@sequenceholdings/artifact-studio 0.7.1 → 0.8.0

package/dist/build.js

@@ -1,5 +1,5 @@
 import { existsSync } from 'node:fs';
-import { mkdir, writeFile } from 'node:fs/promises';
+import { mkdir, realpath, writeFile } from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import { dirname, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -122,7 +122,9 @@ export async function buildArtifactStudioProject(rootDir, { candidateTokenCompat
             ? collectCandidateTokenCompatibilityDiagnostics({ files: source.files })
             : []),
     ];
-    const root = source.root;
+    // Vite resolves imports to physical paths, including macOS /tmp -> /private/tmp.
+    // Give Vite and the source boundary the same physical root.
+    const root = await realpath(source.root);
     const transformedCssModules = new Map();
     const result = await viteBuild({
         root,

package/dist/manifest-next.d.ts

@@ -28,6 +28,9 @@ export declare const artifactNextServerCapabilitiesSchema: z.ZodPrefault<z.ZodOb
     audit: z.ZodOptional<z.ZodObject<{
         service: z.ZodString;
     }, z.core.$strict>>;
+    groups: z.ZodOptional<z.ZodObject<{
+        read: z.ZodBoolean;
+    }, z.core.$strict>>;
     storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
         viewer: "viewer";
         editor: "editor";
@@ -89,6 +92,9 @@ export declare const artifactNextServerSchema: z.ZodPrefault<z.ZodObject<{
         audit: z.ZodOptional<z.ZodObject<{
             service: z.ZodString;
         }, z.core.$strict>>;
+        groups: z.ZodOptional<z.ZodObject<{
+            read: z.ZodBoolean;
+        }, z.core.$strict>>;
         storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
             viewer: "viewer";
             editor: "editor";
@@ -280,6 +286,9 @@ export declare const artifactStudioNextManifestSchema: z.ZodObject<{
             audit: z.ZodOptional<z.ZodObject<{
                 service: z.ZodString;
             }, z.core.$strict>>;
+            groups: z.ZodOptional<z.ZodObject<{
+                read: z.ZodBoolean;
+            }, z.core.$strict>>;
             storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
                 viewer: "viewer";
                 editor: "editor";

package/dist/manifest-next.js

@@ -15,9 +15,14 @@ export const ARTIFACT_NEXT_RESOURCE_DEFAULTS = {
 };
 export { artifactNextAuditCapabilitySchema };
 export * from './manifest-next-ingress.js';
+/** Caller-scoped group membership. A boolean, not a list of group ids: the directory decides which groups the signed-in user is in. */
+const artifactNextGroupsCapabilitySchema = z.strictObject({
+    read: z.boolean(),
+});
 export const artifactNextServerCapabilitiesSchema = z.strictObject({
     ...reachShape,
     audit: artifactNextAuditCapabilitySchema.optional(),
+    groups: artifactNextGroupsCapabilitySchema.optional(),
 }).prefault({});
 // Reuse role semantics and validation; only the new manifest rejects unknown keys.
 const strictCustomRoles = customRolesBlockSchema.safeExtend({

package/dist/manifest.d.ts

@@ -167,6 +167,9 @@ export declare const artifactStudioManifestSchema: z.ZodUnion<readonly [z.ZodObj
             audit: z.ZodOptional<z.ZodObject<{
                 service: z.ZodString;
             }, z.core.$strict>>;
+            groups: z.ZodOptional<z.ZodObject<{
+                read: z.ZodBoolean;
+            }, z.core.$strict>>;
             storage: z.ZodOptional<z.ZodRecord<z.ZodUUID, z.ZodEnum<{
                 viewer: "viewer";
                 editor: "editor";

