@construct-space/cli 1.1.11 → 1.2.0

package/dist/index.js

@@ -5,43 +5,25 @@ var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-function __accessProp(key) {
-  return this[key];
-}
-var __toESMCache_node;
-var __toESMCache_esm;
 var __toESM = (mod, isNodeMode, target) => {
-  var canCache = mod != null && typeof mod === "object";
-  if (canCache) {
-    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
-    var cached = cache.get(mod);
-    if (cached)
-      return cached;
-  }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
   for (let key of __getOwnPropNames(mod))
     if (!__hasOwnProp.call(to, key))
       __defProp(to, key, {
-        get: __accessProp.bind(mod, key),
+        get: () => mod[key],
         enumerable: true
       });
-  if (canCache)
-    cache.set(mod, to);
   return to;
 };
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
-var __returnValue = (v) => v;
-function __exportSetter(name, newValue) {
-  this[name] = __returnValue.bind(null, newValue);
-}
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, {
       get: all[name],
       enumerable: true,
       configurable: true,
-      set: __exportSetter.bind(all, name)
+      set: (newValue) => all[name] = () => newValue
     });
 };
 var __require = import.meta.require;
@@ -2807,6 +2789,7 @@ Object.defineProperties(createChalk.prototype, styles2);
 var chalk = createChalk();
 var chalkStderr = createChalk({ level: stderrColor ? stderrColor.level : 0 });
 var source_default = chalk;
+
 // node_modules/@inquirer/core/dist/lib/key.js
 var isUpKey = (key, keybindings = []) => key.name === "up" || keybindings.includes("vim") && key.name === "k" || keybindings.includes("emacs") && key.ctrl && key.name === "p";
 var isDownKey = (key, keybindings = []) => key.name === "down" || keybindings.includes("vim") && key.name === "j" || keybindings.includes("emacs") && key.ctrl && key.name === "n";
@@ -2951,7 +2934,7 @@ var effectScheduler = {
 // node_modules/@inquirer/core/dist/lib/use-state.js
 function useState(defaultValue) {
   return withPointer((pointer) => {
-    const setState = AsyncResource2.bind(function setState2(newValue) {
+    const setState = AsyncResource2.bind(function setState(newValue) {
       if (pointer.get() !== newValue) {
         pointer.set(newValue);
         handleChange();
@@ -4727,7 +4710,7 @@ async function scaffold(nameArg, options) {
 }
 
 // src/commands/build.ts
-import { existsSync as existsSync6, readFileSync as readFileSync4, readdirSync as readdirSync2, renameSync, statSync as statSync2 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync4, readdirSync as readdirSync3, renameSync, statSync as statSync3 } from "fs";
 import { join as join6 } from "path";
 import { createHash } from "crypto";
 
@@ -7380,8 +7363,8 @@ function validate2(m) {
     errors2.push("author: must be an object with a name");
   if (!m.icon)
     errors2.push("icon: must be a string");
-  if (!["company", "project", "both"].includes(m.scope))
-    errors2.push('scope: must be "company", "project", or "both"');
+  if (!["app", "project", "org", "any"].includes(m.scope))
+    errors2.push('scope: must be "app", "project", "org", or "any"');
   if (!m.pages?.length)
     errors2.push("pages: must be a non-empty array");
   if (!m.navigation?.label)
@@ -7408,30 +7391,84 @@ function exists(dir) {
 }
 
 // src/lib/entry.ts
-import { writeFileSync as writeFileSync3, mkdirSync as mkdirSync2, existsSync as existsSync4 } from "fs";
-import { join as join4, basename, extname } from "path";
+import { writeFileSync as writeFileSync3, mkdirSync as mkdirSync2, existsSync as existsSync4, readdirSync, statSync } from "fs";
+import { join as join4, basename, extname, relative } from "path";
 function capitalize(s) {
   if (!s)
     return s;
   return s.split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join("");
 }
-function resolvePages(m, prefix) {
+function scanPagesDir(pagesDir) {
+  const results = [];
+  function walk(dir, routeSegments) {
+    if (!existsSync4(dir))
+      return;
+    const entries = readdirSync(dir).sort();
+    for (const entry of entries) {
+      const fullPath = join4(dir, entry);
+      const stat = statSync(fullPath);
+      if (stat.isDirectory()) {
+        const segment = entry.replace(/^\[(.+)\]$/, ":$1");
+        walk(fullPath, [...routeSegments, segment]);
+      } else if (stat.isFile() && entry.endsWith(".vue")) {
+        const nameWithoutExt = entry.replace(/\.vue$/, "");
+        const relFile = relative(join4(pagesDir, ".."), fullPath).replace(/\\/g, "/");
+        let routePath;
+        if (nameWithoutExt === "index") {
+          routePath = routeSegments.join("/");
+        } else {
+          const segment = nameWithoutExt.replace(/^\[(.+)\]$/, ":$1");
+          routePath = [...routeSegments, segment].join("/");
+        }
+        results.push({ filePath: relFile, routePath });
+      }
+    }
+  }
+  walk(pagesDir, []);
+  return results;
+}
+function varNameFromFile(filePath) {
+  let cleaned = filePath.replace(/^pages\//, "").replace(/\.vue$/, "");
+  cleaned = cleaned.replace(/\[([^\]]+)\]/g, "$1");
+  const segments = cleaned.split(/[\/-]/).filter(Boolean);
+  const name = segments.map((s) => s.charAt(0).toUpperCase() + s.slice(1)).join("");
+  return (name || "Index") + "Page";
+}
+function resolvePages(m, root, prefix) {
+  const pagesDir = join4(root, "src", "pages");
+  const fsPages = scanPagesDir(pagesDir);
+  const fsMap = new Map;
+  for (const fp of fsPages) {
+    fsMap.set(fp.routePath, fp);
+  }
   return m.pages.map((p) => {
-    let component = p.component;
-    if (!component) {
-      component = p.path === "" ? "pages/index.vue" : `pages/${p.path}.vue`;
+    if (p.component) {
+      const base = basename(p.component);
+      const nameWithoutExt = base.replace(extname(base), "").replace(/[\[\]]/g, "");
+      const dir = p.component.replace(/^pages\//, "").replace(/\/[^/]+$/, "");
+      let varName;
+      if (dir && dir !== p.component.replace(/^pages\//, "")) {
+        varName = capitalize(dir.split("/").map((s) => s.replace(/[\[\]]/g, "")).join("-")) + capitalize(nameWithoutExt) + "Page";
+      } else {
+        varName = capitalize(nameWithoutExt) + "Page";
+      }
+      return { varName, importPath: prefix + p.component, path: p.path };
+    }
+    const fsPage = fsMap.get(p.path);
+    if (fsPage) {
+      const varName = varNameFromFile(fsPage.filePath);
+      return { varName, importPath: prefix + fsPage.filePath, path: p.path };
     }
-    let varName = "IndexPage";
-    if (p.path) {
-      let cleanPath = p.path.replace(/:/g, "");
-      if (p.component) {
-        let base = basename(p.component);
-        base = base.replace(extname(base), "").replace(/[\[\]]/g, "");
-        cleanPath = base;
+    const legacyComponent = p.path === "" ? "pages/index.vue" : `pages/${p.path}.vue`;
+    const legacyFullPath = join4(root, "src", legacyComponent);
+    if (existsSync4(legacyFullPath)) {
+      let varName = "IndexPage";
+      if (p.path) {
+        varName = capitalize(p.path.replace(/[\/:]/g, "-").replace(/-+/g, "-")) + "Page";
       }
-      varName = capitalize(cleanPath) + "Page";
+      return { varName, importPath: prefix + legacyComponent, path: p.path };
     }
-    return { varName, importPath: prefix + component, path: p.path };
+    throw new Error(`[entry] Could not resolve component for page "${p.path}". ` + `Checked: manifest component field, filesystem scan of src/pages/, ` + `and legacy fallback at ${legacyComponent}. ` + `Ensure a .vue file exists for this route.`);
   });
 }
 function resolveWidgets(m, prefix) {
@@ -7450,7 +7487,7 @@ function resolveWidgets(m, prefix) {
 }
 function generate(root, m) {
   const pagePrefix = existsSync4(join4(root, "src", "pages")) ? "./" : "../";
-  const pages = resolvePages(m, pagePrefix);
+  const pages = resolvePages(m, root, pagePrefix);
   const widgets = resolveWidgets(m, "../");
   const actionsPath = join4(root, "src", "actions.ts");
   const hasActions = existsSync4(actionsPath);
@@ -7506,7 +7543,7 @@ function writeEntry(root, m) {
 }
 
