superslate 0.8.1 → 0.10.0

package/dist/cli.js

@@ -1243,7 +1243,7 @@ ${i}
 
 // src/cli.ts
 import { existsSync, readdirSync, statSync } from "fs";
-import { mkdir as mkdir5, mkdtemp as mkdtemp2, readFile as readFile6, readdir as readdir2, rename as rename2, rm as rm5, rmdir, stat as stat5 } from "fs/promises";
+import { mkdir as mkdir5, mkdtemp as mkdtemp2, readFile as readFile6, readdir as readdir2, rename as rename3, rm as rm5, rmdir, stat as stat5 } from "fs/promises";
 import { createConnection, createServer } from "net";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { dirname as dirname3, join as join8, relative as relative2, resolve as resolve4, sep } from "path";
@@ -1266,20 +1266,31 @@ var LICENSE_KEY_VARIABLE2 = "SUPERSLATE_LICENSE_KEY";
 var LICENSE_KEY_PREFIX = "SUPERSLATE-";
 
 // src/core.ts
+var KEBAB_CASE_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var WHITESPACE_CHAR_RE = /\s/;
+var NPM_SCOPE_RE = /^@[a-z0-9][a-z0-9._-]*$/;
+var NEWLINE_CHAR_RE = /\r|\n/;
+var BRAND_NAME_RE = /^[\p{L}\p{N}](?:[\p{L}\p{N} ._-]*[\p{L}\p{N}])?$/u;
+var REGEX_SPECIAL_CHARS_RE = /[.*+?^${}()|[\]\\]/g;
+var ESCAPED_SOURCE_BRAND = SOURCE_BRAND_NAME.replace(REGEX_SPECIAL_CHARS_RE, "\\$&");
+var SOURCE_BRAND_RE = new RegExp(`\\b${ESCAPED_SOURCE_BRAND}\\b`, "gi");
+var ESCAPED_CLI_NAME = CLI_NAME2.replace(REGEX_SPECIAL_CHARS_RE, "\\$&");
+var SOURCE_DELIVERY_GUIDANCE_RE = new RegExp(`pnpm dlx ${ESCAPED_CLI_NAME}|bunx ${ESCAPED_CLI_NAME}|${ESCAPED_CLI_NAME} repository`, "i");
+var VENDOR_BOOTSTRAPPER_GUIDANCE_RE = new RegExp(`${ESCAPED_CLI_NAME}@\\d|public \`${ESCAPED_CLI_NAME}\` npm package`, "i");
 function validateAppName(value) {
   if (!value)
     return "App name is required.";
-  if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(value)) {
+  if (!KEBAB_CASE_RE.test(value)) {
     return "App name must be kebab-case (lowercase letters, numbers, and single hyphens).";
   }
   return;
 }
 function normalizeScope(value) {
   const scope = value.startsWith("@") ? value : `@${value}`;
-  if (/\s/.test(scope)) {
+  if (WHITESPACE_CHAR_RE.test(scope)) {
     throw new Error("Use hyphens instead of spaces, for example test-package.");
   }
-  if (!/^@[a-z0-9][a-z0-9._-]*$/.test(scope)) {
+  if (!NPM_SCOPE_RE.test(scope)) {
     throw new Error("Use lowercase letters and numbers, with optional periods, underscores, or hyphens.");
   }
   return scope;
@@ -1287,1497 +1298,1734 @@ function normalizeScope(value) {
 function validateBrandName(value) {
   if (!value.trim())
     return "Brand name cannot be empty.";
-  if (/\r|\n/.test(value))
+  if (NEWLINE_CHAR_RE.test(value))
     return "Brand name must fit on one line.";
   if (value !== value.trim())
     return "Brand name cannot start or end with whitespace.";
   if (value.length > 48)
     return "Brand name must be 48 characters or less.";
-  if (!/^[\p{L}\p{N}](?:[\p{L}\p{N} ._-]*[\p{L}\p{N}])?$/u.test(value)) {
+  if (!BRAND_NAME_RE.test(value)) {
     return "Brand name may contain letters, numbers, spaces, periods, underscores, and hyphens.";
   }
   return;
 }
 var SCOPE_EXTENSIONS = new Set([".json", ".jsonc", ".md", ".ts", ".tsx", ".yaml", ".yml"]);
 
