@fluid-app/fluid-cli-portal 0.1.37 → 0.1.39

package/dist/index.mjs

@@ -1,16 +1,17 @@
-import { A as fluid_os_v0_create_fluid_osversion, B as fluid_os_v0_update_fluid_osnavigation_item, C as writeMappings, D as fluid_os_v0_create_fluid_osprofile, E as fluid_os_v0_create_fluid_osnavigation_item, F as fluid_os_v0_delete_fluid_osscreen, G as createFetchClient, H as fluid_os_v0_update_fluid_osscreen, I as fluid_os_v0_delete_fluid_ostheme, L as fluid_os_v0_list_fluid_osnavigation_items, M as fluid_os_v0_delete_fluid_osnavigation, N as fluid_os_v0_delete_fluid_osnavigation_item, O as fluid_os_v0_create_fluid_osscreen, P as fluid_os_v0_delete_fluid_osprofile, R as fluid_os_v0_list_fluid_osversions, S as updateMapping, T as fluid_os_v0_create_fluid_osnavigation, U as fluid_os_v0_update_fluid_ostheme, V as fluid_os_v0_update_fluid_osprofile, W as fluid_os_v0_update_fluid_osversion, _ as deriveSlug, a as buildThemeIdToSlugMap, b as resolveIdToSlug, c as transformNavigationItems, d as transformTheme, f as buildSnapshot, g as writeSnapshot, h as readSnapshot, i as buildNavigationIdToSlugMap, j as fluid_os_v0_create_widget_package_version, k as fluid_os_v0_create_fluid_ostheme, l as transformProfile, m as diffAgainstSnapshot, o as deriveScreenSlug, p as computeFileHash, r as buildIdToSlugMap, s as transformNavigation, t as pullCommand, u as transformScreen, v as readMappings, w as fluid_os_v0_complete_widget_package_version_upload, x as resolveSlugToId, y as removeMapping, z as fluid_os_v0_update_fluid_osnavigation } from "./pull-zrTaJuSb.mjs";
+import { A as fluid_os_v0_create_fluid_osversion, B as fluid_os_v0_update_fluid_osnavigation, C as writeMappings, D as fluid_os_v0_create_fluid_osprofile, E as fluid_os_v0_create_fluid_osnavigation_item, F as fluid_os_v0_delete_fluid_osscreen, G as fluid_os_v0_update_fluid_osversion, H as fluid_os_v0_update_fluid_osprofile, I as fluid_os_v0_delete_fluid_ostheme, K as createFetchClient, L as fluid_os_v0_list_fluid_osdefinitions, M as fluid_os_v0_delete_fluid_osnavigation, N as fluid_os_v0_delete_fluid_osnavigation_item, O as fluid_os_v0_create_fluid_osscreen, P as fluid_os_v0_delete_fluid_osprofile, R as fluid_os_v0_list_fluid_osnavigation_items, S as updateMapping, T as fluid_os_v0_create_fluid_osnavigation, U as fluid_os_v0_update_fluid_osscreen, V as fluid_os_v0_update_fluid_osnavigation_item, W as fluid_os_v0_update_fluid_ostheme, _ as deriveSlug, a as buildThemeIdToSlugMap, b as resolveIdToSlug, c as transformNavigationItems, d as transformTheme, f as buildSnapshot, g as writeSnapshot, h as readSnapshot, i as buildNavigationIdToSlugMap, j as fluid_os_v0_create_widget_package_version, k as fluid_os_v0_create_fluid_ostheme, l as transformProfile, m as diffAgainstSnapshot, o as deriveScreenSlug, p as computeFileHash, r as buildIdToSlugMap, s as transformNavigation, t as pullCommand, u as transformScreen, v as readMappings, w as fluid_os_v0_complete_widget_package_version_upload, x as resolveSlugToId, y as removeMapping, z as fluid_os_v0_list_fluid_osversions } from "./pull-CG5dELOX.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
 import chalk from "chalk";
 import ora from "ora";
 import path, { basename, dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { copyFile, mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
+import { copyFile, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { failure, findProjectConfig, getActiveProfile, getAuthToken, listProfileNames, readConfig, success } from "@fluid-app/fluid-cli";
 import prompts from "prompts";
-import { existsSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import Handlebars from "handlebars";
 import { execa } from "execa";
+import os from "node:os";
 import fs from "fs-extra";
 import path$1 from "path";
 import { createHash } from "node:crypto";
@@ -404,8 +405,583 @@ async function installDependencies(cwd) {
 	await runPackageManager(["install"], cwd);
 }
 //#endregion
+//#region src/lib/git.ts
+/**
+* Git wrapper for the portal CLI — shells out to the system `git` via
+* execa. We deliberately do NOT bundle git or use a pure-JS impl; users
+* are expected to have it installed (the same stance as `fluid mist`).
+*
+* Security: a token-bearing `remote_url` (minted by the portal
+* `git_credential` endpoint) must never be logged, persisted, *or*
+* exposed in the process table. The token is stripped from the URL and
+* handed to git through a GIT_ASKPASS script via env vars
+* (FLUID_PORTAL_GIT_USER / FLUID_PORTAL_GIT_PASS) — so it never appears
+* in argv (visible to `ps aux` / `/proc/<pid>/cmdline`) and is never
+* written to `.git/config`.
+*
+* This mirrors `packages/cli/mist/src/lib/git.ts`. Kept portal-local for
+* now; if the widget/mist tracks extract a shared git lib we should
+* consume it instead (see overnight/track2-portal.md).
+*/
+var GitError = class extends Error {
+	exitCode;
+	constructor(message, exitCode = 1) {
+		super(message);
+		this.name = "GitError";
+		this.exitCode = exitCode;
+	}
+};
+/**
+* execa throws ENOENT when the git binary itself is missing — the single
+* most common failure on non-developer machines. Translate it into an
+* actionable message. Returns null for every other failure so call sites
+* keep their specific messages.
+*/
+function gitMissingError(err) {
+	if (err?.code !== "ENOENT") return null;
+	return new GitError("Git isn't installed (or isn't on your PATH), so this command can't run.\n  Install it, then try again:\n    macOS:   xcode-select --install   (or `brew install git`)\n    Windows: https://git-scm.com/download/win\n    Linux:   use your package manager, e.g. `apt install git`", 127);
+}
+/**
+* Is `git` available on this machine? Cheap, never throws — used to
+* decide whether to take the GitHub-template path or fall back to the
+* bundled scaffold.
