agentful 0.4.6 → 0.4.7

package/dist/index.cjs

@@ -33,9 +33,9 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
-// node_modules/commander/lib/error.js
+// ../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/lib/error.js
 var require_error = __commonJS({
-  "node_modules/commander/lib/error.js"(exports2) {
+  "../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/lib/error.js"(exports2) {
     "use strict";
     var CommanderError2 = class extends Error {
       /**
@@ -69,9 +69,9 @@ var require_error = __commonJS({
   }
 });
 
-// node_modules/commander/lib/argument.js
+// ../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/lib/argument.js
 var require_argument = __commonJS({
-  "node_modules/commander/lib/argument.js"(exports2) {
+  "../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/lib/argument.js"(exports2) {
     "use strict";
     var { InvalidArgumentError: InvalidArgumentError2 } = require_error();
     var Argument2 = class {
@@ -197,9 +197,9 @@ var require_argument = __commonJS({
   }
 });
 
-// node_modules/commander/lib/help.js
+// ../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/lib/help.js
 var require_help = __commonJS({
-  "node_modules/commander/lib/help.js"(exports2) {
+  "../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/lib/help.js"(exports2) {
     "use strict";
     var { humanReadableArgName } = require_argument();
     var Help2 = class {
@@ -612,9 +612,9 @@ var require_help = __commonJS({
   }
 });
 
-// node_modules/commander/lib/option.js
+// ../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/lib/option.js
 var require_option = __commonJS({
-  "node_modules/commander/lib/option.js"(exports2) {
+  "../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/lib/option.js"(exports2) {
     "use strict";
     var { InvalidArgumentError: InvalidArgumentError2 } = require_error();
     var Option2 = class {
@@ -885,9 +885,9 @@ var require_option = __commonJS({
   }
 });
 
-// node_modules/commander/lib/suggestSimilar.js
+// ../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/lib/suggestSimilar.js
 var require_suggestSimilar = __commonJS({
-  "node_modules/commander/lib/suggestSimilar.js"(exports2) {
+  "../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/lib/suggestSimilar.js"(exports2) {
     "use strict";
     var maxDistance = 3;
     function editDistance(a, b) {
@@ -966,9 +966,9 @@ var require_suggestSimilar = __commonJS({
   }
 });
 
-// node_modules/commander/lib/command.js
+// ../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/lib/command.js
 var require_command = __commonJS({
-  "node_modules/commander/lib/command.js"(exports2) {
+  "../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/lib/command.js"(exports2) {
     "use strict";
     var EventEmitter = require("events").EventEmitter;
     var childProcess = require("child_process");
@@ -3010,9 +3010,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
   }
 });
 
-// node_modules/commander/index.js
+// ../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/index.js
 var require_commander = __commonJS({
-  "node_modules/commander/index.js"(exports2) {
+  "../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/index.js"(exports2) {
     "use strict";
     var { Argument: Argument2 } = require_argument();
     var { Command: Command2 } = require_command();
@@ -3044,7 +3044,7 @@ var VERSION, brand, useColor, wrap, paint, tuiDesign, sym, ui;
 var init_branding = __esm({
   "src/branding.ts"() {
     "use strict";
-    VERSION = "0.4.6" ? "0.4.6" : null.version;
+    VERSION = "0.4.7" ? "0.4.7" : null.version;
     brand = {
       name: "agentful",
       // the command users type
@@ -3103,9 +3103,9 @@ var init_branding = __esm({
   }
 });
 
-// node_modules/ignore/index.js
+// ../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/ignore/index.js
 var require_ignore = __commonJS({
-  "node_modules/ignore/index.js"(exports2, module2) {
+  "../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/ignore/index.js"(exports2, module2) {
     "use strict";
     function makeArray(subject) {
       return Array.isArray(subject) ? subject : [subject];
@@ -3824,7 +3824,7 @@ var init_plugin = __esm({
   }
 });
 
-// node_modules/commander/esm.mjs
+// ../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/commander/esm.mjs
 var import_index = __toESM(require_commander(), 1);
 var {
   program,
@@ -4785,7 +4785,7 @@ init_branding();
 var import_node_fs4 = require("fs");
 var import_node_path6 = require("path");
 
-// node_modules/fflate/esm/index.mjs
+// ../../../../../../../../Users/gn/Labor/mainmvp/cli/node_modules/fflate/esm/index.mjs
 var import_module = require("module");
 var require2 = (0, import_module.createRequire)("/");
 var _a;
@@ -5597,18 +5597,28 @@ function detectDistDir(rootDir, override) {
 }
 
 // src/lib/preflight.ts
-var import_node_fs5 = require("fs");
-var import_node_path7 = require("path");
+var import_node_fs6 = require("fs");
+var import_node_path8 = require("path");
 
 // ../platform-contract/contract.json
 var contract_default = {
   $comment: "Single source of truth for the platform publish contract (PRD AP6a, planned/cli-push-to-workspace-transition-findings-and-prd-2026-08-17.md). Consumers: cli/src/lib/preflight.ts renders directly from this file; build engine (infrastructure/lambda/build-engine/handler.ts) and executor (opencode-lambda/executor/runtime/opencode_runner.py) are parity-checked against it by ./check-parity.py until AP4/AP5 move them onto it; AP0 instructions/skills render from it later. Bump schema_version on breaking shape changes. See README.md.",
   schema_version: 1,
-  contract_statement: "This platform publishes static files. Your app has no server process of its own \u2014 server-side logic runs as Managed Server Actions (short request/response functions) or on an API of your own that you connect. You cannot set build-time env vars or secrets: the workspace build injects only a fixed allowlist of public client values, and the `agentful push` build injects none.",
+  contract_statement: "This platform publishes static files. Your app has no server process of its own \u2014 server-side logic runs as Managed Server Actions (short request/response functions) or on an API of your own that you connect. You cannot set build-time env vars or secrets: every cloud build injects the same fixed allowlist of public client values, and nothing else.",
   publish: {
     server_process: false,
     build_env_vars: false,
-    $comment_build_env: "false = nobody can SET a build variable or build secret. Two build paths exist and they differ: the workspace executor injects a fixed allowlist of PUBLIC client values (VITE_PROJECT_ID/PUBLIC_PROJECT_ID, and for a BYO Supabase database its URL + publishable key as VITE_/PUBLIC_/NEXT_PUBLIC_); the build engine behind `agentful push` injects nothing beyond NODE_ENV. Code that must build on both paths keeps public values in an ordinary source constant.",
+    $comment_build_env: "false = nobody can SET a build variable or build secret. Two build paths exist \u2014 the workspace executor (end of an agent turn) and the build engine (the workspace's Build button and `agentful push`) \u2014 and both inject the SAME fixed allowlist of PUBLIC client values, listed under build_env. The values come from one function on both paths (aws-services/workspace-manager/client_config.py); check-parity.py (check 13) pins the names. Until 2026-09 the build engine injected nothing, so an app that read import.meta.env.VITE_SUPABASE_URL worked after the agent's turn and lost its database on the next Build click \u2014 without a build error. A public value outside the allowlist still belongs in an ordinary source constant.",
+    build_env: {
+      $comment: "What a cloud build defines, and nothing else. `injected` = suffix x prefixes; `when: byo_supabase` means only while the project's Backend tab has an own Supabase database connected (URL + publishable key; a secret key stored in that slot is refused, never shipped). A read of <public prefix><injected suffix> that the build does NOT define fails the build (422 undefined_build_env): undefined there is a broken app, not a default. Any other read of a public-prefixed name that nothing defines is a warning, because `import.meta.env.VITE_API_BASE ?? '/api'` is a legitimate pattern. `bundler_builtins` are set by the framework itself and are never reported.",
+      public_prefixes: ["VITE_", "PUBLIC_", "NEXT_PUBLIC_"],
+      injected: [
+        { suffix: "PROJECT_ID", prefixes: ["VITE_", "PUBLIC_"], when: "always" },
+        { suffix: "SUPABASE_URL", prefixes: ["VITE_", "PUBLIC_", "NEXT_PUBLIC_"], when: "byo_supabase" },
+        { suffix: "SUPABASE_ANON_KEY", prefixes: ["VITE_", "PUBLIC_", "NEXT_PUBLIC_"], when: "byo_supabase" }
+      ],
+      bundler_builtins: ["PUBLIC_URL"]
+    },
     published_prefix: "dist/",
     canonical_output_check: "root_index_html",
     $comment_output: "Canonical end-to-end contract (AP4): a root-level index.html inside the framework's output dir. Deliberately stricter than the executor's historical index.htm/200.html acceptance \u2014 both builders converge on THIS, not on each other (deployment gate and publish self-heal require dist/index.html)."
@@ -5806,7 +5816,7 @@ var contract_default = {
   build_attempt_schema: {
     file: "deployments/latest-build.json",
     status_values: ["running", "success", "failed"],
-    phase_codes: ["unsupported_project_type", "install", "build", "missing_output", "upload"],
+    phase_codes: ["unsupported_project_type", "client_env", "install", "build", "missing_output", "upload"],
     fields: {
       schema_version: "int \u2014 copy of this contract's schema_version",
       build_id: "string \u2014 unique per attempt",
@@ -5826,6 +5836,154 @@ var contract_default = {
   }
 };
 
