@fluid-app/fluid-cli-portal 0.1.53 → 0.1.55

package/dist/index.mjs

@@ -1,18 +1,19 @@
-import { A as fluid_os_v0_create_fluid_ostheme, B as fluid_os_v0_list_fluid_osversions, C as writeMappings, D as fluid_os_v0_create_fluid_osnavigation_item, E as fluid_os_v0_create_fluid_osnavigation, F as fluid_os_v0_delete_fluid_osprofile, G as fluid_os_v0_update_fluid_ostheme, H as fluid_os_v0_update_fluid_osnavigation_item, I as fluid_os_v0_delete_fluid_osscreen, K as fluid_os_v0_update_fluid_osversion, L as fluid_os_v0_delete_fluid_ostheme, M as fluid_os_v0_create_widget_package_version, N as fluid_os_v0_delete_fluid_osnavigation, O as fluid_os_v0_create_fluid_osprofile, P as fluid_os_v0_delete_fluid_osnavigation_item, R as fluid_os_v0_list_fluid_osdefinitions, S as updateMapping, T as fluid_os_v0_complete_widget_package_version_upload, U as fluid_os_v0_update_fluid_osprofile, V as fluid_os_v0_update_fluid_osnavigation, W as fluid_os_v0_update_fluid_osscreen, _ as deriveSlug, a as buildThemeIdToSlugMap, b as resolveIdToSlug, c as transformNavigationItems, d as transformTheme, f as buildSnapshot, g as writeSnapshot, h as readSnapshot, i as buildNavigationIdToSlugMap, j as fluid_os_v0_create_fluid_osversion, k as fluid_os_v0_create_fluid_osscreen, l as transformProfile, m as diffAgainstSnapshot, o as deriveScreenSlug, p as computeFileHash, q as createFetchClient, r as buildIdToSlugMap, s as transformNavigation, t as pullCommand, u as transformScreen, v as readMappings, w as atomicWriteFile, x as resolveSlugToId, y as removeMapping, z as fluid_os_v0_list_fluid_osnavigation_items } from "./pull-C3yj9L07.mjs";
-import { createRequire } from "node:module";
+import { A as STANDALONE_PORTAL_MARKER, C as writeMappings, D as toFluidOsDynamicObject, E as fluidOsApi, O as createFluidOsHeyApiClient, S as updateMapping, T as createFluidOsClient, _ as deriveSlug, a as buildThemeIdToSlugMap, b as resolveIdToSlug, c as transformNavigationItems, d as transformTheme, f as buildSnapshot, g as writeSnapshot, h as readSnapshot, i as buildNavigationIdToSlugMap, j as assertStandalonePortalRemoteActionAllowed, k as ApiError, l as transformProfile, m as diffAgainstSnapshot, o as deriveScreenSlug, p as computeFileHash, r as buildIdToSlugMap, s as transformNavigation, t as pullCommand, u as transformScreen, v as readMappings, w as atomicWriteFile, x as resolveSlugToId, y as removeMapping } from "./pull-CUR8tbW9.mjs";
+import { l as fluidOsV0DefinitionGitCredentialCreate } from "./sdk.gen-DuPhfdxN.mjs";
+import { a as resolvePublishVersion, i as readCompanyWidgetPackages, n as preflightCompanyPackage, o as loadAndValidateWidgetPackage, r as readCompanyWidgetPackage, s as publishWidgetPackage, t as formatPackageKeyMismatch } from "./src-CpH5SpDH.mjs";
 import { Command } from "commander";
 import chalk from "chalk";
 import ora from "ora";
 import path, { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import { chmodSync, constants, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { chmodSync, constants, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { copyFile, lstat, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import os, { tmpdir } from "node:os";
 import { failure, findProjectConfig, getActiveProfile, getAuthToken, listProfileNames, readConfig, success } from "@fluid-app/fluid-cli";
 import prompts from "prompts";
 import Handlebars from "handlebars";
 import { execa } from "execa";
-import { createHash, randomUUID } from "node:crypto";
+import { randomUUID } from "node:crypto";
 import fs from "fs-extra";
 //#region src/types.ts
 /**
@@ -95,9 +96,9 @@ async function promptProjectConfig(projectName, options) {
 //#endregion
 //#region src/utils/file-system.ts
 const _currentDir$1 = dirname(fileURLToPath(import.meta.url));
-const EMBEDDED_PORTAL_SDK_VERSION = "0.1.462";
+const EMBEDDED_PORTAL_SDK_VERSION = "0.1.464";
 const EMBEDDED_CLI_CORE_VERSION = "0.1.14";
-const EMBEDDED_CLI_PORTAL_VERSION = "0.1.53";
+const EMBEDDED_CLI_PORTAL_VERSION = "0.1.55";
 /**
 * Find the package root by walking up from the current directory to the nearest package.json.
 * Works whether running from dist/ (bundled) or src/utils/ (tsx dev mode).
@@ -1598,6 +1599,15 @@ function portalDevServerOptions(port, exposeToNetwork, cwd = process.cwd()) {
 		watch: { ignored: createPortalWatchIgnored(cwd) }
 	};
 }
+function canFallbackToBareVite(cwd) {
+	try {
+		lstatSync(join(cwd, STANDALONE_PORTAL_MARKER));
+		return false;
+	} catch (error) {
+		if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") return true;
+		throw error;
+	}
+}
 /**
 * Check if the portal directory exists and has content files.
 * Returns true if at minimum `portal/definition.json` exists.
@@ -1637,7 +1647,7 @@ async function autoPull(cwd) {
 	console.log(chalk.yellow("No portal/ directory found.") + " Attempting to pull content...");
 	console.log();
 	try {
-		const { pullCommand } = await import("./pull-C3yj9L07.mjs").then((n) => n.n);
+		const { pullCommand } = await import("./pull-CUR8tbW9.mjs").then((n) => n.n);
 		await pullCommand.parseAsync([], { from: "user" });
 		return hasPortalContent(cwd);
 	} catch (err) {
@@ -1690,12 +1700,17 @@ const devCommand = new Command("dev").description("Start the development server
 	const port = Number.isFinite(parsedPort) ? parsedPort : 5173;
 	try {
 		const { createServer } = await import("vite");
-		const { portalDevPlugin } = await import("./portal-dev-plugin-ByYelgFg.mjs").then((n) => n.n);
-		const { backendDevPlugin } = await import("./backend-dev-plugin-B9-S4Is-.mjs").then((n) => n.n);
+		const { portalDevPlugin } = await import("./portal-dev-plugin-CHlxpXc5.mjs").then((n) => n.n);
+		const { backendDevPlugin } = await import("./backend-dev-plugin-CY3yxgJ1.mjs").then((n) => n.n);
+		const { portalWidgetDevPlugin } = await import("./portal-widget-dev-plugin-B53Lf9Ke.mjs").then((n) => n.n);
 		const server = await createServer({
 			configFile: viteConfigPath,
 			envPrefix: ["VITE_", "NEXT_PUBLIC_"],
-			plugins: [portalDevPlugin(), backendDevPlugin()],
+			plugins: [
+				portalDevPlugin(),
+				backendDevPlugin(),
+				...portalWidgetDevPlugin()
+			],
 			server: portalDevServerOptions(port, options.host === true, cwd)
 		});
 		await server.listen();
@@ -1707,6 +1722,12 @@ const devCommand = new Command("dev").description("Start the development server
 		process.on("SIGTERM", shutdown);
 		await new Promise(() => {});
 	} catch (error) {
+		if (!canFallbackToBareVite(cwd)) {
+			console.error(chalk.red("Could not start the enriched standalone portal dev server."));
+			console.error(chalk.yellow("Standalone portals require the local manifest and widget plugins; bare Vite cannot serve this project correctly."));
+			console.error(error instanceof Error ? error.message : String(error));
+			process.exit(1);
+		}
 		console.warn(chalk.yellow("Could not start the enriched dev server; falling back to `vite`. Local portal content requires portalDevPlugin in vite.config for the fallback path."), error instanceof Error ? error.message : String(error));
 		try {
 			await execa("pnpm", viteArgs, {
@@ -1760,6 +1781,43 @@ const buildCommand = new Command("build").description("Build the application for
 	}
 });
 //#endregion
+//#region ../../portal/core/src/registries/container-registry.ts
+/**
+* Default container registry with LayoutWidget and ContainerWidget
+*/
+const DEFAULT_CONTAINER_REGISTRY = new Map([
+	["LayoutWidget", {
+		isContainer: true,
+		getChildren: (props) => props.children || [],
+		setChildren: (props, children) => ({
+			...props,
+			children
+		})
+	}],
+	["CardWidget", {
+		isContainer: true,
+		getChildren: (props) => props.children || [],
+		setChildren: (props, children) => ({
+			...props,
+			children
+		})
+	}],
+	["ContainerWidget", {
+		isContainer: true,
+		getChildren: (props) => props.children || [],
+		setChildren: (props, children) => ({
+			...props,
+			children
+		})
+	}]
+]);
+/**
+* Check if a widget type is a container
+*/
+function isContainerWidget(widgetType, containerRegistry) {
+	return containerRegistry.has(widgetType);
+}
+//#endregion
 //#region src/utils/push-validation.ts
 /**
 * Cross-reference validation and change categorization utilities for the push command.
@@ -1829,10 +1887,67 @@ function categorizeChanges(diff) {
 	return result;
 }
 /**
+* Faults in a screen's widget tree, as `component_tree[1].props.children[0]`
+* style paths.
+*
+* The screen check used to stop at "name is a string, component_tree is an
+* array" and never look inside. A node missing its `id` published happily —
+* `✔ Portal files valid`, live version activated — and then the admin App
+* Builder rendered the whole portal blank, in a different application, with
+* nothing pointing back at the screen. The builder backfills a missing id
+* (`widget-utils.ts`), but regenerates it per render while identity lookups
+* match on it, so such a node never reconciles.
+*
+* This matters because hand-written `component_tree` JSON is a first-class
+* path, not an edge case: it is how Mist's agent places widgets, and how
+* anything the builder cannot express gets authored.
+*
+* Deliberately conservative about what counts as a node. Only entries of
+* `component_tree` and of a node's `props.children` are checked — the two
+* places every container in `DEFAULT_CONTAINER_REGISTRY` keeps them. A blind
+* walk of every nested object would be wrong: screens are full of `type`-
+* bearing values that are NOT widgets (`background: { type: "solid" }`,
+* `dataSource: { type: "api" }`), and demanding an `id` of those would reject
+* screens that work today. A container using some other prop key is a missed
+* check, which is the safe direction for a gate that blocks publishing.
+*/
+function collectWidgetNodeErrors(nodes) {
+	return walkWidgetNodes(nodes, "component_tree", false, /* @__PURE__ */ new Map());
+}
+function walkWidgetNodes(nodes, path, nullIsAnEmptySlot, seenIds) {
+	const errors = [];
+	nodes.forEach((node, index) => {
+		const at = `${path}[${index}]`;
+		if (node === null || node === void 0) {
+			if (!nullIsAnEmptySlot) errors.push(`${at} must be a widget object.`);
+			return;
+		}
+		if (typeof node !== "object" || Array.isArray(node)) {
+			errors.push(`${at} must be a widget object.`);
+			return;
+		}
+		const record = node;
+		if (typeof record.type !== "string" || record.type.trim().length === 0) errors.push(`${at} is missing a "type".`);
+		else if (record.type !== record.type.trim()) errors.push(`${at} has a "type" with surrounding whitespace (${JSON.stringify(record.type)}). Widget types are matched exactly, so this resolves to no component and renders blank.`);
+		if (typeof record.id !== "string" || record.id.trim().length === 0) errors.push(`${at} is missing an "id". Every widget needs a stable id — without one the screen publishes but renders blank in the app builder.`);
+		else {
+			const firstClaim = seenIds.get(record.id);
+			if (firstClaim === void 0) seenIds.set(record.id, at);
+			else errors.push(`${at} reuses the id ${JSON.stringify(record.id)}, already used by ${firstClaim}. Ids must be unique within a screen — the builder resolves a widget by id and takes the first match, so duplicates make select, delete and drag-drop act on the wrong widget.`);
+		}
+		const props = record.props;
+		if (typeof props !== "object" || props === null || Array.isArray(props)) return;
+		const children = props.children;
+		if (Array.isArray(children)) errors.push(...walkWidgetNodes(children, `${at}.props.children`, true, seenIds));
+	});
+	return errors;
+}
+/**
 * Validate that all cross-references between local portal files are valid.
 *
 * Checks:
 * - New and changed resources contain the required local-file fields
+* - Every widget node in a changed screen has a string "id" and "type"
 * - New and changed themes include the required config object
 * - Navigation items' "screen" slugs reference existing screen files or mappings
 * - Profile "navigation" and "mobile_navigation" slugs reference existing nav files or mappings
@@ -1853,6 +1968,16 @@ async function validateCrossReferences(portalDir, mappings, changes) {
 			file,
 			message: "Screen requires a string \"name\" and array \"component_tree\"."
 		});
+		else {
+			if (screen.component_tree.length > 1) errors.push({
+				file,
+				message: `"component_tree" has ${screen.component_tree.length} top-level nodes, and pushing cannot preserve that. More than one root is serialized into an untyped wrapper the admin builder cannot render, so the screen would arrive blank and uneditable. Wrap them in a single ${CONTAINER_TYPE_LIST} node and move them into its "props.children".`
+			});
+			for (const error of collectWidgetNodeErrors(screen.component_tree)) errors.push({
+				file,
+				message: error
+			});
+		}
 	} catch {
 		errors.push({
 			file,
@@ -1921,6 +2046,59 @@ async function validateCrossReferences(portalDir, mappings, changes) {
 	return errors;
 }
 /**
+* Warns about screens the admin visual builder will not accept drops on.
+*
+* Only container widgets receive the builder's edit-mode child-management
+* callbacks (`onAddChild`, child select/delete/duplicate), so a screen whose
+* `component_tree` has no container at the top level renders perfectly — in
+* local preview and in the live portal — while offering no drop zones at all.
+* A human opening it in the builder cannot drag anything onto the page.
+*
+* That combination (correct everywhere you can look, broken in the one place
+* you cannot) is why this is worth reporting at push time. It is the most
+* likely defect in a hand- or agent-authored screen.
+*
+* Deliberately a WARNING, never an error. Screens without a container root are
+* valid definitions that render correctly, and a repository may hold ones that
+* predate this check; failing their push would break working portals to enforce
+* an authoring convention.
+*
+* Silent on anything it cannot parse. Malformed and unreadable screens are
+* already reported as hard errors by {@link validateCrossReferences}, and a
+* second complaint about a file that never parsed would be noise.
+*/
+async function validateScreenStructure(portalDir, changes) {
+	const warnings = [];
+	const files = [...changes.screens.new, ...changes.screens.changed];
+	for (const file of files) {
+		let screen;
+		try {
+			screen = await readPortalFile$1(portalDir, file);
+		} catch {
+			continue;
+		}
+		const tree = screen.component_tree;
+		if (!Array.isArray(tree) || tree.length === 0) continue;
+		if (tree.length !== 1) continue;
+		const root = tree[0];
+		const rootType = root && typeof root === "object" ? root.type : void 0;
+		if (typeof rootType === "string" && isContainerWidget(rootType, CONTAINER_REGISTRY)) continue;
+		warnings.push({
+			file,
+			message: `No container at the top of "component_tree", so the admin builder will show no drop zones on this screen. Wrap the widgets in a ${CONTAINER_TYPE_LIST} node and move them into its "props.children".`
+		});
+	}
+	return warnings;
+}
+/**
+* Shared with the portal runtime so this check cannot drift from the behaviour
+* it predicts. `DEFAULT_CONTAINER_REGISTRY` is the same map the builder consults
+* via `isContainerWidget`.
+*/
+const CONTAINER_REGISTRY = DEFAULT_CONTAINER_REGISTRY;
+/** Rendered into the warning so it names the real options, not a stale list. */
+const CONTAINER_TYPE_LIST = [...DEFAULT_CONTAINER_REGISTRY.keys()].map((type) => `"${type}"`).join(" / ");
+/**
 * Build a set of valid slugs for a resource type by combining
 * existing mapping slugs with local file slugs on disk.
 */
@@ -1949,6 +2127,26 @@ function validateNavigationItems(items, file, validScreenSlugs, errors) {
 //#endregion
 //#region src/api/git-credential.ts
 /**
+* Portal git-credential adapter (the "invisible git" seam).
+*
+* Mints a short-lived (~1h) remote URL with an embedded installation
+* token for the portal's provisioned GitHub repo. The URL is used
+* immediately for one git op and discarded — NEVER persisted or logged.
+*
+* The backend endpoint (GitSync phase 006, portal adapter) mirrors the
+* widget contract exactly:
+*
+*   POST <endpoint>  ->  201 { git_credential: { remote_url, expires_at }, status, meta }
+*   errors: 409 not_provisioned/not_connected, 502 vendor_error, 422 else
+*           { error_message, errors: { type: [type] }, meta }
+*
+* The exact path is still being finalized as 006 lands, so it lives in
+* one constant here. Until the endpoint ships to prod a request 404s —
+* which we surface as `unavailable` so callers degrade gracefully
+* (warn + skip the git sync, proceed with the normal content push).
+*/
+/** Minted credential — token embedded in `remote_url`. Treat as secret. */
+/**
 * Build the portal git-credential path for a definition id.