+*/
+async function isGitAvailable() {
+	try {
+		await execa("git", ["--version"]);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** Confirm git is installed, throwing the friendly message otherwise. */
+async function ensureGitAvailable() {
+	if (!await isGitAvailable()) throw new GitError("Git isn't installed (or isn't on your PATH), so this command can't run.\n  Install it from https://git-scm.com/downloads (or `brew install git`), then try again.");
+}
+/**
+* Split a token-bearing remote URL into the userless URL + creds. Keeps
+* the token off git's argv: we pass `cleanUrl` to git and feed
+* `username` / `password` back through GIT_ASKPASS env vars.
+*
+* If the URL has no embedded credentials, returns empty strings — fine
+* for public repos where git won't invoke askpass at all.
+*/
+function splitRemoteCredentials(remoteUrl) {
+	const u = new URL(remoteUrl);
+	const username = decodeURIComponent(u.username);
+	const password = decodeURIComponent(u.password);
+	u.username = "";
+	u.password = "";
+	return {
+		cleanUrl: u.toString(),
+		username,
+		password
+	};
+}
+/**
+* Write a stub GIT_ASKPASS shell script to a per-process tmpdir and
+* return its path. The script contains no secret — it echoes back
+* whichever env var (FLUID_PORTAL_GIT_USER / FLUID_PORTAL_GIT_PASS)
+* matches git's prompt. The credentials only live in the spawned git
+* process's env for the duration of the call.
+*
+* One POSIX script for all platforms: Git for Windows executes
+* GIT_ASKPASS through its bundled sh, so a plain sh script works
+* everywhere. Idempotent: subsequent calls reuse the same path.
+*/
+let askpassPath = null;
+function ensureAskpassScript() {
+	if (askpassPath && existsSync(askpassPath)) return askpassPath;
+	const dir = path.join(os.tmpdir(), `fluid-portal-askpass-${process.pid}`);
+	if (!existsSync(dir)) mkdirSync(dir, {
+		recursive: true,
+		mode: 448
+	});
+	const p = path.join(dir, "askpass.sh");
+	writeFileSync(p, `#!/bin/sh\ncase "$1" in\n  Username*) printf '%s' "$FLUID_PORTAL_GIT_USER" ;;\n  *) printf '%s' "$FLUID_PORTAL_GIT_PASS" ;;\nesac\n`, { mode: 448 });
+	chmodSync(p, 448);
+	askpassPath = p;
+	return askpassPath;
+}
+/**
+* Build the spawn env + cleaned URL for a credentialed git invocation.
+*   - `cleanUrl`: URL with userinfo stripped — safe to pass as argv.
+*   - `env`: parent env plus GIT_ASKPASS + FLUID_PORTAL_GIT_USER/PASS.
+*     GIT_TERMINAL_PROMPT=0 prevents the TTY-prompt fallback if the
+*     credentials are empty (auth should fail fast, not hang).
+*/
+function gitAuthSpawn(remoteUrl) {
+	const { cleanUrl, username, password } = splitRemoteCredentials(remoteUrl);
+	return {
+		cleanUrl,
+		env: {
+			...process.env,
+			GIT_ASKPASS: ensureAskpassScript(),
+			GIT_TERMINAL_PROMPT: "0",
+			FLUID_PORTAL_GIT_USER: username,
+			FLUID_PORTAL_GIT_PASS: password
+		}
+	};
+}
+/** Map an execa failure to a GitError, preferring the friendly
+*  git-missing message when the binary itself is absent. */
+function toGitError(err, verb) {
+	const missing = gitMissingError(err);
+	if (missing) return missing;
+	const e = err;
+	return new GitError(`git ${verb} failed${e.exitCode != null ? ` (exit ${e.exitCode})` : ""}`, e.exitCode ?? 1);
+}
+/**
+* `git clone <cleanUrl> <targetDir>`. When `remoteUrl` carries a token,
+* gitAuthSpawn strips it from the URL and re-injects it via GIT_ASKPASS
+* so it never appears in argv. `credential.helper=` stops git from
+* caching what askpass returned to any system credential store.
+*
+* `depth` shallow-clones (used by the create flow, which discards `.git`
+* afterwards anyway).
+*/
+async function gitClone(remoteUrl, targetDir, opts = {}) {
+	const { cleanUrl, env } = gitAuthSpawn(remoteUrl);
+	const depthArgs = opts.depth ? ["--depth", String(opts.depth)] : [];
+	try {
+		await execa("git", [
+			"-c",
+			"credential.helper=",
+			"clone",
+			"--quiet",
+			...depthArgs,
+			cleanUrl,
+			targetDir
+		], {
+			env,
+			stdio: [
+				"ignore",
+				"inherit",
+				"inherit"
+			]
+		});
+	} catch (err) {
+		throw toGitError(err, "clone");
+	}
+}
+/** Initialize a fresh repo (used after scaffolding so the project is
+*  git-ready). Best-effort: never throws — a scaffold without a repo is
+*  still usable, and a missing git binary is handled by the caller. */
+async function gitInit(cwd) {
+	try {
+		await execa("git", ["init", "--quiet"], { cwd });
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** Is `cwd` inside a git work tree? Cheap, never throws. */
+async function isGitRepo(cwd) {
+	try {
+		const { stdout } = await execa("git", ["rev-parse", "--is-inside-work-tree"], { cwd });
+		return stdout.trim() === "true";
+	} catch {
+		return false;
+	}
+}
+/** Read `git remote get-url origin` (or null if no origin / not a repo). */
+async function getOriginUrl(cwd) {
+	try {
+		const { stdout } = await execa("git", [
+			"remote",
+			"get-url",
+			"origin"
+		], { cwd });
+		return stdout.trim();
+	} catch {
+		return null;
+	}
+}
+/**
+* Are there uncommitted changes (working tree or index)? `git status
+* --porcelain` is empty when clean. Returns false (never throws) when
+* `cwd` isn't a repo.
+*/
+async function hasUncommittedChanges(cwd) {
+	try {
+		const { stdout } = await execa("git", ["status", "--porcelain"], { cwd });
+		return stdout.trim().length > 0;
+	} catch {
+		return false;
+	}
+}
+/**
+* Fetch `branch` from a token-bearing remote URL, writing FETCH_HEAD so
+* `gitAheadBehindVsFetchHead` is meaningful. Token comes through
+* GIT_ASKPASS, never argv or `.git/config`.
+*/
+async function gitFetch(cwd, remoteUrl, branch = "main") {
+	const { cleanUrl, env } = gitAuthSpawn(remoteUrl);
+	try {
+		await execa("git", [
+			"-c",
+			"credential.helper=",
+			"fetch",
+			"--quiet",
+			cleanUrl,
+			branch
+		], {
+			cwd,
+			env
+		});
+	} catch (err) {
+		throw toGitError(err, "fetch");
+	}
+}
+/**
+* Count commits in local HEAD vs FETCH_HEAD (after `gitFetch`). Returns
+* `{ahead, behind}`. `0/0` means "in sync" (or no FETCH_HEAD yet).
