@woodsportal/hubspot-kit 1.0.41-dev.6 → 1.0.42-dev.0

package/dist/cli.js

@@ -26,7 +26,6 @@ import {
   isWpHsError,
   runCommand,
   runCommandAsync,
-  runNodeScript,
   runNodeScriptAsync,
   runNodeScriptLongRunning
 } from "./chunk-4GOJPOW3.js";
@@ -276,9 +275,20 @@ function defaultBaselineDir(projectRoot, config) {
   return resolve2(projectRoot, workspace, "audit", "baseline");
 }
 
+// src/lib/exit-cli.ts
+async function exitCli(code) {
+  await new Promise((resolve23) => {
+    setImmediate(resolve23);
+  });
+  await new Promise((resolve23) => {
+    setTimeout(resolve23, 0);
+  });
+  process.exit(code);
+}
+
 // src/cli/commands/doctor.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
-import { join as join2, resolve as resolve7 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
+import { join as join2, resolve as resolve9 } from "path";
 
 // src/lib/cli-spinner.ts
 import * as p from "@clack/prompts";
@@ -526,7 +536,7 @@ function doctorHubSpotChecks(projectRoot) {
       ok: assessment.hsCliInstalled,
       message: assessment.hsCliInstalled ? `HubSpot CLI ${assessment.hsCliVersion ?? ""}`.trim() : "HubSpot CLI not installed",
       remediation: assessment.hsCliInstalled ? void 0 : "npm i -g @hubspot/cli",
-      severity: "error"
+      severity: "warn"
     },
     {
       name: "hubspot-config",
@@ -545,6 +555,215 @@ function doctorHubSpotChecks(projectRoot) {
   ];
 }
 
+// src/lib/cdn-github-setup.ts
+import { existsSync as existsSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
+import { resolve as resolve5 } from "path";
+import * as p2 from "@clack/prompts";
+
+// src/lib/project-env-files.ts
+import { existsSync as existsSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
+import { resolve as resolve4 } from "path";
+var ENV_LOCAL_FILE = ".env.local";
+var ENV_GITIGNORE_LINES = [".env", ".env.*", "!.env*.example", ENV_LOCAL_FILE];
+function parseEnvFile(content) {
+  const result = {};
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eq = trimmed.indexOf("=");
+    if (eq <= 0) continue;
+    const key = trimmed.slice(0, eq).trim();
+    let value = trimmed.slice(eq + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    result[key] = value;
+  }
+  return result;
+}
+function readEnvLocal(projectRoot) {
+  const path = resolve4(projectRoot, ENV_LOCAL_FILE);
+  if (!existsSync3(path)) return {};
+  return parseEnvFile(readFileSync5(path, "utf8"));
+}
+function formatEnvLocal(entries) {
+  const lines = [
+    "# Local secrets \u2014 gitignored. Created by wp init / wp setup (hybrid CDN).",
+    "# PORTAL_CDN_PUBLISH_TOKEN needs repo push on your portal.cdn.json mirror.",
+    ""
+  ];
+  for (const [key, value] of Object.entries(entries)) {
+    if (value.includes(" ") || value.includes("#")) {
+      lines.push(`${key}="${value.replace(/"/g, '\\"')}"`);
+    } else {
+      lines.push(`${key}=${value}`);
+    }
+  }
+  return `${lines.join("\n").trimEnd()}
+`;
+}
+function writeEnvLocal(projectRoot, entries) {
+  const path = resolve4(projectRoot, ENV_LOCAL_FILE);
+  const existing = existsSync3(path) ? parseEnvFile(readFileSync5(path, "utf8")) : {};
+  writeFileSync2(path, formatEnvLocal({ ...existing, ...entries }));
+}
+function mergeProjectEnv(projectRoot, base = process.env) {
+  const local = readEnvLocal(projectRoot);
+  const merged = { ...base };
+  for (const [key, value] of Object.entries(local)) {
+    if (merged[key] == null || merged[key] === "") {
+      merged[key] = value;
+    }
+  }
+  return merged;
+}
+function ensureEnvFilesGitignore(projectRoot) {
+  const gitignorePath = resolve4(projectRoot, ".gitignore");
+  const existing = existsSync3(gitignorePath) ? readFileSync5(gitignorePath, "utf8") : "";
+  const toAppend = ENV_GITIGNORE_LINES.filter((line) => !existing.includes(line)).join("\n");
+  if (!toAppend) return;
+  writeFileSync2(gitignorePath, `${existing.trimEnd()}
+
+# Env files (secrets)
+${toAppend}
+`);
+}
+
+// src/lib/cdn-github-setup.ts
+var PORTAL_CDN_PUBLISH_TOKEN_ENV = "PORTAL_CDN_PUBLISH_TOKEN";
+var PORTAL_CDN_JSON = "portal.cdn.json";
+var PLACEHOLDER_GITHUB = /your-org|your-portal-cdn-mirror/i;
+function isPlaceholderGithubSlug(github) {
+  return PLACEHOLDER_GITHUB.test(github);
+}
+function defaultPortalCdnJson() {
+  const examplePath = kitPath("templates", "shared", "portal.cdn.json.example");
+  if (existsSync4(examplePath)) {
+    return JSON.parse(readFileSync6(examplePath, "utf8"));
+  }
+  return {
+    publishMode: "jsdelivr",
+    github: "your-org/your-portal-cdn-mirror",
+    gitRemote: "https://github.com/your-org/your-portal-cdn-mirror.git",
+    cdnPathInRepo: "dist/cdn",
+    defaultBranch: "main"
+  };
+}
+function readPortalCdnJson(projectRoot) {
+  const path = resolve5(projectRoot, PORTAL_CDN_JSON);
+  if (!existsSync4(path)) return null;
+  try {
+    return JSON.parse(readFileSync6(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function normalizeGithubSlug(input) {
+  const trimmed = input.trim().replace(/^https:\/\/github\.com\//, "").replace(/\.git$/, "");
+  const parts = trimmed.split("/").filter(Boolean);
+  if (parts.length !== 2) return null;
+  return `${parts[0]}/${parts[1]}`;
+}
+function portalCdnJsonFromGithub(github, base) {
+  const slug = normalizeGithubSlug(github);
+  if (!slug) {
+    throw new Error(`Invalid GitHub repo \u2014 use org/repo (got "${github}")`);
+  }
+  return {
+    publishMode: base?.publishMode ?? "jsdelivr",
+    github: slug,
+    gitRemote: `https://github.com/${slug}.git`,
+    cdnPathInRepo: base?.cdnPathInRepo ?? "dist/cdn",
+    defaultBranch: base?.defaultBranch ?? "main"
+  };
+}
+function hasCdnPublishToken(projectRoot) {
+  if (process.env[PORTAL_CDN_PUBLISH_TOKEN_ENV]?.trim()) return true;
+  if (process.env.GITHUB_TOKEN?.trim()) return true;
+  return Boolean(readEnvLocal(projectRoot)[PORTAL_CDN_PUBLISH_TOKEN_ENV]?.trim());
+}
+function hasConfiguredCdnGithubMirror(projectRoot) {
+  const config = readPortalCdnJson(projectRoot);
+  const github = config?.github ?? "";
+  return Boolean(github) && !PLACEHOLDER_GITHUB.test(github);
+}
+function githubDefaultForPrompt(projectRoot) {
+  const existing = readPortalCdnJson(projectRoot);
+  if (existing?.github && !PLACEHOLDER_GITHUB.test(existing.github)) {
+    return existing.github;
+  }
+  return defaultPortalCdnJson().github;
+}
+function needsCdnGitHubSetup(projectRoot) {
+  return !hasConfiguredCdnGithubMirror(projectRoot) || !hasCdnPublishToken(projectRoot);
+}
+function applyCdnGitHubSetup(projectRoot, input) {
+  const existing = readPortalCdnJson(projectRoot) ?? defaultPortalCdnJson();
+  const updated = portalCdnJsonFromGithub(input.github, existing);
+  writeFileSync3(resolve5(projectRoot, PORTAL_CDN_JSON), `${JSON.stringify(updated, null, 2)}
+`);
+  if (input.token?.trim()) {
+    writeEnvLocal(projectRoot, { [PORTAL_CDN_PUBLISH_TOKEN_ENV]: input.token.trim() });
+  }
+  ensureEnvFilesGitignore(projectRoot);
+}
+async function promptCdnGitHubSetup(options = {}) {
+  if (options.skip) return null;
+  const projectRoot = options.projectRoot ?? process.cwd();
+  if (!needsCdnGitHubSetup(projectRoot)) {
+    return null;
+  }
+  let github = options.github?.trim();
+  if (!github && hasConfiguredCdnGithubMirror(projectRoot)) {
+    github = readPortalCdnJson(projectRoot)?.github;
+  }
+  if (!github) {
+    const answer = await p2.text({
+      message: "Public GitHub CDN mirror (org/repo)",
+      placeholder: options.githubDefault ?? "your-org/your-portal-cdn-mirror",
+      initialValue: options.githubDefault,
+      validate: (value) => {
+        const slug = normalizeGithubSlug(value ?? "");
+        return slug ? void 0 : "Enter a public repo as org/repo (jsDelivr serves from it)";
+      }
+    });
+    if (p2.isCancel(answer)) return null;
+    github = normalizeGithubSlug(answer) ?? void 0;
+  }
+  if (!github) return null;
+  if (hasCdnPublishToken(projectRoot)) {
+    return { github };
+  }
+  const tokenAnswer = await p2.password({
+    message: "GitHub token (repo push on CDN mirror)",
+    validate: (value) => {
+      if (!value?.trim()) return "Required for wp publish \u2014 create a fine-grained PAT with Contents: Read and write";
+      return void 0;
+    }
+  });
+  if (p2.isCancel(tokenAnswer)) return null;
+  return { github, token: tokenAnswer.trim() };
+}
+function formatCdnSetupNote(_projectRoot) {
+  return `CDN config written \u2014 edit ${PORTAL_CDN_JSON} if needed; token saved to ${ENV_LOCAL_FILE} (gitignored)`;
+}
+
+// src/lib/wphs-workspace.ts
+var ensureModulePromise;
+function loadEnsureModule() {
+  if (!ensureModulePromise) {
+    ensureModulePromise = Promise.resolve().then(async () => {
+      const mod = await import("./ensure-wphs-workspace-5S3GTO6K.js");
+      return mod;
+    });
+  }
+  return ensureModulePromise;
+}
+async function ensureProjectWphsWorkspace(projectRoot) {
+  const { ensureWphsWorkspace } = await loadEnsureModule();
+  return ensureWphsWorkspace(projectRoot, getKitRoot());
+}
+
 // src/lib/template-dev-deps.ts
 var VITE_DEV_PEER_DEPS = {
   vite: "^6.1.0",
@@ -667,14 +886,14 @@ function validateHubSpotFieldsJson(fields) {
 }
 
