@logic-joe/fleek 0.2.10 → 0.2.12

package/dist/fleek.mjs

@@ -1609,7 +1609,8 @@ var require_error_codes = __commonJS({
       // ONF-190: the browser proof failed because the request's refresh cookie names ANOTHER live web session of the same user (a
       // sign-in on another Fleek host replaced the shared cookie) - the web client renews its session at once (selected by the
       // HttpExceptionFilter from a server-owned request mark, never by a thrower)
-      "session_mismatch"
+      "session_mismatch",
+      "public_visibility"
     ];
     exports.WORKSPACE_APPS = ["chat", "projects", "documents", "whiteboards", "workflows"];
     exports.MAIL_DELIVERY_STATUSES = ["queued", "sending", "accepted", "ambiguous", "failed", "suppressed"];
@@ -4632,7 +4633,7 @@ var require_setup_session = __commonJS({
     exports.SETUP_SESSION_TTL_MINUTES = 30;
     exports.SETUP_SESSION_OPEN_MAX = 10;
     exports.SETUP_SESSION_CLAIM_LIMIT = 10;
-    exports.FLEEK_CLI_SETUP_VERSION_DEFAULT = "0.2.10";
+    exports.FLEEK_CLI_SETUP_VERSION_DEFAULT = "0.2.12";
     exports.FLEEK_CLI_PACKAGE = "@logic-joe/fleek";
     exports.FLEEK_CANONICAL_SERVER = "https://api.onfleek.app";
     exports.SETUP_CLIENT_APPS = ["claude-code", "codex", "orca", "cursor", "other"];
@@ -5303,6 +5304,39 @@ var require_skill_limits = __commonJS({
   }
 });
 
+// ../types/dist/agent-platform/refusal-hints.js
+var require_refusal_hints = __commonJS({
+  "../types/dist/agent-platform/refusal-hints.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.agentRefusalHint = agentRefusalHint;
+    var hints = {
+      public_visibility: {
+        code: "HUMAN_REQUIRED",
+        en: "Making a ticket public needs a person in the browser. Create it with internal visibility, then ask a person to publish it.",
+        de: "Ein Ticket darf nur eine Person im Browser veröffentlichen. Erstelle es intern und bitte eine Person, es zu veröffentlichen."
+      },
+      release_name: {
+        code: "INVALID_INPUT",
+        en: "Use 1–80 plain-text characters without @, mentions, markup, links, encoded references or control characters.",
+        de: "Verwende 1–80 Klartextzeichen ohne @, Erwähnungen, Markup, Links, kodierte Verweise oder Steuerzeichen."
+      },
+      setup_changing: {
+        code: "CONFLICT",
+        en: "The setup changed while it was being read, for example during an apply. Retry the setup read.",
+        de: "Das Setup wurde während des Lesens geändert, etwa beim Anwenden. Lies das Setup erneut."
+      }
+    };
+    function agentRefusalHint(code, details, locale2 = "en") {
+      const reason = details?.reason;
+      if (typeof reason !== "string" || !Object.hasOwn(hints, reason))
+        return;
+      const hint = hints[reason];
+      return hint.code === code ? hint[locale2] : void 0;
+    }
+  }
+});
+
 // ../types/dist/index.js
 var require_dist = __commonJS({
   "../types/dist/index.js"(exports) {
@@ -5341,6 +5375,7 @@ var require_dist = __commonJS({
     __exportStar(require_ticket_references(), exports);
     __exportStar(require_admin_todo(), exports);
     __exportStar(require_skill_limits(), exports);
+    __exportStar(require_refusal_hints(), exports);
   }
 });
 
@@ -31856,8 +31891,8 @@ var require_secret_shape = __commonJS({
       }
       return hostEnd > start2;
     }
-    function scanUrl(text6, start2, end, sep11) {
-      const authorityStart = sep11 + 3;
+    function scanUrl(text6, start2, end, sep10) {
+      const authorityStart = sep10 + 3;
       let authorityEnd = authorityStart;
       while (authorityEnd < end) {
         const code = text6.charCodeAt(authorityEnd);
@@ -31868,7 +31903,7 @@ var require_secret_shape = __commonJS({
       for (let i2 = authorityStart; i2 < authorityEnd; i2++)
         if (text6.charCodeAt(i2) === 64)
           return "url_userinfo";
-      const scheme = lowerAscii(text6, start2, sep11);
+      const scheme = lowerAscii(text6, start2, sep10);
       if (scheme !== "https" && scheme !== "http" || !validUrlHost(text6, authorityStart, authorityEnd))
         return scanTokens(text6, start2, end, true);
       const head = lowerAscii(text6, start2, Math.min(end, start2 + 48));
@@ -31907,9 +31942,9 @@ var require_secret_shape = __commonJS({
       }
       return null;
     }
-    function schemeStart(text6, sep11, floor) {
-      let s = sep11;
-      const limit = Math.max(floor, sep11 - 32);
+    function schemeStart(text6, sep10, floor) {
+      let s = sep10;
+      const limit = Math.max(floor, sep10 - 32);
       while (s > limit) {
         const code = text6.charCodeAt(s - 1);
         const letter = code >= 65 && code <= 90 || code >= 97 && code <= 122;
@@ -31918,7 +31953,7 @@ var require_secret_shape = __commonJS({
         else
           break;
       }
-      while (s < sep11) {
+      while (s < sep10) {
         const code = text6.charCodeAt(s);
         if (code >= 65 && code <= 90 || code >= 97 && code <= 122)
           return s;
@@ -36040,6 +36075,305 @@ var require_document_diff = __commonJS({
   }
 });
 
