@sequenceholdings/artifact-studio 0.7.1 → 0.8.1

package/dist/gateway-main.js

@@ -10,6 +10,7 @@ import { RedisTunnelOwnership, RedisTunnelRelay } from './tunnel/redis.js';
 import { ArtifactRequestAdmission } from './gateway/admission.js';
 import { GatewayControlAdmission } from './gateway/control-admission.js';
 import { createIngressRuntime, IngressSecretsError } from './gateway/ingress-runtime.js';
+import { DatadogStartupError, waitForDatadogStartup } from './gateway/datadog-startup.js';
 function required(name) {
     const value = process.env[name];
     if (!value)
@@ -20,6 +21,7 @@ function required(name) {
 async function main() {
     if (process.env.ARTIFACT_NEXT_ENABLED !== 'true')
         throw new Error('Artifact Next gateway is disabled');
+    await waitForDatadogStartup({ env: process.env });
     const redisUrl = required('ARTIFACT_NEXT_REDIS_URL');
     if (new URL(redisUrl).protocol !== 'rediss:')
         throw new Error('Artifact tunnel routing requires private Redis with TLS');
@@ -135,9 +137,9 @@ async function main() {
     process.once('SIGINT', () => { void stop(); });
 }
 void main().catch((error) => {
-    // Only an ingress-secrets refusal is described: its message names variables, never values, by
-    // construction. Other errors (Redis, URLs) may carry connection strings.
-    const reason = error instanceof IngressSecretsError ? error.message : undefined;
+    // These startup refusals contain only fixed descriptions and configuration names.
+    // Other errors (Redis, URLs) may carry connection strings.
+    const reason = error instanceof IngressSecretsError || error instanceof DatadogStartupError ? error.message : undefined;
     process.stderr.write(`${JSON.stringify({ event: 'artifact_gateway.start_failed', ...(reason ? { reason } : {}) })}\n`);
     process.exit(1);
 });

package/dist/manifest-next.d.ts

@@ -28,6 +28,9 @@ export declare const artifactNextServerCapabilitiesSchema: z.ZodPrefault<z.ZodOb
     audit: z.ZodOptional<z.ZodObject<{
         service: z.ZodString;
     }, z.core.$strict>>;
+    groups: z.ZodOptional<z.ZodObject<{
+        read: z.ZodBoolean;
+    }, z.core.$strict>>;
     storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
         viewer: "viewer";
         editor: "editor";
@@ -89,6 +92,9 @@ export declare const artifactNextServerSchema: z.ZodPrefault<z.ZodObject<{
         audit: z.ZodOptional<z.ZodObject<{
             service: z.ZodString;
         }, z.core.$strict>>;
+        groups: z.ZodOptional<z.ZodObject<{
+            read: z.ZodBoolean;
+        }, z.core.$strict>>;
         storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
             viewer: "viewer";
             editor: "editor";
@@ -280,6 +286,9 @@ export declare const artifactStudioNextManifestSchema: z.ZodObject<{
             audit: z.ZodOptional<z.ZodObject<{
                 service: z.ZodString;
             }, z.core.$strict>>;
+            groups: z.ZodOptional<z.ZodObject<{
+                read: z.ZodBoolean;
+            }, z.core.$strict>>;
             storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
                 viewer: "viewer";
                 editor: "editor";

package/dist/manifest-next.js

@@ -15,9 +15,14 @@ export const ARTIFACT_NEXT_RESOURCE_DEFAULTS = {
 };
 export { artifactNextAuditCapabilitySchema };
 export * from './manifest-next-ingress.js';
+/** Caller-scoped group membership. A boolean, not a list of group ids: the directory decides which groups the signed-in user is in. */
+const artifactNextGroupsCapabilitySchema = z.strictObject({
+    read: z.boolean(),
+});
 export const artifactNextServerCapabilitiesSchema = z.strictObject({
     ...reachShape,
     audit: artifactNextAuditCapabilitySchema.optional(),
+    groups: artifactNextGroupsCapabilitySchema.optional(),
 }).prefault({});
 // Reuse role semantics and validation; only the new manifest rejects unknown keys.
