@promptframe/cli 0.1.30 → 0.1.32

package/dist/index.js

@@ -19,6 +19,21 @@ const DEFAULT_CLI_LOGIN_SCOPES = ['component.upload', 'component.status.read'];
 const SECURITY_EVALUATOR_MODE = 'ast';
 const LOCKFILE_EVIDENCE_SCHEMA_VERSION = 'promptframe.lockfile-evidence.v0.1.0';
 const LOCKFILE_EVIDENCE_FILE_NAME = 'promptframe-lockfile-evidence.json';
+const PROMPTFRAME_WORKSPACE_SCHEMA_VERSION = 'promptframe-workspace.v0.1.0';
+const PROMPTFRAME_PROJECT_CONTEXT_SCHEMA_VERSION = 'promptframe-project-context.v0.1.0';
+const PROMPTFRAME_PROJECT_CONTEXT_FILE_NAME = '.promptframerc';
+const PROJECT_CONTEXT_FORBIDDEN_KEY_NAMES = new Set([
+    'apikey',
+    'auth0subject',
+    'authorization',
+    'citokensecret',
+    'clientsecret',
+    'cookie',
+    'oauthcode',
+    'password',
+    'token',
+    'tokensecret',
+]);
 const PACKAGE_MANAGER_LOCKFILE_NAMES = [
     'package-lock.json',
     'npm-shrinkwrap.json',
@@ -83,16 +98,26 @@ async function run(name, argv) {
         case 'discovery':
             await discovery(argv);
             break;
+        case 'init':
+            await initProjectContext(argv);
+            break;
         case 'project':
             await project(argv);
             break;
         case 'projects':
             await project(['list', ...argv]);
             break;
+        case 'component':
+        case 'components':
+            await component(argv);
+            break;
         case 'ci-token':
         case 'token':
             await ciToken(argv);
             break;
+        case 'workspace':
+            workspace(argv);
+            break;
         case 'setup-ci':
             setupCi(argv);
             break;
@@ -157,7 +182,8 @@ function doctor(argv) {
     console.log(`doctor passed: ${dir}`);
 }
 function validate(argv) {
-    const dir = resolve(firstPositionalArg(argv) ?? '.');
+    const input = resolveComponentInput(argv);
+    const dir = input.dir;
     const manifest = validateComponentDirectory(dir);
     const publicResources = evaluateDirectoryPublicResources(dir);
     assertPublicResourcesAccepted(publicResources);
@@ -171,6 +197,7 @@ function validate(argv) {
     const output = {
         command: 'validate',
         dir,
+        source: input.source,
         manifest: {
             id: manifest.id,
             name: manifest.name,
@@ -195,7 +222,8 @@ function validate(argv) {
     printDiagnostics(diagnostics);
 }
 async function check(argv) {
-    const dir = resolve(firstPositionalArg(argv) ?? '.');
+    const input = resolveComponentInput(argv);
+    const dir = input.dir;
     const target = resolveUploadTarget(argv);
     const manifest = validateComponentDirectory(dir);
     assertAuthoringPackageFreshness(dir, target);
@@ -214,6 +242,7 @@ async function check(argv) {
     const output = {
         command: 'check',
         dir,
+        source: input.source,
         manifest: manifestSummary(manifest),
         checkedRuleIds: VALIDATE_CHECKED_RULE_IDS,
         securityPolicyVersion: PROMPTFRAME_PUBLIC_SECURITY_POLICY.policyVersion,
@@ -267,7 +296,8 @@ function upgrade(argv) {
     }
 }
 function preview(argv) {
-    const dir = resolve(firstPositionalArg(argv) ?? '.');
+    const input = resolveComponentInput(argv);
+    const dir = input.dir;
     const manifest = validateComponentDirectory(dir);
     const previewEnvelope = readPreviewProps(dir);
     const previewScript = resolveLocalPreviewScript(readPackageManifest(join(dir, 'package.json')));
@@ -282,6 +312,7 @@ function preview(argv) {
     const output = {
         command: 'preview',
         dir,
+        source: input.source,
         manifest: manifestSummary(manifest),
         renderingSystem: 'remotion',
         previewSource: 'src/preview-props.json',
@@ -302,7 +333,8 @@ function preview(argv) {
     console.log(`Run: npm run ${previewScript}`);
 }
 async function dev(argv) {
-    const dir = resolve(firstPositionalArg(argv) ?? '.');
+    const input = resolveComponentInput(argv);
+    const dir = input.dir;
     const target = resolveUploadTarget(argv);
     const manifest = validateComponentDirectory(dir);
     assertAuthoringPackageFreshness(dir, target);
@@ -315,6 +347,7 @@ async function dev(argv) {
     const output = {
         command: 'dev',
         dir,
+        source: input.source,
         manifest: manifestSummary(manifest),
         renderingSystem: 'remotion-player',
         previewSource: 'src/preview-props.json',
@@ -343,13 +376,15 @@ async function dev(argv) {
     await runDevServer(dir, devCommand);
 }
 function packageComponent(argv) {
-    const artifact = packageDirectory(argv[0] ?? '.', valueAfter(argv, '--out'));
+    const input = resolveComponentInput(argv);
+    const artifact = packageDirectory(input.dir, valueAfter(argv, '--out'));
     printJson({
         command: 'package',
         diagnostic: diagnostic('package.completed', 'info', 'Component source archive created.'),
         out: artifact.out,
         sizeBytes: artifact.sizeBytes,
         sha256: artifact.sha256,
+        source: input.source,
         publicResources: artifact.publicResources,
     });
 }
@@ -444,18 +479,25 @@ async function remoteCommand(name, argv) {
     }
 }
 async function uploadComponent(argv) {
-    const target = resolve(argv[0] ?? '.');
+    const workspaceComponent = valueAfter(argv, '--workspace-component');
+    const target = resolve(componentPathArg(argv) ?? '.');
     const uploadTarget = resolveUploadTarget(argv);
     let localReusability;
+    if (workspaceComponent && target.endsWith('.zip')) {
+        fail('upload --workspace-component requires a workspace root, not a zip file.', 'workspace.component.zip_unsupported', 2);
+    }
+    const input = target.endsWith('.zip')
+        ? { dir: target, source: { mode: 'zip' } }
+        : resolveComponentInput(argv);
     const artifact = target.endsWith('.zip')
         ? packageZipForUpload(target, uploadTarget)
-        : packageDirectoryForUploadWithLocalReusability(target, uploadTarget, valueAfter(argv, '--out'), (reusability) => {
+        : packageDirectoryForUploadWithLocalReusability(input.dir, uploadTarget, valueAfter(argv, '--out'), (reusability) => {
             localReusability = reusability;
         });
     const localDiagnostics = localReusability
         ? [
             ...reusabilityDiagnostics(localReusability),
-            ...stylePropDiagnostics(target),
+            ...stylePropDiagnostics(input.dir),
             ...(artifact.publicResources?.diagnostics ?? []),
         ]
         : undefined;
@@ -470,19 +512,22 @@ async function uploadComponent(argv) {
         headers: {
