@woodsportal/hubspot-kit 1.0.29 → 1.0.30

package/dist/cli.js

@@ -9,8 +9,8 @@ import {
 } from "./chunk-GTTIJVAR.js";
 
 // src/cli/program.ts
-import { readFileSync as readFileSync13 } from "fs";
-import { resolve as resolve21 } from "path";
+import { readFileSync as readFileSync15 } from "fs";
+import { resolve as resolve23 } from "path";
 import { Command } from "commander";
 
 // src/lib/config.ts
@@ -520,7 +520,7 @@ var VITE_DEV_PEER_DEPS = {
   tailwindcss: "^4.0.6"
 };
 var KIT_DEV_DEP = "@woodsportal/hubspot-kit";
-var KIT_DEV_DEP_VERSION = "^1.0.29";
+var KIT_DEV_DEP_VERSION = "^1.0.30";
 var MODULE_CONFIG_UI_DEPS = [
   "@dnd-kit/core",
   "@dnd-kit/sortable",
@@ -1109,7 +1109,7 @@ function formatProjectLabel(config) {
   return `${config.module.name} \xB7 ${config.projectType}${routerNote}`;
 }
 function section(color, title, body) {
-  const bold = (text2) => color ? pc3.bold(text2) : text2;
+  const bold = (text3) => color ? pc3.bold(text3) : text3;
   return `  ${bold(title)}
 ${body}`;
 }
@@ -1118,10 +1118,10 @@ function printWoodsCliDevBanner(options) {
     return;
   }
   const color = useCliColor();
-  const cyan = (text2) => color ? pc3.cyan(text2) : text2;
-  const dim = (text2) => color ? pc3.dim(text2) : text2;
-  const bold = (text2) => color ? pc3.bold(text2) : text2;
-  const yellow = (text2) => color ? pc3.yellow(text2) : text2;
+  const cyan = (text3) => color ? pc3.cyan(text3) : text3;
+  const dim = (text3) => color ? pc3.dim(text3) : text3;
+  const bold = (text3) => color ? pc3.bold(text3) : text3;
+  const yellow = (text3) => color ? pc3.yellow(text3) : text3;
   const version = options.version ?? readKitVersion();
   const project = formatProjectLabel(options.config);
   const isTheme = isThemeProject(options.config);
@@ -1247,7 +1247,76 @@ async function runDev(ctx, options) {
 }
 
 // src/cli/commands/deploy.ts
-import { resolve as resolve12 } from "path";
+import { resolve as resolve13 } from "path";
+
+// src/lib/project-env-files.ts
+import { existsSync as existsSync8, readFileSync as readFileSync6, writeFileSync } from "fs";
+import { resolve as resolve11 } from "path";
+var ENV_LOCAL_FILE = ".env.local";
+var ENV_GITIGNORE_LINES = [".env", ".env.*", "!.env*.example", ENV_LOCAL_FILE];
+function parseEnvFile(content) {
+  const result = {};
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eq = trimmed.indexOf("=");
+    if (eq <= 0) continue;
+    const key = trimmed.slice(0, eq).trim();
+    let value = trimmed.slice(eq + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    result[key] = value;
+  }
+  return result;
+}
+function readEnvLocal(projectRoot) {
+  const path = resolve11(projectRoot, ENV_LOCAL_FILE);
+  if (!existsSync8(path)) return {};
+  return parseEnvFile(readFileSync6(path, "utf8"));
+}
+function formatEnvLocal(entries) {
+  const lines = [
+    "# Local secrets \u2014 gitignored. Created by wp init / wp setup (hybrid CDN).",
+    "# PORTAL_CDN_PUBLISH_TOKEN needs repo push on your portal.cdn.json mirror.",
+    ""
+  ];
+  for (const [key, value] of Object.entries(entries)) {
+    if (value.includes(" ") || value.includes("#")) {
+      lines.push(`${key}="${value.replace(/"/g, '\\"')}"`);
+    } else {
+      lines.push(`${key}=${value}`);
+    }
+  }
+  return `${lines.join("\n").trimEnd()}
+`;
+}
+function writeEnvLocal(projectRoot, entries) {
+  const path = resolve11(projectRoot, ENV_LOCAL_FILE);
+  const existing = existsSync8(path) ? parseEnvFile(readFileSync6(path, "utf8")) : {};
+  writeFileSync(path, formatEnvLocal({ ...existing, ...entries }));
+}
+function mergeProjectEnv(projectRoot, base = process.env) {
+  const local = readEnvLocal(projectRoot);
+  const merged = { ...base };
+  for (const [key, value] of Object.entries(local)) {
+    if (merged[key] == null || merged[key] === "") {
+      merged[key] = value;
+    }
+  }
+  return merged;
+}
+function ensureEnvFilesGitignore(projectRoot) {
+  const gitignorePath = resolve11(projectRoot, ".gitignore");
+  const existing = existsSync8(gitignorePath) ? readFileSync6(gitignorePath, "utf8") : "";
+  const toAppend = ENV_GITIGNORE_LINES.filter((line) => !existing.includes(line)).join("\n");
+  if (!toAppend) return;
+  writeFileSync(gitignorePath, `${existing.trimEnd()}
+
+# Env files (secrets)
+${toAppend}
+`);
+}
 
 // src/cli/commands/publish.ts
 async function runPublish(ctx, options) {
@@ -1258,7 +1327,10 @@ async function runPublish(ctx, options) {
     });
   }
   const tier = options.tier ?? DEFAULT_BUILD_TIER;
-  const env = { ...process.env, WP_HS_PROJECT_ROOT: ctx.projectRoot };
+  const env = mergeProjectEnv(ctx.projectRoot, {
+    ...process.env,
+    WP_HS_PROJECT_ROOT: ctx.projectRoot
+  });
   const execOpts = {
     cwd: ctx.projectRoot,
     env,
@@ -1305,14 +1377,14 @@ async function runPublish(ctx, options) {
 }
 
 // src/cli/commands/upload.ts
-import { resolve as resolve11 } from "path";
+import { resolve as resolve12 } from "path";
 async function uploadModuleOrTheme(ctx) {
   if (isThemeProject(ctx.config)) {
     const theme = ctx.config.theme;
     if (!theme) {
       throw new WpHsError("theme block missing in woodscli.json", { exitCode: ExitCode.USER_ERROR });
     }
-    const srcDir = resolve11(ctx.projectRoot, theme.srcDir);
+    const srcDir = resolve12(ctx.projectRoot, theme.srcDir);
     runCommand("hs", ["cms", "upload", srcDir, theme.uploadPath], {
       cwd: ctx.projectRoot,
       logger: ctx.logger,
@@ -1320,7 +1392,7 @@ async function uploadModuleOrTheme(ctx) {
     });
     return `Uploaded theme ${srcDir} \u2192 ${theme.uploadPath}`;
   }
-  const outDir = resolve11(ctx.projectRoot, ctx.config.module.outDir);
+  const outDir = resolve12(ctx.projectRoot, ctx.config.module.outDir);
   const uploadPath = ctx.config.module.uploadPath;
   runCommand("hs", ["cms", "upload", outDir, uploadPath], {
     cwd: ctx.projectRoot,
@@ -1432,7 +1504,7 @@ async function runDeploy(ctx, options) {
   if (!ctx.global.json) {
     printCommandDone(
       ctx,
-      `Deploy complete (${resolve12(ctx.projectRoot, ctx.config.module.outDir)} \u2192 ${ctx.config.module.uploadPath})`
+      `Deploy complete (${resolve13(ctx.projectRoot, ctx.config.module.outDir)} \u2192 ${ctx.config.module.uploadPath})`
     );
   }
   return ExitCode.SUCCESS;
@@ -1440,8 +1512,8 @@ async function runDeploy(ctx, options) {
 
