@sequenceholdings/artifact-studio 0.3.0 → 0.4.0

package/dist/trusted-install.js

@@ -1,5 +1,6 @@
 import { readFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
+import { load as parseYaml } from 'js-yaml';
 import { classifyLockfileOrigin } from './lockfile-origin.js';
 export class ArtifactInstallTrustError extends Error {
     name = 'ArtifactInstallTrustError';
@@ -20,6 +21,21 @@ const ALLOWED_TARBALL_PREFIXES = [
     'https://libraries.cgr.dev/javascript/',
     'https://libraries.cgr.dev/javascript-upstream/',
 ];
+/**
+ * Exact off-registry tarballs remote installs accept, each tied to one
+ * dependency name and one integrity hash the lockfile must pin. SheetJS ships
+ * 0.20.x only from its CDN; the registry stops at 0.18.5, which has known
+ * parser vulnerabilities.
+ */
+const PINNED_TARBALLS = new Map([
+    [
+        'https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz',
+        {
+            name: 'xlsx',
+            integrity: 'sha512-oLDq3jw7AcLqKWH2AhCpVTZl8mf6X2YReP+Neh0SJUzV/BdZYjth94tG5toiMB1PPrYtxOCfaoUCkvtuH+3AJA==',
+        },
+    ],
+]);
 const EXCLUDED_DIRS = new Set(['node_modules', '.git']);
 /** Platform peers the CLI aliases at build time — must not be prod-installed remotely. */
 export const REMOTE_INSTALL_PLATFORM_PACKAGES = new Set([
@@ -73,10 +89,15 @@ function assertNoPackageManagerSelection(pkg) {
         }
     }
 }
-function assertRegistryOnlySpecMap(map, label) {
+function isPinnedTarballSpec(name, spec) {
+    return typeof spec === 'string' && PINNED_TARBALLS.get(spec)?.name === name;
+}
+function assertRegistryOnlySpecMap(map, label, { allowPinnedTarballs = false } = {}) {
     if (!map || typeof map !== 'object')
         return;
     for (const [name, spec] of Object.entries(map)) {
+        if (allowPinnedTarballs && isPinnedTarballSpec(name, spec))
+            continue;
         if (isNonRegistrySpec(spec)) {
             throw new ArtifactInstallTrustError(`${label} "${name}" uses a non-registry spec ("${String(spec)}") — only registry semver ranges are allowed`);
         }
@@ -114,7 +135,7 @@ function assertRegistryOnlyPackageJson(dir) {
         throw new ArtifactInstallTrustError('package.json is not valid JSON');
     }
     for (const section of DEPENDENCY_SECTIONS) {
-        assertRegistryOnlySpecMap(pkg[section], 'Dependency');
+        assertRegistryOnlySpecMap(pkg[section], 'Dependency', { allowPinnedTarballs: true });
     }
     assertRegistryOnlySpecMap(pkg.resolutions, 'Resolution override');
     assertNoPackageManagerSelection(pkg);
@@ -148,6 +169,42 @@ function normalizeYamlScalar(raw) {
     }
     return trimmed;
 }
+/**
+ * Check resolved `packages` entries, not lockfile text, so a comment or a YAML
+ * form the text scan misses cannot stand in for a real resolution.
+ */
+function assertParsedPackageResolutions(lockfileText) {
+    let doc;
+    try {
+        doc = parseYaml(lockfileText);
+    }
+    catch {
+        throw new ArtifactInstallTrustError('pnpm-lock.yaml is not valid YAML');
+    }
+    const packages = doc && typeof doc === 'object' ? doc.packages : undefined;
+    if (!packages || typeof packages !== 'object')
+        return;
+    for (const [key, entry] of Object.entries(packages)) {
+        const resolution = entry && typeof entry === 'object'
+            ? entry.resolution
+            : undefined;
+        if (!resolution || typeof resolution !== 'object')
+            continue;
+        const { tarball, integrity } = resolution;
+        if (typeof tarball !== 'string')
+            continue;
+        const pinned = PINNED_TARBALLS.get(tarball);
+        if (pinned) {
+            if (!key.startsWith(`${pinned.name}@`) || integrity !== pinned.integrity) {
+                throw new ArtifactInstallTrustError(`pnpm-lock.yaml must pin integrity ${pinned.integrity} for ${pinned.name} from ${tarball} — regenerate the lockfile`);
+            }
+            continue;
+        }
+        if (!ALLOWED_TARBALL_PREFIXES.some((prefix) => tarball.startsWith(prefix))) {
+            throw new ArtifactInstallTrustError(`pnpm-lock.yaml tarball resolution "${tarball}" is not from the Chainguard registry`);
+        }
+    }
+}
 function assertChainguardLockfile(dir) {
     const lockfileText = readFileSync(join(dir, 'pnpm-lock.yaml'), 'utf8');
     if (classifyLockfileOrigin(lockfileText) !== 'chainguard') {
@@ -159,10 +216,13 @@ function assertChainguardLockfile(dir) {
     }
     for (const match of lockfileText.matchAll(LOCKFILE_TARBALL_RE)) {
         const tarball = normalizeYamlScalar(match[2] ?? '');
+        if (PINNED_TARBALLS.has(tarball))
+            continue;
         if (!ALLOWED_TARBALL_PREFIXES.some((prefix) => tarball.startsWith(prefix))) {
             throw new ArtifactInstallTrustError(`pnpm-lock.yaml tarball resolution "${tarball}" is not from the Chainguard registry`);
         }
     }
+    assertParsedPackageResolutions(lockfileText);
 }
 /**
  * Reject install-control files and non-registry dependency specs before a remote