+// ../validation/dist/agent-error-details.js
+var require_agent_error_details = __commonJS({
+  "../validation/dist/agent-error-details.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.agentErrorDetails = agentErrorDetails2;
+    var types_1 = require_dist();
+    var string4 = (value) => typeof value === "string" && value.length > 0 && value.length <= 256;
+    var integer = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+    var list2 = (value) => Array.isArray(value) && value.length <= 128 && value.every(string4);
+    var oneOf3 = (values) => (value) => typeof value === "string" && values.includes(value);
+    var errors = (value) => Array.isArray(value) && value.length <= 64 && value.every((item2) => item2 && typeof item2 === "object" && !Array.isArray(item2) && Object.keys(item2).length === 2 && typeof item2.path === "string" && item2.path.length <= 256 && (item2.path === "" || item2.path.startsWith("/")) && typeof item2.code === "string" && /^[A-Z][A-Z0-9_]{0,63}$/.test(item2.code));
+    var changeRequest = (value) => typeof value === "string" && value.length > 0 && value.length <= 500;
+    var typeKeyBytes = (value) => typeof value === "string" && value.length > 0 && (0, types_1.issueTypeJsonBytes)(value) <= types_1.ISSUE_TYPE_LIMITS.entryKeyBytes;
+    var typeKeyList = (value) => Array.isArray(value) && value.length <= types_1.ISSUE_TYPE_LIMITS.entries && value.every(typeKeyBytes);
+    var uuid = (value) => typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(value);
+    var personRef = (value) => value === null || typeof value === "string" && value.length > 0 && value.length <= 64;
+    var transitionKeys = (value) => Array.isArray(value) && value.length <= 32 && value.every((item2) => typeof item2 === "string" && item2.length > 0 && item2.length <= 64 && /^[A-Za-z0-9_.:-]+$/.test(item2) && ([...types_1.TRANSITION_CONDITIONS, ...types_1.TRANSITION_REQUIRED_FIELDS].includes(item2) || /^[a-z0-9_.:-]+$/.test(item2)));
+    var bindingField = (value) => typeof value === "string" && value.length <= 130 && (/^state:(?:[a-z][a-z0-9_]{0,31}|\+[0-9a-f-]{36})\.(?:role|gate|omitted)$/.test(value) || /^rule:\+[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(value) || /^rule:(?:\*|[a-z][a-z0-9_]{0,31})>[a-z][a-z0-9_]{0,31}$/.test(value) || ["phases", "roles.defaultRole", "routeOptions", "clarification.maxQuestions", "clarification.maxQuestionsPerRound", "clarification.maxRounds", "clarification.answerWithinHours", "clarification.handoffRouteKey", "clarification.handoffUserId"].includes(value));
+    var schema = {
+      TICKET_TEXT_LIMIT: {},
+      TICKET_TEXT_FORMAT: {},
+      TICKET_TEXT_LOSSY_REPLACEMENT: {},
+      ACCESS_DENIED: { reason: oneOf3(["approval_denied", "field_right", "variant_admin"]), field: bindingField, changeRequest },
+      // ENGINE-AUTHORITY: engine setup refusals (`workflows.engine.*`) - closed lists only
+      CONFLICT: {
+        state: oneOf3(types_1.WORKFLOW_ENGINE_STATES),
+        stoppedReason: oneOf3(types_1.WORKFLOW_ENGINE_STOPPED_REASONS),
+        reason: oneOf3(["setup_changing", "releases_disabled", "release_closed", "name_taken", "active_limit", "too_many_open", "engine_authority_unavailable", "engine_not_admitted", "hidden_bindings", ...types_1.WORK_REQUEST_CONFLICT_REASONS, ...types_1.TRIAGE_CONFLICT_REASONS, ...types_1.KIT_CONFLICT_REASONS, ...types_1.STANDING_CONFLICT_REASONS, ...types_1.SETUP_CONFLICT_REASONS, ...types_1.SETUP_PROPOSAL_CONFLICT_REASONS, ...types_1.KNOWLEDGE_SETUP_REASONS, ...types_1.PROJECT_INIT_CONFLICT_REASONS, ...types_1.CUSTOMER_PROPOSAL_CONFLICT_REASONS, ...types_1.KNOWLEDGE_INGEST_REASONS, ...types_1.ACCESS_REQUEST_CONFLICT_REASONS, ...types_1.SERVICE_ACCOUNT_CONFLICT_REASONS, ...types_1.SETUP_SESSION_CONFLICT_REASONS]),
+        index: integer,
+        statementId: uuid,
+        // INGEST-RELEASE-UX: the draft parent page a release cannot publish along (`parent_unpublished`; only a page the caller can view)
+        parentId: uuid,
+        // PINIT-FIX-2: the application slot page a PROJECT-INIT adoption refused (closed list, no id)
+        slot: oneOf3(types_1.KNOWLEDGE_APPLICATION_SLOTS),
+        statementIds: (value) => Array.isArray(value) && value.length <= 200 && value.every(uuid),
+        fields: (value) => Array.isArray(value) && value.length <= 4 && value.every(oneOf3(["title", "summary", "diagram", "page", "parent"]))
+      },
+      // PRIVACY-WORKCTX: additive `holderRef` (person ref of the holder, null without a handle key / release owner)
+      ALREADY_CLAIMED: { holderLabel: string4, expiresAt: string4, holderRef: personRef },
+      CLAIMED_BY_OTHER: { holderLabel: string4, expiresAt: string4, holderRef: personRef },
+      CLAIM_REQUIRED: { issueIds: list2 },
+      RENEW_LIMIT: { hardExpiresAt: string4 },
+      NOT_READY: { readySelector: string4 },
+      REVISION_CONFLICT: { currentRevision: integer },
+      STATE_CONFLICT: { currentStateVersion: integer },
+      TYPED_COMMENT_IMMUTABLE: { kind: string4 },
+      // PRIVACY-WORKCTX: `assigneeId`, `userIds`, `userId` = wire names of declared person inputs (uniform refusal; never a value);
+      // P2: the workflow person inputs `botUserId`, `designerUserIds`, `ownerUserId`, `user` (spec / edit `assign.user`)
+      INVALID_INPUT: {
+        field: oneOf3([
+          "releaseId",
+          "projectReleaseId",
+          "moveOpenTo",
+          "targetDate",
+          "addressees",
+          "options",
+          "parent",
+          "artifacts",
+          "toUserId",
+          "optionId",
+          "assigneeId",
+          "userIds",
+          "userId",
+          "botUserId",
+          "designerUserIds",
+          "ownerUserId",
+          "user",
+          "data",
+          "inputs",
+          "value",
+          // A2A-DELIVERY AD-1 input fields
+          "after",
+          "agent",
+          "delegateAgent",
+          "neededBy",
+          "pickupMinutes",
+          "question",
+          "teamId",
+          "toAgent",
+          // ONF-142 (Codex B1): a referenced create-dialog image that cannot be bound (foreign, expired, unknown) refuses the create
+          "attachmentIds",
+          // A2A-DELIVERY AD-1b input fields (person addresses keep the uniform PRIVACY refusal shape)
+          "person",
+          "forPerson",
+          "requester",
+          "for",
+          "title",
+          "description",
+          "display",
+          "scope",
+          "kinds",
+          "requestId",
+          // AGD TEAM-RULES-a1: a transition plan over its bounds (TRANSITION_PLAN_LIMITS); a1.2 team process documents (N1 bounds,
+          // shape, states of the team, live deciders)
+          "issueIds",
+          "body",
+          "deciderUserIds",
+          "deciders",
+          "memberRoles",
+          "phases",
+          "rules",
+          "states",
+          // TEAMS-PROJECTS TP-4: Team (user group) create / rename
+          "handle",
+          // AGD CLARIFY-a: handoff (`assignTo` staff only, `reason` derived server-side) and the policy's escalation person
+          "assignTo",
+          "reason",
+          "handoffUserId",
+          // TES-219: a page's explicit space differs from its parent's space (documents.create / knowledge.createPage)
+          "spaceId",
+          // AGD GUIDE-a1: guidance version entries (bounded page list) and pin targets; a2: a role the server did not derive
+          "documentIds",
+          "versionId",
+          "role",
+          // AGD WORK-FOLDER-a: an assessment item (with `index`)
+          "items",
+          "subjectIssueId",
+          "targetTeamId",
+          "targetProjectId",
+          // AGD TRIAGE-a: the route field of an issue write, classification inputs, route option documents
+          "statePools",
+          "deciderPoolIds",
+          "fieldKeys",
+          "choices",
+          "clarification",
+          "stateMap",
+          "deliveryRoute",
+          "duplicates",
+          "type",
+          "route",
+          "priority",
+          "readinessAssessmentId",
+          "options",
+          // AGD QUICKVIEW-a: "Meine Arbeit" paging / navigation (sealed cursor, kind filter, page size) and the guest preview flag
+          "cursor",
+          "kind",
+          "limit",
+          "view",
+          "query",
+          // SKILL-REQ bounded fields: names of inputs only, never stored text.
+          "key",
+          "name",
+          "url",
+          "label",
+          "sourceUrl",
+          "packageVersion",
+          "purpose",
+          "installHints",
+          "item",
+          // KITS-a admin inputs (SETTINGS-AGENTWORK-b): pin targets, host address
+          "teamIds",
+          "origin",
+          "holder",
+          // AGD WORK-FOLDER-b: the gate role of a checklist read / readiness write
+          "gateRole",
+          // FOCUS-MODE FM-1: a malformed UI focus parameter (`@UiFocus()`; the grammar is the only reason)
+          "focus",
+          // AGD CLIENT-AI-a: a field outside the guest toolset's list (closed: the guest tools' own input fields)
+          ...types_1.CLIENT_AI_REFUSED_FIELDS,
+          // AGENT-SCOPE (AS-1): a refused installation scope / scoped area list (`scope`, `clientGroupId`, `teamIds`, `spaceIds`, `allowedAreas`)
+          ...types_1.AGENT_SCOPE_INVALID_FIELDS,
+          // AGD AGENT-RELEASE-b RB-3: a standing order's target (installation not scoped to exactly the group, group not exclusive)
+          ...types_1.STANDING_INVALID_FIELDS,
+          ...types_1.SETUP_INVALID_FIELDS,
