@memberjunction/cli 6.2.0-edge.4 → 6.2.0-edge.6

package/dist/init-templates/citizen-builder/README.md

@@ -6,6 +6,16 @@
 
 ---
 
+## 📋 Before You Start (Prerequisites)
+
+1. **Docker Desktop** installed and running ([Download Docker Desktop](https://www.docker.com/products/docker-desktop)):
+   - Allocate at least **8–12 GB of RAM** to Docker Desktop in **Settings → Resources** (SQL Server + MJAPI + MJExplorer run together inside the container stack).
+2. **Node.js 20+** installed on your machine ([Download Node.js](https://nodejs.org/)) — required only if you run `npx @memberjunction/cli agent init` directly on your host machine.
+3. **One LLM API Key** (OpenAI, Anthropic, Google Gemini, Groq, or Mistral).
+4. **Windows / PowerShell Note**: When running headless test prompts with quotes or multiple lines on Windows PowerShell, pass `-f /work/<prompt-file.txt>` (`--prompt-file`) to `mj ai agents run` instead of inline `-p "..."` strings to avoid PowerShell quote stripping.
+
+---
+
 ## ⚡ Getting Started (Choose Your Path)
 
 ### Option A: The Agent-Driven Path (Recommended — Zero Manual Setup)
@@ -63,8 +73,8 @@ The **Citizen Agent Builder** provides an isolated, local MemberJunction environ
 * **`sqlserver` (Port 1433)**: Microsoft SQL Server 2022.
 * **`mj` (Ports 4000 & 4202)**: A Node 24 container that executes `mj install` on first boot, provisions the database schema, installs business context (More Cheese default, or enterprise apps like Blue Cypress), and serves:
   * **MJAPI** at `http://localhost:4000` (GraphQL API and agent execution engine).
-  * **MJExplorer** at `http://localhost:4202` (Web UI for testing agents and viewing records; port 4202 is an authorized redirect URI for Auth0/MSAL).
-* **Metadata Directory (`./metadata`)**: Local JSON and Markdown files mapped into the container. Pushing metadata to the database is done with a single command (`./scripts/sync-metadata.sh`).
+  * **MJExplorer** at `http://localhost:4202` (Web UI for testing agents and viewing records; zero-config Local Dev Auth is enabled by default on localhost, and port 4202 is also an authorized redirect URI for Auth0/MSAL).
+* **Metadata Directory (`./metadata`)**: Local JSON and Markdown files mapped into the container. Pushing metadata to the database is done with a single command (`./scripts/sync-metadata.sh`, which runs `mj sync push --dir /work/metadata`).
 
 ### Available Agent Tools & CLI Commands
 
@@ -151,7 +161,8 @@ Always enforce these constraints when authoring agents:
 1. **`ModelSelectionMode: "Agent Type"`**: Never hardcode specific provider models (`gpt-4o`, `claude-3-5-sonnet`). The destination environment maps models to Agent Types.
 2. **`ExposeAsAction: false`**: Do not set `true` unless the user explicitly wants other agents to call this agent as an action.
 3. **Dynamic Record Resolution**: Never hardcode record IDs or personal names. Use queries, parameters, or lookup actions.
-4. **Prefer `Flow` Agents**: Use `Flow` agents for predictable step-by-step tasks. Use `Loop` only for dynamic problem-solving with open-ended tool calling.
+4. **Prefer `Loop` Agents by Default**: Use `Loop` agents (`@lookup:MJ: AI Agent Types.Name=Loop`) for interactive, conversational, and exploratory Citizen Builder agents where the agent calls actions/tools and responds to the user. Use `Flow` agents (`@lookup:MJ: AI Agent Types.Name=Flow`) only when you want a fixed, non-interactive deterministic step graph.
+5. **`ArtifactCreationMode: "Never"`**: Valid values are `"Never"`, `"Always"`, or `"System Only"` (never `"None"`).
 
 ---
 
@@ -165,7 +176,7 @@ Always enforce these constraints when authoring agents:
    * **No `sync` Blocks**: Do not author `sync` blocks (`lastModified`, `checksum`). `mj sync push` manages these automatically.
    * **Assign Deterministic UUIDs**: Assign a fresh uppercase UUID for `primaryKey` (e.g. via CLI `uuidgen | tr '[:lower:]' '[:upper:]'`).
    * **Use Dynamic References**:
-     - `@lookup:<EntityName>.<FieldName>=<Value>` for foreign keys (e.g. `@lookup:MJ: AI Agent Types.Name=Flow`).
+     - `@lookup:<EntityName>.<FieldName>=<Value>` for foreign keys (e.g. `@lookup:MJ: AI Agent Types.Name=Loop`).
      - `@file:<relativePath>` for external template files (e.g. `@file:templates/<slug>.template.md`). Note that `@file:` paths are resolved at push time; running `./scripts/sync-metadata.sh` updates the database.
      - `@parent:ID` for linking child records to parent records in nested structures.
 
