minutework 0.1.33 → 0.1.35

package/EXTERNAL_ALPHA.md

@@ -120,14 +120,16 @@ If you run `minutework init` **without** `--starter` in an interactive terminal,
 The generated `tenant-app/.env.example` defaults to:
 
 ```dotenv
-MW_CONTENT_API_TOKEN=
-MW_PUBLIC_SITE_PROPERTY_KEY=main-site
-MW_PUBLIC_SITE_ENV=preview
+NEXT_PUBLIC_MW_APP_ID=tenant.app
+MW_TEMPLATE_APP_NAME=Tenant App
+MW_PUBLIC_BASE_URL=
 ```
 
-`MW_CONTENT_API_TOKEN` stays server-only. `MW_PUBLIC_SITE_ENV=preview` targets
-preview or draft-safe reads, while `MW_PUBLIC_SITE_ENV=live` is publication-safe
-and intended for published snapshot delivery.
+`tenant-app` browser auth and manifest calls use same-origin `/_mw` routes
+through `@minutework/web-auth`. Do not add platform content tokens or
+public-site property variables to the SDK-based tenant app; public content
+should come from hosted published releases/snapshots or gateway-approved
+public-content routes over the MinuteWork substrate.
 
 If the workspace cannot compile hosted preview release metadata for the linked property, deploy fails closed.
 

package/README.md

@@ -122,7 +122,7 @@ Combined **tenant-app + sidecar** workspaces keep sidecar setup explicit. Root `
 
 For direct third-party web hosts such as Vercel, deploy `tenant-app` only. In Vercel, point the project Root Directory at `tenant-app`; the optional sidecar remains a separate Poetry-managed surface.
 
-`link` provisions or resolves the default published-site property for the active tenant and stores that property key in repo-local state. The generated `tenant-app/.env.example` includes the standard site env contract: `MW_CONTENT_API_TOKEN`, `MW_PUBLIC_SITE_PROPERTY_KEY`, and `MW_PUBLIC_SITE_ENV`. It defaults to `MW_PUBLIC_SITE_PROPERTY_KEY=main-site` and `MW_PUBLIC_SITE_ENV=preview`.
+`link` provisions or resolves the default published-site property for the active tenant and stores that property key in repo-local state. The SDK-based `tenant-app/.env.example` contains only the app metadata contract used by the template: `NEXT_PUBLIC_MW_APP_ID`, `MW_TEMPLATE_APP_NAME`, and optional `MW_PUBLIC_BASE_URL`. Browser auth and manifest calls use same-origin `/_mw` routes through `@minutework/web-auth`; do not add platform content tokens or public-site property vars to the tenant app.
 
 `deploy --preview` always revalidates and recompiles before submit, prints a local-vs-remote diff, requires confirmation unless `--yes` is passed, polls typed receipts until a terminal state, and persists the last known preview deploy state under `.minutework/deploy/preview/status.json`. This alpha is preview-first; live public delivery remains follow-on.
 

package/assets/claude-local/CLAUDE.md.template

@@ -6,10 +6,13 @@ smallest surface that fits the request.
 
 `tenant-app` is the combined web starter: public site routes at the root plus a
 private authenticated workspace under `/app`.
+It uses `@minutework/web-auth` through a thin `src/mw/` substrate and
+same-origin `/_mw` routes; do not add per-app auth/gateway BFF routes or
+browser-stored tokens.
 
 `mobile` is the standalone Expo/React Native client starter. It talks directly
 to the platform with native device-flow auth and bearer tokens; it is not a
-`tenant-app` BFF cookie client and not a `sidecar`. It ships through the
+`tenant-app` web SDK cookie client and not a `sidecar`. It ships through the
 developer's own EAS/App Store/Play Store pipeline, not `minutework deploy`.
 
 ## Refresh Managed Guidance
@@ -189,13 +192,14 @@ a concrete backend responsibility such as:
 - `mw.core.site` already includes `config`, `page`, `nav`, `form`, and
   `submission` schemas before Builder starts authoring.
 - Author public content against runtime/CMS records and published-web flows, not
-  against a fixed in-repo marketing template.
-- Use `MW_PUBLIC_CONTENT_SOURCE` to select the public content adapter mode.
-- `MW_CONTENT_API_TOKEN`, `MW_PUBLIC_SITE_PROPERTY_KEY`, and
-  `MW_PUBLIC_SITE_ENV` are required only for `MW_PUBLIC_CONTENT_SOURCE=minutework_cms`.
-- `MW_STATIC_PUBLIC_CONTENT_PATH` is used for `MW_PUBLIC_CONTENT_SOURCE=static_json`.
-- `MW_PUBLIC_SITE_ENV=preview` is for preview or draft-safe reads.
-- `MW_PUBLIC_SITE_ENV=live` is for publication-safe delivery.
+  against a fixed in-repo marketing template or a server-only content-token
+  adapter in `tenant-app`.
+- The SDK-based `tenant-app` public metadata env contract is
+  `NEXT_PUBLIC_MW_APP_ID`, `MW_TEMPLATE_APP_NAME`, and optional
+  `MW_PUBLIC_BASE_URL`; do not add legacy `MW_CONTENT_API_TOKEN`,
+  `MW_PUBLIC_CONTENT_SOURCE`, `MW_PUBLIC_SITE_PROPERTY_KEY`,
+  `MW_PUBLIC_SITE_ENV`, or `MW_STATIC_PUBLIC_CONTENT_PATH` variables unless a
+  compatibility task explicitly targets that old adapter.
 - Anonymous live delivery should prefer published snapshots instead of direct
   runtime reads on every request.
 - `runtime_local_sidecar` is an opt-in public-site serving exception, not the

