@sequenceholdings/artifact-studio 0.7.1 → 0.8.1

package/dist/server/broker-contract.d.ts

@@ -18,6 +18,10 @@ export declare function isArtifactApiPath(path: string): boolean;
 export declare const ARTIFACT_PROCESS_RUN_STATUSES: readonly ["pending", "running", "completed", "failed", "cancelled", "timed_out"];
 /** Lattice lists at most this many runs per call. */
 export declare const ARTIFACT_PROCESS_RUNS_LIMIT = 500;
+/** One page of the caller's own group memberships. */
+export declare const ARTIFACT_GROUP_MEMBERSHIPS_LIMIT = 100;
+/** How far a caller may page their own memberships. The directory is not walked past this. */
+export declare const ARTIFACT_GROUP_MEMBERSHIPS_MAX_PAGE = 100;
 /** A run page can filter to at most this many entities of one type. */
 export declare const ARTIFACT_PROCESS_RUN_ENTITIES_LIMIT = 500;
 /** A run share adds collaborators to at most this many explicitly assigned human nodes. */
@@ -105,6 +109,11 @@ export declare const artifactServerRequestSchema: z.ZodDiscriminatedUnion<[z.Zod
     }>>;
     process: z.ZodString;
     runId: z.ZodOptional<z.ZodString>;
+    version: z.ZodOptional<z.ZodString>;
+    expectedProcess: z.ZodOptional<z.ZodObject<{
+        version: z.ZodString;
+        bundleHash: z.ZodString;
+    }, z.core.$strict>>;
     startNodeId: z.ZodOptional<z.ZodString>;
     title: z.ZodOptional<z.ZodString>;
     entity: z.ZodOptional<z.ZodObject<{
@@ -298,6 +307,14 @@ export declare const artifactServerRequestSchema: z.ZodDiscriminatedUnion<[z.Zod
         group: "group";
     }>>>;
     limit: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>, z.ZodObject<{
+    operation: z.ZodLiteral<"groups_memberships">;
+    mode: z.ZodDefault<z.ZodEnum<{
+        service: "service";
+        user: "user";
+    }>>;
+    page: z.ZodOptional<z.ZodNumber>;
+    limit: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>, z.ZodObject<{
     operation: z.ZodLiteral<"flags">;
     mode: z.ZodDefault<z.ZodEnum<{

package/dist/server/broker-contract.js

@@ -27,10 +27,16 @@ const id = z.string().min(1).max(255).regex(/^[a-zA-Z0-9_-]+$/);
 const latticeId = z.string().min(2).max(128).regex(/^[A-Za-z0-9._-]+$/);
 // A process version is the registry's own label (the bundle hash prefix today); FGA-safe class.
 const latticeVersion = z.string().min(1).max(128).regex(/^[A-Za-z0-9._-]+$/);
+// An assertion on the resolved immutable target, independent of the optional version selector.
+const expectedProcessIdentity = z.object({ version: latticeVersion, bundleHash: z.string().regex(/^[a-f0-9]{64}$/) }).strict();
 /** A Lattice run's lifecycle status, as `GET /api/lattice/runs` filters it. */
 export const ARTIFACT_PROCESS_RUN_STATUSES = ['pending', 'running', 'completed', 'failed', 'cancelled', 'timed_out'];
 /** Lattice lists at most this many runs per call. */
 export const ARTIFACT_PROCESS_RUNS_LIMIT = 500;
+/** One page of the caller's own group memberships. */
+export const ARTIFACT_GROUP_MEMBERSHIPS_LIMIT = 100;
+/** How far a caller may page their own memberships. The directory is not walked past this. */
+export const ARTIFACT_GROUP_MEMBERSHIPS_MAX_PAGE = 100;
 /** A run page can filter to at most this many entities of one type. */
 export const ARTIFACT_PROCESS_RUN_ENTITIES_LIMIT = 500;
 /** A run share adds collaborators to at most this many explicitly assigned human nodes. */
@@ -124,10 +130,12 @@ export const artifactServerRequestSchema = z.discriminatedUnion('operation', [
     z.object({ operation: z.literal('function'), mode, id, params: z.record(z.string(), z.unknown()).optional() }).strict(),
     // Starts a run of a declared process, as `POST /api/lattice/runs` does: the application names the
     // run, passes its input, may seed who works each human node and may enter the graph at a node
-    // other than the process's start (the route's `start_node_id`). The version and engine stay with
-    // the process and its owning routes.
+    // other than the process's start (the route's `start_node_id`). A registered version may be
+    // selected explicitly; omitting it follows the active version. The engine stays server-owned.
     z.object({
         operation: z.literal('lattice'), mode, process: latticeId, runId: latticeId.optional(),
+        version: latticeVersion.optional(),
+        expectedProcess: expectedProcessIdentity.optional(),
         startNodeId: z.string().min(1).max(255).regex(/^[A-Za-z0-9._-]+$/).optional(),
         title: z.string().max(500).optional(),
         entity: z.object({ type: entityRef, id: entityRef }).strict().optional(),
@@ -225,6 +233,13 @@ export const artifactServerRequestSchema = z.discriminatedUnion('operation', [
         types: z.array(z.enum(ARTIFACT_PROCESS_PRINCIPAL_TYPES)).min(1).max(2).optional(),
         limit: z.number().int().min(1).max(ARTIFACT_PROCESS_PRINCIPAL_SEARCH_LIMIT).optional(),
     }).strict(),
+    // The signed-in user's own group memberships. No search, no admin directory, no group-id allowlist:
+    // the directory returns the groups this user is in. Service mode is refused by the handler.
+    z.object({
+        operation: z.literal('groups_memberships'), mode,
+        page: z.number().int().min(1).max(ARTIFACT_GROUP_MEMBERSHIPS_MAX_PAGE).optional(),
+        limit: z.number().int().min(1).max(ARTIFACT_GROUP_MEMBERSHIPS_LIMIT).optional(),
+    }).strict(),
     // Evaluates feature flags as Atlas evaluates its own: for the user, or with no user in service mode.
     // A read: it needs no manifest declaration, as the browser bridge's flags.isEnabled needs none.
     z.object({ operation: z.literal('flags'), mode, names: z.array(flagName).min(1).max(ARTIFACT_FLAGS_PER_REQUEST) }).strict(),

