@fluid-app/fluid-cli-widget 0.1.27 → 0.1.29

package/dist/src-_wfDoBLp.mjs

@@ -0,0 +1,1997 @@
+import { createRequire } from "node:module";
+import fs from "fs-extra";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { execa } from "execa";
+import { pathToFileURL } from "node:url";
+import { failure, success } from "@fluid-app/fluid-cli";
+//#region ../widget-tooling/src/errors.ts
+var WidgetToolingError = class extends Error {
+	code;
+	details;
+	diagnostics;
+	constructor(code, message, options = {}) {
+		super(message, options);
+		this.name = "WidgetToolingError";
+		this.code = code;
+		this.details = options.details;
+		this.diagnostics = options.diagnostics;
+	}
+};
+const CONTENT_TYPES = {
+	".css": "text/css",
+	".js": "application/javascript",
+	".json": "application/json",
+	".map": "application/json"
+};
+const CSS_ARTIFACT_PATH_PATTERN = /^[A-Za-z0-9._~-]+\.css$/;
+const JS_MAP_ARTIFACT_PATH_PATTERN = /^[A-Za-z0-9._~-]+\.js\.map$/;
+async function computeArtifactMetadata(filePath, baseDir) {
+	const relativePath = toPosixPath$1(path.relative(baseDir, filePath));
+	assertAllowedArtifactPath(relativePath);
+	await assertRegularArtifactFile(filePath, relativePath);
+	const buffer = await fs.readFile(filePath);
+	return {
+		path: relativePath,
+		sha256: sha256(buffer),
+		bytes: buffer.byteLength,
+		contentType: getArtifactContentType(filePath)
+	};
+}
+async function collectWidgetPackageArtifacts(publishDir) {
+	const artifactPaths = await findArtifactPaths(publishDir);
+	const artifacts = await Promise.all(artifactPaths.map((artifactPath) => computeArtifactMetadata(artifactPath, publishDir)));
+	assertRequiredUploadArtifacts(artifacts);
+	return artifacts.sort((a, b) => a.path.localeCompare(b.path));
+}
+function createPublishManifestMetadata(options) {
+	return {
+		packageId: options.packageId,
+		version: options.version,
+		builderVersion: options.builderVersion ?? "0.1.0",
+		cliVersion: options.cliVersion,
+		runtimeVersion: options.runtimeVersion,
+		manifestHash: sha256(options.manifestContent),
+		artifacts: options.artifacts
+	};
+}
+function getArtifactContentType(filePath) {
+	if (path.basename(filePath).endsWith(".js.map")) return "application/json";
+	return CONTENT_TYPES[path.extname(filePath)] ?? "application/octet-stream";
+}
+function sha256(content) {
+	return createHash("sha256").update(content).digest("hex");
+}
+function isWidgetPackageCssArtifactPath(relativePath) {
+	return CSS_ARTIFACT_PATH_PATTERN.test(relativePath);
+}
+function isWidgetPackageJsMapArtifactPath(relativePath) {
+	return JS_MAP_ARTIFACT_PATH_PATTERN.test(relativePath);
+}
+async function assertRegularArtifactFile(filePath, relativePath) {
+	const stat = await fs.lstat(filePath);
+	if (stat.isSymbolicLink()) throw new Error(`Widget publish artifact ${JSON.stringify(relativePath)} must be a regular file and must not be a symbolic link.`);
+	if (!stat.isFile()) throw new Error(`Widget publish artifact ${JSON.stringify(relativePath)} must be a regular file.`);
+}
+async function findArtifactPaths(dir, baseDir = dir) {
+	if (!await fs.pathExists(dir)) return [];
+	const entries = await fs.readdir(dir, { withFileTypes: true });
+	return (await Promise.all(entries.map(async (entry) => {
+		const entryPath = path.join(dir, entry.name);
+		const relativePath = toPosixPath$1(path.relative(baseDir, entryPath));
+		if (entry.isSymbolicLink()) throw new Error(`Widget publish artifact ${JSON.stringify(relativePath)} must be a regular file and must not be a symbolic link.`);
+		if (isUploadArtifact(relativePath)) {
+			if (!entry.isFile()) throw new Error(`Widget publish artifact ${JSON.stringify(relativePath)} must be a regular file.`);
+			return [entryPath];
+		}
+		if (entry.isDirectory()) {
+			const nestedPaths = await findArtifactPaths(entryPath, baseDir);
+			if (nestedPaths.length === 0) throwUnsupportedArtifactPath(`${relativePath}/`);
+			return nestedPaths;
+		}
+		if (isAllowedGeneratedFile(relativePath)) return [];
+		throwUnsupportedArtifactPath(relativePath);
+	}))).flat();
+}
+function assertRequiredUploadArtifacts(artifacts) {
+	const artifactPaths = new Set(artifacts.map((artifact) => artifact.path));
+	for (const requiredPath of ["widget.js", "manifest.json"]) {
+		if (artifactPaths.has(requiredPath)) continue;
+		throw new Error(`Widget package publish output must include regular file ${JSON.stringify(requiredPath)}.`);
+	}
+}
+function assertAllowedArtifactPath(relativePath) {
+	if (isUploadArtifact(relativePath) || isAllowedGeneratedFile(relativePath)) return;
+	throwUnsupportedArtifactPath(relativePath);
+}
+function isUploadArtifact(relativePath) {
+	return relativePath === "widget.js" || relativePath === "manifest.json" || isWidgetPackageCssArtifactPath(relativePath) || isWidgetPackageJsMapArtifactPath(relativePath);
+}
+function isAllowedGeneratedFile(relativePath) {
+	return isFlatArtifactPath(relativePath) && relativePath === "publish-manifest.json";
+}
+function isFlatArtifactPath(relativePath) {
+	return relativePath.length > 0 && !relativePath.includes("/") && !relativePath.includes("\\");
+}
+function throwUnsupportedArtifactPath(relativePath) {
+	throw new Error(`Unsupported widget publish artifact ${JSON.stringify(relativePath)}. Allowed files are widget.js, manifest.json, top-level [A-Za-z0-9._~-]+.css, top-level [A-Za-z0-9._~-]+.js.map, and publish-manifest.json.`);
+}
+function toPosixPath$1(value) {
+	return value.split(path.sep).join("/");
+}
+//#endregion
+//#region ../../portal/core/src/remote-dom-widget-package.ts
+const UNSAFE_JSON_KEYS = new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+function isJsonValue(value) {
+	return isJsonValueAtDepth(value, /* @__PURE__ */ new WeakSet(), 0);
+}
+function isJsonValueAtDepth(value, ancestors, depth) {
+	if (value === null || typeof value === "string" || typeof value === "boolean") return true;
+	if (typeof value === "number") return Number.isFinite(value);
+	if (typeof value !== "object" || depth > 50 || ancestors.has(value)) return false;
+	ancestors.add(value);
+	const prototype = Object.getPrototypeOf(value);
+	const isJson = Array.isArray(value) ? value.every((item) => isJsonValueAtDepth(item, ancestors, depth + 1)) : (prototype === Object.prototype || prototype === null) && isRecord$5(value) && Object.entries(value).every(([key, item]) => !UNSAFE_JSON_KEYS.has(key) && isJsonValueAtDepth(item, ancestors, depth + 1));
+	ancestors.delete(value);
+	return isJson;
+}
+function isRecord$5(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region ../widget-tooling/src/internal/widget-package-validation.ts
+const URL_SAFE_SEGMENT_SOURCE = "[A-Za-z0-9][A-Za-z0-9_~-]*";
+const URL_SAFE_WIDGET_NAME_PATTERN = new RegExp(`^${URL_SAFE_SEGMENT_SOURCE}$`);
+const URL_SAFE_DOTTED_IDENTIFIER_PATTERN = new RegExp(`^${URL_SAFE_SEGMENT_SOURCE}(?:\\.${URL_SAFE_SEGMENT_SOURCE})*$`);
+const SEMVER_CORE_PATTERN = "(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)";
+const SEMVER_PRERELEASE_IDENTIFIER_PATTERN = "(?:0|[1-9]\\d*|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*)";
+const SEMVER_URL_SAFE_PATTERN = new RegExp(`^${SEMVER_CORE_PATTERN}(?:-${SEMVER_PRERELEASE_IDENTIFIER_PATTERN}(?:\\.${SEMVER_PRERELEASE_IDENTIFIER_PATTERN})*)?$`);
+const WIDGET_PACKAGE_MANIFEST_VERSION = 1;
+const DEFAULT_WIDGET_ICON = "box";
+const DEFAULT_WIDGET_CATEGORY = "components";
+const DEFAULT_WIDGET_CONTAINER = "block";
+const DEFAULT_MIN_SDK_VERSION = "0.0.0";
+function validateSingleSourceWidgetPackage(sourcePackages, options = {}) {
+	if (sourcePackages.length === 0) return validationFailure({
+		code: "NO_SOURCE_PACKAGE",
+		message: "No defineWidgetPackage source package was found. Export widgetPackage, widgetPackages, or a default widget package from src/widgets.config.ts."
+	});
+	if (sourcePackages.length > 1) return validationFailure({
+		code: "MULTIPLE_SOURCE_PACKAGES",
+		message: "Publish/deploy supports exactly one defineWidgetPackage source package. Export one package or split packages into separate builds."
+	});
+	const sourcePackageValue = sourcePackages[0];
+	if (!sourcePackageValue) return validationFailure({
+		code: "NO_SOURCE_PACKAGE",
+		message: "No defineWidgetPackage source package was found."
+	});
+	const shapeErrors = validateSourcePackageShape(sourcePackageValue);
+	if (shapeErrors.length > 0) return {
+		success: false,
+		errors: shapeErrors
+	};
+	const sourcePackage = sourcePackageValue;
+	const errors = [];
+	const owner = options.owner ?? sourcePackage.packageType;
+	if (owner !== "company" && owner !== "droplet") errors.push({
+		code: "UNSUPPORTED_OWNER",
+		path: "packageType",
+		message: "Widget package publish/deploy currently supports company and droplet owners. Set packageType to \"company\" or \"droplet\"."
+	});
+	else if (options.owner !== void 0 && sourcePackage.packageType !== options.owner) errors.push({
+		code: "UNSUPPORTED_OWNER",
+		path: "packageType",
+		message: `Widget package metadata must set packageType to "${options.owner}" for this workflow.`
+	});
+	const resolvedOwner = owner === "droplet" ? "droplet" : "company";
+	if (resolvedOwner === "droplet" && !readNonEmptyTrimmedString(sourcePackage.packageStableId)) errors.push({
+		code: "INVALID_PACKAGE_KEY",
+		path: "packageStableId",
+		message: "Droplet widget packages must set packageStableId so published widget types remain stable across builds."
+	});
+	const packageKey = resolvePackageKey(sourcePackage, resolvedOwner);
+	const packageKeyPath = readNonEmptyTrimmedString(sourcePackage.packageStableId) ? "packageStableId" : "packageId";
+	if (!isUrlSafeDottedIdentifier(packageKey)) errors.push({
+		code: "INVALID_PACKAGE_KEY",
+		path: packageKeyPath,
+		message: "Widget package key must be URL-safe dot-separated text (letters, numbers, '.', '_', '~', and '-' only)."
+	});
+	if (!isUrlSafeSemver(sourcePackage.version)) errors.push({
+		code: "INVALID_VERSION",
+		path: "version",
+		message: "Widget package version must be a URL-safe SemVer version without build metadata (for example 1.2.3 or 1.2.3-beta.1)."
