@sequenceholdings/artifact-studio 0.9.1 → 0.10.0

package/dist/repository-identity.js

@@ -0,0 +1,41 @@
+import { z } from 'zod';
+/** Internal wire contract shared by Atlas and seq-studio. Not deployment authorization. */
+export const REPOSITORY_IDENTITY_PATH = '.seq/identity.json';
+export const RepositoryIdentitySchema = z.object({
+    tenantId: z.string().max(32).regex(/^[a-z][a-z0-9]*(?:_[a-z0-9]+)*$/),
+    repositoryId: z.string().uuid(),
+    generation: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+}).strict();
+export const RepositoryReceiptSchema = z.object({
+    schemaVersion: z.literal(1),
+    identity: RepositoryIdentitySchema,
+    // Extensible, non-authoritative annotations. Never use metadata for auth or routing.
+    metadata: z.record(z.string(), z.json()).default({}),
+}).strict();
+export function parseRepositoryReceipt({ text }) {
+    if (new TextEncoder().encode(text).byteLength > 65_536)
+        throw new Error('Repository identity exceeds 64 KiB');
+    const value = JSON.parse(text);
+    const visit = (entry, depth) => {
+        if (depth > 32)
+            throw new Error('Repository identity exceeds the metadata depth limit');
+        if (entry !== null && typeof entry === 'object') {
+            for (const child of Object.values(entry))
+                visit(child, depth + 1);
+        }
+    };
+    visit(value, 0);
+    return RepositoryReceiptSchema.parse(value);
+}
+export function renderRepositoryReceipt({ identity, metadata = {} }) {
+    const text = JSON.stringify({ schemaVersion: 1, identity, metadata }, null, 2) + '\n';
+    parseRepositoryReceipt({ text });
+    return text;
+}
+export function assertRepositoryIdentity({ receipt, expected }) {
+    if (receipt.identity.tenantId !== expected.tenantId ||
+        receipt.identity.repositoryId !== expected.repositoryId ||
+        receipt.identity.generation !== expected.generation) {
+        throw new Error('Repository identity does not match the platform record; do not edit identity fields to change ownership');
+    }
+}

package/dist/runtime-contracts.d.ts

@@ -17,10 +17,7 @@ export declare const ARTIFACT_NEXT_SOURCE_LIMITS: Readonly<{
 export declare const artifactSha256DigestSchema: z.ZodString;
 /** Immutable Next deploymentId from compiled output; distinct from the Atlas activation ID. */
 export declare const artifactNextFrameworkBuildIdSchema: z.ZodString;
-/** Shared upload exclusion policy. Content scanning and filesystem containment remain separate checks. */
-export declare function isExcludedArtifactSourcePath({ path }: {
-    path: string;
-}): boolean;
+export { isExcludedArtifactSourcePath } from './source-exclusions.js';
 /** POSIX source paths only; filesystem readers must additionally reject symlink escapes. */
 export declare const artifactSourcePathSchema: z.ZodString;
 /** An exact browser origin, not a URL prefix or an allowlist wildcard. */

