@sequenceholdings/artifact-studio 0.6.7 → 0.7.0

package/README.md

@@ -5,6 +5,28 @@ requests use the current user's normal permissions.
 
 ## Governed ORM operations
 
+### Default SQL (planned SDK 0.7.0)
+
+With the matching Atlas runtime, no operation manifest or registration is needed
+for read-only runtime SQL:
+
+```ts
+const orm = createArtifactOrmExecutor({ namespace: 'lending' })
+const result = await orm.sql({
+  sql: `SELECT l.id, c.name FROM lending.loans l
+    JOIN party.customers c ON c.id = l."customerId"`,
+})
+```
+
+Keep the namespace bridge path declaration below. Caller permissions, row
+policies, foreign export gates and optional ontology consumer contracts still
+apply. Results contain `columns`, array-valued `rows`, and `truncated`; exact
+numeric/bigint values are strings. Queries are capped at 1,000 rows / 8 MiB.
+This prerelease source requires package publication and the matching server
+rollout. The generated-manifest path below remains backward-compatible.
+
+### Registered operations
+
 Use the published caller-aware adapter inside an Artifact Studio Preview or a
 deployed artifact. Generate and apply the namespace first, then import its
 `operations.manifest.json` into your application:
@@ -73,7 +95,10 @@ queries still need every table they read, and mutations still need write reach.
 The Next.js host routes ORM requests through this data contract; no additional
 API path declaration is needed. The POST transport does not grant mutation authority.
 
-The allowlist admits registered persisted operations only. Autogenerated
+The allowlist admits registered persisted operations and the server-owned
+`<namespace>/ops/BuiltinSqlRead` identity when explicitly listed. Default SQL
+still needs all of its table read reach and caller policies; listing it does
+not grant arbitrary database access. Autogenerated
 `DatasetPreview_*` hashes are excluded even if a registered operation has the
 same name. Operation admission retains the existing active and previous
 operation-set fallback; the allowlist pins names, not one content hash. Give a

package/dist/cli.js

@@ -58,12 +58,10 @@ const USAGE = `usage:
   trees; feature branches and dirty source trees remain preview-only for
   deployed environments (\`artifact dev\` / preview channel).
 
-  Interactive --repo builds clone over smart-HTTP and require a repo:read git
-  PAT in ATLAS_GIT_PAT — create one with \`seq-studio auth pat create --scopes
-  repo:read\` or in Atlas → Settings → Tokens. Headless M2M builds use JSON
-  materialize and accept only platform-managed --repo sources. (--env +
-  seq-studio login are still needed to resolve the repo and upload the
-  deployment.)
+  Interactive --repo builds clone over smart-HTTP using your seq-studio login
+  and repository read access. No PAT is needed. Headless M2M builds use JSON
+  materialize and accept only platform-managed --repo sources. Use --env to
+  select the same environment for source and deployment.
 
   Next.js: init --template nextjs, then pnpm install with Node.js 24. dev starts
   a local Next server and an owner-only Atlas preview tunnel (no cloud credentials).

package/dist/gateway/abort.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Settles with `work`, or rejects with the signal's reason as soon as it aborts. For work
+ * that cannot itself be cancelled (google-auth-library token refreshes): the caller stops
+ * waiting at its deadline, and the abandoned work still settles, with its rejection handled.
+ */
+export declare function untilAborted<T>(work: Promise<T>, signal: AbortSignal): Promise<T>;

package/dist/gateway/abort.js

@@ -0,0 +1,16 @@
+/**
+ * Settles with `work`, or rejects with the signal's reason as soon as it aborts. For work
+ * that cannot itself be cancelled (google-auth-library token refreshes): the caller stops
+ * waiting at its deadline, and the abandoned work still settles, with its rejection handled.
+ */
+export function untilAborted(work, signal) {
+    if (signal.aborted) {
+        work.catch(() => undefined);
+        return Promise.reject(signal.reason);
+    }
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(signal.reason);
+        signal.addEventListener('abort', onAbort, { once: true });
+        work.then((value) => { signal.removeEventListener('abort', onAbort); resolve(value); }, (error) => { signal.removeEventListener('abort', onAbort); reject(error); });
+    });
+}

package/dist/gateway/authorization-cache.d.ts

@@ -10,6 +10,10 @@ type Lookup<T> = {
     load: () => Promise<T>;
     notAfter: (value: T) => number;
 };
+export type SeedReservation = {
+    readonly sequence: number;
+    readonly askedAt: number;
+};
 /**
  * Per-process, positive-only decision cache with single-flight loading: the burst of chunk
  * requests behind one page load costs one control-plane call per gateway replica per window.
@@ -31,11 +35,31 @@ export declare class PositiveDecisionCache<T> {
     });
     /** `notAfter` bounds the entry by the decision's own validity, such as a session's expiry. */
     get(lookup: Lookup<T>): Promise<T>;
+    /** The decision source is observed without another lookup or a wrapper around its promise. */
+    getObserved(lookup: Lookup<T>): {
+        promise: Promise<T>;
+        source: 'hit' | 'shared' | 'load';
+    };
     /**
      * Always asks the source, for decisions that must be current (a mutation). An allow refreshes the
      * cached entry; a refusal evicts it and fences older lookups, so the next read asks again too.
      */
     refresh(lookup: Lookup<T>): Promise<T>;
+    /**
+     * Places a question asked through another call, such as a ticket exchange, in this cache's order.
+     * Reserve before asking, then {@link seed} the answer.
+     */
+    reserve(): SeedReservation;
+    /**
+     * Stores an allow returned for a {@link reserve}d question. It ages from when that question was
+     * asked, and an answer asked later for the same key, a refusal included, is never replaced by it.
+     */
+    seed({ key, value, asked, notAfter }: {
+        key: string;
+        value: T;
+        asked: SeedReservation;
+        notAfter: (value: T) => number;
+    }): void;
     clear(): void;
     private ask;
     private record;