 *
 * Matches GitSync Phase 006 (fluid-commerce/fluid #19596): a member
@@ -1969,7 +2167,8 @@ const DEFAULT_RETRY_DELAYS_MS = [
 	15e3
 ];
 const DEFAULT_REQUEST_TIMEOUT_MS = 15e3;
-const RETRYABLE_CONFLICT_TYPES = new Set(["not_provisioned"]);
+const RETRYABLE_CONFLICT_TYPES = new Set(["not_provisioned", "not_connected"]);
+const DURABLE_REPO_STATUSES = new Set(["disconnected"]);
 function nonEmptyString(value) {
 	return typeof value === "string" && value.length > 0 ? value : void 0;
 }
@@ -1977,6 +2176,13 @@ function firstString(value) {
 	if (Array.isArray(value)) return nonEmptyString(value[0]);
 	return nonEmptyString(value);
 }
+function apiErrorBody(error) {
+	if (error.data !== null && typeof error.data === "object" && ("error" in error.data || "error_message" in error.data || "errors" in error.data)) return error.data;
+	return {
+		error_message: error.message,
+		errors: error.data
+	};
+}
 function extractErrorDetails(body, fallback) {
 	if (!body || typeof body !== "object") return { reason: fallback };
 	const envelope = body;
@@ -1985,9 +2191,11 @@ function extractErrorDetails(body, fallback) {
 	const errors = envelope.errors && typeof envelope.errors === "object" ? envelope.errors : void 0;
 	const reason = nonEmptyString(envelope.error_message) ?? nonEmptyString(error?.message) ?? nonEmptyString(envelope.error) ?? fallback;
 	const failureType = firstString(errors?.type) ?? nonEmptyString(nestedDetails?.type);
+	const repoStatus = firstString(errors?.repo_status) ?? nonEmptyString(nestedDetails?.repo_status);
 	return {
 		reason,
-		...failureType ? { failureType } : {}
+		...failureType ? { failureType } : {},
+		...repoStatus ? { repoStatus } : {}
 	};
 }
 function sleep(delayMs) {
@@ -2034,64 +2242,64 @@ async function createPortalGitCredential(options) {
 	const { baseUrl, token, definitionId } = options;
 	const fetchImpl = options.fetchImpl ?? fetch;
 	const requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
-	const url = `${baseUrl.replace(/\/$/, "")}${portalGitCredentialPath(definitionId)}`;
 	const abortController = new AbortController();
 	let requestTimedOut = false;
 	const timeout = setTimeout(() => {
 		requestTimedOut = true;
 		abortController.abort();
 	}, requestTimeoutMs);
-	let resp;
-	let body = null;
 	try {
-		resp = await fetchImpl(url, {
-			method: "POST",
-			headers: {
-				Authorization: `Bearer ${token}`,
-				Accept: "application/json"
-			},
+		const credential = (await fluidOsV0DefinitionGitCredentialCreate({
+			client: createFluidOsHeyApiClient({
+				baseUrl,
+				fetch: fetchImpl,
+				getAuthToken: () => token
+			}),
+			path: { id: definitionId },
 			signal: abortController.signal
-		});
-		if (resp.status !== 404) try {
-			body = await resp.json();
-		} catch (err) {
-			if (requestTimedOut) throw err;
-		}
-	} catch (err) {
-		return {
+		})).git_credential;
+		if (!credential?.remote_url) return {
 			status: "error",
-			reason: requestTimedOut ? `git credential request timed out after ${requestTimeoutMs}ms` : err instanceof Error ? err.message : String(err)
+			reason: "git credential response missing remote_url"
 		};
-	} finally {
-		clearTimeout(timeout);
-	}
-	if (resp.status === 404) return {
-		status: "unavailable",
-		reason: "git sync isn't available for portals on this Fluid API yet",
-		retryable: false
-	};
-	if (!resp.ok) {
-		const details = extractErrorDetails(body, `git credential request failed (HTTP ${resp.status})`);
-		if (resp.status === 409) return {
-			status: "unavailable",
-			reason: details.reason,
-			retryable: details.failureType !== void 0 && RETRYABLE_CONFLICT_TYPES.has(details.failureType),
-			...details.failureType !== void 0 ? { conflictType: details.failureType } : {}
+		return {
+			status: "ok",
+			credential
 		};
+	} catch (err) {
+		if (requestTimedOut) return {
+			status: "error",
+			reason: `git credential request timed out after ${requestTimeoutMs}ms`
+		};
+		if (err instanceof ApiError) {
+			if (err.status === 404) return {
+				status: "unavailable",
+				reason: "git sync isn't available for portals on this Fluid API yet",
+				retryable: false
+			};
+			const details = extractErrorDetails(apiErrorBody(err), `git credential request failed (HTTP ${err.status})`);
+			if (err.status === 409) {
+				const durable = details.repoStatus !== void 0 && DURABLE_REPO_STATUSES.has(details.repoStatus);
+				return {
+					status: "unavailable",
+					reason: details.reason,
+					retryable: !durable && details.failureType !== void 0 && RETRYABLE_CONFLICT_TYPES.has(details.failureType),
+					...details.failureType !== void 0 ? { conflictType: details.failureType } : {},
+					...details.repoStatus !== void 0 ? { repoStatus: details.repoStatus } : {}
+				};
+			}
+			return {
+				status: "error",
+				reason: details.reason
+			};
+		}
 		return {
 			status: "error",
-			reason: details.reason
+			reason: err instanceof Error ? err.message : String(err)
 		};
+	} finally {
+		clearTimeout(timeout);
 	}
-	const credential = body?.git_credential;
-	if (!credential?.remote_url) return {
-		status: "error",
-		reason: "git credential response missing remote_url"
-	};
-	return {
-		status: "ok",
-		credential
-	};
 }
 //#endregion
 //#region src/lib/git-sync.ts
@@ -2226,7 +2434,7 @@ function toApiComponentTree(tree) {
 	return { children: tree };
 }
 /**
-* Create an authenticated FetchClient using the stored CLI profile.
+* Create an authenticated FluidOsClient using the stored CLI profile.
 */
 function createClient$2() {
 	const token = getAuthToken();
@@ -2235,15 +2443,15 @@ function createClient$2() {
 		if (!profile) throw new Error("Not logged in. Run " + chalk.cyan("fluid login") + " first.");
 		throw new Error("No auth token found for profile " + chalk.cyan(profile.name) + ". Run " + chalk.cyan("fluid login") + " to re-authenticate.");
 	}
-	return createFetchClient({
+	return createFluidOsClient({
 		baseUrl: process.env["FLUID_API_BASE"] ?? "https://api.fluid.app",
-		getAuthToken: () => token
+		token
 	});
 }
 async function createAndActivateVersion(client, definitionId) {
-	const versionId = (await fluid_os_v0_create_fluid_osversion(client, definitionId)).version?.id;
+	const versionId = (await fluidOsApi.createVersion(client, definitionId)).version?.id;
 	if (!versionId) throw new Error("the version API returned no version ID");
-	await fluid_os_v0_update_fluid_osversion(client, definitionId, versionId, { version: { active: true } });
+	await fluidOsApi.updateVersion(client, definitionId, versionId, { version: { active: true } });
 	return String(versionId);
 }
 async function activateDraft(definitionId, existingClient) {
@@ -2331,10 +2539,10 @@ async function pushScreens(client, defId, portalDir, changes, mappings) {
 		const slug = slugFromPath(file);
 		try {
 			const local = await readPortalFile(portalDir, file);
-			const newId = (await fluid_os_v0_create_fluid_osscreen(client, defId, { screen: {
+			const newId = (await fluidOsApi.createScreen(client, defId, { screen: {
 				name: local.name,
 				slug,
-				component_tree: toApiComponentTree(local.component_tree)
+				component_tree: toFluidOsDynamicObject(toApiComponentTree(local.component_tree))
 			} })).screen?.id;
 			if (newId != null) currentMappings = updateMapping(currentMappings, "screens", slug, newId);
 			results.push({
@@ -2372,10 +2580,10 @@ async function pushScreens(client, defId, portalDir, changes, mappings) {
 		}
 		try {
 			const local = await readPortalFile(portalDir, file);
-			await fluid_os_v0_update_fluid_osscreen(client, defId, screenId, { screen: {
+			await fluidOsApi.updateScreen(client, defId, screenId, { screen: {
 				name: local.name,
 				slug,
-				component_tree: toApiComponentTree(local.component_tree)
+				component_tree: toFluidOsDynamicObject(toApiComponentTree(local.component_tree))
 			} });
 			results.push({
 				file,
@@ -2411,7 +2619,7 @@ async function pushScreens(client, defId, portalDir, changes, mappings) {
 			};
 		}
 		try {
-			await fluid_os_v0_delete_fluid_osscreen(client, defId, screenId);
+			await fluidOsApi.deleteScreen(client, defId, screenId);
 			currentMappings = removeMapping(currentMappings, "screens", slug);
 			results.push({
 				file,
@@ -2446,10 +2654,10 @@ async function pushThemes(client, defId, portalDir, changes, mappings) {
 		const slug = slugFromPath(file);
 		try {
 			const local = await readPortalFile(portalDir, file);
-			const newId = (await fluid_os_v0_create_fluid_ostheme(client, defId, { theme: {
+			const newId = (await fluidOsApi.createTheme(client, defId, { theme: {
 				name: local.name,
 				active: local.active,
-				config: local.config
+				config: toFluidOsDynamicObject(local.config)
 			} })).theme?.id;
 			if (newId != null) currentMappings = updateMapping(currentMappings, "themes", slug, newId);
 			results.push({
@@ -2487,10 +2695,10 @@ async function pushThemes(client, defId, portalDir, changes, mappings) {
 		}
 		try {
 			const local = await readPortalFile(portalDir, file);
-			await fluid_os_v0_update_fluid_ostheme(client, defId, themeId, { theme: {
+			await fluidOsApi.updateTheme(client, defId, themeId, { theme: {
 				name: local.name,
 				active: local.active,
-				config: local.config
+				config: toFluidOsDynamicObject(local.config)
 			} });
 			results.push({
 				file,
@@ -2526,7 +2734,7 @@ async function pushThemes(client, defId, portalDir, changes, mappings) {
 			};
 		}
 		try {
-			await fluid_os_v0_delete_fluid_ostheme(client, defId, themeId);
+			await fluidOsApi.deleteTheme(client, defId, themeId);
 			currentMappings = removeMapping(currentMappings, "themes", slug);
 			results.push({
 				file,
@@ -2616,7 +2824,7 @@ async function resolveCreatedNavigationItemId(client, defId, navigationId, respo
 	}
 	let response;
 	try {
-		response = await fluid_os_v0_list_fluid_osnavigation_items(client, defId, navigationId);
+		response = await fluidOsApi.listNavigationItems(client, defId, navigationId);
 	} catch (recoveryError) {
 		throw new NavigationRemoteStateUnknownError(`Remote navigation state is unknown because item creation succeeded without returning its required ID, and the recovery read failed: ${enrichedErrorMessage(recoveryError)}. Back up ${file}, run fluid portal pull, then reapply pending edits before pushing again.`);
 	}
@@ -2666,7 +2874,7 @@ async function persistCreatedNavigationItemId(client, defId, navigationId, porta
 		await atomicWriteFile(join(portalDir, file), JSON.stringify(updated, null, 2) + "\n");
 	} catch (persistError) {
 		try {
-			await fluid_os_v0_delete_fluid_osnavigation_item(client, defId, navigationId, serverId);
+			await fluidOsApi.deleteNavigationItem(client, defId, navigationId, serverId);
 		} catch (rollbackError) {
 			throw new NavigationRemoteStateUnknownError(`Failed to persist navigation item ${serverId} locally: ${enrichedErrorMessage(persistError)}. Automatic rollback also failed: ${enrichedErrorMessage(rollbackError)}. Back up ${file}, run fluid portal pull, then reapply pending edits before pushing again.`);
 		}
@@ -2680,7 +2888,7 @@ async function persistCreatedNavigationItemId(client, defId, navigationId, porta
 * must be reconciled before the push snapshot hashes it.
 */
 async function reconcileNavigationFile(client, defId, navId, portalDir, file, local, mappings) {
-	const response = await fluid_os_v0_list_fluid_osnavigation_items(client, defId, navId);
+	const response = await fluidOsApi.listNavigationItems(client, defId, navId);
 	const reconciled = {
 		...local,
 		navigation_items: transformNavigationItems(response.navigation_items ?? [], buildIdToSlugMap(mappings.screens))
@@ -2700,7 +2908,7 @@ async function pushNavigations(client, defId, portalDir, changes, mappings) {
 		let remoteChangesComplete = false;
 		try {
 			let local = await readPortalFile(portalDir, file);
-			const newId = (await fluid_os_v0_create_fluid_osnavigation(client, defId, { navigation: {
+			const newId = (await fluidOsApi.createNavigation(client, defId, { navigation: {
 				name: local.name,
 				platform: local.platform
 			} })).navigation?.id;
@@ -2720,7 +2928,7 @@ async function pushNavigations(client, defId, portalDir, changes, mappings) {
 						source: item.source ?? void 0,
 						parent_id: resolvedParentId
 					};
-					const createdId = await resolveCreatedNavigationItemId(client, defId, newId, (await fluid_os_v0_create_fluid_osnavigation_item(client, defId, newId, { navigation_item: createBody })).navigation_item?.id, knownServerIds, createBody, file);
+					const createdId = await resolveCreatedNavigationItemId(client, defId, newId, (await fluidOsApi.createNavigationItem(client, defId, newId, { navigation_item: createBody })).navigation_item?.id, knownServerIds, createBody, file);
 					local = await persistCreatedNavigationItemId(client, defId, newId, portalDir, file, local, itemIndex, createdId);
 					serverIdByItemIndex.set(itemIndex, createdId);
 				}
@@ -2763,12 +2971,12 @@ async function pushNavigations(client, defId, portalDir, changes, mappings) {
 		let remoteChangesComplete = false;
 		try {
 			let local = await readPortalFile(portalDir, file);
-			await fluid_os_v0_update_fluid_osnavigation(client, defId, navId, { navigation: {
+			await fluidOsApi.updateNavigation(client, defId, navId, { navigation: {
 				name: local.name,
 				platform: local.platform
 			} });
 			const resolvedItems = flattenNavigationItems(resolveNavigationItemScreenIds(local.navigation_items, currentMappings));
-			const serverItems = flattenServerNavigationItems((await fluid_os_v0_list_fluid_osnavigation_items(client, defId, navId)).navigation_items ?? []);
+			const serverItems = flattenServerNavigationItems((await fluidOsApi.listNavigationItems(client, defId, navId)).navigation_items ?? []);
 			const serverById = new Map(serverItems.map((s) => [s.id, s]));
 			const knownServerIds = new Set(serverById.keys());
 			const localIds = new Set(resolvedItems.filter((i) => i.id).map((i) => i.id));
@@ -2785,7 +2993,7 @@ async function pushNavigations(client, defId, portalDir, changes, mappings) {
 					parent_id: resolvedParentId
 				};
 				if (item.id && serverById.has(item.id)) {
-					await fluid_os_v0_update_fluid_osnavigation_item(client, defId, navId, item.id, { navigation_item: body });
+					await fluidOsApi.updateNavigationItem(client, defId, navId, item.id, { navigation_item: body });
 					serverIdByItemIndex.set(itemIndex, item.id);
 				} else {
 					const createBody = {
@@ -2793,12 +3001,12 @@ async function pushNavigations(client, defId, portalDir, changes, mappings) {
 						label: body.label ?? "",
 						position: body.position ?? 0
 					};
-					const createdId = await resolveCreatedNavigationItemId(client, defId, navId, (await fluid_os_v0_create_fluid_osnavigation_item(client, defId, navId, { navigation_item: createBody })).navigation_item?.id, knownServerIds, createBody, file);
+					const createdId = await resolveCreatedNavigationItemId(client, defId, navId, (await fluidOsApi.createNavigationItem(client, defId, navId, { navigation_item: createBody })).navigation_item?.id, knownServerIds, createBody, file);
 					local = await persistCreatedNavigationItemId(client, defId, navId, portalDir, file, local, itemIndex, createdId);
 					serverIdByItemIndex.set(itemIndex, createdId);
 				}
 			}
-			for (const serverItem of serverItems) if (!localIds.has(serverItem.id)) await fluid_os_v0_delete_fluid_osnavigation_item(client, defId, navId, serverItem.id);
+			for (const serverItem of serverItems) if (!localIds.has(serverItem.id)) await fluidOsApi.deleteNavigationItem(client, defId, navId, serverItem.id);
 			remoteChangesComplete = true;
 			await reconcileNavigationFile(client, defId, navId, portalDir, file, local, currentMappings);
 			results.push({
@@ -2835,7 +3043,7 @@ async function pushNavigations(client, defId, portalDir, changes, mappings) {
 			};
 		}
 		try {
-			await fluid_os_v0_delete_fluid_osnavigation(client, defId, navId);
+			await fluidOsApi.deleteNavigation(client, defId, navId);
 			currentMappings = removeMapping(currentMappings, "navigations", slug);
 			results.push({
 				file,
@@ -2869,7 +3077,8 @@ async function pushProfiles(client, defId, portalDir, changes, mappings) {
 	for (const file of changes.new) {
 		const slug = slugFromPath(file);
 		try {
-			const newId = (await fluid_os_v0_create_fluid_osprofile(client, defId, { profile: resolveProfileBody(await readPortalFile(portalDir, file), currentMappings) })).profile?.id;
+			const body = resolveProfileBody(await readPortalFile(portalDir, file), currentMappings);
+			const newId = (await fluidOsApi.createProfile(client, defId, { profile: body })).profile?.id;
 			if (newId != null) currentMappings = updateMapping(currentMappings, "profiles", slug, newId);
 			results.push({
 				file,
@@ -2905,7 +3114,8 @@ async function pushProfiles(client, defId, portalDir, changes, mappings) {
 			};
 		}
 		try {
-			await fluid_os_v0_update_fluid_osprofile(client, defId, profileId, { profile: resolveProfileBody(await readPortalFile(portalDir, file), currentMappings) });
+			const body = resolveProfileBody(await readPortalFile(portalDir, file), currentMappings);
+			await fluidOsApi.updateProfile(client, defId, profileId, { profile: body });
 			results.push({
 				file,
 				action: "updated",
@@ -2940,7 +3150,7 @@ async function pushProfiles(client, defId, portalDir, changes, mappings) {
 			};
 		}
 		try {
-			await fluid_os_v0_delete_fluid_osprofile(client, defId, profileId);
+			await fluidOsApi.deleteProfile(client, defId, profileId);
 			currentMappings = removeMapping(currentMappings, "profiles", slug);
 			results.push({
 				file,
@@ -3013,6 +3223,7 @@ function printPushReport(results, skippedPhases) {
 }
 const pushCommand = new Command("push").description("Push local portal content changes to the Fluid OS API").option("--yes", "Skip confirmation prompt").option("--activate", "Create and activate a live version after a successful push").action(async (options) => {
 	const cwd = process.cwd();
+	await assertStandalonePortalRemoteActionAllowed(cwd, "portal push");
 	const portalDir = join(cwd, PORTAL_DIR);
 	const portalSyncDir = join(cwd, PORTAL_SYNC_DIR$1);
 	console.log();
@@ -3085,6 +3296,12 @@ const pushCommand = new Command("push").description("Push local portal content c
 		process.exit(1);
 	}
 	spinner.succeed("Portal files valid");
+	const structureWarnings = await validateScreenStructure(portalDir, changes);
+	if (structureWarnings.length > 0) {
+		console.log();
+		for (const warning of structureWarnings) console.log(chalk.yellow("  warning  ") + chalk.white(warning.file + ": ") + warning.message);
+		console.log();
+	}
 	spinner.start("Authenticating...");
 	let client;
 	try {
@@ -3193,13 +3410,14 @@ const pushCommand = new Command("push").description("Push local portal content c
 * against the portal git-credential endpoint.