package/dist/runtime-contracts.js

@@ -2,6 +2,7 @@ import { z } from 'zod';
 import { ARTIFACT_NEXT_RUNTIME, artifactNextSecretNameSchema } from './manifest-next.js';
 import { MAX_STUDIO_PATH_LENGTH } from './paths.js';
 import { isLoopbackHostname } from './loopback.js';
+import { isExcludedArtifactSourcePath } from './source-exclusions.js';
 export { resolveArtifactNextImages } from './next-image-config.js';
 /** Atlas routes the gateway calls; every one authenticates the gateway itself. */
 export const ARTIFACT_NEXT_CONTROL_PATH = '/api/artifact-studio/next/control';
@@ -27,21 +28,7 @@ export const artifactSha256DigestSchema = z.string().regex(/^[a-f0-9]{64}$/, 'Ex
 export const artifactNextFrameworkBuildIdSchema = z.string().min(1).max(128).refine((value) => !/[^A-Za-z0-9_-]/.test(value), 'Expected a canonical Next.js deploymentId containing only letters, digits, underscores and hyphens');
 const imageDigestSchema = z.string().regex(/^sha256:[a-f0-9]{64}$/, 'Expected a SHA-256 image digest');
 const imageReferenceSchema = z.string().max(1024).regex(/^[a-z0-9]+(?:[.-][a-z0-9]+)*(?::[1-9][0-9]{0,4})?(?:\/[a-z0-9]+(?:[._-][a-z0-9]+)*)+@sha256:[a-f0-9]{64}$/, 'Expected a registry image reference pinned by digest');
-const excludedSourceSegments = new Set([
-    '.git', 'node_modules', '.next', '.npmrc', '.netrc', '.aws', '.ssh', '.config',
-    'dist', '.artifact-studio', '.git-credentials', '.pypirc', '.azure', '.gcloud', '.doppler',
-    '.turbo', 'coverage', '.docker', '.seq-next-output.json',
-]);
-/** Shared upload exclusion policy. Content scanning and filesystem containment remain separate checks. */
-export function isExcludedArtifactSourcePath({ path }) {
-    return path.split('/').some((segment) => {
-        const normalized = segment.toLowerCase();
-        return excludedSourceSegments.has(normalized)
-            || normalized.startsWith('.env') || normalized.startsWith('.yarnrc')
-            || /(?:^|[-_.])(?:credentials?|service[-_]?account)(?:[-_.].*)?\.json$/.test(normalized)
-            || /\.(pem|key|p12|pfx|jks)$/.test(normalized);
-    });
-}
+export { isExcludedArtifactSourcePath } from './source-exclusions.js';
 /** POSIX source paths only; filesystem readers must additionally reject symlink escapes. */
 export const artifactSourcePathSchema = z.string().min(1).max(MAX_STUDIO_PATH_LENGTH).refine((path) => {
     if (path !== path.trim() || /[\\%:\u0000-\u001f\u007f]/.test(path))

package/dist/server/api-client.d.ts

@@ -18,6 +18,7 @@ export declare function createApiClient({ mode, request, json }: {
 }): {
     request: (path: string, options?: ArtifactServerFetchOptions) => Promise<Response>;
     fetch<TBody = unknown>(path: string, options?: ArtifactServerFetchOptions): Promise<SequenceApiFetchResponse<TBody>>;
+    streamResponse(path: string, options?: ArtifactServerFetchOptions): Promise<Response>;
     stream(path: string, options?: ArtifactServerFetchOptions): Promise<ReadableStream<Uint8Array<ArrayBuffer>>>;
     get: <T = unknown>(path: string) => Promise<T>;
     post: <T = unknown>(path: string, body?: unknown) => Promise<T>;

package/dist/server/api-client.js

@@ -9,6 +9,15 @@ export function createApiClient({ mode, request, json }) {
         // Explicit caller result types match the existing browser SDK; the server validates endpoint schemas.
         return await json(operation(path, options), options.signal);
     };
+    const readableResponse = async (path, options) => {
+        // Only headers are subject to the broker answer deadline. The stream retains
+        // cancellation and server byte/deadline limits without losing response metadata.
+        const response = await request(operation(path, options), { signal: options.signal, stream: true });
+        if (!response.ok || !response.body)
+            throw await stepUpErrorFromResponse(response) ??
+                new ArtifactServerError(response.status, 'stream_unavailable', 'Atlas did not return a readable response');
+        return response;
+    };
     return {
         request: fetchResponse,
         async fetch(path, options = {}) {
@@ -21,14 +30,11 @@ export function createApiClient({ mode, request, json }) {
                     return value === null ? [] : [[key, value]];
                 })) };
         },
+        async streamResponse(path, options = {}) {
+            return readableResponse(path, options);
+        },
         async stream(path, options = {}) {
-            // A stream outlives the broker's answer deadline: only its headers must arrive in time.
-            const response = await request(operation(path, options), { signal: options.signal, stream: true });
-            if (!response.ok || !response.body) {
-                throw await stepUpErrorFromResponse(response) ??
-                    new ArtifactServerError(response.status, 'stream_unavailable', 'Atlas did not return a readable response');
-            }
-            return response.body;
+            return (await readableResponse(path, options)).body;
         },
         get: (path) => typedJson(path),
         post: (path, body) => typedJson(path, { method: 'POST', body }),

