@sequenceholdings/artifact-studio 0.2.6 → 0.3.1

package/dist/gateway/usage.d.ts

@@ -0,0 +1,70 @@
+export interface GatewayUsageEvent {
+    eventId: string;
+    requestId: string;
+    /** The user the gateway acted for: the session owner Atlas authorized for this request. */
+    actorId: string;
+    projectId: string;
+    deploymentId?: string;
+    devSessionId?: string;
+    environment: string;
+    startedAt: string;
+    endedAt: string;
+    measurements: {
+        requestCount: 1;
+        durationMs: number;
+    };
+    outcome: 'success' | 'error' | 'cancelled';
+    httpStatus: number;
+}
+export type GatewayUsageFailure = {
+    kind: 'usage_queue_full' | 'usage_delivery_failed' | 'usage_delivery_rejected' | 'usage_events_rejected' | 'usage_lost_on_shutdown';
+    count: number;
+};
+export interface GatewayUsageLimits {
+    /** Events buffered or in delivery; later observations are dropped and counted. */
+    capacity: number;
+    /** Events per control-plane call. Atlas accepts at most this many per batch. */
+    maxBatch: number;
+    /** Longest an observation waits in the buffer before a partial batch is sent. */
+    flushIntervalMs: number;
+    /** Concurrent batch deliveries. */
+    concurrency: number;
+}
+export declare const GATEWAY_USAGE_LIMITS: Readonly<GatewayUsageLimits>;
+/**
+ * Batched, bounded delivery of request observations: one control-plane call per `maxBatch` events or
+ * per flush interval, instead of one per request. Atlas deduplicates accepted records durably, so a
+ * retried batch is idempotent. Observations are telemetry, not billing totals. A crash loses at most
+ * the unflushed buffer (about one flush interval) and the batches in flight; a graceful drain flushes
+ * everything, and a forced exit reports `pending` as `usage_lost_on_shutdown`.
+ */
+export declare class GatewayUsageReporter {
+    private readonly options;
+    private readonly buffer;
+    private readonly inFlight;
+    private readonly limits;
+    private timer;
+    private dropped;
+    private closed;
+    constructor(options: {
+        send: (events: GatewayUsageEvent[]) => Promise<{
+            rejected: number;
+        }>;
+        onFailure: (failure: GatewayUsageFailure) => void;
+        limits?: Partial<GatewayUsageLimits>;
+    });
+    /** Observations accepted but not yet confirmed by Atlas. */
+    get pending(): number;
+    record(event: GatewayUsageEvent): void;
+    /**
+     * Stops accepting observations and delivers everything buffered; each batch is bounded by its
+     * retries. A process that must exit sooner reports `pending` as lost (see gateway-main).
+     */
+    close(): Promise<void>;
+    private drainAll;
+    private scheduleFlush;
+    private reportDropped;
+    /** Sends full batches, and a partial batch too when forced by the timer or shutdown. */
+    private pump;
+    private deliver;
+}

package/dist/gateway/usage.js

@@ -0,0 +1,116 @@
+export const GATEWAY_USAGE_LIMITS = Object.freeze({ capacity: 10_000, maxBatch: 100, flushIntervalMs: 1_000, concurrency: 4 });
+const ATTEMPTS = 3;
+/**
+ * Batched, bounded delivery of request observations: one control-plane call per `maxBatch` events or
+ * per flush interval, instead of one per request. Atlas deduplicates accepted records durably, so a
+ * retried batch is idempotent. Observations are telemetry, not billing totals. A crash loses at most
+ * the unflushed buffer (about one flush interval) and the batches in flight; a graceful drain flushes
+ * everything, and a forced exit reports `pending` as `usage_lost_on_shutdown`.