 // src/lib/agent.ts
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync4, readdirSync, existsSync as existsSync5 } from "fs";
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync4, readdirSync as readdirSync2, existsSync as existsSync5 } from "fs";
 import { join as join5, extname as extname2, basename as basename2 } from "path";
 var AGENT_KEY = "construct-agent-obfuscate-v1";
 function encode(content) {
@@ -7522,7 +7559,7 @@ function readMdFiles(dir) {
   const result = {};
   if (!existsSync5(dir))
     return result;
-  for (const f of readdirSync(dir)) {
+  for (const f of readdirSync2(dir)) {
     if (extname2(f) !== ".md")
       continue;
     result[basename2(f, ".md")] = readFileSync3(join5(dir, f), "utf-8");
@@ -7533,7 +7570,7 @@ function readJsonFiles(dir) {
   const result = {};
   if (!existsSync5(dir))
     return result;
-  for (const f of readdirSync(dir)) {
+  for (const f of readdirSync2(dir)) {
     if (extname2(f) !== ".json")
       continue;
     result[basename2(f, ".json")] = readFileSync3(join5(dir, f), "utf-8");
@@ -7623,7 +7660,7 @@ async function build(options) {
   }
   runHook(m.hooks, "postBuild", root);
   const agentDir = join6(root, "agent");
-  if (existsSync6(agentDir) && statSync2(agentDir).isDirectory()) {
+  if (existsSync6(agentDir) && statSync3(agentDir).isDirectory()) {
     const distDir2 = join6(root, "dist");
     bundleAgentDir(agentDir, distDir2);
     bundleAgentDir(agentDir, root);
@@ -7632,7 +7669,7 @@ async function build(options) {
   const expectedBundle = `space-${m.id}.iife.js`;
   let bundlePath = join6(distDir, expectedBundle);
   if (!existsSync6(bundlePath)) {
-    const matches = readdirSync2(distDir).filter((f) => f.startsWith("space-") && f.endsWith(".iife.js"));
+    const matches = readdirSync3(distDir).filter((f) => f.startsWith("space-") && f.endsWith(".iife.js"));
     if (matches.length === 1) {
       renameSync(join6(distDir, matches[0]), bundlePath);
       const oldCSS = join6(distDir, matches[0].replace(".iife.js", ".css"));
@@ -7666,16 +7703,16 @@ import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
 import { join as join9 } from "path";
 import { createHash as createHash2 } from "crypto";
 
-// node_modules/chokidar/esm/index.js
-import { stat as statcb } from "fs";
-import { stat as stat3, readdir as readdir2 } from "fs/promises";
+// node_modules/chokidar/index.js
 import { EventEmitter } from "events";
-import * as sysPath2 from "path";
+import { stat as statcb, Stats } from "fs";
+import { readdir as readdir2, stat as stat3 } from "fs/promises";
+import * as sp2 from "path";
 
-// node_modules/readdirp/esm/index.js
-import { stat, lstat, readdir, realpath } from "fs/promises";
+// node_modules/readdirp/index.js
+import { lstat, readdir, realpath, stat } from "fs/promises";
+import { join as pjoin, relative as prelative, resolve as presolve, sep as psep } from "path";
 import { Readable } from "stream";
-import { resolve as presolve, relative as prelative, join as pjoin, sep as psep } from "path";
 var EntryTypes = {
   FILE_TYPE: "files",
   DIR_TYPE: "directories",
@@ -7731,6 +7768,20 @@ var normalizeFilter = (filter) => {
 };
 
 class ReaddirpStream extends Readable {
+  parents;
+  reading;
+  parent;
+  _stat;
+  _maxDepth;
+  _wantsDir;
+  _wantsFile;
+  _wantsEverything;
+  _root;
+  _isDirent;
+  _statsProp;
+  _rdOptions;
+  _fileFilter;
+  _directoryFilter;
   constructor(options = {}) {
     super({
       objectMode: true,
@@ -7747,7 +7798,7 @@ class ReaddirpStream extends Readable {
     } else {
       this._stat = statMethod;
     }
-    this._maxDepth = opts.depth ?? defaultOptions.depth;
+    this._maxDepth = opts.depth != null && Number.isSafeInteger(opts.depth) ? opts.depth : defaultOptions.depth;
     this._wantsDir = type ? DIR_TYPES.has(type) : false;
     this._wantsFile = type ? FILE_TYPES.has(type) : false;
     this._wantsEverything = type === EntryTypes.EVERYTHING_TYPE;
@@ -7892,11 +7943,11 @@ function readdirp(root, options = {}) {
   return new ReaddirpStream(options);
 }
 