+	});
+	if (sourcePackage.widgets.length === 0) errors.push({
+		code: "NO_WIDGETS",
+		path: "widgets",
+		message: "Widget package must include at least one widget."
+	});
+	const packageId = `${resolvedOwner}.${packageKey}`;
+	const seenNames = /* @__PURE__ */ new Set();
+	const seenTypes = /* @__PURE__ */ new Set();
+	const widgets = [];
+	sourcePackage.widgets.forEach((widget, index) => {
+		const path = `widgets[${index}]`;
+		if (!isUrlSafeWidgetName(widget.name)) {
+			errors.push({
+				code: "INVALID_WIDGET_NAME",
+				path: `${path}.name`,
+				message: "Widget name must be URL-safe text (letters, numbers, '_', '~', and '-' only) and cannot be empty."
+			});
+			return;
+		}
+		if (seenNames.has(widget.name)) {
+			errors.push({
+				code: "DUPLICATE_WIDGET",
+				path: `${path}.name`,
+				message: `Duplicate widget name "${widget.name}" found in package ${packageKey}.`
+			});
+			return;
+		}
+		seenNames.add(widget.name);
+		const type = `${packageId}.${widget.name}`;
+		if (!isUrlSafeDottedIdentifier(type)) {
+			errors.push({
+				code: "INVALID_WIDGET_TYPE",
+				path: `${path}.type`,
+				message: `Generated widget type "${type}" is not URL-safe.`
+			});
+			return;
+		}
+		if (seenTypes.has(type)) {
+			errors.push({
+				code: "DUPLICATE_WIDGET",
+				path: `${path}.type`,
+				message: `Duplicate generated widget type "${type}" found.`
+			});
+			return;
+		}
+		seenTypes.add(type);
+		widgets.push(sourceWidgetToDescriptor(widget, type));
+	});
+	if (errors.length > 0) return {
+		success: false,
+		errors
+	};
+	return {
+		success: true,
+		value: {
+			sourcePackage,
+			packageKey,
+			packageId,
+			owner: resolvedOwner,
+			version: sourcePackage.version,
+			widgets
+		},
+		errors: []
+	};
+}
+function buildWidgetPackagePublishManifest(validated, options = {}) {
+	return {
+		manifestVersion: WIDGET_PACKAGE_MANIFEST_VERSION,
+		runtime: "remote-dom",
+		packageId: validated.packageId,
+		source: validated.owner,
+		version: validated.version,
+		workerEntryUrl: toWidgetPackageArtifactPath("widget.js"),
+		cssUrls: mergeCssUrls(validated.sourcePackage.cssUrls, options.cssUrls),
+		assetUrls: [],
+		widgets: validated.widgets.map(({ name: _name, ...widget }) => widget)
+	};
+}
+function sourceWidgetToDescriptor(widget, type) {
+	const displayName = widget.displayName ?? widget.name;
+	return {
+		type,
+		name: widget.name,
+		displayName,
+		description: widget.description ?? `Custom widget ${displayName}`,
+		icon: widget.icon ?? DEFAULT_WIDGET_ICON,
+		category: widget.category ?? DEFAULT_WIDGET_CATEGORY,
+		propertySchema: normalizePropertySchema(widget.propertySchema, type),
+		defaultProps: widget.defaultProps ?? {},
+		container: normalizeContainer(widget.container),
+		minSdkVersion: widget.minSdkVersion ?? DEFAULT_MIN_SDK_VERSION,
+		resizable: normalizeResizable(widget.resizable),
+		capabilities: normalizeCapabilities(widget.capabilities ?? [])
+	};
+}
+function normalizeCapabilities(capabilities) {
+	return capabilities.map((capability) => ({
+		name: capability.name,
+		version: capability.version ?? "1"
+	}));
+}
+function validationFailure(error) {
+	return {
+		success: false,
+		errors: [error]
+	};
+}
+function validateSourcePackageShape(value) {
+	if (!isRecord$4(value)) return [{
+		code: "INVALID_SOURCE_PACKAGE",
+		message: "Widget source package must be a JSON object."
+	}];
+	const errors = [];
+	requireStringField(value, "packageId", "packageId", errors);
+	requireStringField(value, "version", "version", errors);
+	validateOptionalStringField(value, "scope", "scope", errors);
+	validateOptionalStringField(value, "packageStableId", "packageStableId", errors);
+	validateOptionalStringField(value, "packageType", "packageType", errors);
+	if (Object.prototype.hasOwnProperty.call(value, "navigationOrigins")) errors.push({
+		code: "INVALID_SOURCE_PACKAGE",
+		path: "navigationOrigins",
+		message: "navigationOrigins has been removed. Declare the externalNavigation capability and call allowAnchorUrl(url) for each external link."
+	});
+	if (value.cssUrls !== void 0) if (!Array.isArray(value.cssUrls)) errors.push({
+		code: "INVALID_SOURCE_PACKAGE",
+		path: "cssUrls",
+		message: "Widget package cssUrls must be an array of strings when present."
+	});
+	else value.cssUrls.forEach((cssUrl, index) => {
+		validateCssUrl(cssUrl, `cssUrls[${index}]`, errors);
+	});
+	if (!Array.isArray(value.widgets)) {
+		errors.push({
+			code: "INVALID_SOURCE_PACKAGE",
+			path: "widgets",
+			message: "Widget package widgets must be an array."
+		});
+		return errors;
+	}
+	value.widgets.forEach((widget, index) => {
+		const widgetPath = `widgets[${index}]`;
+		if (!isRecord$4(widget)) {
+			errors.push({
+				code: "INVALID_WIDGET_METADATA",
+				path: widgetPath,
+				message: "Widget metadata must be a JSON object."
+			});
+			return;
+		}
+		requireStringField(widget, "name", `${widgetPath}.name`, errors, {
+			code: "INVALID_WIDGET_NAME",
+			message: "Widget name must be a string and cannot be empty."
+		});
+		validateOptionalStringField(widget, "displayName", `${widgetPath}.displayName`, errors, { requireNonEmpty: true });
+		validateOptionalStringField(widget, "description", `${widgetPath}.description`, errors, { requireNonEmpty: true });
+		validateOptionalStringField(widget, "icon", `${widgetPath}.icon`, errors, { requireNonEmpty: true });
+		validateOptionalStringField(widget, "category", `${widgetPath}.category`, errors, { requireNonEmpty: true });
+		validateOptionalStringField(widget, "minSdkVersion", `${widgetPath}.minSdkVersion`, errors, { requireNonEmpty: true });
+		validateOptionalJsonRecordField(widget, "propertySchema", `${widgetPath}.propertySchema`, errors);
+		validateOptionalJsonRecordField(widget, "defaultProps", `${widgetPath}.defaultProps`, errors);
+		validateOptionalCapabilities(widget, "capabilities", `${widgetPath}.capabilities`, errors);
+	});
+	return errors;
+}
+function requireStringField(record, key, path, errors, override) {
+	const value = record[key];
+	if (typeof value === "string" && value.trim().length > 0) return;
+	errors.push({
+		code: override?.code ?? "INVALID_SOURCE_PACKAGE",
+		path,
+		message: override?.message ?? `${path} must be a string and cannot be empty.`
+	});
+}
+function validateOptionalStringField(record, key, path, errors, options = {}) {
+	const value = record[key];
+	if (value === void 0) return;
+	if (typeof value === "string") {
+		if (!options.requireNonEmpty || value.trim().length > 0) return;
+		errors.push({
+			code: "INVALID_SOURCE_PACKAGE",
+			path,
+			message: `${path} must be a non-empty string when present.`
+		});
+		return;
+	}
+	errors.push({
+		code: "INVALID_SOURCE_PACKAGE",
+		path,
+		message: `${path} must be a string when present.`
+	});
+}
+function validateCssUrl(value, cssUrlPath, errors) {
+	if (typeof value !== "string" || value.trim().length === 0) {
+		errors.push({
+			code: "INVALID_SOURCE_PACKAGE",
+			path: cssUrlPath,
+			message: "Widget package cssUrls entries must be non-empty strings."
+		});
+		return;
+	}
+	if (!isWidgetPackageCssArtifactPath(value)) errors.push({
+		code: "INVALID_SOURCE_PACKAGE",
+		path: cssUrlPath,
+		message: "Widget package cssUrls entries must be top-level generated CSS artifact filenames matching [A-Za-z0-9._~-]+.css. Self-host external CSS or fonts via @font-face in widget CSS so the build can isolate them."
