@fluid-app/fluid-cli-portal 0.1.52 → 0.1.54

package/dist/index.mjs

@@ -1,18 +1,19 @@
-import { A as fluid_os_v0_create_fluid_osversion, B as fluid_os_v0_update_fluid_osnavigation, C as writeMappings, D as fluid_os_v0_create_fluid_osprofile, E as fluid_os_v0_create_fluid_osnavigation_item, F as fluid_os_v0_delete_fluid_osscreen, G as fluid_os_v0_update_fluid_osversion, H as fluid_os_v0_update_fluid_osprofile, I as fluid_os_v0_delete_fluid_ostheme, K as createFetchClient, L as fluid_os_v0_list_fluid_osdefinitions, M as fluid_os_v0_delete_fluid_osnavigation, N as fluid_os_v0_delete_fluid_osnavigation_item, O as fluid_os_v0_create_fluid_osscreen, P as fluid_os_v0_delete_fluid_osprofile, R as fluid_os_v0_list_fluid_osnavigation_items, S as updateMapping, T as fluid_os_v0_create_fluid_osnavigation, U as fluid_os_v0_update_fluid_osscreen, V as fluid_os_v0_update_fluid_osnavigation_item, W as fluid_os_v0_update_fluid_ostheme, _ as deriveSlug, a as buildThemeIdToSlugMap, b as resolveIdToSlug, c as transformNavigationItems, d as transformTheme, f as buildSnapshot, g as writeSnapshot, h as readSnapshot, i as buildNavigationIdToSlugMap, j as fluid_os_v0_create_widget_package_version, k as fluid_os_v0_create_fluid_ostheme, l as transformProfile, m as diffAgainstSnapshot, o as deriveScreenSlug, p as computeFileHash, r as buildIdToSlugMap, s as transformNavigation, t as pullCommand, u as transformScreen, v as readMappings, w as fluid_os_v0_complete_widget_package_version_upload, x as resolveSlugToId, y as removeMapping, z as fluid_os_v0_list_fluid_osversions } from "./pull-XOsFaqz2.mjs";
-import { createRequire } from "node:module";
+import { A as STANDALONE_PORTAL_MARKER, C as writeMappings, D as toFluidOsDynamicObject, E as fluidOsApi, O as createFluidOsHeyApiClient, S as updateMapping, T as createFluidOsClient, _ as deriveSlug, a as buildThemeIdToSlugMap, b as resolveIdToSlug, c as transformNavigationItems, d as transformTheme, f as buildSnapshot, g as writeSnapshot, h as readSnapshot, i as buildNavigationIdToSlugMap, j as assertStandalonePortalRemoteActionAllowed, k as ApiError, l as transformProfile, m as diffAgainstSnapshot, o as deriveScreenSlug, p as computeFileHash, r as buildIdToSlugMap, s as transformNavigation, t as pullCommand, u as transformScreen, v as readMappings, w as atomicWriteFile, x as resolveSlugToId, y as removeMapping } from "./pull-CUR8tbW9.mjs";
+import { l as fluidOsV0DefinitionGitCredentialCreate } from "./sdk.gen-DuPhfdxN.mjs";
+import { a as resolvePublishVersion, i as readCompanyWidgetPackages, n as preflightCompanyPackage, o as loadAndValidateWidgetPackage, r as readCompanyWidgetPackage, s as publishWidgetPackage, t as formatPackageKeyMismatch } from "./src-CpH5SpDH.mjs";
 import { Command } from "commander";
 import chalk from "chalk";
 import ora from "ora";
-import path, { basename, dirname, join, relative, resolve } from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import { copyFile, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
+import path, { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import { chmodSync, constants, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { copyFile, lstat, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
+import os, { tmpdir } from "node:os";
 import { failure, findProjectConfig, getActiveProfile, getAuthToken, listProfileNames, readConfig, success } from "@fluid-app/fluid-cli";
 import prompts from "prompts";
-import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import Handlebars from "handlebars";
 import { execa } from "execa";
-import os from "node:os";
-import { createHash } from "node:crypto";
+import { randomUUID } from "node:crypto";
 import fs from "fs-extra";
 //#region src/types.ts
 /**
@@ -95,9 +96,9 @@ async function promptProjectConfig(projectName, options) {
 //#endregion
 //#region src/utils/file-system.ts
 const _currentDir$1 = dirname(fileURLToPath(import.meta.url));
-const EMBEDDED_PORTAL_SDK_VERSION = "0.1.461";
+const EMBEDDED_PORTAL_SDK_VERSION = "0.1.463";
 const EMBEDDED_CLI_CORE_VERSION = "0.1.14";
-const EMBEDDED_CLI_PORTAL_VERSION = "0.1.52";
+const EMBEDDED_CLI_PORTAL_VERSION = "0.1.54";
 /**
 * Find the package root by walking up from the current directory to the nearest package.json.
 * Works whether running from dist/ (bundled) or src/utils/ (tsx dev mode).
@@ -296,6 +297,40 @@ async function getCliVersion() {
 async function getPortalCliVersion() {
 	return getTemplatePackageVersion(["cli", "portal"], EMBEDDED_CLI_PORTAL_VERSION);
 }
+const NPM_REGISTRY_URL = "https://registry.npmjs.org";
+const NPM_REGISTRY_TIMEOUT_MS = 5e3;
+/**
+* Clamp a scaffold dependency pin to a version that `pnpm install` can
+* actually resolve from the registry.
+*
+* The versions above are whatever this CLI build carries — embedded at build
+* time, or read from the workspace when running from source. Both run ahead
+* of npm whenever the monorepo holds a release bump that has not been
+* published yet (routine for anyone running the CLI from a checkout, e.g.
+* Mist in development), and a scaffold pinned to that version fails to
+* install. Only a definitive registry 404 for the exact version downgrades
+* the pin to the registry's `latest`; a network failure or any other registry
+* response keeps the original version, so offline scaffolds behave exactly as
+* before.
+*
+* Scaffold pins are the ONLY sound callsite: consumers that report which
+* version is running (e.g. widget-package-publish) must not route through
+* this — it would silently misreport an unpublished build as the older
+* published one.
+*/
+async function resolveInstallableTemplateVersion(packageName, version) {
+	try {
+		if ((await fetch(`${NPM_REGISTRY_URL}/${packageName}/${encodeURIComponent(version)}`, { signal: AbortSignal.timeout(NPM_REGISTRY_TIMEOUT_MS) })).status !== 404) return version;
+		const latest = await fetch(`${NPM_REGISTRY_URL}/${packageName}/latest`, { signal: AbortSignal.timeout(NPM_REGISTRY_TIMEOUT_MS) });
+		if (!latest.ok) return version;
+		const pkg = await latest.json();
+		if (typeof pkg.version !== "string") return version;
+		console.warn(`${packageName}@${version} is not published yet; the scaffold pins the latest published version ${pkg.version} instead.`);
+		return pkg.version;
+	} catch {
+		return version;
+	}
+}
 async function getTemplatePackageVersion(packagePathSegments, embeddedVersion) {
 	if (embeddedVersion) return embeddedVersion;
 	try {
@@ -486,6 +521,10 @@ function splitRemoteCredentials(remoteUrl) {
 		password
 	};
 }
+/** Strip credential userinfo from a minted remote URL for safe comparison. */
+function cleanGitRemoteUrl(remoteUrl) {
+	return splitRemoteCredentials(remoteUrl).cleanUrl;
+}
 /**
 * Write a stub GIT_ASKPASS shell script to a per-process tmpdir and
 * return its path. The script contains no secret — it echoes back
@@ -519,9 +558,9 @@ function ensureAskpassScript() {
 *     credentials are empty (auth should fail fast, not hang).
 */
 function gitAuthSpawn(remoteUrl) {
-	const { cleanUrl, username, password } = splitRemoteCredentials(remoteUrl);
+	const { username, password } = splitRemoteCredentials(remoteUrl);
 	return {
-		cleanUrl,
+		cleanUrl: cleanGitRemoteUrl(remoteUrl),
 		env: {
 			...process.env,
 			GIT_ASKPASS: ensureAskpassScript(),
@@ -791,6 +830,245 @@ async function gitMergeFastForward(cwd) {
 	}
 }
 /**
+* Local-only state that must never reach a portal's provisioned repo,
+* regardless of which tool created the checkout.
+*
+* `.mist-desktop/` is Mist Desktop's per-machine working state for the
+* project directory it opened — chat transcripts, user attachments,
+* screenshots, source baselines, and a media cache. When Desktop drives
+* `fluid portal push`, that directory sits in the project root, so a
+* whole-tree `git add -A` publishes every private conversation to the
+* portal's GitHub repo. `.mist` is the sibling clone marker (a slug
+* pointer); committing it means a later revert deletes it and breaks
+* slug resolution for every subsequent command.
+*
+* Neither is portal content: the portal's own material lives under
+* `portal/` and is pushed separately by the content push.
+*/
+const LOCAL_ONLY_GIT_PATHS = [".mist", ".mist-desktop/"];
+/**
+* Append {@link LOCAL_ONLY_GIT_PATHS} to `.git/info/exclude` when absent.
+*
+* Why the local exclude and not `.gitignore`: a portal's `.gitignore`
+* ships from the starter template (bundled or the GitHub
+* `portal-template` repo), so a template edit alone would never reach
+* the clones that already exist on people's machines. `.git/info/exclude`
+* is per-checkout, so writing it here — at sync time, on every push —
+* heals a pre-existing clone on its very next push with no template
+* release required. The template is updated too, for fresh scaffolds.
+*
+* Idempotent and best-effort: never throws. A repo with an unusual `.git`
+* layout (missing `info/`, `.git` as a worktree pointer file) just skips
+* the exclude — {@link gitAutoCommit} also cleans these paths out of the
+* index after staging, so the exclude is a convenience, not the only
+* defense.
+*
+* Mirrors `packages/cli/mist/src/lib/git.ts::excludeMistMarkerFromGit`.
+*/
+function excludeLocalStateFromGit(cwd) {
+	try {
+		const gitDir = path.join(cwd, ".git");
+		if (!existsSync(gitDir)) return;
+		const infoDir = path.join(gitDir, "info");
+		if (!existsSync(infoDir)) mkdirSync(infoDir, { recursive: true });
+		const excludePath = path.join(infoDir, "exclude");
+		const existing = existsSync(excludePath) ? readFileSync(excludePath, "utf8") : "";
+		const existingLines = new Set(existing.split("\n").map((line) => line.trim()).filter(Boolean));
+		const missing = LOCAL_ONLY_GIT_PATHS.filter((entry) => !existingLines.has(entry));
+		if (missing.length === 0) return;
+		writeFileSync(excludePath, `${existing}${existing.length > 0 && !existing.endsWith("\n") ? "\n" : ""}${missing.join("\n")}\n`, "utf8");
+	} catch {}
+}
+/**
+* Absolute path of the repository containing `cwd`, or `cwd` itself when
+* resolution fails (not a repo / git missing — the caller's own git
+* command surfaces the real error).
+*
+* Every local-state defense must anchor here rather than to `cwd`: a push
+* run from a project subdirectory would otherwise look for
+* `<subdir>/.git`, silently skip the exclude write, and then let
+* `git add -A` — which always stages the WHOLE repository — sweep the
+* root `.mist-desktop/` into the commit anyway.
+*/
+async function resolveRepoRoot(cwd) {
+	try {
+		const { stdout } = await execa("git", ["rev-parse", "--show-toplevel"], { cwd });
+		const root = stdout.trim();
+		if (root.length > 0) return root;
+	} catch {}
+	return cwd;
+}
+/**
+* Repository-root-anchored {@link excludeLocalStateFromGit}, for callers
+* that only have a possibly-nested `cwd`.
+*
+* Run this BEFORE any working-tree cleanliness check, not just before
+* staging: while `.mist-desktop/` is neither tracked nor excluded, it
+* shows up as untracked in `git status --porcelain`, so a Desktop-driven
+* push reads as "you have uncommitted changes" and the sync skips with
+* advice to `git pull` that the user can't act on. Excluding it first
+* makes the cleanliness check reflect actual portal changes.
+*/
+async function ensureLocalStateExcluded(cwd) {
+	excludeLocalStateFromGit(await resolveRepoRoot(cwd));
+}
+/** Paths currently tracked under `.mist-desktop/`, or [] when none. */
+async function trackedLocalStatePaths(repoRoot) {
+	try {
+		const { stdout } = await execa("git", [
+			"ls-files",
+			"--",
+			".mist-desktop"
+		], { cwd: repoRoot });
+		return stdout.split("\n").filter((l) => l.trim().length > 0);
+	} catch {
+		return [];
+	}
+}
+/**
+* Untrack private Mist Desktop state and, if anything was tracked,
+* commit ONLY that removal so the next push deletes it from the remote.
+* Returns true when a purge commit was made.
+*
+* Call this on every sync BEFORE deciding whether there is anything to
+* auto-commit — a clean checkout that already tracks `.mist-desktop/`
+* still needs the removal, and ignore rules alone cannot untrack an
+* existing path.
+*
+* The commit is built through a THROWAWAY index (`GIT_INDEX_FILE`), not
+* the user's: `read-tree HEAD` → `rm --cached` → `write-tree` →
+* `commit-tree` → `update-ref`. A plain `git commit` would capture the
+* user's entire index, so anything they had pre-staged would be swept
+* into the purge commit and pushed — defeating `--no-commit` and
+* mislabelling their work. A pathspec commit (`git commit -- .mist-desktop`)
+* is also wrong: with `--only` git takes the *working tree* content of
+* those paths, and the chats are still on disk, so it would re-add
+* exactly what we are removing.
+*
+* The user's real index is then updated with the same `rm --cached`,
+* touching only this path — so any other staged work stays staged, and
+* the working tree is never modified.
+*/
+async function purgeLocalStateFromIndex(cwd, message) {
+	const repoRoot = await resolveRepoRoot(cwd);
+	if ((await trackedLocalStatePaths(repoRoot)).length === 0) return false;
+	let head;
+	try {
+		const { stdout } = await execa("git", ["rev-parse", "HEAD"], { cwd: repoRoot });
+		head = stdout.trim();
+		if (!head) return false;
+	} catch {
+		return false;
+	}
+	const tmpIndex = path.join(os.tmpdir(), `fluid-portal-purge-${process.pid}-${randomUUID()}.index`);
+	const indexEnv = {
+		...process.env,
+		GIT_INDEX_FILE: tmpIndex
+	};
+	let commitSha;
+	try {
+		await execa("git", ["read-tree", head], {
+			cwd: repoRoot,
+			env: indexEnv
+		});
+		await execa("git", [
+			"rm",
+			"-q",
+			"-r",
+			"--cached",
+			"--ignore-unmatch",
+			"--",
+			".mist-desktop"
+		], {
+			cwd: repoRoot,
+			env: indexEnv
+		});
+		const { stdout: tree } = await execa("git", ["write-tree"], {
+			cwd: repoRoot,
+			env: indexEnv
+		});
+		const { stdout: sha } = await execa("git", [
+			"commit-tree",
+			tree.trim(),
+			"-p",
+			head,
+			"-m",
+			message
+		], {
+			cwd: repoRoot,
+			env: {
+				...indexEnv,
+				...await identityEnv(repoRoot)
+			}
+		});
+		commitSha = sha.trim();
+		if (!commitSha) return false;
+	} catch (err) {
+		const missing = gitMissingError(err);
+		if (missing) throw missing;
+		throw toGitError(err, "purge local state");
+	} finally {
+		rmSync(tmpIndex, { force: true });
+	}
+	try {
+		await execa("git", [
+			"update-ref",
+			"HEAD",
+			commitSha,
+			head
+		], { cwd: repoRoot });
+	} catch (err) {
+		throw toGitError(err, "purge local state");
+	}
+	try {
+		await execa("git", [
+			"rm",
+			"-q",
+			"-r",
+			"--cached",
+			"--ignore-unmatch",
+			"--",
+			".mist-desktop"
+		], { cwd: repoRoot });
+	} catch {}
+	return true;
+}
+/** `GIT_{AUTHOR,COMMITTER}_*` overrides for `commit-tree`, which (unlike
+*  `git commit`) fails outright rather than prompting when the repo has
+*  no identity. Only set what the repo itself doesn't define. */
+async function identityEnv(cwd) {
+	const env = {};
+	const read = async (key) => {
+		try {
+			return (await execa("git", ["config", key], { cwd })).stdout.trim().length > 0;
+		} catch {
+			return false;
+		}
+	};
+	if (!await read("user.name")) {
+		env["GIT_AUTHOR_NAME"] = "Fluid Portal CLI";
+		env["GIT_COMMITTER_NAME"] = "Fluid Portal CLI";
+	}
+	if (!await read("user.email")) {
+		env["GIT_AUTHOR_EMAIL"] = "portal@fluid.app";
+		env["GIT_COMMITTER_EMAIL"] = "portal@fluid.app";
+	}
+	return env;
+}
+/** Shared `-c user.*` args: use the repo's identity, else a synthetic
+*  Fluid bot identity so the commit isn't rejected. */
+async function resolveIdentityArgs(cwd) {
+	let hasName = false;
+	let hasEmail = false;
+	try {
+		hasName = (await execa("git", ["config", "user.name"], { cwd })).stdout.trim().length > 0;
+	} catch {}
+	try {
+		hasEmail = (await execa("git", ["config", "user.email"], { cwd })).stdout.trim().length > 0;
+	} catch {}
+	return [...hasName ? [] : ["-c", "user.name=Fluid Portal CLI"], ...hasEmail ? [] : ["-c", "user.email=portal@fluid.app"]];
+}
+/**
 * `git add -A && git commit -m <message>` (or, with
 * `{ ignoreRemovals: true }`, `git add --ignore-removal .` — see
 * GitAutoCommitOptions).
@@ -803,11 +1081,42 @@ async function gitMergeFastForward(cwd) {
 * `node_modules/`, `dist/`, `.portal-sync/`, logs, `*.tsbuildinfo`), so
 * generated output and local secrets stay out of the commit.
 *
+* That boundary is not enough on its own for tool-local state written
+* INTO the project directory by whatever opened it — most importantly
+* Mist Desktop's `.mist-desktop/` (private chats, attachments,
+* screenshots) and the `.mist` clone marker. A `.gitignore`-only fix
+* can't reach clones that already exist, so this applies belt AND
+* suspenders, all anchored to the repository root (see
+* {@link resolveRepoRoot}):
+*
+*   1. {@link excludeLocalStateFromGit} — idempotent `.git/info/exclude`
+*      write, so `git add` never picks the paths up in the first place.
+*      Heals pre-existing clones on their next push.
+*   2. `git reset -- ':(top).mist' .mist` after staging — unstages the
+*      marker if step 1 silently failed. We deliberately do NOT pass a
+*      `:(exclude)` pathspec to `git add`: when the path is *also*
+*      listed in `.git/info/exclude`, git exits 1 with "paths are
+*      ignored by one of your .gitignore files", turning the normal
+*      (already-healed) case into a hard failure. Add-then-reset is a
+*      no-op when there's nothing staged.
+*   3. `git rm --cached -r --ignore-unmatch .mist-desktop` — untracks
+*      chat history that an older, unhardened push already committed.
+*      Ignore rules alone cannot untrack an existing path. `--cached`
+*      keeps every file on disk; only the index entry goes away. This
+*      runs even under `ignoreRemovals`, where suppressing deletions
+*      protects remote-only *portal* files — private chats are never
+*      that, and leaving them tracked would keep republishing them.
+*
+* Steps 2 and 3 are best-effort and never fail the publish; the commit
+* itself is what must succeed.
+*
 * Uses the repo's configured identity, else a synthetic Fluid bot
 * identity so the commit isn't rejected. "nothing to commit" is treated
 * as a no-op, not an error.
 */
 async function gitAutoCommit(cwd, message, options = {}) {
+	const repoRoot = await resolveRepoRoot(cwd);
+	excludeLocalStateFromGit(repoRoot);
 	const addArgs = options.ignoreRemovals ? [
 		"add",
 		"--ignore-removal",
@@ -818,15 +1127,27 @@ async function gitAutoCommit(cwd, message, options = {}) {
 	} catch (err) {
 		throw toGitError(err, "add");
 	}
-	let hasName = false;
-	let hasEmail = false;
 	try {
-		hasName = (await execa("git", ["config", "user.name"], { cwd })).stdout.trim().length > 0;
+		await execa("git", [
+			"reset",
+			"-q",
+			"--",
+			":(top).mist",
+			".mist"
+		], { cwd });
 	} catch {}
 	try {
-		hasEmail = (await execa("git", ["config", "user.email"], { cwd })).stdout.trim().length > 0;
+		await execa("git", [
+			"rm",
+			"-q",
+			"-r",
+			"--cached",
+			"--ignore-unmatch",
+			"--",
+			".mist-desktop"
+		], { cwd: repoRoot });
 	} catch {}
-	const identityArgs = [...hasName ? [] : ["-c", "user.name=Fluid Portal CLI"], ...hasEmail ? [] : ["-c", "user.email=portal@fluid.app"]];
+	const identityArgs = await resolveIdentityArgs(cwd);
 	try {
 		await execa("git", [
 			...identityArgs,
@@ -1055,7 +1376,7 @@ async function createPortalProject(appName, options, config, dependencies = defa
 			}).catch(() => {});
 			throw error;
 		}
-	} else await scaffoldFromBundled(targetPath, config, isLocal);
+	} else await scaffoldFromBundled(targetPath, config, isLocal, true);
 	if (config.installDeps) {
 		const installSpinner = ora("Installing dependencies with pnpm...").start();
 		try {
@@ -1105,13 +1426,13 @@ function formatCdPath(targetPath) {
 *
 * Throws on failure; the caller reports and exits.
 */
-async function scaffoldFromBundled(targetPath, config, isLocal) {
+async function scaffoldFromBundled(targetPath, config, isLocal, createTarget) {
 	const templatePaths = getTemplatePaths("starter");
 	if (!await directoryExists(templatePaths.base)) throw new Error("Base template not found");
 	if (!await directoryExists(templatePaths.overlay)) throw new Error("Starter template not found");
 	let sdkVersion;
 	let localCoreVersion;
-	const [cliVersion, portalCliVersion] = await Promise.all([getCliVersion(), getPortalCliVersion()]);
+	const [cliVersion, portalCliVersion] = await Promise.all([getCliVersion().then((version) => resolveInstallableTemplateVersion("@fluid-app/fluid-cli", version)), getPortalCliVersion().then((version) => resolveInstallableTemplateVersion("@fluid-app/fluid-cli-portal", version))]);
 	if (isLocal) {
 		const monorepoRoot = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "..");
 		const sdkPath = join(monorepoRoot, "packages", "portal", "sdk");
@@ -1120,15 +1441,16 @@ async function scaffoldFromBundled(targetPath, config, isLocal) {
 		sdkVersion = getLocalPackageLinkVersion(targetPath, sdkPath);
 		localCoreVersion = getLocalPackageLinkVersion(targetPath, corePath);
 		console.log(chalk.cyan("  Using local packages (--local mode)"));
-	} else sdkVersion = await getSdkVersion();
-	const spinner = ora("Creating project directory...").start();
-	try {
+	} else sdkVersion = await getSdkVersion().then((version) => resolveInstallableTemplateVersion("@fluid-app/portal-sdk", version));
+	const spinner = ora(createTarget ? "Creating project directory..." : "Preparing provisioned portal checkout...").start();
+	if (createTarget) try {
 		await createDirectory(targetPath);
 		spinner.succeed("Created project directory");
 	} catch (error) {
 		spinner.fail("Failed to create project directory");
 		throw error;
 	}
+	else if (!await directoryExists(targetPath)) throw new Error(`Portal checkout does not exist: ${targetPath}`);
 	const templateVariables = {
 		projectName: config.name,
 		sdkVersion,
@@ -1151,6 +1473,79 @@ async function scaffoldFromBundled(targetPath, config, isLocal) {
 		throw error;
 	}
 }
+/**
+* Add the runnable bundled starter to an existing provisioned Git checkout.
+* Portal repositories begin with a bootstrap commit, so a first clone may
+* not contain package.json yet. Rendering into the checkout preserves its
+* .git directory and gives both the CLI and Mist Desktop a usable project
+* without creating unrelated local history.