 *
 * When the credential endpoint reports that no repository is available
-* (the company's Git integration isn't connected, the repo is still
-* unprovisioned after the retry budget, or the endpoint isn't deployed),
-* clone falls back to scaffolding the portal locally from the bundled
-* starter template instead of failing. Local files plus API sync
+* (the repo was torn down, provisioning failed, it is still not ready
+* after the retry budget, or the endpoint isn't deployed), clone falls
+* back to scaffolding the portal locally from the bundled starter
+* template instead of failing. Local files plus API sync
 * (`fluid portal push`/`pull`) are a fully functional portal — Git is
 * an optional sync channel, not a prerequisite — so the user still
-* lands in a working project and Git history can attach later.
+* lands in a working project and Git history can attach later via
+* `fluid portal push`, which adopts the remote's history.
 */
 function getBaseUrl() {
 	return process.env["FLUID_API_BASE"] ?? "https://api.fluid.app";
@@ -3216,9 +3434,9 @@ async function removeIncompleteCheckout(targetDir) {
 	}
 }
 function createClient$1(token) {
-	return createFetchClient({
+	return createFluidOsClient({
 		baseUrl: getBaseUrl(),
-		getAuthToken: () => token
+		token
 	});
 }
 /**
@@ -3228,9 +3446,12 @@ function createClient$1(token) {
 * `not_provisioned` genuinely may resolve later, so it says so.
 */
 function gitSyncUnavailableNotice(outcome) {
-	if (outcome.conflictType === "not_connected") return `This company's Git integration isn't connected, so the portal has no Git repository to clone. Creating the portal locally from the starter template instead — ${chalk.cyan("fluid portal push")}/${chalk.cyan("pull")} sync content without Git, and Git sync can attach once the integration is connected.`;
-	if (outcome.conflictType === "not_provisioned") return "The portal's Git repository isn't provisioned yet. Creating the portal locally from the starter template so you can start now — Git sync can attach once the repository is ready.";
-	return `Git sync isn't available (${outcome.reason}). Creating the portal locally from the starter template instead.`;
+	const attachHint = `Creating the portal locally from the starter template so you can start now — ${chalk.cyan("fluid portal push")}/${chalk.cyan("pull")} sync content without Git, and Git history can attach later with ${chalk.cyan("fluid portal push")}.`;
+	if (outcome.repoStatus === "disconnected") return `The portal's Git repository was disconnected, so there is nothing to clone. ${attachHint}`;
+	if (outcome.repoStatus === "error") return `The portal's Git repository failed to provision. ${attachHint}`;
+	if (outcome.conflictType === "not_connected") return "The portal's Git repository is still being provisioned — it didn't come online in time. " + attachHint;
+	if (outcome.conflictType === "not_provisioned") return `The portal's Git repository isn't provisioned yet. ${attachHint}`;
+	return `Git sync isn't available (${outcome.reason}). ${attachHint}`;
 }
 /**
 * A git-less fallback scaffold that failed or was interrupted leaves the
@@ -3274,7 +3495,7 @@ async function selectDefinition(client, appName, rawDefinitionId) {
 	const definitions = [];
 	let page = 1;
 	while (true) {
-		const response = await fluid_os_v0_list_fluid_osdefinitions(client, {
+		const response = await fluidOsApi.listDefinitions(client, {
 			page,
 			per_page: 500
 		});
@@ -3414,6 +3635,115 @@ const cloneCommand = new Command("clone").description("Clone a portal definition
 	}
 });
 //#endregion
+//#region src/commands/widget-package-publish.ts
+async function publishWidgetRuntimeArtifacts(options) {
+	await assertStandalonePortalRemoteActionAllowed(options.projectDir, "portal widget package publish");
+	const isDryRun = options.dryRun === true;
+	const client = options.client;
+	if (!isDryRun && !client) throw new Error("A FluidOS API client is required when dryRun is false.");
+	const cliVersion = await getPortalCliVersion();
+	if (isDryRun) return await publishWidgetPackage({
+		projectDir: options.projectDir,
+		outDir: options.outDir,
+		owner: options.buildOwner,
+		uploadOwner: options.uploadOwner,
+		cliVersion,
+		dryRun: true
+	});
+	if (!client) throw new Error("A FluidOS API client is required when dryRun is false.");
+	return await publishWidgetPackage({
+		projectDir: options.projectDir,
+		outDir: options.outDir,
+		owner: options.buildOwner,
+		uploadOwner: options.uploadOwner,
+		cliVersion,
+		...options.version ? { version: options.version } : {},
+		client
+	});
+}
+/**
+* Prints a publish failure with its `details` block, which is where the
+* validation tooling names the offending widget and field.
+*/
+function printWidgetPublishError(error) {
+	console.error(chalk.red("Error:") + " " + (error instanceof Error ? error.message : String(error)));
+	if (typeof error === "object" && error !== null && "details" in error && typeof error.details === "string" && error.details.length > 0) console.error(error.details);
+}
+const DEFAULT_API_BASE = "https://api.fluid.app";
+/**
+* Builds the client used to publish widget artifacts.
+*
+* `FLUID_TOKEN` / `FLUID_API_TOKEN` win over any stored profile, matching the
+* resolution order the rest of the CLI documents and implements (see
+* `getAuthToken` in `@fluid-app/fluid-cli`). This path used to read only
+* `~/.fluid/config.json`, which made it the one command a caller could not
+* point at a chosen company: a host that spawns the CLI would publish to
+* whichever profile the terminal happened to have active, and shipping a
+* company's widgets to the wrong tenant is not a failure they could detect from
+* the output.
+*
+* With the env token set, the base URL comes from `FLUID_API_BASE` rather than
+* the stored profile's — a token issued elsewhere has no relationship to the
+* host that profile points at.
+*/
+function createAuthenticatedWidgetPackageClient() {
+	const envToken = process.env["FLUID_TOKEN"] ?? process.env["FLUID_API_TOKEN"] ?? "";
+	if (envToken.length > 0) return createFluidOsHeyApiClient({
+		baseUrl: process.env["FLUID_API_BASE"] ?? DEFAULT_API_BASE,
+		getAuthToken: () => envToken
+	});
+	const { profile, profileName, token } = resolveAuthenticatedProfile();
+	if (!token) {
+		if (!profileName) throw new Error("Not logged in. Run " + chalk.cyan("fluid login") + " first.");
+		throw new Error("No auth token found for profile " + chalk.cyan(profileName) + ". Run " + chalk.cyan("fluid login") + " to re-authenticate.");
+	}
+	return createFluidOsHeyApiClient({
+		baseUrl: profile?.baseUrl ?? process.env["FLUID_API_BASE"] ?? DEFAULT_API_BASE,
+		getAuthToken: () => token
+	});
+}
+function resolveAuthenticatedProfile() {
+	const config = readConfig();
+	const projectConfig = findProjectConfig(process.cwd());
+	if (projectConfig?.profile) {
+		const profile = config.profiles[projectConfig.profile];
+		if (profile) return {
+			profile,
+			profileName: projectConfig.profile,
+			token: profile.token
+		};
+	}
+	if (!config.activeProfile) return {};
+	const profile = config.profiles[config.activeProfile];
+	if (!profile) return {};
+	return {
+		profile,
+		profileName: config.activeProfile,
+		token: profile.token
+	};
+}
+function printWidgetPublishSummary(options) {
+	console.log();
+	console.log(chalk.green.bold(`${options.title} complete`));
+	console.log();
+	console.log(chalk.gray("Owner:       ") + chalk.white(options.ownerLabel));
+	if (options.environment) console.log(chalk.gray("Environment: ") + chalk.white(options.environment));
+	console.log(chalk.gray("Package:     ") + chalk.white(options.packageId));
+	console.log(chalk.gray("Version:     ") + chalk.white(options.version));
+	console.log(chalk.gray("Output:      ") + chalk.cyan(options.outDir));
+	console.log(chalk.gray("Artifacts:   ") + chalk.white(String(options.artifactCount)));
+	console.log();
+}
+function printRuntimeOnlyNotice() {
+	console.log(chalk.yellow("This publishes widget runtime artifacts only; it does not deploy the hosted portal shell."));
+	console.log();
+}
+function printDryRunSessionPayload(sessionPayload) {
+	console.log(chalk.bold("Dry-run upload session payload:"));
+	console.log(JSON.stringify(sessionPayload, null, 2));
+	console.log();
+}
+//#endregion
 //#region src/utils/widget-helpers.ts
 /**
 * Pure helper functions for widget scaffolding.
@@ -3503,12 +3833,14 @@ function insertIntoWidgetPackage(source, exportName) {
 }
 //#endregion
 //#region src/commands/widget-create.ts
-const WIDGET_CONFIG_PATH$1 = path.join("src", "widgets.config.ts");
+const WIDGET_CONFIG_PATH = path.join("src", "widgets.config.ts");
 const createSubcommand = new Command("create").description("Scaffold a new Remote DOM widget").argument("<name>", "Widget name in kebab-case (e.g., stock-ticker)").option("-c, --category <category>", "Widget category for palette grouping", "components").action(async (name, options) => {
 	const cwd = process.cwd();
 	const packageJsonPath = path.join(cwd, "package.json");
-	const configPath = path.join(cwd, WIDGET_CONFIG_PATH$1);
+	const configPath = path.join(cwd, WIDGET_CONFIG_PATH);
 	const widgetDir = path.join(cwd, "src", "widgets", name);
+	let stylesAppended = false;
+	let resolvedPackageKey = null;
 	const validationError = validateWidgetName(name);
 	if (validationError) {
 		console.error(chalk.red(`Error: ${validationError}`));
@@ -3540,28 +3872,38 @@ const createSubcommand = new Command("create").description("Scaffold a new Remot
 			displayName,
 			category
 		}), "utf-8");
+		await appendWidgetStyles(cwd, name);
+		stylesAppended = true;
 		if (await fs.pathExists(configPath)) {
 			const configSource = await fs.readFile(configPath, "utf-8");
-			if (isEmptyWidgetConfig(configSource)) await fs.writeFile(configPath, createWidgetConfigSource(importLine, exportName), "utf-8");
-			else {
+			if (isEmptyWidgetConfig(configSource)) {
+				resolvedPackageKey = await resolveCompanyPackageKey();
+				await fs.writeFile(configPath, createWidgetConfigSource(importLine, exportName, resolvedPackageKey ?? void 0), "utf-8");
+			} else {
 				const withImport = insertImport(configSource, importLine);
 				const updated = withImport ? insertIntoWidgetPackage(withImport, exportName) : null;
-				if (!updated) throw new Error(`${WIDGET_CONFIG_PATH$1} must export the starter widgetPackages placeholder or contain a defineWidgetPackage({ widgets: [...] }) declaration.`);
+				if (!updated) throw new Error(`${WIDGET_CONFIG_PATH} must export the starter widgetPackages placeholder or contain a defineWidgetPackage({ widgets: [...] }) declaration.`);
 				await fs.writeFile(configPath, updated, "utf-8");
 			}
-		} else await fs.writeFile(configPath, createWidgetConfigSource(importLine, exportName), "utf-8");
+		} else {
+			resolvedPackageKey = await resolveCompanyPackageKey();
+			await fs.writeFile(configPath, createWidgetConfigSource(importLine, exportName, resolvedPackageKey ?? void 0), "utf-8");
+		}
 	} catch (error) {
 		await fs.remove(widgetDir).catch(() => {});
+		if (stylesAppended) await removeWidgetStyles(cwd, name).catch(() => {});
 		console.error(chalk.red("Error: Failed to scaffold Remote DOM widget."));
 		console.error(error);
 		process.exit(1);
 	}
 	console.log();
 	console.log(chalk.green("Created widget:") + ` src/widgets/${name}/index.tsx`);
-	console.log(chalk.green("Registered") + ` in ${chalk.cyan(WIDGET_CONFIG_PATH$1)}`);
+	console.log(chalk.green("Registered") + ` in ${chalk.cyan(WIDGET_CONFIG_PATH)}`);
+	if (resolvedPackageKey) console.log(chalk.green("Package key:") + ` ${chalk.cyan(resolvedPackageKey)} (this company's existing widget package)`);
 	console.log();
 	console.log(chalk.yellow("Next steps:"));
 	console.log(`  1. Edit ${chalk.cyan(`src/widgets/${name}/index.tsx`)}`);
+	console.log(`     Styles live in ${chalk.cyan("styles.css")} at the project root — widgets must not import CSS.`);
 	console.log(`  2. Run ${chalk.cyan("fluid portal deploy --dry-run")} to verify the package`);
 });
 function createWidgetSource(options) {
@@ -3571,11 +3913,23 @@ interface ${options.widgetType}Props {
   readonly title?: string;
 }
 
+// Styling: a stylesheet is the ONLY way to style a widget. The host sanitizes
+// every Remote DOM mutation before it reaches the shadow root, so a
+// \`style={{ ... }}\` prop is silently dropped and \`<style>\` is a banned tag.
+// Give elements classNames and put the rules in the project-root styles.css
+// (this widget's rules were appended there when it was scaffolded).
+//
+// Do NOT add \`import "./styles.css"\` here. In dev, Vite answers a CSS import
+// with a browser style-injector that loads \`/@vite/client\`, which touches
+// HTMLElement — absent in a Web Worker — and throws while the package is being
+// evaluated, taking down every widget in the project, not just this one.
 function ${options.componentName}({ title = ${JSON.stringify(options.displayName)} }: ${options.widgetType}Props) {
   return (
-    <section>
-      <h3>{title}</h3>
-      <p>Edit this widget in src/widgets/${options.name}/index.tsx</p>
+    <section className="${options.name}">
+      <h3 className="${options.name}__title">{title}</h3>
+      <p className="${options.name}__body">
+        Edit this widget in src/widgets/${options.name}/index.tsx
+      </p>
     </section>
   );
 }
@@ -3596,1743 +3950,283 @@ export const ${options.exportName} = defineWidget({
 });
 `;
 }
+/**
+* Appends a scaffolded widget's rules to the project-root `styles.css`,
+* creating the file when a project has none yet.
+*
+* The root stylesheet is the single sheet the tooling delivers — dev serves it
+* as the descriptor's `cssUrls`, and the build entry imports it — so every
+* widget in a project shares it. Appending (rather than overwriting) keeps
+* earlier widgets' rules intact; re-scaffolding a name that is already present
+* is a no-op rather than a duplicate block.
+*/
+/**
+* Removes a widget's appended rules from the project-root `styles.css`.
+*
+* Only used to undo a failed scaffold — `appendWidgetStyles` runs before the
+* config update, so a config failure would otherwise strand rules for a widget
+* directory that has just been deleted. Matches the exact block the append
+* writes and leaves everything else, including a project's own rules and other
+* widgets', untouched.
+*/
+async function removeWidgetStyles(projectDir, name) {
+	const stylesPath = path.join(projectDir, "styles.css");
+	if (!await fs.pathExists(stylesPath)) return;
+	const existing = await fs.readFile(stylesPath, "utf-8");
+	const block = createWidgetStylesSource(name);
+	if (!existing.includes(block)) return;
+	const withoutBlock = existing.replace(block, "");
+	await fs.writeFile(stylesPath, withoutBlock.replace(/\n{3,}/gu, "\n\n"), "utf-8");
+}
+async function appendWidgetStyles(projectDir, name) {
+	const stylesPath = path.join(projectDir, "styles.css");
+	const block = createWidgetStylesSource(name);
+	if (!await fs.pathExists(stylesPath)) {
+		await fs.writeFile(stylesPath, `${ROOT_STYLES_HEADER}\n${block}`, "utf-8");
+		return;
+	}
+	const existing = await fs.readFile(stylesPath, "utf-8");
+	if (existing.includes(`.${name} {`)) return;
+	const separator = existing.endsWith("\n") ? "\n" : "\n\n";
+	await fs.appendFile(stylesPath, `${separator}${block}`, "utf-8");
+}
+const ROOT_STYLES_HEADER = `/* Runtime styles for this portal's widgets.
+ *
+ * One sheet per project: dev serves it to the widget shadow root as the
+ * package descriptor's cssUrls, and the package build imports it. Widget
+ * modules must NOT import CSS themselves — in dev that pulls \`/@vite/client\`
+ * into the Web Worker, which throws and stops every widget in the project from
+ * registering.
+ */
+`;
+/**
+* Starter rules for a scaffolded widget.
+*
+* Colors, type, and radii come from the host portal's semantic CSS variables so
+* the widget matches whatever portal it lands on, in both light and dark,
+* without a second hand-written palette. Each `var()` carries a fallback so the
+* widget stays legible in a host that has not adopted the portal theme.
+*
+* Selectors are prefixed with the widget name so nothing leaks into the host.
+*/
+function createWidgetStylesSource(name) {
+	return `.${name} {
+  padding: 24px;
+  border: 1px solid var(--border, #e5e7eb);
+  border-radius: var(--radius-lg, 12px);
+  background: var(--card, #ffffff);
+  color: var(--card-foreground, #111827);
+  font-family: var(--font-body, ui-sans-serif, system-ui, sans-serif);
+}
+
+.${name}__title {
+  margin: 0 0 8px;
+  color: var(--card-foreground, #111827);
+  font-family: var(--font-header, inherit);
+  font-size: 1.25rem;
+  font-weight: 700;
+}
+
+.${name}__body {
+  margin: 0;
+  color: var(--muted-foreground, #6b7280);
+}
+`;
+}
 function isEmptyWidgetConfig(source) {
 	return /export\s+const\s+widgetPackages\s*=\s*\[\]\s+as\s+const\s*;/u.test(source);
 }
-function createWidgetConfigSource(importLine, exportName) {
+/**
+* The key written when the company's real one cannot be resolved.
+*
+* A guess, and one that fails for any company that has already published — a
+* company has exactly ONE widget package and its key is fixed by whichever
+* project published first, so this value is only ever correct by accident.
+*/
+const PLACEHOLDER_PACKAGE_KEY = "portal-widgets";
+function createWidgetConfigSource(importLine, exportName, packageKey = PLACEHOLDER_PACKAGE_KEY) {
 	return `import { defineWidgetPackage } from "@fluid-app/portal-sdk/widgets/worker";
 ${importLine}
 
 export const widgetPackage = defineWidgetPackage({
   scope: "company",
-  packageStableId: "portal-widgets",
+  packageStableId: ${JSON.stringify(packageKey)},
   version: "0.0.0-dev",
   widgets: [${exportName}],
 });
 `;
 }
-const widgetCommand = new Command("widget").description("Manage Remote DOM portal widgets").addCommand(createSubcommand);
-//#endregion
-//#region ../widget-tooling/src/errors.ts
-var WidgetToolingError = class extends Error {
-	code;
-	details;
-	diagnostics;
-	constructor(code, message, options = {}) {
-		super(message, options);
-		this.name = "WidgetToolingError";
-		this.code = code;
-		this.details = options.details;
-		this.diagnostics = options.diagnostics;
+/**
+* Reads the company's existing widget package key, for a config being CREATED.
