artifacty 0.10.2 → 0.10.4

package/README.md

@@ -314,7 +314,7 @@ The browser UI defaults to English. Add `?lang=ko` to any browser route to use K
 
 Schema and storage:
 
-- Metadata lives in SQLite with `schemaVersion: 1`, `artifactType`, and `archivedAt`.
+- Metadata lives in SQLite with `schemaVersion: 1`, `artifactType`, `publisherId`, and `archivedAt`.
 - Archive hides artifacts from default lists without deleting versions.
 - Bundle artifacts store multiple files or base64 assets as portable JSON.
 - Supported formats are `html`, `markdown`, `text`, `json`, `code`, `svg`, `mermaid`, `react`, `sarif`, `csv`, `image`, and `video`.
@@ -329,13 +329,13 @@ Schema and storage:
 
 - The HTTP server binds to `127.0.0.1` by default.
 - If `ARTIFACTY_API_TOKEN` is set, HTTP API routes require `Authorization: Bearer <token>` or `x-artifacty-token`; scripts should prefer headers over `?token=...` URLs.
-- When users exist, personal API tokens issued from `/account` also authenticate HTTP API and MCP requests, and audit logs record the token owner's email as `actor`.
+- When users exist, personal API tokens issued from `/account` also authenticate HTTP API and MCP requests. Created artifacts record the token owner's email as `publisherId`, and audit logs record the same identity as `actor`.
 - API token checks use timing-safe digest comparison.
 - Binding outside localhost requires both `ARTIFACTY_SHARE_MODE=lan` or `team` and `ARTIFACTY_API_TOKEN`.
 - Non-local sharing is intended for trusted LAN or VPN sessions. Prefer a specific interface IP over `0.0.0.0`, keep React rendering disabled, and see [docs/network-sharing.md](docs/network-sharing.md).
 - Non-local binding prints a startup warning because Artifacty does not terminate TLS.
 - Artifact content is scanned for common API keys and private keys before storage. Use `--allow-secrets` or `ARTIFACTY_ALLOW_SECRETS=true` only for intentional exceptions.
-- Creates, updates, reads, imports, archives, and restores write audit events to SQLite.
+- Creates, updates, reads, imports, archives, and restores write audit events to SQLite. Legacy artifacts without a stored publisher are best-effort backfilled from their first `create` or `import` audit actor.
 - CodeMirror editor/viewer and renderer assets are served from local npm dependencies through a package allowlist, not from a public CDN. JavaScript asset routes answer `Origin: null` requests with `Access-Control-Allow-Origin: null` so sandboxed renderer iframes can import local ESM without `allow-same-origin`.
 - Mutating HTTP routes reject non-local browser origins.
 - HTML artifacts render in a sandboxed iframe.

package/docs/artifact-schema-v1.md

@@ -11,6 +11,9 @@ Artifacty schema v1 defines the stable envelope shared by HTTP, CLI, MCP, conver
   "artifactType": "document",
   "title": "Readable title",
   "sourceAgent": "codex",
+  "publisherId": "user@example.com",
+  "publisherName": "User Name",
+  "publisherUserId": "user-record-id",
   "tags": ["handoff"],
   "createdAt": "2026-06-24T00:00:00.000Z",
   "updatedAt": "2026-06-24T00:00:00.000Z",
@@ -41,6 +44,13 @@ Allowed `artifactType` values:
 
 Unknown legacy or external types should be mapped to `unknown`, not rejected during conversion. Native create/update rejects unsupported explicit types.
 
+`sourceAgent` identifies the tool or model surface that produced the artifact,
+such as `codex` or `claude`. `publisherId` identifies who published it to the
+Artifacty store. For authenticated central servers this is the personal token
+owner's email; `publisherName` and `publisherUserId` are included when the
+server can map the request to a local user record. Legacy artifacts are
+best-effort backfilled from the first `create` or `import` audit actor.
+
 ## Version Record
 
 Each version is immutable and points at one content file.

