@sequenceholdings/artifact-studio 0.8.1 → 0.9.1

package/README.md

@@ -500,3 +500,17 @@ streaming and file-transfer helpers retain their ordinary host tracing behavior.
 Tracing does not grant permissions, change service-account behavior or guarantee
 that every transport is instrumented. Traces availability depends on the deployed
 platform version and your app/resource permissions.
+
+
+### Microphone dictation in an isolated application
+
+Explicitly declare browser API read `/api/files/speech/config/get` and write
+`/api/files/speech/stt` to opt an isolated application iframe into microphone
+requests. Both exact paths are required; broad API wildcards do not enable it.
+The browser still asks the user for permission. Existing sandbox origin privileges
+are unchanged, and camera/geolocation remain unavailable. Legacy opaque-origin
+static frames do not receive microphone delegation.
+Upload with `api.upload` option `{ fieldName: 'audio' }`; ordinary uploads still
+default to `file`. Atlas transcription trims silence by default; multipart
+`trimSilence=false` opts out. Speech uses the declared host paths without requiring
+the separate general Next host API rollout flag.

package/dist/api.d.ts

@@ -12,11 +12,12 @@ export declare function getJson<T>({ baseUrl, token, path }: ApiClientOptions &
 export declare function getJsonOr404<T>({ baseUrl, token, path }: ApiClientOptions & {
     path: string;
 }): Promise<T | null>;
-export declare function postJson<T>({ baseUrl, token, path, body, retry503, signal, }: ApiClientOptions & {
+export declare function postJson<T>({ baseUrl, token, path, body, retry503, signal, headers, }: ApiClientOptions & {
     path: string;
     body?: unknown;
     retry503?: boolean;
     signal?: AbortSignal;
+    headers?: Record<string, string>;
 }): Promise<T>;
 export declare function deleteJson({ baseUrl, token, path, signal }: ApiClientOptions & {
     path: string;

package/dist/api.js

@@ -19,7 +19,17 @@ const DEFAULT_RETRY_AFTER_SECONDS = 2;
  * Content-Type) always win over anything here. Malformed JSON is ignored — a
  * bad bypass header should never crash a deploy before the request is even made.
  */
-function extraHeaders() {
+function extraHeaders(baseUrl) {
+    // Preview gateway credentials belong only to the target, never to a separately
+    // authenticated source repository. An unbound header set fails closed.
+    const target = process.env.ARTIFACT_STUDIO_BASE_URL;
+    try {
+        if (!target || new URL(target).origin !== new URL(baseUrl).origin)
+            return {};
+    }
+    catch {
+        return {};
+    }
     const raw = process.env.ARTIFACT_STUDIO_EXTRA_HEADERS?.trim();
     if (!raw)
         return {};
@@ -33,7 +43,7 @@ function extraHeaders() {
             // Prevent case-variant duplicates from being merged by Headers/fetch
             // (e.g. `authorization` + `Authorization` => "a, b"). The client always
             // sets these explicitly below, so ignore any env-supplied variants.
-            if (lower === 'authorization' || lower === 'content-type')
+            if (lower === 'authorization' || lower === 'content-type' || lower === 'x-sequence-source-authorization')
                 continue;
             if (typeof value === 'string')
                 headers[key] = value;
@@ -64,7 +74,7 @@ async function authenticatedFetch({ baseUrl, init = {}, path, token, retry503 =
         ...init,
         redirect: 'manual',
         headers: {
-            ...extraHeaders(),
+            ...extraHeaders(baseUrl),
             ...init.headers,
             Authorization: `Bearer ${token}`,
         },
@@ -84,7 +94,7 @@ export async function getJsonOr404({ baseUrl, token, path }) {
         throw new ArtifactApiError(await responseError('GET', path, response), response.status);
     return response.json();
 }
-export async function postJson({ baseUrl, token, path, body, retry503 = true, signal, }) {
+export async function postJson({ baseUrl, token, path, body, retry503 = true, signal, headers, }) {
     const response = await authenticatedFetch({
         baseUrl,
         token,
@@ -92,7 +102,7 @@ export async function postJson({ baseUrl, token, path, body, retry503 = true, si
         retry503,
         init: {
             method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
+            headers: { ...headers, 'Content-Type': 'application/json' },
             body: body === undefined ? undefined : JSON.stringify(body),
             ...(signal ? { signal } : {}),
         },

