@sequenceholdings/artifact-studio 0.1.6 → 0.1.9

package/dist/templates/react-vite/CLAUDE.md

@@ -13,25 +13,26 @@ This is a sandboxed iframe SPA that runs inside Atlas and talks to Atlas backend
 
 2. **FormData blocker.** `seq.api.fetch` `JSON.stringify`s any non-string `body` value, which silently turns `FormData` into `"{}"`. For uploads, base64-encode the bytes and POST as JSON, or patch the Atlas bridge first.
 
-3. **Capability matcher: exact path or `/*` prefix wildcard only.** `{id}` template forms do **not** match. List both the bare path and the prefix wildcard in `artifact.bundle.yml`:
+3. **Capability matcher: exact paths, `/*` prefix wildcards, and single-segment `*` patterns.** `{id}` template forms do **not** match. List both the bare path and the prefix wildcard for broad resources, or use a least-privilege segment pattern for dynamic routes:
    ```yaml
    - /api/crm/customers
    - /api/crm/customers/*
+   - /api/lattice/runs/*/advance
    ```
 
 ## Prerequisite
 
-`artifact-studio init` requires the Sequence monorepo checked out locally. The CLI rewrites `"@sequenceholdings/atlas-ui": "workspace:*"` and the `@sequenceholdings/artifact-studio` version in this `package.json` to local `file:` paths against the monorepo's `shared/services/atlas-ui` and `shared/services/artifact-studio`. Without the monorepo the rewrite no-ops, and `npm install` fails with `EUNSUPPORTEDPROTOCOL` on `workspace:*` — those two packages aren't published to npm. Run init from inside the monorepo, e.g. `pnpm --dir atlas artifact-studio init <dir>`.
+None — `seq-studio artifact init <dir>` works from any directory; no monorepo checkout is required. The template lists `@sequenceholdings/artifact-studio` and `@sequenceholdings/atlas-ui` in **devDependencies** for local editor/type-check tooling only. `seq-studio artifact build|deploy` bundles against the CLI's own pinned copies of `react`, `react-dom`, `@tanstack/react-query`, `react-router-dom`, `sonner`, and `@sequenceholdings/atlas-ui`, and resolves `@sequenceholdings/artifact-studio` to a virtual `window.seq` module. Remote deploys (`--repo` / `--git-url`) run `pnpm install --prod` for **app-specific** `dependencies` only (e.g. `recharts`, `reactflow`) from the artifact lockfile.
 
-## Package manager: npm, not pnpm
+## Package manager
 
-Once the CLI has rewritten the deps, use `npm install`, not `pnpm install`. The linked `@sequenceholdings/artifact-studio` package carries `"@sequenceholdings/atlas-ui": "workspace:*"` in its own `package.json`; npm tolerates an unresolved `workspace:*` inside a file-linked dep, pnpm errors with `ERR_PNPM_WORKSPACE_PKG_NOT_FOUND`. If a `pnpm-lock.yaml` already exists, `rm -rf node_modules pnpm-lock.yaml` before `npm install`.
+Use **pnpm** for artifacts you will deploy from git — `seq-studio artifact build|deploy --repo/--git-url` runs `pnpm install --frozen-lockfile --prod` when `package.json` is present, so commit `pnpm-lock.yaml`. Local editor-only installs can use another package manager, but pnpm keeps Sequence's `minimumReleaseAge` supply-chain quarantine in effect (see the studio-cli README). If you have a stale checkout from the old `file:`-link era, `rm -rf node_modules` and reinstall.
 
