@fluid-app/fluid-cli-portal 0.1.27 → 0.1.29

package/dist/index.mjs

@@ -1,17 +1,19 @@
-import { A as deleteFluidOSNavigation, B as updateFluidOSScreen, C as writeMappings, D as createFluidOSScreen, E as createFluidOSProfile, F as listFluidOSNavigationItems, H as updateFluidOSVersion, I as listFluidOSVersions, L as updateFluidOSNavigation, M as deleteFluidOSProfile, N as deleteFluidOSScreen, O as createFluidOSTheme, P as deleteFluidOSTheme, R as updateFluidOSNavigationItem, S as updateMapping, T as createFluidOSNavigationItem, U as createFetchClient, V as updateFluidOSTheme, _ as deriveSlug, a as buildThemeIdToSlugMap, b as resolveIdToSlug, c as transformNavigationItems, d as transformTheme, f as buildSnapshot, g as writeSnapshot, h as readSnapshot, i as buildNavigationIdToSlugMap, j as deleteFluidOSNavigationItem, k as createFluidOSVersion, l as transformProfile, m as diffAgainstSnapshot, o as deriveScreenSlug, p as computeFileHash, r as buildIdToSlugMap, s as transformNavigation, t as pullCommand, u as transformScreen, v as readMappings, w as createFluidOSNavigation, x as resolveSlugToId, y as removeMapping, z as updateFluidOSProfile } from "./pull-hAdXOpgb.mjs";
+import { A as fluid_os_v0_create_fluid_osversion, B as fluid_os_v0_update_fluid_osnavigation_item, C as writeMappings, D as fluid_os_v0_create_fluid_osprofile, E as fluid_os_v0_create_fluid_osnavigation_item, F as fluid_os_v0_delete_fluid_osscreen, G as createFetchClient, H as fluid_os_v0_update_fluid_osscreen, I as fluid_os_v0_delete_fluid_ostheme, L as fluid_os_v0_list_fluid_osnavigation_items, M as fluid_os_v0_delete_fluid_osnavigation, N as fluid_os_v0_delete_fluid_osnavigation_item, O as fluid_os_v0_create_fluid_osscreen, P as fluid_os_v0_delete_fluid_osprofile, R as fluid_os_v0_list_fluid_osversions, S as updateMapping, T as fluid_os_v0_create_fluid_osnavigation, U as fluid_os_v0_update_fluid_ostheme, V as fluid_os_v0_update_fluid_osprofile, W as fluid_os_v0_update_fluid_osversion, _ as deriveSlug, a as buildThemeIdToSlugMap, b as resolveIdToSlug, c as transformNavigationItems, d as transformTheme, f as buildSnapshot, g as writeSnapshot, h as readSnapshot, i as buildNavigationIdToSlugMap, j as fluid_os_v0_create_widget_package_version, k as fluid_os_v0_create_fluid_ostheme, l as transformProfile, m as diffAgainstSnapshot, o as deriveScreenSlug, p as computeFileHash, r as buildIdToSlugMap, s as transformNavigation, t as pullCommand, u as transformScreen, v as readMappings, w as fluid_os_v0_complete_widget_package_version_upload, x as resolveSlugToId, y as removeMapping, z as fluid_os_v0_update_fluid_osnavigation } from "./pull-zrTaJuSb.mjs";
+import { createRequire } from "node:module";
 import { Command } from "commander";
 import chalk from "chalk";
 import ora from "ora";
 import path, { basename, dirname, join, relative, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { copyFile, mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
-import { failure, getActiveProfile, getAuthToken, listProfileNames, success } from "@fluid-app/fluid-cli";
+import { failure, findProjectConfig, getActiveProfile, getAuthToken, listProfileNames, readConfig, success } from "@fluid-app/fluid-cli";
 import prompts from "prompts";
 import { existsSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import Handlebars from "handlebars";
 import { execa } from "execa";
 import fs from "fs-extra";
 import path$1 from "path";
+import { createHash } from "node:crypto";
 //#region src/types.ts
 /**
 * Available project templates
@@ -239,16 +241,14 @@ async function getSdkVersion() {
 	}
 }
 /**
-* Reads the portal-core version from the workspace package.json.
-* Falls back to ^0.1.0 if not found.
+* Builds a pnpm link: specifier for local scaffolds.
+*
+* link: keeps the dependency pointed at the workspace package source instead of
+* packing only package.json "files" entries like file: does. That lets Vite's
+* development export resolve the SDK source and its workspace dependencies.
 */
-async function getCoreVersion() {
-	try {
-		const content = await readFile(join(join(findPackageRoot(), "..", ".."), "portal", "core", "package.json"), "utf-8");
-		return `^${JSON.parse(content).version ?? "0.1.0"}`;
-	} catch {
-		return "^0.1.0";
-	}
+function getLocalPackageLinkVersion(targetPath, packagePath) {
+	return `link:${(relative(targetPath, packagePath) || ".").replace(/\\/g, "/")}`;
 }
 /**
 * Reads the CLI core version from the workspace package.json.
@@ -397,7 +397,7 @@ const createCommand = new Command("create").description("Create a new Fluid port
 			process.exit(1);
 		}
 		let sdkVersion;
-		let coreVersion;
+		let localCoreVersion;
 		const cliVersion = await getCliVersion();
 		if (!!options.local) {
 			const packagesRoot = join(join(dirname(fileURLToPath(import.meta.url)), "..", ".."), "..", "..");
@@ -407,13 +407,10 @@ const createCommand = new Command("create").description("Create a new Fluid port
 				console.error(chalk.red("Error: --local requires running from within the fluid-mono monorepo\n  Could not find packages/portal/sdk or packages/portal/core"));
 				process.exit(1);
 			}
-			sdkVersion = `file:${relative(targetPath, sdkPath)}`;
-			coreVersion = `file:${relative(targetPath, corePath)}`;
+			sdkVersion = getLocalPackageLinkVersion(targetPath, sdkPath);
+			localCoreVersion = getLocalPackageLinkVersion(targetPath, corePath);
 			console.log(chalk.cyan("  Using local packages (--local mode)"));
-		} else {
-			sdkVersion = await getSdkVersion();
-			coreVersion = await getCoreVersion();
-		}
+		} else sdkVersion = await getSdkVersion();
 		const spinner = ora("Creating project directory...").start();
 		try {
 			await createDirectory(targetPath);
@@ -425,8 +422,8 @@ const createCommand = new Command("create").description("Create a new Fluid port
 		const templateVariables = {
 			projectName: config.name,
 			sdkVersion,
+			localCoreVersion,
 			cliVersion,
-			coreVersion,
 			selectedPages: config.selectedPages,
 			hasSelectedPages: config.selectedPages.length > 0,
 			profileName: config.profileName
@@ -510,7 +507,7 @@ async function autoPull(cwd) {
 	console.log(chalk.yellow("No portal/ directory found.") + " Attempting to pull content...");
 	console.log();
 	try {
-		const { pullCommand } = await import("./pull-hAdXOpgb.mjs").then((n) => n.n);
+		const { pullCommand } = await import("./pull-zrTaJuSb.mjs").then((n) => n.n);
 		await pullCommand.parseAsync([], { from: "user" });
 		return hasPortalContent(cwd);
 	} catch (err) {
@@ -565,83 +562,417 @@ const devCommand = new Command("dev").description("Start the development server
 	}
 });
 //#endregion
+//#region src/utils/widget-package-config.ts
+const CONFIG_CANDIDATES = [
+	"src/widgets.config.ts",
+	"src/portal.config.ts",
+	"portal.config.ts"
+];
+const SOURCE_PACKAGE_EXTRACT_FILENAME = "extract-widget-packages.ts";
+const SOURCE_PACKAGE_OUTPUT_FILENAME = "source-widget-packages.json";
+const SOURCE_PACKAGE_OUTPUT_SENTINEL = "fluid-widget-source-packages:v1";
+const TSX_CLI_PATH$1 = createRequire(import.meta.url).resolve("tsx/cli");
+async function resolvePortalWidgetSourceConfig(projectDir) {
+	for (const relativePath of CONFIG_CANDIDATES) {
+		const candidate = path.join(projectDir, relativePath);
+		if (await fs.pathExists(candidate)) return {
+			path: candidate,
+			relativePath
+		};
+	}
+}
+async function loadSourceWidgetPackages(projectDir) {
+	const config = await resolvePortalWidgetSourceConfig(projectDir);
+	if (!config) return success([]);
+	let tempDir;
+	try {
+		tempDir = await createTempDirectory$1(projectDir);
+		const extractFile = path.join(tempDir, SOURCE_PACKAGE_EXTRACT_FILENAME);
+		const outputFile = path.join(tempDir, SOURCE_PACKAGE_OUTPUT_FILENAME);
+		await fs.writeFile(extractFile, createSourcePackageExtractorScript({
+			projectDir,
+			configPath: config.path
+		}), {
+			encoding: "utf-8",
+			flag: "wx"
+		});
+		await execa(process.execPath, [
+			TSX_CLI_PATH$1,
+			extractFile,
+			outputFile
+		], {
+			cwd: projectDir,
+			stdio: "pipe",
+			env: {
+				...process.env,
+				NODE_ENV: "production"
+			}
+		});
+		const outputResult = await readSourcePackageExtractorOutput(outputFile);
+		if (!outputResult.success) return outputResult;
+		const parsed = outputResult.value;
+		if (parsed.length === 0) return success([]);
+		return success(parsed);
+	} catch (err) {
+		const error = err;
+		return failure({
+			code: "CONFIG_LOAD_FAILED",
+			message: `Failed to load widget packages from ${config.relativePath}`,
+			details: error.stderr ?? error.message ?? String(err)
+		});
+	} finally {
+		if (tempDir) await fs.remove(tempDir).catch(() => {});
+	}
+}
+async function createTempDirectory$1(projectDir) {
+	const projectTmpDir = path.join(projectDir, ".fluid", "tmp");
+	try {
+		await fs.ensureDir(projectTmpDir);
+		return await fs.mkdtemp(path.join(projectTmpDir, "widget-packages-"));
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		throw new Error(`Unable to create project-local temporary directory at ${projectTmpDir}: ${message}`);
+	}
+}
+async function readSourcePackageExtractorOutput(outputFile) {
+	let output;
+	try {
+		output = await fs.readFile(outputFile, "utf-8");
+	} catch (err) {
+		return failure({
+			code: "CONFIG_LOAD_FAILED",
+			message: "Widget package extractor did not write an output file",
+			details: err instanceof Error ? err.message : String(err)
+		});
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(output);
+	} catch {
+		return failure({
+			code: "INVALID_FORMAT",
+			message: "Failed to parse widget package output file as JSON",
+			details: `Output was: ${output.slice(0, 200)}`
+		});
+	}
+	if (!isRecord$5(parsed) || parsed.sentinel !== SOURCE_PACKAGE_OUTPUT_SENTINEL) return failure({
+		code: "INVALID_FORMAT",
+		message: "Widget package extractor output file had an invalid sentinel"
+	});
+	if (!Array.isArray(parsed.data)) return failure({
+		code: "INVALID_FORMAT",
+		message: "Extracted widget package output is not an array",
+		details: `Expected an array, got: ${typeof parsed.data}`
+	});
+	return success(parsed.data);
+}
+function createSourcePackageExtractorScript(options) {
+	return `
+import fs from "node:fs/promises";
+import path from "node:path";
+import { createServer, normalizePath } from "vite";
+
+const SOURCE_PACKAGE_MARKER = "__fluidSourceWidgetPackage";
+const OUTPUT_SENTINEL = ${JSON.stringify(SOURCE_PACKAGE_OUTPUT_SENTINEL)};
+const projectRoot = ${JSON.stringify(options.projectDir)};
+const widgetConfigPath = ${JSON.stringify(options.configPath)};
+const outputPath = process.argv[2];
+if (!outputPath) throw new Error("Missing widget package extractor output path.");
+
+function toViteModuleId(modulePath) {
+  const relativePath = path.relative(projectRoot, modulePath);
+  if (!relativePath.startsWith("..") && !path.isAbsolute(relativePath)) {
+    return "/" + normalizePath(relativePath);
+  }
+  return normalizePath(modulePath);
+}
+
+const server = await createServer({
+  root: projectRoot,
+  mode: "production",
+  server: { middlewareMode: true },
+  appType: "custom",
+  logLevel: "error",
+  clearScreen: false,
+  resolve: {
+    conditions: ["fluid-widget-authoring"],
+  },
+  ssr: {
+    resolve: {
+      conditions: ["fluid-widget-authoring"],
+    },
+  },
+});
+
+try {
+  const widgetConfig = await server.ssrLoadModule(toViteModuleId(widgetConfigPath));
+
+  function isSourceWidgetPackage(value) {
+    return Boolean(value && typeof value === "object" && value[SOURCE_PACKAGE_MARKER] === true);
+  }
+
+  function collectSourceWidgetPackages(mod) {
+    const candidates = [
+      mod.widgetPackage,
+      ...(Array.isArray(mod.widgetPackages) ? mod.widgetPackages : []),
+      mod.default,
+    ];
+    const byPackageId = new Map();
+    for (const candidate of candidates) {
+      if (!isSourceWidgetPackage(candidate)) continue;
+      if (!byPackageId.has(candidate.packageId)) byPackageId.set(candidate.packageId, candidate);
+    }
+    return Array.from(byPackageId.values());
+  }
+
+  function serializeWidget(widget) {
+    if (!widget || typeof widget !== "object" || Array.isArray(widget)) {
+      return widget;
+    }
+    const { component, ...metadata } = widget;
+    return metadata;
+  }
+
+  function serializePackage(sourcePackage) {
+    return {
+      manifestVersion: sourcePackage.manifestVersion,
+      scope: sourcePackage.scope,
+      packageStableId: sourcePackage.packageStableId,
+      packageId: sourcePackage.packageId,
+      packageType: sourcePackage.packageType,
+      version: sourcePackage.version,
+      cssUrls: sourcePackage.cssUrls,
+      widgets: Array.isArray(sourcePackage.widgets)
+        ? sourcePackage.widgets.map(serializeWidget)
+        : sourcePackage.widgets,
+    };
+  }
+
+  await fs.writeFile(
+    outputPath,
+    JSON.stringify({
+      sentinel: OUTPUT_SENTINEL,
+      data: collectSourceWidgetPackages(widgetConfig).map(serializePackage),
+    }),
+    "utf-8",
+  );
+} finally {
+  await server.close();
+}
+`;
+}
+function isRecord$5(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
 //#region src/utils/extract-manifests.ts
 /**
 * Manifest extraction utility
 *
 * Extracts serializable widget manifest metadata from portal.config.ts
-* by writing a minimal wrapper script that imports customWidgets and
-* serializes the result to stdout, then running it with tsx.
