git-service reads every object from object storage
+ * before the pack starts, which stalls large repos.
  */
-export declare function runGitClone({ cloneUrl, destDir, ref, pat, timeoutMs, }: {
+export declare function runGitClone({ cloneUrl, destDir, ref, depth, pat, timeoutMs, }: {
     cloneUrl: string;
     destDir: string;
     ref?: string;
+    depth?: number;
     pat: string;
     timeoutMs?: number;
 }): Promise<void>;

package/dist/git-clone.js

@@ -55,6 +55,28 @@ const GIT_LOW_SPEED_LIMIT_BYTES = 1000;
 const GIT_LOW_SPEED_TIME_SEC = 180;
 /** Backstop hard deadline: SIGKILL the child even if it trickles above the low-speed floor. */
 const GIT_CLONE_TIMEOUT_MS = 6 * 60_000;
+/**
+ * Argv for `git clone`, excluding the askpass environment.
+ * Positive `depth` is a shallow tip clone. Commit SHAs ignore `depth`.
+ */
+export function gitCloneArgs({ cloneUrl, destDir, ref, depth, }) {
+    const shaRef = ref && looksLikeCommitSha(ref) ? ref : undefined;
+    const branchRef = ref && !shaRef ? ref : undefined;
+    const args = [
+        '-c',
+        `http.lowSpeedLimit=${GIT_LOW_SPEED_LIMIT_BYTES}`,
+        '-c',
+        `http.lowSpeedTime=${GIT_LOW_SPEED_TIME_SEC}`,
+        'clone',
+    ];
+    if (depth != null && depth > 0 && !shaRef) {
+        args.push('--depth', String(depth));
+    }
+    if (branchRef)
+        args.push('--branch', branchRef);
+    args.push(cloneUrl, destDir);
+    return shaRef ? { args, shaRef } : { args };
+}
 /** First non-flag arg (the git subcommand), skipping `-c <value>` config pairs. */
 function gitVerb(args) {
     for (let i = 0; i < args.length; i++) {
@@ -142,8 +164,11 @@ export async function withGitAskpass({ pat, fn, }) {
 /**
  * Clone with a clean URL + PAT via askpass. Branch/tag refs use `--branch`;
  * commit SHAs clone default HEAD then `git checkout <sha>`.
+ * `depth` (repos clone passes 1) fetches only that many commits — a full
+ * history walk against git-service reads every object from object storage
+ * before the pack starts, which stalls large repos.
  */
-export async function runGitClone({ cloneUrl, destDir, ref, pat, timeoutMs, }) {
+export async function runGitClone({ cloneUrl, destDir, ref, depth, pat, timeoutMs, }) {
     let cleanUrl = cloneUrl;
     try {
         const parsed = new URL(cloneUrl);
@@ -156,23 +181,15 @@ export async function runGitClone({ cloneUrl, destDir, ref, pat, timeoutMs, }) {
     catch {
         // leave as-is; git will fail loudly
     }
-    // Global `-c` config must precede the subcommand. Low-speed settings bound
-    // the fetch so a stalled transport aborts fast rather than wedging the deploy.
