agentful 0.4.5 → 0.4.7

package/dist/index.cjs

@@ -33,9 +33,9 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
-// node_modules/commander/lib/error.js
+// ../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/lib/error.js
 var require_error = __commonJS({
-  "node_modules/commander/lib/error.js"(exports2) {
+  "../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/lib/error.js"(exports2) {
     "use strict";
     var CommanderError2 = class extends Error {
       /**
@@ -69,9 +69,9 @@ var require_error = __commonJS({
   }
 });
 
-// node_modules/commander/lib/argument.js
+// ../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/lib/argument.js
 var require_argument = __commonJS({
-  "node_modules/commander/lib/argument.js"(exports2) {
+  "../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/lib/argument.js"(exports2) {
     "use strict";
     var { InvalidArgumentError: InvalidArgumentError2 } = require_error();
     var Argument2 = class {
@@ -197,9 +197,9 @@ var require_argument = __commonJS({
   }
 });
 
-// node_modules/commander/lib/help.js
+// ../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/lib/help.js
 var require_help = __commonJS({
-  "node_modules/commander/lib/help.js"(exports2) {
+  "../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/lib/help.js"(exports2) {
     "use strict";
     var { humanReadableArgName } = require_argument();
     var Help2 = class {
@@ -612,9 +612,9 @@ var require_help = __commonJS({
   }
 });
 
-// node_modules/commander/lib/option.js
+// ../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/lib/option.js
 var require_option = __commonJS({
-  "node_modules/commander/lib/option.js"(exports2) {
+  "../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/lib/option.js"(exports2) {
     "use strict";
     var { InvalidArgumentError: InvalidArgumentError2 } = require_error();
     var Option2 = class {
@@ -885,9 +885,9 @@ var require_option = __commonJS({
   }
 });
 
-// node_modules/commander/lib/suggestSimilar.js
+// ../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/lib/suggestSimilar.js
 var require_suggestSimilar = __commonJS({
-  "node_modules/commander/lib/suggestSimilar.js"(exports2) {
+  "../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/lib/suggestSimilar.js"(exports2) {
     "use strict";
     var maxDistance = 3;
     function editDistance(a, b) {
@@ -966,9 +966,9 @@ var require_suggestSimilar = __commonJS({
   }
 });
 
-// node_modules/commander/lib/command.js
+// ../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/lib/command.js
 var require_command = __commonJS({
-  "node_modules/commander/lib/command.js"(exports2) {
+  "../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/lib/command.js"(exports2) {
     "use strict";
     var EventEmitter = require("events").EventEmitter;
     var childProcess = require("child_process");
@@ -3010,9 +3010,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
   }
 });
 
-// node_modules/commander/index.js
+// ../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/index.js
 var require_commander = __commonJS({
-  "node_modules/commander/index.js"(exports2) {
+  "../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/index.js"(exports2) {
     "use strict";
     var { Argument: Argument2 } = require_argument();
     var { Command: Command2 } = require_command();
@@ -3044,7 +3044,7 @@ var VERSION, brand, useColor, wrap, paint, tuiDesign, sym, ui;
 var init_branding = __esm({
   "src/branding.ts"() {
     "use strict";
-    VERSION = "0.4.5" ? "0.4.5" : null.version;
+    VERSION = "0.4.7" ? "0.4.7" : null.version;
     brand = {
       name: "agentful",
       // the command users type
@@ -3103,9 +3103,9 @@ var init_branding = __esm({
   }
 });
 
-// node_modules/ignore/index.js
+// ../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/ignore/index.js
 var require_ignore = __commonJS({
-  "node_modules/ignore/index.js"(exports2, module2) {
+  "../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/ignore/index.js"(exports2, module2) {
     "use strict";
     function makeArray(subject) {
       return Array.isArray(subject) ? subject : [subject];
@@ -3824,7 +3824,7 @@ var init_plugin = __esm({
   }
 });
 
-// node_modules/commander/esm.mjs
+// ../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/esm.mjs
 var import_index = __toESM(require_commander(), 1);
 var {
   program,
@@ -4785,7 +4785,7 @@ init_branding();
 var import_node_fs4 = require("fs");
 var import_node_path6 = require("path");
 
-// node_modules/fflate/esm/index.mjs
+// ../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/fflate/esm/index.mjs
 var import_module = require("module");
 var require2 = (0, import_module.createRequire)("/");
 var _a;
@@ -5597,18 +5597,28 @@ function detectDistDir(rootDir, override) {
 }
 
 // src/lib/preflight.ts
-var import_node_fs5 = require("fs");
-var import_node_path7 = require("path");
+var import_node_fs6 = require("fs");
+var import_node_path8 = require("path");
 
 // ../platform-contract/contract.json
 var contract_default = {
   $comment: "Single source of truth for the platform publish contract (PRD AP6a, planned/cli-push-to-workspace-transition-findings-and-prd-2026-08-17.md). Consumers: cli/src/lib/preflight.ts renders directly from this file; build engine (infrastructure/lambda/build-engine/handler.ts) and executor (opencode-lambda/executor/runtime/opencode_runner.py) are parity-checked against it by ./check-parity.py until AP4/AP5 move them onto it; AP0 instructions/skills render from it later. Bump schema_version on breaking shape changes. See README.md.",
   schema_version: 1,
-  contract_statement: "This platform publishes static files. Your app has no server process of its own \u2014 server-side logic runs as Managed Server Actions (short request/response functions) or on an API of your own that you connect. You cannot set build-time env vars or secrets: the workspace build injects only a fixed allowlist of public client values, and the `agentful push` build injects none.",
+  contract_statement: "This platform publishes static files. Your app has no server process of its own \u2014 server-side logic runs as Managed Server Actions (short request/response functions) or on an API of your own that you connect. You cannot set build-time env vars or secrets: every cloud build injects the same fixed allowlist of public client values, and nothing else.",
   publish: {
     server_process: false,
     build_env_vars: false,
-    $comment_build_env: "false = nobody can SET a build variable or build secret. Two build paths exist and they differ: the workspace executor injects a fixed allowlist of PUBLIC client values (VITE_PROJECT_ID/PUBLIC_PROJECT_ID, and for a BYO Supabase database its URL + publishable key as VITE_/PUBLIC_/NEXT_PUBLIC_); the build engine behind `agentful push` injects nothing beyond NODE_ENV. Code that must build on both paths keeps public values in an ordinary source constant.",
+    $comment_build_env: "false = nobody can SET a build variable or build secret. Two build paths exist \u2014 the workspace executor (end of an agent turn) and the build engine (the workspace's Build button and `agentful push`) \u2014 and both inject the SAME fixed allowlist of PUBLIC client values, listed under build_env. The values come from one function on both paths (aws-services/workspace-manager/client_config.py); check-parity.py (check 13) pins the names. Until 2026-09 the build engine injected nothing, so an app that read import.meta.env.VITE_SUPABASE_URL worked after the agent's turn and lost its database on the next Build click \u2014 without a build error. A public value outside the allowlist still belongs in an ordinary source constant.",
+    build_env: {
+      $comment: "What a cloud build defines, and nothing else. `injected` = suffix x prefixes; `when: byo_supabase` means only while the project's Backend tab has an own Supabase database connected (URL + publishable key; a secret key stored in that slot is refused, never shipped). A read of <public prefix><injected suffix> that the build does NOT define fails the build (422 undefined_build_env): undefined there is a broken app, not a default. Any other read of a public-prefixed name that nothing defines is a warning, because `import.meta.env.VITE_API_BASE ?? '/api'` is a legitimate pattern. `bundler_builtins` are set by the framework itself and are never reported.",
+      public_prefixes: ["VITE_", "PUBLIC_", "NEXT_PUBLIC_"],
+      injected: [
+        { suffix: "PROJECT_ID", prefixes: ["VITE_", "PUBLIC_"], when: "always" },
+        { suffix: "SUPABASE_URL", prefixes: ["VITE_", "PUBLIC_", "NEXT_PUBLIC_"], when: "byo_supabase" },
+        { suffix: "SUPABASE_ANON_KEY", prefixes: ["VITE_", "PUBLIC_", "NEXT_PUBLIC_"], when: "byo_supabase" }
+      ],
+      bundler_builtins: ["PUBLIC_URL"]
+    },
     published_prefix: "dist/",
     canonical_output_check: "root_index_html",
     $comment_output: "Canonical end-to-end contract (AP4): a root-level index.html inside the framework's output dir. Deliberately stricter than the executor's historical index.htm/200.html acceptance \u2014 both builders converge on THIS, not on each other (deployment gate and publish self-heal require dist/index.html)."
@@ -5618,10 +5628,11 @@ var contract_default = {
     $comment_limits: "Compressed zip bytes. Enforced server-side as MAX_TEMPLATE_ZIP_UPLOAD_BYTES (aws-services/workspace-manager/handler.py); ~8 MB as base64, under the API Gateway 10 MB request cap."
   },
   server_side: {
-    $comment: "What 'server' means on this platform (server-option plan 2026-09-18, AP2). THREE separate tracks with separate limits \u2014 never quote one track's limits for another. managed_actions.limits is pinned against the source constants by check-parity.py (check 10) and against the agent instructions (check 11); the behaviour behind action_timeout_budget_s is pinned in aws-services/action-runner/tests/sandbox_contract.test.js. Additive block: no schema_version bump.",
+    $comment: "What 'server' means on this platform (server-option plan 2026-09-18, AP2). THREE separate tracks with separate limits \u2014 never quote one track's limits for another. managed_actions.limits is pinned against the source constants by check-parity.py (check 10) and against the agent instructions (check 11); the behaviour behind action_timeout_budget_s is pinned in aws-services/action-runner/tests/sandbox_contract.test.js, the one behind switch_off_delay_s (and the refusal itself) in tests/server_switch.test.js. The switch is enforced only while infrastructure/lib/s3-lambda-stack.ts says SERVER_SWITCH_ENFORCEMENT 'enforce' \u2014 check 12 fails if switch_note promises it under any other mode. Additive block: no schema_version bump.",
     managed_actions: {
       label: "Managed Server Actions",
       summary: "Short request/response functions the platform runs for the project. One file is one endpoint; JSON in, JSON out. Backend tab: Server \u2192 Managed.",
+      switch_note: 'Actions run only while the managed server is switched on in the Backend tab (Server \u2192 Managed). A managed database alone does not switch it on. While it is off, every action of the project answers 404 server_not_enabled. Switching on takes effect on the next call; switching off takes effect after the switch-off delay given under Limits at the latest, because warm instances remember "on" for that long. Storing is not running: uploading or pushing action files is not gated by the switch.',
       offers: [
         "One file = one endpoint: .server/actions/<name>.js is served at /api/p/{projectId}/actions/{name}, any HTTP method, JSON in, JSON out",
         "Runtime secrets that never reach the browser: await ctx.secrets.get('server.<name>')",
@@ -5674,7 +5685,8 @@ var contract_default = {
         max_body_bytes: 1048576,
         max_code_bytes: 262144,
         project_concurrency: 10,
-        max_action_depth: 5
+        max_action_depth: 5,
+        switch_off_delay_s: 60
       },
       limits_note: "The per-action budget is a figure to plan with, not a guaranteed stop: an action still waiting on ctx.fetch or ctx.data when the budget runs out is answered with 408 timeout, synchronous code runs on until the hard limit, and after a 408 the action may still complete calls it had already started. Build actions so that a repeated call ends in the same state."
     },
@@ -5804,7 +5816,7 @@ var contract_default = {
   build_attempt_schema: {
     file: "deployments/latest-build.json",
     status_values: ["running", "success", "failed"],
-    phase_codes: ["unsupported_project_type", "install", "build", "missing_output", "upload"],
+    phase_codes: ["unsupported_project_type", "client_env", "install", "build", "missing_output", "upload"],
     fields: {
       schema_version: "int \u2014 copy of this contract's schema_version",
       build_id: "string \u2014 unique per attempt",
@@ -5824,6 +5836,154 @@ var contract_default = {
   }
 };
 