-// node_modules/chokidar/esm/handler.js
-import { watchFile, unwatchFile, watch as fs_watch } from "fs";
-import { open, stat as stat2, lstat as lstat2, realpath as fsrealpath } from "fs/promises";
-import * as sysPath from "path";
+// node_modules/chokidar/handler.js
+import { watch as fs_watch, unwatchFile, watchFile } from "fs";
+import { realpath as fsrealpath, lstat as lstat2, open, stat as stat2 } from "fs/promises";
 import { type as osType } from "os";
+import * as sp from "path";
 var STR_DATA = "data";
 var STR_END = "end";
 var STR_CLOSE = "close";
@@ -8188,7 +8239,7 @@ var binaryExtensions = new Set([
   "zip",
   "zipx"
 ]);
-var isBinaryPath = (filePath) => binaryExtensions.has(sysPath.extname(filePath).slice(1).toLowerCase());
+var isBinaryPath = (filePath) => binaryExtensions.has(sp.extname(filePath).slice(1).toLowerCase());
 var foreach = (val, fn) => {
   if (val instanceof Set) {
     val.forEach(fn);
@@ -8226,7 +8277,7 @@ function createFsWatchInstance(path, options, listener, errHandler, emitRaw) {
     listener(path);
     emitRaw(rawEvent, evPath, { watchedPath: path });
     if (evPath && path !== evPath) {
-      fsWatchBroadcast(sysPath.resolve(path, evPath), KEY_LISTENERS, sysPath.join(path, evPath));
+      fsWatchBroadcast(sp.resolve(path, evPath), KEY_LISTENERS, sp.join(path, evPath));
     }
   };
   try {
@@ -8341,17 +8392,19 @@ var setFsWatchFileListener = (path, fullPath, options, handlers) => {
 };
 
 class NodeFsHandler {
+  fsw;
+  _boundHandleError;
   constructor(fsW) {
     this.fsw = fsW;
     this._boundHandleError = (error2) => fsW._handleError(error2);
   }
   _watchWithNodeFs(path, listener) {
     const opts = this.fsw.options;
-    const directory = sysPath.dirname(path);
-    const basename4 = sysPath.basename(path);
+    const directory = sp.dirname(path);
+    const basename4 = sp.basename(path);
     const parent = this.fsw._getWatchedDir(directory);
     parent.add(basename4);
-    const absolutePath = sysPath.resolve(path);
+    const absolutePath = sp.resolve(path);
     const options = {
       persistent: opts.persistent
     };
@@ -8378,8 +8431,8 @@ class NodeFsHandler {
     if (this.fsw.closed) {
       return;
     }
-    const dirname3 = sysPath.dirname(file);
-    const basename4 = sysPath.basename(file);
+    const dirname3 = sp.dirname(file);
+    const basename4 = sp.basename(file);
     const parent = this.fsw._getWatchedDir(dirname3);
     let prevStats = stats;
     if (parent.has(basename4))
@@ -8462,8 +8515,9 @@ class NodeFsHandler {
     this.fsw._symlinkPaths.set(full, true);
   }
   _handleRead(directory, initialAdd, wh, target, dir, depth, throttler) {
-    directory = sysPath.join(directory, "");
-    throttler = this.fsw._throttle("readdir", directory, 1000);
+    directory = sp.join(directory, "");
+    const throttleKey = target ? `${directory}:${target}` : directory;
+    throttler = this.fsw._throttle("readdir", throttleKey, 1000);
     if (!throttler)
       return;
     const previous = this.fsw._getWatchedDir(wh.path);
@@ -8480,7 +8534,7 @@ class NodeFsHandler {
         return;
       }
       const item = entry.path;
-      let path = sysPath.join(directory, item);
+      let path = sp.join(directory, item);
       current.add(item);
       if (entry.stats.isSymbolicLink() && await this._handleSymlink(entry, directory, path, item)) {
         return;
@@ -8491,7 +8545,7 @@ class NodeFsHandler {
       }
       if (item === target || !target && !previous.has(item)) {
         this.fsw._incrReadyCount();
-        path = sysPath.join(dir, sysPath.relative(dir, path));
+        path = sp.join(dir, sp.relative(dir, path));
         this._addToNodeFs(path, initialAdd, wh, depth + 1);
       }
     }).on(EV.ERROR, this._boundHandleError);
@@ -8517,12 +8571,12 @@ class NodeFsHandler {
     });
   }
   async _handleDir(dir, stats, initialAdd, depth, target, wh, realpath2) {
-    const parentDir = this.fsw._getWatchedDir(sysPath.dirname(dir));
-    const tracked = parentDir.has(sysPath.basename(dir));
+    const parentDir = this.fsw._getWatchedDir(sp.dirname(dir));
+    const tracked = parentDir.has(sp.basename(dir));
     if (!(initialAdd && this.fsw.options.ignoreInitial) && !target && !tracked) {
       this.fsw._emit(EV.ADD_DIR, dir, stats);
     }
-    parentDir.add(sysPath.basename(dir));
+    parentDir.add(sp.basename(dir));
     this.fsw._getWatchedDir(dir);
     let throttler;
     let closer;
@@ -8563,7 +8617,7 @@ class NodeFsHandler {
       const follow = this.fsw.options.followSymlinks;
       let closer;
       if (stats.isDirectory()) {
-        const absPath = sysPath.resolve(path);
+        const absPath = sp.resolve(path);
         const targetPath = follow ? await fsrealpath(path) : path;
         if (this.fsw.closed)
           return;
@@ -8577,14 +8631,14 @@ class NodeFsHandler {
         const targetPath = follow ? await fsrealpath(path) : path;
         if (this.fsw.closed)
           return;
-        const parent = sysPath.dirname(wh.watchPath);
+        const parent = sp.dirname(wh.watchPath);
         this.fsw._getWatchedDir(parent).add(wh.watchPath);
         this.fsw._emit(EV.ADD, wh.watchPath, stats);
         closer = await this._handleDir(parent, stats, initialAdd, depth, path, wh, targetPath);
         if (this.fsw.closed)
           return;
         if (targetPath !== undefined) {
-          this.fsw._symlinkPaths.set(sysPath.resolve(path), targetPath);
+          this.fsw._symlinkPaths.set(sp.resolve(path), targetPath);
         }
       } else {
         closer = this._handleFile(wh.watchPath, stats, initialAdd);
@@ -8602,7 +8656,7 @@ class NodeFsHandler {
   }
 }
 
