@sequenceholdings/artifact-studio 0.3.0 → 0.3.1

package/dist/next-cache/config.js

@@ -1,10 +1,12 @@
 import { readFile, readdir, rename, writeFile } from 'node:fs/promises';
-import { join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { load as parseYaml } from 'js-yaml';
+import { isNextArtifactManifest, parseArtifactStudioManifest } from '../manifest.js';
 import { resolveArtifactNextImages } from '../next-image-config.js';
 export { artifactNextCacheBindingSchema, verifyArtifactNextCacheReadiness } from './runtime.js';
 const MARKER = '// Generated by Atlas Artifact Studio; original configuration is preserved.';
-function configured(config) {
+function configured(config, egress) {
     const deploymentId = process.env.ARTIFACT_NEXT_BUILD_ID;
     if (deploymentId !== undefined && (deploymentId.length < 1 || deploymentId.length > 128 || /[^A-Za-z0-9_-]/.test(deploymentId)))
         throw new Error('Invalid platform build identifier');
@@ -25,7 +27,6 @@ function configured(config) {
         || Object.entries(handlers).some(([key, value]) => !['default', 'remote'].includes(key) || value !== components))) {
         throw new Error('Artifact Studio owns the Next cacheHandlers configuration');
     }
-    const egress = JSON.parse(process.env.ARTIFACT_NEXT_ALLOWED_EGRESS ?? '[]');
     if (!Array.isArray(egress) || !egress.every((host) => typeof host === 'string'))
         throw new Error('Invalid Artifact image egress policy');
     const images = resolveArtifactNextImages({ images: Reflect.get(config, 'images'), egressHosts: egress });
@@ -34,6 +35,32 @@ function configured(config) {
         cacheHandler: incremental, cacheHandlers: { default: components, remote: components },
         images: { ...images, customCacheHandler: true } };
 }
+/**
+ * seq-studio and the hosted build supply the application's egress policy. A plain local
+ * `next build` or `next dev` reads the same declaration from the application's manifest.
+ */
+async function allowedEgress(config) {
+    const supplied = process.env.ARTIFACT_NEXT_ALLOWED_EGRESS;
+    if (supplied !== undefined)
+        return JSON.parse(supplied);
+    const images = Reflect.get(config, 'images');
+    const patterns = typeof images === 'object' && images !== null ? Reflect.get(images, 'remotePatterns') : undefined;
+    if (process.env.K_SERVICE || !Array.isArray(patterns) || patterns.length === 0)
+        return [];
+    return declaredEgress({ projectRoot: process.cwd() });
+}
+/** The nearest artifact.bundle.yml, when its app_root is this project; the manifest may sit above app_root. */
+async function declaredEgress({ projectRoot }) {
+    for (let directory = projectRoot;; directory = dirname(directory)) {
+        const text = await readFile(join(directory, 'artifact.bundle.yml'), 'utf8').catch(() => undefined);
+        if (text !== undefined) {
+            const manifest = parseArtifactStudioManifest(parseYaml(text));
+            return isNextArtifactManifest(manifest) && resolve(directory, manifest.artifact.app_root) === projectRoot ? manifest.server.egress : [];
+        }
+        if (dirname(directory) === directory)
+            return [];
+    }
+}
 /** Always compiled into standalone output; runtime mode is selected only at boot. */
 export function withArtifactNextConfig(input) {
     return async (phase, context) => {
@@ -48,7 +75,7 @@ export function withArtifactNextConfig(input) {
         const config = typeof input === 'function' ? await input(phase, context) : input;
         if (!config || typeof config !== 'object' || Array.isArray(config))
             throw new Error('Next configuration must return an object');
-        return configured(config);
+        return configured(config, await allowedEgress(config));
     };
 }
 /** Runs only inside the isolated compile sandbox, never in the control-plane worker. */

package/dist/next-image-config.js

@@ -66,7 +66,7 @@ function resolveRemotePattern({ pattern, index, egressHosts }) {
         throw new Error(`${label} requires an exact public HTTPS hostname on port 443; wildcard, IP and local hosts are unsupported`);
     }
     if (!egressHosts.includes(value.hostname)) {
-        throw new Error(`${label} hostname must be declared in server.egress; run seq-studio artifact dev/build to supply the application's image policy`);
+        throw new Error(`${label} hostname ${value.hostname} must be declared in the application's server.egress in artifact.bundle.yml`);
     }
     const pathname = remotePatternPathname({ pathname: value.pathname ?? '/**', label });
     const search = remotePatternSearch({ search: value.search, label });

