command_tower 0.16.0 → 0.17.0

data/app/services/command_tower/messaging/rendering/template_resolver.rb

@@ -0,0 +1,128 @@
+# frozen_string_literal: true
+
+require "action_view"
+
+module CommandTower
+  module Messaging
+    module Rendering
+      # Internal Execution-pipeline collaborator (not a Service/Workflow/Controller).
+      #
+      # Resolves one rendered-destination basename (e.g. "email", "sms") to an
+      # ActionView template, preferring a `notification_type_key`-specific view
+      # over the generic one, and preferring the host application's `app/views`
+      # over CommandTower's own engine views for either.
+      #
+      # Host convention (documentation, not code):
+      #
+      #   app/views/command_tower/messaging/rendering/
+      #     email.html.erb                     # optional host override of the generic chrome
+      #     <notification_type_key>/email.html.erb  # optional type-specific override
+      #
+      # Hosts customize by dropping ERB files at that path; they never call this
+      # class directly. `ChannelRenderer` remains the only public Ruby entry into
+      # rendering. `prepend_view_path`/`reset_view_paths!` exist solely as a
+      # messaging spec fixture seam (mirrors Rails' own `prepend_view_path`
+      # testing idiom) and are not part of any host-facing contract.
+      class TemplateResolver
+        TEMPLATE_PREFIX = "command_tower/messaging/rendering"
+        TYPE_KEY_PATTERN = /\A[a-z0-9_]+\z/
+
+        class << self
+          def render(basename:, format:, notification_type_key:, generic_locals:, type_locals:)
+            new.render(
+              basename:,
+              format:,
+              notification_type_key:,
+              generic_locals:,
+              type_locals:,
+            )
+          end
+
+          # Spec-only seam: prepend an additional view root ahead of the host
+          # and engine defaults so fixture views can prove override precedence.
+          def prepend_view_path(path)
+            extra_view_paths.unshift(path.to_s)
+          end
+
+          def reset_view_paths!
+            extra_view_paths.clear
+          end
+
+          # Type-only, no-generic-fallback resolution: returns `nil` when
+          # there is no matching type template (invalid/sanitized-out key, or
+          # the type directory/basename simply does not exist) instead of
+          # raising `Errno::ENOENT` like `.render` does. Callers that have no
+          # generic ERB file to fall back to (e.g. `InboxDocumentRenderer`,
+          # whose generic path is a pure-Ruby builder) use this instead of
+          # `.render`. A template that is *found* but raises mid-render still
+          # propagates (via `render_named`'s `ActionView::Template::Error`
+          # unwrap) so callers can distinguish "no type content" from "type
+          # content is broken" if they choose to.
+          def render_type_template(basename:, format:, notification_type_key:, locals:)
+            new.render_type_template(basename:, format:, notification_type_key:, locals:)
+          end
+
+          def extra_view_paths
+            @extra_view_paths ||= []
+          end
+        end
+
+        def render(basename:, format:, notification_type_key:, generic_locals:, type_locals:)
+          type_key = sanitized_type_key(notification_type_key)
+
+          if type_key
+            begin
+              return render_named("#{TEMPLATE_PREFIX}/#{type_key}/#{basename}", format, type_locals)
+            rescue ActionView::MissingTemplate
+              # No type-specific template for this basename; fall through to generic.
+            end
+          end
+
+          begin
+            render_named("#{TEMPLATE_PREFIX}/#{basename}", format, generic_locals)
+          rescue ActionView::MissingTemplate
+            raise Errno::ENOENT, "missing template #{basename}.#{format}.erb"
+          end
+        end
+
+        def render_type_template(basename:, format:, notification_type_key:, locals:)
+          type_key = sanitized_type_key(notification_type_key)
+          return nil unless type_key
+
+          render_named("#{TEMPLATE_PREFIX}/#{type_key}/#{basename}", format, locals)
+        rescue ActionView::MissingTemplate
+          nil
+        end
+
+        private
+
+        def sanitized_type_key(notification_type_key)
+          key = notification_type_key.to_s
+          key.match?(TYPE_KEY_PATTERN) ? key : nil
+        end
+
+        def render_named(template_name, format, locals)
+          view.render(template: template_name, formats: [format], locals:)
+        rescue ActionView::Template::Error => error
+          # ActionView wraps any error raised while executing a *found*
+          # template in `ActionView::Template::Error`. Legacy plain-ERB
+          # rendering never wrapped errors, so unwrap here to preserve the
+          # original `error_class` that `ChannelRenderer#render`'s outer
+          # rescue surfaces on `RenderError`.
+          raise(error.cause || error)
+        end
+
+        def view
+          @view ||= ActionView::Base.with_empty_template_cache.with_view_paths(view_paths)
+        end
+
+        def view_paths
+          self.class.extra_view_paths + [
+            Rails.root.join("app/views").to_s,
+            CommandTower::Engine.root.join("app/views").to_s,
+          ]
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/client_compatibility/evaluate.rb