package/dist/server/group-directory.d.ts

@@ -0,0 +1,90 @@
+import { z } from 'zod';
+import { type ArtifactServerMode, type ArtifactServerRequest } from './broker-contract.js';
+declare const detail: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodNullable<z.ZodString>;
+    email: z.ZodNullable<z.ZodString>;
+    source: z.ZodString;
+    managedBy: z.ZodNullable<z.ZodString>;
+    memberCount: z.ZodNullable<z.ZodNumber>;
+    userRole: z.ZodNullable<z.ZodEnum<{
+        admin: "admin";
+        member: "member";
+    }>>;
+    members: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        sub: z.ZodNullable<z.ZodString>;
+        name: z.ZodString;
+        email: z.ZodString;
+        role: z.ZodEnum<{
+            admin: "admin";
+            member: "member";
+        }>;
+    }, z.core.$strip>>;
+    added: z.ZodOptional<z.ZodNumber>;
+    skippedExisting: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+declare const page: z.ZodObject<{
+    groups: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        description: z.ZodNullable<z.ZodString>;
+        email: z.ZodNullable<z.ZodString>;
+        source: z.ZodString;
+        managedBy: z.ZodNullable<z.ZodString>;
+        memberCount: z.ZodNullable<z.ZodNumber>;
+        userRole: z.ZodNullable<z.ZodEnum<{
+            admin: "admin";
+            member: "member";
+        }>>;
+    }, z.core.$strip>>;
+    pagination: z.ZodObject<{
+        page: z.ZodNumber;
+        limit: z.ZodNumber;
+        totalCount: z.ZodNumber;
+        totalPages: z.ZodNumber;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type ArtifactGroupDetail = z.infer<typeof detail>;
+export type ArtifactGroupDirectoryPage = z.infer<typeof page>;
+export type ArtifactGroupDirectoryQuery = {
+    page?: number;
+    limit?: number;
+    search?: string;
+    adminView?: boolean;
+};
+export type ArtifactGroupMemberChange = {
+    action: 'add';
+    members: Array<{
+        userId: string;
+        role?: 'admin' | 'member';
+    }>;
+} | {
+    action: 'remove';
+    userId: string;
+} | {
+    action: 'role';
+    userId: string;
+    role: 'admin' | 'member';
+};
+export interface ArtifactGroupDirectory {
+    /** Exact live group labels visible through membership or discoverability, without rosters. */
+    resolve(groupIds: string[]): Promise<{
+        groups: Array<{
+            id: string;
+            name: string;
+        }>;
+    }>;
+    /** Caller memberships; adminView requires platform administration. Declare POST /api/groups/directory in api.write. */
+    directory(query?: ArtifactGroupDirectoryQuery): Promise<ArtifactGroupDirectoryPage>;
+    /** Requires group membership or platform administration and api.read declaration. */
+    get(groupId: string): Promise<ArtifactGroupDetail>;
+    /** Requires group administration and the exact api.write path. App roles do not confer group authority. */
+    changeMembers(groupId: string, change: ArtifactGroupMemberChange): Promise<ArtifactGroupDetail>;
+}
+export declare function createGroupDirectory({ mode, json }: {
+    mode: ArtifactServerMode;
+    json: (operation: ArtifactServerRequest) => Promise<unknown>;
+}): ArtifactGroupDirectory;
+export {};

package/dist/server/group-directory.js

@@ -0,0 +1,17 @@
+import { z } from 'zod';
+import { artifactServerRequestSchema } from './broker-contract.js';
+import { ArtifactServerError } from './errors.js';
+const summary = z.object({ id: z.string(), name: z.string(), description: z.string().nullable(), email: z.string().nullable(), source: z.string(), managedBy: z.string().nullable(), memberCount: z.number().nullable(), userRole: z.enum(['admin', 'member']).nullable() });
+const detail = summary.extend({ members: z.array(z.object({ id: z.string(), sub: z.string().nullable(), name: z.string(), email: z.string(), role: z.enum(['admin', 'member']) })), added: z.number().optional(), skippedExisting: z.array(z.string()).optional() });
+const page = z.object({ groups: z.array(summary), pagination: z.object({ page: z.number(), limit: z.number(), totalCount: z.number(), totalPages: z.number() }) });
+export function createGroupDirectory({ mode, json }) {
+    const segment = (value) => { if (!value || value.length > 255 || /[/?#%\\]/.test(value) || value === '.' || value === '..')
+        throw new ArtifactServerError(400, 'invalid_request', 'Invalid group id'); return value; };
+    const call = async (schema, path, method, body) => {
+        const parsed = schema.safeParse(await json(artifactServerRequestSchema.parse({ operation: 'api', mode, path, method, body })));
+        if (!parsed.success)
+            throw new ArtifactServerError(502, 'invalid_response', 'Atlas returned an invalid group response');
+        return parsed.data;
+    };
+    return { resolve: groupIds => call(z.object({ groups: z.array(z.object({ id: z.string(), name: z.string() })) }), '/api/groups/resolve', 'POST', { groupIds }), directory: (query = {}) => call(page, '/api/groups/directory', 'POST', query), get: groupId => call(detail, `/api/groups/${segment(groupId)}`, 'GET'), changeMembers: (groupId, change) => call(detail, `/api/groups/${segment(groupId)}/members/change`, 'POST', change) };
+}