+*/
+async function scaffoldPortalProjectIntoExistingDirectory(targetPath, config) {
+	const pendingMarker = join(targetPath, PORTAL_SCAFFOLD_PENDING_MARKER);
+	const stagingRoot = await mkdtemp(join(tmpdir(), "fluid-portal-scaffold-stage-"));
+	const stagedProject = join(stagingRoot, "portal");
+	let completed = false;
+	try {
+		await writeFile(pendingMarker, "Fluid Portal scaffold pending\n");
+		await scaffoldFromBundled(stagedProject, config, false, true);
+		const preserved = await copyMissingScaffoldFiles(stagedProject, targetPath);
+		if (preserved.length > 0) console.log(chalk.dim(`  Preserved ${preserved.length} existing repository ${preserved.length === 1 ? "file" : "files"} while adding the runnable scaffold.`));
+		completed = true;
+	} finally {
+		if (completed) await rm(pendingMarker, { force: true });
+		await rm(stagingRoot, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+const PORTAL_SCAFFOLD_PENDING_MARKER = ".fluid-portal-scaffold-pending";
+async function copyMissingScaffoldFiles(sourceRoot, targetRoot, relativeDirectory = "") {
+	const preserved = [];
+	const entries = await readdir(join(sourceRoot, relativeDirectory), { withFileTypes: true });
+	for (const entry of entries) {
+		const relativePath = join(relativeDirectory, entry.name);
+		const sourcePath = join(sourceRoot, relativePath);
+		const targetPath = join(targetRoot, relativePath);
+		if (entry.isDirectory()) {
+			if (!await ensureScaffoldDirectory(targetPath)) throw new Error(`Cannot add the runnable Portal scaffold because the repository path "${relativePath}" is not a directory. The cloned repository and Git history were preserved.`);
+			preserved.push(...await copyMissingScaffoldFiles(sourceRoot, targetRoot, relativePath));
+			continue;
+		}
+		if (!entry.isFile()) throw new Error(`Portal scaffold contains an unsupported file type at ${relativePath}.`);
+		try {
+			await copyFile(sourcePath, targetPath, constants.COPYFILE_EXCL);
+		} catch (error) {
+			if (error.code !== "EEXIST") throw error;
+			preserved.push(relativePath);
+		}
+	}
+	return preserved;
+}
+async function ensureScaffoldDirectory(targetPath) {
+	try {
+		return (await lstat(targetPath)).isDirectory();
+	} catch (error) {
+		const code = error.code;
+		if (code !== "ENOENT") {
+			if (code === "ENOTDIR") return false;
+			throw error;
+		}
+	}
+	try {
+		await mkdir(targetPath);
+		return true;
+	} catch (error) {
+		const code = error.code;
+		if (code !== "EEXIST" && code !== "ENOTDIR") throw error;
+		try {
+			return (await lstat(targetPath)).isDirectory();
+		} catch (statError) {
+			if (statError.code === "ENOTDIR") return false;
+			throw statError;
+		}
+	}
+}
 //#endregion
 //#region src/commands/dev.ts
 /**
@@ -1164,6 +1559,55 @@ async function scaffoldFromBundled(targetPath, config, isLocal) {
 * or auto-pulls if they are logged in.
 */
 const PORTAL_DIR$1 = "portal";
+const WATCHED_DIRECTORIES = [
+	"portal",
+	"public",
+	"src"
+];
+const WATCHED_ROOT_FILES = new Set([
+	"index.html",
+	"package.json",
+	"tsconfig.json",
+	"vite.config.cjs",
+	"vite.config.cts",
+	"vite.config.js",
+	"vite.config.mjs",
+	"vite.config.mts",
+	"vite.config.ts"
+]);
+/**
+* Restrict Vite's root watcher to files that can affect a portal preview.
+* Directory paths themselves must remain visible to Chokidar so it can
+* descend into them and discover their files.
+*/
+function createPortalWatchIgnored(cwd) {
+	const projectRoot = resolve(cwd);
+	return (filePath) => {
+		const projectPath = relative(projectRoot, isAbsolute(filePath) ? filePath : resolve(projectRoot, filePath));
+		if (projectPath === "") return false;
+		if (projectPath === ".." || projectPath.startsWith(`..${sep}`)) return true;
+		const [topLevelPath] = projectPath.split(sep);
+		if (WATCHED_DIRECTORIES.some((directory) => topLevelPath === directory)) return false;
+		const isEnvironmentFile = projectPath === ".env" || projectPath.startsWith(".env.");
+		return !WATCHED_ROOT_FILES.has(projectPath) && !isEnvironmentFile;
+	};
+}
+function portalDevServerOptions(port, exposeToNetwork, cwd = process.cwd()) {
+	return {
+		port,
+		host: exposeToNetwork ? true : void 0,
+		watch: { ignored: createPortalWatchIgnored(cwd) }
+	};
+}
+function canFallbackToBareVite(cwd) {
+	try {
+		lstatSync(join(cwd, STANDALONE_PORTAL_MARKER));
+		return false;
+	} catch (error) {
+		if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") return true;
+		throw error;
+	}
+}
 /**
 * Check if the portal directory exists and has content files.
 * Returns true if at minimum `portal/definition.json` exists.
@@ -1191,7 +1635,7 @@ function checkDependenciesInstalled(cwd) {
 	if (existsSync(nodeModulesPath) && hasVite && hasPortalSdk) return { ok: true };
 	return {
 		ok: false,
-		message: `Dependencies aren't installed in ${cwd} — run \`pnpm install\` (or reopen the project in Mist Desktop, which installs automatically), then retry.`
+		message: `Dependencies aren't installed in ${cwd} — run \`pnpm install\`, then retry.`
 	};
 }
 /**
@@ -1203,7 +1647,7 @@ async function autoPull(cwd) {
 	console.log(chalk.yellow("No portal/ directory found.") + " Attempting to pull content...");
 	console.log();
 	try {
-		const { pullCommand } = await import("./pull-XOsFaqz2.mjs").then((n) => n.n);
+		const { pullCommand } = await import("./pull-CUR8tbW9.mjs").then((n) => n.n);
 		await pullCommand.parseAsync([], { from: "user" });
 		return hasPortalContent(cwd);
 	} catch (err) {
@@ -1256,16 +1700,18 @@ const devCommand = new Command("dev").description("Start the development server
 	const port = Number.isFinite(parsedPort) ? parsedPort : 5173;
 	try {
 		const { createServer } = await import("vite");
-		const { portalDevPlugin } = await import("./portal-dev-plugin-BHE8Z4yr.mjs").then((n) => n.n);
-		const { backendDevPlugin } = await import("./backend-dev-plugin-B9-S4Is-.mjs").then((n) => n.n);
+		const { portalDevPlugin } = await import("./portal-dev-plugin-CHlxpXc5.mjs").then((n) => n.n);
+		const { backendDevPlugin } = await import("./backend-dev-plugin-CY3yxgJ1.mjs").then((n) => n.n);
+		const { portalWidgetDevPlugin } = await import("./portal-widget-dev-plugin-B53Lf9Ke.mjs").then((n) => n.n);
 		const server = await createServer({
 			configFile: viteConfigPath,
 			envPrefix: ["VITE_", "NEXT_PUBLIC_"],
-			plugins: [portalDevPlugin(), backendDevPlugin()],
-			server: {
-				port,
-				host: options.host ? true : void 0
-			}
+			plugins: [
+				portalDevPlugin(),
+				backendDevPlugin(),
+				...portalWidgetDevPlugin()
+			],
+			server: portalDevServerOptions(port, options.host === true, cwd)
 		});
 		await server.listen();
 		server.printUrls();
@@ -1276,6 +1722,12 @@ const devCommand = new Command("dev").description("Start the development server
 		process.on("SIGTERM", shutdown);
 		await new Promise(() => {});
 	} catch (error) {
+		if (!canFallbackToBareVite(cwd)) {
+			console.error(chalk.red("Could not start the enriched standalone portal dev server."));
+			console.error(chalk.yellow("Standalone portals require the local manifest and widget plugins; bare Vite cannot serve this project correctly."));
+			console.error(error instanceof Error ? error.message : String(error));
+			process.exit(1);
+		}
 		console.warn(chalk.yellow("Could not start the enriched dev server; falling back to `vite`. Local portal content requires portalDevPlugin in vite.config for the fallback path."), error instanceof Error ? error.message : String(error));
 		try {
 			await execa("pnpm", viteArgs, {
@@ -1329,6 +1781,43 @@ const buildCommand = new Command("build").description("Build the application for
 	}
 });
 //#endregion
+//#region ../../portal/core/src/registries/container-registry.ts
+/**
+* Default container registry with LayoutWidget and ContainerWidget
+*/
+const DEFAULT_CONTAINER_REGISTRY = new Map([
+	["LayoutWidget", {
+		isContainer: true,
+		getChildren: (props) => props.children || [],
+		setChildren: (props, children) => ({
+			...props,
+			children
+		})
+	}],
+	["CardWidget", {
+		isContainer: true,
+		getChildren: (props) => props.children || [],
+		setChildren: (props, children) => ({
+			...props,
+			children
+		})
+	}],
+	["ContainerWidget", {
+		isContainer: true,
+		getChildren: (props) => props.children || [],
+		setChildren: (props, children) => ({
+			...props,
+			children
+		})
+	}]
+]);
+/**
+* Check if a widget type is a container
+*/
+function isContainerWidget(widgetType, containerRegistry) {
+	return containerRegistry.has(widgetType);
+}
+//#endregion
 //#region src/utils/push-validation.ts
 /**
 * Cross-reference validation and change categorization utilities for the push command.
@@ -1398,9 +1887,68 @@ function categorizeChanges(diff) {
 	return result;
 }
 /**
+* Faults in a screen's widget tree, as `component_tree[1].props.children[0]`
+* style paths.
+*
+* The screen check used to stop at "name is a string, component_tree is an
+* array" and never look inside. A node missing its `id` published happily —
+* `✔ Portal files valid`, live version activated — and then the admin App
+* Builder rendered the whole portal blank, in a different application, with
+* nothing pointing back at the screen. The builder backfills a missing id
+* (`widget-utils.ts`), but regenerates it per render while identity lookups
+* match on it, so such a node never reconciles.
+*
+* This matters because hand-written `component_tree` JSON is a first-class
+* path, not an edge case: it is how Mist's agent places widgets, and how
+* anything the builder cannot express gets authored.
+*
+* Deliberately conservative about what counts as a node. Only entries of
+* `component_tree` and of a node's `props.children` are checked — the two
+* places every container in `DEFAULT_CONTAINER_REGISTRY` keeps them. A blind
+* walk of every nested object would be wrong: screens are full of `type`-
+* bearing values that are NOT widgets (`background: { type: "solid" }`,
+* `dataSource: { type: "api" }`), and demanding an `id` of those would reject
+* screens that work today. A container using some other prop key is a missed
+* check, which is the safe direction for a gate that blocks publishing.
+*/
+function collectWidgetNodeErrors(nodes) {
+	return walkWidgetNodes(nodes, "component_tree", false, /* @__PURE__ */ new Map());
+}
+function walkWidgetNodes(nodes, path, nullIsAnEmptySlot, seenIds) {
+	const errors = [];
+	nodes.forEach((node, index) => {
+		const at = `${path}[${index}]`;
+		if (node === null || node === void 0) {
+			if (!nullIsAnEmptySlot) errors.push(`${at} must be a widget object.`);
+			return;
+		}
+		if (typeof node !== "object" || Array.isArray(node)) {
+			errors.push(`${at} must be a widget object.`);
+			return;
+		}
+		const record = node;
+		if (typeof record.type !== "string" || record.type.trim().length === 0) errors.push(`${at} is missing a "type".`);
+		else if (record.type !== record.type.trim()) errors.push(`${at} has a "type" with surrounding whitespace (${JSON.stringify(record.type)}). Widget types are matched exactly, so this resolves to no component and renders blank.`);
+		if (typeof record.id !== "string" || record.id.trim().length === 0) errors.push(`${at} is missing an "id". Every widget needs a stable id — without one the screen publishes but renders blank in the app builder.`);
+		else {
+			const firstClaim = seenIds.get(record.id);
+			if (firstClaim === void 0) seenIds.set(record.id, at);
+			else errors.push(`${at} reuses the id ${JSON.stringify(record.id)}, already used by ${firstClaim}. Ids must be unique within a screen — the builder resolves a widget by id and takes the first match, so duplicates make select, delete and drag-drop act on the wrong widget.`);
+		}
+		const props = record.props;
+		if (typeof props !== "object" || props === null || Array.isArray(props)) return;
+		const children = props.children;
+		if (Array.isArray(children)) errors.push(...walkWidgetNodes(children, `${at}.props.children`, true, seenIds));
+	});
+	return errors;
+}
+/**
 * Validate that all cross-references between local portal files are valid.
 *
 * Checks:
+* - New and changed resources contain the required local-file fields
+* - Every widget node in a changed screen has a string "id" and "type"
+* - New and changed themes include the required config object
 * - Navigation items' "screen" slugs reference existing screen files or mappings
 * - Profile "navigation" and "mobile_navigation" slugs reference existing nav files or mappings
 * - Profile "themes" slugs reference existing theme files or mappings
@@ -1413,9 +1961,53 @@ async function validateCrossReferences(portalDir, mappings, changes) {
 	for (const file of changes.screens.deleted) validScreenSlugs.delete(slugFromPath(file));
 	for (const file of changes.navigations.deleted) validNavSlugs.delete(slugFromPath(file));
 	for (const file of changes.themes.deleted) validThemeSlugs.delete(slugFromPath(file));
+	const screenFilesToCheck = [...changes.screens.new, ...changes.screens.changed];
+	for (const file of screenFilesToCheck) try {
+		const screen = await readPortalFile$1(portalDir, file);
+		if (typeof screen.name !== "string" || !Array.isArray(screen.component_tree)) errors.push({
+			file,
+			message: "Screen requires a string \"name\" and array \"component_tree\"."
+		});
+		else {
+			if (screen.component_tree.length > 1) errors.push({
+				file,
+				message: `"component_tree" has ${screen.component_tree.length} top-level nodes, and pushing cannot preserve that. More than one root is serialized into an untyped wrapper the admin builder cannot render, so the screen would arrive blank and uneditable. Wrap them in a single ${CONTAINER_TYPE_LIST} node and move them into its "props.children".`
+			});
+			for (const error of collectWidgetNodeErrors(screen.component_tree)) errors.push({
+				file,
+				message: error
+			});
+		}
+	} catch {
+		errors.push({
+			file,
+			message: "Failed to read screen file"
+		});
+	}
+	const themeFilesToCheck = [...changes.themes.new, ...changes.themes.changed];
+	for (const file of themeFilesToCheck) try {
+		const theme = await readPortalFile$1(portalDir, file);
+		if (typeof theme.name !== "string" || typeof theme.active !== "boolean" || !theme.config || typeof theme.config !== "object" || Array.isArray(theme.config)) errors.push({
+			file,
+			message: "Theme requires a string \"name\", boolean \"active\", and \"config\" object. Copy the complete config shape from a pulled theme instead of creating only name/active fields."
+		});
+	} catch {
+		errors.push({
+			file,
+			message: "Failed to read theme file"
+		});
+	}
 	const navFilesToCheck = [...changes.navigations.new, ...changes.navigations.changed];
 	for (const file of navFilesToCheck) try {
-		validateNavigationItems((await readPortalFile$1(portalDir, file)).navigation_items, file, validScreenSlugs, errors);
+		const nav = await readPortalFile$1(portalDir, file);
+		if (typeof nav.name !== "string" || nav.platform !== "web" && nav.platform !== "mobile" || !Array.isArray(nav.navigation_items)) {
+			errors.push({
+				file,
+				message: "Navigation requires a string \"name\", \"platform\" set to \"web\" or \"mobile\", and a \"navigation_items\" array."
+			});
+			continue;
+		}
+		validateNavigationItems(nav.navigation_items, file, validScreenSlugs, errors);
 	} catch {
 		errors.push({
 			file,
@@ -1425,6 +2017,14 @@ async function validateCrossReferences(portalDir, mappings, changes) {
 	const profileFilesToCheck = [...changes.profiles.new, ...changes.profiles.changed];
 	for (const file of profileFilesToCheck) try {
 		const profile = await readPortalFile$1(portalDir, file);
+		const permissions = profile.permissions;
+		if (typeof profile.name !== "string" || typeof profile.default !== "boolean" || !Array.isArray(profile.themes) || !permissions || !Array.isArray(permissions.countries) || !Array.isArray(permissions.ranks) || !Array.isArray(permissions.roles) || !Array.isArray(permissions.platform)) {
+			errors.push({
+				file,
+				message: "Profile requires \"name\", boolean \"default\", a \"themes\" array, and permissions arrays for countries, ranks, roles, and platform."
+			});
+			continue;
+		}
 		if (profile.navigation && !validNavSlugs.has(profile.navigation)) errors.push({
 			file,
 			message: `References navigation "${profile.navigation}" which does not exist`
@@ -1446,6 +2046,59 @@ async function validateCrossReferences(portalDir, mappings, changes) {
 	return errors;
 }
 /**
+* Warns about screens the admin visual builder will not accept drops on.
+*
+* Only container widgets receive the builder's edit-mode child-management
+* callbacks (`onAddChild`, child select/delete/duplicate), so a screen whose
+* `component_tree` has no container at the top level renders perfectly — in
+* local preview and in the live portal — while offering no drop zones at all.
+* A human opening it in the builder cannot drag anything onto the page.
+*
+* That combination (correct everywhere you can look, broken in the one place
+* you cannot) is why this is worth reporting at push time. It is the most
+* likely defect in a hand- or agent-authored screen.
+*
+* Deliberately a WARNING, never an error. Screens without a container root are
+* valid definitions that render correctly, and a repository may hold ones that
+* predate this check; failing their push would break working portals to enforce
+* an authoring convention.
+*
+* Silent on anything it cannot parse. Malformed and unreadable screens are
+* already reported as hard errors by {@link validateCrossReferences}, and a
+* second complaint about a file that never parsed would be noise.
+*/
+async function validateScreenStructure(portalDir, changes) {
+	const warnings = [];
+	const files = [...changes.screens.new, ...changes.screens.changed];
+	for (const file of files) {
+		let screen;
+		try {
+			screen = await readPortalFile$1(portalDir, file);
+		} catch {
+			continue;
+		}
+		const tree = screen.component_tree;
+		if (!Array.isArray(tree) || tree.length === 0) continue;
+		if (tree.length !== 1) continue;
+		const root = tree[0];
+		const rootType = root && typeof root === "object" ? root.type : void 0;
+		if (typeof rootType === "string" && isContainerWidget(rootType, CONTAINER_REGISTRY)) continue;
+		warnings.push({
+			file,
+			message: `No container at the top of "component_tree", so the admin builder will show no drop zones on this screen. Wrap the widgets in a ${CONTAINER_TYPE_LIST} node and move them into its "props.children".`
+		});
+	}
+	return warnings;
+}
+/**
+* Shared with the portal runtime so this check cannot drift from the behaviour
+* it predicts. `DEFAULT_CONTAINER_REGISTRY` is the same map the builder consults
+* via `isContainerWidget`.
+*/
+const CONTAINER_REGISTRY = DEFAULT_CONTAINER_REGISTRY;
+/** Rendered into the warning so it names the real options, not a stale list. */
+const CONTAINER_TYPE_LIST = [...DEFAULT_CONTAINER_REGISTRY.keys()].map((type) => `"${type}"`).join(" / ");
+/**
 * Build a set of valid slugs for a resource type by combining
 * existing mapping slugs with local file slugs on disk.
 */
@@ -1474,6 +2127,26 @@ function validateNavigationItems(items, file, validScreenSlugs, errors) {
 //#endregion
 //#region src/api/git-credential.ts
 /**
+* Portal git-credential adapter (the "invisible git" seam).
+*
+* Mints a short-lived (~1h) remote URL with an embedded installation
+* token for the portal's provisioned GitHub repo. The URL is used
+* immediately for one git op and discarded — NEVER persisted or logged.
+*
+* The backend endpoint (GitSync phase 006, portal adapter) mirrors the
+* widget contract exactly:
+*
+*   POST <endpoint>  ->  201 { git_credential: { remote_url, expires_at }, status, meta }
+*   errors: 409 not_provisioned/not_connected, 502 vendor_error, 422 else
+*           { error_message, errors: { type: [type] }, meta }
+*
+* The exact path is still being finalized as 006 lands, so it lives in
+* one constant here. Until the endpoint ships to prod a request 404s —
+* which we surface as `unavailable` so callers degrade gracefully
+* (warn + skip the git sync, proceed with the normal content push).
+*/
+/** Minted credential — token embedded in `remote_url`. Treat as secret. */
+/**
 * Build the portal git-credential path for a definition id.
 *
 * Matches GitSync Phase 006 (fluid-commerce/fluid #19596): a member
@@ -1483,15 +2156,81 @@ function validateNavigationItems(items, file, validScreenSlugs, errors) {
 function portalGitCredentialPath(definitionId) {
 	return `/api/company/fluid_os/definitions/${definitionId}/git_credential`;
 }
-function extractErrorReason(body, fallback) {
-	if (body && typeof body === "object" && "error" in body) {
-		const error = body.error;
-		if (error && typeof error === "object" && "message" in error) {
-			const message = error.message;
-			if (typeof message === "string" && message.length > 0) return message;
-		}
+const DEFAULT_RETRY_DELAYS_MS = [
+	500,
+	1e3,
+	2e3,
+	4e3,
+	8e3,
+	1e4,
+	15e3,
+	15e3
+];
+const DEFAULT_REQUEST_TIMEOUT_MS = 15e3;
+const RETRYABLE_CONFLICT_TYPES = new Set(["not_provisioned", "not_connected"]);
+const DURABLE_REPO_STATUSES = new Set(["disconnected"]);
+function nonEmptyString(value) {
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function firstString(value) {
+	if (Array.isArray(value)) return nonEmptyString(value[0]);
+	return nonEmptyString(value);
+}
+function apiErrorBody(error) {
+	if (error.data !== null && typeof error.data === "object" && ("error" in error.data || "error_message" in error.data || "errors" in error.data)) return error.data;
+	return {
+		error_message: error.message,
+		errors: error.data
+	};
+}
+function extractErrorDetails(body, fallback) {
+	if (!body || typeof body !== "object") return { reason: fallback };
+	const envelope = body;
+	const error = envelope.error && typeof envelope.error === "object" ? envelope.error : void 0;
+	const nestedDetails = error?.details && typeof error.details === "object" ? error.details : void 0;
+	const errors = envelope.errors && typeof envelope.errors === "object" ? envelope.errors : void 0;
+	const reason = nonEmptyString(envelope.error_message) ?? nonEmptyString(error?.message) ?? nonEmptyString(envelope.error) ?? fallback;
+	const failureType = firstString(errors?.type) ?? nonEmptyString(nestedDetails?.type);
+	const repoStatus = firstString(errors?.repo_status) ?? nonEmptyString(nestedDetails?.repo_status);
+	return {
+		reason,
+		...failureType ? { failureType } : {},
+		...repoStatus ? { repoStatus } : {}
+	};
+}
+function sleep(delayMs) {
+	return new Promise((resolve) => {
+		setTimeout(resolve, delayMs);
+	});
+}
+/**
+* Retry clone-credential conflicts while the backend provisions or revives
+* the portal's repository. The first credential request is the trigger for
+* older definitions with no repo, so a single-shot clone would always fail
+* even though the repository becomes ready seconds later.
+*/
+async function createPortalGitCredentialWithRetry(options) {
+	const retryDelaysMs = options.retryDelaysMs ?? DEFAULT_RETRY_DELAYS_MS;
+	const sleepImpl = options.sleepImpl ?? sleep;
+	const requestOptions = {
+		baseUrl: options.baseUrl,
+		token: options.token,
+		definitionId: options.definitionId,
+		...options.fetchImpl !== void 0 ? { fetchImpl: options.fetchImpl } : {},
+		...options.requestTimeoutMs !== void 0 ? { requestTimeoutMs: options.requestTimeoutMs } : {}
+	};
+	let outcome = await createPortalGitCredential(requestOptions);
+	for (const [index, delayMs] of retryDelaysMs.entries()) {
+		if (outcome.status !== "unavailable" || !outcome.retryable) return outcome;
+		options.onRetry?.({
+			attempt: index + 2,
+			totalAttempts: retryDelaysMs.length + 1,
+			reason: outcome.reason
+		});
+		await sleepImpl(delayMs);
+		outcome = await createPortalGitCredential(requestOptions);
 	}
-	return fallback;
+	return outcome;
 }
 /**
 * Request a git credential for the portal definition's provisioned repo.
