@sequenceholdings/artifact-studio 0.7.0 → 0.7.1

package/dist/gateway/bootstrap-page.js

@@ -21,6 +21,14 @@ export function bootstrapLandingUrl(route, origin) {
         return root;
     }
 }
+/**
+ * Transparent while it connects, so the frame keeps the host's own background through the exchange
+ * and the redirect (a white page reading "Connecting" flashed between Atlas and the app). Only a
+ * failure is shown, on its own light card so it reads over either host theme.
+ */
+const BOOTSTRAP_STYLE = 'html,body{margin:0;height:100%;background:transparent}'
+    + 'body{display:flex;align-items:center;justify-content:center;font:14px/1.4 system-ui,sans-serif}'
+    + '#status:empty{display:none}#status{margin:16px;padding:12px 16px;border-radius:8px;background:#fff;color:#27272a;box-shadow:0 1px 3px rgba(0,0,0,.2)}';
 /** The bootstrap ticket travels in a fragment and a POST body, never a request URL or log. The page
  * exchanges it only inside the Atlas frame; browsers without Fetch Metadata are covered by the script check. */
 export function bootstrapPage({ response, parentOrigin }) {
@@ -28,7 +36,7 @@ export function bootstrapPage({ response, parentOrigin }) {
     response.writeHead(200, {
         'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', 'referrer-policy': 'no-referrer',
         'x-content-type-options': 'nosniff',
-        'content-security-policy': `default-src 'none'; script-src 'nonce-${nonce}'; connect-src 'self'; frame-ancestors ${parentOrigin}; base-uri 'none'; form-action 'none'`,
+        'content-security-policy': `default-src 'none'; script-src 'nonce-${nonce}'; style-src 'nonce-${nonce}'; connect-src 'self'; frame-ancestors ${parentOrigin}; base-uri 'none'; form-action 'none'`,
     });
-    response.end(`<!doctype html><meta charset="utf-8"><title>Connecting application</title><p id="status">Connecting application…</p><script nonce="${nonce}">(() => {const landing=${bootstrapLandingUrl.toString()};const fragment=new URLSearchParams(location.hash.slice(1));const ticket=fragment.get('ticket');history.replaceState(null,'',location.pathname);if(!ticket||window.top===window){document.getElementById('status').textContent='Open this application from Atlas.';return;}fetch('/_sequence/session',{method:'POST',credentials:'same-origin',headers:{'content-type':'application/json'},body:JSON.stringify({ticket})}).then(r=>{if(!r.ok)throw new Error();location.replace(landing(fragment.get('route'),location.origin));}).catch(()=>{document.getElementById('status').textContent='This preview expired. Open it again from Atlas.';});})();</script>`);
+    response.end(`<!doctype html><meta charset="utf-8"><title>Opening application</title><style nonce="${nonce}">${BOOTSTRAP_STYLE}</style><p id="status" role="status"></p><script nonce="${nonce}">(() => {const landing=${bootstrapLandingUrl.toString()};const fragment=new URLSearchParams(location.hash.slice(1));const ticket=fragment.get('ticket');history.replaceState(null,'',location.pathname);if(!ticket||window.top===window){document.getElementById('status').textContent='Open this application from Atlas.';return;}fetch('/_sequence/session',{method:'POST',credentials:'same-origin',headers:{'content-type':'application/json'},body:JSON.stringify({ticket})}).then(r=>{if(!r.ok)throw new Error();location.replace(landing(fragment.get('route'),location.origin));}).catch(()=>{document.getElementById('status').textContent='This preview expired. Open it again from Atlas.';});})();</script>`);
 }