+*
+* Scaffolding is the one moment this can be done safely. A widget's type is
+* `company.<key>.<Name>` and those strings are written into screen JSON, so
+* changing the key later orphans every screen using it — which is why
+* `fluid portal deploy` reports a mismatch rather than rewriting it. At
+* `widget create` no screen references the type yet, so resolving it here
+* prevents the mismatch instead of explaining it afterwards.
+*
+* Best-effort by design: this command made no network calls before, and a
+* scaffold must not fail because a lookup did. Every uncertainty — no token, no
+* network, a company that has never published, a slow answer — falls back to the
+* placeholder, which is exactly today's behaviour.
+*
+* The deadline is deliberate here, unlike the SDK's dev-server probe where a
+* timeout discarded a real answer. The fallback IS the correct result for an
+* offline scaffold, so bounding the wait costs nothing and stops a hung API
+* from wedging a local command.
+*/
+async function resolveCompanyPackageKey() {
+	try {
+		const client = createAuthenticatedWidgetPackageClient();
+		return (await Promise.race([readCompanyWidgetPackages(client), new Promise((resolve) => {
+			setTimeout(() => resolve([]), PACKAGE_KEY_LOOKUP_TIMEOUT_MS);
+		})]))[0]?.key ?? null;
+	} catch {
+		return null;
 	}
-};
-const CONTENT_TYPES = {
-	".css": "text/css",
-	".js": "application/javascript",
-	".json": "application/json",
-	".map": "application/json"
-};
-const CSS_ARTIFACT_PATH_PATTERN = /^[A-Za-z0-9._~-]+\.css$/;
-const JS_MAP_ARTIFACT_PATH_PATTERN = /^[A-Za-z0-9._~-]+\.js\.map$/;
-async function computeArtifactMetadata(filePath, baseDir) {
-	const relativePath = toPosixPath$1(path.relative(baseDir, filePath));
-	assertAllowedArtifactPath(relativePath);
-	await assertRegularArtifactFile(filePath, relativePath);
-	const buffer = await fs.readFile(filePath);
-	return {
-		path: relativePath,
-		sha256: sha256(buffer),
-		bytes: buffer.byteLength,
-		contentType: getArtifactContentType(filePath)
-	};
-}
-async function collectWidgetPackageArtifacts(publishDir) {
-	const artifactPaths = await findArtifactPaths(publishDir);
-	const artifacts = await Promise.all(artifactPaths.map((artifactPath) => computeArtifactMetadata(artifactPath, publishDir)));
-	assertRequiredUploadArtifacts(artifacts);
-	return artifacts.sort((a, b) => a.path.localeCompare(b.path));
-}
-function createPublishManifestMetadata(options) {
-	return {
-		packageId: options.packageId,
-		version: options.version,
-		builderVersion: options.builderVersion ?? "0.1.0",
-		cliVersion: options.cliVersion,
-		runtimeVersion: options.runtimeVersion,
-		manifestHash: sha256(options.manifestContent),
-		artifacts: options.artifacts
-	};
 }
-function getArtifactContentType(filePath) {
-	if (path.basename(filePath).endsWith(".js.map")) return "application/json";
-	return CONTENT_TYPES[path.extname(filePath)] ?? "application/octet-stream";
-}
-function sha256(content) {
-	return createHash("sha256").update(content).digest("hex");
-}
-function isWidgetPackageCssArtifactPath(relativePath) {
-	return CSS_ARTIFACT_PATH_PATTERN.test(relativePath);
-}
-function isWidgetPackageJsMapArtifactPath(relativePath) {
-	return JS_MAP_ARTIFACT_PATH_PATTERN.test(relativePath);
-}
-async function assertRegularArtifactFile(filePath, relativePath) {
-	const stat = await fs.lstat(filePath);
-	if (stat.isSymbolicLink()) throw new Error(`Widget publish artifact ${JSON.stringify(relativePath)} must be a regular file and must not be a symbolic link.`);
-	if (!stat.isFile()) throw new Error(`Widget publish artifact ${JSON.stringify(relativePath)} must be a regular file.`);
-}
-async function findArtifactPaths(dir, baseDir = dir) {
-	if (!await fs.pathExists(dir)) return [];
-	const entries = await fs.readdir(dir, { withFileTypes: true });
-	return (await Promise.all(entries.map(async (entry) => {
-		const entryPath = path.join(dir, entry.name);
-		const relativePath = toPosixPath$1(path.relative(baseDir, entryPath));
-		if (entry.isSymbolicLink()) throw new Error(`Widget publish artifact ${JSON.stringify(relativePath)} must be a regular file and must not be a symbolic link.`);
-		if (isUploadArtifact(relativePath)) {
-			if (!entry.isFile()) throw new Error(`Widget publish artifact ${JSON.stringify(relativePath)} must be a regular file.`);
-			return [entryPath];
+const PACKAGE_KEY_LOOKUP_TIMEOUT_MS = 5e3;
+const widgetCommand = new Command("widget").description("Manage Remote DOM portal widgets").addCommand(createSubcommand);
+//#endregion
+//#region src/commands/deploy.ts
+const DEFAULT_OUT_DIR$1 = ".fluid/widget-dist";
+const DEFAULT_ENVIRONMENT = "production";
+const deployCommand = new Command("deploy").description("Publish company-owned portal widget runtime artifacts").option("-e, --environment <name>", "Target environment label for output reporting", DEFAULT_ENVIRONMENT).option("-o, --out-dir <dir>", "Widget artifact output directory", DEFAULT_OUT_DIR$1).option("--dry-run", "Build and validate upload payload without publishing").action(async (options) => {
+	const environment = options.environment ?? DEFAULT_ENVIRONMENT;
+	const outDir = options.outDir ?? DEFAULT_OUT_DIR$1;
+	const dryRun = options.dryRun === true;
+	console.log();
+	console.log(chalk.blue.bold("Fluid Portal Deploy"));
+	console.log();
+	printRuntimeOnlyNotice();
+	console.log(chalk.gray("Environment: ") + chalk.white(environment));
+	console.log(chalk.gray("Output:      ") + chalk.cyan(outDir));
+	if (dryRun) console.log(chalk.yellow("Dry run: no upload will be created."));
+	console.log();
+	const spinner = ora("Building company-owned widget package...").start();
+	const result = await runPortalDeploy({
+		projectDir: process.cwd(),
+		outDir,
+		environment,
+		dryRun,
+		onProgress: (label) => {
+			spinner.text = label;
 		}
-		if (entry.isDirectory()) {
-			const nestedPaths = await findArtifactPaths(entryPath, baseDir);
-			if (nestedPaths.length === 0) throwUnsupportedArtifactPath(`${relativePath}/`);
-			return nestedPaths;
+	});
+	if (!result.ok) {
+		spinner.fail("Portal deploy failed");
+		console.log();
+		if (result.code === "PACKAGE_KEY_MISMATCH") console.log(chalk.red("Package key does not match this company."));
+		else console.error(chalk.red("Error:") + " " + result.message);
+		if (result.hint) {
+			console.log();
+			console.log(result.hint);
 		}
-		if (isAllowedGeneratedFile(relativePath)) return [];
-		throwUnsupportedArtifactPath(relativePath);
-	}))).flat();
-}
-function assertRequiredUploadArtifacts(artifacts) {
-	const artifactPaths = new Set(artifacts.map((artifact) => artifact.path));
-	for (const requiredPath of ["widget.js", "manifest.json"]) {
-		if (artifactPaths.has(requiredPath)) continue;
-		throw new Error(`Widget package publish output must include regular file ${JSON.stringify(requiredPath)}.`);
+		console.log();
+		process.exit(1);
 	}
-}
-function assertAllowedArtifactPath(relativePath) {
-	if (isUploadArtifact(relativePath) || isAllowedGeneratedFile(relativePath)) return;
-	throwUnsupportedArtifactPath(relativePath);
-}
-function isUploadArtifact(relativePath) {
-	return relativePath === "widget.js" || relativePath === "manifest.json" || isWidgetPackageCssArtifactPath(relativePath) || isWidgetPackageJsMapArtifactPath(relativePath);
-}
-function isAllowedGeneratedFile(relativePath) {
-	return isFlatArtifactPath(relativePath) && relativePath === "publish-manifest.json";
-}
-function isFlatArtifactPath(relativePath) {
-	return relativePath.length > 0 && !relativePath.includes("/") && !relativePath.includes("\\");
-}
-function throwUnsupportedArtifactPath(relativePath) {
-	throw new Error(`Unsupported widget publish artifact ${JSON.stringify(relativePath)}. Allowed files are widget.js, manifest.json, top-level [A-Za-z0-9._~-]+.css, top-level [A-Za-z0-9._~-]+.js.map, and publish-manifest.json.`);
-}
-function toPosixPath$1(value) {
-	return value.split(path.sep).join("/");
-}
-//#endregion
-//#region ../../portal/core/src/remote-dom-widget-package.ts
-const UNSAFE_JSON_KEYS = new Set([
-	"__proto__",
-	"constructor",
-	"prototype"
-]);
-function isJsonValue(value) {
-	return isJsonValueAtDepth(value, /* @__PURE__ */ new WeakSet(), 0);
-}
-function isJsonValueAtDepth(value, ancestors, depth) {
-	if (value === null || typeof value === "string" || typeof value === "boolean") return true;
-	if (typeof value === "number") return Number.isFinite(value);
-	if (typeof value !== "object" || depth > 50 || ancestors.has(value)) return false;
-	ancestors.add(value);
-	const prototype = Object.getPrototypeOf(value);
-	const isJson = Array.isArray(value) ? value.every((item) => isJsonValueAtDepth(item, ancestors, depth + 1)) : (prototype === Object.prototype || prototype === null) && isRecord$5(value) && Object.entries(value).every(([key, item]) => !UNSAFE_JSON_KEYS.has(key) && isJsonValueAtDepth(item, ancestors, depth + 1));
-	ancestors.delete(value);
-	return isJson;
-}
-function isRecord$5(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-//#endregion
-//#region ../widget-tooling/src/internal/widget-package-validation.ts
-const URL_SAFE_SEGMENT_SOURCE = "[A-Za-z0-9][A-Za-z0-9_~-]*";
-const URL_SAFE_WIDGET_NAME_PATTERN = new RegExp(`^${URL_SAFE_SEGMENT_SOURCE}$`);
-const URL_SAFE_DOTTED_IDENTIFIER_PATTERN = new RegExp(`^${URL_SAFE_SEGMENT_SOURCE}(?:\\.${URL_SAFE_SEGMENT_SOURCE})*$`);
-const SEMVER_CORE_PATTERN = "(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)";
-const SEMVER_PRERELEASE_IDENTIFIER_PATTERN = "(?:0|[1-9]\\d*|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*)";
-const SEMVER_URL_SAFE_PATTERN = new RegExp(`^${SEMVER_CORE_PATTERN}(?:-${SEMVER_PRERELEASE_IDENTIFIER_PATTERN}(?:\\.${SEMVER_PRERELEASE_IDENTIFIER_PATTERN})*)?$`);
-const WIDGET_PACKAGE_MANIFEST_VERSION = 1;
-const DEFAULT_WIDGET_ICON = "box";
-const DEFAULT_WIDGET_CATEGORY = "components";
-const DEFAULT_WIDGET_CONTAINER = "block";
-const DEFAULT_MIN_SDK_VERSION = "0.0.0";
-function validateSingleSourceWidgetPackage(sourcePackages, options = {}) {
-	if (sourcePackages.length === 0) return validationFailure({
-		code: "NO_SOURCE_PACKAGE",
-		message: "No defineWidgetPackage source package was found. Export widgetPackage, widgetPackages, or a default widget package from src/widgets.config.ts."
-	});
-	if (sourcePackages.length > 1) return validationFailure({
-		code: "MULTIPLE_SOURCE_PACKAGES",
-		message: "Publish/deploy supports exactly one defineWidgetPackage source package. Export one package or split packages into separate builds."
-	});
-	const sourcePackageValue = sourcePackages[0];
-	if (!sourcePackageValue) return validationFailure({
-		code: "NO_SOURCE_PACKAGE",
-		message: "No defineWidgetPackage source package was found."
-	});
-	const shapeErrors = validateSourcePackageShape(sourcePackageValue);
-	if (shapeErrors.length > 0) return {
-		success: false,
-		errors: shapeErrors
-	};
-	const sourcePackage = sourcePackageValue;
-	const errors = [];
-	const owner = options.owner ?? sourcePackage.packageType;
-	if (owner !== "company" && owner !== "droplet") errors.push({
-		code: "UNSUPPORTED_OWNER",
-		path: "packageType",
-		message: "Widget package publish/deploy currently supports company and droplet owners. Set packageType to \"company\" or \"droplet\"."
-	});
-	else if (options.owner !== void 0 && sourcePackage.packageType !== options.owner) errors.push({
-		code: "UNSUPPORTED_OWNER",
-		path: "packageType",
-		message: `Widget package metadata must set packageType to "${options.owner}" for this workflow.`
-	});
-	const resolvedOwner = owner === "droplet" ? "droplet" : "company";
-	if (resolvedOwner === "droplet" && !readNonEmptyTrimmedString(sourcePackage.packageStableId)) errors.push({
-		code: "INVALID_PACKAGE_KEY",
-		path: "packageStableId",
-		message: "Droplet widget packages must set packageStableId so published widget types remain stable across builds."
-	});
-	const packageKey = resolvePackageKey(sourcePackage, resolvedOwner);
-	const packageKeyPath = readNonEmptyTrimmedString(sourcePackage.packageStableId) ? "packageStableId" : "packageId";
-	if (!isUrlSafeDottedIdentifier(packageKey)) errors.push({
-		code: "INVALID_PACKAGE_KEY",
-		path: packageKeyPath,
-		message: "Widget package key must be URL-safe dot-separated text (letters, numbers, '.', '_', '~', and '-' only)."
-	});
-	if (!isUrlSafeSemver(sourcePackage.version)) errors.push({
-		code: "INVALID_VERSION",
-		path: "version",
-		message: "Widget package version must be a URL-safe SemVer version without build metadata (for example 1.2.3 or 1.2.3-beta.1)."
-	});
-	if (sourcePackage.widgets.length === 0) errors.push({
-		code: "NO_WIDGETS",
-		path: "widgets",
-		message: "Widget package must include at least one widget."
+	spinner.succeed("Built widget runtime artifacts");
+	if (dryRun) {
+		console.log(chalk.yellow("Dry run complete — upload session was not requested."));
+		console.log();
+		if (result.sessionPayload !== void 0) printDryRunSessionPayload(result.sessionPayload);
+	} else console.log(chalk.green("Published widget package version."));
+	if (result.requestedVersion) {
+		console.log(chalk.yellow(`Version ${result.requestedVersion} is already published for this company, so this went out as ${result.version}.`));
+		console.log(chalk.gray("Every portal project in a company shares one widget package, so its versions are shared too."));
+		console.log();
+	}
+	printWidgetPublishSummary({
+		title: dryRun ? "Portal deploy dry run" : "Portal deploy",
+		ownerLabel: "company",
+		environment,
+		outDir,
+		packageId: result.packageId,
+		version: result.version,
+		artifactCount: result.artifactCount
 	});
-	const packageId = `${resolvedOwner}.${packageKey}`;
-	const seenNames = /* @__PURE__ */ new Set();
-	const seenTypes = /* @__PURE__ */ new Set();
-	const widgets = [];
-	sourcePackage.widgets.forEach((widget, index) => {
-		const path = `widgets[${index}]`;
-		if (!isUrlSafeWidgetName(widget.name)) {
-			errors.push({
-				code: "INVALID_WIDGET_NAME",
-				path: `${path}.name`,
-				message: "Widget name must be URL-safe text (letters, numbers, '_', '~', and '-' only) and cannot be empty."
-			});
-			return;
-		}
-		if (seenNames.has(widget.name)) {
-			errors.push({
-				code: "DUPLICATE_WIDGET",
-				path: `${path}.name`,
-				message: `Duplicate widget name "${widget.name}" found in package ${packageKey}.`
-			});
-			return;
-		}
-		seenNames.add(widget.name);
-		const type = `${packageId}.${widget.name}`;
-		if (!isUrlSafeDottedIdentifier(type)) {
-			errors.push({
-				code: "INVALID_WIDGET_TYPE",
-				path: `${path}.type`,
-				message: `Generated widget type "${type}" is not URL-safe.`
-			});
-			return;
-		}
-		if (seenTypes.has(type)) {
-			errors.push({
-				code: "DUPLICATE_WIDGET",
-				path: `${path}.type`,
-				message: `Duplicate generated widget type "${type}" found.`
-			});
-			return;
-		}
-		seenTypes.add(type);
-		widgets.push(sourceWidgetToDescriptor(widget, type));
-	});
-	if (errors.length > 0) return {
-		success: false,
-		errors
-	};
-	return {
-		success: true,
-		value: {
-			sourcePackage,
-			packageKey,
-			packageId,
-			owner: resolvedOwner,
-			version: sourcePackage.version,
-			widgets
-		},
-		errors: []
-	};
-}
-function buildWidgetPackagePublishManifest(validated, options = {}) {
-	return {
-		manifestVersion: WIDGET_PACKAGE_MANIFEST_VERSION,
-		runtime: "remote-dom",
-		packageId: validated.packageId,
-		source: validated.owner,
-		version: validated.version,
-		workerEntryUrl: toWidgetPackageArtifactPath("widget.js"),
-		cssUrls: mergeCssUrls(validated.sourcePackage.cssUrls, options.cssUrls),
-		assetUrls: [],
-		widgets: validated.widgets.map(({ name: _name, ...widget }) => widget)
-	};
-}
-function sourceWidgetToDescriptor(widget, type) {
-	const displayName = widget.displayName ?? widget.name;
-	return {
-		type,
-		name: widget.name,
-		displayName,
-		description: widget.description ?? `Custom widget ${displayName}`,
-		icon: widget.icon ?? DEFAULT_WIDGET_ICON,
-		category: widget.category ?? DEFAULT_WIDGET_CATEGORY,
-		propertySchema: normalizePropertySchema(widget.propertySchema, type),
-		defaultProps: widget.defaultProps ?? {},
-		container: normalizeContainer(widget.container),
-		minSdkVersion: widget.minSdkVersion ?? DEFAULT_MIN_SDK_VERSION,
-		resizable: normalizeResizable(widget.resizable),
-		capabilities: normalizeCapabilities(widget.capabilities ?? [])
-	};
-}
-function normalizeCapabilities(capabilities) {
-	return capabilities.map((capability) => ({
-		name: capability.name,
-		version: capability.version ?? "1"
-	}));
-}
-function validationFailure(error) {
-	return {
-		success: false,
-		errors: [error]
-	};
-}
-function validateSourcePackageShape(value) {
-	if (!isRecord$4(value)) return [{
-		code: "INVALID_SOURCE_PACKAGE",
-		message: "Widget source package must be a JSON object."