package/docs/central-team-deployment-design.md

@@ -126,7 +126,8 @@ revoke personal API tokens from `/account`. CSV imports support
 `email,name,role,password,password_reset_required`; blank passwords are
 generated once and require a password change on first sign-in. Use personal
 tokens for `artifacty install ... --api-token` so MCP and API audit logs record
-the user's email as `actor`.
+the user's email as `actor` and created artifacts record the same email as
+`publisherId`.
 
 Production-like internal deployments should run Artifacty behind a TLS reverse
 proxy, keep `ARTIFACTY_ENABLE_REACT_RENDERER` disabled unless the team trusts
@@ -162,9 +163,9 @@ x-artifacty-actor: user@example.com
 x-artifacty-host: IRAE-MACBOOK
 ```
 
-The server records the authenticated user's email as the audit `actor` when a
-personal token is used. The `x-artifacty-actor` header remains a compatibility
-fallback for the bootstrap/global token path.
+The server records the authenticated user's email as the artifact `publisherId`
+and audit `actor` when a personal token is used. The `x-artifacty-actor` header
+remains a compatibility fallback for the bootstrap/global token path.
 
 ## Security Model
 

package/docs/integrations.md

@@ -353,7 +353,7 @@ tests.
 - `GET /artifacts/:id/diff`: compare two versions.
 - `GET /artifacts/:id/raw?version=n`: raw content.
 
-When `ARTIFACTY_API_TOKEN` is configured, `/api/*` routes require either `Authorization: Bearer <token>` or `x-artifacty-token: <token>`. When users exist, personal tokens issued from `/account` also authenticate API and MCP requests and are mapped to the token owner's email in audit logs. Browser forms can also carry `?token=<token>` in the URL, which is copied to hidden form fields for local team workflows.
+When `ARTIFACTY_API_TOKEN` is configured, `/api/*` routes require either `Authorization: Bearer <token>` or `x-artifacty-token: <token>`. When users exist, personal tokens issued from `/account` also authenticate API and MCP requests, set created artifacts' `publisherId` to the token owner's email, and map audit `actor` to the same identity. Browser forms can also carry `?token=<token>` in the URL, which is copied to hidden form fields for local team workflows.
 
 Renderer notes:
 

package/docs/mcp-public-api.md

@@ -66,8 +66,9 @@ Prompts accept optional context arguments such as `artifactId`, `goal`, `scope`,
 - Local stdio remains the default. Enable the central HTTP endpoint with
   `artifacty serve --mcp-http` and install bridge mode with
   `artifacty install <agent> --mcp-url http://host:8787/mcp --api-token <token>`.
-- On central servers, use a personal token from `/account` so audit logs record
-  the token owner's email as the artifact actor.
+- On central servers, use a personal token from `/account` so created artifacts
+  include the token owner's email as `publisherId` and audit logs record the
+  same identity as `actor`.
 - Remote MCP currently uses bearer/header token auth. OAuth and per-user scoped
   tokens are future hardening work.
 - Binary media resources return stored base64 text through MCP; browser `/raw`

package/docs/network-sharing.md

@@ -44,9 +44,9 @@ When Artifacty binds outside loopback, startup output includes a warning that th
 
 ## Browser Write Behavior
 
-Remote browsers can read shared pages, but write actions are intentionally conservative. Mutating browser routes reject non-local `Origin` headers to reduce CSRF risk. For LAN sharing, prefer API or MCP writes with an explicit token header.
+Remote browsers can read shared pages and can submit browser forms when the request is same-origin with the Artifacty host, for example `Origin: http://10.0.0.50:8787` with `Host: 10.0.0.50:8787`. Mutating browser routes reject cross-origin requests to reduce CSRF risk. For scripts and agents, prefer API or MCP writes with an explicit token header.
 
-Do not relax the origin check just to make remote browser writes easier. A future team dashboard should use a dedicated policy that combines same-origin remote requests, explicit token validation, and clear operator intent.