+          ...types_1.SETUP_PROPOSAL_INVALID_FIELDS,
+          // AGD SETUP-KNOW: knowledge setup writer inputs
+          "area",
+          "applicationId",
+          "slot",
+          "documentId",
+          "pathHint",
+          "expectedRevision",
+          "condition",
+          "derivedFromVersionId",
+          "editSpaceIds",
+          // AGD SETUP-KNOW SK-5b: customer proposal inputs
+          ...types_1.CUSTOMER_PROPOSAL_INVALID_FIELDS,
+          // AGD PROJECT-INIT: the summary (with `path`), selection, customer, project key, run epoch
+          ...types_1.PROJECT_INIT_INVALID_FIELDS,
+          // PROJ-REPO-LINK: the repository reference (never echoes the value)
+          "repository",
+          // AGD-62 LJK-1: the typed result's acceptance verdict (work.complete; explicit, not only through the guest refusal list)
+          "acceptance",
+          // KNOW-INGEST: run / submit / review inputs (names only)
+          ...types_1.KNOWLEDGE_INGEST_INVALID_FIELDS,
+          // AGENT-ATTACH: the file of `issues.attachFile` (names only, never the value)
+          "fileName",
+          "content",
+          "mimeType",
+          "commentId",
+          // AGENT-ATTACH-2: the presigned upload of `issues.attachFileBegin` / `issues.attachFileComplete`
+          "size",
+          "uploadId",
+          // ACCESS-REQUESTS: request / decision / self request inputs (names only)
+          ...types_1.ACCESS_REQUEST_INVALID_FIELDS
+        ]),
+        index: integer,
+        path: (value) => (0, types_1.isProjectInitPath)(value) || (0, types_1.isKnowledgeSubmitPath)(value),
+        // WF-TF-2 `not_target_project`; WORK-FOLDER-b `human_only` = an agent assessment named an item only a human sets
+        reason: oneOf3(["release_name", ...types_1.WORK_REQUEST_INVALID_REASONS, "incompatible_work_filters", "not_target_project", "human_only", "system_item", ...types_1.SKILL_INVALID_REASONS, ...types_1.KIT_INVALID_INPUT_REASONS, ...types_1.SETUP_INVALID_REASONS, ...types_1.SETUP_PROPOSAL_INVALID_REASONS, ...types_1.KNOWLEDGE_SETUP_REASONS, ...types_1.PROJECT_INIT_INVALID_REASONS, ...types_1.KNOWLEDGE_INGEST_INVALID_REASONS]),
+        maxBytes: integer,
+        maxItems: integer,
+        messageKey: oneOf3(["agentWorkSkills.errors.fieldLimit", "agentWorkSkills.errors.countLimit"]),
+        // CFG-B4 (M2): a change draft's browser-only op names the server-built absolute settings link (`browserLink`, ?section=)
+        url: (value) => typeof value === "string" && value.length <= 512 && /^https?:\/\/[^\s<>"']+\?section=[a-z-]+$/.test(value)
+      },
+      HUMAN_REQUIRED: { reason: oneOf3(types_1.HUMAN_REQUIRED_REASONS) },
+      // W3 SETTINGS-AGENTWORK-b: closed validator reason + closed content path (never a caller key or text)
+      KIT_INVALID: { reason: oneOf3(types_1.KIT_ISSUE_REASONS), path: types_1.isKitIssuePath },
+      // AGD CLARIFY-a: a refused clarification question tells the agent protocol to hand off (`fleek_request_human`)
+      QUOTA_EXCEEDED: { dimension: string4, limit: integer, retryAfterSeconds: integer, hint: oneOf3(["request_human"]) },
+      // A2A-DELIVERY: never an identity
+      ADDRESSED_TO_OTHER_AGENT: { since: string4 },
+      ADDRESSED_TO_PERSON: { since: string4 },
+      WORK_ITEM_TAKEN: { takenByRef: personRef },
+      WORK_REQUEST_STATE: { state: oneOf3(types_1.WORK_REQUEST_DISPLAY) },
+      APP_DISABLED: { app: oneOf3(types_1.WORKSPACE_APPS) },
+      APPROVER_LACKS_RIGHTS: { missing: list2 },
+      RUN_EXISTS: { runId: string4 },
+      OUTPUTS_INVALID: { errors },
+      SPEC_INVALID: { errors },
+      DRAFT_CONFLICT: { currentDraftRevision: integer },
+      ROLE_UNRESOLVED: { roleKey: string4 },
+      ROLE_PRINCIPAL_NOT_ELIGIBLE: { userId: string4 },
+      ITEM_LIMIT: { limit: integer },
+      RESULT_TOO_LARGE: { limit: integer },
+      APPROVAL_MODE_NOT_ALLOWED: { mode: oneOf3([...types_1.WORKFLOW_APPROVAL_MODES, "inherit"]), workspaceMode: oneOf3(types_1.WORKFLOW_APPROVAL_MODES) },
+      BATCH_TOO_LARGE: { maxItems: integer, maxBytes: integer },
+      WORKFLOW_NOT_STARTABLE: { reason: oneOf3(types_1.WORKFLOW_NOT_STARTABLE_REASONS) },
+      WORKFLOW_TASK_RECONCILING: { retryAfterSeconds: integer },
+      WORKFLOW_TASK_RESULT_REQUIRED: { missing: list2 },
+      ISSUE_TYPE_NOT_ALLOWED: { type: typeKeyBytes, teamId: uuid, allowed: typeKeyList },
+      ISSUE_TYPE_CATALOG_MISSING: { reason: oneOf3(types_1.ISSUE_TYPE_CATALOG_MISSING_REASONS) },
+      ISSUE_TYPE_ARCHIVED: { typeId: uuid },
+      ISSUE_TYPE_IS_DEFAULT: { setCount: integer },
+      ISSUE_TYPE_SET_IN_USE: { teamCount: integer },
+      ISSUE_TYPE_SET_INVALID: { reason: oneOf3(types_1.ISSUE_TYPE_SET_INVALID_REASONS) },
+      ISSUE_TYPE_LIMIT: { limit: integer },
+      // TCONN-1: allowlisted reasons / capability column names only (never provider text)
+      TARGET_LOCATION_UNAVAILABLE: { reason: oneOf3(types_1.TARGET_ERROR_REASONS) },
+      TARGET_CONNECTION_REAUTH: { reason: oneOf3(types_1.TARGET_ERROR_REASONS) },
+      TARGET_PATH_INVALID: { reason: oneOf3(types_1.TARGET_ERROR_REASONS) },
+      TARGET_FILE_TOO_LARGE: { maxBytes: integer },
+      TARGET_CAPABILITY_MISSING: { reason: oneOf3(types_1.TARGET_ERROR_REASONS), capability: oneOf3(types_1.TARGET_CAPABILITIES) },
+      TARGET_ACCOUNT_MISMATCH: { reason: oneOf3(types_1.TARGET_ERROR_REASONS) },
+      // AGD TEAM-RULES-a1: ids / closed keys only (`missing` = condition / field keys, never content; restricted actors get none)
+      // AGD-51: `openPoints` = the same closed key shape (condition / checklist keys; only for a proven unrestricted human)
+      TRANSITION_DENIED: { reason: oneOf3(types_1.TRANSITION_DENIED_REASONS), toStateId: uuid, collectingStateId: uuid, missing: transitionKeys, openPoints: transitionKeys },
+      TEAM_PROCESS_INVALID: { reason: oneOf3(types_1.TEAM_PROCESS_INVALID_REASONS) },
+      FIELD_LOCKED: { field: oneOf3([...types_1.TEAM_PROCESS_LOCKED_FIELDS, "projectReleaseId"]) },
+      // AGD COST-LIMITS-a: the unit only (never an amount)
+      COST_LIMIT_REACHED: { unit: oneOf3(["tokens", "eur"]) },
+      // AGD TRIAGE-a: the project only
+      ROUTE_NOT_ALLOWED: { teamId: uuid },
+      // AGD KNOW-MAINT-a: a count only (never the ids of changes the reviewer may not review)
+      KNOWLEDGE_REVIEW_FORBIDDEN: { count: integer },
+      // AGD KNOW-MAINT-b: bounds, section ids of the proposal itself and counts only (never page ids or text)
+      KNOWLEDGE_RULE_SUBTREE_TOO_LARGE: { maxPages: integer },
+      KNOWLEDGE_REWRITE_REQUIRED: { sectionIds: (value) => Array.isArray(value) && value.length <= 20 && value.every((item2) => typeof item2 === "string" && /^(?:block:\d{1,8}|end)$/.test(item2)) },
+      KNOWLEDGE_REVIEW_PENDING: { count: integer },
+      // AGD GUIDE-a: closed reasons / ids only (never a page name or text)
+      GUIDANCE_INVALID: { reason: oneOf3(types_1.GUIDANCE_INVALID_REASONS), documentId: uuid },
+      // AGD PROC-TEMPLATES-a: closed reason, a document member or input field (never a value), its position
+      PROCESS_TEMPLATE_INVALID: { reason: oneOf3(types_1.PROCESS_TEMPLATE_INVALID_REASONS), field: (value) => bindingField(value) || oneOf3([...types_1.PROCESS_TEMPLATE_DOCUMENT_FIELDS, ...types_1.PROCESS_TEMPLATE_INPUT_FIELDS, ...types_1.TRANSITION_CONDITIONS, ...types_1.TRANSITION_REQUIRED_FIELDS])(value), index: integer },
+      RULE_PAGE_BUSY: { retryAfterSeconds: integer },
+      GUIDANCE_REQUIRED: { tool: oneOf3(["fleek_get_guidance"]) },
+      GUIDANCE_STALE: { tool: oneOf3(["fleek_get_guidance"]) },
+      // AGD WORK-FOLDER-a: the bound checklist version (null = none bound); WORK-FOLDER-b: the gate role of the fenced key
+      CHECKLIST_STALE: { boundVersionId: (value) => value === null || uuid(value), gateRole: oneOf3(types_1.GUIDANCE_CHECKLIST_GATE_ROLES) },
+      // AGD WORK-FOLDER-b: the closed reason only (never the object a native URL names)
+      ISSUE_LINK_INVALID: { reason: oneOf3(types_1.ISSUE_LINK_INVALID_REASONS) },
+      // AGENT-ATTACH: the decoded size limit of an inline agent file (the transport's own 413 carries no details)
+      CONTENT_TOO_LARGE: { maxBytes: integer },
+      // AGENT-ATTACH-2: the closed reason of a refused upload completion (never a storage detail)
+      ATTACHMENT_UPLOAD_INVALID: { reason: oneOf3(types_1.ATTACHMENT_UPLOAD_INVALID_REASONS) }
+    };
+    function agentErrorDetails2(code, value) {
+      if (!value || typeof value !== "object" || Array.isArray(value) || !Object.hasOwn(schema, code))
+        return;
+      const validators = schema[code];
+      const result = {};
+      for (const [name, validate] of Object.entries(validators)) {
+        const field = value[name];
+        if (validate(field))
+          result[name] = JSON.parse(JSON.stringify(field));
+      }
+      let bytes = 0;
+      for (const char of JSON.stringify(result)) {
+        const point = char.codePointAt(0);
+        bytes += point <= 127 ? 1 : point <= 2047 ? 2 : point <= 65535 ? 3 : 4;
+      }
+      if (!Object.keys(result).length || bytes > 4096)
+        return;
+      return result;
+    }
+  }
+});
+
 // ../validation/dist/index.js
 var require_dist2 = __commonJS({
   "../validation/dist/index.js"(exports) {
@@ -36090,16 +36424,17 @@ var require_dist2 = __commonJS({
     __exportStar(require_doc_statement(), exports);
     __exportStar(require_document_diff(), exports);
     __exportStar(require_zod_compat(), exports);
+    __exportStar(require_agent_error_details(), exports);
   }
 });
 
