@salsita-ai/sdk 0.50.0-develop.bb71259564 → 0.50.0-develop.bc204720a8

package/dist/docs/phoenix/project-structure.mdx

@@ -80,9 +80,10 @@ a file can share its name with a file in another entity folder.
 
 Two naming limits still apply:
 
-- Transformer file names must be unique across all subfolders of `src/transformers/`, because each transformer
-  registers under its file name. Application-spec projects also treat names that differ only in letter case or dashes
-  as the same name.
+- Transformer file names must be unique across all subfolders of `src/transformers/`, and names that differ only in
+  letter case or dashes count as the same name: each `transformers:` entry of the spec names the file that holds its
+  transformer that way. The transformer the file builds carries the entry's name exactly, as `build('clampWidth')`
+  does for the entry `clampWidth`.
 - Files named `index.ts` inside entity folders are not auto-registered, except in application-spec projects. Give
   entity files descriptive names instead.
 
@@ -155,7 +156,7 @@ In a project on the legacy pipeline (see [Current and legacy project tooling](?p
 
 A project installs with any package manager: pnpm, npm, Yarn or Bun. Phoenix writes no package-manager settings and no `packageManager` field; the lockfile, `pnpm-workspace.yaml`, `.npmrc` and `.yarnrc.yml` are the project's own. Run `phoenix` through the package manager the project uses, such as `pnpm phoenix sync` or `npx phoenix sync`.
 