@@ -173,7 +184,7 @@ Always enforce these constraints when authoring agents:
    * Prompt Markdown template: `metadata/prompts/templates/<slug>.template.md`
    * Prompt metadata JSON: `metadata/prompts/.<slug>-prompt.json`
    * Agent metadata JSON: `metadata/agents/.<slug>-agent.json`
-   *(See `metadata/agents/.customer-insight-agent.json` for a reference Flow agent).*
+   *(See `metadata/agents/.customer-insight-agent.json` for a reference Loop agent).*
 
 4. **Push to Local Database**:
    ```bash
@@ -191,6 +202,8 @@ Always enforce these constraints when authoring agents:
    You can trigger test runs directly via CLI with structured output:
    ```bash
    docker compose exec -T mj mj ai agents run -a "<Agent Name>" -p "<Test Input>" --format json
+   # On Windows PowerShell or with multi-line inputs, pass a file via -f (--prompt-file):
+   docker compose exec -T mj mj ai agents run -a "<Agent Name>" -f /work/test-input.txt --format json
    ```
 
 3. **Diagnosing Errors & Auditing Execution Traces**:

package/dist/init-templates/citizen-builder/docker-compose.yml

@@ -1,4 +1,4 @@
-name: mj-citizen-builder
+name: ${COMPOSE_PROJECT_NAME:-mj-citizen-builder}
 
 services:
   sqlserver:
@@ -9,7 +9,7 @@ services:
       ACCEPT_EULA: "Y"
       MSSQL_SA_PASSWORD: "${DB_PASSWORD:-TestPassword123!}"
     ports:
-      - "${DB_PORT:-1433}:1433"
+      - "127.0.0.1:${DB_PORT:-1433}:1433"
     healthcheck:
       test: /opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P "$$MSSQL_SA_PASSWORD" -Q "SELECT 1" -C -No
       interval: 10s
@@ -33,8 +33,8 @@ services:
       sqlserver:
         condition: service_healthy
     ports:
-      - "${API_PORT:-4000}:4000"
-      - "${EXPLORER_PORT:-4202}:4200"
+      - "127.0.0.1:${API_PORT:-4000}:4000"
+      - "127.0.0.1:${EXPLORER_PORT:-4202}:4200"
     environment:
       DB_HOST: "sqlserver"
       DB_PORT: "1433"
@@ -43,7 +43,8 @@ services:
       DB_DATABASE: "${DB_DATABASE:-MemberJunction}"
       # Tells the entrypoint which MemberJunction release `mj install` must fetch
       MJ_VERSION: "${MJ_VERSION}"
-      MJ_BASE_ENCRYPTION_KEY: "${MJ_BASE_ENCRYPTION_KEY:-0123456789abcdef0123456789abcdef}"
+      MJ_BASE_ENCRYPTION_KEY: "${MJ_BASE_ENCRYPTION_KEY:-MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=}"
+      MJ_DEV_AUTH_ENABLED: "${MJ_DEV_AUTH_ENABLED:-true}"
       # LLM Provider API Keys
       AI_VENDOR_API_KEY__OpenAILLM: "${OPENAI_API_KEY:-}"
       AI_VENDOR_API_KEY__AnthropicLLM: "${ANTHROPIC_API_KEY:-}"

package/dist/init-templates/citizen-builder/metadata/.mj-sync.json

@@ -1,7 +1,10 @@
 {
-  "version": "1.0",
-  "directories": [
-    "agents",
-    "prompts"
+  "version": "1.0.0",
+  "push": {
+    "autoCreateMissingRecords": true
+  },
+  "directoryOrder": [
+    "prompts",
+    "agents"
   ]
 }

package/dist/init-templates/citizen-builder/metadata/agents/.customer-insight-agent.json

