@sequenceholdings/artifact-studio 0.1.12 → 0.2.0

package/dist/templates/react-vite/src/main.tsx

@@ -7,7 +7,13 @@ import './styles.css'
 
 const queryClient = new QueryClient()
 
-createRoot(document.getElementById('root')!).render(
+const root = createRoot(document.getElementById('root')!)
+// Platform (same-document) runtime: register so the host can unmount on
+// navigation. No-op inside the sandboxed iframe (registry is never installed).
+;(window as Window & { __atlasArtifactReactRoots__?: Set<{ unmount: () => void }> })
+  .__atlasArtifactReactRoots__?.add(root)
+
+root.render(
   <React.StrictMode>
     <QueryClientProvider client={queryClient}>
       <PortalContainerProvider>

package/dist/templates/react-vite/src/styles.css

@@ -1,3 +1,14 @@
 @import "tailwindcss";
 @import "tw-animate-css";
 @import "@sequenceholdings/atlas-ui/tokens.css";
+@import "@sequenceholdings/atlas-ui/tokens.v2.css";
+@import "@sequenceholdings/atlas-ui/theme.v2.css";
+
+/* Tailwind v4 skips node_modules during automatic source detection, so the
+   utility classes compiled into atlas-ui's components are never generated under
+   raw `pnpm dev`. The deploy build auto-injects this @source and the v2 sheets
+   above when missing (build.ts → atlas-ui-css-plugin); declare them here so
+   scaffolded artifacts render correctly in local vite dev too. Idempotent with
+   build-time injection. At DES-227 cutover, tokens.css becomes v2 — drop the
+   explicit tokens.v2 / theme.v2 imports (and the CLI stops injecting them). */
+@source "../node_modules/@sequenceholdings/atlas-ui/dist";

package/package.json

@@ -9,7 +9,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.1.12",
+  "version": "0.2.0",
   "description": "SDK types and CLI library for building Artifact Studio apps. Driven via `seq-studio artifact <sub>` (@sequenceholdings/studio-cli), which runs the `./cli` runCli export.",
   "type": "module",
   "exports": {
@@ -48,11 +48,24 @@
     "./trusted-install": {
       "types": "./dist/trusted-install.d.ts",
       "default": "./dist/trusted-install.js"
+    },
+    "./deployment-validation": {
+      "types": "./dist/deployment-validation.d.ts",
+      "default": "./dist/deployment-validation.js"
+    },
+    "./active-deploy-policy": {
+      "types": "./dist/active-deploy-policy.d.ts",
+      "default": "./dist/active-deploy-policy.js"
+    },
+    "./child-environment": {
+      "types": "./dist/child-environment.d.ts",
+      "default": "./dist/child-environment.js"
     }
   },
   "files": [
     "dist",
-    "templates"
+    "templates",
+    "VERSION-PIN.md"
   ],
   "dependencies": {
     "@tailwindcss/postcss": "^4.1.8",
@@ -67,8 +80,8 @@
     "tw-animate-css": "^1.4.0",
     "vite": "8.0.16",
     "zod": "^4.1.13",
-    "@sequenceholdings/atlas-ui": "0.1.3",
-    "@sequenceholdings/lattice-form-renderer": "0.1.0"
+    "@sequenceholdings/lattice-form-renderer": "0.1.1",
+    "@sequenceholdings/atlas-ui": "0.3.1"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
@@ -77,7 +90,7 @@
     "vitest": "^4.1.2"
   },
   "scripts": {
-    "build": "tsc && node scripts/copy-templates.mjs",
+    "build": "rm -rf dist && tsc && node scripts/copy-templates.mjs",
     "type-check": "tsc --noEmit",
     "test": "vitest run",
     "bench:build-isolation": "node --expose-gc scripts/bench-build-isolation.mjs"

