@sequenceholdings/artifact-studio 0.9.2 → 0.10.1

package/README.md

@@ -475,6 +475,13 @@ const body = await client.api.stream('/api/agents/chat', {
 return new Response(body, { headers: { 'content-type': 'text/event-stream' } })
 ```
 
+`client.api.streamResponse(path, options)` uses the same streaming transport and
+returns the full `Response`, retaining the broker-approved content type, length,
+and download filename. It does not buffer the body. Forward `request.signal` to
+cancel upstream work when the user disconnects. Governed content readers impose
+their own stricter byte and whole-stream deadlines; this method does not extend
+them. The method is prepared for 0.10.0 and awaits publication.
+
 ## Grouping calls into a trace
 
 The Artifact host supplies tracing context automatically for supported platform
@@ -514,3 +521,215 @@ Upload with `api.upload` option `{ fieldName: 'audio' }`; ordinary uploads still
 default to `file`. Atlas transcription trims silence by default; multipart
 `trimSilence=false` opts out. Speech uses the declared host paths without requiring
 the separate general Next host API rollout flag.
+
+## Next.js task completion and app navigation access (awaiting publication)
+
+These methods require the matching Atlas host deployment. The SDK conveniences
+are prepared for Artifact Studio 0.10.0; source availability does not mean the
+package has been published.
+
+```ts
+const appAccess = await bridge.auth.getAppAccess()
+// Show links only when the destination's value is true. This is a UI hint;
+// the destination still authorizes the user independently.
+
+// After your app-owned route successfully advances its native process step:
+const { notified } = await bridge.lattice.notifyAdvance()
+// false means the server has not yet completed this human step. Retry this
+// read after the accepted transition settles; never replay the mutation.
+```
+
+`auth.getAppAccess` reads only the current viewer's boolean navigation map from
+one fixed, authenticated host endpoint. It accepts no principal or URL,
+requires no arbitrary `capabilities.api` declaration, and does not depend on
+`artifact-next-browser-api`. Missing or malformed permission responses fail
+closed. The generic bridge equivalent is
+`bridge.request({ method: 'auth.getAppAccess' })`.
+
+`lattice.notifyAdvance` accepts no run or step arguments. The host uses its own
+trusted embed context and checks the native authorized run snapshot. Only the
+exact completed human step produces an advance notification; pending, failed,
+replaced or unauthorized tasks cannot. Repeated notifications are deduplicated
+for that host instance. It never advances a process or changes assignments.
+An app can call it before submitting as a host-support check: a parked step
+returns `{ notified: false }`; an old host rejects the method. The generic
+bridge equivalent is `bridge.request({ method: 'lattice.notifyAdvance' })`.
+Applications outside a task embed have no completion context and cannot use it.
+
+
+### Bounded lifecycle reads and group management discovery
+
+A server application can read exact run lifecycles in batches of at most 500
+through `api.post('/api/lattice/runs/read', { runIds })`. Declare that POST path
+under `server.capabilities.api.write` and each process under `processes.read`.
+The adapter has no write effects. It requires the signed-in user, a declared
+process (including development bindings), and Viewer on every run before
+returning any result. Missing or denied runs fail the entire batch. Results
+contain only `id`, `processId`, `status`, `startedAt`, `completedAt`, and
+`archivedAt`; no process metadata, step context, or credentials are exposed.
+
+The authorized group directory and detail responses include `canManage`,
+derived from existing group administration or platform administration, and
+`externalId`. Applications cannot confer group authority through their own
+roles. `POST /api/groups/directory` accepts `manageableOnly: true`; it uses all
+groups only for a verified platform administrator, and otherwise filters the
+caller's existing accessible pages. In that mode the response is
+`{ groups, nextPage: number | null }`, with no filtered-count claim. Follow
+`nextPage` even when a page is empty. This read grants no memberships and changes no group.
+
+### Recoverable group task assignment
+
+Human callers can use these declared `server.capabilities.api.write` adapters:
+
+- `POST /api/lattice/group-task-assignment/prepare`: `{groupId, runId, stepId,
+  targetSub}` returns `{runId, stepId, nodeId, processId, processVersion,
+  expectedAssignmentToken, intentId, preparationProof}`. The server mints the
+  intent UUID. The signed proof binds the exact caller, project, group, command,
+  pinned process/step and actual SQL environment. The application must declare `processes.act` for
+  the mapped process and `groups.read`. The caller must independently administer
+  the live group and hold run Viewer. The task must be parked and unsubmitted,
+  currently assigned to that group or a member, and the target must be an active
+  group member permitted by the run's pinned node allowlist. Application roles
+  do not grant group administration.
+- `POST /api/lattice/group-task-assignment/commit`: the same fields plus
+  `{intentId, expectedAssignmentToken, preparationProof}` return `{receipt}`. The UUID intent is
+  unique within the project. Native assignment, its authorization outbox, and
+  the immutable `applied` receipt commit in one transaction. Reusing an intent
+  with different actor, run, step, target, or token returns 409; an exact retry
+  never reapplies an old assignment.
+- `POST /api/lattice/group-task-assignment/cancel`: the commit body returns the
+  stable receipt. Cancellation and commit serialize on the same intent key.
+  A `cancelled` receipt prevents any later assignment; an already `applied`
+  receipt is returned unchanged. Current group authority and run Viewer remain
+  required, but a disabled target or completed task does not prevent cancellation.
+- `POST /api/lattice/group-task-assignment/receipt`: `{runId, intentId}` returns
+  `{receipt: object | null}` under the project's exact identity, declared
+  `processes.read`, and current run Viewer. It never returns another project's
+  receipt or exposes task state, context, or wait credentials.
+
+A receipt contains project/intent/run/step/node identities, actor, principals,
+`outcome: applied | cancelled`, and `committedAt`. Its timestamp is the database
+transaction timestamp; the receipt becomes visible only after commit. A null
+receipt is **not** proof that a command cannot still apply. App-owned ownership
+reservations must finalize on `applied` and release only on `cancelled`. They
+must not expire an ambiguous reservation or issue another intent as a retry.
+The preparation proof has no expiry and grants no permission by itself. Signing
+key rotation requires explicit operator recovery for pending commands. If the
+caller loses group authority, recovery needs an explicitly authorized
+operator; these endpoints never impersonate the original caller. The first
+release provides caller-driven recovery, not a background service reconciler.
+
+Deployment requires the host adapters and the journaled assignment receipt
+migration. The app's ownership transaction and notification outbox remain
+application-owned and require their own reviewed service grants.