package/dist/tunnel/broker.js

@@ -1,9 +1,15 @@
 import { WebSocketServer } from 'ws';
 import { TunnelPeer, tunnelLimits } from './peer.js';
-import { assertSafeRequest, encodeTunnelFrame, normalizePublicOrigin, sanitizeRequestHeaders, sanitizeResponseHeaders, TUNNEL_PROTOCOL } from './protocol.js';
+import { assertSafeRequest, encodeTunnelFrame, isSharedCacheDirective, normalizePublicOrigin, sanitizeRequestHeaders, sanitizeResponseHeaders, SHARED_CACHE_REFUSAL, TUNNEL_PROTOCOL } from './protocol.js';
 import { forwardWebSocketMessages, MessageBudget, permittedCloseCode, sendWebSocket, WebSocketMessage, writeChunk } from './io.js';
+const UPGRADE_REASONS = { 403: 'Forbidden', 429: 'Too Many Requests', 503: 'Service Unavailable' };
 function rejectUpgrade(socket, status) {
-    socket.end(`HTTP/1.1 ${status} ${status === 403 ? 'Forbidden' : 'Service Unavailable'}\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`);
+    socket.end(`HTTP/1.1 ${status} ${UPGRADE_REASONS[status] ?? 'Service Unavailable'}\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`);
+}
+/** Admission refusals keep their status so clients back off; anything else is an authorization failure. */
+function upgradeFailureStatus(error) {
+    const status = typeof error === 'object' && error !== null && 'status' in error ? error.status : undefined;
+    return status === 429 || status === 503 ? status : 403;
 }
 function rejectHttp(response, status) {
     if (response.headersSent) {
@@ -13,6 +19,29 @@ function rejectHttp(response, status) {
     response.writeHead(status, { 'cache-control': 'no-store', 'content-type': 'application/json' });
     response.end(JSON.stringify({ error: status === 403 ? 'Preview access denied' : 'Development server unavailable' }));
 }
+/** A development process cannot relax the gateway's embedding, response or cache policy. */
+function developmentResponseHeaders({ response, headers }) {
+    // Multiple CSP policies are intersected by browsers, preserving app CSP.
+    const platformCsp = response.getHeader('content-security-policy');
+    const applicationCsp = headers['content-security-policy'];
+    if (platformCsp)
+        headers['content-security-policy'] = [
+            ...(Array.isArray(platformCsp) ? platformCsp : [String(platformCsp)]),
+            ...(applicationCsp === undefined ? [] : Array.isArray(applicationCsp) ? applicationCsp : [applicationCsp]),
+        ];
+    for (const name of ['x-content-type-options', 'referrer-policy']) {
+        const value = response.getHeader(name);
+        if (value !== undefined)
+            headers[name] = String(value);
+    }
+    // The hosted rule: no CDN or proxy may reuse the output without passing authorization again.
+    for (const name of Object.keys(headers))
+        if (isSharedCacheDirective(name))
+            delete headers[name];
+    Object.assign(headers, { 'cache-control': 'no-store', ...SHARED_CACHE_REFUSAL });
+    preserveGatewayCookies({ response, headers });
+    return headers;
+}
 function preserveGatewayCookies({ response, headers }) {
     const gateway = response.getHeader('set-cookie');
     const application = headers['set-cookie'];
@@ -112,8 +141,8 @@ export class ArtifactTunnelBroker {
             });
             socket.resume();
         }
-        catch {
-            rejectUpgrade(socket, 403);
+        catch (error) {
+            rejectUpgrade(socket, upgradeFailureStatus(error));
             if (claimed && lease)
                 await this.options.routing.release(lease.sessionId, lease.epoch, this.options.nodeId).catch(() => undefined);
         }
@@ -304,24 +333,7 @@ export class ArtifactTunnelBroker {
             if (!stream.response || stream.receivedHeaders)
                 throw new Error('Unexpected response');
             stream.receivedHeaders = true;
-            const headers = sanitizeResponseHeaders(frame.headers);
-            // A development process cannot relax the gateway's embedding policy.
-            // Multiple CSP policies are intersected by browsers, preserving app CSP.
-            const platformCsp = stream.response.getHeader('content-security-policy');
-            const applicationCsp = headers['content-security-policy'];
-            if (platformCsp)
-                headers['content-security-policy'] = [
-                    ...(Array.isArray(platformCsp) ? platformCsp : [String(platformCsp)]),
-                    ...(applicationCsp === undefined ? [] : Array.isArray(applicationCsp) ? applicationCsp : [applicationCsp]),
-                ];
-            for (const name of ['x-content-type-options', 'referrer-policy']) {
-                const value = stream.response.getHeader(name);
-                if (value !== undefined)
-                    headers[name] = String(value);
-            }
-            headers['cache-control'] = 'no-store';
-            preserveGatewayCookies({ response: stream.response, headers });
-            stream.response.writeHead(frame.status, headers);
+            stream.response.writeHead(frame.status, developmentResponseHeaders({ response: stream.response, headers: sanitizeResponseHeaders(frame.headers) }));
             return;
         }
         if (frame.type === 'data') {

