@sequenceholdings/artifact-studio 0.6.6 → 0.7.0

package/dist/gateway/session.d.ts

@@ -38,16 +38,16 @@ export declare function renewGatewaySession({ session, authorizedExpiresAt, now
     now?: number;
 }): GatewaySession | null;
 /**
- * `Strict` everywhere Atlas and the runtime domain are one site, as every deployed environment is.
- * `None` is for the local stack only: Atlas on http://localhost is cross-site to
- * https://*.apps.localhost, so browsers drop a `Strict` cookie inside the preview iframe.
- * Partitioned keeps the relaxed cookie to Atlas's top-level site.
+ * `Strict` when every app origin sits under Atlas's own HTTPS host, so the iframe is same-site with
+ * its parent. Anywhere else — app origins on seqholdingsusercontent.com, or the local stack's
+ * http://localhost Atlas — a browser drops a `Strict` cookie inside the Atlas iframe, so the cookie
+ * is `SameSite=None; Partitioned`: the browser keys it to Atlas's top-level site and never sends it
+ * under any other. Cross-site writes are refused on `Origin` either way, not on SameSite.
  */
 export type GatewaySessionSameSite = 'Strict' | 'None';
-/** Reads ARTIFACT_NEXT_SESSION_COOKIE_SAMESITE; only a development gateway may relax the cookie. */
-export declare function gatewaySessionSameSite({ value, appEnv }: {
-    value: string | undefined;
-    appEnv: string;
+export declare function gatewaySessionSameSite({ parentOrigin, runtimeDomain }: {
+    parentOrigin: string;
+    runtimeDomain: string;
 }): GatewaySessionSameSite;
 export declare function gatewaySessionCookies({ session, key, cookie, renewal, now, sameSite }: {
     session: GatewaySession;

package/dist/gateway/session.js

@@ -39,15 +39,10 @@ export function renewGatewaySession({ session, authorizedExpiresAt, now = Date.n
     const expiresAt = Math.min(authorizedExpiresAt, session.maxExpiresAt ?? session.expiresAt);
     return expiresAt > session.expiresAt ? { ...session, expiresAt } : null;
 }
-/** Reads ARTIFACT_NEXT_SESSION_COOKIE_SAMESITE; only a development gateway may relax the cookie. */
-export function gatewaySessionSameSite({ value, appEnv }) {
-    if (value === undefined || value === '' || value === 'strict')
-        return 'Strict';
-    if (value !== 'none')
-        throw new Error('ARTIFACT_NEXT_SESSION_COOKIE_SAMESITE must be "strict" or "none"');
-    if (appEnv !== 'development')
-        throw new Error('ARTIFACT_NEXT_SESSION_COOKIE_SAMESITE=none is only for a local development gateway');
-    return 'None';
+export function gatewaySessionSameSite({ parentOrigin, runtimeDomain }) {
+    const parent = new URL(parentOrigin);
+    const underParent = runtimeDomain === parent.hostname || runtimeDomain.endsWith(`.${parent.hostname}`);
+    return parent.protocol === 'https:' && underParent ? 'Strict' : 'None';
 }
 function cookieAttributes(sameSite) {
     return `Path=/; HttpOnly; Secure; ${sameSite === 'None' ? 'SameSite=None; Partitioned' : 'SameSite=Strict'}`;

package/dist/gateway/usage.d.ts

@@ -1,3 +1,15 @@
+/** Closed, non-sensitive phase observations. An absent phase did not finish before reporting. */
+export interface GatewayTimings {
+    authorizationMs?: number;
+    authorizationCache?: 'hit' | 'shared' | 'load' | 'refresh';
+    admissionMs?: number;
+    identityTokenMs?: number;
+    /** Transport and app work until response headers, not pure app execution time. */
+    upstreamHeadersMs?: number;
+}
+export declare function gatewayElapsedMs(started: number): number;
+/** Detach the once-only usage event from work that can settle after cancellation. */
+export declare function snapshotGatewayTimings(timings: GatewayTimings): Readonly<GatewayTimings>;
 export interface GatewayUsageEvent {
     eventId: string;
     requestId: string;
@@ -22,6 +34,7 @@ export interface GatewayUsageEvent {
     };
     outcome: 'success' | 'error' | 'cancelled';
     httpStatus: number;
+    gatewayTimings?: Readonly<GatewayTimings>;
 }
 export type GatewayUsageFailure = {
     kind: 'usage_queue_full' | 'usage_delivery_failed' | 'usage_delivery_rejected' | 'usage_events_rejected' | 'usage_lost_on_shutdown';