             ...buildRemoteHeaders(endpoint, argv),
             ...buildSecurityPolicyHeaders(),
+            ...buildSourceMetadataHeaders(input.source),
             'x-promptframe-upload-target': uploadTarget,
         },
     }, 'upload.http.failed');
-    const output = {
-        ...payload,
+    const safePayload = sanitizePublicUploadPayload(payload);
+    const output = sanitizePublicUploadPayload({
+        ...safePayload,
         command: 'upload',
         endpoint,
         uploadTarget,
         jobId: getBuildId(payload),
         package: artifact,
+        source: input.source,
         ...(localReusability ? { localReusability, diagnostics: localDiagnostics } : {}),
         diagnostic: diagnostic('upload.completed', 'info', 'Component upload accepted by platform.'),
-    };
+    });
     if (hasFlag(argv, '--json')) {
         printJson(output);
         return;
@@ -490,10 +535,56 @@ async function uploadComponent(argv) {
     console.log('Upload accepted by PromptFrame platform.');
     console.log(`Build: ${output.jobId ?? 'unknown'}`);
     console.log(`Status: ${stringValue(payload.status) ?? stringValue(asRecord(payload.build)?.status) ?? 'queued'}`);
+    if (output.jobId) {
+        console.log(`Next: promptframe status ${output.jobId} --endpoint ${endpoint}`);
+    }
     if (localDiagnostics)
         printDiagnostics(localDiagnostics);
     printStatusUrl(endpoint, payload);
 }
+const PUBLIC_UPLOAD_JSON_OMIT_KEYS = new Set([
+    'providerUsageReceipt',
+    'providerUsageReceipts',
+    'vectorRef',
+    'retryKey',
+    'sourceHash',
+    'sourceHashDetails',
+    'internalSourceHash',
+    'schemaHash',
+    'manifestHash',
+    'bundleHash',
+    'evidence',
+    'evidenceRecords',
+    'evidenceItems',
+    'rawEvidence',
+]);
+function sanitizePublicUploadPayload(value) {
+    return asRecord(sanitizePublicUploadValue(value)) ?? {};
+}
+function sanitizePublicUploadValue(value) {
+    if (typeof value === 'string') {
+        return scrubInternalReferences(value);
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => sanitizePublicUploadValue(item));
+    }
+    const record = asRecord(value);
+    if (!record)
+        return value;
+    const output = {};
+    for (const [key, entry] of Object.entries(record)) {
+        if (PUBLIC_UPLOAD_JSON_OMIT_KEYS.has(key))
+            continue;
+        output[key] = sanitizePublicUploadValue(entry);
+    }
+    return output;
+}
+function scrubInternalReferences(value) {
+    return value
+        .replace(/\bREQ-\d+\b/g, 'internal reference')
+        .replace(/\bTASK-\d+(?:-[A-Za-z0-9-]+)?\b/g, 'internal task')
+        .replace(/\bBUG-\d+\b/g, 'internal bug');
+}
 function resolveUploadTarget(argv) {
     const raw = normalizeUploadTargetAlias(valueAfter(argv, '--target') ?? valueAfter(argv, '--upload-target') ?? 'marketplace_authoring');
     const parsed = authoringUploadTargetSchema.safeParse(raw);
@@ -573,6 +664,331 @@ function buildFreshnessWarningDecision(target, code, message) {
 function formatRemoteStandardStaleFailure(remoteSourceHash) {
     return `PromptFrame component standard is stale: local=${COMPONENT_STANDARD_SOURCE_HASH}, platform=${remoteSourceHash}. Run promptframe upgrade . --apply before upload.`;
 }
+function workspace(argv) {
+    const subcommand = argv[0] ?? 'validate';
+    const rest = argv.slice(argv[0] ? 1 : 0);
+    switch (subcommand) {
+        case 'validate':
+            workspaceValidate(rest);
+            break;
+        case 'list':
+            workspaceList(rest);
+            break;
+        case 'init':
+            workspaceInit(rest);
+            break;
+        case 'add':
+            workspaceAdd(rest);
+            break;
+        default:
+            fail(`Unknown workspace command: ${subcommand}`, 'workspace.command.unknown', 2);
+    }
+}
+function workspaceValidate(argv) {
+    const root = resolve(componentPathArg(argv) ?? '.');
+    const reports = collectWorkspaceComponentReports(root);
+    const output = {
+        command: 'workspace.validate',
+        workspace: workspaceSummary(root),
+        components: reports.map(workspaceReportForOutput),
+        diagnostic: diagnostic('workspace.validate.completed', 'info', 'PromptFrame workspace configuration is valid.'),
+    };
+    if (hasFlag(argv, '--json')) {
+        printJson(output);
+        return;
+    }
+    console.log(`workspace valid: ${root}`);
+    for (const component of reports) {
+        console.log(`${component.id} -> ${component.path}`);
+    }
+}
+function workspaceList(argv) {
+    const root = resolve(componentPathArg(argv) ?? '.');
+    const reports = collectWorkspaceComponentReports(root);
+    const output = {
+        command: 'workspace.list',
+        workspace: workspaceSummary(root),
+        components: reports.map(workspaceReportForOutput),
+        diagnostic: diagnostic('workspace.list.completed', 'info', 'PromptFrame workspace components listed.'),
+    };
+    if (hasFlag(argv, '--json')) {
+        printJson(output);
+        return;
+    }
+    for (const component of reports) {
+        console.log(`${component.id}\t${component.path}`);
+    }
+}
+function workspaceInit(argv) {
+    const root = resolve(componentPathArg(argv) ?? '.');
+    const configPath = workspaceConfigPath(root);
+    if (existsSync(configPath) && !hasFlag(argv, '--force')) {
+        fail(`PromptFrame workspace config already exists at ${configPath}. Use --force to overwrite.`, 'workspace.config.exists');
+    }
+    const componentPath = valueAfter(argv, '--component-path');
+    const componentId = valueAfter(argv, '--id');
+    const components = componentPath || componentId
+        ? [{
+                id: componentId ?? fail('--id is required when --component-path is provided.', 'workspace.component.id_missing', 2),
+                path: normalizeWorkspacePath(componentPath ?? fail('--component-path is required when --id is provided.', 'workspace.component.path_missing', 2)),
+            }]
+        : [];
+    writeWorkspaceConfig(root, components);
+    const output = {
+        command: 'workspace.init',
+        workspace: workspaceSummary(root),
+        components,
+        diagnostic: diagnostic('workspace.init.completed', 'info', 'PromptFrame workspace configuration written.'),
+    };
+    if (hasFlag(argv, '--json')) {
+        printJson(output);
+        return;
+    }
+    console.log(`Wrote PromptFrame workspace config: ${configPath}`);
+}
+function workspaceAdd(argv) {
+    const positionals = positionalArgs(argv);
+    const root = resolve(positionals.length >= 2 ? positionals[0] : '.');
