@sequenceholdings/artifact-studio 0.2.6 → 0.3.0

package/dist/next/bridge.js

@@ -0,0 +1,229 @@
+import { createNextArtifactBridgeEnvelope, EMPTY_NEXT_ARTIFACT_LATTICE_CONTEXT, isNextArtifactRelativePath, nextArtifactInitialContextSchema, nextArtifactThemeSchema, parseNextArtifactBridgeEnvelope, validateNextArtifactBootstrap, } from './protocol.js';
+import { createNextArtifactRequests } from './requests.js';
+import { createNextArtifactStreams } from './streams.js';
+import { createNextArtifactWindowTransport } from './transport.js';
+import { installArtifactReleaseGuard } from './release.js';
+import { stripArtifactReleaseQuery } from './routes.js';
+/**
+ * An SSR-safe external store and DOM transport. Call connect from a client effect,
+ * dispose in its cleanup, and routeChanged when App Router's URL changes. Next
+ * keeps ownership of links and history; only host.navigate leaves the artifact.
+ */
+export function createNextArtifactBridge(options) {
+    validateNextArtifactBootstrap({ bootstrap: options.bootstrap });
+    // Capture connection identity so a caller cannot mutate an established session.
+    const bootstrap = { ...options.bootstrap };
+    const initial = nextArtifactInitialContextSchema.parse(options.initialContext ?? {});
+    const serverSnapshot = { ...initial, status: 'idle' };
+    let snapshot = serverSnapshot;
+    let transport = options.transport;
+    let unsubscribe;
+    let uninstallReleaseGuard;
+    let handshakeTimer;
+    let ready;
+    let resolveReady;
+    let rejectReady;
+    let lastRoute = initial.route;
+    let pendingHostRoute;
+    const subscribers = new Set();
+    const openOverlays = new Set();
+    const timeoutMs = boundedTimeout({ value: options.requestTimeoutMs, fallback: 30_000 });
+    const requests = createNextArtifactRequests({ send, timeoutMs });
+    const streams = createNextArtifactStreams({ send });
+    function update({ next }) {
+        snapshot = next;
+        for (const subscriber of subscribers)
+            subscriber();
+    }
+    function send(payload) {
+        if (!transport || snapshot.status === 'disposed')
+            throw new Error('Artifact bridge is not connected');
+        transport.send({ message: createNextArtifactBridgeEnvelope({ bootstrap, payload }), targetOrigin: bootstrap.parentOrigin });
+    }
+    function requireReady() {
+        if (snapshot.status !== 'ready')
+            throw new Error('Artifact bridge is not ready; await connect()');
+    }
+    function applyRoute({ path, replace = true }) {
+        if (!isNextArtifactRelativePath({ path }))
+            return;
+        path = stripArtifactReleaseQuery({ path });
+        if (path === lastRoute)
+            return;
+        pendingHostRoute = { path, previous: lastRoute };
+        lastRoute = path;
+        update({ next: { ...snapshot, route: path } });
+        options.onNavigate?.({ path, replace });
+    }
+    function receiveContext({ payload }) {
+        const parsed = nextArtifactInitialContextSchema.safeParse(payload);
+        if (!parsed.success)
+            return;
+        const firstContext = snapshot.status === 'connecting';
+        clearTimeout(handshakeTimer);
+        update({ next: { ...snapshot, ...parsed.data, status: 'ready' } });
+        resolveReady?.();
+        if (parsed.data.route)
+            applyRoute({ path: parsed.data.route });
+        else if (firstContext && lastRoute !== undefined) {
+            send({ type: 'artifact-studio-route-change', hash: lastRoute === '/' ? '' : `#${lastRoute}` });
+        }
+    }
+    function receive(event) {