 // src/cli/commands/audit.ts
 import { createHash } from "crypto";
-import { cpSync, existsSync as existsSync8, mkdirSync, readFileSync as readFileSync6, readdirSync, rmSync, statSync } from "fs";
-import { resolve as resolve13, join as join2 } from "path";
+import { cpSync, existsSync as existsSync9, mkdirSync, readFileSync as readFileSync7, readdirSync, rmSync, statSync } from "fs";
+import { resolve as resolve14, join as join2 } from "path";
 var FORBIDDEN_SHIP_TOKENS = [
   "ModuleConfigOverlay",
   "module-config-store",
@@ -1450,10 +1522,10 @@ var FORBIDDEN_SHIP_TOKENS = [
   "dev.module-config"
 ];
 function hashFile(path) {
-  return createHash("sha256").update(readFileSync6(path)).digest("hex");
+  return createHash("sha256").update(readFileSync7(path)).digest("hex");
 }
 function walkFiles(dir) {
-  if (!existsSync8(dir)) return [];
+  if (!existsSync9(dir)) return [];
   const entries = readdirSync(dir);
   const files = [];
   for (const entry of entries) {
@@ -1469,14 +1541,14 @@ function walkFiles(dir) {
 async function runAuditShipBundle(ctx) {
   const root = ctx.projectRoot;
   const targets = [
-    resolve13(root, "dist/cdn"),
-    resolve13(root, ctx.config.module.outDir)
+    resolve14(root, "dist/cdn"),
+    resolve14(root, ctx.config.module.outDir)
   ];
   const violations = [];
   for (const dir of targets) {
     for (const file of walkFiles(dir)) {
       if (!/\.(js|css|html)$/i.test(file)) continue;
-      const content = readFileSync6(file, "utf8");
+      const content = readFileSync7(file, "utf8");
       for (const token of FORBIDDEN_SHIP_TOKENS) {
         if (content.includes(token)) {
           violations.push(`${file}: contains forbidden token "${token}"`);
@@ -1503,21 +1575,21 @@ async function runAuditBaselineCapture(ctx, options) {
   const root = ctx.projectRoot;
   const baseline = options.baselineDir ?? defaultBaselineDir(root, ctx.config);
   const sources = [
-    { label: "cdn", path: resolve13(root, "dist/cdn") },
-    { label: "hubspot", path: resolve13(root, ctx.config.module.outDir) }
+    { label: "cdn", path: resolve14(root, "dist/cdn") },
+    { label: "hubspot", path: resolve14(root, ctx.config.module.outDir) }
   ];
   if (ctx.global.dryRun) {
     ctx.logger.info(`[dry-run] Would capture baseline to ${baseline}`);
     return ExitCode.SUCCESS;
   }
   for (const { label, path } of sources) {
-    if (!existsSync8(path)) {
+    if (!existsSync9(path)) {
       throw new WpHsError(`Cannot capture baseline \u2014 missing ${path}`, {
         exitCode: ExitCode.USER_ERROR,
         remediation: "Run wp build before wp audit baseline --capture."
       });
     }
-    const target = resolve13(baseline, label);
+    const target = resolve14(baseline, label);
     rmSync(target, { recursive: true, force: true });
     mkdirSync(baseline, { recursive: true });
     cpSync(path, target, { recursive: true });
@@ -1533,13 +1605,13 @@ async function runAuditParity(ctx, options) {
   const root = ctx.projectRoot;
   const baseline = options.baselineDir ?? defaultBaselineDir(root, ctx.config);
   const currentDirs = [
-    { label: "cdn", path: resolve13(root, "dist/cdn") },
-    { label: "hubspot", path: resolve13(root, ctx.config.module.outDir) }
+    { label: "cdn", path: resolve14(root, "dist/cdn") },
+    { label: "hubspot", path: resolve14(root, ctx.config.module.outDir) }
   ];
   const mismatches = [];
   for (const { label, path } of currentDirs) {
-    const baselinePath = resolve13(baseline, label);
-    if (!existsSync8(baselinePath)) {
+    const baselinePath = resolve14(baseline, label);
+    if (!existsSync9(baselinePath)) {
       ctx.logger.warn(`No baseline at ${baselinePath} \u2014 skipping ${label} parity`);
       continue;
     }
@@ -1554,8 +1626,8 @@ async function runAuditParity(ctx, options) {
     }
     for (const file of baselineFiles) {
       const rel = file.replace(baselinePath, "");
-      const current = resolve13(path, rel.slice(1));
-      if (!existsSync8(current)) continue;
+      const current = resolve14(path, rel.slice(1));
+      if (!existsSync9(current)) continue;
       const bh = hashFile(file);
       const ch = hashFile(current);
       if (bh !== ch) {
@@ -1582,13 +1654,13 @@ var SECRET_PATTERNS = [
 ];
 async function runAuditSecrets(ctx) {
   const root = ctx.projectRoot;
-  const scanRoots = ["src", "public", ".wphs/config"].map((d) => resolve13(root, d));
+  const scanRoots = ["src", "public", ".wphs/config"].map((d) => resolve14(root, d));
   const findings = [];
   for (const dir of scanRoots) {
     for (const file of walkFiles(dir)) {
       if (!/\.(ts|tsx|js|jsx|json|env|yml|yaml|html)$/i.test(file)) continue;
       if (file.includes("node_modules")) continue;
-      const content = readFileSync6(file, "utf8");
+      const content = readFileSync7(file, "utf8");
       for (const pattern of SECRET_PATTERNS) {
         pattern.lastIndex = 0;
         if (pattern.test(content)) {
@@ -1614,13 +1686,13 @@ async function runAuditSecrets(ctx) {
 }
 
 // src/cli/commands/init.ts
-import { cpSync as cpSync2, existsSync as existsSync11, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync3 } from "fs";
-import { basename as basename2, resolve as resolve16 } from "path";
-import * as p2 from "@clack/prompts";
+import { cpSync as cpSync2, existsSync as existsSync13, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
+import { basename as basename2, resolve as resolve18 } from "path";
+import * as p3 from "@clack/prompts";
 