+// ../platform-contract/buildEnv.ts
+var import_node_fs5 = require("fs");
+var import_node_path7 = require("path");
+var BUILD_ENV = contract_default.publish.build_env;
+var PUBLIC_PREFIXES = BUILD_ENV.public_prefixes;
+var BUILTINS = new Set(BUILD_ENV.bundler_builtins);
+var INJECTABLE_NAMES = new Set(
+  BUILD_ENV.injected.flatMap((e) => e.prefixes.map((p) => `${p}${e.suffix}`))
+);
+var ALWAYS_DEFINED_NAMES = new Set(
+  BUILD_ENV.injected.filter((e) => e.when === "always").flatMap((e) => e.prefixes.map((p) => `${p}${e.suffix}`))
+);
+var splitName = (name) => {
+  const prefix = PUBLIC_PREFIXES.find((p) => name.startsWith(p));
+  return prefix ? { prefix, suffix: name.slice(prefix.length) } : null;
+};
+var injectedEntry = (suffix) => BUILD_ENV.injected.find((e) => e.suffix === suffix);
+var SCAN_FILE = /\.(js|jsx|ts|tsx|mjs|cjs|vue|svelte|astro)$/;
+var SKIP_FILE = /\.d\.ts$|\.(test|spec)\.[a-z]+$/;
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".next", ".git", "dist", "build", "out", ".nuxt", ".output", "coverage"]);
+var SCAN_FILE_BUDGET = 5e3;
+var MAX_SCAN_BYTES = 1024 * 1024;
+var ENV_OBJECT = String.raw`(?:import\.meta\.env|process\.env)`;
+var MEMBER_READ = new RegExp(
+  String.raw`\b${ENV_OBJECT}\s*(?:\??\.\s*([A-Z][A-Z0-9_]*)|\[\s*['"]([A-Z][A-Z0-9_]*)['"]\s*\])(\s*(?:\?\?|\|\|))?`,
+  "g"
+);
+var DESTRUCTURED_READ = new RegExp(String.raw`\{([^{}]*)\}\s*=\s*${ENV_OBJECT}\b`, "g");
+var QUOTED = /'(?:[^'\\\n]|\\.)*'|"(?:[^"\\\n]|\\.)*"/g;
+var MENTIONS_ENV = /\benv\s*[.[]/;
+var stripNonCode = (text) => text.replace(QUOTED, (quoted) => MENTIONS_ENV.test(quoted) ? "''" : quoted).replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:'"`\\])\/\/[^\n]*/g, "$1");
+var isReportable = (name) => !BUILTINS.has(name) && splitName(name) !== null;
+function collectFiles2(dir, out, budget) {
+  if (budget.left <= 0 || !(0, import_node_fs5.existsSync)(dir)) return;
+  for (const entry of (0, import_node_fs5.readdirSync)(dir, { withFileTypes: true })) {
+    if (budget.left <= 0) return;
+    const abs = (0, import_node_path7.join)(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (!SKIP_DIRS.has(entry.name)) collectFiles2(abs, out, budget);
+    } else if (entry.isFile() && SCAN_FILE.test(entry.name) && !SKIP_FILE.test(entry.name)) {
+      budget.left--;
+      out.push(abs);
+    }
+  }
+}
+function scanEnvReads(rootDir) {
+  const files = [];
+  collectFiles2(rootDir, files, { left: SCAN_FILE_BUDGET });
+  const reads = [];
+  for (const abs of files) {
+    let text;
+    try {
+      text = (0, import_node_fs5.readFileSync)(abs, "utf8");
+    } catch {
+      continue;
+    }
+    if (text.length > MAX_SCAN_BYTES || !/\benv\b/.test(text)) continue;
+    text = stripNonCode(text);
+    const inFile = /* @__PURE__ */ new Map();
+    const note = (name, hasFallback) => {
+      if (isReportable(name)) inFile.set(name, (inFile.get(name) ?? true) && hasFallback);
+    };
+    for (const m of text.matchAll(MEMBER_READ)) note(m[1] || m[2], Boolean(m[3]));
+    for (const m of text.matchAll(DESTRUCTURED_READ)) {
+      for (const part of m[1].split(",")) {
+        const field = /^\s*([A-Z][A-Z0-9_]*)\s*(?::\s*[A-Za-z_$][\w$]*\s*)?(=)?/.exec(part);
+        if (field) note(field[1], Boolean(field[2]));
+      }
+    }
+    const file = (0, import_node_path7.relative)(rootDir, abs).split(import_node_path7.sep).join("/");
+    for (const [name, hasFallback] of inFile) reads.push({ name, file, hasFallback });
+  }
+  return reads;
+}
+function envFileNames(rootDir) {
+  const names = /* @__PURE__ */ new Set();
+  if (!(0, import_node_fs5.existsSync)(rootDir)) return names;
+  for (const entry of (0, import_node_fs5.readdirSync)(rootDir, { withFileTypes: true })) {
+    if (!entry.isFile() || !(entry.name === ".env" || entry.name.startsWith(".env."))) continue;
+    let text;
+    try {
+      text = (0, import_node_fs5.readFileSync)((0, import_node_path7.join)(rootDir, entry.name), "utf8");
+    } catch {
+      continue;
+    }
+    for (const line of text.split("\n")) {
+      const m = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/.exec(line);
+      if (m) names.add(m[1]);
+    }
+  }
+  return names;
+}
+var sampleFiles = (files) => files.slice(0, 3).join(", ") + (files.length > 3 ? ", \u2026" : "");
+var prefixList = (prefixes) => prefixes.map((p) => `${p}*`).join("/");
+function platformHint(name, opts) {
+  const { prefix, suffix } = splitName(name);
+  const entry = injectedEntry(suffix);
+  if (!entry.prefixes.includes(prefix)) {
+    return `The platform defines ${suffix} only as ${entry.prefixes.map((p) => `${p}${suffix}`).join(" and ")} \u2014 read one of those, or keep the value in an ordinary source constant.`;
+  }
+  if (entry.when === "byo_supabase") {
+    if ((opts.rejected || []).includes(suffix)) {
+      return "The key stored for this database looks like a Supabase SECRET key. The platform refuses to put it into a public bundle \u2014 store the publishable (anon) key as `database.anon_key` in the Backend tab instead.";
+    }
+    if (opts.provider === "supabase" && (opts.missing || []).includes(suffix)) {
+      return suffix === "SUPABASE_URL" ? "Your own Supabase database is connected, but no https project URL is stored \u2014 set it in the Backend tab (Database)." : "Your own Supabase database is connected, but no publishable key is stored \u2014 add it in the Backend tab as `database.anon_key`.";
+    }
+    return `The platform defines ${suffix} (as ${prefixList(entry.prefixes)}) only while your own Supabase database is connected in the Backend tab (Database \u2192 own Supabase). Connect it there, or keep the public value in an ordinary source constant.`;
+  }
+  return "Keep the public value in an ordinary source constant.";
+}
+function judgeEnvReads(reads, opts) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const read of reads) {
+    if (opts.defined.has(read.name)) continue;
+    byName.set(read.name, [...byName.get(read.name) || [], read]);
+  }
+  const verdict = { errors: [], warnings: [] };
+  const build = opts.backendUnknown ? "the cloud build" : "this build";
+  for (const name of [...byName.keys()].sort()) {
+    const group = byName.get(name);
+    const files = sampleFiles(group.map((r) => r.file).sort());
+    const { prefix, suffix } = splitName(name);
+    const entry = injectedEntry(suffix);
+    const taught = entry !== void 0;
+    const bare = group.filter((r) => !r.hasFallback);
+    const local = opts.localOnly?.has(name) ? " Your local .env defines it, but .env files never leave this machine." : "";
+    if (opts.backendUnknown && entry && entry.when === "byo_supabase" && entry.prefixes.includes(prefix)) {
+      verdict.warnings.push(
+        `${name} is read in ${files}. The cloud build defines it only while your own Supabase database is connected in the Backend tab (Database \u2192 own Supabase)` + (bare.length > 0 ? " \u2014 without that it rejects the build, because the value would compile to `undefined` without any build error." : "; without that the app runs on its own fallback.") + local
+      );
+    } else if (taught && bare.length > 0) {
+      verdict.errors.push(
+        `${name} is read in ${sampleFiles(bare.map((r) => r.file).sort())}, but ${build} does not define it \u2014 it would compile to \`undefined\` without any build error. ${platformHint(name, opts)}${local}`
+      );
+    } else if (taught) {
+      verdict.warnings.push(
+        `${name} is read in ${files} and ${build} does not define it \u2014 the app runs on its own fallback. ${platformHint(name, opts)}${local}`
+      );
+    } else {
+      verdict.warnings.push(
+        `${name} is read in ${files}, but no cloud build defines it \u2014 it compiles to \`undefined\`. This platform sets no build variables of your own: keep public values in an ordinary source constant (a fallback such as \`?? '/api'\` is fine).${local}`
+      );
+    }
+  }
+  return verdict;
+}
+
 // src/lib/preflight.ts
 function feature(id) {
   const found = contract_default.forbidden_server_features.find((f) => f.id === id);
@@ -5851,14 +6011,14 @@ var STATIC_EXPORT = /output\s*:\s*['"]export['"]/;
 var SOURCE_FILE = /\.(js|jsx|ts|tsx|mjs)$/;
 var GET_SERVER_SIDE_PROPS = /export\s+(?:async\s+)?(?:function|const|let|var)\s+getServerSideProps\b|export\s*\{[^}]*\bgetServerSideProps\b[^}]*\}/;
 var USE_SERVER = /^\s*(['"])use server\1\s*;?\s*$/m;
-var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".next", ".git", "dist", "build", "out"]);
-var SCAN_FILE_BUDGET = 5e3;
+var SKIP_DIRS2 = /* @__PURE__ */ new Set(["node_modules", ".next", ".git", "dist", "build", "out"]);
+var SCAN_FILE_BUDGET2 = 5e3;
 function detectFramework(rootDir) {
-  const pkgPath = (0, import_node_path7.join)(rootDir, "package.json");
-  if (!(0, import_node_fs5.existsSync)(pkgPath)) return "vanilla";
+  const pkgPath = (0, import_node_path8.join)(rootDir, "package.json");
+  if (!(0, import_node_fs6.existsSync)(pkgPath)) return "vanilla";
   let pkg;
   try {
-    pkg = JSON.parse((0, import_node_fs5.readFileSync)(pkgPath, "utf8"));
+    pkg = JSON.parse((0, import_node_fs6.readFileSync)(pkgPath, "utf8"));
   } catch {
     return "unknown";
   }
@@ -5868,32 +6028,32 @@ function detectFramework(rootDir) {
 }
 function readDeps(rootDir) {
   try {
-    const pkg = JSON.parse((0, import_node_fs5.readFileSync)((0, import_node_path7.join)(rootDir, "package.json"), "utf8"));
+    const pkg = JSON.parse((0, import_node_fs6.readFileSync)((0, import_node_path8.join)(rootDir, "package.json"), "utf8"));
     return { ...pkg.dependencies, ...pkg.devDependencies };
   } catch {
     return {};
   }
 }
 function findFiles(rootDir, dir, pattern, out, cap = 20) {
-  if (out.length >= cap || !(0, import_node_fs5.existsSync)(dir)) return;
-  for (const entry of (0, import_node_fs5.readdirSync)(dir, { withFileTypes: true })) {
+  if (out.length >= cap || !(0, import_node_fs6.existsSync)(dir)) return;
+  for (const entry of (0, import_node_fs6.readdirSync)(dir, { withFileTypes: true })) {
     if (out.length >= cap) return;
-    const abs = (0, import_node_path7.join)(dir, entry.name);
+    const abs = (0, import_node_path8.join)(dir, entry.name);
     if (entry.isDirectory()) {
-      if (!SKIP_DIRS.has(entry.name)) findFiles(rootDir, abs, pattern, out, cap);
+      if (!SKIP_DIRS2.has(entry.name)) findFiles(rootDir, abs, pattern, out, cap);
     } else if (entry.isFile() && pattern.test(entry.name)) {
-      out.push((0, import_node_path7.relative)(rootDir, abs).split(import_node_path7.sep).join("/"));
+      out.push((0, import_node_path8.relative)(rootDir, abs).split(import_node_path8.sep).join("/"));
     }
   }
 }
 var sample = (list) => list.slice(0, 3).join(", ") + (list.length > 3 ? ", \u2026" : "");
 function collectSourceFiles(dir, out, budget) {
-  if (budget.left <= 0 || !(0, import_node_fs5.existsSync)(dir)) return;
-  for (const entry of (0, import_node_fs5.readdirSync)(dir, { withFileTypes: true })) {
+  if (budget.left <= 0 || !(0, import_node_fs6.existsSync)(dir)) return;
+  for (const entry of (0, import_node_fs6.readdirSync)(dir, { withFileTypes: true })) {
     if (budget.left <= 0) return;
-    const abs = (0, import_node_path7.join)(dir, entry.name);
+    const abs = (0, import_node_path8.join)(dir, entry.name);
     if (entry.isDirectory()) {
-      if (!SKIP_DIRS.has(entry.name)) collectSourceFiles(abs, out, budget);
+      if (!SKIP_DIRS2.has(entry.name)) collectSourceFiles(abs, out, budget);
     } else if (entry.isFile() && SOURCE_FILE.test(entry.name)) {
       budget.left--;
       out.push(abs);
@@ -5903,10 +6063,10 @@ function collectSourceFiles(dir, out, budget) {
 function checkNextjs(rootDir) {
   const issues = [];
   const warnings = [];
-  const configName = NEXT_CONFIG_BASENAMES.find((name) => (0, import_node_fs5.existsSync)((0, import_node_path7.join)(rootDir, name)));
+  const configName = NEXT_CONFIG_BASENAMES.find((name) => (0, import_node_fs6.existsSync)((0, import_node_path8.join)(rootDir, name)));
   let hasStaticExport = true;
   if (configName) {
-    const config = (0, import_node_fs5.readFileSync)((0, import_node_path7.join)(rootDir, configName), "utf8");
+    const config = (0, import_node_fs6.readFileSync)((0, import_node_path8.join)(rootDir, configName), "utf8");
     hasStaticExport = STATIC_EXPORT.test(config);
     if (!hasStaticExport) {
       issues.push(
@@ -5920,31 +6080,31 @@ function checkNextjs(rootDir) {
   const hard = [];
   const pagesApi = [];
   for (const apiDir of PAGES_API_DIRS) {
-    findFiles(rootDir, (0, import_node_path7.join)(rootDir, apiDir), /\.(js|ts|jsx|tsx|mjs)$/, pagesApi);
+    findFiles(rootDir, (0, import_node_path8.join)(rootDir, apiDir), /\.(js|ts|jsx|tsx|mjs)$/, pagesApi);
   }
   if (pagesApi.length > 0) hard.push(`pages/api/* routes (${pagesApi.length} file(s))`);
   const middlewareFiles = [];
   for (const base of ["", "src"]) {
-    const dir = base ? (0, import_node_path7.join)(rootDir, base) : rootDir;
-    if (!(0, import_node_fs5.existsSync)(dir)) continue;
-    for (const entry of (0, import_node_fs5.readdirSync)(dir)) {
-      if (MIDDLEWARE_FILE.test(entry)) middlewareFiles.push((0, import_node_path7.join)(base, entry).split(import_node_path7.sep).join("/"));
+    const dir = base ? (0, import_node_path8.join)(rootDir, base) : rootDir;
+    if (!(0, import_node_fs6.existsSync)(dir)) continue;
+    for (const entry of (0, import_node_fs6.readdirSync)(dir)) {
+      if (MIDDLEWARE_FILE.test(entry)) middlewareFiles.push((0, import_node_path8.join)(base, entry).split(import_node_path8.sep).join("/"));
     }
   }
   hard.push(...middlewareFiles);
   const sourceFiles = [];
-  collectSourceFiles(rootDir, sourceFiles, { left: SCAN_FILE_BUDGET });
+  collectSourceFiles(rootDir, sourceFiles, { left: SCAN_FILE_BUDGET2 });
   const gssp = [];
   const useServer = [];
   for (const abs of sourceFiles) {
     if (gssp.length >= 20 && useServer.length >= 20) break;
     let text;
     try {
-      text = (0, import_node_fs5.readFileSync)(abs, "utf8");
+      text = (0, import_node_fs6.readFileSync)(abs, "utf8");
     } catch {
       continue;
     }
-    const rel = (0, import_node_path7.relative)(rootDir, abs).split(import_node_path7.sep).join("/");
+    const rel = (0, import_node_path8.relative)(rootDir, abs).split(import_node_path8.sep).join("/");
     if (gssp.length < 20 && GET_SERVER_SIDE_PROPS.test(text)) gssp.push(rel);
     if (useServer.length < 20 && USE_SERVER.test(text)) useServer.push(rel);
   }
@@ -5952,7 +6112,7 @@ function checkNextjs(rootDir) {
   if (useServer.length > 0) hard.push(`'use server' actions (${sample(useServer)})`);
   const routeFiles = [];
   for (const appDir of APP_DIRS) {
-    findFiles(rootDir, (0, import_node_path7.join)(rootDir, appDir), ROUTE_HANDLER_FILE, routeFiles);
+    findFiles(rootDir, (0, import_node_path8.join)(rootDir, appDir), ROUTE_HANDLER_FILE, routeFiles);
   }
   if (routeFiles.length > 0) {
     const label = `${routeFiles.length} route handler(s) (${sample(routeFiles)})`;
@@ -5986,6 +6146,17 @@ function checkNextjs(rootDir) {
   }
   return { issues, warnings };
 }
+function checkBuildEnv(rootDir) {
+  const verdict = judgeEnvReads(scanEnvReads(rootDir), {
+    defined: ALWAYS_DEFINED_NAMES,
+    backendUnknown: true,
+    localOnly: envFileNames(rootDir)
+  });
+  return [
+    ...verdict.errors.map((e) => `The cloud build will reject this project: ${e}`),
+    ...verdict.warnings
+  ];
+}
 function runPreflight(rootDir) {
   const framework = detectFramework(rootDir);
   const issues = [];
@@ -6000,17 +6171,18 @@ function runPreflight(rootDir) {
     issues.push(...next.issues);
     warnings.push(...next.warnings);
   }
+  if (framework !== "vanilla") warnings.push(...checkBuildEnv(rootDir));
   return { framework, issues, warnings };
 }
 