@@ -1502,47 +2241,65 @@ function extractErrorReason(body, fallback) {
 async function createPortalGitCredential(options) {
 	const { baseUrl, token, definitionId } = options;
 	const fetchImpl = options.fetchImpl ?? fetch;
-	const url = `${baseUrl.replace(/\/$/, "")}${portalGitCredentialPath(definitionId)}`;
-	let resp;
+	const requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+	const abortController = new AbortController();
+	let requestTimedOut = false;
+	const timeout = setTimeout(() => {
+		requestTimedOut = true;
+		abortController.abort();
+	}, requestTimeoutMs);
 	try {
-		resp = await fetchImpl(url, {
-			method: "POST",
-			headers: {
-				Authorization: `Bearer ${token}`,
-				Accept: "application/json"
-			}
-		});
+		const credential = (await fluidOsV0DefinitionGitCredentialCreate({
+			client: createFluidOsHeyApiClient({
+				baseUrl,
+				fetch: fetchImpl,
+				getAuthToken: () => token
+			}),
+			path: { id: definitionId },
+			signal: abortController.signal
+		})).git_credential;
+		if (!credential?.remote_url) return {
+			status: "error",
+			reason: "git credential response missing remote_url"
+		};
+		return {
+			status: "ok",
+			credential
+		};
 	} catch (err) {
+		if (requestTimedOut) return {
+			status: "error",
+			reason: `git credential request timed out after ${requestTimeoutMs}ms`
+		};
+		if (err instanceof ApiError) {
+			if (err.status === 404) return {
+				status: "unavailable",
+				reason: "git sync isn't available for portals on this Fluid API yet",
+				retryable: false
+			};
+			const details = extractErrorDetails(apiErrorBody(err), `git credential request failed (HTTP ${err.status})`);
+			if (err.status === 409) {
+				const durable = details.repoStatus !== void 0 && DURABLE_REPO_STATUSES.has(details.repoStatus);
+				return {
+					status: "unavailable",
+					reason: details.reason,
+					retryable: !durable && details.failureType !== void 0 && RETRYABLE_CONFLICT_TYPES.has(details.failureType),
+					...details.failureType !== void 0 ? { conflictType: details.failureType } : {},
+					...details.repoStatus !== void 0 ? { repoStatus: details.repoStatus } : {}
+				};
+			}
+			return {
+				status: "error",
+				reason: details.reason
+			};
+		}
 		return {
 			status: "error",
 			reason: err instanceof Error ? err.message : String(err)
 		};
+	} finally {
+		clearTimeout(timeout);
 	}
-	if (resp.status === 404) return {
-		status: "unavailable",
-		reason: "git sync isn't available for portals on this Fluid API yet"
-	};
-	const body = await resp.json().catch(() => null);
-	if (!resp.ok) {
-		const reason = extractErrorReason(body, `git credential request failed (HTTP ${resp.status})`);
-		if (resp.status === 409) return {
-			status: "unavailable",
-			reason
-		};
-		return {
-			status: "error",
-			reason
-		};
-	}
-	const credential = body?.git_credential;
-	if (!credential?.remote_url) return {
-		status: "error",
-		reason: "git credential response missing remote_url"
-	};
-	return {
-		status: "ok",
-		credential
-	};
 }
 //#endregion
 //#region src/lib/git-sync.ts
@@ -1556,6 +2313,9 @@ async function createPortalGitCredential(options) {
 * (no git, no repo, credential endpoint missing, diverged history,
 * network blip) degrades to a skip so the content push always proceeds.
 */
+/** Subject for the index-only commit that untracks leaked Desktop state.
+*  Kept distinct from the publish message so the history explains itself. */
+const PURGE_COMMIT_MESSAGE = "Remove private Mist Desktop state from the portal repository";
 /**
 * Run the best-effort git sync. Returns a result describing what
 * happened; never throws. Callers surface `skipped` reasons as a dim
@@ -1568,6 +2328,7 @@ async function runPortalGitSync(options) {
 		status: "skipped",
 		reason: "not a git repository"
 	};
+	await ensureLocalStateExcluded(cwd);
 	const outcome = await createPortalGitCredential({
 		baseUrl,
 		token,
@@ -1594,6 +2355,7 @@ async function runPortalGitSync(options) {
 				await gitFetch(cwd, remoteUrl, branch);
 				await gitAdoptFetchHead(cwd);
 			}
+			await purgeLocalStateFromIndex(cwd, PURGE_COMMIT_MESSAGE);
 			if (await hasUncommittedChanges(cwd)) await gitAutoCommit(cwd, commitMessage, { ignoreRemovals: true });
 			return await pushCommitted(cwd, remoteUrl, branch);
 		}
@@ -1614,6 +2376,7 @@ async function runPortalGitSync(options) {
 			};
 			await gitMergeFastForward(cwd);
 		}
+		await purgeLocalStateFromIndex(cwd, PURGE_COMMIT_MESSAGE);
 		if (await hasUncommittedChanges(cwd)) await gitAutoCommit(cwd, commitMessage);
 		return await pushCommitted(cwd, remoteUrl, branch);
 	} catch (err) {
@@ -1655,6 +2418,9 @@ async function pushCommitted(cwd, remoteUrl, branch) {
 * Detects changes since the last pull/push via snapshot diffing,
 * validates cross-references, and pushes resources in dependency order.
 */
+var NavigationRemoteStateUnknownError = class extends Error {
+	name = "NavigationRemoteStateUnknownError";
+};
 const PORTAL_DIR = "portal";
 const PORTAL_SYNC_DIR$1 = ".portal-sync";
 /**
@@ -1668,7 +2434,7 @@ function toApiComponentTree(tree) {
 	return { children: tree };
 }
 /**
-* Create an authenticated FetchClient using the stored CLI profile.
+* Create an authenticated FluidOsClient using the stored CLI profile.
 */
 function createClient$2() {
 	const token = getAuthToken();
@@ -1677,11 +2443,33 @@ function createClient$2() {
 		if (!profile) throw new Error("Not logged in. Run " + chalk.cyan("fluid login") + " first.");
 		throw new Error("No auth token found for profile " + chalk.cyan(profile.name) + ". Run " + chalk.cyan("fluid login") + " to re-authenticate.");
 	}
-	return createFetchClient({
+	return createFluidOsClient({
 		baseUrl: process.env["FLUID_API_BASE"] ?? "https://api.fluid.app",
-		getAuthToken: () => token
+		token
 	});
 }
+async function createAndActivateVersion(client, definitionId) {
+	const versionId = (await fluidOsApi.createVersion(client, definitionId)).version?.id;
+	if (!versionId) throw new Error("the version API returned no version ID");
+	await fluidOsApi.updateVersion(client, definitionId, versionId, { version: { active: true } });
+	return String(versionId);
+}
+async function activateDraft(definitionId, existingClient) {
+	const spinner = ora("Creating and activating a live version...");
+	spinner.start();
+	try {
+		const versionId = await createAndActivateVersion(existingClient ?? createClient$2(), definitionId);
+		spinner.succeed(`Live version ${versionId} activated`);
+		return true;
+	} catch (err) {
+		spinner.fail("Could not activate a live version");
+		console.log();
+		console.log(chalk.red("Error:") + " " + (err instanceof Error ? err.message : String(err)));
+		console.log();
+		process.exitCode = 1;
+		return false;
+	}
+}
 /**
 * Extract an enriched error message from a caught value.
 * Includes structured API error data when available.
@@ -1691,6 +2479,18 @@ function enrichedErrorMessage(err) {
 	if (err && typeof err === "object" && "data" in err) msg += ` — ${JSON.stringify(err.data)}`;
 	return msg;
 }
+function navigationPushFailure(err, remoteChangesComplete) {
+	const error = enrichedErrorMessage(err);
+	if (err instanceof NavigationRemoteStateUnknownError) return {
+		advanceSnapshot: true,
+		error
+	};
+	if (!remoteChangesComplete) return { error };
+	return {
+		advanceSnapshot: true,
+		error: `Remote changes were applied before the push failed: ${error}. Run fluid portal pull before editing or pushing again.`
+	};
+}
 /**
 * Best-effort "invisible git" sync: commit the local project and push it
 * to the portal's provisioned GitHub repo before the content push.
@@ -1739,10 +2539,10 @@ async function pushScreens(client, defId, portalDir, changes, mappings) {
 		const slug = slugFromPath(file);
 		try {
 			const local = await readPortalFile(portalDir, file);
-			const newId = (await fluid_os_v0_create_fluid_osscreen(client, defId, { screen: {
+			const newId = (await fluidOsApi.createScreen(client, defId, { screen: {
 				name: local.name,
 				slug,
-				component_tree: toApiComponentTree(local.component_tree)
+				component_tree: toFluidOsDynamicObject(toApiComponentTree(local.component_tree))
 			} })).screen?.id;
 			if (newId != null) currentMappings = updateMapping(currentMappings, "screens", slug, newId);
 			results.push({
@@ -1780,10 +2580,10 @@ async function pushScreens(client, defId, portalDir, changes, mappings) {
 		}
 		try {
 			const local = await readPortalFile(portalDir, file);
-			await fluid_os_v0_update_fluid_osscreen(client, defId, screenId, { screen: {
+			await fluidOsApi.updateScreen(client, defId, screenId, { screen: {
 				name: local.name,
 				slug,
-				component_tree: toApiComponentTree(local.component_tree)
+				component_tree: toFluidOsDynamicObject(toApiComponentTree(local.component_tree))
 			} });
 			results.push({
 				file,
@@ -1819,7 +2619,7 @@ async function pushScreens(client, defId, portalDir, changes, mappings) {
 			};
 		}
 		try {
-			await fluid_os_v0_delete_fluid_osscreen(client, defId, screenId);
+			await fluidOsApi.deleteScreen(client, defId, screenId);
 			currentMappings = removeMapping(currentMappings, "screens", slug);
 			results.push({
 				file,
@@ -1854,10 +2654,10 @@ async function pushThemes(client, defId, portalDir, changes, mappings) {
 		const slug = slugFromPath(file);
 		try {
 			const local = await readPortalFile(portalDir, file);
-			const newId = (await fluid_os_v0_create_fluid_ostheme(client, defId, { theme: {
+			const newId = (await fluidOsApi.createTheme(client, defId, { theme: {
 				name: local.name,
 				active: local.active,
-				config: local.config
+				config: toFluidOsDynamicObject(local.config)
 			} })).theme?.id;
 			if (newId != null) currentMappings = updateMapping(currentMappings, "themes", slug, newId);
 			results.push({
@@ -1895,10 +2695,10 @@ async function pushThemes(client, defId, portalDir, changes, mappings) {
 		}
 		try {
 			const local = await readPortalFile(portalDir, file);
-			await fluid_os_v0_update_fluid_ostheme(client, defId, themeId, { theme: {
+			await fluidOsApi.updateTheme(client, defId, themeId, { theme: {
 				name: local.name,
 				active: local.active,
-				config: local.config
+				config: toFluidOsDynamicObject(local.config)
 			} });
 			results.push({
 				file,
@@ -1934,7 +2734,7 @@ async function pushThemes(client, defId, portalDir, changes, mappings) {
 			};
 		}
 		try {
-			await fluid_os_v0_delete_fluid_ostheme(client, defId, themeId);
+			await fluidOsApi.deleteTheme(client, defId, themeId);
 			currentMappings = removeMapping(currentMappings, "themes", slug);
 			results.push({
 				file,
@@ -1985,36 +2785,141 @@ function resolveNavigationItemScreenIds(items, mappings) {
 * The API reconciliation logic requires a flat list to correctly
 * compare against the flat server response.
 */
-function flattenNavigationItems(items) {
-	const flat = [];
+function flattenNavigationItems(items, treeParentIndex, flat = []) {
 	for (const item of items) {
 		const { children, ...rest } = item;
-		flat.push(rest);
-		if (children && children.length > 0) flat.push(...flattenNavigationItems(children));
+		const itemIndex = flat.length;
+		flat.push({
+			...rest,
+			treeParentIndex
+		});
+		if (children && children.length > 0) flattenNavigationItems(children, itemIndex, flat);
+	}
+	return flat;
+}
+/**
+* The navigation-items index returns root items with descendants nested under
+* `children`. Flatten descendants first so removals cannot orphan or revisit a
+* child when its parent is also deleted.
+*/
+function flattenServerNavigationItems(items, flat = []) {
+	for (const item of items) {
+		flattenServerNavigationItems(item.children ?? [], flat);
+		flat.push(item);
 	}
 	return flat;
 }
+function resolveNavigationItemParentId(item, serverIdByItemIndex) {
+	if (item.treeParentIndex != null) {
+		const serverParentId = serverIdByItemIndex.get(item.treeParentIndex);
+		if (serverParentId == null) throw new Error("Failed to resolve the server ID for a nested navigation item's parent");
+		return serverParentId;
+	}
+	return null;
+}
+async function resolveCreatedNavigationItemId(client, defId, navigationId, responseId, knownServerIds, requestedItem, file) {
+	if (responseId != null) {
+		knownServerIds.add(responseId);
+		return responseId;
+	}
+	let response;
+	try {
+		response = await fluidOsApi.listNavigationItems(client, defId, navigationId);
+	} catch (recoveryError) {
+		throw new NavigationRemoteStateUnknownError(`Remote navigation state is unknown because item creation succeeded without returning its required ID, and the recovery read failed: ${enrichedErrorMessage(recoveryError)}. Back up ${file}, run fluid portal pull, then reapply pending edits before pushing again.`);
+	}
+	const unseenItems = flattenServerNavigationItems(response.navigation_items ?? []).filter((item) => !knownServerIds.has(item.id));
+	const matchingItems = unseenItems.filter((item) => (item.label ?? "") === requestedItem.label && (item.position ?? 0) === requestedItem.position && (item.icon ?? void 0) === requestedItem.icon && (item.screen_id ?? void 0) === requestedItem.screen_id && (item.slug ?? void 0) === requestedItem.slug && (item.source ?? "user") === (requestedItem.source ?? "user") && (item.parent_id ?? null) === (requestedItem.parent_id ?? null));
+	if (unseenItems.length !== 1 || matchingItems.length !== 1) throw new NavigationRemoteStateUnknownError(`Remote navigation state is unknown because item creation succeeded without returning its required ID, and recovery found ${matchingItems.length} matching items among ${unseenItems.length} new server items. Back up ${file}, run fluid portal pull, then reapply pending edits before pushing again.`);
+	const recoveredId = matchingItems[0]?.id;
+	if (recoveredId == null) throw new NavigationRemoteStateUnknownError(`Remote navigation state is unknown because item creation succeeded without returning its required ID. Back up ${file}, run fluid portal pull, then reapply pending edits before pushing again.`);
+	knownServerIds.add(recoveredId);
+	return recoveredId;
+}
+function assignNavigationItemId(navigation, targetIndex, serverId) {
+	let currentIndex = 0;
+	let previousId;
+	function assign(items) {
+		return items.map((item) => {
+			const itemIndex = currentIndex++;
+			const children = assign(item.children ?? []);
+			if (itemIndex !== targetIndex) return {
+				...item,
+				children
+			};
+			previousId = item.id;
+			return {
+				...item,
+				id: serverId,
+				children
+			};
+		});
+	}
+	function rewriteParentIds(items) {
+		return items.map((item) => ({
+			...item,
+			parent_id: item.parent_id === previousId ? serverId : item.parent_id,
+			children: rewriteParentIds(item.children ?? [])
+		}));
+	}
+	const navigationItems = assign(navigation.navigation_items);
+	return {
+		...navigation,
+		navigation_items: previousId == null || previousId === serverId ? navigationItems : rewriteParentIds(navigationItems)
+	};
+}
+async function persistCreatedNavigationItemId(client, defId, navigationId, portalDir, file, navigation, itemIndex, serverId) {
+	const updated = assignNavigationItemId(navigation, itemIndex, serverId);
+	try {
+		await atomicWriteFile(join(portalDir, file), JSON.stringify(updated, null, 2) + "\n");
+	} catch (persistError) {
+		try {
+			await fluidOsApi.deleteNavigationItem(client, defId, navigationId, serverId);
+		} catch (rollbackError) {
+			throw new NavigationRemoteStateUnknownError(`Failed to persist navigation item ${serverId} locally: ${enrichedErrorMessage(persistError)}. Automatic rollback also failed: ${enrichedErrorMessage(rollbackError)}. Back up ${file}, run fluid portal pull, then reapply pending edits before pushing again.`);
+		}
+		throw persistError;
+	}
+	return updated;
+}
+/**
+* Replace a pushed navigation file with the authoritative server tree.
+* New navigation items receive their IDs from the server, so the local file
+* must be reconciled before the push snapshot hashes it.
+*/
+async function reconcileNavigationFile(client, defId, navId, portalDir, file, local, mappings) {
+	const response = await fluidOsApi.listNavigationItems(client, defId, navId);
+	const reconciled = {
+		...local,
+		navigation_items: transformNavigationItems(response.navigation_items ?? [], buildIdToSlugMap(mappings.screens))
+	};
+	await atomicWriteFile(join(portalDir, file), JSON.stringify(reconciled, null, 2) + "\n");
+}
 /**
 * Push navigation changes to the API.
 */
 async function pushNavigations(client, defId, portalDir, changes, mappings) {
 	const results = [];
 	let currentMappings = mappings;
-	for (const file of changes.new) {
+	const newFiles = changes.new.filter((file) => resolveSlugToId(currentMappings, "navigations", slugFromPath(file)) == null);
+	const changedFiles = [...changes.changed, ...changes.new.filter((file) => resolveSlugToId(currentMappings, "navigations", slugFromPath(file)) != null)];
+	for (const file of newFiles) {
 		const slug = slugFromPath(file);
+		let remoteChangesComplete = false;
 		try {
-			const local = await readPortalFile(portalDir, file);
-			const newId = (await fluid_os_v0_create_fluid_osnavigation(client, defId, { navigation: {
+			let local = await readPortalFile(portalDir, file);
+			const newId = (await fluidOsApi.createNavigation(client, defId, { navigation: {
 				name: local.name,
 				platform: local.platform
 			} })).navigation?.id;
 			if (newId != null) {
 				currentMappings = updateMapping(currentMappings, "navigations", slug, newId);
 				const resolvedItems = flattenNavigationItems(resolveNavigationItemScreenIds(local.navigation_items, currentMappings));
-				const localToServerId = /* @__PURE__ */ new Map();
-				for (const item of resolvedItems) {
-					const resolvedParentId = item.parent_id != null ? localToServerId.get(item.parent_id) ?? item.parent_id : void 0;
-					const created = await fluid_os_v0_create_fluid_osnavigation_item(client, defId, newId, { navigation_item: {
+				const serverIdByItemIndex = /* @__PURE__ */ new Map();
+				const knownServerIds = /* @__PURE__ */ new Set();
+				for (const [itemIndex, item] of resolvedItems.entries()) {
+					const resolvedParentId = resolveNavigationItemParentId(item, serverIdByItemIndex);
+					const createBody = {
 						label: item.label ?? "",
 						position: item.position ?? 0,
 						icon: item.icon ?? void 0,
@@ -2022,9 +2927,13 @@ async function pushNavigations(client, defId, portalDir, changes, mappings) {
 						slug: item.slug ?? void 0,
 						source: item.source ?? void 0,
 						parent_id: resolvedParentId
-					} });
-					if (item.id != null && created.navigation_item?.id != null) localToServerId.set(item.id, created.navigation_item.id);
+					};
+					const createdId = await resolveCreatedNavigationItemId(client, defId, newId, (await fluidOsApi.createNavigationItem(client, defId, newId, { navigation_item: createBody })).navigation_item?.id, knownServerIds, createBody, file);
+					local = await persistCreatedNavigationItemId(client, defId, newId, portalDir, file, local, itemIndex, createdId);
+					serverIdByItemIndex.set(itemIndex, createdId);
 				}
+				remoteChangesComplete = true;
+				await reconcileNavigationFile(client, defId, newId, portalDir, file, local, currentMappings);
 			}
 			results.push({
 				file,
@@ -2036,7 +2945,7 @@ async function pushNavigations(client, defId, portalDir, changes, mappings) {
 				file,
 				action: "created",
 				success: false,
-				error: enrichedErrorMessage(err)
+				...navigationPushFailure(err, remoteChangesComplete)
 			});
 			return {
 				results,
@@ -2044,7 +2953,7 @@ async function pushNavigations(client, defId, portalDir, changes, mappings) {
 			};
 		}
 	}
-	for (const file of changes.changed) {
+	for (const file of changedFiles) {
 		const slug = slugFromPath(file);
 		const navId = resolveSlugToId(currentMappings, "navigations", slug);
 		if (navId == null) {
@@ -2059,20 +2968,21 @@ async function pushNavigations(client, defId, portalDir, changes, mappings) {
 				mappings: currentMappings
 			};
 		}
+		let remoteChangesComplete = false;
 		try {
-			const local = await readPortalFile(portalDir, file);
-			await fluid_os_v0_update_fluid_osnavigation(client, defId, navId, { navigation: {
+			let local = await readPortalFile(portalDir, file);
+			await fluidOsApi.updateNavigation(client, defId, navId, { navigation: {
 				name: local.name,
 				platform: local.platform
 			} });
 			const resolvedItems = flattenNavigationItems(resolveNavigationItemScreenIds(local.navigation_items, currentMappings));
-			const serverItems = (await fluid_os_v0_list_fluid_osnavigation_items(client, defId, navId)).navigation_items ?? [];
+			const serverItems = flattenServerNavigationItems((await fluidOsApi.listNavigationItems(client, defId, navId)).navigation_items ?? []);
 			const serverById = new Map(serverItems.map((s) => [s.id, s]));
+			const knownServerIds = new Set(serverById.keys());
 			const localIds = new Set(resolvedItems.filter((i) => i.id).map((i) => i.id));
-			for (const serverItem of serverItems) if (!localIds.has(serverItem.id)) await fluid_os_v0_delete_fluid_osnavigation_item(client, defId, navId, serverItem.id);
-			const localToServerId = /* @__PURE__ */ new Map();
-			for (const item of resolvedItems) {
-				const resolvedParentId = item.parent_id != null ? localToServerId.get(item.parent_id) ?? item.parent_id : void 0;
+			const serverIdByItemIndex = /* @__PURE__ */ new Map();
+			for (const [itemIndex, item] of resolvedItems.entries()) {
+				const resolvedParentId = resolveNavigationItemParentId(item, serverIdByItemIndex);
 				const body = {
 					label: item.label,
 					position: item.position,
@@ -2082,16 +2992,23 @@ async function pushNavigations(client, defId, portalDir, changes, mappings) {
 					source: item.source ?? void 0,
 					parent_id: resolvedParentId
 				};
-				if (item.id && serverById.has(item.id)) await fluid_os_v0_update_fluid_osnavigation_item(client, defId, navId, item.id, { navigation_item: body });
-				else {
-					const created = await fluid_os_v0_create_fluid_osnavigation_item(client, defId, navId, { navigation_item: {
+				if (item.id && serverById.has(item.id)) {
+					await fluidOsApi.updateNavigationItem(client, defId, navId, item.id, { navigation_item: body });
+					serverIdByItemIndex.set(itemIndex, item.id);
+				} else {
+					const createBody = {
 						...body,
 						label: body.label ?? "",
 						position: body.position ?? 0
-					} });
-					if (item.id != null && created.navigation_item?.id != null) localToServerId.set(item.id, created.navigation_item.id);
+					};
+					const createdId = await resolveCreatedNavigationItemId(client, defId, navId, (await fluidOsApi.createNavigationItem(client, defId, navId, { navigation_item: createBody })).navigation_item?.id, knownServerIds, createBody, file);
+					local = await persistCreatedNavigationItemId(client, defId, navId, portalDir, file, local, itemIndex, createdId);
+					serverIdByItemIndex.set(itemIndex, createdId);
 				}
 			}
+			for (const serverItem of serverItems) if (!localIds.has(serverItem.id)) await fluidOsApi.deleteNavigationItem(client, defId, navId, serverItem.id);
+			remoteChangesComplete = true;
+			await reconcileNavigationFile(client, defId, navId, portalDir, file, local, currentMappings);
 			results.push({
 				file,
 				action: "updated",
@@ -2102,7 +3019,7 @@ async function pushNavigations(client, defId, portalDir, changes, mappings) {
 				file,
 				action: "updated",
 				success: false,
-				error: enrichedErrorMessage(err)
+				...navigationPushFailure(err, remoteChangesComplete)
 			});
 			return {
 				results,
@@ -2126,7 +3043,7 @@ async function pushNavigations(client, defId, portalDir, changes, mappings) {
 			};
 		}
 		try {
-			await fluid_os_v0_delete_fluid_osnavigation(client, defId, navId);
+			await fluidOsApi.deleteNavigation(client, defId, navId);
 			currentMappings = removeMapping(currentMappings, "navigations", slug);
 			results.push({
 				file,
@@ -2160,7 +3077,8 @@ async function pushProfiles(client, defId, portalDir, changes, mappings) {
 	for (const file of changes.new) {
 		const slug = slugFromPath(file);
 		try {
-			const newId = (await fluid_os_v0_create_fluid_osprofile(client, defId, { profile: resolveProfileBody(await readPortalFile(portalDir, file), currentMappings) })).profile?.id;
+			const body = resolveProfileBody(await readPortalFile(portalDir, file), currentMappings);
+			const newId = (await fluidOsApi.createProfile(client, defId, { profile: body })).profile?.id;
 			if (newId != null) currentMappings = updateMapping(currentMappings, "profiles", slug, newId);
 			results.push({
 				file,
@@ -2196,7 +3114,8 @@ async function pushProfiles(client, defId, portalDir, changes, mappings) {
 			};
 		}
 		try {
-			await fluid_os_v0_update_fluid_osprofile(client, defId, profileId, { profile: resolveProfileBody(await readPortalFile(portalDir, file), currentMappings) });
+			const body = resolveProfileBody(await readPortalFile(portalDir, file), currentMappings);
+			await fluidOsApi.updateProfile(client, defId, profileId, { profile: body });
 			results.push({
 				file,
 				action: "updated",
@@ -2231,7 +3150,7 @@ async function pushProfiles(client, defId, portalDir, changes, mappings) {
 			};
 		}
 		try {
-			await fluid_os_v0_delete_fluid_osprofile(client, defId, profileId);
+			await fluidOsApi.deleteProfile(client, defId, profileId);
 			currentMappings = removeMapping(currentMappings, "profiles", slug);
 			results.push({
 				file,
@@ -2302,8 +3221,9 @@ function printPushReport(results, skippedPhases) {
 		for (const phase of skippedPhases) console.log(chalk.yellow("  " + phase));
 	}
 }
-const pushCommand = new Command("push").description("Push local portal content changes to the Fluid OS API").option("--yes", "Skip confirmation prompt").action(async (options) => {
+const pushCommand = new Command("push").description("Push local portal content changes to the Fluid OS API").option("--yes", "Skip confirmation prompt").option("--activate", "Create and activate a live version after a successful push").action(async (options) => {
 	const cwd = process.cwd();
+	await assertStandalonePortalRemoteActionAllowed(cwd, "portal push");
 	const portalDir = join(cwd, PORTAL_DIR);
 	const portalSyncDir = join(cwd, PORTAL_SYNC_DIR$1);
 	console.log();
@@ -2341,6 +3261,10 @@ const pushCommand = new Command("push").description("Push local portal content c
 	if (totalChanges === 0) {
 		spinner.succeed("Nothing to push.");
 		console.log();
+		if (options.activate) {
+			await activateDraft(definitionId);
+			console.log();
+		}
 		return;
 	}
 	spinner.succeed(`Found ${totalChanges} change(s)`);
@@ -2362,16 +3286,22 @@ const pushCommand = new Command("push").description("Push local portal content c
 		console.log();
 	}
 	const changes = categorizeChanges(diff);
-	spinner.start("Validating cross-references...");
+	spinner.start("Validating portal files...");
 	const validationErrors = await validateCrossReferences(portalDir, mappings, changes);
 	if (validationErrors.length > 0) {
-		spinner.fail("Cross-reference validation failed");
+		spinner.fail("Portal file validation failed");
 		console.log();
 		for (const err of validationErrors) console.log(chalk.red("  " + err.file + ": ") + err.message);
 		console.log();
 		process.exit(1);
 	}
-	spinner.succeed("Cross-references valid");
+	spinner.succeed("Portal files valid");
+	const structureWarnings = await validateScreenStructure(portalDir, changes);
+	if (structureWarnings.length > 0) {
+		console.log();
+		for (const warning of structureWarnings) console.log(chalk.yellow("  warning  ") + chalk.white(warning.file + ": ") + warning.message);
+		console.log();
+	}
 	spinner.start("Authenticating...");
 	let client;
 	try {
@@ -2442,10 +3372,10 @@ const pushCommand = new Command("push").description("Push local portal content c
 		else spinner.succeed("Phase 3 complete");
 	}
 	await writeMappings(portalSyncDir, currentMappings);
-	const successfulFiles = new Set(allResults.filter((r) => r.success).map((r) => r.file));
-	if (successfulFiles.size > 0) {
+	const filesToSnapshot = new Set(allResults.filter((r) => r.success || r.advanceSnapshot).map((r) => r.file));
+	if (filesToSnapshot.size > 0) {
 		const updatedHashes = { ...snapshot.files };
-		for (const file of successfulFiles) {
+		for (const file of filesToSnapshot) {
 			const fullPath = join(portalDir, file);
 			if (existsSync(fullPath)) updatedHashes[file] = await computeFileHash(fullPath);
 			else delete updatedHashes[file];
@@ -2456,11 +3386,20 @@ const pushCommand = new Command("push").description("Push local portal content c
 		});
 	}
 	console.log();
-	if (allResults.every((r) => r.success) && !aborted) console.log(chalk.green.bold("Push complete!"));
+	const allSucceeded = allResults.every((r) => r.success);
+	if (allSucceeded && !aborted) console.log(chalk.green.bold("Push complete!"));
 	else console.log(chalk.yellow.bold("Push completed with issues:"));
 	console.log();
 	printPushReport(allResults, skippedPhases);
 	console.log();
+	if (!allSucceeded || aborted) {
+		process.exitCode = 1;
+		return;
+	}
+	if (options.activate) {
+		await activateDraft(definitionId, client);
+		console.log();
+	}
 });
 //#endregion
 //#region src/commands/clone.ts
@@ -2470,25 +3409,93 @@ const pushCommand = new Command("push").description("Push local portal content c
 * `./<slug>/`. Mirrors `fluid mist clone` (credential → clone), but
 * against the portal git-credential endpoint.