package/dist/gateway/authorization-cache.js

@@ -31,13 +31,17 @@ export class PositiveDecisionCache {
     }
     /** `notAfter` bounds the entry by the decision's own validity, such as a session's expiry. */
     get(lookup) {
+        return this.getObserved(lookup).promise;
+    }
+    /** The decision source is observed without another lookup or a wrapper around its promise. */
+    getObserved(lookup) {
         const cached = this.entries.get(lookup.key);
         if (cached && !cached.refused && cached.expiresAt > this.now())
-            return Promise.resolve(cached.value);
+            return { promise: Promise.resolve(cached.value), source: 'hit' };
         const inFlight = this.pending.get(lookup.key);
         if (inFlight)
-            return inFlight.promise;
-        return this.ask({ lookup, share: true });
+            return { promise: inFlight.promise, source: 'shared' };
+        return { promise: this.ask({ lookup, share: true }), source: 'load' };
     }
     /**
      * Always asks the source, for decisions that must be current (a mutation). An allow refreshes the
@@ -46,6 +50,20 @@ export class PositiveDecisionCache {
     refresh(lookup) {
         return this.ask({ lookup, share: false });
     }
+    /**
+     * Places a question asked through another call, such as a ticket exchange, in this cache's order.
+     * Reserve before asking, then {@link seed} the answer.
+     */
+    reserve() {
+        return { sequence: ++this.sequence, askedAt: this.now() };
+    }
+    /**
+     * Stores an allow returned for a {@link reserve}d question. It ages from when that question was
+     * asked, and an answer asked later for the same key, a refusal included, is never replaced by it.
+     */
+    seed({ key, value, asked, notAfter }) {
+        this.record({ key, entry: { sequence: asked.sequence, refused: false, value, expiresAt: Math.min(asked.askedAt + this.ttlMs, notAfter(value)) } });
+    }
     clear() {
         this.entries.clear();
         this.pending.clear();

package/dist/gateway/bootstrap-page.d.ts

@@ -0,0 +1,16 @@
+import type { ServerResponse } from 'node:http';
+/**
+ * Where the frame lands once the ticket is exchanged: the host's deep link when it is a path on
+ * this origin, else the application root. Landing on the route directly spares the application a
+ * root render (and any root redirect) followed by a client navigation once the bridge connects.
+ * Returns the validated absolute URL, never a path the browser would parse again: a path that
+ * normalizes to `//host` would otherwise read as protocol-relative and leave the application.
+ * The page embeds this function's source, so it must stay self-contained.
+ */
+export declare function bootstrapLandingUrl(route: string | null, origin: string): string;
+/** The bootstrap ticket travels in a fragment and a POST body, never a request URL or log. The page
+ * exchanges it only inside the Atlas frame; browsers without Fetch Metadata are covered by the script check. */
+export declare function bootstrapPage({ response, parentOrigin }: {
+    response: ServerResponse;
+    parentOrigin: string;
+}): void;

package/dist/gateway/bootstrap-page.js

@@ -0,0 +1,34 @@
+import { randomBytes } from 'node:crypto';
+/**
+ * Where the frame lands once the ticket is exchanged: the host's deep link when it is a path on
+ * this origin, else the application root. Landing on the route directly spares the application a
+ * root render (and any root redirect) followed by a client navigation once the bridge connects.
+ * Returns the validated absolute URL, never a path the browser would parse again: a path that
+ * normalizes to `//host` would otherwise read as protocol-relative and leave the application.
+ * The page embeds this function's source, so it must stay self-contained.
+ */
+export function bootstrapLandingUrl(route, origin) {
+    const root = origin + '/';
+    if (typeof route !== 'string' || route.length > 2048 || !route.startsWith('/') || route.startsWith('//') || route.includes('\\'))
+        return root;
+    try {
+        const url = new URL(route, origin);
+        if (url.origin !== origin || url.pathname.startsWith('//') || url.pathname.startsWith('/_sequence'))
+            return root;
+        return url.href;
+    }
+    catch {
+        return root;
+    }
+}
+/** The bootstrap ticket travels in a fragment and a POST body, never a request URL or log. The page
+ * exchanges it only inside the Atlas frame; browsers without Fetch Metadata are covered by the script check. */
+export function bootstrapPage({ response, parentOrigin }) {
+    const nonce = randomBytes(24).toString('base64');
+    response.writeHead(200, {
+        'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', 'referrer-policy': 'no-referrer',
+        'x-content-type-options': 'nosniff',
+        'content-security-policy': `default-src 'none'; script-src 'nonce-${nonce}'; connect-src 'self'; frame-ancestors ${parentOrigin}; base-uri 'none'; form-action 'none'`,
+    });
+    response.end(`<!doctype html><meta charset="utf-8"><title>Connecting application</title><p id="status">Connecting application…</p><script nonce="${nonce}">(() => {const landing=${bootstrapLandingUrl.toString()};const fragment=new URLSearchParams(location.hash.slice(1));const ticket=fragment.get('ticket');history.replaceState(null,'',location.pathname);if(!ticket||window.top===window){document.getElementById('status').textContent='Open this application from Atlas.';return;}fetch('/_sequence/session',{method:'POST',credentials:'same-origin',headers:{'content-type':'application/json'},body:JSON.stringify({ticket})}).then(r=>{if(!r.ok)throw new Error();location.replace(landing(fragment.get('route'),location.origin));}).catch(()=>{document.getElementById('status').textContent='This preview expired. Open it again from Atlas.';});})();</script>`);
+}

package/dist/gateway/control-config.d.ts

@@ -0,0 +1,21 @@
+import type { GatewayControlIdentity } from './control.js';
+export interface GatewayControlConfig {
+    /** Where the gateway calls Atlas: its public origin, or its private Cloud Run address. */
+    url: string;
+    /** The Atlas origin allowed to frame applications. */
+    parentOrigin: string;
+    /** Absent only for a local gateway: the shared control token authenticates its calls. */
+    identity?: GatewayControlIdentity;
+}
+/**
+ * A deployed gateway presents its service account's identity token, the only gateway
+ * credential a deployed Atlas accepts. A local gateway has no metadata server to mint one,
+ * so it presents the shared control token, which only a local Atlas accepts. Cloud Run sets
+ * K_SERVICE, so a mislabelled deployment never falls back to the shared token. The token's
+ * audience is the parent origin's control path: the public origin Atlas also derives it
+ * from, whichever address the call is routed to.
+ */
+export declare function resolveGatewayControlConfig({ env, identityToken }: {
+    env: NodeJS.ProcessEnv;
+    identityToken: GatewayControlIdentity['token'];
+}): GatewayControlConfig;

package/dist/gateway/control-config.js

@@ -0,0 +1,18 @@
+import { artifactNextControlAudience } from '../runtime-contracts.js';
+/**
+ * A deployed gateway presents its service account's identity token, the only gateway
+ * credential a deployed Atlas accepts. A local gateway has no metadata server to mint one,
+ * so it presents the shared control token, which only a local Atlas accepts. Cloud Run sets
+ * K_SERVICE, so a mislabelled deployment never falls back to the shared token. The token's
+ * audience is the parent origin's control path: the public origin Atlas also derives it
+ * from, whichever address the call is routed to.
+ */
+export function resolveGatewayControlConfig({ env, identityToken }) {
+    const url = env.ARTIFACT_NEXT_CONTROL_PLANE_URL?.trim();
+    if (!url)
+        throw new Error('Missing required gateway configuration: ARTIFACT_NEXT_CONTROL_PLANE_URL');
+    const parentOrigin = env.ARTIFACT_NEXT_PARENT_ORIGIN?.trim() || new URL(url).origin;
+    if (env.APP_ENV === 'development' && !env.K_SERVICE)
+        return { url, parentOrigin };
+    return { url, parentOrigin, identity: { audience: artifactNextControlAudience(parentOrigin), token: identityToken } };
+}