package/dist/server/client.d.ts

@@ -1,5 +1,5 @@
 import { storageClient } from '@sequenceholdings/storage';
-import { type OperationsManifest, type OperationExecutor } from '@sequenceholdings/orm/client';
+import { type OperationExecutor } from '@sequenceholdings/orm/client';
 import type { SequenceApiFetchResponse } from '../sdk.js';
 import { type ArtifactServerMode, type ArtifactServerRequest } from './broker-contract.js';
 import { createArtifactLogger, type ArtifactLogRecord } from './logger.js';
@@ -15,6 +15,20 @@ export interface ArtifactServerFetchOptions {
     body?: unknown;
     signal?: AbortSignal;
 }
+/**
+ * The namespace's generated operations.manifest.json. Only each operation's persisted hash
+ * is read, so the file can be passed as imported: a JSON import types `kind` as string.
+ */
+export interface ArtifactOrmOperations {
+    readonly manifestVersion?: number;
+    readonly schemaHash?: string;
+    readonly opsHash?: string;
+    readonly operations: Readonly<Record<string, {
+        readonly hash: string;
+        readonly kind?: string;
+        readonly requires?: unknown;
+    }>>;
+}
 export interface ArtifactServerClient {
     context: ArtifactRequestContext;
     mode: ArtifactServerMode;
@@ -26,7 +40,7 @@ export interface ArtifactServerClient {
     };
     orm(input: {
         namespace: string;
-        manifest: OperationsManifest;
+        manifest: ArtifactOrmOperations;
     }): OperationExecutor;
     asService(): ArtifactServerClient;
 }

package/dist/server/request-context.d.ts

@@ -20,6 +20,7 @@ export declare const artifactRequestContextSchema: z.ZodObject<{
     deploymentId: z.ZodNullable<z.ZodString>;
     devSessionId: z.ZodNullable<z.ZodString>;
     requestId: z.ZodString;
+    jti: z.ZodUUID;
     method: z.ZodEnum<{
         GET: "GET";
         POST: "POST";

package/dist/server/request-context.js

@@ -26,7 +26,11 @@ export const artifactRequestContextSchema = z.object({
     mode: z.enum(['development', 'preview', 'published']),
     deploymentId: id.nullable(),
     devSessionId: id.nullable(),
+    /** Correlates logs, usage and audit records for the originating request. */
     requestId: id,
+    /** Unique per signed context. Atlas budgets delegated calls per jti until the context expires. */
+    jti: z.uuid(),
+    /** The originating browser request's method. Atlas only delegates reads for GET, HEAD and OPTIONS. */
     method: z.enum(['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS']),
     path: z.string().min(1).max(8192).refine(value => value.startsWith('/') &&
         !value.startsWith('//') && !/[\\\r\n\u0000#]/.test(value), 'Expected an origin-relative request path'),

package/dist/server/runtime-config.d.ts

@@ -31,6 +31,7 @@ export declare function getArtifactRequestContext({ headers, runtime, method, pa
     deploymentId: string | null;
     devSessionId: string | null;
     requestId: string;
+    jti: string;
     method: "GET" | "POST" | "DELETE" | "HEAD" | "PUT" | "PATCH" | "OPTIONS";
     path: string;
     iat: number;

package/dist/server.d.ts

@@ -1,6 +1,6 @@
 import 'server-only';
 export { createArtifactServerClient, ArtifactServerError } from './server/client.js';
-export type { ArtifactServerClient, ArtifactServerFetchOptions } from './server/client.js';
+export type { ArtifactOrmOperations, ArtifactServerClient, ArtifactServerFetchOptions } from './server/client.js';
 export { getArtifactRequestContext, readArtifactRuntimeConfig } from './server/runtime-config.js';
 export type { ArtifactRuntimeConfig, ArtifactRequestHeaders } from './server/runtime-config.js';
 export { getArtifactBrowserBootstrap } from './server/request-context.js';

package/dist/templates/nextjs/README.md

@@ -71,6 +71,12 @@ only the capabilities the application needs, then configure authorized resource
 bindings in Atlas. Local development uses explicit nonproduction resources and
 never falls back to production when a binding is missing.
 