-// node_modules/chokidar/esm/index.js
+// node_modules/chokidar/index.js
 /*! chokidar - MIT License (c) 2012 Paul Miller (paulmillr.com) */
 var SLASH = "/";
 var SLASH_SLASH = "//";
@@ -8610,7 +8664,7 @@ var ONE_DOT = ".";
 var TWO_DOTS = "..";
 var STRING_TYPE = "string";
 var BACK_SLASH_RE = /\\/g;
-var DOUBLE_SLASH_RE = /\/\//;
+var DOUBLE_SLASH_RE = /\/\//g;
 var DOT_RE = /\..*\.(sw[px])$|~$|\.subl.*\.tmp/;
 var REPLACER_RE = /^\.[/\\]/;
 function arrify(item) {
@@ -8629,11 +8683,11 @@ function createPattern(matcher) {
       if (matcher.path === string)
         return true;
       if (matcher.recursive) {
-        const relative3 = sysPath2.relative(matcher.path, string);
-        if (!relative3) {
+        const relative4 = sp2.relative(matcher.path, string);
+        if (!relative4) {
           return false;
         }
-        return !relative3.startsWith("..") && !sysPath2.isAbsolute(relative3);
+        return !relative4.startsWith("..") && !sp2.isAbsolute(relative4);
       }
       return false;
     };
@@ -8643,14 +8697,12 @@ function createPattern(matcher) {
 function normalizePath(path) {
   if (typeof path !== "string")
     throw new Error("string expected");
-  path = sysPath2.normalize(path);
+  path = sp2.normalize(path);
   path = path.replace(/\\/g, "/");
   let prepend = false;
   if (path.startsWith("//"))
     prepend = true;
-  const DOUBLE_SLASH_RE2 = /\/\//;
-  while (path.match(DOUBLE_SLASH_RE2))
-    path = path.replace(DOUBLE_SLASH_RE2, "/");
+  path = path.replace(DOUBLE_SLASH_RE, "/");
   if (prepend)
     path = "/" + path;
   return path;
@@ -8691,31 +8743,32 @@ var toUnix = (string) => {
   if (str.startsWith(SLASH_SLASH)) {
     prepend = true;
   }
-  while (str.match(DOUBLE_SLASH_RE)) {
-    str = str.replace(DOUBLE_SLASH_RE, SLASH);
-  }
+  str = str.replace(DOUBLE_SLASH_RE, SLASH);
   if (prepend) {
     str = SLASH + str;
   }
   return str;
 };
-var normalizePathToUnix = (path) => toUnix(sysPath2.normalize(toUnix(path)));
+var normalizePathToUnix = (path) => toUnix(sp2.normalize(toUnix(path)));
 var normalizeIgnored = (cwd = "") => (path) => {
   if (typeof path === "string") {
-    return normalizePathToUnix(sysPath2.isAbsolute(path) ? path : sysPath2.join(cwd, path));
+    return normalizePathToUnix(sp2.isAbsolute(path) ? path : sp2.join(cwd, path));
   } else {
     return path;
   }
 };
 var getAbsolutePath = (path, cwd) => {
-  if (sysPath2.isAbsolute(path)) {
+  if (sp2.isAbsolute(path)) {
     return path;
   }
-  return sysPath2.join(cwd, path);
+  return sp2.join(cwd, path);
 };
 var EMPTY_SET = Object.freeze(new Set);
 
 class DirEntry {
+  path;
+  _removeWatcher;
+  items;
   constructor(dir, removeWatcher) {
     this.path = dir;
     this._removeWatcher = removeWatcher;
@@ -8740,7 +8793,7 @@ class DirEntry {
       await readdir2(dir);
     } catch (err) {
       if (this._removeWatcher) {
-        this._removeWatcher(sysPath2.dirname(dir), sysPath2.basename(dir));
+        this._removeWatcher(sp2.dirname(dir), sp2.basename(dir));
       }
     }
   }
@@ -8768,12 +8821,19 @@ var STAT_METHOD_F = "stat";
 var STAT_METHOD_L = "lstat";
 
 class WatchHelper {
+  fsw;
+  path;
+  watchPath;
+  fullWatchPath;
+  dirParts;
+  followSymlinks;
+  statMethod;
   constructor(path, follow, fsw) {
     this.fsw = fsw;
     const watchPath = path;
     this.path = path = path.replace(REPLACER_RE, "");
     this.watchPath = watchPath;
-    this.fullWatchPath = sysPath2.resolve(watchPath);
+    this.fullWatchPath = sp2.resolve(watchPath);
     this.dirParts = [];
     this.dirParts.forEach((parts) => {
       if (parts.length > 1)
@@ -8783,7 +8843,7 @@ class WatchHelper {
     this.statMethod = follow ? STAT_METHOD_F : STAT_METHOD_L;
   }
   entryPath(entry) {
-    return sysPath2.join(this.watchPath, sysPath2.relative(this.watchPath, entry.fullPath));
+    return sp2.join(this.watchPath, sp2.relative(this.watchPath, entry.fullPath));
   }
   filterPath(entry) {
     const { stats } = entry;
@@ -8798,6 +8858,24 @@ class WatchHelper {
 }
 