package/dist/gateway/control.d.ts

@@ -115,15 +115,27 @@ export declare class IngressControlError extends GatewayControlError {
     readonly retryAfterSeconds?: number | undefined;
     constructor(status: number, code: IngressControlCode | null, retryAfterSeconds?: number | undefined);
 }
+/** Calls Atlas with the gateway service account's identity token instead of the shared control token. */
+export interface GatewayControlIdentity {
+    audience: string;
+    token: (input: {
+        audience: string;
+        signal: AbortSignal;
+    }) => Promise<string>;
+}
 export declare class ArtifactGatewayControl {
     private readonly options;
     private readonly origin;
+    /** `token` stays required with an identity: Atlas still presents it when it calls the gateway (tokenMatches). */
     constructor(options: {
         url: string;
         token: string;
+        identity?: GatewayControlIdentity;
         fetch?: typeof fetch;
     });
     private call;
+    /** An identity token that cannot be minted is an unavailable control plane, never a call without credentials. */
+    private credential;
     private send;
     /** Every enabled ingress host (GET, at most 1 MiB); the gateway pulls it on a timer, never per request. */
     ingressSnapshot(): Promise<IngressSnapshot>;

package/dist/gateway/control.js

@@ -2,7 +2,8 @@ import { createHash, timingSafeEqual } from 'node:crypto';
 import { z } from 'zod';
 import { normalizePublicOrigin } from '../tunnel/protocol.js';
 import { artifactRequestContextSchema } from '../server/request-context.js';
-import { artifactNextFrameworkBuildIdSchema } from '../runtime-contracts.js';
+import { ARTIFACT_NEXT_CONTROL_PATH, artifactNextFrameworkBuildIdSchema } from '../runtime-contracts.js';
+import { untilAborted } from './abort.js';
 import { INGRESS_SNAPSHOT_MAX_BYTES, ingressExchangeResponseSchema, ingressGrantResponseSchema, ingressSnapshotSchema, } from '../server/ingress-control-contract.js';
 const id = z.string().min(1).max(255);
 const base = {
@@ -94,6 +95,7 @@ async function ingressRefusal(response) {
 export class ArtifactGatewayControl {
     options;
     origin;
+    /** `token` stays required with an identity: Atlas still presents it when it calls the gateway (tokenMatches). */
     constructor(options) {
         this.options = options;
         this.origin = normalizePublicOrigin(options.url);
@@ -103,11 +105,26 @@ export class ArtifactGatewayControl {
     call(path, body, timeoutMs = 10_000) {
         return this.send({ path, body, timeoutMs, maxBytes: 128 * 1024 });
     }
+    /** An identity token that cannot be minted is an unavailable control plane, never a call without credentials. */
+    async credential(signal) {
+        const identity = this.options.identity;
+        if (!identity)
+            return this.options.token;
+        // The token source may ignore `signal`; the call's own deadline still bounds the wait.
+        try {
+            return await untilAborted(identity.token({ audience: identity.audience, signal }), signal);
+        }
+        catch {
+            throw new GatewayControlError(503);
+        }
+    }
     async send({ path, body, timeoutMs, maxBytes, ingress = false }) {
-        const response = await (this.options.fetch ?? fetch)(`${this.origin}/api/artifact-studio/next/control/${path}`, {
+        const signal = AbortSignal.timeout(timeoutMs);
+        const credential = await this.credential(signal);
+        const response = await (this.options.fetch ?? fetch)(`${this.origin}${ARTIFACT_NEXT_CONTROL_PATH}/${path}`, {
             method: body === undefined ? 'GET' : 'POST',
-            headers: { authorization: `Bearer ${this.options.token}`, ...(body === undefined ? {} : { 'content-type': 'application/json' }) },
-            ...(body === undefined ? {} : { body: JSON.stringify(body) }), signal: AbortSignal.timeout(timeoutMs), redirect: 'error',
+            headers: { authorization: `Bearer ${credential}`, ...(body === undefined ? {} : { 'content-type': 'application/json' }) },
+            ...(body === undefined ? {} : { body: JSON.stringify(body) }), signal, redirect: 'error',
         });
         if (!response.ok)
             throw ingress ? await ingressRefusal(response) : new GatewayControlError(response.status);

package/dist/gateway/hosted-proxy.d.ts

@@ -1,6 +1,7 @@
 import { type IncomingMessage, type ServerResponse } from 'node:http';
 import { type HostedArtifactIngressMode } from './ingress-response.js';
 import { type HostedRuntimeTarget } from './runtime-transport.js';
+import { type GatewayTimings } from './usage.js';
 export { cloudRunOrigin, resolveHostedTarget, type HostedRuntimeTarget } from './runtime-transport.js';
 export declare const HOSTED_ARTIFACT_PROXY_LIMITS: Readonly<{
     maxRequestBytes: number;
@@ -35,6 +36,8 @@ export interface HostedArtifactProxyOptions {
     };
     /** Present only for an external ingress request. */
     ingress?: HostedArtifactIngressMode;
+    /** Request-local observations; the caller snapshots them when recording usage. */
+    gatewayTimings?: GatewayTimings;
 }
 export declare function hostedIdentityToken(input: {
     audience: string;