+    const rawPath = positionals.length >= 2 ? positionals[1] : positionals[0];
+    const componentPath = normalizeWorkspacePath(rawPath ?? fail('workspace add requires a component path.', 'workspace.component.path_missing', 2));
+    const id = valueAfter(argv, '--id') ?? fail('workspace add requires --id <component-id>.', 'workspace.component.id_missing', 2);
+    const current = readWorkspaceConfig(root);
+    const components = [...current.components, { id, path: componentPath }];
+    assertNoDuplicateWorkspaceComponents(components);
+    writeWorkspaceConfig(root, components);
+    const output = {
+        command: 'workspace.add',
+        workspace: workspaceSummary(root),
+        component: { id, path: componentPath },
+        diagnostic: diagnostic('workspace.add.completed', 'info', 'PromptFrame workspace component added.'),
+    };
+    if (hasFlag(argv, '--json')) {
+        printJson(output);
+        return;
+    }
+    console.log(`Added workspace component: ${id} -> ${componentPath}`);
+}
+function resolveComponentInput(argv) {
+    const workspaceComponentId = valueAfter(argv, '--workspace-component');
+    if (!workspaceComponentId) {
+        return {
+            dir: resolve(componentPathArg(argv) ?? '.'),
+            source: {
+                mode: 'single_component',
+                componentPath: '.',
+            },
+        };
+    }
+    const root = resolve(componentPathArg(argv) ?? '.');
+    const report = resolveWorkspaceComponent(root, workspaceComponentId);
+    return {
+        dir: report.absolutePath,
+        source: {
+            mode: 'workspace',
+            workspaceConfig: 'promptframe-workspace.json',
+            workspaceComponentId: report.id,
+            componentPath: report.path,
+            manifestId: stringValue(report.manifest.id) ?? report.id,
+        },
+    };
+}
+function resolveWorkspaceComponent(root, componentId) {
+    const reports = collectWorkspaceComponentReports(root);
+    const report = reports.find((component) => component.id === componentId);
+    if (!report) {
+        fail(`PromptFrame workspace component not found: ${componentId}. Run promptframe workspace list ${root} to inspect configured ids.`, 'workspace.component.not_found', 2);
+    }
+    return report;
+}
+function collectWorkspaceComponentReports(root) {
+    const workspace = readWorkspaceConfig(root);
+    if (workspace.components.length === 0) {
+        fail('PromptFrame workspace config does not list any components.', 'workspace.components.empty', 2);
+    }
+    return workspace.components.map((component) => {
+        const absolutePath = resolve(root, component.path);
+        assertWorkspacePathInsideRoot(root, absolutePath, component.path);
+        if (!existsSync(absolutePath)) {
+            fail(`PromptFrame workspace component path does not exist: ${component.path}`, 'workspace.component.path_missing', 2);
+        }
+        const manifest = validateComponentDirectory(absolutePath);
+        if (manifest.id !== component.id) {
+            fail(`PromptFrame workspace component ${component.id} points to ${component.path}, but manifest.json declares ${manifest.id}. Keep promptframe-workspace.json and manifest.json ids identical.`, 'workspace.component.manifest_id_mismatch');
+        }
+        return {
+            ...component,
+            absolutePath,
+            manifest: manifestSummary(manifest),
+        };
+    });
+}
+function workspaceReportForOutput(report) {
+    return {
+        id: report.id,
+        path: report.path,
+        manifest: report.manifest,
+    };
+}
+function workspaceSummary(root) {
+    return {
+        schemaVersion: PROMPTFRAME_WORKSPACE_SCHEMA_VERSION,
+        root,
+        configPath: workspaceConfigPath(root),
+    };
+}
+function workspaceConfigPath(root) {
+    return join(root, 'promptframe-workspace.json');
+}
+function readWorkspaceConfig(root) {
+    const configPath = workspaceConfigPath(root);
+    if (!existsSync(configPath)) {
+        fail(`PromptFrame workspace config not found at ${configPath}.`, 'workspace.config.missing', 2);
+    }
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(configPath, 'utf8'));
+    }
+    catch {
+        fail(`PromptFrame workspace config must be valid JSON: ${configPath}`, 'workspace.config.invalid_json', 2);
+    }
+    const config = asRecord(raw);
+    if (!config) {
+        fail('PromptFrame workspace config must be a JSON object.', 'workspace.config.invalid', 2);
+    }
+    const schemaVersion = stringValue(config.schemaVersion);
+    if (schemaVersion !== PROMPTFRAME_WORKSPACE_SCHEMA_VERSION) {
+        fail(`Unsupported PromptFrame workspace schemaVersion: ${schemaVersion ?? '<missing>'}. Expected ${PROMPTFRAME_WORKSPACE_SCHEMA_VERSION}.`, 'workspace.config.schema_version_unsupported', 2);
+    }
+    const rawComponents = arrayValue(config.components);
+    const components = rawComponents.map((item, index) => {
+        const component = asRecord(item);
+        if (!component) {
+            fail(`PromptFrame workspace components[${index}] must be a JSON object.`, 'workspace.component.invalid', 2);
+        }
+        const id = stringValue(component.id);
+        const path = stringValue(component.path);
+        if (!id) {
+            fail(`PromptFrame workspace components[${index}].id is required.`, 'workspace.component.id_missing', 2);
+        }
+        if (!path) {
+            fail(`PromptFrame workspace components[${index}].path is required.`, 'workspace.component.path_missing', 2);
+        }
+        return {
+            id,
+            path: normalizeWorkspacePath(path),
+        };
+    });
+    assertNoDuplicateWorkspaceComponents(components);
+    return { schemaVersion, components };
+}
+function writeWorkspaceConfig(root, components) {
+    assertNoDuplicateWorkspaceComponents(components);
+    mkdirSync(root, { recursive: true });
+    writeFileSync(workspaceConfigPath(root), `${JSON.stringify({
+        schemaVersion: PROMPTFRAME_WORKSPACE_SCHEMA_VERSION,
+        components,
+    }, null, 2)}\n`, 'utf8');
+}
+function assertNoDuplicateWorkspaceComponents(components) {
+    const ids = new Set();
+    const paths = new Set();
+    for (const component of components) {
+        if (ids.has(component.id)) {
+            fail(`Duplicate PromptFrame workspace component id: ${component.id}`, 'workspace.component.id_duplicate', 2);
+        }
+        if (paths.has(component.path)) {
+            fail(`Duplicate PromptFrame workspace component path: ${component.path}`, 'workspace.component.path_duplicate', 2);
+        }
+        ids.add(component.id);
+        paths.add(component.path);