package/dist/tunnel/client.js

@@ -3,14 +3,21 @@ import WebSocket from 'ws';
 import { TunnelPeer, tunnelLimits } from './peer.js';
 import { assertSafeRequest, normalizePublicOrigin, parseTunnelFrame, sanitizeRequestHeaders, sanitizeResponseHeaders, TUNNEL_PROTOCOL } from './protocol.js';
 import { forwardWebSocketMessages, MessageBudget, permittedCloseCode, sendWebSocket, WebSocketMessage, writeChunk } from './io.js';
+import { isLoopbackHostname } from '../loopback.js';
 /** One connection/epoch only. The caller obtains a fresh lease to reconnect;
  * no HTTP request or mutation is ever retained or replayed. */
 export async function connectLocalTunnel(options) {
     const endpoint = new URL(options.url);
-    const insecureLocal = endpoint.protocol === 'ws:' && ['127.0.0.1', '[::1]', 'localhost'].includes(endpoint.hostname) && options.allowInsecureLoopback;
+    const insecureLocal = endpoint.protocol === 'ws:' && isLoopbackHostname(endpoint.hostname) && options.allowInsecureLoopback;
     if ((endpoint.protocol !== 'wss:' && !insecureLocal) || endpoint.username || endpoint.password || endpoint.hash) {
         throw new Error('Tunnel endpoint must use authenticated WSS');
     }
+    // A cleartext tunnel carries the bearer credential, so a localhost name is dialed at the loopback
+    // address browsers use for it, never through a resolver that could route it elsewhere. The Host
+    // header keeps the name the gateway validates.
+    const dial = new URL(endpoint);
+    if (insecureLocal && !['127.0.0.1', '[::1]'].includes(endpoint.hostname))
+        dial.hostname = '127.0.0.1';
     if (!Number.isSafeInteger(options.localPort) || options.localPort < 1 || options.localPort > 65535)
         throw new Error('Invalid loopback port');
     if (!Number.isSafeInteger(options.epoch) || options.epoch < 1 || !options.sessionId || !options.token || /[\r\n]/.test(options.token))
@@ -18,8 +25,8 @@ export async function connectLocalTunnel(options) {
     const publicOrigin = normalizePublicOrigin(options.publicOrigin);
     const limits = tunnelLimits(options.limits);
     options.signal?.throwIfAborted();
-    const socket = new WebSocket(endpoint, [TUNNEL_PROTOCOL], {
-        headers: { authorization: `Bearer ${options.token}`, 'x-artifact-session-id': options.sessionId, 'x-artifact-tunnel-epoch': String(options.epoch) },
+    const socket = new WebSocket(dial, [TUNNEL_PROTOCOL], {
+        headers: { host: endpoint.host, authorization: `Bearer ${options.token}`, 'x-artifact-session-id': options.sessionId, 'x-artifact-tunnel-epoch': String(options.epoch) },
         maxPayload: limits.maxFrameBytes,
         perMessageDeflate: false,
         followRedirects: false,