@@ -3,13 +3,13 @@
     "fields": {
       "Name": "Customer Insight Specialist",
       "CategoryID": "@lookup:MJ: AI Agent Categories.Name=Assistant",
-      "Description": "Deterministic flow agent that summarizes customer activity, evaluates account standing, and suggests next actions.",
-      "TypeID": "@lookup:MJ: AI Agent Types.Name=Flow",
+      "Description": "Interactive Loop agent that summarizes customer activity, evaluates account standing, and suggests next actions.",
+      "TypeID": "@lookup:MJ: AI Agent Types.Name=Loop",
       "Status": "Active",
       "ExecutionOrder": 0,
       "ExposeAsAction": false,
       "IconClass": "mj-icon-user-check",
-      "ArtifactCreationMode": "None",
+      "ArtifactCreationMode": "Never",
       "PayloadDownstreamPaths": "*",
       "PayloadUpstreamPaths": "*",
       "EnableContextCompression": false,
@@ -22,29 +22,33 @@
             "AgentID": "@parent:ID",
             "PromptID": "@lookup:MJ: AI Prompts.Name=Customer Insight Specialist Prompt",
             "Status": "Active",
-            "ExecutionOrder": 1
+            "ExecutionOrder": 0
           },
           "primaryKey": {
             "ID": "E9A0C381-645F-4D2A-883F-E19C69D3B511"
           }
         }
       ],
-      "MJ: AI Agent Steps": [
+      "MJ: AI Agent Actions": [
         {
           "fields": {
             "AgentID": "@parent:ID",
-            "Name": "Generate Customer Insights",
-            "Description": "Evaluates account data using the Customer Insight Specialist Prompt",
-            "StepType": "Prompt",
-            "StartingStep": true,
-            "PromptID": "@lookup:MJ: AI Prompts.Name=Customer Insight Specialist Prompt",
-            "Status": "Active",
-            "PositionX": 100,
-            "PositionY": 100
+            "ActionID": "@lookup:MJ: Actions.Name=Run Ad-hoc Query",
+            "Status": "Active"
           },
           "primaryKey": {
             "ID": "D2E49B18-091A-4832-B81E-A38C91307D55"
           }
+        },
+        {
+          "fields": {
+            "AgentID": "@parent:ID",
+            "ActionID": "@lookup:MJ: Actions.Name=Run Stored Query",
+            "Status": "Active"
+          },
+          "primaryKey": {
+            "ID": "C8B29A14-312E-4981-9B1F-55913A7C2044"
+          }
         }
       ]
     },

package/dist/init-templates/citizen-builder/metadata/prompts/.customer-insight-prompt.json

@@ -2,8 +2,10 @@
   {
     "fields": {
       "Name": "Customer Insight Specialist Prompt",
-      "Description": "Analyzes customer profile data and recent orders to provide executive account insights.",
+      "Description": "System prompt for the Customer Insight Specialist agent. Analyzes customer profile data and recent activity to provide executive account insights.",
       "CategoryID": "@lookup:MJ: AI Prompt Categories.Name=Agent Type System Prompts",
+      "PromptRole": "System",
+      "PromptPosition": "First",
       "TypeID": "@lookup:MJ: AI Prompt Types.Name=Chat",
       "Status": "Active",
       "TemplateText": "@file:templates/customer-insight.template.md"

package/dist/init-templates/citizen-builder/metadata/prompts/templates/customer-insight.template.md

@@ -2,6 +2,14 @@
 
 You are an expert customer account analyst. Your goal is to review customer profile data and order history, then synthesize a concise executive summary with actionable recommendations.
 
+## User Request
+{{ userMessage }}
+
+## Available Payload Data
+```json
+{{ payload | dump(2) }}
+```
+
 ## Instructions
 1. Analyze the customer account details, active status, and recent activity.
 2. Review any open orders or pending balances.

package/dist/init-templates/citizen-builder/scripts/docker-entrypoint.sh

@@ -58,31 +58,37 @@ if [ ! -f "$STATE_DIR/provisioned" ]; then
   echo "========================================================================"
 
