@sequenceholdings/artifact-studio 0.7.0 → 0.8.0

package/dist/build.js

@@ -1,5 +1,5 @@
 import { existsSync } from 'node:fs';
-import { mkdir, writeFile } from 'node:fs/promises';
+import { mkdir, realpath, writeFile } from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import { dirname, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -122,7 +122,9 @@ export async function buildArtifactStudioProject(rootDir, { candidateTokenCompat
             ? collectCandidateTokenCompatibilityDiagnostics({ files: source.files })
             : []),
     ];
-    const root = source.root;
+    // Vite resolves imports to physical paths, including macOS /tmp -> /private/tmp.
+    // Give Vite and the source boundary the same physical root.
+    const root = await realpath(source.root);
     const transformedCssModules = new Map();
     const result = await viteBuild({
         root,

package/dist/gateway/bootstrap-page.js

@@ -21,6 +21,14 @@ export function bootstrapLandingUrl(route, origin) {
         return root;
     }
 }
+/**
+ * Transparent while it connects, so the frame keeps the host's own background through the exchange
+ * and the redirect (a white page reading "Connecting" flashed between Atlas and the app). Only a
+ * failure is shown, on its own light card so it reads over either host theme.
+ */
+const BOOTSTRAP_STYLE = 'html,body{margin:0;height:100%;background:transparent}'
+    + 'body{display:flex;align-items:center;justify-content:center;font:14px/1.4 system-ui,sans-serif}'
+    + '#status:empty{display:none}#status{margin:16px;padding:12px 16px;border-radius:8px;background:#fff;color:#27272a;box-shadow:0 1px 3px rgba(0,0,0,.2)}';
 /** The bootstrap ticket travels in a fragment and a POST body, never a request URL or log. The page
  * exchanges it only inside the Atlas frame; browsers without Fetch Metadata are covered by the script check. */
 export function bootstrapPage({ response, parentOrigin }) {
@@ -28,7 +36,7 @@ export function bootstrapPage({ response, parentOrigin }) {
     response.writeHead(200, {
         'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', 'referrer-policy': 'no-referrer',
         'x-content-type-options': 'nosniff',
-        'content-security-policy': `default-src 'none'; script-src 'nonce-${nonce}'; connect-src 'self'; frame-ancestors ${parentOrigin}; base-uri 'none'; form-action 'none'`,
+        'content-security-policy': `default-src 'none'; script-src 'nonce-${nonce}'; style-src 'nonce-${nonce}'; connect-src 'self'; frame-ancestors ${parentOrigin}; base-uri 'none'; form-action 'none'`,
     });
-    response.end(`<!doctype html><meta charset="utf-8"><title>Connecting application</title><p id="status">Connecting application…</p><script nonce="${nonce}">(() => {const landing=${bootstrapLandingUrl.toString()};const fragment=new URLSearchParams(location.hash.slice(1));const ticket=fragment.get('ticket');history.replaceState(null,'',location.pathname);if(!ticket||window.top===window){document.getElementById('status').textContent='Open this application from Atlas.';return;}fetch('/_sequence/session',{method:'POST',credentials:'same-origin',headers:{'content-type':'application/json'},body:JSON.stringify({ticket})}).then(r=>{if(!r.ok)throw new Error();location.replace(landing(fragment.get('route'),location.origin));}).catch(()=>{document.getElementById('status').textContent='This preview expired. Open it again from Atlas.';});})();</script>`);
+    response.end(`<!doctype html><meta charset="utf-8"><title>Opening application</title><style nonce="${nonce}">${BOOTSTRAP_STYLE}</style><p id="status" role="status"></p><script nonce="${nonce}">(() => {const landing=${bootstrapLandingUrl.toString()};const fragment=new URLSearchParams(location.hash.slice(1));const ticket=fragment.get('ticket');history.replaceState(null,'',location.pathname);if(!ticket||window.top===window){document.getElementById('status').textContent='Open this application from Atlas.';return;}fetch('/_sequence/session',{method:'POST',credentials:'same-origin',headers:{'content-type':'application/json'},body:JSON.stringify({ticket})}).then(r=>{if(!r.ok)throw new Error();location.replace(landing(fragment.get('route'),location.origin));}).catch(()=>{document.getElementById('status').textContent='This preview expired. Open it again from Atlas.';});})();</script>`);
 }

package/dist/gateway/control.d.ts

@@ -67,6 +67,36 @@ export declare const gatewayTargetSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             }, z.core.$strip>;
         }, z.core.$strip>;
     }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"static">;
+    deploymentId: z.ZodString;
+    contentHash: z.ZodString;
+    active: z.ZodBoolean;
+    published: z.ZodOptional<z.ZodBoolean>;
+    projectId: z.ZodString;
+    ownerId: z.ZodString;
+    environment: z.ZodString;
+    publicOrigin: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    expiresAt: z.ZodNumber;
+    maxExpiresAt: z.ZodOptional<z.ZodNumber>;
+    capabilities: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    serviceAccountId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    lattice: z.ZodOptional<z.ZodObject<{
+        runId: z.ZodNullable<z.ZodString>;
+        nodeId: z.ZodNullable<z.ZodString>;
+        stepId: z.ZodNullable<z.ZodString>;
+        processId: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    taskRoutes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    manifest: z.ZodOptional<z.ZodObject<{
+        server: z.ZodObject<{
+            resources: z.ZodObject<{
+                concurrency: z.ZodNumber;
+                max_instances: z.ZodNumber;
+                timeout_seconds: z.ZodNumber;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
 }, z.core.$strip>], "kind">;
 export type GatewayTarget = z.infer<typeof gatewayTargetSchema>;
 declare const latticeInvokeGrantSchema: z.ZodObject<{
@@ -91,6 +121,15 @@ declare const latticeInvokeGrantSchema: z.ZodObject<{
     }, z.core.$strict>;
 }, z.core.$strict>;
 export type LatticeInvokeGrant = z.infer<typeof latticeInvokeGrantSchema>;
+/** Paths a static deployment serves: its page, entry bundle, source map and lazy chunks. */
+export declare const STATIC_PAGE = "index.html";
+/** The static bundle ceiling (30 MiB) plus headroom; a larger file is a platform fault, never served. */
+export declare const STATIC_FILE_MAX_BYTES: number;
+export interface StaticArtifactFile {
+    body: Buffer;
+    contentType: string;
+    etag?: string;
+}
 export declare class GatewayControlError extends Error {
     readonly status: number;
     constructor(status: number);
@@ -156,6 +195,16 @@ export declare class ArtifactGatewayControl {
         target: GatewayTarget;
     }>;
     authorize(session: GatewaySession): Promise<GatewayTarget>;
+    /**
+     * One immutable file of a static deployment (the page, entry bundle, source map or a chunk), raw
+     * bytes up to the static bundle ceiling. The gateway authorized the browser's session first; this
+     * call carries only the gateway's own credential.
+     */
+    staticFile({ deploymentId, path, parentOrigin }: {
+        deploymentId: string;
+        path: string;
+        parentOrigin: string;
+    }): Promise<StaticArtifactFile>;
     /** SHA-256 both sides so a wrong bearer still takes constant time. */
     tokenMatches(presented: string): boolean;
     latticeInvoke(body: {