@@ -0,0 +1,219 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module ClientCompatibility
+      # Pure, deterministic client-version-compatibility decision.
+      #
+      # Same (headers, controller/action, registry state) always produces the
+      # same complete `Decision`. This service MUST NOT mutate
+      # `CommandTower::Current` or any other request-global — it has zero side
+      # effects beyond returning its result. Any placement of recommendation
+      # metadata onto `Current` is transport plumbing that belongs to the
+      # workflow or boundary layer, never here.
+      class Evaluate
+        DECISIONS = %i[compatible recommended incompatible identity_invalid].freeze
+
+        # Immutable decision/projection. `recommendation_projection` is the
+        # camelCase `clientCompatibility` shape (authority §13), present only
+        # when identity is parseable and current >= effective minimum.
+        class Decision
+          attr_reader :decision, :platform, :current_version, :effective_minimum, :scope,
+                      :recovery, :update_url, :matched_entity_names, :recommendation_projection
+
+          def initialize(
+            decision:,
+            platform: nil,
+            current_version: nil,
+            effective_minimum: nil,
+            scope: nil,
+            recovery: nil,
+            update_url: nil,
+            matched_entity_names: [],
+            recommendation_projection: nil
+          )
+            @decision = decision
+            @platform = platform
+            @current_version = current_version
+            @effective_minimum = effective_minimum
+            @scope = scope
+            @recovery = recovery
+            @update_url = update_url
+            @matched_entity_names = matched_entity_names
+            @recommendation_projection = recommendation_projection
+          end
+
+          def compatible? = %i[compatible recommended].include?(@decision)
+
+          def incompatible? = !compatible?
+        end
+
+        def self.call(app_version_header:, platform_header:, controller_class:, action_name:, registry: CommandTower.config.registry.client_compatibility)
+          new(
+            app_version_header:,
+            platform_header:,
+            controller_class:,
+            action_name:,
+            registry:
+          ).call
+        end
+
+        def initialize(app_version_header:, platform_header:, controller_class:, action_name:, registry:)
+          @app_version_header = app_version_header
+          @platform_header = platform_header
+          @controller_class = controller_class
+          @action_name = action_name.to_s
+          @registry = registry
+        end
+
+        def call
+          return no_op_decision unless registry.opted_in?
+
+          platform = normalized_platform
+          version = normalized_version
+          return identity_invalid_decision(platform:) if platform.nil? || version.nil?
+
+          policy = registry.platform_policy(platform)
+          return identity_invalid_decision(platform:, current_version: version) if policy.nil?
+
+          matched = matched_entity_names
+          effective_minimum, scope = effective_minimum_and_scope(policy:, platform:, matched:)
+
+          current = Gem::Version.new(version)
+          minimum = Gem::Version.new(effective_minimum)
+
+          if current < minimum
+            return incompatible_decision(
+              platform:, current_version: version, effective_minimum:, scope:, matched:, policy:
+            )
+          end
+
+          compatible_or_recommended_decision(
+            platform:, current_version: version, effective_minimum:, matched:, policy:, current:
+          )
+        end
+
+        private
+
+        attr_reader :controller_class, :action_name, :registry
+
+        def normalized_platform
+          token = @platform_header.to_s.strip.downcase
+          return nil if token.empty?
+          return nil unless CommandTower::Configuration::Registry::ClientCompatibility::Config::PLATFORMS.map(&:to_s).include?(token)
