@sequenceholdings/artifact-studio 0.4.0 → 0.5.0

package/dist/gateway/lattice-upstream.js

@@ -0,0 +1,136 @@
+import { request as httpsRequest } from 'node:https';
+import { assertSafeRequest } from '../tunnel/protocol.js';
+import { isManagedServerInvokePath } from '../server/managed-server-path.js';
+import { HOSTED_ARTIFACT_PROXY_LIMITS, cloudRunOrigin, hostedIdentityToken } from './hosted-proxy.js';
+const BODY_CAP = 1024 * 1024;
+/**
+ * Buffered POST into a hosted Next.js app. The destination must already be a
+ * Cloud Run origin Atlas resolved; this rejects anything else before dialing.
+ */
+export async function invokeHostedArtifact(input) {
+    if (!isManagedServerInvokePath(input.path))
+        throw new Error('Invalid managed server path');
+    const upstream = cloudRunOrigin(input.upstreamUrl);
+    const audience = input.upstreamAudience === undefined ? upstream : cloudRunOrigin(input.upstreamAudience);
+    assertSafeRequest('POST', input.path);
+    const payload = Buffer.from(JSON.stringify(input.body ?? {}));
+    if (payload.byteLength > BODY_CAP)
+        throw new Error('Managed server body exceeds 1 MiB');
+    const timeoutMs = Math.min(Math.max(input.timeoutMs, 1), HOSTED_ARTIFACT_PROXY_LIMITS.maxTimeoutMs);
+    const signal = invocationSignal({ timeoutMs, signal: input.signal });
+    const token = await withSignal((input.identityTokenProvider ?? hostedIdentityToken)({ audience: audience.origin, signal }), signal);
+    if (!/^[A-Za-z0-9._~-]+$/.test(token) || token.length > 16384)
+        throw new Error('Invalid platform token');
+    const headers = {
+        host: upstream.host,
+        'content-type': 'application/json',
+        'content-length': String(payload.byteLength),
+        'accept-encoding': 'identity',
+        'x-serverless-authorization': `Bearer ${token}`,
+        'x-sequence-artifact-context': input.requestContext,
+    };
+    const hop = { origin: upstream, path: input.path, headers, body: payload, timeoutMs, signal };
+    const response = await withSignal(input.dispatch ? input.dispatch(hop) : postCloudRun({ ...hop, dial: input.dial }), signal);
+    if (response.body.byteLength > BODY_CAP)
+        throw new Error('Managed server response exceeds 1 MiB');
+    return { status: response.status, body: decodeBody(response) };
+}
+function decodeBody(response) {
+    if (response.body.byteLength === 0)
+        return null;
+    const text = response.body.toString('utf8');
+    if (response.contentType?.split(';', 1)[0]?.trim().toLowerCase() !== 'application/json')
+        return text;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+/**
+ * `timeoutMs` is a deadline from the start of the call, not socket idle time.
+ * Streaming a chunk forever must not extend it. `signal` is the worker's
+ * disconnect; either one destroys the Cloud Run request.
+ */
+function invocationSignal({ timeoutMs, signal }) {
+    const deadline = AbortSignal.timeout(timeoutMs);
+    return signal ? AbortSignal.any([signal, deadline]) : deadline;
+}
+function invocationAbortError(signal) {
+    const reason = signal.reason;
+    if (reason instanceof Error && reason.name === 'TimeoutError')
+        return new Error('Managed server invocation timed out');
+    if (reason instanceof Error && /timed out/i.test(reason.message))
+        return reason;
+    return new Error('Managed server invocation cancelled');
+}
+function withSignal(work, signal) {
+    if (signal.aborted)
+        return Promise.reject(invocationAbortError(signal));
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(invocationAbortError(signal));
+        signal.addEventListener('abort', onAbort, { once: true });
+        work.then((value) => { signal.removeEventListener('abort', onAbort); resolve(value); }, (error) => { signal.removeEventListener('abort', onAbort); reject(error); });
+    });
+}
+function postCloudRun(input) {
+    return new Promise((resolve, reject) => {
+        if (input.signal.aborted) {
+            reject(invocationAbortError(input.signal));
+            return;
+        }
+        let settled = false;
+        let incoming;
+        let onAbort = () => { };
+        const stop = () => input.signal.removeEventListener('abort', onAbort);
+        const fail = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            stop();
+            incoming?.destroy();
+            request.destroy();
+            reject(error instanceof Error ? error : new Error('Managed server invocation failed'));
+        };
+        const succeed = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            stop();
+            resolve(value);
+        };
+        const request = (input.dial ?? httpsRequest)(input.origin, {
+            method: 'POST',
+            path: input.path,
+            headers: input.headers,
+            timeout: input.timeoutMs,
+        }, (response) => {
+            incoming = response;
+            const chunks = [];
+            let length = 0;
+            response.on('data', (chunk) => {
+                length += chunk.byteLength;
+                if (length > BODY_CAP) {
+                    fail(new Error('Managed server response exceeds 1 MiB'));
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            response.on('end', () => {
+                const contentType = response.headers['content-type'];
+                succeed({
+                    status: response.statusCode ?? 502,
+                    ...(typeof contentType === 'string' ? { contentType } : {}),
+                    body: Buffer.concat(chunks),
+                });
+            });
+            response.on('error', fail);
+        });
+        onAbort = () => fail(invocationAbortError(input.signal));
+        input.signal.addEventListener('abort', onAbort, { once: true });
+        request.on('error', fail);
+        request.on('timeout', () => fail(new Error('Managed server invocation timed out')));
+        request.end(input.body);
+    });
+}