-A project that installs with pnpm 11 needs a `pnpm-workspace.yaml` in its root before the first install. pnpm 11 stops an install until every dependency build script is allowed or denied, and the SDK's dependencies have three. Its default minimum release age also refuses a package published only recently, so the exclusion lets the project install an SDK build on the day it is released; it is optional:
+A project that installs with pnpm 11 needs a `pnpm-workspace.yaml` in its root before the first install. pnpm 11 stops an install until every dependency build script is allowed or denied, and the SDK's dependencies have three. An install that skipped a build script writes a placeholder entry under `allowBuilds` instead of `true` or `false`; replace it, because the platform build stops on it and `phoenix deploy` refuses it. Its default minimum release age also refuses a package published only recently, so the exclusion lets the project install an SDK build on the day it is released; it is optional:
 
 ```yaml
 allowBuilds:
@@ -179,9 +180,9 @@ Phoenix generates typed interfaces available globally:
 
 Types are auto-generated in `.phoenix/` from your domain schema:
 
-- `.phoenix/configurator-interface.ts` - Configurator interface types
-- `.phoenix/admin-interface.ts` - Admin interface types
-- `.phoenix/globals.d.ts` - Global type definitions
+- `.phoenix/configurator-globals.ts` - assigns `phx.frontend`
+- `.phoenix/admin-globals.ts` - assigns `phx.frontend.admin`
+- `.phoenix/globals.d.ts` - the type of the `phx` global
 
 Access in code:
 
@@ -199,23 +200,23 @@ type CustomMaterial = Phx['AdminModel']['CustomMaterial']
 
 ### Root Level Files
 
-| File                                                 | Auto-Generated? | Notes                                 |
-| ---------------------------------------------------- | --------------- | ------------------------------------- |
-| `package.json`                                       | No              | Yours; see Dependencies               |
-| `tsconfig.json`                                      | Once            | Yours; see below                      |
-| `eslint.config.js`                                   | Once            | Yours; see below                      |
-| `prettier.config.js`                                 | Once            | Yours; see below                      |
-| `.prettierignore`                                    | No              | Optional and your own; see below      |
-| `pnpm-workspace.yaml`                                | No              | Only with pnpm; see Package manager   |
-| `.gitignore`                                         | Partially       | Only in a git repository; see Markers |
-| `.env`                                               | No              | Git-ignored, local config             |
-| `.env.example`                                       | No              | Template for env vars                 |
-| `.env.generated`                                     | Yes             | Optional, git-ignored; see below      |
-| `README.md`                                          | No              | Project documentation                 |
-| `AGENTS.md`                                          | No              | Your own coding-agent instructions    |
-| `.claude/skills/phoenix/`, `.agents/skills/phoenix/` | Yes             | Phoenix agent skills                  |
-
-Sync does not write `README.md`, `AGENTS.md`, `.env.example`, `.env.ci` or the `README.md` files in `assets/public/` and `assets/private/`. Earlier SDK versions wrote them once; a project that has them keeps them, and they are yours to edit.
+| File                                                 | Auto-Generated? | Notes                                         |
+| ---------------------------------------------------- | --------------- | --------------------------------------------- |
+| `package.json`                                       | No              | Yours; see Dependencies                       |
+| `tsconfig.json`                                      | Once            | Yours; see below                              |
+| `eslint.config.js`                                   | Once            | Yours; see below                              |
+| `prettier.config.js`                                 | Once            | Yours; see below                              |
+| `.prettierignore`                                    | No              | Optional and your own; see below              |
+| `pnpm-workspace.yaml`                                | No              | Only with pnpm; see Package manager           |
+| `.gitignore`                                         | Partially       | Only in a git repository; see Markers         |
+| `.env`                                               | No              | Git-ignored, local config                     |
+| `.env.example`                                       | No              | Template for env vars                         |
+| `.env.generated`                                     | Yes             | Optional, git-ignored; see below              |
+| `README.md`                                          | No              | Project documentation                         |
+| `AGENTS.md`                                          | No              | Project-owned instructions; preserved by sync |
+| `.claude/skills/phoenix/`, `.agents/skills/phoenix/` | Yes             | SDK-managed files; see below                  |
+
+With the application-spec pipeline, sync does not write `README.md`, `.env.example`, `.env.ci` or the `README.md` files in `assets/public/` and `assets/private/`. These files are yours to create and edit; sync preserves them. The legacy pipeline writes `README.md`, `.env.example`, `.env.ci` and the asset-folder `README.md` files when they are missing.
 
 Phoenix keeps the generated env file, with the IDs and values of the prepared deployment, in `.phoenix/` unless the project has a `.env.generated` in its root, which then is the one that counts. `phoenix dev` creates no `.env.generated` in the project root; the deployment and environment commands write it there. See [The generated env file](?path=/docs/phoenix-phoenix-cli--docs#the-generated-env-file).
 
@@ -229,34 +230,26 @@ With the application-spec pipeline, the project's TypeScript settings are in `.p
 
 The only root `tsconfig.json` sync replaces is the full file earlier SDK versions generated there, recognised by its settings; any other stays as it is. `phoenix dev`, `phoenix build` and the webhook bundle do not resolve `paths` aliases, so an alias added to the root file passes `phoenix check` and fails the build. `phoenix check` type-checks with the root `tsconfig.json`, or with `.phoenix/tsconfig.json` when the project has none. The legacy pipeline writes the full `tsconfig.json` on every sync.
 
-With the application-spec pipeline, sync writes `eslint.config.js` and `prettier.config.js` only when the project has none, each re-exporting the SDK's shared configuration so editors find it. They are yours to commit and to change. The only ones sync replaces are the files earlier SDK versions generated there; any other stays as it is. `phoenix check` and `phoenix fix` lint and format with the project's files, and with the SDK's configurations when a file is missing (see [`phoenix check`](?path=/docs/phoenix-phoenix-cli--docs#phoenix-check)). Sync formats the files it generates in the project root, such as the agent skills, with the same Prettier configuration, so `phoenix check` accepts them; while the project's configuration cannot be loaded, as before the first install, they get the SDK's settings. The legacy pipeline writes both files on every sync.
+With the application-spec pipeline, sync writes `eslint.config.js` and `prettier.config.js` only when the project has none, each re-exporting the SDK's shared configuration so editors find it. They are yours to commit and to change. The only ones sync replaces are the files earlier SDK versions generated there; any other stays as it is. `phoenix check` and `phoenix fix` lint and format with the project's files, and with the SDK's configurations when a file is missing (see [`phoenix check`](?path=/docs/phoenix-phoenix-cli--docs#phoenix-check)). Sync formats the files it generates in the project root, such as `tsconfig.json`, with the same Prettier configuration, so `phoenix check` accepts them; while the project's configuration cannot be loaded, as before the first install, they get the SDK's settings. The legacy pipeline writes both files on every sync.
 
 With the application-spec pipeline, the Lingui configuration is `.phoenix/.linguirc`, which sync rewrites with the rest of `.phoenix/` from `availableLocales` in `spec/application.yaml`. Phoenix passes that file to Lingui every time it extracts or compiles the catalogs and to its Vite builds, so a `.linguirc` in the project root is not read and can be deleted. To run Lingui yourself, name the file: `npx lingui extract --config .phoenix/.linguirc`, from the project root. The legacy pipeline writes `.linguirc` in the project root on every sync.
 
 ### DO NOT EDIT (Fully Auto-Generated)
 
-- **Everything in `.phoenix/`** - Completely regenerated on each build. The exceptions are `.phoenix/variants/`, where a coding agent writes the option files for `phoenix variants`, and `.phoenix/.env.generated`, the generated env file of `phoenix dev`; a rebuild keeps both
+- **Generated files in `.phoenix/`** — Rewritten on each build. In application-spec projects, `.phoenix/workspace/` is project-owned: sync, build and clean preserve it, and deploy includes it in the private source archive rather than build inputs or public assets. Rebuilds also keep `.phoenix/variants/`, which holds variant option files, and `.phoenix/.env.generated`, the generated env file of `phoenix dev`.
 - `src/locales/**/*.ts` - Compiled from `.po` catalogs
 - `.env.generated`
-- `phoenix` and `phoenix-*` skill folders under `.claude/skills/` and `.agents/skills/` — rewritten on every sync with anything else inside them removed, and other `phoenix`-prefixed skill folders are removed; to customise a skill, copy it to a folder whose name does not start with `phoenix`
-
-### Agent Guidance
-
-Coding agents (Claude Code, Codex, Cursor) enter through the single `phoenix` skill under `.claude/skills/phoenix/` or `.agents/skills/phoenix/`. Its `SKILL.md` routes to the existing project, CLI, configurator workflow, code review, variants and feedback guides in `references/`. Agents read the guides for their task rather than the whole tree. The configurator workflow retains its five stages and supporting discovery, UX, asset-conversion and appearance-review references.
-
-Phoenix keeps this guidance in step with the installed SDK. During the internal beta, a project created from a canary build gets the canary-update instructions in the linked project guide: once per conversation the agent checks for a newer canary and, after telling you, updates the SDK, runs `phoenix deps`, installs, then runs `phoenix sync`.
-
-An `AGENTS.md` is yours to add; sync does not write one. Sync removes retired `phoenix-*` skill folders but leaves unrelated skills alone. If your own instructions name an earlier separate skill such as `phoenix-review`, point them at `phoenix` and the same task instead.
-
-Projects created by earlier SDK versions had this guidance in `CLAUDE.md`, `.cursor/rules/phoenix.mdc` and `commands/review.md`. Sync removes the SDK block from the first two, keeps your own text around it, deletes a file that held nothing else, and deletes the review commands; ask `phoenix` to review instead of using `/review`.
+- The SDK-managed `phoenix` and `phoenix-*` folders under `.claude/skills/` and `.agents/skills/` — sync rewrites the current bundle, removes unrecognized files inside it and deletes retired folders with those prefixes. Keep custom files outside those prefixes. Sync also removes the SDK blocks from legacy `CLAUDE.md` and `.cursor/rules/phoenix.mdc`, preserves surrounding project text, deletes files left empty and removes the legacy review-command files.
 
 ### Markers for Partial Auto-Generation
 
-`.gitignore` holds the Phoenix entries between two marker lines. Sync rewrites that block and keeps everything outside it. With the application-spec pipeline the block does not list the files sync writes once, `tsconfig.json`, `eslint.config.js` and `prettier.config.js`, so a project commits them:
+`.gitignore` holds the Phoenix entries between two marker lines. Sync rewrites that block and keeps everything outside it. With the application-spec pipeline the block does not list the files sync writes once, `tsconfig.json`, `eslint.config.js` and `prettier.config.js`, so a project commits them. It ignores generated entries inside `.phoenix/` but leaves `.phoenix/workspace/` available for version control, so working records can travel with a checkout:
 