+*/
+async function gitAheadBehindVsFetchHead(cwd) {
+	try {
+		const { stdout } = await execa("git", [
+			"rev-list",
+			"--left-right",
+			"--count",
+			"HEAD...FETCH_HEAD"
+		], { cwd });
+		const [a, b] = stdout.trim().split(/\s+/);
+		const ahead = Number.parseInt(a ?? "0", 10);
+		const behind = Number.parseInt(b ?? "0", 10);
+		return {
+			ahead: Number.isFinite(ahead) ? ahead : 0,
+			behind: Number.isFinite(behind) ? behind : 0
+		};
+	} catch {
+		return {
+			ahead: 0,
+			behind: 0
+		};
+	}
+}
+/** Does `cwd` have any commits yet? (false right after `git init`.) */
+async function hasCommits(cwd) {
+	try {
+		await execa("git", [
+			"rev-parse",
+			"--verify",
+			"HEAD"
+		], { cwd });
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Does `branch` exist on the remote? Throws on transport/auth failure so
+* a network blip is never mistaken for an empty remote (which would skip
+* drift detection). Token via GIT_ASKPASS, never argv or .git/config.
+*/
+async function gitRemoteBranchExists(cwd, remoteUrl, branch = "main") {
+	const { cleanUrl, env } = gitAuthSpawn(remoteUrl);
+	try {
+		const { stdout } = await execa("git", [
+			"-c",
+			"credential.helper=",
+			"ls-remote",
+			"--heads",
+			cleanUrl,
+			`refs/heads/${branch}`
+		], {
+			cwd,
+			env
+		});
+		return stdout.trim().length > 0;
+	} catch (err) {
+		throw toGitError(err, "ls-remote");
+	}
+}
+/**
+* Adopt `FETCH_HEAD` as the current (unborn) branch's base: point the
+* branch ref at it and load its tree into the index, leaving the working
+* tree untouched. The next auto-commit then records the local project
+* tree as a child of the remote history — local files win, remote-only
+* files are recorded as deletions — so the push fast-forwards instead of
+* being rejected for unrelated history. Only call when `hasCommits` is
+* false; with local commits it would silently rewrite the branch ref.
+* Mirrors the widget CLI's first-push adoption (the backend provisions
+* repos with an auto-init/template commit, so a fresh root commit is
+* always unrelated history).
+*
+* Returns the number of remote commits adopted.
+*/
+async function gitAdoptFetchHead(cwd) {
+	try {
+		await execa("git", [
+			"reset",
+			"--mixed",
+			"FETCH_HEAD"
+		], { cwd });
+		const { stdout } = await execa("git", [
+			"rev-list",
+			"--count",
+			"FETCH_HEAD"
+		], { cwd });
+		const count = Number.parseInt(stdout.trim(), 10);
+		return Number.isFinite(count) ? count : 0;
+	} catch (err) {
+		throw toGitError(err, "adopt remote history");
+	}
+}
+/**
+* Normalize a git remote URL to `host/owner/repo` for identity
+* comparison — strips credentials, protocol, `.git`, and trailing
+* slashes so a token-bearing minted URL compares equal to the stored
+* origin. Returns null when the URL doesn't parse.
+*/
+function normalizedRepoIdentity(remoteUrl) {
+	const scp = remoteUrl.match(/^(?:[^@/\s]+@)?([^:/\s]+):([^/].*)$/);
+	if (scp?.[1] && scp[2] && !remoteUrl.includes("://")) {
+		const path = scp[2].replace(/\.git$/, "").replace(/\/+$/, "");
+		return `${scp[1]}/${path}`.toLowerCase();
+	}
+	if (remoteUrl.startsWith("/") || remoteUrl.startsWith(".")) return remoteUrl.replace(/\.git$/, "").replace(/\/+$/, "").toLowerCase();
+	try {
+		const u = new URL(remoteUrl);
+		const path = u.pathname.replace(/\.git$/, "").replace(/\/+$/, "").replace(/^\/+/, "");
+		return `${u.host}/${path}`.toLowerCase();
+	} catch {
+		return null;
+	}
+}
+/**
+* Do HEAD and FETCH_HEAD share any common ancestor? False for unrelated
+* histories — the guard that keeps a whole-tree auto-commit of the WRONG
+* repository from being pushed to a portal's remote. Never throws.
+*/
+async function hasCommonAncestorWithFetchHead(cwd) {
+	try {
+		await execa("git", [
+			"merge-base",
+			"HEAD",
+			"FETCH_HEAD"
+		], { cwd });
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** Fast-forward HEAD to FETCH_HEAD. Fails (non-zero exit) if not
+*  fast-forwardable — callers check the ahead-count first. */
+async function gitMergeFastForward(cwd) {
+	try {
+		await execa("git", [
+			"merge",
+			"--ff-only",
+			"FETCH_HEAD"
+		], { cwd });
+	} catch (err) {
+		throw toGitError(err, "fast-forward merge");
+	}
+}
+/**
+* `git add -A && git commit -m <message>`.
+*
+* `git add -A` intentionally stages the whole work tree: a portal's
+* provisioned repo tracks the entire project (it's seeded from the
+* starter template), and the "publish my changes" UX expects every edit
+* to ship — the same stance as `fluid mist push`. The exclusion boundary
+* is the project's `.gitignore` (the starter ignores `.env`,
+* `node_modules/`, `dist/`, `.portal-sync/`, logs, `*.tsbuildinfo`), so
+* generated output and local secrets stay out of the commit.
+*
+* Uses the repo's configured identity, else a synthetic Fluid bot
+* identity so the commit isn't rejected. "nothing to commit" is treated
+* as a no-op, not an error.
+*/
+async function gitAutoCommit(cwd, message) {
+	try {
+		await execa("git", ["add", "-A"], { cwd });
+	} catch (err) {
+		throw toGitError(err, "add");
+	}
+	let hasName = false;
+	let hasEmail = false;
+	try {
+		hasName = (await execa("git", ["config", "user.name"], { cwd })).stdout.trim().length > 0;
+	} catch {}
+	try {
+		hasEmail = (await execa("git", ["config", "user.email"], { cwd })).stdout.trim().length > 0;
+	} catch {}
+	const identityArgs = [...hasName ? [] : ["-c", "user.name=Fluid Portal CLI"], ...hasEmail ? [] : ["-c", "user.email=portal@fluid.app"]];
+	try {
+		await execa("git", [
+			...identityArgs,
+			"commit",
+			"-m",
+			message
+		], {
+			cwd,
+			stdio: [
+				"ignore",
+				"inherit",
+				"pipe"
+			]
+		});
+	} catch (err) {
+		const missing = gitMissingError(err);
+		if (missing) throw missing;
+		const e = err;
+		const streams = `${typeof e.stdout === "string" ? e.stdout : ""}\n${typeof e.stderr === "string" ? e.stderr : ""}`;
+		if (/nothing to commit/i.test(streams)) return;
+		throw toGitError(err, "commit");
+	}
+}
+/**
+* `git push <cleanUrl> HEAD:<branch>` — credentials supplied via
+* GIT_ASKPASS, never argv. `http.…/.extraheader=` clears any cached
+* Authorization header a CI-style config might inject.