package/dist/gateway/server.js

@@ -6,6 +6,7 @@ import { assertSafeRequest, normalizePublicOrigin } from '../tunnel/protocol.js'
 import { GatewayControlError } from './control.js';
 import { decodeGatewaySession, gatewaySessionCookies, renewGatewaySession, signGatewayContext } from './session.js';
 import { proxyHostedArtifact } from './hosted-proxy.js';
+import { routeSequenceRequest } from './lattice-invoke.js';
 import { admitHostedMutation, ReleaseAdmissionError } from './release-admission.js';
 import { ArtifactAdmissionError } from './admission.js';
 import { gatewayClientAddress } from './control-admission.js';
@@ -285,10 +286,8 @@ export function createArtifactGateway(options) {
                 await exchangeTicket({ request, response, origin });
                 return;
             }
-            if (request.url?.startsWith('/_sequence/')) {
-                json(response, 404, 'not_found');
+            if (await routeSequenceRequest({ request, response, control: options.control, privateKey: options.contextPrivateKey, keyId: options.contextKeyId, admission: options.admission, usage }))
                 return;
-            }
             if (['GET', 'HEAD'].includes(request.method ?? 'GET')) {
                 const url = new URL(request.url ?? '/', origin);
                 if (url.searchParams.has('__sequence_release')) {

package/dist/gateway/session.d.ts

@@ -71,7 +71,7 @@ export declare function decodeGatewaySession(input: {
     frameworkBuildId?: string;
 }): GatewaySession | null;
 /** A fresh jti on every signature: a context names one originating request and its method. */
-export declare function signGatewayContext({ session, method, path, privateKey, keyId, now, capabilities, serviceAccountId, requestId }: {
+export declare function signGatewayContext({ session, method, path, privateKey, keyId, now, capabilities, serviceAccountId, requestId, ttlSeconds }: {
     session: GatewaySession;
     method: string;
     path: string;
@@ -81,5 +81,7 @@ export declare function signGatewayContext({ session, method, path, privateKey,
     capabilities?: string[];
     serviceAccountId?: string | null;
     requestId?: string;
+    /** Seconds until exp. Browser requests stay at 60; a Lattice run may last up to 300. */
+    ttlSeconds?: number;
 }): string;
 export {};