   if [ ! -f "$STATE_DIR/core-installed" ]; then
-    # Generate install configuration
-    cat << EOF > /tmp/install.config.json
-{
-  "PackageManager": "pnpm",
-  "dbUrl": "$DB_HOST",
-  "dbInstance": "",
-  "dbTrustServerCertificate": "Y",
-  "dbDatabase": "$DB_DATABASE",
-  "dbPort": $DB_PORT,
-  "codeGenLogin": "sa",
-  "codeGenPwD": "$DB_PASSWORD",
-  "mjAPILogin": "sa",
-  "mjAPIPwD": "$DB_PASSWORD",
-  "graphQLPort": 4000,
-  "authType": "Local",
-  "createNewUser": "Y",
-  "userEmail": "admin@memberjunction.org",
-  "userFirstName": "Admin",
-  "userLastName": "User",
-  "userName": "admin",
-  "openAIAPIKey": "${AI_VENDOR_API_KEY__OpenAILLM:-}",
-  "anthropicAPIKey": "${AI_VENDOR_API_KEY__AnthropicLLM:-}",
-  "geminiAPIKey": "${AI_VENDOR_API_KEY__GeminiLLM:-}"
-}
-EOF
+    # Generate install configuration safely via JSON.stringify so special characters in passwords/keys are escaped
+    node -e "
+      const fs = require('fs');
+      const cfg = {
+        PackageManager: 'pnpm',
+        DatabaseHost: process.env.DB_HOST || 'sqlserver',
+        DatabasePort: Number(process.env.DB_PORT || 1433),
+        DatabaseName: process.env.DB_DATABASE || 'MemberJunction',
+        DatabaseTrustCert: true,
+        DatabaseAdminUser: 'sa',
+        DatabaseAdminPassword: process.env.DB_PASSWORD || '',
+        CodeGenUser: 'sa',
+        CodeGenPassword: process.env.DB_PASSWORD || '',
+        APIUser: 'sa',
+        APIPassword: process.env.DB_PASSWORD || '',
+        APIPort: 4000,
+        AuthProvider: 'local',
+        BaseEncryptionKey: process.env.MJ_BASE_ENCRYPTION_KEY || 'MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=',
+        CreateNewUser: {
+          Username: 'admin',
+          Email: 'admin@memberjunction.org',
+          FirstName: 'Admin',
+          LastName: 'User'
+        },
+        OpenAIKey: process.env.AI_VENDOR_API_KEY__OpenAILLM || '',
+        AnthropicKey: process.env.AI_VENDOR_API_KEY__AnthropicLLM || '',
+        GeminiKey: process.env.AI_VENDOR_API_KEY__GeminiLLM || '',
+        MistralKey: process.env.AI_VENDOR_API_KEY__MistralLLM || ''
+      };
+      fs.writeFileSync('/tmp/install.config.json', JSON.stringify(cfg, null, 2), { mode: 0o600 });
+    "
 
     # Install the release this workspace is pinned to (MJ_VERSION, the same release as the CLI
     # in this container). Without a tag, `mj install --yes` takes the newest stable GitHub
@@ -96,20 +102,17 @@ EOF
 
     # Execute headless install. Safe to retry: the installer checkpoints completed phases.
     mj install --yes --fast --config /tmp/install.config.json --dir /workspace "${INSTALL_TAG_ARGS[@]}"
+    rm -f /tmp/install.config.json
     touch "$STATE_DIR/core-installed"
     pnpm add -w @angular/compiler@21.2.22 2>/dev/null || true
   fi
 
   # Install Open App business context (More Cheese default or custom enterprise app)
+  # Note: GITHUB_TOKEN is read directly from the environment by OpenAppEngine's GitHubClient
   if [ ! -f "$STATE_DIR/app-installed" ]; then
     APP_URL="${OPEN_APP_INSTALL_URL:-https://github.com/MemberJunction/more-cheese}"
     echo "Installing business context Open App: $APP_URL..."
-    if [ -n "$GITHUB_TOKEN" ]; then
-      AUTH_APP_URL=$(echo "$APP_URL" | sed -E "s|https://github.com/|https://$GITHUB_TOKEN@github.com/|")
-      mj app install "$AUTH_APP_URL"
-    else
-      mj app install "$APP_URL"
-    fi
+    mj app install "$APP_URL"
     touch "$STATE_DIR/app-installed"
   fi
 
@@ -120,8 +123,8 @@ EOF
       || echo "WARNING: capabilities catalog generation failed, so the catalog may be missing or stale. Re-run scripts/generate-capabilities.sh."
   fi
 
-  # Push starter metadata. --ci: never prompt (there is no terminal here) and exit non-zero
-  # on error. Safe to repeat on a retry: mj sync push upserts.
+  # Push starter metadata. --ci: never prompt (there is no terminal here), create
+  # Template records for @file: prompt templates on first push, and exit non-zero on error.
   if [ -d "/work/metadata" ]; then
     mj sync push --dir /work/metadata --ci
   fi
@@ -156,10 +159,82 @@ if [ -f "apps/MJExplorer/package.json" ]; then
   "
 fi
 
