@sequenceholdings/artifact-studio 0.9.1 → 0.10.0

package/README.md

@@ -475,6 +475,13 @@ const body = await client.api.stream('/api/agents/chat', {
 return new Response(body, { headers: { 'content-type': 'text/event-stream' } })
 ```
 
+`client.api.streamResponse(path, options)` uses the same streaming transport and
+returns the full `Response`, retaining the broker-approved content type, length,
+and download filename. It does not buffer the body. Forward `request.signal` to
+cancel upstream work when the user disconnects. Governed content readers impose
+their own stricter byte and whole-stream deadlines; this method does not extend
+them. The method is prepared for 0.10.0 and awaits publication.
+
 ## Grouping calls into a trace
 
 The Artifact host supplies tracing context automatically for supported platform
@@ -514,3 +521,215 @@ Upload with `api.upload` option `{ fieldName: 'audio' }`; ordinary uploads still
 default to `file`. Atlas transcription trims silence by default; multipart
 `trimSilence=false` opts out. Speech uses the declared host paths without requiring
 the separate general Next host API rollout flag.
+
+## Next.js task completion and app navigation access (awaiting publication)
+
+These methods require the matching Atlas host deployment. The SDK conveniences
+are prepared for Artifact Studio 0.10.0; source availability does not mean the
+package has been published.
+
+```ts
+const appAccess = await bridge.auth.getAppAccess()
+// Show links only when the destination's value is true. This is a UI hint;
+// the destination still authorizes the user independently.
+
+// After your app-owned route successfully advances its native process step:
+const { notified } = await bridge.lattice.notifyAdvance()
+// false means the server has not yet completed this human step. Retry this
+// read after the accepted transition settles; never replay the mutation.
+```
+
+`auth.getAppAccess` reads only the current viewer's boolean navigation map from
+one fixed, authenticated host endpoint. It accepts no principal or URL,
+requires no arbitrary `capabilities.api` declaration, and does not depend on
+`artifact-next-browser-api`. Missing or malformed permission responses fail
+closed. The generic bridge equivalent is
+`bridge.request({ method: 'auth.getAppAccess' })`.
+
+`lattice.notifyAdvance` accepts no run or step arguments. The host uses its own
+trusted embed context and checks the native authorized run snapshot. Only the
+exact completed human step produces an advance notification; pending, failed,
+replaced or unauthorized tasks cannot. Repeated notifications are deduplicated
+for that host instance. It never advances a process or changes assignments.
+An app can call it before submitting as a host-support check: a parked step
+returns `{ notified: false }`; an old host rejects the method. The generic
+bridge equivalent is `bridge.request({ method: 'lattice.notifyAdvance' })`.
+Applications outside a task embed have no completion context and cannot use it.
+
+
+### Bounded lifecycle reads and group management discovery
+
+A server application can read exact run lifecycles in batches of at most 500
+through `api.post('/api/lattice/runs/read', { runIds })`. Declare that POST path
+under `server.capabilities.api.write` and each process under `processes.read`.
+The adapter has no write effects. It requires the signed-in user, a declared
+process (including development bindings), and Viewer on every run before
+returning any result. Missing or denied runs fail the entire batch. Results
+contain only `id`, `processId`, `status`, `startedAt`, `completedAt`, and
+`archivedAt`; no process metadata, step context, or credentials are exposed.
+
+The authorized group directory and detail responses include `canManage`,
+derived from existing group administration or platform administration, and
+`externalId`. Applications cannot confer group authority through their own
+roles. `POST /api/groups/directory` accepts `manageableOnly: true`; it uses all
+groups only for a verified platform administrator, and otherwise filters the
+caller's existing accessible pages. In that mode the response is
+`{ groups, nextPage: number | null }`, with no filtered-count claim. Follow
+`nextPage` even when a page is empty. This read grants no memberships and changes no group.
