Add immutable artifact downloads

apps/web/src/api/client.ts

@@ -1150,6 +1150,11 @@ export const api = {
     versionId: string,
     path: string,
   ) => versionAssetUrl("file", projectId, artifactId, versionId, path),
+  versionArchiveUrl: (
+    projectId: string,
+    artifactId: string,
+    versionId: string,
+  ) => `/api/v1/artifacts/${encodeURIComponent(artifactId)}/versions/${encodeURIComponent(versionId)}/archive?${projectQuery(projectId)}`,
   versionMediaUrl: (
     projectId: string,
     artifactId: string,

apps/web/src/review/review-app.tsx

@@ -15,6 +15,7 @@ import {
   BookOpen01Icon,
   Cancel01Icon,
   Comment01Icon,
+  Download04Icon,
   Edit02Icon,
   ExternalLinkIcon,
   File01Icon,
@@ -134,6 +135,11 @@ interface VersionListItem {
   readonly version: Version;
 }
 
+interface ReviewDownload {
+  readonly href: string;
+  readonly title: string;
+}
+
 interface ReviewLocation {
   readonly artifactId: string | null;
   readonly path: string | null;
@@ -960,6 +966,11 @@ function ArtifactReview({
     && session.principal.membershipRole === "administrator"
   ) || session.principal.capabilities.includes("artifact:manage:any");
   const previewKind = reviewPreviewKind(selectedVersion, selectedPath);
+  const download = reviewDownload(
+    projectId,
+    selectedArtifactId,
+    selectedVersion,
+  );
   const selectArtifact = useCallback((artifactId: string, versionId?: string): void => {
     setDetailError(null);
     setSelectedArtifactId(artifactId);
@@ -1657,6 +1668,10 @@ function ArtifactReview({
                     selectedVersion={selectedVersion}
                     triggerClassName="as-button as-focus-controls__button"
                   />
+                  <ReviewDownloadControl
+                    className="as-button as-focus-controls__button"
+                    download={download}
+                  />
                   <button
                     aria-keyshortcuts="F"
                     className="as-button as-focus-controls__button"
@@ -1754,13 +1769,16 @@ function ArtifactReview({
                 </IconButton>
               ) : null}
               <button
+                aria-label={opening ? "Opening raw artifact" : "Open raw artifact"}
                 className="as-button as-button--secondary as-preview-header__raw"
                 disabled={selectedVersionId === null || opening}
                 onClick={() => void openRawArtifact()}
                 type="button"
               >
                 <HugeiconsIcon aria-hidden="true" icon={ExternalLinkIcon} strokeWidth={1.8} />
-                {opening ? "Opening…" : "Open raw artifact"}
+                <span className="as-button__label">
+                  {opening ? "Opening…" : "Open raw artifact"}
+                </span>
               </button>
               <ReviewShareControl
                 details={details}
@@ -1770,7 +1788,12 @@ function ArtifactReview({
                 selectedVersion={selectedVersion}
                 triggerClassName="as-button as-button--secondary"
               />
+              <ReviewDownloadControl
+                className="as-button as-button--secondary"
+                download={download}
+              />
               <button
+                aria-label="Full screen"
                 aria-keyshortcuts="F"
                 className="as-button as-button--primary"
                 disabled={selectedVersionId === null}
@@ -1779,7 +1802,7 @@ function ArtifactReview({
                 type="button"
               >
                 <HugeiconsIcon aria-hidden="true" icon={FullScreenIcon} strokeWidth={1.8} />
-                Full screen
+                <span className="as-button__label">Full screen</span>
               </button>
               {!inspectorOpen ? (
                 <IconButton
@@ -2023,6 +2046,60 @@ function ArtifactReview({
   );
 }
 