+
+`client.processes.getHumanCompletion({ runId, stepId })` reads a committed,
+server-verified human completion receipt. Declare the exact
+`/api/lattice/human-completion/read` path under `server.capabilities.api.write`
+(the POST carries a body but has no write effects), plus the process under
+`processes.read`. Only a verified human caller with current Run Viewer access can
+read it. The result binds actor, immutable process version/bundle, exact step
+attempt, edge and canonical payload hash; it never returns the payload, signing
+token or wait credentials. The payload hash covers canonical JSON of the actual
+submitted payload, including the server-stamped `advanced_by`, excluding the
+reserved `_sequence_human_completion` receipt key. HTTP409
+`HUMAN_COMPLETION_UNAVAILABLE` means no verified committed evidence is available;
+it is not permission to replay a mutation. This method does not establish a
+successor step or grant authority to assign one. The same adapter is callable
+through `client.api.post` by earlier SDK clients, once the target platform release
+is active. Policy-backed application writes still independently require the
+reviewed ORM runtime capability and admission checks.
+
+`client.processes.getHumanContinuation({ runId, stepId })` uses the corresponding
+`/api/lattice/human-continuation/read` POST adapter with the same caller and process
+read permissions. It returns `waiting`, `terminal`, or the first still-parked human
+step and its materialized user/group assignments. The platform verifies the signed
+source completion and every actual edge in a bounded contiguous native serial walk
+against the pinned bundle. Ambiguous or truncated history, parallel/subprocess
+paths, resets, intervening human completions and repeated nodes are refused with
+HTTP409 `HUMAN_CONTINUATION_UNAVAILABLE`; timestamps or graph reachability alone
+never establish a successor. This read grants no authority to advance or reassign.
+
+`bridge.lattice.prepareAdvance()` verifies the host-owned embedded task and its caller Viewer admission without emitting a completion signal, including when the native step already completed. Apps with a separate durable handoff must first verify that handoff, then call `notifyAdvance()`. Both methods accept no task identifiers; the host supplies its own signed context.
+
+### Coordinating a human submission with application ownership (awaiting publication)
+
+Official Next.js servers can coordinate a native human completion with a separate
+application transaction through `/api/lattice/human-handoff/*`. These are fixed
+`client.api.post` adapters: declare each exact path under `server.capabilities.api.write`
+and the process under `processes.act` and `processes.read`. They require a verified
+runtime credential, the gateway's authenticated human, current Run Viewer, and the
+same application and original actor on every retry. Browser delegation, service
+mode, a copied request context, and caller-supplied identity are refused. The
+application server is trusted to acknowledge only its own committed transaction;
+applications must not proxy acknowledgement directly from browser input.
+
+The protocol is deliberately ordered:
+
+1. `prepare` takes `{runId, stepId, edgeId, payload}` and performs read-only support,
+   current Advancer and immutable graph checks. It returns an immutable command
+   with `id`, source pins, `payloadHash`, `assignmentToken` and `preparationProof`.
+   Store this complete command with the application intent and original payload.
+2. Reserve the application intent with its own CAS, then call `reserve` with that
+   exact prepared command. Native reservation checks the source assignment,
+   submission and mutation admissions under the run lock. A failure does not
+   authorize clearing the application reservation.
+3. `advance` takes `{id, runId, stepId, payload}`. Only the original immutable
+   command may signal the workflow. Admission is durable before dispatch; an HTTP
+   failure, Temporal signal ACK, or absent completion receipt is not cancellation.
+4. Use the verified completion and continuation readers. `reconcile` takes
+   `{id, runId, stepId, users, groups}` and binds the proved immediate successor.
+   Identical native assignments need no Owner grant. A real change retains native
+   Run Owner, destination grantability and allowlist requirements, with readback.
+   Terminal continuations require empty user/group arrays.
+5. Commit the application's atomic ownership/watchers/outbox transaction. Only
+   then call `acknowledge` with `{id, runId, stepId}`. `released` is required before
+   telling the browser the whole action succeeded. If acknowledgement is lost,
+   retry it; it never replays the application transaction.
+
+`read` takes `{runId, stepId, id?}` and returns only fence identity/status and the
+bound successor. Include `id` to recover an exact cancelled attempt. Without it,
+only a non-cancelled source attempt is returned. It exposes no payload or token.
+
+When the source assignment changes between preparation and reservation, `cancel`
+accepts the exact prepared command and verifies its server signature, actor,
+application and actual SQL environment. Under the same run lock it writes a
+permanent cancellation receipt only if no matching native command was admitted
+or unexplained settlement observed. A different immutable native admission proves
+this command did not settle, even if that other command already completed.
+Protocol-1 workers always require matching admission before consuming a signal.
+A worker-only timeout receipt, written atomically with the timeout result and
+pinned to the source attempt, also proves an unaccepted prepared command did
+not complete when the timeout won before reservation. Payload fields and imported
+runner output are never timeout evidence. The application may clear its own exact pending CAS only
+after observing `status: 'cancelled'`. The cancelled ID can never reserve or
+advance; a fresh prepared ID can retry the still-parked source. There is no timeout
+unlock. A late request using a cancelled permit is refused before signal delivery.
+
+**Activation boundaries:** this initial protocol admits only top-level Temporal
+human waiters that advertise the patched native handoff protocol. Trigger wait
+credentials and older in-flight waiters are unsupported. Existing human timeout durations remain in force. A held fence pauses settlement
+of both its source timeout and any successor timeout until reconciliation or
+exact cancellation; it does not remove the configured timeout. Every possible selected continuation must reach a first human or
+terminal through at most 128 serial automation, managed-function, managed-server
+or delay nodes. Parallel/subprocess/agent routes, loops, duplicate or missing
+edges are rejected before reserving application state. Deploy migrations first,
+then roll out the admission-enforcing API to every instance, then deploy patched
+workers, and only then enable application use. Deploying workers before all API
+callers admit signals can discard unadmitted old-version signals; an API rollout
+alone is insufficient. Existing unsupported waiters need an independently
+reviewed migration or must finish on their prior application path.
+
+While held, native advance, assignment, sharing, cancellation, reset and fork
+mutations cannot cross the fence. The worker discards stale unadmitted signals
+and holds successor timeouts until release. Ordinary native commands are admitted
+before dispatch, and a prior admitted command prevents fence acquisition. A
+causally verified terminal automation failure can reconcile and release the
+handoff; terminal settlement does not imply a successful ticket outcome. An
+unexplained run failure still requires investigation.
+Nontransactional reset/fork operations retain per-attempt admissions after an
+uncertain mutating failure. **Those admissions currently require operator recovery
+and are an explicit operability/release gate for affected runs:** a later retry or
+current SQL outcome alone cannot prove an older provider call has stopped. No API
+silently expires, impersonates, or clears those attempts. Review provider-specific
+reconciliation before enabling affected-run recovery.

package/VERSION-PIN.md

@@ -94,6 +94,21 @@ before publication; an ordinary released CLI intentionally cannot.