+        if (event.origin !== bootstrap.parentOrigin || event.source !== transport?.parent)
+            return;
+        const envelope = parseNextArtifactBridgeEnvelope({ value: event.data, channelId: bootstrap.channelId, nonce: bootstrap.nonce });
+        if (!envelope)
+            return;
+        const payload = envelope.payload;
+        if (payload.type === 'artifact-studio-next-context') {
+            receiveContext({ payload });
+            return;
+        }
+        if (snapshot.status !== 'ready')
+            return;
+        if (payload.type === 'artifact-studio-set-theme') {
+            const parsed = nextArtifactThemeSchema.safeParse(payload);
+            if (parsed.success)
+                update({ next: { ...snapshot, theme: parsed.data } });
+        }
+        else if (payload.type === 'artifact-studio-set-route' && typeof payload.hash === 'string') {
+            const path = payload.hash === '' ? '/' : payload.hash.startsWith('#') ? payload.hash.slice(1) : '';
+            applyRoute({ path, replace: payload.replace !== false });
+        }
+        else {
+            requests.receive({ payload });
+            streams.receive({ payload });
+        }
+    }
+    const bridge = {
+        connect() {
+            if (snapshot.status === 'disposed')
+                return Promise.reject(new Error('Artifact bridge disposed'));
+            if (ready)
+                return ready;
+            if (!transport) {
+                transport = createNextArtifactWindowTransport();
+                uninstallReleaseGuard = installArtifactReleaseGuard({ deploymentId: bootstrap.deploymentId ?? null });
+            }
+            ready = new Promise((resolve, reject) => { resolveReady = resolve; rejectReady = reject; });
+            // connect is often invoked by an effect; retain rejection for callers without
+            // creating an unhandled rejection before an effect installs its handler.
+            void ready.catch(() => undefined);
+            update({ next: { ...snapshot, status: 'connecting' } });
+            unsubscribe = transport.listen(receive);
+            handshakeTimer = setTimeout(() => {
+                rejectReady?.(new Error('Artifact host handshake timed out'));
+                bridge.dispose();
+            }, boundedTimeout({ value: options.handshakeTimeoutMs, fallback: 10_000 }));
+            try {
+                send({ type: 'artifact-studio-next-ready' });
+            }
+            catch (error) {
+                rejectReady?.(error instanceof Error ? error : new Error('Artifact host handshake failed'));
+                bridge.dispose();
+            }
+            return ready;
+        },
+        dispose() {
+            if (snapshot.status === 'disposed')
+                return;
+            requests.dispose();
+            streams.dispose();
+            for (const overlayId of openOverlays) {
+                try {
+                    send({ type: 'artifact-studio-overlay-state', overlayId, scope: 'viewport', open: false });
+                }
+                catch { /* Host is already detached. */ }
+            }
+            openOverlays.clear();
+            clearTimeout(handshakeTimer);
+            unsubscribe?.();
+            uninstallReleaseGuard?.();
+            rejectReady?.(new Error('Artifact bridge disposed'));
+            update({ next: { ...snapshot, status: 'disposed' } });
+            subscribers.clear();
+        },
+        getSnapshot: () => snapshot,
+        getServerSnapshot: () => serverSnapshot,
+        subscribe(listener) { subscribers.add(listener); return () => { subscribers.delete(listener); }; },