package/dist/server/groups.d.ts

@@ -1,3 +1,4 @@
+import { type ArtifactGroupDirectory } from './group-directory.js';
 import { type ArtifactServerMode, type ArtifactServerRequest } from './broker-contract.js';
 /** One group the signed-in user belongs to. `userRole` is `admin` when they administer it. */
 export interface ArtifactGroupMembership {
@@ -18,7 +19,7 @@ export interface ArtifactGroupMembershipsPage {
         totalPages: number;
     };
 }
-export interface ArtifactServerGroups {
+export interface ArtifactServerGroups extends ArtifactGroupDirectory {
     /**
      * The signed-in user's group memberships. Requires `server.capabilities.groups.read`.
      * Atlas decides which groups they are in; this call cannot name groups, search the directory,

package/dist/server/groups.js

@@ -1,3 +1,4 @@
+import { createGroupDirectory } from './group-directory.js';
 import { z } from 'zod';
 import { ARTIFACT_GROUP_MEMBERSHIPS_LIMIT, artifactServerRequestSchema, } from './broker-contract.js';
 import { ArtifactServerError } from './errors.js';
@@ -16,6 +17,7 @@ const membershipsPageSchema = z.object({
 }).strict();
 export function createArtifactGroupsClient({ mode, json }) {
     return {
+        ...createGroupDirectory({ mode, json }),
         async list(query = {}) {
             const parsed = membershipsPageSchema.safeParse(await json(artifactServerRequestSchema.parse({
                 operation: 'groups_memberships', mode, ...query,

package/dist/server/human-completion.d.ts

@@ -0,0 +1,44 @@
+import { z } from 'zod';
+import { type ArtifactServerMode, type ArtifactServerRequest } from './broker-contract.js';
+declare const querySchema: z.ZodObject<{
+    runId: z.ZodString;
+    stepId: z.ZodString;
+}, z.core.$strict>;
+declare const receiptSchema: z.ZodObject<{
+    runId: z.ZodString;
+    processId: z.ZodString;
+    processVersion: z.ZodString;
+    bundleHash: z.ZodString;
+    stepId: z.ZodString;
+    nodeId: z.ZodString;
+    attempt: z.ZodNumber;
+    actorSub: z.ZodString;
+    edgeId: z.ZodNullable<z.ZodString>;
+    payloadHash: z.ZodString;
+    completedAt: z.ZodString;
+}, z.core.$strict>;
+export type ArtifactHumanCompletionQuery = z.infer<typeof querySchema>;
+export type ArtifactHumanCompletion = z.infer<typeof receiptSchema>;
+/** Read verified, committed human evidence. No payload, token, or mutation is returned.
+ * Requires the API path declaration and the caller's Viewer on a declared process run. */
+export declare function createHumanCompletionReader({ mode, json }: {
+    mode: ArtifactServerMode;
+    json: (operation: ArtifactServerRequest) => Promise<unknown>;
+}): (query: ArtifactHumanCompletionQuery) => Promise<ArtifactHumanCompletion>;
+declare const continuationSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"waiting">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"terminal">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"human">;
+    stepId: z.ZodString;
+    nodeId: z.ZodString;
+    users: z.ZodArray<z.ZodString>;
+    groups: z.ZodArray<z.ZodString>;
+}, z.core.$strict>], "kind">;
+export type ArtifactHumanContinuation = z.infer<typeof continuationSchema>;
+export declare function createHumanContinuationReader({ mode, json }: {
+    mode: ArtifactServerMode;
+    json: (operation: ArtifactServerRequest) => Promise<unknown>;
+}): (query: ArtifactHumanCompletionQuery) => Promise<ArtifactHumanContinuation>;
+export {};