 // src/cli.ts
-var import_types10 = __toESM(require_dist(), 1);
+var import_types11 = __toESM(require_dist(), 1);
 import { spawn as spawn9 } from "node:child_process";
 import { createHash as createHash9, randomBytes as randomBytes12 } from "node:crypto";
-import { realpath as realpath20, rm as rm13 } from "node:fs/promises";
+import { rm as rm13 } from "node:fs/promises";
 import { hostname as osHostname2 } from "node:os";
-import { join as join33, sep as sep10 } from "node:path";
+import { join as join33 } from "node:path";
 import { parseArgs } from "node:util";
 
 // src/config.ts
@@ -37311,7 +37646,8 @@ var EN = {
   "kit.offline": "Server not reachable: status unknown. The installed kits keep working.",
   "kit.doubleE1": "{target}: Fleek Work Protocol installed twice (global and bundle). Run fleek kit pull again.",
   "kit.disabled": "{kit} removed from the bundle.",
-  "kit.cleanupPending": "Not cleaned up yet ({reason}): withdrawn kit files are still in {path}. Fix it and run fleek kit status again.",
+  "kit.cleanupPending": "Not cleaned up yet ({reason}): withdrawn kit files are still in {path}. Fix it and run {command}.",
+  "kit.cleanupPendingSummary": "Not cleaned up yet ({reason}): withdrawn kit files are still in {path}.",
   "kit.none": "No kits.",
   "kit.installed": "installed: {version}",
   "kit.localLine": "{project}: {kits}",
@@ -37493,7 +37829,7 @@ var EN = {
   "errors.kitProjectRequired": "Which project? Pass --project <key or id> (or run it in a pulled checkout).",
   "errors.kitKeyUnknown": "No project you can access has the key {key}.",
   "kit.formerOffline": "Could not check former project {project} (offline) - it is checked again next time.",
-  "errors.kitRunCleanupPending": "Withdrawn kit parts are still in {path} (cleanup pending). Not started - fix the reported problem, then run fleek kit status.",
+  "errors.kitRunCleanupPending": "Withdrawn kit parts from project {project} remain in {path}. Fix the reported problem, then run {command}.",
   "errors.kitRunCodexCheckout": "Codex reads kit skills only inside a project checkout. Start fleek kit run codex in the project's git checkout.",
   "errors.kitNoCheckout": "Not a git checkout.",
   "errors.kitNotPulled": "No kits pulled for {project}.",
@@ -38076,7 +38412,8 @@ var DE = {
   "kit.offline": "Server nicht erreichbar: Status unbekannt. Die installierten Kits funktionieren weiter.",
   "kit.doubleE1": "{target}: Fleek Work Protocol doppelt installiert (global und im Bundle). Führe fleek kit pull erneut aus.",
   "kit.disabled": "{kit} aus dem Bundle entfernt.",
-  "kit.cleanupPending": "Noch nicht aufgeräumt ({reason}): Zurückgezogene Kit-Dateien liegen noch in {path}. Behebe das und führe fleek kit status erneut aus.",
+  "kit.cleanupPending": "Noch nicht aufgeräumt ({reason}): Zurückgezogene Kit-Dateien liegen noch in {path}. Behebe das und führe {command} aus.",
+  "kit.cleanupPendingSummary": "Noch nicht aufgeräumt ({reason}): Zurückgezogene Kit-Dateien liegen noch in {path}.",
   "kit.none": "Keine Kits.",
   "kit.installed": "installiert: {version}",
   "kit.localLine": "{project}: {kits}",
@@ -38258,7 +38595,7 @@ var DE = {
   "errors.kitProjectRequired": "Welches Projekt? Nutze --project <Schlüssel oder ID> (oder führe es in einem Checkout mit geholten Kits aus).",
   "errors.kitKeyUnknown": "Kein Projekt, auf das du zugreifen kannst, hat den Schlüssel {key}.",
   "kit.formerOffline": "Früheres Projekt {project} konnte nicht geprüft werden (offline) - es wird beim nächsten Mal erneut geprüft.",
-  "errors.kitRunCleanupPending": "Zurückgezogene Kit-Teile liegen noch in {path} (Bereinigung ausstehend). Nicht gestartet - behebe das gemeldete Problem und führe dann fleek kit status aus.",
+  "errors.kitRunCleanupPending": "Zurückgezogene Kit-Teile aus Projekt {project} liegen noch in {path}. Behebe das gemeldete Problem und führe dann {command} aus.",
   "errors.kitRunCodexCheckout": "Codex liest Kit-Skills nur in einem Projekt-Checkout. Starte fleek kit run codex im Git-Checkout des Projekts.",
   "errors.kitNoCheckout": "Kein Git-Checkout.",
   "errors.kitNotPulled": "Für {project} sind keine Kits geholt.",
@@ -39764,6 +40101,8 @@ async function serveMcp(client, options) {
 }
 
 // src/mcp-proxy.ts
+var import_types3 = __toESM(require_dist(), 1);
+var import_validation = __toESM(require_dist2(), 1);
 var PROXY_LEGACY_VERSIONS = ["2025-11-25", "2025-06-18"];
 var DEFAULT_VERSION = PROXY_LEGACY_VERSIONS[0];
 var LINE_LIMIT = 1024 * 1024;
@@ -39906,12 +40245,17 @@ async function runProxy(options) {
       }
       if (response.status >= 400) {
         let code = response.status === 403 ? "ACCESS_DENIED" : response.status === 413 ? "CONTENT_TOO_LARGE" : "INVALID_INPUT";
+        let details;
         try {
           const parsed = JSON.parse(raw);
-          if (object2(parsed) && typeof parsed.error === "string" && CODE.test(parsed.error)) code = parsed.error;
+          if (object2(parsed)) {
+            if (typeof parsed.error === "string" && CODE.test(parsed.error)) code = parsed.error;
+            if (typeof parsed.code === "string" && Object.hasOwn(import_types3.AGENT_ERROR_CODES, parsed.code) && import_types3.AGENT_ERROR_CODES[parsed.code].mcpLegacy === parsed.error) code = parsed.code;
+            if (Object.hasOwn(import_types3.AGENT_ERROR_CODES, code)) details = (0, import_validation.agentErrorDetails)(code, parsed.details);
+          }
         } catch {
         }
-        throw new Refused(proxyError(id, code, code === "ACCESS_DENIED" ? "Fleek refused the request (access denied)." : `Fleek refused the request (${code}).`));
+        throw new Refused(proxyError(id, code, code === "ACCESS_DENIED" ? "Fleek refused the request (access denied)." : `Fleek refused the request (${code}).`, details ? { details } : {}));
       }
       throw new TransientError(response.status);
     }
@@ -48097,7 +48441,7 @@ function kitContentHash(content3) {
 }
 
 // ../kit-format/dist/payload.js
-var import_types3 = __toESM(require_dist(), 1);
+var import_types4 = __toESM(require_dist(), 1);
 var KIT_VERSION_PURPOSE = "fleek-kit/1";
 var KIT_STATUS_PURPOSE = "fleek-kit-status/1";
 var KIT_STATUS_STATES = ["current", "superseded", "revoked", "unsigned", "not_entitled"];
@@ -48169,7 +48513,7 @@ function parseVersionAttestationPayload(value) {
     workspaceId: matching(p.workspaceId, UUID, "$.workspaceId"),
     kitKey: kitKeyOf(p.kitKey, "$.kitKey"),
     kind: oneOf(p.kind, KIT_KINDS, "$.kind"),
-    role: oneOf(p.role, import_types3.PROJECT_MEMBER_ROLES, "$.role"),
+    role: oneOf(p.role, import_types4.PROJECT_MEMBER_ROLES, "$.role"),
     audienceClass,
     clientGroupId,
     version: version(p.version, "$.version"),
@@ -48200,7 +48544,7 @@ function parseStatusPayload(value) {
     return {
       kitKey: kitKeyOf(e.kitKey, `${path}.kitKey`),
       kind: oneOf(e.kind, KIT_KINDS, `${path}.kind`),
-      role: oneOf(e.role, import_types3.PROJECT_MEMBER_ROLES, `${path}.role`),
+      role: oneOf(e.role, import_types4.PROJECT_MEMBER_ROLES, `${path}.role`),
       pinnedVersion: version(e.pinnedVersion, `${path}.pinnedVersion`)
     };
   });
@@ -48898,7 +49242,7 @@ function projectFactsForStack(products, catalog = LJ_TECHNOLOGY_CATALOG) {
 }
 
 // src/kit-store.ts
-var import_types4 = __toESM(require_dist(), 1);
+var import_types5 = __toESM(require_dist(), 1);
 var STATE_VERSION = 1;
 var GEN = /^gen-[0-9a-f]{24}$/;
 var corrupt2 = (path) => new CliError("errors.kitStateCorrupt", EXIT.failed, { path }, "KIT_STATE_CORRUPT");
@@ -48911,7 +49255,7 @@ function validState(value, profileKey2, projectId) {
   if (typeof s.workspaceId !== "string" || typeof s.issuer !== "string" || !Array.isArray(s.kits) || s.kits.length > 64) return false;
   if (!s.targets || typeof s.targets !== "object" || !s.checkouts || typeof s.checkouts !== "object" || !Array.isArray(s.mcp) || typeof s.checkoutMode !== "boolean") return false;
   for (const kit2 of s.kits) {
-    if (!kit2 || !isKitKey(kit2.kitKey) || !KIT_KINDS.includes(kit2.kind) || !import_types4.PROJECT_MEMBER_ROLES.includes(kit2.role) || !KIT_PLACEMENTS.includes(kit2.placement) || !Number.isSafeInteger(kit2.version) || !Number.isSafeInteger(kit2.minVersion) || typeof kit2.contentHash !== "string" || typeof kit2.versionId !== "string") return false;
+    if (!kit2 || !isKitKey(kit2.kitKey) || !KIT_KINDS.includes(kit2.kind) || !import_types5.PROJECT_MEMBER_ROLES.includes(kit2.role) || !KIT_PLACEMENTS.includes(kit2.placement) || !Number.isSafeInteger(kit2.version) || !Number.isSafeInteger(kit2.minVersion) || typeof kit2.contentHash !== "string" || typeof kit2.versionId !== "string") return false;
   }
   for (const target of Object.keys(s.targets)) if (!KIT_TARGETS.includes(target)) return false;
   if (s.undecided !== void 0 && (!s.undecided || typeof s.undecided !== "object" || Array.isArray(s.undecided))) return false;
@@ -49676,7 +50020,7 @@ async function orcaPick(deps, values, start2) {
 }
 
 // src/start.ts
-var import_types5 = __toESM(require_dist(), 1);
+var import_types6 = __toESM(require_dist(), 1);
 import { basename as basename2, dirname as dirname6, isAbsolute as isAbsolute6 } from "node:path";
 
 // src/mutation.ts
@@ -49761,7 +50105,7 @@ async function liveFacts(client, task) {
   let step = null;
   if (stateId && tools.has("fleek_list_workflow_states")) {
     const state = (await pages(client, "fleek_list_workflow_states", { teamId: task.projectId }, 200)).find((row) => string3(row.id).toLowerCase() === stateId);
-    step = state && (0, import_types5.isOpenInStep)(state.role) ? state.role : null;
+    step = state && (0, import_types6.isOpenInStep)(state.role) ? state.role : null;
   }
   return { step, claims, providers };
 }
@@ -49881,8 +50225,8 @@ function receiptOf(run2) {
   };
 }
 function promptOf(profile, task, step, role, lang, claim) {
-  const text6 = (0, import_types5.openInStartText)({ workspace: profile.workspace.slug, ticket: task.key, step, role, locale: lang, claim });
-  return text6 && text6.length <= import_types5.OPEN_IN_TEXT_MAX ? text6 : null;
+  const text6 = (0, import_types6.openInStartText)({ workspace: profile.workspace.slug, ticket: task.key, step, role, locale: lang, claim });
+  return text6 && text6.length <= import_types6.OPEN_IN_TEXT_MAX ? text6 : null;
 }
 async function runStart(deps, input) {
   const { profile, task, root, program } = input;
@@ -49947,7 +50291,7 @@ async function runStart(deps, input) {
       key: task.key,
       title: neutralizeLine(task.title).slice(0, 120),
       agent: agent === "codex" ? "Codex" : agent === "claude" ? "Claude" : neutralizeLine(agent).slice(0, 32),
-      task: (0, import_types5.openInTask)(step, role, cliLang)
+      task: (0, import_types6.openInTask)(step, role, cliLang)
     };
     const state = delivered ? { branch: neutralizeLine(delivered.branch), sha: delivered.sha.slice(0, 10), date: delivered.date } : null;
     const question = [
@@ -53424,12 +53768,12 @@ async function validProgram(program, configDir) {
 }
 