+*/
+async function gitPush(cwd, remoteUrl, branch = "main") {
+	const { cleanUrl, env } = gitAuthSpawn(remoteUrl);
+	try {
+		await execa("git", [
+			"-c",
+			"credential.helper=",
+			"-c",
+			"http.https://github.com/.extraheader=",
+			"push",
+			cleanUrl,
+			`HEAD:${branch}`
+		], {
+			cwd,
+			env,
+			stdio: [
+				"ignore",
+				"inherit",
+				"inherit"
+			]
+		});
+	} catch (err) {
+		throw toGitError(err, "push");
+	}
+}
+//#endregion
+//#region src/utils/scaffold-github.ts
+/**
+* GitHub-template scaffolding for `fluid portal create`.
+*
+* The canonical starter lives at github.com/Fluid-WeCommerce/portal-template
+* as a **fully rendered, runnable** project (GitHub's generate-from-template
+* copies files verbatim, so it can't contain `{{handlebars}}` placeholders).
+* The project name is baked in as a distinctive token (CANONICAL_PROJECT_NAME);
+* after cloning we re-substitute it with the user's chosen app name.
+*
+* This is the primary create path. When git or the network is unavailable
+* the command falls back to the bundled template (see create.ts), so
+* scaffolding never hard-fails offline.
+*/
+/** Public HTTPS URL of the portal starter template repo. */
+const TEMPLATE_REPO_URL = "https://github.com/Fluid-WeCommerce/portal-template.git";
+/**
+* The project name baked into the rendered template repo. `fluid portal
+* create` replaces every occurrence with the user's app name after
+* cloning. Must match the name the template was rendered with — keep in
+* sync with the render used to publish the repo.
+*/
+const CANONICAL_PROJECT_NAME = "fluid-portal-starter";
+/**
+* Files/dirs we never rewrite when re-substituting the project name.
+* The lockfile keys packages by import path (`.`), not the root name, so
+* touching it would only risk corruption for zero benefit.
+*/
+const SUBSTITUTION_SKIP = new Set([
+	".git",
+	"node_modules",
+	"pnpm-lock.yaml"
+]);
+/** Extensions we treat as text and safe to rewrite. Everything else is
+*  left byte-for-byte (avoids mangling any binary asset a future template
+*  might carry). */
+const TEXT_EXTENSIONS = new Set([
+	".ts",
+	".tsx",
+	".js",
+	".jsx",
+	".mjs",
+	".cjs",
+	".json",
+	".md",
+	".yml",
+	".yaml",
+	".css",
+	".html",
+	".txt"
+]);
+function hasTextExtension(file) {
+	const dot = file.lastIndexOf(".");
+	if (dot < 0) return false;
+	return TEXT_EXTENSIONS.has(file.slice(dot));
+}
+/** Recursively list absolute file paths, skipping SUBSTITUTION_SKIP dirs. */
+async function listFiles(dir) {
+	const entries = await readdir(dir, { withFileTypes: true });
+	const files = [];
+	for (const entry of entries) {
+		if (SUBSTITUTION_SKIP.has(entry.name)) continue;
+		const full = join(dir, entry.name);
+		if (entry.isDirectory()) files.push(...await listFiles(full));
+		else files.push(full);
+	}
+	return files;
+}
+/** Escape a string for use in a RegExp. */
+function escapeRegExp(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+* Replace every occurrence of the canonical project name with `appName`
+* across the cloned tree's text files. Only files that actually contain
+* the token are rewritten.
+*/
+async function rewriteProjectName(targetPath, appName) {
+	if (appName === "fluid-portal-starter") return;
+	const token = new RegExp(escapeRegExp(CANONICAL_PROJECT_NAME), "g");
+	const files = await listFiles(targetPath);
+	for (const file of files) {
+		if (!hasTextExtension(file)) continue;
+		const content = await readFile(file, "utf-8");
+		if (!content.includes("fluid-portal-starter")) continue;
+		await writeFile(file, content.replace(token, () => appName), "utf-8");
+	}
+}
+/** Rewrite `.fluidrc` with the chosen CLI profile (the template ships an
+*  empty profile). No-op when the file is absent. */
+async function writeFluidrcProfile(targetPath, profileName) {
+	const fluidrcPath = join(targetPath, ".fluidrc");
+	if (!existsSync(fluidrcPath)) return;
+	await writeFile(fluidrcPath, JSON.stringify({ profile: profileName }, null, 2) + "\n", "utf-8");
+}
+/**
+* Clone the GitHub starter template into `targetPath`, discard its git
+* history, re-substitute the project name, wire `.fluidrc`, and copy
+* `.env.example` → `.env`.
+*
+* Throws (GitError or otherwise) on any failure — the caller decides
+* whether to fall back to the bundled template.