+ */
+export class GatewayUsageReporter {
+    options;
+    buffer = [];
+    inFlight = new Map();
+    limits;
+    timer;
+    dropped = 0;
+    closed = false;
+    constructor(options) {
+        this.options = options;
+        this.limits = { ...GATEWAY_USAGE_LIMITS, ...options.limits };
+        for (const value of Object.values(this.limits)) {
+            if (!Number.isSafeInteger(value) || value < 1)
+                throw new Error('Gateway usage limits must be positive integers');
+        }
+    }
+    /** Observations accepted but not yet confirmed by Atlas. */
+    get pending() {
+        let count = this.buffer.length;
+        for (const size of this.inFlight.values())
+            count += size;
+        return count;
+    }
+    record(event) {
+        if (this.closed) {
+            this.options.onFailure({ kind: 'usage_lost_on_shutdown', count: 1 });
+            return;
+        }
+        if (this.pending >= this.limits.capacity) {
+            this.dropped++;
+            this.scheduleFlush();
+            return;
+        }
+        this.buffer.push(event);
+        if (this.buffer.length >= this.limits.maxBatch)
+            this.pump();
+        else
+            this.scheduleFlush();
+    }
+    /**
+     * Stops accepting observations and delivers everything buffered; each batch is bounded by its
+     * retries. A process that must exit sooner reports `pending` as lost (see gateway-main).
+     */
+    async close() {
+        this.closed = true;
+        clearTimeout(this.timer);
+        this.timer = undefined;
+        await this.drainAll();
+        this.reportDropped();
+    }
+    async drainAll() {
+        while (this.buffer.length || this.inFlight.size) {
+            this.pump({ force: true });
+            if (this.inFlight.size)
+                await Promise.race(this.inFlight.keys());
+        }
+    }
+    scheduleFlush() {
+        if (this.timer || this.closed)
+            return;
+        this.timer = setTimeout(() => {
+            this.timer = undefined;
+            this.reportDropped();
+            this.pump({ force: true });
+            if (this.buffer.length)
+                this.scheduleFlush();
+        }, this.limits.flushIntervalMs);
+        this.timer.unref();
+    }
+    reportDropped() {
+        if (!this.dropped)
+            return;
+        this.options.onFailure({ kind: 'usage_queue_full', count: this.dropped });
+        this.dropped = 0;
+    }
+    /** Sends full batches, and a partial batch too when forced by the timer or shutdown. */
+    pump({ force = false } = {}) {
+        while (this.inFlight.size < this.limits.concurrency && (this.buffer.length >= this.limits.maxBatch || (force && this.buffer.length))) {
+            const batch = this.buffer.splice(0, this.limits.maxBatch);
+            const delivery = this.deliver(batch).finally(() => {
+                this.inFlight.delete(delivery);
+                this.pump({ force: this.closed });
+            });
+            this.inFlight.set(delivery, batch.length);
+        }
+    }
+    async deliver(batch) {
+        for (let attempt = 0; attempt < ATTEMPTS; attempt++) {
+            try {
+                const { rejected } = await this.options.send(batch);
+                if (rejected > 0)
+                    this.options.onFailure({ kind: 'usage_events_rejected', count: rejected });
+                return;
+            }
+            catch (error) {
+                const status = typeof error === 'object' && error !== null && 'status' in error ? error.status : undefined;
+                if (typeof status === 'number' && status >= 400 && status < 500 && status !== 429) {
+                    this.options.onFailure({ kind: 'usage_delivery_rejected', count: batch.length });
+                    return;
+                }
+                if (attempt < ATTEMPTS - 1)
+                    await new Promise((resolve) => setTimeout(resolve, 100 * 2 ** attempt));
+            }
+        }
+        this.options.onFailure({ kind: 'usage_delivery_failed', count: batch.length });
+    }
+}

package/dist/gateway-main.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gateway-main.js

@@ -0,0 +1,114 @@
+import { randomUUID } from 'node:crypto';
+import { isIP } from 'node:net';
+import { Redis } from 'ioredis';
+import { ArtifactGatewayControl } from './gateway/control.js';
+import { createArtifactGateway } from './gateway/server.js';