+Do not disable the origin check just to make remote browser writes easier. Same-origin central dashboard writes should pass; writes initiated from another website should fail with `NON_LOCAL_ORIGIN`.
 
 ## Renderer Guidance
 

package/docs/threat-model.md

@@ -68,9 +68,10 @@ reachable from the user's browser.
 
 Controls:
 
-- Mutating browser routes reject non-local `Origin` headers.
+- Mutating browser routes allow loopback or same-origin requests and reject
+  cross-origin writes.
 - API routes require a token when configured.
-- LAN/team mode does not relax browser-origin checks.
+- LAN/team mode does not allow arbitrary browser origins.
 
 ### Untrusted Artifact Rendering
 
@@ -114,8 +115,8 @@ Controls:
 - The HTTP MCP endpoint is disabled unless explicitly enabled.
 - Remote MCP requests require the configured API token.
 - Stdio bridge mode sends tokens in headers, not URLs.
-- Personal tokens map requests to a server-side user record for audit actor
-  attribution.
+- Personal tokens map requests to a server-side user record for artifact
+  `publisherId` and audit `actor` attribution.
 - MCP writes go through the same secret scan and audit paths as CLI/HTTP writes.
 - MCP resources are read-only.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "artifacty",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "description": "Local artifact exchange for heterogeneous LLM agents via HTTP and MCP.",
   "type": "module",
   "keywords": [

package/src/lib/i18n.js

@@ -45,6 +45,8 @@ const TRANSLATIONS = {
     "artifact.schema": "schema v{version}",
     "artifact.archived": "archived {date}",
     "artifact.bytes": "{size} bytes",
+    "artifact.publisher": "publisher {publisher}",
+    "artifact.publisherUnknown": "unknown publisher",
     "artifact.archive": "Archive",
     "artifact.restore": "Restore",
     "diff.title": "{title} Diff",
@@ -103,6 +105,8 @@ const TRANSLATIONS = {
     "artifact.schema": "스키마 v{version}",
     "artifact.archived": "보관됨 {date}",
     "artifact.bytes": "{size} 바이트",
+    "artifact.publisher": "게시자 {publisher}",
+    "artifact.publisherUnknown": "게시자 알 수 없음",
     "artifact.archive": "보관",
     "artifact.restore": "복원",
     "diff.title": "{title} 비교",

package/src/lib/render.js

@@ -13,6 +13,7 @@ export function renderDashboard({ artifacts, baseUrl, filters = {}, pagination,
     .map((artifact) => {
       const tags = artifact.tags.map((tag) => `<span class="tag">${escapeHtml(tag)}</span>`).join("");
       const status = artifact.archivedAt ? statusBadge("archived") : "";
+      const publisher = publisherDisplay(artifact, view);
       const snippet = artifact.searchSnippet
         ? `<span class="row-snippet">${escapeHtml(artifact.searchSnippet)}</span>`
         : "";
@@ -24,6 +25,7 @@ export function renderDashboard({ artifacts, baseUrl, filters = {}, pagination,
             ${snippet}
           </span>
           <span>${escapeHtml(artifact.sourceAgent)}</span>
+          <span class="publisher-cell" title="${escapeAttribute(publisherTitle(artifact, view))}">${escapeHtml(publisher)}</span>
           ${typeBadge(artifact.artifactType || "document")}
           ${formatBadge(artifact.format || "text")}
           <span>v${artifact.latestVersion}</span>
@@ -527,6 +529,7 @@ export function renderArtifactPage({ artifact, version, content, baseUrl, authTo
   const rawUrl = `/artifacts/${encodeURIComponent(artifact.id)}/raw?version=${version.version}`;
   const archiveAction = artifact.archivedAt ? "restore" : "archive";
   const archiveLabel = artifact.archivedAt ? view.text("artifact.restore") : view.text("artifact.archive");