 class FSWatcher extends EventEmitter {
+  closed;
+  options;
+  _closers;
+  _ignoredPaths;
+  _throttled;
+  _streams;
+  _symlinkPaths;
+  _watched;
+  _pendingWrites;
+  _pendingUnlinks;
+  _readyCount;
+  _emitReady;
+  _closePromise;
+  _userIgnored;
+  _readyEmitted;
+  _emitRaw;
+  _boundRemove;
+  _nodeFsHandler;
   constructor(_opts = {}) {
     super();
     this.closed = false;
@@ -8906,7 +8984,7 @@ class FSWatcher extends EventEmitter {
         return;
       results.forEach((item) => {
         if (item)
-          this.add(sysPath2.dirname(item), sysPath2.basename(_origAdd || item));
+          this.add(sp2.dirname(item), sp2.basename(_origAdd || item));
       });
     });
     return this;
@@ -8917,10 +8995,10 @@ class FSWatcher extends EventEmitter {
     const paths = unifyPaths(paths_);
     const { cwd } = this.options;
     paths.forEach((path) => {
-      if (!sysPath2.isAbsolute(path) && !this._closers.has(path)) {
+      if (!sp2.isAbsolute(path) && !this._closers.has(path)) {
         if (cwd)
-          path = sysPath2.join(cwd, path);
-        path = sysPath2.resolve(path);
+          path = sp2.join(cwd, path);
+        path = sp2.resolve(path);
       }
       this._closePath(path);
       this._addIgnoredPath(path);
@@ -8964,7 +9042,7 @@ class FSWatcher extends EventEmitter {
   getWatched() {
     const watchList = {};
     this._watched.forEach((entry, dir) => {
-      const key = this.options.cwd ? sysPath2.relative(this.options.cwd, dir) : dir;
+      const key = this.options.cwd ? sp2.relative(this.options.cwd, dir) : dir;
       const index = key || ONE_DOT;
       watchList[index] = entry.getChildren().sort();
     });
@@ -8980,9 +9058,9 @@ class FSWatcher extends EventEmitter {
       return;
     const opts = this.options;
     if (isWindows)
-      path = sysPath2.normalize(path);
+      path = sp2.normalize(path);
     if (opts.cwd)
-      path = sysPath2.relative(opts.cwd, path);
+      path = sp2.relative(opts.cwd, path);
     const args = [path];
     if (stats != null)
       args.push(stats);
@@ -9033,7 +9111,7 @@ class FSWatcher extends EventEmitter {
         return this;
     }
     if (opts.alwaysStat && stats === undefined && (event === EVENTS.ADD || event === EVENTS.ADD_DIR || event === EVENTS.CHANGE)) {
-      const fullPath = opts.cwd ? sysPath2.join(opts.cwd, path) : path;
+      const fullPath = opts.cwd ? sp2.join(opts.cwd, path) : path;
       let stats2;
       try {
         stats2 = await stat3(fullPath);
@@ -9089,8 +9167,8 @@ class FSWatcher extends EventEmitter {
     const pollInterval = awf.pollInterval;
     let timeoutHandler;
     let fullPath = path;
-    if (this.options.cwd && !sysPath2.isAbsolute(path)) {
-      fullPath = sysPath2.join(this.options.cwd, path);
+    if (this.options.cwd && !sp2.isAbsolute(path)) {
+      fullPath = sp2.join(this.options.cwd, path);
     }
     const now = new Date;
     const writes = this._pendingWrites;
@@ -9147,7 +9225,7 @@ class FSWatcher extends EventEmitter {
     return new WatchHelper(path, this.options.followSymlinks, this);
   }
   _getWatchedDir(directory) {
-    const dir = sysPath2.resolve(directory);
+    const dir = sp2.resolve(directory);
     if (!this._watched.has(dir))
       this._watched.set(dir, new DirEntry(dir, this._boundRemove));
     return this._watched.get(dir);
@@ -9158,8 +9236,8 @@ class FSWatcher extends EventEmitter {
     return Boolean(Number(stats.mode) & 256);
   }
   _remove(directory, item, isDirectory) {
-    const path = sysPath2.join(directory, item);
-    const fullPath = sysPath2.resolve(path);
+    const path = sp2.join(directory, item);
+    const fullPath = sp2.resolve(path);
     isDirectory = isDirectory != null ? isDirectory : this._watched.has(path) || this._watched.has(fullPath);
     if (!this._throttle("remove", path, 100))
       return;
@@ -9177,7 +9255,7 @@ class FSWatcher extends EventEmitter {
     }
     let relPath = path;
     if (this.options.cwd)
-      relPath = sysPath2.relative(this.options.cwd, path);
+      relPath = sp2.relative(this.options.cwd, path);
     if (this.options.awaitWriteFinish && this._pendingWrites.has(relPath)) {
       const event = this._pendingWrites.get(relPath).cancelWait();
       if (event === EVENTS.ADD)
@@ -9192,8 +9270,8 @@ class FSWatcher extends EventEmitter {
   }
   _closePath(path) {
     this._closeFile(path);
-    const dir = sysPath2.dirname(path);
-    this._getWatchedDir(dir).remove(sysPath2.basename(path));
+    const dir = sp2.dirname(path);
+    this._getWatchedDir(dir).remove(sp2.basename(path));
   }
   _closeFile(path) {
     const closers = this._closers.get(path);
@@ -9362,51 +9440,17 @@ function install() {
 }
 
 // src/commands/publish.ts
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync6, statSync as statSync4, unlinkSync as unlinkSync2 } from "fs";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync6, statSync as statSync5, unlinkSync as unlinkSync2 } from "fs";
 import { join as join14, basename as basename6 } from "path";
 
 // src/lib/auth.ts
 import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, mkdirSync as mkdirSync4, unlinkSync, existsSync as existsSync9 } from "fs";
 import { join as join12, dirname as dirname4 } from "path";
 var CREDENTIALS_FILE = "credentials.json";
-var APP_PROFILES_FILE = "profiles.json";
 var DEFAULT_PORTAL = "https://developer.construct.space";
 function credentialsPath() {
   return join12(dataDir(), CREDENTIALS_FILE);
 }
-function appProfilesPath() {
-  return join12(dataDir(), APP_PROFILES_FILE);
-}
-function appProfileAuthPath(profileId) {
-  return join12(dataDir(), "profiles", profileId, "auth.json");
-}
-function loadFromApp() {
-  try {
-    const profilesPath = appProfilesPath();
-    if (!existsSync9(profilesPath))
-      return null;
-    const profiles = JSON.parse(readFileSync6(profilesPath, "utf-8"));
-    if (!profiles?.active_profile)
-      return null;
-    const authPath = appProfileAuthPath(profiles.active_profile);
-    if (!existsSync9(authPath))
-      return null;
-    const auth = JSON.parse(readFileSync6(authPath, "utf-8"));
-    if (!auth?.authenticated || !auth?.token)
-      return null;
-    return {
-      token: auth.token,
-      portal: DEFAULT_PORTAL,
-      user: {
-        id: auth.user.id,
-        name: auth.user.name || [auth.user.first_name, auth.user.last_name].filter(Boolean).join(" ") || auth.user.email,
-        email: auth.user.email
-      }
-    };
-  } catch {
-    return null;
-  }
-}
 function store(creds) {
   const path = credentialsPath();
   mkdirSync4(dirname4(path), { recursive: true });
@@ -9414,12 +9458,9 @@ function store(creds) {
 `, { mode: 384 });
 }
 function load2() {
-  const fromApp = loadFromApp();
-  if (fromApp)
-    return fromApp;
   const path = credentialsPath();
   if (!existsSync9(path)) {
-    throw new Error("not logged in \u2014 run 'construct login' first (or sign in to the Construct app)");
+    throw new Error("not logged in \u2014 run 'construct login' first");
   }
   const data = JSON.parse(readFileSync6(path, "utf-8"));
   if (!data.token) {
@@ -9442,7 +9483,7 @@ function clear() {
 }
 