package/dist/gateway/control.js

@@ -20,6 +20,8 @@ const base = {
 export const gatewayTargetSchema = z.discriminatedUnion('kind', [
     z.object({ ...base, kind: z.literal('development'), sessionId: id, epoch: z.number().int().positive() }),
     z.object({ ...base, kind: z.literal('hosted'), deploymentId: id, frameworkBuildId: artifactNextFrameworkBuildIdSchema, upstreamUrl: z.string().url(), upstreamAudience: z.string().url().optional(), runtimeTransport: z.enum(['cloud-run', 'local-docker']).optional(), active: z.boolean(), published: z.boolean().optional() }),
+    // A static (React/Vite) deployment: the gateway serves its immutable files itself, fetched from Atlas.
+    z.object({ ...base, kind: z.literal('static'), deploymentId: id, contentHash: z.string().min(1).max(128), active: z.boolean(), published: z.boolean().optional() }),
 ]);
 const bootstrapSchema = z.object({ parentOrigin: z.string().transform(normalizePublicOrigin), channelId: id, nonce: z.string().min(16).max(255) });
 const usageResultSchema = z.object({ rejected: z.number().int().nonnegative() });
@@ -41,6 +43,39 @@ const latticeInvokeGrantSchema = z.object({
         timeout_seconds: z.number().int().min(1).max(300),
     }).strict(),
 }).strict();
+/** Paths a static deployment serves: its page, entry bundle, source map and lazy chunks. */
+export const STATIC_PAGE = 'index.html';
+const STATIC_FILE_PATH = /^(?:index\.html|bundle\.js|sourcemap\.json|chunks\/[A-Za-z0-9._-]{1,200})$/;
+/** The static bundle ceiling (30 MiB) plus headroom; a larger file is a platform fault, never served. */
+export const STATIC_FILE_MAX_BYTES = 32 * 1024 * 1024;
+const STATIC_CONTENT_TYPES = new Set(['text/html', 'application/javascript', 'text/javascript', 'application/json', 'text/css']);
+/** Reads at most `maxBytes` of a response body, refusing (502) anything larger. */
+async function readBounded(response, maxBytes) {
+    if (Number(response.headers.get('content-length')) > maxBytes) {
+        await response.body?.cancel().catch(() => undefined);
+        throw new GatewayControlError(502);
+    }
+    const reader = response.body?.getReader();
+    if (!reader)
+        throw new GatewayControlError(502);
+    const chunks = [];
+    let length = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            length += value.length;
+            if (length > maxBytes)
+                throw new GatewayControlError(502);
+            chunks.push(value);
+        }
+        return Buffer.concat(chunks);
+    }
+    finally {
+        await reader.cancel().catch(() => undefined);
+    }
+}
 export class GatewayControlError extends Error {
     status;
     constructor(status) {
@@ -186,11 +221,11 @@ export class ArtifactGatewayControl {
             version: 1, kind: target.kind, projectId: target.projectId, ownerId: target.ownerId,
             environment: target.environment, publicOrigin: target.publicOrigin,
             sessionId: target.kind === 'development' ? target.sessionId : null,
-            deploymentId: target.kind === 'hosted' ? target.deploymentId : null,
+            deploymentId: target.kind === 'development' ? null : target.deploymentId,
             frameworkBuildId: target.kind === 'hosted' ? target.frameworkBuildId : null,
             expiresAt: Math.min(target.expiresAt, target.maxExpiresAt ?? target.expiresAt, Date.now() + 8 * 60 * 60_000),
             maxExpiresAt: Math.min(target.maxExpiresAt ?? (target.kind === 'development' ? target.expiresAt : Date.now() + 8 * 60 * 60_000), Date.now() + 8 * 60 * 60_000),
-            published: target.kind === 'hosted' && (target.published ?? target.active), bridge,
+            published: target.kind !== 'development' && (target.published ?? target.active), bridge,
             ...(target.lattice ? { lattice: target.lattice } : {}),
             ...(target.taskRoutes ? { taskRoutes: target.taskRoutes } : {}),
         };
@@ -206,10 +241,37 @@ export class ArtifactGatewayControl {
         const target = gatewayTargetSchema.parse(value);
         if (target.kind !== session.kind || target.projectId !== session.projectId || target.ownerId !== session.ownerId ||
             target.environment !== session.environment || target.publicOrigin !== session.publicOrigin || target.expiresAt <= Date.now() ||
-            (target.kind === 'development' ? target.sessionId !== session.sessionId : target.deploymentId !== session.deploymentId || target.frameworkBuildId !== session.frameworkBuildId))
+            (target.kind === 'development' ? target.sessionId !== session.sessionId
+                : target.deploymentId !== session.deploymentId || (target.kind === 'hosted' && target.frameworkBuildId !== session.frameworkBuildId)))
             throw new GatewayControlError(403);
         return target;
     }
+    /**
+     * One immutable file of a static deployment (the page, entry bundle, source map or a chunk), raw
+     * bytes up to the static bundle ceiling. The gateway authorized the browser's session first; this
+     * call carries only the gateway's own credential.
+     */
+    async staticFile({ deploymentId, path, parentOrigin }) {
+        if (!STATIC_FILE_PATH.test(path) || !/^[A-Za-z0-9_-]{1,128}$/.test(deploymentId))
+            throw new GatewayControlError(404);
+        const signal = AbortSignal.timeout(15_000);
+        const credential = await this.credential(signal);
+        const query = path === STATIC_PAGE ? `?parentOrigin=${encodeURIComponent(parentOrigin)}` : '';
+        const response = await (this.options.fetch ?? fetch)(`${this.origin}${ARTIFACT_NEXT_CONTROL_PATH}/static/${deploymentId}/${path}${query}`, {
+            headers: { authorization: `Bearer ${credential}` }, signal, redirect: 'error',
+        });
+        if (!response.ok) {
+            await response.body?.cancel().catch(() => undefined);
+            throw new GatewayControlError(response.status);
+        }
+        const contentType = response.headers.get('content-type') ?? '';
+        if (!STATIC_CONTENT_TYPES.has(contentType.split(';', 1)[0].trim().toLowerCase())) {
+            await response.body?.cancel().catch(() => undefined);
+            throw new GatewayControlError(502);
+        }
+        const body = await readBounded(response, STATIC_FILE_MAX_BYTES);
+        return { body, contentType, etag: response.headers.get('etag') ?? undefined };
+    }
     /** SHA-256 both sides so a wrong bearer still takes constant time. */
     tokenMatches(presented) {
         if (presented.length === 0 || presented.length > 1024)

package/dist/gateway/release-admission.d.ts

@@ -20,4 +20,9 @@ export declare function admitHostedMutation({ request, expectedDeploymentId, exp
 }): Promise<{
     body?: AsyncIterable<Uint8Array>;
 }>;
+/** The release a request names: the deployment header, or the Next build id (header or `dpl` query), never conflicting. */
+export declare function releaseHints(request: IncomingMessage): {
+    deploymentId?: string;
+    frameworkBuildId?: string;
+};
 export {};

package/dist/gateway/release-admission.js

@@ -257,3 +257,22 @@ export async function admitHostedMutation({ request, expectedDeploymentId, expec
     }
     return { body: continuation() };
 }
+/** The release a request names: the deployment header, or the Next build id (header or `dpl` query), never conflicting. */
+export function releaseHints(request) {
+    function uniqueHeader(name) {
+        const value = request.headers[name];
+        if (value === undefined)
+            return undefined;
+        const count = request.rawHeaders.filter((_, index) => index % 2 === 0 && request.rawHeaders[index].toLowerCase() === name).length;
+        if (typeof value !== 'string' || count !== 1 || !artifactNextFrameworkBuildIdSchema.safeParse(value).success)
+            throw new ReleaseAdmissionError('conflicting-release');
+        return value;
+    }
+    const deploymentId = uniqueHeader('x-sequence-artifact-release');
+    const frameworkHeader = uniqueHeader('x-deployment-id');
+    const query = new URL(request.url ?? '/', 'https://gateway.invalid').searchParams.getAll('dpl');
+    if (query.length > 1 || (query.length === 1 && !artifactNextFrameworkBuildIdSchema.safeParse(query[0]).success) ||
+        (frameworkHeader && query.length === 1 && frameworkHeader !== query[0]))
+        throw new ReleaseAdmissionError('conflicting-release');
+    return { deploymentId, frameworkBuildId: frameworkHeader ?? query[0] };
+}