package/dist/server/broker-contract.d.ts

@@ -18,6 +18,10 @@ export declare function isArtifactApiPath(path: string): boolean;
 export declare const ARTIFACT_PROCESS_RUN_STATUSES: readonly ["pending", "running", "completed", "failed", "cancelled", "timed_out"];
 /** Lattice lists at most this many runs per call. */
 export declare const ARTIFACT_PROCESS_RUNS_LIMIT = 500;
+/** One page of the caller's own group memberships. */
+export declare const ARTIFACT_GROUP_MEMBERSHIPS_LIMIT = 100;
+/** How far a caller may page their own memberships. The directory is not walked past this. */
+export declare const ARTIFACT_GROUP_MEMBERSHIPS_MAX_PAGE = 100;
 /** A run page can filter to at most this many entities of one type. */
 export declare const ARTIFACT_PROCESS_RUN_ENTITIES_LIMIT = 500;
 /** A run share adds collaborators to at most this many explicitly assigned human nodes. */
@@ -298,6 +302,14 @@ export declare const artifactServerRequestSchema: z.ZodDiscriminatedUnion<[z.Zod
         group: "group";
     }>>>;
     limit: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>, z.ZodObject<{
+    operation: z.ZodLiteral<"groups_memberships">;
+    mode: z.ZodDefault<z.ZodEnum<{
+        service: "service";
+        user: "user";
+    }>>;
+    page: z.ZodOptional<z.ZodNumber>;
+    limit: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>, z.ZodObject<{
     operation: z.ZodLiteral<"flags">;
     mode: z.ZodDefault<z.ZodEnum<{

package/dist/server/broker-contract.js

@@ -31,6 +31,10 @@ const latticeVersion = z.string().min(1).max(128).regex(/^[A-Za-z0-9._-]+$/);
 export const ARTIFACT_PROCESS_RUN_STATUSES = ['pending', 'running', 'completed', 'failed', 'cancelled', 'timed_out'];
 /** Lattice lists at most this many runs per call. */
 export const ARTIFACT_PROCESS_RUNS_LIMIT = 500;
+/** One page of the caller's own group memberships. */
+export const ARTIFACT_GROUP_MEMBERSHIPS_LIMIT = 100;
+/** How far a caller may page their own memberships. The directory is not walked past this. */
+export const ARTIFACT_GROUP_MEMBERSHIPS_MAX_PAGE = 100;
 /** A run page can filter to at most this many entities of one type. */
 export const ARTIFACT_PROCESS_RUN_ENTITIES_LIMIT = 500;
 /** A run share adds collaborators to at most this many explicitly assigned human nodes. */
@@ -225,6 +229,13 @@ export const artifactServerRequestSchema = z.discriminatedUnion('operation', [
         types: z.array(z.enum(ARTIFACT_PROCESS_PRINCIPAL_TYPES)).min(1).max(2).optional(),
         limit: z.number().int().min(1).max(ARTIFACT_PROCESS_PRINCIPAL_SEARCH_LIMIT).optional(),
     }).strict(),
+    // The signed-in user's own group memberships. No search, no admin directory, no group-id allowlist:
+    // the directory returns the groups this user is in. Service mode is refused by the handler.
+    z.object({
+        operation: z.literal('groups_memberships'), mode,
+        page: z.number().int().min(1).max(ARTIFACT_GROUP_MEMBERSHIPS_MAX_PAGE).optional(),
+        limit: z.number().int().min(1).max(ARTIFACT_GROUP_MEMBERSHIPS_LIMIT).optional(),
+    }).strict(),
     // Evaluates feature flags as Atlas evaluates its own: for the user, or with no user in service mode.
     // A read: it needs no manifest declaration, as the browser bridge's flags.isEnabled needs none.
     z.object({ operation: z.literal('flags'), mode, names: z.array(flagName).min(1).max(ARTIFACT_FLAGS_PER_REQUEST) }).strict(),

package/dist/server/client.d.ts

@@ -1,6 +1,7 @@
 import { storageClient } from '@sequenceholdings/storage';
 import { type OperationExecutor } from '@sequenceholdings/orm/client';
 import { type ArtifactAuditAction, type ArtifactServerMode } from './broker-contract.js';
+import { type ArtifactServerGroups } from './groups.js';
 import { type ArtifactServerProcesses } from './processes.js';
 import { type ArtifactOrmJsonScalars } from '../orm-json-scalars.js';
 import { createArtifactLogger, type ArtifactLogRecord } from './logger.js';
@@ -10,6 +11,7 @@ import { createApiClient } from './api-client.js';
 import { type ArtifactPrincipal } from './principal.js';
 import { type ArtifactRuntimeConfig, type ArtifactRequestHeaders } from './runtime-config.js';
 export { ArtifactPrincipalError, ArtifactServerError, INSUFFICIENT_USER_AUTHENTICATION, stepUpResponse } from './errors.js';
+export type * from './groups.js';
 export type * from './processes.js';
 export type { ArtifactServerFetchOptions } from './api-client.js';
 /**
@@ -82,6 +84,7 @@ export interface ArtifactServerClient<TContext extends ArtifactServerContext = A
         invoke<TOutput = unknown>(id: string, params?: Record<string, unknown>): Promise<TOutput>;
     };
     processes: ArtifactServerProcesses;
+    groups: ArtifactServerGroups;
     flags: ArtifactServerFlags;
     audit: ArtifactServerAudit;
     orm(input: ArtifactOrmOptions): OperationExecutor;