+# Ensure turbo.json passes through AI vendor API keys, DB settings, and MJ_DEV_AUTH_ENABLED to child processes
+if [ -f "turbo.json" ]; then
+  node -e "
+    const fs = require('fs');
+    try {
+      const turbo = JSON.parse(fs.readFileSync('turbo.json', 'utf8'));
+      const passThrough = new Set(turbo.globalPassThroughEnv || []);
+      let changed = false;
+      for (const entry of ['AI_VENDOR_API_KEY__*', 'MJ_*', 'DB_*', 'CODEGEN_DB_*', 'GRAPHQL_*', 'OPEN_APP_*', 'GITHUB_TOKEN']) {
+        if (!passThrough.has(entry)) {
+          passThrough.add(entry);
+          changed = true;
+        }
+      }
+      if (changed) {
+        turbo.globalPassThroughEnv = Array.from(passThrough);
+        fs.writeFileSync('turbo.json', JSON.stringify(turbo, null, 2) + '\n');
+      }
+    } catch (e) {
+      console.warn('Notice: turbo.json check skipped:', e.message);
+    }
+  "
+fi
+
+# Sync container environment variables (API keys, encryption key, DB_USER, local dev auth) into workspace .env files
+export MJ_DEV_AUTH_ENABLED="${MJ_DEV_AUTH_ENABLED:-true}"
+node -e "
+  const fs = require('fs');
+  const upsertVar = (content, key, val) => {
+    const re = new RegExp('^' + key + '=.*$', 'm');
+    const line = key + '=' + JSON.stringify(String(val));
+    if (re.test(content)) return content.replace(re, () => line);
+    return content + (content.endsWith('\n') ? '' : '\n') + line + '\n';
+  };
+  const keysToSync = [
+    'DB_HOST', 'DB_PORT', 'DB_DATABASE', 'DB_USERNAME', 'DB_PASSWORD',
+    'MJ_BASE_ENCRYPTION_KEY', 'MJ_DEV_AUTH_ENABLED',
+    'AI_VENDOR_API_KEY__OpenAILLM', 'AI_VENDOR_API_KEY__AnthropicLLM',
+    'AI_VENDOR_API_KEY__GeminiLLM', 'AI_VENDOR_API_KEY__GroqLLM', 'AI_VENDOR_API_KEY__MistralLLM'
+  ];
+  for (const envFile of ['.env', 'apps/MJAPI/.env', 'packages/MJAPI/.env']) {
+    if (fs.existsSync(envFile)) {
+      let content = fs.readFileSync(envFile, 'utf8');
+      for (const k of keysToSync) {
+        const v = process.env[k];
+        if (v !== undefined && v !== '') {
+          content = upsertVar(content, k, v);
+        }
+      }
+      content = upsertVar(content, 'DB_USER', process.env.DB_USERNAME || 'sa');
+      fs.writeFileSync(envFile, content);
+    }
+  }
+  if (process.env.MJ_DEV_AUTH_ENABLED === 'true') {
+    for (const ngEnv of [
+      'apps/MJExplorer/src/environments/environment.ts',
+      'apps/MJExplorer/src/environments/environment.development.ts',
+      'packages/MJExplorer/src/environments/environment.ts',
+      'packages/MJExplorer/src/environments/environment.development.ts',
+    ]) {
+      if (fs.existsSync(ngEnv)) {
+        const src = fs.readFileSync(ngEnv, 'utf8');
+        const next = src.replace(/AUTH_TYPE:\s*['\"][^'\"]*['\"]/g, \"AUTH_TYPE: 'local'\");
+        if (next !== src) {
+          fs.writeFileSync(ngEnv, next);
+        }
+      }
+    }
+  }
+"
+
 # Sanitize dynamicPackages.client so non-browser packages are not bundled into MJExplorer
 if [ -f "mj.config.cjs" ]; then
   node -e "
     const fs = require('fs');
+    const vm = require('vm');
     try {
       const config = require('./mj.config.cjs');
       if (config.dynamicPackages && Array.isArray(config.dynamicPackages.client)) {
@@ -173,10 +248,37 @@ if [ -f "mj.config.cjs" ]; then
           }
         });
         if (changed) {
-          let code = fs.readFileSync('mj.config.cjs', 'utf8');
-          const regex = /client:\s*\[[\s\S]*?\]\s*\},/m;
-          code = code.replace(regex, 'client: ' + JSON.stringify(config.dynamicPackages.client, null, 2) + '\n  },');
-          fs.writeFileSync('mj.config.cjs', code);
+          const code = fs.readFileSync('mj.config.cjs', 'utf8');
+          const dynMatch = code.match(/dynamicPackages\s*:\s*\{/);
+          if (dynMatch && dynMatch.index !== undefined) {
+            const afterDyn = code.slice(dynMatch.index);
+            const clientRel = afterDyn.match(/client\s*:\s*\[/);
+            if (clientRel && clientRel.index !== undefined) {
+              const openPos = dynMatch.index + clientRel.index + clientRel[0].length - 1;
+              let depth = 1, pos = openPos + 1, inStr = null;
+              while (pos < code.length && depth > 0) {
+                const ch = code[pos];
+                if (inStr) {
+                  if (ch === '\\\\') { pos += 2; continue; }
+                  if (ch === inStr) inStr = null;
+                } else if (ch === '\"' || ch === \"'\" || ch === '\`') {
+                  inStr = ch;
+                } else if (ch === '[') {
+                  depth++;
+                } else if (ch === ']') {
+                  depth--;
+                }
+                pos++;
+              }
+              if (depth === 0) {
+                const closePos = pos - 1;
+                const serialized = JSON.stringify(config.dynamicPackages.client, null, 2).replace(/\n/g, '\n    ');
+                const updated = code.slice(0, openPos) + serialized + code.slice(closePos + 1);
+                vm.compileFunction(updated);
+                fs.writeFileSync('mj.config.cjs', updated);
+              }
+            }
+          }
         }
       }
     } catch (e) {
@@ -212,7 +314,7 @@ fi
 echo "========================================================================"
 echo " 🎉 MemberJunction Stack is Running!"
 echo "    MJAPI:       http://localhost:4000 (GraphQL & API)"
-echo "    MJExplorer:  http://localhost:4200 (Web Interface)"
+echo "    MJExplorer:  http://localhost:4200 (Web Interface — Zero-Config Local Dev Auth active)"
 echo "    Database:    localhost:$DB_PORT (DB: $DB_DATABASE)"
 echo "========================================================================"
 