 ## Key files
 
 | File | Role |
 |---|---|
-| `artifact.bundle.yml` | Capability manifest — every API path the artifact calls, exact + `/*` |
+| `artifact.bundle.yml` | Capability manifest — every API path the artifact calls: exact paths, `/*` prefix wildcards, or single-segment `*` patterns |
 | `src/main.tsx` | Providers: `QueryClientProvider` → `PortalContainerProvider` → `App` |
 | `src/App.tsx` | Entrypoint UI |
 | `src/lib/api.ts` | `unwrap<T>` envelope helper + re-export of `seq` |
@@ -40,10 +41,10 @@ Once the CLI has rewritten the deps, use `npm install`, not `pnpm install`. The
 
 ## Defaults
 
-- UI: prefer `@sequenceholdings/atlas-ui` primitives (`Button`, `Card`, `Input`, `Dialog`, `KpiTile`, `Switch`, …) over raw Tailwind. `Select`, `Checkbox`, and `DropdownMenu` are not exported — use native `<select>`, `Switch`, and `Popover` respectively.
+- UI: prefer `@sequenceholdings/atlas-ui` primitives (`Button`, `Card`, `Input`, `Dialog`, `Select`, `Checkbox`, `DropdownMenu`, `KpiTile`, `Switch`, …) over raw Tailwind. The design-system cutover made `Select`, `Checkbox`, `DropdownMenu`, `Command`, `Calendar`, `DatePicker`, `ScrollArea`, `Table`, and the Task family first-class exports — use them directly; fall back to `Popover` compositions or native controls only when a component is genuinely missing.
 - Routing: `HashRouter`. Mount routes at `/`, not at the Atlas app prefix.
 - Data: React Query is wired in `src/main.tsx`. Use `useQuery` / `useMutation` against `unwrap(seq.api.*)`.
-- Icons: do **not** install `@tabler/icons-react` — it won't resolve from the artifact's local `node_modules`. Inline SVG components in `src/icons.tsx`.
+- Icons: do **not** add third-party deps like `@tabler/icons-react`. Deploys from git (`--repo` / `--git-url`) build a bare tree — `seq-studio` runs `pnpm install --prod` from your lockfile, then aliases platform peers (`react`, `react-dom`, `@tanstack/react-query`, `react-router-dom`, `sonner`, `@sequenceholdings/atlas-ui`). List only app-specific imports (e.g. `recharts`) in `dependencies`; do not add file/workspace `@sequenceholdings/*` specs in git-service repos, because remote installs only accept registry semver specs. Inline SVG components in `src/icons.tsx`.
 
 ## Bridge methods
 
@@ -53,3 +54,13 @@ Two primitives on `seq.api`:
 - `seq.api.request(method, path, body?)` throws on non-2xx and returns parsed JSON. Sugar wrappers `seq.api.get / .post / .patch / .delete` are thin shells around `request`, so they also throw.
 
 Wrap reads/writes that should auto-throw through `unwrap()` in `src/lib/api.ts`. Drop to `seq.api.fetch` when you need pagination `meta` or status inspection.
+
+## Lattice embed context
+
+When the artifact is served from a Lattice human node (the **Tasks/Inbox** task surface, or the builder Artifacts tab), `seq.lattice.context()` tells you which run/node/step you're rendering for:
+
+```ts
+const { runId, nodeId, stepId, processId } = seq.lattice.context()
+```
+
+It's **synchronous** (the host injects this into the sandbox up front — no bridge round trip) and each field is `null` when unavailable. The Inbox provides all four; the builder Artifacts tab has no live `stepId`; a standalone open has no context at all. Use it instead of hand-parsing `window.location` — that's the sanctioned, stable accessor, and you don't need to declare anything in `artifact.bundle.yml` for it. To read step-scoped data, pass `runId`/`stepId` to the relevant Atlas endpoint (which still authorizes the caller server-side).

package/dist/templates/react-vite/package.json

@@ -7,20 +7,21 @@
     "build": "vite build",
     "preview": "vite preview"
   },
-  "dependencies": {
+  "dependencies": {},
+  "devDependencies": {
     "@sequenceholdings/artifact-studio": "^0.1.0",
     "@sequenceholdings/atlas-ui": "^0.1.0",
-    "@tanstack/react-query": "^4.36.1",
-    "react": "^18.2.0",
-    "react-dom": "^18.2.0"
-  },
-  "devDependencies": {
     "@tailwindcss/postcss": "^4.2.2",
     "@tailwindcss/vite": "^4.2.2",
+    "@tanstack/react-query": "^4.36.1",
     "@vitejs/plugin-react": "^5.0.0",
+    "react": "^18.2.0",
+    "react-dom": "^18.2.0",
+    "react-router-dom": "^6.28.0",
+    "sonner": "^2.0.7",
     "tailwindcss": "^4.2.2",
     "tw-animate-css": "^1.4.0",
     "typescript": "^5.6.0",
-    "vite": "8.0.8"
+    "vite": "8.0.16"
   }
 }