-	}];
-	const errors = [];
-	requireStringField(value, "packageId", "packageId", errors);
-	requireStringField(value, "version", "version", errors);
-	validateOptionalStringField(value, "scope", "scope", errors);
-	validateOptionalStringField(value, "packageStableId", "packageStableId", errors);
-	validateOptionalStringField(value, "packageType", "packageType", errors);
-	if (Object.prototype.hasOwnProperty.call(value, "navigationOrigins")) errors.push({
-		code: "INVALID_SOURCE_PACKAGE",
-		path: "navigationOrigins",
-		message: "navigationOrigins has been removed. Declare the externalNavigation capability and call allowAnchorUrl(url) for each external link."
-	});
-	if (value.cssUrls !== void 0) if (!Array.isArray(value.cssUrls)) errors.push({
-		code: "INVALID_SOURCE_PACKAGE",
-		path: "cssUrls",
-		message: "Widget package cssUrls must be an array of strings when present."
-	});
-	else value.cssUrls.forEach((cssUrl, index) => {
-		validateCssUrl(cssUrl, `cssUrls[${index}]`, errors);
-	});
-	if (!Array.isArray(value.widgets)) {
-		errors.push({
-			code: "INVALID_SOURCE_PACKAGE",
-			path: "widgets",
-			message: "Widget package widgets must be an array."
-		});
-		return errors;
-	}
-	value.widgets.forEach((widget, index) => {
-		const widgetPath = `widgets[${index}]`;
-		if (!isRecord$4(widget)) {
-			errors.push({
-				code: "INVALID_WIDGET_METADATA",
-				path: widgetPath,
-				message: "Widget metadata must be a JSON object."
-			});
-			return;
-		}
-		requireStringField(widget, "name", `${widgetPath}.name`, errors, {
-			code: "INVALID_WIDGET_NAME",
-			message: "Widget name must be a string and cannot be empty."
-		});
-		validateOptionalStringField(widget, "displayName", `${widgetPath}.displayName`, errors, { requireNonEmpty: true });
-		validateOptionalStringField(widget, "description", `${widgetPath}.description`, errors, { requireNonEmpty: true });
-		validateOptionalStringField(widget, "icon", `${widgetPath}.icon`, errors, { requireNonEmpty: true });
-		validateOptionalStringField(widget, "category", `${widgetPath}.category`, errors, { requireNonEmpty: true });
-		validateOptionalStringField(widget, "minSdkVersion", `${widgetPath}.minSdkVersion`, errors, { requireNonEmpty: true });
-		validateOptionalJsonRecordField(widget, "propertySchema", `${widgetPath}.propertySchema`, errors);
-		validateOptionalJsonRecordField(widget, "defaultProps", `${widgetPath}.defaultProps`, errors);
-		validateOptionalCapabilities(widget, "capabilities", `${widgetPath}.capabilities`, errors);
-	});
-	return errors;
-}
-function requireStringField(record, key, path, errors, override) {
-	const value = record[key];
-	if (typeof value === "string" && value.trim().length > 0) return;
-	errors.push({
-		code: override?.code ?? "INVALID_SOURCE_PACKAGE",
-		path,
-		message: override?.message ?? `${path} must be a string and cannot be empty.`
-	});
-}
-function validateOptionalStringField(record, key, path, errors, options = {}) {
-	const value = record[key];
-	if (value === void 0) return;
-	if (typeof value === "string") {
-		if (!options.requireNonEmpty || value.trim().length > 0) return;
-		errors.push({
-			code: "INVALID_SOURCE_PACKAGE",
-			path,
-			message: `${path} must be a non-empty string when present.`
-		});
-		return;
-	}
-	errors.push({
-		code: "INVALID_SOURCE_PACKAGE",
-		path,
-		message: `${path} must be a string when present.`
-	});
-}
-function validateCssUrl(value, cssUrlPath, errors) {
-	if (typeof value !== "string" || value.trim().length === 0) {
-		errors.push({
-			code: "INVALID_SOURCE_PACKAGE",
-			path: cssUrlPath,
-			message: "Widget package cssUrls entries must be non-empty strings."
-		});
-		return;
-	}
-	if (!isWidgetPackageCssArtifactPath(value)) errors.push({
-		code: "INVALID_SOURCE_PACKAGE",
-		path: cssUrlPath,
-		message: "Widget package cssUrls entries must be top-level generated CSS artifact filenames matching [A-Za-z0-9._~-]+.css. Self-host external CSS or fonts via @font-face in widget CSS so the build can isolate them."
-	});
-}
-function validateOptionalJsonRecordField(record, key, path, errors) {
-	const value = record[key];
-	if (value === void 0) return;
-	if (isRecord$4(value) && isJsonValue(value)) return;
-	errors.push({
-		code: "INVALID_WIDGET_METADATA",
-		path,
-		message: `${path} must be a JSON object when present.`
-	});
-}
-function validateOptionalCapabilities(record, key, path, errors) {
-	const value = record[key];
-	if (value === void 0) return;
-	if (!Array.isArray(value)) {
-		errors.push({
-			code: "INVALID_WIDGET_METADATA",
-			path,
-			message: `${path} must be an array when present.`
-		});
-		return;
-	}
-	const names = /* @__PURE__ */ new Set();
-	value.forEach((candidate, index) => {
-		const capabilityPath = `${path}[${index}]`;
-		if (!isRecord$4(candidate)) {
-			errors.push({
-				code: "INVALID_WIDGET_METADATA",
-				path: capabilityPath,
-				message: `${capabilityPath} must be a JSON object.`
-			});
-			return;
-		}
-		const name = candidate.name;
-		if (!isCanonicalMetadataString(name)) {
-			errors.push({
-				code: "INVALID_WIDGET_METADATA",
-				path: `${capabilityPath}.name`,
-				message: `${capabilityPath}.name must be a non-empty string without surrounding whitespace or control characters.`
-			});
-			return;
-		}
-		const version = candidate.version;
-		if (version !== void 0 && !isCanonicalMetadataString(version)) errors.push({
-			code: "INVALID_WIDGET_METADATA",
-			path: `${capabilityPath}.version`,
-			message: `${capabilityPath}.version must be a non-empty string without surrounding whitespace or control characters when present.`
-		});
-		if (names.has(name)) {
-			errors.push({
-				code: "INVALID_WIDGET_METADATA",
-				path: `${capabilityPath}.name`,
-				message: `${path} must not contain duplicate capability name ${JSON.stringify(name)}.`
-			});
-			return;
-		}
-		names.add(name);
-	});
-}
-function isCanonicalMetadataString(value) {
-	return typeof value === "string" && value.length > 0 && value === value.trim() && !/\p{Cc}/u.test(value);
-}
-function mergeCssUrls(sourceCssUrls, generatedCssUrls) {
-	const generatedCssUrlSet = new Set(generatedCssUrls ?? []);
-	generatedCssUrls?.forEach((cssUrl, index) => {
-		validateGeneratedCssArtifactUrl(cssUrl, `generated cssUrls[${index}]`);
-	});
-	sourceCssUrls?.forEach((cssUrl, index) => {
-		validateGeneratedCssArtifactUrl(cssUrl, `cssUrls[${index}]`);
-		if (generatedCssUrlSet.has(cssUrl)) return;
-		throw new Error(`cssUrls[${index}] URL ${JSON.stringify(cssUrl)} must match a generated top-level CSS artifact. Import the CSS from the widget package bundle or remove it from cssUrls.`);
-	});
-	return Array.from(new Set([...sourceCssUrls ?? [], ...generatedCssUrls ?? []])).map(toWidgetPackageArtifactPath);
-}
-function toWidgetPackageArtifactPath(value) {
-	return value;
-}
-function validateGeneratedCssArtifactUrl(value, cssUrlPath) {
-	if (value.trim().length === 0) throw new Error(`${cssUrlPath} must be a non-empty string.`);
-	if (!isWidgetPackageCssArtifactPath(value)) throw new Error(`${cssUrlPath} must be a top-level generated CSS artifact filename matching [A-Za-z0-9._~-]+.css. Self-host external CSS or fonts via @font-face in widget CSS so the build can isolate them.`);
-}
-function normalizePropertySchema(value, widgetType) {
-	return {
-		...value ?? {},
-		widgetType
-	};
-}
-function normalizeContainer(value) {
-	if (value === "inline" || value === "block" || value === "card" || value === "fullscreen") return value;
-	return DEFAULT_WIDGET_CONTAINER;
-}
-function normalizeResizable(value) {
-	if (typeof value === "boolean") return value;
-	if (value === "horizontal" || value === "vertical" || value === "both") return value;
-	if (!isRecord$4(value)) return false;
-	const horizontal = value.horizontal === true;
-	const vertical = value.vertical === true;
-	if (horizontal && vertical) return "both";
-	if (horizontal) return "horizontal";
-	if (vertical) return "vertical";
-	return false;
-}
-function resolvePackageKey(sourcePackage, owner) {
-	const packageStableId = readNonEmptyTrimmedString(sourcePackage.packageStableId);
-	if (packageStableId) return prefixPackageStableIdWithNonOwnerScope(packageStableId, sourcePackage.scope);
-	return stripOwnerScopeFromPackageId(sourcePackage.packageId, sourcePackage.scope, owner);
-}
-function prefixPackageStableIdWithNonOwnerScope(packageStableId, sourceScope) {
-	const sourceScopeText = readNonEmptyTrimmedString(sourceScope);
-	if (!sourceScopeText || isWidgetPackageOwnerKind(sourceScopeText)) return packageStableId;
-	const sourceScopePrefix = `${sourceScopeText}.`;
-	if (packageStableId.startsWith(sourceScopePrefix)) return packageStableId;
-	return `${sourceScopeText}.${packageStableId}`;
-}
-function stripOwnerScopeFromPackageId(packageId, sourceScope, owner) {
-	const ownerPrefix = `${owner}.`;
-	if (packageId.startsWith(ownerPrefix) && packageId.length > ownerPrefix.length) return packageId.slice(ownerPrefix.length);
-	const sourceScopeText = readNonEmptyTrimmedString(sourceScope);
-	if (isWidgetPackageOwnerKind(sourceScopeText) && packageId.startsWith(`${sourceScopeText}.`) && packageId.length > sourceScopeText.length + 1) return packageId.slice(sourceScopeText.length + 1);
-	return packageId;
-}
-function readNonEmptyTrimmedString(value) {
-	const trimmed = value?.trim();
-	return trimmed ? trimmed : void 0;
-}
-function isWidgetPackageOwnerKind(value) {
-	return value === "company" || value === "droplet";
-}
-function isUrlSafeDottedIdentifier(value) {
-	return URL_SAFE_DOTTED_IDENTIFIER_PATTERN.test(value);
-}
-function isUrlSafeWidgetName(value) {
-	return URL_SAFE_WIDGET_NAME_PATTERN.test(value);
-}
-function isUrlSafeSemver(value) {
-	return SEMVER_URL_SAFE_PATTERN.test(value);
-}
-function isRecord$4(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-//#endregion
-//#region ../widget-tooling/src/internal/widget-package-config.ts
-const WIDGET_CONFIG_PATH = "src/widgets.config.ts";
-const SOURCE_PACKAGE_EXTRACT_FILENAME = "extract-widget-packages.ts";
-const SOURCE_PACKAGE_OUTPUT_FILENAME = "source-widget-packages.json";
-const SOURCE_PACKAGE_OUTPUT_SENTINEL = "fluid-widget-source-packages:v1";
-const TSX_CLI_PATH = createRequire(import.meta.url).resolve("tsx/cli");
-async function resolvePortalWidgetSourceConfig(projectDir) {
-	const candidate = path.join(projectDir, WIDGET_CONFIG_PATH);
-	return await fs.pathExists(candidate) ? {
-		path: candidate,
-		relativePath: WIDGET_CONFIG_PATH
-	} : void 0;
-}
-async function loadSourceWidgetPackages(projectDir) {
-	const config = await resolvePortalWidgetSourceConfig(projectDir);
-	if (!config) return success([]);
-	let tempDir;
-	try {
-		tempDir = await createTempDirectory(projectDir);
-		const extractFile = path.join(tempDir, SOURCE_PACKAGE_EXTRACT_FILENAME);
-		const outputFile = path.join(tempDir, SOURCE_PACKAGE_OUTPUT_FILENAME);
-		await fs.writeFile(extractFile, createSourcePackageExtractorScript({
-			projectDir,
-			configPath: config.path
-		}), {
-			encoding: "utf-8",
-			flag: "wx"
-		});
-		await execa(process.execPath, [
-			TSX_CLI_PATH,
-			extractFile,
-			outputFile
-		], {
-			cwd: projectDir,
-			stdio: "pipe",
-			env: {
-				...process.env,
-				NODE_ENV: "production"
-			}
-		});
-		const outputResult = await readSourcePackageExtractorOutput(outputFile);
-		if (!outputResult.success) return outputResult;
-		const parsed = outputResult.value;
-		if (parsed.length === 0) return success([]);
-		return success(parsed);
-	} catch (err) {
-		const error = err;
-		return failure({
-			code: "CONFIG_LOAD_FAILED",
-			message: `Failed to load widget packages from ${config.relativePath}`,
-			details: error.stderr ?? error.message ?? String(err)
-		});
-	} finally {
-		if (tempDir) await fs.remove(tempDir).catch(() => {});
-	}
-}
-async function createTempDirectory(projectDir) {
-	const projectTmpDir = path.join(projectDir, ".fluid", "tmp");
-	try {
-		await fs.ensureDir(projectTmpDir);
-		return await fs.mkdtemp(path.join(projectTmpDir, "widget-packages-"));
-	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		throw new Error(`Unable to create project-local temporary directory at ${projectTmpDir}: ${message}`);
-	}
-}
-async function readSourcePackageExtractorOutput(outputFile) {
-	let output;
-	try {
-		output = await fs.readFile(outputFile, "utf-8");
-	} catch (err) {
-		return failure({
-			code: "CONFIG_LOAD_FAILED",
-			message: "Widget package extractor did not write an output file",
-			details: err instanceof Error ? err.message : String(err)
-		});
-	}
-	let parsed;
-	try {
-		parsed = JSON.parse(output);
-	} catch {
-		return failure({
-			code: "INVALID_FORMAT",
-			message: "Failed to parse widget package output file as JSON",
-			details: `Output was: ${output.slice(0, 200)}`
-		});
-	}
-	if (!isRecord$3(parsed) || parsed.sentinel !== SOURCE_PACKAGE_OUTPUT_SENTINEL) return failure({
-		code: "INVALID_FORMAT",
-		message: "Widget package extractor output file had an invalid sentinel"
-	});
-	if (!Array.isArray(parsed.data)) return failure({
-		code: "INVALID_FORMAT",
-		message: "Extracted widget package output is not an array",
-		details: `Expected an array, got: ${typeof parsed.data}`
-	});
-	return success(parsed.data);
-}
-function createSourcePackageExtractorScript(options) {
-	return `
-import fs from "node:fs/promises";
-import path from "node:path";
-import { createServer, normalizePath } from "vite";
-
-const SOURCE_PACKAGE_MARKER = "__fluidSourceWidgetPackage";
-const OUTPUT_SENTINEL = ${JSON.stringify(SOURCE_PACKAGE_OUTPUT_SENTINEL)};
-const projectRoot = ${JSON.stringify(options.projectDir)};
-const widgetConfigPath = ${JSON.stringify(options.configPath)};
-const outputPath = process.argv[2];
-if (!outputPath) throw new Error("Missing widget package extractor output path.");
-
-function toViteModuleId(modulePath) {
-  const relativePath = path.relative(projectRoot, modulePath);
-  if (!relativePath.startsWith("..") && !path.isAbsolute(relativePath)) {
-    return "/" + normalizePath(relativePath);
-  }
-  return normalizePath(modulePath);
-}
-
-const server = await createServer({
-  root: projectRoot,
-  mode: "production",
-  server: { middlewareMode: true },
-  appType: "custom",
-  logLevel: "error",
-  clearScreen: false,
-  resolve: {
-    conditions: ["module", "browser", "development|production"],
-  },
-  ssr: {
-    noExternal: ["@fluid-app/portal-sdk"],
-    resolve: {
-      conditions: ["module", "node", "development|production"],
-    },
-  },
 });
-
-try {
-  const widgetConfig = await server.ssrLoadModule(toViteModuleId(widgetConfigPath));
-
-  function isSourceWidgetPackage(value) {
-    return Boolean(value && typeof value === "object" && value[SOURCE_PACKAGE_MARKER] === true);
-  }
-
-  function collectSourceWidgetPackages(mod) {
-    const candidates = [
-      mod.widgetPackage,
-      ...(Array.isArray(mod.widgetPackages) ? mod.widgetPackages : []),
-      mod.default,
-    ];
-    const byPackageId = new Map();
-    for (const candidate of candidates) {
-      if (!isSourceWidgetPackage(candidate)) continue;
-      if (!byPackageId.has(candidate.packageId)) byPackageId.set(candidate.packageId, candidate);
-    }
-    return Array.from(byPackageId.values());
-  }
-
-  function serializeWidget(widget) {
-    if (!widget || typeof widget !== "object" || Array.isArray(widget)) {
-      return widget;
-    }
-    const { component, ...metadata } = widget;
-    return metadata;
-  }
-
-  function serializePackage(sourcePackage) {
-    return {
-      manifestVersion: sourcePackage.manifestVersion,
-      scope: sourcePackage.scope,
-      packageStableId: sourcePackage.packageStableId,
-      packageId: sourcePackage.packageId,
-      packageType: sourcePackage.packageType,
-      version: sourcePackage.version,
-      cssUrls: sourcePackage.cssUrls,
-      ...(Object.prototype.hasOwnProperty.call(sourcePackage, "navigationOrigins")
-        ? { navigationOrigins: sourcePackage.navigationOrigins }
-        : {}),
-      widgets: Array.isArray(sourcePackage.widgets)
-        ? sourcePackage.widgets.map(serializeWidget)
-        : sourcePackage.widgets,
-    };
-  }
-
-  await fs.writeFile(
-    outputPath,
-    JSON.stringify({
-      sentinel: OUTPUT_SENTINEL,
-      data: collectSourceWidgetPackages(widgetConfig).map(serializePackage),
-    }),
-    "utf-8",
-  );
-} finally {
-  await server.close();
-}
-`;
-}
-function isRecord$3(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-//#endregion
-//#region ../widget-tooling/src/internal/widget-package-builder.ts
-const DEFAULT_PUBLISH_DIR = ".fluid/widget-dist";
-const DEFAULT_RUNTIME_VERSION = "1";
-const TEMP_BUILD_DIR = ".fluid/widget-build";
-const TEMP_CLI_DIR = ".fluid/tmp";
-const PROJECT_VITE_CONFIG_CANDIDATES = [
-	"vite.config.ts",
-	"vite.config.mts",
-	"vite.config.js",
-	"vite.config.mjs"
-];
-const BLOCKED_FLUID_PROJECT_PLUGIN_NAMES = ["fluid-portal-dev", "fluid-backend-dev"];
-const require = createRequire(import.meta.url);
-function validateSharedWidgetPackagePublishDir(projectDir, publishDir = DEFAULT_PUBLISH_DIR, options = {}) {
-	const label = options.optionName ?? "publishDir";