package/dist/server/client.d.ts

@@ -1,15 +1,18 @@
 import { storageClient } from '@sequenceholdings/storage';
 import { type OperationExecutor } from '@sequenceholdings/orm/client';
 import { type ArtifactAuditAction, type ArtifactServerMode } from './broker-contract.js';
+import { type ArtifactServerGroups } from './groups.js';
 import { type ArtifactServerProcesses } from './processes.js';
 import { type ArtifactOrmJsonScalars } from '../orm-json-scalars.js';
 import { createArtifactLogger, type ArtifactLogRecord } from './logger.js';
 import { type ArtifactRequestContext, type RequestContextV2External } from './request-context.js';
 import { type ArtifactExternalAccept } from './external-context.js';
 import { createApiClient } from './api-client.js';
+import { type ArtifactServerAgents } from './agent-responses.js';
 import { type ArtifactPrincipal } from './principal.js';
 import { type ArtifactRuntimeConfig, type ArtifactRequestHeaders } from './runtime-config.js';
 export { ArtifactPrincipalError, ArtifactServerError, INSUFFICIENT_USER_AUTHENTICATION, stepUpResponse } from './errors.js';
+export type * from './groups.js';
 export type * from './processes.js';
 export type { ArtifactServerFetchOptions } from './api-client.js';
 /**
@@ -77,11 +80,13 @@ export interface ArtifactServerClient<TContext extends ArtifactServerContext = A
     mode: ArtifactServerMode;
     log: ReturnType<typeof createArtifactLogger>;
     api: ReturnType<typeof createApiClient>;
+    agents: ArtifactServerAgents;
     storage: ReturnType<typeof storageClient>;
     functions: {
         invoke<TOutput = unknown>(id: string, params?: Record<string, unknown>): Promise<TOutput>;
     };
     processes: ArtifactServerProcesses;
+    groups: ArtifactServerGroups;
     flags: ArtifactServerFlags;
     audit: ArtifactServerAudit;
     orm(input: ArtifactOrmOptions): OperationExecutor;