+// ../platform-contract/buildEnv.ts
+var import_node_fs5 = require("fs");
+var import_node_path7 = require("path");
+var BUILD_ENV = contract_default.publish.build_env;
+var PUBLIC_PREFIXES = BUILD_ENV.public_prefixes;
+var BUILTINS = new Set(BUILD_ENV.bundler_builtins);
+var INJECTABLE_NAMES = new Set(
+  BUILD_ENV.injected.flatMap((e) => e.prefixes.map((p) => `${p}${e.suffix}`))
+);
+var ALWAYS_DEFINED_NAMES = new Set(
+  BUILD_ENV.injected.filter((e) => e.when === "always").flatMap((e) => e.prefixes.map((p) => `${p}${e.suffix}`))
+);
+var splitName = (name) => {
+  const prefix = PUBLIC_PREFIXES.find((p) => name.startsWith(p));
+  return prefix ? { prefix, suffix: name.slice(prefix.length) } : null;
+};
+var injectedEntry = (suffix) => BUILD_ENV.injected.find((e) => e.suffix === suffix);
+var SCAN_FILE = /\.(js|jsx|ts|tsx|mjs|cjs|vue|svelte|astro)$/;
+var SKIP_FILE = /\.d\.ts$|\.(test|spec)\.[a-z]+$/;
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".next", ".git", "dist", "build", "out", ".nuxt", ".output", "coverage"]);
+var SCAN_FILE_BUDGET = 5e3;
+var MAX_SCAN_BYTES = 1024 * 1024;
+var ENV_OBJECT = String.raw`(?:import\.meta\.env|process\.env)`;
+var MEMBER_READ = new RegExp(
+  String.raw`\b${ENV_OBJECT}\s*(?:\??\.\s*([A-Z][A-Z0-9_]*)|\[\s*['"]([A-Z][A-Z0-9_]*)['"]\s*\])(\s*(?:\?\?|\|\|))?`,
+  "g"
+);
+var DESTRUCTURED_READ = new RegExp(String.raw`\{([^{}]*)\}\s*=\s*${ENV_OBJECT}\b`, "g");
+var QUOTED = /'(?:[^'\\\n]|\\.)*'|"(?:[^"\\\n]|\\.)*"/g;
+var MENTIONS_ENV = /\benv\s*[.[]/;
+var stripNonCode = (text) => text.replace(QUOTED, (quoted) => MENTIONS_ENV.test(quoted) ? "''" : quoted).replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:'"`\\])\/\/[^\n]*/g, "$1");
+var isReportable = (name) => !BUILTINS.has(name) && splitName(name) !== null;
+function collectFiles2(dir, out, budget) {
+  if (budget.left <= 0 || !(0, import_node_fs5.existsSync)(dir)) return;
+  for (const entry of (0, import_node_fs5.readdirSync)(dir, { withFileTypes: true })) {
+    if (budget.left <= 0) return;
+    const abs = (0, import_node_path7.join)(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (!SKIP_DIRS.has(entry.name)) collectFiles2(abs, out, budget);
+    } else if (entry.isFile() && SCAN_FILE.test(entry.name) && !SKIP_FILE.test(entry.name)) {
+      budget.left--;
+      out.push(abs);
+    }
+  }
+}
+function scanEnvReads(rootDir) {
+  const files = [];
+  collectFiles2(rootDir, files, { left: SCAN_FILE_BUDGET });
+  const reads = [];
+  for (const abs of files) {
+    let text;
+    try {
+      text = (0, import_node_fs5.readFileSync)(abs, "utf8");
+    } catch {
+      continue;
+    }
+    if (text.length > MAX_SCAN_BYTES || !/\benv\b/.test(text)) continue;
+    text = stripNonCode(text);
+    const inFile = /* @__PURE__ */ new Map();
+    const note = (name, hasFallback) => {
+      if (isReportable(name)) inFile.set(name, (inFile.get(name) ?? true) && hasFallback);
+    };
+    for (const m of text.matchAll(MEMBER_READ)) note(m[1] || m[2], Boolean(m[3]));
+    for (const m of text.matchAll(DESTRUCTURED_READ)) {
+      for (const part of m[1].split(",")) {
+        const field = /^\s*([A-Z][A-Z0-9_]*)\s*(?::\s*[A-Za-z_$][\w$]*\s*)?(=)?/.exec(part);
+        if (field) note(field[1], Boolean(field[2]));
+      }
+    }
+    const file = (0, import_node_path7.relative)(rootDir, abs).split(import_node_path7.sep).join("/");
+    for (const [name, hasFallback] of inFile) reads.push({ name, file, hasFallback });
+  }
+  return reads;
+}
+function envFileNames(rootDir) {
+  const names = /* @__PURE__ */ new Set();
+  if (!(0, import_node_fs5.existsSync)(rootDir)) return names;
+  for (const entry of (0, import_node_fs5.readdirSync)(rootDir, { withFileTypes: true })) {
+    if (!entry.isFile() || !(entry.name === ".env" || entry.name.startsWith(".env."))) continue;
+    let text;
+    try {
+      text = (0, import_node_fs5.readFileSync)((0, import_node_path7.join)(rootDir, entry.name), "utf8");
+    } catch {
+      continue;
+    }
+    for (const line of text.split("\n")) {
+      const m = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/.exec(line);
+      if (m) names.add(m[1]);
+    }
+  }
+  return names;
+}
+var sampleFiles = (files) => files.slice(0, 3).join(", ") + (files.length > 3 ? ", \u2026" : "");
+var prefixList = (prefixes) => prefixes.map((p) => `${p}*`).join("/");
+function platformHint(name, opts) {
+  const { prefix, suffix } = splitName(name);
+  const entry = injectedEntry(suffix);
+  if (!entry.prefixes.includes(prefix)) {
+    return `The platform defines ${suffix} only as ${entry.prefixes.map((p) => `${p}${suffix}`).join(" and ")} \u2014 read one of those, or keep the value in an ordinary source constant.`;
+  }
+  if (entry.when === "byo_supabase") {
+    if ((opts.rejected || []).includes(suffix)) {
+      return "The key stored for this database looks like a Supabase SECRET key. The platform refuses to put it into a public bundle \u2014 store the publishable (anon) key as `database.anon_key` in the Backend tab instead.";
+    }
+    if (opts.provider === "supabase" && (opts.missing || []).includes(suffix)) {
+      return suffix === "SUPABASE_URL" ? "Your own Supabase database is connected, but no https project URL is stored \u2014 set it in the Backend tab (Database)." : "Your own Supabase database is connected, but no publishable key is stored \u2014 add it in the Backend tab as `database.anon_key`.";
+    }
+    return `The platform defines ${suffix} (as ${prefixList(entry.prefixes)}) only while your own Supabase database is connected in the Backend tab (Database \u2192 own Supabase). Connect it there, or keep the public value in an ordinary source constant.`;
+  }
+  return "Keep the public value in an ordinary source constant.";
+}
+function judgeEnvReads(reads, opts) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const read of reads) {
+    if (opts.defined.has(read.name)) continue;
+    byName.set(read.name, [...byName.get(read.name) || [], read]);
+  }
+  const verdict = { errors: [], warnings: [] };
+  const build = opts.backendUnknown ? "the cloud build" : "this build";
+  for (const name of [...byName.keys()].sort()) {
+    const group = byName.get(name);
+    const files = sampleFiles(group.map((r) => r.file).sort());
+    const { prefix, suffix } = splitName(name);
+    const entry = injectedEntry(suffix);
+    const taught = entry !== void 0;
+    const bare = group.filter((r) => !r.hasFallback);
+    const local = opts.localOnly?.has(name) ? " Your local .env defines it, but .env files never leave this machine." : "";
+    if (opts.backendUnknown && entry && entry.when === "byo_supabase" && entry.prefixes.includes(prefix)) {
+      verdict.warnings.push(
+        `${name} is read in ${files}. The cloud build defines it only while your own Supabase database is connected in the Backend tab (Database \u2192 own Supabase)` + (bare.length > 0 ? " \u2014 without that it rejects the build, because the value would compile to `undefined` without any build error." : "; without that the app runs on its own fallback.") + local
+      );
+    } else if (taught && bare.length > 0) {
+      verdict.errors.push(
+        `${name} is read in ${sampleFiles(bare.map((r) => r.file).sort())}, but ${build} does not define it \u2014 it would compile to \`undefined\` without any build error. ${platformHint(name, opts)}${local}`
+      );
+    } else if (taught) {
+      verdict.warnings.push(
+        `${name} is read in ${files} and ${build} does not define it \u2014 the app runs on its own fallback. ${platformHint(name, opts)}${local}`
+      );
+    } else {
+      verdict.warnings.push(
+        `${name} is read in ${files}, but no cloud build defines it \u2014 it compiles to \`undefined\`. This platform sets no build variables of your own: keep public values in an ordinary source constant (a fallback such as \`?? '/api'\` is fine).${local}`
+      );
+    }
+  }
+  return verdict;
+}
+
 // src/lib/preflight.ts
 function feature(id) {
   const found = contract_default.forbidden_server_features.find((f) => f.id === id);
@@ -5853,14 +6011,14 @@ var STATIC_EXPORT = /output\s*:\s*['"]export['"]/;
 var SOURCE_FILE = /\.(js|jsx|ts|tsx|mjs)$/;
 var GET_SERVER_SIDE_PROPS = /export\s+(?:async\s+)?(?:function|const|let|var)\s+getServerSideProps\b|export\s*\{[^}]*\bgetServerSideProps\b[^}]*\}/;
 var USE_SERVER = /^\s*(['"])use server\1\s*;?\s*$/m;
-var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".next", ".git", "dist", "build", "out"]);
-var SCAN_FILE_BUDGET = 5e3;
+var SKIP_DIRS2 = /* @__PURE__ */ new Set(["node_modules", ".next", ".git", "dist", "build", "out"]);
+var SCAN_FILE_BUDGET2 = 5e3;
 function detectFramework(rootDir) {
-  const pkgPath = (0, import_node_path7.join)(rootDir, "package.json");
-  if (!(0, import_node_fs5.existsSync)(pkgPath)) return "vanilla";
+  const pkgPath = (0, import_node_path8.join)(rootDir, "package.json");
+  if (!(0, import_node_fs6.existsSync)(pkgPath)) return "vanilla";
   let pkg;
   try {
-    pkg = JSON.parse((0, import_node_fs5.readFileSync)(pkgPath, "utf8"));
+    pkg = JSON.parse((0, import_node_fs6.readFileSync)(pkgPath, "utf8"));
   } catch {
     return "unknown";
   }
@@ -5870,32 +6028,32 @@ function detectFramework(rootDir) {
 }
 function readDeps(rootDir) {
   try {
-    const pkg = JSON.parse((0, import_node_fs5.readFileSync)((0, import_node_path7.join)(rootDir, "package.json"), "utf8"));
+    const pkg = JSON.parse((0, import_node_fs6.readFileSync)((0, import_node_path8.join)(rootDir, "package.json"), "utf8"));
     return { ...pkg.dependencies, ...pkg.devDependencies };
   } catch {
     return {};
   }
 }
 function findFiles(rootDir, dir, pattern, out, cap = 20) {
-  if (out.length >= cap || !(0, import_node_fs5.existsSync)(dir)) return;
-  for (const entry of (0, import_node_fs5.readdirSync)(dir, { withFileTypes: true })) {
+  if (out.length >= cap || !(0, import_node_fs6.existsSync)(dir)) return;
+  for (const entry of (0, import_node_fs6.readdirSync)(dir, { withFileTypes: true })) {
     if (out.length >= cap) return;
-    const abs = (0, import_node_path7.join)(dir, entry.name);
+    const abs = (0, import_node_path8.join)(dir, entry.name);
     if (entry.isDirectory()) {
-      if (!SKIP_DIRS.has(entry.name)) findFiles(rootDir, abs, pattern, out, cap);
+      if (!SKIP_DIRS2.has(entry.name)) findFiles(rootDir, abs, pattern, out, cap);
     } else if (entry.isFile() && pattern.test(entry.name)) {
-      out.push((0, import_node_path7.relative)(rootDir, abs).split(import_node_path7.sep).join("/"));
+      out.push((0, import_node_path8.relative)(rootDir, abs).split(import_node_path8.sep).join("/"));
     }
   }
 }
 var sample = (list) => list.slice(0, 3).join(", ") + (list.length > 3 ? ", \u2026" : "");
 function collectSourceFiles(dir, out, budget) {
-  if (budget.left <= 0 || !(0, import_node_fs5.existsSync)(dir)) return;
-  for (const entry of (0, import_node_fs5.readdirSync)(dir, { withFileTypes: true })) {
+  if (budget.left <= 0 || !(0, import_node_fs6.existsSync)(dir)) return;
+  for (const entry of (0, import_node_fs6.readdirSync)(dir, { withFileTypes: true })) {
     if (budget.left <= 0) return;
-    const abs = (0, import_node_path7.join)(dir, entry.name);
+    const abs = (0, import_node_path8.join)(dir, entry.name);
     if (entry.isDirectory()) {
-      if (!SKIP_DIRS.has(entry.name)) collectSourceFiles(abs, out, budget);
+      if (!SKIP_DIRS2.has(entry.name)) collectSourceFiles(abs, out, budget);
     } else if (entry.isFile() && SOURCE_FILE.test(entry.name)) {
       budget.left--;
       out.push(abs);
@@ -5905,10 +6063,10 @@ function collectSourceFiles(dir, out, budget) {
 function checkNextjs(rootDir) {
   const issues = [];
   const warnings = [];
-  const configName = NEXT_CONFIG_BASENAMES.find((name) => (0, import_node_fs5.existsSync)((0, import_node_path7.join)(rootDir, name)));
+  const configName = NEXT_CONFIG_BASENAMES.find((name) => (0, import_node_fs6.existsSync)((0, import_node_path8.join)(rootDir, name)));
   let hasStaticExport = true;
   if (configName) {
-    const config = (0, import_node_fs5.readFileSync)((0, import_node_path7.join)(rootDir, configName), "utf8");
+    const config = (0, import_node_fs6.readFileSync)((0, import_node_path8.join)(rootDir, configName), "utf8");
     hasStaticExport = STATIC_EXPORT.test(config);
     if (!hasStaticExport) {
       issues.push(
@@ -5922,31 +6080,31 @@ function checkNextjs(rootDir) {
   const hard = [];
   const pagesApi = [];
   for (const apiDir of PAGES_API_DIRS) {
-    findFiles(rootDir, (0, import_node_path7.join)(rootDir, apiDir), /\.(js|ts|jsx|tsx|mjs)$/, pagesApi);
+    findFiles(rootDir, (0, import_node_path8.join)(rootDir, apiDir), /\.(js|ts|jsx|tsx|mjs)$/, pagesApi);
   }
   if (pagesApi.length > 0) hard.push(`pages/api/* routes (${pagesApi.length} file(s))`);
   const middlewareFiles = [];
   for (const base of ["", "src"]) {
-    const dir = base ? (0, import_node_path7.join)(rootDir, base) : rootDir;
-    if (!(0, import_node_fs5.existsSync)(dir)) continue;
-    for (const entry of (0, import_node_fs5.readdirSync)(dir)) {
-      if (MIDDLEWARE_FILE.test(entry)) middlewareFiles.push((0, import_node_path7.join)(base, entry).split(import_node_path7.sep).join("/"));
+    const dir = base ? (0, import_node_path8.join)(rootDir, base) : rootDir;
+    if (!(0, import_node_fs6.existsSync)(dir)) continue;
+    for (const entry of (0, import_node_fs6.readdirSync)(dir)) {
+      if (MIDDLEWARE_FILE.test(entry)) middlewareFiles.push((0, import_node_path8.join)(base, entry).split(import_node_path8.sep).join("/"));
     }
   }
   hard.push(...middlewareFiles);
   const sourceFiles = [];
-  collectSourceFiles(rootDir, sourceFiles, { left: SCAN_FILE_BUDGET });
+  collectSourceFiles(rootDir, sourceFiles, { left: SCAN_FILE_BUDGET2 });
   const gssp = [];
   const useServer = [];
   for (const abs of sourceFiles) {
     if (gssp.length >= 20 && useServer.length >= 20) break;
     let text;
     try {
-      text = (0, import_node_fs5.readFileSync)(abs, "utf8");
+      text = (0, import_node_fs6.readFileSync)(abs, "utf8");
     } catch {
       continue;
     }
-    const rel = (0, import_node_path7.relative)(rootDir, abs).split(import_node_path7.sep).join("/");
+    const rel = (0, import_node_path8.relative)(rootDir, abs).split(import_node_path8.sep).join("/");
     if (gssp.length < 20 && GET_SERVER_SIDE_PROPS.test(text)) gssp.push(rel);
     if (useServer.length < 20 && USE_SERVER.test(text)) useServer.push(rel);
   }
@@ -5954,7 +6112,7 @@ function checkNextjs(rootDir) {
   if (useServer.length > 0) hard.push(`'use server' actions (${sample(useServer)})`);
   const routeFiles = [];
   for (const appDir of APP_DIRS) {
-    findFiles(rootDir, (0, import_node_path7.join)(rootDir, appDir), ROUTE_HANDLER_FILE, routeFiles);
+    findFiles(rootDir, (0, import_node_path8.join)(rootDir, appDir), ROUTE_HANDLER_FILE, routeFiles);
   }
   if (routeFiles.length > 0) {
     const label = `${routeFiles.length} route handler(s) (${sample(routeFiles)})`;
@@ -5988,6 +6146,17 @@ function checkNextjs(rootDir) {
   }
   return { issues, warnings };
 }
+function checkBuildEnv(rootDir) {
+  const verdict = judgeEnvReads(scanEnvReads(rootDir), {
+    defined: ALWAYS_DEFINED_NAMES,
+    backendUnknown: true,
+    localOnly: envFileNames(rootDir)
+  });
+  return [
+    ...verdict.errors.map((e) => `The cloud build will reject this project: ${e}`),
+    ...verdict.warnings
+  ];
+}
 function runPreflight(rootDir) {
   const framework = detectFramework(rootDir);
   const issues = [];
@@ -6002,17 +6171,18 @@ function runPreflight(rootDir) {
     issues.push(...next.issues);
     warnings.push(...next.warnings);
   }
+  if (framework !== "vanilla") warnings.push(...checkBuildEnv(rootDir));
   return { framework, issues, warnings };
 }
 