 // src/lib/pack.ts
-import { readdirSync as readdirSync3, statSync as statSync3, existsSync as existsSync10 } from "fs";
+import { readdirSync as readdirSync4, statSync as statSync4, existsSync as existsSync10 } from "fs";
 import { join as join13 } from "path";
 import { tmpdir } from "os";
 import { execSync as execSync3 } from "child_process";
@@ -9484,8 +9525,8 @@ async function packSource(root) {
     if (existsSync10(join13(root, name)))
       entries.push(name);
   }
-  for (const entry of readdirSync3(root)) {
-    if (statSync3(join13(root, entry)).isDirectory())
+  for (const entry of readdirSync4(root)) {
+    if (statSync4(join13(root, entry)).isDirectory())
       continue;
     if (allowedRootFiles.includes(entry))
       continue;
@@ -9505,7 +9546,7 @@ async function packSource(root) {
   const excludes = "--exclude=node_modules --exclude=dist --exclude=.git --exclude=*.env --exclude=*.log --exclude=*.lock --exclude=*.lockb";
   const cmd = `tar czf "${tarballPath}" ${excludes} ${validEntries.join(" ")}`;
   execSync3(cmd, { cwd: root });
-  const size = statSync3(tarballPath).size;
+  const size = statSync4(tarballPath).size;
   if (size > MAX_SIZE) {
     throw new Error(`Source exceeds maximum size of ${MAX_SIZE / 1024 / 1024}MB`);
   }
@@ -9528,6 +9569,16 @@ async function uploadSource(portalURL, token, tarballPath, m) {
   if (resp.status === 401) {
     throw new Error("authentication failed \u2014 run 'construct login' to re-authenticate");
   }
+  if (resp.status === 403) {
+    let msg = result.error || "You are not the owner of this space";
+    if (result.owner_user_id) {
+      msg += `
+  Current owner: ${result.owner_user_id}`;
+    }
+    msg += `
+  Fork to a new space_id to publish your own version.`;
+    throw new Error(msg);
+  }
   if (resp.status >= 400) {
     const msg = result.error || result.errors?.join("; ") || `server returned ${resp.status}`;
     throw new Error(msg);
@@ -9562,24 +9613,6 @@ async function publish(options) {
     console.log(source_default.dim("  Run 'construct login' to authenticate."));
     process.exit(1);
   }
-  const publishers = creds.publishers || [];
-  if (publishers.length === 0) {
-    console.log(source_default.yellow("  No publisher linked to this session. The upload will likely be rejected."));
-    console.log(source_default.dim("  Run 'construct login' after enrolling at developer.construct.space."));
-  } else {
-    const primary = publishers[0];
-    const kindLabel = primary.kind === "org" ? source_default.cyan("org") : primary.kind === "user" ? source_default.blue("personal") : source_default.dim("legacy");
-    console.log(source_default.dim(`  Publishing as ${primary.name} (${kindLabel})`));
-    if (publishers.length > 1 && !yes) {
-      const proceed = await dist_default4({
-        message: `You have ${publishers.length} publisher identities. Publish under ${primary.name}?`
-      });
-      if (!proceed) {
-        console.log("Cancelled.");
-        return;
-      }
-    }
-  }
   const status = gitSafe(root, "status", "--porcelain");
   if (status) {
     console.log(source_default.yellow("You have uncommitted changes."));
@@ -9663,7 +9696,7 @@ async function publish(options) {
   let tarballPath;
   try {
     tarballPath = await packSource(root);
-    const size = statSync4(tarballPath).size;
+    const size = statSync5(tarballPath).size;
     spinner.succeed(`Source packed (${formatBytes(size)})`);
   } catch (err) {
     spinner.fail("Pack failed");
@@ -9845,12 +9878,6 @@ function clean(options) {
 import { createServer } from "http";
 async function login(options) {
   const portalURL = options?.portal || DEFAULT_PORTAL;
-  const fromApp = loadFromApp();
-  if (fromApp) {
-    console.log(source_default.green(`Using Construct app profile: ${fromApp.user?.name || fromApp.user?.email}`));
-    console.log(source_default.dim("  To use a different identity, sign out of the app or run `construct logout` after login."));
-    return;
-  }
   if (isAuthenticated()) {
     const creds = load2();
     const name = creds.user?.name || "unknown";
@@ -9916,101 +9943,18 @@ async function login(options) {
     const resp = await fetch(`${portalURL}/api/auth/cli-verify`, {
       headers: { Authorization: `Bearer ${token}` }
     });
-    const { user, publishers } = await resp.json();
-    store({ token, portal: portalURL, user, publishers });
+    const { user } = await resp.json();
+    store({ token, portal: portalURL, user });
     console.log();
     console.log(source_default.green(`Logged in as ${user?.name || "there"}`));
-    const list = publishers || [];
-    if (list.length === 0) {
-      console.log(source_default.yellow("  No publisher yet. Run developer enrollment to publish spaces."));
-    } else {
-      for (const p of list) {
-        const label = p.kind === "org" ? source_default.cyan("org") : p.kind === "user" ? source_default.blue("personal") : source_default.dim("legacy");
-        console.log(source_default.dim(`  Publisher: ${p.name} (${label})`));
-      }
-    }
   } catch (err) {
     console.error(source_default.red(`Login failed: ${err.message}`));
     process.exit(1);
   }
 }
 function logout() {
-  const wasCli = isAuthenticated();
   clear();
-  if (wasCli) {
-    console.log(source_default.green("Logged out of CLI credentials."));
-  } else {
-    console.log(source_default.dim("No CLI credentials to clear."));
-  }
-  const appStill = loadFromApp();
-  if (appStill) {
-    console.log();
-    console.log(source_default.yellow("Note: the Construct app is still signed in as ") + source_default.white(appStill.user?.name || appStill.user?.email || ""));
-    console.log(source_default.dim("  The CLI will continue to use the app profile. Sign out of the app to fully disconnect."));
-  }
-}
-
-// src/commands/whoami.ts
-async function whoami() {
-  const fromApp = loadFromApp();
-  let creds = null;
-  let source = "none";
-  if (fromApp) {
-    creds = fromApp;
-    source = "app";
-  } else {
-    try {
-      creds = load2();
-      source = "cli";
-    } catch {
-      source = "none";
-    }
-  }
-  if (source === "none" || !creds) {
-    console.log(source_default.yellow("Not signed in."));
-    console.log(source_default.dim("  Run ") + source_default.white("construct login") + source_default.dim(" or sign in to the Construct app."));
-    return;
-  }
-  const user = creds.user;
-  const sourceLabel = source === "app" ? source_default.cyan("Construct app profile") : source_default.blue("CLI login");
-  console.log();
-  console.log(source_default.bold(user?.name || "Signed in"));
-  console.log(source_default.dim("  " + (user?.email || "")));
-  console.log(source_default.dim("  id: ") + source_default.dim(user?.id || "\u2014"));
-  console.log(source_default.dim("  source: ") + sourceLabel);
-  console.log(source_default.dim("  portal: ") + (creds.portal || DEFAULT_PORTAL));
-  try {
-    const resp = await fetch(`${creds.portal || DEFAULT_PORTAL}/api/auth/cli-verify`, {
-      headers: { Authorization: `Bearer ${creds.token}` }
-    });
-    if (!resp.ok) {
-      console.log(source_default.dim("  publishers: ") + source_default.red(`error (${resp.status})`));
-      return;
-    }
-    const body = await resp.json();
-    const list = body.publishers || [];
-    if (list.length === 0) {
-      console.log(source_default.dim("  publishers: ") + source_default.yellow("none yet \u2014 enroll at developer.construct.space"));
-      return;
-    }
-    console.log();
-    console.log(source_default.bold("Publishers"));
-    for (const p of list) {
-      const kindLabel = p.kind === "org" ? source_default.cyan("org") : p.kind === "user" ? source_default.blue("personal") : source_default.dim("legacy");
-      const verified = p.verified ? source_default.green(" \u2713") : "";
-      console.log(`  ${source_default.white(p.name)} (${kindLabel})${verified}`);
-      if (p.orgId)
-        console.log(source_default.dim(`    org: ${p.orgId}`));
-    }
-  } catch (err) {
-    console.log(source_default.dim("  publishers: ") + source_default.red("could not reach portal"));
-  }
-  console.log();
-  if (source === "app") {
-    console.log(source_default.dim("To switch identities, change the active profile in the Construct app."));
-  } else {
-    console.log(source_default.dim("To switch identities, run 'construct logout' then 'construct login'."));
-  }
+  console.log(source_default.green("Logged out."));
 }
 