package/dist/tunnel/protocol.d.ts

@@ -65,5 +65,14 @@ export declare function encodeTunnelFrame(frame: TunnelFrame): string;
 export declare function normalizePublicOrigin(value: string): string;
 /** Rebuild trusted routing headers; no Atlas bearer/session crosses into app code. */
 export declare function sanitizeRequestHeaders(headers: HeaderInput, publicOrigin: string): TunnelHeaders;
+/** Response headers through which application output could opt into CDN or proxy reuse. */
+export declare function isSharedCacheDirective(name: string): boolean;
+/** Sent in their place on every protected response, so each reuse must pass gateway authorization again. */
+export declare const SHARED_CACHE_REFUSAL: Readonly<{
+    'cdn-cache-control': "no-store";
+    'surrogate-control': "no-store";
+    pragma: "no-cache";
+    expires: "0";
+}>;
 export declare function sanitizeResponseHeaders(headers: HeaderInput): TunnelHeaders;
 export {};

package/dist/tunnel/protocol.js

@@ -1,5 +1,6 @@
 import { Buffer } from 'node:buffer';
 import { z } from 'zod';
+import { isLoopbackHostname } from '../loopback.js';
 /** Version 1 is negotiated by the tunnel connection, not by individual streams. */
 export const TUNNEL_PROTOCOL = 'artifact-tunnel.v1';
 export const DEFAULT_TUNNEL_LIMITS = Object.freeze({
@@ -26,21 +27,29 @@ const HOP_HEADERS = new Set([
     'proxy-connection', 'te', 'trailer', 'transfer-encoding', 'upgrade',
     'content-length', 'expect',
 ]);
-const headerValueSchema = z.string().max(8192).regex(HEADER_VALUE);
-const headersSchema = z.record(z.string().max(256).regex(HEADER_TOKEN), z.union([headerValueSchema, z.array(headerValueSchema).min(1).max(32)])).superRefine((headers, context) => {
-    const names = new Set();
-    let bytes = 0;
-    for (const [name, value] of Object.entries(headers)) {
-        if (names.has(name.toLowerCase())) {
-            context.addIssue({ code: 'custom', message: 'Duplicate case-insensitive header' });
+const MAX_HEADER_BYTES = 32 * 1024;
+function headerMapSchema({ maxValueLength }) {
+    const value = z.string().max(maxValueLength).regex(HEADER_VALUE);
+    return z.record(z.string().max(256).regex(HEADER_TOKEN), z.union([value, z.array(value).min(1).max(32)])).superRefine((headers, context) => {
+        const names = new Set();
+        let bytes = 0;
+        for (const [name, value] of Object.entries(headers)) {
+            if (names.has(name.toLowerCase())) {
+                context.addIssue({ code: 'custom', message: 'Duplicate case-insensitive header' });
+            }
+            names.add(name.toLowerCase());
+            bytes += Buffer.byteLength(name) + Buffer.byteLength(Array.isArray(value) ? value.join(',') : value);
         }
-        names.add(name.toLowerCase());
-        bytes += Buffer.byteLength(name) + Buffer.byteLength(Array.isArray(value) ? value.join(',') : value);
-    }
-    if (names.size > 128 || bytes > 32 * 1024) {
-        context.addIssue({ code: 'custom', message: 'Tunnel headers exceed their size limit' });
-    }
-});
+        if (names.size > 128 || bytes > MAX_HEADER_BYTES) {
+            context.addIssue({ code: 'custom', message: 'Tunnel headers exceed their size limit' });
+        }
+    });
+}
+// A frame carries the gateway's signed request context, which the hosted proxy accepts up to 16 KiB.
+const headersSchema = headerMapSchema({ maxValueLength: 16 * 1024 });
+// A browser request still holds the gateway's own session cookies, which are removed before any
+// frame is built, so they must not use up the application's per-value allowance.
+const browserRequestHeadersSchema = headerMapSchema({ maxValueLength: MAX_HEADER_BYTES });
 /** Enforce origin-form paths before a URL parser can reinterpret a destination. */
 export function assertSafeRequest(method, path) {
     if (!METHODS.has(method))
@@ -119,15 +128,15 @@ export function encodeTunnelFrame(frame) {
 }
 export function normalizePublicOrigin(value) {
     const url = new URL(value);
-    const isLoopback = ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
+    const isLoopback = isLoopbackHostname(url.hostname);
     if (!/^https?:\/\/[^/?#@\\\s]+\/?$/i.test(value) || url.username || url.password || url.search || url.hash ||
         url.pathname !== '/' || (url.protocol !== 'https:' && !(url.protocol === 'http:' && isLoopback)))
         throw new Error('Tunnel public origin must be an HTTPS origin or HTTP loopback origin');
     return url.origin;
 }
-function normalizedHeaders(headers) {
+function normalizedHeaders(headers, schema = headersSchema) {
     const present = Object.fromEntries(Object.entries(headers).filter(([, value]) => value !== undefined));
-    return new Map(Object.entries(headersSchema.parse(present)).map(([name, value]) => [name.toLowerCase(), value]));
+    return new Map(Object.entries(schema.parse(present)).map(([name, value]) => [name.toLowerCase(), value]));
 }
 function removePrivateHeaders(headers) {
     const connection = headers.get('connection');
@@ -144,7 +153,7 @@ function removePrivateHeaders(headers) {
 /** Rebuild trusted routing headers; no Atlas bearer/session crosses into app code. */
 export function sanitizeRequestHeaders(headers, publicOrigin) {
     const origin = normalizePublicOrigin(publicOrigin);
-    const normalized = normalizedHeaders(headers);
+    const normalized = normalizedHeaders(headers, browserRequestHeadersSchema);
     const suppliedOrigin = normalized.get('origin');
     if (suppliedOrigin !== undefined && suppliedOrigin !== origin)
         throw new Error('Tunnel request origin mismatch');
@@ -180,6 +189,12 @@ function constrainCookie(cookie) {
     return [assignment.trim(), ...attributes.map((attribute) => attribute.trim())
             .filter((attribute) => attribute && attribute.split('=', 1)[0].trim().toLowerCase() !== 'domain')].join('; ');
 }
+/** Response headers through which application output could opt into CDN or proxy reuse. */
+export function isSharedCacheDirective(name) {
+    return /(?:^|-)cdn-cache-control$/.test(name) || ['surrogate-control', 'x-accel-expires', 'expires', 'age'].includes(name);
+}
+/** Sent in their place on every protected response, so each reuse must pass gateway authorization again. */
+export const SHARED_CACHE_REFUSAL = Object.freeze({ 'cdn-cache-control': 'no-store', 'surrogate-control': 'no-store', pragma: 'no-cache', expires: '0' });
 export function sanitizeResponseHeaders(headers) {
     const normalized = normalizedHeaders(headers);
     removePrivateHeaders(normalized);