package/dist/gateway/usage.js

@@ -1,3 +1,21 @@
+const MAX_GATEWAY_TIMING_MS = 600_000;
+export function gatewayElapsedMs(started) {
+    return Math.min(MAX_GATEWAY_TIMING_MS, Math.max(0, Math.round(performance.now() - started)));
+}
+/** Detach the once-only usage event from work that can settle after cancellation. */
+export function snapshotGatewayTimings(timings) {
+    const snapshot = {};
+    const durationKeys = ['authorizationMs', 'admissionMs', 'identityTokenMs', 'upstreamHeadersMs'];
+    for (const key of durationKeys) {
+        const value = timings[key];
+        if (typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 && value <= MAX_GATEWAY_TIMING_MS)
+            snapshot[key] = value;
+    }
+    const source = timings.authorizationCache;
+    if (source === 'hit' || source === 'shared' || source === 'load' || source === 'refresh')
+        snapshot.authorizationCache = source;
+    return Object.freeze(snapshot);
+}
 export const GATEWAY_USAGE_LIMITS = Object.freeze({ capacity: 10_000, maxBatch: 100, flushIntervalMs: 1_000, concurrency: 4 });
 const ATTEMPTS = 3;
 /**

package/dist/gateway-main.js

@@ -2,6 +2,8 @@ import { randomUUID } from 'node:crypto';
 import { isIP } from 'node:net';
 import { Redis } from 'ioredis';
 import { ArtifactGatewayControl } from './gateway/control.js';
+import { resolveGatewayControlConfig } from './gateway/control-config.js';
+import { hostedIdentityToken } from './gateway/hosted-proxy.js';
 import { createArtifactGateway } from './gateway/server.js';
 import { gatewaySessionSameSite } from './gateway/session.js';
 import { RedisTunnelOwnership, RedisTunnelRelay } from './tunnel/redis.js';
@@ -58,9 +60,9 @@ async function main() {
     let stopping = false;
     subscriber.on('ready', () => { if (!stopping)
         void relay.start().catch(() => undefined); });
-    const controlUrl = required('ARTIFACT_NEXT_CONTROL_PLANE_URL');
+    const controlConfig = resolveGatewayControlConfig({ env: process.env, identityToken: hostedIdentityToken });
     const controlToken = required('ARTIFACT_NEXT_CONTROL_TOKEN');
-    const control = new ArtifactGatewayControl({ url: controlUrl, token: controlToken });
+    const control = new ArtifactGatewayControl({ url: controlConfig.url, token: controlToken, identity: controlConfig.identity });
     const contextPrivateKey = required('ARTIFACT_NEXT_CONTEXT_PRIVATE_KEY');
     const contextKeyId = required('ARTIFACT_NEXT_CONTEXT_KEY_ID');
     const admission = new ArtifactRequestAdmission({ redis: command, namespace });
@@ -73,13 +75,14 @@ async function main() {
         else
             refuse(failure.kind); },
     });
+    const runtimeDomain = required('ARTIFACT_NEXT_RUNTIME_DOMAIN');
     const gateway = createArtifactGateway({
         control,
-        runtimeDomain: required('ARTIFACT_NEXT_RUNTIME_DOMAIN'),
-        parentOrigin: process.env.ARTIFACT_NEXT_PARENT_ORIGIN ?? new URL(controlUrl).origin,
+        runtimeDomain,
+        parentOrigin: controlConfig.parentOrigin,
         gatewayOrigin: required('ARTIFACT_NEXT_GATEWAY_URL'),
         sessionKey,
-        sessionCookieSameSite: gatewaySessionSameSite({ value: process.env.ARTIFACT_NEXT_SESSION_COOKIE_SAMESITE, appEnv: namespace }),
+        sessionCookieSameSite: gatewaySessionSameSite({ parentOrigin: controlConfig.parentOrigin, runtimeDomain }),
         contextPrivateKey,
         contextKeyId,
         nodeId, routing: ownership, relay,