 ```gitignore
 # ===== BEGIN PHOENIX AUTO-GENERATED =====
-# ... Phoenix-managed ignores ...
+# ... other Phoenix-managed ignores ...
+**/.phoenix/*
+!**/.phoenix/workspace/
 # ===== END PHOENIX AUTO-GENERATED =====
 
 # Your custom ignores (preserved)
@@ -267,6 +260,8 @@ With the application-spec pipeline (see [Current and legacy project tooling](?pa
 
 ### Safe to Edit
 
+- `.phoenix/workspace/` (application-spec project records and specification sources; include durable records in version control)
+- `docs/` (client documents such as rendered specification PDFs; deploy includes them in the private source archive, not in build inputs or public assets)
 - `src/` (except compiled `src/locales/**/*.ts` files)
 - `spec/`
 - `public/`
@@ -278,7 +273,7 @@ With the application-spec pipeline (see [Current and legacy project tooling](?pa
 - `.env`, `.env.example`, `.env.ci`
 - `tsconfig.json` (application-spec pipeline; keep it extending `.phoenix/tsconfig.json`)
 - `eslint.config.js`, `prettier.config.js` (application-spec pipeline; sync writes them once, and they are the project's afterwards)
-- `README.md`, `AGENTS.md`
+- `README.md`
 
 ## File Naming Conventions
 
@@ -359,32 +354,30 @@ project-root/
 │
 ├── blender/                       # 3D model source files (Blender)
 │
-├── .phoenix/                      # AUTO-GENERATED (DO NOT EDIT)
-│   ├── domain/                    # Compiled domain specs
-│   │   ├── model/                 # Configurator model
-│   │   └── admin-model/           # Admin model
-│   ├── webhooks/                  # Generated webhook files
-│   │   ├── index.ts
-│   │   └── builders.ts
-│   ├── .swc/                      # SWC transpiled sources
-│   ├── .lingui/                   # Compiled i18n catalogs
-│   ├── variants/                  # Option files of `phoenix variants`, written by coding agents
+├── .phoenix/                      # Generated output, except the project-owned workspace/
+│   ├── workspace/                 # Specification sources and project records, available for version control
+│   ├── variants/                  # Option files of `phoenix variants`; kept by rebuilds, removed by clean
 │   ├── dist/                      # Build output
-│   │   ├── frontend/              # Frontend bundles
-│   │   └── webhooks/              # Webhook bundles
 │   ├── public -> ../public        # Symlink to public
+│   ├── application-spec.json      # The parsed application spec
+│   ├── domain-spec.ts             # Domain model and reflections; assigns `phx.domain`
+│   ├── spec-code.ts               # Code generated from the spec
+│   ├── spec-messages.ts           # Messages of the spec
 │   ├── domain.ts                  # Domain exports
 │   ├── configurator.ts            # Configurator entry
+│   ├── configurator-config.ts     # Configurator configuration
+│   ├── configurator-globals.ts    # Assigns `phx.frontend`
+│   ├── embedded-configurator.ts   # Embedded configurator entry
 │   ├── admin.ts                   # Admin entry
+│   ├── admin-config.ts            # Admin configuration
+│   ├── admin-globals.ts           # Assigns `phx.frontend.admin`
 │   ├── embedded-admin.ts          # Embedded admin entry
+│   ├── webhook.ts                 # Webhook entry
+│   ├── webhook-builders.ts        # Assigns `phx.webhooks`
 │   ├── editor.tsx                 # Editor component
-│   ├── frontend.config.ts         # Frontend configuration
-│   ├── webhooks.config.ts         # Webhook configuration
-│   ├── phoenix.config.ts          # Phoenix framework config
-│   ├── configurator-interface.ts  # Configurator interface types
-│   ├── admin-interface.ts         # Admin interface types
-│   ├── i18n.ts                    # i18n initialization
-│   ├── globals.d.ts               # Global type definitions
+│   ├── frontend.config.ts         # Frontend runtime configuration
+│   ├── webhooks.config.ts         # Webhook runtime configuration
+│   ├── globals.d.ts               # The type of the `phx` global
 │   ├── tsconfig.json              # TypeScript settings, extended by the root tsconfig.json
 │   ├── .linguirc                  # Lingui configuration
 │   ├── index.html                 # Configurator HTML entry
@@ -565,12 +558,12 @@ The `application.yaml` file contains global application-level settings. These fi
 
