@sequenceholdings/artifact-studio 0.2.5 → 0.3.0

package/dist/manifest-next.js

@@ -0,0 +1,120 @@
+import { storageScopesSchema } from '@sequenceholdings/storage';
+import { z } from 'zod';
+import { capabilityPinsSchema, customRolesBlockSchema, validateCapabilityPins } from './manifest-custom-roles.js';
+import { apiCapabilityPathAllowed, artifactStudioStaticManifestSchema, sidebarBadgeSchema } from './manifest-static.js';
+/** Approved major/minor profile. Builds additionally record exact patch versions. */
+export const ARTIFACT_NEXT_RUNTIME = Object.freeze({ sdk: 'sequence', node: 24, react: 19, next: '16.3' });
+/** Admission policy for new development sessions and builds; retained releases keep their recorded toolchain. */
+export const ARTIFACT_NEXT_APPROVED_PACKAGES = Object.freeze({ next: '16.3.4', react: '19.2.6', 'react-dom': '19.2.6' });
+export const ARTIFACT_NEXT_RESOURCE_DEFAULTS = {
+    cpu: 1, memory_mb: 1024, concurrency: 20, min_instances: 0, max_instances: 3, timeout_seconds: 60,
+};
+const boundedRef = z.string().min(1).max(255).regex(/^[a-zA-Z0-9][a-zA-Z0-9_./:-]*$/).refine((value) => value.split('/').every((part) => part !== '' && part !== '.' && part !== '..'), 'Resource references cannot contain empty segments or traversal');
+const serviceAccountRef = z.string().regex(/^([a-z][a-z0-9-]{1,98}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/);
+const apiPath = z.string().min(1).max(512).refine((value) => {
+    if (!value.startsWith('/api/') || value === '/api/' || value === '/api/*')
+        return false;
+    if (/[\\%?#\s\x00-\x1f]/.test(value))
+        return false;
+    return value.split('/').slice(1).every((part, index, parts) => part !== '.' && part !== '..' && (part !== '' || index === parts.length - 1));
+}, 'API capability paths must be scoped below /api/ without encoded paths, traversal, queries, or fragments');
+const reachShape = {
+    storage: storageScopesSchema.optional(),
+    data: z.strictObject({ read: z.array(boundedRef).max(256).default([]), write: z.array(boundedRef).max(256).default([]) }).prefault({}),
+    api: z.strictObject({ read: z.array(apiPath).max(256).default([]), write: z.array(apiPath).max(256).default([]) }).prefault({}),
+    functions: z.strictObject({ invoke: z.array(boundedRef).max(256).default([]) }).prefault({}),
+};
+export const artifactNextServerCapabilitiesSchema = z.strictObject(reachShape).prefault({});
+// Reuse role semantics and validation; only the new manifest rejects unknown keys.
+const strictCustomRoles = customRolesBlockSchema.safeExtend({
+    definitions: z.record(customRolesBlockSchema.shape.definitions.unwrap().keyType, customRolesBlockSchema.shape.definitions.unwrap().valueType.strict()).default({}),
+    capabilities: z.record(customRolesBlockSchema.shape.capabilities.unwrap().keyType, customRolesBlockSchema.shape.capabilities.unwrap().valueType.strict()).default({}),
+}).strict();
+const browserCapabilities = z.strictObject({
+    ...reachShape,
+    allow_downloads: z.boolean().default(false),
+    allow_popups: z.boolean().default(false),
+    roles: strictCustomRoles.optional(),
+    uses: capabilityPinsSchema,
+}).prefault({});
+export const artifactNextResourceLimitsSchema = z.strictObject({
+    cpu: z.union([z.literal(1), z.literal(2), z.literal(4), z.literal(8)]).default(1),
+    memory_mb: z.number().int().min(512).max(32768).default(1024),
+    concurrency: z.number().int().min(1).max(80).default(20),
+    min_instances: z.number().int().min(0).max(20).default(0),
+    max_instances: z.number().int().min(1).max(100).default(3),
+    timeout_seconds: z.number().int().min(1).max(300).default(60),
+}).superRefine((limits, ctx) => {
+    if (limits.min_instances > limits.max_instances)