package/dist/gateway/control.d.ts

@@ -67,6 +67,36 @@ export declare const gatewayTargetSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             }, z.core.$strip>;
         }, z.core.$strip>;
     }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"static">;
+    deploymentId: z.ZodString;
+    contentHash: z.ZodString;
+    active: z.ZodBoolean;
+    published: z.ZodOptional<z.ZodBoolean>;
+    projectId: z.ZodString;
+    ownerId: z.ZodString;
+    environment: z.ZodString;
+    publicOrigin: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    expiresAt: z.ZodNumber;
+    maxExpiresAt: z.ZodOptional<z.ZodNumber>;
+    capabilities: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    serviceAccountId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    lattice: z.ZodOptional<z.ZodObject<{
+        runId: z.ZodNullable<z.ZodString>;
+        nodeId: z.ZodNullable<z.ZodString>;
+        stepId: z.ZodNullable<z.ZodString>;
+        processId: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    taskRoutes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    manifest: z.ZodOptional<z.ZodObject<{
+        server: z.ZodObject<{
+            resources: z.ZodObject<{
+                concurrency: z.ZodNumber;
+                max_instances: z.ZodNumber;
+                timeout_seconds: z.ZodNumber;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
 }, z.core.$strip>], "kind">;
 export type GatewayTarget = z.infer<typeof gatewayTargetSchema>;
 declare const latticeInvokeGrantSchema: z.ZodObject<{
@@ -91,6 +121,15 @@ declare const latticeInvokeGrantSchema: z.ZodObject<{
     }, z.core.$strict>;
 }, z.core.$strict>;
 export type LatticeInvokeGrant = z.infer<typeof latticeInvokeGrantSchema>;
+/** Paths a static deployment serves: its page, entry bundle, source map and lazy chunks. */
+export declare const STATIC_PAGE = "index.html";
+/** The static bundle ceiling (30 MiB) plus headroom; a larger file is a platform fault, never served. */
+export declare const STATIC_FILE_MAX_BYTES: number;
+export interface StaticArtifactFile {
+    body: Buffer;
+    contentType: string;
+    etag?: string;
+}
 export declare class GatewayControlError extends Error {
     readonly status: number;
     constructor(status: number);
@@ -156,6 +195,16 @@ export declare class ArtifactGatewayControl {
         target: GatewayTarget;
     }>;
     authorize(session: GatewaySession): Promise<GatewayTarget>;
+    /**
+     * One immutable file of a static deployment (the page, entry bundle, source map or a chunk), raw
+     * bytes up to the static bundle ceiling. The gateway authorized the browser's session first; this
+     * call carries only the gateway's own credential.
+     */
+    staticFile({ deploymentId, path, parentOrigin }: {
+        deploymentId: string;
+        path: string;
+        parentOrigin: string;
+    }): Promise<StaticArtifactFile>;
     /** SHA-256 both sides so a wrong bearer still takes constant time. */
     tokenMatches(presented: string): boolean;
     latticeInvoke(body: {

package/dist/gateway/control.js

@@ -20,6 +20,8 @@ const base = {
 export const gatewayTargetSchema = z.discriminatedUnion('kind', [
     z.object({ ...base, kind: z.literal('development'), sessionId: id, epoch: z.number().int().positive() }),
     z.object({ ...base, kind: z.literal('hosted'), deploymentId: id, frameworkBuildId: artifactNextFrameworkBuildIdSchema, upstreamUrl: z.string().url(), upstreamAudience: z.string().url().optional(), runtimeTransport: z.enum(['cloud-run', 'local-docker']).optional(), active: z.boolean(), published: z.boolean().optional() }),
+    // A static (React/Vite) deployment: the gateway serves its immutable files itself, fetched from Atlas.
+    z.object({ ...base, kind: z.literal('static'), deploymentId: id, contentHash: z.string().min(1).max(128), active: z.boolean(), published: z.boolean().optional() }),
 ]);
 const bootstrapSchema = z.object({ parentOrigin: z.string().transform(normalizePublicOrigin), channelId: id, nonce: z.string().min(16).max(255) });
 const usageResultSchema = z.object({ rejected: z.number().int().nonnegative() });
@@ -41,6 +43,39 @@ const latticeInvokeGrantSchema = z.object({
         timeout_seconds: z.number().int().min(1).max(300),
     }).strict(),
 }).strict();
+/** Paths a static deployment serves: its page, entry bundle, source map and lazy chunks. */
+export const STATIC_PAGE = 'index.html';
+const STATIC_FILE_PATH = /^(?:index\.html|bundle\.js|sourcemap\.json|chunks\/[A-Za-z0-9._-]{1,200})$/;
+/** The static bundle ceiling (30 MiB) plus headroom; a larger file is a platform fault, never served. */
+export const STATIC_FILE_MAX_BYTES = 32 * 1024 * 1024;
+const STATIC_CONTENT_TYPES = new Set(['text/html', 'application/javascript', 'text/javascript', 'application/json', 'text/css']);
+/** Reads at most `maxBytes` of a response body, refusing (502) anything larger. */
+async function readBounded(response, maxBytes) {
+    if (Number(response.headers.get('content-length')) > maxBytes) {
+        await response.body?.cancel().catch(() => undefined);
+        throw new GatewayControlError(502);
+    }
+    const reader = response.body?.getReader();
+    if (!reader)
+        throw new GatewayControlError(502);
+    const chunks = [];
+    let length = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            length += value.length;
+            if (length > maxBytes)
+                throw new GatewayControlError(502);
+            chunks.push(value);
+        }
+        return Buffer.concat(chunks);
+    }
+    finally {
+        await reader.cancel().catch(() => undefined);
+    }
+}
 export class GatewayControlError extends Error {
     status;
     constructor(status) {
@@ -186,11 +221,11 @@ export class ArtifactGatewayControl {
             version: 1, kind: target.kind, projectId: target.projectId, ownerId: target.ownerId,
             environment: target.environment, publicOrigin: target.publicOrigin,
             sessionId: target.kind === 'development' ? target.sessionId : null,
-            deploymentId: target.kind === 'hosted' ? target.deploymentId : null,
+            deploymentId: target.kind === 'development' ? null : target.deploymentId,
             frameworkBuildId: target.kind === 'hosted' ? target.frameworkBuildId : null,
             expiresAt: Math.min(target.expiresAt, target.maxExpiresAt ?? target.expiresAt, Date.now() + 8 * 60 * 60_000),
             maxExpiresAt: Math.min(target.maxExpiresAt ?? (target.kind === 'development' ? target.expiresAt : Date.now() + 8 * 60 * 60_000), Date.now() + 8 * 60 * 60_000),
-            published: target.kind === 'hosted' && (target.published ?? target.active), bridge,
+            published: target.kind !== 'development' && (target.published ?? target.active), bridge,
             ...(target.lattice ? { lattice: target.lattice } : {}),
             ...(target.taskRoutes ? { taskRoutes: target.taskRoutes } : {}),
         };
@@ -206,10 +241,37 @@ export class ArtifactGatewayControl {
         const target = gatewayTargetSchema.parse(value);
         if (target.kind !== session.kind || target.projectId !== session.projectId || target.ownerId !== session.ownerId ||
             target.environment !== session.environment || target.publicOrigin !== session.publicOrigin || target.expiresAt <= Date.now() ||
-            (target.kind === 'development' ? target.sessionId !== session.sessionId : target.deploymentId !== session.deploymentId || target.frameworkBuildId !== session.frameworkBuildId))
+            (target.kind === 'development' ? target.sessionId !== session.sessionId
+                : target.deploymentId !== session.deploymentId || (target.kind === 'hosted' && target.frameworkBuildId !== session.frameworkBuildId)))
             throw new GatewayControlError(403);
         return target;
     }
+    /**
+     * One immutable file of a static deployment (the page, entry bundle, source map or a chunk), raw
+     * bytes up to the static bundle ceiling. The gateway authorized the browser's session first; this
+     * call carries only the gateway's own credential.
+     */
+    async staticFile({ deploymentId, path, parentOrigin }) {
+        if (!STATIC_FILE_PATH.test(path) || !/^[A-Za-z0-9_-]{1,128}$/.test(deploymentId))
+            throw new GatewayControlError(404);
+        const signal = AbortSignal.timeout(15_000);
+        const credential = await this.credential(signal);
+        const query = path === STATIC_PAGE ? `?parentOrigin=${encodeURIComponent(parentOrigin)}` : '';
+        const response = await (this.options.fetch ?? fetch)(`${this.origin}${ARTIFACT_NEXT_CONTROL_PATH}/static/${deploymentId}/${path}${query}`, {
+            headers: { authorization: `Bearer ${credential}` }, signal, redirect: 'error',
+        });
+        if (!response.ok) {
+            await response.body?.cancel().catch(() => undefined);
+            throw new GatewayControlError(response.status);
+        }
+        const contentType = response.headers.get('content-type') ?? '';
+        if (!STATIC_CONTENT_TYPES.has(contentType.split(';', 1)[0].trim().toLowerCase())) {
+            await response.body?.cancel().catch(() => undefined);
+            throw new GatewayControlError(502);
+        }
+        const body = await readBounded(response, STATIC_FILE_MAX_BYTES);
+        return { body, contentType, etag: response.headers.get('etag') ?? undefined };
+    }
     /** SHA-256 both sides so a wrong bearer still takes constant time. */
     tokenMatches(presented) {
         if (presented.length === 0 || presented.length > 1024)