 // src/lib/backendDecl.ts
-var import_node_fs6 = require("fs");
-var import_node_path8 = require("path");
+var import_node_fs7 = require("fs");
+var import_node_path9 = require("path");
 function readBackendDeclaration(dir = process.cwd()) {
-  const path = (0, import_node_path8.join)(dir, ".agentful", "backend.json");
-  if (!(0, import_node_fs6.existsSync)(path)) return null;
+  const path = (0, import_node_path9.join)(dir, ".agentful", "backend.json");
+  if (!(0, import_node_fs7.existsSync)(path)) return null;
   try {
-    const parsed = JSON.parse((0, import_node_fs6.readFileSync)(path, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs7.readFileSync)(path, "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
     const collections = Array.isArray(parsed.collections) ? parsed.collections.filter((c) => c && typeof c === "object" && !Array.isArray(c)) : [];
     const secrets = Array.isArray(parsed.secrets) ? parsed.secrets.filter((s) => s && typeof s === "object" && !Array.isArray(s)) : [];
@@ -6054,19 +6226,19 @@ function describeBackendDeclaration(decl) {
 function backendTabUrl(userId, projectId) {
   return `${APP_URL}/workspace/${userId}/${projectId}?view=backend`;
 }
-var ACTIONS_DIR = (0, import_node_path8.join)(".server", "actions");
+var ACTIONS_DIR = (0, import_node_path9.join)(".server", "actions");
 var ACTION_NAME = /^[a-z][a-z0-9_-]{0,62}$/;
 function checkBackendDeclaration(rootDir = process.cwd()) {
   const issues = [];
   const warnings = [];
-  const actionsDir = (0, import_node_path8.join)(rootDir, ACTIONS_DIR);
+  const actionsDir = (0, import_node_path9.join)(rootDir, ACTIONS_DIR);
   const presentFiles = /* @__PURE__ */ new Set();
-  if ((0, import_node_fs6.existsSync)(actionsDir)) {
-    for (const entry of (0, import_node_fs6.readdirSync)(actionsDir)) {
-      const abs = (0, import_node_path8.join)(actionsDir, entry);
+  if ((0, import_node_fs7.existsSync)(actionsDir)) {
+    for (const entry of (0, import_node_fs7.readdirSync)(actionsDir)) {
+      const abs = (0, import_node_path9.join)(actionsDir, entry);
       let isDir = false;
       try {
-        isDir = (0, import_node_fs6.statSync)(abs).isDirectory();
+        isDir = (0, import_node_fs7.statSync)(abs).isDirectory();
       } catch {
         continue;
       }
@@ -6118,6 +6290,7 @@ function checkBackendDeclaration(rootDir = process.cwd()) {
 }
 