package/dist/server/client.js

@@ -3,6 +3,7 @@ import { StorageApiError, storageClient, storageErrorSchema } from '@sequencehol
 import { OrmOperationError } from '@sequenceholdings/orm/client';
 import { z } from 'zod';
 import { artifactOrmIdempotencyKeySchema, artifactServerRequestSchema } from './broker-contract.js';
+import { createArtifactGroupsClient } from './groups.js';
 import { createArtifactProcessesClient } from './processes.js';
 import { assertJsonScalarsAcknowledged, ORM_JSON_SCALARS_HEADER } from '../orm-json-scalars.js';
 import { createArtifactLogger } from './logger.js';
@@ -96,6 +97,7 @@ function buildClient(args) {
             },
         },
         processes: createArtifactProcessesClient({ mode, json }),
+        groups: createArtifactGroupsClient({ mode, json }),
         flags: {
             evaluate: evaluateFlags,
             isEnabled: async (flagName) => (await evaluateFlags([flagName]))[flagName] === true,

package/dist/server/groups.d.ts

@@ -0,0 +1,32 @@
+import { type ArtifactServerMode, type ArtifactServerRequest } from './broker-contract.js';
+/** One group the signed-in user belongs to. `userRole` is `admin` when they administer it. */
+export interface ArtifactGroupMembership {
+    id: string;
+    userRole: 'admin' | 'member';
+    memberCount: number;
+}
+export interface ArtifactGroupMembershipsQuery {
+    page?: number;
+    limit?: number;
+}
+export interface ArtifactGroupMembershipsPage {
+    groups: ArtifactGroupMembership[];
+    pagination: {
+        page: number;
+        limit: number;
+        totalCount: number;
+        totalPages: number;
+    };
+}
+export interface ArtifactServerGroups {
+    /**
+     * The signed-in user's group memberships. Requires `server.capabilities.groups.read`.
+     * Atlas decides which groups they are in; this call cannot name groups, search the directory,
+     * or read another user's memberships.
+     */
+    list(query?: ArtifactGroupMembershipsQuery): Promise<ArtifactGroupMembershipsPage>;
+}
+export declare function createArtifactGroupsClient({ mode, json }: {
+    mode: ArtifactServerMode;
+    json: (operation: ArtifactServerRequest) => Promise<unknown>;
+}): ArtifactServerGroups;

package/dist/server/groups.js

@@ -0,0 +1,28 @@
+import { z } from 'zod';
+import { ARTIFACT_GROUP_MEMBERSHIPS_LIMIT, artifactServerRequestSchema, } from './broker-contract.js';
+import { ArtifactServerError } from './errors.js';
+const membershipsPageSchema = z.object({
+    groups: z.array(z.object({
+        id: z.string().min(1).max(255),
+        userRole: z.enum(['admin', 'member']),
+        memberCount: z.number().int().nonnegative(),
+    }).strict()),
+    pagination: z.object({
+        page: z.number().int().min(1),
+        limit: z.number().int().min(1).max(ARTIFACT_GROUP_MEMBERSHIPS_LIMIT),
+        totalCount: z.number().int().nonnegative(),
+        totalPages: z.number().int().nonnegative(),
+    }).strict(),
+}).strict();
+export function createArtifactGroupsClient({ mode, json }) {
+    return {
+        async list(query = {}) {
+            const parsed = membershipsPageSchema.safeParse(await json(artifactServerRequestSchema.parse({
+                operation: 'groups_memberships', mode, ...query,
+            })));
+            if (!parsed.success)
+                throw new ArtifactServerError(502, 'invalid_response', 'Atlas returned a malformed groups response');
+            return parsed.data;
+        },
+    };
+}