+        ctx.addIssue({ code: 'custom', path: ['min_instances'], message: 'min_instances cannot exceed max_instances' });
+    if (limits.memory_mb < limits.cpu * 512 || limits.memory_mb > limits.cpu * 8192) {
+        ctx.addIssue({ code: 'custom', path: ['memory_mb'], message: 'memory_mb must be between 512 and 8192 MiB per CPU' });
+    }
+}).prefault({});
+const envName = z.string().max(128).regex(/^[A-Z][A-Z0-9_]*$/);
+const reservedServerEnv = /^(NEXT_PUBLIC_|ARTIFACT_|SEQUENCE_|GOOGLE_|GCP_|GCLOUD_|DOPPLER_|MODAL_|AUTH0_|NPM_CONFIG_|npm_config_)/;
+export const artifactNextSecretNameSchema = envName.refine((name) => !reservedServerEnv.test(name) && !['NODE_OPTIONS', 'NODE_ENV', 'PORT', 'HOSTNAME', 'PATH', 'HOME', 'LD_PRELOAD', 'LD_LIBRARY_PATH'].includes(name), 'Secret names cannot override platform/runtime environment variables or expose NEXT_PUBLIC_ values');
+export const artifactNextSecretBindingSchema = z.strictObject({
+    name: artifactNextSecretNameSchema,
+    secret_id: z.uuid(),
+    version: z.number().int().positive(),
+});
+const publicEnvironmentName = envName.refine((name) => name.startsWith('NEXT_PUBLIC_') && !/(^|_)(SECRET|TOKEN|PASSWORD|CREDENTIALS?|PRIVATE_KEY|API_KEY)(_|$)/.test(name), 'Public build variables require NEXT_PUBLIC_ and must not contain secret, token, password, credential, or private/API key names');
+/** Pinned public assets fetched by the trusted preparation stage before offline compilation. */
+export const artifactNextPublicFontSchema = z.strictObject({
+    path: z.string().max(512).regex(/^public\/fonts\/[A-Za-z0-9][A-Za-z0-9_-]*\.woff2$/, 'Font paths must be WOFF2 files directly under app_root/public/fonts with ASCII filenames'),
+    url: z.string().max(2048).regex(/^https:\/\/fonts\.gstatic\.com\/s\/[a-z0-9]+\/v[0-9]+\/[A-Za-z0-9_-]+\.woff2$/, 'Font URLs must use the exact HTTPS fonts.gstatic.com versioned WOFF2 path without credentials, ports, queries, fragments, or encoding'),
+    sha256: z.string().regex(/^[a-f0-9]{64}$/, 'Expected a lowercase SHA-256 digest'),
+});
+export const artifactNextBuildConfigSchema = z.strictObject({
+    public_env: z.record(publicEnvironmentName, z.string().max(8192)).refine((values) => Object.keys(values).length <= 64, 'At most 64 public build variables are allowed').default({}),
+    public_fonts: z.array(artifactNextPublicFontSchema).max(8).refine((fonts) => new Set(fonts.map((font) => font.path)).size === fonts.length, 'Public font destination paths must be unique').default([]),
+}).prefault({});
+const hostname = z.string().max(253).regex(/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$/, 'Egress entries must be exact lowercase DNS hostnames without schemes, ports, paths, IPs, or wildcards').refine((host) => !host.endsWith('.localhost') && !host.endsWith('.local') && !host.endsWith('.internal'), 'Egress cannot target local or platform-internal hostnames');
+export const artifactNextServerSchema = z.strictObject({
+    capabilities: artifactNextServerCapabilitiesSchema,
+    service_account: serviceAccountRef.optional(),
+    secrets: z.array(artifactNextSecretBindingSchema).max(32).default([]),
+    egress: z.array(hostname).max(64).default([]),
+    resources: artifactNextResourceLimitsSchema,
+    cache: z.strictObject({ capacity_gb: z.number().int().min(1).max(16) }).optional(),
+}).superRefine((server, ctx) => {
+    if (new Set(server.secrets.map((secret) => secret.name)).size !== server.secrets.length) {
+        ctx.addIssue({ code: 'custom', path: ['secrets'], message: 'Each secret environment name must be unique' });
+    }
+    if (new Set(server.egress).size !== server.egress.length) {
+        ctx.addIssue({ code: 'custom', path: ['egress'], message: 'Egress hosts must be unique' });
+    }
+}).prefault({});
+const appRoot = z.string().min(1).max(512).refine((value) => {
+    if (value === '.')