-// src/delivery.ts
-var RELEASE_TAG_PATTERN = /^v\d+\.\d+\.\d+(?:-rc\.\d+)?$/;
-function validateLicenseKey(value) {
-  const key = value.trim();
-  if (!key)
-    return "Enter the licence key from your purchase receipt.";
-  if (/\s/.test(key))
-    return "A licence key does not contain spaces.";
-  if (!key.startsWith(LICENSE_KEY_PREFIX) || key.length === LICENSE_KEY_PREFIX.length) {
-    return `A ${CLI_NAME2} licence key starts with ${LICENSE_KEY_PREFIX}. Copy it from your purchase receipt or the customer portal.`;
+// src/core.ts
+import { randomBytes } from "node:crypto";
+import { extname } from "node:path";
+var KEBAB_CASE_RE2 = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var WHITESPACE_CHAR_RE2 = /\s/;
+var NPM_SCOPE_RE2 = /^@[a-z0-9][a-z0-9._-]*$/;
+var NEWLINE_CHAR_RE2 = /\r|\n/;
+var BRAND_NAME_RE2 = /^[\p{L}\p{N}](?:[\p{L}\p{N} ._-]*[\p{L}\p{N}])?$/u;
+var REGEX_SPECIAL_CHARS_RE2 = /[.*+?^${}()|[\]\\]/g;
+var NON_ALPHANUMERIC_CHAR_RE = /[^a-z0-9]/g;
+var LEADING_DIGIT_RE = /^[0-9]/;
+var HTTP_PROTOCOL_RE = /^https?:\/\//;
+var APP_DOMAIN_RE = /^(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$/;
+var BUNDLE_IDENTIFIER_RE = /^[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*){2,}$/;
+var MOBILE_APP_SCHEME_LINE_RE = /^MOBILE_APP_SCHEME=.*$/m;
+var MOBILE_DOCS_SOURCE_LINE_RE = /^\s*'mobile\.md',\n/m;
+var MOBILE_EDITION_SECTION_RE = /^## Mobile edition\n[\s\S]*?(?=^## |(?![\s\S]))/m;
+var MOBILE_TABLE_ROW_RE = /^\| `apps\/mobile` .*\n/gm;
+var MOBILE_PARAGRAPH_RE = /^`apps\/mobile`[\s\S]*?(?:\n\n|\n?(?![\s\S]))/gm;
+var MOBILE_DOCS_LINK_RE = /\[([^\]]+)\]\(\.\/mobile\.md(?:#[^)]*)?\)/g;
+var NAMED_IMPORT_LINE_RE = /^(\s*)(import(?:\s+type)?\s+)\{([^}]+)\}(\s+from\s+.+)$/;
+var WHITESPACE_RE = /\s+/;
+var INTERNAL_AGENT_REFERENCE_RE = /internal\/|landing\/|seller-surface|studio-owned/i;
+var INTERNAL_CLAUDE_REFERENCE_RE = /internal\/|landing\/|studio-owned/i;
+var BETTER_AUTH_SECRET_LINE_RE = /^BETTER_AUTH_SECRET=.*$/m;
+var HEX_64_RE = /^[a-f0-9]{64}$/;
+var DATABASE_URL_LINE_RE = /^DATABASE_URL=.*$/m;
+var GHA_CREDS_FILE_RE = /^gha-creds-.*\.json$/;
+var ESCAPED_SOURCE_BRAND2 = SOURCE_BRAND_NAME.replace(REGEX_SPECIAL_CHARS_RE2, "\\$&");
+var SOURCE_BRAND_RE2 = new RegExp(`\\b${ESCAPED_SOURCE_BRAND2}\\b`, "gi");
+var ESCAPED_CLI_NAME2 = CLI_NAME2.replace(REGEX_SPECIAL_CHARS_RE2, "\\$&");
+var SOURCE_DELIVERY_GUIDANCE_RE2 = new RegExp(`pnpm dlx ${ESCAPED_CLI_NAME2}|bunx ${ESCAPED_CLI_NAME2}|${ESCAPED_CLI_NAME2} repository`, "i");
+var VENDOR_BOOTSTRAPPER_GUIDANCE_RE2 = new RegExp(`${ESCAPED_CLI_NAME2}@\\d|public \`${ESCAPED_CLI_NAME2}\` npm package`, "i");
+var BRAND_MANIFEST = [
+  { path: "apps/web/src/configs/config.ts", occurrences: 2 },
+  { path: "apps/web/index.html", occurrences: 4 },
+  { path: "apps/web/public/favicon/site.webmanifest", occurrences: 2 },
+  { path: "apps/web/public/offline.html", occurrences: 6 },
+  { path: "apps/docs/lib/shared.ts", occurrences: 1 },
+  { path: "apps/site/src/site.ts", occurrences: 1 },
+  { path: "apps/docs/README.md", occurrences: 1 },
+  { path: "README.md", occurrences: 1 },
+  { path: "docs/meta.json", occurrences: 1 },
+  { path: "apps/server/.env.example", occurrences: 1 },
+  { path: "apps/server/src/config/env.ts", occurrences: 2 },
+  { path: "apps/server/src/config/env.test.ts", occurrences: 1 },
+  { path: "packages/email/src/billing-payment-failed.tsx", occurrences: 2 },
+  { path: "packages/email/src/login-email.tsx", occurrences: 3 },
+  { path: "packages/email/src/verify-email.tsx", occurrences: 1 },
+  { path: "packages/email/src/reset-password.tsx", occurrences: 1 },
+  { path: "packages/email/src/security-alert.tsx", occurrences: 1 },
+  { path: "packages/email/src/components/EmailSignature.tsx", occurrences: 1 },
+  { path: "packages/email/src/components/EmailLayout.tsx", occurrences: 1 },
+  { path: "packages/email/src/components/EmailCopyright.tsx", occurrences: 1 },
+  { path: "packages/email/src/welcome-email.tsx", occurrences: 4 },
+  { path: "packages/email/src/billing-payment-successful.tsx", occurrences: 1 },
+  { path: "packages/email/src/billing-subscription-created.tsx", occurrences: 2 },
+  { path: "packages/email/src/billing-subscription-canceled.tsx", occurrences: 2 },
+  { path: "apps/server/email-templates/billing-payment-failed.html", occurrences: 6 },
+  { path: "apps/server/email-templates/billing-payment-successful.html", occurrences: 5 },
+  { path: "apps/server/email-templates/billing-subscription-canceled.html", occurrences: 6 },
+  { path: "apps/server/email-templates/billing-subscription-created.html", occurrences: 6 },
+  { path: "apps/server/email-templates/login-email.html", occurrences: 7 },
+  { path: "apps/server/email-templates/security-alert.html", occurrences: 4 },
+  { path: "apps/server/email-templates/verify-email.html", occurrences: 5 },
+  { path: "apps/server/email-templates/reset-password.html", occurrences: 5 },
+  { path: "apps/server/email-templates/organization-invitation.html", occurrences: 3 },
+  { path: "apps/server/email-templates/welcome-email.html", occurrences: 8 }
+];
+var START_BRAND_MANIFEST = [
+  { path: "apps/start/AGENTS.md", occurrences: 1 },
+  { path: "apps/start/README.md", occurrences: 1 },
+  { path: "apps/start/src/server/config.ts", occurrences: 2 },
+  { path: "apps/start/src/shared/site.ts", occurrences: 1 },
+  { path: "apps/start/wrangler.jsonc", occurrences: 2 },
+  { path: "apps/start/worker-configuration.d.ts", occurrences: 2 }
+];
+var MOBILE_EDITION_PATHS = ["apps/mobile", "docs/mobile.md"];
+var UNIVERSAL_LINK_PATH_PREFIXES = ["/auth", "/invitations"];
+function validateAppName2(value) {
+  if (!value)
+    return "App name is required.";
+  if (!KEBAB_CASE_RE2.test(value)) {
+    return "App name must be kebab-case (lowercase letters, numbers, and single hyphens).";
   }
   return;
 }
-function readLicenseKeyFromEnvironment(environment = process.env) {
-  return environment[LICENSE_KEY_VARIABLE2]?.trim() || undefined;
+function normalizeScope2(value) {
+  const scope = value.startsWith("@") ? value : `@${value}`;
+  if (WHITESPACE_CHAR_RE2.test(scope)) {
+    throw new Error("Use hyphens instead of spaces, for example test-package.");
+  }
+  if (!NPM_SCOPE_RE2.test(scope)) {
+    throw new Error("Use lowercase letters and numbers, with optional periods, underscores, or hyphens.");
+  }
+  return scope;
 }
-function normalizeSourceVersion(value) {
-  const trimmed = value.trim();
-  const releaseTag = trimmed.startsWith("v") ? trimmed : `v${trimmed}`;
-  if (!RELEASE_TAG_PATTERN.test(releaseTag)) {
-    throw new Error(`Source version must be an immutable release such as 1.2.3: ${value}`);
+function validateBrandName2(value) {
+  if (!value.trim())
+    return "Brand name cannot be empty.";
+  if (NEWLINE_CHAR_RE2.test(value))
+    return "Brand name must fit on one line.";
+  if (value !== value.trim())
+    return "Brand name cannot start or end with whitespace.";
+  if (value.length > 48)
+    return "Brand name must be 48 characters or less.";
+  if (!BRAND_NAME_RE2.test(value)) {
+    return "Brand name may contain letters, numbers, spaces, periods, underscores, and hyphens.";
   }
-  return releaseTag;
+  return;
 }
-
-// node_modules/@clack/prompts/dist/index.mjs
-import { styleText as styleText3, stripVTControlCharacters as stripVTControlCharacters2 } from "node:util";
-import process$12 from "node:process";
-var import_sisteransi3 = __toESM(require_src(), 1);
-function isUnicodeSupported2() {
-  if (process$12.platform !== "win32") {
-    return process$12.env.TERM !== "linux";
+function replaceLiteral(content, search, replacement) {
+  if (search === replacement || !content.includes(search))
+    return { content, replacements: 0 };
+  const parts = content.split(search);
+  return { content: parts.join(replacement), replacements: parts.length - 1 };
+}
+function rewriteScopeContent(content, scope, originalScope = DEFAULT_SCOPE) {
+  return replaceLiteral(content, `${originalScope}/`, `${normalizeScope2(scope)}/`);
+}
+function rewriteBrandContent(content, brandName) {
+  const error = validateBrandName2(brandName);
+  if (error)
+    throw new Error(error);
+  const matches = content.match(SOURCE_BRAND_RE2);
+  if (brandName === SOURCE_BRAND_NAME || !matches)
+    return { content, replacements: 0 };
+  return {
+    content: content.replace(SOURCE_BRAND_RE2, () => brandName),
+    replacements: matches.length
+  };
+}
+function mobileSchemeFor(appName) {
+  const error = validateAppName2(appName);
+  if (error)
+    throw new Error(error);
+  return appName;
+}
+function androidPackageSegment(appName) {
+  const segment = appName.replace(NON_ALPHANUMERIC_CHAR_RE, "");
+  return LEADING_DIGIT_RE.test(segment) || !segment ? `app${segment}` : segment;
+}
+function validateAppDomain(value) {
+  if (!value.trim())
+    return "Application domain cannot be empty.";
+  if (HTTP_PROTOCOL_RE.test(value))
+    return "Use a bare host such as app.example.com, not a URL.";
+  if (value.includes("/"))
+    return "Use a bare host such as app.example.com, with no path.";
+  if (!APP_DOMAIN_RE.test(value)) {
+    return "Use a lowercase hostname with at least two labels, for example app.example.com.";
   }
-  return Boolean(process$12.env.CI) || Boolean(process$12.env.WT_SESSION) || Boolean(process$12.env.TERMINUS_SUBLIME) || process$12.env.ConEmuTask === "{cmd::Cmder}" || process$12.env.TERM_PROGRAM === "Terminus-Sublime" || process$12.env.TERM_PROGRAM === "vscode" || process$12.env.TERM === "xterm-256color" || process$12.env.TERM === "alacritty" || process$12.env.TERMINAL_EMULATOR === "JetBrains-JediTerm";
+  return;
 }
-var unicode2 = isUnicodeSupported2();
-var isCI2 = () => process.env.CI === "true";
-var unicodeOr2 = (o, e) => unicode2 ? o : e;
-var S_STEP_ACTIVE2 = unicodeOr2("◆", "*");
-var S_STEP_CANCEL2 = unicodeOr2("■", "x");
-var S_STEP_ERROR2 = unicodeOr2("▲", "x");
-var S_STEP_SUBMIT2 = unicodeOr2("◇", "o");
-var S_BAR_START2 = unicodeOr2("┌", "T");
-var S_BAR2 = unicodeOr2("│", "|");
-var S_BAR_END2 = unicodeOr2("└", "—");
-var S_BAR_START_RIGHT2 = unicodeOr2("┐", "T");
-var S_BAR_END_RIGHT2 = unicodeOr2("┘", "—");
-var S_RADIO_ACTIVE2 = unicodeOr2("●", ">");
-var S_RADIO_INACTIVE2 = unicodeOr2("○", " ");
-var S_CHECKBOX_ACTIVE2 = unicodeOr2("◻", "[•]");
-var S_CHECKBOX_SELECTED2 = unicodeOr2("◼", "[+]");
-var S_CHECKBOX_INACTIVE2 = unicodeOr2("◻", "[ ]");
-var S_PASSWORD_MASK2 = unicodeOr2("▪", "•");
-var S_BAR_H2 = unicodeOr2("─", "-");
-var S_CORNER_TOP_RIGHT2 = unicodeOr2("╮", "+");
-var S_CONNECT_LEFT2 = unicodeOr2("├", "+");
-var S_CORNER_BOTTOM_RIGHT2 = unicodeOr2("╯", "+");
-var S_CORNER_BOTTOM_LEFT2 = unicodeOr2("╰", "+");
-var S_CORNER_TOP_LEFT2 = unicodeOr2("╭", "+");
-var S_INFO2 = unicodeOr2("●", "•");
-var S_SUCCESS2 = unicodeOr2("◆", "*");
-var S_WARN2 = unicodeOr2("▲", "!");
-var S_ERROR2 = unicodeOr2("■", "x");
-var symbol2 = (o) => {
-  switch (o) {
-    case "initial":
-    case "active":
-      return styleText3("cyan", S_STEP_ACTIVE2);
-    case "cancel":
-      return styleText3("red", S_STEP_CANCEL2);
-    case "error":
-      return styleText3("yellow", S_STEP_ERROR2);
-    case "submit":
-      return styleText3("green", S_STEP_SUBMIT2);
-    case "validating":
-      return styleText3("dim", S_STEP_ACTIVE2);
+function validateBundleIdentifier(value) {
+  if (!value.trim())
+    return "Bundle identifier cannot be empty.";
+  if (!BUNDLE_IDENTIFIER_RE.test(value)) {
+    return "Use at least three lowercase reverse-DNS segments, for example com.example.app.";
   }
-};
-var symbolBar = (o) => {
-  switch (o) {
-    case "initial":
-    case "active":
-      return styleText3("cyan", S_BAR2);
-    case "cancel":
-      return styleText3("red", S_BAR2);
-    case "error":
-      return styleText3("yellow", S_BAR2);
-    case "submit":
-      return styleText3("green", S_BAR2);
+  return;
+}
+function deriveMobileIdentity(appName, brandName, bundleIdentifier, appDomain) {
+  const brandError = validateBrandName2(brandName);
+  if (brandError)
+    throw new Error(brandError);
+  const resolvedBundleId = bundleIdentifier ?? `com.${androidPackageSegment(appName)}.app`;
+  const bundleError = validateBundleIdentifier(resolvedBundleId);
+  if (bundleError)
+    throw new Error(bundleError);
+  const domain = appDomain?.trim().toLowerCase();
+  if (domain) {
+    const domainError = validateAppDomain(domain);
+    if (domainError)
+      throw new Error(domainError);
   }
-};
-function formatInstructionFooter(o, e) {
-  const r = [`${e ? `${styleText3("cyan", S_BAR2)}  ` : ""}${o.join(" • ")}`];
-  return e && r.push(styleText3("cyan", S_BAR_END2)), r;
+  return {
+    displayName: brandName,
+    slug: appName,
+    scheme: mobileSchemeFor(appName),
+    bundleIdentifier: resolvedBundleId,
+    ...domain ? { appDomain: domain } : {}
+  };
 }
-var I = (l, e, w, p, b, C = false) => {
-  let r = e, O = 0;
-  if (C)
-    for (let i = p - 1;i >= w; i--) {
-      const m = l[i];
-      if (m && (r -= m.length), O++, r <= b)
-        break;
-    }
-  else
-    for (let i = w;i < p; i++) {
-      const m = l[i];
-      if (m && (r -= m.length), O++, r <= b)
-        break;
+function universalLinkConfig(domain) {
+  return {
+    associatedDomains: [`applinks:${domain}`],
+    intentFilters: [
+      {
+        action: "VIEW",
+        autoVerify: true,
+        category: ["BROWSABLE", "DEFAULT"],
+        data: UNIVERSAL_LINK_PATH_PREFIXES.map((pathPrefix) => ({
+          scheme: "https",
+          host: domain,
+          pathPrefix
+        }))
+      }
+    ]
+  };
+}
+function rewriteMobileAppConfig(content, identity) {
+  const parsed = JSON.parse(content);
+  const { expo } = parsed;
+  if (!expo)
+    throw new Error('Expo configuration is missing its "expo" block.');
+  expo.name = identity.displayName;
+  expo.slug = identity.slug;
+  expo.scheme = identity.scheme;
+  if (expo.ios)
+    expo.ios.bundleIdentifier = identity.bundleIdentifier;
+  if (expo.android)
+    expo.android.package = identity.bundleIdentifier;
+  const links = identity.appDomain ? universalLinkConfig(identity.appDomain) : undefined;
+  if (expo.ios) {
+    if (links)
+      expo.ios.associatedDomains = links.associatedDomains;
+    else
+      delete expo.ios.associatedDomains;
+  }
+  if (expo.android) {
+    if (links)
+      expo.android.intentFilters = links.intentFilters;
+    else
+      delete expo.android.intentFilters;
+  }
+  delete expo.updates;
+  delete expo.owner;
+  if (expo.extra && typeof expo.extra === "object")
+    delete expo.extra.eas;
+  return `${stringifyRepositoryJson(parsed)}
+`;
+}
+function rewriteMobileAppScheme(content, scheme) {
+  if (!MOBILE_APP_SCHEME_LINE_RE.test(content)) {
+    throw new Error("Server .env.example must contain a MOBILE_APP_SCHEME entry.");
+  }
+  return {
+    content: content.replace(MOBILE_APP_SCHEME_LINE_RE, `MOBILE_APP_SCHEME=${scheme}`),
+    replacements: 1
+  };
+}
+var JSON_PRINT_WIDTH = 100;
+function isJsonPrimitive(value) {
+  return value === null || ["string", "number", "boolean"].includes(typeof value);
+}
+function stringifyRepositoryJson(value, indent = 0, column = 0) {
+  const pad = " ".repeat(indent);
+  const innerPad = " ".repeat(indent + 2);
+  if (Array.isArray(value)) {
+    if (value.length === 0)
+      return "[]";
+    if (value.every(isJsonPrimitive)) {
+      const inline = `[${value.map((item) => JSON.stringify(item)).join(", ")}]`;
+      if (column + inline.length <= JSON_PRINT_WIDTH)
+        return inline;
     }
-  return { lineCount: r, removals: O };
-};
-var limitOptions = ({
-  cursor: l,
-  options: e,
-  style: w,
-  output: p = process.stdout,
-  maxItems: b = Number.POSITIVE_INFINITY,
-  columnPadding: C = 0,
-  rowPadding: r = 4
-}) => {
-  const i = getColumns(p) - C, m = getRows(p), M = styleText3("dim", "..."), v = Math.max(m - r, 0), a = Math.max(Math.min(b, v), 5);
-  let f = 0;
-  l >= a - 3 && (f = Math.max(Math.min(l - a + 3, e.length - a), 0));
-  let d = a < e.length && f > 0, c = a < e.length && f + a < e.length;
-  const W = Math.min(f + a, e.length), s = [];
-  let g = 0;
-  d && g++, c && g++;
-  const T = f + (d ? 1 : 0), y = W - (c ? 1 : 0);
-  for (let t = T;t < y; t++) {
-    const n = e[t], o = n ? w(n, t === l) : "", h = wrapAnsi(o, i, {
-      hard: true,
-      trim: false
-    }).split(`
-`);
-    s.push(h), g += h.length;
+    const items = value.map((item) => `${innerPad}${stringifyRepositoryJson(item, indent + 2, indent + 2)}`);
+    return `[
+${items.join(`,
+`)}
+${pad}]`;
+  }
+  if (value !== null && typeof value === "object") {
+    const entries = Object.entries(value);
+    if (entries.length === 0)
+      return "{}";
+    const items = entries.map(([key, item]) => {
+      const label = `${JSON.stringify(key)}: `;
+      return `${innerPad}${label}${stringifyRepositoryJson(item, indent + 2, indent + 2 + label.length)}`;
+    });
+    return `{
+${items.join(`,
+`)}
+${pad}}`;
   }
-  if (g > v) {
-    let t = 0, n = 0, o = g;
-    const h = l - T;
-    let u = v;
-    const L = () => I(s, o, 0, h, u), E = () => I(s, o, h + 1, s.length, u, true);
-    d ? ({ lineCount: o, removals: t } = L(), o > u && (c || (u -= 1), { lineCount: o, removals: n } = E())) : (c || (u -= 1), { lineCount: o, removals: n } = E(), o > u && (u -= 1, { lineCount: o, removals: t } = L())), t > 0 && (d = true, s.splice(0, t)), n > 0 && (c = true, s.splice(s.length - n, n));
+  return JSON.stringify(value);
+}
+function stripMobileRootScripts(content) {
+  const parsed = JSON.parse(content);
+  if (parsed.scripts) {
+    delete parsed.scripts["dev:mobile"];
+    delete parsed.scripts["build:mobile"];
   }
-  const x = [];
-  d && x.push(M);
-  for (const t of s)
-    for (const n of t)
-      x.push(n);
-  return c && x.push(M), x;
-};
-var confirm2 = (e) => {
-  const a = e.active ?? "Yes", o = e.inactive ?? "No";
-  return new r({
-    active: a,
-    inactive: o,
-    signal: e.signal,
-    input: e.input,
-    output: e.output,
-    initialValue: e.initialValue ?? true,
-    render() {
-      const i = e.withGuide ?? settings.withGuide, u = `${symbol2(this.state)}  `, l = i ? `${styleText3("gray", S_BAR2)}  ` : "", f = wrapTextWithPrefix(e.output, e.message, l, u), s = `${i ? `${styleText3("gray", S_BAR2)}
-` : ""}${f}
-`, c = this.value ? a : o;
-      switch (this.state) {
-        case "submit": {
-          const r = i ? `${styleText3("gray", S_BAR2)}  ` : "";
-          return `${s}${r}${styleText3("dim", c)}`;
-        }
-        case "cancel": {
-          const r = i ? `${styleText3("gray", S_BAR2)}  ` : "";
-          return `${s}${r}${styleText3(["strikethrough", "dim"], c)}${i ? `
-${styleText3("gray", S_BAR2)}` : ""}`;
-        }
-        default: {
-          const r = i ? `${styleText3("cyan", S_BAR2)}  ` : "", g = i ? styleText3("cyan", S_BAR_END2) : "";
-          return `${s}${r}${this.value ? `${styleText3("green", S_RADIO_ACTIVE2)} ${a}` : `${styleText3("dim", S_RADIO_INACTIVE2)} ${styleText3("dim", a)}`}${e.vertical ? i ? `
-${styleText3("cyan", S_BAR2)}  ` : `
-` : ` ${styleText3("dim", "/")} `}${this.value ? `${styleText3("dim", S_RADIO_INACTIVE2)} ${styleText3("dim", o)}` : `${styleText3("green", S_RADIO_ACTIVE2)} ${o}`}
-${g}
+  return `${JSON.stringify(parsed, null, 2)}
 `;
-        }
-      }
-    }
-  }).prompt();
-};
-var MULTISELECT_INSTRUCTIONS2 = [
-  `${styleText3("dim", "↑/↓")} to navigate`,
-  `${styleText3("dim", "Space:")} select`,
-  `${styleText3("dim", "Enter:")} confirm`
-];
-var m = (i, u) => i.split(`
-`).map((d) => u(d)).join(`
-`);
-var multiselect = (i) => {
-  const u = (t, a) => {
-    const r = t.label ?? String(t.value);
-    return a === "disabled" ? `${styleText3("gray", S_CHECKBOX_INACTIVE2)} ${m(r, (o) => styleText3(["strikethrough", "gray"], o))}${t.hint ? ` ${styleText3("dim", `(${t.hint ?? "disabled"})`)}` : ""}` : a === "active" ? `${styleText3("cyan", S_CHECKBOX_ACTIVE2)} ${r}${t.hint ? ` ${styleText3("dim", `(${t.hint})`)}` : ""}` : a === "selected" ? `${styleText3("green", S_CHECKBOX_SELECTED2)} ${m(r, (o) => styleText3("dim", o))}${t.hint ? ` ${styleText3("dim", `(${t.hint})`)}` : ""}` : a === "cancelled" ? `${m(r, (o) => styleText3(["strikethrough", "dim"], o))}` : a === "active-selected" ? `${styleText3("green", S_CHECKBOX_SELECTED2)} ${r}${t.hint ? ` ${styleText3("dim", `(${t.hint})`)}` : ""}` : a === "submitted" ? `${m(r, (o) => styleText3("dim", o))}` : `${styleText3("dim", S_CHECKBOX_INACTIVE2)} ${m(r, (o) => styleText3("dim", o))}`;
-  }, d = i.required ?? true, x = i.showInstructions ?? true;
-  return new a({
-    options: i.options,
-    signal: i.signal,
-    input: i.input,
-    output: i.output,
-    initialValues: i.initialValues,
-    required: d,
-    cursorAt: i.cursorAt,
-    validate(t) {
-      if (d && (t === undefined || t.length === 0))
-        return `Please select at least one option.
-${styleText3("reset", styleText3("dim", `Press ${styleText3(["gray", "bgWhite", "inverse"], " space ")} to select, ${styleText3("gray", styleText3("bgWhite", styleText3("inverse", " enter ")))} to submit`))}`;
-    },
-    render() {
-      const t = i.withGuide ?? settings.withGuide, a = wrapTextWithPrefix(i.output, i.message, t ? `${symbolBar(this.state)}  ` : "", `${symbol2(this.state)}  `), r = `${t ? `${styleText3("gray", S_BAR2)}
-` : ""}${a}
-`, o = this.value ?? [], g = (n, l) => {
-        if (n.disabled)
-          return u(n, "disabled");
-        const s = o.includes(n.value);
-        return l && s ? u(n, "active-selected") : s ? u(n, "selected") : u(n, l ? "active" : "inactive");
-      };
-      switch (this.state) {
-        case "submit": {
-          const n = this.options.filter(({ value: s }) => o.includes(s)).map((s) => u(s, "submitted")).join(styleText3("dim", ", ")) || styleText3("dim", "none"), l = wrapTextWithPrefix(i.output, n, t ? `${styleText3("gray", S_BAR2)}  ` : "");
-          return `${r}${l}`;
-        }
-        case "cancel": {
-          const n = this.options.filter(({ value: s }) => o.includes(s)).map((s) => u(s, "cancelled")).join(styleText3("dim", ", "));
-          if (n.trim() === "")
-            return `${r}${styleText3("gray", S_BAR2)}`;
-          const l = wrapTextWithPrefix(i.output, n, t ? `${styleText3("gray", S_BAR2)}  ` : "");
-          return `${r}${l}${t ? `
-${styleText3("gray", S_BAR2)}` : ""}`;
-        }
-        case "error": {
-          const n = t ? `${styleText3("yellow", S_BAR2)}  ` : "", l = this.error.split(`
-`).map(($, v) => v === 0 ? `${t ? `${styleText3("yellow", S_BAR_END2)}  ` : ""}${styleText3("yellow", $)}` : `   ${$}`).join(`
-`), s = r.split(`
-`).length, h = l.split(`
-`).length + 1;
-          return `${r}${n}${limitOptions({
-            output: i.output,
-            options: this.options,
-            cursor: this.cursor,
-            maxItems: i.maxItems,
-            columnPadding: n.length,
-            rowPadding: s + h,
-            style: g
-          }).join(`
-${n}`)}
-${l}
+}
+function stripMobileKnipWorkspace(content) {
+  const parsed = JSON.parse(content);
+  if (parsed.workspaces)
+    delete parsed.workspaces["apps/mobile"];
+  return `${stringifyRepositoryJson(parsed)}
 `;
-        }
-        default: {
-          const n = t ? `${styleText3("cyan", S_BAR2)}  ` : "", l = r.split(`
-`).length, s = x ? formatInstructionFooter(MULTISELECT_INSTRUCTIONS2, t) : t ? [styleText3("cyan", S_BAR_END2)] : [], h = s.join(`
-`), $ = s.length + 1;
-          return `${r}${n}${limitOptions({
-            output: i.output,
-            options: this.options,
-            cursor: this.cursor,
-            maxItems: i.maxItems,
-            columnPadding: n.length,
-            rowPadding: l + $,
-            style: g
-          }).join(`
-${n}`)}
-${h}
+}
+function stripMobileDocsPage(content) {
+  const parsed = JSON.parse(content);
+  if (Array.isArray(parsed.pages)) {
+    parsed.pages = parsed.pages.filter((page) => page !== "mobile");
+  }
+  return `${stringifyRepositoryJson(parsed)}
 `;
-        }
-      }
-    }
-  }).prompt();
-};
-var log2 = {
-  message: (s = [], {
-    symbol: e = styleText3("gray", S_BAR2),
-    secondarySymbol: r = styleText3("gray", S_BAR2),
-    output: m = process.stdout,
-    spacing: l = 1,
-    withGuide: c
-  } = {}) => {
-    const t = [], o = c ?? settings.withGuide, f = o ? r : "", O = o ? `${e}  ` : "", u = o ? `${r}  ` : "";
-    for (let i = 0;i < l; i++)
-      t.push(f);
-    const g = Array.isArray(s) ? s : s.split(`
-`);
-    if (g.length > 0) {
-      const [i, ...y] = g;
-      i.length > 0 ? t.push(`${O}${i}`) : t.push(o ? e : "");
-      for (const p of y)
-        p.length > 0 ? t.push(`${u}${p}`) : t.push(o ? r : "");
+}
+function stripMobileDocsSource(content) {
+  return content.replace(MOBILE_DOCS_SOURCE_LINE_RE, "");
+}
+function stripMobileDocsReferences(content) {
+  return content.replace(MOBILE_EDITION_SECTION_RE, "").replace(MOBILE_TABLE_ROW_RE, "").replace(MOBILE_PARAGRAPH_RE, "").replace(MOBILE_DOCS_LINK_RE, "$1");
+}
+function formatRewrittenPackageJson(content) {
+  const parsed = JSON.parse(content);
+  for (const key of [
+    "dependencies",
+    "devDependencies",
+    "optionalDependencies",
+    "peerDependencies"
+  ]) {
+    const values = parsed[key];
+    if (values && typeof values === "object" && !Array.isArray(values)) {
+      parsed[key] = Object.fromEntries(Object.entries(values).sort(([left], [right]) => left.localeCompare(right)));
     }
-    m.write(`${t.join(`
-`)}
-`);
-  },
-  info: (s, e) => {
-    log2.message(s, { ...e, symbol: styleText3("blue", S_INFO2) });
-  },
-  success: (s, e) => {
-    log2.message(s, { ...e, symbol: styleText3("green", S_SUCCESS2) });
-  },
-  step: (s, e) => {
-    log2.message(s, { ...e, symbol: styleText3("green", S_STEP_SUBMIT2) });
-  },
-  warn: (s, e) => {
-    log2.message(s, { ...e, symbol: styleText3("yellow", S_WARN2) });
-  },
-  warning: (s, e) => {
-    log2.warn(s, e);
-  },
-  error: (s, e) => {
-    log2.message(s, { ...e, symbol: styleText3("red", S_ERROR2) });
   }
-};
-var cancel2 = (o = "", t) => {
-  const i = t?.output ?? process.stdout, e = t?.withGuide ?? settings.withGuide ? `${styleText3("gray", S_BAR_END2)}  ` : "";
-  i.write(`${e}${styleText3("red", o)}
-
-`);
-};
-var intro2 = (o = "", t) => {
-  const i = t?.output ?? process.stdout, e = t?.withGuide ?? settings.withGuide ? `${styleText3("gray", S_BAR_START2)}  ` : "";
-  i.write(`${e}${o}
-`);
-};
-var outro2 = (o = "", t) => {
-  const i = t?.output ?? process.stdout, e = t?.withGuide ?? settings.withGuide ? `${styleText3("gray", S_BAR2)}
-${styleText3("gray", S_BAR_END2)}  ` : "";
-  i.write(`${e}${o}
-
-`);
-};
-var W2 = (l) => styleText3("magenta", l);
-var spinner2 = ({
-  indicator: l = "dots",
-  onCancel: h,
-  output: n = process.stdout,
-  cancelMessage: G,
-  errorMessage: O,
-  frames: E = unicode2 ? ["◒", "◐", "◓", "◑"] : ["•", "o", "O", "0"],
-  delay: F = unicode2 ? 80 : 120,
-  signal: m,
-  ...I
-} = {}) => {
-  const u = isCI2();
-  let M, T, d = false, S = false, s = "", p, w = performance.now();
-  const x = getColumns(n), k = I?.styleFrame ?? W2, g = (e) => {
-    const r = e > 1 ? O ?? settings.messages.error : G ?? settings.messages.cancel;
-    S = e === 1, d && (a(r, e), S && typeof h == "function" && h());
-  }, f = () => g(2), i = () => g(1), A = () => {
-    process.on("uncaughtExceptionMonitor", f), process.on("unhandledRejection", f), process.on("SIGINT", i), process.on("SIGTERM", i), process.on("exit", g), m && m.addEventListener("abort", i);
-  }, H = () => {
-    process.removeListener("uncaughtExceptionMonitor", f), process.removeListener("unhandledRejection", f), process.removeListener("SIGINT", i), process.removeListener("SIGTERM", i), process.removeListener("exit", g), m && m.removeEventListener("abort", i);
-  }, y = () => {
-    if (p === undefined)
-      return;
-    u && n.write(`
+  return `${JSON.stringify(parsed, null, 2)}
+`;
+}
+function wrapLongNamedImports(content, width = 100) {
+  return content.split(`
+`).map((line) => {
+    if (line.length <= width)
+      return line;
+    const match = line.match(NAMED_IMPORT_LINE_RE);
+    if (!match)
+      return line;
+    const [, indentation = "", prefix = "", names = "", suffix = ""] = match;
+    const members = names.split(",").map((name) => name.trim());
+    return [
+      `${indentation}${prefix}{`,
+      ...members.map((name) => `${indentation}  ${name},`),
+      `${indentation}}${suffix}`
+    ].join(`
 `);
-    const r = wrapAnsi(p, x, {
-      hard: true,
-      trim: false
-    }).split(`
+  }).join(`
 `);
-    r.length > 1 && n.write(import_sisteransi3.cursor.up(r.length - 1)), n.write(import_sisteransi3.cursor.to(0)), n.write(import_sisteransi3.erase.down());
-  }, C = (e) => e.replace(/\.+$/, ""), _ = (e) => {
-    const r = (performance.now() - e) / 1000, t = Math.floor(r / 60), o = Math.floor(r % 60);
-    return t > 0 ? `[${t}m ${o}s]` : `[${o}s]`;
-  }, N = I.withGuide ?? settings.withGuide, P = (e = "") => {
-    d = true, M = block({ output: n }), s = C(e), w = performance.now(), N && n.write(`${styleText3("gray", S_BAR2)}
+}
+function wrapBrandedJsxText(content, brandName, width = 100) {
+  const lines = content.split(`
 `);
-    let r = 0, t = 0;
-    A(), T = setInterval(() => {
-      if (u && s === p)
-        return;
-      y(), p = s;
-      const o = k(E[r]);
-      let v;
-      if (u)
-        v = `${o}  ${s}...`;
-      else if (l === "timer")
-        v = `${o}  ${s} ${_(w)}`;
-      else {
-        const B = ".".repeat(Math.floor(t)).slice(0, 3);
-        v = `${o}  ${s}${B}`;
-      }
-      const j = wrapAnsi(v, x, {
-        hard: true,
-        trim: false
-      });
-      n.write(j), r = r + 1 < E.length ? r + 1 : 0, t = t < 4 ? t + 0.125 : 0;
-    }, F);
-  }, a = (e = "", r = 0, t = false) => {
-    if (!d)
-      return;
-    d = false, clearInterval(T), y();
-    const o = r === 0 ? styleText3("green", S_STEP_SUBMIT2) : r === 1 ? styleText3("red", S_STEP_CANCEL2) : styleText3("red", S_STEP_ERROR2);
-    s = e ?? s, t || (l === "timer" ? n.write(`${o}  ${s} ${_(w)}
-`) : n.write(`${o}  ${s}
-`)), H(), M();
-  };
-  return {
-    start: P,
-    stop: (e = "") => a(e, 0),
-    message: (e = "") => {
-      s = C(e ?? s);
-    },
-    cancel: (e = "") => a(e, 1),
-    error: (e = "") => a(e, 2),
-    clear: () => a("", 0, true),
-    get isCancelled() {
-      return S;
+  const output = [];
+  for (let index = 0;index < lines.length; ) {
+    const line = lines[index] ?? "";
+    const text = line.trim();
+    if (!text || text.startsWith("<") || text.startsWith("{") || text.startsWith("//") || text.includes("<") || text.includes(">")) {
+      output.push(line);
+      index += 1;
+      continue;
     }
-  };
-};
-var u3 = {
-  light: unicodeOr2("─", "-"),
-  heavy: unicodeOr2("━", "="),
-  block: unicodeOr2("█", "#")
-};
-var SELECT_INSTRUCTIONS2 = [
-  `${styleText3("dim", "↑/↓")} to navigate`,
-  `${styleText3("dim", "Enter:")} confirm`
-];
-var c = (t, o) => t.includes(`
-`) ? t.split(`
-`).map((d) => o(d)).join(`
-`) : o(t);
-var select = (t) => {
-  const o = (n, m) => {
-    if (n === undefined)
-      return "";
-    const s = n.label ?? String(n.value);
-    switch (m) {
-      case "disabled":
-        return `${styleText3("gray", S_RADIO_INACTIVE2)} ${c(s, (i) => styleText3("gray", i))}${n.hint ? ` ${styleText3("dim", `(${n.hint ?? "disabled"})`)}` : ""}`;
-      case "selected":
-        return `${c(s, (i) => styleText3("dim", i))}`;
-      case "active":
-        return `${styleText3("green", S_RADIO_ACTIVE2)} ${s}${n.hint ? ` ${styleText3("dim", `(${n.hint})`)}` : ""}`;
-      case "cancelled":
-        return `${c(s, (i) => styleText3(["strikethrough", "dim"], i))}`;
-      default:
-        return `${styleText3("dim", S_RADIO_INACTIVE2)} ${c(s, (i) => styleText3("dim", i))}`;
+    const paragraph = [];
+    const originalParagraph = [];
+    const indentation = line.slice(0, line.length - line.trimStart().length);
+    while (index < lines.length) {
+      const candidate = lines[index] ?? "";
+      const candidateText = candidate.trim();
+      if (!candidateText || candidateText.startsWith("<") || candidateText.startsWith("{"))
+        break;
+      paragraph.push(candidateText);
+      originalParagraph.push(candidate);
+      index += 1;
     }
-  }, d = t.showInstructions ?? true;
-  return new n$1({
-    options: t.options,
-    signal: t.signal,
-    input: t.input,
-    output: t.output,
-    initialValue: t.initialValue,
-    render() {
-      const n = t.withGuide ?? settings.withGuide, m = `${symbol2(this.state)}  `, s = `${symbolBar(this.state)}  `, i = wrapTextWithPrefix(t.output, t.message, s, m), u = `${n ? `${styleText3("gray", S_BAR2)}
-` : ""}${i}
-`;
-      switch (this.state) {
-        case "submit": {
-          const r = n ? `${styleText3("gray", S_BAR2)}  ` : "", a = wrapTextWithPrefix(t.output, o(this.options[this.cursor], "selected"), r);
-          return `${u}${a}`;
-        }
-        case "cancel": {
-          const r = n ? `${styleText3("gray", S_BAR2)}  ` : "", a = wrapTextWithPrefix(t.output, o(this.options[this.cursor], "cancelled"), r);
-          return `${u}${a}${n ? `
-${styleText3("gray", S_BAR2)}` : ""}`;
-        }
-        default: {
-          const r = n ? `${styleText3("cyan", S_BAR2)}  ` : "", a = u.split(`
-`).length, p = d ? formatInstructionFooter(SELECT_INSTRUCTIONS2, n) : n ? [styleText3("cyan", S_BAR_END2)] : [], f = p.join(`
-`), b = p.length + 1;
-          return `${u}${r}${limitOptions({
-            output: t.output,
-            cursor: this.cursor,
-            options: this.options,
-            maxItems: t.maxItems,
-            columnPadding: r.length,
-            rowPadding: a + b,
-            style: (g, x) => o(g, g.disabled ? "disabled" : x ? "active" : "inactive")
-          }).join(`
-${r}`)}
-${f}
-`;
-        }
-      }
+    const joined = paragraph.join(" ");
+    if (!joined.includes(brandName)) {
+      output.push(...originalParagraph);
+      continue;
     }
-  }).prompt();
-};
-var i2 = `${styleText3("gray", S_BAR2)}  `;
-var text2 = (t) => new n({
-  validate: t.validate,
-  placeholder: t.placeholder,
-  defaultValue: t.defaultValue,
-  initialValue: t.initialValue,
-  output: t.output,
-  signal: t.signal,
-  input: t.input,
-  render() {
-    const r = t?.withGuide ?? settings.withGuide, l = `${`${r ? `${styleText3("gray", S_BAR2)}
-` : ""}${symbol2(this.state)}  `}${t.message}
-`, d = t.placeholder && t.placeholder.length > 0 ? styleText3("inverse", t.placeholder[0]) + styleText3("dim", t.placeholder.slice(1)) : styleText3(["inverse", "hidden"], "_"), o = this.userInput ? this.userInputWithCursor : d, s = this.value ?? "";
-    switch (this.state) {
-      case "validating": {
-        const n = r ? `${styleText3("cyan", S_BAR2)}  ` : "", i = r ? styleText3("cyan", S_BAR_END2) : "", c = styleText3("dim", o), $ = styleText3("dim", "Validating...");
-        return `${l}${n}${c}
-${i}  ${$}
-`;
-      }
-      case "error": {
-        const n = this.error ? `  ${styleText3("yellow", this.error)}` : "", i = r ? `${styleText3("yellow", S_BAR2)}  ` : "", c = r ? styleText3("yellow", S_BAR_END2) : "";
-        return `${l.trim()}
-${i}${o}
-${c}${n}
-`;
-      }
-      case "submit": {
-        const n = s ? `${r ? "  " : ""}${styleText3("dim", s)}` : "", i = r ? styleText3("gray", S_BAR2) : "";
-        return `${l}${i}${n}`;
-      }
-      case "cancel": {
-        const n = s ? `  ${styleText3(["strikethrough", "dim"], s)}` : "", i = r ? styleText3("gray", S_BAR2) : "";
-        return `${l}${i}${n}${s.trim() ? `
-${i}` : ""}`;
-      }
-      default: {
-        const n = r ? `${styleText3("cyan", S_BAR2)}  ` : "", i = r ? styleText3("cyan", S_BAR_END2) : "";
-        return `${l}${n}${o}
-${i}
-`;
-      }
+    let current = indentation;
+    for (const word of joined.split(WHITESPACE_RE)) {
+      const candidate = current === indentation ? `${indentation}${word}` : `${current} ${word}`;
+      if (candidate.length > width && current !== indentation) {
+        output.push(current);
+        current = `${indentation}${word}`;
+      } else
+        current = candidate;
     }
+    output.push(current);
   }
-}).prompt();
-
-// src/agent-setup.ts
-import { mkdir, readFile, rename, stat, writeFile } from "node:fs/promises";
-import { dirname, join as join2, resolve } from "node:path";
-
-// src/runtime.ts
-import { spawn } from "node:child_process";
-import { accessSync, constants, realpathSync } from "node:fs";
-import { delimiter, join, resolve as resolvePath } from "node:path";
-function runCaptured(command, options) {
-  const [file, ...args] = command;
-  if (!file)
-    throw new Error("runCaptured requires a command");
-  return new Promise((resolve, reject) => {
-    const child = spawn(file, args, {
-      cwd: options.cwd,
-      env: options.env ?? process.env,
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    let stdout = "";
-    let stderr = "";
-    child.stdout.setEncoding("utf8");
-    child.stderr.setEncoding("utf8");
-    child.stdout.on("data", (chunk) => {
-      stdout += chunk;
-    });
-    child.stderr.on("data", (chunk) => {
-      stderr += chunk;
-    });
-    child.on("error", reject);
-    child.on("close", (code, signal) => {
-      resolve({ exitCode: code ?? (signal ? 1 : 0), stdout, stderr });
-    });
-  });
+  return output.join(`
+`);
 }
-function which(command) {
-  if (command.includes("/"))
-    return isExecutable(command) ? command : null;
-  const extensions = process.platform === "win32" ? (process.env.PATHEXT ?? "").split(";") : [""];
-  for (const directory of (process.env.PATH ?? "").split(delimiter)) {
-    if (!directory)
-      continue;
-    for (const extension of extensions) {
-      const candidate = join(directory, `${command}${extension}`);
-      if (isExecutable(candidate))
-        return candidate;
-    }
-  }
-  return null;
+function rewriteRootPackageName(content, appName) {
+  const error = validateAppName2(appName);
+  if (error)
+    throw new Error(error);
+  const parsed = JSON.parse(content);
+  if (parsed.name === appName)
+    return { content, replacements: 0 };
+  parsed.name = appName;
+  return { content: `${JSON.stringify(parsed, null, 2)}
+`, replacements: 1 };
 }
-function isExecutable(path) {
-  try {
-    accessSync(path, constants.X_OK);
-    return true;
-  } catch {
-    return false;
+var WORKER_NAME_DECLARATION = /^name = "[^"]*"$/m;
+function rewriteWorkerName(content, appName) {
+  const error = validateAppName2(appName);
+  if (error)
+    throw new Error(error);
+  const declaration = content.match(WORKER_NAME_DECLARATION)?.[0];
+  if (!declaration) {
+    throw new Error("Cloudflare Worker configuration is missing a name declaration.");
   }
+  const replacement = `name = "${appName}"`;
+  if (declaration === replacement)
+    return { content, replacements: 0 };
+  return { content: content.replace(WORKER_NAME_DECLARATION, replacement), replacements: 1 };
 }
-
-// src/agent-setup.ts
-var CLIENTS = ["codex", "claude", "cursor"];
-var SERVER_NAME = "agent-docs";
-var CODEX_START = "# agent-context:start";
-var CODEX_END = "# agent-context:end";
-var AGENT_CONTEXT_TOOLS = [
-  "search_docs",
-  "search_implementation",
-  "get_repository_map",
-  "plan_change",
-  "get_invariants",
-  "get_verification"
-];
-function takeValue(args, index, flag) {
-  const value = args[index + 1];
-  if (!value || value.startsWith("-"))
-    throw new Error(`${flag} requires a value.`);
-  return value;
-}
-function parseAgentSetupArguments(argv) {
-  const parsed = { yes: false, dryRun: false, help: false };
-  for (let index = 0;index < argv.length; index += 1) {
-    const argument = argv[index];
-    if (argument === "--clients") {
-      const values = takeValue(argv, index++, argument).split(",").map((value) => value.trim()).filter(Boolean);
-      const invalid = values.filter((value) => !CLIENTS.includes(value));
-      if (invalid.length > 0)
-        throw new Error(`Unknown agent client: ${invalid.join(", ")}`);
-      parsed.clients = [...new Set(values)];
-    } else if (argument === "--yes" || argument === "-y")
-      parsed.yes = true;
-    else if (argument === "--dry-run")
-      parsed.dryRun = true;
-    else if (argument === "--help" || argument === "-h")
-      parsed.help = true;
-    else
-      throw new Error(`Unknown agent setup option: ${argument}`);
+var JSONC_WORKER_NAME_FIELD = /("name":\s*")[^"]*(")/;
+function rewriteSiteWorkerName(content, appName) {
+  const error = validateAppName2(appName);
+  if (error)
+    throw new Error(error);
+  if (!JSONC_WORKER_NAME_FIELD.test(content)) {
+    throw new Error("The site Worker configuration is missing a name field.");
   }
-  return parsed;
+  return content.replace(JSONC_WORKER_NAME_FIELD, `$1${appName}-site$2`);
 }
-function agentSetupUsage(cliName) {
-  return `Usage: ${cliName} agent setup [options]
+function replaceMarkdownSection(content, heading, replacement) {
+  const marker = `## ${heading}
+`;
+  const start = content.indexOf(marker);
+  if (start === -1)
+    throw new Error(`Agent instructions are missing the "${heading}" section.`);
+  const end = content.indexOf(`
+## `, start + marker.length);
+  if (end === -1)
+    throw new Error(`Agent instructions cannot delimit the "${heading}" section.`);
+  const sections = [content.slice(0, start).trim(), replacement.trim(), content.slice(end).trim()];
+  return `${sections.filter(Boolean).join(`
 
-Connect local coding clients to this checkout's read-only project context server.
+`)}
+`;
+}
+function removeParagraphContaining(content, fragment) {
+  const paragraphs = content.split(`
 