package/dist/gateway/release-admission.d.ts

@@ -20,4 +20,9 @@ export declare function admitHostedMutation({ request, expectedDeploymentId, exp
 }): Promise<{
     body?: AsyncIterable<Uint8Array>;
 }>;
+/** The release a request names: the deployment header, or the Next build id (header or `dpl` query), never conflicting. */
+export declare function releaseHints(request: IncomingMessage): {
+    deploymentId?: string;
+    frameworkBuildId?: string;
+};
 export {};

package/dist/gateway/release-admission.js

@@ -257,3 +257,22 @@ export async function admitHostedMutation({ request, expectedDeploymentId, expec
     }
     return { body: continuation() };
 }
+/** The release a request names: the deployment header, or the Next build id (header or `dpl` query), never conflicting. */
+export function releaseHints(request) {
+    function uniqueHeader(name) {
+        const value = request.headers[name];
+        if (value === undefined)
+            return undefined;
+        const count = request.rawHeaders.filter((_, index) => index % 2 === 0 && request.rawHeaders[index].toLowerCase() === name).length;
+        if (typeof value !== 'string' || count !== 1 || !artifactNextFrameworkBuildIdSchema.safeParse(value).success)
+            throw new ReleaseAdmissionError('conflicting-release');
+        return value;
+    }
+    const deploymentId = uniqueHeader('x-sequence-artifact-release');
+    const frameworkHeader = uniqueHeader('x-deployment-id');
+    const query = new URL(request.url ?? '/', 'https://gateway.invalid').searchParams.getAll('dpl');
+    if (query.length > 1 || (query.length === 1 && !artifactNextFrameworkBuildIdSchema.safeParse(query[0]).success) ||
+        (frameworkHeader && query.length === 1 && frameworkHeader !== query[0]))
+        throw new ReleaseAdmissionError('conflicting-release');
+    return { deploymentId, frameworkBuildId: frameworkHeader ?? query[0] };
+}

