@fluid-app/fluid-cli-widget 0.1.27 → 0.1.29

package/dist/index.mjs

@@ -1,14 +1,16 @@
+import { i as fluidOsV0WidgetPackageGitCredentialCreate, l as WidgetToolingError, n as loadAndValidateWidgetPackage, r as publishWidgetPackage$1, t as buildWidgetPackage$1 } from "./src-_wfDoBLp.mjs";
 import { Command } from "commander";
-import { buildSharedWidgetPackage, createAuthenticatedWidgetPackageClient, loadSourceWidgetPackages, printDryRunSessionPayload, printRuntimeOnlyNotice, printWidgetPublishSummary, publishWidgetRuntimeArtifacts, validateSingleSourceWidgetPackage, validateWidgetPublishOutDir } from "@fluid-app/fluid-cli-portal";
+import path from "node:path";
+import { randomUUID } from "node:crypto";
+import { execa } from "execa";
+import { fileURLToPath } from "node:url";
+import { findProjectConfig, readConfig } from "@fluid-app/fluid-cli";
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { cp, mkdir, mkdtemp, readFile, readdir, rm, rmdir, stat, writeFile } from "node:fs/promises";
 import chalk from "chalk";
 import ora from "ora";
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { cp, mkdir, mkdtemp, readFile, readdir, rm, rmdir, stat, writeFile } from "node:fs/promises";
-import path from "node:path";
 import { spawn, spawnSync } from "node:child_process";
 import os from "node:os";
-import { execa } from "execa";
-import { fileURLToPath } from "node:url";
 import prompts from "prompts";
 //#region src/utils/config.ts
 const WIDGET_CONFIG_FILE = "fluid.widget.config.ts";
@@ -317,22 +319,27 @@ async function validateDropletWidgetProject(projectDir, packageKeyOverride) {
 	}]);
 	const configErrors = await validateRootWidgetConfig(resolvedProjectDir, packageKeyOverride);
 	if (configErrors.length > 0) throw new WidgetValidationError(configErrors);
-	const sourcePackages = await withRootWidgetConfigBridge(resolvedProjectDir, async () => {
-		const loadResult = await loadSourceWidgetPackages(resolvedProjectDir);
-		if (!loadResult.success) throw new WidgetValidationError([{
-			code: "INVALID_SOURCE_PACKAGE",
-			path: sourceConfig.relativePath,
-			message: appendDetails(loadResult.error.message, loadResult.error.details)
-		}]);
-		return loadResult.value;
-	}, packageKeyOverride);
-	const validation = validateSingleSourceWidgetPackage(sourcePackages, { owner: "droplet" });
-	const errors = [...validation.errors, ...validateDropletMetadata(sourcePackages)];
-	if (!validation.success || !validation.value || errors.length > 0) throw new WidgetValidationError(errors);
+	let validated;
+	try {
+		validated = (await withRootWidgetConfigBridge(resolvedProjectDir, () => loadAndValidateWidgetPackage({
+			projectDir: resolvedProjectDir,
+			owner: "droplet"
+		}), packageKeyOverride)).validated;
+	} catch (error) {
+		if (error instanceof WidgetToolingError) {
+			if (error.diagnostics) throw new WidgetValidationError(error.diagnostics);
+			throw new WidgetValidationError([{
+				code: "INVALID_SOURCE_PACKAGE",
+				path: sourceConfig.relativePath,
+				message: error.details ? `${error.message}\n${error.details}` : error.message
+			}]);
+		}
+		throw error;
+	}
 	return {
 		projectDir: resolvedProjectDir,
 		sourceConfigPath: sourceConfig.relativePath,
-		validated: validation.value
+		validated
 	};
 }
 async function withRootWidgetConfigBridge(projectDir, callback, packageKeyOverride) {
@@ -411,29 +418,6 @@ async function validateRootWidgetConfig(projectDir, packageKeyOverride) {
 		}];
 	}
 }
-function validateDropletMetadata(sourcePackages) {
-	if (sourcePackages.length !== 1) return [];
-	const sourcePackage = sourcePackages[0];
-	if (!isRecord$5(sourcePackage)) return [];
-	const errors = [];
-	if (sourcePackage["packageType"] !== "droplet") errors.push({
-		code: "UNSUPPORTED_OWNER",
-		path: "packageType",
-		message: "Droplet widget packages must set packageType: \"droplet\" in package metadata."
-	});
-	if (!isNonEmptyString(sourcePackage["packageStableId"])) errors.push({
-		code: "INVALID_PACKAGE_KEY",
-		path: "packageStableId",
-		message: "Droplet widget packages must set packageStableId so published widget types remain stable across builds."
-	});
-	const widgets = sourcePackage["widgets"];
-	if (Array.isArray(widgets)) widgets.forEach((widget, index) => {
-		if (!isRecord$5(widget)) return;
-		validateJsonSerializable(widget["propertySchema"], `widgets[${index}].propertySchema`, errors);
-		validateJsonSerializable(widget["defaultProps"], `widgets[${index}].defaultProps`, errors);
-	});
-	return errors;
-}
 function resolvePortalSourceConfig(projectDir) {
 	for (const relativePath of SOURCE_CONFIG_CANDIDATES) {
 		const candidate = path.join(projectDir, relativePath);
@@ -443,50 +427,6 @@ function resolvePortalSourceConfig(projectDir) {
 		};
 	}
 }
-function validateJsonSerializable(value, pathLabel, errors) {
-	if (value === void 0) return;
-	try {
-		assertJsonSerializable(value, pathLabel);
-	} catch (err) {
-		errors.push({
-			code: "INVALID_WIDGET_METADATA",
-			path: pathLabel,
-			message: err instanceof Error ? err.message : String(err)
-		});
-	}
-}
-function assertJsonSerializable(value, pathLabel) {
-	if (value === null) return;
-	const valueType = typeof value;
-	if (valueType === "string" || valueType === "boolean") return;
-	if (valueType === "number") {
-		if (Number.isFinite(value)) return;
-		throw new Error(`${pathLabel} must not contain NaN or Infinity.`);
-	}
-	if (Array.isArray(value)) {
-		value.forEach((item, index) => {
-			assertJsonSerializable(item, `${pathLabel}[${index}]`);
-		});
-		return;
-	}
-	if (isRecord$5(value)) {
-		for (const [key, item] of Object.entries(value)) {
-			if (item === void 0) throw new Error(`${pathLabel}.${key} must not be undefined.`);
-			assertJsonSerializable(item, `${pathLabel}.${key}`);
-		}
-		return;
-	}
-	throw new Error(`${pathLabel} must contain only JSON-serializable values.`);
-}
-function appendDetails(message, details) {
-	return details ? `${message}\n${details}` : message;
-}
-function isNonEmptyString(value) {
-	return typeof value === "string" && value.trim().length > 0;
-}
-function isRecord$5(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function isNodeError(error) {
 	return error instanceof Error && "code" in error;
 }
@@ -633,6 +573,138 @@ function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 //#endregion
+//#region src/utils/template.ts
+const EMBEDDED_PORTAL_SDK_VERSION = "0.1.463";
+const EMBEDDED_CLI_CORE_VERSION = "0.1.14";
+const EMBEDDED_CLI_WIDGET_VERSION = "0.1.29";
+function getDefaultTemplatePath() {
+	return path.join(findPackageRoot(), "templates", "default");
+}
+async function directoryExists(filePath) {
+	try {
+		return (await stat(filePath)).isDirectory();
+	} catch {
+		return false;
+	}
+}
+async function copyWidgetTemplate(templatePath, targetPath, variables) {
+	const files = await getFiles(templatePath);
+	for (const file of files) {
+		const sourcePath = path.join(templatePath, file);
+		const isTemplate = file.endsWith(".template");
+		const outputFiles = getOutputFilenames(file);
+		const content = await readFile(sourcePath, "utf-8");
+		await writeOutputFiles(targetPath, outputFiles, isTemplate ? renderTemplate(content, variables) : content);
+	}
+	for (const skillFile of await getSharedTemplateSkillFiles()) await writeOutputFiles(targetPath, getOutputFilenames(skillFile.relativePath), skillFile.content);
+}
+async function getPortalSdkVersion(options = {}) {
+	return getWorkspacePackageVersion(["portal", "sdk"], EMBEDDED_PORTAL_SDK_VERSION, options);
+}
+async function getPortalCoreVersion(options = {}) {
+	return getWorkspacePackageVersion(["portal", "core"], void 0, options);
+}
+async function getCliVersion(options = {}) {
+	return getWorkspacePackageVersion(["cli", "core"], EMBEDDED_CLI_CORE_VERSION, options);
+}
+async function getWidgetCliVersion(options = {}) {
+	return getWorkspacePackageVersion(["cli", "widget"], EMBEDDED_CLI_WIDGET_VERSION, options);
+}
+async function getWorkspacePackageVersion(packagePathSegments, embeddedVersion, options) {
+	try {
+		const packageRoot = findPackageRoot();
+		const packagesRoot = path.join(packageRoot, "..", "..");
+		const targetPackageRoot = path.join(packagesRoot, ...packagePathSegments);