+ORM access is declared per table and per mutation: list `<namespace>/<table>`
+under `data.read` for every table a query reads (queries that follow
+platform-user relations also read `<namespace>/platformUsers`). Under
+`data.write`, use `<namespace>/ops/<Operation>` for each persisted mutation the
+app runs, or `<namespace>/<table>` for table-level coverage.
+
 Managed secrets stay in hosted runtimes. For local integration tests, use your
 own test credentials, mocks or an existing governed function. Use a hosted
 preview for application code that needs a managed secret. Never put secrets in

package/dist/templates/nextjs/gitignore

@@ -0,0 +1,9 @@
+node_modules/
+.next/
+next-env.d.ts
+.artifact/
+.artifact-studio/
+.env*
+*.tsbuildinfo
+coverage/
+.DS_Store

package/dist/templates/nextjs/pnpm-workspace.yaml

@@ -2,7 +2,21 @@ packages:
   - '.'
 
 minimumReleaseAge: 10080
+# The Sequence SDK chain is published from the Studio repo's audited release
+# pipeline, so a new artifact-studio release must install without waiting out
+# the seven-day quarantine. Scoped to the exact first-party packages a fresh
+# scaffold resolves, not @sequenceholdings/*.
+minimumReleaseAgeExclude:
+  - '@sequenceholdings/artifact-studio'
+  - '@sequenceholdings/atlas-ui'
+  - '@sequenceholdings/custom-roles-manifest'
+  - '@sequenceholdings/lattice-form-renderer'
+  - '@sequenceholdings/orm'
+  - '@sequenceholdings/storage'
 strictDepBuilds: true
 allowBuilds:
   '@tailwindcss/oxide': false
+  # Reached through the SDK's static builder and ORM tooling, never run by a
+  # Next.js app; its platform binary installs as an optional dependency.
+  esbuild: false
   sharp: false