package/dist/server/client.js

@@ -3,6 +3,7 @@ import { StorageApiError, storageClient, storageErrorSchema } from '@sequencehol
 import { OrmOperationError } from '@sequenceholdings/orm/client';
 import { z } from 'zod';
 import { artifactOrmIdempotencyKeySchema, artifactServerRequestSchema } from './broker-contract.js';
+import { createArtifactGroupsClient } from './groups.js';
 import { createArtifactProcessesClient } from './processes.js';
 import { assertJsonScalarsAcknowledged, ORM_JSON_SCALARS_HEADER } from '../orm-json-scalars.js';
 import { createArtifactLogger } from './logger.js';
@@ -10,6 +11,7 @@ import { ARTIFACT_REQUEST_CONTEXT_HEADER, ARTIFACT_RUNTIME_TOKEN_HEADER, ARTIFAC
 import { verifyArtifactExternalContext } from './external-context.js';
 import { isExternalContextToken } from './internal/signed-token.js';
 import { createApiClient } from './api-client.js';
+import { createArtifactAgentsClient } from './agent-responses.js';
 import { pause, transientConnectionCode } from './connection-retry.js';
 import { principalFromContext } from './principal.js';
 import { artifactRuntimeConfigSchema, readArtifactRuntimeConfig } from './runtime-config.js';
@@ -51,7 +53,12 @@ export async function createArtifactServerClient({ headers, runtime, fetch: fetc
             throw new ArtifactServerError(401, 'runtime_changed', 'Artifact runtime disconnected or changed; reload the preview');
         return current;
     };
-    return buildClient({ context, principal: principalFromContext(context), token, getRuntime, fetcher, mode: 'user', logSink });
+    // Opaque proof of the gateway's actual browser authentication. Atlas verifies it
+    // against this exact signed context; it grants nothing when copied to another request.
+    const authenticationToken = headers.get('x-sequence-artifact-authentication') ?? undefined;
+    if (authenticationToken !== undefined && authenticationToken.length > 4096)
+        throw new ArtifactServerError(401, 'invalid_request_context', 'Artifact gateway authentication proof exceeds its header limit');
+    return buildClient({ context, principal: principalFromContext(context), token, authenticationToken, getRuntime, fetcher, mode: 'user', logSink });
 }
 function buildClient(args) {
     const { context, principal, mode, logSink } = args;
@@ -88,6 +95,7 @@ function buildClient(args) {
         mode,
         log,
         api: createApiClient({ mode, request, json }),
+        agents: createArtifactAgentsClient({ mode, json }),
         storage: storageClient({ request: (method, path, body) => storageJson(artifactServerRequestSchema.parse({ operation: 'storage', mode, method, path, body })) }),
         functions: {
             invoke: async (id, params) => {
@@ -96,6 +104,7 @@ function buildClient(args) {
             },
         },
         processes: createArtifactProcessesClient({ mode, json }),
+        groups: createArtifactGroupsClient({ mode, json }),
         flags: {
             evaluate: evaluateFlags,
             isEnabled: async (flagName) => (await evaluateFlags([flagName]))[flagName] === true,
@@ -211,7 +220,7 @@ function isReadOperation(operation) {
             return false;
     }
 }
-function createBrokerTransport({ context, principal, token, getRuntime, fetcher, log }) {
+function createBrokerTransport({ context, principal, token, authenticationToken, getRuntime, fetcher, log }) {
     const send = async (input, signal, stream = false) => {
         // The one choke point for every broker operation: an external caller never acts as a user.
         if (input.mode === 'user' && principal.kind === 'external')
@@ -239,6 +248,7 @@ function createBrokerTransport({ context, principal, token, getRuntime, fetcher,
                     'Content-Type': 'application/json',
                     [ARTIFACT_RUNTIME_TOKEN_HEADER]: runtime.sessionToken,
                     [ARTIFACT_REQUEST_CONTEXT_HEADER]: token,
+                    ...(authenticationToken !== undefined ? { 'x-sequence-artifact-authentication': authenticationToken } : {}),
                 },
                 body,
                 cache: 'no-store',

package/dist/server/groups.d.ts

@@ -0,0 +1,32 @@
+import { type ArtifactServerMode, type ArtifactServerRequest } from './broker-contract.js';
+/** One group the signed-in user belongs to. `userRole` is `admin` when they administer it. */
+export interface ArtifactGroupMembership {
+    id: string;
+    userRole: 'admin' | 'member';
+    memberCount: number;
+}
+export interface ArtifactGroupMembershipsQuery {
+    page?: number;
+    limit?: number;
+}
+export interface ArtifactGroupMembershipsPage {
+    groups: ArtifactGroupMembership[];
+    pagination: {
+        page: number;
+        limit: number;
+        totalCount: number;
+        totalPages: number;
+    };
+}
+export interface ArtifactServerGroups {
+    /**
+     * The signed-in user's group memberships. Requires `server.capabilities.groups.read`.
+     * Atlas decides which groups they are in; this call cannot name groups, search the directory,
+     * or read another user's memberships.
+     */
+    list(query?: ArtifactGroupMembershipsQuery): Promise<ArtifactGroupMembershipsPage>;
+}
+export declare function createArtifactGroupsClient({ mode, json }: {
+    mode: ArtifactServerMode;
+    json: (operation: ArtifactServerRequest) => Promise<unknown>;
+}): ArtifactServerGroups;

package/dist/server/groups.js

@@ -0,0 +1,28 @@
+import { z } from 'zod';
+import { ARTIFACT_GROUP_MEMBERSHIPS_LIMIT, artifactServerRequestSchema, } from './broker-contract.js';
+import { ArtifactServerError } from './errors.js';
+const membershipsPageSchema = z.object({
+    groups: z.array(z.object({
+        id: z.string().min(1).max(255),
+        userRole: z.enum(['admin', 'member']),
+        memberCount: z.number().int().nonnegative(),
+    }).strict()),
+    pagination: z.object({
+        page: z.number().int().min(1),
+        limit: z.number().int().min(1).max(ARTIFACT_GROUP_MEMBERSHIPS_LIMIT),
+        totalCount: z.number().int().nonnegative(),
+        totalPages: z.number().int().nonnegative(),
+    }).strict(),
+}).strict();
+export function createArtifactGroupsClient({ mode, json }) {
+    return {
+        async list(query = {}) {
+            const parsed = membershipsPageSchema.safeParse(await json(artifactServerRequestSchema.parse({
+                operation: 'groups_memberships', mode, ...query,
+            })));
+            if (!parsed.success)
+                throw new ArtifactServerError(502, 'invalid_response', 'Atlas returned a malformed groups response');
+            return parsed.data;
+        },
+    };
+}