+import { RedisTunnelOwnership, RedisTunnelRelay } from './tunnel/redis.js';
+import { ArtifactRequestAdmission } from './gateway/admission.js';
+import { GatewayControlAdmission } from './gateway/control-admission.js';
+function required(name) {
+    const value = process.env[name];
+    if (!value)
+        throw new Error(`Missing required gateway configuration: ${name}`);
+    return value;
+}
+/** A separate process/identity from Atlas and all application/build containers. */
+async function main() {
+    if (process.env.ARTIFACT_NEXT_ENABLED !== 'true')
+        throw new Error('Artifact Next gateway is disabled');
+    const redisUrl = required('ARTIFACT_NEXT_REDIS_URL');
+    if (new URL(redisUrl).protocol !== 'rediss:')
+        throw new Error('Artifact tunnel routing requires private Redis with TLS');
+    const namespace = required('APP_ENV'), nodeId = randomUUID();
+    const redisOptions = {
+        enableOfflineQueue: false, autoResendUnfulfilledCommands: false, maxRetriesPerRequest: 0,
+        lazyConnect: true, connectTimeout: 10_000,
+        tls: { rejectUnauthorized: true, ...(process.env.REDIS_CA_CERT ? { ca: process.env.REDIS_CA_CERT } : {}) },
+    };
+    const command = new Redis(redisUrl, redisOptions);
+    const publisher = new Redis(redisUrl, redisOptions);
+    const subscriber = new Redis(redisUrl, { ...redisOptions, autoResubscribe: false });
+    const clients = [command, publisher, subscriber];
+    for (const client of clients)
+        client.on('error', () => {
+            // Provider messages may include connection strings; keep them out of logs.
+            process.stderr.write(`${JSON.stringify({ event: 'artifact_gateway.redis_unavailable', nodeId })}\n`);
+        });
+    await Promise.all(clients.map(client => client.connect()));
+    const log = (event) => process.stderr.write(`${JSON.stringify({ ...event, nodeId })}\n`);
+    // A flood of refused requests or forged frames must not become a log flood: count and report every 10 s.
+    const refusals = new Map();
+    const refuse = (kind) => { refusals.set(kind, (refusals.get(kind) ?? 0) + 1); };
+    setInterval(() => {
+        for (const [kind, count] of refusals)
+            log({ event: 'artifact_gateway.request', kind, count });
+        refusals.clear();
+    }, 10_000).unref();
+    const sessionKey = required('ARTIFACT_NEXT_SESSION_KEY');
+    const ownership = new RedisTunnelOwnership({ command, namespace });
+    // Relay frames are authenticated with a subkey of the gateway-only session key, which every
+    // replica already shares and Atlas never holds.
+    const relay = new RedisTunnelRelay({ nodeId, namespace, ownership, publisher, subscriber, secret: sessionKey,
+        onRejectedFrame: () => refuse('relay_frame_rejected') });
+    await relay.start();
+    let stopping = false;
+    subscriber.on('ready', () => { if (!stopping)
+        void relay.start().catch(() => undefined); });
+    const controlUrl = required('ARTIFACT_NEXT_CONTROL_PLANE_URL');
+    const gateway = createArtifactGateway({
+        control: new ArtifactGatewayControl({ url: controlUrl, token: required('ARTIFACT_NEXT_CONTROL_TOKEN') }),
+        runtimeDomain: required('ARTIFACT_NEXT_RUNTIME_DOMAIN'),
+        parentOrigin: process.env.ARTIFACT_NEXT_PARENT_ORIGIN ?? new URL(controlUrl).origin,
+        gatewayOrigin: required('ARTIFACT_NEXT_GATEWAY_URL'),
+        sessionKey,
+        contextPrivateKey: required('ARTIFACT_NEXT_CONTEXT_PRIVATE_KEY'),
+        contextKeyId: required('ARTIFACT_NEXT_CONTEXT_KEY_ID'),
+        nodeId, routing: ownership, relay,
+        admission: new ArtifactRequestAdmission({ redis: command, namespace }),
+        controlAdmission: new GatewayControlAdmission({ redis: command, namespace }),
+        resolveLease: sessionId => ownership.resolveLease(sessionId),
+        renewLease: lease => ownership.renew(lease, nodeId),
+        ready: () => clients.every(client => client.status === 'ready') && relay.isReady(),
+        onError: event => { if (event.kind === 'admission_rejected')
+            refuse(event.kind);
+        else
+            log({ event: 'artifact_gateway.request', ...event }); },
+    });
+    const port = Number(process.env.PORT ?? '8080');
+    if (!Number.isSafeInteger(port) || port < 1 || port > 65535)
+        throw new Error('Invalid gateway PORT');
+    // Every interface in its container; a laptop run (scripts/local-stack.sh) keeps it on loopback.