package/dist/trusted-install.js

@@ -1,5 +1,6 @@
 import { readFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
+import { load as parseYaml } from 'js-yaml';
 import { classifyLockfileOrigin } from './lockfile-origin.js';
 export class ArtifactInstallTrustError extends Error {
     name = 'ArtifactInstallTrustError';
@@ -20,6 +21,21 @@ const ALLOWED_TARBALL_PREFIXES = [
     'https://libraries.cgr.dev/javascript/',
     'https://libraries.cgr.dev/javascript-upstream/',
 ];
+/**
+ * Exact off-registry tarballs remote installs accept, each tied to one
+ * dependency name and one integrity hash the lockfile must pin. SheetJS ships
+ * 0.20.x only from its CDN; the registry stops at 0.18.5, which has known
+ * parser vulnerabilities.
+ */
+const PINNED_TARBALLS = new Map([
+    [
+        'https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz',
+        {
+            name: 'xlsx',
+            integrity: 'sha512-oLDq3jw7AcLqKWH2AhCpVTZl8mf6X2YReP+Neh0SJUzV/BdZYjth94tG5toiMB1PPrYtxOCfaoUCkvtuH+3AJA==',
+        },
+    ],
+]);
 const EXCLUDED_DIRS = new Set(['node_modules', '.git']);
 /** Platform peers the CLI aliases at build time — must not be prod-installed remotely. */
 export const REMOTE_INSTALL_PLATFORM_PACKAGES = new Set([
@@ -73,10 +89,15 @@ function assertNoPackageManagerSelection(pkg) {
         }
     }
 }
-function assertRegistryOnlySpecMap(map, label) {
+function isPinnedTarballSpec(name, spec) {
+    return typeof spec === 'string' && PINNED_TARBALLS.get(spec)?.name === name;
+}
+function assertRegistryOnlySpecMap(map, label, { allowPinnedTarballs = false } = {}) {
     if (!map || typeof map !== 'object')
         return;
     for (const [name, spec] of Object.entries(map)) {
+        if (allowPinnedTarballs && isPinnedTarballSpec(name, spec))
+            continue;
         if (isNonRegistrySpec(spec)) {
             throw new ArtifactInstallTrustError(`${label} "${name}" uses a non-registry spec ("${String(spec)}") — only registry semver ranges are allowed`);
         }
@@ -114,7 +135,7 @@ function assertRegistryOnlyPackageJson(dir) {
         throw new ArtifactInstallTrustError('package.json is not valid JSON');
     }
     for (const section of DEPENDENCY_SECTIONS) {
-        assertRegistryOnlySpecMap(pkg[section], 'Dependency');
+        assertRegistryOnlySpecMap(pkg[section], 'Dependency', { allowPinnedTarballs: true });
     }
     assertRegistryOnlySpecMap(pkg.resolutions, 'Resolution override');
     assertNoPackageManagerSelection(pkg);
@@ -148,6 +169,42 @@ function normalizeYamlScalar(raw) {
     }
     return trimmed;
 }
+/**
+ * Check resolved `packages` entries, not lockfile text, so a comment or a YAML
+ * form the text scan misses cannot stand in for a real resolution.
+ */
+function assertParsedPackageResolutions(lockfileText) {
+    let doc;
+    try {
+        doc = parseYaml(lockfileText);
+    }
+    catch {
+        throw new ArtifactInstallTrustError('pnpm-lock.yaml is not valid YAML');
+    }
+    const packages = doc && typeof doc === 'object' ? doc.packages : undefined;
+    if (!packages || typeof packages !== 'object')
+        return;
+    for (const [key, entry] of Object.entries(packages)) {
+        const resolution = entry && typeof entry === 'object'
+            ? entry.resolution
+            : undefined;
+        if (!resolution || typeof resolution !== 'object')
+            continue;
+        const { tarball, integrity } = resolution;
+        if (typeof tarball !== 'string')
+            continue;
+        const pinned = PINNED_TARBALLS.get(tarball);
+        if (pinned) {
+            if (!key.startsWith(`${pinned.name}@`) || integrity !== pinned.integrity) {
+                throw new ArtifactInstallTrustError(`pnpm-lock.yaml must pin integrity ${pinned.integrity} for ${pinned.name} from ${tarball} — regenerate the lockfile`);
+            }
+            continue;
+        }
+        if (!ALLOWED_TARBALL_PREFIXES.some((prefix) => tarball.startsWith(prefix))) {
+            throw new ArtifactInstallTrustError(`pnpm-lock.yaml tarball resolution "${tarball}" is not from the Chainguard registry`);
+        }
+    }
+}
 function assertChainguardLockfile(dir) {
     const lockfileText = readFileSync(join(dir, 'pnpm-lock.yaml'), 'utf8');
     if (classifyLockfileOrigin(lockfileText) !== 'chainguard') {
@@ -159,10 +216,13 @@ function assertChainguardLockfile(dir) {
     }
     for (const match of lockfileText.matchAll(LOCKFILE_TARBALL_RE)) {
         const tarball = normalizeYamlScalar(match[2] ?? '');
+        if (PINNED_TARBALLS.has(tarball))
+            continue;
         if (!ALLOWED_TARBALL_PREFIXES.some((prefix) => tarball.startsWith(prefix))) {
             throw new ArtifactInstallTrustError(`pnpm-lock.yaml tarball resolution "${tarball}" is not from the Chainguard registry`);
         }
     }
+    assertParsedPackageResolutions(lockfileText);
 }
 /**
  * Reject install-control files and non-registry dependency specs before a remote