package/dist/gateway/server.d.ts

@@ -5,6 +5,7 @@ import { type GatewaySessionSameSite } from './session.js';
 import { type ArtifactRequestAdmission } from './admission.js';
 import { type GatewayControlAdmission } from './control-admission.js';
 import { type ArtifactGatewayIngressOptions } from './ingress.js';
+import { StaticArtifactFiles } from './static-files.js';
 export interface ArtifactGatewayOptions {
     control: ArtifactGatewayControl;
     runtimeDomain: string;
@@ -28,6 +29,8 @@ export interface ArtifactGatewayOptions {
     controlAdmission?: Pick<GatewayControlAdmission, 'admit'>;
     /** External ingress front door (design §(e)). Absent: every `ingress-*` host answers 404. */
     ingress?: ArtifactGatewayIngressOptions;
+    /** Static deployments' files (default: fetched from Atlas, cached by deployment within the default byte budget). */
+    staticFiles?: Pick<StaticArtifactFiles, 'get'>;
     /** Reuse of a positive Atlas authorization (default GATEWAY_AUTHORIZATION_TTL_MS; 0 disables). */
     authorizationCacheTtlMs?: number;
     onError?: (event: {

package/dist/gateway/server.js

@@ -8,15 +8,15 @@ import { decodeGatewaySession, gatewaySessionCookies, renewGatewaySession, signG
 import { proxyHostedArtifact } from './hosted-proxy.js';
 import { bootstrapPage } from './bootstrap-page.js';
 import { routeSequenceRequest } from './lattice-invoke.js';
-import { admitHostedMutation, ReleaseAdmissionError } from './release-admission.js';
+import { admitHostedMutation, ReleaseAdmissionError, releaseHints } from './release-admission.js';
 import { ArtifactAdmissionError } from './admission.js';
 import { gatewayClientAddress } from './control-admission.js';
 import { gatewayAuthorizationKey, PositiveDecisionCache, tunnelAuthorizationKey } from './authorization-cache.js';
 import { gatewayElapsedMs, GatewayUsageReporter, snapshotGatewayTimings } from './usage.js';
-import { artifactNextFrameworkBuildIdSchema } from '../runtime-contracts.js';
 import { createDevelopmentIngressProxy } from './ingress-development.js';
 import { createIngressHandler, handleClientErrors } from './ingress-handler.js';
 import { resemblesIngressHost } from './ingress.js';
+import { serveStaticTarget, StaticArtifactFiles } from './static-files.js';
 function json(response, status, error) {
     if (response.headersSent) {
         response.destroy();
@@ -42,24 +42,6 @@ function header(request, key) {
 function isServiceWorkerScript(request) {
     return request.headers['service-worker'] !== undefined || request.headers['sec-fetch-dest'] === 'serviceworker';
 }
-function releaseHints(request) {
-    function uniqueHeader(name) {
-        const value = request.headers[name];
-        if (value === undefined)
-            return undefined;
-        const count = request.rawHeaders.filter((_, index) => index % 2 === 0 && request.rawHeaders[index].toLowerCase() === name).length;
-        if (typeof value !== 'string' || count !== 1 || !artifactNextFrameworkBuildIdSchema.safeParse(value).success)
-            throw new ReleaseAdmissionError('conflicting-release');
-        return value;
-    }
-    const deploymentId = uniqueHeader('x-sequence-artifact-release');
-    const frameworkHeader = uniqueHeader('x-deployment-id');
-    const query = new URL(request.url ?? '/', 'https://gateway.invalid').searchParams.getAll('dpl');
-    if (query.length > 1 || (query.length === 1 && !artifactNextFrameworkBuildIdSchema.safeParse(query[0]).success) ||
-        (frameworkHeader && query.length === 1 && frameworkHeader !== query[0]))
-        throw new ReleaseAdmissionError('conflicting-release');
-    return { deploymentId, frameworkBuildId: frameworkHeader ?? query[0] };
-}
 async function boundedJson(request) {
     if (header(request, 'content-type')?.split(';', 1)[0] !== 'application/json')
         throw new GatewayControlError(400);
@@ -74,6 +56,12 @@ async function boundedJson(request) {
     }
     return JSON.parse(Buffer.concat(chunks).toString('utf8'));
 }
+/** Active use renews the session cookie within its admission bound. */
+function renewCookie({ options, request, response, session, target }) {
+    const renewed = renewGatewaySession({ session, authorizedExpiresAt: target.expiresAt });
+    if (renewed)
+        response.setHeader('set-cookie', gatewaySessionCookies({ session: renewed, key: options.sessionKey, cookie: header(request, 'cookie'), renewal: true, sameSite: options.sessionCookieSameSite }));
+}
 /** Probes reach the container by its own address; an application host keeps its own /health route. */
 function isReadinessRequest({ request, gatewayOrigin, runtimeDomain }) {
     if (request.method !== 'GET')
@@ -109,6 +97,7 @@ export function createArtifactGateway(options) {
     const usage = new GatewayUsageReporter({ send: events => options.control.usage(events), onFailure: failure => options.onError?.(failure) });
     let draining = false;
     const isIngressRequest = (request) => resemblesIngressHost({ rawHost: header(request, 'host'), runtimeDomain: options.runtimeDomain });
+    const staticFiles = options.staticFiles ?? new StaticArtifactFiles({ fetch: ({ deploymentId, path }) => options.control.staticFile({ deploymentId, path, parentOrigin }) });
     /** Admission for the unauthenticated endpoints; the release frees the in-flight permit. */
     async function admitControlCall(endpoint, request) {
         if (!options.controlAdmission)
@@ -183,7 +172,8 @@ export function createArtifactGateway(options) {
             ? authorizations.getObserved(lookup) : { promise: authorizations.refresh(lookup), source: 'refresh' };
         const target = await decision.promise;
         const requestId = randomUUID();
-        const result = { session, target, requestId, authorizationCache: decision.source, requestContext: signGatewayContext({
+        // A static deployment has no server of its own to read a request context.
+        const result = { session, target, requestId, authorizationCache: decision.source, requestContext: target.kind === 'static' ? '' : signGatewayContext({
                 session: { ...session, lattice: target.lattice, taskRoutes: target.taskRoutes }, method, path: request.url ?? '/', privateKey: options.contextPrivateKey, keyId: options.contextKeyId,
                 capabilities: target.capabilities, serviceAccountId: target.serviceAccountId, requestId,
             }) };
@@ -305,6 +295,11 @@ export function createArtifactGateway(options) {
             }
             const authorizationStarted = performance.now();
             const { session, target, requestContext, requestId, authorizationCache } = await authorize(request);
+            // Immutable files Atlas already authorized this session for: no admission, context or usage.
+            if (target.kind === 'static') {
+                await serveStaticTarget({ request, response, target, files: staticFiles, renew: () => renewCookie({ options, request, response, session, target }), parentOrigin: session.bridge.parentOrigin });
+                return;
+            }
             const gatewayTimings = { authorizationMs: gatewayElapsedMs(authorizationStarted), authorizationCache };
             let reported = false;
             const report = () => {
@@ -327,9 +322,7 @@ export function createArtifactGateway(options) {
                 report();
                 return;
             }
-            const renewed = renewGatewaySession({ session, authorizedExpiresAt: target.expiresAt });
-            if (renewed)
-                response.setHeader('set-cookie', gatewaySessionCookies({ session: renewed, key: options.sessionKey, cookie: header(request, 'cookie'), renewal: true, sameSite: options.sessionCookieSameSite }));
+            renewCookie({ options, request, response, session, target });
             // Authorization precedes every response, including Next static assets and cached pages.
             response.setHeader('content-security-policy', `frame-ancestors ${session.bridge.parentOrigin}`);
             response.setHeader('referrer-policy', 'same-origin');