+    }
+}
+function normalizeWorkspacePath(rawPath) {
+    const normalized = rawPath
+        .replaceAll('\\', '/')
+        .replace(/^\.\/+/, '')
+        .replace(/\/+$/, '');
+    if (!normalized) {
+        fail('PromptFrame workspace component path is required.', 'workspace.component.path_missing', 2);
+    }
+    if (normalized.startsWith('/') || /^[A-Za-z]:\//.test(normalized)) {
+        fail(`PromptFrame workspace component path must be relative: ${rawPath}`, 'workspace.component.path_absolute', 2);
+    }
+    const segments = normalized.split('/');
+    if (segments.some((segment) => !segment || segment === '.' || segment === '..')) {
+        fail(`PromptFrame workspace component path must not contain empty, "." or ".." segments: ${rawPath}`, 'workspace.component.path_unsafe', 2);
+    }
+    return normalized;
+}
+function assertWorkspacePathInsideRoot(root, absolutePath, displayPath) {
+    const relativePath = relative(root, absolutePath);
+    if (relativePath.startsWith('..') || relativePath === '' || /^[A-Za-z]:/.test(relativePath)) {
+        fail(`PromptFrame workspace component path must stay inside the workspace root: ${displayPath}`, 'workspace.component.path_unsafe', 2);
+    }
+}
+function buildSourceMetadataHeaders(source) {
+    if (source.mode !== 'workspace')
+        return {};
+    return {
+        'x-promptframe-source-mode': 'workspace',
+        'x-promptframe-source-workspace-config': source.workspaceConfig,
+        'x-promptframe-source-workspace-component-id': source.workspaceComponentId,
+        'x-promptframe-source-component-path': source.componentPath,
+        'x-promptframe-source-manifest-id': source.manifestId,
+    };
+}
+const POSITIONAL_VALUE_FLAGS = new Set([
+    '--allowed-upload-target',
+    '--auth-permissions',
+    '--auth-roles',
+    '--component-path',
+    '--component-id',
+    '--config',
+    '--description',
+    '--display-name',
+    '--endpoint',
+    '--expires-at',
+    '--host',
+    '--id',
+    '--level',
+    '--name',
+    '--out',
+    '--poll-interval-seconds',
+    '--port',
+    '--provider',
+    '--provider-kind',
+    '--provider-name',
+    '--project-id',
+    '--project-context',
+    '--project-namespace',
+    '--reason',
+    '--scope',
+    '--session-id',
+    '--target',
+    '--tenant-id',
+    '--timeout-seconds',
+    '--token',
+    '--upload-target',
+    '--user-id',
+    '--workspace-config',
+    '--workspace-component',
+]);
+function componentPathArg(argv) {
+    return positionalArgs(argv)[0];
+}
+function positionalArgs(argv) {
+    const result = [];
+    for (let index = 0; index < argv.length; index += 1) {
+        const arg = argv[index];
+        if (arg.startsWith('--')) {
+            if (!arg.includes('=') && POSITIONAL_VALUE_FLAGS.has(arg))
+                index += 1;
+            continue;
+        }
+        result.push(arg);
+    }
+    return result;
+}
 function extractRemoteStandardSourceHash(payload) {
     return stringValue(payload.sourceHash)
         ?? stringValue(payload.standardSourceHash)
@@ -593,9 +1009,13 @@ async function showStatus(argv) {
     };
     if (hasFlag(argv, '--json')) {
         printJson(output);
-        return;
     }
-    printBuildSummary(output);
+    else {
+        printBuildSummary(output);
+    }
+    if (hasFlag(argv, '--fail-on-build-failed')) {
+        failIfBuildFailed(output);
+    }
 }
 async function reindexEvidence(argv) {
     const buildId = requiredArg(argv[0], 'reindex requires a build id', 'reindex.build_id.missing');
@@ -817,6 +1237,54 @@ async function discovery(argv) {
     if (uploadTargets.length > 0)
         console.log(`Upload targets: ${uploadTargets.join(', ')}`);
 }
+async function initProjectContext(argv) {
+    const root = resolve(componentPathArg(argv) ?? '.');
+    const contextPath = join(root, PROMPTFRAME_PROJECT_CONTEXT_FILE_NAME);
+    if (existsSync(contextPath) && !hasFlag(argv, '--force')) {
+        fail(`PromptFrame project context already exists at ${contextPath}. Use --force to overwrite.`, 'project_context.exists', 2);
+    }
+    const endpoint = resolveEndpoint('init', argv);
+    const payload = await fetchProjects(endpoint, argv);
+    const projects = arrayValue(payload.projects).map((item) => asRecord(item)).filter((item) => Boolean(item));
+    const requestedProjectId = valueAfter(argv, '--project-id');
+    const currentProjectId = requestedProjectId ?? stringValue(payload.currentProjectId);
+    const project = projects.find((item) => stringValue(item.projectId) === currentProjectId || (!requestedProjectId && item.isCurrent === true));
+    if (!project) {
+        fail(requestedProjectId
+            ? `PromptFrame project ${requestedProjectId} is not available for this credential.`
+            : 'PromptFrame did not report an active project for this credential.', 'project_context.project_missing', 2);
+    }
+    const projectId = requiredArg(stringValue(project.projectId), 'PromptFrame project response did not include projectId.', 'project_context.project_id_missing');
+    const tenantId = stringValue(project.tenantId);
+    const context = buildProjectContext({
+        endpoint,
+        tenantId,
+        projectId,
+        projectNamespace: valueAfter(argv, '--project-namespace')
+            ?? stringValue(project.projectNamespace)
+            ?? normalizeProjectNamespace(projectId),
+        defaultUploadTarget: valueAfter(argv, '--target')
+            ?? valueAfter(argv, '--upload-target')
+            ?? 'marketplace_authoring',
+        workspaceConfig: valueAfter(argv, '--workspace-config') ?? 'promptframe-workspace.json',
+    });
+    mkdirSync(root, { recursive: true });
+    writeFileSync(contextPath, `${JSON.stringify(context, null, 2)}\n`, 'utf8');
+    const output = {
+        command: 'init',
+        endpoint,
+        contextPath,
+        context,
+        project,
+        diagnostic: diagnostic('project_context.init.completed', 'info', 'PromptFrame project context written.'),
+    };
+    if (hasFlag(argv, '--json')) {
+        printJson(output);
+        return;
+    }
+    console.log(`Wrote PromptFrame project context: ${contextPath}`);
+    console.log(`Project: ${projectId}`);
+}
 async function project(argv) {
     const subcommand = argv[0] && !argv[0].startsWith('--') ? argv[0] : 'list';
     if (subcommand !== 'list' && subcommand !== 'current') {
@@ -873,6 +1341,84 @@ async function fetchProjects(endpoint, argv) {
         headers: buildRemoteHeaders(endpoint, argv),
     }, 'project.http.failed');
 }
+async function component(argv) {
+    const subcommand = argv[0] && !argv[0].startsWith('--') ? argv[0] : 'list';