package/templates/react-vite/AGENTS.md

@@ -0,0 +1,90 @@
+# Sequence Artifact Studio app
+
+This is a sandboxed iframe SPA that runs inside Atlas and talks to Atlas backend routes through a postMessage bridge exposed as `seq.api.*` from `@sequenceholdings/artifact-studio`. No direct network access, no API keys in the bundle — everything goes through the bridge, and every endpoint the artifact uses must be declared in `artifact.bundle.yml`.
+
+## Three rules that bite
+
+1. **Envelope unwrap.** Atlas wraps every CRM-style response in `{ success: true, data: T }`. The bridge passes that envelope through raw — it does **not** unwrap automatically. Route every read/write through `unwrap<T>()` in `src/lib/api.ts`:
+   ```ts
+   import { unwrap, seq } from './lib/api'
+   const customer = await unwrap<Customer>(seq.api.get(`/api/crm/customers/${id}`))
+   ```
+   For endpoints with extra envelope fields (pagination `meta`, warnings), drop to `seq.api.fetch` and read `res.body` directly.
+
+2. **FormData blocker.** `seq.api.fetch` `JSON.stringify`s any non-string `body` value, which silently turns `FormData` into `"{}"`. For multipart uploads, use `seq.api.upload(path, file, fields?, options?)`; the bridge constructs `FormData` in the trusted host and returns the usual `{ ok, status, body }` envelope.
+
+3. **Capability matcher: exact paths, `/*` prefix wildcards, and single-segment `*` patterns.** `{id}` template forms do **not** match. List both the bare path and the prefix wildcard for broad resources, or use a least-privilege segment pattern for dynamic routes:
+   ```yaml
+   - /api/crm/customers
+   - /api/crm/customers/*
+   - /api/lattice/runs/*/advance
+   ```
+
+## Prerequisite
+
+None — `seq-studio artifact init <dir>` works from any directory; no monorepo checkout is required. The template lists `@sequenceholdings/artifact-studio` and `@sequenceholdings/atlas-ui` in **devDependencies** for local editor/type-check tooling only. `seq-studio artifact build|deploy` bundles against the CLI's own pinned copies of `react`, `react-dom`, `@tanstack/react-query`, `react-router-dom`, `sonner`, and `@sequenceholdings/atlas-ui`, and resolves `@sequenceholdings/artifact-studio` to a virtual `window.seq` module. Remote deploys (`--repo` / `--git-url`) run `pnpm install --prod` for **app-specific** `dependencies` only (e.g. `recharts`, `reactflow`) from the artifact lockfile.
+
+## Package manager
+
+Use **pnpm** for artifacts you will deploy from git — `seq-studio artifact build|deploy --repo/--git-url` runs `pnpm install --frozen-lockfile --prod` when `package.json` is present, so commit `pnpm-lock.yaml`. Local editor-only installs can use another package manager, but pnpm keeps Sequence's `minimumReleaseAge` supply-chain quarantine in effect (see the studio-cli README). If you have a stale checkout from the old `file:`-link era, `rm -rf node_modules` and reinstall.
+
+## Key files
+
+| File | Role |
+|---|---|
+| `artifact.bundle.yml` | Capability manifest — every API path the artifact calls: exact paths, `/*` prefix wildcards, or single-segment `*` patterns |
+| `src/main.tsx` | Providers: `QueryClientProvider` → `PortalContainerProvider` → `App` |
+| `src/App.tsx` | Entrypoint UI |
+| `src/lib/api.ts` | `unwrap<T>` envelope helper + re-export of `seq` |
+| `src/styles.css` | Tailwind v4 + `@sequenceholdings/atlas-ui/tokens.css` (+ v2 sheets; build injects them when missing) |
+| `vite.config.ts` | Vite + React + Tailwind v4 plugin |
+
+## Defaults
+
+- UI: prefer `@sequenceholdings/atlas-ui` primitives (`Button`, `Card`, `Input`, `Dialog`, `Select`, `Checkbox`, `DropdownMenu`, `KpiTile`, `Switch`, …) over raw Tailwind. The design-system cutover made `Select`, `Checkbox`, `DropdownMenu`, `Command`, `Calendar`, `ScrollArea`, `Table`, and the Task family first-class exports — use them directly; fall back to `Popover` compositions or native controls only when a component is genuinely missing.
+- Routing: `HashRouter`. Mount routes at `/`, not at the Atlas app prefix.
+- Data: React Query is wired in `src/main.tsx`. Use `useQuery` / `useMutation` against `unwrap(seq.api.*)`.