+* by writing a minimal wrapper script that imports customWidgets plus
+* source widget package exports and serializes the result to a temp output
+* file, then running it with tsx.
 *
 * Strips the `component` field (not serializable) from each manifest.
 *
-* Writes a temp script, runs it with tsx, and parses JSON output. This
-* avoids needing Vite's module resolution — portal.config.ts must use
-* relative imports only.
-*
-* Used by `fluid build`. The dev server uses Vite's ssrLoadModule
-* instead (see manifest-plugin.ts in portal-sdk).
+* Writes a temp script, runs it with tsx, and parses JSON output from the
+* output file. The wrapper loads config modules through Vite SSR so project
+* aliases and Vite-compatible module resolution are honored.
 */
-const EXTRACT_FILENAME = "__fluid_extract_manifests.ts";
+const EXTRACT_FILENAME = "extract-manifests.ts";
+const EXTRACT_OUTPUT_FILENAME = "manifests.json";
+const EXTRACT_OUTPUT_SENTINEL = "fluid-widget-manifests:v1";
+const TSX_CLI_PATH = createRequire(import.meta.url).resolve("tsx/cli");
 /**
 * Extract serializable widget manifests from a project's portal.config.ts.
 *
-* Writes a temp wrapper script, runs it with tsx, and parses JSON output.
-* The temp file is always cleaned up.
+* Writes a temp wrapper script, runs it with tsx, and parses the temp JSON
+* output file. The temp files are always cleaned up.
 *
-* Returns an empty array if no customWidgets export exists.
+* Returns an empty array if no customWidgets or source package exports exist.
+*
+* Supported static export shapes are intentionally simple so the CLI can avoid
+* executing unrelated portal configs: named `export const|let|var customWidgets`,
+* `widgetPackage`, or `widgetPackages`; direct `export default
+* defineWidgetPackage(...)`; or `export default <identifier>` where that
+* identifier is initialized with `defineWidgetPackage(...)` in the same file.
+* Re-export-only and computed export shapes are not detected by this layer.
 *
 * @param projectDir - The project root directory containing src/portal.config.ts
 */
 async function extractManifests(projectDir) {
-	const configPath = path$1.join(projectDir, "src", "portal.config.ts");
-	const extractFile = path$1.join(projectDir, EXTRACT_FILENAME);
+	let tempDir;
 	try {
-		if (!await fs.pathExists(configPath)) return success([]);
-		const strippedSource = (await fs.readFile(configPath, "utf-8")).replace(/\/\/[^\n]*/g, "").replace(/\/\*[\s\S]*?\*\//g, "");
-		if (!/export\s+(const|let)\s+customWidgets[\s:=]/.test(strippedSource)) return success([]);
-		await fs.writeFile(extractFile, `
-import { customWidgets } from "./src/portal.config.ts";
-
-const serializable = customWidgets.map(({ component, ...rest }) => rest);
-console.log(JSON.stringify(serializable));
-`, "utf-8");
-		const output = (await execa("npx", ["tsx", EXTRACT_FILENAME], {
+		const config = await resolvePortalWidgetSourceConfig(projectDir);
+		if (!config) return success([]);
+		const configExports = readStaticWidgetExports(await fs.readFile(config.path, "utf-8"));
+		const legacyPortalConfigPath = path$1.join(projectDir, "src", "portal.config.ts");
+		const legacyCustomWidgetsConfigPath = (path$1.resolve(config.path) !== path$1.resolve(legacyPortalConfigPath) && await fs.pathExists(legacyPortalConfigPath) ? readStaticWidgetExports(await fs.readFile(legacyPortalConfigPath, "utf-8")) : void 0)?.hasCustomWidgets ? legacyPortalConfigPath : void 0;
+		if (!configExports.hasCustomWidgets && !configExports.hasSourceWidgetPackages && !legacyCustomWidgetsConfigPath) return success([]);
+		tempDir = await createTempDirectory(projectDir);
+		const extractFile = path$1.join(tempDir, EXTRACT_FILENAME);
+		const outputFile = path$1.join(tempDir, EXTRACT_OUTPUT_FILENAME);
+		const wrapperScript = createManifestExtractorScript({
+			projectDir,
+			widgetConfigPath: config.path,
+			legacyCustomWidgetsConfigPath
+		});
+		await fs.writeFile(extractFile, wrapperScript, {
+			encoding: "utf-8",
+			flag: "wx"
+		});
+		await execa(process.execPath, [
+			TSX_CLI_PATH,
+			extractFile,
+			outputFile
+		], {
 			cwd: projectDir,
 			stdio: "pipe",
 			env: {
 				...process.env,
 				NODE_ENV: "production"
 			}
-		})).stdout.trim();
-		if (!output || output === "null" || output === "[]") return success([]);
-		let parsed;
-		try {
-			parsed = JSON.parse(output);
-		} catch {
-			return failure({
-				code: "INVALID_FORMAT",
-				message: "Failed to parse manifest output as JSON",
-				details: `Output was: ${output.slice(0, 200)}`
-			});
-		}
-		if (!Array.isArray(parsed)) return failure({
-			code: "INVALID_FORMAT",
-			message: "customWidgets export is not an array",
-			details: `Expected an array, got: ${typeof parsed}`
 		});
+		const outputResult = await readManifestExtractorOutput(outputFile);
+		if (!outputResult.success) return outputResult;
+		const parsed = outputResult.value;
+		if (parsed.length === 0) return success([]);
 		return success(parsed.filter((m) => typeof m === "object" && m !== null && typeof m.type === "string" && typeof m.displayName === "string"));
 	} catch (err) {
 		const error = err;
 		return failure({
 			code: "EXTRACTION_FAILED",
-			message: "Failed to extract widget manifests from portal.config.ts",
+			message: "Failed to extract widget manifests from portal widget source config",
 			details: error.stderr ?? error.message ?? String(err)
 		});
 	} finally {
-		await fs.remove(extractFile).catch(() => {});
+		if (tempDir) await fs.remove(tempDir).catch(() => {});
+	}
+}
+function readStaticWidgetExports(source) {
+	const strippedSource = source.replace(/\/\/[^\n]*/g, "").replace(/\/\*[\s\S]*?\*\//g, "");
+	const defaultExportMatch = /export\s+default\s+([A-Za-z_$][\w$]*)\b/.exec(strippedSource);
+	const widgetPackageDefinitionNames = new Set(Array.from(strippedSource.matchAll(/\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)(?:\s*:[^=]+)?\s*=\s*defineWidgetPackage\s*\(/g), (match) => match[1]));
+	const hasDefaultWidgetPackageExport = /export\s+default\s+defineWidgetPackage\s*\(/.test(strippedSource) || defaultExportMatch !== null && widgetPackageDefinitionNames.has(defaultExportMatch[1]);
+	return {
+		hasCustomWidgets: /export\s+(?:const|let|var)\s+customWidgets\b/.test(strippedSource),
+		hasSourceWidgetPackages: /export\s+(?:const|let|var)\s+widgetPackage\b/.test(strippedSource) || /export\s+(?:const|let|var)\s+widgetPackages\b/.test(strippedSource) || hasDefaultWidgetPackageExport
+	};
+}
+async function createTempDirectory(projectDir) {
+	const projectTmpDir = path$1.join(projectDir, ".fluid", "tmp");
+	try {
+		await fs.ensureDir(projectTmpDir);
+		return await fs.mkdtemp(path$1.join(projectTmpDir, "manifests-"));
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		throw new Error(`Unable to create project-local temporary directory at ${projectTmpDir}: ${message}`);
 	}
 }
+async function readManifestExtractorOutput(outputFile) {
+	let output;
+	try {
+		output = await fs.readFile(outputFile, "utf-8");
+	} catch (err) {
+		return failure({
+			code: "EXTRACTION_FAILED",
+			message: "Manifest extractor did not write an output file",
+			details: err instanceof Error ? err.message : String(err)
+		});
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(output);
+	} catch {
+		return failure({
+			code: "INVALID_FORMAT",
+			message: "Failed to parse manifest output file as JSON",
+			details: `Output was: ${output.slice(0, 200)}`
+		});
+	}
+	if (!isRecord$4(parsed) || parsed.sentinel !== EXTRACT_OUTPUT_SENTINEL) return failure({
+		code: "INVALID_FORMAT",
+		message: "Manifest extractor output file had an invalid sentinel"
+	});
+	if (!Array.isArray(parsed.data)) return failure({
+		code: "INVALID_FORMAT",
+		message: "extracted widget manifests output is not an array",
+		details: `Expected an array, got: ${typeof parsed.data}`
+	});
+	return success(parsed.data);
+}
+function isRecord$4(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function createManifestExtractorScript(options) {
+	return `
+import fs from "node:fs/promises";
+import path from "node:path";
+import { createServer, normalizePath } from "vite";
+import {
+  isSourceWidgetPackage,
+  sourceWidgetPackagesToManifests,
+} from "@fluid-app/portal-sdk";
+
+const OUTPUT_SENTINEL = ${JSON.stringify(EXTRACT_OUTPUT_SENTINEL)};
+const projectRoot = ${JSON.stringify(options.projectDir)};
+const widgetConfigPath = ${JSON.stringify(options.widgetConfigPath)};
+const legacyCustomWidgetsConfigPath = ${JSON.stringify(options.legacyCustomWidgetsConfigPath)};
+const outputPath = process.argv[2];
+if (!outputPath) throw new Error("Missing manifest extractor output path.");
+
+function toViteModuleId(modulePath) {
+  const relativePath = path.relative(projectRoot, modulePath);
+  if (!relativePath.startsWith("..") && !path.isAbsolute(relativePath)) {
+    return "/" + normalizePath(relativePath);
+  }
+  return normalizePath(modulePath);
+}
+
+const server = await createServer({
+  root: projectRoot,
+  mode: "production",
+  server: { middlewareMode: true },
+  appType: "custom",
+  logLevel: "error",
+  clearScreen: false,
+});
+
+try {
+  const portalConfig = await server.ssrLoadModule(toViteModuleId(widgetConfigPath));
+  const legacyPortalConfig = legacyCustomWidgetsConfigPath
+    ? await server.ssrLoadModule(toViteModuleId(legacyCustomWidgetsConfigPath))
+    : {};
+
+  const sourcePackages = [];
+  const seenSourcePackageIds = new Set();
+  for (const candidate of [
+    portalConfig.widgetPackage,
+    ...(Array.isArray(portalConfig.widgetPackages) ? portalConfig.widgetPackages : []),
+    portalConfig.default,
+  ]) {
+    if (!isSourceWidgetPackage(candidate)) continue;
+    if (seenSourcePackageIds.has(candidate.packageId)) continue;
+    seenSourcePackageIds.add(candidate.packageId);
+    sourcePackages.push(candidate);
+  }
+  const manifests = [
+    ...(Array.isArray(portalConfig.customWidgets) ? portalConfig.customWidgets : []),
+    ...(Array.isArray(legacyPortalConfig.customWidgets) ? legacyPortalConfig.customWidgets : []),
+    ...sourceWidgetPackagesToManifests(sourcePackages),
+  ];
+  const serializable = manifests.map(({ component, ...rest }) => rest);
+  await fs.writeFile(
+    outputPath,
+    JSON.stringify({ sentinel: OUTPUT_SENTINEL, data: serializable }),
+    "utf-8",
+  );
+} finally {
+  await server.close();
+}
+`;
+}
 //#endregion
 //#region src/commands/build.ts
 const buildCommand = new Command("build").description("Build the application for production").option("-o, --out-dir <dir>", "Output directory", "dist").action(async (options) => {
@@ -895,7 +1226,7 @@ async function pushScreens(client, defId, portalDir, changes, mappings) {
 		const slug = slugFromPath(file);
 		try {
 			const local = await readPortalFile(portalDir, file);
-			const newId = (await createFluidOSScreen(client, defId, { screen: {
+			const newId = (await fluid_os_v0_create_fluid_osscreen(client, defId, { screen: {
 				name: local.name,
 				slug,
 				component_tree: toApiComponentTree(local.component_tree)
@@ -936,7 +1267,7 @@ async function pushScreens(client, defId, portalDir, changes, mappings) {
 		}
 		try {
 			const local = await readPortalFile(portalDir, file);
-			await updateFluidOSScreen(client, defId, screenId, { screen: {
+			await fluid_os_v0_update_fluid_osscreen(client, defId, screenId, { screen: {
 				name: local.name,
 				slug,
 				component_tree: toApiComponentTree(local.component_tree)
@@ -975,7 +1306,7 @@ async function pushScreens(client, defId, portalDir, changes, mappings) {
 			};
 		}
 		try {
-			await deleteFluidOSScreen(client, defId, screenId);
+			await fluid_os_v0_delete_fluid_osscreen(client, defId, screenId);
 			currentMappings = removeMapping(currentMappings, "screens", slug);
 			results.push({
 				file,
@@ -1010,7 +1341,7 @@ async function pushThemes(client, defId, portalDir, changes, mappings) {
 		const slug = slugFromPath(file);
 		try {
 			const local = await readPortalFile(portalDir, file);
-			const newId = (await createFluidOSTheme(client, defId, { theme: {
+			const newId = (await fluid_os_v0_create_fluid_ostheme(client, defId, { theme: {
 				name: local.name,
 				active: local.active,
 				config: local.config
@@ -1051,7 +1382,7 @@ async function pushThemes(client, defId, portalDir, changes, mappings) {
 		}
 		try {
 			const local = await readPortalFile(portalDir, file);
-			await updateFluidOSTheme(client, defId, themeId, { theme: {