+	});
+}
+function validateOptionalJsonRecordField(record, key, path, errors) {
+	const value = record[key];
+	if (value === void 0) return;
+	if (isRecord$4(value) && isJsonValue(value)) return;
+	errors.push({
+		code: "INVALID_WIDGET_METADATA",
+		path,
+		message: `${path} must be a JSON object when present.`
+	});
+}
+function validateOptionalCapabilities(record, key, path, errors) {
+	const value = record[key];
+	if (value === void 0) return;
+	if (!Array.isArray(value)) {
+		errors.push({
+			code: "INVALID_WIDGET_METADATA",
+			path,
+			message: `${path} must be an array when present.`
+		});
+		return;
+	}
+	const names = /* @__PURE__ */ new Set();
+	value.forEach((candidate, index) => {
+		const capabilityPath = `${path}[${index}]`;
+		if (!isRecord$4(candidate)) {
+			errors.push({
+				code: "INVALID_WIDGET_METADATA",
+				path: capabilityPath,
+				message: `${capabilityPath} must be a JSON object.`
+			});
+			return;
+		}
+		const name = candidate.name;
+		if (!isCanonicalMetadataString(name)) {
+			errors.push({
+				code: "INVALID_WIDGET_METADATA",
+				path: `${capabilityPath}.name`,
+				message: `${capabilityPath}.name must be a non-empty string without surrounding whitespace or control characters.`
+			});
+			return;
+		}
+		const version = candidate.version;
+		if (version !== void 0 && !isCanonicalMetadataString(version)) errors.push({
+			code: "INVALID_WIDGET_METADATA",
+			path: `${capabilityPath}.version`,
+			message: `${capabilityPath}.version must be a non-empty string without surrounding whitespace or control characters when present.`
+		});
+		if (names.has(name)) {
+			errors.push({
+				code: "INVALID_WIDGET_METADATA",
+				path: `${capabilityPath}.name`,
+				message: `${path} must not contain duplicate capability name ${JSON.stringify(name)}.`
+			});
+			return;
+		}
+		names.add(name);
+	});
+}
+function isCanonicalMetadataString(value) {
+	return typeof value === "string" && value.length > 0 && value === value.trim() && !/\p{Cc}/u.test(value);
+}
+function mergeCssUrls(sourceCssUrls, generatedCssUrls) {
+	const generatedCssUrlSet = new Set(generatedCssUrls ?? []);
+	generatedCssUrls?.forEach((cssUrl, index) => {
+		validateGeneratedCssArtifactUrl(cssUrl, `generated cssUrls[${index}]`);
+	});
+	sourceCssUrls?.forEach((cssUrl, index) => {
+		validateGeneratedCssArtifactUrl(cssUrl, `cssUrls[${index}]`);
+		if (generatedCssUrlSet.has(cssUrl)) return;
+		throw new Error(`cssUrls[${index}] URL ${JSON.stringify(cssUrl)} must match a generated top-level CSS artifact. Import the CSS from the widget package bundle or remove it from cssUrls.`);
+	});
+	return Array.from(new Set([...sourceCssUrls ?? [], ...generatedCssUrls ?? []])).map(toWidgetPackageArtifactPath);
+}
+function toWidgetPackageArtifactPath(value) {
+	return value;
+}
+function validateGeneratedCssArtifactUrl(value, cssUrlPath) {
+	if (value.trim().length === 0) throw new Error(`${cssUrlPath} must be a non-empty string.`);
+	if (!isWidgetPackageCssArtifactPath(value)) throw new Error(`${cssUrlPath} must be a top-level generated CSS artifact filename matching [A-Za-z0-9._~-]+.css. Self-host external CSS or fonts via @font-face in widget CSS so the build can isolate them.`);
+}
+function normalizePropertySchema(value, widgetType) {
+	return {
+		...value ?? {},
+		widgetType
+	};
+}
+function normalizeContainer(value) {
+	if (value === "inline" || value === "block" || value === "card" || value === "fullscreen") return value;
+	return DEFAULT_WIDGET_CONTAINER;
+}
+function normalizeResizable(value) {
+	if (typeof value === "boolean") return value;
+	if (value === "horizontal" || value === "vertical" || value === "both") return value;
+	if (!isRecord$4(value)) return false;
+	const horizontal = value.horizontal === true;
+	const vertical = value.vertical === true;
+	if (horizontal && vertical) return "both";
+	if (horizontal) return "horizontal";
+	if (vertical) return "vertical";
+	return false;
+}
+function resolvePackageKey(sourcePackage, owner) {
+	const packageStableId = readNonEmptyTrimmedString(sourcePackage.packageStableId);
+	if (packageStableId) return prefixPackageStableIdWithNonOwnerScope(packageStableId, sourcePackage.scope);
+	return stripOwnerScopeFromPackageId(sourcePackage.packageId, sourcePackage.scope, owner);
+}
+function prefixPackageStableIdWithNonOwnerScope(packageStableId, sourceScope) {
+	const sourceScopeText = readNonEmptyTrimmedString(sourceScope);
+	if (!sourceScopeText || isWidgetPackageOwnerKind(sourceScopeText)) return packageStableId;
+	const sourceScopePrefix = `${sourceScopeText}.`;
+	if (packageStableId.startsWith(sourceScopePrefix)) return packageStableId;
+	return `${sourceScopeText}.${packageStableId}`;
+}
+function stripOwnerScopeFromPackageId(packageId, sourceScope, owner) {
+	const ownerPrefix = `${owner}.`;
+	if (packageId.startsWith(ownerPrefix) && packageId.length > ownerPrefix.length) return packageId.slice(ownerPrefix.length);
+	const sourceScopeText = readNonEmptyTrimmedString(sourceScope);
+	if (isWidgetPackageOwnerKind(sourceScopeText) && packageId.startsWith(`${sourceScopeText}.`) && packageId.length > sourceScopeText.length + 1) return packageId.slice(sourceScopeText.length + 1);
+	return packageId;
+}
+function readNonEmptyTrimmedString(value) {
+	const trimmed = value?.trim();
+	return trimmed ? trimmed : void 0;
+}
+function isWidgetPackageOwnerKind(value) {
+	return value === "company" || value === "droplet";
+}
+function isUrlSafeDottedIdentifier(value) {
+	return URL_SAFE_DOTTED_IDENTIFIER_PATTERN.test(value);
+}
+function isUrlSafeWidgetName(value) {
+	return URL_SAFE_WIDGET_NAME_PATTERN.test(value);
+}
+function isUrlSafeSemver(value) {
+	return SEMVER_URL_SAFE_PATTERN.test(value);
+}
+function isRecord$4(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region ../widget-tooling/src/development-descriptor.ts
+function createWidgetPackageDevelopmentDescriptor(options) {
+	const validation = validateSingleSourceWidgetPackage(readSourcePackages(options.sourceModule), { owner: options.owner });
+	if (!validation.success || !validation.value) throw new WidgetToolingError("VALIDATION_FAILED", validation.errors.map((error) => error.message).join("\n") || "Widget package validation failed.", { diagnostics: validation.errors });
+	return validatedPackageToDescriptor(validation.value, options);
+}
+function validatedPackageToDescriptor(validated, options) {
+	const cssUrls = validated.sourcePackage.cssUrls ?? [];
+	const workerEntryPath = options.workerEntryPath ?? "/__runtime-entry__";
+	const defaultCssPath = options.defaultCssPath ?? "/styles.css";
+	return {
+		manifestVersion: 1,
+		runtime: "remote-dom",
+		packageId: validated.packageId,
+		source: validated.owner,
+		version: validated.version,
+		workerEntryUrl: new URL(workerEntryPath, options.origin).href,
+		cssUrls: cssUrls.length > 0 ? cssUrls.map((url) => toDevelopmentCssUrl(url, options.origin)) : [toDevelopmentCssUrl(defaultCssPath, options.origin)],
+		assetUrls: [],
+		widgets: validated.widgets.map(({ name: _name, ...widget }) => widget)
+	};
+}
+function readSourcePackages(sourceModule) {
+	const packages = sourceModule["widgetPackages"];
+	if (Array.isArray(packages) && packages.length > 0) return packages;
+	const widgetPackage = sourceModule["widgetPackage"];
+	if (widgetPackage !== void 0) return [widgetPackage];
+	const defaultPackage = sourceModule["default"];
+	return defaultPackage === void 0 ? [] : [defaultPackage];
+}
+function toDevelopmentCssUrl(url, origin) {
+	const { href } = new URL(url, origin);
+	return href.includes("?") ? `${href}&direct` : `${href}?direct`;
+}
+//#endregion
+//#region ../widget-tooling/src/dev-routes.ts
+function fluidWidgetDevPlugin(options = {}) {
+	const entryModulePath = options.entryModulePath ?? WIDGET_ENTRY_MODULE_PATH;
+	const configModulePath = options.configModulePath ?? WIDGET_CONFIG_MODULE_PATH;
+	const owner = options.owner ?? "droplet";
+	return {
+		name: "fluid-widget-dev-routes",
+		apply: "serve",
+		config: createWidgetDevServerConfig,
+		configureServer(server) {
+			server.middlewares.use(async (request, response, next) => {
+				const pathname = (request.url ?? "").split("?")[0] ?? "";
+				if (pathname === "/__runtime-entry__" || pathname === "/__runtime-entry__/") {
+					sendJavaScript(request, response, buildRuntimeEntryBootstrapScript(entryModulePath, getRequestOrigin(request)));
+					return;
+				}
+				if (pathname === "/__widget-packages__" || pathname === "/__widget-packages__/") {
+					await sendWidgetPackages(server, request, response, {
+						configModulePath,
+						owner,
+						allowNoPackages: options.allowNoPackages === true
+					});
+					return;
+				}
+				next();
+			});
+		}
+	};
+}
+/**
+* Widget projects intentionally have no HTML entrypoint, so Vite cannot
+* discover the worker's dependency graph during its normal startup scan.
+* Without an explicit entry, the first live-preview request discovers and
+* optimizes the portal worker after the server reports ready. Vite reloads
+* the worker mid-mount, closing its message thread and stranding the preview
+* in a permanent error state.
+*
+* Pre-optimizing the worker entry makes the initial graph stable before a
+* preview can connect. Vite follows this entry's imports, so React and the
+* Remote DOM worker runtime are optimized in the same startup pass.
+*/
+function createWidgetDevServerConfig() {
+	return {
+		optimizeDeps: { include: ["@fluid-app/portal-sdk/widgets/worker"] },
+		ssr: { noExternal: ["@fluid-app/portal-sdk"] }
+	};
+}
+/** Source-relative path of a widget project's entry module. The dev
+*  scaffold always places it here (see the widget template) — this is
+*  the one thing the bootstrap script below needs from the plugin
+*  that isn't itself part of the race/preamble fix. */
+const WIDGET_ENTRY_MODULE_PATH = "/src/index.ts";
+/** Source-relative path of a standalone widget project's package source. */
+const WIDGET_CONFIG_MODULE_PATH = "/fluid.widget.config.ts";
+/**
+* Builds the `/__runtime-entry__` worker bootstrap. Runtime-verified
+* against a real widget dev server + `@fluid-app/widget-runtime` host
+* in a Playwright harness (styled Leaderboard widget rendering,
+* mutation records flowing, `mounted.ready` resolving) — every piece
+* below exists to fix something that reproduced in that harness:
+*
+* 1. **Message-buffer race (the silent-mount killer).** The host
+*    (widget-runtime) posts the "mount" message immediately after
+*    `new Worker(...)`. A production-built worker bundle evaluates
+*    synchronously and never races that message. In dev, though, the
+*    worker's module graph loads asynchronously over many HTTP
+*    requests (this bootstrap script, then the entry module, then
+*    everything it imports, each a separate fetch) — so the "mount"
+*    message can be dispatched and consumed by the Worker's default
+*    (listener-less) handling before the widget entry's own
+*    `message` listener, wired up deep inside the awaited import
+*    below, is ever attached. The message is dropped silently, with
+*    no error anywhere — the old `void import("/src/index.ts")` also
+*    swallowed the import's own rejections, compounding the silence.
+*    Traced live: host→worker "mount" posts, zero worker→host replies
+*    until this buffer-and-replay was added; after it, mutation
+*    records flow and `mounted.ready` resolves. Fix: buffer every
+*    message from the instant the worker boots (before anything else
+*    runs), then replay the buffer, in order, once the entry module
+*    has finished importing and has had the chance to attach its
+*    real listener.
+* 2. **React-refresh preamble.** `@vitejs/plugin-react` injects a
+*    preamble into every dev-transformed `.tsx` module referencing
+*    `window.$RefreshReg$` / `$RefreshSig$`. A Worker global scope has
+*    no `window` and no preamble, so importing a react-based widget
+*    entry throws `window is not defined`, and — once `window` is
+*    aliased to `globalThis` — throws again on the bare
+*    `$RefreshSig$` alias. Installing the canonical preamble
+*    (`RefreshRuntime.injectIntoGlobalHook` + no-op `$RefreshReg$` /
+*    `$RefreshSig$`) before the entry import fixes both. The
+*    `window = globalThis` alias was checked against widget-runtime's
+*    worker lockdown / scope detection (which is
+*    `globalThis.postMessage`-based) — no conflict. `/@react-refresh`
+*    is `@vitejs/plugin-react`'s stable virtual module id, but a
+*    widget project isn't guaranteed to use the react plugin, so the
+*    whole block is try/catch-guarded — a project with no
+*    `/@react-refresh` module (no react plugin) boots straight
+*    through to the entry import unaffected.
+* 3. **`await import`, not `void import`.** A genuine failure to
+*    import the entry module (syntax error, missing dependency, …)
+*    must reject the worker's module evaluation loudly, not vanish
+*    the way a fire-and-forget `void import` did.
+* 4. **Absolute dev-server imports.** Mist and portal previews load the
+*    worker from another origin, so the host wraps this entry in a blob URL.
+*    Root-relative specifiers inside a blob module resolve against the host
+*    page (or fail to resolve at all), not this Vite server. Anchoring both
+*    imports to the request origin keeps the entire dev module graph on the
+*    widget server.
+*
+* Dev-only: this only ever serves from `configureServer` (the
+* plugin's `apply: "serve"` gate), never a built/published package.