package/dist/server/human-completion.js

@@ -0,0 +1,38 @@
+import { z } from 'zod';
+import { artifactServerRequestSchema } from './broker-contract.js';
+import { ArtifactServerError } from './errors.js';
+const querySchema = z.object({ runId: z.string().uuid(), stepId: z.string().uuid() }).strict();
+const receiptSchema = z.object({
+    runId: z.string().uuid(), processId: z.string().min(1), processVersion: z.string().min(1), bundleHash: z.string().min(1),
+    stepId: z.string().uuid(), nodeId: z.string().min(1), attempt: z.number().int().positive(), actorSub: z.string().min(1),
+    edgeId: z.string().nullable(), payloadHash: z.string().regex(/^[a-f0-9]{64}$/), completedAt: z.string().datetime(),
+}).strict();
+/** Read verified, committed human evidence. No payload, token, or mutation is returned.
+ * Requires the API path declaration and the caller's Viewer on a declared process run. */
+export function createHumanCompletionReader({ mode, json }) {
+    return async (query) => {
+        const input = querySchema.parse(query);
+        const parsed = receiptSchema.safeParse(await json(artifactServerRequestSchema.parse({
+            operation: 'api', mode, method: 'POST', path: '/api/lattice/human-completion/read', body: input,
+        })));
+        if (!parsed.success || parsed.data.runId !== input.runId || parsed.data.stepId !== input.stepId)
+            throw new ArtifactServerError(502, 'invalid_response', 'Atlas returned invalid human completion evidence');
+        return parsed.data;
+    };
+}
+const continuationSchema = z.discriminatedUnion('kind', [
+    z.object({ kind: z.literal('waiting') }).strict(),
+    z.object({ kind: z.literal('terminal') }).strict(),
+    z.object({ kind: z.literal('human'), stepId: z.string().uuid(), nodeId: z.string().min(1), users: z.array(z.string().min(1)).max(500), groups: z.array(z.string().min(1)).max(500) }).strict(),
+]);
+export function createHumanContinuationReader({ mode, json }) {
+    return async (query) => {
+        const input = querySchema.parse(query);
+        const parsed = continuationSchema.safeParse(await json(artifactServerRequestSchema.parse({
+            operation: 'api', mode, method: 'POST', path: '/api/lattice/human-continuation/read', body: input,
+        })));
+        if (!parsed.success || (parsed.data.kind === 'human' && parsed.data.stepId === input.stepId))
+            throw new ArtifactServerError(502, 'invalid_response', 'Atlas returned invalid human continuation evidence');
+        return parsed.data;
+    };
+}

package/dist/server/processes.d.ts

@@ -1,3 +1,5 @@
+import { type ArtifactHumanContinuation, type ArtifactHumanCompletionQuery, type ArtifactHumanCompletion } from './human-completion.js';
+import { type ArtifactGroupTasksQuery, type ArtifactGroupTasksPage, type ArtifactTaskAssignments } from './task-assignments.js';
 import { type ArtifactProcessPrincipalType, type ArtifactProcessRunStatus, type ArtifactProcessTaskView, type ArtifactServerMode, type ArtifactServerRequest } from './broker-contract.js';
 import { type ArtifactProcessRunsPage, type ArtifactProcessRunsPageQuery } from './process-runs-page.js';
 import { type ArtifactProcessPrincipals, type ArtifactProcessRunViewerChange, type ArtifactRunSharingOperations } from './process-run-sharing.js';
@@ -318,6 +320,21 @@ export interface ArtifactProcessPrincipal {
     memberCount?: number;
 }
 export interface ArtifactServerProcesses extends ArtifactRunSharingOperations {
+    /** Parked tasks and materialized assignees; run Viewer checks and declared process scopes apply. */
+    listGroupTasksPage(query: ArtifactGroupTasksQuery): Promise<ArtifactGroupTasksPage>;
+    readTaskAssignments(query: {
+        runIds: string[];
+    }): Promise<ArtifactTaskAssignments>;
+    /** Batch current definitions, each gated by process Viewer and the declared read set. */
+    describeMany(query: {
+        processes: Array<string | ArtifactProcessDescribeQuery>;
+    }): Promise<{
+        processes: Array<{
+            process: string;
+            version?: string;
+            definition: ArtifactProcessDefinition;
+        }>;
+    }>;
     /** Start a run of a process declared under `processes.start`; the user's Invoker grant decides. */
     start(input: ArtifactProcessStart): Promise<ArtifactProcessRun>;
     /** List the runs of a process declared under `processes.read` that the user may view. */
@@ -331,6 +348,8 @@ export interface ArtifactServerProcesses extends ArtifactRunSharingOperations {
     /** The user's own human steps across processes declared under `processes.read`. */
     listTasks(query?: ArtifactProcessTasksQuery): Promise<ArtifactProcessTask[]>;
     /** Complete a parked human step on a run of a process declared under `processes.act`; the user's own `advancer` grant decides. */
+    getHumanContinuation(query: ArtifactHumanCompletionQuery): Promise<ArtifactHumanContinuation>;
+    getHumanCompletion(query: ArtifactHumanCompletionQuery): Promise<ArtifactHumanCompletion>;
     advance(input: ArtifactProcessAdvance): Promise<ArtifactProcessAdvanceResult>;
     /** Reassign a parked human step; the user's `owner` relation on the run decides. */
     assign(input: ArtifactProcessAssign): Promise<ArtifactProcessAssignResult>;