 // src/lib/backendSync.ts
+var SWITCH_OFF_DELAY_S = contract_default.server_side.managed_actions.limits.switch_off_delay_s;
 var joinMethods = (methods) => methods && methods.length ? methods.join(" + ") : "none";
 function purposeOf(declaration, key) {
   const entry = (declaration?.secrets ?? []).find((s) => s.key === key);
@@ -6260,9 +6433,9 @@ async function fetchBackendSessionState(auth, userId, projectId, opts = {}) {
 }
 function describeServerState(state) {
   if (state.serverEnabled) {
-    return "Server: managed, enabled (Server Actions \u2014 functions we run for you). There is no activation point: pushed action code can change what the published app does immediately; warm instances may serve the previous code for up to five minutes.";
+    return `Server: managed, enabled (Server Actions \u2014 functions we run for you). There is no activation point: pushed action code can change what the published app does immediately; warm instances may serve the previous code for up to five minutes. Switching it off in the Backend tab stops every action within ${SWITCH_OFF_DELAY_S} s.`;
   }
-  const notOn = "Action files you push are still executable through the platform API \u2014 the switch does not turn them off. It controls /api/* routing on the app's own domain and the sync of server.* secrets.";
+  const notOn = "Action files you push are stored, but calls to them answer 404 server_not_enabled until you switch the managed server on in the Backend tab (`agentful backend` opens it \u2014 the CLI can enable the database, not the server). Switching on takes effect on the next call.";
   if (state.serverMode === "byo") {
     return `Server: your own API (${state.serverStatus || "not active"}) \u2014 /api/* on the app's domain is forwarded to it. Managed server: not switched on. ${notOn}`;
   }
@@ -6282,8 +6455,8 @@ function describeBackendState(state) {
 }
 
 // src/lib/backendConsent.ts
-var import_node_fs7 = require("fs");
-var import_node_path9 = require("path");
+var import_node_fs8 = require("fs");
+var import_node_path10 = require("path");
 var import_promises2 = require("readline/promises");
 function declaresManagedDatabase(decl) {
   if (!decl) return false;
@@ -6309,10 +6482,10 @@ function consentQuestion(decl) {
     'It is the same switch as the Backend tab; this push then applies the declaration. A "no" is remembered for this project (`agentful push --yes` or `agentful backend` enables it later).'
   ].join("\n");
 }
-var consentFile = () => (0, import_node_path9.join)(configDir(), "backend-consent.json");
+var consentFile = () => (0, import_node_path10.join)(configDir(), "backend-consent.json");
 function readConsentFile() {
   try {
-    const raw = JSON.parse((0, import_node_fs7.readFileSync)(consentFile(), "utf8"));
+    const raw = JSON.parse((0, import_node_fs8.readFileSync)(consentFile(), "utf8"));
     return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
   } catch {
     return {};
@@ -6324,15 +6497,15 @@ function hasRememberedDecline(projectId) {
 function rememberDecline(projectId) {
   const all = readConsentFile();
   all[projectId] = { declined_at: (/* @__PURE__ */ new Date()).toISOString() };
-  (0, import_node_fs7.mkdirSync)(configDir(), { recursive: true });
-  (0, import_node_fs7.writeFileSync)(consentFile(), JSON.stringify(all, null, 2) + "\n", "utf8");
+  (0, import_node_fs8.mkdirSync)(configDir(), { recursive: true });
+  (0, import_node_fs8.writeFileSync)(consentFile(), JSON.stringify(all, null, 2) + "\n", "utf8");
 }
 function forgetDecline(projectId) {
-  if (!(0, import_node_fs7.existsSync)(consentFile())) return;
+  if (!(0, import_node_fs8.existsSync)(consentFile())) return;
   const all = readConsentFile();
   if (!(projectId in all)) return;
   delete all[projectId];
-  (0, import_node_fs7.writeFileSync)(consentFile(), JSON.stringify(all, null, 2) + "\n", "utf8");
+  (0, import_node_fs8.writeFileSync)(consentFile(), JSON.stringify(all, null, 2) + "\n", "utf8");
 }
 async function enableManagedDatabase(auth, userId, projectId) {
   try {
@@ -6540,13 +6713,14 @@ async function pushCommand(opts) {
     ui.step("Building in the cloud (this can take a few minutes)\u2026");
     const buildStartedAt = Date.now();
     try {
-      await request(`${PB_URL}/api/workspaces/${userId}/${projectId}/build`, {
+      const built = await request(`${PB_URL}/api/workspaces/${userId}/${projectId}/build`, {
         method: "POST",
         token: auth.pb_token,
         body: {},
         timeoutMs: 66e4
       });
       ui.info("Build finished");
+      for (const warning of built?.warnings ?? []) ui.warn(warning);
     } catch (err2) {
       if (err2 instanceof ApiError && err2.code === "network_error") {
         ui.warn("Connection dropped during the build \u2014 polling for the result\u2026");
@@ -6709,15 +6883,15 @@ async function openCommand() {
 // src/commands/tui.ts
 var import_node_child_process6 = require("child_process");
 var import_promises4 = require("readline/promises");
-var import_node_path20 = require("path");
+var import_node_path21 = require("path");
 