package/assets/claude-local/skills/app-pack-authoring/SKILL.md

@@ -21,6 +21,16 @@ An `app pack` is the shipped product unit.
   per-app `src/app/api/auth/*`, `src/app/api/gateway/*`, platform-session BFF
   layers, platform credential login screens, operator-console links, or
   runtime-command demos.
+- If a generated workspace reports `@minutework/web-auth` as missing, treat it
+  as dependency installation, package publishing, or package sync work. Do not
+  hand-roll auth/data routes or browser tokens as a workaround.
+- The template may render a local `/login` page that calls SDK hooks. The SDK
+  also exposes hosted UI helpers for same-origin `/_mw/login`,
+  `/_mw/signup`, and `/_mw/verify-email`; both choices remain SDK-only.
+- Client-side `/app` session checks are UX gating only. Real authorization is
+  enforced server-side by platform `/_mw` routes and runtime dispatch checks:
+  active customer membership, email verification, app publication, and
+  `webCustomerExposed` / `web_customer_exposed` manifest declarations.
 - Browser calls from `tenant-app` should use `mw.query(...)` and
   `mw.action(..., { idempotencyKey })`; actions require a non-empty
   idempotency key. The runtime surface must be declared on the manifest with

package/assets/claude-local/skills/generated-workspace-architecture/SKILL.md

@@ -26,6 +26,15 @@ the monorepo or a live tenant runtime.
   `src/mw/` substrate and `@minutework/web-auth`. Product UI may call that
   substrate, but it must not recreate platform-session BFF routes, platform
   credential login, or browser-exposed platform/runtime tokens.
+- If `@minutework/web-auth` is not installed or resolvable in a generated
+  workspace, fix dependency installation, package publishing, or package sync.
+  Do not replace the SDK with local auth/gateway routes.
+- A local `/login` page may call SDK hooks, while SDK hosted UI helpers point
+  to same-origin `/_mw/login`, `/_mw/signup`, and `/_mw/verify-email`; both
+  are valid only when they stay on the SDK/`/_mw` contract.
+- Client-side app guards are UX only. Platform `/_mw` routes and runtime
+  dispatch enforce active customer membership, email verification, app
+  publication, and manifest exposure server-side.
 - `tenant-app` runtime data access goes through `mw.query(...)` and
   `mw.action(..., { idempotencyKey })` against manifest-declared
   `webCustomerExposed` / `web_customer_exposed` customer surfaces.

package/assets/templates/next-tenant-app/.env.example

@@ -1,9 +1,3 @@
-MW_PLATFORM_BASE_URL=http://127.0.0.1:8000
-MW_PUBLIC_CONTENT_SOURCE=none
-MW_CONTENT_API_TOKEN=
-MW_TEMPLATE_APP_NAME=MinuteWork Combined Starter
+NEXT_PUBLIC_MW_APP_ID=tenant.app
+MW_TEMPLATE_APP_NAME=Tenant App
 MW_PUBLIC_BASE_URL=
-MW_PUBLIC_SITE_PROPERTY_KEY=
-MW_PUBLIC_SITE_ENV=preview
-MW_STATIC_PUBLIC_CONTENT_PATH=content/public-site.json
-MW_ENABLE_RUNTIME_COMMAND_EXAMPLE=false

package/assets/templates/next-tenant-app/README.md

@@ -22,6 +22,20 @@ This template uses the `tenant_web_auth_sdk` profile:
 Only `src/mw/` is MinuteWork substrate. Keep product UI and product logic in
 `src/app`, `src/features`, and developer-owned modules.
 
+The local `/login` route is product UI that calls SDK hooks. The SDK also
+provides hosted UI helpers for same-origin `/_mw/login`, `/_mw/signup`, and
+`/_mw/verify-email` URLs; both paths stay on the same SDK contract.
+
+Client-side `/app` session checks are only UX gating. Authorization is enforced
+by the platform `/_mw` routes and runtime dispatch: active customer membership,
+email verification, app publication, and manifest `web_customer_exposed`
+declarations are checked server-side.
+
+If a generated workspace reports `@minutework/web-auth` as missing, treat that
+as a dependency installation or package publishing/sync issue. Do not recreate
+platform BFF routes, browser bearer tokens, or platform credential login as a
+workaround.
+
 ## Default route shape
 
 - public routes at `/`, `/pricing`, `/docs`, and `/blog`
@@ -29,6 +43,10 @@ Only `src/mw/` is MinuteWork substrate. Keep product UI and product logic in
 - authenticated workspace at `/app`
 - SDK manifest demo at `/app/demo`
 
+All `/app/*` routes are wrapped by `src/app/app/layout.tsx`, which renders the
+shared authenticated layout guard. Individual `/app` pages should assume an
+authenticated tenant-customer session instead of reimplementing auth checks.
+
 The template intentionally does not include `src/lib/platform/*`,
 `src/app/api/auth/*`, `src/app/api/gateway/*`, an operator-console link, a
 runtime-command demo, or a server-only public-content token adapter.

