@sequenceholdings/artifact-studio 0.2.1 → 0.2.3

package/dist/cli.js

@@ -13,7 +13,7 @@ import { hasArtifactStudioManifest, readArtifactStudioSource } from './project.j
 import { localGitMetadata, parseSourceSpec, resolveArtifactSource, } from './source-resolver.js';
 import { acquireDevLock } from './dev-lock.js';
 import { runWatchLoop } from './watch-loop.js';
-import { hashLinkedSources, parseLinks, rebuildLinkedDep, resolveLinkedDeps, syncLinkedDist, } from './dev-link.js';
+import { hashLinkedSources, hasLinkedAtlasUiToolchain, parseLinks, rebuildLinkedDep, resolveLinkedDeps, syncLinkedDist, } from './dev-link.js';
 import { lintArtifactSandbox, reportSandboxWarnings } from './sandbox-lint.js';
 import { assertActiveDeployProvenance } from './active-deploy-policy.js';
 import yaml from 'js-yaml';
@@ -43,10 +43,12 @@ const USAGE = `usage:
   repo's default branch). The target project comes from the source's
   artifact.bundle.yml project_id.
 
-  Official (active) deploys require a clean \`main\` checkout with a resolved
-  git commit — merge first, then \`deploy --repo …\` (or a clean local \`main\`
-  checkout). Feature branches and dirty trees are preview-only
-  (\`artifact dev\` / preview channel).
+  Official (active) deploys to deployed environments require \`main\` with a
+  resolved git commit and a clean artifact source directory. Dirty files
+  outside a nested local source directory are ignored with a warning.
+  Deployments targeting \`local\` may use any branch, including dirty working
+  trees; feature branches and dirty source trees remain preview-only for
+  deployed environments (\`artifact dev\` / preview channel).
 
