> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/setup-apps-os/artifact-server/transparent-safest.md).

# Transparent safest relocation

Transparent safest relocation is a per-tenant mode of the Seal Artifact Server. When it is enabled for your tenant, a build that requests a plain origin version is served the safest sealed version of that package instead, with no change to your manifest and no version suffix. The safest version is the latest released sealed version of that origin version (an enabled private version takes precedence within a Seal Project).

This is a tenant-wide setting, not a per-build choice. It is opt-in and off by default. Contact your Seal account team to enable it for your tenant.

This page assumes your package manager is already pointed at the Seal Artifact Server. See [Configuring package managers](/setup-apps-os/artifact-server/configuring-package-managers.md) for the basic setup.

## What the build sees

With the mode enabled, you do not pin the sealed version and you do not add a suffix. You request the origin version exactly as you always have, and Seal transparently serves the sealed artifact.

If Seal has no sealed version for the requested origin version, the origin version is served unchanged, so the build does not break. A build that requests a version that is already sealed is served that version as-is.

### Maven

When Maven asks `maven.sealsecurity.io` for an origin version's `.pom`, the server returns a relocation POM that points the build at the safest sealed version. For example, a request for `org.apache.commons:commons-text:1.10.0` resolves to `1.10.0+sp3` if that is the safest sealed version, and Maven then fetches that artifact. The relocation POM and its checksum are served from the same bytes, so strict checksum validation (`mvn -C`) still passes.

### npm

When npm asks `npm.sealsecurity.io` for a package, the entry for each origin version is served with the safest sealed version's tarball and integrity. Running `npm install <package>@<origin-version>` therefore installs the sealed artifact (for example, `2.7.4-sp1`) without pinning a sealed version in `package.json`.

## Relationship to `+safest`

For Maven, this mode is the tenant-wide counterpart of the build-invoked [`+safest` suffix](/setup-apps-os/artifact-server/maven-server-features.md): `+safest` is something you write in a single POM dependency to opt that one dependency into safest resolution, while transparent safest relocation applies to every origin-version request for the tenant without editing the manifest at all. npm has no `+safest` suffix, so transparent safest relocation is the way an npm build receives the safest sealed version automatically.

## Related

* [Maven-specific server features](/setup-apps-os/artifact-server/maven-server-features.md): the build-invoked `+safest` and `+safest-until-<cutoff>` suffixes.
* [Configuring package managers](/setup-apps-os/artifact-server/configuring-package-managers.md): pointing your package manager at the Seal Artifact Server.
* [Working with Seal Apps under Artifact Server](/using-platform/working-with-seal-apps/artifact-server.md): the day-to-day rhythm of pinning and resolving sealed versions.