package/dist/tunnel/broker.js

@@ -1,9 +1,15 @@
 import { WebSocketServer } from 'ws';
 import { TunnelPeer, tunnelLimits } from './peer.js';
-import { assertSafeRequest, encodeTunnelFrame, normalizePublicOrigin, sanitizeRequestHeaders, sanitizeResponseHeaders, TUNNEL_PROTOCOL } from './protocol.js';
+import { assertSafeRequest, encodeTunnelFrame, isSharedCacheDirective, normalizePublicOrigin, sanitizeRequestHeaders, sanitizeResponseHeaders, SHARED_CACHE_REFUSAL, TUNNEL_PROTOCOL } from './protocol.js';
 import { forwardWebSocketMessages, MessageBudget, permittedCloseCode, sendWebSocket, WebSocketMessage, writeChunk } from './io.js';
+const UPGRADE_REASONS = { 403: 'Forbidden', 429: 'Too Many Requests', 503: 'Service Unavailable' };
 function rejectUpgrade(socket, status) {
-    socket.end(`HTTP/1.1 ${status} ${status === 403 ? 'Forbidden' : 'Service Unavailable'}\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`);
+    socket.end(`HTTP/1.1 ${status} ${UPGRADE_REASONS[status] ?? 'Service Unavailable'}\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`);
+}
+/** Admission refusals keep their status so clients back off; anything else is an authorization failure. */
+function upgradeFailureStatus(error) {
+    const status = typeof error === 'object' && error !== null && 'status' in error ? error.status : undefined;
+    return status === 429 || status === 503 ? status : 403;
 }
 function rejectHttp(response, status) {
     if (response.headersSent) {
@@ -13,6 +19,29 @@ function rejectHttp(response, status) {
     response.writeHead(status, { 'cache-control': 'no-store', 'content-type': 'application/json' });
     response.end(JSON.stringify({ error: status === 403 ? 'Preview access denied' : 'Development server unavailable' }));
 }
+/** A development process cannot relax the gateway's embedding, response or cache policy. */
+function developmentResponseHeaders({ response, headers }) {
+    // Multiple CSP policies are intersected by browsers, preserving app CSP.
+    const platformCsp = response.getHeader('content-security-policy');
+    const applicationCsp = headers['content-security-policy'];
+    if (platformCsp)
+        headers['content-security-policy'] = [
+            ...(Array.isArray(platformCsp) ? platformCsp : [String(platformCsp)]),
+            ...(applicationCsp === undefined ? [] : Array.isArray(applicationCsp) ? applicationCsp : [applicationCsp]),
+        ];
+    for (const name of ['x-content-type-options', 'referrer-policy']) {
+        const value = response.getHeader(name);
+        if (value !== undefined)
+            headers[name] = String(value);
+    }
+    // The hosted rule: no CDN or proxy may reuse the output without passing authorization again.
+    for (const name of Object.keys(headers))
+        if (isSharedCacheDirective(name))
+            delete headers[name];
+    Object.assign(headers, { 'cache-control': 'no-store', ...SHARED_CACHE_REFUSAL });
+    preserveGatewayCookies({ response, headers });
+    return headers;
+}
 function preserveGatewayCookies({ response, headers }) {
     const gateway = response.getHeader('set-cookie');
     const application = headers['set-cookie'];
@@ -112,8 +141,8 @@ export class ArtifactTunnelBroker {
             });
             socket.resume();
         }
-        catch {
-            rejectUpgrade(socket, 403);
+        catch (error) {
+            rejectUpgrade(socket, upgradeFailureStatus(error));
             if (claimed && lease)
                 await this.options.routing.release(lease.sessionId, lease.epoch, this.options.nodeId).catch(() => undefined);
         }
@@ -304,24 +333,7 @@ export class ArtifactTunnelBroker {
             if (!stream.response || stream.receivedHeaders)
                 throw new Error('Unexpected response');
             stream.receivedHeaders = true;
-            const headers = sanitizeResponseHeaders(frame.headers);
-            // A development process cannot relax the gateway's embedding policy.
-            // Multiple CSP policies are intersected by browsers, preserving app CSP.
-            const platformCsp = stream.response.getHeader('content-security-policy');
-            const applicationCsp = headers['content-security-policy'];
-            if (platformCsp)
-                headers['content-security-policy'] = [
-                    ...(Array.isArray(platformCsp) ? platformCsp : [String(platformCsp)]),
-                    ...(applicationCsp === undefined ? [] : Array.isArray(applicationCsp) ? applicationCsp : [applicationCsp]),
-                ];
-            for (const name of ['x-content-type-options', 'referrer-policy']) {
-                const value = stream.response.getHeader(name);
-                if (value !== undefined)
-                    headers[name] = String(value);
-            }
-            headers['cache-control'] = 'no-store';
-            preserveGatewayCookies({ response: stream.response, headers });
-            stream.response.writeHead(frame.status, headers);
+            stream.response.writeHead(frame.status, developmentResponseHeaders({ response: stream.response, headers: sanitizeResponseHeaders(frame.headers) }));
             return;
         }
         if (frame.type === 'data') {