 The React/Vite starter therefore uses released primitives and responsive CSS
 until that pin advances. Its build test exercises the ordinary CLI toolchain.
 
+## Planned team directory and embedded-task release
+
+Artifact Studio 0.10.0 and Studio CLI 0.6.6 are prepared for the separate
+chain-release workflow and remain awaiting publication. This change adds
+user-authorized directory/group methods, parked human-task assignment reads,
+and a host-verified completion notification for embedded Next.js tasks. The
+narrow app-access bridge reads only the signed-in viewer's app access.
+
+Deploy the matching platform handlers before activating consumers. An SDK
+build or candidate version is not evidence that the registry or target host
+supports these methods. Group administration still requires authority over the
+group; an application's manage capability does not grant it. Completion
+notification verifies the host's own run/step and does not execute or replay a
+workflow transition. Existing package export classifications stay unchanged.
+
 ## Unreleased server process additions
 
 Workspace source adds `processes.listRunsPage` (visible, paginated run summaries)

package/dist/api.d.ts

@@ -19,6 +19,11 @@ export declare function postJson<T>({ baseUrl, token, path, body, retry503, sign
     signal?: AbortSignal;
     headers?: Record<string, string>;
 }): Promise<T>;
+/** Binding updates are idempotent; normal authenticated target transport applies. */
+export declare function putJson<T>({ baseUrl, token, path, body }: ApiClientOptions & {
+    path: string;
+    body: unknown;
+}): Promise<T>;
 export declare function deleteJson({ baseUrl, token, path, signal }: ApiClientOptions & {
     path: string;
     signal?: AbortSignal;

package/dist/api.js

@@ -111,6 +111,13 @@ export async function postJson({ baseUrl, token, path, body, retry503 = true, si
         throw new ArtifactApiError(await responseError('POST', path, response), response.status);
     return response.json();
 }
+/** Binding updates are idempotent; normal authenticated target transport applies. */
+export async function putJson({ baseUrl, token, path, body }) {
+    const response = await authenticatedFetch({ baseUrl, token, path, init: { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) } });
+    if (!response.ok)
+        throw new ArtifactApiError(await responseError('PUT', path, response), response.status);
+    return response.json();
+}
 export async function deleteJson({ baseUrl, token, path, signal }) {
     const response = await authenticatedFetch({ baseUrl, token, path, init: { method: 'DELETE', ...(signal ? { signal } : {}) } });
     if (!response.ok)

package/dist/cli-content-readers.d.ts

@@ -0,0 +1,8 @@
+/** Public CLI for reviewed target bindings; never creates provider registrations. */
+export declare function runContentReadersCommand(input: {
+    action: string;
+    projectId?: string | true;
+    file?: string | true;
+    baseUrl: string;
+    token: string;
+}): Promise<number>;

package/dist/cli-content-readers.js

@@ -0,0 +1,28 @@
+import { readFile, stat } from 'node:fs/promises';
+import { z } from 'zod';
+import { getJson, putJson } from './api.js';
+const bindings = z.record(z.string().regex(/^[a-z][a-z0-9-]{0,62}$/), z.strictObject({ enabled: z.boolean(), revision: z.string().regex(/^[a-f0-9]{64}$/) }))
+    .refine(value => Object.keys(value).length >= 1 && Object.keys(value).length <= 16);
+/** Public CLI for reviewed target bindings; never creates provider registrations. */
+export async function runContentReadersCommand(input) {
+    const projectId = z.uuid().parse(input.projectId);
+    if (input.action !== 'show' && input.action !== 'apply')
+        throw new Error('content-readers requires show or apply');
+    if (input.action === 'show' && input.file !== undefined)
+        throw new Error('show does not accept --file');
+    const path = `/api/artifact-studio/projects/${projectId}/next/content-readers`;
+    if (input.action === 'show') {
+        console.log(JSON.stringify(await getJson({ baseUrl: input.baseUrl, token: input.token, path }), null, 2));
+        return 0;
+    }
+    if (typeof input.file !== 'string' || !input.file)
+        throw new Error('apply requires --file with reviewed bindings');
+    if ((await stat(input.file)).size > 65536)
+        throw new Error('Content-reader binding file exceeds 64 KiB');
+    const raw = await readFile(input.file, 'utf8');
+    if (Buffer.byteLength(raw) > 65536)
+        throw new Error('Content-reader binding file exceeds 64 KiB');
+    const body = bindings.parse(JSON.parse(raw));
+    console.log(JSON.stringify(await putJson({ baseUrl: input.baseUrl, token: input.token, path, body }), null, 2));
+    return 0;
+}

package/dist/cli.js

@@ -1,3 +1,4 @@
+import { runContentReadersCommand } from './cli-content-readers.js';
 import { copyFile, cp, mkdir, writeFile } from 'node:fs/promises';
 import { constants, existsSync } from 'node:fs';
 import { dirname, join, relative, resolve } from 'node:path';
@@ -22,7 +23,7 @@ import yaml from 'js-yaml';
 import { warnOnRoleDefinitions } from './role-definitions-notice.js';
 const COMMANDS = [
     'init', 'whoami', 'link', 'env', 'status', 'list', 'show',
-    'validate', 'build', 'plan', 'deploy', 'dev', 'promote', 'pull', 'rollback',
+    'content-readers', 'validate', 'build', 'plan', 'deploy', 'dev', 'promote', 'pull', 'rollback',
 ];
 const USAGE = `usage:
   seq-studio artifact init <dir> [--template react-vite|nextjs]
@@ -40,6 +41,7 @@ const USAGE = `usage:
   seq-studio artifact promote <deployment-id> --env <env>
   seq-studio artifact pull <project-id> --env <env> --out <dir>
   seq-studio artifact rollback <deployment-id> --env <env>
+  seq-studio artifact content-readers show|apply --project <id> --env <env> [--file bindings.json]
 
   Add --help or -h to any artifact command to print this usage without running it.
   init includes AGENTS.md pointing to your environment's live docs, with a
@@ -111,6 +113,10 @@ export async function runCli(argv = process.argv.slice(2)) {
         case 'promote': return promoteCommand(parsed);
         case 'pull': return pullCommand(parsed);
         case 'rollback': return rollbackCommand(parsed);
+        case 'content-readers': {
+            const env = await envFromArgs(parsed);
+            return runContentReadersCommand({ action: parsed.positional.join(' '), projectId: parsed.flags.project, file: parsed.flags.file, baseUrl: env.url, token: await getRequiredToken(parsed) });
+        }
     }
 }
 function validateKnownOptions(args) {
@@ -125,6 +131,7 @@ function validateKnownOptions(args) {
         dev: { values: ['env', 'key', 'link', 'port'], booleans: ['once'] },
         promote: { values: ['env'], booleans: [] }, pull: { values: ['env', 'out'], booleans: [] },
         rollback: { values: ['env'], booleans: [] },
+        'content-readers': { values: ['env', 'project', 'file'], booleans: [] },
     };
     const { values, booleans } = options[args.command];
     const allowed = new Set([...values, ...booleans]);

package/dist/next/bridge.d.ts

@@ -37,7 +37,21 @@ export interface NextArtifactBridge {
     reportRuntimeLog(input: NextArtifactRuntimeLog): void;
     forwardHostShortcut(input: Pick<KeyboardEvent, 'key' | 'code' | 'metaKey' | 'ctrlKey' | 'shiftKey' | 'altKey'>): boolean;
     host: SequenceHost;
-    lattice: SequenceLattice;
+    /** Read only the current viewer's app navigation decisions. This is not an authorization grant. */
+    auth: {
+        getAppAccess(): Promise<Record<string, boolean>>;
+    };
+    lattice: SequenceLattice & {
+        /** Ask the host to verify its own task completed after an app-owned mutation.