+			await fluid_os_v0_update_fluid_ostheme(client, defId, themeId, { theme: {
 				name: local.name,
 				active: local.active,
 				config: local.config
@@ -1090,7 +1421,7 @@ async function pushThemes(client, defId, portalDir, changes, mappings) {
 			};
 		}
 		try {
-			await deleteFluidOSTheme(client, defId, themeId);
+			await fluid_os_v0_delete_fluid_ostheme(client, defId, themeId);
 			currentMappings = removeMapping(currentMappings, "themes", slug);
 			results.push({
 				file,
@@ -1160,7 +1491,7 @@ async function pushNavigations(client, defId, portalDir, changes, mappings) {
 		const slug = slugFromPath(file);
 		try {
 			const local = await readPortalFile(portalDir, file);
-			const newId = (await createFluidOSNavigation(client, defId, { navigation: {
+			const newId = (await fluid_os_v0_create_fluid_osnavigation(client, defId, { navigation: {
 				name: local.name,
 				platform: local.platform
 			} })).navigation?.id;
@@ -1170,7 +1501,7 @@ async function pushNavigations(client, defId, portalDir, changes, mappings) {
 				const localToServerId = /* @__PURE__ */ new Map();
 				for (const item of resolvedItems) {
 					const resolvedParentId = item.parent_id != null ? localToServerId.get(item.parent_id) ?? item.parent_id : void 0;
-					const created = await createFluidOSNavigationItem(client, defId, newId, { navigation_item: {
+					const created = await fluid_os_v0_create_fluid_osnavigation_item(client, defId, newId, { navigation_item: {
 						label: item.label ?? "",
 						position: item.position ?? 0,
 						icon: item.icon ?? void 0,
@@ -1217,15 +1548,15 @@ async function pushNavigations(client, defId, portalDir, changes, mappings) {
 		}
 		try {
 			const local = await readPortalFile(portalDir, file);
-			await updateFluidOSNavigation(client, defId, navId, { navigation: {
+			await fluid_os_v0_update_fluid_osnavigation(client, defId, navId, { navigation: {
 				name: local.name,
 				platform: local.platform
 			} });
 			const resolvedItems = flattenNavigationItems(resolveNavigationItemScreenIds(local.navigation_items, currentMappings));
-			const serverItems = (await listFluidOSNavigationItems(client, defId, navId)).navigation_items ?? [];
+			const serverItems = (await fluid_os_v0_list_fluid_osnavigation_items(client, defId, navId)).navigation_items ?? [];
 			const serverById = new Map(serverItems.map((s) => [s.id, s]));
 			const localIds = new Set(resolvedItems.filter((i) => i.id).map((i) => i.id));
-			for (const serverItem of serverItems) if (!localIds.has(serverItem.id)) await deleteFluidOSNavigationItem(client, defId, navId, serverItem.id);
+			for (const serverItem of serverItems) if (!localIds.has(serverItem.id)) await fluid_os_v0_delete_fluid_osnavigation_item(client, defId, navId, serverItem.id);
 			const localToServerId = /* @__PURE__ */ new Map();
 			for (const item of resolvedItems) {
 				const resolvedParentId = item.parent_id != null ? localToServerId.get(item.parent_id) ?? item.parent_id : void 0;
@@ -1238,9 +1569,9 @@ async function pushNavigations(client, defId, portalDir, changes, mappings) {
 					source: item.source ?? void 0,
 					parent_id: resolvedParentId
 				};
-				if (item.id && serverById.has(item.id)) await updateFluidOSNavigationItem(client, defId, navId, item.id, { navigation_item: body });
+				if (item.id && serverById.has(item.id)) await fluid_os_v0_update_fluid_osnavigation_item(client, defId, navId, item.id, { navigation_item: body });
 				else {
-					const created = await createFluidOSNavigationItem(client, defId, navId, { navigation_item: {
+					const created = await fluid_os_v0_create_fluid_osnavigation_item(client, defId, navId, { navigation_item: {
 						...body,
 						label: body.label ?? "",
 						position: body.position ?? 0
@@ -1282,7 +1613,7 @@ async function pushNavigations(client, defId, portalDir, changes, mappings) {
 			};
 		}
 		try {
-			await deleteFluidOSNavigation(client, defId, navId);
+			await fluid_os_v0_delete_fluid_osnavigation(client, defId, navId);
 			currentMappings = removeMapping(currentMappings, "navigations", slug);
 			results.push({
 				file,
@@ -1316,7 +1647,7 @@ async function pushProfiles(client, defId, portalDir, changes, mappings) {
 	for (const file of changes.new) {
 		const slug = slugFromPath(file);
 		try {
-			const newId = (await createFluidOSProfile(client, defId, { profile: resolveProfileBody(await readPortalFile(portalDir, file), currentMappings) })).profile?.id;
+			const newId = (await fluid_os_v0_create_fluid_osprofile(client, defId, { profile: resolveProfileBody(await readPortalFile(portalDir, file), currentMappings) })).profile?.id;
 			if (newId != null) currentMappings = updateMapping(currentMappings, "profiles", slug, newId);
 			results.push({
 				file,
@@ -1352,7 +1683,7 @@ async function pushProfiles(client, defId, portalDir, changes, mappings) {
 			};
 		}
 		try {
-			await updateFluidOSProfile(client, defId, profileId, { profile: resolveProfileBody(await readPortalFile(portalDir, file), currentMappings) });
+			await fluid_os_v0_update_fluid_osprofile(client, defId, profileId, { profile: resolveProfileBody(await readPortalFile(portalDir, file), currentMappings) });
 			results.push({
 				file,
 				action: "updated",
@@ -1387,7 +1718,7 @@ async function pushProfiles(client, defId, portalDir, changes, mappings) {
 			};
 		}
 		try {
-			await deleteFluidOSProfile(client, defId, profileId);
+			await fluid_os_v0_delete_fluid_osprofile(client, defId, profileId);
 			currentMappings = removeMapping(currentMappings, "profiles", slug);
 			results.push({
 				file,
@@ -1746,7 +2077,7 @@ export function ${componentName}({ title = "${displayName}" }: ${widgetType}Prop
   );
 }
 `);
-		await fs.writeFile(path.join(widgetDir, "manifest.ts"), `import type { WidgetManifest } from "@fluid-app/portal-core/registries";
+		await fs.writeFile(path.join(widgetDir, "manifest.ts"), `import type { WidgetManifest } from "@fluid-app/portal-sdk";
 import { ${componentName} } from "./component";
 
 export const manifest: WidgetManifest = {
@@ -1810,6 +2141,1529 @@ export { manifest } from "./manifest";
 });
 const widgetCommand = new Command("widget").description("Manage custom portal widgets").addCommand(createSubcommand);
 //#endregion
+//#region src/utils/widget-package-artifacts.ts
+const WIDGET_PACKAGE_BUILDER_VERSION = "1";
+const CONTENT_TYPES = {
+	".css": "text/css",
+	".js": "application/javascript",
+	".json": "application/json",
+	".map": "application/json"
+};
+const CSS_ARTIFACT_PATH_PATTERN = /^[A-Za-z0-9._~-]+\.css$/;
+const JS_MAP_ARTIFACT_PATH_PATTERN = /^[A-Za-z0-9._~-]+\.js\.map$/;
+async function computeArtifactMetadata(filePath, baseDir) {
+	const relativePath = toPosixPath$1(path.relative(baseDir, filePath));
+	assertAllowedArtifactPath(relativePath);
+	await assertRegularArtifactFile(filePath, relativePath);
+	const buffer = await fs.readFile(filePath);
+	return {
+		path: relativePath,
+		sha256: sha256(buffer),
+		bytes: buffer.byteLength,
+		contentType: getArtifactContentType(filePath)
+	};
+}
+async function collectWidgetPackageArtifacts(publishDir) {
+	const artifactPaths = await findArtifactPaths(publishDir);
+	const artifacts = await Promise.all(artifactPaths.map((artifactPath) => computeArtifactMetadata(artifactPath, publishDir)));
+	assertRequiredUploadArtifacts(artifacts);
+	return artifacts.sort((a, b) => a.path.localeCompare(b.path));
+}
+function createPublishManifestMetadata(options) {
+	return {
+		packageId: options.packageId,
+		version: options.version,
+		builderVersion: options.builderVersion ?? "1",
+		cliVersion: options.cliVersion,
+		runtimeVersion: options.runtimeVersion,
+		manifestHash: sha256(options.manifestContent),
+		artifacts: options.artifacts
+	};
+}
+function getArtifactContentType(filePath) {
+	if (path.basename(filePath).endsWith(".js.map")) return "application/json";
+	return CONTENT_TYPES[path.extname(filePath)] ?? "application/octet-stream";
+}
+function sha256(content) {
+	return createHash("sha256").update(content).digest("hex");
+}
+function isWidgetPackageCssArtifactPath(relativePath) {
+	return CSS_ARTIFACT_PATH_PATTERN.test(relativePath);
+}
+function isWidgetPackageJsMapArtifactPath(relativePath) {
+	return JS_MAP_ARTIFACT_PATH_PATTERN.test(relativePath);
+}
+async function assertRegularArtifactFile(filePath, relativePath) {
+	const stat = await fs.lstat(filePath);
+	if (stat.isSymbolicLink()) throw new Error(`Widget publish artifact ${JSON.stringify(relativePath)} must be a regular file and must not be a symbolic link.`);
+	if (!stat.isFile()) throw new Error(`Widget publish artifact ${JSON.stringify(relativePath)} must be a regular file.`);
+}
+async function findArtifactPaths(dir, baseDir = dir) {
+	if (!await fs.pathExists(dir)) return [];
+	const entries = await fs.readdir(dir, { withFileTypes: true });
+	return (await Promise.all(entries.map(async (entry) => {
+		const entryPath = path.join(dir, entry.name);
+		const relativePath = toPosixPath$1(path.relative(baseDir, entryPath));
+		if (entry.isSymbolicLink()) throw new Error(`Widget publish artifact ${JSON.stringify(relativePath)} must be a regular file and must not be a symbolic link.`);
+		if (isUploadArtifact(relativePath)) {
+			if (!entry.isFile()) throw new Error(`Widget publish artifact ${JSON.stringify(relativePath)} must be a regular file.`);
+			return [entryPath];
+		}
+		if (entry.isDirectory()) {
+			const nestedPaths = await findArtifactPaths(entryPath, baseDir);
+			if (nestedPaths.length === 0) throwUnsupportedArtifactPath(`${relativePath}/`);
+			return nestedPaths;
+		}
+		if (isAllowedGeneratedFile(relativePath)) return [];
+		throwUnsupportedArtifactPath(relativePath);
+	}))).flat();
+}
+function assertRequiredUploadArtifacts(artifacts) {
+	const artifactPaths = new Set(artifacts.map((artifact) => artifact.path));
+	for (const requiredPath of ["widget.js", "manifest.json"]) {
+		if (artifactPaths.has(requiredPath)) continue;
+		throw new Error(`Widget package publish output must include regular file ${JSON.stringify(requiredPath)}.`);
+	}
+}
+function assertAllowedArtifactPath(relativePath) {
+	if (isUploadArtifact(relativePath) || isAllowedGeneratedFile(relativePath)) return;
+	throwUnsupportedArtifactPath(relativePath);
+}
+function isUploadArtifact(relativePath) {
+	return relativePath === "widget.js" || relativePath === "manifest.json" || isWidgetPackageCssArtifactPath(relativePath) || isWidgetPackageJsMapArtifactPath(relativePath);
+}
+function isAllowedGeneratedFile(relativePath) {
+	return isFlatArtifactPath(relativePath) && relativePath === "publish-manifest.json";
+}
+function isFlatArtifactPath(relativePath) {
+	return relativePath.length > 0 && !relativePath.includes("/") && !relativePath.includes("\\");
+}
+function throwUnsupportedArtifactPath(relativePath) {
+	throw new Error(`Unsupported widget publish artifact ${JSON.stringify(relativePath)}. Allowed files are widget.js, manifest.json, top-level [A-Za-z0-9._~-]+.css, top-level [A-Za-z0-9._~-]+.js.map, and publish-manifest.json.`);
+}
+function toPosixPath$1(value) {
+	return value.split(path.sep).join("/");
+}
+//#endregion
+//#region src/utils/widget-package-validation.ts
+const URL_SAFE_SEGMENT_SOURCE = "[A-Za-z0-9][A-Za-z0-9_~-]*";
+const URL_SAFE_WIDGET_NAME_PATTERN = new RegExp(`^${URL_SAFE_SEGMENT_SOURCE}$`);
+const URL_SAFE_DOTTED_IDENTIFIER_PATTERN = new RegExp(`^${URL_SAFE_SEGMENT_SOURCE}(?:\\.${URL_SAFE_SEGMENT_SOURCE})*$`);
+const SEMVER_CORE_PATTERN = "(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)";
+const SEMVER_PRERELEASE_IDENTIFIER_PATTERN = "(?:0|[1-9]\\d*|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*)";
+const SEMVER_URL_SAFE_PATTERN = new RegExp(`^${SEMVER_CORE_PATTERN}(?:-${SEMVER_PRERELEASE_IDENTIFIER_PATTERN}(?:\\.${SEMVER_PRERELEASE_IDENTIFIER_PATTERN})*)?$`);
+const WIDGET_PACKAGE_MANIFEST_VERSION = 1;
+const DEFAULT_WIDGET_ICON = "box";
+const DEFAULT_WIDGET_CATEGORY = "components";
+const DEFAULT_WIDGET_CONTAINER = "block";
+const DEFAULT_MIN_SDK_VERSION = "0.0.0";
+function validateSingleSourceWidgetPackage(sourcePackages, options = {}) {
+	if (sourcePackages.length === 0) return validationFailure({
+		code: "NO_SOURCE_PACKAGE",
+		message: "No defineWidgetPackage source package was found. Export widgetPackage, widgetPackages, or a default widget package from src/widgets.config.ts, src/portal.config.ts, or portal.config.ts."