+*/
+function buildRuntimeEntryBootstrapScript(entryPath, origin) {
+	const refreshRuntimeUrl = new URL("/@react-refresh", origin).toString();
+	const entryUrl = new URL(entryPath, origin).toString();
+	return [
+		"// Dev-only worker bootstrap — see buildRuntimeEntryBootstrapScript",
+		"// in packages/cli/widget-tooling/src/dev-routes.ts for why each piece",
+		"// here exists (message-buffer race, react-refresh preamble,",
+		"// await-not-void import).",
+		"const __q = [];",
+		"const __buf = (e) => { __q.push(e.data); };",
+		"self.addEventListener(\"message\", __buf);",
+		"if (typeof window === \"undefined\") { globalThis.window = globalThis; }",
+		"try {",
+		`  const { default: RefreshRuntime } = await import(${JSON.stringify(refreshRuntimeUrl)});`,
+		"  RefreshRuntime.injectIntoGlobalHook(window);",
+		"  window.$RefreshReg$ = () => {};",
+		"  window.$RefreshSig$ = () => (type) => type;",
+		"  window.__vite_plugin_react_preamble_installed__ = true;",
+		"} catch {",
+		"  // No @vitejs/plugin-react in this widget project (no",
+		"  // /@react-refresh virtual module) — nothing to preinstall.",
+		"}",
+		`await import(${JSON.stringify(entryUrl)});`,
+		"self.removeEventListener(\"message\", __buf);",
+		"for (const data of __q) {",
+		"  self.dispatchEvent(new MessageEvent(\"message\", { data }));",
+		"}",
+		""
+	].join("\n");
+}
+/**
+* The shared development descriptor workflow appends Vite's `?direct` query
+* to CSS URLs so preview hosts receive real CSS instead of JS style modules.
+* Published descriptors use a separate build path and never receive it.
+*/
+function createDevWidgetPackageDescriptors(configModule, origin, owner = "droplet") {
+	return [createWidgetPackageDevelopmentDescriptor({
+		sourceModule: configModule,
+		owner,
+		origin,
+		workerEntryPath: "/__runtime-entry__",
+		defaultCssPath: "/styles.css"
+	})];
+}
+/**
+* True when validation failed *only* because the project declares no widget
+* package. Checked against the typed diagnostics rather than message text, and
+* deliberately narrow: a config that declares a package and gets it wrong must
+* still be reported.
+*/
+function isNoSourcePackageError(error) {
+	if (!(error instanceof WidgetToolingError)) return false;
+	const diagnostics = error.diagnostics ?? [];
+	return diagnostics.length > 0 && diagnostics.every((diagnostic) => diagnostic.code === "NO_SOURCE_PACKAGE");
+}
+async function sendWidgetPackages(server, request, response, options) {
+	if (handleOptions(request, response)) return;
+	try {
+		sendJson(response, createDevWidgetPackageDescriptors(await server.ssrLoadModule(options.configModulePath), getRequestOrigin(request), options.owner));
+	} catch (error) {
+		if (options.allowNoPackages && isNoSourcePackageError(error)) {
+			sendJson(response, []);
+			return;
+		}
+		server.config.logger.error(`[fluid] Failed to load widget packages: ${String(error)}`);
+		sendJson(response, { error: String(error) }, 500);
+	}
+}
+function sendJavaScript(request, response, source) {
+	if (handleOptions(request, response)) return;
+	setCorsHeaders(response);
+	response.setHeader("Content-Type", "text/javascript");
+	response.statusCode = 200;
+	response.end(source);
+}
+function sendJson(response, body, statusCode = 200) {
+	setCorsHeaders(response);
+	response.setHeader("Content-Type", "application/json");
+	response.statusCode = statusCode;
+	response.end(JSON.stringify(body, null, 2));
+}
+function handleOptions(request, response) {
+	if (request.method !== "OPTIONS") return false;
+	setCorsHeaders(response);
+	response.statusCode = 204;
+	response.end();
+	return true;
+}
+function setCorsHeaders(response) {
+	response.setHeader("Access-Control-Allow-Origin", "*");
+	response.setHeader("Access-Control-Allow-Methods", "GET, HEAD, OPTIONS");
+	response.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
+}
+function getRequestOrigin(request) {
+	const host = readHeader(request.headers.host);
+	if (!host) throw new Error("Widget dev request is missing the Host header.");
+	return `${readHeader(request.headers["x-forwarded-proto"]) === "https" ? "https" : "http"}://${host}`;
+}
+function readHeader(value) {
+	const candidate = Array.isArray(value) ? value[0] : value;
+	return typeof candidate === "string" && candidate.trim().length > 0 ? candidate.trim() : void 0;
+}
+//#endregion
+//#region ../widget-tooling/src/node-runtime.ts
+/**
+* How this package runs the helper scripts it generates.
+*
+* Building a widget package writes two scripts to disk and runs them: a config
+* extractor (under `tsx`) and a Vite build. Both used to assume the same thing —
+* that `process.execPath` is Node and that `tsx` is resolvable from this
+* module. Both assumptions hold for a CLI and neither holds in an Electron main
+* process, where `process.execPath` is the Electron binary. Spawning it without
+* `ELECTRON_RUN_AS_NODE` starts a second copy of the app instead of running the
+* script, and `tsx` is not in a packaged app's dependency closure at all.
+*
+* So the host says how to run a script rather than this package guessing. The
+* default reproduces the old behaviour exactly, which is why both CLIs are
+* unchanged by this.
+*/
+/** The executable to spawn, and the env to spawn it with. */
+function resolveSpawnTarget(runtime) {
+	return {
+		execPath: runtime?.execPath ?? process.execPath,
+		env: runtime?.env ?? {}
+	};
+}
+/**
+* Resolves `tsx`'s CLI, preferring an injected path.
+*
+* Deliberately a function rather than a module-scope constant. It used to be
+* `const TSX_CLI_PATH = require.resolve("tsx/cli")`, which runs on IMPORT — so a
+* host that merely imported this package, and never published anything, crashed
+* at startup if `tsx` was absent. Resolving on use means a missing `tsx` is a
+* publish-time error the caller can report, not a boot failure.
+*/
+function resolveTsxCliPath(runtime) {
+	if (runtime?.tsxCliPath) return runtime.tsxCliPath;
+	return createRequire(import.meta.url).resolve("tsx/cli");
+}
+//#endregion
+//#region ../widget-tooling/src/internal/widget-package-config.ts
+const WIDGET_CONFIG_PATH = "src/widgets.config.ts";
+/** Long enough for a cold tsx start on a slow machine, short enough to fail. */
+const CONFIG_EVAL_TIMEOUT_MS = 6e4;
+const SOURCE_PACKAGE_EXTRACT_FILENAME = "extract-widget-packages.ts";
+const SOURCE_PACKAGE_OUTPUT_FILENAME = "source-widget-packages.json";
+const SOURCE_PACKAGE_OUTPUT_SENTINEL = "fluid-widget-source-packages:v1";
+async function resolvePortalWidgetSourceConfig(projectDir) {
+	const candidate = path.join(projectDir, WIDGET_CONFIG_PATH);
+	return await fs.pathExists(candidate) ? {
+		path: candidate,
+		relativePath: WIDGET_CONFIG_PATH
+	} : void 0;
+}
+async function loadSourceWidgetPackages(projectDir, nodeRuntime) {
+	const config = await resolvePortalWidgetSourceConfig(projectDir);
+	if (!config) return success([]);
+	let tempDir;
+	try {
+		tempDir = await createTempDirectory(projectDir);
+		const extractFile = path.join(tempDir, SOURCE_PACKAGE_EXTRACT_FILENAME);
+		const outputFile = path.join(tempDir, SOURCE_PACKAGE_OUTPUT_FILENAME);
+		await fs.writeFile(extractFile, createSourcePackageExtractorScript({
+			projectDir,
+			configPath: config.path
+		}), {
+			encoding: "utf-8",
+			flag: "wx"
+		});
+		const spawn = resolveSpawnTarget(nodeRuntime);
+		await execa(spawn.execPath, [
+			resolveTsxCliPath(nodeRuntime),
+			extractFile,
+			outputFile
+		], {
+			cwd: projectDir,
+			stdio: "pipe",
+			env: {
+				...process.env,
+				...spawn.env,
+				NODE_ENV: "production"
+			},
+			timeout: CONFIG_EVAL_TIMEOUT_MS,
+			killSignal: "SIGKILL"
+		});
+		const outputResult = await readSourcePackageExtractorOutput(outputFile);
+		if (!outputResult.success) return outputResult;
+		const parsed = outputResult.value;
+		if (parsed.length === 0) return success([]);
+		return success(parsed);
+	} catch (err) {
+		const error = err;
+		return failure({
+			code: "CONFIG_LOAD_FAILED",
+			message: `Failed to load widget packages from ${config.relativePath}`,
+			details: error.stderr ?? error.message ?? String(err)
+		});
+	} finally {
+		if (tempDir) await fs.remove(tempDir).catch(() => {});
+	}
+}
+async function createTempDirectory(projectDir) {
+	const projectTmpDir = path.join(projectDir, ".fluid", "tmp");
+	try {
+		await fs.ensureDir(projectTmpDir);
+		return await fs.mkdtemp(path.join(projectTmpDir, "widget-packages-"));
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		throw new Error(`Unable to create project-local temporary directory at ${projectTmpDir}: ${message}`);
+	}
+}
+async function readSourcePackageExtractorOutput(outputFile) {
+	let output;
+	try {
+		output = await fs.readFile(outputFile, "utf-8");
+	} catch (err) {
+		return failure({
+			code: "CONFIG_LOAD_FAILED",
+			message: "Widget package extractor did not write an output file",
+			details: err instanceof Error ? err.message : String(err)
+		});
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(output);
+	} catch {
+		return failure({
+			code: "INVALID_FORMAT",
+			message: "Failed to parse widget package output file as JSON",
+			details: `Output was: ${output.slice(0, 200)}`
+		});
+	}
+	if (!isRecord$3(parsed) || parsed.sentinel !== SOURCE_PACKAGE_OUTPUT_SENTINEL) return failure({
+		code: "INVALID_FORMAT",
+		message: "Widget package extractor output file had an invalid sentinel"
+	});
+	if (!Array.isArray(parsed.data)) return failure({
+		code: "INVALID_FORMAT",
+		message: "Extracted widget package output is not an array",
+		details: `Expected an array, got: ${typeof parsed.data}`
+	});
+	return success(parsed.data);
+}
+function createSourcePackageExtractorScript(options) {
+	return `
+import fs from "node:fs/promises";
+import path from "node:path";
+import { createServer, normalizePath } from "vite";
+
+const SOURCE_PACKAGE_MARKER = "__fluidSourceWidgetPackage";
+const OUTPUT_SENTINEL = ${JSON.stringify(SOURCE_PACKAGE_OUTPUT_SENTINEL)};
+const projectRoot = ${JSON.stringify(options.projectDir)};
+const widgetConfigPath = ${JSON.stringify(options.configPath)};
+const outputPath = process.argv[2];
+if (!outputPath) throw new Error("Missing widget package extractor output path.");
+
+function toViteModuleId(modulePath) {
+  const relativePath = path.relative(projectRoot, modulePath);
+  if (!relativePath.startsWith("..") && !path.isAbsolute(relativePath)) {
+    return "/" + normalizePath(relativePath);
+  }
+  return normalizePath(modulePath);
+}
+
+const server = await createServer({
+  root: projectRoot,
+  mode: "production",
+  server: { middlewareMode: true },
