@woodsportal/hubspot-kit 1.0.41 → 1.0.42-dev.0

package/dist/cli.js

@@ -1,208 +1,42 @@
 #!/usr/bin/env node
+import {
+  DEFAULT_WOODSPORTAL_HS,
+  KIT_PACKAGE_NAME,
+  LEGACY_WOODSPORTAL_HS_FILE,
+  WOODSCLI_CONFIG_FILE,
+  WPHS_WORKSPACE_DIR,
+  WoodsPortalHsSchema,
+  findProjectRoot,
+  getKitRoot,
+  isModuleProject,
+  isThemeProject,
+  kitPath,
+  legacyConfigConflict,
+  navConfigFileExists,
+  normalizePagePath,
+  normalizePageSlug,
+  resolveProjectConfig,
+  scaffoldPage,
+  titleFromSlug,
+  usesCdnPipeline
+} from "./chunk-WHYTQEZX.js";
 import {
   ExitCode,
   WpHsError,
   isWpHsError,
   runCommand,
   runCommandAsync,
-  runNodeScript,
   runNodeScriptAsync,
   runNodeScriptLongRunning
 } from "./chunk-4GOJPOW3.js";
 
 // src/cli/program.ts
-import { readFileSync as readFileSync16 } from "fs";
-import { resolve as resolve23 } from "path";
 import { Command } from "commander";
 
 // src/lib/config.ts
-import { readFileSync as readFileSync2 } from "fs";
-
-// src/lib/config-files.ts
-import { existsSync } from "fs";
-import { resolve } from "path";
-var WOODSCLI_CONFIG_FILE = "woodscli.json";
-var LEGACY_WOODSPORTAL_HS_FILE = "woodsportal.hs.json";
-function envConfigPath(projectRoot) {
-  const fromEnv = process.env.WOODSCLI_CONFIG?.trim() || process.env.WP_HS_CONFIG?.trim() || null;
-  if (!fromEnv) return null;
-  return resolve(projectRoot, fromEnv);
-}
-function legacyConfigPath(projectRoot) {
-  return resolve(projectRoot, LEGACY_WOODSPORTAL_HS_FILE);
-}
-function woodscliConfigPath(projectRoot) {
-  return resolve(projectRoot, WOODSCLI_CONFIG_FILE);
-}
-function legacyConfigConflict(projectRoot) {
-  const hasWoodscli = existsSync(woodscliConfigPath(projectRoot));
-  const hasLegacy = existsSync(legacyConfigPath(projectRoot));
-  if (hasLegacy && hasWoodscli) return "duplicate";
-  if (hasLegacy && !hasWoodscli) return "legacy-only";
-  return null;
-}
-function resolveProjectConfig(projectRoot) {
-  const envPath = envConfigPath(projectRoot);
-  if (envPath) {
-    if (!existsSync(envPath)) return null;
-    return { path: envPath, fileName: WOODSCLI_CONFIG_FILE };
-  }
-  const path = woodscliConfigPath(projectRoot);
-  if (existsSync(path)) {
-    return { path, fileName: WOODSCLI_CONFIG_FILE };
-  }
-  return null;
-}
-function findProjectRoot(from = process.cwd()) {
-  if (process.env.WP_HS_PROJECT_ROOT?.trim()) {
-    return resolve(process.env.WP_HS_PROJECT_ROOT.trim());
-  }
-  let dir = resolve(from);
-  while (true) {
-    if (resolveProjectConfig(dir)) {
-      return dir;
-    }
-    const parent = resolve(dir, "..");
-    if (parent === dir) {
-      return null;
-    }
-    dir = parent;
-  }
-}
-
-// src/schema/woodsportal-hs.ts
-import { z } from "zod";
-var CONFIG_VERSION = 1;
-var WPHS_WORKSPACE_DIR = ".wphs";
-var WoodsPortalHsSchema = z.object({
-  configVersion: z.number().int().default(CONFIG_VERSION),
-  projectType: z.enum(["module-hybrid-cdn", "module-monolith", "theme-starter"]),
-  module: z.object({
-    name: z.string().min(1),
-    uploadPath: z.string().min(1),
-    outDir: z.string().default("dist/WoodsPortal.Module")
-  }),
-  theme: z.object({
-    name: z.string().min(1),
-    uploadPath: z.string().min(1),
-    srcDir: z.string().default("src/theme"),
-    themeJson: z.string().default("src/theme/theme.json")
-  }).optional(),
-  cdn: z.object({
-    mode: z.enum(["jsdelivr", "custom", "local", "none"]).default("jsdelivr"),
-    buildIdFile: z.string().default(".module-build-id"),
-    mirror: z.string().default("portal.cdn.json")
-  }).default({}),
-  entries: z.object({
-    app: z.string().default("src/cdn/app-entry.ts"),
-    vendor: z.string().default("src/cdn/vendor-entry.ts"),
-    hubspotBootstrap: z.string().default("src/hubspot/bootstrap.ts"),
-    /** Monolith production IIFE entry (wp build --hubspot-only) */
-    module: z.string().default("src/hubspot/module-entry.tsx"),
-    localDev: z.string().default("src/main.tsx")
-  }).default({}),
-  env: z.object({
-    tiers: z.array(z.enum(["dev", "stg", "prod"])).default(["dev", "stg", "prod"])
-  }).default({}),
-  dev: z.object({
-    moduleConfigDir: z.literal(WPHS_WORKSPACE_DIR).default(WPHS_WORKSPACE_DIR),
-    adapter: z.string().default("./wphs.adapter.ts"),
-    fieldsJson: z.string().default("public/fields.json"),
-    themeFieldsJson: z.string().optional()
-  }).default({}),
-  scaffold: z.object({
-    /** hash = woodsportal-client-frontend (HubSpot CMS); browser = local clean URLs; none = single page */
-    router: z.enum(["hash", "browser", "none"]).default("hash")
-  }).optional()
-});
-var DEFAULT_WOODSPORTAL_HS = {
-  configVersion: CONFIG_VERSION,
-  projectType: "module-hybrid-cdn",
-  module: {
-    name: "woodsportal-module",
-    uploadPath: "dw-modules/woodsportal-module.module",
-    outDir: "dist/WoodsPortal.Module"
-  },
-  cdn: {
-    mode: "jsdelivr",
-    buildIdFile: ".module-build-id",
-    mirror: "portal.cdn.json"
-  },
-  entries: {
-    app: "src/cdn/app-entry.ts",
-    vendor: "src/cdn/vendor-entry.ts",
-    hubspotBootstrap: "src/hubspot/bootstrap.ts",
-    module: "src/hubspot/module-entry.tsx",
-    localDev: "src/main.tsx"
-  },
-  env: {
-    tiers: ["dev", "stg", "prod"]
-  },
-  dev: {
-    moduleConfigDir: WPHS_WORKSPACE_DIR,
-    adapter: "./wphs.adapter.ts",
-    fieldsJson: "public/fields.json"
-  }
-};
-function isModuleProject(config) {
-  return config.projectType === "module-hybrid-cdn" || config.projectType === "module-monolith";
-}
-function isThemeProject(config) {
-  return config.projectType === "theme-starter";
-}
-function usesCdnPipeline(config) {
-  return config.projectType === "module-hybrid-cdn" && config.cdn.mode !== "none";
-}
-
-// src/lib/paths.ts
-import { existsSync as existsSync2, readFileSync } from "fs";
-import { dirname, resolve as resolve2 } from "path";
-import { fileURLToPath } from "url";
-var KIT_PACKAGE_NAME = "@woodsportal/hubspot-kit";
-function resolveKitRoot() {
-  let dir = dirname(fileURLToPath(import.meta.url));
-  while (true) {
-    const pkgPath = resolve2(dir, "package.json");
-    if (existsSync2(pkgPath)) {
-      try {
-        const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
-        if (pkg.name === KIT_PACKAGE_NAME) {
-          return dir;
-        }
-      } catch {
-      }
-    }
-    const parent = dirname(dir);
-    if (parent === dir) {
-      break;
-    }
-    dir = parent;
-  }
-  throw new WpHsError("Could not resolve @woodsportal/hubspot-kit package root.", {
-    exitCode: ExitCode.INTERNAL
-  });
-}
-var kitRoot = resolveKitRoot();
-function getKitRoot() {
-  return kitRoot;
-}
-function findProjectRoot2(from = process.cwd()) {
-  const resolved = findProjectRoot(from);
-  if (!resolved) {
-    throw new WpHsError("Could not find woodscli.json in this directory or any parent.", {
-      exitCode: ExitCode.USER_ERROR,
-      remediation: "Run wp init, or pass --project <path>. Legacy config: wp migrate --yes."
-    });
-  }
-  return resolved;
-}
-function kitPath(...segments) {
-  return resolve2(kitRoot, ...segments);
-}
-
-// src/lib/config.ts
+import { readFileSync } from "fs";
 function loadConfig(projectRoot) {
-  const root = projectRoot ?? findProjectRoot2();
+  const root = projectRoot ?? findProjectRoot();
   const resolved = resolveProjectConfig(root);
   if (!resolved) {
     throw new WpHsError(`Missing ${WOODSCLI_CONFIG_FILE}`, {
@@ -212,7 +46,7 @@ function loadConfig(projectRoot) {
   }
   let raw;
   try {
-    raw = JSON.parse(readFileSync2(resolved.path, "utf8"));
+    raw = JSON.parse(readFileSync(resolved.path, "utf8"));
   } catch (cause) {
     throw new WpHsError(`Invalid JSON in ${resolved.fileName}`, {
       exitCode: ExitCode.USER_ERROR,
@@ -294,20 +128,171 @@ function createLogger(options = {}) {
   };
 }
 
+// src/lib/kit-version-check.ts
+import { existsSync, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+import pc2 from "picocolors";
+import semver from "semver";
+var NPM_REGISTRY_URL = "https://registry.npmjs.org/@woodsportal%2Fhubspot-kit";
+var VERSION_CHECK_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
+var VERSION_CHECK_FETCH_TIMEOUT_MS = 2500;
+function getVersionCheckCachePath() {
+  if (process.env.WP_VERSION_CHECK_CACHE) {
+    return process.env.WP_VERSION_CHECK_CACHE;
+  }
+  const base = process.env.XDG_CACHE_HOME ? join(process.env.XDG_CACHE_HOME, "woodsportal") : join(homedir(), ".cache", "woodsportal");
+  return join(base, "wp-kit-version.json");
+}
+function readVersionCheckCache(now = Date.now()) {
+  const cachePath = getVersionCheckCachePath();
+  if (!existsSync(cachePath)) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(readFileSync2(cachePath, "utf8"));
+    if (!parsed.latest || typeof parsed.fetchedAt !== "number") {
+      return null;
+    }
+    if (now - parsed.fetchedAt > VERSION_CHECK_CACHE_TTL_MS) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function writeVersionCheckCache(cache) {
+  const cachePath = getVersionCheckCachePath();
+  mkdirSync(dirname(cachePath), { recursive: true });
+  writeFileSync(cachePath, `${JSON.stringify(cache)}
+`, "utf8");
+}
+async function fetchLatestKitVersion() {
+  try {
+    const response = await fetch(NPM_REGISTRY_URL, {
+      signal: AbortSignal.timeout(VERSION_CHECK_FETCH_TIMEOUT_MS),
+      headers: { accept: "application/json" }
+    });
+    if (!response.ok) {
+      return null;
+    }
+    const body = await response.json();
+    const latest = body["dist-tags"]?.latest;
+    return typeof latest === "string" && latest.length > 0 ? latest : null;
+  } catch {
+    return null;
+  }
+}
+async function resolveLatestKitVersion(now = Date.now()) {
+  const cached = readVersionCheckCache(now);
+  if (cached) {
+    return cached.latest;
+  }
+  const latest = await fetchLatestKitVersion();
+  if (!latest) {
+    return null;
+  }
+  writeVersionCheckCache({ latest, fetchedAt: now });
+  return latest;
+}
+function isKitUpdateAvailable(current, latest) {
+  const currentCoerced = semver.coerce(current);
+  const latestCoerced = semver.coerce(latest);
+  if (!currentCoerced || !latestCoerced) {
+    return false;
+  }
+  return semver.lt(currentCoerced, latestCoerced);
+}
+function formatKitUpgradeCommand(projectRoot) {
+  const root = projectRoot || process.cwd();
+  const spec = `${KIT_PACKAGE_NAME}@latest`;
+  if (existsSync(join(root, "yarn.lock"))) {
+    return `yarn add -D ${spec}`;
+  }
+  if (existsSync(join(root, "pnpm-lock.yaml"))) {
+    return `pnpm add -D ${spec}`;
+  }
+  return `npm install -D ${spec}`;
+}
+function shouldUseWarnColor() {
+  if (process.env.NO_COLOR !== void 0) return false;
+  if (process.env.CI === "true") return false;
+  return process.stderr.isTTY === true;
+}
+function shouldSkipVersionCheck(options) {
+  if (options.ci || process.env.CI === "true") return true;
+  if (options.json || options.quiet) return true;
+  if (process.env.WP_SKIP_VERSION_CHECK === "1") return true;
+  return false;
+}
+function formatKitUpdateWarning(current, latest, projectRoot) {
+  const upgrade = formatKitUpgradeCommand(projectRoot);
+  const useColor = shouldUseWarnColor();
+  const warn = useColor ? pc2.yellow("warn") : "warn";
+  const dim = useColor ? pc2.dim : (text5) => text5;
+  return [
+    `[${warn}] ${KIT_PACKAGE_NAME} v${current} is installed; latest is v${latest}.`,
+    `${dim("       ")}Upgrade: ${upgrade}`
+  ].join("\n");
+}
+async function maybeWarnKitUpdate(options) {
+  try {
+    if (shouldSkipVersionCheck(options)) {
+      return;
+    }
+    const latest = await resolveLatestKitVersion();
+    if (!latest || !isKitUpdateAvailable(options.current, latest)) {
+      return;
+    }
+    process.stderr.write(`${formatKitUpdateWarning(options.current, latest, options.projectRoot)}
+`);
+  } catch {
+  }
+}
+
+// src/lib/kit-version.ts
+import { readFileSync as readFileSync3 } from "fs";
+import { resolve } from "path";
+var cachedVersion = null;
+function readKitVersion() {
+  if (cachedVersion) {
+    return cachedVersion;
+  }
+  try {
+    const pkg = JSON.parse(readFileSync3(resolve(getKitRoot(), "package.json"), "utf8"));
+    cachedVersion = pkg.version ?? "0.0.0";
+  } catch {
+    cachedVersion = "0.0.0";
+  }
+  return cachedVersion;
+}
+
 // src/lib/wphs-baseline.ts
-import { resolve as resolve3 } from "path";
+import { resolve as resolve2 } from "path";
 function defaultBaselineDir(projectRoot, config) {
   const workspace = config.dev.moduleConfigDir ?? WPHS_WORKSPACE_DIR;
-  return resolve3(projectRoot, workspace, "audit", "baseline");
+  return resolve2(projectRoot, workspace, "audit", "baseline");
+}
+
+// src/lib/exit-cli.ts
+async function exitCli(code) {
+  await new Promise((resolve23) => {
+    setImmediate(resolve23);
+  });
+  await new Promise((resolve23) => {
+    setTimeout(resolve23, 0);
+  });
+  process.exit(code);
 }
 
 // src/cli/commands/doctor.ts
-import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
-import { join, resolve as resolve8 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
+import { join as join2, resolve as resolve9 } from "path";
 
 // src/lib/cli-spinner.ts
 import * as p from "@clack/prompts";
-import pc2 from "picocolors";
+import pc3 from "picocolors";
 function isInteractiveCli(ctx) {
   const { json, quiet, ci } = ctx.global;
   return !json && !quiet && !ci && process.stdout.isTTY === true;
@@ -321,11 +306,11 @@ function isVerboseStepLog(ctx) {
   return ctx.global.verbose === true && !ctx.global.quiet && !ctx.global.json;
 }
 async function yieldForSpinnerPaint() {
-  await new Promise((resolve24) => {
-    setImmediate(resolve24);
+  await new Promise((resolve23) => {
+    setImmediate(resolve23);
   });
-  await new Promise((resolve24) => {
-    setTimeout(resolve24, 48);
+  await new Promise((resolve23) => {
+    setTimeout(resolve23, 48);
   });
 }
 async function runCliTasks(ctx, tasks, options = {}) {
@@ -372,7 +357,7 @@ async function runCliTasks(ctx, tasks, options = {}) {
       await step.task();
       spinner2.stop(step.title);
     } catch (error) {
-      spinner2.stop(pc2.red(step.title));
+      spinner2.stop(pc3.red(step.title));
       throw error;
     }
   }
@@ -384,7 +369,7 @@ function shouldQuietSubprocess(ctx, options = {}) {
 }
 function printCommandDone(ctx, message) {
   if (isInteractiveCli(ctx)) {
-    process.stdout.write(`${pc2.green("\u25C6")} ${message}
+    process.stdout.write(`${pc3.green("\u25C6")} ${message}
 `);
     return;
   }
@@ -392,8 +377,8 @@ function printCommandDone(ctx, message) {
 }
 
 // src/lib/hubspot-cli-setup.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { resolve as resolve4 } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync4 } from "fs";
+import { resolve as resolve3 } from "path";
 import { spawnSync } from "child_process";
 var HUBSPOT_CONFIG_FILE = "hubspot.config.yml";
 var HUBSPOT_CONFIG_EXAMPLE = "hubspot.config.yml.example";
@@ -419,13 +404,13 @@ function hsTimedOut(result) {
   return err?.code === "ETIMEDOUT";
 }
 function assessHubSpotConfigFiles(projectRoot) {
-  const configPath = resolve4(projectRoot, HUBSPOT_CONFIG_FILE);
-  const examplePath = resolve4(projectRoot, HUBSPOT_CONFIG_EXAMPLE);
-  const configPresent = existsSync3(configPath);
-  const examplePresent = existsSync3(examplePath);
+  const configPath = resolve3(projectRoot, HUBSPOT_CONFIG_FILE);
+  const examplePath = resolve3(projectRoot, HUBSPOT_CONFIG_EXAMPLE);
+  const configPresent = existsSync2(configPath);
+  const examplePresent = existsSync2(examplePath);
   let looksLikePlaceholder = false;
   if (configPresent) {
-    const raw = readFileSync3(configPath, "utf8");
+    const raw = readFileSync4(configPath, "utf8");
     looksLikePlaceholder = PLACEHOLDER_PATTERNS.some((pattern) => pattern.test(raw));
   } else {
     looksLikePlaceholder = true;
@@ -551,7 +536,7 @@ function doctorHubSpotChecks(projectRoot) {
       ok: assessment.hsCliInstalled,
       message: assessment.hsCliInstalled ? `HubSpot CLI ${assessment.hsCliVersion ?? ""}`.trim() : "HubSpot CLI not installed",
       remediation: assessment.hsCliInstalled ? void 0 : "npm i -g @hubspot/cli",
-      severity: "error"
+      severity: "warn"
     },
     {
       name: "hubspot-config",
@@ -570,136 +555,345 @@ function doctorHubSpotChecks(projectRoot) {
   ];
 }
 
-// src/lib/template-dev-deps.ts
-var VITE_DEV_PEER_DEPS = {
-  vite: "^6.1.0",
-  "@vitejs/plugin-react": "^4.3.4",
-  "babel-plugin-react-compiler": "^1.0.0",
-  "@tailwindcss/vite": "^4.0.6",
-  "@tanstack/router-plugin": "^1.121.2",
-  "@tanstack/react-router": "^1.121.2",
-  "@dnd-kit/core": "^6.3.1",
-  "@dnd-kit/sortable": "^10.0.0",
-  "@dnd-kit/utilities": "^3.2.2",
-  react: "^19.0.0",
-  "react-dom": "^19.0.0",
-  tailwindcss: "^4.0.6"
-};
-var KIT_DEV_DEP = "@woodsportal/hubspot-kit";
-var KIT_DEV_DEP_VERSION = "^1.0.30";
-var MODULE_CONFIG_UI_DEPS = [
-  "@dnd-kit/core",
-  "@dnd-kit/sortable",
-  "@dnd-kit/utilities"
-];
-function templateDevDependencies() {
-  return {
-    [KIT_DEV_DEP]: KIT_DEV_DEP_VERSION,
-    ...VITE_DEV_PEER_DEPS
-  };
-}
+// src/lib/cdn-github-setup.ts
+import { existsSync as existsSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
+import { resolve as resolve5 } from "path";
+import * as p2 from "@clack/prompts";
 
