@sequenceholdings/artifact-studio 0.6.7 → 0.7.1

package/dist/runtime-contracts.d.ts

@@ -1,5 +1,13 @@
 import { z } from 'zod';
 export { resolveArtifactNextImages } from './next-image-config.js';
+/** Atlas routes the gateway calls; every one authenticates the gateway itself. */
+export declare const ARTIFACT_NEXT_CONTROL_PATH = "/api/artifact-studio/next/control";
+/**
+ * The identity-token audience for gateway control calls: Atlas's public origin plus the control
+ * path, whichever address the call is routed to. Path-scoped, so a token minted for another
+ * Atlas audience is never accepted here.
+ */
+export declare function artifactNextControlAudience(atlasOrigin: string): string;
 /** Shared by local collection, repository collection and the bounded source-upload API. */
 export declare const ARTIFACT_NEXT_SOURCE_LIMITS: Readonly<{
     maxFiles: 2000;

package/dist/runtime-contracts.js

@@ -3,6 +3,16 @@ import { ARTIFACT_NEXT_RUNTIME, artifactNextSecretNameSchema } from './manifest-
 import { MAX_STUDIO_PATH_LENGTH } from './paths.js';
 import { isLoopbackHostname } from './loopback.js';
 export { resolveArtifactNextImages } from './next-image-config.js';
+/** Atlas routes the gateway calls; every one authenticates the gateway itself. */
+export const ARTIFACT_NEXT_CONTROL_PATH = '/api/artifact-studio/next/control';
+/**
+ * The identity-token audience for gateway control calls: Atlas's public origin plus the control
+ * path, whichever address the call is routed to. Path-scoped, so a token minted for another
+ * Atlas audience is never accepted here.
+ */
+export function artifactNextControlAudience(atlasOrigin) {
+    return `${new URL(atlasOrigin).origin}${ARTIFACT_NEXT_CONTROL_PATH}`;
+}
 /** Shared by local collection, repository collection and the bounded source-upload API. */
 export const ARTIFACT_NEXT_SOURCE_LIMITS = Object.freeze({
     maxFiles: 2_000,

package/dist/sdk-orm.d.ts

@@ -1,10 +1,10 @@
-import { type OperationExecutor } from '@sequenceholdings/orm/client';
+import { type SqlOperationExecutor } from '@sequenceholdings/orm/client';
 import { type ArtifactOrmJsonScalars } from './orm-json-scalars.js';
 import { type SequenceApi } from './sdk.js';
 export interface ArtifactOrmExecutorConfig {
     namespace: string;
     /** The generated operations.manifest.json, validated before any host call. */
-    manifest: unknown;
+    manifest?: unknown;
     /** Optional action-scoped host client (for example, withTraceAction's client). */
     sdk?: {
         api: Pick<SequenceApi, 'fetch'>;
@@ -21,4 +21,4 @@ export interface ArtifactOrmExecutorConfig {
  * Declare the namespace path in capabilities.api.write (queries also use POST).
  * Namespace grants, capabilities, row policies, and write checks still apply.
  */
-export declare function createArtifactOrmExecutor({ namespace, manifest, sdk, jsonScalars }: ArtifactOrmExecutorConfig): OperationExecutor;
+export declare function createArtifactOrmExecutor({ namespace, manifest, sdk, jsonScalars }: ArtifactOrmExecutorConfig): SqlOperationExecutor;

package/dist/source-boundary.d.ts

@@ -11,3 +11,9 @@ export interface ArtifactSourceBoundaryOptions {
  * allowed because they are external to the artifact by design.
  */
 export declare function rejectOutsideSourcePlugin({ root, trustedExternalRoots, }: ArtifactSourceBoundaryOptions): Plugin;
+/**
+ * Whether `filePath` is inside a `node_modules` directory. Bundlers pass
+ * Windows paths with forward slashes, so compare in that form whatever the
+ * platform separator is.
+ */
+export declare function isNodeModulesPath(filePath: string): boolean;

package/dist/source-boundary.js

@@ -46,8 +46,13 @@ function isPathWithin(root, candidate) {
 function isTrustedExternalPath(filePath, trustedRoots) {
     return trustedRoots.some((trustedRoot) => isPathWithin(trustedRoot, filePath));
 }
-function isNodeModulesPath(filePath) {
-    return filePath.includes(`${sep}node_modules${sep}`);
+/**
+ * Whether `filePath` is inside a `node_modules` directory. Bundlers pass
+ * Windows paths with forward slashes, so compare in that form whatever the
+ * platform separator is.
+ */
+export function isNodeModulesPath(filePath) {
+    return filePath.replaceAll('\\', '/').includes('/node_modules/');
 }
 function isBareImport(source) {
     return !source.startsWith('.') && !isAbsolute(source);