+- Icons: do **not** add third-party deps like `@tabler/icons-react`. Deploys from git (`--repo` / `--git-url`) build a bare tree — `seq-studio` runs `pnpm install --prod` from your lockfile, then aliases platform peers (`react`, `react-dom`, `@tanstack/react-query`, `react-router-dom`, `sonner`, `@sequenceholdings/atlas-ui`). List only app-specific imports (e.g. `recharts`) in `dependencies`; do not add file/workspace `@sequenceholdings/*` specs in git-service repos, because remote installs only accept registry semver specs. Inline SVG components in `src/icons.tsx`.
+
+## Tokens — colour comes from semantic roles, never a raw ramp
+
+This app bundles `@sequenceholdings/atlas-ui/tokens.css` and re-themes per tenant for free. Reach for a **semantic role** and colour follows the host brand and light/dark automatically.
+
+**Never** use the numbered `black-*` / `white-*` opacity scales (`text-black-40`, `bg-black-6`, `border-black-10`), raw Tailwind neutrals (`gray|slate|zinc|neutral|stone-N`), arbitrary hex in class strings (`bg-[#1f2937]`), or `var(--black-*)` / `var(--color-black-*)`. These are **retired** — post-cutover they resolve to nothing or to a fixed ink that won't flip in dark. Bare `text-white` / `bg-black` and opacity modifiers like `bg-foreground/10` stay legal; only the numbered steps and raw palettes are banned. There is no old→new lookup table on purpose — pick by *what the element is and what it sits on*.
+
+| Situation | Role |
+|---|---|
+| The page surface | `bg-background` — the page only, never a panel |
+| Bordered/rounded panel, card, list | `bg-card` — a border is not a surface; every bordered container needs an explicit surface |
+| Inset well inside a card (code block, read-only value) | `bg-muted` |
+| Form field (input, textarea, select trigger) | `bg-field` |
+| Interactive / hover fill | `bg-accent` / `bg-surface-hover` |
+| Selected / active / focus state fill | `bg-foreground/8`–`bg-foreground/15` overlay |
+| Modal scrim behind a dialog | `bg-overlay` — never `bg-foreground/N` (washes lighter in dark) |
+| Primary text | `text-foreground` |
+| Resting nav items, meta rows | `text-foreground-secondary` |
+| Section labels, captions | `text-muted-foreground` |
+| Standard border | `border-border` (form controls: `border-input`) |
+
+Surfaces **nest** — never repeat a rung (`bg-card` inside `bg-card` is invisible): `bg-background` (page) → `bg-card` (panel, + border + `shadow-xs` to lift) → `bg-muted` (inset well).
+
+**Dual-runtime.** Inside Atlas the artifact runs in its own iframe and inherits nothing — the runtime posts the host's resolved brand in as inline custom properties (theme channel + `data-tokens`). Standalone `vite dev` has no host, so the artifact must still render on the base semantic roles. **Do not** bundle `tokens.v2.tenants.css`, hardcode an opco's brand, or add `[data-theme]` selectors — that pins the artifact to one tenant.
+
+## Bridge methods
+
+Two primitives on `seq.api`:
+
+- `seq.api.fetch(path, options?)` returns `{ ok, status, body }` — does not throw on non-2xx. Use when you need the status (e.g. handle 409) or the raw envelope with extra fields like `meta`.
+- `seq.api.request(method, path, body?)` throws on non-2xx and returns parsed JSON. Sugar wrappers `seq.api.get / .post / .patch / .delete` are thin shells around `request`, so they also throw.
+
+Wrap reads/writes that should auto-throw through `unwrap()` in `src/lib/api.ts`. Drop to `seq.api.fetch` when you need pagination `meta` or status inspection.
+
+## Lattice embed context
+
+When the artifact is served from a Lattice human node (the **Tasks/Inbox** task surface, or the builder Artifacts tab), `seq.lattice.context()` tells you which run/node/step you're rendering for:
+
+```ts
+const { runId, nodeId, stepId, processId } = seq.lattice.context()
+```
+
+It's **synchronous** (the host injects this into the sandbox up front — no bridge round trip) and each field is `null` when unavailable. The Inbox provides all four; the builder Artifacts tab has no live `stepId`; a standalone open has no context at all. Use it instead of hand-parsing `window.location` — that's the sanctioned, stable accessor, and you don't need to declare anything in `artifact.bundle.yml` for it. To read step-scoped data, pass `runId`/`stepId` to the relevant Atlas endpoint (which still authorizes the caller server-side).