 // src/lib/developer-slug.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
-import { resolve as resolve4 } from "path";
-import * as p2 from "@clack/prompts";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
+import { resolve as resolve6 } from "path";
+import * as p3 from "@clack/prompts";
 var SLUG_MAX_LEN = 12;
 var SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,10}[a-z0-9])?$/;
 var DEVELOPER_CONFIG_FILE = "developer.json";
 function developerConfigPath(projectRoot) {
-  return resolve4(projectRoot, ".wphs", "config", DEVELOPER_CONFIG_FILE);
+  return resolve6(projectRoot, ".wphs", "config", DEVELOPER_CONFIG_FILE);
 }
 function sanitizeDevSlug(input) {
   if (!input?.trim()) return void 0;
@@ -686,9 +905,9 @@ function readDeveloperSlug(projectRoot) {
   const fromEnv = sanitizeDevSlug(process.env.PORTAL_CDN_DEV_SLUG) ?? sanitizeDevSlug(process.env.MODULE_CDN_DEV_SLUG);
   if (fromEnv) return fromEnv;
   const path = developerConfigPath(projectRoot);
-  if (!existsSync3(path)) return void 0;
+  if (!existsSync5(path)) return void 0;
   try {
-    const raw = JSON.parse(readFileSync5(path, "utf8"));
+    const raw = JSON.parse(readFileSync7(path, "utf8"));
     return sanitizeDevSlug(raw.slug);
   } catch {
     return void 0;
@@ -700,8 +919,8 @@ function writeDeveloperSlug(projectRoot, slug) {
     throw new Error("Invalid CDN dev slug \u2014 use lowercase letters, numbers, and hyphens (max 12 chars)");
   }
   const path = developerConfigPath(projectRoot);
-  mkdirSync2(resolve4(path, ".."), { recursive: true });
-  writeFileSync2(path, `${JSON.stringify({ slug: normalized }, null, 2)}
+  mkdirSync2(resolve6(path, ".."), { recursive: true });
+  writeFileSync4(path, `${JSON.stringify({ slug: normalized }, null, 2)}
 `);
 }
 function needsDeveloperSlugSetup(projectRoot) {
@@ -711,7 +930,7 @@ async function promptDeveloperSlug(projectRoot) {
   if (!needsDeveloperSlugSetup(projectRoot)) {
     return readDeveloperSlug(projectRoot);
   }
-  const slug = await p2.text({
+  const slug = await p3.text({
     message: "CDN dev slug (unique per developer for shared CDN mirror \u2014 e.g. your first name)",
     placeholder: "manab",
     validate: (value) => {
@@ -721,7 +940,7 @@ async function promptDeveloperSlug(projectRoot) {
       return void 0;
     }
   });
-  if (p2.isCancel(slug) || typeof slug !== "string") {
+  if (p3.isCancel(slug) || typeof slug !== "string") {
     return void 0;
   }
   writeDeveloperSlug(projectRoot, slug);
@@ -763,37 +982,37 @@ function resolveModuleBuildIdMetaForCli(projectRoot, env = process.env) {
 }
 
 // src/lib/upload-only-module.ts
-import { existsSync as existsSync4 } from "fs";
-import { resolve as resolve5 } from "path";
+import { existsSync as existsSync6 } from "fs";
+import { resolve as resolve7 } from "path";
 function isUploadOnlyPreexistingProject(projectRoot, moduleArtifactDirs) {
   if (moduleArtifactDirs.length === 0) return false;
-  if (existsSync4(resolve5(projectRoot, "package.json"))) return false;
-  if (existsSync4(resolve5(projectRoot, "src"))) return false;
-  return moduleArtifactDirs.some((dir) => existsSync4(resolve5(dir, "fields.json")));
+  if (existsSync6(resolve7(projectRoot, "package.json"))) return false;
+  if (existsSync6(resolve7(projectRoot, "src"))) return false;
+  return moduleArtifactDirs.some((dir) => existsSync6(resolve7(dir, "fields.json")));
 }
 