 const strictCustomRoles = customRolesBlockSchema.safeExtend({

package/dist/manifest.d.ts

@@ -167,6 +167,9 @@ export declare const artifactStudioManifestSchema: z.ZodUnion<readonly [z.ZodObj
             audit: z.ZodOptional<z.ZodObject<{
                 service: z.ZodString;
             }, z.core.$strict>>;
+            groups: z.ZodOptional<z.ZodObject<{
+                read: z.ZodBoolean;
+            }, z.core.$strict>>;
             storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
                 viewer: "viewer";
                 editor: "editor";

package/dist/server/agent-responses.d.ts

@@ -0,0 +1,425 @@
+import { z } from 'zod';
+import type { ArtifactServerMode, ArtifactServerRequest } from './broker-contract.js';
+/** Mirrors the platform's completed response contract; cross-package fixtures protect this boundary. */
+export declare const artifactCompletedAgentResponseSchema: z.ZodObject<{
+    runId: z.ZodString;
+    agent: z.ZodString;
+    threadId: z.ZodString;
+    status: z.ZodLiteral<"completed">;
+    output: z.ZodJSONSchema;
+    messages: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        role: z.ZodLiteral<"assistant">;
+        parts: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+            type: z.ZodLiteral<"text">;
+            text: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"dynamic-tool">;
+            output: z.ZodObject<{
+                content: z.ZodArray<z.ZodObject<{
+                    type: z.ZodLiteral<"resource">;
+                    resource: z.ZodObject<{
+                        uri: z.ZodString;
+                        text: z.ZodString;
+                    }, z.core.$strict>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>;
+        }, z.core.$strict>]>>;
+        metadata: z.ZodOptional<z.ZodObject<{
+            citations: z.ZodArray<z.ZodJSONSchema>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    conversation: z.ZodOptional<z.ZodObject<{
+        messageCount: z.ZodNumber;
+        userMessageCount: z.ZodNumber;
+        assistantMessageCount: z.ZodNumber;
+        messages: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            role: z.ZodEnum<{
+                user: "user";
+                assistant: "assistant";
+            }>;
+            textParts: z.ZodArray<z.ZodString>;
+            tools: z.ZodArray<z.ZodObject<{
+                partType: z.ZodString;
+                toolName: z.ZodNullable<z.ZodString>;
+                state: z.ZodNullable<z.ZodString>;
+                outputTruthy: z.ZodBoolean;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ArtifactCompletedAgentRun = z.infer<typeof artifactCompletedAgentResponseSchema>;
+export declare const artifactCompletedAgentConversationSchema: z.ZodObject<{
+    runId: z.ZodString;
+    agent: z.ZodString;
+    threadId: z.ZodString;
+    status: z.ZodLiteral<"completed">;
+    output: z.ZodJSONSchema;
+    messages: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        role: z.ZodLiteral<"assistant">;
+        parts: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+            type: z.ZodLiteral<"text">;
+            text: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"dynamic-tool">;
+            output: z.ZodObject<{
+                content: z.ZodArray<z.ZodObject<{
+                    type: z.ZodLiteral<"resource">;
+                    resource: z.ZodObject<{
+                        uri: z.ZodString;
+                        text: z.ZodString;
+                    }, z.core.$strict>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>;
+        }, z.core.$strict>]>>;
+        metadata: z.ZodOptional<z.ZodObject<{
+            citations: z.ZodArray<z.ZodJSONSchema>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    conversation: z.ZodOptional<z.ZodObject<{
+        messageCount: z.ZodNumber;
+        userMessageCount: z.ZodNumber;
+        assistantMessageCount: z.ZodNumber;
+        messages: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            role: z.ZodEnum<{
+                user: "user";
+                assistant: "assistant";
+            }>;
+            textParts: z.ZodArray<z.ZodString>;