package/dist/gateway/session.d.ts

@@ -4,6 +4,7 @@ export declare function gatewayReleaseCookieName(deploymentId: string): string;
 declare const sessionSchema: z.ZodObject<{
     version: z.ZodLiteral<1>;
     kind: z.ZodEnum<{
+        static: "static";
         development: "development";
         hosted: "hosted";
     }>;

package/dist/gateway/session.js

@@ -17,7 +17,7 @@ catch {
 } });
 const id = z.string().min(1).max(255);
 const sessionSchema = z.object({
-    version: z.literal(1), kind: z.enum(['development', 'hosted']),
+    version: z.literal(1), kind: z.enum(['development', 'hosted', 'static']),
     sessionId: id.nullable(), deploymentId: id.nullable(),
     frameworkBuildId: artifactNextFrameworkBuildIdSchema.nullable(), projectId: id, ownerId: id,
     environment: id, publicOrigin: origin, expiresAt: z.number().int().positive(), maxExpiresAt: z.number().int().positive().optional(), published: z.boolean(),
@@ -26,7 +26,10 @@ const sessionSchema = z.object({
     taskRoutes: artifactRequestContextSchema.shape.taskRoutes,
 }).strict().refine(value => value.kind === 'development'
     ? value.sessionId !== null && value.deploymentId === null && value.frameworkBuildId === null && !value.published
-    : value.sessionId === null && value.deploymentId !== null && value.frameworkBuildId !== null);
+    // A static deployment has no Next build: its assets are named by the deployment itself.
+    : value.kind === 'static'
+        ? value.sessionId === null && value.deploymentId !== null && value.frameworkBuildId === null
+        : value.sessionId === null && value.deploymentId !== null && value.frameworkBuildId !== null);
 function sameSessionScope(left, right) {
     return left.ownerId === right.ownerId && left.projectId === right.projectId &&
         left.environment === right.environment && left.publicOrigin === right.publicOrigin &&