+
+### Recoverable group task assignment
+
+Human callers can use these declared `server.capabilities.api.write` adapters:
+
+- `POST /api/lattice/group-task-assignment/prepare`: `{groupId, runId, stepId,
+  targetSub}` returns `{runId, stepId, nodeId, processId, processVersion,
+  expectedAssignmentToken, intentId, preparationProof}`. The server mints the
+  intent UUID. The signed proof binds the exact caller, project, group, command,
+  pinned process/step and actual SQL environment. The application must declare `processes.act` for
+  the mapped process and `groups.read`. The caller must independently administer
+  the live group and hold run Viewer. The task must be parked and unsubmitted,
+  currently assigned to that group or a member, and the target must be an active
+  group member permitted by the run's pinned node allowlist. Application roles
+  do not grant group administration.
+- `POST /api/lattice/group-task-assignment/commit`: the same fields plus
+  `{intentId, expectedAssignmentToken, preparationProof}` return `{receipt}`. The UUID intent is
+  unique within the project. Native assignment, its authorization outbox, and
+  the immutable `applied` receipt commit in one transaction. Reusing an intent
+  with different actor, run, step, target, or token returns 409; an exact retry
+  never reapplies an old assignment.
+- `POST /api/lattice/group-task-assignment/cancel`: the commit body returns the
+  stable receipt. Cancellation and commit serialize on the same intent key.
+  A `cancelled` receipt prevents any later assignment; an already `applied`
+  receipt is returned unchanged. Current group authority and run Viewer remain
+  required, but a disabled target or completed task does not prevent cancellation.
+- `POST /api/lattice/group-task-assignment/receipt`: `{runId, intentId}` returns
+  `{receipt: object | null}` under the project's exact identity, declared
+  `processes.read`, and current run Viewer. It never returns another project's
+  receipt or exposes task state, context, or wait credentials.
+
+A receipt contains project/intent/run/step/node identities, actor, principals,
+`outcome: applied | cancelled`, and `committedAt`. Its timestamp is the database
+transaction timestamp; the receipt becomes visible only after commit. A null
+receipt is **not** proof that a command cannot still apply. App-owned ownership
+reservations must finalize on `applied` and release only on `cancelled`. They
+must not expire an ambiguous reservation or issue another intent as a retry.
+The preparation proof has no expiry and grants no permission by itself. Signing
+key rotation requires explicit operator recovery for pending commands. If the
+caller loses group authority, recovery needs an explicitly authorized
+operator; these endpoints never impersonate the original caller. The first
+release provides caller-driven recovery, not a background service reconciler.
+
+Deployment requires the host adapters and the journaled assignment receipt
+migration. The app's ownership transaction and notification outbox remain
+application-owned and require their own reviewed service grants.
+
+`client.processes.getHumanCompletion({ runId, stepId })` reads a committed,
+server-verified human completion receipt. Declare the exact
+`/api/lattice/human-completion/read` path under `server.capabilities.api.write`
+(the POST carries a body but has no write effects), plus the process under
+`processes.read`. Only a verified human caller with current Run Viewer access can
+read it. The result binds actor, immutable process version/bundle, exact step
+attempt, edge and canonical payload hash; it never returns the payload, signing
+token or wait credentials. The payload hash covers canonical JSON of the actual
+submitted payload, including the server-stamped `advanced_by`, excluding the
+reserved `_sequence_human_completion` receipt key. HTTP409
+`HUMAN_COMPLETION_UNAVAILABLE` means no verified committed evidence is available;
+it is not permission to replay a mutation. This method does not establish a
+successor step or grant authority to assign one. The same adapter is callable
+through `client.api.post` by earlier SDK clients, once the target platform release
+is active. Policy-backed application writes still independently require the
+reviewed ORM runtime capability and admission checks.
+
+`client.processes.getHumanContinuation({ runId, stepId })` uses the corresponding
+`/api/lattice/human-continuation/read` POST adapter with the same caller and process
+read permissions. It returns `waiting`, `terminal`, or the first still-parked human
+step and its materialized user/group assignments. The platform verifies the signed
+source completion and every actual edge in a bounded contiguous native serial walk
+against the pinned bundle. Ambiguous or truncated history, parallel/subprocess
+paths, resets, intervening human completions and repeated nodes are refused with
+HTTP409 `HUMAN_CONTINUATION_UNAVAILABLE`; timestamps or graph reachability alone
+never establish a successor. This read grants no authority to advance or reassign.