package/dist/git-clone.d.ts

@@ -1,5 +1,3 @@
-/** Read the git PAT from the environment (`ATLAS_GIT_PAT`), trimmed. */
-export declare function resolveGitPatFromEnv(): string | undefined;
 /** Full or abbreviated hex SHAs — not valid as `git clone --branch`. */
 export declare function looksLikeCommitSha(ref: string): boolean;
 /**
@@ -20,7 +18,7 @@ export type RunGitClone = (args: {
      * default branch in full, then check the SHA out.
      */
     depth?: number;
-    /** PAT used as Basic-auth password (username `git`). */
+    /** Login access token used as Basic-auth password (username `git`). */
     pat: string;
     /** Hard ceiling before the git child is killed (default 5m). */
     timeoutMs?: number;

package/dist/git-clone.js

@@ -5,20 +5,15 @@
  * re-exports it from `src/repos/git-clone.ts` so the `repos` tool and the
  * artifact `--repo` deploy path share one clone path.
  *
- * Credentials are supplied via an ephemeral GIT_ASKPASS script so the PAT
+ * Credentials are supplied via an ephemeral GIT_ASKPASS script so the token
  * never lands in `remote.origin.url` or the git argv. Callers pass a clean
- * HTTPS clone URL plus the PAT separately.
+ * HTTPS clone URL plus the login token separately.
  */
 import { spawn } from 'node:child_process';
 import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createScrubbedChildEnv } from './child-environment.js';
-/** Read the git PAT from the environment (`ATLAS_GIT_PAT`), trimmed. */
-export function resolveGitPatFromEnv() {
-    const value = process.env.ATLAS_GIT_PAT?.trim();
-    return value || undefined;
-}
 /** Full or abbreviated hex SHAs — not valid as `git clone --branch`. */
 export function looksLikeCommitSha(ref) {
     return /^[0-9a-f]{7,40}$/i.test(ref);
@@ -151,9 +146,12 @@ export async function withGitAskpass({ pat, fn, }) {
                 GIT_TERMINAL_PROMPT: '0',
                 GIT_CONFIG_NOSYSTEM: '1',
                 SEQ_STUDIO_GIT_ASKPASS_PASSWORD: pat,
-                GIT_CONFIG_COUNT: '1',
+                GIT_CONFIG_COUNT: '2',
                 GIT_CONFIG_KEY_0: 'credential.helper',
                 GIT_CONFIG_VALUE_0: '',
+                // Never redirect a platform credential, even to another path on this host.
+                GIT_CONFIG_KEY_1: 'http.followRedirects',
+                GIT_CONFIG_VALUE_1: 'false',
             },
         }));
     }

package/dist/manifest-next-browser-data.d.ts

@@ -0,0 +1,17 @@
+import { z } from 'zod';
+import { type ArtifactStudioCustomRoles } from './manifest-custom-roles.js';
+/** Additional browser admission rules; neither these rules nor data reach grant access. */
+export declare const artifactNextBrowserDataSchema: z.ZodPrefault<z.ZodObject<{
+    operations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    required_capabilities: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>>;
+    read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>>;
+export type ArtifactNextBrowserData = z.infer<typeof artifactNextBrowserDataSchema>;
+/** Restriction references must be backed by this browser's reach and declared artifact pins. */
+export declare function validateBrowserDataAdmission({ data, uses, roles, ctx }: {
+    data: ArtifactNextBrowserData;
+    uses: readonly string[];
+    roles?: ArtifactStudioCustomRoles;
+    ctx: z.RefinementCtx;
+}): void;