package/dist/cli.d.ts

@@ -32,6 +32,8 @@ export declare function getConfiguredDefaultEnv(): Promise<string | undefined>;
  */
 export interface TokenProviderOptions {
     allowInteractiveLogin: boolean;
+    /** A separate source session; omitted for target requests. Never a caller URL. */
+    sourceEnvironment?: string;
 }
 export interface ProvidedToken {
     authMode: SourceAuthMode;

package/dist/cli.js

@@ -3,7 +3,7 @@ import { constants, existsSync } from 'node:fs';
 import { dirname, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { getJson, getJsonOr404, postJson } from './api.js';
-import { ENV_URLS, readLocalConfig, resolveEnvironment, writeLocalConfig, } from './config.js';
+import { ENV_URLS, knownEnvUrls, readLocalConfig, resolveEnvironment, writeLocalConfig, } from './config.js';
 import { writeBuildArtifact } from './build.js';
 import { buildArtifactStudioProjectIsolated } from './build-subprocess.js';
 import { resolveArtifactStudioPeerVersions, } from './peer-versions.js';
@@ -33,9 +33,9 @@ const USAGE = `usage:
   seq-studio artifact list --env <env> [--json]
   seq-studio artifact show <slug-or-id> --env <env> [--json]
   seq-studio artifact validate [dir]
-  seq-studio artifact build [dir | --repo <ns>/<name> | --git-url <url>] [--ref <ref>] [--path <dir>] [--out dist/artifact-bundle.json]
-  seq-studio artifact plan [dir | --repo <ns>/<name> | --git-url <url>] [--ref <ref>] [--path <dir>] --env <env>
-  seq-studio artifact deploy [dir | --repo <ns>/<name> | --git-url <url>] [--ref <ref>] [--path <dir>] --env <env> [--skip-unchanged] [--no-create] [--project <id>]
+  seq-studio artifact build [dir | --repo <ns>/<name> | --git-url <url>] [--ref <ref>] [--path <dir>] [--source-env <env>] [--out dist/artifact-bundle.json]
+  seq-studio artifact plan [dir | --repo <ns>/<name> | --git-url <url>] [--ref <ref>] [--path <dir>] [--source-env <env>] --env <env>
+  seq-studio artifact deploy [dir | --repo <ns>/<name> | --git-url <url>] [--ref <ref>] [--path <dir>] [--source-env <env>] --env <env> [--skip-unchanged] [--no-create] [--project <id>]
   seq-studio artifact dev [dir] --env <env> [--once] [--key default] [--link <pkgDir>[,<pkgDir>]] [--port <port>]
   seq-studio artifact promote <deployment-id> --env <env>
   seq-studio artifact pull <project-id> --env <env> --out <dir>
@@ -51,7 +51,7 @@ const USAGE = `usage:
   --repo / --git-url repository (default: its root). The target project comes from
   the source's artifact.bundle.yml project_id.
 
-  Official (active) deploys to deployed environments require \`main\` with a
+  Official (active) deploys require \`main\` (or \`staging\` for staging targets) with a
   resolved git commit and a clean artifact source directory. Dirty files
   outside a nested local source directory are ignored with a warning.
   Deployments targeting \`local\` may use any branch, including dirty working
@@ -61,7 +61,11 @@ const USAGE = `usage:
   Interactive --repo builds clone over smart-HTTP using your seq-studio login
   and repository read access. No PAT is needed. Headless M2M builds use JSON
   materialize and accept only platform-managed --repo sources. Use --env to
-  select the same environment for source and deployment.
+  select the target environment. Next.js build/plan/deploy accept --source-env
+  to read a Git Service repository from a separately authenticated environment.
+  Log in to both environments; source read and target deploy permissions apply.
+  The target must support verified cross-environment builds. Source credentials
+  are used only to fetch source, never passed to the build or stored with it.
 