+function reviewDownload(
+  projectId: string,
+  artifactId: string | null,
+  version: ArtifactVersion | null,
+): ReviewDownload | null {
+  if (artifactId === null || version === null) return null;
+  const entries = version.manifest.entries;
+  const onlyEntry = entries.length === 1 ? entries[0] : undefined;
+  if (onlyEntry !== undefined) {
+    return {
+      href: api.versionFileUrl(
+        projectId,
+        artifactId,
+        version.version.id,
+        onlyEntry.path,
+      ),
+      title: `Download ${onlyEntry.path}`,
+    };
+  }
+  return {
+    href: api.versionArchiveUrl(projectId, artifactId, version.version.id),
+    title: `Download ${entries.length} files as a ZIP`,
+  };
+}
+
+function ReviewDownloadControl({
+  className,
+  download,
+}: {
+  readonly className: string;
+  readonly download: ReviewDownload | null;
+}) {
+  if (download === null) {
+    return (
+      <button aria-label="Download" className={className} disabled type="button">
+        <HugeiconsIcon aria-hidden="true" icon={Download04Icon} strokeWidth={1.8} />
+        <span className="as-button__label">Download</span>
+      </button>
+    );
+  }
+  return (
+    <a
+      aria-label="Download"
+      className={className}
+      download
+      href={download.href}
+      title={download.title}
+    >
+      <HugeiconsIcon aria-hidden="true" icon={Download04Icon} strokeWidth={1.8} />
+      <span className="as-button__label">Download</span>
+    </a>
+  );
+}
+
 function DetailsInspector({
   canManage,
   details,

apps/web/src/review/review-share.tsx

@@ -182,14 +182,15 @@ export function ReviewShareControl({
       <Popover.Trigger
         render={(
           <button
+            aria-label="Share"
             className={triggerClassName}
             disabled={details === null || selectedVersion === null}
             type="button"
           />
         )}
       >
         <HugeiconsIcon aria-hidden="true" icon={Share01Icon} strokeWidth={1.8} />
-        Share
+        <span className="as-button__label">Share</span>
       </Popover.Trigger>
       <Popover.Portal>
         <Popover.Backdrop className="as-share-backdrop" />

apps/web/src/review/review.css

@@ -1558,6 +1558,15 @@ select:focus-visible {
   flex: 1;
 }
 
+.as-preview-header__actions {
+  flex: 0 0 auto;
+}
+
+.as-preview-header__actions > .as-button,
+.as-preview-header__actions > [data-popup-open] {
+  flex: 0 0 auto;
+}
+
 .as-preview-header h1 {
   font-size: 0.92rem;
   font-weight: 600;
@@ -2181,6 +2190,21 @@ select:focus-visible {
   }
 }
 
+@container preview-panel (max-width: 40rem) {
+  .as-preview-header__actions {
+    gap: 0.35rem;
+  }
+
+  .as-preview-header__actions .as-button {
+    min-width: 2rem;
+    padding-inline: 0.45rem;
+  }
+
+  .as-preview-header__actions .as-button__label {
+    display: none;
+  }
+}
+
 .as-icon-button,
 .as-button {
   align-items: center;

package.json

@@ -121,6 +121,7 @@
     "@playwright/test": "1.62.1",
     "@types/node": "24.13.3",
     "@vitest/coverage-v8": "4.1.10",
+    "fflate": "0.8.3",
     "node-pty": "1.1.0",
     "oxlint": "1.78.0",
     "oxlint-tsgolint": "7.0.2001",