package/dist/trusted-install.d.ts

@@ -0,0 +1,13 @@
+export declare class ArtifactInstallTrustError extends Error {
+    readonly name = "ArtifactInstallTrustError";
+}
+/** Dot optional — matches both `pnpmfile.cjs` and `.pnpmfile.cjs`. */
+export declare const PNPM_HOOK_FILE_RE: RegExp;
+export declare const PNPM_WORKSPACE_FILE_RE: RegExp;
+/** Platform peers the CLI aliases at build time — must not be prod-installed remotely. */
+export declare const REMOTE_INSTALL_PLATFORM_PACKAGES: Set<string>;
+/**
+ * Reject install-control files and non-registry dependency specs before a remote
+ * `pnpm install` runs on an untrusted git checkout.
+ */
+export declare function assertTrustedArtifactInstallTree(dir: string): void;

package/dist/trusted-install.js

@@ -0,0 +1,186 @@
+import { readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { classifyLockfileOrigin } from './lockfile-origin.js';
+export class ArtifactInstallTrustError extends Error {
+    name = 'ArtifactInstallTrustError';
+}
+/** Dot optional — matches both `pnpmfile.cjs` and `.pnpmfile.cjs`. */
+export const PNPM_HOOK_FILE_RE = /(^|\/)\.?pnpmfile\.cjs$/;
+export const PNPM_WORKSPACE_FILE_RE = /(^|\/)pnpm-workspace\.ya?ml$/;
+const NON_REGISTRY_SPEC_RE = /^(git\+|git:|github:|gitlab:|bitbucket:|https?:|file:|link:|workspace:|catalog:|\.{0,2}\/)/i;
+const DEPENDENCY_SECTIONS = [
+    'dependencies',
+    'devDependencies',
+    'optionalDependencies',
+    'peerDependencies',
+];
+const LOCKFILE_FORBIDDEN_RE = /(^|[\s{,])(repo|commit|directory):\s/m;
+const LOCKFILE_TARBALL_RE = /(^|[\s{,])tarball:\s*([^\n,}]+)/g;
+const ALLOWED_TARBALL_PREFIXES = [
+    'https://libraries.cgr.dev/javascript/',
+    'https://libraries.cgr.dev/javascript-upstream/',
+];
+const EXCLUDED_DIRS = new Set(['node_modules', '.git']);
+/** Platform peers the CLI aliases at build time — must not be prod-installed remotely. */
+export const REMOTE_INSTALL_PLATFORM_PACKAGES = new Set([
+    'react',
+    'react-dom',
+    '@tanstack/react-query',
+    'react-router-dom',
+    'sonner',
+    '@sequenceholdings/atlas-ui',
+    '@sequenceholdings/lattice-form-renderer',
+    '@sequenceholdings/artifact-studio',
+]);
+function listRelativeFiles(dir, prefix = '') {
+    const paths = [];
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
+        if (entry.isSymbolicLink()) {
+            throw new ArtifactInstallTrustError(`Symlinks are not allowed in remote artifact sources (${rel})`);
+        }
+        if (entry.isDirectory()) {
+            if (EXCLUDED_DIRS.has(entry.name))
+                continue;
+            paths.push(...listRelativeFiles(join(dir, entry.name), rel));
+            continue;
+        }
+        if (entry.isFile())
+            paths.push(rel);
+    }
+    return paths;
+}
+function isNonRegistrySpec(spec) {
+    if (typeof spec !== 'string')
+        return false;
+    if (spec.startsWith('$'))
+        return false;
+    if (spec.startsWith('npm:')) {
+        const target = spec.slice(4);
+        return NON_REGISTRY_SPEC_RE.test(target) || target.includes('/');
+    }
+    return NON_REGISTRY_SPEC_RE.test(spec) || spec.includes('/');
+}
+function assertNoPackageManagerSelection(pkg) {
+    if (typeof pkg.packageManager === 'string' && pkg.packageManager.trim() !== '') {
+        throw new ArtifactInstallTrustError('package.json sets packageManager — remote artifact installs use the seq-studio pinned pnpm binary');
+    }
+    const devEngines = pkg.devEngines;
+    if (devEngines && typeof devEngines === 'object' && 'packageManager' in devEngines) {
+        const pm = devEngines.packageManager;
+        if (pm !== undefined && pm !== null) {
+            throw new ArtifactInstallTrustError('package.json sets devEngines.packageManager — remote artifact installs use the seq-studio pinned pnpm binary');
+        }
+    }
+}
+function assertRegistryOnlySpecMap(map, label) {
+    if (!map || typeof map !== 'object')
+        return;
+    for (const [name, spec] of Object.entries(map)) {
+        if (isNonRegistrySpec(spec)) {
+            throw new ArtifactInstallTrustError(`${label} "${name}" uses a non-registry spec ("${String(spec)}") — only registry semver ranges are allowed`);
+        }
+    }
+}
+/** Sections installed by `pnpm install --prod` (devDependencies are omitted). */
+const PROD_INSTALL_SECTIONS = ['dependencies', 'optionalDependencies'];
+function assertNoPlatformPackagesInProdSections(dir) {
+    const raw = readFileSync(join(dir, 'package.json'), 'utf8');
+    let pkg;