 // src/lib/init-router-scaffold.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync2, readFileSync as readFileSync7, rmSync as rmSync2, writeFileSync } from "fs";
-import { resolve as resolve14 } from "path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync2, readFileSync as readFileSync8, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { resolve as resolve15 } from "path";
 var ROUTER_FILES = [
   "src/routes",
   "src/routeTree.gen.ts",
@@ -1634,10 +1706,10 @@ function isModuleTemplate(template) {
   return template === "module-hybrid-cdn" || template === "module-monolith";
 }
 function writeRouterConfig(targetDir, mode) {
-  const configDir = resolve14(targetDir, "src/config");
+  const configDir = resolve15(targetDir, "src/config");
   mkdirSync2(configDir, { recursive: true });
-  writeFileSync(
-    resolve14(configDir, "router.ts"),
+  writeFileSync2(
+    resolve15(configDir, "router.ts"),
     `/** Router history \u2014 set by \`wp init\`. Hash matches woodsportal-client-frontend (HubSpot CMS embeds). */
 export type RouterHistoryMode = 'hash' | 'browser'
 
@@ -1646,8 +1718,8 @@ export const ROUTER_HISTORY: RouterHistoryMode = '${mode}'
   );
 }
 function writeMountDevPreviewRouter(targetDir) {
-  writeFileSync(
-    resolve14(targetDir, "src/portal/mount-dev-preview.tsx"),
+  writeFileSync2(
+    resolve15(targetDir, "src/portal/mount-dev-preview.tsx"),
     `import { mountGreenfieldDev } from '../../.wphs/.kit-bootstrap-greenfield.tsx'
 
 import { App } from '@/app'
@@ -1660,8 +1732,8 @@ export async function mountDevPreview() {
   );
 }
 function writeMountDevPreviewSinglePage(targetDir) {
-  writeFileSync(
-    resolve14(targetDir, "src/portal/mount-dev-preview.tsx"),
+  writeFileSync2(
+    resolve15(targetDir, "src/portal/mount-dev-preview.tsx"),
     `import { mountGreenfieldDev } from '../../.wphs/.kit-bootstrap-greenfield.tsx'
 
 import { StarterSinglePage } from '@/features/starter'
@@ -1674,8 +1746,8 @@ export async function mountDevPreview() {
   );
 }
 function writeMountPortalRouter(targetDir) {
-  writeFileSync(
-    resolve14(targetDir, "src/portal/mount-portal.tsx"),
+  writeFileSync2(
+    resolve15(targetDir, "src/portal/mount-portal.tsx"),
     `import ReactDOM from 'react-dom/client'
 
 import { App } from '@/app'
@@ -1692,8 +1764,8 @@ export async function mountPortal() {
   );
 }
 function writeMountPortalSinglePage(targetDir) {
-  writeFileSync(
-    resolve14(targetDir, "src/portal/mount-portal.tsx"),
+  writeFileSync2(
+    resolve15(targetDir, "src/portal/mount-portal.tsx"),
     `import ReactDOM from 'react-dom/client'
 
 import { StarterSinglePage } from '@/features/starter'
@@ -1710,11 +1782,11 @@ export async function mountPortal() {
   );
 }
 function writeStarterSinglePage(targetDir) {
-  const file = resolve14(targetDir, "src/features/starter/components/starter-single-page.tsx");
-  if (existsSync9(file)) {
+  const file = resolve15(targetDir, "src/features/starter/components/starter-single-page.tsx");
+  if (existsSync10(file)) {
     return;
   }
-  writeFileSync(
+  writeFileSync2(
     file,
     `import { StarterShell } from '@/components/layout/starter-shell'
 
@@ -1737,25 +1809,25 @@ export function StarterSinglePage() {
   );
 }
 function removePath(targetDir, relativePath) {
-  const full = resolve14(targetDir, relativePath);
-  if (!existsSync9(full)) {
+  const full = resolve15(targetDir, relativePath);
+  if (!existsSync10(full)) {
     return;
   }
   rmSync2(full, { recursive: true, force: true });
 }
 function stripTanStackFromPackage(targetDir) {
-  const pkgPath = resolve14(targetDir, "package.json");
-  if (!existsSync9(pkgPath)) {
+  const pkgPath = resolve15(targetDir, "package.json");
+  if (!existsSync10(pkgPath)) {
     return;
   }
-  const pkg = JSON.parse(readFileSync7(pkgPath, "utf8"));
+  const pkg = JSON.parse(readFileSync8(pkgPath, "utf8"));
   if (!pkg.devDependencies) {
     return;
   }
   for (const dep of TANSTACK_DEPS) {
     delete pkg.devDependencies[dep];
   }
-  writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}
+  writeFileSync2(pkgPath, `${JSON.stringify(pkg, null, 2)}
 `);
 }
 function applyRouterScaffold(targetDir, mode, template) {
@@ -1775,22 +1847,141 @@ function applyRouterScaffold(targetDir, mode, template) {
   writeRouterConfig(targetDir, mode);
   writeMountDevPreviewRouter(targetDir);
   writeMountPortalRouter(targetDir);
-  const featuresIndex = resolve14(targetDir, "src/features/starter/index.ts");
-  if (existsSync9(featuresIndex)) {
-    let content = readFileSync7(featuresIndex, "utf8");
+  const featuresIndex = resolve15(targetDir, "src/features/starter/index.ts");
+  if (existsSync10(featuresIndex)) {
+    let content = readFileSync8(featuresIndex, "utf8");
     if (!content.includes("StarterSinglePage")) {
       content = content.replace(
         "export type { StarterPreviewValues } from './hooks/use-starter-preview'\n",
         "export type { StarterPreviewValues } from './hooks/use-starter-preview'\nexport { StarterSinglePage } from './components/starter-single-page'\n"
       );
-      writeFileSync(featuresIndex, content);
+      writeFileSync2(featuresIndex, content);
     }
   }
 }
 