project/evidence/aws-pulumi.json

@@ -1 +1 @@
-{"numTotalTestSuites":2,"numPassedTestSuites":2,"numFailedTestSuites":0,"numPendingTestSuites":0,"numTotalTests":4,"numPassedTests":4,"numFailedTests":0,"numPendingTests":0,"numTodoTests":0,"snapshot":{"added":0,"failure":false,"filesAdded":0,"filesRemoved":0,"filesRemovedList":[],"filesUnmatched":0,"filesUpdated":0,"matched":0,"total":0,"unchecked":0,"uncheckedKeysByFile":[],"unmatched":0,"updated":0,"didUpdate":false},"startTime":1788372195268,"success":true,"testResults":[{"assertionResults":[{"ancestorTitles":["AWS Pulumi deployment"],"fullName":"AWS Pulumi deployment derives the configured capacity plan and rejects unsafe combinations","status":"passed","title":"derives the configured capacity plan and rejects unsafe combinations","duration":4.691082999999935,"failureMessages":[],"meta":{},"tags":[]},{"ancestorTitles":["AWS Pulumi deployment"],"fullName":"AWS Pulumi deployment rejects stack drift, incomplete network adoption, and private TLS ambiguity","status":"passed","title":"rejects stack drift, incomplete network adoption, and private TLS ambiguity","duration":1.0801250000000664,"failureMessages":[],"meta":{},"tags":[]},{"ancestorTitles":["AWS Pulumi deployment"],"fullName":"AWS Pulumi deployment defines the secure AWS resource graph and exact shared outputs","status":"passed","title":"defines the secure AWS resource graph and exact shared outputs","duration":222.19370800000002,"failureMessages":[],"meta":{},"tags":[]},{"ancestorTitles":["AWS Pulumi deployment"],"fullName":"AWS Pulumi deployment adopts a private two-zone VPC without creating public infrastructure","status":"passed","title":"adopts a private two-zone VPC without creating public infrastructure","duration":87.58500000000004,"failureMessages":[],"meta":{},"tags":[]}],"startTime":1788372195899,"endTime":1788372196214.585,"status":"passed","message":"","name":"/Users/ramos/oss/artifact-server-local-html-effectiveness/deploy/pulumi/aws/tests/aws-pulumi.test.ts"}]}
+{"numTotalTestSuites":2,"numPassedTestSuites":2,"numFailedTestSuites":0,"numPendingTestSuites":0,"numTotalTests":4,"numPassedTests":4,"numFailedTests":0,"numPendingTests":0,"numTodoTests":0,"snapshot":{"added":0,"failure":false,"filesAdded":0,"filesRemoved":0,"filesRemovedList":[],"filesUnmatched":0,"filesUpdated":0,"matched":0,"total":0,"unchecked":0,"uncheckedKeysByFile":[],"unmatched":0,"updated":0,"didUpdate":false},"startTime":1788451880994,"success":true,"testResults":[{"assertionResults":[{"ancestorTitles":["AWS Pulumi deployment"],"fullName":"AWS Pulumi deployment derives the configured capacity plan and rejects unsafe combinations","status":"passed","title":"derives the configured capacity plan and rejects unsafe combinations","duration":4.955832999999984,"failureMessages":[],"meta":{},"tags":[]},{"ancestorTitles":["AWS Pulumi deployment"],"fullName":"AWS Pulumi deployment rejects stack drift, incomplete network adoption, and private TLS ambiguity","status":"passed","title":"rejects stack drift, incomplete network adoption, and private TLS ambiguity","duration":1.0678329999999505,"failureMessages":[],"meta":{},"tags":[]},{"ancestorTitles":["AWS Pulumi deployment"],"fullName":"AWS Pulumi deployment defines the secure AWS resource graph and exact shared outputs","status":"passed","title":"defines the secure AWS resource graph and exact shared outputs","duration":218.33325000000002,"failureMessages":[],"meta":{},"tags":[]},{"ancestorTitles":["AWS Pulumi deployment"],"fullName":"AWS Pulumi deployment adopts a private two-zone VPC without creating public infrastructure","status":"passed","title":"adopts a private two-zone VPC without creating public infrastructure","duration":87.41020900000001,"failureMessages":[],"meta":{},"tags":[]}],"startTime":1788451881622,"endTime":1788451881934.4102,"status":"passed","message":"","name":"/Users/ramos/oss/artifact-server/deploy/pulumi/aws/tests/aws-pulumi.test.ts"}]}