-// src/lib/hubspot-fields-json.ts
-var HUBSPOT_MODULE_FIELD_TYPES = /* @__PURE__ */ new Set([
-  "boolean",
-  "choice",
-  "color",
-  "cta",
-  "date",
-  "datetime",
-  "email",
-  "embed",
-  "file",
-  "followup_email",
-  "font",
-  "form",
-  "group",
-  "html",
-  "hubdb_row",
-  "hubdb_table",
-  "icon",
-  "image",
-  "link",
-  "logo",
-  "meeting",
-  "menu",
-  "number",
-  "page",
-  "payment",
-  "richtext",
-  "salesforce_campaign",
-  "simple_menu",
-  "spacing",
-  "tag",
-  "text",
-  "url",
-  "video",
-  "workflow"
-]);
-function isFieldRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function validateFieldNode(node, path, issues) {
-  if (!isFieldRecord(node)) {
-    issues.push({ path, message: "expected a field object" });
-    return;
-  }
-  const type = node.type;
-  if (typeof type !== "string" || type.length === 0) {
-    issues.push({ path: `${path}.type`, message: "missing field type" });
-  } else if (!HUBSPOT_MODULE_FIELD_TYPES.has(type)) {
-    issues.push({
-      path: `${path}.type`,
-      message: type === "textarea" ? `'textarea' is not a HubSpot field type \u2014 use "type": "text" with "display": "textarea"` : `'${type}' is not a valid HubSpot field type`
-    });
-  }
-  const tab = node.tab;
-  if (tab === "STYLE" && type !== "group") {
-    issues.push({
-      path: `${path}.tab`,
-      message: 'STYLE tab fields must live inside a "type": "group" with "tab": "STYLE" (HubSpot page editor Styles tab)'
-    });
-  }
-  if (type !== "group") {
-    const name = node.name;
-    if (typeof name !== "string" || name.trim().length === 0) {
-      issues.push({ path: `${path}.name`, message: "missing field name" });
-    }
-    const label = node.label;
-    if (typeof label !== "string" || label.trim().length === 0) {
-      issues.push({ path: `${path}.label`, message: "missing field label" });
+// src/lib/project-env-files.ts
+import { existsSync as existsSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
+import { resolve as resolve4 } from "path";
+var ENV_LOCAL_FILE = ".env.local";
+var ENV_GITIGNORE_LINES = [".env", ".env.*", "!.env*.example", ENV_LOCAL_FILE];
+function parseEnvFile(content) {
+  const result = {};
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eq = trimmed.indexOf("=");
+    if (eq <= 0) continue;
+    const key = trimmed.slice(0, eq).trim();
+    let value = trimmed.slice(eq + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
     }
-  } else {
-    const children = node.children;
-    if (!Array.isArray(children)) {
-      issues.push({ path: `${path}.children`, message: "group fields require a children array" });
+    result[key] = value;
+  }
+  return result;
+}
+function readEnvLocal(projectRoot) {
+  const path = resolve4(projectRoot, ENV_LOCAL_FILE);
+  if (!existsSync3(path)) return {};
+  return parseEnvFile(readFileSync5(path, "utf8"));
+}
+function formatEnvLocal(entries) {
+  const lines = [
+    "# Local secrets \u2014 gitignored. Created by wp init / wp setup (hybrid CDN).",
+    "# PORTAL_CDN_PUBLISH_TOKEN needs repo push on your portal.cdn.json mirror.",
+    ""
+  ];
+  for (const [key, value] of Object.entries(entries)) {
+    if (value.includes(" ") || value.includes("#")) {
+      lines.push(`${key}="${value.replace(/"/g, '\\"')}"`);
     } else {
-      children.forEach((child, index) => {
-        validateFieldNode(child, `${path}.children[${index}]`, issues);
-      });
+      lines.push(`${key}=${value}`);
     }
   }
+  return `${lines.join("\n").trimEnd()}
+`;
 }
-function validateHubSpotFieldsJson(fields) {
-  if (!Array.isArray(fields)) {
-    return [{ path: "$", message: "fields.json must be a top-level array" }];
-  }
-  const issues = [];
-  fields.forEach((field, index) => {
+function writeEnvLocal(projectRoot, entries) {
+  const path = resolve4(projectRoot, ENV_LOCAL_FILE);
+  const existing = existsSync3(path) ? parseEnvFile(readFileSync5(path, "utf8")) : {};
+  writeFileSync2(path, formatEnvLocal({ ...existing, ...entries }));
+}
+function mergeProjectEnv(projectRoot, base = process.env) {
+  const local = readEnvLocal(projectRoot);
+  const merged = { ...base };
+  for (const [key, value] of Object.entries(local)) {
+    if (merged[key] == null || merged[key] === "") {
+      merged[key] = value;
+    }
+  }
+  return merged;
+}
+function ensureEnvFilesGitignore(projectRoot) {
+  const gitignorePath = resolve4(projectRoot, ".gitignore");
+  const existing = existsSync3(gitignorePath) ? readFileSync5(gitignorePath, "utf8") : "";
+  const toAppend = ENV_GITIGNORE_LINES.filter((line) => !existing.includes(line)).join("\n");
+  if (!toAppend) return;
+  writeFileSync2(gitignorePath, `${existing.trimEnd()}
+
+# Env files (secrets)
+${toAppend}
+`);
+}
+
+// src/lib/cdn-github-setup.ts
+var PORTAL_CDN_PUBLISH_TOKEN_ENV = "PORTAL_CDN_PUBLISH_TOKEN";
+var PORTAL_CDN_JSON = "portal.cdn.json";
+var PLACEHOLDER_GITHUB = /your-org|your-portal-cdn-mirror/i;
+function isPlaceholderGithubSlug(github) {
+  return PLACEHOLDER_GITHUB.test(github);
+}
+function defaultPortalCdnJson() {
+  const examplePath = kitPath("templates", "shared", "portal.cdn.json.example");
+  if (existsSync4(examplePath)) {
+    return JSON.parse(readFileSync6(examplePath, "utf8"));
+  }
+  return {
+    publishMode: "jsdelivr",
+    github: "your-org/your-portal-cdn-mirror",
+    gitRemote: "https://github.com/your-org/your-portal-cdn-mirror.git",
+    cdnPathInRepo: "dist/cdn",
+    defaultBranch: "main"
+  };
+}
+function readPortalCdnJson(projectRoot) {
+  const path = resolve5(projectRoot, PORTAL_CDN_JSON);
+  if (!existsSync4(path)) return null;
+  try {
+    return JSON.parse(readFileSync6(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function normalizeGithubSlug(input) {
+  const trimmed = input.trim().replace(/^https:\/\/github\.com\//, "").replace(/\.git$/, "");
+  const parts = trimmed.split("/").filter(Boolean);
+  if (parts.length !== 2) return null;
+  return `${parts[0]}/${parts[1]}`;
+}
+function portalCdnJsonFromGithub(github, base) {
+  const slug = normalizeGithubSlug(github);
+  if (!slug) {
+    throw new Error(`Invalid GitHub repo \u2014 use org/repo (got "${github}")`);
+  }
+  return {
+    publishMode: base?.publishMode ?? "jsdelivr",
+    github: slug,
+    gitRemote: `https://github.com/${slug}.git`,
+    cdnPathInRepo: base?.cdnPathInRepo ?? "dist/cdn",
+    defaultBranch: base?.defaultBranch ?? "main"
+  };
+}
+function hasCdnPublishToken(projectRoot) {
+  if (process.env[PORTAL_CDN_PUBLISH_TOKEN_ENV]?.trim()) return true;
+  if (process.env.GITHUB_TOKEN?.trim()) return true;
+  return Boolean(readEnvLocal(projectRoot)[PORTAL_CDN_PUBLISH_TOKEN_ENV]?.trim());
+}
+function hasConfiguredCdnGithubMirror(projectRoot) {
+  const config = readPortalCdnJson(projectRoot);
+  const github = config?.github ?? "";
+  return Boolean(github) && !PLACEHOLDER_GITHUB.test(github);
+}
+function githubDefaultForPrompt(projectRoot) {
+  const existing = readPortalCdnJson(projectRoot);
+  if (existing?.github && !PLACEHOLDER_GITHUB.test(existing.github)) {
+    return existing.github;
+  }
+  return defaultPortalCdnJson().github;
+}
+function needsCdnGitHubSetup(projectRoot) {
+  return !hasConfiguredCdnGithubMirror(projectRoot) || !hasCdnPublishToken(projectRoot);
+}
+function applyCdnGitHubSetup(projectRoot, input) {
+  const existing = readPortalCdnJson(projectRoot) ?? defaultPortalCdnJson();
+  const updated = portalCdnJsonFromGithub(input.github, existing);
+  writeFileSync3(resolve5(projectRoot, PORTAL_CDN_JSON), `${JSON.stringify(updated, null, 2)}
+`);
+  if (input.token?.trim()) {
+    writeEnvLocal(projectRoot, { [PORTAL_CDN_PUBLISH_TOKEN_ENV]: input.token.trim() });
+  }
+  ensureEnvFilesGitignore(projectRoot);
+}
+async function promptCdnGitHubSetup(options = {}) {
+  if (options.skip) return null;
+  const projectRoot = options.projectRoot ?? process.cwd();
+  if (!needsCdnGitHubSetup(projectRoot)) {
+    return null;
+  }
+  let github = options.github?.trim();
+  if (!github && hasConfiguredCdnGithubMirror(projectRoot)) {
+    github = readPortalCdnJson(projectRoot)?.github;
+  }
+  if (!github) {
+    const answer = await p2.text({
+      message: "Public GitHub CDN mirror (org/repo)",
+      placeholder: options.githubDefault ?? "your-org/your-portal-cdn-mirror",
+      initialValue: options.githubDefault,
+      validate: (value) => {
+        const slug = normalizeGithubSlug(value ?? "");
+        return slug ? void 0 : "Enter a public repo as org/repo (jsDelivr serves from it)";
+      }
+    });
+    if (p2.isCancel(answer)) return null;
+    github = normalizeGithubSlug(answer) ?? void 0;
+  }
+  if (!github) return null;
+  if (hasCdnPublishToken(projectRoot)) {
+    return { github };
+  }
+  const tokenAnswer = await p2.password({
+    message: "GitHub token (repo push on CDN mirror)",
+    validate: (value) => {
+      if (!value?.trim()) return "Required for wp publish \u2014 create a fine-grained PAT with Contents: Read and write";
+      return void 0;
+    }
+  });
+  if (p2.isCancel(tokenAnswer)) return null;
+  return { github, token: tokenAnswer.trim() };
+}
+function formatCdnSetupNote(_projectRoot) {
+  return `CDN config written \u2014 edit ${PORTAL_CDN_JSON} if needed; token saved to ${ENV_LOCAL_FILE} (gitignored)`;
+}
+
+// src/lib/wphs-workspace.ts
+var ensureModulePromise;
+function loadEnsureModule() {
+  if (!ensureModulePromise) {
+    ensureModulePromise = Promise.resolve().then(async () => {
+      const mod = await import("./ensure-wphs-workspace-5S3GTO6K.js");
+      return mod;
+    });
+  }
+  return ensureModulePromise;
+}
+async function ensureProjectWphsWorkspace(projectRoot) {
+  const { ensureWphsWorkspace } = await loadEnsureModule();
+  return ensureWphsWorkspace(projectRoot, getKitRoot());
+}
+
+// src/lib/template-dev-deps.ts
+var VITE_DEV_PEER_DEPS = {
+  vite: "^6.1.0",
+  "@vitejs/plugin-react": "^4.3.4",
+  "babel-plugin-react-compiler": "^1.0.0",
+  "@tailwindcss/vite": "^4.0.6",
+  "@tanstack/router-plugin": "^1.121.2",
+  "@tanstack/react-router": "^1.121.2",
+  "@dnd-kit/core": "^6.3.1",
+  "@dnd-kit/sortable": "^10.0.0",
+  "@dnd-kit/utilities": "^3.2.2",
+  react: "^19.0.0",
+  "react-dom": "^19.0.0",
+  tailwindcss: "^4.0.6"
+};
+var KIT_DEV_DEP = "@woodsportal/hubspot-kit";
+var KIT_DEV_DEP_VERSION = "^1.0.30";
+var MODULE_CONFIG_UI_DEPS = [
+  "@dnd-kit/core",
+  "@dnd-kit/sortable",
+  "@dnd-kit/utilities"
+];
+function templateDevDependencies() {
+  return {
+    [KIT_DEV_DEP]: KIT_DEV_DEP_VERSION,
+    ...VITE_DEV_PEER_DEPS
+  };
+}
+
+// src/lib/hubspot-fields-json.ts
+var HUBSPOT_MODULE_FIELD_TYPES = /* @__PURE__ */ new Set([
+  "boolean",
+  "choice",
+  "color",
+  "cta",
+  "date",
+  "datetime",
+  "email",
+  "embed",
+  "file",
+  "followup_email",
+  "font",
+  "form",
+  "group",
+  "html",
+  "hubdb_row",
+  "hubdb_table",
+  "icon",
+  "image",
+  "link",
+  "logo",
+  "meeting",
+  "menu",
+  "number",
+  "page",
+  "payment",
+  "richtext",
+  "salesforce_campaign",
+  "simple_menu",
+  "spacing",
+  "tag",
+  "text",
+  "url",
+  "video",
+  "workflow"
+]);
+function isFieldRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function validateFieldNode(node, path, issues) {
+  if (!isFieldRecord(node)) {
+    issues.push({ path, message: "expected a field object" });
+    return;
+  }
+  const type = node.type;
+  if (typeof type !== "string" || type.length === 0) {
+    issues.push({ path: `${path}.type`, message: "missing field type" });
+  } else if (!HUBSPOT_MODULE_FIELD_TYPES.has(type)) {
+    issues.push({
+      path: `${path}.type`,
+      message: type === "textarea" ? `'textarea' is not a HubSpot field type \u2014 use "type": "text" with "display": "textarea"` : `'${type}' is not a valid HubSpot field type`
+    });
+  }
+  const tab = node.tab;
+  if (tab === "STYLE" && type !== "group") {
+    issues.push({
+      path: `${path}.tab`,
+      message: 'STYLE tab fields must live inside a "type": "group" with "tab": "STYLE" (HubSpot page editor Styles tab)'
+    });
+  }
+  if (type !== "group") {
+    const name = node.name;
+    if (typeof name !== "string" || name.trim().length === 0) {
+      issues.push({ path: `${path}.name`, message: "missing field name" });
+    }
+    const label = node.label;
+    if (typeof label !== "string" || label.trim().length === 0) {
+      issues.push({ path: `${path}.label`, message: "missing field label" });
+    }
+  } else {
+    const children = node.children;
+    if (!Array.isArray(children)) {
+      issues.push({ path: `${path}.children`, message: "group fields require a children array" });
+    } else {
+      children.forEach((child, index) => {
+        validateFieldNode(child, `${path}.children[${index}]`, issues);
+      });
+    }
+  }
+}
+function validateHubSpotFieldsJson(fields) {
+  if (!Array.isArray(fields)) {
+    return [{ path: "$", message: "fields.json must be a top-level array" }];
+  }
+  const issues = [];
+  fields.forEach((field, index) => {
     validateFieldNode(field, `[${index}]`, issues);
   });
   return issues;
 }
 
 // src/lib/developer-slug.ts
-import { existsSync as existsSync4, mkdirSync, readFileSync as readFileSync4, writeFileSync } from "fs";
-import { resolve as resolve5 } from "path";
-import * as p2 from "@clack/prompts";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
+import { resolve as resolve6 } from "path";
+import * as p3 from "@clack/prompts";
 var SLUG_MAX_LEN = 12;
 var SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,10}[a-z0-9])?$/;
 var DEVELOPER_CONFIG_FILE = "developer.json";
 function developerConfigPath(projectRoot) {
-  return resolve5(projectRoot, ".wphs", "config", DEVELOPER_CONFIG_FILE);
+  return resolve6(projectRoot, ".wphs", "config", DEVELOPER_CONFIG_FILE);
 }
 function sanitizeDevSlug(input) {
   if (!input?.trim()) return void 0;
@@ -711,9 +905,9 @@ function readDeveloperSlug(projectRoot) {
   const fromEnv = sanitizeDevSlug(process.env.PORTAL_CDN_DEV_SLUG) ?? sanitizeDevSlug(process.env.MODULE_CDN_DEV_SLUG);
   if (fromEnv) return fromEnv;
   const path = developerConfigPath(projectRoot);
-  if (!existsSync4(path)) return void 0;
+  if (!existsSync5(path)) return void 0;
   try {
-    const raw = JSON.parse(readFileSync4(path, "utf8"));
+    const raw = JSON.parse(readFileSync7(path, "utf8"));
     return sanitizeDevSlug(raw.slug);
   } catch {
     return void 0;
@@ -725,8 +919,8 @@ function writeDeveloperSlug(projectRoot, slug) {
     throw new Error("Invalid CDN dev slug \u2014 use lowercase letters, numbers, and hyphens (max 12 chars)");
   }
   const path = developerConfigPath(projectRoot);
-  mkdirSync(resolve5(path, ".."), { recursive: true });
-  writeFileSync(path, `${JSON.stringify({ slug: normalized }, null, 2)}
+  mkdirSync2(resolve6(path, ".."), { recursive: true });
+  writeFileSync4(path, `${JSON.stringify({ slug: normalized }, null, 2)}
 `);
 }
 function needsDeveloperSlugSetup(projectRoot) {
@@ -736,7 +930,7 @@ async function promptDeveloperSlug(projectRoot) {
   if (!needsDeveloperSlugSetup(projectRoot)) {
     return readDeveloperSlug(projectRoot);
   }
-  const slug = await p2.text({
+  const slug = await p3.text({
     message: "CDN dev slug (unique per developer for shared CDN mirror \u2014 e.g. your first name)",
     placeholder: "manab",
     validate: (value) => {
@@ -746,7 +940,7 @@ async function promptDeveloperSlug(projectRoot) {
       return void 0;
     }
   });
-  if (p2.isCancel(slug) || typeof slug !== "string") {
+  if (p3.isCancel(slug) || typeof slug !== "string") {
     return void 0;
   }
   writeDeveloperSlug(projectRoot, slug);
@@ -788,37 +982,37 @@ function resolveModuleBuildIdMetaForCli(projectRoot, env = process.env) {
 }
 
 // src/lib/upload-only-module.ts
-import { existsSync as existsSync5 } from "fs";
-import { resolve as resolve6 } from "path";
+import { existsSync as existsSync6 } from "fs";
+import { resolve as resolve7 } from "path";
 function isUploadOnlyPreexistingProject(projectRoot, moduleArtifactDirs) {
   if (moduleArtifactDirs.length === 0) return false;
-  if (existsSync5(resolve6(projectRoot, "package.json"))) return false;
-  if (existsSync5(resolve6(projectRoot, "src"))) return false;
-  return moduleArtifactDirs.some((dir) => existsSync5(resolve6(dir, "fields.json")));
+  if (existsSync6(resolve7(projectRoot, "package.json"))) return false;
+  if (existsSync6(resolve7(projectRoot, "src"))) return false;
+  return moduleArtifactDirs.some((dir) => existsSync6(resolve7(dir, "fields.json")));
 }
 