package/assets/templates/next-tenant-app/src/app/app/demo/page.tsx

@@ -5,11 +5,5 @@ export const metadata = {
 };
 
 export default function DemoPage() {
-  return (
-    <main className="min-h-screen bg-background text-foreground">
-      <div className="mx-auto flex min-h-screen max-w-5xl flex-col gap-6 px-6 py-8">
-        <ManifestDemo />
-      </div>
-    </main>
-  );
+  return <ManifestDemo />;
 }

package/assets/templates/next-tenant-app/src/app/app/layout.tsx

@@ -1,6 +1,8 @@
 import type { Metadata } from "next";
 import type { ReactNode } from "react";
 
+import { AuthenticatedAppLayoutShell } from "@/features/shell/components/authenticated-app-layout-shell";
+
 export const metadata: Metadata = {
   robots: {
     index: false,
@@ -13,5 +15,11 @@ export default function AuthenticatedAppLayout({
 }: {
   children: ReactNode;
 }) {
-  return children;
+  return (
+    <AuthenticatedAppLayoutShell
+      appName={process.env.MW_TEMPLATE_APP_NAME || "Tenant App"}
+    >
+      {children}
+    </AuthenticatedAppLayoutShell>
+  );
 }

package/assets/templates/next-tenant-app/src/features/shell/components/authenticated-app-layout-shell.tsx

@@ -0,0 +1,181 @@
+"use client";
+
+import type { ReactNode } from "react";
+import { startTransition } from "react";
+import Link from "next/link";
+import { useRouter } from "next/navigation";
+import { LayoutDashboard, LogOut, PlaySquare } from "lucide-react";
+import type {
+  TenantCustomerMembership,
+  TenantCustomerSession,
+} from "@minutework/web-auth";
+import {
+  useMinuteWorkAuth,
+  useMinuteWorkSession,
+} from "@minutework/web-auth/react";
+
+import { PanelFrame } from "@/design-system/patterns/panel-frame";
+import { ThemeModeToggle } from "@/design-system/patterns/theme-mode-toggle";
+import { Button } from "@/design-system/primitives/button";
+import { appRoutes } from "@/lib/app-routes";
+
+type AuthenticatedTenantCustomerSession = TenantCustomerSession & {
+  customer_membership: TenantCustomerMembership;
+};
+
+export function useAuthenticatedTenantCustomerSession(): AuthenticatedTenantCustomerSession {
+  const { session } = useMinuteWorkSession();
+
+  if (!session?.customer_membership) {
+    throw new Error(
+      "useAuthenticatedTenantCustomerSession must be rendered below AuthenticatedAppLayoutShell.",
+    );
+  }
+
+  return session as AuthenticatedTenantCustomerSession;
+}
+
+export function AuthenticatedAppLayoutShell({
+  appName,
+  children,
+}: {
+  appName: string;
+  children: ReactNode;
+}) {
+  const router = useRouter();
+  const { logout } = useMinuteWorkAuth();
+  const { session, loading, authenticated, emailVerificationRequired } =
+    useMinuteWorkSession();
+
+  function redirectToLogin() {
+    startTransition(() => {
+      router.replace(appRoutes.login);
+      router.refresh();
+    });
+  }
+
+  async function handleLogout() {
+    await logout().catch(() => undefined);
+    redirectToLogin();
+  }
+
+  if (loading) {
+    return (
+      <main className="min-h-screen bg-background text-foreground">
+        <div className="mx-auto flex min-h-screen max-w-5xl items-center px-6 py-10">
+          <PanelFrame tone="floating" radius="xl" padding="lg" className="w-full">
+            <p className="text-sm text-muted-foreground">Loading session</p>
+          </PanelFrame>
+        </div>
+      </main>
+    );
+  }
+
+  if (
+    emailVerificationRequired ||
+    session?.email_verification_required ||
+    session?.customer_membership?.status === "pending_verification"
+  ) {
+    return (
+      <main className="min-h-screen bg-background text-foreground">
+        <div className="mx-auto flex min-h-screen max-w-5xl items-center px-6 py-10">
+          <PanelFrame
+            tone="floating"
+            radius="xl"
+            padding="lg"
+            className="w-full space-y-4"
+          >
+            <div className="space-y-2">
+              <h1 className="text-3xl font-semibold tracking-tight">
+                Email verification required
+              </h1>
+              <p className="text-sm leading-7 text-muted-foreground">
+                Finish verification from your email before opening the workspace.
+              </p>
+            </div>
+            <Button onClick={redirectToLogin} className="w-fit">
+              Open login
+            </Button>
+          </PanelFrame>
+        </div>
+      </main>
+    );
+  }
+
+  if (!authenticated || !session?.customer_membership) {
+    return (
+      <main className="min-h-screen bg-background text-foreground">
+        <div className="mx-auto flex min-h-screen max-w-5xl items-center px-6 py-10">
+          <PanelFrame
+            tone="floating"
+            radius="xl"
+            padding="lg"
+            className="w-full space-y-4"
+          >
+            <div className="space-y-2">
+              <h1 className="text-3xl font-semibold tracking-tight">
+                Log in to continue
+              </h1>
+              <p className="text-sm leading-7 text-muted-foreground">
+                This area is available to verified customers.
+              </p>
+            </div>
+            <Button onClick={redirectToLogin} className="w-fit">
+              Open login
+            </Button>
+          </PanelFrame>
+        </div>
+      </main>
+    );
+  }
+
+  return (
+    <main className="min-h-screen bg-background text-foreground">
+      <div className="mx-auto flex min-h-screen max-w-7xl flex-col gap-6 px-6 py-8">
+        <header className="flex flex-col gap-6 xl:flex-row xl:items-start xl:justify-between">
+          <div className="space-y-2">
+            <p className="text-sm font-semibold uppercase tracking-widest text-muted-foreground">
+              {session.tenant.name}
+            </p>
+            <h1 className="max-w-3xl text-4xl font-semibold tracking-tight text-balance sm:text-5xl">
+              {appName}
+            </h1>
+            <p className="max-w-3xl text-base leading-7 text-muted-foreground sm:text-lg">
+              Signed in as {session.user?.email || session.user?.username}.
+            </p>
+          </div>
+
+          <div className="flex flex-col gap-3 sm:flex-row sm:items-start">
+            <ThemeModeToggle className="w-full sm:w-72" />
+            <Button
+              type="button"
+              variant="outline"
+              className="gap-2"
+              onClick={handleLogout}
+            >
+              <LogOut className="size-4" />
+              Log out
+            </Button>
+          </div>
+        </header>
+
+        <nav className="flex flex-wrap gap-2">
+          <Button asChild variant="default">
+            <Link href={appRoutes.appHome}>
+              <LayoutDashboard className="size-4" />
+              Dashboard
+            </Link>
+          </Button>
+          <Button asChild variant="outline">
+            <Link href={appRoutes.demo}>
+              <PlaySquare className="size-4" />
+              Demo
+            </Link>
+          </Button>
+        </nav>
+
+        {children}
+      </div>
+    </main>
+  );
+}