 // src/commands/update.ts
@@ -10285,7 +10229,7 @@ function updateBarrel(modelsDir, modelName) {
 }
 
 // src/commands/graph/push.ts
-import { existsSync as existsSync16, readdirSync as readdirSync4, readFileSync as readFileSync12 } from "fs";
+import { existsSync as existsSync16, readdirSync as readdirSync5, readFileSync as readFileSync12 } from "fs";
 import { join as join20, basename as basename7 } from "path";
 async function graphPush() {
   const root = process.cwd();
@@ -10299,7 +10243,7 @@ async function graphPush() {
     console.error(source_default.red("No src/models/ directory found. Run 'construct graph init' first."));
     process.exit(1);
   }
-  const modelFiles = readdirSync4(modelsDir).filter((f) => f.endsWith(".ts") && f !== "index.ts");
+  const modelFiles = readdirSync5(modelsDir).filter((f) => f.endsWith(".ts") && f !== "index.ts");
   if (modelFiles.length === 0) {
     console.error(source_default.red("No model files found in src/models/"));
     console.log(source_default.dim("  Generate one: construct graph g User name:string email:string"));
@@ -10324,15 +10268,17 @@ async function graphPush() {
     console.error(source_default.red(err.message));
     process.exit(1);
   }
-  const graphURL = process.env.GRAPH_URL || "https://graph.construct.space";
+  const graphURL = process.env.GRAPH_URL || "https://my.construct.space/api/graph";
   const spinner = ora("Registering models...").start();
   try {
+    const userID = creds.user?.id || "";
     const resp = await fetch(`${graphURL}/api/schemas/register`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
         Authorization: `Bearer ${creds.token}`,
-        "X-Space-ID": m.id
+        "X-Space-ID": m.id,
+        "X-Auth-User-ID": userID
       },
       body: JSON.stringify({
         space_id: m.id,
@@ -10342,6 +10288,20 @@ async function graphPush() {
         manifest: { version: 1, models }
       })
     });
+    if (resp.status === 403) {
+      spinner.fail("Ownership check failed");
+      try {
+        const errBody = await resp.json();
+        console.error(source_default.red(`  ${errBody.error || "You are not the owner of this space"}`));
+        if (errBody.owner_user_id) {
+          console.error(source_default.dim(`  Current owner: ${errBody.owner_user_id}`));
+        }
+        console.error(source_default.dim("  Fork to a new space_id to publish your own version."));
+      } catch {
+        console.error(source_default.red(`  403: Forbidden \u2014 ownership check failed`));
+      }
+      process.exit(1);
+    }
     if (!resp.ok) {
       const body = await resp.text();
       spinner.fail("Registration failed");
@@ -10424,7 +10384,7 @@ function parseModelFile(content, fileName) {
 }
 
 // src/commands/graph/migrate.ts
-import { existsSync as existsSync17, readdirSync as readdirSync5, readFileSync as readFileSync13 } from "fs";
+import { existsSync as existsSync17, readdirSync as readdirSync6, readFileSync as readFileSync13 } from "fs";
 import { join as join21, basename as basename8 } from "path";
 async function graphMigrate(options) {
   const root = process.cwd();
@@ -10445,7 +10405,7 @@ async function graphMigrate(options) {
     console.error(source_default.red(err.message));
     process.exit(1);
   }
-  const graphURL = process.env.GRAPH_URL || "https://graph.construct.space";
+  const graphURL = process.env.GRAPH_URL || "https://my.construct.space/api/graph";
   const spinner = ora("Fetching current schema...").start();
   let serverModels = [];
   try {
@@ -10461,7 +10421,7 @@ async function graphMigrate(options) {
     spinner.fail("Could not fetch schema");
     process.exit(1);
   }
-  const modelFiles = readdirSync5(modelsDir).filter((f) => f.endsWith(".ts") && f !== "index.ts");
+  const modelFiles = readdirSync6(modelsDir).filter((f) => f.endsWith(".ts") && f !== "index.ts");
   const localModels = [];
   for (const file of modelFiles) {
     const content = readFileSync13(join21(modelsDir, file), "utf-8");
@@ -10568,7 +10528,7 @@ function parseModelFields(content, fileName) {
 }
 