package/dist/server.d.ts

@@ -2,8 +2,8 @@ import 'server-only';
 export { createArtifactServerClient } from './server/client.js';
 export { ArtifactPrincipalError, ArtifactServerError, INSUFFICIENT_USER_AUTHENTICATION, stepUpResponse } from './server/errors.js';
 export type { ArtifactAtlasRefusal } from './server/errors.js';
-export type { ArtifactAuditEvent, ArtifactOrmOperations, ArtifactOrmOptions, ArtifactProcessAdvance, ArtifactProcessAdvanceResult, ArtifactProcessArtifactRef, ArtifactProcessAssign, ArtifactProcessAssignResult, ArtifactProcessDefinition, ArtifactProcessDescribeQuery, ArtifactProcessEdge, ArtifactProcessHumanNode, ArtifactProcessNode, ArtifactProcessNodeBase, ArtifactProcessNodeState, ArtifactProcessPrincipal, ArtifactProcessPrincipalSearch, ArtifactProcessPrincipals, ArtifactProcessRun, ArtifactProcessRunRecord, ArtifactProcessRunSnapshot, ArtifactProcessRunSummary, ArtifactProcessRunsPage, ArtifactProcessRunsPageQuery, ArtifactProcessRunsQuery, ArtifactProcessRunViewerChange, ArtifactProcessRunViewers, ArtifactProcessStart, ArtifactProcessStepRecord, ArtifactProcessShareRun, ArtifactProcessShareRunResult, ArtifactProcessRunSharingAuthoritiesQuery, ArtifactProcessRunSharingAuthoritiesPage, ArtifactProcessRunSharingAuthority, ArtifactProcessRunSharingDelegate, ArtifactProcessRevokeRunSharingAuthority, ArtifactProcessRevokeRunSharingAuthorityResult, ArtifactProcessTask, ArtifactProcessTasksQuery, ArtifactServerAudit, ArtifactServerClient, ArtifactServerClientOptions, ArtifactServerContext, ArtifactServerFetchOptions, ArtifactServerFlags, ArtifactServerProcesses, } from './server/client.js';
-export { ARTIFACT_AUDIT_ACTIONS, ARTIFACT_AUDIT_RESOURCES_PER_EVENT, ARTIFACT_FLAGS_PER_REQUEST, ARTIFACT_PROCESS_PRINCIPAL_SEARCH_LIMIT, ARTIFACT_PROCESS_PRINCIPAL_TYPES, ARTIFACT_PROCESS_PRINCIPALS_PER_CALL, ARTIFACT_PROCESS_RUN_STATUSES, ARTIFACT_PROCESS_RUNS_LIMIT, ARTIFACT_PROCESS_RUN_ENTITIES_LIMIT, ARTIFACT_PROCESS_SHARE_NODES_LIMIT, ARTIFACT_PROCESS_SHARING_AUTHORITIES_LIMIT, ARTIFACT_PROCESS_TASK_VIEWS, ARTIFACT_PROCESS_TASKS_LIMIT, } from './server/broker-contract.js';
+export type { ArtifactAuditEvent, ArtifactOrmOperations, ArtifactOrmOptions, ArtifactProcessAdvance, ArtifactProcessAdvanceResult, ArtifactProcessArtifactRef, ArtifactProcessAssign, ArtifactProcessAssignResult, ArtifactProcessDefinition, ArtifactProcessDescribeQuery, ArtifactProcessEdge, ArtifactProcessHumanNode, ArtifactProcessNode, ArtifactProcessNodeBase, ArtifactProcessNodeState, ArtifactProcessPrincipal, ArtifactProcessPrincipalSearch, ArtifactProcessPrincipals, ArtifactProcessRun, ArtifactProcessRunRecord, ArtifactProcessRunSnapshot, ArtifactProcessRunSummary, ArtifactProcessRunsPage, ArtifactProcessRunsPageQuery, ArtifactProcessRunsQuery, ArtifactProcessRunViewerChange, ArtifactProcessRunViewers, ArtifactProcessStart, ArtifactProcessStepRecord, ArtifactProcessShareRun, ArtifactProcessShareRunResult, ArtifactProcessRunSharingAuthoritiesQuery, ArtifactProcessRunSharingAuthoritiesPage, ArtifactProcessRunSharingAuthority, ArtifactProcessRunSharingDelegate, ArtifactProcessRevokeRunSharingAuthority, ArtifactProcessRevokeRunSharingAuthorityResult, ArtifactProcessTask, ArtifactProcessTasksQuery, ArtifactServerAudit, ArtifactServerClient, ArtifactServerClientOptions, ArtifactServerContext, ArtifactServerFetchOptions, ArtifactServerFlags, ArtifactServerGroups, ArtifactServerProcesses, ArtifactGroupMembership, ArtifactGroupMembershipsPage, ArtifactGroupMembershipsQuery, } from './server/client.js';
+export { ARTIFACT_AUDIT_ACTIONS, ARTIFACT_AUDIT_RESOURCES_PER_EVENT, ARTIFACT_FLAGS_PER_REQUEST, ARTIFACT_GROUP_MEMBERSHIPS_LIMIT, ARTIFACT_GROUP_MEMBERSHIPS_MAX_PAGE, ARTIFACT_PROCESS_PRINCIPAL_SEARCH_LIMIT, ARTIFACT_PROCESS_PRINCIPAL_TYPES, ARTIFACT_PROCESS_PRINCIPALS_PER_CALL, ARTIFACT_PROCESS_RUN_STATUSES, ARTIFACT_PROCESS_RUNS_LIMIT, ARTIFACT_PROCESS_RUN_ENTITIES_LIMIT, ARTIFACT_PROCESS_SHARE_NODES_LIMIT, ARTIFACT_PROCESS_SHARING_AUTHORITIES_LIMIT, ARTIFACT_PROCESS_TASK_VIEWS, ARTIFACT_PROCESS_TASKS_LIMIT, } from './server/broker-contract.js';
 export type { ArtifactAuditAction, ArtifactProcessPrincipalType, ArtifactProcessRunStatus, ArtifactProcessTaskView, } from './server/broker-contract.js';
 export { getArtifactRequestContext, readArtifactRuntimeConfig } from './server/runtime-config.js';
 export type { ArtifactRuntimeConfig, ArtifactRequestHeaders } from './server/runtime-config.js';