 ### Core Application
 
-| Field                | Type     | Description                                                                                                                                                                                       |
-| -------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `project`            | `string` | Server project `phoenix dev` develops in: a project slug, or `default` for the default project of the signed-in workspace. Read only by the CLI; overridden by `--projectSlug` and `PROJECT_SLUG` |
-| `applicationVersion` | `string` | Semantic version (`x.y.z`) exported as `ApplicationVersion` constant, stored on the deployment record and named in the banner comment of built bundles                                            |
-| `webComponentTag`    | `string` | Custom HTML web component tag name for embedding                                                                                                                                                  |
-| `pageTitle`          | `string` | Browser page title                                                                                                                                                                                |
+| Field                | Type     | Description                                                                                                                                                                                                                            |
+| -------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `project`            | `string` | Server project for `phoenix dev` and `phoenix deploy`: a project slug, or `default` for the signed-in workspace’s default project. The dev command allows `--projectSlug` and `PROJECT_SLUG` overrides; deploy reads the spec directly |
+| `applicationVersion` | `string` | Semantic version (`x.y.z`) exported as `ApplicationVersion` constant, stored on the deployment record and named in the banner comment of built bundles                                                                                 |
+| `webComponentTag`    | `string` | Custom HTML web component tag name for embedding                                                                                                                                                                                       |
+| `pageTitle`          | `string` | Browser page title                                                                                                                                                                                                                     |
 
 ### Internationalization
 

package/dist/docs/phoenix/quickstart.mdx

@@ -267,7 +267,7 @@ export default phx.domain.implementCustomExpressions({
 })
 ```
 
-Application projects receive `phx` as a global. Storybook examples cannot rely on that project environment, so the complete example below imports it from `../../.phoenix/phx.js`; that import is the only intentional difference.
+Application projects receive `phx` as a global. Storybook examples cannot rely on that project environment, so the example's files import it from `../../.phoenix/phx.js`; a project leaves that import out, the only intentional difference.
 
 After sync, the property panel offers Grey, Black, and White. Selecting one updates the domain field, recomputes `$frameColor`, and smoothly changes the real `metalMaterial` in the model. Explore the individual pieces in [Attribute List Selector](?path=/docs/controls-select-attribute-listselect--docs) and [Material Transition](?path=/docs/3d-scene-materials-transition--docs).
 
@@ -1092,8 +1092,6 @@ components:
 ### ./src/expressions/table.ts
 
 ```ts
-import { phx } from '../../.phoenix/phx.js'
-
 const FRAME_COLORS = {
   Grey: '#6f7378',
   Black: '#202124',

package/dist/docs/phoenix/sdk-builder-workflow.mdx

@@ -1,6 +1,6 @@
 # SDK Builder Workflow
 
-An SDK-builder workspace lets you build one configurator from the application spec and develop and deploy it from your terminal. You don't need a repository, a CI pipeline, project keys or a development key. You write `spec/` and `src/`, run `phoenix dev` to develop and `phoenix deploy` to go live, and the platform builds and deploys the project for you.
+An SDK-builder workspace lets you build configurators from application specs and develop and deploy them from your terminal. You don't need a repository, a CI pipeline, project keys or a development key. You write `spec/` and `src/`, run `phoenix dev` to develop and `phoenix deploy` to go live, and the platform builds and deploys the project for you.
 
 Your workspace comes with one project and one `production` environment. Its first deployment is a hello-world configurator, so you have a live link before you change anything.
 
@@ -22,34 +22,34 @@ pnpm install
 pnpm phoenix sync
 ```
 
-`phoenix init [folder]` writes the starter project: `package.json` and the starter spec, `spec/application.yaml` and `spec/configurator.yaml`, which describe one box you can resize and recolour. The starter depends on the same SDK version as the CLI that created it and on the packages the SDK requires next to it (React, three.js, MUI, Lingui and the others, with their type packages), with ESLint and Prettier at the versions the SDK uses itself. Its `package.json` has the `dev`, `build`, `deploy`, `check` and `fix` scripts, which are yours to change. `phoenix sync` then adds the rest of the project: the TypeScript, lint and formatting config and the agent skills. It writes no webhook code: a project without `src/webhooks/index.ts` gets a built-in webhook (see [Webhook Entry Point](?path=/docs/phoenix-webhooks--docs#webhook-entry-point)). It writes a `.gitignore` only when the folder is inside a git repository; run `git init` before the first sync, or sync again after it, to get the file.
+`phoenix init [folder]` writes the starter project: `package.json` and the starter spec, `spec/application.yaml` and `spec/configurator.yaml`, which describe one box you can resize and recolour. The starter depends on the same SDK version as the CLI that created it and on the packages the SDK requires next to it (React, three.js, MUI, Lingui and the others, with their type packages), with ESLint and Prettier at the versions the SDK uses itself. Its `package.json` has the `dev`, `build`, `deploy`, `check` and `fix` scripts, which are yours to change. `phoenix sync` then adds the TypeScript, lint and formatting config and the other generated files described in [Project Structure](?path=/docs/phoenix-project-structure--docs#root-level-files). It writes no webhook code: a project without `src/webhooks/index.ts` gets a built-in webhook (see [Webhook Entry Point](?path=/docs/phoenix-webhooks--docs#webhook-entry-point)). It writes a `.gitignore` only when the folder is inside a git repository; run `git init` before the first sync, or sync again after it, to get the file.
 
 `init` only writes these files: it asks nothing and contacts no server. It refuses a folder that already has a `spec/` folder. A `package.json` already in the folder is kept, as long as it depends on the SDK, and gains only the entries it lacks (see [Starting a New Project](?path=/docs/phoenix-phoenix-cli--docs#starting-a-new-project)).
 
 Phoenix writes no package-manager settings. With pnpm 11, add a `pnpm-workspace.yaml` that allows the build scripts of the SDK's dependencies before the first install; [Package manager](?path=/docs/phoenix-project-structure--docs#package-manager) has the file.
 
-The starter `spec/application.yaml` begins with `project: default`, which means the default project of the workspace you sign in to. Leave it as it is; a workspace has one project.
+The starter `spec/application.yaml` begins with `project: default`, which means the default project of the workspace you sign in to. To develop and deploy another project in that workspace, set `project` to its actual slug. Staff can create or move projects into your workspace; choose the project in Studio's **Project** selector to see its overview, builds, environment variables and allowed sites.
 
 ## 2. Sign in
 