package/dist/server/processes.js

@@ -1,3 +1,5 @@
+import { createHumanCompletionReader, createHumanContinuationReader } from './human-completion.js';
+import { createTaskAssignmentsReader, createGroupTasksReader } from './task-assignments.js';
 import { artifactServerRequestSchema, } from './broker-contract.js';
 import { ArtifactServerError } from './errors.js';
 import { readArtifactProcessRunsPage } from './process-runs-page.js';
@@ -5,6 +7,13 @@ import { createArtifactProcessSharingClient } from './process-run-sharing.js';
 /** `client.processes`: Lattice through the broker's typed `lattice*` operations. Atlas owns validation and redaction. */
 export function createArtifactProcessesClient({ mode, json }) {
     return {
+        listGroupTasksPage: createGroupTasksReader({ mode, json }),
+        readTaskAssignments: createTaskAssignmentsReader({ mode, json }),
+        describeMany: async ({ processes }) => {
+            if (!processes.length || processes.length > 50 || processes.some(value => { const id = typeof value === 'string' ? value : value.process; return !id || id.length > 255 || (typeof value !== 'string' && value.version !== undefined && (!value.version || value.version.length > 255)); }))
+                throw new ArtifactServerError(400, 'invalid_request', 'Expected between one and fifty process IDs');
+            return await json(artifactServerRequestSchema.parse({ operation: 'api', mode, method: 'POST', path: '/api/lattice/process-definitions/read', body: { processes } }));
+        },
         start: async ({ process, ...run }) => {
             // Atlas returns the started run's identifiers; the shape is the Lattice start response.
             return await json(artifactServerRequestSchema.parse({ operation: 'lattice', mode, process, ...run }));
@@ -32,6 +41,8 @@ export function createArtifactProcessesClient({ mode, json }) {
                 throw new ArtifactServerError(502, 'malformed_response', 'Atlas returned a malformed task list');
             return body.items;
         },
+        getHumanContinuation: createHumanContinuationReader({ mode, json }),
+        getHumanCompletion: createHumanCompletionReader({ mode, json }),
         advance: async (input) => {
             // The Lattice advance response; Atlas owns the step resolution, the ACL and the walk.
             return await json(artifactServerRequestSchema.parse({ operation: 'lattice_advance', mode, ...input }));