+    const rest = argv.slice(argv[0] && !argv[0].startsWith('--') ? 1 : 0);
+    switch (subcommand) {
+        case 'list':
+            await componentList(rest);
+            break;
+        case 'create':
+            await componentCreate(rest);
+            break;
+        default:
+            fail(`Unknown component command: ${subcommand}`, 'component.command.unknown', 2);
+    }
+}
+async function componentList(argv) {
+    const endpoint = resolveEndpoint('component', argv);
+    const params = new URLSearchParams();
+    const componentId = valueAfter(argv, '--component-id') ?? positionalArgs(argv)[0];
+    if (componentId)
+        params.set('componentId', assertComponentId(componentId));
+    const query = params.toString();
+    const payload = await fetchJson(`${endpoint}/components/marketplace/self/components${query ? `?${query}` : ''}`, {
+        headers: buildRemoteHeaders(endpoint, argv),
+    }, 'component.list.http.failed');
+    const output = {
+        ...payload,
+        command: 'component.list',
+        endpoint,
+        diagnostic: diagnostic('component.list.completed', 'info', 'PromptFrame project components listed.'),
+    };
+    if (hasFlag(argv, '--json')) {
+        printJson(output);
+        return;
+    }
+    for (const item of arrayValue(payload.declarations)) {
+        const declaration = asRecord(item);
+        if (declaration)
+            printComponentDeclarationLine(declaration);
+    }
+}
+async function componentCreate(argv) {
+    const endpoint = resolveEndpoint('component', argv);
+    const componentId = assertComponentId(requiredArg(positionalArgs(argv)[0], 'component create requires <component-id>.', 'component.id_missing'));
+    const displayName = requiredArg(valueAfter(argv, '--display-name') ?? valueAfter(argv, '--name') ?? displayNameFromComponentId(componentId), 'component create requires --display-name <name>.', 'component.display_name_missing');
+    const description = valueAfter(argv, '--description');
+    const payload = compactRecord({
+        componentId,
+        displayName,
+        description,
+    });
+    const response = await fetchJson(`${endpoint}/components/marketplace/self/components`, {
+        method: 'POST',
+        headers: {
+            ...buildRemoteHeaders(endpoint, argv),
+            'content-type': 'application/json',
+        },
+        body: JSON.stringify(payload),
+    }, 'component.create.http.failed');
+    const output = {
+        ...response,
+        command: 'component.create',
+        endpoint,
+        diagnostic: diagnostic('component.create.completed', 'info', 'PromptFrame project component declared.'),
+    };
+    if (hasFlag(argv, '--json')) {
+        printJson(output);
+        return;
+    }
+    const declaration = asRecord(response.declaration);
+    if (declaration)
+        printComponentDeclarationLine(declaration);
+}
+function printComponentDeclarationLine(declaration) {
+    const componentId = stringValue(declaration.componentId) ?? 'unknown';
+    const status = stringValue(declaration.status) ?? 'unknown';
+    const displayName = stringValue(declaration.displayName) ?? componentId;
+    console.log(`${componentId}\t${status}\t${displayName}`);
+}
 function printProjectLine(project, current) {
     const prefix = current ? '*' : '-';
     const projectId = stringValue(project.projectId) ?? 'unknown';
@@ -1068,16 +1614,22 @@ function setupCi(argv) {
         fail(`Unsupported CI provider: ${provider}.`, 'setup_ci.provider.unsupported', 2);
     }
     const targetDir = resolve(setupCiTargetDir(argv));
-    const workflowPath = join(targetDir, '.github', 'workflows', 'promptframe-component.yml');
+    const workspaceMode = hasFlag(argv, '--workspace');
+    const workspaceReports = workspaceMode ? collectWorkspaceComponentReports(targetDir) : [];
+    const workflowPath = join(targetDir, '.github', 'workflows', workspaceMode ? 'promptframe-workspace.yml' : 'promptframe-component.yml');
     if (existsSync(workflowPath) && !hasFlag(argv, '--force')) {
         fail(`PromptFrame GitHub workflow already exists at ${workflowPath}. Use --force to overwrite.`, 'setup_ci.workflow.exists');
     }
     mkdirSync(dirname(workflowPath), { recursive: true });
-    writeFileSync(workflowPath, promptFrameGithubWorkflow(), 'utf8');
+    writeFileSync(workflowPath, workspaceMode ? promptFrameGithubWorkspaceWorkflow(workspaceReports) : promptFrameGithubWorkflow(), 'utf8');
     const output = {
         success: true,
         command: 'setup-ci',
         provider,
+        ...(workspaceMode ? {
+            workspace: true,
+            components: workspaceReports.map(({ id, path }) => ({ id, path })),
+        } : {}),
         workflowPath,
         requiredSecrets: ['PROMPTFRAME_CI_TOKEN'],
         requiredVariables: ['PROMPTFRAME_API_BASE'],
@@ -1104,6 +1656,186 @@ function setupCiTargetDir(argv) {
     }
     return '.';
 }
+function promptFrameGithubWorkspaceWorkflow(components) {
+    const apiBaseVariable = '$' + '{{ vars.PROMPTFRAME_API_BASE }}';
+    const ciTokenSecret = '$' + '{{ secrets.PROMPTFRAME_CI_TOKEN }}';
+    const matrixComponentId = '$' + '{{ matrix.component.componentId }}';
+    const matrixComponentPath = '$' + '{{ matrix.component.componentPath }}';
+    const matrixArtifactName = '$' + '{{ matrix.component.artifactName }}';
+    const matrixItems = components.map((component) => [
+        '          - componentId: ' + JSON.stringify(component.id),
+        '            componentPath: ' + JSON.stringify(component.path),
+        '            artifactName: ' + JSON.stringify(githubMatrixArtifactName(component.id)),
+    ].join('\n')).join('\n');
+    return `name: PromptFrame Component Workspace
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+    tags:
+      - 'v*'
+      - '*@*'
+      - 'component-*'
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    name: PromptFrame check (${matrixComponentId})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        component:
+${matrixItems}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+      - run: npm install
+      - name: Validate workspace
+        run: npx promptframe workspace validate . --json | tee promptframe-workspace-report.json
+      - name: Validate component package
+        env:
+          PROMPTFRAME_API_BASE: ${apiBaseVariable}
+          COMPONENT_ID: ${matrixComponentId}
+          COMPONENT_PATH: ${matrixComponentPath}
+        run: |
+          set +e
+          npx promptframe check . --workspace-component "$COMPONENT_ID" --json > promptframe-check.json
+          CHECK_EXIT=$?