+		if (options.local) return `link:${(options.targetPath ? path.relative(options.targetPath, targetPackageRoot) : targetPackageRoot).replace(/\\/g, "/") || "."}`;
+		if (embeddedVersion) return embeddedVersion;
+		const packageJsonPath = path.join(targetPackageRoot, "package.json");
+		const content = await readFile(packageJsonPath, "utf-8");
+		const pkg = JSON.parse(content);
+		if (typeof pkg.version !== "string") throw new Error(`Missing version in ${packageJsonPath}`);
+		return pkg.version;
+	} catch (error) {
+		if (embeddedVersion) return embeddedVersion;
+		throw new Error(`Could not resolve the exact template package version for ${packagePathSegments.join("/")}`, { cause: error });
+	}
+}
+async function getFiles(dir, baseDir = dir) {
+	const entries = await readdir(dir, { withFileTypes: true });
+	const files = [];
+	for (const entry of entries) {
+		const fullPath = path.join(dir, entry.name);
+		if (entry.isDirectory()) files.push(...await getFiles(fullPath, baseDir));
+		else files.push(path.relative(baseDir, fullPath));
+	}
+	return files;
+}
+async function getSharedTemplateSkillFiles() {
+	const packageRoot = findFluidCliPackageRoot();
+	const skillsRoot = path.join(packageRoot, "template-skills");
+	const files = await getFiles(skillsRoot);
+	return Promise.all(files.map(async (file) => ({
+		relativePath: path.join("skills", file),
+		content: await readFile(path.join(skillsRoot, file), "utf-8")
+	})));
+}
+function findFluidCliPackageRoot() {
+	const workspacePackageRoot = path.join(findPackageRoot(), "..", "core");
+	if (existsSync(path.join(workspacePackageRoot, "template-skills"))) return workspacePackageRoot;
+	let dir = path.dirname(fileURLToPath(import.meta.resolve("@fluid-app/fluid-cli")));
+	while (!existsSync(path.join(dir, "package.json"))) {
+		const parent = path.dirname(dir);
+		if (parent === dir) throw new Error("Could not find Fluid CLI package root");
+		dir = parent;
+	}
+	return dir;
+}
+function renderTemplate(content, variables) {
+	return content.replace(/{{\s*#if\s+([a-zA-Z0-9_]+)\s*}}([\s\S]*?){{\s*\/if\s*}}/g, (match, key, block) => {
+		if (!isTemplateVariableKey(key)) return match;
+		return variables[key] ? String(block) : "";
+	}).replace(/{{\s*([a-zA-Z0-9_]+)\s*}}/g, (match, key) => {
+		if (isTemplateVariableKey(key)) return variables[key] ?? "";
+		return match;
+	});
+}
+function isTemplateVariableKey(key) {
+	return [
+		"projectName",
+		"widgetScope",
+		"widgetPackageVersion",
+		"sdkVersion",
+		"localCoreVersion",
+		"fluidCliVersion",
+		"widgetCliVersion",
+		"droplet"
+	].includes(key);
+}
+async function writeOutputFiles(targetPath, outputFiles, content) {
+	for (const outputFile of outputFiles) {
+		const destinationPath = path.join(targetPath, outputFile);
+		await mkdir(path.dirname(destinationPath), { recursive: true });
+		await writeFile(destinationPath, content, "utf-8");
+	}
+}
+function getOutputFilenames(filename) {
+	const outputFilename = getOutputFilename(filename);
+	const normalized = outputFilename.replace(/\\/g, "/");
+	if (normalized === "AGENTS.md") return ["AGENTS.md", "CLAUDE.md"];
+	if (normalized.startsWith("skills/")) return [path.join(".agents", outputFilename), path.join(".claude", outputFilename)];
+	return [outputFilename];
+}
+function getOutputFilename(filename) {
+	return filename.endsWith(".template") ? filename.slice(0, -9) : filename;
+}
+function findPackageRoot() {
+	let dir = path.dirname(fileURLToPath(import.meta.url));
+	while (!existsSync(path.join(dir, "package.json"))) {
+		const parent = path.dirname(dir);
+		if (parent === dir) throw new Error("Could not find widget CLI package root");
+		dir = parent;
+	}
+	return dir;
+}
+//#endregion
 //#region src/commands/build.ts
 async function buildWidgetPackage(options) {
 	await validateDropletWidgetProject(options.projectDir);
@@ -640,20 +712,23 @@ async function buildWidgetPackage(options) {
 		projectDir: options.projectDir,
 		scriptName: "typecheck"
 	});
-	const outDir = validateWidgetPublishOutDir(options.projectDir, options.outDir);
-	const buildResult = await withRootWidgetConfigBridge(options.projectDir, () => buildSharedWidgetPackage({
-		projectDir: options.projectDir,
-		publishDir: outDir,
-		owner: "droplet"
-	}));
-	if (!buildResult.success) {
-		const details = buildResult.error.details ? `\n${buildResult.error.details}` : "";
-		throw new Error(`${buildResult.error.message}${details}`);
+	let buildResult;
+	try {
+		const cliVersion = await getWidgetCliVersion();
+		buildResult = await withRootWidgetConfigBridge(options.projectDir, () => buildWidgetPackage$1({
+			projectDir: options.projectDir,
+			outDir: options.outDir,
+			owner: "droplet",
+			cliVersion
+		}));
+	} catch (error) {
+		if (error instanceof WidgetToolingError && error.details) throw new Error(`${error.message}\n${error.details}`, { cause: error });
+		throw error;
 	}
 	return {
-		outDir: buildResult.value.publishDir,
-		packageId: buildResult.value.packageId,
-		version: buildResult.value.version
+		outDir: buildResult.publishDir,
+		packageId: buildResult.packageId,
+		version: buildResult.version
 	};
 }
 const buildCommand = new Command("build").description("Validate and build the current droplet widget package").option("-o, --out-dir <dir>", "Widget artifact output directory", DEFAULT_WIDGET_OUT_DIR).option("--skip-typecheck", "Skip package typecheck script when present").action((options) => {
@@ -675,6 +750,769 @@ const buildCommand = new Command("build").description("Validate and build the cu
 	});
 });
 //#endregion
+//#region ../../platform/api-client-core/src/api-error-shape.ts
+/**
+* Narrows a parsed JSON error payload to the envelope contract. Arrays and
+* primitives are not envelopes, so they resolve to `null` — their content is
+* still reachable through `ApiError.data`.
+*/
+function toApiErrorBody(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+	return value;
+}
+/**
+* The single unwrap rule, shared by every producer of `ApiError`.
+*
+* `??` rather than `||` so an explicitly empty `errors` (`""`, `0`, `false`)
+* is preserved instead of silently falling back to the whole envelope.
+*/
+function toApiErrorData(body) {
+	if (!body) return null;
+	return body.errors ?? body;
+}
+//#endregion
+//#region ../../platform/api-client-core/src/fetch-client.ts
+/**
+* API Error class compatible with fluid-admin's ApiError
+*/
+var ApiError = class ApiError extends Error {
+	status;
+	/**
+	* The unwrapped field-error bag. See `ApiErrorData`; the contract is
+	* documented in `docs/api-error-data-contract.md`.
+	*/
+	data;
+	/**
+	* The full error response envelope. Read `error_message`, `error`, `status`
+	* and nested `errors` from here — `data` has already unwrapped one level.
+	*/
+	body;
+	requestId;
+	constructor(message, status, data, requestId, body) {
+		super(message);
+		this.name = "ApiError";
+		this.status = status;
+		this.data = data ?? null;
+		this.body = body ?? null;
+		this.requestId = requestId;
+		if ("captureStackTrace" in Error) Error.captureStackTrace(this, ApiError);
+	}
+	toJSON() {
+		return {
+			name: this.name,
+			message: this.message,
+			status: this.status,
+			data: this.data,
+			body: this.body,
+			requestId: this.requestId
+		};
+	}
+};
+//#endregion
+//#region ../../platform/api-client-core/src/hey-api-error-policy.ts
+function getNonEmptyString(value) {
+	if (typeof value !== "string") return;
+	const trimmed = value.trim();
+	return trimmed.length > 0 ? trimmed : void 0;
+}
+function getRequestId(response, error) {
+	const meta = toApiErrorBody(error?.meta);
+	return getNonEmptyString(response.headers.get("x-request-id")) ?? getNonEmptyString(response.headers.get("request-id")) ?? getNonEmptyString(error?.request_id) ?? getNonEmptyString(error?.requestId) ?? getNonEmptyString(meta?.request_id) ?? getNonEmptyString(meta?.requestId);
+}
+function getErrorMessage(error, fallback) {
+	const nestedError = toApiErrorBody(error.error);
+	return getNonEmptyString(error.message) ?? getNonEmptyString(error.error_message) ?? getNonEmptyString(nestedError?.message) ?? fallback;
+}
+/**
+* Creates an error interceptor compatible with generated Hey API fetch clients.
+* Consumer-specific auth and cancellation policy is supplied through callbacks,
+* keeping this package independent from generated client types.
