@sequenceholdings/artifact-studio 0.9.1 → 0.10.0

package/dist/source-boundary.js

@@ -1,15 +1,46 @@
 import { realpathSync } from 'node:fs';
-import { isAbsolute, relative, resolve, sep } from 'node:path';
-/**
- * Artifact source must be self-contained: allowing a relative import to escape
- * the build root would let uncommitted files elsewhere in a containing
- * checkout enter the official bundle without being covered by its dirty bit.
- * Published dependencies and the CLI-pinned platform peers are intentionally
- * allowed because they are external to the artifact by design.
- */
-export function rejectOutsideSourcePlugin({ root, trustedExternalRoots, }) {
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+export function createSourceBoundary({ root, trustedExternalRoots }) {
     const rootResolved = realpathSync(resolve(root));
     const trustedRoots = trustedExternalRoots.map((trustedRoot) => realpathSync(resolve(trustedRoot)));
+    const isTrusted = (filePath) => isTrustedExternalPath(physicalPath(filePath), trustedRoots);
+    return {
+        root: rootResolved,
+        isTrusted,
+        assertBuildInput({ filePath, importer, bareSpecifier, reference }) {
+            const realFilePath = physicalPath(filePath);
+            if (isPathWithin(rootResolved, realFilePath))
+                return;
+            const importerPath = importer?.split('?')[0];
+            const importerIsTrustedExternal = importerPath != null &&
+                (isNodeModulesPath(importerPath) || (isAbsolute(importerPath) && isTrusted(importerPath)));
+            if (isNodeModulesPath(filePath) && (bareSpecifier || importerIsTrustedExternal))
+                return;
+            if (isTrustedExternalPath(realFilePath, trustedRoots))
+                return;
+            const from = importerPath ? ` (referenced from ${relative(rootResolved, importerPath)})` : '';
+            throw new Error(`Artifact ${reference} "${filePath}" resolves outside artifact source directory ` +
+                `"${rootResolved}"${from}. Keep relative build inputs inside the artifact ` +
+                'source directory or publish shared code as a dependency.');
+        },
+    };
+}
+/**
+ * The realpath of `filePath`, or of its deepest existing ancestor joined with
+ * the rest, so a reference to a file that does not exist yet is still compared
+ * physically.
+ */
+function physicalPath(filePath) {
+    try {
+        return realpathSync(filePath);
+    }
+    catch {
+        const parent = dirname(filePath);
+        return parent === filePath ? filePath : join(physicalPath(parent), basename(filePath));
+    }
+}
+/** Reject module imports that resolve outside the source boundary. */
+export function rejectOutsideSourcePlugin(boundary) {
     return {
         name: 'reject-artifact-outside-source',
         enforce: 'pre',
@@ -21,26 +52,9 @@ export function rejectOutsideSourcePlugin({ root, trustedExternalRoots, }) {
             if (!isAbsolute(filePath))
                 return resolved;
             // Vite may return a physical path for a root reached through /tmp or
-            // another symlink. Check physical paths on both sides of the boundary;
-            // this also prevents an in-root symlink from admitting an outside file.
-            const realFilePath = realpathSync(filePath);
-            if (isPathWithin(rootResolved, realFilePath))
-                return resolved;
-            const importerPath = importer?.split('?')[0];
-            const importerIsTrustedExternal = importerPath != null &&
-                (isNodeModulesPath(importerPath) ||
-                    (isAbsolute(importerPath) && isTrustedExternalPath(realpathSync(importerPath), trustedRoots)));
-            if (isNodeModulesPath(filePath) && (isBareImport(source) || importerIsTrustedExternal)) {
-                return resolved;
-            }
-            if (isTrustedExternalPath(realFilePath, trustedRoots))
-                return resolved;
-            const from = importer
-                ? ` (imported from ${relative(rootResolved, importer.split('?')[0])})`
-                : '';
-            throw new Error(`Artifact import "${filePath}" resolves outside artifact source directory ` +
-                `"${rootResolved}"${from}. Keep relative build inputs inside the artifact ` +
-                'source directory or publish shared code as a dependency.');
+            // another symlink; the boundary compares physical paths on both sides.
+            boundary.assertBuildInput({ filePath, importer, bareSpecifier: isBareImport(source), reference: 'import' });
+            return resolved;
         },
     };
 }
@@ -62,6 +76,6 @@ function isTrustedExternalPath(filePath, trustedRoots) {
 export function isNodeModulesPath(filePath) {
     return filePath.replaceAll('\\', '/').includes('/node_modules/');
 }
-function isBareImport(source) {
+export function isBareImport(source) {
     return !source.startsWith('.') && !isAbsolute(source);
 }