package/dist/init-templates/citizen-builder/scripts/sync-metadata.sh

@@ -9,6 +9,6 @@ DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$DIR"
 
 echo "Pushing metadata changes to MemberJunction database..."
-docker compose exec -T mj mj sync push --dir /work/metadata
+docker compose exec -T mj mj sync push --dir /work/metadata "$@"
 
 echo "Metadata sync complete!"

package/dist/lib/dev-workspace/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/lib/dev-workspace/build.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EACd,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,iBAAiB,EAEjB,oBAAoB,EACpB,gBAAgB,EAEhB,qBAAqB,EACrB,YAAY,EACZ,eAAe,EACf,cAAc,EAEf,MAAM,YAAY,CAAC;AAEpB,iEAAiE;AACjE,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAiBpD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAAqC,CAAC;AAEpF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB;;;CAGxB,CAAC;AAEX;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB,EAAE,aAAa,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAiB7F,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;CASxB,CAAC;AAEX,4FAA4F;AAC5F,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAEhD,oFAAoF;AACpF,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGtE,CAAC;AAmDF;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,UAAU,GAAG,UAAU,CAAC,CAAC,GAC5E,MAAM,EAAE,CAoBV;AA6CD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,gBAAgB,GAAG,UAAU,CAAC,CAAC,EACnF,QAAQ,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAM,GAC/C,MAAM,CAoBR;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,EAAE,CAOjD;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AASD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAQlE;AAED,6FAA6F;AAC7F,MAAM,WAAW,wBAAwB;IACvC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,gHAAgH;IAChH,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,oGAAoG;IACpG,gBAAgB,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5D;AA4BD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,SAAS,aAAa,EAAE,EACjC,WAAW,GAAE,WAAW,CAAC,MAAM,CAAa,GAC3C,wBAAwB,CAkB1B;AA2BD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAUjG;AAaD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG;IACxE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,sBAAsB,EAAE,CAAC;CACtC,CAgBA;AAED,wGAAwG;AACxG,MAAM,WAAW,4BAA4B;IAC3C,sGAAsG;IACtG,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC/B,QAAQ,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,GAAG,aAAa,CAAA;KAAE,CAAC,CAAC;CACpH;AAOD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,SAAS,aAAa,EAAE,EACjC,UAAU,EAAE,SAAS,sBAAsB,EAAE,GAC5C,4BAA4B,CA2B9B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAUxG;AAuED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,SAAS,aAAa,EAAE,EACjC,iBAAiB,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,GACxD;IAAE,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IAAC,UAAU,EAAE,sBAAsB,EAAE,CAAA;CAAE,CA8B5E;AAKD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,cAAc,EAAE,CAmB1F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,SAAS,oBAAoB,EAAE,EAC/C,MAAM,EAAE,SAAS,cAAc,EAAE,EACjC,iBAAiB,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,EACzD,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC1C,YAAY,EAAE,CAchB;AAuBD,qEAAqE;AACrE,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,kEAAkE;IAClE,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACpD,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,OAAO,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjE;AASD;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,sBAAsB,CAoCjG;AAyED,4EAA4E;AAC5E,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,qFAAqF;IACrF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,wGAAwG;IACxG,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACvC,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,eAAe,GAAE,SAAS,MAAM,EAAO,GACtC,kBAAkB,CAuBpB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkBrI;AAED;;;;;;;;GAQG;AACH;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,cAAc,EAAE,SAAS,oBAAoB,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM/G;AAED,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,qBAAqB,CA0CpH;AA0CD;;;;GAIG;AACH,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAElD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAalG;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,eAAe,CAOhF"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/lib/dev-workspace/build.