-	if (path.isAbsolute(publishDir)) throw new Error(`${label} must be relative to the project directory.`);
-	const normalizedPublishDir = normalizePublishDirForValidation(publishDir);
-	if (normalizedPublishDir === ".fluid" || !normalizedPublishDir.startsWith(".fluid/")) throw new Error(`${label} must be a relative path under .fluid/.`);
-	if (isPathWithinReservedDir(normalizedPublishDir, TEMP_BUILD_DIR)) throw new Error(`${label} must not be ${TEMP_BUILD_DIR} because it is reserved for temporary builder output.`);
-	if (isPathWithinReservedDir(normalizedPublishDir, TEMP_CLI_DIR)) throw new Error(`${label} must not be ${TEMP_CLI_DIR} because it is reserved for Fluid CLI temporary files.`);
-	const resolvedProjectDir = path.resolve(projectDir);
-	const resolvedPublishDir = path.resolve(resolvedProjectDir, publishDir);
-	const relative = path.relative(resolvedProjectDir, resolvedPublishDir);
-	if (relative === "" || relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`${label} must stay inside the project directory.`);
-}
-async function buildSharedWidgetPackage(options) {
-	const publishDirInput = options.publishDir ?? DEFAULT_PUBLISH_DIR;
-	try {
-		await validateWidgetPackageOutputPaths(options.projectDir, publishDirInput);
-	} catch (err) {
-		return failure({
-			code: "INVALID_PUBLISH_DIR",
-			message: "Unsafe widget package publish directory",
-			details: (err instanceof Error ? err : new Error(String(err))).message
-		});
-	}
-	const sourcePackageResult = await loadSourceWidgetPackages(options.projectDir);
-	if (!sourcePackageResult.success) return failure({
-		code: "CONFIG_LOAD_FAILED",
-		message: sourcePackageResult.error.message,
-		details: sourcePackageResult.error.details
-	});
-	const validation = validateSingleSourceWidgetPackage(sourcePackageResult.value, { owner: options.owner });
-	if (!validation.success || !validation.value) return failure({
-		code: "VALIDATION_FAILED",
-		message: validation.errors.map((error) => error.message).join("\n")
-	});
-	try {
-		await validateWidgetPackageOutputPaths(options.projectDir, publishDirInput);
-		const publishDir = path.resolve(options.projectDir, publishDirInput);
-		const widgetScriptPath = path.join(publishDir, "widget.js");
-		await fs.emptyDir(publishDir);
-		const tempDir = path.resolve(options.projectDir, TEMP_BUILD_DIR);
-		await fs.emptyDir(tempDir);
-		let buildFailure;
-		try {
-			await buildWidgetScriptBundle({
-				projectDir: options.projectDir,
-				tempDir,
-				publishDir,
-				validated: validation.value
-			});
-		} catch (error) {
-			buildFailure = { error };
-		}
-		try {
-			await fs.remove(tempDir);
-		} catch {
-			const cleanupFailure = /* @__PURE__ */ new Error("Failed to remove reserved temporary build directory.");
-			if (buildFailure) {
-				const primaryError = buildFailure.error instanceof Error ? buildFailure.error : new Error(String(buildFailure.error));
-				throw new AggregateError([primaryError, cleanupFailure], `${primaryError.message}\n${cleanupFailure.message}`);
-			}
-			throw cleanupFailure;
-		}
-		if (buildFailure) throw buildFailure.error;
-		const cssUrls = await collectCssUrls(publishDir);
-		const descriptor = buildWidgetPackagePublishManifest(validation.value, { cssUrls });
-		const manifestContent = stableStringify(descriptor);
-		const publishPackageId = descriptor.packageId;
-		const manifestPath = path.join(publishDir, "manifest.json");
-		const publishManifestPath = path.join(publishDir, "publish-manifest.json");
-		await fs.writeFile(manifestPath, manifestContent, "utf-8");
-		const artifacts = await collectWidgetPackageArtifacts(publishDir);
-		const publishManifest = createPublishManifestMetadata({
-			packageId: publishPackageId,
-			version: validation.value.version,
-			cliVersion: options.cliVersion,
-			runtimeVersion: DEFAULT_RUNTIME_VERSION,
-			manifestContent,
-			artifacts
-		});
-		await fs.writeFile(publishManifestPath, stableStringify(publishManifest), "utf-8");
-		return success({
-			publishDir,
-			packageId: validation.value.packageId,
-			version: validation.value.version,
-			manifestPath,
-			publishManifestPath,
-			widgetScriptPath
-		});
-	} catch (err) {
-		const error = err instanceof Error ? err : new Error(String(err));
-		const isPublishDirValidationError = /^(publishDir|reserved temporary build directory) /.test(error.message);
-		return failure({
-			code: isPublishDirValidationError ? "INVALID_PUBLISH_DIR" : "WRITE_FAILED",
-			message: isPublishDirValidationError ? "Unsafe widget package publish directory" : "Failed to build shared widget package artifacts",
-			details: error.message
-		});
-	}
-}
-function createWidgetPackageEntrySource(options) {
-	return `import { createElement } from "react";
-import { startWidgetPackage } from "@fluid-app/portal-sdk/widgets/worker";
-${options.cssImportPath ? `import ${JSON.stringify(options.cssImportPath)};` : ""}
-
-const widgetConfig = await import(${JSON.stringify(options.configImportPath)});
-const SOURCE_PACKAGE_MARKER = "__fluidSourceWidgetPackage";
-const descriptors = ${JSON.stringify(options.validated.widgets, null, 2)};
-
-function isSourceWidgetPackage(value) {
-  return Boolean(value && typeof value === "object" && value[SOURCE_PACKAGE_MARKER] === true);
-}
-
-function collectSourceWidgetPackages(mod) {
-  return [
-    mod.widgetPackage,
-    ...(Array.isArray(mod.widgetPackages) ? mod.widgetPackages : []),
-    mod.default,
-  ].filter(isSourceWidgetPackage);
-}
-
-const sourcePackage = collectSourceWidgetPackages(widgetConfig)[0];
-if (!sourcePackage) {
-  throw new Error("No Fluid source widget package found while loading widget package worker bundle.");
-}
-
-const componentsByName = new Map(
-  sourcePackage.widgets.map((widget) => [widget.name, widget.component]),
-);
-
-const widgets = descriptors.map((descriptor) => {
-  const component = componentsByName.get(descriptor.name);
-  if (typeof component !== "function") {
-    throw new Error("Widget package is missing Remote DOM component for " + descriptor.name + ".");
-  }
-  return {
-    ...descriptor,
-    component: (props) => createElement(component, props),
-  };
-});
-
-startWidgetPackage({ widgets });
-`;
-}
-async function buildWidgetScriptBundle(options) {
-	const sourceConfig = await resolvePortalWidgetSourceConfig(options.projectDir);
-	if (!sourceConfig) throw new Error("No portal widget source config found.");
-	const entryPath = path.join(options.tempDir, "widget-entry.ts");
-	const viteConfigPath = path.join(options.tempDir, "vite.config.mjs");
-	const rootStylesPath = path.join(options.projectDir, "styles.css");
-	await fs.writeFile(entryPath, createWidgetPackageEntrySource({
-		configImportPath: pathToFileURL(sourceConfig.path).href,
-		cssImportPath: await fs.pathExists(rootStylesPath) ? pathToFileURL(rootStylesPath).href : void 0,
-		validated: options.validated
-	}), "utf-8");
-	await fs.writeFile(viteConfigPath, createViteConfigSource({
-		entryPath,
-		publishDir: options.publishDir,
-		projectConfigPath: await resolveProjectViteConfigPath(options.projectDir)
-	}), "utf-8");
-	const viteCliPath = resolveViteCliPath(options.projectDir);
-	await execa(process.execPath, [
-		viteCliPath,
-		"build",
-		"--config",
-		viteConfigPath
-	], {
-		cwd: options.projectDir,
-		stdio: "pipe",
-		env: {
-			...process.env,
-			NODE_ENV: "production"
-		}
-	});
-}
-function resolveViteCliPath(projectDir) {
-	const projectViteCliPath = resolveViteCliPathFromRequire(createRequire(path.join(projectDir, "package.json")));
-	if (projectViteCliPath) return projectViteCliPath;
-	const cliViteCliPath = resolveViteCliPathFromRequire(require);
-	if (cliViteCliPath) return cliViteCliPath;
-	throw new Error("Unable to resolve Vite for the portal project. Install the project dependencies and ensure vite is available before building widget packages.");
-}
-async function resolveProjectViteConfigPath(projectDir) {
-	for (const fileName of PROJECT_VITE_CONFIG_CANDIDATES) {
-		const candidate = path.join(projectDir, fileName);
-		if (await fs.pathExists(candidate)) return candidate;
-	}
-}
-function createViteConfigSource(options) {
-	const widgetConfigSource = createWidgetViteConfigObjectSource({
-		...options,
-		disableConfigFileLookup: !options.projectConfigPath
-	});
-	if (!options.projectConfigPath) return `import { defineConfig } from "vite";
-
-export default defineConfig(${widgetConfigSource});
-`;
-	return `import { defineConfig, loadConfigFromFile, mergeConfig } from "vite";
-
-const projectConfigPath = ${JSON.stringify(options.projectConfigPath)};
-const widgetConfig = ${widgetConfigSource};
-const fluidWidgetDefineInvariants = {
-  "process.env.NODE_ENV": JSON.stringify("production"),
-};
-const blockedFluidPluginNames = new Set(${JSON.stringify(BLOCKED_FLUID_PROJECT_PLUGIN_NAMES)});
-
-function isAllowedProjectPlugin(plugin) {
-  return !plugin || typeof plugin !== "object" || !blockedFluidPluginNames.has(plugin.name);
-}
-
-function sanitizeProjectPlugins(pluginOption) {
-  if (!Array.isArray(pluginOption)) {
-    return isAllowedProjectPlugin(pluginOption) ? pluginOption : [];
-  }
-
-  return pluginOption
-    .map((plugin) => Array.isArray(plugin) ? sanitizeProjectPlugins(plugin) : plugin)
-    .filter(isAllowedProjectPlugin);
-}
-
-function copyProjectConfigValue(source, target, key) {
-  if (Object.prototype.hasOwnProperty.call(source, key)) {
-    target[key] = source[key];
-  }
-}
-
-function sanitizeProjectConfig(config) {
-  if (!config || typeof config !== "object") return {};
-
-  const sanitized = {};
-  if (Object.prototype.hasOwnProperty.call(config, "plugins")) {
-    sanitized.plugins = sanitizeProjectPlugins(config.plugins);
-  }
-  copyProjectConfigValue(config, sanitized, "resolve");
-  copyProjectConfigValue(config, sanitized, "define");
-  copyProjectConfigValue(config, sanitized, "css");
-  copyProjectConfigValue(config, sanitized, "esbuild");
-  copyProjectConfigValue(config, sanitized, "json");
-  copyProjectConfigValue(config, sanitized, "assetsInclude");
-  copyProjectConfigValue(config, sanitized, "envDir");
-  copyProjectConfigValue(config, sanitized, "envPrefix");
-  return sanitized;
-}
-
-function copyConfigDefineValue(value) {
-  return value && typeof value === "object" && !Array.isArray(value)
-    ? { ...value }
-    : {};
-}
-
-function mergeFluidWidgetDefineInvariants(mergedConfig, safeProjectConfig, widgetConfig) {
-  mergedConfig.define = {
-    ...copyConfigDefineValue(safeProjectConfig.define),
-    ...copyConfigDefineValue(mergedConfig.define),
-    ...copyConfigDefineValue(widgetConfig.define),
-    ...fluidWidgetDefineInvariants,
-  };
-  return mergedConfig;
-}
-
-export default defineConfig(async (configEnv) => {
-  const projectConfig = await loadConfigFromFile(configEnv, projectConfigPath);
-  const safeProjectConfig = sanitizeProjectConfig(projectConfig?.config ?? {});
-  return mergeFluidWidgetDefineInvariants(mergeConfig(safeProjectConfig, widgetConfig), safeProjectConfig, widgetConfig);
-});
-`;
-}
-function createWidgetViteConfigObjectSource(options) {
-	const configFileSource = options.disableConfigFileLookup ? "  configFile: false,\n" : "";
-	return `(() => {
-  const fluidWidgetDefineInvariants = {
-    "process.env.NODE_ENV": JSON.stringify("production"),
-  };
-
-  function createFluidWidgetBuildInvariants() {
-    return {
-      copyPublicDir: false,
-      emptyOutDir: false,
-      outDir: ${JSON.stringify(options.publishDir)},
-      sourcemap: false,
-      target: "esnext",
-      cssCodeSplit: false,
-      lib: {
-        entry: ${JSON.stringify(options.entryPath)},
-        formats: ["es"],
-        fileName: () => "widget.js",
-        cssFileName: "widget",
-      },
-      rollupOptions: {
-        output: {
-          inlineDynamicImports: true,
-          hoistTransitiveImports: false,
-        },
-      },
-    };
-  }
-
-  function fluidWidgetBuildInvariantsPlugin() {
-    return {
-      name: "fluid-widget-build-invariants",
-      enforce: "post",
-      config() {
-        return { build: createFluidWidgetBuildInvariants() };
-      },
-      configResolved(config) {
-        config.define = {
-          ...(config.define ?? {}),
-          ...fluidWidgetDefineInvariants,
-        };
-        Object.assign(config.build, createFluidWidgetBuildInvariants());
-      },
-    };
-  }
-
-  return {
-${configFileSource}    publicDir: false,
-    define: fluidWidgetDefineInvariants,
-    resolve: {
-      conditions: [
-        "module",
-        "browser",
-        "development|production",
-      ],
-    },
-    plugins: [fluidWidgetBuildInvariantsPlugin()],
-    build: createFluidWidgetBuildInvariants(),
-  };
-})()`;
-}
-async function validateWidgetPackageOutputPaths(projectDir, publishDir) {
-	validateSharedWidgetPackagePublishDir(projectDir, publishDir);
-	await rejectSymlinkedPathSegments({
-		projectDir,
-		relativePath: publishDir,
-		label: "publishDir"
-	});
-	await rejectSymlinkedPathSegments({
-		projectDir,
-		relativePath: TEMP_BUILD_DIR,
-		label: "reserved temporary build directory"
-	});
-}
-async function collectCssUrls(publishDir) {
-	return (await fs.readdir(publishDir, { withFileTypes: true })).filter((entry) => entry.isFile() && isWidgetPackageCssArtifactPath(entry.name)).map((entry) => entry.name).sort();
-}
-async function rejectSymlinkedPathSegments(options) {
-	const resolvedProjectDir = path.resolve(options.projectDir);
-	const resolvedTargetPath = path.resolve(resolvedProjectDir, options.relativePath);
-	const segments = path.relative(resolvedProjectDir, resolvedTargetPath).split(path.sep).filter(Boolean);
-	let currentPath = resolvedProjectDir;
-	for (const segment of segments) {
-		currentPath = path.join(currentPath, segment);
-		let stat;
-		try {
-			stat = await fs.lstat(currentPath);
-		} catch (err) {
-			if (isNodeError(err) && err.code === "ENOENT") return;
-			throw err;
-		}
-		if (stat.isSymbolicLink()) throw new Error(`${options.label} must not include symbolic links.`);
-	}
-}
-function normalizePublishDirForValidation(value) {
-	return toPosixPath(path.normalize(value)).replace(/\/+$/, "") || ".";
-}
-function isPathWithinReservedDir(value, reservedDir) {
-	return value === reservedDir || value.startsWith(`${reservedDir}/`);
-}
-function toPosixPath(value) {
-	return value.split(path.sep).join("/");
-}
-function stableStringify(value) {
-	return `${JSON.stringify(value, null, 2)}\n`;
-}
-function resolveViteCliPathFromRequire(moduleRequire) {
-	try {
-		const packageJsonPath = moduleRequire.resolve("vite/package.json");
-		const binPath = getViteBinPath(moduleRequire(packageJsonPath).bin);
-		if (!binPath) return void 0;
-		return path.resolve(path.dirname(packageJsonPath), binPath);
-	} catch (err) {
-		if (isModuleResolutionError(err)) return void 0;
-		throw err;
-	}
-}
-function getViteBinPath(bin) {
-	if (typeof bin === "string") return bin;
-	if (!isRecord$2(bin)) return void 0;
-	const viteBin = bin.vite;
-	return typeof viteBin === "string" ? viteBin : void 0;
-}
-function isRecord$2(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isNodeError(value) {
-	return typeof value === "object" && value !== null && "code" in value && typeof value.code === "string";
-}
-function isModuleResolutionError(value) {
-	return isNodeError(value) && (value.code === "MODULE_NOT_FOUND" || value.code === "ERR_MODULE_NOT_FOUND");
-}
-//#endregion
-//#region ../widget-tooling/src/internal/widget-package-publish-request.ts
-async function createWidgetPackagePublishRequest(options) {
-	const manifestContent = await fs.readFile(options.manifestPath);
-	const manifest = parseJsonRecord(manifestContent.toString("utf-8"), options.manifestPath);
-	const publishManifest = await readPublishManifest(options.publishManifestPath);
-	assertManifestIdentityMatches(manifest, publishManifest, options.manifestPath);
-	assertMetadataMatches({
-		label: "manifestHash",
-		path: "manifest.json",
-		expected: publishManifest.manifestHash,
-		actual: sha256(manifestContent)
-	});
-	const collectedArtifacts = await collectWidgetPackageArtifacts(options.publishDir);
-	assertArtifactInventoryMatches(publishManifest.artifacts, collectedArtifacts);
-	const artifacts = await readUploadArtifacts(options.publishDir, publishManifest.artifacts);
-	return {
-		version: publishManifest.version,
-		packageKey: stripOwnerPrefix(publishManifest.packageId, options.owner),
-		builderVersion: publishManifest.builderVersion,
-		cliVersion: publishManifest.cliVersion,
-		runtimeVersion: publishManifest.runtimeVersion,
-		manifestHash: publishManifest.manifestHash,
-		manifest,
-		artifacts
-	};
-}
-async function readJsonRecord(filePath) {
-	return parseJsonRecord(await fs.readFile(filePath, "utf-8"), filePath);
-}
-function parseJsonRecord(content, filePath) {
-	const value = JSON.parse(content);
-	if (!isRecord$1(value) || Array.isArray(value)) throw new Error(`${path.basename(filePath)} must contain a JSON object.`);
-	return value;
-}
-async function readPublishManifest(filePath) {
-	const record = await readJsonRecord(filePath);
-	const artifactsValue = record["artifacts"];
-	if (!Array.isArray(artifactsValue)) throw new Error("publish-manifest.json must include an artifacts array.");