+
+`bridge.lattice.prepareAdvance()` verifies the host-owned embedded task and its caller Viewer admission without emitting a completion signal, including when the native step already completed. Apps with a separate durable handoff must first verify that handoff, then call `notifyAdvance()`. Both methods accept no task identifiers; the host supplies its own signed context.
+
+### Coordinating a human submission with application ownership (awaiting publication)
+
+Official Next.js servers can coordinate a native human completion with a separate
+application transaction through `/api/lattice/human-handoff/*`. These are fixed
+`client.api.post` adapters: declare each exact path under `server.capabilities.api.write`
+and the process under `processes.act` and `processes.read`. They require a verified
+runtime credential, the gateway's authenticated human, current Run Viewer, and the
+same application and original actor on every retry. Browser delegation, service
+mode, a copied request context, and caller-supplied identity are refused. The
+application server is trusted to acknowledge only its own committed transaction;
+applications must not proxy acknowledgement directly from browser input.
+
+The protocol is deliberately ordered:
+
+1. `prepare` takes `{runId, stepId, edgeId, payload}` and performs read-only support,
+   current Advancer and immutable graph checks. It returns an immutable command
+   with `id`, source pins, `payloadHash`, `assignmentToken` and `preparationProof`.
+   Store this complete command with the application intent and original payload.
+2. Reserve the application intent with its own CAS, then call `reserve` with that
+   exact prepared command. Native reservation checks the source assignment,
+   submission and mutation admissions under the run lock. A failure does not
+   authorize clearing the application reservation.
+3. `advance` takes `{id, runId, stepId, payload}`. Only the original immutable
+   command may signal the workflow. Admission is durable before dispatch; an HTTP
+   failure, Temporal signal ACK, or absent completion receipt is not cancellation.
+4. Use the verified completion and continuation readers. `reconcile` takes
+   `{id, runId, stepId, users, groups}` and binds the proved immediate successor.
+   Identical native assignments need no Owner grant. A real change retains native
+   Run Owner, destination grantability and allowlist requirements, with readback.
+   Terminal continuations require empty user/group arrays.
+5. Commit the application's atomic ownership/watchers/outbox transaction. Only
+   then call `acknowledge` with `{id, runId, stepId}`. `released` is required before
+   telling the browser the whole action succeeded. If acknowledgement is lost,
+   retry it; it never replays the application transaction.
+
+`read` takes `{runId, stepId, id?}` and returns only fence identity/status and the
+bound successor. Include `id` to recover an exact cancelled attempt. Without it,
+only a non-cancelled source attempt is returned. It exposes no payload or token.
+
+When the source assignment changes between preparation and reservation, `cancel`
+accepts the exact prepared command and verifies its server signature, actor,
+application and actual SQL environment. Under the same run lock it writes a
+permanent cancellation receipt only if no matching native command was admitted
+or unexplained settlement observed. A different immutable native admission proves
+this command did not settle, even if that other command already completed.
+Protocol-1 workers always require matching admission before consuming a signal.
+A worker-only timeout receipt, written atomically with the timeout result and
+pinned to the source attempt, also proves an unaccepted prepared command did
+not complete when the timeout won before reservation. Payload fields and imported
+runner output are never timeout evidence. The application may clear its own exact pending CAS only
+after observing `status: 'cancelled'`. The cancelled ID can never reserve or
+advance; a fresh prepared ID can retry the still-parked source. There is no timeout
+unlock. A late request using a cancelled permit is refused before signal delivery.
+
+**Activation boundaries:** this initial protocol admits only top-level Temporal
+human waiters that advertise the patched native handoff protocol. Trigger wait
+credentials and older in-flight waiters are unsupported. Existing human timeout durations remain in force. A held fence pauses settlement
+of both its source timeout and any successor timeout until reconciliation or
+exact cancellation; it does not remove the configured timeout. Every possible selected continuation must reach a first human or
+terminal through at most 128 serial automation, managed-function, managed-server
+or delay nodes. Parallel/subprocess/agent routes, loops, duplicate or missing
+edges are rejected before reserving application state. Deploy migrations first,
+then roll out the admission-enforcing API to every instance, then deploy patched
+workers, and only then enable application use. Deploying workers before all API
+callers admit signals can discard unadmitted old-version signals; an API rollout
+alone is insufficient. Existing unsupported waiters need an independently
+reviewed migration or must finish on their prior application path.