 // src/vite/resolve-dev-config.ts
-import { existsSync as existsSync6 } from "fs";
+import { existsSync as existsSync7 } from "fs";
 import { platform } from "os";
-import { resolve as resolve7 } from "path";
+import { resolve as resolve8 } from "path";
 var VITE_JS_SEGMENTS = ["node_modules", "vite", "bin", "vite.js"];
 function isProjectViteInstalled(projectRoot) {
-  return existsSync6(resolve7(projectRoot, ...VITE_JS_SEGMENTS));
+  return existsSync7(resolve8(projectRoot, ...VITE_JS_SEGMENTS));
 }
 function resolveProjectViteSpawn(projectRoot) {
-  const viteJs = resolve7(projectRoot, ...VITE_JS_SEGMENTS);
-  if (existsSync6(viteJs)) {
+  const viteJs = resolve8(projectRoot, ...VITE_JS_SEGMENTS);
+  if (existsSync7(viteJs)) {
     return { command: process.execPath, prefixArgs: [viteJs] };
   }
-  const binDir = resolve7(projectRoot, "node_modules", ".bin");
+  const binDir = resolve8(projectRoot, "node_modules", ".bin");
   if (platform() === "win32") {
-    const winCmd = resolve7(binDir, "vite.cmd");
-    if (existsSync6(winCmd)) {
+    const winCmd = resolve8(binDir, "vite.cmd");
+    if (existsSync7(winCmd)) {
       return { command: winCmd, prefixArgs: [] };
     }
   }
-  const posixShim = resolve7(binDir, "vite");
-  if (existsSync6(posixShim)) {
+  const posixShim = resolve8(binDir, "vite");
+  if (existsSync7(posixShim)) {
     return { command: posixShim, prefixArgs: [] };
   }
   return null;
@@ -905,10 +1099,10 @@ function envFileForTier(tier) {
   return ".env.prod";
 }
 function readEnvFileValue(projectRoot, file, key) {
-  const path = resolve8(projectRoot, file);
-  if (!existsSync7(path)) return void 0;
+  const path = resolve9(projectRoot, file);
+  if (!existsSync8(path)) return void 0;
   try {
-    const content = readFileSync5(path, "utf8");
+    const content = readFileSync8(path, "utf8");
     const match = content.match(new RegExp(`^${key}=(.*)$`, "m"));
     return match?.[1]?.trim();
   } catch {
@@ -917,8 +1111,8 @@ function readEnvFileValue(projectRoot, file, key) {
 }
 function checkEnvFiles(ctx) {
   const checks = [];
-  const localPath = resolve8(ctx.projectRoot, ".env.local");
-  const localOk = existsSync7(localPath);
+  const localPath = resolve9(ctx.projectRoot, ".env.local");
+  const localOk = existsSync8(localPath);
   checks.push({
     name: "env-local",
     ok: localOk,
@@ -926,8 +1120,8 @@ function checkEnvFiles(ctx) {
     remediation: localOk ? void 0 : "wp setup or copy .env.local.example \u2192 .env.local",
     severity: "warn"
   });
-  const legacyLocalDev = resolve8(ctx.projectRoot, ".env.dev");
-  if (!localOk && existsSync7(legacyLocalDev)) {
+  const legacyLocalDev = resolve9(ctx.projectRoot, ".env.dev");
+  if (!localOk && existsSync8(legacyLocalDev)) {
     const nodeEnv = readEnvFileValue(ctx.projectRoot, ".env.dev", "VITE_NODE_ENV");
     const hasDevMode = readEnvFileValue(ctx.projectRoot, ".env.dev", "VITE_DEV_MODE") != null;
     const looksLikeLocal = hasDevMode || nodeEnv === "local" || nodeEnv == null || nodeEnv === "development";
@@ -943,7 +1137,7 @@ function checkEnvFiles(ctx) {
   }
   for (const tier of ctx.config.env.tiers) {
     const file = envFileForTier(tier);
-    const ok = existsSync7(resolve8(ctx.projectRoot, file));
+    const ok = existsSync8(resolve9(ctx.projectRoot, file));
     if (tier === "stg") {
       checks.push({
         name: "env-stg",
@@ -966,8 +1160,8 @@ function checkEnvFiles(ctx) {
 }
 function checkLegacyBuildIdFile(ctx) {
   if (isThemeProject(ctx.config) || !usesCdnPipeline(ctx.config)) return null;
-  const legacy = resolve8(ctx.projectRoot, ".portal-build-id");
-  if (!existsSync7(legacy)) return null;
+  const legacy = resolve9(ctx.projectRoot, ".portal-build-id");
+  if (!existsSync8(legacy)) return null;
   return {
     name: "legacy-build-id",
     ok: false,
@@ -978,8 +1172,8 @@ function checkLegacyBuildIdFile(ctx) {
 }
 function checkBuildId(ctx) {
   if (isThemeProject(ctx.config) || !usesCdnPipeline(ctx.config)) return null;
-  const file = resolve8(ctx.projectRoot, ctx.config.cdn.buildIdFile);
-  const ok = existsSync7(file);
+  const file = resolve9(ctx.projectRoot, ctx.config.cdn.buildIdFile);
+  const ok = existsSync8(file);
   return {
     name: "build-id",
     ok,
@@ -1033,7 +1227,7 @@ function checkDevSlug(ctx) {
   };
 }
 function isUploadOnlyProject(ctx) {
-  const moduleDirs = [resolve8(ctx.projectRoot, ctx.config.module.uploadPath)];
+  const moduleDirs = [resolve9(ctx.projectRoot, ctx.config.module.uploadPath)];
   return isUploadOnlyPreexistingProject(ctx.projectRoot, moduleDirs);
 }
 function checkUploadOnlyNote(ctx) {
@@ -1047,8 +1241,8 @@ function checkUploadOnlyNote(ctx) {
   };
 }
 function checkDevViteConfig(ctx) {
-  const path = resolve8(ctx.projectRoot, "vite.config.dev.mjs");
-  const ok = existsSync7(path);
+  const path = resolve9(ctx.projectRoot, "vite.config.dev.mjs");
+  const ok = existsSync8(path);
   return {
     name: "vite-dev-config",
     ok,
@@ -1059,8 +1253,8 @@ function checkDevViteConfig(ctx) {
 }
 function checkMetaJson(ctx) {
   if (isThemeProject(ctx.config)) return null;
-  const path = resolve8(ctx.projectRoot, "public/meta.json");
-  if (!existsSync7(path)) {
+  const path = resolve9(ctx.projectRoot, "public/meta.json");
+  if (!existsSync8(path)) {
     return {
       name: "meta-json",
       ok: false,
@@ -1070,7 +1264,7 @@ function checkMetaJson(ctx) {
     };
   }
   try {
-    const meta = JSON.parse(readFileSync5(path, "utf8"));
+    const meta = JSON.parse(readFileSync8(path, "utf8"));
     const hasContentTypes = Array.isArray(meta.content_types) && meta.content_types.length > 0;
     return {
       name: "meta-json",
@@ -1092,8 +1286,8 @@ function checkMetaJson(ctx) {
 }
 async function checkCdnMirrorPublic(ctx) {
   if (isThemeProject(ctx.config) || !usesCdnPipeline(ctx.config)) return null;
-  const mirrorPath = resolve8(ctx.projectRoot, ctx.config.cdn?.mirror ?? "portal.cdn.json");
-  if (!existsSync7(mirrorPath)) {
+  const mirrorPath = resolve9(ctx.projectRoot, ctx.config.cdn?.mirror ?? "portal.cdn.json");
+  if (!existsSync8(mirrorPath)) {
     return {
       name: "cdn-mirror-public",
       ok: false,
@@ -1104,7 +1298,7 @@ async function checkCdnMirrorPublic(ctx) {
   }
   let github;
   try {
-    const mirror = JSON.parse(readFileSync5(mirrorPath, "utf8"));
+    const mirror = JSON.parse(readFileSync8(mirrorPath, "utf8"));
     github = mirror.github?.trim();
   } catch {
     return {
@@ -1124,6 +1318,15 @@ async function checkCdnMirrorPublic(ctx) {
       severity: "error"
     };
   }
+  if (isPlaceholderGithubSlug(github)) {
+    return {
+      name: "cdn-mirror-public",
+      ok: false,
+      message: `portal.cdn.json still has placeholder github slug (${github})`,
+      remediation: "Run wp setup and set a real public org/repo for jsDelivr",
+      severity: "warn"
+    };
+  }
   try {
     const res = await fetch(`https://api.github.com/repos/${github}`, {
       headers: { Accept: "application/vnd.github+json" }
@@ -1156,8 +1359,8 @@ async function checkCdnMirrorPublic(ctx) {
       severity: "warn"
     };
   }
-  const manifestPath = resolve8(ctx.projectRoot, "dist/cdn/manifest.json");
-  if (!existsSync7(manifestPath)) {
+  const manifestPath = resolve9(ctx.projectRoot, "dist/cdn/manifest.json");
+  if (!existsSync8(manifestPath)) {
     return {
       name: "cdn-mirror-public",
       ok: true,
@@ -1166,7 +1369,7 @@ async function checkCdnMirrorPublic(ctx) {
     };
   }
   try {
-    const manifest = JSON.parse(readFileSync5(manifestPath, "utf8"));
+    const manifest = JSON.parse(readFileSync8(manifestPath, "utf8"));
     const appUrl = manifest.scripts?.find((s) => s.name === "app")?.url;
     if (!appUrl) {
       return {
@@ -1176,20 +1379,36 @@ async function checkCdnMirrorPublic(ctx) {
         severity: "error"
       };
     }
-    const head = await fetch(appUrl, { method: "HEAD" });
-    if (!head.ok) {
+    const appHead = await fetch(appUrl, { method: "HEAD" });
+    if (!appHead.ok) {
       return {
         name: "cdn-mirror-public",
         ok: false,
-        message: `jsDelivr app chunk not reachable (HTTP ${head.status}) \u2014 HubSpot preview will be blank`,
+        message: `jsDelivr app chunk not reachable (HTTP ${appHead.status}) \u2014 HubSpot preview will be blank`,
         remediation: "Run wp deploy (publish CDN + upload module) after making the mirror repo public",
         severity: "error"
       };
     }
+    const lazyChunks = (manifest.scripts ?? []).filter(
+      (entry) => typeof entry.url === "string" && (entry.file?.startsWith("chunks/") || entry.url.includes("/chunks/"))
+    );
+    for (const chunk of lazyChunks) {
+      const chunkHead = await fetch(chunk.url, { method: "HEAD" });
+      if (!chunkHead.ok) {
+        return {
+          name: "cdn-mirror-public",
+          ok: false,
+          message: `jsDelivr lazy chunk not reachable: ${chunk.file ?? chunk.url} (HTTP ${chunkHead.status})`,
+          remediation: "Run wp deploy to republish dist/cdn (including chunks/) and wait 5\u201315 min for jsDelivr propagation",
+          severity: "error"
+        };
+      }
+    }
+    const lazyChunkNote = lazyChunks.length > 0 ? ` and ${lazyChunks.length} lazy chunk(s) are reachable` : "";
     return {
       name: "cdn-mirror-public",
       ok: true,
-      message: `CDN mirror ${github} is public and jsDelivr app chunk is reachable`,
+      message: `CDN mirror ${github} is public and jsDelivr app chunk${lazyChunkNote}`,
       severity: "error"
     };
   } catch {
@@ -1203,8 +1422,8 @@ async function checkCdnMirrorPublic(ctx) {
 }
 function checkFieldsJson(ctx) {
   if (isThemeProject(ctx.config)) return null;
-  const path = resolve8(ctx.projectRoot, "public/fields.json");
-  if (!existsSync7(path)) {
+  const path = resolve9(ctx.projectRoot, "public/fields.json");
+  if (!existsSync8(path)) {
     return {
       name: "fields-json",
       ok: false,
@@ -1214,7 +1433,7 @@ function checkFieldsJson(ctx) {
     };
   }
   try {
-    const fields = JSON.parse(readFileSync5(path, "utf8"));
+    const fields = JSON.parse(readFileSync8(path, "utf8"));
     const issues = validateHubSpotFieldsJson(fields);
     if (issues.length === 0) {
       return {
@@ -1244,11 +1463,11 @@ function checkFieldsJson(ctx) {
   }
 }
 function readProjectFile(projectRoot, relativePath) {
-  const path = resolve8(projectRoot, relativePath);
-  if (!existsSync7(path)) {
+  const path = resolve9(projectRoot, relativePath);
+  if (!existsSync8(path)) {
     return null;
   }
-  return readFileSync5(path, "utf8");
+  return readFileSync8(path, "utf8");
 }
 function checkCssPipeline(ctx) {
   if (isThemeProject(ctx.config) || isUploadOnlyProject(ctx)) {
@@ -1315,9 +1534,9 @@ function checkCssPipeline(ctx) {
   }
   const moduleOutDir = ctx.config.module?.outDir;
   if (moduleOutDir && usesCdnPipeline(ctx.config)) {
-    const moduleCssPath = resolve8(ctx.projectRoot, moduleOutDir, "module.css");
-    if (existsSync7(moduleCssPath)) {
-      const css = readFileSync5(moduleCssPath, "utf8");
+    const moduleCssPath = resolve9(ctx.projectRoot, moduleOutDir, "module.css");
+    if (existsSync8(moduleCssPath)) {
+      const css = readFileSync8(moduleCssPath, "utf8");
       const hasDwUtilities = /dw\\:/.test(css) || /\.dw:/.test(css);
       checks.push({
         name: "css-module-dist-prefixed",
@@ -1332,8 +1551,8 @@ function checkCssPipeline(ctx) {
 }
 function checkHybridModuleHtml(ctx) {
   if (isThemeProject(ctx.config) || !usesCdnPipeline(ctx.config)) return null;
-  const path = resolve8(ctx.projectRoot, "public/module.html");
-  if (!existsSync7(path)) {
+  const path = resolve9(ctx.projectRoot, "public/module.html");
+  if (!existsSync8(path)) {
     return {
       name: "module-html",
       ok: false,
@@ -1342,7 +1561,7 @@ function checkHybridModuleHtml(ctx) {
       severity: "error"
     };
   }
-  const html = readFileSync5(path, "utf8");
+  const html = readFileSync8(path, "utf8");
   const needs = ["__PORTAL_CDN_BASE__", "require_js", "hubSpotData", 'id="app"'];
   const missing = needs.filter((token) => !html.includes(token));
   const usesUndeclaredCdnFields = /module\.portal_(cdn_base_url|vendor_script|app_script|app_css)/.test(
@@ -1360,8 +1579,8 @@ function checkHybridModuleHtml(ctx) {
 function checkCdnViteConfigs(ctx) {
   if (isThemeProject(ctx.config) || !usesCdnPipeline(ctx.config)) return [];
   return ["vite.config.cdn-vendor.mjs", "vite.config.cdn-app.mjs"].map((file) => {
-    const path = resolve8(ctx.projectRoot, file);
-    const ok = existsSync7(path);
+    const path = resolve9(ctx.projectRoot, file);
+    const ok = existsSync8(path);
     return {
       name: file.replace(/\./g, "-"),
       ok,
@@ -1373,8 +1592,8 @@ function checkCdnViteConfigs(ctx) {
 }
 function checkDevEntry(ctx) {
   const checks = [];
-  const indexHtml = resolve8(ctx.projectRoot, "index.html");
-  const hasIndex = existsSync7(indexHtml);
+  const indexHtml = resolve9(ctx.projectRoot, "index.html");
+  const hasIndex = existsSync8(indexHtml);
   checks.push({
     name: "index-html",
     ok: hasIndex,
@@ -1382,8 +1601,8 @@ function checkDevEntry(ctx) {
     remediation: hasIndex ? void 0 : "Re-run wp init or copy index.html from kit templates",
     severity: "error"
   });
-  const localDev = resolve8(ctx.projectRoot, ctx.config.entries.localDev);
-  const hasEntry = existsSync7(localDev);
+  const localDev = resolve9(ctx.projectRoot, ctx.config.entries.localDev);
+  const hasEntry = existsSync8(localDev);
   checks.push({
     name: "local-dev-entry",
     ok: hasEntry,
@@ -1393,7 +1612,7 @@ function checkDevEntry(ctx) {
   });
   if (hasEntry) {
     try {
-      const source = readFileSync5(localDev, "utf8");
+      const source = readFileSync8(localDev, "utf8");
       const usesKitNodeBootstrap = source.includes("@woodsportal/hubspot-kit/dev/bootstrap-greenfield") || source.includes("@woodsportal/hubspot-kit/dev/bootstrap");
       const usesWphsShim = source.includes(".wphs/.kit-bootstrap-greenfield") || source.includes(".wphs/.kit-bootstrap") || source.includes("@wphs/bootstrap-greenfield") || source.includes("@wphs/bootstrap");
       checks.push({
@@ -1410,7 +1629,7 @@ function checkDevEntry(ctx) {
 }
 function checkKitScripts() {
   const script = kitPath("scripts", "build-cdn.mjs");
-  const ok = existsSync7(script);
+  const ok = existsSync8(script);
   return {
     name: "kit-scripts",
     ok,
@@ -1419,12 +1638,38 @@ function checkKitScripts() {
     severity: "error"
   };
 }
+function checkWphsScaffold(scaffoldError) {
+  if (!scaffoldError) return null;
+  return {
+    name: "wphs-scaffold",
+    ok: false,
+    message: `.wphs workspace scaffold failed \u2014 ${scaffoldError}`,
+    remediation: "Run wp doctor --verbose or wp setup; check write permissions on the project root (Windows: enable Developer Mode if junction creation fails)",
+    severity: "error"
+  };
+}
+async function runWphsScaffold(ctx) {
+  if (ctx.global.dryRun) return void 0;
+  try {
+    const paths = await ensureProjectWphsWorkspace(ctx.projectRoot);
+    if (ctx.global.verbose) {
+      ctx.logger.info(`.wphs workspace ready at ${paths.workspaceRoot}`);
+    }
+    return void 0;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (ctx.global.verbose) {
+      ctx.logger.error(`Could not scaffold .wphs workspace: ${message}`);
+    }
+    return message;
+  }
+}
 function checkWphsWorkspace(ctx) {
   const workspace = ctx.config.dev.moduleConfigDir;
   const checks = [];
   for (const legacy of [".dev", ".woodsportal"]) {
-    const legacyPath = resolve8(ctx.projectRoot, legacy);
-    if (existsSync7(legacyPath)) {
+    const legacyPath = resolve9(ctx.projectRoot, legacy);
+    if (existsSync8(legacyPath)) {
       checks.push({
         name: `legacy-${legacy}`,
         ok: false,
@@ -1434,7 +1679,7 @@ function checkWphsWorkspace(ctx) {
       });
     }
   }
-  if (existsSync7(resolve8(ctx.projectRoot, ".wp-hs-baseline"))) {
+  if (existsSync8(resolve9(ctx.projectRoot, ".wp-hs-baseline"))) {
     checks.push({
       name: "legacy-baseline",
       ok: false,
@@ -1453,15 +1698,15 @@ function checkWphsWorkspace(ctx) {
     });
     return checks;
   }
-  const wphsRoot = resolve8(ctx.projectRoot, workspace);
+  const wphsRoot = resolve9(ctx.projectRoot, workspace);
   const required = ["config", "assets/branding", "fixtures", "cache", "audit/baseline", "state"];
   for (const sub of required) {
-    const ok = existsSync7(join(wphsRoot, sub));
+    const ok = existsSync8(join2(wphsRoot, sub));
     checks.push({
       name: `wphs-${sub.replace(/\//g, "-")}`,
       ok,
       message: ok ? `.wphs/${sub}/ present` : `.wphs/${sub}/ missing`,
-      remediation: ok ? void 0 : "Run wp doctor (auto-scaffolds) or wp init",
+      remediation: ok ? void 0 : "Run wp setup or wp doctor --verbose; check write permissions on the project root",
       severity: "error"
     });
   }
@@ -1469,8 +1714,8 @@ function checkWphsWorkspace(ctx) {
 }
 function checkAdapter(ctx) {
   if (isThemeProject(ctx.config)) return null;
-  const adapterPath = resolve8(ctx.projectRoot, ctx.config.dev.adapter);
-  const ok = existsSync7(adapterPath);
+  const adapterPath = resolve9(ctx.projectRoot, ctx.config.dev.adapter);
+  const ok = existsSync8(adapterPath);
   return {
     name: "wphs-adapter",
     ok,
@@ -1481,11 +1726,11 @@ function checkAdapter(ctx) {
 }
 function checkModuleConfigUiDeps(ctx) {
   if (isThemeProject(ctx.config)) return [];
-  const pkgPath = resolve8(ctx.projectRoot, "package.json");
-  if (!existsSync7(pkgPath)) return [];
+  const pkgPath = resolve9(ctx.projectRoot, "package.json");
+  if (!existsSync8(pkgPath)) return [];
   let deps = {};
   try {
-    const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
+    const pkg = JSON.parse(readFileSync8(pkgPath, "utf8"));
     deps = { ...pkg.dependencies, ...pkg.devDependencies };
   } catch {
     return [];
@@ -1512,7 +1757,7 @@ function checkNodeLoaderInterop() {
   };
 }
 function checkViteInstalled(ctx) {
-  if (isThemeProject(ctx.config) && !existsSync7(resolve8(ctx.projectRoot, "vite.config.dev.mjs"))) {
+  if (isThemeProject(ctx.config) && !existsSync8(resolve9(ctx.projectRoot, "vite.config.dev.mjs"))) {
     return null;
   }
   const ok = isProjectViteInstalled(ctx.projectRoot);
@@ -1526,19 +1771,12 @@ function checkViteInstalled(ctx) {
 }
 async function gatherDoctorChecks(ctx) {
   const checks = [];
+  let wphsScaffoldError;
   await runCliTasks(ctx, [
     {
       title: "Preparing .wphs workspace",
       task: async () => {
-        if (ctx.global.dryRun) return;
-        try {
-          runNodeScript(kitPath("scripts", "ensure-wphs-workspace.mjs"), [], {
-            cwd: ctx.projectRoot,
-            logger: ctx.logger,
-            dryRun: false
-          });
-        } catch {
-        }
+        wphsScaffoldError = await runWphsScaffold(ctx);
       }
     },
     {
@@ -1562,7 +1800,11 @@ async function gatherDoctorChecks(ctx) {
     {
       title: "Checking woodscli.json and project layout",
       task: async () => {
-        checks.push(...checkConfig(ctx), ...checkWphsWorkspace(ctx));
+        wphsScaffoldError = await runWphsScaffold(ctx) ?? wphsScaffoldError;
+        checks.push(...checkConfig(ctx));
+        const scaffoldCheck = checkWphsScaffold(wphsScaffoldError);
+        if (scaffoldCheck) checks.push(scaffoldCheck);
+        checks.push(...checkWphsWorkspace(ctx));
         const fieldsCheck = checkFieldsJson(ctx);
         if (fieldsCheck) checks.push(fieldsCheck);
         const metaCheck = checkMetaJson(ctx);
@@ -1672,26 +1914,7 @@ async function runConfigValidate(ctx) {
 import { resolve as resolve10 } from "path";
 