package/dist/gateway/static-files.d.ts

@@ -0,0 +1,66 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { type GatewayTarget, type StaticArtifactFile } from './control.js';
+/** Default byte budget for cached static files on one gateway replica (the gateway runs with 1 GiB). */
+export declare const STATIC_CACHE_DEFAULT_BYTES: number;
+/**
+ * Files of static deployments, cached by deployment and path. A deployment's files never change,
+ * so an entry is valid until evicted (least recently used, bounded by bytes). Concurrent misses for
+ * one file share a single fetch. The page is never cached: Atlas renders it, and its bridge script
+ * follows Atlas releases.
+ */
+export declare class StaticArtifactFiles {
+    private readonly options;
+    private readonly entries;
+    private readonly inflight;
+    private bytes;
+    constructor(options: {
+        fetch: (input: {
+            deploymentId: string;
+            path: string;
+        }) => Promise<StaticArtifactFile>;
+        maxBytes?: number;
+    });
+    get cachedBytes(): number;
+    get({ deploymentId, path }: {
+        deploymentId: string;
+        path: string;
+    }): Promise<StaticArtifactFile & {
+        etag: string;
+    }>;
+    private remember;
+}
+/**
+ * The policy a static application runs under: the sandbox's former `<meta>` policy, now a header
+ * on the application's own origin (so `'self'` is the application, never Atlas), plus what a meta
+ * tag cannot express: `frame-ancestors` keeps the page inside Atlas.
+ */
+export declare function staticContentSecurityPolicy(parentOrigin: string): string;
+/**
+ * Where a static request is served from: `/_artifact/<deployment>/<file>` for assets, the page for
+ * every other path (in-app routes live in the hash or the page's own history). Null: not this
+ * deployment's file.
+ */
+export declare function staticFileForRequest({ url, deploymentId }: {
+    url: string;
+    deploymentId: string;
+}): string | null;
+/** Writes one authorized static file: GET or HEAD, revalidated on every use (each request is authorized). */
+export declare function sendStaticFile({ request, response, file, parentOrigin }: {
+    request: IncomingMessage;
+    response: ServerResponse;
+    file: StaticArtifactFile & {
+        etag: string;
+    };
+    parentOrigin: string;
+}): void;
+/** Answers one request for an authorized static target: reads only, and only this deployment's files. */
+export declare function serveStaticTarget({ request, response, target, files, renew, parentOrigin }: {
+    request: IncomingMessage;
+    response: ServerResponse;
+    target: Extract<GatewayTarget, {
+        kind: 'static';
+    }>;
+    files: Pick<StaticArtifactFiles, 'get'>;
+    renew: () => void;
+    parentOrigin: string;
+}): Promise<void>;

package/dist/gateway/static-files.js

@@ -0,0 +1,112 @@
+import { createHash } from 'node:crypto';
+import { GatewayControlError, STATIC_PAGE } from './control.js';
+/** Default byte budget for cached static files on one gateway replica (the gateway runs with 1 GiB). */
+export const STATIC_CACHE_DEFAULT_BYTES = 192 * 1024 * 1024;
+/**
+ * Files of static deployments, cached by deployment and path. A deployment's files never change,
+ * so an entry is valid until evicted (least recently used, bounded by bytes). Concurrent misses for
+ * one file share a single fetch. The page is never cached: Atlas renders it, and its bridge script
+ * follows Atlas releases.
+ */
+export class StaticArtifactFiles {
+    options;
+    entries = new Map();
+    inflight = new Map();
+    bytes = 0;
+    constructor(options) {
+        this.options = options;
+    }
+    get cachedBytes() { return this.bytes; }
+    async get({ deploymentId, path }) {
+        if (path === STATIC_PAGE)
+            return withEtag(await this.options.fetch({ deploymentId, path }));
+        const key = `${deploymentId}/${path}`;
+        const hit = this.entries.get(key);
+        if (hit) {
+            // Refresh recency: a Map iterates in insertion order, so re-insert at the end.
+            this.entries.delete(key);
+            this.entries.set(key, hit);
+            return hit;
+        }
+        const pending = this.inflight.get(key);
+        if (pending)
+            return pending;
+        const load = this.options.fetch({ deploymentId, path }).then(file => {
+            const entry = withEtag(file);
+            this.remember(key, entry);
+            return entry;
+        }).finally(() => { this.inflight.delete(key); });
+        this.inflight.set(key, load);
+        return load;
+    }
+    remember(key, entry) {
+        const limit = this.options.maxBytes ?? STATIC_CACHE_DEFAULT_BYTES;
+        if (entry.body.length > limit)
+            return;
+        this.entries.set(key, entry);
+        this.bytes += entry.body.length;
+        for (const [oldest, value] of this.entries) {
+            if (this.bytes <= limit)
+                break;
+            this.entries.delete(oldest);
+            this.bytes -= value.body.length;
+        }
+    }
+}
+function withEtag(file) {
+    return { ...file, etag: file.etag ?? `"${createHash('sha256').update(file.body).digest('base64url')}"` };
+}
+/**
+ * The policy a static application runs under: the sandbox's former `<meta>` policy, now a header
+ * on the application's own origin (so `'self'` is the application, never Atlas), plus what a meta
+ * tag cannot express: `frame-ancestors` keeps the page inside Atlas.
+ */
+export function staticContentSecurityPolicy(parentOrigin) {
+    return [
+        "default-src 'none'", "script-src 'self' 'unsafe-inline' 'unsafe-eval'", "style-src 'self' 'unsafe-inline'",
+        "img-src 'self' data: blob: https:", "font-src 'self' data:", "connect-src 'self' blob:", "worker-src 'self' blob:",
+        "object-src blob:", "frame-src blob:", `frame-ancestors ${parentOrigin}`, "base-uri 'none'", "form-action 'none'",
+    ].join('; ');
+}
+/**
+ * Where a static request is served from: `/_artifact/<deployment>/<file>` for assets, the page for
+ * every other path (in-app routes live in the hash or the page's own history). Null: not this
+ * deployment's file.
+ */
+export function staticFileForRequest({ url, deploymentId }) {
+    const pathname = new URL(url, 'https://static.invalid').pathname;
+    const prefix = '/_artifact/';
+    if (!pathname.startsWith(prefix))
+        return STATIC_PAGE;
+    const [requested, ...rest] = pathname.slice(prefix.length).split('/');
+    if (requested !== deploymentId)
+        return null;
+    const file = rest.join('/');
+    return /^(?:bundle\.js|sourcemap\.json|chunks\/[A-Za-z0-9._-]{1,200})$/.test(file) ? file : null;
+}
+/** Writes one authorized static file: GET or HEAD, revalidated on every use (each request is authorized). */
+export function sendStaticFile({ request, response, file, parentOrigin }) {
+    const headers = {
+        'content-type': file.contentType, etag: file.etag, 'cache-control': 'private, no-cache',
+        'content-security-policy': staticContentSecurityPolicy(parentOrigin),
+        'x-content-type-options': 'nosniff', 'referrer-policy': 'same-origin',
+    };
+    if (request.headers['if-none-match'] === file.etag) {
+        response.writeHead(304, headers);
+        response.end();
+        return;
+    }
+    response.writeHead(200, { ...headers, 'content-length': String(file.body.length) });
+    response.end(request.method === 'HEAD' ? undefined : file.body);
+}
+/** Answers one request for an authorized static target: reads only, and only this deployment's files. */
+export async function serveStaticTarget({ request, response, target, files, renew, parentOrigin }) {
+    if (!['GET', 'HEAD'].includes(request.method ?? 'GET'))
+        throw new GatewayControlError(405);
+    const path = staticFileForRequest({ url: request.url ?? '/', deploymentId: target.deploymentId });
+    if (!path)
+        throw new GatewayControlError(404);
+    const file = await files.get({ deploymentId: target.deploymentId, path });
+    renew();
+    sendStaticFile({ request, response, file, parentOrigin });
+}