package/dist/manifest-next-browser-data.js

@@ -0,0 +1,46 @@
+import { z } from 'zod';
+import { capabilityPinsSchema } from './manifest-custom-roles.js';
+import { boundedRef, ormOperationRef, reachShape } from './manifest-next-reach.js';
+const browserOperationRef = boundedRef.refine((ref) => ormOperationRef.test(ref), 'Browser ORM operations name each operation: namespace/ops/Operation');
+/** Additional browser admission rules; neither these rules nor data reach grant access. */
+export const artifactNextBrowserDataSchema = z.strictObject({
+    ...reachShape.data.unwrap().shape,
+    // Preserve absence: existing manifests use table-set admission. An explicit [] denies all.
+    operations: z.array(browserOperationRef).max(256).refine((operations) => new Set(operations).size === operations.length, 'Browser ORM operations must be unique').optional(),
+    // Keys name source namespaces, before development/preview namespace bindings are applied.
+    required_capabilities: z.preprocess((value, ctx) => {
+        // Zod records skip this own key before validating keys; reject it rather than silently drop it.
+        if (value !== null && typeof value === 'object' && Object.hasOwn(value, '__proto__')) {
+            ctx.addIssue({ code: 'custom', path: ['__proto__'], message: 'Capability guard keys are ORM source namespaces' });
+        }
+        return value;
+    }, z.record(z.string().regex(/^[a-z][a-z0-9_]{0,40}$/, 'Capability guard keys are ORM source namespaces'), capabilityPinsSchema.unwrap().min(1).refine((pins) => new Set(pins).size === pins.length, 'Required browser ORM capabilities must be unique'))).optional(),
+}).prefault({});
+/** Restriction references must be backed by this browser's reach and declared artifact pins. */
+export function validateBrowserDataAdmission({ data, uses, roles, ctx }) {
+    const reached = new Set([...data.read, ...data.write].map((ref) => ref.split('/', 1)[0]));
+    for (const [index, operation] of (data.operations ?? []).entries()) {
+        const namespace = operation.split('/', 1)[0];
+        if (!reached.has(namespace)) {
+            ctx.addIssue({
+                code: 'custom', path: ['capabilities', 'data', 'operations', index],
+                message: `${operation} names a namespace that browser capabilities.data.read or write does not reach`,
+            });
+        }
+    }
+    const declared = new Set([...Object.keys(roles?.capabilities ?? {}), ...uses]);
+    for (const [namespace, pins] of Object.entries(data.required_capabilities ?? {})) {
+        const path = ['capabilities', 'data', 'required_capabilities', namespace];
+        if (!reached.has(namespace)) {
+            ctx.addIssue({ code: 'custom', path, message: `${namespace} is not reached by browser capabilities.data.read or write` });
+        }
+        for (const [index, pin] of pins.entries()) {
+            if (!declared.has(pin)) {
+                ctx.addIssue({
+                    code: 'custom', path: [...path, index],
+                    message: `Required capability "${pin}" must be declared in capabilities.roles.capabilities or capabilities.uses`,
+                });
+            }
+        }
+    }
+}

package/dist/manifest-next.d.ts

@@ -22,6 +22,7 @@ export declare const ARTIFACT_NEXT_RESOURCE_DEFAULTS: {
     timeout_seconds: number;
 };
 export { artifactNextAuditCapabilitySchema };
+export type { ArtifactNextBrowserData } from './manifest-next-browser-data.js';
 export * from './manifest-next-ingress.js';
 export declare const artifactNextServerCapabilitiesSchema: z.ZodPrefault<z.ZodObject<{
     audit: z.ZodOptional<z.ZodObject<{
@@ -228,6 +229,12 @@ export declare const artifactStudioNextManifestSchema: z.ZodObject<{
         next: z.ZodDefault<z.ZodLiteral<"16.3">>;
     }, z.core.$strict>>;
     capabilities: z.ZodPrefault<z.ZodObject<{
+        data: z.ZodPrefault<z.ZodObject<{
+            operations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            required_capabilities: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>>;
+            read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
         allow_downloads: z.ZodDefault<z.ZodBoolean>;
         allow_popups: z.ZodDefault<z.ZodBoolean>;
         roles: z.ZodOptional<z.ZodObject<{
@@ -247,10 +254,6 @@ export declare const artifactStudioNextManifestSchema: z.ZodObject<{
             editor: "editor";
             admin: "admin";
         }>>>;
-        data: z.ZodPrefault<z.ZodObject<{
-            read: z.ZodDefault<z.ZodArray<z.ZodString>>;
-            write: z.ZodDefault<z.ZodArray<z.ZodString>>;
-        }, z.core.$strict>>;
         api: z.ZodPrefault<z.ZodObject<{
             read: z.ZodDefault<z.ZodArray<z.ZodString>>;
             write: z.ZodDefault<z.ZodArray<z.ZodString>>;