+*/
+async function scaffoldFromGitHub(options) {
+	const { targetPath, appName, profileName } = options;
+	await gitClone(options.repoUrl ?? "https://github.com/Fluid-WeCommerce/portal-template.git", targetPath, { depth: 1 });
+	await rm(join(targetPath, ".git"), {
+		recursive: true,
+		force: true
+	});
+	await rewriteProjectName(targetPath, appName);
+	await writeFluidrcProfile(targetPath, profileName);
+	const envExample = join(targetPath, ".env.example");
+	try {
+		if ((await stat(envExample)).isFile()) await copyFile(envExample, join(targetPath, ".env"));
+	} catch {}
+}
+//#endregion
 //#region src/commands/create.ts
-const createCommand = new Command("create").description("Create a new Fluid portal application").argument("<app-name>", "Name of the application to create").option("--skip-install", "Skip dependency installation").option("-o, --output-dir <dir>", "Directory to create the project in (defaults to cwd)").option("--local", "Use local monorepo packages via file: links (for development testing)").action(async (appName, options) => {
+const createCommand = new Command("create").description("Create a new Fluid portal application").argument("<app-name>", "Name of the application to create").option("--skip-install", "Skip dependency installation").option("-o, --output-dir <dir>", "Directory to create the project in (defaults to cwd)").option("--local", "Use local monorepo packages via file: links (for development testing)").option("--no-template", "Skip the GitHub starter template; scaffold from the bundled template").action(async (appName, options) => {
 	try {
 		console.log();
 		console.log(chalk.bold("Creating a new Fluid portal application"));
@@ -426,65 +1002,39 @@ const createCommand = new Command("create").description("Create a new Fluid port
 			process.exit(0);
 		}
 		console.log();
-		const templatePaths = getTemplatePaths("starter");
-		if (!await directoryExists(templatePaths.base)) {
-			console.error(chalk.red("Error: Base template not found"));
-			process.exit(1);
-		}
-		if (!await directoryExists(templatePaths.overlay)) {
-			console.error(chalk.red("Error: Starter template not found"));
-			process.exit(1);
-		}
-		let sdkVersion;
-		let localCoreVersion;
-		const cliVersion = await getCliVersion();
-		if (!!options.local) {
-			const monorepoRoot = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "..");
-			const sdkPath = join(monorepoRoot, "packages", "portal", "sdk");
-			const corePath = join(monorepoRoot, "packages", "portal", "core");
-			if (!await directoryExists(sdkPath) || !await directoryExists(corePath)) {
-				console.error(chalk.red("Error: --local requires running from within the fluid-mono monorepo\n  Could not find packages/portal/sdk or packages/portal/core"));
-				process.exit(1);
+		const isLocal = !!options.local;
+		const gitReady = !(isLocal || options.template === false || config.selectedPages.length > 0) && await isGitAvailable();
+		let scaffolded = false;
+		if (gitReady) {
+			const spinner = ora("Fetching starter template from GitHub...").start();
+			try {
+				await scaffoldFromGitHub({
+					targetPath,
+					appName: config.name,
+					profileName: config.profileName
+				});
+				spinner.succeed("Fetched starter template");
+				scaffolded = true;
+			} catch (error) {
+				spinner.warn("Couldn't fetch the GitHub template — using the bundled starter");
+				const reason = error instanceof GitError ? error.message.split("\n")[0] : error instanceof Error ? error.message : String(error);
+				console.log(chalk.dim(`  (${reason}; source: ${TEMPLATE_REPO_URL})`));
+				try {
+					await rm(targetPath, {
+						recursive: true,
+						force: true
+					});
+				} catch {}
 			}
-			sdkVersion = getLocalPackageLinkVersion(targetPath, sdkPath);
-			localCoreVersion = getLocalPackageLinkVersion(targetPath, corePath);
-			console.log(chalk.cyan("  Using local packages (--local mode)"));
-		} else sdkVersion = await getSdkVersion();
-		const spinner = ora("Creating project directory...").start();
-		try {
-			await createDirectory(targetPath);
-			spinner.succeed("Created project directory");
-		} catch (error) {
-			spinner.fail("Failed to create project directory");
-			throw error;
-		}
-		const templateVariables = {
-			projectName: config.name,
-			sdkVersion,
-			localCoreVersion,
-			cliVersion,
-			selectedPages: config.selectedPages,
-			hasSelectedPages: config.selectedPages.length > 0,
-			profileName: config.profileName
-		};
-		spinner.start("Copying template files...");
-		try {
-			await copyTemplate(templatePaths.base, targetPath, templateVariables);
-			await copyTemplate(templatePaths.overlay, targetPath, templateVariables);
-			const envExamplePath = join(targetPath, ".env.example");
-			if (await fileExists(envExamplePath)) await copyFile(envExamplePath, join(targetPath, ".env"));
-			spinner.succeed("Copied template files");
-		} catch (error) {
-			spinner.fail("Failed to copy template files");
-			throw error;
 		}
+		if (!scaffolded) await scaffoldFromBundled(targetPath, config, isLocal);
 		if (config.installDeps) {
-			spinner.start("Installing dependencies with pnpm...");
+			const installSpinner = ora("Installing dependencies with pnpm...").start();
 			try {
 				await installDependencies(targetPath);
-				spinner.succeed("Installed dependencies");
+				installSpinner.succeed("Installed dependencies");
 			} catch {
-				spinner.fail("Failed to install dependencies");
+				installSpinner.fail("Failed to install dependencies");
 				console.log();
 				console.log(chalk.yellow("You can try installing dependencies manually:"));
 				console.log(chalk.cyan(`  cd ${appName}`));
@@ -517,6 +1067,59 @@ const createCommand = new Command("create").description("Create a new Fluid port
 		process.exit(1);
 	}
 });
+/**
+* Scaffold from the bundled base + overlay templates (Handlebars). Used
+* when the GitHub template is skipped/unavailable, or with `--local`
+* (which rewrites SDK/core deps to workspace `file:`/`link:` paths so the
+* generated project resolves unpublished monorepo source).
+*
+* Throws on failure; the caller reports and exits.
+*/
+async function scaffoldFromBundled(targetPath, config, isLocal) {
+	const templatePaths = getTemplatePaths("starter");
+	if (!await directoryExists(templatePaths.base)) throw new Error("Base template not found");
+	if (!await directoryExists(templatePaths.overlay)) throw new Error("Starter template not found");
+	let sdkVersion;
+	let localCoreVersion;
+	const cliVersion = await getCliVersion();
+	if (isLocal) {
+		const monorepoRoot = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "..");
+		const sdkPath = join(monorepoRoot, "packages", "portal", "sdk");
+		const corePath = join(monorepoRoot, "packages", "portal", "core");
+		if (!await directoryExists(sdkPath) || !await directoryExists(corePath)) throw new Error("--local requires running from within the fluid-mono monorepo\n  Could not find packages/portal/sdk or packages/portal/core");
+		sdkVersion = getLocalPackageLinkVersion(targetPath, sdkPath);
+		localCoreVersion = getLocalPackageLinkVersion(targetPath, corePath);
+		console.log(chalk.cyan("  Using local packages (--local mode)"));
+	} else sdkVersion = await getSdkVersion();
+	const spinner = ora("Creating project directory...").start();
+	try {
+		await createDirectory(targetPath);
+		spinner.succeed("Created project directory");
+	} catch (error) {
+		spinner.fail("Failed to create project directory");
+		throw error;
+	}
+	const templateVariables = {
+		projectName: config.name,
+		sdkVersion,
+		localCoreVersion,
+		cliVersion,
+		selectedPages: config.selectedPages,
+		hasSelectedPages: config.selectedPages.length > 0,
+		profileName: config.profileName
+	};
+	spinner.start("Copying template files...");
+	try {
+		await copyTemplate(templatePaths.base, targetPath, templateVariables);
+		await copyTemplate(templatePaths.overlay, targetPath, templateVariables);
+		const envExamplePath = join(targetPath, ".env.example");
+		if (await fileExists(envExamplePath)) await copyFile(envExamplePath, join(targetPath, ".env"));
+		spinner.succeed("Copied template files");
+	} catch (error) {
+		spinner.fail("Failed to copy template files");
+		throw error;
+	}
+}
 //#endregion
 //#region src/commands/dev.ts
 /**
@@ -546,7 +1149,7 @@ async function autoPull(cwd) {
 	console.log(chalk.yellow("No portal/ directory found.") + " Attempting to pull content...");
 	console.log();
 	try {
-		const { pullCommand } = await import("./pull-zrTaJuSb.mjs").then((n) => n.n);
+		const { pullCommand } = await import("./pull-CG5dELOX.mjs").then((n) => n.n);
 		await pullCommand.parseAsync([], { from: "user" });
 		return hasPortalContent(cwd);
 	} catch (err) {
@@ -1224,6 +1827,181 @@ function validateNavigationItems(items, file, validScreenSlugs, errors) {
 	}
 }
 //#endregion
+//#region src/api/git-credential.ts
+/**
+* Build the portal git-credential path for a definition id.