 // src/vite/resolve-dev-config.ts
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync7 } from "fs";
 import { platform } from "os";
-import { resolve as resolve6 } from "path";
+import { resolve as resolve8 } from "path";
 var VITE_JS_SEGMENTS = ["node_modules", "vite", "bin", "vite.js"];
 function isProjectViteInstalled(projectRoot) {
-  return existsSync5(resolve6(projectRoot, ...VITE_JS_SEGMENTS));
+  return existsSync7(resolve8(projectRoot, ...VITE_JS_SEGMENTS));
 }
 function resolveProjectViteSpawn(projectRoot) {
-  const viteJs = resolve6(projectRoot, ...VITE_JS_SEGMENTS);
-  if (existsSync5(viteJs)) {
+  const viteJs = resolve8(projectRoot, ...VITE_JS_SEGMENTS);
+  if (existsSync7(viteJs)) {
     return { command: process.execPath, prefixArgs: [viteJs] };
   }
-  const binDir = resolve6(projectRoot, "node_modules", ".bin");
+  const binDir = resolve8(projectRoot, "node_modules", ".bin");
   if (platform() === "win32") {
-    const winCmd = resolve6(binDir, "vite.cmd");
-    if (existsSync5(winCmd)) {
+    const winCmd = resolve8(binDir, "vite.cmd");
+    if (existsSync7(winCmd)) {
       return { command: winCmd, prefixArgs: [] };
     }
   }
-  const posixShim = resolve6(binDir, "vite");
-  if (existsSync5(posixShim)) {
+  const posixShim = resolve8(binDir, "vite");
+  if (existsSync7(posixShim)) {
     return { command: posixShim, prefixArgs: [] };
   }
   return null;
@@ -880,10 +1099,10 @@ function envFileForTier(tier) {
   return ".env.prod";
 }
 function readEnvFileValue(projectRoot, file, key) {
-  const path = resolve7(projectRoot, file);
-  if (!existsSync6(path)) return void 0;
+  const path = resolve9(projectRoot, file);
+  if (!existsSync8(path)) return void 0;
   try {
-    const content = readFileSync6(path, "utf8");
+    const content = readFileSync8(path, "utf8");
     const match = content.match(new RegExp(`^${key}=(.*)$`, "m"));
     return match?.[1]?.trim();
   } catch {
@@ -892,8 +1111,8 @@ function readEnvFileValue(projectRoot, file, key) {
 }
 function checkEnvFiles(ctx) {
   const checks = [];
-  const localPath = resolve7(ctx.projectRoot, ".env.local");
-  const localOk = existsSync6(localPath);
+  const localPath = resolve9(ctx.projectRoot, ".env.local");
+  const localOk = existsSync8(localPath);
   checks.push({
     name: "env-local",
     ok: localOk,
@@ -901,8 +1120,8 @@ function checkEnvFiles(ctx) {
     remediation: localOk ? void 0 : "wp setup or copy .env.local.example \u2192 .env.local",
     severity: "warn"
   });
-  const legacyLocalDev = resolve7(ctx.projectRoot, ".env.dev");
-  if (!localOk && existsSync6(legacyLocalDev)) {
+  const legacyLocalDev = resolve9(ctx.projectRoot, ".env.dev");
+  if (!localOk && existsSync8(legacyLocalDev)) {
     const nodeEnv = readEnvFileValue(ctx.projectRoot, ".env.dev", "VITE_NODE_ENV");
     const hasDevMode = readEnvFileValue(ctx.projectRoot, ".env.dev", "VITE_DEV_MODE") != null;
     const looksLikeLocal = hasDevMode || nodeEnv === "local" || nodeEnv == null || nodeEnv === "development";
@@ -918,7 +1137,7 @@ function checkEnvFiles(ctx) {
   }
   for (const tier of ctx.config.env.tiers) {
     const file = envFileForTier(tier);
-    const ok = existsSync6(resolve7(ctx.projectRoot, file));
+    const ok = existsSync8(resolve9(ctx.projectRoot, file));
     if (tier === "stg") {
       checks.push({
         name: "env-stg",
@@ -941,8 +1160,8 @@ function checkEnvFiles(ctx) {
 }
 function checkLegacyBuildIdFile(ctx) {
   if (isThemeProject(ctx.config) || !usesCdnPipeline(ctx.config)) return null;
-  const legacy = resolve7(ctx.projectRoot, ".portal-build-id");
-  if (!existsSync6(legacy)) return null;
+  const legacy = resolve9(ctx.projectRoot, ".portal-build-id");
+  if (!existsSync8(legacy)) return null;
   return {
     name: "legacy-build-id",
     ok: false,
@@ -953,8 +1172,8 @@ function checkLegacyBuildIdFile(ctx) {
 }
 function checkBuildId(ctx) {
   if (isThemeProject(ctx.config) || !usesCdnPipeline(ctx.config)) return null;
-  const file = resolve7(ctx.projectRoot, ctx.config.cdn.buildIdFile);
-  const ok = existsSync6(file);
+  const file = resolve9(ctx.projectRoot, ctx.config.cdn.buildIdFile);
+  const ok = existsSync8(file);
   return {
     name: "build-id",
     ok,
@@ -1008,7 +1227,7 @@ function checkDevSlug(ctx) {
   };
 }
 function isUploadOnlyProject(ctx) {
-  const moduleDirs = [resolve7(ctx.projectRoot, ctx.config.module.uploadPath)];
+  const moduleDirs = [resolve9(ctx.projectRoot, ctx.config.module.uploadPath)];
   return isUploadOnlyPreexistingProject(ctx.projectRoot, moduleDirs);
 }
 function checkUploadOnlyNote(ctx) {
@@ -1022,8 +1241,8 @@ function checkUploadOnlyNote(ctx) {
   };
 }
 function checkDevViteConfig(ctx) {
-  const path = resolve7(ctx.projectRoot, "vite.config.dev.mjs");
-  const ok = existsSync6(path);
+  const path = resolve9(ctx.projectRoot, "vite.config.dev.mjs");
+  const ok = existsSync8(path);
   return {
     name: "vite-dev-config",
     ok,
@@ -1034,8 +1253,8 @@ function checkDevViteConfig(ctx) {
 }
 function checkMetaJson(ctx) {
   if (isThemeProject(ctx.config)) return null;
-  const path = resolve7(ctx.projectRoot, "public/meta.json");
-  if (!existsSync6(path)) {
+  const path = resolve9(ctx.projectRoot, "public/meta.json");
+  if (!existsSync8(path)) {
     return {
       name: "meta-json",
       ok: false,
@@ -1045,7 +1264,7 @@ function checkMetaJson(ctx) {
     };
   }
   try {
-    const meta = JSON.parse(readFileSync6(path, "utf8"));
+    const meta = JSON.parse(readFileSync8(path, "utf8"));
     const hasContentTypes = Array.isArray(meta.content_types) && meta.content_types.length > 0;
     return {
       name: "meta-json",
@@ -1067,8 +1286,8 @@ function checkMetaJson(ctx) {
 }
 async function checkCdnMirrorPublic(ctx) {
   if (isThemeProject(ctx.config) || !usesCdnPipeline(ctx.config)) return null;
-  const mirrorPath = resolve7(ctx.projectRoot, ctx.config.cdn?.mirror ?? "portal.cdn.json");
-  if (!existsSync6(mirrorPath)) {
+  const mirrorPath = resolve9(ctx.projectRoot, ctx.config.cdn?.mirror ?? "portal.cdn.json");
+  if (!existsSync8(mirrorPath)) {
     return {
       name: "cdn-mirror-public",
       ok: false,
@@ -1079,7 +1298,7 @@ async function checkCdnMirrorPublic(ctx) {
   }
   let github;
   try {
-    const mirror = JSON.parse(readFileSync6(mirrorPath, "utf8"));
+    const mirror = JSON.parse(readFileSync8(mirrorPath, "utf8"));
     github = mirror.github?.trim();
   } catch {
     return {
@@ -1099,6 +1318,15 @@ async function checkCdnMirrorPublic(ctx) {
       severity: "error"
     };
   }
+  if (isPlaceholderGithubSlug(github)) {
+    return {
+      name: "cdn-mirror-public",
+      ok: false,
+      message: `portal.cdn.json still has placeholder github slug (${github})`,
+      remediation: "Run wp setup and set a real public org/repo for jsDelivr",
+      severity: "warn"
+    };
+  }
   try {
     const res = await fetch(`https://api.github.com/repos/${github}`, {
       headers: { Accept: "application/vnd.github+json" }
@@ -1131,8 +1359,8 @@ async function checkCdnMirrorPublic(ctx) {
       severity: "warn"
     };
   }
-  const manifestPath = resolve7(ctx.projectRoot, "dist/cdn/manifest.json");
-  if (!existsSync6(manifestPath)) {
+  const manifestPath = resolve9(ctx.projectRoot, "dist/cdn/manifest.json");
+  if (!existsSync8(manifestPath)) {
     return {
       name: "cdn-mirror-public",
       ok: true,
@@ -1141,7 +1369,7 @@ async function checkCdnMirrorPublic(ctx) {
     };
   }
   try {
-    const manifest = JSON.parse(readFileSync6(manifestPath, "utf8"));
+    const manifest = JSON.parse(readFileSync8(manifestPath, "utf8"));
     const appUrl = manifest.scripts?.find((s) => s.name === "app")?.url;
     if (!appUrl) {
       return {
@@ -1194,8 +1422,8 @@ async function checkCdnMirrorPublic(ctx) {
 }
 function checkFieldsJson(ctx) {
   if (isThemeProject(ctx.config)) return null;
-  const path = resolve7(ctx.projectRoot, "public/fields.json");
-  if (!existsSync6(path)) {
+  const path = resolve9(ctx.projectRoot, "public/fields.json");
+  if (!existsSync8(path)) {
     return {
       name: "fields-json",
       ok: false,
@@ -1205,7 +1433,7 @@ function checkFieldsJson(ctx) {
     };
   }
   try {
-    const fields = JSON.parse(readFileSync6(path, "utf8"));
+    const fields = JSON.parse(readFileSync8(path, "utf8"));
     const issues = validateHubSpotFieldsJson(fields);
     if (issues.length === 0) {
       return {
@@ -1235,11 +1463,11 @@ function checkFieldsJson(ctx) {
   }
 }
 function readProjectFile(projectRoot, relativePath) {
-  const path = resolve7(projectRoot, relativePath);
-  if (!existsSync6(path)) {
+  const path = resolve9(projectRoot, relativePath);
+  if (!existsSync8(path)) {
     return null;
   }
-  return readFileSync6(path, "utf8");
+  return readFileSync8(path, "utf8");
 }
 function checkCssPipeline(ctx) {
   if (isThemeProject(ctx.config) || isUploadOnlyProject(ctx)) {
@@ -1306,9 +1534,9 @@ function checkCssPipeline(ctx) {
   }
   const moduleOutDir = ctx.config.module?.outDir;
   if (moduleOutDir && usesCdnPipeline(ctx.config)) {
-    const moduleCssPath = resolve7(ctx.projectRoot, moduleOutDir, "module.css");
-    if (existsSync6(moduleCssPath)) {
-      const css = readFileSync6(moduleCssPath, "utf8");
+    const moduleCssPath = resolve9(ctx.projectRoot, moduleOutDir, "module.css");
+    if (existsSync8(moduleCssPath)) {
+      const css = readFileSync8(moduleCssPath, "utf8");
       const hasDwUtilities = /dw\\:/.test(css) || /\.dw:/.test(css);
       checks.push({
         name: "css-module-dist-prefixed",
@@ -1323,8 +1551,8 @@ function checkCssPipeline(ctx) {
 }
 function checkHybridModuleHtml(ctx) {
   if (isThemeProject(ctx.config) || !usesCdnPipeline(ctx.config)) return null;
-  const path = resolve7(ctx.projectRoot, "public/module.html");
-  if (!existsSync6(path)) {
+  const path = resolve9(ctx.projectRoot, "public/module.html");
+  if (!existsSync8(path)) {
     return {
       name: "module-html",
       ok: false,
@@ -1333,7 +1561,7 @@ function checkHybridModuleHtml(ctx) {
       severity: "error"
     };
   }
-  const html = readFileSync6(path, "utf8");
+  const html = readFileSync8(path, "utf8");
   const needs = ["__PORTAL_CDN_BASE__", "require_js", "hubSpotData", 'id="app"'];
   const missing = needs.filter((token) => !html.includes(token));
   const usesUndeclaredCdnFields = /module\.portal_(cdn_base_url|vendor_script|app_script|app_css)/.test(
@@ -1351,8 +1579,8 @@ function checkHybridModuleHtml(ctx) {
 function checkCdnViteConfigs(ctx) {
   if (isThemeProject(ctx.config) || !usesCdnPipeline(ctx.config)) return [];
   return ["vite.config.cdn-vendor.mjs", "vite.config.cdn-app.mjs"].map((file) => {
-    const path = resolve7(ctx.projectRoot, file);
-    const ok = existsSync6(path);
+    const path = resolve9(ctx.projectRoot, file);
+    const ok = existsSync8(path);
     return {
       name: file.replace(/\./g, "-"),
       ok,
@@ -1364,8 +1592,8 @@ function checkCdnViteConfigs(ctx) {
 }
 function checkDevEntry(ctx) {
   const checks = [];
-  const indexHtml = resolve7(ctx.projectRoot, "index.html");
-  const hasIndex = existsSync6(indexHtml);
+  const indexHtml = resolve9(ctx.projectRoot, "index.html");
+  const hasIndex = existsSync8(indexHtml);
   checks.push({
     name: "index-html",
     ok: hasIndex,
@@ -1373,8 +1601,8 @@ function checkDevEntry(ctx) {
     remediation: hasIndex ? void 0 : "Re-run wp init or copy index.html from kit templates",
     severity: "error"
   });
-  const localDev = resolve7(ctx.projectRoot, ctx.config.entries.localDev);
-  const hasEntry = existsSync6(localDev);
+  const localDev = resolve9(ctx.projectRoot, ctx.config.entries.localDev);
+  const hasEntry = existsSync8(localDev);
   checks.push({
     name: "local-dev-entry",
     ok: hasEntry,
@@ -1384,7 +1612,7 @@ function checkDevEntry(ctx) {
   });
   if (hasEntry) {
     try {
-      const source = readFileSync6(localDev, "utf8");
+      const source = readFileSync8(localDev, "utf8");
       const usesKitNodeBootstrap = source.includes("@woodsportal/hubspot-kit/dev/bootstrap-greenfield") || source.includes("@woodsportal/hubspot-kit/dev/bootstrap");
       const usesWphsShim = source.includes(".wphs/.kit-bootstrap-greenfield") || source.includes(".wphs/.kit-bootstrap") || source.includes("@wphs/bootstrap-greenfield") || source.includes("@wphs/bootstrap");
       checks.push({
@@ -1401,7 +1629,7 @@ function checkDevEntry(ctx) {
 }
 function checkKitScripts() {
   const script = kitPath("scripts", "build-cdn.mjs");
-  const ok = existsSync6(script);
+  const ok = existsSync8(script);
   return {
     name: "kit-scripts",
     ok,
@@ -1410,12 +1638,38 @@ function checkKitScripts() {
     severity: "error"
   };
 }
+function checkWphsScaffold(scaffoldError) {
+  if (!scaffoldError) return null;
+  return {
+    name: "wphs-scaffold",
+    ok: false,
+    message: `.wphs workspace scaffold failed \u2014 ${scaffoldError}`,
+    remediation: "Run wp doctor --verbose or wp setup; check write permissions on the project root (Windows: enable Developer Mode if junction creation fails)",
+    severity: "error"
+  };
+}
+async function runWphsScaffold(ctx) {
+  if (ctx.global.dryRun) return void 0;
+  try {
+    const paths = await ensureProjectWphsWorkspace(ctx.projectRoot);
+    if (ctx.global.verbose) {
+      ctx.logger.info(`.wphs workspace ready at ${paths.workspaceRoot}`);
+    }
+    return void 0;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (ctx.global.verbose) {
+      ctx.logger.error(`Could not scaffold .wphs workspace: ${message}`);
+    }
+    return message;
+  }
+}
 function checkWphsWorkspace(ctx) {
   const workspace = ctx.config.dev.moduleConfigDir;
   const checks = [];
   for (const legacy of [".dev", ".woodsportal"]) {
-    const legacyPath = resolve7(ctx.projectRoot, legacy);
-    if (existsSync6(legacyPath)) {
+    const legacyPath = resolve9(ctx.projectRoot, legacy);
+    if (existsSync8(legacyPath)) {
       checks.push({
         name: `legacy-${legacy}`,
         ok: false,
@@ -1425,7 +1679,7 @@ function checkWphsWorkspace(ctx) {
       });
     }
   }
-  if (existsSync6(resolve7(ctx.projectRoot, ".wp-hs-baseline"))) {
+  if (existsSync8(resolve9(ctx.projectRoot, ".wp-hs-baseline"))) {
     checks.push({
       name: "legacy-baseline",
       ok: false,
@@ -1444,15 +1698,15 @@ function checkWphsWorkspace(ctx) {
     });
     return checks;
   }
-  const wphsRoot = resolve7(ctx.projectRoot, workspace);
+  const wphsRoot = resolve9(ctx.projectRoot, workspace);
   const required = ["config", "assets/branding", "fixtures", "cache", "audit/baseline", "state"];
   for (const sub of required) {
-    const ok = existsSync6(join2(wphsRoot, sub));
+    const ok = existsSync8(join2(wphsRoot, sub));
     checks.push({
       name: `wphs-${sub.replace(/\//g, "-")}`,
       ok,
       message: ok ? `.wphs/${sub}/ present` : `.wphs/${sub}/ missing`,
-      remediation: ok ? void 0 : "Run wp doctor (auto-scaffolds) or wp init",
+      remediation: ok ? void 0 : "Run wp setup or wp doctor --verbose; check write permissions on the project root",
       severity: "error"
     });
   }
@@ -1460,8 +1714,8 @@ function checkWphsWorkspace(ctx) {
 }
 function checkAdapter(ctx) {
   if (isThemeProject(ctx.config)) return null;
-  const adapterPath = resolve7(ctx.projectRoot, ctx.config.dev.adapter);
-  const ok = existsSync6(adapterPath);
+  const adapterPath = resolve9(ctx.projectRoot, ctx.config.dev.adapter);
+  const ok = existsSync8(adapterPath);
   return {
     name: "wphs-adapter",
     ok,
@@ -1472,11 +1726,11 @@ function checkAdapter(ctx) {
 }
 function checkModuleConfigUiDeps(ctx) {
   if (isThemeProject(ctx.config)) return [];
-  const pkgPath = resolve7(ctx.projectRoot, "package.json");
-  if (!existsSync6(pkgPath)) return [];
+  const pkgPath = resolve9(ctx.projectRoot, "package.json");
+  if (!existsSync8(pkgPath)) return [];
   let deps = {};
   try {
-    const pkg = JSON.parse(readFileSync6(pkgPath, "utf8"));
+    const pkg = JSON.parse(readFileSync8(pkgPath, "utf8"));
     deps = { ...pkg.dependencies, ...pkg.devDependencies };
   } catch {
     return [];
@@ -1503,7 +1757,7 @@ function checkNodeLoaderInterop() {
   };
 }
 function checkViteInstalled(ctx) {
-  if (isThemeProject(ctx.config) && !existsSync6(resolve7(ctx.projectRoot, "vite.config.dev.mjs"))) {
+  if (isThemeProject(ctx.config) && !existsSync8(resolve9(ctx.projectRoot, "vite.config.dev.mjs"))) {
     return null;
   }
   const ok = isProjectViteInstalled(ctx.projectRoot);
@@ -1517,19 +1771,12 @@ function checkViteInstalled(ctx) {
 }
 async function gatherDoctorChecks(ctx) {
   const checks = [];
+  let wphsScaffoldError;
   await runCliTasks(ctx, [
     {
       title: "Preparing .wphs workspace",
       task: async () => {
-        if (ctx.global.dryRun) return;
-        try {
-          runNodeScript(kitPath("scripts", "ensure-wphs-workspace.mjs"), [], {
-            cwd: ctx.projectRoot,
-            logger: ctx.logger,
-            dryRun: false
-          });
-        } catch {
-        }
+        wphsScaffoldError = await runWphsScaffold(ctx);
       }
     },
     {
@@ -1553,7 +1800,11 @@ async function gatherDoctorChecks(ctx) {
     {
       title: "Checking woodscli.json and project layout",
       task: async () => {
-        checks.push(...checkConfig(ctx), ...checkWphsWorkspace(ctx));
+        wphsScaffoldError = await runWphsScaffold(ctx) ?? wphsScaffoldError;
+        checks.push(...checkConfig(ctx));
+        const scaffoldCheck = checkWphsScaffold(wphsScaffoldError);
+        if (scaffoldCheck) checks.push(scaffoldCheck);
+        checks.push(...checkWphsWorkspace(ctx));
         const fieldsCheck = checkFieldsJson(ctx);
         if (fieldsCheck) checks.push(fieldsCheck);
         const metaCheck = checkMetaJson(ctx);
@@ -1660,7 +1911,7 @@ async function runConfigValidate(ctx) {
 }
 