package/dist/tunnel/protocol.d.ts

@@ -65,5 +65,14 @@ export declare function encodeTunnelFrame(frame: TunnelFrame): string;
 export declare function normalizePublicOrigin(value: string): string;
 /** Rebuild trusted routing headers; no Atlas bearer/session crosses into app code. */
 export declare function sanitizeRequestHeaders(headers: HeaderInput, publicOrigin: string): TunnelHeaders;
+/** Response headers through which application output could opt into CDN or proxy reuse. */
+export declare function isSharedCacheDirective(name: string): boolean;
+/** Sent in their place on every protected response, so each reuse must pass gateway authorization again. */
+export declare const SHARED_CACHE_REFUSAL: Readonly<{
+    'cdn-cache-control': "no-store";
+    'surrogate-control': "no-store";
+    pragma: "no-cache";
+    expires: "0";
+}>;
 export declare function sanitizeResponseHeaders(headers: HeaderInput): TunnelHeaders;
 export {};

package/dist/tunnel/protocol.js

@@ -26,21 +26,29 @@ const HOP_HEADERS = new Set([
     'proxy-connection', 'te', 'trailer', 'transfer-encoding', 'upgrade',
     'content-length', 'expect',
 ]);
-const headerValueSchema = z.string().max(8192).regex(HEADER_VALUE);
-const headersSchema = z.record(z.string().max(256).regex(HEADER_TOKEN), z.union([headerValueSchema, z.array(headerValueSchema).min(1).max(32)])).superRefine((headers, context) => {
-    const names = new Set();
-    let bytes = 0;
-    for (const [name, value] of Object.entries(headers)) {
-        if (names.has(name.toLowerCase())) {
-            context.addIssue({ code: 'custom', message: 'Duplicate case-insensitive header' });
+const MAX_HEADER_BYTES = 32 * 1024;
+function headerMapSchema({ maxValueLength }) {
+    const value = z.string().max(maxValueLength).regex(HEADER_VALUE);
+    return z.record(z.string().max(256).regex(HEADER_TOKEN), z.union([value, z.array(value).min(1).max(32)])).superRefine((headers, context) => {
+        const names = new Set();
+        let bytes = 0;
+        for (const [name, value] of Object.entries(headers)) {
+            if (names.has(name.toLowerCase())) {
+                context.addIssue({ code: 'custom', message: 'Duplicate case-insensitive header' });
+            }
+            names.add(name.toLowerCase());
+            bytes += Buffer.byteLength(name) + Buffer.byteLength(Array.isArray(value) ? value.join(',') : value);
         }
-        names.add(name.toLowerCase());
-        bytes += Buffer.byteLength(name) + Buffer.byteLength(Array.isArray(value) ? value.join(',') : value);
-    }
-    if (names.size > 128 || bytes > 32 * 1024) {
-        context.addIssue({ code: 'custom', message: 'Tunnel headers exceed their size limit' });
-    }
-});
+        if (names.size > 128 || bytes > MAX_HEADER_BYTES) {
+            context.addIssue({ code: 'custom', message: 'Tunnel headers exceed their size limit' });
+        }
+    });
+}
+// A frame carries the gateway's signed request context, which the hosted proxy accepts up to 16 KiB.
+const headersSchema = headerMapSchema({ maxValueLength: 16 * 1024 });
+// A browser request still holds the gateway's own session cookies, which are removed before any
+// frame is built, so they must not use up the application's per-value allowance.
+const browserRequestHeadersSchema = headerMapSchema({ maxValueLength: MAX_HEADER_BYTES });
 /** Enforce origin-form paths before a URL parser can reinterpret a destination. */
 export function assertSafeRequest(method, path) {
     if (!METHODS.has(method))
@@ -125,9 +133,9 @@ export function normalizePublicOrigin(value) {
         throw new Error('Tunnel public origin must be an HTTPS origin or HTTP loopback origin');
     return url.origin;
 }
-function normalizedHeaders(headers) {
+function normalizedHeaders(headers, schema = headersSchema) {
     const present = Object.fromEntries(Object.entries(headers).filter(([, value]) => value !== undefined));
-    return new Map(Object.entries(headersSchema.parse(present)).map(([name, value]) => [name.toLowerCase(), value]));
+    return new Map(Object.entries(schema.parse(present)).map(([name, value]) => [name.toLowerCase(), value]));
 }
 function removePrivateHeaders(headers) {
     const connection = headers.get('connection');
@@ -144,7 +152,7 @@ function removePrivateHeaders(headers) {
 /** Rebuild trusted routing headers; no Atlas bearer/session crosses into app code. */
 export function sanitizeRequestHeaders(headers, publicOrigin) {
     const origin = normalizePublicOrigin(publicOrigin);
-    const normalized = normalizedHeaders(headers);
+    const normalized = normalizedHeaders(headers, browserRequestHeadersSchema);
     const suppliedOrigin = normalized.get('origin');
     if (suppliedOrigin !== undefined && suppliedOrigin !== origin)
         throw new Error('Tunnel request origin mismatch');
@@ -180,6 +188,12 @@ function constrainCookie(cookie) {
     return [assignment.trim(), ...attributes.map((attribute) => attribute.trim())
             .filter((attribute) => attribute && attribute.split('=', 1)[0].trim().toLowerCase() !== 'domain')].join('; ');
 }
+/** Response headers through which application output could opt into CDN or proxy reuse. */
+export function isSharedCacheDirective(name) {
+    return /(?:^|-)cdn-cache-control$/.test(name) || ['surrogate-control', 'x-accel-expires', 'expires', 'age'].includes(name);
+}
+/** Sent in their place on every protected response, so each reuse must pass gateway authorization again. */
+export const SHARED_CACHE_REFUSAL = Object.freeze({ 'cdn-cache-control': 'no-store', 'surrogate-control': 'no-store', pragma: 'no-cache', expires: '0' });
 export function sanitizeResponseHeaders(headers) {
     const normalized = normalizedHeaders(headers);
     removePrivateHeaders(normalized);