   Interactive --repo builds clone over smart-HTTP and require a repo:read git
   PAT in ATLAS_GIT_PAT — create one with \`seq-studio auth pat create --scopes
@@ -327,6 +329,10 @@ function logActiveDeploymentDetails(deployment) {
     if (deployment.cliVersion || deployment.atlasUiVersion) {
         console.log(`    peers:      artifact-studio@${deployment.cliVersion ?? '?'} atlas-ui@${deployment.atlasUiVersion ?? '?'}`);
     }
+    if (deployment.observedBuildEvidence) {
+        console.log(`    observed:   ${deployment.observedBuildEvidence.channel} / ${deployment.observedBuildEvidence.integrityReceipt?.status ?? 'no receipt'} / ${deployment.observedBuildEvidence.toolchain.selection} toolchain ` +
+            `(atlas-ui ${deployment.observedBuildEvidence.atlasUi.contentHash.slice(0, 12)})`);
+    }
     if (deployment.deployMessage)
         console.log(`    message:    ${deployment.deployMessage}`);
     if (deployment.createdAt)
@@ -347,6 +353,11 @@ async function buildPreparedArtifactSource(source) {
     await prepareArtifactBuildRoot(source.dir, { remote: source.remote });
     return buildArtifactStudioProjectIsolated(source.dir);
 }
+function reportBuildDiagnostics(result) {
+    for (const diagnostic of result.diagnostics ?? []) {
+        console.warn(`[seq-studio] warning: ${diagnostic}`);
+    }
+}
 async function buildCommand(args) {
     const spec = parseSourceSpec(args);
     // Local builds stay offline. Public git URLs need no bearer token, but an
@@ -365,6 +376,7 @@ async function buildCommand(args) {
     const source = await resolveArtifactSource(spec, remote);
     try {
         const result = await buildPreparedArtifactSource(source);
+        reportBuildDiagnostics(result);
         // A remote source's dir is a temp dir we tear down below, so default the
         // bundle output next to the cwd rather than into the throwaway tree.
         const defaultOutDir = spec.kind === 'local' ? source.dir : process.cwd();
@@ -394,6 +406,7 @@ async function planCommand(args) {
     });
     try {
         const result = await buildPreparedArtifactSource(source);
+        reportBuildDiagnostics(result);
         console.log(`[seq-studio] plan ${result.manifest.artifact.project_id} -> ${env.name}`);
         console.log(`  source: ${result.sourceHash}`);
         console.log(`  bundle: ${result.bundleHash}`);
@@ -443,9 +456,11 @@ async function deployCommand(args) {
         token,
     });
     try {
-        // Fail closed before build / project create — active deploys must already
-        // look like a clean `main` checkout. Preview (`dev`) never hits this path.
-        assertActiveDeployProvenance(source.provenance);
+        // Fail closed before build / project create for deployed environments.
+        // Local Atlas is a developer's own target, so it intentionally accepts
+        // the current branch and dirty working tree.
+        if (env.name !== 'local')
+            assertActiveDeployProvenance(source.provenance);
         // --skip-unchanged: hash the raw source (no build needed) and no-op when
         // the remote active deployment already matches *and* was built with the
         // same CLI/atlas-ui pin. Lets CI redeploy every artifact on every release
@@ -472,6 +487,7 @@ async function deployCommand(args) {
             }
         }
         const result = await buildPreparedArtifactSource(source);
+        reportBuildDiagnostics(result);
         warnIfInlinedManifestDriftsFromBundle(result);
         // Local sources read/write the project link in their working dir; remote
         // sources resolve strictly by manifest project_id (never a stray config.json
@@ -517,6 +533,7 @@ async function devCommand(args) {
     // refresh the artifact automatically, instead of the rebuild/reinstall/restart
     // dance. Resolved once up front so a bad path fails fast.
     const linkedDeps = resolveLinkedDeps({ links: parseLinks(args.flags.link) });
+    const candidateTokenCompatibility = hasLinkedAtlasUiToolchain({ deps: linkedDeps });
     for (const dep of linkedDeps) {
         const where = relative(process.cwd(), dep.dir) || '.';
         console.log(`[seq-studio] linked ${dep.name} ← ${where}${dep.inPlace ? ' (in place)' : ''}`);
@@ -555,7 +572,11 @@ async function devCommand(args) {
         // Vite builds leak memory that GC can't reclaim and eventually OOM a
         // long-running watch. Isolating each build keeps memory flat. The signal
         // reaps the child if the watcher is shutting down mid-build.
-        const result = await buildArtifactStudioProjectIsolated(dir, { signal: controller.signal });
+        const result = await buildArtifactStudioProjectIsolated(dir, {
+            signal: controller.signal,
+            candidateTokenCompatibility,
+        });
+        reportBuildDiagnostics(result);
         warnIfInlinedManifestDriftsFromBundle(result);
         // The tree can change between the cheap pre-read above and the build
         // finishing — including reverting back to the last-shipped snapshot. Trust
@@ -580,6 +601,7 @@ async function devCommand(args) {
             result,
             channel: 'preview',
             previewKey,
+            linked: linkedDeps.length > 0,
             provenance: localGitMetadata(dir),
             message: `Preview push ${buildCount}`,
         });
@@ -811,7 +833,7 @@ async function ensureRemoteProject({ env, token, result, linkConfigDir, allowCre
         await writeLocalConfig({ ...config, projectId: created.project.id, projectSlug: created.project.slug }, linkConfigDir);
     return created.project;
 }
-async function uploadDeployment({ env, token, projectId, result, channel, previewKey, provenance, message, }) {
+async function uploadDeployment({ env, token, projectId, result, channel, previewKey, linked = false, provenance, message, }) {
     // Active deploys omit `version`: the server derives it from its own
     // sourceHash and de-dupes against the (projectId, version) unique
     // constraint. Pinning it client-side is how a stale CLI-side hash turned
@@ -834,12 +856,18 @@ async function uploadDeployment({ env, token, projectId, result, channel, previe
             bundleFormat: result.bundleFormat,
             sourceMap: result.sourceMap,
             ...(version ? { version } : {}),
-            channel,
             previewKey,
             deployMessage: message ?? null,
-            cliVersion: result.peerVersions.cliVersion,
-            atlasUiVersion: result.peerVersions.atlasUiVersion,
-            ...provenance,
+            observedBuildEvidence: {
+                ...result.observedBuildEvidence,
+                toolchain: { ...result.observedBuildEvidence.toolchain, selection: linked ? 'linked' : 'published' },
+                channel,
+                sourceRevision: {
+                    commit: provenance.gitCommit,
+                    branch: provenance.gitBranch,
+                    dirty: provenance.gitDirty,
+                },
+            },
         },
     });
     return data.deployment;