 // src/cli/commands/build.ts
-import { resolve as resolve8 } from "path";
+import { resolve as resolve10 } from "path";
 
 // src/lib/cli-banner.ts
 import pc4 from "picocolors";
@@ -1789,7 +2040,7 @@ function buildTasks(ctx, options, run) {
       title: `Building monolith module (${tier})`,
       task: async () => {
         await run("run-vite-build.mjs", [
-          resolve8(ctx.projectRoot, "vite.config.monolith.mjs"),
+          resolve10(ctx.projectRoot, "vite.config.monolith.mjs"),
           ...tierToViteModeFlag(tier)
         ]);
         await run("run-hubspot-module-postbuild.mjs");
@@ -1803,7 +2054,7 @@ function buildTasks(ctx, options, run) {
       task: async () => {
         if (options.cdnEsm) {
           await run("run-vite-build.mjs", [
-            resolve8(ctx.projectRoot, "vite.config.cdn-esm.mjs"),
+            resolve10(ctx.projectRoot, "vite.config.cdn-esm.mjs"),
             ...tierToViteModeFlag(tier)
           ]);
         } else {
@@ -1818,7 +2069,7 @@ function buildTasks(ctx, options, run) {
       title: `Building HubSpot module (${tier})`,
       task: async () => {
         await run("run-vite-build.mjs", [
-          resolve8(ctx.projectRoot, "vite.config.hubspot.mjs"),
+          resolve10(ctx.projectRoot, "vite.config.hubspot.mjs"),
           ...tierToViteModeFlag(tier)
         ]);
         await run("run-hubspot-module-postbuild.mjs");
@@ -1915,7 +2166,7 @@ async function runBuild(ctx, options) {
         command: "build",
         tier,
         ok: true,
-        outDir: resolve8(ctx.projectRoot, ctx.config.module.outDir)
+        outDir: resolve10(ctx.projectRoot, ctx.config.module.outDir)
       });
     } else if (!options.quiet) {
       printCommandDone(ctx, "Build complete");
@@ -1966,86 +2217,17 @@ async function runDev(ctx, options) {
 }
 