+          set -e
+          node <<'NODE'
+          const fs = require('node:fs');
+          const payload = JSON.parse(fs.readFileSync('promptframe-check.json', 'utf8'));
+          const diagnostics = Array.isArray(payload.diagnostics) ? payload.diagnostics : [];
+          for (const item of diagnostics) {
+            const code = String(item.code || 'promptframe.diagnostic');
+            const message = String(item.message || code).replace(/\\r?\\n/g, ' ');
+            if (item.severity === 'error') {
+              console.log(\`::error title=\${code}::\${message}\`);
+            } else {
+              console.log(\`::warning title=\${code}::\${message}\`);
+            }
+          }
+          const summary = process.env.GITHUB_STEP_SUMMARY;
+          if (summary) {
+            fs.appendFileSync(summary, [
+              '### PromptFrame workspace check',
+              '',
+              \`- Component ID: \\\`\${process.env.COMPONENT_ID || payload.source?.workspaceComponentId || 'unknown'}\\\`\`,
+              \`- Component path: \\\`\${process.env.COMPONENT_PATH || payload.source?.componentPath || 'unknown'}\\\`\`,
+              \`- Diagnostic: \\\`\${payload.diagnostic?.code || 'unknown'}\\\`\`,
+              \`- Freshness: \\\`\${payload.freshness?.status || 'unknown'}\\\`\`,
+              \`- Diagnostics: \\\`\${diagnostics.length}\\\`\`,
+              '',
+            ].join('\\n'));
+          }
+          NODE
+          exit "$CHECK_EXIT"
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: promptframe-check-report-${matrixArtifactName}
+          path: |
+            promptframe-workspace-report.json
+            promptframe-check.json
+
+  upload:
+    name: PromptFrame upload (${matrixComponentId})
+    if: github.event_name == 'push'
+    needs: check
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        component:
+${matrixItems}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+      - run: npm install
+      - name: Upload component to PromptFrame
+        env:
+          PROMPTFRAME_API_BASE: ${apiBaseVariable}
+          PROMPTFRAME_CI_TOKEN: ${ciTokenSecret}
+          COMPONENT_ID: ${matrixComponentId}
+          COMPONENT_PATH: ${matrixComponentPath}
+        run: |
+          set -euo pipefail
+          npx promptframe upload . --workspace-component "$COMPONENT_ID" --endpoint "$PROMPTFRAME_API_BASE" --json | tee promptframe-upload.json
+          BUILD_ID=$(node <<'NODE'
+          const fs = require('node:fs');
+          const payload = JSON.parse(fs.readFileSync('promptframe-upload.json', 'utf8'));
+          process.stdout.write(String(payload.jobId || payload.buildId || payload.build?.buildId || ''));
+          NODE
+          )
+          if [ -z "$BUILD_ID" ]; then
+            echo "PromptFrame upload response did not include a build id." >&2
+            exit 1
+          fi
+          set +e
+          npx promptframe status "$BUILD_ID" --endpoint "$PROMPTFRAME_API_BASE" --json --fail-on-build-failed | tee promptframe-status.json
+          STATUS_EXIT=\${PIPESTATUS[0]}
+          set -e
+          node <<'NODE'
+          const fs = require('node:fs');
+          const payload = JSON.parse(fs.readFileSync('promptframe-upload.json', 'utf8'));
+          const status = JSON.parse(fs.readFileSync('promptframe-status.json', 'utf8'));
+          const build = status.build || {};
+          const buildId = payload.jobId || payload.buildId || build.buildId || 'unknown';
+          const buildStatus = String(build.status || status.status || payload.status || 'queued');
+          const diagnostics = Array.isArray(build.diagnostics) ? build.diagnostics : [];
+          const firstError = diagnostics.find((item) => item && item.severity === 'error') || diagnostics[0] || {};
+          if (['failed', 'cancelled', 'canceled'].includes(buildStatus.toLowerCase())) {
+            const message = [
+              \`buildId=\${buildId}\`,
+              \`status=\${buildStatus}\`,
+              firstError.code ? \`code=\${firstError.code}\` : '',
+              firstError.message ? \`message=\${String(firstError.message).replace(/\\r?\\n/g, ' ').slice(0, 300)}\` : '',
+            ].filter(Boolean).join(' ');
+            console.log(\`::error title=PromptFrame platform build failed::\${message}\`);
+          }
+          const summary = process.env.GITHUB_STEP_SUMMARY;
+          if (summary) {
+            fs.appendFileSync(summary, [
+              '### PromptFrame workspace upload',
+              '',
+              \`- Component ID: \\\`\${process.env.COMPONENT_ID || payload.source?.workspaceComponentId || 'unknown'}\\\`\`,
+              \`- Component path: \\\`\${process.env.COMPONENT_PATH || payload.source?.componentPath || 'unknown'}\\\`\`,
+              \`- Diagnostic: \\\`\${payload.diagnostic?.code || 'unknown'}\\\`\`,
+              \`- Build ID: \\\`\${buildId}\\\`\`,
+              \`- Platform build status: \\\`\${buildStatus}\\\`\`,
+              firstError.code ? \`- Top diagnostic: \\\`\${firstError.code}\\\`\` : '- Top diagnostic: none',
+              firstError.message ? \`- Message: \${String(firstError.message).replace(/\\r?\\n/g, ' ').slice(0, 300)}\` : '',
+              '',
+            ].filter(Boolean).join('\\n'));
+          }
+          NODE
+          exit "$STATUS_EXIT"
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: promptframe-upload-report-${matrixArtifactName}
+          path: |
+            promptframe-upload.json
+            promptframe-status.json
+`;
+}
+function githubMatrixArtifactName(componentId) {
+    return componentId
+        .replace(/^@/, '')
+        .replace(/[^A-Za-z0-9_.-]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        || 'component';
+}
 function promptFrameGithubWorkflow() {
     const apiBaseVariable = '$' + '{{ vars.PROMPTFRAME_API_BASE }}';
     const ciTokenSecret = '$' + '{{ secrets.PROMPTFRAME_CI_TOKEN }}';
@@ -1200,23 +1932,43 @@ jobs:
             echo "PromptFrame upload response did not include a build id." >&2
             exit 1
           fi
-          npx promptframe status "$BUILD_ID" --endpoint "$PROMPTFRAME_API_BASE" --json | tee promptframe-status.json
+          set +e
+          npx promptframe status "$BUILD_ID" --endpoint "$PROMPTFRAME_API_BASE" --json --fail-on-build-failed | tee promptframe-status.json
+          STATUS_EXIT=\${PIPESTATUS[0]}
+          set -e
           node <<'NODE'
           const fs = require('node:fs');
           const payload = JSON.parse(fs.readFileSync('promptframe-upload.json', 'utf8'));