+
+While held, native advance, assignment, sharing, cancellation, reset and fork
+mutations cannot cross the fence. The worker discards stale unadmitted signals
+and holds successor timeouts until release. Ordinary native commands are admitted
+before dispatch, and a prior admitted command prevents fence acquisition. A
+causally verified terminal automation failure can reconcile and release the
+handoff; terminal settlement does not imply a successful ticket outcome. An
+unexplained run failure still requires investigation.
+Nontransactional reset/fork operations retain per-attempt admissions after an
+uncertain mutating failure. **Those admissions currently require operator recovery
+and are an explicit operability/release gate for affected runs:** a later retry or
+current SQL outcome alone cannot prove an older provider call has stopped. No API
+silently expires, impersonates, or clears those attempts. Review provider-specific
+reconciliation before enabling affected-run recovery.

package/VERSION-PIN.md

@@ -94,6 +94,21 @@ before publication; an ordinary released CLI intentionally cannot.
 The React/Vite starter therefore uses released primitives and responsive CSS
 until that pin advances. Its build test exercises the ordinary CLI toolchain.
 
+## Planned team directory and embedded-task release
+
+Artifact Studio 0.10.0 and Studio CLI 0.6.6 are prepared for the separate
+chain-release workflow and remain awaiting publication. This change adds
+user-authorized directory/group methods, parked human-task assignment reads,
+and a host-verified completion notification for embedded Next.js tasks. The
+narrow app-access bridge reads only the signed-in viewer's app access.
+
+Deploy the matching platform handlers before activating consumers. An SDK
+build or candidate version is not evidence that the registry or target host
+supports these methods. Group administration still requires authority over the
+group; an application's manage capability does not grant it. Completion
+notification verifies the host's own run/step and does not execute or replay a
+workflow transition. Existing package export classifications stay unchanged.
+
 ## Unreleased server process additions
 
 Workspace source adds `processes.listRunsPage` (visible, paginated run summaries)

package/dist/api.d.ts

@@ -19,6 +19,11 @@ export declare function postJson<T>({ baseUrl, token, path, body, retry503, sign
     signal?: AbortSignal;
     headers?: Record<string, string>;
 }): Promise<T>;
+/** Binding updates are idempotent; normal authenticated target transport applies. */
+export declare function putJson<T>({ baseUrl, token, path, body }: ApiClientOptions & {
+    path: string;
+    body: unknown;
+}): Promise<T>;
 export declare function deleteJson({ baseUrl, token, path, signal }: ApiClientOptions & {
     path: string;
     signal?: AbortSignal;

package/dist/api.js

@@ -111,6 +111,13 @@ export async function postJson({ baseUrl, token, path, body, retry503 = true, si
         throw new ArtifactApiError(await responseError('POST', path, response), response.status);
     return response.json();
 }
+/** Binding updates are idempotent; normal authenticated target transport applies. */
+export async function putJson({ baseUrl, token, path, body }) {
+    const response = await authenticatedFetch({ baseUrl, token, path, init: { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) } });
+    if (!response.ok)
+        throw new ArtifactApiError(await responseError('PUT', path, response), response.status);
+    return response.json();
+}
 export async function deleteJson({ baseUrl, token, path, signal }) {
     const response = await authenticatedFetch({ baseUrl, token, path, init: { method: 'DELETE', ...(signal ? { signal } : {}) } });
     if (!response.ok)

package/dist/artifact-env-bindings.d.ts

@@ -1,4 +1,4 @@
-/** Fail an artifact deploy whose source still points at another environment. */
+/** Validate explicit artifact manifest bindings against the selected environment. */
 export declare function assertArtifactEnvironmentBindings({ directory, environment, token, }: {
     directory: string;
     environment: {

package/dist/artifact-env-bindings.js

@@ -1,10 +1,11 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