 // src/link.ts
-var import_types6 = __toESM(require_dist(), 1);
+var import_types7 = __toESM(require_dist(), 1);
 import { stat as stat13 } from "node:fs/promises";
 import { dirname as dirname17 } from "node:path";
-var LINK_SCHEME = import_types6.OPEN_IN_LINK_SCHEME;
+var LINK_SCHEME = import_types7.OPEN_IN_LINK_SCHEME;
 function parseFleekLink(input) {
-  const link3 = (0, import_types6.parseOpenInLink)(input);
+  const link3 = (0, import_types7.parseOpenInLink)(input);
   return link3 ? { action: "orca-open", ...link3 } : null;
 }
 var refused = (key, code, params = {}) => new CliError(key, EXIT.failed, params, code);
@@ -53962,7 +54306,7 @@ import { spawn as spawn7 } from "node:child_process";
 import { randomBytes as randomBytes10 } from "node:crypto";
 import { readFile as readFile21, realpath as realpath16 } from "node:fs/promises";
 import { isAbsolute as isAbsolute10, join as join28, resolve as resolve6, sep as sep8 } from "node:path";
-var import_types7 = __toESM(require_dist(), 1);
+var import_types8 = __toESM(require_dist(), 1);
 
 // src/kit-keys.ts
 var KIT_KEYS = Object.freeze({
@@ -54040,7 +54384,7 @@ import { join as join26, resolve as resolve5 } from "node:path";
 