+// src/lib/cdn-github-setup.ts
+import { existsSync as existsSync11, readFileSync as readFileSync9, writeFileSync as writeFileSync3 } from "fs";
+import { resolve as resolve16 } from "path";
+import * as p2 from "@clack/prompts";
+var PORTAL_CDN_PUBLISH_TOKEN_ENV = "PORTAL_CDN_PUBLISH_TOKEN";
+var PORTAL_CDN_JSON = "portal.cdn.json";
+var PLACEHOLDER_GITHUB = /your-org|your-portal-cdn-mirror/i;
+function defaultPortalCdnJson() {
+  const examplePath = kitPath("templates", "shared", "portal.cdn.json.example");
+  if (existsSync11(examplePath)) {
+    return JSON.parse(readFileSync9(examplePath, "utf8"));
+  }
+  return {
+    publishMode: "jsdelivr",
+    github: "your-org/your-portal-cdn-mirror",
+    gitRemote: "https://github.com/your-org/your-portal-cdn-mirror.git",
+    cdnPathInRepo: "dist/cdn",
+    defaultBranch: "main"
+  };
+}
+function readPortalCdnJson(projectRoot) {
+  const path = resolve16(projectRoot, PORTAL_CDN_JSON);
+  if (!existsSync11(path)) return null;
+  try {
+    return JSON.parse(readFileSync9(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function normalizeGithubSlug(input) {
+  const trimmed = input.trim().replace(/^https:\/\/github\.com\//, "").replace(/\.git$/, "");
+  const parts = trimmed.split("/").filter(Boolean);
+  if (parts.length !== 2) return null;
+  return `${parts[0]}/${parts[1]}`;
+}
+function portalCdnJsonFromGithub(github, base) {
+  const slug = normalizeGithubSlug(github);
+  if (!slug) {
+    throw new Error(`Invalid GitHub repo \u2014 use org/repo (got "${github}")`);
+  }
+  return {
+    publishMode: base?.publishMode ?? "jsdelivr",
+    github: slug,
+    gitRemote: `https://github.com/${slug}.git`,
+    cdnPathInRepo: base?.cdnPathInRepo ?? "dist/cdn",
+    defaultBranch: base?.defaultBranch ?? "main"
+  };
+}
+function hasCdnPublishToken(projectRoot) {
+  if (process.env[PORTAL_CDN_PUBLISH_TOKEN_ENV]?.trim()) return true;
+  if (process.env.GITHUB_TOKEN?.trim()) return true;
+  return Boolean(readEnvLocal(projectRoot)[PORTAL_CDN_PUBLISH_TOKEN_ENV]?.trim());
+}
+function hasConfiguredCdnGithubMirror(projectRoot) {
+  const config = readPortalCdnJson(projectRoot);
+  const github = config?.github ?? "";
+  return Boolean(github) && !PLACEHOLDER_GITHUB.test(github);
+}
+function githubDefaultForPrompt(projectRoot) {
+  const existing = readPortalCdnJson(projectRoot);
+  if (existing?.github && !PLACEHOLDER_GITHUB.test(existing.github)) {
+    return existing.github;
+  }
+  return defaultPortalCdnJson().github;
+}
+function needsCdnGitHubSetup(projectRoot) {
+  return !hasConfiguredCdnGithubMirror(projectRoot) || !hasCdnPublishToken(projectRoot);
+}
+function applyCdnGitHubSetup(projectRoot, input) {
+  const existing = readPortalCdnJson(projectRoot) ?? defaultPortalCdnJson();
+  const updated = portalCdnJsonFromGithub(input.github, existing);
+  writeFileSync3(resolve16(projectRoot, PORTAL_CDN_JSON), `${JSON.stringify(updated, null, 2)}
+`);
+  if (input.token?.trim()) {
+    writeEnvLocal(projectRoot, { [PORTAL_CDN_PUBLISH_TOKEN_ENV]: input.token.trim() });
+  }
+  ensureEnvFilesGitignore(projectRoot);
+}
+async function promptCdnGitHubSetup(options = {}) {
+  if (options.skip) return null;
+  const projectRoot = options.projectRoot ?? process.cwd();
+  if (!needsCdnGitHubSetup(projectRoot)) {
+    return null;
+  }
+  let github = options.github?.trim();
+  if (!github && hasConfiguredCdnGithubMirror(projectRoot)) {
+    github = readPortalCdnJson(projectRoot)?.github;
+  }
+  if (!github) {
+    const answer = await p2.text({
+      message: "Public GitHub CDN mirror (org/repo)",
+      placeholder: options.githubDefault ?? "your-org/your-portal-cdn-mirror",
+      initialValue: options.githubDefault,
+      validate: (value) => {
+        const slug = normalizeGithubSlug(value ?? "");
+        return slug ? void 0 : "Enter a public repo as org/repo (jsDelivr serves from it)";
+      }
+    });
+    if (p2.isCancel(answer)) return null;
+    github = normalizeGithubSlug(answer) ?? void 0;
+  }
+  if (!github) return null;
+  if (hasCdnPublishToken(projectRoot)) {
+    return { github };
+  }
+  const tokenAnswer = await p2.password({
+    message: "GitHub token (repo push on CDN mirror)",
+    validate: (value) => {
+      if (!value?.trim()) return "Required for wp publish \u2014 create a fine-grained PAT with Contents: Read and write";
+      return void 0;
+    }
+  });
+  if (p2.isCancel(tokenAnswer)) return null;
+  return { github, token: tokenAnswer.trim() };
+}
+function formatCdnSetupNote(_projectRoot) {
+  return `CDN config written \u2014 edit ${PORTAL_CDN_JSON} if needed; token saved to ${ENV_LOCAL_FILE} (gitignored)`;
+}
+
 // src/lib/project-setup.ts
-import { copyFileSync, existsSync as existsSync10, writeFileSync as writeFileSync2 } from "fs";
-import { basename, resolve as resolve15 } from "path";
+import { copyFileSync, existsSync as existsSync12, writeFileSync as writeFileSync4 } from "fs";
+import { basename, resolve as resolve17 } from "path";
 function envFileForTier(tier) {
   return tier === "dev" ? ".env.dev" : tier === "stg" ? ".env.stg" : ".env.prod";
 }
@@ -1800,13 +1991,13 @@ function tiersToSetup(config, tier) {
 }
 function firstExisting(paths) {
   for (const path of paths) {
-    if (existsSync10(path)) return path;
+    if (existsSync12(path)) return path;
   }
   return null;
 }
 function copyMissingFile(projectRoot, targetName, sourceCandidates, dryRun) {
-  const target = resolve15(projectRoot, targetName);
-  if (existsSync10(target)) {
+  const target = resolve17(projectRoot, targetName);
+  if (existsSync12(target)) {
     return { action: "skipped", path: targetName, detail: "already present" };
   }
   const source = firstExisting(sourceCandidates);
@@ -1828,12 +2019,12 @@ function copyMissingFile(projectRoot, targetName, sourceCandidates, dryRun) {
   };
 }
 function writeMissingFile(projectRoot, targetName, content, dryRun) {
-  const target = resolve15(projectRoot, targetName);
-  if (existsSync10(target)) {
+  const target = resolve17(projectRoot, targetName);
+  if (existsSync12(target)) {
     return { action: "skipped", path: targetName, detail: "already present" };
   }
   if (!dryRun) {
-    writeFileSync2(target, content);
+    writeFileSync4(target, content);
   }
   return {
     action: "copied",
@@ -1859,8 +2050,8 @@ function applyProjectSetup(ctx, options = {}) {
   const templateDir = kitTemplateDir(config);
   results.push(
     copyMissingFile(projectRoot, HUBSPOT_CONFIG_FILE, [
-      resolve15(projectRoot, HUBSPOT_CONFIG_EXAMPLE),
-      resolve15(templateDir, HUBSPOT_CONFIG_EXAMPLE),
+      resolve17(projectRoot, HUBSPOT_CONFIG_EXAMPLE),
+      resolve17(templateDir, HUBSPOT_CONFIG_EXAMPLE),
       kitPath("templates", HUBSPOT_CONFIG_EXAMPLE)
     ], dryRun)
   );
@@ -1869,8 +2060,8 @@ function applyProjectSetup(ctx, options = {}) {
     const envExample = `${envFile}.example`;
     results.push(
       copyMissingFile(projectRoot, envFile, [
-        resolve15(projectRoot, envExample),
-        resolve15(sharedDir, envExample)
+        resolve17(projectRoot, envExample),
+        resolve17(sharedDir, envExample)
       ], dryRun)
     );
   }
@@ -1878,8 +2069,8 @@ function applyProjectSetup(ctx, options = {}) {
     const mirror = config.cdn.mirror;
     results.push(
       copyMissingFile(projectRoot, mirror, [
-        resolve15(projectRoot, `${mirror}.example`),
-        resolve15(sharedDir, "portal.cdn.json.example")
+        resolve17(projectRoot, `${mirror}.example`),
+        resolve17(sharedDir, "portal.cdn.json.example")
       ], dryRun)
     );
     const buildIdFile = config.cdn.buildIdFile;
@@ -1889,15 +2080,15 @@ function applyProjectSetup(ctx, options = {}) {
   }
   for (const file of templateViteFiles(config)) {
     results.push(
-      copyMissingFile(projectRoot, file, [resolve15(templateDir, file)], dryRun)
+      copyMissingFile(projectRoot, file, [resolve17(templateDir, file)], dryRun)
     );
   }
   if (isModuleProject(config) && !isThemeProject(config)) {
     const adapter = config.dev.adapter;
-    const adapterPath = resolve15(projectRoot, adapter);
-    if (!existsSync10(adapterPath)) {
-      const templateAdapter = resolve15(templateDir, "wphs.adapter.ts");
-      if (existsSync10(templateAdapter)) {
+    const adapterPath = resolve17(projectRoot, adapter);
+    if (!existsSync12(adapterPath)) {
+      const templateAdapter = resolve17(templateDir, "wphs.adapter.ts");
+      if (existsSync12(templateAdapter)) {
         results.push(copyMissingFile(projectRoot, adapter, [templateAdapter], dryRun));
       } else {
         results.push({
@@ -1914,26 +2105,26 @@ function applyProjectSetup(ctx, options = {}) {
 }
 function copySharedSetupExamples(targetDir) {
   const sharedDir = kitPath("templates", "shared");
-  if (!existsSync10(sharedDir)) return;
+  if (!existsSync12(sharedDir)) return;
   for (const name of [
     ".env.dev.example",
     ".env.stg.example",
     ".env.prod.example",
     "portal.cdn.json.example"
   ]) {
-    const src = resolve15(sharedDir, name);
-    const dest = resolve15(targetDir, name);
-    if (existsSync10(src) && !existsSync10(dest)) {
+    const src = resolve17(sharedDir, name);
+    const dest = resolve17(targetDir, name);
+    if (existsSync12(src) && !existsSync12(dest)) {
       copyFileSync(src, dest);
     }
   }
   const hubspotExample = firstExisting([
-    resolve15(sharedDir, HUBSPOT_CONFIG_EXAMPLE),
+    resolve17(sharedDir, HUBSPOT_CONFIG_EXAMPLE),
     kitPath("templates", HUBSPOT_CONFIG_EXAMPLE)
   ]);
   if (!hubspotExample) return;
-  const destHubspot = resolve15(targetDir, HUBSPOT_CONFIG_EXAMPLE);
-  if (!existsSync10(destHubspot) && !existsSync10(resolve15(targetDir, HUBSPOT_CONFIG_FILE))) {
+  const destHubspot = resolve17(targetDir, HUBSPOT_CONFIG_EXAMPLE);
+  if (!existsSync12(destHubspot) && !existsSync12(resolve17(targetDir, HUBSPOT_CONFIG_FILE))) {
     copyFileSync(hubspotExample, destHubspot);
   }
 }
@@ -1946,6 +2137,10 @@ function formatSetupHint(results) {
   if (envCopied) {
     return "Edit .env.* files \u2014 set VITE_PUBLIC_REST_API_ENDPOINT and portal IDs for your environment";
   }
+  const cdnMirror = results.find((r) => r.path === "portal.cdn.json" && r.action === "copied");
+  if (cdnMirror) {
+    return "Hybrid CDN: set public GitHub mirror in portal.cdn.json; token in .env.local (wp init prompts)";
+  }
   return void 0;
 }
 