-Options:
-  --clients <list>  Comma-separated clients: codex,claude,cursor
-  --yes              Configure every detected client without prompting
-  --dry-run          Show the selected configuration without changing client settings
-  -h, --help         Show this help`;
+`);
+  const index = paragraphs.findIndex((paragraph) => paragraph.includes(fragment));
+  if (index === -1)
+    throw new Error(`Agent instructions are missing expected text: ${fragment}`);
+  paragraphs.splice(index, 1);
+  return paragraphs.join(`
+
+`);
 }
-async function pathExists(path) {
-  return Boolean(await stat(path).catch(() => {
-    return;
-  }));
+function rewriteBuyerAgentInstructions(content) {
+  if (content.includes("Audit and remediate the complete buyer-owned SaaS application") && !INTERNAL_AGENT_REFERENCE_RE.test(content)) {
+    return content;
+  }
+  let rewritten = removeParagraphContaining(content, "`internal/` holds every seller-only surface");
+  rewritten = removeParagraphContaining(rewritten, "The root pnpm workspace includes only `apps/*` and `packages/*`.");
+  rewritten = replaceMarkdownSection(rewritten, "Product security audit scope", `## Product security audit scope
+
+Audit and remediate the complete buyer-owned SaaS application: \`apps/\`, \`packages/\`, buyer
+documentation, and the configuration and deployment files that ship with it. \`agent-tooling/\` and
+\`packages/agent-context\` are optional, buyer-distributed development tooling; review them when agent
+behavior or distribution changes, but do not treat them as application runtime code. Do not vendor
+machine-local installed copies, compatibility symlinks, client configuration, or skill lock records
+into this repository.
+`);
+  rewritten = replaceMarkdownSection(rewritten, "Landing boundary", "");
+  rewritten = rewritten.split(`
+`).filter((line) => !line.includes("| `internal`")).join(`
+`).replace("real env files, `internal/`, or\n  `bun.lock`", "real env files, or `bun.lock`");
+  if (INTERNAL_AGENT_REFERENCE_RE.test(rewritten)) {
+    throw new Error("Buyer agent instructions still contain seller-only guidance.");
+  }
+  return rewritten;
 }
-async function findAgentRepositoryRoot(start = process.cwd()) {
-  let current = resolve(start);
-  while (true) {
-    if (await pathExists(join2(current, "AGENTS.md")) && await pathExists(join2(current, "packages/agent-context/package.json")) && await pathExists(join2(current, "agent-tooling/manifest.json"))) {
-      return current;
+var BUYER_README_HEADING = "## Create your product";
+function stripDistributionReadmeBootstrap(content) {
+  if (!content.includes(BUYER_README_HEADING))
+    return content;
+  return replaceMarkdownSection(content, "Create your product", "");
+}
+var REQUIRED_BUYER_CLI_CONSTANTS = ["CLI_NAME", "CLI_PACKAGE_NAME", "DEFAULT_SCOPE"];
+function rewriteBuyerCliConstants(content, scope, brandName) {
+  const buyerVariablePrefix = BUYER_CLI_NAME.toUpperCase().replaceAll("-", "_");
+  const buyerConstants = [
+    ["CLI_NAME", BUYER_CLI_NAME],
+    ["CLI_PACKAGE_NAME", BUYER_CLI_PACKAGE_NAME],
+    ["DEFAULT_SCOPE", normalizeScope2(scope)],
+    ["SOURCE_BRAND_NAME", brandName],
+    ["TEMPLATE_REPOSITORY", "OWNER/REPOSITORY"],
+    ["DELIVERY_BASE_URL", "https://releases.example.com"],
+    ["DOCS_BASE_URL", "https://docs.example.com"],
+    ["DELIVERY_URL_VARIABLE", `${buyerVariablePrefix}_DELIVERY_URL`],
+    ["LICENSE_KEY_VARIABLE", `${buyerVariablePrefix}_LICENSE_KEY`],
+    ["LICENSE_KEY_PREFIX", "LICENSE-"]
+  ];
+  let rewritten = content;
+  for (const [name, value] of buyerConstants) {
+    const declaration = new RegExp(`^export const ${name} = '[^']*'$`, "m");
+    if (!declaration.test(rewritten)) {
+      if (REQUIRED_BUYER_CLI_CONSTANTS.includes(name)) {
+        throw new Error(`Source CLI constants are missing ${name}.`);
+      }
+      continue;
     }
-    const parent = dirname(current);
-    if (parent === current)
-      throw new Error("Run agent setup inside a project repository.");
-    current = parent;
+    rewritten = rewritten.replace(declaration, `export const ${name} = '${value}'`);
   }
+  const leaked = [
+    CLI_PACKAGE_NAME,
+    SOURCE_BRAND_NAME,
+    DELIVERY_BASE_URL,
+    DOCS_BASE_URL,
+    DELIVERY_URL_VARIABLE,
+    LICENSE_KEY_VARIABLE2,
+    LICENSE_KEY_PREFIX
+  ].filter((identity) => rewritten.includes(identity));
+  if (leaked.length > 0) {
+    throw new Error(`Buyer CLI constants still name the source product: ${leaked.join(", ")}`);
+  }
+  return rewritten;
 }
-function serverCommand(root) {
-  return { command: "pnpm", args: ["--dir", resolve(root), "agent:mcp"] };
-}
-function codexManagedBlock(root) {
-  const server = serverCommand(root);
-  const args = server.args.map((argument) => JSON.stringify(argument)).join(", ");
-  return `${CODEX_START}
-[mcp_servers.${SERVER_NAME}]
-command = ${JSON.stringify(server.command)}
-args = [${args}]
-required = false
-enabled_tools = ${JSON.stringify(AGENT_CONTEXT_TOOLS)}
-${CODEX_END}`;
+var SELLER_ONLY_ROOT_SCRIPTS = [
+  "release:distribute",
+  "release:publish-cli",
+  "release:upload"
+];
+function stripSellerOnlyRootScripts(content) {
+  const manifest = JSON.parse(content);
+  for (const script of SELLER_ONLY_ROOT_SCRIPTS)
+    delete manifest.scripts?.[script];
+  return `${JSON.stringify(manifest, null, 2)}
+`;
 }
-function mergeCodexConfig(existing, root) {
-  const managed = codexManagedBlock(root);
-  const start = existing.indexOf(CODEX_START);
-  const end = existing.indexOf(CODEX_END);
-  if (start >= 0 || end >= 0) {
-    if (start < 0 || end < start)
-      throw new Error("Codex config has an incomplete agent-context block.");
-    const after = end + CODEX_END.length;
-    return `${existing.slice(0, start).trimEnd()}
-
-${managed}${existing.slice(after)}`.trimStart();
+function rewriteBuyerClaudeInstructions(content) {
+  if (!INTERNAL_CLAUDE_REFERENCE_RE.test(content))
+    return content;
+  const rewritten = removeParagraphContaining(content, "`internal/landing/AGENTS.md`");
+  if (INTERNAL_CLAUDE_REFERENCE_RE.test(rewritten)) {
+    throw new Error("Buyer Claude instructions still contain seller-only guidance.");
   }
-  if (/^\[mcp_servers\.(?:agent-docs|agent_docs|"agent-docs")\]$/m.test(existing)) {
-    throw new Error("Codex already has an unmanaged agent-docs server; remove or rename it first.");
+  return rewritten;
+}
+function rewriteBuyerSetupInstructions(content) {
+  if (!content.includes("## Create a product repository"))
+    return content;
+  const rewritten = replaceMarkdownSection(content, "Create a product repository", "");
+  if (SOURCE_DELIVERY_GUIDANCE_RE2.test(rewritten)) {
+    throw new Error("Buyer setup instructions still contain source-delivery guidance.");
   }
-  return `${existing.trimEnd()}${existing.trim() ? `
-
-` : ""}${managed}
-`;
+  return rewritten;
 }
-function mergeCursorConfig(existing, root) {
-  let config = {};
-  if (existing?.trim()) {
-    try {
-      const parsed = JSON.parse(existing);
-      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-        throw new Error("Cursor MCP configuration must be a JSON object.");
-      }
-      config = parsed;
-    } catch (error) {
-      if (error instanceof SyntaxError)
-        throw new Error("Cursor MCP configuration is invalid JSON.");
-      throw error;
-    }
+function rewriteBuyerReleaseInstructions(content) {
+  if (!content.includes("## npm bootstrapper"))
+    return content;
+  const rewritten = replaceMarkdownSection(content, "npm bootstrapper", "");
+  if (VENDOR_BOOTSTRAPPER_GUIDANCE_RE2.test(rewritten)) {
+    throw new Error("Buyer release instructions still contain vendor bootstrapper guidance.");
   }
-  const servers = config.mcpServers ?? {};
-  const current = servers[SERVER_NAME];
-  const desired = serverCommand(root);
-  if (current !== undefined && JSON.stringify(current) !== JSON.stringify(desired)) {
-    throw new Error("Cursor already has a different agent-docs server; remove or rename it first.");
+  return rewritten;
+}
+function generateStartDevVars(example, secret = randomBytes(32).toString("base64")) {
+  if (!BETTER_AUTH_SECRET_LINE_RE.test(example)) {
+    throw new Error("apps/start/.dev.vars.example must contain a BETTER_AUTH_SECRET entry.");
   }
-  config.mcpServers = { ...servers, [SERVER_NAME]: desired };
-  return `${JSON.stringify(config, null, 2)}
-`;
+  return example.replace(BETTER_AUTH_SECRET_LINE_RE, `BETTER_AUTH_SECRET=${secret}`);
 }
-async function atomicWrite(path, content) {
-  await mkdir(dirname(path), { recursive: true });
-  const temporary = `${path}.${process.pid}.tmp`;
-  await writeFile(temporary, content, { mode: 384 });
-  await rename(temporary, path);
+function generateServerEnv(example, secret = randomBytes(32).toString("hex"), databasePort = 5432) {
+  if (!HEX_64_RE.test(secret)) {
+    throw new Error("Better Auth secret must be 32 bytes encoded as hex.");
+  }
+  if (!DATABASE_URL_LINE_RE.test(example) || !BETTER_AUTH_SECRET_LINE_RE.test(example)) {
+    throw new Error("Server .env.example must contain DATABASE_URL and BETTER_AUTH_SECRET entries.");
+  }
+  if (!Number.isInteger(databasePort) || databasePort < 1 || databasePort > 65535) {
+    throw new Error("Database port must be an integer between 1 and 65535.");
+  }
+  const databaseUrl = `postgresql://app:app@localhost:${databasePort}/app?sslmode=disable`;
+  return example.replace(DATABASE_URL_LINE_RE, `DATABASE_URL=${databaseUrl}`).replace(BETTER_AUTH_SECRET_LINE_RE, `BETTER_AUTH_SECRET=${secret}`);
 }
-async function capture(command, cwd) {
-  return runCaptured(command, { cwd });
+var SCOPE_EXTENSIONS2 = new Set([".json", ".jsonc", ".md", ".ts", ".tsx", ".yaml", ".yml"]);
+function isScopeRewriteFile(path) {
+  return SCOPE_EXTENSIONS2.has(extname(path)) || path.replaceAll("\\", "/").endsWith("/.vite-hooks/pre-commit");
 }
-async function addGitInfoExcludes(root, paths) {
-  const result = await capture(["git", "rev-parse", "--git-path", "info/exclude"], root);
-  if (result.exitCode !== 0)
-    return false;
-  const rawPath = result.stdout.trim();
-  if (!rawPath)
-    return false;
-  const excludePath = resolve(root, rawPath);
-  const existing = await readFile(excludePath, "utf8").catch(() => "");
-  const missing = paths.filter((path) => !existing.split(/\r?\n/).includes(path));
-  if (missing.length === 0)
+function isTemplatePathExcluded(relativePath) {
+  const normalized = relativePath.replaceAll("\\", "/");
+  const parts = normalized.split("/").filter(Boolean);
+  const basename = parts.at(-1) ?? "";
+  if (parts.includes(".git") || parts.includes(".worktrees") || parts.includes("node_modules"))
     return true;
-  const prefix = existing && !existing.endsWith(`
-`) ? `
-` : "";
-  const marker = "# Local agent configuration";
-  const heading = existing.split(/\r?\n/).includes(marker) ? "" : `${marker}
-`;
-  await atomicWrite(excludePath, `${existing}${prefix}${heading}${missing.join(`
-`)}
-`);
-  return true;
-}
-async function configureCodex(root) {
-  const path = join2(root, ".codex/config.toml");
-  const existing = await readFile(path, "utf8").catch(() => "");
-  await atomicWrite(path, mergeCodexConfig(existing, root));
-  const excluded = await addGitInfoExcludes(root, [".codex/config.toml"]);
-  return excluded ? "Configured project-local .codex/config.toml (excluded from Git)." : "Configured project-local .codex/config.toml; review Git status before committing it.";
+  if (parts.includes(".terraform"))
+    return true;
+  if (parts.includes(".impeccable"))
+    return true;
+  if (parts.includes(".agent-evals") || parts.includes(".agents") || parts.includes(".claude"))
+    return true;
+  if (normalized === "skills-lock.json")
+    return true;
+  if (normalized === "internal" || normalized.startsWith("internal/"))
+    return true;
+  if (normalized === "marketing" || normalized.startsWith("marketing/"))
+    return true;
+  if (normalized === ".github/workflows/internal-commercial.yml")
+    return true;
+  if (normalized === "apps/worker" || normalized.startsWith("apps/worker/"))
+    return true;
+  if (parts[0] === "apps" && parts[1] === "mobile") {
+    const mobileEntry = parts[2] ?? "";
+    if ([".expo", "android", "ios", "credentials", "dist-verify"].includes(mobileEntry))
+      return true;
+  }
+  if (parts.includes(".wrangler") || parts.includes(".astro"))
+    return true;
+  if (parts.includes("dist") || parts.includes("out"))
+    return true;
+  if (parts.includes(".next") || parts.includes(".source") || parts.includes(".turbo"))
+    return true;
+  if (normalized === "bun.lock")
+    return true;
+  if (normalized === ".vercelignore")
+    return true;
+  if (basename.endsWith(".tfvars") || basename === "backend.hcl")
+    return true;
+  if (basename.includes(".tfstate") || GHA_CREDS_FILE_RE.test(basename))
+    return true;
+  if (normalized === "PLAN.md" || normalized === "comments.md")
+    return true;
+  if (normalized === "packages/create-app/src/cli-brand-contract.test.ts")
+    return true;
+  if (normalized === "packages/create-app/src/commercial-contract.test.ts")
+    return true;
+  if (normalized === "packages/create-app/LICENSE")
+    return true;
+  if (normalized === "packages/create-app/README.md")
+    return true;
+  if (normalized === "apps/server/server")
+    return true;
+  if (basename.endsWith(".tsbuildinfo"))
+    return true;
+  if (basename === ".dev.vars" || basename.startsWith(".dev.vars.") && basename !== ".dev.vars.example")
+    return true;
+  if (basename === ".env" || basename.startsWith(".env.") && basename !== ".env.example")
+    return true;
+  return false;
 }
-async function configureCursor(root) {
-  const path = join2(root, ".cursor/mcp.json");
-  const existing = await readFile(path, "utf8").catch(() => {
-    return;
+
+// src/editions.ts
+var NON_INDENTED_LINE_RE = /^\S/;
+var IMPORTER_KEY_LINE_RE = /^ {2}(\S[^:]*):\s*$/;
+var EXTRA_BLANK_LINES_RE = /\n{3,}/g;
+var START_TABLE_ROW_RE = /^\| `apps\/start` .*\n/gm;
+var START_PARAGRAPH_RE = /^`apps\/start`[\s\S]*?(?:\n\n|\n?(?![\s\S]))/gm;
+var WORKER_NAME_FIELD_RE = /("name":\s*")[^"]+(")/;
+var DATABASE_NAME_FIELD_RE = /("database_name":\s*")[^"]+(")/;
+var EDITION_NAMES = ["web", "mobile", "start"];
+var START_EDITION_PATHS = ["apps/start", ".github/workflows/deploy-start.yml"];
+var START_EDITION_OVERLAY = "apps/start/edition";
+var START_ROOT_CONTRACTS = {
+  "ROOT-AGENTS.md": "AGENTS.md",
+  "ROOT-CLAUDE.md": "CLAUDE.md"
+};
+var START_ONLY_KEPT_PATHS = [
+  "apps/start",
+  "apps/site",
+  "packages/billing",
+  "packages/tsconfig",
+  ".github/workflows/deploy-start.yml",
+  ".gitattributes",
+  ".gitignore",
+  ".node-version",
+  "LICENSE",
+  "package.json",
+  "pnpm-lock.yaml",
+  "pnpm-workspace.yaml",
+  "vite.config.ts",
+  "knip.json"
+];
+function normalizeEditions(selection) {
+  return { ...selection, web: selection.web || selection.mobile };
+}
+function selectedEditions(selection) {
+  const normalized = normalizeEditions(selection);
+  return EDITION_NAMES.filter((name) => normalized[name]);
+}
+function selectionFromEditions(editions) {
+  return normalizeEditions({
+    web: editions.includes("web"),
+    mobile: editions.includes("mobile"),
+    start: editions.includes("start")
   });
-  await atomicWrite(path, mergeCursorConfig(existing, root));
-  const excluded = await addGitInfoExcludes(root, [".cursor/mcp.json"]);
-  return excluded ? "Configured project-local .cursor/mcp.json (excluded from Git)." : "Configured project-local .cursor/mcp.json; review Git status before committing it.";
 }
-async function configureClaude(root) {
-  if (!which("claude"))
-    throw new Error("Claude Code CLI is not installed or not on PATH.");
-  const existing = await capture(["claude", "mcp", "get", SERVER_NAME], root);
-  if (existing.exitCode === 0) {
-    const combined = `${existing.stdout}
-${existing.stderr}`;
-    if (combined.includes("agent:mcp") && combined.includes(root)) {
-      return "Claude Code already has the matching local server.";
+function pruneLockfileImporters(content, removedImporters) {
+  if (removedImporters.length === 0)
+    return content;
+  const removed = new Set(removedImporters);
+  const lines = content.split(`
+`);
+  const output = [];
+  let inImporters = false;
+  let skipping = false;
+  for (const line of lines) {
+    if (NON_INDENTED_LINE_RE.test(line)) {
+      inImporters = line === "importers:";
+      skipping = false;
+      output.push(line);
+      continue;
     }
-    throw new Error("Claude Code already has a different agent-docs server; remove it first.");
-  }
-  const server = serverCommand(root);
-  const result = await capture(["claude", "mcp", "add", SERVER_NAME, "--scope", "local", "--", server.command, ...server.args], root);
-  if (result.exitCode !== 0) {
-    const output = result.stderr.trim() || result.stdout.trim();
-    throw new Error(`Claude Code MCP setup failed${output ? `: ${output}` : "."}`);
+    if (inImporters) {
+      const importer = line.match(IMPORTER_KEY_LINE_RE)?.[1];
+      if (importer !== undefined)
+        skipping = removed.has(importer);
+      if (skipping)
+        continue;
+    }
+    output.push(line);
   }
-  return "Configured Claude Code local project scope.";
+  return output.join(`
+`).replace(EXTRA_BLANK_LINES_RE, `
+
+`);
 }
-async function smokeServer(root) {
-  const result = await capture(["pnpm", "--dir", root, "agent:mcp", "--check", "--root", root], root);
-  if (result.exitCode !== 0) {
-    const output = result.stderr.trim() || result.stdout.trim();
-    throw new Error(`Agent context MCP self-check failed${output ? `: ${output}` : "."}`);
-  }
-  const report = JSON.parse(result.stdout);
-  if (!report.ok || report.tools !== AGENT_CONTEXT_TOOLS.length) {
-    throw new Error("Agent context MCP self-check was incomplete.");
+function stripKnipWorkspaces(content, removedWorkspaces) {
+  const parsed = JSON.parse(content);
+  for (const workspace of removedWorkspaces)
+    delete parsed.workspaces?.[workspace];
+  if (parsed.ignoreWorkspaces) {
+    parsed.ignoreWorkspaces = parsed.ignoreWorkspaces.filter((workspace) => !removedWorkspaces.includes(workspace));
   }
+  return `${stringifyRepositoryJson(parsed)}
+`;
 }
-function detectedClients() {
-  return CLIENTS.filter((client) => {
-    if (client === "cursor")
-      return Boolean(which("cursor"));
-    return Boolean(which(client));
-  });
+function stripStartReferences(content) {
+  return content.replace(START_TABLE_ROW_RE, "").replace(START_PARAGRAPH_RE, "");
 }
-async function chooseClients(parsed) {
-  if (parsed.clients) {
-    if (parsed.clients.length === 0)
-      throw new Error("--clients must select at least one client.");
-    return parsed.clients;
-  }
-  const detected = detectedClients();
-  if (parsed.yes) {
-    if (detected.length === 0) {
-      throw new Error("No supported client was detected. Pass --clients codex,claude,cursor.");
-    }
-    return detected;
-  }
-  if (!process.stdin.isTTY) {
-    throw new Error("Interactive setup needs a terminal. Pass --clients and --yes instead.");
-  }
-  const selected = await multiselect({
-    message: "Connect which local coding clients?",
-    required: true,
-    options: CLIENTS.map((client) => ({
-      value: client,
-      label: client === "claude" ? "Claude Code" : `${client[0].toUpperCase()}${client.slice(1)}`,
-      hint: detected.includes(client) ? "detected" : "not detected on PATH"
-    })),
-    initialValues: detected
-  });
-  if (isCancel(selected)) {
-    cancel2("No agent clients were configured.");
-    return;
-  }
-  return selected;
+function rewriteStartWorkerIdentifiers(content, appName) {
+  return content.replace(WORKER_NAME_FIELD_RE, `$1${appName}$2`).replace(DATABASE_NAME_FIELD_RE, `$1${appName}$2`);
 }
-function dryRunDescription(client, root) {
-  if (client === "codex")
-    return mergeCodexConfig("", root).trim();
-  if (client === "cursor")
-    return mergeCursorConfig(undefined, root).trim();
-  const server = serverCommand(root);
-  return [
-    "claude",
-    "mcp",
-    "add",
-    SERVER_NAME,
-    "--scope",
-    "local",
-    "--",
-    server.command,
-    ...server.args
-  ].map((value) => value.includes(" ") ? JSON.stringify(value) : value).join(" ");
+function startOnlyRootPackage(rootPackage, overlayPackage) {
+  const root = JSON.parse(rootPackage);
+  const overlay = JSON.parse(overlayPackage);
+  return `${JSON.stringify({ ...root, scripts: overlay.scripts }, null, 2)}
+`;
 }
-async function runAgentSetup(argv, cliName) {
-  const parsed = parseAgentSetupArguments(argv);
-  if (parsed.help) {
-    process.stdout.write(`${agentSetupUsage(cliName)}
-`);
-    return;
-  }
-  const root = await findAgentRepositoryRoot();
-  const clients = await chooseClients(parsed);
-  if (!clients)
-    return;
-  intro2("Local agent context");
-  if (parsed.dryRun) {
-    for (const client of clients) {
-      log2.info(`${client}
-${dryRunDescription(client, root)}`);
-    }
-    outro2("Dry run complete. No client configuration was changed.");
-    return;
+
+// src/delivery.ts
+var WHITESPACE_CHAR_RE3 = /\s/;
+var RELEASE_TAG_PATTERN = /^v\d+\.\d+\.\d+(?:-rc\.\d+)?$/;
+function validateLicenseKey(value) {
+  const key = value.trim();
+  if (!key)
+    return "Enter the licence key from your purchase receipt.";
+  if (WHITESPACE_CHAR_RE3.test(key))
+    return "A licence key does not contain spaces.";
+  if (!key.startsWith(LICENSE_KEY_PREFIX) || key.length === LICENSE_KEY_PREFIX.length) {
+    return `A ${CLI_NAME2} licence key starts with ${LICENSE_KEY_PREFIX}. Copy it from your purchase receipt or the customer portal.`;
   }
-  const progress = spinner2();
-  progress.start("Testing the local MCP server");
-  await smokeServer(root);
-  progress.stop("Local MCP server passed its protocol self-check");
-  for (const client of clients) {
-    const result = client === "codex" ? await configureCodex(root) : client === "cursor" ? await configureCursor(root) : await configureClaude(root);
-    log2.success(`${client}: ${result}`);
+  return;
+}
+function readLicenseKeyFromEnvironment(environment = process.env) {
+  return environment[LICENSE_KEY_VARIABLE2]?.trim() || undefined;
+}
+function normalizeSourceVersion(value) {
+  const trimmed = value.trim();
+  const releaseTag = trimmed.startsWith("v") ? trimmed : `v${trimmed}`;
+  if (!RELEASE_TAG_PATTERN.test(releaseTag)) {
+    throw new Error(`Source version must be an immutable release such as 1.2.3: ${value}`);
   }
-  log2.info("Restart configured clients, then ask: “Use plan_change for my next feature.”");
-  outro2("Agent context is ready.");
+  return releaseTag;
 }
 