+            tools: z.ZodArray<z.ZodObject<{
+                partType: z.ZodString;
+                toolName: z.ZodNullable<z.ZodString>;
+                state: z.ZodNullable<z.ZodString>;
+                outputTruthy: z.ZodBoolean;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    context: z.ZodObject<{
+        messages: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            role: z.ZodEnum<{
+                user: "user";
+                assistant: "assistant";
+            }>;
+            parts: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+                type: z.ZodLiteral<"text">;
+                text: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodString;
+                toolName: z.ZodOptional<z.ZodString>;
+                name: z.ZodOptional<z.ZodString>;
+                toolCallId: z.ZodOptional<z.ZodString>;
+                state: z.ZodOptional<z.ZodString>;
+                input: z.ZodOptional<z.ZodJSONSchema>;
+                output: z.ZodOptional<z.ZodJSONSchema>;
+            }, z.core.$strict>]>>;
+            metadata: z.ZodOptional<z.ZodObject<{
+                citations: z.ZodArray<z.ZodJSONSchema>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+        compactionSummary: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const artifactCompletedAgentSourceCaptureSchema: z.ZodObject<{
+    responseHash: z.ZodString;
+    sourceReceipt: z.ZodString;
+    response: z.ZodObject<{
+        runId: z.ZodString;
+        agent: z.ZodString;
+        threadId: z.ZodString;
+        status: z.ZodLiteral<"completed">;
+        output: z.ZodJSONSchema;
+        messages: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            role: z.ZodLiteral<"assistant">;
+            parts: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+                type: z.ZodLiteral<"text">;
+                text: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"dynamic-tool">;
+                output: z.ZodObject<{
+                    content: z.ZodArray<z.ZodObject<{
+                        type: z.ZodLiteral<"resource">;
+                        resource: z.ZodObject<{
+                            uri: z.ZodString;
+                            text: z.ZodString;
+                        }, z.core.$strict>;
+                    }, z.core.$strict>>;
+                }, z.core.$strict>;
+            }, z.core.$strict>]>>;
+            metadata: z.ZodOptional<z.ZodObject<{
+                citations: z.ZodArray<z.ZodJSONSchema>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+        conversation: z.ZodOptional<z.ZodObject<{
+            messageCount: z.ZodNumber;
+            userMessageCount: z.ZodNumber;
+            assistantMessageCount: z.ZodNumber;
+            messages: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                role: z.ZodEnum<{
+                    user: "user";
+                    assistant: "assistant";
+                }>;
+                textParts: z.ZodArray<z.ZodString>;
+                tools: z.ZodArray<z.ZodObject<{
+                    partType: z.ZodString;
+                    toolName: z.ZodNullable<z.ZodString>;
+                    state: z.ZodNullable<z.ZodString>;
+                    outputTruthy: z.ZodBoolean;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const artifactCompletedAgentConversationCaptureSchema: z.ZodObject<{
+    responseHash: z.ZodString;
+    sourceReceipt: z.ZodString;
+    response: z.ZodObject<{
+        runId: z.ZodString;
+        agent: z.ZodString;
+        threadId: z.ZodString;
+        status: z.ZodLiteral<"completed">;
+        output: z.ZodJSONSchema;
+        messages: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            role: z.ZodLiteral<"assistant">;
+            parts: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+                type: z.ZodLiteral<"text">;
+                text: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"dynamic-tool">;
+                output: z.ZodObject<{
+                    content: z.ZodArray<z.ZodObject<{
+                        type: z.ZodLiteral<"resource">;
+                        resource: z.ZodObject<{
+                            uri: z.ZodString;