-	return {
-		packageId: readRequiredString(record, "packageId", filePath),
-		version: readRequiredString(record, "version", filePath),
-		builderVersion: readRequiredString(record, "builderVersion", filePath),
-		cliVersion: readRequiredString(record, "cliVersion", filePath),
-		runtimeVersion: readRequiredString(record, "runtimeVersion", filePath),
-		manifestHash: readRequiredString(record, "manifestHash", filePath),
-		artifacts: artifactsValue.map((artifact, index) => readArtifactMetadata(artifact, index))
-	};
-}
-function readArtifactMetadata(value, index) {
-	if (!isRecord$1(value) || Array.isArray(value)) throw new Error(`publish-manifest.json artifacts[${index}] must be a JSON object.`);
-	return {
-		path: readRequiredString(value, "path", "publish-manifest.json"),
-		sha256: readRequiredString(value, "sha256", "publish-manifest.json"),
-		bytes: readRequiredNumber(value, "bytes", "publish-manifest.json"),
-		contentType: readRequiredString(value, "contentType", "publish-manifest.json")
-	};
-}
-async function readUploadArtifacts(publishDir, artifacts) {
-	const resolvedPublishDir = path.resolve(publishDir);
-	return Promise.all(artifacts.map(async (artifact) => {
-		const artifactPath = resolveArtifactPath(resolvedPublishDir, artifact.path);
-		const actual = await computeArtifactMetadata(artifactPath, resolvedPublishDir);
-		assertArtifactMetadataMatches(artifact, actual);
-		return {
-			...actual,
-			body: await fs.readFile(artifactPath)
-		};
-	}));
-}
-function assertManifestIdentityMatches(manifest, publishManifest, manifestPath) {
-	assertMetadataMatches({
-		label: "packageId",
-		path: "manifest.json",
-		expected: publishManifest.packageId,
-		actual: readRequiredString(manifest, "packageId", manifestPath)
-	});
-	assertMetadataMatches({
-		label: "version",
-		path: "manifest.json",
-		expected: publishManifest.version,
-		actual: readRequiredString(manifest, "version", manifestPath)
-	});
-}
-function assertArtifactInventoryMatches(expected, actual) {
-	const expectedByPath = /* @__PURE__ */ new Map();
-	for (const artifact of expected) {
-		if (expectedByPath.has(artifact.path)) throw new Error(`publish-manifest.json artifacts include duplicate path ${JSON.stringify(artifact.path)}. Rebuild the widget package before publishing.`);
-		expectedByPath.set(artifact.path, artifact);
-	}
-	const actualPaths = /* @__PURE__ */ new Set();
-	for (const actualArtifact of actual) {
-		actualPaths.add(actualArtifact.path);
-		const expectedArtifact = expectedByPath.get(actualArtifact.path);
-		if (!expectedArtifact) throw new Error(`publish-manifest.json artifacts omit ${JSON.stringify(actualArtifact.path)}. Rebuild the widget package before publishing.`);
-		assertArtifactMetadataMatches(expectedArtifact, actualArtifact);
-	}
-	for (const expectedArtifact of expected) {
-		if (actualPaths.has(expectedArtifact.path)) continue;
-		throw new Error(`publish-manifest.json artifacts include ${JSON.stringify(expectedArtifact.path)}, but that file is not present on disk. Rebuild the widget package before publishing.`);
-	}
-}
-function assertArtifactMetadataMatches(expected, actual) {
-	assertMetadataMatches({
-		label: "path",
-		path: expected.path,
-		expected: expected.path,
-		actual: actual.path
-	});
-	assertMetadataMatches({
-		label: "sha256",
-		path: expected.path,
-		expected: expected.sha256,
-		actual: actual.sha256
-	});
-	assertMetadataMatches({
-		label: "bytes",
-		path: expected.path,
-		expected: expected.bytes,
-		actual: actual.bytes
-	});
-	assertMetadataMatches({
-		label: "contentType",
-		path: expected.path,
-		expected: expected.contentType,
-		actual: actual.contentType
-	});
-}
-function assertMetadataMatches(options) {
-	if (options.expected === options.actual) return;
-	throw new Error(`publish-manifest.json ${options.label} for ${JSON.stringify(options.path)} does not match the file on disk. Recorded ${JSON.stringify(options.expected)}, computed ${JSON.stringify(options.actual)}. Rebuild the widget package before publishing.`);
-}
-function resolveArtifactPath(publishDir, artifactPath) {
-	const resolved = path.resolve(publishDir, artifactPath);
-	const relative = path.relative(publishDir, resolved);
-	if (relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`Artifact path ${JSON.stringify(artifactPath)} escapes the publish directory.`);
-	return resolved;
-}
-function stripOwnerPrefix(packageId, owner) {
-	const prefix = `${owner}.`;
-	if (packageId.startsWith(prefix) && packageId.length > prefix.length) return packageId.slice(prefix.length);
-	return packageId;
-}
-function readRequiredString(record, key, filePath) {
-	const value = record[key];
-	if (typeof value === "string" && value.trim().length > 0) return value;
-	throw new Error(`${path.basename(filePath)} must include string ${key}.`);
-}
-function readRequiredNumber(record, key, filePath) {
-	const value = record[key];
-	if (typeof value === "number" && Number.isFinite(value)) return value;
-	throw new Error(`${path.basename(filePath)} must include number ${key}.`);
-}
-function isRecord$1(value) {
-	return typeof value === "object" && value !== null;
-}
-//#endregion
-//#region ../widget-tooling/src/internal/widget-package-upload.ts
-var WidgetPackageUploadError = class extends Error {
-	code;
-	constructor(code, message) {
-		super(message);
-		this.name = "WidgetPackageUploadError";
-		this.code = code;
-	}
-};
-function buildWidgetPackageArtifactPayload(artifact) {
-	return {
-		path: artifact.path,
-		sha256: artifact.sha256,
-		bytes: artifact.bytes,
-		contentType: artifact.contentType
-	};
-}
-function buildWidgetPackageUploadSessionPayload(request) {
-	return {
-		version: request.version,
-		package_key: request.packageKey,
-		builder_version: request.builderVersion,
-		cli_version: request.cliVersion,
-		runtime_version: request.runtimeVersion,
-		manifest_hash: request.manifestHash,
-		manifest: request.manifest,
-		artifacts: request.artifacts.map(buildWidgetPackageArtifactPayload)
-	};
-}
-function buildWidgetPackageCompleteUploadPayload(packageKey, artifacts) {
-	return {
-		package_key: packageKey,
-		artifacts: artifacts.map(buildWidgetPackageArtifactPayload)
-	};
-}
-function getWidgetPackageUploadSessionRoute(owner) {
-	switch (owner.kind) {
-		case "droplet": return `/api/droplets/${encodeURIComponent(owner.uuid)}/widget_package_versions`;
-		case "company": return "/api/company/fluid_os/widget_package_versions";
-	}
-}
-function getWidgetPackageCompleteUploadRoute(owner, version) {
-	switch (owner.kind) {
-		case "droplet": return `/api/droplets/${encodeURIComponent(owner.uuid)}/widget_package_versions/${encodeURIComponent(version)}/complete_upload`;
-		case "company": return `/api/company/fluid_os/widget_package_versions/${encodeURIComponent(version)}/complete_upload`;
-	}
-}
-async function requestWidgetPackageUploadSession(client, owner, request) {
-	const payload = buildWidgetPackageUploadSessionPayload(request);
-	try {
-		return normalizeWidgetPackageUploadSession(owner.kind === "company" ? await fluid_os_v0_create_widget_package_version(client, payload) : await client.post(getWidgetPackageUploadSessionRoute(owner), payload), request.version, request.artifacts);
-	} catch (err) {
-		if (err instanceof WidgetPackageUploadError) throw err;
-		throw new WidgetPackageUploadError("SESSION_REQUEST_FAILED", `Failed to create widget package upload session: ${formatUnknownError(err)}`);
-	}
-}
-async function uploadWidgetPackageArtifacts(session, artifacts, fetchImpl = fetch) {
-	const uploadsByPath = new Map(session.uploads.map((upload) => [upload.path, upload]));
-	const results = [];
-	for (const artifact of artifacts) {
-		const upload = uploadsByPath.get(artifact.path);
-		if (!upload) throw new WidgetPackageUploadError("MISSING_SIGNED_URL", `Upload session did not include a signed URL for artifact "${artifact.path}".`);
-		if (upload.contentType !== artifact.contentType) throw new WidgetPackageUploadError("CONTENT_TYPE_MISMATCH", `Upload session expected artifact "${artifact.path}" to use content type "${upload.contentType}", but local artifact uses "${artifact.contentType}".`);
-		let response;
-		try {
-			response = await fetchImpl(upload.url, {
-				method: "PUT",
-				headers: mergeUploadHeaders(upload.headers, upload.contentType),
-				body: artifact.body
-			});
-		} catch (err) {
-			throw new WidgetPackageUploadError("ARTIFACT_UPLOAD_FAILED", `Failed to upload artifact "${artifact.path}": ${formatUnknownError(err)}`);
-		}
-		if (!response.ok) {
-			const body = await response.text().catch(() => "");
-			const details = body.trim() ? `: ${body.trim().slice(0, 500)}` : "";
-			throw new WidgetPackageUploadError("ARTIFACT_UPLOAD_FAILED", `Failed to upload artifact "${artifact.path}": PUT returned HTTP ${response.status}${details}`);
-		}
-		results.push({
-			path: artifact.path,
-			status: response.status,
-			contentType: upload.contentType
-		});
-	}
-	return results;
-}
-async function completeWidgetPackageUpload(client, owner, version, packageKey, artifacts) {
-	const payload = buildWidgetPackageCompleteUploadPayload(packageKey, artifacts);
+/**
+* The whole deploy, as one function returning a result.
+*
+* A result rather than a throw because two of its outcomes — a key that belongs
+* to another package, a version already published — are refusals with a fix to
+* show, not exceptions.
+*/
+async function runPortalDeploy(options) {
 	try {
-		return normalizeWidgetPackageCompleteResponse(owner.kind === "company" ? await fluid_os_v0_complete_widget_package_version_upload(client, version, payload) : await client.post(getWidgetPackageCompleteUploadRoute(owner, version), payload), version);
-	} catch (err) {
-		if (err instanceof WidgetPackageUploadError) throw err;
-		throw new WidgetPackageUploadError("COMPLETE_UPLOAD_FAILED", `Failed to complete widget package upload: ${formatUnknownError(err)}`);
-	}
-}
-async function publishWidgetPackageVersion(options) {
-	const sessionPayload = buildWidgetPackageUploadSessionPayload(options.request);
-	if (options.dryRun) return {
-		dryRun: true,
-		sessionPayload
-	};
-	if (!options.client) throw new Error("A FetchClient is required when dryRun is false.");
-	const session = await requestWidgetPackageUploadSession(options.client, options.owner, options.request);
-	return {
-		dryRun: false,
-		sessionPayload,
-		session,
-		uploadedArtifacts: await uploadWidgetPackageArtifacts(session, options.request.artifacts, options.fetchImpl),
-		complete: await completeWidgetPackageUpload(options.client, options.owner, session.version, options.request.packageKey, options.request.artifacts)
-	};
-}
-function normalizeWidgetPackageUploadSession(response, requestedVersion, requestedArtifacts) {
-	const record = requireRecord(response, "INVALID_SESSION_RESPONSE", "Upload session response must be a JSON object.");
-	requireFiniteNumberProperty(record, "version_id", "INVALID_SESSION_RESPONSE");
-	requireStringProperty(record, "artifact_base_url", "INVALID_SESSION_RESPONSE");
-	const uploadValues = record["uploads"];
-	if (!Array.isArray(uploadValues)) throw new WidgetPackageUploadError("INVALID_SESSION_RESPONSE", "Upload session response must contain an \"uploads\" array.");
-	const requestedArtifactsByPath = new Map(requestedArtifacts.map((artifact) => [artifact.path, artifact]));
-	const seenUploadPaths = /* @__PURE__ */ new Set();
-	const uploads = uploadValues.map((value, index) => {
-		const upload = requireRecord(value, "INVALID_SESSION_RESPONSE", `Upload session uploads[${index}] must be a JSON object.`);
-		const path = requireStringProperty(upload, "path", "INVALID_SESSION_RESPONSE");
-		const url = requireStringProperty(upload, "upload_url", "INVALID_SESSION_RESPONSE");
-		requireStringProperty(upload, "public_url", "INVALID_SESSION_RESPONSE");
-		const requestedArtifact = requestedArtifactsByPath.get(path);
-		if (!requestedArtifact) throw new WidgetPackageUploadError("INVALID_SESSION_RESPONSE", `Upload session response included unexpected artifact "${path}".`);
-		if (seenUploadPaths.has(path)) throw new WidgetPackageUploadError("INVALID_SESSION_RESPONSE", `Upload session response included duplicate artifact "${path}".`);
-		seenUploadPaths.add(path);
+		await assertStandalonePortalRemoteActionAllowed(options.projectDir, "portal deploy");
+	} catch (error) {
 		return {
-			path,
-			url,
-			contentType: requestedArtifact.contentType,
-			headers: {}
+			ok: false,
+			code: "STANDALONE_PORTAL",
+			message: error instanceof Error ? error.message : String(error)
 		};
-	});
-	const missingUploadPaths = requestedArtifacts.map((artifact) => artifact.path).filter((artifactPath) => !seenUploadPaths.has(artifactPath));
-	if (missingUploadPaths.length > 0) throw new WidgetPackageUploadError("INVALID_SESSION_RESPONSE", `Upload session response is missing signed URLs for artifact(s): ${missingUploadPaths.join(", ")}.`);
-	return {
-		version: requestedVersion,
-		uploads,
-		raw: response
-	};
-}
-function normalizeWidgetPackageCompleteResponse(response, requestedVersion) {
-	const record = requireRecord(response, "INVALID_COMPLETE_RESPONSE", "Complete upload response must be a JSON object.");
-	const responseVersion = requireStringProperty(record, "version", "INVALID_COMPLETE_RESPONSE");
-	if (responseVersion !== requestedVersion) throw new WidgetPackageUploadError("INVALID_COMPLETE_RESPONSE", `Complete upload response version "${responseVersion}" did not match requested version "${requestedVersion}".`);
-	const packageKey = requireStringProperty(record, "packageId", "INVALID_COMPLETE_RESPONSE");
-	const status = requireStringProperty(record, "status", "INVALID_COMPLETE_RESPONSE");
-	requireStringProperty(record, "scriptUrl", "INVALID_COMPLETE_RESPONSE");
-	requireStringProperty(record, "manifestUrl", "INVALID_COMPLETE_RESPONSE");
-	requireStringArrayProperty(record, "cssUrls", "INVALID_COMPLETE_RESPONSE");
-	return {
-		version: responseVersion,
-		status,
-		packageKey,
-		raw: response
-	};
-}
-function normalizeHeaderName(name) {
-	return name.toLowerCase();
-}
-function mergeUploadHeaders(headers, contentType) {
-	const merged = {};
-	for (const [key, value] of Object.entries(headers)) {
-		if (normalizeHeaderName(key) === "content-type") continue;
-		merged[key] = value;
 	}
-	merged["Content-Type"] = contentType;
-	return merged;
-}
-function requireRecord(value, code, message) {
-	if (!isRecord(value) || Array.isArray(value)) throw new WidgetPackageUploadError(code, message);
-	return value;
-}
-function isRecord(value) {
-	return typeof value === "object" && value !== null;
-}
-function requireStringProperty(record, key, code) {
-	const value = record[key];
-	if (typeof value === "string" && value.trim().length > 0) return value;
-	throw new WidgetPackageUploadError(code, `Response field "${key}" must be a non-empty string.`);
-}
-function requireFiniteNumberProperty(record, key, code) {
-	const value = record[key];
-	if (typeof value === "number" && Number.isFinite(value)) return value;
-	throw new WidgetPackageUploadError(code, `Response field "${key}" must be a finite number.`);
-}
-function requireStringArrayProperty(record, key, code) {
-	const value = record[key];
-	if (Array.isArray(value) && value.every((entry) => typeof entry === "string" && entry.trim().length > 0)) return value;
-	throw new WidgetPackageUploadError(code, `Response field "${key}" must be an array of non-empty strings.`);
-}
-function formatUnknownError(err) {
-	const base = err instanceof Error ? err.message : String(err);
-	if (isRecord(err) && "data" in err) return `${base} — ${safeStringify(err.data)}`;
-	return base;
-}
-function safeStringify(value) {
-	const seen = /* @__PURE__ */ new WeakSet();
-	try {
-		return JSON.stringify(value, (_key, item) => {
-			if (typeof item === "bigint") return `${item}n`;
-			if (typeof item !== "object" || item === null) return item;
-			if (seen.has(item)) return "[Circular]";
-			seen.add(item);
-			return item;
-		}) ?? String(value);
-	} catch {
-		return "[unserializable error data]";
-	}
-}
-//#endregion
-//#region ../widget-tooling/src/workflows.ts
-async function buildWidgetPackage(options) {
-	const result = await buildSharedWidgetPackage({
-		projectDir: options.projectDir,
-		publishDir: options.outDir,
-		owner: options.owner,
-		cliVersion: options.cliVersion
-	});
-	if (result.success) return result.value;
-	throw new WidgetToolingError(result.error.code === "CONFIG_LOAD_FAILED" ? "CONFIG_LOAD_FAILED" : result.error.code === "VALIDATION_FAILED" ? "VALIDATION_FAILED" : result.error.code === "INVALID_PUBLISH_DIR" ? "INVALID_OUTPUT_DIR" : "BUILD_FAILED", result.error.message, { details: result.error.details });
-}
-async function publishWidgetPackage(options) {
-	if (options.owner !== options.uploadOwner.kind) throw new WidgetToolingError("OWNER_MISMATCH", `Widget package build owner "${options.owner}" must match upload owner kind "${options.uploadOwner.kind}".`);
-	if (!options.dryRun && !options.client) throw new WidgetToolingError("CLIENT_REQUIRED", "A FetchClient is required when dryRun is false.");