 *
-* The credential endpoint is part of GitSync phase 006; until it ships
-* the request 404s and we print a friendly "not available yet" message
-* instead of a raw git error.
+* When the credential endpoint reports that no repository is available
+* (the repo was torn down, provisioning failed, it is still not ready
+* after the retry budget, or the endpoint isn't deployed), clone falls
+* back to scaffolding the portal locally from the bundled starter
+* template instead of failing. Local files plus API sync
+* (`fluid portal push`/`pull`) are a fully functional portal — Git is
+* an optional sync channel, not a prerequisite — so the user still
+* lands in a working project and Git history can attach later via
+* `fluid portal push`, which adopts the remote's history.
 */
 function getBaseUrl() {
 	return process.env["FLUID_API_BASE"] ?? "https://api.fluid.app";
 }
+async function removeIncompleteCheckout(targetDir) {
+	try {
+		await rm(targetDir, {
+			recursive: true,
+			force: true
+		});
+		return null;
+	} catch (error) {
+		return error instanceof Error ? error.message : String(error);
+	}
+}
 function createClient$1(token) {
-	return createFetchClient({
+	return createFluidOsClient({
 		baseUrl: getBaseUrl(),
-		getAuthToken: () => token
+		token
 	});
 }
+/**
+* Human message for the git-sync-unavailable fallback, split by conflict
+* type. `not_connected` is a durable state (the company's Git integration
+* isn't connected), so it must not claim that waiting will fix anything;
+* `not_provisioned` genuinely may resolve later, so it says so.
+*/
+function gitSyncUnavailableNotice(outcome) {
+	const attachHint = `Creating the portal locally from the starter template so you can start now — ${chalk.cyan("fluid portal push")}/${chalk.cyan("pull")} sync content without Git, and Git history can attach later with ${chalk.cyan("fluid portal push")}.`;
+	if (outcome.repoStatus === "disconnected") return `The portal's Git repository was disconnected, so there is nothing to clone. ${attachHint}`;
+	if (outcome.repoStatus === "error") return `The portal's Git repository failed to provision. ${attachHint}`;
+	if (outcome.conflictType === "not_connected") return "The portal's Git repository is still being provisioned — it didn't come online in time. " + attachHint;
+	if (outcome.conflictType === "not_provisioned") return `The portal's Git repository isn't provisioned yet. ${attachHint}`;
+	return `Git sync isn't available (${outcome.reason}). ${attachHint}`;
+}
+/**
+* A git-less fallback scaffold that failed or was interrupted leaves the
+* pending marker behind with no `.git`. Only that exact shape is safe to
+* resume — anything else is an unrelated pre-existing directory.
+*/
+async function canResumeGitlessPortalScaffold(targetDir) {
+	return await fileExists(join(targetDir, ".fluid-portal-scaffold-pending")) && !existsSync(join(targetDir, ".git"));
+}
+async function canResumePortalScaffold(targetDir, credentialRemoteUrl) {
+	if (!await fileExists(join(targetDir, ".fluid-portal-scaffold-pending")) || !await isGitRepo(targetDir)) return false;
+	const origin = await getOriginUrl(targetDir);
+	if (!origin) return false;
+	const expected = cleanGitRemoteUrl(credentialRemoteUrl);
+	return origin.replace(/\/$/, "") === expected.replace(/\/$/, "");
+}
+function resolveDefinition(definitions, appName, rawDefinitionId) {
+	if (rawDefinitionId !== void 0) {
+		if (!/^[1-9]\d*$/.test(rawDefinitionId)) throw new Error("--id must be a positive integer");
+		const definitionId = Number.parseInt(rawDefinitionId, 10);
+		const match = definitions.find((definition) => definition.id === definitionId);
+		if (!match) throw new Error(`No definition found with id ${definitionId}.`);
+		return {
+			id: definitionId,
+			name: match.name ?? `portal-${definitionId}`
+		};
+	}
+	if (!appName) return null;
+	const match = definitions.find((definition) => definition.name?.toLowerCase() === appName.toLowerCase());
+	if (!match || match.id == null) {
+		const available = definitions.map((definition) => chalk.cyan(definition.name ?? "(unnamed)")).join(", ");
+		throw new Error(`No definition found matching "${appName}". Available: ${available}`);
+	}
+	return {
+		id: match.id,
+		name: match.name ?? `portal-${match.id}`
+	};
+}
 /** Select a definition by --app name, else interactively. */
-async function selectDefinition(client, appName) {
+async function selectDefinition(client, appName, rawDefinitionId) {
 	const definitions = [];
 	let page = 1;
 	while (true) {
-		const response = await fluid_os_v0_list_fluid_osdefinitions(client, {
+		const response = await fluidOsApi.listDefinitions(client, {
 			page,
 			per_page: 500
 		});
@@ -2499,17 +3506,8 @@ async function selectDefinition(client, appName) {
 		page++;
 	}
 	if (definitions.length === 0) throw new Error("No Fluid OS definitions found. Create one in the admin dashboard first.");
-	if (appName) {
-		const match = definitions.find((d) => d.name?.toLowerCase() === appName.toLowerCase());
-		if (!match || match.id == null) {
-			const available = definitions.map((d) => chalk.cyan(d.name ?? "(unnamed)")).join(", ");
-			throw new Error(`No definition found matching "${appName}". Available: ${available}`);
-		}
-		return {
-			id: match.id,
-			name: match.name ?? `portal-${match.id}`
-		};
-	}
+	const resolved = resolveDefinition(definitions, appName, rawDefinitionId);
+	if (resolved) return resolved;
 	const { definitionId } = await prompts({
 		type: "select",
 		name: "definitionId",
@@ -2527,9 +3525,8 @@ async function selectDefinition(client, appName) {
 		name: selected.name ?? `portal-${selected.id}`
 	};
 }
-const cloneCommand = new Command("clone").description("Clone a portal definition's provisioned GitHub repo (mints a fresh token per call)").argument("[app]", "Definition name (prompts to select when omitted)").option("--app <name>", "Definition name (same as the positional argument)").option("--dir <dir>", "Target directory (defaults to ./<slug>/)").action(async (appArg, options) => {
+const cloneCommand = new Command("clone").description("Clone a portal definition's provisioned GitHub repo (mints a fresh token per call)").argument("[app]", "Definition name (prompts to select when omitted)").option("--app <name>", "Definition name (same as the positional argument)").option("--id <id>", "Definition id (avoids ambiguity when names repeat)").option("--dir <dir>", "Target directory (defaults to ./<slug>/)").action(async (appArg, options) => {
 	try {
-		await ensureGitAvailable();
 		const token = getAuthToken();
 		if (!token) {
 			const profile = getActiveProfile();
@@ -2537,32 +3534,99 @@ const cloneCommand = new Command("clone").description("Clone a portal definition
 		}
 		const client = createClient$1(token);
 		const spinner = ora("Resolving definition…").start();
-		const definition = await selectDefinition(client, options.app ?? appArg);
+		const definition = await selectDefinition(client, options.app ?? appArg, options.id);
 		spinner.text = "Minting git credential…";
-		const outcome = await createPortalGitCredential({
+		const outcome = await createPortalGitCredentialWithRetry({
 			baseUrl: getBaseUrl(),
 			token,
-			definitionId: definition.id
+			definitionId: definition.id,
+			onRetry: ({ attempt, totalAttempts }) => {
+				spinner.text = `Preparing Git repository… retrying (${attempt}/${totalAttempts})`;
+			}
 		});
-		if (outcome.status !== "ok") {
+		if (outcome.status === "error") {
 			spinner.warn(`Can't clone — ${outcome.reason}`);
 			process.exit(1);
 		}
 		const slug = deriveSlug(definition.name);
 		const targetDir = resolve(options.dir ?? slug);
-		if (existsSync(targetDir)) {
+		if (outcome.status === "unavailable") {
+			spinner.info(gitSyncUnavailableNotice(outcome));
+			const resumeGitless = existsSync(targetDir) && await canResumeGitlessPortalScaffold(targetDir);
+			if (existsSync(targetDir) && !resumeGitless) {
+				spinner.fail(`Directory ${targetDir} already exists. Pass --dir or remove it first.`);
+				process.exit(1);
+			}
+			if (!resumeGitless) {
+				await mkdir(dirname(targetDir), { recursive: true });
+				try {
+					await mkdir(targetDir);
+				} catch (error) {
+					if (error.code === "EEXIST") {
+						spinner.fail(`Directory ${targetDir} was created by another process. Choose a different --dir or retry after it finishes.`);
+						process.exit(1);
+					}
+					throw error;
+				}
+			}
+			try {
+				spinner.text = resumeGitless ? "Resuming portal scaffold…" : "Scaffolding portal from the starter template…";
+				await scaffoldPortalProjectIntoExistingDirectory(targetDir, {
+					name: slug,
+					installDeps: false,
+					selectedPages: [],
+					profileName: getActiveProfile()?.name ?? ""
+				});
+			} catch (err) {
+				spinner.fail(`Git sync is unavailable and the local scaffold failed at ${targetDir}. Fix the reported path or permission conflict and retry.`);
+				throw err;
+			}
+			spinner.succeed(`Created ${chalk.cyan(targetDir)} from the starter template (no Git history yet)`);
+			console.log(chalk.dim(`  cd ${targetDir}`));
+			console.log(chalk.dim(`  ${chalk.cyan("fluid portal pull")} to sync content`));
+			return;
+		}
+		await ensureGitAvailable();
+		const resumeScaffold = existsSync(targetDir) && await canResumePortalScaffold(targetDir, outcome.credential.remote_url);
+		if (existsSync(targetDir) && !resumeScaffold) {
 			spinner.fail(`Directory ${targetDir} already exists. Pass --dir or remove it first.`);
 			process.exit(1);
 		}
-		spinner.text = `Cloning into ${slug}/…`;
-		try {
-			await gitClone(outcome.credential.remote_url, targetDir);
+		if (!resumeScaffold) {
+			await mkdir(dirname(targetDir), { recursive: true });
+			try {
+				await mkdir(targetDir);
+			} catch (error) {
+				if (error.code === "EEXIST") {
+					spinner.fail(`Directory ${targetDir} was created by another process. Choose a different --dir or retry after it finishes.`);
+					process.exit(1);
+				}
+				throw error;
+			}
+			spinner.text = `Cloning into ${slug}/…`;
+			try {
+				await gitClone(outcome.credential.remote_url, targetDir);
+			} catch (err) {
+				const cleanupError = await removeIncompleteCheckout(targetDir);
+				spinner.fail(cleanupError ? `git clone failed, and Fluid could not remove the incomplete checkout: ${cleanupError}` : "git clone failed; removed the incomplete checkout");
+				throw err;
+			}
+			excludeLocalStateFromGit(targetDir);
+		}
+		if (resumeScaffold || !await fileExists(join(targetDir, "package.json"))) try {
+			spinner.text = resumeScaffold ? "Resuming runnable portal scaffold…" : "Adding runnable portal scaffold…";
+			await scaffoldPortalProjectIntoExistingDirectory(targetDir, {
+				name: slug,
+				installDeps: false,
+				selectedPages: [],
+				profileName: getActiveProfile()?.name ?? ""
+			});
 		} catch (err) {
-			spinner.fail("git clone failed");
+			spinner.fail(`Repository cloned at ${targetDir}, but the runnable scaffold failed. The provisioned Git history and repository files were preserved; fix the reported path or permission conflict and retry the scaffold.`);
 			throw err;
 		}
 		spinner.succeed(`Cloned into ${chalk.cyan(targetDir)}`);
-		console.log(chalk.dim(`  cd ${slug}`));
+		console.log(chalk.dim(`  cd ${targetDir}`));
 		console.log(chalk.dim(`  ${chalk.cyan("fluid portal pull")} to sync content`));
 	} catch (error) {
 		console.log();
@@ -2571,6 +3635,115 @@ const cloneCommand = new Command("clone").description("Clone a portal definition
 	}
 });
 //#endregion
+//#region src/commands/widget-package-publish.ts
+async function publishWidgetRuntimeArtifacts(options) {
+	await assertStandalonePortalRemoteActionAllowed(options.projectDir, "portal widget package publish");
+	const isDryRun = options.dryRun === true;
+	const client = options.client;
+	if (!isDryRun && !client) throw new Error("A FluidOS API client is required when dryRun is false.");
+	const cliVersion = await getPortalCliVersion();
+	if (isDryRun) return await publishWidgetPackage({
+		projectDir: options.projectDir,
+		outDir: options.outDir,
+		owner: options.buildOwner,
+		uploadOwner: options.uploadOwner,
+		cliVersion,
+		dryRun: true
+	});
+	if (!client) throw new Error("A FluidOS API client is required when dryRun is false.");
+	return await publishWidgetPackage({
+		projectDir: options.projectDir,
+		outDir: options.outDir,
+		owner: options.buildOwner,
+		uploadOwner: options.uploadOwner,
+		cliVersion,
+		...options.version ? { version: options.version } : {},
+		client
+	});
+}
+/**
+* Prints a publish failure with its `details` block, which is where the
+* validation tooling names the offending widget and field.
+*/
+function printWidgetPublishError(error) {
+	console.error(chalk.red("Error:") + " " + (error instanceof Error ? error.message : String(error)));
+	if (typeof error === "object" && error !== null && "details" in error && typeof error.details === "string" && error.details.length > 0) console.error(error.details);
+}
+const DEFAULT_API_BASE = "https://api.fluid.app";
+/**
+* Builds the client used to publish widget artifacts.
+*
+* `FLUID_TOKEN` / `FLUID_API_TOKEN` win over any stored profile, matching the
+* resolution order the rest of the CLI documents and implements (see
+* `getAuthToken` in `@fluid-app/fluid-cli`). This path used to read only
+* `~/.fluid/config.json`, which made it the one command a caller could not
+* point at a chosen company: a host that spawns the CLI would publish to
+* whichever profile the terminal happened to have active, and shipping a
+* company's widgets to the wrong tenant is not a failure they could detect from
+* the output.
+*
+* With the env token set, the base URL comes from `FLUID_API_BASE` rather than
+* the stored profile's — a token issued elsewhere has no relationship to the
+* host that profile points at.
+*/
+function createAuthenticatedWidgetPackageClient() {
+	const envToken = process.env["FLUID_TOKEN"] ?? process.env["FLUID_API_TOKEN"] ?? "";
+	if (envToken.length > 0) return createFluidOsHeyApiClient({
+		baseUrl: process.env["FLUID_API_BASE"] ?? DEFAULT_API_BASE,
+		getAuthToken: () => envToken
+	});
+	const { profile, profileName, token } = resolveAuthenticatedProfile();
+	if (!token) {
+		if (!profileName) throw new Error("Not logged in. Run " + chalk.cyan("fluid login") + " first.");
+		throw new Error("No auth token found for profile " + chalk.cyan(profileName) + ". Run " + chalk.cyan("fluid login") + " to re-authenticate.");
+	}
+	return createFluidOsHeyApiClient({
+		baseUrl: profile?.baseUrl ?? process.env["FLUID_API_BASE"] ?? DEFAULT_API_BASE,
+		getAuthToken: () => token
+	});
+}
+function resolveAuthenticatedProfile() {
+	const config = readConfig();
+	const projectConfig = findProjectConfig(process.cwd());
+	if (projectConfig?.profile) {
+		const profile = config.profiles[projectConfig.profile];
+		if (profile) return {
+			profile,
+			profileName: projectConfig.profile,
+			token: profile.token
+		};
+	}
+	if (!config.activeProfile) return {};
+	const profile = config.profiles[config.activeProfile];
+	if (!profile) return {};
+	return {
+		profile,
+		profileName: config.activeProfile,
+		token: profile.token
+	};
+}
+function printWidgetPublishSummary(options) {
+	console.log();
+	console.log(chalk.green.bold(`${options.title} complete`));
+	console.log();
+	console.log(chalk.gray("Owner:       ") + chalk.white(options.ownerLabel));
+	if (options.environment) console.log(chalk.gray("Environment: ") + chalk.white(options.environment));
+	console.log(chalk.gray("Package:     ") + chalk.white(options.packageId));
+	console.log(chalk.gray("Version:     ") + chalk.white(options.version));
+	console.log(chalk.gray("Output:      ") + chalk.cyan(options.outDir));
+	console.log(chalk.gray("Artifacts:   ") + chalk.white(String(options.artifactCount)));
+	console.log();
+}
+function printRuntimeOnlyNotice() {
+	console.log(chalk.yellow("This publishes widget runtime artifacts only; it does not deploy the hosted portal shell."));
+	console.log();
+}
+function printDryRunSessionPayload(sessionPayload) {
+	console.log(chalk.bold("Dry-run upload session payload:"));
+	console.log(JSON.stringify(sessionPayload, null, 2));
+	console.log();
+}
+//#endregion
 //#region src/utils/widget-helpers.ts
 /**
 * Pure helper functions for widget scaffolding.
@@ -2660,12 +3833,14 @@ function insertIntoWidgetPackage(source, exportName) {
 }
 //#endregion
 //#region src/commands/widget-create.ts
-const WIDGET_CONFIG_PATH$1 = path.join("src", "widgets.config.ts");
+const WIDGET_CONFIG_PATH = path.join("src", "widgets.config.ts");
 const createSubcommand = new Command("create").description("Scaffold a new Remote DOM widget").argument("<name>", "Widget name in kebab-case (e.g., stock-ticker)").option("-c, --category <category>", "Widget category for palette grouping", "components").action(async (name, options) => {
 	const cwd = process.cwd();
 	const packageJsonPath = path.join(cwd, "package.json");
-	const configPath = path.join(cwd, WIDGET_CONFIG_PATH$1);
+	const configPath = path.join(cwd, WIDGET_CONFIG_PATH);
 	const widgetDir = path.join(cwd, "src", "widgets", name);
+	let stylesAppended = false;
+	let resolvedPackageKey = null;
 	const validationError = validateWidgetName(name);
 	if (validationError) {
 		console.error(chalk.red(`Error: ${validationError}`));
@@ -2697,28 +3872,38 @@ const createSubcommand = new Command("create").description("Scaffold a new Remot
 			displayName,
 			category
 		}), "utf-8");
+		await appendWidgetStyles(cwd, name);
+		stylesAppended = true;
 		if (await fs.pathExists(configPath)) {
 			const configSource = await fs.readFile(configPath, "utf-8");
-			if (isEmptyWidgetConfig(configSource)) await fs.writeFile(configPath, createWidgetConfigSource(importLine, exportName), "utf-8");
-			else {
+			if (isEmptyWidgetConfig(configSource)) {
+				resolvedPackageKey = await resolveCompanyPackageKey();
+				await fs.writeFile(configPath, createWidgetConfigSource(importLine, exportName, resolvedPackageKey ?? void 0), "utf-8");
+			} else {
 				const withImport = insertImport(configSource, importLine);
 				const updated = withImport ? insertIntoWidgetPackage(withImport, exportName) : null;
-				if (!updated) throw new Error(`${WIDGET_CONFIG_PATH$1} must export the starter widgetPackages placeholder or contain a defineWidgetPackage({ widgets: [...] }) declaration.`);
+				if (!updated) throw new Error(`${WIDGET_CONFIG_PATH} must export the starter widgetPackages placeholder or contain a defineWidgetPackage({ widgets: [...] }) declaration.`);
 				await fs.writeFile(configPath, updated, "utf-8");
 			}
-		} else await fs.writeFile(configPath, createWidgetConfigSource(importLine, exportName), "utf-8");
+		} else {
+			resolvedPackageKey = await resolveCompanyPackageKey();
+			await fs.writeFile(configPath, createWidgetConfigSource(importLine, exportName, resolvedPackageKey ?? void 0), "utf-8");
+		}
 	} catch (error) {
 		await fs.remove(widgetDir).catch(() => {});
+		if (stylesAppended) await removeWidgetStyles(cwd, name).catch(() => {});
 		console.error(chalk.red("Error: Failed to scaffold Remote DOM widget."));
 		console.error(error);
 		process.exit(1);
 	}
 	console.log();
 	console.log(chalk.green("Created widget:") + ` src/widgets/${name}/index.tsx`);
-	console.log(chalk.green("Registered") + ` in ${chalk.cyan(WIDGET_CONFIG_PATH$1)}`);
+	console.log(chalk.green("Registered") + ` in ${chalk.cyan(WIDGET_CONFIG_PATH)}`);
+	if (resolvedPackageKey) console.log(chalk.green("Package key:") + ` ${chalk.cyan(resolvedPackageKey)} (this company's existing widget package)`);
 	console.log();
 	console.log(chalk.yellow("Next steps:"));
 	console.log(`  1. Edit ${chalk.cyan(`src/widgets/${name}/index.tsx`)}`);
+	console.log(`     Styles live in ${chalk.cyan("styles.css")} at the project root — widgets must not import CSS.`);
 	console.log(`  2. Run ${chalk.cyan("fluid portal deploy --dry-run")} to verify the package`);
 });
 function createWidgetSource(options) {
@@ -2728,11 +3913,23 @@ interface ${options.widgetType}Props {
   readonly title?: string;
 }
 
+// Styling: a stylesheet is the ONLY way to style a widget. The host sanitizes
+// every Remote DOM mutation before it reaches the shadow root, so a
+// \`style={{ ... }}\` prop is silently dropped and \`<style>\` is a banned tag.