package/assets/templates/next-tenant-app/src/features/shell/components/private-app-shell.tsx

@@ -1,120 +1,10 @@
 "use client";
 
-import { startTransition } from "react";
-import Link from "next/link";
-import { useRouter } from "next/navigation";
-import { LayoutDashboard, LogOut, PlaySquare } from "lucide-react";
-
-import { PanelFrame } from "@/design-system/patterns/panel-frame";
-import { ThemeModeToggle } from "@/design-system/patterns/theme-mode-toggle";
-import { Button } from "@/design-system/primitives/button";
 import { TenantDashboard } from "@/features/dashboard/components/tenant-dashboard";
-import { appRoutes } from "@/lib/app-routes";
-import { useMinuteWorkAuth, useMinuteWorkSession } from "@minutework/web-auth/react";
+import { useAuthenticatedTenantCustomerSession } from "@/features/shell/components/authenticated-app-layout-shell";
 
 export function PrivateAppShell({ appName }: { appName: string }) {
-  const router = useRouter();
-  const { logout } = useMinuteWorkAuth();
-  const { session, loading, authenticated, emailVerificationRequired } =
-    useMinuteWorkSession();
-
-  function redirectToLogin() {
-    startTransition(() => {
-      router.replace(appRoutes.login);
-      router.refresh();
-    });
-  }
-
-  async function handleLogout() {
-    await logout().catch(() => undefined);
-    redirectToLogin();
-  }
-
-  if (loading) {
-    return (
-      <main className="min-h-screen bg-background text-foreground">
-        <div className="mx-auto flex min-h-screen max-w-5xl items-center px-6 py-10">
-          <PanelFrame tone="floating" radius="xl" padding="lg" className="w-full">
-            <p className="text-sm text-muted-foreground">Loading session</p>
-          </PanelFrame>
-        </div>
-      </main>
-    );
-  }
-
-  if (!authenticated || !session?.customer_membership) {
-    return (
-      <main className="min-h-screen bg-background text-foreground">
-        <div className="mx-auto flex min-h-screen max-w-5xl items-center px-6 py-10">
-          <PanelFrame tone="floating" radius="xl" padding="lg" className="w-full space-y-4">
-            <div className="space-y-2">
-              <h1 className="text-3xl font-semibold tracking-tight">
-                {emailVerificationRequired
-                  ? "Email verification required"
-                  : "Log in to continue"}
-              </h1>
-              <p className="text-sm leading-7 text-muted-foreground">
-                {emailVerificationRequired
-                  ? "Finish verification from your email before opening the workspace."
-                  : "This area is available to verified customers."}
-              </p>
-            </div>
-            <Button onClick={redirectToLogin} className="w-fit">
-              Open login
-            </Button>
-          </PanelFrame>
-        </div>
-      </main>
-    );
-  }
-
-  return (
-    <main className="min-h-screen bg-background text-foreground">
-      <div className="mx-auto flex min-h-screen max-w-7xl flex-col gap-6 px-6 py-8">
-        <header className="flex flex-col gap-6 xl:flex-row xl:items-start xl:justify-between">
-          <div className="space-y-2">
-            <p className="text-sm font-semibold uppercase tracking-widest text-muted-foreground">
-              {session.tenant.name}
-            </p>
-            <h1 className="max-w-3xl text-4xl font-semibold tracking-tight text-balance sm:text-5xl">
-              {appName}
-            </h1>
-            <p className="max-w-3xl text-base leading-7 text-muted-foreground sm:text-lg">
-              Signed in as {session.user?.email || session.user?.username}.
-            </p>
-          </div>
-
-          <div className="flex flex-col gap-3 sm:flex-row sm:items-start">
-            <ThemeModeToggle className="w-full sm:w-72" />
-            <Button
-              type="button"
-              variant="outline"
-              className="gap-2"
-              onClick={handleLogout}
-            >
-              <LogOut className="size-4" />
-              Log out
-            </Button>
-          </div>
-        </header>
-
-        <nav className="flex flex-wrap gap-2">
-          <Button asChild variant="default">
-            <Link href={appRoutes.appHome}>
-              <LayoutDashboard className="size-4" />
-              Dashboard
-            </Link>
-          </Button>
-          <Button asChild variant="outline">
-            <Link href={appRoutes.demo}>
-              <PlaySquare className="size-4" />
-              Demo
-            </Link>
-          </Button>
-        </nav>
+  const session = useAuthenticatedTenantCustomerSession();
 