 ```bash
-pnpm phoenix login <workspace>
+pnpm phoenix login
 ```
 
-`phoenix login` opens Studio, where you name the token and approve the sign-in. Only a super admin of the workspace can open Studio, so only a super admin can approve it. The CLI suggests `phoenix CLI on <computer>`; a name of your own, such as the agent and the machine, tells your tokens apart later. Studio sends a one-time code back to the CLI on `127.0.0.1`, the CLI exchanges it for a personal token and returns the browser to Studio, which confirms the sign-in. The code only works for the CLI that asked for it and expires after five minutes. **Deny** stops the waiting CLI at once and creates no token. Use `--no-open` to print the link instead of opening a browser.
+`phoenix login` opens Studio, where you name the token and approve the sign-in. You can approve a personal sign-in before receiving project access; developing and deploying require a current project Superadmin grant or workspace Superadmin membership. The CLI suggests `phoenix CLI on <computer>`; a name of your own, such as its purpose and the machine, tells your tokens apart later. Studio sends a one-time code back to the CLI on `127.0.0.1`, the CLI exchanges it for a personal token and returns the browser to Studio, which confirms the sign-in. The code only works for the CLI that asked for it and expires after five minutes. **Deny** stops the waiting CLI at once and creates no token. Use `--no-open` to print the link instead of opening a browser.
 
-The CLI stores the token in `~/.phoenix/credentials.json`, readable only by you, with one entry per server. `PHOENIX_CREDENTIALS_FILE` moves the file. The token acts for you in your workspace until you revoke it. It stops working when you are removed from the workspace or banned.
+The CLI stores the token in `~/.phoenix/credentials.json`, readable only by you, with one entry per server. `PHOENIX_CREDENTIALS_FILE` moves the file. The token follows your current access across SDK-builder workspaces until you revoke it. Removing workspace membership or a project grant immediately removes access to that target; disabling your account blocks the token. Set `project` in `spec/application.yaml` to an explicit project slug. `pnpm phoenix whoami` shows the current accessible projects. The legacy `phoenix login <workspace>` command still issues a workspace-bound token and accepts `project: default`. Tokens cannot manage users, roles or other tokens.
 
 `pnpm phoenix logout` revokes the token and removes it from the file. Studio's **CLI tokens** page lists your tokens by the names you gave them, with when they were last used, and revokes any of them, for example one left on another computer. A revoked token leaves the list.
 
-`login`, `logout` and `deploy` follow the region, not the `SERVER_URL` in the project's `.env`. `dev` follows the region too when `.env` has no `SERVER_URL`:
+`login`, `whoami`, `logout` and `deploy` follow the region, not the `SERVER_URL` in the project's `.env`. `dev` follows the region too when `.env` has no `SERVER_URL`:
 
-| Flag                   | Default                              | Description                                      |
-| ---------------------- | ------------------------------------ | ------------------------------------------------ |
-| `--region`             | `eu`                                 | Phoenix region of the workspace: `eu` or `us`    |
-| `--serverUrl` / `--su` | the region's server                  | Phoenix server URL, for a local or custom server |
-| `--studioUrl`          | the workspace's Studio in the region | Studio URL of the workspace (`login`)            |
-| `--open`               | `true`                               | Open the approval page in your browser (`login`) |
+| Flag                   | Default                         | Description                                      |
+| ---------------------- | ------------------------------- | ------------------------------------------------ |
+| `--region`             | `eu`                            | Phoenix region of the workspace: `eu` or `us`    |
+| `--serverUrl` / `--su` | the region's server             | Phoenix server URL, for a local or custom server |
+| `--studioUrl`          | the shared Studio in the region | Studio URL matching the server (`login`)         |
+| `--open`               | `true`                          | Open the approval page in your browser (`login`) |
 
 ## 3. Develop
 
@@ -63,10 +63,6 @@ Every user who signs the CLI in gets their own development environment, so a tea
 
 `pnpm phoenix dev --persistence local-storage` still runs the project without any server, with state kept in the browser.
 
-Coding agents follow the generated `phoenix` skill: before their first change they start `phoenix dev` and open the preview in your browser, and after `phoenix deploy` starts a build they open its page in Studio.
-
-To build the configurator with your coding agent, give it your product documents, prices, pictures, drawings or models and ask it to create the configurator. The generated `phoenix` skill’s Configurator workflow guide takes it through five stages: a representative first slice you can try early, a plan of the whole configuration experience, options and features added in small increments, finalization, and a complete review. It studies the SDK documentation before building, keeps a `configurator-spec.md` in the project as the record of what is decided and what remains open, and asks you only for decisions it cannot derive from your materials.
-
 ## 4. Deploy
 