+                            text: z.ZodString;
+                        }, z.core.$strict>;
+                    }, z.core.$strict>>;
+                }, z.core.$strict>;
+            }, z.core.$strict>]>>;
+            metadata: z.ZodOptional<z.ZodObject<{
+                citations: z.ZodArray<z.ZodJSONSchema>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+        conversation: z.ZodOptional<z.ZodObject<{
+            messageCount: z.ZodNumber;
+            userMessageCount: z.ZodNumber;
+            assistantMessageCount: z.ZodNumber;
+            messages: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                role: z.ZodEnum<{
+                    user: "user";
+                    assistant: "assistant";
+                }>;
+                textParts: z.ZodArray<z.ZodString>;
+                tools: z.ZodArray<z.ZodObject<{
+                    partType: z.ZodString;
+                    toolName: z.ZodNullable<z.ZodString>;
+                    state: z.ZodNullable<z.ZodString>;
+                    outputTruthy: z.ZodBoolean;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+        context: z.ZodObject<{
+            messages: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                role: z.ZodEnum<{
+                    user: "user";
+                    assistant: "assistant";
+                }>;
+                parts: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+                    type: z.ZodLiteral<"text">;
+                    text: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    type: z.ZodString;
+                    toolName: z.ZodOptional<z.ZodString>;
+                    name: z.ZodOptional<z.ZodString>;
+                    toolCallId: z.ZodOptional<z.ZodString>;
+                    state: z.ZodOptional<z.ZodString>;
+                    input: z.ZodOptional<z.ZodJSONSchema>;
+                    output: z.ZodOptional<z.ZodJSONSchema>;
+                }, z.core.$strict>]>>;
+                metadata: z.ZodOptional<z.ZodObject<{
+                    citations: z.ZodArray<z.ZodJSONSchema>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+            compactionSummary: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const artifactAgentConversationSourceCaptureSchema: z.ZodObject<{
+    responseHash: z.ZodString;
+    sourceReceipt: z.ZodString;
+    response: z.ZodObject<{
+        agent: z.ZodString;
+        threadId: z.ZodString;
+        revision: z.ZodNumber;
+        cutoffAt: z.ZodISODateTime;
+        context: z.ZodObject<{
+            messages: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                role: z.ZodEnum<{
+                    user: "user";
+                    assistant: "assistant";
+                }>;
+                parts: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+                    type: z.ZodLiteral<"text">;
+                    text: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    type: z.ZodString;
+                    toolName: z.ZodOptional<z.ZodString>;
+                    name: z.ZodOptional<z.ZodString>;
+                    toolCallId: z.ZodOptional<z.ZodString>;
+                    state: z.ZodOptional<z.ZodString>;
+                    input: z.ZodOptional<z.ZodJSONSchema>;
+                    output: z.ZodOptional<z.ZodJSONSchema>;
+                }, z.core.$strict>]>>;
+                metadata: z.ZodOptional<z.ZodObject<{
+                    citations: z.ZodArray<z.ZodJSONSchema>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+            compactionSummary: z.ZodNull;
+        }, z.core.$strict>;
+        conversation: z.ZodObject<{
+            messageCount: z.ZodNumber;
+            userMessageCount: z.ZodNumber;
+            assistantMessageCount: z.ZodNumber;
+            messages: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                role: z.ZodEnum<{
+                    user: "user";
+                    assistant: "assistant";
+                }>;
+                textParts: z.ZodArray<z.ZodString>;
+                tools: z.ZodArray<z.ZodObject<{
+                    partType: z.ZodString;
+                    toolName: z.ZodNullable<z.ZodString>;