-	const build = await buildWidgetPackage(options);
-	let request;
-	try {
-		request = await createWidgetPackagePublishRequest({
-			publishDir: build.publishDir,
-			manifestPath: build.manifestPath,
-			publishManifestPath: build.publishManifestPath,
-			owner: options.owner
-		});
+	let client;
+	if (!options.dryRun) try {
+		client = createAuthenticatedWidgetPackageClient();
 	} catch (error) {
-		throw new WidgetToolingError("ARTIFACT_VERIFICATION_FAILED", error instanceof Error ? error.message : "Failed to verify widget package artifacts.", { cause: error });
-	}
-	try {
-		const publish = options.dryRun ? await publishWidgetPackageVersion({
-			owner: options.uploadOwner,
-			request,
-			dryRun: true,
-			fetchImpl: options.fetchImpl
-		}) : await publishWidgetPackageVersion({
-			client: options.client,
-			owner: options.uploadOwner,
-			request,
-			fetchImpl: options.fetchImpl
-		});
 		return {
-			build,
-			request,
-			publish
+			ok: false,
+			code: "NOT_AUTHENTICATED",
+			message: "Not signed in to Fluid, so the widgets were not published.",
+			...error instanceof Error ? { hint: error.message } : {}
 		};
-	} catch (error) {
-		if (error instanceof WidgetToolingError) throw error;
-		if (error instanceof WidgetPackageUploadError) throw new WidgetToolingError(toPublicUploadErrorCode(error.code), error.message, { cause: error });
-		throw new WidgetToolingError("PUBLISH_FAILED", error instanceof Error ? error.message : "Failed to publish widget package.", { cause: error });
-	}
-}
-function toPublicUploadErrorCode(code) {
-	switch (code) {
-		case "SESSION_REQUEST_FAILED":
-		case "INVALID_SESSION_RESPONSE":
-		case "MISSING_SIGNED_URL":
-		case "CONTENT_TYPE_MISMATCH":
-		case "ARTIFACT_UPLOAD_FAILED":
-		case "COMPLETE_UPLOAD_FAILED":
-		case "INVALID_COMPLETE_RESPONSE": return code;
-		default: return "PUBLISH_FAILED";
 	}
-}
-//#endregion
-//#region src/commands/widget-package-publish.ts
-async function publishWidgetRuntimeArtifacts(options) {
-	const isDryRun = options.dryRun === true;
-	const client = options.client;
-	if (!isDryRun && !client) throw new Error("A FetchClient is required when dryRun is false.");
-	const cliVersion = await getPortalCliVersion();
-	try {
-		if (isDryRun) return await publishWidgetPackage({
-			projectDir: options.projectDir,
-			outDir: options.outDir,
-			owner: options.buildOwner,
-			uploadOwner: options.uploadOwner,
-			cliVersion,
-			dryRun: true
-		});
-		if (!client) throw new Error("A FetchClient is required when dryRun is false.");
-		return await publishWidgetPackage({
+	let preflight = {};
+	if (client) {
+		options.onProgress?.("Checking this company's widget package...");
+		preflight = await preflightCompanyPackage({
 			projectDir: options.projectDir,
-			outDir: options.outDir,
-			owner: options.buildOwner,
-			uploadOwner: options.uploadOwner,
-			cliVersion,
-			client
+			client,
+			readConfiguredPackage: async (dir) => {
+				const { validated } = await loadAndValidateWidgetPackage({
+					projectDir: dir,
+					owner: "company"
+				});
+				return {
+					packageId: validated.packageId,
+					version: validated.version
+				};
+			}
 		});
-	} catch (error) {
-		throwWithDetails(error);
-	}
-}
-function throwWithDetails(error) {
-	if (!(error instanceof Error)) throw error;
-	if (!("details" in error) || typeof error.details !== "string" || error.details.length === 0) throw error;
-	throw new Error(`${error.message}\n${error.details}`, { cause: error });
-}
-function createAuthenticatedWidgetPackageClient() {
-	const { profile, profileName, token } = resolveAuthenticatedProfile();
-	if (!token) {
-		if (!profileName) throw new Error("Not logged in. Run " + chalk.cyan("fluid login") + " first.");
-		throw new Error("No auth token found for profile " + chalk.cyan(profileName) + ". Run " + chalk.cyan("fluid login") + " to re-authenticate.");
-	}
-	return createFetchClient({
-		baseUrl: profile?.baseUrl ?? process.env["FLUID_API_BASE"] ?? "https://api.fluid.app",
-		getAuthToken: () => token
-	});
-}
-function resolveAuthenticatedProfile() {
-	const config = readConfig();
-	const projectConfig = findProjectConfig(process.cwd());
-	if (projectConfig?.profile) {
-		const profile = config.profiles[projectConfig.profile];
-		if (profile) return {
-			profile,
-			profileName: projectConfig.profile,
-			token: profile.token
+		if (preflight.mismatch) return {
+			ok: false,
+			code: "PACKAGE_KEY_MISMATCH",
+			message: "This project publishes under a different package key.",
+			hint: preflight.mismatch
 		};
 	}
-	if (!config.activeProfile) return {};
-	const profile = config.profiles[config.activeProfile];
-	if (!profile) return {};
-	return {
-		profile,
-		profileName: config.activeProfile,
-		token: profile.token
-	};
-}
-function printWidgetPublishSummary(options) {
-	console.log();
-	console.log(chalk.green.bold(`${options.title} complete`));
-	console.log();
-	console.log(chalk.gray("Owner:       ") + chalk.white(options.ownerLabel));
-	if (options.environment) console.log(chalk.gray("Environment: ") + chalk.white(options.environment));
-	console.log(chalk.gray("Package:     ") + chalk.white(options.result.build.packageId));
-	console.log(chalk.gray("Version:     ") + chalk.white(options.result.build.version));
-	console.log(chalk.gray("Output:      ") + chalk.cyan(options.outDir));
-	console.log(chalk.gray("Artifacts:   ") + chalk.white(String(options.result.request.artifacts.length)));
-	console.log();
-}
-function printRuntimeOnlyNotice() {
-	console.log(chalk.yellow("This publishes widget runtime artifacts only; it does not deploy the hosted portal shell."));
-	console.log();
-}
-function printDryRunSessionPayload(result) {
-	console.log(chalk.bold("Dry-run upload session payload:"));
-	console.log(JSON.stringify(result.publish.sessionPayload, null, 2));
-	console.log();
-}
-//#endregion
-//#region src/commands/deploy.ts
-const DEFAULT_OUT_DIR$1 = ".fluid/widget-dist";
-const DEFAULT_ENVIRONMENT = "production";
-const deployCommand = new Command("deploy").description("Publish company-owned portal widget runtime artifacts").option("-e, --environment <name>", "Target environment label for output reporting", DEFAULT_ENVIRONMENT).option("-o, --out-dir <dir>", "Widget artifact output directory", DEFAULT_OUT_DIR$1).option("--dry-run", "Build and validate upload payload without publishing").action(async (options) => {
-	const environment = options.environment ?? DEFAULT_ENVIRONMENT;
-	const outDir = options.outDir ?? DEFAULT_OUT_DIR$1;
-	const dryRun = options.dryRun === true;
-	console.log();
-	console.log(chalk.blue.bold("Fluid Portal Deploy"));
-	console.log();
-	printRuntimeOnlyNotice();
-	console.log(chalk.gray("Environment: ") + chalk.white(environment));
-	console.log(chalk.gray("Output:      ") + chalk.cyan(outDir));
-	if (dryRun) console.log(chalk.yellow("Dry run: no upload will be created."));
-	console.log();
-	const spinner = ora("Building company-owned widget package...").start();
+	options.onProgress?.("Building company-owned widget package...");
 	try {
 		const result = await publishWidgetRuntimeArtifacts({
-			projectDir: process.cwd(),
-			outDir,
+			projectDir: options.projectDir,
+			outDir: options.outDir,
 			buildOwner: "company",
 			uploadOwner: { kind: "company" },
-			dryRun,
-			...dryRun ? {} : { client: createAuthenticatedWidgetPackageClient() }
-		});
-		spinner.succeed("Built widget runtime artifacts");
-		if (dryRun) {
-			console.log(chalk.yellow("Dry run complete — upload session was not requested."));
-			console.log();
-			printDryRunSessionPayload(result);
-		} else console.log(chalk.green("Published widget package version."));
-		printWidgetPublishSummary({
-			title: dryRun ? "Portal deploy dry run" : "Portal deploy",
-			ownerLabel: "company",
-			environment,
-			outDir,
-			result
+			dryRun: options.dryRun,
+			...preflight.versionOverride ? { version: preflight.versionOverride } : {},
+			...client ? { client } : {}
 		});
-	} catch (err) {
-		spinner.fail("Portal deploy failed");
-		console.error(chalk.red("Error:") + " " + (err instanceof Error ? err.message : String(err)));
-		process.exit(1);
+		return {
+			ok: true,
+			packageId: result.build.packageId,
+			version: result.build.version,
+			artifactCount: result.request.artifacts.length,
+			...preflight.versionOverride && preflight.configuredVersion ? { requestedVersion: preflight.configuredVersion } : {},
+			sessionPayload: result.publish.sessionPayload
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			code: error instanceof Error && "code" in error ? String(error.code) : "PUBLISH_FAILED",
+			message: error instanceof Error ? error.message : "Publishing the widgets failed.",
+			...error instanceof Error && "details" in error && typeof error.details === "string" && error.details.length > 0 ? { hint: error.details } : {}
+		};
 	}
-});
+}
 //#endregion
 //#region src/commands/doctor.ts
 /** Files that are managed by the SDK and should match the canonical template. */
@@ -5507,9 +4401,9 @@ function requireToken() {
 	return token;
 }
 function createClient(token) {
-	return createFetchClient({
+	return createFluidOsClient({
 		baseUrl: getApiBase(),
-		getAuthToken: () => token
+		token
 	});
 }
 async function requireDefinitionId() {
@@ -5522,13 +4416,14 @@ async function requireDefinitionId() {
 	return mappings.definition.id;
 }
 const createVersionCommand = new Command("create").description("Create a new version (snapshot) of the portal definition").option("--activate", "Activate the version immediately after creation").action(async (options) => {
+	await assertStandalonePortalRemoteActionAllowed(process.cwd(), "portal version create");
 	const client = createClient(requireToken());
 	const definitionId = await requireDefinitionId();
 	console.log();
 	console.log(chalk.bold("Creating version..."));
 	let result;
 	try {
-		result = await fluid_os_v0_create_fluid_osversion(client, definitionId);
+		result = await fluidOsApi.createVersion(client, definitionId);
 	} catch (err) {
 		console.error(chalk.red("Error:") + " Failed to create version — " + (err instanceof Error ? err.message : String(err)));
 		process.exit(1);
@@ -5546,7 +4441,7 @@ const createVersionCommand = new Command("create").description("Create a new ver
 	if (options.activate) {
 		console.log("Activating version...");
 		try {
-			await fluid_os_v0_update_fluid_osversion(client, definitionId, version.id, { version: { active: true } });
+			await fluidOsApi.updateVersion(client, definitionId, version.id, { version: { active: true } });
 		} catch (err) {
 			console.error(chalk.red("Error:") + " Failed to activate version — " + (err instanceof Error ? err.message : String(err)));
 			process.exit(1);
@@ -5561,7 +4456,7 @@ const listVersionCommand = new Command("list").description("List all versions of
 	const definitionId = await requireDefinitionId();
 	let result;
 	try {
-		result = await fluid_os_v0_list_fluid_osversions(client, definitionId);
+		result = await fluidOsApi.listVersions(client, definitionId);
 	} catch (err) {
 		console.error(chalk.red("Error:") + " Failed to list versions — " + (err instanceof Error ? err.message : String(err)));
 		process.exit(1);
@@ -5587,6 +4482,12 @@ const listVersionCommand = new Command("list").description("List all versions of
 	console.log();
 });
 const activateVersionCommand = new Command("activate").description("Activate a specific version, making it the live version").argument("<version-id>", "The version ID to activate").option("-y, --yes", "Skip confirmation prompt").action(async (versionId, options) => {
+	await assertStandalonePortalRemoteActionAllowed(process.cwd(), "portal version activate");
+	const numericVersionId = Number(versionId);
+	if (!Number.isSafeInteger(numericVersionId) || numericVersionId < 1) {
+		console.error(chalk.red("Error:") + " Version ID must be a positive integer.");
+		process.exit(1);
+	}
 	const client = createClient(requireToken());
 	const definitionId = await requireDefinitionId();
 	if (!options.yes) {
@@ -5604,7 +4505,7 @@ const activateVersionCommand = new Command("activate").description("Activate a s
 	console.log();
 	console.log(chalk.bold("Activating version..."));
 	try {
-		await fluid_os_v0_update_fluid_osversion(client, definitionId, versionId, { version: { active: true } });
+		await fluidOsApi.updateVersion(client, definitionId, numericVersionId, { version: { active: true } });
 	} catch (err) {
 		console.error(chalk.red("Error:") + " Failed to activate version — " + (err instanceof Error ? err.message : String(err)));
 		process.exit(1);
@@ -5618,6 +4519,7 @@ const versionCommand = new Command("version").description("Manage portal definit
 //#region src/commands/widget-publish.ts
 const DEFAULT_OUT_DIR = ".fluid/widget-dist";
 const publishSubcommand = new Command("publish").description("Publish droplet-owned widget runtime artifacts").requiredOption("--droplet <uuid>", "Droplet UUID that owns the widget package").option("-o, --out-dir <dir>", "Widget artifact output directory", DEFAULT_OUT_DIR).option("--dry-run", "Build and validate upload payload without publishing").action(async (options) => {
+	await assertStandalonePortalRemoteActionAllowed(process.cwd(), "portal widget publish");
 	const outDir = options.outDir ?? DEFAULT_OUT_DIR;
 	const dryRun = options.dryRun === true;
 	console.log();
@@ -5645,17 +4547,19 @@ const publishSubcommand = new Command("publish").description("Publish droplet-ow
 		if (dryRun) {
 			console.log(chalk.yellow("Dry run complete — upload session was not requested."));
 			console.log();
-			printDryRunSessionPayload(result);
+			printDryRunSessionPayload(result.publish.sessionPayload);
 		} else console.log(chalk.green("Published widget package version."));
 		printWidgetPublishSummary({
 			title: dryRun ? "Widget publish dry run" : "Widget publish",
 			ownerLabel: `droplet ${options.droplet}`,
 			outDir,
-			result
+			packageId: result.build.packageId,
+			version: result.build.version,
+			artifactCount: result.request.artifacts.length
 		});
 	} catch (err) {
 		spinner.fail("Widget publish failed");
-		console.error(chalk.red("Error:") + " " + (err instanceof Error ? err.message : String(err)));
+		printWidgetPublishError(err);
 		process.exit(1);
 	}
 });
@@ -5687,6 +4591,6 @@ const plugin = {
 	}
 };
 //#endregion
-export { CANONICAL_PROJECT_NAME, FILE_SYSTEM_ERRORS, GitError, TEMPLATES, TEMPLATE_REPO_URL, buildIdToSlugMap, buildNavigationIdToSlugMap, buildSnapshot, buildThemeIdToSlugMap, categorizeChanges, cloneCommand, computeFileHash, copyTemplate, copyTemplateSafe, createCommand, createDirectory, createDirectorySafe, createPortalGitCredential, createPortalProject, plugin as default, deployCommand, deriveScreenSlug, deriveSlug, diffAgainstSnapshot, directoryExists, doctorCommand, ensureGitAvailable, fileExists, getInstallCommand, getOriginUrl, getRunCommand, getSdkVersion, getSdkVersionSafe, getTemplatePaths, gitAheadBehindVsFetchHead, gitAutoCommit, gitClone, gitFetch, gitInit, gitMergeFastForward, gitMissingError, gitPush, hasUncommittedChanges, installDependencies, isGitAvailable, isGitRepo, pathExists, portalGitCredentialPath, promptProjectConfig, pullCommand, pushCommand, readFileSafe, readMappings, readSnapshot, removeMapping, resolveIdToSlug, resolveSlugToId, rewriteProjectName, runPackageManager, runPortalGitSync, scaffoldFromGitHub, slugFromPath, topLevelWidgetCommand, transformNavigation, transformNavigationItems, transformProfile, transformScreen, transformTheme, updateMapping, validateCrossReferences, versionCommand, widgetCommand, writeFileSafe, writeFluidrcProfile, writeMappings, writeSnapshot };
+export { CANONICAL_PROJECT_NAME, FILE_SYSTEM_ERRORS, GitError, TEMPLATES, TEMPLATE_REPO_URL, buildIdToSlugMap, buildNavigationIdToSlugMap, buildSnapshot, buildThemeIdToSlugMap, categorizeChanges, cloneCommand, computeFileHash, copyTemplate, copyTemplateSafe, createCommand, createDirectory, createDirectorySafe, createPortalGitCredential, createPortalProject, plugin as default, deployCommand, deriveScreenSlug, deriveSlug, diffAgainstSnapshot, directoryExists, doctorCommand, ensureGitAvailable, fileExists, formatPackageKeyMismatch, getInstallCommand, getOriginUrl, getRunCommand, getSdkVersion, getSdkVersionSafe, getTemplatePaths, gitAheadBehindVsFetchHead, gitAutoCommit, gitClone, gitFetch, gitInit, gitMergeFastForward, gitMissingError, gitPush, hasUncommittedChanges, installDependencies, isGitAvailable, isGitRepo, pathExists, portalGitCredentialPath, preflightCompanyPackage, promptProjectConfig, publishWidgetRuntimeArtifacts, pullCommand, pushCommand, readCompanyWidgetPackage, readFileSafe, readMappings, readSnapshot, removeMapping, resolveIdToSlug, resolvePublishVersion, resolveSlugToId, rewriteProjectName, runPackageManager, runPortalGitSync, scaffoldFromGitHub, slugFromPath, topLevelWidgetCommand, transformNavigation, transformNavigationItems, transformProfile, transformScreen, transformTheme, updateMapping, validateCrossReferences, versionCommand, widgetCommand, writeFileSafe, writeFluidrcProfile, writeMappings, writeSnapshot };
 
 //# sourceMappingURL=index.mjs.map