package/dist/gateway/hosted-proxy.js

@@ -8,6 +8,7 @@ import { enforceBrowserCachePolicy, mergeFramePolicy, rewriteLocation } from './
 import { createReleaseFormTransform } from '../server/release-forms.js';
 import { declaredContentLength, INGRESS_PROXY_ERROR_CODES, INGRESS_PROXY_LIMITS, writeIngressResponseHead } from './ingress-response.js';
 import { resolveHostedTarget } from './runtime-transport.js';
+import { gatewayElapsedMs } from './usage.js';
 export { cloudRunOrigin, resolveHostedTarget } from './runtime-transport.js';
 export const HOSTED_ARTIFACT_PROXY_LIMITS = Object.freeze({ maxRequestBytes: 32 * 1024 * 1024, maxResponseBytes: 32 * 1024 * 1024, timeoutMs: 60_000, maxTimeoutMs: 300_000 });
 const googleAuth = new GoogleAuth();
@@ -129,7 +130,11 @@ class HostedExchange {
         stripCloudHeaders(headers);
         if (audience) {
             const provider = this.options.identityTokenProvider ?? defaultIdentityTokenProvider;
-            const token = await provider({ audience: audience.origin, signal: this.controller.signal });
+            const identityStarted = performance.now();
+            const token = await provider({ audience: audience.origin, signal: this.controller.signal }).finally(() => {
+                if (!this.stopped && this.options.gatewayTimings)
+                    this.options.gatewayTimings.identityTokenMs = gatewayElapsedMs(identityStarted);
+            });
             if (this.stopped)
                 return;
             if (!/^[A-Za-z0-9._~-]+$/.test(token) || token.length > 16384)
@@ -145,7 +150,12 @@ class HostedExchange {
         headers['x-sequence-artifact-context'] = requestContext;
         const destination = this.resolveDestination(upstream);
         const transport = destination.protocol === 'https:' ? httpsRequest : httpRequest;
-        this.outgoing = transport(destination, { method: request.method, path: request.url, headers, maxHeaderSize: 32 * 1024 }, (incoming) => this.receive({ incoming, upstream, publicOrigin }));
+        const upstreamStarted = performance.now();
+        this.outgoing = transport(destination, { method: request.method, path: request.url, headers, maxHeaderSize: 32 * 1024 }, (incoming) => {
+            if (!this.stopped && this.options.gatewayTimings)
+                this.options.gatewayTimings.upstreamHeadersMs = gatewayElapsedMs(upstreamStarted);
+            this.receive({ incoming, upstream, publicOrigin });
+        });
         this.outgoing.on('error', () => this.fail(this.unavailableStatus));
         this.outgoing.once('upgrade', (_incoming, socket) => { socket.destroy(); this.fail(502); });
         this.outgoing.on('drain', () => { if (!this.stopped)

package/dist/gateway/server.d.ts

@@ -11,7 +11,7 @@ export interface ArtifactGatewayOptions {
     parentOrigin: string;
     gatewayOrigin: string;
     sessionKey: string;
-    /** Defaults to `Strict`. `None` only for a local development gateway (see GatewaySessionSameSite). */
+    /** Defaults to `Strict`; `None` when app origins are cross-site to Atlas (see gatewaySessionSameSite). */
     sessionCookieSameSite?: GatewaySessionSameSite;
     contextPrivateKey: string;
     contextKeyId: string;

package/dist/gateway/server.js

@@ -1,4 +1,4 @@
-import { createPrivateKey, randomBytes, randomUUID } from 'node:crypto';
+import { createPrivateKey, randomUUID } from 'node:crypto';
 import { createServer } from 'node:http';
 import { z } from 'zod';
 import { ArtifactTunnelBroker } from '../tunnel/index.js';
@@ -6,12 +6,13 @@ import { assertSafeRequest, normalizePublicOrigin } from '../tunnel/protocol.js'
 import { GatewayControlError } from './control.js';
 import { decodeGatewaySession, gatewaySessionCookies, renewGatewaySession, signGatewayContext } from './session.js';
 import { proxyHostedArtifact } from './hosted-proxy.js';
+import { bootstrapPage } from './bootstrap-page.js';
 import { routeSequenceRequest } from './lattice-invoke.js';
 import { admitHostedMutation, ReleaseAdmissionError } from './release-admission.js';
 import { ArtifactAdmissionError } from './admission.js';
 import { gatewayClientAddress } from './control-admission.js';
 import { gatewayAuthorizationKey, PositiveDecisionCache, tunnelAuthorizationKey } from './authorization-cache.js';
-import { GatewayUsageReporter } from './usage.js';
+import { gatewayElapsedMs, GatewayUsageReporter, snapshotGatewayTimings } from './usage.js';
 import { artifactNextFrameworkBuildIdSchema } from '../runtime-contracts.js';
 import { createDevelopmentIngressProxy } from './ingress-development.js';
 import { createIngressHandler, handleClientErrors } from './ingress-handler.js';
@@ -73,17 +74,6 @@ async function boundedJson(request) {
     }
     return JSON.parse(Buffer.concat(chunks).toString('utf8'));
 }
-/** The bootstrap ticket travels in a fragment and a POST body, never a request URL or log. The page
- * exchanges it only inside the Atlas frame; browsers without Fetch Metadata are covered by the script check. */
-function bootstrapPage({ response, parentOrigin }) {
-    const nonce = randomBytes(24).toString('base64');
-    response.writeHead(200, {
-        'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', 'referrer-policy': 'no-referrer',
-        'x-content-type-options': 'nosniff',
-        'content-security-policy': `default-src 'none'; script-src 'nonce-${nonce}'; connect-src 'self'; frame-ancestors ${parentOrigin}; base-uri 'none'; form-action 'none'`,
-    });
-    response.end(`<!doctype html><meta charset="utf-8"><title>Connecting application</title><p id="status">Connecting application…</p><script nonce="${nonce}">(() => {const ticket=new URLSearchParams(location.hash.slice(1)).get('ticket');history.replaceState(null,'',location.pathname);if(!ticket||window.top===window){document.getElementById('status').textContent='Open this application from Atlas.';return;}fetch('/_sequence/session',{method:'POST',credentials:'same-origin',headers:{'content-type':'application/json'},body:JSON.stringify({ticket})}).then(r=>{if(!r.ok)throw new Error();location.replace('/');}).catch(()=>{document.getElementById('status').textContent='This preview expired. Open it again from Atlas.';});})();</script>`);
-}
 /** Probes reach the container by its own address; an application host keeps its own /health route. */
 function isReadinessRequest({ request, gatewayOrigin, runtimeDomain }) {
     if (request.method !== 'GET')
@@ -132,15 +122,18 @@ export function createArtifactGateway(options) {
         const { ticket } = z.object({ ticket: z.string().regex(/^[A-Za-z0-9_-]{43}$/) }).strict().parse(await boundedJson(request));
         // Anyone can post a ticket: rate limit and admit before the exchange reaches Atlas.
         const release = await admitControlCall('session', request);
-        let session;
+        let session, target;
+        const asked = authorizations.reserve();
         try {
-            ({ session } = await options.control.bootstrap(ticket));
+            ({ session, target } = await options.control.bootstrap(ticket));
         }
         finally {
             release();
         }
         if (session.publicOrigin !== origin || session.bridge.parentOrigin !== parentOrigin)
             throw new GatewayControlError(403);
+        // Atlas just authorized this session: the document load that follows reuses it, not a second call.
+        authorizations.seed({ key: gatewayAuthorizationKey(session), value: target, asked, notAfter: value => value.expiresAt });
         response.setHeader('set-cookie', gatewaySessionCookies({ session, key: options.sessionKey, cookie: header(request, 'cookie'), sameSite: options.sessionCookieSameSite }));
         json(response, 200, 'connected');
     }
@@ -186,9 +179,11 @@ export function createArtifactGateway(options) {
         // same session and target for up to the cache TTL (never past the target's own expiry). Mutations
         // always ask Atlas, so revocation, suspension and a changed activation stop them immediately.
         const lookup = { key: gatewayAuthorizationKey(session), load: () => options.control.authorize(session), notAfter: (value) => value.expiresAt };
-        const target = safeMethod ? await authorizations.get(lookup) : await authorizations.refresh(lookup);
+        const decision = safeMethod
+            ? authorizations.getObserved(lookup) : { promise: authorizations.refresh(lookup), source: 'refresh' };
+        const target = await decision.promise;
         const requestId = randomUUID();
-        const result = { session, target, requestId, requestContext: signGatewayContext({
+        const result = { session, target, requestId, authorizationCache: decision.source, requestContext: signGatewayContext({
                 session: { ...session, lattice: target.lattice, taskRoutes: target.taskRoutes }, method, path: request.url ?? '/', privateKey: options.contextPrivateKey, keyId: options.contextKeyId,
                 capabilities: target.capabilities, serviceAccountId: target.serviceAccountId, requestId,
             }) };
@@ -308,7 +303,9 @@ export function createArtifactGateway(options) {
                     request.url = url.pathname + url.search;
                 }
             }
-            const { session, target, requestContext, requestId } = await authorize(request);
+            const authorizationStarted = performance.now();
+            const { session, target, requestContext, requestId, authorizationCache } = await authorize(request);
+            const gatewayTimings = { authorizationMs: gatewayElapsedMs(authorizationStarted), authorizationCache };
             let reported = false;
             const report = () => {
                 if (reported)
@@ -321,6 +318,7 @@ export function createArtifactGateway(options) {
                     measurements: { requestCount: 1, durationMs: Math.max(0, Math.round(performance.now() - started)) },
                     outcome: !response.writableFinished ? 'cancelled' : response.statusCode >= 400 ? 'error' : 'success',
                     httpStatus: response.statusCode,
+                    gatewayTimings: snapshotGatewayTimings(gatewayTimings),
                 });
             };
             response.once('finish', report);
@@ -342,12 +340,14 @@ export function createArtifactGateway(options) {
             }
             if (!options.admission)
                 throw new ArtifactAdmissionError(503, 'admission_unavailable');
-            const admitted = await options.admission.acquire({ environment: target.environment, projectId: target.projectId, deploymentId: target.deploymentId, resources: target.manifest?.server.resources });
+            const admissionStarted = performance.now();
+            const admitted = await options.admission.acquire({ environment: target.environment, projectId: target.projectId, deploymentId: target.deploymentId, resources: target.manifest?.server.resources })
+                .finally(() => { gatewayTimings.admissionMs = gatewayElapsedMs(admissionStarted); });
             admitted.bind(response, () => response.destroy());
             if (response.destroyed)
                 return;
             const { body } = await admitHostedMutation({ request, expectedDeploymentId: target.deploymentId, expectedFrameworkBuildId: target.frameworkBuildId, active: target.active, published: session.published });
-            await proxyHostedArtifact({ request, response, target, requestContext, body, limits: { timeoutMs: admitted.timeoutMs } });
+            await proxyHostedArtifact({ request, response, target, requestContext, body, limits: { timeoutMs: admitted.timeoutMs }, gatewayTimings });
         })().catch(error => {
             options.onError?.({ kind: error instanceof ReleaseAdmissionError ? 'release_mismatch' : error instanceof GatewayControlError ? 'authorization_denied'
                     : error instanceof ArtifactAdmissionError ? 'admission_rejected' : 'request_failed' });