+	});
+	if (sourcePackages.length > 1) return validationFailure({
+		code: "MULTIPLE_SOURCE_PACKAGES",
+		message: "Publish/deploy supports exactly one defineWidgetPackage source package. Export one package or split packages into separate builds."
+	});
+	const sourcePackageValue = sourcePackages[0];
+	if (!sourcePackageValue) return validationFailure({
+		code: "NO_SOURCE_PACKAGE",
+		message: "No defineWidgetPackage source package was found."
+	});
+	const shapeErrors = validateSourcePackageShape(sourcePackageValue);
+	if (shapeErrors.length > 0) return {
+		success: false,
+		errors: shapeErrors
+	};
+	const sourcePackage = sourcePackageValue;
+	const errors = [];
+	const owner = options.owner ?? sourcePackage.packageType;
+	if (owner !== "company" && owner !== "droplet") errors.push({
+		code: "UNSUPPORTED_OWNER",
+		path: "packageType",
+		message: "Widget package publish/deploy currently supports company and droplet owners. Set packageType to \"company\" or \"droplet\"."
+	});
+	const resolvedOwner = owner === "droplet" ? "droplet" : "company";
+	const packageKey = resolvePackageKey(sourcePackage, resolvedOwner);
+	const packageKeyPath = readNonEmptyTrimmedString(sourcePackage.packageStableId) ? "packageStableId" : "packageId";
+	if (!isUrlSafeDottedIdentifier(packageKey)) errors.push({
+		code: "INVALID_PACKAGE_KEY",
+		path: packageKeyPath,
+		message: "Widget package key must be URL-safe dot-separated text (letters, numbers, '.', '_', '~', and '-' only)."
+	});
+	if (!isUrlSafeSemver(sourcePackage.version)) errors.push({
+		code: "INVALID_VERSION",
+		path: "version",
+		message: "Widget package version must be a URL-safe SemVer version without build metadata (for example 1.2.3 or 1.2.3-beta.1)."
+	});
+	if (sourcePackage.widgets.length === 0) errors.push({
+		code: "NO_WIDGETS",
+		path: "widgets",
+		message: "Widget package must include at least one widget."
+	});
+	const packageId = `${resolvedOwner}.${packageKey}`;
+	const seenNames = /* @__PURE__ */ new Set();
+	const seenTypes = /* @__PURE__ */ new Set();
+	const widgets = [];
+	sourcePackage.widgets.forEach((widget, index) => {
+		const path = `widgets[${index}]`;
+		if (!isUrlSafeWidgetName(widget.name)) {
+			errors.push({
+				code: "INVALID_WIDGET_NAME",
+				path: `${path}.name`,
+				message: "Widget name must be URL-safe text (letters, numbers, '_', '~', and '-' only) and cannot be empty."
+			});
+			return;
+		}
+		if (seenNames.has(widget.name)) {
+			errors.push({
+				code: "DUPLICATE_WIDGET",
+				path: `${path}.name`,
+				message: `Duplicate widget name "${widget.name}" found in package ${packageKey}.`
+			});
+			return;
+		}
+		seenNames.add(widget.name);
+		const type = `${packageId}.${widget.name}`;
+		if (!isUrlSafeDottedIdentifier(type)) {
+			errors.push({
+				code: "INVALID_WIDGET_TYPE",
+				path: `${path}.type`,
+				message: `Generated widget type "${type}" is not URL-safe.`
+			});
+			return;
+		}
+		if (seenTypes.has(type)) {
+			errors.push({
+				code: "DUPLICATE_WIDGET",
+				path: `${path}.type`,
+				message: `Duplicate generated widget type "${type}" found.`
+			});
+			return;
+		}
+		seenTypes.add(type);
+		widgets.push(sourceWidgetToDescriptor(widget, type));
+	});
+	if (errors.length > 0) return {
+		success: false,
+		errors
+	};
+	return {
+		success: true,
+		value: {
+			sourcePackage,
+			packageKey,
+			packageId,
+			owner: resolvedOwner,
+			version: sourcePackage.version,
+			widgets
+		},
+		errors: []
+	};
+}
+function buildWidgetPackageDescriptor(validated, options = {}) {
+	const remoteEntryUrl = options.remoteEntryUrl ?? "widget.js";
+	validateRuntimeDescriptorUrl(remoteEntryUrl, "remoteEntryUrl");
+	return {
+		manifestVersion: WIDGET_PACKAGE_MANIFEST_VERSION,
+		packageId: getWidgetPackageDescriptorPackageId(validated),
+		packageType: validated.owner,
+		version: validated.version,
+		remoteEntryUrl,
+		cssUrls: mergeCssUrls(validated.sourcePackage.cssUrls, options.cssUrls),
+		widgets: validated.widgets
+	};
+}
+function getWidgetPackageDescriptorPackageId(validated) {
+	return validated.owner === "droplet" ? validated.packageKey : validated.packageId;
+}
+function sourceWidgetToDescriptor(widget, type) {
+	const displayName = widget.displayName ?? widget.name;
+	return {
+		type,
+		name: widget.name,
+		displayName,
+		description: widget.description ?? `Custom widget ${displayName}`,
+		icon: widget.icon ?? DEFAULT_WIDGET_ICON,
+		category: widget.category ?? DEFAULT_WIDGET_CATEGORY,
+		propertySchema: normalizePropertySchema(widget.propertySchema, type),
+		defaultProps: widget.defaultProps ?? {},
+		container: normalizeContainer(widget.container),
+		minSdkVersion: widget.minSdkVersion ?? DEFAULT_MIN_SDK_VERSION,
+		resizable: normalizeResizable(widget.resizable)
+	};
+}
+function validationFailure(error) {
+	return {
+		success: false,
+		errors: [error]
+	};
+}
+function validateSourcePackageShape(value) {
+	if (!isRecord$3(value)) return [{
+		code: "INVALID_SOURCE_PACKAGE",
+		message: "Widget source package must be a JSON object."
+	}];
+	const errors = [];
+	requireStringField(value, "packageId", "packageId", errors);
+	requireStringField(value, "version", "version", errors);
+	validateOptionalStringField(value, "scope", "scope", errors);
+	validateOptionalStringField(value, "packageStableId", "packageStableId", errors);
+	validateOptionalStringField(value, "packageType", "packageType", errors);
+	if (value.cssUrls !== void 0) if (!Array.isArray(value.cssUrls)) errors.push({
+		code: "INVALID_SOURCE_PACKAGE",
+		path: "cssUrls",
+		message: "Widget package cssUrls must be an array of strings when present."
+	});
+	else value.cssUrls.forEach((cssUrl, index) => {
+		validateCssUrl(cssUrl, `cssUrls[${index}]`, errors);
+	});
+	if (!Array.isArray(value.widgets)) {
+		errors.push({
+			code: "INVALID_SOURCE_PACKAGE",
+			path: "widgets",
+			message: "Widget package widgets must be an array."
+		});
+		return errors;
+	}
+	value.widgets.forEach((widget, index) => {
+		const widgetPath = `widgets[${index}]`;
+		if (!isRecord$3(widget)) {
+			errors.push({
+				code: "INVALID_WIDGET_METADATA",
+				path: widgetPath,
+				message: "Widget metadata must be a JSON object."
+			});
+			return;
+		}
+		requireStringField(widget, "name", `${widgetPath}.name`, errors, {
+			code: "INVALID_WIDGET_NAME",
+			message: "Widget name must be a string and cannot be empty."
+		});
+		validateOptionalStringField(widget, "displayName", `${widgetPath}.displayName`, errors, { requireNonEmpty: true });
+		validateOptionalStringField(widget, "description", `${widgetPath}.description`, errors, { requireNonEmpty: true });
+		validateOptionalStringField(widget, "icon", `${widgetPath}.icon`, errors, { requireNonEmpty: true });
+		validateOptionalStringField(widget, "category", `${widgetPath}.category`, errors, { requireNonEmpty: true });
+		validateOptionalStringField(widget, "minSdkVersion", `${widgetPath}.minSdkVersion`, errors, { requireNonEmpty: true });
+		validateOptionalRecordField(widget, "propertySchema", `${widgetPath}.propertySchema`, errors);
+		validateOptionalRecordField(widget, "defaultProps", `${widgetPath}.defaultProps`, errors);
+	});
+	return errors;
+}
+function requireStringField(record, key, path, errors, override) {
+	const value = record[key];
+	if (typeof value === "string" && value.trim().length > 0) return;
+	errors.push({
+		code: override?.code ?? "INVALID_SOURCE_PACKAGE",
+		path,
+		message: override?.message ?? `${path} must be a string and cannot be empty.`
+	});
+}
+function validateOptionalStringField(record, key, path, errors, options = {}) {
+	const value = record[key];
+	if (value === void 0) return;
+	if (typeof value === "string") {
+		if (!options.requireNonEmpty || value.trim().length > 0) return;
+		errors.push({
+			code: "INVALID_SOURCE_PACKAGE",
+			path,
+			message: `${path} must be a non-empty string when present.`
+		});
+		return;
+	}
+	errors.push({
+		code: "INVALID_SOURCE_PACKAGE",
+		path,
+		message: `${path} must be a string when present.`
+	});
+}
+function validateCssUrl(value, cssUrlPath, errors) {
+	if (typeof value !== "string" || value.trim().length === 0) {
+		errors.push({
+			code: "INVALID_SOURCE_PACKAGE",
+			path: cssUrlPath,
+			message: "Widget package cssUrls entries must be non-empty strings."
+		});
+		return;
+	}
+	if (!isValidRuntimeDescriptorUrl(value)) {
+		errors.push({
+			code: "INVALID_SOURCE_PACKAGE",
+			path: cssUrlPath,
+			message: "Widget package cssUrls entries must be https URLs, trusted local http URLs, or relative URLs."
+		});
+		return;
+	}
+	if (!isAbsoluteRuntimeUrl(value) && !isWidgetPackageCssArtifactPath(value)) errors.push({
+		code: "INVALID_SOURCE_PACKAGE",
+		path: cssUrlPath,
+		message: "Widget package relative cssUrls entries must be top-level CSS artifact filenames matching [A-Za-z0-9._~-]+.css."