   Next.js: init --template nextjs, then pnpm install with Node.js 24. dev starts
   a local Next server and an owner-only Atlas preview tunnel (no cloud credentials).
@@ -114,9 +118,9 @@ function validateKnownOptions(args) {
         link: { values: ['env', 'project'], booleans: [] }, env: { values: [], booleans: [] },
         status: { values: ['env'], booleans: [] }, list: { values: ['env'], booleans: ['json'] },
         show: { values: ['env'], booleans: ['json'] }, validate: { values: [], booleans: [] },
-        build: { values: ['env', 'repo', 'git-url', 'ref', 'path', 'out'], booleans: [] },
-        plan: { values: ['env', 'repo', 'git-url', 'ref', 'path'], booleans: [] },
-        deploy: { values: ['env', 'repo', 'git-url', 'ref', 'path', 'project', 'out'], booleans: ['skip-unchanged', 'no-create'] },
+        build: { values: ['source-env', 'env', 'repo', 'git-url', 'ref', 'path', 'out'], booleans: [] },
+        plan: { values: ['source-env', 'env', 'repo', 'git-url', 'ref', 'path'], booleans: [] },
+        deploy: { values: ['source-env', 'env', 'repo', 'git-url', 'ref', 'path', 'project', 'out'], booleans: ['skip-unchanged', 'no-create'] },
         dev: { values: ['env', 'key', 'link', 'port'], booleans: ['once'] },
         promote: { values: ['env'], booleans: [] }, pull: { values: ['env', 'out'], booleans: [] },
         rollback: { values: ['env'], booleans: [] },
@@ -441,16 +445,17 @@ function reportBuildDiagnostics(result) {
 }
 async function buildCommand(args) {
     const spec = parseSourceSpec(args);
+    const sourceEnvironment = sourceEnvironmentFromArgs(args);
     // Local builds stay offline. Public git URLs need no bearer token, but an
     // optional auth lookup still identifies a selected M2M principal so the
     // source policy can reject arbitrary CI input before cloning.
-    const auth = spec.kind === 'git-service'
-        ? await getRequiredAuth(args)
+    const auth = spec.kind === 'git-service' || sourceEnvironment
+        ? await getSourceAuth(args)
         : spec.kind === 'git-url'
             ? await getOptionalAuth(args)
             : null;
     const remote = spec.kind === 'git-service' && auth
-        ? { authMode: auth.authMode, baseUrl: (await envFromArgs(args)).url, token: auth.token }
+        ? { authMode: auth.authMode, baseUrl: (sourceEnvironment ?? await envFromArgs(args)).url, token: auth.token }
         : auth
             ? { authMode: auth.authMode }
             : {};
@@ -459,6 +464,7 @@ async function buildCommand(args) {
         if (isNextArtifactManifest(await readArtifactStudioManifest(source.dir))) {
             return await buildNextCommand({ args, source, active: false });
         }
+        assertSourceEnvironmentSupportsManifest(args);
         const result = await buildPreparedArtifactSource(source);
         reportBuildDiagnostics(result);
         // A remote source's dir is a temp dir we tear down below, so default the
@@ -483,10 +489,12 @@ async function planCommand(args) {
     const auth = await getOptionalAuth(args);
     const token = auth?.token ?? null;
     const spec = parseSourceSpec(args);
+    const sourceEnvironment = sourceEnvironmentFromArgs(args);
+    const sourceAuth = sourceEnvironment ? await getSourceAuth(args) : auth;
     const source = await resolveArtifactSource(spec, {
-        ...(auth ? { authMode: auth.authMode } : {}),
-        baseUrl: env.url,
-        token,
+        ...(sourceAuth ? { authMode: sourceAuth.authMode } : {}),
+        baseUrl: (sourceEnvironment ?? env).url,
+        token: sourceAuth?.token ?? null,
     });
     try {
         const manifest = await readArtifactStudioManifest(source.dir);
@@ -494,6 +502,7 @@ async function planCommand(args) {
             const { planNextProject } = await import('./next-build.js');
             return await planNextProject({ root: source.dir, manifest, environment: env.name });
         }
+        assertSourceEnvironmentSupportsManifest(args);
         const result = await buildPreparedArtifactSource(source);
         reportBuildDiagnostics(result);