 // src/lib/backendDecl.ts
-var import_node_fs6 = require("fs");
-var import_node_path8 = require("path");
+var import_node_fs7 = require("fs");
+var import_node_path9 = require("path");
 function readBackendDeclaration(dir = process.cwd()) {
-  const path = (0, import_node_path8.join)(dir, ".agentful", "backend.json");
-  if (!(0, import_node_fs6.existsSync)(path)) return null;
+  const path = (0, import_node_path9.join)(dir, ".agentful", "backend.json");
+  if (!(0, import_node_fs7.existsSync)(path)) return null;
   try {
-    const parsed = JSON.parse((0, import_node_fs6.readFileSync)(path, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs7.readFileSync)(path, "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
     const collections = Array.isArray(parsed.collections) ? parsed.collections.filter((c) => c && typeof c === "object" && !Array.isArray(c)) : [];
     const secrets = Array.isArray(parsed.secrets) ? parsed.secrets.filter((s) => s && typeof s === "object" && !Array.isArray(s)) : [];
@@ -6056,19 +6226,19 @@ function describeBackendDeclaration(decl) {
 function backendTabUrl(userId, projectId) {
   return `${APP_URL}/workspace/${userId}/${projectId}?view=backend`;
 }
-var ACTIONS_DIR = (0, import_node_path8.join)(".server", "actions");
+var ACTIONS_DIR = (0, import_node_path9.join)(".server", "actions");
 var ACTION_NAME = /^[a-z][a-z0-9_-]{0,62}$/;
 function checkBackendDeclaration(rootDir = process.cwd()) {
   const issues = [];
   const warnings = [];
-  const actionsDir = (0, import_node_path8.join)(rootDir, ACTIONS_DIR);
+  const actionsDir = (0, import_node_path9.join)(rootDir, ACTIONS_DIR);
   const presentFiles = /* @__PURE__ */ new Set();
-  if ((0, import_node_fs6.existsSync)(actionsDir)) {
-    for (const entry of (0, import_node_fs6.readdirSync)(actionsDir)) {
-      const abs = (0, import_node_path8.join)(actionsDir, entry);
+  if ((0, import_node_fs7.existsSync)(actionsDir)) {
+    for (const entry of (0, import_node_fs7.readdirSync)(actionsDir)) {
+      const abs = (0, import_node_path9.join)(actionsDir, entry);
       let isDir = false;
       try {
-        isDir = (0, import_node_fs6.statSync)(abs).isDirectory();
+        isDir = (0, import_node_fs7.statSync)(abs).isDirectory();
       } catch {
         continue;
       }
@@ -6285,8 +6455,8 @@ function describeBackendState(state) {
 }
 