+	});
+}
+function validateRuntimeDescriptorUrl(value, urlPath) {
+	if (value.trim().length === 0) throw new Error(`${urlPath} must be a non-empty string.`);
+	if (!isValidRuntimeDescriptorUrl(value)) throw new Error(`${urlPath} must be an https URL, trusted local http URL, or relative URL.`);
+}
+function isValidRuntimeDescriptorUrl(value) {
+	if (value.trim() !== value || containsUnsafeUrlCharacter(value)) return false;
+	if (/^[a-zA-Z][a-zA-Z\d+.-]*:/.exec(value)) {
+		let parsedUrl;
+		try {
+			parsedUrl = new URL(value);
+		} catch {
+			return false;
+		}
+		return parsedUrl.protocol === "https:" || isTrustedLocalHttpUrl(parsedUrl, value);
+	}
+	if (value.slice(0, 2) === "//") return false;
+	try {
+		new URL(value, "http://localhost");
+		return true;
+	} catch {
+		return false;
+	}
+}
+function isTrustedLocalHttpUrl(url, rawUrl) {
+	if (url.protocol !== "http:") return false;
+	const hostname = extractRawHostname(rawUrl).toLowerCase();
+	return hostname === "localhost" || hostname === "[::1]" || hostname === "::1" || isLoopbackIpv4Hostname(hostname);
+}
+function extractRawHostname(rawUrl) {
+	const authorityStart = rawUrl.indexOf("://") + 3;
+	const authorityEnd = findAuthorityEnd(rawUrl, authorityStart);
+	const authority = rawUrl.slice(authorityStart, authorityEnd);
+	const hostAndPort = authority.slice(authority.lastIndexOf("@") + 1);
+	if (hostAndPort.charAt(0) === "[") {
+		const bracketEnd = hostAndPort.indexOf("]");
+		return bracketEnd === -1 ? hostAndPort : hostAndPort.slice(0, bracketEnd + 1);
+	}
+	const portStart = hostAndPort.indexOf(":");
+	return portStart === -1 ? hostAndPort : hostAndPort.slice(0, portStart);
+}
+function findAuthorityEnd(rawUrl, authorityStart) {
+	let authorityEnd = rawUrl.length;
+	for (const delimiter of [
+		"/",
+		"?",
+		"#"
+	]) {
+		const delimiterIndex = rawUrl.indexOf(delimiter, authorityStart);
+		if (delimiterIndex !== -1 && delimiterIndex < authorityEnd) authorityEnd = delimiterIndex;
+	}
+	return authorityEnd;
+}
+function isLoopbackIpv4Hostname(hostname) {
+	const octets = hostname.split(".");
+	if (octets.length !== 4 || octets[0] !== "127") return false;
+	return octets.every(isBoundedIpv4Octet);
+}
+function isBoundedIpv4Octet(octet) {
+	if (!/^\d{1,3}$/.test(octet)) return false;
+	if (octet.length > 1 && octet.charAt(0) === "0") return false;
+	const value = Number(octet);
+	return value >= 0 && value <= 255;
+}
+function containsUnsafeUrlCharacter(value) {
+	for (let index = 0; index < value.length; index += 1) {
+		const charCode = value.charCodeAt(index);
+		if (charCode <= 31 || charCode === 127 || charCode === 92) return true;
+	}
+	return false;
+}
+function validateOptionalRecordField(record, key, path, errors) {
+	const value = record[key];
+	if (value === void 0 || isRecord$3(value)) return;
+	errors.push({
+		code: "INVALID_WIDGET_METADATA",
+		path,
+		message: `${path} must be a JSON object when present.`
+	});
+}
+function mergeCssUrls(sourceCssUrls, generatedCssUrls) {
+	const generatedCssUrlSet = new Set(generatedCssUrls ?? []);
+	sourceCssUrls?.forEach((cssUrl, index) => {
+		validateRuntimeDescriptorUrl(cssUrl, `cssUrls[${index}]`);
+		if (isAbsoluteRuntimeUrl(cssUrl)) return;
+		if (!isWidgetPackageCssArtifactPath(cssUrl)) throw new Error(`cssUrls[${index}] relative URL ${JSON.stringify(cssUrl)} must be a top-level CSS artifact filename matching [A-Za-z0-9._~-]+.css.`);
+		if (generatedCssUrlSet.has(cssUrl)) return;
+		throw new Error(`cssUrls[${index}] relative URL ${JSON.stringify(cssUrl)} must match a generated top-level CSS artifact. Import the CSS from the widget package bundle or remove it from cssUrls.`);
+	});
+	const cssUrls = Array.from(new Set([...sourceCssUrls ?? [], ...generatedCssUrls ?? []]));
+	cssUrls.forEach((cssUrl, index) => {
+		validateRuntimeDescriptorUrl(cssUrl, `cssUrls[${index}]`);
+	});
+	return cssUrls;
+}
+function isAbsoluteRuntimeUrl(value) {
+	return /^[a-zA-Z][a-zA-Z\d+.-]*:/.test(value);
+}
+function normalizePropertySchema(value, widgetType) {
+	return {
+		...value ?? {},
+		widgetType
+	};
+}
+function normalizeContainer(value) {
+	if (value === "inline" || value === "block" || value === "card" || value === "fullscreen") return value;
+	return DEFAULT_WIDGET_CONTAINER;
+}
+function normalizeResizable(value) {
+	if (typeof value === "boolean") return value;
+	if (value === "horizontal" || value === "vertical" || value === "both") return value;
+	if (!isRecord$3(value)) return false;
+	const horizontal = value.horizontal === true;
+	const vertical = value.vertical === true;
+	if (horizontal && vertical) return "both";
+	if (horizontal) return "horizontal";
+	if (vertical) return "vertical";
+	return false;
+}
+function resolvePackageKey(sourcePackage, owner) {
+	const packageStableId = readNonEmptyTrimmedString(sourcePackage.packageStableId);
+	if (packageStableId) return prefixPackageStableIdWithNonOwnerScope(packageStableId, sourcePackage.scope);
+	return stripOwnerScopeFromPackageId(sourcePackage.packageId, sourcePackage.scope, owner);
+}
+function prefixPackageStableIdWithNonOwnerScope(packageStableId, sourceScope) {
+	const sourceScopeText = readNonEmptyTrimmedString(sourceScope);
+	if (!sourceScopeText || isWidgetPackageOwnerKind(sourceScopeText)) return packageStableId;
+	const sourceScopePrefix = `${sourceScopeText}.`;
+	if (packageStableId.startsWith(sourceScopePrefix)) return packageStableId;
+	return `${sourceScopeText}.${packageStableId}`;
+}
+function stripOwnerScopeFromPackageId(packageId, sourceScope, owner) {
+	const ownerPrefix = `${owner}.`;
+	if (packageId.startsWith(ownerPrefix) && packageId.length > ownerPrefix.length) return packageId.slice(ownerPrefix.length);
+	const sourceScopeText = readNonEmptyTrimmedString(sourceScope);
+	if (isWidgetPackageOwnerKind(sourceScopeText) && packageId.startsWith(`${sourceScopeText}.`) && packageId.length > sourceScopeText.length + 1) return packageId.slice(sourceScopeText.length + 1);
+	return packageId;
+}
+function readNonEmptyTrimmedString(value) {
+	const trimmed = value?.trim();
+	return trimmed ? trimmed : void 0;
+}
+function isWidgetPackageOwnerKind(value) {
+	return value === "company" || value === "droplet";
+}
+function isUrlSafeDottedIdentifier(value) {
+	return URL_SAFE_DOTTED_IDENTIFIER_PATTERN.test(value);
+}
+function isUrlSafeWidgetName(value) {
+	return URL_SAFE_WIDGET_NAME_PATTERN.test(value);
+}
+function isUrlSafeSemver(value) {
+	return SEMVER_URL_SAFE_PATTERN.test(value);
+}
+function isRecord$3(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region src/utils/widget-package-builder.ts
+const DEFAULT_PUBLISH_DIR = ".fluid/widget-dist";
+const DEFAULT_RUNTIME_VERSION = "1";
+const TEMP_BUILD_DIR = ".fluid/widget-build";
+const TEMP_CLI_DIR = ".fluid/tmp";
+const PROJECT_VITE_CONFIG_CANDIDATES = [
+	"vite.config.ts",
+	"vite.config.mts",
+	"vite.config.js",
+	"vite.config.mjs"
+];
+const BLOCKED_FLUID_PROJECT_PLUGIN_NAMES = [
+	"fluid-manifest-plugin",
+	"fluid-preview-plugin",
+	"fluid-builder-preview",
+	"fluid-builder-preview-standalone",
+	"fluid-portal-dev",
+	"fluid-backend-dev"
+];
+const require = createRequire(import.meta.url);
+function validateSharedWidgetPackagePublishDir(projectDir, publishDir = DEFAULT_PUBLISH_DIR, options = {}) {
+	const label = options.optionName ?? "publishDir";
+	if (path.isAbsolute(publishDir)) throw new Error(`${label} must be relative to the project directory.`);
+	const normalizedPublishDir = normalizePublishDirForValidation(publishDir);
+	if (normalizedPublishDir === ".fluid" || !normalizedPublishDir.startsWith(".fluid/")) throw new Error(`${label} must be a relative path under .fluid/.`);
+	if (isPathWithinReservedDir(normalizedPublishDir, TEMP_BUILD_DIR)) throw new Error(`${label} must not be ${TEMP_BUILD_DIR} because it is reserved for temporary builder output.`);
+	if (isPathWithinReservedDir(normalizedPublishDir, TEMP_CLI_DIR)) throw new Error(`${label} must not be ${TEMP_CLI_DIR} because it is reserved for Fluid CLI temporary files.`);
+	const resolvedProjectDir = path.resolve(projectDir);
+	const resolvedPublishDir = path.resolve(resolvedProjectDir, publishDir);
+	const relative = path.relative(resolvedProjectDir, resolvedPublishDir);
+	if (relative === "" || relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`${label} must stay inside the project directory.`);
+}
+async function buildSharedWidgetPackage(options) {
+	const publishDirInput = options.publishDir ?? DEFAULT_PUBLISH_DIR;
+	try {
+		await validateWidgetPackageOutputPaths(options.projectDir, publishDirInput);
+	} catch (err) {
+		return failure({
+			code: "INVALID_PUBLISH_DIR",
+			message: "Unsafe widget package publish directory",
+			details: (err instanceof Error ? err : new Error(String(err))).message
+		});
+	}
+	const sourcePackageResult = await loadSourceWidgetPackages(options.projectDir);
+	if (!sourcePackageResult.success) return failure({
+		code: "CONFIG_LOAD_FAILED",
+		message: sourcePackageResult.error.message,
+		details: sourcePackageResult.error.details
+	});
+	const validation = validateSingleSourceWidgetPackage(sourcePackageResult.value, { owner: options.owner });
+	if (!validation.success || !validation.value) return failure({
+		code: "VALIDATION_FAILED",
+		message: validation.errors.map((error) => error.message).join("\n")
+	});
+	try {
+		await validateWidgetPackageOutputPaths(options.projectDir, publishDirInput);
+		const publishDir = path.resolve(options.projectDir, publishDirInput);
+		await fs.emptyDir(publishDir);
+		const tempDir = path.resolve(options.projectDir, TEMP_BUILD_DIR);
+		await fs.emptyDir(tempDir);
+		try {
+			await buildWidgetScriptBundle({
+				projectDir: options.projectDir,
+				tempDir,
+				publishDir,
+				validated: validation.value
+			});
+		} finally {
+			await fs.remove(tempDir).catch(() => {});
+		}
+		const cssUrls = await collectCssUrls(publishDir);
+		const manifestContent = stableStringify(buildWidgetPackageDescriptor(validation.value, { cssUrls }));
+		const manifestPath = path.join(publishDir, "manifest.json");
+		const widgetScriptPath = path.join(publishDir, "widget.js");
+		const publishManifestPath = path.join(publishDir, "publish-manifest.json");
+		await fs.writeFile(manifestPath, manifestContent, "utf-8");
+		const artifacts = await collectWidgetPackageArtifacts(publishDir);
+		const publishManifest = createPublishManifestMetadata({
+			packageId: getWidgetPackageDescriptorPackageId(validation.value),
+			version: validation.value.version,
+			cliVersion: readCliVersion(),
+			runtimeVersion: DEFAULT_RUNTIME_VERSION,
+			manifestContent,
+			artifacts
+		});
+		await fs.writeFile(publishManifestPath, stableStringify(publishManifest), "utf-8");
+		return success({
+			publishDir,
+			packageId: getWidgetPackageDescriptorPackageId(validation.value),
+			version: validation.value.version,
+			manifestPath,
+			publishManifestPath,
+			widgetScriptPath
+		});
+	} catch (err) {
+		const error = err instanceof Error ? err : new Error(String(err));
+		const isPublishDirValidationError = /^(publishDir|reserved temporary build directory) /.test(error.message);
+		return failure({
+			code: isPublishDirValidationError ? "INVALID_PUBLISH_DIR" : "WRITE_FAILED",
+			message: isPublishDirValidationError ? "Unsafe widget package publish directory" : "Failed to build shared widget package artifacts",
+			details: error.message
+		});
+	}
+}
+function createWidgetPackageEntrySource(options) {
+	return `import * as widgetConfig from ${JSON.stringify(options.configImportPath)};
+
+const SOURCE_PACKAGE_MARKER = "__fluidSourceWidgetPackage";
+const descriptors = ${JSON.stringify(options.validated.widgets, null, 2)};
+
+function isSourceWidgetPackage(value) {
+  return Boolean(value && typeof value === "object" && value[SOURCE_PACKAGE_MARKER] === true);
+}
+
+function collectSourceWidgetPackages(mod) {
+  return [
+    mod.widgetPackage,
+    ...(Array.isArray(mod.widgetPackages) ? mod.widgetPackages : []),
+    mod.default,
+  ].filter(isSourceWidgetPackage);
+}
+
+const sourcePackage = collectSourceWidgetPackages(widgetConfig)[0];
+if (!sourcePackage) {
+  throw new Error("No Fluid source widget package found while loading widget package bundle.");
+}
+
+const componentsByName = new Map(
+  sourcePackage.widgets.map((widget) => [widget.name, widget.component]),
+);
+
+const widgets = descriptors.map((descriptor) => {
+  const component = componentsByName.get(descriptor.name);
+  if (typeof component !== "function" && typeof component !== "object") {
+    throw new Error("Widget package is missing component for " + descriptor.name + ".");
+  }
+  return { ...descriptor, component };
+});
+
+if (!window.FluidWidgets || typeof window.FluidWidgets.registerPackage !== "function") {
+  throw new Error("FluidWidgets registry is not installed.");
+}
+
+window.FluidWidgets.registerPackage({
+  packageId: ${JSON.stringify(options.validated.packageId)},
+  version: ${JSON.stringify(options.validated.version)},
+  widgets,
+});
+`;
+}
+async function buildWidgetScriptBundle(options) {
+	const sourceConfig = await resolvePortalWidgetSourceConfig(options.projectDir);
+	if (!sourceConfig) throw new Error("No portal widget source config found.");
+	const entryPath = path.join(options.tempDir, "widget-entry.ts");
+	const viteConfigPath = path.join(options.tempDir, "vite.config.mjs");
+	await fs.writeFile(entryPath, createWidgetPackageEntrySource({
+		configImportPath: pathToFileURL(sourceConfig.path).href,
+		validated: options.validated
+	}), "utf-8");
+	await fs.writeFile(viteConfigPath, createViteConfigSource({
+		entryPath,
+		publishDir: options.publishDir,