 // src/lib/cli-banner.ts
-import pc3 from "picocolors";
-
-// src/lib/kit-version.ts
-import { readFileSync as readFileSync6 } from "fs";
-import { resolve as resolve9 } from "path";
-var cachedVersion = null;
-function readKitVersion() {
-  if (cachedVersion) {
-    return cachedVersion;
-  }
-  try {
-    const pkg = JSON.parse(readFileSync6(resolve9(getKitRoot(), "package.json"), "utf8"));
-    cachedVersion = pkg.version ?? "0.0.0";
-  } catch {
-    cachedVersion = "0.0.0";
-  }
-  return cachedVersion;
-}
-
-// src/lib/cli-banner.ts
+import pc4 from "picocolors";
 var WOODSCLI_ASCII_BANNER = `
  __          __             _      _____ _      _____ 
  \\ \\        / /            | |    / ____| |    |_   _|
@@ -1721,7 +1944,7 @@ function formatProjectLabel(config) {
   return `${config.module.name} \xB7 ${config.projectType}${routerNote}`;
 }
 function section(color, title, body) {
-  const bold = (text4) => color ? pc3.bold(text4) : text4;
+  const bold = (text5) => color ? pc4.bold(text5) : text5;
   return `  ${bold(title)}
 ${body}`;
 }
@@ -1730,10 +1953,10 @@ function printWoodsCliDevBanner(options) {
     return;
   }
   const color = useCliColor();
-  const cyan = (text4) => color ? pc3.cyan(text4) : text4;
-  const dim = (text4) => color ? pc3.dim(text4) : text4;
-  const bold = (text4) => color ? pc3.bold(text4) : text4;
-  const yellow = (text4) => color ? pc3.yellow(text4) : text4;
+  const cyan = (text5) => color ? pc4.cyan(text5) : text5;
+  const dim = (text5) => color ? pc4.dim(text5) : text5;
+  const bold = (text5) => color ? pc4.bold(text5) : text5;
+  const yellow = (text5) => color ? pc4.yellow(text5) : text5;
   const version = options.version ?? readKitVersion();
   const project = formatProjectLabel(options.config);
   const isTheme = isThemeProject(options.config);
@@ -1994,86 +2217,17 @@ async function runDev(ctx, options) {
 }
 
 // src/cli/commands/deploy.ts
-import { resolve as resolve13 } from "path";
-
-// src/lib/project-env-files.ts
-import { existsSync as existsSync8, readFileSync as readFileSync7, writeFileSync as writeFileSync2 } from "fs";
-import { resolve as resolve11 } from "path";
-var ENV_LOCAL_FILE = ".env.local";
-var ENV_GITIGNORE_LINES = [".env", ".env.*", "!.env*.example", ENV_LOCAL_FILE];
-function parseEnvFile(content) {
-  const result = {};
-  for (const line of content.split("\n")) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith("#")) continue;
-    const eq = trimmed.indexOf("=");
-    if (eq <= 0) continue;
-    const key = trimmed.slice(0, eq).trim();
-    let value = trimmed.slice(eq + 1).trim();
-    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
-      value = value.slice(1, -1);
-    }
-    result[key] = value;
-  }
-  return result;
-}
-function readEnvLocal(projectRoot) {
-  const path = resolve11(projectRoot, ENV_LOCAL_FILE);
-  if (!existsSync8(path)) return {};
-  return parseEnvFile(readFileSync7(path, "utf8"));
-}
-function formatEnvLocal(entries) {
-  const lines = [
-    "# Local secrets \u2014 gitignored. Created by wp init / wp setup (hybrid CDN).",
-    "# PORTAL_CDN_PUBLISH_TOKEN needs repo push on your portal.cdn.json mirror.",
-    ""
-  ];
-  for (const [key, value] of Object.entries(entries)) {
-    if (value.includes(" ") || value.includes("#")) {
-      lines.push(`${key}="${value.replace(/"/g, '\\"')}"`);
-    } else {
-      lines.push(`${key}=${value}`);
-    }
-  }
-  return `${lines.join("\n").trimEnd()}
-`;
-}
-function writeEnvLocal(projectRoot, entries) {
-  const path = resolve11(projectRoot, ENV_LOCAL_FILE);
-  const existing = existsSync8(path) ? parseEnvFile(readFileSync7(path, "utf8")) : {};
-  writeFileSync2(path, formatEnvLocal({ ...existing, ...entries }));
-}
-function mergeProjectEnv(projectRoot, base = process.env) {
-  const local = readEnvLocal(projectRoot);
-  const merged = { ...base };
-  for (const [key, value] of Object.entries(local)) {
-    if (merged[key] == null || merged[key] === "") {
-      merged[key] = value;
-    }
-  }
-  return merged;
-}
-function ensureEnvFilesGitignore(projectRoot) {
-  const gitignorePath = resolve11(projectRoot, ".gitignore");
-  const existing = existsSync8(gitignorePath) ? readFileSync7(gitignorePath, "utf8") : "";
-  const toAppend = ENV_GITIGNORE_LINES.filter((line) => !existing.includes(line)).join("\n");
-  if (!toAppend) return;
-  writeFileSync2(gitignorePath, `${existing.trimEnd()}
-
-# Env files (secrets)
-${toAppend}
-`);
-}
+import { resolve as resolve12 } from "path";
 
 // src/cli/commands/upload.ts
-import { resolve as resolve12 } from "path";
+import { resolve as resolve11 } from "path";
 async function uploadModuleOrTheme(ctx) {
   if (isThemeProject(ctx.config)) {
     const theme = ctx.config.theme;
     if (!theme) {
       throw new WpHsError("theme block missing in woodscli.json", { exitCode: ExitCode.USER_ERROR });
     }
-    const srcDir = resolve12(ctx.projectRoot, theme.srcDir);
+    const srcDir = resolve11(ctx.projectRoot, theme.srcDir);
     await runCommandAsync("hs", ["cms", "upload", srcDir, theme.uploadPath], {
       cwd: ctx.projectRoot,
       projectRoot: ctx.projectRoot,
@@ -2083,7 +2237,7 @@ async function uploadModuleOrTheme(ctx) {
     });
     return `Uploaded theme ${srcDir} \u2192 ${theme.uploadPath}`;
   }
-  const outDir = resolve12(ctx.projectRoot, ctx.config.module.outDir);
+  const outDir = resolve11(ctx.projectRoot, ctx.config.module.outDir);
   const uploadPath = ctx.config.module.uploadPath;
   await runCommandAsync("hs", ["cms", "upload", outDir, uploadPath], {
     cwd: ctx.projectRoot,
@@ -2260,7 +2414,7 @@ async function runDeploy(ctx, options) {
   if (!ctx.global.json) {
     printCommandDone(
       ctx,
-      `Deploy complete (${resolve13(ctx.projectRoot, ctx.config.module.outDir)} \u2192 ${ctx.config.module.uploadPath})`
+      `Deploy complete (${resolve12(ctx.projectRoot, ctx.config.module.outDir)} \u2192 ${ctx.config.module.uploadPath})`
     );
   }
   return ExitCode.SUCCESS;
@@ -2333,8 +2487,8 @@ async function runPublish(ctx, options) {
 
 // src/cli/commands/audit.ts
 import { createHash } from "crypto";
-import { cpSync, existsSync as existsSync9, mkdirSync as mkdirSync2, readFileSync as readFileSync8, readdirSync, rmSync, statSync } from "fs";
-import { resolve as resolve14, join as join2 } from "path";
+import { cpSync, existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync9, readdirSync, rmSync, statSync } from "fs";
+import { resolve as resolve13, join as join3 } from "path";
 var FORBIDDEN_SHIP_TOKENS = [
   "ModuleConfigOverlay",
   "module-config-store",
@@ -2343,15 +2497,16 @@ var FORBIDDEN_SHIP_TOKENS = [
   "dev.module-config"
 ];
 var FORBIDDEN_FIXTURE_MENU_TOKENS = ["User Home", "Primary Company Deals"];
+var FORBIDDEN_PREVIEW_FIXTURE_TOKENS = ["preview.editor@example.com", "CMS_EDITOR_PREVIEW"];
 function hashFile(path) {
-  return createHash("sha256").update(readFileSync8(path)).digest("hex");
+  return createHash("sha256").update(readFileSync9(path)).digest("hex");
 }
 function walkFiles(dir) {
   if (!existsSync9(dir)) return [];
   const entries = readdirSync(dir);
   const files = [];
   for (const entry of entries) {
-    const full = join2(dir, entry);
+    const full = join3(dir, entry);
     if (statSync(full).isDirectory()) {
       files.push(...walkFiles(full));
     } else {
@@ -2363,26 +2518,31 @@ function walkFiles(dir) {
 async function runAuditShipBundle(ctx) {
   const root = ctx.projectRoot;
   const targets = [
-    resolve14(root, "dist/cdn"),
-    resolve14(root, ctx.config.module.outDir)
+    resolve13(root, "dist/cdn"),
+    resolve13(root, ctx.config.module.outDir)
   ];
   const violations = [];
   for (const dir of targets) {
     for (const file of walkFiles(dir)) {
       if (!/\.(js|css|html)$/i.test(file)) continue;
-      const content = readFileSync8(file, "utf8");
+      const content = readFileSync9(file, "utf8");
       for (const token of FORBIDDEN_SHIP_TOKENS) {
         if (content.includes(token)) {
           violations.push(`${file}: contains forbidden token "${token}"`);
         }
       }
-      const isCdnAppBundle = /[/\\]dist[/\\]cdn[/\\]app\..*\.js$/i.test(file);
-      if (isCdnAppBundle) {
+      const isCdnAppEntry = /[/\\]dist[/\\]cdn[/\\]app\..*\.js$/i.test(file);
+      if (isCdnAppEntry) {
         for (const token of FORBIDDEN_FIXTURE_MENU_TOKENS) {
           if (content.includes(token)) {
             violations.push(`${file}: contains fixture menu marker "${token}"`);
           }
         }
+        for (const token of FORBIDDEN_PREVIEW_FIXTURE_TOKENS) {
+          if (content.includes(token)) {
+            violations.push(`${file}: contains preview fixture marker "${token}"`);
+          }
+        }
       }
     }
   }
@@ -2405,8 +2565,8 @@ async function runAuditBaselineCapture(ctx, options) {
   const root = ctx.projectRoot;
   const baseline = options.baselineDir ?? defaultBaselineDir(root, ctx.config);
   const sources = [
-    { label: "cdn", path: resolve14(root, "dist/cdn") },
-    { label: "hubspot", path: resolve14(root, ctx.config.module.outDir) }
+    { label: "cdn", path: resolve13(root, "dist/cdn") },
+    { label: "hubspot", path: resolve13(root, ctx.config.module.outDir) }
   ];
   if (ctx.global.dryRun) {
     ctx.logger.info(`[dry-run] Would capture baseline to ${baseline}`);
@@ -2419,9 +2579,9 @@ async function runAuditBaselineCapture(ctx, options) {
         remediation: "Run wp build before wp audit baseline --capture."
       });
     }
-    const target = resolve14(baseline, label);
+    const target = resolve13(baseline, label);
     rmSync(target, { recursive: true, force: true });
-    mkdirSync2(baseline, { recursive: true });
+    mkdirSync3(baseline, { recursive: true });
     cpSync(path, target, { recursive: true });
   }
   if (ctx.global.json) {
@@ -2435,12 +2595,12 @@ async function runAuditParity(ctx, options) {
   const root = ctx.projectRoot;
   const baseline = options.baselineDir ?? defaultBaselineDir(root, ctx.config);
   const currentDirs = [
-    { label: "cdn", path: resolve14(root, "dist/cdn") },
-    { label: "hubspot", path: resolve14(root, ctx.config.module.outDir) }
+    { label: "cdn", path: resolve13(root, "dist/cdn") },
+    { label: "hubspot", path: resolve13(root, ctx.config.module.outDir) }
   ];
   const mismatches = [];
   for (const { label, path } of currentDirs) {
-    const baselinePath = resolve14(baseline, label);
+    const baselinePath = resolve13(baseline, label);
     if (!existsSync9(baselinePath)) {
       ctx.logger.warn(`No baseline at ${baselinePath} \u2014 skipping ${label} parity`);
       continue;
@@ -2456,7 +2616,7 @@ async function runAuditParity(ctx, options) {
     }
     for (const file of baselineFiles) {
       const rel = file.replace(baselinePath, "");
-      const current = resolve14(path, rel.slice(1));
+      const current = resolve13(path, rel.slice(1));
       if (!existsSync9(current)) continue;
       const bh = hashFile(file);
       const ch = hashFile(current);
@@ -2484,13 +2644,13 @@ var SECRET_PATTERNS = [
 ];
 async function runAuditSecrets(ctx) {
   const root = ctx.projectRoot;
-  const scanRoots = ["src", "public", ".wphs/config"].map((d) => resolve14(root, d));
+  const scanRoots = ["src", "public", ".wphs/config"].map((d) => resolve13(root, d));
   const findings = [];
   for (const dir of scanRoots) {
     for (const file of walkFiles(dir)) {
       if (!/\.(ts|tsx|js|jsx|json|env|yml|yaml|html)$/i.test(file)) continue;
       if (file.includes("node_modules")) continue;
-      const content = readFileSync8(file, "utf8");
+      const content = readFileSync9(file, "utf8");
       for (const pattern of SECRET_PATTERNS) {
         pattern.lastIndex = 0;
         if (pattern.test(content)) {
@@ -2516,13 +2676,13 @@ async function runAuditSecrets(ctx) {
 }
 
 // src/cli/commands/init.ts
-import { cpSync as cpSync2, existsSync as existsSync13, mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename2, resolve as resolve18 } from "path";
-import * as p4 from "@clack/prompts";
+import { cpSync as cpSync3, existsSync as existsSync13, mkdirSync as mkdirSync5, readdirSync as readdirSync2, readFileSync as readFileSync12, writeFileSync as writeFileSync8 } from "fs";
+import { basename as basename2, resolve as resolve17 } from "path";
+import * as p5 from "@clack/prompts";
 
 // src/lib/init-router-scaffold.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync9, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
-import { resolve as resolve15 } from "path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync4, readFileSync as readFileSync10, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "fs";
+import { resolve as resolve14 } from "path";
 var ROUTER_FILES = [
   "src/routes",
   "src/routeTree.gen.ts",
@@ -2536,10 +2696,10 @@ function isModuleTemplate(template) {
   return template === "module-hybrid-cdn" || template === "module-monolith";
 }
 function writeRouterConfig(targetDir, mode) {
-  const configDir = resolve15(targetDir, "src/config");
-  mkdirSync3(configDir, { recursive: true });
-  writeFileSync3(
-    resolve15(configDir, "router.ts"),
+  const configDir = resolve14(targetDir, "src/config");
+  mkdirSync4(configDir, { recursive: true });
+  writeFileSync5(
+    resolve14(configDir, "router.ts"),
     `/** Router history \u2014 set by \`wp init\`. Hash matches woodsportal-client-frontend (HubSpot CMS embeds). */
 export type RouterHistoryMode = 'hash' | 'browser'
 
@@ -2548,8 +2708,8 @@ export const ROUTER_HISTORY: RouterHistoryMode = '${mode}'
   );
 }
 function writeMountDevPreviewRouter(targetDir) {
-  writeFileSync3(
-    resolve15(targetDir, "src/portal/mount-dev-preview.tsx"),
+  writeFileSync5(
+    resolve14(targetDir, "src/portal/mount-dev-preview.tsx"),
     `import { mountGreenfieldDev } from '../../.wphs/.kit-bootstrap-greenfield.tsx'
 
 import { App } from '@/app'
@@ -2562,8 +2722,8 @@ export async function mountDevPreview() {
   );
 }
 function writeMountDevPreviewSinglePage(targetDir) {
-  writeFileSync3(
-    resolve15(targetDir, "src/portal/mount-dev-preview.tsx"),
+  writeFileSync5(
+    resolve14(targetDir, "src/portal/mount-dev-preview.tsx"),
     `import { mountGreenfieldDev } from '../../.wphs/.kit-bootstrap-greenfield.tsx'
 
 import { StarterSinglePage } from '@/features/starter'
@@ -2576,8 +2736,8 @@ export async function mountDevPreview() {
   );
 }
 function writeMountPortalRouter(targetDir) {
-  writeFileSync3(
-    resolve15(targetDir, "src/portal/mount-portal.tsx"),
+  writeFileSync5(
+    resolve14(targetDir, "src/portal/mount-portal.tsx"),
     `import ReactDOM from 'react-dom/client'
 
 import { App } from '@/app'
@@ -2594,8 +2754,8 @@ export async function mountPortal() {
   );
 }
 function writeMountPortalSinglePage(targetDir) {
-  writeFileSync3(
-    resolve15(targetDir, "src/portal/mount-portal.tsx"),
+  writeFileSync5(
+    resolve14(targetDir, "src/portal/mount-portal.tsx"),
     `import ReactDOM from 'react-dom/client'
 
 import { StarterSinglePage } from '@/features/starter'
@@ -2612,11 +2772,11 @@ export async function mountPortal() {
   );
 }
 function writeStarterSinglePage(targetDir) {
-  const file = resolve15(targetDir, "src/features/starter/components/starter-single-page.tsx");
+  const file = resolve14(targetDir, "src/features/starter/components/starter-single-page.tsx");
   if (existsSync10(file)) {
     return;
   }
-  writeFileSync3(
+  writeFileSync5(
     file,
     `import { StarterShell } from '@/components/layout/starter-shell'
 