+  const publisher = publisherDisplay(artifact, view);
 
   return pageShell({
     title: artifact.title,
@@ -550,6 +553,7 @@ export function renderArtifactPage({ artifact, version, content, baseUrl, authTo
           ${typeBadge(artifact.artifactType || "document")}
           <span>${view.text("artifact.schema", { version: artifact.schemaVersion || 1 })}</span>
           ${artifact.archivedAt ? statusBadge(view.text("artifact.archived", { date: artifact.archivedAt })) : ""}
+          <span title="${escapeAttribute(publisherTitle(artifact, view))}">${view.text("artifact.publisher", { publisher })}</span>
           <span>${view.text("artifact.bytes", { size: version.sizeBytes })}</span>
           <span>${escapeHtml(version.createdAt)}</span>
           <span>${escapeHtml(version.sha256.slice(0, 12))}</span>
@@ -1295,8 +1299,8 @@ export function pageShell({ title, body, head = "", afterBody = "", locale = DEF
     }
     .artifact-row {
       display: grid;
-      grid-template-columns: minmax(220px, 1fr) 120px 120px 90px 64px minmax(120px, 220px);
-      gap: 16px;
+      grid-template-columns: minmax(220px, 1fr) 110px minmax(140px, 200px) 110px 84px 56px minmax(100px, 180px);
+      gap: 12px;
       align-items: center;
       min-height: 64px;
       padding: 14px 18px;
@@ -1343,6 +1347,13 @@ export function pageShell({ title, body, head = "", afterBody = "", locale = DEF
       font-size: 12.5px;
       color: var(--muted);
     }
+    .artifact-row .publisher-cell {
+      min-width: 0;
+      overflow: hidden;
+      text-overflow: ellipsis;
+      white-space: nowrap;
+      color: var(--text);
+    }
     .empty {
       color: var(--muted);
       font-size: 13px;
@@ -1828,6 +1839,19 @@ function formatBadge(value) {
   return `<span class="badge f-${escapeAttribute(slug)}">${escapeHtml(format)}</span>`;
 }
 
+function publisherDisplay(artifact, view) {
+  return artifact.publisherId || artifact.publisherName || view.text("artifact.publisherUnknown");
+}
+
+function publisherTitle(artifact, view) {
+  const id = artifact.publisherId || "";
+  const name = artifact.publisherName || "";
+  if (id && name && id !== name) {
+    return `${name} <${id}>`;
+  }
+  return id || name || view.text("artifact.publisherUnknown");
+}
+
 function statusBadge(label) {
   return `<span class="badge s-archived">${label}</span>`;
 }

package/src/lib/storage.js

@@ -6,7 +6,7 @@ import path from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import { assertNoSecrets, securityConfig } from "./security.js";
 
-export const STORE_VERSION = 3;
+export const STORE_VERSION = 4;
 export const ARTIFACT_SCHEMA_VERSION = 1;
 export const MAX_ARTIFACT_BYTES = 16 * 1024 * 1024;
 export const USER_ROLES = ["admin", "user"];
@@ -141,6 +141,7 @@ export async function createArtifact(store = createStore(), input = {}) {
       const now = new Date().toISOString();
       const id = makeArtifactId(normalized.title);
       const version = writeVersionFile(store, id, 1, normalized, now);
+      const publisher = publisherFromAudit(input.audit);
 
       artifact = {
         id,
@@ -148,6 +149,9 @@ export async function createArtifact(store = createStore(), input = {}) {
         artifactType: normalized.artifactType,
         schemaVersion: normalized.schemaVersion,
         sourceAgent: normalized.sourceAgent,
+        publisherId: publisher.publisherId,
+        publisherName: publisher.publisherName,
+        publisherUserId: publisher.publisherUserId,
         tags: normalized.tags,
         createdAt: now,
         updatedAt: now,
@@ -461,15 +465,17 @@ function listArtifactsPageWithSql(db, filters) {