 // src/init-scan.ts
 import { spawn as spawn6 } from "node:child_process";
-var import_validation = __toESM(require_dist2(), 1);
+var import_validation2 = __toESM(require_dist2(), 1);
 import { createHash as createHash7 } from "node:crypto";
 import { constants as fsConstants4 } from "node:fs";
 import { lstat as lstat12, mkdir as mkdir8, open as open5, realpath as realpath15, writeFile as writeFile4 } from "node:fs/promises";
@@ -54135,7 +54479,7 @@ async function readJson(root, path) {
 }
 async function readSmall2(root, path, max) {
   try {
-    if (!(0, import_validation.evidencePathAllowed)(path)) return null;
+    if (!(0, import_validation2.evidencePathAllowed)(path)) return null;
     const realRoot = await realpath15(root), source = join25(root, path);
     if (await realpath15(source) !== join25(realRoot, ...path.split("/"))) return null;
     const seen = await lstat12(source);
@@ -54290,7 +54634,7 @@ async function scanFacts(checkout, app) {
   const stack = [];
   const add = (category, product, major, evidence) => {
     if (stack.some((entry) => entry.category === category && entry.product === product) || stack.length >= 60) return;
-    stack.push({ category, product, major, evidence: (0, import_validation.evidencePathAllowed)(evidence) ? [evidence] : [] });
+    stack.push({ category, product, major, evidence: (0, import_validation2.evidencePathAllowed)(evidence) ? [evidence] : [] });
   };
   const manifestPath = `${prefix}package.json`;
   const manifest = own4.includes(manifestPath) ? await readJson(checkout.root, manifestPath) : null;
@@ -54337,9 +54681,9 @@ async function scanFacts(checkout, app) {
     }
   }
   const stories = own4.filter((file) => /\.stories\.(?:tsx?|jsx?|mdx|vue|svelte)$/.test(file));
-  const configPath = own4.find((file) => /(?:^|\/)\.storybook\/main\.(?:[cm]?[jt]s)$/.test(file) && (0, import_validation.evidencePathAllowed)(file)) ?? null;
-  const patternConfig = own4.find((file) => /(?:^|\/)patternlab-config\.json$/.test(file) && (0, import_validation.evidencePathAllowed)(file)) ?? null;
-  const patternFiles = own4.filter((file) => /(?:^|\/)source\/_patterns\/.*\.(?:mustache|twig|hbs|handlebars|html|njk)$/.test(file) && (0, import_validation.evidencePathAllowed)(file));
+  const configPath = own4.find((file) => /(?:^|\/)\.storybook\/main\.(?:[cm]?[jt]s)$/.test(file) && (0, import_validation2.evidencePathAllowed)(file)) ?? null;
+  const patternConfig = own4.find((file) => /(?:^|\/)patternlab-config\.json$/.test(file) && (0, import_validation2.evidencePathAllowed)(file)) ?? null;
+  const patternFiles = own4.filter((file) => /(?:^|\/)source\/_patterns\/.*\.(?:mustache|twig|hbs|handlebars|html|njk)$/.test(file) && (0, import_validation2.evidencePathAllowed)(file));
   const hasPatternLabDependency = manifest !== null && Object.keys(dependencies(manifest)).some((name) => name.startsWith("@pattern-lab/"));
   const patternLab = patternConfig !== null || patternFiles.length > 0 || hasPatternLabDependency;
   const atomicLevel = (file) => file.match(/(?:^|\/)(?:\d+[-_])?(atoms|molecules|organisms|templates|pages)(?:\/|$)/)?.[1];
@@ -54356,24 +54700,24 @@ async function scanFacts(checkout, app) {
       return { name: name.slice(0, 120), ...parent && parent !== "." && parent !== name ? { group: parent.slice(0, 120) } : {}, path: file };
     }),
     ...patternFiles.slice(0, 200).map((file) => ({ name: posix3.basename(file).replace(/\.[^.]+$/, "").slice(0, 120), group: atomicLevel(file) ?? posix3.basename(posix3.dirname(file)), path: file }))
-  ].filter((c) => c.name && (0, import_validation.evidencePathAllowed)(c.path)).slice(0, 200);
+  ].filter((c) => c.name && (0, import_validation2.evidencePathAllowed)(c.path)).slice(0, 200);
   const designSources = {};
-  const tokenPath = own4.find((file) => /(?:^|\/)(?:tokens\.json|style-dictionary(?:\.config)?\.[cm]?[jt]s|style-dictionary\.config\.json)$/.test(file) && (0, import_validation.evidencePathAllowed)(file));
+  const tokenPath = own4.find((file) => /(?:^|\/)(?:tokens\.json|style-dictionary(?:\.config)?\.[cm]?[jt]s|style-dictionary\.config\.json)$/.test(file) && (0, import_validation2.evidencePathAllowed)(file));
   if (tokenPath) {
     designSources.tokens = { path: tokenPath, evidence: [tokenPath] };
     add("build", "design-tokens", null, tokenPath);
   }
-  const codeConnectPath = own4.find((file) => /(?:^|\/)figma\.config\.json$|\.figma\.[cm]?[jt]sx?$/.test(file) && (0, import_validation.evidencePathAllowed)(file));
+  const codeConnectPath = own4.find((file) => /(?:^|\/)figma\.config\.json$|\.figma\.[cm]?[jt]sx?$/.test(file) && (0, import_validation2.evidencePathAllowed)(file));
   if (codeConnectPath) {
     designSources.codeConnect = { present: true, configPath: codeConnectPath };
     add("ui_library", "figma-code-connect", null, codeConnectPath);
   }
-  if (rootPath && patternFiles[0] && (0, import_validation.evidencePathAllowed)(rootPath)) designSources.components = { path: rootPath, evidence: [patternFiles[0]] };
-  const figmaSources = own4.filter((file) => /(?:^|\/)figma\.config\.json$|\.figma\.[cm]?[jt]sx?$/.test(file) && (0, import_validation.evidencePathAllowed)(file)).slice(0, 3);
+  if (rootPath && patternFiles[0] && (0, import_validation2.evidencePathAllowed)(rootPath)) designSources.components = { path: rootPath, evidence: [patternFiles[0]] };
+  const figmaSources = own4.filter((file) => /(?:^|\/)figma\.config\.json$|\.figma\.[cm]?[jt]sx?$/.test(file) && (0, import_validation2.evidencePathAllowed)(file)).slice(0, 3);
   for (const file of figmaSources) {
     const content3 = await readSmall2(checkout.root, file, INIT_SCAN_LIMITS.fileBytes);
     const url = content3?.match(/https:\/\/(?:www\.)?figma\.com\/(?:file|design)\/[A-Za-z0-9_-]+(?:\/[A-Za-z0-9_-]+)?/)?.[0];
-    if (url && (0, import_validation.environmentUrlAllowed)(url)) {
+    if (url && (0, import_validation2.environmentUrlAllowed)(url)) {
       designSources.figmaFile = { url, evidence: [file] };
       break;
     }
@@ -54389,7 +54733,7 @@ async function scanFacts(checkout, app) {
   const inputs = checkout.files.filter((file) => !ignored(file) && (file.startsWith(prefix) && stagingAllowed(file.slice(prefix.length)) || !!prefix && rootInput(file)));
   const environmentNames = [];
   const environment = (name, file) => {
-    if (!/^[A-Za-z][A-Za-z0-9_-]{0,59}$/.test(name) || !(0, import_validation.evidencePathAllowed)(file) || environmentNames.length >= 30) return;
+    if (!/^[A-Za-z][A-Za-z0-9_-]{0,59}$/.test(name) || !(0, import_validation2.evidencePathAllowed)(file) || environmentNames.length >= 30) return;
     const known = environmentNames.find((entry) => entry.name === name);
     if (known) {
       if (!known.evidence.includes(file) && known.evidence.length < 3) known.evidence.push(file);
@@ -54432,7 +54776,7 @@ async function scanFacts(checkout, app) {
   }
   const base = {
     stack,
-    storybook: { present: stories.length > 0 || configPath !== null, configPath: configPath && (0, import_validation.evidencePathAllowed)(configPath) ? configPath : null, stories: stories.length },
+    storybook: { present: stories.length > 0 || configPath !== null, configPath: configPath && (0, import_validation2.evidencePathAllowed)(configPath) ? configPath : null, stories: stories.length },
     locales,
     ci,
     docker,
@@ -54440,7 +54784,7 @@ async function scanFacts(checkout, app) {
     ...Object.keys(designSources).length ? { designSources } : {},
     ...environmentNames.length ? { environmentNames } : {}
   };
-  const factsHash = createHash7("sha256").update((0, import_validation.projectInitCanonical)(base)).digest("hex");
+  const factsHash = createHash7("sha256").update((0, import_validation2.projectInitCanonical)(base)).digest("hex");
   return { facts: { ...base, factsHash }, components };
 }
 var ENV_EXAMPLE = /^\.env\.(?:example|sample|template)$/;
@@ -54479,7 +54823,7 @@ function stagingAllowed(relative3) {
   if (segments.some((segment) => STAGING_DENY.test(segment))) return false;
   const name = posix3.basename(relative3);
   const checkedPath = ENV_EXAMPLE.test(name) ? [...segments.slice(0, -1), "env-example"].join("/") : relative3;
-  if (!(0, import_validation.evidencePathAllowed)(checkedPath)) return false;
+  if (!(0, import_validation2.evidencePathAllowed)(checkedPath)) return false;
   if (/(?:^|[-.])lock(?:file)?(?:\.|$)|\.lock$|-lock\.|^yarn\.lock$|^pnpm-lock\.yaml$|^package-lock\.json$|^composer\.lock$|^Gemfile\.lock$|^go\.sum$/i.test(name)) return false;
   return ENV_EXAMPLE.test(name) || STAGING_ALLOW.some((pattern) => pattern.test(name)) || STAGING_ALLOW_PATH.some((pattern) => pattern.test(relative3));
 }
@@ -54564,7 +54908,7 @@ async function stageApplication(checkout, app, dir) {
       }
       const sourceBytes = bytes.length;
       if (envExample) bytes = Buffer.from(environmentKeys(bytes.toString("utf8")), "utf8");
-      if (designInputFile(file) && (0, import_validation.credentialShapeOf)(bytes.toString("utf8"))) {
+      if (designInputFile(file) && (0, import_validation2.credentialShapeOf)(bytes.toString("utf8"))) {
         skipped++;
         continue;
       }
@@ -55715,7 +56059,7 @@ function parseListing(result) {
   const seen = /* @__PURE__ */ new Set();
   return kits.map((raw) => {
     const k = raw;
-    if (!k || typeof k !== "object" || !isKitKey(k.kitKey) || seen.has(k.kitKey) || !KIT_KINDS.includes(String(k.kind)) || !import_types7.PROJECT_MEMBER_ROLES.includes(String(k.role)) || !Number.isSafeInteger(k.version) || k.version < 1 || typeof k.versionId !== "string" || !UUID.test(k.versionId) || typeof k.contentHash !== "string" || !/^[0-9a-f]{64}$/.test(k.contentHash) || !KIT_PLACEMENTS.includes(String(k.placement)) || !Number.isSafeInteger(k.parts) || k.parts < 1 || k.parts > KIT_MAX_PARTS) {
+    if (!k || typeof k !== "object" || !isKitKey(k.kitKey) || seen.has(k.kitKey) || !KIT_KINDS.includes(String(k.kind)) || !import_types8.PROJECT_MEMBER_ROLES.includes(String(k.role)) || !Number.isSafeInteger(k.version) || k.version < 1 || typeof k.versionId !== "string" || !UUID.test(k.versionId) || typeof k.contentHash !== "string" || !/^[0-9a-f]{64}$/.test(k.contentHash) || !KIT_PLACEMENTS.includes(String(k.placement)) || !Number.isSafeInteger(k.parts) || k.parts < 1 || k.parts > KIT_MAX_PARTS) {
       throw protocol("listing");
     }
     seen.add(k.kitKey);
@@ -55945,6 +56289,9 @@ function installedOf(kit2, previous2, downgraded) {
   const minVersion = downgraded ? kit2.version : Math.max(previous2?.minVersion ?? kit2.version, kit2.version);
   return { kitKey: kit2.kitKey, kind: kit2.kind, role: kit2.role, version: kit2.version, versionId: kit2.versionId, contentHash: kit2.contentHash, placement: kit2.placement, minVersion };
 }
+function cleanupStatusCommand(profileKey2, projectId) {
+  return `fleek --profile ${profileKey2} kit status --project ${projectId}`;
+}
 var tupleId = (kitKey, version2) => `${kitKey}@${version2}`;
 function checkoutTuples(checkouts) {
   const out = /* @__PURE__ */ new Map();
@@ -56255,7 +56602,7 @@ async function settleFormerProjects(ctx, profile, exclude) {
   return { pending, offline };
 }
 function reportFormer(ctx, settlement) {
-  for (const item2 of settlement?.pending ?? []) ctx.out.error(ctx.out.style.warn(ctx.t("kit.cleanupPending", { path: neutralizeLine(item2.root), reason: item2.reason })));
+  for (const item2 of settlement?.pending ?? []) ctx.out.error(ctx.out.style.warn(ctx.t("kit.cleanupPendingSummary", { path: neutralizeLine(item2.root), reason: neutralizeLine(item2.reason) })));
   for (const projectId of settlement?.offline ?? []) ctx.out.error(ctx.out.style.warn(ctx.t("kit.formerOffline", { project: projectId })));
 }
 async function staleKeyRefusal(ctx, profile, project) {
@@ -56414,7 +56761,7 @@ async function kitPull(ctx, projectRef, values, options = {}) {
       for (const entry of listedMcp) ctx.out.line(s.warn(ctx.t("kit.mcpManual", { target: entry.target, entry: s.cmd(neutralizeLine(`${entry.name} ${entry.url}`)) })));
       for (const key of unsigned2) ctx.out.line(s.warn(ctx.t("kit.unsignedPending", { kit: key })));
       ctx.out.line(s.ok(summary.changed ? ctx.t("kit.pulled", { count: installed.length }) : ctx.t("kit.upToDate")));
-      for (const pending of skippedRoots) ctx.out.error(s.warn(ctx.t("kit.cleanupPending", { path: neutralizeLine(pending.root), reason: pending.reason })));
+      for (const pending of skippedRoots) ctx.out.error(s.warn(ctx.t("kit.cleanupPending", { path: neutralizeLine(pending.root), reason: neutralizeLine(pending.reason), command: cleanupStatusCommand(profile.key, projectId) })));
       const runnable = targets.find((target) => KIT_CAPABILITIES[target].launcher);
       if (options.nextStep !== false && runnable && !skippedRoots.length && !former.pending.length) {
         ctx.out.line(`  ${ctx.t("next.step", { command: s.cmd(`fleek kit run ${runnable}${here ? "" : ` --project ${ref}`}`) })}`);
@@ -56548,7 +56895,7 @@ async function kitStatus(ctx, values, options = {}) {
       for (const [target, value] of Object.entries(e1)) if (value === "both") ctx.out.line(s.warn(ctx.t("kit.doubleE1", { target })));
       for (const key of withdrawn.keys()) ctx.out.line(s.warn(ctx.t("kit.disabled", { kit: key })));
       for (const tuple of checkoutWithdrawn) ctx.out.line(s.warn(ctx.t("kit.disabled", { kit: tuple })));
-      for (const pending of cleanupPending) ctx.out.error(s.warn(ctx.t("kit.cleanupPending", { path: neutralizeLine(pending.root), reason: pending.reason })));
+      for (const pending of cleanupPending) ctx.out.error(s.warn(ctx.t("kit.cleanupPending", { path: neutralizeLine(pending.root), reason: neutralizeLine(pending.reason), command: cleanupStatusCommand(profileHint.key, projectId) })));
       if (rows.some((row) => row.state === "update")) {
         ctx.out.line(`  ${ctx.t("next.step", { command: s.cmd(`fleek kit pull${values.project ? ` ${neutralizeLine(values.project)}` : ""}`) })}`);
       }
@@ -56640,6 +56987,20 @@ function defaultSpawn(program, args, options) {
     child.once("exit", (code, signal) => done(code ?? (signal ? 128 : 1)));
   });
 }
+async function assertKitCleanup(ctx, profileKey2) {
+  const pendingCleanup = [];
+  for (const projectId of await localProjects(ctx.configDir, profileKey2)) {
+    for (const item2 of await new KitDomain(ctx.configDir, profileKey2, projectId).cleanupPending()) pendingCleanup.push({ ...item2, projectId });
+  }
+  for (const item2 of pendingCleanup) ctx.out.error(ctx.out.style.warn(ctx.t("kit.cleanupPending", { path: neutralizeLine(item2.root), reason: neutralizeLine(item2.reason), command: cleanupStatusCommand(profileKey2, item2.projectId) })));
+  const here = await realpath16(ctx.deps.cwd ?? process.cwd()).catch(() => null);
+  const blocking = here ? pendingCleanup.find((item2) => here === item2.root || here.startsWith(item2.root + sep8)) : void 0;
+  if (blocking) throw new CliError("errors.kitRunCleanupPending", KIT_EXIT.revokedOrNotEntitled, {
+    path: neutralizeLine(blocking.root),
+    project: blocking.projectId,
+    command: cleanupStatusCommand(profileKey2, blocking.projectId)
+  }, "CLEANUP_PENDING");
+}
 async function kitRun(ctx, client, values, userArgs) {
   if (!client || !KIT_TARGETS.includes(client)) throw usage2();
   const target = client;
@@ -56664,11 +57025,7 @@ async function kitRun(ctx, client, values, userArgs) {
       else ctx.info(notice);
     }
   }
-  const pendingCleanup = await domain.cleanupPending();
-  for (const item2 of pendingCleanup) ctx.out.error(ctx.out.style.warn(ctx.t("kit.cleanupPending", { path: neutralizeLine(item2.root), reason: item2.reason })));
-  const here = await realpath16(ctx.deps.cwd ?? process.cwd()).catch(() => null);
-  const blocking = here ? pendingCleanup.find((item2) => here === item2.root || here.startsWith(item2.root + sep8)) : void 0;
-  if (blocking) throw new CliError("errors.kitRunCleanupPending", KIT_EXIT.revokedOrNotEntitled, { path: blocking.root }, "CLEANUP_PENDING");
+  await assertKitCleanup(ctx, profile.key);
   const gen = await domain.current();
   if (!gen) throw new CliError("errors.kitNotPulled", EXIT.failed, { project: projectId }, "KIT_NOT_PULLED");
   const state = gen.state.targets[target];
@@ -56740,7 +57097,7 @@ async function kitRun(ctx, client, values, userArgs) {
 