+// Give elements classNames and put the rules in the project-root styles.css
+// (this widget's rules were appended there when it was scaffolded).
+//
+// Do NOT add \`import "./styles.css"\` here. In dev, Vite answers a CSS import
+// with a browser style-injector that loads \`/@vite/client\`, which touches
+// HTMLElement — absent in a Web Worker — and throws while the package is being
+// evaluated, taking down every widget in the project, not just this one.
 function ${options.componentName}({ title = ${JSON.stringify(options.displayName)} }: ${options.widgetType}Props) {
   return (
-    <section>
-      <h3>{title}</h3>
-      <p>Edit this widget in src/widgets/${options.name}/index.tsx</p>
+    <section className="${options.name}">
+      <h3 className="${options.name}__title">{title}</h3>
+      <p className="${options.name}__body">
+        Edit this widget in src/widgets/${options.name}/index.tsx
+      </p>
     </section>
   );
 }
@@ -2753,1692 +3950,283 @@ export const ${options.exportName} = defineWidget({
 });
 `;
 }
+/**
+* Appends a scaffolded widget's rules to the project-root `styles.css`,
+* creating the file when a project has none yet.
+*
+* The root stylesheet is the single sheet the tooling delivers — dev serves it
+* as the descriptor's `cssUrls`, and the build entry imports it — so every
+* widget in a project shares it. Appending (rather than overwriting) keeps
+* earlier widgets' rules intact; re-scaffolding a name that is already present
+* is a no-op rather than a duplicate block.
+*/
+/**
+* Removes a widget's appended rules from the project-root `styles.css`.
+*
+* Only used to undo a failed scaffold — `appendWidgetStyles` runs before the
+* config update, so a config failure would otherwise strand rules for a widget
+* directory that has just been deleted. Matches the exact block the append
+* writes and leaves everything else, including a project's own rules and other
+* widgets', untouched.
+*/
+async function removeWidgetStyles(projectDir, name) {
+	const stylesPath = path.join(projectDir, "styles.css");
+	if (!await fs.pathExists(stylesPath)) return;
+	const existing = await fs.readFile(stylesPath, "utf-8");
+	const block = createWidgetStylesSource(name);
+	if (!existing.includes(block)) return;
+	const withoutBlock = existing.replace(block, "");
+	await fs.writeFile(stylesPath, withoutBlock.replace(/\n{3,}/gu, "\n\n"), "utf-8");
+}
+async function appendWidgetStyles(projectDir, name) {
+	const stylesPath = path.join(projectDir, "styles.css");
+	const block = createWidgetStylesSource(name);
+	if (!await fs.pathExists(stylesPath)) {
+		await fs.writeFile(stylesPath, `${ROOT_STYLES_HEADER}\n${block}`, "utf-8");
+		return;
+	}
+	const existing = await fs.readFile(stylesPath, "utf-8");
+	if (existing.includes(`.${name} {`)) return;
+	const separator = existing.endsWith("\n") ? "\n" : "\n\n";
+	await fs.appendFile(stylesPath, `${separator}${block}`, "utf-8");
+}
+const ROOT_STYLES_HEADER = `/* Runtime styles for this portal's widgets.
+ *
+ * One sheet per project: dev serves it to the widget shadow root as the
+ * package descriptor's cssUrls, and the package build imports it. Widget
+ * modules must NOT import CSS themselves — in dev that pulls \`/@vite/client\`
+ * into the Web Worker, which throws and stops every widget in the project from
+ * registering.
+ */
+`;
+/**
+* Starter rules for a scaffolded widget.
+*
+* Colors, type, and radii come from the host portal's semantic CSS variables so
+* the widget matches whatever portal it lands on, in both light and dark,
+* without a second hand-written palette. Each `var()` carries a fallback so the
+* widget stays legible in a host that has not adopted the portal theme.
+*
+* Selectors are prefixed with the widget name so nothing leaks into the host.
+*/
+function createWidgetStylesSource(name) {
+	return `.${name} {
+  padding: 24px;
+  border: 1px solid var(--border, #e5e7eb);
+  border-radius: var(--radius-lg, 12px);
+  background: var(--card, #ffffff);
+  color: var(--card-foreground, #111827);
+  font-family: var(--font-body, ui-sans-serif, system-ui, sans-serif);
+}
+
+.${name}__title {
+  margin: 0 0 8px;
+  color: var(--card-foreground, #111827);
+  font-family: var(--font-header, inherit);
+  font-size: 1.25rem;
+  font-weight: 700;
+}
+
+.${name}__body {
+  margin: 0;
+  color: var(--muted-foreground, #6b7280);
+}
+`;
+}
 function isEmptyWidgetConfig(source) {
 	return /export\s+const\s+widgetPackages\s*=\s*\[\]\s+as\s+const\s*;/u.test(source);
 }
-function createWidgetConfigSource(importLine, exportName) {
+/**
+* The key written when the company's real one cannot be resolved.
+*
+* A guess, and one that fails for any company that has already published — a
+* company has exactly ONE widget package and its key is fixed by whichever
+* project published first, so this value is only ever correct by accident.
+*/
+const PLACEHOLDER_PACKAGE_KEY = "portal-widgets";
+function createWidgetConfigSource(importLine, exportName, packageKey = PLACEHOLDER_PACKAGE_KEY) {
 	return `import { defineWidgetPackage } from "@fluid-app/portal-sdk/widgets/worker";
 ${importLine}
 
 export const widgetPackage = defineWidgetPackage({
   scope: "company",
-  packageStableId: "portal-widgets",
+  packageStableId: ${JSON.stringify(packageKey)},
   version: "0.0.0-dev",
   widgets: [${exportName}],
 });
 `;
 }
-const widgetCommand = new Command("widget").description("Manage Remote DOM portal widgets").addCommand(createSubcommand);
-//#endregion
-//#region src/utils/widget-package-config.ts
-const WIDGET_CONFIG_PATH = "src/widgets.config.ts";
-const SOURCE_PACKAGE_EXTRACT_FILENAME = "extract-widget-packages.ts";
-const SOURCE_PACKAGE_OUTPUT_FILENAME = "source-widget-packages.json";
-const SOURCE_PACKAGE_OUTPUT_SENTINEL = "fluid-widget-source-packages:v1";
-const TSX_CLI_PATH = createRequire(import.meta.url).resolve("tsx/cli");
-async function resolvePortalWidgetSourceConfig(projectDir) {
-	const candidate = path.join(projectDir, WIDGET_CONFIG_PATH);
-	return await fs.pathExists(candidate) ? {
-		path: candidate,
-		relativePath: WIDGET_CONFIG_PATH
-	} : void 0;
-}
-async function loadSourceWidgetPackages(projectDir) {
-	const config = await resolvePortalWidgetSourceConfig(projectDir);
-	if (!config) return success([]);
-	let tempDir;
-	try {
-		tempDir = await createTempDirectory(projectDir);
-		const extractFile = path.join(tempDir, SOURCE_PACKAGE_EXTRACT_FILENAME);
-		const outputFile = path.join(tempDir, SOURCE_PACKAGE_OUTPUT_FILENAME);
-		await fs.writeFile(extractFile, createSourcePackageExtractorScript({
-			projectDir,
-			configPath: config.path
-		}), {
-			encoding: "utf-8",
-			flag: "wx"
-		});
-		await execa(process.execPath, [
-			TSX_CLI_PATH,
-			extractFile,
-			outputFile
-		], {
-			cwd: projectDir,
-			stdio: "pipe",
-			env: {
-				...process.env,
-				NODE_ENV: "production"
-			}
-		});
-		const outputResult = await readSourcePackageExtractorOutput(outputFile);
-		if (!outputResult.success) return outputResult;
-		const parsed = outputResult.value;
-		if (parsed.length === 0) return success([]);
-		return success(parsed);
-	} catch (err) {
-		const error = err;
-		return failure({
-			code: "CONFIG_LOAD_FAILED",
-			message: `Failed to load widget packages from ${config.relativePath}`,
-			details: error.stderr ?? error.message ?? String(err)
-		});
-	} finally {
-		if (tempDir) await fs.remove(tempDir).catch(() => {});
-	}
-}
-async function createTempDirectory(projectDir) {
-	const projectTmpDir = path.join(projectDir, ".fluid", "tmp");
+/**
+* Reads the company's existing widget package key, for a config being CREATED.
+*
+* Scaffolding is the one moment this can be done safely. A widget's type is
+* `company.<key>.<Name>` and those strings are written into screen JSON, so
+* changing the key later orphans every screen using it — which is why
+* `fluid portal deploy` reports a mismatch rather than rewriting it. At
+* `widget create` no screen references the type yet, so resolving it here
+* prevents the mismatch instead of explaining it afterwards.
+*
+* Best-effort by design: this command made no network calls before, and a
+* scaffold must not fail because a lookup did. Every uncertainty — no token, no
+* network, a company that has never published, a slow answer — falls back to the
+* placeholder, which is exactly today's behaviour.
+*
+* The deadline is deliberate here, unlike the SDK's dev-server probe where a
+* timeout discarded a real answer. The fallback IS the correct result for an
+* offline scaffold, so bounding the wait costs nothing and stops a hung API
+* from wedging a local command.
+*/
+async function resolveCompanyPackageKey() {
 	try {
-		await fs.ensureDir(projectTmpDir);
-		return await fs.mkdtemp(path.join(projectTmpDir, "widget-packages-"));
-	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		throw new Error(`Unable to create project-local temporary directory at ${projectTmpDir}: ${message}`);
+		const client = createAuthenticatedWidgetPackageClient();
+		return (await Promise.race([readCompanyWidgetPackages(client), new Promise((resolve) => {
+			setTimeout(() => resolve([]), PACKAGE_KEY_LOOKUP_TIMEOUT_MS);
+		})]))[0]?.key ?? null;
+	} catch {
+		return null;
 	}
 }
-async function readSourcePackageExtractorOutput(outputFile) {
-	let output;
-	try {
-		output = await fs.readFile(outputFile, "utf-8");
-	} catch (err) {
-		return failure({
-			code: "CONFIG_LOAD_FAILED",
-			message: "Widget package extractor did not write an output file",
-			details: err instanceof Error ? err.message : String(err)
-		});
+const PACKAGE_KEY_LOOKUP_TIMEOUT_MS = 5e3;
+const widgetCommand = new Command("widget").description("Manage Remote DOM portal widgets").addCommand(createSubcommand);
+//#endregion
+//#region src/commands/deploy.ts
+const DEFAULT_OUT_DIR$1 = ".fluid/widget-dist";
+const DEFAULT_ENVIRONMENT = "production";
+const deployCommand = new Command("deploy").description("Publish company-owned portal widget runtime artifacts").option("-e, --environment <name>", "Target environment label for output reporting", DEFAULT_ENVIRONMENT).option("-o, --out-dir <dir>", "Widget artifact output directory", DEFAULT_OUT_DIR$1).option("--dry-run", "Build and validate upload payload without publishing").action(async (options) => {
+	const environment = options.environment ?? DEFAULT_ENVIRONMENT;
+	const outDir = options.outDir ?? DEFAULT_OUT_DIR$1;
+	const dryRun = options.dryRun === true;
+	console.log();
+	console.log(chalk.blue.bold("Fluid Portal Deploy"));
+	console.log();
+	printRuntimeOnlyNotice();
+	console.log(chalk.gray("Environment: ") + chalk.white(environment));
+	console.log(chalk.gray("Output:      ") + chalk.cyan(outDir));
+	if (dryRun) console.log(chalk.yellow("Dry run: no upload will be created."));
+	console.log();
+	const spinner = ora("Building company-owned widget package...").start();
+	const result = await runPortalDeploy({
+		projectDir: process.cwd(),
+		outDir,
+		environment,
+		dryRun,
+		onProgress: (label) => {
+			spinner.text = label;
+		}
+	});
+	if (!result.ok) {
+		spinner.fail("Portal deploy failed");
+		console.log();
+		if (result.code === "PACKAGE_KEY_MISMATCH") console.log(chalk.red("Package key does not match this company."));
+		else console.error(chalk.red("Error:") + " " + result.message);
+		if (result.hint) {
+			console.log();
+			console.log(result.hint);
+		}
+		console.log();
+		process.exit(1);
 	}
-	let parsed;
-	try {
-		parsed = JSON.parse(output);
-	} catch {
-		return failure({
-			code: "INVALID_FORMAT",
-			message: "Failed to parse widget package output file as JSON",
-			details: `Output was: ${output.slice(0, 200)}`
-		});
+	spinner.succeed("Built widget runtime artifacts");
+	if (dryRun) {
+		console.log(chalk.yellow("Dry run complete — upload session was not requested."));
+		console.log();
+		if (result.sessionPayload !== void 0) printDryRunSessionPayload(result.sessionPayload);
+	} else console.log(chalk.green("Published widget package version."));
+	if (result.requestedVersion) {
+		console.log(chalk.yellow(`Version ${result.requestedVersion} is already published for this company, so this went out as ${result.version}.`));
+		console.log(chalk.gray("Every portal project in a company shares one widget package, so its versions are shared too."));
+		console.log();
 	}
-	if (!isRecord$5(parsed) || parsed.sentinel !== SOURCE_PACKAGE_OUTPUT_SENTINEL) return failure({
-		code: "INVALID_FORMAT",
-		message: "Widget package extractor output file had an invalid sentinel"
-	});
-	if (!Array.isArray(parsed.data)) return failure({
-		code: "INVALID_FORMAT",
-		message: "Extracted widget package output is not an array",
-		details: `Expected an array, got: ${typeof parsed.data}`
+	printWidgetPublishSummary({
+		title: dryRun ? "Portal deploy dry run" : "Portal deploy",
+		ownerLabel: "company",
+		environment,
+		outDir,
+		packageId: result.packageId,
+		version: result.version,
+		artifactCount: result.artifactCount
 	});
-	return success(parsed.data);
-}
-function createSourcePackageExtractorScript(options) {
-	return `
-import fs from "node:fs/promises";
-import path from "node:path";
-import { createServer, normalizePath } from "vite";
-
-const SOURCE_PACKAGE_MARKER = "__fluidSourceWidgetPackage";
-const OUTPUT_SENTINEL = ${JSON.stringify(SOURCE_PACKAGE_OUTPUT_SENTINEL)};
-const projectRoot = ${JSON.stringify(options.projectDir)};
-const widgetConfigPath = ${JSON.stringify(options.configPath)};
-const outputPath = process.argv[2];
-if (!outputPath) throw new Error("Missing widget package extractor output path.");
-
-function toViteModuleId(modulePath) {
-  const relativePath = path.relative(projectRoot, modulePath);
-  if (!relativePath.startsWith("..") && !path.isAbsolute(relativePath)) {
-    return "/" + normalizePath(relativePath);
-  }
-  return normalizePath(modulePath);
-}
-
-const server = await createServer({
-  root: projectRoot,
-  mode: "production",
-  server: { middlewareMode: true },
-  appType: "custom",
-  logLevel: "error",
-  clearScreen: false,
-  resolve: {
-    conditions: ["module", "browser", "development|production"],
-  },
-  ssr: {
-    noExternal: ["@fluid-app/portal-sdk"],
-    resolve: {
-      conditions: ["module", "node", "development|production"],
-    },
-  },
 });
-
-try {
-  const widgetConfig = await server.ssrLoadModule(toViteModuleId(widgetConfigPath));
-
-  function isSourceWidgetPackage(value) {
-    return Boolean(value && typeof value === "object" && value[SOURCE_PACKAGE_MARKER] === true);
-  }
-
-  function collectSourceWidgetPackages(mod) {
-    const candidates = [
-      mod.widgetPackage,
-      ...(Array.isArray(mod.widgetPackages) ? mod.widgetPackages : []),
-      mod.default,
-    ];
-    const byPackageId = new Map();
-    for (const candidate of candidates) {
-      if (!isSourceWidgetPackage(candidate)) continue;
-      if (!byPackageId.has(candidate.packageId)) byPackageId.set(candidate.packageId, candidate);
-    }
-    return Array.from(byPackageId.values());
-  }
-
-  function serializeWidget(widget) {
-    if (!widget || typeof widget !== "object" || Array.isArray(widget)) {
-      return widget;
-    }
-    const { component, ...metadata } = widget;
-    return metadata;
-  }
-
-  function serializePackage(sourcePackage) {
-    return {
-      manifestVersion: sourcePackage.manifestVersion,
-      scope: sourcePackage.scope,
-      packageStableId: sourcePackage.packageStableId,
-      packageId: sourcePackage.packageId,
-      packageType: sourcePackage.packageType,
-      version: sourcePackage.version,
-      cssUrls: sourcePackage.cssUrls,
-      widgets: Array.isArray(sourcePackage.widgets)
-        ? sourcePackage.widgets.map(serializeWidget)
-        : sourcePackage.widgets,
-    };
-  }
-
-  await fs.writeFile(
-    outputPath,
-    JSON.stringify({
-      sentinel: OUTPUT_SENTINEL,
-      data: collectSourceWidgetPackages(widgetConfig).map(serializePackage),
-    }),
-    "utf-8",
-  );
-} finally {
-  await server.close();
-}
-`;
-}
-function isRecord$5(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-//#endregion
-//#region src/utils/widget-package-artifacts.ts
-const WIDGET_PACKAGE_BUILDER_VERSION = "1";
-const CONTENT_TYPES = {
-	".css": "text/css",
-	".js": "application/javascript",
-	".json": "application/json",
-	".map": "application/json"
-};
-const CSS_ARTIFACT_PATH_PATTERN = /^[A-Za-z0-9._~-]+\.css$/;
-const JS_MAP_ARTIFACT_PATH_PATTERN = /^[A-Za-z0-9._~-]+\.js\.map$/;
-async function computeArtifactMetadata(filePath, baseDir) {
-	const relativePath = toPosixPath$1(path.relative(baseDir, filePath));
-	assertAllowedArtifactPath(relativePath);
-	await assertRegularArtifactFile(filePath, relativePath);
-	const buffer = await fs.readFile(filePath);
-	return {
-		path: relativePath,
-		sha256: sha256(buffer),
-		bytes: buffer.byteLength,
-		contentType: getArtifactContentType(filePath)
-	};
-}
-async function collectWidgetPackageArtifacts(publishDir) {
-	const artifactPaths = await findArtifactPaths(publishDir);
-	const artifacts = await Promise.all(artifactPaths.map((artifactPath) => computeArtifactMetadata(artifactPath, publishDir)));
-	assertRequiredUploadArtifacts(artifacts);
-	return artifacts.sort((a, b) => a.path.localeCompare(b.path));
-}
-function createPublishManifestMetadata(options) {
-	return {
-		packageId: options.packageId,
-		version: options.version,
-		builderVersion: options.builderVersion ?? "1",
-		cliVersion: options.cliVersion,
-		runtimeVersion: options.runtimeVersion,
-		manifestHash: sha256(options.manifestContent),
-		artifacts: options.artifacts
-	};
-}
-function getArtifactContentType(filePath) {
-	if (path.basename(filePath).endsWith(".js.map")) return "application/json";
-	return CONTENT_TYPES[path.extname(filePath)] ?? "application/octet-stream";
-}
-function sha256(content) {
-	return createHash("sha256").update(content).digest("hex");
-}
-function isWidgetPackageCssArtifactPath(relativePath) {
-	return CSS_ARTIFACT_PATH_PATTERN.test(relativePath);
-}
-function isWidgetPackageJsMapArtifactPath(relativePath) {
-	return JS_MAP_ARTIFACT_PATH_PATTERN.test(relativePath);
-}
-async function assertRegularArtifactFile(filePath, relativePath) {
-	const stat = await fs.lstat(filePath);
-	if (stat.isSymbolicLink()) throw new Error(`Widget publish artifact ${JSON.stringify(relativePath)} must be a regular file and must not be a symbolic link.`);
-	if (!stat.isFile()) throw new Error(`Widget publish artifact ${JSON.stringify(relativePath)} must be a regular file.`);
-}
-async function findArtifactPaths(dir, baseDir = dir) {
-	if (!await fs.pathExists(dir)) return [];
-	const entries = await fs.readdir(dir, { withFileTypes: true });
-	return (await Promise.all(entries.map(async (entry) => {
-		const entryPath = path.join(dir, entry.name);
-		const relativePath = toPosixPath$1(path.relative(baseDir, entryPath));
-		if (entry.isSymbolicLink()) throw new Error(`Widget publish artifact ${JSON.stringify(relativePath)} must be a regular file and must not be a symbolic link.`);
-		if (isUploadArtifact(relativePath)) {
-			if (!entry.isFile()) throw new Error(`Widget publish artifact ${JSON.stringify(relativePath)} must be a regular file.`);
-			return [entryPath];
-		}
-		if (entry.isDirectory()) {
-			const nestedPaths = await findArtifactPaths(entryPath, baseDir);
-			if (nestedPaths.length === 0) throwUnsupportedArtifactPath(`${relativePath}/`);
-			return nestedPaths;
-		}
-		if (isAllowedGeneratedFile(relativePath)) return [];
-		throwUnsupportedArtifactPath(relativePath);
-	}))).flat();
-}
-function assertRequiredUploadArtifacts(artifacts) {
-	const artifactPaths = new Set(artifacts.map((artifact) => artifact.path));
-	for (const requiredPath of ["widget.js", "manifest.json"]) {
-		if (artifactPaths.has(requiredPath)) continue;
-		throw new Error(`Widget package publish output must include regular file ${JSON.stringify(requiredPath)}.`);
-	}
-}
-function assertAllowedArtifactPath(relativePath) {
-	if (isUploadArtifact(relativePath) || isAllowedGeneratedFile(relativePath)) return;
-	throwUnsupportedArtifactPath(relativePath);
-}
-function isUploadArtifact(relativePath) {
-	return relativePath === "widget.js" || relativePath === "manifest.json" || isWidgetPackageCssArtifactPath(relativePath) || isWidgetPackageJsMapArtifactPath(relativePath);
-}
-function isAllowedGeneratedFile(relativePath) {
-	return isFlatArtifactPath(relativePath) && relativePath === "publish-manifest.json";
-}
-function isFlatArtifactPath(relativePath) {
-	return relativePath.length > 0 && !relativePath.includes("/") && !relativePath.includes("\\");
-}
-function throwUnsupportedArtifactPath(relativePath) {
-	throw new Error(`Unsupported widget publish artifact ${JSON.stringify(relativePath)}. Allowed files are widget.js, manifest.json, top-level [A-Za-z0-9._~-]+.css, top-level [A-Za-z0-9._~-]+.js.map, and publish-manifest.json.`);
-}
-function toPosixPath$1(value) {
-	return value.split(path.sep).join("/");
-}
-//#endregion
-//#region ../../portal/core/src/remote-dom-widget-package.ts
-const UNSAFE_JSON_KEYS = new Set([
-	"__proto__",
-	"constructor",
-	"prototype"
-]);
-function isJsonValue(value) {
-	return isJsonValueAtDepth(value, /* @__PURE__ */ new WeakSet(), 0);
-}
-function isJsonValueAtDepth(value, ancestors, depth) {
-	if (value === null || typeof value === "string" || typeof value === "boolean") return true;
-	if (typeof value === "number") return Number.isFinite(value);
-	if (typeof value !== "object" || depth > 50 || ancestors.has(value)) return false;
-	ancestors.add(value);
-	const prototype = Object.getPrototypeOf(value);
-	const isJson = Array.isArray(value) ? value.every((item) => isJsonValueAtDepth(item, ancestors, depth + 1)) : (prototype === Object.prototype || prototype === null) && isRecord$4(value) && Object.entries(value).every(([key, item]) => !UNSAFE_JSON_KEYS.has(key) && isJsonValueAtDepth(item, ancestors, depth + 1));
-	ancestors.delete(value);
-	return isJson;
-}
-function isRecord$4(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-//#endregion
-//#region src/utils/widget-package-validation.ts
-const URL_SAFE_SEGMENT_SOURCE = "[A-Za-z0-9][A-Za-z0-9_~-]*";
-const URL_SAFE_WIDGET_NAME_PATTERN = new RegExp(`^${URL_SAFE_SEGMENT_SOURCE}$`);
-const URL_SAFE_DOTTED_IDENTIFIER_PATTERN = new RegExp(`^${URL_SAFE_SEGMENT_SOURCE}(?:\\.${URL_SAFE_SEGMENT_SOURCE})*$`);
-const SEMVER_CORE_PATTERN = "(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)";
-const SEMVER_PRERELEASE_IDENTIFIER_PATTERN = "(?:0|[1-9]\\d*|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*)";
-const SEMVER_URL_SAFE_PATTERN = new RegExp(`^${SEMVER_CORE_PATTERN}(?:-${SEMVER_PRERELEASE_IDENTIFIER_PATTERN}(?:\\.${SEMVER_PRERELEASE_IDENTIFIER_PATTERN})*)?$`);
-const WIDGET_PACKAGE_MANIFEST_VERSION = 1;
-const DEFAULT_WIDGET_ICON = "box";
-const DEFAULT_WIDGET_CATEGORY = "components";
-const DEFAULT_WIDGET_CONTAINER = "block";
-const DEFAULT_MIN_SDK_VERSION = "0.0.0";
-function validateSingleSourceWidgetPackage(sourcePackages, options = {}) {
-	if (sourcePackages.length === 0) return validationFailure({
-		code: "NO_SOURCE_PACKAGE",
-		message: "No defineWidgetPackage source package was found. Export widgetPackage, widgetPackages, or a default widget package from src/widgets.config.ts."