         console.log(`[seq-studio] plan ${result.manifest.artifact.project_id} -> ${env.name}`);
@@ -539,10 +548,12 @@ async function deployCommand(args) {
     const { token } = auth;
     const spec = parseSourceSpec(args);
     const explicitProjectId = typeof args.flags.project === 'string' ? args.flags.project : null;
+    const sourceEnvironment = sourceEnvironmentFromArgs(args);
+    const sourceAuth = sourceEnvironment ? await getSourceAuth(args) : auth;
     const source = await resolveArtifactSource(spec, {
-        authMode: auth.authMode,
-        baseUrl: env.url,
-        token,
+        authMode: sourceAuth.authMode,
+        baseUrl: (sourceEnvironment ?? env).url,
+        token: sourceAuth.token,
     });
     try {
         // Fail closed before build / project create for deployed environments.
@@ -558,6 +569,7 @@ async function deployCommand(args) {
         if (isNextArtifactManifest(manifest)) {
             return await buildNextCommand({ args, source, active: true });
         }
+        assertSourceEnvironmentSupportsManifest(args);
         // --skip-unchanged: hash the raw source (no build needed) and no-op when
         // the remote active deployment already matches *and* was built with the
         // same CLI/atlas-ui pin. Lets CI redeploy every artifact on every release
@@ -618,8 +630,10 @@ async function buildNextCommand({ args, source, active }) {
     if (active) {
         assertActiveDeployProvenance({ ...source.provenance, environment: env.name });
     }
-    const repositoryId = active || spec.kind === 'git-service'
-        ? await resolveNextRepositoryId({ spec, repository, baseUrl: env.url, token })
+    const sourceEnvironment = sourceEnvironmentFromArgs(args);
+    const sourceToken = sourceEnvironment ? (await getSourceAuth(args)).token : token;
+    const repositoryId = active || spec.kind === 'git-service' || sourceEnvironment
+        ? await resolveNextRepositoryId({ spec, repository, baseUrl: (sourceEnvironment ?? env).url, token: sourceToken })
         : undefined;
     const project = await ensureRemoteProject({
         env: env.url, token, result: { manifest }, linkConfigDir: spec.kind === 'local' ? source.dir : null,
@@ -632,6 +646,7 @@ async function buildNextCommand({ args, source, active }) {
     return submitNextBuild({
         root: source.dir, sourceRoot: source.sourceRoot, manifest, projectId: project.id, baseUrl: env.url,
         getToken: () => getRequiredToken(args), provenance: source.provenance, repository, repositoryId,
+        ...(sourceEnvironment ? { sourceEnvironment: sourceEnvironment.name, sourceToken } : {}),
         channel: active ? 'active' : 'preview', out: typeof args.flags.out === 'string' ? resolve(args.flags.out) : undefined,
     });
 }
@@ -1027,6 +1042,29 @@ export async function getConfiguredDefaultEnv() {
 async function envFromArgs(args) {
     return resolveEnvironment(typeof args.flags.env === 'string' ? args.flags.env : undefined, await getConfiguredDefaultEnv());
 }
+/** Source selection must never inherit the target URL override. */
+function sourceEnvironmentFromArgs(args) {
+    const name = args.flags['source-env'];
+    if (typeof name !== 'string')
+        return undefined;
+    const url = knownEnvUrls()[name];
+    if (typeof url !== 'string' || !url)
+        throw new Error(`Unknown source environment "${name}". Run seq-studio envs list and login to the source environment.`);
+    return { name, url };
+}
+async function getSourceAuth(args) {
+    const source = sourceEnvironmentFromArgs(args);
+    if (!source)
+        return getRequiredAuth(args);
+    const auth = await resolveAuth({ allowInteractiveLogin: true, sourceEnvironment: source.name });
+    if (!auth)
+        throw new Error(`Authenticate to the source with seq-studio login -e ${source.name}.`);
+    return auth;
+}
+function assertSourceEnvironmentSupportsManifest(args) {
+    if (args.flags['source-env'])
+        throw new Error('--source-env is supported for Next.js repository builds only.');
+}
 let tokenProvider = null;
 export function setTokenProvider(provider) {
     tokenProvider = provider;