+        request(input) {
+            try {
+                requireReady();
+            }
+            catch (error) {
+                return Promise.reject(error);
+            }
+            return requests.request(input);
+        },
+        stream(input) {
+            try {
+                requireReady();
+            }
+            catch (error) {
+                return Promise.reject(error);
+            }
+            return streams.open(input);
+        },
+        routeChanged({ path }) {
+            if (!isNextArtifactRelativePath({ path }))
+                throw new Error('Artifact route must be a relative path');
+            path = stripArtifactReleaseQuery({ path });
+            // App Router navigation commits asynchronously. An effect still reporting
+            // the old URL must not immediately navigate the shell back to that URL.
+            if (pendingHostRoute && path === pendingHostRoute.previous)
+                return;
+            pendingHostRoute = undefined;
+            if (path === lastRoute)
+                return;
+            lastRoute = path;
+            update({ next: { ...snapshot, route: path } });
+            if (snapshot.status === 'ready')
+                send({ type: 'artifact-studio-route-change', hash: path === '/' ? '' : `#${path}` });
+        },
+        setDocumentTitle({ label }) {
+            requireReady();
+            send({ type: 'artifact-studio-document-title', label: label.slice(0, 200) });
+        },
+        reportRuntimeLog(input) {
+            if (snapshot.status !== 'ready')
+                return;
+            send({ ...input, type: 'artifact-studio-runtime-log', message: input.message.slice(0, 16_384), args: input.args.slice(0, 32) });
+        },
+        forwardHostShortcut(input) {
+            if (snapshot.status !== 'ready' || input.key.toLowerCase() !== 'k' || !(input.metaKey || input.ctrlKey) || input.altKey)
+                return false;
+            send({ type: 'artifact-studio-host-shortcut', key: input.key, code: input.code, metaKey: input.metaKey, ctrlKey: input.ctrlKey, shiftKey: input.shiftKey, altKey: input.altKey });
+            return true;
+        },
+        lattice: { context: () => ({ ...(snapshot.lattice ?? EMPTY_NEXT_ARTIFACT_LATTICE_CONTEXT) }) },
+        host: {
+            navigate(path) {
+                requireReady();
+                if (!isNextArtifactRelativePath({ path }))
+                    throw new Error('Host navigation requires a relative path');
+                send({ type: 'artifact-studio-host-navigate', path: stripArtifactReleaseQuery({ path }) });
+            },
+            setOverlayState({ overlayId, scope, open }) {
+                requireReady();
+                if (!overlayId || overlayId.length > 128 || scope !== 'viewport')
+                    throw new Error('Invalid Artifact overlay');
+                if (openOverlays.size >= 100 && open && !openOverlays.has(overlayId))
+                    throw new Error('Too many Artifact overlays');
+                if (open)
+                    openOverlays.add(overlayId);
+                else
+                    openOverlays.delete(overlayId);
+                send({ type: 'artifact-studio-overlay-state', overlayId, scope, open });
+            },
+        },
+    };
+    return bridge;
+}
+function boundedTimeout({ value, fallback }) {
+    if (value === undefined)
+        return fallback;
+    if (!Number.isFinite(value) || value < 1 || value > 300_000)
+        throw new Error('Artifact timeout must be between 1 and 300000 milliseconds');
+    return value;
+}