 // src/cli/commands/deploy.ts
-import { resolve as resolve11 } from "path";
-
-// src/lib/project-env-files.ts
-import { existsSync as existsSync7, readFileSync as readFileSync7, writeFileSync as writeFileSync3 } from "fs";
-import { resolve as resolve9 } from "path";
-var ENV_LOCAL_FILE = ".env.local";
-var ENV_GITIGNORE_LINES = [".env", ".env.*", "!.env*.example", ENV_LOCAL_FILE];
-function parseEnvFile(content) {
-  const result = {};
-  for (const line of content.split("\n")) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith("#")) continue;
-    const eq = trimmed.indexOf("=");
-    if (eq <= 0) continue;
-    const key = trimmed.slice(0, eq).trim();
-    let value = trimmed.slice(eq + 1).trim();
-    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
-      value = value.slice(1, -1);
-    }
-    result[key] = value;
-  }
-  return result;
-}
-function readEnvLocal(projectRoot) {
-  const path = resolve9(projectRoot, ENV_LOCAL_FILE);
-  if (!existsSync7(path)) return {};
-  return parseEnvFile(readFileSync7(path, "utf8"));
-}
-function formatEnvLocal(entries) {
-  const lines = [
-    "# Local secrets \u2014 gitignored. Created by wp init / wp setup (hybrid CDN).",
-    "# PORTAL_CDN_PUBLISH_TOKEN needs repo push on your portal.cdn.json mirror.",
-    ""
-  ];
-  for (const [key, value] of Object.entries(entries)) {
-    if (value.includes(" ") || value.includes("#")) {
-      lines.push(`${key}="${value.replace(/"/g, '\\"')}"`);
-    } else {
-      lines.push(`${key}=${value}`);
-    }
-  }
-  return `${lines.join("\n").trimEnd()}
-`;
-}
-function writeEnvLocal(projectRoot, entries) {
-  const path = resolve9(projectRoot, ENV_LOCAL_FILE);
-  const existing = existsSync7(path) ? parseEnvFile(readFileSync7(path, "utf8")) : {};
-  writeFileSync3(path, formatEnvLocal({ ...existing, ...entries }));
-}
-function mergeProjectEnv(projectRoot, base = process.env) {
-  const local = readEnvLocal(projectRoot);
-  const merged = { ...base };
-  for (const [key, value] of Object.entries(local)) {
-    if (merged[key] == null || merged[key] === "") {
-      merged[key] = value;
-    }
-  }
-  return merged;
-}
-function ensureEnvFilesGitignore(projectRoot) {
-  const gitignorePath = resolve9(projectRoot, ".gitignore");
-  const existing = existsSync7(gitignorePath) ? readFileSync7(gitignorePath, "utf8") : "";
-  const toAppend = ENV_GITIGNORE_LINES.filter((line) => !existing.includes(line)).join("\n");
-  if (!toAppend) return;
-  writeFileSync3(gitignorePath, `${existing.trimEnd()}
-
-# Env files (secrets)
-${toAppend}
-`);
-}
+import { resolve as resolve12 } from "path";
 
 // src/cli/commands/upload.ts
-import { resolve as resolve10 } from "path";
+import { resolve as resolve11 } from "path";
 async function uploadModuleOrTheme(ctx) {
   if (isThemeProject(ctx.config)) {
     const theme = ctx.config.theme;
     if (!theme) {
       throw new WpHsError("theme block missing in woodscli.json", { exitCode: ExitCode.USER_ERROR });
     }
-    const srcDir = resolve10(ctx.projectRoot, theme.srcDir);
+    const srcDir = resolve11(ctx.projectRoot, theme.srcDir);
     await runCommandAsync("hs", ["cms", "upload", srcDir, theme.uploadPath], {
       cwd: ctx.projectRoot,
       projectRoot: ctx.projectRoot,
@@ -2055,7 +2237,7 @@ async function uploadModuleOrTheme(ctx) {
     });
     return `Uploaded theme ${srcDir} \u2192 ${theme.uploadPath}`;
   }
-  const outDir = resolve10(ctx.projectRoot, ctx.config.module.outDir);
+  const outDir = resolve11(ctx.projectRoot, ctx.config.module.outDir);
   const uploadPath = ctx.config.module.uploadPath;
   await runCommandAsync("hs", ["cms", "upload", outDir, uploadPath], {
     cwd: ctx.projectRoot,
@@ -2232,7 +2414,7 @@ async function runDeploy(ctx, options) {
   if (!ctx.global.json) {
     printCommandDone(
       ctx,
-      `Deploy complete (${resolve11(ctx.projectRoot, ctx.config.module.outDir)} \u2192 ${ctx.config.module.uploadPath})`
+      `Deploy complete (${resolve12(ctx.projectRoot, ctx.config.module.outDir)} \u2192 ${ctx.config.module.uploadPath})`
     );
   }
   return ExitCode.SUCCESS;
@@ -2305,8 +2487,8 @@ async function runPublish(ctx, options) {
 
 // src/cli/commands/audit.ts
 import { createHash } from "crypto";
-import { cpSync, existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync8, readdirSync, rmSync, statSync } from "fs";
-import { resolve as resolve12, join as join3 } from "path";
+import { cpSync, existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync9, readdirSync, rmSync, statSync } from "fs";
+import { resolve as resolve13, join as join3 } from "path";
 var FORBIDDEN_SHIP_TOKENS = [
   "ModuleConfigOverlay",
   "module-config-store",
@@ -2317,10 +2499,10 @@ var FORBIDDEN_SHIP_TOKENS = [
 var FORBIDDEN_FIXTURE_MENU_TOKENS = ["User Home", "Primary Company Deals"];
 var FORBIDDEN_PREVIEW_FIXTURE_TOKENS = ["preview.editor@example.com", "CMS_EDITOR_PREVIEW"];
 function hashFile(path) {
-  return createHash("sha256").update(readFileSync8(path)).digest("hex");
+  return createHash("sha256").update(readFileSync9(path)).digest("hex");
 }
 function walkFiles(dir) {
-  if (!existsSync8(dir)) return [];
+  if (!existsSync9(dir)) return [];
   const entries = readdirSync(dir);
   const files = [];
   for (const entry of entries) {
@@ -2336,14 +2518,14 @@ function walkFiles(dir) {
 async function runAuditShipBundle(ctx) {
   const root = ctx.projectRoot;
   const targets = [
-    resolve12(root, "dist/cdn"),
-    resolve12(root, ctx.config.module.outDir)
+    resolve13(root, "dist/cdn"),
+    resolve13(root, ctx.config.module.outDir)
   ];
   const violations = [];
   for (const dir of targets) {
     for (const file of walkFiles(dir)) {
       if (!/\.(js|css|html)$/i.test(file)) continue;
-      const content = readFileSync8(file, "utf8");
+      const content = readFileSync9(file, "utf8");
       for (const token of FORBIDDEN_SHIP_TOKENS) {
         if (content.includes(token)) {
           violations.push(`${file}: contains forbidden token "${token}"`);
@@ -2383,21 +2565,21 @@ async function runAuditBaselineCapture(ctx, options) {
   const root = ctx.projectRoot;
   const baseline = options.baselineDir ?? defaultBaselineDir(root, ctx.config);
   const sources = [
-    { label: "cdn", path: resolve12(root, "dist/cdn") },
-    { label: "hubspot", path: resolve12(root, ctx.config.module.outDir) }
+    { label: "cdn", path: resolve13(root, "dist/cdn") },
+    { label: "hubspot", path: resolve13(root, ctx.config.module.outDir) }
   ];
   if (ctx.global.dryRun) {
     ctx.logger.info(`[dry-run] Would capture baseline to ${baseline}`);
     return ExitCode.SUCCESS;
   }
   for (const { label, path } of sources) {
-    if (!existsSync8(path)) {
+    if (!existsSync9(path)) {
       throw new WpHsError(`Cannot capture baseline \u2014 missing ${path}`, {
         exitCode: ExitCode.USER_ERROR,
         remediation: "Run wp build before wp audit baseline --capture."
       });
     }
-    const target = resolve12(baseline, label);
+    const target = resolve13(baseline, label);
     rmSync(target, { recursive: true, force: true });
     mkdirSync3(baseline, { recursive: true });
     cpSync(path, target, { recursive: true });
@@ -2413,13 +2595,13 @@ async function runAuditParity(ctx, options) {
   const root = ctx.projectRoot;
   const baseline = options.baselineDir ?? defaultBaselineDir(root, ctx.config);
   const currentDirs = [
-    { label: "cdn", path: resolve12(root, "dist/cdn") },
-    { label: "hubspot", path: resolve12(root, ctx.config.module.outDir) }
+    { label: "cdn", path: resolve13(root, "dist/cdn") },
+    { label: "hubspot", path: resolve13(root, ctx.config.module.outDir) }
   ];
   const mismatches = [];
   for (const { label, path } of currentDirs) {
-    const baselinePath = resolve12(baseline, label);
-    if (!existsSync8(baselinePath)) {
+    const baselinePath = resolve13(baseline, label);
+    if (!existsSync9(baselinePath)) {
       ctx.logger.warn(`No baseline at ${baselinePath} \u2014 skipping ${label} parity`);
       continue;
     }
@@ -2434,8 +2616,8 @@ async function runAuditParity(ctx, options) {
     }
     for (const file of baselineFiles) {
       const rel = file.replace(baselinePath, "");
-      const current = resolve12(path, rel.slice(1));
-      if (!existsSync8(current)) continue;
+      const current = resolve13(path, rel.slice(1));
+      if (!existsSync9(current)) continue;
       const bh = hashFile(file);
       const ch = hashFile(current);
       if (bh !== ch) {
@@ -2462,13 +2644,13 @@ var SECRET_PATTERNS = [
 ];
 async function runAuditSecrets(ctx) {
   const root = ctx.projectRoot;
-  const scanRoots = ["src", "public", ".wphs/config"].map((d) => resolve12(root, d));
+  const scanRoots = ["src", "public", ".wphs/config"].map((d) => resolve13(root, d));
   const findings = [];
   for (const dir of scanRoots) {
     for (const file of walkFiles(dir)) {
       if (!/\.(ts|tsx|js|jsx|json|env|yml|yaml|html)$/i.test(file)) continue;
       if (file.includes("node_modules")) continue;
-      const content = readFileSync8(file, "utf8");
+      const content = readFileSync9(file, "utf8");
       for (const pattern of SECRET_PATTERNS) {
         pattern.lastIndex = 0;
         if (pattern.test(content)) {
@@ -2499,8 +2681,8 @@ import { basename as basename2, resolve as resolve17 } from "path";
 import * as p5 from "@clack/prompts";
 