package/dist/next-build.d.ts

@@ -15,7 +15,7 @@ export declare function resolveNextRepositoryId({ spec, repository, baseUrl, tok
     baseUrl: string;
     token: string;
 }): Promise<string>;
-export declare function submitNextBuild({ root, sourceRoot, manifest, projectId, baseUrl, getToken, provenance, repository, repositoryId, channel, out }: {
+export declare function submitNextBuild({ root, sourceRoot, manifest, projectId, baseUrl, getToken, provenance, repository, repositoryId, sourceEnvironment, sourceToken, channel, out }: {
     root: string;
     sourceRoot: string;
     manifest: ArtifactStudioNextManifest;
@@ -25,6 +25,8 @@ export declare function submitNextBuild({ root, sourceRoot, manifest, projectId,
     provenance: SourceProvenance;
     repository: string;
     repositoryId?: string;
+    sourceEnvironment?: string;
+    sourceToken?: string;
     channel: 'active' | 'preview';
     out?: string;
 }): Promise<number>;

package/dist/next-build.js

@@ -58,16 +58,16 @@ export async function resolveNextRepositoryId({ spec, repository, baseUrl, token
             return match[1];
     }
     catch { /* Opaque labels/SSH origins are valid preview provenance but cannot attest a release. */ }
-    throw new Error('Official Next.js releases require a Git Service repository in this Atlas environment. Push the reviewed revision, then run artifact deploy --repo <namespace>/<name> --ref main --env <env> (or --ref staging for a staging environment).');
+    throw new Error('Official Next.js releases require a Git Service repository in the selected source environment. Use --source-env <env> when its repository lives in another environment. Push the reviewed revision, then run artifact deploy --repo <namespace>/<name> --ref main --env <env> (or --ref staging for a staging environment).');
 }
 /**
  * A verified repository build names a commit and the application's directory in it;
  * anything else uploads the committed source snapshot. The repository root is omitted
  * so the request stays valid for Atlas versions that predate `sourceRoot`.
  */
-function nextBuildRequestBody({ manifest, files, commit, provenance, repository, repositoryId, sourceRoot, channel }) {
+function nextBuildRequestBody({ manifest, files, commit, provenance, repository, repositoryId, sourceEnvironment, sourceRoot, channel }) {
     if (repositoryId)
-        return { repositoryId, commit, ...(sourceRoot === '.' ? {} : { sourceRoot }), idempotencyKey: randomUUID(), channel };
+        return { repositoryId, ...(sourceEnvironment ? { sourceEnvironment } : {}), commit, ...(sourceRoot === '.' ? {} : { sourceRoot }), idempotencyKey: randomUUID(), channel };
     return {
         manifest,
         files: files.map(({ path, content, encoding }) => ({ path, content, encoding: encoding ?? 'utf8' })),
@@ -75,7 +75,7 @@ function nextBuildRequestBody({ manifest, files, commit, provenance, repository,
         idempotencyKey: randomUUID(), channel,
     };
 }
-export async function submitNextBuild({ root, sourceRoot, manifest, projectId, baseUrl, getToken, provenance, repository, repositoryId, channel, out }) {
+export async function submitNextBuild({ root, sourceRoot, manifest, projectId, baseUrl, getToken, provenance, repository, repositoryId, sourceEnvironment, sourceToken, channel, out }) {
     if (!provenance.gitCommit || !/^[a-f0-9]{40}$/i.test(provenance.gitCommit)) {
         throw new Error('Commit the application source before requesting a hosted build. Use artifact dev for uncommitted local development.');
     }
@@ -84,8 +84,12 @@ export async function submitNextBuild({ root, sourceRoot, manifest, projectId, b
     if (channel === 'active' && !repositoryId)
         throw new Error('An official release requires a verified Git Service repository.');
     const path = `/api/artifact-studio/projects/${encodeURIComponent(projectId)}/next`;
-    const body = nextBuildRequestBody({ manifest, files: source.files, commit: provenance.gitCommit, provenance, repository, repositoryId, sourceRoot, channel });
-    const response = operationSchema.parse(await postJson({ baseUrl, token: await getToken(), path: `${path}/builds${repositoryId ? '/from-repository' : ''}`, body }));
+    const body = nextBuildRequestBody({ manifest, files: source.files, commit: provenance.gitCommit, provenance, repository, repositoryId, sourceEnvironment, sourceRoot, channel });
+    if (sourceEnvironment && !sourceToken)
+        throw new Error('Cross-environment builds require a separately authenticated source session.');
+    const response = operationSchema.parse(await postJson({ baseUrl, token: await getToken(), path: `${path}/builds${repositoryId ? '/from-repository' : ''}`, body, ...(sourceEnvironment ? { headers: { 'x-sequence-source-authorization': `Bearer ${sourceToken}` } } : {}) }));
+    if (sourceEnvironment)
+        console.log(`[seq-studio] source: ${sourceEnvironment} / ${repository} -> target: ${baseUrl}`);
     const directory = repositoryId && sourceRoot !== '.' ? ` (${sourceRoot})` : '';
     console.log(`[seq-studio] Atlas build ${response.operation.id} (${channel}) from ${provenance.gitCommit.slice(0, 12)}${directory}`);
     console.log(`${baseUrl}/artifact-studio/projects/${projectId}`);