package/dist/gateway/session.d.ts

@@ -38,16 +38,16 @@ export declare function renewGatewaySession({ session, authorizedExpiresAt, now
     now?: number;
 }): GatewaySession | null;
 /**
- * `Strict` everywhere Atlas and the runtime domain are one site, as every deployed environment is.
- * `None` is for the local stack only: Atlas on http://localhost is cross-site to
- * https://*.apps.localhost, so browsers drop a `Strict` cookie inside the preview iframe.
- * Partitioned keeps the relaxed cookie to Atlas's top-level site.
+ * `Strict` when every app origin sits under Atlas's own HTTPS host, so the iframe is same-site with
+ * its parent. Anywhere else — app origins on seqholdingsusercontent.com, or the local stack's
+ * http://localhost Atlas — a browser drops a `Strict` cookie inside the Atlas iframe, so the cookie
+ * is `SameSite=None; Partitioned`: the browser keys it to Atlas's top-level site and never sends it
+ * under any other. Cross-site writes are refused on `Origin` either way, not on SameSite.
  */
 export type GatewaySessionSameSite = 'Strict' | 'None';
-/** Reads ARTIFACT_NEXT_SESSION_COOKIE_SAMESITE; only a development gateway may relax the cookie. */
-export declare function gatewaySessionSameSite({ value, appEnv }: {
-    value: string | undefined;
-    appEnv: string;
+export declare function gatewaySessionSameSite({ parentOrigin, runtimeDomain }: {
+    parentOrigin: string;
+    runtimeDomain: string;
 }): GatewaySessionSameSite;
 export declare function gatewaySessionCookies({ session, key, cookie, renewal, now, sameSite }: {
     session: GatewaySession;

package/dist/gateway/session.js

@@ -39,15 +39,10 @@ export function renewGatewaySession({ session, authorizedExpiresAt, now = Date.n
     const expiresAt = Math.min(authorizedExpiresAt, session.maxExpiresAt ?? session.expiresAt);
     return expiresAt > session.expiresAt ? { ...session, expiresAt } : null;
 }
-/** Reads ARTIFACT_NEXT_SESSION_COOKIE_SAMESITE; only a development gateway may relax the cookie. */
-export function gatewaySessionSameSite({ value, appEnv }) {
-    if (value === undefined || value === '' || value === 'strict')
-        return 'Strict';
-    if (value !== 'none')
-        throw new Error('ARTIFACT_NEXT_SESSION_COOKIE_SAMESITE must be "strict" or "none"');
-    if (appEnv !== 'development')
-        throw new Error('ARTIFACT_NEXT_SESSION_COOKIE_SAMESITE=none is only for a local development gateway');
-    return 'None';
+export function gatewaySessionSameSite({ parentOrigin, runtimeDomain }) {
+    const parent = new URL(parentOrigin);
+    const underParent = runtimeDomain === parent.hostname || runtimeDomain.endsWith(`.${parent.hostname}`);
+    return parent.protocol === 'https:' && underParent ? 'Strict' : 'None';
 }
 function cookieAttributes(sameSite) {
     return `Path=/; HttpOnly; Secure; ${sameSite === 'None' ? 'SameSite=None; Partitioned' : 'SameSite=Strict'}`;