+        return true;
+    return !value.startsWith('/') && !/[\\:\s\x00-\x1f]/.test(value) &&
+        value.split('/').every((part) => part !== '' && part !== '.' && part !== '..' && !part.startsWith('.') && part !== 'node_modules');
+}, 'app_root must be a relative source directory without traversal, hidden directories, or node_modules').default('.');
+export const artifactStudioNextManifestSchema = z.strictObject({
+    bundle: z.strictObject({ name: z.string().min(1).max(255), schema_version: z.literal(2) }),
+    artifact: z.strictObject({
+        project_id: artifactStudioStaticManifestSchema.shape.artifact.shape.project_id,
+        title: z.string().min(1).max(255),
+        description: z.string().max(2000).optional(),
+        type: z.literal('nextjs'),
+        app_root: appRoot,
+    }),
+    runtime: z.strictObject({
+        sdk: z.literal('sequence').default('sequence'), node: z.literal(24).default(24), react: z.literal(19).default(19), next: z.literal('16.3').default('16.3'),
+    }).prefault({}),
+    capabilities: browserCapabilities,
+    build: artifactNextBuildConfigSchema,
+    server: artifactNextServerSchema,
+    targets: z.record(z.string().min(1), z.strictObject({ url: z.string().url() })).default({}),
+    sidebarIcon: z.string().max(64).optional(),
+    sidebarBadge: sidebarBadgeSchema.strict().optional(),
+}).superRefine((manifest, ctx) => {
+    for (const message of validateCapabilityPins({ uses: manifest.capabilities.uses, roles: manifest.capabilities.roles })) {
+        ctx.addIssue({ code: 'custom', path: ['capabilities', 'uses'], message });
+    }
+    if (manifest.sidebarBadge && !apiCapabilityPathAllowed(manifest.sidebarBadge.endpoint, manifest.capabilities.api.read)) {
+        ctx.addIssue({ code: 'custom', path: ['sidebarBadge', 'endpoint'], message: 'sidebarBadge.endpoint must be declared in capabilities.api.read' });
+    }
+});

package/dist/manifest-static.d.ts

@@ -0,0 +1,76 @@
+import { z } from 'zod';
+export { CUSTOM_CAPABILITY_PIN_RE, CUSTOM_ROLE_KEY_RE, capabilityPinsSchema, customRolesBlockSchema, customRolesDeclared, parseCapabilityPin, validateCapabilityPins, type ArtifactStudioCustomRoles, type ParsedCapabilityPin, } from './manifest-custom-roles.js';
+export declare const sidebarBadgeSchema: z.ZodObject<{
+    endpoint: z.ZodString;
+    tone: z.ZodOptional<z.ZodEnum<{
+        alert: "alert";
+        muted: "muted";
+    }>>;
+}, z.core.$strip>;
+export type SidebarBadgeManifest = z.infer<typeof sidebarBadgeSchema>;
+export declare function apiCapabilityPathAllowed(pathname: string, allowed: readonly string[]): boolean;
+export declare const artifactStudioStaticManifestSchema: z.ZodObject<{
+    bundle: z.ZodObject<{
+        name: z.ZodString;
+        schema_version: z.ZodDefault<z.ZodLiteral<1>>;
+    }, z.core.$strip>;
+    artifact: z.ZodObject<{
+        project_id: z.ZodString;
+        title: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        type: z.ZodDefault<z.ZodEnum<{
+            react: "react";
+            html: "html";
+        }>>;
+        entrypoint: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    }, z.core.$strip>;
+    runtime: z.ZodDefault<z.ZodObject<{
+        sdk: z.ZodDefault<z.ZodLiteral<"sequence">>;
+        react: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<18>, z.ZodLiteral<19>]>>;
+    }, z.core.$strip>>;
+    capabilities: z.ZodDefault<z.ZodObject<{
+        storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
+            viewer: "viewer";
+            editor: "editor";
+            admin: "admin";
+        }>>>;
+        data: z.ZodDefault<z.ZodObject<{
+            read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+        api: z.ZodDefault<z.ZodObject<{
+            read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+        functions: z.ZodDefault<z.ZodObject<{
+            invoke: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+        allow_downloads: z.ZodDefault<z.ZodBoolean>;
+        allow_popups: z.ZodDefault<z.ZodBoolean>;
+        roles: z.ZodOptional<z.ZodObject<{
+            definitions: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+                description: z.ZodOptional<z.ZodString>;
+                default: z.ZodDefault<z.ZodBoolean>;
+                inherits: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                grants: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            }, z.core.$strip>>>;