 // src/lib/backendConsent.ts
-var import_node_fs7 = require("fs");
-var import_node_path9 = require("path");
+var import_node_fs8 = require("fs");
+var import_node_path10 = require("path");
 var import_promises2 = require("readline/promises");
 function declaresManagedDatabase(decl) {
   if (!decl) return false;
@@ -6312,10 +6482,10 @@ function consentQuestion(decl) {
     'It is the same switch as the Backend tab; this push then applies the declaration. A "no" is remembered for this project (`agentful push --yes` or `agentful backend` enables it later).'
   ].join("\n");
 }
-var consentFile = () => (0, import_node_path9.join)(configDir(), "backend-consent.json");
+var consentFile = () => (0, import_node_path10.join)(configDir(), "backend-consent.json");
 function readConsentFile() {
   try {
-    const raw = JSON.parse((0, import_node_fs7.readFileSync)(consentFile(), "utf8"));
+    const raw = JSON.parse((0, import_node_fs8.readFileSync)(consentFile(), "utf8"));
     return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
   } catch {
     return {};
@@ -6327,15 +6497,15 @@ function hasRememberedDecline(projectId) {
 function rememberDecline(projectId) {
   const all = readConsentFile();
   all[projectId] = { declined_at: (/* @__PURE__ */ new Date()).toISOString() };
-  (0, import_node_fs7.mkdirSync)(configDir(), { recursive: true });
-  (0, import_node_fs7.writeFileSync)(consentFile(), JSON.stringify(all, null, 2) + "\n", "utf8");
+  (0, import_node_fs8.mkdirSync)(configDir(), { recursive: true });
+  (0, import_node_fs8.writeFileSync)(consentFile(), JSON.stringify(all, null, 2) + "\n", "utf8");
 }
 function forgetDecline(projectId) {
-  if (!(0, import_node_fs7.existsSync)(consentFile())) return;
+  if (!(0, import_node_fs8.existsSync)(consentFile())) return;
   const all = readConsentFile();
   if (!(projectId in all)) return;
   delete all[projectId];
-  (0, import_node_fs7.writeFileSync)(consentFile(), JSON.stringify(all, null, 2) + "\n", "utf8");
+  (0, import_node_fs8.writeFileSync)(consentFile(), JSON.stringify(all, null, 2) + "\n", "utf8");
 }
 async function enableManagedDatabase(auth, userId, projectId) {
   try {
@@ -6543,13 +6713,14 @@ async function pushCommand(opts) {
     ui.step("Building in the cloud (this can take a few minutes)\u2026");
     const buildStartedAt = Date.now();
     try {
-      await request(`${PB_URL}/api/workspaces/${userId}/${projectId}/build`, {
+      const built = await request(`${PB_URL}/api/workspaces/${userId}/${projectId}/build`, {
         method: "POST",
         token: auth.pb_token,
         body: {},
         timeoutMs: 66e4
       });
       ui.info("Build finished");
+      for (const warning of built?.warnings ?? []) ui.warn(warning);
     } catch (err2) {
       if (err2 instanceof ApiError && err2.code === "network_error") {
         ui.warn("Connection dropped during the build \u2014 polling for the result\u2026");
@@ -6712,15 +6883,15 @@ async function openCommand() {
 // src/commands/tui.ts
 var import_node_child_process6 = require("child_process");
 var import_promises4 = require("readline/promises");
-var import_node_path20 = require("path");
+var import_node_path21 = require("path");
 
 // src/lib/binWrapper.ts
-var import_node_fs8 = require("fs");
-var import_node_path10 = require("path");
+var import_node_fs9 = require("fs");
+var import_node_path11 = require("path");
 var import_node_os3 = require("os");
 function ensureCliOnPath() {
-  const binDir = (0, import_node_path10.join)((0, import_node_os3.homedir)(), ".local", "share", "agentful", "bin");
-  (0, import_node_fs8.mkdirSync)(binDir, { recursive: true });
+  const binDir = (0, import_node_path11.join)((0, import_node_os3.homedir)(), ".local", "share", "agentful", "bin");
+  (0, import_node_fs9.mkdirSync)(binDir, { recursive: true });
   const entry = process.argv[1];
   if (!entry) return binDir;
   const restore = (name) => {
@@ -6729,8 +6900,8 @@ function ensureCliOnPath() {
 ` : `export ${name}=${JSON.stringify(original)}
 `;
   };
-  const wrapper = (0, import_node_path10.join)(binDir, "agentful");
-  (0, import_node_fs8.writeFileSync)(
+  const wrapper = (0, import_node_path11.join)(binDir, "agentful");
+  (0, import_node_fs9.writeFileSync)(
     wrapper,
     `#!/bin/sh
 # Generated by the Agentful CLI so the coding agent can run \`agentful \u2026\`.
@@ -6740,7 +6911,7 @@ function ensureCliOnPath() {
     "utf8"
   );
   try {
-    (0, import_node_fs8.chmodSync)(wrapper, 493);
+    (0, import_node_fs9.chmodSync)(wrapper, 493);
   } catch {
   }
   return binDir;
@@ -6750,9 +6921,9 @@ function ensureCliOnPath() {
 init_branding();
 