@@ -2027,7 +2222,7 @@ function buildConfigForProject(template, projectName, router) {
   return config;
 }
 function assertTargetDirIsScaffoldable(targetDir) {
-  if (!existsSync11(targetDir)) return;
+  if (!existsSync13(targetDir)) return;
   const entries = readdirSync2(targetDir).filter((entry) => entry !== ".DS_Store");
   if (entries.length > 0) {
     throw new WpHsError(`Target directory is not empty: ${targetDir}`, {
@@ -2038,7 +2233,7 @@ function assertTargetDirIsScaffoldable(targetDir) {
 }
 function resolveInitTargetDir(options, interactiveName) {
   if (options.directory) {
-    return resolve16(options.directory);
+    return resolve18(options.directory);
   }
   const parentDir = process.cwd();
   const slug = options.name ?? interactiveName;
@@ -2052,7 +2247,7 @@ function resolveInitTargetDir(options, interactiveName) {
   if (error) {
     throw new WpHsError(error, { exitCode: ExitCode.USER_ERROR });
   }
-  return resolve16(parentDir, slug);
+  return resolve18(parentDir, slug);
 }
 async function runInit(ctx, options) {
   const nonInteractive = ctx.global.ci || ctx.global.yes || ctx.global.json;
@@ -2061,7 +2256,7 @@ async function runInit(ctx, options) {
   let router = options.router;
   if (!nonInteractive) {
     if (!template) {
-      const type = await p2.select({
+      const type = await p3.select({
         message: "Project type",
         options: [
           {
@@ -2073,22 +2268,22 @@ async function runInit(ctx, options) {
           { value: "theme-starter", label: "Theme starter", hint: "CMS theme templates" }
         ]
       });
-      if (p2.isCancel(type)) throw new WpHsError("Init cancelled", { exitCode: ExitCode.USER_ERROR });
+      if (p3.isCancel(type)) throw new WpHsError("Init cancelled", { exitCode: ExitCode.USER_ERROR });
       template = type;
     }
     if (!options.directory && !projectName) {
-      const nameAnswer = await p2.text({
+      const nameAnswer = await p3.text({
         message: "Project name (folder name)",
         placeholder: "my-portal-module",
         validate: (value) => validateProjectName(normalizeProjectName(value ?? ""))
       });
-      if (p2.isCancel(nameAnswer)) {
+      if (p3.isCancel(nameAnswer)) {
         throw new WpHsError("Init cancelled", { exitCode: ExitCode.USER_ERROR });
       }
       projectName = normalizeProjectName(nameAnswer);
     }
     if (!router && template && isModuleTemplate(template)) {
-      const routerAnswer = await p2.select({
+      const routerAnswer = await p3.select({
         message: "Client-side routing",
         initialValue: "hash",
         options: [
@@ -2109,7 +2304,7 @@ async function runInit(ctx, options) {
           }
         ]
       });
-      if (p2.isCancel(routerAnswer)) {
+      if (p3.isCancel(routerAnswer)) {
         throw new WpHsError("Init cancelled", { exitCode: ExitCode.USER_ERROR });
       }
       router = routerAnswer;
@@ -2125,7 +2320,7 @@ async function runInit(ctx, options) {
   const slug = projectName ?? basename2(targetDir);
   assertTargetDirIsScaffoldable(targetDir);
   const templateDir = kitPath("templates", template);
-  if (!existsSync11(templateDir)) {
+  if (!existsSync13(templateDir)) {
     throw new WpHsError(`Template not found: ${template}`, { exitCode: ExitCode.USER_ERROR });
   }
   if (ctx.global.dryRun) {
@@ -2136,18 +2331,18 @@ async function runInit(ctx, options) {
   cpSync2(templateDir, targetDir, { recursive: true });
   copySharedSetupExamples(targetDir);
   const config = buildConfigForProject(template, slug, router);
-  writeFileSync3(resolve16(targetDir, WOODSCLI_CONFIG_FILE), `${JSON.stringify(config, null, 2)}
+  writeFileSync5(resolve18(targetDir, WOODSCLI_CONFIG_FILE), `${JSON.stringify(config, null, 2)}
 `);
-  const pkgPath = resolve16(targetDir, "package.json");
-  if (existsSync11(pkgPath)) {
-    const pkg = JSON.parse(readFileSync8(pkgPath, "utf8"));
+  const pkgPath = resolve18(targetDir, "package.json");
+  if (existsSync13(pkgPath)) {
+    const pkg = JSON.parse(readFileSync10(pkgPath, "utf8"));
     pkg.name = slug;
     pkg.scripts = { ...pkg.scripts, ...TEMPLATE_SCRIPTS[template] };
     pkg.devDependencies = {
       ...pkg.devDependencies,
       ...templateDevDependencies()
     };
-    writeFileSync3(pkgPath, `${JSON.stringify(pkg, null, 2)}
+    writeFileSync5(pkgPath, `${JSON.stringify(pkg, null, 2)}
 `);
   }
   if (router && isModuleTemplate(template)) {
@@ -2158,7 +2353,7 @@ async function runInit(ctx, options) {
     logger: ctx.logger,
     dryRun: false
   });
-  const gitignorePath = resolve16(targetDir, ".gitignore");
+  const gitignorePath = resolve18(targetDir, ".gitignore");
   const gitignoreExtras = [
     "hubspot.config.yml",
     ".wphs/config/module-config.local.json",
@@ -2171,16 +2366,40 @@ async function runInit(ctx, options) {
     ".wphs/.kit-bootstrap.tsx",
     ".wphs/.kit-bootstrap-greenfield.tsx"
   ];
-  const existing = existsSync11(gitignorePath) ? readFileSync8(gitignorePath, "utf8") : "";
+  const existing = existsSync13(gitignorePath) ? readFileSync10(gitignorePath, "utf8") : "";
   const toAppend = gitignoreExtras.filter((line) => !existing.includes(line)).join("\n");
   if (toAppend) {
-    writeFileSync3(gitignorePath, `${existing.trimEnd()}
+    writeFileSync5(gitignorePath, `${existing.trimEnd()}
 ${toAppend}
 `);
   }
+  if (template === "module-hybrid-cdn" && !ctx.global.dryRun && needsCdnGitHubSetup(targetDir)) {
+    const githubDefault = githubDefaultForPrompt(targetDir);
+    let cdnSetup = null;
+    if (nonInteractive) {
+      if (options.cdnGithub) {
+        cdnSetup = { github: options.cdnGithub };
+      }
+    } else {
+      p3.log.step("Hybrid CDN \u2014 GitHub mirror (public repo for jsDelivr)");
+      cdnSetup = await promptCdnGitHubSetup({
+        projectRoot: targetDir,
+        githubDefault,
+        github: options.cdnGithub
+      });
+    }
+    if (cdnSetup) {
+      applyCdnGitHubSetup(targetDir, cdnSetup);
+      if (!nonInteractive) {
+        p3.log.success(formatCdnSetupNote(targetDir));
+      } else {
+        ctx.logger.success(formatCdnSetupNote(targetDir));
+      }
+    }
+  }
   if (!nonInteractive) {
-    p2.log.success(`Scaffolded ${template} in ${targetDir}`);
-    p2.note(`cd ${slug} && yarn install && wp setup && wp doctor && wp dev`, "Getting started");
+    p3.log.success(`Scaffolded ${template} in ${targetDir}`);
+    p3.note(`cd ${slug} && yarn install && wp setup && wp doctor && wp dev`, "Getting started");
   } else {
     ctx.logger.success(`Scaffolded ${template} in ${targetDir}`);
   }
@@ -2188,40 +2407,40 @@ ${toAppend}
 }
 