package/dist/tunnel/redis-auth.d.ts

@@ -0,0 +1,37 @@
+import { type Envelope } from './redis-types.js';
+/** Frames older (or further in the future) than this are replays or come from a stalled node. */
+export declare const RELAY_FRAME_MAX_AGE_MS = 30000;
+/** An envelope quotes a frame as a JSON string: at most double its size, plus fixed fields and the MAC. */
+export declare const RELAY_MESSAGE_MAX_BYTES: number;
+/**
+ * The relay's frame key: an HKDF-SHA256 subkey of the gateway-only session key, bound to one
+ * environment. Atlas and every other Redis client lack that key, so they cannot forge frames, and
+ * the session key itself is never used as a MAC key for anything but cookies.
+ */
+export declare function deriveRelayFrameKey({ secret, namespace }: {
+    secret: string;
+    namespace: string;
+}): Buffer;
+/**
+ * Authenticates relay messages: the MAC binds the destination channel, so a captured frame cannot be
+ * redirected to another node, and each source's strictly increasing sequence plus a freshness window
+ * rejects replays. A single publisher connection per node keeps Redis delivery in sequence order.
+ */
+export declare class RelayFrameAuthenticator {
+    private readonly key;
+    private readonly now;
+    private sequence;
+    private readonly peers;
+    constructor(key: Buffer, now?: () => number);
+    seal({ channel, envelope }: {
+        channel: string;
+        envelope: Envelope;
+    }): string;
+    /** Null for any frame that is oversized, unauthenticated, stale, replayed or malformed. */
+    open({ channel, message }: {
+        channel: string;
+        message: string;
+    }): Envelope | null;
+    /** Forgotten peers can only send frames newer than the freshness window, which rejects replays. */
+    private forgetIdlePeers;
+}