+
+          token.to_sym
+        end
+
+        def normalized_version
+          CommandTower::ClientCompatibility::Version.normalize(@app_version_header)
+        end
+
+        def matched_entity_names
+          CommandTower::Authorization::Entity.entities.values
+            .select { |entity| entity.matches?(controller: controller_class, method: action_name.to_sym) == true }
+            .map { |entity| entity.name.to_s }
+        end
+
+        def effective_minimum_and_scope(policy:, platform:, matched:)
+          strictest = policy.minimum
+          scope = :application
+
+          matched.each do |entity_name|
+            requirement = registry.entity_requirement(entity_name)
+            next if requirement.nil?
+
+            entity_minimum = entity_minimum_for(requirement, platform:)
+            next if entity_minimum.nil?
+
+            if Gem::Version.new(entity_minimum) > Gem::Version.new(strictest)
+              strictest = entity_minimum
+              scope = :capability
+            end
+          end
+
+          [strictest, scope]
+        end
+
+        def entity_minimum_for(requirement, platform:)
+          if requirement.client_contract.present?
+            binding = registry.binding_for(requirement.client_contract)
+            binding&.for_platform(platform)
+          else
+            requirement.minimum.for_platform(platform)
+          end
+        end
+
+        def no_op_decision
+          Decision.new(decision: :compatible)
+        end
+
+        def identity_invalid_decision(platform: nil, current_version: nil)
+          Decision.new(
+            decision: :identity_invalid,
+            platform:,
+            current_version:,
+            scope: :application,
+            recovery: recovery_for(platform),
+            update_url: update_url_for(platform)
+          )
+        end
+
+        def incompatible_decision(platform:, current_version:, effective_minimum:, scope:, matched:, policy:)
+          Decision.new(
+            decision: :incompatible,
+            platform:,
+            current_version:,
+            effective_minimum:,
+            scope:,
+            recovery: recovery_for(platform),
+            update_url: update_url_for(platform),
+            matched_entity_names: matched,
+            recommendation_projection: nil
+          )
+        end
+
+        def compatible_or_recommended_decision(platform:, current_version:, effective_minimum:, matched:, policy:, current:)
+          recommended = policy.recommended
+          update_available = recommended.present? && current < Gem::Version.new(recommended)
+
+          Decision.new(
+            decision: update_available ? :recommended : :compatible,
+            platform:,
+            current_version:,
+            effective_minimum:,
+            scope: :application,
+            matched_entity_names: matched,
+            recommendation_projection: recommendation_projection(
+              platform:, current_version:, effective_minimum:, recommended:, update_available:
+            )
+          )
+        end
+
+        def recommendation_projection(platform:, current_version:, effective_minimum:, recommended:, update_available:)
+          {
+            platform: platform.to_s,
+            currentVersion: current_version,
+            minimumVersion: effective_minimum,
+            recommendedVersion: recommended,
+            updateAvailable: update_available,
+            recovery: recovery_for(platform).to_s,
+            updateUrl: update_url_for(platform)
+          }.compact
+        end
+
+        def recovery_for(platform)
+          return :reload if platform.nil? || platform == :web
+
+          :app_store
+        end
+
+        def update_url_for(platform)
+          return nil if platform.nil? || platform == :web
+
+          registry.platform_policy(platform)&.update_url
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/messaging/inbox.rb