package/dist/sdk.d.ts

@@ -44,6 +44,8 @@ export interface SequenceApiFetchResponse<TBody = unknown> {
     headers?: Record<string, string>;
 }
 export interface SequenceApiUploadOptions {
+    /** Multipart binary field name. Defaults to file. */
+    fieldName?: string;
     timeoutMs?: number;
     /**
      * HTTP method for the multipart request. Defaults to POST; PUT is allowed

package/dist/templates/react-vite/package.json

@@ -10,7 +10,7 @@
   },
   "dependencies": {},
   "devDependencies": {
-    "@sequenceholdings/artifact-studio": "^0.8.0",
+    "@sequenceholdings/artifact-studio": "^0.9.0",
     "@sequenceholdings/atlas-ui": "^3.1.1",
     "@tailwindcss/postcss": "^4.2.2",
     "@tailwindcss/vite": "^4.2.2",

package/package.json

@@ -9,7 +9,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.8.1",
+  "version": "0.9.1",
   "description": "SDK types and CLI library for building Artifact Studio apps. Driven via `seq-studio artifact <sub>` (@sequenceholdings/studio-cli), which runs the `./cli` runCli export.",
   "type": "module",
   "exports": {
@@ -168,7 +168,7 @@
     "server-only": "0.0.1",
     "parse5": "7.3.0",
     "@sequenceholdings/lattice-form-renderer": "0.2.0",
-    "@sequenceholdings/storage": "0.1.1",
+    "@sequenceholdings/storage": "0.1.2",
     "@sequenceholdings/orm": "2.6.2"
   },
   "devDependencies": {

package/templates/react-vite/package.json

@@ -10,7 +10,7 @@
   },
   "dependencies": {},
   "devDependencies": {
-    "@sequenceholdings/artifact-studio": "^0.8.0",
+    "@sequenceholdings/artifact-studio": "^0.9.0",
     "@sequenceholdings/atlas-ui": "^3.1.1",
     "@tailwindcss/postcss": "^4.2.2",
     "@tailwindcss/vite": "^4.2.2",