package/dist/tunnel/redis-auth.js

@@ -0,0 +1,92 @@
+import { createHmac, hkdfSync, timingSafeEqual } from 'node:crypto';
+import { z } from 'zod';
+import { DEFAULT_TUNNEL_LIMITS } from './protocol.js';
+import { envelopeSchema } from './redis-types.js';
+const WIRE_VERSION = 'v1';
+/** Frames older (or further in the future) than this are replays or come from a stalled node. */
+export const RELAY_FRAME_MAX_AGE_MS = 30_000;
+/** An envelope quotes a frame as a JSON string: at most double its size, plus fixed fields and the MAC. */
+export const RELAY_MESSAGE_MAX_BYTES = DEFAULT_TUNNEL_LIMITS.maxFrameBytes * 2 + 4096;
+const PEER_RETENTION_MS = RELAY_FRAME_MAX_AGE_MS * 4;
+const MAX_TRACKED_PEERS = 1024;
+const wireSchema = z.object({
+    sequence: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+    sentAt: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+    envelope: envelopeSchema,
+}).strict();
+/**
+ * The relay's frame key: an HKDF-SHA256 subkey of the gateway-only session key, bound to one
+ * environment. Atlas and every other Redis client lack that key, so they cannot forge frames, and
+ * the session key itself is never used as a MAC key for anything but cookies.
+ */
+export function deriveRelayFrameKey({ secret, namespace }) {
+    if (Buffer.byteLength(secret) < 32)
+        throw new Error('Tunnel relay authentication requires a gateway secret of at least 32 bytes');
+    return Buffer.from(hkdfSync('sha256', secret, 'atlas-artifact-next', `artifact-next/tunnel-relay/v1:${namespace}`, 32));
+}
+function mac({ key, channel, body }) {
+    return createHmac('sha256', key).update(`${WIRE_VERSION}\n${channel}\n${body}`).digest();
+}
+/**
+ * Authenticates relay messages: the MAC binds the destination channel, so a captured frame cannot be
+ * redirected to another node, and each source's strictly increasing sequence plus a freshness window
+ * rejects replays. A single publisher connection per node keeps Redis delivery in sequence order.
+ */
+export class RelayFrameAuthenticator {
+    key;
+    now;
+    sequence = 0;
+    peers = new Map();
+    constructor(key, now = Date.now) {
+        this.key = key;
+        this.now = now;
+        if (key.length !== 32)
+            throw new Error('Invalid tunnel relay frame key');
+    }
+    seal({ channel, envelope }) {
+        const body = JSON.stringify({ sequence: ++this.sequence, sentAt: this.now(), envelope });
+        return `${WIRE_VERSION}.${mac({ key: this.key, channel, body }).toString('base64url')}.${body}`;
+    }
+    /** Null for any frame that is oversized, unauthenticated, stale, replayed or malformed. */
+    open({ channel, message }) {
+        if (Buffer.byteLength(message) > RELAY_MESSAGE_MAX_BYTES || !message.startsWith(`${WIRE_VERSION}.`))
+            return null;
+        const separator = message.indexOf('.', WIRE_VERSION.length + 1);
+        if (separator < 0)
+            return null;
+        const signature = message.slice(WIRE_VERSION.length + 1, separator), body = message.slice(separator + 1);
+        if (!/^[A-Za-z0-9_-]{43}$/.test(signature))
+            return null;
+        const expected = mac({ key: this.key, channel, body }), actual = Buffer.from(signature, 'base64url');
+        if (actual.length !== expected.length || !timingSafeEqual(actual, expected))
+            return null;
+        let wire;
+        try {
+            wire = wireSchema.parse(JSON.parse(body));
+        }
+        catch {
+            return null;
+        }
+        const now = this.now();
+        if (Math.abs(now - wire.sentAt) > RELAY_FRAME_MAX_AGE_MS)
+            return null;
+        const source = wire.envelope.source;
+        const peer = this.peers.get(source);
+        if (peer && wire.sequence <= peer.sequence)
+            return null;
+        this.peers.delete(source);
+        this.peers.set(source, { sequence: wire.sequence, seenAt: now });
+        this.forgetIdlePeers(now);
+        return wire.envelope;
+    }
+    /** Forgotten peers can only send frames newer than the freshness window, which rejects replays. */
+    forgetIdlePeers(now) {
+        if (this.peers.size <= MAX_TRACKED_PEERS)
+            return;
+        for (const [source, peer] of this.peers) {
+            if (now - peer.seenAt <= PEER_RETENTION_MS)
+                break;
+            this.peers.delete(source);
+        }
+    }
+}