+            capabilities: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+                description: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>>;
+        }, z.core.$strip>>;
+        uses: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    targets: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+    }, z.core.$strict>>>;
+    sidebarIcon: z.ZodOptional<z.ZodString>;
+    sidebarBadge: z.ZodOptional<z.ZodObject<{
+        endpoint: z.ZodString;
+        tone: z.ZodOptional<z.ZodEnum<{
+            alert: "alert";
+            muted: "muted";
+        }>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ArtifactStudioStaticManifest = z.infer<typeof artifactStudioStaticManifestSchema>;
+export declare function parseArtifactStudioStaticManifest(value: unknown): ArtifactStudioStaticManifest;

package/dist/manifest-static.js

@@ -0,0 +1,124 @@
+import { storageScopesSchema } from '@sequenceholdings/storage';
+import { z } from 'zod';
+import { capabilityPinsSchema, customRolesBlockSchema, validateCapabilityPins, } from './manifest-custom-roles.js';
+import { normalizeArtifactPath } from './paths.js';
+export { CUSTOM_CAPABILITY_PIN_RE, CUSTOM_ROLE_KEY_RE, capabilityPinsSchema, customRolesBlockSchema, customRolesDeclared, parseCapabilityPin, validateCapabilityPins, } from './manifest-custom-roles.js';
+const apiCapabilityPathSchema = z.string().min(1).refine((path) => path.startsWith('/api/') && path !== '/api/' && path !== '/api/*', 'API capability paths must be scoped below /api/');
+const apiCapabilitiesSchema = z.object({
+    read: z.array(apiCapabilityPathSchema).default([]),
+    write: z.array(apiCapabilityPathSchema).default([]),
+}).default({ read: [], write: [] });
+const sidebarBadgeToneSchema = z.enum(['alert', 'muted']);
+export const sidebarBadgeSchema = z.object({
+    endpoint: apiCapabilityPathSchema,
+    tone: sidebarBadgeToneSchema.optional(),
+});
+function matchesApiCapabilityEntry(pathname, entry) {
+    if (!entry.startsWith('/api/'))
+        return false;
+    if (entry === pathname)
+        return true;
+    if (entry.includes('*') && (!entry.endsWith('/*') || hasMidPathWildcard(entry))) {
+        const pathParts = pathname.split('/');
+        const entryParts = entry.split('/');
+        return (pathParts.length === entryParts.length &&
+            entryParts.every((part, index) => part === '*' || part === pathParts[index]));
+    }
+    if (entry.endsWith('/*')) {
+        const prefix = entry.slice(0, -1);
+        return pathname.startsWith(prefix);
+    }
+    if (entry.endsWith('/')) {
+        return pathname.startsWith(entry);
+    }
+    return false;
+}
+function hasMidPathWildcard(entry) {
+    const parts = entry.split('/');
+    return parts.slice(1, -1).some((part) => part === '*');
+}
+export function apiCapabilityPathAllowed(pathname, allowed) {
+    return allowed.some((entry) => matchesApiCapabilityEntry(pathname, entry));
+}
+export const artifactStudioStaticManifestSchema = z.object({
+    bundle: z.object({
+        name: z.string().min(1).max(255),
+        schema_version: z.literal(1).default(1),
+    }),
+    artifact: z.object({
+        project_id: z.string().min(1).max(255).regex(/^[a-z][a-z0-9-]*(?:\/[a-z][a-z0-9-]*)*$/),
+        title: z.string().min(1).max(255),
+        description: z.string().max(2000).optional(),
+        type: z.enum(['react', 'html']).default('react'),
+        entrypoint: z.string().min(1).max(512).transform(normalizeArtifactPath),
+    }),
+    runtime: z.object({
+        sdk: z.literal('sequence').default('sequence'),
+        react: z.union([z.literal(18), z.literal(19)]).default(18),
+    }).default({ sdk: 'sequence', react: 18 }),
+    capabilities: z.object({
+        storage: storageScopesSchema.optional(),
+        data: z.object({
+            read: z.array(z.string().min(1)).default([]),
+            write: z.array(z.string().min(1)).default([]),
+        }).default({ read: [], write: [] }),
+        api: apiCapabilitiesSchema,
+        functions: z.object({
+            invoke: z.array(z.string().min(1)).default([]),
+        }).default({ invoke: [] }),
+        /** Opt-in: enables iframe `allow-downloads`. Default false. */
+        allow_downloads: z.boolean().default(false),
+        /**
+         * Opt-in: enables iframe `allow-popups allow-popups-to-escape-sandbox` so
+         * the artifact can open a new top-level (unsandboxed) browser tab — needed
+         * to render a PDF in the native viewer, which the sandbox CSP blocks
+         * in-frame. Default false; grant only to trusted-authored artifacts.