@@ -120,7 +120,14 @@ module CommandTower
             communication = CommandTower::Messaging::Contract::Communications.find(
               CommandTower::Messaging::Contract::Requests::FindCommunication.build(communication_id: item.communication_id, recipient_id:)
             )
-            item(item).merge(body: communication.body, metadata: communication.metadata, notification_type_key: communication.notification_type_key)
+            content = CommandTower::Messaging::Rendering::InboxDocumentRenderer.render(communication:, recipient_id:).to_h
+
+            item(item).merge(
+              body: communication.body,
+              metadata: communication.metadata,
+              notification_type_key: communication.notification_type_key,
+              content:,
+            )
           end
         end
       end

data/app/views/command_tower/email_verification_mailer/verify_email.html.erb

@@ -1,11 +1,12 @@
-<table width="100%" cellpadding="0" cellspacing="0" border="0" style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif; background-color: #f5f7fa; padding: 40px 20px;">
+<% theme = CommandTower::EmailTheme::Resolver.resolve -%>
+<table width="100%" cellpadding="0" cellspacing="0" border="0" style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif; background-color: <%= theme[:canvas_background] %>; padding: 40px 20px;">
   <tr>
     <td align="center">
-      <table width="600" cellpadding="0" cellspacing="0" border="0" style="background-color: #ffffff; border-radius: 12px; box-shadow: 0 4px 6px rgba(0, 0, 0, 0.1); overflow: hidden;">
+      <table width="600" cellpadding="0" cellspacing="0" border="0" style="background-color: <%= theme[:surface_background] %>; border-radius: 12px; box-shadow: 0 4px 6px rgba(0, 0, 0, 0.1); overflow: hidden;">
         <!-- Header -->
         <tr>
-          <td style="background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); padding: 40px 30px; text-align: center;">
-            <h1 style="margin: 0; color: #ffffff; font-size: 28px; font-weight: 600; letter-spacing: -0.5px;">
+          <td style="background: <%= theme[:accent] %>; padding: 40px 30px; text-align: center;">
+            <h1 style="margin: 0; color: <%= theme[:text_on_accent] %>; font-size: 28px; font-weight: 600; letter-spacing: -0.5px;">
               Welcome to <%= CommandTower.config.app.communication_name %>!
             </h1>
           </td>
@@ -14,44 +15,44 @@
         <!-- Content -->
         <tr>
           <td style="padding: 40px 30px;">
-            <p style="margin: 0 0 20px 0; color: #4a5568; font-size: 16px; line-height: 1.6;">
-              Hello <strong style="color: #2d3748;"><%= @user.full_name %></strong>,
+            <p style="margin: 0 0 20px 0; color: <%= theme[:body_text] %>; font-size: 16px; line-height: 1.6;">
+              Hello <strong style="color: <%= theme[:primary_text] %>;"><%= @user.full_name %></strong>,
             </p>
 
-            <p style="margin: 0 0 30px 0; color: #4a5568; font-size: 16px; line-height: 1.6;">
+            <p style="margin: 0 0 30px 0; color: <%= theme[:body_text] %>; font-size: 16px; line-height: 1.6;">
               Thank you for joining us! To complete your registration and verify your email address, please use the verification code below:
             </p>
 
             <!-- Verification Code Box -->
             <table width="100%" cellpadding="0" cellspacing="0" border="0" style="margin: 30px 0;">
               <tr>
-                <td align="center" style="padding: 30px; background: linear-gradient(135deg, #f6f8fb 0%, #e9ecef 100%); border-radius: 8px; border: 2px dashed #cbd5e0;">
-                  <div style="font-size: 36px; font-weight: 700; letter-spacing: 8px; color: #667eea; font-family: 'Courier New', monospace; text-align: center;">
+                <td align="center" style="padding: 30px; background-color: <%= theme[:canvas_background] %>; border-radius: 8px; border: 2px dashed <%= theme[:surface_border] %>;">
+                  <div style="font-size: 36px; font-weight: 700; letter-spacing: 8px; color: <%= theme[:accent] %>; font-family: 'Courier New', monospace; text-align: center;">
                     <%= @code %>
                   </div>
-                  <p style="margin: 15px 0 0 0; color: #718096; font-size: 12px; text-transform: uppercase; letter-spacing: 1px;">
+                  <p style="margin: 15px 0 0 0; color: <%= theme[:muted_text] %>; font-size: 12px; text-transform: uppercase; letter-spacing: 1px;">
                     Verification Code
                   </p>
                 </td>
               </tr>
             </table>
 