@@ -2639,25 +2799,25 @@ export function StarterSinglePage() {
   );
 }
 function removePath(targetDir, relativePath) {
-  const full = resolve15(targetDir, relativePath);
+  const full = resolve14(targetDir, relativePath);
   if (!existsSync10(full)) {
     return;
   }
   rmSync2(full, { recursive: true, force: true });
 }
 function stripTanStackFromPackage(targetDir) {
-  const pkgPath = resolve15(targetDir, "package.json");
+  const pkgPath = resolve14(targetDir, "package.json");
   if (!existsSync10(pkgPath)) {
     return;
   }
-  const pkg = JSON.parse(readFileSync9(pkgPath, "utf8"));
+  const pkg = JSON.parse(readFileSync10(pkgPath, "utf8"));
   if (!pkg.devDependencies) {
     return;
   }
   for (const dep of TANSTACK_DEPS) {
     delete pkg.devDependencies[dep];
   }
-  writeFileSync3(pkgPath, `${JSON.stringify(pkg, null, 2)}
+  writeFileSync5(pkgPath, `${JSON.stringify(pkg, null, 2)}
 `);
 }
 function applyRouterScaffold(targetDir, mode, template) {
@@ -2677,141 +2837,582 @@ function applyRouterScaffold(targetDir, mode, template) {
   writeRouterConfig(targetDir, mode);
   writeMountDevPreviewRouter(targetDir);
   writeMountPortalRouter(targetDir);
-  const featuresIndex = resolve15(targetDir, "src/features/starter/index.ts");
+  const featuresIndex = resolve14(targetDir, "src/features/starter/index.ts");
   if (existsSync10(featuresIndex)) {
-    let content = readFileSync9(featuresIndex, "utf8");
+    let content = readFileSync10(featuresIndex, "utf8");
     if (!content.includes("StarterSinglePage")) {
       content = content.replace(
         "export type { StarterPreviewValues } from './hooks/use-starter-preview'\n",
         "export type { StarterPreviewValues } from './hooks/use-starter-preview'\nexport { StarterSinglePage } from './components/starter-single-page'\n"
       );
-      writeFileSync3(featuresIndex, content);
+      writeFileSync5(featuresIndex, content);
     }
   }
 }
 
-// src/lib/cdn-github-setup.ts
-import { existsSync as existsSync11, readFileSync as readFileSync10, writeFileSync as writeFileSync4 } from "fs";
-import { resolve as resolve16 } from "path";
-import * as p3 from "@clack/prompts";
-var PORTAL_CDN_PUBLISH_TOKEN_ENV = "PORTAL_CDN_PUBLISH_TOKEN";
-var PORTAL_CDN_JSON = "portal.cdn.json";
-var PLACEHOLDER_GITHUB = /your-org|your-portal-cdn-mirror/i;
-function defaultPortalCdnJson() {
-  const examplePath = kitPath("templates", "shared", "portal.cdn.json.example");
-  if (existsSync11(examplePath)) {
-    return JSON.parse(readFileSync10(examplePath, "utf8"));
-  }
+// src/lib/init-auth-scaffold.ts
+import { cpSync as cpSync2, existsSync as existsSync11, readFileSync as readFileSync11, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
+import { resolve as resolve15 } from "path";
+
+// src/lib/template-auth-deps.ts
+var AUTH_SCAFFOLD_DEPS = {
+  "woodsportal-client-sdk": "^4.0.7-dev.11",
+  "@tanstack/react-query": "^5.66.9",
+  "@t3-oss/env-core": "^0.12.0",
+  zod: "^3.24.2",
+  sonner: "^2.0.1"
+};
+function mergeAuthDevDependencies(existing) {
   return {
-    publishMode: "jsdelivr",
-    github: "your-org/your-portal-cdn-mirror",
-    gitRemote: "https://github.com/your-org/your-portal-cdn-mirror.git",
-    cdnPathInRepo: "dist/cdn",
-    defaultBranch: "main"
+    ...existing,
+    ...AUTH_SCAFFOLD_DEPS
   };
 }
-function readPortalCdnJson(projectRoot) {
-  const path = resolve16(projectRoot, PORTAL_CDN_JSON);
-  if (!existsSync11(path)) return null;
-  try {
-    return JSON.parse(readFileSync10(path, "utf8"));
-  } catch {
-    return null;
+
+// src/lib/init-auth-scaffold.ts
+var AUTH_SCAFFOLD_ROOT = kitPath("templates", "scaffold", "auth");
+function readTierManifest() {
+  const path = resolve15(AUTH_SCAFFOLD_ROOT, "tier-manifest.json");
+  return JSON.parse(readFileSync11(path, "utf8"));
+}
+function readNavManifest() {
+  const path = resolve15(AUTH_SCAFFOLD_ROOT, "nav-manifest.json");
+  return JSON.parse(readFileSync11(path, "utf8"));
+}
+function layersForMode(mode) {
+  const manifest = readTierManifest();
+  const entry = manifest.tiers[mode];
+  if (!entry?.layers?.length) {
+    throw new Error(`Unknown auth scaffold tier in tier-manifest.json: ${mode}`);
   }
+  return entry.layers;
 }
-function normalizeGithubSlug(input) {
-  const trimmed = input.trim().replace(/^https:\/\/github\.com\//, "").replace(/\.git$/, "");
-  const parts = trimmed.split("/").filter(Boolean);
-  if (parts.length !== 2) return null;
-  return `${parts[0]}/${parts[1]}`;
+function copyLayer(targetDir, layerName) {
+  const layerRoot = resolve15(AUTH_SCAFFOLD_ROOT, layerName);
+  if (!existsSync11(layerRoot)) {
+    throw new Error(`Auth scaffold layer not found: ${layerName}`);
+  }
+  cpSync2(layerRoot, targetDir, { recursive: true, force: true });
 }
-function portalCdnJsonFromGithub(github, base) {
-  const slug = normalizeGithubSlug(github);
-  if (!slug) {
-    throw new Error(`Invalid GitHub repo \u2014 use org/repo (got "${github}")`);
+function layerForNavMode(nav) {
+  const manifest = readNavManifest();
+  const entry = manifest.modes[nav];
+  if (!entry?.layer) {
+    throw new Error(`Unknown nav scaffold mode in nav-manifest.json: ${nav}`);
   }
-  return {
-    publishMode: base?.publishMode ?? "jsdelivr",
-    github: slug,
-    gitRemote: `https://github.com/${slug}.git`,
-    cdnPathInRepo: base?.cdnPathInRepo ?? "dist/cdn",
-    defaultBranch: base?.defaultBranch ?? "main"
-  };
+  return entry.layer;
 }
-function hasCdnPublishToken(projectRoot) {
-  if (process.env[PORTAL_CDN_PUBLISH_TOKEN_ENV]?.trim()) return true;
-  if (process.env.GITHUB_TOKEN?.trim()) return true;
-  return Boolean(readEnvLocal(projectRoot)[PORTAL_CDN_PUBLISH_TOKEN_ENV]?.trim());
+function copyNavLayer(targetDir, nav) {
+  copyLayer(targetDir, layerForNavMode(nav));
 }
-function hasConfiguredCdnGithubMirror(projectRoot) {
-  const config = readPortalCdnJson(projectRoot);
-  const github = config?.github ?? "";
-  return Boolean(github) && !PLACEHOLDER_GITHUB.test(github);
+function patchNavScaffoldFile(targetDir, nav) {
+  const navScaffoldPath = resolve15(targetDir, "src/config/nav-scaffold.ts");
+  if (!existsSync11(navScaffoldPath)) {
+    return;
+  }
+  const content = `/** Set by wp init --nav ${nav}. */
+export const NAV_SCAFFOLD_MODE = '${nav}' as const
+
+export type NavScaffoldMode = typeof NAV_SCAFFOLD_MODE
+`;
+  writeFileSync6(navScaffoldPath, content);
 }
-function githubDefaultForPrompt(projectRoot) {
-  const existing = readPortalCdnJson(projectRoot);
-  if (existing?.github && !PLACEHOLDER_GITHUB.test(existing.github)) {
-    return existing.github;
+function patchAuthTierFile(targetDir, mode) {
+  const authTierPath = resolve15(targetDir, "src/config/auth-tier.ts");
+  if (!existsSync11(authTierPath)) {
+    return;
+  }
+  const content = `/** Set by wp init --auth ${mode}. */
+export const AUTH_SCAFFOLD_TIER = '${mode}' as const
+
+export type AuthScaffoldTier = typeof AUTH_SCAFFOLD_TIER
+`;
+  writeFileSync6(authTierPath, content);
+}
+function patchStarterOnlyBlocks(targetDir, mode) {
+  const hasSso = mode === "sso" || mode === "full";
+  const hasFull = mode === "full";
+  const filesToPatch = [
+    "src/integrations/configure-woodsportal-sdk.ts",
+    "src/features/auth/login-session-bridge.ts",
+    "src/app.tsx",
+    "src/features/auth/components/starter-login.tsx",
+    "src/portal/mount-portal.tsx",
+    "src/features/auth/auth-route-paths.ts"
+  ];
+  for (const relative of filesToPatch) {
+    const filePath = resolve15(targetDir, relative);
+    if (!existsSync11(filePath)) {
+      continue;
+    }
+    let content = readFileSync11(filePath, "utf8");
+    content = stripMarkedBlock(content, "WPHS_AUTH_SSO", hasSso);
+    content = stripMarkedBlock(content, "WPHS_AUTH_FULL", hasFull);
+    if (!hasFull && relative === "src/integrations/configure-woodsportal-sdk.ts") {
+      content = content.replace(
+        /^import \{ isMfaPendingSession \} from '@\/features\/auth\/auth-session'\n/m,
+        ""
+      );
+    }
+    writeFileSync6(filePath, content);
   }
-  return defaultPortalCdnJson().github;
 }
-function needsCdnGitHubSetup(projectRoot) {
-  return !hasConfiguredCdnGithubMirror(projectRoot) || !hasCdnPublishToken(projectRoot);
+function stripMarkedBlock(content, marker, keep) {
+  const start = `// ${marker}`;
+  const end = `// /${marker}`;
+  const pattern = new RegExp(
+    `${escapeRegExp(start)}[\\s\\S]*?${escapeRegExp(end)}\\n?`,
+    "g"
+  );
+  if (keep) {
+    return content.replace(new RegExp(`${escapeRegExp(start)}\\n?`, "g"), "").replace(new RegExp(`${escapeRegExp(end)}\\n?`, "g"), "");
+  }
+  return content.replace(pattern, "");
 }
-function applyCdnGitHubSetup(projectRoot, input) {
-  const existing = readPortalCdnJson(projectRoot) ?? defaultPortalCdnJson();
-  const updated = portalCdnJsonFromGithub(input.github, existing);
-  writeFileSync4(resolve16(projectRoot, PORTAL_CDN_JSON), `${JSON.stringify(updated, null, 2)}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var LOWER_TIER_AUTH_GUARD_FILES = [
+  "src/features/auth/login-session-bridge.ts",
+  "src/integrations/configure-woodsportal-sdk.ts",
+  "src/app.tsx",
+  "src/portal/mount-portal.tsx",
+  "src/features/auth/components/starter-login.tsx"
+];
+function assertLowerTierAuthScaffold(targetDir, mode) {
+  const violations = [];
+  for (const relative of LOWER_TIER_AUTH_GUARD_FILES) {
+    const filePath = resolve15(targetDir, relative);
+    if (!existsSync11(filePath)) {
+      continue;
+    }
+    const content = readFileSync11(filePath, "utf8");
+    if (content.includes("WPHS_AUTH_")) {
+      violations.push(`${relative}: leftover WPHS_AUTH_* strip markers`);
+    }
+    if (relative === "src/features/auth/login-session-bridge.ts") {
+      if (content.includes("mfa-pending-storage")) {
+        violations.push(`${relative}: must not import mfa-pending-storage on --auth ${mode}`);
+      }
+      if (content.includes("navigateToMfaGate")) {
+        violations.push(`${relative}: must not reference navigateToMfaGate on --auth ${mode}`);
+      }
+    }
+  }
+  if (existsSync11(resolve15(targetDir, "src/routes/_auth/two-fa.tsx"))) {
+    violations.push("src/routes/_auth/two-fa.tsx: MFA route must not exist on --auth " + mode);
+  }
+  if (violations.length > 0) {
+    throw new WpHsError(`Auth scaffold tier "${mode}" still contains full-tier artifacts:
+- ${violations.join("\n- ")}`, {
+      exitCode: ExitCode.INTERNAL,
+      remediation: "Fix strip markers in templates/scaffold/auth/_shared or report a hubspot-kit bug."
+    });
+  }
+}
+function assertFullTierAuthScaffold(targetDir) {
+  const required = [
+    "src/features/auth/mfa-pending-storage.ts",
+    "src/routes/_auth/two-fa.tsx"
+  ];
+  const missing = required.filter((relative) => !existsSync11(resolve15(targetDir, relative)));
+  if (missing.length > 0) {
+    throw new WpHsError(`Auth scaffold tier "full" is missing required files:
+- ${missing.join("\n- ")}`, {
+      exitCode: ExitCode.INTERNAL
+    });
+  }
+  const bridge = readFileSync11(resolve15(targetDir, "src/features/auth/login-session-bridge.ts"), "utf8");
+  if (bridge.includes("WPHS_AUTH_")) {
+    throw new WpHsError('Auth scaffold tier "full" left WPHS_AUTH_* markers in login-session-bridge.ts', {
+      exitCode: ExitCode.INTERNAL
+    });
+  }
+  if (!bridge.includes("navigateToMfaGate") || !bridge.includes("mfa-pending-storage")) {
+    throw new WpHsError('Auth scaffold tier "full" login-session-bridge.ts is missing MFA wiring', {
+      exitCode: ExitCode.INTERNAL
+    });
+  }
+}
+function patchPackageJson(targetDir) {
+  const pkgPath = resolve15(targetDir, "package.json");
+  if (!existsSync11(pkgPath)) {
+    return;
+  }
+  const pkg = JSON.parse(readFileSync11(pkgPath, "utf8"));
+  pkg.devDependencies = mergeAuthDevDependencies(pkg.devDependencies);
+  writeFileSync6(pkgPath, `${JSON.stringify(pkg, null, 2)}
 `);
-  if (input.token?.trim()) {
-    writeEnvLocal(projectRoot, { [PORTAL_CDN_PUBLISH_TOKEN_ENV]: input.token.trim() });
+}
+function writeAuthMountDevPreview(targetDir) {
+  writeFileSync6(
+    resolve15(targetDir, "src/portal/mount-dev-preview.tsx"),
+    `import { mountGreenfieldDev } from '../../.wphs/.kit-bootstrap-greenfield.tsx'
+
+import { App } from '@/app'
+import { getPortalRouter, mountPortal } from '@/portal/mount-portal'
+
+/** Local dev: module-config overlay + auth-aware App shell. */
+export async function mountDevPreview() {
+  await mountGreenfieldDev({
+    beforePreview: () => mountPortal({ skipAppRender: true }),
+    preview: <App router={getPortalRouter()} />,
+  })
+}
+`
+  );
+}
+function validateAuthRouterCombo(auth, router) {
+  if (auth === "none") {
+    return;
+  }
+  if (router === "none") {
+    throw new Error(
+      "Portal auth scaffold requires client-side routing. Use --router hash or --router browser."
+    );
   }
-  ensureEnvFilesGitignore(projectRoot);
 }
-async function promptCdnGitHubSetup(options = {}) {
-  if (options.skip) return null;
-  const projectRoot = options.projectRoot ?? process.cwd();
-  if (!needsCdnGitHubSetup(projectRoot)) {
-    return null;
+function validateNavAuthCombo(auth, nav) {
+  if (!nav || nav === "top") {
+    return;
   }
-  let github = options.github?.trim();
-  if (!github && hasConfiguredCdnGithubMirror(projectRoot)) {
-    github = readPortalCdnJson(projectRoot)?.github;
+  if (auth === "none") {
+    throw new Error(
+      "Portal navigation shell requires auth scaffold. Use --auth starter|sso|full or omit --nav."
+    );
   }
-  if (!github) {
-    const answer = await p3.text({
-      message: "Public GitHub CDN mirror (org/repo)",
-      placeholder: options.githubDefault ?? "your-org/your-portal-cdn-mirror",
-      initialValue: options.githubDefault,
-      validate: (value) => {
-        const slug = normalizeGithubSlug(value ?? "");
-        return slug ? void 0 : "Enter a public repo as org/repo (jsDelivr serves from it)";
+}
+function assertNavScaffold(targetDir, nav) {
+  const mainLayoutPath = resolve15(targetDir, "src/components/Layouts/MainLayout.tsx");
+  if (!existsSync11(mainLayoutPath)) {
+    throw new WpHsError("Auth scaffold is missing MainLayout.tsx after nav layer copy", {
+      exitCode: ExitCode.INTERNAL
+    });
+  }
+  const sidebarPath = resolve15(targetDir, "src/components/layout/portal-sidebar.tsx");
+  if (nav === "sidebar") {
+    if (!existsSync11(sidebarPath)) {
+      throw new WpHsError('Nav scaffold mode "sidebar" is missing portal-sidebar.tsx', {
+        exitCode: ExitCode.INTERNAL
+      });
+    }
+  } else if (existsSync11(sidebarPath)) {
+    throw new WpHsError('Nav scaffold mode "top" must not include portal-sidebar.tsx', {
+      exitCode: ExitCode.INTERNAL
+    });
+  }
+  const navScaffold = readFileSync11(resolve15(targetDir, "src/config/nav-scaffold.ts"), "utf8");
+  if (!navScaffold.includes(`'${nav}'`)) {
+    throw new WpHsError(`nav-scaffold.ts was not patched for mode "${nav}"`, {
+      exitCode: ExitCode.INTERNAL
+    });
+  }
+}
+function applyAuthScaffold(targetDir, mode, routerMode, template, nav = "top") {
+  if (mode === "none" || !isModuleTemplate(template)) {
+    return;
+  }
+  validateAuthRouterCombo(mode, routerMode);
+  validateNavAuthCombo(mode, nav);
+  for (const layer of layersForMode(mode)) {
+    copyLayer(targetDir, layer);
+  }
+  patchAuthTierFile(targetDir, mode);
+  patchStarterOnlyBlocks(targetDir, mode);
+  patchNavScaffoldFile(targetDir, nav);
+  copyNavLayer(targetDir, nav);
+  assertNavScaffold(targetDir, nav);
+  if (mode === "starter" || mode === "sso") {
+    assertLowerTierAuthScaffold(targetDir, mode);
+  } else if (mode === "full") {
+    assertFullTierAuthScaffold(targetDir);
+  }
+  patchPackageJson(targetDir);
+  if (routerMode && routerMode !== "none") {
+    writeAuthMountDevPreview(targetDir);
+  }
+}
+var AUTH_TIER_ORDER = ["none", "starter", "sso", "full"];
+function authTierRank(tier) {
+  return AUTH_TIER_ORDER.indexOf(tier);
+}
+function readCurrentAuthTier(targetDir) {
+  const authTierPath = resolve15(targetDir, "src/config/auth-tier.ts");
+  if (!existsSync11(authTierPath)) {
+    return "none";
+  }
+  const content = readFileSync11(authTierPath, "utf8");
+  const match = content.match(/AUTH_SCAFFOLD_TIER = '(starter|sso|full)'/);
+  return match?.[1] ?? "none";
+}
+function applyAuthTierUpgrade(targetDir, targetTier, routerMode, template, nav = "top") {
+  if (!isModuleTemplate(template)) {
+    throw new WpHsError("Auth upgrade is only supported for module projects.", {
+      exitCode: ExitCode.USER_ERROR
+    });
+  }
+  validateAuthRouterCombo(targetTier, routerMode);
+  const currentTier = readCurrentAuthTier(targetDir);
+  if (currentTier === "none") {
+    applyAuthScaffold(targetDir, targetTier, routerMode, template, nav);
+    return targetTier;
+  }
+  if (authTierRank(targetTier) <= authTierRank(currentTier)) {
+    throw new WpHsError(
+      `Auth upgrade requires a higher tier than "${currentTier}" (requested "${targetTier}").`,
+      {
+        exitCode: ExitCode.USER_ERROR,
+        remediation: "Use starter \u2192 sso \u2192 full. Re-init for downgrades."
+      }
+    );
+  }
+  const targetLayers = layersForMode(targetTier);
+  const currentLayers = layersForMode(currentTier);
+  const layersToCopy = targetLayers.filter((layer) => !currentLayers.includes(layer));
+  for (const layer of layersToCopy) {
+    copyLayer(targetDir, layer);
+  }
+  patchAuthTierFile(targetDir, targetTier);
+  patchStarterOnlyBlocks(targetDir, targetTier);
+  if (targetTier === "starter" || targetTier === "sso") {
+    assertLowerTierAuthScaffold(targetDir, targetTier);
+  } else {
+    assertFullTierAuthScaffold(targetDir);
+  }
+  patchPackageJson(targetDir);
+  if (routerMode && routerMode !== "none") {
+    writeAuthMountDevPreview(targetDir);
+  }
+  return targetTier;
+}
+var SIDEBAR_NAV_FILES = [
+  "src/components/layout/portal-sidebar.tsx",
+  "src/components/layout/portal-sidebar-nav.tsx"
+];
+function applyNavScaffoldUpgrade(targetDir, nav) {
+  const authTierPath = resolve15(targetDir, "src/config/auth-tier.ts");
+  if (!existsSync11(authTierPath)) {
+    throw new WpHsError("Nav scaffold requires portal auth (missing src/config/auth-tier.ts).", {
+      exitCode: ExitCode.USER_ERROR,
+      remediation: "Run wp scaffold auth upgrade --tier starter first."
+    });
+  }
+  if (nav === "top") {
+    for (const relative of SIDEBAR_NAV_FILES) {
+      const filePath = resolve15(targetDir, relative);
+      if (existsSync11(filePath)) {
+        rmSync3(filePath);
+      }
+    }
+  }
+  patchNavScaffoldFile(targetDir, nav);
+  copyNavLayer(targetDir, nav);
+  assertNavScaffold(targetDir, nav);
+}
+function readProjectAuthTier(targetDir) {
+  return readCurrentAuthTier(targetDir);
+}
+
+// src/lib/init-wizard.ts
+import * as p4 from "@clack/prompts";
+
+// src/lib/project-name.ts
+var PROJECT_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
+function normalizeProjectName(input) {
+  return input.trim().toLowerCase().replace(/[\s_]+/g, "-").replace(/[^a-z0-9-]/g, "").replace(/-+/g, "-").replace(/^-+|-+$/g, "");
+}
+function validateProjectName(name) {
+  if (!name) return "Project name is required";
+  if (!PROJECT_NAME_PATTERN.test(name)) {
+    return "Use lowercase letters, numbers, and hyphens (e.g. my-portal-module)";
+  }
+  if (name.length > 64) return "Project name is too long (max 64 characters)";
+  return void 0;
+}
+function moduleOutDirFromSlug(slug) {
+  const pascal = slug.split("-").filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");
+  return `dist/${pascal || "HubSpot"}.Module`;
+}
+
+// src/lib/init-wizard.ts
+function cancelIfNeeded(value) {
+  if (p4.isCancel(value)) {
+    throw new WpHsError("Init cancelled", { exitCode: ExitCode.USER_ERROR });
+  }
+  return value;
+}
+async function runInitWizard(options) {
+  let template = options.template;
+  if (!template) {
+    const type = cancelIfNeeded(
+      await p4.select({
+        message: "Project type",
+        options: [
+          {
+            value: "module-hybrid-cdn",
+            label: "Module (hybrid CDN)",
+            hint: "jsDelivr + thin module.js"
+          },
+          {
+            value: "module-monolith",
+            label: "Module (monolith)",
+            hint: "Single module.js IIFE"
+          },
+          {
+            value: "theme-starter",
+            label: "Theme starter",
+            hint: "CMS theme templates"
+          }
+        ]
+      })
+    );
+    template = type;
+  }
+  let projectName = options.name ? normalizeProjectName(options.name) : void 0;
+  if (!options.directory && !projectName) {
+    const nameAnswer = cancelIfNeeded(
+      await p4.text({
+        message: "Project name (folder name)",
+        placeholder: "my-portal-module",
+        validate: (value) => validateProjectName(normalizeProjectName(value ?? ""))
+      })
+    );
+    projectName = normalizeProjectName(nameAnswer);
+  }
+  if (!projectName && options.directory) {
+    projectName = normalizeProjectName(options.directory.split("/").pop() ?? "my-portal");
+  }
+  if (!projectName) {
+    throw new WpHsError("Project name is required", {
+      exitCode: ExitCode.USER_ERROR,
+      remediation: "Pass --name or --directory."
+    });
+  }
+  let router = options.router;
+  if (!router && isModuleTemplate(template)) {
+    const routerAnswer = cancelIfNeeded(
+      await p4.select({
+        message: "Client-side routing",
+        initialValue: "hash",
+        options: [
+          {
+            value: "hash",
+            label: "Hash history (recommended)",
+            hint: "Works in HubSpot CMS embeds"
+          },
+          {
+            value: "browser",
+            label: "Browser history",
+            hint: "Clean URLs for local dev only"
+          },
+          {
+            value: "none",
+            label: "No router",
+            hint: "Single-page starter"
+          }
+        ]
+      })
+    );
+    router = routerAnswer;
+  }
+  let auth = options.auth ?? "none";
+  if (!options.auth && isModuleTemplate(template) && router && router !== "none") {
+    const authAnswer = cancelIfNeeded(
+      await p4.select({
+        message: "Portal auth (woodsportal-api + SDK)",
+        initialValue: "none",
+        options: [
+          { value: "none", label: "No portal login", hint: "Routes only" },
+          { value: "starter", label: "Email + password", hint: "Login + sample protected page" },
+          { value: "sso", label: "Email + password + SSO", hint: "OAuth callback route" },
+          {
+            value: "full",
+            label: "Email + password + SSO + MFA",
+            hint: "Recommended for production portals"
+          }
+        ]
+      })
+    );
+    auth = authAnswer;
+  } else if (router === "none" && isModuleTemplate(template)) {
+    p4.log.info("Portal auth requires routing \u2014 auth tier set to none.");
+    auth = "none";
+  }
+  let nav = options.nav ?? "top";
+  if (!options.nav && auth !== "none" && isModuleTemplate(template)) {
+    const navAnswer = cancelIfNeeded(
+      await p4.select({
+        message: "Portal navigation shell",
+        initialValue: "top",
+        options: [
+          {
+            value: "top",
+            label: "Top navigation (recommended)",
+            hint: "Simple header links"
+          },
+          {
+            value: "sidebar",
+            label: "Sidebar navigation",
+            hint: "Collapsible left menu (production-shaped)"
+          }
+        ]
+      })
+    );
+    nav = navAnswer;
+  } else if (auth === "none") {
+    nav = "top";
+  }
+  let cdnSetup = null;
+  if (template === "module-hybrid-cdn") {
+    if (options.cdnGithub) {
+      cdnSetup = { github: options.cdnGithub };
+    } else {
+      p4.log.step("Hybrid CDN \u2014 GitHub mirror (public repo for jsDelivr)");
+      const prompted = await promptCdnGitHubSetup({
+        projectRoot: options.cwd,
+        githubDefault: githubDefaultForPrompt(options.cwd),
+        github: options.cdnGithub
+      });
+      if (prompted) {
+        cdnSetup = prompted;
       }
-    });
-    if (p3.isCancel(answer)) return null;
-    github = normalizeGithubSlug(answer) ?? void 0;
+    }
   }
-  if (!github) return null;
-  if (hasCdnPublishToken(projectRoot)) {
-    return { github };
+  const folder = options.directory ?? `${options.cwd}/${projectName}`;
+  const summary = [
+    `Template:  ${template}`,
+    `Folder:    ${folder}`,
+    ...isModuleTemplate(template) ? [
+      `Router:    ${router ?? "hash"}`,
+      `Auth:      ${auth}`,
+      ...auth !== "none" ? [`Nav:       ${nav}`] : []
+    ] : [],
+    ...template === "module-hybrid-cdn" ? [`CDN repo:  ${cdnSetup?.github ?? "(skipped \u2014 configure later)"}`] : []
+  ].join("\n");
+  p4.note(summary, "Scaffold summary");
+  const confirmed = cancelIfNeeded(
+    await p4.confirm({
+      message: "Proceed with scaffold?",
+      initialValue: true
+    })
+  );
+  if (!confirmed) {
+    throw new WpHsError("Init cancelled", { exitCode: ExitCode.USER_ERROR });
   }
-  const tokenAnswer = await p3.password({
-    message: "GitHub token (repo push on CDN mirror)",
-    validate: (value) => {
-      if (!value?.trim()) return "Required for wp publish \u2014 create a fine-grained PAT with Contents: Read and write";
-      return void 0;
-    }
-  });
-  if (p3.isCancel(tokenAnswer)) return null;
-  return { github, token: tokenAnswer.trim() };
-}
-function formatCdnSetupNote(_projectRoot) {
-  return `CDN config written \u2014 edit ${PORTAL_CDN_JSON} if needed; token saved to ${ENV_LOCAL_FILE} (gitignored)`;
+  return {
+    template,
+    projectName,
+    router,
+    auth,
+    nav,
+    cdnSetup,
+    confirmed: true
+  };
 }
 