+  appType: "custom",
+  logLevel: "error",
+  clearScreen: false,
+  resolve: {
+    conditions: ["module", "browser", "development|production"],
+  },
+  ssr: {
+    noExternal: ["@fluid-app/portal-sdk"],
+    resolve: {
+      conditions: ["module", "node", "development|production"],
+    },
+  },
+});
+
+try {
+  const widgetConfig = await server.ssrLoadModule(toViteModuleId(widgetConfigPath));
+
+  function isSourceWidgetPackage(value) {
+    return Boolean(value && typeof value === "object" && value[SOURCE_PACKAGE_MARKER] === true);
+  }
+
+  function collectSourceWidgetPackages(mod) {
+    const candidates = [
+      mod.widgetPackage,
+      ...(Array.isArray(mod.widgetPackages) ? mod.widgetPackages : []),
+      mod.default,
+    ];
+    const byPackageId = new Map();
+    for (const candidate of candidates) {
+      if (!isSourceWidgetPackage(candidate)) continue;
+      if (!byPackageId.has(candidate.packageId)) byPackageId.set(candidate.packageId, candidate);
+    }
+    return Array.from(byPackageId.values());
+  }
+
+  function serializeWidget(widget) {
+    if (!widget || typeof widget !== "object" || Array.isArray(widget)) {
+      return widget;
+    }
+    const { component, ...metadata } = widget;
+    return metadata;
+  }
+
+  function serializePackage(sourcePackage) {
+    return {
+      manifestVersion: sourcePackage.manifestVersion,
+      scope: sourcePackage.scope,
+      packageStableId: sourcePackage.packageStableId,
+      packageId: sourcePackage.packageId,
+      packageType: sourcePackage.packageType,
+      version: sourcePackage.version,
+      cssUrls: sourcePackage.cssUrls,
+      ...(Object.prototype.hasOwnProperty.call(sourcePackage, "navigationOrigins")
+        ? { navigationOrigins: sourcePackage.navigationOrigins }
+        : {}),
+      widgets: Array.isArray(sourcePackage.widgets)
+        ? sourcePackage.widgets.map(serializeWidget)
+        : sourcePackage.widgets,
+    };
+  }
+
+  await fs.writeFile(
+    outputPath,
+    JSON.stringify({
+      sentinel: OUTPUT_SENTINEL,
+      data: collectSourceWidgetPackages(widgetConfig).map(serializePackage),
+    }),
+    "utf-8",
+  );
+} finally {
+  await server.close();
+}
+`;
+}
+function isRecord$3(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region ../widget-tooling/src/internal/widget-package-builder.ts
+const DEFAULT_PUBLISH_DIR = ".fluid/widget-dist";
+const DEFAULT_RUNTIME_VERSION = "1";
+const TEMP_BUILD_DIR = ".fluid/widget-build";
+const TEMP_CLI_DIR = ".fluid/tmp";
+const PROJECT_VITE_CONFIG_CANDIDATES = [
+	"vite.config.ts",
+	"vite.config.mts",
+	"vite.config.js",
+	"vite.config.mjs"
+];
+const BLOCKED_FLUID_PROJECT_PLUGIN_NAMES = ["fluid-portal-dev", "fluid-backend-dev"];
+const require = createRequire(import.meta.url);
+function validateSharedWidgetPackagePublishDir(projectDir, publishDir = DEFAULT_PUBLISH_DIR, options = {}) {
+	const label = options.optionName ?? "publishDir";
+	if (path.isAbsolute(publishDir)) throw new Error(`${label} must be relative to the project directory.`);
+	const normalizedPublishDir = normalizePublishDirForValidation(publishDir);
+	if (normalizedPublishDir === ".fluid" || !normalizedPublishDir.startsWith(".fluid/")) throw new Error(`${label} must be a relative path under .fluid/.`);
+	if (isPathWithinReservedDir(normalizedPublishDir, TEMP_BUILD_DIR)) throw new Error(`${label} must not be ${TEMP_BUILD_DIR} because it is reserved for temporary builder output.`);
+	if (isPathWithinReservedDir(normalizedPublishDir, TEMP_CLI_DIR)) throw new Error(`${label} must not be ${TEMP_CLI_DIR} because it is reserved for Fluid CLI temporary files.`);
+	const resolvedProjectDir = path.resolve(projectDir);
+	const resolvedPublishDir = path.resolve(resolvedProjectDir, publishDir);
+	const relative = path.relative(resolvedProjectDir, resolvedPublishDir);
+	if (relative === "" || relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`${label} must stay inside the project directory.`);
+}
+/**
+* Restamps each loaded source package with `version`.
+*
+* Object spread carries own enumerable SYMBOL keys as well as string ones,
+* which matters here: `defineWidgetPackage` marks its result with a symbol that
+* validation uses to recognise a real source package. A copy that dropped it
+* would fail validation with a message about a missing package rather than
+* about the version.
+*/
+function withVersionOverride(sourcePackages, version) {
+	return sourcePackages.map((sourcePackage) => typeof sourcePackage === "object" && sourcePackage !== null ? {
+		...sourcePackage,
+		version
+	} : sourcePackage);
+}
+async function buildSharedWidgetPackage(options) {
+	const publishDirInput = options.publishDir ?? DEFAULT_PUBLISH_DIR;
+	try {
+		await validateWidgetPackageOutputPaths(options.projectDir, publishDirInput);
+	} catch (err) {
+		return failure({
+			code: "INVALID_PUBLISH_DIR",
+			message: "Unsafe widget package publish directory",
+			details: (err instanceof Error ? err : new Error(String(err))).message
+		});
+	}
+	const sourcePackageResult = await loadSourceWidgetPackages(options.projectDir, options.nodeRuntime);
+	if (!sourcePackageResult.success) return failure({
+		code: "CONFIG_LOAD_FAILED",
+		message: sourcePackageResult.error.message,
+		details: sourcePackageResult.error.details
+	});
+	const validation = validateSingleSourceWidgetPackage(options.versionOverride ? withVersionOverride(sourcePackageResult.value, options.versionOverride) : sourcePackageResult.value, { owner: options.owner });
+	if (!validation.success || !validation.value) return failure({
+		code: "VALIDATION_FAILED",
+		message: validation.errors.map((error) => error.message).join("\n")
+	});
+	try {
+		await validateWidgetPackageOutputPaths(options.projectDir, publishDirInput);
+		const publishDir = path.resolve(options.projectDir, publishDirInput);
+		const widgetScriptPath = path.join(publishDir, "widget.js");
+		await fs.emptyDir(publishDir);
+		const tempDir = path.resolve(options.projectDir, TEMP_BUILD_DIR);
+		await fs.emptyDir(tempDir);
+		let buildFailure;
+		try {
+			await buildWidgetScriptBundle({
+				projectDir: options.projectDir,
+				tempDir,
+				publishDir,
+				validated: validation.value,
+				...options.nodeRuntime ? { nodeRuntime: options.nodeRuntime } : {}
+			});
+		} catch (error) {
+			buildFailure = { error };
+		}
+		try {
+			await fs.remove(tempDir);
+		} catch {
+			const cleanupFailure = /* @__PURE__ */ new Error("Failed to remove reserved temporary build directory.");
+			if (buildFailure) {
+				const primaryError = buildFailure.error instanceof Error ? buildFailure.error : new Error(String(buildFailure.error));
+				throw new AggregateError([primaryError, cleanupFailure], `${primaryError.message}\n${cleanupFailure.message}`);
+			}
+			throw cleanupFailure;
+		}
+		if (buildFailure) throw buildFailure.error;
+		const cssUrls = await collectCssUrls(publishDir);
+		const descriptor = buildWidgetPackagePublishManifest(validation.value, { cssUrls });
+		const manifestContent = stableStringify(descriptor);
+		const publishPackageId = descriptor.packageId;
+		const manifestPath = path.join(publishDir, "manifest.json");
+		const publishManifestPath = path.join(publishDir, "publish-manifest.json");
+		await fs.writeFile(manifestPath, manifestContent, "utf-8");
+		const artifacts = await collectWidgetPackageArtifacts(publishDir);
+		const publishManifest = createPublishManifestMetadata({
+			packageId: publishPackageId,
+			version: validation.value.version,
+			cliVersion: options.cliVersion,
+			runtimeVersion: DEFAULT_RUNTIME_VERSION,
+			manifestContent,
+			artifacts
+		});
+		await fs.writeFile(publishManifestPath, stableStringify(publishManifest), "utf-8");
+		return success({
+			publishDir,
+			packageId: validation.value.packageId,
+			version: validation.value.version,
+			manifestPath,
+			publishManifestPath,
+			widgetScriptPath
+		});
+	} catch (err) {
+		const error = err instanceof Error ? err : new Error(String(err));
+		const isPublishDirValidationError = /^(publishDir|reserved temporary build directory) /.test(error.message);
+		return failure({
+			code: isPublishDirValidationError ? "INVALID_PUBLISH_DIR" : "WRITE_FAILED",
+			message: isPublishDirValidationError ? "Unsafe widget package publish directory" : "Failed to build shared widget package artifacts",
+			details: error.message
+		});
+	}
+}
+function createWidgetPackageEntrySource(options) {
+	return `import { createElement } from "react";
+import { startWidgetPackage } from "@fluid-app/portal-sdk/widgets/worker";
+${options.cssImportPath ? `import ${JSON.stringify(options.cssImportPath)};` : ""}
+
+const widgetConfig = await import(${JSON.stringify(options.configImportPath)});
+const SOURCE_PACKAGE_MARKER = "__fluidSourceWidgetPackage";
+const descriptors = ${JSON.stringify(options.validated.widgets, null, 2)};
+
+function isSourceWidgetPackage(value) {
+  return Boolean(value && typeof value === "object" && value[SOURCE_PACKAGE_MARKER] === true);
+}
+
+function collectSourceWidgetPackages(mod) {
+  return [
+    mod.widgetPackage,
+    ...(Array.isArray(mod.widgetPackages) ? mod.widgetPackages : []),
+    mod.default,
+  ].filter(isSourceWidgetPackage);
+}
+
+const sourcePackage = collectSourceWidgetPackages(widgetConfig)[0];
+if (!sourcePackage) {
+  throw new Error("No Fluid source widget package found while loading widget package worker bundle.");
+}
+
+const componentsByName = new Map(
+  sourcePackage.widgets.map((widget) => [widget.name, widget.component]),
+);
+
+const widgets = descriptors.map((descriptor) => {
+  const component = componentsByName.get(descriptor.name);
+  if (typeof component !== "function") {
+    throw new Error("Widget package is missing Remote DOM component for " + descriptor.name + ".");
+  }
+  return {
+    ...descriptor,
+    component: (props) => createElement(component, props),
+  };
+});
+
+startWidgetPackage({ widgets });
+`;
+}
+async function buildWidgetScriptBundle(options) {
+	const sourceConfig = await resolvePortalWidgetSourceConfig(options.projectDir);
+	if (!sourceConfig) throw new Error("No portal widget source config found.");
+	const entryPath = path.join(options.tempDir, "widget-entry.ts");
+	const viteConfigPath = path.join(options.tempDir, "vite.config.mjs");
+	const rootStylesPath = path.join(options.projectDir, "styles.css");
+	await fs.writeFile(entryPath, createWidgetPackageEntrySource({
+		configImportPath: pathToFileURL(sourceConfig.path).href,
+		cssImportPath: await fs.pathExists(rootStylesPath) ? pathToFileURL(rootStylesPath).href : void 0,