package/dist/gateway/server.d.ts

@@ -5,6 +5,7 @@ import { type GatewaySessionSameSite } from './session.js';
 import { type ArtifactRequestAdmission } from './admission.js';
 import { type GatewayControlAdmission } from './control-admission.js';
 import { type ArtifactGatewayIngressOptions } from './ingress.js';
+import { StaticArtifactFiles } from './static-files.js';
 export interface ArtifactGatewayOptions {
     control: ArtifactGatewayControl;
     runtimeDomain: string;
@@ -28,6 +29,8 @@ export interface ArtifactGatewayOptions {
     controlAdmission?: Pick<GatewayControlAdmission, 'admit'>;
     /** External ingress front door (design §(e)). Absent: every `ingress-*` host answers 404. */
     ingress?: ArtifactGatewayIngressOptions;
+    /** Static deployments' files (default: fetched from Atlas, cached by deployment within the default byte budget). */
+    staticFiles?: Pick<StaticArtifactFiles, 'get'>;
     /** Reuse of a positive Atlas authorization (default GATEWAY_AUTHORIZATION_TTL_MS; 0 disables). */
     authorizationCacheTtlMs?: number;
     onError?: (event: {

package/dist/gateway/server.js

@@ -8,15 +8,15 @@ import { decodeGatewaySession, gatewaySessionCookies, renewGatewaySession, signG
 import { proxyHostedArtifact } from './hosted-proxy.js';
 import { bootstrapPage } from './bootstrap-page.js';
 import { routeSequenceRequest } from './lattice-invoke.js';
-import { admitHostedMutation, ReleaseAdmissionError } from './release-admission.js';
+import { admitHostedMutation, ReleaseAdmissionError, releaseHints } from './release-admission.js';
 import { ArtifactAdmissionError } from './admission.js';
 import { gatewayClientAddress } from './control-admission.js';
 import { gatewayAuthorizationKey, PositiveDecisionCache, tunnelAuthorizationKey } from './authorization-cache.js';
 import { gatewayElapsedMs, GatewayUsageReporter, snapshotGatewayTimings } from './usage.js';
-import { artifactNextFrameworkBuildIdSchema } from '../runtime-contracts.js';
 import { createDevelopmentIngressProxy } from './ingress-development.js';
 import { createIngressHandler, handleClientErrors } from './ingress-handler.js';
 import { resemblesIngressHost } from './ingress.js';
+import { serveStaticTarget, StaticArtifactFiles } from './static-files.js';
 function json(response, status, error) {
     if (response.headersSent) {
         response.destroy();
@@ -42,24 +42,6 @@ function header(request, key) {
 function isServiceWorkerScript(request) {
     return request.headers['service-worker'] !== undefined || request.headers['sec-fetch-dest'] === 'serviceworker';
 }
-function releaseHints(request) {
-    function uniqueHeader(name) {
-        const value = request.headers[name];
-        if (value === undefined)
-            return undefined;
-        const count = request.rawHeaders.filter((_, index) => index % 2 === 0 && request.rawHeaders[index].toLowerCase() === name).length;
-        if (typeof value !== 'string' || count !== 1 || !artifactNextFrameworkBuildIdSchema.safeParse(value).success)
-            throw new ReleaseAdmissionError('conflicting-release');
-        return value;
-    }
-    const deploymentId = uniqueHeader('x-sequence-artifact-release');
-    const frameworkHeader = uniqueHeader('x-deployment-id');
-    const query = new URL(request.url ?? '/', 'https://gateway.invalid').searchParams.getAll('dpl');
-    if (query.length > 1 || (query.length === 1 && !artifactNextFrameworkBuildIdSchema.safeParse(query[0]).success) ||
-        (frameworkHeader && query.length === 1 && frameworkHeader !== query[0]))
-        throw new ReleaseAdmissionError('conflicting-release');
-    return { deploymentId, frameworkBuildId: frameworkHeader ?? query[0] };
-}
 async function boundedJson(request) {
     if (header(request, 'content-type')?.split(';', 1)[0] !== 'application/json')
         throw new GatewayControlError(400);
@@ -74,6 +56,12 @@ async function boundedJson(request) {
     }
     return JSON.parse(Buffer.concat(chunks).toString('utf8'));
 }
+/** Active use renews the session cookie within its admission bound. */
+function renewCookie({ options, request, response, session, target }) {
+    const renewed = renewGatewaySession({ session, authorizedExpiresAt: target.expiresAt });
+    if (renewed)
+        response.setHeader('set-cookie', gatewaySessionCookies({ session: renewed, key: options.sessionKey, cookie: header(request, 'cookie'), renewal: true, sameSite: options.sessionCookieSameSite }));
+}
 /** Probes reach the container by its own address; an application host keeps its own /health route. */
 function isReadinessRequest({ request, gatewayOrigin, runtimeDomain }) {
     if (request.method !== 'GET')
@@ -109,6 +97,7 @@ export function createArtifactGateway(options) {
     const usage = new GatewayUsageReporter({ send: events => options.control.usage(events), onFailure: failure => options.onError?.(failure) });
     let draining = false;
     const isIngressRequest = (request) => resemblesIngressHost({ rawHost: header(request, 'host'), runtimeDomain: options.runtimeDomain });
+    const staticFiles = options.staticFiles ?? new StaticArtifactFiles({ fetch: ({ deploymentId, path }) => options.control.staticFile({ deploymentId, path, parentOrigin }) });
     /** Admission for the unauthenticated endpoints; the release frees the in-flight permit. */
     async function admitControlCall(endpoint, request) {
         if (!options.controlAdmission)
@@ -183,7 +172,8 @@ export function createArtifactGateway(options) {
             ? authorizations.getObserved(lookup) : { promise: authorizations.refresh(lookup), source: 'refresh' };
         const target = await decision.promise;
         const requestId = randomUUID();
-        const result = { session, target, requestId, authorizationCache: decision.source, requestContext: signGatewayContext({
+        // A static deployment has no server of its own to read a request context.
+        const result = { session, target, requestId, authorizationCache: decision.source, requestContext: target.kind === 'static' ? '' : signGatewayContext({
                 session: { ...session, lattice: target.lattice, taskRoutes: target.taskRoutes }, method, path: request.url ?? '/', privateKey: options.contextPrivateKey, keyId: options.contextKeyId,
                 capabilities: target.capabilities, serviceAccountId: target.serviceAccountId, requestId,
             }) };
@@ -305,6 +295,11 @@ export function createArtifactGateway(options) {
             }
             const authorizationStarted = performance.now();
             const { session, target, requestContext, requestId, authorizationCache } = await authorize(request);
+            // Immutable files Atlas already authorized this session for: no admission, context or usage.
+            if (target.kind === 'static') {
+                await serveStaticTarget({ request, response, target, files: staticFiles, renew: () => renewCookie({ options, request, response, session, target }), parentOrigin: session.bridge.parentOrigin });
+                return;
+            }
             const gatewayTimings = { authorizationMs: gatewayElapsedMs(authorizationStarted), authorizationCache };
             let reported = false;
             const report = () => {
@@ -327,9 +322,7 @@ export function createArtifactGateway(options) {
                 report();
                 return;
             }
-            const renewed = renewGatewaySession({ session, authorizedExpiresAt: target.expiresAt });
-            if (renewed)
-                response.setHeader('set-cookie', gatewaySessionCookies({ session: renewed, key: options.sessionKey, cookie: header(request, 'cookie'), renewal: true, sameSite: options.sessionCookieSameSite }));
+            renewCookie({ options, request, response, session, target });
             // Authorization precedes every response, including Next static assets and cached pages.
             response.setHeader('content-security-policy', `frame-ancestors ${session.bridge.parentOrigin}`);
             response.setHeader('referrer-policy', 'same-origin');

package/dist/gateway/session.d.ts

@@ -4,6 +4,7 @@ export declare function gatewayReleaseCookieName(deploymentId: string): string;
 declare const sessionSchema: z.ZodObject<{
     version: z.ZodLiteral<1>;
     kind: z.ZodEnum<{
+        static: "static";
         development: "development";
         hosted: "hosted";
     }>;