package/dist/source-exclusions.d.ts

@@ -0,0 +1,4 @@
+/** Shared upload exclusion policy. Content scanning and filesystem containment remain separate checks. */
+export declare function isExcludedArtifactSourcePath({ path }: {
+    path: string;
+}): boolean;

package/dist/source-exclusions.js

@@ -0,0 +1,16 @@
+/** Leaf module (no imports) so manifest and source-include validation can share it without a cycle. */
+const excludedSourceSegments = new Set([
+    '.git', 'node_modules', '.next', '.npmrc', '.netrc', '.aws', '.ssh', '.config',
+    'dist', '.artifact-studio', '.git-credentials', '.pypirc', '.azure', '.gcloud', '.doppler',
+    '.turbo', 'coverage', '.docker', '.seq-next-output.json',
+]);
+/** Shared upload exclusion policy. Content scanning and filesystem containment remain separate checks. */
+export function isExcludedArtifactSourcePath({ path }) {
+    return path.split('/').some((segment) => {
+        const normalized = segment.toLowerCase();
+        return excludedSourceSegments.has(normalized)
+            || normalized.startsWith('.env') || normalized.startsWith('.yarnrc')
+            || /(?:^|[-_.])(?:credentials?|service[-_]?account)(?:[-_.].*)?\.json$/.test(normalized)
+            || /\.(pem|key|p12|pfx|jks)$/.test(normalized);
+    });
+}

package/dist/source-resolver.js

@@ -4,7 +4,7 @@ import { mkdtemp, realpath, rm, stat } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { createScrubbedChildEnv } from './child-environment.js';
-import { materializeRepo, resolveCommitSha, resolveRepo } from './git-service-client.js';
+import { checkRepositoryDeploymentIdentity, materializeRepo, resolveCommitSha, resolveRepo } from './git-service-client.js';
 import { gitServiceCloneUrl, runGitClone } from './git-clone.js';
 /** True for sources that must be fetched from a remote (git-service / git-url). */
 export function isRemoteSpec(spec) {
@@ -126,6 +126,7 @@ export async function resolveArtifactSource(spec, opts = {}) {
             const repo = await resolveRepo({ baseUrl: opts.baseUrl, token: opts.token, namespace: spec.namespace, name: spec.name });
             const ref = spec.ref ?? repo.defaultBranch;
             const sha = await resolveCommitSha({ baseUrl: opts.baseUrl, token: opts.token, repoId: repo.id, ref });
+            await checkRepositoryDeploymentIdentity({ baseUrl: opts.baseUrl, token: opts.token, repoId: repo.id, commit: sha });
             // CI/system path: the trusted M2M service account can't own a PAT (PAT
             // issuance is gated on a human Auth0 user row), so it keeps the JSON
             // materialize path it has always used, authenticated by its M2M token.