+*
+* Matches GitSync Phase 006 (fluid-commerce/fluid #19596): a member
+* route on the company-scoped definitions resource —
+* `POST /api/company/fluid_os/definitions/:id/git_credential`.
+*/
+function portalGitCredentialPath(definitionId) {
+	return `/api/company/fluid_os/definitions/${definitionId}/git_credential`;
+}
+function extractErrorReason(body, fallback) {
+	if (body && typeof body === "object" && "error" in body) {
+		const error = body.error;
+		if (error && typeof error === "object" && "message" in error) {
+			const message = error.message;
+			if (typeof message === "string" && message.length > 0) return message;
+		}
+	}
+	return fallback;
+}
+/**
+* Request a git credential for the portal definition's provisioned repo.
+*
+* Never throws — every failure maps to an `unavailable`/`error` outcome
+* so the invisible-git sync is strictly best-effort.
+*/
+async function createPortalGitCredential(options) {
+	const { baseUrl, token, definitionId } = options;
+	const fetchImpl = options.fetchImpl ?? fetch;
+	const url = `${baseUrl.replace(/\/$/, "")}${portalGitCredentialPath(definitionId)}`;
+	let resp;
+	try {
+		resp = await fetchImpl(url, {
+			method: "POST",
+			headers: {
+				Authorization: `Bearer ${token}`,
+				Accept: "application/json"
+			}
+		});
+	} catch (err) {
+		return {
+			status: "error",
+			reason: err instanceof Error ? err.message : String(err)
+		};
+	}
+	if (resp.status === 404) return {
+		status: "unavailable",
+		reason: "git sync isn't available for portals on this Fluid API yet"
+	};
+	const body = await resp.json().catch(() => null);
+	if (!resp.ok) {
+		const reason = extractErrorReason(body, `git credential request failed (HTTP ${resp.status})`);
+		if (resp.status === 409) return {
+			status: "unavailable",
+			reason
+		};
+		return {
+			status: "error",
+			reason
+		};
+	}
+	const credential = body?.git_credential;
+	if (!credential?.remote_url) return {
+		status: "error",
+		reason: "git credential response missing remote_url"
+	};
+	return {
+		status: "ok",
+		credential
+	};
+}
+//#endregion
+//#region src/lib/git-sync.ts
+/**
+* Invisible-git sync for `fluid portal push`.
+*
+* Before the normal content push, we best-effort mirror the local portal
+* project to its provisioned GitHub repo: fetch → fast-forward-pull if a
+* teammate pushed → auto-commit working-tree changes → push HEAD:main.
+* This mirrors `fluid mist push`, but is STRICTLY non-fatal: any problem
+* (no git, no repo, credential endpoint missing, diverged history,
+* network blip) degrades to a skip so the content push always proceeds.
+*/
+/**
+* Run the best-effort git sync. Returns a result describing what
+* happened; never throws. Callers surface `skipped` reasons as a dim
+* note and continue.
+*/
+async function runPortalGitSync(options) {
+	const { cwd, baseUrl, token, definitionId, commitMessage } = options;
+	const branch = options.branch ?? "main";
+	if (!await isGitRepo(cwd) && !await gitInit(cwd)) return {
+		status: "skipped",
+		reason: "not a git repository"
+	};
+	const outcome = await createPortalGitCredential({
+		baseUrl,
+		token,
+		definitionId,
+		fetchImpl: options.fetchImpl
+	});
+	if (outcome.status !== "ok") return {
+		status: "skipped",
+		reason: outcome.reason
+	};
+	const remoteUrl = outcome.credential.remote_url;
+	const origin = await getOriginUrl(cwd);
+	if (origin) {
+		const originId = normalizedRepoIdentity(origin);
+		const mintedId = normalizedRepoIdentity(remoteUrl);
+		if (mintedId && originId !== mintedId) return {
+			status: "skipped",
+			reason: `this directory's git origin (${originId ?? origin}) is not the portal's provisioned repository (${mintedId}) — are you in the right project directory?`
+		};
+	}
+	try {
+		if (!await hasCommits(cwd)) {
+			if (await gitRemoteBranchExists(cwd, remoteUrl, branch)) {
+				await gitFetch(cwd, remoteUrl, branch);
+				await gitAdoptFetchHead(cwd);
+			}
+			if (await hasUncommittedChanges(cwd)) await gitAutoCommit(cwd, commitMessage);
+			return await pushCommitted(cwd, remoteUrl, branch);
+		}
+		await gitFetch(cwd, remoteUrl, branch);
+		if (!await hasCommonAncestorWithFetchHead(cwd)) return {
+			status: "skipped",
+			reason: "this repository's history is unrelated to the portal's provisioned repository — are you in the right project directory?"
+		};
+		const { ahead, behind } = await gitAheadBehindVsFetchHead(cwd);
+		if (behind > 0 && ahead > 0) return {
+			status: "skipped",
+			reason: "local branch and origin have diverged — run `git pull --rebase` and retry"
+		};
+		if (behind > 0) {
+			if (await hasUncommittedChanges(cwd)) return {
+				status: "skipped",
+				reason: "origin has newer commits and you have uncommitted changes — run `git pull` and retry"
+			};
+			await gitMergeFastForward(cwd);
+		}
+		if (await hasUncommittedChanges(cwd)) await gitAutoCommit(cwd, commitMessage);
+		return await pushCommitted(cwd, remoteUrl, branch);
+	} catch (err) {
+		return {
+			status: "skipped",
+			reason: err instanceof Error ? err.message : String(err)
+		};
+	}
+}
+/**
+* The push gets its own failure boundary: by this point the auto-commit
+* (and any fast-forward) has already mutated local git state. A push
+* failure here is FATAL to the content push (matching `fluid widget
+* push`): publishing artifacts whose source never reached the repo is
+* exactly the drift the invisible-git model exists to prevent. The
+* local commit is durable — rerunning push finds the branch ahead and
+* retries the sync.