       LOWER(id) LIKE ? ESCAPE '\\' OR
       LOWER(title) LIKE ? ESCAPE '\\' OR
       LOWER(source_agent) LIKE ? ESCAPE '\\' OR
+      LOWER(COALESCE(publisher_id, '')) LIKE ? ESCAPE '\\' OR
+      LOWER(COALESCE(publisher_name, '')) LIKE ? ESCAPE '\\' OR
       LOWER(tags_json) LIKE ? ESCAPE '\\'
     )`);
-    params.push(like, like, like, like);
+    params.push(like, like, like, like, like, like);
   }
 
   const whereSql = clauses.length ? `WHERE ${clauses.join(" AND ")}` : "";
   const total = db.prepare(`SELECT COUNT(*) AS total FROM artifacts ${whereSql}`).get(...params).total;
   const rows = db.prepare(`
-    SELECT id, title, artifact_type, schema_version, source_agent, tags_json, created_at, updated_at, latest_version, archived_at
+    SELECT id, title, artifact_type, schema_version, source_agent, publisher_id, publisher_name, publisher_user_id, tags_json, created_at, updated_at, latest_version, archived_at
     FROM artifacts
     ${whereSql}
     ORDER BY updated_at DESC, created_at DESC
@@ -503,13 +509,16 @@ function listArtifactsPageWithFts(db, filters) {
       a.artifact_type,
       a.schema_version,
       a.source_agent,
+      a.publisher_id,
+      a.publisher_name,
+      a.publisher_user_id,
       a.tags_json,
       a.created_at,
       a.updated_at,
       a.latest_version,
       a.archived_at,
       bm25(artifact_search) AS search_rank,
-      snippet(artifact_search, 7, '', '', '...', 24) AS search_snippet
+      snippet(artifact_search, -1, '', '', '...', 24) AS search_snippet
     FROM artifact_search
     JOIN artifacts a ON a.id = artifact_search.artifact_id
     ${whereSql}
@@ -572,6 +581,9 @@ function artifactFromRow(db, row) {
     artifactType: row.artifact_type,
     schemaVersion: row.schema_version,
     sourceAgent: row.source_agent,
+    publisherId: row.publisher_id || null,
+    publisherName: row.publisher_name || null,
+    publisherUserId: row.publisher_user_id || null,
     tags: parseJson(row.tags_json, []),
     createdAt: row.created_at,
     updatedAt: row.updated_at,
@@ -589,6 +601,15 @@ function normalizeWhitespace(value) {
   return normalizeOptionalString(value).replace(/\s+/g, " ");
 }
 
+function publisherFromAudit(audit = {}) {
+  const publisherId = normalizeOptionalString(audit.publisherId || audit.actor) || null;
+  return {
+    publisherId,
+    publisherName: normalizeOptionalString(audit.publisherName || audit.userName) || null,
+    publisherUserId: normalizeOptionalString(audit.publisherUserId || audit.userId) || null
+  };
+}
+
 function toFtsQuery(value) {
   const tokens = normalizeOptionalString(value).match(/[\p{L}\p{N}_-]+/gu) || [];
   return tokens
@@ -986,6 +1007,9 @@ export function toArtifactSummary(artifact) {
     artifactType: artifact.artifactType,
     schemaVersion: artifact.schemaVersion,
     sourceAgent: artifact.sourceAgent,
+    publisherId: artifact.publisherId || null,
+    publisherName: artifact.publisherName || null,
+    publisherUserId: artifact.publisherUserId || null,
     tags: artifact.tags,
     createdAt: artifact.createdAt,
     updatedAt: artifact.updatedAt,
@@ -1075,6 +1099,9 @@ function initializeSchema(db) {
       artifact_type TEXT NOT NULL DEFAULT 'document',
       schema_version INTEGER NOT NULL DEFAULT 1,
       source_agent TEXT NOT NULL,
+      publisher_id TEXT,
+      publisher_name TEXT,
+      publisher_user_id TEXT,
       tags_json TEXT NOT NULL,
       created_at TEXT NOT NULL,
       updated_at TEXT NOT NULL,
@@ -1152,11 +1179,118 @@ function initializeSchema(db) {
   ensureColumn(db, "artifacts", "artifact_type", "TEXT NOT NULL DEFAULT 'document'");