package/dist/templates/react-vite/package.json

@@ -10,7 +10,7 @@
   },
   "dependencies": {},
   "devDependencies": {
-    "@sequenceholdings/artifact-studio": "^0.9.0",
+    "@sequenceholdings/artifact-studio": "^0.10.0",
     "@sequenceholdings/atlas-ui": "^3.1.1",
     "@tailwindcss/postcss": "^4.2.2",
     "@tailwindcss/vite": "^4.2.2",

package/package.json

@@ -9,7 +9,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.9.1",
+  "version": "0.10.0",
   "description": "SDK types and CLI library for building Artifact Studio apps. Driven via `seq-studio artifact <sub>` (@sequenceholdings/studio-cli), which runs the `./cli` runCli export.",
   "type": "module",
   "exports": {
@@ -33,6 +33,10 @@
       "types": "./dist/git-service-client.d.ts",
       "default": "./dist/git-service-client.js"
     },
+    "./repository-identity": {
+      "types": "./dist/repository-identity.d.ts",
+      "default": "./dist/repository-identity.js"
+    },
     "./git-clone": {
       "types": "./dist/git-clone.d.ts",
       "default": "./dist/git-clone.js"
@@ -169,7 +173,7 @@
     "parse5": "7.3.0",
     "@sequenceholdings/lattice-form-renderer": "0.2.0",
     "@sequenceholdings/storage": "0.1.2",
-    "@sequenceholdings/orm": "2.6.2"
+    "@sequenceholdings/orm": "2.7.0"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",

package/templates/react-vite/package.json

@@ -10,7 +10,7 @@
   },
   "dependencies": {},
   "devDependencies": {
-    "@sequenceholdings/artifact-studio": "^0.9.0",
+    "@sequenceholdings/artifact-studio": "^0.10.0",
     "@sequenceholdings/atlas-ui": "^3.1.1",
     "@tailwindcss/postcss": "^4.2.2",
     "@tailwindcss/vite": "^4.2.2",