package/dist/tunnel/redis-auth.d.ts

@@ -0,0 +1,37 @@
+import { type Envelope } from './redis-types.js';
+/** Frames older (or further in the future) than this are replays or come from a stalled node. */
+export declare const RELAY_FRAME_MAX_AGE_MS = 30000;
+/** An envelope quotes a frame as a JSON string: at most double its size, plus fixed fields and the MAC. */
+export declare const RELAY_MESSAGE_MAX_BYTES: number;
+/**
+ * The relay's frame key: an HKDF-SHA256 subkey of the gateway-only session key, bound to one
+ * environment. Atlas and every other Redis client lack that key, so they cannot forge frames, and
+ * the session key itself is never used as a MAC key for anything but cookies.
+ */
+export declare function deriveRelayFrameKey({ secret, namespace }: {
+    secret: string;
+    namespace: string;
+}): Buffer;
+/**
+ * Authenticates relay messages: the MAC binds the destination channel, so a captured frame cannot be
+ * redirected to another node, and each source's strictly increasing sequence plus a freshness window
+ * rejects replays. A single publisher connection per node keeps Redis delivery in sequence order.
+ */
+export declare class RelayFrameAuthenticator {
+    private readonly key;
+    private readonly now;
+    private sequence;
+    private readonly peers;
+    constructor(key: Buffer, now?: () => number);
+    seal({ channel, envelope }: {
+        channel: string;
+        envelope: Envelope;
+    }): string;
+    /** Null for any frame that is oversized, unauthenticated, stale, replayed or malformed. */
+    open({ channel, message }: {
+        channel: string;
+        message: string;
+    }): Envelope | null;
+    /** Forgotten peers can only send frames newer than the freshness window, which rejects replays. */
+    private forgetIdlePeers;
+}