           const status = JSON.parse(fs.readFileSync('promptframe-status.json', 'utf8'));
+          const build = status.build || {};
+          const buildId = payload.jobId || payload.buildId || build.buildId || 'unknown';
+          const buildStatus = String(build.status || status.status || payload.status || 'queued');
+          const diagnostics = Array.isArray(build.diagnostics) ? build.diagnostics : [];
+          const firstError = diagnostics.find((item) => item && item.severity === 'error') || diagnostics[0] || {};
+          if (['failed', 'cancelled', 'canceled'].includes(buildStatus.toLowerCase())) {
+            const message = [
+              \`buildId=\${buildId}\`,
+              \`status=\${buildStatus}\`,
+              firstError.code ? \`code=\${firstError.code}\` : '',
+              firstError.message ? \`message=\${String(firstError.message).replace(/\\r?\\n/g, ' ').slice(0, 300)}\` : '',
+            ].filter(Boolean).join(' ');
+            console.log(\`::error title=PromptFrame platform build failed::\${message}\`);
+          }
           const summary = process.env.GITHUB_STEP_SUMMARY;
           if (summary) {
             fs.appendFileSync(summary, [
               '### PromptFrame upload',
               '',
               \`- Diagnostic: \\\`\${payload.diagnostic?.code || 'unknown'}\\\`\`,
-              \`- Build ID: \\\`\${payload.jobId || payload.buildId || 'unknown'}\\\`\`,
-              \`- Admission status: \\\`\${status.build?.status || status.status || payload.status || 'queued'}\\\`\`,
+              \`- Build ID: \\\`\${buildId}\\\`\`,
+              \`- Platform build status: \\\`\${buildStatus}\\\`\`,
+              firstError.code ? \`- Top diagnostic: \\\`\${firstError.code}\\\`\` : '- Top diagnostic: none',
+              firstError.message ? \`- Message: \${String(firstError.message).replace(/\\r?\\n/g, ' ').slice(0, 300)}\` : '',
               '',
-            ].join('\\n'));
+            ].filter(Boolean).join('\\n'));
           }
           NODE
+          exit "$STATUS_EXIT"
       - uses: actions/upload-artifact@v4
         if: always()
         with:
@@ -1228,21 +1980,29 @@ jobs:
 }
 function resolveEndpoint(commandName, argv) {
     const config = readConfig(argv);
+    const credential = asRecord(config.credential);
+    const projectContext = readProjectContext(argv);
     const endpoint = valueAfter(argv, '--endpoint')
         ?? process.env.PROMPTFRAME_API_BASE
         ?? process.env.REMOTION_MEDIA_API_BASE
-        ?? stringValue(config.endpoint);
+        ?? stringValue(config.endpoint)
+        ?? stringValue(credential?.endpoint)
+        ?? projectContext?.endpoint;
     if (!endpoint) {
-        fail(`${commandName} requires --endpoint, PROMPTFRAME_API_BASE, REMOTION_MEDIA_API_BASE, or local config. No default production endpoint is embedded in the public CLI.`, `${commandName}.endpoint.missing`, 2);
+        fail(`${commandName} requires --endpoint, PROMPTFRAME_API_BASE, REMOTION_MEDIA_API_BASE, local config, or .promptframerc. No default production endpoint is embedded in the public CLI.`, `${commandName}.endpoint.missing`, 2);
     }
     return normalizeEndpoint(endpoint);
 }
 function resolveOptionalEndpoint(argv) {
     const config = readConfig(argv);
+    const credential = asRecord(config.credential);
+    const projectContext = readProjectContext(argv);
     const endpoint = valueAfter(argv, '--endpoint')
         ?? stringValue(process.env.PROMPTFRAME_API_BASE)
         ?? stringValue(process.env.REMOTION_MEDIA_API_BASE)
-        ?? stringValue(config.endpoint);
+        ?? stringValue(config.endpoint)
+        ?? stringValue(credential?.endpoint)
+        ?? projectContext?.endpoint;
     return endpoint ? normalizeEndpoint(endpoint) : undefined;
 }
 function buildContextHeaders(argv) {
@@ -1271,7 +2031,7 @@ function buildRemoteHeaders(endpoint, argv, options = {}) {
         'x-auth-permissions',
     ].includes(name));
     if (isFormalEndpoint(endpoint) && hasDevHeaders) {
-        fail('Formal PromptFrame endpoints do not accept dev identity headers. Use promptframe login or a scoped CI token.', 'cli.auth.dev_header_formal_endpoint_forbidden');
+        fail(`Formal PromptFrame endpoints do not accept dev identity headers. Run promptframe login --endpoint ${endpoint}, or set PROMPTFRAME_CI_TOKEN to a scoped CI token and retry without --auth-roles/--auth-permissions.`, 'cli.auth.dev_header_formal_endpoint_forbidden');
     }
     if (isFormalEndpoint(endpoint) && options.requireAuth !== false) {
         fail('No PromptFrame CLI credential found for this endpoint. Run promptframe login --endpoint <url> or provide PROMPTFRAME_CI_TOKEN.', 'cli.auth.login_required', 2);
@@ -1411,6 +2171,110 @@ function writeConfig(argv, config) {
 function resolveConfigPath(argv) {
     return resolve(valueAfter(argv, '--config') ?? process.env.PROMPTFRAME_CONFIG ?? join(os.homedir(), '.promptframe', 'component-authoring.json'));
 }
+function readProjectContext(argv) {
+    const explicitPath = valueAfter(argv, '--project-context');
+    const contextPath = explicitPath
+        ? resolve(explicitPath)
+        : findProjectContextPath(process.cwd());
+    if (!contextPath || !existsSync(contextPath))
+        return undefined;
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(contextPath, 'utf8'));
+    }
+    catch {
+        fail(`PromptFrame project context is not valid JSON: ${contextPath}`, 'project_context.invalid_json', 2);
+    }
+    return parseProjectContext(raw, contextPath);
+}
+function findProjectContextPath(startDir) {
+    let current = resolve(startDir);
+    for (;;) {
+        const candidate = join(current, PROMPTFRAME_PROJECT_CONTEXT_FILE_NAME);
+        if (existsSync(candidate))
+            return candidate;
+        const parent = dirname(current);
+        if (parent === current)
+            return undefined;
+        current = parent;
+    }
+}
+function parseProjectContext(value, sourcePath) {
+    const record = asRecord(value);
+    if (!record) {
+        fail(`PromptFrame project context must be a JSON object: ${sourcePath}`, 'project_context.invalid', 2);
+    }
+    assertProjectContextSecretFree(record, sourcePath);
+    const schemaVersion = stringValue(record.schemaVersion);
+    if (schemaVersion && schemaVersion !== PROMPTFRAME_PROJECT_CONTEXT_SCHEMA_VERSION) {
+        fail(`Unsupported PromptFrame project context schemaVersion ${schemaVersion}. Expected ${PROMPTFRAME_PROJECT_CONTEXT_SCHEMA_VERSION}.`, 'project_context.schema_unsupported', 2);
+    }
+    return {