+*/
+async function pushCommitted(cwd, remoteUrl, branch) {
+	try {
+		await gitPush(cwd, remoteUrl, branch);
+	} catch (err) {
+		return {
+			status: "failed",
+			reason: `your changes are committed locally but couldn't be pushed (${err instanceof Error ? err.message : String(err)}) — nothing was published; rerun \`fluid portal push\` to retry`
+		};
+	}
+	return {
+		status: "synced",
+		pushed: true
+	};
+}
+//#endregion
 //#region src/commands/push.ts
 /**
 * `fluid portal push` command
@@ -1247,7 +2025,7 @@ function toApiComponentTree(tree) {
 /**
 * Create an authenticated FetchClient using the stored CLI profile.
 */
-function createClient$1() {
+function createClient$2() {
 	const token = getAuthToken();
 	if (!token) {
 		const profile = getActiveProfile();
@@ -1269,6 +2047,32 @@ function enrichedErrorMessage(err) {
 	return msg;
 }
 /**
+* Best-effort "invisible git" sync: commit the local project and push it
+* to the portal's provisioned GitHub repo before the content push. Never
+* throws — every failure is reported as a dim note and swallowed so the
+* content push always runs.
+*/
+async function runInvisibleGitSync(cwd, definitionId, definitionName) {
+	const token = getAuthToken();
+	if (!token) return;
+	const baseUrl = process.env["FLUID_API_BASE"] ?? "https://api.fluid.app";
+	const commitMessage = `Portal push: ${definitionName} · ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 19).replace("T", " ")}`;
+	const spinner = ora("Syncing project to git…").start();
+	const result = await runPortalGitSync({
+		cwd,
+		baseUrl,
+		token,
+		definitionId,
+		commitMessage
+	});
+	if (result.status === "synced") spinner.succeed("Synced project to git");
+	else if (result.status === "failed") {
+		spinner.fail("Git sync failed");
+		throw new Error(result.reason);
+	} else spinner.info(chalk.gray(`Skipped git sync — ${result.reason}`));
+	console.log();
+}
+/**
 * Read and parse a JSON file from the portal directory.
 */
 async function readPortalFile(portalDir, relativePath) {
@@ -1876,6 +2680,7 @@ const pushCommand = new Command("push").description("Push local portal content c
 	const definitionName = snapshot.definition;
 	console.log(chalk.gray("Definition: ") + chalk.white(definitionName) + chalk.gray(` (ID: ${definitionId})`));
 	console.log();
+	await runInvisibleGitSync(cwd, definitionId, definitionName);
 	const spinner = ora();
 	spinner.start("Detecting changes...");
 	const diff = await diffAgainstSnapshot(portalDir, snapshot);
@@ -1917,7 +2722,7 @@ const pushCommand = new Command("push").description("Push local portal content c
 	spinner.start("Authenticating...");
 	let client;
 	try {
-		client = createClient$1();
+		client = createClient$2();
 		spinner.succeed("Authenticated");
 	} catch (err) {
 		spinner.fail("Authentication failed");
@@ -2005,6 +2810,114 @@ const pushCommand = new Command("push").description("Push local portal content c
 	console.log();
 });
 //#endregion
+//#region src/commands/clone.ts
+/**
+* `fluid portal clone [app]` — mints a fresh git credential for a Fluid
+* OS portal definition and clones its provisioned GitHub repo into
+* `./<slug>/`. Mirrors `fluid mist clone` (credential → clone), but
+* against the portal git-credential endpoint.
+*
+* The credential endpoint is part of GitSync phase 006; until it ships
+* the request 404s and we print a friendly "not available yet" message
+* instead of a raw git error.
+*/
+function getBaseUrl() {
+	return process.env["FLUID_API_BASE"] ?? "https://api.fluid.app";
+}
+function createClient$1(token) {
+	return createFetchClient({
+		baseUrl: getBaseUrl(),
+		getAuthToken: () => token
+	});
+}
+/** Select a definition by --app name, else interactively. */
+async function selectDefinition(client, appName) {
+	const definitions = [];
+	let page = 1;
+	while (true) {
+		const response = await fluid_os_v0_list_fluid_osdefinitions(client, {
+			page,
+			per_page: 500
+		});
+		const batch = response.definitions ?? [];
+		definitions.push(...batch);
+		const totalPages = response.meta?.total_pages ?? 1;
+		if (page >= totalPages || batch.length === 0) break;
+		page++;
+	}
+	if (definitions.length === 0) throw new Error("No Fluid OS definitions found. Create one in the admin dashboard first.");
+	if (appName) {
+		const match = definitions.find((d) => d.name?.toLowerCase() === appName.toLowerCase());
+		if (!match || match.id == null) {
+			const available = definitions.map((d) => chalk.cyan(d.name ?? "(unnamed)")).join(", ");
+			throw new Error(`No definition found matching "${appName}". Available: ${available}`);
+		}
+		return {
+			id: match.id,
+			name: match.name ?? `portal-${match.id}`
+		};
+	}
+	const { definitionId } = await prompts({
+		type: "select",
+		name: "definitionId",
+		message: "Select a Fluid OS definition to clone",
+		choices: definitions.filter((d) => d.id != null).map((d) => ({
+			title: d.name ?? "(unnamed)",
+			value: d.id
+		}))
+	});
+	if (definitionId == null) throw new Error("No definition selected.");
+	const selected = definitions.find((d) => d.id === definitionId);
+	if (!selected || selected.id == null) throw new Error("Selected definition not found.");
+	return {
+		id: selected.id,
+		name: selected.name ?? `portal-${selected.id}`
+	};
+}
+const cloneCommand = new Command("clone").description("Clone a portal definition's provisioned GitHub repo (mints a fresh token per call)").argument("[app]", "Definition name (prompts to select when omitted)").option("--app <name>", "Definition name (same as the positional argument)").option("--dir <dir>", "Target directory (defaults to ./<slug>/)").action(async (appArg, options) => {
+	try {
+		await ensureGitAvailable();
+		const token = getAuthToken();
+		if (!token) {
+			const profile = getActiveProfile();
+			throw new Error(profile ? `No auth token for profile ${chalk.cyan(profile.name)}. Run ${chalk.cyan("fluid login")}.` : `Not logged in. Run ${chalk.cyan("fluid login")} first.`);
+		}
+		const client = createClient$1(token);
+		const spinner = ora("Resolving definition…").start();
+		const definition = await selectDefinition(client, options.app ?? appArg);
+		spinner.text = "Minting git credential…";
+		const outcome = await createPortalGitCredential({
+			baseUrl: getBaseUrl(),
+			token,
+			definitionId: definition.id
+		});
+		if (outcome.status !== "ok") {
+			spinner.warn(`Can't clone — ${outcome.reason}`);
+			process.exit(1);
+		}
+		const slug = deriveSlug(definition.name);
+		const targetDir = resolve(options.dir ?? slug);
+		if (existsSync(targetDir)) {
+			spinner.fail(`Directory ${targetDir} already exists. Pass --dir or remove it first.`);
+			process.exit(1);
+		}
+		spinner.text = `Cloning into ${slug}/…`;
+		try {
+			await gitClone(outcome.credential.remote_url, targetDir);
+		} catch (err) {
+			spinner.fail("git clone failed");
+			throw err;
+		}
+		spinner.succeed(`Cloned into ${chalk.cyan(targetDir)}`);
+		console.log(chalk.dim(`  cd ${slug}`));
+		console.log(chalk.dim(`  ${chalk.cyan("fluid portal pull")} to sync content`));
+	} catch (error) {
+		console.log();
+		console.log(chalk.red("Error:") + " " + (error instanceof Error ? error.message : String(error)));
+		process.exit(1);
+	}
+});
+//#endregion
 //#region src/utils/widget-helpers.ts
 /**
 * Pure helper functions for widget scaffolding.