 // src/lib/engine.ts
-var import_node_fs9 = require("fs");
+var import_node_fs10 = require("fs");
 var import_node_crypto = require("crypto");
-var import_node_path11 = require("path");
+var import_node_path12 = require("path");
 var import_node_os4 = require("os");
 var import_node_child_process3 = require("child_process");
 var import_node_stream = require("stream");
@@ -6797,8 +6968,8 @@ function platformKey() {
   );
 }
 function cacheDir(version) {
-  const base = process.env.XDG_CACHE_HOME || (0, import_node_path11.join)((0, import_node_os4.homedir)(), ".cache");
-  return (0, import_node_path11.join)(base, "agentful", "engine", version);
+  const base = process.env.XDG_CACHE_HOME || (0, import_node_path12.join)((0, import_node_os4.homedir)(), ".cache");
+  return (0, import_node_path12.join)(base, "agentful", "engine", version);
 }
 async function fetchManifest() {
   try {
@@ -6809,7 +6980,7 @@ async function fetchManifest() {
 }
 async function sha256File(path) {
   const hash = (0, import_node_crypto.createHash)("sha256");
-  await (0, import_promises3.pipeline)((0, import_node_fs9.createReadStream)(path), hash);
+  await (0, import_promises3.pipeline)((0, import_node_fs10.createReadStream)(path), hash);
   return hash.digest("hex");
 }
 async function ensureEngine() {
@@ -6818,12 +6989,12 @@ async function ensureEngine() {
   noticeIfOutdated(manifest);
   const version = manifest?.engine_version || FALLBACK_ENGINE_VERSION;
   const dir = cacheDir(version);
-  const binPath = (0, import_node_path11.join)(dir, ENGINE_BINARY);
-  if ((0, import_node_fs9.existsSync)(binPath)) return binPath;
+  const binPath = (0, import_node_path12.join)(dir, ENGINE_BINARY);
+  if ((0, import_node_fs10.existsSync)(binPath)) return binPath;
   const artifact = manifest?.artifacts?.[key];
   const url = artifact?.url || `${APP_URL}/cli/engine/${version}/${key}${key.startsWith("darwin") ? ".zip" : ".tar.gz"}`;
-  (0, import_node_fs9.mkdirSync)(dir, { recursive: true });
-  const archivePath = (0, import_node_path11.join)(dir, key.startsWith("darwin") ? "engine.zip" : "engine.tar.gz");
+  (0, import_node_fs10.mkdirSync)(dir, { recursive: true });
+  const archivePath = (0, import_node_path12.join)(dir, key.startsWith("darwin") ? "engine.zip" : "engine.tar.gz");
   ui.step(`Preparing the ${brand.displayName} engine (first run only)\u2026`);
   const resp = await fetch(url, {
     redirect: "follow",
@@ -6837,11 +7008,11 @@ async function ensureEngine() {
       `Could not download the engine (HTTP ${resp.status}). Check your connection and try again.`
     );
   }
-  await (0, import_promises3.pipeline)(import_node_stream.Readable.fromWeb(resp.body), (0, import_node_fs9.createWriteStream)(archivePath));
+  await (0, import_promises3.pipeline)(import_node_stream.Readable.fromWeb(resp.body), (0, import_node_fs10.createWriteStream)(archivePath));
   if (artifact?.sha256) {
     const actual = await sha256File(archivePath);
     if (actual !== artifact.sha256) {
-      (0, import_node_fs9.rmSync)(archivePath, { force: true });
+      (0, import_node_fs10.rmSync)(archivePath, { force: true });
       throw new ApiError(
         0,
         "engine_checksum_mismatch",
@@ -6850,7 +7021,7 @@ async function ensureEngine() {
     }
   }
   const extract = archivePath.endsWith(".zip") ? (0, import_node_child_process3.spawnSync)("unzip", ["-oq", archivePath], { cwd: dir, stdio: "ignore" }) : (0, import_node_child_process3.spawnSync)("tar", ["-xzf", archivePath], { cwd: dir, stdio: "ignore" });
-  (0, import_node_fs9.rmSync)(archivePath, { force: true });
+  (0, import_node_fs10.rmSync)(archivePath, { force: true });
   if (extract.status !== 0) {
     throw new ApiError(
       0,
@@ -6858,24 +7029,24 @@ async function ensureEngine() {
       `Could not unpack the engine (needs ${archivePath.endsWith(".zip") ? "unzip" : "tar"} on PATH).`
     );
   }
-  const extracted = (0, import_node_path11.join)(dir, "opencode");
-  if ((0, import_node_fs9.existsSync)(extracted) && !(0, import_node_fs9.existsSync)(binPath)) (0, import_node_fs9.renameSync)(extracted, binPath);
-  if (!(0, import_node_fs9.existsSync)(binPath)) {
+  const extracted = (0, import_node_path12.join)(dir, "opencode");
+  if ((0, import_node_fs10.existsSync)(extracted) && !(0, import_node_fs10.existsSync)(binPath)) (0, import_node_fs10.renameSync)(extracted, binPath);
+  if (!(0, import_node_fs10.existsSync)(binPath)) {
     throw new ApiError(0, "engine_extract_failed", "Engine archive did not contain the expected binary.");
   }
-  (0, import_node_fs9.chmodSync)(binPath, 493);
+  (0, import_node_fs10.chmodSync)(binPath, 493);
   ui.ok(`Engine ready.`);
   console.log(paint.dim("  powered by opencode (MIT) \xB7 run `agentful licenses` for details"));
   return binPath;
 }
 
 // src/lib/gatewayToken.ts
-var import_node_fs10 = require("fs");
-var import_node_path12 = require("path");
-var cachePath = () => (0, import_node_path12.join)(configDir(), "gateway.json");
+var import_node_fs11 = require("fs");
+var import_node_path13 = require("path");
+var cachePath = () => (0, import_node_path13.join)(configDir(), "gateway.json");
 async function ensureGatewaySession(auth, projectId) {
   try {
-    const cached = JSON.parse((0, import_node_fs10.readFileSync)(cachePath(), "utf8"));
+    const cached = JSON.parse((0, import_node_fs11.readFileSync)(cachePath(), "utf8"));
     if (cached?.token && cached.expires_at - Date.now() / 1e3 > 3600) {
       return cached;
     }
@@ -6886,18 +7057,18 @@ async function ensureGatewaySession(auth, projectId) {
     body: projectId ? { project_id: projectId } : {},
     timeoutMs: 3e4
   });
-  (0, import_node_fs10.mkdirSync)(configDir(), { recursive: true });
-  (0, import_node_fs10.writeFileSync)(cachePath(), JSON.stringify(res, null, 2) + "\n", "utf8");
+  (0, import_node_fs11.mkdirSync)(configDir(), { recursive: true });
+  (0, import_node_fs11.writeFileSync)(cachePath(), JSON.stringify(res, null, 2) + "\n", "utf8");
   try {
-    (0, import_node_fs10.chmodSync)(cachePath(), 384);
+    (0, import_node_fs11.chmodSync)(cachePath(), 384);
   } catch {
   }
   return res;
 }
 
 // src/lib/engineConfig.ts
-var import_node_fs12 = require("fs");
-var import_node_path14 = require("path");
+var import_node_fs13 = require("fs");
+var import_node_path15 = require("path");
 var import_node_os5 = require("os");
 