 // src/lib/project-setup.ts
-import { copyFileSync, existsSync as existsSync12, writeFileSync as writeFileSync5 } from "fs";
-import { basename, resolve as resolve17 } from "path";
+import { copyFileSync, existsSync as existsSync12, writeFileSync as writeFileSync7 } from "fs";
+import { basename, resolve as resolve16 } from "path";
 function envFileForTier2(tier) {
   return tier === "dev" ? ".env.dev" : tier === "stg" ? ".env.stg" : ".env.prod";
 }
@@ -2826,7 +3427,7 @@ function firstExisting(paths) {
   return null;
 }
 function copyMissingFile(projectRoot, targetName, sourceCandidates, dryRun) {
-  const target = resolve17(projectRoot, targetName);
+  const target = resolve16(projectRoot, targetName);
   if (existsSync12(target)) {
     return { action: "skipped", path: targetName, detail: "already present" };
   }
@@ -2849,12 +3450,12 @@ function copyMissingFile(projectRoot, targetName, sourceCandidates, dryRun) {
   };
 }
 function writeMissingFile(projectRoot, targetName, content, dryRun) {
-  const target = resolve17(projectRoot, targetName);
+  const target = resolve16(projectRoot, targetName);
   if (existsSync12(target)) {
     return { action: "skipped", path: targetName, detail: "already present" };
   }
   if (!dryRun) {
-    writeFileSync5(target, content);
+    writeFileSync7(target, content);
   }
   return {
     action: "copied",
@@ -2880,15 +3481,15 @@ function applyProjectSetup(ctx, options = {}) {
   const templateDir = kitTemplateDir(config);
   results.push(
     copyMissingFile(projectRoot, HUBSPOT_CONFIG_FILE, [
-      resolve17(projectRoot, HUBSPOT_CONFIG_EXAMPLE),
-      resolve17(templateDir, HUBSPOT_CONFIG_EXAMPLE),
+      resolve16(projectRoot, HUBSPOT_CONFIG_EXAMPLE),
+      resolve16(templateDir, HUBSPOT_CONFIG_EXAMPLE),
       kitPath("templates", HUBSPOT_CONFIG_EXAMPLE)
     ], dryRun)
   );
   results.push(
     copyMissingFile(projectRoot, ".env.local", [
-      resolve17(projectRoot, ".env.local.example"),
-      resolve17(sharedDir, ".env.local.example")
+      resolve16(projectRoot, ".env.local.example"),
+      resolve16(sharedDir, ".env.local.example")
     ], dryRun)
   );
   for (const tier of tiersToSetup(config, options.tier)) {
@@ -2896,8 +3497,8 @@ function applyProjectSetup(ctx, options = {}) {
     const envExample = `${envFile}.example`;
     results.push(
       copyMissingFile(projectRoot, envFile, [
-        resolve17(projectRoot, envExample),
-        resolve17(sharedDir, envExample)
+        resolve16(projectRoot, envExample),
+        resolve16(sharedDir, envExample)
       ], dryRun)
     );
   }
@@ -2905,8 +3506,8 @@ function applyProjectSetup(ctx, options = {}) {
     const mirror = config.cdn.mirror;
     results.push(
       copyMissingFile(projectRoot, mirror, [
-        resolve17(projectRoot, `${mirror}.example`),
-        resolve17(sharedDir, "portal.cdn.json.example")
+        resolve16(projectRoot, `${mirror}.example`),
+        resolve16(sharedDir, "portal.cdn.json.example")
       ], dryRun)
     );
     const buildIdFile = config.cdn.buildIdFile;
@@ -2921,14 +3522,14 @@ function applyProjectSetup(ctx, options = {}) {
   }
   for (const file of templateViteFiles(config)) {
     results.push(
-      copyMissingFile(projectRoot, file, [resolve17(templateDir, file)], dryRun)
+      copyMissingFile(projectRoot, file, [resolve16(templateDir, file)], dryRun)
     );
   }
   if (isModuleProject(config) && !isThemeProject(config)) {
     const adapter = config.dev.adapter;
-    const adapterPath = resolve17(projectRoot, adapter);
+    const adapterPath = resolve16(projectRoot, adapter);
     if (!existsSync12(adapterPath)) {
-      const templateAdapter = resolve17(templateDir, "wphs.adapter.ts");
+      const templateAdapter = resolve16(templateDir, "wphs.adapter.ts");
       if (existsSync12(templateAdapter)) {
         results.push(copyMissingFile(projectRoot, adapter, [templateAdapter], dryRun));
       } else {
@@ -2954,19 +3555,19 @@ function copySharedSetupExamples(targetDir) {
     ".env.prod.example",
     "portal.cdn.json.example"
   ]) {
-    const src = resolve17(sharedDir, name);
-    const dest = resolve17(targetDir, name);
+    const src = resolve16(sharedDir, name);
+    const dest = resolve16(targetDir, name);
     if (existsSync12(src) && !existsSync12(dest)) {
       copyFileSync(src, dest);
     }
   }
   const hubspotExample = firstExisting([
-    resolve17(sharedDir, HUBSPOT_CONFIG_EXAMPLE),
+    resolve16(sharedDir, HUBSPOT_CONFIG_EXAMPLE),
     kitPath("templates", HUBSPOT_CONFIG_EXAMPLE)
   ]);
   if (!hubspotExample) return;
-  const destHubspot = resolve17(targetDir, HUBSPOT_CONFIG_EXAMPLE);
-  if (!existsSync12(destHubspot) && !existsSync12(resolve17(targetDir, HUBSPOT_CONFIG_FILE))) {
+  const destHubspot = resolve16(targetDir, HUBSPOT_CONFIG_EXAMPLE);
+  if (!existsSync12(destHubspot) && !existsSync12(resolve16(targetDir, HUBSPOT_CONFIG_FILE))) {
     copyFileSync(hubspotExample, destHubspot);
   }
 }
@@ -3014,26 +3615,8 @@ var TEMPLATE_SCRIPTS = {
   }
 };
 
-// src/lib/project-name.ts
-var PROJECT_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
-function normalizeProjectName(input) {
-  return input.trim().toLowerCase().replace(/[\s_]+/g, "-").replace(/[^a-z0-9-]/g, "").replace(/-+/g, "-").replace(/^-+|-+$/g, "");
-}
-function validateProjectName(name) {
-  if (!name) return "Project name is required";
-  if (!PROJECT_NAME_PATTERN.test(name)) {
-    return "Use lowercase letters, numbers, and hyphens (e.g. my-portal-module)";
-  }
-  if (name.length > 64) return "Project name is too long (max 64 characters)";
-  return void 0;
-}
-function moduleOutDirFromSlug(slug) {
-  const pascal = slug.split("-").filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");
-  return `dist/${pascal || "HubSpot"}.Module`;
-}
-
 // src/cli/commands/init.ts
-function buildConfigForProject(template, projectName, router) {
+function buildConfigForProject(template, projectName, router, auth = "none", nav = "top") {
   const base = { ...DEFAULT_WOODSPORTAL_HS, projectType: template };
   if (template === "theme-starter") {
     return {
@@ -3058,8 +3641,12 @@ function buildConfigForProject(template, projectName, router) {
       mode: template === "module-monolith" ? "none" : base.cdn.mode
     }
   };
-  if (isModuleTemplate(template) && router) {
-    config.scaffold = { router };
+  if (isModuleTemplate(template)) {
+    config.scaffold = {
+      router: router ?? "hash",
+      auth: auth ?? "none",
+      ...auth !== "none" ? { nav: nav ?? "top" } : {}
+    };
   }
   return config;
 }
@@ -3075,7 +3662,7 @@ function assertTargetDirIsScaffoldable(targetDir) {
 }
 function resolveInitTargetDir(options, interactiveName) {
   if (options.directory) {
-    return resolve18(options.directory);
+    return resolve17(options.directory);
   }
   const parentDir = process.cwd();
   const slug = options.name ?? interactiveName;
@@ -3089,67 +3676,31 @@ function resolveInitTargetDir(options, interactiveName) {
   if (error) {
     throw new WpHsError(error, { exitCode: ExitCode.USER_ERROR });
   }
-  return resolve18(parentDir, slug);
+  return resolve17(parentDir, slug);
 }
 async function runInit(ctx, options) {
   const nonInteractive = ctx.global.ci || ctx.global.yes || ctx.global.json;
   let template = options.template;
   let projectName = options.name ? normalizeProjectName(options.name) : void 0;
   let router = options.router;
+  let auth = options.auth ?? "none";
+  let nav = options.nav ?? "top";
+  let cdnGithub = options.cdnGithub;
+  let wizardCdnSetup = null;
   if (!nonInteractive) {
-    if (!template) {
-      const type = await p4.select({
-        message: "Project type",
-        options: [
-          {
-            value: "module-hybrid-cdn",
-            label: "Module (hybrid CDN)",
-            hint: "jsDelivr + thin module.js"
-          },
-          { value: "module-monolith", label: "Module (monolith)", hint: "Single module.js IIFE" },
-          { value: "theme-starter", label: "Theme starter", hint: "CMS theme templates" }
-        ]
-      });
-      if (p4.isCancel(type)) throw new WpHsError("Init cancelled", { exitCode: ExitCode.USER_ERROR });
-      template = type;
-    }
-    if (!options.directory && !projectName) {
-      const nameAnswer = await p4.text({
-        message: "Project name (folder name)",
-        placeholder: "my-portal-module",
-        validate: (value) => validateProjectName(normalizeProjectName(value ?? ""))
-      });
-      if (p4.isCancel(nameAnswer)) {
-        throw new WpHsError("Init cancelled", { exitCode: ExitCode.USER_ERROR });
-      }
-      projectName = normalizeProjectName(nameAnswer);
-    }
-    if (!router && template && isModuleTemplate(template)) {
-      const routerAnswer = await p4.select({
-        message: "Client-side routing",
-        initialValue: "hash",
-        options: [
-          {
-            value: "hash",
-            label: "Hash history (recommended)",
-            hint: "Same as woodsportal-client-frontend \u2014 works in HubSpot CMS embeds"
-          },
-          {
-            value: "browser",
-            label: "Browser history",
-            hint: "Clean /guide URLs for local dev (not for HubSpot iframe embeds)"
-          },
-          {
-            value: "none",
-            label: "No router",
-            hint: "Single-page starter \u2014 add TanStack Router later"
-          }
-        ]
-      });
-      if (p4.isCancel(routerAnswer)) {
-        throw new WpHsError("Init cancelled", { exitCode: ExitCode.USER_ERROR });
-      }
-      router = routerAnswer;
+    const wizard = await runInitWizard({
+      ...options,
+      cwd: process.cwd(),
+      auth: options.auth
+    });
+    template = wizard.template;
+    projectName = wizard.projectName;
+    router = wizard.router;
+    auth = wizard.auth;
+    nav = wizard.nav ?? "top";
+    wizardCdnSetup = wizard.cdnSetup;
+    if (wizard.cdnSetup?.github) {
+      cdnGithub = wizard.cdnSetup.github;
     }
   }
   if (!template) {
@@ -3158,6 +3709,19 @@ async function runInit(ctx, options) {
   if (!router && isModuleTemplate(template)) {
     router = "hash";
   }
+  if (!options.auth && nonInteractive && isModuleTemplate(template)) {
+    auth = "none";
+  }
+  try {
+    validateAuthRouterCombo(auth, router);
+    validateNavAuthCombo(auth, nav);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new WpHsError(message, {
+      exitCode: ExitCode.USER_ERROR,
+      remediation: "Use --router hash or --router browser with --auth starter|sso|full. Nav shell (--nav sidebar) requires auth."
+    });
+  }
   const targetDir = resolveInitTargetDir(options, projectName);
   const slug = projectName ?? basename2(targetDir);
   assertTargetDirIsScaffoldable(targetDir);
@@ -3166,36 +3730,37 @@ async function runInit(ctx, options) {
     throw new WpHsError(`Template not found: ${template}`, { exitCode: ExitCode.USER_ERROR });
   }
   if (ctx.global.dryRun) {
-    ctx.logger.info(`[dry-run] Would scaffold ${template} in ${targetDir}`);
+    ctx.logger.info(
+      `[dry-run] Would scaffold ${template} in ${targetDir} (router=${router ?? "n/a"}, auth=${auth}, nav=${auth !== "none" ? nav : "n/a"})`
+    );
     return ExitCode.SUCCESS;
   }
-  mkdirSync4(targetDir, { recursive: true });
-  cpSync2(templateDir, targetDir, { recursive: true });
+  mkdirSync5(targetDir, { recursive: true });
+  cpSync3(templateDir, targetDir, { recursive: true });
   copySharedSetupExamples(targetDir);
-  const config = buildConfigForProject(template, slug, router);
-  writeFileSync6(resolve18(targetDir, WOODSCLI_CONFIG_FILE), `${JSON.stringify(config, null, 2)}
+  const config = buildConfigForProject(template, slug, router, auth, nav);
+  writeFileSync8(resolve17(targetDir, WOODSCLI_CONFIG_FILE), `${JSON.stringify(config, null, 2)}
 `);
-  const pkgPath = resolve18(targetDir, "package.json");
+  const pkgPath = resolve17(targetDir, "package.json");
   if (existsSync13(pkgPath)) {
-    const pkg = JSON.parse(readFileSync11(pkgPath, "utf8"));
+    const pkg = JSON.parse(readFileSync12(pkgPath, "utf8"));
     pkg.name = slug;
     pkg.scripts = { ...pkg.scripts, ...TEMPLATE_SCRIPTS[template] };
     pkg.devDependencies = {
       ...pkg.devDependencies,
       ...templateDevDependencies()
     };
-    writeFileSync6(pkgPath, `${JSON.stringify(pkg, null, 2)}
+    writeFileSync8(pkgPath, `${JSON.stringify(pkg, null, 2)}
 `);
   }
   if (router && isModuleTemplate(template)) {
     applyRouterScaffold(targetDir, router, template);
   }
-  runNodeScript(kitPath("scripts/ensure-wphs-workspace.mjs"), [], {
-    cwd: targetDir,
-    logger: ctx.logger,
-    dryRun: false
-  });
-  const gitignorePath = resolve18(targetDir, ".gitignore");
+  if (isModuleTemplate(template)) {
+    applyAuthScaffold(targetDir, auth, router, template, nav);
+  }
+  await ensureProjectWphsWorkspace(targetDir);
+  const gitignorePath = resolve17(targetDir, ".gitignore");
   const gitignoreExtras = [
     "hubspot.config.yml",
     ".wphs/config/module-config.local.json",
@@ -3208,40 +3773,27 @@ async function runInit(ctx, options) {
     ".wphs/.kit-bootstrap.tsx",
     ".wphs/.kit-bootstrap-greenfield.tsx"
   ];
-  const existing = existsSync13(gitignorePath) ? readFileSync11(gitignorePath, "utf8") : "";
+  const existing = existsSync13(gitignorePath) ? readFileSync12(gitignorePath, "utf8") : "";
   const toAppend = gitignoreExtras.filter((line) => !existing.includes(line)).join("\n");
   if (toAppend) {
-    writeFileSync6(gitignorePath, `${existing.trimEnd()}
+    writeFileSync8(gitignorePath, `${existing.trimEnd()}
 ${toAppend}
 `);
   }
-  if (template === "module-hybrid-cdn" && !ctx.global.dryRun && needsCdnGitHubSetup(targetDir)) {
-    const githubDefault = githubDefaultForPrompt(targetDir);
-    let cdnSetup = null;
-    if (nonInteractive) {
-      if (options.cdnGithub) {
-        cdnSetup = { github: options.cdnGithub };
-      }
-    } else {
-      p4.log.step("Hybrid CDN \u2014 GitHub mirror (public repo for jsDelivr)");
-      cdnSetup = await promptCdnGitHubSetup({
-        projectRoot: targetDir,
-        githubDefault,
-        github: options.cdnGithub
-      });
-    }
-    if (cdnSetup) {
-      applyCdnGitHubSetup(targetDir, cdnSetup);
+  if (template === "module-hybrid-cdn" && !ctx.global.dryRun) {
+    const setup = wizardCdnSetup ?? (cdnGithub ? { github: cdnGithub } : null);
+    if (setup) {
+      applyCdnGitHubSetup(targetDir, setup);
       if (!nonInteractive) {
-        p4.log.success(formatCdnSetupNote(targetDir));
+        p5.log.success(formatCdnSetupNote(targetDir));
       } else {
         ctx.logger.success(formatCdnSetupNote(targetDir));
       }
     }
   }
   if (!nonInteractive) {
-    p4.log.success(`Scaffolded ${template} in ${targetDir}`);
-    p4.note(`cd ${slug} && yarn install && wp setup && wp doctor && wp dev`, "Getting started");
+    p5.log.success(`Scaffolded ${template} in ${targetDir}`);
+    p5.note(`cd ${slug} && yarn install && wp setup && wp doctor && wp dev`, "Getting started");
   } else {
     ctx.logger.success(`Scaffolded ${template} in ${targetDir}`);
   }
@@ -3249,15 +3801,15 @@ ${toAppend}
 }
 