+    try {
+        pkg = JSON.parse(raw);
+    }
+    catch {
+        throw new ArtifactInstallTrustError('package.json is not valid JSON');
+    }
+    for (const section of PROD_INSTALL_SECTIONS) {
+        const deps = pkg[section];
+        if (!deps || typeof deps !== 'object')
+            continue;
+        for (const name of Object.keys(deps)) {
+            if (REMOTE_INSTALL_PLATFORM_PACKAGES.has(name)) {
+                throw new ArtifactInstallTrustError(`Dependency "${name}" is a platform peer aliased by seq-studio at build time — move it to devDependencies (local editor tooling only) and keep only app-specific packages in dependencies for git-service deploys`);
+            }
+        }
+    }
+}
+function assertRegistryOnlyPackageJson(dir) {
+    const raw = readFileSync(join(dir, 'package.json'), 'utf8');
+    let pkg;
+    try {
+        pkg = JSON.parse(raw);
+    }
+    catch {
+        throw new ArtifactInstallTrustError('package.json is not valid JSON');
+    }
+    for (const section of DEPENDENCY_SECTIONS) {
+        assertRegistryOnlySpecMap(pkg[section], 'Dependency');
+    }
+    assertRegistryOnlySpecMap(pkg.resolutions, 'Resolution override');
+    assertNoPackageManagerSelection(pkg);
+    const pnpmConfig = pkg.pnpm;
+    if (pnpmConfig && typeof pnpmConfig === 'object') {
+        const cfg = pnpmConfig;
+        const patched = cfg.patchedDependencies;
+        if (patched && typeof patched === 'object' && Object.keys(patched).length > 0) {
+            throw new ArtifactInstallTrustError('package.json sets pnpm.patchedDependencies — dependency patches are not allowed in remote artifact installs');
+        }
+        assertRegistryOnlySpecMap(cfg.overrides, 'pnpm override');
+        const exts = cfg.packageExtensions;
+        if (exts && typeof exts === 'object') {
+            for (const [extName, ext] of Object.entries(exts)) {
+                if (!ext || typeof ext !== 'object')
+                    continue;
+                const extObj = ext;
+                for (const section of DEPENDENCY_SECTIONS) {
+                    assertRegistryOnlySpecMap(extObj[section], `pnpm packageExtensions "${extName}" ${section}`);
+                }
+            }
+        }
+    }
+}
+function normalizeYamlScalar(raw) {
+    const trimmed = raw.trim();
+    if (trimmed.length >= 2 &&
+        (trimmed[0] === '"' || trimmed[0] === "'") &&
+        trimmed[trimmed.length - 1] === trimmed[0]) {
+        return trimmed.slice(1, -1);
+    }
+    return trimmed;
+}
+function assertChainguardLockfile(dir) {
+    const lockfileText = readFileSync(join(dir, 'pnpm-lock.yaml'), 'utf8');
+    if (classifyLockfileOrigin(lockfileText) !== 'chainguard') {
+        throw new ArtifactInstallTrustError('pnpm-lock.yaml must be resolved against Chainguard (registry=https://libraries.cgr.dev/javascript/) — regenerate locally and commit the lockfile');
+    }
+    const forbidden = LOCKFILE_FORBIDDEN_RE.exec(lockfileText);
+    if (forbidden) {
+        throw new ArtifactInstallTrustError(`pnpm-lock.yaml resolves at least one dependency outside the registry (found "${forbidden[2]}:" resolution)`);
+    }
+    for (const match of lockfileText.matchAll(LOCKFILE_TARBALL_RE)) {
+        const tarball = normalizeYamlScalar(match[2] ?? '');
+        if (!ALLOWED_TARBALL_PREFIXES.some((prefix) => tarball.startsWith(prefix))) {
+            throw new ArtifactInstallTrustError(`pnpm-lock.yaml tarball resolution "${tarball}" is not from the Chainguard registry`);
+        }
+    }
+}
+/**
+ * Reject install-control files and non-registry dependency specs before a remote
+ * `pnpm install` runs on an untrusted git checkout.
+ */
+export function assertTrustedArtifactInstallTree(dir) {
+    for (const rel of listRelativeFiles(dir)) {
+        if (rel === '.npmrc' || rel.endsWith('/.npmrc')) {
+            throw new ArtifactInstallTrustError('Source .npmrc is not allowed — seq-studio pins the registry in a controlled install config');
+        }
+        if (PNPM_HOOK_FILE_RE.test(rel)) {
+            throw new ArtifactInstallTrustError(`${rel} is not allowed — pnpm hook files execute during install`);
+        }
+        if (PNPM_WORKSPACE_FILE_RE.test(rel)) {
+            throw new ArtifactInstallTrustError(`${rel} is not allowed — pnpm-workspace.yaml can redirect dependencies outside the pinned registry`);
+        }
+    }
+    assertNoPlatformPackagesInProdSections(dir);
+    assertRegistryOnlyPackageJson(dir);
+    assertChainguardLockfile(dir);
+}