 ```bash
@@ -76,7 +72,7 @@ pnpm phoenix deploy
 `phoenix deploy` goes through these steps:
 
 1. It validates the application spec.
-2. It packs the project files: the `.yaml` files in `spec`, everything in `src`, `mocks`, `assets`, `public` and `templates`, and `package.json`, `tsconfig.json`, `pnpm-lock.yaml`, `pnpm-workspace.yaml`, `.gitignore`, `CLAUDE.md` and `.cursor/rules/phoenix.mdc`. Every `node_modules`, `.phoenix` and `__generated` folder, every `.DS_Store` and `._*` file and every `.env` and `.env.*` file are left out, at any depth.
+2. It packs the project files: the `.yaml` files in `spec`, everything in `src`, `mocks`, `assets`, `public` and `templates`, and `package.json`, `tsconfig.json`, `pnpm-lock.yaml`, `pnpm-workspace.yaml`, `.gitignore`, `CLAUDE.md` and `.cursor/rules/phoenix.mdc`. Project-owned `.phoenix/workspace/` records and the client documents in `docs/` also travel in the private source archive; they are excluded from build inputs and public assets. Other `.phoenix` contents, every `node_modules` and `__generated` folder, every `.DS_Store` and `._*` file and every `.env` and `.env.*` file are left out.
 3. It asks the server for a build. The server compares your domain model with the deployed one and refuses, before anything is uploaded, a model that changed under an already deployed model version; see [Migrations](?path=/docs/phoenix-migrations--docs).
 4. It uploads the archive, which may be up to 200 MB.
 5. It starts the build, prints a link to the build's page in Studio and follows the build until your configurator is live, then prints its URL.
@@ -99,14 +95,12 @@ Tell us what is broken, confusing or missing, from wherever you are:
 - In the terminal, `pnpm phoenix feedback "<message>" --type bug|idea|other` sends it with your sign-in, and `--file <path>` sends a text file instead of the argument. See the [CLI reference](?path=/docs/phoenix-phoenix-cli--docs).
 - On a build's page in Studio, **Download** → **Sources** downloads the archive `phoenix deploy` uploaded for that build, so a report only needs to name the build.
 
-Coding agents working in your project use the same command, guided by the generated `phoenix` skill’s Feedback guide. They never send on their own: an agent shows you a draft, right away when the problem is crucial and otherwise at the end of the task, and sends it only after you approve it. A report names the build with its Studio page link and the live configurator, says what the agent was doing, what happened and what it expected, quotes the exact error and ends with a condensed conversation log. Agents are told never to include secrets, credentials or personal data; parts of your project and your own words go in only through a draft you approved. When you are done with the configurator, the agent also asks you, once per conversation, to evaluate the run: minutes spent, then scores from 0 to 10 for the agent's guidance, functionality, UX, 3D quality, UI visuals and the overall result, and your comments. It asks one question at a time, never picks a score for you, tells you the answers go to the Phoenix team, shows the message and sends it only after you approve it.
-
 ## Known limits
 
-- You can deploy once the workspace's first deployment is live. Until then, `phoenix deploy` tells you the workspace is still being set up.
+- You can deploy once the selected project's production setup is ready. Until then, `phoenix deploy` tells you that project's setup is incomplete.
 - The first deployment is the starter, so the starter's model is version 1 in production. Replacing it with your own model needs the starter's model kept as `v1` and a migration to version 2; [Migrations](?path=/docs/phoenix-migrations--docs) shows the migration for replacing a model entirely.
-- One workspace has one project, one `production` environment and one development environment per user.
-- `phoenix deploy` always deploys to the workspace's default project; it doesn't read `project` from the spec yet.
+- Each project uses its `production` environment and has a development environment per user. Creating or moving projects requires staff.
+- `phoenix deploy` reads `project` from the application spec. Omitted or `default` selects the workspace’s original default project. After moving a project into another workspace, sign in to that workspace and set the actual moved project slug before deploying. Targeting a nondefault project requires server API 1.61.0 or newer; the CLI stops before upload if the server cannot confirm support.
 - Only `phoenix dev` works from the sign-in. `phoenix deployment:prepare-dev` still needs the `.env` block of a Studio development environment.
 - Every deploy uploads the whole project; there are no incremental uploads.
 - Your own environment variables are set in Studio under Environment, by a super admin of the workspace, and apply from the next deploy. After a change, **Redeploy #N now** there rebuilds your live build with the new values, without a new `phoenix deploy`; it appears once your own build is live. `phoenix dev` doesn't receive them: your development environment has its own variables. A build reads them from `process.env`; a webhook reads the ones the spec declares under `env.webhook`, through `phx.webhooksEnv` (see [Webhooks](?path=/docs/phoenix-webhooks--docs)). They can't use platform names such as `LAMBDA_FUNCTION_NAME`, the `AWS_` prefix, the identity provider settings such as `CLERK_API_KEY`, or names the CLI and the deploy tooling read themselves, such as `SERVER_URL` or `NODE_OPTIONS`; Studio refuses those names.

package/dist/docs/phoenix/sessions-and-access.mdx

@@ -81,15 +81,18 @@ When chunked publishing is configured, session tokens may also contain a `chunkS
 