-    const lowSpeed = [
-        '-c',
-        `http.lowSpeedLimit=${GIT_LOW_SPEED_LIMIT_BYTES}`,
-        '-c',
-        `http.lowSpeedTime=${GIT_LOW_SPEED_TIME_SEC}`,
-    ];
     await withGitAskpass({
         pat,
         fn: async (env) => {
-            const args = [...lowSpeed, 'clone'];
-            const shaRef = ref && looksLikeCommitSha(ref) ? ref : undefined;
-            const branchRef = ref && !shaRef ? ref : undefined;
-            if (branchRef)
-                args.push('--branch', branchRef);
-            args.push(cleanUrl, destDir);
+            const { args, shaRef } = gitCloneArgs({
+                cloneUrl: cleanUrl,
+                destDir,
+                ...(ref ? { ref } : {}),
+                ...(depth != null ? { depth } : {}),
+            });
             try {
                 await spawnGit({ args, env, ...(timeoutMs ? { timeoutMs } : {}) });
             }

package/dist/manifest-next.d.ts

@@ -0,0 +1,217 @@
+import { z } from 'zod';
+/** Approved major/minor profile. Builds additionally record exact patch versions. */
+export declare const ARTIFACT_NEXT_RUNTIME: Readonly<{
+    sdk: "sequence";
+    node: 24;
+    react: 19;
+    next: "16.3";
+}>;
+/** Admission policy for new development sessions and builds; retained releases keep their recorded toolchain. */
+export declare const ARTIFACT_NEXT_APPROVED_PACKAGES: Readonly<{
+    next: "16.3.4";
+    react: "19.2.6";
+    'react-dom': "19.2.6";
+}>;
+export declare const ARTIFACT_NEXT_RESOURCE_DEFAULTS: {
+    cpu: number;
+    memory_mb: number;
+    concurrency: number;
+    min_instances: number;
+    max_instances: number;
+    timeout_seconds: number;
+};
+export declare const artifactNextServerCapabilitiesSchema: z.ZodPrefault<z.ZodObject<{
+    storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
+        viewer: "viewer";
+        editor: "editor";
+        admin: "admin";
+    }>>>;
+    data: z.ZodPrefault<z.ZodObject<{
+        read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+    api: z.ZodPrefault<z.ZodObject<{
+        read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+    functions: z.ZodPrefault<z.ZodObject<{
+        invoke: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>>;
+export type ArtifactNextServerCapabilities = z.infer<typeof artifactNextServerCapabilitiesSchema>;
+export declare const artifactNextResourceLimitsSchema: z.ZodPrefault<z.ZodObject<{
+    cpu: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<4>, z.ZodLiteral<8>]>>;
+    memory_mb: z.ZodDefault<z.ZodNumber>;
+    concurrency: z.ZodDefault<z.ZodNumber>;
+    min_instances: z.ZodDefault<z.ZodNumber>;
+    max_instances: z.ZodDefault<z.ZodNumber>;
+    timeout_seconds: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>>;
+export declare const artifactNextSecretNameSchema: z.ZodString;
+export declare const artifactNextSecretBindingSchema: z.ZodObject<{
+    name: z.ZodString;
+    secret_id: z.ZodUUID;
+    version: z.ZodNumber;
+}, z.core.$strict>;
+/** Pinned public assets fetched by the trusted preparation stage before offline compilation. */
+export declare const artifactNextPublicFontSchema: z.ZodObject<{
+    path: z.ZodString;
+    url: z.ZodString;
+    sha256: z.ZodString;
+}, z.core.$strict>;
+export type ArtifactNextPublicFont = z.infer<typeof artifactNextPublicFontSchema>;
+export declare const artifactNextBuildConfigSchema: z.ZodPrefault<z.ZodObject<{
+    public_env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    public_fonts: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        url: z.ZodString;
+        sha256: z.ZodString;
+    }, z.core.$strict>>>;
+}, z.core.$strict>>;
+export declare const artifactNextServerSchema: z.ZodPrefault<z.ZodObject<{
+    capabilities: z.ZodPrefault<z.ZodObject<{
+        storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
+            viewer: "viewer";
+            editor: "editor";
+            admin: "admin";
+        }>>>;
+        data: z.ZodPrefault<z.ZodObject<{
+            read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        api: z.ZodPrefault<z.ZodObject<{
+            read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        functions: z.ZodPrefault<z.ZodObject<{
+            invoke: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    service_account: z.ZodOptional<z.ZodString>;
+    secrets: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        secret_id: z.ZodUUID;
+        version: z.ZodNumber;
+    }, z.core.$strict>>>;
+    egress: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    resources: z.ZodPrefault<z.ZodObject<{