+         */
+        allow_popups: z.boolean().default(false),
+        /**
+         * Custom Roles & Capabilities (PER-61): manifest-declared roles and the
+         * capability keys the artifact's code checks. Reconciled into
+         * `custom_role` FGA structural tuples when a deploy activates.
+         */
+        roles: customRolesBlockSchema.optional(),
+        /**
+         * Capability pins (PER-76): registry capabilities this artifact's code
+         * checks — `org/<key>` or a bare project-scoped `<key>`. Reconciled into
+         * the host's attachment set at activation; existence is validated
+         * server-side there.
+         */
+        uses: capabilityPinsSchema,
+    }).default({
+        data: { read: [], write: [] },
+        api: { read: [], write: [] },
+        functions: { invoke: [] },
+        allow_downloads: false,
+        allow_popups: false,
+        uses: [],
+    }),
+    targets: z.record(z.string().min(1), z.object({
+        url: z.string().url(),
+    }).strict()).default({}),
+    sidebarIcon: z.string().max(64).optional(),
+    sidebarBadge: sidebarBadgeSchema.optional(),
+}).superRefine((manifest, ctx) => {
+    for (const message of validateCapabilityPins({
+        uses: manifest.capabilities.uses,
+        roles: manifest.capabilities.roles,
+    })) {
+        ctx.addIssue({ code: 'custom', message, path: ['capabilities', 'uses'] });
+    }
+    if (!manifest.sidebarBadge)
+        return;
+    const endpoint = manifest.sidebarBadge.endpoint;
+    if (!apiCapabilityPathAllowed(endpoint, manifest.capabilities.api.read)) {
+        ctx.addIssue({
+            code: 'custom',
+            message: `sidebarBadge.endpoint ${endpoint} must be declared in capabilities.api.read`,
+            path: ['sidebarBadge', 'endpoint'],
+        });
+    }
+});
+export function parseArtifactStudioStaticManifest(value) {
+    return artifactStudioStaticManifestSchema.parse(value);
+}

package/dist/manifest.d.ts

@@ -1,15 +1,10 @@
 import { z } from 'zod';
-export { CUSTOM_CAPABILITY_PIN_RE, CUSTOM_ROLE_KEY_RE, capabilityPinsSchema, customRolesBlockSchema, customRolesDeclared, parseCapabilityPin, validateCapabilityPins, type ArtifactStudioCustomRoles, type ParsedCapabilityPin, } from './manifest-custom-roles.js';
-export declare const sidebarBadgeSchema: z.ZodObject<{
-    endpoint: z.ZodString;
-    tone: z.ZodOptional<z.ZodEnum<{
-        alert: "alert";
-        muted: "muted";
-    }>>;
-}, z.core.$strip>;
-export type SidebarBadgeManifest = z.infer<typeof sidebarBadgeSchema>;
-export declare function apiCapabilityPathAllowed(pathname: string, allowed: readonly string[]): boolean;
-export declare const artifactStudioManifestSchema: z.ZodObject<{
+import { type ArtifactStudioStaticManifest } from './manifest-static.js';
+import { type ArtifactStudioNextManifest } from './manifest-next.js';
+export * from './manifest-static.js';
+export * from './manifest-next.js';
+/** Versioned parsing keeps schema-v1 stripping/default behavior unchanged. */
+export declare const artifactStudioManifestSchema: z.ZodUnion<readonly [z.ZodObject<{
     bundle: z.ZodObject<{
         name: z.ZodString;
         schema_version: z.ZodDefault<z.ZodLiteral<1>>;
@@ -29,6 +24,11 @@ export declare const artifactStudioManifestSchema: z.ZodObject<{
         react: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<18>, z.ZodLiteral<19>]>>;
     }, z.core.$strip>>;
     capabilities: z.ZodDefault<z.ZodObject<{
+        storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
+            viewer: "viewer";
+            editor: "editor";
+            admin: "admin";
+        }>>>;
         data: z.ZodDefault<z.ZodObject<{
             read: z.ZodDefault<z.ZodArray<z.ZodString>>;
             write: z.ZodDefault<z.ZodArray<z.ZodString>>;