package/dist/next/browser-logs.d.ts

@@ -0,0 +1,7 @@
+import type { NextArtifactRuntimeLog } from './protocol.js';
+/** Best-effort redaction, not permission to log secrets or request payloads. */
+export declare function createNextArtifactRuntimeLog({ level, source, args }: {
+    level: NextArtifactRuntimeLog['level'];
+    source: NextArtifactRuntimeLog['source'];
+    args: unknown[];
+}): NextArtifactRuntimeLog;

package/dist/next/browser-logs.js

@@ -0,0 +1,51 @@
+const SENSITIVE_KEY = /authorization|cookie|password|secret|token|credential|api[-_]?key/i;
+function safeString({ value }) {
+    return value.slice(0, 8192)
+        .replace(/\bBearer\s+[A-Za-z0-9._~+\/-]+=*/gi, 'Bearer [REDACTED]')
+        .replace(/\b(password|secret|token|api[-_]?key)\s*[:=]\s*[^\s,;]+/gi, '$1=[REDACTED]')
+        .replace(/(https?:\/\/[^\s?#]+)\?[^\s#]*/g, '$1?[REDACTED]');
+}
+/** Best-effort redaction, not permission to log secrets or request payloads. */
+export function createNextArtifactRuntimeLog({ level, source, args }) {
+    const seen = new WeakSet();
+    function serialize({ value, depth }) {
+        if (typeof value === 'string')
+            return safeString({ value });
+        if (value === null || typeof value === 'boolean' || typeof value === 'number')
+            return value;
+        if (typeof value !== 'object')
+            return String(value).slice(0, 128);
+        if (seen.has(value))
+            return '[Circular]';
+        if (depth >= 3)
+            return '[Truncated]';
+        seen.add(value);
+        if (value instanceof Error)
+            return { name: value.name, message: safeString({ value: value.message }), stack: safeString({ value: value.stack ?? '' }) };
+        if (Array.isArray(value))
+            return value.slice(0, 16).map((item) => serialize({ value: item, depth: depth + 1 }));
+        const result = {};
+        for (const key of Object.keys(value).slice(0, 20)) {
+            const descriptor = Object.getOwnPropertyDescriptor(value, key);
+            // Never invoke application getters to capture a console message.
+            result[key] = SENSITIVE_KEY.test(key) ? '[REDACTED]' : descriptor && 'value' in descriptor ? serialize({ value: descriptor.value, depth: depth + 1 }) : '[Accessor]';
+        }
+        return result;
+    }
+    const serialized = args.slice(0, 16).map((value) => {
+        try {
+            return serialize({ value, depth: 0 });
+        }
+        catch {
+            return '[Unserializable]';
+        }
+    });
+    // Preserve the existing host log shape while bounding the whole argument set.
+    const encoded = JSON.stringify(serialized);
+    const bounded = encoded.length > 16_384 ? [encoded.slice(0, 16_384)] : serialized;
+    return {
+        level, source, args: bounded,
+        message: bounded.map((value) => typeof value === 'string' ? value : JSON.stringify(value)).join(' ').slice(0, 16_384),
+        timestamp: new Date().toISOString(),
+    };
+}

package/dist/next/browser.d.ts

@@ -0,0 +1,6 @@
+import type { NextArtifactBridge } from './bridge.js';
+/** Install once per mounted provider; cleanup restores the original browser APIs. */
+export declare function installNextArtifactBrowserIntegration({ bridge, captureConsole }: {
+    bridge: NextArtifactBridge;
+    captureConsole?: boolean;
+}): () => void;

package/dist/next/browser.js

@@ -0,0 +1,57 @@
+import { createNextArtifactRuntimeLog } from './browser-logs.js';
+/** Install once per mounted provider; cleanup restores the original browser APIs. */
+export function installNextArtifactBrowserIntegration({ bridge, captureConsole = true }) {
+    if (typeof window === 'undefined')
+        return () => undefined;
+    const pending = [];
+    function emit(input) {
+        try {
+            const log = createNextArtifactRuntimeLog(input);
+            if (bridge.getSnapshot().status === 'ready')
+                bridge.reportRuntimeLog(log);
+            else if (pending.length < 32 && bridge.getSnapshot().status !== 'disposed')
+                pending.push(log);
+        }
+        catch { /* Logging must never interrupt application behavior. */ }
+    }
+    const unsubscribe = bridge.subscribe(() => {
+        if (bridge.getSnapshot().status !== 'ready')
+            return;
+        for (const log of pending.splice(0)) {
+            try {
+                bridge.reportRuntimeLog(log);
+            }
+            catch { /* The host may have disconnected. */ }
+        }
+    });
+    const restorers = [];
+    if (captureConsole) {
+        const levels = ['log', 'info', 'warn', 'error'];
+        for (const level of levels) {
+            const original = console[level];
+            function instrumented(...args) {
+                emit({ level, source: 'console', args });
+                original.apply(console, args);
+            }
+            console[level] = instrumented;
+            restorers.push(() => { if (console[level] === instrumented)
+                console[level] = original; });
+        }
+    }
+    const onError = (event) => emit({ level: 'error', source: 'error', args: [event.error ?? event.message] });
+    const onRejection = (event) => emit({ level: 'error', source: 'unhandledrejection', args: [event.reason] });
+    const onShortcut = (event) => { if (bridge.forwardHostShortcut(event))
+        event.preventDefault(); };
+    window.addEventListener('error', onError);
+    window.addEventListener('unhandledrejection', onRejection);
+    window.addEventListener('keydown', onShortcut);
+    return () => {
+        unsubscribe();
+        for (const restore of restorers)
+            restore();
+        pending.length = 0;
+        window.removeEventListener('error', onError);
+        window.removeEventListener('unhandledrejection', onRejection);
+        window.removeEventListener('keydown', onShortcut);
+    };
+}