package/templates/react-vite/CLAUDE.md

@@ -1,66 +1,7 @@
 # Sequence Artifact Studio app
 
-This is a sandboxed iframe SPA that runs inside Atlas and talks to Atlas backend routes through a postMessage bridge exposed as `seq.api.*` from `@sequenceholdings/artifact-studio`. No direct network access, no API keys in the bundle — everything goes through the bridge, and every endpoint the artifact uses must be declared in `artifact.bundle.yml`.
+Agent instructions for this artifact live in `AGENTS.md` — one file every coding agent reads
+(Cursor and Codex load `AGENTS.md` natively; the import below pulls it in for Claude Code).
+Add or edit guidance in `AGENTS.md`, not here.
 
-## Three rules that bite
-
-1. **Envelope unwrap.** Atlas wraps every CRM-style response in `{ success: true, data: T }`. The bridge passes that envelope through raw — it does **not** unwrap automatically. Route every read/write through `unwrap<T>()` in `src/lib/api.ts`:
-   ```ts
-   import { unwrap, seq } from './lib/api'
-   const customer = await unwrap<Customer>(seq.api.get(`/api/crm/customers/${id}`))
-   ```
-   For endpoints with extra envelope fields (pagination `meta`, warnings), drop to `seq.api.fetch` and read `res.body` directly.
-
-2. **FormData blocker.** `seq.api.fetch` `JSON.stringify`s any non-string `body` value, which silently turns `FormData` into `"{}"`. For uploads, base64-encode the bytes and POST as JSON, or patch the Atlas bridge first.
-
-3. **Capability matcher: exact paths, `/*` prefix wildcards, and single-segment `*` patterns.** `{id}` template forms do **not** match. List both the bare path and the prefix wildcard for broad resources, or use a least-privilege segment pattern for dynamic routes:
-   ```yaml
-   - /api/crm/customers
-   - /api/crm/customers/*
-   - /api/lattice/runs/*/advance
-   ```
-
-## Prerequisite
-
-None — `seq-studio artifact init <dir>` works from any directory; no monorepo checkout is required. The template lists `@sequenceholdings/artifact-studio` and `@sequenceholdings/atlas-ui` in **devDependencies** for local editor/type-check tooling only. `seq-studio artifact build|deploy` bundles against the CLI's own pinned copies of `react`, `react-dom`, `@tanstack/react-query`, `react-router-dom`, `sonner`, and `@sequenceholdings/atlas-ui`, and resolves `@sequenceholdings/artifact-studio` to a virtual `window.seq` module. Remote deploys (`--repo` / `--git-url`) run `pnpm install --prod` for **app-specific** `dependencies` only (e.g. `recharts`, `reactflow`) from the artifact lockfile.
-
-## Package manager
-
-Use **pnpm** for artifacts you will deploy from git — `seq-studio artifact build|deploy --repo/--git-url` runs `pnpm install --frozen-lockfile --prod` when `package.json` is present, so commit `pnpm-lock.yaml`. Local editor-only installs can use another package manager, but pnpm keeps Sequence's `minimumReleaseAge` supply-chain quarantine in effect (see the studio-cli README). If you have a stale checkout from the old `file:`-link era, `rm -rf node_modules` and reinstall.
-
-## Key files
-
-| File | Role |
-|---|---|
-| `artifact.bundle.yml` | Capability manifest — every API path the artifact calls: exact paths, `/*` prefix wildcards, or single-segment `*` patterns |
-| `src/main.tsx` | Providers: `QueryClientProvider` → `PortalContainerProvider` → `App` |
-| `src/App.tsx` | Entrypoint UI |
-| `src/lib/api.ts` | `unwrap<T>` envelope helper + re-export of `seq` |
-| `src/styles.css` | Tailwind v4 + `@sequenceholdings/atlas-ui/tokens.css` |
-| `vite.config.ts` | Vite + React + Tailwind v4 plugin |
-
-## Defaults
-
-- UI: prefer `@sequenceholdings/atlas-ui` primitives (`Button`, `Card`, `Input`, `Dialog`, `Select`, `Checkbox`, `DropdownMenu`, `KpiTile`, `Switch`, …) over raw Tailwind. The design-system cutover made `Select`, `Checkbox`, `DropdownMenu`, `Command`, `Calendar`, `DatePicker`, `ScrollArea`, `Table`, and the Task family first-class exports — use them directly; fall back to `Popover` compositions or native controls only when a component is genuinely missing.
-- Routing: `HashRouter`. Mount routes at `/`, not at the Atlas app prefix.
-- Data: React Query is wired in `src/main.tsx`. Use `useQuery` / `useMutation` against `unwrap(seq.api.*)`.
-- Icons: do **not** add third-party deps like `@tabler/icons-react`. Deploys from git (`--repo` / `--git-url`) build a bare tree — `seq-studio` runs `pnpm install --prod` from your lockfile, then aliases platform peers (`react`, `react-dom`, `@tanstack/react-query`, `react-router-dom`, `sonner`, `@sequenceholdings/atlas-ui`). List only app-specific imports (e.g. `recharts`) in `dependencies`; do not add file/workspace `@sequenceholdings/*` specs in git-service repos, because remote installs only accept registry semver specs. Inline SVG components in `src/icons.tsx`.
-
-## Bridge methods
-
-Two primitives on `seq.api`:
-
-- `seq.api.fetch(path, options?)` returns `{ ok, status, body }` — does not throw on non-2xx. Use when you need the status (e.g. handle 409) or the raw envelope with extra fields like `meta`.
-- `seq.api.request(method, path, body?)` throws on non-2xx and returns parsed JSON. Sugar wrappers `seq.api.get / .post / .patch / .delete` are thin shells around `request`, so they also throw.
-
-Wrap reads/writes that should auto-throw through `unwrap()` in `src/lib/api.ts`. Drop to `seq.api.fetch` when you need pagination `meta` or status inspection.
-
-## Lattice embed context
-
-When the artifact is served from a Lattice human node (the **Tasks/Inbox** task surface, or the builder Artifacts tab), `seq.lattice.context()` tells you which run/node/step you're rendering for:
-
-```ts
-const { runId, nodeId, stepId, processId } = seq.lattice.context()
-```
-
-It's **synchronous** (the host injects this into the sandbox up front — no bridge round trip) and each field is `null` when unavailable. The Inbox provides all four; the builder Artifacts tab has no live `stepId`; a standalone open has no context at all. Use it instead of hand-parsing `window.location` — that's the sanctioned, stable accessor, and you don't need to declare anything in `artifact.bundle.yml` for it. To read step-scoped data, pass `runId`/`stepId` to the relevant Atlas endpoint (which still authorizes the caller server-side).
+@AGENTS.md