-            <p style="margin: 30px 0 20px 0; color: #718096; font-size: 14px; line-height: 1.6;">
-              <strong style="color: #4a5568;">Important:</strong> This code will expire in <%= CommandTower.config.login.plain_text.email_verify.verify_code_link_valid_for.inspect %>. If you didn't request this code, please ignore this email.
+            <p style="margin: 30px 0 20px 0; color: <%= theme[:muted_text] %>; font-size: 14px; line-height: 1.6;">
+              <strong style="color: <%= theme[:body_text] %>;">Important:</strong> This code will expire in <%= CommandTower.config.login.plain_text.email_verify.verify_code_link_valid_for.inspect %>. If you didn't request this code, please ignore this email.
             </p>
           </td>
         </tr>
 
         <!-- Footer -->
         <tr>
-          <td style="padding: 30px; background-color: #f7fafc; border-top: 1px solid #e2e8f0;">
-            <p style="margin: 0 0 15px 0; color: #4a5568; font-size: 14px; text-align: center; line-height: 1.6;">
+          <td style="padding: 30px; background-color: <%= theme[:canvas_background] %>; border-top: 1px solid <%= theme[:surface_border] %>;">
+            <p style="margin: 0 0 15px 0; color: <%= theme[:body_text] %>; font-size: 14px; text-align: center; line-height: 1.6;">
               Best regards,<br>
-              <strong style="color: #667eea;"><%= CommandTower.config.app.communication_name %> Team</strong>
+              <strong style="color: <%= theme[:accent] %>;"><%= CommandTower.config.app.communication_name %> Team</strong>
             </p>
 
             <p style="margin: 0; text-align: center;">
-              <a href="<%= CommandTower.config.app.composed_url %>" target="_blank" style="color: #667eea; text-decoration: none; font-size: 14px; font-weight: 500;">
+              <a href="<%= CommandTower.config.app.composed_url %>" target="_blank" style="color: <%= theme[:primary_action] %>; text-decoration: none; font-size: 14px; font-weight: 500;">
                 Visit <%= CommandTower.config.app.communication_name %>
               </a>
             </p>
@@ -63,7 +64,7 @@
       <table width="600" cellpadding="0" cellspacing="0" border="0" style="margin-top: 20px;">
         <tr>
           <td style="text-align: center; padding: 20px 0;">
-            <p style="margin: 0; color: #a0aec0; font-size: 12px; line-height: 1.5;">
+            <p style="margin: 0; color: <%= theme[:muted_text] %>; font-size: 12px; line-height: 1.5;">
               This is an automated message. Please do not reply to this email.
             </p>
           </td>