-// src/deployment-cli.ts
-import { readFile as readFile3 } from "node:fs/promises";
-import { resolve as resolve2 } from "node:path";
-
-// src/deployment.ts
-import { mkdir as mkdir2, readFile as readFile2, rm, stat as stat2, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join3 } from "node:path";
-var deploymentClouds = ["aws", "gcp", "azure"];
-var frontendTargets = ["native", "vercel", "cloudflare"];
-var storageProviders = ["r2", "s3", "gcs"];
-var defaultRegions = {
-  aws: "us-east-1",
-  gcp: "us-central1",
-  azure: "eastus2"
-};
-var defaultStorageProviders = {
-  aws: "s3",
-  gcp: "gcs",
-  azure: "r2"
-};
-var storageProvidersByCloud = {
-  aws: ["s3", "r2"],
-  gcp: ["gcs", "r2"],
-  azure: ["r2"]
-};
-function isDeploymentCloud(value) {
-  return deploymentClouds.some((cloud) => cloud === value);
-}
-function isFrontendTarget(value) {
-  return frontendTargets.some((target) => target === value);
-}
-function isStorageProvider(value) {
-  return storageProviders.some((provider) => provider === value);
-}
-function parseDeploymentCloud(value) {
-  if (!isDeploymentCloud(value))
-    throw new Error("Cloud must be aws, gcp, or azure.");
-  return value;
-}
-function parseFrontendTarget(value) {
-  if (!isFrontendTarget(value)) {
-    throw new Error("Frontend target must be native, vercel, or cloudflare.");
-  }
-  return value;
-}
-function parseStorageProvider(value) {
-  if (!isStorageProvider(value))
-    throw new Error("Storage provider must be r2, s3, or gcs.");
-  return value;
-}
-function validateDeploymentEnvironment(value) {
-  if (!/^[a-z][a-z0-9-]{1,30}$/.test(value)) {
-    return "Environment must use 2-31 lowercase letters, numbers, or hyphens.";
+// node_modules/@clack/prompts/dist/index.mjs
+import { styleText as styleText3, stripVTControlCharacters as stripVTControlCharacters2 } from "node:util";
+import process$12 from "node:process";
+var import_sisteransi3 = __toESM(require_src(), 1);
+function isUnicodeSupported2() {
+  if (process$12.platform !== "win32") {
+    return process$12.env.TERM !== "linux";
   }
-  return;
+  return Boolean(process$12.env.CI) || Boolean(process$12.env.WT_SESSION) || Boolean(process$12.env.TERMINUS_SUBLIME) || process$12.env.ConEmuTask === "{cmd::Cmder}" || process$12.env.TERM_PROGRAM === "Terminus-Sublime" || process$12.env.TERM_PROGRAM === "vscode" || process$12.env.TERM === "xterm-256color" || process$12.env.TERM === "alacritty" || process$12.env.TERMINAL_EMULATOR === "JetBrains-JediTerm";
 }
-function validateRegion(value) {
-  if (!/^[a-z0-9][a-z0-9-]{1,31}$/.test(value)) {
-    return "Region must use 2-32 lowercase letters, numbers, or hyphens.";
+var unicode2 = isUnicodeSupported2();
+var isCI2 = () => process.env.CI === "true";
+var unicodeOr2 = (o, e) => unicode2 ? o : e;
+var S_STEP_ACTIVE2 = unicodeOr2("◆", "*");
+var S_STEP_CANCEL2 = unicodeOr2("■", "x");
+var S_STEP_ERROR2 = unicodeOr2("▲", "x");
+var S_STEP_SUBMIT2 = unicodeOr2("◇", "o");
+var S_BAR_START2 = unicodeOr2("┌", "T");
+var S_BAR2 = unicodeOr2("│", "|");
+var S_BAR_END2 = unicodeOr2("└", "—");
+var S_BAR_START_RIGHT2 = unicodeOr2("┐", "T");
+var S_BAR_END_RIGHT2 = unicodeOr2("┘", "—");
+var S_RADIO_ACTIVE2 = unicodeOr2("●", ">");
+var S_RADIO_INACTIVE2 = unicodeOr2("○", " ");
+var S_CHECKBOX_ACTIVE2 = unicodeOr2("◻", "[•]");
+var S_CHECKBOX_SELECTED2 = unicodeOr2("◼", "[+]");
+var S_CHECKBOX_INACTIVE2 = unicodeOr2("◻", "[ ]");
+var S_PASSWORD_MASK2 = unicodeOr2("▪", "•");
+var S_BAR_H2 = unicodeOr2("─", "-");
+var S_CORNER_TOP_RIGHT2 = unicodeOr2("╮", "+");
+var S_CONNECT_LEFT2 = unicodeOr2("├", "+");
+var S_CORNER_BOTTOM_RIGHT2 = unicodeOr2("╯", "+");
+var S_CORNER_BOTTOM_LEFT2 = unicodeOr2("╰", "+");
+var S_CORNER_TOP_LEFT2 = unicodeOr2("╭", "+");
+var S_INFO2 = unicodeOr2("●", "•");
+var S_SUCCESS2 = unicodeOr2("◆", "*");
+var S_WARN2 = unicodeOr2("▲", "!");
+var S_ERROR2 = unicodeOr2("■", "x");
+var symbol2 = (o) => {
+  switch (o) {
+    case "initial":
+    case "active":
+      return styleText3("cyan", S_STEP_ACTIVE2);
+    case "cancel":
+      return styleText3("red", S_STEP_CANCEL2);
+    case "error":
+      return styleText3("yellow", S_STEP_ERROR2);
+    case "submit":
+      return styleText3("green", S_STEP_SUBMIT2);
+    case "validating":
+      return styleText3("dim", S_STEP_ACTIVE2);
   }
-  return;
-}
-function validateDomain(value) {
-  if (value.length > 80 || !/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(value)) {
-    return "Enter a lowercase hostname such as api.example.com, without a protocol or path.";
+};
+var symbolBar = (o) => {
+  switch (o) {
+    case "initial":
+    case "active":
+      return styleText3("cyan", S_BAR2);
+    case "cancel":
+      return styleText3("red", S_BAR2);
+    case "error":
+      return styleText3("yellow", S_BAR2);
+    case "submit":
+      return styleText3("green", S_BAR2);
   }
-  return;
+};
+function formatInstructionFooter(o, e) {
+  const r = [`${e ? `${styleText3("cyan", S_BAR2)}  ` : ""}${o.join(" • ")}`];
+  return e && r.push(styleText3("cyan", S_BAR_END2)), r;
 }
-function validateDeploymentSelection(selection) {
-  if (!storageProvidersByCloud[selection.cloud].includes(selection.storageProvider)) {
-    throw new Error(`${selection.storageProvider} storage is not supported for ${selection.cloud} deployments.`);
-  }
-  const environmentError = validateDeploymentEnvironment(selection.environment);
-  if (environmentError)
-    throw new Error(environmentError);
-  const regionError = validateRegion(selection.region);
-  if (regionError)
-    throw new Error(regionError);
-  const apiError = validateDomain(selection.apiDomain);
-  if (apiError)
-    throw new Error(`API domain: ${apiError}`);
-  const frontendError = validateDomain(selection.frontendDomain);
-  if (frontendError)
-    throw new Error(`Frontend domain: ${frontendError}`);
-  if (selection.apiDomain === selection.frontendDomain) {
-    throw new Error("API and frontend domains must be different hostnames.");
-  }
-  const apiSite = selection.apiDomain.split(".").slice(1).join(".");
-  const frontendSite = selection.frontendDomain.split(".").slice(1).join(".");
-  if (apiSite !== frontendSite) {
-    throw new Error("API and frontend domains must be sibling hosts under the same site.");
+var I = (l, e, w, p, b, C = false) => {
+  let r = e, O = 0;
+  if (C)
+    for (let i = p - 1;i >= w; i--) {
+      const m = l[i];
+      if (m && (r -= m.length), O++, r <= b)
+        break;
+    }
+  else
+    for (let i = w;i < p; i++) {
+      const m = l[i];
+      if (m && (r -= m.length), O++, r <= b)
+        break;
+    }
+  return { lineCount: r, removals: O };
+};
+var limitOptions = ({
+  cursor: l,
+  options: e,
+  style: w,
+  output: p = process.stdout,
+  maxItems: b = Number.POSITIVE_INFINITY,
+  columnPadding: C = 0,
+  rowPadding: r = 4
+}) => {
+  const i = getColumns(p) - C, m = getRows(p), M = styleText3("dim", "..."), v = Math.max(m - r, 0), a = Math.max(Math.min(b, v), 5);
+  let f = 0;
+  l >= a - 3 && (f = Math.max(Math.min(l - a + 3, e.length - a), 0));
+  let d = a < e.length && f > 0, c = a < e.length && f + a < e.length;
+  const W = Math.min(f + a, e.length), s = [];
+  let g = 0;
+  d && g++, c && g++;
+  const T = f + (d ? 1 : 0), y = W - (c ? 1 : 0);
+  for (let t = T;t < y; t++) {
+    const n = e[t], o = n ? w(n, t === l) : "", h = wrapAnsi(o, i, {
+      hard: true,
+      trim: false
+    }).split(`
+`);
+    s.push(h), g += h.length;
   }
-}
-function createDeploymentConfig(projectName, selection) {
-  validateDeploymentSelection(selection);
-  return {
-    schema_version: 2,
-    cloud: selection.cloud,
-    storage_provider: selection.storageProvider,
-    project_name: projectName,
-    environment: selection.environment,
-    region: selection.region,
-    frontend_target: selection.frontendTarget,
-    external_frontend_origin: selection.frontendTarget === "native" ? null : `https://${selection.frontendDomain}`,
-    api_domain: selection.apiDomain,
-    frontend_domain: selection.frontendDomain,
-    ha_enabled: selection.haEnabled
-  };
-}
-function deploymentReadme(config) {
-  const identity = config.cloud === "aws" ? "`AWS_ROLE_ARN` secret" : config.cloud === "gcp" ? "`GCP_WORKLOAD_IDENTITY_PROVIDER` and `GCP_SERVICE_ACCOUNT` secrets" : "`AZURE_CLIENT_ID`, `AZURE_TENANT_ID`, and `AZURE_SUBSCRIPTION_ID` secrets";
-  const providerInputs = config.cloud === "aws" ? "Route 53 zone or certificate identifiers and runtime Secrets Manager ARNs" : config.cloud === "gcp" ? "GCP project, Cloud DNS zone, and runtime Secret Manager names" : "Azure DNS zone ID and runtime Key Vault secret identifiers";
-  const storageSetup = config.storage_provider === "r2" ? `Create private staging and public Cloudflare R2 buckets, then store the required storage
-   variables in the runtime secret container.` : `${config.storage_provider.toUpperCase()} application buckets, lifecycle policy, CORS, public access, and workload permissions are
-   managed by the selected OpenTofu root.`;
-  return `# Deployment setup
-
-The deployment target is locked:
-
-- backend: **${config.cloud.toUpperCase()}**;
-- storage: **${config.storage_provider}**;
-- frontend: **${config.frontend_target}**;
-- environment: **${config.environment}**.
-
-## Protected GitHub environment
-
-Create a GitHub environment named \`${config.environment}\` and configure:
-
-- ${identity};
-- a \`BACKEND_HCL\` secret containing the selected remote-state backend configuration;
-- a \`TFVARS_JSON\` secret containing only:
-  - ${providerInputs};
-- \`VITE_TERMS_URL\` and \`VITE_PRIVACY_URL\`, plus \`VITE_MARKETING_URL\` when the product has a
-  public marketing site.
-
-## Cloud preparation
-
-1. Run \`infra/bootstrap/${config.cloud}\` once with an administrator identity.
-2. Configure OIDC trust for this repository and the \`${config.environment}\` GitHub environment.
-3. Create the DNS zone or supply the existing zone identifier required by the selected root.
-4. ${storageSetup}
-5. Create application secret entries for Better Auth and enabled email, billing, monitoring, OAuth,
-   and credential-based providers.
-6. Put only secret identifiers in \`TFVARS_JSON\`; write secret values directly through the cloud
-   provider.
-7. Dispatch \`.github/workflows/deploy-cloud.yml\` with:
-   - cloud: \`${config.cloud}\`;
-   - environment: \`${config.environment}\`;
-   - frontend: \`${config.frontend_target}\`.
-
-The workflow creates the registry first, pushes an immutable image, provisions the API with public
-traffic disabled, runs migrations, and admits traffic only after migration succeeds.
-
-The provider lock is deliberate. Restore the deployment directories from a fresh licensed release
-before changing cloud providers.
-`;
-}
-async function removeIfPresent(target) {
-  if (!await stat2(target).catch(() => {
-    return;
-  }))
-    return false;
-  await rm(target, { recursive: true, force: true });
-  return true;
-}
-async function applyDeploymentSelection(repositoryRoot, projectName, selection) {
-  const config = createDeploymentConfig(projectName, selection);
-  const configPath = join3(repositoryRoot, "deployment/config.json");
-  if (await stat2(configPath).catch(() => {
-    return;
-  })) {
-    throw new Error("Deployment is already locked. Restore a fresh release to change providers.");
+  if (g > v) {
+    let t = 0, n = 0, o = g;
+    const h = l - T;
+    let u = v;
+    const L = () => I(s, o, 0, h, u), E = () => I(s, o, h + 1, s.length, u, true);
+    d ? ({ lineCount: o, removals: t } = L(), o > u && (c || (u -= 1), { lineCount: o, removals: n } = E())) : (c || (u -= 1), { lineCount: o, removals: n } = E(), o > u && (u -= 1, { lineCount: o, removals: t } = L())), t > 0 && (d = true, s.splice(0, t)), n > 0 && (c = true, s.splice(s.length - n, n));
   }
-  await mkdir2(join3(repositoryRoot, "deployment"), { recursive: true });
-  await writeFile2(configPath, `${JSON.stringify(config, null, 2)}
-`);
-  await writeFile2(join3(repositoryRoot, "deployment/README.md"), deploymentReadme(config));
-  const removed = [];
-  for (const cloud of deploymentClouds) {
-    if (cloud === selection.cloud)
-      continue;
-    for (const relativePath of [
-      `infra/bootstrap/${cloud}`,
-      `infra/modules/${cloud}`,
-      `infra/roots/${cloud}`,
-      `scripts/deploy/release-${cloud}.sh`,
-      `scripts/deploy/frontend-${cloud}.sh`
-    ]) {
-      if (await removeIfPresent(join3(repositoryRoot, relativePath)))
-        removed.push(relativePath);
+  const x = [];
+  d && x.push(M);
+  for (const t of s)
+    for (const n of t)
+      x.push(n);
+  return c && x.push(M), x;
+};
+var confirm2 = (e) => {
+  const a = e.active ?? "Yes", o = e.inactive ?? "No";
+  return new r({
+    active: a,
+    inactive: o,
+    signal: e.signal,
+    input: e.input,
+    output: e.output,
+    initialValue: e.initialValue ?? true,
+    render() {
+      const i = e.withGuide ?? settings.withGuide, u = `${symbol2(this.state)}  `, l = i ? `${styleText3("gray", S_BAR2)}  ` : "", f = wrapTextWithPrefix(e.output, e.message, l, u), s = `${i ? `${styleText3("gray", S_BAR2)}
+` : ""}${f}
+`, c = this.value ? a : o;
+      switch (this.state) {
+        case "submit": {
+          const r = i ? `${styleText3("gray", S_BAR2)}  ` : "";
+          return `${s}${r}${styleText3("dim", c)}`;
+        }
+        case "cancel": {
+          const r = i ? `${styleText3("gray", S_BAR2)}  ` : "";
+          return `${s}${r}${styleText3(["strikethrough", "dim"], c)}${i ? `
+${styleText3("gray", S_BAR2)}` : ""}`;
+        }
+        default: {
+          const r = i ? `${styleText3("cyan", S_BAR2)}  ` : "", g = i ? styleText3("cyan", S_BAR_END2) : "";
+          return `${s}${r}${this.value ? `${styleText3("green", S_RADIO_ACTIVE2)} ${a}` : `${styleText3("dim", S_RADIO_INACTIVE2)} ${styleText3("dim", a)}`}${e.vertical ? i ? `
+${styleText3("cyan", S_BAR2)}  ` : `
+` : ` ${styleText3("dim", "/")} `}${this.value ? `${styleText3("dim", S_RADIO_INACTIVE2)} ${styleText3("dim", o)}` : `${styleText3("green", S_RADIO_ACTIVE2)} ${o}`}
+${g}
+`;
+        }
+      }
+    }
+  }).prompt();
+};
+var MULTISELECT_INSTRUCTIONS2 = [
+  `${styleText3("dim", "↑/↓")} to navigate`,
+  `${styleText3("dim", "Space:")} select`,
+  `${styleText3("dim", "Enter:")} confirm`
+];
+var m = (i, u) => i.split(`
+`).map((d) => u(d)).join(`
+`);
+var multiselect = (i) => {
+  const u = (t, a) => {
+    const r = t.label ?? String(t.value);
+    return a === "disabled" ? `${styleText3("gray", S_CHECKBOX_INACTIVE2)} ${m(r, (o) => styleText3(["strikethrough", "gray"], o))}${t.hint ? ` ${styleText3("dim", `(${t.hint ?? "disabled"})`)}` : ""}` : a === "active" ? `${styleText3("cyan", S_CHECKBOX_ACTIVE2)} ${r}${t.hint ? ` ${styleText3("dim", `(${t.hint})`)}` : ""}` : a === "selected" ? `${styleText3("green", S_CHECKBOX_SELECTED2)} ${m(r, (o) => styleText3("dim", o))}${t.hint ? ` ${styleText3("dim", `(${t.hint})`)}` : ""}` : a === "cancelled" ? `${m(r, (o) => styleText3(["strikethrough", "dim"], o))}` : a === "active-selected" ? `${styleText3("green", S_CHECKBOX_SELECTED2)} ${r}${t.hint ? ` ${styleText3("dim", `(${t.hint})`)}` : ""}` : a === "submitted" ? `${m(r, (o) => styleText3("dim", o))}` : `${styleText3("dim", S_CHECKBOX_INACTIVE2)} ${m(r, (o) => styleText3("dim", o))}`;
+  }, d = i.required ?? true, x = i.showInstructions ?? true;
+  return new a({
+    options: i.options,
+    signal: i.signal,
+    input: i.input,
+    output: i.output,
+    initialValues: i.initialValues,
+    required: d,
+    cursorAt: i.cursorAt,
+    validate(t) {
+      if (d && (t === undefined || t.length === 0))
+        return `Please select at least one option.
+${styleText3("reset", styleText3("dim", `Press ${styleText3(["gray", "bgWhite", "inverse"], " space ")} to select, ${styleText3("gray", styleText3("bgWhite", styleText3("inverse", " enter ")))} to submit`))}`;
+    },
+    render() {
+      const t = i.withGuide ?? settings.withGuide, a = wrapTextWithPrefix(i.output, i.message, t ? `${symbolBar(this.state)}  ` : "", `${symbol2(this.state)}  `), r = `${t ? `${styleText3("gray", S_BAR2)}
+` : ""}${a}
+`, o = this.value ?? [], g = (n, l) => {
+        if (n.disabled)
+          return u(n, "disabled");
+        const s = o.includes(n.value);
+        return l && s ? u(n, "active-selected") : s ? u(n, "selected") : u(n, l ? "active" : "inactive");
+      };
+      switch (this.state) {
+        case "submit": {
+          const n = this.options.filter(({ value: s }) => o.includes(s)).map((s) => u(s, "submitted")).join(styleText3("dim", ", ")) || styleText3("dim", "none"), l = wrapTextWithPrefix(i.output, n, t ? `${styleText3("gray", S_BAR2)}  ` : "");
+          return `${r}${l}`;
+        }
+        case "cancel": {
+          const n = this.options.filter(({ value: s }) => o.includes(s)).map((s) => u(s, "cancelled")).join(styleText3("dim", ", "));
+          if (n.trim() === "")
+            return `${r}${styleText3("gray", S_BAR2)}`;
+          const l = wrapTextWithPrefix(i.output, n, t ? `${styleText3("gray", S_BAR2)}  ` : "");
+          return `${r}${l}${t ? `
+${styleText3("gray", S_BAR2)}` : ""}`;
+        }
+        case "error": {
+          const n = t ? `${styleText3("yellow", S_BAR2)}  ` : "", l = this.error.split(`
+`).map(($, v) => v === 0 ? `${t ? `${styleText3("yellow", S_BAR_END2)}  ` : ""}${styleText3("yellow", $)}` : `   ${$}`).join(`
+`), s = r.split(`
+`).length, h = l.split(`
+`).length + 1;
+          return `${r}${n}${limitOptions({
+            output: i.output,
+            options: this.options,
+            cursor: this.cursor,
+            maxItems: i.maxItems,
+            columnPadding: n.length,
+            rowPadding: s + h,
+            style: g
+          }).join(`
+${n}`)}
+${l}
+`;
+        }
+        default: {
+          const n = t ? `${styleText3("cyan", S_BAR2)}  ` : "", l = r.split(`
+`).length, s = x ? formatInstructionFooter(MULTISELECT_INSTRUCTIONS2, t) : t ? [styleText3("cyan", S_BAR_END2)] : [], h = s.join(`
+`), $ = s.length + 1;
+          return `${r}${n}${limitOptions({
+            output: i.output,
+            options: this.options,
+            cursor: this.cursor,
+            maxItems: i.maxItems,
+            columnPadding: n.length,
+            rowPadding: l + $,
+            style: g
+          }).join(`
+${n}`)}
+${h}
+`;
+        }
+      }
+    }
+  }).prompt();
+};
+var log2 = {
+  message: (s = [], {
+    symbol: e = styleText3("gray", S_BAR2),
+    secondarySymbol: r = styleText3("gray", S_BAR2),
+    output: m = process.stdout,
+    spacing: l = 1,
+    withGuide: c
+  } = {}) => {
+    const t = [], o = c ?? settings.withGuide, f = o ? r : "", O = o ? `${e}  ` : "", u = o ? `${r}  ` : "";
+    for (let i = 0;i < l; i++)
+      t.push(f);
+    const g = Array.isArray(s) ? s : s.split(`
+`);
+    if (g.length > 0) {
+      const [i, ...y] = g;
+      i.length > 0 ? t.push(`${O}${i}`) : t.push(o ? e : "");
+      for (const p of y)
+        p.length > 0 ? t.push(`${u}${p}`) : t.push(o ? r : "");
+    }
+    m.write(`${t.join(`
+`)}
+`);
+  },
+  info: (s, e) => {
+    log2.message(s, { ...e, symbol: styleText3("blue", S_INFO2) });
+  },
+  success: (s, e) => {
+    log2.message(s, { ...e, symbol: styleText3("green", S_SUCCESS2) });
+  },
+  step: (s, e) => {
+    log2.message(s, { ...e, symbol: styleText3("green", S_STEP_SUBMIT2) });
+  },
+  warn: (s, e) => {
+    log2.message(s, { ...e, symbol: styleText3("yellow", S_WARN2) });
+  },
+  warning: (s, e) => {
+    log2.warn(s, e);
+  },
+  error: (s, e) => {
+    log2.message(s, { ...e, symbol: styleText3("red", S_ERROR2) });
+  }
+};
+var cancel2 = (o = "", t) => {
+  const i = t?.output ?? process.stdout, e = t?.withGuide ?? settings.withGuide ? `${styleText3("gray", S_BAR_END2)}  ` : "";
+  i.write(`${e}${styleText3("red", o)}
+
+`);
+};
+var intro2 = (o = "", t) => {
+  const i = t?.output ?? process.stdout, e = t?.withGuide ?? settings.withGuide ? `${styleText3("gray", S_BAR_START2)}  ` : "";
+  i.write(`${e}${o}
+`);
+};
+var outro2 = (o = "", t) => {
+  const i = t?.output ?? process.stdout, e = t?.withGuide ?? settings.withGuide ? `${styleText3("gray", S_BAR2)}
+${styleText3("gray", S_BAR_END2)}  ` : "";
+  i.write(`${e}${o}
+
+`);
+};
+var W2 = (l) => styleText3("magenta", l);
+var spinner2 = ({
+  indicator: l = "dots",
+  onCancel: h,
+  output: n = process.stdout,
+  cancelMessage: G,
+  errorMessage: O,
+  frames: E = unicode2 ? ["◒", "◐", "◓", "◑"] : ["•", "o", "O", "0"],
+  delay: F = unicode2 ? 80 : 120,
+  signal: m,
+  ...I
+} = {}) => {
+  const u = isCI2();
+  let M, T, d = false, S = false, s = "", p, w = performance.now();
+  const x = getColumns(n), k = I?.styleFrame ?? W2, g = (e) => {
+    const r = e > 1 ? O ?? settings.messages.error : G ?? settings.messages.cancel;
+    S = e === 1, d && (a(r, e), S && typeof h == "function" && h());
+  }, f = () => g(2), i = () => g(1), A = () => {
+    process.on("uncaughtExceptionMonitor", f), process.on("unhandledRejection", f), process.on("SIGINT", i), process.on("SIGTERM", i), process.on("exit", g), m && m.addEventListener("abort", i);
+  }, H = () => {
+    process.removeListener("uncaughtExceptionMonitor", f), process.removeListener("unhandledRejection", f), process.removeListener("SIGINT", i), process.removeListener("SIGTERM", i), process.removeListener("exit", g), m && m.removeEventListener("abort", i);
+  }, y = () => {
+    if (p === undefined)
+      return;
+    u && n.write(`
+`);
+    const r = wrapAnsi(p, x, {
+      hard: true,
+      trim: false
+    }).split(`
+`);
+    r.length > 1 && n.write(import_sisteransi3.cursor.up(r.length - 1)), n.write(import_sisteransi3.cursor.to(0)), n.write(import_sisteransi3.erase.down());
+  }, C = (e) => e.replace(/\.+$/, ""), _ = (e) => {
+    const r = (performance.now() - e) / 1000, t = Math.floor(r / 60), o = Math.floor(r % 60);
+    return t > 0 ? `[${t}m ${o}s]` : `[${o}s]`;
+  }, N = I.withGuide ?? settings.withGuide, P = (e = "") => {
+    d = true, M = block({ output: n }), s = C(e), w = performance.now(), N && n.write(`${styleText3("gray", S_BAR2)}
+`);
+    let r = 0, t = 0;
+    A(), T = setInterval(() => {
+      if (u && s === p)
+        return;
+      y(), p = s;
+      const o = k(E[r]);
+      let v;
+      if (u)
+        v = `${o}  ${s}...`;
+      else if (l === "timer")
+        v = `${o}  ${s} ${_(w)}`;
+      else {
+        const B = ".".repeat(Math.floor(t)).slice(0, 3);
+        v = `${o}  ${s}${B}`;
+      }
+      const j = wrapAnsi(v, x, {
+        hard: true,
+        trim: false
+      });
+      n.write(j), r = r + 1 < E.length ? r + 1 : 0, t = t < 4 ? t + 0.125 : 0;
+    }, F);
+  }, a = (e = "", r = 0, t = false) => {
+    if (!d)
+      return;
+    d = false, clearInterval(T), y();
+    const o = r === 0 ? styleText3("green", S_STEP_SUBMIT2) : r === 1 ? styleText3("red", S_STEP_CANCEL2) : styleText3("red", S_STEP_ERROR2);
+    s = e ?? s, t || (l === "timer" ? n.write(`${o}  ${s} ${_(w)}
+`) : n.write(`${o}  ${s}
+`)), H(), M();
+  };
+  return {
+    start: P,
+    stop: (e = "") => a(e, 0),
+    message: (e = "") => {
+      s = C(e ?? s);
+    },
+    cancel: (e = "") => a(e, 1),
+    error: (e = "") => a(e, 2),
+    clear: () => a("", 0, true),
+    get isCancelled() {
+      return S;
+    }
+  };
+};
+var u3 = {
+  light: unicodeOr2("─", "-"),
+  heavy: unicodeOr2("━", "="),
+  block: unicodeOr2("█", "#")
+};
+var SELECT_INSTRUCTIONS2 = [
+  `${styleText3("dim", "↑/↓")} to navigate`,
+  `${styleText3("dim", "Enter:")} confirm`
+];
+var c = (t, o) => t.includes(`
+`) ? t.split(`
+`).map((d) => o(d)).join(`
+`) : o(t);
+var select = (t) => {
+  const o = (n, m) => {
+    if (n === undefined)
+      return "";
+    const s = n.label ?? String(n.value);
+    switch (m) {
+      case "disabled":
+        return `${styleText3("gray", S_RADIO_INACTIVE2)} ${c(s, (i) => styleText3("gray", i))}${n.hint ? ` ${styleText3("dim", `(${n.hint ?? "disabled"})`)}` : ""}`;
+      case "selected":
+        return `${c(s, (i) => styleText3("dim", i))}`;
+      case "active":
+        return `${styleText3("green", S_RADIO_ACTIVE2)} ${s}${n.hint ? ` ${styleText3("dim", `(${n.hint})`)}` : ""}`;
+      case "cancelled":
+        return `${c(s, (i) => styleText3(["strikethrough", "dim"], i))}`;
+      default:
+        return `${styleText3("dim", S_RADIO_INACTIVE2)} ${c(s, (i) => styleText3("dim", i))}`;
+    }
+  }, d = t.showInstructions ?? true;
+  return new n$1({
+    options: t.options,
+    signal: t.signal,
+    input: t.input,
+    output: t.output,
+    initialValue: t.initialValue,
+    render() {
+      const n = t.withGuide ?? settings.withGuide, m = `${symbol2(this.state)}  `, s = `${symbolBar(this.state)}  `, i = wrapTextWithPrefix(t.output, t.message, s, m), u = `${n ? `${styleText3("gray", S_BAR2)}
+` : ""}${i}
+`;
+      switch (this.state) {
+        case "submit": {
+          const r = n ? `${styleText3("gray", S_BAR2)}  ` : "", a = wrapTextWithPrefix(t.output, o(this.options[this.cursor], "selected"), r);
+          return `${u}${a}`;
+        }
+        case "cancel": {
+          const r = n ? `${styleText3("gray", S_BAR2)}  ` : "", a = wrapTextWithPrefix(t.output, o(this.options[this.cursor], "cancelled"), r);
+          return `${u}${a}${n ? `
+${styleText3("gray", S_BAR2)}` : ""}`;
+        }
+        default: {
+          const r = n ? `${styleText3("cyan", S_BAR2)}  ` : "", a = u.split(`
+`).length, p = d ? formatInstructionFooter(SELECT_INSTRUCTIONS2, n) : n ? [styleText3("cyan", S_BAR_END2)] : [], f = p.join(`
+`), b = p.length + 1;
+          return `${u}${r}${limitOptions({
+            output: t.output,
+            cursor: this.cursor,
+            options: this.options,
+            maxItems: t.maxItems,
+            columnPadding: r.length,
+            rowPadding: a + b,
+            style: (g, x) => o(g, g.disabled ? "disabled" : x ? "active" : "inactive")
+          }).join(`
+${r}`)}
+${f}
+`;
+        }
+      }
+    }
+  }).prompt();
+};
+var i2 = `${styleText3("gray", S_BAR2)}  `;
+var text2 = (t) => new n({
+  validate: t.validate,
+  placeholder: t.placeholder,
+  defaultValue: t.defaultValue,
+  initialValue: t.initialValue,
+  output: t.output,
+  signal: t.signal,
+  input: t.input,
+  render() {
+    const r = t?.withGuide ?? settings.withGuide, l = `${`${r ? `${styleText3("gray", S_BAR2)}
+` : ""}${symbol2(this.state)}  `}${t.message}
+`, d = t.placeholder && t.placeholder.length > 0 ? styleText3("inverse", t.placeholder[0]) + styleText3("dim", t.placeholder.slice(1)) : styleText3(["inverse", "hidden"], "_"), o = this.userInput ? this.userInputWithCursor : d, s = this.value ?? "";
+    switch (this.state) {
+      case "validating": {
+        const n = r ? `${styleText3("cyan", S_BAR2)}  ` : "", i = r ? styleText3("cyan", S_BAR_END2) : "", c = styleText3("dim", o), $ = styleText3("dim", "Validating...");
+        return `${l}${n}${c}
+${i}  ${$}
+`;
+      }
+      case "error": {
+        const n = this.error ? `  ${styleText3("yellow", this.error)}` : "", i = r ? `${styleText3("yellow", S_BAR2)}  ` : "", c = r ? styleText3("yellow", S_BAR_END2) : "";
+        return `${l.trim()}
+${i}${o}
+${c}${n}
+`;
+      }
+      case "submit": {
+        const n = s ? `${r ? "  " : ""}${styleText3("dim", s)}` : "", i = r ? styleText3("gray", S_BAR2) : "";
+        return `${l}${i}${n}`;
+      }
+      case "cancel": {
+        const n = s ? `  ${styleText3(["strikethrough", "dim"], s)}` : "", i = r ? styleText3("gray", S_BAR2) : "";
+        return `${l}${i}${n}${s.trim() ? `
+${i}` : ""}`;
+      }
+      default: {
+        const n = r ? `${styleText3("cyan", S_BAR2)}  ` : "", i = r ? styleText3("cyan", S_BAR_END2) : "";
+        return `${l}${n}${o}
+${i}
+`;
+      }
     }
   }
-  const adapters = [
-    { target: "vercel", path: "apps/web/vercel.json" },
-    { target: "cloudflare", path: "apps/web/wrangler.toml" },
-    {
-      target: "azure-native",
-      path: "apps/web/public/staticwebapp.config.json"
-    }
-  ];
-  const selectedAdapter = selection.frontendTarget === "native" ? selection.cloud === "azure" ? "azure-native" : undefined : selection.frontendTarget;
-  for (const adapter of adapters) {
-    if (adapter.target === selectedAdapter)
+}).prompt();
+
+// src/agent-setup.ts
+import { mkdir, readFile, rename, stat, writeFile } from "node:fs/promises";
+import { dirname, join as join2, resolve } from "node:path";
+
+// src/runtime.ts
+import { spawn } from "node:child_process";
+import { accessSync, constants, realpathSync } from "node:fs";
+import { delimiter, join, resolve as resolvePath } from "node:path";
+function runCaptured(command, options) {
+  const [file, ...args] = command;
+  if (!file)
+    throw new Error("runCaptured requires a command");
+  return new Promise((resolve, reject) => {
+    const child = spawn(file, args, {
+      cwd: options.cwd,
+      env: options.env ?? process.env,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.setEncoding("utf8");
+    child.stderr.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk;
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk;
+    });
+    child.on("error", reject);
+    child.on("close", (code, signal) => {
+      resolve({ exitCode: code ?? (signal ? 1 : 0), stdout, stderr });
+    });
+  });
+}
+function which(command) {
+  if (command.includes("/"))
+    return isExecutable(command) ? command : null;
+  const extensions = process.platform === "win32" ? (process.env.PATHEXT ?? "").split(";") : [""];
+  for (const directory of (process.env.PATH ?? "").split(delimiter)) {
+    if (!directory)
       continue;
-    if (await removeIfPresent(join3(repositoryRoot, adapter.path)))
-      removed.push(adapter.path);
+    for (const extension of extensions) {
+      const candidate = join(directory, `${command}${extension}`);
+      if (isExecutable(candidate))
+        return candidate;
+    }
   }
-  if (selection.frontendTarget !== "native") {
-    const nativeScript = `scripts/deploy/frontend-${selection.cloud}.sh`;
-    if (await removeIfPresent(join3(repositoryRoot, nativeScript)))
-      removed.push(nativeScript);
+  return null;
+}
+function isExecutable(path) {
+  try {
+    accessSync(path, constants.X_OK);
+    return true;
+  } catch {
+    return false;
   }
-  return removed;
 }
 