package/dist/next/protocol.d.ts

@@ -0,0 +1,73 @@
+import { z } from 'zod';
+export declare const NEXT_ARTIFACT_BRIDGE_TYPE = "artifact-studio-next";
+export declare const NEXT_ARTIFACT_BRIDGE_VERSION = 1;
+export declare const nextArtifactThemeSchema: z.ZodObject<{
+    tokens: z.ZodNullable<z.ZodString>;
+    theme: z.ZodNullable<z.ZodString>;
+    dark: z.ZodBoolean;
+    vars: z.ZodRecord<z.ZodString, z.ZodString>;
+}, z.core.$strip>;
+export type NextArtifactTheme = z.infer<typeof nextArtifactThemeSchema>;
+export declare const nextArtifactLatticeContextSchema: z.ZodObject<{
+    runId: z.ZodNullable<z.ZodString>;
+    nodeId: z.ZodNullable<z.ZodString>;
+    stepId: z.ZodNullable<z.ZodString>;
+    processId: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type NextArtifactLatticeContext = z.infer<typeof nextArtifactLatticeContextSchema>;
+export declare const nextArtifactInitialContextSchema: z.ZodObject<{
+    theme: z.ZodOptional<z.ZodObject<{
+        tokens: z.ZodNullable<z.ZodString>;
+        theme: z.ZodNullable<z.ZodString>;
+        dark: z.ZodBoolean;
+        vars: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strip>>;
+    lattice: z.ZodOptional<z.ZodObject<{
+        runId: z.ZodNullable<z.ZodString>;
+        nodeId: z.ZodNullable<z.ZodString>;
+        stepId: z.ZodNullable<z.ZodString>;
+        processId: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    route: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+}, z.core.$strip>;
+export type NextArtifactInitialContext = z.infer<typeof nextArtifactInitialContextSchema>;
+/** UI context only. These fields never convey backend identity or authorization. */
+export interface NextArtifactBridgeBootstrap {
+    parentOrigin: string;
+    channelId: string;
+    nonce: string;
+    deploymentId?: string | null;
+}
+export interface NextArtifactRuntimeLog {
+    level: 'log' | 'info' | 'warn' | 'error';
+    source: 'console' | 'error' | 'unhandledrejection' | 'bridge';
+    message: string;
+    args: unknown[];
+    timestamp: string;
+}
+declare const envelopeSchema: z.ZodObject<{
+    type: z.ZodLiteral<"artifact-studio-next">;
+    version: z.ZodLiteral<1>;
+    channelId: z.ZodString;
+    nonce: z.ZodString;
+    payload: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strip>;
+export type NextArtifactBridgeEnvelope = z.infer<typeof envelopeSchema>;
+/** Caller must independently check event.source and event.origin. */
+export declare function parseNextArtifactBridgeEnvelope({ value, channelId, nonce }: {
+    value: unknown;
+    channelId: string;
+    nonce: string;
+}): NextArtifactBridgeEnvelope | null;
+export declare function createNextArtifactBridgeEnvelope({ bootstrap, payload }: {
+    bootstrap: Pick<NextArtifactBridgeBootstrap, 'channelId' | 'nonce'>;
+    payload: Record<string, unknown>;
+}): NextArtifactBridgeEnvelope;
+export declare function validateNextArtifactBootstrap({ bootstrap }: {
+    bootstrap: NextArtifactBridgeBootstrap;
+}): void;
+export declare function isNextArtifactRelativePath({ path }: {
+    path: unknown;
+}): boolean;
+export declare const EMPTY_NEXT_ARTIFACT_LATTICE_CONTEXT: Readonly<NextArtifactLatticeContext>;
+export {};