data/app/views/command_tower/messaging/rendering/email.html.erb

@@ -1,21 +1,22 @@
-<table width="100%" cellpadding="0" cellspacing="0" border="0" style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif; background-color: #f4f5f7; padding: 32px 16px;">
+<% theme = CommandTower::EmailTheme::Resolver.resolve -%>
+<table width="100%" cellpadding="0" cellspacing="0" border="0" style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif; background-color: <%= theme[:canvas_background] %>; padding: 32px 16px;">
   <tr>
     <td align="center">
-      <table width="600" cellpadding="0" cellspacing="0" border="0" style="background-color: #ffffff; border: 1px solid #e2e8f0; border-radius: 8px; overflow: hidden;">
+      <table width="600" cellpadding="0" cellspacing="0" border="0" style="background-color: <%= theme[:surface_background] %>; border: 1px solid <%= theme[:surface_border] %>; border-radius: 8px; overflow: hidden;">
         <tr>
           <td style="padding: 28px 28px 8px 28px;">
-            <h1 style="margin: 0; color: #1a202c; font-size: 22px; font-weight: 600; line-height: 1.35;">
+            <h1 style="margin: 0; color: <%= theme[:primary_text] %>; font-size: 22px; font-weight: 600; line-height: 1.35;">
               <%= h.call(title) %>
             </h1>
           </td>
         </tr>
         <tr>
           <td style="padding: 8px 28px 28px 28px;">
-            <p style="margin: 0; color: #4a5568; font-size: 16px; line-height: 1.6; white-space: pre-wrap;">
+            <p style="margin: 0; color: <%= theme[:body_text] %>; font-size: 16px; line-height: 1.6; white-space: pre-wrap;">
 <%= h.call(body) %></p>
             <% if deep_link -%>
             <p style="margin: 24px 0 0 0;">
-              <a href="<%= h.call(deep_link) %>" style="color: #2b6cb0; font-size: 14px; text-decoration: underline;">
+              <a href="<%= h.call(deep_link) %>" style="color: <%= theme[:primary_action] %>; font-size: 14px; text-decoration: underline;">
                 <%= h.call(deep_link) %>
               </a>
             </p>

data/app/views/command_tower/password_reset_mailer/reset_password.html.erb

@@ -1,11 +1,12 @@
-<table width="100%" cellpadding="0" cellspacing="0" border="0" style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif; background-color: #f5f7fa; padding: 40px 20px;">
+<% theme = CommandTower::EmailTheme::Resolver.resolve -%>
+<table width="100%" cellpadding="0" cellspacing="0" border="0" style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif; background-color: <%= theme[:canvas_background] %>; padding: 40px 20px;">
   <tr>
     <td align="center">
-      <table width="600" cellpadding="0" cellspacing="0" border="0" style="background-color: #ffffff; border-radius: 12px; box-shadow: 0 4px 6px rgba(0, 0, 0, 0.1); overflow: hidden;">
+      <table width="600" cellpadding="0" cellspacing="0" border="0" style="background-color: <%= theme[:surface_background] %>; border-radius: 12px; box-shadow: 0 4px 6px rgba(0, 0, 0, 0.1); overflow: hidden;">
         <!-- Header -->
         <tr>
-          <td style="background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); padding: 40px 30px; text-align: center;">
-            <h1 style="margin: 0; color: #ffffff; font-size: 28px; font-weight: 600; letter-spacing: -0.5px;">
+          <td style="background: <%= theme[:accent] %>; padding: 40px 30px; text-align: center;">
+            <h1 style="margin: 0; color: <%= theme[:text_on_accent] %>; font-size: 28px; font-weight: 600; letter-spacing: -0.5px;">
               Reset Your Password
             </h1>
           </td>
@@ -14,22 +15,22 @@
         <!-- Content -->
         <tr>
           <td style="padding: 40px 30px;">
-            <p style="margin: 0 0 20px 0; color: #4a5568; font-size: 16px; line-height: 1.6;">
-              Hello <strong style="color: #2d3748;"><%= @user.full_name %></strong>,
+            <p style="margin: 0 0 20px 0; color: <%= theme[:body_text] %>; font-size: 16px; line-height: 1.6;">
+              Hello <strong style="color: <%= theme[:primary_text] %>;"><%= @user.full_name %></strong>,
             </p>
 
-            <p style="margin: 0 0 30px 0; color: #4a5568; font-size: 16px; line-height: 1.6;">
+            <p style="margin: 0 0 30px 0; color: <%= theme[:body_text] %>; font-size: 16px; line-height: 1.6;">
               We received a request to reset your password for your <%= CommandTower.config.app.communication_name %> account. Click the button below to reset your password:
             </p>
 