package/dist/server/processes.d.ts

@@ -7,6 +7,17 @@ export type { ArtifactProcessRunSharingAuthoritiesQuery, ArtifactProcessRunShari
 /** A run of a process declared under `server.capabilities.processes.start`. */
 export interface ArtifactProcessStart {
     process: string;
+    /** Select a registered immutable version. Omit to start the process's current active version. */
+    version?: string;
+    /**
+     * Require the resolved immutable target to match this version and bundle hash before Atlas
+     * creates the run. Drift returns 409 PROCESS_IDENTITY_MISMATCH; this assertion does not select
+     * a version. Use `version` separately to start a captured target after active-version promotion.
+     */
+    expectedProcess?: {
+        version: string;
+        bundleHash: string;
+    };
     /** Idempotency key: starting the same run id again returns the existing run. */
     runId?: string;
     /**

package/dist/server/request-authentication.d.ts

@@ -0,0 +1,42 @@
+import { type ArtifactGatewayPublicKeys, type ArtifactRequestContext } from './request-context.js';
+export declare const ARTIFACT_REQUEST_AUTHENTICATION_HEADER = "x-sequence-artifact-authentication";
+export declare const ARTIFACT_REQUEST_AUTHENTICATION_MAX_LENGTH = 4096;
+export declare class ArtifactRequestHeaderError extends Error {
+    constructor();
+}
+/** Internal forwarding validation; the signed proof is verified by the receiving broker. */
+export declare function validatedArtifactAuthenticationHeader({ token, contextToken, external }: {
+    token: unknown;
+    contextToken: unknown;
+    external?: boolean;
+}): string | undefined;
+/** Internal transport guard: trusted appended headers share the same 32 KiB transport budget. */
+export declare function assertArtifactRequestHeaderBudget({ headers }: {
+    headers: Readonly<Record<string, string | string[]>>;
+}): void;
+/** Add only the gateway-controlled value after all browser-owned private headers were stripped. */
+export declare function appendArtifactAuthenticationHeader({ headers, token, contextToken }: {
+    headers: Record<string, string | string[]>;
+    token: unknown;
+    contextToken: unknown;
+}): void;
+/** Cloud transport identity headers may come only from the platform's own credential provider. */
+export declare function stripArtifactCloudHeaders({ headers }: {
+    headers: Record<string, string | string[]>;
+}): void;
+/**
+ * Verifies actual authentication separately from actor attribution. An absent proof keeps legacy
+ * contexts usable, but supplies no human authority. A present invalid proof always fails closed.
+ * The exact signed context bytes bind even bridge, deployment and service-account fields that
+ * are not repeated in this small proof. No application-authored context can supply this evidence.
+ */
+export declare function verifyArtifactRequestAuthentication({ token, requestContextToken, context, publicKeys, now }: {
+    token: string | null | undefined;
+    requestContextToken: string;
+    context: ArtifactRequestContext;
+    publicKeys: ArtifactGatewayPublicKeys;
+    now?: number;
+}): Readonly<{
+    authenticationMethod: 'auth0_user';
+    sub: string;
+}> | undefined;