   ensureColumn(db, "artifacts", "schema_version", "INTEGER NOT NULL DEFAULT 1");
   ensureColumn(db, "artifacts", "archived_at", "TEXT");
+  ensureColumn(db, "artifacts", "publisher_id", "TEXT");
+  ensureColumn(db, "artifacts", "publisher_name", "TEXT");
+  ensureColumn(db, "artifacts", "publisher_user_id", "TEXT");
   ensureColumn(db, "users", "password_reset_required", "INTEGER NOT NULL DEFAULT 0");
+  db.exec("CREATE INDEX IF NOT EXISTS idx_artifacts_publisher_id ON artifacts(publisher_id)");
+  backfillArtifactPublishers(db);
   db.prepare("INSERT OR REPLACE INTO meta (key, value) VALUES ('store_version', ?)").run(String(STORE_VERSION));
   ensureSearchTable(db);
 }
 
+function backfillArtifactPublishers(db) {
+  const rows = db.prepare(`
+    SELECT
+      id,
+      publisher_id,
+      (
+        SELECT actor
+        FROM audit_log
+        WHERE audit_log.artifact_id = artifacts.id
+          AND action IN ('create', 'import')
+          AND actor IS NOT NULL
+          AND TRIM(actor) != ''
+        ORDER BY created_at ASC
+        LIMIT 1
+      ) AS actor
+    FROM artifacts
+    WHERE publisher_id IS NULL
+      OR TRIM(publisher_id) = ''
+      OR publisher_id LIKE 'curl/%'
+      OR publisher_id LIKE 'Wget/%'
+      OR publisher_id LIKE 'HTTPie/%'
+      OR publisher_id LIKE 'PostmanRuntime/%'
+      OR publisher_id LIKE 'undici%'
+      OR publisher_id LIKE 'node-fetch%'
+      OR publisher_id LIKE 'Mozilla/%'
+  `).all();
+
+  if (rows.length === 0) {
+    enrichPublisherUsers(db);
+    return;
+  }
+
+  const update = db.prepare(`
+    UPDATE artifacts
+    SET publisher_id = ?, publisher_name = ?, publisher_user_id = ?
+    WHERE id = ?
+  `);
+
+  transaction(db, () => {
+    for (const row of rows) {
+      const existingPublisherId = normalizeOptionalString(row.publisher_id);
+      if (existingPublisherId && !isLikelyUserAgentActor(existingPublisherId)) {
+        continue;
+      }
+      const actor = normalizeOptionalString(row.actor);
+      const publisher = publisherForActor(db, actor);
+      if (!publisher.publisherId && !existingPublisherId) {
+        continue;
+      }
+      update.run(publisher.publisherId, publisher.publisherName, publisher.publisherUserId, row.id);
+    }
+    enrichPublisherUsers(db);
+  });
+}
+
+function enrichPublisherUsers(db) {
+  db.prepare(`
+    UPDATE artifacts
+    SET
+      publisher_user_id = COALESCE(
+        publisher_user_id,
+        (SELECT id FROM users WHERE LOWER(users.email) = LOWER(artifacts.publisher_id) LIMIT 1)
+      ),
+      publisher_name = COALESCE(
+        NULLIF(publisher_name, ''),
+        (SELECT name FROM users WHERE LOWER(users.email) = LOWER(artifacts.publisher_id) LIMIT 1)
+      )
+    WHERE publisher_id IS NOT NULL AND TRIM(publisher_id) != ''
+  `).run();
+}
+
+function publisherForActor(db, actor) {
+  const publisherId = normalizeOptionalString(actor);
+  if (!publisherId || isLikelyUserAgentActor(publisherId)) {
+    return {
+      publisherId: null,
+      publisherName: null,
+      publisherUserId: null
+    };
+  }
+
+  const user = db.prepare("SELECT id, email, name FROM users WHERE LOWER(email) = LOWER(?)").get(publisherId);
+  return {
+    publisherId: user?.email || publisherId,
+    publisherName: user?.name || null,
+    publisherUserId: user?.id || null
+  };
+}
+
+function isLikelyUserAgentActor(value) {
+  if (/^(curl|Wget|HTTPie|PostmanRuntime)\//i.test(value)) {
+    return true;
+  }
+  if (/^(undici|node-fetch)(\/|$)/i.test(value)) {
+    return true;
+  }
+  if (value.length < 24) {
+    return false;
+  }
+  return /\b(Mozilla|AppleWebKit|Chrome|Safari|Firefox|Edg)\b/i.test(value);
+}
+