@@ -5303,6 +6216,7 @@ const plugin = {
 		portal.addCommand(buildCommand);
 		portal.addCommand(pullCommand);
 		portal.addCommand(pushCommand);
+		portal.addCommand(cloneCommand);
 		portal.addCommand(deployCommand);
 		portal.addCommand(widgetCommand);
 		portal.addCommand(doctorCommand);
@@ -5311,6 +6225,6 @@ const plugin = {
 	}
 };
 //#endregion
-export { FILE_SYSTEM_ERRORS, TEMPLATES, WIDGET_PACKAGE_BUILDER_VERSION, WidgetPackageUploadError, buildIdToSlugMap, buildNavigationIdToSlugMap, buildSharedWidgetPackage, buildSnapshot, buildThemeIdToSlugMap, buildWidgetPackageCompleteUploadPayload, buildWidgetPackageDescriptor, buildWidgetPackageUploadSessionPayload, categorizeChanges, collectWidgetPackageArtifacts, completeWidgetPackageUpload, computeArtifactMetadata, computeFileHash, copyTemplate, copyTemplateSafe, createAuthenticatedWidgetPackageClient, createCommand, createDirectory, createDirectorySafe, createPublishManifestMetadata, createWidgetPackageEntrySource, createWidgetPackagePublishRequest, plugin as default, deployCommand, deriveScreenSlug, deriveSlug, diffAgainstSnapshot, directoryExists, doctorCommand, fileExists, getArtifactContentType, getInstallCommand, getRunCommand, getSdkVersion, getSdkVersionSafe, getTemplatePaths, getWidgetPackageCompleteUploadRoute, getWidgetPackageUploadSessionRoute, installDependencies, loadSourceWidgetPackages, normalizeWidgetPackageCompleteResponse, normalizeWidgetPackageUploadSession, pathExists, printDryRunSessionPayload, printRuntimeOnlyNotice, printWidgetPublishSummary, promptProjectConfig, publishWidgetPackageVersion, publishWidgetRuntimeArtifacts, pullCommand, pushCommand, readFileSafe, readMappings, readSnapshot, removeMapping, requestWidgetPackageUploadSession, resolveIdToSlug, resolvePortalWidgetSourceConfig, resolveSlugToId, runPackageManager, sha256, slugFromPath, topLevelWidgetCommand, transformNavigation, transformNavigationItems, transformProfile, transformScreen, transformTheme, updateMapping, uploadWidgetPackageArtifacts, validateCrossReferences, validateSingleSourceWidgetPackage, validateWidgetPublishOutDir, versionCommand, widgetCommand, writeFileSafe, writeMappings, writeSnapshot };
+export { CANONICAL_PROJECT_NAME, FILE_SYSTEM_ERRORS, GitError, TEMPLATES, TEMPLATE_REPO_URL, WIDGET_PACKAGE_BUILDER_VERSION, WidgetPackageUploadError, buildIdToSlugMap, buildNavigationIdToSlugMap, buildSharedWidgetPackage, buildSnapshot, buildThemeIdToSlugMap, buildWidgetPackageCompleteUploadPayload, buildWidgetPackageDescriptor, buildWidgetPackageUploadSessionPayload, categorizeChanges, cloneCommand, collectWidgetPackageArtifacts, completeWidgetPackageUpload, computeArtifactMetadata, computeFileHash, copyTemplate, copyTemplateSafe, createAuthenticatedWidgetPackageClient, createCommand, createDirectory, createDirectorySafe, createPortalGitCredential, createPublishManifestMetadata, createWidgetPackageEntrySource, createWidgetPackagePublishRequest, plugin as default, deployCommand, deriveScreenSlug, deriveSlug, diffAgainstSnapshot, directoryExists, doctorCommand, ensureGitAvailable, fileExists, getArtifactContentType, getInstallCommand, getOriginUrl, getRunCommand, getSdkVersion, getSdkVersionSafe, getTemplatePaths, getWidgetPackageCompleteUploadRoute, getWidgetPackageUploadSessionRoute, gitAheadBehindVsFetchHead, gitAutoCommit, gitClone, gitFetch, gitInit, gitMergeFastForward, gitMissingError, gitPush, hasUncommittedChanges, installDependencies, isGitAvailable, isGitRepo, loadSourceWidgetPackages, normalizeWidgetPackageCompleteResponse, normalizeWidgetPackageUploadSession, pathExists, portalGitCredentialPath, printDryRunSessionPayload, printRuntimeOnlyNotice, printWidgetPublishSummary, promptProjectConfig, publishWidgetPackageVersion, publishWidgetRuntimeArtifacts, pullCommand, pushCommand, readFileSafe, readMappings, readSnapshot, removeMapping, requestWidgetPackageUploadSession, resolveIdToSlug, resolvePortalWidgetSourceConfig, resolveSlugToId, rewriteProjectName, runPackageManager, runPortalGitSync, scaffoldFromGitHub, sha256, slugFromPath, topLevelWidgetCommand, transformNavigation, transformNavigationItems, transformProfile, transformScreen, transformTheme, updateMapping, uploadWidgetPackageArtifacts, validateCrossReferences, validateSingleSourceWidgetPackage, validateWidgetPublishOutDir, versionCommand, widgetCommand, writeFileSafe, writeFluidrcProfile, writeMappings, writeSnapshot };
 
 //# sourceMappingURL=index.mjs.map