 // src/init.ts
 import { createHash as createHash8, randomUUID as randomUUID4 } from "node:crypto";
-var import_validation2 = __toESM(require_dist2(), 1);
+var import_validation3 = __toESM(require_dist2(), 1);
 import { constants as fsConstants5 } from "node:fs";
 import { lstat as lstat13, mkdir as mkdir10, mkdtemp as mkdtemp2, open as open6, readdir as readdir12, realpath as realpath17, rename as rename4, rm as rm11, writeFile as writeFile6 } from "node:fs/promises";
 import { tmpdir } from "node:os";
@@ -56831,11 +57188,11 @@ function instructions2(ctx, app, facts) {
     "",
     ...projectFactLines(de, facts),
     de ? "## Ausgabe" : "## Output",
-    de ? `Liefere genau ein JSON-Objekt: beim gedruckten manuellen Befehl nur JSON auf stdout (der Befehl schreibt atomar), sonst genau eine JSON-Datei \`agent-output.json\` im Ausgabeverzeichnis (erst \`.tmp\`, dann umbenennen), Format \`${import_validation2.PROJECT_INIT_AGENT_FORMAT}\`:` : `Return exactly one JSON object: with the printed manual command, only JSON on stdout (the command writes atomically), otherwise exactly one JSON file \`agent-output.json\` in the output directory (write \`.tmp\` first, then rename), format \`${import_validation2.PROJECT_INIT_AGENT_FORMAT}\`:`,
+    de ? `Liefere genau ein JSON-Objekt: beim gedruckten manuellen Befehl nur JSON auf stdout (der Befehl schreibt atomar), sonst genau eine JSON-Datei \`agent-output.json\` im Ausgabeverzeichnis (erst \`.tmp\`, dann umbenennen), Format \`${import_validation3.PROJECT_INIT_AGENT_FORMAT}\`:` : `Return exactly one JSON object: with the printed manual command, only JSON on stdout (the command writes atomically), otherwise exactly one JSON file \`agent-output.json\` in the output directory (write \`.tmp\` first, then rename), format \`${import_validation3.PROJECT_INIT_AGENT_FORMAT}\`:`,
     "",
     "```json",
     JSON.stringify({
-      format: import_validation2.PROJECT_INIT_AGENT_FORMAT,
+      format: import_validation3.PROJECT_INIT_AGENT_FORMAT,
       sections: { overview: "…", architecture: "…", componentsNote: "…", cmsNote: "…", integrationsNote: "…" },
       components: [{ name: "Button", group: "Basis", note: "…" }],
       cms: null,
@@ -56848,7 +57205,7 @@ function instructions2(ctx, app, facts) {
     }, null, 2),
     "```",
     "",
-    de ? `Grenzen: Abschnitte ≤ ${import_validation2.PROJECT_INIT_LIMITS.section} Zeichen, Hinweise ≤ ${import_validation2.PROJECT_INIT_LIMITS.reviewHints}, Datei ≤ 64 KiB. Einfacher Text mit Absätzen und Spiegelstrichen.` : `Bounds: sections <= ${import_validation2.PROJECT_INIT_LIMITS.section} characters, hints <= ${import_validation2.PROJECT_INIT_LIMITS.reviewHints}, file <= 64 KiB. Plain text with paragraphs and bullets.`
+    de ? `Grenzen: Abschnitte ≤ ${import_validation3.PROJECT_INIT_LIMITS.section} Zeichen, Hinweise ≤ ${import_validation3.PROJECT_INIT_LIMITS.reviewHints}, Datei ≤ 64 KiB. Einfacher Text mit Absätzen und Spiegelstrichen.` : `Bounds: sections <= ${import_validation3.PROJECT_INIT_LIMITS.section} characters, hints <= ${import_validation3.PROJECT_INIT_LIMITS.reviewHints}, file <= 64 KiB. Plain text with paragraphs and bullets.`
   ].join("\n");
 }
 function projectFactLines(de, facts) {
@@ -56937,7 +57294,7 @@ async function startAgent(ctx, values, stagingDir, outputFile, timeoutMs, app) {
       env,
       signal: ctx.deps.signal,
       timeoutMs: Math.max(1, timeoutMs),
-      maxBytes: import_validation2.PROJECT_INIT_LIMITS.summaryBytes
+      maxBytes: import_validation3.PROJECT_INIT_LIMITS.summaryBytes
     }));
     if (result.code !== 0) throw new CliError("errors.initAgentFailed", EXIT.failed, { code: result.code }, "AGENT_FAILED");
     const temporary = `${outputFile}.tmp`;
@@ -57065,7 +57422,7 @@ async function initCommand(ctx, values) {
       if (!apps.includes(app)) apps.push(app);
     }
   } else if (tty) {
-    const max = import_validation2.PROJECT_INIT_LIMITS.applicationsPerRun;
+    const max = import_validation3.PROJECT_INIT_LIMITS.applicationsPerRun;
     const defaults = candidates.filter((app) => !app.library).slice(0, max);
     const lines = [
       ctx.t("init.selectHeading", { count: candidates.length, max }),
@@ -57088,7 +57445,7 @@ async function initCommand(ctx, values) {
     if (picked === null) throw usage3("errors.initSelection", { max, project: values.project, app: candidates[0]?.key ?? "app" });
     apps = picked;
   } else throw usage3("errors.initYesNeedsApp");
-  if (apps.length > import_validation2.PROJECT_INIT_LIMITS.applicationsPerRun) throw usage3("errors.initTooManyApps", { max: import_validation2.PROJECT_INIT_LIMITS.applicationsPerRun });
+  if (apps.length > import_validation3.PROJECT_INIT_LIMITS.applicationsPerRun) throw usage3("errors.initTooManyApps", { max: import_validation3.PROJECT_INIT_LIMITS.applicationsPerRun });
   if (!apps.length) throw usage3("errors.initNoApps");
   const existing = context.applications.filter((entry) => entry.name !== null && APPLICATION_KEY.test(entry.key));
   const mapping = await mapApplications(ctx, apps, explicit, existing, tty && !values.yes, values.verbose);
@@ -57235,20 +57592,20 @@ async function runApplication(ctx, client, values, checkout, context, app, appli
   const staged = await stageApplication(checkout, app, stagingDir);
   const applicationKey = application.key;
   const input = {
-    format: import_validation2.PROJECT_INIT_INPUT_FORMAT,
+    format: import_validation3.PROJECT_INIT_INPUT_FORMAT,
     application: { key: applicationKey, name: application.name, path: app.path, kind: app.kind },
     facts,
     files: staged.files,
     base: known?.base ?? null,
     statements: Array.isArray(known?.statements) ? known.statements.slice(0, 100) : [],
-    outputFormat: import_validation2.PROJECT_INIT_AGENT_FORMAT
+    outputFormat: import_validation3.PROJECT_INIT_AGENT_FORMAT
   };
   const inputFile = join29(stagingDir, "fleek-input.json"), instructionsFile = join29(stagingDir, "FLEEK-INIT.md"), outputFile = join29(outputDir, "agent-output.json");
   await writeFile6(inputFile, `${JSON.stringify(input, null, 2)}
 `, { mode: 256 });
   await writeFile6(instructionsFile, `${instructions2(ctx, app, facts)}
 `, { mode: 256 });
-  const stagingDigest = createHash8("sha256").update(JSON.stringify([import_validation2.PROJECT_INIT_FORMAT, INIT_CLI_VERSION, staged.digest, facts.factsHash, input.base, input.statements])).digest("hex");
+  const stagingDigest = createHash8("sha256").update(JSON.stringify([import_validation3.PROJECT_INIT_FORMAT, INIT_CLI_VERSION, staged.digest, facts.factsHash, input.base, input.statements])).digest("hex");
   const idempotencyKey = values.yes ? `pi-${createHash8("sha256").update(JSON.stringify([context.project.teamId, applicationKey, checkout.commit, stagingDigest])).digest("hex")}` : `pi-${createHash8("sha256").update(`${runId}:${app.key}`).digest("hex")}`;
   if (values.yes && !values["dry-run"] && (await client.availableTools()).has(ACTION_STATUS_TOOL)) {
     const status = await client.callTool(ACTION_STATUS_TOOL, { action: WIRE.projectInitSubmit, idempotencyKey }).then((r) => r.structured).catch(() => null);
@@ -57287,18 +57644,18 @@ async function runApplication(ctx, client, values, checkout, context, app, appli
   let raw;
   try {
     const seen = await lstat13(outputFile);
-    if (!seen.isFile() || seen.nlink !== 1 || seen.size > import_validation2.PROJECT_INIT_LIMITS.summaryBytes) throw new Error("not a bounded file");
+    if (!seen.isFile() || seen.nlink !== 1 || seen.size > import_validation3.PROJECT_INIT_LIMITS.summaryBytes) throw new Error("not a bounded file");
     const handle = await open6(outputFile, fsConstants5.O_RDONLY | (fsConstants5.O_NOFOLLOW ?? 0) | (fsConstants5.O_NONBLOCK ?? 0));
     try {
       const info = await handle.stat();
       if (!info.isFile() || info.ino !== seen.ino || info.dev !== seen.dev || info.nlink !== 1) throw new Error("replaced");
-      const buffer = Buffer.alloc(import_validation2.PROJECT_INIT_LIMITS.summaryBytes + 1);
+      const buffer = Buffer.alloc(import_validation3.PROJECT_INIT_LIMITS.summaryBytes + 1);
       let length = 0;
       for (; ; ) {
         const { bytesRead } = await handle.read(buffer, length, buffer.length - length, length);
         if (bytesRead === 0) break;
         length += bytesRead;
-        if (length > import_validation2.PROJECT_INIT_LIMITS.summaryBytes) throw new Error("too large");
+        if (length > import_validation3.PROJECT_INIT_LIMITS.summaryBytes) throw new Error("too large");
       }
       raw = JSON.parse(buffer.subarray(0, length).toString("utf8"));
     } finally {
@@ -57307,33 +57664,33 @@ async function runApplication(ctx, client, values, checkout, context, app, appli
   } catch {
     raw = void 0;
   }
-  const agentOutput = raw === void 0 ? null : (0, import_validation2.parseProjectInitAgentOutput)(raw);
+  const agentOutput = raw === void 0 ? null : (0, import_validation3.parseProjectInitAgentOutput)(raw);
   if (!agentOutput?.ok) {
     emit(ctx, { event: "error", app: app.key, code: "output_invalid" });
     if (!ctx.json) ctx.out.error(ctx.out.style.fail(ctx.t("init.outputInvalid", { app: app.key, field: agentOutput && !agentOutput.ok ? agentOutput.issues[0]?.path || "-" : "-" })));
     return "failed";
   }
-  const composed = (0, import_validation2.composeProjectInitSummary)({
+  const composed = (0, import_validation3.composeProjectInitSummary)({
     application: { key: applicationKey, name: application.name, path: app.path, kind: app.kind },
     source: { commit: checkout.commit, dirty: checkout.dirty, analyzedAt: new Date(ctx.now()).toISOString(), cliVersion: INIT_CLI_VERSION, kitVersion: null, agent: started ? "claude_code" : "manual" },
     facts,
     components
   }, agentOutput.value, input.statements);
-  const parsed = (0, import_validation2.parseProjectInitSummary)(composed);
+  const parsed = (0, import_validation3.parseProjectInitSummary)(composed);
   if (!parsed.ok) {
     emit(ctx, { event: "error", app: app.key, code: "output_invalid" });
     if (!ctx.json) ctx.out.error(ctx.out.style.fail(ctx.t("init.outputInvalid", { app: app.key, field: parsed.issues[0]?.path || "-" })));
     return "failed";
   }
-  const findings = (0, import_validation2.scanProjectInit)(parsed.value);
-  const summary = (0, import_validation2.stripProjectInitFindings)(parsed.value, findings);
+  const findings = (0, import_validation3.scanProjectInit)(parsed.value);
+  const summary = (0, import_validation3.stripProjectInitFindings)(parsed.value, findings);
   const removed = findings.map((finding) => ({ path: finding.path, reason: finding.reason }));
   if (!summary) {
     emit(ctx, { event: "error", app: app.key, code: "application_unusable" });
     if (!ctx.json) ctx.out.error(ctx.out.style.fail(ctx.t("init.unusable", { app: app.key })));
     return "failed";
   }
-  const warnings = (0, import_validation2.projectInitWarnings)(summary).length;
+  const warnings = (0, import_validation3.projectInitWarnings)(summary).length;
   emit(ctx, { event: "checked", app: app.key, removed, warnings });
   if (!ctx.json) {
     const s = ctx.out.style;
@@ -57385,7 +57742,7 @@ async function runApplication(ctx, client, values, checkout, context, app, appli
 }
 