package/dist/dev-link.d.ts

@@ -9,8 +9,8 @@
  *
  * `--link` collapses that to zero steps: the watcher hashes the linked package's
  * source each tick, and on change rebuilds the package and copies its fresh `dist`
- * into the exact location the artifact build resolves it from — then forces an
- * artifact rebuild + preview push.
+ * plus package-root CSS entries into the exact location the artifact build resolves
+ * them from — then forces an artifact rebuild + preview push.
  */
 export interface LinkedDep {
     /** Absolute path to the linked source package (e.g. shared/services/atlas-ui). */
@@ -26,6 +26,10 @@ export interface LinkedDep {
     /** True when the artifact resolves the package straight from `dir` (symlinked file: dep). */
     inPlace: boolean;
 }
+/** True only when this dev session explicitly selected a local Atlas UI package. */
+export declare function hasLinkedAtlasUiToolchain({ deps }: {
+    deps: readonly LinkedDep[];
+}): boolean;
 /** Resolve `${name}/package.json` the same way the build worker does. */
 type PackageResolver = (request: string) => string;
 /** Split a `--link a,b` flag value into trimmed, non-empty paths. */
@@ -51,10 +55,10 @@ export declare function hashLinkedSources(deps: readonly LinkedDep[]): Promise<s
 /** Run a linked package's `build` script in a child process. */
 export declare function rebuildLinkedDep(dep: LinkedDep, signal?: AbortSignal): Promise<void>;
 /**
- * Copy a linked package's freshly built `dist` into the location the artifact
- * build resolves it from. A no-op when the artifact already resolves the package
- * in place (symlinked file: dep), where the rebuild already wrote the bytes the
- * build will read.
+ * Copy a linked package's freshly built `dist` and root CSS entries into the
+ * location the artifact build resolves them from. A no-op when the artifact
+ * already resolves the package in place (symlinked file: dep), where the rebuild
+ * already wrote the bytes the build will read.
  */
 export declare function syncLinkedDist(dep: LinkedDep): Promise<void>;
 export {};