+*/
+function createHeyApiErrorInterceptor(options = {}) {
+	return (error, response, request, requestOptions) => {
+		if (!response) {
+			if (error instanceof ApiError) return error;
+			if (options.shouldPassThroughTransportError?.(error)) return error;
+			if (!request) return error;
+			return new ApiError(`Network error: ${error instanceof Error ? error.message : "Unknown network error"}`, 0, null);
+		}
+		if (response.ok && error instanceof SyntaxError) return new ApiError("Failed to parse response as JSON", response.status, null, getRequestId(response, null));
+		options.onResponseError?.(response);
+		const method = request?.method ?? requestOptions.method ?? "GET";
+		const errorRecord = toApiErrorBody(error);
+		const requestId = getRequestId(response, errorRecord);
+		if (errorRecord) return new ApiError(getErrorMessage(errorRecord, `${method} request failed`), response.status, toApiErrorData(errorRecord), requestId, errorRecord);
+		const isJson = response.headers.get("content-type")?.includes("application/json");
+		const text = getNonEmptyString(error);
+		return new ApiError(isJson && text ? text.slice(0, 200) : `${method} request failed with status ${response.status}`, response.status, isJson ? error : null, requestId, null);
+	};
+}
+//#endregion
+//#region ../../api-clients/hey-api-fetch-runtime/src/generated/core/bodySerializer.gen.ts
+const jsonBodySerializer = { bodySerializer: (body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value) };
+Object.entries({
+	$body_: "body",
+	$headers_: "headers",
+	$path_: "path",
+	$query_: "query"
+});
+//#endregion
+//#region ../../api-clients/hey-api-fetch-runtime/src/generated/core/serverSentEvents.gen.ts
+function createSseClient({ onRequest, onSseError, onSseEvent, responseTransformer, responseValidator, sseDefaultRetryDelay, sseMaxRetryAttempts, sseMaxRetryDelay, sseSleepFn, url, ...options }) {
+	let lastEventId;
+	const sleep = sseSleepFn ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+	const createStream = async function* () {
+		let retryDelay = sseDefaultRetryDelay ?? 3e3;
+		let attempt = 0;
+		const signal = options.signal ?? new AbortController().signal;
+		while (true) {
+			if (signal.aborted) break;
+			attempt++;
+			const headers = options.headers instanceof Headers ? options.headers : new Headers(options.headers);
+			if (lastEventId !== void 0) headers.set("Last-Event-ID", lastEventId);
+			try {
+				const requestInit = {
+					redirect: "follow",
+					...options,
+					body: options.serializedBody,
+					headers,
+					signal
+				};
+				let request = new Request(url, requestInit);
+				if (onRequest) request = await onRequest(url, requestInit);
+				const response = await (options.fetch ?? globalThis.fetch)(request);
+				if (!response.ok) throw new Error(`SSE failed: ${response.status} ${response.statusText}`);
+				if (!response.body) throw new Error("No body in SSE response");
+				const reader = response.body.pipeThrough(new TextDecoderStream()).getReader();
+				let buffer = "";
+				const abortHandler = () => {
+					try {
+						reader.cancel();
+					} catch {}
+				};
+				signal.addEventListener("abort", abortHandler);
+				try {
+					while (true) {
+						const { done, value } = await reader.read();
+						if (done) break;
+						buffer += value;
+						buffer = buffer.replace(/\r\n?/g, "\n");
+						const chunks = buffer.split("\n\n");
+						buffer = chunks.pop() ?? "";
+						for (const chunk of chunks) {
+							const lines = chunk.split("\n");
+							const dataLines = [];
+							let eventName;
+							for (const line of lines) if (line.startsWith("data:")) dataLines.push(line.replace(/^data:\s*/, ""));
+							else if (line.startsWith("event:")) eventName = line.replace(/^event:\s*/, "");
+							else if (line.startsWith("id:")) lastEventId = line.replace(/^id:\s*/, "");
+							else if (line.startsWith("retry:")) {
+								const parsed = Number.parseInt(line.replace(/^retry:\s*/, ""), 10);
+								if (!Number.isNaN(parsed)) retryDelay = parsed;
+							}
+							let data;
+							let parsedJson = false;
+							if (dataLines.length) {
+								const rawData = dataLines.join("\n");
+								try {
+									data = JSON.parse(rawData);
+									parsedJson = true;
+								} catch {
+									data = rawData;
+								}
+							}
+							if (parsedJson) {
+								if (responseValidator) await responseValidator(data);
+								if (responseTransformer) data = await responseTransformer(data);
+							}
+							onSseEvent?.({
+								data,
+								event: eventName,
+								id: lastEventId,
+								retry: retryDelay
+							});
+							if (dataLines.length) yield data;
+						}
+					}
+				} finally {
+					signal.removeEventListener("abort", abortHandler);
+					reader.releaseLock();
+				}
+				break;
+			} catch (error) {
+				onSseError?.(error);
+				if (sseMaxRetryAttempts !== void 0 && attempt >= sseMaxRetryAttempts) break;
+				await sleep(Math.min(retryDelay * 2 ** (attempt - 1), sseMaxRetryDelay ?? 3e4));
+			}
+		}
+	};
+	return { stream: createStream() };
+}
+//#endregion
+//#region ../../api-clients/hey-api-fetch-runtime/src/generated/core/pathSerializer.gen.ts
+const separatorArrayExplode = (style) => {
+	switch (style) {
+		case "label": return ".";
+		case "matrix": return ";";
+		case "simple": return ",";
+		default: return "&";
+	}
+};
+const separatorArrayNoExplode = (style) => {
+	switch (style) {
+		case "form": return ",";
+		case "pipeDelimited": return "|";
+		case "spaceDelimited": return "%20";
+		default: return ",";
+	}
+};
+const separatorObjectExplode = (style) => {
+	switch (style) {
+		case "label": return ".";
+		case "matrix": return ";";
+		case "simple": return ",";
+		default: return "&";
+	}
+};
+const serializeArrayParam = ({ allowReserved, explode, name, style, value }) => {
+	if (!explode) {
+		const joinedValues = (allowReserved ? value : value.map((v) => encodeURIComponent(v))).join(separatorArrayNoExplode(style));
+		switch (style) {
+			case "label": return `.${joinedValues}`;
+			case "matrix": return `;${name}=${joinedValues}`;
+			case "simple": return joinedValues;
+			default: return `${name}=${joinedValues}`;
+		}
+	}
+	const separator = separatorArrayExplode(style);
+	const joinedValues = value.map((v) => {
+		if (style === "label" || style === "simple") return allowReserved ? v : encodeURIComponent(v);
+		return serializePrimitiveParam({
+			allowReserved,
+			name,
+			value: v
+		});
+	}).join(separator);
+	return style === "label" || style === "matrix" ? separator + joinedValues : joinedValues;
+};
+const serializePrimitiveParam = ({ allowReserved, name, value }) => {
+	if (value === void 0 || value === null) return "";
+	if (typeof value === "object") throw new Error("Deeply-nested arrays/objects aren’t supported. Provide your own `querySerializer()` to handle these.");
+	return `${name}=${allowReserved ? value : encodeURIComponent(value)}`;
+};
+const serializeObjectParam = ({ allowReserved, explode, name, style, value, valueOnly }) => {
+	if (value instanceof Date) return valueOnly ? value.toISOString() : `${name}=${value.toISOString()}`;
+	if (style !== "deepObject" && !explode) {
+		let values = [];
+		Object.entries(value).forEach(([key, v]) => {
+			values = [
+				...values,
+				key,
+				allowReserved ? v : encodeURIComponent(v)
+			];
+		});
+		const joinedValues = values.join(",");
+		switch (style) {
+			case "form": return `${name}=${joinedValues}`;
+			case "label": return `.${joinedValues}`;
+			case "matrix": return `;${name}=${joinedValues}`;
+			default: return joinedValues;
+		}
+	}
+	const separator = separatorObjectExplode(style);
+	const joinedValues = Object.entries(value).map(([key, v]) => serializePrimitiveParam({
+		allowReserved,
+		name: style === "deepObject" ? `${name}[${key}]` : key,
+		value: v
+	})).join(separator);
+	return style === "label" || style === "matrix" ? separator + joinedValues : joinedValues;
+};
+//#endregion
+//#region ../../api-clients/hey-api-fetch-runtime/src/generated/core/utils.gen.ts
+const PATH_PARAM_RE = /\{[^{}]+\}/g;
+const defaultPathSerializer = ({ path, url: _url }) => {
+	let url = _url;
+	const matches = _url.match(PATH_PARAM_RE);
+	if (matches) for (const match of matches) {
+		let explode = false;
+		let name = match.substring(1, match.length - 1);
+		let style = "simple";
+		if (name.endsWith("*")) {
+			explode = true;
+			name = name.substring(0, name.length - 1);
+		}
+		if (name.startsWith(".")) {
+			name = name.substring(1);
+			style = "label";
+		} else if (name.startsWith(";")) {
+			name = name.substring(1);
+			style = "matrix";
+		}
+		const value = path[name];
+		if (value === void 0 || value === null) continue;
+		if (Array.isArray(value)) {
+			url = url.replace(match, serializeArrayParam({
+				explode,
+				name,
+				style,
+				value
+			}));
+			continue;
+		}
+		if (typeof value === "object") {
+			url = url.replace(match, serializeObjectParam({
+				explode,
+				name,
+				style,
+				value,
+				valueOnly: true
+			}));
+			continue;
+		}
+		if (style === "matrix") {
+			url = url.replace(match, `;${serializePrimitiveParam({
+				name,
+				value
+			})}`);
+			continue;
+		}
+		const replaceValue = encodeURIComponent(style === "label" ? `.${value}` : value);
+		url = url.replace(match, replaceValue);
+	}
+	return url;
+};
+const getUrl = ({ baseUrl, path, query, querySerializer, url: _url }) => {
+	const pathUrl = _url.startsWith("/") ? _url : `/${_url}`;
+	let url = (baseUrl ?? "") + pathUrl;
+	if (path) url = defaultPathSerializer({
+		path,
+		url
+	});
+	let search = query ? querySerializer(query) : "";
+	if (search.startsWith("?")) search = search.substring(1);
+	if (search) url += `?${search}`;
+	return url;
+};
+function getValidRequestBody(options) {
+	const hasBody = options.body !== void 0;
+	if (hasBody && options.bodySerializer) {
+		if ("serializedBody" in options) return options.serializedBody !== void 0 && options.serializedBody !== "" ? options.serializedBody : null;
+		return options.body !== "" ? options.body : null;
+	}
+	if (hasBody) return options.body;
+}
+//#endregion
+//#region ../../api-clients/hey-api-fetch-runtime/src/generated/core/auth.gen.ts
+const getAuthToken = async (auth, callback) => {
+	const token = typeof callback === "function" ? await callback(auth) : callback;
+	if (!token) return;
+	if (auth.scheme === "bearer") return `Bearer ${token}`;
+	if (auth.scheme === "basic") return `Basic ${btoa(token)}`;
+	return token;
+};
+//#endregion
+//#region ../../api-clients/hey-api-fetch-runtime/src/generated/client/utils.gen.ts
+const createQuerySerializer = ({ parameters = {}, ...args } = {}) => {
+	const querySerializer = (queryParams) => {
+		const search = [];
+		if (queryParams && typeof queryParams === "object") for (const name in queryParams) {
+			const value = queryParams[name];
+			if (value === void 0 || value === null) continue;
+			const options = parameters[name] || args;
+			if (Array.isArray(value)) {
+				const serializedArray = serializeArrayParam({
+					allowReserved: options.allowReserved,
+					explode: true,
+					name,
+					style: "form",
+					value,
+					...options.array
+				});
+				if (serializedArray) search.push(serializedArray);
+			} else if (typeof value === "object") {
+				const serializedObject = serializeObjectParam({
+					allowReserved: options.allowReserved,
+					explode: true,
+					name,
+					style: "deepObject",
+					value,
+					...options.object
+				});
+				if (serializedObject) search.push(serializedObject);
+			} else {
+				const serializedPrimitive = serializePrimitiveParam({
+					allowReserved: options.allowReserved,
+					name,
+					value
+				});
+				if (serializedPrimitive) search.push(serializedPrimitive);
+			}
+		}
+		return search.join("&");
+	};
+	return querySerializer;
+};
+/**
+* Infers parseAs value from provided Content-Type header.