+                    state: z.ZodNullable<z.ZodString>;
+                    outputTruthy: z.ZodBoolean;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type ArtifactCompletedAgentSourceCapture = z.infer<typeof artifactCompletedAgentSourceCaptureSchema>;
+export type ArtifactCompletedAgentConversationCapture = z.infer<typeof artifactCompletedAgentConversationCaptureSchema>;
+export type ArtifactAgentConversationSourceCapture = z.infer<typeof artifactAgentConversationSourceCaptureSchema>;
+export declare const artifactCompletedWorkflowSourceCaptureSchema: z.ZodObject<{
+    responseHash: z.ZodString;
+    sourceReceipt: z.ZodString;
+    response: z.ZodObject<{
+        workflow: z.ZodString;
+        runId: z.ZodString;
+        status: z.ZodLiteral<"completed">;
+        output: z.ZodJSONSchema;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type ArtifactCompletedWorkflowSourceCapture = z.infer<typeof artifactCompletedWorkflowSourceCaptureSchema>;
+export interface ArtifactServerAgents {
+    createJob(input: ArtifactCreateAgentJob): Promise<ArtifactCreatedAgentJob>;
+    createWorkflowJob(input: ArtifactCreateWorkflowJob): Promise<ArtifactCreatedWorkflowJob>;
+    getCurrentIdentity(query: {
+        kind: 'agent' | 'workflow';
+        id: string;
+    }): Promise<ArtifactExecutionIdentity>;
+    getCompletedRun(query: {
+        agent: string;
+        runId: string;
+    }): Promise<ArtifactCompletedAgentRun>;
+    captureCompletedRun(query: {
+        agent: string;
+        runId: string;
+    }): Promise<ArtifactCompletedAgentSourceCapture>;
+    captureCompletedConversation(query: {
+        agent: string;
+        runId: string;
+    }): Promise<ArtifactCompletedAgentConversationCapture>;
+    captureConversation(query: {
+        agent: string;
+        threadId: string;
+    }): Promise<ArtifactAgentConversationSourceCapture>;
+    captureCompletedWorkflow(query: {
+        workflow: string;
+        runId: string;
+    }): Promise<ArtifactCompletedWorkflowSourceCapture>;
+}
+export declare const artifactExecutionIdentitySchema: z.ZodObject<{
+    id: z.ZodString;
+    version: z.ZodString;
+    definitionSha256: z.ZodString;
+}, z.core.$strict>;
+export type ArtifactExecutionIdentity = z.infer<typeof artifactExecutionIdentitySchema>;
+declare const createAgentJobSchema: z.ZodObject<{
+    agentId: z.ZodString;
+    messages: z.ZodArray<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        role: z.ZodEnum<{
+            user: "user";
+            system: "system";
+            assistant: "assistant";
+        }>;
+        content: z.ZodOptional<z.ZodString>;
+        parts: z.ZodOptional<z.ZodArray<z.ZodJSONSchema>>;
+        fileIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodJSONSchema>>;
+    }, z.core.$strict>>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodJSONSchema>>;
+    expectedIdentity: z.ZodObject<{
+        id: z.ZodString;
+        version: z.ZodString;
+        definitionSha256: z.ZodString;
+    }, z.core.$strict>;
+    idempotencyKey: z.ZodString;
+}, z.core.$strict>;
+declare const createWorkflowJobSchema: z.ZodObject<{
+    workflowId: z.ZodString;
+    input: z.ZodJSONSchema;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodJSONSchema>>;
+    expectedIdentity: z.ZodObject<{
+        id: z.ZodString;
+        version: z.ZodString;
+        definitionSha256: z.ZodString;
+    }, z.core.$strict>;
+    idempotencyKey: z.ZodString;
+}, z.core.$strict>;
+declare const createdAgentJobSchema: z.ZodObject<{
+    type: z.ZodLiteral<"agent">;
+    threadId: z.ZodString;
+    jobId: z.ZodString;
+    triggerId: z.ZodString;
+    status: z.ZodEnum<{
+        queued: "queued";
+        running: "running";
+        failed: "failed";
+        cancelled: "cancelled";
+        completed: "completed";
+    }>;
+}, z.core.$strict>;
+declare const createdWorkflowJobSchema: z.ZodObject<{
+    type: z.ZodLiteral<"workflow">;
+    workflowId: z.ZodString;
+    jobId: z.ZodString;
+    triggerId: z.ZodString;
+    status: z.ZodEnum<{
+        queued: "queued";
+        running: "running";
+        failed: "failed";
+        cancelled: "cancelled";
+        completed: "completed";