package/dist/manifest-next.js

@@ -1,6 +1,7 @@
 import { ontologyContractSchema } from '@sequenceholdings/orm/canonical';
 import { z } from 'zod';
 import { capabilityPinsSchema, customRolesBlockSchema, validateCapabilityPins } from './manifest-custom-roles.js';
+import { artifactNextBrowserDataSchema, validateBrowserDataAdmission } from './manifest-next-browser-data.js';
 import { isManagedServerInvokePath } from './server/managed-server-path.js';
 import { artifactNextIngressSchema, validateIngressAgainstServer } from './manifest-next-ingress.js';
 import { artifactNextAuditCapabilitySchema, reachShape, serviceAccountRef } from './manifest-next-reach.js';
@@ -25,6 +26,7 @@ const strictCustomRoles = customRolesBlockSchema.safeExtend({
 }).strict();
 const browserCapabilities = z.strictObject({
     ...reachShape,
+    data: artifactNextBrowserDataSchema,
     allow_downloads: z.boolean().default(false),
     allow_popups: z.boolean().default(false),
     roles: strictCustomRoles.optional(),
@@ -125,6 +127,7 @@ export const artifactStudioNextManifestSchema = z.strictObject({
     sidebarIcon: z.string().max(64).optional(),
     sidebarBadge: sidebarBadgeSchema.strict().optional(),
 }).superRefine((manifest, ctx) => {
+    validateBrowserDataAdmission({ ...manifest.capabilities, ctx });
     for (const message of validateCapabilityPins({ uses: manifest.capabilities.uses, roles: manifest.capabilities.roles })) {
         ctx.addIssue({ code: 'custom', path: ['capabilities', 'uses'], message });
     }

package/dist/manifest.d.ts

@@ -112,6 +112,12 @@ export declare const artifactStudioManifestSchema: z.ZodUnion<readonly [z.ZodObj
         next: z.ZodDefault<z.ZodLiteral<"16.3">>;
     }, z.core.$strict>>;
     capabilities: z.ZodPrefault<z.ZodObject<{
+        data: z.ZodPrefault<z.ZodObject<{
+            operations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            required_capabilities: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>>;
+            read: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            write: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
         allow_downloads: z.ZodDefault<z.ZodBoolean>;
         allow_popups: z.ZodDefault<z.ZodBoolean>;
         roles: z.ZodOptional<z.ZodObject<{
@@ -131,10 +137,6 @@ export declare const artifactStudioManifestSchema: z.ZodUnion<readonly [z.ZodObj
             editor: "editor";
             admin: "admin";
         }>>>;
-        data: z.ZodPrefault<z.ZodObject<{
-            read: z.ZodDefault<z.ZodArray<z.ZodString>>;
-            write: z.ZodDefault<z.ZodArray<z.ZodString>>;
-        }, z.core.$strict>>;
         api: z.ZodPrefault<z.ZodObject<{
             read: z.ZodDefault<z.ZodArray<z.ZodString>>;
             write: z.ZodDefault<z.ZodArray<z.ZodString>>;

package/dist/runtime-contracts.d.ts

@@ -1,5 +1,13 @@
 import { z } from 'zod';
 export { resolveArtifactNextImages } from './next-image-config.js';
+/** Atlas routes the gateway calls; every one authenticates the gateway itself. */
+export declare const ARTIFACT_NEXT_CONTROL_PATH = "/api/artifact-studio/next/control";
+/**
+ * The identity-token audience for gateway control calls: Atlas's public origin plus the control
+ * path, whichever address the call is routed to. Path-scoped, so a token minted for another
+ * Atlas audience is never accepted here.
+ */
+export declare function artifactNextControlAudience(atlasOrigin: string): string;
 /** Shared by local collection, repository collection and the bounded source-upload API. */
 export declare const ARTIFACT_NEXT_SOURCE_LIMITS: Readonly<{
     maxFiles: 2000;

package/dist/runtime-contracts.js

@@ -3,6 +3,16 @@ import { ARTIFACT_NEXT_RUNTIME, artifactNextSecretNameSchema } from './manifest-
 import { MAX_STUDIO_PATH_LENGTH } from './paths.js';
 import { isLoopbackHostname } from './loopback.js';
 export { resolveArtifactNextImages } from './next-image-config.js';
+/** Atlas routes the gateway calls; every one authenticates the gateway itself. */
+export const ARTIFACT_NEXT_CONTROL_PATH = '/api/artifact-studio/next/control';
+/**
+ * The identity-token audience for gateway control calls: Atlas's public origin plus the control
+ * path, whichever address the call is routed to. Path-scoped, so a token minted for another
+ * Atlas audience is never accepted here.
+ */
+export function artifactNextControlAudience(atlasOrigin) {
+    return `${new URL(atlasOrigin).origin}${ARTIFACT_NEXT_CONTROL_PATH}`;
+}
 /** Shared by local collection, repository collection and the bounded source-upload API. */
 export const ARTIFACT_NEXT_SOURCE_LIMITS = Object.freeze({
     maxFiles: 2_000,