+         * Returns false while the native step is pending; retry this read, never the mutation. */
+        notifyAdvance(): Promise<{
+            notified: boolean;
+        }>;
+        /** Verify current host task admission without notifying or completing it. */
+        prepareAdvance(): Promise<{
+            supported: true;
+        }>;
+    };
 }
 /**
  * An SSR-safe external store and DOM transport. Call connect from a client effect,

package/dist/next/bridge.js

@@ -1,3 +1,4 @@
+import { z } from 'zod';
 import { createNextArtifactBridgeEnvelope, EMPTY_NEXT_ARTIFACT_LATTICE_CONTEXT, isNextArtifactRelativePath, nextArtifactInitialContextSchema, nextArtifactThemeSchema, parseNextArtifactBridgeEnvelope, validateNextArtifactBootstrap, } from './protocol.js';
 import { createNextArtifactRequests } from './requests.js';
 import { createNextArtifactStreams } from './streams.js';
@@ -203,7 +204,23 @@ export function createNextArtifactBridge(options) {
             send({ type: 'artifact-studio-host-shortcut', key: input.key, code: input.code, metaKey: input.metaKey, ctrlKey: input.ctrlKey, shiftKey: input.shiftKey, altKey: input.altKey });
             return true;
         },
-        lattice: { context: () => ({ ...(snapshot.lattice ?? EMPTY_NEXT_ARTIFACT_LATTICE_CONTEXT) }) },
+        auth: {
+            async getAppAccess() {
+                const result = await bridge.request({ method: 'auth.getAppAccess' });
+                return z.record(z.string(), z.boolean()).parse(result);
+            },
+        },
+        lattice: {
+            context: () => ({ ...(snapshot.lattice ?? EMPTY_NEXT_ARTIFACT_LATTICE_CONTEXT) }),
+            async prepareAdvance() {
+                const result = await bridge.request({ method: 'lattice.prepareAdvance' });
+                return z.object({ supported: z.literal(true) }).strict().parse(result);
+            },
+            async notifyAdvance() {
+                const result = await bridge.request({ method: 'lattice.notifyAdvance' });
+                return z.object({ notified: z.boolean() }).strict().parse(result);
+            },
+        },
         host: {
             navigate(path) {
                 requireReady();

package/dist/sdk.d.ts

@@ -413,6 +413,40 @@ export declare function createArtifactStorageClient(sdk?: SequenceArtifactSdk):
             size: number | null;
             contentType: string | null;
         }>;
+        getNodeWithAncestors: (id: string) => Promise<{
+            id: string;
+            workspaceId: string;
+            parentId: string | null;
+            name: string;
+            kind: "file" | "folder";
+            state: "active" | "trashed" | "purging";
+            restricted: boolean;
+            revision: number;
+            currentVersionId: string | null;
+            metadata: Record<string, string>;
+            createdAt: string;
+            updatedAt: string;
+            role: "viewer" | "editor" | "admin";
+            size: number | null;
+            contentType: string | null;
+            ancestors: {
+                id: string;
+                workspaceId: string;
+                parentId: string | null;
+                name: string;
+                kind: "file" | "folder";
+                state: "active" | "trashed" | "purging";
+                restricted: boolean;
+                revision: number;
+                currentVersionId: string | null;
+                metadata: Record<string, string>;
+                createdAt: string;
+                updatedAt: string;
+                role: "viewer" | "editor" | "admin";
+                size: number | null;
+                contentType: string | null;
+            }[];
+        }>;
         createFolder: (name: string, parentId?: string | null, { idempotencyKey, }?: {
             idempotencyKey?: string;
         }) => Promise<{

package/dist/server/api-client.d.ts

@@ -18,6 +18,7 @@ export declare function createApiClient({ mode, request, json }: {
 }): {
     request: (path: string, options?: ArtifactServerFetchOptions) => Promise<Response>;
     fetch<TBody = unknown>(path: string, options?: ArtifactServerFetchOptions): Promise<SequenceApiFetchResponse<TBody>>;
+    streamResponse(path: string, options?: ArtifactServerFetchOptions): Promise<Response>;
     stream(path: string, options?: ArtifactServerFetchOptions): Promise<ReadableStream<Uint8Array<ArrayBuffer>>>;
     get: <T = unknown>(path: string) => Promise<T>;
     post: <T = unknown>(path: string, body?: unknown) => Promise<T>;

package/dist/server/api-client.js

@@ -9,6 +9,15 @@ export function createApiClient({ mode, request, json }) {
         // Explicit caller result types match the existing browser SDK; the server validates endpoint schemas.
         return await json(operation(path, options), options.signal);
     };
+    const readableResponse = async (path, options) => {
+        // Only headers are subject to the broker answer deadline. The stream retains
+        // cancellation and server byte/deadline limits without losing response metadata.
+        const response = await request(operation(path, options), { signal: options.signal, stream: true });
+        if (!response.ok || !response.body)
+            throw await stepUpErrorFromResponse(response) ??
+                new ArtifactServerError(response.status, 'stream_unavailable', 'Atlas did not return a readable response');
+        return response;
+    };
     return {
         request: fetchResponse,
         async fetch(path, options = {}) {
@@ -21,14 +30,11 @@ export function createApiClient({ mode, request, json }) {
                     return value === null ? [] : [[key, value]];
                 })) };
         },
+        async streamResponse(path, options = {}) {
+            return readableResponse(path, options);
+        },
         async stream(path, options = {}) {
-            // A stream outlives the broker's answer deadline: only its headers must arrive in time.
-            const response = await request(operation(path, options), { signal: options.signal, stream: true });
-            if (!response.ok || !response.body) {
-                throw await stepUpErrorFromResponse(response) ??