+*/
+const getParseAs = (contentType) => {
+	if (!contentType) return "stream";
+	const cleanContent = contentType.split(";")[0]?.trim();
+	if (!cleanContent) return;
+	if (cleanContent.startsWith("application/json") || cleanContent.endsWith("+json")) return "json";
+	if (cleanContent === "multipart/form-data") return "formData";
+	if ([
+		"application/",
+		"audio/",
+		"image/",
+		"video/"
+	].some((type) => cleanContent.startsWith(type))) return "blob";
+	if (cleanContent.startsWith("text/")) return "text";
+};
+const checkForExistence = (options, name) => {
+	if (!name) return false;
+	if (options.headers.has(name) || options.query?.[name] || options.headers.get("Cookie")?.includes(`${name}=`)) return true;
+	return false;
+};
+async function setAuthParams(options) {
+	for (const auth of options.security ?? []) {
+		if (checkForExistence(options, auth.name)) continue;
+		const token = await getAuthToken(auth, options.auth);
+		if (!token) continue;
+		const name = auth.name ?? "Authorization";
+		switch (auth.in) {
+			case "query":
+				if (!options.query) options.query = {};
+				options.query[name] = token;
+				break;
+			case "cookie":
+				options.headers.append("Cookie", `${name}=${token}`);
+				break;
+			default:
+				options.headers.set(name, token);
+				break;
+		}
+	}
+}
+const buildUrl = (options) => getUrl({
+	baseUrl: options.baseUrl,
+	path: options.path,
+	query: options.query,
+	querySerializer: typeof options.querySerializer === "function" ? options.querySerializer : createQuerySerializer(options.querySerializer),
+	url: options.url
+});
+const mergeConfigs = (a, b) => {
+	const config = {
+		...a,
+		...b
+	};
+	if (config.baseUrl?.endsWith("/")) config.baseUrl = config.baseUrl.substring(0, config.baseUrl.length - 1);
+	config.headers = mergeHeaders(a.headers, b.headers);
+	return config;
+};
+const headersEntries = (headers) => {
+	const entries = [];
+	headers.forEach((value, key) => {
+		entries.push([key, value]);
+	});
+	return entries;
+};
+const mergeHeaders = (...headers) => {
+	const mergedHeaders = new Headers();
+	for (const header of headers) {
+		if (!header) continue;
+		const iterator = header instanceof Headers ? headersEntries(header) : Object.entries(header);
+		for (const [key, value] of iterator) if (value === null) mergedHeaders.delete(key);
+		else if (Array.isArray(value)) for (const v of value) mergedHeaders.append(key, v);
+		else if (value !== void 0) mergedHeaders.set(key, typeof value === "object" ? JSON.stringify(value) : value);
+	}
+	return mergedHeaders;
+};
+var Interceptors = class {
+	fns = [];
+	clear() {
+		this.fns = [];
+	}
+	eject(id) {
+		const index = this.getInterceptorIndex(id);
+		if (this.fns[index]) this.fns[index] = null;
+	}
+	exists(id) {
+		const index = this.getInterceptorIndex(id);
+		return Boolean(this.fns[index]);
+	}
+	getInterceptorIndex(id) {
+		if (typeof id === "number") return this.fns[id] ? id : -1;
+		return this.fns.indexOf(id);
+	}
+	update(id, fn) {
+		const index = this.getInterceptorIndex(id);
+		if (this.fns[index]) {
+			this.fns[index] = fn;
+			return id;
+		}
+		return false;
+	}
+	use(fn) {
+		this.fns.push(fn);
+		return this.fns.length - 1;
+	}
+};
+const createInterceptors = () => ({
+	error: new Interceptors(),
+	request: new Interceptors(),
+	response: new Interceptors()
+});
+const defaultQuerySerializer = createQuerySerializer({
+	allowReserved: false,
+	array: {
+		explode: true,
+		style: "form"
+	},
+	object: {
+		explode: true,
+		style: "deepObject"
+	}
+});
+const defaultHeaders = { "Content-Type": "application/json" };
+const createConfig = (override = {}) => ({
+	...jsonBodySerializer,
+	headers: defaultHeaders,
+	parseAs: "auto",
+	querySerializer: defaultQuerySerializer,
+	...override
+});
+//#endregion
+//#region ../../api-clients/hey-api-fetch-runtime/src/generated/client/client.gen.ts
+const createClient = (config = {}) => {
+	let _config = mergeConfigs(createConfig(), config);
+	const getConfig = () => ({ ..._config });
+	const setConfig = (config) => {
+		_config = mergeConfigs(_config, config);
+		return getConfig();
+	};
+	const interceptors = createInterceptors();
+	const beforeRequest = async (options) => {
+		const opts = {
+			..._config,
+			...options,
+			fetch: options.fetch ?? _config.fetch ?? globalThis.fetch,
+			headers: mergeHeaders(_config.headers, options.headers),
+			serializedBody: void 0
+		};
+		if (opts.security) await setAuthParams(opts);
+		if (opts.requestValidator) await opts.requestValidator(opts);
+		if (opts.body !== void 0 && opts.bodySerializer) opts.serializedBody = opts.bodySerializer(opts.body);
+		if (opts.body === void 0 || opts.serializedBody === "") opts.headers.delete("Content-Type");
+		const resolvedOpts = opts;
+		return {
+			opts: resolvedOpts,
+			url: buildUrl(resolvedOpts)
+		};
+	};
+	const request = async (options) => {
+		const throwOnError = options.throwOnError ?? _config.throwOnError;
+		const responseStyle = options.responseStyle ?? _config.responseStyle;
+		let request;
+		let response;
+		try {
+			const { opts, url } = await beforeRequest(options);
+			const requestInit = {
+				redirect: "follow",
+				...opts,
+				body: getValidRequestBody(opts)
+			};
+			request = new Request(url, requestInit);
+			for (const fn of interceptors.request.fns) if (fn) request = await fn(request, opts);
+			const _fetch = opts.fetch;
+			response = await _fetch(request);
+			for (const fn of interceptors.response.fns) if (fn) response = await fn(response, request, opts);
+			const result = {
+				request,
+				response
+			};
+			if (response.ok) {
+				const parseAs = (opts.parseAs === "auto" ? getParseAs(response.headers.get("Content-Type")) : opts.parseAs) ?? "json";
+				if (response.status === 204 || response.headers.get("Content-Length") === "0") {
+					let emptyData;
+					switch (parseAs) {
+						case "arrayBuffer":
+						case "blob":
+						case "text":
+							emptyData = await response[parseAs]();
+							break;
+						case "formData":
+							emptyData = new FormData();
+							break;
+						case "stream":
+							emptyData = response.body;
+							break;
+						default:
+							emptyData = {};
+							break;
+					}
+					return opts.responseStyle === "data" ? emptyData : {
+						data: emptyData,
+						...result
+					};
+				}
+				let data;
+				switch (parseAs) {
+					case "arrayBuffer":
+					case "blob":
+					case "formData":
+					case "text":
+						data = await response[parseAs]();
+						break;
+					case "json": {
+						const text = await response.text();
+						data = text ? JSON.parse(text) : {};
+						break;
+					}
+					case "stream": return opts.responseStyle === "data" ? response.body : {
+						data: response.body,
+						...result
+					};
+				}
+				if (parseAs === "json") {
+					if (opts.responseValidator) await opts.responseValidator(data);
+					if (opts.responseTransformer) data = await opts.responseTransformer(data);
+				}
+				return opts.responseStyle === "data" ? data : {
+					data,
+					...result
+				};
+			}
+			const textError = await response.text();
+			let jsonError;
+			try {
+				jsonError = JSON.parse(textError);
+			} catch {}
+			throw jsonError ?? textError;
+		} catch (error) {
+			let finalError = error;
+			for (const fn of interceptors.error.fns) if (fn) finalError = await fn(finalError, response, request, options);
+			finalError = finalError || {};