+		projectConfigPath: await resolveProjectViteConfigPath(options.projectDir)
+	}), "utf-8");
+	const viteCliPath = resolveViteCliPath(options.projectDir);
+	await execa(process.execPath, [
+		viteCliPath,
+		"build",
+		"--config",
+		viteConfigPath
+	], {
+		cwd: options.projectDir,
+		stdio: "pipe",
+		env: {
+			...process.env,
+			NODE_ENV: "production"
+		}
+	});
+}
+function resolveViteCliPath(projectDir) {
+	const projectViteCliPath = resolveViteCliPathFromRequire(createRequire(path.join(projectDir, "package.json")));
+	if (projectViteCliPath) return projectViteCliPath;
+	const cliViteCliPath = resolveViteCliPathFromRequire(require);
+	if (cliViteCliPath) return cliViteCliPath;
+	throw new Error("Unable to resolve Vite for the portal project. Install the project dependencies and ensure vite is available before building widget packages.");
+}
+async function resolveProjectViteConfigPath(projectDir) {
+	for (const fileName of PROJECT_VITE_CONFIG_CANDIDATES) {
+		const candidate = path.join(projectDir, fileName);
+		if (await fs.pathExists(candidate)) return candidate;
+	}
+}
+function createViteConfigSource(options) {
+	const widgetConfigSource = createWidgetViteConfigObjectSource({
+		...options,
+		disableConfigFileLookup: !options.projectConfigPath
+	});
+	if (!options.projectConfigPath) return `import { defineConfig } from "vite";
+
+export default defineConfig(${widgetConfigSource});
+`;
+	return `import { defineConfig, loadConfigFromFile, mergeConfig } from "vite";
+
+const projectConfigPath = ${JSON.stringify(options.projectConfigPath)};
+const widgetConfig = ${widgetConfigSource};
+const blockedFluidPluginNames = new Set(${JSON.stringify(BLOCKED_FLUID_PROJECT_PLUGIN_NAMES)});
+
+function isAllowedProjectPlugin(plugin) {
+  return !plugin || typeof plugin !== "object" || !blockedFluidPluginNames.has(plugin.name);
+}
+
+function sanitizeProjectPlugins(pluginOption) {
+  if (!Array.isArray(pluginOption)) {
+    return isAllowedProjectPlugin(pluginOption) ? pluginOption : [];
+  }
+
+  return pluginOption
+    .map((plugin) => Array.isArray(plugin) ? sanitizeProjectPlugins(plugin) : plugin)
+    .filter(isAllowedProjectPlugin);
+}
+
+function copyProjectConfigValue(source, target, key) {
+  if (Object.prototype.hasOwnProperty.call(source, key)) {
+    target[key] = source[key];
+  }
+}
+
+function sanitizeProjectConfig(config) {
+  if (!config || typeof config !== "object") return {};
+
+  const sanitized = {};
+  if (Object.prototype.hasOwnProperty.call(config, "plugins")) {
+    sanitized.plugins = sanitizeProjectPlugins(config.plugins);
+  }
+  copyProjectConfigValue(config, sanitized, "resolve");
+  copyProjectConfigValue(config, sanitized, "define");
+  copyProjectConfigValue(config, sanitized, "css");
+  copyProjectConfigValue(config, sanitized, "esbuild");
+  copyProjectConfigValue(config, sanitized, "json");
+  copyProjectConfigValue(config, sanitized, "assetsInclude");
+  copyProjectConfigValue(config, sanitized, "envDir");
+  copyProjectConfigValue(config, sanitized, "envPrefix");
+  return sanitized;
+}
+
+export default defineConfig(async (configEnv) => {
+  const projectConfig = await loadConfigFromFile(configEnv, projectConfigPath);
+  const safeProjectConfig = sanitizeProjectConfig(projectConfig?.config ?? {});
+  return mergeConfig(safeProjectConfig, widgetConfig);
+});
+`;
+}
+function createWidgetViteConfigObjectSource(options) {
+	const configFileSource = options.disableConfigFileLookup ? "  configFile: false,\n" : "";
+	return `(() => {
+  function createFluidWidgetBuildInvariants() {
+    return {
+      copyPublicDir: false,
+      emptyOutDir: false,
+      outDir: ${JSON.stringify(options.publishDir)},
+      sourcemap: false,
+      lib: {
+        entry: ${JSON.stringify(options.entryPath)},
+        formats: ["iife"],
+        name: "FluidWidgetPackage",
+        fileName: () => "widget.js",
+      },
+      rollupOptions: {
+        external: ["react", "react-dom", "react/jsx-runtime"],
+        output: {
+          globals: {
+            react: "FluidShared.React",
+            "react-dom": "FluidShared.ReactDOM",
+            "react/jsx-runtime": "FluidShared.ReactJsxRuntime",
+          },
+        },
+      },
+    };
+  }
+
+  function fluidWidgetBuildInvariantsPlugin() {
+    return {
+      name: "fluid-widget-build-invariants",
+      enforce: "post",
+      config() {
+        return { build: createFluidWidgetBuildInvariants() };
+      },
+      configResolved(config) {
+        Object.assign(config.build, createFluidWidgetBuildInvariants());
+      },
+    };
+  }
+
+  return {
+${configFileSource}    publicDir: false,
+    resolve: {
+      conditions: ["fluid-widget-authoring"],
+    },
+    plugins: [fluidWidgetBuildInvariantsPlugin()],
+    build: createFluidWidgetBuildInvariants(),
+  };
+})()`;
+}
+async function validateWidgetPackageOutputPaths(projectDir, publishDir) {
+	validateSharedWidgetPackagePublishDir(projectDir, publishDir);
+	await rejectSymlinkedPathSegments({
+		projectDir,
+		relativePath: publishDir,
+		label: "publishDir"
+	});
+	await rejectSymlinkedPathSegments({
+		projectDir,
+		relativePath: TEMP_BUILD_DIR,
+		label: "reserved temporary build directory"
+	});
+}
+async function collectCssUrls(publishDir) {
+	return (await fs.readdir(publishDir, { withFileTypes: true })).filter((entry) => entry.isFile() && isWidgetPackageCssArtifactPath(entry.name)).map((entry) => entry.name).sort();
+}
+async function rejectSymlinkedPathSegments(options) {
+	const resolvedProjectDir = path.resolve(options.projectDir);
+	const resolvedTargetPath = path.resolve(resolvedProjectDir, options.relativePath);
+	const segments = path.relative(resolvedProjectDir, resolvedTargetPath).split(path.sep).filter(Boolean);
+	let currentPath = resolvedProjectDir;
+	for (const segment of segments) {
+		currentPath = path.join(currentPath, segment);
+		let stat;
+		try {
+			stat = await fs.lstat(currentPath);
+		} catch (err) {
+			if (isNodeError(err) && err.code === "ENOENT") return;
+			throw err;
+		}
+		if (stat.isSymbolicLink()) throw new Error(`${options.label} must not include symbolic links.`);
+	}
+}
+function normalizePublishDirForValidation(value) {
+	return toPosixPath(path.normalize(value)).replace(/\/+$/, "") || ".";
+}
+function isPathWithinReservedDir(value, reservedDir) {
+	return value === reservedDir || value.startsWith(`${reservedDir}/`);
+}
+function toPosixPath(value) {
+	return value.split(path.sep).join("/");
+}
+function stableStringify(value) {
+	return `${JSON.stringify(value, null, 2)}\n`;
+}
+function readCliVersion() {
+	const startDir = path.dirname(fileURLToPath(import.meta.url));
+	for (const packageJsonPath of candidatePackageJsonPaths(startDir)) try {
+		const packageJson = require(packageJsonPath);
+		if (packageJson.name === "@fluid-app/fluid-cli-portal" && typeof packageJson.version === "string") return packageJson.version;
+	} catch {}
+	return "0.0.0";
+}
+function resolveViteCliPathFromRequire(moduleRequire) {
+	try {
+		const packageJsonPath = moduleRequire.resolve("vite/package.json");
+		const binPath = getViteBinPath(moduleRequire(packageJsonPath).bin);
+		if (!binPath) return void 0;
+		return path.resolve(path.dirname(packageJsonPath), binPath);
+	} catch (err) {
+		if (isModuleResolutionError(err)) return void 0;
+		throw err;
+	}
+}
+function getViteBinPath(bin) {
+	if (typeof bin === "string") return bin;
+	if (!isRecord$2(bin)) return void 0;
+	const viteBin = bin.vite;
+	return typeof viteBin === "string" ? viteBin : void 0;
+}
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNodeError(value) {
+	return typeof value === "object" && value !== null && "code" in value && typeof value.code === "string";
+}
+function isModuleResolutionError(value) {
+	return isNodeError(value) && (value.code === "MODULE_NOT_FOUND" || value.code === "ERR_MODULE_NOT_FOUND");
+}
+function candidatePackageJsonPaths(startDir) {
+	const paths = [];
+	let current = startDir;
+	while (true) {
+		paths.push(path.join(current, "package.json"));
+		const parent = path.dirname(current);
+		if (parent === current) return paths;
+		current = parent;
+	}
+}
+//#endregion
+//#region src/utils/widget-package-upload.ts
+var WidgetPackageUploadError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "WidgetPackageUploadError";
+		this.code = code;
+	}
+};
+const SESSION_ARRAY_KEYS = [
+	"uploads",
+	"artifacts",
+	"signedUploads",
+	"signed_uploads",
+	"signedUrls",
+	"signed_urls",
+	"uploadUrls",
+	"upload_urls"
+];
+const SESSION_RECORD_KEYS = [
+	"signedUrls",
+	"signed_urls",
+	"uploadUrls",
+	"upload_urls"
+];
+function buildWidgetPackageArtifactPayload(artifact) {
+	return {
+		path: artifact.path,
+		sha256: artifact.sha256,
+		bytes: artifact.bytes,
+		contentType: artifact.contentType
+	};
+}
+function buildWidgetPackageUploadSessionPayload(request) {
+	return {
+		version: request.version,
+		package_key: request.packageKey,
+		builder_version: request.builderVersion,
+		cli_version: request.cliVersion,
+		runtime_version: request.runtimeVersion,
+		manifest_hash: request.manifestHash,
+		manifest: request.manifest,
+		artifacts: request.artifacts.map(buildWidgetPackageArtifactPayload)
+	};
+}
+function buildWidgetPackageCompleteUploadPayload(packageKey, artifacts) {
+	return {
+		package_key: packageKey,
+		artifacts: artifacts.map(buildWidgetPackageArtifactPayload)
+	};
+}
+function getWidgetPackageUploadSessionRoute(owner) {
+	switch (owner.kind) {
+		case "droplet": return `/api/droplets/${encodeURIComponent(owner.uuid)}/widget_package_versions`;
+		case "company": return "/api/company/fluid_os/widget_package_versions";
+	}
+}
+function getWidgetPackageCompleteUploadRoute(owner, version) {
+	switch (owner.kind) {
+		case "droplet": return `/api/droplets/${encodeURIComponent(owner.uuid)}/widget_package_versions/${encodeURIComponent(version)}/complete_upload`;
+		case "company": return `/api/company/fluid_os/widget_package_versions/${encodeURIComponent(version)}/complete_upload`;
+	}
+}
+async function requestWidgetPackageUploadSession(client, owner, request) {
+	const payload = buildWidgetPackageUploadSessionPayload(request);
+	try {
+		return normalizeWidgetPackageUploadSession(owner.kind === "company" ? await fluid_os_v0_create_widget_package_version(client, payload) : await client.post(getWidgetPackageUploadSessionRoute(owner), payload), request.version, request.artifacts);
+	} catch (err) {
+		if (err instanceof WidgetPackageUploadError) throw err;
+		throw new WidgetPackageUploadError("SESSION_REQUEST_FAILED", `Failed to create widget package upload session: ${formatUnknownError(err)}`);
+	}
+}
+async function uploadWidgetPackageArtifacts(session, artifacts, fetchImpl = fetch) {
+	const uploadsByPath = new Map(session.uploads.map((upload) => [upload.path, upload]));
+	const results = [];
+	for (const artifact of artifacts) {
+		const upload = uploadsByPath.get(artifact.path);
+		if (!upload) throw new WidgetPackageUploadError("MISSING_SIGNED_URL", `Upload session did not include a signed URL for artifact "${artifact.path}".`);
+		if (upload.contentType !== artifact.contentType) throw new WidgetPackageUploadError("CONTENT_TYPE_MISMATCH", `Upload session expected artifact "${artifact.path}" to use content type "${upload.contentType}", but local artifact uses "${artifact.contentType}".`);
+		let response;
+		try {
+			response = await fetchImpl(upload.url, {
+				method: "PUT",
+				headers: mergeUploadHeaders(upload.headers, upload.contentType),
+				body: artifact.body
+			});
+		} catch (err) {
+			throw new WidgetPackageUploadError("ARTIFACT_UPLOAD_FAILED", `Failed to upload artifact "${artifact.path}": ${formatUnknownError(err)}`);
+		}
+		if (!response.ok) {
+			const body = await response.text().catch(() => "");
+			const details = body.trim() ? `: ${body.trim().slice(0, 500)}` : "";
+			throw new WidgetPackageUploadError("ARTIFACT_UPLOAD_FAILED", `Failed to upload artifact "${artifact.path}": PUT returned HTTP ${response.status}${details}`);
+		}
+		results.push({
+			path: artifact.path,
+			status: response.status,
+			contentType: upload.contentType
+		});
+	}
+	return results;
+}
+async function completeWidgetPackageUpload(client, owner, version, packageKey, artifacts) {
+	const payload = buildWidgetPackageCompleteUploadPayload(packageKey, artifacts);
+	try {
+		return normalizeWidgetPackageCompleteResponse(owner.kind === "company" ? await fluid_os_v0_complete_widget_package_version_upload(client, version, payload) : await client.post(getWidgetPackageCompleteUploadRoute(owner, version), payload), version);
+	} catch (err) {
+		if (err instanceof WidgetPackageUploadError) throw err;
+		throw new WidgetPackageUploadError("COMPLETE_UPLOAD_FAILED", `Failed to complete widget package upload: ${formatUnknownError(err)}`);
+	}
+}
+async function publishWidgetPackageVersion(options) {
+	const sessionPayload = buildWidgetPackageUploadSessionPayload(options.request);
+	if (options.dryRun) return {
+		dryRun: true,
+		sessionPayload
+	};
+	if (!options.client) throw new Error("A FetchClient is required when dryRun is false.");
+	const session = await requestWidgetPackageUploadSession(options.client, options.owner, options.request);
+	return {
+		dryRun: false,
+		sessionPayload,
+		session,
+		uploadedArtifacts: await uploadWidgetPackageArtifacts(session, options.request.artifacts, options.fetchImpl),
+		complete: await completeWidgetPackageUpload(options.client, options.owner, session.version, options.request.packageKey, options.request.artifacts)
+	};
+}
+function normalizeWidgetPackageUploadSession(response, requestedVersion, requestedArtifacts) {
+	const record = requireRecord(response, "Upload session response must be a JSON object.");