 import { getJsonOr404 } from './api.js';
 import { knownEnvUrls } from './config.js';
 import { assertNoCrossEnvironmentBindings, canonicalDeploymentOrigin } from './env-bindings.js';
-import { readArtifactStudioSource } from './project.js';
-/** Fail an artifact deploy whose source still points at another environment. */
+/** Validate explicit artifact manifest bindings against the selected environment. */
 export async function assertArtifactEnvironmentBindings({ directory, environment, token, }) {
-    const source = await readArtifactStudioSource(directory);
+    const manifest = await readFile(join(directory, 'artifact.bundle.yml'), 'utf8');
     const deployOrigin = canonicalDeploymentOrigin(environment.url);
     if (!deployOrigin)
         throw new Error(`Invalid deployment URL '${environment.url}'.`);
@@ -17,7 +18,7 @@ export async function assertArtifactEnvironmentBindings({ directory, environment
         deployOrigin,
         origins,
         workspaces: [],
-        files: source.files,
+        files: [{ path: 'artifact.bundle.yml', content: manifest }],
         workspaceExists: async (workspaceId) => {
             const workspace = await getJsonOr404({
                 baseUrl: environment.url,

package/dist/build-input-guards.d.ts

@@ -0,0 +1,8 @@
+import { type Plugin } from 'vite';
+import { type SourceBoundary } from './source-boundary.js';
+export declare function guardStylesheetInputsPlugin(boundary: SourceBoundary): Plugin;
+/**
+ * Reject `new URL('<path>', import.meta.url)` assets outside the boundary. A
+ * template literal is a glob over its static directory, which must stay inside.
+ */
+export declare function guardImportMetaUrlPlugin(boundary: SourceBoundary): Plugin;

package/dist/build-input-guards.js

@@ -0,0 +1,178 @@
+import { existsSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { createIdResolver } from 'vite';
+import { isBareImport } from './source-boundary.js';
+/**
+ * Vite and Tailwind resolve some build inputs with internal resolvers that
+ * never reach a plugin's `resolveId`: stylesheet `@import`, CSS `url()` and
+ * `image-set()`, and `new URL('<literal>', import.meta.url)`. Tailwind also
+ * runs JavaScript named by `@plugin` and `@config`. The build runs on the
+ * caller's machine (a laptop, CI, or an agent sandbox holding the caller's
+ * token), so these guards check every such reference against the source
+ * boundary before Vite or Tailwind acts on it.
+ */
+/** The stylesheet requests Vite and Tailwind process (Vite's own CSS language test). */
+const STYLESHEET_REQUEST_RE = /\.(?:css|less|sass|scss|styl|stylus|pcss|postcss|sss)(?:$|\?)|[?&]lang\.css\b/;
+/** Tailwind at-rules that load and run JavaScript at build time. */
+const BUILD_CODE_AT_RULE_RE = /@(?:plugin|config)(?![\w-])/i;
+/** A CSS string: either quote, with the other quote and escapes allowed inside. */
+const CSS_STRING = String.raw `"((?:[^"\\]|\\.)*)"|'((?:[^'\\]|\\.)*)'`;
+/** `@import` / `@reference` targets: a string, or a string or bare token in `url()`. */
+const STYLESHEET_IMPORT_RE = new RegExp(String.raw `@(?:import|reference)\s*(?:url\(\s*)?(?:${CSS_STRING}|([^'"\s;)]+))`, 'gi');
+/** Tailwind `@source` paths (`@source inline(...)` names classes, not files). */
+const SOURCE_DIRECTIVE_RE = new RegExp(String.raw `@source\s+(?:not\s+)?(?:${CSS_STRING})`, 'gi');
+/** Mirrors Vite's `cssUrlRE`, so every `url()` Vite rewrites is checked. */
+const CSS_URL_RE = /(?<=^|[^\w\-\u0080-￿])url\((\s*('[^']+'|"[^"]+")\s*|(?:\\.|[^'")\\])+)\)/g;
+const IMAGE_SET_RE = /image-set\(([^)]*(?:\([^)]*\)[^)]*)*)\)/gi;
+const QUOTED_RE = new RegExp(CSS_STRING, 'g');
+/** Mirrors Vite's `assetImportMetaUrlRE`. */
+const IMPORT_META_URL_RE = /\bnew\s+URL\s*\(\s*('[^']+'|"[^"]+"|`[^`]+`)\s*,\s*import\.meta\.url\s*(?:,\s*)?\)/g;
+const NON_FILE_URL_RE = /^(?:[a-z][a-z\d+.-]*:|\/\/|#)/i;
+function pathOf(id) {
+    if (id.startsWith('\0'))
+        return null;
+    const filePath = id.split('?')[0];
+    return isAbsolute(filePath) ? filePath : null;
+}
+/**
+ * Where Vite would read a referenced asset from: relative to the referencing
+ * file, root-relative then absolute for a leading `/`. Null for a URL that is
+ * not a local file or that does not exist (Vite leaves those unresolved).