package/dist/gateway/session.js

@@ -17,7 +17,7 @@ catch {
 } });
 const id = z.string().min(1).max(255);
 const sessionSchema = z.object({
-    version: z.literal(1), kind: z.enum(['development', 'hosted']),
+    version: z.literal(1), kind: z.enum(['development', 'hosted', 'static']),
     sessionId: id.nullable(), deploymentId: id.nullable(),
     frameworkBuildId: artifactNextFrameworkBuildIdSchema.nullable(), projectId: id, ownerId: id,
     environment: id, publicOrigin: origin, expiresAt: z.number().int().positive(), maxExpiresAt: z.number().int().positive().optional(), published: z.boolean(),
@@ -26,7 +26,10 @@ const sessionSchema = z.object({
     taskRoutes: artifactRequestContextSchema.shape.taskRoutes,
 }).strict().refine(value => value.kind === 'development'
     ? value.sessionId !== null && value.deploymentId === null && value.frameworkBuildId === null && !value.published
-    : value.sessionId === null && value.deploymentId !== null && value.frameworkBuildId !== null);
+    // A static deployment has no Next build: its assets are named by the deployment itself.
+    : value.kind === 'static'
+        ? value.sessionId === null && value.deploymentId !== null && value.frameworkBuildId === null
+        : value.sessionId === null && value.deploymentId !== null && value.frameworkBuildId !== null);
 function sameSessionScope(left, right) {
     return left.ownerId === right.ownerId && left.projectId === right.projectId &&
         left.environment === right.environment && left.publicOrigin === right.publicOrigin &&

package/dist/gateway/static-files.d.ts

@@ -0,0 +1,66 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { type GatewayTarget, type StaticArtifactFile } from './control.js';
+/** Default byte budget for cached static files on one gateway replica (the gateway runs with 1 GiB). */
+export declare const STATIC_CACHE_DEFAULT_BYTES: number;
+/**
+ * Files of static deployments, cached by deployment and path. A deployment's files never change,
+ * so an entry is valid until evicted (least recently used, bounded by bytes). Concurrent misses for
+ * one file share a single fetch. The page is never cached: Atlas renders it, and its bridge script
+ * follows Atlas releases.
+ */
+export declare class StaticArtifactFiles {
+    private readonly options;
+    private readonly entries;
+    private readonly inflight;
+    private bytes;
+    constructor(options: {
+        fetch: (input: {
+            deploymentId: string;
+            path: string;
+        }) => Promise<StaticArtifactFile>;
+        maxBytes?: number;
+    });
+    get cachedBytes(): number;
+    get({ deploymentId, path }: {
+        deploymentId: string;
+        path: string;
+    }): Promise<StaticArtifactFile & {
+        etag: string;
+    }>;
+    private remember;
+}
+/**
+ * The policy a static application runs under: the sandbox's former `<meta>` policy, now a header
+ * on the application's own origin (so `'self'` is the application, never Atlas), plus what a meta
+ * tag cannot express: `frame-ancestors` keeps the page inside Atlas.
+ */
+export declare function staticContentSecurityPolicy(parentOrigin: string): string;
+/**
+ * Where a static request is served from: `/_artifact/<deployment>/<file>` for assets, the page for
+ * every other path (in-app routes live in the hash or the page's own history). Null: not this
+ * deployment's file.
+ */
+export declare function staticFileForRequest({ url, deploymentId }: {
+    url: string;
+    deploymentId: string;
+}): string | null;
+/** Writes one authorized static file: GET or HEAD, revalidated on every use (each request is authorized). */
+export declare function sendStaticFile({ request, response, file, parentOrigin }: {
+    request: IncomingMessage;
+    response: ServerResponse;
+    file: StaticArtifactFile & {
+        etag: string;
+    };
+    parentOrigin: string;
+}): void;
+/** Answers one request for an authorized static target: reads only, and only this deployment's files. */
+export declare function serveStaticTarget({ request, response, target, files, renew, parentOrigin }: {
+    request: IncomingMessage;
+    response: ServerResponse;
+    target: Extract<GatewayTarget, {
+        kind: 'static';
+    }>;
+    files: Pick<StaticArtifactFiles, 'get'>;
+    renew: () => void;
+    parentOrigin: string;
+}): Promise<void>;

package/dist/gateway/static-files.js

@@ -0,0 +1,112 @@
+import { createHash } from 'node:crypto';
+import { GatewayControlError, STATIC_PAGE } from './control.js';
+/** Default byte budget for cached static files on one gateway replica (the gateway runs with 1 GiB). */
+export const STATIC_CACHE_DEFAULT_BYTES = 192 * 1024 * 1024;
+/**
+ * Files of static deployments, cached by deployment and path. A deployment's files never change,
+ * so an entry is valid until evicted (least recently used, bounded by bytes). Concurrent misses for
+ * one file share a single fetch. The page is never cached: Atlas renders it, and its bridge script
+ * follows Atlas releases.
+ */
+export class StaticArtifactFiles {
+    options;
+    entries = new Map();
+    inflight = new Map();
+    bytes = 0;
+    constructor(options) {
+        this.options = options;
+    }
+    get cachedBytes() { return this.bytes; }
+    async get({ deploymentId, path }) {
+        if (path === STATIC_PAGE)
+            return withEtag(await this.options.fetch({ deploymentId, path }));
+        const key = `${deploymentId}/${path}`;
+        const hit = this.entries.get(key);
+        if (hit) {
+            // Refresh recency: a Map iterates in insertion order, so re-insert at the end.
+            this.entries.delete(key);
+            this.entries.set(key, hit);
+            return hit;
+        }
+        const pending = this.inflight.get(key);
+        if (pending)
+            return pending;
+        const load = this.options.fetch({ deploymentId, path }).then(file => {
+            const entry = withEtag(file);
+            this.remember(key, entry);
+            return entry;
+        }).finally(() => { this.inflight.delete(key); });
+        this.inflight.set(key, load);
+        return load;
+    }
+    remember(key, entry) {
+        const limit = this.options.maxBytes ?? STATIC_CACHE_DEFAULT_BYTES;
+        if (entry.body.length > limit)
+            return;
+        this.entries.set(key, entry);
+        this.bytes += entry.body.length;
+        for (const [oldest, value] of this.entries) {
+            if (this.bytes <= limit)
+                break;
+            this.entries.delete(oldest);
+            this.bytes -= value.body.length;
+        }
+    }
+}
+function withEtag(file) {
+    return { ...file, etag: file.etag ?? `"${createHash('sha256').update(file.body).digest('base64url')}"` };
+}
+/**
+ * The policy a static application runs under: the sandbox's former `<meta>` policy, now a header
+ * on the application's own origin (so `'self'` is the application, never Atlas), plus what a meta
+ * tag cannot express: `frame-ancestors` keeps the page inside Atlas.
+ */
+export function staticContentSecurityPolicy(parentOrigin) {
+    return [
+        "default-src 'none'", "script-src 'self' 'unsafe-inline' 'unsafe-eval'", "style-src 'self' 'unsafe-inline'",
+        "img-src 'self' data: blob: https:", "font-src 'self' data:", "connect-src 'self' blob:", "worker-src 'self' blob:",
+        "object-src blob:", "frame-src blob:", `frame-ancestors ${parentOrigin}`, "base-uri 'none'", "form-action 'none'",
+    ].join('; ');
+}
+/**
+ * Where a static request is served from: `/_artifact/<deployment>/<file>` for assets, the page for
+ * every other path (in-app routes live in the hash or the page's own history). Null: not this
+ * deployment's file.
+ */
+export function staticFileForRequest({ url, deploymentId }) {
+    const pathname = new URL(url, 'https://static.invalid').pathname;
+    const prefix = '/_artifact/';
+    if (!pathname.startsWith(prefix))
+        return STATIC_PAGE;
+    const [requested, ...rest] = pathname.slice(prefix.length).split('/');
+    if (requested !== deploymentId)
+        return null;
+    const file = rest.join('/');
+    return /^(?:bundle\.js|sourcemap\.json|chunks\/[A-Za-z0-9._-]{1,200})$/.test(file) ? file : null;
+}
+/** Writes one authorized static file: GET or HEAD, revalidated on every use (each request is authorized). */
+export function sendStaticFile({ request, response, file, parentOrigin }) {
+    const headers = {
+        'content-type': file.contentType, etag: file.etag, 'cache-control': 'private, no-cache',
+        'content-security-policy': staticContentSecurityPolicy(parentOrigin),
+        'x-content-type-options': 'nosniff', 'referrer-policy': 'same-origin',
+    };
+    if (request.headers['if-none-match'] === file.etag) {
+        response.writeHead(304, headers);
+        response.end();
+        return;
+    }
+    response.writeHead(200, { ...headers, 'content-length': String(file.body.length) });
+    response.end(request.method === 'HEAD' ? undefined : file.body);
+}
+/** Answers one request for an authorized static target: reads only, and only this deployment's files. */
+export async function serveStaticTarget({ request, response, target, files, renew, parentOrigin }) {
+    if (!['GET', 'HEAD'].includes(request.method ?? 'GET'))
+        throw new GatewayControlError(405);
+    const path = staticFileForRequest({ url: request.url ?? '/', deploymentId: target.deploymentId });
+    if (!path)
+        throw new GatewayControlError(404);
+    const file = await files.get({ deploymentId: target.deploymentId, path });
+    renew();
+    sendStaticFile({ request, response, file, parentOrigin });
+}