package/dist/gateway/session.js

@@ -1,6 +1,6 @@
 import { createHmac, createPrivateKey, randomUUID, sign, timingSafeEqual } from 'node:crypto';
 import { z } from 'zod';
-import { artifactRequestContextSchema } from '../server/request-context.js';
+import { ARTIFACT_CONTEXT_MAX_AGE_SECONDS, ARTIFACT_LATTICE_CONTEXT_MAX_AGE_SECONDS, artifactRequestContextSchema } from '../server/request-context.js';
 import { normalizePublicOrigin } from '../tunnel/protocol.js';
 import { artifactNextFrameworkBuildIdSchema } from '../runtime-contracts.js';
 export const GATEWAY_SESSION_COOKIE = '__Host-atlas-artifact-session';
@@ -137,13 +137,20 @@ export function decodeGatewaySession(input) {
     return matches.sort((left, right) => right.expiresAt - left.expiresAt || (left.deploymentId ?? '').localeCompare(right.deploymentId ?? ''))[0] ?? null;
 }
 /** A fresh jti on every signature: a context names one originating request and its method. */
-export function signGatewayContext({ session, method, path, privateKey, keyId, now = Math.floor(Date.now() / 1000), capabilities = [], serviceAccountId = null, requestId = randomUUID() }) {
+export function signGatewayContext({ session, method, path, privateKey, keyId, now = Math.floor(Date.now() / 1000), capabilities = [], serviceAccountId = null, requestId = randomUUID(), ttlSeconds = ARTIFACT_CONTEXT_MAX_AGE_SECONDS }) {
+    const latticeRun = session.lattice?.runId ?? null;
+    const ceiling = latticeRun !== null && latticeRun !== ''
+        ? ARTIFACT_LATTICE_CONTEXT_MAX_AGE_SECONDS
+        : ARTIFACT_CONTEXT_MAX_AGE_SECONDS;
+    if (!Number.isInteger(ttlSeconds) || ttlSeconds < 1 || ttlSeconds > ceiling) {
+        throw new Error(`Artifact context lifetime must be 1..${ceiling} seconds`);
+    }
     const context = artifactRequestContextSchema.parse({
         v: 1, iss: 'atlas-artifact-gateway', aud: `artifact:${session.projectId}`,
         sub: session.ownerId, projectId: session.projectId, environment: session.environment,
         mode: session.kind === 'development' ? 'development' : session.published ? 'published' : 'preview',
         deploymentId: session.deploymentId, devSessionId: session.sessionId, requestId, jti: randomUUID(),
-        method, path, iat: now, exp: now + 60, capabilities, serviceAccountId,
+        method, path, iat: now, exp: now + ttlSeconds, capabilities, serviceAccountId,
         bridge: session.bridge, theme: 'system',
         lattice: session.lattice ?? { runId: null, nodeId: null, stepId: null, processId: null },
         ...(session.taskRoutes ? { taskRoutes: session.taskRoutes } : {}),