 // src/lib/init-router-scaffold.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync4, readFileSync as readFileSync9, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
-import { resolve as resolve13 } from "path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync4, readFileSync as readFileSync10, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "fs";
+import { resolve as resolve14 } from "path";
 var ROUTER_FILES = [
   "src/routes",
   "src/routeTree.gen.ts",
@@ -2514,10 +2696,10 @@ function isModuleTemplate(template) {
   return template === "module-hybrid-cdn" || template === "module-monolith";
 }
 function writeRouterConfig(targetDir, mode) {
-  const configDir = resolve13(targetDir, "src/config");
+  const configDir = resolve14(targetDir, "src/config");
   mkdirSync4(configDir, { recursive: true });
-  writeFileSync4(
-    resolve13(configDir, "router.ts"),
+  writeFileSync5(
+    resolve14(configDir, "router.ts"),
     `/** Router history \u2014 set by \`wp init\`. Hash matches woodsportal-client-frontend (HubSpot CMS embeds). */
 export type RouterHistoryMode = 'hash' | 'browser'
 
@@ -2526,8 +2708,8 @@ export const ROUTER_HISTORY: RouterHistoryMode = '${mode}'
   );
 }
 function writeMountDevPreviewRouter(targetDir) {
-  writeFileSync4(
-    resolve13(targetDir, "src/portal/mount-dev-preview.tsx"),
+  writeFileSync5(
+    resolve14(targetDir, "src/portal/mount-dev-preview.tsx"),
     `import { mountGreenfieldDev } from '../../.wphs/.kit-bootstrap-greenfield.tsx'
 
 import { App } from '@/app'
@@ -2540,8 +2722,8 @@ export async function mountDevPreview() {
   );
 }
 function writeMountDevPreviewSinglePage(targetDir) {
-  writeFileSync4(
-    resolve13(targetDir, "src/portal/mount-dev-preview.tsx"),
+  writeFileSync5(
+    resolve14(targetDir, "src/portal/mount-dev-preview.tsx"),
     `import { mountGreenfieldDev } from '../../.wphs/.kit-bootstrap-greenfield.tsx'
 
 import { StarterSinglePage } from '@/features/starter'
@@ -2554,8 +2736,8 @@ export async function mountDevPreview() {
   );
 }
 function writeMountPortalRouter(targetDir) {
-  writeFileSync4(
-    resolve13(targetDir, "src/portal/mount-portal.tsx"),
+  writeFileSync5(
+    resolve14(targetDir, "src/portal/mount-portal.tsx"),
     `import ReactDOM from 'react-dom/client'
 
 import { App } from '@/app'
@@ -2572,8 +2754,8 @@ export async function mountPortal() {
   );
 }
 function writeMountPortalSinglePage(targetDir) {
-  writeFileSync4(
-    resolve13(targetDir, "src/portal/mount-portal.tsx"),
+  writeFileSync5(
+    resolve14(targetDir, "src/portal/mount-portal.tsx"),
     `import ReactDOM from 'react-dom/client'
 
 import { StarterSinglePage } from '@/features/starter'
@@ -2590,11 +2772,11 @@ export async function mountPortal() {
   );
 }
 function writeStarterSinglePage(targetDir) {
-  const file = resolve13(targetDir, "src/features/starter/components/starter-single-page.tsx");
-  if (existsSync9(file)) {
+  const file = resolve14(targetDir, "src/features/starter/components/starter-single-page.tsx");
+  if (existsSync10(file)) {
     return;
   }
-  writeFileSync4(
+  writeFileSync5(
     file,
     `import { StarterShell } from '@/components/layout/starter-shell'
 
@@ -2617,25 +2799,25 @@ export function StarterSinglePage() {
   );
 }
 function removePath(targetDir, relativePath) {
-  const full = resolve13(targetDir, relativePath);
-  if (!existsSync9(full)) {
+  const full = resolve14(targetDir, relativePath);
+  if (!existsSync10(full)) {
     return;
   }
   rmSync2(full, { recursive: true, force: true });
 }
 function stripTanStackFromPackage(targetDir) {
-  const pkgPath = resolve13(targetDir, "package.json");
-  if (!existsSync9(pkgPath)) {
+  const pkgPath = resolve14(targetDir, "package.json");
+  if (!existsSync10(pkgPath)) {
     return;
   }
-  const pkg = JSON.parse(readFileSync9(pkgPath, "utf8"));
+  const pkg = JSON.parse(readFileSync10(pkgPath, "utf8"));
   if (!pkg.devDependencies) {
     return;
   }
   for (const dep of TANSTACK_DEPS) {
     delete pkg.devDependencies[dep];
   }
-  writeFileSync4(pkgPath, `${JSON.stringify(pkg, null, 2)}
+  writeFileSync5(pkgPath, `${JSON.stringify(pkg, null, 2)}
 `);
 }
 function applyRouterScaffold(targetDir, mode, template) {
@@ -2655,22 +2837,22 @@ function applyRouterScaffold(targetDir, mode, template) {
   writeRouterConfig(targetDir, mode);
   writeMountDevPreviewRouter(targetDir);
   writeMountPortalRouter(targetDir);
-  const featuresIndex = resolve13(targetDir, "src/features/starter/index.ts");
-  if (existsSync9(featuresIndex)) {
-    let content = readFileSync9(featuresIndex, "utf8");
+  const featuresIndex = resolve14(targetDir, "src/features/starter/index.ts");
+  if (existsSync10(featuresIndex)) {
+    let content = readFileSync10(featuresIndex, "utf8");
     if (!content.includes("StarterSinglePage")) {
       content = content.replace(
         "export type { StarterPreviewValues } from './hooks/use-starter-preview'\n",
         "export type { StarterPreviewValues } from './hooks/use-starter-preview'\nexport { StarterSinglePage } from './components/starter-single-page'\n"
       );
-      writeFileSync4(featuresIndex, content);
+      writeFileSync5(featuresIndex, content);
     }
   }
 }
 
 // src/lib/init-auth-scaffold.ts
-import { cpSync as cpSync2, existsSync as existsSync10, readFileSync as readFileSync10, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "fs";
-import { resolve as resolve14 } from "path";
+import { cpSync as cpSync2, existsSync as existsSync11, readFileSync as readFileSync11, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
+import { resolve as resolve15 } from "path";
 
 // src/lib/template-auth-deps.ts
 var AUTH_SCAFFOLD_DEPS = {
@@ -2690,12 +2872,12 @@ function mergeAuthDevDependencies(existing) {
 // src/lib/init-auth-scaffold.ts
 var AUTH_SCAFFOLD_ROOT = kitPath("templates", "scaffold", "auth");
 function readTierManifest() {
-  const path = resolve14(AUTH_SCAFFOLD_ROOT, "tier-manifest.json");
-  return JSON.parse(readFileSync10(path, "utf8"));
+  const path = resolve15(AUTH_SCAFFOLD_ROOT, "tier-manifest.json");
+  return JSON.parse(readFileSync11(path, "utf8"));
 }
 function readNavManifest() {
-  const path = resolve14(AUTH_SCAFFOLD_ROOT, "nav-manifest.json");
-  return JSON.parse(readFileSync10(path, "utf8"));
+  const path = resolve15(AUTH_SCAFFOLD_ROOT, "nav-manifest.json");
+  return JSON.parse(readFileSync11(path, "utf8"));
 }
 function layersForMode(mode) {
   const manifest = readTierManifest();
@@ -2706,8 +2888,8 @@ function layersForMode(mode) {
   return entry.layers;
 }
 function copyLayer(targetDir, layerName) {
-  const layerRoot = resolve14(AUTH_SCAFFOLD_ROOT, layerName);
-  if (!existsSync10(layerRoot)) {
+  const layerRoot = resolve15(AUTH_SCAFFOLD_ROOT, layerName);
+  if (!existsSync11(layerRoot)) {
     throw new Error(`Auth scaffold layer not found: ${layerName}`);
   }
   cpSync2(layerRoot, targetDir, { recursive: true, force: true });
@@ -2724,8 +2906,8 @@ function copyNavLayer(targetDir, nav) {
   copyLayer(targetDir, layerForNavMode(nav));
 }
 function patchNavScaffoldFile(targetDir, nav) {
-  const navScaffoldPath = resolve14(targetDir, "src/config/nav-scaffold.ts");
-  if (!existsSync10(navScaffoldPath)) {
+  const navScaffoldPath = resolve15(targetDir, "src/config/nav-scaffold.ts");
+  if (!existsSync11(navScaffoldPath)) {
     return;
   }
   const content = `/** Set by wp init --nav ${nav}. */
@@ -2733,11 +2915,11 @@ export const NAV_SCAFFOLD_MODE = '${nav}' as const
 