package/dist/server.js

@@ -1,7 +1,7 @@
 import 'server-only';
 export { createArtifactServerClient } from './server/client.js';
 export { ArtifactPrincipalError, ArtifactServerError, INSUFFICIENT_USER_AUTHENTICATION, stepUpResponse } from './server/errors.js';
-export { ARTIFACT_AUDIT_ACTIONS, ARTIFACT_AUDIT_RESOURCES_PER_EVENT, ARTIFACT_FLAGS_PER_REQUEST, ARTIFACT_PROCESS_PRINCIPAL_SEARCH_LIMIT, ARTIFACT_PROCESS_PRINCIPAL_TYPES, ARTIFACT_PROCESS_PRINCIPALS_PER_CALL, ARTIFACT_PROCESS_RUN_STATUSES, ARTIFACT_PROCESS_RUNS_LIMIT, ARTIFACT_PROCESS_RUN_ENTITIES_LIMIT, ARTIFACT_PROCESS_SHARE_NODES_LIMIT, ARTIFACT_PROCESS_SHARING_AUTHORITIES_LIMIT, ARTIFACT_PROCESS_TASK_VIEWS, ARTIFACT_PROCESS_TASKS_LIMIT, } from './server/broker-contract.js';
+export { ARTIFACT_AUDIT_ACTIONS, ARTIFACT_AUDIT_RESOURCES_PER_EVENT, ARTIFACT_FLAGS_PER_REQUEST, ARTIFACT_GROUP_MEMBERSHIPS_LIMIT, ARTIFACT_GROUP_MEMBERSHIPS_MAX_PAGE, ARTIFACT_PROCESS_PRINCIPAL_SEARCH_LIMIT, ARTIFACT_PROCESS_PRINCIPAL_TYPES, ARTIFACT_PROCESS_PRINCIPALS_PER_CALL, ARTIFACT_PROCESS_RUN_STATUSES, ARTIFACT_PROCESS_RUNS_LIMIT, ARTIFACT_PROCESS_RUN_ENTITIES_LIMIT, ARTIFACT_PROCESS_SHARE_NODES_LIMIT, ARTIFACT_PROCESS_SHARING_AUTHORITIES_LIMIT, ARTIFACT_PROCESS_TASK_VIEWS, ARTIFACT_PROCESS_TASKS_LIMIT, } from './server/broker-contract.js';
 export { getArtifactRequestContext, readArtifactRuntimeConfig } from './server/runtime-config.js';
 export { ArtifactContextError, getArtifactBrowserBootstrap } from './server/request-context.js';
 export { verifyArtifactExternalContext } from './server/external-context.js';