+			if (throwOnError) throw finalError;
+			return responseStyle === "data" ? void 0 : {
+				error: finalError,
+				request,
+				response
+			};
+		}
+	};
+	const makeMethodFn = (method) => (options) => request({
+		...options,
+		method
+	});
+	const makeSseFn = (method) => async (options) => {
+		const { opts, url } = await beforeRequest(options);
+		return createSseClient({
+			...opts,
+			body: opts.body,
+			method,
+			onRequest: async (url, init) => {
+				let request = new Request(url, init);
+				for (const fn of interceptors.request.fns) if (fn) request = await fn(request, opts);
+				return request;
+			},
+			serializedBody: getValidRequestBody(opts),
+			url
+		});
+	};
+	const _buildUrl = (options) => buildUrl({
+		..._config,
+		...options
+	});
+	return {
+		buildUrl: _buildUrl,
+		connect: makeMethodFn("CONNECT"),
+		delete: makeMethodFn("DELETE"),
+		get: makeMethodFn("GET"),
+		getConfig,
+		head: makeMethodFn("HEAD"),
+		interceptors,
+		options: makeMethodFn("OPTIONS"),
+		patch: makeMethodFn("PATCH"),
+		post: makeMethodFn("POST"),
+		put: makeMethodFn("PUT"),
+		request,
+		setConfig,
+		sse: {
+			connect: makeSseFn("CONNECT"),
+			delete: makeSseFn("DELETE"),
+			get: makeSseFn("GET"),
+			head: makeSseFn("HEAD"),
+			options: makeSseFn("OPTIONS"),
+			patch: makeSseFn("PATCH"),
+			post: makeSseFn("POST"),
+			put: makeSseFn("PUT"),
+			trace: makeSseFn("TRACE")
+		},
+		trace: makeMethodFn("TRACE")
+	};
+};
+//#endregion
+//#region ../../api-clients/fluidos/src/hey-api-client.ts
+function isAbortError(error) {
+	return error instanceof DOMException && error.name === "AbortError" || error instanceof Error && error.name === "AbortError";
+}
+function createFluidOsHeyApiClient(config) {
+	const client = createClient({
+		auth: async () => await config.getAuthToken?.() ?? void 0,
+		baseUrl: config.baseUrl,
+		fetch: config.fetch,
+		headers: {
+			Accept: "application/json",
+			...config.defaultHeaders
+		},
+		throwOnError: true
+	});
+	client.interceptors.error.use(createHeyApiErrorInterceptor({
+		onResponseError: (response) => {
+			if (response.status === 401) config.onAuthError?.();
+		},
+		shouldPassThroughTransportError: isAbortError
+	}));
+	return client;
+}
+//#endregion
+//#region src/utils/auth-client.ts
+function createAuthenticatedClient() {
+	return { client: createAuthenticatedWidgetPackageClient() };
+}
+function createAuthenticatedWidgetPackageClient() {
+	const { profile, profileName, token } = resolveAuthenticatedProfile();
+	if (!token) {
+		if (!profileName) throw new Error("Not logged in. Run " + chalk.cyan("fluid login") + " first.");
+		throw new Error("No auth token found for profile " + chalk.cyan(profileName) + ". Run " + chalk.cyan("fluid login") + " to re-authenticate.");
+	}
+	return createFluidOsHeyApiClient({
+		baseUrl: profile?.baseUrl ?? process.env["FLUID_API_BASE"] ?? "https://api.fluid.app",
+		getAuthToken: () => token
+	});
+}
+function resolveAuthenticatedProfile() {
+	const config = readConfig();
+	const projectConfig = findProjectConfig(process.cwd());
+	if (projectConfig?.profile) {
+		const profile = config.profiles[projectConfig.profile];
+		if (profile) return {
+			profile,
+			profileName: projectConfig.profile,
+			token: profile.token
+		};
+	}
+	if (!config.activeProfile) return {};
+	const profile = config.profiles[config.activeProfile];
+	if (!profile) return {};
+	return {
+		profile,
+		profileName: config.activeProfile,
+		token: profile.token
+	};
+}
+//#endregion
 //#region src/lib/git.ts
 /**
 * Git wrapper for the Fluid widget CLI — shells out to the system `git`
@@ -994,50 +1832,268 @@ async function gitAdoptFetchHead(cwd) {
 		throw wrapGitError(err, "adopt remote history");
 	}
 }
-/** Fast-forward `HEAD` to `FETCH_HEAD`. Fails if not fast-forwardable. */
-async function gitMergeFastForward(cwd) {
+/** Fast-forward `HEAD` to `FETCH_HEAD`. Fails if not fast-forwardable. */
+async function gitMergeFastForward(cwd) {
+	try {
+		await execa("git", [
+			"merge",
+			"--ff-only",
+			"FETCH_HEAD"
+		], { cwd });
+	} catch (err) {
+		throw wrapGitError(err, "fast-forward merge");
+	}
+}
+/** Are there uncommitted changes (working tree or index) in this repo? */
+async function hasUncommittedChanges(cwd) {
+	try {
+		const { stdout } = await execa("git", ["status", "--porcelain"], { cwd });
+		return stdout.trim().length > 0;
+	} catch {
+		return false;
+	}
+}
+/** Stash working-tree + untracked changes with a tagged message. */
+async function gitStash(cwd, message) {
+	try {
+		await execa("git", [
+			"stash",
+			"push",
+			"--include-untracked",
+			"--message",
+			message
+		], { cwd });
+	} catch (err) {
+		throw wrapGitError(err, "stash push");
+	}
+}
+/** Pop the most recent stash. Throws on conflict so callers can surface it. */
+async function gitStashPop(cwd) {
+	try {
+		await execa("git", ["stash", "pop"], { cwd });
+	} catch (err) {
+		const missing = gitMissingError(err);
+		if (missing) throw missing;
+		throw new GitError("Couldn't restore your local changes after pulling — the edits collided with a teammate's. Run `git stash list` and resolve manually.", err.exitCode ?? 1);
+	}
+}
+/**
+* Local-only state that must never reach a widget's provisioned repo.
+*
+* `.mist-desktop/` is Mist Desktop's per-machine working state for the
+* project directory it opened — chat transcripts, user attachments,
+* screenshots, source baselines, media cache. When Desktop drives
+* `fluid widget push`, that directory sits in the project root, so a
+* whole-tree `git add -A` publishes every private conversation.
+* `.mist` is the sibling clone/slug marker.
+*
+* Mirrors the portal CLI (`packages/cli/portal/src/lib/git.ts`) and the
+* Mist CLI (`packages/cli/mist/src/lib/git.ts`).
+*/
+const LOCAL_ONLY_GIT_PATHS = [".mist", ".mist-desktop/"];
+/**
+* Append {@link LOCAL_ONLY_GIT_PATHS} to `.git/info/exclude` when absent.
+*
+* Why the local exclude and not `.gitignore`: `.gitignore` ships from the
+* widget starter template, so editing it would never reach the clones
+* already on people's machines. `.git/info/exclude` is per-checkout, so
+* writing it on every sync heals a pre-existing clone on its next push.
+*
+* Idempotent and best-effort: never throws. {@link gitAutoCommit} also
+* cleans these paths out of the index after staging.
+*/
+function excludeLocalStateFromGit(cwd) {
+	try {
+		const gitDir = path.join(cwd, ".git");
+		if (!existsSync(gitDir)) return;
+		const infoDir = path.join(gitDir, "info");
+		if (!existsSync(infoDir)) mkdirSync(infoDir, { recursive: true });
+		const excludePath = path.join(infoDir, "exclude");
+		const existing = existsSync(excludePath) ? readFileSync(excludePath, "utf8") : "";
+		const existingLines = new Set(existing.split("\n").map((line) => line.trim()).filter(Boolean));
+		const missing = LOCAL_ONLY_GIT_PATHS.filter((entry) => !existingLines.has(entry));
+		if (missing.length === 0) return;
+		writeFileSync(excludePath, `${existing}${existing.length > 0 && !existing.endsWith("\n") ? "\n" : ""}${missing.join("\n")}\n`, "utf8");
+	} catch {}
+}
+/**
+* Absolute path of the repository containing `cwd`, or `cwd` when
+* resolution fails. Every local-state defense anchors here: `git add -A`
+* stages the WHOLE repository, so a push run from a subdirectory would
+* otherwise look for `<subdir>/.git`, skip the exclude, and sweep the
+* root `.mist-desktop/` in anyway.