 // src/cli/commands/migrate.ts
-import { cpSync as cpSync3, existsSync as existsSync12, mkdirSync as mkdirSync4, readFileSync as readFileSync9, readdirSync as readdirSync3, renameSync, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
-import { join as join3, resolve as resolve17 } from "path";
+import { cpSync as cpSync3, existsSync as existsSync14, mkdirSync as mkdirSync4, readFileSync as readFileSync11, readdirSync as readdirSync3, renameSync, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
+import { join as join3, resolve as resolve19 } from "path";
 var LEGACY_DIRS = [".dev", ".woodsportal"];
 var LEGACY_BASELINE = ".wp-hs-baseline";
 async function runMigrate(ctx, _options = {}) {
   const root = ctx.projectRoot;
-  const wphsRoot = resolve17(root, WPHS_WORKSPACE_DIR);
+  const wphsRoot = resolve19(root, WPHS_WORKSPACE_DIR);
   const actions = [];
   for (const legacy of LEGACY_DIRS) {
-    const legacyPath = resolve17(root, legacy);
-    if (!existsSync12(legacyPath)) continue;
+    const legacyPath = resolve19(root, legacy);
+    if (!existsSync14(legacyPath)) continue;
     actions.push(`Move ${legacy}/ \u2192 .wphs/`);
     if (ctx.global.dryRun) continue;
     mkdirSync4(join3(wphsRoot, "config"), { recursive: true });
     mkdirSync4(join3(wphsRoot, "assets", "branding"), { recursive: true });
     const localConfig = join3(legacyPath, "module-config.local.json");
     const exampleConfig = join3(legacyPath, "module-config.example.json");
-    if (existsSync12(localConfig)) {
+    if (existsSync14(localConfig)) {
       cpSync3(localConfig, join3(wphsRoot, "config", "module-config.local.json"));
     }
-    if (existsSync12(exampleConfig)) {
+    if (existsSync14(exampleConfig)) {
       cpSync3(exampleConfig, join3(wphsRoot, "config", "module-config.example.json"));
     }
     const branding = join3(legacyPath, "branding-assets");
-    if (existsSync12(branding)) {
+    if (existsSync14(branding)) {
       for (const file of readdirSync3(branding)) {
         cpSync3(join3(branding, file), join3(wphsRoot, "assets", "branding", file));
       }
     }
     rmSync3(legacyPath, { recursive: true, force: true });
   }
-  const legacyBaseline = resolve17(root, LEGACY_BASELINE);
+  const legacyBaseline = resolve19(root, LEGACY_BASELINE);
   const targetBaseline = join3(wphsRoot, "audit", "baseline");
-  if (existsSync12(legacyBaseline)) {
+  if (existsSync14(legacyBaseline)) {
     actions.push(`Move ${LEGACY_BASELINE}/ \u2192 .wphs/audit/baseline/`);
     if (!ctx.global.dryRun) {
       mkdirSync4(targetBaseline, { recursive: true });
@@ -2229,26 +2448,26 @@ async function runMigrate(ctx, _options = {}) {
       rmSync3(legacyBaseline, { recursive: true, force: true });
     }
   }
-  const legacyConfigPath2 = resolve17(root, LEGACY_WOODSPORTAL_HS_FILE);
-  const woodscliPath = resolve17(root, WOODSCLI_CONFIG_FILE);
-  if (existsSync12(legacyConfigPath2) && !existsSync12(woodscliPath)) {
+  const legacyConfigPath2 = resolve19(root, LEGACY_WOODSPORTAL_HS_FILE);
+  const woodscliPath = resolve19(root, WOODSCLI_CONFIG_FILE);
+  if (existsSync14(legacyConfigPath2) && !existsSync14(woodscliPath)) {
     actions.push(`Rename ${LEGACY_WOODSPORTAL_HS_FILE} \u2192 ${WOODSCLI_CONFIG_FILE}`);
     if (!ctx.global.dryRun) {
       renameSync(legacyConfigPath2, woodscliPath);
     }
-  } else if (existsSync12(legacyConfigPath2) && existsSync12(woodscliPath)) {
+  } else if (existsSync14(legacyConfigPath2) && existsSync14(woodscliPath)) {
     actions.push(`Remove duplicate ${LEGACY_WOODSPORTAL_HS_FILE}`);
     if (!ctx.global.dryRun) {
       rmSync3(legacyConfigPath2, { force: true });
     }
   }
-  if (existsSync12(woodscliPath)) {
-    const raw = JSON.parse(readFileSync9(woodscliPath, "utf8"));
+  if (existsSync14(woodscliPath)) {
+    const raw = JSON.parse(readFileSync11(woodscliPath, "utf8"));
     if (raw?.dev?.moduleConfigDir && raw.dev.moduleConfigDir !== WPHS_WORKSPACE_DIR) {
       actions.push(`Update dev.moduleConfigDir \u2192 .wphs in project config`);
       if (!ctx.global.dryRun) {
         raw.dev.moduleConfigDir = WPHS_WORKSPACE_DIR;
-        writeFileSync4(woodscliPath, `${JSON.stringify(raw, null, 2)}
+        writeFileSync6(woodscliPath, `${JSON.stringify(raw, null, 2)}
 `);
       }
     }
@@ -2277,10 +2496,10 @@ async function runMigrate(ctx, _options = {}) {
 }
 