 Configurator and admin session tokens can carry a `sub` claim naming the user the session belongs to. Per-user server data, such as assistant threads, is keyed on it. It is for the server only: the SDK does not expose it in `sessionPayload`, so do not key frontend data on it. The server builds it from the source of the id, so an id sent by the browser can never pass as a signed-in user:
 
-| `sub`              | When                                                                                        |
-| ------------------ | ------------------------------------------------------------------------------------------- |
-| `clerk-<id>`       | The auth handler builder's Clerk handlers signed the user in; `<id>` is the Clerk user id.  |
-| `custom-<id>`      | Any other auth handler returned `userId`; `<id>` is that value.                             |
-| `anonymous-<uuid>` | No auth hook, or the handler returned no `userId`; `<uuid>` is the browser's anonymous id.  |
-| `studio-<id>`      | Studio minted the token for its signed-in user (embedded admin, edit and preview sessions). |
+| `sub`              | When                                                                                                             |
+| ------------------ | ---------------------------------------------------------------------------------------------------------------- |
+| `clerk-<id>`       | The auth handler builder's Clerk handlers signed the user in; `<id>` is the Clerk user id.                       |
+| `phoenix-<id>`     | The shared Cognito flow resolved a Phoenix account and current project grant; `<id>` is its stable account UUID. |
+| `custom-<id>`      | Any other auth handler returned `userId`; `<id>` is that value.                                                  |
+| `anonymous-<uuid>` | No auth hook, or the handler returned no `userId`; `<uuid>` is the browser's anonymous id.                       |
+| `studio-<id>`      | Studio minted the token for its signed-in user (embedded admin, edit and preview sessions).                      |
 
 The browser's anonymous id is a random UUID the SDK keeps under the localStorage key `configurator-user-id` and sends with every session authentication, so one browser is one anonymous user. It is separate from the analytics `user_id`. When storage is unavailable, the id lasts for the page's lifetime.
 
+For shared Cognito sign-in, provider configuration, role gates and revocation, see **[Webhooks — Cognito configurator sign-in](?path=/docs/phoenix-webhooks--docs#cognito-configurator-sign-in)**.
+
 A signed-in user therefore keeps the same identity across browsers, while an anonymous one is tied to the browser. A custom refresh handler must return `userId` again, or the renewed session becomes the browser's anonymous user. Return `userId` from your handlers as shown in **[Webhooks - Custom auth handlers](?path=/docs/phoenix-webhooks--docs#custom-auth-handlers)**.
 
 ### Studio Embedded Admin Sessions
@@ -169,8 +172,8 @@ Each handler returns _session data_, _role information_, and _token metadata_ th
 Once authentication succeeds:
 
 - Phoenix **stores session and refresh tokens**
-- Session determines user's **role** (admin, user, or anonymous)
-- Admin users receive an **additional admin session token** for accessing the Admin application
+- Session determines user's **role** (superadmin, admin, user, or anonymous)
+- Admin and superadmin users receive an **additional admin session token** for accessing the Admin application
 - Users can now access _general pages_ like presets and deployments
 
 ### 4. Configuration Access Validation
@@ -194,8 +197,8 @@ Finally, Phoenix creates an **authorized API client** that:
 
 Authentication logic is implemented through **webhook handlers** when the deployment is configured with **`useAuthHook: true`**. These handlers:
 
-- **Run in AWS Lambda** - Serverless execution environment
-- **Control user roles** - Determine admin, user, or anonymous access
+- **Run in AWS Lambda** - Serverless execution environment; under `phoenix dev` they run on the developer's machine through the development webhook tunnel
+- **Control user roles** - Determine superadmin, admin, user, or anonymous access
 - **Generate session data** - Custom data attached to user sessions
 - **Manage token generation** - Control session and refresh token creation
 
@@ -210,7 +213,7 @@ useAuthHook: true # Enable webhook authentication
 useClerk: true # Enables Clerk + sets useAuthHook automatically
 ```
 
-Webhook handlers are implemented in `src/webhooks/index.ts`. The builders and type definitions are auto-generated in `.phoenix/webhooks/builders.ts` based on your spec configuration.
+The webhook entry is the default export of `src/webhooks/index.ts`. The builders and their types are generated from your spec configuration into `.phoenix/webhook-builders.ts`, which sets the `phx.webhooks` global, so project code never imports builders from `.phoenix/`.
 
 The auth handler builder provides a fluent API for configuring authentication methods. You can combine multiple handlers to support different authentication scenarios. The builder is accessed through the `phx.webhooks` global namespace:
 
@@ -240,22 +243,37 @@ For custom third-party integrations (not SSO - use Clerk handlers for that), you
 ```typescript
 // src/webhooks/index.ts
 const authHandler = phx.webhooks.authHandlerBuilder
-  .withCodeHandler(async (payload, ctx) => {
-    const { code, accessToken, idToken } = payload
-    // Server retrieves tokens from Redis and passes them to webhook
+  .withCodeHandler(async ({ accessToken }, { logger }) => {
+    // The platform already redeemed the one-time code, so the payload holds
+    // { type: 'code', accessToken, refreshToken?, idToken? } and no code.
+    // PARTNER_API_URL is declared under `env.webhook` in a spec file
+    const response = await fetch(`${phx.webhooksEnv.PARTNER_API_URL}/me`, {
+      headers: { authorization: `Bearer ${accessToken}` },
+    })
+
+    if (!response.ok) {
+      logger.warn(`The partner API refused the access token with status ${response.status}.`)
+
+      return { success: false }
+    }
 