 function migrateJsonIndex(db, store) {
   if (!existsSync(store.indexPath)) {
     return;
@@ -1192,11 +1326,17 @@ function migrateJsonIndex(db, store) {
 
 function ensureSearchTable(db) {
   try {
+    const existing = db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'artifact_search'").get();
+    if (existing && !searchTableHasPublisherColumns(db)) {
+      db.exec("DROP TABLE artifact_search");
+    }
     db.exec(`
       CREATE VIRTUAL TABLE IF NOT EXISTS artifact_search USING fts5(
         artifact_id UNINDEXED,
         title,
         source_agent,
+        publisher_id,
+        publisher_name,
         artifact_type,
         tags,
         format,
@@ -1212,9 +1352,14 @@ function ensureSearchTable(db) {
   }
 }
 
+function searchTableHasPublisherColumns(db) {
+  const columns = db.prepare("PRAGMA table_info(artifact_search)").all().map((row) => row.name);
+  return columns.includes("publisher_id") && columns.includes("publisher_name");
+}
+
 function searchIndexAvailable(db) {
   const row = db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'artifact_search'").get();
-  return Boolean(row) || ensureSearchTable(db);
+  return (Boolean(row) && searchTableHasPublisherColumns(db)) || ensureSearchTable(db);
 }
 
 function syncSearchIndexIfEmpty(db, store) {
@@ -1280,17 +1425,23 @@ function upsertSearchIndex(db, artifact, version, content) {
   db.prepare("DELETE FROM artifact_search WHERE artifact_id = ?").run(artifact.id);
   db.prepare(`
     INSERT INTO artifact_search (
-      artifact_id, title, source_agent, artifact_type, tags, format, metadata, content
+      artifact_id, title, source_agent, publisher_id, publisher_name, artifact_type, tags, format, metadata, content
     )
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
   `).run(
     artifact.id,
     artifact.title,
     artifact.sourceAgent,
+    artifact.publisherId || "",
+    artifact.publisherName || "",
     artifact.artifactType,
     artifact.tags.join(" "),
     version.format,
-    metadataSearchText(version.metadata),
+    metadataSearchText({
+      ...(version.metadata || {}),
+      publisherId: artifact.publisherId || undefined,
+      publisherName: artifact.publisherName || undefined
+    }),
     content
   );
 }
@@ -1321,7 +1472,7 @@ function listStoreFiles(root) {
 
 function loadArtifacts(db) {
   const rows = db.prepare(`
-    SELECT id, title, artifact_type, schema_version, source_agent, tags_json, created_at, updated_at, latest_version, archived_at
+    SELECT id, title, artifact_type, schema_version, source_agent, publisher_id, publisher_name, publisher_user_id, tags_json, created_at, updated_at, latest_version, archived_at
     FROM artifacts
     ORDER BY updated_at DESC, created_at DESC
   `).all();
@@ -1332,6 +1483,9 @@ function loadArtifacts(db) {
     artifactType: row.artifact_type,
     schemaVersion: row.schema_version,
     sourceAgent: row.source_agent,
+    publisherId: row.publisher_id || null,
+    publisherName: row.publisher_name || null,
+    publisherUserId: row.publisher_user_id || null,
     tags: parseJson(row.tags_json, []),
     createdAt: row.created_at,
     updatedAt: row.updated_at,
@@ -1352,7 +1506,7 @@ function loadVersions(db, artifactId) {
 
 function findArtifactById(db, id) {
   const row = db.prepare(`
-    SELECT id, title, artifact_type, schema_version, source_agent, tags_json, created_at, updated_at, latest_version, archived_at
+    SELECT id, title, artifact_type, schema_version, source_agent, publisher_id, publisher_name, publisher_user_id, tags_json, created_at, updated_at, latest_version, archived_at
     FROM artifacts
     WHERE id = ?