package/dist/sdk-orm.d.ts

@@ -1,10 +1,10 @@
-import { type OperationExecutor } from '@sequenceholdings/orm/client';
+import { type SqlOperationExecutor } from '@sequenceholdings/orm/client';
 import { type ArtifactOrmJsonScalars } from './orm-json-scalars.js';
 import { type SequenceApi } from './sdk.js';
 export interface ArtifactOrmExecutorConfig {
     namespace: string;
     /** The generated operations.manifest.json, validated before any host call. */
-    manifest: unknown;
+    manifest?: unknown;
     /** Optional action-scoped host client (for example, withTraceAction's client). */
     sdk?: {
         api: Pick<SequenceApi, 'fetch'>;
@@ -21,4 +21,4 @@ export interface ArtifactOrmExecutorConfig {
  * Declare the namespace path in capabilities.api.write (queries also use POST).
  * Namespace grants, capabilities, row policies, and write checks still apply.
  */
-export declare function createArtifactOrmExecutor({ namespace, manifest, sdk, jsonScalars }: ArtifactOrmExecutorConfig): OperationExecutor;
+export declare function createArtifactOrmExecutor({ namespace, manifest, sdk, jsonScalars }: ArtifactOrmExecutorConfig): SqlOperationExecutor;

package/dist/server/internal/verify-any.d.ts

@@ -1,5 +1,19 @@
 import { type ArtifactGatewayPublicKeys, type ArtifactRequestContext, type RequestContextV2External } from '../request-context.js';
 export type AnyArtifactRequestContext = ArtifactRequestContext | RequestContextV2External;
+/**
+ * Optional human-directory prefetch for hosted admission, never an authorization result. The
+ * signed project is not yet bound to the credential's database record. After loading that record,
+ * the caller must still run its ordinary verifier with the runtime's keys and authoritative
+ * project, rechecking the clock after the await. Ineligible or invalid contexts return null so
+ * credential failures and external admission keep their existing checks and error ordering.
+ */
+export declare function preverifyHostedBrowserContext({ token, publicKeys, environment, deploymentId, now }: {
+    token: string | null;
+    publicKeys: ArtifactGatewayPublicKeys;
+    environment: string;
+    deploymentId: string;
+    now?: number;
+}): ArtifactRequestContext | null;
 /**
  * Version-dispatching verifier for platform code that must accept both Atlas-user (v1) and
  * external (v2) contexts, such as the broker. Applications never get this: it is not exported

package/dist/server/internal/verify-any.js

@@ -1,7 +1,33 @@
-import { ArtifactContextError, requestContextV2ExternalSchema, } from '../request-context.js';
+import { ArtifactContextError, ARTIFACT_SERVICE_ACCOUNT_SUB_PREFIX, artifactRequestContextSchema, requestContextV2ExternalSchema, } from '../request-context.js';
 import { ARTIFACT_EXTERNAL_CONTEXT_KID_PREFIX, verifySignedContext } from './signed-token.js';
 import { parseV1Context } from './v1-context.js';
 import { canonicalizeIngressPath, signedIngressPath } from '../ingress-routes.js';
+/**
+ * Optional human-directory prefetch for hosted admission, never an authorization result. The
+ * signed project is not yet bound to the credential's database record. After loading that record,
+ * the caller must still run its ordinary verifier with the runtime's keys and authoritative
+ * project, rechecking the clock after the await. Ineligible or invalid contexts return null so
+ * credential failures and external admission keep their existing checks and error ordering.
+ */
+export function preverifyHostedBrowserContext({ token, publicKeys, environment, deploymentId, now = Math.floor(Date.now() / 1000) }) {
+    try {
+        const { kid, payload } = verifySignedContext({ token, publicKeys });
+        if (kid.startsWith(ARTIFACT_EXTERNAL_CONTEXT_KID_PREFIX))
+            return null;
+        const parsed = artifactRequestContextSchema.safeParse(payload);
+        if (!parsed.success)
+            return null;
+        const context = parsed.data;
+        if (context.mode === 'development' || context.deploymentId !== deploymentId ||
+            context.sub.startsWith(ARTIFACT_SERVICE_ACCOUNT_SUB_PREFIX))
+            return null;
+        // Self-binding is safe only for this prefetch: ordinary admission binds the stored project.
+        return parseV1Context({ payload: context, projectId: context.projectId, environment, now });
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Version-dispatching verifier for platform code that must accept both Atlas-user (v1) and
  * external (v2) contexts, such as the broker. Applications never get this: it is not exported