             <!-- Reset Token Box -->
             <table width="100%" cellpadding="0" cellspacing="0" border="0" style="margin: 30px 0;">
               <tr>
-                <td align="center" style="padding: 30px; background: linear-gradient(135deg, #f6f8fb 0%, #e9ecef 100%); border-radius: 8px; border: 2px dashed #cbd5e0;">
-                  <div style="font-size: 18px; font-weight: 600; color: #667eea; font-family: 'Courier New', monospace; text-align: center; word-break: break-all; padding: 10px;">
+                <td align="center" style="padding: 30px; background-color: <%= theme[:canvas_background] %>; border-radius: 8px; border: 2px dashed <%= theme[:surface_border] %>;">
+                  <div style="font-size: 18px; font-weight: 600; color: <%= theme[:accent] %>; font-family: 'Courier New', monospace; text-align: center; word-break: break-all; padding: 10px;">
                     <%= @token %>
                   </div>
-                  <p style="margin: 15px 0 0 0; color: #718096; font-size: 12px; text-transform: uppercase; letter-spacing: 1px;">
+                  <p style="margin: 15px 0 0 0; color: <%= theme[:muted_text] %>; font-size: 12px; text-transform: uppercase; letter-spacing: 1px;">
                     Reset Token
                   </p>
                 </td>
@@ -42,30 +43,30 @@
                 <td align="center" style="padding: 15px 0;">
                   <% reset_url = "#{CommandTower.config.app.composed_url}#{@reset_password_path}?token=#{@token}" %>
                   <% reset_url += "&email=#{CGI.escape(@email)}" if @require_email %>
-                  <a href="<%= reset_url %>" style="display: inline-block; padding: 14px 32px; background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); color: #ffffff; text-decoration: none; border-radius: 8px; font-weight: 600; font-size: 16px; text-align: center;">
+                  <a href="<%= reset_url %>" style="display: inline-block; padding: 14px 32px; background-color: <%= theme[:primary_action] %>; color: <%= theme[:text_on_accent] %>; text-decoration: none; border-radius: 8px; font-weight: 600; font-size: 16px; text-align: center;">
                     Reset Password
                   </a>
                 </td>
               </tr>
             </table>
 
-            <p style="margin: 30px 0 20px 0; color: #718096; font-size: 14px; line-height: 1.6;">
-              <strong style="color: #4a5568;">Important:</strong> This link will expire in <%= CommandTower.config.login.plain_text.password_reset.token_valid_for.inspect %>. If you didn't request a password reset, please ignore this email. Your password will remain unchanged.
+            <p style="margin: 30px 0 20px 0; color: <%= theme[:muted_text] %>; font-size: 14px; line-height: 1.6;">
+              <strong style="color: <%= theme[:body_text] %>;">Important:</strong> This link will expire in <%= CommandTower.config.login.plain_text.password_reset.token_valid_for.inspect %>. If you didn't request a password reset, please ignore this email. Your password will remain unchanged.
             </p>
 
-            <p style="margin: 20px 0 0 0; color: #718096; font-size: 14px; line-height: 1.6;">
+            <p style="margin: 20px 0 0 0; color: <%= theme[:muted_text] %>; font-size: 14px; line-height: 1.6;">
               If the button above doesn't work, copy and paste the reset token above into the password reset form on our website.
             </p>
 