 export type NavScaffoldMode = typeof NAV_SCAFFOLD_MODE
 `;
-  writeFileSync5(navScaffoldPath, content);
+  writeFileSync6(navScaffoldPath, content);
 }
 function patchAuthTierFile(targetDir, mode) {
-  const authTierPath = resolve14(targetDir, "src/config/auth-tier.ts");
-  if (!existsSync10(authTierPath)) {
+  const authTierPath = resolve15(targetDir, "src/config/auth-tier.ts");
+  if (!existsSync11(authTierPath)) {
     return;
   }
   const content = `/** Set by wp init --auth ${mode}. */
@@ -2745,7 +2927,7 @@ export const AUTH_SCAFFOLD_TIER = '${mode}' as const
 
 export type AuthScaffoldTier = typeof AUTH_SCAFFOLD_TIER
 `;
-  writeFileSync5(authTierPath, content);
+  writeFileSync6(authTierPath, content);
 }
 function patchStarterOnlyBlocks(targetDir, mode) {
   const hasSso = mode === "sso" || mode === "full";
@@ -2759,11 +2941,11 @@ function patchStarterOnlyBlocks(targetDir, mode) {
     "src/features/auth/auth-route-paths.ts"
   ];
   for (const relative of filesToPatch) {
-    const filePath = resolve14(targetDir, relative);
-    if (!existsSync10(filePath)) {
+    const filePath = resolve15(targetDir, relative);
+    if (!existsSync11(filePath)) {
       continue;
     }
-    let content = readFileSync10(filePath, "utf8");
+    let content = readFileSync11(filePath, "utf8");
     content = stripMarkedBlock(content, "WPHS_AUTH_SSO", hasSso);
     content = stripMarkedBlock(content, "WPHS_AUTH_FULL", hasFull);
     if (!hasFull && relative === "src/integrations/configure-woodsportal-sdk.ts") {
@@ -2772,7 +2954,7 @@ function patchStarterOnlyBlocks(targetDir, mode) {
         ""
       );
     }
-    writeFileSync5(filePath, content);
+    writeFileSync6(filePath, content);
   }
 }
 function stripMarkedBlock(content, marker, keep) {
@@ -2800,11 +2982,11 @@ var LOWER_TIER_AUTH_GUARD_FILES = [
 function assertLowerTierAuthScaffold(targetDir, mode) {
   const violations = [];
   for (const relative of LOWER_TIER_AUTH_GUARD_FILES) {
-    const filePath = resolve14(targetDir, relative);
-    if (!existsSync10(filePath)) {
+    const filePath = resolve15(targetDir, relative);
+    if (!existsSync11(filePath)) {
       continue;
     }
-    const content = readFileSync10(filePath, "utf8");
+    const content = readFileSync11(filePath, "utf8");
     if (content.includes("WPHS_AUTH_")) {
       violations.push(`${relative}: leftover WPHS_AUTH_* strip markers`);
     }
@@ -2817,7 +2999,7 @@ function assertLowerTierAuthScaffold(targetDir, mode) {
       }
     }
   }
-  if (existsSync10(resolve14(targetDir, "src/routes/_auth/two-fa.tsx"))) {
+  if (existsSync11(resolve15(targetDir, "src/routes/_auth/two-fa.tsx"))) {
     violations.push("src/routes/_auth/two-fa.tsx: MFA route must not exist on --auth " + mode);
   }
   if (violations.length > 0) {
@@ -2833,14 +3015,14 @@ function assertFullTierAuthScaffold(targetDir) {
     "src/features/auth/mfa-pending-storage.ts",
     "src/routes/_auth/two-fa.tsx"
   ];
-  const missing = required.filter((relative) => !existsSync10(resolve14(targetDir, relative)));
+  const missing = required.filter((relative) => !existsSync11(resolve15(targetDir, relative)));
   if (missing.length > 0) {
     throw new WpHsError(`Auth scaffold tier "full" is missing required files:
 - ${missing.join("\n- ")}`, {
       exitCode: ExitCode.INTERNAL
     });
   }
-  const bridge = readFileSync10(resolve14(targetDir, "src/features/auth/login-session-bridge.ts"), "utf8");
+  const bridge = readFileSync11(resolve15(targetDir, "src/features/auth/login-session-bridge.ts"), "utf8");
   if (bridge.includes("WPHS_AUTH_")) {
     throw new WpHsError('Auth scaffold tier "full" left WPHS_AUTH_* markers in login-session-bridge.ts', {
       exitCode: ExitCode.INTERNAL
@@ -2853,18 +3035,18 @@ function assertFullTierAuthScaffold(targetDir) {
   }
 }
 function patchPackageJson(targetDir) {
-  const pkgPath = resolve14(targetDir, "package.json");
-  if (!existsSync10(pkgPath)) {
+  const pkgPath = resolve15(targetDir, "package.json");
+  if (!existsSync11(pkgPath)) {
     return;
   }
-  const pkg = JSON.parse(readFileSync10(pkgPath, "utf8"));
+  const pkg = JSON.parse(readFileSync11(pkgPath, "utf8"));
   pkg.devDependencies = mergeAuthDevDependencies(pkg.devDependencies);
-  writeFileSync5(pkgPath, `${JSON.stringify(pkg, null, 2)}
+  writeFileSync6(pkgPath, `${JSON.stringify(pkg, null, 2)}
 `);
 }
 function writeAuthMountDevPreview(targetDir) {
-  writeFileSync5(
-    resolve14(targetDir, "src/portal/mount-dev-preview.tsx"),
+  writeFileSync6(
+    resolve15(targetDir, "src/portal/mount-dev-preview.tsx"),
     `import { mountGreenfieldDev } from '../../.wphs/.kit-bootstrap-greenfield.tsx'
 
 import { App } from '@/app'
@@ -2901,25 +3083,25 @@ function validateNavAuthCombo(auth, nav) {
   }
 }
 function assertNavScaffold(targetDir, nav) {
-  const mainLayoutPath = resolve14(targetDir, "src/components/Layouts/MainLayout.tsx");
-  if (!existsSync10(mainLayoutPath)) {
+  const mainLayoutPath = resolve15(targetDir, "src/components/Layouts/MainLayout.tsx");
+  if (!existsSync11(mainLayoutPath)) {
     throw new WpHsError("Auth scaffold is missing MainLayout.tsx after nav layer copy", {
       exitCode: ExitCode.INTERNAL
     });
   }
-  const sidebarPath = resolve14(targetDir, "src/components/layout/portal-sidebar.tsx");
+  const sidebarPath = resolve15(targetDir, "src/components/layout/portal-sidebar.tsx");
   if (nav === "sidebar") {
-    if (!existsSync10(sidebarPath)) {
+    if (!existsSync11(sidebarPath)) {
       throw new WpHsError('Nav scaffold mode "sidebar" is missing portal-sidebar.tsx', {
         exitCode: ExitCode.INTERNAL
       });
     }
-  } else if (existsSync10(sidebarPath)) {
+  } else if (existsSync11(sidebarPath)) {
     throw new WpHsError('Nav scaffold mode "top" must not include portal-sidebar.tsx', {
       exitCode: ExitCode.INTERNAL
     });
   }
-  const navScaffold = readFileSync10(resolve14(targetDir, "src/config/nav-scaffold.ts"), "utf8");
+  const navScaffold = readFileSync11(resolve15(targetDir, "src/config/nav-scaffold.ts"), "utf8");
   if (!navScaffold.includes(`'${nav}'`)) {
     throw new WpHsError(`nav-scaffold.ts was not patched for mode "${nav}"`, {
       exitCode: ExitCode.INTERNAL
@@ -2955,11 +3137,11 @@ function authTierRank(tier) {
   return AUTH_TIER_ORDER.indexOf(tier);
 }
 function readCurrentAuthTier(targetDir) {
-  const authTierPath = resolve14(targetDir, "src/config/auth-tier.ts");
-  if (!existsSync10(authTierPath)) {
+  const authTierPath = resolve15(targetDir, "src/config/auth-tier.ts");
+  if (!existsSync11(authTierPath)) {
     return "none";
   }
-  const content = readFileSync10(authTierPath, "utf8");
+  const content = readFileSync11(authTierPath, "utf8");
   const match = content.match(/AUTH_SCAFFOLD_TIER = '(starter|sso|full)'/);
   return match?.[1] ?? "none";
 }
@@ -3008,8 +3190,8 @@ var SIDEBAR_NAV_FILES = [
   "src/components/layout/portal-sidebar-nav.tsx"
 ];
 function applyNavScaffoldUpgrade(targetDir, nav) {
-  const authTierPath = resolve14(targetDir, "src/config/auth-tier.ts");
-  if (!existsSync10(authTierPath)) {
+  const authTierPath = resolve15(targetDir, "src/config/auth-tier.ts");
+  if (!existsSync11(authTierPath)) {
     throw new WpHsError("Nav scaffold requires portal auth (missing src/config/auth-tier.ts).", {
       exitCode: ExitCode.USER_ERROR,
       remediation: "Run wp scaffold auth upgrade --tier starter first."
@@ -3017,8 +3199,8 @@ function applyNavScaffoldUpgrade(targetDir, nav) {
   }
   if (nav === "top") {
     for (const relative of SIDEBAR_NAV_FILES) {
-      const filePath = resolve14(targetDir, relative);
-      if (existsSync10(filePath)) {
+      const filePath = resolve15(targetDir, relative);
+      if (existsSync11(filePath)) {
         rmSync3(filePath);
       }
     }
@@ -3052,125 +3234,6 @@ function moduleOutDirFromSlug(slug) {
   return `dist/${pascal || "HubSpot"}.Module`;
 }
 