package/dist/server/request-authentication.js

@@ -0,0 +1,93 @@
+import { createHash } from 'node:crypto';
+import { validateHeaderValue } from 'node:http';
+import { z } from 'zod';
+import { ArtifactContextError, artifactRequestContextSchema, verifyArtifactRequestContext } from './request-context.js';
+import { ARTIFACT_EXTERNAL_CONTEXT_KID_PREFIX, verifySignedContext } from './internal/signed-token.js';
+export const ARTIFACT_REQUEST_AUTHENTICATION_HEADER = 'x-sequence-artifact-authentication';
+export const ARTIFACT_REQUEST_AUTHENTICATION_MAX_LENGTH = 4096;
+export class ArtifactRequestHeaderError extends Error {
+    constructor() { super('Artifact request headers exceed the transport limit'); this.name = 'ArtifactRequestHeaderError'; }
+}
+/** Internal forwarding validation; the signed proof is verified by the receiving broker. */
+export function validatedArtifactAuthenticationHeader({ token, contextToken, external = false }) {
+    if (token === undefined)
+        return undefined;
+    if (typeof token !== 'string' || !token || token.length > ARTIFACT_REQUEST_AUTHENTICATION_MAX_LENGTH ||
+        typeof contextToken !== 'string' || !contextToken || external)
+        throw new Error('Invalid Artifact request authentication');
+    validateHeaderValue(ARTIFACT_REQUEST_AUTHENTICATION_HEADER, token);
+    return token;
+}
+/** Internal transport guard: trusted appended headers share the same 32 KiB transport budget. */
+export function assertArtifactRequestHeaderBudget({ headers }) {
+    let bytes = 0;
+    const entries = Object.entries(headers);
+    if (entries.length > 128)
+        throw new ArtifactRequestHeaderError();
+    for (const [name, value] of entries) {
+        // Node may emit array values as repeated lines. Counting each name/CRLF is conservative
+        // even for cookie values, which Node joins instead of repeating.
+        for (const item of Array.isArray(value) ? value : [value]) {
+            bytes += Buffer.byteLength(name) + Buffer.byteLength(item) + 4;
+            if (bytes > 32 * 1024)
+                throw new ArtifactRequestHeaderError();
+        }
+    }
+}
+/** Add only the gateway-controlled value after all browser-owned private headers were stripped. */
+export function appendArtifactAuthenticationHeader({ headers, token, contextToken }) {
+    const authentication = validatedArtifactAuthenticationHeader({ token, contextToken });
+    if (authentication !== undefined)
+        headers[ARTIFACT_REQUEST_AUTHENTICATION_HEADER] = authentication;
+    assertArtifactRequestHeaderBudget({ headers });
+}
+/** Cloud transport identity headers may come only from the platform's own credential provider. */
+export function stripArtifactCloudHeaders({ headers }) {
+    for (const name of Object.keys(headers)) {
+        if (name === 'x-serverless-authorization' || name.startsWith('x-goog-'))
+            delete headers[name];
+    }
+}
+/** Internal signed format. Authentication is deliberately absent from the public v1 context. */
+const authenticationProofSchema = z.object({
+    purpose: z.literal('artifact-request-authentication'), v: z.literal(1),
+    iss: z.literal('atlas-artifact-gateway'), aud: z.string().min(1).max(300),
+    authenticationMethod: z.literal('auth0_user'), sub: z.string().min(1).max(255),
+    contextJti: z.uuid(), contextSha256: z.string().regex(/^[a-f0-9]{64}$/),
+    projectId: z.string().min(1).max(255), environment: z.string().min(1).max(255),
+    method: z.enum(['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS']), pathSha256: z.string().regex(/^[a-f0-9]{64}$/),
+    iat: z.number().int().nonnegative(), exp: z.number().int().positive(),
+}).strict();
+/**
+ * Verifies actual authentication separately from actor attribution. An absent proof keeps legacy
+ * contexts usable, but supplies no human authority. A present invalid proof always fails closed.
+ * The exact signed context bytes bind even bridge, deployment and service-account fields that
+ * are not repeated in this small proof. No application-authored context can supply this evidence.
+ */
+export function verifyArtifactRequestAuthentication({ token, requestContextToken, context, publicKeys, now = Math.floor(Date.now() / 1000) }) {
+    if (token === null || token === undefined)
+        return undefined;
+    try {
+        if (!token || token.length > ARTIFACT_REQUEST_AUTHENTICATION_MAX_LENGTH)
+            throw new ArtifactContextError();
+        const signedContext = verifyArtifactRequestContext({ token: requestContextToken, publicKeys,
+            projectId: context.projectId, environment: context.environment, method: context.method, path: context.path, now });
+        if (JSON.stringify(signedContext) !== JSON.stringify(artifactRequestContextSchema.parse(context)))
+            throw new ArtifactContextError();
+        const contextSignature = verifySignedContext({ token: requestContextToken, publicKeys });
+        const verified = verifySignedContext({ token, publicKeys });
+        if (verified.kid.startsWith(ARTIFACT_EXTERNAL_CONTEXT_KID_PREFIX) || verified.kid !== contextSignature.kid)
+            throw new ArtifactContextError();
+        const proof = authenticationProofSchema.parse(verified.payload);
+        if (proof.contextSha256 !== createHash('sha256').update(requestContextToken).digest('hex') ||
+            proof.contextJti !== signedContext.jti || proof.sub !== signedContext.sub || proof.aud !== signedContext.aud ||
+            proof.projectId !== signedContext.projectId || proof.environment !== signedContext.environment ||
+            proof.method !== signedContext.method || proof.pathSha256 !== createHash('sha256').update(signedContext.path).digest('hex') ||
+            proof.iat !== signedContext.iat || proof.exp !== signedContext.exp)
+            throw new ArtifactContextError();
+        return Object.freeze({ authenticationMethod: proof.authenticationMethod, sub: proof.sub });
+    }
+    catch {
+        throw new ArtifactContextError();
+    }
+}

package/dist/server/request-context.d.ts

@@ -195,3 +195,4 @@ export declare function verifyArtifactRequestContext({ token, publicKeys, projec
 export declare function getArtifactBrowserBootstrap(context: ArtifactRequestContext | RequestContextV2External): NextArtifactBridgeBootstrap & {
     initialContext: NextArtifactInitialContext;
 };
+export { ARTIFACT_REQUEST_AUTHENTICATION_HEADER, verifyArtifactRequestAuthentication } from './request-authentication.js';

package/dist/server/request-context.js

@@ -193,3 +193,4 @@ export function getArtifactBrowserBootstrap(context) {
         },
     };
 }
+export { ARTIFACT_REQUEST_AUTHENTICATION_HEADER, verifyArtifactRequestAuthentication } from './request-authentication.js';