+*/
+async function resolveRepoRoot(cwd) {
+	try {
+		const { stdout } = await execa("git", ["rev-parse", "--show-toplevel"], { cwd });
+		const root = stdout.trim();
+		if (root.length > 0) return root;
+	} catch {}
+	return cwd;
+}
+/**
+* Repository-root-anchored {@link excludeLocalStateFromGit}. Run before
+* any working-tree cleanliness check: while `.mist-desktop/` is neither
+* tracked nor excluded it shows as untracked in `git status --porcelain`,
+* so a Desktop-driven push needlessly stashes/pops around a pull.
+*/
+async function ensureLocalStateExcluded(cwd) {
+	excludeLocalStateFromGit(await resolveRepoRoot(cwd));
+}
+/** Paths currently tracked under `.mist-desktop/`, or [] when none. */
+async function trackedLocalStatePaths(repoRoot) {
 	try {
-		await execa("git", [
-			"merge",
-			"--ff-only",
-			"FETCH_HEAD"
-		], { cwd });
-	} catch (err) {
-		throw wrapGitError(err, "fast-forward merge");
+		const { stdout } = await execa("git", [
+			"ls-files",
+			"--",
+			".mist-desktop"
+		], { cwd: repoRoot });
+		return stdout.split("\n").filter((l) => l.trim().length > 0);
+	} catch {
+		return [];
 	}
 }
-/** Are there uncommitted changes (working tree or index) in this repo? */
-async function hasUncommittedChanges(cwd) {
+/**
+* Untrack private Mist Desktop state and, if anything was tracked,
+* commit ONLY that removal so the next push deletes it from the remote.
+* Returns true when a purge commit was made.
+*
+* Must run regardless of working-tree cleanliness AND of `--no-commit`:
+* an older CLI could have committed chats to a checkout that is now
+* clean, and gating on either would skip the cleanup forever, leaving
+* the chats published.
+*
+* The commit is built through a THROWAWAY index (`GIT_INDEX_FILE`), not
+* the user's: `read-tree HEAD` → `rm --cached` → `write-tree` →
+* `commit-tree` → `update-ref`. A plain `git commit` would capture the
+* user's entire index, so anything they had pre-staged would be swept
+* into the purge commit and pushed — the exact thing `--no-commit`
+* exists to prevent. A pathspec commit (`git commit -- .mist-desktop`)
+* is also wrong: with `--only` git takes the *working tree* content of
+* those paths, and the chats are still on disk, so it would re-add
+* exactly what we are removing.
+*
+* The user's real index then gets the same scoped `rm --cached`, so any
+* other staged work stays staged and the working tree is never touched.
+*/
+async function purgeLocalStateFromIndex(cwd, message, identity = DEFAULT_COMMIT_IDENTITY) {
+	const repoRoot = await resolveRepoRoot(cwd);
+	if ((await trackedLocalStatePaths(repoRoot)).length === 0) return false;
+	let head;
 	try {
-		const { stdout } = await execa("git", ["status", "--porcelain"], { cwd });
-		return stdout.trim().length > 0;
+		const { stdout } = await execa("git", ["rev-parse", "HEAD"], { cwd: repoRoot });
+		head = stdout.trim();
+		if (!head) return false;
 	} catch {
 		return false;
 	}
-}
-/** Stash working-tree + untracked changes with a tagged message. */
-async function gitStash(cwd, message) {
+	const tmpIndex = path.join(os.tmpdir(), `fluid-widget-purge-${process.pid}-${randomUUID()}.index`);
+	const indexEnv = {
+		...process.env,
+		GIT_INDEX_FILE: tmpIndex
+	};
+	let commitSha;
 	try {
+		await execa("git", ["read-tree", head], {
+			cwd: repoRoot,
+			env: indexEnv
+		});
 		await execa("git", [
-			"stash",
-			"push",
-			"--include-untracked",
-			"--message",
+			"rm",
+			"-q",
+			"-r",
+			"--cached",
+			"--ignore-unmatch",
+			"--",
+			".mist-desktop"
+		], {
+			cwd: repoRoot,
+			env: indexEnv
+		});
+		const { stdout: tree } = await execa("git", ["write-tree"], {
+			cwd: repoRoot,
+			env: indexEnv
+		});
+		const { stdout: sha } = await execa("git", [
+			"commit-tree",
+			tree.trim(),
+			"-p",
+			head,
+			"-m",
 			message
-		], { cwd });
+		], {
+			cwd: repoRoot,
+			env: {
+				...indexEnv,
+				...await identityEnv(repoRoot, identity)
+			}
+		});
+		commitSha = sha.trim();
+		if (!commitSha) return false;
 	} catch (err) {
-		throw wrapGitError(err, "stash push");
+		const missing = gitMissingError(err);
+		if (missing) throw missing;
+		throw wrapGitError(err, "purge local state");
+	} finally {
+		rmSync(tmpIndex, { force: true });
 	}
-}
-/** Pop the most recent stash. Throws on conflict so callers can surface it. */
-async function gitStashPop(cwd) {
 	try {
-		await execa("git", ["stash", "pop"], { cwd });
+		await execa("git", [
+			"update-ref",
+			"HEAD",
+			commitSha,
+			head
+		], { cwd: repoRoot });
 	} catch (err) {
-		const missing = gitMissingError(err);
-		if (missing) throw missing;
-		throw new GitError("Couldn't restore your local changes after pulling — the edits collided with a teammate's. Run `git stash list` and resolve manually.", err.exitCode ?? 1);
+		throw wrapGitError(err, "purge local state");
+	}
+	try {
+		await execa("git", [
+			"rm",
+			"-q",
+			"-r",
+			"--cached",
+			"--ignore-unmatch",
+			"--",
+			".mist-desktop"
+		], { cwd: repoRoot });
+	} catch {}
+	return true;
+}
+/** `GIT_{AUTHOR,COMMITTER}_*` overrides for `commit-tree`, which (unlike
+*  `git commit`) fails outright rather than prompting when the repo has
+*  no identity. Only set what the repo itself doesn't define. */
+async function identityEnv(cwd, identity) {
+	const env = {};
+	const has = async (key) => {
+		try {
+			return (await execa("git", ["config", key], { cwd })).stdout.trim().length > 0;
+		} catch {
+			return false;
+		}
+	};
+	if (!await has("user.name")) {
+		env["GIT_AUTHOR_NAME"] = identity.name;
+		env["GIT_COMMITTER_NAME"] = identity.name;
+	}
+	if (!await has("user.email")) {
+		env["GIT_AUTHOR_EMAIL"] = identity.email;
+		env["GIT_COMMITTER_EMAIL"] = identity.email;
 	}
+	return env;
+}
+/** Shared `-c user.*` args: prefer the repo's configured identity, else
+*  the supplied synthetic one so the commit isn't rejected. */
+async function resolveIdentityArgs(cwd, identity) {
+	let hasName = false;
+	let hasEmail = false;
+	try {
+		hasName = (await execa("git", ["config", "user.name"], { cwd })).stdout.trim().length > 0;
+	} catch {}
+	try {
+		hasEmail = (await execa("git", ["config", "user.email"], { cwd })).stdout.trim().length > 0;
+	} catch {}
+	return [...hasName ? [] : ["-c", `user.name=${identity.name}`], ...hasEmail ? [] : ["-c", `user.email=${identity.email}`]];
 }
 const DEFAULT_COMMIT_IDENTITY = {
 	name: "Fluid CLI",
@@ -1051,22 +2107,54 @@ const DEFAULT_COMMIT_IDENTITY = {
 * commit per push. If the repo has no configured user.name / user.email we
 * pass a synthetic identity so the commit isn't rejected. "nothing to commit"
 * is treated as a no-op rather than an error.
+*
+* Scope: `add -A` stages the whole work tree, bounded by the project
+* `.gitignore` — which can't cover tool-local state written INTO the
+* project by whatever opened it (Mist Desktop's `.mist-desktop/` chats and
+* the `.mist` marker). Belt and suspenders, all repo-root-anchored:
+*
+*   1. {@link excludeLocalStateFromGit} — idempotent `.git/info/exclude`
+*      write so `git add` never sees the paths. Heals old clones.
+*   2. `git reset -- ':(top).mist' .mist` — unstages the marker if step 1
+*      silently failed. We deliberately do NOT pass `:(exclude)` to
+*      `git add`: when the path is also in `.git/info/exclude`, git exits
+*      1 with "paths are ignored by one of your .gitignore files", which
+*      would turn the already-healed case into a hard failure.
+*   3. `git rm --cached -r --ignore-unmatch .mist-desktop` — untracks
+*      chats an older push already committed (ignore rules can't untrack).
+*      `--cached` keeps every file on disk.