-// src/deployment-prompts.ts
-class DeploymentPromptCancelled extends Error {
+// src/agent-setup.ts
+var CODEX_AGENT_DOCS_TABLE_RE = /^\[mcp_servers\.(?:agent-docs|agent_docs|"agent-docs")\]$/m;
+var LINE_BREAK_RE = /\r?\n/;
+var CLIENTS = ["codex", "claude", "cursor"];
+var SERVER_NAME = "agent-docs";
+var CODEX_START = "# agent-context:start";
+var CODEX_END = "# agent-context:end";
+var AGENT_CONTEXT_TOOLS = [
+  "search_docs",
+  "search_implementation",
+  "get_repository_map",
+  "plan_change",
+  "get_invariants",
+  "get_verification"
+];
+function takeValue(args, index, flag) {
+  const value = args[index + 1];
+  if (!value || value.startsWith("-"))
+    throw new Error(`${flag} requires a value.`);
+  return value;
 }
-async function unwrap(value) {
-  if (isCancel(value)) {
-    cancel2("Deployment configuration was not changed.");
-    throw new DeploymentPromptCancelled;
+function parseAgentSetupArguments(argv) {
+  const parsed = { yes: false, dryRun: false, help: false };
+  for (let index = 0;index < argv.length; index += 1) {
+    const argument = argv[index];
+    if (argument === "--clients") {
+      const values = takeValue(argv, index++, argument).split(",").map((value) => value.trim()).filter(Boolean);
+      const invalid = values.filter((value) => !CLIENTS.includes(value));
+      if (invalid.length > 0)
+        throw new Error(`Unknown agent client: ${invalid.join(", ")}`);
+      parsed.clients = [...new Set(values)];
+    } else if (argument === "--yes" || argument === "-y")
+      parsed.yes = true;
+    else if (argument === "--dry-run")
+      parsed.dryRun = true;
+    else if (argument === "--help" || argument === "-h")
+      parsed.help = true;
+    else
+      throw new Error(`Unknown agent setup option: ${argument}`);
   }
-  return value;
+  return parsed;
 }
-async function collectDeploymentSelection(defaults = {}, nonInteractive = false) {
-  if (nonInteractive) {
-    if (!defaults.cloud || !defaults.apiDomain || !defaults.frontendDomain) {
-      throw new Error("Non-interactive deployment setup requires --cloud, --api-domain, and --frontend-domain.");
+function agentSetupUsage(cliName) {
+  return `Usage: ${cliName} agent setup [options]
+
+Connect local coding clients to this checkout's read-only project context server.
+
+Options:
+  --clients <list>  Comma-separated clients: codex,claude,cursor
+  --yes              Configure every detected client without prompting
+  --dry-run          Show the selected configuration without changing client settings
+  -h, --help         Show this help`;
+}
+async function pathExists(path) {
+  return Boolean(await stat(path).catch(() => {
+    return;
+  }));
+}
+async function findAgentRepositoryRoot(start = process.cwd()) {
+  let current = resolve(start);
+  while (true) {
+    if (await pathExists(join2(current, "AGENTS.md")) && await pathExists(join2(current, "packages/agent-context/package.json")) && await pathExists(join2(current, "agent-tooling/manifest.json"))) {
+      return current;
     }
-    return {
-      cloud: defaults.cloud,
-      storageProvider: defaults.storageProvider ?? defaultStorageProviders[defaults.cloud],
-      frontendTarget: defaults.frontendTarget ?? "native",
-      environment: defaults.environment ?? "production",
-      region: defaults.region ?? defaultRegions[defaults.cloud],
-      apiDomain: defaults.apiDomain,
-      frontendDomain: defaults.frontendDomain,
-      haEnabled: defaults.haEnabled ?? false
-    };
+    const parent = dirname(current);
+    if (parent === current)
+      throw new Error("Run agent setup inside a project repository.");
+    current = parent;
   }
-  const cloud = defaults.cloud ?? parseDeploymentCloud(await unwrap(await select({
-    message: "Backend cloud",
-    options: [
-      { value: "aws", label: "AWS", hint: "ECS Fargate + RDS PostgreSQL" },
-      { value: "gcp", label: "Google Cloud", hint: "Cloud Run + Cloud SQL" },
-      { value: "azure", label: "Azure", hint: "Container Apps + Flexible Server" }
-    ]
-  })));
-  const frontendTarget = defaults.frontendTarget ?? parseFrontendTarget(await unwrap(await select({
-    message: "Frontend host",
-    options: [
-      { value: "native", label: "Cloud native", hint: "Managed with the backend" },
-      { value: "vercel", label: "Vercel SPA", hint: "Static frontend only" },
-      {
-        value: "cloudflare",
-        label: "Cloudflare static assets",
-        hint: "No API Worker"
-      }
-    ]
-  })));
-  const storageProvider = defaults.storageProvider ?? (storageProvidersByCloud[cloud].length === 1 ? storageProvidersByCloud[cloud][0] ?? defaultStorageProviders[cloud] : parseStorageProvider(await unwrap(await select({
-    message: "Object storage",
-    options: storageProvidersByCloud[cloud].map((provider) => ({
-      value: provider,
-      label: provider === "s3" ? "Amazon S3" : provider === "gcs" ? "Google Cloud Storage" : "Cloudflare R2",
-      hint: provider === defaultStorageProviders[cloud] ? "Cloud-native default" : ""
-    }))
-  }))));
-  const environment = defaults.environment ?? await unwrap(await text2({
-    message: "Deployment environment",
-    placeholder: "production",
-    defaultValue: "production",
-    validate: (value) => validateDeploymentEnvironment(value || "production")
-  }));
-  const region = defaults.region ?? await unwrap(await text2({
-    message: `${cloud.toUpperCase()} region`,
-    placeholder: defaultRegions[cloud],
-    defaultValue: defaultRegions[cloud],
-    validate: (value) => validateRegion(value || defaultRegions[cloud])
-  }));
-  const apiDomain = defaults.apiDomain ?? await unwrap(await text2({
-    message: "Production API domain",
-    placeholder: "api.example.com",
-    validate: (value) => validateDomain(value ?? "")
-  }));
-  const frontendDomain = defaults.frontendDomain ?? await unwrap(await text2({
-    message: "Production frontend domain",
-    placeholder: "app.example.com",
-    validate: (value) => validateDomain(value ?? "")
-  }));
-  const haEnabled = defaults.haEnabled ?? await unwrap(await confirm2({
-    message: "Enable the higher-availability profile?",
-    initialValue: false
-  }));
-  return {
-    cloud,
-    storageProvider,
-    frontendTarget,
-    environment,
-    region,
-    apiDomain,
-    frontendDomain,
-    haEnabled
-  };
 }
-
-// src/deployment-cli.ts
-function takeValue2(args, index, flag) {
-  const value = args[index + 1];
-  if (!value || value.startsWith("--"))
-    throw new Error(`${flag} requires a value.`);
-  return value;
+function serverCommand(root) {
+  return { command: "pnpm", args: ["--dir", resolve(root), "agent:mcp"] };
+}
+function codexManagedBlock(root) {
+  const server = serverCommand(root);
+  const args = server.args.map((argument) => JSON.stringify(argument)).join(", ");
+  return `${CODEX_START}
+[mcp_servers.${SERVER_NAME}]
+command = ${JSON.stringify(server.command)}
+args = [${args}]
+required = false
+enabled_tools = ${JSON.stringify(AGENT_CONTEXT_TOOLS)}
+${CODEX_END}`;
 }
-function parseDeploymentArguments(argv) {
-  const parsed = { yes: false };
-  for (let index = 0;index < argv.length; index += 1) {
-    const argument = argv[index];
-    if (argument === "--cloud") {
-      parsed.cloud = parseDeploymentCloud(takeValue2(argv, index++, argument));
-    } else if (argument === "--frontend") {
-      parsed.frontendTarget = parseFrontendTarget(takeValue2(argv, index++, argument));
-    } else if (argument === "--storage") {
-      parsed.storageProvider = parseStorageProvider(takeValue2(argv, index++, argument));
-    } else if (argument === "--environment") {
-      parsed.environment = takeValue2(argv, index++, argument);
-    } else if (argument === "--region") {
-      parsed.region = takeValue2(argv, index++, argument);
-    } else if (argument === "--api-domain") {
-      parsed.apiDomain = takeValue2(argv, index++, argument);
-    } else if (argument === "--frontend-domain") {
-      parsed.frontendDomain = takeValue2(argv, index++, argument);
-    } else if (argument === "--ha")
-      parsed.haEnabled = true;
-    else if (argument === "--no-ha")
-      parsed.haEnabled = false;
-    else if (argument === "--yes" || argument === "-y")
-      parsed.yes = true;
-    else
-      throw new Error(`Unknown deployment option: ${argument}`);
+function mergeCodexConfig(existing, root) {
+  const managed = codexManagedBlock(root);
+  const start = existing.indexOf(CODEX_START);
+  const end = existing.indexOf(CODEX_END);
+  if (start >= 0 || end >= 0) {
+    if (start < 0 || end < start)
+      throw new Error("Codex config has an incomplete agent-context block.");
+    const after = end + CODEX_END.length;
+    return `${existing.slice(0, start).trimEnd()}
+
+${managed}${existing.slice(after)}`.trimStart();
   }
-  return parsed;
+  if (CODEX_AGENT_DOCS_TABLE_RE.test(existing)) {
+    throw new Error("Codex already has an unmanaged agent-docs server; remove or rename it first.");
+  }
+  return `${existing.trimEnd()}${existing.trim() ? `
+
+` : ""}${managed}
+`;
 }
-async function runDeploymentConfigure(argv, productName, repositoryRoot = process.cwd()) {
-  const parsed = parseDeploymentArguments(argv);
-  const root = resolve2(repositoryRoot);
-  const rootPackage = JSON.parse(await readFile3(`${root}/package.json`, "utf8"));
-  if (!rootPackage.name)
-    throw new Error("Root package name is required for deployment setup.");
-  intro2(`${productName} deployment setup`);
-  try {
-    const selection = await collectDeploymentSelection(parsed, parsed.yes);
-    const removed = await applyDeploymentSelection(root, rootPackage.name, selection);
-    log2.success(`${selection.cloud.toUpperCase()} + ${selection.storageProvider} + ${selection.frontendTarget} is locked for ${selection.environment}.`);
-    log2.info(`${removed.length} unused deployment paths removed.`);
-    log2.step("Next");
-    log2.message(`Review deployment/config.json
-Configure the protected GitHub environment
-Dispatch .github/workflows/deploy-cloud.yml`);
-    outro2("Deployment configuration is ready to commit.");
-  } catch (error) {
-    if (error instanceof DeploymentPromptCancelled)
-      return;
-    throw error;
+function mergeCursorConfig(existing, root) {
+  let config = {};
+  if (existing?.trim()) {
+    try {
+      const parsed = JSON.parse(existing);
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error("Cursor MCP configuration must be a JSON object.");
+      }
+      config = parsed;
+    } catch (error) {
+      if (error instanceof SyntaxError)
+        throw new Error("Cursor MCP configuration is invalid JSON.");
+      throw error;
+    }
+  }
+  const servers = config.mcpServers ?? {};
+  const current = servers[SERVER_NAME];
+  const desired = serverCommand(root);
+  if (current !== undefined && JSON.stringify(current) !== JSON.stringify(desired)) {
+    throw new Error("Cursor already has a different agent-docs server; remove or rename it first.");
   }
+  config.mcpServers = { ...servers, [SERVER_NAME]: desired };
+  return `${JSON.stringify(config, null, 2)}
+`;
 }
-
-// src/runtime.ts
-import { spawn as spawn2 } from "node:child_process";
-import { accessSync as accessSync2, constants as constants2, realpathSync as realpathSync2 } from "node:fs";
-import { delimiter as delimiter2, join as join4, resolve as resolvePath2 } from "node:path";
-import { fileURLToPath } from "node:url";
-function runCaptured2(command, options) {
-  const [file, ...args] = command;
-  if (!file)
-    throw new Error("runCaptured requires a command");
-  return new Promise((resolve, reject) => {
-    const child = spawn2(file, args, {
-      cwd: options.cwd,
-      env: options.env ?? process.env,
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    let stdout = "";
-    let stderr = "";
-    child.stdout.setEncoding("utf8");
-    child.stderr.setEncoding("utf8");
-    child.stdout.on("data", (chunk) => {
-      stdout += chunk;
-    });
-    child.stderr.on("data", (chunk) => {
-      stderr += chunk;
-    });
-    child.on("error", reject);
-    child.on("close", (code, signal) => {
-      resolve({ exitCode: code ?? (signal ? 1 : 0), stdout, stderr });
-    });
-  });
+async function atomicWrite(path, content) {
+  await mkdir(dirname(path), { recursive: true });
+  const temporary = `${path}.${process.pid}.tmp`;
+  await writeFile(temporary, content, { mode: 384 });
+  await rename(temporary, path);
 }
-function runInherited(command, options) {
-  const [file, ...args] = command;
-  if (!file)
-    throw new Error("runInherited requires a command");
-  return new Promise((resolve, reject) => {
-    const child = spawn2(file, args, {
-      cwd: options.cwd,
-      env: options.env ?? process.env,
-      stdio: "inherit"
-    });
-    child.on("error", reject);
-    child.on("close", (code, signal) => {
-      resolve(code ?? (signal === "SIGINT" ? 130 : 1));
-    });
+async function capture(command, cwd) {
+  return runCaptured(command, { cwd });
+}
+async function addGitInfoExcludes(root, paths) {
+  const result = await capture(["git", "rev-parse", "--git-path", "info/exclude"], root);
+  if (result.exitCode !== 0)
+    return false;
+  const rawPath = result.stdout.trim();
+  if (!rawPath)
+    return false;
+  const excludePath = resolve(root, rawPath);
+  const existing = await readFile(excludePath, "utf8").catch(() => "");
+  const missing = paths.filter((path) => !existing.split(LINE_BREAK_RE).includes(path));
+  if (missing.length === 0)
+    return true;
+  const prefix = existing && !existing.endsWith(`
+`) ? `
+` : "";
+  const marker = "# Local agent configuration";
+  const heading = existing.split(LINE_BREAK_RE).includes(marker) ? "" : `${marker}
+`;
+  await atomicWrite(excludePath, `${existing}${prefix}${heading}${missing.join(`
+`)}
+`);
+  return true;
+}
+async function configureCodex(root) {
+  const path = join2(root, ".codex/config.toml");
+  const existing = await readFile(path, "utf8").catch(() => "");
+  await atomicWrite(path, mergeCodexConfig(existing, root));
+  const excluded = await addGitInfoExcludes(root, [".codex/config.toml"]);
+  return excluded ? "Configured project-local .codex/config.toml (excluded from Git)." : "Configured project-local .codex/config.toml; review Git status before committing it.";
+}
+async function configureCursor(root) {
+  const path = join2(root, ".cursor/mcp.json");
+  const existing = await readFile(path, "utf8").catch(() => {
+    return;
   });
+  await atomicWrite(path, mergeCursorConfig(existing, root));
+  const excluded = await addGitInfoExcludes(root, [".cursor/mcp.json"]);
+  return excluded ? "Configured project-local .cursor/mcp.json (excluded from Git)." : "Configured project-local .cursor/mcp.json; review Git status before committing it.";
 }
-function canonicalPath(path) {
-  try {
-    return realpathSync2(path);
-  } catch {
-    return resolvePath2(path);
+async function configureClaude(root) {
+  if (!which("claude"))
+    throw new Error("Claude Code CLI is not installed or not on PATH.");
+  const existing = await capture(["claude", "mcp", "get", SERVER_NAME], root);
+  if (existing.exitCode === 0) {
+    const combined = `${existing.stdout}
+${existing.stderr}`;
+    if (combined.includes("agent:mcp") && combined.includes(root)) {
+      return "Claude Code already has the matching local server.";
+    }
+    throw new Error("Claude Code already has a different agent-docs server; remove it first.");
+  }
+  const server = serverCommand(root);
+  const result = await capture(["claude", "mcp", "add", SERVER_NAME, "--scope", "local", "--", server.command, ...server.args], root);
+  if (result.exitCode !== 0) {
+    const output = result.stderr.trim() || result.stdout.trim();
+    throw new Error(`Claude Code MCP setup failed${output ? `: ${output}` : "."}`);
   }
+  return "Configured Claude Code local project scope.";
 }
-function isEntrypoint(moduleUrl) {
-  const entry = process.argv[1];
-  if (!entry)
-    return false;
-  try {
-    return canonicalPath(fileURLToPath(moduleUrl)) === canonicalPath(entry);
-  } catch {
-    return false;
+async function smokeServer(root) {
+  const result = await capture(["pnpm", "--dir", root, "agent:mcp", "--check", "--root", root], root);
+  if (result.exitCode !== 0) {
+    const output = result.stderr.trim() || result.stdout.trim();
+    throw new Error(`Agent context MCP self-check failed${output ? `: ${output}` : "."}`);
+  }
+  const report = JSON.parse(result.stdout);
+  if (!report.ok || report.tools !== AGENT_CONTEXT_TOOLS.length) {
+    throw new Error("Agent context MCP self-check was incomplete.");
+  }
+}
+function detectedClients() {
+  return CLIENTS.filter((client) => {
+    if (client === "cursor")
+      return Boolean(which("cursor"));
+    return Boolean(which(client));
+  });
+}
+async function chooseClients(parsed) {
+  if (parsed.clients) {
+    if (parsed.clients.length === 0)
+      throw new Error("--clients must select at least one client.");
+    return parsed.clients;
+  }
+  const detected = detectedClients();
+  if (parsed.yes) {
+    if (detected.length === 0) {
+      throw new Error("No supported client was detected. Pass --clients codex,claude,cursor.");
+    }
+    return detected;
+  }
+  if (!process.stdin.isTTY) {
+    throw new Error("Interactive setup needs a terminal. Pass --clients and --yes instead.");
+  }
+  const selected = await multiselect({
+    message: "Connect which local coding clients?",
+    required: true,
+    options: CLIENTS.map((client) => ({
+      value: client,
+      label: client === "claude" ? "Claude Code" : `${client[0].toUpperCase()}${client.slice(1)}`,
+      hint: detected.includes(client) ? "detected" : "not detected on PATH"
+    })),
+    initialValues: detected
+  });
+  if (isCancel(selected)) {
+    cancel2("No agent clients were configured.");
+    return;
   }
+  return selected;
 }
-
-// src/deployment-prompts.ts
-class DeploymentPromptCancelled2 extends Error {
+function dryRunDescription(client, root) {
+  if (client === "codex")
+    return mergeCodexConfig("", root).trim();
+  if (client === "cursor")
+    return mergeCursorConfig(undefined, root).trim();
+  const server = serverCommand(root);
+  return [
+    "claude",
+    "mcp",
+    "add",
+    SERVER_NAME,
+    "--scope",
+    "local",
+    "--",
+    server.command,
+    ...server.args
+  ].map((value) => value.includes(" ") ? JSON.stringify(value) : value).join(" ");
 }
-async function unwrap2(value) {
-  if (isCancel(value)) {
-    cancel2("Deployment configuration was not changed.");
-    throw new DeploymentPromptCancelled2;
+async function runAgentSetup(argv, cliName) {
+  const parsed = parseAgentSetupArguments(argv);
+  if (parsed.help) {
+    process.stdout.write(`${agentSetupUsage(cliName)}
+`);
+    return;
   }
-  return value;
-}
-async function collectDeploymentSelection2(defaults = {}, nonInteractive = false) {
-  if (nonInteractive) {
-    if (!defaults.cloud || !defaults.apiDomain || !defaults.frontendDomain) {
-      throw new Error("Non-interactive deployment setup requires --cloud, --api-domain, and --frontend-domain.");
+  const root = await findAgentRepositoryRoot();
+  const clients = await chooseClients(parsed);
+  if (!clients)
+    return;
+  intro2("Local agent context");
+  if (parsed.dryRun) {
+    for (const client of clients) {
+      log2.info(`${client}
+${dryRunDescription(client, root)}`);
     }
-    return {
-      cloud: defaults.cloud,
-      storageProvider: defaults.storageProvider ?? defaultStorageProviders[defaults.cloud],
-      frontendTarget: defaults.frontendTarget ?? "native",
-      environment: defaults.environment ?? "production",
-      region: defaults.region ?? defaultRegions[defaults.cloud],
-      apiDomain: defaults.apiDomain,
-      frontendDomain: defaults.frontendDomain,
-      haEnabled: defaults.haEnabled ?? false
-    };
+    outro2("Dry run complete. No client configuration was changed.");
+    return;
   }
-  const cloud = defaults.cloud ?? parseDeploymentCloud(await unwrap2(await select({
-    message: "Backend cloud",
-    options: [
-      { value: "aws", label: "AWS", hint: "ECS Fargate + RDS PostgreSQL" },
-      { value: "gcp", label: "Google Cloud", hint: "Cloud Run + Cloud SQL" },
-      { value: "azure", label: "Azure", hint: "Container Apps + Flexible Server" }
-    ]
-  })));
-  const frontendTarget = defaults.frontendTarget ?? parseFrontendTarget(await unwrap2(await select({
-    message: "Frontend host",
-    options: [
-      { value: "native", label: "Cloud native", hint: "Managed with the backend" },
-      { value: "vercel", label: "Vercel SPA", hint: "Static frontend only" },
-      {
-        value: "cloudflare",
-        label: "Cloudflare static assets",
-        hint: "No API Worker"
-      }
-    ]
-  })));
-  const storageProvider = defaults.storageProvider ?? (storageProvidersByCloud[cloud].length === 1 ? storageProvidersByCloud[cloud][0] ?? defaultStorageProviders[cloud] : parseStorageProvider(await unwrap2(await select({
-    message: "Object storage",
-    options: storageProvidersByCloud[cloud].map((provider) => ({
-      value: provider,
-      label: provider === "s3" ? "Amazon S3" : provider === "gcs" ? "Google Cloud Storage" : "Cloudflare R2",
-      hint: provider === defaultStorageProviders[cloud] ? "Cloud-native default" : ""
-    }))
-  }))));
-  const environment = defaults.environment ?? await unwrap2(await text2({
-    message: "Deployment environment",
-    placeholder: "production",
-    defaultValue: "production",
-    validate: (value) => validateDeploymentEnvironment(value || "production")
-  }));
-  const region = defaults.region ?? await unwrap2(await text2({
-    message: `${cloud.toUpperCase()} region`,
-    placeholder: defaultRegions[cloud],
-    defaultValue: defaultRegions[cloud],
-    validate: (value) => validateRegion(value || defaultRegions[cloud])
-  }));
-  const apiDomain = defaults.apiDomain ?? await unwrap2(await text2({
-    message: "Production API domain",
-    placeholder: "api.example.com",
-    validate: (value) => validateDomain(value ?? "")
-  }));
-  const frontendDomain = defaults.frontendDomain ?? await unwrap2(await text2({
-    message: "Production frontend domain",
-    placeholder: "app.example.com",
-    validate: (value) => validateDomain(value ?? "")
-  }));
-  const haEnabled = defaults.haEnabled ?? await unwrap2(await confirm2({
-    message: "Enable the higher-availability profile?",
-    initialValue: false
-  }));
-  return {
-    cloud,
-    storageProvider,
-    frontendTarget,
-    environment,
-    region,
-    apiDomain,
-    frontendDomain,
-    haEnabled
-  };
+  const progress = spinner2();
+  progress.start("Testing the local MCP server");
+  await smokeServer(root);
+  progress.stop("Local MCP server passed its protocol self-check");
+  for (const client of clients) {
+    const result = client === "codex" ? await configureCodex(root) : client === "cursor" ? await configureCursor(root) : await configureClaude(root);
+    log2.success(`${client}: ${result}`);
+  }
+  log2.info("Restart configured clients, then ask: “Use plan_change for my next feature.”");
+  outro2("Agent context is ready.");
 }
 