 // src/cli/commands/examples.ts
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 function loadManifest() {
   const manifestPath = kitPath("examples", "manifest.json");
-  const raw = JSON.parse(readFileSync10(manifestPath, "utf8"));
+  const raw = JSON.parse(readFileSync12(manifestPath, "utf8"));
   return raw.scenarios;
 }
 async function runExamplesList(ctx, options = {}) {
@@ -2313,15 +2532,15 @@ async function runExamplesSmoke(ctx, options = {}) {
 }
 
 // src/cli/commands/fields.ts
-import { cpSync as cpSync4, existsSync as existsSync13, readFileSync as readFileSync11, writeFileSync as writeFileSync5 } from "fs";
-import { resolve as resolve18 } from "path";
+import { cpSync as cpSync4, existsSync as existsSync15, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "fs";
+import { resolve as resolve20 } from "path";
 async function runFieldsSync(ctx, options = {}) {
   const direction = options.direction ?? "pull";
-  const fieldsPath = resolve18(ctx.projectRoot, ctx.config.dev.fieldsJson);
-  const cacheDir = resolve18(ctx.projectRoot, ctx.config.dev.moduleConfigDir, "cache", "fields-sync");
-  const cachePath = resolve18(cacheDir, "fields.json");
+  const fieldsPath = resolve20(ctx.projectRoot, ctx.config.dev.fieldsJson);
+  const cacheDir = resolve20(ctx.projectRoot, ctx.config.dev.moduleConfigDir, "cache", "fields-sync");
+  const cachePath = resolve20(cacheDir, "fields.json");
   if (direction === "pull") {
-    if (!existsSync13(fieldsPath)) {
+    if (!existsSync15(fieldsPath)) {
       throw new WpHsError(`Missing ${ctx.config.dev.fieldsJson}`, {
         exitCode: ExitCode.USER_ERROR,
         remediation: "Add fields.json or run wp init."
@@ -2337,7 +2556,7 @@ async function runFieldsSync(ctx, options = {}) {
     ctx.logger.success(`Cached fields \u2192 ${cachePath}`);
     return ExitCode.SUCCESS;
   }
-  if (!existsSync13(cachePath)) {
+  if (!existsSync15(cachePath)) {
     throw new WpHsError("No cached fields \u2014 run wp fields sync pull first.", {
       exitCode: ExitCode.USER_ERROR
     });
@@ -2346,14 +2565,14 @@ async function runFieldsSync(ctx, options = {}) {
     ctx.logger.info(`[dry-run] Would write ${cachePath} \u2192 ${fieldsPath}`);
     return ExitCode.SUCCESS;
   }
-  writeFileSync5(fieldsPath, readFileSync11(cachePath, "utf8"));
+  writeFileSync7(fieldsPath, readFileSync13(cachePath, "utf8"));
   ctx.logger.success(`Restored fields from cache \u2192 ${fieldsPath}`);
   return ExitCode.SUCCESS;
 }
 