package/dist/source-resolver.js

@@ -5,7 +5,7 @@ import { tmpdir } from 'node:os';
 import { isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { createScrubbedChildEnv } from './child-environment.js';
 import { materializeRepo, resolveCommitSha, resolveRepo } from './git-service-client.js';
-import { gitServiceCloneUrl, resolveGitPatFromEnv, runGitClone } from './git-clone.js';
+import { gitServiceCloneUrl, runGitClone } from './git-clone.js';
 /** True for sources that must be fetched from a remote (git-service / git-url). */
 export function isRemoteSpec(spec) {
     return spec.kind !== 'local';
@@ -136,21 +136,12 @@ export async function resolveArtifactSource(spec, opts = {}) {
                 console.log(`[seq-studio] source: ${spec.namespace}/${spec.name}@${ref} (${sha.slice(0, 10)}, ${count} file(s), M2M)`);
                 return await materialized({ gitCommit: sha, gitBranch: ref, gitDirty: false });
             }
-            // Human path: materialize via a smart-HTTP `git clone` (one pack
-            // transfer). The earlier per-blob JSON walk was O(files) serial HTTP
-            // round-trips and stalled/failed on large artifacts. Smart-HTTP
-            // authenticates by PAT (Basic-auth password), NOT the Auth0 bearer — the
-            // same token you clone the repo with. No PAT, no git workflow.
-            const pat = resolveGitPatFromEnv();
-            if (pat) {
-                const cloneUrl = gitServiceCloneUrl(opts.baseUrl, repo.id);
-                await runGitClone({ cloneUrl, destDir: dest, pat, ref: sha });
-                console.log(`[seq-studio] source: ${spec.namespace}/${spec.name}@${ref} (${sha.slice(0, 10)}, git clone)`);
-                return await materialized({ gitCommit: sha, gitBranch: ref, gitDirty: false });
-            }
-            throw new Error('Deploying from --repo requires a git PAT. Set ATLAS_GIT_PAT to a token with the ' +
-                'repo:read scope (create one in Atlas → Settings → Tokens, or `seq-studio auth pat create`). ' +
-                'The git-service clone uses smart-HTTP, which authenticates by PAT — the same token you clone the repo with.');
+            // Use the same selected human identity for metadata and Git transport.
+            // An ambient PAT must not silently change the principal on the clone.
+            const cloneUrl = gitServiceCloneUrl(opts.baseUrl, repo.id);
+            await runGitClone({ cloneUrl, destDir: dest, pat: opts.token, ref: sha });
+            console.log(`[seq-studio] source: ${spec.namespace}/${spec.name}@${ref} (${sha.slice(0, 10)}, git clone)`);
+            return await materialized({ gitCommit: sha, gitBranch: ref, gitDirty: false });
         }
         const { sha, branch } = cloneGitUrl(spec.url, spec.ref, dest);
         console.log(`[seq-studio] source: ${redactGitUrl(spec.url)}${spec.ref ? `@${spec.ref}` : ''} (${sha.slice(0, 10)})`);

package/dist/templates/nextjs/README.md

@@ -179,6 +179,13 @@ own test credentials, mocks or an existing governed function. Use a hosted
 preview for application code that needs a managed secret. Never put secrets in
 `build.public_env`, `NEXT_PUBLIC_*`, client components or committed files.
 
+Cookies your application sets itself should use a `__Host-` name with `Secure`,
+`HttpOnly`, `Path=/` and no `Domain`. Applications on one deployment share a
+registrable domain, and only a `__Host-` cookie is guaranteed to come from your
+own origin rather than a neighbour's. When the application origin is on a
+different site from its Atlas frame, a cookie it needs there must also be
+`SameSite=None; Partitioned`, or the browser drops it.
+
 The local process is ordinary code running as your operating-system user.
 Atlas governs access to platform resources; it does not sandbox your laptop's
 filesystem or all outbound network connections.