+        schemaVersion: PROMPTFRAME_PROJECT_CONTEXT_SCHEMA_VERSION,
+        ...(stringValue(record.endpoint) ? { endpoint: normalizeEndpoint(stringValue(record.endpoint)) } : {}),
+        ...(stringValue(record.tenantId) ? { tenantId: stringValue(record.tenantId) } : {}),
+        ...(stringValue(record.projectId) ? { projectId: stringValue(record.projectId) } : {}),
+        ...(stringValue(record.projectNamespace) ? { projectNamespace: stringValue(record.projectNamespace) } : {}),
+        ...(stringValue(record.defaultUploadTarget) ? { defaultUploadTarget: stringValue(record.defaultUploadTarget) } : {}),
+        ...(stringValue(record.workspaceConfig) ? { workspaceConfig: stringValue(record.workspaceConfig) } : {}),
+    };
+}
+function buildProjectContext(input) {
+    const context = {
+        schemaVersion: PROMPTFRAME_PROJECT_CONTEXT_SCHEMA_VERSION,
+        endpoint: normalizeEndpoint(input.endpoint),
+        ...(input.tenantId ? { tenantId: input.tenantId } : {}),
+        projectId: input.projectId,
+        ...(input.projectNamespace ? { projectNamespace: normalizeProjectNamespace(input.projectNamespace) } : {}),
+        ...(input.defaultUploadTarget ? { defaultUploadTarget: input.defaultUploadTarget } : {}),
+        ...(input.workspaceConfig ? { workspaceConfig: input.workspaceConfig } : {}),
+    };
+    assertProjectContextSecretFree(context, PROMPTFRAME_PROJECT_CONTEXT_FILE_NAME);
+    return context;
+}
+function assertProjectContextSecretFree(value, sourcePath) {
+    if (!value || typeof value !== 'object')
+        return;
+    if (Array.isArray(value)) {
+        for (const item of value)
+            assertProjectContextSecretFree(item, sourcePath);
+        return;
+    }
+    for (const [key, child] of Object.entries(value)) {
+        const normalizedKey = key.toLowerCase().replace(/[^a-z0-9]/g, '');
+        if (PROJECT_CONTEXT_FORBIDDEN_KEY_NAMES.has(normalizedKey)) {
+            fail(`PromptFrame project context must not contain secret-bearing field "${key}" in ${sourcePath}. Store tokens in the local CLI config or CI secret store instead.`, 'project_context.secret_field_forbidden', 2);
+        }
+        assertProjectContextSecretFree(child, sourcePath);
+    }
+}
+function assertComponentId(value) {
+    if (!/^@[a-z0-9][a-z0-9-]{1,62}\/[a-z0-9][a-z0-9-]{1,62}$/.test(value)) {
+        fail(`Invalid component id "${value}". Expected @project-namespace/component-slug.`, 'component.id_invalid', 2);
+    }
+    return value;
+}
+function normalizeProjectNamespace(value) {
+    const normalized = value
+        .trim()
+        .toLowerCase()
+        .replace(/^@/, '')
+        .replace(/[^a-z0-9-]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 63);
+    if (!/^[a-z0-9][a-z0-9-]{1,62}$/.test(normalized)) {
+        fail(`Invalid project namespace "${value}".`, 'project_context.namespace_invalid', 2);
+    }
+    return normalized;
+}
+function displayNameFromComponentId(componentId) {
+    const slug = componentId.split('/').at(-1) ?? componentId;
+    return slug
+        .split('-')
+        .filter(Boolean)
+        .map((part) => `${part[0]?.toUpperCase() ?? ''}${part.slice(1)}`)
+        .join(' ');
+}
 async function fetchJson(url, init, code) {
     const response = await fetch(url, init);
     const payload = await response.json().catch(() => ({}));
@@ -2095,6 +2959,26 @@ function printBuildSummary(payload) {
         console.log(`${stringValue(diagnosticItem?.severity)?.toUpperCase() ?? 'INFO'} ${stringValue(diagnosticItem?.code) ?? 'unknown'}: ${stringValue(diagnosticItem?.message) ?? ''}`);
     }
 }
+function failIfBuildFailed(payload) {
+    const status = getBuildStatus(payload);
+    if (!status || !['failed', 'cancelled', 'canceled'].includes(status.toLowerCase()))
+        return;
+    const buildId = getBuildId(payload) ?? 'unknown';
+    const diagnosticItem = firstBuildDiagnostic(payload);
+    const diagnosticText = diagnosticItem
+        ? `${stringValue(diagnosticItem.code) ?? 'unknown'}: ${stringValue(diagnosticItem.message) ?? ''}`.trim()
+        : 'no diagnostic';
+    fail(`PromptFrame platform build failed: buildId=${buildId} status=${status} diagnostic=${diagnosticText}`, 'status.build.failed', 1);
+}
+function getBuildStatus(payload) {
+    return stringValue(asRecord(payload.build)?.status) ?? stringValue(payload.status);
+}
+function firstBuildDiagnostic(payload) {
+    const diagnostics = arrayValue(asRecord(payload.build)?.diagnostics)
+        .map((item) => asRecord(item))
+        .filter((item) => Boolean(item));
+    return diagnostics.find((item) => item.severity === 'error') ?? diagnostics[0];
+}
 function printStatusUrl(endpoint, payload) {
     const statusUrl = stringValue(payload.statusUrl) ?? stringValue(asRecord(payload.build)?.statusUrl);
     if (!statusUrl)
@@ -2143,6 +3027,7 @@ Commands:
     --target <target>              marketplace_authoring or project_private_generation
     --target marketplace --strict  Alias for strict external marketplace authoring
   status <buildId>                 Fetch component build status
+    --fail-on-build-failed         Exit nonzero when platform build status is failed/cancelled
   reindex <buildId>                Rebuild component search/evidence indexes
   probe <buildId> --level <level>  Rerun component layout/security probe
   login --endpoint <url>             Start browser login code flow and store a CLI token
@@ -2150,13 +3035,15 @@ Commands:
   whoami                            Show the current PromptFrame CLI identity
   logout                            Revoke the current CLI token and clear local config
   discovery                         Fetch platform endpoint and self-service capabilities
+  init [dir]                        Write secret-free .promptframerc project context
   project list|current              List accessible projects or show the active project
+  component list|create             List or declare Project-scoped components
   ci-token create|list|revoke       Manage self-service CI tokens for the current project
   setup-ci [dir] --provider github   Write a GitHub Actions workflow skeleton
   configure --endpoint <url>       Write local CLI endpoint/context config
 
 Endpoint resolution:
-  --endpoint, PROMPTFRAME_API_BASE, REMOTION_MEDIA_API_BASE, then local config.
+  --endpoint, PROMPTFRAME_API_BASE, REMOTION_MEDIA_API_BASE, local config, then .promptframerc.
   The public CLI embeds no production/private endpoint defaults.
 Auth context:
   promptframe login, PROMPTFRAME_CI_TOKEN, or PROMPTFRAME_CLI_TOKEN for formal endpoints.