 // src/lib/binWrapper.ts
-var import_node_fs8 = require("fs");
-var import_node_path10 = require("path");
+var import_node_fs9 = require("fs");
+var import_node_path11 = require("path");
 var import_node_os3 = require("os");
 function ensureCliOnPath() {
-  const binDir = (0, import_node_path10.join)((0, import_node_os3.homedir)(), ".local", "share", "agentful", "bin");
-  (0, import_node_fs8.mkdirSync)(binDir, { recursive: true });
+  const binDir = (0, import_node_path11.join)((0, import_node_os3.homedir)(), ".local", "share", "agentful", "bin");
+  (0, import_node_fs9.mkdirSync)(binDir, { recursive: true });
   const entry = process.argv[1];
   if (!entry) return binDir;
   const restore = (name) => {
@@ -6726,8 +6900,8 @@ function ensureCliOnPath() {
 ` : `export ${name}=${JSON.stringify(original)}
 `;
   };
-  const wrapper = (0, import_node_path10.join)(binDir, "agentful");
-  (0, import_node_fs8.writeFileSync)(
+  const wrapper = (0, import_node_path11.join)(binDir, "agentful");
+  (0, import_node_fs9.writeFileSync)(
     wrapper,
     `#!/bin/sh
 # Generated by the Agentful CLI so the coding agent can run \`agentful \u2026\`.
@@ -6737,7 +6911,7 @@ function ensureCliOnPath() {
     "utf8"
   );
   try {
-    (0, import_node_fs8.chmodSync)(wrapper, 493);
+    (0, import_node_fs9.chmodSync)(wrapper, 493);
   } catch {
   }
   return binDir;
@@ -6747,9 +6921,9 @@ function ensureCliOnPath() {
 init_branding();
 
 // src/lib/engine.ts
-var import_node_fs9 = require("fs");
+var import_node_fs10 = require("fs");
 var import_node_crypto = require("crypto");
-var import_node_path11 = require("path");
+var import_node_path12 = require("path");
 var import_node_os4 = require("os");
 var import_node_child_process3 = require("child_process");
 var import_node_stream = require("stream");
@@ -6794,8 +6968,8 @@ function platformKey() {
   );
 }
 function cacheDir(version) {
-  const base = process.env.XDG_CACHE_HOME || (0, import_node_path11.join)((0, import_node_os4.homedir)(), ".cache");
-  return (0, import_node_path11.join)(base, "agentful", "engine", version);
+  const base = process.env.XDG_CACHE_HOME || (0, import_node_path12.join)((0, import_node_os4.homedir)(), ".cache");
+  return (0, import_node_path12.join)(base, "agentful", "engine", version);
 }
 async function fetchManifest() {
   try {
@@ -6806,7 +6980,7 @@ async function fetchManifest() {
 }
 async function sha256File(path) {
   const hash = (0, import_node_crypto.createHash)("sha256");
-  await (0, import_promises3.pipeline)((0, import_node_fs9.createReadStream)(path), hash);
+  await (0, import_promises3.pipeline)((0, import_node_fs10.createReadStream)(path), hash);
   return hash.digest("hex");
 }
 async function ensureEngine() {
@@ -6815,12 +6989,12 @@ async function ensureEngine() {
   noticeIfOutdated(manifest);
   const version = manifest?.engine_version || FALLBACK_ENGINE_VERSION;
   const dir = cacheDir(version);
-  const binPath = (0, import_node_path11.join)(dir, ENGINE_BINARY);
-  if ((0, import_node_fs9.existsSync)(binPath)) return binPath;
+  const binPath = (0, import_node_path12.join)(dir, ENGINE_BINARY);
+  if ((0, import_node_fs10.existsSync)(binPath)) return binPath;
   const artifact = manifest?.artifacts?.[key];
   const url = artifact?.url || `${APP_URL}/cli/engine/${version}/${key}${key.startsWith("darwin") ? ".zip" : ".tar.gz"}`;
-  (0, import_node_fs9.mkdirSync)(dir, { recursive: true });
-  const archivePath = (0, import_node_path11.join)(dir, key.startsWith("darwin") ? "engine.zip" : "engine.tar.gz");
+  (0, import_node_fs10.mkdirSync)(dir, { recursive: true });
+  const archivePath = (0, import_node_path12.join)(dir, key.startsWith("darwin") ? "engine.zip" : "engine.tar.gz");
   ui.step(`Preparing the ${brand.displayName} engine (first run only)\u2026`);
   const resp = await fetch(url, {
     redirect: "follow",
@@ -6834,11 +7008,11 @@ async function ensureEngine() {
       `Could not download the engine (HTTP ${resp.status}). Check your connection and try again.`
     );
   }
-  await (0, import_promises3.pipeline)(import_node_stream.Readable.fromWeb(resp.body), (0, import_node_fs9.createWriteStream)(archivePath));
+  await (0, import_promises3.pipeline)(import_node_stream.Readable.fromWeb(resp.body), (0, import_node_fs10.createWriteStream)(archivePath));
   if (artifact?.sha256) {
     const actual = await sha256File(archivePath);
     if (actual !== artifact.sha256) {
-      (0, import_node_fs9.rmSync)(archivePath, { force: true });
+      (0, import_node_fs10.rmSync)(archivePath, { force: true });
       throw new ApiError(
         0,
         "engine_checksum_mismatch",
@@ -6847,7 +7021,7 @@ async function ensureEngine() {
     }
   }
   const extract = archivePath.endsWith(".zip") ? (0, import_node_child_process3.spawnSync)("unzip", ["-oq", archivePath], { cwd: dir, stdio: "ignore" }) : (0, import_node_child_process3.spawnSync)("tar", ["-xzf", archivePath], { cwd: dir, stdio: "ignore" });
-  (0, import_node_fs9.rmSync)(archivePath, { force: true });
+  (0, import_node_fs10.rmSync)(archivePath, { force: true });
   if (extract.status !== 0) {
     throw new ApiError(
       0,
@@ -6855,24 +7029,24 @@ async function ensureEngine() {
       `Could not unpack the engine (needs ${archivePath.endsWith(".zip") ? "unzip" : "tar"} on PATH).`
     );
   }
-  const extracted = (0, import_node_path11.join)(dir, "opencode");
-  if ((0, import_node_fs9.existsSync)(extracted) && !(0, import_node_fs9.existsSync)(binPath)) (0, import_node_fs9.renameSync)(extracted, binPath);
-  if (!(0, import_node_fs9.existsSync)(binPath)) {
+  const extracted = (0, import_node_path12.join)(dir, "opencode");
+  if ((0, import_node_fs10.existsSync)(extracted) && !(0, import_node_fs10.existsSync)(binPath)) (0, import_node_fs10.renameSync)(extracted, binPath);
+  if (!(0, import_node_fs10.existsSync)(binPath)) {
     throw new ApiError(0, "engine_extract_failed", "Engine archive did not contain the expected binary.");
   }
-  (0, import_node_fs9.chmodSync)(binPath, 493);
+  (0, import_node_fs10.chmodSync)(binPath, 493);
   ui.ok(`Engine ready.`);
   console.log(paint.dim("  powered by opencode (MIT) \xB7 run `agentful licenses` for details"));
   return binPath;
 }
 
 // src/lib/gatewayToken.ts
-var import_node_fs10 = require("fs");
-var import_node_path12 = require("path");
-var cachePath = () => (0, import_node_path12.join)(configDir(), "gateway.json");
+var import_node_fs11 = require("fs");
+var import_node_path13 = require("path");
+var cachePath = () => (0, import_node_path13.join)(configDir(), "gateway.json");
 async function ensureGatewaySession(auth, projectId) {
   try {
-    const cached = JSON.parse((0, import_node_fs10.readFileSync)(cachePath(), "utf8"));
+    const cached = JSON.parse((0, import_node_fs11.readFileSync)(cachePath(), "utf8"));
     if (cached?.token && cached.expires_at - Date.now() / 1e3 > 3600) {
       return cached;
     }
@@ -6883,18 +7057,18 @@ async function ensureGatewaySession(auth, projectId) {
     body: projectId ? { project_id: projectId } : {},
     timeoutMs: 3e4
   });
-  (0, import_node_fs10.mkdirSync)(configDir(), { recursive: true });
-  (0, import_node_fs10.writeFileSync)(cachePath(), JSON.stringify(res, null, 2) + "\n", "utf8");
+  (0, import_node_fs11.mkdirSync)(configDir(), { recursive: true });
+  (0, import_node_fs11.writeFileSync)(cachePath(), JSON.stringify(res, null, 2) + "\n", "utf8");
   try {
-    (0, import_node_fs10.chmodSync)(cachePath(), 384);
+    (0, import_node_fs11.chmodSync)(cachePath(), 384);
   } catch {
   }
   return res;
 }
 
 // src/lib/engineConfig.ts
-var import_node_fs12 = require("fs");
-var import_node_path14 = require("path");
+var import_node_fs13 = require("fs");
+var import_node_path15 = require("path");
 var import_node_os5 = require("os");
 