 // src/index.ts
-var VERSION = "1.1.11";
+var VERSION = "1.2.0";
 var program2 = new Command;
 program2.name("construct").description("Construct CLI \u2014 scaffold, build, develop, and publish spaces").version(VERSION);
 program2.command("scaffold [name]").alias("new").alias("create").description("Create a new Construct space project").option("--with-tests", "Include E2E testing boilerplate").option("--full", "Full preset: multiple pages, extra skills, widget templates").action(async (name, opts) => scaffold(name, opts));
@@ -10581,7 +10541,6 @@ program2.command("check").description("Run type-check (vue-tsc) and linter (esli
 program2.command("clean").description("Remove build artifacts").option("--all", "Also remove node_modules and lockfiles").action((opts) => clean(opts));
 program2.command("login").description("Authenticate with Construct").option("--portal <url>", "Portal URL").action(async (opts) => login(opts));
 program2.command("logout").description("Sign out").action(() => logout());
-program2.command("whoami").alias("status").description("Show the active profile, its source (app or CLI), and linked publishers").action(() => whoami());
 program2.command("update").description("Update the CLI to the latest version").action(() => update());
 var graph = program2.command("graph").description("Construct Graph \u2014 data models and GraphQL");
 graph.command("init").description("Initialize Graph in a space project").action(() => graphInit());

package/dist/templates/space/full/space.manifest.json.tmpl

@@ -7,7 +7,7 @@
     "name": "Your Name"
   },
   "icon": "i-lucide-box",
-  "scope": "both",
+  "scope": "app",
   "minConstructVersion": "0.7.0",
   "navigation": {
     "label": "{{.DisplayName}}",

package/dist/templates/space/space.manifest.json.tmpl

@@ -7,7 +7,7 @@
     "name": "Your Name"
   },
   "icon": "i-lucide-box",
-  "scope": "both",
+  "scope": "app",
   "minConstructVersion": "0.7.0",
   "navigation": {
     "label": "{{.DisplayName}}",
@@ -34,7 +34,7 @@
   "keywords": ["{{.ID}}"],
   "agent": "agent/config.md",
   "skills": ["agent/skills/default.md"],
-  "actions": {},
+  "actions": "src/actions.ts",
   "widgets": [
     {
       "id": "summary",

package/dist/templates/space/widgets/2x1.vue.tmpl

@@ -1,7 +1,14 @@
 <script setup lang="ts">
 /**
  * {{.DisplayName}} Summary Widget — 2×1 compact view
+ *
+ * Widgets run inside a closed Shadow DOM sandbox.
+ * Use the injected widgetApi for theme and actions — do not access
+ * window, document, or global stores directly.
  */
+import { inject } from 'vue'
+
+const api = inject<{ theme: { mode: string; vars: Record<string, string> }; space: { id: string; name: string } }>('widgetApi')
 </script>
 
 <template>

package/dist/templates/space/widgets/4x1.vue.tmpl

@@ -1,7 +1,14 @@
 <script setup lang="ts">
 /**
  * {{.DisplayName}} Summary Widget — 4×1 wide view
+ *
+ * Widgets run inside a closed Shadow DOM sandbox.
+ * Use the injected widgetApi for theme and actions — do not access
+ * window, document, or global stores directly.
  */
+import { inject } from 'vue'
+
+const api = inject<{ theme: { mode: string; vars: Record<string, string> }; space: { id: string; name: string } }>('widgetApi')
 </script>
 
 <template>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@construct-space/cli",
-  "version": "1.1.11",
+  "version": "1.2.0",
   "description": "Construct CLI — scaffold, build, develop, and publish spaces",
   "type": "module",
   "bin": {

package/templates/space/full/space.manifest.json.tmpl

@@ -7,7 +7,7 @@
     "name": "Your Name"
   },
   "icon": "i-lucide-box",
-  "scope": "both",
+  "scope": "app",
   "minConstructVersion": "0.7.0",
   "navigation": {
     "label": "{{.DisplayName}}",

package/templates/space/space.manifest.json.tmpl

@@ -7,7 +7,7 @@
     "name": "Your Name"
   },
   "icon": "i-lucide-box",
-  "scope": "both",
+  "scope": "app",
   "minConstructVersion": "0.7.0",
   "navigation": {
     "label": "{{.DisplayName}}",
@@ -34,7 +34,7 @@
   "keywords": ["{{.ID}}"],
   "agent": "agent/config.md",
   "skills": ["agent/skills/default.md"],
-  "actions": {},
+  "actions": "src/actions.ts",
   "widgets": [
     {
       "id": "summary",

package/templates/space/widgets/2x1.vue.tmpl

@@ -1,7 +1,14 @@
 <script setup lang="ts">
 /**
  * {{.DisplayName}} Summary Widget — 2×1 compact view
+ *
+ * Widgets run inside a closed Shadow DOM sandbox.
+ * Use the injected widgetApi for theme and actions — do not access
+ * window, document, or global stores directly.
  */
+import { inject } from 'vue'
+
+const api = inject<{ theme: { mode: string; vars: Record<string, string> }; space: { id: string; name: string } }>('widgetApi')
 </script>
 
 <template>

package/templates/space/widgets/4x1.vue.tmpl

@@ -1,7 +1,14 @@
 <script setup lang="ts">
 /**
  * {{.DisplayName}} Summary Widget — 4×1 wide view
+ *
+ * Widgets run inside a closed Shadow DOM sandbox.
+ * Use the injected widgetApi for theme and actions — do not access
+ * window, document, or global stores directly.
  */
+import { inject } from 'vue'
+
+const api = inject<{ theme: { mode: string; vars: Record<string, string> }; space: { id: string; name: string } }>('widgetApi')
 </script>
 
 <template>