package/dist/gateway/usage.d.ts

@@ -1,3 +1,15 @@
+/** Closed, non-sensitive phase observations. An absent phase did not finish before reporting. */
+export interface GatewayTimings {
+    authorizationMs?: number;
+    authorizationCache?: 'hit' | 'shared' | 'load' | 'refresh';
+    admissionMs?: number;
+    identityTokenMs?: number;
+    /** Transport and app work until response headers, not pure app execution time. */
+    upstreamHeadersMs?: number;
+}
+export declare function gatewayElapsedMs(started: number): number;
+/** Detach the once-only usage event from work that can settle after cancellation. */
+export declare function snapshotGatewayTimings(timings: GatewayTimings): Readonly<GatewayTimings>;
 export interface GatewayUsageEvent {
     eventId: string;
     requestId: string;
@@ -22,6 +34,7 @@ export interface GatewayUsageEvent {
     };
     outcome: 'success' | 'error' | 'cancelled';
     httpStatus: number;
+    gatewayTimings?: Readonly<GatewayTimings>;
 }
 export type GatewayUsageFailure = {
     kind: 'usage_queue_full' | 'usage_delivery_failed' | 'usage_delivery_rejected' | 'usage_events_rejected' | 'usage_lost_on_shutdown';

package/dist/gateway/usage.js

@@ -1,3 +1,21 @@
+const MAX_GATEWAY_TIMING_MS = 600_000;
+export function gatewayElapsedMs(started) {
+    return Math.min(MAX_GATEWAY_TIMING_MS, Math.max(0, Math.round(performance.now() - started)));
+}
+/** Detach the once-only usage event from work that can settle after cancellation. */
+export function snapshotGatewayTimings(timings) {
+    const snapshot = {};
+    const durationKeys = ['authorizationMs', 'admissionMs', 'identityTokenMs', 'upstreamHeadersMs'];
+    for (const key of durationKeys) {
+        const value = timings[key];
+        if (typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 && value <= MAX_GATEWAY_TIMING_MS)
+            snapshot[key] = value;
+    }
+    const source = timings.authorizationCache;
+    if (source === 'hit' || source === 'shared' || source === 'load' || source === 'refresh')
+        snapshot.authorizationCache = source;
+    return Object.freeze(snapshot);
+}
 export const GATEWAY_USAGE_LIMITS = Object.freeze({ capacity: 10_000, maxBatch: 100, flushIntervalMs: 1_000, concurrency: 4 });
 const ATTEMPTS = 3;
 /**

package/dist/gateway-main.js

@@ -2,6 +2,8 @@ import { randomUUID } from 'node:crypto';
 import { isIP } from 'node:net';
 import { Redis } from 'ioredis';
 import { ArtifactGatewayControl } from './gateway/control.js';
+import { resolveGatewayControlConfig } from './gateway/control-config.js';
+import { hostedIdentityToken } from './gateway/hosted-proxy.js';
 import { createArtifactGateway } from './gateway/server.js';
 import { gatewaySessionSameSite } from './gateway/session.js';
 import { RedisTunnelOwnership, RedisTunnelRelay } from './tunnel/redis.js';
@@ -58,9 +60,9 @@ async function main() {
     let stopping = false;
     subscriber.on('ready', () => { if (!stopping)
         void relay.start().catch(() => undefined); });
-    const controlUrl = required('ARTIFACT_NEXT_CONTROL_PLANE_URL');
+    const controlConfig = resolveGatewayControlConfig({ env: process.env, identityToken: hostedIdentityToken });
     const controlToken = required('ARTIFACT_NEXT_CONTROL_TOKEN');
-    const control = new ArtifactGatewayControl({ url: controlUrl, token: controlToken });
+    const control = new ArtifactGatewayControl({ url: controlConfig.url, token: controlToken, identity: controlConfig.identity });
     const contextPrivateKey = required('ARTIFACT_NEXT_CONTEXT_PRIVATE_KEY');
     const contextKeyId = required('ARTIFACT_NEXT_CONTEXT_KEY_ID');
     const admission = new ArtifactRequestAdmission({ redis: command, namespace });
@@ -73,13 +75,14 @@ async function main() {
         else
             refuse(failure.kind); },
     });
+    const runtimeDomain = required('ARTIFACT_NEXT_RUNTIME_DOMAIN');
     const gateway = createArtifactGateway({
         control,
-        runtimeDomain: required('ARTIFACT_NEXT_RUNTIME_DOMAIN'),
-        parentOrigin: process.env.ARTIFACT_NEXT_PARENT_ORIGIN ?? new URL(controlUrl).origin,
+        runtimeDomain,
+        parentOrigin: controlConfig.parentOrigin,
         gatewayOrigin: required('ARTIFACT_NEXT_GATEWAY_URL'),
         sessionKey,
-        sessionCookieSameSite: gatewaySessionSameSite({ value: process.env.ARTIFACT_NEXT_SESSION_COOKIE_SAMESITE, appEnv: namespace }),
+        sessionCookieSameSite: gatewaySessionSameSite({ parentOrigin: controlConfig.parentOrigin, runtimeDomain }),
         contextPrivateKey,
         contextKeyId,
         nodeId, routing: ownership, relay,

package/dist/git-clone.d.ts

@@ -1,5 +1,3 @@
-/** Read the git PAT from the environment (`ATLAS_GIT_PAT`), trimmed. */
-export declare function resolveGitPatFromEnv(): string | undefined;
 /** Full or abbreviated hex SHAs — not valid as `git clone --branch`. */
 export declare function looksLikeCommitSha(ref: string): boolean;
 /**
@@ -20,7 +18,7 @@ export type RunGitClone = (args: {
      * default branch in full, then check the SHA out.
      */
     depth?: number;
-    /** PAT used as Basic-auth password (username `git`). */
+    /** Login access token used as Basic-auth password (username `git`). */
     pat: string;
     /** Hard ceiling before the git child is killed (default 5m). */
     timeoutMs?: number;