-    // Process third-party integration data
-    const userData = await processThirdPartyData(accessToken, idToken)
+    const userData: {
+      readonly id: string
+      readonly email: string
+      readonly permissions: string[]
+      readonly isAdmin: boolean
+    } = await response.json()
 
     return {
       success: true,
       data: {
-        userId: userData.id,
         email: userData.email,
         tags: userData.permissions,
       },
-      role: determineRole(userData),
-      refreshToken: await generateRefreshToken(userData),
+      role: userData.isAdmin ? 'admin' : 'user',
+      // The session user, a top-level field rather than part of the session data
+      userId: userData.id,
+      // An absolute Unix timestamp in seconds; three hours from now when omitted
       expirationTime: Math.floor(Date.now() / 1000) + 3600,
     }
   })
@@ -263,7 +281,6 @@ const authHandler = phx.webhooks.authHandlerBuilder
     return {
       success: true,
       data: {
-        userId: 'anonymous',
         tags: [],
       },
       role: 'anonymous',
@@ -275,7 +292,7 @@ const authHandler = phx.webhooks.authHandlerBuilder
 export default phx.webhooks.webhookBuilder.withAuthHook(authHandler).build()
 ```
 
-Each handler receives the authentication payload and returns session data, user role, and token metadata. The session data you return becomes available throughout the application and can include any custom fields defined in your domain's SessionData type.
+Each handler receives the authentication payload and returns session data, user role, and token metadata. A handler refuses the session with `{ success: false }`; log the reason with the `logger`, because the response carries no error message. The session data you return becomes available throughout the application and can include any custom fields declared in the spec's `sessionData` schema, which declares no required properties.
 
 Phoenix supports several types of authentication handlers:
 
@@ -305,17 +322,9 @@ To enable Clerk authentication:
 useClerk: true # Enables Clerk auth and sets useAuthHook automatically
 ```
 
-**2. Set environment variables** (defined in your project's `.env` file):
-
-```bash
-CLERK_SECRET_KEY=sk_...
-JWT_SECRET_BASE64=...
-OAUTH_PROVIDER_BASE_URL=https://...
-OAUTH_PROVIDER_CLIENT_ID=...
-OAUTH_PROVIDER_CLIENT_SECRET=...
-```
+**2. Configure Clerk for the workspace in Studio.** The Clerk credentials come from the workspace's Clerk settings in Studio and reach the webhook as generated variables (`CLERK_API_KEY`, `JWT_SECRET_BASE64`, `OAUTH_PROVIDER_CLIENT_ID`, `OAUTH_PROVIDER_CLIENT_SECRET`, `OAUTH_PROVIDER_BASE_URL`, `FRONTEND_URL` and `RESOURCES_URL`). The project neither declares them nor keeps them in its `.env`. See [Clerk Sign-In](?path=/docs/phoenix-clerk-sign-in--docs).
 
-**3. Use Clerk handlers** in your webhook (the builder is auto-generated in `.phoenix/webhooks/builders.ts`):
+**3. Use Clerk handlers** in your webhook (`phx.webhooks` is set by the generated `.phoenix/webhook-builders.ts`):
 
 ```typescript
 // src/webhooks/index.ts
@@ -493,24 +502,36 @@ Use custom code handlers for third-party integrations. The server handles Redis
 ```typescript
 // src/webhooks/index.ts
 const authHandler = phx.webhooks.authHandlerBuilder
-  .withCodeHandler(async (payload, ctx) => {
-    const { code, accessToken, idToken } = payload
+  .withCodeHandler(async ({ accessToken }, { logger }) => {
     // Server already retrieved tokens from Redis and passed them here
 
-    // Verify and process third-party tokens
-    const integrationUser = await thirdPartyAPI.validateToken(accessToken)
+    // Verify the third-party token; INTEGRATION_API_URL is declared under `env.webhook` in a spec file
+    const response = await fetch(`${phx.webhooksEnv.INTEGRATION_API_URL}/tokens/verify`, {
+      headers: { authorization: `Bearer ${accessToken}` },
+    })
+
+    if (!response.ok) {
+      logger.warn(`The integration rejected the access token with status ${response.status}.`)
+
+      return { success: false }
+    }
+
+    const integrationUser: {
+      readonly id: string
+      readonly email: string
+      readonly permissions?: string[]
+      readonly isAdmin: boolean
+    } = await response.json()
 
     // Map third-party data to Phoenix session
     return {
       success: true,
       data: {
-        userId: integrationUser.id,
         email: integrationUser.email,
-        customData: integrationUser.metadata,
-        tags: integrationUser.permissions || [],
+        tags: integrationUser.permissions ?? [],
       },
-      role: determineRoleFromIntegration(integrationUser),
-      refreshToken: await generateRefreshToken(integrationUser),
+      role: integrationUser.isAdmin ? 'admin' : 'user',
+      userId: integrationUser.id,
       expirationTime: Math.floor(Date.now() / 1000) + 3600,
     }
   })

package/dist/docs/phoenix/sharing.mdx

@@ -240,7 +240,7 @@ env:
 
 ```ts
 export const linkTasks = phx.webhooks.taskFactory.createGenerateConfigurationLinkTask((resources, data) => {
-  const frontendUrl = phx.runtimeConfig.CUSTOM_FRONTEND_URL ?? data.frontendUrl
+  const frontendUrl = phx.webhooksEnv.CUSTOM_FRONTEND_URL ?? data.frontendUrl
 
   return [
     {