package/dist/dev-link.js

@@ -1,9 +1,13 @@
 import { spawn } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { existsSync, readFileSync, realpathSync } from 'node:fs';
-import { cp, readFile, readdir, rm } from 'node:fs/promises';
+import { cp, mkdir, readFile, readdir, rm } from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import { dirname, join, relative, resolve } from 'node:path';
+/** True only when this dev session explicitly selected a local Atlas UI package. */
+export function hasLinkedAtlasUiToolchain({ deps }) {
+    return deps.some((dep) => dep.name === '@sequenceholdings/atlas-ui');
+}
 const WATCHED_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.css', '.json']);
 const IGNORED_DIRS = new Set(['node_modules', '.git', 'dist', '.next', '.turbo', '.cache']);
 const defaultResolver = createRequire(import.meta.url).resolve;
@@ -72,9 +76,26 @@ export async function hashLinkedSources(deps) {
     for (const dep of deps) {
         hash.update(dep.name);
         hash.update('\0');
-        const files = (await collectFiles(dep.srcDir)).sort((a, b) => a.localeCompare(b));
-        for (const file of files) {
-            hash.update(relative(dep.srcDir, file));
+        const sourceRoots = [
+            { label: 'src', dir: dep.srcDir },
+            // Atlas UI emits its package-root token entries from this generator.
+            // Watching scripts means edits to that generator trigger a linked preview.
+            { label: 'scripts', dir: join(dep.dir, 'scripts') },
+        ];
+        for (const sourceRoot of sourceRoots) {
+            const files = (await collectFiles(sourceRoot.dir)).sort((a, b) => a.localeCompare(b));
+            for (const file of files) {
+                hash.update(sourceRoot.label);
+                hash.update('/');
+                hash.update(relative(sourceRoot.dir, file));
+                hash.update('\0');
+                hash.update(await readFile(file));
+                hash.update('\0');
+            }
+        }
+        for (const file of await packageRootCssFiles(dep.dir)) {
+            hash.update('root-css/');
+            hash.update(relative(dep.dir, file));
             hash.update('\0');
             hash.update(await readFile(file));
             hash.update('\0');
@@ -82,6 +103,14 @@ export async function hashLinkedSources(deps) {
     }
     return hash.digest('hex');
 }
+async function packageRootCssFiles(pkgDir) {
+    if (!existsSync(pkgDir))
+        return [];
+    const entries = await readdir(pkgDir, { withFileTypes: true });
+    return entries
+        .filter((entry) => entry.isFile() && entry.name.endsWith('.css'))
+        .map((entry) => join(pkgDir, entry.name));
+}
 async function collectFiles(root) {
     if (!existsSync(root))
         return [];
@@ -139,10 +168,10 @@ export function rebuildLinkedDep(dep, signal) {
     });
 }
 /**
- * Copy a linked package's freshly built `dist` into the location the artifact
- * build resolves it from. A no-op when the artifact already resolves the package
- * in place (symlinked file: dep), where the rebuild already wrote the bytes the
- * build will read.
+ * Copy a linked package's freshly built `dist` and root CSS entries into the
+ * location the artifact build resolves them from. A no-op when the artifact
+ * already resolves the package in place (symlinked file: dep), where the rebuild
+ * already wrote the bytes the build will read.
  */
 export async function syncLinkedDist(dep) {
     if (dep.inPlace)
@@ -150,6 +179,11 @@ export async function syncLinkedDist(dep) {
     if (!existsSync(dep.distDir)) {
         throw new Error(`${dep.name} build produced no dist at ${dep.distDir}`);
     }
+    const targetPkgDir = dirname(dep.targetDistDir);
+    await mkdir(targetPkgDir, { recursive: true });
     await rm(dep.targetDistDir, { recursive: true, force: true });
     await cp(dep.distDir, dep.targetDistDir, { recursive: true });
+    for (const file of await packageRootCssFiles(dep.dir)) {
+        await cp(file, join(targetPkgDir, relative(dep.dir, file)));
+    }
 }

package/dist/manifest.d.ts

@@ -58,9 +58,9 @@ export declare const artifactStudioManifestSchema: z.ZodObject<{
     targets: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
         url: z.ZodString;
         visibility: z.ZodDefault<z.ZodEnum<{
+            published: "published";
             private: "private";
             shared: "shared";
-            published: "published";
         }>>;
     }, z.core.$strip>>>;
     sidebarBadge: z.ZodOptional<z.ZodObject<{