+// src/deployment-cli.ts
+import { readFile as readFile3 } from "node:fs/promises";
+import { resolve as resolve2 } from "node:path";
+
 // src/deployment.ts
-import { mkdir as mkdir3, readFile as readFile4, rm as rm2, stat as stat3, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join5 } from "node:path";
-var deploymentClouds2 = ["aws", "gcp", "azure"];
-var frontendTargets2 = ["native", "vercel", "cloudflare"];
-var storageProviders2 = ["r2", "s3", "gcs"];
-var storageProvidersByCloud2 = {
+import { mkdir as mkdir2, readFile as readFile2, rm, stat as stat2, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join3 } from "node:path";
+var DEPLOYMENT_ENVIRONMENT_RE = /^[a-z][a-z0-9-]{1,30}$/;
+var REGION_RE = /^[a-z0-9][a-z0-9-]{1,31}$/;
+var DOMAIN_RE = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+var deploymentClouds = ["aws", "gcp", "azure"];
+var frontendTargets = ["native", "vercel", "cloudflare"];
+var storageProviders = ["r2", "s3", "gcs"];
+var defaultRegions = {
+  aws: "us-east-1",
+  gcp: "us-central1",
+  azure: "eastus2"
+};
+var defaultStorageProviders = {
+  aws: "s3",
+  gcp: "gcs",
+  azure: "r2"
+};
+var storageProvidersByCloud = {
   aws: ["s3", "r2"],
   gcp: ["gcs", "r2"],
   azure: ["r2"]
 };
-function isDeploymentCloud2(value) {
-  return deploymentClouds2.some((cloud) => cloud === value);
+function isDeploymentCloud(value) {
+  return deploymentClouds.some((cloud) => cloud === value);
 }
-function isFrontendTarget2(value) {
-  return frontendTargets2.some((target) => target === value);
+function isFrontendTarget(value) {
+  return frontendTargets.some((target) => target === value);
 }
-function isStorageProvider2(value) {
-  return storageProviders2.some((provider) => provider === value);
+function isStorageProvider(value) {
+  return storageProviders.some((provider) => provider === value);
 }
-function parseDeploymentCloud2(value) {
-  if (!isDeploymentCloud2(value))
+function parseDeploymentCloud(value) {
+  if (!isDeploymentCloud(value))
     throw new Error("Cloud must be aws, gcp, or azure.");
   return value;
 }
-function parseFrontendTarget2(value) {
-  if (!isFrontendTarget2(value)) {
+function parseFrontendTarget(value) {
+  if (!isFrontendTarget(value)) {
     throw new Error("Frontend target must be native, vercel, or cloudflare.");
   }
   return value;
 }
-function parseStorageProvider2(value) {
-  if (!isStorageProvider2(value))
+function parseStorageProvider(value) {
+  if (!isStorageProvider(value))
     throw new Error("Storage provider must be r2, s3, or gcs.");
   return value;
 }
-function validateDeploymentEnvironment2(value) {
-  if (!/^[a-z][a-z0-9-]{1,30}$/.test(value)) {
+function validateDeploymentEnvironment(value) {
+  if (!DEPLOYMENT_ENVIRONMENT_RE.test(value)) {
     return "Environment must use 2-31 lowercase letters, numbers, or hyphens.";
   }
   return;
 }
-function validateRegion2(value) {
-  if (!/^[a-z0-9][a-z0-9-]{1,31}$/.test(value)) {
+function validateRegion(value) {
+  if (!REGION_RE.test(value)) {
     return "Region must use 2-32 lowercase letters, numbers, or hyphens.";
   }
   return;
 }
-function validateDomain2(value) {
-  if (value.length > 80 || !/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(value)) {
+function validateDomain(value) {
+  if (value.length > 80 || !DOMAIN_RE.test(value)) {
     return "Enter a lowercase hostname such as api.example.com, without a protocol or path.";
   }
   return;
 }
-function validateDeploymentSelection2(selection) {
-  if (!storageProvidersByCloud2[selection.cloud].includes(selection.storageProvider)) {
+function validateDeploymentSelection(selection) {
+  if (!storageProvidersByCloud[selection.cloud].includes(selection.storageProvider)) {
     throw new Error(`${selection.storageProvider} storage is not supported for ${selection.cloud} deployments.`);
   }
-  const environmentError = validateDeploymentEnvironment2(selection.environment);
+  const environmentError = validateDeploymentEnvironment(selection.environment);
   if (environmentError)
     throw new Error(environmentError);
-  const regionError = validateRegion2(selection.region);
+  const regionError = validateRegion(selection.region);
   if (regionError)
     throw new Error(regionError);
-  const apiError = validateDomain2(selection.apiDomain);
+  const apiError = validateDomain(selection.apiDomain);
   if (apiError)
     throw new Error(`API domain: ${apiError}`);
-  const frontendError = validateDomain2(selection.frontendDomain);
+  const frontendError = validateDomain(selection.frontendDomain);
   if (frontendError)
     throw new Error(`Frontend domain: ${frontendError}`);
   if (selection.apiDomain === selection.frontendDomain) {
@@ -2789,8 +3037,8 @@ function validateDeploymentSelection2(selection) {
     throw new Error("API and frontend domains must be sibling hosts under the same site.");
   }
 }
-function createDeploymentConfig2(projectName, selection) {
-  validateDeploymentSelection2(selection);
+function createDeploymentConfig(projectName, selection) {
+  validateDeploymentSelection(selection);
   return {
     schema_version: 2,
     cloud: selection.cloud,
@@ -2805,7 +3053,7 @@ function createDeploymentConfig2(projectName, selection) {
     ha_enabled: selection.haEnabled
   };
 }
-function deploymentReadme2(config) {
+function deploymentReadme(config) {
   const identity = config.cloud === "aws" ? "`AWS_ROLE_ARN` secret" : config.cloud === "gcp" ? "`GCP_WORKLOAD_IDENTITY_PROVIDER` and `GCP_SERVICE_ACCOUNT` secrets" : "`AZURE_CLIENT_ID`, `AZURE_TENANT_ID`, and `AZURE_SUBSCRIPTION_ID` secrets";
   const providerInputs = config.cloud === "aws" ? "Route 53 zone or certificate identifiers and runtime Secrets Manager ARNs" : config.cloud === "gcp" ? "GCP project, Cloud DNS zone, and runtime Secret Manager names" : "Azure DNS zone ID and runtime Key Vault secret identifiers";
   const storageSetup = config.storage_provider === "r2" ? `Create private staging and public Cloudflare R2 buckets, then store the required storage
@@ -2853,28 +3101,28 @@ The provider lock is deliberate. Restore the deployment directories from a fresh
 before changing cloud providers.
 `;
 }
-async function removeIfPresent2(target) {
-  if (!await stat3(target).catch(() => {
+async function removeIfPresent(target) {
+  if (!await stat2(target).catch(() => {
     return;
   }))
     return false;
-  await rm2(target, { recursive: true, force: true });
+  await rm(target, { recursive: true, force: true });
   return true;
 }
-async function applyDeploymentSelection2(repositoryRoot, projectName, selection) {
-  const config = createDeploymentConfig2(projectName, selection);
-  const configPath = join5(repositoryRoot, "deployment/config.json");
-  if (await stat3(configPath).catch(() => {
+async function applyDeploymentSelection(repositoryRoot, projectName, selection) {
+  const config = createDeploymentConfig(projectName, selection);
+  const configPath = join3(repositoryRoot, "deployment/config.json");
+  if (await stat2(configPath).catch(() => {
     return;
   })) {
     throw new Error("Deployment is already locked. Restore a fresh release to change providers.");
   }
-  await mkdir3(join5(repositoryRoot, "deployment"), { recursive: true });
-  await writeFile3(configPath, `${JSON.stringify(config, null, 2)}
+  await mkdir2(join3(repositoryRoot, "deployment"), { recursive: true });
+  await writeFile2(configPath, `${JSON.stringify(config, null, 2)}
 `);
-  await writeFile3(join5(repositoryRoot, "deployment/README.md"), deploymentReadme2(config));
+  await writeFile2(join3(repositoryRoot, "deployment/README.md"), deploymentReadme(config));
   const removed = [];
-  for (const cloud of deploymentClouds2) {
+  for (const cloud of deploymentClouds) {
     if (cloud === selection.cloud)
       continue;
     for (const relativePath of [
@@ -2884,7 +3132,7 @@ async function applyDeploymentSelection2(repositoryRoot, projectName, selection)
       `scripts/deploy/release-${cloud}.sh`,
       `scripts/deploy/frontend-${cloud}.sh`
     ]) {
-      if (await removeIfPresent2(join5(repositoryRoot, relativePath)))
+      if (await removeIfPresent(join3(repositoryRoot, relativePath)))
         removed.push(relativePath);
     }
   }
@@ -2900,534 +3148,681 @@ async function applyDeploymentSelection2(repositoryRoot, projectName, selection)
   for (const adapter of adapters) {
     if (adapter.target === selectedAdapter)
       continue;
-    if (await removeIfPresent2(join5(repositoryRoot, adapter.path)))
+    if (await removeIfPresent(join3(repositoryRoot, adapter.path)))
       removed.push(adapter.path);
   }
   if (selection.frontendTarget !== "native") {
     const nativeScript = `scripts/deploy/frontend-${selection.cloud}.sh`;
-    if (await removeIfPresent2(join5(repositoryRoot, nativeScript)))
+    if (await removeIfPresent(join3(repositoryRoot, nativeScript)))
       removed.push(nativeScript);
   }
   return removed;
 }
 
-// src/scaffold.ts
-import { execFile } from "node:child_process";
-import { createHash } from "node:crypto";
-import { cp, lstat, mkdir as mkdir4, mkdtemp, readFile as readFile5, readdir, rm as rm4, stat as stat4, writeFile as writeFile4 } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { basename, dirname as dirname2, join as join7, relative, resolve as resolve3 } from "node:path";
-import { promisify } from "node:util";
-
-// src/delivery.ts
-import { createWriteStream } from "node:fs";
-import { rm as rm3 } from "node:fs/promises";
-import { join as join6 } from "node:path";
-import { Readable, Transform } from "node:stream";
-import { pipeline } from "node:stream/promises";
-var RELEASE_TAG_PATTERN2 = /^v\d+\.\d+\.\d+(?:-rc\.\d+)?$/;
-var INDEX_TIMEOUT_MS = 15000;
-var DOWNLOAD_TIMEOUT_MS = 300000;
-function deliveryBaseUrl(environment = process.env) {
-  const configured = environment[DELIVERY_URL_VARIABLE]?.trim();
-  return (configured || DELIVERY_BASE_URL).replace(/\/+$/, "");
+// src/deployment-prompts.ts
+class DeploymentPromptCancelled extends Error {
+}
+async function unwrap(value) {
+  if (isCancel(value)) {
+    cancel2("Deployment configuration was not changed.");
+    throw new DeploymentPromptCancelled;
+  }
+  return value;
 }
-function releaseAssetNames(releaseTag) {
-  const artifact = `foundation-source-${releaseTag}.tar.gz`;
+async function collectDeploymentSelection(defaults = {}, nonInteractive = false) {
+  if (nonInteractive) {
+    if (!defaults.cloud || !defaults.apiDomain || !defaults.frontendDomain) {
+      throw new Error("Non-interactive deployment setup requires --cloud, --api-domain, and --frontend-domain.");
+    }
+    return {
+      cloud: defaults.cloud,
+      storageProvider: defaults.storageProvider ?? defaultStorageProviders[defaults.cloud],
+      frontendTarget: defaults.frontendTarget ?? "native",
+      environment: defaults.environment ?? "production",
+      region: defaults.region ?? defaultRegions[defaults.cloud],
+      apiDomain: defaults.apiDomain,
+      frontendDomain: defaults.frontendDomain,
+      haEnabled: defaults.haEnabled ?? false
+    };
+  }
+  const cloud = defaults.cloud ?? parseDeploymentCloud(await unwrap(await select({
+    message: "Backend cloud",
+    options: [
+      { value: "aws", label: "AWS", hint: "ECS Fargate + RDS PostgreSQL" },
+      { value: "gcp", label: "Google Cloud", hint: "Cloud Run + Cloud SQL" },
+      { value: "azure", label: "Azure", hint: "Container Apps + Flexible Server" }
+    ]
+  })));
+  const frontendTarget = defaults.frontendTarget ?? parseFrontendTarget(await unwrap(await select({
+    message: "Frontend host",
+    options: [
+      { value: "native", label: "Cloud native", hint: "Managed with the backend" },
+      { value: "vercel", label: "Vercel SPA", hint: "Static frontend only" },
+      {
+        value: "cloudflare",
+        label: "Cloudflare static assets",
+        hint: "No API Worker"
+      }
+    ]
+  })));
+  const storageProvider = defaults.storageProvider ?? (storageProvidersByCloud[cloud].length === 1 ? storageProvidersByCloud[cloud][0] ?? defaultStorageProviders[cloud] : parseStorageProvider(await unwrap(await select({
+    message: "Object storage",
+    options: storageProvidersByCloud[cloud].map((provider) => ({
+      value: provider,
+      label: provider === "s3" ? "Amazon S3" : provider === "gcs" ? "Google Cloud Storage" : "Cloudflare R2",
+      hint: provider === defaultStorageProviders[cloud] ? "Cloud-native default" : ""
+    }))
+  }))));
+  const environment = defaults.environment ?? await unwrap(await text2({
+    message: "Deployment environment",
+    placeholder: "production",
+    defaultValue: "production",
+    validate: (value) => validateDeploymentEnvironment(value || "production")
+  }));
+  const region = defaults.region ?? await unwrap(await text2({
+    message: `${cloud.toUpperCase()} region`,
+    placeholder: defaultRegions[cloud],
+    defaultValue: defaultRegions[cloud],
+    validate: (value) => validateRegion(value || defaultRegions[cloud])
+  }));
+  const apiDomain = defaults.apiDomain ?? await unwrap(await text2({
+    message: "Production API domain",
+    placeholder: "api.example.com",
+    validate: (value) => validateDomain(value ?? "")
+  }));
+  const frontendDomain = defaults.frontendDomain ?? await unwrap(await text2({
+    message: "Production frontend domain",
+    placeholder: "app.example.com",
+    validate: (value) => validateDomain(value ?? "")
+  }));
+  const haEnabled = defaults.haEnabled ?? await unwrap(await confirm2({
+    message: "Enable the higher-availability profile?",
+    initialValue: false
+  }));
   return {
-    artifact,
-    checksum: `${artifact}.sha256`,
-    manifest: `foundation-source-${releaseTag}.manifest.json`
+    cloud,
+    storageProvider,
+    frontendTarget,
+    environment,
+    region,
+    apiDomain,
+    frontendDomain,
+    haEnabled
   };
 }
-function describeFailure(status, subject) {
-  if (status === 401) {
-    return "That licence key was not accepted. Copy it exactly from your purchase receipt or the customer portal (polar.sh).";
-  }
-  if (status === 429) {
-    return "Too many download requests for this licence key. Wait a minute and try again.";
-  }
-  if (status === 404)
-    return `${subject} is not available for download.`;
-  if (status >= 500) {
-    return "Source delivery is temporarily unavailable. Wait a few minutes and try again.";
-  }
-  return `Source delivery refused the request (HTTP ${status}).`;
+
+// src/deployment-cli.ts
+function takeValue2(args, index, flag) {
+  const value = args[index + 1];
+  if (!value || value.startsWith("--"))
+    throw new Error(`${flag} requires a value.`);
+  return value;
 }
-async function requestDelivery(url, init, subject) {
-  let response;
-  try {
-    response = await fetch(url, init);
-  } catch {
-    throw new Error("Could not reach source delivery. Check your network connection and try again.");
+function parseDeploymentArguments(argv) {
+  const parsed = { yes: false };
+  for (let index = 0;index < argv.length; index += 1) {
+    const argument = argv[index];
+    if (argument === "--cloud") {
+      parsed.cloud = parseDeploymentCloud(takeValue2(argv, index++, argument));
+    } else if (argument === "--frontend") {
+      parsed.frontendTarget = parseFrontendTarget(takeValue2(argv, index++, argument));
+    } else if (argument === "--storage") {
+      parsed.storageProvider = parseStorageProvider(takeValue2(argv, index++, argument));
+    } else if (argument === "--environment") {
+      parsed.environment = takeValue2(argv, index++, argument);
+    } else if (argument === "--region") {
+      parsed.region = takeValue2(argv, index++, argument);
+    } else if (argument === "--api-domain") {
+      parsed.apiDomain = takeValue2(argv, index++, argument);
+    } else if (argument === "--frontend-domain") {
+      parsed.frontendDomain = takeValue2(argv, index++, argument);
+    } else if (argument === "--ha")
+      parsed.haEnabled = true;
+    else if (argument === "--no-ha")
+      parsed.haEnabled = false;
+    else if (argument === "--yes" || argument === "-y")
+      parsed.yes = true;
+    else
+      throw new Error(`Unknown deployment option: ${argument}`);
   }
-  if (!response.ok)
-    throw new Error(describeFailure(response.status, subject));
-  return response;
+  return parsed;
 }
-async function resolveRelease(licenseKey, baseUrl = deliveryBaseUrl()) {
-  const response = await requestDelivery(`${baseUrl}/v1/releases`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ key: licenseKey }),
-    signal: AbortSignal.timeout(INDEX_TIMEOUT_MS)
-  }, "The release index");
-  let index;
+async function runDeploymentConfigure(argv, productName, repositoryRoot = process.cwd()) {
+  const parsed = parseDeploymentArguments(argv);
+  const root = resolve2(repositoryRoot);
+  const rootPackage = JSON.parse(await readFile3(`${root}/package.json`, "utf8"));
+  if (!rootPackage.name)
+    throw new Error("Root package name is required for deployment setup.");
+  intro2(`${productName} deployment setup`);
   try {
-    index = await response.json();
-  } catch {
-    index = undefined;
-  }
-  if (!index || !RELEASE_TAG_PATTERN2.test(index.latest) || !Array.isArray(index.versions)) {
-    throw new Error(`Source delivery returned an unreadable release index.`);
+    const selection = await collectDeploymentSelection(parsed, parsed.yes);
+    const removed = await applyDeploymentSelection(root, rootPackage.name, selection);
+    log2.success(`${selection.cloud.toUpperCase()} + ${selection.storageProvider} + ${selection.frontendTarget} is locked for ${selection.environment}.`);
+    log2.info(`${removed.length} unused deployment paths removed.`);
+    log2.step("Next");
+    log2.message(`Review deployment/config.json
+Configure the protected GitHub environment
+Dispatch .github/workflows/deploy-cloud.yml`);
+    outro2("Deployment configuration is ready to commit.");
+  } catch (error) {
+    if (error instanceof DeploymentPromptCancelled)
+      return;
+    throw error;
   }
-  return index;
 }
-function readContentLength(response) {
-  const header = response.headers.get("content-length");
-  if (!header)
-    return;
-  const total = Number(header);
-  return Number.isSafeInteger(total) && total > 0 ? total : undefined;
+
+// src/runtime.ts
+import { spawn as spawn2 } from "node:child_process";
+import { accessSync as accessSync2, constants as constants2, realpathSync as realpathSync2 } from "node:fs";
+import { delimiter as delimiter2, join as join4, resolve as resolvePath2 } from "node:path";
+import { fileURLToPath } from "node:url";
+function runCaptured2(command, options) {
+  const [file, ...args] = command;
+  if (!file)
+    throw new Error("runCaptured requires a command");
+  return new Promise((resolve, reject) => {
+    const child = spawn2(file, args, {
+      cwd: options.cwd,
+      env: options.env ?? process.env,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.setEncoding("utf8");
+    child.stderr.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk;
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk;
+    });
+    child.on("error", reject);
+    child.on("close", (code, signal) => {
+      resolve({ exitCode: code ?? (signal ? 1 : 0), stdout, stderr });
+    });
+  });
 }
-function countBytes(total, onBytes) {
-  let received = 0;
-  return new Transform({
-    transform(chunk, _encoding, done) {
-      received += chunk.length;
-      onBytes(received, total);
-      done(null, chunk);
-    }
+function runInherited(command, options) {
+  const [file, ...args] = command;
+  if (!file)
+    throw new Error("runInherited requires a command");
+  return new Promise((resolve, reject) => {
+    const child = spawn2(file, args, {
+      cwd: options.cwd,
+      env: options.env ?? process.env,
+      stdio: "inherit"
+    });
+    child.on("error", reject);
+    child.on("close", (code, signal) => {
+      resolve(code ?? (signal === "SIGINT" ? 130 : 1));
+    });
   });
 }
-async function downloadAsset(licenseKey, releaseTag, assetName, directory, baseUrl = deliveryBaseUrl(), onBytes) {
-  const response = await requestDelivery(`${baseUrl}/v1/source/${encodeURIComponent(releaseTag)}/${encodeURIComponent(assetName)}`, {
-    headers: { authorization: `Bearer ${licenseKey}` },
-    signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS)
-  }, releaseTag);
-  if (!response.body)
-    throw new Error(`Source delivery returned an empty ${assetName}.`);
-  const path = join6(directory, assetName);
-  const source = Readable.fromWeb(response.body);
+function canonicalPath(path) {
+  try {
+    return realpathSync2(path);
+  } catch {
+    return resolvePath2(path);
+  }
+}
+function isEntrypoint(moduleUrl) {
+  const entry = process.argv[1];
+  if (!entry)
+    return false;
   try {
-    if (onBytes) {
-      await pipeline(source, countBytes(readContentLength(response), onBytes), createWriteStream(path));
-    } else {
-      await pipeline(source, createWriteStream(path));
-    }
+    return canonicalPath(fileURLToPath(moduleUrl)) === canonicalPath(entry);
   } catch {
-    await rm3(path, { force: true });
-    throw new Error(`Downloading ${assetName} was interrupted. Try again in a few minutes.`);
+    return false;
   }
-  return path;
 }
 