package/dist/server.d.ts

@@ -1,13 +1,14 @@
 import 'server-only';
 export { createArtifactServerClient } from './server/client.js';
+export type { ArtifactServerAgents, ArtifactCompletedAgentRun, ArtifactCompletedAgentSourceCapture, ArtifactCompletedAgentConversationCapture, ArtifactAgentConversationSourceCapture, ArtifactExecutionIdentity, ArtifactCreateAgentJob, ArtifactCreateWorkflowJob, ArtifactCreatedAgentJob, ArtifactCreatedWorkflowJob, ArtifactCompletedWorkflowSourceCapture } from './server/agent-responses.js';
 export { ArtifactPrincipalError, ArtifactServerError, INSUFFICIENT_USER_AUTHENTICATION, stepUpResponse } from './server/errors.js';
 export type { ArtifactAtlasRefusal } from './server/errors.js';
-export type { ArtifactAuditEvent, ArtifactOrmOperations, ArtifactOrmOptions, ArtifactProcessAdvance, ArtifactProcessAdvanceResult, ArtifactProcessArtifactRef, ArtifactProcessAssign, ArtifactProcessAssignResult, ArtifactProcessDefinition, ArtifactProcessDescribeQuery, ArtifactProcessEdge, ArtifactProcessHumanNode, ArtifactProcessNode, ArtifactProcessNodeBase, ArtifactProcessNodeState, ArtifactProcessPrincipal, ArtifactProcessPrincipalSearch, ArtifactProcessPrincipals, ArtifactProcessRun, ArtifactProcessRunRecord, ArtifactProcessRunSnapshot, ArtifactProcessRunSummary, ArtifactProcessRunsPage, ArtifactProcessRunsPageQuery, ArtifactProcessRunsQuery, ArtifactProcessRunViewerChange, ArtifactProcessRunViewers, ArtifactProcessStart, ArtifactProcessStepRecord, ArtifactProcessShareRun, ArtifactProcessShareRunResult, ArtifactProcessRunSharingAuthoritiesQuery, ArtifactProcessRunSharingAuthoritiesPage, ArtifactProcessRunSharingAuthority, ArtifactProcessRunSharingDelegate, ArtifactProcessRevokeRunSharingAuthority, ArtifactProcessRevokeRunSharingAuthorityResult, ArtifactProcessTask, ArtifactProcessTasksQuery, ArtifactServerAudit, ArtifactServerClient, ArtifactServerClientOptions, ArtifactServerContext, ArtifactServerFetchOptions, ArtifactServerFlags, ArtifactServerProcesses, } from './server/client.js';
-export { ARTIFACT_AUDIT_ACTIONS, ARTIFACT_AUDIT_RESOURCES_PER_EVENT, ARTIFACT_FLAGS_PER_REQUEST, ARTIFACT_PROCESS_PRINCIPAL_SEARCH_LIMIT, ARTIFACT_PROCESS_PRINCIPAL_TYPES, ARTIFACT_PROCESS_PRINCIPALS_PER_CALL, ARTIFACT_PROCESS_RUN_STATUSES, ARTIFACT_PROCESS_RUNS_LIMIT, ARTIFACT_PROCESS_RUN_ENTITIES_LIMIT, ARTIFACT_PROCESS_SHARE_NODES_LIMIT, ARTIFACT_PROCESS_SHARING_AUTHORITIES_LIMIT, ARTIFACT_PROCESS_TASK_VIEWS, ARTIFACT_PROCESS_TASKS_LIMIT, } from './server/broker-contract.js';
+export type { ArtifactAuditEvent, ArtifactOrmOperations, ArtifactOrmOptions, ArtifactProcessAdvance, ArtifactProcessAdvanceResult, ArtifactProcessArtifactRef, ArtifactProcessAssign, ArtifactProcessAssignResult, ArtifactProcessDefinition, ArtifactProcessDescribeQuery, ArtifactProcessEdge, ArtifactProcessHumanNode, ArtifactProcessNode, ArtifactProcessNodeBase, ArtifactProcessNodeState, ArtifactProcessPrincipal, ArtifactProcessPrincipalSearch, ArtifactProcessPrincipals, ArtifactProcessRun, ArtifactProcessRunRecord, ArtifactProcessRunSnapshot, ArtifactProcessRunSummary, ArtifactProcessRunsPage, ArtifactProcessRunsPageQuery, ArtifactProcessRunsQuery, ArtifactProcessRunViewerChange, ArtifactProcessRunViewers, ArtifactProcessStart, ArtifactProcessStepRecord, ArtifactProcessShareRun, ArtifactProcessShareRunResult, ArtifactProcessRunSharingAuthoritiesQuery, ArtifactProcessRunSharingAuthoritiesPage, ArtifactProcessRunSharingAuthority, ArtifactProcessRunSharingDelegate, ArtifactProcessRevokeRunSharingAuthority, ArtifactProcessRevokeRunSharingAuthorityResult, ArtifactProcessTask, ArtifactProcessTasksQuery, ArtifactServerAudit, ArtifactServerClient, ArtifactServerClientOptions, ArtifactServerContext, ArtifactServerFetchOptions, ArtifactServerFlags, ArtifactServerGroups, ArtifactServerProcesses, ArtifactGroupMembership, ArtifactGroupMembershipsPage, ArtifactGroupMembershipsQuery, } from './server/client.js';
+export { ARTIFACT_AUDIT_ACTIONS, ARTIFACT_AUDIT_RESOURCES_PER_EVENT, ARTIFACT_FLAGS_PER_REQUEST, ARTIFACT_GROUP_MEMBERSHIPS_LIMIT, ARTIFACT_GROUP_MEMBERSHIPS_MAX_PAGE, ARTIFACT_PROCESS_PRINCIPAL_SEARCH_LIMIT, ARTIFACT_PROCESS_PRINCIPAL_TYPES, ARTIFACT_PROCESS_PRINCIPALS_PER_CALL, ARTIFACT_PROCESS_RUN_STATUSES, ARTIFACT_PROCESS_RUNS_LIMIT, ARTIFACT_PROCESS_RUN_ENTITIES_LIMIT, ARTIFACT_PROCESS_SHARE_NODES_LIMIT, ARTIFACT_PROCESS_SHARING_AUTHORITIES_LIMIT, ARTIFACT_PROCESS_TASK_VIEWS, ARTIFACT_PROCESS_TASKS_LIMIT, } from './server/broker-contract.js';
 export type { ArtifactAuditAction, ArtifactProcessPrincipalType, ArtifactProcessRunStatus, ArtifactProcessTaskView, } from './server/broker-contract.js';
 export { getArtifactRequestContext, readArtifactRuntimeConfig } from './server/runtime-config.js';
 export type { ArtifactRuntimeConfig, ArtifactRequestHeaders } from './server/runtime-config.js';
-export { ArtifactContextError, getArtifactBrowserBootstrap } from './server/request-context.js';
+export { ArtifactContextError, getArtifactBrowserBootstrap, ARTIFACT_REQUEST_AUTHENTICATION_HEADER, verifyArtifactRequestAuthentication } from './server/request-context.js';
 export type { ArtifactContextErrorReason, ArtifactRequestContext, RequestContextV2External } from './server/request-context.js';
 export { verifyArtifactExternalContext } from './server/external-context.js';
 export type { ArtifactExternalAccept } from './server/external-context.js';