+    const host = process.env.ARTIFACT_NEXT_GATEWAY_HOST ?? '0.0.0.0';
+    if (isIP(host) === 0)
+        throw new Error('Invalid ARTIFACT_NEXT_GATEWAY_HOST: expected an IP address');
+    await new Promise((resolve, reject) => {
+        gateway.server.once('error', reject);
+        gateway.server.listen(port, host, resolve);
+    });
+    process.stdout.write(`${JSON.stringify({ event: 'artifact_gateway.ready', nodeId, port })}\n`);
+    const stop = async () => {
+        if (stopping)
+            return;
+        stopping = true;
+        const deadline = setTimeout(() => {
+            // Account for observations a forced exit discards; a graceful drain reports its own losses.
+            const lost = gateway.pendingUsage;
+            if (lost)
+                log({ event: 'artifact_gateway.request', kind: 'usage_lost_on_shutdown', count: lost });
+            gateway.server.closeAllConnections();
+            process.exit(1);
+        }, 9_000);
+        deadline.unref();
+        await gateway.drain();
+        await relay.close();
+        for (const client of clients)
+            client.disconnect();
+        clearTimeout(deadline);
+    };
+    process.once('SIGTERM', () => { void stop(); });
+    process.once('SIGINT', () => { void stop(); });
+}
+void main().catch(() => {
+    process.stderr.write(`${JSON.stringify({ event: 'artifact_gateway.start_failed' })}\n`);
+    process.exit(1);
+});

package/dist/git-clone.d.ts

@@ -15,11 +15,29 @@ export type RunGitClone = (args: {
     destDir: string;
     /** Optional branch, tag, or commit SHA. */
     ref?: string;
+    /**
+     * `git clone --depth`. Omitted for commit-SHA refs: those clone the
+     * default branch in full, then check the SHA out.
+     */
+    depth?: number;
     /** PAT used as Basic-auth password (username `git`). */
     pat: string;
     /** Hard ceiling before the git child is killed (default 5m). */
     timeoutMs?: number;
 }) => Promise<void>;
+/**
+ * Argv for `git clone`, excluding the askpass environment.
+ * Positive `depth` is a shallow tip clone. Commit SHAs ignore `depth`.
+ */
+export declare function gitCloneArgs({ cloneUrl, destDir, ref, depth, }: {
+    cloneUrl: string;
+    destDir: string;
+    ref?: string;
+    depth?: number;
+}): {
+    args: string[];
+    shaRef?: string;
+};
 /**
  * Run `fn` with GIT_ASKPASS set to a short-lived script that answers username
  * with `git` and password with `pat`. The script is deleted afterward.
@@ -31,11 +49,15 @@ export declare function withGitAskpass<T>({ pat, fn, }: {
 /**
  * Clone with a clean URL + PAT via askpass. Branch/tag refs use `--branch`;
  * commit SHAs clone default HEAD then `git checkout <sha>`.
+ * `depth` (repos clone passes 1) fetches only that many commits — a full
+ * history walk against git-service reads every object from object storage
+ * before the pack starts, which stalls large repos.