-        <TenantDashboard appName={appName} session={session} />
-      </div>
-    </main>
-  );
+  return <TenantDashboard appName={appName} session={session} />;
 }

package/assets/templates/next-tenant-app/src/mw/mock.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from "vitest";
 
-import { createIdempotencyKey } from "@/mw/client";
+import { createIdempotencyKey, mwAppId } from "@/mw/client";
 import { createTemplateMockMinuteWorkClient } from "@/mw/mock";
 
 describe("MinuteWork SDK mock substrate", () => {
@@ -17,5 +17,6 @@ describe("MinuteWork SDK mock substrate", () => {
 
     expect(queryResult.count).toBe(1);
     expect(actionResult.created).toBe(true);
+    expect(client.appId).toBe(mwAppId);
   });
 });

package/assets/templates/next-tenant-app/src/mw/mock.ts

@@ -4,9 +4,11 @@
 
 import { createMockMinuteWorkClient } from "@minutework/web-auth/mock";
 
+import { mwAppId } from "@/mw/client";
+
 export function createTemplateMockMinuteWorkClient() {
   return createMockMinuteWorkClient({
-    appId: "tenant.app",
+    appId: mwAppId,
     verified: true,
     queryHandlers: {
       "demo.list": () => ({

package/assets/templates/next-tenant-app/tools/template/validate-route-contract.mjs

@@ -1,4 +1,4 @@
-import { existsSync } from "node:fs";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -22,6 +22,38 @@ const requiredPaths = [
   "src/mw/provider.tsx",
   "src/mw/mock.ts",
 ];
+const appRoutesRoot = path.join(templateRoot, "src", "app", "app");
+const appLayoutPath = path.join(appRoutesRoot, "layout.tsx");
+const appLayoutSource = readFileSync(appLayoutPath, "utf8");
+const appRoutePagePaths = collectNamedFiles(appRoutesRoot, new Set(["page.tsx"]));
+const appRouteHandlerPaths = collectNamedFiles(appRoutesRoot, new Set(["route.ts", "route.tsx"]));
+const guardedSurfaceSourcePaths = [
+  ...collectSourceFiles(appRoutesRoot),
+  ...collectSourceFiles(path.join(templateRoot, "src", "features")),
+];
+const allowedGuardPatternFiles = new Map([
+  [
+    "src/app/app/layout.tsx",
+    new Set(["AuthenticatedAppLayoutShell"]),
+  ],
+  [
+    "src/features/auth/components/login-screen.tsx",
+    new Set(["useMinuteWorkAuth"]),
+  ],
+  [
+    "src/features/shell/components/authenticated-app-layout-shell.tsx",
+    new Set([
+      "AuthenticatedAppLayoutShell",
+      "useMinuteWorkAuth",
+      "useMinuteWorkSession",
+    ]),
+  ],
+]);
+const forbiddenGuardPatterns = [
+  "useMinuteWorkSession",
+  "useMinuteWorkAuth",
+  "AuthenticatedAppLayoutShell",
+];
 
 const missingPaths = requiredPaths.filter(
   (relativePath) => !existsSync(path.join(templateRoot, relativePath)),
@@ -35,4 +67,91 @@ if (missingPaths.length > 0) {
   );
 }
 