package/dist/manifest-next.d.ts

@@ -28,6 +28,9 @@ export declare const artifactNextServerCapabilitiesSchema: z.ZodPrefault<z.ZodOb
     audit: z.ZodOptional<z.ZodObject<{
         service: z.ZodString;
     }, z.core.$strict>>;
+    groups: z.ZodOptional<z.ZodObject<{
+        read: z.ZodBoolean;
+    }, z.core.$strict>>;
     storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
         viewer: "viewer";
         editor: "editor";
@@ -89,6 +92,9 @@ export declare const artifactNextServerSchema: z.ZodPrefault<z.ZodObject<{
         audit: z.ZodOptional<z.ZodObject<{
             service: z.ZodString;
         }, z.core.$strict>>;
+        groups: z.ZodOptional<z.ZodObject<{
+            read: z.ZodBoolean;
+        }, z.core.$strict>>;
         storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
             viewer: "viewer";
             editor: "editor";
@@ -280,6 +286,9 @@ export declare const artifactStudioNextManifestSchema: z.ZodObject<{
             audit: z.ZodOptional<z.ZodObject<{
                 service: z.ZodString;
             }, z.core.$strict>>;
+            groups: z.ZodOptional<z.ZodObject<{
+                read: z.ZodBoolean;
+            }, z.core.$strict>>;
             storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
                 viewer: "viewer";
                 editor: "editor";
@@ -401,6 +410,10 @@ export declare const artifactStudioNextManifestSchema: z.ZodObject<{
         mobile: z.ZodOptional<z.ZodEnum<{
             responsive: "responsive";
         }>>;
+        status: z.ZodOptional<z.ZodEnum<{
+            alpha: "alpha";
+            beta: "beta";
+        }>>;
     }, z.core.$strip>>;
     sidebarIcon: z.ZodOptional<z.ZodString>;
     sidebarBadge: z.ZodOptional<z.ZodObject<{

package/dist/manifest-next.js

@@ -15,9 +15,14 @@ export const ARTIFACT_NEXT_RESOURCE_DEFAULTS = {
 };
 export { artifactNextAuditCapabilitySchema };
 export * from './manifest-next-ingress.js';
+/** Caller-scoped group membership. A boolean, not a list of group ids: the directory decides which groups the signed-in user is in. */
+const artifactNextGroupsCapabilitySchema = z.strictObject({
+    read: z.boolean(),
+});
 export const artifactNextServerCapabilitiesSchema = z.strictObject({
     ...reachShape,
     audit: artifactNextAuditCapabilitySchema.optional(),
+    groups: artifactNextGroupsCapabilitySchema.optional(),
 }).prefault({});
 // Reuse role semantics and validation; only the new manifest rejects unknown keys.
 const strictCustomRoles = customRolesBlockSchema.safeExtend({

package/dist/manifest-static.d.ts

@@ -12,6 +12,10 @@ export declare const artifactPresentationSchema: z.ZodObject<{
     mobile: z.ZodOptional<z.ZodEnum<{
         responsive: "responsive";
     }>>;
+    status: z.ZodOptional<z.ZodEnum<{
+        alpha: "alpha";
+        beta: "beta";
+    }>>;
 }, z.core.$strip>;
 export type ArtifactPresentation = z.infer<typeof artifactPresentationSchema>;
 export declare const artifactOfflineCapabilitySchema: z.ZodObject<{
@@ -95,6 +99,10 @@ export declare const artifactStudioStaticManifestSchema: z.ZodObject<{
         mobile: z.ZodOptional<z.ZodEnum<{
             responsive: "responsive";
         }>>;
+        status: z.ZodOptional<z.ZodEnum<{
+            alpha: "alpha";
+            beta: "beta";
+        }>>;
     }, z.core.$strip>>;
     offline: z.ZodOptional<z.ZodObject<{
         mode: z.ZodEnum<{

package/dist/manifest-static.js

@@ -16,6 +16,11 @@ export const sidebarBadgeSchema = z.object({
 });
 export const artifactPresentationSchema = z.object({
     mobile: z.enum(['responsive']).optional(),
+    /**
+     * Lifecycle stage the Atlas shell shows as an Alpha/Beta badge beside the
+     * app's name. Omit for GA. Mirrors `App.status` for native apps.
+     */
+    status: z.enum(['alpha', 'beta']).optional(),
 });
 export const artifactOfflineCapabilitySchema = z.object({
     mode: z.enum(['read', 'read-write']),

package/dist/manifest.d.ts

@@ -69,6 +69,10 @@ export declare const artifactStudioManifestSchema: z.ZodUnion<readonly [z.ZodObj
         mobile: z.ZodOptional<z.ZodEnum<{
             responsive: "responsive";
         }>>;
+        status: z.ZodOptional<z.ZodEnum<{
+            alpha: "alpha";
+            beta: "beta";
+        }>>;
     }, z.core.$strip>>;
     offline: z.ZodOptional<z.ZodObject<{
         mode: z.ZodEnum<{
@@ -163,6 +167,9 @@ export declare const artifactStudioManifestSchema: z.ZodUnion<readonly [z.ZodObj
             audit: z.ZodOptional<z.ZodObject<{
                 service: z.ZodString;
             }, z.core.$strict>>;
+            groups: z.ZodOptional<z.ZodObject<{
+                read: z.ZodBoolean;
+            }, z.core.$strict>>;
             storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
                 viewer: "viewer";
                 editor: "editor";
@@ -284,6 +291,10 @@ export declare const artifactStudioManifestSchema: z.ZodUnion<readonly [z.ZodObj
         mobile: z.ZodOptional<z.ZodEnum<{
             responsive: "responsive";
         }>>;
+        status: z.ZodOptional<z.ZodEnum<{
+            alpha: "alpha";
+            beta: "beta";
+        }>>;
     }, z.core.$strip>>;
     sidebarIcon: z.ZodOptional<z.ZodString>;
     sidebarBadge: z.ZodOptional<z.ZodObject<{

package/dist/server/broker-contract.d.ts

@@ -18,6 +18,10 @@ export declare function isArtifactApiPath(path: string): boolean;
 export declare const ARTIFACT_PROCESS_RUN_STATUSES: readonly ["pending", "running", "completed", "failed", "cancelled", "timed_out"];
 /** Lattice lists at most this many runs per call. */
 export declare const ARTIFACT_PROCESS_RUNS_LIMIT = 500;
+/** One page of the caller's own group memberships. */
+export declare const ARTIFACT_GROUP_MEMBERSHIPS_LIMIT = 100;
+/** How far a caller may page their own memberships. The directory is not walked past this. */
+export declare const ARTIFACT_GROUP_MEMBERSHIPS_MAX_PAGE = 100;
 /** A run page can filter to at most this many entities of one type. */
 export declare const ARTIFACT_PROCESS_RUN_ENTITIES_LIMIT = 500;
 /** A run share adds collaborators to at most this many explicitly assigned human nodes. */
@@ -298,6 +302,14 @@ export declare const artifactServerRequestSchema: z.ZodDiscriminatedUnion<[z.Zod
         group: "group";
     }>>>;
     limit: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>, z.ZodObject<{
+    operation: z.ZodLiteral<"groups_memberships">;
+    mode: z.ZodDefault<z.ZodEnum<{
+        service: "service";
+        user: "user";
+    }>>;
+    page: z.ZodOptional<z.ZodNumber>;
+    limit: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>, z.ZodObject<{
     operation: z.ZodLiteral<"flags">;
     mode: z.ZodDefault<z.ZodEnum<{