+*
+* Steps 2 and 3 are best-effort and never fail the push.
 */
 async function gitAutoCommit(cwd, message, identity = DEFAULT_COMMIT_IDENTITY) {
+	const repoRoot = await resolveRepoRoot(cwd);
+	excludeLocalStateFromGit(repoRoot);
 	try {
 		await execa("git", ["add", "-A"], { cwd });
 	} catch (err) {
 		throw wrapGitError(err, "add");
 	}
-	let hasName = false;
-	let hasEmail = false;
 	try {
-		hasName = (await execa("git", ["config", "user.name"], { cwd })).stdout.trim().length > 0;
+		await execa("git", [
+			"reset",
+			"-q",
+			"--",
+			":(top).mist",
+			".mist"
+		], { cwd });
 	} catch {}
 	try {
-		hasEmail = (await execa("git", ["config", "user.email"], { cwd })).stdout.trim().length > 0;
+		await execa("git", [
+			"rm",
+			"-q",
+			"-r",
+			"--cached",
+			"--ignore-unmatch",
+			"--",
+			".mist-desktop"
+		], { cwd: repoRoot });
 	} catch {}
-	const identityArgs = [...hasName ? [] : ["-c", `user.name=${identity.name}`], ...hasEmail ? [] : ["-c", `user.email=${identity.email}`]];
+	const identityArgs = await resolveIdentityArgs(cwd, identity);
 	try {
 		await execa("git", [
 			...identityArgs,
@@ -1091,6 +2179,10 @@ async function gitAutoCommit(cwd, message, identity = DEFAULT_COMMIT_IDENTITY) {
 }
 //#endregion
 //#region src/utils/git-credential.ts
+function unwrapResponseData(response) {
+	if (response !== null && typeof response === "object" && "data" in response && !("git_credential" in response)) return response.data;
+	return response;
+}
 /**
 * Mint a git credential for a widget package.
 *
@@ -1103,8 +2195,13 @@ async function gitAutoCommit(cwd, message, identity = DEFAULT_COMMIT_IDENTITY) {
 * decide whether to degrade gracefully (see `isGitSyncUnavailable`).
 */
 async function mintWidgetGitCredential(options) {
-	const path = options.droplet ? `/api/droplets/${encodeURIComponent(options.droplet)}/widget_package/git_credential` : "/api/company/fluid_os/widget_package/git_credential";
-	const response = await options.client.post(path);
+	const response = unwrapResponseData(options.droplet ? await options.client.post({
+		responseStyle: "data",
+		url: `/api/droplets/${encodeURIComponent(options.droplet)}/widget_package/git_credential`
+	}) : await fluidOsV0WidgetPackageGitCredentialCreate({
+		client: options.client,
+		responseStyle: "data"
+	}));
 	const remoteUrl = response?.git_credential?.remote_url;
 	if (typeof remoteUrl !== "string" || remoteUrl.length === 0) throw new Error("The git credential response did not include a remote URL. Update the Fluid CLI, or contact support if this persists.");
 	const expiresAtRaw = response.git_credential?.expires_at;
@@ -1235,138 +2332,6 @@ const cloneCommand = new Command("clone").description("Clone a widget package's
 	console.log(chalk.dim(`  cd ${path.relative(process.cwd(), targetDir) || "."}`));
 	if (options.skipInstall === true) console.log(chalk.dim(`  ${installCommand}`));
 }));
-//#endregion
-//#region src/utils/template.ts
-const EMBEDDED_PORTAL_SDK_VERSION = "0.1.461";
-const EMBEDDED_CLI_CORE_VERSION = "0.1.14";
-const EMBEDDED_CLI_WIDGET_VERSION = "0.1.27";
-function getDefaultTemplatePath() {
-	return path.join(findPackageRoot(), "templates", "default");
-}
-async function directoryExists(filePath) {
-	try {
-		return (await stat(filePath)).isDirectory();
-	} catch {
-		return false;
-	}
-}
-async function copyWidgetTemplate(templatePath, targetPath, variables) {
-	const files = await getFiles(templatePath);
-	for (const file of files) {
-		const sourcePath = path.join(templatePath, file);
-		const isTemplate = file.endsWith(".template");
-		const outputFiles = getOutputFilenames(file);
-		const content = await readFile(sourcePath, "utf-8");
-		await writeOutputFiles(targetPath, outputFiles, isTemplate ? renderTemplate(content, variables) : content);
-	}
-	for (const skillFile of await getSharedTemplateSkillFiles()) await writeOutputFiles(targetPath, getOutputFilenames(skillFile.relativePath), skillFile.content);
-}
-async function getPortalSdkVersion(options = {}) {
-	return getWorkspacePackageVersion(["portal", "sdk"], EMBEDDED_PORTAL_SDK_VERSION, options);
-}
-async function getPortalCoreVersion(options = {}) {
-	return getWorkspacePackageVersion(["portal", "core"], void 0, options);
-}
-async function getCliVersion(options = {}) {
-	return getWorkspacePackageVersion(["cli", "core"], EMBEDDED_CLI_CORE_VERSION, options);
-}
-async function getWidgetCliVersion(options = {}) {
-	return getWorkspacePackageVersion(["cli", "widget"], EMBEDDED_CLI_WIDGET_VERSION, options);
-}
-async function getWorkspacePackageVersion(packagePathSegments, embeddedVersion, options) {
-	try {
-		const packageRoot = findPackageRoot();
-		const packagesRoot = path.join(packageRoot, "..", "..");
-		const targetPackageRoot = path.join(packagesRoot, ...packagePathSegments);
-		if (options.local) return `link:${(options.targetPath ? path.relative(options.targetPath, targetPackageRoot) : targetPackageRoot).replace(/\\/g, "/") || "."}`;
-		if (embeddedVersion) return embeddedVersion;
-		const packageJsonPath = path.join(targetPackageRoot, "package.json");
-		const content = await readFile(packageJsonPath, "utf-8");
-		const pkg = JSON.parse(content);
-		if (typeof pkg.version !== "string") throw new Error(`Missing version in ${packageJsonPath}`);
-		return pkg.version;
-	} catch (error) {
-		if (embeddedVersion) return embeddedVersion;
-		throw new Error(`Could not resolve the exact template package version for ${packagePathSegments.join("/")}`, { cause: error });
-	}
-}
-async function getFiles(dir, baseDir = dir) {
-	const entries = await readdir(dir, { withFileTypes: true });
-	const files = [];
-	for (const entry of entries) {
-		const fullPath = path.join(dir, entry.name);
-		if (entry.isDirectory()) files.push(...await getFiles(fullPath, baseDir));
-		else files.push(path.relative(baseDir, fullPath));
-	}
-	return files;
-}
-async function getSharedTemplateSkillFiles() {
-	const packageRoot = findFluidCliPackageRoot();
-	const skillsRoot = path.join(packageRoot, "template-skills");
-	const files = await getFiles(skillsRoot);
-	return Promise.all(files.map(async (file) => ({
-		relativePath: path.join("skills", file),
-		content: await readFile(path.join(skillsRoot, file), "utf-8")
-	})));
-}
-function findFluidCliPackageRoot() {
-	const workspacePackageRoot = path.join(findPackageRoot(), "..", "core");
-	if (existsSync(path.join(workspacePackageRoot, "template-skills"))) return workspacePackageRoot;
-	let dir = path.dirname(fileURLToPath(import.meta.resolve("@fluid-app/fluid-cli")));
-	while (!existsSync(path.join(dir, "package.json"))) {
-		const parent = path.dirname(dir);
-		if (parent === dir) throw new Error("Could not find Fluid CLI package root");
-		dir = parent;
-	}
-	return dir;
-}
-function renderTemplate(content, variables) {
-	return content.replace(/{{\s*#if\s+([a-zA-Z0-9_]+)\s*}}([\s\S]*?){{\s*\/if\s*}}/g, (match, key, block) => {
-		if (!isTemplateVariableKey(key)) return match;
-		return variables[key] ? String(block) : "";
-	}).replace(/{{\s*([a-zA-Z0-9_]+)\s*}}/g, (match, key) => {
-		if (isTemplateVariableKey(key)) return variables[key] ?? "";
-		return match;
-	});
-}
-function isTemplateVariableKey(key) {
-	return [
-		"projectName",
-		"widgetScope",
-		"widgetPackageVersion",
-		"sdkVersion",
-		"localCoreVersion",
-		"fluidCliVersion",
-		"widgetCliVersion",
-		"droplet"
-	].includes(key);
-}
-async function writeOutputFiles(targetPath, outputFiles, content) {
-	for (const outputFile of outputFiles) {
-		const destinationPath = path.join(targetPath, outputFile);
-		await mkdir(path.dirname(destinationPath), { recursive: true });
-		await writeFile(destinationPath, content, "utf-8");
-	}
-}
-function getOutputFilenames(filename) {
-	const outputFilename = getOutputFilename(filename);
-	const normalized = outputFilename.replace(/\\/g, "/");
-	if (normalized === "AGENTS.md") return ["AGENTS.md", "CLAUDE.md"];
-	if (normalized.startsWith("skills/")) return [path.join(".agents", outputFilename), path.join(".claude", outputFilename)];
-	return [outputFilename];
-}
-function getOutputFilename(filename) {
-	return filename.endsWith(".template") ? filename.slice(0, -9) : filename;
-}
-function findPackageRoot() {
-	let dir = path.dirname(fileURLToPath(import.meta.url));