+    }>;
+}, z.core.$strict>;
+export type ArtifactCreateAgentJob = z.infer<typeof createAgentJobSchema>;
+export type ArtifactCreateWorkflowJob = z.infer<typeof createWorkflowJobSchema>;
+export type ArtifactCreatedAgentJob = z.infer<typeof createdAgentJobSchema>;
+export type ArtifactCreatedWorkflowJob = z.infer<typeof createdWorkflowJobSchema>;
+/** User mode only; the manifest declares each exact route and Atlas enforces its current source access floor. */
+export declare function createArtifactAgentsClient({ mode, json }: {
+    mode: ArtifactServerMode;
+    json: (operation: ArtifactServerRequest) => Promise<unknown>;
+}): ArtifactServerAgents;
+export {};

package/dist/server/agent-responses.js

@@ -0,0 +1,154 @@
+import { z } from 'zod';
+import { ArtifactServerError } from './errors.js';
+const resourceId = z.string().min(1).max(255).regex(/^[A-Za-z0-9._-]+$/);
+/** Mirrors the platform's completed response contract; cross-package fixtures protect this boundary. */
+export const artifactCompletedAgentResponseSchema = z.strictObject({
+    runId: resourceId, agent: resourceId, threadId: resourceId, status: z.literal('completed'), output: z.json(),
+    messages: z.array(z.strictObject({
+        id: z.string().min(1).max(255), role: z.literal('assistant'),
+        parts: z.array(z.union([
+            z.strictObject({ type: z.literal('text'), text: z.string() }),
+            z.strictObject({ type: z.literal('dynamic-tool'), output: z.strictObject({ content: z.array(z.strictObject({ type: z.literal('resource'), resource: z.strictObject({ uri: z.string().startsWith('citation://'), text: z.string() }) })).max(1000) }) }),
+        ])).max(1000),
+        metadata: z.strictObject({ citations: z.array(z.json()).max(1000) }).optional(),
+    })).max(1000),
+    conversation: z.strictObject({
+        messageCount: z.number().int().min(0).max(1000), userMessageCount: z.number().int().min(0).max(1000), assistantMessageCount: z.number().int().min(0).max(1000),
+        messages: z.array(z.strictObject({ id: z.string().min(1).max(255), role: z.enum(['user', 'assistant']), textParts: z.array(z.string()).max(1000), tools: z.array(z.strictObject({ partType: z.string().min(1).max(255), toolName: z.string().max(255).nullable(), state: z.string().max(255).nullable(), outputTruthy: z.boolean() })).max(1000) })).max(1000),
+    }).optional(),
+});
+const conversationToolPart = z.strictObject({
+    type: z.string().min(1).max(255).refine((type) => type !== 'tool-result' && (type === 'dynamic-tool' || type === 'tool-invocation' || type.startsWith('tool-')), 'Only tool parts are permitted'),
+    toolName: z.string().max(255).optional(), name: z.string().max(255).optional(), toolCallId: z.string().min(1).max(255).optional(), state: z.string().max(255).optional(),
+    input: z.json().optional(), output: z.json().optional(),
+});
+export const artifactCompletedAgentConversationSchema = artifactCompletedAgentResponseSchema.extend({
+    context: z.strictObject({
+        messages: z.array(z.strictObject({
+            id: z.string().min(1).max(255), role: z.enum(['user', 'assistant']),
+            parts: z.array(z.union([z.strictObject({ type: z.literal('text'), text: z.string() }), conversationToolPart])).max(1000),
+            metadata: z.strictObject({ citations: z.array(z.json()).max(1000) }).optional(),
+        })).max(1000),
+        compactionSummary: z.string().nullable(),
+    }),
+});
+const sourceFields = { responseHash: z.string().regex(/^[a-f0-9]{64}$/), sourceReceipt: z.string().min(1).max(16_384) };
+export const artifactCompletedAgentSourceCaptureSchema = z.strictObject({ response: artifactCompletedAgentResponseSchema, ...sourceFields });
+export const artifactCompletedAgentConversationCaptureSchema = z.strictObject({ response: artifactCompletedAgentConversationSchema, ...sourceFields });
+export const artifactAgentConversationSourceCaptureSchema = z.strictObject({
+    response: z.strictObject({
+        agent: resourceId, threadId: resourceId, revision: z.number().int().min(1).max(Number.MAX_SAFE_INTEGER), cutoffAt: z.iso.datetime({ offset: true }),
+        context: artifactCompletedAgentConversationSchema.shape.context.extend({ compactionSummary: z.null() }),