package/templates/react-vite/src/main.tsx

@@ -7,7 +7,13 @@ import './styles.css'
 
 const queryClient = new QueryClient()
 
-createRoot(document.getElementById('root')!).render(
+const root = createRoot(document.getElementById('root')!)
+// Platform (same-document) runtime: register so the host can unmount on
+// navigation. No-op inside the sandboxed iframe (registry is never installed).
+;(window as Window & { __atlasArtifactReactRoots__?: Set<{ unmount: () => void }> })
+  .__atlasArtifactReactRoots__?.add(root)
+
+root.render(
   <React.StrictMode>
     <QueryClientProvider client={queryClient}>
       <PortalContainerProvider>

package/templates/react-vite/src/styles.css

@@ -1,3 +1,14 @@
 @import "tailwindcss";
 @import "tw-animate-css";
 @import "@sequenceholdings/atlas-ui/tokens.css";
+@import "@sequenceholdings/atlas-ui/tokens.v2.css";
+@import "@sequenceholdings/atlas-ui/theme.v2.css";
+
+/* Tailwind v4 skips node_modules during automatic source detection, so the
+   utility classes compiled into atlas-ui's components are never generated under
+   raw `pnpm dev`. The deploy build auto-injects this @source and the v2 sheets
+   above when missing (build.ts → atlas-ui-css-plugin); declare them here so
+   scaffolded artifacts render correctly in local vite dev too. Idempotent with
+   build-time injection. At DES-227 cutover, tokens.css becomes v2 — drop the
+   explicit tokens.v2 / theme.v2 imports (and the CLI stops injecting them). */
+@source "../node_modules/@sequenceholdings/atlas-ui/dist";

package/dist/auth.d.ts

@@ -1,2 +0,0 @@
-export declare function loginWithPkce(): Promise<void>;
-export declare function getAccessToken(): Promise<string | null>;