-// src/core.ts
-import { randomBytes } from "node:crypto";
-import { extname } from "node:path";
-var BRAND_MANIFEST = [
-  { path: "apps/web/src/configs/config.ts", occurrences: 2 },
-  { path: "apps/web/index.html", occurrences: 4 },
-  { path: "apps/web/public/favicon/site.webmanifest", occurrences: 2 },
-  { path: "apps/web/public/offline.html", occurrences: 6 },
-  { path: "apps/docs/lib/shared.ts", occurrences: 1 },
-  { path: "apps/docs/README.md", occurrences: 1 },
-  { path: "README.md", occurrences: 1 },
-  { path: "docs/meta.json", occurrences: 1 },
-  { path: "apps/server/.env.example", occurrences: 1 },
-  { path: "apps/server/src/config/env.ts", occurrences: 2 },
-  { path: "apps/server/src/config/env.test.ts", occurrences: 1 },
-  { path: "packages/email/src/billing-payment-failed.tsx", occurrences: 2 },
-  { path: "packages/email/src/login-email.tsx", occurrences: 3 },
-  { path: "packages/email/src/verify-email.tsx", occurrences: 1 },
-  { path: "packages/email/src/reset-password.tsx", occurrences: 1 },
-  { path: "packages/email/src/security-alert.tsx", occurrences: 1 },
-  { path: "packages/email/src/components/EmailSignature.tsx", occurrences: 1 },
-  { path: "packages/email/src/components/EmailLayout.tsx", occurrences: 1 },
-  { path: "packages/email/src/components/EmailCopyright.tsx", occurrences: 1 },
-  { path: "packages/email/src/welcome-email.tsx", occurrences: 4 },
-  { path: "packages/email/src/billing-payment-successful.tsx", occurrences: 1 },
-  { path: "packages/email/src/billing-subscription-created.tsx", occurrences: 2 },
-  { path: "packages/email/src/billing-subscription-canceled.tsx", occurrences: 2 },
-  { path: "apps/server/email-templates/billing-payment-failed.html", occurrences: 6 },
-  { path: "apps/server/email-templates/billing-payment-successful.html", occurrences: 5 },
-  { path: "apps/server/email-templates/billing-subscription-canceled.html", occurrences: 6 },
-  { path: "apps/server/email-templates/billing-subscription-created.html", occurrences: 6 },
-  { path: "apps/server/email-templates/login-email.html", occurrences: 7 },
-  { path: "apps/server/email-templates/security-alert.html", occurrences: 4 },
-  { path: "apps/server/email-templates/verify-email.html", occurrences: 5 },
-  { path: "apps/server/email-templates/reset-password.html", occurrences: 5 },
-  { path: "apps/server/email-templates/organization-invitation.html", occurrences: 3 },
-  { path: "apps/server/email-templates/welcome-email.html", occurrences: 8 }
-];
-function validateAppName2(value) {
-  if (!value)
-    return "App name is required.";
-  if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(value)) {
-    return "App name must be kebab-case (lowercase letters, numbers, and single hyphens).";
-  }
-  return;
+// src/deployment-prompts.ts
+class DeploymentPromptCancelled2 extends Error {
 }
-function normalizeScope2(value) {
-  const scope = value.startsWith("@") ? value : `@${value}`;
-  if (/\s/.test(scope)) {
-    throw new Error("Use hyphens instead of spaces, for example test-package.");
-  }
-  if (!/^@[a-z0-9][a-z0-9._-]*$/.test(scope)) {
-    throw new Error("Use lowercase letters and numbers, with optional periods, underscores, or hyphens.");
+async function unwrap2(value) {
+  if (isCancel(value)) {
+    cancel2("Deployment configuration was not changed.");
+    throw new DeploymentPromptCancelled2;
   }
-  return scope;
+  return value;
 }
-function validateBrandName2(value) {
-  if (!value.trim())
-    return "Brand name cannot be empty.";
-  if (/\r|\n/.test(value))
-    return "Brand name must fit on one line.";
-  if (value !== value.trim())
-    return "Brand name cannot start or end with whitespace.";
-  if (value.length > 48)
-    return "Brand name must be 48 characters or less.";
-  if (!/^[\p{L}\p{N}](?:[\p{L}\p{N} ._-]*[\p{L}\p{N}])?$/u.test(value)) {
-    return "Brand name may contain letters, numbers, spaces, periods, underscores, and hyphens.";
+async function collectDeploymentSelection2(defaults = {}, nonInteractive = false) {
+  if (nonInteractive) {
+    if (!defaults.cloud || !defaults.apiDomain || !defaults.frontendDomain) {
+      throw new Error("Non-interactive deployment setup requires --cloud, --api-domain, and --frontend-domain.");
+    }
+    return {
+      cloud: defaults.cloud,
+      storageProvider: defaults.storageProvider ?? defaultStorageProviders[defaults.cloud],
+      frontendTarget: defaults.frontendTarget ?? "native",
+      environment: defaults.environment ?? "production",
+      region: defaults.region ?? defaultRegions[defaults.cloud],
+      apiDomain: defaults.apiDomain,
+      frontendDomain: defaults.frontendDomain,
+      haEnabled: defaults.haEnabled ?? false
+    };
   }
-  return;
-}
-function replaceLiteral(content, search, replacement) {
-  if (search === replacement || !content.includes(search))
-    return { content, replacements: 0 };
-  const parts = content.split(search);
-  return { content: parts.join(replacement), replacements: parts.length - 1 };
-}
-function rewriteScopeContent(content, scope, originalScope = DEFAULT_SCOPE) {
-  return replaceLiteral(content, `${originalScope}/`, `${normalizeScope2(scope)}/`);
-}
-function rewriteBrandContent(content, brandName) {
-  const error = validateBrandName2(brandName);
-  if (error)
-    throw new Error(error);
-  const escapedSourceBrand = SOURCE_BRAND_NAME.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const sourceBrandPattern = new RegExp(`\\b${escapedSourceBrand}\\b`, "gi");
-  const matches = content.match(sourceBrandPattern);
-  if (brandName === SOURCE_BRAND_NAME || !matches)
-    return { content, replacements: 0 };
+  const cloud = defaults.cloud ?? parseDeploymentCloud(await unwrap2(await select({
+    message: "Backend cloud",
+    options: [
+      { value: "aws", label: "AWS", hint: "ECS Fargate + RDS PostgreSQL" },
+      { value: "gcp", label: "Google Cloud", hint: "Cloud Run + Cloud SQL" },
+      { value: "azure", label: "Azure", hint: "Container Apps + Flexible Server" }
+    ]
+  })));
+  const frontendTarget = defaults.frontendTarget ?? parseFrontendTarget(await unwrap2(await select({
+    message: "Frontend host",
+    options: [
+      { value: "native", label: "Cloud native", hint: "Managed with the backend" },
+      { value: "vercel", label: "Vercel SPA", hint: "Static frontend only" },
+      {
+        value: "cloudflare",
+        label: "Cloudflare static assets",
+        hint: "No API Worker"
+      }
+    ]
+  })));
+  const storageProvider = defaults.storageProvider ?? (storageProvidersByCloud[cloud].length === 1 ? storageProvidersByCloud[cloud][0] ?? defaultStorageProviders[cloud] : parseStorageProvider(await unwrap2(await select({
+    message: "Object storage",
+    options: storageProvidersByCloud[cloud].map((provider) => ({
+      value: provider,
+      label: provider === "s3" ? "Amazon S3" : provider === "gcs" ? "Google Cloud Storage" : "Cloudflare R2",
+      hint: provider === defaultStorageProviders[cloud] ? "Cloud-native default" : ""
+    }))
+  }))));
+  const environment = defaults.environment ?? await unwrap2(await text2({
+    message: "Deployment environment",
+    placeholder: "production",
+    defaultValue: "production",
+    validate: (value) => validateDeploymentEnvironment(value || "production")
+  }));
+  const region = defaults.region ?? await unwrap2(await text2({
+    message: `${cloud.toUpperCase()} region`,
+    placeholder: defaultRegions[cloud],
+    defaultValue: defaultRegions[cloud],
+    validate: (value) => validateRegion(value || defaultRegions[cloud])
+  }));
+  const apiDomain = defaults.apiDomain ?? await unwrap2(await text2({
+    message: "Production API domain",
+    placeholder: "api.example.com",
+    validate: (value) => validateDomain(value ?? "")
+  }));
+  const frontendDomain = defaults.frontendDomain ?? await unwrap2(await text2({
+    message: "Production frontend domain",
+    placeholder: "app.example.com",
+    validate: (value) => validateDomain(value ?? "")
+  }));
+  const haEnabled = defaults.haEnabled ?? await unwrap2(await confirm2({
+    message: "Enable the higher-availability profile?",
+    initialValue: false
+  }));
   return {
-    content: content.replace(sourceBrandPattern, () => brandName),
-    replacements: matches.length
+    cloud,
+    storageProvider,
+    frontendTarget,
+    environment,
+    region,
+    apiDomain,
+    frontendDomain,
+    haEnabled
   };
 }
-function formatRewrittenPackageJson(content) {
-  const parsed = JSON.parse(content);
-  for (const key of [
-    "dependencies",
-    "devDependencies",
-    "optionalDependencies",
-    "peerDependencies"
-  ]) {
-    const values = parsed[key];
-    if (values && typeof values === "object" && !Array.isArray(values)) {
-      parsed[key] = Object.fromEntries(Object.entries(values).sort(([left], [right]) => left.localeCompare(right)));
-    }
-  }
-  return `${JSON.stringify(parsed, null, 2)}
-`;
-}
-function wrapLongNamedImports(content, width = 100) {
-  return content.split(`
-`).map((line) => {
-    if (line.length <= width)
-      return line;
-    const match = line.match(/^(\s*)(import(?:\s+type)?\s+)\{([^}]+)\}(\s+from\s+.+)$/);
-    if (!match)
-      return line;
-    const [, indentation = "", prefix = "", names = "", suffix = ""] = match;
-    const members = names.split(",").map((name) => name.trim());
-    return [
-      `${indentation}${prefix}{`,
-      ...members.map((name) => `${indentation}  ${name},`),
-      `${indentation}}${suffix}`
-    ].join(`
-`);
-  }).join(`
-`);
-}
-function wrapBrandedJsxText(content, brandName, width = 100) {
-  const lines = content.split(`
-`);
-  const output = [];
-  for (let index = 0;index < lines.length; ) {
-    const line = lines[index] ?? "";
-    const text = line.trim();
-    if (!text || text.startsWith("<") || text.startsWith("{") || text.startsWith("//") || text.includes("<") || text.includes(">")) {
-      output.push(line);
-      index += 1;
-      continue;
-    }
-    const paragraph = [];
-    const originalParagraph = [];
-    const indentation = line.slice(0, line.length - line.trimStart().length);
-    while (index < lines.length) {
-      const candidate = lines[index] ?? "";
-      const candidateText = candidate.trim();
-      if (!candidateText || candidateText.startsWith("<") || candidateText.startsWith("{"))
-        break;
-      paragraph.push(candidateText);
-      originalParagraph.push(candidate);
-      index += 1;
-    }
-    const joined = paragraph.join(" ");
-    if (!joined.includes(brandName)) {
-      output.push(...originalParagraph);
-      continue;
-    }
-    let current = indentation;
-    for (const word of joined.split(/\s+/)) {
-      const candidate = current === indentation ? `${indentation}${word}` : `${current} ${word}`;
-      if (candidate.length > width && current !== indentation) {
-        output.push(current);
-        current = `${indentation}${word}`;
-      } else
-        current = candidate;
-    }
-    output.push(current);
+
+// src/deployment.ts
+import { mkdir as mkdir3, readFile as readFile4, rm as rm2, stat as stat3, writeFile as writeFile3 } from "node:fs/promises";
+import { join as join5 } from "node:path";
+var DEPLOYMENT_ENVIRONMENT_RE2 = /^[a-z][a-z0-9-]{1,30}$/;
+var REGION_RE2 = /^[a-z0-9][a-z0-9-]{1,31}$/;
+var DOMAIN_RE2 = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+var deploymentClouds2 = ["aws", "gcp", "azure"];
+var frontendTargets2 = ["native", "vercel", "cloudflare"];
+var storageProviders2 = ["r2", "s3", "gcs"];
+var storageProvidersByCloud2 = {
+  aws: ["s3", "r2"],
+  gcp: ["gcs", "r2"],
+  azure: ["r2"]
+};
+function isDeploymentCloud2(value) {
+  return deploymentClouds2.some((cloud) => cloud === value);
+}
+function isFrontendTarget2(value) {
+  return frontendTargets2.some((target) => target === value);
+}
+function isStorageProvider2(value) {
+  return storageProviders2.some((provider) => provider === value);
+}
+function parseDeploymentCloud2(value) {
+  if (!isDeploymentCloud2(value))
+    throw new Error("Cloud must be aws, gcp, or azure.");
+  return value;
+}
+function parseFrontendTarget2(value) {
+  if (!isFrontendTarget2(value)) {
+    throw new Error("Frontend target must be native, vercel, or cloudflare.");
   }
-  return output.join(`
-`);
+  return value;
 }
-function rewriteRootPackageName(content, appName) {
-  const error = validateAppName2(appName);
-  if (error)
-    throw new Error(error);
-  const parsed = JSON.parse(content);
-  if (parsed.name === appName)
-    return { content, replacements: 0 };
-  parsed.name = appName;
-  return { content: `${JSON.stringify(parsed, null, 2)}
-`, replacements: 1 };
+function parseStorageProvider2(value) {
+  if (!isStorageProvider2(value))
+    throw new Error("Storage provider must be r2, s3, or gcs.");
+  return value;
 }
-var WORKER_NAME_DECLARATION = /^name = "[^"]*"$/m;
-function rewriteWorkerName(content, appName) {
-  const error = validateAppName2(appName);
-  if (error)
-    throw new Error(error);
-  const declaration = content.match(WORKER_NAME_DECLARATION)?.[0];
-  if (!declaration) {
-    throw new Error("Cloudflare Worker configuration is missing a name declaration.");
+function validateDeploymentEnvironment2(value) {
+  if (!DEPLOYMENT_ENVIRONMENT_RE2.test(value)) {
+    return "Environment must use 2-31 lowercase letters, numbers, or hyphens.";
   }
-  const replacement = `name = "${appName}"`;
-  if (declaration === replacement)
-    return { content, replacements: 0 };
-  return { content: content.replace(WORKER_NAME_DECLARATION, replacement), replacements: 1 };
+  return;
 }
-function replaceMarkdownSection(content, heading, replacement) {
-  const marker = `## ${heading}
-`;
-  const start = content.indexOf(marker);
-  if (start === -1)
-    throw new Error(`Agent instructions are missing the "${heading}" section.`);
-  const end = content.indexOf(`
-## `, start + marker.length);
-  if (end === -1)
-    throw new Error(`Agent instructions cannot delimit the "${heading}" section.`);
-  const sections = [content.slice(0, start).trim(), replacement.trim(), content.slice(end).trim()];
-  return `${sections.filter(Boolean).join(`
-
-`)}
-`;
+function validateRegion2(value) {
+  if (!REGION_RE2.test(value)) {
+    return "Region must use 2-32 lowercase letters, numbers, or hyphens.";
+  }
+  return;
 }
-function removeParagraphContaining(content, fragment) {
-  const paragraphs = content.split(`
+function validateDomain2(value) {
+  if (value.length > 80 || !DOMAIN_RE2.test(value)) {
+    return "Enter a lowercase hostname such as api.example.com, without a protocol or path.";
+  }
+  return;
+}
+function validateDeploymentSelection2(selection) {
+  if (!storageProvidersByCloud2[selection.cloud].includes(selection.storageProvider)) {
+    throw new Error(`${selection.storageProvider} storage is not supported for ${selection.cloud} deployments.`);
+  }
+  const environmentError = validateDeploymentEnvironment2(selection.environment);
+  if (environmentError)
+    throw new Error(environmentError);
+  const regionError = validateRegion2(selection.region);
+  if (regionError)
+    throw new Error(regionError);
+  const apiError = validateDomain2(selection.apiDomain);
+  if (apiError)
+    throw new Error(`API domain: ${apiError}`);
+  const frontendError = validateDomain2(selection.frontendDomain);
+  if (frontendError)
+    throw new Error(`Frontend domain: ${frontendError}`);
+  if (selection.apiDomain === selection.frontendDomain) {
+    throw new Error("API and frontend domains must be different hostnames.");
+  }
+  const apiSite = selection.apiDomain.split(".").slice(1).join(".");
+  const frontendSite = selection.frontendDomain.split(".").slice(1).join(".");
+  if (apiSite !== frontendSite) {
+    throw new Error("API and frontend domains must be sibling hosts under the same site.");
+  }
+}
+function createDeploymentConfig2(projectName, selection) {
+  validateDeploymentSelection2(selection);
+  return {
+    schema_version: 2,
+    cloud: selection.cloud,
+    storage_provider: selection.storageProvider,
+    project_name: projectName,
+    environment: selection.environment,
+    region: selection.region,
+    frontend_target: selection.frontendTarget,
+    external_frontend_origin: selection.frontendTarget === "native" ? null : `https://${selection.frontendDomain}`,
+    api_domain: selection.apiDomain,
+    frontend_domain: selection.frontendDomain,
+    ha_enabled: selection.haEnabled
+  };
+}
+function deploymentReadme2(config) {
+  const identity = config.cloud === "aws" ? "`AWS_ROLE_ARN` secret" : config.cloud === "gcp" ? "`GCP_WORKLOAD_IDENTITY_PROVIDER` and `GCP_SERVICE_ACCOUNT` secrets" : "`AZURE_CLIENT_ID`, `AZURE_TENANT_ID`, and `AZURE_SUBSCRIPTION_ID` secrets";
+  const providerInputs = config.cloud === "aws" ? "Route 53 zone or certificate identifiers and runtime Secrets Manager ARNs" : config.cloud === "gcp" ? "GCP project, Cloud DNS zone, and runtime Secret Manager names" : "Azure DNS zone ID and runtime Key Vault secret identifiers";
+  const storageSetup = config.storage_provider === "r2" ? `Create private staging and public Cloudflare R2 buckets, then store the required storage
+   variables in the runtime secret container.` : `${config.storage_provider.toUpperCase()} application buckets, lifecycle policy, CORS, public access, and workload permissions are
+   managed by the selected OpenTofu root.`;
+  return `# Deployment setup
 
-`);
-  const index = paragraphs.findIndex((paragraph) => paragraph.includes(fragment));
-  if (index === -1)
-    throw new Error(`Agent instructions are missing expected text: ${fragment}`);
-  paragraphs.splice(index, 1);
-  return paragraphs.join(`
+The deployment target is locked:
 
-`);
+- backend: **${config.cloud.toUpperCase()}**;
+- storage: **${config.storage_provider}**;
+- frontend: **${config.frontend_target}**;
+- environment: **${config.environment}**.
+
+## Protected GitHub environment
+
+Create a GitHub environment named \`${config.environment}\` and configure:
+
+- ${identity};
+- a \`BACKEND_HCL\` secret containing the selected remote-state backend configuration;
+- a \`TFVARS_JSON\` secret containing only:
+  - ${providerInputs};
+- \`VITE_TERMS_URL\` and \`VITE_PRIVACY_URL\`, plus \`VITE_MARKETING_URL\` when the product has a
+  public marketing site.
+
+## Cloud preparation
+
+1. Run \`infra/bootstrap/${config.cloud}\` once with an administrator identity.
+2. Configure OIDC trust for this repository and the \`${config.environment}\` GitHub environment.
+3. Create the DNS zone or supply the existing zone identifier required by the selected root.
+4. ${storageSetup}
+5. Create application secret entries for Better Auth and enabled email, billing, monitoring, OAuth,
+   and credential-based providers.
+6. Put only secret identifiers in \`TFVARS_JSON\`; write secret values directly through the cloud
+   provider.
+7. Dispatch \`.github/workflows/deploy-cloud.yml\` with:
+   - cloud: \`${config.cloud}\`;
+   - environment: \`${config.environment}\`;
+   - frontend: \`${config.frontend_target}\`.
+
+The workflow creates the registry first, pushes an immutable image, provisions the API with public
+traffic disabled, runs migrations, and admits traffic only after migration succeeds.
+
+The provider lock is deliberate. Restore the deployment directories from a fresh licensed release
+before changing cloud providers.
+`;
 }
-function rewriteBuyerAgentInstructions(content) {
-  if (content.includes("Audit and remediate the complete buyer-owned SaaS application") && !/internal\/|landing\/|seller-surface|studio-owned/i.test(content)) {
-    return content;
+async function removeIfPresent2(target) {
+  if (!await stat3(target).catch(() => {
+    return;
+  }))
+    return false;
+  await rm2(target, { recursive: true, force: true });
+  return true;
+}
+async function applyDeploymentSelection2(repositoryRoot, projectName, selection) {
+  const config = createDeploymentConfig2(projectName, selection);
+  const configPath = join5(repositoryRoot, "deployment/config.json");
+  if (await stat3(configPath).catch(() => {
+    return;
+  })) {
+    throw new Error("Deployment is already locked. Restore a fresh release to change providers.");
   }
-  let rewritten = removeParagraphContaining(content, "`internal/` holds every seller-only surface");
-  rewritten = removeParagraphContaining(rewritten, "The root pnpm workspace includes only `apps/*` and `packages/*`.");
-  rewritten = replaceMarkdownSection(rewritten, "Product security audit scope", `## Product security audit scope
-
-Audit and remediate the complete buyer-owned SaaS application: \`apps/\`, \`packages/\`, buyer
-documentation, and the configuration and deployment files that ship with it. \`agent-tooling/\` and
-\`packages/agent-context\` are optional, buyer-distributed development tooling; review them when agent
-behavior or distribution changes, but do not treat them as application runtime code. Do not vendor
-machine-local installed copies, compatibility symlinks, client configuration, or skill lock records
-into this repository.
+  await mkdir3(join5(repositoryRoot, "deployment"), { recursive: true });
+  await writeFile3(configPath, `${JSON.stringify(config, null, 2)}
 `);
-  rewritten = replaceMarkdownSection(rewritten, "Landing boundary", "");
-  rewritten = rewritten.split(`
-`).filter((line) => !line.includes("| `internal`")).join(`
-`).replace("real env files, `internal/`, or\n  `bun.lock`", "real env files, or `bun.lock`");
-  if (/internal\/|landing\/|seller-surface|studio-owned/i.test(rewritten)) {
-    throw new Error("Buyer agent instructions still contain seller-only guidance.");
+  await writeFile3(join5(repositoryRoot, "deployment/README.md"), deploymentReadme2(config));
+  const removed = [];
+  for (const cloud of deploymentClouds2) {
+    if (cloud === selection.cloud)
+      continue;
+    for (const relativePath of [
+      `infra/bootstrap/${cloud}`,
+      `infra/modules/${cloud}`,
+      `infra/roots/${cloud}`,
+      `scripts/deploy/release-${cloud}.sh`,
+      `scripts/deploy/frontend-${cloud}.sh`
+    ]) {
+      if (await removeIfPresent2(join5(repositoryRoot, relativePath)))
+        removed.push(relativePath);
+    }
   }
-  return rewritten;
-}
-var BUYER_README_HEADING = "## Create your product";
-function stripDistributionReadmeBootstrap(content) {
-  if (!content.includes(BUYER_README_HEADING))
-    return content;
-  return replaceMarkdownSection(content, "Create your product", "");
-}
-var REQUIRED_BUYER_CLI_CONSTANTS = ["CLI_NAME", "CLI_PACKAGE_NAME", "DEFAULT_SCOPE"];
-function rewriteBuyerCliConstants(content, scope, brandName) {
-  const buyerVariablePrefix = BUYER_CLI_NAME.toUpperCase().replaceAll("-", "_");
-  const buyerConstants = [
-    ["CLI_NAME", BUYER_CLI_NAME],
-    ["CLI_PACKAGE_NAME", BUYER_CLI_PACKAGE_NAME],
-    ["DEFAULT_SCOPE", normalizeScope2(scope)],
-    ["SOURCE_BRAND_NAME", brandName],
-    ["TEMPLATE_REPOSITORY", "OWNER/REPOSITORY"],
-    ["DELIVERY_BASE_URL", "https://releases.example.com"],
-    ["DOCS_BASE_URL", "https://docs.example.com"],
-    ["DELIVERY_URL_VARIABLE", `${buyerVariablePrefix}_DELIVERY_URL`],
-    ["LICENSE_KEY_VARIABLE", `${buyerVariablePrefix}_LICENSE_KEY`],
-    ["LICENSE_KEY_PREFIX", "LICENSE-"]
+  const adapters = [
+    { target: "vercel", path: "apps/web/vercel.json" },
+    { target: "cloudflare", path: "apps/web/wrangler.toml" },
+    {
+      target: "azure-native",
+      path: "apps/web/public/staticwebapp.config.json"
+    }
   ];
-  let rewritten = content;
-  for (const [name, value] of buyerConstants) {
-    const declaration = new RegExp(`^export const ${name} = '[^']*'$`, "m");
-    if (!declaration.test(rewritten)) {
-      if (REQUIRED_BUYER_CLI_CONSTANTS.includes(name)) {
-        throw new Error(`Source CLI constants are missing ${name}.`);
-      }
+  const selectedAdapter = selection.frontendTarget === "native" ? selection.cloud === "azure" ? "azure-native" : undefined : selection.frontendTarget;
+  for (const adapter of adapters) {
+    if (adapter.target === selectedAdapter)
       continue;
-    }
-    rewritten = rewritten.replace(declaration, `export const ${name} = '${value}'`);
+    if (await removeIfPresent2(join5(repositoryRoot, adapter.path)))
+      removed.push(adapter.path);
   }
-  const leaked = [
-    CLI_PACKAGE_NAME,
-    SOURCE_BRAND_NAME,
-    DELIVERY_BASE_URL,
-    DOCS_BASE_URL,
-    DELIVERY_URL_VARIABLE,
-    LICENSE_KEY_VARIABLE2,
-    LICENSE_KEY_PREFIX
-  ].filter((identity) => rewritten.includes(identity));
-  if (leaked.length > 0) {
-    throw new Error(`Buyer CLI constants still name the source product: ${leaked.join(", ")}`);
+  if (selection.frontendTarget !== "native") {
+    const nativeScript = `scripts/deploy/frontend-${selection.cloud}.sh`;
+    if (await removeIfPresent2(join5(repositoryRoot, nativeScript)))
+      removed.push(nativeScript);
   }
-  return rewritten;
+  return removed;
 }
-var SELLER_ONLY_ROOT_SCRIPTS = [
-  "release:distribute",
-  "release:publish-cli",
-  "release:upload"
-];
-function stripSellerOnlyRootScripts(content) {
-  const manifest = JSON.parse(content);
-  for (const script of SELLER_ONLY_ROOT_SCRIPTS)
-    delete manifest.scripts?.[script];
-  return `${JSON.stringify(manifest, null, 2)}
-`;
+
+// src/scaffold.ts
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import {
+  cp,
+  lstat,
+  mkdir as mkdir4,
+  mkdtemp,
+  readFile as readFile5,
+  readdir,
+  rename as rename2,
+  rm as rm4,
+  stat as stat4,
+  writeFile as writeFile4
+} from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename, dirname as dirname2, join as join7, relative, resolve as resolve3 } from "node:path";
+import { promisify } from "node:util";
+
+// src/delivery.ts
+import { createWriteStream } from "node:fs";
+import { rm as rm3 } from "node:fs/promises";
+import { join as join6 } from "node:path";
+import { Readable, Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
+var TRAILING_SLASHES_RE = /\/+$/;
+var RELEASE_TAG_PATTERN2 = /^v\d+\.\d+\.\d+(?:-rc\.\d+)?$/;
+var INDEX_TIMEOUT_MS = 15000;
+var DOWNLOAD_TIMEOUT_MS = 300000;
+function deliveryBaseUrl(environment = process.env) {
+  const configured = environment[DELIVERY_URL_VARIABLE]?.trim();
+  return (configured || DELIVERY_BASE_URL).replace(TRAILING_SLASHES_RE, "");
 }
-function rewriteBuyerClaudeInstructions(content) {
-  if (!/internal\/|landing\/|studio-owned/i.test(content))
-    return content;
-  const rewritten = removeParagraphContaining(content, "`internal/landing/AGENTS.md`");
-  if (/internal\/|landing\/|studio-owned/i.test(rewritten)) {
-    throw new Error("Buyer Claude instructions still contain seller-only guidance.");
-  }
-  return rewritten;
+function entitledEditions(index) {
+  if (!Array.isArray(index.editions))
+    return [];
+  return index.editions.filter((edition) => typeof edition === "string" && edition.trim());
 }
-function rewriteBuyerSetupInstructions(content) {
-  if (!content.includes("## Create a product repository"))
-    return content;
-  const rewritten = replaceMarkdownSection(content, "Create a product repository", "");
-  const escapedCliName = CLI_NAME2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  if (new RegExp(`pnpm dlx ${escapedCliName}|bunx ${escapedCliName}|${escapedCliName} repository`, "i").test(rewritten)) {
-    throw new Error("Buyer setup instructions still contain source-delivery guidance.");
+function entitledSelection(index) {
+  const editions = entitledEditions(index);
+  const namesBaseEdition = editions.includes("web") || editions.includes("start");
+  return selectionFromEditions(namesBaseEdition ? editions : ["web", ...editions]);
+}
+
+class EditionNotLicensedError extends Error {
+  constructor(edition) {
+    super(`Your licence does not include the ${edition} edition. Drop --${edition} to continue, or contact support if you purchased it.`);
+    this.name = "EditionNotLicensedError";
   }
-  return rewritten;
 }
-function rewriteBuyerReleaseInstructions(content) {
-  if (!content.includes("## npm bootstrapper"))
-    return content;
-  const rewritten = replaceMarkdownSection(content, "npm bootstrapper", "");
-  const escapedCliName = CLI_NAME2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  if (new RegExp(`${escapedCliName}@\\d|public \`${escapedCliName}\` npm package`, "i").test(rewritten)) {
-    throw new Error("Buyer release instructions still contain vendor bootstrapper guidance.");
+function resolveEdition(edition, request) {
+  if (!request.licensed)
+    return request.requested ?? false;
+  if (request.requested === false)
+    return false;
+  if (request.requested && !request.entitled)
+    throw new EditionNotLicensedError(edition);
+  return request.entitled;
+}
+function releaseAssetNames(releaseTag) {
+  const artifact = `foundation-source-${releaseTag}.tar.gz`;
+  return {
+    artifact,
+    checksum: `${artifact}.sha256`,
+    manifest: `foundation-source-${releaseTag}.manifest.json`
+  };
+}
+function describeFailure(status, subject) {
+  if (status === 401) {
+    return "That licence key was not accepted. Copy it exactly from your purchase receipt or the customer portal (polar.sh).";
   }
-  return rewritten;
+  if (status === 429) {
+    return "Too many download requests for this licence key. Wait a minute and try again.";
+  }
+  if (status === 404)
+    return `${subject} is not available for download.`;
+  if (status >= 500) {
+    return "Source delivery is temporarily unavailable. Wait a few minutes and try again.";
+  }
+  return `Source delivery refused the request (HTTP ${status}).`;
 }
-function generateServerEnv(example, secret = randomBytes(32).toString("hex"), databasePort = 5432) {
-  if (!/^[a-f0-9]{64}$/.test(secret)) {
-    throw new Error("Better Auth secret must be 32 bytes encoded as hex.");
+async function requestDelivery(url, init, subject) {
+  let response;
+  try {
+    response = await fetch(url, init);
+  } catch {
+    throw new Error("Could not reach source delivery. Check your network connection and try again.");
   }
-  if (!/^DATABASE_URL=.*$/m.test(example) || !/^BETTER_AUTH_SECRET=.*$/m.test(example)) {
-    throw new Error("Server .env.example must contain DATABASE_URL and BETTER_AUTH_SECRET entries.");
+  if (!response.ok)
+    throw new Error(describeFailure(response.status, subject));
+  return response;
+}
+async function resolveRelease(licenseKey, baseUrl = deliveryBaseUrl()) {
+  const response = await requestDelivery(`${baseUrl}/v1/releases`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ key: licenseKey }),
+    signal: AbortSignal.timeout(INDEX_TIMEOUT_MS)
+  }, "The release index");
+  let index;
+  try {
+    index = await response.json();
+  } catch {
+    index = undefined;
   }
-  if (!Number.isInteger(databasePort) || databasePort < 1 || databasePort > 65535) {
-    throw new Error("Database port must be an integer between 1 and 65535.");
+  if (!index || !RELEASE_TAG_PATTERN2.test(index.latest) || !Array.isArray(index.versions)) {
+    throw new Error(`Source delivery returned an unreadable release index.`);
   }
-  const databaseUrl = `postgresql://app:app@localhost:${databasePort}/app?sslmode=disable`;
-  return example.replace(/^DATABASE_URL=.*$/m, `DATABASE_URL=${databaseUrl}`).replace(/^BETTER_AUTH_SECRET=.*$/m, `BETTER_AUTH_SECRET=${secret}`);
+  return index;
 }
-var SCOPE_EXTENSIONS2 = new Set([".json", ".jsonc", ".md", ".ts", ".tsx", ".yaml", ".yml"]);
-function isScopeRewriteFile(path) {
-  return SCOPE_EXTENSIONS2.has(extname(path)) || path.replaceAll("\\", "/").endsWith("/.vite-hooks/pre-commit");
+function readContentLength(response) {
+  const header = response.headers.get("content-length");
+  if (!header)
+    return;
+  const total = Number(header);
+  return Number.isSafeInteger(total) && total > 0 ? total : undefined;
 }
-function isTemplatePathExcluded(relativePath) {
-  const normalized = relativePath.replaceAll("\\", "/");
-  const parts = normalized.split("/").filter(Boolean);
-  const basename = parts.at(-1) ?? "";
-  if (parts.includes(".git") || parts.includes(".worktrees") || parts.includes("node_modules"))
-    return true;
-  if (parts.includes(".terraform"))
-    return true;
-  if (parts.includes(".impeccable"))
-    return true;
-  if (parts.includes(".agent-evals") || parts.includes(".agents") || parts.includes(".claude"))
-    return true;
-  if (normalized === "skills-lock.json")
-    return true;
-  if (normalized === "internal" || normalized.startsWith("internal/"))
-    return true;
-  if (normalized === "marketing" || normalized.startsWith("marketing/"))
-    return true;
-  if (normalized === ".github/workflows/internal-commercial.yml")
-    return true;
-  if (normalized === "apps/worker" || normalized.startsWith("apps/worker/"))
-    return true;
-  if (parts.includes("dist") || parts.includes("out"))
-    return true;
-  if (parts.includes(".next") || parts.includes(".source") || parts.includes(".turbo"))
-    return true;
-  if (normalized === "bun.lock")
-    return true;
-  if (normalized === ".vercelignore")
-    return true;
-  if (basename.endsWith(".tfvars") || basename === "backend.hcl")
-    return true;
-  if (basename.includes(".tfstate") || /^gha-creds-.*\.json$/.test(basename))
-    return true;
-  if (normalized === "PLAN.md" || normalized === "comments.md")
-    return true;
-  if (normalized === "packages/create-app/src/cli-brand-contract.test.ts")
-    return true;
-  if (normalized === "packages/create-app/src/commercial-contract.test.ts")
-    return true;
-  if (normalized === "packages/create-app/LICENSE")
-    return true;
-  if (normalized === "packages/create-app/README.md")
-    return true;
-  if (normalized === "apps/server/server")
-    return true;
-  if (basename.endsWith(".tsbuildinfo"))
-    return true;
-  if (basename === ".env" || basename.startsWith(".env.") && basename !== ".env.example")
-    return true;
-  return false;
+function countBytes(total, onBytes) {
+  let received = 0;
+  return new Transform({
+    transform(chunk, _encoding, done) {
+      received += chunk.length;
+      onBytes(received, total);
+      done(null, chunk);
+    }
+  });
+}
+async function downloadAsset(licenseKey, releaseTag, assetName, directory, baseUrl = deliveryBaseUrl(), onBytes) {
+  const response = await requestDelivery(`${baseUrl}/v1/source/${encodeURIComponent(releaseTag)}/${encodeURIComponent(assetName)}`, {
+    headers: { authorization: `Bearer ${licenseKey}` },
+    signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS)
+  }, releaseTag);
+  if (!response.body)
+    throw new Error(`Source delivery returned an empty ${assetName}.`);
+  const path = join6(directory, assetName);
+  const source = Readable.fromWeb(response.body);
+  try {
+    if (onBytes) {
+      await pipeline(source, countBytes(readContentLength(response), onBytes), createWriteStream(path));
+    } else {
+      await pipeline(source, createWriteStream(path));
+    }
+  } catch {
+    await rm3(path, { force: true });
+    throw new Error(`Downloading ${assetName} was interrupted. Try again in a few minutes.`);
+  }
+  return path;
 }
 