+	const responseVersion = getResponseVersion(record);
+	if (responseVersion && responseVersion !== requestedVersion) throw new WidgetPackageUploadError("INVALID_SESSION_RESPONSE", `Upload session response version "${responseVersion}" did not match requested version "${requestedVersion}".`);
+	const version = responseVersion ?? requestedVersion;
+	const nestedRecord = getNestedVersionRecord(record);
+	const uploads = getSignedUploads(nestedRecord ? [record, nestedRecord] : [record], requestedArtifacts);
+	const missingUploadPaths = requestedArtifacts.map((artifact) => artifact.path).filter((artifactPath) => !uploads.some((upload) => upload.path === artifactPath));
+	if (missingUploadPaths.length > 0) throw new WidgetPackageUploadError("INVALID_SESSION_RESPONSE", `Upload session response is missing signed URLs for artifact(s): ${missingUploadPaths.join(", ")}.`);
+	return {
+		version,
+		uploads,
+		raw: response
+	};
+}
+function normalizeWidgetPackageCompleteResponse(response, requestedVersion) {
+	if (response == null) return {
+		version: requestedVersion,
+		raw: response
+	};
+	const record = requireRecord(response, "Complete upload response must be a JSON object or empty response.");
+	const nested = getNestedVersionRecord(record) ?? record;
+	const responseVersion = getResponseVersion(nested);
+	if (responseVersion && responseVersion !== requestedVersion) throw new WidgetPackageUploadError("INVALID_COMPLETE_RESPONSE", `Complete upload response version "${responseVersion}" did not match requested version "${requestedVersion}".`);
+	const packageKey = getStringProperty(nested, "package_key") ?? getStringProperty(nested, "packageKey") ?? getStringProperty(nested, "packageId");
+	const status = getStringProperty(nested, "status") ?? getStringProperty(nested, "state");
+	return {
+		version: responseVersion ?? requestedVersion,
+		...status ? { status } : {},
+		...packageKey ? { packageKey } : {},
+		raw: response
+	};
+}
+function getSignedUploads(records, requestedArtifacts) {
+	const uploads = [];
+	for (const record of records) {
+		for (const key of SESSION_ARRAY_KEYS) {
+			const value = record[key];
+			if (!Array.isArray(value)) continue;
+			for (const item of value) {
+				const upload = signedUploadFromRecord(item, requestedArtifacts);
+				if (upload) uploads.push(upload);
+			}
+		}
+		for (const key of SESSION_RECORD_KEYS) {
+			const value = record[key];
+			if (!isRecord$1(value) || Array.isArray(value)) continue;
+			for (const [artifactPath, uploadValue] of Object.entries(value)) {
+				const upload = signedUploadFromKeyedValue(artifactPath, uploadValue, requestedArtifacts);
+				if (upload) uploads.push(upload);
+			}
+		}
+	}
+	return dedupeUploads(uploads);
+}
+function signedUploadFromRecord(value, requestedArtifacts) {
+	if (!isRecord$1(value)) return null;
+	const artifactPath = readFirstString(value, [
+		"path",
+		"key",
+		"artifactPath",
+		"artifact_path",
+		"artifactKey",
+		"artifact_key",
+		"name"
+	]);
+	const url = readFirstString(value, [
+		"url",
+		"signedUrl",
+		"signed_url",
+		"uploadUrl",
+		"upload_url"
+	]);
+	if (!artifactPath || !url) return null;
+	const requestedArtifact = findRequestedArtifact(requestedArtifacts, artifactPath);
+	const contentType = readFirstString(value, [
+		"contentType",
+		"content_type",
+		"expectedContentType",
+		"expected_content_type"
+	]) ?? requestedArtifact?.contentType;
+	if (!contentType) return null;
+	return {
+		path: artifactPath,
+		url,
+		contentType,
+		headers: getHeaders(value["headers"])
+	};
+}
+function signedUploadFromKeyedValue(artifactPath, value, requestedArtifacts) {
+	const requestedArtifact = findRequestedArtifact(requestedArtifacts, artifactPath);
+	if (typeof value === "string") {
+		if (!requestedArtifact) return null;
+		return {
+			path: artifactPath,
+			url: value,
+			contentType: requestedArtifact.contentType,
+			headers: {}
+		};
+	}
+	if (!isRecord$1(value)) return null;
+	const url = readFirstString(value, [
+		"url",
+		"signedUrl",
+		"signed_url",
+		"uploadUrl",
+		"upload_url"
+	]);
+	if (!url) return null;
+	const contentType = readFirstString(value, [
+		"contentType",
+		"content_type",
+		"expectedContentType",
+		"expected_content_type"
+	]) ?? requestedArtifact?.contentType;
+	if (!contentType) return null;
+	return {
+		path: artifactPath,
+		url,
+		contentType,
+		headers: getHeaders(value["headers"])
+	};
+}
+function normalizeHeaderName(name) {
+	return name.toLowerCase();
+}
+function mergeUploadHeaders(headers, contentType) {
+	const merged = {};
+	for (const [key, value] of Object.entries(headers)) {
+		if (normalizeHeaderName(key) === "content-type") continue;
+		merged[key] = value;
+	}
+	merged["Content-Type"] = contentType;
+	return merged;
+}
+function dedupeUploads(uploads) {
+	const deduped = /* @__PURE__ */ new Map();
+	for (const upload of uploads) deduped.set(upload.path, upload);
+	return Array.from(deduped.values());
+}
+function findRequestedArtifact(requestedArtifacts, artifactPath) {
+	return requestedArtifacts.find((artifact) => artifact.path === artifactPath);
+}
+function requireRecord(value, message) {
+	if (!isRecord$1(value) || Array.isArray(value)) throw new WidgetPackageUploadError("INVALID_RESPONSE", message);
+	return value;
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null;
+}
+function getStringProperty(record, key) {
+	const value = record[key];
+	if (typeof value === "string" && value.trim().length > 0) return value;
+	if (typeof value === "number" && Number.isFinite(value)) return String(value);
+}
+function readFirstString(record, keys) {
+	for (const key of keys) {
+		const value = getStringProperty(record, key);
+		if (value) return value;
+	}
+}
+function getHeaders(value) {
+	if (!isRecord$1(value) || Array.isArray(value)) return {};
+	const headers = {};
+	for (const [key, headerValue] of Object.entries(value)) if (typeof headerValue === "string") headers[key] = headerValue;
+	return headers;
+}
+function getResponseVersion(record) {
+	const directVersion = getStringProperty(record, "version");
+	if (directVersion) return directVersion;
+	const nested = getNestedVersionRecord(record);
+	return nested ? getStringProperty(nested, "version") : void 0;
+}
+function getNestedVersionRecord(record) {
+	const candidates = [
+		record["portal_widget_package_version"],
+		record["widget_package_version"],
+		record["package_version"]
+	];
+	for (const candidate of candidates) if (isRecord$1(candidate) && !Array.isArray(candidate)) return candidate;
+}
+function formatUnknownError(err) {
+	const base = err instanceof Error ? err.message : String(err);
+	if (isRecord$1(err) && "data" in err) return `${base} — ${JSON.stringify(err.data)}`;
+	return base;
+}
+//#endregion
+//#region src/commands/widget-package-publish.ts
+async function publishWidgetRuntimeArtifacts(options, dependencies = {}) {
+	const buildPackage = dependencies.buildSharedWidgetPackage ?? buildSharedWidgetPackage;
+	const publishVersion = dependencies.publishWidgetPackageVersion ?? publishWidgetPackageVersion;
+	const isDryRun = options.dryRun === true;
+	const client = options.client;
+	if (!isDryRun && !client) throw new Error("A FetchClient is required when dryRun is false.");
+	const safeOutDir = validateWidgetPublishOutDir(options.projectDir, options.outDir);
+	const buildResult = await buildPackage({
+		projectDir: options.projectDir,
+		publishDir: safeOutDir,
+		owner: options.buildOwner
+	});
+	if (!buildResult.success) {
+		const details = buildResult.error.details ? `\n${buildResult.error.details}` : "";
+		throw new Error(`${buildResult.error.message}${details}`);
+	}
+	const request = await createWidgetPackagePublishRequest({
+		publishDir: buildResult.value.publishDir,
+		manifestPath: buildResult.value.manifestPath,
+		publishManifestPath: buildResult.value.publishManifestPath,
+		owner: options.buildOwner
+	});
+	let publish;
+	if (isDryRun) publish = await publishVersion({
+		owner: options.uploadOwner,
+		request,
+		dryRun: true
+	});
+	else {
+		if (!client) throw new Error("A FetchClient is required when dryRun is false.");
+		publish = await publishVersion({
+			client,
+			owner: options.uploadOwner,
+			request
+		});
+	}
+	return {
+		build: buildResult.value,
+		request,
+		publish
+	};
+}
+async function createWidgetPackagePublishRequest(options) {
+	const manifestContent = await fs.readFile(options.manifestPath);
+	const manifest = parseJsonRecord(manifestContent.toString("utf-8"), options.manifestPath);
+	const publishManifest = await readPublishManifest(options.publishManifestPath);
+	assertManifestIdentityMatches(manifest, publishManifest, options.manifestPath);
+	assertMetadataMatches({
+		label: "manifestHash",
+		path: "manifest.json",
+		expected: publishManifest.manifestHash,
+		actual: sha256(manifestContent)
+	});
+	const collectedArtifacts = await collectWidgetPackageArtifacts(options.publishDir);
+	assertArtifactInventoryMatches(publishManifest.artifacts, collectedArtifacts);
+	const artifacts = await readUploadArtifacts(options.publishDir, publishManifest.artifacts);
+	return {
+		version: publishManifest.version,
+		packageKey: stripOwnerPrefix(publishManifest.packageId, options.owner),
+		builderVersion: publishManifest.builderVersion,
+		cliVersion: publishManifest.cliVersion,
+		runtimeVersion: publishManifest.runtimeVersion,
+		manifestHash: publishManifest.manifestHash,
+		manifest,
+		artifacts
+	};
+}
+function createAuthenticatedWidgetPackageClient() {
+	const { profile, profileName, token } = resolveAuthenticatedProfile();
+	if (!token) {
+		if (!profileName) throw new Error("Not logged in. Run " + chalk.cyan("fluid login") + " first.");
+		throw new Error("No auth token found for profile " + chalk.cyan(profileName) + ". Run " + chalk.cyan("fluid login") + " to re-authenticate.");
+	}
+	return createFetchClient({
+		baseUrl: profile?.baseUrl ?? process.env["FLUID_API_BASE"] ?? "https://api.fluid.app",
+		getAuthToken: () => token
+	});
+}
+function resolveAuthenticatedProfile() {
+	const config = readConfig();
+	const projectConfig = findProjectConfig(process.cwd());
+	if (projectConfig?.profile) {
+		const profile = config.profiles[projectConfig.profile];
+		if (profile) return {
+			profile,
+			profileName: projectConfig.profile,
+			token: profile.token
+		};
+	}
+	if (!config.activeProfile) return {};
+	const profile = config.profiles[config.activeProfile];
+	if (!profile) return {};
+	return {
+		profile,
+		profileName: config.activeProfile,
+		token: profile.token
+	};
+}
+function printWidgetPublishSummary(options) {
+	console.log();
+	console.log(chalk.green.bold(`${options.title} complete`));
+	console.log();
+	console.log(chalk.gray("Owner:       ") + chalk.white(options.ownerLabel));
+	if (options.environment) console.log(chalk.gray("Environment: ") + chalk.white(options.environment));
+	console.log(chalk.gray("Package:     ") + chalk.white(options.result.build.packageId));
+	console.log(chalk.gray("Version:     ") + chalk.white(options.result.build.version));
+	console.log(chalk.gray("Output:      ") + chalk.cyan(options.outDir));
+	console.log(chalk.gray("Artifacts:   ") + chalk.white(String(options.result.request.artifacts.length)));
+	console.log();
+}
+function printRuntimeOnlyNotice() {
+	console.log(chalk.yellow("This publishes widget runtime artifacts only; it does not deploy the hosted portal shell."));
+	console.log();
+}
+function printDryRunSessionPayload(result) {
+	console.log(chalk.bold("Dry-run upload session payload:"));
+	console.log(JSON.stringify(result.publish.sessionPayload, null, 2));
+	console.log();
+}
+function validateWidgetPublishOutDir(projectDir, outDir) {
+	validateSharedWidgetPackagePublishDir(projectDir, outDir, { optionName: "--out-dir" });
+	return outDir;
+}
+async function readJsonRecord(filePath) {
+	return parseJsonRecord(await fs.readFile(filePath, "utf-8"), filePath);
+}
+function parseJsonRecord(content, filePath) {
+	const value = JSON.parse(content);
+	if (!isRecord(value) || Array.isArray(value)) throw new Error(`${path.basename(filePath)} must contain a JSON object.`);
+	return value;
+}
+async function readPublishManifest(filePath) {
+	const record = await readJsonRecord(filePath);
+	const artifactsValue = record["artifacts"];
+	if (!Array.isArray(artifactsValue)) throw new Error("publish-manifest.json must include an artifacts array.");
+	return {
+		packageId: readRequiredString(record, "packageId", filePath),
+		version: readRequiredString(record, "version", filePath),
+		builderVersion: readRequiredString(record, "builderVersion", filePath),
+		cliVersion: readRequiredString(record, "cliVersion", filePath),
+		runtimeVersion: readRequiredString(record, "runtimeVersion", filePath),
+		manifestHash: readRequiredString(record, "manifestHash", filePath),
+		artifacts: artifactsValue.map((artifact, index) => readArtifactMetadata(artifact, index))
+	};
+}
+function readArtifactMetadata(value, index) {
+	if (!isRecord(value) || Array.isArray(value)) throw new Error(`publish-manifest.json artifacts[${index}] must be a JSON object.`);
+	return {
+		path: readRequiredString(value, "path", "publish-manifest.json"),
+		sha256: readRequiredString(value, "sha256", "publish-manifest.json"),
+		bytes: readRequiredNumber(value, "bytes", "publish-manifest.json"),
+		contentType: readRequiredString(value, "contentType", "publish-manifest.json")
+	};
+}
+async function readUploadArtifacts(publishDir, artifacts) {
+	const resolvedPublishDir = path.resolve(publishDir);
+	return Promise.all(artifacts.map(async (artifact) => {
+		const artifactPath = resolveArtifactPath(resolvedPublishDir, artifact.path);