+if (!appLayoutSource.includes("AuthenticatedAppLayoutShell")) {
+  throw new Error("src/app/app/layout.tsx must wrap all /app routes in AuthenticatedAppLayoutShell.");
+}
+
+if (!appLayoutSource.includes("{children}")) {
+  throw new Error("src/app/app/layout.tsx must pass children through the authenticated layout guard.");
+}
+
+const appRouteRelativePaths = appRoutePagePaths.map((absolutePath) =>
+  path.relative(templateRoot, absolutePath),
+);
+
+if (!appRouteRelativePaths.includes(path.join("src", "app", "app", "demo", "page.tsx"))) {
+  throw new Error("Route contract must include /app/demo so the guarded layout cannot be bypassed.");
+}
+
+if (appRouteHandlerPaths.length > 0) {
+  throw new Error(
+    `Route handlers under /app bypass the authenticated layout guard.\n${appRouteHandlerPaths
+      .map((absolutePath) => `- ${path.relative(templateRoot, absolutePath)}`)
+      .join("\n")}`,
+  );
+}
+
+for (const sourcePath of guardedSurfaceSourcePaths) {
+  const source = readFileSync(sourcePath, "utf8");
+  const relativePath = normalizePath(path.relative(templateRoot, sourcePath));
+  const allowedPatterns = allowedGuardPatternFiles.get(relativePath) ?? new Set();
+  const matchedPattern = forbiddenGuardPatterns.find(
+    (pattern) => source.includes(pattern) && !allowedPatterns.has(pattern),
+  );
+
+  if (matchedPattern) {
+    throw new Error(
+      `${relativePath} must not own guarded-surface auth wiring (${matchedPattern}); keep raw SDK auth/session hooks in src/features/shell/components/authenticated-app-layout-shell.tsx or the public login screen.`,
+    );
+  }
+}
+
 console.log("combined route contract is valid");
+
+function collectNamedFiles(directory, names) {
+  const entries = readdirSync(directory, { withFileTypes: true });
+  const files = [];
+
+  for (const entry of entries) {
+    const absolutePath = path.join(directory, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...collectNamedFiles(absolutePath, names));
+      continue;
+    }
+    if (!entry.isFile() || !names.has(entry.name)) {
+      continue;
+    }
+    if (!statSync(absolutePath).isFile()) {
+      continue;
+    }
+    files.push(absolutePath);
+  }
+
+  return files;
+}
+
+function collectSourceFiles(directory) {
+  const entries = readdirSync(directory, { withFileTypes: true });
+  const files = [];
+
+  for (const entry of entries) {
+    const absolutePath = path.join(directory, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...collectSourceFiles(absolutePath));
+      continue;
+    }
+    if (!entry.isFile() || !/\.(tsx|ts)$/.test(entry.name)) {
+      continue;
+    }
+    if (!statSync(absolutePath).isFile()) {
+      continue;
+    }
+    files.push(absolutePath);
+  }
+
+  return files;
+}
+
+function normalizePath(value) {
+  return value.split(path.sep).join("/");
+}

package/assets/templates/next-tenant-app/tools/template/with-public-site-fixture.mjs

@@ -1,5 +1,4 @@
 import { spawn } from "node:child_process";
-import { createServer } from "node:http";
 
 const [command, ...args] = process.argv.slice(2);
 const storybookHeapMb = process.env.MW_STORYBOOK_NODE_HEAP_MB ?? "768";
@@ -9,123 +8,38 @@ if (!command) {
   process.exit(1);
 }
 
-const emptySnapshot = {
-  site: {
-    siteName: "MinuteWork Combined Starter",
-    siteDescription: "Validation fixture snapshot for the combined starter.",
-    organizationName: "MinuteWork",
-    footerBlurb: "Validation fixture content.",
-    primaryCta: {
-      label: "Sign In",
-      href: "/login",
-    },
-    secondaryCta: {
-      label: "Docs",
-      href: "/docs",
-    },
-    primaryNavigation: [
-      { label: "Home", href: "/" },
-      { label: "Pricing", href: "/pricing" },
-      { label: "Docs", href: "/docs" },
-      { label: "Blog", href: "/blog" },
-    ],
-    collections: {
-      docs: {
-        eyebrow: "Docs",
-        title: "Documentation",
-        description: "Validation fixture docs collection.",
-      },
-      blog: {
-        eyebrow: "Blog",
-        title: "Updates",
-        description: "Validation fixture blog collection.",
-      },
-    },
-  },
-  marketingPages: [],
-  docs: [],
-  blog: [],
+const childEnv = {
+  ...process.env,
+  NEXT_PUBLIC_MW_APP_ID: process.env.NEXT_PUBLIC_MW_APP_ID ?? "tenant.app",
+  MW_TEMPLATE_APP_NAME: process.env.MW_TEMPLATE_APP_NAME ?? "Tenant App",
+  MW_PUBLIC_BASE_URL: process.env.MW_PUBLIC_BASE_URL ?? "https://public.example.com",
 };
 
-const server = createServer((request, response) => {
-  const requestUrl = new URL(request.url ?? "/", "http://127.0.0.1");
-  if (
-    request.method !== "GET" ||
-    requestUrl.pathname !== "/api/v1/developer/public-site/snapshots/main-site/"
-  ) {
-    response.writeHead(404, { "content-type": "application/json" });
-    response.end(JSON.stringify({ detail: "Not found" }));
-    return;
-  }
-
-  const environment = requestUrl.searchParams.get("environment") ?? "preview";
-  const sourceBoundary = environment === "live" ? "runtime_live" : "runtime_preview";
+if (
+  command === "storybook" &&
+  !/\bmax-old-space-size=/.test(childEnv.NODE_OPTIONS ?? "")
+) {
+  childEnv.NODE_OPTIONS = [childEnv.NODE_OPTIONS, `--max-old-space-size=${storybookHeapMb}`]
+    .filter(Boolean)
+    .join(" ");
+}
 
-  response.writeHead(200, { "content-type": "application/json" });
-  response.end(
-    JSON.stringify({
-      environment,
-      source_boundary: sourceBoundary,
-      snapshot: emptySnapshot,
-    }),
-  );
+const child = spawn(command, args, {
+  env: childEnv,
+  stdio: "inherit",
 });
 