 // src/scaffold.ts
+var SHA256_CHECKSUM_LINE_RE = /^([a-f0-9]{64})\s+\*?([^\s]+)$/i;
 var execFileAsync = promisify(execFile);
 async function assertEmptyTarget(targetDirectory) {
   try {
@@ -3497,7 +3892,7 @@ async function assertNoSymbolicLinks(directory, root = directory, isIncluded) {
   }
 }
 function verifyReleaseMetadata(checksum, manifest, artifactName, digest, templateRef) {
-  const checksumMatch = checksum.trim().match(/^([a-f0-9]{64})\s+\*?([^\s]+)$/i);
+  const checksumMatch = checksum.trim().match(SHA256_CHECKSUM_LINE_RE);
   if (!checksumMatch || checksumMatch[2] !== artifactName) {
     throw new Error(`${CLI_NAME2} release checksum metadata is malformed.`);
   }
@@ -3508,9 +3903,30 @@ function verifyReleaseMetadata(checksum, manifest, artifactName, digest, templat
     throw new Error(`${CLI_NAME2} release manifest does not match the downloaded source artifact.`);
   }
 }
-async function downloadLicensedTemplate(target, licenseKey, sourceVersion, onDownloadProgress) {
+function chooseEditions(requested, entitled) {
+  const choose = (edition, localDefault) => entitled ? resolveEdition(edition, {
+    requested: requested[edition],
+    entitled: entitled[edition],
+    licensed: true
+  }) : requested[edition] ?? localDefault;
+  const selection = normalizeEditions({
+    web: choose("web", true),
+    mobile: choose("mobile", false),
+    start: choose("start", false)
+  });
+  if (requested.web === false && selection.mobile) {
+    throw new Error("The mobile edition ships with the web foundation it runs on. Drop --no-web, or add --no-mobile.");
+  }
+  if (selectedEditions(selection).length === 0) {
+    throw new Error("Nothing to scaffold: every edition was excluded.");
+  }
+  return selection;
+}
+async function downloadLicensedTemplate(target, licenseKey, requested, sourceVersion, onDownloadProgress) {
   const baseUrl = deliveryBaseUrl();
-  const releaseTag = sourceVersion ?? (await resolveRelease(licenseKey, baseUrl)).latest;
+  const index = await resolveRelease(licenseKey, baseUrl);
+  const selection = chooseEditions(requested, entitledSelection(index));
+  const releaseTag = sourceVersion ?? index.latest;
   const { artifact, checksum: checksumName, manifest: manifestName } = releaseAssetNames(releaseTag);
   const temporaryDirectory = await mkdtemp(join7(tmpdir(), `${CLI_NAME2}-`));
   const extractedPath = join7(temporaryDirectory, "template");
@@ -3526,6 +3942,7 @@ async function downloadLicensedTemplate(target, licenseKey, sourceVersion, onDow
     await mkdir4(extractedPath);
     await execFileAsync("tar", ["-xzf", archivePath, "-C", extractedPath, "--strip-components=1"]);
     await copyLocalTemplate(extractedPath, target);
+    return selection;
   } finally {
     await rm4(temporaryDirectory, { recursive: true, force: true });
   }
@@ -3575,8 +3992,10 @@ async function applyScopeRewrite(target, scope) {
 }
 async function applyBrandRewrite(target, brandName) {
   const report = { files: 0, replacements: 0 };
-  for (const entry of BRAND_MANIFEST) {
+  for (const entry of [...BRAND_MANIFEST, ...START_BRAND_MANIFEST]) {
     const path = join7(target, entry.path);
+    if (!await exists(path))
+      continue;
     const replacements = await rewriteFile(path, (content) => {
       const result = rewriteBrandContent(content, brandName);
       if (result.replacements > 0 && path.endsWith(".tsx")) {
@@ -3590,6 +4009,108 @@ async function applyBrandRewrite(target, brandName) {
   }
   return report;
 }
+async function rewriteJsonFile(path, rewrite) {
+  await writeFile4(path, rewrite(await readFile5(path, "utf8")));
+}
+async function exists(path) {
+  return Boolean(await lstat(path).catch(() => {
+    return;
+  }));
+}
+async function rewriteIfPresent(path, rewrite) {
+  const content = await readFile5(path, "utf8").catch(() => {
+    return;
+  });
+  if (content === undefined)
+    return;
+  const rewritten = rewrite(content);
+  if (rewritten !== content)
+    await writeFile4(path, rewritten);
+}
+async function markdownDocuments(target) {
+  const pages = await readdir(join7(target, "docs"), { recursive: true }).catch(() => []);
+  return [
+    "AGENTS.md",
+    ...pages.filter((page) => page.endsWith(".md")).map((page) => join7("docs", page))
+  ];
+}
+async function applyMobileIdentity(target, appName, brandName, bundleIdentifier, appDomain) {
+  const identity = deriveMobileIdentity(appName, brandName, bundleIdentifier, appDomain);
+  await rewriteJsonFile(join7(target, "apps/mobile/app.json"), (content) => rewriteMobileAppConfig(content, identity));
+  await rewriteFile(join7(target, "apps/server/.env.example"), (content) => rewriteMobileAppScheme(content, identity.scheme));
+}
+async function removeMobileEdition(target) {
+  for (const path of MOBILE_EDITION_PATHS) {
+    await rm4(join7(target, path), { recursive: true, force: true });
+  }
+  await rewriteIfPresent(join7(target, "package.json"), stripMobileRootScripts);
+  await rewriteIfPresent(join7(target, "knip.json"), stripMobileKnipWorkspace);
+  await rewriteIfPresent(join7(target, "docs/meta.json"), stripMobileDocsPage);
+  for (const page of await markdownDocuments(target)) {
+    await rewriteIfPresent(join7(target, page), stripMobileDocsReferences);
+  }
+  await rewriteIfPresent(join7(target, "apps/docs/lib/source.ts"), stripMobileDocsSource);
+  await rewriteIfPresent(join7(target, "pnpm-lock.yaml"), (content) => pruneLockfileImporters(content, ["apps/mobile"]));
+}
+async function removeStartEdition(target) {
+  for (const path of START_EDITION_PATHS) {
+    await rm4(join7(target, path), { recursive: true, force: true });
+  }
+  await rewriteIfPresent(join7(target, "knip.json"), (content) => stripKnipWorkspaces(content, ["apps/start"]));
+  for (const page of await markdownDocuments(target)) {
+    await rewriteIfPresent(join7(target, page), stripStartReferences);
+  }
+  await rewriteIfPresent(join7(target, "pnpm-lock.yaml"), (content) => pruneLockfileImporters(content, ["apps/start"]));
+}
+async function pruneToKeptPaths(target, relativeDirectory, kept, removedWorkspaces) {
+  for (const entry of await readdir(join7(target, relativeDirectory))) {
+    const relativePath = relativeDirectory ? `${relativeDirectory}/${entry}` : entry;
+    if (kept.has(relativePath))
+      continue;
+    if ([...kept].some((path) => path.startsWith(`${relativePath}/`))) {
+      await pruneToKeptPaths(target, relativePath, kept, removedWorkspaces);
+      continue;
+    }
+    if (relativeDirectory === "apps" || relativeDirectory === "packages") {
+      removedWorkspaces.push(relativePath);
+    }
+    await rm4(join7(target, relativePath), { recursive: true, force: true });
+  }
+}
+async function reduceToStartEdition(target) {
+  const overlay = join7(target, START_EDITION_OVERLAY);
+  const overlayPackage = await readFile5(join7(overlay, "package.json"), "utf8");
+  const rootPackage = await readFile5(join7(target, "package.json"), "utf8");
+  const removedWorkspaces = [];
+  await pruneToKeptPaths(target, "", new Set(START_ONLY_KEPT_PATHS), removedWorkspaces);
+  await cp(overlay, target, { recursive: true, force: true });
+  await writeFile4(join7(target, "package.json"), startOnlyRootPackage(rootPackage, overlayPackage));
+  for (const [overlayName, rootName] of Object.entries(START_ROOT_CONTRACTS)) {
+    await rename2(join7(target, overlayName), join7(target, rootName));
+  }
+  await rm4(overlay, { recursive: true, force: true });
+  await rewriteIfPresent(join7(target, "knip.json"), (content) => stripKnipWorkspaces(content, removedWorkspaces));
+  await rewriteIfPresent(join7(target, "pnpm-lock.yaml"), (content) => pruneLockfileImporters(content, removedWorkspaces));
+}
+async function isStartOnlyTree(target) {
+  return await exists(join7(target, "apps/start")) && !await exists(join7(target, "apps/server"));
+}
+async function assembleEditions(target, selection, { keepStartOverlay = false } = {}) {
+  if (!selection.mobile)
+    await removeMobileEdition(target);
+  if (!selection.start)
+    await removeStartEdition(target);
+  if (!selection.web && !await isStartOnlyTree(target))
+    await reduceToStartEdition(target);
+  if (!keepStartOverlay)
+    await rm4(join7(target, START_EDITION_OVERLAY), { recursive: true, force: true });
+}
+async function applyStartIdentity(target, appName) {
+  await rewriteIfPresent(join7(target, "apps/start/wrangler.jsonc"), (content) => rewriteStartWorkerIdentifiers(content, appName));
+}
+async function renameSiteWorker(target, appName) {
+  await rewriteIfPresent(join7(target, "apps/site/wrangler.jsonc"), (content) => rewriteSiteWorkerName(content, appName));
+}
 async function renameFrontendWorker(target, appName) {
   const workerPath = join7(target, "apps/web/wrangler.toml");
   if (!await stat4(workerPath).catch(() => {
@@ -3598,6 +4119,10 @@ async function renameFrontendWorker(target, appName) {
     return;
   await rewriteFile(workerPath, (content) => rewriteWorkerName(content, appName));
 }
+async function generateStartEnvironment(target) {
+  const example = await readFile5(join7(target, "apps/start/.dev.vars.example"), "utf8");
+  await writeFile4(join7(target, "apps/start/.dev.vars"), generateStartDevVars(example));
+}
 async function generateEnvironmentFiles(target, databasePort = 5432) {
   const serverExample = await readFile5(join7(target, "apps/server/.env.example"), "utf8");
   await writeFile4(join7(target, "apps/server/.env"), generateServerEnv(serverExample, undefined, databasePort));
@@ -3674,28 +4199,49 @@ async function scaffold(options) {
   const target = resolve3(options.targetDirectory);
   await assertEmptyTarget(target);
   try {
-    if (options.from)
+    const requested = {
+      web: options.includeWeb,
+      mobile: options.includeMobile,
+      start: options.includeStart
+    };
+    let selection;
+    if (options.from) {
+      selection = chooseEditions(requested, undefined);
       await copyLocalTemplate(options.from, target);
-    else if (options.licenseKey) {
-      await downloadLicensedTemplate(target, options.licenseKey, options.sourceVersion, options.onDownloadProgress);
+    } else if (options.licenseKey) {
+      selection = await downloadLicensedTemplate(target, options.licenseKey, requested, options.sourceVersion, options.onDownloadProgress);
     } else {
       throw new Error(`A local source path or a ${CLI_NAME2} licence key is required.`);
     }
+    await assembleEditions(target, selection);
+    if (selection.mobile) {
+      await applyMobileIdentity(target, options.appName, options.brandName, options.mobileBundleIdentifier, options.mobileAppDomain);
+    }
+    if (selection.start)
+      await applyStartIdentity(target, options.appName);
     const packagePath = join7(target, "package.json");
     const packageReplacements = await rewriteFile(packagePath, (content) => rewriteRootPackageName(content, options.appName));
     await renameFrontendWorker(target, options.appName);
+    await renameSiteWorker(target, options.appName);
     const scope = await applyScopeRewrite(target, options.scope);
-    await neutralizeAgentInstructions(target);
-    await neutralizeSourceCli(target, options.scope, options.brandName);
+    if (selection.web) {
+      await neutralizeAgentInstructions(target);
+      await neutralizeSourceCli(target, options.scope, options.brandName);
+    }
     const brand = await applyBrandRewrite(target, options.brandName);
-    await generateEnvironmentFiles(target, options.databasePort);
+    if (selection.web)
+      await generateEnvironmentFiles(target, options.databasePort);
+    if (selection.start)
+      await generateStartEnvironment(target);
     if (options.initializeGit)
       await initializeRepository(target);
     return {
       targetDirectory: target,
       packageName: { files: packageReplacements > 0 ? 1 : 0, replacements: packageReplacements },
       scope,
-      brand
+      brand,
+      editions: selectedEditions(selection),
+      mobile: selection.mobile
     };
   } catch (error) {
     if ((await stat4(target).catch(() => {
@@ -3710,6 +4256,10 @@ async function scaffold(options) {
 }
 
 // src/cli.ts
+var COMBINING_MARK_RE = /\p{Mark}/gu;
+var NON_ALPHANUMERIC_RE = /[^a-z0-9]+/g;
+var OUTER_DASHES_RE = /^-+|-+$/g;
+
 class CliCancelled extends Error {
 }
 function usage() {
@@ -3723,6 +4273,15 @@ Options:
   --license-key <key> Licence key from your purchase (or set ${LICENSE_KEY_VARIABLE})
   --source-version <version> Pin an immutable release (default: the latest you are entitled to)
   --from <path>       Use a local Git checkout, tracked files only (maintainer/testing)
+  --web / --no-web    Include or exclude the web foundation: the React app and the API
+  --mobile / --no-mobile Include or exclude the mobile edition, which ships with the web
+                      foundation it runs on
+  --start-edition / --no-start-edition Include or exclude the TanStack Start edition
+                      Editions default to whatever your licence entitles you to;
+                      --from defaults to the web foundation alone
+  --bundle-id <id>    Reverse-DNS iOS/Android identifier (default: com.<app-name>.app)
+  --app-domain <host> Host serving your web app, wired as an iOS/Android universal link
+                      so emailed sign-in and invite links open the app (default: none)
   --scope <namespace> Advanced workspace namespace override (default: derived from brand)
   --brand <name>      Display name (default: derived from app name)
   --yes               Accept recommended defaults for omitted options
@@ -3766,7 +4325,23 @@ function parseArguments(argv) {
     const argument = argv[index];
     if (argument === "--from")
       parsed.from = takeValue3(argv, index++, argument);
-    else if (argument === "--license-key")
+    else if (argument === "--web")
+      parsed.includeWeb = true;
+    else if (argument === "--no-web")
+      parsed.includeWeb = false;
+    else if (argument === "--start-edition")
+      parsed.includeStart = true;
+    else if (argument === "--no-start-edition")
+      parsed.includeStart = false;
+    else if (argument === "--mobile")
+      parsed.includeMobile = true;
+    else if (argument === "--no-mobile")
+      parsed.includeMobile = false;
+    else if (argument === "--bundle-id") {
+      parsed.mobileBundleIdentifier = takeValue3(argv, index++, argument);
+    } else if (argument === "--app-domain") {
+      parsed.mobileAppDomain = takeValue3(argv, index++, argument);
+    } else if (argument === "--license-key")
       parsed.licenseKey = takeValue3(argv, index++, argument);
     else if (argument === "--source-version") {
       parsed.sourceVersion = normalizeSourceVersion(takeValue3(argv, index++, argument));
@@ -3834,7 +4409,7 @@ function suggestBrandName(appName) {
   return appName.split("-").map((segment) => productAcronyms[segment] ?? `${segment.charAt(0).toUpperCase()}${segment.slice(1)}`).join(" ");
 }
 function suggestScope(brandName, fallbackAppName) {
-  const namespace = brandName.normalize("NFKD").replace(/\p{Mark}/gu, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  const namespace = brandName.normalize("NFKD").replace(COMBINING_MARK_RE, "").toLowerCase().replace(NON_ALPHANUMERIC_RE, "-").replace(OUTER_DASHES_RE, "");
   return namespace || fallbackAppName;
 }
 async function unwrapPrompt(value) {
@@ -3916,7 +4491,7 @@ async function collectOptions(parsed) {
     message: "Start local development now?",
     initialValue: true
   })));
-  const setupDeployment = parsed.setupDeployment ?? (parsed.yes ? false : await unwrapPrompt(await confirm({
+  const setupDeployment = parsed.setupDeployment ?? (parsed.yes || parsed.includeWeb === false ? false : await unwrapPrompt(await confirm({
     message: "Set up cloud deployment now?",
     initialValue: false
   })));
@@ -3931,7 +4506,12 @@ async function collectOptions(parsed) {
     initializeGit,
     installDependencies,
     startDevelopment,
-    deployment
+    deployment,
+    includeWeb: parsed.includeWeb,
+    includeMobile: parsed.includeMobile,
+    includeStart: parsed.includeStart,
+    mobileBundleIdentifier: parsed.mobileBundleIdentifier,
+    mobileAppDomain: parsed.mobileAppDomain
   };
 }
 async function readCliVersion() {
@@ -4096,7 +4676,7 @@ async function createApplication(options) {
   const preparing = "Preparing your application";
   const reporter = createScaffoldReporter(preparing, Boolean(options.licenseKey));
   try {
-    await runStep(preparing, "Application source prepared", () => scaffold({
+    const report = await runStep(preparing, "Application source prepared", () => scaffold({
       appName: options.appName,
       scope: options.scope,
       brandName: options.brandName,
@@ -4106,9 +4686,14 @@ async function createApplication(options) {
       sourceVersion: options.sourceVersion,
       initializeGit: options.initializeGit,
       databasePort,
-      onDownloadProgress: reporter.onDownloadProgress
+      onDownloadProgress: reporter.onDownloadProgress,
+      includeWeb: options.includeWeb,
+      includeMobile: options.includeMobile,
+      includeStart: options.includeStart,
+      mobileBundleIdentifier: options.mobileBundleIdentifier,
+      mobileAppDomain: options.mobileAppDomain
     }), reporter.handle);
-    if (options.deployment) {
+    if (options.deployment && report.editions.includes("web")) {
       await runStep("Configuring deployment", "Deployment target locked", () => applyDeploymentSelection2(staging, options.appName, options.deployment), spinner());
     }
     if (options.installDependencies) {
@@ -4118,19 +4703,20 @@ async function createApplication(options) {
       return;
     }))
       await rmdir(target);
-    await rename2(staging, target);
-    return { target, databasePort };
+    await rename3(staging, target);
+    return { target, databasePort, editions: report.editions };
   } catch (error) {
     await rm5(staging, { recursive: true, force: true });
     throw error;
   }
 }
-function completionDetails(target, options, databasePort) {
+function completionDetails(target, options, databasePort, editions) {
   const targetName = relative2(process.cwd(), target) || options.appName;
   const install = options.installDependencies ? [] : ["vp install --frozen-lockfile"];
+  const run = editions.includes("web") ? ["pnpm dev"] : ["pnpm db:migrate", "pnpm dev"];
   return {
     directory: `./${targetName}`,
-    commands: [`cd ${targetName}`, ...install, "pnpm dev"].join(`
+    commands: [`cd ${targetName}`, ...install, ...run].join(`
 `),
     database: `Postgres  localhost:${databasePort}`
   };
@@ -4166,14 +4752,28 @@ async function main() {
   }
   intro(`${suggestBrandName(CLI_NAME)} ${version} \xB7 production SaaS foundation`);
   const options = await collectOptions(parsed);
-  const { target, databasePort } = await createApplication(options);
-  const completion = completionDetails(target, options, databasePort);
+  const { target, databasePort, editions } = await createApplication(options);
+  const completion = completionDetails(target, options, databasePort, editions);
   log.success(`Created ${completion.directory}`);
+  if (!editions.includes("web")) {
+    log.step("Run locally");
+    log.info("Start     http://localhost:3003. apps/start/.dev.vars holds a fresh auth secret.\n          Deploy with `pnpm deploy:worker`; see apps/start/docs/deploy.md.");
+    outro(`${options.brandName} is ready.`);
+    printRunnableCommands(completion.commands);
+    return;
+  }
+  const mobile = editions.includes("mobile");
   if (!options.startDevelopment) {
     log.step("Run locally");
     log.info(`Web       http://localhost:5173
 API       http://localhost:8000
 ${completion.database}`);
+    if (editions.includes("start")) {
+      log.info("Start     vp run --filter ./apps/start dev \u2014 http://localhost:3003. See apps/start/README.md.");
+    }
+    if (mobile) {
+      log.info("Mobile    pnpm dev:mobile \u2014 run `npx eas init` inside apps/mobile to claim your own\n          Expo project before the first build. See docs/mobile.md.");
+    }
     if (options.deployment) {
       log.info(`Deployment ${options.deployment.cloud.toUpperCase()} + ${options.deployment.storageProvider} + ${options.deployment.frontendTarget} locked. Review deployment/README.md.`);
     } else {