package/dist/templates/react-vite/package.json

@@ -9,7 +9,7 @@
   },
   "dependencies": {},
   "devDependencies": {
-    "@sequenceholdings/artifact-studio": "^0.6.0",
+    "@sequenceholdings/artifact-studio": "^0.7.0",
     "@sequenceholdings/atlas-ui": "^3.1.1",
     "@tailwindcss/postcss": "^4.2.2",
     "@tailwindcss/vite": "^4.2.2",

package/dist/trusted-install.d.ts

@@ -7,7 +7,14 @@ export declare const PNPM_WORKSPACE_FILE_RE: RegExp;
 /** Platform peers the CLI aliases at build time — must not be prod-installed remotely. */
 export declare const REMOTE_INSTALL_PLATFORM_PACKAGES: Set<string>;
 /**
- * Reject install-control files and non-registry dependency specs before a remote
- * `pnpm install` runs on an untrusted git checkout.
+ * Trust gate for remote static React/Vite artifact installs (called by
+ * `prepare-build.ts` before `pnpm install`); also reused for remote process repos.
+ * It rejects install-control files and non-registry dependency specs.
+ *
+ * Hosted Next.js builds use `prepareHostedBuildSource` in Atlas
+ * `next-hosted/source-policy.ts` and a controlled install workspace from
+ * `hostedInstallWorkspace` in `next-hosted/release-age.ts` instead. Do not apply
+ * this static gate to a Next.js template: its workspace file and approved
+ * platform dependencies follow the hosted policy.
  */
 export declare function assertTrustedArtifactInstallTree(dir: string): void;

package/dist/trusted-install.js

@@ -225,8 +225,15 @@ function assertChainguardLockfile(dir) {
     assertParsedPackageResolutions(lockfileText);
 }
 /**
- * Reject install-control files and non-registry dependency specs before a remote
- * `pnpm install` runs on an untrusted git checkout.
+ * Trust gate for remote static React/Vite artifact installs (called by
+ * `prepare-build.ts` before `pnpm install`); also reused for remote process repos.
+ * It rejects install-control files and non-registry dependency specs.
+ *
+ * Hosted Next.js builds use `prepareHostedBuildSource` in Atlas
+ * `next-hosted/source-policy.ts` and a controlled install workspace from
+ * `hostedInstallWorkspace` in `next-hosted/release-age.ts` instead. Do not apply
+ * this static gate to a Next.js template: its workspace file and approved
+ * platform dependencies follow the hosted policy.
  */
 export function assertTrustedArtifactInstallTree(dir) {
     for (const rel of listRelativeFiles(dir)) {

package/package.json

@@ -9,7 +9,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.6.6",
+  "version": "0.7.0",
   "description": "SDK types and CLI library for building Artifact Studio apps. Driven via `seq-studio artifact <sub>` (@sequenceholdings/studio-cli), which runs the `./cli` runCli export.",
   "type": "module",
   "exports": {
@@ -167,8 +167,8 @@
     "server-only": "0.0.1",
     "parse5": "7.3.0",
     "@sequenceholdings/lattice-form-renderer": "0.2.0",
-    "@sequenceholdings/orm": "2.5.0",
-    "@sequenceholdings/storage": "0.1.1"
+    "@sequenceholdings/storage": "0.1.1",
+    "@sequenceholdings/orm": "2.6.0"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",

package/templates/nextjs/README.md

@@ -179,6 +179,13 @@ own test credentials, mocks or an existing governed function. Use a hosted
 preview for application code that needs a managed secret. Never put secrets in
 `build.public_env`, `NEXT_PUBLIC_*`, client components or committed files.
 
+Cookies your application sets itself should use a `__Host-` name with `Secure`,
+`HttpOnly`, `Path=/` and no `Domain`. Applications on one deployment share a
+registrable domain, and only a `__Host-` cookie is guaranteed to come from your
+own origin rather than a neighbour's. When the application origin is on a
+different site from its Atlas frame, a cookie it needs there must also be
+`SameSite=None; Partitioned`, or the browser drops it.
+
 The local process is ordinary code running as your operating-system user.
 Atlas governs access to platform resources; it does not sandbox your laptop's
 filesystem or all outbound network connections.

package/templates/react-vite/package.json

@@ -9,7 +9,7 @@
   },
   "dependencies": {},
   "devDependencies": {
-    "@sequenceholdings/artifact-studio": "^0.6.0",
+    "@sequenceholdings/artifact-studio": "^0.7.0",
     "@sequenceholdings/atlas-ui": "^3.1.1",
     "@tailwindcss/postcss": "^4.2.2",
     "@tailwindcss/vite": "^4.2.2",