-try {
-  const baseUrl = await new Promise((resolve, reject) => {
-    server.once("error", reject);
-    server.listen(0, "127.0.0.1", () => {
-      const address = server.address();
-      if (!address || typeof address === "string") {
-        reject(new Error("Unable to resolve validation fixture server address."));
-        return;
-      }
-      resolve(`http://127.0.0.1:${address.port}`);
-    });
-  });
-
-  const exitCode = await new Promise((resolve, reject) => {
-    const childEnv = {
-      ...process.env,
-      MW_CONTENT_API_TOKEN: "validate-content-token",
-      MW_PLATFORM_BASE_URL: baseUrl,
-      MW_PUBLIC_CONTENT_SOURCE: "minutework_cms",
-      MW_PUBLIC_BASE_URL: "https://public.example.com",
-      MW_PUBLIC_SITE_ENV: "preview",
-      MW_PUBLIC_SITE_PROPERTY_KEY: "main-site",
-    };
-    if (
-      command === "storybook" &&
-      !/\bmax-old-space-size=/.test(childEnv.NODE_OPTIONS ?? "")
-    ) {
-      childEnv.NODE_OPTIONS = [childEnv.NODE_OPTIONS, `--max-old-space-size=${storybookHeapMb}`]
-        .filter(Boolean)
-        .join(" ");
-    }
-    const child = spawn(command, args, {
-      env: childEnv,
-      stdio: "inherit",
-    });
+child.once("error", (error) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+});
 
-    child.once("error", reject);
-    child.once("exit", (code, signal) => {
-      if (signal) {
-        reject(new Error(`Validation fixture command exited via signal ${signal}.`));
-        return;
-      }
-      resolve(code ?? 1);
-    });
-  });
+child.once("exit", (code, signal) => {
+  if (signal) {
+    console.error(`Validation fixture command exited via signal ${signal}.`);
+    process.exitCode = 1;
+    return;
+  }
 
-  process.exitCode = exitCode;
-} finally {
-  await new Promise((resolve, reject) => {
-    server.close((error) => {
-      if (error) {
-        reject(error);
-        return;
-      }
-      resolve(undefined);
-    });
-  });
-}
+  process.exitCode = code ?? 1;
+});

package/assets/templates/next-tenant-app/vitest.config.ts

@@ -11,13 +11,9 @@ export default defineConfig({
   },
   test: {
     env: {
-      MW_PLATFORM_BASE_URL: "http://127.0.0.1:8000",
-      MW_PUBLIC_CONTENT_SOURCE: "minutework_cms",
-      MW_CONTENT_API_TOKEN: "test-content-token",
+      NEXT_PUBLIC_MW_APP_ID: "tenant.app",
+      MW_TEMPLATE_APP_NAME: "Tenant App",
       MW_PUBLIC_BASE_URL: "http://127.0.0.1:3000",
-      MW_PUBLIC_SITE_PROPERTY_KEY: "main-site",
-      MW_PUBLIC_SITE_ENV: "preview",
-      MW_STATIC_PUBLIC_CONTENT_PATH: "content/public-site.json",
     },
     environment: "node",
     globals: true,

package/dist/workspace-bootstrap.js

@@ -11,12 +11,9 @@ export async function bootstrapVmLocalWorkspaceEnv(options) {
     }
     if (options.starters.tenantApp) {
         await writeManagedEnvBlock(path.join(options.workspaceRoot, "tenant-app", ".env.local"), "tenant-app", {
-            MW_PLATFORM_BASE_URL: workspaceWiring.platform_base_url ?? "",
-            MW_CONTENT_API_TOKEN: workspaceWiring.content_token_plaintext ?? "",
+            NEXT_PUBLIC_MW_APP_ID: workspaceWiring.app_id ?? "tenant.app",
+            MW_TEMPLATE_APP_NAME: workspaceWiring.workspace_name ?? "Tenant App",
             MW_PUBLIC_BASE_URL: workspaceWiring.public_base_url ?? "",
-            MW_PUBLIC_SITE_PROPERTY_KEY: workspaceWiring.public_site_property_key ?? "",
-            MW_PUBLIC_SITE_ENV: workspaceWiring.public_site_env ?? "preview",
-            MW_ENABLE_RUNTIME_COMMAND_EXAMPLE: "false",
         });
     }
     if (options.starters.sidecar) {