 // src/branding/agentful-theme.json
@@ -7040,22 +7211,22 @@ ${cmd.template}
 }
 
 // src/lib/tools.ts
-var import_node_fs11 = require("fs");
-var import_node_path13 = require("path");
+var import_node_fs12 = require("fs");
+var import_node_path14 = require("path");
 function assetsDir() {
-  const here = (0, import_node_path13.dirname)(process.argv[1] || "");
-  for (const candidate of [(0, import_node_path13.join)(here, "..", "assets"), (0, import_node_path13.join)(here, "assets")]) {
-    if ((0, import_node_fs11.existsSync)((0, import_node_path13.join)(candidate, "tools", "imagegen.ts"))) return candidate;
+  const here = (0, import_node_path14.dirname)(process.argv[1] || "");
+  for (const candidate of [(0, import_node_path14.join)(here, "..", "assets"), (0, import_node_path14.join)(here, "assets")]) {
+    if ((0, import_node_fs12.existsSync)((0, import_node_path14.join)(candidate, "tools", "imagegen.ts"))) return candidate;
   }
   return null;
 }
 function installEngineTools(configDir2) {
   const assets = assetsDir();
   if (!assets) return false;
-  const target = (0, import_node_path13.join)(configDir2, "tools");
-  (0, import_node_fs11.mkdirSync)(target, { recursive: true });
+  const target = (0, import_node_path14.join)(configDir2, "tools");
+  (0, import_node_fs12.mkdirSync)(target, { recursive: true });
   try {
-    (0, import_node_fs11.cpSync)((0, import_node_path13.join)(assets, "tools"), target, { recursive: true });
+    (0, import_node_fs12.cpSync)((0, import_node_path14.join)(assets, "tools"), target, { recursive: true });
     return true;
   } catch {
     return false;
@@ -7125,6 +7296,14 @@ function managedServerLine(backend) {
   const ownApi = backend.serverMode === "byo" ? "Server: the owner connected **an API of their own** \u2014 `/api/*` on the app's domain is forwarded to it, and the platform adds no secret and authorizes nobody. " : "";
   return `${ownApi}Managed server: **not switched on** in the Backend tab. **Action files you push are stored, but every call to them answers \`404 server_not_enabled\`** until the owner switches the managed server on (\`agentful backend\` opens the tab; the CLI can enable the database, NOT the server). Switching on takes effect on the next call. Never tell the user an action works before the server is on.`;
 }
+function buildEnvList() {
+  const entries = contract_default.publish.build_env.injected;
+  const when = {
+    always: "always",
+    byo_supabase: "only while the owner's own Supabase database is connected in the Backend tab"
+  };
+  return entries.map((e) => `  - ${e.prefixes.map((p) => `\`${p}${e.suffix}\``).join(", ")} \u2014 ${when[e.when] ?? e.when}`).join("\n");
+}
 var bytes = (n) => n >= 1024 * 1024 ? `${n / (1024 * 1024)} MB` : `${n / 1024} KB`;
 function serverSideSection() {
   const tracks = contract_default.server_side;
@@ -7180,18 +7359,26 @@ is fine \u2014 but then say clearly that \`agentful push\` cannot deploy it.
   Server-side logic has its own place \u2014 see "Where server logic belongs".
 - The canonical build output is a root-level \`index.html\` inside the
   framework's output directory.
-- There are **no build-time env vars**: the cloud build injects nothing beyond
-  NODE_ENV. There is no settings tab for build secrets \u2014 do not invent one.
-  Backend-tab secrets are runtime-only for Managed Server Actions and never
-  reach a build; the workspace executor injects only allowlisted PUBLIC client
-  vars (\`database.anon_key\`/\`publishable_key\` expanded as
-  \`VITE_\`/\`PUBLIC_\`/\`NEXT_PUBLIC_\`). Never rely on \`.env*\` files reaching the
-  cloud \u2014 the CLI and server both strip them.
-- So PUBLIC client values go into an ordinary source constant, not into
-  \`import.meta.env\`/\`process.env\`: the project ID (below) and, when the app
-  talks to the owner's own Supabase, its project URL and **publishable (anon)
-  key**. In an \`agentful push\` build \`import.meta.env.VITE_SUPABASE_URL\` is
-  \`undefined\` \u2014 the app would compile and then fail to reach its database.
+- You **cannot set build-time env vars**, and there is no settings tab for
+  build secrets \u2014 do not invent one. Backend-tab secrets are runtime-only for
+  Managed Server Actions and never reach a build. Every cloud build \u2014 the
+  workspace build and the \`agentful push\` build alike \u2014 defines the same
+  fixed allowlist of PUBLIC client values, and nothing else:
+${buildEnvList()}
+  Never rely on \`.env*\` files reaching the cloud \u2014 the CLI never uploads
+  them.
+- A cloud build **rejects** a read of one of those names while nothing defines
+  it (e.g. \`import.meta.env.VITE_SUPABASE_URL\` with no own Supabase database
+  connected): it would compile to \`undefined\` without any build error and the
+  app would fail to reach its database. A read of any OTHER
+  \`VITE_\`/\`PUBLIC_\`/\`NEXT_PUBLIC_\` name is never defined by the platform; the
+  build warns and inlines \`undefined\`.
+- So PUBLIC client values of your own go into an ordinary source constant, not
+  into \`import.meta.env\`/\`process.env\`. For the project ID (below) and, when
+  the app talks to the owner's own Supabase, its project URL and **publishable
+  (anon) key**, a source constant is also the form that works in local
+  development: on this machine nothing defines the names above unless the user
+  keeps a local \`.env\`, which never leaves it.
   Never put a Supabase **secret / service-role key** in source: that one
   belongs in Backend-tab secrets and is only readable from a Managed Server
   Action.
@@ -7342,7 +7529,7 @@ var CLOUD_AGENT_PROMPT = `You are the Agentful Cloud build agent: everything you
 var LOCAL_AGENT_PROMPT = `You are in local-only mode: free local development with no cloud deployment target \u2014 any stack is fine. Be clear that this directory will NOT be deployable with \`agentful push\` unless it satisfies the platform contract in AGENTFUL_CLOUD.md (${SERVER_SIDE_IN_ONE_SENTENCE}). If the user asks to deploy or push, check the contract first and say honestly whether the project can ship on the platform; never claim cloud deployability without evidence.`;
 function readAuthFile(path) {
   try {
-    return (0, import_node_fs12.readFileSync)(path, "utf8");
+    return (0, import_node_fs13.readFileSync)(path, "utf8");
   } catch {
     return null;
   }
@@ -7407,11 +7594,11 @@ function buildEngineConfig(opts) {
   };
 }
 function engineXdg() {
-  const root = (0, import_node_path14.join)((0, import_node_os5.homedir)(), ".local", "share", "agentful");
+  const root = (0, import_node_path15.join)((0, import_node_os5.homedir)(), ".local", "share", "agentful");
   return {
-    configHome: (0, import_node_path14.join)(root, "engine-config"),
-    dataHome: (0, import_node_path14.join)(root, "engine-data"),
-    stateHome: (0, import_node_path14.join)(root, "engine-state")
+    configHome: (0, import_node_path15.join)(root, "engine-config"),
+    dataHome: (0, import_node_path15.join)(root, "engine-data"),
+    stateHome: (0, import_node_path15.join)(root, "engine-state")
   };
 }
 async function resolveTheme() {
@@ -7430,24 +7617,24 @@ async function resolveTheme() {
 }
 async function writeEngineSession(session, catalog, localProviders = {}, framework = "unknown", skillsInstruction = null, backendState, model) {
   const xdg = engineXdg();
-  const configDir2 = (0, import_node_path14.join)(xdg.configHome, "opencode");
-  const dataDir = (0, import_node_path14.join)(xdg.dataHome, "opencode");
-  const themesDir = (0, import_node_path14.join)(configDir2, "themes");
-  const pluginsDir = (0, import_node_path14.join)(configDir2, "plugins");
-  const commandsDir = (0, import_node_path14.join)(configDir2, "commands");
-  for (const dir of [themesDir, pluginsDir, commandsDir, dataDir, (0, import_node_path14.join)(xdg.stateHome, "opencode")]) {
-    (0, import_node_fs12.mkdirSync)(dir, { recursive: true });
+  const configDir2 = (0, import_node_path15.join)(xdg.configHome, "opencode");
+  const dataDir = (0, import_node_path15.join)(xdg.dataHome, "opencode");
+  const themesDir = (0, import_node_path15.join)(configDir2, "themes");
+  const pluginsDir = (0, import_node_path15.join)(configDir2, "plugins");
+  const commandsDir = (0, import_node_path15.join)(configDir2, "commands");
+  for (const dir of [themesDir, pluginsDir, commandsDir, dataDir, (0, import_node_path15.join)(xdg.stateHome, "opencode")]) {
+    (0, import_node_fs13.mkdirSync)(dir, { recursive: true });
   }
   const imagegenAvailable = installEngineTools(configDir2) && session.img_on !== false;
-  const cloudInstructionsPath = (0, import_node_path14.join)(configDir2, CLOUD_INSTRUCTIONS_FILENAME);
-  (0, import_node_fs12.writeFileSync)(cloudInstructionsPath, renderCloudInstructions(framework, backendState));
-  const skillsPath = (0, import_node_path14.join)(configDir2, "AGENTFUL_SKILLS.md");
+  const cloudInstructionsPath = (0, import_node_path15.join)(configDir2, CLOUD_INSTRUCTIONS_FILENAME);
+  (0, import_node_fs13.writeFileSync)(cloudInstructionsPath, renderCloudInstructions(framework, backendState));
+  const skillsPath = (0, import_node_path15.join)(configDir2, "AGENTFUL_SKILLS.md");
   const instructionPaths = [cloudInstructionsPath];
   if (skillsInstruction) {
-    (0, import_node_fs12.writeFileSync)(skillsPath, skillsInstruction);
+    (0, import_node_fs13.writeFileSync)(skillsPath, skillsInstruction);
     instructionPaths.push(skillsPath);
   } else {
-    (0, import_node_fs12.rmSync)(skillsPath, { force: true });
+    (0, import_node_fs13.rmSync)(skillsPath, { force: true });
   }
   const config = buildEngineConfig({
     session,
@@ -7457,13 +7644,13 @@ async function writeEngineSession(session, catalog, localProviders = {}, framewo
     instructionPaths,
     model
   });
-  (0, import_node_fs12.writeFileSync)((0, import_node_path14.join)(configDir2, "config.json"), JSON.stringify(config, null, 2));
-  const authPath2 = (0, import_node_path14.join)(dataDir, "auth.json");
-  (0, import_node_fs12.writeFileSync)(authPath2, mergedAuthJson(readAuthFile(authPath2), session.token));
+  (0, import_node_fs13.writeFileSync)((0, import_node_path15.join)(configDir2, "config.json"), JSON.stringify(config, null, 2));
+  const authPath2 = (0, import_node_path15.join)(dataDir, "auth.json");
+  (0, import_node_fs13.writeFileSync)(authPath2, mergedAuthJson(readAuthFile(authPath2), session.token));
   const { brandingPluginSource: brandingPluginSource2 } = await Promise.resolve().then(() => (init_plugin(), plugin_exports));
-  const pluginPath = (0, import_node_path14.join)(pluginsDir, "agentful-branding.tsx");
-  (0, import_node_fs12.writeFileSync)(pluginPath, brandingPluginSource2());
-  (0, import_node_fs12.writeFileSync)((0, import_node_path14.join)(configDir2, "tui.json"), JSON.stringify({
+  const pluginPath = (0, import_node_path15.join)(pluginsDir, "agentful-branding.tsx");
+  (0, import_node_fs13.writeFileSync)(pluginPath, brandingPluginSource2());
+  (0, import_node_fs13.writeFileSync)((0, import_node_path15.join)(configDir2, "tui.json"), JSON.stringify({
     theme: "agentful",
     plugin: [`file://${pluginPath}`],
     // The engine's own sidebar sections are plugins with fixed ids, and
@@ -7475,13 +7662,13 @@ async function writeEngineSession(session, catalog, localProviders = {}, framewo
     // state over this map.
     plugin_enabled: DISABLED_ENGINE_PLUGINS
   }, null, 2));
-  (0, import_node_fs12.writeFileSync)((0, import_node_path14.join)(themesDir, "agentful.json"), JSON.stringify(await resolveTheme(), null, 2));
+  (0, import_node_fs13.writeFileSync)((0, import_node_path15.join)(themesDir, "agentful.json"), JSON.stringify(await resolveTheme(), null, 2));
   for (const name of Object.keys(SLASH_COMMANDS)) {
-    (0, import_node_fs12.writeFileSync)((0, import_node_path14.join)(commandsDir, `${name}.md`), commandMarkdown(name));
+    (0, import_node_fs13.writeFileSync)((0, import_node_path15.join)(commandsDir, `${name}.md`), commandMarkdown(name));
   }
   for (const legacy of ["xdg-config", "xdg-data", "xdg-state"]) {
     try {
-      (0, import_node_fs12.rmSync)((0, import_node_path14.join)((0, import_node_os5.homedir)(), ".local", "share", "agentful", legacy), { recursive: true, force: true });
+      (0, import_node_fs13.rmSync)((0, import_node_path15.join)((0, import_node_os5.homedir)(), ".local", "share", "agentful", legacy), { recursive: true, force: true });
     } catch {
     }
   }
@@ -7489,8 +7676,8 @@ async function writeEngineSession(session, catalog, localProviders = {}, framewo
 }
 