package/dist/manifest-next.d.ts

@@ -20,7 +20,18 @@ export declare const ARTIFACT_NEXT_RESOURCE_DEFAULTS: {
     max_instances: number;
     timeout_seconds: number;
 };
+/**
+ * Where the server's audit events (`client.audit.record`) go: an Atlas audit service id. Every
+ * application may record under `artifact_studio`; Atlas admits a first-party service, such as
+ * `application_portal`, only for the projects it registers for it. Server-only: browsers can't audit.
+ */
+export declare const artifactNextAuditCapabilitySchema: z.ZodObject<{
+    service: z.ZodString;
+}, z.core.$strict>;
 export declare const artifactNextServerCapabilitiesSchema: z.ZodPrefault<z.ZodObject<{
+    audit: z.ZodOptional<z.ZodObject<{
+        service: z.ZodString;
+    }, z.core.$strict>>;
     storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
         viewer: "viewer";
         editor: "editor";
@@ -37,6 +48,11 @@ export declare const artifactNextServerCapabilitiesSchema: z.ZodPrefault<z.ZodOb
     functions: z.ZodPrefault<z.ZodObject<{
         invoke: z.ZodDefault<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
+    processes: z.ZodPrefault<z.ZodObject<{
+        start: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        act: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
 }, z.core.$strict>>;
 export type ArtifactNextServerCapabilities = z.infer<typeof artifactNextServerCapabilitiesSchema>;
 export declare const artifactNextResourceLimitsSchema: z.ZodPrefault<z.ZodObject<{
@@ -70,6 +86,9 @@ export declare const artifactNextBuildConfigSchema: z.ZodPrefault<z.ZodObject<{
 }, z.core.$strict>>;
 export declare const artifactNextServerSchema: z.ZodPrefault<z.ZodObject<{
     capabilities: z.ZodPrefault<z.ZodObject<{
+        audit: z.ZodOptional<z.ZodObject<{
+            service: z.ZodString;
+        }, z.core.$strict>>;
         storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
             viewer: "viewer";
             editor: "editor";
@@ -86,6 +105,11 @@ export declare const artifactNextServerSchema: z.ZodPrefault<z.ZodObject<{
         functions: z.ZodPrefault<z.ZodObject<{
             invoke: z.ZodDefault<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>;
+        processes: z.ZodPrefault<z.ZodObject<{
+            start: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            act: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
     }, z.core.$strict>>;
     service_account: z.ZodOptional<z.ZodString>;
     secrets: z.ZodDefault<z.ZodArray<z.ZodObject<{
@@ -105,8 +129,18 @@ export declare const artifactNextServerSchema: z.ZodPrefault<z.ZodObject<{
     cache: z.ZodOptional<z.ZodObject<{
         capacity_gb: z.ZodNumber;
     }, z.core.$strict>>;
+    lattice: z.ZodOptional<z.ZodObject<{
+        accept: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
 }, z.core.$strict>>;
 export declare const artifactStudioNextManifestSchema: z.ZodObject<{
+    ontology: z.ZodOptional<z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        produce: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        invoke: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
     bundle: z.ZodObject<{
         name: z.ZodString;
         schema_version: z.ZodLiteral<2>;
@@ -155,6 +189,11 @@ export declare const artifactStudioNextManifestSchema: z.ZodObject<{
         functions: z.ZodPrefault<z.ZodObject<{
             invoke: z.ZodDefault<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>;
+        processes: z.ZodPrefault<z.ZodObject<{
+            start: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            act: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
     }, z.core.$strict>>;
     build: z.ZodPrefault<z.ZodObject<{
         public_env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -166,6 +205,9 @@ export declare const artifactStudioNextManifestSchema: z.ZodObject<{
     }, z.core.$strict>>;
     server: z.ZodPrefault<z.ZodObject<{
         capabilities: z.ZodPrefault<z.ZodObject<{
+            audit: z.ZodOptional<z.ZodObject<{
+                service: z.ZodString;
+            }, z.core.$strict>>;
             storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
                 viewer: "viewer";
                 editor: "editor";
@@ -182,6 +224,11 @@ export declare const artifactStudioNextManifestSchema: z.ZodObject<{
             functions: z.ZodPrefault<z.ZodObject<{
                 invoke: z.ZodDefault<z.ZodArray<z.ZodString>>;
             }, z.core.$strict>>;
+            processes: z.ZodPrefault<z.ZodObject<{
+                start: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                act: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
         }, z.core.$strict>>;
         service_account: z.ZodOptional<z.ZodString>;
         secrets: z.ZodDefault<z.ZodArray<z.ZodObject<{
@@ -201,10 +248,18 @@ export declare const artifactStudioNextManifestSchema: z.ZodObject<{
         cache: z.ZodOptional<z.ZodObject<{
             capacity_gb: z.ZodNumber;
         }, z.core.$strict>>;
+        lattice: z.ZodOptional<z.ZodObject<{
+            accept: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
     }, z.core.$strict>>;
     targets: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
         url: z.ZodString;
     }, z.core.$strict>>>;
+    presentation: z.ZodOptional<z.ZodObject<{
+        mobile: z.ZodOptional<z.ZodEnum<{
+            responsive: "responsive";
+        }>>;
+    }, z.core.$strip>>;
     sidebarIcon: z.ZodOptional<z.ZodString>;
     sidebarBadge: z.ZodOptional<z.ZodObject<{
         endpoint: z.ZodString;