-	while (!existsSync(path.join(dir, "package.json"))) {
-		const parent = path.dirname(dir);
-		if (parent === dir) throw new Error("Could not find widget CLI package root");
-		dir = parent;
-	}
-	return dir;
-}
 /**
 * The template repo to clone. Overridable via `FLUID_WIDGET_TEMPLATE_REPO`
 * (read at call time so tests can point at a local repo). Falls back to the
@@ -1697,11 +2662,6 @@ function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 //#endregion
-//#region src/utils/auth-client.ts
-function createAuthenticatedClient() {
-	return { client: createAuthenticatedWidgetPackageClient() };
-}
-//#endregion
 //#region src/utils/droplets.ts
 const MAX_DROPLET_PAGES = 100;
 async function promptForDroplet(client) {
@@ -1720,10 +2680,18 @@ async function promptForDroplet(client) {
 }
 async function listDroplets(client) {
 	try {
-		const firstResponse = await client.get("/api/droplets", { page: 1 });
+		const firstResponse = await client.get({
+			query: { page: 1 },
+			responseStyle: "data",
+			url: "/api/droplets"
+		});
 		const totalPages = Math.min(readTotalPages(firstResponse) ?? 1, MAX_DROPLET_PAGES);
 		const responses = [firstResponse];
-		for (let page = 2; page <= totalPages; page += 1) responses.push(await client.get("/api/droplets", { page }));
+		for (let page = 2; page <= totalPages; page += 1) responses.push(await client.get({
+			query: { page },
+			responseStyle: "data",
+			url: "/api/droplets"
+		}));
 		return responses.flatMap(normalizeDropletsResponse);
 	} catch (err) {
 		if (isApiLikeError(err)) {
@@ -1820,10 +2788,17 @@ const linkCommand = new Command("link").description("Link this widget project to
 //#endregion
 //#region src/utils/droplet-api.ts
 async function fetchDropletWidgetStatus(options) {
-	return extractArray(await options.client.get(`/api/droplets/${encodeURIComponent(options.droplet)}/widget_package_versions`)).map(normalizeVersionSummary);
+	return extractArray(await options.client.get({
+		responseStyle: "data",
+		url: `/api/droplets/${encodeURIComponent(options.droplet)}/widget_package_versions`
+	})).map(normalizeVersionSummary);
 }
 async function fetchDropletWidgetLogs(options) {
-	return extractArray(await options.client.get(`/api/droplets/${encodeURIComponent(options.droplet)}/widget_package_versions/logs`, options.limit ? { limit: options.limit } : void 0)).map(normalizeLogEntry);
+	return extractArray(await options.client.get({
+		query: options.limit ? { limit: options.limit } : void 0,
+		responseStyle: "data",
+		url: `/api/droplets/${encodeURIComponent(options.droplet)}/widget_package_versions/logs`
+	})).map(normalizeLogEntry);
 }
 function formatStatusRows(versions) {
 	if (versions.length === 0) return "No widget package versions found.";
@@ -1955,29 +2930,7 @@ function parseLimit(value) {
 }
 //#endregion
 //#region src/commands/publish.ts
-async function publishWidgetPackage(options, dependencies) {
-	if (dependencies) {
-		await dependencies.buildWidgetPackage({
-			projectDir: options.projectDir,
-			outDir: options.outDir
-		});
-		const dryRun = options.dryRun === true;
-		if (dryRun) return {
-			dryRun,
-			uploaded: false,
-			outDir: options.outDir
-		};
-		await dependencies.uploadWidgetPackage({
-			outDir: options.outDir,
-			droplet: options.droplet,
-			client: options.client
-		});
-		return {
-			dryRun,
-			uploaded: true,
-			outDir: options.outDir
-		};
-	}
+async function publishWidgetPackage(options) {
 	const droplet = await resolvePublishDroplet(options.projectDir, options.droplet);
 	await validateDropletWidgetProject(options.projectDir, droplet);
 	if (options.skipTypecheck !== true) await runPackageScriptIfAvailable({
@@ -1985,16 +2938,11 @@ async function publishWidgetPackage(options, dependencies) {
 		scriptName: "typecheck"
 	});
 	const dryRun = options.dryRun === true;
-	await withRootWidgetConfigBridge(options.projectDir, () => publishWidgetRuntimeArtifacts({
+	await withRootWidgetConfigBridge(options.projectDir, () => publishDropletWidgetPackageArtifacts({
 		projectDir: options.projectDir,
 		outDir: options.outDir,
-		buildOwner: "droplet",
-		uploadOwner: {
-			kind: "droplet",
-			uuid: droplet
-		},
-		dryRun,
-		...dryRun ? {} : { client: createAuthenticatedWidgetPackageClient() }
+		droplet,
+		dryRun
 	}), droplet);
 	return {
 		dryRun,
@@ -2029,16 +2977,11 @@ const publishCommand = new Command("publish").description("Publish a Fluid widge
 			else typecheckSpinner.info("No typecheck script found; skipping");
 		}
 		const publishSpinner = ora(dryRun ? "Building and preparing dry-run upload payload..." : "Building and publishing widget artifacts...").start();
-		const result = await withRootWidgetConfigBridge(projectDir, () => publishWidgetRuntimeArtifacts({
+		const result = await withRootWidgetConfigBridge(projectDir, () => publishDropletWidgetPackageArtifacts({
 			projectDir,
 			outDir,
-			buildOwner: "droplet",
-			uploadOwner: {
-				kind: "droplet",
-				uuid: droplet
-			},
-			dryRun,
-			...dryRun ? {} : { client: createAuthenticatedWidgetPackageClient() }
+			droplet,
+			dryRun
 		}), droplet);
 		publishSpinner.succeed(dryRun ? "Prepared dry-run upload payload" : "Published widget package");
 		if (dryRun) {
@@ -2064,6 +3007,47 @@ async function resolvePublishDroplet(projectDir, override) {
 	}
 	throw new Error("Missing droplet UUID. Pass --droplet <uuid> or set droplet in fluid.widget.config.ts.");
 }
+async function publishDropletWidgetPackageArtifacts(options) {
+	const common = {
+		projectDir: options.projectDir,
+		outDir: options.outDir,
+		owner: "droplet",
+		uploadOwner: {
+			kind: "droplet",
+			uuid: options.droplet
+		},
+		cliVersion: await getWidgetCliVersion()
+	};
+	if (options.dryRun) return publishWidgetPackage$1({
+		...common,
+		dryRun: true
+	});
+	return publishWidgetPackage$1({
+		...common,
+		dryRun: false,
+		client: createAuthenticatedWidgetPackageClient()
+	});
+}
+function printRuntimeOnlyNotice() {
+	console.log(chalk.yellow("This publishes widget runtime artifacts only; it does not deploy the hosted portal shell."));
+	console.log();
+}
+function printDryRunSessionPayload(result) {
+	console.log(chalk.bold("Dry-run upload session payload:"));
+	console.log(JSON.stringify(result.publish.sessionPayload, null, 2));
+	console.log();
+}
+function printWidgetPublishSummary(options) {
+	console.log();
+	console.log(chalk.green.bold(`${options.title} complete`));
+	console.log();
+	console.log(chalk.gray("Owner:       ") + chalk.white(options.ownerLabel));
+	console.log(chalk.gray("Package:     ") + chalk.white(options.result.build.packageId));
+	console.log(chalk.gray("Version:     ") + chalk.white(options.result.build.version));
+	console.log(chalk.gray("Output:      ") + chalk.cyan(options.outDir));
+	console.log(chalk.gray("Artifacts:   ") + chalk.white(String(options.result.request.artifacts.length)));
+	console.log();
+}
 //#endregion
 //#region src/utils/me.ts
 function str(value) {
@@ -2071,7 +3055,10 @@ function str(value) {
 	return null;
 }
 async function fetchCurrentUser(client) {
-	const raw = await client.get("/api/me");
+	const raw = await client.get({
+		responseStyle: "data",
+		url: "/api/me"
+	});
 	const composed = [str(raw.first_name), str(raw.last_name)].filter((part) => part !== null).join(" ").trim();
 	const idValue = str(raw.public_id) ?? (typeof raw.id === "number" && Number.isFinite(raw.id) ? String(raw.id) : null);
 	return {
@@ -2095,6 +3082,7 @@ async function syncWidgetGitRepo(options) {
 	const { cwd, client } = options;
 	const branch = options.branch ?? "main";
 	if (!await isGitRepository(cwd)) await gitInit(cwd, branch);
+	await ensureLocalStateExcluded(cwd);
 	const cred = await mintWidgetGitCredential({
 		client,
 		droplet: options.droplet
@@ -2121,6 +3109,7 @@ async function syncWidgetGitRepo(options) {
 			}
 		} else pulled = await gitAdoptFetchHead(cwd);
 	}
+	await purgeLocalStateFromIndex(cwd, "Remove private Mist Desktop state from the widget repository", await resolveCommitIdentity(client));
 	let committed = false;
 	if (options.commit !== false && await hasUncommittedChanges(cwd)) {
 		await gitAutoCommit(cwd, await buildCommitMessage(client, options.message), await resolveCommitIdentity(client));