package/dist/reporting-limits.d.ts

@@ -0,0 +1,17 @@
+/** Max length of user-authored SQL accepted by reporting routes. */
+export declare const REPORTING_MAX_SQL_CHARS = 500000;
+/** Max decoded file size for manual report uploads. */
+export declare const UPLOAD_MAX_BYTES: number;
+/** Max length of a base64-encoded upload before decoding. */
+export declare const UPLOAD_MAX_BASE64_CHARS: number;
+/** Formatted bundle transport and file boundaries. */
+export declare const FORMATTED_BUNDLE_MAX_BYTES: number;
+/** Reserve space for multipart boundaries and per-file headers in the artifact. */
+export declare const FORMATTED_BUNDLE_MULTIPART_OVERHEAD_RESERVE_BYTES: number;
+export declare const FORMATTED_BUNDLE_MAX_DEFINITION_BYTES: number;
+export declare const FORMATTED_BUNDLE_MAX_SQL_FILES = 50;
+export declare const FORMATTED_BUNDLE_MAX_SQL_BYTES: number;
+export declare const FORMATTED_BUNDLE_MAX_SQL_CHARS = 500000;
+export declare const FORMATTED_BUNDLE_MAX_TOTAL_SQL_CHARS: number;
+/** The definition and multipart contracts must reject the same input count. */
+export declare const MAX_FORMATTED_REPORT_INPUTS = 50;

package/dist/reporting-limits.js

@@ -0,0 +1,17 @@
+/** Max length of user-authored SQL accepted by reporting routes. */
+export const REPORTING_MAX_SQL_CHARS = 500_000;
+/** Max decoded file size for manual report uploads. */
+export const UPLOAD_MAX_BYTES = 20 * 1024 * 1024;
+/** Max length of a base64-encoded upload before decoding. */
+export const UPLOAD_MAX_BASE64_CHARS = Math.ceil(UPLOAD_MAX_BYTES / 3) * 4;
+/** Formatted bundle transport and file boundaries. */
+export const FORMATTED_BUNDLE_MAX_BYTES = 20 * 1024 * 1024;
+/** Reserve space for multipart boundaries and per-file headers in the artifact. */
+export const FORMATTED_BUNDLE_MULTIPART_OVERHEAD_RESERVE_BYTES = 64 * 1024;
+export const FORMATTED_BUNDLE_MAX_DEFINITION_BYTES = 2 * 1024 * 1024;
+export const FORMATTED_BUNDLE_MAX_SQL_FILES = 50;
+export const FORMATTED_BUNDLE_MAX_SQL_BYTES = 2 * 1024 * 1024;
+export const FORMATTED_BUNDLE_MAX_SQL_CHARS = REPORTING_MAX_SQL_CHARS;
+export const FORMATTED_BUNDLE_MAX_TOTAL_SQL_CHARS = 10 * REPORTING_MAX_SQL_CHARS;
+/** The definition and multipart contracts must reject the same input count. */
+export const MAX_FORMATTED_REPORT_INPUTS = FORMATTED_BUNDLE_MAX_SQL_FILES;

package/dist/sdk.d.ts

@@ -19,7 +19,7 @@ export interface SequenceApiUploadOptions {
 }
 export interface SequenceApi {
     fetch<TBody = unknown>(path: string, options?: SequenceApiFetchOptions): Promise<SequenceApiFetchResponse<TBody>>;
-    upload<TBody = unknown>(path: string, file: File, fields?: Record<string, string>, options?: SequenceApiUploadOptions): Promise<SequenceApiFetchResponse<TBody>>;
+    upload<TBody = unknown>(path: string, file: File | readonly File[], fields?: Record<string, string>, options?: SequenceApiUploadOptions): Promise<SequenceApiFetchResponse<TBody>>;
     stream(path: string, options?: SequenceApiFetchOptions): Promise<ReadableStream<Uint8Array>>;
     get<TBody = unknown>(path: string): Promise<TBody>;
     post<TBody = unknown>(path: string, body?: unknown): Promise<TBody>;
@@ -88,7 +88,7 @@ export interface SequenceLattice {
 export interface SequenceHost {
     /**
      * Navigate the parent Atlas shell to an in-app route — e.g.
-     * `seq.host.navigate('/crm#/customers/<uid>')`. Fire-and-forget: the artifact
+     * `seq.host.navigate('/relationships#/customers/<uid>')`. Fire-and-forget: the artifact
      * sandbox cannot navigate the top frame itself (no `allow-top-navigation`),
      * so this posts the request to the host, which validates it and drives the
      * shell router. The host ignores anything that isn't a same-app relative