package/dist/manifest-next.d.ts

@@ -401,6 +401,10 @@ export declare const artifactStudioNextManifestSchema: z.ZodObject<{
         mobile: z.ZodOptional<z.ZodEnum<{
             responsive: "responsive";
         }>>;
+        status: z.ZodOptional<z.ZodEnum<{
+            alpha: "alpha";
+            beta: "beta";
+        }>>;
     }, z.core.$strip>>;
     sidebarIcon: z.ZodOptional<z.ZodString>;
     sidebarBadge: z.ZodOptional<z.ZodObject<{

package/dist/manifest-static.d.ts

@@ -12,6 +12,10 @@ export declare const artifactPresentationSchema: z.ZodObject<{
     mobile: z.ZodOptional<z.ZodEnum<{
         responsive: "responsive";
     }>>;
+    status: z.ZodOptional<z.ZodEnum<{
+        alpha: "alpha";
+        beta: "beta";
+    }>>;
 }, z.core.$strip>;
 export type ArtifactPresentation = z.infer<typeof artifactPresentationSchema>;
 export declare const artifactOfflineCapabilitySchema: z.ZodObject<{
@@ -95,6 +99,10 @@ export declare const artifactStudioStaticManifestSchema: z.ZodObject<{
         mobile: z.ZodOptional<z.ZodEnum<{
             responsive: "responsive";
         }>>;
+        status: z.ZodOptional<z.ZodEnum<{
+            alpha: "alpha";
+            beta: "beta";
+        }>>;
     }, z.core.$strip>>;
     offline: z.ZodOptional<z.ZodObject<{
         mode: z.ZodEnum<{

package/dist/manifest-static.js

@@ -16,6 +16,11 @@ export const sidebarBadgeSchema = z.object({
 });
 export const artifactPresentationSchema = z.object({
     mobile: z.enum(['responsive']).optional(),
+    /**
+     * Lifecycle stage the Atlas shell shows as an Alpha/Beta badge beside the
+     * app's name. Omit for GA. Mirrors `App.status` for native apps.
+     */
+    status: z.enum(['alpha', 'beta']).optional(),
 });
 export const artifactOfflineCapabilitySchema = z.object({
     mode: z.enum(['read', 'read-write']),