package/dist/server/task-assignments.d.ts

@@ -0,0 +1,81 @@
+import { z } from 'zod';
+import { type ArtifactServerMode, type ArtifactServerRequest } from './broker-contract.js';
+declare const result: z.ZodObject<{
+    runs: z.ZodArray<z.ZodObject<{
+        runId: z.ZodString;
+        processId: z.ZodString;
+        truncated: z.ZodBoolean;
+        tasks: z.ZodArray<z.ZodObject<{
+            stepId: z.ZodString;
+            nodeId: z.ZodString;
+            startedAt: z.ZodString;
+            dueAt: z.ZodNullable<z.ZodString>;
+            users: z.ZodArray<z.ZodObject<{
+                type: z.ZodEnum<{
+                    user: "user";
+                    group: "group";
+                }>;
+                id: z.ZodString;
+                name: z.ZodString;
+                email: z.ZodOptional<z.ZodString>;
+                picture: z.ZodOptional<z.ZodString>;
+                memberCount: z.ZodOptional<z.ZodNumber>;
+                unavailable: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strip>>;
+            groups: z.ZodArray<z.ZodObject<{
+                type: z.ZodEnum<{
+                    user: "user";
+                    group: "group";
+                }>;
+                id: z.ZodString;
+                name: z.ZodString;
+                email: z.ZodOptional<z.ZodString>;
+                picture: z.ZodOptional<z.ZodString>;
+                memberCount: z.ZodOptional<z.ZodNumber>;
+                unavailable: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ArtifactTaskAssignments = z.infer<typeof result>;
+/** Read at most fifty runs' parked assignments. Requires api.write path declaration and processes.read; every run must be viewable. */
+export declare function createTaskAssignmentsReader({ mode, json }: {
+    mode: ArtifactServerMode;
+    json: (operation: ArtifactServerRequest) => Promise<unknown>;
+}): ({ runIds }: {
+    runIds: string[];
+}) => Promise<ArtifactTaskAssignments>;
+declare const groupTaskQuery: z.ZodObject<{
+    groupId: z.ZodString;
+    processes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    limit: z.ZodOptional<z.ZodNumber>;
+    cursor: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+declare const groupTaskPage: z.ZodObject<{
+    tasks: z.ZodArray<z.ZodObject<{
+        stepId: z.ZodString;
+        runId: z.ZodString;
+        nodeId: z.ZodString;
+        processId: z.ZodString;
+        processVersion: z.ZodString;
+        title: z.ZodNullable<z.ZodString>;
+        entity: z.ZodNullable<z.ZodObject<{
+            type: z.ZodString;
+            id: z.ZodString;
+        }, z.core.$strip>>;
+        startedAt: z.ZodString;
+        dueAt: z.ZodNullable<z.ZodString>;
+        users: z.ZodArray<z.ZodString>;
+        memberUsers: z.ZodArray<z.ZodString>;
+        groups: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    nextCursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type ArtifactGroupTasksQuery = z.infer<typeof groupTaskQuery>;
+export type ArtifactGroupTasksPage = z.infer<typeof groupTaskPage>;
+/** Group membership and each run's Viewer scope are checked before paging. */
+export declare function createGroupTasksReader({ mode, json }: {
+    mode: ArtifactServerMode;
+    json: (operation: ArtifactServerRequest) => Promise<unknown>;
+}): (query: ArtifactGroupTasksQuery) => Promise<ArtifactGroupTasksPage>;
+export {};

package/dist/server/task-assignments.js

@@ -0,0 +1,26 @@
+import { z } from 'zod';
+import { artifactServerRequestSchema } from './broker-contract.js';
+import { ArtifactServerError } from './errors.js';
+const principal = z.object({ type: z.enum(['user', 'group']), id: z.string(), name: z.string(), email: z.string().optional(), picture: z.string().optional(), memberCount: z.number().optional(), unavailable: z.boolean().optional() });
+const result = z.object({ runs: z.array(z.object({ runId: z.string(), processId: z.string(), truncated: z.boolean(), tasks: z.array(z.object({ stepId: z.string(), nodeId: z.string(), startedAt: z.string(), dueAt: z.string().nullable(), users: z.array(principal), groups: z.array(principal) })) })) });
+/** Read at most fifty runs' parked assignments. Requires api.write path declaration and processes.read; every run must be viewable. */
+export function createTaskAssignmentsReader({ mode, json }) {
+    return async ({ runIds }) => {
+        const input = z.array(z.string().uuid()).min(1).max(50).parse(runIds);
+        const parsed = result.safeParse(await json(artifactServerRequestSchema.parse({ operation: 'api', mode, method: 'POST', path: '/api/lattice/task-assignments/read', body: { runIds: input } })));
+        if (!parsed.success)
+            throw new ArtifactServerError(502, 'invalid_response', 'Atlas returned invalid task assignments');
+        return parsed.data;
+    };
+}
+const groupTaskQuery = z.object({ groupId: z.string().min(1).max(255), processes: z.array(z.string().min(1).max(255)).min(1).max(200).optional(), limit: z.number().int().min(1).max(100).optional(), cursor: z.string().max(2048).optional() }).strict();
+const groupTaskPage = z.object({ tasks: z.array(z.object({ stepId: z.string(), runId: z.string(), nodeId: z.string(), processId: z.string(), processVersion: z.string(), title: z.string().nullable(), entity: z.object({ type: z.string(), id: z.string() }).nullable(), startedAt: z.string(), dueAt: z.string().nullable(), users: z.array(z.string()), memberUsers: z.array(z.string()), groups: z.array(z.string()) })), nextCursor: z.string().nullable() });
+/** Group membership and each run's Viewer scope are checked before paging. */
+export function createGroupTasksReader({ mode, json }) {
+    return async (query) => {
+        const parsed = groupTaskPage.safeParse(await json(artifactServerRequestSchema.parse({ operation: 'api', mode, method: 'POST', path: '/api/lattice/group-tasks/read', body: groupTaskQuery.parse(query) })));
+        if (!parsed.success)
+            throw new ArtifactServerError(502, 'invalid_response', 'Atlas returned an invalid group task page');
+        return parsed.data;
+    };
+}