   `).get(id);
@@ -1370,6 +1524,9 @@ function findArtifactById(db, id) {
     artifactType: row.artifact_type,
     schemaVersion: row.schema_version,
     sourceAgent: row.source_agent,
+    publisherId: row.publisher_id || null,
+    publisherName: row.publisher_name || null,
+    publisherUserId: row.publisher_user_id || null,
     tags: parseJson(row.tags_json, []),
     createdAt: row.created_at,
     updatedAt: row.updated_at,
@@ -1382,15 +1539,18 @@ function findArtifactById(db, id) {
 function insertArtifactRecord(db, artifact) {
   db.prepare(`
     INSERT INTO artifacts (
-      id, title, artifact_type, schema_version, source_agent, tags_json, created_at, updated_at, latest_version, archived_at
+      id, title, artifact_type, schema_version, source_agent, publisher_id, publisher_name, publisher_user_id, tags_json, created_at, updated_at, latest_version, archived_at
     )
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
   `).run(
     artifact.id,
     artifact.title,
     normalizeArtifactType(artifact.artifactType || artifact.artifact_type || "document"),
     normalizeSchemaVersion(artifact.schemaVersion || artifact.schema_version),
     artifact.sourceAgent || artifact.source_agent || "unknown",
+    normalizeOptionalString(artifact.publisherId || artifact.publisher_id) || null,
+    normalizeOptionalString(artifact.publisherName || artifact.publisher_name) || null,
+    normalizeOptionalString(artifact.publisherUserId || artifact.publisher_user_id) || null,
     JSON.stringify(artifact.tags || []),
     artifact.createdAt || artifact.created_at,
     artifact.updatedAt || artifact.updated_at,

package/src/server.js

@@ -816,11 +816,25 @@ export function assertLocalOrigin(request) {
     return;
   }
 
-  const parsed = new URL(origin);
+  let parsed;
+  try {
+    parsed = new URL(origin);
+  } catch {
+    throw Object.assign(new Error(`Rejected invalid origin: ${origin}`), {
+      statusCode: 403,
+      code: "NON_LOCAL_ORIGIN"
+    });
+  }
+
   const hostname = parsed.hostname.toLowerCase();
-  const allowed = hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
+  const host = String(request.headers.host || "").toLowerCase();
+  const allowed =
+    hostname === "localhost" ||
+    hostname === "127.0.0.1" ||
+    hostname === "::1" ||
+    (host && parsed.host.toLowerCase() === host && (parsed.protocol === "http:" || parsed.protocol === "https:"));
   if (!allowed) {
-    throw Object.assign(new Error(`Rejected non-local origin: ${origin}`), {
+    throw Object.assign(new Error(`Rejected untrusted origin: ${origin}`), {
       statusCode: 403,
       code: "NON_LOCAL_ORIGIN"
     });
@@ -967,8 +981,9 @@ function auditContext(request, surface) {
   const auth = request.artifactyAuth;
   return {
     surface,
-    actor: auth?.actor || request.headers["x-artifacty-actor"] || request.headers["user-agent"] || "unknown",
+    actor: auth?.actor || request.headers["x-artifacty-actor"] || "unknown",
     userId: auth?.user?.id || null,
+    publisherName: auth?.user?.name || null,
     tokenId: auth?.tokenId || null
   };
 }
@@ -992,7 +1007,7 @@ async function requireRequestAuth({ store, request, url, body = {}, config }) {
   if (!authRequired) {
     return {
       type: "anonymous",
-      actor: request.headers["x-artifacty-actor"] || request.headers["user-agent"] || "anonymous"
+      actor: request.headers["x-artifacty-actor"] || "anonymous"
     };
   }