package/dist/source-boundary.d.ts

@@ -0,0 +1,13 @@
+import type { Plugin } from 'vite';
+export interface ArtifactSourceBoundaryOptions {
+    root: string;
+    trustedExternalRoots: readonly string[];
+}
+/**
+ * Artifact source must be self-contained: allowing a relative import to escape
+ * the build root would let uncommitted files elsewhere in a containing
+ * checkout enter the official bundle without being covered by its dirty bit.
+ * Published dependencies and the CLI-pinned platform peers are intentionally
+ * allowed because they are external to the artifact by design.
+ */
+export declare function rejectOutsideSourcePlugin({ root, trustedExternalRoots, }: ArtifactSourceBoundaryOptions): Plugin;

package/dist/source-boundary.js

@@ -0,0 +1,54 @@
+import { isAbsolute, relative, resolve, sep } from 'node:path';
+/**
+ * Artifact source must be self-contained: allowing a relative import to escape
+ * the build root would let uncommitted files elsewhere in a containing
+ * checkout enter the official bundle without being covered by its dirty bit.
+ * Published dependencies and the CLI-pinned platform peers are intentionally
+ * allowed because they are external to the artifact by design.
+ */
+export function rejectOutsideSourcePlugin({ root, trustedExternalRoots, }) {
+    const rootResolved = resolve(root);
+    const trustedRoots = trustedExternalRoots.map((trustedRoot) => resolve(trustedRoot));
+    return {
+        name: 'reject-artifact-outside-source',
+        enforce: 'pre',
+        async resolveId(source, importer, options) {
+            const resolved = await this.resolve(source, importer, { ...options, skipSelf: true });
+            if (!resolved || resolved.external || resolved.id.startsWith('\0'))
+                return resolved;
+            const filePath = resolved.id.split('?')[0];
+            if (!isAbsolute(filePath) || isPathWithin(rootResolved, filePath))
+                return resolved;
+            const importerPath = importer?.split('?')[0];
+            const importerIsTrustedExternal = importerPath != null &&
+                (isNodeModulesPath(importerPath) || isTrustedExternalPath(importerPath, trustedRoots));
+            if (isNodeModulesPath(filePath) && (isBareImport(source) || importerIsTrustedExternal)) {
+                return resolved;
+            }
+            if (isTrustedExternalPath(filePath, trustedRoots))
+                return resolved;
+            const from = importer
+                ? ` (imported from ${relative(rootResolved, importer.split('?')[0])})`
+                : '';
+            throw new Error(`Artifact import "${filePath}" resolves outside artifact source directory ` +
+                `"${rootResolved}"${from}. Keep relative build inputs inside the artifact ` +
+                'source directory or publish shared code as a dependency.');
+        },
+    };
+}
+function isPathWithin(root, candidate) {
+    const pathFromRoot = relative(root, candidate);
+    return (pathFromRoot === '' ||
+        (pathFromRoot !== '..' &&
+            !pathFromRoot.startsWith(`..${sep}`) &&
+            !isAbsolute(pathFromRoot)));
+}
+function isTrustedExternalPath(filePath, trustedRoots) {
+    return trustedRoots.some((trustedRoot) => isPathWithin(trustedRoot, filePath));
+}
+function isNodeModulesPath(filePath) {
+    return filePath.includes(`${sep}node_modules${sep}`);
+}
+function isBareImport(source) {
+    return !source.startsWith('.') && !isAbsolute(source);
+}