+ */
+function referencedFile({ reference, importer, root }) {
+    let target = reference.trim().replace(/^['"]|['"]$/g, '').split(/[?#]/)[0];
+    try {
+        target = decodeURI(target);
+    }
+    catch {
+        // Vite keeps an undecodable URL as written.
+    }
+    if (!target || NON_FILE_URL_RE.test(target))
+        return null;
+    const candidates = target.startsWith('/') ? [join(root, target), target] : [resolve(dirname(importer), target)];
+    return candidates.find((candidate) => existsSync(candidate)) ?? null;
+}
+/**
+ * Reject Tailwind JavaScript loading and out-of-boundary references in every
+ * stylesheet the build processes, following `@import` into nested stylesheets
+ * because Tailwind and Vite read those without another plugin pass. Must run
+ * before Tailwind: list it ahead of `@tailwindcss/vite`.
+ */
+/** The first capture group a match filled: the string body or the bare token. */
+function captured(match) {
+    return match.slice(1).find((group) => group !== undefined);
+}
+export function guardStylesheetInputsPlugin(boundary) {
+    // Files already scanned or being scanned. Recording a file before awaiting
+    // its imports makes an import cycle end instead of awaiting an ancestor.
+    const started = new Set();
+    // Resolve package stylesheets as Vite's CSS @import does (the `style`
+    // condition): a CSS-only package such as tw-animate-css has no JS entry.
+    let resolveStylesheet;
+    async function checkStylesheet({ file, code, resolveStylesheetImport }) {
+        if (!boundary.isTrusted(file) && BUILD_CODE_AT_RULE_RE.test(code)) {
+            throw new Error(`Artifact stylesheet "${file}" uses Tailwind @plugin or @config, which runs JavaScript on the build machine. ` +
+                'Configure Tailwind in CSS (@theme, @utility, @custom-variant) instead.');
+        }
+        const assertPath = (reference, kind) => {
+            const filePath = referencedFile({ reference, importer: file, root: boundary.root });
+            if (filePath)
+                boundary.assertBuildInput({ filePath, importer: file, bareSpecifier: false, reference: kind });
+            return filePath;
+        };
+        const nested = [];
+        for (const match of code.matchAll(STYLESHEET_IMPORT_RE)) {
+            const specifier = captured(match);
+            if (!specifier || NON_FILE_URL_RE.test(specifier))
+                continue;
+            // Check both the literal path and what the CSS resolver finds (which adds
+            // `.css` to an extensionless path and follows a package's `style` entry):
+            // Tailwind and Vite load whichever exists.
+            const literal = assertPath(specifier, 'stylesheet import');
+            const resolved = await resolveStylesheetImport(specifier, file);
+            if (resolved) {
+                boundary.assertBuildInput({ filePath: resolved, importer: file, bareSpecifier: isBareImport(specifier), reference: 'stylesheet import' });
+            }
+            // Tailwind and Vite parse any imported file as CSS, whatever its extension.