package/dist/watch-loop.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Non-overlapping poll loop for watch-style commands (e.g. `artifact dev`).
+ *
+ * A naive `setInterval(tick, intervalMs)` fires on a fixed cadence
+ * regardless of whether the previous `tick` finished. When `tick` is an
+ * expensive, CPU-bound rebuild that runs longer than `intervalMs`, builds
+ * stack up concurrently — each holding a full in-memory module graph —
+ * and contend for CPU/heap, which makes each build slower, which lets even
+ * more pile up. That positive-feedback loop is unbounded and OOMs the
+ * process.
+ *
+ * This scheduler guarantees a single `tick` is ever in flight: it awaits
+ * the current tick, then waits `intervalMs`, then repeats — so the next
+ * tick never starts until the previous one has fully settled.
+ */
+export interface RunWatchLoopOptions {
+    /** The work to run each cycle. Awaited to completion before the next cycle is scheduled. */
+    tick: () => Promise<void>;
+    /** Idle delay between the end of one tick and the start of the next. */
+    intervalMs: number;
+    /** Aborting stops the loop: no further tick runs and the returned promise resolves. */
+    signal: AbortSignal;
+    /** Invoked when a `tick` rejects. The loop continues regardless — one failure never kills it. */
+    onError?: (error: unknown) => void;
+}
+export declare function runWatchLoop({ tick, intervalMs, signal, onError, }: RunWatchLoopOptions): Promise<void>;