  */
-export declare function runGitClone({ cloneUrl, destDir, ref, pat, timeoutMs, }: {
+export declare function runGitClone({ cloneUrl, destDir, ref, depth, pat, timeoutMs, }: {
     cloneUrl: string;
     destDir: string;
     ref?: string;
+    depth?: number;
     pat: string;
     timeoutMs?: number;
 }): Promise<void>;

package/dist/git-clone.js

@@ -55,6 +55,28 @@ const GIT_LOW_SPEED_LIMIT_BYTES = 1000;
 const GIT_LOW_SPEED_TIME_SEC = 180;
 /** Backstop hard deadline: SIGKILL the child even if it trickles above the low-speed floor. */
 const GIT_CLONE_TIMEOUT_MS = 6 * 60_000;
+/**
+ * Argv for `git clone`, excluding the askpass environment.
+ * Positive `depth` is a shallow tip clone. Commit SHAs ignore `depth`.
+ */
+export function gitCloneArgs({ cloneUrl, destDir, ref, depth, }) {
+    const shaRef = ref && looksLikeCommitSha(ref) ? ref : undefined;
+    const branchRef = ref && !shaRef ? ref : undefined;
+    const args = [
+        '-c',
+        `http.lowSpeedLimit=${GIT_LOW_SPEED_LIMIT_BYTES}`,
+        '-c',
+        `http.lowSpeedTime=${GIT_LOW_SPEED_TIME_SEC}`,
+        'clone',
+    ];
+    if (depth != null && depth > 0 && !shaRef) {
+        args.push('--depth', String(depth));
+    }
+    if (branchRef)
+        args.push('--branch', branchRef);
+    args.push(cloneUrl, destDir);
+    return shaRef ? { args, shaRef } : { args };
+}
 /** First non-flag arg (the git subcommand), skipping `-c <value>` config pairs. */
 function gitVerb(args) {
     for (let i = 0; i < args.length; i++) {
@@ -142,8 +164,11 @@ export async function withGitAskpass({ pat, fn, }) {
 /**
  * Clone with a clean URL + PAT via askpass. Branch/tag refs use `--branch`;
  * commit SHAs clone default HEAD then `git checkout <sha>`.
+ * `depth` (repos clone passes 1) fetches only that many commits — a full
+ * history walk against git-service reads every object from object storage
+ * before the pack starts, which stalls large repos.
  */
-export async function runGitClone({ cloneUrl, destDir, ref, pat, timeoutMs, }) {
+export async function runGitClone({ cloneUrl, destDir, ref, depth, pat, timeoutMs, }) {
     let cleanUrl = cloneUrl;
     try {
         const parsed = new URL(cloneUrl);
@@ -156,23 +181,15 @@ export async function runGitClone({ cloneUrl, destDir, ref, pat, timeoutMs, }) {
     catch {
         // leave as-is; git will fail loudly
     }
-    // Global `-c` config must precede the subcommand. Low-speed settings bound
-    // the fetch so a stalled transport aborts fast rather than wedging the deploy.