package/dist/next/protocol.js

@@ -0,0 +1,56 @@
+import { z } from 'zod';
+import { stripArtifactReleaseQuery } from './routes.js';
+export const NEXT_ARTIFACT_BRIDGE_TYPE = 'artifact-studio-next';
+export const NEXT_ARTIFACT_BRIDGE_VERSION = 1;
+export const nextArtifactThemeSchema = z.object({
+    tokens: z.string().max(128).nullable(),
+    theme: z.string().max(128).nullable(),
+    dark: z.boolean(),
+    vars: z.record(z.string().regex(/^--[a-zA-Z0-9_-]{1,100}$/), z.string().max(1024)),
+});
+export const nextArtifactLatticeContextSchema = z.object({
+    runId: z.string().max(256).nullable(),
+    nodeId: z.string().max(256).nullable(),
+    stepId: z.string().max(256).nullable(),
+    processId: z.string().max(256).nullable(),
+});
+export const nextArtifactInitialContextSchema = z.object({
+    theme: nextArtifactThemeSchema.optional(),
+    lattice: nextArtifactLatticeContextSchema.optional(),
+    route: z.string().max(8192).refine((path) => isNextArtifactRelativePath({ path })).transform((path) => stripArtifactReleaseQuery({ path })).optional(),
+});
+const envelopeSchema = z.object({
+    type: z.literal(NEXT_ARTIFACT_BRIDGE_TYPE),
+    version: z.literal(NEXT_ARTIFACT_BRIDGE_VERSION),
+    channelId: z.string().min(1).max(256),
+    nonce: z.string().min(16).max(256),
+    payload: z.record(z.string(), z.unknown()),
+});
+/** Caller must independently check event.source and event.origin. */
+export function parseNextArtifactBridgeEnvelope({ value, channelId, nonce }) {
+    const parsed = envelopeSchema.safeParse(value);
+    if (!parsed.success || parsed.data.channelId !== channelId || parsed.data.nonce !== nonce)
+        return null;
+    return parsed.data;
+}
+export function createNextArtifactBridgeEnvelope({ bootstrap, payload }) {
+    return { type: NEXT_ARTIFACT_BRIDGE_TYPE, version: NEXT_ARTIFACT_BRIDGE_VERSION, channelId: bootstrap.channelId, nonce: bootstrap.nonce, payload };
+}
+export function validateNextArtifactBootstrap({ bootstrap }) {
+    let parsed;
+    try {
+        parsed = new URL(bootstrap.parentOrigin);
+    }
+    catch {
+        throw new Error('Artifact parent origin must be an exact HTTP(S) origin');
+    }
+    const local = parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1' || parsed.hostname === '[::1]';
+    if (parsed.origin !== bootstrap.parentOrigin || (parsed.protocol !== 'https:' && !(parsed.protocol === 'http:' && local))) {
+        throw new Error('Artifact parent origin must be HTTPS (or HTTP loopback), without a path');
+    }
+    envelopeSchema.parse(createNextArtifactBridgeEnvelope({ bootstrap, payload: {} }));
+}
+export function isNextArtifactRelativePath({ path }) {
+    return typeof path === 'string' && path.length <= 8192 && path.startsWith('/') && !path.startsWith('//') && !/[\\\s\x00-\x1f\x7f]/.test(path);
+}
+export const EMPTY_NEXT_ARTIFACT_LATTICE_CONTEXT = Object.freeze({ runId: null, nodeId: null, stepId: null, processId: null });