package/dist/server.js

@@ -1,8 +1,8 @@
 import 'server-only';
 export { createArtifactServerClient } from './server/client.js';
 export { ArtifactPrincipalError, ArtifactServerError, INSUFFICIENT_USER_AUTHENTICATION, stepUpResponse } from './server/errors.js';
-export { ARTIFACT_AUDIT_ACTIONS, ARTIFACT_AUDIT_RESOURCES_PER_EVENT, ARTIFACT_FLAGS_PER_REQUEST, ARTIFACT_PROCESS_PRINCIPAL_SEARCH_LIMIT, ARTIFACT_PROCESS_PRINCIPAL_TYPES, ARTIFACT_PROCESS_PRINCIPALS_PER_CALL, ARTIFACT_PROCESS_RUN_STATUSES, ARTIFACT_PROCESS_RUNS_LIMIT, ARTIFACT_PROCESS_RUN_ENTITIES_LIMIT, ARTIFACT_PROCESS_SHARE_NODES_LIMIT, ARTIFACT_PROCESS_SHARING_AUTHORITIES_LIMIT, ARTIFACT_PROCESS_TASK_VIEWS, ARTIFACT_PROCESS_TASKS_LIMIT, } from './server/broker-contract.js';
+export { ARTIFACT_AUDIT_ACTIONS, ARTIFACT_AUDIT_RESOURCES_PER_EVENT, ARTIFACT_FLAGS_PER_REQUEST, ARTIFACT_GROUP_MEMBERSHIPS_LIMIT, ARTIFACT_GROUP_MEMBERSHIPS_MAX_PAGE, ARTIFACT_PROCESS_PRINCIPAL_SEARCH_LIMIT, ARTIFACT_PROCESS_PRINCIPAL_TYPES, ARTIFACT_PROCESS_PRINCIPALS_PER_CALL, ARTIFACT_PROCESS_RUN_STATUSES, ARTIFACT_PROCESS_RUNS_LIMIT, ARTIFACT_PROCESS_RUN_ENTITIES_LIMIT, ARTIFACT_PROCESS_SHARE_NODES_LIMIT, ARTIFACT_PROCESS_SHARING_AUTHORITIES_LIMIT, ARTIFACT_PROCESS_TASK_VIEWS, ARTIFACT_PROCESS_TASKS_LIMIT, } from './server/broker-contract.js';
 export { getArtifactRequestContext, readArtifactRuntimeConfig } from './server/runtime-config.js';
-export { ArtifactContextError, getArtifactBrowserBootstrap } from './server/request-context.js';
+export { ArtifactContextError, getArtifactBrowserBootstrap, ARTIFACT_REQUEST_AUTHENTICATION_HEADER, verifyArtifactRequestAuthentication } from './server/request-context.js';
 export { verifyArtifactExternalContext } from './server/external-context.js';
 export { externalEvidence } from './server/principal.js';