package/dist/tunnel/redis-types.d.ts

@@ -67,4 +67,9 @@ export interface RedisTunnelRelayOptions {
     publisher: RedisTunnelPublisher;
     subscriber: RedisTunnelSubscriber;
     connectTimeoutMs?: number;
+    /** Gateway-only key material shared by every replica (the session key). Frames are authenticated
+     * with an HKDF subkey of it; the value itself never leaves the process. */
+    secret: string;
+    /** Called for each relay message dropped as unauthenticated, stale, replayed or oversized. */
+    onRejectedFrame?: () => void;
 }

package/dist/tunnel/redis.d.ts

@@ -1,17 +1,20 @@
 import type { TunnelLease } from './broker.js';
 import type { TunnelRelay, TunnelSocket } from './transport.js';
-import { type RedisTunnelRelayOptions } from './redis-types.js';
+import type { RedisTunnelRelayOptions } from './redis-types.js';
 export { RedisTunnelOwnership } from './redis-ownership.js';
 export type { RedisTunnelCommands } from './redis-ownership.js';
 export type { RedisTunnelPublisher, RedisTunnelSubscriber, RedisTunnelRelayOptions } from './redis-types.js';
 /** Internal Redis channels contain authorized application traffic. Deploy them
- * on the environment's private, authenticated Redis and disable command replay. */
+ * on the environment's private, authenticated Redis and disable command replay.
+ * Every message is authenticated with a gateway-only key: other Redis clients
+ * can neither inject, redirect nor replay tunnel frames. */
 export declare class RedisTunnelRelay implements TunnelRelay {
     private readonly options;
     private started;
     private closed;
     private readonly attached;
     private readonly connected;
+    private readonly frames;
     private publishing;
     private receiving;
     private outgoingBytes;

package/dist/tunnel/redis.js

@@ -2,16 +2,19 @@ import { randomUUID } from 'node:crypto';
 import { DEFAULT_TUNNEL_LIMITS, parseTunnelFrame } from './protocol.js';
 import { redisIdentifier as identifier, redisNamespaceSchema as namespaceSchema, redisLeaseSchema as leaseSchema } from './redis-ownership.js';
 import { RelaySocket } from './redis-socket.js';
-import { envelopeSchema } from './redis-types.js';
+import { deriveRelayFrameKey, RelayFrameAuthenticator } from './redis-auth.js';
 export { RedisTunnelOwnership } from './redis-ownership.js';
 /** Internal Redis channels contain authorized application traffic. Deploy them
- * on the environment's private, authenticated Redis and disable command replay. */
+ * on the environment's private, authenticated Redis and disable command replay.
+ * Every message is authenticated with a gateway-only key: other Redis clients
+ * can neither inject, redirect nor replay tunnel frames. */
 export class RedisTunnelRelay {
     options;
     started = false;
     closed = false;
     attached = new Map();
     connected = new Map();
+    frames;
     publishing = Promise.resolve();
     receiving = Promise.resolve();
     outgoingBytes = 0;
@@ -24,6 +27,7 @@ export class RedisTunnelRelay {
         namespaceSchema.parse(options.namespace);
         if (options.namespace !== options.ownership.namespace || Object.is(options.publisher, options.subscriber))
             throw new Error('Separate, environment-scoped Redis clients are required');
+        this.frames = new RelayFrameAuthenticator(deriveRelayFrameKey({ secret: options.secret, namespace: options.namespace }));
         if (options.connectTimeoutMs !== undefined && (!Number.isSafeInteger(options.connectTimeoutMs) || options.connectTimeoutMs < 1 || options.connectTimeoutMs > 60_000))
             throw new Error('Invalid tunnel connect timeout');
         const policy = options.publisher.options;
@@ -93,8 +97,15 @@ export class RedisTunnelRelay {
     onMessage = (channel, raw) => {
         if (!this.started || channel !== this.channel(this.options.nodeId))
             return;
+        // Authenticate before anything else: a message without a valid MAC, fresh timestamp and new
+        // sequence is dropped without resetting live traffic, so a Redis client cannot inject or DoS.
+        const envelope = this.frames.open({ channel, message: raw });
+        if (!envelope) {
+            this.options.onRejectedFrame?.();
+            return;
+        }
         const bytes = Buffer.byteLength(raw);
-        if (bytes > DEFAULT_TUNNEL_LIMITS.maxFrameBytes * 2 + 2048 || this.incomingBytes + bytes > DEFAULT_TUNNEL_LIMITS.maxBufferedBytes) {
+        if (this.incomingBytes + bytes > DEFAULT_TUNNEL_LIMITS.maxBufferedBytes) {
             this.onRelayOverload();
             return;
         }
@@ -102,11 +113,13 @@ export class RedisTunnelRelay {
         const generation = this.generation;
         this.receiving = this.receiving.then(async () => {
             if (this.started && generation === this.generation)
-                await this.receive(envelopeSchema.parse(JSON.parse(raw)));
+                await this.receive(envelope);
         }).catch(() => this.onRelayOverload()).finally(() => { this.incomingBytes -= bytes; });
     };
     publish(nodeId, envelope) {
-        const payload = JSON.stringify(envelope);
+        const channel = this.channel(nodeId);
+        // Sealed in call order, so each destination sees this node's sequence numbers ascending.
+        const payload = this.frames.seal({ channel, envelope });
         const bytes = Buffer.byteLength(payload);
         if (this.outgoingBytes + bytes > DEFAULT_TUNNEL_LIMITS.maxBufferedBytes)
             return Promise.reject(new Error('Tunnel relay publish queue exceeded'));
@@ -115,7 +128,7 @@ export class RedisTunnelRelay {
         const sending = this.publishing.then(async () => {
             if (envelope.type !== 'close' && (generation !== this.generation || !this.started || this.closed))
                 throw new Error('Tunnel relay generation changed');
-            if (await this.options.publisher.publish(this.channel(nodeId), payload) < 1)
+            if (await this.options.publisher.publish(channel, payload) < 1)
                 throw new Error('Tunnel node is offline');
         });
         this.publishing = sending.catch(() => undefined).finally(() => { this.outgoingBytes -= bytes; });