 // src/branding/agentful-theme.json
@@ -7037,22 +7211,22 @@ ${cmd.template}
 }
 
 // src/lib/tools.ts
-var import_node_fs11 = require("fs");
-var import_node_path13 = require("path");
+var import_node_fs12 = require("fs");
+var import_node_path14 = require("path");
 function assetsDir() {
-  const here = (0, import_node_path13.dirname)(process.argv[1] || "");
-  for (const candidate of [(0, import_node_path13.join)(here, "..", "assets"), (0, import_node_path13.join)(here, "assets")]) {
-    if ((0, import_node_fs11.existsSync)((0, import_node_path13.join)(candidate, "tools", "imagegen.ts"))) return candidate;
+  const here = (0, import_node_path14.dirname)(process.argv[1] || "");
+  for (const candidate of [(0, import_node_path14.join)(here, "..", "assets"), (0, import_node_path14.join)(here, "assets")]) {
+    if ((0, import_node_fs12.existsSync)((0, import_node_path14.join)(candidate, "tools", "imagegen.ts"))) return candidate;
   }
   return null;
 }
 function installEngineTools(configDir2) {
   const assets = assetsDir();
   if (!assets) return false;
-  const target = (0, import_node_path13.join)(configDir2, "tools");
-  (0, import_node_fs11.mkdirSync)(target, { recursive: true });
+  const target = (0, import_node_path14.join)(configDir2, "tools");
+  (0, import_node_fs12.mkdirSync)(target, { recursive: true });
   try {
-    (0, import_node_fs11.cpSync)((0, import_node_path13.join)(assets, "tools"), target, { recursive: true });
+    (0, import_node_fs12.cpSync)((0, import_node_path14.join)(assets, "tools"), target, { recursive: true });
     return true;
   } catch {
     return false;
@@ -7115,11 +7289,20 @@ function backendSessionLines(backend) {
   return lines.join("\n");
 }
 function managedServerLine(backend) {
+  const delay2 = contract_default.server_side.managed_actions.limits.switch_off_delay_s;
   if (backend.serverEnabled) {
-    return "Managed server: **enabled**. **There is no activation point:** pushed action source can change what the published app does immediately, while warm instances may keep serving the previous code for up to five minutes.";
+    return `Managed server: **enabled**. **There is no activation point:** pushed action source can change what the published app does immediately, while warm instances may keep serving the previous code for up to five minutes. Switching the server off in the Backend tab stops every action within ${delay2} s.`;
   }
   const ownApi = backend.serverMode === "byo" ? "Server: the owner connected **an API of their own** \u2014 `/api/*` on the app's domain is forwarded to it, and the platform adds no secret and authorizes nobody. " : "";
-  return `${ownApi}Managed server: **not switched on** in the Backend tab. **Action files you push are still executable through the platform API** \u2014 the switch does not turn them off. It controls \`/api/*\` routing on the app's own domain and the sync of \`server.*\` secrets.`;
+  return `${ownApi}Managed server: **not switched on** in the Backend tab. **Action files you push are stored, but every call to them answers \`404 server_not_enabled\`** until the owner switches the managed server on (\`agentful backend\` opens the tab; the CLI can enable the database, NOT the server). Switching on takes effect on the next call. Never tell the user an action works before the server is on.`;
+}
+function buildEnvList() {
+  const entries = contract_default.publish.build_env.injected;
+  const when = {
+    always: "always",
+    byo_supabase: "only while the owner's own Supabase database is connected in the Backend tab"
+  };
+  return entries.map((e) => `  - ${e.prefixes.map((p) => `\`${p}${e.suffix}\``).join(", ")} \u2014 ${when[e.when] ?? e.when}`).join("\n");
 }
 var bytes = (n) => n >= 1024 * 1024 ? `${n / (1024 * 1024)} MB` : `${n / 1024} KB`;
 function serverSideSection() {
@@ -7130,6 +7313,7 @@ function serverSideSection() {
       `### ${heading} ${t.label}`,
       "",
       t.summary,
+      ...t.switch_note ? ["", t.switch_note] : [],
       "",
       "Offers:",
       ...t.offers.map((o) => `- ${o}`),
@@ -7147,7 +7331,7 @@ function serverSideSection() {
     track(
       "managed_actions",
       "(a)",
-      `${a.action_timeout_budget_s} s budget per action, ${a.hard_timeout_s} s hard limit, ${a.memory_mb} MB memory, request body \u2264 ${bytes(a.max_body_bytes)}, action source \u2264 ${bytes(a.max_code_bytes)}, ${a.project_concurrency} concurrent calls per project, self-call depth \u2264 ${a.max_action_depth}.`
+      `${a.action_timeout_budget_s} s budget per action, ${a.hard_timeout_s} s hard limit, ${a.memory_mb} MB memory, request body \u2264 ${bytes(a.max_body_bytes)}, action source \u2264 ${bytes(a.max_code_bytes)}, ${a.project_concurrency} concurrent calls per project, self-call depth \u2264 ${a.max_action_depth}, switch-off delay \u2264 ${a.switch_off_delay_s} s.`
     ),
     track("own_api", "(b)", null),
     track(
@@ -7175,18 +7359,26 @@ is fine \u2014 but then say clearly that \`agentful push\` cannot deploy it.
   Server-side logic has its own place \u2014 see "Where server logic belongs".
 - The canonical build output is a root-level \`index.html\` inside the
   framework's output directory.
-- There are **no build-time env vars**: the cloud build injects nothing beyond
-  NODE_ENV. There is no settings tab for build secrets \u2014 do not invent one.
-  Backend-tab secrets are runtime-only for Managed Server Actions and never
-  reach a build; the workspace executor injects only allowlisted PUBLIC client
-  vars (\`database.anon_key\`/\`publishable_key\` expanded as
-  \`VITE_\`/\`PUBLIC_\`/\`NEXT_PUBLIC_\`). Never rely on \`.env*\` files reaching the
-  cloud \u2014 the CLI and server both strip them.
-- So PUBLIC client values go into an ordinary source constant, not into
-  \`import.meta.env\`/\`process.env\`: the project ID (below) and, when the app
-  talks to the owner's own Supabase, its project URL and **publishable (anon)
-  key**. In an \`agentful push\` build \`import.meta.env.VITE_SUPABASE_URL\` is
-  \`undefined\` \u2014 the app would compile and then fail to reach its database.
+- You **cannot set build-time env vars**, and there is no settings tab for
+  build secrets \u2014 do not invent one. Backend-tab secrets are runtime-only for
+  Managed Server Actions and never reach a build. Every cloud build \u2014 the
+  workspace build and the \`agentful push\` build alike \u2014 defines the same
+  fixed allowlist of PUBLIC client values, and nothing else:
+${buildEnvList()}
+  Never rely on \`.env*\` files reaching the cloud \u2014 the CLI never uploads
+  them.
+- A cloud build **rejects** a read of one of those names while nothing defines
+  it (e.g. \`import.meta.env.VITE_SUPABASE_URL\` with no own Supabase database
+  connected): it would compile to \`undefined\` without any build error and the
+  app would fail to reach its database. A read of any OTHER
+  \`VITE_\`/\`PUBLIC_\`/\`NEXT_PUBLIC_\` name is never defined by the platform; the
+  build warns and inlines \`undefined\`.
+- So PUBLIC client values of your own go into an ordinary source constant, not
+  into \`import.meta.env\`/\`process.env\`. For the project ID (below) and, when
+  the app talks to the owner's own Supabase, its project URL and **publishable
+  (anon) key**, a source constant is also the form that works in local
+  development: on this machine nothing defines the names above unless the user
+  keeps a local \`.env\`, which never leaves it.
   Never put a Supabase **secret / service-role key** in source: that one
   belongs in Backend-tab secrets and is only readable from a Managed Server
   Action.
@@ -7337,7 +7529,7 @@ var CLOUD_AGENT_PROMPT = `You are the Agentful Cloud build agent: everything you
 var LOCAL_AGENT_PROMPT = `You are in local-only mode: free local development with no cloud deployment target \u2014 any stack is fine. Be clear that this directory will NOT be deployable with \`agentful push\` unless it satisfies the platform contract in AGENTFUL_CLOUD.md (${SERVER_SIDE_IN_ONE_SENTENCE}). If the user asks to deploy or push, check the contract first and say honestly whether the project can ship on the platform; never claim cloud deployability without evidence.`;
 function readAuthFile(path) {
   try {
-    return (0, import_node_fs12.readFileSync)(path, "utf8");
+    return (0, import_node_fs13.readFileSync)(path, "utf8");
   } catch {
     return null;
   }
@@ -7402,11 +7594,11 @@ function buildEngineConfig(opts) {
   };
 }
 function engineXdg() {
-  const root = (0, import_node_path14.join)((0, import_node_os5.homedir)(), ".local", "share", "agentful");
+  const root = (0, import_node_path15.join)((0, import_node_os5.homedir)(), ".local", "share", "agentful");
   return {
-    configHome: (0, import_node_path14.join)(root, "engine-config"),
-    dataHome: (0, import_node_path14.join)(root, "engine-data"),
-    stateHome: (0, import_node_path14.join)(root, "engine-state")
+    configHome: (0, import_node_path15.join)(root, "engine-config"),
+    dataHome: (0, import_node_path15.join)(root, "engine-data"),
+    stateHome: (0, import_node_path15.join)(root, "engine-state")
   };
 }
 async function resolveTheme() {
@@ -7425,24 +7617,24 @@ async function resolveTheme() {
 }
 async function writeEngineSession(session, catalog, localProviders = {}, framework = "unknown", skillsInstruction = null, backendState, model) {
   const xdg = engineXdg();
-  const configDir2 = (0, import_node_path14.join)(xdg.configHome, "opencode");
-  const dataDir = (0, import_node_path14.join)(xdg.dataHome, "opencode");
-  const themesDir = (0, import_node_path14.join)(configDir2, "themes");
-  const pluginsDir = (0, import_node_path14.join)(configDir2, "plugins");
-  const commandsDir = (0, import_node_path14.join)(configDir2, "commands");
-  for (const dir of [themesDir, pluginsDir, commandsDir, dataDir, (0, import_node_path14.join)(xdg.stateHome, "opencode")]) {
-    (0, import_node_fs12.mkdirSync)(dir, { recursive: true });
+  const configDir2 = (0, import_node_path15.join)(xdg.configHome, "opencode");
+  const dataDir = (0, import_node_path15.join)(xdg.dataHome, "opencode");
+  const themesDir = (0, import_node_path15.join)(configDir2, "themes");
+  const pluginsDir = (0, import_node_path15.join)(configDir2, "plugins");
+  const commandsDir = (0, import_node_path15.join)(configDir2, "commands");
+  for (const dir of [themesDir, pluginsDir, commandsDir, dataDir, (0, import_node_path15.join)(xdg.stateHome, "opencode")]) {
+    (0, import_node_fs13.mkdirSync)(dir, { recursive: true });
   }
   const imagegenAvailable = installEngineTools(configDir2) && session.img_on !== false;
-  const cloudInstructionsPath = (0, import_node_path14.join)(configDir2, CLOUD_INSTRUCTIONS_FILENAME);
-  (0, import_node_fs12.writeFileSync)(cloudInstructionsPath, renderCloudInstructions(framework, backendState));
-  const skillsPath = (0, import_node_path14.join)(configDir2, "AGENTFUL_SKILLS.md");
+  const cloudInstructionsPath = (0, import_node_path15.join)(configDir2, CLOUD_INSTRUCTIONS_FILENAME);
+  (0, import_node_fs13.writeFileSync)(cloudInstructionsPath, renderCloudInstructions(framework, backendState));
+  const skillsPath = (0, import_node_path15.join)(configDir2, "AGENTFUL_SKILLS.md");
   const instructionPaths = [cloudInstructionsPath];
   if (skillsInstruction) {
-    (0, import_node_fs12.writeFileSync)(skillsPath, skillsInstruction);
+    (0, import_node_fs13.writeFileSync)(skillsPath, skillsInstruction);
     instructionPaths.push(skillsPath);
   } else {
-    (0, import_node_fs12.rmSync)(skillsPath, { force: true });
+    (0, import_node_fs13.rmSync)(skillsPath, { force: true });
   }
   const config = buildEngineConfig({
     session,
@@ -7452,13 +7644,13 @@ async function writeEngineSession(session, catalog, localProviders = {}, framewo
     instructionPaths,
     model
   });
-  (0, import_node_fs12.writeFileSync)((0, import_node_path14.join)(configDir2, "config.json"), JSON.stringify(config, null, 2));
-  const authPath2 = (0, import_node_path14.join)(dataDir, "auth.json");
-  (0, import_node_fs12.writeFileSync)(authPath2, mergedAuthJson(readAuthFile(authPath2), session.token));
+  (0, import_node_fs13.writeFileSync)((0, import_node_path15.join)(configDir2, "config.json"), JSON.stringify(config, null, 2));
+  const authPath2 = (0, import_node_path15.join)(dataDir, "auth.json");
+  (0, import_node_fs13.writeFileSync)(authPath2, mergedAuthJson(readAuthFile(authPath2), session.token));
   const { brandingPluginSource: brandingPluginSource2 } = await Promise.resolve().then(() => (init_plugin(), plugin_exports));
-  const pluginPath = (0, import_node_path14.join)(pluginsDir, "agentful-branding.tsx");
-  (0, import_node_fs12.writeFileSync)(pluginPath, brandingPluginSource2());
-  (0, import_node_fs12.writeFileSync)((0, import_node_path14.join)(configDir2, "tui.json"), JSON.stringify({
+  const pluginPath = (0, import_node_path15.join)(pluginsDir, "agentful-branding.tsx");
+  (0, import_node_fs13.writeFileSync)(pluginPath, brandingPluginSource2());
+  (0, import_node_fs13.writeFileSync)((0, import_node_path15.join)(configDir2, "tui.json"), JSON.stringify({
     theme: "agentful",
     plugin: [`file://${pluginPath}`],
     // The engine's own sidebar sections are plugins with fixed ids, and
@@ -7470,13 +7662,13 @@ async function writeEngineSession(session, catalog, localProviders = {}, framewo
     // state over this map.
     plugin_enabled: DISABLED_ENGINE_PLUGINS
   }, null, 2));
-  (0, import_node_fs12.writeFileSync)((0, import_node_path14.join)(themesDir, "agentful.json"), JSON.stringify(await resolveTheme(), null, 2));
+  (0, import_node_fs13.writeFileSync)((0, import_node_path15.join)(themesDir, "agentful.json"), JSON.stringify(await resolveTheme(), null, 2));
   for (const name of Object.keys(SLASH_COMMANDS)) {
-    (0, import_node_fs12.writeFileSync)((0, import_node_path14.join)(commandsDir, `${name}.md`), commandMarkdown(name));
+    (0, import_node_fs13.writeFileSync)((0, import_node_path15.join)(commandsDir, `${name}.md`), commandMarkdown(name));
   }
   for (const legacy of ["xdg-config", "xdg-data", "xdg-state"]) {
     try {
-      (0, import_node_fs12.rmSync)((0, import_node_path14.join)((0, import_node_os5.homedir)(), ".local", "share", "agentful", legacy), { recursive: true, force: true });
+      (0, import_node_fs13.rmSync)((0, import_node_path15.join)((0, import_node_os5.homedir)(), ".local", "share", "agentful", legacy), { recursive: true, force: true });
     } catch {
     }
   }
@@ -7484,8 +7676,8 @@ async function writeEngineSession(session, catalog, localProviders = {}, framewo
 }
 