package/dist/source-boundary.js

@@ -1,3 +1,4 @@
+import { realpathSync } from 'node:fs';
 import { isAbsolute, relative, resolve, sep } from 'node:path';
 /**
  * Artifact source must be self-contained: allowing a relative import to escape
@@ -7,8 +8,8 @@ import { isAbsolute, relative, resolve, sep } from 'node:path';
  * allowed because they are external to the artifact by design.
  */
 export function rejectOutsideSourcePlugin({ root, trustedExternalRoots, }) {
-    const rootResolved = resolve(root);
-    const trustedRoots = trustedExternalRoots.map((trustedRoot) => resolve(trustedRoot));
+    const rootResolved = realpathSync(resolve(root));
+    const trustedRoots = trustedExternalRoots.map((trustedRoot) => realpathSync(resolve(trustedRoot)));
     return {
         name: 'reject-artifact-outside-source',
         enforce: 'pre',
@@ -17,15 +18,22 @@ export function rejectOutsideSourcePlugin({ root, trustedExternalRoots, }) {
             if (!resolved || resolved.external || resolved.id.startsWith('\0'))
                 return resolved;
             const filePath = resolved.id.split('?')[0];
-            if (!isAbsolute(filePath) || isPathWithin(rootResolved, filePath))
+            if (!isAbsolute(filePath))
+                return resolved;
+            // Vite may return a physical path for a root reached through /tmp or
+            // another symlink. Check physical paths on both sides of the boundary;
+            // this also prevents an in-root symlink from admitting an outside file.
+            const realFilePath = realpathSync(filePath);
+            if (isPathWithin(rootResolved, realFilePath))
                 return resolved;
             const importerPath = importer?.split('?')[0];
             const importerIsTrustedExternal = importerPath != null &&
-                (isNodeModulesPath(importerPath) || isTrustedExternalPath(importerPath, trustedRoots));
+                (isNodeModulesPath(importerPath) ||
+                    (isAbsolute(importerPath) && isTrustedExternalPath(realpathSync(importerPath), trustedRoots)));
             if (isNodeModulesPath(filePath) && (isBareImport(source) || importerIsTrustedExternal)) {
                 return resolved;
             }
-            if (isTrustedExternalPath(filePath, trustedRoots))
+            if (isTrustedExternalPath(realFilePath, trustedRoots))
                 return resolved;
             const from = importer
                 ? ` (imported from ${relative(rootResolved, importer.split('?')[0])})`

package/dist/templates/react-vite/package.json

@@ -10,7 +10,7 @@
   },
   "dependencies": {},
   "devDependencies": {
-    "@sequenceholdings/artifact-studio": "^0.7.0",
+    "@sequenceholdings/artifact-studio": "^0.8.0",
     "@sequenceholdings/atlas-ui": "^3.1.1",
     "@tailwindcss/postcss": "^4.2.2",
     "@tailwindcss/vite": "^4.2.2",

package/dist/tunnel/broker.d.ts

@@ -30,6 +30,8 @@ export interface GatewayAuthorization {
     publicOrigin: string;
     /** Signed, audience-scoped context minted by Atlas, never a user bearer. */
     requestContext?: string;
+    /** Generated from the authenticated gateway session, never forwarded from a browser. */
+    requestAuthentication?: string;
 }
 export interface TunnelBrokerOptions {
     nodeId: string;
@@ -52,6 +54,10 @@ export declare class ArtifactTunnelBroker {
     private readonly pendingConnections;
     private readonly ownerTimers;
     private closing;
+    private draining;
+    private readonly drainWaiters;
+    private readonly pendingReceipts;
+    private relayClosed?;
     constructor(options: TunnelBrokerOptions);
     handleTunnelUpgrade(request: IncomingMessage, socket: Duplex, head: Buffer): Promise<void>;
     handleHttp(request: IncomingMessage, response: ServerResponse, sessionId: string): Promise<void>;
@@ -59,6 +65,7 @@ export declare class ArtifactTunnelBroker {
     handleExternalHttp(input: TunnelExternalRequest): Promise<void>;
     handleWebSocketUpgrade(request: IncomingMessage, socket: Duplex, head: Buffer, sessionId: string): Promise<void>;
     private authorize;
+    private requestHeaders;
     /**
      * The live tunnel for an external request: the session's current lease, for the granted project
      * and environment, still valid. Null otherwise. No browser owner is compared: Atlas's grant
@@ -79,7 +86,13 @@ export declare class ArtifactTunnelBroker {
     private writeExternalChunk;
     private finish;
     private abort;
-    /** Immediate revocation and graceful service shutdown hook. */
+    /** Stop new upgrades and remote-owner admission while admitted HTTP handlers finish. */
+    beginDrain(): void;
+    private notifyDrained;
+    /** The gateway first joins admitted handlers and response accounting. Its outer deadline
+     * bounds finite streams; lease validation and revocation remain active until cleanup. */
+    drain(): Promise<void>;
+    /** Immediate security revocation, never a graceful drain. */
     disconnect(sessionId: string): void;
     close(): void;
 }