@@ -57,12 +57,8 @@ export declare const artifactStudioManifestSchema: z.ZodObject<{
     }, z.core.$strip>>;
     targets: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
         url: z.ZodString;
-        visibility: z.ZodDefault<z.ZodEnum<{
-            published: "published";
-            private: "private";
-            shared: "shared";
-        }>>;
-    }, z.core.$strip>>>;
+    }, z.core.$strict>>>;
+    sidebarIcon: z.ZodOptional<z.ZodString>;
     sidebarBadge: z.ZodOptional<z.ZodObject<{
         endpoint: z.ZodString;
         tone: z.ZodOptional<z.ZodEnum<{
@@ -70,6 +66,115 @@ export declare const artifactStudioManifestSchema: z.ZodObject<{
             muted: "muted";
         }>>;
     }, z.core.$strip>>;
-}, z.core.$strip>;
-export type ArtifactStudioManifest = z.infer<typeof artifactStudioManifestSchema>;
+}, z.core.$strip>, z.ZodObject<{
+    bundle: z.ZodObject<{
+        name: z.ZodString;
+        schema_version: z.ZodLiteral<2>;
+    }, z.core.$strict>;
+    artifact: z.ZodObject<{
+        project_id: z.ZodString;
+        title: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        type: z.ZodLiteral<"nextjs">;
+        app_root: z.ZodDefault<z.ZodString>;
+    }, z.core.$strict>;
+    runtime: z.ZodPrefault<z.ZodObject<{
+        sdk: z.ZodDefault<z.ZodLiteral<"sequence">>;
+        node: z.ZodDefault<z.ZodLiteral<24>>;
+        react: z.ZodDefault<z.ZodLiteral<19>>;
+        next: z.ZodDefault<z.ZodLiteral<"16.3">>;
+    }, z.core.$strict>>;
+    capabilities: z.ZodPrefault<z.ZodObject<{
+        allow_downloads: z.ZodDefault<z.ZodBoolean>;
+        allow_popups: z.ZodDefault<z.ZodBoolean>;
+        roles: z.ZodOptional<z.ZodObject<{
+            definitions: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+                description: z.ZodOptional<z.ZodString>;
+                default: z.ZodDefault<z.ZodBoolean>;
+                inherits: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                grants: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>>;
+            capabilities: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+                description: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>>;
+        uses: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
+            viewer: "viewer";
+            editor: "editor";
+            admin: "admin";
+        }>>>;
+        data: z.ZodPrefault<z.ZodObject<{
+            read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        api: z.ZodPrefault<z.ZodObject<{
+            read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        functions: z.ZodPrefault<z.ZodObject<{
+            invoke: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    build: z.ZodPrefault<z.ZodObject<{
+        public_env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        public_fonts: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            url: z.ZodString;
+            sha256: z.ZodString;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>;
+    server: z.ZodPrefault<z.ZodObject<{
+        capabilities: z.ZodPrefault<z.ZodObject<{
+            storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
+                viewer: "viewer";
+                editor: "editor";
+                admin: "admin";
+            }>>>;
+            data: z.ZodPrefault<z.ZodObject<{
+                read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+            api: z.ZodPrefault<z.ZodObject<{
+                read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+            functions: z.ZodPrefault<z.ZodObject<{
+                invoke: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+        service_account: z.ZodOptional<z.ZodString>;
+        secrets: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            secret_id: z.ZodUUID;