 // src/cli/commands/migrate.ts
-import { cpSync as cpSync3, existsSync as existsSync14, mkdirSync as mkdirSync5, readFileSync as readFileSync12, readdirSync as readdirSync3, renameSync, rmSync as rmSync3, writeFileSync as writeFileSync7 } from "fs";
-import { join as join3, resolve as resolve19 } from "path";
+import { cpSync as cpSync4, existsSync as existsSync14, mkdirSync as mkdirSync6, readFileSync as readFileSync13, readdirSync as readdirSync3, renameSync, rmSync as rmSync4, writeFileSync as writeFileSync9 } from "fs";
+import { join as join4, resolve as resolve18 } from "path";
 var LEGACY_DIRS = [".dev", ".woodsportal"];
 var LEGACY_BASELINE = ".wp-hs-baseline";
 var LEGACY_BUILD_ID_FILE = ".portal-build-id";
 var MODULE_BUILD_ID_FILE = ".module-build-id";
 function readFirstNonCommentLine(filePath) {
   if (!existsSync14(filePath)) return void 0;
-  const line = readFileSync12(filePath, "utf8").split("\n").map((l) => l.trim()).find((l) => l.length > 0 && !l.startsWith("#"));
+  const line = readFileSync13(filePath, "utf8").split("\n").map((l) => l.trim()).find((l) => l.length > 0 && !l.startsWith("#"));
   return line || void 0;
 }
 function stripToBaseline(raw) {
@@ -3271,71 +3823,71 @@ function stripToBaseline(raw) {
 }
 async function runMigrate(ctx, _options = {}) {
   const root = ctx.projectRoot;
-  const wphsRoot = resolve19(root, WPHS_WORKSPACE_DIR);
+  const wphsRoot = resolve18(root, WPHS_WORKSPACE_DIR);
   const actions = [];
   for (const legacy of LEGACY_DIRS) {
-    const legacyPath = resolve19(root, legacy);
+    const legacyPath = resolve18(root, legacy);
     if (!existsSync14(legacyPath)) continue;
     actions.push(`Move ${legacy}/ \u2192 .wphs/`);
     if (ctx.global.dryRun) continue;
-    mkdirSync5(join3(wphsRoot, "config"), { recursive: true });
-    mkdirSync5(join3(wphsRoot, "assets", "branding"), { recursive: true });
-    const localConfig = join3(legacyPath, "module-config.local.json");
-    const exampleConfig = join3(legacyPath, "module-config.example.json");
+    mkdirSync6(join4(wphsRoot, "config"), { recursive: true });
+    mkdirSync6(join4(wphsRoot, "assets", "branding"), { recursive: true });
+    const localConfig = join4(legacyPath, "module-config.local.json");
+    const exampleConfig = join4(legacyPath, "module-config.example.json");
     if (existsSync14(localConfig)) {
-      cpSync3(localConfig, join3(wphsRoot, "config", "module-config.local.json"));
+      cpSync4(localConfig, join4(wphsRoot, "config", "module-config.local.json"));
     }
     if (existsSync14(exampleConfig)) {
-      cpSync3(exampleConfig, join3(wphsRoot, "config", "module-config.example.json"));
+      cpSync4(exampleConfig, join4(wphsRoot, "config", "module-config.example.json"));
     }
-    const branding = join3(legacyPath, "branding-assets");
+    const branding = join4(legacyPath, "branding-assets");
     if (existsSync14(branding)) {
       for (const file of readdirSync3(branding)) {
-        cpSync3(join3(branding, file), join3(wphsRoot, "assets", "branding", file));
+        cpSync4(join4(branding, file), join4(wphsRoot, "assets", "branding", file));
       }
     }
-    rmSync3(legacyPath, { recursive: true, force: true });
+    rmSync4(legacyPath, { recursive: true, force: true });
   }
-  const legacyBaseline = resolve19(root, LEGACY_BASELINE);
-  const targetBaseline = join3(wphsRoot, "audit", "baseline");
+  const legacyBaseline = resolve18(root, LEGACY_BASELINE);
+  const targetBaseline = join4(wphsRoot, "audit", "baseline");
   if (existsSync14(legacyBaseline)) {
     actions.push(`Move ${LEGACY_BASELINE}/ \u2192 .wphs/audit/baseline/`);
     if (!ctx.global.dryRun) {
-      mkdirSync5(targetBaseline, { recursive: true });
-      cpSync3(legacyBaseline, targetBaseline, { recursive: true });
-      rmSync3(legacyBaseline, { recursive: true, force: true });
+      mkdirSync6(targetBaseline, { recursive: true });
+      cpSync4(legacyBaseline, targetBaseline, { recursive: true });
+      rmSync4(legacyBaseline, { recursive: true, force: true });
     }
   }
-  const legacyConfigPath2 = resolve19(root, LEGACY_WOODSPORTAL_HS_FILE);
-  const woodscliPath = resolve19(root, WOODSCLI_CONFIG_FILE);
-  if (existsSync14(legacyConfigPath2) && !existsSync14(woodscliPath)) {
+  const legacyConfigPath = resolve18(root, LEGACY_WOODSPORTAL_HS_FILE);
+  const woodscliPath = resolve18(root, WOODSCLI_CONFIG_FILE);
+  if (existsSync14(legacyConfigPath) && !existsSync14(woodscliPath)) {
     actions.push(`Rename ${LEGACY_WOODSPORTAL_HS_FILE} \u2192 ${WOODSCLI_CONFIG_FILE}`);
     if (!ctx.global.dryRun) {
-      renameSync(legacyConfigPath2, woodscliPath);
+      renameSync(legacyConfigPath, woodscliPath);
     }
-  } else if (existsSync14(legacyConfigPath2) && existsSync14(woodscliPath)) {
+  } else if (existsSync14(legacyConfigPath) && existsSync14(woodscliPath)) {
     actions.push(`Remove duplicate ${LEGACY_WOODSPORTAL_HS_FILE}`);
     if (!ctx.global.dryRun) {
-      rmSync3(legacyConfigPath2, { force: true });
+      rmSync4(legacyConfigPath, { force: true });
     }
   }
-  const legacyBuildIdPath = resolve19(root, LEGACY_BUILD_ID_FILE);
-  const moduleBuildIdPath = resolve19(root, MODULE_BUILD_ID_FILE);
+  const legacyBuildIdPath = resolve18(root, LEGACY_BUILD_ID_FILE);
+  const moduleBuildIdPath = resolve18(root, MODULE_BUILD_ID_FILE);
   if (existsSync14(legacyBuildIdPath) && !existsSync14(moduleBuildIdPath)) {
     const baseline = stripToBaseline(readFirstNonCommentLine(legacyBuildIdPath)) ?? "v0.0.1-dev";
     actions.push(`Migrate ${LEGACY_BUILD_ID_FILE} \u2192 ${MODULE_BUILD_ID_FILE} (baseline ${baseline})`);
     if (!ctx.global.dryRun) {
-      writeFileSync7(
+      writeFileSync9(
         moduleBuildIdPath,
         `# Channel baseline for local CDN deploys (wp deploy auto-bumps per developer).
 ${baseline}
 `
       );
-      rmSync3(legacyBuildIdPath, { force: true });
+      rmSync4(legacyBuildIdPath, { force: true });
     }
   }
   if (existsSync14(woodscliPath)) {
-    const raw = JSON.parse(readFileSync12(woodscliPath, "utf8"));
+    const raw = JSON.parse(readFileSync13(woodscliPath, "utf8"));
     let configChanged = false;
     if (raw?.dev?.moduleConfigDir && raw.dev.moduleConfigDir !== WPHS_WORKSPACE_DIR) {
       actions.push(`Update dev.moduleConfigDir \u2192 .wphs in project config`);
@@ -3352,7 +3904,7 @@ ${baseline}
       }
     }
     if (configChanged && !ctx.global.dryRun) {
-      writeFileSync7(woodscliPath, `${JSON.stringify(raw, null, 2)}
+      writeFileSync9(woodscliPath, `${JSON.stringify(raw, null, 2)}
 `);
     }
   }
@@ -3370,20 +3922,16 @@ ${baseline}
       remediation: "Run: wp migrate --yes"
     });
   }
-  runNodeScript(kitPath("scripts/ensure-wphs-workspace.mjs"), [], {
-    cwd: root,
-    logger: ctx.logger,
-    dryRun: false
-  });
+  await ensureProjectWphsWorkspace(root);
   for (const action of actions) ctx.logger.success(action);
   return ExitCode.SUCCESS;
 }
 
 // src/cli/commands/examples.ts
-import { readFileSync as readFileSync13 } from "fs";
+import { readFileSync as readFileSync14 } from "fs";
 function loadManifest() {
   const manifestPath = kitPath("examples", "manifest.json");
-  const raw = JSON.parse(readFileSync13(manifestPath, "utf8"));
+  const raw = JSON.parse(readFileSync14(manifestPath, "utf8"));
   return raw.scenarios;
 }
 async function runExamplesList(ctx, options = {}) {
@@ -3403,8 +3951,8 @@ async function runExamplesSmoke(ctx, options = {}) {
   const tier = options.tier ?? "static";
   const args = ["--tier", tier];
   if (options.scenario) args.push("--scenario", options.scenario);
-  const { runNodeScript: runNodeScript2 } = await import("./exec-VY6BGWF3.js");
-  runNodeScript2(kitPath("examples", "smoke", "run-matrix.mjs"), args, {
+  const { runNodeScript } = await import("./exec-VY6BGWF3.js");
+  runNodeScript(kitPath("examples", "smoke", "run-matrix.mjs"), args, {
     cwd: ctx.projectRoot,
     logger: ctx.logger,
     dryRun: ctx.global.dryRun
@@ -3416,13 +3964,13 @@ async function runExamplesSmoke(ctx, options = {}) {
 }
 
 // src/cli/commands/fields.ts
-import { cpSync as cpSync4, existsSync as existsSync15, readFileSync as readFileSync14, writeFileSync as writeFileSync8 } from "fs";
-import { resolve as resolve20 } from "path";
+import { cpSync as cpSync5, existsSync as existsSync15, readFileSync as readFileSync15, writeFileSync as writeFileSync10 } from "fs";
+import { resolve as resolve19 } from "path";
 async function runFieldsSync(ctx, options = {}) {
   const direction = options.direction ?? "pull";
-  const fieldsPath = resolve20(ctx.projectRoot, ctx.config.dev.fieldsJson);
-  const cacheDir = resolve20(ctx.projectRoot, ctx.config.dev.moduleConfigDir, "cache", "fields-sync");
-  const cachePath = resolve20(cacheDir, "fields.json");
+  const fieldsPath = resolve19(ctx.projectRoot, ctx.config.dev.fieldsJson);
+  const cacheDir = resolve19(ctx.projectRoot, ctx.config.dev.moduleConfigDir, "cache", "fields-sync");
+  const cachePath = resolve19(cacheDir, "fields.json");
   if (direction === "pull") {
     if (!existsSync15(fieldsPath)) {
       throw new WpHsError(`Missing ${ctx.config.dev.fieldsJson}`, {
@@ -3434,9 +3982,9 @@ async function runFieldsSync(ctx, options = {}) {
       ctx.logger.info(`[dry-run] Would cache ${fieldsPath} \u2192 ${cachePath}`);
       return ExitCode.SUCCESS;
     }
-    const { mkdirSync: mkdirSync6 } = await import("fs");
-    mkdirSync6(cacheDir, { recursive: true });
-    cpSync4(fieldsPath, cachePath);
+    const { mkdirSync: mkdirSync7 } = await import("fs");
+    mkdirSync7(cacheDir, { recursive: true });
+    cpSync5(fieldsPath, cachePath);
     ctx.logger.success(`Cached fields \u2192 ${cachePath}`);
     return ExitCode.SUCCESS;
   }
@@ -3449,14 +3997,14 @@ async function runFieldsSync(ctx, options = {}) {
     ctx.logger.info(`[dry-run] Would write ${cachePath} \u2192 ${fieldsPath}`);
     return ExitCode.SUCCESS;
   }
-  writeFileSync8(fieldsPath, readFileSync14(cachePath, "utf8"));
+  writeFileSync10(fieldsPath, readFileSync15(cachePath, "utf8"));
   ctx.logger.success(`Restored fields from cache \u2192 ${fieldsPath}`);
   return ExitCode.SUCCESS;
 }
 
 // src/cli/commands/regression.ts
 import { existsSync as existsSync16 } from "fs";
-import { resolve as resolve21 } from "path";
+import { resolve as resolve20 } from "path";
 var LEGACY_SHIM_SCRIPTS = [
   "build-cdn.mjs",
   "run-vite-build.mjs",
@@ -3479,7 +4027,7 @@ async function runRegressionSmoke(ctx, options = {}) {
   if (!validateOk) failures.push("wp config validate failed");
   if (options.checkLegacyShims !== false) {
     for (const script of LEGACY_SHIM_SCRIPTS) {
-      const shim = resolve21(ctx.projectRoot, "scripts", script);
+      const shim = resolve20(ctx.projectRoot, "scripts", script);
       const kitScript = kitPath("scripts", script);
       const shimOk = existsSync16(shim) && existsSync16(kitScript);
       checks.push({ name: `shim:${script}`, ok: shimOk });
@@ -3487,12 +4035,12 @@ async function runRegressionSmoke(ctx, options = {}) {
     }
   }
   for (const rel of FORBIDDEN_CONSUMER_PATHS) {
-    const forbidden = resolve21(ctx.projectRoot, rel);
+    const forbidden = resolve20(ctx.projectRoot, rel);
     const absent = !existsSync16(forbidden);
     checks.push({ name: `no-${rel}`, ok: absent });
     if (!absent) failures.push(`Forbidden dev path still present: ${rel}`);
   }
-  const woodscliConfig = resolve21(ctx.projectRoot, WOODSCLI_CONFIG_FILE);
+  const woodscliConfig = resolve20(ctx.projectRoot, WOODSCLI_CONFIG_FILE);
   const configOk = existsSync16(woodscliConfig);
   checks.push({ name: WOODSCLI_CONFIG_FILE, ok: configOk });
   if (!configOk) failures.push(`${WOODSCLI_CONFIG_FILE} missing`);
@@ -3527,14 +4075,7 @@ async function runSetup(ctx, options = {}) {
         title: "Preparing .wphs workspace",
         task: async () => {
           if (ctx.global.dryRun) return;
-          try {
-            runNodeScript(kitPath("scripts", "ensure-wphs-workspace.mjs"), [], {
-              cwd: ctx.projectRoot,
-              logger: ctx.logger,
-              dryRun: false
-            });
-          } catch {
-          }
+          await ensureProjectWphsWorkspace(ctx.projectRoot);
         }
       },
       {
@@ -3603,11 +4144,11 @@ async function runSetup(ctx, options = {}) {
 }
 
 // src/cli/commands/portal.ts
-import * as p5 from "@clack/prompts";
+import * as p6 from "@clack/prompts";
 