package/dist/manifest-next.js

@@ -1,7 +1,9 @@
 import { storageScopesSchema } from '@sequenceholdings/storage';
+import { ontologyContractSchema } from '@sequenceholdings/orm/canonical';
 import { z } from 'zod';
 import { capabilityPinsSchema, customRolesBlockSchema, validateCapabilityPins } from './manifest-custom-roles.js';
-import { apiCapabilityPathAllowed, artifactStudioStaticManifestSchema, sidebarBadgeSchema } from './manifest-static.js';
+import { isManagedServerInvokePath } from './server/managed-server-path.js';
+import { apiCapabilityPathAllowed, artifactPresentationSchema, artifactStudioStaticManifestSchema, sidebarBadgeSchema, } from './manifest-static.js';
 /** Approved major/minor profile. Builds additionally record exact patch versions. */
 export const ARTIFACT_NEXT_RUNTIME = Object.freeze({ sdk: 'sequence', node: 24, react: 19, next: '16.3' });
 /** Admission policy for new development sessions and builds; retained releases keep their recorded toolchain. */
@@ -30,13 +32,34 @@ const ormTableRef = /^[a-z][a-z0-9_]{0,40}\/(?:[a-z][a-z0-9_]{0,62}|platformUser
 const ormOperationRef = /^[a-z][a-z0-9_]{0,40}\/ops\/[_A-Za-z][_0-9A-Za-z]*$/;
 const dataReadRef = boundedRef.refine((ref) => ormTableRef.test(ref), 'ORM read references use namespace/table');
 const dataWriteRef = boundedRef.refine((ref) => ormTableRef.test(ref) || ormOperationRef.test(ref), 'ORM write references use namespace/ops/Operation or namespace/table');
+const latticeProcessRef = z.string().min(2).max(128).regex(/^[A-Za-z0-9._-]+$/, 'Process references are Lattice process ids');
 const reachShape = {
     storage: storageScopesSchema.optional(),
     data: z.strictObject({ read: z.array(dataReadRef).max(256).default([]), write: z.array(dataWriteRef).max(256).default([]) }).prefault({}),
     api: z.strictObject({ read: z.array(apiPath).max(256).default([]), write: z.array(apiPath).max(256).default([]) }).prefault({}),
     functions: z.strictObject({ invoke: z.array(boundedRef).max(256).default([]) }).prefault({}),
+    // `start`: processes the server may start runs of. `read`: processes whose runs, template and
+    // the user's own steps it may read. `act`: processes whose human steps it may advance and
+    // reassign, and whose runs' viewers it may manage. All name exact process ids; the user's own
+    // Invoker / Viewer / Advancer / Owner grants decide what happens.
+    processes: z.strictObject({
+        start: z.array(latticeProcessRef).max(256).default([]),
+        read: z.array(latticeProcessRef).max(256).default([]),
+        act: z.array(latticeProcessRef).max(256).default([]),
+    }).prefault({}),
 };
-export const artifactNextServerCapabilitiesSchema = z.strictObject(reachShape).prefault({});
+/**
+ * Where the server's audit events (`client.audit.record`) go: an Atlas audit service id. Every
+ * application may record under `artifact_studio`; Atlas admits a first-party service, such as
+ * `application_portal`, only for the projects it registers for it. Server-only: browsers can't audit.
+ */
+export const artifactNextAuditCapabilitySchema = z.strictObject({
+    service: z.string().regex(/^[a-z][a-z0-9_]{0,63}$/, 'Audit services are Atlas audit service ids, such as artifact_studio'),
+});
+export const artifactNextServerCapabilitiesSchema = z.strictObject({
+    ...reachShape,
+    audit: artifactNextAuditCapabilitySchema.optional(),
+}).prefault({});
 // Reuse role semantics and validation; only the new manifest rejects unknown keys.
 const strictCustomRoles = customRolesBlockSchema.safeExtend({