package/dist/env-binding-scan.js

@@ -1,179 +0,0 @@
-import yaml from 'js-yaml';
-const UUID_SOURCE = '[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}';
-const SCANNED_EXTENSIONS = new Set(['.ts', '.tsx', '.mts', '.cts', '.js', '.jsx', '.mjs', '.cjs', '.json', '.yml', '.yaml']);
-export function originsDeclaredInFiles(files) {
-    const origins = [];
-    for (const file of files) {
-        if (file.encoding === 'base64' || basename(file.path) !== 'artifact.bundle.yml')
-            continue;
-        for (const [name, url] of Object.entries(declaredTargets(file.content))) {
-            try {
-                origins.push({ name, origin: new URL(url).origin.toLowerCase() });
-            }
-            catch {
-                // A target that is not a URL is reported when the selected environment is checked.
-            }
-        }
-    }
-    return origins;
-}
-export function declaredTargets(content) {
-    let parsed;
-    try {
-        parsed = yaml.load(content);
-    }
-    catch {
-        return {};
-    }
-    if (!parsed || typeof parsed !== 'object' || !('targets' in parsed))
-        return {};
-    const targets = parsed.targets;
-    if (!targets || typeof targets !== 'object')
-        return {};
-    const urls = {};
-    for (const [name, value] of Object.entries(targets)) {
-        if (value && typeof value === 'object' && 'url' in value && typeof value.url === 'string')
-            urls[name] = value.url;
-    }
-    return urls;
-}
-export function contentContainsOrigin(content, origin, skippedLines) {
-    const haystack = content.toLowerCase();
-    const needle = origin.toLowerCase();
-    let from = 0;
-    while (from < haystack.length) {
-        const at = haystack.indexOf(needle, from);
-        if (at < 0)
-            return false;
-        const next = haystack[at + needle.length];
-        const line = haystack.slice(0, at).split('\n').length - 1;
-        if (!skippedLines.has(line) && (next === undefined || !/[a-z0-9.-]/.test(next)))
-            return true;
-        from = at + needle.length;
-    }
-    return false;
-}
-/** Manifest text with the root `targets` map removed, so its URLs are declarations. */
-export function contentOutsideTargets(content) {
-    let parsed;
-    try {
-        parsed = yaml.load(content);
-    }
-    catch {
-        return content;
-    }
-    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed) || !('targets' in parsed))
-        return content;
-    const rest = {};
-    for (const [key, value] of Object.entries(parsed)) {
-        if (key !== 'targets')
-            rest[key] = value;
-    }
-    return yaml.dump(rest, { lineWidth: -1 });
-}
-export function collectWorkspaceSlotIds(files) {
-    const ids = new Set();
-    for (const file of files) {
-        if (!scannable(file))
-            continue;
-        for (const workspaceId of workspaceSlotIds(file))
-            ids.add(workspaceId);
-    }
-    return [...ids];
-}
-export function workspaceSlotIds(file) {
-    const ids = new Set();
-    if (file.path.endsWith('.yml') || file.path.endsWith('.yaml'))
-        collectYamlWorkspaceIds(file.content, ids);
-    const marker = /workspace/gi;
-    let match;
-    while ((match = marker.exec(file.content))) {
-        const region = workspaceExpression(file.content, match.index);
-        for (const id of region.matchAll(new RegExp(UUID_SOURCE, 'gi')))
-            ids.add(id[0].toLowerCase());
-    }
-    return [...ids];
-}
-function workspaceExpression(content, start) {
-    let depth = 0;
-    let quote;
-    const limit = Math.min(content.length, start + 500);
-    for (let index = start; index < limit; index += 1) {
-        const char = content[index] ?? '';
-        const step = stepExpression({ char, depth, quote });
-        depth = step.depth;
-        quote = step.quote;
-        if (step.skip) {
-            index += 1;
-            continue;
-        }
-        if (step.done)
-            return content.slice(start, index);
-        if (char === '\n' && depth === 0 && expressionEnds(content.slice(index + 1))) {
-            return content.slice(start, index);
-        }
-    }
-    return content.slice(start, limit);
-}
-function stepExpression({ char, depth, quote }) {
-    if (quote) {
-        if (char === '\\')
-            return { depth, quote, skip: true };
-        return { depth, quote: char === quote ? undefined : quote };
-    }
-    if (char === '"' || char === "'" || char === '`')
-        return { depth, quote: char };
-    if (char === '(' || char === '[' || char === '{')
-        return { depth: depth + 1, quote };
-    if (char === ')' || char === ']' || char === '}')
-        return { depth: Math.max(0, depth - 1), quote };
-    if (char === ';' && depth === 0)
-        return { depth, quote, done: true };
-    return { depth, quote };
-}
-function expressionEnds(rest) {
-    const next = rest.split('\n')[0] ?? '';
-    return next.trim() === '' || (!/^[ \t]/.test(next) && !/^[)\]},.]/.test(next.trimStart()));
-}
-export function scannable(file) {
-    if (file.encoding === 'base64')
-        return false;
-    const name = basename(file.path);
-    if (name === 'pnpm-lock.yaml' || name === 'package-lock.json' || name === 'yarn.lock' || name.endsWith('.md'))
-        return false;
-    if (name === '.env')
-        return true;
-    const extension = name.includes('.') ? name.slice(name.lastIndexOf('.')) : '';
-    return SCANNED_EXTENSIONS.has(extension);
-}
-export function basename(path) {
-    const parts = path.split('/');
-    return parts[parts.length - 1] ?? path;
-}
-function collectYamlWorkspaceIds(content, ids) {
-    let parsed;
-    try {
-        parsed = yaml.load(content);
-    }
-    catch {
-        return;
-    }
-    walkYaml(parsed, null, ids);
-}
-function walkYaml(node, parentKey, ids) {
-    if (!node || typeof node !== 'object')
-        return;
-    if (Array.isArray(node)) {
-        for (const item of node)
-            walkYaml(item, parentKey, ids);
-        return;
-    }
-    for (const [key, value] of Object.entries(node)) {
-        if (parentKey === 'storage' && new RegExp(`^${UUID_SOURCE}$`, 'i').test(key))
-            ids.add(key.toLowerCase());
-        if (/workspace/i.test(key) && typeof value === 'string' && new RegExp(`^${UUID_SOURCE}$`, 'i').test(value)) {
-            ids.add(value.toLowerCase());
-        }
-        walkYaml(value, key, ids);
-    }
-}