package/dist/source-resolver.js

@@ -161,7 +161,12 @@ export function localGitMetadata(dir) {
         if (!gitBranch) {
             gitBranch = resolveDetachedMainBranch({ gitOpts, gitCommit }) ?? '';
         }
-        const gitDirty = String(execFileSync('git', ['status', '--porcelain'], gitOpts)).trim().length > 0;
+        const wholeTreeStatus = String(execFileSync('git', ['status', '--porcelain'], gitOpts)).trim();
+        const sourceStatus = String(execFileSync('git', ['status', '--porcelain', '--', '.'], gitOpts)).trim();
+        const gitDirty = sourceStatus.length > 0;
+        if (wholeTreeStatus && !gitDirty) {
+            console.warn(`[seq-studio] ignoring unrelated dirty files outside artifact source directory ${dir}`);
+        }
         return { gitCommit, gitBranch: gitBranch || null, gitDirty };
     }
     catch {

package/dist/templates/react-vite/AGENTS.md

@@ -36,7 +36,7 @@ Use **pnpm** for artifacts you will deploy from git — `seq-studio artifact bui
 | `src/main.tsx` | Providers: `QueryClientProvider` → `PortalContainerProvider` → `App` |
 | `src/App.tsx` | Entrypoint UI |
 | `src/lib/api.ts` | `unwrap<T>` envelope helper + re-export of `seq` |
-| `src/styles.css` | Tailwind v4 + `@sequenceholdings/atlas-ui/tokens.css` (+ v2 sheets; build injects them when missing) |
+| `src/styles.css` | Tailwind v4 + canonical `@sequenceholdings/atlas-ui/tokens.css` |
 | `vite.config.ts` | Vite + React + Tailwind v4 plugin |
 
 ## Defaults

package/dist/templates/react-vite/package.json

@@ -9,15 +9,15 @@
   },
   "dependencies": {},
   "devDependencies": {
-    "@sequenceholdings/artifact-studio": "^0.1.0",
-    "@sequenceholdings/atlas-ui": "^0.1.0",
+    "@sequenceholdings/artifact-studio": "^0.2.1",
+    "@sequenceholdings/atlas-ui": "^2.0.1",
     "@tailwindcss/postcss": "^4.2.2",
     "@tailwindcss/vite": "^4.2.2",
     "@tanstack/react-query": "^4.36.1",
     "@vitejs/plugin-react": "^5.0.0",
     "react": "^18.2.0",
     "react-dom": "^18.2.0",
-    "react-router-dom": "^6.28.0",
+    "react-router-dom": "^7.18.2",
     "sonner": "^2.0.7",
     "tailwindcss": "^4.2.2",
     "tw-animate-css": "^1.4.0",

package/dist/templates/react-vite/src/styles.css

@@ -1,8 +1,6 @@
 @import "tailwindcss";
 @import "tw-animate-css";
 @import "@sequenceholdings/atlas-ui/tokens.css";
-@import "@sequenceholdings/atlas-ui/tokens.v2.css";
-@import "@sequenceholdings/atlas-ui/theme.v2.css";
 
 /* Tailwind v4 skips node_modules during automatic source detection, so the
    utility classes compiled into atlas-ui's components are never generated under

package/dist/token-contract.d.ts

@@ -0,0 +1,16 @@
+import type { ArtifactStudioSourceFile } from './project.js';
+export interface RetiredOpacityUtilityReference {
+    path: string;
+    utility: string;
+}
+export declare function collectDeprecatedTokenImportDiagnostics({ files, }: {
+    files: readonly ArtifactStudioSourceFile[];
+}): string[];
+/**
+ * Candidate builds use a source report rather than a build-time ban. A normal
+ * CLI release must remain able to rebuild pre-cutover artifacts; an explicit
+ * `artifact dev --link <atlas-ui>` preview is the opt-in migration surface.
+ */
+export declare function collectCandidateTokenCompatibilityDiagnostics({ files, }: {
+    files: readonly ArtifactStudioSourceFile[];
+}): string[];