-                    new ArtifactServerError(response.status, 'stream_unavailable', 'Atlas did not return a readable response');
-            }
-            return response.body;
+            return (await readableResponse(path, options)).body;
         },
         get: (path) => typedJson(path),
         post: (path, body) => typedJson(path, { method: 'POST', body }),

package/dist/server/group-directory.d.ts

@@ -0,0 +1,90 @@
+import { z } from 'zod';
+import { type ArtifactServerMode, type ArtifactServerRequest } from './broker-contract.js';
+declare const detail: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodNullable<z.ZodString>;
+    email: z.ZodNullable<z.ZodString>;
+    source: z.ZodString;
+    managedBy: z.ZodNullable<z.ZodString>;
+    memberCount: z.ZodNullable<z.ZodNumber>;
+    userRole: z.ZodNullable<z.ZodEnum<{
+        admin: "admin";
+        member: "member";
+    }>>;
+    members: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        sub: z.ZodNullable<z.ZodString>;
+        name: z.ZodString;
+        email: z.ZodString;
+        role: z.ZodEnum<{
+            admin: "admin";
+            member: "member";
+        }>;
+    }, z.core.$strip>>;
+    added: z.ZodOptional<z.ZodNumber>;
+    skippedExisting: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+declare const page: z.ZodObject<{
+    groups: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        description: z.ZodNullable<z.ZodString>;
+        email: z.ZodNullable<z.ZodString>;
+        source: z.ZodString;
+        managedBy: z.ZodNullable<z.ZodString>;
+        memberCount: z.ZodNullable<z.ZodNumber>;
+        userRole: z.ZodNullable<z.ZodEnum<{
+            admin: "admin";
+            member: "member";
+        }>>;
+    }, z.core.$strip>>;
+    pagination: z.ZodObject<{
+        page: z.ZodNumber;
+        limit: z.ZodNumber;
+        totalCount: z.ZodNumber;
+        totalPages: z.ZodNumber;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type ArtifactGroupDetail = z.infer<typeof detail>;
+export type ArtifactGroupDirectoryPage = z.infer<typeof page>;
+export type ArtifactGroupDirectoryQuery = {
+    page?: number;
+    limit?: number;
+    search?: string;
+    adminView?: boolean;
+};
+export type ArtifactGroupMemberChange = {
+    action: 'add';
+    members: Array<{
+        userId: string;
+        role?: 'admin' | 'member';
+    }>;
+} | {
+    action: 'remove';
+    userId: string;
+} | {
+    action: 'role';
+    userId: string;
+    role: 'admin' | 'member';
+};
+export interface ArtifactGroupDirectory {
+    /** Exact live group labels visible through membership or discoverability, without rosters. */
+    resolve(groupIds: string[]): Promise<{
+        groups: Array<{
+            id: string;
+            name: string;
+        }>;
+    }>;
+    /** Caller memberships; adminView requires platform administration. Declare POST /api/groups/directory in api.write. */
+    directory(query?: ArtifactGroupDirectoryQuery): Promise<ArtifactGroupDirectoryPage>;
+    /** Requires group membership or platform administration and api.read declaration. */
+    get(groupId: string): Promise<ArtifactGroupDetail>;
+    /** Requires group administration and the exact api.write path. App roles do not confer group authority. */
+    changeMembers(groupId: string, change: ArtifactGroupMemberChange): Promise<ArtifactGroupDetail>;
+}
+export declare function createGroupDirectory({ mode, json }: {
+    mode: ArtifactServerMode;
+    json: (operation: ArtifactServerRequest) => Promise<unknown>;
+}): ArtifactGroupDirectory;
+export {};

package/dist/server/group-directory.js

@@ -0,0 +1,17 @@
+import { z } from 'zod';
+import { artifactServerRequestSchema } from './broker-contract.js';
+import { ArtifactServerError } from './errors.js';
+const summary = z.object({ id: z.string(), name: z.string(), description: z.string().nullable(), email: z.string().nullable(), source: z.string(), managedBy: z.string().nullable(), memberCount: z.number().nullable(), userRole: z.enum(['admin', 'member']).nullable() });
+const detail = summary.extend({ members: z.array(z.object({ id: z.string(), sub: z.string().nullable(), name: z.string(), email: z.string(), role: z.enum(['admin', 'member']) })), added: z.number().optional(), skippedExisting: z.array(z.string()).optional() });
+const page = z.object({ groups: z.array(summary), pagination: z.object({ page: z.number(), limit: z.number(), totalCount: z.number(), totalPages: z.number() }) });
+export function createGroupDirectory({ mode, json }) {
+    const segment = (value) => { if (!value || value.length > 255 || /[/?#%\\]/.test(value) || value === '.' || value === '..')
+        throw new ArtifactServerError(400, 'invalid_request', 'Invalid group id'); return value; };
+    const call = async (schema, path, method, body) => {
+        const parsed = schema.safeParse(await json(artifactServerRequestSchema.parse({ operation: 'api', mode, path, method, body })));
+        if (!parsed.success)
+            throw new ArtifactServerError(502, 'invalid_response', 'Atlas returned an invalid group response');
+        return parsed.data;
+    };
+    return { resolve: groupIds => call(z.object({ groups: z.array(z.object({ id: z.string(), name: z.string() })) }), '/api/groups/resolve', 'POST', { groupIds }), directory: (query = {}) => call(page, '/api/groups/directory', 'POST', query), get: groupId => call(detail, `/api/groups/${segment(groupId)}`, 'GET'), changeMembers: (groupId, change) => call(detail, `/api/groups/${segment(groupId)}/members/change`, 'POST', change) };
+}

package/dist/server/groups.d.ts

@@ -1,3 +1,4 @@
+import { type ArtifactGroupDirectory } from './group-directory.js';
 import { type ArtifactServerMode, type ArtifactServerRequest } from './broker-contract.js';
 /** One group the signed-in user belongs to. `userRole` is `admin` when they administer it. */
 export interface ArtifactGroupMembership {
@@ -18,7 +19,7 @@ export interface ArtifactGroupMembershipsPage {
         totalPages: number;
     };
 }
-export interface ArtifactServerGroups {
+export interface ArtifactServerGroups extends ArtifactGroupDirectory {
     /**
      * The signed-in user's group memberships. Requires `server.capabilities.groups.read`.