 // src/lib/skills.ts
-var import_node_fs13 = require("fs");
-var import_node_path15 = require("path");
+var import_node_fs14 = require("fs");
+var import_node_path16 = require("path");
 
 // src/generated/skills.json
 var skills_default = {
@@ -7559,7 +7746,7 @@ var SCAFFOLD_BY_FRAMEWORK = {
 };
 function hasVueDependency(rootDir) {
   try {
-    const pkg = JSON.parse((0, import_node_fs13.readFileSync)((0, import_node_path15.join)(rootDir, "package.json"), "utf8"));
+    const pkg = JSON.parse((0, import_node_fs14.readFileSync)((0, import_node_path16.join)(rootDir, "package.json"), "utf8"));
     return Boolean({ ...pkg.dependencies, ...pkg.devDependencies }["vue"]);
   } catch {
     return false;
@@ -7589,7 +7776,7 @@ function renderSkillsInstruction(names) {
   return "# Platform deployment skills (mandatory)\n\nThese are the same skills the cloud build agent loads for this stack.\nFollow them when scaffolding or editing \u2014 they are not optional hints.\n\n" + sections.join("\n\n---\n\n") + "\n";
 }
 function skillsInstructionFor(framework, rootDir) {
-  if (!(0, import_node_fs13.existsSync)(rootDir)) return null;
+  if (!(0, import_node_fs14.existsSync)(rootDir)) return null;
   return renderSkillsInstruction(selectSkills(framework, rootDir));
 }
 
@@ -7737,15 +7924,15 @@ function decideLocalProviders(policy) {
 }
 
 // src/lib/localProviders.ts
-var import_node_fs14 = require("fs");
-var import_node_path16 = require("path");
+var import_node_fs15 = require("fs");
+var import_node_path17 = require("path");
 var LOCAL_PROVIDERS_FILE = "local-providers.json";
 function localProvidersPath() {
-  return (0, import_node_path16.join)(configDir(), LOCAL_PROVIDERS_FILE);
+  return (0, import_node_path17.join)(configDir(), LOCAL_PROVIDERS_FILE);
 }
 function readLocalProviders() {
   try {
-    const raw = JSON.parse((0, import_node_fs14.readFileSync)(localProvidersPath(), "utf8"));
+    const raw = JSON.parse((0, import_node_fs15.readFileSync)(localProvidersPath(), "utf8"));
     if (raw && typeof raw === "object" && !Array.isArray(raw)) {
       const map = raw.providers && typeof raw.providers === "object" ? raw.providers : raw;
       const usable = {};
@@ -7780,8 +7967,8 @@ function resolveLocalProviders(policy) {
 }
 function writeLocalProvidersExample() {
   const path = localProvidersPath();
-  if ((0, import_node_fs14.existsSync)(path)) return path;
-  (0, import_node_fs14.mkdirSync)(configDir(), { recursive: true });
+  if ((0, import_node_fs15.existsSync)(path)) return path;
+  (0, import_node_fs15.mkdirSync)(configDir(), { recursive: true });
   const example = {
     _comment: 'Providers with your own API key, running locally. Requests go directly to the provider \u2014 no Agentful credits, no platform region guarantee. Remove the leading underscore from "_anthropic" and fill in your key to enable it.',
     _anthropic: {
@@ -7791,17 +7978,17 @@ function writeLocalProvidersExample() {
       models: { "claude-sonnet-4-5": { name: "Claude Sonnet 4.5 (my key)" } }
     }
   };
-  (0, import_node_fs14.writeFileSync)(path, JSON.stringify(example, null, 2) + "\n", "utf8");
+  (0, import_node_fs15.writeFileSync)(path, JSON.stringify(example, null, 2) + "\n", "utf8");
   try {
-    (0, import_node_fs14.chmodSync)(path, 384);
+    (0, import_node_fs15.chmodSync)(path, 384);
   } catch {
   }
   return path;
 }
 
 // src/lib/sessions.ts
-var import_node_fs15 = require("fs");
-var import_node_path17 = require("path");
+var import_node_fs16 = require("fs");
+var import_node_path18 = require("path");
 var import_node_child_process4 = require("child_process");
 function parseSessionModel(raw) {
   if (!raw) return null;
@@ -7818,8 +8005,8 @@ function parseSessionModel(raw) {
   }
 }
 function modelForSession(sessionID) {
-  const dbPath = (0, import_node_path17.join)(engineXdg().dataHome, "opencode", "opencode.db");
-  if (!(0, import_node_fs15.existsSync)(dbPath)) return null;
+  const dbPath = (0, import_node_path18.join)(engineXdg().dataHome, "opencode", "opencode.db");
+  if (!(0, import_node_fs16.existsSync)(dbPath)) return null;
   const escaped = sessionID.replace(/'/g, "''");
   const res = (0, import_node_child_process4.spawnSync)(
     "sqlite3",
@@ -7840,8 +8027,8 @@ function modelForSession(sessionID) {
   }
 }
 function lastSessionForDirectory(cwd = process.cwd()) {
-  const dbPath = (0, import_node_path17.join)(engineXdg().dataHome, "opencode", "opencode.db");
-  if (!(0, import_node_fs15.existsSync)(dbPath)) return null;
+  const dbPath = (0, import_node_path18.join)(engineXdg().dataHome, "opencode", "opencode.db");
+  if (!(0, import_node_fs16.existsSync)(dbPath)) return null;
   const escaped = cwd.replace(/'/g, "''");
   const res = (0, import_node_child_process4.spawnSync)(
     "sqlite3",
@@ -7867,9 +8054,9 @@ function lastSessionForDirectory(cwd = process.cwd()) {
 }
 