package/dist/next/release.d.ts

@@ -0,0 +1,15 @@
+export declare const ARTIFACT_RELEASE_HEADER = "x-sequence-artifact-release";
+export declare const ARTIFACT_RELEASE_FORM_FIELD = "__sequence_release";
+interface ArtifactFetchTarget {
+    fetch: typeof globalThis.fetch;
+    location: {
+        origin: string;
+        href: string;
+    };
+}
+/** Stamp the document's release, never a cookie shared with another tab. No mutations are retried. */
+export declare function installArtifactReleaseGuard({ deploymentId, target }: {
+    deploymentId: string | null;
+    target?: ArtifactFetchTarget;
+}): () => void;
+export {};

package/dist/next/release.js

@@ -0,0 +1,46 @@
+export const ARTIFACT_RELEASE_HEADER = 'x-sequence-artifact-release';
+export const ARTIFACT_RELEASE_FORM_FIELD = '__sequence_release';
+const guards = new WeakMap();
+/** Stamp the document's release, never a cookie shared with another tab. No mutations are retried. */
+export function installArtifactReleaseGuard({ deploymentId, target = typeof window === 'undefined' ? undefined : window }) {
+    if (!target || !deploymentId)
+        return () => { };
+    if (!/^[a-zA-Z0-9_-]{1,255}$/.test(deploymentId))
+        throw new Error('Invalid Artifact deployment identifier');
+    const existing = guards.get(target);
+    if (existing) {
+        if (existing.deploymentId !== deploymentId)
+            throw new Error('Artifact document release changed; reload before submitting mutations');
+        existing.users += 1;
+        return cleanup({ target, guard: existing });
+    }
+    const original = target.fetch;
+    const wrapped = (input, init) => {
+        const url = new URL(input instanceof Request ? input.url : String(input), target.location.href);
+        const method = (init?.method ?? (input instanceof Request ? input.method : 'GET')).toUpperCase();
+        if (url.origin !== target.location.origin || ['GET', 'HEAD', 'OPTIONS'].includes(method))
+            return original.call(target, input, init);
+        const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));
+        headers.set(ARTIFACT_RELEASE_HEADER, deploymentId);
+        return original.call(target, input, { ...init, headers });
+    };
+    const guard = { deploymentId, original, wrapped, users: 1 };
+    guards.set(target, guard);
+    target.fetch = wrapped;
+    return cleanup({ target, guard });
+}
+function cleanup({ target, guard }) {
+    let disposed = false;
+    return () => {
+        if (disposed)
+            return;
+        disposed = true;
+        guard.users -= 1;
+        if (guard.users !== 0)
+            return;
+        // Preserve a later wrapper installed by the application or another framework.
+        if (target.fetch === guard.wrapped)
+            target.fetch = guard.original;
+        guards.delete(target);
+    };
+}

package/dist/next/requests.d.ts

@@ -0,0 +1,15 @@
+export interface NextArtifactBridgeRequest {
+    method: string;
+    args?: unknown[];
+    signal?: AbortSignal;
+}
+export declare function createNextArtifactRequests({ send, timeoutMs }: {
+    send(payload: Record<string, unknown>): void;
+    timeoutMs: number;
+}): {
+    request({ method, args, signal }: NextArtifactBridgeRequest): Promise<unknown>;
+    receive({ payload }: {
+        payload: Record<string, unknown>;
+    }): void;
+    dispose(): void;
+};