package/dist/watch-loop.js

@@ -0,0 +1,31 @@
+export async function runWatchLoop({ tick, intervalMs, signal, onError, }) {
+    while (!signal.aborted) {
+        try {
+            await tick();
+        }
+        catch (error) {
+            onError?.(error);
+        }
+        if (signal.aborted)
+            break;
+        await delay(intervalMs, signal);
+    }
+}
+/** Resolve after `ms`, or immediately when `signal` aborts. Cleans up its timer/listener either way. */
+function delay(ms, signal) {
+    return new Promise((resolve) => {
+        if (signal.aborted) {
+            resolve();
+            return;
+        }
+        const onAbort = () => {
+            clearTimeout(timer);
+            resolve();
+        };
+        const timer = setTimeout(() => {
+            signal.removeEventListener('abort', onAbort);
+            resolve();
+        }, ms);
+        signal.addEventListener('abort', onAbort, { once: true });
+    });
+}

package/package.json

@@ -1,14 +1,17 @@
 {
   "name": "@sequenceholdings/artifact-studio",
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/sequenceholdings/studio.git",
+    "directory": "shared/services/artifact-studio"
+  },
   "publishConfig": {
-    "access": "restricted"
+    "access": "public"
   },
-  "version": "0.1.6",
-  "description": "CLI and SDK types for building Artifact Studio apps",
+  "version": "0.1.9",
+  "description": "SDK types and CLI library for building Artifact Studio apps. Driven via `seq-studio artifact <sub>` (@sequenceholdings/studio-cli), which runs the `./cli` runCli export.",
   "type": "module",
-  "bin": {
-    "artifact-studio": "./dist/bin.js"
-  },
   "exports": {
     ".": {
       "types": "./dist/sdk.d.ts",
@@ -17,6 +20,18 @@
     "./cli": {
       "types": "./dist/cli.d.ts",
       "default": "./dist/cli.js"
+    },
+    "./source-resolver": {
+      "types": "./dist/source-resolver.d.ts",
+      "default": "./dist/source-resolver.js"
+    },
+    "./git-service-client": {
+      "types": "./dist/git-service-client.d.ts",
+      "default": "./dist/git-service-client.js"
+    },
+    "./git-clone": {
+      "types": "./dist/git-clone.d.ts",
+      "default": "./dist/git-clone.js"
     }
   },
   "files": [
@@ -26,14 +41,18 @@
   "dependencies": {
     "@tailwindcss/postcss": "^4.1.8",
     "@tailwindcss/vite": "^4.1.8",
+    "@tanstack/react-query": "^4.36.1",
     "js-yaml": "^4.1.1",
     "react": "^18.2.0",
     "react-dom": "^18.2.0",
+    "react-router-dom": "^6.30.4",
+    "sonner": "^2.0.7",
     "tailwindcss": "^4.1.8",
     "tw-animate-css": "^1.4.0",
-    "vite": "8.0.8",
+    "vite": "8.0.16",
     "zod": "^4.1.13",
-    "@sequenceholdings/atlas-ui": "0.1.2"
+    "@sequenceholdings/atlas-ui": "0.1.3",
+    "@sequenceholdings/lattice-form-renderer": "0.1.0"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
@@ -44,6 +63,7 @@
   "scripts": {
     "build": "tsc && node scripts/copy-templates.mjs",
     "type-check": "tsc --noEmit",
-    "test": "vitest run"
+    "test": "vitest run",
+    "bench:build-isolation": "node --expose-gc scripts/bench-build-isolation.mjs"
   }
 }

package/templates/react-vite/CLAUDE.md

@@ -13,25 +13,26 @@ This is a sandboxed iframe SPA that runs inside Atlas and talks to Atlas backend
 
 2. **FormData blocker.** `seq.api.fetch` `JSON.stringify`s any non-string `body` value, which silently turns `FormData` into `"{}"`. For uploads, base64-encode the bytes and POST as JSON, or patch the Atlas bridge first.
 