package/dist/git-clone.js

@@ -5,20 +5,15 @@
  * re-exports it from `src/repos/git-clone.ts` so the `repos` tool and the
  * artifact `--repo` deploy path share one clone path.
  *
- * Credentials are supplied via an ephemeral GIT_ASKPASS script so the PAT
+ * Credentials are supplied via an ephemeral GIT_ASKPASS script so the token
  * never lands in `remote.origin.url` or the git argv. Callers pass a clean
- * HTTPS clone URL plus the PAT separately.
+ * HTTPS clone URL plus the login token separately.
  */
 import { spawn } from 'node:child_process';
 import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createScrubbedChildEnv } from './child-environment.js';
-/** Read the git PAT from the environment (`ATLAS_GIT_PAT`), trimmed. */
-export function resolveGitPatFromEnv() {
-    const value = process.env.ATLAS_GIT_PAT?.trim();
-    return value || undefined;
-}
 /** Full or abbreviated hex SHAs — not valid as `git clone --branch`. */
 export function looksLikeCommitSha(ref) {
     return /^[0-9a-f]{7,40}$/i.test(ref);
@@ -151,9 +146,12 @@ export async function withGitAskpass({ pat, fn, }) {
                 GIT_TERMINAL_PROMPT: '0',
                 GIT_CONFIG_NOSYSTEM: '1',
                 SEQ_STUDIO_GIT_ASKPASS_PASSWORD: pat,
-                GIT_CONFIG_COUNT: '1',
+                GIT_CONFIG_COUNT: '2',
                 GIT_CONFIG_KEY_0: 'credential.helper',
                 GIT_CONFIG_VALUE_0: '',
+                // Never redirect a platform credential, even to another path on this host.
+                GIT_CONFIG_KEY_1: 'http.followRedirects',
+                GIT_CONFIG_VALUE_1: 'false',
             },
         }));
     }

package/dist/runtime-contracts.d.ts

@@ -1,5 +1,13 @@
 import { z } from 'zod';
 export { resolveArtifactNextImages } from './next-image-config.js';
+/** Atlas routes the gateway calls; every one authenticates the gateway itself. */
+export declare const ARTIFACT_NEXT_CONTROL_PATH = "/api/artifact-studio/next/control";
+/**
+ * The identity-token audience for gateway control calls: Atlas's public origin plus the control
+ * path, whichever address the call is routed to. Path-scoped, so a token minted for another
+ * Atlas audience is never accepted here.
+ */
+export declare function artifactNextControlAudience(atlasOrigin: string): string;
 /** Shared by local collection, repository collection and the bounded source-upload API. */
 export declare const ARTIFACT_NEXT_SOURCE_LIMITS: Readonly<{
     maxFiles: 2000;

package/dist/runtime-contracts.js

@@ -3,6 +3,16 @@ import { ARTIFACT_NEXT_RUNTIME, artifactNextSecretNameSchema } from './manifest-
 import { MAX_STUDIO_PATH_LENGTH } from './paths.js';
 import { isLoopbackHostname } from './loopback.js';
 export { resolveArtifactNextImages } from './next-image-config.js';
+/** Atlas routes the gateway calls; every one authenticates the gateway itself. */
+export const ARTIFACT_NEXT_CONTROL_PATH = '/api/artifact-studio/next/control';
+/**
+ * The identity-token audience for gateway control calls: Atlas's public origin plus the control
+ * path, whichever address the call is routed to. Path-scoped, so a token minted for another
+ * Atlas audience is never accepted here.
+ */
+export function artifactNextControlAudience(atlasOrigin) {
+    return `${new URL(atlasOrigin).origin}${ARTIFACT_NEXT_CONTROL_PATH}`;
+}
 /** Shared by local collection, repository collection and the bounded source-upload API. */
 export const ARTIFACT_NEXT_SOURCE_LIMITS = Object.freeze({
     maxFiles: 2_000,

package/dist/sdk-orm.d.ts

@@ -1,10 +1,10 @@
-import { type OperationExecutor } from '@sequenceholdings/orm/client';
+import { type SqlOperationExecutor } from '@sequenceholdings/orm/client';
 import { type ArtifactOrmJsonScalars } from './orm-json-scalars.js';
 import { type SequenceApi } from './sdk.js';
 export interface ArtifactOrmExecutorConfig {
     namespace: string;
     /** The generated operations.manifest.json, validated before any host call. */
-    manifest: unknown;
+    manifest?: unknown;
     /** Optional action-scoped host client (for example, withTraceAction's client). */
     sdk?: {
         api: Pick<SequenceApi, 'fetch'>;
@@ -21,4 +21,4 @@ export interface ArtifactOrmExecutorConfig {
  * Declare the namespace path in capabilities.api.write (queries also use POST).
  * Namespace grants, capabilities, row policies, and write checks still apply.
  */
-export declare function createArtifactOrmExecutor({ namespace, manifest, sdk, jsonScalars }: ArtifactOrmExecutorConfig): OperationExecutor;
+export declare function createArtifactOrmExecutor({ namespace, manifest, sdk, jsonScalars }: ArtifactOrmExecutorConfig): SqlOperationExecutor;

package/dist/source-resolver.js

@@ -5,7 +5,7 @@ import { tmpdir } from 'node:os';
 import { isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { createScrubbedChildEnv } from './child-environment.js';
 import { materializeRepo, resolveCommitSha, resolveRepo } from './git-service-client.js';
-import { gitServiceCloneUrl, resolveGitPatFromEnv, runGitClone } from './git-clone.js';
+import { gitServiceCloneUrl, runGitClone } from './git-clone.js';
 /** True for sources that must be fetched from a remote (git-service / git-url). */
 export function isRemoteSpec(spec) {
     return spec.kind !== 'local';
@@ -136,21 +136,12 @@ export async function resolveArtifactSource(spec, opts = {}) {
                 console.log(`[seq-studio] source: ${spec.namespace}/${spec.name}@${ref} (${sha.slice(0, 10)}, ${count} file(s), M2M)`);
                 return await materialized({ gitCommit: sha, gitBranch: ref, gitDirty: false });
             }
-            // Human path: materialize via a smart-HTTP `git clone` (one pack
-            // transfer). The earlier per-blob JSON walk was O(files) serial HTTP
-            // round-trips and stalled/failed on large artifacts. Smart-HTTP
-            // authenticates by PAT (Basic-auth password), NOT the Auth0 bearer — the
-            // same token you clone the repo with. No PAT, no git workflow.
-            const pat = resolveGitPatFromEnv();
-            if (pat) {
-                const cloneUrl = gitServiceCloneUrl(opts.baseUrl, repo.id);
-                await runGitClone({ cloneUrl, destDir: dest, pat, ref: sha });
-                console.log(`[seq-studio] source: ${spec.namespace}/${spec.name}@${ref} (${sha.slice(0, 10)}, git clone)`);
-                return await materialized({ gitCommit: sha, gitBranch: ref, gitDirty: false });
-            }
-            throw new Error('Deploying from --repo requires a git PAT. Set ATLAS_GIT_PAT to a token with the ' +
-                'repo:read scope (create one in Atlas → Settings → Tokens, or `seq-studio auth pat create`). ' +
-                'The git-service clone uses smart-HTTP, which authenticates by PAT — the same token you clone the repo with.');
+            // Use the same selected human identity for metadata and Git transport.
+            // An ambient PAT must not silently change the principal on the clone.
+            const cloneUrl = gitServiceCloneUrl(opts.baseUrl, repo.id);
+            await runGitClone({ cloneUrl, destDir: dest, pat: opts.token, ref: sha });
+            console.log(`[seq-studio] source: ${spec.namespace}/${spec.name}@${ref} (${sha.slice(0, 10)}, git clone)`);
+            return await materialized({ gitCommit: sha, gitBranch: ref, gitDirty: false });
         }
         const { sha, branch } = cloneGitUrl(spec.url, spec.ref, dest);
         console.log(`[seq-studio] source: ${redactGitUrl(spec.url)}${spec.ref ? `@${spec.ref}` : ''} (${sha.slice(0, 10)})`);