 // src/lib/skills.ts
-var import_node_fs13 = require("fs");
-var import_node_path15 = require("path");
+var import_node_fs14 = require("fs");
+var import_node_path16 = require("path");
 
 // src/generated/skills.json
 var skills_default = {
@@ -7554,7 +7746,7 @@ var SCAFFOLD_BY_FRAMEWORK = {
 };
 function hasVueDependency(rootDir) {
   try {
-    const pkg = JSON.parse((0, import_node_fs13.readFileSync)((0, import_node_path15.join)(rootDir, "package.json"), "utf8"));
+    const pkg = JSON.parse((0, import_node_fs14.readFileSync)((0, import_node_path16.join)(rootDir, "package.json"), "utf8"));
     return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }["vue"]);
   } catch {
     return false;
@@ -7584,7 +7776,7 @@ function renderSkillsInstruction(names) {
   return "# Platform deployment skills (mandatory)\n\nThese are the same skills the cloud build agent loads for this stack.\nFollow them when scaffolding or editing \u2014 they are not optional hints.\n\n" + sections.join("\n\n---\n\n") + "\n";
 }
 function skillsInstructionFor(framework, rootDir) {
-  if (!(0, import_node_fs13.existsSync)(rootDir)) return null;
+  if (!(0, import_node_fs14.existsSync)(rootDir)) return null;
   return renderSkillsInstruction(selectSkills(framework, rootDir));
 }
 
@@ -7732,15 +7924,15 @@ function decideLocalProviders(policy) {
 }
 
 // src/lib/localProviders.ts
-var import_node_fs14 = require("fs");
-var import_node_path16 = require("path");
+var import_node_fs15 = require("fs");
+var import_node_path17 = require("path");
 var LOCAL_PROVIDERS_FILE = "local-providers.json";
 function localProvidersPath() {
-  return (0, import_node_path16.join)(configDir(), LOCAL_PROVIDERS_FILE);
+  return (0, import_node_path17.join)(configDir(), LOCAL_PROVIDERS_FILE);
 }
 function readLocalProviders() {
   try {
-    const raw = JSON.parse((0, import_node_fs14.readFileSync)(localProvidersPath(), "utf8"));
+    const raw = JSON.parse((0, import_node_fs15.readFileSync)(localProvidersPath(), "utf8"));
     if (raw && typeof raw === "object" && !Array.isArray(raw)) {
       const map = raw.providers && typeof raw.providers === "object" ? raw.providers : raw;
       const usable = {};
@@ -7775,8 +7967,8 @@ function resolveLocalProviders(policy) {
 }
 function writeLocalProvidersExample() {
   const path = localProvidersPath();
-  if ((0, import_node_fs14.existsSync)(path)) return path;
-  (0, import_node_fs14.mkdirSync)(configDir(), { recursive: true });
+  if ((0, import_node_fs15.existsSync)(path)) return path;
+  (0, import_node_fs15.mkdirSync)(configDir(), { recursive: true });
   const example = {
     _comment: 'Providers with your own API key, running locally. Requests go directly to the provider \u2014 no Agentful credits, no platform region guarantee. Remove the leading underscore from "_anthropic" and fill in your key to enable it.',
     _anthropic: {
@@ -7786,17 +7978,17 @@ function writeLocalProvidersExample() {
       models: { "claude-sonnet-4-5": { name: "Claude Sonnet 4.5 (my key)" } }
     }
   };
-  (0, import_node_fs14.writeFileSync)(path, JSON.stringify(example, null, 2) + "\n", "utf8");
+  (0, import_node_fs15.writeFileSync)(path, JSON.stringify(example, null, 2) + "\n", "utf8");
   try {
-    (0, import_node_fs14.chmodSync)(path, 384);
+    (0, import_node_fs15.chmodSync)(path, 384);
   } catch {
   }
   return path;
 }
 
 // src/lib/sessions.ts
-var import_node_fs15 = require("fs");
-var import_node_path17 = require("path");
+var import_node_fs16 = require("fs");
+var import_node_path18 = require("path");
 var import_node_child_process4 = require("child_process");
 function parseSessionModel(raw) {
   if (!raw) return null;
@@ -7813,8 +8005,8 @@ function parseSessionModel(raw) {
   }
 }
 function modelForSession(sessionID) {
-  const dbPath = (0, import_node_path17.join)(engineXdg().dataHome, "opencode", "opencode.db");
-  if (!(0, import_node_fs15.existsSync)(dbPath)) return null;
+  const dbPath = (0, import_node_path18.join)(engineXdg().dataHome, "opencode", "opencode.db");
+  if (!(0, import_node_fs16.existsSync)(dbPath)) return null;
   const escaped = sessionID.replace(/'/g, "''");
   const res = (0, import_node_child_process4.spawnSync)(
     "sqlite3",
@@ -7835,8 +8027,8 @@ function modelForSession(sessionID) {
   }
 }
 function lastSessionForDirectory(cwd = process.cwd()) {
-  const dbPath = (0, import_node_path17.join)(engineXdg().dataHome, "opencode", "opencode.db");
-  if (!(0, import_node_fs15.existsSync)(dbPath)) return null;
+  const dbPath = (0, import_node_path18.join)(engineXdg().dataHome, "opencode", "opencode.db");
+  if (!(0, import_node_fs16.existsSync)(dbPath)) return null;
   const escaped = cwd.replace(/'/g, "''");
   const res = (0, import_node_child_process4.spawnSync)(
     "sqlite3",
@@ -7862,9 +8054,9 @@ function lastSessionForDirectory(cwd = process.cwd()) {
 }
 