+        cpu: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<4>, z.ZodLiteral<8>]>>;
+        memory_mb: z.ZodDefault<z.ZodNumber>;
+        concurrency: z.ZodDefault<z.ZodNumber>;
+        min_instances: z.ZodDefault<z.ZodNumber>;
+        max_instances: z.ZodDefault<z.ZodNumber>;
+        timeout_seconds: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strict>>;
+    cache: z.ZodOptional<z.ZodObject<{
+        capacity_gb: z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>>;
+export declare const artifactStudioNextManifestSchema: z.ZodObject<{
+    bundle: z.ZodObject<{
+        name: z.ZodString;
+        schema_version: z.ZodLiteral<2>;
+    }, z.core.$strict>;
+    artifact: z.ZodObject<{
+        project_id: z.ZodString;
+        title: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        type: z.ZodLiteral<"nextjs">;
+        app_root: z.ZodDefault<z.ZodString>;
+    }, z.core.$strict>;
+    runtime: z.ZodPrefault<z.ZodObject<{
+        sdk: z.ZodDefault<z.ZodLiteral<"sequence">>;
+        node: z.ZodDefault<z.ZodLiteral<24>>;
+        react: z.ZodDefault<z.ZodLiteral<19>>;
+        next: z.ZodDefault<z.ZodLiteral<"16.3">>;
+    }, z.core.$strict>>;
+    capabilities: z.ZodPrefault<z.ZodObject<{
+        allow_downloads: z.ZodDefault<z.ZodBoolean>;
+        allow_popups: z.ZodDefault<z.ZodBoolean>;
+        roles: z.ZodOptional<z.ZodObject<{
+            definitions: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+                description: z.ZodOptional<z.ZodString>;
+                default: z.ZodDefault<z.ZodBoolean>;
+                inherits: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                grants: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>>;
+            capabilities: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+                description: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>>;
+        uses: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
+            viewer: "viewer";
+            editor: "editor";
+            admin: "admin";
+        }>>>;
+        data: z.ZodPrefault<z.ZodObject<{
+            read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        api: z.ZodPrefault<z.ZodObject<{
+            read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        functions: z.ZodPrefault<z.ZodObject<{
+            invoke: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    build: z.ZodPrefault<z.ZodObject<{
+        public_env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        public_fonts: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            url: z.ZodString;
+            sha256: z.ZodString;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>;
+    server: z.ZodPrefault<z.ZodObject<{
+        capabilities: z.ZodPrefault<z.ZodObject<{
+            storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
+                viewer: "viewer";
+                editor: "editor";
+                admin: "admin";
+            }>>>;
+            data: z.ZodPrefault<z.ZodObject<{
+                read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+            api: z.ZodPrefault<z.ZodObject<{
+                read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+            functions: z.ZodPrefault<z.ZodObject<{
+                invoke: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+        service_account: z.ZodOptional<z.ZodString>;
+        secrets: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            secret_id: z.ZodUUID;
+            version: z.ZodNumber;
+        }, z.core.$strict>>>;
+        egress: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        resources: z.ZodPrefault<z.ZodObject<{
+            cpu: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<4>, z.ZodLiteral<8>]>>;
+            memory_mb: z.ZodDefault<z.ZodNumber>;
+            concurrency: z.ZodDefault<z.ZodNumber>;
+            min_instances: z.ZodDefault<z.ZodNumber>;
+            max_instances: z.ZodDefault<z.ZodNumber>;
+            timeout_seconds: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strict>>;
+        cache: z.ZodOptional<z.ZodObject<{
+            capacity_gb: z.ZodNumber;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    targets: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+    }, z.core.$strict>>>;
+    sidebarIcon: z.ZodOptional<z.ZodString>;
+    sidebarBadge: z.ZodOptional<z.ZodObject<{
+        endpoint: z.ZodString;
+        tone: z.ZodOptional<z.ZodEnum<{
+            alert: "alert";
+            muted: "muted";
+        }>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ArtifactStudioNextManifest = z.infer<typeof artifactStudioNextManifestSchema>;