-3. **Capability matcher: exact path or `/*` prefix wildcard only.** `{id}` template forms do **not** match. List both the bare path and the prefix wildcard in `artifact.bundle.yml`:
+3. **Capability matcher: exact paths, `/*` prefix wildcards, and single-segment `*` patterns.** `{id}` template forms do **not** match. List both the bare path and the prefix wildcard for broad resources, or use a least-privilege segment pattern for dynamic routes:
    ```yaml
    - /api/crm/customers
    - /api/crm/customers/*
+   - /api/lattice/runs/*/advance
    ```
 
 ## Prerequisite
 
-`artifact-studio init` requires the Sequence monorepo checked out locally. The CLI rewrites `"@sequenceholdings/atlas-ui": "workspace:*"` and the `@sequenceholdings/artifact-studio` version in this `package.json` to local `file:` paths against the monorepo's `shared/services/atlas-ui` and `shared/services/artifact-studio`. Without the monorepo the rewrite no-ops, and `npm install` fails with `EUNSUPPORTEDPROTOCOL` on `workspace:*` — those two packages aren't published to npm. Run init from inside the monorepo, e.g. `pnpm --dir atlas artifact-studio init <dir>`.
+None — `seq-studio artifact init <dir>` works from any directory; no monorepo checkout is required. The template lists `@sequenceholdings/artifact-studio` and `@sequenceholdings/atlas-ui` in **devDependencies** for local editor/type-check tooling only. `seq-studio artifact build|deploy` bundles against the CLI's own pinned copies of `react`, `react-dom`, `@tanstack/react-query`, `react-router-dom`, `sonner`, and `@sequenceholdings/atlas-ui`, and resolves `@sequenceholdings/artifact-studio` to a virtual `window.seq` module. Remote deploys (`--repo` / `--git-url`) run `pnpm install --prod` for **app-specific** `dependencies` only (e.g. `recharts`, `reactflow`) from the artifact lockfile.
 
-## Package manager: npm, not pnpm
+## Package manager
 
-Once the CLI has rewritten the deps, use `npm install`, not `pnpm install`. The linked `@sequenceholdings/artifact-studio` package carries `"@sequenceholdings/atlas-ui": "workspace:*"` in its own `package.json`; npm tolerates an unresolved `workspace:*` inside a file-linked dep, pnpm errors with `ERR_PNPM_WORKSPACE_PKG_NOT_FOUND`. If a `pnpm-lock.yaml` already exists, `rm -rf node_modules pnpm-lock.yaml` before `npm install`.
+Use **pnpm** for artifacts you will deploy from git — `seq-studio artifact build|deploy --repo/--git-url` runs `pnpm install --frozen-lockfile --prod` when `package.json` is present, so commit `pnpm-lock.yaml`. Local editor-only installs can use another package manager, but pnpm keeps Sequence's `minimumReleaseAge` supply-chain quarantine in effect (see the studio-cli README). If you have a stale checkout from the old `file:`-link era, `rm -rf node_modules` and reinstall.
 
 ## Key files
 
 | File | Role |
 |---|---|
-| `artifact.bundle.yml` | Capability manifest — every API path the artifact calls, exact + `/*` |
+| `artifact.bundle.yml` | Capability manifest — every API path the artifact calls: exact paths, `/*` prefix wildcards, or single-segment `*` patterns |
 | `src/main.tsx` | Providers: `QueryClientProvider` → `PortalContainerProvider` → `App` |
 | `src/App.tsx` | Entrypoint UI |
 | `src/lib/api.ts` | `unwrap<T>` envelope helper + re-export of `seq` |
@@ -40,10 +41,10 @@ Once the CLI has rewritten the deps, use `npm install`, not `pnpm install`. The
 