     definitions: z.record(customRolesBlockSchema.shape.definitions.unwrap().keyType, customRolesBlockSchema.shape.definitions.unwrap().valueType.strict()).default({}),
@@ -83,6 +106,7 @@ export const artifactNextBuildConfigSchema = z.strictObject({
     public_fonts: z.array(artifactNextPublicFontSchema).max(8).refine((fonts) => new Set(fonts.map((font) => font.path)).size === fonts.length, 'Public font destination paths must be unique').default([]),
 }).prefault({});
 const hostname = z.string().max(253).regex(/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$/, 'Egress entries must be exact lowercase DNS hostnames without schemes, ports, paths, IPs, or wildcards').refine((host) => !host.endsWith('.localhost') && !host.endsWith('.local') && !host.endsWith('.internal'), 'Egress cannot target local or platform-internal hostnames');
+const managedServerInvokePath = z.string().refine(isManagedServerInvokePath, 'Lattice accept paths are exact origin-relative paths with no query or traversal');
 export const artifactNextServerSchema = z.strictObject({
     capabilities: artifactNextServerCapabilitiesSchema,
     service_account: serviceAccountRef.optional(),
@@ -90,6 +114,10 @@ export const artifactNextServerSchema = z.strictObject({
     egress: z.array(hostname).max(64).default([]),
     resources: artifactNextResourceLimitsSchema,
     cache: z.strictObject({ capacity_gb: z.number().int().min(1).max(16) }).optional(),
+    /** Paths Lattice may POST. Exact match only; omitted means Lattice cannot call this server. */
+    lattice: z.strictObject({
+        accept: z.array(managedServerInvokePath).max(32).default([]),
+    }).optional(),
 }).superRefine((server, ctx) => {
     if (new Set(server.secrets.map((secret) => secret.name)).size !== server.secrets.length) {
         ctx.addIssue({ code: 'custom', path: ['secrets'], message: 'Each secret environment name must be unique' });
@@ -97,6 +125,9 @@ export const artifactNextServerSchema = z.strictObject({
     if (new Set(server.egress).size !== server.egress.length) {
         ctx.addIssue({ code: 'custom', path: ['egress'], message: 'Egress hosts must be unique' });
     }
+    if (server.lattice && new Set(server.lattice.accept).size !== server.lattice.accept.length) {
+        ctx.addIssue({ code: 'custom', path: ['lattice', 'accept'], message: 'Lattice accept paths must be unique' });
+    }
 }).prefault({});
 const appRoot = z.string().min(1).max(512).refine((value) => {
     if (value === '.')
@@ -105,6 +136,7 @@ const appRoot = z.string().min(1).max(512).refine((value) => {
         value.split('/').every((part) => part !== '' && part !== '.' && part !== '..' && !part.startsWith('.') && part !== 'node_modules');
 }, 'app_root must be a relative source directory without traversal, hidden directories, or node_modules').default('.');
 export const artifactStudioNextManifestSchema = z.strictObject({
+    ontology: ontologyContractSchema.optional(),
     bundle: z.strictObject({ name: z.string().min(1).max(255), schema_version: z.literal(2) }),
     artifact: z.strictObject({
         project_id: artifactStudioStaticManifestSchema.shape.artifact.shape.project_id,
@@ -120,6 +152,7 @@ export const artifactStudioNextManifestSchema = z.strictObject({
     build: artifactNextBuildConfigSchema,
     server: artifactNextServerSchema,
     targets: z.record(z.string().min(1), z.strictObject({ url: z.string().url() })).default({}),
+    presentation: artifactPresentationSchema.optional(),
     sidebarIcon: z.string().max(64).optional(),
     sidebarBadge: sidebarBadgeSchema.strict().optional(),
 }).superRefine((manifest, ctx) => {