-// src/lib/cdn-github-setup.ts
-import { existsSync as existsSync11, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "fs";
-import { resolve as resolve15 } from "path";
-import * as p3 from "@clack/prompts";
-var PORTAL_CDN_PUBLISH_TOKEN_ENV = "PORTAL_CDN_PUBLISH_TOKEN";
-var PORTAL_CDN_JSON = "portal.cdn.json";
-var PLACEHOLDER_GITHUB = /your-org|your-portal-cdn-mirror/i;
-function defaultPortalCdnJson() {
-  const examplePath = kitPath("templates", "shared", "portal.cdn.json.example");
-  if (existsSync11(examplePath)) {
-    return JSON.parse(readFileSync11(examplePath, "utf8"));
-  }
-  return {
-    publishMode: "jsdelivr",
-    github: "your-org/your-portal-cdn-mirror",
-    gitRemote: "https://github.com/your-org/your-portal-cdn-mirror.git",
-    cdnPathInRepo: "dist/cdn",
-    defaultBranch: "main"
-  };
-}
-function readPortalCdnJson(projectRoot) {
-  const path = resolve15(projectRoot, PORTAL_CDN_JSON);
-  if (!existsSync11(path)) return null;
-  try {
-    return JSON.parse(readFileSync11(path, "utf8"));
-  } catch {
-    return null;
-  }
-}
-function normalizeGithubSlug(input) {
-  const trimmed = input.trim().replace(/^https:\/\/github\.com\//, "").replace(/\.git$/, "");
-  const parts = trimmed.split("/").filter(Boolean);
-  if (parts.length !== 2) return null;
-  return `${parts[0]}/${parts[1]}`;
-}
-function portalCdnJsonFromGithub(github, base) {
-  const slug = normalizeGithubSlug(github);
-  if (!slug) {
-    throw new Error(`Invalid GitHub repo \u2014 use org/repo (got "${github}")`);
-  }
-  return {
-    publishMode: base?.publishMode ?? "jsdelivr",
-    github: slug,
-    gitRemote: `https://github.com/${slug}.git`,
-    cdnPathInRepo: base?.cdnPathInRepo ?? "dist/cdn",
-    defaultBranch: base?.defaultBranch ?? "main"
-  };
-}
-function hasCdnPublishToken(projectRoot) {
-  if (process.env[PORTAL_CDN_PUBLISH_TOKEN_ENV]?.trim()) return true;
-  if (process.env.GITHUB_TOKEN?.trim()) return true;
-  return Boolean(readEnvLocal(projectRoot)[PORTAL_CDN_PUBLISH_TOKEN_ENV]?.trim());
-}
-function hasConfiguredCdnGithubMirror(projectRoot) {
-  const config = readPortalCdnJson(projectRoot);
-  const github = config?.github ?? "";
-  return Boolean(github) && !PLACEHOLDER_GITHUB.test(github);
-}
-function githubDefaultForPrompt(projectRoot) {
-  const existing = readPortalCdnJson(projectRoot);
-  if (existing?.github && !PLACEHOLDER_GITHUB.test(existing.github)) {
-    return existing.github;
-  }
-  return defaultPortalCdnJson().github;
-}
-function needsCdnGitHubSetup(projectRoot) {
-  return !hasConfiguredCdnGithubMirror(projectRoot) || !hasCdnPublishToken(projectRoot);
-}
-function applyCdnGitHubSetup(projectRoot, input) {
-  const existing = readPortalCdnJson(projectRoot) ?? defaultPortalCdnJson();
-  const updated = portalCdnJsonFromGithub(input.github, existing);
-  writeFileSync6(resolve15(projectRoot, PORTAL_CDN_JSON), `${JSON.stringify(updated, null, 2)}
-`);
-  if (input.token?.trim()) {
-    writeEnvLocal(projectRoot, { [PORTAL_CDN_PUBLISH_TOKEN_ENV]: input.token.trim() });
-  }
-  ensureEnvFilesGitignore(projectRoot);
-}
-async function promptCdnGitHubSetup(options = {}) {
-  if (options.skip) return null;
-  const projectRoot = options.projectRoot ?? process.cwd();
-  if (!needsCdnGitHubSetup(projectRoot)) {
-    return null;
-  }
-  let github = options.github?.trim();
-  if (!github && hasConfiguredCdnGithubMirror(projectRoot)) {
-    github = readPortalCdnJson(projectRoot)?.github;
-  }
-  if (!github) {
-    const answer = await p3.text({
-      message: "Public GitHub CDN mirror (org/repo)",
-      placeholder: options.githubDefault ?? "your-org/your-portal-cdn-mirror",
-      initialValue: options.githubDefault,
-      validate: (value) => {
-        const slug = normalizeGithubSlug(value ?? "");
-        return slug ? void 0 : "Enter a public repo as org/repo (jsDelivr serves from it)";
-      }
-    });
-    if (p3.isCancel(answer)) return null;
-    github = normalizeGithubSlug(answer) ?? void 0;
-  }
-  if (!github) return null;
-  if (hasCdnPublishToken(projectRoot)) {
-    return { github };
-  }
-  const tokenAnswer = await p3.password({
-    message: "GitHub token (repo push on CDN mirror)",
-    validate: (value) => {
-      if (!value?.trim()) return "Required for wp publish \u2014 create a fine-grained PAT with Contents: Read and write";
-      return void 0;
-    }
-  });
-  if (p3.isCancel(tokenAnswer)) return null;
-  return { github, token: tokenAnswer.trim() };
-}
-function formatCdnSetupNote(_projectRoot) {
-  return `CDN config written \u2014 edit ${PORTAL_CDN_JSON} if needed; token saved to ${ENV_LOCAL_FILE} (gitignored)`;
-}
-
 // src/lib/init-wizard.ts
 function cancelIfNeeded(value) {
   if (p4.isCancel(value)) {
@@ -3696,11 +3759,7 @@ async function runInit(ctx, options) {
   if (isModuleTemplate(template)) {
     applyAuthScaffold(targetDir, auth, router, template, nav);
   }
-  runNodeScript(kitPath("scripts/ensure-wphs-workspace.mjs"), [], {
-    cwd: targetDir,
-    logger: ctx.logger,
-    dryRun: false
-  });
+  await ensureProjectWphsWorkspace(targetDir);
   const gitignorePath = resolve17(targetDir, ".gitignore");
   const gitignoreExtras = [
     "hubspot.config.yml",
@@ -3863,11 +3922,7 @@ ${baseline}
       remediation: "Run: wp migrate --yes"
     });
   }
-  runNodeScript(kitPath("scripts/ensure-wphs-workspace.mjs"), [], {
-    cwd: root,
-    logger: ctx.logger,
-    dryRun: false
-  });
+  await ensureProjectWphsWorkspace(root);
   for (const action of actions) ctx.logger.success(action);
   return ExitCode.SUCCESS;
 }
@@ -3896,8 +3951,8 @@ async function runExamplesSmoke(ctx, options = {}) {
   const tier = options.tier ?? "static";
   const args = ["--tier", tier];
   if (options.scenario) args.push("--scenario", options.scenario);
-  const { runNodeScript: runNodeScript2 } = await import("./exec-VY6BGWF3.js");
-  runNodeScript2(kitPath("examples", "smoke", "run-matrix.mjs"), args, {
+  const { runNodeScript } = await import("./exec-VY6BGWF3.js");
+  runNodeScript(kitPath("examples", "smoke", "run-matrix.mjs"), args, {
     cwd: ctx.projectRoot,
     logger: ctx.logger,
     dryRun: ctx.global.dryRun
@@ -4020,14 +4075,7 @@ async function runSetup(ctx, options = {}) {
         title: "Preparing .wphs workspace",
         task: async () => {
           if (ctx.global.dryRun) return;
-          try {
-            runNodeScript(kitPath("scripts", "ensure-wphs-workspace.mjs"), [], {
-              cwd: ctx.projectRoot,
-              logger: ctx.logger,
-              dryRun: false
-            });
-          } catch {
-          }
+          await ensureProjectWphsWorkspace(ctx.projectRoot);
         }
       },
       {
@@ -4608,7 +4656,7 @@ function attachGlobals(command) {
 async function handle(fn) {
   try {
     const code = await fn();
-    process.exit(code);
+    await exitCli(code);
   } catch (error) {
     if (isWpHsError(error)) {
       process.stderr.write(`Error: ${error.message}
@@ -4617,11 +4665,11 @@ async function handle(fn) {
         process.stderr.write(`\u2192 ${error.remediation}
 `);
       }
-      process.exit(error.exitCode);
+      await exitCli(error.exitCode);
     }
     process.stderr.write(`Error: ${error instanceof Error ? error.message : String(error)}
 `);
-    process.exit(ExitCode.INTERNAL);
+    await exitCli(ExitCode.INTERNAL);
   }
 }
 function createProgram() {