-	});
-	if (sourcePackages.length > 1) return validationFailure({
-		code: "MULTIPLE_SOURCE_PACKAGES",
-		message: "Publish/deploy supports exactly one defineWidgetPackage source package. Export one package or split packages into separate builds."
-	});
-	const sourcePackageValue = sourcePackages[0];
-	if (!sourcePackageValue) return validationFailure({
-		code: "NO_SOURCE_PACKAGE",
-		message: "No defineWidgetPackage source package was found."
-	});
-	const shapeErrors = validateSourcePackageShape(sourcePackageValue);
-	if (shapeErrors.length > 0) return {
-		success: false,
-		errors: shapeErrors
-	};
-	const sourcePackage = sourcePackageValue;
-	const errors = [];
-	const owner = options.owner ?? sourcePackage.packageType;
-	if (owner !== "company" && owner !== "droplet") errors.push({
-		code: "UNSUPPORTED_OWNER",
-		path: "packageType",
-		message: "Widget package publish/deploy currently supports company and droplet owners. Set packageType to \"company\" or \"droplet\"."
-	});
-	const resolvedOwner = owner === "droplet" ? "droplet" : "company";
-	const packageKey = resolvePackageKey(sourcePackage, resolvedOwner);
-	const packageKeyPath = readNonEmptyTrimmedString(sourcePackage.packageStableId) ? "packageStableId" : "packageId";
-	if (!isUrlSafeDottedIdentifier(packageKey)) errors.push({
-		code: "INVALID_PACKAGE_KEY",
-		path: packageKeyPath,
-		message: "Widget package key must be URL-safe dot-separated text (letters, numbers, '.', '_', '~', and '-' only)."
-	});
-	if (!isUrlSafeSemver(sourcePackage.version)) errors.push({
-		code: "INVALID_VERSION",
-		path: "version",
-		message: "Widget package version must be a URL-safe SemVer version without build metadata (for example 1.2.3 or 1.2.3-beta.1)."
-	});
-	if (sourcePackage.widgets.length === 0) errors.push({
-		code: "NO_WIDGETS",
-		path: "widgets",
-		message: "Widget package must include at least one widget."
-	});
-	const packageId = `${resolvedOwner}.${packageKey}`;
-	const seenNames = /* @__PURE__ */ new Set();
-	const seenTypes = /* @__PURE__ */ new Set();
-	const widgets = [];
-	sourcePackage.widgets.forEach((widget, index) => {
-		const path = `widgets[${index}]`;
-		if (!isUrlSafeWidgetName(widget.name)) {
-			errors.push({
-				code: "INVALID_WIDGET_NAME",
-				path: `${path}.name`,
-				message: "Widget name must be URL-safe text (letters, numbers, '_', '~', and '-' only) and cannot be empty."
-			});
-			return;
-		}
-		if (seenNames.has(widget.name)) {
-			errors.push({
-				code: "DUPLICATE_WIDGET",
-				path: `${path}.name`,
-				message: `Duplicate widget name "${widget.name}" found in package ${packageKey}.`
-			});
-			return;
-		}
-		seenNames.add(widget.name);
-		const type = `${packageId}.${widget.name}`;
-		if (!isUrlSafeDottedIdentifier(type)) {
-			errors.push({
-				code: "INVALID_WIDGET_TYPE",
-				path: `${path}.type`,
-				message: `Generated widget type "${type}" is not URL-safe.`
-			});
-			return;
-		}
-		if (seenTypes.has(type)) {
-			errors.push({
-				code: "DUPLICATE_WIDGET",
-				path: `${path}.type`,
-				message: `Duplicate generated widget type "${type}" found.`
-			});
-			return;
-		}
-		seenTypes.add(type);
-		widgets.push(sourceWidgetToDescriptor(widget, type));
-	});
-	if (errors.length > 0) return {
-		success: false,
-		errors
-	};
-	return {
-		success: true,
-		value: {
-			sourcePackage,
-			packageKey,
-			packageId,
-			owner: resolvedOwner,
-			version: sourcePackage.version,
-			widgets
-		},
-		errors: []
-	};
-}
-function buildWidgetPackagePublishManifest(validated, options = {}) {
-	return {
-		manifestVersion: WIDGET_PACKAGE_MANIFEST_VERSION,
-		runtime: "remote-dom",
-		packageId: validated.packageId,
-		source: validated.owner,
-		version: validated.version,
-		workerEntryUrl: toWidgetPackageArtifactPath("widget.js"),
-		cssUrls: mergeCssUrls(validated.sourcePackage.cssUrls, options.cssUrls),
-		assetUrls: [],
-		widgets: validated.widgets.map(({ name: _name, ...widget }) => widget)
-	};
-}
-function sourceWidgetToDescriptor(widget, type) {
-	const displayName = widget.displayName ?? widget.name;
-	return {
-		type,
-		name: widget.name,
-		displayName,
-		description: widget.description ?? `Custom widget ${displayName}`,
-		icon: widget.icon ?? DEFAULT_WIDGET_ICON,
-		category: widget.category ?? DEFAULT_WIDGET_CATEGORY,
-		propertySchema: normalizePropertySchema(widget.propertySchema, type),
-		defaultProps: widget.defaultProps ?? {},
-		container: normalizeContainer(widget.container),
-		minSdkVersion: widget.minSdkVersion ?? DEFAULT_MIN_SDK_VERSION,
-		resizable: normalizeResizable(widget.resizable),
-		capabilities: normalizeCapabilities(widget.capabilities ?? [])
-	};
-}
-function normalizeCapabilities(capabilities) {
-	return capabilities.map((capability) => ({
-		name: capability.name,
-		version: capability.version ?? "1"
-	}));
-}
-function validationFailure(error) {
-	return {
-		success: false,
-		errors: [error]
-	};
-}
-function validateSourcePackageShape(value) {
-	if (!isRecord$3(value)) return [{
-		code: "INVALID_SOURCE_PACKAGE",
-		message: "Widget source package must be a JSON object."
-	}];
-	const errors = [];
-	requireStringField(value, "packageId", "packageId", errors);
-	requireStringField(value, "version", "version", errors);
-	validateOptionalStringField(value, "scope", "scope", errors);
-	validateOptionalStringField(value, "packageStableId", "packageStableId", errors);
-	validateOptionalStringField(value, "packageType", "packageType", errors);
-	if (value.cssUrls !== void 0) if (!Array.isArray(value.cssUrls)) errors.push({
-		code: "INVALID_SOURCE_PACKAGE",
-		path: "cssUrls",
-		message: "Widget package cssUrls must be an array of strings when present."
-	});
-	else value.cssUrls.forEach((cssUrl, index) => {
-		validateCssUrl(cssUrl, `cssUrls[${index}]`, errors);
-	});
-	if (!Array.isArray(value.widgets)) {
-		errors.push({
-			code: "INVALID_SOURCE_PACKAGE",
-			path: "widgets",
-			message: "Widget package widgets must be an array."
-		});
-		return errors;
-	}
-	value.widgets.forEach((widget, index) => {
-		const widgetPath = `widgets[${index}]`;
-		if (!isRecord$3(widget)) {
-			errors.push({
-				code: "INVALID_WIDGET_METADATA",
-				path: widgetPath,
-				message: "Widget metadata must be a JSON object."
-			});
-			return;
-		}
-		requireStringField(widget, "name", `${widgetPath}.name`, errors, {
-			code: "INVALID_WIDGET_NAME",
-			message: "Widget name must be a string and cannot be empty."
-		});
-		validateOptionalStringField(widget, "displayName", `${widgetPath}.displayName`, errors, { requireNonEmpty: true });
-		validateOptionalStringField(widget, "description", `${widgetPath}.description`, errors, { requireNonEmpty: true });
-		validateOptionalStringField(widget, "icon", `${widgetPath}.icon`, errors, { requireNonEmpty: true });
-		validateOptionalStringField(widget, "category", `${widgetPath}.category`, errors, { requireNonEmpty: true });
-		validateOptionalStringField(widget, "minSdkVersion", `${widgetPath}.minSdkVersion`, errors, { requireNonEmpty: true });
-		validateOptionalJsonRecordField(widget, "propertySchema", `${widgetPath}.propertySchema`, errors);
-		validateOptionalJsonRecordField(widget, "defaultProps", `${widgetPath}.defaultProps`, errors);
-		validateOptionalCapabilities(widget, "capabilities", `${widgetPath}.capabilities`, errors);
-	});
-	return errors;
-}
-function requireStringField(record, key, path, errors, override) {
-	const value = record[key];
-	if (typeof value === "string" && value.trim().length > 0) return;
-	errors.push({
-		code: override?.code ?? "INVALID_SOURCE_PACKAGE",
-		path,
-		message: override?.message ?? `${path} must be a string and cannot be empty.`
-	});
-}
-function validateOptionalStringField(record, key, path, errors, options = {}) {
-	const value = record[key];
-	if (value === void 0) return;
-	if (typeof value === "string") {
-		if (!options.requireNonEmpty || value.trim().length > 0) return;
-		errors.push({
-			code: "INVALID_SOURCE_PACKAGE",
-			path,
-			message: `${path} must be a non-empty string when present.`
-		});
-		return;
-	}
-	errors.push({
-		code: "INVALID_SOURCE_PACKAGE",
-		path,
-		message: `${path} must be a string when present.`
-	});
-}
-function validateCssUrl(value, cssUrlPath, errors) {
-	if (typeof value !== "string" || value.trim().length === 0) {
-		errors.push({
-			code: "INVALID_SOURCE_PACKAGE",
-			path: cssUrlPath,
-			message: "Widget package cssUrls entries must be non-empty strings."
-		});
-		return;
-	}
-	if (!isWidgetPackageCssArtifactPath(value)) errors.push({
-		code: "INVALID_SOURCE_PACKAGE",
-		path: cssUrlPath,
-		message: "Widget package cssUrls entries must be top-level generated CSS artifact filenames matching [A-Za-z0-9._~-]+.css. Self-host external CSS or fonts via @font-face in widget CSS so the build can isolate them."
-	});
-}
-function validateOptionalJsonRecordField(record, key, path, errors) {
-	const value = record[key];
-	if (value === void 0) return;
-	if (isRecord$3(value) && isJsonValue(value)) return;
-	errors.push({
-		code: "INVALID_WIDGET_METADATA",
-		path,
-		message: `${path} must be a JSON object when present.`
-	});
-}
-function validateOptionalCapabilities(record, key, path, errors) {
-	const value = record[key];
-	if (value === void 0) return;
-	if (!Array.isArray(value)) {
-		errors.push({
-			code: "INVALID_WIDGET_METADATA",
-			path,
-			message: `${path} must be an array when present.`
-		});
-		return;
-	}
-	const names = /* @__PURE__ */ new Set();
-	value.forEach((candidate, index) => {
-		const capabilityPath = `${path}[${index}]`;
-		if (!isRecord$3(candidate)) {
-			errors.push({
-				code: "INVALID_WIDGET_METADATA",
-				path: capabilityPath,
-				message: `${capabilityPath} must be a JSON object.`
-			});
-			return;
-		}
-		const name = candidate.name;
-		if (!isCanonicalMetadataString(name)) {
-			errors.push({
-				code: "INVALID_WIDGET_METADATA",
-				path: `${capabilityPath}.name`,
-				message: `${capabilityPath}.name must be a non-empty string without surrounding whitespace or control characters.`
-			});
-			return;
-		}
-		const version = candidate.version;
-		if (version !== void 0 && !isCanonicalMetadataString(version)) errors.push({
-			code: "INVALID_WIDGET_METADATA",
-			path: `${capabilityPath}.version`,
-			message: `${capabilityPath}.version must be a non-empty string without surrounding whitespace or control characters when present.`
-		});
-		if (names.has(name)) {
-			errors.push({
-				code: "INVALID_WIDGET_METADATA",
-				path: `${capabilityPath}.name`,
-				message: `${path} must not contain duplicate capability name ${JSON.stringify(name)}.`
-			});
-			return;
-		}
-		names.add(name);
-	});
-}
-function isCanonicalMetadataString(value) {
-	return typeof value === "string" && value.length > 0 && value === value.trim() && !/\p{Cc}/u.test(value);
-}
-function mergeCssUrls(sourceCssUrls, generatedCssUrls) {
-	const generatedCssUrlSet = new Set(generatedCssUrls ?? []);
-	generatedCssUrls?.forEach((cssUrl, index) => {
-		validateGeneratedCssArtifactUrl(cssUrl, `generated cssUrls[${index}]`);
-	});
-	sourceCssUrls?.forEach((cssUrl, index) => {
-		validateGeneratedCssArtifactUrl(cssUrl, `cssUrls[${index}]`);
-		if (generatedCssUrlSet.has(cssUrl)) return;
-		throw new Error(`cssUrls[${index}] URL ${JSON.stringify(cssUrl)} must match a generated top-level CSS artifact. Import the CSS from the widget package bundle or remove it from cssUrls.`);
-	});
-	return Array.from(new Set([...sourceCssUrls ?? [], ...generatedCssUrls ?? []])).map(toWidgetPackageArtifactPath);
-}
-function toWidgetPackageArtifactPath(value) {
-	return value;
-}
-function validateGeneratedCssArtifactUrl(value, cssUrlPath) {
-	if (value.trim().length === 0) throw new Error(`${cssUrlPath} must be a non-empty string.`);
-	if (!isWidgetPackageCssArtifactPath(value)) throw new Error(`${cssUrlPath} must be a top-level generated CSS artifact filename matching [A-Za-z0-9._~-]+.css. Self-host external CSS or fonts via @font-face in widget CSS so the build can isolate them.`);
-}
-function normalizePropertySchema(value, widgetType) {
-	return {
-		...value ?? {},
-		widgetType
-	};
-}
-function normalizeContainer(value) {
-	if (value === "inline" || value === "block" || value === "card" || value === "fullscreen") return value;
-	return DEFAULT_WIDGET_CONTAINER;
-}
-function normalizeResizable(value) {
-	if (typeof value === "boolean") return value;
-	if (value === "horizontal" || value === "vertical" || value === "both") return value;
-	if (!isRecord$3(value)) return false;
-	const horizontal = value.horizontal === true;
-	const vertical = value.vertical === true;
-	if (horizontal && vertical) return "both";
-	if (horizontal) return "horizontal";
-	if (vertical) return "vertical";
-	return false;
-}
-function resolvePackageKey(sourcePackage, owner) {
-	const packageStableId = readNonEmptyTrimmedString(sourcePackage.packageStableId);
-	if (packageStableId) return prefixPackageStableIdWithNonOwnerScope(packageStableId, sourcePackage.scope);
-	return stripOwnerScopeFromPackageId(sourcePackage.packageId, sourcePackage.scope, owner);
-}
-function prefixPackageStableIdWithNonOwnerScope(packageStableId, sourceScope) {
-	const sourceScopeText = readNonEmptyTrimmedString(sourceScope);
-	if (!sourceScopeText || isWidgetPackageOwnerKind(sourceScopeText)) return packageStableId;
-	const sourceScopePrefix = `${sourceScopeText}.`;
-	if (packageStableId.startsWith(sourceScopePrefix)) return packageStableId;
-	return `${sourceScopeText}.${packageStableId}`;
-}
-function stripOwnerScopeFromPackageId(packageId, sourceScope, owner) {
-	const ownerPrefix = `${owner}.`;
-	if (packageId.startsWith(ownerPrefix) && packageId.length > ownerPrefix.length) return packageId.slice(ownerPrefix.length);
-	const sourceScopeText = readNonEmptyTrimmedString(sourceScope);
-	if (isWidgetPackageOwnerKind(sourceScopeText) && packageId.startsWith(`${sourceScopeText}.`) && packageId.length > sourceScopeText.length + 1) return packageId.slice(sourceScopeText.length + 1);
-	return packageId;
-}
-function readNonEmptyTrimmedString(value) {
-	const trimmed = value?.trim();
-	return trimmed ? trimmed : void 0;
-}
-function isWidgetPackageOwnerKind(value) {
-	return value === "company" || value === "droplet";
-}
-function isUrlSafeDottedIdentifier(value) {
-	return URL_SAFE_DOTTED_IDENTIFIER_PATTERN.test(value);
-}
-function isUrlSafeWidgetName(value) {
-	return URL_SAFE_WIDGET_NAME_PATTERN.test(value);
-}
-function isUrlSafeSemver(value) {
-	return SEMVER_URL_SAFE_PATTERN.test(value);
-}
-function isRecord$3(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-//#endregion
-//#region src/utils/widget-package-builder.ts
-const DEFAULT_PUBLISH_DIR = ".fluid/widget-dist";
-const DEFAULT_RUNTIME_VERSION = "1";
-const TEMP_BUILD_DIR = ".fluid/widget-build";
-const TEMP_CLI_DIR = ".fluid/tmp";
-const PROJECT_VITE_CONFIG_CANDIDATES = [
-	"vite.config.ts",
-	"vite.config.mts",
-	"vite.config.js",
-	"vite.config.mjs"
-];
-const BLOCKED_FLUID_PROJECT_PLUGIN_NAMES = ["fluid-portal-dev", "fluid-backend-dev"];
-const require = createRequire(import.meta.url);
-function validateSharedWidgetPackagePublishDir(projectDir, publishDir = DEFAULT_PUBLISH_DIR, options = {}) {
-	const label = options.optionName ?? "publishDir";
-	if (path.isAbsolute(publishDir)) throw new Error(`${label} must be relative to the project directory.`);
-	const normalizedPublishDir = normalizePublishDirForValidation(publishDir);
-	if (normalizedPublishDir === ".fluid" || !normalizedPublishDir.startsWith(".fluid/")) throw new Error(`${label} must be a relative path under .fluid/.`);
-	if (isPathWithinReservedDir(normalizedPublishDir, TEMP_BUILD_DIR)) throw new Error(`${label} must not be ${TEMP_BUILD_DIR} because it is reserved for temporary builder output.`);
-	if (isPathWithinReservedDir(normalizedPublishDir, TEMP_CLI_DIR)) throw new Error(`${label} must not be ${TEMP_CLI_DIR} because it is reserved for Fluid CLI temporary files.`);
-	const resolvedProjectDir = path.resolve(projectDir);
-	const resolvedPublishDir = path.resolve(resolvedProjectDir, publishDir);
-	const relative = path.relative(resolvedProjectDir, resolvedPublishDir);
-	if (relative === "" || relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`${label} must stay inside the project directory.`);
-}
-async function buildSharedWidgetPackage(options) {
-	const publishDirInput = options.publishDir ?? DEFAULT_PUBLISH_DIR;
-	try {
-		await validateWidgetPackageOutputPaths(options.projectDir, publishDirInput);
-	} catch (err) {
-		return failure({
-			code: "INVALID_PUBLISH_DIR",
-			message: "Unsafe widget package publish directory",
-			details: (err instanceof Error ? err : new Error(String(err))).message
-		});
-	}
-	const sourcePackageResult = await loadSourceWidgetPackages(options.projectDir);
-	if (!sourcePackageResult.success) return failure({
-		code: "CONFIG_LOAD_FAILED",
-		message: sourcePackageResult.error.message,
-		details: sourcePackageResult.error.details
-	});
-	const validation = validateSingleSourceWidgetPackage(sourcePackageResult.value, { owner: options.owner });
-	if (!validation.success || !validation.value) return failure({
-		code: "VALIDATION_FAILED",
-		message: validation.errors.map((error) => error.message).join("\n")
-	});
-	try {
-		await validateWidgetPackageOutputPaths(options.projectDir, publishDirInput);
-		const publishDir = path.resolve(options.projectDir, publishDirInput);
-		const widgetScriptPath = path.join(publishDir, "widget.js");
-		await fs.emptyDir(publishDir);
-		const tempDir = path.resolve(options.projectDir, TEMP_BUILD_DIR);
-		await fs.emptyDir(tempDir);
-		let buildFailure;
-		try {
-			await buildWidgetScriptBundle({
-				projectDir: options.projectDir,
-				tempDir,
-				publishDir,
-				validated: validation.value
-			});
-		} catch (error) {
-			buildFailure = { error };
-		}
-		try {
-			await fs.remove(tempDir);
-		} catch {
-			const cleanupFailure = /* @__PURE__ */ new Error("Failed to remove reserved temporary build directory.");
-			if (buildFailure) {
-				const primaryError = buildFailure.error instanceof Error ? buildFailure.error : new Error(String(buildFailure.error));
-				throw new AggregateError([primaryError, cleanupFailure], `${primaryError.message}\n${cleanupFailure.message}`);
-			}
-			throw cleanupFailure;
-		}
-		if (buildFailure) throw buildFailure.error;
-		const cssUrls = await collectCssUrls(publishDir);
-		const descriptor = buildWidgetPackagePublishManifest(validation.value, { cssUrls });
-		const manifestContent = stableStringify(descriptor);
-		const publishPackageId = descriptor.packageId;
-		const manifestPath = path.join(publishDir, "manifest.json");
-		const publishManifestPath = path.join(publishDir, "publish-manifest.json");
-		await fs.writeFile(manifestPath, manifestContent, "utf-8");
-		const artifacts = await collectWidgetPackageArtifacts(publishDir);
-		const publishManifest = createPublishManifestMetadata({
-			packageId: publishPackageId,
-			version: validation.value.version,
-			cliVersion: readCliVersion(),
-			runtimeVersion: DEFAULT_RUNTIME_VERSION,
-			manifestContent,
-			artifacts
-		});
-		await fs.writeFile(publishManifestPath, stableStringify(publishManifest), "utf-8");
-		return success({
-			publishDir,
-			packageId: validation.value.packageId,
-			version: validation.value.version,
-			manifestPath,
-			publishManifestPath,
-			widgetScriptPath
-		});
-	} catch (err) {
-		const error = err instanceof Error ? err : new Error(String(err));
-		const isPublishDirValidationError = /^(publishDir|reserved temporary build directory) /.test(error.message);
-		return failure({
-			code: isPublishDirValidationError ? "INVALID_PUBLISH_DIR" : "WRITE_FAILED",
-			message: isPublishDirValidationError ? "Unsafe widget package publish directory" : "Failed to build shared widget package artifacts",
-			details: error.message
-		});
-	}
-}
-function createWidgetPackageEntrySource(options) {
-	return `import { createElement } from "react";
-import { startWidgetPackage } from "@fluid-app/portal-sdk/widgets/worker";
-${options.cssImportPath ? `import ${JSON.stringify(options.cssImportPath)};` : ""}
-
-const widgetConfig = await import(${JSON.stringify(options.configImportPath)});
-const SOURCE_PACKAGE_MARKER = "__fluidSourceWidgetPackage";
-const descriptors = ${JSON.stringify(options.validated.widgets, null, 2)};
-
-function isSourceWidgetPackage(value) {
-  return Boolean(value && typeof value === "object" && value[SOURCE_PACKAGE_MARKER] === true);
-}
-
-function collectSourceWidgetPackages(mod) {
-  return [
-    mod.widgetPackage,
-    ...(Array.isArray(mod.widgetPackages) ? mod.widgetPackages : []),
-    mod.default,
-  ].filter(isSourceWidgetPackage);
-}
-
-const sourcePackage = collectSourceWidgetPackages(widgetConfig)[0];
-if (!sourcePackage) {
-  throw new Error("No Fluid source widget package found while loading widget package worker bundle.");
-}
-
-const componentsByName = new Map(
-  sourcePackage.widgets.map((widget) => [widget.name, widget.component]),
-);
-
-const widgets = descriptors.map((descriptor) => {
-  const component = componentsByName.get(descriptor.name);
-  if (typeof component !== "function") {
-    throw new Error("Widget package is missing Remote DOM component for " + descriptor.name + ".");
-  }
-  return {
-    ...descriptor,
-    component: (props) => createElement(component, props),
-  };
-});
-
-startWidgetPackage({ widgets });
-`;
-}
-async function buildWidgetScriptBundle(options) {
-	const sourceConfig = await resolvePortalWidgetSourceConfig(options.projectDir);
-	if (!sourceConfig) throw new Error("No portal widget source config found.");
-	const entryPath = path.join(options.tempDir, "widget-entry.ts");
-	const viteConfigPath = path.join(options.tempDir, "vite.config.mjs");
-	const rootStylesPath = path.join(options.projectDir, "styles.css");
-	await fs.writeFile(entryPath, createWidgetPackageEntrySource({
-		configImportPath: pathToFileURL(sourceConfig.path).href,
-		cssImportPath: await fs.pathExists(rootStylesPath) ? pathToFileURL(rootStylesPath).href : void 0,
-		validated: options.validated
-	}), "utf-8");
-	await fs.writeFile(viteConfigPath, createViteConfigSource({
-		entryPath,