 ## Defaults
 
-- UI: prefer `@sequenceholdings/atlas-ui` primitives (`Button`, `Card`, `Input`, `Dialog`, `KpiTile`, `Switch`, …) over raw Tailwind. `Select`, `Checkbox`, and `DropdownMenu` are not exported — use native `<select>`, `Switch`, and `Popover` respectively.
+- UI: prefer `@sequenceholdings/atlas-ui` primitives (`Button`, `Card`, `Input`, `Dialog`, `Select`, `Checkbox`, `DropdownMenu`, `KpiTile`, `Switch`, …) over raw Tailwind. The design-system cutover made `Select`, `Checkbox`, `DropdownMenu`, `Command`, `Calendar`, `DatePicker`, `ScrollArea`, `Table`, and the Task family first-class exports — use them directly; fall back to `Popover` compositions or native controls only when a component is genuinely missing.
 - Routing: `HashRouter`. Mount routes at `/`, not at the Atlas app prefix.
 - Data: React Query is wired in `src/main.tsx`. Use `useQuery` / `useMutation` against `unwrap(seq.api.*)`.
-- Icons: do **not** install `@tabler/icons-react` — it won't resolve from the artifact's local `node_modules`. Inline SVG components in `src/icons.tsx`.
+- Icons: do **not** add third-party deps like `@tabler/icons-react`. Deploys from git (`--repo` / `--git-url`) build a bare tree — `seq-studio` runs `pnpm install --prod` from your lockfile, then aliases platform peers (`react`, `react-dom`, `@tanstack/react-query`, `react-router-dom`, `sonner`, `@sequenceholdings/atlas-ui`). List only app-specific imports (e.g. `recharts`) in `dependencies`; do not add file/workspace `@sequenceholdings/*` specs in git-service repos, because remote installs only accept registry semver specs. Inline SVG components in `src/icons.tsx`.
 
 ## Bridge methods
 
@@ -53,3 +54,13 @@ Two primitives on `seq.api`:
 - `seq.api.request(method, path, body?)` throws on non-2xx and returns parsed JSON. Sugar wrappers `seq.api.get / .post / .patch / .delete` are thin shells around `request`, so they also throw.
 
 Wrap reads/writes that should auto-throw through `unwrap()` in `src/lib/api.ts`. Drop to `seq.api.fetch` when you need pagination `meta` or status inspection.
+
+## Lattice embed context
+
+When the artifact is served from a Lattice human node (the **Tasks/Inbox** task surface, or the builder Artifacts tab), `seq.lattice.context()` tells you which run/node/step you're rendering for:
+
+```ts
+const { runId, nodeId, stepId, processId } = seq.lattice.context()
+```
+
+It's **synchronous** (the host injects this into the sandbox up front — no bridge round trip) and each field is `null` when unavailable. The Inbox provides all four; the builder Artifacts tab has no live `stepId`; a standalone open has no context at all. Use it instead of hand-parsing `window.location` — that's the sanctioned, stable accessor, and you don't need to declare anything in `artifact.bundle.yml` for it. To read step-scoped data, pass `runId`/`stepId` to the relevant Atlas endpoint (which still authorizes the caller server-side).

package/templates/react-vite/package.json

@@ -7,20 +7,21 @@
     "build": "vite build",
     "preview": "vite preview"
   },
-  "dependencies": {
+  "dependencies": {},
+  "devDependencies": {
     "@sequenceholdings/artifact-studio": "^0.1.0",
     "@sequenceholdings/atlas-ui": "^0.1.0",
-    "@tanstack/react-query": "^4.36.1",
-    "react": "^18.2.0",
-    "react-dom": "^18.2.0"
-  },
-  "devDependencies": {
     "@tailwindcss/postcss": "^4.2.2",
     "@tailwindcss/vite": "^4.2.2",
+    "@tanstack/react-query": "^4.36.1",
     "@vitejs/plugin-react": "^5.0.0",
+    "react": "^18.2.0",
+    "react-dom": "^18.2.0",
+    "react-router-dom": "^6.28.0",
+    "sonner": "^2.0.7",
     "tailwindcss": "^4.2.2",
     "tw-animate-css": "^1.4.0",
     "typescript": "^5.6.0",
-    "vite": "8.0.8"
+    "vite": "8.0.16"
   }
 }

package/dist/bin.d.ts

@@ -1,2 +0,0 @@
-#!/usr/bin/env node
-export {};

package/dist/bin.js

@@ -1,8 +0,0 @@
-#!/usr/bin/env node
-import { runCli } from './cli.js';
-runCli()
-    .then((code) => process.exit(code))
-    .catch((error) => {
-    console.error(error instanceof Error ? error.message : error);
-    process.exit(1);
-});