 // src/lib/modelPin.ts
-var import_node_fs16 = require("fs");
-var import_node_path18 = require("path");
-var PROJECT_MODEL_PIN = (0, import_node_path18.join)(".agentful", "model.json");
+var import_node_fs17 = require("fs");
+var import_node_path19 = require("path");
+var PROJECT_MODEL_PIN = (0, import_node_path19.join)(".agentful", "model.json");
 function isCanonicalModel(value) {
   const slash = value.indexOf("/");
   return slash > 0 && slash < value.length - 1 && !/\s/.test(value);
@@ -7889,10 +8076,10 @@ function assertModelPin(pin, source) {
   return pin;
 }
 function readProjectModelPin(cwd = process.cwd()) {
-  const path = (0, import_node_path18.join)(cwd, PROJECT_MODEL_PIN);
+  const path = (0, import_node_path19.join)(cwd, PROJECT_MODEL_PIN);
   let raw;
   try {
-    raw = (0, import_node_fs16.readFileSync)(path, "utf8");
+    raw = (0, import_node_fs17.readFileSync)(path, "utf8");
   } catch (error) {
     const code = error.code;
     if (code === "ENOENT") return null;
@@ -7919,7 +8106,7 @@ function readProjectModelPin(cwd = process.cwd()) {
 function readEngineVariants(xdg) {
   try {
     const parsed = JSON.parse(
-      (0, import_node_fs16.readFileSync)((0, import_node_path18.join)(xdg.stateHome, "opencode", "model.json"), "utf8")
+      (0, import_node_fs17.readFileSync)((0, import_node_path19.join)(xdg.stateHome, "opencode", "model.json"), "utf8")
     );
     if (!parsed.variant || typeof parsed.variant !== "object" || Array.isArray(parsed.variant)) return {};
     return Object.fromEntries(
@@ -7931,17 +8118,17 @@ function readEngineVariants(xdg) {
 }
 function writeEngineVariant(xdg, model, variant) {
   assertModelPin({ model, variant }, "Selected");
-  const path = (0, import_node_path18.join)(xdg.stateHome, "opencode", "model.json");
+  const path = (0, import_node_path19.join)(xdg.stateHome, "opencode", "model.json");
   let state = {};
   try {
-    const parsed = JSON.parse((0, import_node_fs16.readFileSync)(path, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs17.readFileSync)(path, "utf8"));
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) state = parsed;
   } catch {
   }
   const existing = state.variant;
   const variants = existing && typeof existing === "object" && !Array.isArray(existing) ? existing : {};
   state.variant = { ...variants, [model]: variant };
-  (0, import_node_fs16.writeFileSync)(path, JSON.stringify(state, null, 2) + "\n", "utf8");
+  (0, import_node_fs17.writeFileSync)(path, JSON.stringify(state, null, 2) + "\n", "utf8");
 }
 function resolveModelPin(opts) {
   const cliPin = opts.cliModel ? assertModelPin({ model: opts.cliModel, variant: opts.cliVariant }, "CLI") : null;
@@ -7990,8 +8177,8 @@ function resolveModelPin(opts) {
 // src/lib/engineModels.ts
 var import_node_child_process5 = require("child_process");
 var import_node_util = require("util");
-var import_node_fs17 = require("fs");
-var import_node_path19 = require("path");
+var import_node_fs18 = require("fs");
+var import_node_path20 = require("path");
 var execFileAsync = (0, import_node_util.promisify)(import_node_child_process5.execFile);
 function parseEngineModelsOutput(output) {
   return Array.from(new Set(
@@ -8042,7 +8229,7 @@ async function assertEngineModelAvailable(binPath, xdg, model, listModels = list
 function readConnectedEngineProviders(xdg) {
   try {
     const parsed = JSON.parse(
-      (0, import_node_fs17.readFileSync)((0, import_node_path19.join)(xdg.dataHome, "opencode", "auth.json"), "utf8")
+      (0, import_node_fs18.readFileSync)((0, import_node_path20.join)(xdg.dataHome, "opencode", "auth.json"), "utf8")
     );
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return [];
     return Object.keys(parsed).filter((id) => id !== "agentful").sort();
@@ -8470,7 +8657,7 @@ async function tuiCommand(opts = {}) {
           ...process.env,
           // Slash commands run `agentful …` through the agent's bash tool, which
           // has no access to the user's shell aliases.
-          PATH: `${binDir}${import_node_path20.delimiter}${process.env.PATH || ""}`,
+          PATH: `${binDir}${import_node_path21.delimiter}${process.env.PATH || ""}`,
           XDG_CONFIG_HOME: xdg.configHome,
           XDG_DATA_HOME: xdg.dataHome,
           XDG_STATE_HOME: xdg.stateHome,
@@ -8601,38 +8788,38 @@ async function shareCommand(opts) {
 }
 
 // src/commands/pull.ts
-var import_node_fs19 = require("fs");
-var import_node_path22 = require("path");
+var import_node_fs20 = require("fs");
+var import_node_path23 = require("path");
 init_branding();
 init_branding();
 
 // src/lib/pullFiles.ts
-var import_node_fs18 = require("fs");
-var import_node_path21 = require("path");
+var import_node_fs19 = require("fs");
+var import_node_path22 = require("path");
 var INLINE_BASE64_EXTENSIONS = /\.(?:png|jpe?g|gif|webp|avif|svg|ico|bmp|tiff?|woff2?|ttf|otf|eot|pdf|docx?|xlsx?|pptx?|zip|tar|gz|7z|rar|bz2|mp[34]|m4a|wav|ogg|avi|mov|mkv|flac|webm|exe|dll|so|dylib|bin|wasm)$/i;
 function inlineContent(value) {
   return typeof value === "object" && value !== null && "content" in value ? String(value.content) : String(value ?? "");
 }
 function writePulledWorkspaceEntry(root, rel, value) {
-  const target = (0, import_node_path21.join)(root, rel);
-  (0, import_node_fs18.mkdirSync)((0, import_node_path21.dirname)(target), { recursive: true });
+  const target = (0, import_node_path22.join)(root, rel);
+  (0, import_node_fs19.mkdirSync)((0, import_node_path22.dirname)(target), { recursive: true });
   const content = inlineContent(value);
   if (INLINE_BASE64_EXTENSIONS.test(rel)) {
-    (0, import_node_fs18.writeFileSync)(target, Buffer.from(content, "base64"));
+    (0, import_node_fs19.writeFileSync)(target, Buffer.from(content, "base64"));
     return;
   }
-  (0, import_node_fs18.writeFileSync)(target, content, "utf8");
+  (0, import_node_fs19.writeFileSync)(target, content, "utf8");
 }
 function writePulledBackendDeclaration(root, declaration) {
-  const target = (0, import_node_path21.join)(root, ".agentful", "backend.json");
-  (0, import_node_fs18.mkdirSync)((0, import_node_path21.dirname)(target), { recursive: true });
+  const target = (0, import_node_path22.join)(root, ".agentful", "backend.json");
+  (0, import_node_fs19.mkdirSync)((0, import_node_path22.dirname)(target), { recursive: true });
   const {
     source: _source,
     received_at: _receivedAt,
     last_sync: _lastSync,
     ...portableDeclaration
   } = declaration;
-  (0, import_node_fs18.writeFileSync)(target, `${JSON.stringify(portableDeclaration, null, 2)}
+  (0, import_node_fs19.writeFileSync)(target, `${JSON.stringify(portableDeclaration, null, 2)}
 `, "utf8");
 }
 
@@ -8641,7 +8828,7 @@ async function pullCommand(opts) {
   console.log(banner());
   const auth = await ensureAuth();
   const project = requireProject();
-  const nonHidden = (0, import_node_fs19.readdirSync)(process.cwd()).filter((n) => n !== ".agentful" && !n.startsWith("."));
+  const nonHidden = (0, import_node_fs20.readdirSync)(process.cwd()).filter((n) => n !== ".agentful" && !n.startsWith("."));
   if (nonHidden.length > 0 && !opts.force) {
     throw new ApiError(
       0,
@@ -8668,9 +8855,9 @@ async function pullCommand(opts) {
         ui.warn(`Skipped ${rel} (HTTP ${resp.status})`);
         continue;
       }
-      const target = (0, import_node_path22.join)(process.cwd(), rel);
-      (0, import_node_fs19.mkdirSync)((0, import_node_path22.dirname)(target), { recursive: true });
-      (0, import_node_fs19.writeFileSync)(target, Buffer.from(await resp.arrayBuffer()));
+      const target = (0, import_node_path23.join)(process.cwd(), rel);
+      (0, import_node_fs20.mkdirSync)((0, import_node_path23.dirname)(target), { recursive: true });
+      (0, import_node_fs20.writeFileSync)(target, Buffer.from(await resp.arrayBuffer()));
       written++;
     }
   } else if (data.files) {