+        conversation: artifactCompletedAgentResponseSchema.shape.conversation.unwrap(),
+    }),
+    ...sourceFields,
+});
+export const artifactCompletedWorkflowSourceCaptureSchema = z.strictObject({ response: z.strictObject({ workflow: resourceId, runId: resourceId, status: z.literal('completed'), output: z.json() }), ...sourceFields });
+export const artifactExecutionIdentitySchema = z.strictObject({
+    id: z.string().min(1).max(128).regex(/^[A-Za-z0-9_-]+$/), version: z.string().min(1).max(128),
+    definitionSha256: z.string().regex(/^[a-f0-9]{64}$/),
+});
+const idempotencyKeySchema = z.string().min(1).max(128).regex(/^[\x21-\x7e]+$/);
+const jobMessageSchema = z.strictObject({
+    id: z.string().optional(), role: z.enum(['user', 'assistant', 'system']),
+    content: z.string().optional(), parts: z.array(z.json()).optional(),
+    fileIds: z.array(resourceId).optional(), metadata: z.record(z.string(), z.json()).optional(),
+}).refine((message) => Boolean(message.content?.length || message.parts?.length), 'A job message requires content or parts');
+const createAgentJobSchema = z.strictObject({
+    agentId: resourceId, messages: z.array(jobMessageSchema).min(1), metadata: z.record(z.string(), z.json()).optional(),
+    expectedIdentity: artifactExecutionIdentitySchema, idempotencyKey: idempotencyKeySchema,
+});
+const createWorkflowJobSchema = z.strictObject({
+    workflowId: resourceId, input: z.json(), metadata: z.record(z.string(), z.json()).optional(),
+    expectedIdentity: artifactExecutionIdentitySchema, idempotencyKey: idempotencyKeySchema,
+});
+const createdJobFields = { jobId: resourceId, triggerId: resourceId,
+    status: z.enum(['queued', 'running', 'completed', 'failed', 'cancelled']) };
+const createdAgentJobSchema = z.strictObject({ ...createdJobFields, type: z.literal('agent'), threadId: resourceId });
+const createdWorkflowJobSchema = z.strictObject({ ...createdJobFields, type: z.literal('workflow'), workflowId: resourceId });
+/** User mode only; the manifest declares each exact route and Atlas enforces its current source access floor. */
+export function createArtifactAgentsClient({ mode, json }) {
+    async function read(query, endpoint) {
+        if (mode !== 'user')
+            throw new ArtifactServerError(403, 'operation_not_allowed', 'Completed agent sources require user mode');
+        const { agent, runId } = z.strictObject({ agent: resourceId, runId: resourceId }).parse(query);
+        const path = `/api/agents/jobs/${encodeURIComponent(runId)}/${endpoint}?${new URLSearchParams({ agent })}`;
+        return json({ operation: 'api', mode, method: 'GET', path });
+    }
+    function matches(response, query) {
+        return response.runId === query.runId && response.agent === query.agent;
+    }
+    return {
+        async createJob(input) {
+            if (mode !== 'user')
+                throw new ArtifactServerError(403, 'operation_not_allowed', 'Job admission requires user mode');
+            const body = createAgentJobSchema.parse(input);
+            if (body.expectedIdentity.id !== body.agentId)
+                throw new ArtifactServerError(400, 'invalid_request', 'The agent source identity does not match its job');
+            const parsed = createdAgentJobSchema.safeParse(await json({ operation: 'api', mode, method: 'POST', path: '/api/agents/jobs/create-idempotent', body }));
+            if (!parsed.success)
+                throw new ArtifactServerError(502, 'invalid_response', 'Atlas returned an invalid agent job admission');
+            return parsed.data;
+        },
+        async createWorkflowJob(input) {
+            if (mode !== 'user')
+                throw new ArtifactServerError(403, 'operation_not_allowed', 'Job admission requires user mode');
+            const { workflowId, ...body } = createWorkflowJobSchema.parse(input);
+            if (body.expectedIdentity.id !== workflowId)
+                throw new ArtifactServerError(400, 'invalid_request', 'The workflow source identity does not match its job');
+            const parsed = createdWorkflowJobSchema.safeParse(await json({ operation: 'api', mode, method: 'POST',