+		validated: options.validated
+	}), "utf-8");
+	await fs.writeFile(viteConfigPath, createViteConfigSource({
+		entryPath,
+		publishDir: options.publishDir,
+		projectConfigPath: await resolveProjectViteConfigPath(options.projectDir)
+	}), "utf-8");
+	const viteCliPath = resolveViteCliPath(options.projectDir);
+	const spawn = resolveSpawnTarget(options.nodeRuntime);
+	await execa(spawn.execPath, [
+		viteCliPath,
+		"build",
+		"--config",
+		viteConfigPath
+	], {
+		cwd: options.projectDir,
+		stdio: "pipe",
+		env: {
+			...process.env,
+			...spawn.env,
+			NODE_ENV: "production"
+		}
+	});
+}
+function resolveViteCliPath(projectDir) {
+	const projectViteCliPath = resolveViteCliPathFromRequire(createRequire(path.join(projectDir, "package.json")));
+	if (projectViteCliPath) return projectViteCliPath;
+	const cliViteCliPath = resolveViteCliPathFromRequire(require);
+	if (cliViteCliPath) return cliViteCliPath;
+	throw new Error("Unable to resolve Vite for the portal project. Install the project dependencies and ensure vite is available before building widget packages.");
+}
+async function resolveProjectViteConfigPath(projectDir) {
+	for (const fileName of PROJECT_VITE_CONFIG_CANDIDATES) {
+		const candidate = path.join(projectDir, fileName);
+		if (await fs.pathExists(candidate)) return candidate;
+	}
+}
+function createViteConfigSource(options) {
+	const widgetConfigSource = createWidgetViteConfigObjectSource({
+		...options,
+		disableConfigFileLookup: !options.projectConfigPath
+	});
+	if (!options.projectConfigPath) return `import { defineConfig } from "vite";
+
+export default defineConfig(${widgetConfigSource});
+`;
+	return `import { defineConfig, loadConfigFromFile, mergeConfig } from "vite";
+
+const projectConfigPath = ${JSON.stringify(options.projectConfigPath)};
+const widgetConfig = ${widgetConfigSource};
+const fluidWidgetDefineInvariants = {
+  "process.env.NODE_ENV": JSON.stringify("production"),
+};
+const blockedFluidPluginNames = new Set(${JSON.stringify(BLOCKED_FLUID_PROJECT_PLUGIN_NAMES)});
+
+function isAllowedProjectPlugin(plugin) {
+  return !plugin || typeof plugin !== "object" || !blockedFluidPluginNames.has(plugin.name);
+}
+
+function sanitizeProjectPlugins(pluginOption) {
+  if (!Array.isArray(pluginOption)) {
+    return isAllowedProjectPlugin(pluginOption) ? pluginOption : [];
+  }
+
+  return pluginOption
+    .map((plugin) => Array.isArray(plugin) ? sanitizeProjectPlugins(plugin) : plugin)
+    .filter(isAllowedProjectPlugin);
+}
+
+function copyProjectConfigValue(source, target, key) {
+  if (Object.prototype.hasOwnProperty.call(source, key)) {
+    target[key] = source[key];
+  }
+}
+
+function sanitizeProjectConfig(config) {
+  if (!config || typeof config !== "object") return {};
+
+  const sanitized = {};
+  if (Object.prototype.hasOwnProperty.call(config, "plugins")) {
+    sanitized.plugins = sanitizeProjectPlugins(config.plugins);
+  }
+  copyProjectConfigValue(config, sanitized, "resolve");
+  copyProjectConfigValue(config, sanitized, "define");
+  copyProjectConfigValue(config, sanitized, "css");
+  copyProjectConfigValue(config, sanitized, "esbuild");
+  copyProjectConfigValue(config, sanitized, "json");
+  copyProjectConfigValue(config, sanitized, "assetsInclude");
+  copyProjectConfigValue(config, sanitized, "envDir");
+  copyProjectConfigValue(config, sanitized, "envPrefix");
+  return sanitized;
+}
+
+function copyConfigDefineValue(value) {
+  return value && typeof value === "object" && !Array.isArray(value)
+    ? { ...value }
+    : {};
+}
+
+function mergeFluidWidgetDefineInvariants(mergedConfig, safeProjectConfig, widgetConfig) {
+  mergedConfig.define = {
+    ...copyConfigDefineValue(safeProjectConfig.define),
+    ...copyConfigDefineValue(mergedConfig.define),
+    ...copyConfigDefineValue(widgetConfig.define),
+    ...fluidWidgetDefineInvariants,
+  };
+  return mergedConfig;
+}
+
+export default defineConfig(async (configEnv) => {
+  const projectConfig = await loadConfigFromFile(configEnv, projectConfigPath);
+  const safeProjectConfig = sanitizeProjectConfig(projectConfig?.config ?? {});
+  return mergeFluidWidgetDefineInvariants(mergeConfig(safeProjectConfig, widgetConfig), safeProjectConfig, widgetConfig);
+});
+`;
+}
+function createWidgetViteConfigObjectSource(options) {
+	const configFileSource = options.disableConfigFileLookup ? "  configFile: false,\n" : "";
+	return `(() => {
+  const fluidWidgetDefineInvariants = {
+    "process.env.NODE_ENV": JSON.stringify("production"),
+  };
+
+  function createFluidWidgetBuildInvariants() {
+    return {
+      copyPublicDir: false,
+      emptyOutDir: false,
+      outDir: ${JSON.stringify(options.publishDir)},
+      sourcemap: false,
+      target: "esnext",
+      cssCodeSplit: false,
+      lib: {
+        entry: ${JSON.stringify(options.entryPath)},
+        formats: ["es"],
+        fileName: () => "widget.js",
+        cssFileName: "widget",
+      },
+      rollupOptions: {
+        output: {
+          inlineDynamicImports: true,
+          hoistTransitiveImports: false,
+        },
+      },
+    };
+  }
+
+  function fluidWidgetBuildInvariantsPlugin() {
+    return {
+      name: "fluid-widget-build-invariants",
+      enforce: "post",
+      config() {
+        return { build: createFluidWidgetBuildInvariants() };
+      },
+      configResolved(config) {
+        config.define = {
+          ...(config.define ?? {}),
+          ...fluidWidgetDefineInvariants,
+        };
+        Object.assign(config.build, createFluidWidgetBuildInvariants());
+      },
+    };
+  }
+
+  return {
+${configFileSource}    publicDir: false,
+    define: fluidWidgetDefineInvariants,
+    resolve: {
+      conditions: [
+        "module",
+        "browser",
+        "development|production",
+      ],
+    },
+    plugins: [fluidWidgetBuildInvariantsPlugin()],
+    build: createFluidWidgetBuildInvariants(),
+  };
+})()`;
+}
+async function validateWidgetPackageOutputPaths(projectDir, publishDir) {
+	validateSharedWidgetPackagePublishDir(projectDir, publishDir);
+	await rejectSymlinkedPathSegments({
+		projectDir,
+		relativePath: publishDir,
+		label: "publishDir"
+	});
+	await rejectSymlinkedPathSegments({
+		projectDir,
+		relativePath: TEMP_BUILD_DIR,
+		label: "reserved temporary build directory"
+	});
+}
+async function collectCssUrls(publishDir) {
+	return (await fs.readdir(publishDir, { withFileTypes: true })).filter((entry) => entry.isFile() && isWidgetPackageCssArtifactPath(entry.name)).map((entry) => entry.name).sort();
+}
+async function rejectSymlinkedPathSegments(options) {
+	const resolvedProjectDir = path.resolve(options.projectDir);
+	const resolvedTargetPath = path.resolve(resolvedProjectDir, options.relativePath);
+	const segments = path.relative(resolvedProjectDir, resolvedTargetPath).split(path.sep).filter(Boolean);
+	let currentPath = resolvedProjectDir;
+	for (const segment of segments) {
+		currentPath = path.join(currentPath, segment);
+		let stat;
+		try {
+			stat = await fs.lstat(currentPath);
+		} catch (err) {
+			if (isNodeError(err) && err.code === "ENOENT") return;
+			throw err;
+		}
+		if (stat.isSymbolicLink()) throw new Error(`${options.label} must not include symbolic links.`);
+	}
+}
+function normalizePublishDirForValidation(value) {
+	return toPosixPath(path.normalize(value)).replace(/\/+$/, "") || ".";
+}
+function isPathWithinReservedDir(value, reservedDir) {
+	return value === reservedDir || value.startsWith(`${reservedDir}/`);
+}
+function toPosixPath(value) {
+	return value.split(path.sep).join("/");
+}
+function stableStringify(value) {
+	return `${JSON.stringify(value, null, 2)}\n`;
+}
+function resolveViteCliPathFromRequire(moduleRequire) {
+	try {
+		const packageJsonPath = moduleRequire.resolve("vite/package.json");
+		const binPath = getViteBinPath(moduleRequire(packageJsonPath).bin);
+		if (!binPath) return void 0;
+		return path.resolve(path.dirname(packageJsonPath), binPath);
+	} catch (err) {
+		if (isModuleResolutionError(err)) return void 0;
+		throw err;
+	}
+}
+function getViteBinPath(bin) {
+	if (typeof bin === "string") return bin;
+	if (!isRecord$2(bin)) return void 0;
+	const viteBin = bin.vite;
+	return typeof viteBin === "string" ? viteBin : void 0;
+}
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNodeError(value) {
+	return typeof value === "object" && value !== null && "code" in value && typeof value.code === "string";
+}
+function isModuleResolutionError(value) {
+	return isNodeError(value) && (value.code === "MODULE_NOT_FOUND" || value.code === "ERR_MODULE_NOT_FOUND");
+}
+//#endregion
+//#region ../widget-tooling/src/internal/widget-package-publish-request.ts
+async function createWidgetPackagePublishRequest(options) {
+	const manifestContent = await fs.readFile(options.manifestPath);
+	const manifest = parseJsonRecord(manifestContent.toString("utf-8"), options.manifestPath);
+	const publishManifest = await readPublishManifest(options.publishManifestPath);
+	assertManifestIdentityMatches(manifest, publishManifest, options.manifestPath);
+	assertMetadataMatches({
+		label: "manifestHash",
+		path: "manifest.json",
+		expected: publishManifest.manifestHash,
+		actual: sha256(manifestContent)
+	});
+	const collectedArtifacts = await collectWidgetPackageArtifacts(options.publishDir);
+	assertArtifactInventoryMatches(publishManifest.artifacts, collectedArtifacts);
+	const artifacts = await readUploadArtifacts(options.publishDir, publishManifest.artifacts);
+	return {
+		version: publishManifest.version,
+		packageKey: stripOwnerPrefix(publishManifest.packageId, options.owner),
+		builderVersion: publishManifest.builderVersion,
+		cliVersion: publishManifest.cliVersion,
+		runtimeVersion: publishManifest.runtimeVersion,
+		manifestHash: publishManifest.manifestHash,
+		manifest,
+		artifacts
+	};
+}
+async function readJsonRecord(filePath) {
+	return parseJsonRecord(await fs.readFile(filePath, "utf-8"), filePath);
+}
+function parseJsonRecord(content, filePath) {
+	const value = JSON.parse(content);
+	if (!isRecord$1(value) || Array.isArray(value)) throw new Error(`${path.basename(filePath)} must contain a JSON object.`);
+	return value;
+}
+async function readPublishManifest(filePath) {
+	const record = await readJsonRecord(filePath);
+	const artifactsValue = record["artifacts"];
+	if (!Array.isArray(artifactsValue)) throw new Error("publish-manifest.json must include an artifacts array.");
+	return {
+		packageId: readRequiredString(record, "packageId", filePath),
+		version: readRequiredString(record, "version", filePath),