+            for (const filePath of new Set([literal, resolved]))
+                if (filePath)
+                    nested.push(filePath);
+        }
+        for (const match of code.matchAll(SOURCE_DIRECTIVE_RE)) {
+            const path = captured(match);
+            if (path)
+                boundary.assertBuildInput({ filePath: resolve(dirname(file), path), importer: file, bareSpecifier: false, reference: '@source path' });
+        }
+        for (const [, reference] of code.matchAll(CSS_URL_RE)) {
+            if (reference)
+                assertPath(reference, 'stylesheet url()');
+        }
+        for (const [, body] of code.matchAll(IMAGE_SET_RE)) {
+            for (const quoted of (body ?? '').matchAll(QUOTED_RE)) {
+                const reference = captured(quoted);
+                if (reference)
+                    assertPath(reference, 'stylesheet image-set()');
+            }
+        }
+        await Promise.all(nested.map((nestedFile) => checkFile(nestedFile, resolveStylesheetImport)));
+    }
+    async function checkFile(file, resolveStylesheetImport) {
+        // A file another traversal already started is checked there, and a failure
+        // there fails the build.
+        if (started.has(file))
+            return;
+        started.add(file);
+        await checkStylesheet({ file, code: await readFile(file, 'utf8'), resolveStylesheetImport });
+    }
+    return {
+        name: 'guard-artifact-stylesheet-inputs',
+        enforce: 'pre',
+        configResolved(config) {
+            resolveStylesheet = createIdResolver(config, {
+                extensions: ['.css'], mainFields: ['style'], conditions: ['style', 'production'], tryIndex: false, preferRelative: true,
+            });
+        },
+        async transform(code, id) {
+            const file = pathOf(id);
+            if (!file || !STYLESHEET_REQUEST_RE.test(id) || /[?&]raw\b/.test(id))
+                return null;
+            const environment = this.environment;
+            const resolveStylesheetImport = async (specifier, importer) => {
+                // An import the CSS resolver cannot find is checked by its literal path;
+                // anything else unresolvable fails in Vite or Tailwind as well.
+                const resolved = await resolveStylesheet?.(environment, specifier, importer).catch(() => undefined);
+                return resolved ? pathOf(resolved) : null;
+            };
+            await checkStylesheet({ file, code, resolveStylesheetImport });
+            return null;
+        },
+    };
+}
+/**
+ * Reject `new URL('<path>', import.meta.url)` assets outside the boundary. A
+ * template literal is a glob over its static directory, which must stay inside.
+ */
+export function guardImportMetaUrlPlugin(boundary) {
+    return {
+        name: 'guard-artifact-import-meta-url',
+        enforce: 'pre',
+        transform(code, id) {
+            const file = pathOf(id);
+            if (!file || STYLESHEET_REQUEST_RE.test(id) || !code.includes('import.meta.url'))
+                return null;
+            for (const [, literal] of code.matchAll(IMPORT_META_URL_RE)) {
+                const body = literal.slice(1, -1);
+                const isTemplate = literal.startsWith('`') && body.includes('${');
+                const reference = isTemplate ? body.slice(0, body.lastIndexOf('/', body.indexOf('${')) + 1) || '.' : body;
+                if (NON_FILE_URL_RE.test(reference))
+                    continue;
+                const target = reference.startsWith('/')
+                    ? [join(boundary.root, reference), reference].find((candidate) => existsSync(candidate)) ?? join(boundary.root, reference)
+                    : resolve(dirname(file), reference);
+                boundary.assertBuildInput({ filePath: target, importer: file, bareSpecifier: false, reference: 'new URL() asset' });
+            }
+            return null;
+        },
+    };
+}

package/dist/build.js

@@ -15,7 +15,8 @@ import { isNextArtifactManifest } from './manifest.js';
 import { normalizeArtifactPath } from './paths.js';
 import { resolveArtifactStudioPeerVersions, } from './peer-versions.js';
 import { ARTIFACT_RUNTIME_CHUNK_DIR, assertSafeRuntimeChunkFileName } from './runtime-chunks.js';
-import { rejectOutsideSourcePlugin } from './source-boundary.js';
+import { guardImportMetaUrlPlugin, guardStylesheetInputsPlugin } from './build-input-guards.js';
+import { createSourceBoundary, rejectOutsideSourcePlugin } from './source-boundary.js';
 import { collectCandidateTokenCompatibilityDiagnostics, collectDeprecatedTokenImportDiagnostics, } from './token-contract.js';
 /** Keep in sync with `atlas/src/server/services/artifact-studio/limits.ts`. */
 const MAX_DEPLOY_SOURCEMAP_BYTES = 10 * 1024 * 1024;
@@ -126,16 +127,24 @@ export async function buildArtifactStudioProject(rootDir, { candidateTokenCompat
     // Give Vite and the source boundary the same physical root.