package/dist/auth.js

@@ -1,129 +0,0 @@
-import { createHash, randomBytes } from 'node:crypto';
-import { createServer } from 'node:http';
-import { spawn } from 'node:child_process';
-import { writeTokenConfig, readTokenConfig } from './config.js';
-const REDIRECT_PORT = 5099;
-const REDIRECT_URI = `http://localhost:${REDIRECT_PORT}`;
-const DEFAULT_AUTH0_DOMAIN = 'dev-n1t8ts403fp8oyxp.us.auth0.com';
-const DEFAULT_AUTH0_CLIENT_ID = 'GD9riCDWocfc66odpWBjwBiX43qqAX8r';
-const DEFAULT_AUTH0_AUDIENCE = 'https://api.studio.com';
-function envOr(name, fallback) {
-    return process.env[name]?.trim() || fallback;
-}
-function readAuth0Config() {
-    return {
-        domain: envOr('ARTIFACT_STUDIO_AUTH0_DOMAIN', DEFAULT_AUTH0_DOMAIN),
-        clientId: envOr('ARTIFACT_STUDIO_AUTH0_CLIENT_ID', DEFAULT_AUTH0_CLIENT_ID),
-        audience: envOr('ARTIFACT_STUDIO_AUTH0_AUDIENCE', DEFAULT_AUTH0_AUDIENCE),
-    };
-}
-function base64Url(input) {
-    return input.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
-}
-function openBrowser(url) {
-    const command = process.platform === 'darwin'
-        ? 'open'
-        : process.platform === 'win32'
-            ? 'cmd'
-            : 'xdg-open';
-    const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
-    const child = spawn(command, args, { stdio: 'ignore', detached: true });
-    child.unref();
-}
-export async function loginWithPkce() {
-    const config = readAuth0Config();
-    const verifier = base64Url(randomBytes(32));
-    const challenge = base64Url(createHash('sha256').update(verifier).digest());
-    const authUrl = new URL(`https://${config.domain}/authorize`);
-    authUrl.searchParams.set('response_type', 'code');
-    authUrl.searchParams.set('client_id', config.clientId);
-    authUrl.searchParams.set('redirect_uri', REDIRECT_URI);
-    authUrl.searchParams.set('scope', 'openid profile email offline_access');
-    authUrl.searchParams.set('audience', config.audience);
-    authUrl.searchParams.set('code_challenge', challenge);
-    authUrl.searchParams.set('code_challenge_method', 'S256');
-    const code = await waitForCode(authUrl.toString());
-    const tokenResponse = await fetch(`https://${config.domain}/oauth/token`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-            grant_type: 'authorization_code',
-            client_id: config.clientId,
-            code,
-            redirect_uri: REDIRECT_URI,
-            code_verifier: verifier,
-        }),
-    });
-    if (!tokenResponse.ok) {
-        throw new Error(`Auth0 token exchange failed: ${await tokenResponse.text()}`);
-    }
-    const tokens = await tokenResponse.json();
-    if (!tokens.refresh_token) {
-        throw new Error('No refresh token returned. Ensure Auth0 offline access is enabled.');
-    }
-    await writeTokenConfig({
-        accessToken: tokens.access_token,
-        refreshToken: tokens.refresh_token,
-        expiresAt: Date.now() + (tokens.expires_in ?? 86400) * 1000,
-    });
-}
-export async function getAccessToken() {
-    const tokens = await readTokenConfig();
-    if (!tokens.accessToken && !tokens.refreshToken)
-        return null;
-    if (tokens.accessToken && tokens.expiresAt && Date.now() < tokens.expiresAt - 60_000) {
-        return tokens.accessToken;
-    }
-    if (!tokens.refreshToken)
-        return tokens.accessToken ?? null;
-    const config = readAuth0Config();
-    const response = await fetch(`https://${config.domain}/oauth/token`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-            grant_type: 'refresh_token',
-            client_id: config.clientId,
-            refresh_token: tokens.refreshToken,
-        }),
-    });
-    if (!response.ok) {
-        throw new Error('Stored refresh token is no longer valid. Run seq-studio login again.');
-    }
-    const refreshed = await response.json();
-    await writeTokenConfig({
-        accessToken: refreshed.access_token,
-        refreshToken: refreshed.refresh_token ?? tokens.refreshToken,
-        expiresAt: Date.now() + (refreshed.expires_in ?? 86400) * 1000,
-    });
-    return refreshed.access_token;
-}
-async function waitForCode(authUrl) {
-    return new Promise((resolve, reject) => {
-        const server = createServer((req, res) => {
-            const url = new URL(req.url ?? '/', REDIRECT_URI);
-            const code = url.searchParams.get('code');
-            const error = url.searchParams.get('error');
-            if (error) {
-                res.writeHead(400, { 'content-type': 'text/plain' });
-                res.end(`Login failed: ${error}`);
-                server.close();
-                reject(new Error(`Auth0 login failed: ${error}`));
-                return;
-            }
-            if (!code) {
-                res.writeHead(400, { 'content-type': 'text/plain' });
-                res.end('Missing authorization code');
-                return;
-            }
-            res.writeHead(200, { 'content-type': 'text/html' });
-            res.end('<h1>Artifact Studio login complete</h1><p>You may close this tab.</p>');
-            server.close();
-            resolve(code);
-        });
-        server.once('error', reject);
-        server.listen(REDIRECT_PORT, () => {
-            console.log(`Opening browser for Auth0 login. If it does not open, visit:\n${authUrl}`);
-            openBrowser(authUrl);
-        });
-    });
-}