+            version: z.ZodNumber;
+        }, z.core.$strict>>>;
+        egress: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        resources: z.ZodPrefault<z.ZodObject<{
+            cpu: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<4>, z.ZodLiteral<8>]>>;
+            memory_mb: z.ZodDefault<z.ZodNumber>;
+            concurrency: z.ZodDefault<z.ZodNumber>;
+            min_instances: z.ZodDefault<z.ZodNumber>;
+            max_instances: z.ZodDefault<z.ZodNumber>;
+            timeout_seconds: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strict>>;
+        cache: z.ZodOptional<z.ZodObject<{
+            capacity_gb: z.ZodNumber;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    targets: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+    }, z.core.$strict>>>;
+    sidebarIcon: z.ZodOptional<z.ZodString>;
+    sidebarBadge: z.ZodOptional<z.ZodObject<{
+        endpoint: z.ZodString;
+        tone: z.ZodOptional<z.ZodEnum<{
+            alert: "alert";
+            muted: "muted";
+        }>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>]>;
+export type ArtifactStudioManifest = ArtifactStudioStaticManifest | ArtifactStudioNextManifest;
+export type ArtifactStudioManifestInput = z.input<typeof artifactStudioManifestSchema>;
 export declare function parseArtifactStudioManifest(value: unknown): ArtifactStudioManifest;
+export declare function isNextArtifactManifest(manifest: ArtifactStudioManifest): manifest is ArtifactStudioNextManifest;

package/dist/manifest.js

@@ -1,122 +1,16 @@
 import { z } from 'zod';
-import { capabilityPinsSchema, customRolesBlockSchema, validateCapabilityPins, } from './manifest-custom-roles.js';
-import { normalizeArtifactPath } from './paths.js';
-export { CUSTOM_CAPABILITY_PIN_RE, CUSTOM_ROLE_KEY_RE, capabilityPinsSchema, customRolesBlockSchema, customRolesDeclared, parseCapabilityPin, validateCapabilityPins, } from './manifest-custom-roles.js';
-const apiCapabilityPathSchema = z.string().min(1).refine((path) => path.startsWith('/api/') && path !== '/api/' && path !== '/api/*', 'API capability paths must be scoped below /api/');
-const apiCapabilitiesSchema = z.object({
-    read: z.array(apiCapabilityPathSchema).default([]),
-    write: z.array(apiCapabilityPathSchema).default([]),
-}).default({ read: [], write: [] });
-const sidebarBadgeToneSchema = z.enum(['alert', 'muted']);
-export const sidebarBadgeSchema = z.object({
-    endpoint: apiCapabilityPathSchema,
-    tone: sidebarBadgeToneSchema.optional(),
-});
-function matchesApiCapabilityEntry(pathname, entry) {
-    if (!entry.startsWith('/api/'))
-        return false;
-    if (entry === pathname)
-        return true;
-    if (entry.includes('*') && (!entry.endsWith('/*') || hasMidPathWildcard(entry))) {
-        const pathParts = pathname.split('/');
-        const entryParts = entry.split('/');
-        return (pathParts.length === entryParts.length &&
-            entryParts.every((part, index) => part === '*' || part === pathParts[index]));
-    }
-    if (entry.endsWith('/*')) {
-        const prefix = entry.slice(0, -1);
-        return pathname.startsWith(prefix);
-    }
-    if (entry.endsWith('/')) {
-        return pathname.startsWith(entry);
-    }
-    return false;
-}
-function hasMidPathWildcard(entry) {
-    const parts = entry.split('/');
-    return parts.slice(1, -1).some((part) => part === '*');
-}
-export function apiCapabilityPathAllowed(pathname, allowed) {
-    return allowed.some((entry) => matchesApiCapabilityEntry(pathname, entry));
-}
-export const artifactStudioManifestSchema = z.object({
-    bundle: z.object({
-        name: z.string().min(1).max(255),
-        schema_version: z.literal(1).default(1),
-    }),
-    artifact: z.object({
-        project_id: z.string().min(1).max(255).regex(/^[a-z][a-z0-9-]*(?:\/[a-z][a-z0-9-]*)*$/),