 // src/service.ts
-var import_types8 = __toESM(require_dist(), 1);
+var import_types9 = __toESM(require_dist(), 1);
 import { spawn as spawn8 } from "node:child_process";
 import { randomBytes as randomBytes11, randomUUID as randomUUID5 } from "node:crypto";
 import { constants as fsConstants6 } from "node:fs";
@@ -57487,7 +57844,7 @@ var TokenFilter = class {
 var usage4 = () => new CliError("errors.usage", EXIT.usage, {}, "USAGE");
 function normalizeSetupCode(value) {
   const code = (value ?? "").toUpperCase().replace(/[\s-]/g, "");
-  if (code.length !== import_types8.SERVICE_ACCOUNT_USER_CODE_LENGTH || [...code].some((char) => !import_types8.SERVICE_ACCOUNT_USER_CODE_CHARSET.includes(char))) throw usage4();
+  if (code.length !== import_types9.SERVICE_ACCOUNT_USER_CODE_LENGTH || [...code].some((char) => !import_types9.SERVICE_ACCOUNT_USER_CODE_CHARSET.includes(char))) throw usage4();
   return code;
 }
 function serverArg(value) {
@@ -58371,7 +58728,7 @@ function realSystem(options = {}) {
 }
 
 // src/setup.ts
-var import_types9 = __toESM(require_dist(), 1);
+var import_types10 = __toESM(require_dist(), 1);
 import { hostname } from "node:os";
 import { join as join32, resolve as resolve8 } from "node:path";
 import { realpath as realpath19 } from "node:fs/promises";
@@ -58534,7 +58891,7 @@ function createSetupProxyAdapter(ctx) {
 // src/setup.ts
 async function setupCommand(ctx, code, values) {
   const normalized = (code ?? "").replace(/-/g, "").toUpperCase();
-  if (normalized.length !== 8 || [...normalized].some((char) => !import_types9.SERVICE_ACCOUNT_USER_CODE_CHARSET.includes(char))) {
+  if (normalized.length !== 8 || [...normalized].some((char) => !import_types10.SERVICE_ACCOUNT_USER_CODE_CHARSET.includes(char))) {
     throw new CliError("errors.setupCode", EXIT.usage, {}, "INVALID_SETUP_CODE");
   }
   registerSecret(code);
@@ -59210,7 +59567,7 @@ function derivedClientId(origin) {
   const url = new URL(origin);
   const labels = url.hostname.split(".");
   if (url.protocol !== "https:" || labels.length < 3) return null;
-  return (0, import_types10.fleekCliClientId)(`https://app.${labels.slice(1).join(".")}`);
+  return (0, import_types11.fleekCliClientId)(`https://app.${labels.slice(1).join(".")}`);
 }
 function validClientId(value) {
   let url;
@@ -59410,7 +59767,7 @@ async function login(ctx, values, guided = false) {
         throw new CliError(pending.expiresAt <= ctx.now() ? "errors.setupDeviceExpired" : "errors.setupDeviceRestart", EXIT.needsLogin, {}, "EXPIRED_TOKEN");
       }
       registerSecret(pending.accessToken);
-      const uri = `${(0, import_types10.serviceDeviceVerificationOrigin)(info.issuer)}/device`;
+      const uri = `${(0, import_types11.serviceDeviceVerificationOrigin)(info.issuer)}/device`;
       device = {
         deviceCode: pending.accessToken,
         userCode: saved.userCode,
@@ -59695,7 +60052,7 @@ async function work(ctx, sub, args, values) {
         WIRE.claim,
         {
           issueId: id,
-          purpose: oneOf2(values.purpose, import_types10.CLAIM_PURPOSES) ?? "work",
+          purpose: oneOf2(values.purpose, import_types11.CLAIM_PURPOSES) ?? "work",
           ...values.ttl ? { ttlMinutes: int(values.ttl, 1, 1440) } : {},
           ...values.note ? { note: text5(values.note, 280) } : {}
         },
@@ -59714,7 +60071,7 @@ async function work(ctx, sub, args, values) {
       );
     case "release":
     case "complete": {
-      const outcome = sub === "release" ? oneOf2(values.outcome, import_types10.CLAIM_RELEASE_OUTCOMES, true) : oneOf2(values.outcome, import_types10.CLAIM_COMPLETE_OUTCOMES, true);
+      const outcome = sub === "release" ? oneOf2(values.outcome, import_types11.CLAIM_RELEASE_OUTCOMES, true) : oneOf2(values.outcome, import_types11.CLAIM_COMPLETE_OUTCOMES, true);
       return write(
         ctx,
         client,
@@ -60486,12 +60843,10 @@ async function kitAuto(ctx, values, client, passthrough) {
       return await kitRun({ ...kitCtx, deps: { ...ctx.deps, spawn: spawnWith } }, client, { ...values, project: found.projectId, orcaLaunch: true, program }, passthrough);
     } catch (error) {
       if (!(error instanceof CliError) || !["NEEDS_LOGIN", "TRANSIENT", "KIT_PROXY_UNAVAILABLE", "RATE_LIMITED", "UNAVAILABLE_ON_SERVER"].includes(error.code ?? "")) throw error;
-      const here = await realpath20(cwd), pending = domain ? await domain.cleanupPending() : [];
-      const blocking = pending.find((item2) => here === item2.root || here.startsWith(item2.root + sep10));
-      if (blocking) throw new CliError("errors.kitRunCleanupPending", KIT_EXIT.revokedOrNotEntitled, { path: blocking.root }, "CLEANUP_PENDING");
+      await assertKitCleanup(kitCtx, found.profile.key);
       ctx.out.error(ctx.s.warn(ctx.t(values["dry-run"] ? "kit.autoDryRunFallback" : "kit.autoFallback", { code: error instanceof CliError ? error.code ?? error.key : "INTERNAL" })));
     }
-  }
+  } else if (found) await assertKitCleanup(kitContext(ctx, values, found), found.profile.key);
   if (values["dry-run"]) {
     ctx.out.json({ program, args: passthrough, attached: false });
     return EXIT.ok;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logic-joe/fleek",
-  "version": "0.2.10",
+  "version": "0.2.12",
   "description": "fleek - command line client for the Fleek agent hub (MCP over OAuth, OS keychain, signed role/project kits)",
   "license": "Apache-2.0",
   "type": "module",