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EACd,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,iBAAiB,EAEjB,oBAAoB,EACpB,gBAAgB,EAEhB,qBAAqB,EACrB,YAAY,EACZ,eAAe,EACf,cAAc,EAEf,MAAM,YAAY,CAAC;AAEpB,iEAAiE;AACjE,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAiBpD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAAqC,CAAC;AAEpF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB;;;CAGxB,CAAC;AAEX;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB,EAAE,aAAa,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAiB7F,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;CASxB,CAAC;AAEX,4FAA4F;AAC5F,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAEhD,oFAAoF;AACpF,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGtE,CAAC;AAmDF;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,UAAU,GAAG,UAAU,CAAC,CAAC,GAC5E,MAAM,EAAE,CAoBV;AA6CD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,gBAAgB,GAAG,UAAU,CAAC,CAAC,EACnF,QAAQ,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAM,GAC/C,MAAM,CAoBR;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,EAAE,CAOjD;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AASD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAQlE;AAED,6FAA6F;AAC7F,MAAM,WAAW,wBAAwB;IACvC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,gHAAgH;IAChH,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,oGAAoG;IACpG,gBAAgB,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5D;AA4BD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,SAAS,aAAa,EAAE,EACjC,WAAW,GAAE,WAAW,CAAC,MAAM,CAAa,GAC3C,wBAAwB,CAkB1B;AA2BD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAUjG;AAaD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG;IACxE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,sBAAsB,EAAE,CAAC;CACtC,CAgBA;AAED,wGAAwG;AACxG,MAAM,WAAW,4BAA4B;IAC3C,sGAAsG;IACtG,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC/B,QAAQ,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,GAAG,aAAa,CAAA;KAAE,CAAC,CAAC;CACpH;AAOD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,SAAS,aAAa,EAAE,EACjC,UAAU,EAAE,SAAS,sBAAsB,EAAE,GAC5C,4BAA4B,CA2B9B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAUxG;AAyGD,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,SAAS,aAAa,EAAE,EACjC,iBAAiB,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,GACxD;IAAE,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IAAC,UAAU,EAAE,sBAAsB,EAAE,CAAA;CAAE,CA8B5E;AAKD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,cAAc,EAAE,CAmB1F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,SAAS,oBAAoB,EAAE,EAC/C,MAAM,EAAE,SAAS,cAAc,EAAE,EACjC,iBAAiB,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,EACzD,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC1C,YAAY,EAAE,CAchB;AAuBD,qEAAqE;AACrE,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,kEAAkE;IAClE,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACpD,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,OAAO,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjE;AASD;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,sBAAsB,CAoCjG;AAyED,4EAA4E;AAC5E,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,qFAAqF;IACrF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,wGAAwG;IACxG,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACvC,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,eAAe,GAAE,SAAS,MAAM,EAAO,GACtC,kBAAkB,CAuBpB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkBrI;AAED;;;;;;;;GAQG;AACH;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,cAAc,EAAE,SAAS,oBAAoB,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM/G;AAED,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,qBAAqB,CA0CpH;AA0CD;;;;GAIG;AACH,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAElD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAalG;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,eAAe,CAOhF"}