-        title: z.string().min(1).max(255),
-        description: z.string().max(2000).optional(),
-        type: z.enum(['react', 'html']).default('react'),
-        entrypoint: z.string().min(1).max(512).transform(normalizeArtifactPath),
-    }),
-    runtime: z.object({
-        sdk: z.literal('sequence').default('sequence'),
-        react: z.union([z.literal(18), z.literal(19)]).default(18),
-    }).default({ sdk: 'sequence', react: 18 }),
-    capabilities: z.object({
-        data: z.object({
-            read: z.array(z.string().min(1)).default([]),
-            write: z.array(z.string().min(1)).default([]),
-        }).default({ read: [], write: [] }),
-        api: apiCapabilitiesSchema,
-        functions: z.object({
-            invoke: z.array(z.string().min(1)).default([]),
-        }).default({ invoke: [] }),
-        /** Opt-in: enables iframe `allow-downloads`. Default false. */
-        allow_downloads: z.boolean().default(false),
-        /**
-         * Opt-in: enables iframe `allow-popups allow-popups-to-escape-sandbox` so
-         * the artifact can open a new top-level (unsandboxed) browser tab — needed
-         * to render a PDF in the native viewer, which the sandbox CSP blocks
-         * in-frame. Default false; grant only to trusted-authored artifacts.
-         */
-        allow_popups: z.boolean().default(false),
-        /**
-         * Custom Roles & Capabilities (PER-61): manifest-declared roles and the
-         * capability keys the artifact's code checks. Reconciled into
-         * `custom_role` FGA structural tuples when a deploy activates.
-         */
-        roles: customRolesBlockSchema.optional(),
-        /**
-         * Capability pins (PER-76): registry capabilities this artifact's code
-         * checks — `org/<key>` or a bare project-scoped `<key>`. Reconciled into
-         * the host's attachment set at activation; existence is validated
-         * server-side there.
-         */
-        uses: capabilityPinsSchema,
-    }).default({
-        data: { read: [], write: [] },
-        api: { read: [], write: [] },
-        functions: { invoke: [] },
-        allow_downloads: false,
-        allow_popups: false,
-        uses: [],
-    }),
-    targets: z.record(z.string().min(1), z.object({
-        url: z.string().url(),
-        visibility: z.enum(['private', 'shared', 'published']).default('private'),
-    })).default({}),
-    sidebarBadge: sidebarBadgeSchema.optional(),
-}).superRefine((manifest, ctx) => {
-    for (const message of validateCapabilityPins({
-        uses: manifest.capabilities.uses,
-        roles: manifest.capabilities.roles,
-    })) {
-        ctx.addIssue({ code: 'custom', message, path: ['capabilities', 'uses'] });
-    }
-    if (!manifest.sidebarBadge)
-        return;
-    const endpoint = manifest.sidebarBadge.endpoint;
-    if (!apiCapabilityPathAllowed(endpoint, manifest.capabilities.api.read)) {
-        ctx.addIssue({
-            code: 'custom',
-            message: `sidebarBadge.endpoint ${endpoint} must be declared in capabilities.api.read`,
-            path: ['sidebarBadge', 'endpoint'],
-        });
-    }
-});
+import { artifactStudioStaticManifestSchema } from './manifest-static.js';
+import { artifactStudioNextManifestSchema } from './manifest-next.js';
+export * from './manifest-static.js';
+export * from './manifest-next.js';
+/** Versioned parsing keeps schema-v1 stripping/default behavior unchanged. */
+export const artifactStudioManifestSchema = z.union([
+    artifactStudioStaticManifestSchema,
+    artifactStudioNextManifestSchema,
+]);
 export function parseArtifactStudioManifest(value) {
     return artifactStudioManifestSchema.parse(value);
 }
+export function isNextArtifactManifest(manifest) {
+    return manifest.artifact.type === 'nextjs';
+}