package/dist/server.d.ts

@@ -16,3 +16,7 @@ export { externalEvidence } from './server/principal.js';
 export type { ArtifactExternalEvidence, ArtifactExternalPrincipal, ArtifactPrincipal } from './server/principal.js';
 export type { ArtifactLogMetadata, ArtifactLogRecord } from './server/logger.js';
 export type { ArtifactOrmJsonScalars } from './orm-json-scalars.js';
+export type { ArtifactGroupDetail, ArtifactGroupDirectoryPage, ArtifactGroupDirectoryQuery, ArtifactGroupMemberChange } from './server/group-directory.js';
+export type { ArtifactTaskAssignments } from './server/task-assignments.js';
+export type { ArtifactGroupTasksQuery, ArtifactGroupTasksPage } from './server/task-assignments.js';
+export type { ArtifactHumanCompletionQuery, ArtifactHumanCompletion, ArtifactHumanContinuation } from './server/human-completion.js';

package/dist/source-boundary.d.ts

@@ -4,16 +4,37 @@ export interface ArtifactSourceBoundaryOptions {
     trustedExternalRoots: readonly string[];
 }
 /**
- * Artifact source must be self-contained: allowing a relative import to escape
- * the build root would let uncommitted files elsewhere in a containing
- * checkout enter the official bundle without being covered by its dirty bit.
- * Published dependencies and the CLI-pinned platform peers are intentionally
- * allowed because they are external to the artifact by design.
+ * Which files may feed an artifact build. Artifact source must be
+ * self-contained: a relative path that escapes the build root would let files
+ * elsewhere on the build machine (uncommitted checkout files, or the caller's
+ * credentials) enter the official bundle. Published dependencies and the
+ * CLI-pinned platform peers are intentionally allowed because they are external
+ * to the artifact by design.
  */
-export declare function rejectOutsideSourcePlugin({ root, trustedExternalRoots, }: ArtifactSourceBoundaryOptions): Plugin;
+export interface SourceBoundary {
+    /** Physical source root. */
+    root: string;
+    /**
+     * Throw unless `filePath` may enter the build when `importer` references it.
+     * `bareSpecifier` marks a package reference rather than a path. Paths are
+     * compared physically, so an in-root symlink cannot admit an outside file.
+     */
+    assertBuildInput(input: {
+        filePath: string;
+        importer?: string;
+        bareSpecifier: boolean;
+        reference: string;
+    }): void;
+    /** Whether `filePath` is part of the CLI-pinned platform toolchain. */
+    isTrusted(filePath: string): boolean;
+}
+export declare function createSourceBoundary({ root, trustedExternalRoots }: ArtifactSourceBoundaryOptions): SourceBoundary;
+/** Reject module imports that resolve outside the source boundary. */
+export declare function rejectOutsideSourcePlugin(boundary: SourceBoundary): Plugin;
 /**
  * Whether `filePath` is inside a `node_modules` directory. Bundlers pass
  * Windows paths with forward slashes, so compare in that form whatever the
  * platform separator is.
  */
 export declare function isNodeModulesPath(filePath: string): boolean;
+export declare function isBareImport(source: string): boolean;