-		publishDir: options.publishDir,
-		projectConfigPath: await resolveProjectViteConfigPath(options.projectDir)
-	}), "utf-8");
-	const viteCliPath = resolveViteCliPath(options.projectDir);
-	await execa(process.execPath, [
-		viteCliPath,
-		"build",
-		"--config",
-		viteConfigPath
-	], {
-		cwd: options.projectDir,
-		stdio: "pipe",
-		env: {
-			...process.env,
-			NODE_ENV: "production"
-		}
-	});
-}
-function resolveViteCliPath(projectDir) {
-	const projectViteCliPath = resolveViteCliPathFromRequire(createRequire(path.join(projectDir, "package.json")));
-	if (projectViteCliPath) return projectViteCliPath;
-	const cliViteCliPath = resolveViteCliPathFromRequire(require);
-	if (cliViteCliPath) return cliViteCliPath;
-	throw new Error("Unable to resolve Vite for the portal project. Install the project dependencies and ensure vite is available before building widget packages.");
-}
-async function resolveProjectViteConfigPath(projectDir) {
-	for (const fileName of PROJECT_VITE_CONFIG_CANDIDATES) {
-		const candidate = path.join(projectDir, fileName);
-		if (await fs.pathExists(candidate)) return candidate;
-	}
-}
-function createViteConfigSource(options) {
-	const widgetConfigSource = createWidgetViteConfigObjectSource({
-		...options,
-		disableConfigFileLookup: !options.projectConfigPath
-	});
-	if (!options.projectConfigPath) return `import { defineConfig } from "vite";
-
-export default defineConfig(${widgetConfigSource});
-`;
-	return `import { defineConfig, loadConfigFromFile, mergeConfig } from "vite";
-
-const projectConfigPath = ${JSON.stringify(options.projectConfigPath)};
-const widgetConfig = ${widgetConfigSource};
-const fluidWidgetDefineInvariants = {
-  "process.env.NODE_ENV": JSON.stringify("production"),
-};
-const blockedFluidPluginNames = new Set(${JSON.stringify(BLOCKED_FLUID_PROJECT_PLUGIN_NAMES)});
-
-function isAllowedProjectPlugin(plugin) {
-  return !plugin || typeof plugin !== "object" || !blockedFluidPluginNames.has(plugin.name);
-}
-
-function sanitizeProjectPlugins(pluginOption) {
-  if (!Array.isArray(pluginOption)) {
-    return isAllowedProjectPlugin(pluginOption) ? pluginOption : [];
-  }
-
-  return pluginOption
-    .map((plugin) => Array.isArray(plugin) ? sanitizeProjectPlugins(plugin) : plugin)
-    .filter(isAllowedProjectPlugin);
-}
-
-function copyProjectConfigValue(source, target, key) {
-  if (Object.prototype.hasOwnProperty.call(source, key)) {
-    target[key] = source[key];
-  }
-}
-
-function sanitizeProjectConfig(config) {
-  if (!config || typeof config !== "object") return {};
-
-  const sanitized = {};
-  if (Object.prototype.hasOwnProperty.call(config, "plugins")) {
-    sanitized.plugins = sanitizeProjectPlugins(config.plugins);
-  }
-  copyProjectConfigValue(config, sanitized, "resolve");
-  copyProjectConfigValue(config, sanitized, "define");
-  copyProjectConfigValue(config, sanitized, "css");
-  copyProjectConfigValue(config, sanitized, "esbuild");
-  copyProjectConfigValue(config, sanitized, "json");
-  copyProjectConfigValue(config, sanitized, "assetsInclude");
-  copyProjectConfigValue(config, sanitized, "envDir");
-  copyProjectConfigValue(config, sanitized, "envPrefix");
-  return sanitized;
-}
-
-function copyConfigDefineValue(value) {
-  return value && typeof value === "object" && !Array.isArray(value)
-    ? { ...value }
-    : {};
-}
-
-function mergeFluidWidgetDefineInvariants(mergedConfig, safeProjectConfig, widgetConfig) {
-  mergedConfig.define = {
-    ...copyConfigDefineValue(safeProjectConfig.define),
-    ...copyConfigDefineValue(mergedConfig.define),
-    ...copyConfigDefineValue(widgetConfig.define),
-    ...fluidWidgetDefineInvariants,
-  };
-  return mergedConfig;
-}
-
-export default defineConfig(async (configEnv) => {
-  const projectConfig = await loadConfigFromFile(configEnv, projectConfigPath);
-  const safeProjectConfig = sanitizeProjectConfig(projectConfig?.config ?? {});
-  return mergeFluidWidgetDefineInvariants(mergeConfig(safeProjectConfig, widgetConfig), safeProjectConfig, widgetConfig);
-});
-`;
-}
-function createWidgetViteConfigObjectSource(options) {
-	const configFileSource = options.disableConfigFileLookup ? "  configFile: false,\n" : "";
-	return `(() => {
-  const fluidWidgetDefineInvariants = {
-    "process.env.NODE_ENV": JSON.stringify("production"),
-  };
-
-  function createFluidWidgetBuildInvariants() {
-    return {
-      copyPublicDir: false,
-      emptyOutDir: false,
-      outDir: ${JSON.stringify(options.publishDir)},
-      sourcemap: false,
-      target: "esnext",
-      cssCodeSplit: false,
-      lib: {
-        entry: ${JSON.stringify(options.entryPath)},
-        formats: ["es"],
-        fileName: () => "widget.js",
-        cssFileName: "widget",
-      },
-      rollupOptions: {
-        output: {
-          inlineDynamicImports: true,
-          hoistTransitiveImports: false,
-        },
-      },
-    };
-  }
-
-  function fluidWidgetBuildInvariantsPlugin() {
-    return {
-      name: "fluid-widget-build-invariants",
-      enforce: "post",
-      config() {
-        return { build: createFluidWidgetBuildInvariants() };
-      },
-      configResolved(config) {
-        config.define = {
-          ...(config.define ?? {}),
-          ...fluidWidgetDefineInvariants,
-        };
-        Object.assign(config.build, createFluidWidgetBuildInvariants());
-      },
-    };
-  }
-
-  return {
-${configFileSource}    publicDir: false,
-    define: fluidWidgetDefineInvariants,
-    resolve: {
-      conditions: [
-        "module",
-        "browser",
-        "development|production",
-      ],
-    },
-    plugins: [fluidWidgetBuildInvariantsPlugin()],
-    build: createFluidWidgetBuildInvariants(),
-  };
-})()`;
-}
-async function validateWidgetPackageOutputPaths(projectDir, publishDir) {
-	validateSharedWidgetPackagePublishDir(projectDir, publishDir);
-	await rejectSymlinkedPathSegments({
-		projectDir,
-		relativePath: publishDir,
-		label: "publishDir"
-	});
-	await rejectSymlinkedPathSegments({
-		projectDir,
-		relativePath: TEMP_BUILD_DIR,
-		label: "reserved temporary build directory"
-	});
-}
-async function collectCssUrls(publishDir) {
-	return (await fs.readdir(publishDir, { withFileTypes: true })).filter((entry) => entry.isFile() && isWidgetPackageCssArtifactPath(entry.name)).map((entry) => entry.name).sort();
-}
-async function rejectSymlinkedPathSegments(options) {
-	const resolvedProjectDir = path.resolve(options.projectDir);
-	const resolvedTargetPath = path.resolve(resolvedProjectDir, options.relativePath);
-	const segments = path.relative(resolvedProjectDir, resolvedTargetPath).split(path.sep).filter(Boolean);
-	let currentPath = resolvedProjectDir;
-	for (const segment of segments) {
-		currentPath = path.join(currentPath, segment);
-		let stat;
-		try {
-			stat = await fs.lstat(currentPath);
-		} catch (err) {
-			if (isNodeError(err) && err.code === "ENOENT") return;
-			throw err;
-		}
-		if (stat.isSymbolicLink()) throw new Error(`${options.label} must not include symbolic links.`);
-	}
-}
-function normalizePublishDirForValidation(value) {
-	return toPosixPath(path.normalize(value)).replace(/\/+$/, "") || ".";
-}
-function isPathWithinReservedDir(value, reservedDir) {
-	return value === reservedDir || value.startsWith(`${reservedDir}/`);
-}
-function toPosixPath(value) {
-	return value.split(path.sep).join("/");
-}
-function stableStringify(value) {
-	return `${JSON.stringify(value, null, 2)}\n`;
-}
-function readCliVersion() {
-	return resolveCliVersionFromPackageMetadata(path.dirname(fileURLToPath(import.meta.url)), require);
-}
-function resolveCliVersionFromPackageMetadata(startDir, loadPackageMetadata) {
-	for (const packageJsonPath of candidatePackageJsonPaths(startDir)) {
-		let packageJson;
-		try {
-			packageJson = loadPackageMetadata(packageJsonPath);
-		} catch (error) {
-			if (isModuleResolutionError(error)) continue;
-			throw new Error("Failed to read Fluid CLI package metadata.", { cause: error });
-		}
-		if (!isRecord$2(packageJson) || packageJson.name !== "@fluid-app/fluid-cli-portal") continue;
-		if (typeof packageJson.version !== "string" || packageJson.version.length === 0) throw new Error("Fluid CLI package metadata does not declare a valid version.");
-		return packageJson.version;
-	}
-	throw new Error("Unable to find Fluid CLI package metadata.");
-}
-function resolveViteCliPathFromRequire(moduleRequire) {
-	try {
-		const packageJsonPath = moduleRequire.resolve("vite/package.json");
-		const binPath = getViteBinPath(moduleRequire(packageJsonPath).bin);
-		if (!binPath) return void 0;
-		return path.resolve(path.dirname(packageJsonPath), binPath);
-	} catch (err) {
-		if (isModuleResolutionError(err)) return void 0;
-		throw err;
-	}
-}
-function getViteBinPath(bin) {
-	if (typeof bin === "string") return bin;
-	if (!isRecord$2(bin)) return void 0;
-	const viteBin = bin.vite;
-	return typeof viteBin === "string" ? viteBin : void 0;
-}
-function isRecord$2(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isNodeError(value) {
-	return typeof value === "object" && value !== null && "code" in value && typeof value.code === "string";
-}
-function isModuleResolutionError(value) {
-	return isNodeError(value) && (value.code === "MODULE_NOT_FOUND" || value.code === "ERR_MODULE_NOT_FOUND");
-}
-function candidatePackageJsonPaths(startDir) {
-	const paths = [];
-	let current = startDir;
-	while (true) {
-		paths.push(path.join(current, "package.json"));
-		const parent = path.dirname(current);
-		if (parent === current) return paths;
-		current = parent;
-	}
-}
-//#endregion
-//#region src/utils/widget-package-upload.ts
-var WidgetPackageUploadError = class extends Error {
-	code;
-	constructor(code, message) {
-		super(message);
-		this.name = "WidgetPackageUploadError";
-		this.code = code;
-	}
-};
-function buildWidgetPackageArtifactPayload(artifact) {
-	return {
-		path: artifact.path,
-		sha256: artifact.sha256,
-		bytes: artifact.bytes,
-		contentType: artifact.contentType
-	};
-}
-function buildWidgetPackageUploadSessionPayload(request) {
-	return {
-		version: request.version,
-		package_key: request.packageKey,
-		builder_version: request.builderVersion,
-		cli_version: request.cliVersion,
-		runtime_version: request.runtimeVersion,
-		manifest_hash: request.manifestHash,
-		manifest: request.manifest,
-		artifacts: request.artifacts.map(buildWidgetPackageArtifactPayload)
-	};
-}
-function buildWidgetPackageCompleteUploadPayload(packageKey, artifacts) {
-	return {
-		package_key: packageKey,
-		artifacts: artifacts.map(buildWidgetPackageArtifactPayload)
-	};
-}
-function getWidgetPackageUploadSessionRoute(owner) {
-	switch (owner.kind) {
-		case "droplet": return `/api/droplets/${encodeURIComponent(owner.uuid)}/widget_package_versions`;
-		case "company": return "/api/company/fluid_os/widget_package_versions";
-	}
-}
-function getWidgetPackageCompleteUploadRoute(owner, version) {
-	switch (owner.kind) {
-		case "droplet": return `/api/droplets/${encodeURIComponent(owner.uuid)}/widget_package_versions/${encodeURIComponent(version)}/complete_upload`;
-		case "company": return `/api/company/fluid_os/widget_package_versions/${encodeURIComponent(version)}/complete_upload`;
-	}
-}
-async function requestWidgetPackageUploadSession(client, owner, request) {
-	const payload = buildWidgetPackageUploadSessionPayload(request);
-	try {
-		return normalizeWidgetPackageUploadSession(owner.kind === "company" ? await fluid_os_v0_create_widget_package_version(client, payload) : await client.post(getWidgetPackageUploadSessionRoute(owner), payload), request.version, request.artifacts);
-	} catch (err) {
-		if (err instanceof WidgetPackageUploadError) throw err;
-		throw new WidgetPackageUploadError("SESSION_REQUEST_FAILED", `Failed to create widget package upload session: ${formatUnknownError(err)}`);
-	}
-}
-async function uploadWidgetPackageArtifacts(session, artifacts, fetchImpl = fetch) {
-	const uploadsByPath = new Map(session.uploads.map((upload) => [upload.path, upload]));
-	const results = [];
-	for (const artifact of artifacts) {
-		const upload = uploadsByPath.get(artifact.path);
-		if (!upload) throw new WidgetPackageUploadError("MISSING_SIGNED_URL", `Upload session did not include a signed URL for artifact "${artifact.path}".`);
-		if (upload.contentType !== artifact.contentType) throw new WidgetPackageUploadError("CONTENT_TYPE_MISMATCH", `Upload session expected artifact "${artifact.path}" to use content type "${upload.contentType}", but local artifact uses "${artifact.contentType}".`);
-		let response;
-		try {
-			response = await fetchImpl(upload.url, {
-				method: "PUT",
-				headers: mergeUploadHeaders(upload.headers, upload.contentType),
-				body: artifact.body
-			});
-		} catch (err) {
-			throw new WidgetPackageUploadError("ARTIFACT_UPLOAD_FAILED", `Failed to upload artifact "${artifact.path}": ${formatUnknownError(err)}`);
-		}
-		if (!response.ok) {
-			const body = await response.text().catch(() => "");
-			const details = body.trim() ? `: ${body.trim().slice(0, 500)}` : "";
-			throw new WidgetPackageUploadError("ARTIFACT_UPLOAD_FAILED", `Failed to upload artifact "${artifact.path}": PUT returned HTTP ${response.status}${details}`);
-		}
-		results.push({
-			path: artifact.path,
-			status: response.status,
-			contentType: upload.contentType
-		});
-	}
-	return results;
-}
-async function completeWidgetPackageUpload(client, owner, version, packageKey, artifacts) {
-	const payload = buildWidgetPackageCompleteUploadPayload(packageKey, artifacts);
+/**
+* The whole deploy, as one function returning a result.
+*
+* A result rather than a throw because two of its outcomes — a key that belongs
+* to another package, a version already published — are refusals with a fix to
+* show, not exceptions.
+*/
+async function runPortalDeploy(options) {
 	try {
-		return normalizeWidgetPackageCompleteResponse(owner.kind === "company" ? await fluid_os_v0_complete_widget_package_version_upload(client, version, payload) : await client.post(getWidgetPackageCompleteUploadRoute(owner, version), payload), version);
-	} catch (err) {
-		if (err instanceof WidgetPackageUploadError) throw err;
-		throw new WidgetPackageUploadError("COMPLETE_UPLOAD_FAILED", `Failed to complete widget package upload: ${formatUnknownError(err)}`);
-	}
-}
-async function publishWidgetPackageVersion(options) {
-	const sessionPayload = buildWidgetPackageUploadSessionPayload(options.request);
-	if (options.dryRun) return {
-		dryRun: true,
-		sessionPayload
-	};
-	if (!options.client) throw new Error("A FetchClient is required when dryRun is false.");
-	const session = await requestWidgetPackageUploadSession(options.client, options.owner, options.request);
-	return {
-		dryRun: false,
-		sessionPayload,
-		session,
-		uploadedArtifacts: await uploadWidgetPackageArtifacts(session, options.request.artifacts, options.fetchImpl),
-		complete: await completeWidgetPackageUpload(options.client, options.owner, session.version, options.request.packageKey, options.request.artifacts)
-	};
-}
-function normalizeWidgetPackageUploadSession(response, requestedVersion, requestedArtifacts) {
-	const record = requireRecord(response, "INVALID_SESSION_RESPONSE", "Upload session response must be a JSON object.");
-	requireFiniteNumberProperty(record, "version_id", "INVALID_SESSION_RESPONSE");
-	requireStringProperty(record, "artifact_base_url", "INVALID_SESSION_RESPONSE");
-	const uploadValues = record["uploads"];
-	if (!Array.isArray(uploadValues)) throw new WidgetPackageUploadError("INVALID_SESSION_RESPONSE", "Upload session response must contain an \"uploads\" array.");
-	const requestedArtifactsByPath = new Map(requestedArtifacts.map((artifact) => [artifact.path, artifact]));
-	const seenUploadPaths = /* @__PURE__ */ new Set();
-	const uploads = uploadValues.map((value, index) => {
-		const upload = requireRecord(value, "INVALID_SESSION_RESPONSE", `Upload session uploads[${index}] must be a JSON object.`);
-		const path = requireStringProperty(upload, "path", "INVALID_SESSION_RESPONSE");
-		const url = requireStringProperty(upload, "upload_url", "INVALID_SESSION_RESPONSE");
-		requireStringProperty(upload, "public_url", "INVALID_SESSION_RESPONSE");
-		const requestedArtifact = requestedArtifactsByPath.get(path);
-		if (!requestedArtifact) throw new WidgetPackageUploadError("INVALID_SESSION_RESPONSE", `Upload session response included unexpected artifact "${path}".`);
-		if (seenUploadPaths.has(path)) throw new WidgetPackageUploadError("INVALID_SESSION_RESPONSE", `Upload session response included duplicate artifact "${path}".`);
-		seenUploadPaths.add(path);
+		await assertStandalonePortalRemoteActionAllowed(options.projectDir, "portal deploy");
+	} catch (error) {
 		return {
-			path,
-			url,
-			contentType: requestedArtifact.contentType,
-			headers: {}
+			ok: false,
+			code: "STANDALONE_PORTAL",
+			message: error instanceof Error ? error.message : String(error)
 		};
-	});
-	const missingUploadPaths = requestedArtifacts.map((artifact) => artifact.path).filter((artifactPath) => !seenUploadPaths.has(artifactPath));
-	if (missingUploadPaths.length > 0) throw new WidgetPackageUploadError("INVALID_SESSION_RESPONSE", `Upload session response is missing signed URLs for artifact(s): ${missingUploadPaths.join(", ")}.`);
-	return {
-		version: requestedVersion,
-		uploads,
-		raw: response
-	};
-}
-function normalizeWidgetPackageCompleteResponse(response, requestedVersion) {
-	const record = requireRecord(response, "INVALID_COMPLETE_RESPONSE", "Complete upload response must be a JSON object.");
-	const responseVersion = requireStringProperty(record, "version", "INVALID_COMPLETE_RESPONSE");
-	if (responseVersion !== requestedVersion) throw new WidgetPackageUploadError("INVALID_COMPLETE_RESPONSE", `Complete upload response version "${responseVersion}" did not match requested version "${requestedVersion}".`);
-	const packageKey = requireStringProperty(record, "packageId", "INVALID_COMPLETE_RESPONSE");
-	const status = requireStringProperty(record, "status", "INVALID_COMPLETE_RESPONSE");
-	requireStringProperty(record, "scriptUrl", "INVALID_COMPLETE_RESPONSE");
-	requireStringProperty(record, "manifestUrl", "INVALID_COMPLETE_RESPONSE");
-	requireStringArrayProperty(record, "cssUrls", "INVALID_COMPLETE_RESPONSE");
-	return {
-		version: responseVersion,
-		status,
-		packageKey,
-		raw: response
-	};
-}
-function normalizeHeaderName(name) {
-	return name.toLowerCase();
-}
-function mergeUploadHeaders(headers, contentType) {
-	const merged = {};
-	for (const [key, value] of Object.entries(headers)) {
-		if (normalizeHeaderName(key) === "content-type") continue;
-		merged[key] = value;
 	}
-	merged["Content-Type"] = contentType;
-	return merged;
-}
-function requireRecord(value, code, message) {
-	if (!isRecord$1(value) || Array.isArray(value)) throw new WidgetPackageUploadError(code, message);
-	return value;
-}
-function isRecord$1(value) {
-	return typeof value === "object" && value !== null;
-}
-function requireStringProperty(record, key, code) {
-	const value = record[key];
-	if (typeof value === "string" && value.trim().length > 0) return value;
-	throw new WidgetPackageUploadError(code, `Response field "${key}" must be a non-empty string.`);
-}
-function requireFiniteNumberProperty(record, key, code) {
-	const value = record[key];
-	if (typeof value === "number" && Number.isFinite(value)) return value;
-	throw new WidgetPackageUploadError(code, `Response field "${key}" must be a finite number.`);
-}
-function requireStringArrayProperty(record, key, code) {
-	const value = record[key];
-	if (Array.isArray(value) && value.every((entry) => typeof entry === "string" && entry.trim().length > 0)) return value;
-	throw new WidgetPackageUploadError(code, `Response field "${key}" must be an array of non-empty strings.`);
-}
-function formatUnknownError(err) {
-	const base = err instanceof Error ? err.message : String(err);
-	if (isRecord$1(err) && "data" in err) return `${base} — ${safeStringify(err.data)}`;
-	return base;
-}
-function safeStringify(value) {
-	const seen = /* @__PURE__ */ new WeakSet();
-	try {
-		return JSON.stringify(value, (_key, item) => {
-			if (typeof item === "bigint") return `${item}n`;
-			if (typeof item !== "object" || item === null) return item;
-			if (seen.has(item)) return "[Circular]";
-			seen.add(item);
-			return item;
-		}) ?? String(value);
-	} catch {
-		return "[unserializable error data]";
+	let client;
+	if (!options.dryRun) try {
+		client = createAuthenticatedWidgetPackageClient();
+	} catch (error) {
+		return {
+			ok: false,
+			code: "NOT_AUTHENTICATED",
+			message: "Not signed in to Fluid, so the widgets were not published.",
+			...error instanceof Error ? { hint: error.message } : {}
+		};
 	}
-}
-//#endregion
-//#region src/commands/widget-package-publish.ts
-async function publishWidgetRuntimeArtifacts(options, dependencies = {}) {
-	const buildPackage = dependencies.buildSharedWidgetPackage ?? buildSharedWidgetPackage;
-	const publishVersion = dependencies.publishWidgetPackageVersion ?? publishWidgetPackageVersion;
-	const isDryRun = options.dryRun === true;
-	const client = options.client;
-	if (!isDryRun && !client) throw new Error("A FetchClient is required when dryRun is false.");
-	const safeOutDir = validateWidgetPublishOutDir(options.projectDir, options.outDir);
-	const buildResult = await buildPackage({
-		projectDir: options.projectDir,
-		publishDir: safeOutDir,
-		owner: options.buildOwner
-	});
-	if (!buildResult.success) {
-		const details = buildResult.error.details ? `\n${buildResult.error.details}` : "";
-		throw new Error(`${buildResult.error.message}${details}`);
-	}
-	const request = await createWidgetPackagePublishRequest({
-		publishDir: buildResult.value.publishDir,
-		manifestPath: buildResult.value.manifestPath,
-		publishManifestPath: buildResult.value.publishManifestPath,
-		owner: options.buildOwner
-	});
-	let publish;
-	if (isDryRun) publish = await publishVersion({
-		owner: options.uploadOwner,
-		request,
-		dryRun: true
-	});
-	else {
-		if (!client) throw new Error("A FetchClient is required when dryRun is false.");
-		publish = await publishVersion({
+	let preflight = {};