package/dist/source-resolver.js

@@ -5,7 +5,7 @@ import { tmpdir } from 'node:os';
 import { isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { createScrubbedChildEnv } from './child-environment.js';
 import { materializeRepo, resolveCommitSha, resolveRepo } from './git-service-client.js';
-import { gitServiceCloneUrl, resolveGitPatFromEnv, runGitClone } from './git-clone.js';
+import { gitServiceCloneUrl, runGitClone } from './git-clone.js';
 /** True for sources that must be fetched from a remote (git-service / git-url). */
 export function isRemoteSpec(spec) {
     return spec.kind !== 'local';
@@ -136,21 +136,12 @@ export async function resolveArtifactSource(spec, opts = {}) {
                 console.log(`[seq-studio] source: ${spec.namespace}/${spec.name}@${ref} (${sha.slice(0, 10)}, ${count} file(s), M2M)`);
                 return await materialized({ gitCommit: sha, gitBranch: ref, gitDirty: false });
             }
-            // Human path: materialize via a smart-HTTP `git clone` (one pack
-            // transfer). The earlier per-blob JSON walk was O(files) serial HTTP
-            // round-trips and stalled/failed on large artifacts. Smart-HTTP
-            // authenticates by PAT (Basic-auth password), NOT the Auth0 bearer — the
-            // same token you clone the repo with. No PAT, no git workflow.
-            const pat = resolveGitPatFromEnv();
-            if (pat) {
-                const cloneUrl = gitServiceCloneUrl(opts.baseUrl, repo.id);
-                await runGitClone({ cloneUrl, destDir: dest, pat, ref: sha });
-                console.log(`[seq-studio] source: ${spec.namespace}/${spec.name}@${ref} (${sha.slice(0, 10)}, git clone)`);
-                return await materialized({ gitCommit: sha, gitBranch: ref, gitDirty: false });
-            }
-            throw new Error('Deploying from --repo requires a git PAT. Set ATLAS_GIT_PAT to a token with the ' +
-                'repo:read scope (create one in Atlas → Settings → Tokens, or `seq-studio auth pat create`). ' +
-                'The git-service clone uses smart-HTTP, which authenticates by PAT — the same token you clone the repo with.');
+            // Use the same selected human identity for metadata and Git transport.
+            // An ambient PAT must not silently change the principal on the clone.
+            const cloneUrl = gitServiceCloneUrl(opts.baseUrl, repo.id);
+            await runGitClone({ cloneUrl, destDir: dest, pat: opts.token, ref: sha });
+            console.log(`[seq-studio] source: ${spec.namespace}/${spec.name}@${ref} (${sha.slice(0, 10)}, git clone)`);
+            return await materialized({ gitCommit: sha, gitBranch: ref, gitDirty: false });
         }
         const { sha, branch } = cloneGitUrl(spec.url, spec.ref, dest);
         console.log(`[seq-studio] source: ${redactGitUrl(spec.url)}${spec.ref ? `@${spec.ref}` : ''} (${sha.slice(0, 10)})`);

package/dist/templates/nextjs/README.md

@@ -179,6 +179,13 @@ own test credentials, mocks or an existing governed function. Use a hosted
 preview for application code that needs a managed secret. Never put secrets in
 `build.public_env`, `NEXT_PUBLIC_*`, client components or committed files.
 
+Cookies your application sets itself should use a `__Host-` name with `Secure`,
+`HttpOnly`, `Path=/` and no `Domain`. Applications on one deployment share a
+registrable domain, and only a `__Host-` cookie is guaranteed to come from your
+own origin rather than a neighbour's. When the application origin is on a
+different site from its Atlas frame, a cookie it needs there must also be
+`SameSite=None; Partitioned`, or the browser drops it.
+
 The local process is ordinary code running as your operating-system user.
 Atlas governs access to platform resources; it does not sandbox your laptop's
 filesystem or all outbound network connections.

package/dist/templates/react-vite/package.json

@@ -5,15 +5,18 @@
   "scripts": {
     "dev": "vite",
     "build": "vite build",
-    "preview": "vite preview"
+    "preview": "vite preview",
+    "type-check": "tsc --noEmit"
   },
   "dependencies": {},
   "devDependencies": {
-    "@sequenceholdings/artifact-studio": "^0.6.0",
+    "@sequenceholdings/artifact-studio": "^0.7.0",
     "@sequenceholdings/atlas-ui": "^3.1.1",
     "@tailwindcss/postcss": "^4.2.2",
     "@tailwindcss/vite": "^4.2.2",
     "@tanstack/react-query": "^4.36.1",
+    "@types/react": "^18.3.31",
+    "@types/react-dom": "^18.3.7",
     "@vitejs/plugin-react": "^5.0.0",
     "react": "^18.2.0",
     "react-dom": "^18.2.0",

package/dist/templates/react-vite/tsconfig.json

@@ -0,0 +1,17 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["dom", "dom.iterable", "esnext"],
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "react-jsx",
+    "types": ["vite/client"]
+  },
+  "include": ["src", "vite.config.ts"]
+}