-    const lowSpeed = [
-        '-c',
-        `http.lowSpeedLimit=${GIT_LOW_SPEED_LIMIT_BYTES}`,
-        '-c',
-        `http.lowSpeedTime=${GIT_LOW_SPEED_TIME_SEC}`,
-    ];
     await withGitAskpass({
         pat,
         fn: async (env) => {
-            const args = [...lowSpeed, 'clone'];
-            const shaRef = ref && looksLikeCommitSha(ref) ? ref : undefined;
-            const branchRef = ref && !shaRef ? ref : undefined;
-            if (branchRef)
-                args.push('--branch', branchRef);
-            args.push(cleanUrl, destDir);
+            const { args, shaRef } = gitCloneArgs({
+                cloneUrl: cleanUrl,
+                destDir,
+                ...(ref ? { ref } : {}),
+                ...(depth != null ? { depth } : {}),
+            });
             try {
                 await spawnGit({ args, env, ...(timeoutMs ? { timeoutMs } : {}) });
             }

package/dist/manifest-next.d.ts

@@ -0,0 +1,217 @@
+import { z } from 'zod';
+/** Approved major/minor profile. Builds additionally record exact patch versions. */
+export declare const ARTIFACT_NEXT_RUNTIME: Readonly<{
+    sdk: "sequence";
+    node: 24;
+    react: 19;
+    next: "16.3";
+}>;
+/** Admission policy for new development sessions and builds; retained releases keep their recorded toolchain. */
+export declare const ARTIFACT_NEXT_APPROVED_PACKAGES: Readonly<{
+    next: "16.3.4";
+    react: "19.2.6";
+    'react-dom': "19.2.6";
+}>;
+export declare const ARTIFACT_NEXT_RESOURCE_DEFAULTS: {
+    cpu: number;
+    memory_mb: number;
+    concurrency: number;
+    min_instances: number;
+    max_instances: number;
+    timeout_seconds: number;
+};
+export declare const artifactNextServerCapabilitiesSchema: z.ZodPrefault<z.ZodObject<{
+    storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
+        viewer: "viewer";
+        editor: "editor";
+        admin: "admin";
+    }>>>;
+    data: z.ZodPrefault<z.ZodObject<{
+        read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+    api: z.ZodPrefault<z.ZodObject<{
+        read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+    functions: z.ZodPrefault<z.ZodObject<{
+        invoke: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>>;
+export type ArtifactNextServerCapabilities = z.infer<typeof artifactNextServerCapabilitiesSchema>;
+export declare const artifactNextResourceLimitsSchema: z.ZodPrefault<z.ZodObject<{
+    cpu: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<4>, z.ZodLiteral<8>]>>;
+    memory_mb: z.ZodDefault<z.ZodNumber>;
+    concurrency: z.ZodDefault<z.ZodNumber>;
+    min_instances: z.ZodDefault<z.ZodNumber>;
+    max_instances: z.ZodDefault<z.ZodNumber>;
+    timeout_seconds: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>>;
+export declare const artifactNextSecretNameSchema: z.ZodString;
+export declare const artifactNextSecretBindingSchema: z.ZodObject<{
+    name: z.ZodString;
+    secret_id: z.ZodUUID;
+    version: z.ZodNumber;
+}, z.core.$strict>;
+/** Pinned public assets fetched by the trusted preparation stage before offline compilation. */
+export declare const artifactNextPublicFontSchema: z.ZodObject<{
+    path: z.ZodString;
+    url: z.ZodString;
+    sha256: z.ZodString;
+}, z.core.$strict>;
+export type ArtifactNextPublicFont = z.infer<typeof artifactNextPublicFontSchema>;
+export declare const artifactNextBuildConfigSchema: z.ZodPrefault<z.ZodObject<{
+    public_env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    public_fonts: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        url: z.ZodString;
+        sha256: z.ZodString;
+    }, z.core.$strict>>>;
+}, z.core.$strict>>;
+export declare const artifactNextServerSchema: z.ZodPrefault<z.ZodObject<{
+    capabilities: z.ZodPrefault<z.ZodObject<{
+        storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
+            viewer: "viewer";
+            editor: "editor";
+            admin: "admin";
+        }>>>;
+        data: z.ZodPrefault<z.ZodObject<{
+            read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        api: z.ZodPrefault<z.ZodObject<{
+            read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        functions: z.ZodPrefault<z.ZodObject<{
+            invoke: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    service_account: z.ZodOptional<z.ZodString>;
+    secrets: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        secret_id: z.ZodUUID;
+        version: z.ZodNumber;
+    }, z.core.$strict>>>;
+    egress: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    resources: z.ZodPrefault<z.ZodObject<{
+        cpu: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<4>, z.ZodLiteral<8>]>>;