package/dist/manifest-static.d.ts

@@ -8,8 +8,30 @@ export declare const sidebarBadgeSchema: z.ZodObject<{
     }>>;
 }, z.core.$strip>;
 export type SidebarBadgeManifest = z.infer<typeof sidebarBadgeSchema>;
+export declare const artifactPresentationSchema: z.ZodObject<{
+    mobile: z.ZodOptional<z.ZodEnum<{
+        responsive: "responsive";
+    }>>;
+}, z.core.$strip>;
+export type ArtifactPresentation = z.infer<typeof artifactPresentationSchema>;
+export declare const artifactOfflineCapabilitySchema: z.ZodObject<{
+    mode: z.ZodEnum<{
+        read: "read";
+        "read-write": "read-write";
+    }>;
+    max_age_hours: z.ZodNumber;
+    policy_version: z.ZodNumber;
+}, z.core.$strip>;
+export type ArtifactOfflineCapability = z.infer<typeof artifactOfflineCapabilitySchema>;
 export declare function apiCapabilityPathAllowed(pathname: string, allowed: readonly string[]): boolean;
 export declare const artifactStudioStaticManifestSchema: z.ZodObject<{
+    ontology: z.ZodOptional<z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        produce: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        invoke: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
     bundle: z.ZodObject<{
         name: z.ZodString;
         schema_version: z.ZodDefault<z.ZodLiteral<1>>;
@@ -63,6 +85,19 @@ export declare const artifactStudioStaticManifestSchema: z.ZodObject<{
     targets: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
         url: z.ZodString;
     }, z.core.$strict>>>;
+    presentation: z.ZodOptional<z.ZodObject<{
+        mobile: z.ZodOptional<z.ZodEnum<{
+            responsive: "responsive";
+        }>>;
+    }, z.core.$strip>>;
+    offline: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodEnum<{
+            read: "read";
+            "read-write": "read-write";
+        }>;
+        max_age_hours: z.ZodNumber;
+        policy_version: z.ZodNumber;
+    }, z.core.$strip>>;
     sidebarIcon: z.ZodOptional<z.ZodString>;
     sidebarBadge: z.ZodOptional<z.ZodObject<{
         endpoint: z.ZodString;

package/dist/manifest-static.js

@@ -1,4 +1,5 @@
 import { storageScopesSchema } from '@sequenceholdings/storage';
+import { ontologyContractSchema } from '@sequenceholdings/orm/canonical';
 import { z } from 'zod';
 import { capabilityPinsSchema, customRolesBlockSchema, validateCapabilityPins, } from './manifest-custom-roles.js';
 import { normalizeArtifactPath } from './paths.js';
@@ -13,6 +14,14 @@ export const sidebarBadgeSchema = z.object({
     endpoint: apiCapabilityPathSchema,
     tone: sidebarBadgeToneSchema.optional(),
 });
+export const artifactPresentationSchema = z.object({
+    mobile: z.enum(['responsive']).optional(),
+});
+export const artifactOfflineCapabilitySchema = z.object({
+    mode: z.enum(['read', 'read-write']),
+    max_age_hours: z.number().int().min(1),
+    policy_version: z.number().int().min(1),
+});
 function matchesApiCapabilityEntry(pathname, entry) {
     if (!entry.startsWith('/api/'))
         return false;
@@ -41,6 +50,7 @@ export function apiCapabilityPathAllowed(pathname, allowed) {
     return allowed.some((entry) => matchesApiCapabilityEntry(pathname, entry));
 }
 export const artifactStudioStaticManifestSchema = z.object({
+    ontology: ontologyContractSchema.optional(),
     bundle: z.object({
         name: z.string().min(1).max(255),
         schema_version: z.literal(1).default(1),
@@ -99,6 +109,8 @@ export const artifactStudioStaticManifestSchema = z.object({
     targets: z.record(z.string().min(1), z.object({
         url: z.string().url(),
     }).strict()).default({}),
+    presentation: artifactPresentationSchema.optional(),
+    offline: artifactOfflineCapabilitySchema.optional(),
     sidebarIcon: z.string().max(64).optional(),
     sidebarBadge: sidebarBadgeSchema.optional(),
 }).superRefine((manifest, ctx) => {