package/dist/workspace-bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-bootstrap.js","sourceRoot":"","sources":["../src/workspace-bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAwB7B,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,OAMlD;IACC,MAAM,eAAe,GAAG,MAAM,0BAA0B,CAAC;QACvD,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,oBAAoB,CACxB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,YAAY,EAAE,YAAY,CAAC,EAC5D,YAAY,EACZ;YACE,oBAAoB,EAAE,eAAe,CAAC,iBAAiB,IAAI,EAAE;YAC7D,oBAAoB,EAAE,eAAe,CAAC,uBAAuB,IAAI,EAAE;YACnE,kBAAkB,EAAE,eAAe,CAAC,eAAe,IAAI,EAAE;YACzD,2BAA2B,EAAE,eAAe,CAAC,wBAAwB,IAAI,EAAE;YAC3E,kBAAkB,EAAE,eAAe,CAAC,eAAe,IAAI,SAAS;YAChE,iCAAiC,EAAE,OAAO;SAC3C,CACF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,oBAAoB,CACxB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,EACzD,SAAS,EACT;YACE,eAAe,EAAE,eAAe,CAAC,YAAY,IAAI,EAAE;YACnD,aAAa,EAAE,eAAe,CAAC,UAAU,IAAI,EAAE;YAC/C,YAAY,EAAE,eAAe,CAAC,SAAS,IAAI,EAAE;YAC7C,mBAAmB,EAAE,eAAe,CAAC,gBAAgB,IAAI,EAAE;YAC3D,0BAA0B,EAAE,eAAe,CAAC,uBAAuB,IAAI,EAAE;SAC1E,CACF,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,OAIzC;IACC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,aAAa,GACjB,GAAG,CAAC,oCAAoC,IAAI,gCAAgC,CAAC;IAC/E,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,aAAa,CAAC,CAAC;IAC/D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,iBAAiB,GAAG,GAAG,CAAC,+BAA+B,CAAC;IAC9D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IAChD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB;QAClC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,SAAS,EAAE,OAAO,EAAE,uBAAuB,CAAC;QAC3E,CAAC,CAAC,IAAI,CAAC,IAAI,CACP,IAAI,EACJ,QAAQ,EACR,OAAO,EACP,YAAY,EACZ,UAAU,EACV,SAAS,EACT,OAAO,EACP,uBAAuB,CACxB,CAAC;IACN,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAA4B,CAAC;QAC7F,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAC1E,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,UAAkB,EAClB,SAAiB,EACjB,MAA8B;IAE9B,MAAM,WAAW,GAAG,6BAA6B,SAAS,EAAE,CAAC;IAC7D,MAAM,SAAS,GAAG,6BAA6B,SAAS,EAAE,CAAC;IAC3D,MAAM,aAAa,GAAG,qBAAqB,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAExD,IAAI,WAAmB,CAAC;IACxB,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACnE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;QAClE,MAAM,CAAC,EAAE,MAAM,GAAG,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7D,WAAW,GAAG,GAAG,MAAM,GAAG,aAAa,GAAG,MAAM,EAAE,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/E,WAAW,GAAG,GAAG,QAAQ,GAAG,SAAS,GAAG,aAAa,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,qBAAqB,CAC5B,WAAmB,EACnB,SAAiB,EACjB,MAA8B;IAE9B,MAAM,KAAK,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtB,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,UAAkB;IACvD,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,UAAkB;IACpD,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"workspace-bootstrap.js","sourceRoot":"","sources":["../src/workspace-bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AA0B7B,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,OAMlD;IACC,MAAM,eAAe,GAAG,MAAM,0BAA0B,CAAC;QACvD,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,oBAAoB,CACxB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,YAAY,EAAE,YAAY,CAAC,EAC5D,YAAY,EACZ;YACE,qBAAqB,EAAE,eAAe,CAAC,MAAM,IAAI,YAAY;YAC7D,oBAAoB,EAAE,eAAe,CAAC,cAAc,IAAI,YAAY;YACpE,kBAAkB,EAAE,eAAe,CAAC,eAAe,IAAI,EAAE;SAC1D,CACF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,oBAAoB,CACxB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,EACzD,SAAS,EACT;YACE,eAAe,EAAE,eAAe,CAAC,YAAY,IAAI,EAAE;YACnD,aAAa,EAAE,eAAe,CAAC,UAAU,IAAI,EAAE;YAC/C,YAAY,EAAE,eAAe,CAAC,SAAS,IAAI,EAAE;YAC7C,mBAAmB,EAAE,eAAe,CAAC,gBAAgB,IAAI,EAAE;YAC3D,0BAA0B,EAAE,eAAe,CAAC,uBAAuB,IAAI,EAAE;SAC1E,CACF,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,OAIzC;IACC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,aAAa,GACjB,GAAG,CAAC,oCAAoC,IAAI,gCAAgC,CAAC;IAC/E,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,aAAa,CAAC,CAAC;IAC/D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,iBAAiB,GAAG,GAAG,CAAC,+BAA+B,CAAC;IAC9D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IAChD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB;QAClC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,SAAS,EAAE,OAAO,EAAE,uBAAuB,CAAC;QAC3E,CAAC,CAAC,IAAI,CAAC,IAAI,CACP,IAAI,EACJ,QAAQ,EACR,OAAO,EACP,YAAY,EACZ,UAAU,EACV,SAAS,EACT,OAAO,EACP,uBAAuB,CACxB,CAAC;IACN,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAA4B,CAAC;QAC7F,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAC1E,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,UAAkB,EAClB,SAAiB,EACjB,MAA8B;IAE9B,MAAM,WAAW,GAAG,6BAA6B,SAAS,EAAE,CAAC;IAC7D,MAAM,SAAS,GAAG,6BAA6B,SAAS,EAAE,CAAC;IAC3D,MAAM,aAAa,GAAG,qBAAqB,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAExD,IAAI,WAAmB,CAAC;IACxB,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACnE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;QAClE,MAAM,CAAC,EAAE,MAAM,GAAG,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7D,WAAW,GAAG,GAAG,MAAM,GAAG,aAAa,GAAG,MAAM,EAAE,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/E,WAAW,GAAG,GAAG,QAAQ,GAAG,SAAS,GAAG,aAAa,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,qBAAqB,CAC5B,WAAmB,EACnB,SAAiB,EACjB,MAA8B;IAE9B,MAAM,KAAK,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtB,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,UAAkB;IACvD,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,UAAkB;IACpD,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "minutework",
-  "version": "0.1.33",
+  "version": "0.1.35",
   "description": "MinuteWork CLI for workspace scaffolding, local preview workflows, and hosted preview deploys.",
   "type": "module",
   "bin": {