package/dist/templates/nextjs/README.md

@@ -179,6 +179,13 @@ own test credentials, mocks or an existing governed function. Use a hosted
 preview for application code that needs a managed secret. Never put secrets in
 `build.public_env`, `NEXT_PUBLIC_*`, client components or committed files.
 
+Cookies your application sets itself should use a `__Host-` name with `Secure`,
+`HttpOnly`, `Path=/` and no `Domain`. Applications on one deployment share a
+registrable domain, and only a `__Host-` cookie is guaranteed to come from your
+own origin rather than a neighbour's. When the application origin is on a
+different site from its Atlas frame, a cookie it needs there must also be
+`SameSite=None; Partitioned`, or the browser drops it.
+
 The local process is ordinary code running as your operating-system user.
 Atlas governs access to platform resources; it does not sandbox your laptop's
 filesystem or all outbound network connections.

package/dist/templates/react-vite/package.json

@@ -9,7 +9,7 @@
   },
   "dependencies": {},
   "devDependencies": {
-    "@sequenceholdings/artifact-studio": "^0.6.0",
+    "@sequenceholdings/artifact-studio": "^0.7.0",
     "@sequenceholdings/atlas-ui": "^3.1.1",
     "@tailwindcss/postcss": "^4.2.2",
     "@tailwindcss/vite": "^4.2.2",

package/dist/trusted-install.d.ts

@@ -7,7 +7,14 @@ export declare const PNPM_WORKSPACE_FILE_RE: RegExp;
 /** Platform peers the CLI aliases at build time — must not be prod-installed remotely. */
 export declare const REMOTE_INSTALL_PLATFORM_PACKAGES: Set<string>;
 /**
- * Reject install-control files and non-registry dependency specs before a remote
- * `pnpm install` runs on an untrusted git checkout.
+ * Trust gate for remote static React/Vite artifact installs (called by
+ * `prepare-build.ts` before `pnpm install`); also reused for remote process repos.
+ * It rejects install-control files and non-registry dependency specs.
+ *
+ * Hosted Next.js builds use `prepareHostedBuildSource` in Atlas
+ * `next-hosted/source-policy.ts` and a controlled install workspace from
+ * `hostedInstallWorkspace` in `next-hosted/release-age.ts` instead. Do not apply
+ * this static gate to a Next.js template: its workspace file and approved
+ * platform dependencies follow the hosted policy.
  */
 export declare function assertTrustedArtifactInstallTree(dir: string): void;

package/dist/trusted-install.js

@@ -225,8 +225,15 @@ function assertChainguardLockfile(dir) {
     assertParsedPackageResolutions(lockfileText);
 }
 /**
- * Reject install-control files and non-registry dependency specs before a remote
- * `pnpm install` runs on an untrusted git checkout.
+ * Trust gate for remote static React/Vite artifact installs (called by
+ * `prepare-build.ts` before `pnpm install`); also reused for remote process repos.
+ * It rejects install-control files and non-registry dependency specs.
+ *
+ * Hosted Next.js builds use `prepareHostedBuildSource` in Atlas
+ * `next-hosted/source-policy.ts` and a controlled install workspace from
+ * `hostedInstallWorkspace` in `next-hosted/release-age.ts` instead. Do not apply
+ * this static gate to a Next.js template: its workspace file and approved
+ * platform dependencies follow the hosted policy.
  */
 export function assertTrustedArtifactInstallTree(dir) {
     for (const rel of listRelativeFiles(dir)) {

package/package.json

@@ -9,7 +9,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.6.7",
+  "version": "0.7.0",
   "description": "SDK types and CLI library for building Artifact Studio apps. Driven via `seq-studio artifact <sub>` (@sequenceholdings/studio-cli), which runs the `./cli` runCli export.",
   "type": "module",
   "exports": {
@@ -166,9 +166,9 @@
     "google-auth-library": "^10.5.0",
     "server-only": "0.0.1",
     "parse5": "7.3.0",
+    "@sequenceholdings/lattice-form-renderer": "0.2.0",
     "@sequenceholdings/storage": "0.1.1",
-    "@sequenceholdings/orm": "2.5.0",
-    "@sequenceholdings/lattice-form-renderer": "0.2.0"
+    "@sequenceholdings/orm": "2.6.0"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",

package/templates/nextjs/README.md

@@ -179,6 +179,13 @@ own test credentials, mocks or an existing governed function. Use a hosted
 preview for application code that needs a managed secret. Never put secrets in
 `build.public_env`, `NEXT_PUBLIC_*`, client components or committed files.
 
+Cookies your application sets itself should use a `__Host-` name with `Secure`,
+`HttpOnly`, `Path=/` and no `Domain`. Applications on one deployment share a
+registrable domain, and only a `__Host-` cookie is guaranteed to come from your
+own origin rather than a neighbour's. When the application origin is on a
+different site from its Atlas frame, a cookie it needs there must also be
+`SameSite=None; Partitioned`, or the browser drops it.
+
 The local process is ordinary code running as your operating-system user.
 Atlas governs access to platform resources; it does not sandbox your laptop's
 filesystem or all outbound network connections.

package/templates/react-vite/package.json

@@ -9,7 +9,7 @@
   },
   "dependencies": {},
   "devDependencies": {
-    "@sequenceholdings/artifact-studio": "^0.6.0",
+    "@sequenceholdings/artifact-studio": "^0.7.0",
     "@sequenceholdings/atlas-ui": "^3.1.1",
     "@tailwindcss/postcss": "^4.2.2",
     "@tailwindcss/vite": "^4.2.2",