package/dist/server/broker-contract.js

@@ -31,6 +31,10 @@ const latticeVersion = z.string().min(1).max(128).regex(/^[A-Za-z0-9._-]+$/);
 export const ARTIFACT_PROCESS_RUN_STATUSES = ['pending', 'running', 'completed', 'failed', 'cancelled', 'timed_out'];
 /** Lattice lists at most this many runs per call. */
 export const ARTIFACT_PROCESS_RUNS_LIMIT = 500;
+/** One page of the caller's own group memberships. */
+export const ARTIFACT_GROUP_MEMBERSHIPS_LIMIT = 100;
+/** How far a caller may page their own memberships. The directory is not walked past this. */
+export const ARTIFACT_GROUP_MEMBERSHIPS_MAX_PAGE = 100;
 /** A run page can filter to at most this many entities of one type. */
 export const ARTIFACT_PROCESS_RUN_ENTITIES_LIMIT = 500;
 /** A run share adds collaborators to at most this many explicitly assigned human nodes. */
@@ -225,6 +229,13 @@ export const artifactServerRequestSchema = z.discriminatedUnion('operation', [
         types: z.array(z.enum(ARTIFACT_PROCESS_PRINCIPAL_TYPES)).min(1).max(2).optional(),
         limit: z.number().int().min(1).max(ARTIFACT_PROCESS_PRINCIPAL_SEARCH_LIMIT).optional(),
     }).strict(),
+    // The signed-in user's own group memberships. No search, no admin directory, no group-id allowlist:
+    // the directory returns the groups this user is in. Service mode is refused by the handler.
+    z.object({
+        operation: z.literal('groups_memberships'), mode,
+        page: z.number().int().min(1).max(ARTIFACT_GROUP_MEMBERSHIPS_MAX_PAGE).optional(),
+        limit: z.number().int().min(1).max(ARTIFACT_GROUP_MEMBERSHIPS_LIMIT).optional(),
+    }).strict(),
     // Evaluates feature flags as Atlas evaluates its own: for the user, or with no user in service mode.
     // A read: it needs no manifest declaration, as the browser bridge's flags.isEnabled needs none.
     z.object({ operation: z.literal('flags'), mode, names: z.array(flagName).min(1).max(ARTIFACT_FLAGS_PER_REQUEST) }).strict(),

package/dist/server/client.d.ts

@@ -1,6 +1,7 @@
 import { storageClient } from '@sequenceholdings/storage';
 import { type OperationExecutor } from '@sequenceholdings/orm/client';
 import { type ArtifactAuditAction, type ArtifactServerMode } from './broker-contract.js';
+import { type ArtifactServerGroups } from './groups.js';
 import { type ArtifactServerProcesses } from './processes.js';
 import { type ArtifactOrmJsonScalars } from '../orm-json-scalars.js';
 import { createArtifactLogger, type ArtifactLogRecord } from './logger.js';
@@ -10,6 +11,7 @@ import { createApiClient } from './api-client.js';
 import { type ArtifactPrincipal } from './principal.js';
 import { type ArtifactRuntimeConfig, type ArtifactRequestHeaders } from './runtime-config.js';
 export { ArtifactPrincipalError, ArtifactServerError, INSUFFICIENT_USER_AUTHENTICATION, stepUpResponse } from './errors.js';
+export type * from './groups.js';
 export type * from './processes.js';
 export type { ArtifactServerFetchOptions } from './api-client.js';
 /**
@@ -82,6 +84,7 @@ export interface ArtifactServerClient<TContext extends ArtifactServerContext = A
         invoke<TOutput = unknown>(id: string, params?: Record<string, unknown>): Promise<TOutput>;
     };
     processes: ArtifactServerProcesses;
+    groups: ArtifactServerGroups;
     flags: ArtifactServerFlags;
     audit: ArtifactServerAudit;
     orm(input: ArtifactOrmOptions): OperationExecutor;

package/dist/server/client.js

@@ -3,6 +3,7 @@ import { StorageApiError, storageClient, storageErrorSchema } from '@sequencehol
 import { OrmOperationError } from '@sequenceholdings/orm/client';
 import { z } from 'zod';
 import { artifactOrmIdempotencyKeySchema, artifactServerRequestSchema } from './broker-contract.js';
+import { createArtifactGroupsClient } from './groups.js';
 import { createArtifactProcessesClient } from './processes.js';
 import { assertJsonScalarsAcknowledged, ORM_JSON_SCALARS_HEADER } from '../orm-json-scalars.js';
 import { createArtifactLogger } from './logger.js';
@@ -96,6 +97,7 @@ function buildClient(args) {
             },
         },
         processes: createArtifactProcessesClient({ mode, json }),
+        groups: createArtifactGroupsClient({ mode, json }),
         flags: {
             evaluate: evaluateFlags,
             isEnabled: async (flagName) => (await evaluateFlags([flagName]))[flagName] === true,

package/dist/server/groups.d.ts

@@ -0,0 +1,32 @@
+import { type ArtifactServerMode, type ArtifactServerRequest } from './broker-contract.js';
+/** One group the signed-in user belongs to. `userRole` is `admin` when they administer it. */
+export interface ArtifactGroupMembership {
+    id: string;
+    userRole: 'admin' | 'member';
+    memberCount: number;
+}
+export interface ArtifactGroupMembershipsQuery {
+    page?: number;
+    limit?: number;
+}
+export interface ArtifactGroupMembershipsPage {
+    groups: ArtifactGroupMembership[];
+    pagination: {
+        page: number;
+        limit: number;
+        totalCount: number;
+        totalPages: number;
+    };
+}
+export interface ArtifactServerGroups {
+    /**
+     * The signed-in user's group memberships. Requires `server.capabilities.groups.read`.
+     * Atlas decides which groups they are in; this call cannot name groups, search the directory,
+     * or read another user's memberships.
+     */
+    list(query?: ArtifactGroupMembershipsQuery): Promise<ArtifactGroupMembershipsPage>;
+}
+export declare function createArtifactGroupsClient({ mode, json }: {
+    mode: ArtifactServerMode;
+    json: (operation: ArtifactServerRequest) => Promise<unknown>;
+}): ArtifactServerGroups;

package/dist/server/groups.js

@@ -0,0 +1,28 @@
+import { z } from 'zod';
+import { ARTIFACT_GROUP_MEMBERSHIPS_LIMIT, artifactServerRequestSchema, } from './broker-contract.js';
+import { ArtifactServerError } from './errors.js';
+const membershipsPageSchema = z.object({
+    groups: z.array(z.object({
+        id: z.string().min(1).max(255),
+        userRole: z.enum(['admin', 'member']),
+        memberCount: z.number().int().nonnegative(),
+    }).strict()),
+    pagination: z.object({
+        page: z.number().int().min(1),
+        limit: z.number().int().min(1).max(ARTIFACT_GROUP_MEMBERSHIPS_LIMIT),
+        totalCount: z.number().int().nonnegative(),
+        totalPages: z.number().int().nonnegative(),
+    }).strict(),
+}).strict();
+export function createArtifactGroupsClient({ mode, json }) {
+    return {
+        async list(query = {}) {
+            const parsed = membershipsPageSchema.safeParse(await json(artifactServerRequestSchema.parse({
+                operation: 'groups_memberships', mode, ...query,
+            })));
+            if (!parsed.success)
+                throw new ArtifactServerError(502, 'invalid_response', 'Atlas returned a malformed groups response');
+            return parsed.data;
+        },
+    };
+}