+        memory_mb: z.ZodDefault<z.ZodNumber>;
+        concurrency: z.ZodDefault<z.ZodNumber>;
+        min_instances: z.ZodDefault<z.ZodNumber>;
+        max_instances: z.ZodDefault<z.ZodNumber>;
+        timeout_seconds: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strict>>;
+    cache: z.ZodOptional<z.ZodObject<{
+        capacity_gb: z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>>;
+export declare const artifactStudioNextManifestSchema: z.ZodObject<{
+    bundle: z.ZodObject<{
+        name: z.ZodString;
+        schema_version: z.ZodLiteral<2>;
+    }, z.core.$strict>;
+    artifact: z.ZodObject<{
+        project_id: z.ZodString;
+        title: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        type: z.ZodLiteral<"nextjs">;
+        app_root: z.ZodDefault<z.ZodString>;
+    }, z.core.$strict>;
+    runtime: z.ZodPrefault<z.ZodObject<{
+        sdk: z.ZodDefault<z.ZodLiteral<"sequence">>;
+        node: z.ZodDefault<z.ZodLiteral<24>>;
+        react: z.ZodDefault<z.ZodLiteral<19>>;
+        next: z.ZodDefault<z.ZodLiteral<"16.3">>;
+    }, z.core.$strict>>;
+    capabilities: z.ZodPrefault<z.ZodObject<{
+        allow_downloads: z.ZodDefault<z.ZodBoolean>;
+        allow_popups: z.ZodDefault<z.ZodBoolean>;
+        roles: z.ZodOptional<z.ZodObject<{
+            definitions: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+                description: z.ZodOptional<z.ZodString>;
+                default: z.ZodDefault<z.ZodBoolean>;
+                inherits: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                grants: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>>;
+            capabilities: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+                description: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>>;
+        uses: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
+            viewer: "viewer";
+            editor: "editor";
+            admin: "admin";
+        }>>>;
+        data: z.ZodPrefault<z.ZodObject<{
+            read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        api: z.ZodPrefault<z.ZodObject<{
+            read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        functions: z.ZodPrefault<z.ZodObject<{
+            invoke: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    build: z.ZodPrefault<z.ZodObject<{
+        public_env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        public_fonts: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            url: z.ZodString;
+            sha256: z.ZodString;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>;
+    server: z.ZodPrefault<z.ZodObject<{
+        capabilities: z.ZodPrefault<z.ZodObject<{
+            storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
+                viewer: "viewer";
+                editor: "editor";
+                admin: "admin";
+            }>>>;
+            data: z.ZodPrefault<z.ZodObject<{
+                read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+            api: z.ZodPrefault<z.ZodObject<{
+                read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+            functions: z.ZodPrefault<z.ZodObject<{
+                invoke: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+        service_account: z.ZodOptional<z.ZodString>;
+        secrets: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            secret_id: z.ZodUUID;
+            version: z.ZodNumber;
+        }, z.core.$strict>>>;
+        egress: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        resources: z.ZodPrefault<z.ZodObject<{
+            cpu: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<4>, z.ZodLiteral<8>]>>;
+            memory_mb: z.ZodDefault<z.ZodNumber>;
+            concurrency: z.ZodDefault<z.ZodNumber>;
+            min_instances: z.ZodDefault<z.ZodNumber>;
+            max_instances: z.ZodDefault<z.ZodNumber>;
+            timeout_seconds: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strict>>;
+        cache: z.ZodOptional<z.ZodObject<{
+            capacity_gb: z.ZodNumber;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    targets: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        url: z.ZodString;
+    }, z.core.$strict>>>;
+    sidebarIcon: z.ZodOptional<z.ZodString>;
+    sidebarBadge: z.ZodOptional<z.ZodObject<{
+        endpoint: z.ZodString;
+        tone: z.ZodOptional<z.ZodEnum<{
+            alert: "alert";
+            muted: "muted";
+        }>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ArtifactStudioNextManifest = z.infer<typeof artifactStudioNextManifestSchema>;