      * Atlas decides which groups they are in; this call cannot name groups, search the directory,

package/dist/server/groups.js

@@ -1,3 +1,4 @@
+import { createGroupDirectory } from './group-directory.js';
 import { z } from 'zod';
 import { ARTIFACT_GROUP_MEMBERSHIPS_LIMIT, artifactServerRequestSchema, } from './broker-contract.js';
 import { ArtifactServerError } from './errors.js';
@@ -16,6 +17,7 @@ const membershipsPageSchema = z.object({
 }).strict();
 export function createArtifactGroupsClient({ mode, json }) {
     return {
+        ...createGroupDirectory({ mode, json }),
         async list(query = {}) {
             const parsed = membershipsPageSchema.safeParse(await json(artifactServerRequestSchema.parse({
                 operation: 'groups_memberships', mode, ...query,

package/dist/server/human-completion.d.ts

@@ -0,0 +1,44 @@
+import { z } from 'zod';
+import { type ArtifactServerMode, type ArtifactServerRequest } from './broker-contract.js';
+declare const querySchema: z.ZodObject<{
+    runId: z.ZodString;
+    stepId: z.ZodString;
+}, z.core.$strict>;
+declare const receiptSchema: z.ZodObject<{
+    runId: z.ZodString;
+    processId: z.ZodString;
+    processVersion: z.ZodString;
+    bundleHash: z.ZodString;
+    stepId: z.ZodString;
+    nodeId: z.ZodString;
+    attempt: z.ZodNumber;
+    actorSub: z.ZodString;
+    edgeId: z.ZodNullable<z.ZodString>;
+    payloadHash: z.ZodString;
+    completedAt: z.ZodString;
+}, z.core.$strict>;
+export type ArtifactHumanCompletionQuery = z.infer<typeof querySchema>;
+export type ArtifactHumanCompletion = z.infer<typeof receiptSchema>;
+/** Read verified, committed human evidence. No payload, token, or mutation is returned.
+ * Requires the API path declaration and the caller's Viewer on a declared process run. */
+export declare function createHumanCompletionReader({ mode, json }: {
+    mode: ArtifactServerMode;
+    json: (operation: ArtifactServerRequest) => Promise<unknown>;
+}): (query: ArtifactHumanCompletionQuery) => Promise<ArtifactHumanCompletion>;
+declare const continuationSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"waiting">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"terminal">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"human">;
+    stepId: z.ZodString;
+    nodeId: z.ZodString;
+    users: z.ZodArray<z.ZodString>;
+    groups: z.ZodArray<z.ZodString>;
+}, z.core.$strict>], "kind">;
+export type ArtifactHumanContinuation = z.infer<typeof continuationSchema>;
+export declare function createHumanContinuationReader({ mode, json }: {
+    mode: ArtifactServerMode;
+    json: (operation: ArtifactServerRequest) => Promise<unknown>;
+}): (query: ArtifactHumanCompletionQuery) => Promise<ArtifactHumanContinuation>;
+export {};

package/dist/server/human-completion.js

@@ -0,0 +1,38 @@
+import { z } from 'zod';
+import { artifactServerRequestSchema } from './broker-contract.js';
+import { ArtifactServerError } from './errors.js';
+const querySchema = z.object({ runId: z.string().uuid(), stepId: z.string().uuid() }).strict();
+const receiptSchema = z.object({
+    runId: z.string().uuid(), processId: z.string().min(1), processVersion: z.string().min(1), bundleHash: z.string().min(1),
+    stepId: z.string().uuid(), nodeId: z.string().min(1), attempt: z.number().int().positive(), actorSub: z.string().min(1),
+    edgeId: z.string().nullable(), payloadHash: z.string().regex(/^[a-f0-9]{64}$/), completedAt: z.string().datetime(),
+}).strict();
+/** Read verified, committed human evidence. No payload, token, or mutation is returned.
+ * Requires the API path declaration and the caller's Viewer on a declared process run. */
+export function createHumanCompletionReader({ mode, json }) {
+    return async (query) => {
+        const input = querySchema.parse(query);
+        const parsed = receiptSchema.safeParse(await json(artifactServerRequestSchema.parse({
+            operation: 'api', mode, method: 'POST', path: '/api/lattice/human-completion/read', body: input,
+        })));
+        if (!parsed.success || parsed.data.runId !== input.runId || parsed.data.stepId !== input.stepId)
+            throw new ArtifactServerError(502, 'invalid_response', 'Atlas returned invalid human completion evidence');
+        return parsed.data;
+    };
+}
+const continuationSchema = z.discriminatedUnion('kind', [
+    z.object({ kind: z.literal('waiting') }).strict(),
+    z.object({ kind: z.literal('terminal') }).strict(),
+    z.object({ kind: z.literal('human'), stepId: z.string().uuid(), nodeId: z.string().min(1), users: z.array(z.string().min(1)).max(500), groups: z.array(z.string().min(1)).max(500) }).strict(),
+]);
+export function createHumanContinuationReader({ mode, json }) {
+    return async (query) => {
+        const input = querySchema.parse(query);
+        const parsed = continuationSchema.safeParse(await json(artifactServerRequestSchema.parse({
+            operation: 'api', mode, method: 'POST', path: '/api/lattice/human-continuation/read', body: input,
+        })));
+        if (!parsed.success || (parsed.data.kind === 'human' && parsed.data.stepId === input.stepId))
+            throw new ArtifactServerError(502, 'invalid_response', 'Atlas returned invalid human continuation evidence');
+        return parsed.data;
+    };
+}

package/dist/server/processes.d.ts

@@ -1,3 +1,5 @@
+import { type ArtifactHumanContinuation, type ArtifactHumanCompletionQuery, type ArtifactHumanCompletion } from './human-completion.js';
+import { type ArtifactGroupTasksQuery, type ArtifactGroupTasksPage, type ArtifactTaskAssignments } from './task-assignments.js';
 import { type ArtifactProcessPrincipalType, type ArtifactProcessRunStatus, type ArtifactProcessTaskView, type ArtifactServerMode, type ArtifactServerRequest } from './broker-contract.js';
 import { type ArtifactProcessRunsPage, type ArtifactProcessRunsPageQuery } from './process-runs-page.js';
 import { type ArtifactProcessPrincipals, type ArtifactProcessRunViewerChange, type ArtifactRunSharingOperations } from './process-run-sharing.js';
@@ -318,6 +320,21 @@ export interface ArtifactProcessPrincipal {
     memberCount?: number;
 }
 export interface ArtifactServerProcesses extends ArtifactRunSharingOperations {
+    /** Parked tasks and materialized assignees; run Viewer checks and declared process scopes apply. */
+    listGroupTasksPage(query: ArtifactGroupTasksQuery): Promise<ArtifactGroupTasksPage>;
+    readTaskAssignments(query: {
+        runIds: string[];
+    }): Promise<ArtifactTaskAssignments>;
+    /** Batch current definitions, each gated by process Viewer and the declared read set. */
+    describeMany(query: {
+        processes: Array<string | ArtifactProcessDescribeQuery>;
+    }): Promise<{
+        processes: Array<{