package/dist/tunnel/redis-auth.js

@@ -0,0 +1,92 @@
+import { createHmac, hkdfSync, timingSafeEqual } from 'node:crypto';
+import { z } from 'zod';
+import { DEFAULT_TUNNEL_LIMITS } from './protocol.js';
+import { envelopeSchema } from './redis-types.js';
+const WIRE_VERSION = 'v1';
+/** Frames older (or further in the future) than this are replays or come from a stalled node. */
+export const RELAY_FRAME_MAX_AGE_MS = 30_000;
+/** An envelope quotes a frame as a JSON string: at most double its size, plus fixed fields and the MAC. */
+export const RELAY_MESSAGE_MAX_BYTES = DEFAULT_TUNNEL_LIMITS.maxFrameBytes * 2 + 4096;
+const PEER_RETENTION_MS = RELAY_FRAME_MAX_AGE_MS * 4;
+const MAX_TRACKED_PEERS = 1024;
+const wireSchema = z.object({
+    sequence: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+    sentAt: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+    envelope: envelopeSchema,
+}).strict();
+/**
+ * The relay's frame key: an HKDF-SHA256 subkey of the gateway-only session key, bound to one
+ * environment. Atlas and every other Redis client lack that key, so they cannot forge frames, and
+ * the session key itself is never used as a MAC key for anything but cookies.
+ */
+export function deriveRelayFrameKey({ secret, namespace }) {
+    if (Buffer.byteLength(secret) < 32)
+        throw new Error('Tunnel relay authentication requires a gateway secret of at least 32 bytes');
+    return Buffer.from(hkdfSync('sha256', secret, 'atlas-artifact-next', `artifact-next/tunnel-relay/v1:${namespace}`, 32));
+}
+function mac({ key, channel, body }) {
+    return createHmac('sha256', key).update(`${WIRE_VERSION}\n${channel}\n${body}`).digest();
+}
+/**
+ * Authenticates relay messages: the MAC binds the destination channel, so a captured frame cannot be
+ * redirected to another node, and each source's strictly increasing sequence plus a freshness window
+ * rejects replays. A single publisher connection per node keeps Redis delivery in sequence order.
+ */
+export class RelayFrameAuthenticator {
+    key;
+    now;
+    sequence = 0;
+    peers = new Map();
+    constructor(key, now = Date.now) {
+        this.key = key;
+        this.now = now;
+        if (key.length !== 32)
+            throw new Error('Invalid tunnel relay frame key');
+    }
+    seal({ channel, envelope }) {
+        const body = JSON.stringify({ sequence: ++this.sequence, sentAt: this.now(), envelope });
+        return `${WIRE_VERSION}.${mac({ key: this.key, channel, body }).toString('base64url')}.${body}`;
+    }
+    /** Null for any frame that is oversized, unauthenticated, stale, replayed or malformed. */
+    open({ channel, message }) {
+        if (Buffer.byteLength(message) > RELAY_MESSAGE_MAX_BYTES || !message.startsWith(`${WIRE_VERSION}.`))
+            return null;
+        const separator = message.indexOf('.', WIRE_VERSION.length + 1);
+        if (separator < 0)
+            return null;
+        const signature = message.slice(WIRE_VERSION.length + 1, separator), body = message.slice(separator + 1);
+        if (!/^[A-Za-z0-9_-]{43}$/.test(signature))
+            return null;
+        const expected = mac({ key: this.key, channel, body }), actual = Buffer.from(signature, 'base64url');
+        if (actual.length !== expected.length || !timingSafeEqual(actual, expected))
+            return null;
+        let wire;
+        try {
+            wire = wireSchema.parse(JSON.parse(body));
+        }
+        catch {
+            return null;
+        }
+        const now = this.now();
+        if (Math.abs(now - wire.sentAt) > RELAY_FRAME_MAX_AGE_MS)
+            return null;
+        const source = wire.envelope.source;
+        const peer = this.peers.get(source);
+        if (peer && wire.sequence <= peer.sequence)
+            return null;
+        this.peers.delete(source);
+        this.peers.set(source, { sequence: wire.sequence, seenAt: now });
+        this.forgetIdlePeers(now);
+        return wire.envelope;
+    }
+    /** Forgotten peers can only send frames newer than the freshness window, which rejects replays. */
+    forgetIdlePeers(now) {
+        if (this.peers.size <= MAX_TRACKED_PEERS)
+            return;
+        for (const [source, peer] of this.peers) {
+            if (now - peer.seenAt <= PEER_RETENTION_MS)
+                break;
+            this.peers.delete(source);
+        }
+    }
+}

package/dist/tunnel/redis-types.d.ts

@@ -67,4 +67,9 @@ export interface RedisTunnelRelayOptions {
     publisher: RedisTunnelPublisher;
     subscriber: RedisTunnelSubscriber;
     connectTimeoutMs?: number;
+    /** Gateway-only key material shared by every replica (the session key). Frames are authenticated
+     * with an HKDF subkey of it; the value itself never leaves the process. */
+    secret: string;
+    /** Called for each relay message dropped as unauthenticated, stale, replayed or oversized. */
+    onRejectedFrame?: () => void;
 }