+                path: `/api/agents/workflows/${encodeURIComponent(workflowId)}/jobs`, body }));
+            if (!parsed.success || parsed.data.workflowId !== workflowId)
+                throw new ArtifactServerError(502, 'invalid_response', 'Atlas returned an invalid workflow job admission');
+            return parsed.data;
+        },
+        async getCurrentIdentity(query) {
+            if (mode !== 'user')
+                throw new ArtifactServerError(403, 'operation_not_allowed', 'Execution source identity requires user mode');
+            const { kind, id } = z.strictObject({ kind: z.enum(['agent', 'workflow']), id: resourceId }).parse(query);
+            const path = `/api/agents/${kind === 'agent' ? 'agents' : 'workflows'}/${encodeURIComponent(id)}/current-identity`;
+            const parsed = artifactExecutionIdentitySchema.safeParse(await json({ operation: 'api', mode, method: 'GET', path }));
+            if (!parsed.success || parsed.data.id !== id)
+                throw new ArtifactServerError(502, 'invalid_response', 'Atlas returned an invalid execution source identity');
+            return parsed.data;
+        },
+        async getCompletedRun(query) {
+            const parsed = artifactCompletedAgentResponseSchema.safeParse(await read(query, 'completed-response'));
+            if (!parsed.success || !matches(parsed.data, query))
+                throw new ArtifactServerError(502, 'invalid_response', 'Atlas returned an invalid completed agent response');
+            return parsed.data;
+        },
+        async captureCompletedRun(query) {
+            const parsed = artifactCompletedAgentSourceCaptureSchema.safeParse(await read(query, 'completed-source'));
+            if (!parsed.success || !matches(parsed.data.response, query))
+                throw new ArtifactServerError(502, 'invalid_response', 'Atlas returned an invalid completed source capture');
+            return parsed.data;
+        },
+        async captureCompletedConversation(query) {
+            const parsed = artifactCompletedAgentConversationCaptureSchema.safeParse(await read(query, 'completed-conversation'));
+            if (!parsed.success || !matches(parsed.data.response, query))
+                throw new ArtifactServerError(502, 'invalid_response', 'Atlas returned an invalid completed conversation capture');
+            return parsed.data;
+        },
+        async captureCompletedWorkflow(query) {
+            if (mode !== 'user')
+                throw new ArtifactServerError(403, 'operation_not_allowed', 'Workflow sources require user mode');
+            const { workflow, runId } = z.strictObject({ workflow: resourceId, runId: resourceId }).parse(query);
+            const path = `/api/agents/jobs/${encodeURIComponent(runId)}/completed-workflow-source?${new URLSearchParams({ workflow })}`;
+            const parsed = artifactCompletedWorkflowSourceCaptureSchema.safeParse(await json({ operation: 'api', mode, method: 'GET', path }));
+            if (!parsed.success || parsed.data.response.workflow !== workflow || parsed.data.response.runId !== runId)
+                throw new ArtifactServerError(502, 'invalid_response', 'Atlas returned an invalid completed workflow source');
+            return parsed.data;
+        },
+        async captureConversation(query) {
+            if (mode !== 'user')
+                throw new ArtifactServerError(403, 'operation_not_allowed', 'Conversation sources require user mode');
+            const { agent, threadId } = z.strictObject({ agent: resourceId, threadId: resourceId }).parse(query);
+            const path = `/api/agents/threads/${encodeURIComponent(threadId)}/conversation-source?${new URLSearchParams({ agent })}`;
+            const parsed = artifactAgentConversationSourceCaptureSchema.safeParse(await json({ operation: 'api', mode, method: 'GET', path }));
+            if (!parsed.success || parsed.data.response.agent !== agent || parsed.data.response.threadId !== threadId)
+                throw new ArtifactServerError(502, 'invalid_response', 'Atlas returned an invalid conversation source capture');
+            return parsed.data;
+        },
+    };
+}