+            process: string;
+            version?: string;
+            definition: ArtifactProcessDefinition;
+        }>;
+    }>;
     /** Start a run of a process declared under `processes.start`; the user's Invoker grant decides. */
     start(input: ArtifactProcessStart): Promise<ArtifactProcessRun>;
     /** List the runs of a process declared under `processes.read` that the user may view. */
@@ -331,6 +348,8 @@ export interface ArtifactServerProcesses extends ArtifactRunSharingOperations {
     /** The user's own human steps across processes declared under `processes.read`. */
     listTasks(query?: ArtifactProcessTasksQuery): Promise<ArtifactProcessTask[]>;
     /** Complete a parked human step on a run of a process declared under `processes.act`; the user's own `advancer` grant decides. */
+    getHumanContinuation(query: ArtifactHumanCompletionQuery): Promise<ArtifactHumanContinuation>;
+    getHumanCompletion(query: ArtifactHumanCompletionQuery): Promise<ArtifactHumanCompletion>;
     advance(input: ArtifactProcessAdvance): Promise<ArtifactProcessAdvanceResult>;
     /** Reassign a parked human step; the user's `owner` relation on the run decides. */
     assign(input: ArtifactProcessAssign): Promise<ArtifactProcessAssignResult>;

package/dist/server/processes.js

@@ -1,3 +1,5 @@
+import { createHumanCompletionReader, createHumanContinuationReader } from './human-completion.js';
+import { createTaskAssignmentsReader, createGroupTasksReader } from './task-assignments.js';
 import { artifactServerRequestSchema, } from './broker-contract.js';
 import { ArtifactServerError } from './errors.js';
 import { readArtifactProcessRunsPage } from './process-runs-page.js';
@@ -5,6 +7,13 @@ import { createArtifactProcessSharingClient } from './process-run-sharing.js';
 /** `client.processes`: Lattice through the broker's typed `lattice*` operations. Atlas owns validation and redaction. */
 export function createArtifactProcessesClient({ mode, json }) {
     return {
+        listGroupTasksPage: createGroupTasksReader({ mode, json }),
+        readTaskAssignments: createTaskAssignmentsReader({ mode, json }),
+        describeMany: async ({ processes }) => {
+            if (!processes.length || processes.length > 50 || processes.some(value => { const id = typeof value === 'string' ? value : value.process; return !id || id.length > 255 || (typeof value !== 'string' && value.version !== undefined && (!value.version || value.version.length > 255)); }))
+                throw new ArtifactServerError(400, 'invalid_request', 'Expected between one and fifty process IDs');
+            return await json(artifactServerRequestSchema.parse({ operation: 'api', mode, method: 'POST', path: '/api/lattice/process-definitions/read', body: { processes } }));
+        },
         start: async ({ process, ...run }) => {
             // Atlas returns the started run's identifiers; the shape is the Lattice start response.
             return await json(artifactServerRequestSchema.parse({ operation: 'lattice', mode, process, ...run }));
@@ -32,6 +41,8 @@ export function createArtifactProcessesClient({ mode, json }) {
                 throw new ArtifactServerError(502, 'malformed_response', 'Atlas returned a malformed task list');
             return body.items;
         },
+        getHumanContinuation: createHumanContinuationReader({ mode, json }),
+        getHumanCompletion: createHumanCompletionReader({ mode, json }),
         advance: async (input) => {
             // The Lattice advance response; Atlas owns the step resolution, the ACL and the walk.
             return await json(artifactServerRequestSchema.parse({ operation: 'lattice_advance', mode, ...input }));

package/dist/server/task-assignments.d.ts

@@ -0,0 +1,81 @@
+import { z } from 'zod';
+import { type ArtifactServerMode, type ArtifactServerRequest } from './broker-contract.js';
+declare const result: z.ZodObject<{
+    runs: z.ZodArray<z.ZodObject<{
+        runId: z.ZodString;
+        processId: z.ZodString;
+        truncated: z.ZodBoolean;
+        tasks: z.ZodArray<z.ZodObject<{
+            stepId: z.ZodString;
+            nodeId: z.ZodString;
+            startedAt: z.ZodString;
+            dueAt: z.ZodNullable<z.ZodString>;
+            users: z.ZodArray<z.ZodObject<{
+                type: z.ZodEnum<{
+                    user: "user";
+                    group: "group";
+                }>;
+                id: z.ZodString;
+                name: z.ZodString;
+                email: z.ZodOptional<z.ZodString>;
+                picture: z.ZodOptional<z.ZodString>;
+                memberCount: z.ZodOptional<z.ZodNumber>;
+                unavailable: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strip>>;
+            groups: z.ZodArray<z.ZodObject<{
+                type: z.ZodEnum<{
+                    user: "user";
+                    group: "group";
+                }>;
+                id: z.ZodString;
+                name: z.ZodString;
+                email: z.ZodOptional<z.ZodString>;
+                picture: z.ZodOptional<z.ZodString>;
+                memberCount: z.ZodOptional<z.ZodNumber>;
+                unavailable: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ArtifactTaskAssignments = z.infer<typeof result>;
+/** Read at most fifty runs' parked assignments. Requires api.write path declaration and processes.read; every run must be viewable. */
+export declare function createTaskAssignmentsReader({ mode, json }: {
+    mode: ArtifactServerMode;
+    json: (operation: ArtifactServerRequest) => Promise<unknown>;
+}): ({ runIds }: {
+    runIds: string[];
+}) => Promise<ArtifactTaskAssignments>;
+declare const groupTaskQuery: z.ZodObject<{
+    groupId: z.ZodString;
+    processes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    limit: z.ZodOptional<z.ZodNumber>;
+    cursor: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+declare const groupTaskPage: z.ZodObject<{
+    tasks: z.ZodArray<z.ZodObject<{
+        stepId: z.ZodString;
+        runId: z.ZodString;
+        nodeId: z.ZodString;
+        processId: z.ZodString;
+        processVersion: z.ZodString;
+        title: z.ZodNullable<z.ZodString>;
+        entity: z.ZodNullable<z.ZodObject<{
+            type: z.ZodString;
+            id: z.ZodString;
+        }, z.core.$strip>>;
+        startedAt: z.ZodString;
+        dueAt: z.ZodNullable<z.ZodString>;
+        users: z.ZodArray<z.ZodString>;
+        memberUsers: z.ZodArray<z.ZodString>;
+        groups: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    nextCursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type ArtifactGroupTasksQuery = z.infer<typeof groupTaskQuery>;
+export type ArtifactGroupTasksPage = z.infer<typeof groupTaskPage>;