package/dist/server.d.ts

@@ -2,8 +2,8 @@ import 'server-only';
 export { createArtifactServerClient } from './server/client.js';
 export { ArtifactPrincipalError, ArtifactServerError, INSUFFICIENT_USER_AUTHENTICATION, stepUpResponse } from './server/errors.js';
 export type { ArtifactAtlasRefusal } from './server/errors.js';
-export type { ArtifactAuditEvent, ArtifactOrmOperations, ArtifactOrmOptions, ArtifactProcessAdvance, ArtifactProcessAdvanceResult, ArtifactProcessArtifactRef, ArtifactProcessAssign, ArtifactProcessAssignResult, ArtifactProcessDefinition, ArtifactProcessDescribeQuery, ArtifactProcessEdge, ArtifactProcessHumanNode, ArtifactProcessNode, ArtifactProcessNodeBase, ArtifactProcessNodeState, ArtifactProcessPrincipal, ArtifactProcessPrincipalSearch, ArtifactProcessPrincipals, ArtifactProcessRun, ArtifactProcessRunRecord, ArtifactProcessRunSnapshot, ArtifactProcessRunSummary, ArtifactProcessRunsPage, ArtifactProcessRunsPageQuery, ArtifactProcessRunsQuery, ArtifactProcessRunViewerChange, ArtifactProcessRunViewers, ArtifactProcessStart, ArtifactProcessStepRecord, ArtifactProcessShareRun, ArtifactProcessShareRunResult, ArtifactProcessRunSharingAuthoritiesQuery, ArtifactProcessRunSharingAuthoritiesPage, ArtifactProcessRunSharingAuthority, ArtifactProcessRunSharingDelegate, ArtifactProcessRevokeRunSharingAuthority, ArtifactProcessRevokeRunSharingAuthorityResult, ArtifactProcessTask, ArtifactProcessTasksQuery, ArtifactServerAudit, ArtifactServerClient, ArtifactServerClientOptions, ArtifactServerContext, ArtifactServerFetchOptions, ArtifactServerFlags, ArtifactServerProcesses, } from './server/client.js';
-export { ARTIFACT_AUDIT_ACTIONS, ARTIFACT_AUDIT_RESOURCES_PER_EVENT, ARTIFACT_FLAGS_PER_REQUEST, ARTIFACT_PROCESS_PRINCIPAL_SEARCH_LIMIT, ARTIFACT_PROCESS_PRINCIPAL_TYPES, ARTIFACT_PROCESS_PRINCIPALS_PER_CALL, ARTIFACT_PROCESS_RUN_STATUSES, ARTIFACT_PROCESS_RUNS_LIMIT, ARTIFACT_PROCESS_RUN_ENTITIES_LIMIT, ARTIFACT_PROCESS_SHARE_NODES_LIMIT, ARTIFACT_PROCESS_SHARING_AUTHORITIES_LIMIT, ARTIFACT_PROCESS_TASK_VIEWS, ARTIFACT_PROCESS_TASKS_LIMIT, } from './server/broker-contract.js';
+export type { ArtifactAuditEvent, ArtifactOrmOperations, ArtifactOrmOptions, ArtifactProcessAdvance, ArtifactProcessAdvanceResult, ArtifactProcessArtifactRef, ArtifactProcessAssign, ArtifactProcessAssignResult, ArtifactProcessDefinition, ArtifactProcessDescribeQuery, ArtifactProcessEdge, ArtifactProcessHumanNode, ArtifactProcessNode, ArtifactProcessNodeBase, ArtifactProcessNodeState, ArtifactProcessPrincipal, ArtifactProcessPrincipalSearch, ArtifactProcessPrincipals, ArtifactProcessRun, ArtifactProcessRunRecord, ArtifactProcessRunSnapshot, ArtifactProcessRunSummary, ArtifactProcessRunsPage, ArtifactProcessRunsPageQuery, ArtifactProcessRunsQuery, ArtifactProcessRunViewerChange, ArtifactProcessRunViewers, ArtifactProcessStart, ArtifactProcessStepRecord, ArtifactProcessShareRun, ArtifactProcessShareRunResult, ArtifactProcessRunSharingAuthoritiesQuery, ArtifactProcessRunSharingAuthoritiesPage, ArtifactProcessRunSharingAuthority, ArtifactProcessRunSharingDelegate, ArtifactProcessRevokeRunSharingAuthority, ArtifactProcessRevokeRunSharingAuthorityResult, ArtifactProcessTask, ArtifactProcessTasksQuery, ArtifactServerAudit, ArtifactServerClient, ArtifactServerClientOptions, ArtifactServerContext, ArtifactServerFetchOptions, ArtifactServerFlags, ArtifactServerGroups, ArtifactServerProcesses, ArtifactGroupMembership, ArtifactGroupMembershipsPage, ArtifactGroupMembershipsQuery, } from './server/client.js';
+export { ARTIFACT_AUDIT_ACTIONS, ARTIFACT_AUDIT_RESOURCES_PER_EVENT, ARTIFACT_FLAGS_PER_REQUEST, ARTIFACT_GROUP_MEMBERSHIPS_LIMIT, ARTIFACT_GROUP_MEMBERSHIPS_MAX_PAGE, ARTIFACT_PROCESS_PRINCIPAL_SEARCH_LIMIT, ARTIFACT_PROCESS_PRINCIPAL_TYPES, ARTIFACT_PROCESS_PRINCIPALS_PER_CALL, ARTIFACT_PROCESS_RUN_STATUSES, ARTIFACT_PROCESS_RUNS_LIMIT, ARTIFACT_PROCESS_RUN_ENTITIES_LIMIT, ARTIFACT_PROCESS_SHARE_NODES_LIMIT, ARTIFACT_PROCESS_SHARING_AUTHORITIES_LIMIT, ARTIFACT_PROCESS_TASK_VIEWS, ARTIFACT_PROCESS_TASKS_LIMIT, } from './server/broker-contract.js';
 export type { ArtifactAuditAction, ArtifactProcessPrincipalType, ArtifactProcessRunStatus, ArtifactProcessTaskView, } from './server/broker-contract.js';
 export { getArtifactRequestContext, readArtifactRuntimeConfig } from './server/runtime-config.js';
 export type { ArtifactRuntimeConfig, ArtifactRequestHeaders } from './server/runtime-config.js';

package/dist/server.js

@@ -1,7 +1,7 @@
 import 'server-only';
 export { createArtifactServerClient } from './server/client.js';
 export { ArtifactPrincipalError, ArtifactServerError, INSUFFICIENT_USER_AUTHENTICATION, stepUpResponse } from './server/errors.js';
-export { ARTIFACT_AUDIT_ACTIONS, ARTIFACT_AUDIT_RESOURCES_PER_EVENT, ARTIFACT_FLAGS_PER_REQUEST, ARTIFACT_PROCESS_PRINCIPAL_SEARCH_LIMIT, ARTIFACT_PROCESS_PRINCIPAL_TYPES, ARTIFACT_PROCESS_PRINCIPALS_PER_CALL, ARTIFACT_PROCESS_RUN_STATUSES, ARTIFACT_PROCESS_RUNS_LIMIT, ARTIFACT_PROCESS_RUN_ENTITIES_LIMIT, ARTIFACT_PROCESS_SHARE_NODES_LIMIT, ARTIFACT_PROCESS_SHARING_AUTHORITIES_LIMIT, ARTIFACT_PROCESS_TASK_VIEWS, ARTIFACT_PROCESS_TASKS_LIMIT, } from './server/broker-contract.js';
+export { ARTIFACT_AUDIT_ACTIONS, ARTIFACT_AUDIT_RESOURCES_PER_EVENT, ARTIFACT_FLAGS_PER_REQUEST, ARTIFACT_GROUP_MEMBERSHIPS_LIMIT, ARTIFACT_GROUP_MEMBERSHIPS_MAX_PAGE, ARTIFACT_PROCESS_PRINCIPAL_SEARCH_LIMIT, ARTIFACT_PROCESS_PRINCIPAL_TYPES, ARTIFACT_PROCESS_PRINCIPALS_PER_CALL, ARTIFACT_PROCESS_RUN_STATUSES, ARTIFACT_PROCESS_RUNS_LIMIT, ARTIFACT_PROCESS_RUN_ENTITIES_LIMIT, ARTIFACT_PROCESS_SHARE_NODES_LIMIT, ARTIFACT_PROCESS_SHARING_AUTHORITIES_LIMIT, ARTIFACT_PROCESS_TASK_VIEWS, ARTIFACT_PROCESS_TASKS_LIMIT, } from './server/broker-contract.js';
 export { getArtifactRequestContext, readArtifactRuntimeConfig } from './server/runtime-config.js';
 export { ArtifactContextError, getArtifactBrowserBootstrap } from './server/request-context.js';
 export { verifyArtifactExternalContext } from './server/external-context.js';