     const root = await realpath(source.root);
     const transformedCssModules = new Map();
+    const boundary = createSourceBoundary({
+        root,
+        trustedExternalRoots: [...Object.values(peerResolveAlias).map((target) => dirname(target)), dirname(artifactSdkEntry)],
+    });
     const result = await viteBuild({
         root,
         configFile: false,
         logLevel: 'silent',
+        // An inline PostCSS config stops Vite from loading postcss.config.* (or
+        // .postcssrc) from the source tree, which would run repository code on the
+        // build machine. Tailwind runs as the Vite plugin below and needs none.
+        css: { postcss: { plugins: [] } },
         plugins: [
-            rejectOutsideSourcePlugin({
-                root,
-                trustedExternalRoots: [...Object.values(peerResolveAlias).map((target) => dirname(target)), dirname(artifactSdkEntry)],
-            }),
+            rejectOutsideSourcePlugin(boundary),
             rejectIgnoredSourcePlugin(root, source.ignorePatterns),
+            // Before Tailwind, which reads @import / @plugin / @config itself.
+            guardStylesheetInputsPlugin(boundary),
+            guardImportMetaUrlPlugin(boundary),
             artifactSdkVirtualModule(),
             atlasUiCssResolverPlugin({
                 atlasUiDir: selectedAtlasUiDir,

package/dist/cli-content-readers.d.ts

@@ -0,0 +1,8 @@
+/** Public CLI for reviewed target bindings; never creates provider registrations. */
+export declare function runContentReadersCommand(input: {
+    action: string;
+    projectId?: string | true;
+    file?: string | true;
+    baseUrl: string;
+    token: string;
+}): Promise<number>;

package/dist/cli-content-readers.js

@@ -0,0 +1,28 @@
+import { readFile, stat } from 'node:fs/promises';
+import { z } from 'zod';
+import { getJson, putJson } from './api.js';
+const bindings = z.record(z.string().regex(/^[a-z][a-z0-9-]{0,62}$/), z.strictObject({ enabled: z.boolean(), revision: z.string().regex(/^[a-f0-9]{64}$/) }))
+    .refine(value => Object.keys(value).length >= 1 && Object.keys(value).length <= 16);
+/** Public CLI for reviewed target bindings; never creates provider registrations. */
+export async function runContentReadersCommand(input) {
+    const projectId = z.uuid().parse(input.projectId);
+    if (input.action !== 'show' && input.action !== 'apply')
+        throw new Error('content-readers requires show or apply');
+    if (input.action === 'show' && input.file !== undefined)
+        throw new Error('show does not accept --file');
+    const path = `/api/artifact-studio/projects/${projectId}/next/content-readers`;
+    if (input.action === 'show') {
+        console.log(JSON.stringify(await getJson({ baseUrl: input.baseUrl, token: input.token, path }), null, 2));
+        return 0;
+    }
+    if (typeof input.file !== 'string' || !input.file)
+        throw new Error('apply requires --file with reviewed bindings');
+    if ((await stat(input.file)).size > 65536)
+        throw new Error('Content-reader binding file exceeds 64 KiB');
+    const raw = await readFile(input.file, 'utf8');
+    if (Buffer.byteLength(raw) > 65536)
+        throw new Error('Content-reader binding file exceeds 64 KiB');
+    const body = bindings.parse(JSON.parse(raw));
+    console.log(JSON.stringify(await putJson({ baseUrl: input.baseUrl, token: input.token, path, body }), null, 2));
+    return 0;
+}

package/dist/cli.d.ts

@@ -39,5 +39,6 @@ export interface ProvidedToken {
     authMode: SourceAuthMode;
     token: string;
 }
+export declare function setPackageInstallUnavailable(guidance: string | null): void;
 export declare function setTokenProvider(provider: ((options: TokenProviderOptions) => Promise<ProvidedToken | null>) | null): void;
 export {};