diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index a7ace95768..1d1a7488da 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -55,6 +55,41 @@ jobs:
       - name: Type-check
         run: npm run type-check
 
+  # TEMPORARY probe (chore/sr-sdk-artifactory) - do NOT merge.
+  # Settled already: the corp host artifactory.corp.adobe.com is behind Adobe's
+  # Banyan ZTNA gateway (interactive SSO) and is unusable from a public runner.
+  # Open question this job answers: is the MACHINE host artifactory-uw2.adobeitc.com
+  # (public TLS cert, token auth, used by mystique CI) reachable from a public
+  # GitHub-hosted runner? We expect HTTP 401 (reachable, needs a token, which we
+  # don't have yet). A timeout / http_code=000 / DNS failure means it is
+  # internal-only and GH-hosted CI can't use it either. No auth, no secret.
+  sr-artifactory-probe:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - name: Probe machine host reachability (no auth)
+        run: |
+          set +e
+          HOST=artifactory-uw2.adobeitc.com
+          PKG="https://$HOST/artifactory/api/npm/npm-quazar-gar-tf-remote/@semrush%2fai-seo-ts"
+          echo "== DNS resolution on the runner =="
+          getent ahosts "$HOST" || echo "(DNS resolution FAILED)"
+          echo "== TLS verify (public cert expected -> return code 0) =="
+          echo | openssl s_client -connect "$HOST:443" -servername "$HOST" 2>/dev/null \
+            | grep -E "Verify return code" || echo "(no TLS handshake)"
+          echo "== HTTP status hitting the npm repo, no auth =="
+          code=$(curl -sS -o /dev/null -w "%{http_code}" --max-time 30 "$PKG")
+          echo "http_code=$code"
+          case "$code" in
+            401|403) echo "RESULT: REACHABLE (auth required, as expected). GH-hosted CI can use this host once we have a scoped token." ;;
+            000)     echo "RESULT: NOT REACHABLE (connection failed/timeout). Likely internal-only; GH-hosted CI can't use it." ;;
+            2*|3*)   echo "RESULT: reachable, unexpected open access (http $code) - inspect above." ;;
+            *)       echo "RESULT: got http $code - inspect above." ;;
+          esac
+
   # Manually-triggered deploy for the serenity job runner worker (adobe/serenity-docs#186),
   # a second Lambda built from a distinct hedy --entryFile
   # (src/serenity-prompt-classification/index.js, deployed as
diff --git a/.npmrc b/.npmrc
index b6f27f1359..4246024762 100644
--- a/.npmrc
+++ b/.npmrc
@@ -1 +1,16 @@
 engine-strict=true
+
+# Semrush AI-SEO SDK (@semrush/ai-seo-ts, published under @quazar too) is served
+# from Adobe Artifactory. Use the MACHINE host artifactory-uw2.adobeitc.com, NOT
+# artifactory.corp.adobe.com — the corp host is behind Banyan ZTNA (interactive
+# human SSO) and is unreachable from CI. The machine host is reachable from
+# GitHub-hosted runners over the public internet with a public TLS cert; it only
+# needs a token. Verified in chore/sr-sdk-artifactory (PR probe: TLS ok, HTTP 401).
+#
+# Auth: set ARTIFACTORY_AUTH_TOKEN at install time. In CI, add it as a GitHub
+# Actions secret and export it into the install step's env. The token must be an
+# Artifactory access/identity token with READ scope on npm-quazar-gar-tf-remote.
+# (This is the only piece still outstanding — no such token is provisioned yet.)
+@semrush:registry=https://artifactory-uw2.adobeitc.com/artifactory/api/npm/npm-quazar-gar-tf-remote/
+@quazar:registry=https://artifactory-uw2.adobeitc.com/artifactory/api/npm/npm-quazar-gar-tf-remote/
+//artifactory-uw2.adobeitc.com/artifactory/api/npm/npm-quazar-gar-tf-remote/:_authToken=${ARTIFACTORY_AUTH_TOKEN}