package/dist/manifest.d.ts

@@ -69,6 +69,10 @@ export declare const artifactStudioManifestSchema: z.ZodUnion<readonly [z.ZodObj
         mobile: z.ZodOptional<z.ZodEnum<{
             responsive: "responsive";
         }>>;
+        status: z.ZodOptional<z.ZodEnum<{
+            alpha: "alpha";
+            beta: "beta";
+        }>>;
     }, z.core.$strip>>;
     offline: z.ZodOptional<z.ZodObject<{
         mode: z.ZodEnum<{
@@ -284,6 +288,10 @@ export declare const artifactStudioManifestSchema: z.ZodUnion<readonly [z.ZodObj
         mobile: z.ZodOptional<z.ZodEnum<{
             responsive: "responsive";
         }>>;
+        status: z.ZodOptional<z.ZodEnum<{
+            alpha: "alpha";
+            beta: "beta";
+        }>>;
     }, z.core.$strip>>;
     sidebarIcon: z.ZodOptional<z.ZodString>;
     sidebarBadge: z.ZodOptional<z.ZodObject<{

package/dist/source-boundary.d.ts

@@ -11,3 +11,9 @@ export interface ArtifactSourceBoundaryOptions {
  * allowed because they are external to the artifact by design.
  */
 export declare function rejectOutsideSourcePlugin({ root, trustedExternalRoots, }: ArtifactSourceBoundaryOptions): Plugin;
+/**
+ * Whether `filePath` is inside a `node_modules` directory. Bundlers pass
+ * Windows paths with forward slashes, so compare in that form whatever the
+ * platform separator is.
+ */
+export declare function isNodeModulesPath(filePath: string): boolean;

package/dist/source-boundary.js

@@ -46,8 +46,13 @@ function isPathWithin(root, candidate) {
 function isTrustedExternalPath(filePath, trustedRoots) {
     return trustedRoots.some((trustedRoot) => isPathWithin(trustedRoot, filePath));
 }
-function isNodeModulesPath(filePath) {
-    return filePath.includes(`${sep}node_modules${sep}`);
+/**
+ * Whether `filePath` is inside a `node_modules` directory. Bundlers pass
+ * Windows paths with forward slashes, so compare in that form whatever the
+ * platform separator is.
+ */
+export function isNodeModulesPath(filePath) {
+    return filePath.replaceAll('\\', '/').includes('/node_modules/');
 }
 function isBareImport(source) {
     return !source.startsWith('.') && !isAbsolute(source);

package/dist/templates/react-vite/package.json

@@ -5,7 +5,8 @@
   "scripts": {
     "dev": "vite",
     "build": "vite build",
-    "preview": "vite preview"
+    "preview": "vite preview",
+    "type-check": "tsc --noEmit"
   },
   "dependencies": {},
   "devDependencies": {
@@ -14,6 +15,8 @@
     "@tailwindcss/postcss": "^4.2.2",
     "@tailwindcss/vite": "^4.2.2",
     "@tanstack/react-query": "^4.36.1",
+    "@types/react": "^18.3.31",
+    "@types/react-dom": "^18.3.7",
     "@vitejs/plugin-react": "^5.0.0",
     "react": "^18.2.0",
     "react-dom": "^18.2.0",

package/dist/templates/react-vite/tsconfig.json

@@ -0,0 +1,17 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["dom", "dom.iterable", "esnext"],
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "react-jsx",
+    "types": ["vite/client"]
+  },
+  "include": ["src", "vite.config.ts"]
+}

package/package.json

@@ -9,7 +9,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "SDK types and CLI library for building Artifact Studio apps. Driven via `seq-studio artifact <sub>` (@sequenceholdings/studio-cli), which runs the `./cli` runCli export.",
   "type": "module",
   "exports": {
@@ -159,6 +159,7 @@
     "sonner": "^2.0.7",
     "tailwindcss": "^4.1.8",
     "tw-animate-css": "^1.4.0",
+    "typescript": "^5.6.0",
     "vite": "8.0.16",
     "zod": "^4.1.13",
     "ws": "^8.21.0",
@@ -168,12 +169,11 @@
     "parse5": "7.3.0",
     "@sequenceholdings/lattice-form-renderer": "0.2.0",
     "@sequenceholdings/storage": "0.1.1",
-    "@sequenceholdings/orm": "2.6.0"
+    "@sequenceholdings/orm": "2.6.1"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.0.0",
-    "typescript": "^5.6.0",
     "vitest": "^4.1.11",
     "@types/ws": "^8.18.1"
   },

package/templates/react-vite/package.json

@@ -5,7 +5,8 @@
   "scripts": {
     "dev": "vite",
     "build": "vite build",
-    "preview": "vite preview"
+    "preview": "vite preview",
+    "type-check": "tsc --noEmit"
   },
   "dependencies": {},
   "devDependencies": {
@@ -14,6 +15,8 @@
     "@tailwindcss/postcss": "^4.2.2",
     "@tailwindcss/vite": "^4.2.2",
     "@tanstack/react-query": "^4.36.1",
+    "@types/react": "^18.3.31",
+    "@types/react-dom": "^18.3.7",
     "@vitejs/plugin-react": "^5.0.0",
     "react": "^18.2.0",
     "react-dom": "^18.2.0",

package/templates/react-vite/tsconfig.json

@@ -0,0 +1,17 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["dom", "dom.iterable", "esnext"],
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "react-jsx",
+    "types": ["vite/client"]
+  },
+  "include": ["src", "vite.config.ts"]
+}