package/dist/trusted-install.d.ts

@@ -7,7 +7,14 @@ export declare const PNPM_WORKSPACE_FILE_RE: RegExp;
 /** Platform peers the CLI aliases at build time — must not be prod-installed remotely. */
 export declare const REMOTE_INSTALL_PLATFORM_PACKAGES: Set<string>;
 /**
- * Reject install-control files and non-registry dependency specs before a remote
- * `pnpm install` runs on an untrusted git checkout.
+ * Trust gate for remote static React/Vite artifact installs (called by
+ * `prepare-build.ts` before `pnpm install`); also reused for remote process repos.
+ * It rejects install-control files and non-registry dependency specs.
+ *
+ * Hosted Next.js builds use `prepareHostedBuildSource` in Atlas
+ * `next-hosted/source-policy.ts` and a controlled install workspace from
+ * `hostedInstallWorkspace` in `next-hosted/release-age.ts` instead. Do not apply
+ * this static gate to a Next.js template: its workspace file and approved
+ * platform dependencies follow the hosted policy.
  */
 export declare function assertTrustedArtifactInstallTree(dir: string): void;

package/dist/trusted-install.js

@@ -225,8 +225,15 @@ function assertChainguardLockfile(dir) {
     assertParsedPackageResolutions(lockfileText);
 }
 /**
- * Reject install-control files and non-registry dependency specs before a remote
- * `pnpm install` runs on an untrusted git checkout.
+ * Trust gate for remote static React/Vite artifact installs (called by
+ * `prepare-build.ts` before `pnpm install`); also reused for remote process repos.
+ * It rejects install-control files and non-registry dependency specs.
+ *
+ * Hosted Next.js builds use `prepareHostedBuildSource` in Atlas
+ * `next-hosted/source-policy.ts` and a controlled install workspace from
+ * `hostedInstallWorkspace` in `next-hosted/release-age.ts` instead. Do not apply
+ * this static gate to a Next.js template: its workspace file and approved
+ * platform dependencies follow the hosted policy.
  */
 export function assertTrustedArtifactInstallTree(dir) {
     for (const rel of listRelativeFiles(dir)) {

package/package.json

@@ -9,7 +9,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.6.7",
+  "version": "0.7.1",
   "description": "SDK types and CLI library for building Artifact Studio apps. Driven via `seq-studio artifact <sub>` (@sequenceholdings/studio-cli), which runs the `./cli` runCli export.",
   "type": "module",
   "exports": {
@@ -159,6 +159,7 @@
     "sonner": "^2.0.7",
     "tailwindcss": "^4.1.8",
     "tw-animate-css": "^1.4.0",
+    "typescript": "^5.6.0",
     "vite": "8.0.16",
     "zod": "^4.1.13",
     "ws": "^8.21.0",
@@ -166,14 +167,13 @@
     "google-auth-library": "^10.5.0",
     "server-only": "0.0.1",
     "parse5": "7.3.0",
+    "@sequenceholdings/lattice-form-renderer": "0.2.0",
     "@sequenceholdings/storage": "0.1.1",
-    "@sequenceholdings/orm": "2.5.0",
-    "@sequenceholdings/lattice-form-renderer": "0.2.0"
+    "@sequenceholdings/orm": "2.6.1"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.0.0",
-    "typescript": "^5.6.0",
     "vitest": "^4.1.11",
     "@types/ws": "^8.18.1"
   },

package/templates/nextjs/README.md

@@ -179,6 +179,13 @@ own test credentials, mocks or an existing governed function. Use a hosted
 preview for application code that needs a managed secret. Never put secrets in
 `build.public_env`, `NEXT_PUBLIC_*`, client components or committed files.
 
+Cookies your application sets itself should use a `__Host-` name with `Secure`,
+`HttpOnly`, `Path=/` and no `Domain`. Applications on one deployment share a
+registrable domain, and only a `__Host-` cookie is guaranteed to come from your
+own origin rather than a neighbour's. When the application origin is on a
+different site from its Atlas frame, a cookie it needs there must also be
+`SameSite=None; Partitioned`, or the browser drops it.
+
 The local process is ordinary code running as your operating-system user.
 Atlas governs access to platform resources; it does not sandbox your laptop's
 filesystem or all outbound network connections.

package/templates/react-vite/package.json

@@ -5,15 +5,18 @@
   "scripts": {
     "dev": "vite",
     "build": "vite build",
-    "preview": "vite preview"
+    "preview": "vite preview",
+    "type-check": "tsc --noEmit"
   },
   "dependencies": {},
   "devDependencies": {
-    "@sequenceholdings/artifact-studio": "^0.6.0",
+    "@sequenceholdings/artifact-studio": "^0.7.0",
     "@sequenceholdings/atlas-ui": "^3.1.1",
     "@tailwindcss/postcss": "^4.2.2",
     "@tailwindcss/vite": "^4.2.2",
     "@tanstack/react-query": "^4.36.1",
+    "@types/react": "^18.3.31",
+    "@types/react-dom": "^18.3.7",
     "@vitejs/plugin-react": "^5.0.0",
     "react": "^18.2.0",
     "react-dom": "^18.2.0",

package/templates/react-vite/tsconfig.json

@@ -0,0 +1,17 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["dom", "dom.iterable", "esnext"],
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "react-jsx",
+    "types": ["vite/client"]
+  },
+  "include": ["src", "vite.config.ts"]
+}