package/dist/source-boundary.d.ts

@@ -11,3 +11,9 @@ export interface ArtifactSourceBoundaryOptions {
  * allowed because they are external to the artifact by design.
  */
 export declare function rejectOutsideSourcePlugin({ root, trustedExternalRoots, }: ArtifactSourceBoundaryOptions): Plugin;
+/**
+ * Whether `filePath` is inside a `node_modules` directory. Bundlers pass
+ * Windows paths with forward slashes, so compare in that form whatever the
+ * platform separator is.
+ */
+export declare function isNodeModulesPath(filePath: string): boolean;

package/dist/source-boundary.js

@@ -1,3 +1,4 @@
+import { realpathSync } from 'node:fs';
 import { isAbsolute, relative, resolve, sep } from 'node:path';
 /**
  * Artifact source must be self-contained: allowing a relative import to escape
@@ -7,8 +8,8 @@ import { isAbsolute, relative, resolve, sep } from 'node:path';
  * allowed because they are external to the artifact by design.
  */
 export function rejectOutsideSourcePlugin({ root, trustedExternalRoots, }) {
-    const rootResolved = resolve(root);
-    const trustedRoots = trustedExternalRoots.map((trustedRoot) => resolve(trustedRoot));
+    const rootResolved = realpathSync(resolve(root));
+    const trustedRoots = trustedExternalRoots.map((trustedRoot) => realpathSync(resolve(trustedRoot)));
     return {
         name: 'reject-artifact-outside-source',
         enforce: 'pre',
@@ -17,15 +18,22 @@ export function rejectOutsideSourcePlugin({ root, trustedExternalRoots, }) {
             if (!resolved || resolved.external || resolved.id.startsWith('\0'))
                 return resolved;
             const filePath = resolved.id.split('?')[0];
-            if (!isAbsolute(filePath) || isPathWithin(rootResolved, filePath))
+            if (!isAbsolute(filePath))
+                return resolved;
+            // Vite may return a physical path for a root reached through /tmp or
+            // another symlink. Check physical paths on both sides of the boundary;
+            // this also prevents an in-root symlink from admitting an outside file.
+            const realFilePath = realpathSync(filePath);
+            if (isPathWithin(rootResolved, realFilePath))
                 return resolved;
             const importerPath = importer?.split('?')[0];
             const importerIsTrustedExternal = importerPath != null &&
-                (isNodeModulesPath(importerPath) || isTrustedExternalPath(importerPath, trustedRoots));
+                (isNodeModulesPath(importerPath) ||
+                    (isAbsolute(importerPath) && isTrustedExternalPath(realpathSync(importerPath), trustedRoots)));
             if (isNodeModulesPath(filePath) && (isBareImport(source) || importerIsTrustedExternal)) {
                 return resolved;
             }
-            if (isTrustedExternalPath(filePath, trustedRoots))
+            if (isTrustedExternalPath(realFilePath, trustedRoots))
                 return resolved;
             const from = importer
                 ? ` (imported from ${relative(rootResolved, importer.split('?')[0])})`
@@ -46,8 +54,13 @@ function isPathWithin(root, candidate) {
 function isTrustedExternalPath(filePath, trustedRoots) {
     return trustedRoots.some((trustedRoot) => isPathWithin(trustedRoot, filePath));
 }
-function isNodeModulesPath(filePath) {
-    return filePath.includes(`${sep}node_modules${sep}`);
+/**
+ * Whether `filePath` is inside a `node_modules` directory. Bundlers pass
+ * Windows paths with forward slashes, so compare in that form whatever the
+ * platform separator is.
+ */
+export function isNodeModulesPath(filePath) {
+    return filePath.replaceAll('\\', '/').includes('/node_modules/');
 }
 function isBareImport(source) {
     return !source.startsWith('.') && !isAbsolute(source);

package/dist/templates/react-vite/package.json

@@ -5,15 +5,18 @@
   "scripts": {
     "dev": "vite",
     "build": "vite build",
-    "preview": "vite preview"
+    "preview": "vite preview",
+    "type-check": "tsc --noEmit"
   },
   "dependencies": {},
   "devDependencies": {
-    "@sequenceholdings/artifact-studio": "^0.7.0",
+    "@sequenceholdings/artifact-studio": "^0.8.0",
     "@sequenceholdings/atlas-ui": "^3.1.1",
     "@tailwindcss/postcss": "^4.2.2",
     "@tailwindcss/vite": "^4.2.2",
     "@tanstack/react-query": "^4.36.1",
+    "@types/react": "^18.3.31",
+    "@types/react-dom": "^18.3.7",
     "@vitejs/plugin-react": "^5.0.0",
     "react": "^18.2.0",
     "react-dom": "^18.2.0",

package/dist/templates/react-vite/tsconfig.json

@@ -0,0 +1,17 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["dom", "dom.iterable", "esnext"],
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "react-jsx",
+    "types": ["vite/client"]
+  },
+  "include": ["src", "vite.config.ts"]
+}

package/package.json

@@ -9,7 +9,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "SDK types and CLI library for building Artifact Studio apps. Driven via `seq-studio artifact <sub>` (@sequenceholdings/studio-cli), which runs the `./cli` runCli export.",
   "type": "module",
   "exports": {
@@ -159,6 +159,7 @@
     "sonner": "^2.0.7",
     "tailwindcss": "^4.1.8",
     "tw-animate-css": "^1.4.0",
+    "typescript": "^5.6.0",
     "vite": "8.0.16",
     "zod": "^4.1.13",
     "ws": "^8.21.0",
@@ -166,14 +167,13 @@
     "google-auth-library": "^10.5.0",
     "server-only": "0.0.1",
     "parse5": "7.3.0",
-    "@sequenceholdings/lattice-form-renderer": "0.2.0",
     "@sequenceholdings/storage": "0.1.1",
-    "@sequenceholdings/orm": "2.6.0"
+    "@sequenceholdings/orm": "2.6.1",
+    "@sequenceholdings/lattice-form-renderer": "0.2.0"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.0.0",
-    "typescript": "^5.6.0",
     "vitest": "^4.1.11",
     "@types/ws": "^8.18.1"
   },

package/templates/react-vite/package.json

@@ -5,15 +5,18 @@
   "scripts": {
     "dev": "vite",
     "build": "vite build",
-    "preview": "vite preview"
+    "preview": "vite preview",
+    "type-check": "tsc --noEmit"
   },
   "dependencies": {},
   "devDependencies": {
-    "@sequenceholdings/artifact-studio": "^0.7.0",
+    "@sequenceholdings/artifact-studio": "^0.8.0",
     "@sequenceholdings/atlas-ui": "^3.1.1",
     "@tailwindcss/postcss": "^4.2.2",
     "@tailwindcss/vite": "^4.2.2",
     "@tanstack/react-query": "^4.36.1",
+    "@types/react": "^18.3.31",
+    "@types/react-dom": "^18.3.7",
     "@vitejs/plugin-react": "^5.0.0",
     "react": "^18.2.0",
     "react-dom": "^18.2.0",

package/templates/react-vite/tsconfig.json

@@ -0,0 +1,17 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["dom", "dom.iterable", "esnext"],
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "react-jsx",
+    "types": ["vite/client"]
+  },
+  "include": ["src", "vite.config.ts"]
+}