package/dist/next/requests.js

@@ -0,0 +1,59 @@
+export function createNextArtifactRequests({ send, timeoutMs }) {
+    const pending = new Map();
+    // A React effect remount may reuse the session nonce. Old responses must not
+    // settle requests created by the new bridge instance.
+    const instanceId = globalThis.crypto.randomUUID();
+    let sequence = 0;
+    function cancel({ id, error }) {
+        const request = pending.get(id);
+        if (!request)
+            return;
+        pending.delete(id);
+        request.cleanup();
+        request.reject(error);
+        try {
+            send({ type: 'artifact-studio-bridge-cancel', id });
+        }
+        catch { /* A lost host cannot accept cancellation. */ }
+    }
+    return {
+        request({ method, args = [], signal }) {
+            if (signal?.aborted)
+                return Promise.reject(new DOMException('Artifact request aborted', 'AbortError'));
+            if (pending.size >= 100)
+                return Promise.reject(new Error('Too many pending Artifact requests'));
+            if (!method || method.length > 128 || args.length > 20)
+                return Promise.reject(new Error('Invalid Artifact bridge request'));
+            const id = `artifact-next-${instanceId}-${++sequence}`;
+            return new Promise((resolve, reject) => {
+                const onAbort = () => cancel({ id, error: new DOMException('Artifact request aborted', 'AbortError') });
+                const timer = setTimeout(() => cancel({ id, error: new Error('Artifact bridge request timed out') }), timeoutMs);
+                pending.set(id, { resolve, reject, cleanup() { clearTimeout(timer); signal?.removeEventListener('abort', onAbort); } });
+                signal?.addEventListener('abort', onAbort, { once: true });
+                try {
+                    send({ type: 'artifact-studio-bridge-request', id, method, args });
+                }
+                catch (error) {
+                    cancel({ id, error: error instanceof Error ? error : new Error('Artifact request could not be sent') });
+                }
+            });
+        },
+        receive({ payload }) {
+            if (payload.type !== 'artifact-studio-bridge-response' || typeof payload.id !== 'string')
+                return;
+            const request = pending.get(payload.id);
+            if (!request)
+                return;
+            pending.delete(payload.id);
+            request.cleanup();
+            if (typeof payload.error === 'string')
+                request.reject(new Error(payload.error));
+            else
+                request.resolve(payload.result);
+        },
+        dispose() {
+            for (const id of pending.keys())
+                cancel({ id, error: new Error('Artifact bridge disposed') });
+        },
+    };
+}

package/dist/next/routes.d.ts

@@ -0,0 +1,4 @@
+/** Remove transport metadata without reserializing application query values. */
+export declare function stripArtifactReleaseQuery({ path }: {
+    path: string;
+}): string;

package/dist/next/routes.js

@@ -0,0 +1,21 @@
+import { ARTIFACT_RELEASE_FORM_FIELD } from './release.js';
+/** Remove transport metadata without reserializing application query values. */
+export function stripArtifactReleaseQuery({ path }) {
+    const hashAt = path.indexOf('#');
+    const beforeHash = hashAt < 0 ? path : path.slice(0, hashAt);
+    const queryAt = beforeHash.indexOf('?');
+    if (queryAt < 0)
+        return path;
+    const query = beforeHash.slice(queryAt + 1);
+    const parts = query.split('&');
+    const kept = parts.filter((part) => {
+        const key = part.split('=', 1)[0] ?? '';
+        // URLSearchParams decodes only the key here. Non-reserved parameters retain
+        // their byte-for-byte spelling, duplicate order and original escaping.
+        return !new URLSearchParams(`${key}=`).has(ARTIFACT_RELEASE_FORM_FIELD);
+    });
+    if (kept.length === parts.length)
+        return path;
+    const remaining = kept.join('&');
+    return `${beforeHash.slice(0, queryAt)}${remaining ? `?${remaining}` : ''}${hashAt < 0 ? '' : path.slice(hashAt)}`;
+}

package/dist/next/streams.d.ts

@@ -0,0 +1,16 @@
+import type { SequenceApiFetchOptions } from '../sdk.js';
+export interface NextArtifactStreamRequest {
+    path: string;
+    options?: SequenceApiFetchOptions;
+    signal?: AbortSignal;
+}
+/** One pull grants one <=64KiB chunk; unread responses cannot fill a message queue. */
+export declare function createNextArtifactStreams({ send }: {
+    send(payload: Record<string, unknown>): void;
+}): {
+    open: ({ path, options, signal }: NextArtifactStreamRequest) => Promise<Response>;
+    receive({ payload }: {
+        payload: Record<string, unknown>;
+    }): void;
+    dispose(): void;
+};