 // src/lib/modelPin.ts
-var import_node_fs16 = require("fs");
-var import_node_path18 = require("path");
-var PROJECT_MODEL_PIN = (0, import_node_path18.join)(".agentful", "model.json");
+var import_node_fs17 = require("fs");
+var import_node_path19 = require("path");
+var PROJECT_MODEL_PIN = (0, import_node_path19.join)(".agentful", "model.json");
 function isCanonicalModel(value) {
   const slash = value.indexOf("/");
   return slash > 0 && slash < value.length - 1 && !/\s/.test(value);
@@ -7884,10 +8076,10 @@ function assertModelPin(pin, source) {
   return pin;
 }
 function readProjectModelPin(cwd = process.cwd()) {
-  const path = (0, import_node_path18.join)(cwd, PROJECT_MODEL_PIN);
+  const path = (0, import_node_path19.join)(cwd, PROJECT_MODEL_PIN);
   let raw;
   try {
-    raw = (0, import_node_fs16.readFileSync)(path, "utf8");
+    raw = (0, import_node_fs17.readFileSync)(path, "utf8");
   } catch (error) {
     const code = error.code;
     if (code === "ENOENT") return null;
@@ -7914,7 +8106,7 @@ function readProjectModelPin(cwd = process.cwd()) {
 function readEngineVariants(xdg) {
   try {
     const parsed = JSON.parse(
-      (0, import_node_fs16.readFileSync)((0, import_node_path18.join)(xdg.stateHome, "opencode", "model.json"), "utf8")
+      (0, import_node_fs17.readFileSync)((0, import_node_path19.join)(xdg.stateHome, "opencode", "model.json"), "utf8")
     );
     if (!parsed.variant || typeof parsed.variant !== "object" || Array.isArray(parsed.variant)) return {};
     return Object.fromEntries(
@@ -7926,17 +8118,17 @@ function readEngineVariants(xdg) {
 }
 function writeEngineVariant(xdg, model, variant) {
   assertModelPin({ model, variant }, "Selected");
-  const path = (0, import_node_path18.join)(xdg.stateHome, "opencode", "model.json");
+  const path = (0, import_node_path19.join)(xdg.stateHome, "opencode", "model.json");
   let state = {};
   try {
-    const parsed = JSON.parse((0, import_node_fs16.readFileSync)(path, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs17.readFileSync)(path, "utf8"));
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) state = parsed;
   } catch {
   }
   const existing = state.variant;
   const variants = existing && typeof existing === "object" && !Array.isArray(existing) ? existing : {};
   state.variant = { ...variants, [model]: variant };
-  (0, import_node_fs16.writeFileSync)(path, JSON.stringify(state, null, 2) + "\n", "utf8");
+  (0, import_node_fs17.writeFileSync)(path, JSON.stringify(state, null, 2) + "\n", "utf8");
 }
 function resolveModelPin(opts) {
   const cliPin = opts.cliModel ? assertModelPin({ model: opts.cliModel, variant: opts.cliVariant }, "CLI") : null;
@@ -7985,8 +8177,8 @@ function resolveModelPin(opts) {
 // src/lib/engineModels.ts
 var import_node_child_process5 = require("child_process");
 var import_node_util = require("util");
-var import_node_fs17 = require("fs");
-var import_node_path19 = require("path");
+var import_node_fs18 = require("fs");
+var import_node_path20 = require("path");
 var execFileAsync = (0, import_node_util.promisify)(import_node_child_process5.execFile);
 function parseEngineModelsOutput(output) {
   return Array.from(new Set(
@@ -8037,7 +8229,7 @@ async function assertEngineModelAvailable(binPath, xdg, model, listModels = list
 function readConnectedEngineProviders(xdg) {
   try {
     const parsed = JSON.parse(
-      (0, import_node_fs17.readFileSync)((0, import_node_path19.join)(xdg.dataHome, "opencode", "auth.json"), "utf8")
+      (0, import_node_fs18.readFileSync)((0, import_node_path20.join)(xdg.dataHome, "opencode", "auth.json"), "utf8")
     );
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return [];
     return Object.keys(parsed).filter((id) => id !== "agentful").sort();
@@ -8465,7 +8657,7 @@ async function tuiCommand(opts = {}) {
           ...process.env,
           // Slash commands run `agentful …` through the agent's bash tool, which
           // has no access to the user's shell aliases.
-          PATH: `${binDir}${import_node_path20.delimiter}${process.env.PATH || ""}`,
+          PATH: `${binDir}${import_node_path21.delimiter}${process.env.PATH || ""}`,
           XDG_CONFIG_HOME: xdg.configHome,
           XDG_DATA_HOME: xdg.dataHome,
           XDG_STATE_HOME: xdg.stateHome,
@@ -8596,38 +8788,38 @@ async function shareCommand(opts) {
 }
 
 // src/commands/pull.ts
-var import_node_fs19 = require("fs");
-var import_node_path22 = require("path");
+var import_node_fs20 = require("fs");
+var import_node_path23 = require("path");
 init_branding();
 init_branding();
 
 // src/lib/pullFiles.ts
-var import_node_fs18 = require("fs");
-var import_node_path21 = require("path");
+var import_node_fs19 = require("fs");
+var import_node_path22 = require("path");
 var INLINE_BASE64_EXTENSIONS = /\.(?:png|jpe?g|gif|webp|avif|svg|ico|bmp|tiff?|woff2?|ttf|otf|eot|pdf|docx?|xlsx?|pptx?|zip|tar|gz|7z|rar|bz2|mp[34]|m4a|wav|ogg|avi|mov|mkv|flac|webm|exe|dll|so|dylib|bin|wasm)$/i;
 function inlineContent(value) {
   return typeof value === "object" && value !== null && "content" in value ? String(value.content) : String(value ?? "");
 }
 function writePulledWorkspaceEntry(root, rel, value) {
-  const target = (0, import_node_path21.join)(root, rel);
-  (0, import_node_fs18.mkdirSync)((0, import_node_path21.dirname)(target), { recursive: true });
+  const target = (0, import_node_path22.join)(root, rel);
+  (0, import_node_fs19.mkdirSync)((0, import_node_path22.dirname)(target), { recursive: true });
   const content = inlineContent(value);
   if (INLINE_BASE64_EXTENSIONS.test(rel)) {
-    (0, import_node_fs18.writeFileSync)(target, Buffer.from(content, "base64"));
+    (0, import_node_fs19.writeFileSync)(target, Buffer.from(content, "base64"));
     return;
   }
-  (0, import_node_fs18.writeFileSync)(target, content, "utf8");
+  (0, import_node_fs19.writeFileSync)(target, content, "utf8");
 }
 function writePulledBackendDeclaration(root, declaration) {
-  const target = (0, import_node_path21.join)(root, ".agentful", "backend.json");
-  (0, import_node_fs18.mkdirSync)((0, import_node_path21.dirname)(target), { recursive: true });
+  const target = (0, import_node_path22.join)(root, ".agentful", "backend.json");
+  (0, import_node_fs19.mkdirSync)((0, import_node_path22.dirname)(target), { recursive: true });
   const {
     source: _source,
     received_at: _receivedAt,
     last_sync: _lastSync,
     ...portableDeclaration
   } = declaration;
-  (0, import_node_fs18.writeFileSync)(target, `${JSON.stringify(portableDeclaration, null, 2)}
+  (0, import_node_fs19.writeFileSync)(target, `${JSON.stringify(portableDeclaration, null, 2)}
 `, "utf8");
 }
 
@@ -8636,7 +8828,7 @@ async function pullCommand(opts) {
   console.log(banner());
   const auth = await ensureAuth();
   const project = requireProject();
-  const nonHidden = (0, import_node_fs19.readdirSync)(process.cwd()).filter((n) => n !== ".agentful" && !n.startsWith("."));
+  const nonHidden = (0, import_node_fs20.readdirSync)(process.cwd()).filter((n) => n !== ".agentful" && !n.startsWith("."));
   if (nonHidden.length > 0 && !opts.force) {
     throw new ApiError(
       0,
@@ -8663,9 +8855,9 @@ async function pullCommand(opts) {
         ui.warn(`Skipped ${rel} (HTTP ${resp.status})`);
         continue;
       }
-      const target = (0, import_node_path22.join)(process.cwd(), rel);
-      (0, import_node_fs19.mkdirSync)((0, import_node_path22.dirname)(target), { recursive: true });
-      (0, import_node_fs19.writeFileSync)(target, Buffer.from(await resp.arrayBuffer()));
+      const target = (0, import_node_path23.join)(process.cwd(), rel);
+      (0, import_node_fs20.mkdirSync)((0, import_node_path23.dirname)(target), { recursive: true });
+      (0, import_node_fs20.writeFileSync)(target, Buffer.from(await resp.arrayBuffer()));
       written++;
     }
   } else if (data.files) {