+		builderVersion: readRequiredString(record, "builderVersion", filePath),
+		cliVersion: readRequiredString(record, "cliVersion", filePath),
+		runtimeVersion: readRequiredString(record, "runtimeVersion", filePath),
+		manifestHash: readRequiredString(record, "manifestHash", filePath),
+		artifacts: artifactsValue.map((artifact, index) => readArtifactMetadata(artifact, index))
+	};
+}
+function readArtifactMetadata(value, index) {
+	if (!isRecord$1(value) || Array.isArray(value)) throw new Error(`publish-manifest.json artifacts[${index}] must be a JSON object.`);
+	return {
+		path: readRequiredString(value, "path", "publish-manifest.json"),
+		sha256: readRequiredString(value, "sha256", "publish-manifest.json"),
+		bytes: readRequiredNumber(value, "bytes", "publish-manifest.json"),
+		contentType: readRequiredString(value, "contentType", "publish-manifest.json")
+	};
+}
+async function readUploadArtifacts(publishDir, artifacts) {
+	const resolvedPublishDir = path.resolve(publishDir);
+	return Promise.all(artifacts.map(async (artifact) => {
+		const artifactPath = resolveArtifactPath(resolvedPublishDir, artifact.path);
+		const actual = await computeArtifactMetadata(artifactPath, resolvedPublishDir);
+		assertArtifactMetadataMatches(artifact, actual);
+		return {
+			...actual,
+			body: await fs.readFile(artifactPath)
+		};
+	}));
+}
+function assertManifestIdentityMatches(manifest, publishManifest, manifestPath) {
+	assertMetadataMatches({
+		label: "packageId",
+		path: "manifest.json",
+		expected: publishManifest.packageId,
+		actual: readRequiredString(manifest, "packageId", manifestPath)
+	});
+	assertMetadataMatches({
+		label: "version",
+		path: "manifest.json",
+		expected: publishManifest.version,
+		actual: readRequiredString(manifest, "version", manifestPath)
+	});
+}
+function assertArtifactInventoryMatches(expected, actual) {
+	const expectedByPath = /* @__PURE__ */ new Map();
+	for (const artifact of expected) {
+		if (expectedByPath.has(artifact.path)) throw new Error(`publish-manifest.json artifacts include duplicate path ${JSON.stringify(artifact.path)}. Rebuild the widget package before publishing.`);
+		expectedByPath.set(artifact.path, artifact);
+	}
+	const actualPaths = /* @__PURE__ */ new Set();
+	for (const actualArtifact of actual) {
+		actualPaths.add(actualArtifact.path);
+		const expectedArtifact = expectedByPath.get(actualArtifact.path);
+		if (!expectedArtifact) throw new Error(`publish-manifest.json artifacts omit ${JSON.stringify(actualArtifact.path)}. Rebuild the widget package before publishing.`);
+		assertArtifactMetadataMatches(expectedArtifact, actualArtifact);
+	}
+	for (const expectedArtifact of expected) {
+		if (actualPaths.has(expectedArtifact.path)) continue;
+		throw new Error(`publish-manifest.json artifacts include ${JSON.stringify(expectedArtifact.path)}, but that file is not present on disk. Rebuild the widget package before publishing.`);
+	}
+}
+function assertArtifactMetadataMatches(expected, actual) {
+	assertMetadataMatches({
+		label: "path",
+		path: expected.path,
+		expected: expected.path,
+		actual: actual.path
+	});
+	assertMetadataMatches({
+		label: "sha256",
+		path: expected.path,
+		expected: expected.sha256,
+		actual: actual.sha256
+	});
+	assertMetadataMatches({
+		label: "bytes",
+		path: expected.path,
+		expected: expected.bytes,
+		actual: actual.bytes
+	});
+	assertMetadataMatches({
+		label: "contentType",
+		path: expected.path,
+		expected: expected.contentType,
+		actual: actual.contentType
+	});
+}
+function assertMetadataMatches(options) {
+	if (options.expected === options.actual) return;
+	throw new Error(`publish-manifest.json ${options.label} for ${JSON.stringify(options.path)} does not match the file on disk. Recorded ${JSON.stringify(options.expected)}, computed ${JSON.stringify(options.actual)}. Rebuild the widget package before publishing.`);
+}
+function resolveArtifactPath(publishDir, artifactPath) {
+	const resolved = path.resolve(publishDir, artifactPath);
+	const relative = path.relative(publishDir, resolved);
+	if (relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`Artifact path ${JSON.stringify(artifactPath)} escapes the publish directory.`);
+	return resolved;
+}
+function stripOwnerPrefix(packageId, owner) {
+	const prefix = `${owner}.`;
+	if (packageId.startsWith(prefix) && packageId.length > prefix.length) return packageId.slice(prefix.length);
+	return packageId;
+}
+function readRequiredString(record, key, filePath) {
+	const value = record[key];
+	if (typeof value === "string" && value.trim().length > 0) return value;
+	throw new Error(`${path.basename(filePath)} must include string ${key}.`);
+}
+function readRequiredNumber(record, key, filePath) {
+	const value = record[key];
+	if (typeof value === "number" && Number.isFinite(value)) return value;
+	throw new Error(`${path.basename(filePath)} must include number ${key}.`);
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null;
+}
+//#endregion
+//#region ../../api-clients/fluidos/src/hey-api/sdk.gen.ts
+/**
+* Create a Fluid OS widget package version
+*
+* Start a company-owned Fluid OS widget package publish flow and return signed upload URLs for each artifact.
+*/
+const fluidOsV0CreateWidgetPackageVersion = (options) => options.client.post({
+	responseStyle: "data",
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/api/company/fluid_os/widget_package_versions",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
+});
+/**
+* Complete a Fluid OS widget package upload
+*
+* Verify uploaded artifacts for a company-owned Fluid OS widget package version and approve the version when verification succeeds. Uploaded manifest.json is verified for matching packageId, matching version, and valid company-owned `company.<package_key>.` widget type prefixes.
+*/
+const fluidOsV0CompleteWidgetPackageVersionUpload = (options) => options.client.post({
+	responseStyle: "data",
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/api/company/fluid_os/widget_package_versions/{version}/complete_upload",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
+});
+/**
+* Mint a short-lived git credential for the company widget repo
+*
+* Returns an HTTPS clone URL with a fresh installation token from the
+* Fluid GitHub App embedded as the password. The CLI uses it
+* transparently — no `gh`, no PAT, no SSH key.
+*
+* Valid for ~1 hour (GitHub installation token TTL); re-mint on each
+* operation.
+*
+*/
+const fluidOsV0WidgetPackageGitCredentialCreate = (options) => options.client.post({
+	responseStyle: "data",
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/api/company/fluid_os/widget_package/git_credential",
+	...options
+});
+//#endregion
+//#region ../widget-tooling/src/internal/widget-package-upload.ts
+var WidgetPackageUploadError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "WidgetPackageUploadError";
+		this.code = code;
+	}
+};
+function buildWidgetPackageArtifactPayload(artifact) {
+	return {
+		path: artifact.path,
+		sha256: artifact.sha256,
+		bytes: artifact.bytes,
+		contentType: artifact.contentType
+	};
+}
+function buildWidgetPackageUploadSessionPayload(request) {
+	return {
+		version: request.version,
+		package_key: request.packageKey,
+		builder_version: request.builderVersion,
+		cli_version: request.cliVersion,
+		runtime_version: request.runtimeVersion,
+		manifest_hash: request.manifestHash,
+		manifest: request.manifest,
+		artifacts: request.artifacts.map(buildWidgetPackageArtifactPayload)
+	};
+}
+function buildWidgetPackageCompleteUploadPayload(packageKey, artifacts) {
+	return {
+		package_key: packageKey,
+		artifacts: artifacts.map(buildWidgetPackageArtifactPayload)
+	};
+}
+function getWidgetPackageUploadSessionRoute(owner) {
+	switch (owner.kind) {
+		case "droplet": return `/api/droplets/${encodeURIComponent(owner.uuid)}/widget_package_versions`;
+		case "company": return "/api/company/fluid_os/widget_package_versions";
+	}
+}
+function getWidgetPackageCompleteUploadRoute(owner, version) {
+	switch (owner.kind) {
+		case "droplet": return `/api/droplets/${encodeURIComponent(owner.uuid)}/widget_package_versions/${encodeURIComponent(version)}/complete_upload`;
+		case "company": return `/api/company/fluid_os/widget_package_versions/${encodeURIComponent(version)}/complete_upload`;
+	}
+}
+async function requestWidgetPackageUploadSession(client, owner, request) {
+	const payload = buildWidgetPackageUploadSessionPayload(request);
+	try {
+		return normalizeWidgetPackageUploadSession(owner.kind === "company" ? await fluidOsV0CreateWidgetPackageVersion({
+			body: payload,
+			client
+		}) : await client.post({
+			body: payload,
+			responseStyle: "data",
+			url: getWidgetPackageUploadSessionRoute(owner)
+		}), request.version, request.artifacts);
+	} catch (err) {
+		if (err instanceof WidgetPackageUploadError) throw err;
+		throw new WidgetPackageUploadError("SESSION_REQUEST_FAILED", `Failed to create widget package upload session: ${formatUnknownError(err)}`);
+	}
+}
+async function uploadWidgetPackageArtifacts(session, artifacts, fetchImpl = fetch) {
+	const uploadsByPath = new Map(session.uploads.map((upload) => [upload.path, upload]));
+	const results = [];
+	for (const artifact of artifacts) {
+		const upload = uploadsByPath.get(artifact.path);
+		if (!upload) throw new WidgetPackageUploadError("MISSING_SIGNED_URL", `Upload session did not include a signed URL for artifact "${artifact.path}".`);
+		if (upload.contentType !== artifact.contentType) throw new WidgetPackageUploadError("CONTENT_TYPE_MISMATCH", `Upload session expected artifact "${artifact.path}" to use content type "${upload.contentType}", but local artifact uses "${artifact.contentType}".`);
+		let response;
+		try {
+			response = await fetchImpl(upload.url, {
+				method: "PUT",
+				headers: mergeUploadHeaders(upload.headers, upload.contentType),
+				body: artifact.body
+			});
+		} catch (err) {
+			throw new WidgetPackageUploadError("ARTIFACT_UPLOAD_FAILED", `Failed to upload artifact "${artifact.path}": ${formatUnknownError(err)}`);
+		}
+		if (!response.ok) {
+			const body = await response.text().catch(() => "");
+			const details = body.trim() ? `: ${body.trim().slice(0, 500)}` : "";
+			throw new WidgetPackageUploadError("ARTIFACT_UPLOAD_FAILED", `Failed to upload artifact "${artifact.path}": PUT returned HTTP ${response.status}${details}`);
+		}
+		results.push({
+			path: artifact.path,
+			status: response.status,
+			contentType: upload.contentType
+		});
+	}
+	return results;
+}
+async function completeWidgetPackageUpload(client, owner, version, packageKey, artifacts) {