+		const actual = await computeArtifactMetadata(artifactPath, resolvedPublishDir);
+		assertArtifactMetadataMatches(artifact, actual);
+		return {
+			...actual,
+			body: await fs.readFile(artifactPath)
+		};
+	}));
+}
+function assertManifestIdentityMatches(manifest, publishManifest, manifestPath) {
+	assertMetadataMatches({
+		label: "packageId",
+		path: "manifest.json",
+		expected: publishManifest.packageId,
+		actual: readRequiredString(manifest, "packageId", manifestPath)
+	});
+	assertMetadataMatches({
+		label: "version",
+		path: "manifest.json",
+		expected: publishManifest.version,
+		actual: readRequiredString(manifest, "version", manifestPath)
+	});
+}
+function assertArtifactInventoryMatches(expected, actual) {
+	const expectedByPath = /* @__PURE__ */ new Map();
+	for (const artifact of expected) {
+		if (expectedByPath.has(artifact.path)) throw new Error(`publish-manifest.json artifacts include duplicate path ${JSON.stringify(artifact.path)}. Rebuild the widget package before publishing.`);
+		expectedByPath.set(artifact.path, artifact);
+	}
+	const actualPaths = /* @__PURE__ */ new Set();
+	for (const actualArtifact of actual) {
+		actualPaths.add(actualArtifact.path);
+		const expectedArtifact = expectedByPath.get(actualArtifact.path);
+		if (!expectedArtifact) throw new Error(`publish-manifest.json artifacts omit ${JSON.stringify(actualArtifact.path)}. Rebuild the widget package before publishing.`);
+		assertArtifactMetadataMatches(expectedArtifact, actualArtifact);
+	}
+	for (const expectedArtifact of expected) {
+		if (actualPaths.has(expectedArtifact.path)) continue;
+		throw new Error(`publish-manifest.json artifacts include ${JSON.stringify(expectedArtifact.path)}, but that file is not present on disk. Rebuild the widget package before publishing.`);
+	}
+}
+function assertArtifactMetadataMatches(expected, actual) {
+	assertMetadataMatches({
+		label: "path",
+		path: expected.path,
+		expected: expected.path,
+		actual: actual.path
+	});
+	assertMetadataMatches({
+		label: "sha256",
+		path: expected.path,
+		expected: expected.sha256,
+		actual: actual.sha256
+	});
+	assertMetadataMatches({
+		label: "bytes",
+		path: expected.path,
+		expected: expected.bytes,
+		actual: actual.bytes
+	});
+	assertMetadataMatches({
+		label: "contentType",
+		path: expected.path,
+		expected: expected.contentType,
+		actual: actual.contentType
+	});
+}
+function assertMetadataMatches(options) {
+	if (options.expected === options.actual) return;
+	throw new Error(`publish-manifest.json ${options.label} for ${JSON.stringify(options.path)} does not match the file on disk. Recorded ${JSON.stringify(options.expected)}, computed ${JSON.stringify(options.actual)}. Rebuild the widget package before publishing.`);
+}
+function resolveArtifactPath(publishDir, artifactPath) {
+	const resolved = path.resolve(publishDir, artifactPath);
+	const relative = path.relative(publishDir, resolved);
+	if (relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`Artifact path ${JSON.stringify(artifactPath)} escapes the publish directory.`);
+	return resolved;
+}
+function stripOwnerPrefix(packageId, owner) {
+	const prefix = `${owner}.`;
+	if (packageId.startsWith(prefix) && packageId.length > prefix.length) return packageId.slice(prefix.length);
+	return packageId;
+}
+function readRequiredString(record, key, filePath) {
+	const value = record[key];
+	if (typeof value === "string" && value.trim().length > 0) return value;
+	throw new Error(`${path.basename(filePath)} must include string ${key}.`);
+}
+function readRequiredNumber(record, key, filePath) {
+	const value = record[key];
+	if (typeof value === "number" && Number.isFinite(value)) return value;
+	throw new Error(`${path.basename(filePath)} must include number ${key}.`);
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null;
+}
+//#endregion
+//#region src/commands/deploy.ts
+const DEFAULT_OUT_DIR$1 = ".fluid/widget-dist";
+const DEFAULT_ENVIRONMENT = "production";
+const deployCommand = new Command("deploy").description("Publish company-owned portal widget runtime artifacts").option("-e, --environment <name>", "Target environment label for output reporting", DEFAULT_ENVIRONMENT).option("-o, --out-dir <dir>", "Widget artifact output directory", DEFAULT_OUT_DIR$1).option("--dry-run", "Build and validate upload payload without publishing").action(async (options) => {
+	const environment = options.environment ?? DEFAULT_ENVIRONMENT;
+	const outDir = options.outDir ?? DEFAULT_OUT_DIR$1;
+	const dryRun = options.dryRun === true;
+	console.log();
+	console.log(chalk.blue.bold("Fluid Portal Deploy"));
+	console.log();
+	printRuntimeOnlyNotice();
+	console.log(chalk.gray("Environment: ") + chalk.white(environment));
+	console.log(chalk.gray("Output:      ") + chalk.cyan(outDir));
+	if (dryRun) console.log(chalk.yellow("Dry run: no upload will be created."));
+	console.log();
+	const spinner = ora("Building company-owned widget package...").start();
+	try {
+		const result = await publishWidgetRuntimeArtifacts({
+			projectDir: process.cwd(),
+			outDir,
+			buildOwner: "company",
+			uploadOwner: { kind: "company" },
+			dryRun,
+			...dryRun ? {} : { client: createAuthenticatedWidgetPackageClient() }
+		});
+		spinner.succeed("Built widget runtime artifacts");
+		if (dryRun) {
+			console.log(chalk.yellow("Dry run complete — upload session was not requested."));
+			console.log();
+			printDryRunSessionPayload(result);
+		} else console.log(chalk.green("Published widget package version."));
+		printWidgetPublishSummary({
+			title: dryRun ? "Portal deploy dry run" : "Portal deploy",
+			ownerLabel: "company",
+			environment,
+			outDir,
+			result
+		});
+	} catch (err) {
+		spinner.fail("Portal deploy failed");
+		console.error(chalk.red("Error:") + " " + (err instanceof Error ? err.message : String(err)));
+		process.exit(1);
+	}
+});
+//#endregion
 //#region src/commands/doctor.ts
 /** Files that are managed by the SDK and should match the canonical template. */
 const INFRASTRUCTURE_FILES = [
@@ -2004,7 +3858,7 @@ const createVersionCommand = new Command("create").description("Create a new ver
 	console.log(chalk.bold("Creating version..."));
 	let result;
 	try {
-		result = await createFluidOSVersion(client, definitionId);
+		result = await fluid_os_v0_create_fluid_osversion(client, definitionId);
 	} catch (err) {
 		console.error(chalk.red("Error:") + " Failed to create version — " + (err instanceof Error ? err.message : String(err)));
 		process.exit(1);
@@ -2022,7 +3876,7 @@ const createVersionCommand = new Command("create").description("Create a new ver
 	if (options.activate) {
 		console.log("Activating version...");
 		try {
-			await updateFluidOSVersion(client, definitionId, version.id, { version: { active: true } });
+			await fluid_os_v0_update_fluid_osversion(client, definitionId, version.id, { version: { active: true } });
 		} catch (err) {
 			console.error(chalk.red("Error:") + " Failed to activate version — " + (err instanceof Error ? err.message : String(err)));
 			process.exit(1);
@@ -2037,7 +3891,7 @@ const listVersionCommand = new Command("list").description("List all versions of
 	const definitionId = await requireDefinitionId();
 	let result;
 	try {
-		result = await listFluidOSVersions(client, definitionId);
+		result = await fluid_os_v0_list_fluid_osversions(client, definitionId);
 	} catch (err) {
 		console.error(chalk.red("Error:") + " Failed to list versions — " + (err instanceof Error ? err.message : String(err)));
 		process.exit(1);
@@ -2080,7 +3934,7 @@ const activateVersionCommand = new Command("activate").description("Activate a s
 	console.log();
 	console.log(chalk.bold("Activating version..."));
 	try {
-		await updateFluidOSVersion(client, definitionId, versionId, { version: { active: true } });
+		await fluid_os_v0_update_fluid_osversion(client, definitionId, versionId, { version: { active: true } });
 	} catch (err) {
 		console.error(chalk.red("Error:") + " Failed to activate version — " + (err instanceof Error ? err.message : String(err)));
 		process.exit(1);
@@ -2091,6 +3945,52 @@ const activateVersionCommand = new Command("activate").description("Activate a s
 });
 const versionCommand = new Command("version").description("Manage portal definition versions").addCommand(createVersionCommand).addCommand(listVersionCommand).addCommand(activateVersionCommand);
 //#endregion
+//#region src/commands/widget-publish.ts
+const DEFAULT_OUT_DIR = ".fluid/widget-dist";
+const publishSubcommand = new Command("publish").description("Publish droplet-owned widget runtime artifacts").requiredOption("--droplet <uuid>", "Droplet UUID that owns the widget package").option("-o, --out-dir <dir>", "Widget artifact output directory", DEFAULT_OUT_DIR).option("--dry-run", "Build and validate upload payload without publishing").action(async (options) => {
+	const outDir = options.outDir ?? DEFAULT_OUT_DIR;
+	const dryRun = options.dryRun === true;
+	console.log();
+	console.log(chalk.blue.bold("Fluid Widget Publish"));
+	console.log();
+	printRuntimeOnlyNotice();
+	console.log(chalk.gray("Droplet: ") + chalk.white(options.droplet));
+	console.log(chalk.gray("Output:  ") + chalk.cyan(outDir));
+	if (dryRun) console.log(chalk.yellow("Dry run: no upload will be created."));
+	console.log();
+	const spinner = ora("Building droplet-owned widget package...").start();
+	try {
+		const result = await publishWidgetRuntimeArtifacts({
+			projectDir: process.cwd(),
+			outDir,
+			buildOwner: "droplet",
+			uploadOwner: {
+				kind: "droplet",
+				uuid: options.droplet
+			},
+			dryRun,
+			...dryRun ? {} : { client: createAuthenticatedWidgetPackageClient() }
+		});
+		spinner.succeed("Built widget runtime artifacts");
+		if (dryRun) {
+			console.log(chalk.yellow("Dry run complete — upload session was not requested."));
+			console.log();
+			printDryRunSessionPayload(result);
+		} else console.log(chalk.green("Published widget package version."));
+		printWidgetPublishSummary({
+			title: dryRun ? "Widget publish dry run" : "Widget publish",
+			ownerLabel: `droplet ${options.droplet}`,
+			outDir,
+			result
+		});
+	} catch (err) {
+		spinner.fail("Widget publish failed");
+		console.error(chalk.red("Error:") + " " + (err instanceof Error ? err.message : String(err)));
+		process.exit(1);
+	}
+});
+const topLevelWidgetCommand = new Command("widget").description("Publish Fluid widget packages").addCommand(publishSubcommand);
+//#endregion
 //#region src/index.ts
 /**
 * @fluid-app/fluid-cli-portal
@@ -2108,6 +4008,7 @@ const plugin = {
 		portal.addCommand(buildCommand);
 		portal.addCommand(pullCommand);
 		portal.addCommand(pushCommand);
+		portal.addCommand(deployCommand);
 		portal.addCommand(widgetCommand);
 		portal.addCommand(doctorCommand);
 		portal.addCommand(versionCommand);
@@ -2115,6 +4016,6 @@ const plugin = {
 	}
 };
 //#endregion
-export { FILE_SYSTEM_ERRORS, TEMPLATES, buildIdToSlugMap, buildNavigationIdToSlugMap, buildSnapshot, buildThemeIdToSlugMap, categorizeChanges, computeFileHash, copyTemplate, copyTemplateSafe, createCommand, createDirectory, createDirectorySafe, plugin as default, deriveScreenSlug, deriveSlug, diffAgainstSnapshot, directoryExists, doctorCommand, fileExists, getCoreVersion, getInstallCommand, getRunCommand, getSdkVersion, getSdkVersionSafe, getTemplatePaths, installDependencies, pathExists, promptProjectConfig, pullCommand, pushCommand, readFileSafe, readMappings, readSnapshot, removeMapping, resolveIdToSlug, resolveSlugToId, runPackageManager, slugFromPath, transformNavigation, transformNavigationItems, transformProfile, transformScreen, transformTheme, updateMapping, validateCrossReferences, versionCommand, widgetCommand, writeFileSafe, writeMappings, writeSnapshot };
+export { FILE_SYSTEM_ERRORS, TEMPLATES, WIDGET_PACKAGE_BUILDER_VERSION, WidgetPackageUploadError, buildIdToSlugMap, buildNavigationIdToSlugMap, buildSharedWidgetPackage, buildSnapshot, buildThemeIdToSlugMap, buildWidgetPackageCompleteUploadPayload, buildWidgetPackageDescriptor, buildWidgetPackageUploadSessionPayload, categorizeChanges, collectWidgetPackageArtifacts, completeWidgetPackageUpload, computeArtifactMetadata, computeFileHash, copyTemplate, copyTemplateSafe, createAuthenticatedWidgetPackageClient, createCommand, createDirectory, createDirectorySafe, createPublishManifestMetadata, createWidgetPackageEntrySource, createWidgetPackagePublishRequest, plugin as default, deployCommand, deriveScreenSlug, deriveSlug, diffAgainstSnapshot, directoryExists, doctorCommand, fileExists, getArtifactContentType, getInstallCommand, getRunCommand, getSdkVersion, getSdkVersionSafe, getTemplatePaths, getWidgetPackageCompleteUploadRoute, getWidgetPackageUploadSessionRoute, installDependencies, loadSourceWidgetPackages, normalizeWidgetPackageCompleteResponse, normalizeWidgetPackageUploadSession, pathExists, printDryRunSessionPayload, printRuntimeOnlyNotice, printWidgetPublishSummary, promptProjectConfig, publishWidgetPackageVersion, publishWidgetRuntimeArtifacts, pullCommand, pushCommand, readFileSafe, readMappings, readSnapshot, removeMapping, requestWidgetPackageUploadSession, resolveIdToSlug, resolvePortalWidgetSourceConfig, resolveSlugToId, runPackageManager, sha256, slugFromPath, topLevelWidgetCommand, transformNavigation, transformNavigationItems, transformProfile, transformScreen, transformTheme, updateMapping, uploadWidgetPackageArtifacts, validateCrossReferences, validateSingleSourceWidgetPackage, validateWidgetPublishOutDir, versionCommand, widgetCommand, writeFileSafe, writeMappings, writeSnapshot };
 
 //# sourceMappingURL=index.mjs.map