+	if (client) {
+		options.onProgress?.("Checking this company's widget package...");
+		preflight = await preflightCompanyPackage({
+			projectDir: options.projectDir,
 			client,
-			owner: options.uploadOwner,
-			request
+			readConfiguredPackage: async (dir) => {
+				const { validated } = await loadAndValidateWidgetPackage({
+					projectDir: dir,
+					owner: "company"
+				});
+				return {
+					packageId: validated.packageId,
+					version: validated.version
+				};
+			}
 		});
-	}
-	return {
-		build: buildResult.value,
-		request,
-		publish
-	};
-}
-async function createWidgetPackagePublishRequest(options) {
-	const manifestContent = await fs.readFile(options.manifestPath);
-	const manifest = parseJsonRecord(manifestContent.toString("utf-8"), options.manifestPath);
-	const publishManifest = await readPublishManifest(options.publishManifestPath);
-	assertManifestIdentityMatches(manifest, publishManifest, options.manifestPath);
-	assertMetadataMatches({
-		label: "manifestHash",
-		path: "manifest.json",
-		expected: publishManifest.manifestHash,
-		actual: sha256(manifestContent)
-	});
-	const collectedArtifacts = await collectWidgetPackageArtifacts(options.publishDir);
-	assertArtifactInventoryMatches(publishManifest.artifacts, collectedArtifacts);
-	const artifacts = await readUploadArtifacts(options.publishDir, publishManifest.artifacts);
-	return {
-		version: publishManifest.version,
-		packageKey: stripOwnerPrefix(publishManifest.packageId, options.owner),
-		builderVersion: publishManifest.builderVersion,
-		cliVersion: publishManifest.cliVersion,
-		runtimeVersion: publishManifest.runtimeVersion,
-		manifestHash: publishManifest.manifestHash,
-		manifest,
-		artifacts
-	};
-}
-function createAuthenticatedWidgetPackageClient() {
-	const { profile, profileName, token } = resolveAuthenticatedProfile();
-	if (!token) {
-		if (!profileName) throw new Error("Not logged in. Run " + chalk.cyan("fluid login") + " first.");
-		throw new Error("No auth token found for profile " + chalk.cyan(profileName) + ". Run " + chalk.cyan("fluid login") + " to re-authenticate.");
-	}
-	return createFetchClient({
-		baseUrl: profile?.baseUrl ?? process.env["FLUID_API_BASE"] ?? "https://api.fluid.app",
-		getAuthToken: () => token
-	});
-}
-function resolveAuthenticatedProfile() {
-	const config = readConfig();
-	const projectConfig = findProjectConfig(process.cwd());
-	if (projectConfig?.profile) {
-		const profile = config.profiles[projectConfig.profile];
-		if (profile) return {
-			profile,
-			profileName: projectConfig.profile,
-			token: profile.token
+		if (preflight.mismatch) return {
+			ok: false,
+			code: "PACKAGE_KEY_MISMATCH",
+			message: "This project publishes under a different package key.",
+			hint: preflight.mismatch
 		};
 	}
-	if (!config.activeProfile) return {};
-	const profile = config.profiles[config.activeProfile];
-	if (!profile) return {};
-	return {
-		profile,
-		profileName: config.activeProfile,
-		token: profile.token
-	};
-}
-function printWidgetPublishSummary(options) {
-	console.log();
-	console.log(chalk.green.bold(`${options.title} complete`));
-	console.log();
-	console.log(chalk.gray("Owner:       ") + chalk.white(options.ownerLabel));
-	if (options.environment) console.log(chalk.gray("Environment: ") + chalk.white(options.environment));
-	console.log(chalk.gray("Package:     ") + chalk.white(options.result.build.packageId));
-	console.log(chalk.gray("Version:     ") + chalk.white(options.result.build.version));
-	console.log(chalk.gray("Output:      ") + chalk.cyan(options.outDir));
-	console.log(chalk.gray("Artifacts:   ") + chalk.white(String(options.result.request.artifacts.length)));
-	console.log();
-}
-function printRuntimeOnlyNotice() {
-	console.log(chalk.yellow("This publishes widget runtime artifacts only; it does not deploy the hosted portal shell."));
-	console.log();
-}
-function printDryRunSessionPayload(result) {
-	console.log(chalk.bold("Dry-run upload session payload:"));
-	console.log(JSON.stringify(result.publish.sessionPayload, null, 2));
-	console.log();
-}
-function validateWidgetPublishOutDir(projectDir, outDir) {
-	validateSharedWidgetPackagePublishDir(projectDir, outDir, { optionName: "--out-dir" });
-	return outDir;
-}
-async function readJsonRecord(filePath) {
-	return parseJsonRecord(await fs.readFile(filePath, "utf-8"), filePath);
-}
-function parseJsonRecord(content, filePath) {
-	const value = JSON.parse(content);
-	if (!isRecord(value) || Array.isArray(value)) throw new Error(`${path.basename(filePath)} must contain a JSON object.`);
-	return value;
-}
-async function readPublishManifest(filePath) {
-	const record = await readJsonRecord(filePath);
-	const artifactsValue = record["artifacts"];
-	if (!Array.isArray(artifactsValue)) throw new Error("publish-manifest.json must include an artifacts array.");
-	return {
-		packageId: readRequiredString(record, "packageId", filePath),
-		version: readRequiredString(record, "version", filePath),
-		builderVersion: readRequiredString(record, "builderVersion", filePath),
-		cliVersion: readRequiredString(record, "cliVersion", filePath),
-		runtimeVersion: readRequiredString(record, "runtimeVersion", filePath),
-		manifestHash: readRequiredString(record, "manifestHash", filePath),
-		artifacts: artifactsValue.map((artifact, index) => readArtifactMetadata(artifact, index))
-	};
-}
-function readArtifactMetadata(value, index) {
-	if (!isRecord(value) || Array.isArray(value)) throw new Error(`publish-manifest.json artifacts[${index}] must be a JSON object.`);
-	return {
-		path: readRequiredString(value, "path", "publish-manifest.json"),
-		sha256: readRequiredString(value, "sha256", "publish-manifest.json"),
-		bytes: readRequiredNumber(value, "bytes", "publish-manifest.json"),
-		contentType: readRequiredString(value, "contentType", "publish-manifest.json")
-	};
-}
-async function readUploadArtifacts(publishDir, artifacts) {
-	const resolvedPublishDir = path.resolve(publishDir);
-	return Promise.all(artifacts.map(async (artifact) => {
-		const artifactPath = resolveArtifactPath(resolvedPublishDir, artifact.path);
-		const actual = await computeArtifactMetadata(artifactPath, resolvedPublishDir);
-		assertArtifactMetadataMatches(artifact, actual);
-		return {
-			...actual,
-			body: await fs.readFile(artifactPath)
-		};
-	}));
-}
-function assertManifestIdentityMatches(manifest, publishManifest, manifestPath) {
-	assertMetadataMatches({
-		label: "packageId",
-		path: "manifest.json",
-		expected: publishManifest.packageId,
-		actual: readRequiredString(manifest, "packageId", manifestPath)
-	});
-	assertMetadataMatches({
-		label: "version",
-		path: "manifest.json",
-		expected: publishManifest.version,
-		actual: readRequiredString(manifest, "version", manifestPath)
-	});
-}
-function assertArtifactInventoryMatches(expected, actual) {
-	const expectedByPath = /* @__PURE__ */ new Map();
-	for (const artifact of expected) {
-		if (expectedByPath.has(artifact.path)) throw new Error(`publish-manifest.json artifacts include duplicate path ${JSON.stringify(artifact.path)}. Rebuild the widget package before publishing.`);
-		expectedByPath.set(artifact.path, artifact);
-	}
-	const actualPaths = /* @__PURE__ */ new Set();
-	for (const actualArtifact of actual) {
-		actualPaths.add(actualArtifact.path);
-		const expectedArtifact = expectedByPath.get(actualArtifact.path);
-		if (!expectedArtifact) throw new Error(`publish-manifest.json artifacts omit ${JSON.stringify(actualArtifact.path)}. Rebuild the widget package before publishing.`);
-		assertArtifactMetadataMatches(expectedArtifact, actualArtifact);
-	}
-	for (const expectedArtifact of expected) {
-		if (actualPaths.has(expectedArtifact.path)) continue;
-		throw new Error(`publish-manifest.json artifacts include ${JSON.stringify(expectedArtifact.path)}, but that file is not present on disk. Rebuild the widget package before publishing.`);
-	}
-}
-function assertArtifactMetadataMatches(expected, actual) {
-	assertMetadataMatches({
-		label: "path",
-		path: expected.path,
-		expected: expected.path,
-		actual: actual.path
-	});
-	assertMetadataMatches({
-		label: "sha256",
-		path: expected.path,
-		expected: expected.sha256,
-		actual: actual.sha256
-	});
-	assertMetadataMatches({
-		label: "bytes",
-		path: expected.path,
-		expected: expected.bytes,
-		actual: actual.bytes
-	});
-	assertMetadataMatches({
-		label: "contentType",
-		path: expected.path,
-		expected: expected.contentType,
-		actual: actual.contentType
-	});
-}
-function assertMetadataMatches(options) {
-	if (options.expected === options.actual) return;
-	throw new Error(`publish-manifest.json ${options.label} for ${JSON.stringify(options.path)} does not match the file on disk. Recorded ${JSON.stringify(options.expected)}, computed ${JSON.stringify(options.actual)}. Rebuild the widget package before publishing.`);
-}
-function resolveArtifactPath(publishDir, artifactPath) {
-	const resolved = path.resolve(publishDir, artifactPath);
-	const relative = path.relative(publishDir, resolved);
-	if (relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`Artifact path ${JSON.stringify(artifactPath)} escapes the publish directory.`);
-	return resolved;
-}
-function stripOwnerPrefix(packageId, owner) {
-	const prefix = `${owner}.`;
-	if (packageId.startsWith(prefix) && packageId.length > prefix.length) return packageId.slice(prefix.length);
-	return packageId;
-}
-function readRequiredString(record, key, filePath) {
-	const value = record[key];
-	if (typeof value === "string" && value.trim().length > 0) return value;
-	throw new Error(`${path.basename(filePath)} must include string ${key}.`);
-}
-function readRequiredNumber(record, key, filePath) {
-	const value = record[key];
-	if (typeof value === "number" && Number.isFinite(value)) return value;
-	throw new Error(`${path.basename(filePath)} must include number ${key}.`);
-}
-function isRecord(value) {
-	return typeof value === "object" && value !== null;
-}
-//#endregion
-//#region src/commands/deploy.ts
-const DEFAULT_OUT_DIR$1 = ".fluid/widget-dist";
-const DEFAULT_ENVIRONMENT = "production";
-const deployCommand = new Command("deploy").description("Publish company-owned portal widget runtime artifacts").option("-e, --environment <name>", "Target environment label for output reporting", DEFAULT_ENVIRONMENT).option("-o, --out-dir <dir>", "Widget artifact output directory", DEFAULT_OUT_DIR$1).option("--dry-run", "Build and validate upload payload without publishing").action(async (options) => {
-	const environment = options.environment ?? DEFAULT_ENVIRONMENT;
-	const outDir = options.outDir ?? DEFAULT_OUT_DIR$1;
-	const dryRun = options.dryRun === true;
-	console.log();
-	console.log(chalk.blue.bold("Fluid Portal Deploy"));
-	console.log();
-	printRuntimeOnlyNotice();
-	console.log(chalk.gray("Environment: ") + chalk.white(environment));
-	console.log(chalk.gray("Output:      ") + chalk.cyan(outDir));
-	if (dryRun) console.log(chalk.yellow("Dry run: no upload will be created."));
-	console.log();
-	const spinner = ora("Building company-owned widget package...").start();
+	options.onProgress?.("Building company-owned widget package...");
 	try {
 		const result = await publishWidgetRuntimeArtifacts({
-			projectDir: process.cwd(),
-			outDir,
+			projectDir: options.projectDir,
+			outDir: options.outDir,
 			buildOwner: "company",
 			uploadOwner: { kind: "company" },
-			dryRun,
-			...dryRun ? {} : { client: createAuthenticatedWidgetPackageClient() }
-		});
-		spinner.succeed("Built widget runtime artifacts");
-		if (dryRun) {
-			console.log(chalk.yellow("Dry run complete — upload session was not requested."));
-			console.log();
-			printDryRunSessionPayload(result);
-		} else console.log(chalk.green("Published widget package version."));
-		printWidgetPublishSummary({
-			title: dryRun ? "Portal deploy dry run" : "Portal deploy",
-			ownerLabel: "company",
-			environment,
-			outDir,
-			result
+			dryRun: options.dryRun,
+			...preflight.versionOverride ? { version: preflight.versionOverride } : {},
+			...client ? { client } : {}
 		});
-	} catch (err) {
-		spinner.fail("Portal deploy failed");
-		console.error(chalk.red("Error:") + " " + (err instanceof Error ? err.message : String(err)));
-		process.exit(1);
+		return {
+			ok: true,
+			packageId: result.build.packageId,
+			version: result.build.version,
+			artifactCount: result.request.artifacts.length,
+			...preflight.versionOverride && preflight.configuredVersion ? { requestedVersion: preflight.configuredVersion } : {},
+			sessionPayload: result.publish.sessionPayload
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			code: error instanceof Error && "code" in error ? String(error.code) : "PUBLISH_FAILED",
+			message: error instanceof Error ? error.message : "Publishing the widgets failed.",
+			...error instanceof Error && "details" in error && typeof error.details === "string" && error.details.length > 0 ? { hint: error.details } : {}
+		};
 	}
-});
+}
 //#endregion
 //#region src/commands/doctor.ts
 /** Files that are managed by the SDK and should match the canonical template. */
@@ -4613,9 +4401,9 @@ function requireToken() {
 	return token;
 }
 function createClient(token) {
-	return createFetchClient({
+	return createFluidOsClient({
 		baseUrl: getApiBase(),
-		getAuthToken: () => token
+		token
 	});
 }
 async function requireDefinitionId() {
@@ -4628,13 +4416,14 @@ async function requireDefinitionId() {
 	return mappings.definition.id;
 }
 const createVersionCommand = new Command("create").description("Create a new version (snapshot) of the portal definition").option("--activate", "Activate the version immediately after creation").action(async (options) => {
+	await assertStandalonePortalRemoteActionAllowed(process.cwd(), "portal version create");
 	const client = createClient(requireToken());
 	const definitionId = await requireDefinitionId();
 	console.log();
 	console.log(chalk.bold("Creating version..."));
 	let result;
 	try {
-		result = await fluid_os_v0_create_fluid_osversion(client, definitionId);
+		result = await fluidOsApi.createVersion(client, definitionId);
 	} catch (err) {
 		console.error(chalk.red("Error:") + " Failed to create version — " + (err instanceof Error ? err.message : String(err)));
 		process.exit(1);
@@ -4652,7 +4441,7 @@ const createVersionCommand = new Command("create").description("Create a new ver
 	if (options.activate) {
 		console.log("Activating version...");
 		try {
-			await fluid_os_v0_update_fluid_osversion(client, definitionId, version.id, { version: { active: true } });
+			await fluidOsApi.updateVersion(client, definitionId, version.id, { version: { active: true } });
 		} catch (err) {
 			console.error(chalk.red("Error:") + " Failed to activate version — " + (err instanceof Error ? err.message : String(err)));
 			process.exit(1);
@@ -4667,7 +4456,7 @@ const listVersionCommand = new Command("list").description("List all versions of
 	const definitionId = await requireDefinitionId();
 	let result;
 	try {
-		result = await fluid_os_v0_list_fluid_osversions(client, definitionId);
+		result = await fluidOsApi.listVersions(client, definitionId);
 	} catch (err) {
 		console.error(chalk.red("Error:") + " Failed to list versions — " + (err instanceof Error ? err.message : String(err)));
 		process.exit(1);
@@ -4693,6 +4482,12 @@ const listVersionCommand = new Command("list").description("List all versions of
 	console.log();
 });
 const activateVersionCommand = new Command("activate").description("Activate a specific version, making it the live version").argument("<version-id>", "The version ID to activate").option("-y, --yes", "Skip confirmation prompt").action(async (versionId, options) => {
+	await assertStandalonePortalRemoteActionAllowed(process.cwd(), "portal version activate");
+	const numericVersionId = Number(versionId);
+	if (!Number.isSafeInteger(numericVersionId) || numericVersionId < 1) {
+		console.error(chalk.red("Error:") + " Version ID must be a positive integer.");
+		process.exit(1);
+	}
 	const client = createClient(requireToken());
 	const definitionId = await requireDefinitionId();
 	if (!options.yes) {
@@ -4710,7 +4505,7 @@ const activateVersionCommand = new Command("activate").description("Activate a s
 	console.log();
 	console.log(chalk.bold("Activating version..."));
 	try {
-		await fluid_os_v0_update_fluid_osversion(client, definitionId, versionId, { version: { active: true } });
+		await fluidOsApi.updateVersion(client, definitionId, numericVersionId, { version: { active: true } });
 	} catch (err) {
 		console.error(chalk.red("Error:") + " Failed to activate version — " + (err instanceof Error ? err.message : String(err)));
 		process.exit(1);
@@ -4724,6 +4519,7 @@ const versionCommand = new Command("version").description("Manage portal definit
 //#region src/commands/widget-publish.ts
 const DEFAULT_OUT_DIR = ".fluid/widget-dist";
 const publishSubcommand = new Command("publish").description("Publish droplet-owned widget runtime artifacts").requiredOption("--droplet <uuid>", "Droplet UUID that owns the widget package").option("-o, --out-dir <dir>", "Widget artifact output directory", DEFAULT_OUT_DIR).option("--dry-run", "Build and validate upload payload without publishing").action(async (options) => {
+	await assertStandalonePortalRemoteActionAllowed(process.cwd(), "portal widget publish");
 	const outDir = options.outDir ?? DEFAULT_OUT_DIR;
 	const dryRun = options.dryRun === true;
 	console.log();
@@ -4751,17 +4547,19 @@ const publishSubcommand = new Command("publish").description("Publish droplet-ow
 		if (dryRun) {
 			console.log(chalk.yellow("Dry run complete — upload session was not requested."));
 			console.log();
-			printDryRunSessionPayload(result);
+			printDryRunSessionPayload(result.publish.sessionPayload);
 		} else console.log(chalk.green("Published widget package version."));
 		printWidgetPublishSummary({
 			title: dryRun ? "Widget publish dry run" : "Widget publish",
 			ownerLabel: `droplet ${options.droplet}`,
 			outDir,
-			result
+			packageId: result.build.packageId,
+			version: result.build.version,
+			artifactCount: result.request.artifacts.length
 		});
 	} catch (err) {
 		spinner.fail("Widget publish failed");
-		console.error(chalk.red("Error:") + " " + (err instanceof Error ? err.message : String(err)));
+		printWidgetPublishError(err);
 		process.exit(1);
 	}
 });
@@ -4793,6 +4591,6 @@ const plugin = {
 	}
 };
 //#endregion
-export { CANONICAL_PROJECT_NAME, FILE_SYSTEM_ERRORS, GitError, TEMPLATES, TEMPLATE_REPO_URL, WIDGET_PACKAGE_BUILDER_VERSION, WidgetPackageUploadError, buildIdToSlugMap, buildNavigationIdToSlugMap, buildSharedWidgetPackage, buildSnapshot, buildThemeIdToSlugMap, buildWidgetPackageCompleteUploadPayload, buildWidgetPackagePublishManifest, buildWidgetPackageUploadSessionPayload, categorizeChanges, cloneCommand, collectWidgetPackageArtifacts, completeWidgetPackageUpload, computeArtifactMetadata, computeFileHash, copyTemplate, copyTemplateSafe, createAuthenticatedWidgetPackageClient, createCommand, createDirectory, createDirectorySafe, createPortalGitCredential, createPortalProject, createPublishManifestMetadata, createWidgetPackageEntrySource, createWidgetPackagePublishRequest, plugin as default, deployCommand, deriveScreenSlug, deriveSlug, diffAgainstSnapshot, directoryExists, doctorCommand, ensureGitAvailable, fileExists, getArtifactContentType, getInstallCommand, getOriginUrl, getRunCommand, getSdkVersion, getSdkVersionSafe, getTemplatePaths, getWidgetPackageCompleteUploadRoute, getWidgetPackageUploadSessionRoute, gitAheadBehindVsFetchHead, gitAutoCommit, gitClone, gitFetch, gitInit, gitMergeFastForward, gitMissingError, gitPush, hasUncommittedChanges, installDependencies, isGitAvailable, isGitRepo, loadSourceWidgetPackages, normalizeWidgetPackageCompleteResponse, normalizeWidgetPackageUploadSession, pathExists, portalGitCredentialPath, printDryRunSessionPayload, printRuntimeOnlyNotice, printWidgetPublishSummary, promptProjectConfig, publishWidgetPackageVersion, publishWidgetRuntimeArtifacts, pullCommand, pushCommand, readFileSafe, readMappings, readSnapshot, removeMapping, requestWidgetPackageUploadSession, resolveIdToSlug, resolvePortalWidgetSourceConfig, resolveSlugToId, rewriteProjectName, runPackageManager, runPortalGitSync, scaffoldFromGitHub, sha256, slugFromPath, topLevelWidgetCommand, transformNavigation, transformNavigationItems, transformProfile, transformScreen, transformTheme, updateMapping, uploadWidgetPackageArtifacts, validateCrossReferences, validateSingleSourceWidgetPackage, validateWidgetPublishOutDir, versionCommand, widgetCommand, writeFileSafe, writeFluidrcProfile, writeMappings, writeSnapshot };
+export { CANONICAL_PROJECT_NAME, FILE_SYSTEM_ERRORS, GitError, TEMPLATES, TEMPLATE_REPO_URL, buildIdToSlugMap, buildNavigationIdToSlugMap, buildSnapshot, buildThemeIdToSlugMap, categorizeChanges, cloneCommand, computeFileHash, copyTemplate, copyTemplateSafe, createCommand, createDirectory, createDirectorySafe, createPortalGitCredential, createPortalProject, plugin as default, deployCommand, deriveScreenSlug, deriveSlug, diffAgainstSnapshot, directoryExists, doctorCommand, ensureGitAvailable, fileExists, formatPackageKeyMismatch, getInstallCommand, getOriginUrl, getRunCommand, getSdkVersion, getSdkVersionSafe, getTemplatePaths, gitAheadBehindVsFetchHead, gitAutoCommit, gitClone, gitFetch, gitInit, gitMergeFastForward, gitMissingError, gitPush, hasUncommittedChanges, installDependencies, isGitAvailable, isGitRepo, pathExists, portalGitCredentialPath, preflightCompanyPackage, promptProjectConfig, publishWidgetRuntimeArtifacts, pullCommand, pushCommand, readCompanyWidgetPackage, readFileSafe, readMappings, readSnapshot, removeMapping, resolveIdToSlug, resolvePublishVersion, resolveSlugToId, rewriteProjectName, runPackageManager, runPortalGitSync, scaffoldFromGitHub, slugFromPath, topLevelWidgetCommand, transformNavigation, transformNavigationItems, transformProfile, transformScreen, transformTheme, updateMapping, validateCrossReferences, versionCommand, widgetCommand, writeFileSafe, writeFluidrcProfile, writeMappings, writeSnapshot };
 
 //# sourceMappingURL=index.mjs.map