+	const payload = buildWidgetPackageCompleteUploadPayload(packageKey, artifacts);
+	try {
+		return normalizeWidgetPackageCompleteResponse(owner.kind === "company" ? await fluidOsV0CompleteWidgetPackageVersionUpload({
+			body: payload,
+			client,
+			path: { version }
+		}) : await client.post({
+			body: payload,
+			responseStyle: "data",
+			url: getWidgetPackageCompleteUploadRoute(owner, version)
+		}), version);
+	} catch (err) {
+		if (err instanceof WidgetPackageUploadError) throw err;
+		throw new WidgetPackageUploadError("COMPLETE_UPLOAD_FAILED", `Failed to complete widget package upload: ${formatUnknownError(err)}`);
+	}
+}
+async function publishWidgetPackageVersion(options) {
+	const sessionPayload = buildWidgetPackageUploadSessionPayload(options.request);
+	if (options.dryRun) return {
+		dryRun: true,
+		sessionPayload
+	};
+	if (!options.client) throw new Error("A FluidOS API client is required when dryRun is false.");
+	const session = await requestWidgetPackageUploadSession(options.client, options.owner, options.request);
+	return {
+		dryRun: false,
+		sessionPayload,
+		session,
+		uploadedArtifacts: await uploadWidgetPackageArtifacts(session, options.request.artifacts, options.fetchImpl),
+		complete: await completeWidgetPackageUpload(options.client, options.owner, session.version, options.request.packageKey, options.request.artifacts)
+	};
+}
+function normalizeWidgetPackageUploadSession(response, requestedVersion, requestedArtifacts) {
+	const record = requireRecord(response, "INVALID_SESSION_RESPONSE", "Upload session response must be a JSON object.");
+	requireFiniteNumberProperty(record, "version_id", "INVALID_SESSION_RESPONSE");
+	requireStringProperty(record, "artifact_base_url", "INVALID_SESSION_RESPONSE");
+	const uploadValues = record["uploads"];
+	if (!Array.isArray(uploadValues)) throw new WidgetPackageUploadError("INVALID_SESSION_RESPONSE", "Upload session response must contain an \"uploads\" array.");
+	const requestedArtifactsByPath = new Map(requestedArtifacts.map((artifact) => [artifact.path, artifact]));
+	const seenUploadPaths = /* @__PURE__ */ new Set();
+	const uploads = uploadValues.map((value, index) => {
+		const upload = requireRecord(value, "INVALID_SESSION_RESPONSE", `Upload session uploads[${index}] must be a JSON object.`);
+		const path = requireStringProperty(upload, "path", "INVALID_SESSION_RESPONSE");
+		const url = requireStringProperty(upload, "upload_url", "INVALID_SESSION_RESPONSE");
+		requireStringProperty(upload, "public_url", "INVALID_SESSION_RESPONSE");
+		const requestedArtifact = requestedArtifactsByPath.get(path);
+		if (!requestedArtifact) throw new WidgetPackageUploadError("INVALID_SESSION_RESPONSE", `Upload session response included unexpected artifact "${path}".`);
+		if (seenUploadPaths.has(path)) throw new WidgetPackageUploadError("INVALID_SESSION_RESPONSE", `Upload session response included duplicate artifact "${path}".`);
+		seenUploadPaths.add(path);
+		return {
+			path,
+			url,
+			contentType: requestedArtifact.contentType,
+			headers: {}
+		};
+	});
+	const missingUploadPaths = requestedArtifacts.map((artifact) => artifact.path).filter((artifactPath) => !seenUploadPaths.has(artifactPath));
+	if (missingUploadPaths.length > 0) throw new WidgetPackageUploadError("INVALID_SESSION_RESPONSE", `Upload session response is missing signed URLs for artifact(s): ${missingUploadPaths.join(", ")}.`);
+	return {
+		version: requestedVersion,
+		uploads,
+		raw: response
+	};
+}
+function normalizeWidgetPackageCompleteResponse(response, requestedVersion) {
+	const record = requireRecord(response, "INVALID_COMPLETE_RESPONSE", "Complete upload response must be a JSON object.");
+	const responseVersion = requireStringProperty(record, "version", "INVALID_COMPLETE_RESPONSE");
+	if (responseVersion !== requestedVersion) throw new WidgetPackageUploadError("INVALID_COMPLETE_RESPONSE", `Complete upload response version "${responseVersion}" did not match requested version "${requestedVersion}".`);
+	const packageKey = requireStringProperty(record, "packageId", "INVALID_COMPLETE_RESPONSE");
+	const status = requireStringProperty(record, "status", "INVALID_COMPLETE_RESPONSE");
+	requireStringProperty(record, "scriptUrl", "INVALID_COMPLETE_RESPONSE");
+	requireStringProperty(record, "manifestUrl", "INVALID_COMPLETE_RESPONSE");
+	requireStringArrayProperty(record, "cssUrls", "INVALID_COMPLETE_RESPONSE");
+	return {
+		version: responseVersion,
+		status,
+		packageKey,
+		raw: response
+	};
+}
+function normalizeHeaderName(name) {
+	return name.toLowerCase();
+}
+function mergeUploadHeaders(headers, contentType) {
+	const merged = {};
+	for (const [key, value] of Object.entries(headers)) {
+		if (normalizeHeaderName(key) === "content-type") continue;
+		merged[key] = value;
+	}
+	merged["Content-Type"] = contentType;
+	return merged;
+}
+function requireRecord(value, code, message) {
+	if (!isRecord(value) || Array.isArray(value)) throw new WidgetPackageUploadError(code, message);
+	return value;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null;
+}
+function requireStringProperty(record, key, code) {
+	const value = record[key];
+	if (typeof value === "string" && value.trim().length > 0) return value;
+	throw new WidgetPackageUploadError(code, `Response field "${key}" must be a non-empty string.`);
+}
+function requireFiniteNumberProperty(record, key, code) {
+	const value = record[key];
+	if (typeof value === "number" && Number.isFinite(value)) return value;
+	throw new WidgetPackageUploadError(code, `Response field "${key}" must be a finite number.`);
+}
+function requireStringArrayProperty(record, key, code) {
+	const value = record[key];
+	if (Array.isArray(value) && value.every((entry) => typeof entry === "string" && entry.trim().length > 0)) return value;
+	throw new WidgetPackageUploadError(code, `Response field "${key}" must be an array of non-empty strings.`);
+}
+function formatUnknownError(err) {
+	const base = err instanceof Error ? err.message : String(err);
+	if (isRecord(err) && "data" in err) return `${base} — ${safeStringify(err.data)}`;
+	return base;
+}
+function safeStringify(value) {
+	const seen = /* @__PURE__ */ new WeakSet();
+	try {
+		return JSON.stringify(value, (_key, item) => {
+			if (typeof item === "bigint") return `${item}n`;
+			if (typeof item !== "object" || item === null) return item;
+			if (seen.has(item)) return "[Circular]";
+			seen.add(item);
+			return item;
+		}) ?? String(value);
+	} catch {
+		return "[unserializable error data]";
+	}
+}
+//#endregion
+//#region ../widget-tooling/src/workflows.ts
+async function loadAndValidateWidgetPackage(options) {
+	const sourceConfig = await resolvePortalWidgetSourceConfig(options.projectDir);
+	const loadResult = await loadSourceWidgetPackages(options.projectDir, options.nodeRuntime);
+	if (!loadResult.success) throw new WidgetToolingError("CONFIG_LOAD_FAILED", loadResult.error.message, { details: loadResult.error.details });
+	const validation = validateSingleSourceWidgetPackage(loadResult.value, { owner: options.owner });
+	if (!validation.success || !validation.value) throw new WidgetToolingError("VALIDATION_FAILED", validation.errors.map((error) => error.message).join("\n") || "Widget package validation failed.", { diagnostics: validation.errors });
+	return {
+		projectDir: options.projectDir,
+		sourceConfigPath: sourceConfig?.relativePath ?? "src/widgets.config.ts",
+		validated: validation.value
+	};
+}
+async function buildWidgetPackage(options) {
+	const result = await buildSharedWidgetPackage({
+		projectDir: options.projectDir,
+		publishDir: options.outDir,
+		owner: options.owner,
+		cliVersion: options.cliVersion,
+		...options.version ? { versionOverride: options.version } : {},
+		...options.nodeRuntime ? { nodeRuntime: options.nodeRuntime } : {}
+	});
+	if (result.success) return result.value;
+	throw new WidgetToolingError(result.error.code === "CONFIG_LOAD_FAILED" ? "CONFIG_LOAD_FAILED" : result.error.code === "VALIDATION_FAILED" ? "VALIDATION_FAILED" : result.error.code === "INVALID_PUBLISH_DIR" ? "INVALID_OUTPUT_DIR" : "BUILD_FAILED", result.error.message, { details: result.error.details });
+}
+async function publishWidgetPackage(options) {
+	if (options.owner !== options.uploadOwner.kind) throw new WidgetToolingError("OWNER_MISMATCH", `Widget package build owner "${options.owner}" must match upload owner kind "${options.uploadOwner.kind}".`);
+	if (!options.dryRun && !options.client) throw new WidgetToolingError("CLIENT_REQUIRED", "A FluidOS API client is required when dryRun is false.");
+	const build = await buildWidgetPackage(options);
+	let request;
+	try {
+		request = await createWidgetPackagePublishRequest({
+			publishDir: build.publishDir,
+			manifestPath: build.manifestPath,
+			publishManifestPath: build.publishManifestPath,
+			owner: options.owner
+		});
+	} catch (error) {
+		throw new WidgetToolingError("ARTIFACT_VERIFICATION_FAILED", error instanceof Error ? error.message : "Failed to verify widget package artifacts.", { cause: error });
+	}
+	try {
+		const publish = options.dryRun ? await publishWidgetPackageVersion({
+			owner: options.uploadOwner,
+			request,
+			dryRun: true,
+			fetchImpl: options.fetchImpl
+		}) : await publishWidgetPackageVersion({
+			client: options.client,
+			owner: options.uploadOwner,
+			request,
+			fetchImpl: options.fetchImpl
+		});
+		return {
+			build,
+			request,
+			publish
+		};
+	} catch (error) {
+		if (error instanceof WidgetToolingError) throw error;
+		if (error instanceof WidgetPackageUploadError) throw new WidgetToolingError(toPublicUploadErrorCode(error.code), error.message, { cause: error });
+		throw new WidgetToolingError("PUBLISH_FAILED", error instanceof Error ? error.message : "Failed to publish widget package.", { cause: error });
+	}
+}
+function toPublicUploadErrorCode(code) {
+	switch (code) {
+		case "SESSION_REQUEST_FAILED":
+		case "INVALID_SESSION_RESPONSE":
+		case "MISSING_SIGNED_URL":
+		case "CONTENT_TYPE_MISMATCH":
+		case "ARTIFACT_UPLOAD_FAILED":
+		case "COMPLETE_UPLOAD_FAILED":
+		case "INVALID_COMPLETE_RESPONSE": return code;
+		default: return "PUBLISH_FAILED";
+	}
+}
+//#endregion
+export { buildRuntimeEntryBootstrapScript as a, fluidWidgetDevPlugin as c, fluidOsV0WidgetPackageGitCredentialCreate as i, WidgetToolingError as l, loadAndValidateWidgetPackage as n, createDevWidgetPackageDescriptors as o, publishWidgetPackage as r, createWidgetDevServerConfig as s, buildWidgetPackage as t };
+
+//# sourceMappingURL=src-_wfDoBLp.mjs.map