package/package.json

@@ -9,7 +9,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "SDK types and CLI library for building Artifact Studio apps. Driven via `seq-studio artifact <sub>` (@sequenceholdings/studio-cli), which runs the `./cli` runCli export.",
   "type": "module",
   "exports": {
@@ -148,7 +148,7 @@
     "parse5": "7.3.0",
     "@sequenceholdings/lattice-form-renderer": "0.1.3",
     "@sequenceholdings/storage": "0.1.0",
-    "@sequenceholdings/orm": "2.1.0"
+    "@sequenceholdings/orm": "2.1.1"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",

package/templates/nextjs/README.md

@@ -71,6 +71,12 @@ only the capabilities the application needs, then configure authorized resource
 bindings in Atlas. Local development uses explicit nonproduction resources and
 never falls back to production when a binding is missing.
 
+ORM access is declared per table and per mutation: list `<namespace>/<table>`
+under `data.read` for every table a query reads (queries that follow
+platform-user relations also read `<namespace>/platformUsers`). Under
+`data.write`, use `<namespace>/ops/<Operation>` for each persisted mutation the
+app runs, or `<namespace>/<table>` for table-level coverage.
+
 Managed secrets stay in hosted runtimes. For local integration tests, use your
 own test credentials, mocks or an existing governed function. Use a hosted
 preview for application code that needs a managed secret. Never put secrets in

package/templates/nextjs/gitignore

@@ -0,0 +1,9 @@
+node_modules/
+.next/
+next-env.d.ts
+.artifact/
+.artifact-studio/
+.env*
+*.tsbuildinfo
+coverage/
+.DS_Store

package/templates/nextjs/pnpm-workspace.yaml

@@ -2,7 +2,21 @@ packages:
   - '.'
 
 minimumReleaseAge: 10080
+# The Sequence SDK chain is published from the Studio repo's audited release
+# pipeline, so a new artifact-studio release must install without waiting out
+# the seven-day quarantine. Scoped to the exact first-party packages a fresh
+# scaffold resolves, not @sequenceholdings/*.
+minimumReleaseAgeExclude:
+  - '@sequenceholdings/artifact-studio'
+  - '@sequenceholdings/atlas-ui'
+  - '@sequenceholdings/custom-roles-manifest'
+  - '@sequenceholdings/lattice-form-renderer'
+  - '@sequenceholdings/orm'
+  - '@sequenceholdings/storage'
 strictDepBuilds: true
 allowBuilds:
   '@tailwindcss/oxide': false
+  # Reached through the SDK's static builder and ORM tooling, never run by a
+  # Next.js app; its platform binary installs as an optional dependency.
+  esbuild: false
   sharp: false