package/dist/source-boundary.js

@@ -1,3 +1,4 @@
+import { realpathSync } from 'node:fs';
 import { isAbsolute, relative, resolve, sep } from 'node:path';
 /**
  * Artifact source must be self-contained: allowing a relative import to escape
@@ -7,8 +8,8 @@ import { isAbsolute, relative, resolve, sep } from 'node:path';
  * allowed because they are external to the artifact by design.
  */
 export function rejectOutsideSourcePlugin({ root, trustedExternalRoots, }) {
-    const rootResolved = resolve(root);
-    const trustedRoots = trustedExternalRoots.map((trustedRoot) => resolve(trustedRoot));
+    const rootResolved = realpathSync(resolve(root));
+    const trustedRoots = trustedExternalRoots.map((trustedRoot) => realpathSync(resolve(trustedRoot)));
     return {
         name: 'reject-artifact-outside-source',
         enforce: 'pre',
@@ -17,15 +18,22 @@ export function rejectOutsideSourcePlugin({ root, trustedExternalRoots, }) {
             if (!resolved || resolved.external || resolved.id.startsWith('\0'))
                 return resolved;
             const filePath = resolved.id.split('?')[0];
-            if (!isAbsolute(filePath) || isPathWithin(rootResolved, filePath))
+            if (!isAbsolute(filePath))
+                return resolved;
+            // Vite may return a physical path for a root reached through /tmp or
+            // another symlink. Check physical paths on both sides of the boundary;
+            // this also prevents an in-root symlink from admitting an outside file.
+            const realFilePath = realpathSync(filePath);
+            if (isPathWithin(rootResolved, realFilePath))
                 return resolved;
             const importerPath = importer?.split('?')[0];
             const importerIsTrustedExternal = importerPath != null &&
-                (isNodeModulesPath(importerPath) || isTrustedExternalPath(importerPath, trustedRoots));
+                (isNodeModulesPath(importerPath) ||
+                    (isAbsolute(importerPath) && isTrustedExternalPath(realpathSync(importerPath), trustedRoots)));
             if (isNodeModulesPath(filePath) && (isBareImport(source) || importerIsTrustedExternal)) {
                 return resolved;
             }
-            if (isTrustedExternalPath(filePath, trustedRoots))
+            if (isTrustedExternalPath(realFilePath, trustedRoots))
                 return resolved;
             const from = importer
                 ? ` (imported from ${relative(rootResolved, importer.split('?')[0])})`

package/dist/templates/react-vite/package.json

@@ -10,7 +10,7 @@
   },
   "dependencies": {},
   "devDependencies": {
-    "@sequenceholdings/artifact-studio": "^0.7.0",
+    "@sequenceholdings/artifact-studio": "^0.8.0",
     "@sequenceholdings/atlas-ui": "^3.1.1",
     "@tailwindcss/postcss": "^4.2.2",
     "@tailwindcss/vite": "^4.2.2",

package/package.json

@@ -9,7 +9,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.7.1",
+  "version": "0.8.0",
   "description": "SDK types and CLI library for building Artifact Studio apps. Driven via `seq-studio artifact <sub>` (@sequenceholdings/studio-cli), which runs the `./cli` runCli export.",
   "type": "module",
   "exports": {
@@ -167,9 +167,9 @@
     "google-auth-library": "^10.5.0",
     "server-only": "0.0.1",
     "parse5": "7.3.0",
-    "@sequenceholdings/lattice-form-renderer": "0.2.0",
     "@sequenceholdings/storage": "0.1.1",
-    "@sequenceholdings/orm": "2.6.1"
+    "@sequenceholdings/orm": "2.6.1",
+    "@sequenceholdings/lattice-form-renderer": "0.2.0"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",

package/templates/react-vite/package.json

@@ -10,7 +10,7 @@
   },
   "dependencies": {},
   "devDependencies": {
-    "@sequenceholdings/artifact-studio": "^0.7.0",
+    "@sequenceholdings/artifact-studio": "^0.8.0",
     "@sequenceholdings/atlas-ui": "^3.1.1",
     "@tailwindcss/postcss": "^4.2.2",
     "@tailwindcss/vite": "^4.2.2",