package/dist/manifest.d.ts

@@ -5,6 +5,13 @@ export * from './manifest-static.js';
 export * from './manifest-next.js';
 /** Versioned parsing keeps schema-v1 stripping/default behavior unchanged. */
 export declare const artifactStudioManifestSchema: z.ZodUnion<readonly [z.ZodObject<{
+    ontology: z.ZodOptional<z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        produce: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        invoke: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
     bundle: z.ZodObject<{
         name: z.ZodString;
         schema_version: z.ZodDefault<z.ZodLiteral<1>>;
@@ -58,6 +65,19 @@ export declare const artifactStudioManifestSchema: z.ZodUnion<readonly [z.ZodObj
     targets: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
         url: z.ZodString;
     }, z.core.$strict>>>;
+    presentation: z.ZodOptional<z.ZodObject<{
+        mobile: z.ZodOptional<z.ZodEnum<{
+            responsive: "responsive";
+        }>>;
+    }, z.core.$strip>>;
+    offline: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodEnum<{
+            read: "read";
+            "read-write": "read-write";
+        }>;
+        max_age_hours: z.ZodNumber;
+        policy_version: z.ZodNumber;
+    }, z.core.$strip>>;
     sidebarIcon: z.ZodOptional<z.ZodString>;
     sidebarBadge: z.ZodOptional<z.ZodObject<{
         endpoint: z.ZodString;
@@ -67,6 +87,13 @@ export declare const artifactStudioManifestSchema: z.ZodUnion<readonly [z.ZodObj
         }>>;
     }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
+    ontology: z.ZodOptional<z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        produce: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        invoke: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
     bundle: z.ZodObject<{
         name: z.ZodString;
         schema_version: z.ZodLiteral<2>;
@@ -115,6 +142,11 @@ export declare const artifactStudioManifestSchema: z.ZodUnion<readonly [z.ZodObj
         functions: z.ZodPrefault<z.ZodObject<{
             invoke: z.ZodDefault<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>;
+        processes: z.ZodPrefault<z.ZodObject<{
+            start: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            act: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
     }, z.core.$strict>>;
     build: z.ZodPrefault<z.ZodObject<{
         public_env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -126,6 +158,9 @@ export declare const artifactStudioManifestSchema: z.ZodUnion<readonly [z.ZodObj
     }, z.core.$strict>>;
     server: z.ZodPrefault<z.ZodObject<{
         capabilities: z.ZodPrefault<z.ZodObject<{
+            audit: z.ZodOptional<z.ZodObject<{
+                service: z.ZodString;
+            }, z.core.$strict>>;
             storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
                 viewer: "viewer";
                 editor: "editor";
@@ -142,6 +177,11 @@ export declare const artifactStudioManifestSchema: z.ZodUnion<readonly [z.ZodObj
             functions: z.ZodPrefault<z.ZodObject<{
                 invoke: z.ZodDefault<z.ZodArray<z.ZodString>>;
             }, z.core.$strict>>;
+            processes: z.ZodPrefault<z.ZodObject<{
+                start: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                act: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
         }, z.core.$strict>>;
         service_account: z.ZodOptional<z.ZodString>;
         secrets: z.ZodDefault<z.ZodArray<z.ZodObject<{
@@ -161,10 +201,18 @@ export declare const artifactStudioManifestSchema: z.ZodUnion<readonly [z.ZodObj
         cache: z.ZodOptional<z.ZodObject<{
             capacity_gb: z.ZodNumber;
         }, z.core.$strict>>;
+        lattice: z.ZodOptional<z.ZodObject<{
+            accept: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
     }, z.core.$strict>>;
     targets: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
         url: z.ZodString;
     }, z.core.$strict>>>;
+    presentation: z.ZodOptional<z.ZodObject<{
+        mobile: z.ZodOptional<z.ZodEnum<{
+            responsive: "responsive";
+        }>>;
+    }, z.core.$strip>>;
     sidebarIcon: z.ZodOptional<z.ZodString>;
     sidebarBadge: z.ZodOptional<z.ZodObject<{
         endpoint: z.ZodString;

package/dist/next-build.d.ts

@@ -15,8 +15,9 @@ export declare function resolveNextRepositoryId({ spec, repository, baseUrl, tok
     baseUrl: string;
     token: string;
 }): Promise<string>;
-export declare function submitNextBuild({ root, manifest, projectId, baseUrl, getToken, provenance, repository, repositoryId, channel, out }: {
+export declare function submitNextBuild({ root, sourceRoot, manifest, projectId, baseUrl, getToken, provenance, repository, repositoryId, channel, out }: {
     root: string;
+    sourceRoot: string;
     manifest: ArtifactStudioNextManifest;
     projectId: string;
     baseUrl: string;