+/** Group membership and each run's Viewer scope are checked before paging. */
+export declare function createGroupTasksReader({ mode, json }: {
+    mode: ArtifactServerMode;
+    json: (operation: ArtifactServerRequest) => Promise<unknown>;
+}): (query: ArtifactGroupTasksQuery) => Promise<ArtifactGroupTasksPage>;
+export {};

package/dist/server/task-assignments.js

@@ -0,0 +1,26 @@
+import { z } from 'zod';
+import { artifactServerRequestSchema } from './broker-contract.js';
+import { ArtifactServerError } from './errors.js';
+const principal = z.object({ type: z.enum(['user', 'group']), id: z.string(), name: z.string(), email: z.string().optional(), picture: z.string().optional(), memberCount: z.number().optional(), unavailable: z.boolean().optional() });
+const result = z.object({ runs: z.array(z.object({ runId: z.string(), processId: z.string(), truncated: z.boolean(), tasks: z.array(z.object({ stepId: z.string(), nodeId: z.string(), startedAt: z.string(), dueAt: z.string().nullable(), users: z.array(principal), groups: z.array(principal) })) })) });
+/** Read at most fifty runs' parked assignments. Requires api.write path declaration and processes.read; every run must be viewable. */
+export function createTaskAssignmentsReader({ mode, json }) {
+    return async ({ runIds }) => {
+        const input = z.array(z.string().uuid()).min(1).max(50).parse(runIds);
+        const parsed = result.safeParse(await json(artifactServerRequestSchema.parse({ operation: 'api', mode, method: 'POST', path: '/api/lattice/task-assignments/read', body: { runIds: input } })));
+        if (!parsed.success)
+            throw new ArtifactServerError(502, 'invalid_response', 'Atlas returned invalid task assignments');
+        return parsed.data;
+    };
+}
+const groupTaskQuery = z.object({ groupId: z.string().min(1).max(255), processes: z.array(z.string().min(1).max(255)).min(1).max(200).optional(), limit: z.number().int().min(1).max(100).optional(), cursor: z.string().max(2048).optional() }).strict();
+const groupTaskPage = z.object({ tasks: z.array(z.object({ stepId: z.string(), runId: z.string(), nodeId: z.string(), processId: z.string(), processVersion: z.string(), title: z.string().nullable(), entity: z.object({ type: z.string(), id: z.string() }).nullable(), startedAt: z.string(), dueAt: z.string().nullable(), users: z.array(z.string()), memberUsers: z.array(z.string()), groups: z.array(z.string()) })), nextCursor: z.string().nullable() });
+/** Group membership and each run's Viewer scope are checked before paging. */
+export function createGroupTasksReader({ mode, json }) {
+    return async (query) => {
+        const parsed = groupTaskPage.safeParse(await json(artifactServerRequestSchema.parse({ operation: 'api', mode, method: 'POST', path: '/api/lattice/group-tasks/read', body: groupTaskQuery.parse(query) })));
+        if (!parsed.success)
+            throw new ArtifactServerError(502, 'invalid_response', 'Atlas returned an invalid group task page');
+        return parsed.data;
+    };
+}

package/dist/server.d.ts

@@ -16,3 +16,7 @@ export { externalEvidence } from './server/principal.js';
 export type { ArtifactExternalEvidence, ArtifactExternalPrincipal, ArtifactPrincipal } from './server/principal.js';
 export type { ArtifactLogMetadata, ArtifactLogRecord } from './server/logger.js';
 export type { ArtifactOrmJsonScalars } from './orm-json-scalars.js';
+export type { ArtifactGroupDetail, ArtifactGroupDirectoryPage, ArtifactGroupDirectoryQuery, ArtifactGroupMemberChange } from './server/group-directory.js';
+export type { ArtifactTaskAssignments } from './server/task-assignments.js';
+export type { ArtifactGroupTasksQuery, ArtifactGroupTasksPage } from './server/task-assignments.js';
+export type { ArtifactHumanCompletionQuery, ArtifactHumanCompletion, ArtifactHumanContinuation } from './server/human-completion.js';

package/dist/templates/nextjs/README.md

@@ -186,6 +186,10 @@ own origin rather than a neighbour's. When the application origin is on a
 different site from its Atlas frame, a cookie it needs there must also be
 `SameSite=None; Partitioned`, or the browser drops it.
 
+For the same reason, the gateway refuses any `POST`, `PUT`, `PATCH`, `DELETE` or
+WebSocket upgrade whose `Origin` is not your application's own. It does not guard
+`GET`, `HEAD` or `OPTIONS`, so never change state in response to them.
+
 The local process is ordinary code running as your operating-system user.
 Atlas governs access to platform resources; it does not sandbox your laptop's
 filesystem or all outbound network connections.

package/dist/templates/react-vite/package.json

@@ -10,7 +10,7 @@
   },
   "dependencies": {},
   "devDependencies": {
-    "@sequenceholdings/artifact-studio": "^0.9.0",
+    "@sequenceholdings/artifact-studio": "^0.10.0",
     "@sequenceholdings/atlas-ui": "^3.1.1",
     "@tailwindcss/postcss": "^4.2.2",
     "@tailwindcss/vite": "^4.2.2",

package/package.json

@@ -9,7 +9,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.9.2",
+  "version": "0.10.1",
   "description": "SDK types and CLI library for building Artifact Studio apps. Driven via `seq-studio artifact <sub>` (@sequenceholdings/studio-cli), which runs the `./cli` runCli export.",
   "type": "module",
   "exports": {
@@ -171,9 +171,9 @@
     "google-auth-library": "^10.5.0",
     "server-only": "0.0.1",
     "parse5": "7.3.0",
-    "@sequenceholdings/lattice-form-renderer": "0.2.0",
-    "@sequenceholdings/orm": "2.6.2",
-    "@sequenceholdings/storage": "0.1.2"
+    "@sequenceholdings/storage": "0.1.2",
+    "@sequenceholdings/orm": "2.7.1",
+    "@sequenceholdings/lattice-form-renderer": "0.2.0"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",

package/templates/nextjs/README.md

@@ -186,6 +186,10 @@ own origin rather than a neighbour's. When the application origin is on a
 different site from its Atlas frame, a cookie it needs there must also be
 `SameSite=None; Partitioned`, or the browser drops it.
 
+For the same reason, the gateway refuses any `POST`, `PUT`, `PATCH`, `DELETE` or
+WebSocket upgrade whose `Origin` is not your application's own. It does not guard
+`GET`, `HEAD` or `OPTIONS`, so never change state in response to them.
+
 The local process is ordinary code running as your operating-system user.
 Atlas governs access to platform resources; it does not sandbox your laptop's
 filesystem or all outbound network connections.

package/templates/react-vite/package.json

@@ -10,7 +10,7 @@
   },
   "dependencies": {},
   "devDependencies": {
-    "@sequenceholdings/artifact-studio": "^0.9.0",
+    "@sequenceholdings/artifact-studio": "^0.10.0",
     "@sequenceholdings/atlas-ui": "^3.1.1",
     "@tailwindcss/postcss": "^4.2.2",
     "@tailwindcss/vite": "^4.2.2",