             <!-- Alternative Reset URL Link -->
             <table width="100%" cellpadding="0" cellspacing="0" border="0" style="margin: 30px 0 0 0;">
               <tr>
-                <td align="center" style="padding: 20px; background-color: #f7fafc; border-radius: 8px; border: 1px solid #e2e8f0;">
-                  <p style="margin: 0 0 10px 0; color: #4a5568; font-size: 14px; font-weight: 600;">
+                <td align="center" style="padding: 20px; background-color: <%= theme[:canvas_background] %>; border-radius: 8px; border: 1px solid <%= theme[:surface_border] %>;">
+                  <p style="margin: 0 0 10px 0; color: <%= theme[:body_text] %>; font-size: 14px; font-weight: 600;">
                     Or visit the reset password page directly:
                   </p>
-                  <p style="margin: 0; color: #667eea; font-size: 14px; word-break: break-all;">
-                    <a href="<%= CommandTower.config.app.composed_url %><%= @reset_password_path %>" style="color: #667eea; text-decoration: underline;">
+                  <p style="margin: 0; color: <%= theme[:primary_action] %>; font-size: 14px; word-break: break-all;">
+                    <a href="<%= CommandTower.config.app.composed_url %><%= @reset_password_path %>" style="color: <%= theme[:primary_action] %>; text-decoration: underline;">
                       <%= CommandTower.config.app.composed_url %><%= @reset_password_path %>
                     </a>
                   </p>
@@ -77,14 +78,14 @@
 
         <!-- Footer -->
         <tr>
-          <td style="padding: 30px; background-color: #f7fafc; border-top: 1px solid #e2e8f0;">
-            <p style="margin: 0 0 15px 0; color: #4a5568; font-size: 14px; text-align: center; line-height: 1.6;">
+          <td style="padding: 30px; background-color: <%= theme[:canvas_background] %>; border-top: 1px solid <%= theme[:surface_border] %>;">
+            <p style="margin: 0 0 15px 0; color: <%= theme[:body_text] %>; font-size: 14px; text-align: center; line-height: 1.6;">
               Best regards,<br>
-              <strong style="color: #667eea;"><%= CommandTower.config.app.communication_name %> Team</strong>
+              <strong style="color: <%= theme[:accent] %>;"><%= CommandTower.config.app.communication_name %> Team</strong>
             </p>
 
             <p style="margin: 0; text-align: center;">
-              <a href="<%= CommandTower.config.app.composed_url %>" target="_blank" style="color: #667eea; text-decoration: none; font-size: 14px; font-weight: 500;">
+              <a href="<%= CommandTower.config.app.composed_url %>" target="_blank" style="color: <%= theme[:primary_action] %>; text-decoration: none; font-size: 14px; font-weight: 500;">
                 Visit <%= CommandTower.config.app.communication_name %>
               </a>
             </p>
@@ -96,7 +97,7 @@
       <table width="600" cellpadding="0" cellspacing="0" border="0" style="margin-top: 20px;">
         <tr>
           <td style="text-align: center; padding: 20px 0;">
-            <p style="margin: 0; color: #a0aec0; font-size: 12px; line-height: 1.5;">
+            <p style="margin: 0; color: <%= theme[:muted_text] %>; font-size: 12px; line-height: 1.5;">
               This is an automated message. Please do not reply to this email.
             </p>
           </td>

data/app/workflows/command_tower/workflows/auth/plain_text/login_workflow.rb

@@ -5,6 +5,8 @@ module CommandTower
     module Auth
       module PlainText
         class LoginWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          include CommandTower::Workflows::ClientCompatibility::RecommendationMeta
+
           retry_strategy :none
 
           def call(input:, request_context: nil)
@@ -24,6 +26,7 @@ module CommandTower
                   token_expires_at: data[:expires_at]
                 ),
                 http_status: :created,
+                meta: client_compatibility_meta,
                 response_effects: {
                   set_token: { token: data[:token], expires_at: data[:expires_at] },
                   ensure_csrf_cookie: { rotate: csrf_rotate_on_login? }

data/app/workflows/command_tower/workflows/auth/session/show_workflow.rb

@@ -5,6 +5,8 @@ module CommandTower
     module Auth
       module Session
         class ShowWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          include CommandTower::Workflows::ClientCompatibility::RecommendationMeta
+
           retry_strategy :none
 
           def call(current_user:, auth_context:)
@@ -30,6 +32,7 @@ module CommandTower
                 actor: auth_context.actor_user
               ),
               http_status: :ok,
+              meta: client_compatibility_meta,
               response_effects: response_effects
             )
           end