 // src/lib/hubspot-portals.ts
-import { existsSync as existsSync17, readFileSync as readFileSync15 } from "fs";
-import { resolve as resolve22 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync16 } from "fs";
+import { resolve as resolve21 } from "path";
 function stripYamlScalar(value) {
   const trimmed = value.trim();
   if (trimmed.startsWith('"') && trimmed.endsWith('"') || trimmed.startsWith("'") && trimmed.endsWith("'")) {
@@ -3645,20 +4186,20 @@ function parseHubSpotConfigPortals(raw) {
   return { defaultPortal, portals };
 }
 function readHubSpotPortals(projectRoot) {
-  const configPath = resolve22(projectRoot, HUBSPOT_CONFIG_FILE);
+  const configPath = resolve21(projectRoot, HUBSPOT_CONFIG_FILE);
   if (!existsSync17(configPath)) {
     throw new WpHsError(`${HUBSPOT_CONFIG_FILE} not found in project root.`, {
       exitCode: ExitCode.USER_ERROR,
       remediation: "Run wp setup, then add your portal + PAT."
     });
   }
-  const raw = readFileSync15(configPath, "utf8");
+  const raw = readFileSync16(configPath, "utf8");
   const { defaultPortal, portals } = parseHubSpotConfigPortals(raw);
   return { configPath, defaultPortal, portals };
 }
 function resolvePortalName(portals, nameOrId) {
   const needle = nameOrId.trim();
-  return portals.find((p6) => p6.name === needle) ?? portals.find((p6) => p6.portalId === needle) ?? null;
+  return portals.find((p9) => p9.name === needle) ?? portals.find((p9) => p9.portalId === needle) ?? null;
 }
 
 // src/cli/commands/portal.ts
@@ -3713,7 +4254,7 @@ async function runPortalUse(ctx, options = {}) {
         remediation: "wp portal use <name>  \xB7  wp portal list"
       });
     }
-    const answer = await p5.select({
+    const answer = await p6.select({
       message: "Set default HubSpot portal",
       options: data.portals.map((portal2) => ({
         value: portal2.name,
@@ -3721,7 +4262,7 @@ async function runPortalUse(ctx, options = {}) {
         hint: portal2.name === data.defaultPortal ? `current default \xB7 ${portal2.portalId ?? "no id"}` : portal2.portalId ?? void 0
       }))
     });
-    if (p5.isCancel(answer)) {
+    if (p6.isCancel(answer)) {
       throw new WpHsError("Portal selection cancelled", { exitCode: ExitCode.USER_ERROR });
     }
     targetName = answer;
@@ -3755,6 +4296,311 @@ async function runPortalUse(ctx, options = {}) {
   return ExitCode.SUCCESS;
 }
 
+// src/cli/commands/page.ts
+import * as p7 from "@clack/prompts";
+function cancelIfNeeded2(value) {
+  if (p7.isCancel(value)) {
+    throw new WpHsError("Page scaffold cancelled", { exitCode: ExitCode.USER_ERROR });
+  }
+  return value;
+}
+function resolveAccessFlags(options) {
+  if (options.isPublic && options.isProtected) {
+    throw new WpHsError("Use only one of --public or --protected.", {
+      exitCode: ExitCode.USER_ERROR
+    });
+  }
+  if (options.isPublic) {
+    return "public";
+  }
+  if (options.isProtected) {
+    return "protected";
+  }
+  return void 0;
+}
+async function promptPageAddOptions(ctx, options) {
+  const nonInteractive = ctx.global.ci || ctx.global.yes || ctx.global.json;
+  const hasNavConfig = navConfigFileExists(ctx.projectRoot);
+  let slug = options.slug ? normalizePageSlug(options.slug) : void 0;
+  if (!slug && nonInteractive) {
+    throw new WpHsError("Page slug is required in non-interactive mode.", {
+      exitCode: ExitCode.USER_ERROR,
+      remediation: "Pass a slug: wp page add settings"
+    });
+  }
+  if (!slug) {
+    const slugAnswer = cancelIfNeeded2(
+      await p7.text({
+        message: "Page slug (URL segment)",
+        placeholder: "settings",
+        validate: (value) => {
+          const normalized = normalizePageSlug(value ?? "");
+          if (!normalized || !/^[a-z][a-z0-9-]*$/.test(normalized)) {
+            return "Use lowercase letters, numbers, and hyphens";
+          }
+          return void 0;
+        }
+      })
+    );
+    slug = normalizePageSlug(slugAnswer);
+  }
+  let path = options.path ? normalizePagePath(options.path, slug) : void 0;
+  if (!path && !nonInteractive) {
+    const pathAnswer = cancelIfNeeded2(
+      await p7.text({
+        message: "Route path",
+        initialValue: `/${slug}`,
+        validate: (value) => {
+          const normalized = normalizePagePath(value ?? "", slug);
+          if (!normalized.startsWith("/")) {
+            return "Path must start with /";
+          }
+          return void 0;
+        }
+      })
+    );
+    path = normalizePagePath(pathAnswer, slug);
+  }
+  path ??= normalizePagePath(`/${slug}`, slug);
+  let title = options.title?.trim() || titleFromSlug(slug);
+  if (!options.title && !nonInteractive) {
+    const titleAnswer = cancelIfNeeded2(
+      await p7.text({
+        message: "Page title",
+        initialValue: title,
+        validate: (value) => value?.trim() ? void 0 : "Title is required"
+      })
+    );
+    title = titleAnswer.trim();
+  }
+  let access = resolveAccessFlags(options);
+  if (!access && nonInteractive) {
+    throw new WpHsError("Access mode is required in non-interactive mode.", {
+      exitCode: ExitCode.USER_ERROR,
+      remediation: "Pass --public or --protected."
+    });
+  }
+  if (!access) {
+    const accessAnswer = cancelIfNeeded2(
+      await p7.select({
+        message: "Who can access this page?",
+        initialValue: "public",
+        options: [
+          {
+            value: "public",
+            label: "Public",
+            hint: "Visible without signing in"
+          },
+          {
+            value: "protected",
+            label: "Protected",
+            hint: "Requires portal sign-in"
+          }
+        ]
+      })
+    );
+    access = accessAnswer;
+  }
+  let addToNav;
+  if (options.addToNav) {
+    addToNav = true;
+  } else if (options.skipNav) {
+    addToNav = false;
+  } else if (!hasNavConfig) {
+    addToNav = false;
+  } else if (nonInteractive) {
+    throw new WpHsError("Navigation choice is required in non-interactive mode.", {
+      exitCode: ExitCode.USER_ERROR,
+      remediation: "Pass --nav or --no-nav when portal-nav.ts or starter-nav.ts exists."
+    });
+  } else {
+    const navAnswer = cancelIfNeeded2(
+      await p7.confirm({
+        message: "Add to navigation menu?",
+        initialValue: true
+      })
+    );
+    addToNav = navAnswer;
+  }
+  return { slug, path, title, access, addToNav };
+}
+async function runPageAdd(ctx, options) {
+  const resolved = await promptPageAddOptions(ctx, options);
+  const result = await scaffoldPage({
+    projectRoot: ctx.projectRoot,
+    config: ctx.config,
+    slug: resolved.slug,
+    path: resolved.path,
+    title: resolved.title,
+    access: resolved.access,
+    addToNav: resolved.addToNav,
+    dryRun: ctx.global.dryRun,
+    logger: ctx.logger
+  });
+  if (ctx.global.json) {
+    ctx.logger.json({
+      ok: true,
+      slug: resolved.slug,
+      path: resolved.path,
+      access: resolved.access,
+      addToNav: resolved.addToNav,
+      ...result
+    });
+    return ExitCode.SUCCESS;
+  }
+  if (ctx.global.dryRun) {
+    ctx.logger.info("[dry-run] Page scaffold planned.");
+    return ExitCode.SUCCESS;
+  }
+  const lines = [
+    `Created ${result.routeFile}`,
+    `Created ${result.pageFile}`,
+    result.routeTreeRegenerated ? "Regenerated src/routeTree.gen.ts" : result.routeTreeWarning ?? "Restart wp dev if navigation types look stale."
+  ];
+  if (!ctx.global.quiet) {
+    p7.log.success(`Page "${resolved.title}" scaffolded at ${resolved.path}`);
+    p7.note(lines.join("\n"), "Next steps");
+  } else {
+    ctx.logger.success(lines.join("\n"));
+  }
+  return ExitCode.SUCCESS;
+}
+async function runPageList(ctx) {
+  const { listScaffoldedPages } = await import("./scaffold-page-lifecycle-EHMPWPPE.js");
+  const pages = listScaffoldedPages(ctx.projectRoot, ctx.config);
+  if (ctx.global.json) {
+    ctx.logger.json({ pages });
+    return ExitCode.SUCCESS;
+  }
+  if (pages.length === 0) {
+    ctx.logger.info("No scaffolded pages in src/features/pages/ (use wp page add).");
+    return ExitCode.SUCCESS;
+  }
+  if (!ctx.global.quiet) {
+    p7.log.info(`Scaffolded pages (${pages.length})`);
+    for (const page of pages) {
+      const navFlag = page.inNav ? "nav" : "no-nav";
+      p7.log.message(
+        `  ${page.slug}  ${page.path}  ${page.access}  ${navFlag}  ${page.routeFile}`
+      );
+    }
+  } else {
+    for (const page of pages) {
+      ctx.logger.info(`${page.slug}	${page.path}	${page.access}	${page.inNav}`);
+    }
+  }
+  return ExitCode.SUCCESS;
+}
+async function runPageRemove(ctx, options) {
+  const { removeScaffoldedPage } = await import("./scaffold-page-lifecycle-EHMPWPPE.js");
+  const result = removeScaffoldedPage({
+    projectRoot: ctx.projectRoot,
+    config: ctx.config,
+    slug: options.slug,
+    removeFromNav: !options.skipNav,
+    dryRun: ctx.global.dryRun,
+    logger: ctx.logger
+  });
+  if (ctx.global.json) {
+    ctx.logger.json({ ok: true, ...result });
+    return ExitCode.SUCCESS;
+  }
+  if (ctx.global.dryRun) {
+    ctx.logger.info("[dry-run] Page removal planned.");
+    return ExitCode.SUCCESS;
+  }
+  p7.log.success(`Removed page "${result.slug}"`);
+  return ExitCode.SUCCESS;
+}
+
+// src/cli/commands/scaffold.ts
+import * as p8 from "@clack/prompts";
+import { writeFileSync as writeFileSync11 } from "fs";
+import { resolve as resolve22 } from "path";
+function persistScaffoldConfig(projectRoot, config, patch) {
+  const auth = patch.auth ?? config.scaffold?.auth ?? "none";
+  const router = patch.router ?? config.scaffold?.router ?? "hash";
+  const scaffold = { router, auth };
+  if (auth !== "none") {
+    scaffold.nav = patch.nav ?? config.scaffold?.nav ?? "top";
+  }
+  const next = { ...config, scaffold };
+  writeFileSync11(resolve22(projectRoot, WOODSCLI_CONFIG_FILE), `${JSON.stringify(next, null, 2)}
+`);
+  return next;
+}
+function parseAuthTier(value) {
+  if (value === "starter" || value === "sso" || value === "full") {
+    return value;
+  }
+  return void 0;
+}
+function runScaffoldAuthUpgrade(ctx, options) {
+  const routerMode = ctx.config.scaffold?.router ?? "hash";
+  const nav = ctx.config.scaffold?.nav ?? "top";
+  const current = readProjectAuthTier(ctx.projectRoot);
+  if (ctx.global.dryRun) {
+    ctx.logger.info(
+      `[dry-run] Would upgrade auth from "${current}" to "${options.tier}" in ${ctx.projectRoot}`
+    );
+    return ExitCode.SUCCESS;
+  }
+  const applied = applyAuthTierUpgrade(
+    ctx.projectRoot,
+    options.tier,
+    routerMode,
+    ctx.config.projectType,
+    nav
+  );
+  persistScaffoldConfig(ctx.projectRoot, ctx.config, {
+    auth: applied,
+    nav: applied !== "none" ? nav : void 0
+  });
+  if (ctx.global.json) {
+    ctx.logger.json({ ok: true, previousTier: current, tier: applied });
+    return ExitCode.SUCCESS;
+  }
+  p8.log.success(`Portal auth upgraded to "${applied}" (was "${current}")`);
+  p8.note("Review new routes under src/routes/_auth/ and run wp dev.", "Next steps");
+  return ExitCode.SUCCESS;
+}
+function runScaffoldNav(ctx, options) {
+  const currentNav = ctx.config.scaffold?.nav ?? "top";
+  if (ctx.config.scaffold?.auth === "none" || readProjectAuthTier(ctx.projectRoot) === "none") {
+    throw new WpHsError("Nav scaffold requires portal auth.", {
+      exitCode: ExitCode.USER_ERROR,
+      remediation: "Run wp scaffold auth upgrade --tier starter first."
+    });
+  }
+  if (ctx.global.dryRun) {
+    ctx.logger.info(`[dry-run] Would apply nav shell "${options.mode}" (was "${currentNav}")`);
+    return ExitCode.SUCCESS;
+  }
+  applyNavScaffoldUpgrade(ctx.projectRoot, options.mode);
+  persistScaffoldConfig(ctx.projectRoot, ctx.config, { nav: options.mode });
+  if (ctx.global.json) {
+    ctx.logger.json({ ok: true, previousMode: currentNav, mode: options.mode });
+    return ExitCode.SUCCESS;
+  }
+  p8.log.success(`Navigation shell set to "${options.mode}" (was "${currentNav}")`);
+  return ExitCode.SUCCESS;
+}
+function parseScaffoldAuthTierArg(value) {
+  const tier = value ? parseAuthTier(value) : void 0;
+  if (!tier) {
+    throw new WpHsError("Auth tier is required: starter | sso | full", {
+      exitCode: ExitCode.USER_ERROR
+    });
+  }
+  return tier;
+}
+function parseScaffoldNavModeArg(value) {
+  if (value === "top" || value === "sidebar") {
+    return value;
+  }
+  throw new WpHsError("Nav mode is required: top | sidebar", { exitCode: ExitCode.USER_ERROR });
+}
+
 // src/cli/commands/watch.ts
 async function runWatch(ctx, options) {
   ensureHubSpotConfigForCms(ctx);
@@ -3780,14 +4626,19 @@ async function runWatch(ctx, options) {
 }
 
 // src/cli/program.ts
-function readVersion() {
+function resolveProjectRootForVersionCheck(project) {
+  if (project) {
+    return project;
+  }
   try {
-    const pkg = JSON.parse(readFileSync16(resolve23(getKitRoot(), "package.json"), "utf8"));
-    return pkg.version ?? "0.0.0";
+    return findProjectRoot();
   } catch {
-    return "0.0.0";
+    return process.cwd();
   }
 }
+function readVersion() {
+  return readKitVersion();
+}
 function buildContext(global) {
   const logger = createLogger({
     verbose: global.verbose,
@@ -3795,7 +4646,7 @@ function buildContext(global) {
     json: global.json,
     ci: global.ci
   });
-  const projectRoot = global.project ?? findProjectRoot2();
+  const projectRoot = global.project ?? findProjectRoot();
   const { config } = loadConfig(projectRoot);
   return { projectRoot, config, logger, global };
 }
@@ -3805,7 +4656,7 @@ function attachGlobals(command) {
 async function handle(fn) {
   try {
     const code = await fn();
-    process.exit(code);
+    await exitCli(code);
   } catch (error) {
     if (isWpHsError(error)) {
       process.stderr.write(`Error: ${error.message}
@@ -3814,16 +4665,30 @@ async function handle(fn) {
         process.stderr.write(`\u2192 ${error.remediation}
 `);
       }
-      process.exit(error.exitCode);
+      await exitCli(error.exitCode);
     }
     process.stderr.write(`Error: ${error instanceof Error ? error.message : String(error)}
 `);
-    process.exit(ExitCode.INTERNAL);
+    await exitCli(ExitCode.INTERNAL);
   }
 }
 function createProgram() {
   const program2 = new Command().name("wp").description("WoodsCLI \u2014 HubSpot CMS dev kit by WoodsPortal (modules + themes)").version(readVersion()).addHelpText("after", "\nWoodsCLI \xB7 WoodsPortal HubSpot CLI \xB7 npm @woodsportal/hubspot-kit");
   attachGlobals(program2);
+  program2.hook("preAction", async (_thisCommand, actionCommand) => {
+    const global = program2.opts();
+    const name = actionCommand.name();
+    if (name === "version" || name === "help") {
+      return;
+    }
+    await maybeWarnKitUpdate({
+      current: readKitVersion(),
+      projectRoot: resolveProjectRootForVersionCheck(global.project),
+      ci: global.ci,
+      json: global.json,
+      quiet: global.quiet
+    });
+  });
   program2.command("doctor").description("Check prerequisites (Node, HubSpot CLI, .wphs workspace, config)").action(async () => {
     const global = program2.opts();
     await handle(() => runDoctor(buildContext(global)));
@@ -3842,6 +4707,12 @@ function createProgram() {
     await handle(() => runConfigValidate(buildContext(global)));
   });
   program2.command("init").description("Scaffold a new module or theme project").option("-t, --template <type>", "module-hybrid-cdn | module-monolith | theme-starter").option("-n, --name <slug>", "Project name (creates ./<name>/ under cwd)").option("-d, --directory <path>", "Full target directory (skips name \u2192 folder prompt)").option("--router <mode>", "hash (client-frontend default) | browser | none \u2014 modules only").option(
+    "--auth <tier>",
+    "Portal auth: none | starter | sso | full \u2014 modules with router \u2260 none"
+  ).option(
+    "--nav <mode>",
+    "Authenticated nav shell: top | sidebar (requires --auth starter|sso|full)"
+  ).option(
     "--cdn-github <org/repo>",
     "Public GitHub CDN mirror repo (hybrid CDN; use with --ci / -y)"
   ).action(
@@ -3860,12 +4731,16 @@ function createProgram() {
         global
       };
       const routerMode = opts.router === "browser" || opts.router === "none" || opts.router === "hash" ? opts.router : void 0;
+      const authMode = opts.auth === "none" || opts.auth === "starter" || opts.auth === "sso" || opts.auth === "full" ? opts.auth : void 0;
+      const navMode = opts.nav === "top" || opts.nav === "sidebar" ? opts.nav : void 0;
       await handle(
         () => runInit(ctx, {
           template: opts.template,
           name: opts.name,
           directory: opts.directory,
           router: routerMode,
+          auth: authMode,
+          nav: navMode,
           cdnGithub: opts.cdnGithub
         })
       );
@@ -3998,6 +4873,45 @@ function createProgram() {
     const global = program2.opts();
     await handle(() => runPortalUse(buildContext(global), { name }));
   });
+  const page = program2.command("page").description("Scaffold routed pages");
+  page.command("add [slug]").description("Create a route file + page component").option("--path <path>", "URL path (default: /<slug>)").option("--title <title>", "Page heading").option("--public", "Public route (no sign-in)").option("--protected", "Protected route (requires auth)").option("--nav", "Add link to navigation menu (portal-nav.ts or starter-nav.ts)").option("--no-nav", "Skip navigation menu").action(
+    async (slug, opts) => {
+      const global = program2.opts();
+      await handle(
+        () => runPageAdd(buildContext(global), {
+          slug,
+          path: opts.path,
+          title: opts.title,
+          isPublic: opts.public,
+          isProtected: opts.protected,
+          addToNav: opts.nav,
+          skipNav: opts.noNav
+        })
+      );
+    }
+  );
+  page.command("list").alias("ls").description("List scaffolded pages under src/features/pages/").action(async () => {
+    const global = program2.opts();
+    await handle(() => runPageList(buildContext(global)));
+  });
+  page.command("remove <slug>").description("Remove a scaffolded page (route, component, routes.ts, nav)").option("--no-nav", "Leave navigation menu unchanged").action(async (slug, opts) => {
+    const global = program2.opts();
+    await handle(
+      () => runPageRemove(buildContext(global), { slug, skipNav: opts.noNav })
+    );
+  });
+  const scaffold = program2.command("scaffold").description("Re-apply portal scaffold layers");
+  const scaffoldAuth = scaffold.command("auth").description("Portal auth tier upgrades");
+  scaffoldAuth.command("upgrade").description("Upgrade portal auth tier on an existing module (starter \u2192 sso \u2192 full)").requiredOption("--tier <tier>", "starter | sso | full").action(async (opts) => {
+    const global = program2.opts();
+    const tier = parseScaffoldAuthTierArg(opts.tier);
+    await handle(async () => runScaffoldAuthUpgrade(buildContext(global), { tier }));
+  });
+  scaffold.command("nav").description("Re-apply authenticated navigation shell (top | sidebar)").requiredOption("--mode <mode>", "top | sidebar").action(async (opts) => {
+    const global = program2.opts();
+    const mode = parseScaffoldNavModeArg(opts.mode);
+    await handle(async () => runScaffoldNav(buildContext(global), { mode }));
+  });
   return program2;
 }