package/dist/lib/dev-workspace/build.js

@@ -552,6 +552,13 @@ export function IndexWorkspacePackages(members) {
  * contract `readJsonFile` already sets ("Unparseable JSON at <path>"). Without it a missing `name`
  * surfaced as `Cannot read properties of undefined (reading 'length')`, which names neither the
  * repo nor the file — and a developer may have a dozen of them.
+ *
+ * Also validates `platform`, when present, against the same three literals `runsInBrowser` below
+ * understands. `MjAppPackageEntry.platform` is a closed three-literal union, so the final
+ * `declared as MjAppPackageEntry[]` cast is a LIE unless this loop enforces it — an unvalidated
+ * typo like `"platform": "Node"` would satisfy the cast, fail every `=== 'node'`/`'browser'`/`'both'`
+ * comparison in `runsInBrowser`, and silently fall through its Node-only branch, dropping the
+ * package from the shell import set with no error (#4428).
  */
 function readDeclaredEntries(member, section) {
     const declared = member.MjAppJson?.packages?.[section];
@@ -568,33 +575,58 @@ function readDeclaredEntries(member, section) {
         if (typeof entry.name !== 'string') {
             throw new Error(`${where}[${index}] has no "name" string — a package entry must name its package`);
         }
+        const platform = entry.platform;
+        if (platform !== undefined && !VALID_PLATFORMS.includes(platform)) {
+            throw new Error(`${where}[${index}] has an invalid "platform" value ${JSON.stringify(platform)} — must be one of ${VALID_PLATFORMS.join(', ')}`);
+        }
     }
     return declared;
 }
+/** The only valid values for a manifest package entry's `platform` field — see {@link runsInBrowser}. */
+const VALID_PLATFORMS = ['node', 'browser', 'both'];
 /**
  * Every package a member declares that an app shell will be asked to import.
  *
  * This set mirrors the HOST's rule exactly, because the host is the only thing that decides what
  * the shell imports. `GetClientPackagesFromManifest`
  * (`packages/OpenApp/Engine/src/install/config-manager.ts`) builds the client dynamic-package list
- * as `[...packages.client, ...packages.shared]` with **no role test** — its own comment: "every
- * client/shared package is emitted regardless of startupExport — client entries are side-effect
- * imports" — and `mj codegen manifest --open-app-client-bootstrap` turns every enabled entry into
- * an import in the shell's generated class-registrations manifest, with no role field even present
- * on its entry type.
+ * as `[...packages.client, ...packages.shared]` minus anything whose platform excludes the
+ * browser, and `mj codegen manifest --open-app-client-bootstrap` turns every enabled entry into an
+ * import in the shell's generated class-registrations manifest.
  *
- * So there is deliberately no `role` filter here. An earlier revision kept only `role: 'bootstrap'`
- * on the premise that other roles "are imported normally"; the host contradicts that, and `role`
- * is a required seven-value enum whose `components` / `module` members are the documented Angular
- * roles. Anything narrower leaves a schema-valid package imported by the shell and linked by
- * nobody — the exact page-load-with-a-green-build failure this module exists to prevent (#4364).
+ * There is deliberately no `role` FILTER here beyond the platform rule. An earlier revision kept
+ * only `role: 'bootstrap'` on the premise that other roles "are imported normally"; the host
+ * contradicts that, and `role` is a required seven-value enum whose `components` / `module`
+ * members are the documented Angular roles. Anything narrower leaves a schema-valid package
+ * imported by the shell and linked by nobody — the page-load-with-a-green-build failure this
+ * module exists to prevent (#4364).
+ *
+ * The platform rule itself IS a role test, but a targeted one: it drops only what cannot run in a
+ * browser at all. Before it existed, a Node-only actions package declared `shared` was imported
+ * into the Angular bundle and the host could not build (#4428).
  *
  * `packages.server[]` is NOT here, and that is not an oversight: the host routes it to
  * `dynamicPackages.server`, a Node process that resolves importer-relative rather than from the
  * vite root, so it is not part of the shell's resolution problem.
  */
 function readShellImportedEntries(member) {
-    return [...readDeclaredEntries(member, 'client'), ...readDeclaredEntries(member, 'shared')];
+    return [...readDeclaredEntries(member, 'client'), ...readDeclaredEntries(member, 'shared')].filter(runsInBrowser);
+}
+/**
+ * Whether a declared package may be imported by the app shell.
+ *
+ * DELIBERATE COPY of `ResolvePackagePlatform` / `PackageRunsOnTier` in
+ * `packages/OpenApp/Engine/src/manifest/package-platform.ts`, which is canonical;
+ * `packages/DynamicPackages/src/discover.ts` keeps a third copy. Importing the engine's version
+ * here would bind this command to that package's built `dist/`. Change one, change all three. The
+ * engine's `package-platform.test.ts` holds the canonical case list; this module's spec mirrors its
+ * cases by hand, because it cannot import the engine.
+ */
+function runsInBrowser(pkg) {
+    // `readDeclaredEntries` has already rejected every `platform` other than absent or one of the
+    // three literals, so only `undefined` needs the role default here.
+    const platform = pkg.platform ?? (pkg.role === 'actions' ? 'node' : 'both');
+    return platform === 'both' || platform === 'browser';
 }
 export function CollectOpenAppClientPackages(members, workspacePackages) {
     const collected = new Map();