 // src/cli/commands/regression.ts
-import { existsSync as existsSync14 } from "fs";
-import { resolve as resolve19 } from "path";
+import { existsSync as existsSync16 } from "fs";
+import { resolve as resolve21 } from "path";
 var LEGACY_SHIM_SCRIPTS = [
   "build-cdn.mjs",
   "run-vite-build.mjs",
@@ -2376,21 +2595,21 @@ async function runRegressionSmoke(ctx, options = {}) {
   if (!validateOk) failures.push("wp config validate failed");
   if (options.checkLegacyShims !== false) {
     for (const script of LEGACY_SHIM_SCRIPTS) {
-      const shim = resolve19(ctx.projectRoot, "scripts", script);
+      const shim = resolve21(ctx.projectRoot, "scripts", script);
       const kitScript = kitPath("scripts", script);
-      const shimOk = existsSync14(shim) && existsSync14(kitScript);
+      const shimOk = existsSync16(shim) && existsSync16(kitScript);
       checks.push({ name: `shim:${script}`, ok: shimOk });
       if (!shimOk) failures.push(`Missing legacy shim or kit script: ${script}`);
     }
   }
   for (const rel of FORBIDDEN_CONSUMER_PATHS) {
-    const forbidden = resolve19(ctx.projectRoot, rel);
-    const absent = !existsSync14(forbidden);
+    const forbidden = resolve21(ctx.projectRoot, rel);
+    const absent = !existsSync16(forbidden);
     checks.push({ name: `no-${rel}`, ok: absent });
     if (!absent) failures.push(`Forbidden dev path still present: ${rel}`);
   }
-  const woodscliConfig = resolve19(ctx.projectRoot, WOODSCLI_CONFIG_FILE);
-  const configOk = existsSync14(woodscliConfig);
+  const woodscliConfig = resolve21(ctx.projectRoot, WOODSCLI_CONFIG_FILE);
+  const configOk = existsSync16(woodscliConfig);
   checks.push({ name: WOODSCLI_CONFIG_FILE, ok: configOk });
   if (!configOk) failures.push(`${WOODSCLI_CONFIG_FILE} missing`);
   if (ctx.global.json) {
@@ -2448,6 +2667,17 @@ async function runSetup(ctx, options = {}) {
   );
   const copied = results.filter((r) => r.action === "copied");
   const manual = results.filter((r) => r.action === "manual");
+  const nonInteractive = ctx.global.ci || ctx.global.yes || ctx.global.json || ctx.global.dryRun;
+  if (usesCdnPipeline(ctx.config) && needsCdnGitHubSetup(ctx.projectRoot) && !nonInteractive) {
+    const cdnSetup = await promptCdnGitHubSetup({
+      projectRoot: ctx.projectRoot,
+      githubDefault: githubDefaultForPrompt(ctx.projectRoot)
+    });
+    if (cdnSetup) {
+      applyCdnGitHubSetup(ctx.projectRoot, cdnSetup);
+      ctx.logger.success(formatCdnSetupNote(ctx.projectRoot));
+    }
+  }
   if (ctx.global.json) {
     ctx.logger.json({
       command: "setup",
@@ -2483,11 +2713,11 @@ async function runSetup(ctx, options = {}) {
 }
 
 // src/cli/commands/portal.ts
-import * as p3 from "@clack/prompts";
+import * as p4 from "@clack/prompts";
 
 // src/lib/hubspot-portals.ts
-import { existsSync as existsSync15, readFileSync as readFileSync12 } from "fs";
-import { resolve as resolve20 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync14 } from "fs";
+import { resolve as resolve22 } from "path";
 function stripYamlScalar(value) {
   const trimmed = value.trim();
   if (trimmed.startsWith('"') && trimmed.endsWith('"') || trimmed.startsWith("'") && trimmed.endsWith("'")) {
@@ -2525,20 +2755,20 @@ function parseHubSpotConfigPortals(raw) {
   return { defaultPortal, portals };
 }
 function readHubSpotPortals(projectRoot) {
-  const configPath = resolve20(projectRoot, HUBSPOT_CONFIG_FILE);
-  if (!existsSync15(configPath)) {
+  const configPath = resolve22(projectRoot, HUBSPOT_CONFIG_FILE);
+  if (!existsSync17(configPath)) {
     throw new WpHsError(`${HUBSPOT_CONFIG_FILE} not found in project root.`, {
       exitCode: ExitCode.USER_ERROR,
       remediation: "Run wp setup, then add your portal + PAT."
     });
   }
-  const raw = readFileSync12(configPath, "utf8");
+  const raw = readFileSync14(configPath, "utf8");
   const { defaultPortal, portals } = parseHubSpotConfigPortals(raw);
   return { configPath, defaultPortal, portals };
 }
 function resolvePortalName(portals, nameOrId) {
   const needle = nameOrId.trim();
-  return portals.find((p4) => p4.name === needle) ?? portals.find((p4) => p4.portalId === needle) ?? null;
+  return portals.find((p5) => p5.name === needle) ?? portals.find((p5) => p5.portalId === needle) ?? null;
 }
 
 // src/cli/commands/portal.ts
@@ -2593,7 +2823,7 @@ async function runPortalUse(ctx, options = {}) {
         remediation: "wp portal use <name>  \xB7  wp portal list"
       });
     }
-    const answer = await p3.select({
+    const answer = await p4.select({
       message: "Set default HubSpot portal",
       options: data.portals.map((portal2) => ({
         value: portal2.name,
@@ -2601,7 +2831,7 @@ async function runPortalUse(ctx, options = {}) {
         hint: portal2.name === data.defaultPortal ? `current default \xB7 ${portal2.portalId ?? "no id"}` : portal2.portalId ?? void 0
       }))
     });
-    if (p3.isCancel(answer)) {
+    if (p4.isCancel(answer)) {
       throw new WpHsError("Portal selection cancelled", { exitCode: ExitCode.USER_ERROR });
     }
     targetName = answer;
@@ -2662,7 +2892,7 @@ async function runWatch(ctx, options) {
 // src/cli/program.ts
 function readVersion() {
   try {
-    const pkg = JSON.parse(readFileSync13(resolve21(getKitRoot(), "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync15(resolve23(getKitRoot(), "package.json"), "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -2721,7 +2951,10 @@ function createProgram() {
     const global = program2.opts();
     await handle(() => runConfigValidate(buildContext(global)));
   });
-  program2.command("init").description("Scaffold a new module or theme project").option("-t, --template <type>", "module-hybrid-cdn | module-monolith | theme-starter").option("-n, --name <slug>", "Project name (creates ./<name>/ under cwd)").option("-d, --directory <path>", "Full target directory (skips name \u2192 folder prompt)").option("--router <mode>", "hash (client-frontend default) | browser | none \u2014 modules only").action(
+  program2.command("init").description("Scaffold a new module or theme project").option("-t, --template <type>", "module-hybrid-cdn | module-monolith | theme-starter").option("-n, --name <slug>", "Project name (creates ./<name>/ under cwd)").option("-d, --directory <path>", "Full target directory (skips name \u2192 folder prompt)").option("--router <mode>", "hash (client-frontend default) | browser | none \u2014 modules only").option(
+    "--cdn-github <org/repo>",
+    "Public GitHub CDN mirror repo (hybrid CDN; use with --ci / -y)"
+  ).action(
     async (opts) => {
       const global = program2.opts();
       const logger = createLogger({
@@ -2742,7 +2975,8 @@ function createProgram() {
           template: opts.template,
           name: opts.name,
           directory: opts.directory,
-          router: routerMode
+          router: routerMode,
+          cdnGithub: opts.cdnGithub
         })
       );
     }